Sienna Meridian Satterwhite
6fec7dbab5
Secure JavaScript/TypeScript execution in workflow steps via deno_core, behind the `deno` feature flag. Security features: - Per-step permission system: net host allowlist, filesystem read/write path restrictions, env var allowlist, subprocess spawn control - V8 heap limits (64MB default) prevent memory exhaustion - Execution timeout with V8 isolate termination for sync infinite loops - Path traversal detection blocks ../ escape attempts - Dynamic import rejection unless explicitly enabled Workflow I/O ops: - inputs() — read workflow data as JSON - output(key, value) — set step outputs - log(message) — structured tracing Architecture: - JsRuntime runs on dedicated thread (V8 is !Send) - PermissionChecker enforced on every I/O op via OpState - DenoStep implements StepBody, integrates with existing compiler - Step type dispatch: "shell" or "deno" in YAML 34 new tests (12 permission unit, 3 config, 2 runtime, 18 integration).
59 lines
1.5 KiB
TOML
59 lines
1.5 KiB
TOML
[workspace]
|
|
members = ["wfe-core", "wfe-sqlite", "wfe-postgres", "wfe-opensearch", "wfe-valkey", "wfe", "wfe-yaml"]
|
|
resolver = "2"
|
|
|
|
[workspace.package]
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
license = "MIT"
|
|
|
|
[workspace.dependencies]
|
|
# Core
|
|
tokio = { version = "1", features = ["full"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
async-trait = "0.1"
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
thiserror = "2"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
tracing-opentelemetry = "0.28"
|
|
opentelemetry = "0.27"
|
|
opentelemetry_sdk = { version = "0.27", features = ["rt-tokio"] }
|
|
opentelemetry-otlp = { version = "0.27", features = ["tonic"] }
|
|
|
|
# HTTP
|
|
reqwest = { version = "0.12", features = ["json"] }
|
|
|
|
# Persistence
|
|
sqlx = { version = "0.8", features = ["runtime-tokio", "tls-rustls", "sqlite", "postgres", "chrono", "uuid", "json"] }
|
|
|
|
# Redis/Valkey
|
|
redis = { version = "0.27", features = ["tokio-comp", "connection-manager"] }
|
|
|
|
# Search
|
|
opensearch = "2"
|
|
|
|
# Internal crates
|
|
wfe-core = { path = "wfe-core" }
|
|
wfe-sqlite = { path = "wfe-sqlite" }
|
|
wfe-postgres = { path = "wfe-postgres" }
|
|
wfe-opensearch = { path = "wfe-opensearch" }
|
|
wfe-valkey = { path = "wfe-valkey" }
|
|
wfe-yaml = { path = "wfe-yaml" }
|
|
|
|
# YAML
|
|
serde_yaml = "0.9"
|
|
regex = "1"
|
|
|
|
# Deno runtime
|
|
deno_core = "0.394"
|
|
url = "2"
|
|
|
|
# Dev/Test
|
|
pretty_assertions = "1"
|
|
rstest = "0.23"
|
|
wiremock = "0.6"
|
|
tokio-stream = "0.1"
|