Skip to content
Sign up

flagon-io/g1t

public
0

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
1,460 linesCodeBlameRaw
1//! Runs one GitHub Actions job, as GitHub's runner would: its steps in
2//! order, each `run` in a shell and each `uses` as the action it names,
3//! with the `${{ }}` contexts, the `GITHUB_*` variables and files, and the
4//! workflow commands steps print. It reports every step and the log to
5//! g1t as it goes.
6//!
7//! Configuration comes from the environment: `G1T_API`, and `ACTIONS_JOB`
8//! and `ACTIONS_TOKEN`, the job and its own token. Everything else, the
9//! job's definition, its contexts and its secrets, is fetched with them.
10
11mod blobs;
12mod containers;
13mod files;
14mod glob;
15mod matchers;
16mod paths;
17mod process;
18mod report;
19mod uses;
20/// Also unpacks the plugins a run gets from Customize (customize.rs).
21pub(crate) mod zip;
22
23use std::collections::{BTreeMap, BTreeSet};
24use std::path::{Path, PathBuf};
25use std::process::Command;
26use std::time::{Duration, Instant};
27
28use anyhow::{Context, Result};
29use g1t_actions::events::WORKSPACE;
30use g1t_actions::expr::{self, Scope, Status};
31use serde_json::{Map, Value, json};
32
33use files::StepFiles;
34use process::{Commands, Ended};
35use report::{Api, Log};
36
37const TEMP: &str = "/home/runner/_temp";
38/// Set to `1` by the self-hosted runner: the job's token is spent on its
39/// spec, and the harness carries on with the one that replaces it
40/// (`report::Api::spec`). A `G1T_` variable, so no step sees it.
41pub(crate) const ROTATE_TOKEN: &str = "G1T_ROTATE_JOB_TOKEN";
42
43/// Who is running steps: the job itself, or a composite action inside it.
44#[derive(Clone, Default)]
45pub(crate) struct Frame {
46 /// The `steps` context.
47 pub(crate) steps: Map<String, Value>,
48 /// A composite action's `inputs`, in place of the workflow's.
49 pub(crate) inputs: Option<Value>,
50 /// A composite action's folder, for `github.action_path`.
51 pub(crate) action_path: Option<String>,
52 /// Variables a composite action's caller set for its steps.
53 pub(crate) env: BTreeMap<String, String>,
54}
55
56/// A step run when the job's steps are done: an action's `post`, or
57/// saving the cache.
58pub(crate) struct Post {
59 pub(crate) name: String,
60 pub(crate) condition: String,
61 pub(crate) env: BTreeMap<String, String>,
62 pub(crate) run: PostRun,
63}
64
65pub(crate) enum PostRun {
66 Node { action_dir: PathBuf, script: String, using: String },
67 /// A Docker action's `post-entrypoint`.
68 Docker(containers::DockerRun),
69}
70
71pub(crate) struct Job {
72 pub(crate) log: Log,
73 pub(crate) spec: Value,
74 pub(crate) workspace: PathBuf,
75 pub(crate) temp: PathBuf,
76 /// This process's own variables, less its credentials, and GitHub's.
77 base_env: BTreeMap<String, String>,
78 /// Written to `GITHUB_ENV` by earlier steps.
79 added_env: BTreeMap<String, String>,
80 /// Written to `GITHUB_PATH` by earlier steps, newest first.
81 path_prepend: Vec<String>,
82 workflow_env: BTreeMap<String, String>,
83 job_env: BTreeMap<String, String>,
84 /// github, vars, secrets, inputs, matrix, needs, strategy, runner.
85 pub(crate) contexts: Map<String, Value>,
86 pub(crate) failed: bool,
87 pub(crate) posts: Vec<Post>,
88 step_names: Vec<String>,
89 deadline: Instant,
90 /// The running step's `timeout-minutes`, as an instant: the nearest of
91 /// the step's own and those of the steps around it (a composite
92 /// action's step inside a `uses:` step). Every process a step starts
93 /// stops by it, as every one stops by the job's deadline.
94 step_deadline: Option<Instant>,
95 debug: bool,
96 /// What the last Node process left, for the step that ran it.
97 pub(crate) last_node_outputs: BTreeMap<String, String>,
98 pub(crate) last_node_state: BTreeMap<String, String>,
99 /// What each action's `pre` saved, by its step's `GITHUB_ACTION`, for
100 /// the step's main and post.
101 pub(crate) pre_state: BTreeMap<String, BTreeMap<String, String>>,
102 /// The names of the sandbox's own variables, which a container does
103 /// not get.
104 host_env: BTreeSet<String>,
105 /// Whether this job has a Docker Engine of its own (g1t's machines).
106 pub(crate) docker_hosted: bool,
107 /// The job's network, once its containers have one.
108 pub(crate) network: Option<String>,
109 /// `services:`, by their names, and their containers' names.
110 pub(crate) services: Vec<(String, String)>,
111 /// `container:`, once started.
112 pub(crate) container: Option<containers::JobContainer>,
113 /// The `job` context's `container` and `services`.
114 pub(crate) job_context: Map<String, Value>,
115 /// Docker actions' images built in this job.
116 pub(crate) built_actions: containers::Built,
117 /// `RUNNER_TRACKING_ID`, which every process a step starts inherits.
118 tracking_id: String,
119}
120
121fn text_map(value: Option<&Value>) -> BTreeMap<String, String> {
122 value
123 .and_then(Value::as_object)
124 .map(|map| map.iter().map(|(k, v)| (k.clone(), expr::to_text(v))).collect())
125 .unwrap_or_default()
126}
127
128/// Where `name_steps` puts a step's `GITHUB_ACTION`.
129const ACTION_NAME: &str = "__g1t_action";
130
131/// Gives each step its `GITHUB_ACTION`, as GitHub's runner names them: its
132/// `id`, else `__run` for a script and `__owner_repo` for an action
133/// (`__self` for one in the repository), the second of a name `_2`, the
134/// third `_3`.
135pub(crate) fn name_steps(steps: &mut [Map<String, Value>]) {
136 let mut taken: BTreeSet<String> = steps.iter().filter_map(|step| step.get("id").map(expr::to_text)).collect();
137 for step in steps.iter_mut() {
138 let name = match step.get("id").map(expr::to_text) {
139 Some(id) => id,
140 None => {
141 let base = match step.get("uses").map(expr::to_text) {
142 None => "run".to_owned(),
143 Some(uses) if uses.starts_with("./") => "self".to_owned(),
144 Some(uses) => {
145 let name = uses.split('@').next().unwrap_or_default();
146 let name = name.strip_prefix("docker://").unwrap_or(name);
147 let repository: Vec<&str> = name.splitn(3, '/').take(2).collect();
148 repository.join("_").chars().map(|c| if c.is_ascii_alphanumeric() || c == '_' || c == '-' { c } else { '_' }).collect()
149 }
150 };
151 let base = format!("__{base}");
152 let mut name = base.clone();
153 let mut n = 2;
154 while taken.contains(&name) {
155 name = format!("{base}_{n}");
156 n += 1;
157 }
158 taken.insert(name.clone());
159 name
160 }
161 };
162 step.insert(ACTION_NAME.into(), Value::String(name));
163 }
164}
165
166/// A step's title when it has no name, as GitHub shows it.
167fn default_title(step: &Map<String, Value>) -> String {
168 if let Some(uses) = step.get("uses").and_then(Value::as_str) {
169 return format!("Run {uses}");
170 }
171 let run = step.get("run").map(expr::to_text).unwrap_or_default();
172 let first = run.lines().find(|line| !line.trim().is_empty()).unwrap_or_default().trim();
173 format!("Run {first}")
174}
175
176/// What GitHub's runner sets on a step itself, which its `env:` list leaves out.
177const RUNNER_SET: [&str; 2] = ["GITHUB_ACTION", "GITHUB_ACTION_PATH"];
178
179/// The step's variables as GitHub lists them under `env:`: each name and
180/// its value (masked later, as every line is), a value of several lines
181/// with the rest indented beneath it.
182fn env_lines(env: &BTreeMap<String, String>) -> Vec<String> {
183 let listed: Vec<(&String, &String)> = env.iter().filter(|(name, _)| !RUNNER_SET.contains(&name.as_str())).collect();
184 if listed.is_empty() {
185 return Vec::new();
186 }
187 let mut lines = vec!["env:".to_owned()];
188 for (name, value) in listed {
189 let mut parts = value.split('\n');
190 lines.push(format!(" {name}: {}", parts.next().unwrap_or_default()));
191 lines.extend(parts.map(|part| format!(" {part}")));
192 }
193 lines
194}
195
196/// How GitHub's runner opens a `run` step, in a group that starts folded:
197/// `Run` and the script's first line, the whole script (in cyan, as
198/// GitHub draws it), the shell it runs in and the step's variables.
