Merge branch 'pivotal-cf:main' into main

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
           go-version-file: go.mod
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v6
 
       - name: Ensure Generate Succeeds and Does Not Make Changes
         run: |

go.mod

@@ -1,6 +1,6 @@
 module github.com/pivotal-cf/kiln
 
-go 1.21
+go 1.22.6
 
 require (
 	github.com/Masterminds/semver/v3 v3.2.1

internal/acceptance/workflows/baking_a_tile.feature

@@ -13,11 +13,11 @@ Feature: As a developer, I want to bake a tile
       | releases/bpm-1.2.12.tgz           |
       | releases/hello-release-0.2.3.tgz |
     And "bake_records/0.2.0-dev.json" contains substring: "version": "0.2.0-dev"
-    And "bake_records/0.2.0-dev.json" contains substring: "source_revision": "bc3ac24e192ba06a2eca19381ad785ec7069e0d0"
+    And "bake_records/0.2.0-dev.json" contains substring: "source_revision": "6d5069f9dfb954ff77bb16c5aee670b9909f154a"
     And "bake_records/0.2.0-dev.json" contains substring: "tile_directory": "."
     And "bake_records/0.2.0-dev.json" contains substring: "kiln_version": "0.0.0+acceptance-tests"
-    And "bake_records/0.2.0-dev.json" contains substring: "file_checksum": "5f8abc7a3272a70fa716cdf120f6976f6b78e16a01a4b3e085ced7f51d6c7691"
-    And "tile-0.2.0-dev.pivotal" has sha256 sum "5f8abc7a3272a70fa716cdf120f6976f6b78e16a01a4b3e085ced7f51d6c7691"
+    And "bake_records/0.2.0-dev.json" contains substring: "file_checksum": "c94e5749bf676f03ff10539956e9445d309647c5299b16dfe71cb522e9258f0d"
+    And "tile-0.2.0-dev.pivotal" has sha256 sum "c94e5749bf676f03ff10539956e9445d309647c5299b16dfe71cb522e9258f0d"
 
   Scenario: it reads directory configuration from Kilnfile
     Given I have a tile source directory "testdata/tiles/non-standard-paths"

internal/acceptance/workflows/testdata/tiles/v2/go.mod

@@ -1,6 +1,6 @@
 module github.com/crhntr/hello-tile
 
-go 1.20
+go 1.22.6
 
 require (
 	github.com/cppforlife/go-patch v0.2.0 // indirect

internal/commands/find_stemcell_version.go

@@ -2,6 +2,7 @@ package commands
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 
@@ -57,7 +58,7 @@ func (cmd FindStemcellVersion) Execute(args []string) error {
 	}
 
 	if kilnfile.Stemcell.Version == "" {
-		return fmt.Errorf(ErrStemcellMajorVersionMustBeValid)
+		return errors.New(ErrStemcellMajorVersionMustBeValid)
 	}
 
 	// Get stemcell version from pivnet

internal/commands/update_release.go

@@ -78,7 +78,6 @@ func (u UpdateRelease) Execute(args []string) error {
 			StemcellOS:       kilnfileLock.Stemcell.OS,
 			GitHubRepository: releaseSpec.GitHubRepository,
 		}, false)
-
 		if err != nil {
 			if component.IsErrNotFound(err) {
 				return fmt.Errorf("error finding the release: %w", err)
@@ -99,7 +98,6 @@ func (u UpdateRelease) Execute(args []string) error {
 			StemcellVersion:  kilnfileLock.Stemcell.Version,
 			GitHubRepository: releaseSpec.GitHubRepository,
 		})
-
 		if err != nil {
 			if component.IsErrNotFound(err) {
 				return fmt.Errorf("error finding the release: %w", err)

internal/commands/update_stemcell.go

@@ -48,7 +48,6 @@ func (update UpdateStemcell) Execute(args []string) error {
 
 	kilnStemcellVersion := kilnfile.Stemcell.Version
 	releaseVersionConstraint, err = semver.NewConstraint(kilnStemcellVersion)
-
 	if err != nil {
 		return fmt.Errorf("invalid stemcell constraint in kilnfile: %w", err)
 	}

internal/commands/validate.go

@@ -14,6 +14,7 @@ import (
 type Validate struct {
 	Options struct {
 		flags.Standard
+		ReleaseSourceTypeAllowList []string `long:"allow-release-source-type"`
 	}
 
