Sign in

flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

g1t/crates/runner/src/checks.rs

233 lines7,272 bytesCodeBlame
1//! Runs an issue's acceptance checks against one commit and reports how
2//! each went.
3//!
4//! The sandbox holds nothing but that commit: no agent has run here, so a
5//! passing result says something about the code and not about what an
6//! agent left lying around.
7//!
8//! Configuration comes from the environment:
9//!
10//! - `G1T_API`, `CHECK_RUN`, `CHECK_TOKEN`: where and how to report.
11//! - `GIT_REMOTE`, `GIT_COMMIT`: what to check out.
12//! - `G1T_USER`, `G1T_TOKEN`: to read the repository, if it is private.
13//! - `CHECKS`: the commands, as a JSON array.
14
15use std::path::Path;
16use std::process::{Command, Stdio};
17use std::time::Instant;
18
19use anyhow::{Context, Result, bail};
20use serde::Serialize;
21
22use crate::{WORKDIR, auth_option, env, git};
23
24/// The longest one command may run.
25const COMMAND_TIMEOUT_SECONDS: u32 = 10 * 60;
26/// How much of a command's output is kept: the end, where failures are.
27const MAX_OUTPUT_CHARS: usize = 12_000;
28/// What `timeout` exits with when it had to stop the command.
29const TIMED_OUT: i32 = 124;
30const KILLED: i32 = 137;
31
32#[derive(Debug, Serialize)]
33#[serde(rename_all = "camelCase")]
34pub(crate) struct CheckResult {
35 pub(crate) command: String,
36 pub(crate) passed: bool,
37 exit_code: Option<i32>,
38 output: String,
39 duration_ms: u64,
40}
41
42impl CheckResult {
43 pub(crate) fn output_text(&self) -> &str {
44 &self.output
45 }
46}
47
48/// The last `limit` characters of `text`, saying so if any were dropped.
49fn tail(text: &str, limit: usize) -> String {
50 let length = text.chars().count();
51 if length <= limit {
52 return text.to_owned();
53 }
54 let kept: String = text.chars().skip(length - limit).collect();
55 format!("… (earlier output not shown)\n{kept}")
56}
57
58pub(crate) fn redact(text: &str, secrets: &[String]) -> String {
59 secrets.iter().fold(text.to_owned(), |text, secret| {
60 text.replace(secret, "[redacted]")
61 })
62}
63
64/// Runs one command in the checkout, without this process's credentials.
65pub(crate) fn run_command(command: &str, workdir: &Path, secrets: &[String]) -> CheckResult {
66 let started = Instant::now();
67 let output = Command::new("timeout")
68 .args([
69 "--signal=KILL",
70 &COMMAND_TIMEOUT_SECONDS.to_string(),
71 "sh",
72 "-c",
73 // One stream, in the order it was written.
74 &format!("( {command}\n) 2>&1"),
75 ])
76 .current_dir(workdir)
77 .env_remove("G1T_TOKEN")
78 .env_remove("CHECK_TOKEN")
79 .env_remove("DEPLOY_TOKEN")
80 .stdin(Stdio::null())
81 .output();
82 let duration_ms = started.elapsed().as_millis() as u64;
83 match output {
84 Ok(output) => {
85 let code = output.status.code();
86 let timed_out = matches!(code, Some(TIMED_OUT | KILLED) | None);
87 let mut text = String::from_utf8_lossy(&output.stdout).into_owned();
88 if timed_out {
89 text.push_str(&format!(
90 "\nStopped after {} minutes.",
91 COMMAND_TIMEOUT_SECONDS / 60
92 ));
93 }
94 CheckResult {
95 command: command.to_owned(),
96 passed: output.status.success(),
97 exit_code: code.filter(|_| !timed_out),
98 output: redact(&tail(text.trim_end(), MAX_OUTPUT_CHARS), secrets),
99 duration_ms,
100 }
101 }
102 Err(error) => CheckResult {
103 command: command.to_owned(),
104 passed: false,
105 exit_code: None,
