Skip to content
Sign up

flagon-io/g1t

public
0
816 linesCodeBlameRaw
1//! Self-hosted runners: a workspace's or a repository's own machines, which
2//! run its workflow jobs (and, when it says so, its agents' work) instead
3//! of g1t's sandboxes. Time on them costs nothing.
4//!
5//! The actions service keeps them, beside the jobs they run. A machine runs
6//! `g1t-runner` (`crates/runner`), which registers once with a short-lived
7//! registration token an admin made, gets a credential of its own, and then
8//! only ever calls out: it polls `api.g1t.sh` for work, runs what it is
9//! given with the same harness g1t's sandboxes use, and reports back. No
10//! port is opened on the machine.
11//!
12//! - A **registration token** (`g1trt_…`) is made by an owner of the
13//! workspace (or an admin of the repository) and lasts an hour. It can
14//! register any number of runners until then, and nothing else.
15//! - A **runner credential** (`g1tr_…`) belongs to one runner. It is stored
16//! only as a hash, rotates every day (the poll that rotates it hands the
17//! new one over), and is revoked when the runner is removed. It can poll
18//! for work, report on what that runner was given, and remove the runner;
19//! nothing else. Any other endpoint refuses it.
20//! - A job is given to a runner when every label in its `runs-on` is one
21//! of the runner's labels (ignoring case), and the runner's group lets
22//! the job's repository use it. A job whose `runs-on` names
23//! `self-hosted` (or a `group`) only ever runs on self-hosted runners; it
24//! waits, saying for which labels, until one picks it up, for a day at
25//! most.
26//!
27//! The management methods take an `actor` and an owner (`repo` or
28//! `workspace`), as secrets do. The runner's own methods take its id and
29//! credential. Mirrors `packages/contracts/src/runners.ts`.
30
31use serde::{Deserialize, Serialize};
32use serde_json::{Map, Value};
33
34use crate::User;
35use crate::repos::RepoPath;
36
37/// Every runner has these labels, whatever else it was given.
38pub const SELF_HOSTED: &str = "self-hosted";
39/// What a registration token starts with.
40pub const REGISTRATION_PREFIX: &str = "g1trt_";
41/// What a runner's credential starts with.
42pub const CREDENTIAL_PREFIX: &str = "g1tr_";
43/// How long a registration token lasts, in seconds.
44pub const REGISTRATION_TTL_SECONDS: u64 = 60 * 60;
45/// How long a job may wait for a self-hosted runner before it fails.
46pub const MAX_WAIT_HOURS: u64 = 24;
47/// A runner that has not polled for this long is offline.
48pub const ONLINE_WITHIN_MS: u64 = 90 * 1000;
49/// How long one poll waits for work before answering with none.
50pub const MAX_POLL_WAIT_MS: u64 = 20 * 1000;
51/// How often a runner's credential is replaced.
52pub const ROTATE_AFTER_MS: u64 = 24 * 60 * 60 * 1000;
53/// The most labels a runner has, and the longest one.
54pub const MAX_LABELS: usize = 30;
55pub const MAX_LABEL_LEN: usize = 64;
56/// The most runners a workspace has.
57pub const MAX_RUNNERS: u32 = 500;
58/// The most runners a workspace registers in one minute.
59pub const MAX_REGISTRATIONS_PER_MINUTE: u32 = 30;
60/// The most registration tokens a workspace makes in one hour.
61pub const MAX_TOKENS_PER_HOUR: u32 = 60;
62
63// --- What people see -------------------------------------------------------
64
65/// What a runner is doing now.
66#[derive(Clone, Debug, Serialize, Deserialize)]
67#[serde(rename_all = "camelCase")]
68pub struct RunnerWork {
69 /// `workflow` (a workflow job) or `agent` (an agent's run, checks, a
70 /// review, the merge queue).
71 pub kind: String,
72 pub id: String,
73 /// The job's name, or what the agent is doing.
74 pub name: String,
75 /// `owner/name`.
76 pub repo: Option<String>,
77 /// For a link: the workflow run the job is in, or for `agent` work
78 /// the agent run it is (`/<owner>/<name>/agents/runs/<id>`), when
79 /// the sandbox that handed it over said which.
