Merge development into main

package.json

@@ -3,14 +3,14 @@
   "version": "2.1.5",
   "private": false,
   "description": "The kernel for UbiquityOS.",
-  "module": "dist/esm/index.js",
+  "module": "dist/index.mjs",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
   "exports": {
     ".": {
-      "require": "./dist/index.js",
-      "import": "./dist/esm/index.js",
-      "types": "./dist/index.d.ts"
+			"types": "./dist/index.d.ts",
+			"require": "./dist/index.js",
+			"import": "./dist/index.mjs"
     }
   },
   "files": [
@@ -57,8 +57,9 @@
     "@octokit/plugin-rest-endpoint-methods": "13.2.4",
     "@octokit/plugin-retry": "7.1.1",
     "@octokit/plugin-throttling": "9.3.1",
-    "@octokit/types": "13.5.0",
-    "@octokit/webhooks": "13.2.8",
+    "@octokit/rest": "^21.0.2",
+    "@octokit/types": "^13.5.0",
+    "@octokit/webhooks": "13.3.0",
     "@octokit/webhooks-types": "7.5.1",
     "@sinclair/typebox": "0.32.35",
     "@ubiquity-os/ubiquity-os-logger": "^1.3.2",

src/github/handlers/index.ts

@@ -98,16 +98,21 @@ async function handleEvent(event: EmitterWebhookEvent, eventHandler: InstanceTyp
     state.inputs[0] = inputs;
     await eventHandler.pluginChainState.put(stateId, state);
 
-    if (!isGithubPluginObject) {
-      await dispatchWorker(plugin, await inputs.getWorkerInputs());
-    } else {
-      await dispatchWorkflow(context, {
-        owner: plugin.owner,
-        repository: plugin.repo,
-        workflowId: plugin.workflowId,
-        ref: plugin.ref,
-        inputs: inputs.getWorkflowInputs(),
-      });
+    // We wrap the dispatch so a failing plugin doesn't break the whole execution
+    try {
+      if (!isGithubPluginObject) {
+        await dispatchWorker(plugin, await inputs.getWorkerInputs());
+      } else {
+        await dispatchWorkflow(context, {
+          owner: plugin.owner,
+          repository: plugin.repo,
+          workflowId: plugin.workflowId,
+          ref: plugin.ref,
+          inputs: await inputs.getWorkflowInputs(),
+        });
+      }
+    } catch (e) {
+      console.error(`An error occurred while processing the plugin chain, will skip plugin ${JSON.stringify(plugin)}`, e);
     }
   }
 }

src/github/handlers/push-event.ts

@@ -125,18 +125,8 @@ async function checkPluginConfigurations(context: GitHubContext<"push">, config:
 export default async function handlePushEvent(context: GitHubContext<"push">) {
   const { payload } = context;
   const { repository, commits, after } = payload;
-  const configPaths = [CONFIG_FULL_PATH, DEV_CONFIG_FULL_PATH];
-  const didConfigurationFileChange = commits.some((commit) =>
-    configPaths.some((path) => {
-      if (commit.modified?.includes(path) || commit.added?.includes(path)) {
-        // Keeps only the config that matched the modified elements
-        configPaths.length = 0;
-        configPaths.push(path);
-        return true;
-      }
-      return false;
-    })
-  );
+  const configPath = context.eventHandler.environment === "production" ? CONFIG_FULL_PATH : DEV_CONFIG_FULL_PATH;
+  const didConfigurationFileChange = commits.some((commit) => commit.modified?.includes(configPath) || commit.added?.includes(configPath));
 
   if (!didConfigurationFileChange || !repository.owner) {
     return;
@@ -154,7 +144,7 @@ export default async function handlePushEvent(context: GitHubContext<"push">) {
   try {
     if (errors.length) {
       const body = [];
-      body.push(...constructErrorBody(errors, rawData, repository, after, configPaths[0]));
+      body.push(...constructErrorBody(errors, rawData, repository, after, configPath));
       await createCommitComment(
         context,
         {

src/github/handlers/repository-dispatch.ts

@@ -73,7 +73,7 @@ export async function repositoryDispatch(context: GitHubContext<"repository_disp
       repository: nextPlugin.plugin.repo,
       ref: nextPlugin.plugin.ref,
       workflowId: nextPlugin.plugin.workflowId,
-      inputs: inputs.getWorkflowInputs(),
+      inputs: await inputs.getWorkflowInputs(),
     });
   } else {
     await dispatchWorker(nextPlugin.plugin, await inputs.getWorkerInputs());

src/github/types/plugin.ts

@@ -45,15 +45,20 @@ export class PluginInput<T extends EmitterWebhookEventName = EmitterWebhookEvent
     this.ref = ref;
   }
 
