Move the action from Deno to Node.js and Vite+ (#20)
## Summary
Moves `commons/bot-agents` off Deno. The action's TypeScript now runs directly on the job image's Node.js (`node src/<phase>.ts`, using Node's built-in type stripping), with no build step and still no runtime dependency. Repository checks move to Vite+ (`vp check`, `vp test`).
## What changed
- **Runtime.** `action.yml` runs `prepare.ts`, `run.ts`, and `post.ts` with `node` instead of `deno run -A`. `package.json` (`"type": "module"`, `engines.node >=24.2` for `import.meta.main`) is now copied into the root-owned source copy by `scripts/protect-source.sh`.
- **Profiles.** `profiles.yml` → `profiles.json`, with the same content (encrypted values unchanged), parsed with `JSON.parse`. This drops the only runtime dependency (`@std/yaml`).
- **Deno APIs → Node.**
- `src/command.ts` wraps `child_process.spawn` with the old `Deno.Command` shapes: `output()`/`spawn()`, `clearEnv`, `uid`/`gid`, and Deno's stdio defaults (stdin inherited; stdout/stderr piped for `output()`, inherited for `spawn()`). A signal exit maps to `128 + signo`. Status settles on process exit.
- `src/errors.ts` maps `NotFound` to `ENOENT`/`ESRCH`.
- fs, path, stream, and readline calls are mapped one for one. `makeTempFile` becomes an exclusive `wx` 0600 create.
- **Size refactors.** These are needed for Oxlint's default limits. There are no behavior changes and no overrides for source files.
- `run.ts` is split into `run-context.ts`, `agents.ts`, and `agent-{claude,codex,opencode}.ts`.
- `post.ts` is split into `post.ts` and `post-artifacts.ts`.
- `parseCredentials`, `readOutcome`, and `postRuntime` are broken into helpers.
- Loops that awaited sequentially became recursion or a `reduce` chain, so they stay sequential. `/proc` status reads became `Promise.all`.
- `src/json.ts` adds type guards in place of `as` casts.
- **Tests.** The 58 `Deno.test` cases were converted to Vitest with the codemod, and its TODOs were finished by hand.
- Unit tests are `src/*.test.ts`; the repository-level workflow test is `tests/workflow.test.ts`.
- Root-only tests are now `test.skipIf(!IS_ROOT)`, so they show as skipped instead of silently passing.
- New `tests/entrypoints.test.ts` runs each phase under real Node to prove its whole import graph loads.
- **Config.** The only config files are `package.json`, `tsconfig.json`, and `vite.config.ts`, plus `package-lock.json`.
- Lint uses Oxlint correctness/suspicious/pedantic/perf at error, with default limits and type-aware checks.
- `scripts/project-lint.ts` holds the rule list. It maps Deno's `recommended` rules that fall outside those categories, adds the template's `id-match`, `no-disable-comments`, and `no-non-ts-imports`, and maps Deno's `no-window`/`no-process-global`/`no-node-globals` to `no-restricted-globals` (so `process`/`Buffer` come from `node:` imports).
- **CI.** `.gitea/workflows/check.yml` runs `node --version`, `npm ci`, `npx vp check`, and `npx vp test` in the default runner image.
- **Formatting.** Oxfmt formatting is a separate first commit, so the second commit shows only the semantic diff.
- **AGENTS.md** is updated for the new toolchain.
## Deviations / risks
- **Live `@main` switch.** Six consumer repos use `commons/bot-agents@main`, so merging switches all of them at once. Suggested before merging: tag the current `main` (e.g. `deno-final`) as a rollback target, and canary this branch from one consumer (`uses: …/commons/bot-agents@node-migration`) on a throwaway PR.
- **Node version.** `post.ts` relies on `import.meta.main`, which needs Node ≥ 24.2. DANNYEC's cached `node:24-bookworm` minor is unknown (`forcePull=false`), and the CI job now prints `node --version` to confirm it.
- **Deno stays in the global install.** `deno` remains in the action's global npm install because agents still verify Deno-based consumers (memona, memona-home). Remove it once those repos move.
- **`prefer-readonly-parameter-types` is off.** This pedantic rule is turned off, as in the explicit-types template and the app repos, because Node/web types (`Response`, `Stats`, `RequestInit`) can never satisfy it. `scripts/**` has one narrow override (`no-unsafe-enum-comparison`) for AST node `type` comparisons.