106 output: format!("Could not start the command: {error}"),
107 duration_ms,
108 },
109 }
110}
111
112struct Reporter {
113 url: String,
114 token: String,
115}
116
117impl Reporter {
118 fn send(&self, mut body: serde_json::Value) -> Result<()> {
119 body["token"] = self.token.clone().into();
120 ureq::post(&self.url)
121 .send_json(body)
122 .context("could not report the check run")?;
123 Ok(())
124 }
125}
126
127fn check_out(secrets: &[String]) -> Result<()> {
128 let remote = env("GIT_REMOTE")?;
129 let commit = env("GIT_COMMIT")?;
130 let auth = auth_option(&env("G1T_USER")?, &env("G1T_TOKEN")?);
131 std::fs::create_dir_all("/work")?;
132 let cloned = git(
133 Path::new("/work"),
134 &["-c", &auth, "clone", "--quiet", &remote, WORKDIR],
135 )
136 .and_then(|_| {
137 git(
138 Path::new(WORKDIR),
139 &[
140 "-c",
141 "advice.detachedHead=false",
142 "checkout",
143 "--quiet",
144 &commit,
145 ],
146 )
147 });
148 if let Err(error) = cloned {
149 bail!("{}", redact(&format!("{error:#}"), secrets));
150 }
151 Ok(())
152}
153
154pub fn main() -> i32 {
155 let reporter = match (env("G1T_API"), env("CHECK_RUN"), env("CHECK_TOKEN")) {
156 (Ok(api), Ok(run), Ok(token)) => Reporter {
157 url: format!("{api}/checks/{run}"),
158 token,
159 },
160 _ => {
161 eprintln!("g1t-runner: G1T_API, CHECK_RUN and CHECK_TOKEN must be set");
162 return 2;
163 }
164 };
165 let secrets: Vec<String> = ["G1T_TOKEN", "CHECK_TOKEN"]
166 .iter()
167 .filter_map(|name| std::env::var(name).ok())
168 .filter(|secret| !secret.is_empty())
169 .collect();
170 let commands: Vec<String> = std::env::var("CHECKS")
171 .ok()
172 .and_then(|json| serde_json::from_str(&json).ok())
173 .unwrap_or_default();
174
175 // Says the run has started.
176 if let Err(error) = reporter.send(serde_json::json!({})) {
177 eprintln!("g1t-runner: {error:#}");
178 return 1;
179 }
180 let report = match check_out(&secrets) {
181 Err(error) => serde_json::json!({
182 "error": format!("The commit could not be checked out: {error:#}"),
183 }),
184 Ok(()) => {
185 let results: Vec<CheckResult> = commands
186 .iter()
187 .map(|command| run_command(command, Path::new(WORKDIR), &secrets))
188 .collect();
189 serde_json::json!({ "results": results })
190 }
191 };
192 match reporter.send(report) {
193 Ok(()) => 0,
194 Err(error) => {
195 eprintln!("g1t-runner: {error:#}");
196 1
197 }
198 }
199}
200
201#[cfg(test)]
202mod tests {
203 use super::*;
204
205 #[test]
206 fn long_output_keeps_its_end() {
207 let text = format!("{}END", "x".repeat(50));
208 let kept = tail(&text, 10);
209 assert!(kept.ends_with("xxxxxxxEND"));
210 assert!(kept.starts_with("… (earlier output not shown)"));
211 assert_eq!(tail("short", 10), "short");
212 }
213
214 #[test]
215 fn secrets_do_not_reach_a_report() {
216 let secrets = vec!["g1t_secret".to_owned()];
217 assert_eq!(redact("token=g1t_secret", &secrets), "token=[redacted]");
218 }
219
220 #[cfg(unix)]
221 #[test]
222 fn a_command_passes_or_fails_by_its_exit_code() {
223 let here = std::env::temp_dir();
224 let passed = run_command("echo out; echo err >&2", &here, &[]);
225 assert!(passed.passed);
226 assert_eq!(passed.exit_code, Some(0));
227 assert_eq!(passed.output, "out\nerr");
228 let failed = run_command("echo nope; exit 3", &here, &[]);
229 assert!(!failed.passed);
230 assert_eq!(failed.exit_code, Some(3));
231 assert_eq!(failed.output, "nope");
232 }
233}