Skip to content
Sign in

flagon-io/g1t

public
0
1,293 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Actions: keep workflow runs safe1//! Keeping runs safe: a repository's choices for its workflows (what a
2//! job's token may do when its workflow says nothing, and which pull
3//! requests' runs wait for approval), environments' protection rules, the
4//! reviews of the jobs they hold, and approving a pull request's run.
5//!
6//! - A job that names an environment with rules is `pending` once its needs
7//! are done: until a reviewer approves it (when the environment has
8//! reviewers), its wait timer has run out (when it has one), and only on
9//! a ref the environment lets deploy. Its secrets are read when it
10//! starts, so the environment's are never handed out before then. One
11//! review approves every job of the run attempt that names the
12//! environment.
13//! - A run of a pull request from outside the workspace may wait as
14//! `action_required` until someone with the Write role approves it, by
15//! the repository's approval policy.
16
17use g1t_actions::filter::Pattern;
18use g1t_actions::permissions::TokenDefault;
19use g1t_contracts::access::{self, AccessSource, Capability, CollaboratorPermissionArgs, PermissionInfo};
20use g1t_contracts::actions::{
Merge main into the run-protection branch21 APPROVAL_POLICIES, ActionsSettings, ActionsSettingsArgs, SetWorkspaceActionsSettingsArgs, WorkspaceActionsSettings,
22 WorkspaceActionsSettingsArgs, BranchPattern, DeleteEnvironmentArgs, Environment, EnvironmentReviewer,
Actions: keep workflow runs safe23 EnvironmentsArgs, MAX_ENVIRONMENT_REVIEWERS, MAX_WAIT_MINUTES, PendingDeployment, PendingDeploymentsArgs, ReviewDeploymentsArgs,
24 RunActionArgs, RunApproval, SetActionsSettingsArgs, SetEnvironmentArgs, WorkflowRun,
25};
26use g1t_contracts::identity::AGENT_ID;
27use g1t_contracts::repos::{Repo, RepoPath};
28use g1t_contracts::time::rfc3339;
29use g1t_contracts::{FailureCode, Outcome, PrincipalKind, User, Viewer};
30use g1t_kit::now_ms;
31use serde::Deserialize;
32use serde_json::{Value, json};
33use worker::Result;
34
35use crate::plan::{JobRow, RunRow};
36use crate::{Actions, check, fail, optional};
37
38/// What the approval policy is when a repository chose none.
39pub const DEFAULT_APPROVAL_POLICY: &str = "outside_contributors";
40
41fn now() -> String {
42 rfc3339(now_ms())
43}
44
Merge main into the run-protection branch45/// A repository's own choices (migrations 0006 and 0007); null is unchosen.
46#[derive(Default, Deserialize)]
47struct SettingsRow {
48 default_permissions: Option<String>,
49 approval_policy: Option<String>,
50 can_approve_pulls: Option<u32>,
51}
52
Actions: keep workflow runs safe53#[derive(Deserialize)]
Merge main into the run-protection branch54struct WorkspaceRow {
Actions: keep workflow runs safe55 default_permissions: String,
Merge main into the run-protection branch56 max_permissions: String,
57 can_approve_pulls: u32,
58}
59
60/// What a workflow without `permissions:` gets: the repository's choice,
61/// else `write` for a repository made before restricted tokens
62/// (`grandfathered`), else its workspace's default; never more than the
63/// workspace's maximum.
64pub(crate) fn effective_default(chosen: Option<TokenDefault>, grandfathered: bool, workspace_default: TokenDefault, maximum: TokenDefault) -> TokenDefault {
65 let wanted = chosen.unwrap_or(if grandfathered { TokenDefault::Permissive } else { workspace_default });
66 if maximum == TokenDefault::Restricted { TokenDefault::Restricted } else { wanted }
67}
68
69/// The workspace's policy, or its defaults.
70fn workspace_policy(row: Option<WorkspaceRow>) -> WorkspaceActionsSettings {
71 match row {
72 Some(row) => WorkspaceActionsSettings {
73 default_permissions: row.default_permissions,
74 max_permissions: row.max_permissions,
75 can_approve_pull_requests: row.can_approve_pulls != 0,
76 },
77 None => WorkspaceActionsSettings {
78 default_permissions: TokenDefault::Restricted.as_str().to_owned(),
79 max_permissions: TokenDefault::Permissive.as_str().to_owned(),
80 can_approve_pull_requests: false,
81 },
82 }
Actions: keep workflow runs safe83}
84
85#[derive(Clone, Deserialize)]
86struct EnvRow {
87 name: String,
88 reviewers: String,
89 prevent_self_review: u32,
90 wait_minutes: u32,
91 branch_policy: String,
92 branch_patterns: String,
93 admins_bypass: u32,
94 updated_at: String,
95 updated_by: Option<String>,
96}
97
98impl EnvRow {
99 fn view(&self) -> Environment {
100 Environment {
101 name: self.name.clone(),
102 reviewers: serde_json::from_str(&self.reviewers).unwrap_or_default(),
103 prevent_self_review: self.prevent_self_review != 0,
104 wait_minutes: self.wait_minutes,
105 branch_policy: self.branch_policy.clone(),
106 branch_patterns: serde_json::from_str(&self.branch_patterns).unwrap_or_default(),
107 admins_bypass: self.admins_bypass != 0,
108 protected: true,
109 updated_at: Some(self.updated_at.clone()),
110 updated_by: self.updated_by.clone(),
111 }
112 }
113}
114
115/// An environment no rules hold.
116fn unprotected(name: &str) -> Environment {
117 Environment {
118 name: name.to_owned(),
119 reviewers: Vec::new(),
120 prevent_self_review: false,
121 wait_minutes: 0,
122 branch_policy: "all".to_owned(),
123 branch_patterns: Vec::new(),
124 admins_bypass: true,
125 protected: false,
126 updated_at: None,
127 updated_by: None,
128 }
129}
130
131#[derive(Clone, Deserialize)]
132struct GateRow {
133 environment: String,
134 state: String,
135 needs_review: u32,
136 wait_until: Option<String>,
137 reviewed_by: Option<String>,
138 comment: Option<String>,
139 reviewed_at: Option<String>,
140}
141
142/// An environment's name as rules and secrets keep it: lowercase, up to 40
143/// letters, digits, `-` and `_`.
144pub(crate) fn environment_name(name: &str) -> std::result::Result<String, String> {
145 let lower = name.trim().to_ascii_lowercase();
146 if lower.is_empty() || lower.len() > 40 || !lower.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') {
147 return Err(format!("`{}` is not an environment's name: up to 40 letters, digits, - and _.", name.trim()));
148 }
149 Ok(lower)
150}
151
152/// Whether `git_ref` may deploy to an environment by its `policy`.
153/// `protected` says whether the branch is protected, for `protected`.
154pub(crate) fn branch_allowed(policy: &str, patterns: &[BranchPattern], git_ref: &str, protected: bool, environment: &str) -> std::result::Result<(), String> {
155 let (kind, name) = match (git_ref.strip_prefix("refs/heads/"), git_ref.strip_prefix("refs/tags/")) {
156 (Some(branch), _) => ("branch", branch),
157 (_, Some(tag)) => ("tag", tag),
158 _ => ("ref", git_ref),
159 };
160 match policy {
161 "protected" if kind == "branch" && protected => Ok(()),
162 "protected" => Err(format!("{environment} takes deployments from protected branches only, and `{name}` is not one.")),
163 "selected" => {
164 let allowed = patterns
165 .iter()
166 .filter(|pattern| pattern.kind == kind)
167 .any(|pattern| Pattern::parse(&pattern.name).matches(name));
168 if allowed {
169 Ok(())
170 } else {
171 Err(format!("The {kind} `{name}` may not deploy to {environment}: its deployment rules list the branches and tags that may."))