- **Stricter validation of malformed input.** For valid input, behavior is unchanged. A few validations are stricter where the old code would have used a malformed value:
- Gitea `/user` and comment responses are checked.
- The runtime manifest and the outcome's profile type are checked against known values.
- Some type-check errors are now `TypeError` (same messages).
- **@cunarist lint plugins.** "CI fails until @cunarist/eslint-plugin-* are published" does **not** apply here. This repo's Deno setup enabled no plugin, so it depends on none of `@cunarist/eslint-plugin-*`, and CI can pass as is.
## Verification
- `vp check`: formatting, lint (0 warnings), and type check all pass.
- `vp test` as a normal user: 56 passed, 5 root-only skipped.
- `vp test` as root in `node:24-bookworm` (Node v24.22.0, the CI image): all 61 passed, including the UID isolation, process cleanup, and `prepare.ts` cleanup tests.
- End-to-end smoke as root in `node:24-bookworm`, with fake `codex`/`claude`/`npx` binaries and a fake Gitea, through `protect-source.sh` → `prepare.ts` → `run.ts` → `post.ts`:
- Codex hit "usage limit" and fell through to Claude.
- Agents ran as UIDs 20000/20001 without the master key.
- The Codex login was persisted to `/root/.codex/auth.json` (0600).
- The PR review with an inline comment was posted with the reviewer token.
- Runtime credentials were removed and the git author was configured.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: #20
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>
This commit was merged in pull request #20.
This commit is contained in:
Danny Kim
@@ -0,0 +1,232 @@
|
||||
/**
|
||||
* `project` — lint rules this repository holds its own source to. Deno lint
|
||||
* ran here with its `recommended` rules and no plugins; the Oxlint categories
|
||||
* in `vite.config.ts` plus the rule list below keep at least that coverage.
|
||||
* Its rules of its own are `no-disable-comments` and `no-non-ts-imports`.
|
||||
*
|
||||
* Loaded by `vite.config.ts` as an Oxlint `jsPlugins` entry.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
import type { LanguageOptions, RuleDefinition, RuleVisitor, TextSourceCode } from "@eslint/core";
|
||||
import type { TSESTree } from "@typescript-eslint/types";
|
||||
import type { DummyRuleMap } from "vite-plus/lint";
|
||||
|
||||
/** The source code both hosts hand a rule, with the comment list. */
|
||||
interface ProjectSourceCode extends TextSourceCode {
|
||||
getAllComments(): TSESTree.Comment[];
|
||||
}
|
||||
|
||||
/** ESLint's default rule types, reporting TypeScript-ESTree nodes. */
|
||||
interface ProjectRuleTypes {
|
||||
LangOptions: LanguageOptions;
|
||||
Code: ProjectSourceCode;
|
||||
RuleOptions: [];
|
||||
Visitor: RuleVisitor;
|
||||
Node: TSESTree.Node;
|
||||
MessageIds: string;
|
||||
ExtRuleDocs: unknown;
|
||||
}
|
||||
|
||||
/** A repo-local rule, in ESLint's standard `create` form. */
|
||||
type ProjectRule = RuleDefinition<ProjectRuleTypes>;
|
||||
|
||||
/** A comment that turns lint rules off or back on, in ESLint or Oxlint form. */
|
||||
const DIRECTIVE_PATTERN: RegExp = /^\s*(?:eslint|oxlint)-(?:disable|enable)/u;
|
||||
|
||||
/** This rule's own name, which a directive may not use to silence it. */
|
||||
const RULE_NAME: string = "no-disable-comments";
|
||||
|
||||
/**
|
||||
* `no-disable-comments` — rejects every `eslint-disable*`, `eslint-enable*`,
|
||||
* `oxlint-disable*`, and `oxlint-enable*` comment, line or block. Oxlint has
|
||||
* no `noInlineConfig` and no `eslint-comments` rules, so this repo bans them
|
||||
* itself: when a rule fires, fix the source.
|
||||
*
|
||||
* A directive can silence the report on itself, so two built-in checks close
|
||||
* the gaps: `unicorn/no-abusive-eslint-disable` fails one that names no rule,
|
||||
* and this rule skips one that names it, which then silences nothing and fails
|
||||
* `reportUnusedDisableDirectives` in `vite.config.ts`.
