Sienna Meridian Satterwhite
6fec7dbab5
Secure JavaScript/TypeScript execution in workflow steps via deno_core, behind the `deno` feature flag. Security features: - Per-step permission system: net host allowlist, filesystem read/write path restrictions, env var allowlist, subprocess spawn control - V8 heap limits (64MB default) prevent memory exhaustion - Execution timeout with V8 isolate termination for sync infinite loops - Path traversal detection blocks ../ escape attempts - Dynamic import rejection unless explicitly enabled Workflow I/O ops: - inputs() — read workflow data as JSON - output(key, value) — set step outputs - log(message) — structured tracing Architecture: - JsRuntime runs on dedicated thread (V8 is !Send) - PermissionChecker enforced on every I/O op via OpState - DenoStep implements StepBody, integrates with existing compiler - Step type dispatch: "shell" or "deno" in YAML 34 new tests (12 permission unit, 3 config, 2 runtime, 18 integration).
30 lines
810 B
TOML
30 lines
810 B
TOML
[package]
|
|
name = "wfe-yaml"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
description = "YAML workflow definitions for WFE"
|
|
|
|
[features]
|
|
default = []
|
|
deno = ["deno_core", "url"]
|
|
|
|
[dependencies]
|
|
wfe-core = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
serde_yaml = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
tokio = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tracing = { workspace = true }
|
|
regex = { workspace = true }
|
|
deno_core = { workspace = true, optional = true }
|
|
url = { workspace = true, optional = true }
|
|
|
|
[dev-dependencies]
|
|
pretty_assertions = { workspace = true }
|
|
tokio = { workspace = true, features = ["test-util", "process"] }
|
|
tokio-util = "0.7"
|
|
wfe-core = { workspace = true, features = ["test-support"] }
|
|
wfe = { path = "../wfe" }
|