vouchington-tooling 0.1.4 → 0.1.6

package/dist/session-friction/normalize.mjs

@@ -0,0 +1,174 @@
+const MAX_COMMAND_TOKEN_LENGTH = 40;
+const MAX_COMMAND_LENGTH = 100_000;
+const MAX_COMMAND_WRAPPERS = 16;
+const REDACTED_TOKEN = '[REDACTED]';
+const CREDENTIAL_OPTION = /^--?(?:api[-_]?key|auth|credential|password|secret|token)=/i;
+const URL_USERINFO = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+@/i;
+const ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const PACKAGE_RUNNERS = new Set(['npm', 'npx', 'pnpm', 'pnpx', 'yarn']);
+const GIT_OPTIONS_WITH_ARGS = new Set(['-C', '-c', '--git-dir', '--work-tree']);
+const ENV_OPTIONS_WITH_ARGS = new Set(['-C', '--chdir', '-S', '--split-string', '-u', '--unset']);
+const ENV_OPTIONS_WITHOUT_ARGS = new Set([
+    '-i',
+    '--ignore-environment',
+    '-0',
+    '--null',
+    '-v',
+    '--debug',
+]);
+const GIT_OPTIONS_WITHOUT_ARGS = new Set([
+    '-v',
+    '--version',
+    '-h',
+    '--help',
+    '--exec-path',
+    '--html-path',
+    '--man-path',
+    '--info-path',
+    '-p',
+    '--paginate',
+    '-P',
+    '--no-pager',
+    '--no-replace-objects',
+    '--bare',
+]);
+function splitCommand(command) {
+    const result = [];
+    let segment = [];
+    let word = '';
+    let quote;
+    let escaped = false;
+    const flushWord = () => {
+        if (word)
+            segment.push(word);
+        word = '';
+    };
+    const flushSegment = () => {
+        flushWord();
+        if (segment.length)
+            result.push(segment);
+        segment = [];
+    };
+    for (const char of command) {
+        if (escaped) {
+            word += char;
+            escaped = false;
+        }
+        else if (char === '\\' && quote !== "'") {
+            escaped = true;
+        }
+        else if (quote) {
+            if (char === quote)
+                quote = undefined;
+            else
+                word += char;
+        }
+        else if (char === '"' || char === "'")
+            quote = char;
+        else if (';&|<>\n\r'.includes(char))
+            flushSegment();
+        else if (/\s/.test(char))
+            flushWord();
+        else
+            word += char;
+    }
+    if (escaped)
+        word += '\\';
+    flushSegment();
+    return result;
+}
+function redact(token) {
+    return token.length > MAX_COMMAND_TOKEN_LENGTH ||
+        CREDENTIAL_OPTION.test(token) ||
+        URL_USERINFO.test(token)
+        ? REDACTED_TOKEN
+        : token;
+}
+function stripAssignments(tokens) {
+    let index = 0;
+    while (index < tokens.length && ENV_ASSIGNMENT.test(tokens[index]))
+        index++;
+    const wrapper = tokens[index];
+    // Assignments without an executable are represented by a safe sentinel.
+    if (wrapper !== 'env' && !wrapper?.endsWith('/env'))
+        return index < tokens.length ? tokens.slice(index) : index ? [REDACTED_TOKEN] : tokens;
+    index++;
+    while (index < tokens.length) {
+        const option = tokens[index];
+        if (option === '--') {
+            index++;
+            break;
+        }
+        const optionName = option.split('=', 1)[0];
