Skip to content
Sign in

flagon-io/g1t

public
0
1,310 linesCodeBlameRaw
1//! Keeping runs safe: a repository's choices for its workflows (what a
2//! job's token may do when its workflow says nothing, and which pull
3//! requests' runs wait for approval), environments' protection rules, the
4//! reviews of the jobs they hold, and approving a pull request's run.
5//!
6//! - A job that names an environment with rules is `pending` once its needs
7//! are done: until a reviewer approves it (when the environment has
8//! reviewers), its wait timer has run out (when it has one), and only on
9//! a ref the environment lets deploy. Its secrets are read when it
10//! starts, so the environment's are never handed out before then. One
11//! review approves every job of the run attempt that names the
12//! environment.
13//! - A run of a pull request from outside the workspace may wait as
14//! `action_required` until someone with the Write role approves it, by
15//! the repository's approval policy.
16
17use g1t_actions::filter::Pattern;
18use g1t_actions::permissions::TokenDefault;
19use g1t_contracts::access::{self, AccessSource, Capability, CollaboratorPermissionArgs, PermissionInfo};
20use g1t_contracts::actions::{
21 APPROVAL_POLICIES, ActionsSettings, ActionsSettingsArgs, SetWorkspaceActionsSettingsArgs, WorkspaceActionsSettings,
22 WorkspaceActionsSettingsArgs, BranchPattern, DeleteEnvironmentArgs, Environment, EnvironmentReviewer,
23 EnvironmentsArgs, MAX_ENVIRONMENT_REVIEWERS, MAX_WAIT_MINUTES, PendingDeployment, PendingDeploymentsArgs, ReviewDeploymentsArgs,
24 RunActionArgs, RunApproval, SetActionsSettingsArgs, SetEnvironmentArgs, WorkflowRun,
25};
26use g1t_contracts::identity::AGENT_ID;
27use g1t_contracts::repos::{Repo, RepoPath};
28use g1t_contracts::time::rfc3339;
29use g1t_contracts::{FailureCode, Outcome, PrincipalKind, User, Viewer};
30use g1t_kit::now_ms;
31use serde::Deserialize;
32use serde_json::{Value, json};
33use worker::Result;
34
35use crate::plan::{JobRow, RunRow};
36use crate::{Actions, check, fail, optional};
37
38/// What the approval policy is when a repository chose none.
39pub const DEFAULT_APPROVAL_POLICY: &str = "outside_contributors";
40
41fn now() -> String {
42 rfc3339(now_ms())
43}
44
45/// A repository's own choices (migrations 0006 and 0007); null is unchosen.
46#[derive(Default, Deserialize)]
47struct SettingsRow {
48 default_permissions: Option<String>,
49 approval_policy: Option<String>,
50 can_approve_pulls: Option<u32>,
51 /// Migration 0008: who may use its actions and reusable workflows.
52 #[serde(default)]
53 access_level: Option<String>,
54}
55
56#[derive(Deserialize)]
57struct WorkspaceRow {
58 default_permissions: String,
59 max_permissions: String,
60 can_approve_pulls: u32,
61}
62
63/// What a workflow without `permissions:` gets: the repository's choice,
64/// else `write` for a repository made before restricted tokens
65/// (`grandfathered`), else its workspace's default; never more than the
66/// workspace's maximum.
67pub(crate) fn effective_default(chosen: Option<TokenDefault>, grandfathered: bool, workspace_default: TokenDefault, maximum: TokenDefault) -> TokenDefault {
68 let wanted = chosen.unwrap_or(if grandfathered { TokenDefault::Permissive } else { workspace_default });
69 if maximum == TokenDefault::Restricted { TokenDefault::Restricted } else { wanted }
70}
71
72/// The workspace's policy, or its defaults.
73fn workspace_policy(row: Option<WorkspaceRow>) -> WorkspaceActionsSettings {
74 match row {
75 Some(row) => WorkspaceActionsSettings {
76 default_permissions: row.default_permissions,
77 max_permissions: row.max_permissions,
78 can_approve_pull_requests: row.can_approve_pulls != 0,
79 },
80 None => WorkspaceActionsSettings {
81 default_permissions: TokenDefault::Restricted.as_str().to_owned(),
82 max_permissions: TokenDefault::Permissive.as_str().to_owned(),
83 can_approve_pull_requests: false,
84 },
85 }
86}
87
88#[derive(Clone, Deserialize)]
89struct EnvRow {
90 name: String,
91 reviewers: String,
92 prevent_self_review: u32,
93 wait_minutes: u32,
94 branch_policy: String,
95 branch_patterns: String,
96 admins_bypass: u32,
97 updated_at: String,
98 updated_by: Option<String>,
99}
100
101impl EnvRow {
102 fn view(&self) -> Environment {
103 Environment {
104 name: self.name.clone(),
105 reviewers: serde_json::from_str(&self.reviewers).unwrap_or_default(),
106 prevent_self_review: self.prevent_self_review != 0,
107 wait_minutes: self.wait_minutes,
108 branch_policy: self.branch_policy.clone(),
109 branch_patterns: serde_json::from_str(&self.branch_patterns).unwrap_or_default(),
110 admins_bypass: self.admins_bypass != 0,
111 protected: true,
112 updated_at: Some(self.updated_at.clone()),
113 updated_by: self.updated_by.clone(),
114 }
115 }
116}
117
118/// An environment no rules hold.
119fn unprotected(name: &str) -> Environment {
120 Environment {
121 name: name.to_owned(),
122 reviewers: Vec::new(),
123 prevent_self_review: false,
124 wait_minutes: 0,
125 branch_policy: "all".to_owned(),
126 branch_patterns: Vec::new(),
127 admins_bypass: true,
128 protected: false,
129 updated_at: None,
130 updated_by: None,
131 }
132}
133
134#[derive(Clone, Deserialize)]
135struct GateRow {
136 environment: String,
137 state: String,
138 needs_review: u32,
139 wait_until: Option<String>,
140 reviewed_by: Option<String>,
141 comment: Option<String>,
142 reviewed_at: Option<String>,
143}
144
145/// An environment's name as rules and secrets keep it: lowercase, up to 40
146/// letters, digits, `-` and `_`.
147pub(crate) fn environment_name(name: &str) -> std::result::Result<String, String> {
148 let lower = name.trim().to_ascii_lowercase();
149 if lower.is_empty() || lower.len() > 40 || !lower.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') {
150 return Err(format!("`{}` is not an environment's name: up to 40 letters, digits, - and _.", name.trim()));
151 }
152 Ok(lower)
153}
154
155/// Whether `git_ref` may deploy to an environment by its `policy`.
156/// `protected` says whether the branch is protected, for `protected`.
157pub(crate) fn branch_allowed(policy: &str, patterns: &[BranchPattern], git_ref: &str, protected: bool, environment: &str) -> std::result::Result<(), String> {
158 let (kind, name) = match (git_ref.strip_prefix("refs/heads/"), git_ref.strip_prefix("refs/tags/")) {
159 (Some(branch), _) => ("branch", branch),
160 (_, Some(tag)) => ("tag", tag),
161 _ => ("ref", git_ref),
162 };
163 match policy {
164 "protected" if kind == "branch" && protected => Ok(()),
165 "protected" => Err(format!("{environment} takes deployments from protected branches only, and `{name}` is not one.")),
166 "selected" => {
167 let allowed = patterns
168 .iter()
169 .filter(|pattern| pattern.kind == kind)
170 .any(|pattern| Pattern::parse(&pattern.name).matches(name));
171 if allowed {
172 Ok(())
173 } else {
174 Err(format!("The {kind} `{name}` may not deploy to {environment}: its deployment rules list the branches and tags that may."))
175 }
176 }
177 _ => Ok(()),
178 }
179}
180
181/// How someone may decide on an environment's jobs.
