willfire 0.1.21 → 0.1.23

package/README.md

@@ -17,11 +17,12 @@ pnpm add willfire
 ## Library
 
 ```ts
-import { predict } from "willfire";
-import { getOctokit } from "@actions/github"; // or new Octokit({ auth: token })
+import { makeGithubClient, predict } from "willfire";
 
+// makeGithubClient reads GH_TOKEN or GITHUB_TOKEN from the environment; any
+// object satisfying the exported GithubClient interface works in its place.
 const { entries, checkNames, skip, sources } = await predict(
-  getOctokit(token),
+  makeGithubClient(),
   "owner/repo",
   123,
   { action: context.payload.action }, // "opened" | "synchronize" | "reopened"

package/dist/cli/isPrEventAction.d.ts

@@ -0,0 +1,2 @@
+import type { PrEventAction } from "../types.js";
+export declare const isPrEventAction: (v: string) => v is PrEventAction;

package/dist/cli/isPrEventAction.js

@@ -0,0 +1 @@
+export const isPrEventAction = (v) => v === "opened" || v === "synchronize" || v === "reopened";

package/dist/cli/parseArgs.js

@@ -1,5 +1,5 @@
+import { isPrEventAction } from "./isPrEventAction.js";
 const USAGE = "usage: predict --repo owner/name --pr N [--action opened|synchronize|reopened] [--json]";
-const isPrEventAction = (v) => v === "opened" || v === "synchronize" || v === "reopened";
 export function parseArgs(argv) {
     const get = (flag) => {
         const i = argv.indexOf(flag);

package/dist/cli.js

@@ -6,12 +6,12 @@
 // GITHUB_TOKEN.
 import { parseArgs } from "./cli/parseArgs.js";
 import { isWorkflowEntry } from "./entries/isWorkflowEntry.js";
-import { makeOctokit } from "./predict/makeOctokit.js";
+import { makeGithubClient } from "./predict/makeGithubClient.js";
 import { predict } from "./predict/predict.js";
 const isMain = /cli\.(ts|js)$|\/willfire$/.test(process.argv[1] ?? "");
 if (isMain) {
     const args = parseArgs(process.argv.slice(2));
-    const prediction = await predict(makeOctokit(), args.repo, args.pr, {
+    const prediction = await predict(makeGithubClient(), args.repo, args.pr, {
         action: args.action,
     });
     const { entries, skip, sources } = prediction;

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { patternToRegex, matchFilters } from "./filters/index.js";
 export { expandMatrix } from "./matrix/index.js";
 export { evalIf, expandWorkflowJobs } from "./jobs/index.js";
 export { parseUses } from "./uses/index.js";
-export { makeOctokit, predict } from "./predict/index.js";
+export { makeGithubClient, predict } from "./predict/index.js";
+export type { GithubClient } from "./predict/index.js";
 export type { ExecOutcome, JobExecutor } from "./execute.js";
 export type { JobName, WorkflowEntry, JobEntry, Entry, Prediction, PrEventAction, PredictOptions, Ctx, ExpandedJob, SourceRef, WorkflowSource, FetchWorkflow, ResolveRef, WorkflowReader, UsesTarget, } from "./types.js";

package/dist/index.js

@@ -3,4 +3,4 @@ export { patternToRegex, matchFilters } from "./filters/index.js";
 export { expandMatrix } from "./matrix/index.js";
 export { evalIf, expandWorkflowJobs } from "./jobs/index.js";
 export { parseUses } from "./uses/index.js";
-export { makeOctokit, predict } from "./predict/index.js";
+export { makeGithubClient, predict } from "./predict/index.js";

package/dist/predict/index.d.ts

@@ -1,4 +1,5 @@
-export { makeOctokit } from "./makeOctokit.js";
+export { makeGithubClient } from "./makeGithubClient.js";
+export type { GithubClient } from "./makeGithubClient.js";
 export { sourceKey } from "./sourceKey.js";
 export { stackTargetRef } from "./stackTargetRef.js";
 export { finalizePrediction } from "./finalizePrediction.js";

package/dist/predict/index.js

@@ -1,4 +1,4 @@
-export { makeOctokit } from "./makeOctokit.js";
+export { makeGithubClient } from "./makeGithubClient.js";
 export { sourceKey } from "./sourceKey.js";
 export { stackTargetRef } from "./stackTargetRef.js";
 export { finalizePrediction } from "./finalizePrediction.js";

package/dist/predict/makeGithubClient.d.ts

@@ -0,0 +1,108 @@
+interface RepoParams {
+    owner: string;
+    repo: string;
+}
+interface PageParams {
+    per_page?: number;
+    page?: number;
+}
+/** Response types carry only the fields willfire actually reads. */
+export interface GithubPullSummary {
+    base: {
+        ref: string;
+    };
+    merge_commit_sha: string | null;
+}
+export interface GithubPull extends GithubPullSummary {
+    commits: number;
+    head: {
+        sha: string;
+    };
+}
+export interface GithubPullFile {
+    filename: string;
+}
+export interface GithubCommit {
+    sha: string;
+    commit: {
+        message: string;
+    };
+    parents: {
+        sha: string;
+    }[];
+}
+export interface GithubWorkflow {
+    path: string;
+    state: string;
+}
+export interface GithubWorkflowRun {
+    id: number;