+        const splitStringOption = optionName === '-S' || (optionName.length >= 5 && '--split-string'.startsWith(optionName));
+        if (splitStringOption)
+            return [REDACTED_TOKEN];
+        const abbreviatedArgument = optionName.length >= 5 && '--chdir'.startsWith(optionName);
+        if (ENV_OPTIONS_WITH_ARGS.has(optionName) || abbreviatedArgument) {
+            index += option.includes('=') ? 1 : 2;
+            continue;
+        }
+        if (ENV_OPTIONS_WITHOUT_ARGS.has(option)) {
+            index++;
+            continue;
+        }
+        if (option.startsWith('-'))
+            return [REDACTED_TOKEN];
+        break;
+    }
+    while (index < tokens.length && ENV_ASSIGNMENT.test(tokens[index]))
+        index++;
+    if (index < tokens.length)
+        return tokens.slice(index);
+    return tokens.some((token) => ENV_ASSIGNMENT.test(token)) ? [REDACTED_TOKEN] : [];
+}
+function stripGitOptions(tokens) {
+    let index = 0;
+    while (index < tokens.length) {
+        const token = tokens[index];
+        if (token === '--')
+            return tokens.slice(index + 1);
+        if (GIT_OPTIONS_WITH_ARGS.has(token)) {
+            if (index + 1 >= tokens.length)
+                return [REDACTED_TOKEN];
+            index += 2;
+        }
+        else if (GIT_OPTIONS_WITHOUT_ARGS.has(token) || /^--[a-z0-9-]+=/i.test(token))
+            index++;
+        else
+            break;
+    }
+    return tokens.slice(index);
+}
+function packageRunner(token) {
+    return [...PACKAGE_RUNNERS].some((runner) => token === runner || token.endsWith(`/${runner}`));
+}
+function normalizeSegment(tokens) {
+    const [first, ...rest] = tokens;
+    if (!first)
+        return '';
+    if (packageRunner(first) && (rest[0] === 'run' || rest[0] === 'exec') && rest[1])
+        return `${redact(first)} ${rest[0]} ${redact(rest[1])}`;
+    const effective = first === 'git' || first.endsWith('/git') ? stripGitOptions(rest) : rest;
+    return effective[0] ? `${redact(first)} ${redact(effective[0])}` : redact(first);
+}
+export function normalizeCommandPrefix(command, wrappersToStrip = []) {
+    if (command.length > MAX_COMMAND_LENGTH)
+        return '[REDACTED: command too long]';
+    const segments = splitCommand(command);
+    let index = 0;
+    while (index < segments.length - 1 && stripAssignments(segments[index])[0] === 'cd')
+        index++;
+    const tokens = stripAssignments(segments[index] ?? []);
+    const wrapperValues = Array.isArray(wrappersToStrip) ? wrappersToStrip : [];
+    const wrapperNames = new Set(wrapperValues
+        .slice(0, MAX_COMMAND_WRAPPERS)
+        .filter((value) => typeof value === 'string' && value.length > 0 && value.length <= MAX_COMMAND_TOKEN_LENGTH));
+    let wrappers = 0;
+    while (tokens[wrappers] && wrapperNames.has(tokens[wrappers]))
+        wrappers++;
+    if (!wrappers)
+        return normalizeSegment(tokens);
+    const nested = normalizeSegment(stripAssignments(tokens.slice(wrappers)));
+    return nested ? `${redact(tokens[0])} ${nested}` : redact(tokens[0]);
+}