172 }
173 }
174 _ => Ok(()),
175 }
176}
177
178/// How someone may decide on an environment's jobs.
179#[derive(Clone, Copy, Debug, PartialEq, Eq)]
180pub(crate) enum Reviewer {
181 /// One of its reviewers.
182 Listed,
183 /// An admin, past its rules, which also skips its wait timer.
184 AdminBypass,
185}
186
187/// Whether `username` (in `teams`, an admin or not) may approve or reject
188/// the environment's jobs in a run `started_by` began.
189pub(crate) fn may_review(
190 environment: &Environment,
191 username: &str,
192 teams: &[String],
193 admin: bool,
194 started_by: Option<&str>,
195) -> std::result::Result<Reviewer, String> {
196 let listed = environment.reviewers.iter().any(|reviewer| match reviewer.kind.as_str() {
197 "team" => teams.iter().any(|team| team.eq_ignore_ascii_case(&reviewer.name)),
198 _ => reviewer.name.eq_ignore_ascii_case(username),
199 });
200 let started = started_by.is_some_and(|by| by.eq_ignore_ascii_case(username));
201 if listed && !(environment.prevent_self_review && started) {
202 return Ok(Reviewer::Listed);
203 }
204 if admin && environment.admins_bypass {
205 return Ok(Reviewer::AdminBypass);
206 }
207 Err(if listed {
208 format!("You started this run, and {} does not let whoever started a run approve its deployments.", environment.name)
209 } else if environment.reviewers.is_empty() {
210 format!("{} has no reviewers: its jobs wait for its timer. Only an admin can start them sooner.", environment.name)
211 } else {
212 format!("You are not one of {}'s reviewers.", environment.name)
213 })
214}
215
216/// Whether a gate lets its jobs start at `now`.
217pub(crate) fn gate_open(state: &str, needs_review: bool, wait_until: Option<&str>, now: &str) -> bool {
218 state != "rejected" && (!needs_review || state == "approved") && wait_until.is_none_or(|until| until <= now)
219}
220
221/// Why a pull request's run waits for approval, if it does, by `policy`:
222/// `member` of the workspace, whether they `can_push`, and whether this is
223/// their `first_time` (no pull request of theirs merged here).
224pub(crate) fn approval_reason(policy: &str, member: bool, can_push: bool, first_time: bool) -> Option<&'static str> {
225 if member {
226 return None;
227 }
228 match policy {
229 "all_external_contributors" => Some("is not a member of the workspace"),
230 "first_time_contributors" => first_time.then_some("has not had a pull request merged here yet"),
231 _ if !can_push => Some("cannot push to the repository"),
232 _ => first_time.then_some("has not had a pull request merged here yet"),
233 }
234}
235
236/// What a job waits for at its environment, in words.
237fn held_reason(environment: &str, needs_review: bool, wait_until: Option<&str>) -> String {
238 match (needs_review, wait_until) {
239 (true, Some(until)) => format!("Waiting for a review to deploy to {environment}, and for its wait timer, until {until}."),
240 (true, None) => format!("Waiting for a review to deploy to {environment}."),
241 (false, Some(until)) => format!("Waiting for {environment}'s wait timer, until {until}."),
242 (false, None) => format!("Waiting to deploy to {environment}."),
243 }
244}
245
246/// What an environment's rules say about a job that names it.
247pub(crate) enum Gate {
248 /// No rules hold it: it starts.
249 Open,
250 /// It waits, for this.
251 Held(String),
252 /// It may not deploy there.
253 Refused(String),
254}
255
256impl Actions {
Merge main into the run-protection branch257 // --- The repository's and workspace's choices -------------------------------
Actions: keep workflow runs safe258
Merge main into the run-protection branch259 async fn repo_choices(&self, repo_id: &str) -> Result<SettingsRow> {
260 Ok(self
Actions: keep workflow runs safe261 .db
Merge main into the run-protection branch262 .prepare("SELECT default_permissions, approval_policy, can_approve_pulls FROM repo_settings WHERE repo_id = ?")
Actions: keep workflow runs safe263 .bind(&[repo_id.into()])?
264 .first::<SettingsRow>(None)
Merge main into the run-protection branch265 .await?
266 .unwrap_or_default())
267 }
268
269 /// A workspace's policy for its repositories' tokens, or the defaults.
270 pub(crate) async fn workspace_settings(&self, workspace: &str) -> Result<WorkspaceActionsSettings> {
271 let row = self
272 .db
273 .prepare("SELECT default_permissions, max_permissions, can_approve_pulls FROM workspace_actions_settings WHERE namespace = ?")
274 .bind(&[workspace.to_lowercase().into()])?
275 .first::<WorkspaceRow>(None)
276 .await?;
277 Ok(workspace_policy(row))
278 }
279
280 /// Whether `repo` was made before restricted tokens began, and so keeps
281 /// read and write until someone chooses otherwise.
282 async fn grandfathered(&self, repo: &Repo) -> Result<bool> {
283 #[derive(Deserialize)]
284 struct Since {
285 value: String,
286 }
287 let since = self
288 .db
289 .prepare("SELECT value FROM actions_meta WHERE key = 'restricted_since'")
290 .first::<Since>(None)
Actions: keep workflow runs safe291 .await?;
Merge main into the run-protection branch292 Ok(since.is_some_and(|since| !repo.created_at.is_empty() && repo.created_at.as_str() < since.value.as_str()))
293 }
294
295 /// A repository's settings as they hold, its workspace's taken in.
296 pub(crate) async fn repo_settings(&self, repo: &Repo) -> Result<ActionsSettings> {
297 let row = self.repo_choices(&repo.id).await?;
298 let workspace = self.workspace_settings(&repo.namespace).await?;
299 let chosen = row.default_permissions.as_deref().and_then(TokenDefault::parse);
300 let default = effective_default(
301 chosen,
302 self.grandfathered(repo).await?,
303 TokenDefault::parse(&workspace.default_permissions).unwrap_or_default(),
304 TokenDefault::parse(&workspace.max_permissions).unwrap_or(TokenDefault::Permissive),
305 );
306 Ok(ActionsSettings {
307 default_permissions: default.as_str().to_owned(),
308 default_chosen: chosen.is_some(),
309 max_permissions: workspace.max_permissions.clone(),
310 approval_policy: row.approval_policy.unwrap_or_else(|| DEFAULT_APPROVAL_POLICY.to_owned()),
311 can_approve_pull_requests: workspace.can_approve_pull_requests && row.can_approve_pulls == Some(1),
312 workspace_allows_pull_requests: workspace.can_approve_pull_requests,
Actions: keep workflow runs safe313 })
314 }
315
Merge main into the run-protection branch316 /// What a workflow without `permissions:` gets in the repository, and
317 /// whether its jobs may open and approve pull requests.
318 pub(crate) async fn token_policy(&self, repo_id: &str) -> Result<(TokenDefault, bool)> {
319 let Some((repo, _)) = self.repo_by_id(repo_id).await? else {
320 return Ok((TokenDefault::Restricted, false));
321 };
322 let settings = self.repo_settings(&repo).await?;
323 Ok((TokenDefault::parse(&settings.default_permissions).unwrap_or_default(), settings.can_approve_pull_requests))
Actions: keep workflow runs safe324 }
325
Merge main into the run-protection branch326 /// The approval policy of a repository.
327 pub(crate) async fn approval_policy(&self, repo_id: &str) -> Result<String> {
328 Ok(self.repo_choices(repo_id).await?.approval_policy.unwrap_or_else(|| DEFAULT_APPROVAL_POLICY.to_owned()))
329 }
330
Actions: keep workflow runs safe331 pub async fn actions_settings(&self, a: ActionsSettingsArgs) -> Result<Outcome<ActionsSettings>> {
332 let Some(repo) = self.visible_repo(&a.repo, &a.viewer).await? else {
333 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
334 };
Merge main into the run-protection branch335 Ok(Outcome::Ok(self.repo_settings(&repo).await?))
