feat: [CI-18487]: Precompile strip_prefix regex once per run, fix absolute-path join in resolveKey, added logs and tests.

Author: DevanshMathur19

README.md

@@ -61,6 +61,47 @@ docker run --rm \
   plugins/s3 --dry-run
 ```
 
+### Wildcard strip_prefix
+
+You can strip dynamic, runtime-generated directory prefixes from S3 keys using shell-style wildcards in `strip_prefix`.
+
+Supported patterns:
+
+- `*` matches exactly one path segment (no `/`).
+- `**` matches any depth (including zero segments).
+- `?` matches exactly one character (no `/`).
+
+The pattern is anchored at the start of the path. Use `/` to delimit directory boundaries. We recommend ending directory patterns with a trailing `/` to strip whole directory segments.
+
+Examples:
+
+- Pattern: `/harness/artifacts/*/`
+  - Path: `/harness/artifacts/build-123/module/app.zip`
+  - Result key suffix: `module/app.zip`
+
+- Pattern: `/harness/artifacts/**/`
+  - Path: `/harness/artifacts/build-123/deep/nested/file.zip`
+  - Result key suffix: `file.zip`
+
+- Pattern: `/harness/artifacts/*/services/`
+  - Path: `/harness/artifacts/build-123/services/auth/auth.zip`
+  - Result key suffix: `auth/auth.zip`
+
+Trailing slash semantics:
+
+- A trailing `/` indicates you are stripping up to a directory boundary.
+- Without a trailing `/`, the match may end mid-segment. For directory prefix stripping, prefer a trailing `/`.
+
+Windows notes:
+
+- `strip_prefix` must start with `/`. Backslashes are accepted and normalized to `/` internally (e.g. `\\harness\\artifacts\\*/` is allowed).
+- Windows drive letters like `C:\\...` are not supported and will be rejected.
+
+Dry-run logging:
+
+- With `--dry-run` or `PLUGIN_DRY_RUN=true`, the plugin logs what would be uploaded.
+- Fields include `name` (source), `target` (S3 key), `strip_pattern`, and `removed_prefix` (the portion stripped from the path when the pattern matches).
+
 * For Download
 ```
 docker run --rm \

plugin.go

@@ -139,7 +139,8 @@ func (p *Plugin) Exec() error {
 		return err
 	}
 
-	// Validate strip prefix pattern if it contains wildcards
+	// Validate strip prefix pattern and precompile regex once
+	normalizedStrip := strings.ReplaceAll(p.StripPrefix, "\\", "/")
 	if p.StripPrefix != "" {
 		if err := validateStripPrefix(p.StripPrefix); err != nil {
 			log.WithFields(log.Fields{
@@ -150,13 +151,52 @@ func (p *Plugin) Exec() error {
 		}
 	}
 
+	var compiled *regexp.Regexp
+	if normalizedStrip != "" && strings.ContainsAny(normalizedStrip, "*?") {
+		var err error
+		compiled, err = patternToRegex(normalizedStrip)
+		if err != nil {
+			log.WithFields(log.Fields{
+				"error":   err,
+				"pattern": p.StripPrefix,
+			}).Error("Failed to compile strip_prefix pattern")
+			return err
+		}
+	}
+
+	anyMatched := false
+
 	for _, match := range matches {
 		// skip directories
 		if isDir(match, matches) {
 			continue
 		}
 
-		target := resolveKey(p.Target, match, p.StripPrefix)
+		// Preview stripping (using precompiled regex when available)
+		stripped := match
+		matched := false
+		if normalizedStrip != "" {
+			var err error
+			stripped, matched, err = stripWildcardPrefixWithRegex(match, normalizedStrip, compiled)
+			if err != nil {
+				log.WithFields(log.Fields{
+					"error":   err,
+					"path":    match,
+					"pattern": p.StripPrefix,
+				}).Warn("Failed to strip prefix, using original path")
+				stripped = match
+			}
+		}
+		if matched {
+			anyMatched = true
+		}
+
+		// Build final key (ensure relative component for join)
+		rel := strings.TrimPrefix(filepath.ToSlash(stripped), "/")
+		target := filepath.ToSlash(filepath.Join(p.Target, rel))
+		if !strings.HasPrefix(target, "/") {
+			target = "/" + target
+		}
 
 		contentType := matchExtension(match, p.ContentType)
 		contentEncoding := matchExtension(match, p.ContentEncoding)
@@ -177,9 +217,22 @@ func (p *Plugin) Exec() error {
 			"target": target,
 		}).Info("Uploading file")
 
