Access all build steps

Help
1

HI,

I happen to use in my project some addRunArtifact steps, but that got me thinking about dependencies that can do that too, which I find not very safe.

I would like to know how to dump, look through and assert all steps that are defined in the project, and so far I know I can b.graph.generated_files to look through mostly modules, buut that doesnt give me much confidence as I cant access through that addSystemCommand that is run from step only running that system command (some dependency could always have “run zig build notmaliciousstep” in its documentation, to do something, or it could just run system command that is zig build with malicious step)

So: Is there a way to get list of all build steps, and not only those that my dependency explicitly depends on? Or inspecting build graph, to later make assertions about it in build system a silly idea, and it should be done outside build system (dump steps->assert on than->conditionally run build)?

2

You can get the complete graph in zon by running zig build --print-configuration
this won’t run any steps, but it will still run build.zig’s as that is what constructs the graph.

Though it is in the serialised format which may be annoying to read.

If that is still too much arbitrary code execution for you, then your only option is to read your dependencies source. You do get the convenience of zig build --fetch=all to get dependencies into zig-pkg, which–as far as I can tell–does not run any build.zig’s

3

--print-configuration is quite helpful, but from what I can see, it only lists things from my build.zig and external dependencies are not even being mentioned.

I guess I can still use that somehow anyway, if I just recursively run that on any package. Thanks.

4

I just checked on a project of mine, and it absolutely does include dependencies.