|
| 1 | +#!/usr/bin/env bun |
| 2 | +/** |
| 3 | + * Shared orchestration script for the appwrite-utils GitHub Actions. |
| 4 | + * |
| 5 | + * Each composite action forwards its inputs as AWU_* environment variables and |
| 6 | + * invokes this script with `bun`. The script translates them into an |
| 7 | + * `appwrite-migrate` invocation run through `bunx`, so the published CLI is |
| 8 | + * fetched and executed without ever going through a pnpm install gate (which |
| 9 | + * would interactively prompt to approve esbuild's build script and hang CI). |
| 10 | + * |
| 11 | + * No npm dependencies: only Node/Bun built-ins. Bun runs this .ts file directly, |
| 12 | + * so there is no build step. |
| 13 | + * |
| 14 | + * Secrets (the API key) are passed to the child via the environment only, never |
| 15 | + * on argv, and are never printed. |
| 16 | + */ |
| 17 | +import { spawnSync } from "node:child_process"; |
| 18 | + |
| 19 | +function env(name: string): string | undefined { |
| 20 | + const v = process.env[name]; |
| 21 | + if (v === undefined) return undefined; |
| 22 | + const trimmed = v.trim(); |
| 23 | + return trimmed.length > 0 ? trimmed : undefined; |
| 24 | +} |
| 25 | + |
| 26 | +/** Minimal POSIX-ish tokenizer for the generic action's raw `args` input. No eval. */ |
| 27 | +function tokenizeArgs(input: string): string[] { |
| 28 | + const tokens: string[] = []; |
| 29 | + let cur = ""; |
| 30 | + let inSingle = false; |
| 31 | + let inDouble = false; |
| 32 | + let sawToken = false; |
| 33 | + for (let i = 0; i < input.length; i++) { |
| 34 | + const ch = input[i]; |
| 35 | + if (inSingle) { |
| 36 | + if (ch === "'") inSingle = false; |
| 37 | + else cur += ch; |
| 38 | + continue; |
| 39 | + } |
| 40 | + if (inDouble) { |
| 41 | + if (ch === '"') inDouble = false; |
| 42 | + else if (ch === "\\" && (input[i + 1] === '"' || input[i + 1] === "\\")) { |
| 43 | + cur += input[++i]; |
| 44 | + } else cur += ch; |
| 45 | + continue; |
| 46 | + } |
| 47 | + if (ch === "'") { inSingle = true; sawToken = true; continue; } |
| 48 | + if (ch === '"') { inDouble = true; sawToken = true; continue; } |
| 49 | + if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") { |
| 50 | + if (sawToken) { tokens.push(cur); cur = ""; sawToken = false; } |
| 51 | + continue; |
| 52 | + } |
| 53 | + cur += ch; |
| 54 | + sawToken = true; |
| 55 | + } |
| 56 | + if (inSingle || inDouble) { |
| 57 | + throw new Error("AWU_ARGS: unbalanced quotes in args input"); |
| 58 | + } |
| 59 | + if (sawToken) tokens.push(cur); |
| 60 | + return tokens; |
| 61 | +} |
| 62 | + |
| 63 | +function pushFlag(argv: string[], flag: string, value: string | undefined) { |
| 64 | + if (value !== undefined) argv.push(flag, value); |
| 65 | +} |
| 66 | + |
| 67 | +function buildArgv(): string[] { |
| 68 | + const command = env("AWU_COMMAND"); |
| 69 | + if (!command) throw new Error("AWU_COMMAND is required"); |
| 70 | + |
| 71 | + const argv: string[] = []; |
| 72 | + |
| 73 | + switch (command) { |
| 74 | + case "deploy-functions": { |
| 75 | + argv.push("--deployFunctions"); |
| 76 | + pushFlag(argv, "--functionIds", env("AWU_FUNCTION_IDS")); |
| 77 | + pushFlag(argv, "--functionPath", env("AWU_FUNCTION_PATH")); |
| 78 | + pushFlag(argv, "--buildConcurrency", env("AWU_BUILD_CONCURRENCY")); |
| 79 | + pushFlag(argv, "--config", env("AWU_CONFIG")); |