+    path: string;
+    status: string | null;
+}
+export interface GithubJob {
+    name: string;
+    conclusion: string | null;
+}
+export interface GithubClient {
+    rest: {
+        pulls: {
+            get(params: RepoParams & {
+                pull_number: number;
+            }): Promise<{
+                data: GithubPull;
+            }>;
+            list(params: RepoParams & PageParams & {
+                state: string;
+                head: string;
+            }): Promise<{
+                data: GithubPullSummary[];
+            }>;
+            listFiles(params: RepoParams & PageParams & {
+                pull_number: number;
+            }): Promise<{
+                data: GithubPullFile[];
+            }>;
+        };
+        repos: {
+            getCommit(params: RepoParams & {
+                ref: string;
+            }): Promise<{
+                data: GithubCommit;
+            }>;
+            /** The file at `path` as text — always the `raw` media type. */
+            getContent(params: RepoParams & {
+                path: string;
+                ref: string;
+            }): Promise<{
+                data: string;
+            }>;
+            downloadTarballArchive(params: RepoParams & {
+                ref: string;
+            }): Promise<{
+                data: ArrayBuffer;
+            }>;
+        };
+        actions: {
+            listRepoWorkflows(params: RepoParams & PageParams): Promise<{
+                data: GithubWorkflow[];
+            }>;
+            listWorkflowRunsForRepo(params: RepoParams & PageParams & {
+                head_sha: string;
+                event: string;
+            }): Promise<{
+                data: GithubWorkflowRun[];
+            }>;
+            listJobsForWorkflowRun(params: RepoParams & PageParams & {
+                run_id: number;
+            }): Promise<{
+                data: GithubJob[];
+            }>;
+        };
+    };
+    paginate<P extends PageParams, T>(route: (params: P) => Promise<{
+        data: T[];
+    }>, params: P): Promise<T[]>;
+}
+export declare function makeGithubClient(): GithubClient;
+export {};

package/dist/predict/makeGithubClient.js

@@ -0,0 +1,96 @@
+// The GitHub REST surface willfire uses: a handful of GET endpoints plus the
+// tarball download, over plain `fetch`. The shape mirrors the octokit subset
+// it replaced (#75) so call sites and their fakes carry over unchanged.
+export function makeGithubClient() {
+    const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN;
+    if (!token) {
+        throw new Error("GH_TOKEN or GITHUB_TOKEN must be set");
+    }
+    const request = async (path, query, accept) => {
+        const url = new URL(`https://api.github.com${path}`);
+        for (const [key, value] of Object.entries(query)) {
+            if (value !== undefined) {
+                url.searchParams.set(key, String(value));
+            }
+        }
+        const res = await fetch(url, {
+            headers: {
+                accept,
+                authorization: `Bearer ${token}`,
+                // GitHub rejects requests without a User-Agent.
+                "user-agent": "willfire",
+                "x-github-api-version": "2022-11-28",
+            },
+        });
+        if (!res.ok) {
+            throw new Error(`GitHub API ${res.status} for ${path}`);
+        }
+        return res;
+    };
+    const json = async (path, query = {}) => {
+        const res = await request(path, query, "application/vnd.github+json");
+        return { data: (await res.json()) };
+    };
+    return {
+        rest: {
+            pulls: {
+                get: ({ owner, repo, pull_number }) => json(`/repos/${owner}/${repo}/pulls/${pull_number}`),
+                list: ({ owner, repo, state, head, per_page, page }) => json(`/repos/${owner}/${repo}/pulls`, {
+                    state,
+                    head,
+                    per_page,
+                    page,
+                }),
+                listFiles: ({ owner, repo, pull_number, per_page, page }) => json(`/repos/${owner}/${repo}/pulls/${pull_number}/files`, {
+                    per_page,
+                    page,
+                }),
+            },
+            repos: {
+                getCommit: ({ owner, repo, ref }) => json(`/repos/${owner}/${repo}/commits/${ref}`),
+                getContent: async ({ owner, repo, path, ref }) => {
+                    const res = await request(`/repos/${owner}/${repo}/contents/${path}`, { ref }, "application/vnd.github.raw+json");
+                    return { data: await res.text() };
+                },
+                // 302 to a short-lived codeload URL; fetch follows it, and undici
+                // drops the authorization header on the cross-origin hop.
