vouchington-tooling 0.0.9 → 0.0.11

package/dist/pg-schema-snapshot/types.d.mts

@@ -0,0 +1,103 @@
+export type CatalogQuery = <Row extends Record<string, unknown>>(sql: string, values?: readonly unknown[]) => Promise<{
+    rows: Row[];
+}>;
+export type PartitionPolicy = {
+    strategy: 'RANGE' | 'LIST -> RANGE';
+    key: string;
+    children: 'default' | 'monthly' | 'list-default-range';
+    retentionOwner: string | null;
+    accessClass: string;
+};
+export type SchemaGrowthMaps = {
+    partitionPolicies: ReadonlyMap<string, PartitionPolicy>;
+    unboundedUnpartitionedTables: ReadonlySet<string>;
+};
+export type SchemaColumnSnapshot = {
+    type: string;
+    nullable: boolean;
+    defaultExpression: string | null;
+    generatedExpression: string | null;
+    identity: 'always' | 'by default' | null;
+    generated: 'stored' | 'virtual' | null;
+    collation: string | null;
+    comment: string | null;
+    ordinalPosition: number;
+};
+export type SchemaKeyConstraintSnapshot = {
+    definition: string;
+    columns: string[];
+};
+export type SchemaForeignKeySnapshot = SchemaKeyConstraintSnapshot & {
+    referencedTable: string;
+    referencedColumns: string[];
+    onUpdate: 'no action' | 'restrict' | 'cascade' | 'set null' | 'set default';
+    onDelete: 'no action' | 'restrict' | 'cascade' | 'set null' | 'set default';
+    validated: boolean;
+};
+export type SchemaIndexKeySnapshot = {
+    column: string | null;
+    expression: string;
+    opclass: string;
+    descending: boolean;
+    nullsFirst: boolean;
+};
+export type SchemaIndexSnapshot = {
+    definition: string;
+    accessMethod: string;
+    unique: boolean;
+    primary: boolean;
+    constraintBacked: boolean;
+    valid: boolean;
+    ready: boolean;
+    keys: SchemaIndexKeySnapshot[];
+    includedColumns: string[];
+    predicate: string | null;
+};
+export type SchemaPhysicalPartitionSnapshot = {
+    strategy: 'hash' | 'list' | 'range';
+    key: string;
+};
+export type SchemaTableSnapshot = {
+    relationKind: 'table' | 'partitioned table';
+    columns: Record<string, SchemaColumnSnapshot>;
+    primaryKey: SchemaKeyConstraintSnapshot | null;
+    uniqueConstraints: Record<string, SchemaKeyConstraintSnapshot>;
+    checkConstraints: Record<string, string>;
+    foreignKeys: Record<string, SchemaForeignKeySnapshot>;
+    indexes: Record<string, SchemaIndexSnapshot>;
+    triggers: Record<string, string>;
+    comment: string | null;
+    physicalPartition: SchemaPhysicalPartitionSnapshot | null;
+    partition: PartitionPolicy | null;
+    growth: 'bounded' | 'unbounded';
+};
+export type SchemaViewSnapshot = {
+    definition: string;
+    comment: string | null;
+    materialized: boolean;
+};
+export type SchemaEnumSnapshot = {
+    values: string[];
+};
+export type SchemaExtensionSnapshot = {
+    version: string;
+};
+export type SchemaFunctionSnapshot = {
+    definition: string;
+};
+export type SchemaPolicySnapshot = {
+    table: string;
+    command: string;
+    pgRoles: string[];
+    using: string | null;
+    withCheck: string | null;
+};
+export type SchemaSnapshot = {
+    formatVersion: 2;
+    tables: Record<string, SchemaTableSnapshot>;
+    views: Record<string, SchemaViewSnapshot>;
+    enums: Record<string, SchemaEnumSnapshot>;
+    extensions: Record<string, SchemaExtensionSnapshot>;
+    functions: Record<string, SchemaFunctionSnapshot>;
+    policies: Record<string, SchemaPolicySnapshot>;
+};

package/dist/pg-schema-snapshot/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/process-line-buffer/index.d.mts