package/dist/session-friction/report.d.mts

@@ -0,0 +1,2 @@
+import type { SessionFrictionReport, SessionFrictionReportOptions } from './types.mts';
+export declare function buildSessionFrictionReport(sessionId: string, options: SessionFrictionReportOptions): Promise<SessionFrictionReport>;

package/dist/session-friction/report.mjs

@@ -0,0 +1,113 @@
+import { eventLimit, readFrictionLog, requireDirectory } from './log.mjs';
+import { buildCiFailuresSection, getConformingGroups } from './ci-failures.mjs';
+import { buildSandboxSection } from './sandbox.mjs';
+import { validateSessionId } from './session-id.mjs';
+const JOURNAL_ENTRY_MAX_COUNT = 500;
+const JOURNAL_MARKDOWN_MAX_BYTES = 10_000;
+const JOURNAL_TOTAL_MAX_BYTES = 1_000_000;
+function journalData(entry) {
+    try {
+        const data = entry?.data;
+        return data ? { type: data.type, markdown: data.markdown } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function collectEntries(entries) {
+    const result = [];
+    let consumed = 0;
+    let inspectedBytes = 0;
+    let retainedBytes = 0;
+    let truncated = false;
+    for await (const entry of entries) {
+        consumed++;
+        const data = journalData(entry);
+        const markdown = data?.markdown;
+        if (data?.type === 'journal' && typeof markdown === 'string') {
+            const bytes = Buffer.byteLength(markdown);
+            inspectedBytes += bytes;
+            if (bytes > JOURNAL_MARKDOWN_MAX_BYTES)
+                truncated = true;
+            if (bytes <= JOURNAL_MARKDOWN_MAX_BYTES && retainedBytes + bytes <= JOURNAL_TOTAL_MAX_BYTES) {
+                result.push({ data: { type: 'journal', markdown } });
+                retainedBytes += bytes;
+            }
+        }
+        if (consumed >= JOURNAL_ENTRY_MAX_COUNT ||
+            inspectedBytes >= JOURNAL_TOTAL_MAX_BYTES ||
+            retainedBytes >= JOURNAL_TOTAL_MAX_BYTES) {
+            truncated = true;
+            break;
+        }
+    }
+    return { entries: result, truncated };
+}
+function errorMessage(error) {
+    try {
+        return error instanceof Error ? error.message : String(error);
+    }
+    catch {
+        return '[unprintable error]';
+    }
+}
+function sandboxMarkdown(friction) {
+    if (friction.status === 'events')
+        return buildSandboxSection(friction.events);
+    const status = friction.status === 'empty' ? 'none observed' : 'unavailable (no friction log)';
+    return `## Sandbox & Permission Audit\nStatus: ${status}`;
+}
+function reportFromLog(sessionId, logOptions, journal) {
+    try {
+        const friction = readFrictionLog(sessionId, logOptions);
+        if (journal.status === 'ok' && journal.truncated)
+            return {
+                markdown: '## CI Failures\nStatus: unavailable (journal scan incomplete)\n\n' +
+                    sandboxMarkdown(friction),
+            };
+        const markdown = buildCiFailuresSection(sessionId, journal, friction.status);
+        return { markdown: `${markdown}\n\n${sandboxMarkdown(friction)}` };
+    }
+    catch (error) {
+        const ciMarkdown = journal.status === 'ok' && journal.truncated
+            ? '## CI Failures\nStatus: unavailable (journal scan incomplete)'
+            : journal.status === 'ok' && journal.markdownBlocks.length === 0
+                ? '## CI Failures\nStatus: unavailable (friction log unreadable)'
+                : buildCiFailuresSection(sessionId, journal, 'empty');
+        return {
+            markdown: `${ciMarkdown}\n\n## Sandbox & Permission Audit\nStatus: unavailable (friction log unreadable)`,
+            diagnostic: errorMessage(error),
+        };
+    }
+}
+export async function buildSessionFrictionReport(sessionId, options) {
+    validateSessionId(sessionId);
+    requireDirectory(options.directory);
+    eventLimit(options.maxEvents);
+    let journal;
+    try {
+        const loaded = await options.journalLoader(sessionId);
+        if (loaded.status === 'not-found')
+            journal = { status: 'ok', markdownBlocks: [], truncated: false };
+        else {
+            const collected = await collectEntries(loaded.entries);
+            journal = {
+                status: 'ok',
+                markdownBlocks: getConformingGroups(collected.entries),
+                truncated: collected.truncated,
+            };
+        }
+    }
+    catch (error) {
+        const diagnostic = errorMessage(error);
+        journal = { status: 'unreachable', diagnostic };
+    }
+    const report = reportFromLog(sessionId, options, journal);
+    if (journal.status === 'unreachable') {
+        const diagnostic = report.diagnostic
+            ? `${journal.diagnostic}; ${report.diagnostic}`
+            : journal.diagnostic;
+        return { ...report, diagnostic };
+    }
+    return report;
+}

