willfire 0.1.21 → 0.1.22

package/dist/cli/isPrEventAction.d.ts

@@ -0,0 +1,2 @@
+import type { PrEventAction } from "../types.js";
+export declare const isPrEventAction: (v: string) => v is PrEventAction;

package/dist/cli/isPrEventAction.js

@@ -0,0 +1 @@
+export const isPrEventAction = (v) => v === "opened" || v === "synchronize" || v === "reopened";

package/dist/cli/parseArgs.js

@@ -1,5 +1,5 @@
+import { isPrEventAction } from "./isPrEventAction.js";
 const USAGE = "usage: predict --repo owner/name --pr N [--action opened|synchronize|reopened] [--json]";
-const isPrEventAction = (v) => v === "opened" || v === "synchronize" || v === "reopened";
 export function parseArgs(argv) {
     const get = (flag) => {
         const i = argv.indexOf(flag);

package/dist/predict/makeLiveExecutor.js

@@ -1,5 +1,6 @@
 import { makeCloneProvider, makeExecutor, makeTreeProvider, runShell, } from "../execute.js";
-import { makeSandboxRunner, SANDBOX_NODE_MAJOR } from "../sandbox.js";
+import { makeSandboxRunner } from "../sandbox/makeSandboxRunner.js";
+import { SANDBOX_NODE_MAJOR } from "../sandbox/sandboxConfig.js";
 /**
  * The executor `predict` uses by default. Repo-authored steps run in the
  * docker sandbox; infrastructure subprocesses (`tar`, `git`) run on the host,

package/dist/sandbox/imageTag.d.ts

@@ -0,0 +1,2 @@
+/** The tag names the dockerfile that built it, so a change is a new image. */
+export declare function imageTag(dockerfile: string): string;

package/dist/sandbox/imageTag.js

@@ -0,0 +1,6 @@
+import { createHash } from "node:crypto";
+/** The tag names the dockerfile that built it, so a change is a new image. */
+export function imageTag(dockerfile) {
+    const hash = createHash("sha256").update(dockerfile).digest("hex");
+    return `willfire-sandbox:${hash.slice(0, 12)}`;
+}

package/dist/sandbox/index.d.ts

@@ -0,0 +1,4 @@
+export { DOCKERFILE, SANDBOX_NODE_MAJOR, sandboxConfig, type SandboxConfig } from "./sandboxConfig.js";
+export { imageTag } from "./imageTag.js";
+export { sandboxArgv } from "./sandboxArgv.js";
+export { makeSandboxRunner } from "./makeSandboxRunner.js";

package/dist/sandbox/index.js

@@ -0,0 +1,4 @@
+export { DOCKERFILE, SANDBOX_NODE_MAJOR, sandboxConfig } from "./sandboxConfig.js";
+export { imageTag } from "./imageTag.js";
+export { sandboxArgv } from "./sandboxArgv.js";
+export { makeSandboxRunner } from "./makeSandboxRunner.js";

package/dist/sandbox/makeSandboxRunner.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A `RunCommand` that runs each step inside a hermetic docker container: no
+ * network, no capabilities, a read-only root, and only the host paths in
+ * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
+ * keep nothing needs no per-repo grant — this is what lets execution be on by
+ * default instead of configured.
+ */
+import type { RunCommand } from "../execute.js";
+import { type SandboxConfig } from "./sandboxConfig.js";
+/**
+ * Provisions the image lazily, once, and remembers a failure: every later
+ * spec gets 125 (docker's "could not start" band) with the reason rather
+ * than retrying a build that already failed.
+ */
+export declare function makeSandboxRunner(opts?: Partial<SandboxConfig>): RunCommand;