182#[derive(Clone, Copy, Debug, PartialEq, Eq)]
183pub(crate) enum Reviewer {
184 /// One of its reviewers.
185 Listed,
186 /// An admin, past its rules, which also skips its wait timer.
187 AdminBypass,
188}
189
190/// Whether `username` (in `teams`, an admin or not) may approve or reject
191/// the environment's jobs in a run `started_by` began.
192pub(crate) fn may_review(
193 environment: &Environment,
194 username: &str,
195 teams: &[String],
196 admin: bool,
197 started_by: Option<&str>,
198) -> std::result::Result<Reviewer, String> {
199 let listed = environment.reviewers.iter().any(|reviewer| match reviewer.kind.as_str() {
200 "team" => teams.iter().any(|team| team.eq_ignore_ascii_case(&reviewer.name)),
201 _ => reviewer.name.eq_ignore_ascii_case(username),
202 });
203 let started = started_by.is_some_and(|by| by.eq_ignore_ascii_case(username));
204 if listed && !(environment.prevent_self_review && started) {
205 return Ok(Reviewer::Listed);
206 }
207 if admin && environment.admins_bypass {
208 return Ok(Reviewer::AdminBypass);
209 }
210 Err(if listed {
211 format!("You started this run, and {} does not let whoever started a run approve its deployments.", environment.name)
212 } else if environment.reviewers.is_empty() {
213 format!("{} has no reviewers: its jobs wait for its timer. Only an admin can start them sooner.", environment.name)
214 } else {
215 format!("You are not one of {}'s reviewers.", environment.name)
216 })
217}
218
219/// Whether a gate lets its jobs start at `now`.
220pub(crate) fn gate_open(state: &str, needs_review: bool, wait_until: Option<&str>, now: &str) -> bool {
221 state != "rejected" && (!needs_review || state == "approved") && wait_until.is_none_or(|until| until <= now)
222}
223
224/// Why a pull request's run waits for approval, if it does, by `policy`:
225/// `member` of the workspace, whether they `can_push`, and whether this is
226/// their `first_time` (no pull request of theirs merged here).
227pub(crate) fn approval_reason(policy: &str, member: bool, can_push: bool, first_time: bool) -> Option<&'static str> {
228 if member {
229 return None;
230 }
231 match policy {
232 "all_external_contributors" => Some("is not a member of the workspace"),
233 "first_time_contributors" => first_time.then_some("has not had a pull request merged here yet"),
234 _ if !can_push => Some("cannot push to the repository"),
235 _ => first_time.then_some("has not had a pull request merged here yet"),
236 }
237}
238
239/// What a job waits for at its environment, in words.
240fn held_reason(environment: &str, needs_review: bool, wait_until: Option<&str>) -> String {
241 match (needs_review, wait_until) {
242 (true, Some(until)) => format!("Waiting for a review to deploy to {environment}, and for its wait timer, until {until}."),
243 (true, None) => format!("Waiting for a review to deploy to {environment}."),
244 (false, Some(until)) => format!("Waiting for {environment}'s wait timer, until {until}."),
245 (false, None) => format!("Waiting to deploy to {environment}."),
246 }
247}
248
249/// What an environment's rules say about a job that names it.
250pub(crate) enum Gate {
251 /// No rules hold it: it starts.
252 Open,
253 /// It waits, for this.
254 Held(String),
255 /// It may not deploy there.
256 Refused(String),
257}
258
259impl Actions {
260 // --- The repository's and workspace's choices -------------------------------
261
262 async fn repo_choices(&self, repo_id: &str) -> Result<SettingsRow> {
263 Ok(self
264 .db
265 .prepare("SELECT default_permissions, approval_policy, can_approve_pulls, access_level FROM repo_settings WHERE repo_id = ?")
266 .bind(&[repo_id.into()])?
267 .first::<SettingsRow>(None)
268 .await?
269 .unwrap_or_default())
270 }
271
272 /// A workspace's policy for its repositories' tokens, or the defaults.
273 pub(crate) async fn workspace_settings(&self, workspace: &str) -> Result<WorkspaceActionsSettings> {
274 let row = self
275 .db
276 .prepare("SELECT default_permissions, max_permissions, can_approve_pulls FROM workspace_actions_settings WHERE namespace = ?")
277 .bind(&[workspace.to_lowercase().into()])?
278 .first::<WorkspaceRow>(None)
279 .await?;
280 Ok(workspace_policy(row))
281 }
282
283 /// Whether `repo` was made before restricted tokens began, and so keeps
284 /// read and write until someone chooses otherwise.
285 async fn grandfathered(&self, repo: &Repo) -> Result<bool> {
286 #[derive(Deserialize)]
287 struct Since {
288 value: String,
289 }
290 let since = self
291 .db
292 .prepare("SELECT value FROM actions_meta WHERE key = 'restricted_since'")
293 .first::<Since>(None)
294 .await?;
295 Ok(since.is_some_and(|since| !repo.created_at.is_empty() && repo.created_at.as_str() < since.value.as_str()))
296 }
297
298 /// A repository's settings as they hold, its workspace's taken in.
299 pub(crate) async fn repo_settings(&self, repo: &Repo) -> Result<ActionsSettings> {
300 let row = self.repo_choices(&repo.id).await?;
301 let workspace = self.workspace_settings(&repo.namespace).await?;
302 let chosen = row.default_permissions.as_deref().and_then(TokenDefault::parse);
303 let default = effective_default(
304 chosen,
305 self.grandfathered(repo).await?,
306 TokenDefault::parse(&workspace.default_permissions).unwrap_or_default(),
307 TokenDefault::parse(&workspace.max_permissions).unwrap_or(TokenDefault::Permissive),
308 );
309 Ok(ActionsSettings {
310 default_permissions: default.as_str().to_owned(),
311 default_chosen: chosen.is_some(),
312 max_permissions: workspace.max_permissions.clone(),
313 approval_policy: row.approval_policy.unwrap_or_else(|| DEFAULT_APPROVAL_POLICY.to_owned()),
314 can_approve_pull_requests: workspace.can_approve_pull_requests && row.can_approve_pulls == Some(1),
315 workspace_allows_pull_requests: workspace.can_approve_pull_requests,
316 access_level: row.access_level.as_deref().and_then(g1t_contracts::actions::access_level).unwrap_or("none").to_owned(),
317 })
318 }
319
320 /// What a workflow without `permissions:` gets in the repository, and
321 /// whether its jobs may open and approve pull requests.
322 pub(crate) async fn token_policy(&self, repo_id: &str) -> Result<(TokenDefault, bool)> {
323 let Some((repo, _)) = self.repo_by_id(repo_id).await? else {
324 return Ok((TokenDefault::Restricted, false));
325 };
326 let settings = self.repo_settings(&repo).await?;
327 Ok((TokenDefault::parse(&settings.default_permissions).unwrap_or_default(), settings.can_approve_pull_requests))
328 }
329
330 /// The approval policy of a repository.
331 pub(crate) async fn approval_policy(&self, repo_id: &str) -> Result<String> {
332 Ok(self.repo_choices(repo_id).await?.approval_policy.unwrap_or_else(|| DEFAULT_APPROVAL_POLICY.to_owned()))
333 }
334
335 /// Who may use a repository's actions and reusable workflows when it is
336 /// private: `none` or `organization`.
