1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package usecase
4
5import (
6 "context"
7 "crypto/rsa"
8 "slices"
9 "time"
10
11 "bnema.dev/ermite-actions/expr"
12 "bnema.dev/ermite-actions/template"
13 "bnema.dev/ermite-actions/workflow"
14 "bnema.dev/ermite/internal/domain"
15 "bnema.dev/ermite/internal/ports"
16)
17
18// Sweep exposes the daily sweep to the tests.
19func (c *CI) Sweep(ctx context.Context) { c.sweep(ctx) }
20
21// RunTitle gives the title of a run as startRun sets it: the evaluated
22// run-name, else commitTitle.
23func (c *CI) RunTitle(ctx context.Context, wf *workflow.Workflow, githubJSON, commitTitle string) string {
24 if name, ok := c.evalRunName(ctx, wf, githubJSON, expr.NewDictionary()); ok {
25 return name
26 }
27 return commitTitle
28}
29
30// CheckRunID exposes checkRunID to the tests.
31func CheckRunID(ctx context.Context, run domain.CIRun, index, combo int) int64 {
32 return checkRunID(ctx, run, index, combo)
33}
34
35// SecretUse is the result of SecretsUsedBy.
36type SecretUse = secretUse
37
38// SecretsUsedBy exposes secretsUsedBy to the tests.
39func SecretsUsedBy(workflowYAML, jobID string) SecretUse {
40 return secretsUsedBy(workflowYAML, jobID)
41}
42
43// SecretWalks is the number of YAML walks made so far.
44func SecretWalks() int64 { return secretWalks.Load() }
45
46// SecretUseCache is a wfCache exposed to the tests.
47type SecretUseCache struct{ c *wfCache }
48
49// NewSecretUseCache builds a cache for up to max runs.
50func NewSecretUseCache(max int) *SecretUseCache { return &SecretUseCache{newWfCache(max)} }
51
52// Use is wfCache.secretUse.
53func (s *SecretUseCache) Use(runID int64, yaml, jobKey string) SecretUse {
54 return s.c.secretUse(runID, yaml, jobKey)
55}
56
57// Drop is wfCache.drop.
58func (s *SecretUseCache) Drop(runID int64) { s.c.drop(runID) }
59
60// EvalConcurrency exposes evalConcurrency to the tests.
61func EvalConcurrency(ctx context.Context, tok template.Token, env template.Env) (domain.CIConcurrency, error) {
62 return evalConcurrency(ctx, tok, env)
63}
64
65// MatchPullRequest exposes the pull_request filter to the tests.
66func MatchPullRequest(wf *workflow.Workflow, action, base string, files []string, truncated bool) bool {
67 return matchPullRequest(wf, "pull_request", action, base, files, truncated)
68}
69
70// MatchPullRequestTarget exposes the pull_request_target filter to the tests.
71func MatchPullRequestTarget(wf *workflow.Workflow, action, base string, files []string, truncated bool) bool {
72 return matchPullRequest(wf, "pull_request_target", action, base, files, truncated)
73}
74
75// MatchWorkflowRun exposes the workflow_run filter to the tests.
76func MatchWorkflowRun(wf *workflow.Workflow, name, action, headBranch string) bool {
77 return matchWorkflowRun(wf, name, action, headBranch)
78}
79
80// ResolveDispatchInputs exposes resolveDispatchInputs to the tests.
81func ResolveDispatchInputs(defs []workflow.Input, given map[string]string) (map[string]string, error) {
82 return resolveDispatchInputs(defs, given)
83}
84
85// PullFilesLink exposes the Link header of the files endpoint to the tests.
86func PullFilesLink(base string, page, perPage, total int) string {
87 return pullFilesLink(base, page, perPage, total)
88}
89
90// FilePatch exposes the patch text of a file of the files endpoint to the tests.
91func FilePatch(f domain.FileDiff) (string, bool) { return filePatch(f) }
92
93// PullTipsTrusted exposes the trust check of an activity of a merge request to
94// the tests, on a CI that has cfg and no workers.
95func PullTipsTrusted(ctx context.Context, cfg CIConfig, repo domain.RepoName, ev ports.PullRequestEvent) (bool, domain.ObjectID) {
96 return (&CI{cfg: cfg}).pullTipsTrusted(ctx, repo, ev)
97}
98
99// Thumbprint exposes thumbprint to the tests.
100func Thumbprint(pub *rsa.PublicKey) string { return thumbprint(pub) }
101
102// IDTokenClaims gives the claims idTokenClaims builds, decoded.
103func IDTokenClaims(contextsJSON, environment, issuer, audience string, at time.Time) (map[string]any, []string, error) {
104 claims, err := idTokenClaims(contextsJSON, environment, idTokenMeta{issuer: issuer, audience: audience, jti: "jti", now: at})
105 if err != nil {
106 return nil, nil, err
107 }
108 out := make(map[string]any, len(claims))
109 keys := make([]string, 0, len(claims))
110 for _, p := range claims {
111 out[p.k] = p.v
112 keys = append(keys, p.k)
113 }
114 return out, keys, nil
115}
116
117// SignForTest signs claims (in the order of their keys) with the signing key.
118func (o *OIDC) SignForTest(claims map[string]any) (string, error) {
119 keys := make([]string, 0, len(claims))
120 for k := range claims {
121 keys = append(keys, k)
122 }
123 slices.Sort(keys)
124 out := make(ordered, 0, len(keys))
125 for _, k := range keys {
126 out = append(out, pair{k, claims[k]})
127 }
128 return o.sign(out)
129}