services/actions/src/plan.rs · flagon-io/g1t

"`{file}` would be the {}th level of workflows: a run connects at most ten, the workflow it started from and nine levels of reusable workflows below it.",

322

depth + 1

323

));

324

}

325

let mut unique: Vec<&str> = called.to_vec();

326

unique.push(file);

327

unique.sort_unstable();

328

unique.dedup();

329

if unique.len() > MAX_CALLED_WORKFLOWS {

330

return Err(format!("Calling `{file}` would make {} reusable workflows in this run: a run calls at most {MAX_CALLED_WORKFLOWS} different ones.", unique.len()));

}

Ok(())

}

/// What a job is shown as: its `name` (else its id), under the job whose

336

/// call made it (`caller`), read with its matrix when it has an

337

/// expression, else with the matrix's values after it.

338

fn shown_name(job: &workflow::Job, caller: Option<&str>, combination: &Map<String, Value>, scope: &Scope) -> String {

339

let base = job.name.clone().unwrap_or(job.id.clone());

340

let base = match caller {

341

Some(caller) => format!("{caller} / {base}"),

342

None => base,

343

};

344

if expr::has_expression(&base) {

345

expr::interpolate(&base, scope).unwrap_or(base)

346

} else if job.matrix.is_some() {

347

matrix::job_name(&base, combination)

} else {

base

}

}

/// Debug logging for a job, as a re-run with it turned on gives GitHub's:

354

/// `RUNNER_DEBUG=1` and `runner.debug`, and `ACTIONS_STEP_DEBUG` and

355

/// `ACTIONS_RUNNER_DEBUG` set, which the runner reads as the secrets of

356

/// those names (`::debug::` lines shown, and how each step's `if` read).

357

pub fn debug_logging(variables: &mut Map<String, Value>, runner: &mut Value) {

358

variables.insert("RUNNER_DEBUG".into(), json!("1"));

359

variables.insert("ACTIONS_STEP_DEBUG".into(), json!("true"));

360

variables.insert("ACTIONS_RUNNER_DEBUG".into(), json!("true"));

361

runner["debug"] = json!("1");

}

impl JobRow {

pub fn needs(&self) -> Vec<String> {

366

serde_json::from_str(&self.needs).unwrap_or_default()

367

}

368

369

pub fn call(&self) -> Option<Value> {

370

self.call.as_deref().and_then(|call| serde_json::from_str(call).ok())

371

}

372

373

/// For a job that calls a reusable workflow: what the keys of the jobs

374

/// its call makes start with (`call_prefix`).

375

pub fn call_prefix(&self) -> Option<String> {

376

let call = self.call().filter(|call| call["role"] == "caller")?;

377

Some(call["prefix"].as_str().unwrap_or(&self.key).to_owned())

378

}

379

380

/// A job that calls a reusable workflow and has not called it yet: it

381

/// waits for room under its matrix's `max-parallel`, or in its

382

/// concurrency group.

383

pub fn holds_call(&self) -> bool {

384

self.status == "waiting" && self.call_prefix().is_some()

385

}

386

387

/// For a job of a called workflow: that workflow, the job's own id in

388

/// it, and the job.

389

pub fn callee(&self) -> Option<(Workflow, workflow::Job, Value)> {

390

let call = self.call().filter(|call| call["role"] == "callee")?;

391

let called = workflow::parse(call["source"].as_str()?).ok()?;

392

let job = called.jobs.iter().find(|job| call["job"].as_str() == Some(job.id.as_str()))?.clone();

393

Some((called, job, call))

}

}

/// A job to decide on: its key, its definition, and what it needs, as

398

/// (name in `needs`, key of the jobs).

399

type Unit = (String, workflow::Job, Vec<(String, String)>);

400

401

/// How many levels of reusable workflows may sit below the workflow a run

402

/// started from, as on GitHub (ten levels of workflows in all).

403

const MAX_CALL_DEPTH: u64 = 9;

404

/// How many different reusable workflows a run may call, as on GitHub.

405

const MAX_CALLED_WORKFLOWS: usize = 50;

406

407

/// What the jobs of one key came to, for `needs.<key>`.

408

fn key_result(rows: &[&JobRow]) -> &'static str {

409

let failed = |row: &&&JobRow| row.conclusion.as_deref() == Some("failure") && row.continue_on_error == 0;

410

if rows.iter().any(|row| failed(&row)) {

411

"failure"

412

} else if rows.iter().any(|row| row.conclusion.as_deref() == Some("cancelled")) {

413

"cancelled"

414

} else if rows.iter().all(|row| row.conclusion.as_deref() == Some("skipped")) {

"skipped"

} else {

"success"

}

}

/// Whether any job before `key` failed: one it needs, or one those need,

422

/// however far back. A job after a skipped one still sees the failure

423

/// that skipped it, as GitHub's failure() does. `needs_of`: each key's

424

/// needs, as keys; `failed`: whether a key's jobs came to a failure.

425

fn ancestor_failed(needs_of: &std::collections::HashMap<&str, Vec<&str>>, key: &str, failed: impl Fn(&str) -> bool) -> bool {

426

let mut seen = std::collections::HashSet::new();

427

let mut stack: Vec<&str> = needs_of.get(key).cloned().unwrap_or_default();

428

while let Some(next) = stack.pop() {

429

if !seen.insert(next) {

continue;

}

if failed(next) {

return true;

}

stack.extend(needs_of.get(next).into_iter().flatten().copied());

}

false

}

/// A job's `environment:`, as deployments read it: its name, the address in

441

/// `environment.url` once its expressions are filled in from the run, and

442

/// whether the job deploys to it. A job with `deployment: false` only reads

443

/// the environment's secrets and variables, and makes no deployment.

444

#[derive(Clone, Debug, Default, PartialEq)]

445

pub(crate) struct JobEnvironment {

446

pub(crate) name: String,

447

pub(crate) url: Option<String>,

448

pub(crate) deploys: bool,

449

}

450

451

/// The environment `environment:` names, as written in `raw` (a job), with

452

/// `contexts` to fill in expressions: null when it names none, or only

453

/// through an expression this cannot read before the job runs.

454

pub(crate) fn environment_of(raw: &Value, contexts: &Map<String, Value>) -> Option<JobEnvironment> {

455

let scope = Scope { contexts, status: Status::Success, hash_files: None };

456

let plain = |value: &Value| -> Option<String> {

457

let text = match value {

458

Value::String(text) if text.contains("${{") => expr::interpolate_value(value, &scope).ok().map(|v| expr::to_text(&v))?,

459

Value::String(text) => text.clone(),

460

_ => return None,

461

};

462

let text = text.trim().to_owned();

463

(!text.is_empty()).then_some(text)

464

};

465

match raw.get("environment")? {

466

name @ Value::String(_) => Some(JobEnvironment { name: plain(name)?, url: None, deploys: workflow::records_deployment(raw) }),

467

Value::Object(env) => {

468

let name = plain(env.get("name")?)?;

let url = env

.get("url")

.and_then(plain)

.filter(|url| url.starts_with("https://") || url.starts_with("http://"));

473

Some(JobEnvironment { name, url, deploys: workflow::records_deployment(raw) })

}

_ => None,

}

}

/// The contexts a job's `runs-on` and `environment` are read with before it

480

/// runs: the run's `github`, its inputs, and the job's matrix.

481

fn start_contexts(run: &RunRow, job: &JobRow, key: &str) -> Map<String, Value> {

482

let mut contexts = Map::new();

483

contexts.insert("github".into(), run.info().context(key, "", run.action.as_deref()));

484

contexts.insert("inputs".into(), Value::Object(run.inputs()));

485

contexts.insert("matrix".into(), job.matrix.as_deref().and_then(|m| serde_json::from_str(m).ok()).unwrap_or_else(|| json!({})));

contexts

}

/// The job as its workflow (or the workflow it calls) defines it.

490

fn job_spec(run: &RunRow, job: &JobRow) -> Option<workflow::Job> {

491

match job.callee() {

492

Some((_, spec, _)) => Some(spec),

493

None => workflow::parse(&run.source).ok().and_then(|w| w.jobs.into_iter().find(|j| j.id == job.key)),

}

}

/// The environment a job deploys to, if it deploys: by the name read when

498

/// its needs were done (which may have needed their outputs), else as

499

/// its `environment:` reads now.

500

pub(crate) fn deploys_to(run: &RunRow, job: &JobRow) -> Option<JobEnvironment> {

501

let spec = job_spec(run, job)?;

502

let read = environment_of(&spec.raw, &start_contexts(run, job, &spec.id));

503

let env = match (read, &job.environment) {

504

(Some(env), Some(name)) => Some(JobEnvironment { name: name.clone(), ..env }),

505

(Some(env), None) => Some(env),

506

(None, Some(name)) => Some(JobEnvironment { name: name.clone(), url: None, deploys: workflow::records_deployment(&spec.raw) }),

507

(None, None) => None,

508

};

509

env.filter(|env| env.deploys)

510

}

511

512

/// Whether a run's repository was public when the run was made, from its

513

/// event's `repository.private`: private when the event doesn't say.

514

fn run_is_public(run: &RunRow) -> bool {

515

run.info().event.get("repository").and_then(|repository| repository.get("private")).and_then(Value::as_bool) == Some(false)

516

}

517

518

/// The machine a job's `runs-on` asks for (`instance_for`), for the

519

/// runner: none for the standard one. `ubuntu-latest` follows GitHub: the

520

/// 4-core machine in a public repository. Billing charges the job as the

521

/// machine named here, so what it ran on is what it pays for.

522

fn start_instance(run: &RunRow, job: &JobRow) -> Option<String> {

523

let spec = match job.callee() {

524

Some((_, spec, _)) => spec,

525

None => workflow::parse(&run.source).ok().and_then(|w| w.jobs.into_iter().find(|j| j.id == job.key))?,

526

};

527

// `runs-on` as the job was queued with: its matrix and the run's

528

// inputs. A label that needs more than those is the standard machine.

529

let contexts = start_contexts(run, job, &spec.id);

530

let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };

531

let labels: Vec<String> = match expr::interpolate_value(&spec.runs_on, &scope).unwrap_or(Value::Null) {

532

Value::String(label) => vec![label],

533

Value::Array(labels) => labels.iter().map(expr::to_text).collect(),

534

Value::Object(given) => match given.get("labels") {

535

Some(Value::Array(labels)) => labels.iter().map(expr::to_text).collect(),

536

Some(label) => vec![expr::to_text(label)],

None => Vec::new(),

},

_ => Vec::new(),

};

let instance = g1t_contracts::actions::instance_for(&labels, run_is_public(run));

542

(instance != g1t_contracts::actions::STANDARD_INSTANCE).then(|| instance.label.to_owned())

}

fn now() -> String {

rfc3339(now_ms())

}

/// How a finished run went for one environment, from the conclusions of

550

/// the jobs that deploy to it: failed if any failed, an error if any was

551

/// cancelled, else a success; nothing when none ran (all skipped).

552

pub(crate) fn deployment_outcome(conclusions: &[Option<String>]) -> Option<&'static str> {

553

let ran: Vec<&str> = conclusions.iter().flatten().map(String::as_str).filter(|c| *c != "skipped").collect();

if ran.is_empty() {

return None;

}

if ran.iter().any(|c| *c == "failure" || *c == "timed_out") {

558

return Some("failure");

559

}

560

if ran.contains(&"cancelled") {

561

return Some("error");

}

Some("success")

}

impl Actions {

pub async fn run_row(&self, id: &str) -> Result<Option<RunRow>> {

568

self.db.prepare("SELECT * FROM runs WHERE id = ?").bind(&[id.into()])?.first::<RunRow>(None).await

569

}

570

571

pub async fn job_rows(&self, run_id: &str) -> Result<Vec<JobRow>> {

572

self.db

573

.prepare("SELECT * FROM jobs WHERE run_id = ? ORDER BY rowid")

574

.bind(&[run_id.into()])?

.all()

.await?

.results::<JobRow>()

}

pub async fn run_summary(&self, id: &str) -> Result<Outcome<WorkflowRun>> {

581

Ok(match self.run_row(id).await? {

582

Some(row) => Outcome::Ok(row.summary()),

583

None => fail(FailureCode::NotFound, "No such run."),

})

}

/// The contexts every expression outside a job's steps may use.

588

fn base_contexts(run: &RunRow, vars: &Map<String, Value>, job: &str) -> Map<String, Value> {

589

let mut contexts = Map::new();

590

contexts.insert("github".into(), run.info().context(job, "", run.action.as_deref()));

591

contexts.insert("inputs".into(), Value::Object(run.inputs()));

592

contexts.insert("vars".into(), Value::Object(vars.clone()));

593

contexts.insert("needs".into(), json!({}));

594

contexts.insert("runner".into(), runner_context());

contexts

}

/// Whether `namespace` is a person's own workspace: usernames and

599

/// workspaces share one namespace, so it is when someone has that

600

/// username. Kept in the isolate for a few minutes, so a burst of

601

/// runs asks identity once.

602

async fn personal_namespace(&self, namespace: &str) -> Result<bool> {

603

const KEEP_MS: u64 = 5 * 60 * 1000;

604

thread_local! {

605

static PERSONAL: std::cell::RefCell<std::collections::HashMap<String, (bool, u64)>> = Default::default();

606

}

607

let now = now_ms();

608

let key = namespace.to_ascii_lowercase();

609

if let Some(personal) = PERSONAL.with(|kept| kept.borrow().get(&key).filter(|(_, at)| now.saturating_sub(*at) < KEEP_MS).map(|(personal, _)| *personal)) {

610

return Ok(personal);

611

}

612

let found: g1t_contracts::Viewer = g1t_kit::call(

613

&self.identity,

614

"user_by_username",

615

&g1t_contracts::identity::UsernameArgs { username: key.clone() },

616

)

617

.await?;

618

let personal = found.is_some_and(|user| user.username.eq_ignore_ascii_case(namespace));

619

PERSONAL.with(|kept| {

620

let mut kept = kept.borrow_mut();

621

if kept.len() > 1000 {

622

kept.clear();

623

}

624

kept.insert(key, (personal, now));

});

Ok(personal)

}

/// Makes a run and its jobs, and starts what can start. `None` when the

630

/// event already started this workflow.

631

pub async fn create_run(&self, new: NewRun) -> Result<Option<String>> {

632

self.create_run_with(new, false).await

633

}

634

635

/// As `create_run`, but the run's pending status must reach Work: one

636

/// that cannot is cancelled and the error returned, so that a caller

637

/// waiting on statuses (the merge queue) never reads "no workflows" or

638

/// a premature pass from a run nothing was told about.

639

pub async fn create_run_registered(&self, new: NewRun) -> Result<Option<String>> {

640

self.create_run_with(new, true).await

641

}

642

643

async fn create_run_with(&self, new: NewRun, strict: bool) -> Result<Option<String>> {

644

// Nothing starts on an archived repository. A deleted one is never

645

// found to start anything on.

646

if new.repo.archived() {

647

return Ok(None);

648

}

649

// Nor while its Actions are off (Settings, Actions; a fork's are

650

// until someone turns them on), whatever started it. This is the

651

// gate; read once per request, so the runs of one push share it.

652

if !self.actions_on(&new.repo).await? {

653

return Ok(None);

654

}

655

let workflow_row = self.workflow_row(&new.repo, &new.path, &new.workflow.display_name(&new.path), &new.source).await?;

656

let numbered = self

657

.db

658

.prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")

659

.bind(&[workflow_row.id.as_str().into()])?

660

.first::<Count>(None)

661

.await?

662

.map_or(1, |count| count.n);

663

let id = new_id("run", now_ms());

664

let mut info = new.info.clone();

665

// A personal workspace's repositories are a `User`'s, as on GitHub.

666

if self.personal_namespace(&new.repo.namespace).await? {

667

crate::payload::owned_by_person(&mut info.event, &new.repo.namespace);

668

}

669

info.workflow = new.workflow.display_name(&new.path);

670

info.workflow_path = new.path.clone();

671

info.run_id = id.clone();

672

info.run_number = u64::from(numbered);

673

let vars = self

674

.variables_for(&new.repo.id, &format!("{}/{}", new.repo.namespace, new.repo.name), None, new.trusted)

675

.await?;

676

677

// run-name and the concurrency group read github, inputs and vars.

