flagon-io/g1t

public

2,005 lines91,519 bytesCode Blame

1	//! A run's life: made, its jobs waiting on the jobs they need, each job
2	//! skipped or expanded into its matrix and queued, started in a sandbox
3	//! when its workspace has room, reporting its steps and logs as it goes,
4	//! and finished; the run finishes with its last job.
5
6	use g1t_actions::events::{RunInfo, runner_context};
7	use g1t_actions::expr::{self, Scope, Status};
8	use g1t_actions::matrix;
9	use g1t_actions::workflow::{self, Workflow};
10	use g1t_contracts::access::Capability;
11	use g1t_contracts::actions::{JobCallArgs, RunActionArgs, StartJobArgs, WorkflowRun};
12	use g1t_contracts::identity::{CreateAccessTokenArgs, CreatedAccessToken};
13	use g1t_contracts::repos::{Repo, RepoPath};
14	use g1t_contracts::time::rfc3339;
15	use g1t_contracts::{FailureCode, Outcome, new_id};
16	use g1t_kit::now_ms;
17	use g1t_secrets::{random_hex, same, sha256_hex};
18	use serde::Deserialize;
19	use serde_json::{Map, Value, json};
20	use worker::Result;
21
22	use crate::sync::WorkflowRow;
23	use crate::{Actions, Count, MAX_TIMEOUT_MINUTES, RUNNING_PER_WORKSPACE, SELF_HOSTED_MAX_TIMEOUT_MINUTES, SILENT_MS, SITE, check, fail, optional, repo_path};
24	use g1t_contracts::runners::{Wanted, waiting_reason};
25
26	/// The most log one job keeps, in bytes; past it, the log says so and stops.
27	const MAX_LOG_BYTES: usize = 4 * 1024 * 1024;
28	/// The most a single log report may add.
29	const MAX_CHUNK_BYTES: usize = 256 * 1024;
30	const MAX_ANNOTATIONS: usize = 50;
31
32	/// The repository whose unfinished runs `event` stops, by id: one deleted,
33	/// or archived (not unarchived).
34	pub fn stops_runs(event: &g1t_contracts::events::Event) -> Option<String> {
35	let stops = match event.kind.as_str() {
36	"repo.deleted" => true,
37	"repo.archived" => event.data["archived"].as_bool() != Some(false),
38	_ => false,
39	};
40	if !stops {
41	return None;
42	}
43	event.repo_id.clone().or_else(\|\| event.data["repoId"].as_str().map(str::to_owned))
44	}
45
46	pub struct NewRun {
47	pub repo: Repo,
48	pub path: String,
49	pub source: String,
50	pub workflow: Workflow,
51	pub info: RunInfo,
52	pub action: Option<String>,
53	pub pull: Option<u32>,
54	pub title: String,
55	pub inputs: Map<String, Value>,
56	pub event_key: String,
57	pub actor_id: Option<String>,
58	pub actor: Option<String>,
59	pub trusted: bool,
60	}
61
62	#[derive(Clone, Deserialize)]
63	pub struct RunRow {
64	pub id: String,
65	pub workflow_id: String,
66	pub repo_id: String,
67	pub repo: String,
68	pub path: String,
69	pub name: String,
70	pub title: String,
71	pub number: u64,
72	pub attempt: u64,
73	pub event: String,
74	pub action: Option<String>,
75	pub git_ref: String,
76	pub sha: String,
77	pub pull: Option<u32>,
78	pub status: String,
79	pub conclusion: Option<String>,
80	pub error: Option<String>,
81	pub actor: Option<String>,
82	pub actor_id: Option<String>,
83	pub source: String,
84	pub info: String,
85	pub inputs: String,
86	pub trusted: u32,
87	pub concurrency_group: Option<String>,
88	pub created_at: String,
89	pub started_at: Option<String>,
90	pub finished_at: Option<String>,
91	}
92
93	impl RunRow {
94	pub fn info(&self) -> RunInfo {
95	let mut info: RunInfo = serde_json::from_str(&self.info).unwrap_or_default();
96	info.run_id = self.id.clone();
97	info.run_number = self.number;
98	info.run_attempt = self.attempt;
99	info.workflow_path = self.path.clone();
100	if info.workflow.is_empty() {
101	info.workflow = self.name.clone();
102	}
103	info
104	}
105
106	pub fn inputs(&self) -> Map<String, Value> {
107	serde_json::from_str(&self.inputs).unwrap_or_default()
108	}
109
110	pub fn summary(&self) -> WorkflowRun {
111	WorkflowRun {
112	id: self.id.clone(),
113	workflow_id: self.workflow_id.clone(),
114	path: self.path.clone(),
115	name: self.name.clone(),
116	title: self.title.clone(),
117	number: self.number,
118	attempt: self.attempt,
119	event: self.event.clone(),
120	git_ref: self.git_ref.clone(),
121	sha: self.sha.clone(),
122	pull: self.pull,
123	status: self.status.clone(),
124	conclusion: self.conclusion.clone(),
125	error: self.error.clone(),
126	actor: self.actor.clone(),
127	created_at: self.created_at.clone(),
128	started_at: self.started_at.clone(),
129	finished_at: self.finished_at.clone(),
130	}
131	}
132	}
133
134	#[derive(Clone, Deserialize)]
135	pub struct JobRow {
136	pub id: String,
137	pub run_id: String,
138	pub repo_id: String,
139	pub namespace: String,
140	pub key: String,
141	pub ordinal: u32,
142	pub name: String,
143	pub needs: String,
144	pub matrix: Option<String>,
145	pub status: String,
146	pub conclusion: Option<String>,
147	pub steps: String,
148	pub annotations: String,
149	pub outputs: String,
150	pub reason: Option<String>,
151	pub token_hash: Option<String>,
152	pub timeout_minutes: u32,
153	pub continue_on_error: u32,
154	pub max_parallel: Option<u32>,
155	/// Set for a job that calls a reusable workflow, and for that
156	/// workflow's jobs (see migration 0002).
157	pub call: Option<String>,
158	pub seen_at: Option<String>,
159	pub started_at: Option<String>,
160	pub finished_at: Option<String>,
161	/// For a job whose `runs-on` names self-hosted runners: what it asks
162	/// for, as a JSON array (see `g1t_contracts::runners::Wanted`), when it
163	/// started waiting, and the runner that took it (migration 0004).
164	#[serde(default)]
165	pub labels: Option<String>,
166	#[serde(default)]
167	pub queued_at: Option<String>,
168	#[serde(default)]
169	pub runner_id: Option<String>,
170	#[serde(default)]
171	pub runner_name: Option<String>,
172	}
173
174	impl JobRow {
175	pub fn needs(&self) -> Vec<String> {
176	serde_json::from_str(&self.needs).unwrap_or_default()
177	}
178
179	pub fn call(&self) -> Option<Value> {
180	self.call.as_deref().and_then(\|call\| serde_json::from_str(call).ok())
181	}
182
183	/// For a job of a called workflow: that workflow, the job's own id in
184	/// it, and the job.
185	pub fn callee(&self) -> Option<(Workflow, workflow::Job, Value)> {
186	let call = self.call().filter(\|call\| call["role"] == "callee")?;
187	let called = workflow::parse(call["source"].as_str()?).ok()?;
188	let job = called.jobs.iter().find(\|job\| call["job"].as_str() == Some(job.id.as_str()))?.clone();
189	Some((called, job, call))
190	}
191	}
192
193	/// A job to decide on: its key, its definition, and what it needs, as
194	/// (name in `needs`, key of the jobs).
195	type Unit = (String, workflow::Job, Vec<(String, String)>);
196
197	/// How deep reusable workflows may call one another, as on GitHub.
198	const MAX_CALL_DEPTH: u64 = 4;
199
200	/// What the jobs of one key came to, for `needs.<key>`.
201	fn key_result(rows: &[&JobRow]) -> &'static str {
202	let failed = \|row: &&&JobRow\| row.conclusion.as_deref() == Some("failure") && row.continue_on_error == 0;
203	if rows.iter().any(\|row\| failed(&row)) {
204	"failure"
205	} else if rows.iter().any(\|row\| row.conclusion.as_deref() == Some("cancelled")) {
206	"cancelled"
207	} else if rows.iter().all(\|row\| row.conclusion.as_deref() == Some("skipped")) {
208	"skipped"
209	} else {
210	"success"
211	}
212	}
213
214	/// Whether any job before `key` failed: one it needs, or one those need,
215	/// however far back. A job after a skipped one still sees the failure
216	/// that skipped it, as GitHub's failure() does. `needs_of`: each key's
217	/// needs, as keys; `failed`: whether a key's jobs came to a failure.
218	fn ancestor_failed(needs_of: &std::collections::HashMap<&str, Vec<&str>>, key: &str, failed: impl Fn(&str) -> bool) -> bool {
219	let mut seen = std::collections::HashSet::new();
220	let mut stack: Vec<&str> = needs_of.get(key).cloned().unwrap_or_default();
221	while let Some(next) = stack.pop() {
222	if !seen.insert(next) {
223	continue;
224	}
225	if failed(next) {
226	return true;
227	}
228	stack.extend(needs_of.get(next).into_iter().flatten().copied());
229	}
230	false
231	}
232
233	/// A job's `environment:`, as deployments read it: its name, the address in
234	/// `environment.url` once its expressions are filled in from the run, and
235	/// whether the job deploys to it. A job with `deployment: false` only reads
236	/// the environment's secrets and variables, and makes no deployment.
237	#[derive(Clone, Debug, Default, PartialEq)]
238	pub(crate) struct JobEnvironment {
239	pub(crate) name: String,
240	pub(crate) url: Option<String>,
241	pub(crate) deploys: bool,
242	}
243
244	/// The environment `environment:` names, as written in `raw` (a job), with
245	/// `contexts` to fill in expressions: null when it names none, or only
246	/// through an expression this cannot read before the job runs.
247	pub(crate) fn environment_of(raw: &Value, contexts: &Map<String, Value>) -> Option<JobEnvironment> {
248	let scope = Scope { contexts, status: Status::Success, hash_files: None };
249	let plain = \|value: &Value\| -> Option<String> {
250	let text = match value {
251	Value::String(text) if text.contains("${{") => expr::interpolate_value(value, &scope).ok().map(\|v\| expr::to_text(&v))?,
252	Value::String(text) => text.clone(),
253	_ => return None,
254	};
255	let text = text.trim().to_owned();
256	(!text.is_empty()).then_some(text)
257	};
258	match raw.get("environment")? {
259	name @ Value::String(_) => Some(JobEnvironment { name: plain(name)?, url: None, deploys: true }),
260	Value::Object(env) => {
261	let name = plain(env.get("name")?)?;
262	let url = env
263	.get("url")
264	.and_then(plain)
265	.filter(\|url\| url.starts_with("https://") \|\| url.starts_with("http://"));
266	let deploys = !matches!(env.get("deployment"), Some(Value::Bool(false)))
267	&& !matches!(env.get("deployment"), Some(Value::String(text)) if text.trim() == "false");
268	Some(JobEnvironment { name, url, deploys })
269	}
270	_ => None,
271	}
272	}
273
274	/// The contexts a job's `runs-on` and `environment` are read with before it
275	/// runs: the run's `github`, its inputs, and the job's matrix.