337 pub(crate) async fn access_level_of(&self, repo_id: &str) -> Result<&'static str> {
338 Ok(self.repo_choices(repo_id).await?.access_level.as_deref().and_then(g1t_contracts::actions::access_level).unwrap_or("none"))
339 }
340
341 pub async fn actions_settings(&self, a: ActionsSettingsArgs) -> Result<Outcome<ActionsSettings>> {
342 let Some(repo) = self.visible_repo(&a.repo, &a.viewer).await? else {
343 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
344 };
345 Ok(Outcome::Ok(self.repo_settings(&repo).await?))
346 }
347
348 pub async fn set_actions_settings(&self, a: SetActionsSettingsArgs) -> Result<Outcome<ActionsSettings>> {
349 if let Some(refused) = refuse_job_token(&a.actor) {
350 return Ok(refused);
351 }
352 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
353 let mut row = self.repo_choices(&repo.id).await?;
354 let workspace = self.workspace_settings(&repo.namespace).await?;
355 if let Some(default) = a.default_permissions.as_deref().map(str::trim) {
356 row.default_permissions = match default {
357 "inherit" | "" => None,
358 other => match TokenDefault::parse(other) {
359 Some(TokenDefault::Permissive) if workspace.max_permissions == "read" => {
360 return Ok(fail(
361 FailureCode::Forbidden,
362 format!("{} holds its repositories' tokens to read-only: an owner can change that in the workspace's Actions settings.", repo.namespace),
363 ));
364 }
365 Some(parsed) => Some(parsed.as_str().to_owned()),
366 None => return Ok(fail(FailureCode::Invalid, "default_permissions is read, write or inherit.")),
367 },
368 };
369 }
370 if let Some(policy) = &a.approval_policy {
371 let policy = policy.trim();
372 if !APPROVAL_POLICIES.contains(&policy) {
373 return Ok(fail(FailureCode::Invalid, format!("approval_policy is one of {}.", APPROVAL_POLICIES.join(", "))));
374 }
375 row.approval_policy = Some(policy.to_owned());
376 }
377 if let Some(allow) = a.can_approve_pull_requests {
378 if allow && !workspace.can_approve_pull_requests {
379 return Ok(fail(
380 FailureCode::Forbidden,
381 format!("{} does not let its repositories' jobs open or approve pull requests: an owner can allow it in the workspace's Actions settings.", repo.namespace),
382 ));
383 }
384 row.can_approve_pulls = Some(u32::from(allow));
385 }
386 if let Some(level) = &a.access_level {
387 match g1t_contracts::actions::access_level(level) {
388 Some(level) => row.access_level = Some(level.to_owned()),
389 None => return Ok(fail(FailureCode::Invalid, "access_level is none or organization.")),
390 }
391 }
392 // 0006's artifact retention is kept, or its default for a new row.
393 self.db
394 .prepare(
395 "INSERT INTO repo_settings (repo_id, artifact_retention_days, default_permissions, approval_policy, can_approve_pulls, access_level, updated_at, updated_by)
396 VALUES (?1, ?7, ?2, ?3, ?4, ?8, ?5, ?6)
397 ON CONFLICT (repo_id) DO UPDATE SET default_permissions = ?2, approval_policy = ?3, can_approve_pulls = ?4,
398 access_level = ?8, updated_at = ?5, updated_by = ?6",
399 )
400 .bind(&[
401 repo.id.as_str().into(),
402 optional(row.default_permissions.as_deref()),
403 optional(row.approval_policy.as_deref()),
404 row.can_approve_pulls.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
405 now().into(),
406 a.actor.username.as_str().into(),
407 g1t_contracts::actions::ARTIFACT_RETENTION_DEFAULT_DAYS.into(),
408 optional(row.access_level.as_deref()),
409 ])?
410 .run()
411 .await?;
412 Ok(Outcome::Ok(self.repo_settings(&repo).await?))
413 }
414
415 pub async fn workspace_actions_settings(&self, a: WorkspaceActionsSettingsArgs) -> Result<Outcome<WorkspaceActionsSettings>> {
416 let workspace = a.workspace.trim().to_lowercase();
417 if !a.viewer.as_ref().is_some_and(|viewer| viewer.is_member(&workspace)) {
418 return Ok(fail(FailureCode::NotFound, "There is no such workspace."));
419 }
420 Ok(Outcome::Ok(self.workspace_settings(&workspace).await?))
421 }
422
423 pub async fn set_workspace_actions_settings(&self, a: SetWorkspaceActionsSettingsArgs) -> Result<Outcome<WorkspaceActionsSettings>> {
424 if let Some(refused) = refuse_job_token(&a.actor) {
425 return Ok(refused);
426 }
427 let workspace = a.workspace.trim().to_lowercase();
428 if a.actor.kind != PrincipalKind::User || a.actor.role_in(&workspace) != Some(g1t_contracts::Role::Owner) {
429 return Ok(fail(FailureCode::Forbidden, format!("Only an owner of {workspace} can change its Actions settings.")));
430 }
431 let mut settings = self.workspace_settings(&workspace).await?;
432 let level = |text: &str, field: &str| -> std::result::Result<String, String> {
433 TokenDefault::parse(text.trim()).map(|parsed| parsed.as_str().to_owned()).ok_or_else(|| format!("{field} is read or write."))
434 };
435 if let Some(text) = &a.default_permissions {
436 match level(text, "default_permissions") {
437 Ok(parsed) => settings.default_permissions = parsed,
438 Err(problem) => return Ok(fail(FailureCode::Invalid, problem)),
439 }
440 }
441 if let Some(text) = &a.max_permissions {
442 match level(text, "max_permissions") {
443 Ok(parsed) => settings.max_permissions = parsed,
444 Err(problem) => return Ok(fail(FailureCode::Invalid, problem)),
445 }
446 }
447 if settings.max_permissions == "read" {
448 settings.default_permissions = "read".to_owned();
449 }
450 if let Some(allow) = a.can_approve_pull_requests {
451 settings.can_approve_pull_requests = allow;
452 }
453 self.db
454 .prepare(
455 "INSERT INTO workspace_actions_settings (namespace, default_permissions, max_permissions, can_approve_pulls, updated_at, updated_by)
456 VALUES (?1, ?2, ?3, ?4, ?5, ?6)
457 ON CONFLICT (namespace) DO UPDATE SET default_permissions = ?2, max_permissions = ?3, can_approve_pulls = ?4,
458 updated_at = ?5, updated_by = ?6",
459 )
460 .bind(&[
461 workspace.as_str().into(),
462 settings.default_permissions.as_str().into(),
463 settings.max_permissions.as_str().into(),
464 u32::from(settings.can_approve_pull_requests).into(),
465 now().into(),
466 a.actor.username.as_str().into(),
467 ])?
468 .run()
469 .await?;
470 Ok(Outcome::Ok(settings))
471 }
472
473 // --- Environments -------------------------------------------------------------
474
475 async fn environment_row(&self, repo_id: &str, name: &str) -> Result<Option<EnvRow>> {
476 self.db
477 .prepare("SELECT * FROM environments WHERE repo_id = ? AND name = ?")
478 .bind(&[repo_id.into(), name.to_ascii_lowercase().into()])?
479 .first::<EnvRow>(None)
480 .await
481 }
482
483 /// An environment and its rules; one without rules if it has none.
484 pub(crate) async fn environment_rules(&self, repo_id: &str, name: &str) -> Result<Environment> {
485 Ok(match self.environment_row(repo_id, name).await? {
486 Some(row) => row.view(),
487 None => unprotected(&name.to_ascii_lowercase()),
488 })
489 }
490
491 /// `environments`: every environment the repository's rules, secrets,
492 /// workflows or jobs name; or with `name`, the one.
493 pub async fn environments(&self, a: EnvironmentsArgs) -> Result<Outcome<Vec<Environment>>> {
494 let Some(repo) = self.visible_repo(&a.repo, &a.viewer).await? else {
495 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
496 };
497 if let Some(name) = &a.name {
498 let name = check!(environment_name(name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
499 return Ok(Outcome::Ok(vec![self.environment_rules(&repo.id, &name).await?]));
500 }
501 let rows = self
502 .db
503 .prepare("SELECT * FROM environments WHERE repo_id = ? ORDER BY name")
504 .bind(&[repo.id.as_str().into()])?