|
||||
*/
|
||||
const noDisableCommentsRule: ProjectRule = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: { description: "Disallow lint disable and enable comments" },
|
||||
schema: [],
|
||||
messages: { directive: "Lint disable comments are not allowed; fix the source." },
|
||||
},
|
||||
create(context) {
|
||||
return {
|
||||
Program(_node: TSESTree.Program): void {
|
||||
for (const comment of context.sourceCode.getAllComments()) {
|
||||
if (DIRECTIVE_PATTERN.test(comment.value) && !comment.value.includes(RULE_NAME)) {
|
||||
context.report({ loc: comment.loc, messageId: "directive" });
|
||||
}
|
||||
}
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
/** A module specifier read as a path: relative, absolute, or a `#` alias. */
|
||||
const PATH_SPECIFIER_PATTERN: RegExp = /^[./#]/u;
|
||||
|
||||
/**
|
||||
* Whether `source` names something other than a `.ts` module: a query string
|
||||
* such as `?raw`, or a final path segment with any other extension. Bare
|
||||
* package names are left alone, dots and all, as are extensionless paths.
|
||||
*/
|
||||
function isNonTsSource(source: string): boolean {
|
||||
if (source.includes("?")) {
|
||||
return true;
|
||||
}
|
||||
const segments: string[] = source.split("/");
|
||||
if (!PATH_SPECIFIER_PATTERN.test(source)) {
|
||||
const nameLength: number = source.startsWith("@") ? 2 : 1;
|
||||
if (segments.length <= nameLength) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
const lastSegment: string = segments.at(-1) ?? "";
|
||||
if (lastSegment === "." || lastSegment === ".." || !lastSegment.includes(".")) {
|
||||
return false;
|
||||
}
|
||||
return !lastSegment.endsWith(".ts");
|
||||
}
|
||||
|
||||
/**
|
||||
* `no-non-ts-imports` — rejects importing anything but a `.ts` module: a
|
||||
* source path, static or a dynamic `import()` with a string literal, ending in
|
||||
* another extension (`.css`, `.json`, `.svg`, `.js`, `.tsx`) or carrying a
|
||||
* query string (`?raw`, `?url`), and any import or export with import
|
||||
* attributes. Bare package names, `#` aliases, and `node:` builtins without an
|
||||
* extension pass; package subpaths are checked like paths.
|
||||
*/
|
||||
const noNonTsImportsRule: ProjectRule = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: { description: "Disallow importing modules other than .ts files" },
|
||||
schema: [],
|
||||
messages: {
|
||||
extension: "Only .ts modules may be imported.",
|
||||
attributes: "Import attributes are not allowed.",
|
||||
},
|
||||
},
|
||||
create(context) {
|
||||
function checkSource(source: TSESTree.StringLiteral): void {
|
||||
if (isNonTsSource(source.value)) {
|
||||
context.report({ node: source, messageId: "extension" });
|
||||
}
|
||||
}
|
||||
function checkDeclaration(
|
||||
node:
|
||||
| TSESTree.ImportDeclaration
|
||||
| TSESTree.ExportNamedDeclaration
|
||||
| TSESTree.ExportAllDeclaration,
|
||||
): void {
|
||||
if (node.source === null) {
|
||||
return;
|
||||
}
|
||||
checkSource(node.source);
|
||||
if (node.attributes.length > 0) {
|
||||
context.report({ node, messageId: "attributes" });
|
||||
}
|
||||
}
|
||||
return {
|
||||
ImportDeclaration: checkDeclaration,
|
||||
ExportNamedDeclaration: checkDeclaration,
|
||||
ExportAllDeclaration: checkDeclaration,
|
||||
ImportExpression(node: TSESTree.ImportExpression): void {
|
||||
if (node.source.type === "Literal" && typeof node.source.value === "string") {
|
||||
checkSource(node.source);
|
||||
}
|
||||
if (node.options !== null) {
|
||||
context.report({ node, messageId: "attributes" });
|
||||
}
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
/**
|
||||
* This repository's own rule list, spread by `vite.config.ts`: Deno's
|
||||
* `recommended` rules that sit outside the Oxlint categories, plus the
|
||||
* template's extras. Built-in Oxlint rule ids sit here too, so
|
||||
* `vite.config.ts` lists no rule by name.
|
||||
*/
|
||||
const rules: DummyRuleMap = {
|
||||
// The explicit-types template's `camelcase` stand-in: no `_` inside a name
|
||||
// once leading and trailing ones are trimmed, unless it has no lowercase
|
||||
// ASCII letter (UPPER_SNAKE).