Actions: keep workflow runs safe336 }
337
338 pub async fn set_actions_settings(&self, a: SetActionsSettingsArgs) -> Result<Outcome<ActionsSettings>> {
339 if let Some(refused) = refuse_job_token(&a.actor) {
340 return Ok(refused);
341 }
342 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
Merge main into the run-protection branch343 let mut row = self.repo_choices(&repo.id).await?;
344 let workspace = self.workspace_settings(&repo.namespace).await?;
345 if let Some(default) = a.default_permissions.as_deref().map(str::trim) {
346 row.default_permissions = match default {
347 "inherit" | "" => None,
348 other => match TokenDefault::parse(other) {
349 Some(TokenDefault::Permissive) if workspace.max_permissions == "read" => {
350 return Ok(fail(
351 FailureCode::Forbidden,
352 format!("{} holds its repositories' tokens to read-only: an owner can change that in the workspace's Actions settings.", repo.namespace),
353 ));
354 }
355 Some(parsed) => Some(parsed.as_str().to_owned()),
356 None => return Ok(fail(FailureCode::Invalid, "default_permissions is read, write or inherit.")),
357 },
358 };
Actions: keep workflow runs safe359 }
360 if let Some(policy) = &a.approval_policy {
361 let policy = policy.trim();
362 if !APPROVAL_POLICIES.contains(&policy) {
363 return Ok(fail(FailureCode::Invalid, format!("approval_policy is one of {}.", APPROVAL_POLICIES.join(", "))));
364 }
Merge main into the run-protection branch365 row.approval_policy = Some(policy.to_owned());
366 }
367 if let Some(allow) = a.can_approve_pull_requests {
368 if allow && !workspace.can_approve_pull_requests {
369 return Ok(fail(
370 FailureCode::Forbidden,
371 format!("{} does not let its repositories' jobs open or approve pull requests: an owner can allow it in the workspace's Actions settings.", repo.namespace),
372 ));
373 }
374 row.can_approve_pulls = Some(u32::from(allow));
Actions: keep workflow runs safe375 }
Merge main into the run-protection branch376 // 0006's artifact retention is kept, or its default for a new row.
Actions: keep workflow runs safe377 self.db
378 .prepare(
Merge main into the run-protection branch379 "INSERT INTO repo_settings (repo_id, artifact_retention_days, default_permissions, approval_policy, can_approve_pulls, updated_at, updated_by)
380 VALUES (?1, ?7, ?2, ?3, ?4, ?5, ?6)
381 ON CONFLICT (repo_id) DO UPDATE SET default_permissions = ?2, approval_policy = ?3, can_approve_pulls = ?4,
382 updated_at = ?5, updated_by = ?6",
Actions: keep workflow runs safe383 )
384 .bind(&[
385 repo.id.as_str().into(),
Merge main into the run-protection branch386 optional(row.default_permissions.as_deref()),
387 optional(row.approval_policy.as_deref()),
388 row.can_approve_pulls.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
389 now().into(),
390 a.actor.username.as_str().into(),
391 g1t_contracts::actions::ARTIFACT_RETENTION_DEFAULT_DAYS.into(),
392 ])?
393 .run()
394 .await?;
395 Ok(Outcome::Ok(self.repo_settings(&repo).await?))
396 }
397
398 pub async fn workspace_actions_settings(&self, a: WorkspaceActionsSettingsArgs) -> Result<Outcome<WorkspaceActionsSettings>> {
399 let workspace = a.workspace.trim().to_lowercase();
400 if !a.viewer.as_ref().is_some_and(|viewer| viewer.is_member(&workspace)) {
401 return Ok(fail(FailureCode::NotFound, "There is no such workspace."));
402 }
403 Ok(Outcome::Ok(self.workspace_settings(&workspace).await?))
404 }
405
406 pub async fn set_workspace_actions_settings(&self, a: SetWorkspaceActionsSettingsArgs) -> Result<Outcome<WorkspaceActionsSettings>> {
407 if let Some(refused) = refuse_job_token(&a.actor) {
408 return Ok(refused);
409 }
410 let workspace = a.workspace.trim().to_lowercase();
411 if a.actor.kind != PrincipalKind::User || a.actor.role_in(&workspace) != Some(g1t_contracts::Role::Owner) {
412 return Ok(fail(FailureCode::Forbidden, format!("Only an owner of {workspace} can change its Actions settings.")));
413 }
414 let mut settings = self.workspace_settings(&workspace).await?;
415 let level = |text: &str, field: &str| -> std::result::Result<String, String> {
416 TokenDefault::parse(text.trim()).map(|parsed| parsed.as_str().to_owned()).ok_or_else(|| format!("{field} is read or write."))
417 };
418 if let Some(text) = &a.default_permissions {
419 match level(text, "default_permissions") {
420 Ok(parsed) => settings.default_permissions = parsed,
421 Err(problem) => return Ok(fail(FailureCode::Invalid, problem)),
422 }
423 }
424 if let Some(text) = &a.max_permissions {
425 match level(text, "max_permissions") {
426 Ok(parsed) => settings.max_permissions = parsed,
427 Err(problem) => return Ok(fail(FailureCode::Invalid, problem)),
428 }
429 }
430 if settings.max_permissions == "read" {
431 settings.default_permissions = "read".to_owned();
432 }
433 if let Some(allow) = a.can_approve_pull_requests {
434 settings.can_approve_pull_requests = allow;
435 }
436 self.db
437 .prepare(
438 "INSERT INTO workspace_actions_settings (namespace, default_permissions, max_permissions, can_approve_pulls, updated_at, updated_by)
439 VALUES (?1, ?2, ?3, ?4, ?5, ?6)
440 ON CONFLICT (namespace) DO UPDATE SET default_permissions = ?2, max_permissions = ?3, can_approve_pulls = ?4,
441 updated_at = ?5, updated_by = ?6",
442 )
443 .bind(&[
444 workspace.as_str().into(),
Actions: keep workflow runs safe445 settings.default_permissions.as_str().into(),
Merge main into the run-protection branch446 settings.max_permissions.as_str().into(),
447 u32::from(settings.can_approve_pull_requests).into(),
Actions: keep workflow runs safe448 now().into(),
449 a.actor.username.as_str().into(),
450 ])?
451 .run()
452 .await?;
453 Ok(Outcome::Ok(settings))
454 }
455
456 // --- Environments -------------------------------------------------------------
457
458 async fn environment_row(&self, repo_id: &str, name: &str) -> Result<Option<EnvRow>> {
459 self.db
460 .prepare("SELECT * FROM environments WHERE repo_id = ? AND name = ?")
461 .bind(&[repo_id.into(), name.to_ascii_lowercase().into()])?
462 .first::<EnvRow>(None)
463 .await
464 }
465
466 /// An environment and its rules; one without rules if it has none.
467 pub(crate) async fn environment_rules(&self, repo_id: &str, name: &str) -> Result<Environment> {
468 Ok(match self.environment_row(repo_id, name).await? {
469 Some(row) => row.view(),
470 None => unprotected(&name.to_ascii_lowercase()),
471 })
472 }
473
474 /// `environments`: every environment the repository's rules, secrets,
475 /// workflows or jobs name; or with `name`, the one.
476 pub async fn environments(&self, a: EnvironmentsArgs) -> Result<Outcome<Vec<Environment>>> {
477 let Some(repo) = self.visible_repo(&a.repo, &a.viewer).await? else {
478 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
479 };
480 if let Some(name) = &a.name {
481 let name = check!(environment_name(name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
482 return Ok(Outcome::Ok(vec![self.environment_rules(&repo.id, &name).await?]));
483 }
484 let rows = self
485 .db
486 .prepare("SELECT * FROM environments WHERE repo_id = ? ORDER BY name")
487 .bind(&[repo.id.as_str().into()])?
