mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-01 22:45:02 +01:00
/ship review of #3633 (security CRITICAL x2): gh pr list --head "$branch" ran through sh(), so a branch named x$(cmd) executed. Replay 3 of gstack-evals #34: a local bare origin under GH_HOST failed the carry check, and RUNTIME_LINES counted JSON. The fixture's origin is now a GitHub URL mapped to the bare repo by insteadOf. Failing-first tests. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
110 lines
6.9 KiB
TypeScript
110 lines
6.9 KiB
TypeScript
/**
|
|
* ship-bin-common — what gstack-ship-preflight and gstack-ship-release share: running git
|
|
* and sibling bins with timeouts, flag reading, the effective ship policy, and the compact
|
|
* result every step prints (KEY: lines, STOP: where the agent must judge, NEXT: what it
|
|
* does next). The bins chain existing commands and never make a decision the /ship prose
|
|
* assigns to the agent.
|
|
*/
|
|
import { spawn, spawnSync } from 'node:child_process';
|
|
import * as path from 'node:path';
|
|
import { BIN_DIR, runBashSync, runScriptSync, scriptInvocation } from './script-invocation';
|
|
|
|
export interface Run { status: number | null; stdout: string; stderr: string }
|
|
const done = (r: { status: number | null; stdout?: string | Buffer | null; stderr?: string | Buffer | null; error?: Error }): Run =>
|
|
({ status: r.status, stdout: String(r.stdout ?? ''), stderr: String(r.stderr ?? '') + (r.error ? r.error.message : '') });
|
|
|
|
export function git(cwd: string, args: string[], timeout = 120_000): Run {
|
|
return done(spawnSync('git', args, { cwd, encoding: 'utf8', timeout, maxBuffer: 64 * 1024 * 1024, env: { ...process.env, GIT_TERMINAL_PROMPT: '0' } }));
|
|
}
|
|
export function bin(cwd: string, name: string, args: string[], timeout = 600_000): Run {
|
|
return done(runScriptSync(path.join(BIN_DIR, name), args, { cwd, encoding: 'utf8', timeout, maxBuffer: 64 * 1024 * 1024 }));
|
|
}
|
|
/** Whether origin's configured URL names a host (https, ssh or scp form), before any insteadOf rewrite; a local path or file:// remote has none, so gh cannot map it to a repository. */
|
|
export function hostedOrigin(cwd: string): boolean {
|
|
const url = git(cwd, ['config', '--get', 'remote.origin.url']).stdout.trim();
|
|
return /^(?:[a-z][a-z0-9+.-]*:\/\/(?:[^@/\s]+@)?[^/:\s]+[:/]|[^@/\s]+@[^/:\s]+:)\S+$/i.test(url) && !/^file:/i.test(url);
|
|
}
|
|
/** gh with argv, never a shell, so a branch name cannot change what runs. */
|
|
export function gh(cwd: string, args: string[], timeout = 60_000): Run {
|
|
return done(spawnSync('gh', args, { cwd, encoding: 'utf8', timeout, maxBuffer: 64 * 1024 * 1024, env: { ...process.env, GIT_TERMINAL_PROMPT: '0' } }));
|
|
}
|
|
export function sh(cwd: string, command: string, timeout = 1_800_000): Run {
|
|
return done(runBashSync(command, { cwd, encoding: 'utf8', timeout, maxBuffer: 64 * 1024 * 1024 }));
|
|
}
|
|
/** A sibling bin run without blocking, so independent test lanes run in parallel. */
|
|
export function binAsync(cwd: string, name: string, args: string[], timeout = 3_600_000): Promise<Run> {
|
|
const inv = scriptInvocation(path.join(BIN_DIR, name), args);
|
|
if (!inv.ok) return Promise.resolve({ status: null, stdout: '', stderr: inv.error });
|
|
return new Promise(resolve => {
|
|
const child = spawn(inv.cmd, inv.argv, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
|
|
let stdout = '', stderr = '';
|
|
child.stdout.on('data', d => { stdout = (stdout + d).slice(-200_000); });
|
|
child.stderr.on('data', d => { stderr = (stderr + d).slice(-200_000); });
|
|
const timer = setTimeout(() => child.kill('SIGKILL'), timeout);
|
|
child.on('close', status => { clearTimeout(timer); resolve({ status, stdout, stderr }); });
|
|
});
|
|
}
|
|
|
|
export function flagReader(argv: readonly string[]) {
|
|
const all = (n: string) => argv.flatMap((a, i) => (a === n && argv[i + 1] !== undefined ? [argv[i + 1]!] : []));
