Skip to content
Sign in

flagon-io/g1t

public
0

g1t/services/actions/src/plan.rs

2,005 lines91,519 bytesCodeBlame

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

GitHub Actions on g1t, part two: running workflows1//! A run's life: made, its jobs waiting on the jobs they need, each job
2//! skipped or expanded into its matrix and queued, started in a sandbox
3//! when its workspace has room, reporting its steps and logs as it goes,
4//! and finished; the run finishes with its last job.
5
6use g1t_actions::events::{RunInfo, runner_context};
7use g1t_actions::expr::{self, Scope, Status};
8use g1t_actions::matrix;
9use g1t_actions::workflow::{self, Workflow};
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look10use g1t_contracts::access::Capability;
GitHub Actions on g1t, part two: running workflows11use g1t_contracts::actions::{JobCallArgs, RunActionArgs, StartJobArgs, WorkflowRun};
12use g1t_contracts::identity::{CreateAccessTokenArgs, CreatedAccessToken};
13use g1t_contracts::repos::{Repo, RepoPath};
14use g1t_contracts::time::rfc3339;
15use g1t_contracts::{FailureCode, Outcome, new_id};
16use g1t_kit::now_ms;
17use g1t_secrets::{random_hex, same, sha256_hex};
18use serde::Deserialize;
19use serde_json::{Map, Value, json};
20use worker::Result;
21
22use crate::sync::WorkflowRow;
Fast pages, required checks on the branch, self-hosted runners, honest incidents23use crate::{Actions, Count, MAX_TIMEOUT_MINUTES, RUNNING_PER_WORKSPACE, SELF_HOSTED_MAX_TIMEOUT_MINUTES, SILENT_MS, SITE, check, fail, optional, repo_path};
24use g1t_contracts::runners::{Wanted, waiting_reason};
GitHub Actions on g1t, part two: running workflows25
26/// The most log one job keeps, in bytes; past it, the log says so and stops.
27const MAX_LOG_BYTES: usize = 4 * 1024 * 1024;
28/// The most a single log report may add.
29const MAX_CHUNK_BYTES: usize = 256 * 1024;
30const MAX_ANNOTATIONS: usize = 50;
31
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look32/// The repository whose unfinished runs `event` stops, by id: one deleted,
33/// or archived (not unarchived).
34pub fn stops_runs(event: &g1t_contracts::events::Event) -> Option<String> {
35 let stops = match event.kind.as_str() {
36 "repo.deleted" => true,
37 "repo.archived" => event.data["archived"].as_bool() != Some(false),
38 _ => false,
39 };
40 if !stops {
41 return None;
42 }
43 event.repo_id.clone().or_else(|| event.data["repoId"].as_str().map(str::to_owned))
44}
45
GitHub Actions on g1t, part two: running workflows46pub struct NewRun {
47 pub repo: Repo,
48 pub path: String,
49 pub source: String,
50 pub workflow: Workflow,
51 pub info: RunInfo,
52 pub action: Option<String>,
53 pub pull: Option<u32>,
54 pub title: String,
55 pub inputs: Map<String, Value>,
56 pub event_key: String,
57 pub actor_id: Option<String>,
58 pub actor: Option<String>,
59 pub trusted: bool,
60}
61
62#[derive(Clone, Deserialize)]
63pub struct RunRow {
64 pub id: String,
65 pub workflow_id: String,
66 pub repo_id: String,
67 pub repo: String,
68 pub path: String,
69 pub name: String,
70 pub title: String,
71 pub number: u64,
72 pub attempt: u64,
73 pub event: String,
74 pub action: Option<String>,
75 pub git_ref: String,
76 pub sha: String,
77 pub pull: Option<u32>,
78 pub status: String,
79 pub conclusion: Option<String>,
80 pub error: Option<String>,
81 pub actor: Option<String>,
82 pub actor_id: Option<String>,
83 pub source: String,
84 pub info: String,
85 pub inputs: String,
86 pub trusted: u32,
87 pub concurrency_group: Option<String>,
88 pub created_at: String,
89 pub started_at: Option<String>,
90 pub finished_at: Option<String>,
91}
92
93impl RunRow {
94 pub fn info(&self) -> RunInfo {
95 let mut info: RunInfo = serde_json::from_str(&self.info).unwrap_or_default();
96 info.run_id = self.id.clone();
97 info.run_number = self.number;
98 info.run_attempt = self.attempt;
99 info.workflow_path = self.path.clone();
100 if info.workflow.is_empty() {
101 info.workflow = self.name.clone();
102 }
103 info
104 }
105
106 pub fn inputs(&self) -> Map<String, Value> {
107 serde_json::from_str(&self.inputs).unwrap_or_default()
108 }
109
110 pub fn summary(&self) -> WorkflowRun {
111 WorkflowRun {
112 id: self.id.clone(),
113 workflow_id: self.workflow_id.clone(),
114 path: self.path.clone(),
115 name: self.name.clone(),
116 title: self.title.clone(),
117 number: self.number,
118 attempt: self.attempt,
119 event: self.event.clone(),
120 git_ref: self.git_ref.clone(),
121 sha: self.sha.clone(),
122 pull: self.pull,
123 status: self.status.clone(),
124 conclusion: self.conclusion.clone(),
125 error: self.error.clone(),
126 actor: self.actor.clone(),
127 created_at: self.created_at.clone(),
128 started_at: self.started_at.clone(),
129 finished_at: self.finished_at.clone(),
130 }
131 }
132}
133
134#[derive(Clone, Deserialize)]
135pub struct JobRow {
136 pub id: String,
137 pub run_id: String,
138 pub repo_id: String,
139 pub namespace: String,
140 pub key: String,
141 pub ordinal: u32,
142 pub name: String,
143 pub needs: String,
144 pub matrix: Option<String>,
145 pub status: String,
146 pub conclusion: Option<String>,
147 pub steps: String,
148 pub annotations: String,
149 pub outputs: String,
150 pub reason: Option<String>,
151 pub token_hash: Option<String>,
152 pub timeout_minutes: u32,
153 pub continue_on_error: u32,
154 pub max_parallel: Option<u32>,
Actions: reusable workflows in the repository155 /// Set for a job that calls a reusable workflow, and for that
156 /// workflow's jobs (see migration 0002).
157 pub call: Option<String>,
GitHub Actions on g1t, part two: running workflows158 pub seen_at: Option<String>,
159 pub started_at: Option<String>,
160 pub finished_at: Option<String>,
Fast pages, required checks on the branch, self-hosted runners, honest incidents161 /// For a job whose `runs-on` names self-hosted runners: what it asks
162 /// for, as a JSON array (see `g1t_contracts::runners::Wanted`), when it
163 /// started waiting, and the runner that took it (migration 0004).
164 #[serde(default)]
165 pub labels: Option<String>,
166 #[serde(default)]
167 pub queued_at: Option<String>,
168 #[serde(default)]
169 pub runner_id: Option<String>,
170 #[serde(default)]
171 pub runner_name: Option<String>,
GitHub Actions on g1t, part two: running workflows172}
173
174impl JobRow {
175 pub fn needs(&self) -> Vec<String> {
176 serde_json::from_str(&self.needs).unwrap_or_default()
177 }
Actions: reusable workflows in the repository178
179 pub fn call(&self) -> Option<Value> {
180 self.call.as_deref().and_then(|call| serde_json::from_str(call).ok())
181 }
182
183 /// For a job of a called workflow: that workflow, the job's own id in
184 /// it, and the job.
185 pub fn callee(&self) -> Option<(Workflow, workflow::Job, Value)> {
186 let call = self.call().filter(|call| call["role"] == "callee")?;
187 let called = workflow::parse(call["source"].as_str()?).ok()?;
188 let job = called.jobs.iter().find(|job| call["job"].as_str() == Some(job.id.as_str()))?.clone();
189 Some((called, job, call))
190 }
GitHub Actions on g1t, part two: running workflows191}
192
Actions: reusable workflows in the repository193/// A job to decide on: its key, its definition, and what it needs, as
194/// (name in `needs`, key of the jobs).
195type Unit = (String, workflow::Job, Vec<(String, String)>);
196
197/// How deep reusable workflows may call one another, as on GitHub.
198const MAX_CALL_DEPTH: u64 = 4;
199
GitHub Actions on g1t, part two: running workflows200/// What the jobs of one key came to, for `needs.<key>`.
201fn key_result(rows: &[&JobRow]) -> &'static str {
202 let failed = |row: &&&JobRow| row.conclusion.as_deref() == Some("failure") && row.continue_on_error == 0;
203 if rows.iter().any(|row| failed(&row)) {
204 "failure"
205 } else if rows.iter().any(|row| row.conclusion.as_deref() == Some("cancelled")) {
206 "cancelled"
207 } else if rows.iter().all(|row| row.conclusion.as_deref() == Some("skipped")) {
208 "skipped"
209 } else {
210 "success"
211 }
212}
213
Fast pages, required checks on the branch, self-hosted runners, honest incidents214/// Whether any job before `key` failed: one it needs, or one those need,
215/// however far back. A job after a skipped one still sees the failure
216/// that skipped it, as GitHub's failure() does. `needs_of`: each key's
217/// needs, as keys; `failed`: whether a key's jobs came to a failure.
218fn ancestor_failed(needs_of: &std::collections::HashMap<&str, Vec<&str>>, key: &str, failed: impl Fn(&str) -> bool) -> bool {
219 let mut seen = std::collections::HashSet::new();
220 let mut stack: Vec<&str> = needs_of.get(key).cloned().unwrap_or_default();
221 while let Some(next) = stack.pop() {
222 if !seen.insert(next) {
223 continue;
224 }
225 if failed(next) {
226 return true;
227 }
228 stack.extend(needs_of.get(next).into_iter().flatten().copied());
229 }
230 false
231}
232
Merge main: Deployments panel in the About, project homepage, both sides' operations233/// A job's `environment:`, as deployments read it: its name, the address in
234/// `environment.url` once its expressions are filled in from the run, and
235/// whether the job deploys to it. A job with `deployment: false` only reads
236/// the environment's secrets and variables, and makes no deployment.
237#[derive(Clone, Debug, Default, PartialEq)]
238pub(crate) struct JobEnvironment {
239 pub(crate) name: String,
240 pub(crate) url: Option<String>,
241 pub(crate) deploys: bool,
242}
243
244/// The environment `environment:` names, as written in `raw` (a job), with
245/// `contexts` to fill in expressions: null when it names none, or only
246/// through an expression this cannot read before the job runs.
247pub(crate) fn environment_of(raw: &Value, contexts: &Map<String, Value>) -> Option<JobEnvironment> {
248 let scope = Scope { contexts, status: Status::Success, hash_files: None };
249 let plain = |value: &Value| -> Option<String> {
250 let text = match value {
251 Value::String(text) if text.contains("${{") => expr::interpolate_value(value, &scope).ok().map(|v| expr::to_text(&v))?,
252 Value::String(text) => text.clone(),
253 _ => return None,
254 };
255 let text = text.trim().to_owned();
256 (!text.is_empty()).then_some(text)
257 };
258 match raw.get("environment")? {
259 name @ Value::String(_) => Some(JobEnvironment { name: plain(name)?, url: None, deploys: true }),
260 Value::Object(env) => {
261 let name = plain(env.get("name")?)?;
262 let url = env
263 .get("url")
264 .and_then(plain)
265 .filter(|url| url.starts_with("https://") || url.starts_with("http://"));
266 let deploys = !matches!(env.get("deployment"), Some(Value::Bool(false)))
267 && !matches!(env.get("deployment"), Some(Value::String(text)) if text.trim() == "false");
268 Some(JobEnvironment { name, url, deploys })
269 }
270 _ => None,
271 }
272}
273
274/// The contexts a job's `runs-on` and `environment` are read with before it
275/// runs: the run's `github`, its inputs, and the job's matrix.