@@ -0,0 +1,7 @@
+export declare const DEFAULT_TRUNCATED_LINE_MARKER = " [oversized line truncated] ";
+export declare const DEFAULT_MAX_PENDING_LINE_LENGTH: number;
+export declare function boundPendingLine(value: string, marker?: string, maxLength?: number): string;
+export declare function splitCompleteLines(value: string): {
+    complete: string[];
+    pending: string;
+};

package/dist/process-line-buffer/index.mjs

@@ -0,0 +1,28 @@
+export const DEFAULT_TRUNCATED_LINE_MARKER = ' [oversized line truncated] ';
+export const DEFAULT_MAX_PENDING_LINE_LENGTH = 64 * 1024;
+export function boundPendingLine(value, marker = DEFAULT_TRUNCATED_LINE_MARKER, maxLength = DEFAULT_MAX_PENDING_LINE_LENGTH) {
+    if (value.length <= maxLength)
+        return value;
+    if (marker.length >= maxLength)
+        return marker;
+    const retainedLength = maxLength - marker.length;
+    const headLength = Math.floor(retainedLength / 2);
+    const tailLength = retainedLength - headLength;
+    return value.slice(0, headLength) + marker + value.slice(-tailLength);
+}
+export function splitCompleteLines(value) {
+    const complete = [];
+    let start = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index];
+        if (character !== '\n' && character !== '\r')
+            continue;
+        if (character === '\r' && index === value.length - 1)
+            break;
+        if (character === '\r' && value[index + 1] === '\n')
+            index += 1;
+        complete.push(value.slice(start, index + 1));
+        start = index + 1;
+    }
+    return { complete, pending: value.slice(start) };
+}

package/dist/shared-context/{fake-git.test-helpers.d.mts → fake-git.d.mts}

@@ -8,4 +8,5 @@ export type FakeGitOptions = {
     trackedFiles?: readonly string[];
 };
 export declare function installFakeGit({ binDir, isInsideWorkTree, lsFilesExitCode, lsFilesStderr, pathPrefix, repoRoot, trackedFiles, }: FakeGitOptions): void;
+export declare function setFakeGitTrackedFiles(files: readonly string[]): void;
 export declare function clearFakeGitEnv(): void;

package/dist/shared-context/{fake-git.test-helpers.mjs → fake-git.mjs}

@@ -15,7 +15,10 @@ export function installFakeGit({ binDir, isInsideWorkTree = true, lsFilesExitCod
     process.env[FAKE_GIT_LS_FILES_STDERR] = lsFilesStderr;
     if (repoRoot !== undefined)
         process.env[FAKE_GIT_ROOT] = repoRoot;
-    process.env[FAKE_GIT_FILES] = [...trackedFiles].toSorted().join('\n');
+    setFakeGitTrackedFiles(trackedFiles);
+}
+export function setFakeGitTrackedFiles(files) {
+    process.env[FAKE_GIT_FILES] = [...files].toSorted().join('\n');
 }
 export function clearFakeGitEnv() {
     process.env.FAKE_GIT_INSIDE = 'false';

package/dist/shared-context/index.d.mts

@@ -1,3 +1,5 @@
+export { clearFakeGitEnv, installFakeGit, setFakeGitTrackedFiles } from './fake-git.mts';
+export type { FakeGitOptions } from './fake-git.mts';
 export declare function gitEnv(): NodeJS.ProcessEnv;
 export interface SharedContext {
     repoRoot: string;

