chore: high severity vulnerability

Reviewed-on: #9

.gitignore

@@ -34,3 +34,4 @@ lerna-debug.log*
 !.vscode/extensions.json
 
 /config.yml
+tsconfig.build.tsbuildinfo

.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": []
+}

config.yml.example

@@ -16,5 +16,9 @@ db:
     prefix: fennec
   rabbitmq:
     uri: 'amqp://fennec:fennec@192.168.31.194:5672'
+  etcd:
+    hosts:
+      - 'http://192.168.31.194:2379'
+
 workspaces:
   root: '/Users/ivanli/Projects/fennec/workspaces'

ecosystem.config.js

@@ -0,0 +1,14 @@
+module.exports = {
+  apps: [
+    {
+      name: 'fennec-be',
+      script: 'npm',
+      args: 'run start:prod',
+      watch: false,
+      ignore_watch: ['node_modules'],
+      log_date_format: 'MM-DD HH:mm:ss.SSS Z',
+      env: {},
+      max_restarts: 5,
+    },
+  ],
+};

package.json

@@ -1,8 +1,8 @@
 {
   "name": "fennec-be",
-  "version": "0.1.0",
-  "description": "",
-  "author": "",
+  "version": "0.1.1",
+  "description": "a ci/cd project.",
+  "author": "Ivan Li\b<ivanli2048@gmail.com>",
   "private": true,
   "license": "UNLICENSED",
   "scripts": {
@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@golevelup/nestjs-rabbitmq": "^1.16.1",
-    "@nestjs/bull": "^0.3.1",
+    "@nestjs-lib/auth": "^0.2.1",
     "@nestjs/common": "^7.5.1",
     "@nestjs/config": "^0.6.2",
     "@nestjs/core": "^7.5.1",
@@ -30,24 +30,25 @@
     "@nestjs/platform-express": "^7.5.1",
     "@nestjs/typeorm": "^7.1.5",
     "@types/amqplib": "^0.8.0",
-    "@types/bull": "^3.15.0",
     "@types/ramda": "^0.27.38",
     "apollo-server-express": "^2.19.2",
     "bcrypt": "^5.0.0",
     "body-parser": "^1.19.0",
-    "bull": "^3.20.1",
     "class-transformer": "^0.3.2",
     "class-validator": "^0.13.1",
     "debug": "^4.3.1",
     "graphql": "^15.5.0",
-    "graphql-tools": "^7.0.2",
+    "graphql-tools": "^8.1.0",
     "ioredis": "^4.25.0",
+    "jose": "^3.14.0",
     "js-yaml": "^4.0.0",
+    "nestjs-etcd": "^0.2.0",
     "nestjs-pino": "^1.4.0",
     "nestjs-redis": "^1.2.8",
     "observable-to-async-generator": "^1.0.1-rc",
     "pg": "^8.5.1",
     "pino-pretty": "^4.7.1",
+    "pm2": "^5.1.0",
     "ramda": "^0.27.1",
     "reflect-metadata": "^0.1.13",
     "rimraf": "^3.0.2",
@@ -56,7 +57,7 @@
     "typeorm": "^0.2.30"
   },
   "devDependencies": {
-    "@nestjs/cli": "^7.5.7",
+    "@nestjs/cli": "^7.6.0",
     "@nestjs/schematics": "^7.1.3",
     "@nestjs/testing": "^7.5.1",
     "@types/body-parser": "^1.19.0",
@@ -96,6 +97,9 @@
     "collectCoverageFrom": [
       "**/*.(t|j)s"
     ],
+    "moduleNameMapper": {
+      "^jose/(.*)$": "<rootDir>/../node_modules/jose/dist/node/cjs/$1"
+    },
     "coverageDirectory": "../coverage",
     "testEnvironment": "node"
   }

src/app.module.ts

@@ -1,3 +1,4 @@
+import { CommonsModule } from './commons/commons.module';
 import { MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { GraphQLModule } from '@nestjs/graphql';
@@ -12,13 +13,13 @@ import { PipelineTasksModule } from './pipeline-tasks/pipeline-tasks.module';
 import configuration from './commons/config/configuration';
 import { RedisModule } from 'nestjs-redis';
 import { WebhooksModule } from './webhooks/webhooks.module';
-import { RawBodyMiddleware } from './commons/middlewares/raw-body.middleware';
+import { RawBodyMiddleware } from './commons/middleware/raw-body.middleware';
 import { GiteaWebhooksController } from './webhooks/gitea-webhooks.controller';
-import { ParseBodyMiddleware } from './commons/middlewares/parse-body.middleware';
-import { BullModule } from '@nestjs/bull';
+import { ParseBodyMiddleware } from './commons/middleware/parse-body.middleware';
 import { LoggerModule } from 'nestjs-pino';
-
+import { EtcdModule } from 'nestjs-etcd';
 import pinoPretty from 'pino-pretty';
+import { fromPairs, map, pipe, toPairs } from 'ramda';
 