276	fn start_contexts(run: &RunRow, job: &JobRow, key: &str) -> Map<String, Value> {
277	let mut contexts = Map::new();
278	contexts.insert("github".into(), run.info().context(key, "", run.action.as_deref()));
279	contexts.insert("inputs".into(), Value::Object(run.inputs()));
280	contexts.insert("matrix".into(), job.matrix.as_deref().and_then(\|m\| serde_json::from_str(m).ok()).unwrap_or_else(\|\| json!({})));
281	contexts
282	}
283
284	/// The job as its workflow (or the workflow it calls) defines it.
285	fn job_spec(run: &RunRow, job: &JobRow) -> Option<workflow::Job> {
286	match job.callee() {
287	Some((_, spec, _)) => Some(spec),
288	None => workflow::parse(&run.source).ok().and_then(\|w\| w.jobs.into_iter().find(\|j\| j.id == job.key)),
289	}
290	}
291
292	/// The environment a job deploys to, if it deploys.
293	pub(crate) fn deploys_to(run: &RunRow, job: &JobRow) -> Option<JobEnvironment> {
294	let spec = job_spec(run, job)?;
295	environment_of(&spec.raw, &start_contexts(run, job, &spec.id)).filter(\|env\| env.deploys)
296	}
297
298	/// What the runner is told about a job it starts, from its workflow: the
299	/// environment it names plainly, and the machine its `runs-on` asks for
300	/// (`instance_for`; none for the standard one).
301	#[derive(Default)]
302	struct StartDetails {
303	environment: Option<String>,
304	instance: Option<String>,
305	}
306
307	fn start_details(run: &RunRow, job: &JobRow) -> StartDetails {
308	let spec = match job.callee() {
309	Some((_, spec, _)) => spec,
310	None => match workflow::parse(&run.source).ok().and_then(\|w\| w.jobs.into_iter().find(\|j\| j.id == job.key)) {
311	Some(spec) => spec,
312	None => return StartDetails::default(),
313	},
314	};
315	let environment = match spec.raw.get("environment") {
316	Some(Value::String(name)) if !name.contains("${{") => Some(name.clone()),
317	Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).filter(\|n\| !n.contains("${{")).map(str::to_owned),
318	_ => None,
319	};
320	// `runs-on` as the job was queued with: its matrix and the run's
321	// inputs. A label that needs more than those is the standard machine.
322	let contexts = start_contexts(run, job, &spec.id);
323	let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
324	let labels: Vec<String> = match expr::interpolate_value(&spec.runs_on, &scope).unwrap_or(Value::Null) {
325	Value::String(label) => vec![label],
326	Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
327	Value::Object(given) => match given.get("labels") {
328	Some(Value::Array(labels)) => labels.iter().map(expr::to_text).collect(),
329	Some(label) => vec![expr::to_text(label)],
330	None => Vec::new(),
331	},
332	_ => Vec::new(),
333	};
334	let instance = g1t_contracts::actions::instance_for(&labels);
335	StartDetails {
336	environment,
337	instance: (instance != g1t_contracts::actions::STANDARD_INSTANCE).then(\|\| instance.label.to_owned()),
338	}
339	}
340
341	fn now() -> String {
342	rfc3339(now_ms())
343	}
344
345	/// How a finished run went for one environment, from the conclusions of
346	/// the jobs that deploy to it: failed if any failed, an error if any was
347	/// cancelled, else a success; nothing when none ran (all skipped).
348	pub(crate) fn deployment_outcome(conclusions: &[Option<String>]) -> Option<&'static str> {
349	let ran: Vec<&str> = conclusions.iter().flatten().map(String::as_str).filter(\|c\| *c != "skipped").collect();
350	if ran.is_empty() {
351	return None;
352	}
353	if ran.iter().any(\|c\| c == "failure" \|\| c == "timed_out") {
354	return Some("failure");
355	}
356	if ran.contains(&"cancelled") {
357	return Some("error");
358	}
359	Some("success")
360	}
361
362	impl Actions {
363	pub async fn run_row(&self, id: &str) -> Result<Option<RunRow>> {
364	self.db.prepare("SELECT * FROM runs WHERE id = ?").bind(&[id.into()])?.first::<RunRow>(None).await
365	}
366
367	pub async fn job_rows(&self, run_id: &str) -> Result<Vec<JobRow>> {
368	self.db
369	.prepare("SELECT * FROM jobs WHERE run_id = ? ORDER BY rowid")
370	.bind(&[run_id.into()])?
371	.all()
372	.await?
373	.results::<JobRow>()
374	}
375
376	pub async fn run_summary(&self, id: &str) -> Result<Outcome<WorkflowRun>> {
377	Ok(match self.run_row(id).await? {
378	Some(row) => Outcome::Ok(row.summary()),
379	None => fail(FailureCode::NotFound, "No such run."),
380	})
381	}
382
383	/// The contexts every expression outside a job's steps may use.
384	fn base_contexts(run: &RunRow, vars: &Map<String, Value>, job: &str) -> Map<String, Value> {
385	let mut contexts = Map::new();
386	contexts.insert("github".into(), run.info().context(job, "", run.action.as_deref()));
387	contexts.insert("inputs".into(), Value::Object(run.inputs()));
388	contexts.insert("vars".into(), Value::Object(vars.clone()));
389	contexts.insert("needs".into(), json!({}));
390	contexts.insert("runner".into(), runner_context());
391	contexts
392	}
393
394	/// Makes a run and its jobs, and starts what can start. `None` when the
395	/// event already started this workflow.
396	pub async fn create_run(&self, new: NewRun) -> Result<Option<String>> {
397	// Nothing starts on an archived repository. A deleted one is never
398	// found to start anything on.
399	if new.repo.archived() {
400	return Ok(None);
401	}
402	let workflow_row = self.workflow_row(&new.repo, &new.path, &new.workflow.display_name(&new.path), &new.source).await?;
403	let numbered = self
404	.db
405	.prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")
406	.bind(&[workflow_row.id.as_str().into()])?
407	.first::<Count>(None)
408	.await?
409	.map_or(1, \|count\| count.n);
410	let id = new_id("run", now_ms());
411	let mut info = new.info.clone();
412	info.workflow = new.workflow.display_name(&new.path);
413	info.workflow_path = new.path.clone();
414	info.run_id = id.clone();
415	info.run_number = u64::from(numbered);
416	let vars = self
417	.variables_for(&new.repo.id, &format!("{}/{}", new.repo.namespace, new.repo.name), None, new.trusted)
418	.await?;
419
420	// run-name and the concurrency group read github, inputs and vars.
421	let mut contexts = Map::new();
422	contexts.insert("github".into(), info.context("", "", new.action.as_deref()));
423	contexts.insert("inputs".into(), Value::Object(new.inputs.clone()));
424	contexts.insert("vars".into(), Value::Object(vars));
425	let scope = Scope {
426	contexts: &contexts,
427	status: Status::Success,
428	hash_files: None,
429	};
430	let title = new
431	.workflow
432	.run_name
433	.as_deref()
434	.and_then(\|run_name\| expr::interpolate(run_name, &scope).ok())
435	.filter(\|title\| !title.trim().is_empty())
436	.unwrap_or(new.title.clone());
437	let group = new.workflow.concurrency.as_ref().and_then(\|c\| expr::interpolate(&c.group, &scope).ok());
438	let cancel_in_progress = new
439	.workflow
440	.concurrency
441	.as_ref()
442	.and_then(\|c\| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())
443	.is_some_and(\|value\| expr::truthy(&value));
444
445	let inserted = self
446	.db
447	.prepare(
448	"INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, action, git_ref, sha,
449	pull, status, actor, actor_id, source, info, inputs, trusted, concurrency_group, event_key, created_at)
450	VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id",
451	)
452	.bind(&[
453	id.as_str().into(),
454	workflow_row.id.as_str().into(),
455	new.repo.id.as_str().into(),
456	format!("{}/{}", new.repo.namespace, new.repo.name).into(),
457	new.path.as_str().into(),
458	info.workflow.as_str().into(),
459	title.as_str().into(),
460	numbered.into(),
461	info.event_name.as_str().into(),
462	optional(new.action.as_deref()),
463	info.git_ref.as_str().into(),
464	info.sha.as_str().into(),
465	new.pull.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
466	optional(new.actor.as_deref()),
467	optional(new.actor_id.as_deref()),
468	new.source.as_str().into(),
469	serde_json::to_string(&info)?.into(),
470	serde_json::to_string(&new.inputs)?.into(),
471	u32::from(new.trusted).into(),
472	optional(group.as_deref()),
473	new.event_key.as_str().into(),
474	now().into(),
475	])?
476	.first::<Value>(None)
477	.await?;
478	if inserted.is_none() {
479	return Ok(None);
480	}
481	if let Some(run) = self.run_row(&id).await? {
482	self.report_pending(&run).await?;
483	}
484
485	// Every job, waiting; each is expanded when the jobs it needs are done.
486	let mut statements = Vec::new();
487	for job in &new.workflow.jobs {
488	statements.push(
489	self.db
490	.prepare(
491	"INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting')",
492	)
493	.bind(&[
494	new_id("job", now_ms()).into(),
495	id.as_str().into(),
496	new.repo.id.as_str().into(),
497	new.repo.namespace.as_str().into(),
498	job.id.as_str().into(),
499	job.name.clone().filter(\|n\| !expr::has_expression(n)).unwrap_or(job.id.clone()).into(),
500	serde_json::to_string(&job.needs)?.into(),
501	])?,
502	);
503	}
504	self.db.batch(statements).await?;
505
506	// One run at a time per concurrency group.
507	if let Some(group) = &group {
508	let others = self
509	.db
510	.prepare("SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND id != ? AND status != 'completed' ORDER BY id")
511	.bind(&[new.repo.id.as_str().into(), group.as_str().into(), id.as_str().into()])?
512	.all()
513	.await?
514	.results::<RunRow>()?;
515	for other in &others {
516	if cancel_in_progress \|\| other.status == "pending" {
517	// A newer run replaces a waiting one, as on GitHub.
518	self.cancel_run(other, "A newer run in the same concurrency group replaced it.").await?;
519	}
520	}
521	if !cancel_in_progress && others.iter().any(\|other\| other.status != "pending") {
522	self.db
523	.prepare("UPDATE runs SET status = 'pending' WHERE id = ?")
524	.bind(&[id.as_str().into()])?
