Make MySQL provisioning pull-aware

Author: chubes4

packages/cli/src/commands/recipe-run.ts

@@ -29,7 +29,7 @@ import { RecipePhaseError } from "./recipe-run-phases.js"
 import { markPreviewLeaseAvailable, markPreviewLeaseFailed, markPreviewLeaseReleased, startPreviewLeaseRecipeRun } from "./preview-lease.js"
 import { importRecipeSiteSeeds } from "./recipe-site-seeds.js"
 import { applyRecipeRuntimeSetup, cleanupInputMountBaselines, prepareRecipeRuntimeSetup, recipeRunDependencyOverlay, recipeRunExtraPlugin, recipeRunStagedFile, rewriteInputMountPathArgs } from "./recipe-runtime-setup.js"
-import { provisionRuntimeServices, RuntimeServiceProvisionError, type RuntimeServiceEvidence } from "../runtime-services.js"
+import { provisionRuntimeServices, runtimeServiceEvidenceFromError, type RuntimeServiceEvidence } from "../runtime-services.js"
 import { distributionStartupProbeFailure, executeRecipeCollectWorkloadResult, executeRecipeWorkflowStep, recipeAdvisoryFailure, recipeBrowserEvidence, recipeStepFailure, recipeWorkflowArgsEvidence, recipeWorkflowStepIsAdvisory, runDistributionSetupArtifacts, runDistributionStartupProbes, runRecipeProbes, withRecipeExecutionPhase } from "./recipe-run-workflow-evidence.js"
 import type { RecipeAdvisoryFailure, RecipeBrowserEvidence, RecipeDiagnosticArtifactRef, RecipeEffectiveRecipeArtifact, RecipeExecutionResult, RecipeFuzzCaseCommandRef, RecipeFuzzCaseResult, RecipeFuzzCaseStatus, RecipeFuzzRunResult, RecipeInterruptionController, RecipePhaseEvidence, RecipePhaseName, RecipePhpWasmRuntimeDiagnostic, RecipeRunCommandOutput, RecipeRunComponentContract, RecipeRunDeclaredArtifact, RecipeRunDistributionSetupArtifact, RecipeRunDistributionStartupProbe, RecipeRunFixtureDatabase, RecipeRunOptions, RecipeRunOutput, RecipeRunProbe, RecipeRunProvenance, RecipeRunStagedFile, RecipeRuntimeDiagnostic, RecipeStepFailure, RecipeValidateOptions, RecipeValidateOutput } from "./recipe-run-types.js"
 
@@ -422,8 +422,9 @@ async function runRecipe(options: RecipeRunOptions, interruption?: RecipeInterru
       output: { ...completedRecipeOutputFields({ executions, componentContracts: componentContractResults(recipe, extraPlugins, phaseTracker.list(), executions), stagedFiles: stagedFiles.map(recipeRunStagedFile), fixtureDatabases, siteSeeds, distributionSetupArtifacts, distributionStartupProbes, probes, declaredArtifacts, stepFailures, phaseEvidence: phaseTracker.list(), advisoryFailures, browserEvidence, benchResultsList, fuzzRun: fuzzRunResult, evidence }), provenance: recipeRunProvenance(recipe, recipePath) },
     })
   } catch (error) {
-    if (error instanceof RuntimeServiceProvisionError) {
-      serviceEvidence = error.evidence
+    const failedServiceEvidence = runtimeServiceEvidenceFromError(error)
+    if (failedServiceEvidence) {
+      serviceEvidence = failedServiceEvidence
       await runRegistry.update(runRecord.runId, { metadata: { managedRuntimeServices: serviceEvidence } })
     }
     await markPreviewLeaseFailed(options.previewLeaseFile, error)

packages/cli/src/runtime-services.ts

@@ -25,6 +25,17 @@ export class RuntimeServiceProvisionError extends Error {
   }
 }
 