488 .all()
489 .await?
490 .results::<EnvRow>()?;
491 let mut out: Vec<Environment> = rows.iter().map(EnvRow::view).collect();
492 let mut named: Vec<String> = self.secret_environments(&repo.id).await?;
493 #[derive(Deserialize)]
494 struct Named {
495 environment: String,
496 }
497 let used = self
498 .db
499 .prepare("SELECT DISTINCT environment FROM jobs WHERE repo_id = ? AND environment IS NOT NULL LIMIT 100")
500 .bind(&[repo.id.as_str().into()])?
501 .all()
502 .await?
503 .results::<Named>()?;
504 named.extend(used.into_iter().map(|n| n.environment));
505 #[derive(Deserialize)]
506 struct Source {
507 source: String,
508 }
509 let sources = self
510 .db
511 .prepare("SELECT source FROM workflows WHERE repo_id = ? AND error IS NULL")
512 .bind(&[repo.id.as_str().into()])?
513 .all()
514 .await?
515 .results::<Source>()?;
516 for source in sources {
517 let Ok(workflow) = g1t_actions::workflow::parse(&source.source) else { continue };
518 for job in &workflow.jobs {
519 let written = match job.raw.get("environment") {
520 Some(Value::String(name)) => Some(name.clone()),
521 Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).map(str::to_owned),
522 _ => None,
523 };
524 if let Some(name) = written.filter(|name| !name.contains("${{")) {
525 named.push(name);
526 }
527 }
528 }
529 for name in named {
530 if let Ok(name) = environment_name(&name)
531 && !out.iter().any(|env| env.name == name)
532 {
533 out.push(unprotected(&name));
534 }
535 }
536 out.sort_by(|a, b| b.protected.cmp(&a.protected).then(a.name.cmp(&b.name)));
537 Ok(Outcome::Ok(out))
538 }
539
540 pub async fn set_environment(&self, a: SetEnvironmentArgs) -> Result<Outcome<Environment>> {
541 if let Some(refused) = refuse_job_token(&a.actor) {
542 return Ok(refused);
543 }
544 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
545 let name = check!(environment_name(&a.name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
546 let mut env = self.environment_rules(&repo.id, &name).await?;
547 if let Some(reviewers) = a.reviewers {
548 let reviewers = check!(self.valid_reviewers(&repo, reviewers).await?);
549 env.reviewers = reviewers;
550 }
551 if let Some(flag) = a.prevent_self_review {
552 env.prevent_self_review = flag;
553 }
554 if let Some(minutes) = a.wait_minutes {
555 if minutes > MAX_WAIT_MINUTES {
556 return Ok(fail(FailureCode::Invalid, format!("A wait timer is at most {MAX_WAIT_MINUTES} minutes (30 days).")));
557 }
558 env.wait_minutes = minutes;
559 }
560 if let Some(policy) = a.branch_policy {
561 let policy = policy.trim().to_owned();
562 if !["all", "protected", "selected"].contains(&policy.as_str()) {
563 return Ok(fail(FailureCode::Invalid, "branch_policy is all, protected or selected."));
564 }
565 env.branch_policy = policy;
566 }
567 if let Some(patterns) = a.branch_patterns {
568 let mut clean: Vec<BranchPattern> = Vec::new();
569 for pattern in patterns {
570 let name = pattern.name.trim().to_owned();
571 let kind = pattern.kind.trim().to_ascii_lowercase();
572 if name.is_empty() || name.len() > 255 {
573 return Ok(fail(FailureCode::Invalid, "A branch or tag pattern is 1 to 255 characters."));
574 }
575 if kind != "branch" && kind != "tag" {
576 return Ok(fail(FailureCode::Invalid, format!("`{name}`: a pattern's type is branch or tag.")));
577 }
578 if !clean.iter().any(|known| known.name == name && known.kind == kind) {
579 clean.push(BranchPattern { name, kind });
580 }
581 }
582 if clean.len() > 50 {
583 return Ok(fail(FailureCode::Invalid, "An environment lists at most 50 branch and tag patterns."));
584 }
585 env.branch_patterns = clean;
586 }
587 if let Some(flag) = a.admins_bypass {
588 env.admins_bypass = flag;
589 }
590 let at = now();
591 self.db
592 .prepare(
593 "INSERT INTO environments (repo_id, name, reviewers, prevent_self_review, wait_minutes, branch_policy, branch_patterns,
594 admins_bypass, created_at, updated_at, updated_by)
595 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?9, ?10)
596 ON CONFLICT (repo_id, name) DO UPDATE SET reviewers = ?3, prevent_self_review = ?4, wait_minutes = ?5,
597 branch_policy = ?6, branch_patterns = ?7, admins_bypass = ?8, updated_at = ?9, updated_by = ?10",
598 )
599 .bind(&[
600 repo.id.as_str().into(),
601 name.as_str().into(),
602 serde_json::to_string(&env.reviewers)?.into(),
603 u32::from(env.prevent_self_review).into(),
604 env.wait_minutes.into(),
605 env.branch_policy.as_str().into(),
606 serde_json::to_string(&env.branch_patterns)?.into(),
607 u32::from(env.admins_bypass).into(),
608 at.as_str().into(),
609 a.actor.username.as_str().into(),
610 ])?
611 .run()
612 .await?;
613 Ok(Outcome::Ok(self.environment_rules(&repo.id, &name).await?))
614 }
615
616 pub async fn delete_environment(&self, a: DeleteEnvironmentArgs) -> Result<Outcome<bool>> {
617 if let Some(refused) = refuse_job_token(&a.actor) {
618 return Ok(refused);
619 }
620 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
621 let name = check!(environment_name(&a.name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
622 let removed = self
623 .db
624 .prepare("DELETE FROM environments WHERE repo_id = ? AND name = ? RETURNING name")
625 .bind(&[repo.id.as_str().into(), name.as_str().into()])?
626 .first::<Value>(None)
627 .await?;
628 if removed.is_none() {
629 return Ok(fail(FailureCode::NotFound, format!("{name} has no protection rules.")));
630 }
631 Ok(Outcome::Ok(true))
632 }
633
634 /// Reviewers as given, checked: at most six, each a person with access
635 /// to the repository or a team of its workspace.
636 async fn valid_reviewers(&self, repo: &Repo, given: Vec<EnvironmentReviewer>) -> Result<Outcome<Vec<EnvironmentReviewer>>> {
637 if given.len() > MAX_ENVIRONMENT_REVIEWERS {
638 return Ok(fail(FailureCode::Invalid, format!("An environment has at most {MAX_ENVIRONMENT_REVIEWERS} reviewers.")));
639 }
640 let Some(ws) = self.workspace_actor(&repo.namespace).await? else {
641 return Ok(fail(FailureCode::NotFound, "There is no such workspace."));
642 };
643 let mut out: Vec<EnvironmentReviewer> = Vec::new();
644 for reviewer in given {
645 let kind = reviewer.kind.trim().to_ascii_lowercase();
646 let name = reviewer.name.trim().trim_start_matches('@').to_ascii_lowercase();
647 match kind.as_str() {
648 "user" => {
649 let permission: Outcome<PermissionInfo> = g1t_kit::call(
650 &self.identity,
651 "collaborator_permission",
652 &CollaboratorPermissionArgs {
653 viewer: Some(ws.clone()),
654 path: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
655 username: name.clone(),
656 },
657 )
658 .await?;
659 if !permission.into_result().ok().is_some_and(|info| info.role.is_some()) {
660 return Ok(fail(FailureCode::Invalid, format!("{name} has no access to {}/{}, so cannot review.", repo.namespace, repo.name)));
661 }
662 }
663 "team" => {
664 let slug = name.rsplit('/').next().unwrap_or(&name).to_owned();
665 if self.team_people(&repo.namespace, &slug).await?.is_none() {
666 return Ok(fail(FailureCode::Invalid, format!("{} has no team called {slug}.", repo.namespace)));
667 }
668 if !out.iter().any(|known| known.kind == "team" && known.name == slug) {
669 out.push(EnvironmentReviewer { kind, name: slug });
670 }
671 continue;
672 }
673 _ => return Ok(fail(FailureCode::Invalid, "A reviewer's type is user or team.")),
674 }
675 if !out.iter().any(|known| known.kind == kind && known.name == name) {
676 out.push(EnvironmentReviewer { kind, name });
677 }
678 }
679 Ok(Outcome::Ok(out))
680 }
681
682 /// Everyone in a team of `workspace` and its child teams, by username;
683 /// `None` when there is no such team.