525	.run()
526	.await?;
527	return Ok(Some(id));
528	}
529	}
530	self.advance(&id).await?;
531	Ok(Some(id))
532	}
533
534	/// A run that could not start, such as for a workflow file that does not read.
535	#[allow(clippy::too_many_arguments)]
536	pub async fn record_failed_run(
537	&self,
538	row: &WorkflowRow,
539	git_ref: &str,
540	sha: &str,
541	event_key: &str,
542	actor_id: Option<&str>,
543	actor: &str,
544	problem: &str,
545	) -> Result<()> {
546	let numbered = self
547	.db
548	.prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")
549	.bind(&[row.id.as_str().into()])?
550	.first::<Count>(None)
551	.await?
552	.map_or(1, \|count\| count.n);
553	let at = now();
554	self.db
555	.prepare(
556	"INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, git_ref, sha, status,
557	conclusion, error, actor, actor_id, source, info, event_key, created_at, finished_at)
558	VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'push', ?, ?, 'completed', 'failure', ?, ?, ?, ?, '{}', ?, ?, ?)",
559	)
560	.bind(&[
561	new_id("run", now_ms()).into(),
562	row.id.as_str().into(),
563	row.repo_id.as_str().into(),
564	row.repo.as_str().into(),
565	row.path.as_str().into(),
566	row.path.as_str().into(),
567	"Invalid workflow file".into(),
568	numbered.into(),
569	git_ref.into(),
570	sha.into(),
571	problem.into(),
572	actor.into(),
573	optional(actor_id),
574	row.source.as_str().into(),
575	event_key.into(),
576	at.as_str().into(),
577	at.as_str().into(),
578	])?
579	.run()
580	.await?;
581	Ok(())
582	}
583
584	/// Moves a run along: jobs whose needs are done are decided on, and
585	/// jobs that can start are started.
586	pub async fn advance(&self, run_id: &str) -> Result<()> {
587	// Each pass may finish jobs (skipped ones), which may free others.
588	for _ in 0..20 {
589	let Some(run) = self.run_row(run_id).await? else { return Ok(()) };
590	if run.status == "completed" \|\| run.status == "pending" {
591	return Ok(());
592	}
593	let workflow = match workflow::parse(&run.source) {
594	Ok(workflow) => workflow,
595	Err(problem) => {
596	self.finish_run(&run, Some(&problem)).await?;
597	return Ok(());
598	}
599	};
600	let jobs = self.job_rows(run_id).await?;
601	let mut changed = false;
602	// What to decide on: the workflow's jobs, and the jobs of the
603	// workflows they call, each with its needs as (name, key).
604	let mut units: Vec<Unit> = workflow
605	.jobs
606	.iter()
607	.map(\|job\| (job.id.clone(), job.clone(), job.needs.iter().map(\|n\| (n.clone(), n.clone())).collect()))
608	.collect();
609	let mut seen = std::collections::HashSet::new();
610	for row in &jobs {
611	if !seen.insert(row.key.clone()) {
612	continue;
613	}
614	if let Some((_, job, call)) = row.callee() {
615	let parent = call["parent"].as_str().unwrap_or_default().to_owned();
616	let needs = job.needs.iter().map(\|n\| (n.clone(), format!("{parent}/{n}"))).collect();
617	units.push((row.key.clone(), job, needs));
618	}
619	}
620	// Each key's needs, as keys, to look back through for failure().
621	let needs_of: std::collections::HashMap<&str, Vec<&str>> =
622	units.iter().map(\|(key, _, needs)\| (key.as_str(), needs.iter().map(\|(_, need)\| need.as_str()).collect())).collect();
623	let key_failed = \|key: &str\| key_result(&jobs.iter().filter(\|row\| row.key == key).collect::<Vec<_>>()) == "failure";
624	for (key, job, needs) in &units {
625	let rows: Vec<&JobRow> = jobs.iter().filter(\|row\| &row.key == key).collect();
626	if rows.is_empty() \|\| !rows.iter().all(\|row\| row.status == "waiting") {
627	continue;
628	}
629	let needed: Vec<(&String, Vec<&JobRow>)> =
630	needs.iter().map(\|(name, need)\| (name, jobs.iter().filter(\|row\| &row.key == need).collect())).collect();
631	if !needed.iter().all(\|(_, rows)\| rows.iter().all(\|row\| row.status == "completed")) {
632	continue;
633	}
634	let failed_before = ancestor_failed(&needs_of, key, key_failed);
635	self.decide(&run, job, rows[0], &needed, failed_before).await?;
636	changed = true;
637	}
638	// A job that called a workflow finishes with that workflow's jobs.
639	for row in jobs.iter().filter(\|row\| row.status == "calling") {
640	let children: Vec<&JobRow> = jobs
641	.iter()
642	.filter(\|child\| child.call().is_some_and(\|call\| call["role"] == "callee" && call["parent"].as_str() == Some(row.key.as_str())))
643	.collect();
644	if !children.is_empty() && children.iter().all(\|child\| child.status == "completed") {
645	self.finish_call(row, &children).await?;
646	changed = true;
647	}
648	}
649	if !changed {
650	break;
651	}
652	}
653	self.start_queued().await?;
654	self.finish_if_done(run_id).await
655	}
656
657	/// Decides on one job whose needs are done: skip it, fail it, or expand
658	/// it into its matrix and queue it. `failed_before`: whether any job
659	/// before it failed, however far back (`ancestor_failed`).
660	async fn decide(&self, run: &RunRow, job: &workflow::Job, row: &JobRow, needed: &[(&String, Vec<&JobRow>)], failed_before: bool) -> Result<()> {
661	let vars = self.variables_for(&run.repo_id, &run.repo, None, run.trusted != 0).await?;
662	let mut contexts = Self::base_contexts(run, &vars, &job.id);
663	// A called workflow's jobs read the inputs they were called with.
664	let call = row.call();
665	let parent = call.as_ref().filter(\|c\| c["role"] == "callee").and_then(\|c\| c["parent"].as_str().map(str::to_owned));
666	if let Some(call) = call.as_ref().filter(\|c\| c["role"] == "callee") {
667	contexts.insert("inputs".into(), call["inputs"].clone());
668	}
669	let mut needs = Map::new();
670	let mut results = Vec::new();
671	for (key, rows) in needed {
672	let result = key_result(rows);
673	let mut outputs = Map::new();
674	for row in rows {
675	if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {
676	outputs.extend(more);
677	}
678	}
679	results.push(result);
680	needs.insert((*key).clone(), json!({ "result": result, "outputs": outputs }));
681	}
682	// As on GitHub: a need that was skipped makes success() false but
683	// not failure(); failure() is a failure anywhere before the job.
684	let status = expr::job_status(results, failed_before, run.conclusion.as_deref() == Some("cancelled"));
685	contexts.insert("needs".into(), Value::Object(needs));
686	let scope = Scope {
687	contexts: &contexts,
688	status,
689	hash_files: None,
690	};
691	let condition = job.condition.as_deref().unwrap_or_default();
692	match expr::condition(condition, &scope) {
693	Ok(true) => {}
694	Ok(false) => return self.skip_job(row, None).await,
695	Err(problem) => return self.fail_job(row, &format!("Its `if` does not read: {problem}")).await,
696	}
697	if let Some(uses) = &job.uses {
698	return self.call_workflow(run, job, row, uses, &scope).await;
699	}
700
701	// Its matrix, which may come from a needed job's outputs.
702	let combinations = match &job.matrix {
703	None => vec![Map::new()],
704	Some(matrix) => {
705	let value = match expr::interpolate_value(matrix, &scope) {
706	Ok(value) => value,
707	Err(problem) => return self.fail_job(row, &format!("Its matrix does not read: {problem}")).await,
708	};
709	match matrix::expand(&value) {
710	Ok(combinations) if !combinations.is_empty() => combinations,
711	Ok(_) => return self.fail_job(row, "Its matrix makes no jobs.").await,
712	Err(problem) => return self.fail_job(row, &problem).await,
713	}
714	}
715	};
716	let total = combinations.len();
717	let raw = job.raw.as_object().cloned().unwrap_or_default();
718	// Whether pull requests from forks may use self-hosted runners here,
719	// asked once, and only for a run that is not trusted.
720	let mut forks_allowed: Option<bool> = None;
721	let mut statements = Vec::new();
722	for (index, combination) in combinations.iter().enumerate() {
723	let mut contexts = contexts.clone();
724	contexts.insert("matrix".into(), Value::Object(combination.clone()));
725	contexts.insert(
726	"strategy".into(),
727	json!({ "fail-fast": job.fail_fast, "job-index": index, "job-total": total, "max-parallel": job.max_parallel.unwrap_or(total as u32) }),
728	);
729	let scope = Scope {
730	contexts: &contexts,
731	status: Status::Success,
732	hash_files: None,
733	};
734	let base_name = job.name.clone().unwrap_or(job.id.clone());
735	// A called workflow's job is shown under the job that called it.
736	let base_name = match &parent {
737	Some(parent) => format!("{} / {base_name}", parent.replace('/', " / ")),
738	None => base_name,
739	};
740	let name = if expr::has_expression(&base_name) {
741	expr::interpolate(&base_name, &scope).unwrap_or(base_name)
742	} else if job.matrix.is_some() {
743	matrix::job_name(&base_name, combination)
744	} else {
745	base_name
746	};
747	let runs_on = expr::interpolate_value(&job.runs_on, &scope).unwrap_or(Value::Null);
748	let labels = match &runs_on {
749	Value::String(label) => vec![label.clone()],
750	Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
751	Value::Object(spec) => spec.get("labels").map(\|l\| match l {
752	Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
753	other => vec![expr::to_text(other)],
754	}).unwrap_or_default(),
755	_ => Vec::new(),
756	};
757	// `runs-on: self-hosted` (or a group): the workspace's own
758	// machines, which may run any OS. Otherwise g1t's Linux sandboxes.
759	let group = match &runs_on {
760	Value::Object(spec) => spec.get("group").map(expr::to_text),
761	_ => None,
762	};
763	let wanted = Wanted::of(&labels, group.as_deref());
764	let mut reason = if wanted.self_hosted {
765	None
766	} else {
767	labels
768	.iter()
769	.find(\|label\| {
770	let lower = label.to_ascii_lowercase();
771	lower.contains("windows") \|\| lower.contains("macos")
772	})
773	.map(\|label\| {
774	let os = if label.to_ascii_lowercase().contains("windows") { "windows" } else { "macos" };
775	format!("`runs-on: {label}`: g1t's own runners are Linux. A self-hosted runner can run it: `runs-on: [self-hosted, {os}]`.")
776	})
777	};
778	// A pull request from a fork runs code anyone could write: never
779	// on the workspace's machines unless it said they may.