-  public getWorkflowInputs() {
-    return {
+  public async getWorkflowInputs() {
+    const inputs = {
       stateId: this.stateId,
       eventName: this.eventName,
       eventPayload: JSON.stringify(this.eventPayload),
       settings: JSON.stringify(this.settings),
       authToken: this.authToken,
       ref: this.ref,
     };
+    const signature = await this.eventHandler.signPayload(JSON.stringify(inputs));
+    return {
+      ...inputs,
+      signature,
+    };
   }
 
   public async getWorkerInputs() {

src/sdk/actions.ts

@@ -8,6 +8,8 @@ import { config } from "dotenv";
 import { Context } from "./context";
 import { customOctokit } from "./octokit";
 import { sanitizeMetadata } from "./util";
+import { verifySignature } from "./signature";
+import { KERNEL_PUBLIC_KEY } from "./constants";
 
 config();
 
@@ -16,6 +18,7 @@ interface Options {
   postCommentOnError?: boolean;
   settingsSchema?: TAnySchema;
   envSchema?: TAnySchema;
+  kernelPublicKey?: string;
 }
 
 const inputSchema = T.Object({
@@ -25,6 +28,7 @@ const inputSchema = T.Object({
   authToken: T.String(),
   settings: T.String(),
   ref: T.String(),
+  signature: T.String(),
 });
 
 export async function createActionsPlugin<TConfig = unknown, TEnv = unknown, TSupportedEvents extends WebhookEventName = WebhookEventName>(
@@ -36,20 +40,29 @@ export async function createActionsPlugin<TConfig = unknown, TEnv = unknown, TSu
     postCommentOnError: options?.postCommentOnError || true,
     settingsSchema: options?.settingsSchema,
     envSchema: options?.envSchema,
+    kernelPublicKey: options?.kernelPublicKey || KERNEL_PUBLIC_KEY,
   };
 
+  const githubInputs = { ...github.context.payload.inputs };
+  const signature = githubInputs.signature;
+  delete githubInputs.signature;
+  if (!(await verifySignature(pluginOptions.kernelPublicKey, githubInputs, signature))) {
+    core.setFailed(`Error: Invalid signature`);
+    return;
+  }
+
   const inputs = Value.Decode(inputSchema, github.context.payload.inputs);
 
   let config: TConfig;
   if (pluginOptions.settingsSchema) {
-    config = Value.Decode(pluginOptions.settingsSchema, JSON.parse(inputs.settings));
+    config = Value.Decode(pluginOptions.settingsSchema, Value.Default(pluginOptions.settingsSchema, JSON.parse(inputs.settings)));
   } else {
     config = JSON.parse(inputs.settings) as TConfig;
   }
 
   let env: TEnv;
   if (pluginOptions.envSchema) {
-    env = Value.Decode(pluginOptions.envSchema, process.env);
+    env = Value.Decode(pluginOptions.envSchema, Value.Default(pluginOptions.envSchema, process.env));
   } else {
     env = process.env as TEnv;
   }

src/sdk/server.ts

@@ -52,14 +52,14 @@ export async function createPlugin<TConfig = unknown, TEnv = unknown, TSupported
 
     let config: TConfig;
     if (pluginOptions.settingsSchema) {
-      config = Value.Decode(pluginOptions.settingsSchema, payload.settings);
+      config = Value.Decode(pluginOptions.settingsSchema, Value.Default(pluginOptions.settingsSchema, payload.settings));
     } else {
       config = payload.settings as TConfig;
     }
 
     let env: TEnv;
     if (pluginOptions.envSchema) {
-      env = Value.Decode(pluginOptions.envSchema, ctx.env);
+      env = Value.Decode(pluginOptions.envSchema, Value.Default(pluginOptions.envSchema, ctx.env));
     } else {
       env = ctx.env as TEnv;
     }

src/sdk/signature.ts

@@ -1,20 +1,25 @@
 export async function verifySignature(publicKeyPem: string, payload: unknown, signature: string) {
-  const pemContents = publicKeyPem.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").trim();
-  const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
+  try {
+    const pemContents = publicKeyPem.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").trim();
+    const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
 
-  const publicKey = await crypto.subtle.importKey(
-    "spki",
-    binaryDer,
-    {
-      name: "RSASSA-PKCS1-v1_5",
-      hash: "SHA-256",
-    },
-    true,
-    ["verify"]
-  );
+    const publicKey = await crypto.subtle.importKey(
+      "spki",
+      binaryDer,
+      {
+        name: "RSASSA-PKCS1-v1_5",
+        hash: "SHA-256",
+      },
+      true,
+      ["verify"]
+    );
 
-  const signatureArray = Uint8Array.from(atob(signature), (c) => c.charCodeAt(0));
-  const dataArray = new TextEncoder().encode(JSON.stringify(payload));
+    const signatureArray = Uint8Array.from(atob(signature), (c) => c.charCodeAt(0));
+    const dataArray = new TextEncoder().encode(JSON.stringify(payload));
 
-  return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", publicKey, signatureArray, dataArray);
+    return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", publicKey, signatureArray, dataArray);
+  } catch (error) {
+    console.error(error);
+    return false;
+  }
 }