Sign in

flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

g1t/crates/runner/src/actions/uses.rs

374 lines18,900 bytesCodeBlame
1//! `uses:` steps: `actions/checkout` done natively against g1t, actions
2//! fetched from GitHub and run as they are (JavaScript and composite), and
3//! a few of GitHub's own whose services g1t does not have yet.
4
5use std::collections::BTreeMap;
6use std::path::{Path, PathBuf};
7use std::process::Command;
8use std::time::Duration;
9
10use base64::Engine;
11use base64::engine::general_purpose::STANDARD;
12use g1t_actions::expr;
13use g1t_actions::workflow::yaml_to_json;
14use serde_json::{Map, Value, json};
15
16use super::files::StepFiles;
17use super::process::{self, Commands, Ended};
18use super::{Frame, Job, Post, PostRun};
19
20const ACTIONS_DIR: &str = "/home/runner/_actions";
21
22/// Where an action comes from.
23enum Source {
24 Local(PathBuf),
25 GitHub { owner: String, repo: String, path: String, git_ref: String },
26}
27
28fn safe(part: &str) -> bool {
29 !part.is_empty() && part.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.' | '/')) && !part.contains("..")
30}
31
32impl Job {
33 /// Runs a git command, logging it; the credential header is never logged.
34 fn git(&mut self, dir: &Path, args: &[&str], auth: Option<&str>) -> bool {
35 let shown: Vec<&str> = args.to_vec();
36 self.log.line(&format!("[command]git {}", shown.join(" ")));
37 let mut command = Command::new("git");
38 command.current_dir(dir);
39 if let Some(header) = auth {
40 command.args(["-c", &format!("http.extraheader={header}")]);
41 }
42 command.args(args).env("GIT_TERMINAL_PROMPT", "0");
43 let mut commands = Commands::default();
44 matches!(process::run(command, Duration::from_secs(600), &mut self.log, &mut commands), Ok(Ended::Exited(0)))
45 }
46
47 /// `actions/checkout`, against g1t.
48 fn checkout(&mut self, with: &BTreeMap<String, String>) -> (bool, BTreeMap<String, String>) {
49 let checkout = self.spec["checkout"].clone();
50 let own = checkout["repository"].as_str().unwrap_or_default().to_owned();
51 let server = self.contexts["github"]["server_url"].as_str().unwrap_or("https://g1t.sh").to_owned();
52 let repository = with.get("repository").filter(|r| !r.is_empty()).cloned().unwrap_or(own.clone());
53 let same = repository.eq_ignore_ascii_case(&own);
54 let token = with.get("token").filter(|t| !t.is_empty()).cloned().or_else(|| checkout["token"].as_str().map(str::to_owned)).unwrap_or_default();
55 let url = if same { checkout["url"].as_str().unwrap_or_default().to_owned() } else { format!("{server}/{repository}.git") };
56 let path = with.get("path").filter(|p| !p.is_empty()).map_or(self.workspace.clone(), |p| self.workspace.join(p));
57 let depth: u32 = with.get("fetch-depth").and_then(|d| d.parse().ok()).unwrap_or(1);
58 let wanted_ref = with.get("ref").filter(|r| !r.is_empty()).cloned();
59 let auth = (!token.is_empty()).then(|| format!("AUTHORIZATION: basic {}", STANDARD.encode(format!("x-access-token:{token}"))));
60
61 self.log.line(&format!("Checking out {repository} into {}", path.display()));
62 if path.exists() {
63 let _ = std::fs::remove_dir_all(&path);
64 }
65 if let Err(error) = std::fs::create_dir_all(&path) {
66 self.log.line(&format!("##[error]Could not make {}: {error}", path.display()));
67 return (false, BTreeMap::new());
68 }
69 let _ = Command::new("git").args(["config", "--global", "--add", "safe.directory", "*"]).status();
70 if !self.git(&path, &["init", "--quiet"], None) || !self.git(&path, &["remote", "add", "origin", &url], None) {
71 return (false, BTreeMap::new());
72 }
73
74 // What to fetch, and which commit to end up on.