780	if wanted.self_hosted && run.trusted == 0 {
781	let allowed = match forks_allowed {
782	Some(allowed) => allowed,
783	None => {
784	let allowed = self.effective_runner_settings(&row.namespace, Some(&run.repo_id)).await?.fork_pull_requests;
785	forks_allowed = Some(allowed);
786	allowed
787	}
788	};
789	if !allowed {
790	reason = Some(
791	"Pull requests from forks do not run on self-hosted runners here. An admin can allow it under Settings, Runners.".to_owned(),
792	);
793	}
794	}
795	let max_minutes = if wanted.self_hosted { SELF_HOSTED_MAX_TIMEOUT_MINUTES } else { MAX_TIMEOUT_MINUTES };
796	let timeout = raw
797	.get("timeout-minutes")
798	.and_then(\|value\| expr::interpolate_value(value, &scope).ok())
799	.and_then(\|value\| value.as_f64().or_else(\|\| expr::to_text(&value).parse().ok()))
800	.map_or(MAX_TIMEOUT_MINUTES, \|minutes\| (minutes.ceil() as u32).clamp(1, max_minutes));
801	let continue_on_error = raw
802	.get("continue-on-error")
803	.and_then(\|value\| expr::interpolate_value(value, &scope).ok())
804	.is_some_and(\|value\| expr::truthy(&value));
805	let (status, conclusion, finished) = match &reason {
806	Some(_) => ("completed", Some("failure"), Some(now())),
807	None => ("queued", None, None),
808	};
809	// A self-hosted job waits, saying for what, until a runner takes it.
810	let (labels_json, queued_at) = if wanted.self_hosted && reason.is_none() {
811	reason = Some(waiting_reason(&wanted));
812	(Some(serde_json::to_string(&wanted.stored())?), Some(now()))
813	} else {
814	(None, None)
815	};
816	let values: Vec<worker::wasm_bindgen::JsValue> = vec![
817	name.into(),
818	serde_json::to_string(combination)?.into(),
819	status.into(),
820	optional(conclusion),
821	optional(reason.as_deref()),
822	timeout.into(),
823	u32::from(continue_on_error).into(),
824	job.max_parallel.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
825	optional(finished.as_deref()),
826	optional(labels_json.as_deref()),
827	optional(queued_at.as_deref()),
828	];
829	if index == 0 {
830	let mut bound = values;
831	bound.push(row.id.as_str().into());
832	statements.push(
833	self.db
834	.prepare(
835	"UPDATE jobs SET name = ?, matrix = ?, status = ?, conclusion = ?, reason = ?, timeout_minutes = ?,
836	continue_on_error = ?, max_parallel = ?, finished_at = ?, labels = ?, queued_at = ? WHERE id = ?",
837	)
838	.bind(&bound)?,
839	);
840	} else {
841	let mut bound: Vec<worker::wasm_bindgen::JsValue> = vec![
842	new_id("job", now_ms()).into(),
843	row.run_id.as_str().into(),
844	row.repo_id.as_str().into(),
845	row.namespace.as_str().into(),
846	row.key.as_str().into(),
847	(index as u32).into(),
848	row.needs.as_str().into(),
849	optional(row.call.as_deref()),
850	];
851	bound.extend(values);
852	statements.push(
853	self.db
854	.prepare(
855	"INSERT INTO jobs (id, run_id, repo_id, namespace, key, ordinal, needs, call, name, matrix, status, conclusion, reason,
856	timeout_minutes, continue_on_error, max_parallel, finished_at, labels, queued_at)
857	VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
858	)
859	.bind(&bound)?,
860	);
861	}
862	}
863	self.db.batch(statements).await?;
864	Ok(())
865	}
866
867	/// A job that calls a reusable workflow in the repository: that
868	/// workflow's jobs join the run under it, with the inputs it passes.
869	async fn call_workflow(&self, run: &RunRow, job: &workflow::Job, row: &JobRow, uses: &str, scope: &Scope<'_>) -> Result<()> {
870	let Some(local) = uses.strip_prefix("./") else {
871	return self
872	.fail_job(row, "Reusable workflows from other repositories are not called on g1t yet; ones in this repository (`./.g1t/workflows/…`) are.")
873	.await;
874	};
875	let depth = row.call().and_then(\|c\| c["depth"].as_u64()).unwrap_or(0) + 1;
876	if depth > MAX_CALL_DEPTH {
877	return self.fail_job(row, &format!("Reusable workflows call each other more than {MAX_CALL_DEPTH} deep.")).await;
878	}
879	let local = local.split('@').next().unwrap_or(local).to_owned();
880	let path = repo_path(&run.repo);
881	let Some(ws) = self.workspace_actor(&path.namespace).await? else {
882	return self.fail_job(row, "The workspace is gone.").await;
883	};
884	// A repository moved from GitHub keeps saying `.github/…`.
885	let mut found = self.read_file(&path, &ws, &run.sha, &local).await?.map(\|text\| (local.clone(), text));
886	if found.is_none()
887	&& let Some(rest) = local.strip_prefix(".github/")
888	{
889	let moved = format!(".g1t/{rest}");
890	found = self.read_file(&path, &ws, &run.sha, &moved).await?.map(\|text\| (moved, text));
891	}
892	let Some((file, source)) = found else {
893	return self.fail_job(row, &format!("`{uses}` is not in the repository at this commit.")).await;
894	};
895	let called = match workflow::parse(&source) {
896	Ok(called) => called,
897	Err(problem) => return self.fail_job(row, &format!("`{file}` does not read: {problem}")).await,
898	};
899	let Some(trigger) = called.trigger("workflow_call") else {
900	return self.fail_job(row, &format!("`{file}` cannot be called: it has no `on: workflow_call`.")).await;
901	};
902	// Inputs: what the caller passes, else the called workflow's defaults.
903	let given = match job.raw.get("with") {
904	Some(with) => match expr::interpolate_value(with, scope) {
905	Ok(Value::Object(given)) => given,
906	Ok(_) => Map::new(),
907	Err(problem) => return self.fail_job(row, &format!("Its `with` does not read: {problem}")).await,
908	},
909	None => Map::new(),
910	};
911	let mut inputs = Map::new();
912	for (name, spec) in &trigger.inputs {
913	let value = given.get(name).cloned().or_else(\|\| spec.get("default").cloned()).unwrap_or(Value::Null);
914	if value.is_null() && spec.get("required").and_then(Value::as_bool) == Some(true) {
915	return self.fail_job(row, &format!("`{file}` needs the input `{name}`.")).await;
916	}
917	inputs.insert(name.clone(), value);
918	}
919	for (name, value) in given {
920	inputs.entry(name).or_insert(value);
921	}
922	let mut statements = Vec::new();
923	for called_job in &called.jobs {
924	let needs: Vec<String> = called_job.needs.iter().map(\|n\| format!("{}/{n}", row.key)).collect();
925	let call = json!({
926	"role": "callee", "parent": row.key, "job": called_job.id, "path": file,
927	"source": source, "inputs": inputs, "depth": depth,
928	});
929	statements.push(
930	self.db
931	.prepare("INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status, call) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting', ?)")
932	.bind(&[
933	new_id("job", now_ms()).into(),
934	row.run_id.as_str().into(),
935	row.repo_id.as_str().into(),
936	row.namespace.as_str().into(),
937	format!("{}/{}", row.key, called_job.id).into(),
938	format!("{} / {}", row.name, called_job.name.clone().unwrap_or(called_job.id.clone())).into(),
939	serde_json::to_string(&needs)?.into(),
940	serde_json::to_string(&call)?.into(),
941	])?,
942	);
943	}
944	statements.push(
945	self.db
946	.prepare("UPDATE jobs SET status = 'calling', call = ?, reason = ?, started_at = ? WHERE id = ?")
947	.bind(&[
948	serde_json::to_string(&json!({ "role": "caller", "path": file, "source": source }))?.into(),
949	format!("Calls `{file}`.").into(),
950	now().into(),
951	row.id.as_str().into(),
952	])?,
953	);
954	self.db.batch(statements).await?;
955	Ok(())
956	}
957
958	/// A job that called a workflow, finished with its jobs: their result,
959	/// and the outputs the workflow declares.
960	async fn finish_call(&self, row: &JobRow, children: &[&JobRow]) -> Result<()> {
961	let call = row.call().unwrap_or_default();
962	let called = call["source"].as_str().and_then(\|s\| workflow::parse(s).ok());
963	let mut jobs_context = Map::new();
964	let mut by_key: std::collections::BTreeMap<String, Vec<&JobRow>> = std::collections::BTreeMap::new();
965	for child in children {
966	by_key.entry(child.key.clone()).or_default().push(child);
967	}
968	for (key, rows) in &by_key {
969	let mut outputs = Map::new();
970	for child in rows {
971	if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&child.outputs) {
972	outputs.extend(more);
973	}
974	}
975	let id = key.rsplit('/').next().unwrap_or(key);
976	jobs_context.insert(id.to_owned(), json!({ "result": key_result(rows), "outputs": outputs }));
977	}
978	let inputs = children.first().and_then(\|c\| c.call()).map(\|c\| c["inputs"].clone()).unwrap_or(json!({}));
979	let mut contexts = Map::new();
980	contexts.insert("jobs".into(), Value::Object(jobs_context));
981	contexts.insert("inputs".into(), inputs);
982	let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
983	let mut outputs = Map::new();
984	if let Some(Value::Object(declared)) = called.as_ref().map(\|w\| {
985	let on = w.raw.get("on").or_else(\|\| w.raw.get("true")).cloned().unwrap_or(Value::Null);
986	on.get("workflow_call").and_then(\|c\| c.get("outputs")).cloned().unwrap_or(Value::Null)
987	}) {
988	for (name, spec) in declared {
989	if let Some(value) = spec.get("value") {
990	let value = expr::interpolate_value(value, &scope).unwrap_or(Value::Null);
991	outputs.insert(name, Value::String(expr::to_text(&value)));
992	}
993	}
994	}
995	let conclusion = key_result(children);
996	self.db
997	.prepare("UPDATE jobs SET status = 'completed', conclusion = ?, outputs = ?, finished_at = ? WHERE id = ? AND status = 'calling'")
998	.bind(&[conclusion.into(), serde_json::to_string(&outputs)?.into(), now().into(), row.id.as_str().into()])?
999	.run()
1000	.await?;
1001	Ok(())
1002	}
1003
1004	/// A file's text at a commit, if it is there.
1005	async fn read_file(&self, path: &RepoPath, ws: &g1t_contracts::User, sha: &str, file: &str) -> Result<Option<String>> {
1006	let blob: Outcome<g1t_contracts::repos::BlobView> = g1t_kit::call(
1007	&self.repos,
1008	"blob",
1009	&g1t_contracts::repos::BlobArgs {
1010	path: path.clone(),
1011	viewer: Some(ws.clone()),
1012	git_ref: sha.to_owned(),
1013	file_path: file.to_owned(),
1014	},
1015	)
1016	.await?;
1017	Ok(match blob {
1018	Outcome::Ok(view) => view.text,
1019	Outcome::Fail(_) => None,
1020	})
1021	}
1022
1023	async fn skip_job(&self, row: &JobRow, reason: Option<&str>) -> Result<()> {
1024	self.db
1025	.prepare("UPDATE jobs SET status = 'completed', conclusion = 'skipped', reason = ?, finished_at = ? WHERE id = ?")