-		// when executing a dry-run we exit because we don't actually want to
-		// upload the file to S3.
+		// when executing a dry-run print what would be stripped and skip upload.
 		if p.DryRun {
+			removed := ""
+			if matched {
+				// removed prefix = original - stripped suffix
+				orig := filepath.ToSlash(match)
+				rem := strings.TrimSuffix(orig, filepath.ToSlash(stripped))
+				removed = rem
+			}
+			log.WithFields(log.Fields{
+				"name":          match,
+				"bucket":        p.Bucket,
+				"target":        target,
+				"strip_pattern": p.StripPrefix,
+				"removed_prefix": removed,
+			}).Info("Dry-run: would upload")
 			continue
 		}
 
@@ -238,6 +291,12 @@ func (p *Plugin) Exec() error {
 		f.Close()
 	}
 
+	if normalizedStrip != "" && !anyMatched {
+		log.WithFields(log.Fields{
+			"pattern": p.StripPrefix,
+		}).Warn("strip_prefix did not match any paths; keys will include original path")
+	}
+
 	return nil
 }
 
@@ -325,10 +384,12 @@ func resolveKey(target, srcPath, stripPrefix string) string {
 			"error":   err,
 			"path":    srcPath,
 			"pattern": stripPrefix,
-		}).Warning("Failed to strip prefix, using original path")
+		}).Warn("Failed to strip prefix, using original path")
 		stripped = srcPath
 	}
-
+	// Ensure we never drop the target when the stripped path is absolute.
+	// Always join with a relative path component.
+	stripped = strings.TrimPrefix(stripped, "/")
 	key := filepath.Join(target, stripped)
 	key = filepath.ToSlash(key)
 	if !strings.HasPrefix(key, "/") {
@@ -341,42 +402,42 @@ func resolveSource(sourceDir, source, stripPrefix string) string {
 	// Remove the leading sourceDir from the source path
 	path := strings.TrimPrefix(strings.TrimPrefix(source, sourceDir), "/")
 
-	// Add the specified stripPrefix to the resulting path
-	return stripPrefix + path
+    // Add the specified stripPrefix to the resulting path
+    return stripPrefix + path
 }
 
 // checks if the source path is a dir
 func isDir(source string, matches []string) bool {
-	stat, err := os.Stat(source)
-	if err != nil {
-		return true // should never happen
-	}
-	if stat.IsDir() {
-		count := 0
-		for _, match := range matches {
-			if strings.HasPrefix(match, source) {
-				count++
-			}
-		}
-		if count <= 1 {
-			log.Warnf("Skipping '%s' since it is a directory. Please use correct glob expression if this is unexpected.", source)
-		}
-		return true
-	}
-	return false
+    stat, err := os.Stat(source)
+    if err != nil {
+        return true // should never happen
+    }
+    if stat.IsDir() {
+        count := 0
+        for _, match := range matches {
+            if strings.HasPrefix(match, source) {
+                count++
+            }
+        }
+        if count <= 1 {
+            log.Warnf("Skipping '%s' since it is a directory. Please use correct glob expression if this is unexpected.", source)
+        }
+        return true
+    }
+    return false
 }
 
 // normalizePath converts the path to a forward slash format and trims the prefix.
 func normalizePath(path string) string {
-	return strings.TrimPrefix(filepath.ToSlash(path), "/")
+    return strings.TrimPrefix(filepath.ToSlash(path), "/")
 }
 
 // downloadS3Object downloads a single object from S3
 func (p *Plugin) downloadS3Object(client *s3.S3, sourceDir, key, target string) error {
-	log.WithFields(log.Fields{
-		"bucket": p.Bucket,
-		"key":    key,
-	}).Info("Getting S3 object")
+    log.WithFields(log.Fields{
+        "bucket": p.Bucket,
+        "key":    key,
+    }).Info("Getting S3 object")
 
 	obj, err := client.GetObject(&s3.GetObjectInput{
 		Bucket: &p.Bucket,
@@ -394,7 +455,6 @@ func (p *Plugin) downloadS3Object(client *s3.S3, sourceDir, key, target string)
 
 	// Create the destination file path
 	destination := filepath.Join(p.Target, target)
-	log.Println("Destination: ", destination)
 
 	// Extract the directory from the destination path
 	dir := filepath.Dir(destination)
@@ -534,10 +594,18 @@ func assumeRoleWithWebIdentity(sess *session.Session, roleArn, roleSessionName,
 