+export function runtimeServiceEvidenceFromError(error: unknown): RuntimeServiceEvidence[] | undefined {
+  let current = error
+  const seen = new Set<unknown>()
+  while (current instanceof Error && !seen.has(current)) {
+    if (current instanceof RuntimeServiceProvisionError) return current.evidence
+    seen.add(current)
+    current = current.cause
+  }
+  return undefined
+}
+
 interface ManagedRuntimeService {
   env: Record<string, string>
   evidence: RuntimeServiceEvidence
@@ -103,6 +114,7 @@ async function provisionMysqlDockerService(service: WorkspaceRecipeRuntimeServic
   let started = false
   try {
     throwIfAborted(signal)
+    await ensureDockerImage(dependencies, signal)
     await dependencies.execute("docker", runArgs, { env: childEnvironment, signal, timeout: 30_000 })
     started = true
     const { stdout } = await dependencies.execute("docker", ["port", container, "3306/tcp"], { signal, timeout: 10_000 })
@@ -122,6 +134,15 @@ async function provisionMysqlDockerService(service: WorkspaceRecipeRuntimeServic
   }
 }
 
+async function ensureDockerImage(dependencies: RuntimeServiceDependencies, signal?: AbortSignal): Promise<void> {
+  try {
+    await dependencies.execute("docker", ["image", "inspect", MYSQL_IMAGE], { signal, timeout: 10_000 })
+  } catch {
+    throwIfAborted(signal)
+    await dependencies.execute("docker", ["pull", MYSQL_IMAGE], { signal, timeout: 5 * 60_000 })
+  }
+}
+
 async function releaseServices(services: ManagedRuntimeService[]): Promise<void> {
   const results = await Promise.allSettled([...services].reverse().map(async (service) => await service.release()))
   const failure = results.find((result): result is PromiseRejectedResult => result.status === "rejected")

tests/runtime-services.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict"
 import { createServer } from "node:net"
-import { parseLoopbackPort, provisionRuntimeServices, RuntimeServiceProvisionError, runtimeServicePlan, waitForMysqlProtocol, type RuntimeServiceDependencies } from "../packages/cli/src/runtime-services.ts"
+import { parseLoopbackPort, provisionRuntimeServices, RuntimeServiceProvisionError, runtimeServiceEvidenceFromError, runtimeServicePlan, waitForMysqlProtocol, type RuntimeServiceDependencies } from "../packages/cli/src/runtime-services.ts"
 import { validateWorkspaceRecipeJsonSchema } from "../packages/runtime-core/src/recipe-schema.ts"
 
 const service = { id: "test-db", kind: "mysql", outputs: { host: "DB_HOST", port: "DB_PORT", password: "DB_PASSWORD" } } as const
@@ -35,9 +35,11 @@ const dependencies: RuntimeServiceDependencies = {
 const provisioned = await provisionRuntimeServices([service], { dependencies })
 assert.equal(provisioned.env.DB_PORT, "41001")
 assert.equal(provisioned.env.DB_PASSWORD, Buffer.alloc(24, 7).toString("base64url"))
-assert.ok(calls[0]?.args.includes("MYSQL_PASSWORD"))
-assert.equal(calls[0]?.args.some((arg) => arg.includes(provisioned.env.DB_PASSWORD)), false, "credentials never enter Docker argv")
+const runCall = calls.find((call) => call.args[0] === "run")
+assert.ok(runCall?.args.includes("MYSQL_PASSWORD"))
+assert.equal(runCall?.args.some((arg) => arg.includes(provisioned.env.DB_PASSWORD)), false, "credentials never enter Docker argv")
 assert.equal(JSON.stringify(provisioned.evidence).includes(provisioned.env.DB_PASSWORD), false, "credentials never enter evidence")
+assert.equal(calls[0]?.args[0], "image", "the provider checks the image before starting the service")
 await provisioned.release()
 await provisioned.release()
 assert.equal(calls.filter((call) => call.args[0] === "rm").length, 1, "release is idempotent")
@@ -71,4 +73,8 @@ assert.equal(failedCleanup, true)
 const controller = new AbortController()
 controller.abort()
 await assert.rejects(provisionRuntimeServices([service], { dependencies, signal: controller.signal }), (error: unknown) => error instanceof RuntimeServiceProvisionError && error.evidence[0]?.diagnostic?.code === "interrupted")
+
+const nestedEvidence = [{ id: "nested", kind: "mysql", provider: "test", version: "test", readiness: "failed", lifecycle: "failed" }] satisfies import("../packages/cli/src/runtime-services.ts").RuntimeServiceEvidence[]
+const nestedError = new Error("phase failed", { cause: new RuntimeServiceProvisionError("service failed", nestedEvidence) })
+assert.equal(runtimeServiceEvidenceFromError(nestedError), nestedEvidence, "phase wrappers retain structured service evidence")
 console.log("runtime services tests passed")