75 let run_ref = checkout["ref"].as_str().unwrap_or_default().to_owned();
76 let run_sha = checkout["sha"].as_str().unwrap_or_default().to_owned();
77 let is_sha = |r: &str| r.len() == 40 && r.chars().all(|c| c.is_ascii_hexdigit());
78 let (fetch, sha, branch): (String, Option<String>, Option<String>) = match &wanted_ref {
79 Some(r) if is_sha(r) => ("HEAD".into(), Some(r.clone()), None),
80 Some(r) if r.starts_with("refs/") => (r.clone(), None, r.strip_prefix("refs/heads/").map(str::to_owned)),
81 Some(r) => (r.clone(), None, Some(r.clone())),
82 None if same && run_ref.starts_with("refs/pull/") => ("HEAD".into(), Some(run_sha.clone()), None),
83 None if same => (run_ref.clone(), Some(run_sha.clone()), run_ref.strip_prefix("refs/heads/").map(str::to_owned)),
84 None => ("HEAD".into(), None, None),
85 };
86 let depth_arg = format!("--depth={depth}");
87 let mut args = vec!["fetch", "--no-tags", "--prune", "--quiet"];
88 if depth > 0 {
89 args.push(&depth_arg);
90 }
91 if with.get("fetch-tags").is_some_and(|t| t == "true") {
92 args.retain(|a| *a != "--no-tags");
93 }
94 args.push("origin");
95 args.push(&fetch);
96 if !self.git(&path, &args, auth.as_deref()) {
97 self.log.line(&format!("##[error]Could not fetch {fetch} from {repository}."));
98 return (false, BTreeMap::new());
99 }
100 let target = sha.clone().unwrap_or_else(|| "FETCH_HEAD".into());
101 // The commit may be further back than a shallow fetch reaches.
102 let present = Command::new("git").current_dir(&path).args(["cat-file", "-e", &format!("{target}^{{commit}}")]).status().is_ok_and(|s| s.success());
103 if !present && !self.git(&path, &["fetch", "--no-tags", "--quiet", "origin"], auth.as_deref()) {
104 return (false, BTreeMap::new());
105 }
106 let checked_out = match &branch {
107 Some(branch) => self.git(&path, &["checkout", "--quiet", "--force", "-B", branch, &target], None),
108 None => self.git(&path, &["checkout", "--quiet", "--force", "--detach", &target], None),
109 };
110 if !checked_out {
111 return (false, BTreeMap::new());
112 }
113 if with.get("persist-credentials").is_none_or(|p| p != "false")
114 && let Some(header) = &auth
115 {
116 let key = format!("http.{server}/.extraheader");
117 let _ = Command::new("git").current_dir(&path).args(["config", "--local", &key, header]).status();
118 }
119 if let Some(submodules) = with.get("submodules").filter(|s| *s == "true" || *s == "recursive") {
120 let mut args = vec!["submodule", "update", "--init", "--quiet"];
121 if submodules == "recursive" {
122 args.push("--recursive");
123 }
124 if !self.git(&path, &args, auth.as_deref()) {
125 self.log.line("##[warning]Submodules could not all be checked out; only those hosted on g1t can be.");
126 }
127 }
128 if with.get("lfs").is_some_and(|l| l == "true") {
129 self.log.line("##[warning]Git LFS files are not fetched on g1t yet.");
130 }
131 let commit = Command::new("git").current_dir(&path).args(["rev-parse", "HEAD"]).output().ok().map(|o| String::from_utf8_lossy(&o.stdout).trim().to_owned()).unwrap_or_default();
132 self.log.line(&format!("Checked out {commit}"));
133 let mut outputs = BTreeMap::new();
134 outputs.insert("ref".into(), wanted_ref.unwrap_or(run_ref));
135 outputs.insert("commit".into(), commit);
136 (true, outputs)
137 }
138
139 /// Fetches an action from GitHub, once per job.
140 fn fetch_action(&mut self, owner: &str, repo: &str, git_ref: &str) -> Option<PathBuf> {
141 let dir = Path::new(ACTIONS_DIR).join(owner).join(repo).join(git_ref);
142 if dir.join(".g1t-fetched").exists() {
143 return Some(dir);
144 }
145 if !(safe(owner) && safe(repo) && safe(git_ref)) {
146 self.log.line(&format!("##[error]`{owner}/{repo}@{git_ref}` is not a name g1t can fetch."));
147 return None;
148 }
149 self.log.line(&format!("Download action repository '{owner}/{repo}@{git_ref}'"));
150 let _ = std::fs::create_dir_all(&dir);
151 let url = format!("https://codeload.github.com/{owner}/{repo}/tar.gz/{git_ref}");
152 let script = format!("set -o pipefail; curl -fsSL --retry 3 '{url}' | tar -xz -C '{}' --strip-components=1", dir.display());
153 let mut command = Command::new("bash");
154 command.args(["-c", &script]);
155 let mut commands = Commands::default();
156 match process::run(command, Duration::from_secs(300), &mut self.log, &mut commands) {
157 Ok(Ended::Exited(0)) => {
158 let _ = std::fs::write(dir.join(".g1t-fetched"), "");
159 Some(dir)
160 }
161 _ => {
162 self.log.line(&format!("##[error]Could not download {owner}/{repo}@{git_ref} from GitHub."));
163 let _ = std::fs::remove_dir_all(&dir);
164 None
165 }
166 }
167 }
168
169 /// Runs a JavaScript file of an action with Node.
