conductor

[conductor] task integration on conductor-worker-x86-64
[conductor] commit 9d4a25c78da7 attempt 1
[conductor] image node:24-alpine
$ apk add --no-cache git
( 1/12) Installing brotli-libs (1.2.0-r1)
( 2/12) Installing c-ares (1.34.8-r0)
( 3/12) Installing libunistring (1.4.2-r0)
( 4/12) Installing libidn2 (2.3.8-r0)
( 5/12) Installing nghttp2-libs (1.69.0-r0)
( 6/12) Installing libpsl (0.21.5-r3)
( 7/12) Installing zstd-libs (1.5.7-r2)
( 8/12) Installing libcurl (8.22.0-r0)
( 9/12) Installing libexpat (2.8.4-r0)
(10/12) Installing pcre2 (10.48-r0)
(11/12) Installing git (2.54.0-r0)
(12/12) Installing git-init-template (2.54.0-r0)
Executing busybox-1.37.0-r31.trigger
OK: 23.3 MiB in 30 packages
$ npm install --no-audit --no-fund

added 78 packages in 5s
npm notice
npm notice New major version of npm available! 11.19.0 -> 12.0.2
npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.2
npm notice To update run: npm install -g npm@12.0.2
npm notice
$ npm test

> conductor@0.4.2 test
> node --test "test/**/*.test.js"

✔ every tracked text file is pure ASCII (240.033001ms)
✔ no file uses CRLF line endings or trailing whitespace (98.584943ms)
✔ a password round trips and a wrong one is refused (46.512226ms)
✔ the same password hashes differently each time (34.991403ms)
✔ parameters are read back from the stored hash (32.058197ms)
✔ a malformed stored hash is refused rather than throwing (0.789937ms)
✔ password length is bounded (1.026051ms)
✔ a session token round trips its claims (2.362226ms)
✔ a token signed with another secret is refused (0.611395ms)
✔ a tampered payload is refused (0.529372ms)
✔ an expired token is refused (0.960376ms)
✔ a malformed token is refused rather than throwing (0.805863ms)
✔ cookies are parsed and issued (3.246934ms)
✔ the oidc login state round trips with its return path (2.266581ms)
✔ a missing return path means the root (0.702625ms)
✔ the oidc login state is refused when forged, stale or off-site (0.823246ms)
✔ oidc roles are collected from the usual claim shapes (1.129757ms)
✔ mask replaces secrets, longest first (0.620898ms)
✔ mask ignores very short values and leaves clean output alone (0.509606ms)
✔ health reports the selected drivers (379.34407ms)
✔ a signed trigger creates a job and expands the pipeline (206.812458ms)
✔ an unsigned or wrongly signed trigger is refused (100.224573ms)
✔ github and gitlab push payloads are understood (315.911252ms)
✔ a branch deletion is ignored rather than failing (129.100277ms)
✔ a broken pipeline is reported as a client error with detail (209.612165ms)
✔ a missing pipeline file is reported clearly (207.919711ms)
✔ a pipeline may be spelled .conductor.yaml instead of .conductor.yml (253.498008ms)
✔ a project pointed at a specific file gets no fallback (270.506449ms)
✔ a repository carrying both spellings is refused rather than guessed at (259.586934ms)
✔ a pipeline still using the jobs key is told what it was renamed to (223.059143ms)
✔ a job can be created directly, without a push payload to imitate (231.827426ms)
✔ creating a job requires the same signature as a trigger (139.190321ms)
✔ creating a job insists on a real commit rather than inferring one (107.539991ms)
✔ a job can be read back, with the state of every task (203.009385ms)
✔ a public job is readable without any credential at all (218.562955ms)
✔ a private job needs the trigger secret, and is otherwise absent (243.747825ms)
✔ a job of another project cannot be read through this one (192.563953ms)
✔ a task can be read back on its own, and by its full name (262.71715ms)
✔ reading a task back carries its dependencies and matrix (260.023571ms)
✔ reading a task back never exposes its environment, services or script (230.202864ms)
✔ a task lists the artifacts it stored, with a usable download url (254.934782ms)
✔ reading a task back needs no worker token (244.793845ms)
✔ a private task is absent without a credential, and needs its project named (254.311102ms)
✔ a private task is readable by an administrator, by either path (440.001956ms)