276fn start_contexts(run: &RunRow, job: &JobRow, key: &str) -> Map<String, Value> {
277 let mut contexts = Map::new();
278 contexts.insert("github".into(), run.info().context(key, "", run.action.as_deref()));
279 contexts.insert("inputs".into(), Value::Object(run.inputs()));
280 contexts.insert("matrix".into(), job.matrix.as_deref().and_then(|m| serde_json::from_str(m).ok()).unwrap_or_else(|| json!({})));
281 contexts
282}
283
284/// The job as its workflow (or the workflow it calls) defines it.
285fn job_spec(run: &RunRow, job: &JobRow) -> Option<workflow::Job> {
286 match job.callee() {
287 Some((_, spec, _)) => Some(spec),
288 None => workflow::parse(&run.source).ok().and_then(|w| w.jobs.into_iter().find(|j| j.id == job.key)),
289 }
290}
291
292/// The environment a job deploys to, if it deploys.
293pub(crate) fn deploys_to(run: &RunRow, job: &JobRow) -> Option<JobEnvironment> {
294 let spec = job_spec(run, job)?;
295 environment_of(&spec.raw, &start_contexts(run, job, &spec.id)).filter(|env| env.deploys)
296}
297
Fast pages, required checks on the branch, self-hosted runners, honest incidents298/// What the runner is told about a job it starts, from its workflow: the
299/// environment it names plainly, and the machine its `runs-on` asks for
300/// (`instance_for`; none for the standard one).
301#[derive(Default)]
302struct StartDetails {
303 environment: Option<String>,
304 instance: Option<String>,
305}
306
307fn start_details(run: &RunRow, job: &JobRow) -> StartDetails {
308 let spec = match job.callee() {
309 Some((_, spec, _)) => spec,
310 None => match workflow::parse(&run.source).ok().and_then(|w| w.jobs.into_iter().find(|j| j.id == job.key)) {
311 Some(spec) => spec,
312 None => return StartDetails::default(),
313 },
314 };
315 let environment = match spec.raw.get("environment") {
316 Some(Value::String(name)) if !name.contains("${{") => Some(name.clone()),
317 Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).filter(|n| !n.contains("${{")).map(str::to_owned),
318 _ => None,
319 };
320 // `runs-on` as the job was queued with: its matrix and the run's
321 // inputs. A label that needs more than those is the standard machine.
Merge main: Deployments panel in the About, project homepage, both sides' operations322 let contexts = start_contexts(run, job, &spec.id);
Fast pages, required checks on the branch, self-hosted runners, honest incidents323 let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
324 let labels: Vec<String> = match expr::interpolate_value(&spec.runs_on, &scope).unwrap_or(Value::Null) {
325 Value::String(label) => vec![label],
326 Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
327 Value::Object(given) => match given.get("labels") {
328 Some(Value::Array(labels)) => labels.iter().map(expr::to_text).collect(),
329 Some(label) => vec![expr::to_text(label)],
330 None => Vec::new(),
331 },
332 _ => Vec::new(),
333 };
334 let instance = g1t_contracts::actions::instance_for(&labels);
335 StartDetails {
336 environment,
337 instance: (instance != g1t_contracts::actions::STANDARD_INSTANCE).then(|| instance.label.to_owned()),
338 }
339}
340
GitHub Actions on g1t, part two: running workflows341fn now() -> String {
342 rfc3339(now_ms())
343}
344
Merge main: Deployments panel in the About, project homepage, both sides' operations345/// How a finished run went for one environment, from the conclusions of
346/// the jobs that deploy to it: failed if any failed, an error if any was
347/// cancelled, else a success; nothing when none ran (all skipped).
348pub(crate) fn deployment_outcome(conclusions: &[Option<String>]) -> Option<&'static str> {
349 let ran: Vec<&str> = conclusions.iter().flatten().map(String::as_str).filter(|c| *c != "skipped").collect();
350 if ran.is_empty() {
351 return None;
352 }
353 if ran.iter().any(|c| *c == "failure" || *c == "timed_out") {
354 return Some("failure");
355 }
356 if ran.contains(&"cancelled") {
357 return Some("error");
358 }
359 Some("success")
360}
361
GitHub Actions on g1t, part two: running workflows362impl Actions {
363 pub async fn run_row(&self, id: &str) -> Result<Option<RunRow>> {
364 self.db.prepare("SELECT * FROM runs WHERE id = ?").bind(&[id.into()])?.first::<RunRow>(None).await
365 }
366
367 pub async fn job_rows(&self, run_id: &str) -> Result<Vec<JobRow>> {
368 self.db
369 .prepare("SELECT * FROM jobs WHERE run_id = ? ORDER BY rowid")
370 .bind(&[run_id.into()])?
371 .all()
372 .await?
373 .results::<JobRow>()
374 }
375
376 pub async fn run_summary(&self, id: &str) -> Result<Outcome<WorkflowRun>> {
377 Ok(match self.run_row(id).await? {
378 Some(row) => Outcome::Ok(row.summary()),
379 None => fail(FailureCode::NotFound, "No such run."),
380 })
381 }
382
383 /// The contexts every expression outside a job's steps may use.
384 fn base_contexts(run: &RunRow, vars: &Map<String, Value>, job: &str) -> Map<String, Value> {
385 let mut contexts = Map::new();
386 contexts.insert("github".into(), run.info().context(job, "", run.action.as_deref()));
387 contexts.insert("inputs".into(), Value::Object(run.inputs()));
388 contexts.insert("vars".into(), Value::Object(vars.clone()));
389 contexts.insert("needs".into(), json!({}));
390 contexts.insert("runner".into(), runner_context());
391 contexts
392 }
393
394 /// Makes a run and its jobs, and starts what can start. `None` when the
395 /// event already started this workflow.
396 pub async fn create_run(&self, new: NewRun) -> Result<Option<String>> {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look397 // Nothing starts on an archived repository. A deleted one is never
398 // found to start anything on.
399 if new.repo.archived() {
400 return Ok(None);
401 }
GitHub Actions on g1t, part two: running workflows402 let workflow_row = self.workflow_row(&new.repo, &new.path, &new.workflow.display_name(&new.path), &new.source).await?;
403 let numbered = self
404 .db
405 .prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")
406 .bind(&[workflow_row.id.as_str().into()])?
407 .first::<Count>(None)
408 .await?
409 .map_or(1, |count| count.n);
410 let id = new_id("run", now_ms());
411 let mut info = new.info.clone();
412 info.workflow = new.workflow.display_name(&new.path);
413 info.workflow_path = new.path.clone();
414 info.run_id = id.clone();
415 info.run_number = u64::from(numbered);
Secrets and variables: one list, rows per environment, for workflows and deployments416 let vars = self
417 .variables_for(&new.repo.id, &format!("{}/{}", new.repo.namespace, new.repo.name), None, new.trusted)
418 .await?;
GitHub Actions on g1t, part two: running workflows419
420 // run-name and the concurrency group read github, inputs and vars.
421 let mut contexts = Map::new();
422 contexts.insert("github".into(), info.context("", "", new.action.as_deref()));
423 contexts.insert("inputs".into(), Value::Object(new.inputs.clone()));
424 contexts.insert("vars".into(), Value::Object(vars));
425 let scope = Scope {
426 contexts: &contexts,
427 status: Status::Success,
428 hash_files: None,
429 };
430 let title = new
431 .workflow
432 .run_name
433 .as_deref()
434 .and_then(|run_name| expr::interpolate(run_name, &scope).ok())
435 .filter(|title| !title.trim().is_empty())
436 .unwrap_or(new.title.clone());
437 let group = new.workflow.concurrency.as_ref().and_then(|c| expr::interpolate(&c.group, &scope).ok());
438 let cancel_in_progress = new
439 .workflow
440 .concurrency
441 .as_ref()
442 .and_then(|c| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())
443 .is_some_and(|value| expr::truthy(&value));
444
445 let inserted = self
446 .db
447 .prepare(
448 "INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, action, git_ref, sha,
449 pull, status, actor, actor_id, source, info, inputs, trusted, concurrency_group, event_key, created_at)
450 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id",
451 )
452 .bind(&[
453 id.as_str().into(),
454 workflow_row.id.as_str().into(),
455 new.repo.id.as_str().into(),
456 format!("{}/{}", new.repo.namespace, new.repo.name).into(),
457 new.path.as_str().into(),
458 info.workflow.as_str().into(),
459 title.as_str().into(),
460 numbered.into(),
461 info.event_name.as_str().into(),
462 optional(new.action.as_deref()),
463 info.git_ref.as_str().into(),
464 info.sha.as_str().into(),
465 new.pull.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
466 optional(new.actor.as_deref()),
467 optional(new.actor_id.as_deref()),
468 new.source.as_str().into(),
469 serde_json::to_string(&info)?.into(),
470 serde_json::to_string(&new.inputs)?.into(),
471 u32::from(new.trusted).into(),
472 optional(group.as_deref()),
473 new.event_key.as_str().into(),
474 now().into(),
475 ])?
476 .first::<Value>(None)
477 .await?;
478 if inserted.is_none() {
479 return Ok(None);
480 }
481 if let Some(run) = self.run_row(&id).await? {
482 self.report_pending(&run).await?;
483 }
484
485 // Every job, waiting; each is expanded when the jobs it needs are done.
486 let mut statements = Vec::new();
487 for job in &new.workflow.jobs {
488 statements.push(
489 self.db
490 .prepare(
491 "INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting')",
492 )
493 .bind(&[
494 new_id("job", now_ms()).into(),
495 id.as_str().into(),
496 new.repo.id.as_str().into(),
497 new.repo.namespace.as_str().into(),
498 job.id.as_str().into(),
499 job.name.clone().filter(|n| !expr::has_expression(n)).unwrap_or(job.id.clone()).into(),
500 serde_json::to_string(&job.needs)?.into(),
501 ])?,
502 );
503 }
504 self.db.batch(statements).await?;
505
506 // One run at a time per concurrency group.
507 if let Some(group) = &group {
508 let others = self
509 .db
510 .prepare("SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND id != ? AND status != 'completed' ORDER BY id")
511 .bind(&[new.repo.id.as_str().into(), group.as_str().into(), id.as_str().into()])?
512 .all()
513 .await?
514 .results::<RunRow>()?;
515 for other in &others {
516 if cancel_in_progress || other.status == "pending" {
517 // A newer run replaces a waiting one, as on GitHub.
518 self.cancel_run(other, "A newer run in the same concurrency group replaced it.").await?;
519 }
520 }
521 if !cancel_in_progress && others.iter().any(|other| other.status != "pending") {
522 self.db
523 .prepare("UPDATE runs SET status = 'pending' WHERE id = ?")
524 .bind(&[id.as_str().into()])?
525 .run()
526 .await?;
527 return Ok(Some(id));
528 }
529 }
530 self.advance(&id).await?;
531 Ok(Some(id))
532 }
533
534 /// A run that could not start, such as for a workflow file that does not read.
535 #[allow(clippy::too_many_arguments)]
536 pub async fn record_failed_run(
537 &self,
538 row: &WorkflowRow,
539 git_ref: &str,
540 sha: &str,
541 event_key: &str,
542 actor_id: Option<&str>,
543 actor: &str,
544 problem: &str,
545 ) -> Result<()> {
546 let numbered = self
547 .db
548 .prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")
549 .bind(&[row.id.as_str().into()])?
550 .first::<Count>(None)
551 .await?