199pub(crate) fn script_header(script: &str, shell: &str, env: &BTreeMap<String, String>) -> Vec<String> {
200 let first = script.lines().find(|line| !line.trim().is_empty()).unwrap_or_default().trim();
201 let mut lines = vec![format!("##[group]Run {first}")];
202 lines.extend(script.trim_matches(['\n', '\r']).lines().map(|line| format!("\u{1b}[36;1m{line}\u{1b}[0m")));
203 lines.push(format!("shell: {shell}"));
204 lines.extend(env_lines(env));
205 lines.push("##[endgroup]".into());
206 lines
207}
208
209/// How GitHub's runner opens a `uses:` step: `Run` and the action, its
210/// inputs under `with:` and the step's variables under `env:`.
211pub(crate) fn uses_header(uses: &str, with: &BTreeMap<String, String>, env: &BTreeMap<String, String>) -> Vec<String> {
212 let mut lines = vec![format!("##[group]Run {uses}")];
213 if !with.is_empty() {
214 lines.push("with:".into());
215 for (name, value) in with {
216 let mut parts = value.trim_end_matches('\n').split('\n');
217 lines.push(format!(" {name}: {}", parts.next().unwrap_or_default()));
218 lines.extend(parts.map(|part| format!(" {part}")));
219 }
220 }
221 lines.extend(env_lines(env));
222 lines.push("##[endgroup]".into());
223 lines
224}
225
226impl Job {
227 /// A shell's whole path, found on the step's `PATH` as GitHub's runner
228 /// shows it (`/usr/bin/bash`), or its name when it is not there.
229 fn program_path(&self, program: &str) -> String {
230 if Path::new(program).is_absolute() {
231 return program.to_owned();
232 }
233 let path = self.base_env.get("PATH").cloned().unwrap_or_default();
234 let dirs = self.path_prepend.iter().map(String::as_str).chain(path.split(paths::PATH_SEPARATOR));
235 let names: Vec<String> = if cfg!(windows) { vec![format!("{program}.exe"), program.to_owned()] } else { vec![program.to_owned()] };
236 dirs.filter(|dir| !dir.is_empty())
237 .flat_map(|dir| names.iter().map(move |name| Path::new(dir).join(name)))
238 .find(|candidate| candidate.is_file())
239 .map_or_else(|| program.to_owned(), |found| found.display().to_string())
240 }
241
242 pub(crate) fn base_env_value(&self, name: &str) -> Option<String> {
243 self.base_env.get(name).cloned()
244 }
245
246 /// What earlier steps added to `PATH`, newest first.
247 pub(crate) fn path_prepend_entries(&self) -> &[String] {
248 &self.path_prepend
249 }
250
251 /// How the job is going, for `success()`, `failure()`, `cancelled()`
252 /// and `always()`: once the run is cancelled, only steps that ask for
253 /// `always()` or `cancelled()` run.
254 fn status(&self) -> Status {
255 if report::cancelled() {
256 Status::Cancelled
257 } else if self.failed {
258 Status::Failure
259 } else {
260 Status::Success
261 }
262 }
263
264 /// `job.status`.
265 fn status_word(&self) -> &'static str {
266 if report::cancelled() {
267 "cancelled"
268 } else if self.failed {
269 "failure"
270 } else {
271 "success"
272 }
273 }
274
275 /// The contexts an expression in a step can use.
276 pub(crate) fn contexts_for(&self, frame: &Frame, env: &BTreeMap<String, String>) -> Map<String, Value> {
277 let mut contexts = self.contexts.clone();
278 contexts.insert("env".into(), Value::Object(env.iter().map(|(k, v)| (k.clone(), Value::String(v.clone()))).collect()));
279 contexts.insert("steps".into(), Value::Object(frame.steps.clone()));
280 contexts.insert("job".into(), containers::job_context(self.status_word(), &self.job_context));
281 if let Some(inputs) = &frame.inputs {
282 contexts.insert("inputs".into(), inputs.clone());
283 }
284 if let Some(path) = &frame.action_path
285 && let Some(github) = contexts.get_mut("github")
286 {
287 github["action_path"] = Value::String(path.clone());
288 }
289 contexts
290 }
291
292 /// Runs `f` with a scope over these contexts.
293 pub(crate) fn with_scope<T>(&self, contexts: &Map<String, Value>, f: impl FnOnce(&Scope) -> T) -> T {
294 let workspace = self.workspace.clone();
295 let hash = move |patterns: &[String]| files::hash_files(&workspace, patterns);
296 let scope = Scope {
297 contexts,
298 status: self.status(),
299 hash_files: Some(&hash),
300 };
301 f(&scope)
302 }
303
304 /// The `env` context for a step: the workflow's, the job's, what earlier
305 /// steps wrote to `GITHUB_ENV`, and the frame's.
306 pub(crate) fn env_context(&self, frame: &Frame) -> BTreeMap<String, String> {
307 let mut env = self.added_env.clone();
308 env.extend(self.workflow_env.clone());
309 env.extend(self.job_env.clone());
310 env.extend(frame.env.clone());
311 env
312 }
313
314 /// What a process for a step is given.
315 pub(crate) fn process_env(&self, env: &BTreeMap<String, String>, files: &StepFiles) -> BTreeMap<String, String> {
316 let mut out = self.base_env.clone();
317 out.extend(env.clone());
318 for (name, value) in files.variables() {
319 out.insert(name.to_owned(), value);
320 }
321 if !self.path_prepend.is_empty() {
322 let current = out.get("PATH").cloned().unwrap_or_default();
323 let separator = paths::PATH_SEPARATOR;
324 out.insert("PATH".into(), format!("{}{separator}{current}", self.path_prepend.join(separator)));
325 }
326 out
327 }
328
329 /// Takes in what a step wrote to its files. Returns its outputs.
330 pub(crate) fn absorb(&mut self, files: &StepFiles, commands: &Commands) -> (BTreeMap<String, String>, BTreeMap<String, String>) {
331 let mut outputs: BTreeMap<String, String> = commands.outputs.clone();
332 match files::key_values(&StepFiles::read(&files.output)) {
333 Ok(values) => outputs.extend(values),
334 Err(problem) => self.log.line(&format!("##[error]$GITHUB_OUTPUT: {problem}")),
335 }
336 match files::key_values(&StepFiles::read(&files.env)) {
337 Ok(values) => {
338 for (name, value) in values {
339 if name.starts_with("GITHUB_") || name == "NODE_OPTIONS" {
340 self.log.line(&format!("##[warning]{name} cannot be set through $GITHUB_ENV."));
341 continue;
342 }
343 self.added_env.insert(name, value);
344 }
345 }
346 Err(problem) => self.log.line(&format!("##[error]$GITHUB_ENV: {problem}")),
347 }
348 for line in StepFiles::read(&files.path).lines().map(str::trim).filter(|l| !l.is_empty()) {
349 self.path_prepend.insert(0, line.to_owned());
350 }
351 let mut state = commands.state.clone();
352 if let Ok(values) = files::key_values(&StepFiles::read(&files.state)) {
353 state.extend(values);
354 }
355 // The step's job summary, for the run's page (report.rs).
356 self.log.summary(&StepFiles::read(&files.summary));
357 (outputs, state)
358 }
359
360 pub(crate) fn remaining_time(&self) -> Duration {
361 self.remaining()
362 }
363
364 /// What is left for the running step: its `timeout-minutes`, within
365 /// the job's.
366 fn remaining(&self) -> Duration {
367 let until = self.step_deadline.map_or(self.deadline, |step| step.min(self.deadline));
368 until.saturating_duration_since(Instant::now())
369 }
370
371 /// What is left of the job's own time, whatever the step's.
372 fn job_remaining(&self) -> Duration {
373 self.deadline.saturating_duration_since(Instant::now())
374 }
375
376 /// Runs a shell script for a `run` step.
377 pub(crate) fn run_script(
378 &mut self,
379 script: &str,
380 shell: Option<&str>,
381 working_directory: Option<&str>,
382 env: &BTreeMap<String, String>,
383 timeout: Duration,
384 ) -> (bool, BTreeMap<String, String>, BTreeMap<String, String>) {
385 crate::abuse::touch();
386 // Mining is never a workflow's job (abuse.rs).
387 if let Some(miner) = crate::abuse::miner_in(script) {
388 self.log.line(&format!("##[error]g1t does not run cryptocurrency miners ({miner}). This step was not run."));
389 return (false, BTreeMap::new(), BTreeMap::new());
390 }
391 let id = format!("{:x}", rand_id());
392 let shell = shell.map(str::trim).filter(|s| !s.is_empty());
393 let (program, args, extension): (String, Vec<String>, &str) = match shell {
394 // A self-hosted Windows runner, as GitHub's: PowerShell.
395 None if cfg!(windows) => (windows_powershell(), powershell_args(), "ps1"),
396 // A job container without bash, as GitHub's runner does.