 @Module({
   imports: [
@@ -63,16 +64,21 @@ import pinoPretty from 'pino-pretty';
         playground: true,
         autoSchemaFile: true,
         installSubscriptionHandlers: true,
-      }),
-      inject: [ConfigService],
-    }),
-    BullModule.forRootAsync({
-      imports: [ConfigModule],
-      useFactory: (configService: ConfigService) => ({
-        redis: {
-          host: configService.get<string>('db.redis.host', 'localhost'),
-          port: configService.get<number>('db.redis.port', undefined),
-          password: configService.get<string>('db.redis.password', undefined),
+        context: ({ req, connection, ...args }) => {
+          return connection ? { req: connection.context } : { req };
+        },
+        subscriptions: {
+          onConnect: (connectionParams: Record<string, string>) => {
+            const connectionParamsWithLowerKeys = pipe(
+              toPairs,
+              map(([key, value]) => [key.toLowerCase(), value]),
+              fromPairs,
+            )(connectionParams);
+
+            return {
+              headers: connectionParamsWithLowerKeys,
+            };
+          },
         },
       }),
       inject: [ConfigService],
@@ -91,7 +97,15 @@ import pinoPretty from 'pino-pretty';
       }),
       inject: [ConfigService],
     }),
+    EtcdModule.forRootAsync({
+      imports: [ConfigModule],
+      useFactory: (configService: ConfigService) => ({
+        hosts: configService.get<string>('db.etcd.hosts', 'localhost:2379'),
+      }),
+      inject: [ConfigService],
+    }),
     WebhooksModule,
+    CommonsModule,
   ],
   controllers: [AppController],
   providers: [AppService, AppResolver],

src/commons/commons.module.ts

@@ -1,10 +1,11 @@
 import { Module } from '@nestjs/common';
 import { PasswordConverter } from './services/password-converter';
 import { RedisMutexModule } from './redis-mutex/redis-mutex.module';
+import { AuthModule } from '@nestjs-lib/auth';
 
 @Module({
+  imports: [RedisMutexModule, AuthModule],
   providers: [PasswordConverter],
-  exports: [PasswordConverter, RedisMutexModule],
-  imports: [RedisMutexModule],
+  exports: [PasswordConverter, RedisMutexModule, AuthModule],
 })
 export class CommonsModule {}

src/commons/filters/all.exception-filter.ts

@@ -6,13 +6,18 @@ import {
   HttpStatus,
 } from '@nestjs/common';
 import { ApolloError } from 'apollo-server-errors';
+import { PinoLogger, InjectPinoLogger } from 'nestjs-pino';
 
 @Catch(HttpException)
 export class HttpExceptionFilter implements ExceptionFilter {
+  constructor(
+    @InjectPinoLogger(HttpExceptionFilter.name)
+    private readonly logger: PinoLogger,
+  ) {}
   catch(exception: HttpException, host: ArgumentsHost) {
     switch (host.getType<'http' | 'graphql' | string>()) {
       case 'graphql': {
-        const message = exception.message;
+        const errorName = exception.message;
         const extensions: Record<string, any> = {};
         const err = exception.getResponse();
         if (typeof err === 'string') {
@@ -21,8 +26,10 @@ export class HttpExceptionFilter implements ExceptionFilter {
           Object.assign(extensions, (err as any).extension);
           extensions.message = (err as any).message;
         }
+        extensions.error = errorName;
+        this.logger.error(extensions);
         return new ApolloError(
-          message,
+          extensions.message,
           exception.getStatus().toString(),
           extensions,
         );

src/commons/redis-mutex/redis-mutex.service.spec.ts

@@ -1,4 +1,5 @@
 import { Test, TestingModule } from '@nestjs/testing';
+import { RedisService } from 'nestjs-redis';
 import { RedisMutexService } from './redis-mutex.service';
 
 describe('RedisMutexService', () => {
@@ -6,7 +7,13 @@ describe('RedisMutexService', () => {
 
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
-      providers: [RedisMutexService],
+      providers: [
+        RedisMutexService,
+        {
+          provide: RedisService,
+          useValue: {},
+        },
+      ],
     }).compile();
 
     service = module.get<RedisMutexService>(RedisMutexService);

src/main.ts

@@ -1,3 +1,4 @@
+import { PinoLogger } from 'nestjs-pino';
 import { ValidationPipe } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { NestFactory } from '@nestjs/core';
@@ -14,7 +15,8 @@ async function bootstrap() {
       transform: true,
     }),
   );
-  app.useGlobalFilters(new HttpExceptionFilter());
+  const httpExceptionFilterLogger = await app.resolve(PinoLogger);
+  app.useGlobalFilters(new HttpExceptionFilter(httpExceptionFilterLogger));
   await app.listen(configService.get<number>('http.port'));
 }
 bootstrap();

src/pipeline-tasks/models/work-unit-metadata.model.ts

@@ -1,4 +1,6 @@
 import { Field, InputType, Int, ObjectType } from '@nestjs/graphql';
+import { Type } from 'class-transformer';
+import { IsInstance, isInstance, ValidateNested } from 'class-validator';
 import { WorkUnit } from './work-unit.model';
 