package/dist/session-friction/sandbox.d.mts

@@ -0,0 +1,2 @@
+import type { FrictionEvent } from './types.mts';
+export declare function buildSandboxSection(events: FrictionEvent[]): string;

package/dist/session-friction/sandbox.mjs

@@ -0,0 +1,15 @@
+import { markdownAuditText } from './text.mjs';
+const SANDBOX_SECTION_HEADER = '## Sandbox & Permission Audit';
+const KIND_ORDER = ['sandbox-escalation', 'sandbox-failure'];
+export function buildSandboxSection(events) {
+    const groups = KIND_ORDER.map((kind) => {
+        const selected = events.filter((event) => event.kind === kind);
+        return selected.length
+            ? [
+                `- ${kind} (${selected.length})`,
+                ...selected.map((event) => `  - ${markdownAuditText(event.commandPrefix)} — ${markdownAuditText(event.detail)} — ${markdownAuditText(event.timestamp)}`),
+            ].join('\n')
+            : undefined;
+    }).filter((group) => group !== undefined);
+    return `${SANDBOX_SECTION_HEADER}\nEvents observed: ${events.length}\n\n${groups.join('\n')}`;
+}

package/dist/session-friction/session-id.d.mts

@@ -0,0 +1,2 @@
+export declare function validateSessionId(sessionId: string): void;
+export declare function sanitizeSessionId(sessionId: string): string;

package/dist/session-friction/session-id.mjs

@@ -0,0 +1,17 @@
+import { createHash } from 'node:crypto';
+import { isWellFormedUnicode, normalizeAuditText } from './text.mjs';
+const SESSION_ID_MAX_LENGTH = 4096;
+export function validateSessionId(sessionId) {
+    if (typeof sessionId !== 'string')
+        throw new Error('sessionId must be a string');
+    if (sessionId.length > SESSION_ID_MAX_LENGTH)
+        throw new Error('sessionId is too long');
+    if (!isWellFormedUnicode(sessionId))
+        throw new Error('sessionId must be well-formed Unicode');
+    if (normalizeAuditText(sessionId) === '')
+        throw new Error('sessionId must be non-empty');
+}
+export function sanitizeSessionId(sessionId) {
+    validateSessionId(sessionId);
+    return createHash('sha256').update(sessionId).digest('hex');
+}

package/dist/session-friction/text.d.mts

@@ -0,0 +1,5 @@
+export declare function normalizeAuditText(value: string): string;
+export declare function boundedText(value: string, maximum: number): string;
+export declare function isWellFormedUnicode(value: string): boolean;
+export declare function isSafeAuditText(value: unknown): value is string;
+export declare function markdownAuditText(value: string): string;

package/dist/session-friction/text.mjs

@@ -0,0 +1,45 @@
+const CONTROL_CHARACTERS = /[\p{Cc}\p{Cf}]+/gu;
+const MARKDOWN_CHARACTER = /\\|`|\*|_|~|\[|\]|<|>|#|-|\+|!|\||&/;
+const MARKDOWN_AUDIT_MAX_LENGTH = 120;
+export function normalizeAuditText(value) {
+    return value.replace(CONTROL_CHARACTERS, ' ').trim();
+}
+export function boundedText(value, maximum) {
+    let end = Math.min(value.length, maximum);
+    if (end < value.length &&
+        /[\uD800-\uDBFF]/.test(value[end - 1]) &&
+        /[\uDC00-\uDFFF]/.test(value[end]))
+        end--;
+    return value.slice(0, end);
+}
+export function isWellFormedUnicode(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return false;
+            index++;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff)
+            return false;
+    }
+    return true;
+}
+export function isSafeAuditText(value) {
+    return (typeof value === 'string' &&
+        value !== '' &&
+        isWellFormedUnicode(value) &&
+        value === normalizeAuditText(value));
+}
+export function markdownAuditText(value) {
+    // Escaping is atomic, so the result may be shorter than the maximum.
+    let result = '';
+    for (const character of normalizeAuditText(value)) {
+        const escaped = MARKDOWN_CHARACTER.test(character) ? `\\${character}` : character;
+        if (result.length + escaped.length > MARKDOWN_AUDIT_MAX_LENGTH)
+            break;
+        result += escaped;
+    }
+    return result;
+}