397 None if self.container.as_ref().is_some_and(|c| c.shell == "sh") => ("sh".into(), vec!["-e".into(), "{0}".into()], "sh"),
398 None => ("bash".into(), vec!["-e".into(), "{0}".into()], "sh"),
399 Some("bash") => ("bash".into(), vec!["--noprofile".into(), "--norc".into(), "-eo".into(), "pipefail".into(), "{0}".into()], "sh"),
400 Some("sh") => ("sh".into(), vec!["-e".into(), "{0}".into()], "sh"),
401 Some("python") => (self.python_program(), vec!["{0}".into()], "py"),
402 Some("pwsh") if cfg!(windows) || program_exists("pwsh") => ("pwsh".into(), powershell_args(), "ps1"),
403 Some("powershell") if cfg!(windows) => ("powershell".into(), powershell_args(), "ps1"),
404 Some("cmd") if cfg!(windows) => (
405 "cmd".into(),
406 vec!["/D".into(), "/E:ON".into(), "/V:OFF".into(), "/S".into(), "/C".into(), "CALL \"{0}\"".into()],
407 "cmd",
408 ),
409 Some(other @ ("pwsh" | "powershell" | "cmd")) => {
410 self.log.line(&format!(
411 "##[error]`shell: {other}` needs Windows or PowerShell, which g1t's Linux runners do not have. A self-hosted Windows runner can run it: `runs-on: [self-hosted, windows]`."
412 ));
413 return (false, BTreeMap::new(), BTreeMap::new());
414 }
415 Some(custom) => {
416 let mut parts = custom.split_whitespace().map(str::to_owned);
417 let program = parts.next().unwrap_or_default();
418 let mut args: Vec<String> = parts.collect();
419 if !args.iter().any(|a| a.contains("{0}")) {
420 args.push("{0}".into());
421 }
422 let extension = script_extension(&program);
423 (program, args, extension)
424 }
425 };
426 let script_path = self.temp.join(if extension.is_empty() { id.clone() } else { format!("{id}.{extension}") });
427 if let Err(error) = std::fs::write(&script_path, script_contents(&program, script)) {
428 self.log.line(&format!("##[error]Could not write the script: {error}"));
429 return (false, BTreeMap::new(), BTreeMap::new());
430 }
431 let files = match StepFiles::new(&self.temp, &id) {
432 Ok(files) => files,
433 Err(error) => {
434 self.log.line(&format!("##[error]Could not make the step's files: {error}"));
435 return (false, BTreeMap::new(), BTreeMap::new());
436 }
437 };
438 // GitHub's opening of a `run` step, folded: the script, the shell
439 // it runs in (the program's whole path) and the step's variables.
440 let shown_program = if self.container.is_some() { program.clone() } else { self.program_path(&program) };
441 for line in script_header(script, &format!("{shown_program} {}", args.join(" ")), env) {
442 self.log.line(&line);
443 }
444 let args: Vec<String> = args.iter().map(|a| a.replace("{0}", &paths::shown(&script_path))).collect();
445 let dir = match working_directory {
446 Some(dir) if Path::new(dir).is_absolute() => PathBuf::from(dir),
447 Some(dir) => self.workspace.join(dir),
448 None => self.workspace.clone(),
449 };
450 let full = self.process_env(env, &files);
451 let in_container = self.container.as_ref().map(|c| c.path.clone()).and_then(|image_path| {
452 let inside = self.container_env(env, full.clone(), &image_path);
453 self.in_container(&program, &args, &dir, inside)
454 });
455 let command = match in_container {
456 Some(command) => command,
457 None => {
458 let mut command = Command::new(&program);
459 command.args(&args).current_dir(&dir).env_clear().envs(full);
460 command
461 }
462 };
463 let mut commands = Commands {
464 debug: self.debug,
465 ..Commands::default()
466 };
467 let ended = process::run(command, timeout.min(self.remaining()), &mut self.log, &mut commands);
468 let ok = match ended {
469 Ok(Ended::Exited(0)) => true,
470 Ok(Ended::Exited(code)) => {
471 self.log.line(&format!("##[error]Process completed with exit code {code}."));
472 false
473 }
474 Ok(Ended::TimedOut) => {
475 self.log.line("##[error]The step ran past its time limit and was stopped.");
476 false
477 }
478 Ok(Ended::Cancelled) => false,
479 Err(error) => {
480 self.log.line(&format!("##[error]{program} could not be started: {error}"));
481 false
482 }
483 };
484 let (outputs, state) = self.absorb(&files, &commands);
485 (ok, outputs, state)
486 }
487
488 /// Runs one step of a frame. Returns whether it succeeded (its
489 /// conclusion). `number` is the step the log belongs to.
490 pub(crate) fn step(&mut self, frame: &mut Frame, step: &Map<String, Value>, number: u32, report: bool, defaults: &Map<String, Value>) -> bool {
491 // A cancellation heard during an earlier step (which it stopped) or
492 // since: from here on, only cleanup steps run, and none is stopped
493 // for it again.
494 if report::cancelled() {
495 report::take_cancel();
496 }
497 let env_before = self.env_context(frame);
498 let contexts = self.contexts_for(frame, &env_before);
499 let title = match step.get("name").map(expr::to_text) {
500 Some(name) => self.with_scope(&contexts, |scope| expr::interpolate(&name, scope)).unwrap_or(name),
501 None => default_title(step),
502 };
503 let condition = step.get("if").map(expr::to_text).unwrap_or_default();
504 let read = self.with_scope(&contexts, |scope| expr::condition(&condition, scope));
505 // Debug logging: how the step's `if` read, as GitHub's runner says.
506 if self.debug {
507 let shown = if condition.trim().is_empty() { "success()" } else { condition.trim() };
508 self.log.line(&format!("##[debug]Evaluating condition for step: '{title}'"));
509 self.log.line(&format!("##[debug]Evaluating: {shown}"));
510 match &read {
511 Ok(result) => self.log.line(&format!("##[debug]Result: {result}")),
512 Err(problem) => self.log.line(&format!("##[debug]Failed: {problem}")),
513 }
514 }
515 let run_it = match read {
516 Ok(run_it) => run_it,
517 Err(problem) => {
518 self.log.line(&format!("##[error]The step's `if` does not read: {problem}"));
519 self.failed = true;
520 if report {
521 self.log.step_state(number, &title, "completed", Some("failure"));
522 }
523 return false;
524 }
525 };
526 let id = step.get("id").map(expr::to_text);
527 if !run_it {
528 if let Some(id) = &id {
529 frame.steps.insert(id.clone(), json!({ "outputs": {}, "outcome": "skipped", "conclusion": "skipped" }));
530 }
531 if report {
532 self.log.step_state(number, &title, "completed", Some("skipped"));
533 }
534 return true;
535 }
536 if report {
537 self.log.step(number);
538 self.log.step_state(number, &title, "in_progress", None);
539 }
540
541 // The step's own env, read with the contexts before it.
542 let env = self.step_env(step, &contexts, env_before.clone());
543 let action_name = step.get(ACTION_NAME).map(expr::to_text).or_else(|| id.clone()).unwrap_or_else(|| "__run".into());
544 let minutes = step
545 .get("timeout-minutes")
546 .and_then(|v| self.with_scope(&contexts, |scope| expr::interpolate_value(v, scope)).ok())
547 .and_then(|v| v.as_f64().or_else(|| expr::to_text(&v).parse().ok()));
548 let timeout = step_timeout(minutes);
549 // Every step stops at its own `timeout-minutes`, `run` or `uses`: a
550 // `uses:` step's action, and every process it starts, included.
551 let outer_deadline = self.step_deadline;
552 self.step_deadline = step_deadline(outer_deadline, Instant::now(), minutes);
553 let continue_on_error = step
554 .get("continue-on-error")
555 .and_then(|v| self.with_scope(&contexts, |scope| expr::interpolate_value(v, scope)).ok())
556 .is_some_and(|v| expr::truthy(&v));
557
558 let (ok, outputs) = if let Some(run) = step.get("run").map(expr::to_text) {
559 let script = match self.with_scope(&contexts, |scope| expr::interpolate(&run, scope)) {
560 Ok(script) => script,
561 Err(problem) => {
562 self.log.line(&format!("##[error]The script does not read: {problem}"));
563 String::new()
564 }
565 };
566 let shell = step
567 .get("shell")
568 .map(expr::to_text)
569 .or_else(|| defaults.get("shell").map(expr::to_text));
570 if frame.action_path.is_some() && shell.is_none() {
571 self.log.line("##[error]A composite action's `run` steps need a `shell`.");
572 (false, BTreeMap::new())
573 } else {
574 let working_directory = step
575 .get("working-directory")
576 .or_else(|| defaults.get("working-directory"))
577 .map(|v| self.with_scope(&contexts, |scope| expr::interpolate(&expr::to_text(v), scope)).unwrap_or_else(|_| expr::to_text(v)));
578 let mut env = env;
579 if let Some(path) = &frame.action_path {
580 env.insert("GITHUB_ACTION_PATH".into(), path.clone());
581 }
582 env.insert("GITHUB_ACTION".into(), action_name.clone());
583 let (ok, outputs, _) = self.run_script(&script, shell.as_deref(), working_directory.as_deref(), &env, timeout);
584 (ok, outputs)
585 }
586 } else if let Some(uses) = step.get("uses").map(expr::to_text) {
587 let with = self.step_with(step, &contexts);
588 self.uses(&uses, &with, &env, frame, &title, &action_name, timeout)
589 } else {
590 self.log.line("##[error]A step needs `run` or `uses`.");
591 (false, BTreeMap::new())
592 };
593 let own_deadline = self.step_deadline.filter(|_| self.step_deadline != outer_deadline);
594 self.step_deadline = outer_deadline;
595 let ok = if own_deadline.is_some_and(|until| Instant::now() >= until) {
596 self.log.line(&format!(
597 "##[error]The step ran past its timeout-minutes ({}) and was stopped.",
598 minutes.unwrap_or_default()
599 ));
600 false
601 } else {
602 ok
603 };
604
605 // A step the cancellation stopped ends cancelled, not failed.