 @InputType('WorkUnitMetadataInput')
@@ -6,5 +8,9 @@ import { WorkUnit } from './work-unit.model';
 export class WorkUnitMetadata {
   @Field(() => Int)
   version = 1;
+
+  @Type(() => WorkUnit)
+  @IsInstance(WorkUnit, { each: true })
+  @ValidateNested({ each: true })
   units: WorkUnit[];
 }

src/pipeline-tasks/models/work-unit.model.ts

@@ -1,4 +1,5 @@
 import { Field, InputType, ObjectType } from '@nestjs/graphql';
+import { IsNotEmpty } from 'class-validator';
 import {
   PipelineUnits,
   PipelineUnits as PipelineUnitTypes,
@@ -9,5 +10,7 @@ import {
 export class WorkUnit {
   @Field(() => PipelineUnits)
   type: PipelineUnitTypes;
+
+  @IsNotEmpty({ each: true })
   scripts: string[];
 }

src/pipeline-tasks/pipeline-task.logger.spec.ts

@@ -42,9 +42,9 @@ describe('PipelineTaskRunner', () => {
       setTimeout(() => {
         logger.handleEvent(event);
       });
-      expect(message$.pipe(take(1), timeout(100)).toPromise()).rejects.toMatch(
-        'timeout',
-      );
+      await expect(
+        message$.pipe(take(1), timeout(100)).toPromise(),
+      ).rejects.toThrow(/timeout/i);
     });
     it('multiple subscribers', async () => {
       const event = new PipelineTaskEvent();
@@ -53,13 +53,16 @@ describe('PipelineTaskRunner', () => {
       const message2$ = logger.getMessage$('test');
       setTimeout(() => {
         logger.handleEvent(event);
+        logger.handleEvent(event);
       });
-      expect(message$.pipe(take(1), timeout(100)).toPromise()).resolves.toEqual(
-        event,
-      );
+      await Promise.all([
+        expect(
+          message$.pipe(take(1), timeout(100)).toPromise(),
+        ).resolves.toEqual(event),
         expect(
           message2$.pipe(take(1), timeout(100)).toPromise(),
-      ).resolves.toEqual(event);
+        ).resolves.toEqual(event),
+      ]);
     });
   });
 

src/pipeline-tasks/pipeline-task.logger.ts

@@ -13,7 +13,8 @@ import {
 @Injectable()
 export class PipelineTaskLogger implements OnModuleDestroy {
   private readonly messageSubject = new Subject<PipelineTaskEvent>();
-  private readonly message$: Observable<PipelineTaskEvent> = this.messageSubject.pipe();
+  private readonly message$: Observable<PipelineTaskEvent> =
+    this.messageSubject.pipe();
 
   @RabbitSubscribe({
     exchange: EXCHANGE_PIPELINE_TASK_FANOUT,

src/pipeline-tasks/pipeline-task.runner.spec.ts

@@ -1,3 +1,4 @@
+import { DeployByPm2Service } from './runners/deploy-by-pm2/deploy-by-pm2.service';
 import { Test, TestingModule } from '@nestjs/testing';
 import { ReposService } from '../repos/repos.service';
 import { PipelineUnits } from './enums/pipeline-units.enum';
@@ -11,7 +12,7 @@ import { WorkUnitMetadata } from './models/work-unit-metadata.model';
 import { AmqpConnection } from '@golevelup/nestjs-rabbitmq';
 describe('PipelineTaskRunner', () => {
   let runner: PipelineTaskRunner;
-  let reposService: ReposService;
+  let deployByPM2Service: DeployByPm2Service;
 
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
@@ -36,11 +37,18 @@ describe('PipelineTaskRunner', () => {
           provide: AmqpConnection,
           useValue: {},
         },
+        {
+          provide: DeployByPm2Service,
+          useValue: {
+            deploy: () => Promise.resolve(),
+          },
+        },
       ],
     }).compile();
 
-    reposService = module.get(ReposService);
+    module.get(ReposService);
     runner = module.get(PipelineTaskRunner);
+    deployByPM2Service = module.get(DeployByPm2Service);
   });
 
   it('should be defined', () => {
@@ -65,7 +73,7 @@ describe('PipelineTaskRunner', () => {
     beforeEach(() => {
       emitEvent = jest
         .spyOn(runner, 'emitEvent')
-        .mockImplementation((..._) => Promise.resolve());
+        .mockImplementation(() => Promise.resolve());
     });
 
     describe('doTask', () => {
@@ -75,10 +83,10 @@ describe('PipelineTaskRunner', () => {
       beforeEach(() => {
         checkout = jest
           .spyOn(runner, 'checkout')
-          .mockImplementation((..._) => Promise.resolve('/null'));
+          .mockImplementation(() => Promise.resolve('/null'));
         doTaskUnit = jest
           .spyOn(runner, 'doTaskUnit')
-          .mockImplementation((..._) => Promise.resolve());
+          .mockImplementation(() => Promise.resolve());
       });
 
       it('only checkout', async () => {
@@ -145,7 +153,7 @@ describe('PipelineTaskRunner', () => {
         await runner.doTask(task);
 
         expect(checkout).toBeCalledTimes(1);
-        expect(doTaskUnit).toBeCalledTimes(2);
+        expect(doTaskUnit).toBeCalledTimes(1);
         expect(emitEvent).toBeCalledTimes(2);
       });
 
