mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-21 08:22:20 +02:00
47 lines
2.4 KiB
TypeScript
47 lines
2.4 KiB
TypeScript
import { execFileSync } from "node:child_process";
|
|
import { devNull } from "node:os";
|
|
import type { MatrixExecution } from "./types.js";
|
|
import { resolveRunnerE2ESource } from "./source.js";
|
|
|
|
/** The checked-out controller is authoritative, independently of workflow context. */
|
|
export function prepareHermesQualificationSource(
|
|
executions: readonly MatrixExecution[],
|
|
repositoryRoot: string,
|
|
environment: NodeJS.ProcessEnv,
|
|
) {
|
|
if (!executions.some(execution => execution.profile.qualificationCandidate === "hermes")) return null;
|
|
const gitEnvironment: NodeJS.ProcessEnv = {
|
|
GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: devNull,
|
|
...Object.fromEntries(["PATH", "SYSTEMROOT", "LANG"].flatMap(name =>
|
|
environment[name] === undefined ? [] : [[name, environment[name]]])),
|
|
};
|
|
const git = (args: string[]) => {
|
|
try {
|
|
return execFileSync("git", ["-c", "core.fsmonitor=false", ...args], {
|
|
cwd: repositoryRoot, env: gitEnvironment, encoding: "utf8",
|
|
timeout: 10_000, maxBuffer: 1024 * 1024, stdio: ["ignore", "pipe", "pipe"],
|
|
}).trim();
|
|
} catch {
|
|
throw new Error("Hermes qualification needs readable Git source before credentials; use a clean checkout.");
|
|
}
|
|
};
|
|
const sha = git(["rev-parse", "HEAD"]);
|
|
if (!/^[a-f0-9]{40}$/.test(sha)) throw new Error("Hermes qualification source SHA is invalid.");
|
|
if (git(["status", "--porcelain", "--untracked-files=normal"])) {
|
|
throw new Error("Hermes qualification needs a clean checkout before credentials; commit or remove source changes.");
|
|
}
|
|
const requestedSha = environment.PAPERCLIP_RUNNER_E2E_SOURCE_SHA?.trim();
|
|
if (requestedSha && requestedSha !== sha) {
|
|
throw new Error("Hermes qualification source SHA differs from the checked-out controller before credentials.");
|
|
}
|
|
const ref = git(["rev-parse", "--symbolic-full-name", "HEAD"]);
|
|
if (git(["rev-parse", "HEAD"]) !== sha) throw new Error("Hermes qualification source changed during admission.");
|
|
// These explicit values survive local-env loading and reach every child and
|
|
// synthetic failure. A workflow's own GITHUB_SHA may identify another commit.
|
|
environment.PAPERCLIP_RUNNER_E2E_SOURCE_SHA = sha;
|
|
environment.PAPERCLIP_RUNNER_E2E_SOURCE_REF =
|
|
(requestedSha && environment.PAPERCLIP_RUNNER_E2E_SOURCE_REF?.trim()) || ref;
|
|
return { schema: "paperclip.hermes.e2e-source/v1", workingTreeClean: true,
|
|
...resolveRunnerE2ESource(null, environment) };
|
|
}
|