552 .map_or(1, |count| count.n);
553 let at = now();
554 self.db
555 .prepare(
556 "INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, git_ref, sha, status,
557 conclusion, error, actor, actor_id, source, info, event_key, created_at, finished_at)
558 VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'push', ?, ?, 'completed', 'failure', ?, ?, ?, ?, '{}', ?, ?, ?)",
559 )
560 .bind(&[
561 new_id("run", now_ms()).into(),
562 row.id.as_str().into(),
563 row.repo_id.as_str().into(),
564 row.repo.as_str().into(),
565 row.path.as_str().into(),
566 row.path.as_str().into(),
567 "Invalid workflow file".into(),
568 numbered.into(),
569 git_ref.into(),
570 sha.into(),
571 problem.into(),
572 actor.into(),
573 optional(actor_id),
574 row.source.as_str().into(),
575 event_key.into(),
576 at.as_str().into(),
577 at.as_str().into(),
578 ])?
579 .run()
580 .await?;
581 Ok(())
582 }
583
584 /// Moves a run along: jobs whose needs are done are decided on, and
585 /// jobs that can start are started.
586 pub async fn advance(&self, run_id: &str) -> Result<()> {
587 // Each pass may finish jobs (skipped ones), which may free others.
588 for _ in 0..20 {
589 let Some(run) = self.run_row(run_id).await? else { return Ok(()) };
590 if run.status == "completed" || run.status == "pending" {
591 return Ok(());
592 }
593 let workflow = match workflow::parse(&run.source) {
594 Ok(workflow) => workflow,
595 Err(problem) => {
596 self.finish_run(&run, Some(&problem)).await?;
597 return Ok(());
598 }
599 };
600 let jobs = self.job_rows(run_id).await?;
601 let mut changed = false;
Actions: reusable workflows in the repository602 // What to decide on: the workflow's jobs, and the jobs of the
603 // workflows they call, each with its needs as (name, key).
604 let mut units: Vec<Unit> = workflow
605 .jobs
606 .iter()
607 .map(|job| (job.id.clone(), job.clone(), job.needs.iter().map(|n| (n.clone(), n.clone())).collect()))
608 .collect();
609 let mut seen = std::collections::HashSet::new();
610 for row in &jobs {
611 if !seen.insert(row.key.clone()) {
612 continue;
613 }
614 if let Some((_, job, call)) = row.callee() {
615 let parent = call["parent"].as_str().unwrap_or_default().to_owned();
616 let needs = job.needs.iter().map(|n| (n.clone(), format!("{parent}/{n}"))).collect();
617 units.push((row.key.clone(), job, needs));
618 }
619 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents620 // Each key's needs, as keys, to look back through for failure().
621 let needs_of: std::collections::HashMap<&str, Vec<&str>> =
622 units.iter().map(|(key, _, needs)| (key.as_str(), needs.iter().map(|(_, need)| need.as_str()).collect())).collect();
623 let key_failed = |key: &str| key_result(&jobs.iter().filter(|row| row.key == key).collect::<Vec<_>>()) == "failure";
Actions: reusable workflows in the repository624 for (key, job, needs) in &units {
625 let rows: Vec<&JobRow> = jobs.iter().filter(|row| &row.key == key).collect();
GitHub Actions on g1t, part two: running workflows626 if rows.is_empty() || !rows.iter().all(|row| row.status == "waiting") {
627 continue;
628 }
629 let needed: Vec<(&String, Vec<&JobRow>)> =
Actions: reusable workflows in the repository630 needs.iter().map(|(name, need)| (name, jobs.iter().filter(|row| &row.key == need).collect())).collect();
GitHub Actions on g1t, part two: running workflows631 if !needed.iter().all(|(_, rows)| rows.iter().all(|row| row.status == "completed")) {
632 continue;
633 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents634 let failed_before = ancestor_failed(&needs_of, key, key_failed);
635 self.decide(&run, job, rows[0], &needed, failed_before).await?;
GitHub Actions on g1t, part two: running workflows636 changed = true;
637 }
Actions: reusable workflows in the repository638 // A job that called a workflow finishes with that workflow's jobs.
639 for row in jobs.iter().filter(|row| row.status == "calling") {
640 let children: Vec<&JobRow> = jobs
641 .iter()
642 .filter(|child| child.call().is_some_and(|call| call["role"] == "callee" && call["parent"].as_str() == Some(row.key.as_str())))
643 .collect();
644 if !children.is_empty() && children.iter().all(|child| child.status == "completed") {
645 self.finish_call(row, &children).await?;
646 changed = true;
647 }
648 }
GitHub Actions on g1t, part two: running workflows649 if !changed {
650 break;
651 }
652 }
653 self.start_queued().await?;
654 self.finish_if_done(run_id).await
655 }
656
657 /// Decides on one job whose needs are done: skip it, fail it, or expand
Fast pages, required checks on the branch, self-hosted runners, honest incidents658 /// it into its matrix and queue it. `failed_before`: whether any job
659 /// before it failed, however far back (`ancestor_failed`).
660 async fn decide(&self, run: &RunRow, job: &workflow::Job, row: &JobRow, needed: &[(&String, Vec<&JobRow>)], failed_before: bool) -> Result<()> {
Secrets and variables: one list, rows per environment, for workflows and deployments661 let vars = self.variables_for(&run.repo_id, &run.repo, None, run.trusted != 0).await?;
GitHub Actions on g1t, part two: running workflows662 let mut contexts = Self::base_contexts(run, &vars, &job.id);
Actions: reusable workflows in the repository663 // A called workflow's jobs read the inputs they were called with.
664 let call = row.call();
665 let parent = call.as_ref().filter(|c| c["role"] == "callee").and_then(|c| c["parent"].as_str().map(str::to_owned));
666 if let Some(call) = call.as_ref().filter(|c| c["role"] == "callee") {
667 contexts.insert("inputs".into(), call["inputs"].clone());
668 }
GitHub Actions on g1t, part two: running workflows669 let mut needs = Map::new();
Fast pages, required checks on the branch, self-hosted runners, honest incidents670 let mut results = Vec::new();
GitHub Actions on g1t, part two: running workflows671 for (key, rows) in needed {
672 let result = key_result(rows);
673 let mut outputs = Map::new();
674 for row in rows {
675 if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {
676 outputs.extend(more);
677 }
678 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents679 results.push(result);
GitHub Actions on g1t, part two: running workflows680 needs.insert((*key).clone(), json!({ "result": result, "outputs": outputs }));
681 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents682 // As on GitHub: a need that was skipped makes success() false but
683 // not failure(); failure() is a failure anywhere before the job.
684 let status = expr::job_status(results, failed_before, run.conclusion.as_deref() == Some("cancelled"));
GitHub Actions on g1t, part two: running workflows685 contexts.insert("needs".into(), Value::Object(needs));
686 let scope = Scope {
687 contexts: &contexts,
688 status,
689 hash_files: None,
690 };
691 let condition = job.condition.as_deref().unwrap_or_default();
692 match expr::condition(condition, &scope) {
693 Ok(true) => {}
694 Ok(false) => return self.skip_job(row, None).await,
695 Err(problem) => return self.fail_job(row, &format!("Its `if` does not read: {problem}")).await,
696 }
Actions: reusable workflows in the repository697 if let Some(uses) = &job.uses {
698 return self.call_workflow(run, job, row, uses, &scope).await;
GitHub Actions on g1t, part two: running workflows699 }
700
701 // Its matrix, which may come from a needed job's outputs.
702 let combinations = match &job.matrix {
703 None => vec![Map::new()],
704 Some(matrix) => {
705 let value = match expr::interpolate_value(matrix, &scope) {
706 Ok(value) => value,
707 Err(problem) => return self.fail_job(row, &format!("Its matrix does not read: {problem}")).await,
708 };
709 match matrix::expand(&value) {
710 Ok(combinations) if !combinations.is_empty() => combinations,
711 Ok(_) => return self.fail_job(row, "Its matrix makes no jobs.").await,
712 Err(problem) => return self.fail_job(row, &problem).await,
713 }
714 }
715 };
716 let total = combinations.len();
717 let raw = job.raw.as_object().cloned().unwrap_or_default();
Fast pages, required checks on the branch, self-hosted runners, honest incidents718 // Whether pull requests from forks may use self-hosted runners here,
719 // asked once, and only for a run that is not trusted.
720 let mut forks_allowed: Option<bool> = None;
GitHub Actions on g1t, part two: running workflows721 let mut statements = Vec::new();
722 for (index, combination) in combinations.iter().enumerate() {
723 let mut contexts = contexts.clone();
724 contexts.insert("matrix".into(), Value::Object(combination.clone()));
725 contexts.insert(
726 "strategy".into(),
727 json!({ "fail-fast": job.fail_fast, "job-index": index, "job-total": total, "max-parallel": job.max_parallel.unwrap_or(total as u32) }),
728 );
729 let scope = Scope {
730 contexts: &contexts,
731 status: Status::Success,
732 hash_files: None,
733 };
734 let base_name = job.name.clone().unwrap_or(job.id.clone());
Actions: reusable workflows in the repository735 // A called workflow's job is shown under the job that called it.
736 let base_name = match &parent {
737 Some(parent) => format!("{} / {base_name}", parent.replace('/', " / ")),
738 None => base_name,
739 };
GitHub Actions on g1t, part two: running workflows740 let name = if expr::has_expression(&base_name) {
741 expr::interpolate(&base_name, &scope).unwrap_or(base_name)
742 } else if job.matrix.is_some() {
743 matrix::job_name(&base_name, combination)
744 } else {
745 base_name
746 };
747 let runs_on = expr::interpolate_value(&job.runs_on, &scope).unwrap_or(Value::Null);
748 let labels = match &runs_on {
749 Value::String(label) => vec![label.clone()],
750 Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
751 Value::Object(spec) => spec.get("labels").map(|l| match l {
752 Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
753 other => vec![expr::to_text(other)],
754 }).unwrap_or_default(),
755 _ => Vec::new(),
756 };
Fast pages, required checks on the branch, self-hosted runners, honest incidents757 // `runs-on: self-hosted` (or a group): the workspace's own
758 // machines, which may run any OS. Otherwise g1t's Linux sandboxes.
759 let group = match &runs_on {
760 Value::Object(spec) => spec.get("group").map(expr::to_text),
761 _ => None,
762 };
763 let wanted = Wanted::of(&labels, group.as_deref());
764 let mut reason = if wanted.self_hosted {
765 None
766 } else {
767 labels
768 .iter()
769 .find(|label| {
770 let lower = label.to_ascii_lowercase();
771 lower.contains("windows") || lower.contains("macos")
772 })
773 .map(|label| {
774 let os = if label.to_ascii_lowercase().contains("windows") { "windows" } else { "macos" };
775 format!("`runs-on: {label}`: g1t's own runners are Linux. A self-hosted runner can run it: `runs-on: [self-hosted, {os}]`.")
776 })
777 };
778 // A pull request from a fork runs code anyone could write: never
779 // on the workspace's machines unless it said they may.