✔ a task of another project cannot be read through this one (228.475365ms)
✔ an unknown task is 404 by either path (140.787732ms)
✔ the worker api rejects missing and invalid tokens (100.951615ms)
✔ independent tasks dispatch concurrently (232.604341ms)
✔ a task is only offered to a worker that satisfies its requires (233.484313ms)
✔ a worker is not offered work for an architecture it cannot build (223.789187ms)
✔ a claimed task carries everything the worker needs (250.047965ms)
✔ a task that requires a feature reports it to the worker (226.855131ms)
✔ the standard conductor variables are present in the task environment (233.981113ms)
✔ the source tarball is served from the mirror (209.350009ms)
✔ a worker cannot touch a task it does not hold (243.907124ms)
✔ log appends are resumable and deduplicated by offset (236.353821ms)
✔ an oversized log chunk is refused (248.111045ms)
✔ a finished log moves to storage and is still readable (237.570956ms)
✔ artifacts are stored, hashed, and stripped of traversal (247.914842ms)
✔ an artifact shorter than its content-length is rejected (256.421737ms)
✔ success releases dependents, matched on shared dimensions (263.924506ms)
✔ failure skips transitive dependents, not just direct ones (252.302997ms)
✔ a job settles as failed once every task is terminal (283.031628ms)
✔ a job settles as success when everything passes (251.233342ms)
✔ an allowed failure does not fail the job or block dependents (259.089567ms)
✔ a task with retries left is requeued instead of failing the job (237.572588ms)
✔ heartbeats keep a task alive and report cancellation (227.224341ms)
✔ the reaper fails a task whose worker stopped reporting (252.02818ms)
✔ a second push produces an independent, numbered job (413.666559ms)
﹣ jobs can be listed and filtered by project (0.384165ms) # the JSON API was removed
﹣ unknown jobs, tasks and artifacts return 404 (0.135452ms) # the JSON API was removed
✔ a disabled project refuses triggers (124.498805ms)
✔ a trigger for an unknown project is a 404 (86.99599ms)
✔ a commit that is not in the repository is refused (213.598648ms)
✔ a task is told to fetch an archive, and never the repository itself (244.890144ms)
✔ the source archive is the bare tree, with no wrapping directory (234.372696ms)
✔ the working directory is resolved from the pipeline, then the project (717.412794ms)
✔ an unusable working directory is refused rather than sanitised (921.462621ms)
✔ the trigger secret is not stored in the clear (163.94109ms)
✔ worker tokens are stored only as hashes (115.747848ms)
✔ defaults select sqlite, local storage and local auth (7.646126ms)
✔ configuring an s3 bucket switches the storage driver (1.564697ms)
✔ a partial s3 configuration is rejected rather than half applied (2.025999ms)
✔ configuring an oidc discovery url switches the auth mode (1.415464ms)
✔ an oidc discovery url without a client id is rejected (1.284312ms)
✔ a database url selects its dialect (2.443588ms)
✔ an unsupported database scheme is reported clearly (1.469446ms)
✔ a sqlite url collapses into database.path (1.595864ms)
✔ environment variables override the config file (53.284012ms)
✔ relative paths resolve against the config file directory (7.587638ms)
✔ a missing explicit config file is an error, a missing default is not (2.62592ms)
✔ a heartbeat timeout below the reap interval is rejected (9.893748ms)
✔ a non-integer port is rejected with the variable named (1.201349ms)
✔ parseKey accepts hex and base64, and rejects the wrong length (0.694813ms)
✔ stateDirs omits the storage directory when s3 is in use (2.353887ms)
✔ the loaded config is frozen (1.050195ms)
✔ topological order places dependencies first (4.785428ms)
✔ topological order is deterministic (5.887251ms)
✔ a cycle is detected and named (1.970852ms)
✔ depth reflects the longest path, not insertion order (0.851674ms)
✔ independent tasks are runnable at the same time (1.012782ms)
✔ a task becomes runnable only once every dependency succeeds (0.800692ms)