606 let stopped = !ok && report::cancelled();
607 let outcome = if ok {
608 "success"
609 } else if stopped {
610 "cancelled"
611 } else {
612 "failure"
613 };
614 let conclusion = if ok || continue_on_error {
615 "success"
616 } else {
617 outcome
618 };
619 if !ok && continue_on_error && !stopped {
620 self.log.line("##[warning]The step failed, and `continue-on-error` lets the job go on.");
621 }
622 if let Some(id) = &id {
623 let outputs: Map<String, Value> = outputs.iter().map(|(k, v)| (k.clone(), Value::String(v.clone()))).collect();
624 frame.steps.insert(id.clone(), json!({ "outputs": outputs, "outcome": outcome, "conclusion": conclusion }));
625 }
626 if conclusion == "failure" {
627 self.failed = true;
628 }
629 if report {
630 self.log.step_state(number, &title, "completed", Some(conclusion));
631 }
632 conclusion == "success"
633 }
634
635 /// A step's own `env` over `base`, read with `contexts`.
636 fn step_env(&self, step: &Map<String, Value>, contexts: &Map<String, Value>, mut base: BTreeMap<String, String>) -> BTreeMap<String, String> {
637 if let Some(Value::Object(step_env)) = step.get("env") {
638 for (name, value) in step_env {
639 let value = self.with_scope(contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
640 base.insert(name.clone(), expr::to_text(&value));
641 }
642 }
643 base
644 }
645
646 /// A `uses:` step's `with`, read with `contexts`.
647 fn step_with(&self, step: &Map<String, Value>, contexts: &Map<String, Value>) -> BTreeMap<String, String> {
648 match step.get("with") {
649 Some(Value::Object(with)) => with
650 .iter()
651 .map(|(k, v)| {
652 let value = self.with_scope(contexts, |scope| expr::interpolate_value(v, scope)).unwrap_or(Value::Null);
653 (k.clone(), expr::to_text(&value))
654 })
655 .collect(),
656 _ => BTreeMap::new(),
657 }
658 }
659
660 fn report_steps(&self) {
661 self.log.steps(&self.step_names);
662 }
663}
664
665/// How long a step's processes may run: its `timeout-minutes`, or six
666/// hours (the job's own limit still applies).
667fn step_timeout(minutes: Option<f64>) -> Duration {
668 match minutes {
669 Some(minutes) if minutes.is_finite() && minutes > 0.0 => Duration::from_secs_f64(minutes * 60.0),
670 Some(_) => Duration::ZERO,
671 None => Duration::from_secs(6 * 3600),
672 }
673}
674
675/// When a step must end by: its `timeout-minutes` from `now`, or `outer`
676/// (the deadline of the `uses:` step it runs inside, for a composite
677/// action's step), whichever is nearer. None when neither sets one.
678fn step_deadline(outer: Option<Instant>, now: Instant, minutes: Option<f64>) -> Option<Instant> {
679 let own = minutes.map(|minutes| now + step_timeout(Some(minutes)));
680 match (outer, own) {
681 (Some(outer), Some(own)) => Some(outer.min(own)),
682 (outer, own) => outer.or(own),
683 }
684}
685
686/// PowerShell on Windows: `pwsh` (PowerShell 7) if it is installed, as on
687/// GitHub's Windows runners, else Windows PowerShell.
688fn windows_powershell() -> String {
689 if program_exists("pwsh") { "pwsh".into() } else { "powershell".into() }
690}
691
692/// How GitHub runs a PowerShell step: the script, stopping at the first error.
693fn powershell_args() -> Vec<String> {
694 vec!["-NoLogo".into(), "-NoProfile".into(), "-NonInteractive".into(), "-Command".into(), ". '{0}'".into()]
695}
696
697/// The name of a shell's program, without its folder or `.exe`.
698fn program_name(program: &str) -> &str {
699 let name = program.rsplit(['/', '\\']).next().unwrap_or(program);
700 name.strip_suffix(".exe").or_else(|| name.strip_suffix(".EXE")).unwrap_or(name)
701}
702
703/// The extension GitHub's runner gives a script, by its shell's program:
704/// none for a program it does not know.
705fn script_extension(program: &str) -> &'static str {
706 match program_name(program) {
707 "bash" | "sh" => "sh",
708 "pwsh" | "powershell" => "ps1",
709 "cmd" => "cmd",
710 "python" => "py",
711 _ => "",
712 }
713}
714
715/// A script as GitHub's runner writes it: for PowerShell, stopping at the
716/// first error and exiting with the last program's exit code.
717fn script_contents(program: &str, script: &str) -> String {
718 let newline = if cfg!(windows) { "\r\n" } else { "\n" };
719 match program_name(program) {
720 "pwsh" | "powershell" => format!(
721 "$ErrorActionPreference = 'stop'{newline}{script}{newline}if ((Test-Path -LiteralPath variable:\\LASTEXITCODE)) {{ exit $LASTEXITCODE }}"
722 ),
723 _ => script.to_owned(),
724 }
725}
726
727/// Whether `program` is a file in one of `path`'s folders (or, on
728/// Windows, `program.exe`), without running it.
729fn on_path(program: &str, path: &str) -> bool {
730 let names = if cfg!(windows) { vec![program.to_owned(), format!("{program}.exe")] } else { vec![program.to_owned()] };
731 path.split(paths::PATH_SEPARATOR).filter(|dir| !dir.is_empty()).any(|dir| names.iter().any(|name| Path::new(dir).join(name).is_file()))
732}
733
734impl Job {
735 /// `shell: python`'s program: `python`, as on GitHub, where there is
736 /// one, else `python3` (Debian has no `python`).
737 fn python_program(&self) -> String {
738 if let Some(container) = &self.container {
739 return container.python.into();
740 }
741 let path = std::iter::once(self.base_env.get("PATH").cloned().unwrap_or_default());
742 let path: Vec<String> = self.path_prepend.iter().cloned().chain(path).collect();
743 if on_path("python", &path.join(paths::PATH_SEPARATOR)) { "python".into() } else { "python3".into() }
744 }
745}
746
747/// Whether `program` is on `PATH`.
748fn program_exists(program: &str) -> bool {
749 Command::new(program)
750 .arg(if program == "cmd" { "/C" } else { "-Version" })
751 .stdout(std::process::Stdio::null())
752 .stderr(std::process::Stdio::null())
753 .status()
754 .is_ok()
755}
756
757/// An id for files, unique enough within one job.
758fn rand_id() -> u64 {
759 use std::sync::atomic::{AtomicU64, Ordering};
760 static NEXT: AtomicU64 = AtomicU64::new(1);
761 let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos() as u64).unwrap_or(0);
762 nanos ^ (NEXT.fetch_add(1, Ordering::Relaxed) << 48)
763}
764
765fn interpolated_map(job: &Job, value: Option<&Value>, contexts: &Map<String, Value>) -> BTreeMap<String, String> {
766 let mut out = BTreeMap::new();
767 if let Some(Value::Object(map)) = value {
768 for (name, value) in map {
769 let value = job.with_scope(contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
770 out.insert(name.clone(), expr::to_text(&value));
771 }
772 }
773 out
774}
775
776/// Whether `::debug::` lines are shown and steps' conditions explained:
777/// `ACTIONS_STEP_DEBUG` as a secret or a variable set to `true`, or a
778/// re-run with debug logging, which sets it and `RUNNER_DEBUG=1` among the
779/// job's variables.