package/dist/shared-context/index.mjs

@@ -3,6 +3,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
 const execFileAsync = promisify(execFile);
+export { clearFakeGitEnv, installFakeGit, setFakeGitTrackedFiles } from './fake-git.mjs';
 export function gitEnv() {
     return Object.fromEntries(Object.entries(process.env).filter(([k]) => !k.startsWith('GIT_')));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -65,6 +65,36 @@
       "import": "./dist/shared-context/index.mjs",
       "default": "./dist/shared-context/index.mjs"
     },
+    "./gha-selected-files": {
+      "types": "./dist/gha-selected-files/index.d.mts",
+      "import": "./dist/gha-selected-files/index.mjs",
+      "default": "./dist/gha-selected-files/index.mjs"
+    },
+    "./gha-artifacts-cleanup": {
+      "types": "./dist/gha-artifacts-cleanup/index.d.mts",
+      "import": "./dist/gha-artifacts-cleanup/index.mjs",
+      "default": "./dist/gha-artifacts-cleanup/index.mjs"
+    },
+    "./http-origin": {
+      "types": "./dist/http-origin/index.d.mts",
+      "import": "./dist/http-origin/index.mjs",
+      "default": "./dist/http-origin/index.mjs"
+    },
+    "./process-line-buffer": {
+      "types": "./dist/process-line-buffer/index.d.mts",
+      "import": "./dist/process-line-buffer/index.mjs",
+      "default": "./dist/process-line-buffer/index.mjs"
+    },
+    "./pg-schema-snapshot": {
+      "types": "./dist/pg-schema-snapshot/index.d.mts",
+      "import": "./dist/pg-schema-snapshot/index.mjs",
+      "default": "./dist/pg-schema-snapshot/index.mjs"
+    },
+    "./openapi-document": {
+      "types": "./dist/openapi-document/index.d.mts",
+      "import": "./dist/openapi-document/index.mjs",
+      "default": "./dist/openapi-document/index.mjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
@@ -75,6 +105,12 @@
     "prepack": "pnpm run build",
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
+  "dependencies": {
+    "picomatch": "4.0.5"
+  },
+  "devDependencies": {
+    "@types/picomatch": "^4.0.3"
+  },
   "optionalDependencies": {
     "@libpg-query/parser": "^18.0.0"
   },