package/dist/sandbox/makeSandboxRunner.js

@@ -0,0 +1,44 @@
+/**
+ * A `RunCommand` that runs each step inside a hermetic docker container: no
+ * network, no capabilities, a read-only root, and only the host paths in
+ * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
+ * keep nothing needs no per-repo grant — this is what lets execution be on by
+ * default instead of configured.
+ */
+import { imageTag } from "./imageTag.js";
+import { runDocker } from "./runDocker.js";
+import { sandboxArgv } from "./sandboxArgv.js";
+import { sandboxConfig } from "./sandboxConfig.js";
+/**
+ * Provisions the image lazily, once, and remembers a failure: every later
+ * spec gets 125 (docker's "could not start" band) with the reason rather
+ * than retrying a build that already failed.
+ */
+export function makeSandboxRunner(opts = {}) {
+    const cfg = sandboxConfig(opts);
+    const tag = imageTag(cfg.dockerfile);
+    let ensured = null;
+    const ensureImage = () => {
+        ensured ??= (async () => {
+            const inspect = await runDocker(cfg.dockerBin, ["image", "inspect", tag]);
+            if (inspect.code === 0) {
+                return null;
+            }
+            const build = await runDocker(cfg.dockerBin, ["build", "-t", tag, "-"], cfg.dockerfile);
+            if (build.code === 0) {
+                return null;
+            }
+            const trimmed = build.stderr.trim();
+            const tail = trimmed.slice(trimmed.lastIndexOf("\n") + 1);
+            return `cannot build sandbox image ${tag}${tail === "" ? "" : ` (${tail})`}`;
+        })();
+        return ensured;
+    };
+    return async (spec) => {
+        const failure = await ensureImage();
+        if (failure !== null) {
+            return { code: 125, stderr: failure };
+        }
+        return runDocker(cfg.dockerBin, sandboxArgv(spec, cfg));
+    };
+}

package/dist/sandbox/runDocker.d.ts

@@ -0,0 +1,4 @@
+export declare function runDocker(bin: string, argv: string[], stdin?: string): Promise<{
+    code: number;
+    stderr: string;
+}>;

package/dist/sandbox/runDocker.js

@@ -0,0 +1,26 @@
+import { spawn } from "node:child_process";
+// The client itself runs with the host environment — it needs the host PATH
+// and any DOCKER_HOST to find the daemon.
+export function runDocker(bin, argv, stdin) {
+    return new Promise((resolvePromise) => {
+        const child = spawn(bin, argv, {
+            env: process.env,
+            stdio: [stdin === undefined ? "ignore" : "pipe", "ignore", "pipe"],
+        });
+        let stderr = "";
+        child.stderr.on("data", (d) => {
+            stderr += String(d);
+            if (stderr.length > 4096) {
+                stderr = stderr.slice(-4096);
+            }
+        });
+        child.on("spawn", () => {
+            if (stdin !== undefined) {
+                child.stdin.write(stdin);
+                child.stdin.end();
+            }
+        });
+        child.on("error", () => resolvePromise({ code: 127, stderr }));
+        child.on("close", (code) => resolvePromise({ code: code ?? 1, stderr }));
+    });
+}

package/dist/sandbox/sandboxArgv.d.ts

@@ -0,0 +1,8 @@
+import type { RunSpec } from "../execute.js";
+import type { SandboxConfig } from "./sandboxConfig.js";
+/**
+ * The complete `docker run` argv for one step. `PATH` and `HOME` in
+ * `spec.env` are host facts; the container gets its image's PATH and a
+ * writable `HOME=/tmp` instead.
+ */
+export declare function sandboxArgv(spec: RunSpec, cfg: SandboxConfig): string[];

package/dist/sandbox/sandboxArgv.js

@@ -0,0 +1,41 @@
+import { imageTag } from "./imageTag.js";
+/**
+ * The complete `docker run` argv for one step. `PATH` and `HOME` in
+ * `spec.env` are host facts; the container gets its image's PATH and a
+ * writable `HOME=/tmp` instead.
+ */
+export function sandboxArgv(spec, cfg) {
+    const argv = [
+        "run",
+        "--rm",
+        "--network",
+        "none",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--read-only",
+        "--tmpfs",
+        "/tmp",
+        "--user",
+        `${cfg.uid}:${cfg.gid}`,
+    ];
+    for (const m of spec.mounts ?? []) {
+        argv.push("-v", `${m.path}:${m.path}${m.writable ? "" : ":ro"}`);
+    }
+    argv.push("-w", spec.cwd);
+    for (const [k, v] of Object.entries(spec.env)) {
+        if (k !== "PATH" && k !== "HOME") {
+            argv.push("-e", `${k}=${v}`);
+        }
+    }
+    argv.push("-e", "HOME=/tmp");
+    argv.push(imageTag(cfg.dockerfile));
+    if (spec.shell === "bash") {
+        argv.push("bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", spec.script);
+    }
+    else {
+        argv.push("sh", "-e", "-c", spec.script);
+    }
+    return argv;
+}