170 pub(crate) fn run_node(&mut self, action_dir: &Path, script: &str, env: &BTreeMap<String, String>) -> bool {
171 let id = format!("node{}", super::rand_id());
172 let Ok(files) = StepFiles::new(&self.temp, &id) else { return false };
173 let mut command = Command::new("node");
174 command.arg(action_dir.join(script)).current_dir(&self.workspace).env_clear().envs(self.process_env(env, &files));
175 let mut commands = Commands {
176 debug: false,
177 ..Commands::default()
178 };
179 let ended = process::run(command, Duration::from_secs(6 * 3600).min(self.deadline_left()), &mut self.log, &mut commands);
180 let ok = matches!(ended, Ok(Ended::Exited(0)));
181 if let Ok(Ended::Exited(code)) = ended
182 && code != 0
183 {
184 self.log.line(&format!("##[error]The action exited with code {code}."));
185 }
186 let (outputs, state) = self.absorb(&files, &commands);
187 self.last_node_outputs = outputs;
188 self.last_node_state = state;
189 ok
190 }
191
192 fn deadline_left(&self) -> Duration {
193 self.remaining_time()
194 }
195
196 /// Runs a `uses:` step. Returns whether it succeeded, and its outputs.
197 #[allow(clippy::too_many_arguments)]
198 pub(crate) fn uses(
199 &mut self,
200 uses: &str,
201 with: &BTreeMap<String, String>,
202 env: &BTreeMap<String, String>,
203 frame: &Frame,
204 title: &str,
205 id: Option<&str>,
206 _timeout: Duration,
207 ) -> (bool, BTreeMap<String, String>) {
208 let uses = uses.trim();
209 if uses.starts_with("docker://") {
210 self.log.line(&format!("##[error]`{uses}`: Docker actions do not run on g1t yet."));
211 return (false, BTreeMap::new());
212 }
213 let (name, git_ref) = uses.split_once('@').unwrap_or((uses, ""));
214 let lower = name.to_ascii_lowercase();
215 match lower.as_str() {
216 "actions/checkout" => return self.checkout(with),
217 "actions/upload-artifact" => return self.upload_artifact(with),
218 "actions/download-artifact" => return self.download_artifact(with),
219 "actions/cache" => return self.cache(with, true, title),
220 "actions/cache/restore" => return self.cache(with, false, title),
221 "actions/cache/save" => return self.cache_save_now(with),
222 _ => {}
223 }
224 let source = if let Some(local) = name.strip_prefix("./") {
225 // A repository moved from GitHub renamed `.github` to `.g1t`, but
226 // its workflows still say `./.github/actions/…`.
227 let mut dir = self.workspace.join(local);
228 if let Some(rest) = local.strip_prefix(".github/")
229 && !dir.exists()
230 {
231 dir = self.workspace.join(".g1t").join(rest);
232 }
233 Source::Local(dir)
234 } else {
235 let mut parts = name.splitn(3, '/');
236 let (Some(owner), Some(repo)) = (parts.next(), parts.next()) else {
237 self.log.line(&format!("##[error]`{uses}` is not an action: use owner/repo@ref, owner/repo/path@ref, or ./path."));
238 return (false, BTreeMap::new());
239 };
240 if git_ref.is_empty() {
241 self.log.line(&format!("##[error]`{uses}` needs a version, such as @v4."));
242 return (false, BTreeMap::new());
243 }
244 Source::GitHub {
245 owner: owner.to_owned(),
246 repo: repo.to_owned(),
247 path: parts.next().unwrap_or_default().to_owned(),
248 git_ref: git_ref.to_owned(),
249 }
250 };
251 let (dir, repository) = match &source {
252 Source::Local(dir) => (dir.clone(), String::new()),
253 Source::GitHub { owner, repo, path, git_ref } => match self.fetch_action(owner, repo, git_ref) {
254 Some(root) => (if path.is_empty() { root } else { root.join(path) }, format!("{owner}/{repo}")),
255 None => return (false, BTreeMap::new()),
256 },
257 };
258 let manifest = ["action.yml", "action.yaml"].iter().map(|f| dir.join(f)).find(|p| p.exists());
259 let Some(manifest) = manifest else {
260 self.log.line(&format!("##[error]`{uses}` has no action.yml."));
261 return (false, BTreeMap::new());
262 };
263 let action = match std::fs::read_to_string(&manifest).ok().and_then(|text| serde_yaml::from_str::<serde_yaml::Value>(&text).ok()) {
264 Some(yaml) => yaml_to_json(&yaml),
265 None => {
266 self.log.line(&format!("##[error]`{uses}`: its action.yml does not read."));
267 return (false, BTreeMap::new());
268 }
269 };
270
271 // Inputs: what the step gives, else the action's defaults.