780fn step_debug(contexts: &Map<String, Value>, variables: &Value) -> bool {
781 let named = |name: &str| {
782 contexts
783 .get("secrets")
784 .and_then(|s| s.get(name))
785 .or_else(|| contexts.get("vars").and_then(|v| v.get(name)))
786 .or_else(|| variables.get(name))
787 .is_some_and(|v| expr::to_text(v).eq_ignore_ascii_case("true"))
788 };
789 named("ACTIONS_STEP_DEBUG") || variables.get("RUNNER_DEBUG").is_some_and(|v| expr::to_text(v) == "1")
790}
791
792fn setup(spec: Value, api: Api) -> Result<Job> {
793 setup_in(spec, api, paths::under_home(WORKSPACE), paths::under_home(TEMP))
794}
795
796/// [`setup`] with the workspace and temporary folder given: a test's own.
797fn setup_in(mut spec: Value, api: Api, workspace: PathBuf, temp: PathBuf) -> Result<Job> {
798 let masks: Vec<String> = spec["masks"].as_array().map(|m| m.iter().filter_map(|v| v.as_str().map(str::to_owned)).collect()).unwrap_or_default();
799 let mut log = Log::new(api, masks);
800 // Variables GitHub sets that a g1t from before them does not send.
801 default_variables(&mut spec);
802 // On a self-hosted runner's own machine, GitHub's layout lives in a
803 // folder of the runner's (paths.rs).
804 for part in ["variables", "github"] {
805 paths::relocate(&mut spec[part]);
806 }
807 paths::relocate(&mut spec["contexts"]["runner"]);
808 log.matchers.workspace = workspace.clone();
809 std::fs::create_dir_all(&workspace).context("could not make the workspace")?;
810 std::fs::create_dir_all(&temp).context("could not make the temporary folder")?;
811 std::fs::write(temp.join("event.json"), serde_json::to_string_pretty(&spec["event"])?)?;
812
813 let host_env: BTreeSet<String> = std::env::vars().map(|(name, _)| name).collect();
814 // Docker of the job's own, on g1t's machines (crate::docker).
815 let docker_hosted = cfg!(target_os = "linux")
816 && std::env::var("G1T_DOCKER").as_deref() == Ok("on")
817 && spec["variables"]["RUNNER_ENVIRONMENT"].as_str() != Some("self-hosted");
818 // This process's environment, less what only it should see. `ImageOS`
819 // and `ImageVersion` come with it when the machine's image sets them,
820 // as GitHub's images do; nothing makes them up otherwise.
821 let mut base_env: BTreeMap<String, String> =
822 std::env::vars().filter(|(name, _)| !matches!(name.as_str(), "ACTIONS_TOKEN" | "ACTIONS_JOB" | "MODE") && !name.starts_with("G1T_")).collect();
823 base_env.insert("HOME".into(), std::env::var("HOME").unwrap_or_else(|_| "/home/node".into()));
824 base_env.extend(text_map(spec.get("variables")));
825 base_env.insert("GITHUB_EVENT_PATH".into(), paths::shown(&temp.join("event.json")));
826 // As GitHub's runner marks what a job starts, so "Complete job" finds
827 // what its steps left running (process::orphans).
828 let tracking_id = format!("github_{:016x}{:016x}", rand_id(), rand_id());
829 base_env.insert("RUNNER_TRACKING_ID".into(), tracking_id.clone());
830
831 let mut contexts: Map<String, Value> = spec["contexts"].as_object().cloned().unwrap_or_default();
832 contexts.insert("github".into(), spec["github"].clone());
833 let debug = step_debug(&contexts, &spec["variables"]);
834
835 // `timeoutMinutes` is how the API spelled it before its bodies were
836 // `snake_case`.
837 let timeout = spec["timeout_minutes"]
838 .as_u64()
839 .or_else(|| spec["timeoutMinutes"].as_u64())
840 .unwrap_or(60);
841 let mut job = Job {
842 log,
843 spec,
844 workspace,
845 temp,
846 base_env,
847 added_env: BTreeMap::new(),
848 path_prepend: Vec::new(),
849 workflow_env: BTreeMap::new(),
850 job_env: BTreeMap::new(),
851 contexts,
852 failed: false,
853 posts: Vec::new(),
854 step_names: Vec::new(),
855 deadline: Instant::now() + Duration::from_secs(timeout * 60),
856 step_deadline: None,
857 debug,
858 last_node_outputs: BTreeMap::new(),
859 last_node_state: BTreeMap::new(),
860 pre_state: BTreeMap::new(),
861 host_env,
862 docker_hosted,
863 network: None,
864 services: Vec::new(),
865 container: None,
866 job_context: Map::new(),
867 built_actions: containers::Built::new(),
868 tracking_id,
869 };
870
871 // The workflow's env reads github, secrets, inputs and vars; the job's
872 // also its matrix, needs and strategy.
873 let mut contexts = job.contexts.clone();
874 contexts.insert("env".into(), json!({}));
875 job.workflow_env = interpolated_map(&job, job.spec["workflow"].get("env"), &contexts);
876 contexts.insert("env".into(), Value::Object(job.workflow_env.iter().map(|(k, v)| (k.clone(), json!(v))).collect()));
877 job.job_env = interpolated_map(&job, job.spec["spec"].get("env"), &contexts);
878 Ok(job)
879}
880
881/// `RUNNER_WORKSPACE` and `GITHUB_REPOSITORY_OWNER_ID` (with
882/// `github.repository_owner_id`), when the spec does not have them: the
883/// folder the workspace is in, and the owner's id from the event.
884fn default_variables(spec: &mut Value) {
885 if spec["variables"].is_object() && spec["variables"].get("RUNNER_WORKSPACE").is_none() {
886 spec["variables"]["RUNNER_WORKSPACE"] = json!(g1t_actions::events::RUNNER_WORKSPACE);
887 }
888 let owner_id = g1t_actions::events::owner_id(&spec["event"]);
889 if let Some(owner_id) = owner_id.filter(|id| !id.is_empty()) {
890 if spec["variables"].is_object() && spec["variables"].get("GITHUB_REPOSITORY_OWNER_ID").and_then(Value::as_str).is_none_or(str::is_empty) {
891 spec["variables"]["GITHUB_REPOSITORY_OWNER_ID"] = json!(owner_id);
892 }
893 if spec["github"].is_object() && spec["github"].get("repository_owner_id").and_then(Value::as_str).is_none_or(str::is_empty) {
894 spec["github"]["repository_owner_id"] = json!(owner_id);
895 }
896 }
897}
898
899/// What "Set up job" says of the runner and the machine it runs on.
900#[derive(Default)]
901pub(crate) struct Machine {
902 pub(crate) version: String,
903 pub(crate) self_hosted: bool,
904 pub(crate) runner_name: String,
905 /// `RUNNER_OS` and `RUNNER_ARCH`.
906 pub(crate) os: String,
907 pub(crate) arch: String,
908 /// `/etc/os-release`, where there is one.
909 pub(crate) os_release: Option<String>,
910 /// `ImageOS` and `ImageVersion`, when the machine's image sets them.
911 pub(crate) image: Option<(String, String)>,
912 pub(crate) cpus: usize,
913 pub(crate) memory_bytes: Option<u64>,
914 /// The job token's permissions, by GitHub's names.
915 pub(crate) permissions: Vec<(String, String)>,
916}
917
918impl Machine {
919 fn here(spec: &Value, base_env: &BTreeMap<String, String>) -> Machine {
920 let variables = &spec["variables"];
921 let text = |name: &str| variables[name].as_str().unwrap_or_default().to_owned();
922 let self_hosted = variables["RUNNER_ENVIRONMENT"] == "self-hosted";
923 let image = match (base_env.get("ImageOS"), base_env.get("ImageVersion")) {
924 (None, None) => None,
925 (os, version) => Some((os.cloned().unwrap_or_default(), version.cloned().unwrap_or_default())),
926 };
927 let permissions = spec
928 .get("permissions")
929 .and_then(Value::as_object)
930 .map(|map| map.iter().map(|(name, access)| (name.clone(), expr::to_text(access))).collect())
931 .unwrap_or_default();
932 Machine {
933 version: env!("CARGO_PKG_VERSION").to_owned(),
934 self_hosted,
935 runner_name: if self_hosted { text("RUNNER_NAME") } else { "g1t".to_owned() },
936 os: text("RUNNER_OS"),
937 arch: text("RUNNER_ARCH"),
938 os_release: std::fs::read_to_string("/etc/os-release").ok(),
939 image,
940 cpus: std::thread::available_parallelism().map_or(1, usize::from),
941 memory_bytes: memory_limit(
942 std::fs::read_to_string("/sys/fs/cgroup/memory.max").ok().as_deref(),
943 std::fs::read_to_string("/proc/meminfo").ok().as_deref(),
944 ),
945 permissions,
946 }
947 }
948}
949
950/// The memory a job has: its cgroup's limit, else the machine's.