505 .all()
506 .await?
507 .results::<EnvRow>()?;
508 let mut out: Vec<Environment> = rows.iter().map(EnvRow::view).collect();
509 let mut named: Vec<String> = self.secret_environments(&repo.id).await?;
510 #[derive(Deserialize)]
511 struct Named {
512 environment: String,
513 }
514 let used = self
515 .db
516 .prepare("SELECT DISTINCT environment FROM jobs WHERE repo_id = ? AND environment IS NOT NULL LIMIT 100")
517 .bind(&[repo.id.as_str().into()])?
518 .all()
519 .await?
520 .results::<Named>()?;
521 named.extend(used.into_iter().map(|n| n.environment));
522 #[derive(Deserialize)]
523 struct Source {
524 source: String,
525 }
526 let sources = self
527 .db
528 .prepare("SELECT source FROM workflows WHERE repo_id = ? AND error IS NULL")
529 .bind(&[repo.id.as_str().into()])?
530 .all()
531 .await?
532 .results::<Source>()?;
533 for source in sources {
534 let Ok(workflow) = g1t_actions::workflow::parse(&source.source) else { continue };
535 for job in &workflow.jobs {
536 let written = match job.raw.get("environment") {
537 Some(Value::String(name)) => Some(name.clone()),
538 Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).map(str::to_owned),
539 _ => None,
540 };
541 if let Some(name) = written.filter(|name| !name.contains("${{")) {
542 named.push(name);
543 }
544 }
545 }
546 for name in named {
547 if let Ok(name) = environment_name(&name)
548 && !out.iter().any(|env| env.name == name)
549 {
550 out.push(unprotected(&name));
551 }
552 }
553 out.sort_by(|a, b| b.protected.cmp(&a.protected).then(a.name.cmp(&b.name)));
554 Ok(Outcome::Ok(out))
555 }
556
557 pub async fn set_environment(&self, a: SetEnvironmentArgs) -> Result<Outcome<Environment>> {
558 if let Some(refused) = refuse_job_token(&a.actor) {
559 return Ok(refused);
560 }
561 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
562 let name = check!(environment_name(&a.name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
563 let mut env = self.environment_rules(&repo.id, &name).await?;
564 if let Some(reviewers) = a.reviewers {
565 let reviewers = check!(self.valid_reviewers(&repo, reviewers).await?);
566 env.reviewers = reviewers;
567 }
568 if let Some(flag) = a.prevent_self_review {
569 env.prevent_self_review = flag;
570 }
571 if let Some(minutes) = a.wait_minutes {
572 if minutes > MAX_WAIT_MINUTES {
573 return Ok(fail(FailureCode::Invalid, format!("A wait timer is at most {MAX_WAIT_MINUTES} minutes (30 days).")));
574 }
575 env.wait_minutes = minutes;
576 }
577 if let Some(policy) = a.branch_policy {
578 let policy = policy.trim().to_owned();
579 if !["all", "protected", "selected"].contains(&policy.as_str()) {
580 return Ok(fail(FailureCode::Invalid, "branch_policy is all, protected or selected."));
581 }
582 env.branch_policy = policy;
583 }
584 if let Some(patterns) = a.branch_patterns {
585 let mut clean: Vec<BranchPattern> = Vec::new();
586 for pattern in patterns {
587 let name = pattern.name.trim().to_owned();
588 let kind = pattern.kind.trim().to_ascii_lowercase();
589 if name.is_empty() || name.len() > 255 {
590 return Ok(fail(FailureCode::Invalid, "A branch or tag pattern is 1 to 255 characters."));
591 }
592 if kind != "branch" && kind != "tag" {
593 return Ok(fail(FailureCode::Invalid, format!("`{name}`: a pattern's type is branch or tag.")));
594 }
595 if !clean.iter().any(|known| known.name == name && known.kind == kind) {
596 clean.push(BranchPattern { name, kind });
597 }
598 }
599 if clean.len() > 50 {
600 return Ok(fail(FailureCode::Invalid, "An environment lists at most 50 branch and tag patterns."));
601 }
602 env.branch_patterns = clean;
603 }
604 if let Some(flag) = a.admins_bypass {
605 env.admins_bypass = flag;
606 }
607 let at = now();
608 self.db
609 .prepare(
610 "INSERT INTO environments (repo_id, name, reviewers, prevent_self_review, wait_minutes, branch_policy, branch_patterns,
611 admins_bypass, created_at, updated_at, updated_by)
612 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?9, ?10)
613 ON CONFLICT (repo_id, name) DO UPDATE SET reviewers = ?3, prevent_self_review = ?4, wait_minutes = ?5,
614 branch_policy = ?6, branch_patterns = ?7, admins_bypass = ?8, updated_at = ?9, updated_by = ?10",
615 )
616 .bind(&[
617 repo.id.as_str().into(),
618 name.as_str().into(),
619 serde_json::to_string(&env.reviewers)?.into(),
620 u32::from(env.prevent_self_review).into(),
621 env.wait_minutes.into(),
622 env.branch_policy.as_str().into(),
623 serde_json::to_string(&env.branch_patterns)?.into(),
624 u32::from(env.admins_bypass).into(),
625 at.as_str().into(),
626 a.actor.username.as_str().into(),
627 ])?
628 .run()
629 .await?;
630 Ok(Outcome::Ok(self.environment_rules(&repo.id, &name).await?))
631 }
632
633 pub async fn delete_environment(&self, a: DeleteEnvironmentArgs) -> Result<Outcome<bool>> {
634 if let Some(refused) = refuse_job_token(&a.actor) {
635 return Ok(refused);
636 }
637 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
638 let name = check!(environment_name(&a.name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
639 let removed = self
640 .db
641 .prepare("DELETE FROM environments WHERE repo_id = ? AND name = ? RETURNING name")
642 .bind(&[repo.id.as_str().into(), name.as_str().into()])?
643 .first::<Value>(None)
644 .await?;
645 if removed.is_none() {
646 return Ok(fail(FailureCode::NotFound, format!("{name} has no protection rules.")));
647 }
648 Ok(Outcome::Ok(true))
649 }
650
651 /// Reviewers as given, checked: at most six, each a person with access
652 /// to the repository or a team of its workspace.
653 async fn valid_reviewers(&self, repo: &Repo, given: Vec<EnvironmentReviewer>) -> Result<Outcome<Vec<EnvironmentReviewer>>> {
654 if given.len() > MAX_ENVIRONMENT_REVIEWERS {
655 return Ok(fail(FailureCode::Invalid, format!("An environment has at most {MAX_ENVIRONMENT_REVIEWERS} reviewers.")));
656 }
657 let Some(ws) = self.workspace_actor(&repo.namespace).await? else {
658 return Ok(fail(FailureCode::NotFound, "There is no such workspace."));
659 };
660 let mut out: Vec<EnvironmentReviewer> = Vec::new();
661 for reviewer in given {
662 let kind = reviewer.kind.trim().to_ascii_lowercase();
663 let name = reviewer.name.trim().trim_start_matches('@').to_ascii_lowercase();
664 match kind.as_str() {
665 "user" => {
666 let permission: Outcome<PermissionInfo> = g1t_kit::call(
667 &self.identity,
668 "collaborator_permission",
669 &CollaboratorPermissionArgs {
670 viewer: Some(ws.clone()),
671 path: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
672 username: name.clone(),
673 },
674 )
675 .await?;
676 if !permission.into_result().ok().is_some_and(|info| info.role.is_some()) {
677 return Ok(fail(FailureCode::Invalid, format!("{name} has no access to {}/{}, so cannot review.", repo.namespace, repo.name)));
678 }
679 }
680 "team" => {
681 let slug = name.rsplit('/').next().unwrap_or(&name).to_owned();
682 if self.team_people(&repo.namespace, &slug).await?.is_none() {
683 return Ok(fail(FailureCode::Invalid, format!("{} has no team called {slug}.", repo.namespace)));
684 }
685 if !out.iter().any(|known| known.kind == "team" && known.name == slug) {
686 out.push(EnvironmentReviewer { kind, name: slug });
687 }
688 continue;
689 }
690 _ => return Ok(fail(FailureCode::Invalid, "A reviewer's type is user or team.")),
691 }
692 if !out.iter().any(|known| known.kind == kind && known.name == name) {
693 out.push(EnvironmentReviewer { kind, name });
694 }
695 }
696 Ok(Outcome::Ok(out))
697 }
698
699 /// Everyone in a team of `workspace` and its child teams, by username;
700 /// `None` when there is no such team.