|
||||
"id-match": [
|
||||
"error",
|
||||
"^_*[^_]*_*$|^[^a-z]*$",
|
||||
{ properties: false, classFields: false, onlyDeclarations: false, ignoreDestructuring: true },
|
||||
],
|
||||
// Deno's `recommended` rules outside the categories.
|
||||
"no-array-constructor": "error",
|
||||
"no-case-declarations": "error",
|
||||
"no-empty": "error",
|
||||
"no-fallthrough": "error",
|
||||
"no-inner-declarations": "error",
|
||||
"no-prototype-builtins": "error",
|
||||
"no-redeclare": "error",
|
||||
"no-regex-spaces": "error",
|
||||
"no-var": "error",
|
||||
"prefer-const": "error",
|
||||
"require-await": "error",
|
||||
"require-yield": "error",
|
||||
"typescript/adjacent-overload-signatures": "error",
|
||||
"typescript/ban-ts-comment": "error",
|
||||
"typescript/no-empty-interface": "error",
|
||||
"typescript/no-empty-object-type": "error",
|
||||
"typescript/no-explicit-any": "error",
|
||||
"typescript/no-namespace": "error",
|
||||
"typescript/no-non-null-asserted-optional-chain": "error",
|
||||
"typescript/no-unsafe-function-type": "error",
|
||||
"typescript/no-wrapper-object-types": "error",
|
||||
"typescript/prefer-as-const": "error",
|
||||
"typescript/prefer-namespace-keyword": "error",
|
||||
"typescript/triple-slash-reference": "error",
|
||||
// Deno's `no-window`, `no-process-global`, and `no-node-globals`: on Node,
|
||||
// these come from an explicit `node:` import instead of the global scope.
|
||||
"no-restricted-globals": [
|
||||
"error",
|
||||
"window",
|
||||
"process",
|
||||
"Buffer",
|
||||
"global",
|
||||
"setImmediate",
|
||||
"clearImmediate",
|
||||
],
|
||||
// The explicit-types template's extras.
|
||||
"import/no-cycle": "error",
|
||||
"typescript/consistent-type-imports": "error",
|
||||
"typescript/no-import-type-side-effects": "error",
|
||||
"typescript/no-non-null-assertion": "error",
|
||||
// Deno's `ban-untagged-ignore` and `ban-unused-ignore`, made stricter: no
|
||||
// disable comments at all.
|
||||
"project/no-disable-comments": "error",
|
||||
"project/no-non-ts-imports": "error",
|
||||
"unicorn/no-abusive-eslint-disable": "error",
|
||||
// Pedantic, but Node's and the web's own types (`Response`, `Stats`,
|
||||
// `RequestInit`) are mutable, so no parameter of theirs can pass; the
|
||||
// explicit-types template and the app repos turn it off too.
|
||||
"typescript/prefer-readonly-parameter-types": "off",
|
||||
};
|
||||
|
||||
/**
|
||||
* The repo-local plugin, namespace `project`: its own rules, enabled as
|
||||
* `project/<rule>`, and `configs.project`, the rule list above.
|
||||
*/
|
||||
const plugin = {
|
||||
meta: { name: "project" },
|
||||
rules: {
|
||||
"no-disable-comments": noDisableCommentsRule,
|
||||
"no-non-ts-imports": noNonTsImportsRule,
|
||||
},
|
||||
configs: { project: { rules } },
|
||||
};
|
||||
|
||||
export default plugin;
|
||||
@@ -4,6 +4,7 @@ set -euo pipefail
|
||||
path=$(mktemp -d "${RUNNER_TEMP}/bot-agents-source-XXXXXX")
|
||||
mkdir "${path}/src"
|
||||
cp -a "${ACTION_PATH}"/src/*.ts "${path}/src/"
|
||||
cp -a "${ACTION_PATH}/profiles.yml" "${ACTION_PATH}/prompt.md" "${path}/"
|
||||
# package.json makes Node load the TypeScript sources as ES modules.
|
||||
cp -a "${ACTION_PATH}/package.json" "${ACTION_PATH}/profiles.json" "${ACTION_PATH}/prompt.md" "${path}/"
|
||||
chmod -R go-w "${path}"
|
||||
printf 'path=%s\n' "${path}" >> "${GITHUB_OUTPUT}"
|
||||
|
||||
Reference in New Issue
Block a user