678

let mut contexts = Map::new();

679

contexts.insert("github".into(), info.context("", "", new.action.as_deref()));

680

contexts.insert("inputs".into(), Value::Object(new.inputs.clone()));

681

contexts.insert("vars".into(), Value::Object(vars));

682

let scope = Scope {

683

contexts: &contexts,

684

status: Status::Success,

hash_files: None,

};

let title = new

.workflow

.run_name

.as_deref()

.and_then(|run_name| expr::interpolate(run_name, &scope).ok())

692

.filter(|title| !title.trim().is_empty())

693

.unwrap_or(new.title.clone());

694

let group = new.workflow.concurrency.as_ref().and_then(|c| expr::interpolate(&c.group, &scope).ok());

695

let cancel_in_progress = new

.workflow

.concurrency

.as_ref()

.and_then(|c| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())

700

.is_some_and(|value| expr::truthy(&value));

701

702

let approval = new.approval.as_ref().map(|reason| RunApproval { state: "required".into(), reason: reason.clone(), approved_by: None });

let inserted = self

.db

.prepare(

"INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, action, git_ref, sha,

707

pull, status, actor, actor_id, source, info, inputs, trusted, concurrency_group, event_key, created_at,

708

approval, cancel_in_progress)

709

VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id",

)

.bind(&[

id.as_str().into(),

workflow_row.id.as_str().into(),

714

new.repo.id.as_str().into(),

715

format!("{}/{}", new.repo.namespace, new.repo.name).into(),

716

new.path.as_str().into(),

717

info.workflow.as_str().into(),

718

title.as_str().into(),

719

numbered.into(),

720

info.event_name.as_str().into(),

721

optional(new.action.as_deref()),

722

info.git_ref.as_str().into(),

723

new.head_sha.as_deref().unwrap_or(&info.sha).into(),

724

new.pull.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),

725

if approval.is_some() { "action_required" } else { "queued" }.into(),

726

optional(new.actor.as_deref()),

727

optional(new.actor_id.as_deref()),

728

new.source.as_str().into(),

729

serde_json::to_string(&info)?.into(),

730

serde_json::to_string(&new.inputs)?.into(),

731

u32::from(new.trusted).into(),

732

optional(group.as_deref()),

733

new.event_key.as_str().into(),

734

now().into(),

735

approval.as_ref().map(serde_json::to_string).transpose()?.as_deref().map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),

736

u32::from(cancel_in_progress).into(),

737

])?

738

.first::<Value>(None)

739

.await?;

740

if inserted.is_none() {

741

return Ok(None);

742

}

743

let mut unregistered = None;

744

if let Some(run) = self.run_row(&id).await? {

745

if strict {

746

if let Err(error) = self.try_report_pending(&run).await {

747

unregistered = Some((run, error));

748

}

749

} else {

750

self.report_pending(&run).await?;

}

}

// Every job, waiting; each is expanded when the jobs it needs are done.

755

let mut statements = Vec::new();

756

for job in &new.workflow.jobs {

statements.push(

self.db

.prepare(

"INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting')",

761

)

762

.bind(&[

763

new_id("job", now_ms()).into(),

764

id.as_str().into(),

765

new.repo.id.as_str().into(),

766

new.repo.namespace.as_str().into(),

767

job.id.as_str().into(),

768

job.name.clone().filter(|n| !expr::has_expression(n)).unwrap_or(job.id.clone()).into(),

769

serde_json::to_string(&job.needs)?.into(),

])?,

);

}

self.db.batch(statements).await?;

774

if let Some((run, error)) = unregistered {

775

self.cancel_run(&run, "Its pending status could not be registered.", false).await?;

return Err(error);

}

// A pull request's run from outside waits to be approved; it joins

780

// its concurrency group once it is (protection.rs, approve_run).

781

if approval.is_some() {

782

return Ok(Some(id));

783

}

784

if let Some(run) = self.run_row(&id).await? {

785

self.enter_group(&run).await?;

}

Ok(Some(id))

}

/// A run about to start: one run at a time per concurrency group, as on

791

/// GitHub. A newer run replaces one that waits in the group, and with

792

/// `cancel-in-progress` the one that runs; otherwise it waits as

793

/// `pending` for the one that runs. Then it moves along.

794

pub(crate) async fn enter_group(&self, run: &RunRow) -> Result<()> {

795

if let Some(group) = &run.concurrency_group {

796

let cancel_in_progress = run.cancel_in_progress != 0;

let others = self

.db

.prepare(

"SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND id != ? AND status NOT IN ('completed', 'action_required') ORDER BY id",

801

)

802

.bind(&[run.repo_id.as_str().into(), group.as_str().into(), run.id.as_str().into()])?

803

.all()

804

.await?

805

.results::<RunRow>()?;

806

for other in &others {

807

if cancel_in_progress || other.status == "pending" {

808

// A newer run replaces a waiting one, as on GitHub.

809

self.cancel_run(other, "A newer run in the same concurrency group replaced it.", false).await?;

810

}

811

}

812

if !cancel_in_progress && others.iter().any(|other| other.status != "pending") {

813

self.db

814

.prepare("UPDATE runs SET status = 'pending' WHERE id = ?")

815

.bind(&[run.id.as_str().into()])?

.run()

.await?;

return Ok(());

}

}

self.advance(&run.id).await

822

}

823

824

/// A run that could not start, such as for a workflow file that does

825

/// not read. None while `repo`'s Actions are off, as for `create_run`.

826

#[allow(clippy::too_many_arguments)]

827

pub async fn record_failed_run(

&self,

repo: &Repo,

row: &WorkflowRow,

git_ref: &str,

sha: &str,

event_key: &str,

actor_id: Option<&str>,

actor: &str,

problem: &str,

) -> Result<()> {

if !self.actions_on(repo).await? {

return Ok(());

}

let numbered = self

.db

.prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")

844

.bind(&[row.id.as_str().into()])?

845

.first::<Count>(None)

846

.await?

847

.map_or(1, |count| count.n);

let at = now();

self.db

.prepare(

"INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, git_ref, sha, status,

852

conclusion, error, actor, actor_id, source, info, event_key, created_at, finished_at)

853

VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'push', ?, ?, 'completed', 'failure', ?, ?, ?, ?, '{}', ?, ?, ?)",

854

)

855

.bind(&[

856

new_id("run", now_ms()).into(),

857

row.id.as_str().into(),

858

row.repo_id.as_str().into(),

859

row.repo.as_str().into(),

860

row.path.as_str().into(),

861

row.path.as_str().into(),

862

"Invalid workflow file".into(),

numbered.into(),

git_ref.into(),

sha.into(),

problem.into(),

actor.into(),

optional(actor_id),

row.source.as_str().into(),

event_key.into(),

at.as_str().into(),

at.as_str().into(),

])?

.run()

.await?;

Ok(())

}

/// Moves a run along: jobs whose needs are done are decided on, and

880

/// jobs that can start are started.

881

pub async fn advance(&self, run_id: &str) -> Result<()> {

882

// Each pass may finish jobs (skipped ones), which may free others.

883

for _ in 0..20 {

884

let Some(run) = self.run_row(run_id).await? else { return Ok(()) };

885

if matches!(run.status.as_str(), "completed" | "pending" | "action_required") {

886

return Ok(());

887

}

888

let workflow = match workflow::parse(&run.source) {

889

Ok(workflow) => workflow,

890

Err(problem) => {

891

self.finish_run(&run, Some(&problem)).await?;

return Ok(());

}

};

let jobs = self.job_rows(run_id).await?;

896

let mut changed = false;

897

// What to decide on: the workflow's jobs, and the jobs of the

898

// workflows they call, each with its needs as (name, key).

899

let mut units: Vec<Unit> = workflow

900

.jobs

901

.iter()

902

.map(|job| (job.id.clone(), job.clone(), job.needs.iter().map(|n| (n.clone(), n.clone())).collect()))

903

.collect();

904

let mut seen = std::collections::HashSet::new();

905

for row in &jobs {

906

if !seen.insert(row.key.clone()) {

907

continue;

908

}

909

if let Some((_, job, call)) = row.callee() {

910

let parent = call["parent"].as_str().unwrap_or_default().to_owned();

911

let needs = job.needs.iter().map(|n| (n.clone(), format!("{parent}/{n}"))).collect();

912

units.push((row.key.clone(), job, needs));

913

}

914

}

915

// Each key's needs, as keys, to look back through for failure().

916

let needs_of: std::collections::HashMap<&str, Vec<&str>> =

917

units.iter().map(|(key, _, needs)| (key.as_str(), needs.iter().map(|(_, need)| need.as_str()).collect())).collect();

918

let key_failed = |key: &str| key_result(&jobs.iter().filter(|row| row.key == key).collect::<Vec<_>>()) == "failure";

919

for (key, job, needs) in &units {

920

let rows: Vec<&JobRow> = jobs.iter().filter(|row| &row.key == key).collect();

921

if rows.is_empty() || !rows.iter().all(|row| row.status == "waiting" && !row.holds_call()) {

922

continue;

923

}

924

let needed: Vec<(&String, Vec<&JobRow>)> =

925

needs.iter().map(|(name, need)| (name, jobs.iter().filter(|row| &row.key == need).collect())).collect();

926

if !needed.iter().all(|(_, rows)| rows.iter().all(|row| row.status == "completed")) {

927

continue;

928

}

929

let failed_before = ancestor_failed(&needs_of, key, key_failed);

930

self.decide(&run, job, rows[0], &needed, failed_before).await?;

931

changed = true;

932

}

933

// A job that called a workflow finishes with that workflow's jobs.

934

for row in jobs.iter().filter(|row| row.status == "calling") {

935

let prefix = row.call_prefix().unwrap_or(row.key.clone());

936

let children: Vec<&JobRow> = jobs

937

.iter()

938

.filter(|child| child.call().is_some_and(|call| call["role"] == "callee" && call["parent"].as_str() == Some(prefix.as_str())))

939

.collect();

940

if !children.is_empty() && children.iter().all(|child| child.status == "completed") {

941

self.finish_call(&run, row, &children).await?;

changed = true;

}

}

// Calls that wait start while their matrix's `max-parallel` and

946

// their concurrency group have room.

947

let mut calling: std::collections::HashMap<&str, u32> = std::collections::HashMap::new();

948

for row in jobs.iter().filter(|row| row.status == "calling") {

949

*calling.entry(row.key.as_str()).or_default() += 1;

950

}

951

for row in jobs.iter().filter(|row| row.holds_call()) {

952

let running = calling.get(row.key.as_str()).copied().unwrap_or(0);

953

if row.max_parallel.is_some_and(|max| running >= max) || self.group_busy(row).await? {

954

continue;

955

}

956

if self.start_call(row).await? {

957

calling.insert(row.key.as_str(), running + 1);

changed = true;

}

}

if !changed {

break;

}

}

self.start_queued().await?;

966

self.finish_if_done(run_id).await

967

}

968

969

/// Decides on one job whose needs are done: skip it, fail it, or expand

970

/// it into its matrix and queue it. `failed_before`: whether any job

971

/// before it failed, however far back (`ancestor_failed`).

972

async fn decide(&self, run: &RunRow, job: &workflow::Job, row: &JobRow, needed: &[(&String, Vec<&JobRow>)], failed_before: bool) -> Result<()> {

973

let vars = self.variables_for(&run.repo_id, &run.repo, None, run.trusted != 0).await?;

974

let mut contexts = Self::base_contexts(run, &vars, &job.id);

975

// A called workflow's jobs read the inputs they were called with.

976

let call = row.call();

977

// Shown under the job whose call made it, by that job's name.

978

let caller = call.as_ref().filter(|c| c["role"] == "callee").and_then(|c| {

979

c["title"].as_str().map(str::to_owned).or_else(|| c["parent"].as_str().map(|parent| parent.replace('/', " / ")))

980

});

981

if let Some(call) = call.as_ref().filter(|c| c["role"] == "callee") {

982

contexts.insert("inputs".into(), call["inputs"].clone());

983

}

984

let mut needs = Map::new();

985

let mut results = Vec::new();

986

for (key, rows) in needed {

987

let result = key_result(rows);

988

let mut outputs = Map::new();

989

for row in rows {

990

if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {

991

outputs.extend(more);

992

}

993

}

994

results.push(result);

995

needs.insert((*key).clone(), json!({ "result": result, "outputs": outputs }));

996

}

997

// As on GitHub: a need that was skipped makes success() false but

998

// not failure(); failure() is a failure anywhere before the job.

999

let status = expr::job_status(results, failed_before, run.conclusion.as_deref() == Some("cancelled"));

1000

contexts.insert("needs".into(), Value::Object(needs));

let scope = Scope {

contexts: &contexts,

status,

hash_files: None,

};

let condition = job.condition.as_deref().unwrap_or_default();

1007

match expr::condition(condition, &scope) {

1008

Ok(true) => {}

1009

Ok(false) => return self.skip_job(row, None).await,

1010

Err(problem) => return self.fail_job(row, &format!("Its `if` does not read: {problem}")).await,

1011

}

1012

// Its matrix, which may come from a needed job's outputs.

1013

let combinations = match &job.matrix {

1014

None => vec![Map::new()],

1015

Some(matrix) => {

1016

let value = match expr::interpolate_value(matrix, &scope) {

1017

Ok(value) => value,

1018

Err(problem) => return self.fail_job(row, &format!("Its matrix does not read: {problem}")).await,

1019

};

1020

match matrix::expand(&value) {

1021

Ok(combinations) if !combinations.is_empty() => combinations,

1022

Ok(_) => return self.fail_job(row, "Its matrix makes no jobs.").await,

1023

Err(problem) => return self.fail_job(row, &problem).await,

}

}

};

// A job that calls a reusable workflow calls it once for each.

1028

if let Some(uses) = &job.uses {

1029

return self.call_workflow(run, job, row, uses, &contexts, &combinations, caller.as_deref()).await;

1030

}

1031

let total = combinations.len();

1032

let raw = job.raw.as_object().cloned().unwrap_or_default();

1033

// Whether pull requests from forks may use self-hosted runners here,

1034

// asked once, and only for a run that is not trusted.

1035

let mut forks_allowed: Option<bool> = None;

1036

// Each concurrency group its jobs join, and whether it cancels.

1037

let mut groups: Vec<(String, bool)> = Vec::new();

1038

let mut statements = Vec::new();

1039

for (index, combination) in combinations.iter().enumerate() {

1040

let mut contexts = contexts.clone();

1041

contexts.insert("matrix".into(), Value::Object(combination.clone()));

1042

contexts.insert(

1043

"strategy".into(),

1044

json!({ "fail-fast": job.fail_fast, "job-index": index, "job-total": total, "max-parallel": job.max_parallel.unwrap_or(total as u32) }),

);

let scope = Scope {

contexts: &contexts,

status: Status::Success,

1049

hash_files: None,

1050

};

1051

let name = shown_name(job, caller.as_deref(), combination, &scope);

1052

let runs_on = expr::interpolate_value(&job.runs_on, &scope).unwrap_or(Value::Null);

1053

let labels = match &runs_on {

1054

Value::String(label) => vec![label.clone()],

1055

Value::Array(labels) => labels.iter().map(expr::to_text).collect(),

1056

Value::Object(spec) => spec.get("labels").map(|l| match l {

1057

Value::Array(labels) => labels.iter().map(expr::to_text).collect(),

1058

other => vec![expr::to_text(other)],

1059

}).unwrap_or_default(),

1060

_ => Vec::new(),

1061

};

1062

// `runs-on: self-hosted` (or a group): the workspace's own

1063

// machines, which may run any OS. Otherwise g1t's Linux sandboxes.

1064

let group = match &runs_on {

1065

Value::Object(spec) => spec.get("group").map(expr::to_text),

1066

_ => None,

1067

};

1068

let wanted = Wanted::of(&labels, group.as_deref());

1069

let mut reason = if wanted.self_hosted {

None

} else {

labels

.iter()

.find(|label| {

let lower = label.to_ascii_lowercase();

1076

lower.contains("windows") || lower.contains("macos")

1077

})

1078

.map(|label| {

1079

let os = if label.to_ascii_lowercase().contains("windows") { "windows" } else { "macos" };

1080

format!("`runs-on: {label}`: g1t's own runners are Linux. A self-hosted runner can run it: `runs-on: [self-hosted, {os}]`.")

1081

})

1082

};

1083

// A pull request from a fork runs code anyone could write: never

1084

// on the workspace's machines unless it said they may.

1085

if wanted.self_hosted && run.trusted == 0 {

1086

let allowed = match forks_allowed {

1087

Some(allowed) => allowed,

1088

None => {

1089

let allowed = self.effective_runner_settings(&row.namespace, Some(&run.repo_id)).await?.fork_pull_requests;

1090

forks_allowed = Some(allowed);

allowed

}

};

if !allowed {

reason = Some(

"Pull requests from forks do not run on self-hosted runners here. An admin can allow it under Settings, Runners.".to_owned(),

);

}

}

let max_minutes = if wanted.self_hosted { SELF_HOSTED_MAX_TIMEOUT_MINUTES } else { MAX_TIMEOUT_MINUTES };

1101

let timeout = raw

1102

.get("timeout-minutes")

1103

.and_then(|value| expr::interpolate_value(value, &scope).ok())

1104

.and_then(|value| value.as_f64().or_else(|| expr::to_text(&value).parse().ok()))

1105

.map_or(g1t_actions::workflow::DEFAULT_TIMEOUT_MINUTES.min(max_minutes), |minutes| (minutes.ceil() as u32).clamp(1, max_minutes));

1106

let continue_on_error = raw

1107

.get("continue-on-error")

1108

.and_then(|value| expr::interpolate_value(value, &scope).ok())

1109

.is_some_and(|value| expr::truthy(&value));

1110

let (mut status, mut conclusion, mut finished) = match &reason {

1111

Some(_) => ("completed", Some("failure"), Some(now())),

1112

None => ("queued", None, None),

1113

};

1114

// A self-hosted job waits, saying for what, until a runner takes it.

