Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 1 | // node --test scripts/runner-release.test.mjs |
| 2 | import assert from "node:assert/strict"; | |
| 3 | import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; | |
| 4 | import { tmpdir } from "node:os"; | |
| 5 | import { join } from "node:path"; | |
| 6 | import { test } from "node:test"; | |
| 7 | import { createPrivateKey } from "node:crypto"; | |
| 8 | ||
| 9 | import { TARGETS, keygen, manifest, sha256, signBytes, verifyBytes, version } from "./runner-release.mjs"; | |
| Self-hosted runners on a person's own computer are sandboxes that nothing a job runs can get out of. `g1t-runner sandbox up|down|status|update [--json]` gives a Windows, macOS or Linux computer up to two capabilities, each a runner of its own: Linux jobs in a Linux VM the runner owns, where the runner's image runs under Sysbox and each job is a fresh container inside it (nested-container, three walls from the computer); and jobs native to Windows, each in a Windows Sandbox of its own, discarded after, with one read-only folder holding the harness (a new `vm` isolation level, also `g1t-runner register --native`). On Windows the VM is a WSL 2 distribution imported from the release's signed root filesystem: its wsl.conf turns off drives, Windows programs and Windows' PATH, and the supervisor inside unmounts what WSL shares with every distribution anyway (/mnt/wsl, where Docker Desktop keeps its sockets to Windows, WSLg, the GPU driver folders), refuses to run while anything of the computer's is reachable, and drops containers' traffic to the computer's address but for DNS. It needs no administrator once WSL is installed, and works on Windows 11 Home. On macOS the VM runs under vfkit and on Linux without Sysbox under QEMU with KVM, with no shared folders and nothing forwarded in (built and tested as commands, not yet run on those machines); on Linux with Sysbox no VM is needed. `status --json` reports the state, versions, isolation, the current job and a sentence when something is wrong, and each capability's availability with its cause and fix, for the desktop app. `update` drains the runner, swaps in the newest signed image and starts again without registering again. The sandbox's images are built from deploy/sandbox/Dockerfile by scripts/sandbox-image.mjs and listed with their SHA-256 in the release's signed manifest, beside the runner image's digest. The release workflow now builds its images on g1t's own machines (g1t-4core) rather than waiting forever for a self-hosted runner, registering QEMU for arm64 where the machine allows it and building amd64 alone with a warning where it does not, and signs and publishes once the images are built. The Runners page shows each runner's isolation (Sandboxed, VM per job, Shared Docker, Unsandboxed), which the API now returns as `isolation`. The Self-hosted runners guide has a new "Sandbox on your computer" section, with what it cannot stop. | 10 | import { sandboxFiles, section } from "./sandbox-image.mjs"; |
| Fast pages, required checks on the branch, self-hosted runners, honest incidents | 11 | |
| 12 | test("a release is signed with the private key and checked with the raw public key", () => { | |
| 13 | const keys = keygen(); | |
| 14 | assert.equal(Buffer.from(keys.public, "base64").length, 32); | |
| 15 | const key = createPrivateKey({ key: Buffer.from(keys.private, "base64"), format: "der", type: "pkcs8" }); | |
| 16 | const bytes = Buffer.from('{"version":"0.2.0","files":{}}'); | |
| 17 | const signature = signBytes(bytes, key); | |
| 18 | assert.equal(Buffer.from(signature, "base64").length, 64); | |
| 19 | assert.ok(verifyBytes(bytes, signature, keys.public)); | |
| 20 | assert.ok(!verifyBytes(Buffer.from('{"version":"9.9.9","files":{}}'), signature, keys.public)); | |
| 21 | assert.ok(!verifyBytes(bytes, signature, keygen().public)); | |
| 22 | }); | |
| 23 | ||
| 24 | test("the manifest names each binary that was built, with its SHA-256", () => { | |
| 25 | const dir = mkdtempSync(join(tmpdir(), "runner-release-")); | |
| 26 | try { | |
| 27 | writeFileSync(join(dir, TARGETS["linux-x64"].file), "linux"); | |
| 28 | writeFileSync(join(dir, TARGETS["windows-x64"].file), "windows"); | |
| 29 | const m = manifest(dir, "0.2.0", "example/agent:0.2.0"); | |
| 30 | assert.equal(m.version, "0.2.0"); | |
| 31 | assert.equal(m.agent_image, "example/agent:0.2.0"); | |
| 32 | assert.deepEqual(Object.keys(m.files).sort(), ["linux-x64", "windows-x64"]); | |
| 33 | assert.equal(m.files["linux-x64"].sha256, sha256(Buffer.from("linux"))); | |