701 async fn team_people(&self, workspace: &str, slug: &str) -> Result<Option<Vec<String>>> {
702 let resolved: Vec<Value> = g1t_kit::call(
703 &self.identity,
704 "resolve_teams",
705 &json!({ "teams": [format!("{workspace}/{slug}")] }),
706 )
707 .await
708 .unwrap_or_default();
709 Ok(resolved.into_iter().next().map(|team| {
710 ["members", "child_members"]
711 .iter()
712 .flat_map(|key| team[*key].as_array().cloned().unwrap_or_default())
713 .filter_map(|person| person["username"].as_str().map(str::to_lowercase))
714 .collect()
715 }))
716 }
717
718 /// The teams of the environment's reviewers that `username` is in.
719 async fn reviewer_teams(&self, workspace: &str, environment: &Environment, username: &str) -> Result<Vec<String>> {
720 let mut teams = Vec::new();
721 for reviewer in environment.reviewers.iter().filter(|r| r.kind == "team") {
722 if self
723 .team_people(workspace, &reviewer.name)
724 .await?
725 .is_some_and(|people| people.iter().any(|person| person.eq_ignore_ascii_case(username)))
726 {
727 teams.push(reviewer.name.clone());
728 }
729 }
730 Ok(teams)
731 }
732
733 // --- Gates ---------------------------------------------------------------------
734
735 /// What `environment`'s rules say about a job of `run` that names it,
736 /// recording the run's gate there the first time one of its jobs
737 /// reaches it.
738 pub(crate) async fn gate(&self, run: &RunRow, environment: &str) -> Result<Gate> {
739 let Ok(name) = environment_name(environment) else {
740 return Ok(Gate::Open);
741 };
742 let Some(row) = self.environment_row(&run.repo_id, &name).await? else {
743 return Ok(Gate::Open);
744 };
745 let env = row.view();
746 // Which refs may deploy, before anything waits.
747 let protected = if env.branch_policy == "protected" { self.branch_protected(run).await? } else { false };
748 if let Err(problem) = branch_allowed(&env.branch_policy, &env.branch_patterns, &run.git_ref, protected, &name) {
749 return Ok(Gate::Refused(problem));
750 }
751 let needs_review = !env.reviewers.is_empty();
752 if !needs_review && env.wait_minutes == 0 {
753 return Ok(Gate::Open);
754 }
755 let existing = self.gate_row(&run.id, run.attempt as u32, &name).await?;
756 let gate = match existing {
757 Some(gate) => gate,
758 None => {
759 let wait_until = (env.wait_minutes > 0).then(|| rfc3339(now_ms() + u64::from(env.wait_minutes) * 60_000));
760 self.db
761 .prepare(
762 "INSERT OR IGNORE INTO environment_gates (run_id, attempt, environment, repo_id, state, needs_review, wait_until, created_at)
763 VALUES (?, ?, ?, ?, 'waiting', ?, ?, ?)",
764 )
765 .bind(&[
766 run.id.as_str().into(),
767 (run.attempt as u32).into(),
768 name.as_str().into(),
769 run.repo_id.as_str().into(),
770 u32::from(needs_review).into(),
771 optional(wait_until.as_deref()),
772 now().into(),
773 ])?
774 .run()
775 .await?;
776 if needs_review {
777 self.ask_reviewers(run, &env).await;
778 }
779 match self.gate_row(&run.id, run.attempt as u32, &name).await? {
780 Some(gate) => gate,
781 None => return Ok(Gate::Held(held_reason(&name, needs_review, wait_until.as_deref()))),
782 }
783 }
784 };
785 if gate.state == "rejected" {
786 let by = gate.reviewed_by.as_deref().unwrap_or("A reviewer");
787 return Ok(Gate::Refused(format!("{by} rejected the deployment to {name}.")));
788 }
789 if gate_open(&gate.state, gate.needs_review != 0, gate.wait_until.as_deref(), &now()) {
790 return Ok(Gate::Open);
791 }
792 let review_left = gate.needs_review != 0 && gate.state != "approved";
793 Ok(Gate::Held(held_reason(&name, review_left, gate.wait_until.as_deref())))
794 }
795
796 async fn gate_row(&self, run_id: &str, attempt: u32, environment: &str) -> Result<Option<GateRow>> {
797 self.db
798 .prepare("SELECT * FROM environment_gates WHERE run_id = ? AND attempt = ? AND environment = ?")
799 .bind(&[run_id.into(), attempt.into(), environment.into()])?
800 .first::<GateRow>(None)
801 .await
802 }
803
804 /// Whether the run's branch is protected: the default branch, or one an
805 /// active rule holds.
806 async fn branch_protected(&self, run: &RunRow) -> Result<bool> {
807 let Some(branch) = run.git_ref.strip_prefix("refs/heads/") else { return Ok(false) };
808 let path = crate::repo_path(&run.repo);
809 let Some(ws) = self.workspace_actor(&path.namespace).await? else { return Ok(false) };
810 let rules: Outcome<Value> = g1t_kit::call(
811 &self.work,
812 "effective_rules",
813 &json!({ "viewer": ws, "repo": path, "name": branch, "target": "branch" }),
814 )
815 .await
816 .unwrap_or_else(|_| Outcome::Ok(Value::Null));
817 Ok(match rules {
818 Outcome::Ok(rules) => {
819 rules["default_branch"].as_bool() == Some(true)
820 || rules["rules"].as_array().is_some_and(|rules| rules.iter().any(|rule| rule["enforcement"] == "active"))
821 }
822 Outcome::Fail(_) => false,
823 })
824 }
825
826 /// Tells an environment's reviewers that a run waits for them.
827 async fn ask_reviewers(&self, run: &RunRow, env: &Environment) {
828 let path = crate::repo_path(&run.repo);
829 let mut people: Vec<String> = Vec::new();
830 for reviewer in &env.reviewers {
831 let names = match reviewer.kind.as_str() {
832 "team" => self.team_people(&path.namespace, &reviewer.name).await.ok().flatten().unwrap_or_default(),
833 _ => vec![reviewer.name.clone()],
834 };
835 for name in names {
836 // Never whoever cannot approve their own run.
837 let own = env.prevent_self_review && run.actor.as_deref().is_some_and(|by| by.eq_ignore_ascii_case(&name));
838 if !own && !people.contains(&name) {
839 people.push(name);
840 }
841 }
842 }
843 if people.is_empty() {
844 return;
845 }
846 let published: Result<()> = g1t_kit::call(
847 &self.events,
848 "publish",
849 &g1t_contracts::events::Publish {
850 events: vec![g1t_contracts::events::NewEvent {
851 kind: "deployment.review_requested",
852 source: "actions",
853 repo_id: Some(run.repo_id.clone()),
854 actor: run.actor_id.clone(),
855 data: json!({
856 "repoId": run.repo_id,
857 "runId": run.id,
858 "attempt": run.attempt,
859 "environment": env.name,
860 "workflow": run.name,
861 "title": run.title,
862 "number": run.number,
863 "notify": people,
864 "link": format!("/{}/actions/runs/{}", run.repo, run.id),
865 }),
866 }],
867 },
868 )
869 .await;
870 if let Err(error) = published {
871 worker::console_error!("actions: reviewers of {} not told for run {}: {error}", env.name, run.id);
872 }
873 }
874
875 /// The environments holding a run's jobs this attempt, and whether
876 /// `viewer` may decide on each.