1026	.bind(&[optional(reason), now().into(), row.id.as_str().into()])?
1027	.run()
1028	.await?;
1029	Ok(())
1030	}
1031
1032	async fn fail_job(&self, row: &JobRow, reason: &str) -> Result<()> {
1033	self.db
1034	.prepare("UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ? WHERE id = ? AND status != 'completed'")
1035	.bind(&[reason.into(), now().into(), row.id.as_str().into()])?
1036	.run()
1037	.await?;
1038	Ok(())
1039	}
1040
1041	/// Starts queued jobs, oldest first, while their workspace has room.
1042	pub async fn start_queued(&self) -> Result<()> {
1043	let queued = self
1044	.db
1045	// Self-hosted jobs are taken by their runners (runners.rs).
1046	.prepare("SELECT * FROM jobs WHERE status = 'queued' AND labels IS NULL ORDER BY rowid LIMIT 50")
1047	.all()
1048	.await?
1049	.results::<JobRow>()?;
1050	let mut running: std::collections::HashMap<String, u32> = std::collections::HashMap::new();
1051	for job in queued {
1052	let in_workspace = match running.get(&job.namespace) {
1053	Some(n) => *n,
1054	None => {
1055	let n = self
1056	.db
1057	// Only g1t's own sandboxes count against the workspace's room.
1058	.prepare("SELECT COUNT(*) AS n FROM jobs WHERE status = 'in_progress' AND namespace = ? AND runner_id IS NULL")
1059	.bind(&[job.namespace.as_str().into()])?
1060	.first::<Count>(None)
1061	.await?
1062	.map_or(0, \|count\| count.n);
1063	running.insert(job.namespace.clone(), n);
1064	n
1065	}
1066	};
1067	if in_workspace >= RUNNING_PER_WORKSPACE {
1068	continue;
1069	}
1070	if let Some(max) = job.max_parallel {
1071	let siblings = self
1072	.db
1073	.prepare("SELECT COUNT(*) AS n FROM jobs WHERE run_id = ? AND key = ? AND status = 'in_progress'")
1074	.bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?
1075	.first::<Count>(None)
1076	.await?
1077	.map_or(0, \|count\| count.n);
1078	if siblings >= max {
1079	continue;
1080	}
1081	}
1082	let token = random_hex(24);
1083	let at = now();
1084	let claimed = self
1085	.db
1086	.prepare(
1087	"UPDATE jobs SET status = 'in_progress', token_hash = ?, started_at = ?, seen_at = ? WHERE id = ? AND status = 'queued' RETURNING id",
1088	)
1089	.bind(&[sha256_hex(&token).into(), at.as_str().into(), at.as_str().into(), job.id.as_str().into()])?
1090	.first::<Value>(None)
1091	.await?;
1092	if claimed.is_none() {
1093	continue;
1094	}
1095	running.insert(job.namespace.clone(), in_workspace + 1);
1096	self.db
1097	.prepare("UPDATE runs SET status = 'in_progress', started_at = COALESCE(started_at, ?) WHERE id = ? AND status = 'queued'")
1098	.bind(&[at.as_str().into(), job.run_id.as_str().into()])?
1099	.run()
1100	.await?;
1101	let run = self.run_row(&job.run_id).await?;
1102	let repo: RepoPath = run.as_ref().map(\|run\| repo_path(&run.repo)).unwrap_or(RepoPath {
1103	namespace: job.namespace.clone(),
1104	name: String::new(),
1105	});
1106	// Its environment and the machine it asked for, for the runner.
1107	let details = run.as_ref().map(\|run\| start_details(run, &job)).unwrap_or_default();
1108	let started: Outcome<Value> = g1t_kit::call(
1109	&self.runner,
1110	"start_actions_job",
1111	&StartJobArgs {
1112	job: job.id.clone(),
1113	token,
1114	repo,
1115	timeout_minutes: job.timeout_minutes,
1116	workflow: run.as_ref().map(\|run\| run.path.clone()),
1117	environment: details.environment,
1118	trusted: run.as_ref().is_some_and(\|run\| run.trusted != 0),
1119	instance: details.instance,
1120	},
1121	)
1122	.await
1123	.unwrap_or_else(\|error\| fail(FailureCode::Conflict, format!("The runner could not be reached: {error}")));
1124	if let Outcome::Fail(refused) = started {
1125	Box::pin(self.finish_job(&job.id, "failure", Some(&refused.message), None)).await?;
1126	} else {
1127	self.job_started(&job.id).await?;
1128	}
1129	}
1130	Ok(())
1131	}
1132
1133	/// Finishes a job and moves its run along.
1134	pub async fn finish_job(&self, job_id: &str, conclusion: &str, reason: Option<&str>, outputs: Option<&Map<String, Value>>) -> Result<()> {
1135	let finished = self
1136	.db
1137	.prepare(
1138	"UPDATE jobs SET status = 'completed', conclusion = ?, reason = COALESCE(?, reason), outputs = COALESCE(?, outputs),
1139	finished_at = ?, token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *",
1140	)
1141	.bind(&[
1142	conclusion.into(),
1143	optional(reason),
1144	outputs.map(\|o\| serde_json::to_string(o).unwrap_or_default()).as_deref().map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
1145	now().into(),
1146	job_id.into(),
1147	])?
1148	.first::<JobRow>(None)
1149	.await?;
1150	let Some(job) = finished else { return Ok(()) };
1151	// A job that deploys failed: so did its run's deployment, now.
1152	if conclusion == "failure" && job.continue_on_error == 0 && job.started_at.is_some()
1153	&& let Some(run) = self.run_row(&job.run_id).await?
1154	&& let Some(env) = deploys_to(&run, &job)
1155	{
1156	self.report_deployment(&run, &env, "failure", false).await;
1157	}
1158	// A self-hosted runner's job: the runner is free again, and its time
1159	// is recorded, at nothing.
1160	if job.runner_id.is_some() {
1161	self.released(&job).await?;
1162	}
1163	// Steps still marked as going are not going any more.
1164	let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
1165	let mut touched = false;
1166	for step in steps.iter_mut() {
1167	if step["status"] != "completed" {
1168	let was_running = step["status"] == "in_progress";
1169	step["status"] = json!("completed");
1170	step["conclusion"] = json!(if was_running { conclusion } else { "skipped" });
1171	touched = true;
1172	}
1173	}
1174	if touched {
1175	self.db
1176	.prepare("UPDATE jobs SET steps = ? WHERE id = ?")
1177	.bind(&[serde_json::to_string(&steps)?.into(), job.id.as_str().into()])?
1178	.run()
1179	.await?;
1180	}
1181	// fail-fast: one failed combination stops the rest of its matrix.
1182	if conclusion == "failure" && job.continue_on_error == 0 && job.matrix.as_deref().is_some_and(\|m\| m != "{}") {
1183	let run = self.run_row(&job.run_id).await?;
1184	let fail_fast = run
1185	.as_ref()
1186	.and_then(\|run\| workflow::parse(&run.source).ok())
1187	.and_then(\|workflow\| workflow.jobs.into_iter().find(\|j\| j.id == job.key))
1188	.is_none_or(\|j\| j.fail_fast);
1189	if fail_fast {
1190	let siblings = self
1191	.db
1192	.prepare("SELECT * FROM jobs WHERE run_id = ? AND key = ? AND status != 'completed'")
1193	.bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?
1194	.all()
1195	.await?
1196	.results::<JobRow>()?;
1197	for sibling in siblings {
1198	self.stop_job(&sibling, "Another job of its matrix failed, and the matrix is fail-fast.").await?;
1199	}
1200	}
1201	}
1202	Box::pin(self.advance(&job.run_id)).await
1203	}
1204
1205	/// Cancels a job, stopping its sandbox if it has one.
1206	async fn stop_job(&self, job: &JobRow, reason: &str) -> Result<()> {
1207	// A self-hosted runner hears it was cancelled on its next poll.
1208	if job.status == "in_progress" && job.runner_id.is_none() {
1209	let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;
1210	}
1211	let stopped = self
1212	.db
1213	.prepare("UPDATE jobs SET status = 'completed', conclusion = 'cancelled', reason = ?, finished_at = ?, token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *")
1214	.bind(&[reason.into(), now().into(), job.id.as_str().into()])?
1215	.first::<JobRow>(None)
1216	.await?;
1217	if let Some(stopped) = stopped.filter(\|row\| row.runner_id.is_some()) {
1218	self.released(&stopped).await?;
1219	}
1220	Ok(())
1221	}
1222
1223	/// Finishes the run when every job has.
1224	async fn finish_if_done(&self, run_id: &str) -> Result<()> {
1225	let Some(run) = self.run_row(run_id).await? else { return Ok(()) };
1226	if run.status == "completed" \|\| run.status == "pending" {
1227	return Ok(());
1228	}
1229	let jobs = self.job_rows(run_id).await?;
1230	if !jobs.iter().all(\|job\| job.status == "completed") {
1231	return Ok(());
1232	}
1233	self.finish_run(&run, None).await
1234	}
1235
1236	async fn finish_run(&self, run: &RunRow, error: Option<&str>) -> Result<()> {
1237	let jobs = self.job_rows(&run.id).await?;
1238	let rows: Vec<&JobRow> = jobs.iter().collect();
1239	let conclusion = if error.is_some() {
1240	"failure"
1241	} else if run.conclusion.as_deref() == Some("cancelled") {
1242	"cancelled"
1243	} else if rows.is_empty() {
1244	"skipped"
1245	} else {
1246	key_result(&rows)
1247	};
1248	let done = self
1249	.db
1250	.prepare("UPDATE runs SET status = 'completed', conclusion = ?, error = COALESCE(?, error), finished_at = ? WHERE id = ? AND status != 'completed' RETURNING id")
1251	.bind(&[conclusion.into(), optional(error), now().into(), run.id.as_str().into()])?
1252	.first::<Value>(None)
1253	.await?;
1254	if done.is_none() {
1255	return Ok(());
1256	}
1257	self.report_status(run, conclusion).await?;
1258	self.settle_deployments(run, &jobs, conclusion == "cancelled").await;
1259	let published: Result<()> = g1t_kit::call(
1260	&self.events,
1261	"publish",
1262	&g1t_contracts::events::Publish {
1263	events: vec![g1t_contracts::events::NewEvent {
1264	kind: "workflow.completed",
1265	source: "actions",
1266	repo_id: Some(run.repo_id.clone()),
1267	actor: run.actor_id.clone(),
1268	data: g1t_contracts::events::WorkflowEvent {
1269	run_id: run.id.clone(),
1270	repo_id: run.repo_id.clone(),
1271	workflow: run.name.clone(),
1272	path: run.path.clone(),
1273	number: run.number,
1274	event: run.event.clone(),
1275	conclusion: conclusion.to_owned(),
1276	git_ref: run.git_ref.clone(),
1277	sha: run.sha.clone(),
1278	pull: run.pull,
1279	},
1280	}],
1281	},
1282	)
1283	.await;
1284	if let Err(error) = published {
1285	worker::console_error!("actions: could not publish workflow.completed: {error}");
1286	}
1287	// The next run waiting in its concurrency group.