package/scripts/gha/diagnose-port-collision.sh

@@ -0,0 +1,232 @@
+#!/usr/bin/env bash
+
+PORTS="${PORTS:-}"
+OUTPUT_DIR="${OUTPUT_DIR:-${RUNNER_TEMP:-/tmp}/port-diagnostics}"
+
+if [ "${PORT_DIAGNOSTICS_BOUNDED_CHILD:-}" != 1 ]; then
+  PORT_DIAGNOSTICS_BOUNDED_CHILD=1 python3 - \
+    "${PORT_DIAGNOSTICS_TIMEOUT_SECONDS:-45}" "$0" "$@" <<'PY'
+import os
+import signal
+import subprocess
+import sys
+
+try:
+    timeout_seconds = float(sys.argv[1])
+    if timeout_seconds <= 0 or timeout_seconds > 300:
+        raise ValueError
+except ValueError:
+    timeout_seconds = 45
+
+try:
+    process = subprocess.Popen(
+        ["bash", sys.argv[2], *sys.argv[3:]],
+        env=os.environ.copy(),
+        start_new_session=True,
+    )
+except OSError as error:
+    print(f"::warning::Could not start port diagnostics: {error}", file=sys.stderr)
+    sys.exit(0)
+
+try:
+    process.wait(timeout=timeout_seconds)
+except subprocess.TimeoutExpired:
+    os.killpg(process.pid, signal.SIGTERM)
+    try:
+        process.wait(timeout=2)
+    except subprocess.TimeoutExpired:
+        os.killpg(process.pid, signal.SIGKILL)
+        process.wait()
+    print(
+        f"::warning::Port diagnostics collector exceeded {timeout_seconds:g}s; uploading partial evidence",
+        file=sys.stderr,
+    )
+PY
+  exit 0
+fi
+
+usage() {
+  cat <<'USAGE'
+Usage: diagnose-port-collision [--ports "2200 2216"] [--output-dir PATH]
+
+Best-effort, non-masking diagnostics for a failed workflow that allocated localhost ports.
+The script never returns a failure for an unavailable probe or an occupied port.
+USAGE
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --ports)
+      [ "$#" -ge 2 ] || { usage >&2; exit 0; }
+      PORTS="$2"
+      shift
+      ;;
+    --output-dir)
+      [ "$#" -ge 2 ] || { usage >&2; exit 0; }
+      OUTPUT_DIR="$2"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "::warning::Ignoring unknown diagnostics argument: $1" >&2
+      ;;
+  esac
+  shift
+done
+
+if ! mkdir -p "$OUTPUT_DIR" 2>/dev/null; then
+  echo "::warning::Could not create port diagnostics directory: $OUTPUT_DIR" >&2
+  exit 0
+fi
+
+REPORT="$OUTPUT_DIR/summary.txt"
+LISTENERS="$OUTPUT_DIR/listeners.txt"
+DOCKER_REPORT="$OUTPUT_DIR/docker.txt"
+KERNEL_REPORT="$OUTPUT_DIR/kernel.txt"
+RUNNER_REPORT="$OUTPUT_DIR/runner.txt"
+
+write_report_header() {
+  local path="$1"
+  {
+    echo "generated_at=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo unavailable)"
+    echo "workflow=${GITHUB_WORKFLOW:-unavailable}"
+    echo "job=${GITHUB_JOB:-unavailable}"
+    echo "run_id=${GITHUB_RUN_ID:-unavailable}"
+    echo "run_attempt=${GITHUB_RUN_ATTEMPT:-unavailable}"
+    echo "runner_name=${RUNNER_NAME:-unavailable}"
+    echo "runner_os=${RUNNER_OS:-unavailable}"
+    echo "workspace=${GITHUB_WORKSPACE:-unavailable}"
+    echo "allocated_ports=${PORTS:-none}"
+  } > "$path" 2>/dev/null || true
+}
+
+write_report_header "$REPORT"
+
+run_bounded() {
+  local seconds="$1"
+  shift
+  python3 - "$seconds" "$@" <<'PY'
+import subprocess
+import sys
+try:
+    subprocess.run(sys.argv[2:], check=False, timeout=float(sys.argv[1]))
+except subprocess.TimeoutExpired:
+    print(f'probe=timed-out after {sys.argv[1]}s', file=sys.stderr)
+except OSError as error:
+    print(f'probe=unavailable ({error})', file=sys.stderr)
+PY
+}
+
+valid_ports=()
+invalid_ports=()
+read -r -a requested_ports <<< "$PORTS"
+for port in "${requested_ports[@]}"; do
+  case "$port" in
+    ''|*[!0-9]*) invalid_ports+=("$port") ;;
+    *)
+      if [ "$port" -ge 1 ] && [ "$port" -le 65535 ]; then
+        valid_ports+=("$port")
+      else
+        invalid_ports+=("$port")
+      fi
+      ;;
+  esac
+done
+
+{
+  echo "requested_port_count=${#requested_ports[@]}"
+  echo "valid_port_count=${#valid_ports[@]}"
+  echo "invalid_ports=${invalid_ports[*]:-none}"
+} >> "$REPORT" 2>/dev/null || true
+
+{
+  echo "# Linux kernel port contract (best effort)"
+  if command -v sysctl >/dev/null 2>&1; then
+    echo "ip_local_reserved_ports=$(sysctl -n net.ipv4.ip_local_reserved_ports 2>/dev/null || echo unavailable)"
+    echo "ip_local_port_range=$(sysctl -n net.ipv4.ip_local_port_range 2>/dev/null || echo unavailable)"
+  else
+    echo "sysctl=unavailable"
+  fi
+  for path in /proc/sys/net/ipv4/ip_local_reserved_ports /proc/sys/net/ipv4/ip_local_port_range; do
+    if [ -r "$path" ]; then
+      echo "$path=$(tr -d '\n' < "$path" 2>/dev/null || true)"
+    fi
+  done
+} > "$KERNEL_REPORT" 2>/dev/null || true
+
+{
+  echo "# TCP socket diagnostics (best effort)"
+  lsof_available=false
+  ss_available=false
+  lsof_output=''
+  if command -v lsof >/dev/null 2>&1; then
+    lsof_available=true
+    lsof_output=$(run_bounded 10 lsof -nP -iTCP 2>&1 || true)
+  elif command -v ss >/dev/null 2>&1; then
+    ss_available=true
+  fi
+  for port in "${valid_ports[@]}"; do
+    occupied=false
+    echo "port=$port"
+    if [ "$lsof_available" = true ]; then
+      if lsof_filtered=$(printf '%s\n' "$lsof_output" | awk -v port="$port" '
+        /^probe=/ { print; next }
+        $1 == "COMMAND" { header = $0; next }
+        {
+          local_endpoint = $9
+          sub(/->.*/, "", local_endpoint)
+          if (local_endpoint ~ (":" port "$")) {
+            if (!printed_header && header != "") {
+              print header
+              printed_header = 1
+            }
+            print
+            found = 1
+          }
+        }
+        END { exit found ? 0 : 1 }
+      '); then
+        occupied=true
+      fi
+      [ -z "$lsof_filtered" ] || printf '%s\n' "$lsof_filtered"
+    elif [ "$ss_available" = true ]; then
+      ss -ntp "( sport = :$port )" 2>&1 || true
+      if ss -nt "( sport = :$port )" 2>/dev/null | tail -n +2 | grep -q .; then
+        occupied=true
+      fi
+    else
+      echo "probe=unavailable (neither lsof nor ss is installed)"
+    fi
+    echo "status=$([ "$occupied" = true ] && echo occupied || echo free-or-unobserved)"
+    echo
+  done
+} > "$LISTENERS" 2>/dev/null || true
+
+{
+  echo "# Docker diagnostics (best effort)"
+  if command -v docker >/dev/null 2>&1; then
+    run_bounded 10 docker version --format 'server={{.Server.Version}}' 2>&1 || true
+    docker_ps_output=$(run_bounded 10 docker ps --no-trunc --format 'container={{.ID}} names={{.Names}} ports={{.Ports}}' 2>&1 || true)
+    for port in "${valid_ports[@]}"; do
+      echo "published_port=$port"
+      printf '%s\n' "$docker_ps_output" | awk -v port="$port" '/^probe=/ || $0 ~ "(^|[^0-9])" port "->"' || true
+    done
+  else
+    echo "docker=unavailable"
+  fi
+} > "$DOCKER_REPORT" 2>/dev/null || true
+
+{
+  echo "# Runner context (deliberately excludes the process environment)"
+  uname -a 2>&1 || true
+  hostname 2>&1 || true
+  id 2>&1 || true
+  echo "runner_temp=${RUNNER_TEMP:-unavailable}"
+  echo "github_actions=${GITHUB_ACTIONS:-unavailable}"
+} > "$RUNNER_REPORT" 2>/dev/null || true
+
+echo "::notice::Port diagnostics captured under $OUTPUT_DIR"
+exit 0