+                downloadTarballArchive: async ({ owner, repo, ref }) => {
+                    const res = await request(`/repos/${owner}/${repo}/tarball/${ref}`, {}, "application/vnd.github+json");
+                    return { data: await res.arrayBuffer() };
+                },
+            },
+            actions: {
+                // The actions list endpoints wrap their arrays in an envelope; unwrap
+                // here so `paginate` sees one shape everywhere.
+                listRepoWorkflows: async ({ owner, repo, per_page, page }) => {
+                    const { data } = await json(`/repos/${owner}/${repo}/actions/workflows`, { per_page, page });
+                    return { data: data.workflows };
+                },
+                listWorkflowRunsForRepo: async ({ owner, repo, head_sha, event, per_page, page }) => {
+                    const { data } = await json(`/repos/${owner}/${repo}/actions/runs`, { head_sha, event, per_page, page });
+                    return { data: data.workflow_runs };
+                },
+                listJobsForWorkflowRun: async ({ owner, repo, run_id, per_page, page }) => {
+                    const { data } = await json(`/repos/${owner}/${repo}/actions/runs/${run_id}/jobs`, { per_page, page });
+                    return { data: data.jobs };
+                },
+            },
+        },
+        // A short page ends the walk. A count landing exactly on a page boundary
+        // costs one extra empty-page request, which keeps this free of Link-header
+        // parsing.
+        paginate: async (route, params) => {
+            const perPage = params.per_page ?? 30;
+            const all = [];
+            let page = 1;
+            let full = true;
+            while (full) {
+                const { data } = await route({ ...params, page });
+                all.push(...data);
+                full = data.length === perPage;
+                page += 1;
+            }
+            return all;
+        },
+    };
+}

package/dist/predict/makeLiveExecutor.d.ts

@@ -1,5 +1,5 @@
-import type { Octokit } from "@octokit/rest";
 import { type JobExecutor, type RunCommand } from "../execute.js";
+import type { GithubClient } from "./makeGithubClient.js";
 import type { ResolveRef, WorkflowSource } from "../types.js";
 export interface LiveExecutorOpts {
     /** How steps run; the hermetic docker sandbox by default. */
@@ -17,4 +17,4 @@ export interface LiveExecutorOpts {
  * docker sandbox; infrastructure subprocesses (`tar`, `git`) run on the host,
  * since the clone needs the network the sandbox denies.
  */
-export declare function makeLiveExecutor(octokit: Octokit, workspace: WorkflowSource, resolveRef: ResolveRef, opts?: LiveExecutorOpts): JobExecutor;
+export declare function makeLiveExecutor(github: GithubClient, workspace: WorkflowSource, resolveRef: ResolveRef, opts?: LiveExecutorOpts): JobExecutor;

package/dist/predict/makeLiveExecutor.js

@@ -1,14 +1,15 @@
 import { makeCloneProvider, makeExecutor, makeTreeProvider, runShell, } from "../execute.js";
-import { makeSandboxRunner, SANDBOX_NODE_MAJOR } from "../sandbox.js";
+import { makeSandboxRunner } from "../sandbox/makeSandboxRunner.js";
+import { SANDBOX_NODE_MAJOR } from "../sandbox/sandboxConfig.js";
 /**
  * The executor `predict` uses by default. Repo-authored steps run in the
  * docker sandbox; infrastructure subprocesses (`tar`, `git`) run on the host,
  * since the clone needs the network the sandbox denies.
