Skip to content
Sign in

flagon-io/g1t

public
0

g1t/crates/runner/src/actions/uses.rs

405 lines20,458 bytesCodeBlame
1//! `uses:` steps: `actions/checkout` done natively against g1t, actions
2//! fetched from GitHub and run as they are (JavaScript and composite), and
3//! a few of GitHub's own whose services g1t does not have yet.
4
5use std::collections::BTreeMap;
6use std::path::{Path, PathBuf};
7use std::process::Command;
8use std::time::Duration;
9
10use base64::Engine;
11use base64::engine::general_purpose::STANDARD;
12use g1t_actions::expr;
13use g1t_actions::workflow::yaml_to_json;
14use serde_json::{Map, Value, json};
15
16use super::files::StepFiles;
17use super::process::{self, Commands, Ended};
18use super::{Frame, Job, Post, PostRun};
19
20const ACTIONS_DIR: &str = "/home/runner/_actions";
21
22/// Where an action comes from.
23enum Source {
24 Local(PathBuf),
25 GitHub { owner: String, repo: String, path: String, git_ref: String },
26}
27
28fn safe(part: &str) -> bool {
29 !part.is_empty() && part.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.' | '/')) && !part.contains("..")
30}
31
32impl Job {
33 /// Runs a git command, logging it; the credential header is never logged.
34 fn git(&mut self, dir: &Path, args: &[&str], auth: Option<&str>) -> bool {
35 let shown: Vec<&str> = args.to_vec();
36 self.log.line(&format!("[command]git {}", shown.join(" ")));
37 let mut command = Command::new("git");
38 command.current_dir(dir);
39 if let Some(header) = auth {
40 command.args(["-c", &format!("http.extraheader={header}")]);
41 }
42 command.args(args).env("GIT_TERMINAL_PROMPT", "0");
43 let mut commands = Commands::default();
44 matches!(process::run(command, Duration::from_secs(600), &mut self.log, &mut commands), Ok(Ended::Exited(0)))
45 }
46
47 /// A fetch, tried again after a short wait when it fails: a transfer
48 /// cut short on the way ("transfer closed with N bytes remaining") is
49 /// over by the next try. Three tries in all, as actions/checkout does.
50 fn fetch_retrying(&mut self, dir: &Path, args: &[&str], auth: Option<&str>) -> bool {
51 for (attempt, wait) in [0u64, 2, 5].into_iter().enumerate() {
52 if attempt > 0 {
53 self.log.line(&format!("The fetch failed; trying again in {wait} s ({} of 3).", attempt + 1));
54 std::thread::sleep(Duration::from_secs(wait));
55 }
56 if self.git(dir, args, auth) {
57 return true;
58 }
59 }
60 false
61 }
62
63 /// `actions/checkout`, against g1t.
64 fn checkout(&mut self, with: &BTreeMap<String, String>) -> (bool, BTreeMap<String, String>) {
65 let checkout = self.spec["checkout"].clone();
66 let own = checkout["repository"].as_str().unwrap_or_default().to_owned();
67 let server = self.contexts["github"]["server_url"].as_str().unwrap_or("https://g1t.sh").to_owned();
68 let repository = with.get("repository").filter(|r| !r.is_empty()).cloned().unwrap_or(own.clone());
69 let same = repository.eq_ignore_ascii_case(&own);
70 let token = with.get("token").filter(|t| !t.is_empty()).cloned().or_else(|| checkout["token"].as_str().map(str::to_owned)).unwrap_or_default();
71 let url = if same { checkout["url"].as_str().unwrap_or_default().to_owned() } else { format!("{server}/{repository}.git") };
72 let path = with.get("path").filter(|p| !p.is_empty()).map_or(self.workspace.clone(), |p| self.workspace.join(p));
73 let depth: u32 = with.get("fetch-depth").and_then(|d| d.parse().ok()).unwrap_or(1);
74 let wanted_ref = with.get("ref").filter(|r| !r.is_empty()).cloned();
75 let auth = (!token.is_empty()).then(|| format!("AUTHORIZATION: basic {}", STANDARD.encode(format!("x-access-token:{token}"))));
76
77 self.log.line(&format!("Checking out {repository} into {}", path.display()));
78 if path.exists() {
79 let _ = std::fs::remove_dir_all(&path);
80 }
81 if let Err(error) = std::fs::create_dir_all(&path) {
82 self.log.line(&format!("##[error]Could not make {}: {error}", path.display()));
83 return (false, BTreeMap::new());
84 }
85 let _ = Command::new("git").args(["config", "--global", "--add", "safe.directory", "*"]).status();
86 if !self.git(&path, &["init", "--quiet"], None) || !self.git(&path, &["remote", "add", "origin", &url], None) {
87 return (false, BTreeMap::new());
88 }
89
90 // What to fetch, and which commit to end up on.