951fn memory_limit(cgroup_max: Option<&str>, meminfo: Option<&str>) -> Option<u64> {
952 let total = meminfo.and_then(|info| {
953 info.lines().find_map(|line| line.strip_prefix("MemTotal:")).and_then(|rest| rest.trim().trim_end_matches("kB").trim().parse::<u64>().ok()).map(|kb| kb * 1024)
954 });
955 let limit = cgroup_max.and_then(|max| max.trim().parse::<u64>().ok());
956 match (limit, total) {
957 (Some(limit), Some(total)) => Some(limit.min(total)),
958 (limit, total) => limit.or(total),
959 }
960}
961
962/// `pull-requests` as GitHub's log names it: `PullRequests`.
963fn permission_title(name: &str) -> String {
964 name.split(['-', '_'])
965 .map(|word| {
966 let mut chars = word.chars();
967 chars.next().map(|first| first.to_ascii_uppercase().to_string() + chars.as_str()).unwrap_or_default()
968 })
969 .collect()
970}
971
972/// GitHub's "Set up job", before the actions are downloaded: the runner's
973/// version and name, the operating system, the image, the machine, what
974/// the job's token may do and where its secrets come from.
975pub(crate) fn setup_header(machine: &Machine) -> Vec<String> {
976 let mut lines = vec![format!("Current runner version: '{}'", machine.version), format!("Runner name: '{}'", machine.runner_name)];
977 lines.push("##[group]Operating System".into());
978 let release = machine.os_release.as_deref().unwrap_or_default();
979 let field = |key: &str| {
980 release.lines().find_map(|line| line.strip_prefix(key).and_then(|rest| rest.strip_prefix('='))).map(|value| value.trim().trim_matches('"').to_owned()).filter(|v| !v.is_empty())
981 };
982 match field("NAME") {
983 Some(name) => {
984 lines.push(name);
985 lines.extend(field("VERSION").or_else(|| field("VERSION_ID")));
986 }
987 None => lines.push(format!("{} {}", machine.os, machine.arch).trim().to_owned()),
988 }
989 lines.push("##[endgroup]".into());
990 if machine.image.is_some() || !machine.self_hosted {
991 lines.push("##[group]Runner Image".into());
992 if let Some((os, version)) = &machine.image {
993 if !os.is_empty() {
994 lines.push(format!("Image: {os}"));
995 }
996 if !version.is_empty() {
997 lines.push(format!("Version: {version}"));
998 }
999 }
1000 if !machine.self_hosted {
1001 lines.push("Included Software: Node 24, Python 3, Go, Rust".into());
1002 }
1003 lines.push("##[endgroup]".into());
1004 }
1005 lines.push("##[group]Machine".into());
1006 lines.push(if machine.self_hosted { "Self-hosted".into() } else { "Hosted by g1t".to_owned() });
1007 lines.push(format!("Architecture: {}", machine.arch));
1008 lines.push(format!("CPUs: {}", machine.cpus));
1009 if let Some(bytes) = machine.memory_bytes {
1010 let gib = bytes as f64 / (1024.0 * 1024.0 * 1024.0);
1011 let shown = if (gib - gib.round()).abs() < 0.05 { format!("{}", gib.round()) } else { format!("{gib:.1}") };
1012 lines.push(format!("Memory: {shown} GB"));
1013 }
1014 lines.push("##[endgroup]".into());
1015 let granted: Vec<&(String, String)> = machine.permissions.iter().filter(|(_, access)| access != "none" && !access.is_empty()).collect();
1016 if !granted.is_empty() {
1017 lines.push("##[group]G1T_TOKEN Permissions".into());
1018 lines.extend(granted.iter().map(|(name, access)| format!("{}: {access}", permission_title(name))));
1019 lines.push("##[endgroup]".into());
1020 }
1021 lines.push("Secret source: Actions".into());
1022 lines.push("Prepare workflow directory".into());
1023 lines
1024}
1025
1026/// The job's `defaults.run`, its own over the workflow's.
1027fn run_defaults(spec: &Value) -> Map<String, Value> {
1028 let mut defaults = spec["workflow"]["defaults"]["run"].as_object().cloned().unwrap_or_default();
1029 if let Some(own) = spec["spec"]["defaults"]["run"].as_object() {
1030 defaults.extend(own.clone());
1031 }
1032 defaults
1033}
1034
1035fn run_job(job: &mut Job) {
1036 let mut steps: Vec<Map<String, Value>> = job.spec["spec"]["steps"]
1037 .as_array()
1038 .map(|steps| steps.iter().filter_map(|s| s.as_object().cloned()).collect())
1039 .unwrap_or_default();
1040 name_steps(&mut steps);
1041 let defaults = run_defaults(&job.spec);
1042
1043 // Step names as they read before anything has run.
1044 let frame = Frame::default();
1045 let env = job.env_context(&frame);
1046 let contexts = job.contexts_for(&frame, &env);
1047 job.step_names = steps
1048 .iter()
1049 .map(|step| match step.get("name").map(expr::to_text) {
1050 Some(name) => job.with_scope(&contexts, |scope| expr::interpolate(&name, scope)).unwrap_or(name),
1051 None => default_title(step),
1052 })
1053 .collect();
1054 job.report_steps();
1055
1056 job.log.step(0);
1057 // GitHub's "Set up job": the runner, the machine, the token, then the
1058 // actions the job uses.
1059 for line in setup_header(&Machine::here(&job.spec, &job.base_env)) {
1060 job.log.line(&line);
1061 }
1062 if let Some(Value::Object(matrix)) = job.contexts.get("matrix")
1063 && !matrix.is_empty()
1064 {
1065 job.log.line(&format!("Matrix: {}", serde_json::to_string(matrix).unwrap_or_default()));
1066 }
1067 if job.docker_hosted {
1068 let registry = job.contexts["github"]["server_url"].as_str().and_then(crate::docker::engine::registry_host);
1069 let token = job.contexts.get("secrets").and_then(|s| s.get("G1T_TOKEN")).map(expr::to_text).filter(|t| !t.is_empty());
1070 let options = crate::docker::engine::Options { registry: registry.zip(token) };
1071 if let Err(problem) = crate::docker::engine::enable(options) {
1072 job.log.line(&format!("##[warning]Docker is not available in this job: {problem}"));
1073 job.docker_hosted = false;
1074 }
1075 }
1076 // A self-hosted runner's word on how this job was run (selfhosted/exec.rs).
1077 if let Ok(notice) = std::env::var("G1T_JOB_NOTICE") {
1078 job.log.line(&format!("##[warning]{notice}"));
1079 }
1080 // Actions first, then containers, as GitHub's "Set up job" and
1081 // "Initialize containers". Each action's `pre` (read from the actions
1082 // just downloaded) is a step of its own, "Pre <step>", before the
1083 // job's first step.
1084 let prepared = job.prepare_actions(&steps);
1085 let pres = if prepared { job.pre_steps(&steps) } else { Vec::new() };
1086 if !pres.is_empty() {
1087 let mut names: Vec<String> = pres.iter().map(|(index, _)| format!("Pre {}", job.step_names[*index])).collect();
1088 names.extend(job.step_names.iter().cloned());
1089 job.step_names = names;
1090 job.report_steps();
1091 }
1092 if prepared {
1093 job.log.line(&format!("Complete job name: {}", job.spec["name"].as_str().unwrap_or_default()));
1094 }
1095 let containers_started = prepared && job.start_containers();
1096 job.log.flush();
1097
1098 let mut frame = Frame::default();
1099 if !containers_started {
1100 job.failed = true;
1101 for (index, name) in job.step_names.clone().iter().enumerate() {
1102 job.log.step_state(index as u32 + 1, name, "completed", Some("skipped"));
1103 }
1104 }
1105 for (index, (_, pre)) in pres.iter().enumerate().filter(|_| containers_started) {
1106 let number = index as u32 + 1;
1107 let name = job.step_names[index].clone();
1108 if report::cancelled() {
1109 report::take_cancel();
1110 }
1111 if !job.pre_runs(pre) {
1112 job.log.step_state(number, &name, "completed", Some("skipped"));
1113 continue;
1114 }
1115 job.log.step(number);
1116 job.log.step_state(number, &name, "in_progress", None);
1117 let ok = job.run_pre(pre);
1118 if !ok {
1119 job.failed = true;
1120 }
1121 let conclusion = if ok {
1122 "success"
1123 } else if report::cancelled() {
1124 "cancelled"
1125 } else {
1126 "failure"
1127 };
1128 job.log.step_state(number, &name, "completed", Some(conclusion));
1129 }
1130 let offset = pres.len() as u32;
1131 for (index, step) in steps.iter().enumerate().filter(|_| containers_started) {
1132 job.step(&mut frame, step, offset + index as u32 + 1, true, &defaults);
1133 job.log_docker_notes();
1134 if job.job_remaining().is_zero() {
1135 job.log.line("##[error]The job ran past its time limit.");
1136 job.failed = true;
1137 break;
1138 }
1139 }
1140
1141 // Post steps, last registered first.