1115

let (labels_json, queued_at) = if wanted.self_hosted && reason.is_none() {

1116

reason = Some(waiting_reason(&wanted));

1117

(Some(serde_json::to_string(&wanted.stored())?), Some(now()))

} else {

(None, None)

};

// The environment it names, an expression read now, and what

1122

// that environment's protection rules say: it starts, waits as

1123

// `pending` (protection.rs), or may not deploy there.

1124

let environment = environment_of(&job.raw, &contexts).map(|env| env.name);

1125

if status == "queued"

1126

&& let Some(name) = &environment

1127

{

1128

match self.gate(run, name).await? {

Gate::Open => {}

Gate::Held(why) => {

status = "pending";

reason = Some(why);

}

Gate::Refused(why) => {

1135

(status, conclusion, finished) = ("completed", Some("failure"), Some(now()));

reason = Some(why);

}

}

}

// Its own concurrency group.

let job_group = job

.concurrency

.as_ref()

.and_then(|c| expr::interpolate(&c.group, &scope).ok())

1145

.map(|group| group.trim().to_owned())

1146

.filter(|group| !group.is_empty());

let job_cancel = job

.concurrency

.as_ref()

.and_then(|c| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())

1151

.is_some_and(|value| expr::truthy(&value));

1152

if status != "completed"

1153

&& let Some(group) = &job_group

1154

&& !groups.iter().any(|(known, _)| known == group)

1155

{

1156

groups.push((group.clone(), job_cancel));

1157

}

1158

let values: Vec<worker::wasm_bindgen::JsValue> = vec![

1159

name.into(),

1160

serde_json::to_string(combination)?.into(),

1161

status.into(),

1162

optional(conclusion),

1163

optional(reason.as_deref()),

1164

timeout.into(),

1165

u32::from(continue_on_error).into(),

1166

job.max_parallel.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),

1167

optional(finished.as_deref()),

1168

optional(labels_json.as_deref()),

1169

optional(queued_at.as_deref()),

1170

optional(environment.as_deref()),

1171

optional(job_group.as_deref()),

1172

u32::from(job_cancel).into(),

1173

];

1174

if index == 0 {

1175

let mut bound = values;

1176

bound.push(row.id.as_str().into());

statements.push(

self.db

.prepare(

"UPDATE jobs SET name = ?, matrix = ?, status = ?, conclusion = ?, reason = ?, timeout_minutes = ?,

1181

continue_on_error = ?, max_parallel = ?, finished_at = ?, labels = ?, queued_at = ?, environment = ?,

1182

concurrency_group = ?, cancel_in_progress = ? WHERE id = ?",

)

.bind(&bound)?,

);

} else {

let mut bound: Vec<worker::wasm_bindgen::JsValue> = vec![

1188

new_id("job", now_ms()).into(),

1189

row.run_id.as_str().into(),

1190

row.repo_id.as_str().into(),

1191

row.namespace.as_str().into(),

1192

row.key.as_str().into(),

1193

(index as u32).into(),

1194

row.needs.as_str().into(),

1195

optional(row.call.as_deref()),

1196

];

1197

bound.extend(values);

statements.push(

self.db

.prepare(

"INSERT INTO jobs (id, run_id, repo_id, namespace, key, ordinal, needs, call, name, matrix, status, conclusion, reason,

1202

timeout_minutes, continue_on_error, max_parallel, finished_at, labels, queued_at, environment,

1203

concurrency_group, cancel_in_progress)

1204

VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",

)

.bind(&bound)?,

);

}

}

self.db.batch(statements).await?;

1211

self.replace_in_groups(run, &row.key, &groups).await

1212

}

1213

1214

/// A job queued in its own concurrency group: with `cancel-in-progress`

1215

/// it cancels the group's other jobs; otherwise it replaces any that

1216

/// are queued and not started, and waits for the one running

1217

/// (`start_queued` starts one of a group at a time). As on GitHub.

1218

async fn replace_in_groups(&self, run: &RunRow, key: &str, groups: &[(String, bool)]) -> Result<()> {

1219

if groups.is_empty() {

1220

return Ok(());

1221

}

1222

#[derive(Deserialize)]

struct Id {

id: String,

}

let mine: Vec<String> = self

1227

.db

1228

.prepare("SELECT id FROM jobs WHERE run_id = ? AND key = ?")

1229

.bind(&[run.id.as_str().into(), key.into()])?

.all()

.await?

.results::<Id>()?

.into_iter()

.map(|row| row.id)

.collect();

let mut moved: Vec<String> = Vec::new();

1237

for (group, cancel) in groups {

1238

let others = self

1239

.db

1240

// A call that waits in the group, or calls, is in it too.

1241

.prepare("SELECT * FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status IN ('waiting', 'queued', 'pending', 'in_progress', 'calling')")

1242

.bind(&[run.repo_id.as_str().into(), group.as_str().into()])?

1243

.all()

1244

.await?

1245

.results::<JobRow>()?;

1246

for other in others.iter().filter(|other| !mine.contains(&other.id)) {

1247

if *cancel || matches!(other.status.as_str(), "queued" | "waiting") {

1248

self.stop_job(other, "A newer job in the same concurrency group replaced it.").await?;

1249

if !moved.contains(&other.run_id) {

1250

moved.push(other.run_id.clone());

}

}

}

}

for other_run in moved.iter().filter(|id| **id != run.id) {

1256

Box::pin(self.advance(other_run)).await?;

}

Ok(())

}

/// A job that calls a reusable workflow, in the repository or another

1262

/// (reach.rs): once for each combination of its matrix, as on GitHub,

1263

/// each with the inputs and secrets it passes read with that

1264

/// combination's `matrix`. Each call waits (`holds_call`) until its

1265

/// matrix's `max-parallel` and its concurrency group have room, when

1266

/// `start_call` puts the workflow's jobs in the run under it.

1267

#[allow(clippy::too_many_arguments)]

1268

async fn call_workflow(

&self,

run: &RunRow,

job: &workflow::Job,

row: &JobRow,

uses: &str,

contexts: &Map<String, Value>,

1275

combinations: &[Map<String, Value>],

1276

caller: Option<&str>,

1277

) -> Result<()> {

1278

let depth = row.call().and_then(|c| c["depth"].as_u64()).unwrap_or(0) + 1;

1279

if depth > MAX_CALL_DEPTH {

1280

return self.fail_job(row, &call_allowed(depth, &[], uses).unwrap_err()).await;

1281

}

1282

let (file, source, origin) = match self.called_workflow(run, row, uses).await? {

1283

Ok(found) => found,

1284

Err(why) => return self.fail_job(row, &why).await,

1285

};

1286

let jobs = self.job_rows(&run.id).await?;

1287

// Each call so far, by the workflow it called.

1288

let called_paths: Vec<String> = jobs

1289

.iter()

1290

.filter(|other| other.call_prefix().is_some())

1291

.filter_map(JobRow::call)

1292

.filter_map(|call| call["path"].as_str().map(str::to_owned))

1293

.collect();

1294

let called_already: Vec<&str> = called_paths.iter().map(String::as_str).collect();

1295

if let Err(why) = call_allowed(depth, &called_already, &file) {

1296

return self.fail_job(row, &why).await;

1297

}

1298

let called = match workflow::parse(&source) {

1299

Ok(called) => called,

1300

Err(problem) => return self.fail_job(row, &format!("`{file}` does not read: {problem}")).await,

1301

};

1302

let Some(trigger) = called.trigger("workflow_call") else {

1303

return self.fail_job(row, &format!("`{file}` cannot be called: it has no `on: workflow_call`.")).await;

1304

};

1305

// Secrets: none but the job's token unless `secrets:` passes them,

1306

// by name or with `inherit`; read when each job starts (job_spec).

1307

let outer = row.call().filter(|c| c["role"] == "callee").and_then(|c| c.get("secrets").cloned());

1308

let total = combinations.len();

1309

let mut groups: Vec<(String, bool)> = Vec::new();

1310

let mut statements = Vec::new();

1311

for (index, combination) in combinations.iter().enumerate() {

1312

let mut contexts = contexts.clone();

1313

contexts.insert("matrix".into(), Value::Object(combination.clone()));

1314

contexts.insert(

1315

"strategy".into(),

1316

json!({ "fail-fast": job.fail_fast, "job-index": index, "job-total": total, "max-parallel": job.max_parallel.unwrap_or(total as u32) }),

1317

);

1318

let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };

1319

let name = shown_name(job, caller, combination, &scope);

1320

// Inputs: what `with:` passes, as the called workflow types them.

1321

let given = match job.raw.get("with") {

1322

Some(with) => match expr::interpolate_value(with, &scope) {

1323

Ok(Value::Object(given)) => Ok(given),

1324

Ok(_) => Ok(Map::new()),

1325

Err(problem) => Err(format!("Its `with` does not read: {problem}")),

1326

},

1327

None => Ok(Map::new()),

1328

};

1329

let inputs = given.and_then(|given| crate::reach::call_inputs(&file, &trigger.inputs, &given));

1330

let secrets = crate::reach::secrets_plan(&job.raw, &contexts, outer.clone());

1331

let problem = match &inputs {

1332

Err(why) => Some(why.clone()),

1333

Ok(_) => crate::reach::missing_secrets(&called.raw, &secrets)

1334

.first()

1335

.map(|name| format!("`{file}` needs the secret `{name}`: pass it under `secrets:`, or use `secrets: inherit`."))

1336

.or_else(|| {

1337

crate::reach::undeclared_secrets(&called.raw, &secrets)

1338

.first()

1339

.map(|name| format!("Invalid secret: `{name}` is not defined in `{file}`."))

1340

}),

1341

};

1342

// Its own concurrency group, which it holds while its workflow runs.

let group = job

.concurrency

.as_ref()

.and_then(|c| expr::interpolate(&c.group, &scope).ok())

1347

.map(|group| group.trim().to_owned())

1348

.filter(|group| !group.is_empty());

let cancel = job

.concurrency

.as_ref()

.and_then(|c| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())

1353

.is_some_and(|value| expr::truthy(&value));

1354

if problem.is_none()

1355

&& let Some(group) = &group

1356

&& !groups.iter().any(|(known, _)| known == group)

1357

{

1358

groups.push((group.clone(), cancel));

1359

}

1360

let call = json!({

1361

"role": "caller", "path": file, "source": source, "origin": origin, "depth": depth,

1362

"prefix": call_prefix(&row.key, job.matrix.is_some().then_some(index)), "title": name,

1363

"inputs": inputs.unwrap_or_default(), "secrets": secrets, "fail_fast": job.fail_fast,

1364

});

1365

let (status, conclusion, finished) = match &problem {

1366

Some(_) => ("completed", Some("failure"), Some(now())),

1367

None => ("waiting", None, None),

1368

};

1369

let values: Vec<worker::wasm_bindgen::JsValue> = vec![

1370

name.as_str().into(),

1371

serde_json::to_string(combination)?.into(),

1372

status.into(),

1373

optional(conclusion),

1374

optional(problem.as_deref()),

1375

job.max_parallel.map(|max| max.max(1)).map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),

1376

optional(finished.as_deref()),

1377

optional(group.as_deref()),

1378

u32::from(cancel).into(),

1379

serde_json::to_string(&call)?.into(),

1380

];

1381

if index == 0 {

1382

let mut bound = values;

1383

bound.push(row.id.as_str().into());

statements.push(

self.db

.prepare(

"UPDATE jobs SET name = ?, matrix = ?, status = ?, conclusion = ?, reason = ?, max_parallel = ?, finished_at = ?,

1388

concurrency_group = ?, cancel_in_progress = ?, call = ? WHERE id = ?",

)

.bind(&bound)?,

);

} else {

let mut bound: Vec<worker::wasm_bindgen::JsValue> = vec![

1394

new_id("job", now_ms()).into(),

1395

row.run_id.as_str().into(),

1396

row.repo_id.as_str().into(),

1397

row.namespace.as_str().into(),

1398

row.key.as_str().into(),

1399

(index as u32).into(),

1400

row.needs.as_str().into(),

1401

];

1402

bound.extend(values);

statements.push(

self.db

.prepare(

"INSERT INTO jobs (id, run_id, repo_id, namespace, key, ordinal, needs, name, matrix, status, conclusion, reason,

1407

max_parallel, finished_at, concurrency_group, cancel_in_progress, call)

1408

VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",

)

.bind(&bound)?,

);

}

}

self.db.batch(statements).await?;

1415

self.replace_in_groups(run, &row.key, &groups).await

1416

}

1417

1418

/// Whether another job of `row`'s concurrency group runs, or calls a

1419

/// workflow, so that `row` waits for it.

1420

async fn group_busy(&self, row: &JobRow) -> Result<bool> {

1421

let Some(group) = &row.concurrency_group else { return Ok(false) };

1422

let busy = self

1423

.db

1424

.prepare("SELECT COUNT(*) AS n FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status IN ('in_progress', 'calling') AND id != ?")

1425

.bind(&[row.repo_id.as_str().into(), group.as_str().into(), row.id.as_str().into()])?

1426

.first::<Count>(None)

1427

.await?

1428

.map_or(0, |count| count.n);

Ok(busy > 0)

}

/// A call that waited (`holds_call`) is made: the called workflow's

1433

/// jobs join the run under it, named under its name and keyed under its

1434

/// prefix. False when it no longer waits.

1435

async fn start_call(&self, row: &JobRow) -> Result<bool> {

1436

let Some(call) = row.call() else { return Ok(false) };

1437

let Some(prefix) = row.call_prefix() else { return Ok(false) };

1438

let Some(called) = call["source"].as_str().and_then(|source| workflow::parse(source).ok()) else { return Ok(false) };

1439

let file = call["path"].as_str().unwrap_or_default();

1440

let started = self

1441

.db

1442

.prepare("UPDATE jobs SET status = 'calling', reason = ?, started_at = ? WHERE id = ? AND status = 'waiting' RETURNING id")

1443

.bind(&[format!("Calls `{file}`.").into(), now().into(), row.id.as_str().into()])?

1444

.first::<Value>(None)

1445

.await?;

1446

if started.is_none() {

1447

return Ok(false);

1448

}

1449

let mut statements = Vec::new();

1450

for called_job in &called.jobs {

1451

let needs: Vec<String> = called_job.needs.iter().map(|n| format!("{prefix}/{n}")).collect();

1452

let callee = json!({

1453

"role": "callee", "parent": prefix, "title": row.name, "job": called_job.id, "path": file,

1454

"source": call["source"], "inputs": call["inputs"], "depth": call["depth"], "origin": call["origin"], "secrets": call["secrets"],

});

statements.push(

self.db

.prepare("INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status, call) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting', ?)")

1459

.bind(&[

1460

new_id("job", now_ms()).into(),

1461

row.run_id.as_str().into(),

1462

row.repo_id.as_str().into(),

1463

row.namespace.as_str().into(),

1464

format!("{prefix}/{}", called_job.id).into(),

1465

format!("{} / {}", row.name, called_job.name.clone().unwrap_or(called_job.id.clone())).into(),

1466

serde_json::to_string(&needs)?.into(),

1467

serde_json::to_string(&callee)?.into(),

])?,

);

}

if !statements.is_empty() {

1472

self.db.batch(statements).await?;

}

Ok(true)

}

/// The runs with a call waiting in `group`, but `run_id`, moved along

1478

/// now that a job of the group has finished.

1479

async fn wake_group(&self, repo_id: &str, group: &str, run_id: &str) -> Result<()> {

1480

#[derive(Deserialize)]

struct RunId {

run_id: String,

}

let waiting = self

.db

.prepare("SELECT DISTINCT run_id FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status = 'waiting' AND run_id != ?")

1487

.bind(&[repo_id.into(), group.into(), run_id.into()])?

1488

.all()

1489

.await?

1490

.results::<RunId>()?;

1491

for other in waiting {

1492

Box::pin(self.advance(&other.run_id)).await?;

}

Ok(())

}

/// A job that called a workflow, finished with its jobs: their result,

1498

/// and the outputs the workflow declares. A failed call of a fail-fast

1499

/// matrix stops the matrix's other calls.