  */
-export function makeLiveExecutor(octokit, workspace, resolveRef, opts = {}) {
+export function makeLiveExecutor(github, workspace, resolveRef, opts = {}) {
     const download = async (src) => {
         try {
-            const { data } = await octokit.rest.repos.downloadTarballArchive({
+            const { data } = await github.rest.repos.downloadTarballArchive({
                 owner: src.owner,
                 repo: src.repo,
                 ref: src.sha,

package/dist/predict/predict.d.ts

@@ -1,3 +1,3 @@
-import type { Octokit } from "@octokit/rest";
+import type { GithubClient } from "./makeGithubClient.js";
 import type { Prediction, PredictOptions } from "../types.js";
-export declare function predict(octokit: Octokit, repo: string, prNumber: number, opts?: PredictOptions): Promise<Prediction>;
+export declare function predict(github: GithubClient, repo: string, prNumber: number, opts?: PredictOptions): Promise<Prediction>;

package/dist/predict/predict.js

@@ -15,16 +15,16 @@ import { sourceKey } from "./sourceKey.js";
 import { stackTargetRef } from "./stackTargetRef.js";
 const SKIP_RE = /\[(skip ci|ci skip|no ci|skip actions|actions skip)\]/i;
 const SKIP_TRAILER_RE = /^skip-checks:\s*true/im;
-export async function predict(octokit, repo, prNumber, opts = {}) {
+export async function predict(github, repo, prNumber, opts = {}) {
     const [owner, name] = repo.split("/");
     const base = { owner, repo: name };
-    const { data: pr } = await octokit.rest.pulls.get({ ...base, pull_number: prNumber });
-    const files = await octokit.paginate(octokit.rest.pulls.listFiles, {
+    const { data: pr } = await github.rest.pulls.get({ ...base, pull_number: prNumber });
+    const files = await github.paginate(github.rest.pulls.listFiles, {
         ...base,
         pull_number: prNumber,
         per_page: 100,
     });
-    const stackTarget = await stackTargetRef(octokit, owner, name, pr);
+    const stackTarget = await stackTargetRef(github, owner, name, pr);
     const ctx = {
         // The caller's answer wins whenever it has one. The commit-count fallback
         // is a guess kept only so existing callers keep working.
@@ -43,7 +43,7 @@ export async function predict(octokit, repo, prNumber, opts = {}) {
     // is in from the start: it is read even on the skip path, where the commit
     // message is what decides the verdict.
     const sources = new Map([[sourceKey(headSource), headSource]]);
-    const { data: headCommit } = await octokit.rest.repos.getCommit({
+    const { data: headCommit } = await github.rest.repos.getCommit({
         ...base,
         ref: headSha,
     });
@@ -63,7 +63,7 @@ export async function predict(octokit, repo, prNumber, opts = {}) {
         }
         let sha;
         try {
-            const { data } = await octokit.rest.repos.getCommit({
+            const { data } = await github.rest.repos.getCommit({
                 owner: src.owner,
                 repo: src.repo,
                 ref: src.ref,
@@ -96,12 +96,11 @@ export async function predict(octokit, repo, prNumber, opts = {}) {
         }
         let content;
         try {
-            const { data } = await octokit.rest.repos.getContent({
+            const { data } = await github.rest.repos.getContent({
                 owner: src.owner,
                 repo: src.repo,
                 path,
                 ref: src.sha,
-                mediaType: { format: "raw" },
             });
             content = data;
         }
@@ -116,9 +115,9 @@ export async function predict(octokit, repo, prNumber, opts = {}) {
     const reader = { fetchWorkflow, resolveRef };
     // Execution is on by default and costs nothing until a workflow needs it.
     const executor = opts.executor === undefined
-        ? makeLiveExecutor(octokit, headSource, resolveRef)
+        ? makeLiveExecutor(github, headSource, resolveRef)
         : (opts.executor ?? undefined);
-    const workflows = await octokit.paginate(octokit.rest.actions.listRepoWorkflows, {
+    const workflows = await github.paginate(github.rest.actions.listRepoWorkflows, {
         ...base,
         per_page: 100,
     });

package/dist/predict/stackTargetRef.d.ts

@@ -1,4 +1,4 @@
-import type { Octokit } from "@octokit/rest";
+import type { GithubClient } from "./makeGithubClient.js";
 import type { StackNode } from "../types.js";
 /**
  * The branch this PR's stack ultimately targets, or null for a plain PR.
@@ -11,4 +11,4 @@ import type { StackNode } from "../types.js";
  * parent PR's own merge sha in stacked mode. Anything undecidable ends the
  * walk at the last proven hop; never throws.
  */
-export declare function stackTargetRef(octokit: Octokit, owner: string, repo: string, pr: StackNode): Promise<string | null>;
+export declare function stackTargetRef(github: GithubClient, owner: string, repo: string, pr: StackNode): Promise<string | null>;

package/dist/predict/stackTargetRef.js

@@ -11,7 +11,7 @@ const MAX_STACK_DEPTH = 10;
  * parent PR's own merge sha in stacked mode. Anything undecidable ends the
  * walk at the last proven hop; never throws.