@@ -171,9 +179,7 @@ describe('PipelineTaskRunner', () => {
 
         doTaskUnit = jest
           .spyOn(runner, 'doTaskUnit')
-          .mockImplementation((..._) =>
-            Promise.reject(new Error('test error')),
-          );
+          .mockImplementation(() => Promise.reject(new Error('test error')));
         await runner.doTask(task);
 
         expect(checkout).toBeCalledTimes(1);
@@ -189,7 +195,7 @@ describe('PipelineTaskRunner', () => {
       it('success', async () => {
         const runScript = jest
           .spyOn(runner, 'runScript')
-          .mockImplementation((..._) => Promise.resolve());
+          .mockImplementation(() => Promise.resolve());
         const task = new PipelineTask();
 
         const unit = PipelineUnits.test;
@@ -210,9 +216,7 @@ describe('PipelineTaskRunner', () => {
       it('failed', async () => {
         const runScript = jest
           .spyOn(runner, 'runScript')
-          .mockImplementation((..._) =>
-            Promise.reject(new Error('test error')),
-          );
+          .mockImplementation(() => Promise.reject(new Error('test error')));
         const task = new PipelineTask();
 
         const unit = PipelineUnits.test;
@@ -230,7 +234,7 @@ describe('PipelineTaskRunner', () => {
 
     describe('runScript', () => {
       it('normal', async () => {
-        const spawn = jest.fn((..._: any[]) => ({
+        const spawn = jest.fn<any, any>(() => ({
           stdout: {
             on: () => undefined,
           },
@@ -256,7 +260,7 @@ describe('PipelineTaskRunner', () => {
         });
       });
       it('failed', async () => {
-        const spawn = jest.fn((..._: any[]) => ({
+        const spawn = jest.fn(() => ({
           stdout: {
             on: () => undefined,
           },
@@ -291,7 +295,7 @@ describe('PipelineTaskRunner', () => {
             }, 10);
           }, 10);
         });
-        const spawn = jest.fn((..._: any[]) => ({
+        const spawn = jest.fn(() => ({
           stdout: {
             on,
           },
@@ -304,7 +308,7 @@ describe('PipelineTaskRunner', () => {
         }));
 
         let emitSuccessCount = 0;
-        jest.spyOn(runner, 'emitEvent').mockImplementation((..._: any[]) => {
+        jest.spyOn(runner, 'emitEvent').mockImplementation(() => {
           return new Promise((resolve) => {
             setTimeout(() => {
               emitSuccessCount++;
@@ -323,4 +327,25 @@ describe('PipelineTaskRunner', () => {
       });
     });
   });
+
+  describe('tryRunDeployScript', () => {
+    it('should be call deploy with right args', async () => {
+      const deploy = jest.spyOn(deployByPM2Service, 'deploy');
+      await expect(
+        runner['tryRunDeployScript'](
+          '/test/dir',
+          '@@DEPLOY ecosystem.config.js',
+        ),
+      ).resolves.toBe(true);
+      expect(deploy.mock.calls[0][0]).toEqual('/test/dir/ecosystem.config.js');
+    });
+    it('should return false', async () => {
+      await expect(
+        runner['tryRunDeployScript'](
+          '/test/dir',
+          'pm2 start ecosystem.config.js',
+        ),
+      ).resolves.toBe(false);
+    });
+  });
 });

src/pipeline-tasks/pipeline-task.runner.ts

@@ -1,3 +1,4 @@
+import { DeployByPm2Service } from './runners/deploy-by-pm2/deploy-by-pm2.service';
 import { ReposService } from '../repos/repos.service';
 import { spawn, ChildProcessWithoutNullStreams } from 'child_process';
 import { PipelineTask } from './pipeline-task.entity';
@@ -27,6 +28,9 @@ import {
   getSelfInstanceQueueKey,
   getSelfInstanceRouteKey,
 } from '../commons/utils/rabbit-mq';
+import { rm } from 'fs/promises';
+import { rename } from 'fs/promises';
+import { join } from 'path';
 
 type Spawn = typeof spawn;
 
@@ -41,6 +45,7 @@ export class PipelineTaskRunner {
     @Inject('spawn')
     private readonly spawn: Spawn,
     private readonly amqpConnection: AmqpConnection,
+    private readonly deployByPM2Service: DeployByPm2Service,
   ) {}
   @RabbitSubscribe({
     exchange: 'new-pipeline-task',
@@ -110,7 +115,7 @@ export class PipelineTaskRunner {
 
     this.logger.info('running task [%s].', task.id);
     try {
-      const workspaceRoot = await this.checkout(task);
+      let workspaceRoot = await this.checkout(task);
       const units = task.units
         .filter((unit) => unit !== PipelineUnits.checkout)
         .map(
@@ -121,6 +126,22 @@ export class PipelineTaskRunner {
         );
       this.logger.info({ units }, 'begin run units.');
       for (const unit of units) {
+        if (unit.type === PipelineUnits.deploy) {
+          const oldRoot = workspaceRoot;
+          workspaceRoot = this.reposService.getDeployRoot(task);
+          if (oldRoot !== workspaceRoot) {
+            await rm(workspaceRoot, { force: true, recursive: true });
+            await rename(oldRoot, workspaceRoot);
+          }
+
+          await this.emitEvent(
+            task,
+            unit.type,
+            TaskStatuses.success,
+            `[deploy] change deploy folder content success`,
+            'stdout',
+          );
+        }
         await this.doTaskUnit(unit.type, unit.scripts, task, workspaceRoot);
       }
       await this.emitEvent(
@@ -213,6 +234,7 @@ export class PipelineTaskRunner {
         'checkout failed.',
         'stderr',
       );
+      throw err;
     }
   }
 