|
|
return { all, flag: (n: string) => all(n).at(-1), has: (n: string) => argv.includes(n) };
|
|
}
|
|
|
|
/** --lane <label>=<command> pairs (Step 5's labels and exact commands). */
|
|
export function lanes(argv: readonly string[]): { label: string; command: string }[] | string {
|
|
const out: { label: string; command: string }[] = [];
|
|
for (const raw of flagReader(argv).all('--lane')) {
|
|
const at = raw.indexOf('=');
|
|
if (at < 1 || at === raw.length - 1) return `--lane ${raw} is not <label>=<command>`;
|
|
out.push({ label: raw.slice(0, at), command: raw.slice(at + 1) });
|
|
}
|
|
return out;
|
|
}
|
|
|
|
/** The base branch's effective ship policy (gstack-ship-policy show-effective --json), or null when unreadable. */
|
|
export function shipPolicy(cwd: string, base: string): Record<string, any> | null {
|
|
const r = bin(cwd, 'gstack-ship-policy', ['show-effective', '--base', base, '--json'], 60_000);
|
|
try { return JSON.parse(r.stdout).policy ?? null; } catch { return null; }
|
|
}
|
|
|
|
/** Release metadata a version stamp and Steps 13-14 write: the release commit's paths, never a behavior change. */
|
|
export function releasePaths(policy: Record<string, any> | null): string[] {
|
|
const list = (v: unknown) => (Array.isArray(v) ? v.filter((s): s is string => typeof s === 'string') : []);
|
|
return [...new Set(['VERSION', 'CHANGELOG.md', 'TODOS.md', 'package.json', 'package-lock.json', 'bun.lock', 'agents-digest/gstack-AGENTS.md',
|
|
...(typeof policy?.changelog === 'string' ? [policy.changelog] : []), ...list(policy?.release_outputs), ...list(policy?.stamp_paths)])];
|
|
}
|
|
|
|
export const short = (list: readonly string[], n = 6) => list.slice(0, n).join(',') + (list.length > n ? `,+${list.length - n} more` : '');
|
|
export const firstLine = (s: string) => s.trim().split('\n').filter(Boolean).at(-1)?.slice(0, 240) ?? '';
|
|
|
|
/** The compact result: at most MAX_LINES lines; STOP and NEXT always survive the cap. */
|
|
export const MAX_LINES = 30;
|
|
export class Report {
|
|
readonly lines: string[] = [];
|
|
exit = 0;
|
|
add(line: string): this { this.lines.push(line); return this; }
|
|
next(what: string): this { return this.add(`NEXT: ${what}`); }
|
|
stop(what: string): Report { this.exit = 3; return this.add(`STOP: ${what}`); }
|
|
render(): string {
|
|
const keep = this.lines.length <= MAX_LINES ? this.lines
|
|
: [...this.lines.filter(l => !/^(STOP|NEXT):/.test(l)).slice(0, MAX_LINES - 1 - this.lines.filter(l => /^(STOP|NEXT):/.test(l)).length), `… ${this.lines.length - MAX_LINES + 1} line(s) cut`, ...this.lines.filter(l => /^(STOP|NEXT):/.test(l))];
|
|
return keep.join('\n') + '\n';
|
|
}
|
|
}
|
|
|
|
/** Run each lane through gstack-evidence run in parallel and read its recorded line. */
|
|
export async function runLanes(cwd: string, list: { label: string; command: string }[]): Promise<{ label: string; exit: number | null; testsRan: string; log: string }[]> {
|
|
return Promise.all(list.map(async l => {
|
|
const r = await binAsync(cwd, 'gstack-evidence', ['run', '--label', l.label, '--', l.command]);
|
|
const m = /gstack-evidence: recorded label=\S+ exit=(\S+) tests_ran=(\S+) log=(\S+)/.exec(r.stderr);
|
|
return { label: l.label, exit: r.status, testsRan: m?.[2] ?? 'unknown', log: m?.[3] ?? '-' };
|
|
}));
|
|
}
|
|
|
|
/** Step 5's lane verdict: a lane passes on its runner count, never exit 0 alone. */
|
|
export function laneLine(l: { label: string; exit: number | null; testsRan: string; log: string }): { line: string; ok: boolean } {
|
|
const zero = l.exit === 0 && l.testsRan === '0';
|
|
const state = l.exit !== 0 ? 'FAIL' : zero ? 'ZERO-RUN' : l.testsRan === 'unknown' ? 'pass (count unavailable)' : 'pass';
|
|
return { line: `LANE: ${l.label} ${state} exit=${l.exit} tests_ran=${l.testsRan} log=${l.log}`, ok: l.exit === 0 && !zero };
|
|
}
|