80 pub run_id: Option<String>,
81 pub started_at: Option<String>,
82}
83
84#[derive(Clone, Debug, Serialize, Deserialize)]
85#[serde(rename_all = "camelCase")]
86pub struct Runner {
87 pub id: String,
88 pub name: String,
89 pub workspace: String,
90 /// `owner/name` for a repository's own runner; null for the workspace's.
91 pub repo: Option<String>,
92 /// Its group's name; null for a repository's runner.
93 pub group: Option<String>,
94 /// Every label, `self-hosted`, its OS and architecture among them.
95 pub labels: Vec<String>,
96 /// `linux`, `macos` or `windows`.
97 pub os: String,
98 /// `x64` or `arm64`.
99 pub arch: String,
100 /// The `g1t-runner` version it last reported.
101 pub version: String,
102 /// Runs one job, then removes itself.
103 pub ephemeral: bool,
104 /// `online`, `busy` or `offline`.
105 pub status: String,
106 pub work: Option<RunnerWork>,
107 pub last_seen_at: Option<String>,
108 pub created_at: String,
109 pub created_by: Option<String>,
110 /// How it keeps work from its machine, as it last said
111 /// ([`ISOLATIONS`]); null for a runner from before runners said.
112 #[serde(default)]
113 pub isolation: Option<String>,
114}
115
116/// Which of a workspace's repositories may use its runners.
117#[derive(Clone, Debug, Serialize, Deserialize)]
118#[serde(rename_all = "camelCase")]
119pub struct RunnerGroup {
120 pub id: String,
121 pub name: String,
122 /// The group runners join when none is named: every repository.
123 pub default: bool,
124 /// Repository names (without the workspace) that may use it; empty is
125 /// every repository in the workspace.
126 pub repositories: Vec<String>,
127 pub runners: u32,
128 pub updated_at: String,
129}
130
131/// A registration token, shown once.
132#[derive(Clone, Debug, Serialize, Deserialize)]
133#[serde(rename_all = "camelCase")]
134pub struct RegistrationToken {
135 pub token: String,
136 pub expires_at: String,
137 pub workspace: String,
138 pub repo: Option<String>,
139 pub group: Option<String>,
140 /// What to pass as `--url`.
141 pub url: String,
142}
143
144/// Where a workspace's (or a repository's) agents work, and whether pull
145/// requests from forks may use its runners.
146#[derive(Clone, Debug, Default, Serialize, Deserialize)]
147#[serde(rename_all = "camelCase")]
148pub struct RunnerSettings {
149 /// Agent runs, checks, reviews and the merge queue run on self-hosted
150 /// runners with `agent_labels`, instead of g1t's sandboxes.
151 pub agents_on_self_hosted: bool,
152 /// The labels a runner needs to take agent work; `self-hosted` is
153 /// always one.
154 pub agent_labels: Vec<String>,
155 /// Jobs of pull requests from forks may run on self-hosted runners.
156 /// Off by default: anyone who can open a pull request could run code
157 /// on the machine.
158 pub fork_pull_requests: bool,
159 /// For a repository: these are its workspace's, not its own.
160 pub inherited: bool,
161}
162
163// --- Management ------------------------------------------------------------
164
165/// A workspace's runners (`workspace`), or a repository's own (`repo`).
166#[derive(Clone, Debug, Default, Serialize, Deserialize)]
167pub struct RunnersOwner {
168 #[serde(default)]
169 pub repo: Option<RepoPath>,
170 #[serde(default)]
171 pub workspace: Option<String>,
172}
173
174/// `runners`: a workspace's runners (members), or a repository's own
175/// (its admins). Returns `Outcome<Vec<Runner>>`.
176#[derive(Debug, Serialize, Deserialize)]
177pub struct ListRunnersArgs {
178 pub actor: User,
179 #[serde(flatten)]
180 pub owner: RunnersOwner,
181}
182
183/// `create_registration_token`: owners of the workspace, or admins of the
184/// repository. Returns `Outcome<RegistrationToken>`.
185#[derive(Debug, Serialize, Deserialize)]
186pub struct CreateRegistrationTokenArgs {
187 pub actor: User,
188 #[serde(flatten)]
189 pub owner: RunnersOwner,
190 /// The group its runners join, by name or id; the default group if
191 /// left out. Not for a repository's runners.
192 #[serde(default)]
193 pub group: Option<String>,
194}
195
196/// `remove_runner`: as `create_registration_token`. A job it is running is
197/// cancelled. Returns `Outcome<bool>`.