@@ -255,6 +277,9 @@ export class PipelineTaskRunner {
     unit: PipelineUnits,
   ): Promise<void> {
     await this.emitEvent(task, unit, TaskStatuses.working, script, 'stdin');
+    if (await this.tryRunDeployScript(workspaceRoot, script)) {
+      return;
+    }
     return new Promise((resolve, reject) => {
       const sub = this.spawn(script, {
         shell: true,
@@ -298,4 +323,17 @@ export class PipelineTaskRunner {
       });
     });
   }
+
+  private async tryRunDeployScript(workspaceRoot: string, script: string) {
+    const match = /^@@DEPLOY\s+(\S*)/.exec(script);
+    if (match) {
+      await this.deployByPM2Service.deploy(
+        join(workspaceRoot, match[1]),
+        workspaceRoot,
+      );
+      return true;
+    } else {
+      return false;
+    }
+  }
 }

src/pipeline-tasks/pipeline-tasks.constants.ts

@@ -7,3 +7,5 @@ export const ROUTE_PIPELINE_TASK_DONE = 'pipeline-task-done';
 export const QUEUE_PIPELINE_TASK_DONE = 'pipeline-task-done';
 export const ROUTE_PIPELINE_TASK_KILL = 'pipeline-task-kill';
 export const QUEUE_PIPELINE_TASK_KILL = 'pipeline-task-kill';
+
+export const PM2_TOKEN = Symbol('pm2-token');

src/pipeline-tasks/pipeline-tasks.module.ts

@@ -16,9 +16,12 @@ import {
 } from './pipeline-tasks.constants';
 import { PipelineTaskLogger } from './pipeline-task.logger';
 import { PipelineTaskFlushService } from './pipeline-task-flush.service';
+import { CommonsModule } from '../commons/commons.module';
+import { DeployByPm2Service } from './runners/deploy-by-pm2/deploy-by-pm2.service';
 
 @Module({
   imports: [
+    CommonsModule,
     TypeOrmModule.forFeature([PipelineTask, Pipeline]),
     RedisModule,
     ReposModule,
@@ -66,6 +69,7 @@ import { PipelineTaskFlushService } from './pipeline-task-flush.service';
       useValue: spawn,
     },
     PipelineTaskFlushService,
+    DeployByPm2Service,
   ],
   exports: [PipelineTasksService],
 })

src/pipeline-tasks/pipeline-tasks.resolver.spec.ts

@@ -1,3 +1,4 @@
+import { JwtService } from '@nestjs-lib/auth';
 import { Test, TestingModule } from '@nestjs/testing';
 import { PipelineTaskLogger } from './pipeline-task.logger';
 import { PipelineTasksResolver } from './pipeline-tasks.resolver';
@@ -18,6 +19,10 @@ describe('PipelineTasksResolver', () => {
           provide: PipelineTaskLogger,
           useValue: {},
         },
+        {
+          provide: JwtService,
+          useValue: {},
+        },
       ],
     }).compile();
 

src/pipeline-tasks/pipeline-tasks.resolver.ts

@@ -7,7 +7,9 @@ import { plainToClass } from 'class-transformer';
 import { PipelineTaskLogger } from './pipeline-task.logger';
 import { observableToAsyncIterable } from '@graphql-tools/utils';
 import { PipelineTaskEvent } from './models/pipeline-task-event';
+import { Roles, AccountRole } from '@nestjs-lib/auth';
 
+@Roles(AccountRole.admin, AccountRole.super)
 @Resolver()
 export class PipelineTasksResolver {
   constructor(