  */
-export async function stackTargetRef(octokit, owner, repo, pr) {
+export async function stackTargetRef(github, owner, repo, pr) {
     let target = null;
     let cur = pr;
     try {
@@ -20,7 +20,7 @@ export async function stackTargetRef(octokit, owner, repo, pr) {
             if (mergeSha === null) {
                 break;
             }
-            const { data: preview } = await octokit.rest.repos.getCommit({
+            const { data: preview } = await github.rest.repos.getCommit({
                 owner,
                 repo,
                 ref: mergeSha,
@@ -29,7 +29,7 @@ export async function stackTargetRef(octokit, owner, repo, pr) {
             if (previewParent === undefined) {
                 break;
             }
-            const { data: baseTip } = await octokit.rest.repos.getCommit({
+            const { data: baseTip } = await github.rest.repos.getCommit({
                 owner,
                 repo,
                 ref: cur.base.ref,
@@ -40,7 +40,7 @@ export async function stackTargetRef(octokit, owner, repo, pr) {
             }
             // Otherwise only an exact match against an open PR whose head is the
             // base branch proves stacked mode; a stale preview matches nothing.
-            const { data: candidates } = await octokit.rest.pulls.list({
+            const { data: candidates } = await github.rest.pulls.list({
                 owner,
                 repo,
                 state: "open",

package/dist/sandbox/imageTag.d.ts

@@ -0,0 +1,2 @@
+/** The tag names the dockerfile that built it, so a change is a new image. */
+export declare function imageTag(dockerfile: string): string;

package/dist/sandbox/imageTag.js

@@ -0,0 +1,6 @@
+import { createHash } from "node:crypto";
+/** The tag names the dockerfile that built it, so a change is a new image. */
+export function imageTag(dockerfile) {
+    const hash = createHash("sha256").update(dockerfile).digest("hex");
+    return `willfire-sandbox:${hash.slice(0, 12)}`;
+}

package/dist/sandbox/index.d.ts

@@ -0,0 +1,4 @@
+export { DOCKERFILE, SANDBOX_NODE_MAJOR, sandboxConfig, type SandboxConfig } from "./sandboxConfig.js";
+export { imageTag } from "./imageTag.js";
+export { sandboxArgv } from "./sandboxArgv.js";
+export { makeSandboxRunner } from "./makeSandboxRunner.js";

package/dist/sandbox/index.js

@@ -0,0 +1,4 @@
+export { DOCKERFILE, SANDBOX_NODE_MAJOR, sandboxConfig } from "./sandboxConfig.js";
+export { imageTag } from "./imageTag.js";
+export { sandboxArgv } from "./sandboxArgv.js";
+export { makeSandboxRunner } from "./makeSandboxRunner.js";

package/dist/sandbox/makeSandboxRunner.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A `RunCommand` that runs each step inside a hermetic docker container: no
+ * network, no capabilities, a read-only root, and only the host paths in
+ * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
+ * keep nothing needs no per-repo grant — this is what lets execution be on by
+ * default instead of configured.
+ */
+import type { RunCommand } from "../execute.js";
+import { type SandboxConfig } from "./sandboxConfig.js";
+/**
+ * Provisions the image lazily, once, and remembers a failure: every later
+ * spec gets 125 (docker's "could not start" band) with the reason rather
+ * than retrying a build that already failed.
+ */
+export declare function makeSandboxRunner(opts?: Partial<SandboxConfig>): RunCommand;

package/dist/sandbox/makeSandboxRunner.js

@@ -0,0 +1,44 @@
+/**
+ * A `RunCommand` that runs each step inside a hermetic docker container: no
+ * network, no capabilities, a read-only root, and only the host paths in
+ * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
+ * keep nothing needs no per-repo grant — this is what lets execution be on by
+ * default instead of configured.
+ */
+import { imageTag } from "./imageTag.js";
+import { runDocker } from "./runDocker.js";
+import { sandboxArgv } from "./sandboxArgv.js";
+import { sandboxConfig } from "./sandboxConfig.js";
+/**
+ * Provisions the image lazily, once, and remembers a failure: every later
+ * spec gets 125 (docker's "could not start" band) with the reason rather
+ * than retrying a build that already failed.