✔ a running dependency does not release its dependents (0.827688ms)
✔ failure skips transitive dependents, not just direct ones (1.111355ms)
✔ a skipped dependency never releases a dependent (1.704435ms)
✔ allowed failures can satisfy a dependency when asked to (0.956188ms)
✔ transitive dependents of a leaf is empty (2.083652ms)
✔ graph helpers tolerate dependencies outside the set (0.882031ms)
✔ dialect detection covers every supported scheme (4.523571ms)
✔ statement splitter respects literals and comments (1.44884ms)
✔ statement splitter keeps postgres dollar quoted bodies whole (0.87286ms)
✔ migrations apply once and are idempotent (124.469721ms)
✔ an edited migration is refused rather than silently diverging (54.657173ms)
✔ a migration removed from disk is reported (36.715641ms)
✔ rows come back as ordinary objects (39.260216ms)
✔ a conditional update claims exactly once (43.651327ms)
✔ deleting a job cascades to its tasks (28.484385ms)
✔ a failed transaction rolls back, and a failed savepoint keeps the outer work (51.687092ms)
﹣ migrations apply and retention sweeps on postgres (2.635248ms) # SKIP
﹣ migrations apply and retention sweeps on mysql (0.370667ms) # SKIP
✔ every example pipeline compiles (78.166329ms)
✔ the distribution example fans in per architecture (15.758109ms)
✔ the node example wires services and features (11.598162ms)
✔ git jobs with safe.directory set (3.62194ms)
✔ it appends to configuration already in the environment (0.772945ms)
✔ a count that is not a number does not corrupt the sequence (0.607706ms)
✔ git accepts the environment we build (72.383382ms)
✔ a file missing from a commit reads as missing, whatever sits in the working directory (107.126221ms)
﹣ the endpoints and key set come from the discovery document (1.844185ms) # docker is not available
✔ discovery reports a document that is missing an endpoint (43.993011ms)
✔ discovery reports an unreachable provider and a bad status (1.424057ms)
﹣ a token carrying the admin role authenticates as an administrator (0.361019ms) # the JSON API was removed
﹣ a token without the admin role is an ordinary user (0.276053ms) # the JSON API was removed
﹣ roles are recognised in the groups and resource_access shapes (0.186927ms) # the JSON API was removed
﹣ an OIDC user gets a local account and can own a project (0.235322ms) # the JSON API was removed
﹣ the same subject keeps one account even when the display name changes (0.297996ms) # the JSON API was removed
﹣ a display name colliding with a local account gets its own username (0.385631ms) # the JSON API was removed
﹣ a role revoked at the provider is lost on the next request (0.550206ms) # the JSON API was removed
﹣ an account disabled locally is refused despite a valid token (0.707498ms) # the JSON API was removed
﹣ a forged signature is refused (0.786327ms) # the JSON API was removed
﹣ an expired token is refused (0.285732ms) # the JSON API was removed
﹣ a token from a different issuer is refused (0.241772ms) # the JSON API was removed
﹣ an anonymous visitor asking for a protected page is sent to the provider (0.258257ms) # docker is not available
﹣ a browser signs in at the provider and comes back with a session (0.130459ms) # docker is not available
﹣ a callback with a forged state is refused (0.112479ms) # docker is not available
﹣ local passwords are refused while OIDC is in charge (0.105884ms) # the JSON API was removed
﹣ an OIDC administrator can drive the interface (0.104374ms) # docker is not available
﹣ worker ownership follows the OIDC identity (0.102965ms) # the JSON API was removed
✔ a pattern without a star matches exactly (3.941193ms)
✔ a star matches any job of characters (0.956371ms)
✔ the rest of a pattern is literal, not a regular expression (0.61472ms)
✔ a restricted task is left out of jobs for other refs (60.295185ms)
✔ it is left out rather than recorded as skipped (6.523838ms)
✔ tasks depending on an excluded task are excluded too (8.20502ms)