src/pipeline-tasks/runners/deploy-by-pm2/deploy-by-pm2.service.spec.ts

@@ -0,0 +1,117 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { getLoggerToken, PinoLogger } from 'nestjs-pino';
+import { join } from 'path';
+import { DeployByPm2Service } from './deploy-by-pm2.service';
+
+describe('DeployByPm2Service', () => {
+  let service: DeployByPm2Service;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        DeployByPm2Service,
+        {
+          provide: getLoggerToken(DeployByPm2Service.name),
+          useValue: new PinoLogger({
+            pinoHttp: {
+              level: 'silent',
+            },
+          }),
+        },
+      ],
+    }).compile();
+
+    service = module.get<DeployByPm2Service>(DeployByPm2Service);
+  });
+
+  it('should be defined', () => {
+    expect(service).toBeDefined();
+  });
+
+  describe('getAppsSn', () => {
+    it('should return right value', () => {
+      expect(
+        service['getAppsSn']([
+          { name: 'app' },
+          { name: 'app#4' },
+          { name: 'app#1' },
+        ]),
+      ).toEqual(4 + 1);
+    });
+    it('should return 1 when no match', () => {
+      expect(
+        service['getAppsSn']([
+          { name: 'bar' },
+          { name: 'foo#4' },
+          { name: 'foo#1' },
+        ]),
+      ).toEqual(4 + 1);
+    });
+  });
+
+  describe('filterOldApps', () => {
+    it('should return right value', () => {
+      expect(
+        service['filterOldApps'](
+          [{ name: 'app' }],
+          [
+            { name: 'app' },
+            { name: 'app#4' },
+            { name: 'foo#2' },
+            { name: 'bar' },
+          ],
+        ),
+      ).toEqual([{ name: 'app' }, { name: 'app#4' }]);
+    });
+    it('should return [] when no match', () => {
+      expect(
+        service['filterOldApps'](
+          [{ name: 'app' }],
+          [{ name: 'foo#2' }, { name: 'bar' }],
+        ),
+      ).toEqual([]);
+    });
+  });
+
+  describe('replaceAppName', () => {
+    it('should be replaced with right value', () => {
+      const getAppsSn = jest
+        .spyOn(service, 'getAppsSn' as any)
+        .mockImplementation(() => 1);
+      const options = [{ name: 'app' }, { name: 'foo' }];
+      service['replaceAppName'](options, []);
+      expect(options).toEqual([{ name: 'app#1' }, { name: 'foo#1' }]);
+      expect(getAppsSn).toBeCalledTimes(1);
+      expect(getAppsSn.mock.calls[0][0]).toEqual([]);
+    });
+  });
+
+  describe('deploy', () => {
+    it('should be success', async () => {
+      const filterOldApps = jest
+        .spyOn(service, 'filterOldApps' as any)
+        .mockImplementation(() => [{ name: 'app#1' }, { name: 'app#2' }]);
+      const replaceAppName = jest
+        .spyOn(service, 'replaceAppName' as any)
+        .mockImplementation((options) => (options[0].name = 'app#2'));
+      const stopApps = jest
+        .spyOn(service, 'stopApps' as any)
+        .mockImplementation(() => Promise.resolve());
+      await expect(
+        service['deploy'](
+          join(
+            __dirname,
+            '../../../../test/__mocks__/deploy-service/ecosystem.config.js',
+          ),
+          join(__dirname, '../../../../test/__mocks__/deploy-service'),
+        ),
+      ).resolves.toBeFalsy();
+      expect(filterOldApps).toBeCalledTimes(1);
+      expect(replaceAppName).toBeCalledTimes(1);
+      expect(stopApps).toBeCalledTimes(1);
+      stopApps.mockReset();
+
+      await service['stopApps']([{ name: 'app#2' }]);
+    }, 10_000);
+  });
+});

src/pipeline-tasks/runners/deploy-by-pm2/deploy-by-pm2.service.ts

@@ -0,0 +1,98 @@
+import { InjectPinoLogger, PinoLogger } from 'nestjs-pino';
+import { Injectable } from '@nestjs/common';
+import { promisify } from 'util';
+import * as pm2 from 'pm2';
+import { Proc, ProcessDescription, StartOptions } from 'pm2';
+import { clone, last } from 'ramda';
+
+@Injectable()
+export class DeployByPm2Service {
+  constructor(
+    @InjectPinoLogger(DeployByPm2Service.name)
+    private readonly logger: PinoLogger,
+  ) {}
+  async deploy(filePath: string, workspace: string) {
+    const baseConfig: { apps: StartOptions[] } = await import(filePath);
+    const appOptionsList: StartOptions[] = clone(baseConfig.apps);
+
+    await promisify<void>(pm2.connect.bind(pm2))();
+    const allApps = await promisify(pm2.list.bind(pm2))();
+    try {
+      if (!Array.isArray(baseConfig.apps)) {
+        this.logger.error(
+          'the "apps" in the PM2 ecosystem configuration is not array',
+        );
+        throw new Error('apps is not array');
+      }
+
+      const oldApps = this.filterOldApps(appOptionsList, allApps);
+
+      this.replaceAppName(appOptionsList, oldApps);
+      for (const appOptions of appOptionsList) {
+        const proc = await promisify<StartOptions, Proc>(pm2.start.bind(pm2))({
+          ...appOptions,
+          cwd: workspace,
+        });
+        this.logger.info({ proc }, `start ${appOptions.name}`);
+      }
+      await this.stopApps(oldApps);
+    } catch (err) {
+      await this.stopApps(appOptionsList);
+      throw err;
+    } finally {
+      pm2.disconnect();
+    }
+  }
+
+  private async stopApps(apps: ProcessDescription[] | StartOptions[]) {
+    await Promise.all(
+      apps.map(async (app: ProcessDescription | StartOptions) => {
+        let procAtStop: ProcessDescription;
+        let procAtDelete: ProcessDescription;
+        try {
+          const idOrName = 'pm_id' in app ? app.pm_id : app.name;
+          procAtStop = await promisify(pm2.stop.bind(pm2))(idOrName);
+          procAtDelete = await promisify(pm2.delete.bind(pm2))(idOrName);
+          this.logger.info('stop & delete %s success', app.name);
+        } catch (error) {
+          this.logger.error(
+            { error, procAtStop, procAtDelete },
+            'stop & delete %s error',
+            app.name,
+          );
+        }
+      }),
+    );
+  }
+
+  private replaceAppName(
+    optionsList: StartOptions[],
+    oldApps: ProcessDescription[],
+  ) {
+    const appSn = this.getAppsSn(oldApps);
+
+    optionsList.forEach((options) => {
+      if (!options.name) {
+        this.logger.error('please give a name for application');
+        throw new Error('app name is not given');
+      }
+      options.name = `${options.name}#${appSn}`;
+    });
+  }
+
+  private filterOldApps(
+    optionsList: StartOptions[],
+    apps: ProcessDescription[],
+  ) {
+    return apps.filter((app) =>
+      optionsList.some((options) => app.name.split('#')[0] === options.name),
+    );
+  }
+
+  private getAppsSn(oldApps: ProcessDescription[]) {
+    const appsSn: number[] = oldApps.map(
+      (app) => +(app.name.split('#')?.[1] ?? 0),
+    );
+    return (last(appsSn.sort()) ?? 0) + 1;
+  }
+}