1500

async fn finish_call(&self, run: &RunRow, row: &JobRow, children: &[&JobRow]) -> Result<()> {

1501

let call = row.call().unwrap_or_default();

1502

let called = call["source"].as_str().and_then(|s| workflow::parse(s).ok());

1503

let mut jobs_context = Map::new();

1504

let mut by_key: std::collections::BTreeMap<String, Vec<&JobRow>> = std::collections::BTreeMap::new();

1505

for child in children {

1506

by_key.entry(child.key.clone()).or_default().push(child);

1507

}

1508

for (key, rows) in &by_key {

1509

let mut outputs = Map::new();

1510

for child in rows {

1511

if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&child.outputs) {

1512

outputs.extend(more);

1513

}

1514

}

1515

let id = key.rsplit('/').next().unwrap_or(key);

1516

jobs_context.insert(id.to_owned(), json!({ "result": key_result(rows), "outputs": outputs }));

1517

}

1518

let inputs = children.first().and_then(|c| c.call()).map(|c| c["inputs"].clone()).unwrap_or(json!({}));

1519

let mut contexts = Map::new();

1520

contexts.insert("jobs".into(), Value::Object(jobs_context));

1521

contexts.insert("inputs".into(), inputs);

1522

let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };

1523

let mut outputs = Map::new();

1524

if let Some(Value::Object(declared)) = called.as_ref().map(|w| {

1525

let on = w.raw.get("on").or_else(|| w.raw.get("true")).cloned().unwrap_or(Value::Null);

1526

on.get("workflow_call").and_then(|c| c.get("outputs")).cloned().unwrap_or(Value::Null)

1527

}) {

1528

for (name, spec) in declared {

1529

if let Some(value) = spec.get("value") {

1530

let value = expr::interpolate_value(value, &scope).unwrap_or(Value::Null);

1531

outputs.insert(name, Value::String(expr::to_text(&value)));

}

}

}

let conclusion = key_result(children);

1536

let finished = self

1537

.db

1538

.prepare("UPDATE jobs SET status = 'completed', conclusion = ?, outputs = ?, finished_at = ? WHERE id = ? AND status = 'calling' RETURNING id")

1539

.bind(&[conclusion.into(), serde_json::to_string(&outputs)?.into(), now().into(), row.id.as_str().into()])?

1540

.first::<Value>(None)

1541

.await?;

1542

if finished.is_none() {

1543

return Ok(());

1544

}

1545

if conclusion == "failure" && row.matrix.as_deref().is_some_and(|m| m != "{}") && call["fail_fast"] != json!(false) {

1546

let siblings = self

1547

.db

1548

.prepare("SELECT * FROM jobs WHERE run_id = ? AND key = ? AND status != 'completed'")

1549

.bind(&[row.run_id.as_str().into(), row.key.as_str().into()])?

1550

.all()

1551

.await?

1552

.results::<JobRow>()?;

1553

for sibling in siblings {

1554

self.stop_job(&sibling, "Another job of its matrix failed, and the matrix is fail-fast.").await?;

1555

}

1556

}

1557

if let Some(group) = &row.concurrency_group {

1558

self.wake_group(&run.repo_id, group, &run.id).await?;

}

Ok(())

}

/// A file's text at a commit, if it is there.

1564

pub(crate) async fn read_file(&self, path: &RepoPath, ws: &g1t_contracts::User, sha: &str, file: &str) -> Result<Option<String>> {

1565

let blob: Outcome<g1t_contracts::repos::BlobView> = g1t_kit::call(

1566

&self.repos,

1567

"blob",

1568

&g1t_contracts::repos::BlobArgs {

1569

path: path.clone(),

1570

viewer: Some(ws.clone()),

1571

git_ref: sha.to_owned(),

1572

file_path: file.to_owned(),

},

)

.await?;

Ok(match blob {

Outcome::Ok(view) => view.text,

1578

Outcome::Fail(_) => None,

})

}

async fn skip_job(&self, row: &JobRow, reason: Option<&str>) -> Result<()> {

1583

self.db

1584

.prepare("UPDATE jobs SET status = 'completed', conclusion = 'skipped', reason = ?, finished_at = ? WHERE id = ?")

1585

.bind(&[optional(reason), now().into(), row.id.as_str().into()])?

.run()

.await?;

Ok(())

}

async fn fail_job(&self, row: &JobRow, reason: &str) -> Result<()> {

1592

self.db

1593

.prepare("UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ? WHERE id = ? AND status != 'completed'")

1594

.bind(&[reason.into(), now().into(), row.id.as_str().into()])?

.run()

.await?;

Ok(())

}

/// Starts queued jobs, oldest first, while their workspace has room.

1601

pub async fn start_queued(&self) -> Result<()> {

1602

self.start_queued_except(&std::collections::HashSet::new()).await

1603

}

1604

1605

/// [`Self::start_queued`], leaving `held` for a later sweep.

1606

async fn start_queued_except(&self, held: &std::collections::HashSet<String>) -> Result<()> {

1607

let queued = self

1608

.db

1609

// Self-hosted jobs are taken by their runners (runners.rs).

1610

.prepare("SELECT * FROM jobs WHERE status = 'queued' AND labels IS NULL ORDER BY rowid LIMIT 50")

1611

.all()

1612

.await?

1613

.results::<JobRow>()?;

1614

let mut running: std::collections::HashMap<String, u32> = std::collections::HashMap::new();

1615

// Every workspace's jobs on g1t's own machines: past its share, a

1616

// workspace starts more only while the pool has room (has_room).

1617

let mut in_pool = if queued.is_empty() {

0

} else {

self.db

.prepare("SELECT COUNT(*) AS n FROM jobs WHERE status = 'in_progress' AND runner_id IS NULL")

1622

.first::<Count>(None)

1623

.await?

1624

.map_or(0, |count| count.n)

1625

};

1626

for job in queued {

1627

if held.contains(&job.id) {

1628

continue;

1629

}

1630

let in_workspace = match running.get(&job.namespace) {

Some(n) => *n,

None => {

let n = self

.db

// Only g1t's own sandboxes count against the workspace's room.

1636

.prepare("SELECT COUNT(*) AS n FROM jobs WHERE status = 'in_progress' AND namespace = ? AND runner_id IS NULL")

1637

.bind(&[job.namespace.as_str().into()])?

1638

.first::<Count>(None)

1639

.await?

1640

.map_or(0, |count| count.n);

1641

running.insert(job.namespace.clone(), n);

n

}

};

if !has_room(in_workspace, in_pool) {

1646

continue;

1647

}

1648

if let Some(max) = job.max_parallel {

1649

let siblings = self

1650

.db

1651

.prepare("SELECT COUNT(*) AS n FROM jobs WHERE run_id = ? AND key = ? AND status = 'in_progress'")

1652

.bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?

1653

.first::<Count>(None)

1654

.await?

1655

.map_or(0, |count| count.n);

if siblings >= max {

continue;

}

}

// One job of a concurrency group runs at a time.

1661

if let Some(group) = &job.concurrency_group {

1662

let running = self

1663

.db

1664

.prepare("SELECT COUNT(*) AS n FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status IN ('in_progress', 'calling') AND id != ?")

1665

.bind(&[job.repo_id.as_str().into(), group.as_str().into(), job.id.as_str().into()])?

1666

.first::<Count>(None)

1667

.await?

1668

.map_or(0, |count| count.n);

if running > 0 {

continue;

}

}

let token = random_hex(24);

let at = now();

let claimed = self

.db

.prepare(

"UPDATE jobs SET status = 'in_progress', token_hash = ?, first_token_hash = NULL, started_at = ?, seen_at = ?, waiting_since = NULL WHERE id = ? AND status = 'queued' RETURNING id",

1679

)

1680

.bind(&[sha256_hex(&token).into(), at.as_str().into(), at.as_str().into(), job.id.as_str().into()])?

1681

.first::<Value>(None)

1682

.await?;

1683

if claimed.is_none() {

1684

continue;

1685

}

1686

running.insert(job.namespace.clone(), in_workspace + 1);

1687

in_pool += 1;

1688

self.db

1689

.prepare("UPDATE runs SET status = 'in_progress', started_at = COALESCE(started_at, ?) WHERE id = ? AND status = 'queued'")

1690

.bind(&[at.as_str().into(), job.run_id.as_str().into()])?

1691

.run()

1692

.await?;

1693

let run = self.run_row(&job.run_id).await?;

1694

let repo: RepoPath = run.as_ref().map(|run| repo_path(&run.repo)).unwrap_or(RepoPath {

1695

namespace: job.namespace.clone(),

1696

1697

});

1698

// The machine it asked for, for the runner.

1699

let instance = run.as_ref().and_then(|run| start_instance(run, &job));

1700

let trusted = run.as_ref().is_some_and(|run| run.trusted != 0);

1701

// Only a trusted run's jobs get secrets, brokered ones included.

1702

let brokered = trusted && self.may_broker(&job.repo_id, &job.namespace).await?;

1703

let started: Outcome<Value> = g1t_kit::call(

&self.runner,

"start_actions_job",

&StartJobArgs {

job: job.id.clone(),

token,

repo,

timeout_minutes: job.timeout_minutes,

instance,

brokered,

},

)

.await

.unwrap_or_else(|error| fail(FailureCode::Conflict, format!("The runner could not be reached: {error}")));

1717

if let Outcome::Fail(refused) = started {

1718

// No machine free (every sandbox of its class taken, or a

1719

// rollout replacing them): back in the queue, tried again at

1720

// the next sweep, until it has waited WAIT_FOR_MACHINE_MS.

1721

// The sandboxes after it would find none either, so this

1722

// sweep starts no more.

1723

if refused.code == FailureCode::Unavailable {

1724

let since = job.waiting_since.clone().unwrap_or_else(|| at.clone());

1725

if crate::waited_for_a_machine(Some(&since), now_ms()) {

1726

let minutes = crate::WAIT_FOR_MACHINE_MS / 60_000;

1727

let reason = format!("{} None came free in {minutes} minutes.", refused.message);

1728

Box::pin(self.finish_job(&job.id, "failure", Some(&reason), None)).await?;

continue;

}

self.db

.prepare(

"UPDATE jobs SET status = 'queued', token_hash = NULL, started_at = NULL, seen_at = NULL, waiting_since = ?, reason = ?

1734

WHERE id = ? AND status = 'in_progress'",

1735

)

1736

.bind(&[since.as_str().into(), refused.message.as_str().into(), job.id.as_str().into()])?

1737

.run()

1738

.await?;

1739

worker::console_warn!("actions: job {} waits for a machine: {}", job.id, refused.message);

1740

break;

1741

}

1742

// Billing would not pay for a scheduled run's job: the

1743

// schedule waits rather than making runs only to refuse them.

1744

if refused.code == FailureCode::PaymentRequired

1745

&& let Some(run) = run.as_ref().filter(|run| run.event == "schedule")

1746

{

1747

self.db

1748

.prepare("UPDATE workflows SET schedule_refused_until = ? WHERE id = ?")

1749

.bind(&[rfc3339(now_ms() + crate::SCHEDULE_REFUSED_MS).into(), run.workflow_id.as_str().into()])?

.run()

.await?;

}

Box::pin(self.finish_job(&job.id, "failure", Some(&refused.message), None)).await?;

1754

} else {

1755

self.job_started(&job.id).await?;

}

}

Ok(())

}

/// Finishes a job and moves its run along.

1762

pub async fn finish_job(&self, job_id: &str, conclusion: &str, reason: Option<&str>, outputs: Option<&Map<String, Value>>) -> Result<()> {

let finished = self

.db

.prepare(

"UPDATE jobs SET status = 'completed', conclusion = ?, reason = COALESCE(?, reason), outputs = COALESCE(?, outputs),

1767

finished_at = ?, token_hash = NULL, first_token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *",

)

.bind(&[

conclusion.into(),

optional(reason),

outputs.map(|o| serde_json::to_string(o).unwrap_or_default()).as_deref().map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),

now().into(),

job_id.into(),

])?

.first::<JobRow>(None)

1777

.await?;

1778

let Some(job) = finished else { return Ok(()) };

1779

self.tell_live(&job.repo_id, &job.run_id, None, None).await;

1780

// Its G1T_TOKEN stops working with it.

1781

self.revoke_job_tokens(&job.id).await;

1782

// A g1t.page build it opened and did not finish fails now, not at

1783

// the deployments sweep. Only a job that ran can have opened one.

1784

if job.started_at.is_some() {

1785

self.end_job_builds(&job.id, conclusion).await;

1786

}

1787

// A job that deploys failed: so did its run's deployment, now.

1788

if conclusion == "failure" && job.continue_on_error == 0 && job.started_at.is_some()

1789

&& let Some(run) = self.run_row(&job.run_id).await?

1790

&& let Some(env) = deploys_to(&run, &job)

1791

{

1792

self.report_deployment(&run, &env, "failure", false).await;

1793

}

1794

// A self-hosted runner's job: the runner is free again, and its time

1795

// is recorded, at nothing.

1796

if job.runner_id.is_some() {

1797

self.released(&job).await?;

1798

}

1799

// Steps still marked as going are not going any more.

1800

let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();

1801

let mut touched = false;

1802

for step in steps.iter_mut() {

1803

if step["status"] != "completed" {

1804

let was_running = step["status"] == "in_progress";

1805

step["status"] = json!("completed");

1806

step["conclusion"] = json!(if was_running { conclusion } else { "skipped" });

touched = true;

}

}

if touched {

self.db

.prepare("UPDATE jobs SET steps = ? WHERE id = ?")

1813

.bind(&[serde_json::to_string(&steps)?.into(), job.id.as_str().into()])?

.run()

.await?;

}

// fail-fast: one failed combination stops the rest of its matrix.

1818

if conclusion == "failure" && job.continue_on_error == 0 && job.matrix.as_deref().is_some_and(|m| m != "{}") {

1819

let run = self.run_row(&job.run_id).await?;

1820

// As its workflow, or the workflow it is a job of, says.

1821

let fail_fast = run.as_ref().and_then(|run| job_spec(run, &job)).is_none_or(|j| j.fail_fast);

if fail_fast {

let siblings = self

.db

.prepare("SELECT * FROM jobs WHERE run_id = ? AND key = ? AND status != 'completed'")

1826

.bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?

1827

.all()

1828

.await?

1829

.results::<JobRow>()?;

1830

for sibling in siblings {

1831

self.stop_job(&sibling, "Another job of its matrix failed, and the matrix is fail-fast.").await?;

}

}

}

// A call waiting in its concurrency group, in another run, may start.

1836

if let Some(group) = &job.concurrency_group {

1837

self.wake_group(&job.repo_id, group, &job.run_id).await?;

1838

}

1839

Box::pin(self.advance(&job.run_id)).await

1840

}

1841

1842

/// Cancels a job. One that is running is told to stop (the answer to

1843

/// its next report), and runs its `if: always()` and `cancelled()`

1844

/// steps and its post steps before it ends `cancelled`; one that has

1845

/// not started is cancelled at once.

1846

async fn stop_job(&self, job: &JobRow, reason: &str) -> Result<()> {

1847

// A job calling a workflow stops with that workflow's jobs.

1848

if job.status == "calling"

1849

&& let Some(prefix) = job.call_prefix()

1850

{

1851

let under = format!("{prefix}/");

1852

for child in self.job_rows(&job.run_id).await?.iter().filter(|child| child.key.starts_with(&under) && child.status != "completed") {

1853

Box::pin(self.stop_job(child, reason)).await?;

1854

}

1855

}

1856

if job.status == "in_progress" && job.started_at.is_some() {

1857

self.db

1858

.prepare("UPDATE jobs SET cancel_requested_at = COALESCE(cancel_requested_at, ?), reason = ? WHERE id = ? AND status = 'in_progress'")

1859

.bind(&[now().into(), reason.into(), job.id.as_str().into()])?

.run()

.await?;

return Ok(());

}

self.hard_stop(job, reason).await

1865

}

1866

1867

/// Cancels a job outright, stopping its sandbox if it has one.

1868

async fn hard_stop(&self, job: &JobRow, reason: &str) -> Result<()> {

1869

// A self-hosted runner hears it was cancelled on its next poll.

1870

if job.status == "in_progress" && job.runner_id.is_none() {

1871

let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;

}

let stopped = self

.db

.prepare("UPDATE jobs SET status = 'completed', conclusion = 'cancelled', reason = ?, finished_at = ?, token_hash = NULL, first_token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *")

1876

.bind(&[reason.into(), now().into(), job.id.as_str().into()])?

1877

.first::<JobRow>(None)

1878

.await?;

1879

if stopped.as_ref().is_some_and(|row| row.started_at.is_some()) {

1880

self.revoke_job_tokens(&job.id).await;

1881

self.end_job_builds(&job.id, "cancelled").await;

1882

}

1883

if let Some(stopped) = stopped.filter(|row| row.runner_id.is_some()) {

1884

self.released(&stopped).await?;

}

Ok(())

}

/// Ends a job's tokens at once. A failure is logged: the token expires

1890

/// on its own soon after the job's time limit.

1891

async fn revoke_job_tokens(&self, job_id: &str) {

1892

let revoked: Result<bool> =

1893

g1t_kit::call(&self.identity, "revoke_job_tokens", &RevokeJobTokensArgs { job_id: job_id.to_owned() }).await;

1894

if let Err(error) = revoked {

1895

worker::console_error!("actions: the tokens of job {job_id} were not revoked: {error}");

}

}

/// Finishes the run when every job has.

