Skip to content
Sign up

flagon-io/g1t

public
0

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
117 linesCodeBlameRaw
1import assert from "node:assert/strict";
2import { readFileSync } from "node:fs";
3import { test } from "node:test";
4
5import type { WorkflowDomain } from "@g1t/contracts";
6
7import {
8 INSTANCE_TYPES,
9 STANDARD_INSTANCE,
10 instanceNamed,
11 machineNamed,
12 machineSize,
13 machines,
14 priceScale,
15 runnerMinutes,
16} from "../../../packages/contracts/src/instances.ts";
17
18import { SANDBOX_BINDINGS, jobHosts, jobNamespaceOf, sandboxNamespace } from "./egress.ts";
19
20const domains: WorkflowDomain[] = [
21 { domain: "api.cloudflare.com", workflows: ["deploy.yml"], environments: ["production"] },
22 { domain: "*.example.com", workflows: [], environments: [] },
23];
24const policy = { workflowDomains: domains };
25const deploy = { workflow: ".g1t/workflows/deploy.yml", environment: "production", trusted: true };
26
27test("a trusted workflow job reaches the workflow-only domains that name it", () => {
28 assert.deepEqual(jobHosts(policy, "actions", deploy), ["api.cloudflare.com", "*.example.com"]);
29 assert.deepEqual(jobHosts(policy, "actions", { ...deploy, workflow: "DEPLOY.yml", environment: "Production" }), [
30 "api.cloudflare.com",
31 "*.example.com",
32 ]);
33 // Another environment, none, or another workflow: only the open entry.
34 assert.deepEqual(jobHosts(policy, "actions", { ...deploy, environment: "staging" }), ["*.example.com"]);
35 assert.deepEqual(jobHosts(policy, "actions", { ...deploy, environment: null }), ["*.example.com"]);
36 assert.deepEqual(jobHosts(policy, "actions", { ...deploy, workflow: ".g1t/workflows/ci.yml" }), ["*.example.com"]);
37});
38
39test("nothing else ever reaches them: forks, deploy builds, unknown jobs", () => {
40 assert.deepEqual(jobHosts(policy, "actions", { ...deploy, trusted: false }), []);
41 assert.deepEqual(jobHosts(policy, "deploy", deploy), []);
42 assert.deepEqual(jobHosts(policy, "actions", null), []);
43 assert.deepEqual(jobHosts(policy, "actions", { ...deploy, workflow: null }), []);
44 // Guardrails from before the list existed.
45 assert.deepEqual(jobHosts({}, "actions", deploy), []);
46});
47
48test("each sandbox class reports to its own namespace", () => {
49 const env = { SANDBOX: "standard", SANDBOX_2CORE: "two", SANDBOX_4CORE: "four" } as unknown as object;
50 assert.equal(sandboxNamespace(env, "AttemptSandbox"), "standard");
51 assert.equal(sandboxNamespace(env, "Sandbox4Core"), "four");
52 assert.equal(sandboxNamespace(env, "Sandbox2Core"), "two");
53 assert.equal(sandboxNamespace(env, undefined), "standard");
54 assert.equal(sandboxNamespace({ SANDBOX: "standard" }, "Sandbox4Core"), "standard");
55 assert.deepEqual(Object.keys(SANDBOX_BINDINGS), ["AttemptSandbox", "Sandbox2Core", "Sandbox4Core"]);
56});
57
58test("each label in the machine catalogue runs in its own class, bound and sized as wrangler.jsonc says", () => {
59 type Size = { vcpu: number; memory_mib: number; disk_mb: number };
60 // wrangler.jsonc's comments are whole lines.
61 const text = readFileSync(new URL("../wrangler.jsonc", import.meta.url), "utf8").replace(/^\s*\/\/.*$/gm, "");
62 const config = JSON.parse(text) as {
63 containers: { class_name: string; instance_type: unknown }[];
64 durable_objects: { bindings: { name: string; class_name: string }[] };
65 };
66 // The named Cloudflare instance types a machine may be, at the sizes
67 // Cloudflare gives them. A custom type would be a row here once the
68 // account may use them.
69 const named: Record<string, Size> = {
70 "standard-3": { vcpu: 2, memory_mib: 8 * 1024, disk_mb: 16_000 },
71 "standard-4": { vcpu: 4, memory_mib: 12 * 1024, disk_mb: 20_000 },
72 };
73 // Every class has a label, and every label a class.
74 assert.deepEqual(
75 INSTANCE_TYPES.map((instance) => instance.sandboxClass).sort(),
76 config.containers.map((container) => container.class_name).sort(),
77 );
78 for (const instance of INSTANCE_TYPES) {
79 const type = config.containers.find((c) => c.class_name === instance.sandboxClass)?.instance_type;
80 const size = typeof type === "string" ? named[type] : undefined;
81 assert.ok(size, `${instance.sandboxClass}: ${JSON.stringify(type)}`);
82 assert.equal(type, instance.container, instance.label);
83 assert.deepEqual(
84 { vcpu: size.vcpu, memoryGib: size.memory_mib / 1024, diskGb: size.disk_mb / 1000 },
85 { vcpu: instance.vcpu, memoryGib: instance.memoryGib, diskGb: instance.diskGb },
86 instance.label,
87 );
88 // Its binding, here and in wrangler.jsonc, is what a job starts in.
89 const binding = SANDBOX_BINDINGS[instance.sandboxClass];
90 assert.ok(binding, `${instance.sandboxClass} has no binding in SANDBOX_BINDINGS`);
91 assert.ok(
92 config.durable_objects.bindings.some((b) => b.name === binding && b.class_name === instance.sandboxClass),
93 binding,
94 );
95 assert.equal(jobNamespaceOf({ [binding]: instance.label }, instance), instance.label);
96 }
97 // A class not deployed here: the job is not started on another machine.
98 assert.equal(jobNamespaceOf({ SANDBOX: "standard" }, INSTANCE_TYPES[2]!), null);
99 assert.equal(jobNamespaceOf({ SANDBOX: "standard" }, { sandboxClass: "Sandbox64Core" }), null);
100});
101
102test("runs-on labels are the catalogue's, and a job is charged its minutes rounded up", () => {
103 assert.equal(instanceNamed("ubuntu-latest"), STANDARD_INSTANCE);
104 assert.equal(instanceNamed("G1T-4Core").machine, "4-core");
105 assert.equal(instanceNamed("g1t-2core").machine, STANDARD_INSTANCE.machine);
106 assert.deepEqual(
107 machines().map((m) => [m.machine, m.microsPerMinute, machineSize(m)]),
108 [
109 ["2-core", 4000, "2 vCPU, 8 GiB, 16 GB"],
110 ["4-core", 7000, "4 vCPU, 12 GiB, 20 GB"],
111 ],
112 );
113 assert.equal(machineNamed("4-core")?.label, "g1t-4core");
114 assert.equal(machineNamed("8-core"), null);
115 assert.equal(priceScale(instanceNamed("g1t-4core")), 1.75);
116 assert.deepEqual([0, 1, 60, 61, 3600].map(runnerMinutes), [0, 1, 1, 2, 60]);
117});