780 if wanted.self_hosted && run.trusted == 0 {
781 let allowed = match forks_allowed {
782 Some(allowed) => allowed,
783 None => {
784 let allowed = self.effective_runner_settings(&row.namespace, Some(&run.repo_id)).await?.fork_pull_requests;
785 forks_allowed = Some(allowed);
786 allowed
787 }
788 };
789 if !allowed {
790 reason = Some(
791 "Pull requests from forks do not run on self-hosted runners here. An admin can allow it under Settings, Runners.".to_owned(),
792 );
793 }
794 }
795 let max_minutes = if wanted.self_hosted { SELF_HOSTED_MAX_TIMEOUT_MINUTES } else { MAX_TIMEOUT_MINUTES };
GitHub Actions on g1t, part two: running workflows796 let timeout = raw
797 .get("timeout-minutes")
798 .and_then(|value| expr::interpolate_value(value, &scope).ok())
799 .and_then(|value| value.as_f64().or_else(|| expr::to_text(&value).parse().ok()))
Fast pages, required checks on the branch, self-hosted runners, honest incidents800 .map_or(MAX_TIMEOUT_MINUTES, |minutes| (minutes.ceil() as u32).clamp(1, max_minutes));
GitHub Actions on g1t, part two: running workflows801 let continue_on_error = raw
802 .get("continue-on-error")
803 .and_then(|value| expr::interpolate_value(value, &scope).ok())
804 .is_some_and(|value| expr::truthy(&value));
805 let (status, conclusion, finished) = match &reason {
806 Some(_) => ("completed", Some("failure"), Some(now())),
807 None => ("queued", None, None),
808 };
Fast pages, required checks on the branch, self-hosted runners, honest incidents809 // A self-hosted job waits, saying for what, until a runner takes it.
810 let (labels_json, queued_at) = if wanted.self_hosted && reason.is_none() {
811 reason = Some(waiting_reason(&wanted));
812 (Some(serde_json::to_string(&wanted.stored())?), Some(now()))
813 } else {
814 (None, None)
815 };
GitHub Actions on g1t, part two: running workflows816 let values: Vec<worker::wasm_bindgen::JsValue> = vec![
817 name.into(),
818 serde_json::to_string(combination)?.into(),
819 status.into(),
820 optional(conclusion),
821 optional(reason.as_deref()),
822 timeout.into(),
823 u32::from(continue_on_error).into(),
824 job.max_parallel.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
825 optional(finished.as_deref()),
Fast pages, required checks on the branch, self-hosted runners, honest incidents826 optional(labels_json.as_deref()),
827 optional(queued_at.as_deref()),
GitHub Actions on g1t, part two: running workflows828 ];
829 if index == 0 {
830 let mut bound = values;
831 bound.push(row.id.as_str().into());
832 statements.push(
833 self.db
834 .prepare(
835 "UPDATE jobs SET name = ?, matrix = ?, status = ?, conclusion = ?, reason = ?, timeout_minutes = ?,
Fast pages, required checks on the branch, self-hosted runners, honest incidents836 continue_on_error = ?, max_parallel = ?, finished_at = ?, labels = ?, queued_at = ? WHERE id = ?",
GitHub Actions on g1t, part two: running workflows837 )
838 .bind(&bound)?,
839 );
840 } else {
841 let mut bound: Vec<worker::wasm_bindgen::JsValue> = vec![
842 new_id("job", now_ms()).into(),
843 row.run_id.as_str().into(),
844 row.repo_id.as_str().into(),
845 row.namespace.as_str().into(),
846 row.key.as_str().into(),
847 (index as u32).into(),
848 row.needs.as_str().into(),
Actions: reusable workflows in the repository849 optional(row.call.as_deref()),
GitHub Actions on g1t, part two: running workflows850 ];
851 bound.extend(values);
852 statements.push(
853 self.db
854 .prepare(
Actions: reusable workflows in the repository855 "INSERT INTO jobs (id, run_id, repo_id, namespace, key, ordinal, needs, call, name, matrix, status, conclusion, reason,
Fast pages, required checks on the branch, self-hosted runners, honest incidents856 timeout_minutes, continue_on_error, max_parallel, finished_at, labels, queued_at)
857 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
GitHub Actions on g1t, part two: running workflows858 )
859 .bind(&bound)?,
860 );
861 }
862 }
863 self.db.batch(statements).await?;
864 Ok(())
865 }
866
Actions: reusable workflows in the repository867 /// A job that calls a reusable workflow in the repository: that
868 /// workflow's jobs join the run under it, with the inputs it passes.
869 async fn call_workflow(&self, run: &RunRow, job: &workflow::Job, row: &JobRow, uses: &str, scope: &Scope<'_>) -> Result<()> {
870 let Some(local) = uses.strip_prefix("./") else {
871 return self
872 .fail_job(row, "Reusable workflows from other repositories are not called on g1t yet; ones in this repository (`./.g1t/workflows/…`) are.")
873 .await;
874 };
875 let depth = row.call().and_then(|c| c["depth"].as_u64()).unwrap_or(0) + 1;
876 if depth > MAX_CALL_DEPTH {
877 return self.fail_job(row, &format!("Reusable workflows call each other more than {MAX_CALL_DEPTH} deep.")).await;
878 }
879 let local = local.split('@').next().unwrap_or(local).to_owned();
880 let path = repo_path(&run.repo);
881 let Some(ws) = self.workspace_actor(&path.namespace).await? else {
882 return self.fail_job(row, "The workspace is gone.").await;
883 };
884 // A repository moved from GitHub keeps saying `.github/…`.
885 let mut found = self.read_file(&path, &ws, &run.sha, &local).await?.map(|text| (local.clone(), text));
886 if found.is_none()
887 && let Some(rest) = local.strip_prefix(".github/")
888 {
889 let moved = format!(".g1t/{rest}");
890 found = self.read_file(&path, &ws, &run.sha, &moved).await?.map(|text| (moved, text));
891 }
892 let Some((file, source)) = found else {
893 return self.fail_job(row, &format!("`{uses}` is not in the repository at this commit.")).await;
894 };
895 let called = match workflow::parse(&source) {
896 Ok(called) => called,
897 Err(problem) => return self.fail_job(row, &format!("`{file}` does not read: {problem}")).await,
898 };
899 let Some(trigger) = called.trigger("workflow_call") else {
900 return self.fail_job(row, &format!("`{file}` cannot be called: it has no `on: workflow_call`.")).await;
901 };
902 // Inputs: what the caller passes, else the called workflow's defaults.
903 let given = match job.raw.get("with") {
904 Some(with) => match expr::interpolate_value(with, scope) {
905 Ok(Value::Object(given)) => given,
906 Ok(_) => Map::new(),
907 Err(problem) => return self.fail_job(row, &format!("Its `with` does not read: {problem}")).await,
908 },
909 None => Map::new(),
910 };
911 let mut inputs = Map::new();
912 for (name, spec) in &trigger.inputs {
913 let value = given.get(name).cloned().or_else(|| spec.get("default").cloned()).unwrap_or(Value::Null);
914 if value.is_null() && spec.get("required").and_then(Value::as_bool) == Some(true) {
915 return self.fail_job(row, &format!("`{file}` needs the input `{name}`.")).await;
916 }
917 inputs.insert(name.clone(), value);
918 }
919 for (name, value) in given {
920 inputs.entry(name).or_insert(value);
921 }
922 let mut statements = Vec::new();
923 for called_job in &called.jobs {
924 let needs: Vec<String> = called_job.needs.iter().map(|n| format!("{}/{n}", row.key)).collect();
925 let call = json!({
926 "role": "callee", "parent": row.key, "job": called_job.id, "path": file,
927 "source": source, "inputs": inputs, "depth": depth,
928 });
929 statements.push(
930 self.db
931 .prepare("INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status, call) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting', ?)")
932 .bind(&[
933 new_id("job", now_ms()).into(),
934 row.run_id.as_str().into(),
935 row.repo_id.as_str().into(),
936 row.namespace.as_str().into(),
937 format!("{}/{}", row.key, called_job.id).into(),
938 format!("{} / {}", row.name, called_job.name.clone().unwrap_or(called_job.id.clone())).into(),
939 serde_json::to_string(&needs)?.into(),
940 serde_json::to_string(&call)?.into(),
941 ])?,
942 );
943 }
944 statements.push(
945 self.db
946 .prepare("UPDATE jobs SET status = 'calling', call = ?, reason = ?, started_at = ? WHERE id = ?")
947 .bind(&[
948 serde_json::to_string(&json!({ "role": "caller", "path": file, "source": source }))?.into(),
949 format!("Calls `{file}`.").into(),
950 now().into(),
951 row.id.as_str().into(),
952 ])?,
953 );
954 self.db.batch(statements).await?;
955 Ok(())
956 }
957
958 /// A job that called a workflow, finished with its jobs: their result,
959 /// and the outputs the workflow declares.
960 async fn finish_call(&self, row: &JobRow, children: &[&JobRow]) -> Result<()> {
961 let call = row.call().unwrap_or_default();
962 let called = call["source"].as_str().and_then(|s| workflow::parse(s).ok());
963 let mut jobs_context = Map::new();
964 let mut by_key: std::collections::BTreeMap<String, Vec<&JobRow>> = std::collections::BTreeMap::new();
965 for child in children {
966 by_key.entry(child.key.clone()).or_default().push(child);
967 }
968 for (key, rows) in &by_key {
969 let mut outputs = Map::new();
970 for child in rows {
971 if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&child.outputs) {
972 outputs.extend(more);
973 }
974 }
975 let id = key.rsplit('/').next().unwrap_or(key);
976 jobs_context.insert(id.to_owned(), json!({ "result": key_result(rows), "outputs": outputs }));
977 }
978 let inputs = children.first().and_then(|c| c.call()).map(|c| c["inputs"].clone()).unwrap_or(json!({}));
979 let mut contexts = Map::new();
980 contexts.insert("jobs".into(), Value::Object(jobs_context));
981 contexts.insert("inputs".into(), inputs);
982 let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
983 let mut outputs = Map::new();
984 if let Some(Value::Object(declared)) = called.as_ref().map(|w| {
985 let on = w.raw.get("on").or_else(|| w.raw.get("true")).cloned().unwrap_or(Value::Null);
986 on.get("workflow_call").and_then(|c| c.get("outputs")).cloned().unwrap_or(Value::Null)
987 }) {
988 for (name, spec) in declared {
989 if let Some(value) = spec.get("value") {
990 let value = expr::interpolate_value(value, &scope).unwrap_or(Value::Null);
991 outputs.insert(name, Value::String(expr::to_text(&value)));
992 }
993 }
994 }
995 let conclusion = key_result(children);
996 self.db
997 .prepare("UPDATE jobs SET status = 'completed', conclusion = ?, outputs = ?, finished_at = ? WHERE id = ? AND status = 'calling'")
998 .bind(&[conclusion.into(), serde_json::to_string(&outputs)?.into(), now().into(), row.id.as_str().into()])?
999 .run()
1000 .await?;
1001 Ok(())
1002 }
1003
1004 /// A file's text at a commit, if it is there.
1005 async fn read_file(&self, path: &RepoPath, ws: &g1t_contracts::User, sha: &str, file: &str) -> Result<Option<String>> {
1006 let blob: Outcome<g1t_contracts::repos::BlobView> = g1t_kit::call(
1007 &self.repos,
1008 "blob",
1009 &g1t_contracts::repos::BlobArgs {
1010 path: path.clone(),
1011 viewer: Some(ws.clone()),
1012 git_ref: sha.to_owned(),
1013 file_path: file.to_owned(),
1014 },
1015 )
1016 .await?;
1017 Ok(match blob {
1018 Outcome::Ok(view) => view.text,
1019 Outcome::Fail(_) => None,
1020 })
1021 }
1022
GitHub Actions on g1t, part two: running workflows1023 async fn skip_job(&self, row: &JobRow, reason: Option<&str>) -> Result<()> {
1024 self.db
1025 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'skipped', reason = ?, finished_at = ? WHERE id = ?")
1026 .bind(&[optional(reason), now().into(), row.id.as_str().into()])?
1027 .run()
1028 .await?;
1029 Ok(())
1030 }
1031
1032 async fn fail_job(&self, row: &JobRow, reason: &str) -> Result<()> {
1033 self.db
1034 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ? WHERE id = ? AND status != 'completed'")
1035 .bind(&[reason.into(), now().into(), row.id.as_str().into()])?