198#[derive(Debug, Serialize, Deserialize)]
199pub struct RemoveRunnerArgs {
200 pub actor: User,
201 #[serde(flatten)]
202 pub owner: RunnersOwner,
203 pub id: String,
204}
205
206/// `runner_groups`: members. Returns `Outcome<Vec<RunnerGroup>>`.
207#[derive(Debug, Serialize, Deserialize)]
208pub struct RunnerGroupsArgs {
209 pub actor: User,
210 pub workspace: String,
211}
212
213/// `set_runner_group`: create one (no `id`) or change one. Owners.
214/// Returns `Outcome<RunnerGroup>`.
215#[derive(Debug, Serialize, Deserialize)]
216pub struct SetRunnerGroupArgs {
217 pub actor: User,
218 pub workspace: String,
219 #[serde(default)]
220 pub id: Option<String>,
221 #[serde(default)]
222 pub name: Option<String>,
223 /// Repository names; empty for every repository.
224 #[serde(default)]
225 pub repositories: Option<Vec<String>>,
226}
227
228/// `delete_runner_group`: owners. Its runners move to the default group,
229/// which cannot be deleted. Returns `Outcome<bool>`.
230#[derive(Debug, Serialize, Deserialize)]
231pub struct DeleteRunnerGroupArgs {
232 pub actor: User,
233 pub workspace: String,
234 pub id: String,
235}
236
237// --- The desktop app's runners ----------------------------------------------
238
239/// The desktop app keeps a runner on a person's computer while it is open
240/// (apps/desktop/src-tauri/src/runner). What it says of that runner, as it
241/// says it in its tray and settings (its diagnosis.rs, the one catalogue
242/// of those words), is kept here per computer, so the workspace's Runners
243/// page lists every desktop with the same state, why, and the fix. A
244/// desktop not heard from for `DESKTOP_OPEN_WITHIN_MS` has g1t closed, and
245/// shows `closed`, which the app sent too.
246pub const DESKTOP_OPEN_WITHIN_MS: u64 = 10 * 60 * 1000;
247/// The most desktops a workspace keeps reports for.
248pub const MAX_DESKTOPS: u32 = 200;
249
250/// A diagnosis, as the app made it.
251#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
252pub struct DesktopDiagnosis {
253 /// `idle`, `busy`, `no_docker`, `no_sandbox`, `not_allowed`, …
254 pub code: String,
255 /// `ok`, `working`, `off`, `warning` or `problem`.
256 pub tone: String,
257 pub title: String,
258 #[serde(default)]
259 pub cause: Option<String>,
260 #[serde(default)]
261 pub fix: Option<String>,
262}
263
264/// One person's computer, as its desktop app last said.
265#[derive(Clone, Debug, Serialize, Deserialize)]
266#[serde(rename_all = "camelCase")]
267pub struct DesktopRunner {
268 pub workspace: String,
269 /// The computer's name, which its runner has too.
270 pub machine: String,
271 /// Whose computer: their username.
272 pub person: String,
273 /// `sandboxed`, `docker` or `host`.
274 pub backend: String,
275 pub version: Option<String>,
276 pub diagnosis: DesktopDiagnosis,
277 /// What to show while g1t is closed on it.
278 pub closed: DesktopDiagnosis,
279 /// Heard from within `DESKTOP_OPEN_WITHIN_MS`: g1t is open there.
280 pub open: bool,
281 pub reported_at: String,
282}
283
284/// `report_desktop`: the person's own desktop app, through the site, for a
285/// workspace they own. Returns `Outcome<bool>`.
286#[derive(Debug, Serialize, Deserialize)]
287pub struct ReportDesktopArgs {
288 pub actor: User,
289 pub workspace: String,
290 pub machine: String,
291 pub backend: String,
292 #[serde(default)]
293 pub version: Option<String>,
294 pub diagnosis: DesktopDiagnosis,
295 pub closed: DesktopDiagnosis,
296}
297
298/// `desktop_runners`: owners of the workspace. Returns `Outcome<Vec<DesktopRunner>>`.
299#[derive(Debug, Serialize, Deserialize)]
300pub struct DesktopRunnersArgs {
301 pub actor: User,
302 pub workspace: String,
303}
304
305/// `runner_settings`: members of the workspace, or admins of the
306/// repository. Returns `Outcome<RunnerSettings>`.