91 let run_ref = checkout["ref"].as_str().unwrap_or_default().to_owned();
92 let run_sha = checkout["sha"].as_str().unwrap_or_default().to_owned();
93 let is_sha = |r: &str| r.len() == 40 && r.chars().all(|c| c.is_ascii_hexdigit());
94 let (fetch, sha, branch): (String, Option<String>, Option<String>) = match &wanted_ref {
95 Some(r) if is_sha(r) => ("HEAD".into(), Some(r.clone()), None),
96 Some(r) if r.starts_with("refs/") => (r.clone(), None, r.strip_prefix("refs/heads/").map(str::to_owned)),
97 Some(r) => (r.clone(), None, Some(r.clone())),
98 None if same && run_ref.starts_with("refs/pull/") => ("HEAD".into(), Some(run_sha.clone()), None),
99 None if same => (run_ref.clone(), Some(run_sha.clone()), run_ref.strip_prefix("refs/heads/").map(str::to_owned)),
100 None => ("HEAD".into(), None, None),
101 };
102 let depth_arg = format!("--depth={depth}");
103 let mut args = vec!["fetch", "--no-tags", "--prune", "--quiet"];
104 if depth > 0 {
105 args.push(&depth_arg);
106 }
107 if with.get("fetch-tags").is_some_and(|t| t == "true") {
108 args.retain(|a| *a != "--no-tags");
109 }
110 args.push("origin");
111 args.push(&fetch);
112 if !self.fetch_retrying(&path, &args, auth.as_deref()) {
113 self.log.line(&format!("##[error]Could not fetch {fetch} from {repository}."));
114 return (false, BTreeMap::new());
115 }
116 let target = sha.clone().unwrap_or_else(|| "FETCH_HEAD".into());
117 // The commit may be further back than a shallow fetch reaches: the
118 // branch moved on after the run began, say. Ask for the commit
119 // itself, and failing that the whole history; a plain fetch never
120 // reaches past a shallow boundary.
121 let has = |target: &str| Command::new("git").current_dir(&path).args(["cat-file", "-e", &format!("{target}^{{commit}}")]).status().is_ok_and(|s| s.success());
122 if !has(&target) {
123 let by_sha = sha.as_deref().is_some_and(|sha| {
124 let mut args = vec!["fetch", "--no-tags", "--quiet"];
125 if depth > 0 {
126 args.push(&depth_arg);
127 }
128 args.extend(["origin", sha]);
129 self.git(&path, &args, auth.as_deref()) && has(sha)
130 });
131 let shallow = path.join(".git").join("shallow").exists();
132 let deepen: &[&str] = if shallow { &["fetch", "--no-tags", "--quiet", "--unshallow", "origin"] } else { &["fetch", "--no-tags", "--quiet", "origin"] };
133 if !by_sha && !self.fetch_retrying(&path, deepen, auth.as_deref()) {
134 return (false, BTreeMap::new());
135 }
136 }
137 let checked_out = match &branch {
138 Some(branch) => self.git(&path, &["checkout", "--quiet", "--force", "-B", branch, &target], None),
139 None => self.git(&path, &["checkout", "--quiet", "--force", "--detach", &target], None),
140 };
141 if !checked_out {
142 return (false, BTreeMap::new());
143 }
144 if with.get("persist-credentials").is_none_or(|p| p != "false")
145 && let Some(header) = &auth
146 {
147 let key = format!("http.{server}/.extraheader");
148 let _ = Command::new("git").current_dir(&path).args(["config", "--local", &key, header]).status();
149 }
150 if let Some(submodules) = with.get("submodules").filter(|s| *s == "true" || *s == "recursive") {
151 let mut args = vec!["submodule", "update", "--init", "--quiet"];
152 if submodules == "recursive" {
153 args.push("--recursive");