package/dist/session-friction/types.d.mts

@@ -0,0 +1,52 @@
+export type FrictionEventKind = 'sandbox-escalation' | 'sandbox-failure';
+export type FrictionEvent = {
+    kind: FrictionEventKind;
+    timestamp: string;
+    commandPrefix: string;
+    detail: string;
+};
+export type ToolResultObservation = {
+    type: 'tool-result';
+    command: string;
+    commandWrappers?: string[];
+    escalationDetail?: string;
+    structuredStderr?: string;
+};
+export type PermissionRequestObservation = {
+    type: 'permission-request';
+    command: string;
+    commandWrappers?: string[];
+};
+export type FrictionObservation = ToolResultObservation | PermissionRequestObservation;
+export type FrictionLogReadResult = {
+    status: 'absent';
+} | {
+    status: 'empty';
+} | {
+    status: 'events';
+    events: FrictionEvent[];
+};
+export type FrictionLogOptions = {
+    directory: string;
+    maxEvents?: number;
+};
+export type JournalEntry = {
+    data?: {
+        type?: unknown;
+        markdown?: unknown;
+    };
+};
+export type JournalLoadResult = {
+    status: 'ok';
+    entries: Iterable<JournalEntry> | AsyncIterable<JournalEntry>;
+} | {
+    status: 'not-found';
+};
+export type JournalLoader = (sessionId: string) => JournalLoadResult | Promise<JournalLoadResult>;
+export type SessionFrictionReport = {
+    markdown: string;
+    diagnostic?: string;
+};
+export type SessionFrictionReportOptions = FrictionLogOptions & {
+    journalLoader: JournalLoader;
+};

package/dist/session-friction/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/session-friction/utf8.d.mts

@@ -0,0 +1 @@
+export declare function decodeUtf8(value: Uint8Array): string;

package/dist/session-friction/utf8.mjs

@@ -0,0 +1,8 @@
+export function decodeUtf8(value) {
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(value);
+    }
+    catch {
+        throw new Error('session-friction log is not valid UTF-8');
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -41,6 +41,11 @@
       "import": "./dist/retrospective-transcript/index.mjs",
       "default": "./dist/retrospective-transcript/index.mjs"
     },
+    "./session-friction": {
+      "types": "./dist/session-friction/index.d.mts",
+      "import": "./dist/session-friction/index.mjs",
+      "default": "./dist/session-friction/index.mjs"
+    },
     "./sql-ast": {
       "types": "./dist/sql-ast/index.d.mts",
       "import": "./dist/sql-ast/index.mjs",
@@ -223,7 +228,7 @@
   },
   "dependencies": {
     "csv-parse": "7.0.2",
-    "csv-stringify": "6.8.2",
+    "csv-stringify": "6.8.3",
     "dockerfile-ast": "0.7.1",
     "picomatch": "4.0.5",
     "yaml": "2.9.0"