 	FS billy.Filesystem
@@ -38,7 +39,7 @@ func (v Validate) Execute(args []string) error {
 		return fmt.Errorf("failed to load kilnfiles: %w", err)
 	}
 
-	errs := cargo.Validate(kf, lock)
+	errs := cargo.Validate(kf, lock, cargo.ValidateResourceTypeAllowList(v.Options.ReleaseSourceTypeAllowList...))
 	if len(errs) > 0 {
 		return errorList(errs)
 	}

internal/commands/validate_test.go

@@ -0,0 +1,72 @@
+package commands_test
+
+import (
+	"io"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+
+	"github.com/go-git/go-billy/v5"
+	"github.com/go-git/go-billy/v5/memfs"
+
+	"github.com/pivotal-cf/kiln/internal/commands"
+)
+
+var _ = Describe("validate", func() {
+	var (
+		validate  commands.Validate
+		directory billy.Filesystem
+	)
+
+	BeforeEach(func() {
+		directory = memfs.New()
+	})
+
+	JustBeforeEach(func() {
+		validate = commands.NewValidate(directory)
+	})
+
+	When("the kilnfile has two release_sources", func() {
+		BeforeEach(func() {
+			f, err := directory.Create("Kilnfile")
+			Expect(err).NotTo(HaveOccurred())
+			// language=yaml
+			_, _ = io.WriteString(f, `---
+release_sources:
+  - type: "bosh.io"
+  - type: "github"
+`)
+			_ = f.Close()
+		})
+
+		BeforeEach(func() {
+			f, err := directory.Create("Kilnfile.lock")
+			Expect(err).NotTo(HaveOccurred())
+			_ = f.Close()
+		})
+
+		When("both types are in the allow list", func() {
+			It("it does fail", func() {
+				err := validate.Execute([]string{
+					"--allow-release-source-type=bosh.io",
+					"--allow-release-source-type=github",
+				})
+				Expect(err).NotTo(HaveOccurred())
+			})
+		})
+		When("both one of the types is not in the allow list", func() {
+			It("it does fail", func() {
+				err := validate.Execute([]string{
+					"--allow-release-source-type=bosh.io",
+				})
+				Expect(err).To(MatchError(ContainSubstring("release source type not allowed: github")))
+			})
+		})
+		When("the allow list is empty", func() {
+			It("it does not fail", func() {
+				err := validate.Execute([]string{})
+				Expect(err).NotTo(HaveOccurred())
+			})
+		})
+	})
+})

internal/component/artifactory.go

@@ -311,7 +311,7 @@ func (ars *ArtifactoryReleaseSource) UploadRelease(spec cargo.BOSHReleaseTarball
 	switch response.StatusCode {
 	case http.StatusCreated:
 	default:
-		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf(response.Status)
+		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("response contained errror status code: %d %s", response.StatusCode, response.Status)
 	}
 
 	return cargo.BOSHReleaseTarballLock{

internal/test/testdata/happy-tile/go.mod

@@ -1,6 +1,6 @@
 module github.com/pivotal-cf/kiln/internal/commands/testdata/tas_fake/tas
 
-go 1.20
+go 1.22.6
 
 require (
 	github.com/onsi/ginkgo v1.16.4

pkg/cargo/validate.go

@@ -3,13 +3,51 @@ package cargo
 import (
 	"fmt"
 	"slices"
+	"text/template/parse"
 
 	"github.com/Masterminds/semver/v3"
 )
 