154 }
155 if !self.git(&path, &args, auth.as_deref()) {
156 self.log.line("##[warning]Submodules could not all be checked out; only those hosted on g1t can be.");
157 }
158 }
159 if with.get("lfs").is_some_and(|l| l == "true") {
160 self.log.line("##[warning]Git LFS files are not fetched on g1t yet.");
161 }
162 let commit = Command::new("git").current_dir(&path).args(["rev-parse", "HEAD"]).output().ok().map(|o| String::from_utf8_lossy(&o.stdout).trim().to_owned()).unwrap_or_default();
163 self.log.line(&format!("Checked out {commit}"));
164 let mut outputs = BTreeMap::new();
165 outputs.insert("ref".into(), wanted_ref.unwrap_or(run_ref));
166 outputs.insert("commit".into(), commit);
167 (true, outputs)
168 }
169
170 /// Fetches an action from GitHub, once per job.
171 fn fetch_action(&mut self, owner: &str, repo: &str, git_ref: &str) -> Option<PathBuf> {
172 let dir = super::paths::under_home(ACTIONS_DIR).join(owner).join(repo).join(git_ref);
173 if dir.join(".g1t-fetched").exists() {
174 return Some(dir);
175 }
176 if !(safe(owner) && safe(repo) && safe(git_ref)) {
177 self.log.line(&format!("##[error]`{owner}/{repo}@{git_ref}` is not a name g1t can fetch."));
178 return None;
179 }
180 self.log.line(&format!("Download action repository '{owner}/{repo}@{git_ref}'"));
181 let _ = std::fs::create_dir_all(&dir);
182 let url = format!("https://codeload.github.com/{owner}/{repo}/tar.gz/{git_ref}");
183 let script = format!("set -o pipefail; curl -fsSL --retry 3 '{url}' | tar -xz -C '{}' --strip-components=1", dir.display());
184 let mut command = Command::new("bash");
185 command.args(["-c", &script]);
186 let mut commands = Commands::default();
187 match process::run(command, Duration::from_secs(300), &mut self.log, &mut commands) {
188 Ok(Ended::Exited(0)) => {
189 let _ = std::fs::write(dir.join(".g1t-fetched"), "");
190 Some(dir)
191 }
192 _ => {
193 self.log.line(&format!("##[error]Could not download {owner}/{repo}@{git_ref} from GitHub."));
194 let _ = std::fs::remove_dir_all(&dir);
195 None
196 }
197 }
198 }
199
200 /// Runs a JavaScript file of an action with Node.
201 pub(crate) fn run_node(&mut self, action_dir: &Path, script: &str, env: &BTreeMap<String, String>) -> bool {
202 let id = format!("node{}", super::rand_id());
203 let Ok(files) = StepFiles::new(&self.temp, &id) else { return false };
204 let mut command = Command::new("node");
205 command.arg(action_dir.join(script)).current_dir(&self.workspace).env_clear().envs(self.process_env(env, &files));
206 let mut commands = Commands {
207 debug: false,
208 ..Commands::default()
209 };
210 let ended = process::run(command, Duration::from_secs(6 * 3600).min(self.deadline_left()), &mut self.log, &mut commands);
211 let ok = matches!(ended, Ok(Ended::Exited(0)));
212 if let Ok(Ended::Exited(code)) = ended
213 && code != 0
214 {
215 self.log.line(&format!("##[error]The action exited with code {code}."));
216 }
217 let (outputs, state) = self.absorb(&files, &commands);
218 self.last_node_outputs = outputs;
219 self.last_node_state = state;
220 ok
221 }
222
223 fn deadline_left(&self) -> Duration {
224 self.remaining_time()
225 }
226
227 /// Runs a `uses:` step. Returns whether it succeeded, and its outputs.