1900

async fn finish_if_done(&self, run_id: &str) -> Result<()> {

1901

let Some(run) = self.run_row(run_id).await? else { return Ok(()) };

1902

if matches!(run.status.as_str(), "completed" | "pending" | "action_required") {

1903

return Ok(());

1904

}

1905

let jobs = self.job_rows(run_id).await?;

1906

if !jobs.iter().all(|job| job.status == "completed") {

1907

return Ok(());

1908

}

1909

self.finish_run(&run, None).await

1910

}

1911

1912

async fn finish_run(&self, run: &RunRow, error: Option<&str>) -> Result<()> {

1913

let jobs = self.job_rows(&run.id).await?;

1914

let rows: Vec<&JobRow> = jobs.iter().collect();

1915

let conclusion = if error.is_some() {

1916

"failure"

1917

} else if run.conclusion.as_deref() == Some("cancelled") {

1918

"cancelled"

1919

} else if rows.is_empty() {

"skipped"

} else {

key_result(&rows)

};

let done = self

.db

.prepare("UPDATE runs SET status = 'completed', conclusion = ?, error = COALESCE(?, error), finished_at = ? WHERE id = ? AND status != 'completed' RETURNING id")

1927

.bind(&[conclusion.into(), optional(error), now().into(), run.id.as_str().into()])?

1928

.first::<Value>(None)

.await?;

if done.is_none() {

return Ok(());

}

self.report_status(run, conclusion).await?;

1934

self.settle_deployments(run, &jobs, conclusion == "cancelled").await;

1935

let published: Result<()> = g1t_kit::call(

1936

&self.events,

1937

"publish",

1938

&g1t_contracts::events::Publish {

1939

events: vec![g1t_contracts::events::NewEvent {

1940

kind: "workflow.completed",

1941

source: "actions",

1942

repo_id: Some(run.repo_id.clone()),

1943

actor: run.actor_id.clone(),

1944

data: g1t_contracts::events::WorkflowEvent {

1945

run_id: run.id.clone(),

1946

repo_id: run.repo_id.clone(),

1947

workflow: run.name.clone(),

1948

path: run.path.clone(),

1949

number: run.number,

1950

event: run.event.clone(),

1951

conclusion: conclusion.to_owned(),

1952

git_ref: run.git_ref.clone(),

1953

sha: run.sha.clone(),

pull: run.pull,

},

}],

},

)

.await;

if let Err(error) = published {

1961

worker::console_error!("actions: could not publish workflow.completed: {error}");

1962

}

1963

// The next run waiting in its concurrency group.

1964

if let Some(group) = &run.concurrency_group {

1965

let next = self

1966

.db

1967

.prepare("SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND status = 'pending' ORDER BY id LIMIT 1")

1968

.bind(&[run.repo_id.as_str().into(), group.as_str().into()])?

1969

.first::<RunRow>(None)

1970

.await?;

1971

if let Some(next) = next {

1972

self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[next.id.as_str().into()])?.run().await?;

1973

Box::pin(self.advance(&next.id)).await?;

}

}

Ok(())

}

/// Tells the deployments service that a job ended (`workflow_job_ended`),

1980

/// so a build it opened with `start_from_workflow` and left open fails

1981

/// at once. Never fails the job: an answer that does not come is

1982

/// logged, and the sweep fails the build later.

1983

async fn end_job_builds(&self, job_id: &str, conclusion: &str) {

1984

let ended: Result<Value> =

1985

g1t_kit::call(&self.deployments, "workflow_job_ended", &json!({ "jobId": job_id, "conclusion": conclusion })).await;

1986

if let Err(error) = ended {

1987

worker::console_log!("actions: could not tell deployments that job {job_id} ended: {error}");

}

}

/// Tells the deployments service how a run's deployment to `env` stands:

1992

/// made when its first job naming the environment starts, failed when one

1993

/// of them fails, and settled (`last`) when the run finishes. Never fails

1994

/// the run: a deployment that could not be recorded is logged.

1995

async fn report_deployment(&self, run: &RunRow, env: &JobEnvironment, state: &str, last: bool) {

1996

let path = repo_path(&run.repo);

1997

let reported: Result<Value> = g1t_kit::call(

1998

&self.deployments,

1999

"actions_deployment",

2000

&json!({

2001

"repoId": run.repo_id,

2002

"repo": { "namespace": path.namespace, "name": path.name },

2003

"runId": run.id,

2004

"attempt": run.attempt,

2005

"runUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),

2006

"environment": env.name,

"url": env.url,

"ref": run.git_ref,

"sha": run.sha,

"state": state,

"final": last,

"creator": run.actor,

2013

"workflow": run.name,

}),

)

.await;

if let Err(error) = reported {

2018

worker::console_error!("actions: deployment to {} not recorded for run {}: {error}", env.name, run.id);

}

}

/// A job that deploys has started: its run's deployment to the

2023

/// environment is under way.

2024

pub(crate) async fn job_started(&self, job_id: &str) -> Result<()> {

2025

let Some(job) = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[job_id.into()])?.first::<JobRow>(None).await? else {

2026

return Ok(());

2027

};

2028

let Some(run) = self.run_row(&job.run_id).await? else { return Ok(()) };

2029

self.tell_live(&run.repo_id, &run.id, Some(&run.sha), run.pull).await;

2030

if let Some(env) = deploys_to(&run, &job) {

2031

self.report_deployment(&run, &env, "in_progress", false).await;

}

Ok(())

}

/// Pages open on the repository hear that a run's job started or

2037

/// finished, which is no event (`g1t_contracts::live`). Logged and left

2038

/// when notify cannot be reached: the pages catch up by themselves.

2039

pub(crate) async fn tell_live(&self, repo_id: &str, run_id: &str, sha: Option<&str>, pull: Option<u32>) {

2040

let Some(notify) = &self.notify else { return };

2041

let change = g1t_contracts::live::RepoChange {

2042

repo_id: repo_id.to_owned(),

2043

kind: g1t_contracts::live::RUN_UPDATED.to_owned(),

2044

run: Some(run_id.to_owned()),

2045

sha: sha.map(str::to_owned),

number: pull,

at: now(),

..Default::default()

};

let args = g1t_contracts::live::RepoChangedArgs { changes: vec![change] };

2051

let told: Result<Value> = g1t_kit::call(notify, g1t_contracts::live::REPO_CHANGED, &args).await;

2052

if let Err(error) = told {

2053

worker::console_error!("actions: live pages not told of run {run_id}: {error}");

}

}

/// The run is over: each environment its jobs deployed to takes the

2058

/// outcome of those jobs (`deployment_outcome`).

2059

async fn settle_deployments(&self, run: &RunRow, jobs: &[JobRow], cancelled: bool) {

2060

let mut seen: Vec<(JobEnvironment, Vec<Option<String>>)> = Vec::new();

2061

for job in jobs {

2062

let Some(env) = deploys_to(run, job) else { continue };

2063

let conclusion = if cancelled && job.conclusion.as_deref() != Some("skipped") && job.started_at.is_some() {

2064

Some("cancelled".to_owned())

2065

} else if job.started_at.is_none() {

2066

Some("skipped".to_owned())

2067

} else {

2068

job.conclusion.clone()

2069

};

2070

match seen.iter_mut().find(|(known, _)| known.name.eq_ignore_ascii_case(&env.name)) {

2071

Some((known, conclusions)) => {

2072

if known.url.is_none() {

2073

known.url = env.url.clone();

2074

}

2075

conclusions.push(conclusion);

2076

}

2077

None => seen.push((env, vec![conclusion])),

2078

}

2079

}

2080

for (env, conclusions) in seen {

2081

if let Some(state) = deployment_outcome(&conclusions) {

2082

self.report_deployment(run, &env, state, true).await;

}

}

}

/// Tells the pull request (or commit) how the run went, as a status.

2088

async fn report_status(&self, run: &RunRow, conclusion: &str) -> Result<()> {

2089

let state = match conclusion {

2090

"success" | "skipped" => "success",

2091

"cancelled" => "error",

2092

_ => "failure",

2093

};

2094

let _: Result<Value> = g1t_kit::call(

&self.work,

"set_commit_status",

&json!({

"repoId": run.repo_id,

2099

"sha": run.sha,

2100

"context": format!("{} / {}", run.name, run.event),

2101

"state": state,

2102

"description": format!("{} {}", run.name, match conclusion {

2103

"success" => "passed",

2104

"skipped" => "was skipped",

2105

"cancelled" => "was cancelled",

2106

_ => "failed",

2107

}),

2108

"targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),

"source": "actions",

}),

)

.await;

Ok(())

}

/// Tells the pull request a run has started on its head.

2117

pub async fn report_pending(&self, run: &RunRow) -> Result<()> {

2118

if let Err(error) = self.try_report_pending(run).await {

2119

worker::console_warn!("pending status for run {} not reported: {error}", run.id);

}

Ok(())

}

/// Reports a run as pending on its commit, failing when Work did not

2125

/// store it.

2126

pub async fn try_report_pending(&self, run: &RunRow) -> Result<()> {

2127

let stored: Outcome<bool> = g1t_kit::call(

&self.work,

"set_commit_status",

&json!({

"repoId": run.repo_id,

2132

"sha": run.sha,

2133

"context": format!("{} / {}", run.name, run.event),

2134

"state": "pending",

2135

"description": if run.status == "action_required" {

2136

format!("{} is waiting for approval", run.name)

2137

} else {

2138

format!("{} is running", run.name)

2139

},

2140

"targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),

"source": "actions",

}),

)

.await?;

match stored {

Outcome::Ok(_) => Ok(()),

2147

Outcome::Fail(failure) => Err(worker::Error::RustError(format!("pending status refused: {}", failure.message))),

}

}

/// Cancels a run: its waiting and queued jobs at once, and its running

2152

/// ones gracefully (`stop_job`), or outright when `force`.

2153

pub async fn cancel_run(&self, run: &RunRow, reason: &str, force: bool) -> Result<()> {

2154

self.db

2155

.prepare("UPDATE runs SET conclusion = 'cancelled' WHERE id = ? AND status != 'completed'")

2156

.bind(&[run.id.as_str().into()])?

2157

.run()

2158

.await?;

2159

for job in self.job_rows(&run.id).await?.iter().filter(|job| job.status != "completed") {

2160

if force {

2161

self.hard_stop(job, reason).await?;

2162

} else {

2163

self.stop_job(job, reason).await?;

2164

}

2165

}

2166

if run.status == "pending" || run.status == "action_required" {

2167

self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[run.id.as_str().into()])?.run().await?;

2168

}

2169

self.advance(&run.id).await

2170

}

2171

2172

/// Cancels every run of the repository that has not finished, for

2173

/// `repo.deleted` and `repo.archived`.

2174

pub async fn stop_runs(&self, repo_id: &str) -> Result<()> {

2175

let runs = self

2176

.db

2177

.prepare("SELECT * FROM runs WHERE repo_id = ? AND status != 'completed'")

2178

.bind(&[repo_id.into()])?

2179

.all()

2180

.await?

2181

.results::<RunRow>()?;

2182

for run in runs {

2183

self.cancel_run(&run, "The repository was archived or deleted.", true).await?;

}

Ok(())

}

pub async fn cancel(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {

2189

if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {

2190

return Ok(Outcome::Fail(refused));

2191

}

2192

let run = check!(self.run_in(&a.repo, &a.id).await?);

2193

if run.status == "completed" {

2194

return Ok(fail(FailureCode::Conflict, "The run has already finished."));

2195

}

2196

// Cancelling a run that is already cancelling stops its jobs

2197

// outright, without waiting for their cleanup steps.

2198

let force = a.force || run.conclusion.as_deref() == Some("cancelled");

2199

let reason = if force {

2200

format!("{} stopped the run without waiting for its cleanup steps.", a.actor.username)

2201

} else {

2202

format!("{} cancelled the run.", a.actor.username)

2203

};

2204

self.cancel_run(&run, &reason, force).await?;

2205

self.run_summary(&run.id).await

2206

}

2207

2208

/// Runs again, as a new attempt: every job, with `failed_only` those

2209

/// that did not succeed, or with `job` that one; each with the jobs that

2210

/// need them. The attempt that ends is kept, its jobs and their logs and

2211

/// summaries with it (`job_attempts`, `run_attempts`).

2212

pub async fn rerun(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {

2213

if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {

2214

return Ok(Outcome::Fail(refused));

2215

}

2216

// A job alone (`POST …/jobs/{job}/rerun`) names its run.

2217

let run_id = match (&a.job, a.id.is_empty()) {

2218

(Some(job), true) => {

2219

#[derive(Deserialize)]

struct Of {

run_id: String,

}

let of = self.db.prepare("SELECT run_id FROM jobs WHERE id = ?").bind(&[job.as_str().into()])?.first::<Of>(None).await?;

2224

match of {

2225

Some(of) => of.run_id,

2226

None => return Ok(fail(FailureCode::NotFound, "No such job.")),

}

}

_ => a.id.clone(),

};

let run = check!(self.run_in(&a.repo, &run_id).await?);

2232

if run.status != "completed" {

2233

return Ok(fail(FailureCode::Conflict, "The run is still going: cancel it first."));

2234

}

2235

// Nothing starts again on an archived repository.

2236

match self.visible_repo(&a.repo, &Some(a.actor.clone())).await? {

2237

Some(repo) if repo.archived() => {

2238

return Ok(fail(FailureCode::Forbidden, g1t_contracts::repos::archived_message(&repo.namespace, &repo.name)));

2239

}

2240

Some(repo) if !self.actions_on(&repo).await? => {

2241

return Ok(fail(FailureCode::Forbidden, g1t_contracts::actions::actions_disabled_message(&repo.namespace, &repo.name)));

2242

}

2243

Some(_) => {}

2244

None => return Ok(fail(FailureCode::NotFound, "There is no such repository.")),

2245

}

2246

if run.error.is_some() {

2247

return Ok(fail(FailureCode::Conflict, "This run never started: fix the workflow file and push again."));

2248

}

2249

let jobs = self.job_rows(&run.id).await?;

2250

let workflow = workflow::parse(&run.source).ok();

2251

let target = match &a.job {

2252

Some(id) => match jobs.iter().find(|job| &job.id == id) {

2253

Some(job) => Some(top_key(&job.key).to_owned()),

2254

None => return Ok(fail(FailureCode::NotFound, "That job is not in the run's latest attempt.")),

},

None => None,

};

let which = match (&target, a.failed_only) {

2259

(Some(key), _) => Rerun::Job(key),

2260

(None, true) => Rerun::Failed,

2261

(None, false) => Rerun::All,

2262

};

2263

let order = workflow.as_ref().map(|w| w.job_order()).unwrap_or_default();

2264

let again = rerun_keys(

2265

&order,

2266

|key| jobs.iter().find(|j| j.key == key).map(JobRow::needs).unwrap_or_default(),

2267

|key| jobs.iter().filter(|j| j.key == key).all(|j| j.conclusion.as_deref() == Some("success")),

2268

which,

2269

);

2270

if again.is_empty() {

2271

return Ok(fail(FailureCode::Conflict, "Every job succeeded: there is nothing to run again."));

2272

}

2273

// The jobs that run again, a called workflow's with the job calling it.

2274

let rerun_ids: Vec<&str> = jobs.iter().filter(|job| again.iter().any(|key| key == top_key(&job.key))).map(|job| job.id.as_str()).collect();

2275

let ids = serde_json::to_string(&rerun_ids)?;

2276

let ended = run.attempt.to_string();

2277

let ended = ended.as_str();

2278

let mut statements = vec![

2279

// The attempt that ends, as it ended.

2280

self.db

2281

.prepare(

2282

"INSERT OR REPLACE INTO run_attempts (run_id, attempt, repo_id, conclusion, actor, debug, started_at, finished_at)

2283

SELECT id, attempt, repo_id, conclusion, COALESCE(triggering_actor, actor), debug, started_at, finished_at FROM runs WHERE id = ?",

2284

)

2285

.bind(&[run.id.as_str().into()])?,

2286

// Earlier attempts that showed a job's logs from where it ran

2287

// then now find them where they move to.

2288

self.db

2289

.prepare("UPDATE job_attempts SET log_id = log_id || '.' || ?1 WHERE run_id = ?2 AND log_id IN (SELECT value FROM json_each(?3))")

2290

.bind(&[ended.into(), run.id.as_str().into(), ids.as_str().into()])?,

2291

// Each of its jobs: one that runs again keeps its logs under

2292

// `{id}.{attempt}`; one left alone is still the live job's.

2293

self.db

2294

.prepare(

2295

"INSERT OR REPLACE INTO job_attempts (id, run_id, repo_id, attempt, job_id, log_id, key, ordinal, name, needs, status, conclusion,

2296

steps, annotations, reason, environment, labels, runner_name, started_at, finished_at)

2297

SELECT id || '.' || ?1, run_id, repo_id, ?1, id,

2298

CASE WHEN id IN (SELECT value FROM json_each(?3)) THEN id || '.' || ?1 ELSE id END,

2299

key, ordinal, name, needs, status, conclusion, steps, annotations, reason, environment, labels, runner_name, started_at, finished_at

2300

FROM jobs WHERE run_id = ?2 ORDER BY rowid",

2301

)

2302

.bind(&[ended.into(), run.id.as_str().into(), ids.as_str().into()])?,

2303

self.db

2304

.prepare("UPDATE logs SET job_id = job_id || '.' || ?1 WHERE job_id IN (SELECT value FROM json_each(?2))")

2305

.bind(&[ended.into(), ids.as_str().into()])?,

2306

self.db

2307

.prepare("UPDATE job_summaries SET job_id = job_id || '.' || ?1 WHERE job_id IN (SELECT value FROM json_each(?2))")

2308

.bind(&[ended.into(), ids.as_str().into()])?,

2309

];

2310

for key in &again {

2311

statements.push(self.db.prepare("DELETE FROM jobs WHERE run_id = ? AND key = ? AND ordinal > 0").bind(&[run.id.as_str().into(), key.as_str().into()])?);

2312

// The jobs of a workflow it called (each matrix combination's

2313

// under `key[i]/`) are made again when it calls it again.