package/scripts/gha/prepare-trivy-db.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mirror_repository="${TRIVY_DB_MIRROR_REPOSITORY:-mirror.gcr.io/aquasec/trivy-db:2}"
+official_repository="${TRIVY_DB_OFFICIAL_REPOSITORY:-ghcr.io/aquasecurity/trivy-db:2}"
+download_timeout="${TRIVY_DB_TIMEOUT:-75s}"
+
+download_database() {
+  trivy image \
+    --download-db-only \
+    --no-progress \
+    --timeout "$download_timeout" \
+    --db-repository "$1"
+}
+
+mirror_exit=0
+download_database "$mirror_repository" || mirror_exit=$?
+if [ "$mirror_exit" -eq 0 ]; then
+  echo "Trivy vulnerability database prepared from the Google mirror"
+  exit 0
+fi
+
+echo "Trivy database mirror failed with exit ${mirror_exit}; retrying from official GHCR"
+official_exit=0
+download_database "$official_repository" || official_exit=$?
+if [ "$official_exit" -eq 0 ]; then
+  echo "Trivy vulnerability database prepared from official GHCR"
+  exit 0
+fi
+
+echo "Trivy vulnerability database download failed from the Google mirror (exit ${mirror_exit}) and official GHCR (exit ${official_exit})" >&2
+exit "$official_exit"