src/pipelines/commit-logs.resolver.spec.ts

@@ -1,3 +1,4 @@
+import { JwtService } from '@nestjs-lib/auth';
 import { Test, TestingModule } from '@nestjs/testing';
 import { PipelineTasksService } from '../pipeline-tasks/pipeline-tasks.service';
 import { CommitLogsResolver } from './commit-logs.resolver';
@@ -18,6 +19,10 @@ describe('CommitLogsResolver', () => {
           provide: PipelineTasksService,
           useValue: {},
         },
+        {
+          provide: JwtService,
+          useValue: {},
+        },
       ],
     }).compile();
 

src/pipelines/commit-logs.resolver.ts

@@ -1,3 +1,4 @@
+import { Roles, AccountRole } from '@nestjs-lib/auth';
 import { Query } from '@nestjs/graphql';
 import {
   Args,
@@ -10,6 +11,7 @@ import { PipelineTasksService } from '../pipeline-tasks/pipeline-tasks.service';
 import { Commit, LogFields } from '../repos/dtos/log-list.model';
 import { PipelinesService } from './pipelines.service';
 
+@Roles(AccountRole.admin, AccountRole.super)
 @Resolver(() => Commit)
 export class CommitLogsResolver {
   constructor(

src/pipelines/dtos/create-pipeline.input.ts

@@ -1,11 +1,13 @@
+import { Type } from 'class-transformer';
 import { InputType } from '@nestjs/graphql';
 import { WorkUnitMetadata } from '../../pipeline-tasks/models/work-unit-metadata.model';
 import {
-  IsObject,
+  IsInstance,
   IsOptional,
   IsString,
   IsUUID,
   MaxLength,
+  ValidateNested,
 } from 'class-validator';
 
 @InputType({ isAbstract: true })
@@ -21,7 +23,9 @@ export class CreatePipelineInput {
   @MaxLength(32)
   name: string;
 
+  @Type(() => WorkUnitMetadata)
   @IsOptional()
-  @IsObject()
+  @ValidateNested()
+  @IsInstance(WorkUnitMetadata)
   workUnitMetadata: WorkUnitMetadata;
 }

src/pipelines/pipelines.module.ts

@@ -8,9 +8,11 @@ import { PipelineTasksModule } from '../pipeline-tasks/pipeline-tasks.module';
 import { ReposModule } from '../repos/repos.module';
 import { RabbitMQModule } from '@golevelup/nestjs-rabbitmq';
 import { ConfigModule, ConfigService } from '@nestjs/config';
+import { CommonsModule } from '../commons/commons.module';
 
 @Module({
   imports: [
+    CommonsModule,
     TypeOrmModule.forFeature([Pipeline]),
     PipelineTasksModule,
     RabbitMQModule.forRootAsync(RabbitMQModule, {

src/pipelines/pipelines.resolver.spec.ts

@@ -1,3 +1,4 @@
+import { JwtService } from '@nestjs-lib/auth';
 import { Test, TestingModule } from '@nestjs/testing';
 import { PipelinesResolver } from './pipelines.resolver';
 import { PipelinesService } from './pipelines.service';
@@ -13,6 +14,10 @@ describe('PipelinesResolver', () => {
           provide: PipelinesService,
           useValue: {},
         },
+        {
+          provide: JwtService,
+          useValue: {},
+        },
       ],
     }).compile();
 

src/pipelines/pipelines.resolver.ts

@@ -4,7 +4,9 @@ import { UpdatePipelineInput } from './dtos/update-pipeline.input';
 import { Pipeline } from './pipeline.entity';
 import { PipelinesService } from './pipelines.service';
 import { ListPipelineArgs } from './dtos/list-pipelines.args';
+import { Roles, AccountRole } from '@nestjs-lib/auth';
 
+@Roles(AccountRole.admin, AccountRole.super)
 @Resolver()
 export class PipelinesResolver {
   constructor(private readonly service: PipelinesService) {}

src/projects/projects.module.ts

@@ -6,9 +6,11 @@ import { Project } from './project.entity';
 import { RabbitMQModule } from '@golevelup/nestjs-rabbitmq';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { EXCHANGE_PROJECT_FANOUT } from './projects.constants';
+import { CommonsModule } from '../commons/commons.module';
 