307#[derive(Debug, Serialize, Deserialize)]
308pub struct RunnerSettingsArgs {
309 pub actor: User,
310 #[serde(flatten)]
311 pub owner: RunnersOwner,
312}
313
314/// `set_runner_settings`: owners, or admins of the repository. Left out is
315/// unchanged; `inherit` drops a repository's own settings. Returns
316/// `Outcome<RunnerSettings>`.
317#[derive(Debug, Serialize, Deserialize)]
318pub struct SetRunnerSettingsArgs {
319 pub actor: User,
320 #[serde(flatten)]
321 pub owner: RunnersOwner,
322 #[serde(default)]
323 pub agents_on_self_hosted: Option<bool>,
324 #[serde(default)]
325 pub agent_labels: Option<Vec<String>>,
326 #[serde(default)]
327 pub fork_pull_requests: Option<bool>,
328 #[serde(default)]
329 pub inherit: bool,
330}
331
332/// `stuck_jobs`: Mission control's Needs you. Returns `Vec<StuckJob>`.
333#[derive(Debug, Serialize, Deserialize)]
334pub struct StuckJobsArgs {
335 pub viewer: crate::Viewer,
336}
337
338/// `runner_activity`: what runs for a workspace now, on g1t's cloud and
339/// handed to its own runners, for the Runners page. Owners, as the
340/// workspace's runners are. Snake case both ways. Returns
341/// `Outcome<RunnerActivity>`.
342#[derive(Debug, Serialize, Deserialize)]
343pub struct RunnerActivityArgs {
344 pub actor: User,
345 pub workspace: String,
346}
347
348/// A workflow job running in one of g1t's sandboxes.
349#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
350pub struct CloudJob {
351 pub id: String,
352 pub name: String,
353 /// The workflow run it is in.
354 pub run_id: String,
355 /// `owner/name`.
356 pub repo: String,
357 pub started_at: Option<String>,
358}
359
360/// Agent work handed to one of the workspace's own runners, waiting for
361/// one or taken.
362#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
363pub struct HandedOverTask {
364 pub id: String,
365 /// The agent run it is, when the sandbox said; older tasks have none.
366 pub run_id: Option<String>,
367 /// `agent`, `checks`, `review`, `queue`…
368 pub kind: String,
369 pub title: String,
370 /// `owner/name`.
371 pub repo: String,
372 /// `queued` or `in_progress`.
373 pub status: String,
374 pub runner_name: Option<String>,
375 pub created_at: String,
376 pub started_at: Option<String>,
377}
378
379#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
380pub struct RunnerActivity {
381 /// Workflow jobs in g1t's sandboxes now, newest first, at most
382 /// `ACTIVITY_LIMIT`.
383 pub cloud_jobs: Vec<CloudJob>,
384 /// Workflow jobs queued for g1t's sandboxes.
385 pub cloud_jobs_queued: u32,
386 /// Agent work on, or waiting for, the workspace's own runners.
387 pub handed_over: Vec<HandedOverTask>,
388 /// Workflow jobs waiting for one of the workspace's own runners.
389 pub self_hosted_jobs_queued: u32,
390}
391
392/// The most jobs and tasks `runner_activity` lists of each.
393pub const ACTIVITY_LIMIT: u32 = 100;
394
395/// A job that has waited ten minutes or more for a self-hosted runner,
396/// with none that matches online.
397#[derive(Clone, Debug, Serialize, Deserialize)]
398#[serde(rename_all = "camelCase")]
399pub struct StuckJob {
400 pub id: String,
401 pub name: String,
402 pub run_id: String,
403 /// `owner/name`.
404 pub repo: String,
405 /// What it asks for, for people: `self-hosted, linux, gpu`.
406 pub labels: String,
407 pub queued_at: String,
408}
409
410// --- The runner's side (snake_case on the wire, as the API passes it) ------
411
412/// `runner_register`: a machine registering with a registration token.
413/// Returns `Outcome<Registered>`.
414#[derive(Clone, Debug, Default, Serialize, Deserialize)]
415pub struct RegisterArgs {
416 pub token: String,
417 pub name: String,
418 #[serde(default)]
419 pub labels: Vec<String>,
420 pub os: String,
421 pub arch: String,
422 #[serde(default)]
423 pub version: String,
424 #[serde(default)]
425 pub ephemeral: bool,
426 /// A group by name, for a workspace's token; the token's group, else
427 /// the default, if left out.