1288	if let Some(group) = &run.concurrency_group {
1289	let next = self
1290	.db
1291	.prepare("SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND status = 'pending' ORDER BY id LIMIT 1")
1292	.bind(&[run.repo_id.as_str().into(), group.as_str().into()])?
1293	.first::<RunRow>(None)
1294	.await?;
1295	if let Some(next) = next {
1296	self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[next.id.as_str().into()])?.run().await?;
1297	Box::pin(self.advance(&next.id)).await?;
1298	}
1299	}
1300	Ok(())
1301	}
1302
1303	/// Tells the deployments service how a run's deployment to `env` stands:
1304	/// made when its first job naming the environment starts, failed when one
1305	/// of them fails, and settled (`last`) when the run finishes. Never fails
1306	/// the run: a deployment that could not be recorded is logged.
1307	async fn report_deployment(&self, run: &RunRow, env: &JobEnvironment, state: &str, last: bool) {
1308	let path = repo_path(&run.repo);
1309	let reported: Result<Value> = g1t_kit::call(
1310	&self.deployments,
1311	"actions_deployment",
1312	&json!({
1313	"repoId": run.repo_id,
1314	"repo": { "namespace": path.namespace, "name": path.name },
1315	"runId": run.id,
1316	"attempt": run.attempt,
1317	"runUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
1318	"environment": env.name,
1319	"url": env.url,
1320	"ref": run.git_ref,
1321	"sha": run.sha,
1322	"state": state,
1323	"final": last,
1324	"creator": run.actor,
1325	"workflow": run.name,
1326	}),
1327	)
1328	.await;
1329	if let Err(error) = reported {
1330	worker::console_error!("actions: deployment to {} not recorded for run {}: {error}", env.name, run.id);
1331	}
1332	}
1333
1334	/// A job that deploys has started: its run's deployment to the
1335	/// environment is under way.
1336	pub(crate) async fn job_started(&self, job_id: &str) -> Result<()> {
1337	let Some(job) = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[job_id.into()])?.first::<JobRow>(None).await? else {
1338	return Ok(());
1339	};
1340	let Some(run) = self.run_row(&job.run_id).await? else { return Ok(()) };
1341	if let Some(env) = deploys_to(&run, &job) {
1342	self.report_deployment(&run, &env, "in_progress", false).await;
1343	}
1344	Ok(())
1345	}
1346
1347	/// The run is over: each environment its jobs deployed to takes the
1348	/// outcome of those jobs (`deployment_outcome`).
1349	async fn settle_deployments(&self, run: &RunRow, jobs: &[JobRow], cancelled: bool) {
1350	let mut seen: Vec<(JobEnvironment, Vec<Option<String>>)> = Vec::new();
1351	for job in jobs {
1352	let Some(env) = deploys_to(run, job) else { continue };
1353	let conclusion = if cancelled && job.conclusion.as_deref() != Some("skipped") && job.started_at.is_some() {
1354	Some("cancelled".to_owned())
1355	} else if job.started_at.is_none() {
1356	Some("skipped".to_owned())
1357	} else {
1358	job.conclusion.clone()
1359	};
1360	match seen.iter_mut().find(\|(known, _)\| known.name.eq_ignore_ascii_case(&env.name)) {
1361	Some((known, conclusions)) => {
1362	if known.url.is_none() {
1363	known.url = env.url.clone();
1364	}
1365	conclusions.push(conclusion);
1366	}
1367	None => seen.push((env, vec![conclusion])),
1368	}
1369	}
1370	for (env, conclusions) in seen {
1371	if let Some(state) = deployment_outcome(&conclusions) {
1372	self.report_deployment(run, &env, state, true).await;
1373	}
1374	}
1375	}
1376
1377	/// Tells the pull request (or commit) how the run went, as a status.
1378	async fn report_status(&self, run: &RunRow, conclusion: &str) -> Result<()> {
1379	let state = match conclusion {
1380	"success" \| "skipped" => "success",
1381	"cancelled" => "error",
1382	_ => "failure",
1383	};
1384	let _: Result<Value> = g1t_kit::call(
1385	&self.work,
1386	"set_commit_status",
1387	&json!({
1388	"repoId": run.repo_id,
1389	"sha": run.sha,
1390	"context": format!("{} / {}", run.name, run.event),
1391	"state": state,
1392	"description": format!("{} {}", run.name, match conclusion {
1393	"success" => "passed",
1394	"skipped" => "was skipped",
1395	"cancelled" => "was cancelled",
1396	_ => "failed",
1397	}),
1398	"targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
1399	"source": "actions",
1400	}),
1401	)
1402	.await;
1403	Ok(())
1404	}
1405
1406	/// Tells the pull request a run has started on its head.
1407	pub async fn report_pending(&self, run: &RunRow) -> Result<()> {
1408	let _: Result<Value> = g1t_kit::call(
1409	&self.work,
1410	"set_commit_status",
1411	&json!({
1412	"repoId": run.repo_id,
1413	"sha": run.sha,
1414	"context": format!("{} / {}", run.name, run.event),
1415	"state": "pending",
1416	"description": format!("{} is running", run.name),
1417	"targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
1418	"source": "actions",
1419	}),
1420	)
1421	.await;
1422	Ok(())
1423	}
1424
1425	/// Cancels a run: its waiting and queued jobs, and stops its running ones.
1426	pub async fn cancel_run(&self, run: &RunRow, reason: &str) -> Result<()> {
1427	self.db
1428	.prepare("UPDATE runs SET conclusion = 'cancelled' WHERE id = ? AND status != 'completed'")
1429	.bind(&[run.id.as_str().into()])?
1430	.run()
1431	.await?;
1432	for job in self.job_rows(&run.id).await?.iter().filter(\|job\| job.status != "completed") {
1433	self.stop_job(job, reason).await?;
1434	}
1435	if run.status == "pending" {
1436	self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[run.id.as_str().into()])?.run().await?;
1437	}
1438	self.advance(&run.id).await
1439	}
1440
1441	/// Cancels every run of the repository that has not finished, for
1442	/// `repo.deleted` and `repo.archived`.
1443	pub async fn stop_runs(&self, repo_id: &str) -> Result<()> {
1444	let runs = self
1445	.db
1446	.prepare("SELECT * FROM runs WHERE repo_id = ? AND status != 'completed'")
1447	.bind(&[repo_id.into()])?
1448	.all()
1449	.await?
1450	.results::<RunRow>()?;
1451	for run in runs {
1452	self.cancel_run(&run, "The repository was archived or deleted.").await?;
1453	}
1454	Ok(())
1455	}
1456
1457	pub async fn cancel(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
1458	if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {
1459	return Ok(Outcome::Fail(refused));
1460	}
1461	let run = check!(self.run_in(&a.repo, &a.id).await?);
1462	if run.status == "completed" {
1463	return Ok(fail(FailureCode::Conflict, "The run has already finished."));
1464	}
1465	self.cancel_run(&run, &format!("{} cancelled the run.", a.actor.username)).await?;
1466	self.run_summary(&run.id).await
1467	}
1468
1469	/// Runs again: every job, or with `failed_only` those that did not
1470	/// succeed and the jobs that need them.
1471	pub async fn rerun(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
1472	if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {
1473	return Ok(Outcome::Fail(refused));
1474	}
1475	let run = check!(self.run_in(&a.repo, &a.id).await?);
1476	if run.status != "completed" {
1477	return Ok(fail(FailureCode::Conflict, "The run is still going: cancel it first."));
1478	}
1479	// Nothing starts again on an archived repository.
1480	match self.visible_repo(&a.repo, &Some(a.actor.clone())).await? {
1481	Some(repo) if repo.archived() => {
1482	return Ok(fail(FailureCode::Forbidden, g1t_contracts::repos::archived_message(&repo.namespace, &repo.name)));
1483	}
1484	Some(_) => {}
1485	None => return Ok(fail(FailureCode::NotFound, "There is no such repository.")),
1486	}
1487	if run.error.is_some() {
1488	return Ok(fail(FailureCode::Conflict, "This run never started: fix the workflow file and push again."));
1489	}
1490	let jobs = self.job_rows(&run.id).await?;
1491	let workflow = workflow::parse(&run.source).ok();
1492	// Which keys run again: failed ones and, transitively, those needing them.
1493	let mut again: Vec<String> = Vec::new();
1494	for key in workflow.as_ref().map(\|w\| w.job_order()).unwrap_or_default() {
1495	let rows: Vec<&JobRow> = jobs.iter().filter(\|j\| j.key == key).collect();
1496	let failed = rows.iter().any(\|row\| row.conclusion.as_deref() != Some("success"));
1497	let needs_again = rows.first().is_some_and(\|row\| row.needs().iter().any(\|need\| again.contains(need)));
1498	if !a.failed_only \|\| failed \|\| needs_again {
1499	again.push(key.to_owned());
1500	}
1501	}
1502	if again.is_empty() {
1503	return Ok(fail(FailureCode::Conflict, "Every job succeeded: there is nothing to run again."));
1504	}
1505	let mut statements = Vec::new();
1506	for key in &again {
1507	statements.push(self.db.prepare("DELETE FROM logs WHERE job_id IN (SELECT id FROM jobs WHERE run_id = ? AND key = ?)").bind(&[run.id.as_str().into(), key.as_str().into()])?);
1508	statements.push(self.db.prepare("DELETE FROM jobs WHERE run_id = ? AND key = ? AND ordinal > 0").bind(&[run.id.as_str().into(), key.as_str().into()])?);
1509	// The jobs of a workflow it called are made again when it calls it again.
1510	statements.push(
1511	self.db
1512	.prepare("DELETE FROM logs WHERE job_id IN (SELECT id FROM jobs WHERE run_id = ? AND key LIKE ?)")
1513	.bind(&[run.id.as_str().into(), format!("{key}/%").into()])?,
1514	);
1515	statements.push(
1516	self.db
1517	.prepare("DELETE FROM jobs WHERE run_id = ? AND key LIKE ?")
