Define shipped binary permissions once and test the production build

.github/workflows/ci.yml

@@ -37,14 +37,7 @@ jobs:
       - name: Install StrykerJS
         run: npm install --no-save --no-package-lock @stryker-mutator/core
       - name: Build executable
-        run: |
-          touch persist.dat
-          deno compile \
-            --allow-read \
-            --allow-write \
-            --allow-net \
-            --allow-env=HOST,PORT,PERSIST,QUEUE_API_TOKEN,QUEUE_DEPTH_LIMIT,QUEUE_COUNT_LIMIT,RATE_LIMIT_REQUESTS \
-            main.ts
+        run: deno run --frozen --allow-run scripts/compile.ts
       - name: Run tests
         run: deno test --allow-read --allow-write --allow-net --allow-env --allow-run
 

Dockerfile

@@ -4,7 +4,7 @@ COPY . /queue
 
 WORKDIR /queue
 
-RUN deno compile --allow-read --allow-write --allow-net --allow-env=HOST,PORT,PERSIST,QUEUE_API_TOKEN,QUEUE_DEPTH_LIMIT,QUEUE_COUNT_LIMIT,RATE_LIMIT_REQUESTS --allow-sys main.ts && cp ./queue /usr/bin/
+RUN deno run --frozen --allow-run scripts/compile.ts /usr/bin/queue
 
 RUN mkdir -p /data && chown -R deno:deno /queue /usr/bin/queue /data
 

README.md

@@ -45,6 +45,23 @@ the `Authorization` header when making requests.
 
 Note the use of environment variables to change the listening address - these also work for the executable.
 
+## Building from source
+
+With Deno 2.7.6, build using the locked production compile operation:
+
+```sh
+deno run --frozen --allow-run scripts/compile.ts
+# Optional isolated output path:
+deno run --frozen --allow-run scripts/compile.ts /tmp/queue-test
+```
+
+Docker, CI, and the compiled-binary regression use this same operation.
+`scripts/compile.ts` owns the permissions; environment names are shared with
+runtime discovery in `src/config.ts`. Write and network permissions intentionally
+remain unrestricted to support runtime-selected persistence directories and
+HOST/PORT. Run `deno test --frozen --allow-read --allow-write --allow-net --allow-env --allow-run tests/compiled_binary_test.ts`
+to verify startup and persistence across a restart with the shipped permissions.
+
 ## Usage
 
 Once started, you interact with the server using HTTP requests.

main.ts

@@ -1,7 +1,7 @@
 import * as Persistency from "./src/persist.ts";
 import QueueManager from "./src/manager.ts";
 import { createHandler } from "./src/handler.ts";
-import { parseConfig } from "./src/config.ts";
+import { ENV_VAR_NAMES, parseConfig } from "./src/config.ts";
 import type { Payload } from "./src/payload.ts";
 
 const LOG_ENCODER = new TextEncoder();
@@ -13,16 +13,7 @@ function writeLog(message: string): void {
 // Read each config var by name rather than Deno.env.toObject(), which
 // enumerates the entire process environment and therefore requires
 // unrestricted env access. A compiled binary with a scoped --allow-env
-// allowlist (see Dockerfile/CI) can only grant per-name access.
-const ENV_VAR_NAMES = [
-    "HOST",
-    "PORT",
-    "PERSIST",
-    "QUEUE_API_TOKEN",
-    "QUEUE_DEPTH_LIMIT",
-    "QUEUE_COUNT_LIMIT",
-    "RATE_LIMIT_REQUESTS",
-] as const;
+// allowlist (see scripts/compile.ts) can only grant per-name access.
 
 function readEnv(): Record<string, string | undefined> {
     const env: Record<string, string | undefined> = {};

scripts/compile.ts

@@ -0,0 +1,37 @@
+// The production binary's permissions. Docker, CI, and startup regressions all
+// build here; unrestricted write/network access supports runtime configuration.
+import { ENV_VAR_NAMES } from "../src/config.ts";
+
+export async function compileBinary(
+  output = "queue",
+  overrides: { env?: true } = {},
+): Promise<void> {
+  const permissions = [
+    "--allow-read",
+    "--allow-write",
+    "--allow-net",
+    overrides.env ? "--allow-env" : `--allow-env=${ENV_VAR_NAMES.join(",")}`,
+    "--allow-sys",
+  ];
+  const result = await new Deno.Command(Deno.execPath(), {
+    args: [
+      "compile",
+      "--frozen",
+      ...permissions,
+      "--output",
+      output,
+      "main.ts",
+    ],
+    cwd: new URL("../", import.meta.url),
+    stdout: "inherit",
+    stderr: "inherit",
+  }).output();
+  if (!result.success) {
+    throw new Error(`Compilation failed (exit ${result.code})`);
+  }
+}
+
+if (import.meta.main) {
+  if (Deno.args.length > 1) throw new Error("Usage: compile.ts [output-path]");
+  await compileBinary(Deno.args[0]);
+}

src/config.ts

@@ -1,5 +1,16 @@
 import { parseArgs } from "jsr:@std/[email protected]/parse-args";
 
+// Shared by runtime environment discovery and the production compiler.
+export const ENV_VAR_NAMES = [
+    "HOST",
+    "PORT",
+    "PERSIST",
+    "QUEUE_API_TOKEN",
+    "QUEUE_DEPTH_LIMIT",
+    "QUEUE_COUNT_LIMIT",
+    "RATE_LIMIT_REQUESTS",
+] as const;
+
 export class ConfigError extends Error {
     constructor(message: string) {
         super(message);