877 pub(crate) async fn pending_for(&self, run: &RunRow, viewer: &Viewer) -> Result<Vec<PendingDeployment>> {
878 let gates = self
879 .db
880 .prepare("SELECT * FROM environment_gates WHERE run_id = ? AND attempt = ? ORDER BY environment")
881 .bind(&[run.id.as_str().into(), (run.attempt as u32).into()])?
882 .all()
883 .await?
884 .results::<GateRow>()?;
885 if gates.is_empty() {
886 return Ok(Vec::new());
887 }
888 let jobs = self.job_rows(&run.id).await?;
889 let repo = self.visible_repo(&crate::repo_path(&run.repo), viewer).await?;
890 let mut out = Vec::new();
891 for gate in gates {
892 let env = self.environment_rules(&run.repo_id, &gate.environment).await?;
893 let held: Vec<&JobRow> = jobs.iter().filter(|job| job.environment.as_deref().is_some_and(|e| e.eq_ignore_ascii_case(&gate.environment))).collect();
894 let waiting = gate.state == "waiting" && held.iter().any(|job| job.status == "pending");
895 let can_review = match (viewer, &repo, waiting) {
896 (Some(user), Some(repo), true) if user.kind == PrincipalKind::User && user.token.as_ref().is_none_or(|t| t.job.is_none()) => {
897 let teams = self.reviewer_teams(&repo.namespace, &env, &user.username).await?;
898 let admin = access::can(Some(user), repo, Capability::Administer);
899 may_review(&env, &user.username, &teams, admin, run.actor.as_deref()).is_ok()
900 }
901 _ => false,
902 };
903 out.push(PendingDeployment {
904 environment: gate.environment.clone(),
905 state: gate.state.clone(),
906 needs_review: gate.needs_review != 0,
907 wait_until: gate.wait_until.clone(),
908 reviewers: env.reviewers.clone(),
909 jobs: held.iter().map(|job| job.name.clone()).collect(),
910 can_review,
911 reviewed_by: gate.reviewed_by.clone(),
912 comment: gate.comment.clone(),
913 reviewed_at: gate.reviewed_at.clone(),
914 });
915 }
916 Ok(out)
917 }
918
919 pub async fn pending_deployments(&self, a: PendingDeploymentsArgs) -> Result<Outcome<Vec<PendingDeployment>>> {
920 if self.visible_repo(&a.repo, &a.viewer).await?.is_none() {
921 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
922 }
923 let run = check!(self.run_in(&a.repo, &a.id).await?);
924 Ok(Outcome::Ok(self.pending_for(&run, &a.viewer).await?))
925 }
926
927 /// `review_deployments`: a reviewer approves or rejects the jobs an
928 /// environment holds in a run.
929 pub async fn review_deployments(&self, a: ReviewDeploymentsArgs) -> Result<Outcome<Vec<PendingDeployment>>> {
930 if let Some(refused) = refuse_job_token(&a.actor) {
931 return Ok(refused);
932 }
933 if a.actor.kind != PrincipalKind::User {
934 return Ok(fail(FailureCode::Forbidden, "Only a person can review a deployment."));
935 }
936 let repo = check!(self.may(&a.actor, &a.repo, Capability::Read).await?);
937 let approve = match a.state.trim() {
938 "approved" | "approve" => true,
939 "rejected" | "reject" => false,
940 _ => return Ok(fail(FailureCode::Invalid, "state is approved or rejected.")),
941 };
942 let run = check!(self.run_in(&a.repo, &a.id).await?);
943 let wanted: Vec<String> = a.environments.iter().filter_map(|name| environment_name(name).ok()).collect();
944 let pending = self.pending_for(&run, &Some(a.actor.clone())).await?;
945 let waiting: Vec<&PendingDeployment> = pending
946 .iter()
947 .filter(|p| p.state == "waiting" && !p.jobs.is_empty())
948 .filter(|p| wanted.is_empty() || wanted.contains(&p.environment))
949 .collect();
950 if waiting.is_empty() {
951 return Ok(fail(FailureCode::Conflict, "No deployment of this run is waiting for review."));
952 }
953 let comment: Option<String> = a.comment.as_deref().map(str::trim).filter(|c| !c.is_empty()).map(|c| c.chars().take(1000).collect());
954 let admin = access::can(Some(&a.actor), &repo, Capability::Administer);
955 let at = now();
956 for pending in &waiting {
957 let env = self.environment_rules(&run.repo_id, &pending.environment).await?;
958 let teams = self.reviewer_teams(&repo.namespace, &env, &a.actor.username).await?;
959 let how = match may_review(&env, &a.actor.username, &teams, admin, run.actor.as_deref()) {
960 Ok(how) => how,
961 Err(problem) => return Ok(fail(FailureCode::Forbidden, problem)),
962 };
963 let state = if approve { "approved" } else { "rejected" };
964 // An admin's approval past the rules skips the wait timer too.
965 let clear_wait = approve && how == Reviewer::AdminBypass;
966 self.db
967 .prepare(
968 "UPDATE environment_gates SET state = ?, reviewed_by = ?, comment = ?, reviewed_at = ?,
969 wait_until = CASE WHEN ? THEN NULL ELSE wait_until END
970 WHERE run_id = ? AND attempt = ? AND environment = ? AND state = 'waiting'",
971 )
972 .bind(&[
973 state.into(),
974 a.actor.username.as_str().into(),
975 optional(comment.as_deref()),
976 at.as_str().into(),
977 u32::from(clear_wait).into(),
978 run.id.as_str().into(),
979 (run.attempt as u32).into(),
980 pending.environment.as_str().into(),
981 ])?
982 .run()
983 .await?;
984 if !approve {
985 let reason = match &comment {
986 Some(comment) => format!("{} rejected the deployment to {}: {comment}", a.actor.username, pending.environment),
987 None => format!("{} rejected the deployment to {}.", a.actor.username, pending.environment),
988 };
989 self.db
990 .prepare(
991 "UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ?
992 WHERE run_id = ? AND status = 'pending' AND lower(environment) = ?",
993 )
994 .bind(&[reason.into(), at.as_str().into(), run.id.as_str().into(), pending.environment.as_str().into()])?
995 .run()
996 .await?;
997 }
998 }
999 self.release_gates_of(&run).await?;
1000 self.advance(&run.id).await?;
1001 let run = self.run_row(&run.id).await?.unwrap_or(run);
1002 Ok(Outcome::Ok(self.pending_for(&run, &Some(a.actor.clone())).await?))
1003 }
1004
1005 /// Queues a run's pending jobs whose environments now let them start.
1006 pub(crate) async fn release_gates_of(&self, run: &RunRow) -> Result<bool> {
1007 let jobs = self.job_rows(&run.id).await?;
1008 let at = now();
1009 let mut released = false;
1010 for job in jobs.iter().filter(|job| job.status == "pending") {
1011 let Some(environment) = job.environment.as_deref() else { continue };
1012 match self.gate(run, environment).await? {
1013 Gate::Open => {
1014 // A self-hosted job waits for a runner again.
1015 let reason = job
1016 .labels
1017 .as_deref()
1018 .and_then(|labels| serde_json::from_str::<Vec<String>>(labels).ok())
1019 .map(|stored| g1t_contracts::runners::waiting_reason(&g1t_contracts::runners::Wanted::from_stored(&stored)));
1020 self.db
1021 .prepare("UPDATE jobs SET status = 'queued', reason = ?, queued_at = ? WHERE id = ? AND status = 'pending'")
1022 .bind(&[optional(reason.as_deref()), at.as_str().into(), job.id.as_str().into()])?