✔ depth and ordering describe the job that will happen (3.442065ms)
✔ without a ref nothing is filtered, so a pipeline can still be validated (5.006447ms)
✔ a restricted task cannot match a job that has no ref (10.498159ms)
✔ a malformed rule is reported rather than ignored (19.354575ms)
✔ the rule is not inherited from defaults (4.160664ms)
✔ a minimal pipeline compiles (48.505069ms)
✔ version is required and pinned (7.55881ms)
✔ empty and malformed documents are rejected clearly (13.938974ms)
✔ image and script are required (1.310911ms)
✔ image may come from defaults (3.844943ms)
✔ unknown keys are rejected, with a suggestion when close (8.161789ms)
✔ all problems are reported at once (4.65813ms)
✔ durations accept seconds, units and composites (5.582615ms)
✔ durations accept day and week units (5.815099ms)
✔ a malformed duration is rejected (3.263324ms)
✔ arch expands into one task per architecture (4.652403ms)
✔ a matrix expands to the cartesian product (3.813147ms)
✔ needs match on shared dimensions rather than fanning out (13.382621ms)
✔ a task without the shared dimension depends on every instance (2.269284ms)
✔ match all opts out of dimension matching (3.404164ms)
✔ needs may name one concrete instance (3.354821ms)
✔ an unsatisfiable dimension match is reported, not silently dropped (2.192132ms)
✔ needs on an unknown task lists what is defined (0.819901ms)
✔ self dependency is rejected (1.140173ms)
✔ a dependency cycle names the cycle (3.166904ms)
✔ interpolation substitutes arch and matrix values (2.634662ms)
✔ interpolating an undefined dimension is an error (1.231479ms)
✔ referring to arch without declaring one is an error (1.441687ms)
✔ matrix values must be safe for use in a task name (0.937895ms)
✔ arch may not also be a matrix dimension (0.818184ms)
✔ services get a derived alias and reject duplicates (5.197746ms)
✔ artifacts accept a bare list and reject absolute paths (2.155286ms)
✔ artifact when is constrained (1.37384ms)
✔ defaults are inherited and overridden per task (2.307036ms)
✔ env values must be scalars with valid names (1.658386ms)
✔ parsePipeline normalizes without expanding (1.28318ms)
✔ a realistic distribution pipeline produces the expected graph (3.626093ms)
✔ compiles markers to the placeholder each dialect expects (11.563876ms)
✔ numbers postgres placeholders per occurrence, including repeats (0.534271ms)
✔ ignores markers inside string literals and comments (0.747217ms)
✔ a json literal in default text survives untouched (0.524437ms)
✔ doubling a brace escapes it (0.866543ms)
✔ block comments are skipped, and nest only for postgres (0.762189ms)
✔ postgres dollar quoted bodies are skipped (0.574302ms)
✔ mysql backtick identifiers and hash comments are skipped (0.950643ms)
✔ a malformed marker is rejected with a useful message (2.641943ms)
✔ binds by name, resolving dotted paths (1.83915ms)
✔ an exact key beats path traversal (0.549304ms)
✔ reports every missing key at once (1.850111ms)
✔ rejects an array of parameters, which would silently bind by position (0.646542ms)
✔ normalizes booleans, dates and null (0.537022ms)
✔ rejects an object value, which is nearly always a forgotten stringify (0.697109ms)
✔ an artifact past its own deadline is deleted (356.360691ms)
✔ an explicit deadline overrides the policy in both directions (199.67836ms)
✔ an explicit deadline also beats the last good job (112.359424ms)
✔ the last few jobs keep their artifacts however old they are (107.897068ms)
✔ recent artifacts are kept however many jobs have followed (105.654638ms)
✔ an artifact outside both rules is deleted (87.97363ms)
✔ the most recent successful job is kept whatever the policy says (106.407549ms)
✔ only the latest success is protected, not every success (120.664772ms)
✔ a project may keep artifacts forever despite a server default (111.644438ms)
✔ a project setting overrides the server default (93.924444ms)
✔ an unfinished job is never swept (91.789476ms)
✔ logs older than the limit are removed but the task remains (108.92319ms)