684 async fn team_people(&self, workspace: &str, slug: &str) -> Result<Option<Vec<String>>> {
685 let resolved: Vec<Value> = g1t_kit::call(
686 &self.identity,
687 "resolve_teams",
688 &json!({ "teams": [format!("{workspace}/{slug}")] }),
689 )
690 .await
691 .unwrap_or_default();
692 Ok(resolved.into_iter().next().map(|team| {
693 ["members", "child_members"]
694 .iter()
695 .flat_map(|key| team[*key].as_array().cloned().unwrap_or_default())
696 .filter_map(|person| person["username"].as_str().map(str::to_lowercase))
697 .collect()
698 }))
699 }
700
701 /// The teams of the environment's reviewers that `username` is in.
702 async fn reviewer_teams(&self, workspace: &str, environment: &Environment, username: &str) -> Result<Vec<String>> {
703 let mut teams = Vec::new();
704 for reviewer in environment.reviewers.iter().filter(|r| r.kind == "team") {
705 if self
706 .team_people(workspace, &reviewer.name)
707 .await?
708 .is_some_and(|people| people.iter().any(|person| person.eq_ignore_ascii_case(username)))
709 {
710 teams.push(reviewer.name.clone());
711 }
712 }
713 Ok(teams)
714 }
715
716 // --- Gates ---------------------------------------------------------------------
717
718 /// What `environment`'s rules say about a job of `run` that names it,
719 /// recording the run's gate there the first time one of its jobs
720 /// reaches it.
721 pub(crate) async fn gate(&self, run: &RunRow, environment: &str) -> Result<Gate> {
722 let Ok(name) = environment_name(environment) else {
723 return Ok(Gate::Open);
724 };
725 let Some(row) = self.environment_row(&run.repo_id, &name).await? else {
726 return Ok(Gate::Open);
727 };
728 let env = row.view();
729 // Which refs may deploy, before anything waits.
730 let protected = if env.branch_policy == "protected" { self.branch_protected(run).await? } else { false };
731 if let Err(problem) = branch_allowed(&env.branch_policy, &env.branch_patterns, &run.git_ref, protected, &name) {
732 return Ok(Gate::Refused(problem));
733 }
734 let needs_review = !env.reviewers.is_empty();
735 if !needs_review && env.wait_minutes == 0 {
736 return Ok(Gate::Open);
737 }
738 let existing = self.gate_row(&run.id, run.attempt as u32, &name).await?;
739 let gate = match existing {
740 Some(gate) => gate,
741 None => {
742 let wait_until = (env.wait_minutes > 0).then(|| rfc3339(now_ms() + u64::from(env.wait_minutes) * 60_000));
743 self.db
744 .prepare(
745 "INSERT OR IGNORE INTO environment_gates (run_id, attempt, environment, repo_id, state, needs_review, wait_until, created_at)
746 VALUES (?, ?, ?, ?, 'waiting', ?, ?, ?)",
747 )
748 .bind(&[
749 run.id.as_str().into(),
750 (run.attempt as u32).into(),
751 name.as_str().into(),
752 run.repo_id.as_str().into(),
753 u32::from(needs_review).into(),
754 optional(wait_until.as_deref()),
755 now().into(),
756 ])?
757 .run()
758 .await?;
759 if needs_review {
760 self.ask_reviewers(run, &env).await;
761 }
762 match self.gate_row(&run.id, run.attempt as u32, &name).await? {
763 Some(gate) => gate,
764 None => return Ok(Gate::Held(held_reason(&name, needs_review, wait_until.as_deref()))),
765 }
766 }
767 };
768 if gate.state == "rejected" {
769 let by = gate.reviewed_by.as_deref().unwrap_or("A reviewer");
770 return Ok(Gate::Refused(format!("{by} rejected the deployment to {name}.")));
771 }
772 if gate_open(&gate.state, gate.needs_review != 0, gate.wait_until.as_deref(), &now()) {
773 return Ok(Gate::Open);
774 }
775 let review_left = gate.needs_review != 0 && gate.state != "approved";
776 Ok(Gate::Held(held_reason(&name, review_left, gate.wait_until.as_deref())))
777 }
778
779 async fn gate_row(&self, run_id: &str, attempt: u32, environment: &str) -> Result<Option<GateRow>> {
780 self.db
781 .prepare("SELECT * FROM environment_gates WHERE run_id = ? AND attempt = ? AND environment = ?")
782 .bind(&[run_id.into(), attempt.into(), environment.into()])?
783 .first::<GateRow>(None)
784 .await
785 }
786
787 /// Whether the run's branch is protected: the default branch, or one an
788 /// active rule holds.
789 async fn branch_protected(&self, run: &RunRow) -> Result<bool> {
790 let Some(branch) = run.git_ref.strip_prefix("refs/heads/") else { return Ok(false) };
791 let path = crate::repo_path(&run.repo);
792 let Some(ws) = self.workspace_actor(&path.namespace).await? else { return Ok(false) };
793 let rules: Outcome<Value> = g1t_kit::call(
794 &self.work,
795 "effective_rules",
796 &json!({ "viewer": ws, "repo": path, "name": branch, "target": "branch" }),
797 )
798 .await
799 .unwrap_or_else(|_| Outcome::Ok(Value::Null));
800 Ok(match rules {
801 Outcome::Ok(rules) => {
802 rules["default_branch"].as_bool() == Some(true)
803 || rules["rules"].as_array().is_some_and(|rules| rules.iter().any(|rule| rule["enforcement"] == "active"))
804 }
805 Outcome::Fail(_) => false,
806 })
807 }
808
809 /// Tells an environment's reviewers that a run waits for them.
810 async fn ask_reviewers(&self, run: &RunRow, env: &Environment) {
811 let path = crate::repo_path(&run.repo);
812 let mut people: Vec<String> = Vec::new();
813 for reviewer in &env.reviewers {
814 let names = match reviewer.kind.as_str() {
815 "team" => self.team_people(&path.namespace, &reviewer.name).await.ok().flatten().unwrap_or_default(),
816 _ => vec![reviewer.name.clone()],
817 };
818 for name in names {
819 // Never whoever cannot approve their own run.
820 let own = env.prevent_self_review && run.actor.as_deref().is_some_and(|by| by.eq_ignore_ascii_case(&name));
821 if !own && !people.contains(&name) {
822 people.push(name);
823 }
824 }
825 }
826 if people.is_empty() {
827 return;
828 }
829 let published: Result<()> = g1t_kit::call(
830 &self.events,
831 "publish",
832 &g1t_contracts::events::Publish {
833 events: vec![g1t_contracts::events::NewEvent {
834 kind: "deployment.review_requested",
835 source: "actions",
836 repo_id: Some(run.repo_id.clone()),
837 actor: run.actor_id.clone(),
838 data: json!({
839 "repoId": run.repo_id,
840 "runId": run.id,
841 "attempt": run.attempt,
842 "environment": env.name,
843 "workflow": run.name,
844 "title": run.title,
845 "number": run.number,
846 "notify": people,
847 "link": format!("/{}/actions/runs/{}", run.repo, run.id),
848 }),
849 }],
850 },
851 )
852 .await;
853 if let Err(error) = published {
854 worker::console_error!("actions: reviewers of {} not told for run {}: {error}", env.name, run.id);
855 }
856 }
857
858 /// The environments holding a run's jobs this attempt, and whether
859 /// `viewer` may decide on each.