package/dist/sandbox/sandboxConfig.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The node major the image ships — also the refusal boundary for `setup-node`
+ * and `node2x` runtimes asking for any other major.
+ */
+export declare const SANDBOX_NODE_MAJOR = 24;
+export declare const DOCKERFILE = "FROM node:24-slim\nRUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*\n";
+export interface SandboxConfig {
+    dockerBin: string;
+    uid: number;
+    gid: number;
+    dockerfile: string;
+}
+export declare function sandboxConfig(opts?: Partial<SandboxConfig>): SandboxConfig;

package/dist/sandbox/sandboxConfig.js

@@ -0,0 +1,18 @@
+/**
+ * The node major the image ships — also the refusal boundary for `setup-node`
+ * and `node2x` runtimes asking for any other major.
+ */
+export const SANDBOX_NODE_MAJOR = 24;
+// git and python3: checkout's postcondition and the interpreters a script on
+// a GitHub-hosted runner takes for granted.
+export const DOCKERFILE = `FROM node:${SANDBOX_NODE_MAJOR}-slim
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*
+`;
+export function sandboxConfig(opts = {}) {
+    return {
+        dockerBin: opts.dockerBin ?? "docker",
+        uid: opts.uid ?? process.getuid(),
+        gid: opts.gid ?? process.getgid(),
+        dockerfile: opts.dockerfile ?? DOCKERFILE,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "willfire",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Predict the set of CI check entries GitHub Actions will create for a pull request",
   "license": "MIT",
   "packageManager": "pnpm@10.33.0",

package/dist/sandbox.d.ts

@@ -1,35 +0,0 @@
-/**
- * A `RunCommand` that runs each step inside a hermetic docker container: no
- * network, no capabilities, a read-only root, and only the host paths in
- * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
- * keep nothing needs no per-repo grant — this is what lets execution be on by
- * default instead of configured.
- */
-import type { RunCommand, RunSpec } from "./execute.js";
-/**
- * The node major the image ships — also the refusal boundary for `setup-node`
- * and `node2x` runtimes asking for any other major.
- */
-export declare const SANDBOX_NODE_MAJOR = 24;
-export declare const DOCKERFILE = "FROM node:24-slim\nRUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*\n";
-export interface SandboxConfig {
-    dockerBin: string;
-    uid: number;
-    gid: number;
-    dockerfile: string;
-}
-export declare function sandboxConfig(opts?: Partial<SandboxConfig>): SandboxConfig;
-/** The tag names the dockerfile that built it, so a change is a new image. */
-export declare function imageTag(dockerfile: string): string;
-/**
- * The complete `docker run` argv for one step. `PATH` and `HOME` in
- * `spec.env` are host facts; the container gets its image's PATH and a
- * writable `HOME=/tmp` instead.
- */
-export declare function sandboxArgv(spec: RunSpec, cfg: SandboxConfig): string[];
-/**
- * Provisions the image lazily, once, and remembers a failure: every later
- * spec gets 125 (docker's "could not start" band) with the reason rather
- * than retrying a build that already failed.
- */
-export declare function makeSandboxRunner(opts?: Partial<SandboxConfig>): RunCommand;