 @Module({
   imports: [
+    CommonsModule,
     TypeOrmModule.forFeature([Project]),
     RabbitMQModule.forRootAsync(RabbitMQModule, {
       imports: [ConfigModule],

src/projects/projects.resolver.spec.ts

@@ -1,3 +1,4 @@
+import { JwtService } from '@nestjs-lib/auth';
 import { Test, TestingModule } from '@nestjs/testing';
 import { ProjectsResolver } from './projects.resolver';
 import { ProjectsService } from './projects.service';
@@ -13,6 +14,10 @@ describe('ProjectsResolver', () => {
           provide: ProjectsService,
           useValue: {},
         },
+        {
+          provide: JwtService,
+          useValue: {},
+        },
       ],
     }).compile();
 

src/projects/projects.resolver.ts

@@ -1,9 +1,11 @@
+import { AccountRole, Roles } from '@nestjs-lib/auth';
 import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
 import { CreateProjectInput } from './dtos/create-project.input';
 import { UpdateProjectInput } from './dtos/update-project.input';
 import { Project } from './project.entity';
 import { ProjectsService } from './projects.service';
 
+@Roles(AccountRole.admin, AccountRole.super)
 @Resolver(() => Project)
 export class ProjectsResolver {
   constructor(private readonly service: ProjectsService) {}
@@ -20,7 +22,7 @@ export class ProjectsResolver {
   @Mutation(() => Project)
   async createProject(
     @Args('project', { type: () => CreateProjectInput })
-    dto: UpdateProjectInput,
+    dto: CreateProjectInput,
   ) {
     return await this.service.create(dto);
   }

src/repos/repos.service.spec.ts

@@ -12,6 +12,7 @@ import { readFile } from 'fs/promises';
 import { getLoggerToken, PinoLogger } from 'nestjs-pino';
 import { Nack } from '@golevelup/nestjs-rabbitmq';
 import { getInstanceName } from '../commons/utils/rabbit-mq';
+import { RedisMutexService } from '../commons/redis-mutex/redis-mutex.service';
 
 const getTest1Project = () =>
   ({
@@ -52,6 +53,14 @@ describe('ReposService', () => {
           provide: getLoggerToken(ReposService.name),
           useValue: new PinoLogger({}),
         },
+        {
+          provide: RedisMutexService,
+          useValue: {
+            lock: jest.fn(() =>
+              Promise.resolve(() => Promise.resolve(undefined)),
+            ),
+          },
+        },
       ],
     }).compile();
 

src/repos/repos.service.ts

@@ -56,6 +56,14 @@ export class ReposService {
     );
   }
 
+  getDeployRoot(task: PipelineTask) {
+    return join(
+      this.configService.get<string>('workspaces.root'),
+      encodeURIComponent(task.pipeline.project.name),
+      encodeURIComponent(`deploy-${task.pipeline.name}`),
+    );
+  }
+
   async getGit(
     project: Project,
     workspaceRoot?: string,

test/__mocks__/deploy-service/ecosystem.config.js

@@ -0,0 +1,15 @@
+module.exports = {
+  apps: [
+    {
+      name: 'app',
+      script: __dirname + '/index.js',
+      watch: false,
+      ignore_watch: ['node_modules'],
+      log_date_format: 'MM-DD HH:mm:ss.SSS Z',
+      env: {},
+      max_restarts: 5,
+      kill_timeout: 10_000,
+      wait_ready: true,
+    },
+  ],
+};

test/__mocks__/deploy-service/index.js

@@ -0,0 +1,23 @@
+import { createServer } from 'http';
+
+var app = createServer(function (req, res) {
+  res.writeHead(200);
+  setTimeout(() => {
+    res.end('hey');
+  }, 2000);
+});
+
+var listener = app.listen(0, function () {
+  console.log('Listening on port ' + listener.address().port);
+  setTimeout(() => {
+    // Here we send the ready signal to PM2
+    process.send('ready');
+  }, 5000);
+});
+
+process.on('SIGINT', function () {
+  listener.close();
+  setTimeout(() => {
+    process.exit(0);
+  }, 2000);
+});

test/__mocks__/deploy-service/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "deploy-service",
+  "version": "1.0.0",
+  "description": "For Test",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {},
+  "author": "Ivan Li",
+  "license": "ISC"
+}

test/__mocks__/deploy-service/test.js

@@ -0,0 +1,16 @@
+import { createServer } from 'http';
+
+var app = createServer(function (req, res) {
+  res.writeHead(200);
+  setTimeout(() => {
+    res.end('pm2');
+  }, 2000);
+});
+
+var listener = app.listen(33333, function () {
+  console.log('Listening on port ' + listener.address().port);
+  setTimeout(() => {
+    // Here we send the ready signal to PM2
+    process.send('ready');
+  }, 5000);
+});

tsconfig.json

@@ -7,9 +7,10 @@
     "experimentalDecorators": true,
     "allowSyntheticDefaultImports": true,
     "target": "es2017",
+    "lib": ["ES2021"],
     "sourceMap": true,
     "outDir": "./dist",
+    "rootDir": "./src",
     "baseUrl": "./",
-    "incremental": true
-  }
+  },
 }