| 80 | + // Single-function overrides (CLI rejects these unless exactly one fn is targeted). |
| 81 | + pushFlag(argv, "--functionName", env("AWU_FN_NAME")); |
| 82 | + pushFlag(argv, "--functionRuntime", env("AWU_FN_RUNTIME")); |
| 83 | + pushFlag(argv, "--functionEntrypoint", env("AWU_FN_ENTRYPOINT")); |
| 84 | + pushFlag(argv, "--functionCommands", env("AWU_FN_COMMANDS")); |
| 85 | + pushFlag(argv, "--functionSchedule", env("AWU_FN_SCHEDULE")); |
| 86 | + pushFlag(argv, "--functionTimeout", env("AWU_FN_TIMEOUT")); |
| 87 | + pushFlag(argv, "--functionScopes", env("AWU_FN_SCOPES")); |
| 88 | + pushFlag(argv, "--functionEvents", env("AWU_FN_EVENTS")); |
| 89 | + pushFlag(argv, "--functionExecute", env("AWU_FN_EXECUTE")); |
| 90 | + // Boolean overrides: pass as --flag=value so yargs records the explicit value. |
| 91 | + const enabled = env("AWU_FN_ENABLED"); |
| 92 | + if (enabled !== undefined) argv.push(`--functionEnabled=${enabled}`); |
| 93 | + const logging = env("AWU_FN_LOGGING"); |
| 94 | + if (logging !== undefined) argv.push(`--functionLogging=${logging}`); |
| 95 | + break; |
| 96 | + } |
| 97 | + case "push": { |
| 98 | + argv.push("--push"); |
| 99 | + pushFlag(argv, "--config", env("AWU_CONFIG")); |
| 100 | + break; |
| 101 | + } |
| 102 | + case "raw": { |
| 103 | + const raw = env("AWU_ARGS"); |
| 104 | + if (!raw) throw new Error("AWU_ARGS is required for the generic action"); |
| 105 | + argv.push(...tokenizeArgs(raw)); |
| 106 | + break; |
| 107 | + } |
| 108 | + default: |
| 109 | + throw new Error(`Unknown AWU_COMMAND: ${command}`); |
| 110 | + } |
| 111 | + |
| 112 | + return argv; |
| 113 | +} |
| 114 | + |
| 115 | +function main(): number { |
| 116 | + const argv = buildArgv(); |
| 117 | + const cliVersion = env("AWU_CLI_VERSION") ?? "latest"; |
| 118 | + const workingDir = env("AWU_WORKING_DIR") ?? "."; |
| 119 | + |
| 120 | + const childEnv: NodeJS.ProcessEnv = { ...process.env }; |
| 121 | + // The CLI reads these (resolveCliCredentials). Passing via env keeps the API |
| 122 | + // key off the command line and out of any logged argv. |
| 123 | + const endpoint = env("AWU_ENDPOINT"); |
| 124 | + const projectId = env("AWU_PROJECT_ID"); |
| 125 | + const apiKey = env("AWU_API_KEY"); |
| 126 | + if (endpoint) childEnv.APPWRITE_ENDPOINT = endpoint; |
| 127 | + if (projectId) childEnv.APPWRITE_PROJECT_ID = projectId; |
| 128 | + if (apiKey) childEnv.APPWRITE_API_KEY = apiKey; |
| 129 | + |
| 130 | + const bunxArgs = [ |
| 131 | + "--package=appwrite-utils-cli@" + cliVersion, |
| 132 | + "appwrite-migrate", |
| 133 | + ...argv, |
| 134 | + ]; |
| 135 | + |
| 136 | + // argv contains no secrets (creds go via env), so this is safe to print. |
| 137 | + console.log(`> bunx ${bunxArgs.join(" ")} (cwd: ${workingDir})`); |
| 138 | + |
| 139 | + const result = spawnSync("bunx", bunxArgs, { |
| 140 | + cwd: workingDir, |
| 141 | + env: childEnv, |
| 142 | + stdio: "inherit", |
| 143 | + }); |
| 144 | + |
| 145 | + if (result.error) { |
| 146 | + console.error(`Failed to run appwrite-migrate: ${result.error.message}`); |
| 147 | + return 1; |
| 148 | + } |
| 149 | + if (typeof result.status === "number") return result.status; |
| 150 | + // Terminated by signal. |
| 151 | + return 1; |
| 152 | +} |
| 153 | + |
| 154 | +process.exit(main()); |
0 commit comments