mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #308 from pikasTech/fix/hwlab-1119-prepare-source-template-escape

Browse Source 
fix: validate D601 prepare-source yaml script
This commit is contained in:
Lyon
2026-06-13 06:37:53 +08:00
committed by GitHub
parent 903104bbad b094caeee3
commit 4196a532b1
1 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/hwlab-node.ts
+22 -2
View File
@@ -1246,6 +1246,7 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
"node - \"$render_dir\" \"$overlay_b64\" <<'NODE'",
"const fs = require('fs');",
"const path = require('path');",
"const vm = require('node:vm');",
"const renderDir = process.argv[2];",
"const overlay = JSON.parse(Buffer.from(process.argv[3], 'base64').toString('utf8'));",
"const pipelinePath = path.join(renderDir, overlay.tektonDir, 'pipeline.yaml');",
@@ -1302,11 +1303,14 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
" if (!file) return;",
" const full = path.join(dir, file);",
" console.error(JSON.stringify({ event: 'prepare-source-dependencies', status: 'npm-debug-log', path: full }));",
" console.error(fs.readFileSync(full, 'utf8').split(/\\r?\\n/u).slice(-80).join('\\n'));",
" const lines = fs.readFileSync(full, 'utf8').split(String.fromCharCode(10));",
" console.error(lines.slice(-80).join(String.fromCharCode(10)));",
"}",
"if (hasYaml()) { emit('cached'); process.exit(0); }",
"fs.mkdirSync('node_modules/yaml', { recursive: true });",
"const tarball = registry.replace(/\\/+$/u, '') + '/yaml/-/yaml-' + version + '.tgz';",
"let registryBase = registry;",
"while (registryBase.endsWith('/')) registryBase = registryBase.slice(0, -1);",
"const tarball = registryBase + '/yaml/-/yaml-' + version + '.tgz';",
"const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hwlab-yaml-'));",
"const tgz = path.join(tmpDir, 'yaml.tgz');",
"if (run('curl', ['-fsSL', '--retry', String(retryCount), '--connect-timeout', '10', '--max-time', String(timeoutSeconds), '-o', tgz, tarball]) && run('tar', ['-xzf', tgz, '-C', 'node_modules/yaml', '--strip-components=1'])) emit('installed', { manager: 'tarball' });",
@@ -1326,6 +1330,21 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
"NODE_UNIDESK_YAML_DEPENDENCY",
"ci_timing_emit prepare-source-dependencies succeeded \"$prepare_source_dependencies_started_ms\"`;",
"}",
"function validatePrepareSourceDependencyScript(script) {",
" const marker = 'NODE_UNIDESK_YAML_DEPENDENCY';",
" let offset = 0;",
" while (true) {",
" const markerStart = script.indexOf(\"node <<'\" + marker + \"'\", offset);",
" if (markerStart === -1) return;",
" const bodyStart = script.indexOf('\\n', markerStart);",
" if (bodyStart === -1) throw new Error('prepare-source dependency heredoc body missing newline');",
" const bodyEnd = script.indexOf('\\n' + marker, bodyStart + 1);",
" if (bodyEnd === -1) throw new Error('prepare-source dependency heredoc terminator missing');",
" const body = script.slice(bodyStart + 1, bodyEnd);",
" try { new vm.Script(body, { filename: 'NODE_UNIDESK_YAML_DEPENDENCY.js' }); } catch (error) { throw new Error(`generated prepare-source yaml dependency script is invalid: ${error.message}`); }",
" offset = bodyEnd + marker.length + 1;",
" }",
"}",
"function deployYamlOverlayScript() {",
" const runtimeOverlay = JSON.stringify({",
" nodeId: overlay.nodeId,",
@@ -1827,6 +1846,7 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
" return `${match}\\n${[runtimePathOverlayScript(), runtimeGitopsPostprocessScript()].filter(Boolean).join('\\n')}`;",
" });",
" result = result.replace(/node scripts\\/run-bun\\.mjs scripts\\/gitops-render\\.mjs([^\\n]*?)--out \"\\$render_check_dir\"/g, (match) => match.includes('--gitops-root ') ? match : `${match} --gitops-root ${JSON.stringify(overlay.gitopsRoot)} --node ${shellSingle(overlay.nodeId)} --git-read-url ${shellSingle(overlay.gitReadUrl)} --git-write-url ${shellSingle(overlay.gitWriteUrl)} --runtime-endpoint ${shellSingle(overlay.publicApiUrl)} --web-endpoint ${shellSingle(overlay.publicWebUrl)}`);",
" validatePrepareSourceDependencyScript(result);",
" return result;",
"}",
"function patchManifestObject(doc) {",