1518	.bind(&[run.id.as_str().into(), format!("{key}/%").into()])?,
1519	);
1520	statements.push(
1521	self.db
1522	.prepare(
1523	"UPDATE jobs SET status = 'waiting', conclusion = NULL, steps = '[]', annotations = '[]', outputs = '{}', reason = NULL,
1524	matrix = NULL, call = NULL, token_hash = NULL, seen_at = NULL, started_at = NULL, finished_at = NULL,
1525	labels = NULL, queued_at = NULL, runner_id = NULL, runner_name = NULL WHERE run_id = ? AND key = ?",
1526	)
1527	.bind(&[run.id.as_str().into(), key.as_str().into()])?,
1528	);
1529	}
1530	statements.push(
1531	self.db
1532	.prepare("UPDATE runs SET status = 'queued', conclusion = NULL, attempt = attempt + 1, started_at = NULL, finished_at = NULL WHERE id = ?")
1533	.bind(&[run.id.as_str().into()])?,
1534	);
1535	self.db.batch(statements).await?;
1536	if let Some(run) = self.run_row(&run.id).await? {
1537	self.report_pending(&run).await?;
1538	}
1539	self.advance(&run.id).await?;
1540	self.run_summary(&run.id).await
1541	}
1542
1543	pub async fn run_in(&self, repo: &RepoPath, id: &str) -> Result<Outcome<RunRow>> {
1544	let row = self
1545	.db
1546	.prepare("SELECT * FROM runs WHERE id = ? AND lower(repo) = lower(?)")
1547	.bind(&[id.into(), format!("{}/{}", repo.namespace, repo.name).into()])?
1548	.first::<RunRow>(None)
1549	.await?;
1550	Ok(row.map_or_else(\|\| fail(FailureCode::NotFound, "No such run."), Outcome::Ok))
1551	}
1552
1553	// --- The sandbox's side -----------------------------------------------------
1554
1555	pub(crate) async fn job_for_token(&self, a: &JobCallArgs) -> Result<Outcome<JobRow>> {
1556	let job = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[a.job.as_str().into()])?.first::<JobRow>(None).await?;
1557	Ok(match job {
1558	Some(job) if job.status == "in_progress" && job.token_hash.as_deref().is_some_and(\|hash\| same(hash, &sha256_hex(&a.token))) => {
1559	Outcome::Ok(job)
1560	}
1561	_ => fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."),
1562	})
1563	}
1564
1565	/// `job_auth`: which run and repository a running job's token is for,
1566	/// so the API can keep its artifacts and cache.
1567	pub async fn job_auth(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
1568	let job = check!(self.job_for_token(&a).await?);
1569	Ok(Outcome::Ok(json!({ "run": job.run_id, "repoId": job.repo_id })))
1570	}
1571
1572	/// `job_spec`: everything the sandbox needs to run the job.
1573	pub async fn job_spec(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
1574	let job = check!(self.job_for_token(&a).await?);
1575	let Some(run) = self.run_row(&job.run_id).await? else {
1576	return Ok(fail(FailureCode::NotFound, "No such run."));
1577	};
1578	let Ok(caller) = workflow::parse(&run.source) else {
1579	return Ok(fail(FailureCode::Invalid, "The workflow no longer reads."));
1580	};
1581	// A called workflow's job runs as that workflow defines it.
1582	let callee = job.callee();
1583	let (workflow, spec, call_inputs) = match callee {
1584	Some((called, spec, call)) => (called, spec, Some(call["inputs"].clone())),
1585	None => match caller.jobs.iter().find(\|j\| j.id == job.key) {
1586	Some(spec) => (caller.clone(), spec.clone(), None),
1587	None => return Ok(fail(FailureCode::NotFound, "The job is not in the workflow.")),
1588	},
1589	};
1590	let spec = &spec;
1591	let repo = repo_path(&run.repo);
1592	let trusted = run.trusted != 0;
1593	// The job's `environment:`, by name: entries with a value for it give
1594	// that value instead of their default, as GitHub's environment
1595	// secrets do.
1596	let environment: Option<String> = match spec.raw.get("environment") {
1597	Some(Value::String(name)) if !name.contains("${{") => Some(name.clone()),
1598	Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).filter(\|n\| !n.contains("${{")).map(str::to_owned),
1599	_ => None,
1600	};
1601	// G1T_TOKEN, and GITHUB_TOKEN as its alias: the workspace's own
1602	// token, for as long as the job may run.
1603	let token = if trusted {
1604	match self.workspace_actor(&repo.namespace).await? {
1605	Some(workspace) => {
1606	let created: CreatedAccessToken = g1t_kit::call(
1607	&self.identity,
1608	"create_access_token",
1609	&CreateAccessTokenArgs {
1610	user: workspace,
1611	name: format!("G1T_TOKEN for {} run {}", run.repo, run.number),
1612	ttl_seconds: Some(u64::from(job.timeout_minutes) * 60 + 600),
1613	scopes: None,
1614	listed: false,
1615	},
1616	)
1617	.await?;
1618	created.token
1619	}
1620	None => String::new(),
1621	}
1622	} else {
1623	String::new()
1624	};
1625	// A run that is not trusted (a pull request from outside the
1626	// workspace) gets no secrets and an empty token.
1627	let mut secrets = if trusted {
1628	self.secrets_for(&run.repo_id, &run.repo, environment.as_deref(), true).await?
1629	} else {
1630	Map::new()
1631	};
1632	secrets.insert("G1T_TOKEN".into(), Value::String(token.clone()));
1633	secrets.insert("GITHUB_TOKEN".into(), Value::String(token.clone()));
1634	let masks: Vec<String> = secrets.values().filter_map(\|v\| v.as_str()).filter(\|v\| v.len() >= 4).map(str::to_owned).collect();
1635	let vars = self.variables_for(&run.repo_id, &run.repo, environment.as_deref(), trusted).await?;
1636
1637	let jobs = self.job_rows(&run.id).await?;
1638	let mut needs = Map::new();
1639	// In a called workflow, its jobs' keys sit under the job that called it.
1640	let parent = job.call().filter(\|c\| c["role"] == "callee").and_then(\|c\| c["parent"].as_str().map(str::to_owned));
1641	for need in &spec.needs {
1642	let key = match &parent {
1643	Some(parent) => format!("{parent}/{need}"),
1644	None => need.clone(),
1645	};
1646	let rows: Vec<&JobRow> = jobs.iter().filter(\|row\| row.key == key).collect();
1647	let mut outputs = Map::new();
1648	for row in &rows {
1649	if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {
1650	outputs.extend(more);
1651	}
1652	}
1653	needs.insert(need.clone(), json!({ "result": key_result(&rows), "outputs": outputs }));
1654	}
1655	let siblings = jobs.iter().filter(\|row\| row.key == job.key).count();
1656	let matrix: Value = job.matrix.as_deref().and_then(\|m\| serde_json::from_str(m).ok()).unwrap_or(json!({}));
1657	let info = run.info();
1658	let mut github = info.context(&job.key, &token, run.action.as_deref());
1659	github["token"] = json!(token);
1660	// On a self-hosted runner, `runner` and `RUNNER_*` describe that
1661	// machine rather than g1t's sandbox.
1662	let mut variables = info.variables(&job.key);
1663	let runner = match &job.runner_id {
1664	Some(id) => self.runner_context_for(id, &mut variables).await?,
1665	None => runner_context(),
1666	};
1667
1668	// Where to check out: a pull request's fork, or the repository.
1669	let clone_url = match run.pull {
1670	Some(number) if run.event.starts_with("pull_request") && run.event != "pull_request_target" => {
1671	let located: Outcome<g1t_contracts::work::PullDetail> = g1t_kit::call(
1672	&self.work,
1673	"get_pull",
1674	&g1t_contracts::work::ViewArgs {
1675	repo: repo.clone(),
1676	number,
1677	viewer: self.workspace_actor(&repo.namespace).await?,
1678	after_seq: 0,
1679	},
1680	)
1681	.await?;
1682	match located {
1683	Outcome::Ok(detail) => match detail.pull.fork {
1684	Some(fork) => format!("{SITE}/{}/{}.git", fork.namespace, fork.name),
1685	None => format!("{SITE}/{}.git", run.repo),
1686	},
1687	Outcome::Fail(_) => format!("{SITE}/{}.git", run.repo),
1688	}
1689	}
1690	_ => format!("{SITE}/{}.git", run.repo),
1691	};
1692
1693	Ok(Outcome::Ok(json!({
1694	"job": job.id,
1695	"run": run.id,
1696	"key": job.key,
1697	"name": job.name,
1698	"spec": spec.raw,
1699	"workflow": {
1700	"env": workflow.env,
1701	"defaults": workflow.raw.get("defaults").cloned().unwrap_or(Value::Null),
1702	},
1703	"github": github,
1704	"variables": variables,
1705	"event": info.event,
1706	"contexts": {
1707	"vars": vars,
1708	"secrets": secrets,
1709	"inputs": call_inputs.unwrap_or_else(\|\| Value::Object(run.inputs())),
1710	"matrix": matrix,
1711	"needs": needs,
1712	"strategy": {
1713	"fail-fast": spec.fail_fast,
1714	"job-index": job.ordinal,
1715	"job-total": siblings,
1716	"max-parallel": spec.max_parallel.unwrap_or(siblings as u32),
1717	},
1718	"runner": runner,
1719	},
1720	"checkout": {
1721	"repository": run.repo,
1722	"url": clone_url,
1723	"sha": run.sha,
1724	"ref": run.git_ref,
1725	"token": token,
1726	},
1727	"timeoutMinutes": job.timeout_minutes,
1728	"masks": masks,
1729	})))
1730	}
1731
1732	/// `job_report`: the sandbox telling how the job is going.
1733	pub async fn job_report(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
1734	let job = check!(self.job_for_token(&a).await?);
1735	let report = &a.report;
1736	let at = now();
1737	match report["kind"].as_str().unwrap_or_default() {
1738	"steps" => {
1739	// The list can grow as the job goes (post steps), so steps
1740	// already reported keep where they stand.
1741	let known: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
1742	let steps: Vec<Value> = report["steps"]
1743	.as_array()
1744	.map(\|names\| {
1745	names
1746	.iter()
1747	.enumerate()
1748	.map(\|(i, name)\| match known.get(i) {
1749	Some(step) if step["status"] != "queued" => step.clone(),
1750	_ => json!({ "number": i + 1, "name": expr::to_text(name), "status": "queued", "conclusion": null, "startedAt": null, "finishedAt": null }),
1751	})
1752	.collect()
1753	})
1754	.unwrap_or_default();
1755	self.db
1756	.prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")
1757	.bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?
1758	.run()
1759	.await?;
1760	}
1761	"step" => {
1762	let number = report["number"].as_u64().unwrap_or(0) as usize;
1763	let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
1764	if let Some(step) = number.checked_sub(1).and_then(\|i\| steps.get_mut(i)) {
1765	let status = report["status"].as_str().unwrap_or("in_progress");
1766	step["status"] = json!(status);
1767	if status == "in_progress" {
1768	step["startedAt"] = json!(at);
1769	}
1770	if status == "completed" {
1771	step["finishedAt"] = json!(at);
1772	step["conclusion"] = report["conclusion"].clone();
1773	}
1774	if let Some(name) = report["name"].as_str() {
1775	step["name"] = json!(name);
1776	}
1777	}
1778	self.db
1779	.prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")
1780	.bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?