860 pub(crate) async fn pending_for(&self, run: &RunRow, viewer: &Viewer) -> Result<Vec<PendingDeployment>> {
861 let gates = self
862 .db
863 .prepare("SELECT * FROM environment_gates WHERE run_id = ? AND attempt = ? ORDER BY environment")
864 .bind(&[run.id.as_str().into(), (run.attempt as u32).into()])?
865 .all()
866 .await?
867 .results::<GateRow>()?;
868 if gates.is_empty() {
869 return Ok(Vec::new());
870 }
871 let jobs = self.job_rows(&run.id).await?;
872 let repo = self.visible_repo(&crate::repo_path(&run.repo), viewer).await?;
873 let mut out = Vec::new();
874 for gate in gates {
875 let env = self.environment_rules(&run.repo_id, &gate.environment).await?;
876 let held: Vec<&JobRow> = jobs.iter().filter(|job| job.environment.as_deref().is_some_and(|e| e.eq_ignore_ascii_case(&gate.environment))).collect();
877 let waiting = gate.state == "waiting" && held.iter().any(|job| job.status == "pending");
878 let can_review = match (viewer, &repo, waiting) {
879 (Some(user), Some(repo), true) if user.kind == PrincipalKind::User && user.token.as_ref().is_none_or(|t| t.job.is_none()) => {
880 let teams = self.reviewer_teams(&repo.namespace, &env, &user.username).await?;
881 let admin = access::can(Some(user), repo, Capability::Administer);
882 may_review(&env, &user.username, &teams, admin, run.actor.as_deref()).is_ok()
883 }
884 _ => false,
885 };
886 out.push(PendingDeployment {
887 environment: gate.environment.clone(),
888 state: gate.state.clone(),
889 needs_review: gate.needs_review != 0,
890 wait_until: gate.wait_until.clone(),
891 reviewers: env.reviewers.clone(),
892 jobs: held.iter().map(|job| job.name.clone()).collect(),
893 can_review,
894 reviewed_by: gate.reviewed_by.clone(),
895 comment: gate.comment.clone(),
896 reviewed_at: gate.reviewed_at.clone(),
897 });
898 }
899 Ok(out)
900 }
901
902 pub async fn pending_deployments(&self, a: PendingDeploymentsArgs) -> Result<Outcome<Vec<PendingDeployment>>> {
903 if self.visible_repo(&a.repo, &a.viewer).await?.is_none() {
904 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
905 }
906 let run = check!(self.run_in(&a.repo, &a.id).await?);
907 Ok(Outcome::Ok(self.pending_for(&run, &a.viewer).await?))
908 }
909
910 /// `review_deployments`: a reviewer approves or rejects the jobs an
911 /// environment holds in a run.
912 pub async fn review_deployments(&self, a: ReviewDeploymentsArgs) -> Result<Outcome<Vec<PendingDeployment>>> {
913 if let Some(refused) = refuse_job_token(&a.actor) {
914 return Ok(refused);
915 }
916 if a.actor.kind != PrincipalKind::User {
917 return Ok(fail(FailureCode::Forbidden, "Only a person can review a deployment."));
918 }
919 let repo = check!(self.may(&a.actor, &a.repo, Capability::Read).await?);
920 let approve = match a.state.trim() {
921 "approved" | "approve" => true,
922 "rejected" | "reject" => false,
923 _ => return Ok(fail(FailureCode::Invalid, "state is approved or rejected.")),
924 };
925 let run = check!(self.run_in(&a.repo, &a.id).await?);
926 let wanted: Vec<String> = a.environments.iter().filter_map(|name| environment_name(name).ok()).collect();
927 let pending = self.pending_for(&run, &Some(a.actor.clone())).await?;
928 let waiting: Vec<&PendingDeployment> = pending
929 .iter()
930 .filter(|p| p.state == "waiting" && !p.jobs.is_empty())
931 .filter(|p| wanted.is_empty() || wanted.contains(&p.environment))
932 .collect();
933 if waiting.is_empty() {
934 return Ok(fail(FailureCode::Conflict, "No deployment of this run is waiting for review."));
935 }
936 let comment: Option<String> = a.comment.as_deref().map(str::trim).filter(|c| !c.is_empty()).map(|c| c.chars().take(1000).collect());
937 let admin = access::can(Some(&a.actor), &repo, Capability::Administer);
938 let at = now();
939 for pending in &waiting {
940 let env = self.environment_rules(&run.repo_id, &pending.environment).await?;
941 let teams = self.reviewer_teams(&repo.namespace, &env, &a.actor.username).await?;
942 let how = match may_review(&env, &a.actor.username, &teams, admin, run.actor.as_deref()) {
943 Ok(how) => how,
944 Err(problem) => return Ok(fail(FailureCode::Forbidden, problem)),
945 };
946 let state = if approve { "approved" } else { "rejected" };
947 // An admin's approval past the rules skips the wait timer too.
948 let clear_wait = approve && how == Reviewer::AdminBypass;
949 self.db
950 .prepare(
951 "UPDATE environment_gates SET state = ?, reviewed_by = ?, comment = ?, reviewed_at = ?,
952 wait_until = CASE WHEN ? THEN NULL ELSE wait_until END
953 WHERE run_id = ? AND attempt = ? AND environment = ? AND state = 'waiting'",
954 )
955 .bind(&[
956 state.into(),
957 a.actor.username.as_str().into(),
958 optional(comment.as_deref()),
959 at.as_str().into(),
960 u32::from(clear_wait).into(),
961 run.id.as_str().into(),
962 (run.attempt as u32).into(),
963 pending.environment.as_str().into(),
964 ])?
965 .run()
966 .await?;
967 if !approve {
968 let reason = match &comment {
969 Some(comment) => format!("{} rejected the deployment to {}: {comment}", a.actor.username, pending.environment),
970 None => format!("{} rejected the deployment to {}.", a.actor.username, pending.environment),
971 };
972 self.db
973 .prepare(
974 "UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ?
975 WHERE run_id = ? AND status = 'pending' AND lower(environment) = ?",
976 )
977 .bind(&[reason.into(), at.as_str().into(), run.id.as_str().into(), pending.environment.as_str().into()])?
978 .run()
979 .await?;
980 }
981 }
982 self.release_gates_of(&run).await?;
983 self.advance(&run.id).await?;
984 let run = self.run_row(&run.id).await?.unwrap_or(run);
985 Ok(Outcome::Ok(self.pending_for(&run, &Some(a.actor.clone())).await?))
986 }
987
988 /// Queues a run's pending jobs whose environments now let them start.
989 pub(crate) async fn release_gates_of(&self, run: &RunRow) -> Result<bool> {
990 let jobs = self.job_rows(&run.id).await?;
991 let at = now();
992 let mut released = false;
993 for job in jobs.iter().filter(|job| job.status == "pending") {
994 let Some(environment) = job.environment.as_deref() else { continue };
995 match self.gate(run, environment).await? {
996 Gate::Open => {
997 // A self-hosted job waits for a runner again.
998 let reason = job
999 .labels
1000 .as_deref()
1001 .and_then(|labels| serde_json::from_str::<Vec<String>>(labels).ok())
1002 .map(|stored| g1t_contracts::runners::waiting_reason(&g1t_contracts::runners::Wanted::from_stored(&stored)));
1003 self.db
1004 .prepare("UPDATE jobs SET status = 'queued', reason = ?, queued_at = ? WHERE id = ? AND status = 'pending'")
1005 .bind(&[optional(reason.as_deref()), at.as_str().into(), job.id.as_str().into()])?