package/scripts/gha/download-optional-run-artifacts.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo 'usage: download-optional-run-artifacts.sh (--name <name> | --pattern <pattern>) --dir <directory>' >&2
+  exit 2
+}
+
+selector=''
+selector_type=''
+destination=''
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --name|--pattern)
+      [ -z "$selector_type" ] && [ "$#" -ge 2 ] || usage
+      selector_type="${1#--}"
+      selector="$2"
+      shift 2
+      ;;
+    --dir)
+      [ -z "$destination" ] && [ "$#" -ge 2 ] || usage
+      destination="$2"
+      shift 2
+      ;;
+    *) usage ;;
+  esac
+done
+
+[ -n "$selector_type" ] && [ -n "$selector" ] && [ -n "$destination" ] || usage
+[ -n "${GITHUB_OUTPUT:-}" ] || { echo 'GITHUB_OUTPUT must be set' >&2; exit 2; }
+[ -n "${GITHUB_REPOSITORY:-}" ] || { echo 'GITHUB_REPOSITORY must be set' >&2; exit 2; }
+[ -n "${GITHUB_RUN_ID:-}" ] || { echo 'GITHUB_RUN_ID must be set' >&2; exit 2; }
+github_host="${GH_HOST:-${GITHUB_SERVER_URL:-https://github.com}}"
+github_host="${github_host#*://}"
+github_host="${github_host%%/*}"
+[ -n "$github_host" ] || { echo 'GitHub host must be set' >&2; exit 2; }
+repository="$GITHUB_REPOSITORY"
+case "$github_host" in
+  github.com|*.ghe.com) ;;
+  *)
+    if [ -z "${GH_ENTERPRISE_TOKEN:-${GITHUB_ENTERPRISE_TOKEN:-}}" ]; then
+      enterprise_token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+      [ -z "$enterprise_token" ] || export GH_ENTERPRISE_TOKEN="$enterprise_token"
+    fi
+    ;;
+esac
+
+validate_artifact_name() {
+  case "$1" in
+    ''|.|..|*/*|*\\*)
+      echo '[optional-run-artifacts] invalid artifact name' >&2
+      return 2
+      ;;
+  esac
+}
+
+download_exact() {
+  artifact="$1"
+  directory="$2"
+  validate_artifact_name "$artifact" || return $?
+  artifacts=$(list_artifact_names) || return $?
+  found=0
+  while IFS= read -r candidate; do
+    if [ "$candidate" = "$artifact" ]; then
+      found=1
+      break
+    fi
+  done < <(printf '%s\n' "$artifacts")
+  [ "$found" -eq 1 ] || return 3
+  echo "[optional-run-artifacts] attempt selector=$selector_type" >&2
+  GH_HOST="$github_host" gh run download "$GITHUB_RUN_ID" --repo "$repository" --name "$artifact" --dir "$directory"
+}
+
+list_artifact_names() {
+  GH_HOST="$github_host" gh api \
+    --paginate \
+    "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" \
+    --jq '.artifacts[] | select(.expired | not) | .name'
+}
+
+download_pattern() {
+  artifacts=$(list_artifact_names | awk '!seen[$0]++') || return $?
+  selected_artifacts=()
+  while IFS= read -r artifact; do
+    [ -n "$artifact" ] || continue
+    # shellcheck disable=SC2254
+    # selector is the caller's intended glob pattern.
+    case "$artifact" in
+      $selector) ;;
+      *) continue ;;
+    esac
+    validate_artifact_name "$artifact" || return $?
+    selected_artifacts+=("$artifact")
+    echo "[optional-run-artifacts] selected artifact=$artifact" >&2
+  done < <(printf '%s\n' "$artifacts")
+  count=${#selected_artifacts[@]}
+  echo "[optional-run-artifacts] selection selector=pattern count=$count" >&2
+  [ "$count" -gt 0 ] || return 3
+  for artifact in "${selected_artifacts[@]}"; do
+    echo "[optional-run-artifacts] attempt artifact=$artifact" >&2
+    GH_HOST="$github_host" gh run download "$GITHUB_RUN_ID" --repo "$repository" --name "$artifact" --dir "$destination/$artifact" || return $?
+  done
+}
+
+if [ "$selector_type" = name ]; then
+  if download_exact "$selector" "$destination"; then status=0; else status=$?; fi
+else
+  if download_pattern; then status=0; else status=$?; fi
+fi
+if [ "$status" -eq 0 ]; then
+  echo 'availability=available' >> "$GITHUB_OUTPUT"
+  echo "[optional-run-artifacts] result=available selector=$selector_type" >&2
+else
+  case "$status" in
+    130|143) exit "$status" ;;
+    3)
+      echo 'availability=unavailable' >> "$GITHUB_OUTPUT"
+      echo "::warning::Optional same-run artifact unavailable; continuing with validated fallback (selector=$selector_type exit=$status)" >&2
+      echo "[optional-run-artifacts] result=unavailable selector=$selector_type exit=$status" >&2
+      ;;
+    *)
+      echo "[optional-run-artifacts] result=error selector=$selector_type exit=$status" >&2
+      exit "$status"
+      ;;
+  esac
+fi

