Rhai Tool

RhaiTool

Embedded Rhai scripting (kind: rhai), source: src/tools/rhai.rs. The code: string is rendered as a Jinja template before it runs (on the server and again on the worker), so never put {{, {% or {# in it. Prior step results, workload keys and args: entries are in scope as variables; a step that didn't run is not (is_def_var("step") guards it).

Functions

Function	Returns	Notes
log(s), print(s), debug(s), info(s), warn(s), error(s)	()	Worker tracing, target rhai.
parse_json(s), to_json(v)	map/array, string
contains(s, sub), contains_any(s, [subs])	bool
timestamp(), timestamp_ms()	string	Worker clock, UTC.
sleep(secs), sleep_ms(ms)	()	Blocks the task.
http_get(url), http_get_auth(url, bearer), http_post(url, body), http_delete(url)	string	Prefer the http tool in a step.
get_gcp_token()	string	ADC access token, "" on error.
sha256_hex(s)	string	Lowercase hex SHA-256 of the UTF-8 bytes.
hmac_sha256_hex(key, msg)	string	HMAC-SHA256 (RFC 2104/4231), lowercase hex.
random_digits(n)	string	n decimal digits (1..=32) from the OS CSPRNG, unbiased. Errors outside the range.
random_token(bytes)	string	bytes (1..=64) random bytes, base64url without padding.
eq_ct(a, b)	bool	Equality whose time doesn't depend on where the strings differ (length differences still return false).

The last five are for playbooks that issue or check one-time secrets, such as an emailed sign-in code: generate with random_digits(6), store only hmac_sha256_hex(key_from_keychain, code), compare with eq_ct. Never put the plain code or key in a step result: results are kept in the event log.

In pipelines

A rhai task inside a tool: list sees earlier sibling tasks' results by label (fetch.status_code) on the worker. Sibling references in another task's config are rendered by the server first, where siblings don't exist yet; defer them with "{{ '{{ prep.x }}' }}".

An auth: block on a pipeline task (e.g. http with type: gcp_adc) is applied like on a single-tool step (before the fix it was silently dropped).