1006 .run()
1007 .await?;
1008 released = true;
1009 }
1010 Gate::Held(reason) => {
1011 if job.reason.as_deref() != Some(reason.as_str()) {
1012 self.db
1013 .prepare("UPDATE jobs SET reason = ? WHERE id = ? AND status = 'pending'")
1014 .bind(&[reason.into(), job.id.as_str().into()])?
1015 .run()
1016 .await?;
1017 }
1018 }
1019 Gate::Refused(reason) => {
1020 self.db
1021 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ? WHERE id = ? AND status = 'pending'")
1022 .bind(&[reason.into(), at.as_str().into(), job.id.as_str().into()])?
1023 .run()
1024 .await?;
1025 released = true;
1026 }
1027 }
1028 }
1029 Ok(released)
1030 }
1031
1032 /// Every minute: runs whose jobs wait at an environment whose timer has
1033 /// run out, or whose review came in, move along.
1034 pub(crate) async fn release_gates(&self) -> Result<()> {
1035 #[derive(Deserialize)]
1036 struct Waiting {
1037 run_id: String,
1038 }
1039 let runs = self
1040 .db
1041 .prepare("SELECT DISTINCT run_id FROM jobs WHERE status = 'pending' LIMIT 100")
1042 .all()
1043 .await?
1044 .results::<Waiting>()?;
1045 for waiting in runs {
1046 let Some(run) = self.run_row(&waiting.run_id).await? else { continue };
1047 if self.release_gates_of(&run).await? {
1048 self.advance(&run.id).await?;
1049 }
1050 }
1051 Ok(())
1052 }
1053
1054 // --- Approving runs of pull requests from outside --------------------------
1055
1056 /// Why a pull request's run waits for approval, if it does: by the
1057 /// repository's policy, whoever the pull request is for (its owner).
1058 pub(crate) async fn approval_needed(&self, repo: &Repo, owner: &User, ws: &User) -> Result<Option<String>> {
1059 // g1t's own work, nobody asked for, is the workspace's.
1060 if owner.id == AGENT_ID || owner.kind == PrincipalKind::System {
1061 return Ok(None);
1062 }
Merge main into the run-protection branch1063 let policy = self.approval_policy(&repo.id).await?;
Actions: keep workflow runs safe1064 let permission: Outcome<PermissionInfo> = g1t_kit::call(
1065 &self.identity,
1066 "collaborator_permission",
1067 &CollaboratorPermissionArgs {
1068 viewer: Some(ws.clone()),
1069 path: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
1070 username: owner.username.clone(),
1071 },
1072 )
1073 .await?;
1074 let info = permission.into_result().ok();
1075 let member = owner.is_member(&repo.namespace.to_lowercase())
1076 || info.as_ref().is_some_and(|info| matches!(info.source, Some(AccessSource::Owner | AccessSource::Base | AccessSource::Team)));
1077 if member {
1078 return Ok(None);
1079 }
1080 let can_push = info.as_ref().and_then(|info| info.role).is_some_and(|role| access::allows(role, Capability::Push));
1081 let first_time = !self.has_merged(repo, owner, ws).await?;
1082 Ok(approval_reason(&policy, member, can_push, first_time).map(|why| format!("{} {why}, so someone with the Write role approves its runs first.", owner.username)))
1083 }
1084
1085 /// Whether a pull request of `owner`'s has been merged into `repo`.
1086 async fn has_merged(&self, repo: &Repo, owner: &User, ws: &User) -> Result<bool> {
1087 let closed: Outcome<Vec<g1t_contracts::work::Pull>> = g1t_kit::call(
1088 &self.work,
1089 "list_pulls",
1090 &g1t_contracts::work::ListPullsArgs {
1091 repo: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
1092 viewer: Some(ws.clone()),
1093 state: Some(g1t_contracts::work::State::Closed),
1094 label: None,
1095 milestone: None,
1096 base: None,
1097 },
1098 )
1099 .await
1100 .unwrap_or_else(|_| Outcome::Ok(Vec::new()));
1101 Ok(closed.into_result().unwrap_or_default().iter().any(|pull| pull.merged_at.is_some() && pull.owner().id == owner.id))
1102 }
1103
1104 /// `approve_run`: someone with the Write role lets a pull request's run
1105 /// that waits for approval start.
1106 pub async fn approve_run(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
1107 if let Some(refused) = refuse_job_token(&a.actor) {
1108 return Ok(refused);
1109 }
1110 check!(self.may(&a.actor, &a.repo, Capability::Run).await?);
1111 let run = check!(self.run_in(&a.repo, &a.id).await?);
1112 if run.status != "action_required" {
1113 return Ok(fail(FailureCode::Conflict, "This run is not waiting for approval."));
1114 }
1115 let mut approval = run.approval().unwrap_or(RunApproval { state: "required".into(), reason: String::new(), approved_by: None });
1116 approval.state = "approved".to_owned();
1117 approval.approved_by = Some(a.actor.username.clone());
1118 let started = self
1119 .db
1120 .prepare("UPDATE runs SET status = 'queued', approval = ?, approved_by = ? WHERE id = ? AND status = 'action_required' RETURNING id")
1121 .bind(&[serde_json::to_string(&approval)?.into(), a.actor.username.as_str().into(), run.id.as_str().into()])?
1122 .first::<Value>(None)
1123 .await?;
1124 if started.is_none() {
1125 return Ok(fail(FailureCode::Conflict, "This run is not waiting for approval."));
1126 }
1127 if let Some(run) = self.run_row(&run.id).await? {
1128 self.enter_group(&run).await?;
1129 }
1130 self.run_summary(&run.id).await
1131 }
1132}
1133
1134/// A workflow job's own token may not approve or change what keeps runs
1135/// safe: a workflow could otherwise let itself through.
1136fn refuse_job_token<T>(actor: &User) -> Option<Outcome<T>> {
1137 actor
1138 .token
1139 .as_ref()
1140 .is_some_and(|token| token.job.is_some())
1141 .then(|| fail(FailureCode::Forbidden, "A workflow job's token cannot approve runs or deployments, or change their rules."))
1142}
1143
1144#[cfg(test)]
1145mod tests {
1146 use super::*;
1147
1148 fn env(reviewers: &[(&str, &str)]) -> Environment {
1149 Environment {
1150 reviewers: reviewers.iter().map(|(kind, name)| EnvironmentReviewer { kind: (*kind).into(), name: (*name).into() }).collect(),
1151 ..unprotected("production")
1152 }
1153 }
1154
1155 fn pattern(name: &str, kind: &str) -> BranchPattern {
1156 BranchPattern { name: name.into(), kind: kind.into() }
1157 }
1158
1159 #[test]
Merge main into the run-protection branch1160 fn the_default_token_the_github_way() {
1161 use TokenDefault::{Permissive, Restricted};
1162 // A new repository takes its workspace's default: read-only unless it says.
1163 assert_eq!(effective_default(None, false, Restricted, Permissive), Restricted);
1164 assert_eq!(effective_default(None, false, Permissive, Permissive), Permissive);
1165 // One made before restricted tokens keeps read and write.
1166 assert_eq!(effective_default(None, true, Restricted, Permissive), Permissive);
1167 // A repository's own choice wins...
1168 assert_eq!(effective_default(Some(Restricted), true, Permissive, Permissive), Restricted);
1169 assert_eq!(effective_default(Some(Permissive), false, Restricted, Permissive), Permissive);
1170 // ...but never past the workspace's maximum.
1171 assert_eq!(effective_default(Some(Permissive), true, Permissive, Restricted), Restricted);
1172 assert_eq!(effective_default(None, true, Restricted, Restricted), Restricted);
1173 // A workspace without a row: new repositories read-only, writes allowed, no pull requests.