1036 .run()
1037 .await?;
1038 Ok(())
1039 }
1040
1041 /// Starts queued jobs, oldest first, while their workspace has room.
1042 pub async fn start_queued(&self) -> Result<()> {
1043 let queued = self
1044 .db
Fast pages, required checks on the branch, self-hosted runners, honest incidents1045 // Self-hosted jobs are taken by their runners (runners.rs).
1046 .prepare("SELECT * FROM jobs WHERE status = 'queued' AND labels IS NULL ORDER BY rowid LIMIT 50")
GitHub Actions on g1t, part two: running workflows1047 .all()
1048 .await?
1049 .results::<JobRow>()?;
1050 let mut running: std::collections::HashMap<String, u32> = std::collections::HashMap::new();
1051 for job in queued {
1052 let in_workspace = match running.get(&job.namespace) {
1053 Some(n) => *n,
1054 None => {
1055 let n = self
1056 .db
Fast pages, required checks on the branch, self-hosted runners, honest incidents1057 // Only g1t's own sandboxes count against the workspace's room.
1058 .prepare("SELECT COUNT(*) AS n FROM jobs WHERE status = 'in_progress' AND namespace = ? AND runner_id IS NULL")
GitHub Actions on g1t, part two: running workflows1059 .bind(&[job.namespace.as_str().into()])?
1060 .first::<Count>(None)
1061 .await?
1062 .map_or(0, |count| count.n);
1063 running.insert(job.namespace.clone(), n);
1064 n
1065 }
1066 };
1067 if in_workspace >= RUNNING_PER_WORKSPACE {
1068 continue;
1069 }
1070 if let Some(max) = job.max_parallel {
1071 let siblings = self
1072 .db
1073 .prepare("SELECT COUNT(*) AS n FROM jobs WHERE run_id = ? AND key = ? AND status = 'in_progress'")
1074 .bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?
1075 .first::<Count>(None)
1076 .await?
1077 .map_or(0, |count| count.n);
1078 if siblings >= max {
1079 continue;
1080 }
1081 }
1082 let token = random_hex(24);
1083 let at = now();
1084 let claimed = self
1085 .db
1086 .prepare(
1087 "UPDATE jobs SET status = 'in_progress', token_hash = ?, started_at = ?, seen_at = ? WHERE id = ? AND status = 'queued' RETURNING id",
1088 )
1089 .bind(&[sha256_hex(&token).into(), at.as_str().into(), at.as_str().into(), job.id.as_str().into()])?
1090 .first::<Value>(None)
1091 .await?;
1092 if claimed.is_none() {
1093 continue;
1094 }
1095 running.insert(job.namespace.clone(), in_workspace + 1);
1096 self.db
1097 .prepare("UPDATE runs SET status = 'in_progress', started_at = COALESCE(started_at, ?) WHERE id = ? AND status = 'queued'")
1098 .bind(&[at.as_str().into(), job.run_id.as_str().into()])?
1099 .run()
1100 .await?;
1101 let run = self.run_row(&job.run_id).await?;
1102 let repo: RepoPath = run.as_ref().map(|run| repo_path(&run.repo)).unwrap_or(RepoPath {
1103 namespace: job.namespace.clone(),
1104 name: String::new(),
1105 });
Fast pages, required checks on the branch, self-hosted runners, honest incidents1106 // Its environment and the machine it asked for, for the runner.
1107 let details = run.as_ref().map(|run| start_details(run, &job)).unwrap_or_default();
GitHub Actions on g1t, part two: running workflows1108 let started: Outcome<Value> = g1t_kit::call(
1109 &self.runner,
1110 "start_actions_job",
1111 &StartJobArgs {
1112 job: job.id.clone(),
1113 token,
1114 repo,
1115 timeout_minutes: job.timeout_minutes,
Fast pages, required checks on the branch, self-hosted runners, honest incidents1116 workflow: run.as_ref().map(|run| run.path.clone()),
1117 environment: details.environment,
1118 trusted: run.as_ref().is_some_and(|run| run.trusted != 0),
1119 instance: details.instance,
GitHub Actions on g1t, part two: running workflows1120 },
1121 )
1122 .await
1123 .unwrap_or_else(|error| fail(FailureCode::Conflict, format!("The runner could not be reached: {error}")));
1124 if let Outcome::Fail(refused) = started {
1125 Box::pin(self.finish_job(&job.id, "failure", Some(&refused.message), None)).await?;
Merge main: Deployments panel in the About, project homepage, both sides' operations1126 } else {
1127 self.job_started(&job.id).await?;
GitHub Actions on g1t, part two: running workflows1128 }
1129 }
1130 Ok(())
1131 }
1132
1133 /// Finishes a job and moves its run along.
1134 pub async fn finish_job(&self, job_id: &str, conclusion: &str, reason: Option<&str>, outputs: Option<&Map<String, Value>>) -> Result<()> {
1135 let finished = self
1136 .db
1137 .prepare(
1138 "UPDATE jobs SET status = 'completed', conclusion = ?, reason = COALESCE(?, reason), outputs = COALESCE(?, outputs),
1139 finished_at = ?, token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *",
1140 )
1141 .bind(&[
1142 conclusion.into(),
1143 optional(reason),
1144 outputs.map(|o| serde_json::to_string(o).unwrap_or_default()).as_deref().map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
1145 now().into(),
1146 job_id.into(),
1147 ])?
1148 .first::<JobRow>(None)
1149 .await?;
1150 let Some(job) = finished else { return Ok(()) };
Merge main: Deployments panel in the About, project homepage, both sides' operations1151 // A job that deploys failed: so did its run's deployment, now.
1152 if conclusion == "failure" && job.continue_on_error == 0 && job.started_at.is_some()
1153 && let Some(run) = self.run_row(&job.run_id).await?
1154 && let Some(env) = deploys_to(&run, &job)
1155 {
1156 self.report_deployment(&run, &env, "failure", false).await;
1157 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents1158 // A self-hosted runner's job: the runner is free again, and its time
1159 // is recorded, at nothing.
1160 if job.runner_id.is_some() {
1161 self.released(&job).await?;
1162 }
GitHub Actions on g1t, part two: running workflows1163 // Steps still marked as going are not going any more.
1164 let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
1165 let mut touched = false;
1166 for step in steps.iter_mut() {
1167 if step["status"] != "completed" {
1168 let was_running = step["status"] == "in_progress";
1169 step["status"] = json!("completed");
1170 step["conclusion"] = json!(if was_running { conclusion } else { "skipped" });
1171 touched = true;
1172 }
1173 }
1174 if touched {
1175 self.db
1176 .prepare("UPDATE jobs SET steps = ? WHERE id = ?")
1177 .bind(&[serde_json::to_string(&steps)?.into(), job.id.as_str().into()])?
1178 .run()
1179 .await?;
1180 }
1181 // fail-fast: one failed combination stops the rest of its matrix.
1182 if conclusion == "failure" && job.continue_on_error == 0 && job.matrix.as_deref().is_some_and(|m| m != "{}") {
1183 let run = self.run_row(&job.run_id).await?;
1184 let fail_fast = run
1185 .as_ref()
1186 .and_then(|run| workflow::parse(&run.source).ok())
1187 .and_then(|workflow| workflow.jobs.into_iter().find(|j| j.id == job.key))
1188 .is_none_or(|j| j.fail_fast);
1189 if fail_fast {
1190 let siblings = self
1191 .db
1192 .prepare("SELECT * FROM jobs WHERE run_id = ? AND key = ? AND status != 'completed'")
1193 .bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?
1194 .all()
1195 .await?
1196 .results::<JobRow>()?;
1197 for sibling in siblings {
1198 self.stop_job(&sibling, "Another job of its matrix failed, and the matrix is fail-fast.").await?;
1199 }
1200 }
1201 }
1202 Box::pin(self.advance(&job.run_id)).await
1203 }
1204
1205 /// Cancels a job, stopping its sandbox if it has one.
1206 async fn stop_job(&self, job: &JobRow, reason: &str) -> Result<()> {
Fast pages, required checks on the branch, self-hosted runners, honest incidents1207 // A self-hosted runner hears it was cancelled on its next poll.
1208 if job.status == "in_progress" && job.runner_id.is_none() {
GitHub Actions on g1t, part two: running workflows1209 let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;
1210 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents1211 let stopped = self
1212 .db
1213 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'cancelled', reason = ?, finished_at = ?, token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *")
GitHub Actions on g1t, part two: running workflows1214 .bind(&[reason.into(), now().into(), job.id.as_str().into()])?
Fast pages, required checks on the branch, self-hosted runners, honest incidents1215 .first::<JobRow>(None)
GitHub Actions on g1t, part two: running workflows1216 .await?;
Fast pages, required checks on the branch, self-hosted runners, honest incidents1217 if let Some(stopped) = stopped.filter(|row| row.runner_id.is_some()) {
1218 self.released(&stopped).await?;
1219 }
GitHub Actions on g1t, part two: running workflows1220 Ok(())
1221 }
1222
1223 /// Finishes the run when every job has.
1224 async fn finish_if_done(&self, run_id: &str) -> Result<()> {
1225 let Some(run) = self.run_row(run_id).await? else { return Ok(()) };
1226 if run.status == "completed" || run.status == "pending" {
1227 return Ok(());
1228 }
1229 let jobs = self.job_rows(run_id).await?;
1230 if !jobs.iter().all(|job| job.status == "completed") {
1231 return Ok(());
1232 }
1233 self.finish_run(&run, None).await
1234 }
1235
1236 async fn finish_run(&self, run: &RunRow, error: Option<&str>) -> Result<()> {
1237 let jobs = self.job_rows(&run.id).await?;
1238 let rows: Vec<&JobRow> = jobs.iter().collect();
1239 let conclusion = if error.is_some() {
1240 "failure"
1241 } else if run.conclusion.as_deref() == Some("cancelled") {
1242 "cancelled"
1243 } else if rows.is_empty() {
1244 "skipped"
1245 } else {
1246 key_result(&rows)
1247 };
1248 let done = self
1249 .db
1250 .prepare("UPDATE runs SET status = 'completed', conclusion = ?, error = COALESCE(?, error), finished_at = ? WHERE id = ? AND status != 'completed' RETURNING id")
1251 .bind(&[conclusion.into(), optional(error), now().into(), run.id.as_str().into()])?
1252 .first::<Value>(None)
1253 .await?;
1254 if done.is_none() {
1255 return Ok(());
1256 }
1257 self.report_status(run, conclusion).await?;
Merge main: Deployments panel in the About, project homepage, both sides' operations1258 self.settle_deployments(run, &jobs, conclusion == "cancelled").await;
Actions: workflow_run, workflow.completed, artifacts on the run page, Node 241259 let published: Result<()> = g1t_kit::call(
1260 &self.events,
1261 "publish",
1262 &g1t_contracts::events::Publish {
1263 events: vec![g1t_contracts::events::NewEvent {
1264 kind: "workflow.completed",
1265 source: "actions",
1266 repo_id: Some(run.repo_id.clone()),
1267 actor: run.actor_id.clone(),
1268 data: g1t_contracts::events::WorkflowEvent {
1269 run_id: run.id.clone(),
1270 repo_id: run.repo_id.clone(),
1271 workflow: run.name.clone(),
1272 path: run.path.clone(),
1273 number: run.number,
1274 event: run.event.clone(),
1275 conclusion: conclusion.to_owned(),
1276 git_ref: run.git_ref.clone(),
1277 sha: run.sha.clone(),
1278 pull: run.pull,
1279 },
1280 }],
1281 },
1282 )
1283 .await;
1284 if let Err(error) = published {
1285 worker::console_error!("actions: could not publish workflow.completed: {error}");
1286 }
GitHub Actions on g1t, part two: running workflows1287 // The next run waiting in its concurrency group.