+ */
+export function makeSandboxRunner(opts = {}) {
+    const cfg = sandboxConfig(opts);
+    const tag = imageTag(cfg.dockerfile);
+    let ensured = null;
+    const ensureImage = () => {
+        ensured ??= (async () => {
+            const inspect = await runDocker(cfg.dockerBin, ["image", "inspect", tag]);
+            if (inspect.code === 0) {
+                return null;
+            }
+            const build = await runDocker(cfg.dockerBin, ["build", "-t", tag, "-"], cfg.dockerfile);
+            if (build.code === 0) {
+                return null;
+            }
+            const trimmed = build.stderr.trim();
+            const tail = trimmed.slice(trimmed.lastIndexOf("\n") + 1);
+            return `cannot build sandbox image ${tag}${tail === "" ? "" : ` (${tail})`}`;
+        })();
+        return ensured;
+    };
+    return async (spec) => {
+        const failure = await ensureImage();
+        if (failure !== null) {
+            return { code: 125, stderr: failure };
+        }
+        return runDocker(cfg.dockerBin, sandboxArgv(spec, cfg));
+    };
+}

package/dist/sandbox/runDocker.d.ts

@@ -0,0 +1,4 @@
+export declare function runDocker(bin: string, argv: string[], stdin?: string): Promise<{
+    code: number;
+    stderr: string;
+}>;

package/dist/sandbox/runDocker.js

@@ -0,0 +1,26 @@
+import { spawn } from "node:child_process";
+// The client itself runs with the host environment — it needs the host PATH
+// and any DOCKER_HOST to find the daemon.
+export function runDocker(bin, argv, stdin) {
+    return new Promise((resolvePromise) => {
+        const child = spawn(bin, argv, {
+            env: process.env,
+            stdio: [stdin === undefined ? "ignore" : "pipe", "ignore", "pipe"],
+        });
+        let stderr = "";
+        child.stderr.on("data", (d) => {
+            stderr += String(d);
+            if (stderr.length > 4096) {
+                stderr = stderr.slice(-4096);
+            }
+        });
+        child.on("spawn", () => {
+            if (stdin !== undefined) {
+                child.stdin.write(stdin);
+                child.stdin.end();
+            }
+        });
+        child.on("error", () => resolvePromise({ code: 127, stderr }));
+        child.on("close", (code) => resolvePromise({ code: code ?? 1, stderr }));
+    });
+}

package/dist/sandbox/sandboxArgv.d.ts

@@ -0,0 +1,8 @@
+import type { RunSpec } from "../execute.js";
+import type { SandboxConfig } from "./sandboxConfig.js";
+/**
+ * The complete `docker run` argv for one step. `PATH` and `HOME` in
+ * `spec.env` are host facts; the container gets its image's PATH and a
+ * writable `HOME=/tmp` instead.
+ */
+export declare function sandboxArgv(spec: RunSpec, cfg: SandboxConfig): string[];

package/dist/sandbox/sandboxArgv.js

@@ -0,0 +1,41 @@
+import { imageTag } from "./imageTag.js";
+/**
+ * The complete `docker run` argv for one step. `PATH` and `HOME` in
+ * `spec.env` are host facts; the container gets its image's PATH and a
+ * writable `HOME=/tmp` instead.
+ */
+export function sandboxArgv(spec, cfg) {
+    const argv = [
+        "run",
+        "--rm",
+        "--network",
+        "none",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--read-only",
+        "--tmpfs",
+        "/tmp",
+        "--user",
+        `${cfg.uid}:${cfg.gid}`,
+    ];
+    for (const m of spec.mounts ?? []) {
+        argv.push("-v", `${m.path}:${m.path}${m.writable ? "" : ":ro"}`);
+    }
+    argv.push("-w", spec.cwd);
+    for (const [k, v] of Object.entries(spec.env)) {
+        if (k !== "PATH" && k !== "HOME") {
+            argv.push("-e", `${k}=${v}`);
+        }
+    }
+    argv.push("-e", "HOME=/tmp");
+    argv.push(imageTag(cfg.dockerfile));
+    if (spec.shell === "bash") {
+        argv.push("bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", spec.script);
+    }
+    else {
+        argv.push("sh", "-e", "-c", spec.script);
+    }
+    return argv;
+}

package/dist/sandbox/sandboxConfig.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The node major the image ships — also the refusal boundary for `setup-node`
+ * and `node2x` runtimes asking for any other major.
+ */
+export declare const SANDBOX_NODE_MAJOR = 24;
+export declare const DOCKERFILE = "FROM node:24-slim\nRUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*\n";
+export interface SandboxConfig {
+    dockerBin: string;
+    uid: number;
+    gid: number;
+    dockerfile: string;
+}
+export declare function sandboxConfig(opts?: Partial<SandboxConfig>): SandboxConfig;

package/dist/sandbox/sandboxConfig.js

@@ -0,0 +1,18 @@
+/**
+ * The node major the image ships — also the refusal boundary for `setup-node`
+ * and `node2x` runtimes asking for any other major.