1142 let posts: Vec<Post> = std::mem::take(&mut job.posts);
1143 for post in posts.into_iter().rev() {
1144 let number = job.step_names.len() as u32 + 1;
1145 job.step_names.push(post.name.clone());
1146 job.report_steps();
1147 let contexts = job.contexts_for(&frame, &job.env_context(&frame));
1148 let run_it = job.with_scope(&contexts, |scope| expr::condition(&post.condition, scope)).unwrap_or(true);
1149 if !run_it {
1150 job.log.step_state(number, &post.name, "completed", Some("skipped"));
1151 continue;
1152 }
1153 job.log.step(number);
1154 job.log.step_state(number, &post.name, "in_progress", None);
1155 let ok = match &post.run {
1156 PostRun::Node { action_dir, script, using } => job.run_node(action_dir, script, &post.env, using),
1157 PostRun::Docker(run) => job.run_docker(run).0,
1158 };
1159 job.log.step_state(number, &post.name, "completed", Some(if ok { "success" } else { "failure" }));
1160 if !ok {
1161 job.failed = true;
1162 }
1163 }
1164
1165 // GitHub's "Stop containers": services' logs, and everything removed.
1166 if job.has_containers() {
1167 let number = job.step_names.len() as u32 + 1;
1168 job.step_names.push("Stop containers".into());
1169 job.report_steps();
1170 job.log.step(number);
1171 job.log.step_state(number, "Stop containers", "in_progress", None);
1172 job.stop_containers();
1173 job.log.step_state(number, "Stop containers", "completed", Some("success"));
1174 }
1175
1176 // The job's outputs, read now that every step has run.
1177 let env = job.env_context(&frame);
1178 let contexts = job.contexts_for(&frame, &env);
1179 // GitHub's "Complete job": the job's outputs set, and whatever its
1180 // steps left running stopped.
1181 let number = job.step_names.len() as u32 + 1;
1182 job.step_names.push("Complete job".into());
1183 job.report_steps();
1184 job.log.step(number);
1185 job.log.step_state(number, "Complete job", "in_progress", None);
1186 let mut outputs = Map::new();
1187 if let Some(Value::Object(declared)) = job.spec["spec"].get("outputs") {
1188 job.log.line("Evaluate and set job outputs");
1189 for (name, value) in declared {
1190 let value = job.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
1191 job.log.line(&format!("Set output '{name}'"));
1192 outputs.insert(name.clone(), Value::String(expr::to_text(&value)));
1193 }
1194 }
1195 let outputs = job.log.withhold_secrets(&outputs);
1196 job.log.line("Cleaning up orphan processes");
1197 let orphans = process::orphans(&job.tracking_id);
1198 for (pid, name) in &orphans {
1199 job.log.line(&format!("Terminate orphan process: pid ({pid}) ({name})"));
1200 }
1201 process::kill_orphans(&orphans);
1202 job.log.step_state(number, "Complete job", "completed", Some("success"));
1203 // Cancelled, the job ends so however its cleanup went (and g1t holds
1204 // to that whatever it is told).
1205 let conclusion = if report::cancelled() {
1206 "cancelled"
1207 } else if job.failed {
1208 "failure"
1209 } else {
1210 "success"
1211 };
1212 job.log.done(conclusion, &outputs, None);
1213}
1214
1215pub(crate) fn main() -> i32 {
1216 let mut api = match (crate::env("G1T_API"), crate::env("ACTIONS_JOB"), crate::env("ACTIONS_TOKEN")) {
1217 (Ok(base), Ok(job), Ok(token)) => Api { base, job, token },
1218 _ => {
1219 eprintln!("g1t-runner: G1T_API, ACTIONS_JOB and ACTIONS_TOKEN are needed");
1220 return 2;
1221 }
1222 };
1223 // A self-hosted runner asks for the token to be spent on the spec
1224 // (selfhosted/exec.rs): there, the token it was given sits where the
1225 // computer can see it (a Windows job's script, a container's
1226 // environment). g1t's own sandboxes keep theirs to report a sandbox
1227 // that stopped, and do not ask.
1228 let rotate = std::env::var(ROTATE_TOKEN).is_ok_and(|v| v == "1");
1229 let spec = match api.spec(rotate) {
1230 Ok(spec) => spec,
1231 Err(error) => {
1232 eprintln!("g1t-runner: could not fetch the job: {error:#}");
1233 api.report(json!({ "kind": "done", "conclusion": "failure", "reason": format!("The runner could not fetch the job: {error}") }));
1234 return 1;
1235 }
1236 };
1237 let reporter = Api {
1238 base: api.base.clone(),
1239 job: api.job.clone(),
1240 token: api.token.clone(),
1241 };
1242 let mut job = match setup(spec, reporter) {
1243 Ok(job) => job,
1244 Err(error) => {
1245 api.report(json!({ "kind": "done", "conclusion": "failure", "reason": format!("The runner could not set up: {error:#}") }));
1246 return 1;
1247 }
1248 };
1249 run_job(&mut job);
1250 if job.failed || report::cancelled() { 1 } else { 0 }
1251}
1252
1253#[cfg(test)]
1254mod tests {
1255 use serde_json::{Map, Value, json};
1256
1257 use super::*;
1258
1259 #[test]
1260 fn set_up_job_says_what_runs_the_job_as_github_does() {
1261 let machine = Machine {
1262 version: "0.2.0".into(),
1263 runner_name: "g1t".into(),
1264 os: "Linux".into(),
1265 arch: "X64".into(),
1266 os_release: Some("PRETTY_NAME=\"Debian GNU/Linux 12 (bookworm)\"\nNAME=\"Debian GNU/Linux\"\nVERSION_ID=\"12\"\nVERSION=\"12 (bookworm)\"\n".into()),
1267 image: Some(("ubuntu24".into(), "20261005.1".into())),
1268 cpus: 4,
1269 memory_bytes: Some(12 * 1024 * 1024 * 1024),
1270 permissions: vec![("contents".into(), "read".into()), ("id-token".into(), "none".into()), ("metadata".into(), "read".into()), ("pull-requests".into(), "write".into())],
1271 ..Machine::default()
1272 };
1273 let text = setup_header(&machine).join("\n");
1274 assert_eq!(
1275 text,
1276 "Current runner version: '0.2.0'\nRunner name: 'g1t'\n\
1277 ##[group]Operating System\nDebian GNU/Linux\n12 (bookworm)\n##[endgroup]\n\
1278 ##[group]Runner Image\nImage: ubuntu24\nVersion: 20261005.1\nIncluded Software: Node 24, Python 3, Go, Rust\n##[endgroup]\n\
1279 ##[group]Machine\nHosted by g1t\nArchitecture: X64\nCPUs: 4\nMemory: 12 GB\n##[endgroup]\n\
1280 ##[group]G1T_TOKEN Permissions\nContents: read\nMetadata: read\nPullRequests: write\n##[endgroup]\n\
1281 Secret source: Actions\nPrepare workflow directory"
1282 );
1283 // A self-hosted machine without an image of GitHub's, or an os-release.
1284 let own = Machine { version: "0.2.0".into(), self_hosted: true, runner_name: "build-box".into(), os: "macOS".into(), arch: "ARM64".into(), cpus: 8, ..Machine::default() };
1285 let text = setup_header(&own).join("\n");
1286 assert!(text.contains("Runner name: 'build-box'\n##[group]Operating System\nmacOS ARM64\n##[endgroup]\n##[group]Machine\nSelf-hosted"), "{text}");
1287 assert!(!text.contains("Runner Image") && !text.contains("Memory") && !text.contains("Permissions"), "{text}");
1288 assert_eq!(memory_limit(Some("max\n"), Some("MemTotal: 16384000 kB\n")), Some(16_384_000 * 1024));
1289 assert_eq!(memory_limit(Some("4294967296\n"), Some("MemTotal: 16384000 kB\n")), Some(4_294_967_296));
1290 assert_eq!(memory_limit(None, None), None);
1291 assert_eq!(permission_title("security-events"), "SecurityEvents");
1292 }
1293
1294 #[test]
1295 fn a_run_step_opens_with_its_script_shell_and_variables_folded() {
1296 let env: BTreeMap<String, String> = [("CARGO_TERM_COLOR", "always"), ("GITHUB_ACTION", "__run"), ("KEY", "line one\nline two")]
1297 .into_iter()
1298 .map(|(k, v)| (k.to_owned(), v.to_owned()))
1299 .collect();
1300 let lines = script_header("\n node build.mjs --all\necho done\n", "/usr/bin/bash -e {0}", &env);
1301 assert_eq!(
1302 lines,
1303 [
1304 "##[group]Run node build.mjs --all",
1305 "\u{1b}[36;1m node build.mjs --all\u{1b}[0m",
1306 "\u{1b}[36;1mecho done\u{1b}[0m",
1307 "shell: /usr/bin/bash -e {0}",
1308 "env:",
1309 " CARGO_TERM_COLOR: always",
1310 " KEY: line one",
1311 " line two",
1312 "##[endgroup]",
1313 ]
1314 );
1315 // No variables: no `env:`.