1288 if let Some(group) = &run.concurrency_group {
1289 let next = self
1290 .db
1291 .prepare("SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND status = 'pending' ORDER BY id LIMIT 1")
1292 .bind(&[run.repo_id.as_str().into(), group.as_str().into()])?
1293 .first::<RunRow>(None)
1294 .await?;
1295 if let Some(next) = next {
1296 self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[next.id.as_str().into()])?.run().await?;
1297 Box::pin(self.advance(&next.id)).await?;
1298 }
1299 }
1300 Ok(())
1301 }
1302
Merge main: Deployments panel in the About, project homepage, both sides' operations1303 /// Tells the deployments service how a run's deployment to `env` stands:
1304 /// made when its first job naming the environment starts, failed when one
1305 /// of them fails, and settled (`last`) when the run finishes. Never fails
1306 /// the run: a deployment that could not be recorded is logged.
1307 async fn report_deployment(&self, run: &RunRow, env: &JobEnvironment, state: &str, last: bool) {
1308 let path = repo_path(&run.repo);
1309 let reported: Result<Value> = g1t_kit::call(
1310 &self.deployments,
1311 "actions_deployment",
1312 &json!({
1313 "repoId": run.repo_id,
1314 "repo": { "namespace": path.namespace, "name": path.name },
1315 "runId": run.id,
1316 "attempt": run.attempt,
1317 "runUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
1318 "environment": env.name,
1319 "url": env.url,
1320 "ref": run.git_ref,
1321 "sha": run.sha,
1322 "state": state,
1323 "final": last,
1324 "creator": run.actor,
1325 "workflow": run.name,
1326 }),
1327 )
1328 .await;
1329 if let Err(error) = reported {
1330 worker::console_error!("actions: deployment to {} not recorded for run {}: {error}", env.name, run.id);
1331 }
1332 }
1333
1334 /// A job that deploys has started: its run's deployment to the
1335 /// environment is under way.
1336 pub(crate) async fn job_started(&self, job_id: &str) -> Result<()> {
1337 let Some(job) = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[job_id.into()])?.first::<JobRow>(None).await? else {
1338 return Ok(());
1339 };
1340 let Some(run) = self.run_row(&job.run_id).await? else { return Ok(()) };
1341 if let Some(env) = deploys_to(&run, &job) {
1342 self.report_deployment(&run, &env, "in_progress", false).await;
1343 }
1344 Ok(())
1345 }
1346
1347 /// The run is over: each environment its jobs deployed to takes the
1348 /// outcome of those jobs (`deployment_outcome`).
1349 async fn settle_deployments(&self, run: &RunRow, jobs: &[JobRow], cancelled: bool) {
1350 let mut seen: Vec<(JobEnvironment, Vec<Option<String>>)> = Vec::new();
1351 for job in jobs {
1352 let Some(env) = deploys_to(run, job) else { continue };
1353 let conclusion = if cancelled && job.conclusion.as_deref() != Some("skipped") && job.started_at.is_some() {
1354 Some("cancelled".to_owned())
1355 } else if job.started_at.is_none() {
1356 Some("skipped".to_owned())
1357 } else {
1358 job.conclusion.clone()
1359 };
1360 match seen.iter_mut().find(|(known, _)| known.name.eq_ignore_ascii_case(&env.name)) {
1361 Some((known, conclusions)) => {
1362 if known.url.is_none() {
1363 known.url = env.url.clone();
1364 }
1365 conclusions.push(conclusion);
1366 }
1367 None => seen.push((env, vec![conclusion])),
1368 }
1369 }
1370 for (env, conclusions) in seen {
1371 if let Some(state) = deployment_outcome(&conclusions) {
1372 self.report_deployment(run, &env, state, true).await;
1373 }
1374 }
1375 }
1376
GitHub Actions on g1t, part two: running workflows1377 /// Tells the pull request (or commit) how the run went, as a status.
1378 async fn report_status(&self, run: &RunRow, conclusion: &str) -> Result<()> {
1379 let state = match conclusion {
1380 "success" | "skipped" => "success",
1381 "cancelled" => "error",
1382 _ => "failure",
1383 };
1384 let _: Result<Value> = g1t_kit::call(
1385 &self.work,
1386 "set_commit_status",
1387 &json!({
1388 "repoId": run.repo_id,
1389 "sha": run.sha,
1390 "context": format!("{} / {}", run.name, run.event),
1391 "state": state,
1392 "description": format!("{} {}", run.name, match conclusion {
1393 "success" => "passed",
1394 "skipped" => "was skipped",
1395 "cancelled" => "was cancelled",
1396 _ => "failed",
1397 }),
1398 "targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge1399 "source": "actions",
GitHub Actions on g1t, part two: running workflows1400 }),
1401 )
1402 .await;
1403 Ok(())
1404 }
1405
1406 /// Tells the pull request a run has started on its head.
1407 pub async fn report_pending(&self, run: &RunRow) -> Result<()> {
1408 let _: Result<Value> = g1t_kit::call(
1409 &self.work,
1410 "set_commit_status",
1411 &json!({
1412 "repoId": run.repo_id,
1413 "sha": run.sha,
1414 "context": format!("{} / {}", run.name, run.event),
1415 "state": "pending",
1416 "description": format!("{} is running", run.name),
1417 "targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge1418 "source": "actions",
GitHub Actions on g1t, part two: running workflows1419 }),
1420 )
1421 .await;
1422 Ok(())
1423 }
1424
1425 /// Cancels a run: its waiting and queued jobs, and stops its running ones.
1426 pub async fn cancel_run(&self, run: &RunRow, reason: &str) -> Result<()> {
1427 self.db
1428 .prepare("UPDATE runs SET conclusion = 'cancelled' WHERE id = ? AND status != 'completed'")
1429 .bind(&[run.id.as_str().into()])?
1430 .run()
1431 .await?;
1432 for job in self.job_rows(&run.id).await?.iter().filter(|job| job.status != "completed") {
1433 self.stop_job(job, reason).await?;
1434 }
1435 if run.status == "pending" {
1436 self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[run.id.as_str().into()])?.run().await?;
1437 }
1438 self.advance(&run.id).await
1439 }
1440
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1441 /// Cancels every run of the repository that has not finished, for
1442 /// `repo.deleted` and `repo.archived`.
1443 pub async fn stop_runs(&self, repo_id: &str) -> Result<()> {
1444 let runs = self
1445 .db
1446 .prepare("SELECT * FROM runs WHERE repo_id = ? AND status != 'completed'")
1447 .bind(&[repo_id.into()])?
1448 .all()
1449 .await?
1450 .results::<RunRow>()?;
1451 for run in runs {
1452 self.cancel_run(&run, "The repository was archived or deleted.").await?;
1453 }
1454 Ok(())
1455 }
1456
GitHub Actions on g1t, part two: running workflows1457 pub async fn cancel(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1458 if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {
GitHub Actions on g1t, part two: running workflows1459 return Ok(Outcome::Fail(refused));
1460 }
1461 let run = check!(self.run_in(&a.repo, &a.id).await?);
1462 if run.status == "completed" {
1463 return Ok(fail(FailureCode::Conflict, "The run has already finished."));
1464 }
1465 self.cancel_run(&run, &format!("{} cancelled the run.", a.actor.username)).await?;
1466 self.run_summary(&run.id).await
1467 }
1468
1469 /// Runs again: every job, or with `failed_only` those that did not
1470 /// succeed and the jobs that need them.
1471 pub async fn rerun(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1472 if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {
GitHub Actions on g1t, part two: running workflows1473 return Ok(Outcome::Fail(refused));
1474 }
1475 let run = check!(self.run_in(&a.repo, &a.id).await?);
1476 if run.status != "completed" {
1477 return Ok(fail(FailureCode::Conflict, "The run is still going: cancel it first."));
1478 }
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1479 // Nothing starts again on an archived repository.
1480 match self.visible_repo(&a.repo, &Some(a.actor.clone())).await? {
1481 Some(repo) if repo.archived() => {
1482 return Ok(fail(FailureCode::Forbidden, g1t_contracts::repos::archived_message(&repo.namespace, &repo.name)));
1483 }
1484 Some(_) => {}
1485 None => return Ok(fail(FailureCode::NotFound, "There is no such repository.")),
1486 }
GitHub Actions on g1t, part two: running workflows1487 if run.error.is_some() {
1488 return Ok(fail(FailureCode::Conflict, "This run never started: fix the workflow file and push again."));
1489 }
1490 let jobs = self.job_rows(&run.id).await?;
1491 let workflow = workflow::parse(&run.source).ok();
1492 // Which keys run again: failed ones and, transitively, those needing them.
1493 let mut again: Vec<String> = Vec::new();
1494 for key in workflow.as_ref().map(|w| w.job_order()).unwrap_or_default() {
1495 let rows: Vec<&JobRow> = jobs.iter().filter(|j| j.key == key).collect();
1496 let failed = rows.iter().any(|row| row.conclusion.as_deref() != Some("success"));
1497 let needs_again = rows.first().is_some_and(|row| row.needs().iter().any(|need| again.contains(need)));
1498 if !a.failed_only || failed || needs_again {
1499 again.push(key.to_owned());
1500 }
1501 }
1502 if again.is_empty() {
1503 return Ok(fail(FailureCode::Conflict, "Every job succeeded: there is nothing to run again."));
1504 }
1505 let mut statements = Vec::new();
1506 for key in &again {
1507 statements.push(self.db.prepare("DELETE FROM logs WHERE job_id IN (SELECT id FROM jobs WHERE run_id = ? AND key = ?)").bind(&[run.id.as_str().into(), key.as_str().into()])?);
1508 statements.push(self.db.prepare("DELETE FROM jobs WHERE run_id = ? AND key = ? AND ordinal > 0").bind(&[run.id.as_str().into(), key.as_str().into()])?);
Actions: reusable workflows in the repository1509 // The jobs of a workflow it called are made again when it calls it again.
GitHub Actions on g1t, part two: running workflows1510 statements.push(
1511 self.db
Actions: reusable workflows in the repository1512 .prepare("DELETE FROM logs WHERE job_id IN (SELECT id FROM jobs WHERE run_id = ? AND key LIKE ?)")
1513 .bind(&[run.id.as_str().into(), format!("{key}/%").into()])?,
1514 );
1515 statements.push(
1516 self.db
1517 .prepare("DELETE FROM jobs WHERE run_id = ? AND key LIKE ?")
1518 .bind(&[run.id.as_str().into(), format!("{key}/%").into()])?,
1519 );
1520 statements.push(
1521 self.db
GitHub Actions on g1t, part two: running workflows1522 .prepare(
1523 "UPDATE jobs SET status = 'waiting', conclusion = NULL, steps = '[]', annotations = '[]', outputs = '{}', reason = NULL,
Fast pages, required checks on the branch, self-hosted runners, honest incidents1524 matrix = NULL, call = NULL, token_hash = NULL, seen_at = NULL, started_at = NULL, finished_at = NULL,
1525 labels = NULL, queued_at = NULL, runner_id = NULL, runner_name = NULL WHERE run_id = ? AND key = ?",
GitHub Actions on g1t, part two: running workflows1526 )
1527 .bind(&[run.id.as_str().into(), key.as_str().into()])?,
1528 );
1529 }
1530 statements.push(
1531 self.db
1532 .prepare("UPDATE runs SET status = 'queued', conclusion = NULL, attempt = attempt + 1, started_at = NULL, finished_at = NULL WHERE id = ?")