1174 let policy = workspace_policy(None);
1175 assert_eq!((policy.default_permissions.as_str(), policy.max_permissions.as_str()), ("read", "write"));
1176 assert!(!policy.can_approve_pull_requests);
1177 }
1178
1179 #[test]
Actions: keep workflow runs safe1180 fn which_refs_may_deploy() {
1181 assert!(branch_allowed("all", &[], "refs/pull/3/merge", false, "production").is_ok());
1182 assert!(branch_allowed("protected", &[], "refs/heads/main", true, "production").is_ok());
1183 assert!(branch_allowed("protected", &[], "refs/heads/feature", false, "production").unwrap_err().contains("protected branches only"));
1184 // A pull request's merge ref is never a protected branch.
1185 assert!(branch_allowed("protected", &[], "refs/pull/3/merge", true, "production").is_err());
1186 let selected = [pattern("main", "branch"), pattern("release/*", "branch"), pattern("v*", "tag")];
1187 assert!(branch_allowed("selected", &selected, "refs/heads/release/1.x", false, "production").is_ok());
1188 assert!(branch_allowed("selected", &selected, "refs/tags/v1.2.0", false, "production").is_ok());
1189 assert!(branch_allowed("selected", &selected, "refs/heads/feature", false, "production").is_err());
1190 // A tag pattern does not let a branch of that name through.
1191 assert!(branch_allowed("selected", &[pattern("v*", "tag")], "refs/heads/v2", false, "production").is_err());
1192 assert!(branch_allowed("selected", &[], "refs/heads/main", false, "production").is_err());
1193 }
1194
1195 #[test]
1196 fn who_may_review() {
1197 let production = env(&[("user", "ada"), ("team", "deployers")]);
1198 assert_eq!(may_review(&production, "ada", &[], false, Some("bo")), Ok(Reviewer::Listed));
1199 assert_eq!(may_review(&production, "Ada", &[], false, None), Ok(Reviewer::Listed), "names compare without case");
1200 assert_eq!(may_review(&production, "cy", &["deployers".into()], false, None), Ok(Reviewer::Listed));
1201 assert!(may_review(&production, "cy", &[], false, None).unwrap_err().contains("not one of"));
1202 // An admin past the rules, unless the environment says no.
1203 assert_eq!(may_review(&production, "cy", &[], true, None), Ok(Reviewer::AdminBypass));
1204 let strict = Environment { admins_bypass: false, ..production.clone() };
1205 assert!(may_review(&strict, "cy", &[], true, None).is_err());
1206 // Whoever started the run, when self-review is off.
1207 let no_self = Environment { prevent_self_review: true, ..production.clone() };
1208 assert!(may_review(&no_self, "ada", &[], false, Some("ada")).unwrap_err().contains("You started this run"));
1209 assert_eq!(may_review(&no_self, "ada", &[], false, Some("bo")), Ok(Reviewer::Listed));
1210 assert_eq!(may_review(&no_self, "ada", &[], true, Some("ada")), Ok(Reviewer::AdminBypass));
1211 // Without reviewers there is nothing to review; an admin may start it.
1212 let timer = Environment { wait_minutes: 30, ..env(&[]) };
1213 assert!(may_review(&timer, "ada", &[], false, None).unwrap_err().contains("no reviewers"));
1214 assert_eq!(may_review(&timer, "ada", &[], true, None), Ok(Reviewer::AdminBypass));
1215 }
1216
1217 #[test]
1218 fn a_gate_opens_on_review_and_time() {
1219 let now = "2026-10-08T12:00:00Z";
1220 assert!(!gate_open("waiting", true, None, now));
1221 assert!(gate_open("approved", true, None, now));
1222 assert!(!gate_open("approved", true, Some("2026-10-08T12:30:00Z"), now));
1223 assert!(gate_open("approved", true, Some("2026-10-08T11:30:00Z"), now));
1224 assert!(gate_open("waiting", false, Some("2026-10-08T11:59:00Z"), now));
1225 assert!(!gate_open("waiting", false, Some("2026-10-08T12:01:00Z"), now));
1226 assert!(!gate_open("rejected", false, None, now));
1227 assert_eq!(held_reason("production", true, None), "Waiting for a review to deploy to production.");
1228 assert!(held_reason("staging", false, Some("2026-10-08T12:30:00Z")).contains("wait timer"));
1229 }
1230
1231 #[test]
1232 fn which_pull_requests_wait_for_approval() {
1233 // Members never wait.
1234 for policy in APPROVAL_POLICIES {
1235 assert_eq!(approval_reason(policy, true, true, true), None);
1236 }
1237 // The default: anyone who cannot push, and an outside collaborator's first.
1238 assert!(approval_reason("outside_contributors", false, false, false).is_some());
1239 assert!(approval_reason("outside_contributors", false, true, true).is_some());
1240 assert_eq!(approval_reason("outside_contributors", false, true, false), None);
1241 // First-time contributors only.
1242 assert!(approval_reason("first_time_contributors", false, false, true).is_some());
1243 assert_eq!(approval_reason("first_time_contributors", false, false, false), None);
1244 // Everyone outside the workspace.
1245 assert!(approval_reason("all_external_contributors", false, true, false).is_some());
1246 }
1247
1248 #[test]
1249 fn a_jobs_permissions_are_g1t_scopes_and_outside_runs_read_only() {
1250 use g1t_actions::permissions::{Access, Permissions};
1251 use g1t_contracts::scopes::{Level, Scope, TokenAccess};
1252 for scope in Permissions::all(Access::Write).scopes() {
1253 assert!(Scope::parse(scope).is_some(), "{scope} is not a g1t scope");
1254 }
1255 let token = |permissions: &Permissions| TokenAccess {
1256 scopes: Some(permissions.scopes().into_iter().map(str::to_owned).collect()),
1257 repo: Some("acme/web".into()),
1258 ..TokenAccess::default()
1259 };
1260 // The default: it can clone, and nothing more.
1261 let restricted = token(&Permissions::default_for(TokenDefault::Restricted));
1262 assert!(restricted.allows(Scope::CodeRead));
1263 assert!(!restricted.allows(Scope::CodeWrite));
1264 assert!(!restricted.allows(Scope::IssuesWrite));
1265 // A pull request from outside reads, whatever it asks for.
1266 let outside = token(&Permissions::all(Access::Write).read_only());
1267 assert!(Scope::ALL.iter().filter(|scope| outside.allows(**scope)).all(|scope| scope.level() == Level::Read));
1268 // Never more than a repository's: no admin, no secrets, no agents.
1269 let everything = token(&Permissions::all(Access::Write));
1270 for never in [Scope::RepoAdmin, Scope::SecretsRead, Scope::AgentsRun, Scope::WorkspaceRead, Scope::RunnersRead] {
1271 assert!(!everything.allows(never), "{}", never.as_str());
1272 }
1273 }
1274
1275 #[test]
1276 fn environment_names_are_checked() {
1277 assert_eq!(environment_name(" Production ").unwrap(), "production");
1278 assert!(environment_name("staging env").is_err());
1279 assert!(environment_name("").is_err());
1280 assert!(environment_name(&"a".repeat(41)).is_err());
1281 }
1282
1283 #[test]
1284 fn a_job_token_cannot_let_itself_through() {
1285 let mut actor = User { id: "wsp_1".into(), username: "acme".into(), kind: PrincipalKind::Workspace, ..User::default() };
1286 assert!(refuse_job_token::<()>(&actor).is_none());
1287 actor.token = Some(Box::new(g1t_contracts::scopes::TokenAccess {
Merge main into the run-protection branch1288 job: Some(g1t_contracts::scopes::JobToken { run_id: "run_1".into(), job_id: "job_1".into(), pull_requests: false }),
Actions: keep workflow runs safe1289 ..Default::default()
1290 }));
1291 assert!(refuse_job_token::<()>(&actor).is_some());
1292 }
1293}

This file's history is long; its oldest lines are credited to the oldest commit read.