228 #[allow(clippy::too_many_arguments)]
229 pub(crate) fn uses(
230 &mut self,
231 uses: &str,
232 with: &BTreeMap<String, String>,
233 env: &BTreeMap<String, String>,
234 frame: &Frame,
235 title: &str,
236 id: Option<&str>,
237 _timeout: Duration,
238 ) -> (bool, BTreeMap<String, String>) {
239 let uses = uses.trim();
240 if uses.starts_with("docker://") {
241 self.log.line(&format!("##[error]`{uses}`: Docker actions do not run on g1t yet."));
242 return (false, BTreeMap::new());
243 }
244 let (name, git_ref) = uses.split_once('@').unwrap_or((uses, ""));
245 let lower = name.to_ascii_lowercase();
246 match lower.as_str() {
247 "actions/checkout" => return self.checkout(with),
248 "actions/upload-artifact" => return self.upload_artifact(with),
249 "actions/download-artifact" => return self.download_artifact(with),
250 "actions/cache" => return self.cache(with, true, title),
251 "actions/cache/restore" => return self.cache(with, false, title),
252 "actions/cache/save" => return self.cache_save_now(with),
253 _ => {}
254 }
255 let source = if let Some(local) = name.strip_prefix("./") {
256 // A repository moved from GitHub renamed `.github` to `.g1t`, but
257 // its workflows still say `./.github/actions/…`.
258 let mut dir = self.workspace.join(local);
259 if let Some(rest) = local.strip_prefix(".github/")
260 && !dir.exists()
261 {
262 dir = self.workspace.join(".g1t").join(rest);
263 }
264 Source::Local(dir)
265 } else {
266 let mut parts = name.splitn(3, '/');
267 let (Some(owner), Some(repo)) = (parts.next(), parts.next()) else {
268 self.log.line(&format!("##[error]`{uses}` is not an action: use owner/repo@ref, owner/repo/path@ref, or ./path."));
269 return (false, BTreeMap::new());
270 };
271 if git_ref.is_empty() {
272 self.log.line(&format!("##[error]`{uses}` needs a version, such as @v4."));
273 return (false, BTreeMap::new());
274 }
275 Source::GitHub {
276 owner: owner.to_owned(),
277 repo: repo.to_owned(),
278 path: parts.next().unwrap_or_default().to_owned(),
279 git_ref: git_ref.to_owned(),
280 }
281 };
282 let (dir, repository) = match &source {
283 Source::Local(dir) => (dir.clone(), String::new()),
284 Source::GitHub { owner, repo, path, git_ref } => match self.fetch_action(owner, repo, git_ref) {
285 Some(root) => (if path.is_empty() { root } else { root.join(path) }, format!("{owner}/{repo}")),
286 None => return (false, BTreeMap::new()),
287 },
288 };
289 let manifest = ["action.yml", "action.yaml"].iter().map(|f| dir.join(f)).find(|p| p.exists());
290 let Some(manifest) = manifest else {
291 self.log.line(&format!("##[error]`{uses}` has no action.yml."));
292 return (false, BTreeMap::new());
293 };
294 let action = match std::fs::read_to_string(&manifest).ok().and_then(|text| serde_yaml::from_str::<serde_yaml::Value>(&text).ok()) {
295 Some(yaml) => yaml_to_json(&yaml),
296 None => {
297 self.log.line(&format!("##[error]`{uses}`: its action.yml does not read."));
298 return (false, BTreeMap::new());
299 }
300 };
301
302 // Inputs: what the step gives, else the action's defaults.