2314

statements.push(

2315

self.db

2316

.prepare("DELETE FROM jobs WHERE run_id = ? AND (key LIKE ? OR key LIKE ?)")

2317

.bind(&[run.id.as_str().into(), format!("{key}/%").into(), format!("{key}[%").into()])?,

);

statements.push(

self.db

.prepare(

"UPDATE jobs SET status = 'waiting', conclusion = NULL, steps = '[]', annotations = '[]', outputs = '{}', reason = NULL,

2323

matrix = NULL, call = NULL, token_hash = NULL, first_token_hash = NULL, seen_at = NULL, started_at = NULL, finished_at = NULL,

2324

labels = NULL, queued_at = NULL, runner_id = NULL, runner_name = NULL, environment = NULL,

2325

concurrency_group = NULL, cancel_in_progress = 0, cancel_requested_at = NULL WHERE run_id = ? AND key = ?",

2326

)

2327

.bind(&[run.id.as_str().into(), key.as_str().into()])?,

);

}

statements.push(

self.db

.prepare(

"UPDATE runs SET status = 'queued', conclusion = NULL, attempt = attempt + 1, started_at = NULL, finished_at = NULL,

2334

triggering_actor = ?, debug = ? WHERE id = ?",

2335

)

2336

.bind(&[a.actor.username.as_str().into(), u32::from(a.debug).into(), run.id.as_str().into()])?,

2337

);

2338

self.db.batch(statements).await?;

2339

if let Some(run) = self.run_row(&run.id).await? {

2340

self.report_pending(&run).await?;

2341

}

2342

self.advance(&run.id).await?;

2343

// A page left open on the attempt that ended, which asks for nothing

2344

// while its run is over, hears that it is going again: re-run from

2345

// the API, the MCP tool, a pull request or another tab, as well as

2346

// from that page, it offers Cancel run and not the re-runs.

2347

self.tell_live(&run.repo_id, &run.id, Some(&run.sha), run.pull).await;

2348

self.run_summary(&run.id).await

2349

}

2350

2351

pub async fn run_in(&self, repo: &RepoPath, id: &str) -> Result<Outcome<RunRow>> {

2352

let row = self

2353

.db

2354

.prepare("SELECT * FROM runs WHERE id = ? AND lower(repo) = lower(?)")

2355

.bind(&[id.into(), format!("{}/{}", repo.namespace, repo.name).into()])?

2356

.first::<RunRow>(None)

2357

.await?;

2358

Ok(row.map_or_else(|| fail(FailureCode::NotFound, "No such run."), Outcome::Ok))

2359

}

2360

2361

// --- The sandbox's side -----------------------------------------------------

2362

2363

pub(crate) async fn job_for_token(&self, a: &JobCallArgs) -> Result<Outcome<JobRow>> {

2364

self.job_for(a, false).await

2365

}

2366

2367

/// As [`Self::job_for_token`], and also with the token the job started

2368

/// with after its harness swapped it (`job_spec` with `rotate`): for

2369

/// `brokered_secrets` alone, which the runner Worker asks with the

2370

/// token it was given at the start, and which no API route passes on.

2371

pub(crate) async fn job_for_started_token(&self, a: &JobCallArgs) -> Result<Outcome<JobRow>> {

2372

self.job_for(a, true).await

2373

}

2374

2375

async fn job_for(&self, a: &JobCallArgs, started: bool) -> Result<Outcome<JobRow>> {

2376

let job = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[a.job.as_str().into()])?.first::<JobRow>(None).await?;

2377

Ok(match job {

2378

Some(job) if job.status == "in_progress" && token_opens(job.token_hash.as_deref(), job.first_token_hash.as_deref(), &a.token, started) => Outcome::Ok(job),

2379

_ => fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."),

})

}

/// `job_auth`: which run and repository a running job's token is for,

2384

/// so the API can keep its artifacts and cache.

2385

pub async fn job_auth(&self, a: JobCallArgs) -> Result<Outcome<Value>> {

2386

let job = check!(self.job_for_token(&a).await?);

2387

Ok(Outcome::Ok(json!({ "run": job.run_id, "repoId": job.repo_id })))

2388

}

2389

2390

/// `job_spec`: everything the sandbox needs to run the job.

2391

pub async fn job_spec(&self, a: JobCallArgs) -> Result<Outcome<Value>> {

2392

let job = check!(self.job_for_token(&a).await?);

2393

// Asked to, the token the harness asked with is spent here: it gets

2394

// a new one with the spec, for everything after, so a copy of the

2395

// first left on the runner's computer (a Windows job's script, a

2396

// container's environment) cannot fetch the secrets again. The new

2397

// token is made now, as the runtime token is signed with its hash,

2398

// and swapped in last, so a spec that could not be made leaves the

2399

// old one working.

2400

let next = a.rotate.then(|| random_hex(24));

2401

let token_hash = match &next {

2402

Some(next) => sha256_hex(next),

2403

None => job.token_hash.clone().unwrap_or_default(),

2404

};

2405

let Some(run) = self.run_row(&job.run_id).await? else {

2406

return Ok(fail(FailureCode::NotFound, "No such run."));

2407

};

2408

let Ok(caller) = workflow::parse(&run.source) else {

2409

return Ok(fail(FailureCode::Invalid, "The workflow no longer reads."));

2410

};

2411

// A called workflow's job runs as that workflow defines it.

2412

let callee = job.callee();

2413

let (workflow, spec, call_inputs) = match callee {

2414

Some((called, spec, call)) => (called, spec, Some(call["inputs"].clone())),

2415

None => match caller.jobs.iter().find(|j| j.id == job.key) {

2416

Some(spec) => (caller.clone(), spec.clone(), None),

2417

None => return Ok(fail(FailureCode::NotFound, "The job is not in the workflow.")),

},

};

let spec = &spec;

let repo = repo_path(&run.repo);

2422

let trusted = run.trusted != 0;

2423

// The job's `environment:`, by name, as read when its needs were done

2424

// (an expression included), once the environment's protection rules

2425

// let it start: entries with a value for it give that value instead

2426

// of their default, as GitHub's environment secrets do.

2427

let environment: Option<String> = job.environment.clone();

2428

// What its token may do: its `permissions:` (a called workflow's

2429

// jobs no more than the job that calls it), else the repository's

2430

// default; read-only for a pull request from outside.

2431

// The repository's default, its workspace's taken in, and whether

2432

// its jobs may open and approve pull requests.

2433

let (default, pull_requests) = self.token_policy(&run.repo_id).await?;

2434

let mut permissions = spec.permissions(&workflow, default);

2435

if let Some(parent) = &job.call().filter(|c| c["role"] == "callee").and_then(|c| c["parent"].as_str().map(str::to_owned)) {

2436

let top = top_key(parent);

2437

if let Some(caller_job) = caller.jobs.iter().find(|j| j.id == top) {

2438

permissions = permissions.capped_by(&caller_job.permissions(&caller, default));

}

}

if !trusted {

permissions = permissions.read_only();

2443

}

2444

// G1T_TOKEN, and GITHUB_TOKEN as its alias: a token of the

2445

// workspace's that reaches this repository only, with the scopes

2446

// its permissions give, until the job ends.

2447

let token = match self.workspace_actor(&repo.namespace).await? {

2448

Some(workspace) => {

2449

let created: CreatedAccessToken = g1t_kit::call(

2450

&self.identity,

2451

"create_job_token",

2452

&CreateJobTokenArgs {

2453

workspace,

2454

repo: repo.clone(),

2455

run_id: run.id.clone(),

2456

job_id: job.id.clone(),

2457

2458

ttl_seconds: u64::from(job.timeout_minutes) * 60 + 600,

2459

scopes: permissions.scopes().into_iter().map(str::to_owned).collect(),

2460

pull_requests: pull_requests && trusted,

},

)

.await?;

created.token

}

None => String::new(),

2467

};

2468

// A run that is not trusted (a pull request from outside the

2469

// workspace) gets no secrets and an empty token.

2470

let passed = job.call().filter(|c| c["role"] == "callee").and_then(|c| c.get("secrets").cloned());

2471

// Brokered secrets among them (broker.rs), whatever keys they reach

2472

// the job under.

2473

let mut brokers: Vec<Broker> = Vec::new();

2474

let mut secrets = match (trusted, passed) {

2475

(false, _) => Map::new(),

2476

(true, None) => {

2477

let resolved = self.secrets_for(&run.repo_id, &run.repo, environment.as_deref(), true).await?;

2478

brokers.extend(resolved.brokers());

2479

resolved.values

2480

}

2481

// A called workflow's job: what its callers passed it (reach.rs),

2482

// and its own environment's secrets over them.

2483

(true, Some(plan)) => {

2484

let base = self.secrets_for(&run.repo_id, &run.repo, None, true).await?;

2485

brokers.extend(base.brokers());

2486

let base = base.values;

2487

let vars = self.variables_for(&run.repo_id, &run.repo, None, true).await?;

2488

let github = run.info().context(&job.key, "", run.action.as_deref());

2489

let mut passed = crate::reach::resolve_secrets(&plan, &base, &github, &vars);

2490

if let Some(name) = environment.as_deref() {

2491

let own = self.secrets_for(&run.repo_id, &run.repo, Some(name), true).await?;

2492

brokers.extend(own.brokers());

2493

for (key, value) in own.values {

2494

if base.get(&key) != Some(&value) {

2495

passed.insert(key, value);

}

}

}

passed

}

};

// A brokered secret's value never reaches the sandbox: the job gets

2503

// a stand-in, which the runner Worker fills in on its requests to

2504

// the secret's hosts. A self-hosted runner's requests never pass

2505

// the Worker: a harness there that brokers is given each stand-in's

2506

// hosts, and passes its job's requests to them through g1t

2507

// (broker.rs); any other keeps a stand-in that does nothing, and

2508

// the log says so.

2509

let stand_ins = broker::substitute(&mut secrets, &brokers, broker::stand_in);

2510

let relayed = job.runner_id.is_some() && a.broker && !stand_ins.is_empty();

2511

if !stand_ins.is_empty() {

2512

self.keep_stand_ins(&job.id, job.timeout_minutes, &stand_ins).await?;

2513

if job.runner_id.is_some() {

2514

let mut made: Vec<&broker::StandIn> = stand_ins.iter().collect();

2515

made.sort_unstable_by(|a, b| a.broker.name.cmp(&b.broker.name));

2516

let notes: String = made

2517

.iter()

2518

.map(|made| {

2519

let note = if relayed { broker::brokered_note(&made.broker.name, &made.broker.hosts) } else { broker::self_hosted_note(&made.broker.name) };

note + "\n"

})

.collect();

self.note_log(&job.id, 0, &notes).await?;

2524

}

2525

}

2526

secrets.insert("G1T_TOKEN".into(), Value::String(token.clone()));

2527

secrets.insert("GITHUB_TOKEN".into(), Value::String(token.clone()));

2528

// Each secret as it is, a line at a time, base64 and JSON-escaped.

2529

let mut masks: Vec<String> = g1t_actions::mask::all_variants(secrets.values().filter_map(|v| v.as_str()));

2530

let vars = self.variables_for(&run.repo_id, &run.repo, environment.as_deref(), trusted).await?;

2531

// The toolkit's runtime token (runtime.rs), for as long as the job

2532

// may run; the API puts it and the toolkit's addresses in the

2533

// job's variables.

2534

let runtime_token = crate::runtime::runtime_token(

&job.id,

&job.run_id,

&token_hash,

now_ms() / 1000,

u64::from(job.timeout_minutes) * 60 + 600,

2540

);

2541

masks.push(runtime_token.clone());

2542

let retention_days = self.retention_setting(&run.repo_id).await?;

2543

2544

let jobs = self.job_rows(&run.id).await?;

2545

let mut needs = Map::new();

2546

// In a called workflow, its jobs' keys sit under the job that called it.

2547

let parent = job.call().filter(|c| c["role"] == "callee").and_then(|c| c["parent"].as_str().map(str::to_owned));

2548

for need in &spec.needs {

2549

let key = match &parent {

2550

Some(parent) => format!("{parent}/{need}"),

2551

None => need.clone(),

2552

};

2553

let rows: Vec<&JobRow> = jobs.iter().filter(|row| row.key == key).collect();

2554

let mut outputs = Map::new();

2555

for row in &rows {

2556

if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {

2557

outputs.extend(more);

2558

}

2559

}

2560

needs.insert(need.clone(), json!({ "result": key_result(&rows), "outputs": outputs }));

2561

}

2562

let siblings = jobs.iter().filter(|row| row.key == job.key).count();

2563

let matrix: Value = job.matrix.as_deref().and_then(|m| serde_json::from_str(m).ok()).unwrap_or(json!({}));

2564

let info = run.info();

2565

let mut github = info.context(&job.key, &token, run.action.as_deref());

2566

github["token"] = json!(token);

2567

github["retention_days"] = json!(retention_days);

2568

// On a self-hosted runner, `runner` and `RUNNER_*` describe that

2569

// machine rather than g1t's sandbox.

2570

let mut variables = info.variables(&job.key);

2571

variables.insert("GITHUB_RETENTION_DAYS".into(), json!(retention_days.to_string()));

2572

let mut runner = match &job.runner_id {

2573

Some(id) => self.runner_context_for(id, &mut variables).await?,

2574

None => runner_context(),

2575

};

2576

// A re-run with debug logging: what GitHub sets for one.

2577

if run.debug != 0 {

2578

debug_logging(&mut variables, &mut runner);

2579

}

2580

2581

// Where to check out: the repository, which holds a pull request's

2582

// test merge commit; a pull request's fork when the run builds its

2583

// head instead (`run.sha` is the head, `info.sha` what is built).

2584

let clone_url = match run.pull {

2585

Some(number) if run.event.starts_with("pull_request") && run.event != "pull_request_target" && info.sha == run.sha => {

2586

let located: Outcome<g1t_contracts::work::PullDetail> = g1t_kit::call(

2587

&self.work,

2588

"get_pull",

2589

&g1t_contracts::work::ViewArgs {

2590

repo: repo.clone(),

2591

number,

2592

viewer: self.workspace_actor(&repo.namespace).await?,

after_seq: 0,

},

)

.await?;

match located {

Outcome::Ok(detail) => match detail.pull.fork.or(detail.pull.head_repo) {

2599

Some(fork) => format!("{SITE}/{}/{}.git", fork.namespace, fork.name),

2600

None => format!("{SITE}/{}.git", run.repo),

2601

},

2602

Outcome::Fail(_) => format!("{SITE}/{}.git", run.repo),

2603

}

2604

}

2605

_ => format!("{SITE}/{}.git", run.repo),

2606

};

2607

2608

// Only one fetch with a token gets its spec: of two at once, the

2609

// second finds the hash already changed and is refused.

if next.is_some() {

let swapped = self

.db

.prepare(TOKEN_ROTATE)

2614

.bind(&[token_hash.as_str().into(), job.id.as_str().into(), job.token_hash.as_deref().unwrap_or_default().into()])?

2615

.first::<Value>(None)

2616

.await?;

2617

if swapped.is_none() {

2618

return Ok(fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."));

}

}

let mut spec = json!({

"job": job.id,

"run": run.id,

"key": job.key,

"name": job.name,

"spec": spec.raw,

"workflow": {

"env": workflow.env,

"defaults": workflow.raw.get("defaults").cloned().unwrap_or(Value::Null),

2631

},

2632

"github": github,

2633

"variables": variables,

"event": info.event,

"contexts": {

"vars": vars,

"secrets": secrets,

"inputs": call_inputs.unwrap_or_else(|| Value::Object(run.inputs())),

"matrix": matrix,

"needs": needs,

"strategy": {

"fail-fast": spec.fail_fast,

2643

"job-index": job.ordinal,

2644

"job-total": siblings,

2645

"max-parallel": spec.max_parallel.unwrap_or(siblings as u32),

},

"runner": runner,

},

"checkout": {

"repository": run.repo,

"url": clone_url,

"sha": info.sha,

"ref": run.git_ref,

"token": token,

},

"timeoutMinutes": job.timeout_minutes,

2657

"masks": masks,

2658

// As the job's log lists them at its start.

2659

"permissions": permissions.listed().into_iter().map(|(name, access)| (name.to_owned(), json!(access.as_str()))).collect::<Map<String, Value>>(),

2660

// Whether the job may ask for an OIDC token decides whether it

2661

// is told where to.