428 #[serde(default)]
429 pub group: Option<String>,
430 /// Replace a runner of the same name instead of refusing.
431 #[serde(default)]
432 pub replace: bool,
433 /// How the runner keeps work from its machine: `nested-container` (a
434 /// container per job, inside the runner's own sandboxed container),
435 /// `vm` (a throwaway VM per job, native to the machine's OS),
436 /// `container` (a container per job, on a Docker Engine it shares with
437 /// its machine) or `host` (directly on the machine). A `host` runner is
438 /// given no public repository's work ([`isolation_allows`]); older
439 /// runners leave it out.
440 #[serde(default)]
441 pub isolation: Option<String>,
442}
443
444/// The isolation levels a runner may say it has (`RegisterArgs::isolation`).
445pub const ISOLATIONS: &[&str] = &["nested-container", "vm", "container", "host"];
446
447#[derive(Clone, Debug, Serialize, Deserialize)]
448pub struct Registered {
449 pub runner: Runner,
450 /// Shown once; the runner keeps it in its configuration.
451 pub credential: String,
452}
453
454/// Every call a registered runner makes carries its id and credential.
455#[derive(Clone, Debug, Default, Serialize, Deserialize)]
456pub struct RunnerAuth {
457 pub runner: String,
458 pub credential: String,
459}
460
461/// `runner_poll`: waits up to `wait_ms` for work. Doubles as the runner's
462/// heartbeat. Returns `Outcome<Poll>`.
463#[derive(Clone, Debug, Default, Serialize, Deserialize)]
464pub struct PollArgs {
465 #[serde(flatten)]
466 pub auth: RunnerAuth,
467 #[serde(default)]
468 pub version: String,
469 /// What it is running now; it is given nothing more while busy.
470 #[serde(default)]
471 pub running: Vec<String>,
472 #[serde(default)]
473 pub wait_ms: u64,
474 /// How the runner keeps work from its machine now, as at registration
475 /// (`RegisterArgs::isolation`); kept up to date from each poll. Older
476 /// runners leave it out.
477 #[serde(default)]
478 pub isolation: Option<String>,
479}
480
481/// Work for a runner.
482#[derive(Clone, Debug, Serialize, Deserialize)]
483pub struct Assignment {
484 /// `workflow` or `agent`.
485 pub kind: String,
486 pub id: String,
487 pub name: String,
488 pub repo: String,
489 pub timeout_minutes: u32,
490 /// The image to run it in: the job's `container:`, when it names one.
491 pub image: Option<String>,
492 /// A workflow job's own token, for `ACTIONS_JOB`/`ACTIONS_TOKEN`.
493 pub token: Option<String>,
494 /// An agent task's environment, as g1t's sandbox would have been
495 /// started with: `MODE`, the run's short-lived credentials, the model
496 /// proxy's address.
497 pub env: Option<Map<String, Value>>,
498 /// The repository's visibility, `public` or `private`, when g1t knows
499 /// it: a runner that runs work directly on its machine refuses a
500 /// public repository's. Older g1t leaves it out.
501 #[serde(default)]
502 pub visibility: Option<String>,
503}
504
505#[derive(Clone, Debug, Default, Serialize, Deserialize)]
506pub struct Poll {
507 pub assignment: Option<Assignment>,
508 /// Work it holds that it should stop: cancelled, timed out, removed.
509 #[serde(default)]
510 pub cancel: Vec<String>,
511 /// A new credential: it replaces the old, which stops working once this
512 /// one is used.
513 pub credential: Option<String>,
514 /// The runner was removed: stop and forget the credential.
515 #[serde(default)]
516 pub removed: bool,
517}
518
519/// `runner_finished`: a runner telling what became of work it was given.
520/// For a workflow job the harness has normally reported already; this
521/// covers one that crashed or was killed. Returns `Outcome<bool>` (whether
522/// it changed anything).
523#[derive(Clone, Debug, Default, Serialize, Deserialize)]
524pub struct FinishedArgs {
525 #[serde(flatten)]
526 pub auth: RunnerAuth,
527 pub id: String,
528 pub exit_code: i32,
529 #[serde(default)]
530 pub reason: Option<String>,
531}
532
533/// `runner_remove_self`: `g1t-runner remove`. Returns `Outcome<bool>`.