-func Validate(spec Kilnfile, lock KilnfileLock) []error {
+type ValidationOptions struct {
+	resourceTypeAllowList []string
+}
+
+func NewValidateOptions() ValidationOptions {
+	return ValidationOptions{}
+}
+
+// ValidateResourceTypeAllowList calls ValidationOptions.SetValidateResourceTypeAllowList on the result of NewValidateOptions
+func ValidateResourceTypeAllowList(allowList ...string) ValidationOptions {
+	return NewValidateOptions().SetValidateResourceTypeAllowList(allowList)
+}
+
+func (o ValidationOptions) SetValidateResourceTypeAllowList(allowList []string) ValidationOptions {
+	o.resourceTypeAllowList = allowList
+	return o
+}
+
+func mergeOptions(options []ValidationOptions) ValidationOptions {
+	var opt ValidationOptions
+	for _, o := range options {
+		if o.resourceTypeAllowList != nil {
+			opt.resourceTypeAllowList = o.resourceTypeAllowList
+		}
+	}
+	return opt
+}
+
+func Validate(spec Kilnfile, lock KilnfileLock, options ...ValidationOptions) []error {
+	opt := mergeOptions(options)
 	var result []error
 
+	if len(opt.resourceTypeAllowList) > 0 {
+		for _, s := range spec.ReleaseSources {
+			if !slices.Contains(opt.resourceTypeAllowList, s.Type) {
+				result = append(result, fmt.Errorf("release source type not allowed: %s", s.Type))
+			}
+		}
+	}
+
 	for index, componentSpec := range spec.Releases {
 		if componentSpec.Name == "" {
 			result = append(result, fmt.Errorf("release at index %d missing name in spec", index))
@@ -43,6 +81,7 @@ func Validate(spec Kilnfile, lock KilnfileLock) []error {
 	}
 
 	result = append(result, ensureRemoteSourceExistsForEachReleaseLock(spec, lock)...)
+	result = append(result, ensureReleaseSourceConfiguration(spec.ReleaseSources)...)
 
 	if len(result) > 0 {
 		return result
@@ -51,6 +90,64 @@ func Validate(spec Kilnfile, lock KilnfileLock) []error {
 	return nil
 }
 
+func ensureReleaseSourceConfiguration(sources []ReleaseSourceConfig) []error {
+	var errs []error
+	for _, source := range sources {
+		switch source.Type {
+		case BOSHReleaseTarballSourceTypeArtifactory:
+			if source.ArtifactoryHost == "" {
+				errs = append(errs, fmt.Errorf("missing required field artifactory_host"))
+			}
+			if source.Username == "" {
+				errs = append(errs, fmt.Errorf("missing required field username"))
+			}
+			if source.Password == "" {
+				errs = append(errs, fmt.Errorf("missing required field password"))
+			}
+			if source.Repo == "" {
+				errs = append(errs, fmt.Errorf("missing required field repo"))
+			}
+			if source.PathTemplate == "" {
+				errs = append(errs, fmt.Errorf("missing required field path_template"))
+			} else {
+				p := parse.New("path_template")
+				p.Mode |= parse.SkipFuncCheck
+				if _, err := p.Parse(source.PathTemplate, "", "", make(map[string]*parse.Tree)); err != nil {
+					errs = append(errs, fmt.Errorf("failed to parse path_template: %w", err))
+				}
+			}
+			if source.Bucket != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field bucket"))
+			}
+			if source.Region != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field region"))
+			}
+			if source.AccessKeyId != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field access_key_id"))
+			}
+			if source.SecretAccessKey != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field secret_access_key"))
+			}
+			if source.RoleARN != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field role_arn"))
+			}
+			if source.Endpoint != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field endpoint"))
+			}
+			if source.Org != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field org"))
+			}
+			if source.GithubToken != "" {
+				errs = append(errs, fmt.Errorf("artifactory has unexpected field github_token"))
+			}
+		case BOSHReleaseTarballSourceTypeBOSHIO:
+		case BOSHReleaseTarballSourceTypeS3:
+		case BOSHReleaseTarballSourceTypeGithub:
+		}
+	}
+	return errs
+}
+
 func ensureRemoteSourceExistsForEachReleaseLock(spec Kilnfile, lock KilnfileLock) []error {
 	var result []error
 	for _, release := range lock.Releases {