2662

"runtime": {

2663

"token": runtime_token,

2664

"idToken": self.oidc_allowed(&run, &job),

2665

},

2666

});

2667

if let Some(next) = next {

2668

spec["nextToken"] = json!(next);

2669

}

2670

if relayed {

2671

spec["brokered"] = broker::spec_entries(&stand_ins);

2672

}

2673

Ok(Outcome::Ok(spec))

2674

}

2675

2676

/// `job_report`: the sandbox telling how the job is going.

2677

pub async fn job_report(&self, a: JobCallArgs) -> Result<Outcome<Value>> {

2678

let job = check!(self.job_for_token(&a).await?);

2679

let report = &a.report;

2680

let at = now();

2681

match report["kind"].as_str().unwrap_or_default() {

2682

"steps" => {

2683

// The list can grow as the job goes (post steps), so steps

2684

// already reported keep where they stand.

2685

let known: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();

2686

let steps: Vec<Value> = report["steps"]

.as_array()

.map(|names| {

names

.iter()

.enumerate()

.map(|(i, name)| match known.get(i) {

2693

Some(step) if step["status"] != "queued" => step.clone(),

2694

_ => json!({ "number": i + 1, "name": expr::to_text(name), "status": "queued", "conclusion": null, "startedAt": null, "finishedAt": null }),

})

.collect()

})

.unwrap_or_default();

2699

self.db

2700

.prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")

2701

.bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?

.run()

.await?;

}

"step" => {

let number = report["number"].as_u64().unwrap_or(0) as usize;

2707

let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();

2708

if let Some(step) = number.checked_sub(1).and_then(|i| steps.get_mut(i)) {

2709

let status = report["status"].as_str().unwrap_or("in_progress");

2710

step["status"] = json!(status);

2711

if status == "in_progress" {

2712

step["startedAt"] = json!(at);

2713

}

2714

if status == "completed" {

2715

step["finishedAt"] = json!(at);

2716

step["conclusion"] = report["conclusion"].clone();

2717

}

2718

if let Some(name) = report["name"].as_str() {

2719

step["name"] = json!(name);

}

}

self.db

.prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")

2724

.bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?

.run()

.await?;

}

// A line from g1t itself, not the job: the runner Worker's note

2729

// that a brokered secret went to a host it is not for. Put

2730

// under the step that is running.

2731

"note" => {

2732

let text = report["text"].as_str().unwrap_or_default().chars().take(1000).collect::<String>();

2733

let steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();

2734

let step = steps.iter().rev().find(|step| step["status"] == "in_progress").and_then(|step| step["number"].as_u64()).unwrap_or(0);

2735

if !text.trim().is_empty() {

2736

self.note_log(&job.id, step as u32, &text).await?;

}

}

"log" => {

let mut text = report["text"].as_str().unwrap_or_default().to_owned();

2741

// A brokered secret's value never enters the sandbox, but an

2742

// answer that echoed it whole could carry it in; it is

2743

// masked here, where the value is known.

2744

if job.brokered != 0 {

2745

let values: Vec<String> = self.stand_ins_of(&job.id).await?.into_iter().map(|secret| secret.value).collect();

2746

if !values.is_empty() {

2747

text = g1t_actions::mask::apply(&text, &g1t_actions::mask::all_variants(values.iter().map(String::as_str)));

2748

}

2749

}

2750

if text.len() > MAX_CHUNK_BYTES {

2751

let mut cut = MAX_CHUNK_BYTES;

2752

while !text.is_char_boundary(cut) {

cut -= 1;

}

text.truncate(cut);

}

#[derive(Deserialize)]

struct Size {

n: Option<f64>,

}

let size = self

.db

.prepare("SELECT SUM(LENGTH(text)) AS n FROM logs WHERE job_id = ?")

2764

.bind(&[job.id.as_str().into()])?

2765

.first::<Size>(None)

2766

.await?;

2767

let used = size.and_then(|s| s.n).unwrap_or(0.0) as usize;

2768

if used < MAX_LOG_BYTES {

2769

if used + text.len() >= MAX_LOG_BYTES {

2770

text.push_str("\n… The log reached its limit of 4 MB; the rest is not kept.\n");

2771

}

2772

// The next `seq` is taken in the insert itself, so two

2773

// batches at once (a report sent again while the first

2774

// was still being written) never reach for the same one

2775

// and lose a chunk to the primary key.

self.db

.prepare(LOG_INSERT)

.bind(&[

job.id.as_str().into(),

2780

(report["step"].as_u64().unwrap_or(0) as u32).into(),

2781

text.into(),

2782

report["chunk"].as_u64().map_or(worker::wasm_bindgen::JsValue::NULL, |n| (n as f64).into()),

])?

.run()

.await?;

}

self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;

2788

}

2789

"summary" => {

2790

// `$GITHUB_STEP_SUMMARY`, masked by the runner: added to the

2791

// step's summary, up to 1 MiB a step and 20 steps a job.

2792

let step = report["step"].as_u64().unwrap_or(0) as u32;

2793

let markdown = report["markdown"].as_str().unwrap_or_default();

2794

#[derive(Deserialize)]

struct Held {

steps: u32,

mine: Option<f64>,

}

let held = self

.db

.prepare("SELECT COUNT(*) AS steps, MAX(CASE WHEN step = ? THEN LENGTH(markdown) END) AS mine FROM job_summaries WHERE job_id = ?")

2802

.bind(&[step.into(), job.id.as_str().into()])?

2803

.first::<Held>(None)

2804

.await?;

2805

let (steps, mine) = held.map_or((0, None), |held| (held.steps, held.mine.map(|n| n as usize)));

2806

if summary_fits(steps, mine, markdown.len()) {

2807

self.db

2808

.prepare(

2809

"INSERT INTO job_summaries (job_id, step, markdown) VALUES (?, ?, ?)

2810

ON CONFLICT (job_id, step) DO UPDATE SET markdown = job_summaries.markdown || excluded.markdown",

2811

)

2812

.bind(&[job.id.as_str().into(), step.into(), markdown.into()])?

.run()

.await?;

}

self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;

2817

}

2818

"annotation" => {

2819

let mut annotations: Vec<Value> = serde_json::from_str(&job.annotations).unwrap_or_default();

2820

if annotations.len() < MAX_ANNOTATIONS {

2821

annotations.push(json!({

2822

"level": report["level"].as_str().unwrap_or("notice"),

2823

"message": report["message"].as_str().unwrap_or_default().chars().take(4000).collect::<String>(),

2824

"title": report["title"],

2825

"file": report["file"],

2826

"line": report["line"],

2827

}));

2828

self.db

2829

.prepare("UPDATE jobs SET annotations = ?, seen_at = ? WHERE id = ?")

2830

.bind(&[serde_json::to_string(&annotations)?.into(), at.as_str().into(), job.id.as_str().into()])?

.run()

.await?;

}

}

// Nothing to tell; the answer says whether to stop.

2836

"ping" => {

2837

self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;

2838

}

2839

"done" => {

2840

// A job told to stop ends cancelled, however its cleanup went.

2841

let conclusion = if job.cancel_requested_at.is_some() {

"cancelled"

} else {

report["conclusion"]

.as_str()

.filter(|c| matches!(*c, "success" | "failure" | "cancelled"))

2847

.unwrap_or("failure")

2848

};

2849

let outputs = report["outputs"].as_object().cloned();

2850

Box::pin(self.finish_job(&job.id, conclusion, report["reason"].as_str(), outputs.as_ref())).await?;

2851

}

2852

other => return Ok(fail(FailureCode::Invalid, format!("There is no report called `{other}`."))),

2853

}

2854

// `cancelled`: the run was cancelled, and the runner should stop

2855

// the step it is on and run only its cleanup steps.

2856

Ok(Outcome::Ok(json!({ "ok": true, "cancelled": job.cancel_requested_at.is_some() })))

2857

}

2858

2859

// --- Every minute ---------------------------------------------------------------

2860

2861

pub async fn on_minute(&self, now_ms: u64) -> Result<()> {

2862

let minute = now_ms / 60_000 * 60_000;

2863

// Repositories a workspace's managed workflows changed in, beyond

2864

// those synced at once (managed.rs): their schedules wait for it.

2865

if let Err(error) = self.catch_up_syncs().await {

2866

worker::console_error!("actions: catching up syncs failed: {error}");

2867

}

2868

// Staff (or billing's usage watcher) paused scheduled runs across

2869

// g1t: this minute's schedules are skipped, not queued for later.

2870

// Kept 30 seconds in the isolate (g1t_kit::pause).

2871

if g1t_kit::pause::paused(&self.billing, g1t_contracts::billing::PauseLevel::Schedules).await {

2872

worker::console_log!("actions: schedules are paused across g1t; skipped this minute's");

2873

} else if let Err(error) = self.run_schedules(minute).await {

2874

worker::console_error!("actions: schedules failed: {error}");

2875

}

2876

// Jobs whose sandbox went quiet or ran past their time.

2877

let running = self.db.prepare("SELECT * FROM jobs WHERE status = 'in_progress'").all().await?.results::<JobRow>()?;

2878

let mut lost = std::collections::HashSet::new();

2879

for job in running {

2880

// Times in g1t's format compare as text.

2881

let before = |ms: u64| rfc3339(now_ms.saturating_sub(ms));

2882

let silent = job.seen_at.as_deref().is_some_and(|seen| seen < before(SILENT_MS).as_str());

2883

let limit = (u64::from(job.timeout_minutes) * 60 + 120) * 1000;

2884

let over = job.started_at.as_deref().is_some_and(|started| started < before(limit).as_str());

2885

let cancel_overdue = job.cancel_requested_at.as_deref().is_some_and(|at| at < before(CANCEL_GRACE_MS).as_str());

2886

if cancel_overdue {

2887

// Cancelled, and still going after its grace period.

2888

self.hard_stop(&job, "It was cancelled, and did not finish its cleanup steps within 5 minutes.").await?;

2889

self.advance(&job.run_id).await?;

2890

} else if over {

2891

let reason = format!("It ran longer than its time limit of {} minutes.", job.timeout_minutes);

2892

// A self-hosted runner is told to stop on its next poll.

2893

if job.runner_id.is_none() {

2894

let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;

2895

}

2896

self.finish_job(&job.id, "failure", Some(&reason), None).await?;

2897

} else if job.runner_id.is_none() && crate::never_reported(job.started_at.as_deref(), job.seen_at.as_deref(), now_ms) {

2898

// Its sandbox never ran it: nothing it did needs undoing.

2899

// It starts again at the next sweep, not this one: the same

2900

// sandbox takes it, and the stop of the lost one finishes

2901

// in that sandbox's alarm, after this.

2902

if self.retry_lost_start(&job, now_ms).await? {

2903

lost.insert(job.id.clone());

2904

}

2905

} else if silent {

2906

let reason = match &job.runner_name {

2907

Some(name) => format!("The self-hosted runner {name} stopped answering."),

2908

None => "The runner stopped answering.".to_owned(),

2909

};

2910

self.finish_job(&job.id, "failure", Some(&reason), None).await?;

2911

}

2912

}

2913

// Calls of reusable workflows waiting in a concurrency group, in

2914

// case the job they waited for was cancelled in another run.

2915

#[derive(Deserialize)]

struct RunId {

run_id: String,

}

let held = self

.db

.prepare("SELECT DISTINCT run_id FROM jobs WHERE status = 'waiting' AND concurrency_group IS NOT NULL LIMIT 20")

2922

.all()

2923

.await?

2924

.results::<RunId>()?;

2925

for run in held {

2926

self.advance(&run.run_id).await?;

2927

}

2928

if let Err(error) = self.sweep_runners(now_ms).await {

2929

worker::console_error!("actions: the runners' sweep failed: {error}");

2930

}

2931

// Jobs held at an environment whose wait timer has run out.

2932

if let Err(error) = self.release_gates().await {

2933

worker::console_error!("actions: environments' gates failed: {error}");

2934

}

2935

// Once an hour: the cache's expired entries, and its storage.

2936

if (now_ms / 60_000) % 60 == 7

2937

&& let Err(error) = self.sweep_cache(now_ms).await

2938

{

2939

worker::console_error!("actions: the cache's sweep failed: {error}");

2940

}

2941

// And the archives of GitHub's actions no job uses any more.

2942

if (now_ms / 60_000) % 60 == 47

2943

&& let Err(error) = self.sweep_action_archives(now_ms).await

2944

{

2945

worker::console_error!("actions: the action archives' sweep failed: {error}");

2946

}

2947

// And artifacts past their time, and the toolkit's abandoned parts.

2948

if (now_ms / 60_000) % 60 == 37 {

2949

if let Err(error) = self.sweep_artifacts(now_ms).await {

2950

worker::console_error!("actions: the artifacts' sweep failed: {error}");

2951

}

2952

if let Err(error) = self.sweep_blob_parts(now_ms).await {

2953

worker::console_error!("actions: the blob parts' sweep failed: {error}");

2954

}

2955

}

2956

// And logs of jobs that finished longer ago than LOG_RETENTION_DAYS.

2957

if (now_ms / 60_000) % 60 == 17

2958

&& let Err(error) = self.sweep_logs(now_ms).await

2959

{

2960

worker::console_error!("actions: the logs' sweep failed: {error}");

2961

}

2962

self.start_queued_except(&lost).await

2963

}

2964

2965

/// A job whose sandbox never reported (`never_reported`): back in the

2966

/// queue, its token void so that sandbox can no longer report for it,

2967

/// and the sandbox stopped, which gives back what billing held for it.

2968

/// It waits as a job with no machine does, and fails once it has waited

2969

/// WAIT_FOR_MACHINE_MS. Returns whether it went back in the queue.

2970

async fn retry_lost_start(&self, job: &JobRow, now_ms: u64) -> Result<bool> {

2971

let since = job.waiting_since.clone().or_else(|| job.started_at.clone()).unwrap_or_else(|| rfc3339(now_ms));

2972

if crate::waited_for_a_machine(Some(&since), now_ms) {

2973

let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;

2974

let minutes = crate::WAIT_FOR_MACHINE_MS / 60_000;

2975

let reason = format!("No machine ran the job in {minutes} minutes: each one it was given stopped answering before it started.");

2976

self.finish_job(&job.id, "failure", Some(&reason), None).await?;

2977

return Ok(false);

2978

}

2979

// Not if it reported after all, since it was read.

let requeued = self

.db

.prepare(

"UPDATE jobs SET status = 'queued', token_hash = NULL, first_token_hash = NULL, started_at = NULL, seen_at = NULL, waiting_since = ?, reason = ?

2984

WHERE id = ? AND status = 'in_progress' AND seen_at = started_at RETURNING id",

2985

)

2986

.bind(&[

2987

since.as_str().into(),

2988

"Its machine stopped answering before it started; it waits for another.".into(),

2989

job.id.as_str().into(),

2990

])?

2991

.first::<Value>(None)

2992

.await?;

2993

if requeued.is_none() {

2994

return Ok(false);

2995

}

2996

worker::console_warn!("actions: job {} never reported; it goes back in the queue", job.id);

2997

self.revoke_job_tokens(&job.id).await;

2998

let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;

Ok(true)

}

}

#[cfg(test)]

mod log_chunks {

use rusqlite::{Connection, params};

3007

3008

use super::LOG_INSERT;

3009

3010

/// The logs table as the migrations leave it.

3011

fn database() -> Connection {

3012

let db = Connection::open_in_memory().unwrap();

3013

for name in ["0001_init.sql", "0016_log_chunks.sql"] {

3014

let path = format!("{}/migrations/{name}", env!("CARGO_MANIFEST_DIR"));

3015

db.execute_batch(&std::fs::read_to_string(path).unwrap()).unwrap();

}

db

}

fn log(db: &Connection, job: &str) -> Vec<(i64, i64, String)> {

3021

let mut rows = db.prepare("SELECT seq, step, text FROM logs WHERE job_id = ? ORDER BY seq").unwrap();

3022

rows.query_map([job], |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?))).unwrap().map(Result::unwrap).collect()

}

#[test]

fn a_batch_sent_again_is_kept_once() {

3027

let db = database();

3028

let insert = |job: &str, step: i64, text: &str, chunk: Option<i64>| db.execute(LOG_INSERT, params![job, step, text, chunk]).unwrap();

3029

assert_eq!(insert("job_1", 0, "one\n", Some(1)), 1);

3030

// The runner did not hear the answer and sent the batch again.

3031

assert_eq!(insert("job_1", 0, "one\n", Some(1)), 0);

3032

assert_eq!(insert("job_1", 1, "two\n", Some(2)), 1);

3033

// Another job numbers its batches from 1 too.

3034

assert_eq!(insert("job_2", 0, "other\n", Some(1)), 1);

3035

// A runner that numbers nothing has every batch kept, as before.