534#[derive(Clone, Debug, Default, Serialize, Deserialize)]
535pub struct RemoveSelfArgs {
536 #[serde(flatten)]
537 pub auth: RunnerAuth,
538}
539
540// --- Between services (camelCase, as every service speaks) ----------------
541
542/// `runner_route`: whether a kind of g1t's own work in a repository runs on
543/// self-hosted runners, and on which labels. Asked by the runner service
544/// before it starts a sandbox. Returns `Option<Vec<String>>`.
545#[derive(Clone, Debug, Serialize, Deserialize)]
546#[serde(rename_all = "camelCase")]
547pub struct RouteArgs {
548 pub workspace: String,
549 pub repo: RepoPath,
550}
551
552/// `enqueue_task`: agent work for a self-hosted runner, from the runner
553/// service's sandbox (`sandbox` is its Durable Object's id), which is told
554/// with `task_ended` how it went. Returns `Outcome<String>` (the task's id).
555#[derive(Clone, Debug, Serialize, Deserialize)]
556#[serde(rename_all = "camelCase")]
557pub struct EnqueueTaskArgs {
558 pub sandbox: String,
559 pub workspace: String,
560 pub repo: RepoPath,
561 /// The run kind: `agent`, `checks`, `review`, `queue`…
562 pub kind: String,
563 pub title: String,
564 pub labels: Vec<String>,
565 pub env: Map<String, Value>,
566 pub timeout_minutes: u32,
567 /// The agent run the work belongs to, when the sandbox opened one: what
568 /// people's pages link a runner's agent work to.
569 #[serde(default, alias = "run_id")]
570 pub run_id: Option<String>,
571}
572
573/// `cancel_task`: the sandbox's work stopped from g1t's side (a person, a
574/// time cap). Returns `Outcome<bool>`.
575#[derive(Clone, Debug, Serialize, Deserialize)]
576#[serde(rename_all = "camelCase")]
577pub struct CancelTaskArgs {
578 pub sandbox: String,
579 #[serde(default)]
580 pub reason: Option<String>,
581}
582
583// --- Labels ----------------------------------------------------------------
584
585/// A label as it is kept: trimmed and lowercase. `None` when it is not
586/// one: empty, too long, or with characters other than letters, digits,
587/// `-`, `_`, `.`, `:` and `/`.
588pub fn clean_label(label: &str) -> Option<String> {
589 let label = label.trim().to_ascii_lowercase();
590 let ok = !label.is_empty()
591 && label.len() <= MAX_LABEL_LEN
592 && label.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.' | ':' | '/'));
593 ok.then_some(label)
594}
595
596/// A runner's labels: what it was given, cleaned, with `self-hosted`, its
597/// OS and its architecture, each once, in that order first.
598pub fn runner_labels(given: &[String], os: &str, arch: &str) -> Result<Vec<String>, String> {
599 let mut labels: Vec<String> = Vec::new();
600 for label in [SELF_HOSTED, os, arch].iter().map(|s| s.to_string()).chain(given.iter().cloned()) {
601 let Some(clean) = clean_label(&label) else {
602 return Err(format!("`{label}` is not a label: use letters, digits, `-`, `_`, `.`, `:` and `/`, up to {MAX_LABEL_LEN} characters."));
603 };
604 if !labels.contains(&clean) {
605 labels.push(clean);
606 }
607 }
608 if labels.len() > MAX_LABELS {
609 return Err(format!("A runner has at most {MAX_LABELS} labels."));
610 }
611 Ok(labels)
612}
613
614/// The OS a runner reports, as its label: `linux`, `macos` or `windows`.
615pub fn os_label(os: &str) -> Option<&'static str> {
616 match os.trim().to_ascii_lowercase().as_str() {
617 "linux" => Some("linux"),
618 "macos" | "darwin" | "osx" | "mac" => Some("macos"),
619 "windows" | "win" => Some("windows"),
620 _ => None,
621 }
622}
623
624/// The architecture a runner reports, as its label: `x64` or `arm64`.
625pub fn arch_label(arch: &str) -> Option<&'static str> {
626 match arch.trim().to_ascii_lowercase().as_str() {
627 "x64" | "x86_64" | "amd64" => Some("x64"),
628 "arm64" | "aarch64" => Some("arm64"),
629 _ => None,
630 }
631}
632
633/// What a job's `runs-on` asks for, read for self-hosted runners: its
634/// labels, cleaned, and the group it names. `self_hosted` when it names
635/// `self-hosted` or a group, which only self-hosted runners can satisfy.