| 34 | assert.equal(m.files["windows-x64"].name, "g1t-runner-windows-x64.exe"); | |
| 35 | } finally { | |
| 36 | rmSync(dir, { recursive: true, force: true }); | |
| 37 | } | |
| 38 | }); | |
| 39 | ||
| 40 | test("platforms are named as the runner names them", () => { | |
| 41 | assert.deepEqual(Object.keys(TARGETS).sort(), ["linux-arm64", "linux-x64", "macos-arm64", "macos-x64", "windows-x64"]); | |
| 42 | assert.match(version(), /^\d+\.\d+\.\d+/); | |
| 43 | }); | |
| Self-hosted runners on a person's own computer are sandboxes that nothing a job runs can get out of. `g1t-runner sandbox up|down|status|update [--json]` gives a Windows, macOS or Linux computer up to two capabilities, each a runner of its own: Linux jobs in a Linux VM the runner owns, where the runner's image runs under Sysbox and each job is a fresh container inside it (nested-container, three walls from the computer); and jobs native to Windows, each in a Windows Sandbox of its own, discarded after, with one read-only folder holding the harness (a new `vm` isolation level, also `g1t-runner register --native`). On Windows the VM is a WSL 2 distribution imported from the release's signed root filesystem: its wsl.conf turns off drives, Windows programs and Windows' PATH, and the supervisor inside unmounts what WSL shares with every distribution anyway (/mnt/wsl, where Docker Desktop keeps its sockets to Windows, WSLg, the GPU driver folders), refuses to run while anything of the computer's is reachable, and drops containers' traffic to the computer's address but for DNS. It needs no administrator once WSL is installed, and works on Windows 11 Home. On macOS the VM runs under vfkit and on Linux without Sysbox under QEMU with KVM, with no shared folders and nothing forwarded in (built and tested as commands, not yet run on those machines); on Linux with Sysbox no VM is needed. `status --json` reports the state, versions, isolation, the current job and a sentence when something is wrong, and each capability's availability with its cause and fix, for the desktop app. `update` drains the runner, swaps in the newest signed image and starts again without registering again. The sandbox's images are built from deploy/sandbox/Dockerfile by scripts/sandbox-image.mjs and listed with their SHA-256 in the release's signed manifest, beside the runner image's digest. The release workflow now builds its images on g1t's own machines (g1t-4core) rather than waiting forever for a self-hosted runner, registering QEMU for arm64 where the machine allows it and building amd64 alone with a warning where it does not, and signs and publishes once the images are built. The Runners page shows each runner's isolation (Sandboxed, VM per job, Shared Docker, Unsandboxed), which the API now returns as `isolation`. The Self-hosted runners guide has a new "Sandbox on your computer" section, with what it cannot stop. | 44 | |
| 45 | test("the sandbox's images join the signed manifest, and one that is missing is refused", async () => { | |
| 46 | const dir = mkdtempSync(join(tmpdir(), "runner-release-sandbox-")); | |
| 47 | try { | |
| 48 | writeFileSync(join(dir, TARGETS["linux-x64"].file), "linux"); | |
| 49 | writeFileSync(join(dir, sandboxFiles("x64")["wsl-x64"]), "rootfs"); | |
| 50 | const s = await section(dir, "g1t.sh/flagon-io/g1t-runner@sha256:ab"); | |
| 51 | assert.deepEqual(Object.keys(s.files), ["wsl-x64"]); | |
| 52 | assert.equal(s.files["wsl-x64"].sha256, sha256(Buffer.from("rootfs"))); | |
| 53 | assert.equal(s.files["wsl-x64"].size, 6); | |
| 54 | writeFileSync(join(dir, "sandbox.json"), JSON.stringify(s)); | |
| 55 | const m = manifest(dir, "0.3.0"); | |
| 56 | assert.equal(m.sandbox.runner_image, "g1t.sh/flagon-io/g1t-runner@sha256:ab"); | |
| 57 | assert.equal(m.sandbox.files["wsl-x64"].name, "g1t-sandbox-wsl-x64.tar.gz"); | |
| 58 | writeFileSync(join(dir, "sandbox.json"), JSON.stringify({ runner_image: null, files: { "vm-x64-disk": { name: "gone.raw.gz", sha256: "00" } } })); | |
| 59 | assert.throws(() => manifest(dir, "0.3.0"), /gone\.raw\.gz/); | |
| 60 | } finally { | |
| 61 | rmSync(dir, { recursive: true, force: true }); | |
| 62 | } | |
| 63 | }); | |
| 64 | ||
| 65 | test("the sandbox's files are named as the launcher asks for them", () => { | |
| 66 | // crates/runner/src/selfhosted/launcher: wsl.rs's and vm.rs's image_keys(). | |
| 67 | assert.deepEqual(Object.keys(sandboxFiles("arm64")), ["wsl-arm64", "vm-arm64-kernel", "vm-arm64-initrd", "vm-arm64-disk"]); | |
| 68 | }); |