1781	.run()
1782	.await?;
1783	}
1784	"log" => {
1785	let mut text = report["text"].as_str().unwrap_or_default().to_owned();
1786	if text.len() > MAX_CHUNK_BYTES {
1787	let mut cut = MAX_CHUNK_BYTES;
1788	while !text.is_char_boundary(cut) {
1789	cut -= 1;
1790	}
1791	text.truncate(cut);
1792	}
1793	#[derive(Deserialize)]
1794	struct Size {
1795	n: Option<f64>,
1796	seq: Option<f64>,
1797	}
1798	let size = self
1799	.db
1800	.prepare("SELECT SUM(LENGTH(text)) AS n, MAX(seq) AS seq FROM logs WHERE job_id = ?")
1801	.bind(&[job.id.as_str().into()])?
1802	.first::<Size>(None)
1803	.await?;
1804	let (used, seq) = size.map_or((0, 0.0), \|s\| (s.n.unwrap_or(0.0) as usize, s.seq.unwrap_or(0.0)));
1805	if used < MAX_LOG_BYTES {
1806	if used + text.len() >= MAX_LOG_BYTES {
1807	text.push_str("\n… The log reached its limit of 4 MB; the rest is not kept.\n");
1808	}
1809	self.db
1810	.prepare("INSERT INTO logs (job_id, seq, step, text) VALUES (?, ?, ?, ?)")
1811	.bind(&[job.id.as_str().into(), // Numbers go to D1 as f64: a u64 would be a BigInt, which it refuses.
1812	(seq + 1.0).into(), (report["step"].as_u64().unwrap_or(0) as u32).into(), text.into()])?
1813	.run()
1814	.await?;
1815	}
1816	self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;
1817	}
1818	"annotation" => {
1819	let mut annotations: Vec<Value> = serde_json::from_str(&job.annotations).unwrap_or_default();
1820	if annotations.len() < MAX_ANNOTATIONS {
1821	annotations.push(json!({
1822	"level": report["level"].as_str().unwrap_or("notice"),
1823	"message": report["message"].as_str().unwrap_or_default().chars().take(4000).collect::<String>(),
1824	"title": report["title"],
1825	"file": report["file"],
1826	"line": report["line"],
1827	}));
1828	self.db
1829	.prepare("UPDATE jobs SET annotations = ?, seen_at = ? WHERE id = ?")
1830	.bind(&[serde_json::to_string(&annotations)?.into(), at.as_str().into(), job.id.as_str().into()])?
1831	.run()
1832	.await?;
1833	}
1834	}
1835	"done" => {
1836	let conclusion = report["conclusion"]
1837	.as_str()
1838	.filter(\|c\| matches!(*c, "success" \| "failure" \| "cancelled"))
1839	.unwrap_or("failure");
1840	let outputs = report["outputs"].as_object().cloned();
1841	Box::pin(self.finish_job(&job.id, conclusion, report["reason"].as_str(), outputs.as_ref())).await?;
1842	}
1843	other => return Ok(fail(FailureCode::Invalid, format!("There is no report called `{other}`."))),
1844	}
1845	Ok(Outcome::Ok(json!({ "ok": true })))
1846	}
1847
1848	// --- Every minute ---------------------------------------------------------------
1849
1850	pub async fn on_minute(&self, now_ms: u64) -> Result<()> {
1851	let minute = now_ms / 60_000 * 60_000;
1852	if let Err(error) = self.run_schedules(minute).await {
1853	worker::console_error!("actions: schedules failed: {error}");
1854	}
1855	// Jobs whose sandbox went quiet or ran past their time.
1856	let running = self.db.prepare("SELECT * FROM jobs WHERE status = 'in_progress'").all().await?.results::<JobRow>()?;
1857	for job in running {
1858	// Times in g1t's format compare as text.
1859	let before = \|ms: u64\| rfc3339(now_ms.saturating_sub(ms));
1860	let silent = job.seen_at.as_deref().is_some_and(\|seen\| seen < before(SILENT_MS).as_str());
1861	let limit = (u64::from(job.timeout_minutes) * 60 + 120) * 1000;
1862	let over = job.started_at.as_deref().is_some_and(\|started\| started < before(limit).as_str());
1863	if over {
1864	let reason = format!("It ran longer than its time limit of {} minutes.", job.timeout_minutes);
1865	// A self-hosted runner is told to stop on its next poll.
1866	if job.runner_id.is_none() {
1867	let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;
1868	}
1869	self.finish_job(&job.id, "failure", Some(&reason), None).await?;
1870	} else if silent {
1871	let reason = match &job.runner_name {
1872	Some(name) => format!("The self-hosted runner {name} stopped answering."),
1873	None => "The runner stopped answering.".to_owned(),
1874	};
1875	self.finish_job(&job.id, "failure", Some(&reason), None).await?;
1876	}
1877	}
1878	if let Err(error) = self.sweep_runners(now_ms).await {
1879	worker::console_error!("actions: the runners' sweep failed: {error}");
1880	}
1881	// Once an hour: the cache's expired entries, and its storage.
1882	if (now_ms / 60_000) % 60 == 7
1883	&& let Err(error) = self.sweep_cache(now_ms).await
1884	{
1885	worker::console_error!("actions: the cache's sweep failed: {error}");
1886	}
1887	self.start_queued().await
1888	}
1889	}
1890
1891
1892	#[cfg(test)]
1893	mod stopping {
1894	use super::stops_runs;
1895	use g1t_contracts::events::Event;
1896	use serde_json::{Value, json};
1897
1898	fn event(kind: &str, data: Value) -> Event {
1899	Event {
1900	id: "evt_1".into(),
1901	kind: kind.into(),
1902	source: "repos".into(),
1903	time: "2026-10-05T00:00:00Z".into(),
1904	repo_id: Some("rep_1".into()),
1905	actor: None,
1906	data,
1907	}
1908	}
1909
1910	#[test]
1911	fn deleting_or_archiving_stops_runs() {
1912	assert_eq!(stops_runs(&event("repo.deleted", json!({ "repoId": "rep_1" }))).as_deref(), Some("rep_1"));
1913	assert_eq!(stops_runs(&event("repo.archived", json!({ "archived": true }))).as_deref(), Some("rep_1"));
1914	assert_eq!(stops_runs(&event("repo.unarchived", json!({ "archived": false }))), None);
1915	assert_eq!(stops_runs(&event("repo.restored", json!({}))), None);
1916	assert_eq!(stops_runs(&event("git.push", json!({}))), None);
1917	}
1918	}
1919
1920	#[cfg(test)]
1921	mod status_of_needs {
1922	use std::collections::HashMap;
1923
1924	use super::ancestor_failed;
1925
1926	/// check -> plan -> (migrate) -> core -> edge, as deploy.yml has them,
1927	/// and a job that needs only the last.
1928	fn graph() -> HashMap<&'static str, Vec<&'static str>> {
1929	HashMap::from([
1930	("check", vec![]),
1931	("plan", vec!["check"]),
1932	("migrate", vec!["plan"]),
1933	("core", vec!["plan", "migrate"]),
1934	("edge", vec!["plan", "migrate", "core"]),
1935	("notify", vec!["edge"]),
1936	])
1937	}
1938
1939	#[test]
1940	fn a_failure_is_seen_however_far_back() {
1941	let needs = graph();
1942	let failed = \|which: &'static str\| move \|key: &str\| key == which;
1943	// check failed; plan, and everything after, was skipped for it.
1944	assert!(ancestor_failed(&needs, "notify", failed("check")));
1945	assert!(ancestor_failed(&needs, "core", failed("check")));
1946	assert!(ancestor_failed(&needs, "edge", failed("core")));
1947	// Nothing before a job failed: a skipped migrate is not a failure.
1948	assert!(!ancestor_failed(&needs, "edge", \|_\| false));
1949	assert!(!ancestor_failed(&needs, "core", failed("edge")));
1950	assert!(!ancestor_failed(&needs, "check", failed("check")));
1951	}
1952
1953	#[test]
1954	fn cycles_and_unknown_keys_end() {
1955	let needs = HashMap::from([("a", vec!["b"]), ("b", vec!["a"])]);
1956	assert!(!ancestor_failed(&needs, "a", \|_\| false));
1957	assert!(!ancestor_failed(&needs, "missing", \|_\| true));
1958	}
1959	}
1960
1961	#[cfg(test)]
1962	mod deployments {
1963	use serde_json::{Map, Value, json};
1964
1965	use super::{JobEnvironment, deployment_outcome, environment_of};
1966
1967	#[test]
1968	fn a_jobs_environment_is_read_for_deployments() {
1969	let contexts: Map<String, Value> = serde_json::from_value(json!({
1970	"github": { "ref_name": "main", "repository": "acme/web" },
1971	"inputs": { "target": "staging" },
1972	"matrix": {},
1973	}))
1974	.unwrap();
1975	let read = \|raw: Value\| environment_of(&raw, &contexts);
1976	assert_eq!(read(json!({})), None);
1977	assert_eq!(
1978	read(json!({ "environment": "production" })),
1979	Some(JobEnvironment { name: "production".into(), url: None, deploys: true })
1980	);
1981	assert_eq!(
1982	read(json!({ "environment": { "name": "production", "url": "https://g1t.sh" } })),
1983	Some(JobEnvironment { name: "production".into(), url: Some("https://g1t.sh".into()), deploys: true })
1984	);
1985	// Expressions are filled in from the run.
1986	assert_eq!(
1987	read(json!({ "environment": { "name": "${{ inputs.target }}", "url": "https://${{ github.ref_name }}.example.com" } })),
1988	Some(JobEnvironment { name: "staging".into(), url: Some("https://main.example.com".into()), deploys: true })
1989	);
1990	// Secrets only: no deployment.
1991	assert!(!read(json!({ "environment": { "name": "production", "deployment": false } })).unwrap().deploys);
1992	// Only http(s) addresses.
1993	assert_eq!(read(json!({ "environment": { "name": "production", "url": "javascript:alert(1)" } })).unwrap().url, None);
1994	}
1995
1996	#[test]
1997	fn a_runs_outcome_for_an_environment() {
1998	let of = \|list: &[&str]\| deployment_outcome(&list.iter().map(\|c\| Some((*c).to_owned())).collect::<Vec<_>>());
1999	assert_eq!(of(&["success", "skipped"]), Some("success"));
2000	assert_eq!(of(&["success", "failure"]), Some("failure"));
2001	assert_eq!(of(&["success", "cancelled"]), Some("error"));
2002	assert_eq!(of(&["skipped"]), None);
2003	assert_eq!(deployment_outcome(&[None]), None);
2004	}
2005	}