fix: Audit 10/14 (#2183)

* Test interactive.

* Add new field.

* chore: Release

* Fix test utils.

* chore: Release

* Fix ci check.

* Add optional glob.

* Update JS.

* Remove debug.

* Bump.

Author: milesj

.yarn/versions/afdd9a82.yml

@@ -0,0 +1,15 @@
+releases:
+  '@moonrepo/cli': patch
+  '@moonrepo/core-linux-arm64-gnu': patch
+  '@moonrepo/core-linux-arm64-musl': patch
+  '@moonrepo/core-linux-x64-gnu': patch
+  '@moonrepo/core-linux-x64-musl': patch
+  '@moonrepo/core-macos-arm64': patch
+  '@moonrepo/core-macos-x64': patch
+  '@moonrepo/core-windows-x64-msvc': patch
+  '@moonrepo/types': patch
+
+declined:
+  - '@moonrepo/report'
+  - '@moonrepo/runtime'
+  - website

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## Unreleased
+
+#### 🚀 Updates
+
+- Added an `optional` parameter to task glob outputs.
+- **WASM API**
+  - Added `ParseManifestInput.root` and `ParseLockInput.root` fields.
+
+#### 🧰 Toolchains
+
+- **JavaScript**
+  - Added support for Bun v1.3 `package.json` catalogs.
+  - Updated `parse_manifest` to resolve versions from applicable catalogs.
+
+#### 🐞 Fixes
+
+- Fixed an issue where interactive tasks would constantly print the "running for" message.
+- Fixed an issue where touched files that were not staged would not be included in the
+  affected/hashing calculation in CI.
+
 ## 1.41.4
 
 #### 🐞 Fixes

Cargo.lock

@@ -339,6 +339,7 @@ async fn hash_manifest_contents<'action>(
     for manifest_path in manifest_paths {
         let app_context = Arc::clone(app_context);
         let toolchain = Arc::clone(toolchain);
+        let deps_root = deps_root.to_owned();
 
         if let Ok(rel_path) = manifest_path.relative_to(&app_context.workspace_root) {
             hash_content.manifest_paths.insert(rel_path);
@@ -349,6 +350,7 @@ async fn hash_manifest_contents<'action>(
                 .parse_manifest(ParseManifestInput {
                     context: app_context.toolchain_registry.create_context(),
                     path: toolchain.to_virtual_path(manifest_path),
+                    root: toolchain.to_virtual_path(deps_root),
                 })
                 .await
         }));

crates/actions/src/actions/install_dependencies.rs

@@ -52,19 +52,32 @@ config_struct!(
     pub struct GlobOutput {
         /// The glob pattern.
         pub glob: GlobPath,
+
+        /// Mark the file as optional instead of failing with
+        /// an error after running a task and the output doesn't exist.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        pub optional: Option<bool>,
     }
 );
 
 generate_io_glob_methods!(GlobOutput);
 
 impl GlobOutput {
     pub fn from_uri(uri: Uri) -> Result<Self, ParseError> {
-        let output = Self {
+        let mut output = Self {
             glob: GlobPath::parse(uri.path.replace("__QM__", "?"))?,
+            optional: None,
         };
 
-        if let Some((key, _)) = uri.query.into_iter().next() {
-            return Err(ParseError::new(format!("unknown glob field `{key}`")));
+        for (key, value) in uri.query {
+            match key.as_str() {
+                "optional" => {
+                    output.optional = Some(parse_bool_field(&key, &value)?);
+                }
+                _ => {
+                    return Err(ParseError::new(format!("unknown glob field `{key}`")));
+                }
+            };
         }
 
         Ok(output)
@@ -114,6 +127,14 @@ impl Output {
     pub fn is_glob(&self) -> bool {
         matches!(self, Self::Glob(_))
     }
+
+    pub fn is_optional(&self) -> bool {
+        match self {
+            Output::File(value) => value.optional.unwrap_or_default(),
+            Output::Glob(value) => value.optional.unwrap_or_default(),
+            _ => false,
+        }
+    }
 }
 
 impl FromStr for Output {

crates/config/src/shapes/output.rs

@@ -154,7 +154,7 @@ impl ToolchainConfig {
             )),
             "unstable_javascript" => Some(find_debug_locator_with_url_fallback(
                 "javascript_toolchain",
-                "0.2.1",
+                "0.2.2",
             )),
             "unstable_go" => Some(find_debug_locator_with_url_fallback(
                 "go_toolchain",

crates/config/src/toolchain_config.rs

@@ -156,6 +156,14 @@ mod output_shape {
                 Output::parse("glob:///file.*").unwrap(),
                 Output::Glob(stub_glob_output("/file.*"))
             );
+
+            let mut output = stub_glob_output("/file.*");
+            output.optional = Some(true);
+
+            assert_eq!(
+                Output::parse("glob:///file.*?optional").unwrap(),
+                Output::Glob(output)
+            );
         }
 
         #[test]
@@ -175,6 +183,7 @@ mod output_shape {
                 assert_eq!(
                     Output::Glob(GlobOutput {
                         glob: GlobPath(pat.into()),
+                        optional: None,
                     }),
                     Output::Glob(stub_glob_output(pat))
                 );

crates/config/tests/output_shape_test.rs

@@ -1,6 +1,6 @@
 [package]
 name = "moon_pdk_api"
-version = "0.4.0"
+version = "0.4.1"
 edition = "2024"
 license = "MIT"
 description = "Core APIs for creating moon WASM plugins."

crates/pdk-api/Cargo.toml

@@ -163,6 +163,10 @@ api_struct!(
 
         /// Virtual path to the manifest file.
         pub path: VirtualPath,
+
+        /// Virtual path to the dependencies root. This is where
+        /// the lockfile and root manifest should exist.
+        pub root: VirtualPath,
     }
 );
 
@@ -293,8 +297,12 @@ api_struct!(
         /// Current moon context.
         pub context: MoonContext,
 
-        /// Virtual path to the lock file.
+        /// Virtual path to the lockfile.
         pub path: VirtualPath,
+
+        /// Virtual path to the dependencies root. This is where
+        /// the lockfile and root manifest should exist.
+        pub root: VirtualPath,
     }
 );
 
@@ -309,7 +317,7 @@ api_struct!(
 );
 
 api_struct!(
-    /// Represents a dependency definition in a lock file.
+    /// Represents a dependency definition in a lockfile.
     #[serde(default)]
     pub struct LockDependency {
         /// A unique hash: checksum, integrity, etc.

crates/pdk-api/src/toolchain/tier2.rs

@@ -1,6 +1,6 @@
 [package]
 name = "moon_pdk_test_utils"
-version = "0.4.1"
+version = "0.4.2"
 edition = "2024"
 license = "MIT"
 description = "Utilities for testing moon WASM plugins."
@@ -9,7 +9,7 @@ repository = "https://github.com/moonrepo/moon"
 publish = true
 
 [dependencies]
-moon_pdk_api = { version = "0.4.0", path = "../pdk-api" }
+moon_pdk_api = { version = "0.4.1", path = "../pdk-api" }
 moon_target = { version = "0.2.0", path = "../target" }
 extism = { workspace = true }
 proto_core = { workspace = true }