1316 assert!(!script_header("make", "sh -e {0}", &BTreeMap::new()).contains(&"env:".to_owned()));
1317 let with: BTreeMap<String, String> = [("path", "~/.cargo\ntarget\n"), ("key", "k")].into_iter().map(|(k, v)| (k.to_owned(), v.to_owned())).collect();
1318 assert_eq!(
1319 uses_header("actions/cache@v4", &with, &BTreeMap::new()),
1320 ["##[group]Run actions/cache@v4", "with:", " key: k", " path: ~/.cargo", " target", "##[endgroup]"]
1321 );
1322 }
1323
1324 #[test]
1325 fn debug_logging_comes_from_a_secret_a_variable_or_a_debug_rerun() {
1326 let contexts = |value: Value| -> Map<String, Value> { serde_json::from_value(value).unwrap() };
1327 let none = json!({});
1328 assert!(!step_debug(&contexts(json!({ "secrets": {}, "vars": {} })), &none));
1329 assert!(step_debug(&contexts(json!({ "secrets": { "ACTIONS_STEP_DEBUG": "true" } })), &none));
1330 assert!(step_debug(&contexts(json!({ "vars": { "ACTIONS_STEP_DEBUG": "TRUE" } })), &none));
1331 assert!(!step_debug(&contexts(json!({ "vars": { "ACTIONS_STEP_DEBUG": "false" } })), &none));
1332 // A re-run with debug logging sets these among the job's variables.
1333 assert!(step_debug(&contexts(json!({})), &json!({ "RUNNER_DEBUG": "1" })));
1334 assert!(step_debug(&contexts(json!({})), &json!({ "ACTIONS_STEP_DEBUG": "true" })));
1335 assert!(!step_debug(&contexts(json!({})), &json!({ "RUNNER_DEBUG": "0" })));
1336 }
1337
1338 #[test]
1339 fn scripts_get_githubs_extension_for_their_shell() {
1340 assert_eq!(script_extension("bash"), "sh");
1341 assert_eq!(script_extension("/usr/bin/sh"), "sh");
1342 assert_eq!(script_extension("pwsh"), "ps1");
1343 assert_eq!(script_extension("C:\\Windows\\powershell.exe"), "ps1");
1344 assert_eq!(script_extension("cmd"), "cmd");
1345 assert_eq!(script_extension("python"), "py");
1346 // A program GitHub does not know: no extension.
1347 assert_eq!(script_extension("perl"), "");
1348 assert_eq!(script_extension("python3"), "");
1349 }
1350
1351 #[test]
1352 fn powershell_scripts_stop_at_errors_and_keep_the_exit_code() {
1353 let newline = if cfg!(windows) { "\r\n" } else { "\n" };
1354 assert_eq!(
1355 script_contents("pwsh", "Write-Output hi"),
1356 format!("$ErrorActionPreference = 'stop'{newline}Write-Output hi{newline}if ((Test-Path -LiteralPath variable:\\LASTEXITCODE)) {{ exit $LASTEXITCODE }}")
1357 );
1358 assert!(script_contents("powershell.exe", "x").starts_with("$ErrorActionPreference = 'stop'"));
1359 assert_eq!(script_contents("bash", "echo hi"), "echo hi");
1360 }
1361
1362 #[test]
1363 fn programs_are_found_on_path_without_running_them() {
1364 let dir = std::env::temp_dir().join(format!("g1t-on-path-{}", std::process::id()));
1365 std::fs::create_dir_all(&dir).unwrap();
1366 std::fs::write(dir.join("python"), "").unwrap();
1367 let path = format!("/nowhere{}{}", paths::PATH_SEPARATOR, dir.display());
1368 assert!(on_path("python", &path));
1369 assert!(!on_path("python9", &path));
1370 assert!(!on_path("python", ""));
1371 let _ = std::fs::remove_dir_all(&dir);
1372 }
1373
1374 #[test]
1375 fn steps_are_named_for_github_action_as_github_names_them() {
1376 let mut steps: Vec<Map<String, Value>> = serde_json::from_value(json!([
1377 { "run": "a" },
1378 { "run": "b" },
1379 { "id": "build", "run": "c" },
1380 { "uses": "actions/setup-node@v4" },
1381 { "uses": "actions/cache/restore@v4" },
1382 { "uses": "actions/setup-node@v4" },
1383 { "uses": "./.github/actions/x" },
1384 { "run": "d" },
1385 { "id": "__run_4", "run": "e" },
1386 { "run": "f" },
1387 ]))
1388 .unwrap();
1389 name_steps(&mut steps);
1390 let names: Vec<String> = steps.iter().map(|s| expr::to_text(&s[ACTION_NAME])).collect();
1391 assert_eq!(
1392 names,
1393 ["__run", "__run_2", "build", "__actions_setup-node", "__actions_cache", "__actions_setup-node_2", "__self", "__run_3", "__run_4", "__run_5"]
1394 );
1395 }
1396
1397 #[test]
1398 fn variables_a_spec_lacks_are_filled_in() {
1399 let mut spec = json!({
1400 "variables": { "CI": "true" },
1401 "github": { "repository_owner_id": "" },
1402 "event": { "repository": { "owner": { "id": 7 } } },
1403 });
1404 default_variables(&mut spec);
1405 assert_eq!(spec["variables"]["RUNNER_WORKSPACE"], "/home/runner/work");
1406 assert_eq!(spec["variables"]["GITHUB_REPOSITORY_OWNER_ID"], "7");
1407 assert_eq!(spec["github"]["repository_owner_id"], "7");
1408 // What g1t sent stands.
1409 let mut spec = json!({ "variables": { "RUNNER_WORKSPACE": "/w", "GITHUB_REPOSITORY_OWNER_ID": "9" }, "github": {}, "event": {} });
1410 default_variables(&mut spec);
1411 assert_eq!(spec["variables"]["RUNNER_WORKSPACE"], "/w");
1412 assert_eq!(spec["variables"]["GITHUB_REPOSITORY_OWNER_ID"], "9");
1413 }
1414
1415 #[test]
1416 fn a_steps_timeout_is_its_own_or_the_nearer_one_around_it() {
1417 let now = Instant::now();
1418 // No timeout-minutes anywhere: only the job's deadline applies.
1419 assert_eq!(step_deadline(None, now, None), None);
1420 // A step's own, in minutes, fractions included.
1421 assert_eq!(step_deadline(None, now, Some(1.5)), Some(now + Duration::from_secs(90)));
1422 // A composite action's step inside a `uses:` step with its own:
1423 // the nearer of the two.
1424 let outer = now + Duration::from_secs(60);
1425 assert_eq!(step_deadline(Some(outer), now, Some(10.0)), Some(outer));
1426 assert_eq!(step_deadline(Some(outer), now, Some(0.5)), Some(now + Duration::from_secs(30)));
1427 assert_eq!(step_deadline(Some(outer), now, None), Some(outer));
1428 // Zero or less is a time already up.
1429 assert_eq!(step_deadline(None, now, Some(0.0)), Some(now));
1430 assert_eq!(step_timeout(None), Duration::from_secs(6 * 3600));
1431 assert_eq!(step_timeout(Some(-1.0)), Duration::ZERO);
1432 }
1433
1434 /// `core.getIDToken()` reads the OIDC variables from the step's own
1435 /// environment, so they have to reach every step's process as the API
1436 /// put them in the spec: the URL untouched by path relocation, and the
1437 /// token not dropped with the runner's own credentials.
1438 #[test]
1439 fn a_steps_process_gets_the_oidc_request_variables() {
1440 let dir = std::env::temp_dir().join(format!("g1t-oidc-env-{}-{}", std::process::id(), rand_id()));
1441 let url = "https://api.g1t.sh/actions/oidc/token?api-version=2.0";
1442 let spec = json!({
1443 "variables": {
1444 "ACTIONS_RUNTIME_TOKEN": "h.p.s",
1445 "ACTIONS_ID_TOKEN_REQUEST_URL": url,
1446 "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "h.p.s",
1447 },
1448 "github": {},
1449 "event": {},
1450 "masks": ["h.p.s"],
1451 });
1452 let job = setup_in(spec, Api::offline(), dir.join("work"), dir.join("temp")).unwrap();
1453 let files = StepFiles::new(&job.temp, "oidc").unwrap();
1454 let env = job.process_env(&BTreeMap::new(), &files);
1455 assert_eq!(env.get("ACTIONS_ID_TOKEN_REQUEST_URL").map(String::as_str), Some(url));
1456 assert_eq!(env.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN").map(String::as_str), Some("h.p.s"));
1457 assert_eq!(env.get("ACTIONS_RUNTIME_TOKEN").map(String::as_str), Some("h.p.s"));
1458 let _ = std::fs::remove_dir_all(&dir);
1459 }
1460}