✔ a swept log is distinguishable from one that never existed (115.681774ms)
✔ a log is swept only once (122.475035ms)
✔ zero keeps logs forever (106.527978ms)
✔ a storage failure leaves the row for the next pass (100.918236ms)
✔ a sweep deletes no more than its batch (120.762206ms)
✔ one project policy does not reach into another (110.294223ms)
✔ artifacts.expire in a pipeline reaches the stored artifact (269.26894ms)
﹣ the api reports and accepts project retention (0.325514ms) # the JSON API was removed
✔ seals and opens a value (8.110944ms)
✔ sealing twice produces different ciphertext (1.491158ms)
✔ without a key, values are stored as marked plaintext (0.675837ms)
✔ a keyed box can still read values written before a key existed (0.543125ms)
✔ an unkeyed box refuses encrypted values with an actionable message (2.266196ms)
✔ the wrong key fails to open (0.873997ms)
✔ tampering with the ciphertext is detected (0.798519ms)
✔ associated data binds a secret to its location (2.664036ms)
✔ a key of the wrong size is refused at construction (1.729083ms)
✔ task ids are opaque, and say nothing about their job (8.913954ms)
✔ time ordered ids sort by creation time (0.725074ms)
✔ random ids use the expected alphabet (0.409788ms)
✔ slugify produces readable project ids and falls back when empty (0.699669ms)
✔ token hashing and constant time comparison (1.924994ms)
✔ the pipeline this project jobs on itself compiles (61.687741ms)
✔ its tasks declare the features they actually need (12.510971ms)
✔ publishing is restricted to main and release tags (62.821258ms)
✔ get-vanilla matches the reference signature (6.737403ms)
✔ get-vanilla-query-order-key-case matches the reference signature (1.973328ms)
✔ uriEncode percent encodes the characters encodeURIComponent leaves alone (0.479066ms)
✔ amzDate produces both required formats (0.509391ms)
✔ s3 requests carry the content hash header (1.372861ms)
✔ presigned urls carry the signature in the query string (4.632913ms)
✔ an already encoded path is not encoded a second time (1.85943ms)
✔ key validation rejects traversal and absolute paths (3.778864ms)
✔ sanitizeRelativePath strips traversal from worker supplied paths (0.469247ms)
✔ key layout is stable (0.703145ms)
✔ local backend round trips a buffer and reports its digest (52.398047ms)
✔ local backend serves ranges (10.99045ms)
✔ local backend accepts a stream (12.642598ms)
✔ local backend reports a missing object and deletes idempotently (6.860463ms)
✔ local backend has no presigned urls (1.665346ms)
✔ a partial write leaves no object behind (5.159576ms)
✔ part size grows so that a huge object still fits in 10000 parts (0.525607ms)
✔ inParts regroups an awkwardly chunked stream into fixed parts (2.375583ms)
✔ inParts handles a chunk far larger than the part size (0.885033ms)
✔ inParts yields nothing for an empty stream (0.8967ms)
﹣ s3 backend round trips awkward keys against a real server (0.158238ms) # docker is not available
﹣ s3 serves byte ranges (0.093575ms) # docker is not available
﹣ s3 accepts a stream when the size is known (0.176205ms) # docker is not available
﹣ a presigned url is usable without credentials (0.200761ms) # docker is not available
﹣ a tampered presigned url is rejected by the server (0.102519ms) # docker is not available
﹣ s3 reports a missing object and deletes idempotently (0.128934ms) # docker is not available
﹣ a stream of unknown length is accepted (0.097175ms) # docker is not available
﹣ a body past the single request threshold is uploaded in parts (0.092257ms) # docker is not available
﹣ a large body really is sent as several parts, and a small one is not (0.099606ms) # docker is not available
﹣ a multipart object still serves ranges (0.159833ms) # docker is not available
﹣ a body that does not match its declared size is rejected (0.102799ms) # docker is not available
﹣ a failed multipart upload does not leave parts behind (0.098616ms) # docker is not available
﹣ bad credentials fail loudly rather than silently storing nothing (0.067716ms) # docker is not available