+ */
+export const SANDBOX_NODE_MAJOR = 24;
+// git and python3: checkout's postcondition and the interpreters a script on
+// a GitHub-hosted runner takes for granted.
+export const DOCKERFILE = `FROM node:${SANDBOX_NODE_MAJOR}-slim
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*
+`;
+export function sandboxConfig(opts = {}) {
+    return {
+        dockerBin: opts.dockerBin ?? "docker",
+        uid: opts.uid ?? process.getuid(),
+        gid: opts.gid ?? process.getgid(),
+        dockerfile: opts.dockerfile ?? DOCKERFILE,
+    };
+}

package/dist/verify.js

@@ -4,7 +4,7 @@
 //
 // Ground truth: workflow runs for the PR head SHA with a pull_request event,
 // and the job entries inside each run (skipped jobs included).
-import { isJobEntry, makeOctokit, predict } from "./index.js";
+import { isJobEntry, makeGithubClient, predict } from "./index.js";
 async function actualEntries(octokit, repo, prNumber) {
     const [owner, name] = repo.split("/");
     const base = { owner, repo: name };
@@ -43,7 +43,7 @@ if (!repo || !prArg) {
     process.exit(2);
 }
 const pr = Number(prArg);
-const octokit = makeOctokit();
+const octokit = makeGithubClient();
 const { entries: predictedRaw } = await predict(octokit, repo, pr);
 // Compare on the resolved check name — that is the string GitHub actually
 // puts on the job. Entries whose name could not be resolved statically have

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "willfire",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Predict the set of CI check entries GitHub Actions will create for a pull request",
   "license": "MIT",
   "packageManager": "pnpm@10.33.0",
@@ -46,7 +46,6 @@
     "verify": "tsx src/verify.ts"
   },
   "dependencies": {
-    "@octokit/rest": "^22.0.0",
     "yaml": "^2.6.0"
   },
   "devDependencies": {

package/dist/predict/makeOctokit.d.ts

@@ -1,2 +0,0 @@
-import { Octokit } from "@octokit/rest";
-export declare function makeOctokit(): Octokit;

package/dist/predict/makeOctokit.js

@@ -1,8 +0,0 @@
-import { Octokit } from "@octokit/rest";
-export function makeOctokit() {
-    const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN;
-    if (!token) {
-        throw new Error("GH_TOKEN or GITHUB_TOKEN must be set");
-    }
-    return new Octokit({ auth: token });
-}

package/dist/sandbox.d.ts

@@ -1,35 +0,0 @@
-/**
- * A `RunCommand` that runs each step inside a hermetic docker container: no
- * network, no capabilities, a read-only root, and only the host paths in
- * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
- * keep nothing needs no per-repo grant — this is what lets execution be on by
- * default instead of configured.
- */
-import type { RunCommand, RunSpec } from "./execute.js";
-/**
- * The node major the image ships — also the refusal boundary for `setup-node`
- * and `node2x` runtimes asking for any other major.
- */
-export declare const SANDBOX_NODE_MAJOR = 24;
-export declare const DOCKERFILE = "FROM node:24-slim\nRUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*\n";
-export interface SandboxConfig {
-    dockerBin: string;
-    uid: number;
-    gid: number;
-    dockerfile: string;
-}
-export declare function sandboxConfig(opts?: Partial<SandboxConfig>): SandboxConfig;
-/** The tag names the dockerfile that built it, so a change is a new image. */
-export declare function imageTag(dockerfile: string): string;
-/**
- * The complete `docker run` argv for one step. `PATH` and `HOME` in
- * `spec.env` are host facts; the container gets its image's PATH and a
- * writable `HOME=/tmp` instead.
- */
-export declare function sandboxArgv(spec: RunSpec, cfg: SandboxConfig): string[];
-/**
- * Provisions the image lazily, once, and remembers a failure: every later
- * spec gets 125 (docker's "could not start" band) with the reason rather
- * than retrying a build that already failed.
- */
-export declare function makeSandboxRunner(opts?: Partial<SandboxConfig>): RunCommand;

package/dist/sandbox.js

@@ -1,130 +0,0 @@
-/**
- * A `RunCommand` that runs each step inside a hermetic docker container: no
- * network, no capabilities, a read-only root, and only the host paths in
- * `RunSpec.mounts`, bound at their own paths. Code that can reach nothing and
- * keep nothing needs no per-repo grant — this is what lets execution be on by
- * default instead of configured.
