Plugins

exec

This plugin runs a program on the runner.

  exec.run(program, { args, input, env, dir, timeout, as })   gives { status, out, err }

program is a name on the runner's PATH, or a path. A path with no leading / is in the job's scratch directory (Scripts).

Options:

argsa list of text, numbers and handles to secrets (secrets) inputstdin: text, bytes, a blob or a handle enva map of text and handles; the program gets these variables and PATH, and no others dirthe working directory; default the job's scratch directory timeoutseconds, or text such as "30s"; default 1m asthe form of out: "text", "bytes", "json" or "blob"; default "text"

Returns:

statusthe exit code; a code other than 0 is not an error outstdout: at most 64 MiB, or a blob of any size (blobs) errstderr, as text: at most 64 MiB

Errors:

not_foundthe program is not found, or cannot be started timeoutthe program ran past timeout bad_inputout or err is over 64 MiB

Needs these permissions:

exec:programthe program fs.read:paththe directory given as dir secret:NAME@exec:programa secret sent to the program

The program runs as the runner's user, and Corbie does not limit what it does.

This script reads stdout as a blob, and writes a blob to a file for a program.

allow: [exec:pg_dump, exec:pdftotext, fs.write:in.pdf, fs.read:out.txt]

const dump = exec.run("pg_dump", { args: ["shop"], as: "blob" }).out

const document = blobs.make("%PDF A short document.", { type: "application/pdf" })
fs.write("in.pdf", { blob: document })                   // a blob into the scratch directory
exec.run("pdftotext", { args: ["in.pdf", "out.txt"] })
return { dump, text: blobs.file("out.txt") }             // and a file out of it

This script runs git in a directory and checks its exit code.

allow: [exec:git, fs.read:/srv/repo]

const made = exec.run("git", { args: ["log", "--oneline", "-5"], dir: "/srv/repo" })
if (made.status !== 0) throw new Error(made.err)
return made.out.trim().split("\n").length                // gives 5

This script sends a secret to a program in an environment variable.

allow: [exec:deploy, "secret:DEPLOY_TOKEN@exec:deploy"]

const sent = exec.run("deploy", { args: ["site"], env: { DEPLOY_TOKEN: secrets.get("DEPLOY_TOKEN") } })
return sent.out                                          // gives "deployed site\n"