202 lines
7.1 KiB
Go
202 lines
7.1 KiB
Go
package buildstep
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"regexp"
|
|
"strings"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/forgekey"
|
|
)
|
|
|
|
// Option changes FetchCommit.
|
|
type Option func(*fetchOptions)
|
|
|
|
type fetchOptions struct {
|
|
allowFile bool
|
|
mirror string
|
|
}
|
|
|
|
// AllowFileRemote lets FetchCommit take a file:// remote. It is for a test's local repository; production
|
|
// code does not pass it, and FetchCommit then refuses anything but ssh://.
|
|
func AllowFileRemote() Option { return func(o *fetchOptions) { o.allowFile = true } }
|
|
|
|
// WithMirror makes FetchCommit (and MergeInto) borrow objects from mirror, a bare repository that UpdateMirror keeps
|
|
// in the build module's own cache (novox/hq ADR 0536 §2; issue 890): the workspace's .git/objects/info/alternates
|
|
// names the mirror's objects directory, so git transfers only the objects the mirror lacks. It is a plain file, never
|
|
// a symlink. mirror must be an absolute path of an existing directory; the workspace never writes to it.
|
|
func WithMirror(mirror string) Option { return func(o *fetchOptions) { o.mirror = mirror } }
|
|
|
|
// useMirror writes the alternates file of the repository in dir, when a mirror is set.
|
|
func useMirror(o fetchOptions, dir string) error {
|
|
if o.mirror == "" {
|
|
return nil
|
|
}
|
|
info := filepath.Join(dir, ".git", "objects", "info")
|
|
if err := os.MkdirAll(info, 0o755); err != nil {
|
|
return fmt.Errorf("buildstep: the mirror cannot be used: %w", err)
|
|
}
|
|
line := filepath.Join(o.mirror, "objects") + "\n"
|
|
if err := os.WriteFile(filepath.Join(info, "alternates"), []byte(line), 0o644); err != nil {
|
|
return fmt.Errorf("buildstep: the mirror cannot be used: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
var (
|
|
commitOK = regexp.MustCompile(`^[0-9a-f]{40}$`)
|
|
refOK = regexp.MustCompile(`^refs/[A-Za-z0-9._/-]+$`)
|
|
)
|
|
|
|
// FetchCommit fetches one commit of a forge repository into dir, an empty directory, and checks it out detached
|
|
// (novox/hq ADR 0466 §4, §5; issue 1474). remote is ssh://<ssh name>/<owner>/<repo>.git, the ssh name being the
|
|
// one the build module's templates set up (ADR 0409 §1); commit is a full 40-hex sha; ref is optional, and names
|
|
// the pull request's head (refs/pull/<n>/head) when the commit is only there. Every git command runs through run
|
|
// as `git -C dir ...` with GIT_TERMINAL_PROMPT=0 and no credential helper, so nothing is asked for and no
|
|
// credential is used. A remote that is not ssh://, or one with user information, and a commit that is not 40
|
|
// hex digits are refused before anything runs.
|
|
func FetchCommit(ctx context.Context, run forgekey.Runner, dir, remote, commit, ref string, opts ...Option) error {
|
|
var o fetchOptions
|
|
for _, opt := range opts {
|
|
opt(&o)
|
|
}
|
|
if err := checkFetch(o, dir, remote, commit, ref); err != nil {
|
|
return err
|
|
}
|
|
env := []string{"GIT_TERMINAL_PROMPT=0"}
|
|
git := func(args ...string) (string, error) {
|
|
full := append([]string{"-c", "credential.helper=", "-C", dir}, args...)
|
|
r := run(ctx, env, "git", full...)
|
|
if r.Status != 0 || r.Err != "" {
|
|
return "", fmt.Errorf("git %s: %s", args[0], firstLine(r.Err+" "+r.Stderr))
|
|
}
|
|
return r.Stdout, nil
|
|
}
|
|
if _, err := git("init", "-q"); err != nil {
|
|
return err
|
|
}
|
|
if err := useMirror(o, dir); err != nil {
|
|
return err
|
|
}
|
|
if _, err := git("remote", "add", "origin", remote); err != nil {
|
|
return err
|
|
}
|
|
if _, err := git("fetch", "--no-tags", "--depth", "1", "origin", commit); err != nil {
|
|
if ref == "" {
|
|
return err
|
|
}
|
|
if _, rerr := git("fetch", "--no-tags", "origin", ref); rerr != nil {
|
|
return fmt.Errorf("%v; then the ref %s: %w", err, ref, rerr)
|
|
}
|
|
if _, verr := git("cat-file", "-e", commit+"^{commit}"); verr != nil {
|
|
return fmt.Errorf("the commit %s is not in %s: %w", commit, ref, verr)
|
|
}
|
|
}
|
|
if _, err := git("checkout", "-q", "--detach", commit); err != nil {
|
|
return err
|
|
}
|
|
out, err := git("rev-parse", "HEAD")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if head := strings.TrimSpace(out); head != commit {
|
|
return fmt.Errorf("the checkout is at %s, not at the commit %s", head, commit)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// UpdateMirror brings the bare repository mirror to commit: it makes the mirror when it is absent (git init --bare,
|
|
// origin set to remote), then fetches the commit, or the ref when only the ref holds it, with the same rules as
|
|
// FetchCommit (no prompt, no credential helper, ssh:// or an allowed file:// remote, a 40-hex commit). The mirror
|
|
// keeps every commit it was brought to, so later fetches through WithMirror transfer only what is new. Callers
|
|
// serialise updates of one mirror.