303 let env_context = env.clone();
304 let contexts = self.contexts_for(frame, &env_context);
305 let mut inputs: BTreeMap<String, String> = BTreeMap::new();
306 if let Some(Value::Object(declared)) = action.get("inputs") {
307 for (input, spec) in declared {
308 let given = with.iter().find(|(k, _)| k.eq_ignore_ascii_case(input)).map(|(_, v)| v.clone());
309 let value = match given {
310 Some(value) => value,
311 None => match spec.get("default") {
312 Some(default) => {
313 let default = self.with_scope(&contexts, |scope| expr::interpolate_value(default, scope)).unwrap_or(Value::Null);
314 expr::to_text(&default)
315 }
316 None => String::new(),
317 },
318 };
319 inputs.insert(input.clone(), value);
320 }
321 }
322 for (key, value) in with {
323 if !inputs.keys().any(|k| k.eq_ignore_ascii_case(key)) {
324 inputs.insert(key.clone(), value.clone());
325 }
326 }
327
328 let runs = action.get("runs").cloned().unwrap_or(Value::Null);
329 let using = runs.get("using").map(expr::to_text).unwrap_or_default().to_ascii_lowercase();
330 let mut step_env = env.clone();
331 step_env.insert("GITHUB_ACTION".into(), id.map_or_else(|| format!("__{}", repository.replace('/', "_")), str::to_owned));
332 step_env.insert("GITHUB_ACTION_REPOSITORY".into(), repository.clone());
333 step_env.insert("GITHUB_ACTION_REF".into(), git_ref.to_owned());
334 step_env.insert("GITHUB_ACTION_PATH".into(), dir.display().to_string());
335
336 if using.starts_with("node") {
337 for (input, value) in &inputs {
338 step_env.insert(format!("INPUT_{}", input.replace(' ', "_").to_ascii_uppercase()), value.clone());
339 }
340 let condition_of = |key: &str| runs.get(key).map(expr::to_text).unwrap_or_else(|| "always()".into());
341 if let Some(pre) = runs.get("pre").map(expr::to_text) {
342 let run_pre = self.with_scope(&contexts, |scope| expr::condition(&condition_of("pre-if"), scope)).unwrap_or(true);
343 if run_pre && !self.run_node(&dir, &pre, &step_env) {
344 return (false, BTreeMap::new());
345 }
346 }
347 let Some(main) = runs.get("main").map(expr::to_text) else {
348 self.log.line(&format!("##[error]`{uses}` has no `runs.main`."));
349 return (false, BTreeMap::new());
350 };
351 let ok = self.run_node(&dir, &main, &step_env);
352 let outputs = std::mem::take(&mut self.last_node_outputs);
353 let state = std::mem::take(&mut self.last_node_state);
354 if let Some(post) = runs.get("post").map(expr::to_text) {
355 let mut post_env = step_env.clone();
356 for (name, value) in state {
357 post_env.insert(format!("STATE_{name}"), value);
358 }
359 self.posts.push(Post {
360 name: format!("Post {title}"),
361 condition: condition_of("post-if"),
362 env: post_env,
363 run: PostRun::Node { action_dir: dir.clone(), script: post },
364 });
365 }
366 return (ok, outputs);
367 }
368 if using == "composite" {
369 let mut inner = Frame {
370 steps: Map::new(),
371 inputs: Some(Value::Object(inputs.iter().map(|(k, v)| (k.clone(), json!(v))).collect())),
372 action_path: Some(dir.display().to_string()),
373 env: env.clone(),
374 };
375 let steps: Vec<Map<String, Value>> = runs.get("steps").and_then(Value::as_array).map(|s| s.iter().filter_map(|s| s.as_object().cloned()).collect()).unwrap_or_default();
376 let was_failed = self.failed;
377 // A composite's steps see their own success, not the job's.
378 self.failed = false;
379 let mut ok = true;
380 for step in &steps {
381 if !self.step(&mut inner, step, 0, false, &Map::new()) {
382 ok = false;
383 }
384 }
385 let contexts = self.contexts_for(&inner, &inner.env.clone());
386 let mut outputs = BTreeMap::new();
387 if let Some(Value::Object(declared)) = action.get("outputs") {
388 for (name, spec) in declared {
389 if let Some(value) = spec.get("value") {
390 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
391 outputs.insert(name.clone(), expr::to_text(&value));
392 }
393 }
394 }
395 self.failed = was_failed;
396 return (ok, outputs);
397 }
398 if using == "docker" {
399 self.log.line(&format!("##[error]`{uses}` is a Docker action, which does not run on g1t yet."));
400 return (false, BTreeMap::new());
401 }
402 self.log.line(&format!("##[error]`{uses}` runs with `{using}`, which g1t does not know."));
403 (false, BTreeMap::new())
404 }
405}