package/dist/sandbox.js

@@ -1,130 +0,0 @@
-/**
- * A `RunCommand` that runs each step inside a hermetic docker container: no
- * network, no capabilities, a read-only root, and only the host paths in
- * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
- * keep nothing needs no per-repo grant — this is what lets execution be on by
- * default instead of configured.
- */
-import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
-/**
- * The node major the image ships — also the refusal boundary for `setup-node`
- * and `node2x` runtimes asking for any other major.
- */
-export const SANDBOX_NODE_MAJOR = 24;
-// git and python3: checkout's postcondition and the interpreters a script on
-// a GitHub-hosted runner takes for granted.
-export const DOCKERFILE = `FROM node:${SANDBOX_NODE_MAJOR}-slim
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*
-`;
-export function sandboxConfig(opts = {}) {
-    return {
-        dockerBin: opts.dockerBin ?? "docker",
-        uid: opts.uid ?? process.getuid(),
-        gid: opts.gid ?? process.getgid(),
-        dockerfile: opts.dockerfile ?? DOCKERFILE,
-    };
-}
-/** The tag names the dockerfile that built it, so a change is a new image. */
-export function imageTag(dockerfile) {
-    const hash = createHash("sha256").update(dockerfile).digest("hex");
-    return `willfire-sandbox:${hash.slice(0, 12)}`;
-}
-/**
- * The complete `docker run` argv for one step. `PATH` and `HOME` in
- * `spec.env` are host facts; the container gets its image's PATH and a
- * writable `HOME=/tmp` instead.
- */
-export function sandboxArgv(spec, cfg) {
-    const argv = [
-        "run",
-        "--rm",
-        "--network",
-        "none",
-        "--cap-drop",
-        "ALL",
-        "--security-opt",
-        "no-new-privileges",
-        "--read-only",
-        "--tmpfs",
-        "/tmp",
-        "--user",
-        `${cfg.uid}:${cfg.gid}`,
-    ];
-    for (const m of spec.mounts ?? []) {
-        argv.push("-v", `${m.path}:${m.path}${m.writable ? "" : ":ro"}`);
-    }
-    argv.push("-w", spec.cwd);
-    for (const [k, v] of Object.entries(spec.env)) {
-        if (k !== "PATH" && k !== "HOME") {
-            argv.push("-e", `${k}=${v}`);
-        }
-    }
-    argv.push("-e", "HOME=/tmp");
-    argv.push(imageTag(cfg.dockerfile));
-    if (spec.shell === "bash") {
-        argv.push("bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", spec.script);
-    }
-    else {
-        argv.push("sh", "-e", "-c", spec.script);
-    }
-    return argv;
-}
-// The client itself runs with the host environment — it needs the host PATH
-// and any DOCKER_HOST to find the daemon.
-function runDocker(bin, argv, stdin) {
-    return new Promise((resolvePromise) => {
-        const child = spawn(bin, argv, {
-            env: process.env,
-            stdio: [stdin === undefined ? "ignore" : "pipe", "ignore", "pipe"],
-        });
-        let stderr = "";
-        child.stderr.on("data", (d) => {
-            stderr += String(d);
-            if (stderr.length > 4096) {
-                stderr = stderr.slice(-4096);
-            }
-        });
-        child.on("spawn", () => {
-            if (stdin !== undefined) {
-                child.stdin.write(stdin);
-                child.stdin.end();
-            }
-        });
-        child.on("error", () => resolvePromise({ code: 127, stderr }));
-        child.on("close", (code) => resolvePromise({ code: code ?? 1, stderr }));
-    });
-}
-/**
- * Provisions the image lazily, once, and remembers a failure: every later
- * spec gets 125 (docker's "could not start" band) with the reason rather
- * than retrying a build that already failed.
- */
-export function makeSandboxRunner(opts = {}) {
-    const cfg = sandboxConfig(opts);
-    const tag = imageTag(cfg.dockerfile);
-    let ensured = null;
-    const ensureImage = () => {
-        ensured ??= (async () => {
-            const inspect = await runDocker(cfg.dockerBin, ["image", "inspect", tag]);
-            if (inspect.code === 0) {
-                return null;
-            }
-            const build = await runDocker(cfg.dockerBin, ["build", "-t", tag, "-"], cfg.dockerfile);
-            if (build.code === 0) {
-                return null;
-            }
-            const trimmed = build.stderr.trim();
-            const tail = trimmed.slice(trimmed.lastIndexOf("\n") + 1);
-            return `cannot build sandbox image ${tag}${tail === "" ? "" : ` (${tail})`}`;
-        })();
-        return ensured;
-    };
-    return async (spec) => {
-        const failure = await ensureImage();
-        if (failure !== null) {
-            return { code: 125, stderr: failure };
-        }
-        return runDocker(cfg.dockerBin, sandboxArgv(spec, cfg));
-    };
-}