636#[derive(Clone, Debug, Default, PartialEq, Eq)]
637pub struct Wanted {
638 pub labels: Vec<String>,
639 pub group: Option<String>,
640 pub self_hosted: bool,
641}
642
643impl Wanted {
644 pub fn of(labels: &[String], group: Option<&str>) -> Wanted {
645 let mut out: Vec<String> = Vec::new();
646 for label in labels {
647 let clean = label.trim().to_ascii_lowercase();
648 if !clean.is_empty() && !out.contains(&clean) {
649 out.push(clean);
650 }
651 }
652 let group = group.map(|g| g.trim().to_owned()).filter(|g| !g.is_empty());
653 let self_hosted = group.is_some() || out.iter().any(|l| l == SELF_HOSTED);
654 Wanted { labels: out, group, self_hosted }
655 }
656
657 /// The job's labels as stored on it: its labels, then `group:<name>`.
658 pub fn stored(&self) -> Vec<String> {
659 let mut out = self.labels.clone();
660 if let Some(group) = &self.group {
661 out.push(format!("group:{}", group.to_ascii_lowercase()));
662 }
663 out
664 }
665
666 /// Back from what [`Wanted::stored`] kept.
667 pub fn from_stored(stored: &[String]) -> Wanted {
668 let group = stored.iter().find_map(|l| l.strip_prefix("group:").map(str::to_owned));
669 let labels: Vec<String> = stored.iter().filter(|l| !l.starts_with("group:")).cloned().collect();
670 Wanted::of(&labels, group.as_deref())
671 }
672
673 /// Whether a runner with `labels`, in the group called `group`, can
674 /// take it: every label it asks for, and its group if it names one.
675 pub fn matches(&self, labels: &[String], group: Option<&str>) -> bool {
676 let has = |wanted: &String| labels.iter().any(|l| l.eq_ignore_ascii_case(wanted));
677 let group_ok = match (&self.group, group) {
678 (None, _) => true,
679 (Some(wanted), Some(group)) => wanted.eq_ignore_ascii_case(group),
680 (Some(_), None) => false,
681 };
682 group_ok && self.labels.iter().all(has)
683 }
684
685 /// For people: `self-hosted, linux, gpu` (in group `build`).
686 pub fn describe(&self) -> String {
687 let labels = self.labels.join(", ");
688 match &self.group {
689 Some(group) if labels.is_empty() => format!("in group {group}"),
690 Some(group) => format!("{labels} in group {group}"),
691 None => labels,
692 }
693 }
694}
695
696/// What a public repository's job says while the only runners that could
697/// take it run jobs directly on their machines (`host` isolation), which
698/// are never given a public repository's work.
699pub const WAITING_FOR_SANDBOX: &str =
700 "Waiting for a sandboxed runner: this repository is public, and host-mode runners don't run public repositories' jobs.";
701
702/// Whether a runner of `isolation` may be given a repository's work, by
703/// its visibility (`public` or `private`; unknown lets it through, and the
704/// runner decides). A host-mode runner takes no public repository's work.
705pub fn isolation_allows(isolation: Option<&str>, visibility: Option<&str>) -> bool {
706 !(isolation == Some("host") && visibility == Some("public"))
707}
708
709/// What a job waiting for a runner says.