1023 .run()
1024 .await?;
1025 released = true;
1026 }
1027 Gate::Held(reason) => {
1028 if job.reason.as_deref() != Some(reason.as_str()) {
1029 self.db
1030 .prepare("UPDATE jobs SET reason = ? WHERE id = ? AND status = 'pending'")
1031 .bind(&[reason.into(), job.id.as_str().into()])?
1032 .run()
1033 .await?;
1034 }
1035 }
1036 Gate::Refused(reason) => {
1037 self.db
1038 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ? WHERE id = ? AND status = 'pending'")
1039 .bind(&[reason.into(), at.as_str().into(), job.id.as_str().into()])?
1040 .run()
1041 .await?;
1042 released = true;
1043 }
1044 }
1045 }
1046 Ok(released)
1047 }
1048
1049 /// Every minute: runs whose jobs wait at an environment whose timer has
1050 /// run out, or whose review came in, move along.
1051 pub(crate) async fn release_gates(&self) -> Result<()> {
1052 #[derive(Deserialize)]
1053 struct Waiting {
1054 run_id: String,
1055 }
1056 let runs = self
1057 .db
1058 .prepare("SELECT DISTINCT run_id FROM jobs WHERE status = 'pending' LIMIT 100")
1059 .all()
1060 .await?
1061 .results::<Waiting>()?;
1062 for waiting in runs {
1063 let Some(run) = self.run_row(&waiting.run_id).await? else { continue };
1064 if self.release_gates_of(&run).await? {
1065 self.advance(&run.id).await?;
1066 }
1067 }
1068 Ok(())
1069 }
1070
1071 // --- Approving runs of pull requests from outside --------------------------
1072
1073 /// Why a pull request's run waits for approval, if it does: by the
1074 /// repository's policy, whoever the pull request is for (its owner).
1075 pub(crate) async fn approval_needed(&self, repo: &Repo, owner: &User, ws: &User) -> Result<Option<String>> {
1076 // g1t's own work, nobody asked for, is the workspace's.
1077 if owner.id == AGENT_ID || owner.kind == PrincipalKind::System {
1078 return Ok(None);
1079 }
1080 let policy = self.approval_policy(&repo.id).await?;
1081 let permission: Outcome<PermissionInfo> = g1t_kit::call(
1082 &self.identity,
1083 "collaborator_permission",
1084 &CollaboratorPermissionArgs {
1085 viewer: Some(ws.clone()),
1086 path: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
1087 username: owner.username.clone(),
1088 },
1089 )
1090 .await?;
1091 let info = permission.into_result().ok();
1092 let member = owner.is_member(&repo.namespace.to_lowercase())
1093 || info.as_ref().is_some_and(|info| matches!(info.source, Some(AccessSource::Owner | AccessSource::Base | AccessSource::Team)));
1094 if member {
1095 return Ok(None);
1096 }
1097 let can_push = info.as_ref().and_then(|info| info.role).is_some_and(|role| access::allows(role, Capability::Push));
1098 let first_time = !self.has_merged(repo, owner, ws).await?;
1099 Ok(approval_reason(&policy, member, can_push, first_time).map(|why| format!("{} {why}, so someone with the Write role approves its runs first.", owner.username)))
1100 }
1101
1102 /// Whether a pull request of `owner`'s has been merged into `repo`.
1103 async fn has_merged(&self, repo: &Repo, owner: &User, ws: &User) -> Result<bool> {
1104 let closed: Outcome<Vec<g1t_contracts::work::Pull>> = g1t_kit::call(
1105 &self.work,
1106 "list_pulls",
1107 &g1t_contracts::work::ListPullsArgs {
1108 repo: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
1109 viewer: Some(ws.clone()),
1110 state: Some(g1t_contracts::work::State::Closed),
1111 label: None,
1112 milestone: None,
1113 base: None,
1114 },
1115 )
1116 .await
1117 .unwrap_or_else(|_| Outcome::Ok(Vec::new()));
1118 Ok(closed.into_result().unwrap_or_default().iter().any(|pull| pull.merged_at.is_some() && pull.owner().id == owner.id))
1119 }
1120
1121 /// `approve_run`: someone with the Write role lets a pull request's run
1122 /// that waits for approval start.
1123 pub async fn approve_run(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
1124 if let Some(refused) = refuse_job_token(&a.actor) {
1125 return Ok(refused);
1126 }
1127 check!(self.may(&a.actor, &a.repo, Capability::Run).await?);
1128 let run = check!(self.run_in(&a.repo, &a.id).await?);
1129 if run.status != "action_required" {
1130 return Ok(fail(FailureCode::Conflict, "This run is not waiting for approval."));
1131 }
1132 let mut approval = run.approval().unwrap_or(RunApproval { state: "required".into(), reason: String::new(), approved_by: None });
1133 approval.state = "approved".to_owned();
1134 approval.approved_by = Some(a.actor.username.clone());
1135 let started = self
1136 .db
1137 .prepare("UPDATE runs SET status = 'queued', approval = ?, approved_by = ? WHERE id = ? AND status = 'action_required' RETURNING id")
1138 .bind(&[serde_json::to_string(&approval)?.into(), a.actor.username.as_str().into(), run.id.as_str().into()])?
1139 .first::<Value>(None)
1140 .await?;
1141 if started.is_none() {
1142 return Ok(fail(FailureCode::Conflict, "This run is not waiting for approval."));
1143 }
1144 if let Some(run) = self.run_row(&run.id).await? {
1145 self.enter_group(&run).await?;
1146 }
1147 self.run_summary(&run.id).await
1148 }
1149}
1150
1151/// A workflow job's own token may not approve or change what keeps runs
1152/// safe: a workflow could otherwise let itself through.
1153fn refuse_job_token<T>(actor: &User) -> Option<Outcome<T>> {
1154 actor
1155 .token
1156 .as_ref()
1157 .is_some_and(|token| token.job.is_some())
1158 .then(|| fail(FailureCode::Forbidden, "A workflow job's token cannot approve runs or deployments, or change their rules."))
1159}
1160
1161#[cfg(test)]
1162mod tests {
1163 use super::*;
1164
1165 fn env(reviewers: &[(&str, &str)]) -> Environment {
1166 Environment {
1167 reviewers: reviewers.iter().map(|(kind, name)| EnvironmentReviewer { kind: (*kind).into(), name: (*name).into() }).collect(),
1168 ..unprotected("production")
1169 }
1170 }
1171
1172 fn pattern(name: &str, kind: &str) -> BranchPattern {
1173 BranchPattern { name: name.into(), kind: kind.into() }
1174 }
1175
1176 #[test]
1177 fn the_default_token_the_github_way() {
1178 use TokenDefault::{Permissive, Restricted};
1179 // A new repository takes its workspace's default: read-only unless it says.
1180 assert_eq!(effective_default(None, false, Restricted, Permissive), Restricted);
1181 assert_eq!(effective_default(None, false, Permissive, Permissive), Permissive);
1182 // One made before restricted tokens keeps read and write.
1183 assert_eq!(effective_default(None, true, Restricted, Permissive), Permissive);
1184 // A repository's own choice wins...
1185 assert_eq!(effective_default(Some(Restricted), true, Permissive, Permissive), Restricted);
1186 assert_eq!(effective_default(Some(Permissive), false, Restricted, Permissive), Permissive);
1187 // ...but never past the workspace's maximum.
1188 assert_eq!(effective_default(Some(Permissive), true, Permissive, Restricted), Restricted);
1189 assert_eq!(effective_default(None, true, Restricted, Restricted), Restricted);
1190 // A workspace without a row: new repositories read-only, writes allowed, no pull requests.