 // validateStripPrefix validates a strip prefix pattern with wildcards
 func validateStripPrefix(pattern string) error {
-	// Pattern must start with /
-	if !strings.HasPrefix(pattern, "/") {
-		return fmt.Errorf("strip_prefix must start with '/'")
-	}
+    // Normalize Windows backslashes to forward slashes for validation (OS-independent)
+    pattern = strings.ReplaceAll(pattern, "\\", "/")
+
+    // Pattern must start with /
+    if !strings.HasPrefix(pattern, "/") {
+        return fmt.Errorf("strip_prefix must start with '/'")
+    }
+
+    // Reject Windows drive-letter prefixes like C:/...
+    if len(pattern) >= 2 && pattern[1] == ':' {
+        return fmt.Errorf("strip_prefix must be an absolute POSIX-style path (e.g. '/root/...'), drive letters are not supported")
+    }
 
 	// Check length limit
 	if len(pattern) > 256 {
@@ -563,7 +631,7 @@ func validateStripPrefix(pattern string) error {
 		}
 	}
 
-	return nil
+	    return nil
 }
 
 // patternToRegex converts shell-style wildcards to regex
@@ -580,50 +648,56 @@ func patternToRegex(pattern string) (*regexp.Regexp, error) {
 	// Anchor at start
 	escaped = "^" + escaped
 
-	return regexp.Compile(escaped)
+	    return regexp.Compile(escaped)
+}
+
+// stripWildcardPrefixWithRegex strips prefix using wildcard pattern matching, reusing
+// a precompiled regex when provided. It returns the possibly stripped path, whether
+// the pattern matched, and any error if stripping would remove the entire key.
+func stripWildcardPrefixWithRegex(path, pattern string, re *regexp.Regexp) (string, bool, error) {
+    if pattern == "" {
+        return path, false, nil
+    }
+
+    // Normalize paths to forward slashes (OS-independent)
+    path = strings.ReplaceAll(path, "\\", "/")
+    pattern = strings.ReplaceAll(pattern, "\\", "/")
+
+    // Literal prefix (no wildcards)
+    if !strings.ContainsAny(pattern, "*?") {
+        if !strings.HasPrefix(path, pattern) {
+            return path, false, nil
+        }
+        stripped := strings.TrimPrefix(path, pattern)
+        if stripped == "" || stripped == "/" || strings.TrimPrefix(stripped, "/") == "" {
+            return path, true, fmt.Errorf("strip_prefix removes entire path for '%s'", filepath.Base(path))
+        }
+        return stripped, true, nil
+    }
+
+    // Wildcard pattern
+    var err error
+    if re == nil {
+        re, err = patternToRegex(pattern)
+        if err != nil {
+            return path, false, fmt.Errorf("invalid pattern: %v", err)
+        }
+    }
+
+    m := re.FindStringSubmatch(path)
+    if len(m) == 0 {
+        return path, false, nil
+    }
+    full := m[0]
+    stripped := strings.TrimPrefix(path, full)
+    if stripped == "" || stripped == "/" || strings.TrimPrefix(stripped, "/") == "" {
+        return path, true, fmt.Errorf("strip_prefix removes entire path for '%s'", filepath.Base(path))
+    }
+    return stripped, true, nil
 }
 
 // stripWildcardPrefix strips prefix using wildcard pattern matching
 func stripWildcardPrefix(path, pattern string) (string, error) {
-	if pattern == "" {
-		return path, nil
-	}
-
-	// Normalize paths
-	path = filepath.ToSlash(path)
-	pattern = filepath.ToSlash(pattern)
-
-	// Handle literal prefix (no wildcards)
-	if !strings.ContainsAny(pattern, "*?") {
-		stripped := strings.TrimPrefix(path, pattern)
-		// Validate result for literal prefix
-		if stripped == "" || stripped == "/" || strings.TrimPrefix(stripped, "/") == "" {
-			return path, fmt.Errorf("strip_prefix removes entire path for '%s'", filepath.Base(path))
-		}
-		return stripped, nil
-	}
-
-	// Convert pattern to regex
-	re, err := patternToRegex(pattern)
-	if err != nil {
-		return path, fmt.Errorf("invalid pattern: %v", err)
-	}
-
-	// Find matches
-	matches := re.FindStringSubmatch(path)
-	if len(matches) == 0 {
-		// No match, return path unchanged
-		return path, nil
-	}
-
-	// Calculate what to strip (the full match)
-	fullMatch := matches[0]
-	stripped := strings.TrimPrefix(path, fullMatch)
-
-	// Validate result
-	if stripped == "" || stripped == "/" || strings.TrimPrefix(stripped, "/") == "" {
-		return path, fmt.Errorf("strip_prefix removes entire path for '%s'", filepath.Base(path))
-	}
-
-	return stripped, nil
+    stripped, _, err := stripWildcardPrefixWithRegex(path, pattern, nil)
+    return stripped, err
 }