✔ every javascript file parses (972.522202ms)
✔ the shell scripts parse (3.37415ms)
✔ interpolated values are escaped by default (2.673871ms)
✔ quotes and ampersands are escaped inside attributes (0.560109ms)
✔ nested templates and arrays are kept, raw is passed through (0.454928ms)
✔ null, undefined and false render as nothing (0.354623ms)
✔ attrs omits absent values and renders bare booleans (0.520733ms)
✔ an anonymous visitor sees public jobs and an invitation to sign in (516.016159ms)
✔ an anonymous visitor cannot see a private job (309.792071ms)
✔ management pages redirect an anonymous visitor to sign in (257.981803ms)
✔ signing in through the form sets a session and reveals the nav (370.253856ms)
✔ a user creates a project through the form and is shown the secret once (401.972212ms)
✔ a project page shows variables and never their values (345.351824ms)
✔ setting and removing a variable returns the updated table (379.712829ms)
✔ a user cannot open or delete a project they do not own (511.966176ms)
✔ registering a worker shows the token once and lists it (355.325951ms)
✔ an ordinary user cannot create shared capacity from the form (555.405637ms)
✔ the users page is administrator only and warns about what deletion destroys (536.46942ms)
✔ a running job polls, and a finished one stops (400.524425ms)
✔ a task page streams the log and stops polling once it completes (419.985137ms)
✔ log output is escaped, so a task cannot inject markup into the page (347.440589ms)
✔ a mutation without the htmx header is refused (358.015694ms)
✔ the sign in form is centred rather than stranded at the left edge (209.753781ms)
✔ row actions stay ordinary table cells, so rows keep one height (325.563094ms)
✔ the stylesheet and htmx are served, and nothing else is (213.817676ms)
✔ the project page shows retention, with server defaults as placeholders (361.181575ms)
✔ saving retention through the form stores it, and empty means inherit (352.656919ms)
✔ a negative retention value is refused by the form (294.879364ms)
✔ the project page offers a working directory, defaulting to the server one (300.430785ms)
✔ saving a working directory stores it, and empty clears it (322.261324ms)
✔ an unusable working directory is refused by the form (391.040346ms)
✔ worker config loads from json and reports features (29.803433ms)
✔ worker config reads the token from a file (5.415471ms)
✔ environment overrides the worker config file (4.126883ms)
✔ worker config without a token is rejected (6.366523ms)
✔ a malformed feature is reported with its path (4.150346ms)
✔ shell quoting survives quotes and metacharacters (0.67937ms)
✔ a generated script echoes each command and stops on failure (0.694571ms)
✔ container names are valid for docker and stay unique (2.224054ms)
✔ job arguments carry mounts, env, network and privilege (1.188949ms)
✔ a task container is created without sharing anything with the worker (1.287008ms)
✔ a feature still contributes its bind mounts (0.582457ms)
✔ features resolve into mounts, env and privilege (0.836053ms)
✔ an unknown required feature is reported rather than ignored (0.326886ms)
✔ an artifact pattern reduces to the part that can be copied out (0.720716ms)
✔ overlapping artifact paths are copied out once (0.898693ms)
✔ artifact collection globs, and refuses to leave the workspace (33.786075ms)
✔ artifact when controls collection (0.53098ms)
✔ an idle worker keeps running instead of exiting (4013.828102ms)
✔ a worker stops promptly on a signal rather than after its poll interval (1522.769763ms)
✔ log output is batched and offsets advance (5.396642ms)
✔ a conflicting offset resynchronises instead of duplicating (1.454497ms)
✔ secrets are masked before anything leaves the host (2.587068ms)
✔ a secret split across two writes is still masked (0.989615ms)
✔ a failing conductor does not break the task (1.787239ms)
ℹ tests 331
ℹ suites 0
ℹ pass 295
ℹ fail 0
ℹ cancelled 0
ℹ skipped 36
ℹ todo 0
ℹ duration_ms 15284.626575
[conductor] done