710pub fn waiting_reason(wanted: &Wanted) -> String {
711 format!("Waiting for a self-hosted runner with labels {}.", wanted.describe())
712}
713
714#[cfg(test)]
715mod tests {
716 use super::*;
717
718 fn strings(items: &[&str]) -> Vec<String> {
719 items.iter().map(|s| s.to_string()).collect()
720 }
721
722 #[test]
723 fn a_host_mode_runner_takes_no_public_repositorys_work() {
724 assert!(!isolation_allows(Some("host"), Some("public")));
725 assert!(isolation_allows(Some("host"), Some("private")));
726 assert!(isolation_allows(Some("host"), None));
727 assert!(isolation_allows(Some("container"), Some("public")));
728 assert!(isolation_allows(None, Some("public")), "an older runner decides itself");
729 let poll: PollArgs = serde_json::from_value(serde_json::json!({ "runner": "rnr_1", "credential": "c" })).unwrap();
730 assert_eq!(poll.isolation, None, "an older runner's poll");
731 }
732
733 #[test]
734 fn a_runner_always_has_self_hosted_its_os_and_its_arch() {
735 let labels = runner_labels(&strings(&["GPU", "gpu", " cuda-12 "]), "linux", "x64").unwrap();
736 assert_eq!(labels, strings(&["self-hosted", "linux", "x64", "gpu", "cuda-12"]));
737 assert!(runner_labels(&strings(&["has space"]), "linux", "x64").is_err());
738 assert!(runner_labels(&strings(&[""]), "linux", "x64").is_err());
739 }
740
741 #[test]
742 fn os_and_arch_are_read_as_people_write_them() {
743 assert_eq!(os_label("Darwin"), Some("macos"));
744 assert_eq!(os_label("Windows"), Some("windows"));
745 assert_eq!(os_label("plan9"), None);
746 assert_eq!(arch_label("x86_64"), Some("x64"));
747 assert_eq!(arch_label("aarch64"), Some("arm64"));
748 assert_eq!(arch_label("mips"), None);
749 }
750
751 #[test]
752 fn a_job_names_self_hosted_or_a_group_to_need_one() {
753 assert!(Wanted::of(&strings(&["Self-Hosted", "linux"]), None).self_hosted);
754 assert!(Wanted::of(&strings(&[]), Some("build")).self_hosted);
755 assert!(!Wanted::of(&strings(&["ubuntu-latest"]), None).self_hosted);
756 }
757
758 #[test]
759 fn every_label_the_job_names_must_be_the_runners() {
760 let runner = strings(&["self-hosted", "linux", "x64", "gpu"]);
761 assert!(Wanted::of(&strings(&["self-hosted"]), None).matches(&runner, Some("default")));
762 assert!(Wanted::of(&strings(&["self-hosted", "LINUX", "gpu"]), None).matches(&runner, None));
763 assert!(!Wanted::of(&strings(&["self-hosted", "linux", "arm64"]), None).matches(&runner, None));
764 assert!(!Wanted::of(&strings(&["self-hosted", "windows"]), None).matches(&runner, None));
765 }
766
767 #[test]
768 fn a_group_is_matched_by_name() {
769 let runner = strings(&["self-hosted", "linux", "x64"]);
770 let wanted = Wanted::of(&strings(&["linux"]), Some("Build"));
771 assert!(wanted.matches(&runner, Some("build")));
772 assert!(!wanted.matches(&runner, Some("default")));
773 assert!(!wanted.matches(&runner, None));
774 assert_eq!(Wanted::from_stored(&wanted.stored()), wanted.clone().tap_lower());
775 }
776
777 impl Wanted {
778 fn tap_lower(mut self) -> Wanted {
779 self.group = self.group.map(|g| g.to_ascii_lowercase());
780 self
781 }
782 }
783
784 #[test]
785 fn waiting_says_for_what() {
786 let wanted = Wanted::of(&strings(&["self-hosted", "linux", "gpu"]), None);
787 assert_eq!(waiting_reason(&wanted), "Waiting for a self-hosted runner with labels self-hosted, linux, gpu.");
788 }
789
790 #[test]
791 fn the_runners_wire_is_snake_case() {
792 let poll: PollArgs = serde_json::from_value(serde_json::json!({
793 "runner": "rnr_1", "credential": "g1tr_x", "version": "0.1.0", "running": ["job_1"], "wait_ms": 1000
794 }))
795 .unwrap();
796 assert_eq!(poll.auth.runner, "rnr_1");
797 assert_eq!(poll.wait_ms, 1000);
798 let assignment = serde_json::to_value(Assignment {
799 kind: "workflow".into(),
800 id: "job_1".into(),
801 name: "build".into(),
802 repo: "acme/web".into(),
803 timeout_minutes: 60,
804 image: None,
805 token: Some("t".into()),
806 env: None,
807 visibility: Some("private".into()),
808 })
809 .unwrap();
810 assert_eq!(assignment["timeout_minutes"], 60);
811 assert_eq!(assignment["visibility"], "private");
812 // An older runner's registration, without an isolation level.
813 let register: RegisterArgs = serde_json::from_value(serde_json::json!({ "token": "g1trt_x", "name": "a", "os": "linux", "arch": "x64" })).unwrap();
814 assert_eq!(register.isolation, None);
815 }
816}