1533 .bind(&[run.id.as_str().into()])?,
1534 );
1535 self.db.batch(statements).await?;
1536 if let Some(run) = self.run_row(&run.id).await? {
1537 self.report_pending(&run).await?;
1538 }
1539 self.advance(&run.id).await?;
1540 self.run_summary(&run.id).await
1541 }
1542
1543 pub async fn run_in(&self, repo: &RepoPath, id: &str) -> Result<Outcome<RunRow>> {
1544 let row = self
1545 .db
1546 .prepare("SELECT * FROM runs WHERE id = ? AND lower(repo) = lower(?)")
1547 .bind(&[id.into(), format!("{}/{}", repo.namespace, repo.name).into()])?
1548 .first::<RunRow>(None)
1549 .await?;
1550 Ok(row.map_or_else(|| fail(FailureCode::NotFound, "No such run."), Outcome::Ok))
1551 }
1552
1553 // --- The sandbox's side -----------------------------------------------------
1554
Fast pages, required checks on the branch, self-hosted runners, honest incidents1555 pub(crate) async fn job_for_token(&self, a: &JobCallArgs) -> Result<Outcome<JobRow>> {
GitHub Actions on g1t, part two: running workflows1556 let job = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[a.job.as_str().into()])?.first::<JobRow>(None).await?;
1557 Ok(match job {
1558 Some(job) if job.status == "in_progress" && job.token_hash.as_deref().is_some_and(|hash| same(hash, &sha256_hex(&a.token))) => {
1559 Outcome::Ok(job)
1560 }
1561 _ => fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."),
1562 })
1563 }
1564
A repository has its own sidebar, as settings do1565 /// `job_auth`: which run and repository a running job's token is for,
1566 /// so the API can keep its artifacts and cache.
1567 pub async fn job_auth(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
1568 let job = check!(self.job_for_token(&a).await?);
1569 Ok(Outcome::Ok(json!({ "run": job.run_id, "repoId": job.repo_id })))
1570 }
1571
GitHub Actions on g1t, part two: running workflows1572 /// `job_spec`: everything the sandbox needs to run the job.
1573 pub async fn job_spec(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
1574 let job = check!(self.job_for_token(&a).await?);
1575 let Some(run) = self.run_row(&job.run_id).await? else {
1576 return Ok(fail(FailureCode::NotFound, "No such run."));
1577 };
Actions: reusable workflows in the repository1578 let Ok(caller) = workflow::parse(&run.source) else {
GitHub Actions on g1t, part two: running workflows1579 return Ok(fail(FailureCode::Invalid, "The workflow no longer reads."));
1580 };
Actions: reusable workflows in the repository1581 // A called workflow's job runs as that workflow defines it.
1582 let callee = job.callee();
1583 let (workflow, spec, call_inputs) = match callee {
1584 Some((called, spec, call)) => (called, spec, Some(call["inputs"].clone())),
1585 None => match caller.jobs.iter().find(|j| j.id == job.key) {
1586 Some(spec) => (caller.clone(), spec.clone(), None),
1587 None => return Ok(fail(FailureCode::NotFound, "The job is not in the workflow.")),
1588 },
GitHub Actions on g1t, part two: running workflows1589 };
Actions: reusable workflows in the repository1590 let spec = &spec;
GitHub Actions on g1t, part two: running workflows1591 let repo = repo_path(&run.repo);
1592 let trusted = run.trusted != 0;
Secrets and variables: one list, rows per environment, for workflows and deployments1593 // The job's `environment:`, by name: entries with a value for it give
1594 // that value instead of their default, as GitHub's environment
1595 // secrets do.
1596 let environment: Option<String> = match spec.raw.get("environment") {
1597 Some(Value::String(name)) if !name.contains("${{") => Some(name.clone()),
1598 Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).filter(|n| !n.contains("${{")).map(str::to_owned),
1599 _ => None,
1600 };
1601 // G1T_TOKEN, and GITHUB_TOKEN as its alias: the workspace's own
1602 // token, for as long as the job may run.
GitHub Actions on g1t, part two: running workflows1603 let token = if trusted {
1604 match self.workspace_actor(&repo.namespace).await? {
1605 Some(workspace) => {
1606 let created: CreatedAccessToken = g1t_kit::call(
1607 &self.identity,
1608 "create_access_token",
1609 &CreateAccessTokenArgs {
1610 user: workspace,
Secrets and variables: one list, rows per environment, for workflows and deployments1611 name: format!("G1T_TOKEN for {} run {}", run.repo, run.number),
GitHub Actions on g1t, part two: running workflows1612 ttl_seconds: Some(u64::from(job.timeout_minutes) * 60 + 600),
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step1613 scopes: None,
1614 listed: false,
GitHub Actions on g1t, part two: running workflows1615 },
1616 )
1617 .await?;
1618 created.token
1619 }
1620 None => String::new(),
1621 }
1622 } else {
1623 String::new()
1624 };
Secrets and variables: one list, rows per environment, for workflows and deployments1625 // A run that is not trusted (a pull request from outside the
1626 // workspace) gets no secrets and an empty token.
1627 let mut secrets = if trusted {
1628 self.secrets_for(&run.repo_id, &run.repo, environment.as_deref(), true).await?
1629 } else {
1630 Map::new()
1631 };
1632 secrets.insert("G1T_TOKEN".into(), Value::String(token.clone()));
GitHub Actions on g1t, part two: running workflows1633 secrets.insert("GITHUB_TOKEN".into(), Value::String(token.clone()));
1634 let masks: Vec<String> = secrets.values().filter_map(|v| v.as_str()).filter(|v| v.len() >= 4).map(str::to_owned).collect();
Secrets and variables: one list, rows per environment, for workflows and deployments1635 let vars = self.variables_for(&run.repo_id, &run.repo, environment.as_deref(), trusted).await?;
GitHub Actions on g1t, part two: running workflows1636
1637 let jobs = self.job_rows(&run.id).await?;
1638 let mut needs = Map::new();
Actions: reusable workflows in the repository1639 // In a called workflow, its jobs' keys sit under the job that called it.
1640 let parent = job.call().filter(|c| c["role"] == "callee").and_then(|c| c["parent"].as_str().map(str::to_owned));
GitHub Actions on g1t, part two: running workflows1641 for need in &spec.needs {
Actions: reusable workflows in the repository1642 let key = match &parent {
1643 Some(parent) => format!("{parent}/{need}"),
1644 None => need.clone(),
1645 };
1646 let rows: Vec<&JobRow> = jobs.iter().filter(|row| row.key == key).collect();
GitHub Actions on g1t, part two: running workflows1647 let mut outputs = Map::new();
1648 for row in &rows {
1649 if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {
1650 outputs.extend(more);
1651 }
1652 }
1653 needs.insert(need.clone(), json!({ "result": key_result(&rows), "outputs": outputs }));
1654 }
1655 let siblings = jobs.iter().filter(|row| row.key == job.key).count();
1656 let matrix: Value = job.matrix.as_deref().and_then(|m| serde_json::from_str(m).ok()).unwrap_or(json!({}));
1657 let info = run.info();
1658 let mut github = info.context(&job.key, &token, run.action.as_deref());
1659 github["token"] = json!(token);
Fast pages, required checks on the branch, self-hosted runners, honest incidents1660 // On a self-hosted runner, `runner` and `RUNNER_*` describe that
1661 // machine rather than g1t's sandbox.
1662 let mut variables = info.variables(&job.key);
1663 let runner = match &job.runner_id {
1664 Some(id) => self.runner_context_for(id, &mut variables).await?,
1665 None => runner_context(),
1666 };
GitHub Actions on g1t, part two: running workflows1667
1668 // Where to check out: a pull request's fork, or the repository.
1669 let clone_url = match run.pull {
1670 Some(number) if run.event.starts_with("pull_request") && run.event != "pull_request_target" => {
1671 let located: Outcome<g1t_contracts::work::PullDetail> = g1t_kit::call(
1672 &self.work,
1673 "get_pull",
1674 &g1t_contracts::work::ViewArgs {
1675 repo: repo.clone(),
1676 number,
1677 viewer: self.workspace_actor(&repo.namespace).await?,
1678 after_seq: 0,
1679 },
1680 )
1681 .await?;
1682 match located {
1683 Outcome::Ok(detail) => match detail.pull.fork {
1684 Some(fork) => format!("{SITE}/{}/{}.git", fork.namespace, fork.name),
1685 None => format!("{SITE}/{}.git", run.repo),
1686 },
1687 Outcome::Fail(_) => format!("{SITE}/{}.git", run.repo),
1688 }
1689 }
1690 _ => format!("{SITE}/{}.git", run.repo),
1691 };
1692
1693 Ok(Outcome::Ok(json!({
1694 "job": job.id,
1695 "run": run.id,
1696 "key": job.key,
1697 "name": job.name,
1698 "spec": spec.raw,
1699 "workflow": {
1700 "env": workflow.env,
1701 "defaults": workflow.raw.get("defaults").cloned().unwrap_or(Value::Null),
1702 },
1703 "github": github,
Fast pages, required checks on the branch, self-hosted runners, honest incidents1704 "variables": variables,
GitHub Actions on g1t, part two: running workflows1705 "event": info.event,
1706 "contexts": {
1707 "vars": vars,
1708 "secrets": secrets,
Actions: reusable workflows in the repository1709 "inputs": call_inputs.unwrap_or_else(|| Value::Object(run.inputs())),
GitHub Actions on g1t, part two: running workflows1710 "matrix": matrix,
1711 "needs": needs,
1712 "strategy": {
1713 "fail-fast": spec.fail_fast,
1714 "job-index": job.ordinal,
1715 "job-total": siblings,
1716 "max-parallel": spec.max_parallel.unwrap_or(siblings as u32),
1717 },
Fast pages, required checks on the branch, self-hosted runners, honest incidents1718 "runner": runner,
GitHub Actions on g1t, part two: running workflows1719 },
1720 "checkout": {
1721 "repository": run.repo,
1722 "url": clone_url,
1723 "sha": run.sha,
1724 "ref": run.git_ref,
1725 "token": token,
1726 },
1727 "timeoutMinutes": job.timeout_minutes,
1728 "masks": masks,
1729 })))
1730 }
1731
1732 /// `job_report`: the sandbox telling how the job is going.
1733 pub async fn job_report(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
1734 let job = check!(self.job_for_token(&a).await?);
1735 let report = &a.report;
1736 let at = now();
1737 match report["kind"].as_str().unwrap_or_default() {
1738 "steps" => {
1739 // The list can grow as the job goes (post steps), so steps
1740 // already reported keep where they stand.
1741 let known: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
1742 let steps: Vec<Value> = report["steps"]
1743 .as_array()
1744 .map(|names| {
1745 names
1746 .iter()
1747 .enumerate()
1748 .map(|(i, name)| match known.get(i) {
1749 Some(step) if step["status"] != "queued" => step.clone(),
1750 _ => json!({ "number": i + 1, "name": expr::to_text(name), "status": "queued", "conclusion": null, "startedAt": null, "finishedAt": null }),
1751 })
1752 .collect()
1753 })
1754 .unwrap_or_default();
1755 self.db
1756 .prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")
1757 .bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?
1758 .run()
1759 .await?;
1760 }
1761 "step" => {
1762 let number = report["number"].as_u64().unwrap_or(0) as usize;
1763 let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
1764 if let Some(step) = number.checked_sub(1).and_then(|i| steps.get_mut(i)) {
1765 let status = report["status"].as_str().unwrap_or("in_progress");
1766 step["status"] = json!(status);
1767 if status == "in_progress" {
1768 step["startedAt"] = json!(at);
1769 }
1770 if status == "completed" {
1771 step["finishedAt"] = json!(at);
1772 step["conclusion"] = report["conclusion"].clone();
1773 }
1774 if let Some(name) = report["name"].as_str() {
1775 step["name"] = json!(name);
1776 }
1777 }
1778 self.db
1779 .prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")
1780 .bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?