|
|
func UpdateMirror(ctx context.Context, run forgekey.Runner, mirror, remote, commit, ref string, opts ...Option) error {
|
|
var o fetchOptions
|
|
for _, opt := range opts {
|
|
opt(&o)
|
|
}
|
|
if !filepath.IsAbs(mirror) {
|
|
return fmt.Errorf("buildstep: the mirror %q is not an absolute path", mirror)
|
|
}
|
|
if err := checkFetch(o, mirror, remote, commit, ref); err != nil {
|
|
return err
|
|
}
|
|
env := []string{"GIT_TERMINAL_PROMPT=0"}
|
|
git := func(args ...string) error {
|
|
r := run(ctx, env, "git", append([]string{"-c", "credential.helper="}, args...)...)
|
|
if r.Status != 0 || r.Err != "" {
|
|
return fmt.Errorf("git %s: %s", args[0], firstLine(r.Err+" "+r.Stderr))
|
|
}
|
|
return nil
|
|
}
|
|
in := func(args ...string) error { return git(append([]string{"-C", mirror}, args...)...) }
|
|
if _, err := os.Stat(filepath.Join(mirror, "HEAD")); err != nil {
|
|
if err := git("init", "-q", "--bare", mirror); err != nil {
|
|
return err
|
|
}
|
|
if err := in("remote", "add", "origin", remote); err != nil {
|
|
return err
|
|
}
|
|
} else if err := in("remote", "set-url", "origin", remote); err != nil {
|
|
return err
|
|
}
|
|
if err := in("fetch", "--no-tags", "origin", commit); err != nil {
|
|
if ref == "" {
|
|
return err
|
|
}
|
|
if rerr := in("fetch", "--no-tags", "origin", ref); rerr != nil {
|
|
return fmt.Errorf("%v; then the ref %s: %w", err, ref, rerr)
|
|
}
|
|
}
|
|
if err := in("cat-file", "-e", commit+"^{commit}"); err != nil {
|
|
return fmt.Errorf("the commit %s is not in the mirror: %w", commit, err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func checkFetch(o fetchOptions, dir, remote, commit, ref string) error {
|
|
if dir == "" {
|
|
return fmt.Errorf("buildstep: no workspace directory")
|
|
}
|
|
if o.mirror != "" {
|
|
if !filepath.IsAbs(o.mirror) {
|
|
return fmt.Errorf("buildstep: the mirror %q is not an absolute path", o.mirror)
|
|
}
|
|
if fi, err := os.Stat(o.mirror); err != nil || !fi.IsDir() {
|
|
return fmt.Errorf("buildstep: the mirror %q is not an existing directory", o.mirror)
|
|
}
|
|
}
|
|
if !commitOK.MatchString(commit) {
|
|
return fmt.Errorf("buildstep: %q is not a full commit (40 hex digits)", commit)
|
|
}
|
|
if ref != "" && !refOK.MatchString(ref) {
|
|
return fmt.Errorf("buildstep: %q is not a ref (refs/...)", ref)
|
|
}
|
|
u, err := url.Parse(remote)
|
|
if err != nil {
|
|
return fmt.Errorf("buildstep: the remote is not a URL: %w", err)
|
|
}
|
|
if u.User != nil {
|
|
return fmt.Errorf("buildstep: the remote carries user information; the key is the credential")
|
|
}
|
|
switch {
|
|
case u.Scheme == "ssh" && u.Host != "":
|
|
case u.Scheme == "file" && o.allowFile:
|
|
default:
|
|
return fmt.Errorf("buildstep: the remote %q is not ssh://", remote)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func firstLine(s string) string {
|
|
for _, l := range strings.Split(s, "\n") {
|
|
if l = strings.TrimSpace(l); l != "" {
|
|
return l
|
|
}
|
|
}
|
|
return ""
|
|
}
|