mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-10 16:05:58 +00:00
Ruben FiszelandClaude Opus 4.8
28966bdbf1
* fix(frontend): use curl fallback for +Variable/+Resource in bash sandbox mode When a bash script uses `# sandbox <image>` or `# docker`, the body runs inside a custom container image that does not have the `wmill` CLI installed, so the `wmill variable get` / `wmill resource get` snippets inserted by the +Variable and +Resource pickers fail. Detect `# sandbox`/`# docker` in the editor code and insert a curl-based snippet using the BASE_INTERNAL_URL, WM_TOKEN and WM_WORKSPACE env vars (available in sandbox) instead. Fixes WIN-2215 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(frontend): mirror worker grammar and use curl/wget fallback in sandbox mode Address review of the bash sandbox picker fallback: - Extract detection into `bashRunsInCustomImage`, mirroring the worker's BashAnnotations grammar (leading comment lines only; `# sandbox <image>` or bare `# docker`). A bare `# sandbox` is the nsjail-bash modifier that still runs on the worker rootfs where `wmill` is available, so it now correctly keeps the `wmill` snippet. This also fixes the substring false positives (`# sandboxed`, `# docker` in prose/body) and false negatives (`#sandbox <image>`). - The default `# sandbox alpine:latest` image ships busybox `wget`, not `curl`, so the snippet now tries `curl` then falls back to `wget`. - `variables/get_value` returns a JSON-quoted string; strip the outer quotes with `sed` so the sandbox snippet matches the `jq -r .value` output of the non-sandbox branch. Resources return JSON either way. - Add focused unit tests for the detection grammar. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
44 lines
1.8 KiB
TypeScript
44 lines
1.8 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import { bashRunsInCustomImage } from './script_helpers'
|
|
|
|
// bashRunsInCustomImage decides whether the +Variable/+Resource pickers insert a
|
|
// curl/wget snippet (custom image, no wmill CLI) or the wmill CLI snippet. It must
|
|
// stay in sync with the worker's BashAnnotations grammar
|
|
// (backend/windmill-common/src/worker.rs): leading comment lines only, `# sandbox
|
|
// <image>` or bare `# docker` select a container; a bare `# sandbox` does not.
|
|
|
|
describe('bashRunsInCustomImage', () => {
|
|
it('true for `# sandbox <image>` (spaced and compact)', () => {
|
|
expect(bashRunsInCustomImage('# sandbox alpine:latest\necho hi')).toBe(true)
|
|
expect(bashRunsInCustomImage('#sandbox python:3.12-slim\n')).toBe(true)
|
|
})
|
|
|
|
it('true for a bare `# docker` annotation', () => {
|
|
expect(bashRunsInCustomImage('# docker\necho hi')).toBe(true)
|
|
})
|
|
|
|
it('true when the sandbox line follows other leading comments (default template)', () => {
|
|
expect(bashRunsInCustomImage('# shellcheck shell=bash\n# sandbox alpine:latest\necho hi')).toBe(
|
|
true
|
|
)
|
|
})
|
|
|
|
it('false for a bare `# sandbox` (nsjail-bash on the worker, wmill available)', () => {
|
|
expect(bashRunsInCustomImage('# sandbox\necho hi')).toBe(false)
|
|
})
|
|
|
|
it('false for prose comments that merely contain the words', () => {
|
|
expect(bashRunsInCustomImage('# sandboxed run below\necho hi')).toBe(false)
|
|
expect(bashRunsInCustomImage('# runs in a docker container\necho hi')).toBe(false)
|
|
})
|
|
|
|
it('false when the annotation is not on a leading comment line', () => {
|
|
expect(bashRunsInCustomImage('echo hi\n# sandbox alpine')).toBe(false)
|
|
expect(bashRunsInCustomImage('msg="$1" # docker')).toBe(false)
|
|
})
|
|
|
|
it('false for a plain script with no annotations', () => {
|
|
expect(bashRunsInCustomImage('# shellcheck shell=bash\necho hi')).toBe(false)
|
|
})
|
|
})
|