package/scripts/gha/install-github-release.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 usage() {
-  echo "usage: install-github-release.sh --repo owner/name --version VERSION --asset TEMPLATE --bin NAME [--tag-prefix PREFIX] [--strip-components N] [--bin-dir DIR] [--version-flag FLAG] [--checksums-asset NAME] [--no-checksum]" >&2
+  echo "usage: install-github-release.sh --repo owner/name --version VERSION --asset TEMPLATE --bin NAME [--tag-prefix PREFIX] [--strip-components N] [--bin-dir DIR] [--version-flag FLAG] [--checksums-asset NAME] [--expected-sha256 SHA256] [--no-checksum]" >&2
 }
 
 REPO="${REPO:-}"
@@ -14,6 +14,7 @@ STRIP_COMPONENTS="${STRIP_COMPONENTS:-1}"
 BIN_DIR="${INSTALL_BIN_DIR:-}"
 VERSION_FLAG="${VERSION_FLAG:---version}"
 CHECKSUMS_ASSET="${CHECKSUMS_ASSET:-}"
+EXPECTED_SHA256="${EXPECTED_SHA256:-}"
 NO_CHECKSUM="${NO_CHECKSUM:-0}"
 
 if [ -n "${RELEASE_OWNER:-}" ] && [ -n "${RELEASE_REPO:-}" ]; then
@@ -67,6 +68,11 @@ while [ "${#}" -gt 0 ]; do
       CHECKSUMS_ASSET="$2"
       shift 2
       ;;
+    --expected-sha256)
+      [ "${#}" -ge 2 ] || { usage; exit 2; }
+      EXPECTED_SHA256="$2"
+      shift 2
+      ;;
     --no-checksum)
       NO_CHECKSUM=1
       shift
@@ -97,6 +103,11 @@ if ! [[ "$STRIP_COMPONENTS" =~ ^[0-9]+$ ]]; then
   exit 2
 fi
 
+if [ -n "$EXPECTED_SHA256" ] && ! [[ "$EXPECTED_SHA256" =~ ^[[:xdigit:]]{64}$ ]]; then
+  echo "install-github-release.sh: --expected-sha256 must be a 64-character hexadecimal SHA-256 digest" >&2
+  exit 2
+fi
+
 BIN_DIR="${BIN_DIR:-${RUNNER_TEMP:-${HOME}/.local}/bin}"
 mkdir -p "$BIN_DIR"
 if [ -n "${GITHUB_PATH:-}" ]; then
@@ -150,10 +161,12 @@ extract_dir="${work}-extract"
 rm -rf "$extract_dir"
 mkdir -p "$extract_dir"
 curl -fsSL -o "$archive" "${base_url}/${asset_name}"
-if [ "$NO_CHECKSUM" != 1 ]; then
-  if [ -n "$checksums_name" ]; then
+if [ -n "$EXPECTED_SHA256" ] || [ "$NO_CHECKSUM" != 1 ]; then
+  if [ -n "$EXPECTED_SHA256" ]; then
+    expected="$EXPECTED_SHA256"
+  elif [ -n "$checksums_name" ]; then
     curl -fsSL -o "${archive}.checksums" "${base_url}/${checksums_name}"
-    expected=$(grep -F "$asset_name" "${archive}.checksums" | awk '{print $1}')
+    expected=$(awk -v file="$asset_name" '$2 == file || $2 == "*" file { print $1 }' "${archive}.checksums")
     rm "${archive}.checksums"
   else
     curl -fsSL -o "${archive}.sha256" "${base_url}/${asset_name}.sha256"