3036

assert_eq!(insert("job_3", 0, "a\n", None), 1);

3037

assert_eq!(insert("job_3", 0, "a\n", None), 1);

3038

assert_eq!(log(&db, "job_1"), [(1, 0, "one\n".into()), (2, 1, "two\n".into())]);

3039

assert_eq!(log(&db, "job_2"), [(1, 0, "other\n".into())]);

3040

assert_eq!(log(&db, "job_3").len(), 2);

3041

// A job run again moves its log aside (`{id}.{attempt}`), and the

3042

// new attempt's runner numbers from 1 again.

3043

db.execute("UPDATE logs SET job_id = job_id || '.1' WHERE job_id = 'job_1'", []).unwrap();

3044

assert_eq!(insert("job_1", 0, "again\n", Some(1)), 1);

3045

assert_eq!(log(&db, "job_1"), [(1, 0, "again\n".into())]);

3046

assert_eq!(log(&db, "job_1.1").len(), 2);

}

}

#[cfg(test)]

mod token_rotation {

use g1t_secrets::sha256_hex;

3053

use rusqlite::{Connection, OptionalExtension, params};

3054

3055

use super::{TOKEN_ROTATE, token_opens};

3056

3057

fn database() -> Connection {

3058

let db = Connection::open_in_memory().unwrap();

3059

for name in ["0001_init.sql", "0020_job_token_rotation.sql"] {

3060

let path = format!("{}/migrations/{name}", env!("CARGO_MANIFEST_DIR"));

3061

db.execute_batch(&std::fs::read_to_string(path).unwrap()).unwrap();

3062

}

3063

db.execute(

3064

"INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, status, token_hash) VALUES ('job_1', 'run_1', 'repo_1', 'acme', 'build', 'build', 'in_progress', ?1)",

3065

[sha256_hex("first")],

)

.unwrap();

db

}

fn rotate(db: &Connection, next: &str, shown: &str) -> bool {

3072

db.query_row(TOKEN_ROTATE, params![sha256_hex(next), "job_1", sha256_hex(shown)], |row| row.get::<_, String>(0))

.optional()

.unwrap()

.is_some()

}

/// The job's current token's hash, and the one it started with.

3079

fn hashes(db: &Connection) -> (Option<String>, Option<String>) {

3080

db.query_row("SELECT token_hash, first_token_hash FROM jobs WHERE id = 'job_1'", [], |row| Ok((row.get(0)?, row.get(1)?))).unwrap()

}

#[test]

fn a_job_token_fetches_its_spec_once() {

3085

let db = database();

3086

assert!(rotate(&db, "second", "first"));

3087

assert_eq!(hashes(&db), (Some(sha256_hex("second")), Some(sha256_hex("first"))));

3088

// The first token, shown again (a copy left on the computer, or a

3089

// second fetch racing the first), swaps nothing and is refused.

3090

assert!(!rotate(&db, "third", "first"));

3091

assert_eq!(hashes(&db).0, Some(sha256_hex("second")));

3092

// A job that ended has no token to swap.

3093

db.execute("UPDATE jobs SET status = 'completed', token_hash = NULL, first_token_hash = NULL", []).unwrap();

3094

assert!(!rotate(&db, "fourth", "second"));

3095

assert_eq!(hashes(&db), (None, None));

}

#[test]

fn the_worker_finds_brokered_secrets_with_the_token_the_job_started_with() {

3100

let db = database();

3101

let opens = |db: &Connection, token: &str, started: bool| {

3102

let (current, first) = hashes(db);

3103

token_opens(current.as_deref(), first.as_deref(), token, started)

3104

};

3105

// Before any swap, the job's one token opens everything.

3106

assert!(opens(&db, "first", false) && opens(&db, "first", true));

3107

assert!(rotate(&db, "second", "first"));

3108

// The harness's new token opens everything.

3109

assert!(opens(&db, "second", false) && opens(&db, "second", true));

3110

// The token it started with, which the runner Worker holds, still

3111

// finds the job's brokered secrets, and opens nothing else.

3112

assert!(opens(&db, "first", true));

3113

assert!(!opens(&db, "first", false));

3114

assert!(!opens(&db, "other", true));

3115

// Another swap keeps the token it started with, not the one between.

3116

assert!(rotate(&db, "third", "second"));

3117

assert!(opens(&db, "first", true));

3118

assert!(!opens(&db, "second", true));

}

#[test]

fn the_runtime_token_is_signed_for_the_token_that_replaces_the_first() {

3123

let now = 1_800_000_000;

3124

let token = crate::runtime::runtime_token("job_1", "run_1", &sha256_hex("second"), now, 600);

3125

assert!(crate::runtime::runtime_valid(&token, "job_1", &sha256_hex("second"), now));

3126

assert!(!crate::runtime::runtime_valid(&token, "job_1", &sha256_hex("first"), now));

}

}

#[cfg(test)]

mod stopping {

use super::stops_runs;

3133

use g1t_contracts::events::Event;

3134

use serde_json::{Value, json};

3135

3136

fn event(kind: &str, data: Value) -> Event {

Event {

id: "evt_1".into(),

kind: kind.into(),

source: "repos".into(),

3141

time: "2026-10-05T00:00:00Z".into(),

3142

repo_id: Some("rep_1".into()),

actor: None,

data,

}

}

#[test]

fn deleting_or_archiving_stops_runs() {

3150

assert_eq!(stops_runs(&event("repo.deleted", json!({ "repoId": "rep_1" }))).as_deref(), Some("rep_1"));

3151

assert_eq!(stops_runs(&event("repo.archived", json!({ "archived": true }))).as_deref(), Some("rep_1"));

3152

assert_eq!(stops_runs(&event("repo.unarchived", json!({ "archived": false }))), None);

3153

assert_eq!(stops_runs(&event("repo.restored", json!({}))), None);

3154

assert_eq!(stops_runs(&event("git.push", json!({}))), None);

}

}

#[cfg(test)]

mod status_of_needs {

3160

use std::collections::HashMap;

3161

3162

use super::ancestor_failed;

3163

3164

/// check -> plan -> (migrate) -> core -> edge, as deploy.yml has them,

3165

/// and a job that needs only the last.

3166

fn graph() -> HashMap<&'static str, Vec<&'static str>> {

3167

HashMap::from([

3168

("check", vec![]),

3169

("plan", vec!["check"]),

3170

("migrate", vec!["plan"]),

3171

("core", vec!["plan", "migrate"]),

3172

("edge", vec!["plan", "migrate", "core"]),

3173

("notify", vec!["edge"]),

])

}

#[test]

fn a_failure_is_seen_however_far_back() {

3179

let needs = graph();

3180

let failed = |which: &'static str| move |key: &str| key == which;

3181

// check failed; plan, and everything after, was skipped for it.

3182

assert!(ancestor_failed(&needs, "notify", failed("check")));

3183

assert!(ancestor_failed(&needs, "core", failed("check")));

3184

assert!(ancestor_failed(&needs, "edge", failed("core")));

3185

// Nothing before a job failed: a skipped migrate is not a failure.

3186

assert!(!ancestor_failed(&needs, "edge", |_| false));

3187

assert!(!ancestor_failed(&needs, "core", failed("edge")));

3188

assert!(!ancestor_failed(&needs, "check", failed("check")));

}

#[test]

fn cycles_and_unknown_keys_end() {

3193

let needs = HashMap::from([("a", vec!["b"]), ("b", vec!["a"])]);

3194

assert!(!ancestor_failed(&needs, "a", |_| false));

3195

assert!(!ancestor_failed(&needs, "missing", |_| true));

}

}

#[cfg(test)]

mod deployments {

use serde_json::{Map, Value, json};

3202

3203

use super::{JobEnvironment, deployment_outcome, environment_of};

3204

3205

#[test]

3206

fn a_jobs_environment_is_read_for_deployments() {

3207

let contexts: Map<String, Value> = serde_json::from_value(json!({

3208

"github": { "ref_name": "main", "repository": "acme/web" },

3209

"inputs": { "target": "staging" },

"matrix": {},

}))

.unwrap();

let read = |raw: Value| environment_of(&raw, &contexts);

3214

assert_eq!(read(json!({})), None);

3215

assert_eq!(

3216

read(json!({ "environment": "production" })),

3217

Some(JobEnvironment { name: "production".into(), url: None, deploys: true })

3218

);

3219

assert_eq!(

3220

read(json!({ "environment": { "name": "production", "url": "https://g1t.sh" } })),

3221

Some(JobEnvironment { name: "production".into(), url: Some("https://g1t.sh".into()), deploys: true })

3222

);

3223

// Expressions are filled in from the run.

3224

assert_eq!(

3225

read(json!({ "environment": { "name": "${{ inputs.target }}", "url": "https://${{ github.ref_name }}.example.com" } })),

3226

Some(JobEnvironment { name: "staging".into(), url: Some("https://main.example.com".into()), deploys: true })

3227

);

3228

// Secrets only: no deployment.

3229

assert!(!read(json!({ "environment": { "name": "production", "deployment": false } })).unwrap().deploys);

3230

// The same, said in the job's g1t settings.

3231

assert!(!read(json!({ "environment": "production", "g1t": { "deployment": false } })).unwrap().deploys);

3232

assert!(!read(json!({ "environment": { "name": "production" }, "g1t": { "deployment": false } })).unwrap().deploys);

3233

// Only http(s) addresses.

3234

assert_eq!(read(json!({ "environment": { "name": "production", "url": "javascript:alert(1)" } })).unwrap().url, None);

}

#[test]

fn a_runs_outcome_for_an_environment() {

3239

let of = |list: &[&str]| deployment_outcome(&list.iter().map(|c| Some((*c).to_owned())).collect::<Vec<_>>());

3240

assert_eq!(of(&["success", "skipped"]), Some("success"));

3241

assert_eq!(of(&["success", "failure"]), Some("failure"));

3242

assert_eq!(of(&["success", "cancelled"]), Some("error"));

3243

assert_eq!(of(&["skipped"]), None);

3244

assert_eq!(deployment_outcome(&[None]), None);

}

}

#[cfg(test)]

mod reruns {

use serde_json::{Map, Value, json};

3251

3252

use super::{MAX_SUMMARIES, MAX_SUMMARY_BYTES, Rerun, Scope, Status, call_allowed, call_prefix, debug_logging, rerun_keys, shown_name, summary_fits, top_key};

3253

3254

/// build ← test ← deploy, and lint on its own.

3255

fn keys(which: Rerun, failed: &[&str]) -> Vec<String> {

3256

let order = ["build", "lint", "test", "deploy"];

3257

let needs = |key: &str| -> Vec<String> {

3258

match key {

3259

"test" => vec!["build".into()],

3260

"deploy" => vec!["test".into()],

_ => Vec::new(),

}

};

rerun_keys(&order, needs, |key| !failed.contains(&key), which)

}

#[test]

fn a_rerun_takes_the_jobs_it_names_and_those_that_need_them() {

3269

assert_eq!(keys(Rerun::All, &[]), ["build", "lint", "test", "deploy"]);

3270

assert_eq!(keys(Rerun::Failed, &["test"]), ["test", "deploy"]);

3271

assert_eq!(keys(Rerun::Failed, &["lint"]), ["lint"]);

3272

assert!(keys(Rerun::Failed, &[]).is_empty());

3273

// One job, whatever it came to, and what depends on it.

3274

assert_eq!(keys(Rerun::Job("build"), &[]), ["build", "test", "deploy"]);

3275

assert_eq!(keys(Rerun::Job("lint"), &["test"]), ["lint"]);

3276

assert_eq!(keys(Rerun::Job("deploy"), &[]), ["deploy"]);

3277

assert!(keys(Rerun::Job("missing"), &[]).is_empty());

}

#[test]

fn a_called_workflows_jobs_run_again_with_the_job_that_calls_it() {

3282

assert_eq!(top_key("build/test"), "build");

3283

assert_eq!(top_key("build/inner/test"), "build");

3284

assert_eq!(top_key("lint"), "lint");

3285

// A matrix's calls each have their own jobs, under `key[i]/`.

3286

assert_eq!(top_key("build[1]/test"), "build");

3287

assert_eq!(top_key("build/inner[0]/test"), "build");

3288

assert_eq!(call_prefix("build", Some(1)), "build[1]");

3289

assert_eq!(call_prefix("build/inner", None), "build/inner");

}

#[test]

fn a_run_connects_ten_levels_of_workflows_and_fifty_reusable_ones() {

3294

assert!(call_allowed(1, &[], "a.yml").is_ok());

3295

assert!(call_allowed(9, &[], "a.yml").is_ok());

3296

let deep = call_allowed(10, &[], "a.yml").unwrap_err();

3297

assert!(deep.contains("at most ten") && deep.contains("nine levels"), "{deep}");

3298

let names: Vec<String> = (0..50).map(|n| format!("w{n}.yml")).collect();

3299

let fifty: Vec<&str> = names.iter().map(String::as_str).collect();

3300

// A workflow called again, as by each combination of a matrix, is one.

3301

assert!(call_allowed(1, &fifty, "w3.yml").is_ok());

3302

assert!(call_allowed(1, &fifty, "another.yml").unwrap_err().contains("at most 50 different"));

}

#[test]

fn a_matrixs_calls_are_named_by_the_caller_and_its_values() {

3307

let workflow = super::workflow::parse(

3308

"on: push\njobs:\n build:\n name: Build\n strategy:\n matrix: { os: [linux], node: [20] }\n uses: ./.g1t/workflows/b.yml\n plain:\n uses: ./.g1t/workflows/b.yml\n test:\n name: Test ${{ matrix.os }}\n strategy:\n matrix: { os: [linux] }\n runs-on: ubuntu-latest\n steps: [{ run: 'true' }]",

3309

)

3310

.unwrap();

3311

let job = |id: &str| workflow.jobs.iter().find(|job| job.id == id).unwrap();

3312

let combination: Map<String, Value> = serde_json::from_value(json!({ "os": "linux", "node": 20 })).unwrap();

3313

let mut contexts = Map::new();

3314

contexts.insert("matrix".into(), Value::Object(combination.clone()));

3315

let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };

3316

assert_eq!(shown_name(job("build"), None, &combination, &scope), "Build (linux, 20)");

3317

assert_eq!(shown_name(job("plain"), None, &Map::new(), &scope), "plain");

3318

// A called workflow's job, under the call that made it.

3319

assert_eq!(shown_name(job("plain"), Some("Build (linux, 20)"), &Map::new(), &scope), "Build (linux, 20) / plain");

3320

assert_eq!(shown_name(job("test"), Some("Build"), &combination, &scope), "Build / Test linux");

}

#[test]

fn a_job_keeps_twenty_steps_summaries_of_a_mebibyte_each() {

3325

assert!(summary_fits(0, None, 10));

3326

assert!(!summary_fits(0, None, 0), "nothing to keep");

3327

assert!(!summary_fits(MAX_SUMMARIES, None, 10), "a twenty-first step's summary is dropped");

3328

assert!(summary_fits(MAX_SUMMARIES, Some(10), 10), "a step that has one may add to it");

3329

assert!(summary_fits(1, Some(MAX_SUMMARY_BYTES - 10), 10));

3330

assert!(!summary_fits(1, Some(MAX_SUMMARY_BYTES - 10), 11));

3331

assert!(!summary_fits(0, None, MAX_SUMMARY_BYTES + 1));

}

#[test]

fn a_debug_rerun_sets_what_github_sets() {

3336

let mut variables = Map::new();

3337

let mut runner = json!({ "name": "g1t", "debug": "" });

3338

debug_logging(&mut variables, &mut runner);

3339

assert_eq!(variables["RUNNER_DEBUG"], "1");

3340

assert_eq!(variables["ACTIONS_STEP_DEBUG"], "true");

3341

assert_eq!(variables["ACTIONS_RUNNER_DEBUG"], "true");

3342

assert_eq!(runner["debug"], Value::String("1".into()));

3343

assert_eq!(runner["name"], "g1t");

}

}

#[cfg(test)]

mod machines {

use serde_json::json;

3350

3351

use super::{RunInfo, RunRow, run_is_public};

3352

3353

fn run(event: serde_json::Value) -> RunRow {

3354

let info = serde_json::to_string(&RunInfo { repository: "acme/web".into(), event, ..RunInfo::default() }).unwrap();

3355

serde_json::from_value(json!({

3356

"id": "run_1", "workflow_id": "wf_1", "repo_id": "rep_1", "repo": "acme/web", "path": ".g1t/workflows/ci.yml", "name": "CI",

3357

"title": "CI", "number": 1, "attempt": 1, "event": "push", "git_ref": "refs/heads/main", "sha": "abc", "status": "queued",

3358

"source": "", "info": info, "inputs": "{}", "trusted": 1, "created_at": "2026-10-18T00:00:00Z",

}))

.unwrap()

}

#[test]

fn a_runs_repository_is_public_only_when_its_event_says_so() {

3365

assert!(run_is_public(&run(json!({ "repository": { "private": false } }))));

3366

assert!(!run_is_public(&run(json!({ "repository": { "private": true } }))));

3367

// An event that doesn't say is taken as private: the standard machine.

3368

assert!(!run_is_public(&run(json!({}))));

3369

}

3370

}