mirror of
https://github.com/bahdotsh/wrkflw.git
synced 2026-09-02 12:16:16 +02:00
f53a45e25d
It turns out that resolve_action was blindly splitting on '@' for *all* action references, including Docker image refs like docker://alpine@sha256:abc123. The '@' in a Docker digest is not a version separator — it's part of the image reference. Splitting it produces a nonsensical repository and a fake "version" that happens to be a SHA256 digest. Nobody noticed because the Docker path doesn't use the version field, but the parsed data was still wrong. While at it, the auth retry path in fetch_and_parse was constructing a brand new reqwest::Client on every single 404-then-retry cycle. That means a fresh TLS handshake each time, which is wasteful when we already have a perfectly good static client pattern. Promote the no-redirect client to a static Lazy, same as HTTP_CLIENT. The auth redirect flow — where we send GITHUB_TOKEN to the origin but strip it before following a redirect to a CDN — had zero test coverage. This is the kind of security invariant that *really* should not depend on code review alone. Add wiremock-based tests that verify the token does not leak to redirect targets, plus tests for the basic auth retry and 404 paths. Parameterize fetch_and_parse with a base_url so wiremock can intercept the requests.
47 lines
1.1 KiB
TOML
47 lines
1.1 KiB
TOML
[package]
|
|
name = "wrkflw-executor"
|
|
version = "0.7.3"
|
|
edition.workspace = true
|
|
description = "Workflow execution engine for wrkflw"
|
|
license.workspace = true
|
|
documentation.workspace = true
|
|
homepage.workspace = true
|
|
repository.workspace = true
|
|
keywords.workspace = true
|
|
categories.workspace = true
|
|
|
|
[dependencies]
|
|
# Internal crates
|
|
wrkflw-models.workspace = true
|
|
wrkflw-parser.workspace = true
|
|
wrkflw-runtime.workspace = true
|
|
wrkflw-logging.workspace = true
|
|
wrkflw-matrix.workspace = true
|
|
wrkflw-secrets.workspace = true
|
|
wrkflw-utils.workspace = true
|
|
|
|
# External dependencies
|
|
async-trait.workspace = true
|
|
bollard.workspace = true
|
|
chrono.workspace = true
|
|
dirs.workspace = true
|
|
futures.workspace = true
|
|
futures-util.workspace = true
|
|
ignore = "0.4"
|
|
lazy_static.workspace = true
|
|
num_cpus.workspace = true
|
|
once_cell.workspace = true
|
|
regex.workspace = true
|
|
reqwest.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
serde_yaml.workspace = true
|
|
tar.workspace = true
|
|
tempfile.workspace = true
|
|
thiserror.workspace = true
|
|
tokio.workspace = true
|
|
uuid.workspace = true
|
|
|
|
[dev-dependencies]
|
|
wiremock.workspace = true
|