272 let env_context = env.clone();
273 let contexts = self.contexts_for(frame, &env_context);
274 let mut inputs: BTreeMap<String, String> = BTreeMap::new();
275 if let Some(Value::Object(declared)) = action.get("inputs") {
276 for (input, spec) in declared {
277 let given = with.iter().find(|(k, _)| k.eq_ignore_ascii_case(input)).map(|(_, v)| v.clone());
278 let value = match given {
279 Some(value) => value,
280 None => match spec.get("default") {
281 Some(default) => {
282 let default = self.with_scope(&contexts, |scope| expr::interpolate_value(default, scope)).unwrap_or(Value::Null);
283 expr::to_text(&default)
284 }
285 None => String::new(),
286 },
287 };
288 inputs.insert(input.clone(), value);
289 }
290 }
291 for (key, value) in with {
292 if !inputs.keys().any(|k| k.eq_ignore_ascii_case(key)) {
293 inputs.insert(key.clone(), value.clone());
294 }
295 }
296
297 let runs = action.get("runs").cloned().unwrap_or(Value::Null);
298 let using = runs.get("using").map(expr::to_text).unwrap_or_default().to_ascii_lowercase();
299 let mut step_env = env.clone();
300 step_env.insert("GITHUB_ACTION".into(), id.map_or_else(|| format!("__{}", repository.replace('/', "_")), str::to_owned));
301 step_env.insert("GITHUB_ACTION_REPOSITORY".into(), repository.clone());
302 step_env.insert("GITHUB_ACTION_REF".into(), git_ref.to_owned());
303 step_env.insert("GITHUB_ACTION_PATH".into(), dir.display().to_string());
304
305 if using.starts_with("node") {
306 for (input, value) in &inputs {
307 step_env.insert(format!("INPUT_{}", input.replace(' ', "_").to_ascii_uppercase()), value.clone());
308 }
309 let condition_of = |key: &str| runs.get(key).map(expr::to_text).unwrap_or_else(|| "always()".into());
310 if let Some(pre) = runs.get("pre").map(expr::to_text) {
311 let run_pre = self.with_scope(&contexts, |scope| expr::condition(&condition_of("pre-if"), scope)).unwrap_or(true);
312 if run_pre && !self.run_node(&dir, &pre, &step_env) {
313 return (false, BTreeMap::new());
314 }
315 }
316 let Some(main) = runs.get("main").map(expr::to_text) else {
317 self.log.line(&format!("##[error]`{uses}` has no `runs.main`."));
318 return (false, BTreeMap::new());
319 };
320 let ok = self.run_node(&dir, &main, &step_env);
321 let outputs = std::mem::take(&mut self.last_node_outputs);
322 let state = std::mem::take(&mut self.last_node_state);
323 if let Some(post) = runs.get("post").map(expr::to_text) {
324 let mut post_env = step_env.clone();
325 for (name, value) in state {
326 post_env.insert(format!("STATE_{name}"), value);
327 }
328 self.posts.push(Post {
329 name: format!("Post {title}"),
330 condition: condition_of("post-if"),
331 env: post_env,
332 run: PostRun::Node { action_dir: dir.clone(), script: post },
333 });
334 }
335 return (ok, outputs);
336 }
337 if using == "composite" {
338 let mut inner = Frame {
339 steps: Map::new(),
340 inputs: Some(Value::Object(inputs.iter().map(|(k, v)| (k.clone(), json!(v))).collect())),
341 action_path: Some(dir.display().to_string()),
342 env: env.clone(),
343 };
344 let steps: Vec<Map<String, Value>> = runs.get("steps").and_then(Value::as_array).map(|s| s.iter().filter_map(|s| s.as_object().cloned()).collect()).unwrap_or_default();
345 let was_failed = self.failed;
346 // A composite's steps see their own success, not the job's.
347 self.failed = false;
348 let mut ok = true;
349 for step in &steps {
350 if !self.step(&mut inner, step, 0, false, &Map::new()) {
351 ok = false;
352 }
353 }
354 let contexts = self.contexts_for(&inner, &inner.env.clone());
355 let mut outputs = BTreeMap::new();
356 if let Some(Value::Object(declared)) = action.get("outputs") {
357 for (name, spec) in declared {
358 if let Some(value) = spec.get("value") {
359 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
360 outputs.insert(name.clone(), expr::to_text(&value));
361 }
362 }
363 }
364 self.failed = was_failed;
365 return (ok, outputs);
366 }
367 if using == "docker" {
368 self.log.line(&format!("##[error]`{uses}` is a Docker action, which does not run on g1t yet."));
369 return (false, BTreeMap::new());
370 }
371 self.log.line(&format!("##[error]`{uses}` runs with `{using}`, which g1t does not know."));
372 (false, BTreeMap::new())
373 }
374}