aquaproj/aqua v2.40.0

on GitHub

Pull Requests | Issues | v2.39.1...v2.40.0

Features

#3363 Support getting package versions from external files

This release enables you to get package versions from external files.
This feature is useful when:

• Migrate any tool to aqua gradually
• Support aqua and other tools

This release adds some fields to aqua.yaml's packages.

• version_expr: An expr expression to read external files
• version_expr_prefix: A prefix of version

e.g.

packages:
- name: hashicorp/terraform
  version_expr: |
    "v" + readFile('.terraform-version')

  version_expr: |
    readJSON('version.json').version
  version_expr_prefix: cli-

  version_expr: |
    readYAML('version.yaml').version

version_expr is evaluated using expr.
The following custom functions are available.

• readFile("file path"): reads a file and returns a file content
• readJSON("file path"): read and unmarshal a JSON file and returns an object
• readYAML("file path"): read and unmarshal a YAML file and returns an object

⚠️ Constraint of version_expr

Allowing to read external files is potentially risky in terms of security.
Malicious users can try to read secret files and expose secrets via log using version_expr.
To prevent such a threat, we restrict the evaluation result of version_expr.
It must match with the regular expression ^v?\d+\.\d+(\.\d+)*[.-]?((alpha|beta|dev|rc)[.-]?)?\d*.