1191 let policy = workspace_policy(None);
1192 assert_eq!((policy.default_permissions.as_str(), policy.max_permissions.as_str()), ("read", "write"));
1193 assert!(!policy.can_approve_pull_requests);
1194 }
1195
1196 #[test]
1197 fn which_refs_may_deploy() {
1198 assert!(branch_allowed("all", &[], "refs/pull/3/merge", false, "production").is_ok());
1199 assert!(branch_allowed("protected", &[], "refs/heads/main", true, "production").is_ok());
1200 assert!(branch_allowed("protected", &[], "refs/heads/feature", false, "production").unwrap_err().contains("protected branches only"));
1201 // A pull request's merge ref is never a protected branch.
1202 assert!(branch_allowed("protected", &[], "refs/pull/3/merge", true, "production").is_err());
1203 let selected = [pattern("main", "branch"), pattern("release/*", "branch"), pattern("v*", "tag")];
1204 assert!(branch_allowed("selected", &selected, "refs/heads/release/1.x", false, "production").is_ok());
1205 assert!(branch_allowed("selected", &selected, "refs/tags/v1.2.0", false, "production").is_ok());
1206 assert!(branch_allowed("selected", &selected, "refs/heads/feature", false, "production").is_err());
1207 // A tag pattern does not let a branch of that name through.
1208 assert!(branch_allowed("selected", &[pattern("v*", "tag")], "refs/heads/v2", false, "production").is_err());
1209 assert!(branch_allowed("selected", &[], "refs/heads/main", false, "production").is_err());
1210 }
1211
1212 #[test]
1213 fn who_may_review() {
1214 let production = env(&[("user", "ada"), ("team", "deployers")]);
1215 assert_eq!(may_review(&production, "ada", &[], false, Some("bo")), Ok(Reviewer::Listed));
1216 assert_eq!(may_review(&production, "Ada", &[], false, None), Ok(Reviewer::Listed), "names compare without case");
1217 assert_eq!(may_review(&production, "cy", &["deployers".into()], false, None), Ok(Reviewer::Listed));
1218 assert!(may_review(&production, "cy", &[], false, None).unwrap_err().contains("not one of"));
1219 // An admin past the rules, unless the environment says no.
1220 assert_eq!(may_review(&production, "cy", &[], true, None), Ok(Reviewer::AdminBypass));
1221 let strict = Environment { admins_bypass: false, ..production.clone() };
1222 assert!(may_review(&strict, "cy", &[], true, None).is_err());
1223 // Whoever started the run, when self-review is off.
1224 let no_self = Environment { prevent_self_review: true, ..production.clone() };
1225 assert!(may_review(&no_self, "ada", &[], false, Some("ada")).unwrap_err().contains("You started this run"));
1226 assert_eq!(may_review(&no_self, "ada", &[], false, Some("bo")), Ok(Reviewer::Listed));
1227 assert_eq!(may_review(&no_self, "ada", &[], true, Some("ada")), Ok(Reviewer::AdminBypass));
1228 // Without reviewers there is nothing to review; an admin may start it.
1229 let timer = Environment { wait_minutes: 30, ..env(&[]) };
1230 assert!(may_review(&timer, "ada", &[], false, None).unwrap_err().contains("no reviewers"));
1231 assert_eq!(may_review(&timer, "ada", &[], true, None), Ok(Reviewer::AdminBypass));
1232 }
1233
1234 #[test]
1235 fn a_gate_opens_on_review_and_time() {
1236 let now = "2026-10-08T12:00:00Z";
1237 assert!(!gate_open("waiting", true, None, now));
1238 assert!(gate_open("approved", true, None, now));
1239 assert!(!gate_open("approved", true, Some("2026-10-08T12:30:00Z"), now));
1240 assert!(gate_open("approved", true, Some("2026-10-08T11:30:00Z"), now));
1241 assert!(gate_open("waiting", false, Some("2026-10-08T11:59:00Z"), now));
1242 assert!(!gate_open("waiting", false, Some("2026-10-08T12:01:00Z"), now));
1243 assert!(!gate_open("rejected", false, None, now));
1244 assert_eq!(held_reason("production", true, None), "Waiting for a review to deploy to production.");
1245 assert!(held_reason("staging", false, Some("2026-10-08T12:30:00Z")).contains("wait timer"));
1246 }
1247
1248 #[test]
1249 fn which_pull_requests_wait_for_approval() {
1250 // Members never wait.
1251 for policy in APPROVAL_POLICIES {
1252 assert_eq!(approval_reason(policy, true, true, true), None);
1253 }
1254 // The default: anyone who cannot push, and an outside collaborator's first.
1255 assert!(approval_reason("outside_contributors", false, false, false).is_some());
1256 assert!(approval_reason("outside_contributors", false, true, true).is_some());
1257 assert_eq!(approval_reason("outside_contributors", false, true, false), None);
1258 // First-time contributors only.
1259 assert!(approval_reason("first_time_contributors", false, false, true).is_some());
1260 assert_eq!(approval_reason("first_time_contributors", false, false, false), None);
1261 // Everyone outside the workspace.
1262 assert!(approval_reason("all_external_contributors", false, true, false).is_some());
1263 }
1264
1265 #[test]
1266 fn a_jobs_permissions_are_g1t_scopes_and_outside_runs_read_only() {
1267 use g1t_actions::permissions::{Access, Permissions};
1268 use g1t_contracts::scopes::{Level, Scope, TokenAccess};
1269 for scope in Permissions::all(Access::Write).scopes() {
1270 assert!(Scope::parse(scope).is_some(), "{scope} is not a g1t scope");
1271 }
1272 let token = |permissions: &Permissions| TokenAccess {
1273 scopes: Some(permissions.scopes().into_iter().map(str::to_owned).collect()),
1274 repo: Some("acme/web".into()),
1275 ..TokenAccess::default()
1276 };
1277 // The default: it can clone, and nothing more.
1278 let restricted = token(&Permissions::default_for(TokenDefault::Restricted));
1279 assert!(restricted.allows(Scope::CodeRead));
1280 assert!(!restricted.allows(Scope::CodeWrite));
1281 assert!(!restricted.allows(Scope::IssuesWrite));
1282 // A pull request from outside reads, whatever it asks for.
1283 let outside = token(&Permissions::all(Access::Write).read_only());
1284 assert!(Scope::ALL.iter().filter(|scope| outside.allows(**scope)).all(|scope| scope.level() == Level::Read));
1285 // Never more than a repository's: no admin, no secrets, no agents.
1286 let everything = token(&Permissions::all(Access::Write));
1287 for never in [Scope::RepoAdmin, Scope::SecretsRead, Scope::AgentsRun, Scope::WorkspaceRead, Scope::RunnersRead] {
1288 assert!(!everything.allows(never), "{}", never.as_str());
1289 }
1290 }
1291
1292 #[test]
1293 fn environment_names_are_checked() {
1294 assert_eq!(environment_name(" Production ").unwrap(), "production");
1295 assert!(environment_name("staging env").is_err());
1296 assert!(environment_name("").is_err());
1297 assert!(environment_name(&"a".repeat(41)).is_err());
1298 }
1299
1300 #[test]
1301 fn a_job_token_cannot_let_itself_through() {
1302 let mut actor = User { id: "wsp_1".into(), username: "acme".into(), kind: PrincipalKind::Workspace, ..User::default() };
1303 assert!(refuse_job_token::<()>(&actor).is_none());
1304 actor.token = Some(Box::new(g1t_contracts::scopes::TokenAccess {
1305 job: Some(g1t_contracts::scopes::JobToken { run_id: "run_1".into(), job_id: "job_1".into(), pull_requests: false }),
1306 ..Default::default()
1307 }));
1308 assert!(refuse_job_token::<()>(&actor).is_some());
1309 }
1310}