- */
-import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
-/**
- * The node major the image ships — also the refusal boundary for `setup-node`
- * and `node2x` runtimes asking for any other major.
- */
-export const SANDBOX_NODE_MAJOR = 24;
-// git and python3: checkout's postcondition and the interpreters a script on
-// a GitHub-hosted runner takes for granted.
-export const DOCKERFILE = `FROM node:${SANDBOX_NODE_MAJOR}-slim
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates python3 && rm -rf /var/lib/apt/lists/*
-`;
-export function sandboxConfig(opts = {}) {
-    return {
-        dockerBin: opts.dockerBin ?? "docker",
-        uid: opts.uid ?? process.getuid(),
-        gid: opts.gid ?? process.getgid(),
-        dockerfile: opts.dockerfile ?? DOCKERFILE,
-    };
-}
-/** The tag names the dockerfile that built it, so a change is a new image. */
-export function imageTag(dockerfile) {
-    const hash = createHash("sha256").update(dockerfile).digest("hex");
-    return `willfire-sandbox:${hash.slice(0, 12)}`;
-}
-/**
- * The complete `docker run` argv for one step. `PATH` and `HOME` in
- * `spec.env` are host facts; the container gets its image's PATH and a
- * writable `HOME=/tmp` instead.
- */
-export function sandboxArgv(spec, cfg) {
-    const argv = [
-        "run",
-        "--rm",
-        "--network",
-        "none",
-        "--cap-drop",
-        "ALL",
-        "--security-opt",
-        "no-new-privileges",
-        "--read-only",
-        "--tmpfs",
-        "/tmp",
-        "--user",
-        `${cfg.uid}:${cfg.gid}`,
-    ];
-    for (const m of spec.mounts ?? []) {
-        argv.push("-v", `${m.path}:${m.path}${m.writable ? "" : ":ro"}`);
-    }
-    argv.push("-w", spec.cwd);
-    for (const [k, v] of Object.entries(spec.env)) {
-        if (k !== "PATH" && k !== "HOME") {
-            argv.push("-e", `${k}=${v}`);
-        }
-    }
-    argv.push("-e", "HOME=/tmp");
-    argv.push(imageTag(cfg.dockerfile));
-    if (spec.shell === "bash") {
-        argv.push("bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", spec.script);
-    }
-    else {
-        argv.push("sh", "-e", "-c", spec.script);
-    }
-    return argv;
-}
-// The client itself runs with the host environment — it needs the host PATH
-// and any DOCKER_HOST to find the daemon.
-function runDocker(bin, argv, stdin) {
-    return new Promise((resolvePromise) => {
-        const child = spawn(bin, argv, {
-            env: process.env,
-            stdio: [stdin === undefined ? "ignore" : "pipe", "ignore", "pipe"],
-        });
-        let stderr = "";
-        child.stderr.on("data", (d) => {
-            stderr += String(d);
-            if (stderr.length > 4096) {
-                stderr = stderr.slice(-4096);
-            }
-        });
-        child.on("spawn", () => {
-            if (stdin !== undefined) {
-                child.stdin.write(stdin);
-                child.stdin.end();
-            }
-        });
-        child.on("error", () => resolvePromise({ code: 127, stderr }));
-        child.on("close", (code) => resolvePromise({ code: code ?? 1, stderr }));
-    });
-}
-/**
- * Provisions the image lazily, once, and remembers a failure: every later
- * spec gets 125 (docker's "could not start" band) with the reason rather
- * than retrying a build that already failed.
- */
-export function makeSandboxRunner(opts = {}) {
-    const cfg = sandboxConfig(opts);
-    const tag = imageTag(cfg.dockerfile);
-    let ensured = null;
-    const ensureImage = () => {
-        ensured ??= (async () => {
-            const inspect = await runDocker(cfg.dockerBin, ["image", "inspect", tag]);
-            if (inspect.code === 0) {
-                return null;
-            }
-            const build = await runDocker(cfg.dockerBin, ["build", "-t", tag, "-"], cfg.dockerfile);
-            if (build.code === 0) {
-                return null;
-            }
-            const trimmed = build.stderr.trim();
-            const tail = trimmed.slice(trimmed.lastIndexOf("\n") + 1);
-            return `cannot build sandbox image ${tag}${tail === "" ? "" : ` (${tail})`}`;
-        })();
-        return ensured;
-    };
-    return async (spec) => {
-        const failure = await ensureImage();
-        if (failure !== null) {
-            return { code: 125, stderr: failure };
-        }
-        return runDocker(cfg.dockerBin, sandboxArgv(spec, cfg));
-    };
-}