1781 .run()
1782 .await?;
1783 }
1784 "log" => {
1785 let mut text = report["text"].as_str().unwrap_or_default().to_owned();
1786 if text.len() > MAX_CHUNK_BYTES {
1787 let mut cut = MAX_CHUNK_BYTES;
1788 while !text.is_char_boundary(cut) {
1789 cut -= 1;
1790 }
1791 text.truncate(cut);
1792 }
1793 #[derive(Deserialize)]
1794 struct Size {
GitHub Actions on g1t, part three: .g1t/workflows, the pages, the docs1795 n: Option<f64>,
1796 seq: Option<f64>,
GitHub Actions on g1t, part two: running workflows1797 }
1798 let size = self
1799 .db
1800 .prepare("SELECT SUM(LENGTH(text)) AS n, MAX(seq) AS seq FROM logs WHERE job_id = ?")
1801 .bind(&[job.id.as_str().into()])?
1802 .first::<Size>(None)
1803 .await?;
GitHub Actions on g1t, part three: .g1t/workflows, the pages, the docs1804 let (used, seq) = size.map_or((0, 0.0), |s| (s.n.unwrap_or(0.0) as usize, s.seq.unwrap_or(0.0)));
GitHub Actions on g1t, part two: running workflows1805 if used < MAX_LOG_BYTES {
1806 if used + text.len() >= MAX_LOG_BYTES {
1807 text.push_str("\n… The log reached its limit of 4 MB; the rest is not kept.\n");
1808 }
1809 self.db
1810 .prepare("INSERT INTO logs (job_id, seq, step, text) VALUES (?, ?, ?, ?)")
GitHub Actions on g1t, part three: .g1t/workflows, the pages, the docs1811 .bind(&[job.id.as_str().into(), // Numbers go to D1 as f64: a u64 would be a BigInt, which it refuses.
1812 (seq + 1.0).into(), (report["step"].as_u64().unwrap_or(0) as u32).into(), text.into()])?
GitHub Actions on g1t, part two: running workflows1813 .run()
1814 .await?;
1815 }
1816 self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;
1817 }
1818 "annotation" => {
1819 let mut annotations: Vec<Value> = serde_json::from_str(&job.annotations).unwrap_or_default();
1820 if annotations.len() < MAX_ANNOTATIONS {
1821 annotations.push(json!({
1822 "level": report["level"].as_str().unwrap_or("notice"),
1823 "message": report["message"].as_str().unwrap_or_default().chars().take(4000).collect::<String>(),
1824 "title": report["title"],
1825 "file": report["file"],
1826 "line": report["line"],
1827 }));
1828 self.db
1829 .prepare("UPDATE jobs SET annotations = ?, seen_at = ? WHERE id = ?")
1830 .bind(&[serde_json::to_string(&annotations)?.into(), at.as_str().into(), job.id.as_str().into()])?
1831 .run()
1832 .await?;
1833 }
1834 }
1835 "done" => {
1836 let conclusion = report["conclusion"]
1837 .as_str()
1838 .filter(|c| matches!(*c, "success" | "failure" | "cancelled"))
1839 .unwrap_or("failure");
1840 let outputs = report["outputs"].as_object().cloned();
1841 Box::pin(self.finish_job(&job.id, conclusion, report["reason"].as_str(), outputs.as_ref())).await?;
1842 }
1843 other => return Ok(fail(FailureCode::Invalid, format!("There is no report called `{other}`."))),
1844 }
1845 Ok(Outcome::Ok(json!({ "ok": true })))
1846 }
1847
1848 // --- Every minute ---------------------------------------------------------------
1849
1850 pub async fn on_minute(&self, now_ms: u64) -> Result<()> {
1851 let minute = now_ms / 60_000 * 60_000;
1852 if let Err(error) = self.run_schedules(minute).await {
1853 worker::console_error!("actions: schedules failed: {error}");
1854 }
1855 // Jobs whose sandbox went quiet or ran past their time.
1856 let running = self.db.prepare("SELECT * FROM jobs WHERE status = 'in_progress'").all().await?.results::<JobRow>()?;
1857 for job in running {
1858 // Times in g1t's format compare as text.
1859 let before = |ms: u64| rfc3339(now_ms.saturating_sub(ms));
1860 let silent = job.seen_at.as_deref().is_some_and(|seen| seen < before(SILENT_MS).as_str());
1861 let limit = (u64::from(job.timeout_minutes) * 60 + 120) * 1000;
1862 let over = job.started_at.as_deref().is_some_and(|started| started < before(limit).as_str());
1863 if over {
1864 let reason = format!("It ran longer than its time limit of {} minutes.", job.timeout_minutes);
Fast pages, required checks on the branch, self-hosted runners, honest incidents1865 // A self-hosted runner is told to stop on its next poll.
1866 if job.runner_id.is_none() {
1867 let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;
1868 }
GitHub Actions on g1t, part two: running workflows1869 self.finish_job(&job.id, "failure", Some(&reason), None).await?;
1870 } else if silent {
Fast pages, required checks on the branch, self-hosted runners, honest incidents1871 let reason = match &job.runner_name {
1872 Some(name) => format!("The self-hosted runner {name} stopped answering."),
1873 None => "The runner stopped answering.".to_owned(),
1874 };
1875 self.finish_job(&job.id, "failure", Some(&reason), None).await?;
GitHub Actions on g1t, part two: running workflows1876 }
1877 }
Fast pages, required checks on the branch, self-hosted runners, honest incidents1878 if let Err(error) = self.sweep_runners(now_ms).await {
1879 worker::console_error!("actions: the runners' sweep failed: {error}");
1880 }
1881 // Once an hour: the cache's expired entries, and its storage.
1882 if (now_ms / 60_000) % 60 == 7
1883 && let Err(error) = self.sweep_cache(now_ms).await
1884 {
1885 worker::console_error!("actions: the cache's sweep failed: {error}");
1886 }
GitHub Actions on g1t, part two: running workflows1887 self.start_queued().await
1888 }
1889}
1890
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1891
1892#[cfg(test)]
1893mod stopping {
1894 use super::stops_runs;
1895 use g1t_contracts::events::Event;
1896 use serde_json::{Value, json};
1897
1898 fn event(kind: &str, data: Value) -> Event {
1899 Event {
1900 id: "evt_1".into(),
1901 kind: kind.into(),
1902 source: "repos".into(),
1903 time: "2026-10-05T00:00:00Z".into(),
1904 repo_id: Some("rep_1".into()),
1905 actor: None,
1906 data,
1907 }
1908 }
1909
1910 #[test]
1911 fn deleting_or_archiving_stops_runs() {
1912 assert_eq!(stops_runs(&event("repo.deleted", json!({ "repoId": "rep_1" }))).as_deref(), Some("rep_1"));
1913 assert_eq!(stops_runs(&event("repo.archived", json!({ "archived": true }))).as_deref(), Some("rep_1"));
1914 assert_eq!(stops_runs(&event("repo.unarchived", json!({ "archived": false }))), None);
1915 assert_eq!(stops_runs(&event("repo.restored", json!({}))), None);
1916 assert_eq!(stops_runs(&event("git.push", json!({}))), None);
1917 }
1918}
Fast pages, required checks on the branch, self-hosted runners, honest incidents1919
1920#[cfg(test)]
1921mod status_of_needs {
1922 use std::collections::HashMap;
1923
1924 use super::ancestor_failed;
1925
1926 /// check -> plan -> (migrate) -> core -> edge, as deploy.yml has them,
1927 /// and a job that needs only the last.
1928 fn graph() -> HashMap<&'static str, Vec<&'static str>> {
1929 HashMap::from([
1930 ("check", vec![]),
1931 ("plan", vec!["check"]),
1932 ("migrate", vec!["plan"]),
1933 ("core", vec!["plan", "migrate"]),
1934 ("edge", vec!["plan", "migrate", "core"]),
1935 ("notify", vec!["edge"]),
1936 ])
1937 }
1938
1939 #[test]
1940 fn a_failure_is_seen_however_far_back() {
1941 let needs = graph();
1942 let failed = |which: &'static str| move |key: &str| key == which;
1943 // check failed; plan, and everything after, was skipped for it.
1944 assert!(ancestor_failed(&needs, "notify", failed("check")));
1945 assert!(ancestor_failed(&needs, "core", failed("check")));
1946 assert!(ancestor_failed(&needs, "edge", failed("core")));
1947 // Nothing before a job failed: a skipped migrate is not a failure.
1948 assert!(!ancestor_failed(&needs, "edge", |_| false));
1949 assert!(!ancestor_failed(&needs, "core", failed("edge")));
1950 assert!(!ancestor_failed(&needs, "check", failed("check")));
1951 }
1952
1953 #[test]
1954 fn cycles_and_unknown_keys_end() {
1955 let needs = HashMap::from([("a", vec!["b"]), ("b", vec!["a"])]);
1956 assert!(!ancestor_failed(&needs, "a", |_| false));
1957 assert!(!ancestor_failed(&needs, "missing", |_| true));
1958 }
1959}
Merge main: Deployments panel in the About, project homepage, both sides' operations1960
1961#[cfg(test)]
1962mod deployments {
1963 use serde_json::{Map, Value, json};
1964
1965 use super::{JobEnvironment, deployment_outcome, environment_of};
1966
1967 #[test]
1968 fn a_jobs_environment_is_read_for_deployments() {
1969 let contexts: Map<String, Value> = serde_json::from_value(json!({
1970 "github": { "ref_name": "main", "repository": "acme/web" },
1971 "inputs": { "target": "staging" },
1972 "matrix": {},
1973 }))
1974 .unwrap();
1975 let read = |raw: Value| environment_of(&raw, &contexts);
1976 assert_eq!(read(json!({})), None);
1977 assert_eq!(
1978 read(json!({ "environment": "production" })),
1979 Some(JobEnvironment { name: "production".into(), url: None, deploys: true })
1980 );
1981 assert_eq!(
1982 read(json!({ "environment": { "name": "production", "url": "https://g1t.sh" } })),
1983 Some(JobEnvironment { name: "production".into(), url: Some("https://g1t.sh".into()), deploys: true })
1984 );
1985 // Expressions are filled in from the run.
1986 assert_eq!(
1987 read(json!({ "environment": { "name": "${{ inputs.target }}", "url": "https://${{ github.ref_name }}.example.com" } })),
1988 Some(JobEnvironment { name: "staging".into(), url: Some("https://main.example.com".into()), deploys: true })
1989 );
1990 // Secrets only: no deployment.
1991 assert!(!read(json!({ "environment": { "name": "production", "deployment": false } })).unwrap().deploys);
1992 // Only http(s) addresses.
1993 assert_eq!(read(json!({ "environment": { "name": "production", "url": "javascript:alert(1)" } })).unwrap().url, None);
1994 }
1995
1996 #[test]
1997 fn a_runs_outcome_for_an_environment() {
1998 let of = |list: &[&str]| deployment_outcome(&list.iter().map(|c| Some((*c).to_owned())).collect::<Vec<_>>());
1999 assert_eq!(of(&["success", "skipped"]), Some("success"));
2000 assert_eq!(of(&["success", "failure"]), Some("failure"));
2001 assert_eq!(of(&["success", "cancelled"]), Some("error"));
2002 assert_eq!(of(&["skipped"]), None);
2003 assert_eq!(deployment_outcome(&[None]), None);
2004 }
2005}

This file's history is long; its oldest lines are credited to the oldest commit read.