Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
1,488 linesCodeBlameRaw
1//! Runs one GitHub Actions job, as GitHub's runner would: its steps in
2//! order, each `run` in a shell and each `uses` as the action it names,
3//! with the `${{ }}` contexts, the `GITHUB_*` variables and files, and the
4//! workflow commands steps print. It reports every step and the log to
5//! g1t as it goes.
6//!
7//! Configuration comes from the environment: `G1T_API`, and `ACTIONS_JOB`
8//! and `ACTIONS_TOKEN`, the job and its own token. Everything else, the
9//! job's definition, its contexts and its secrets, is fetched with them.
10
11mod blobs;
12mod broker;
13mod containers;
14mod files;
15mod glob;
16mod matchers;
17mod paths;
18mod process;
19mod report;
20mod uses;
21pub(crate) mod zip;
22
23use std::collections::{BTreeMap, BTreeSet};
24use std::path::{Path, PathBuf};
25use std::process::Command;
26use std::time::{Duration, Instant};
27
28use anyhow::{Context, Result};
29use g1t_actions::events::WORKSPACE;
30use g1t_actions::expr::{self, Scope, Status};
31use serde_json::{Map, Value, json};
32
33use files::StepFiles;
34use process::{Commands, Ended};
35use report::{Api, Log};
36
37const TEMP: &str = "/home/runner/_temp";
38/// Set to `1` by the self-hosted runner: the job's token is spent on its
39/// spec, and the harness carries on with the one that replaces it
40/// (`report::Api::spec`). A `G1T_` variable, so no step sees it.
41pub(crate) const ROTATE_TOKEN: &str = "G1T_ROTATE_JOB_TOKEN";
42
43/// Who is running steps: the job itself, or a composite action inside it.
44#[derive(Clone, Default)]
45pub(crate) struct Frame {
46 /// The `steps` context.
47 pub(crate) steps: Map<String, Value>,
48 /// A composite action's `inputs`, in place of the workflow's.
49 pub(crate) inputs: Option<Value>,
50 /// A composite action's folder, for `github.action_path`.
51 pub(crate) action_path: Option<String>,
52 /// Variables a composite action's caller set for its steps.
53 pub(crate) env: BTreeMap<String, String>,
54}
55
56/// A step run when the job's steps are done: an action's `post`, or
57/// saving the cache.
58pub(crate) struct Post {
59 pub(crate) name: String,
60 pub(crate) condition: String,
61 pub(crate) env: BTreeMap<String, String>,
62 pub(crate) run: PostRun,
63}
64
65pub(crate) enum PostRun {
66 Node { action_dir: PathBuf, script: String, using: String },
67 /// A Docker action's `post-entrypoint`.
68 Docker(containers::DockerRun),
69}
70
71pub(crate) struct Job {
72 pub(crate) log: Log,
73 pub(crate) spec: Value,
74 pub(crate) workspace: PathBuf,
75 pub(crate) temp: PathBuf,
76 /// This process's own variables, less its credentials, and GitHub's.
77 base_env: BTreeMap<String, String>,
78 /// Written to `GITHUB_ENV` by earlier steps.
79 added_env: BTreeMap<String, String>,
80 /// Written to `GITHUB_PATH` by earlier steps, newest first.
81 path_prepend: Vec<String>,
82 workflow_env: BTreeMap<String, String>,
83 job_env: BTreeMap<String, String>,
84 /// github, vars, secrets, inputs, matrix, needs, strategy, runner.
85 pub(crate) contexts: Map<String, Value>,
86 pub(crate) failed: bool,
87 pub(crate) posts: Vec<Post>,
88 step_names: Vec<String>,
89 deadline: Instant,
90 /// The running step's `timeout-minutes`, as an instant: the nearest of
91 /// the step's own and those of the steps around it (a composite
92 /// action's step inside a `uses:` step). Every process a step starts
93 /// stops by it, as every one stops by the job's deadline.
94 step_deadline: Option<Instant>,
95 debug: bool,
96 /// What the last Node process left, for the step that ran it.
97 pub(crate) last_node_outputs: BTreeMap<String, String>,
98 pub(crate) last_node_state: BTreeMap<String, String>,
99 /// What each action's `pre` saved, by its step's `GITHUB_ACTION`, for
100 /// the step's main and post.
101 pub(crate) pre_state: BTreeMap<String, BTreeMap<String, String>>,
102 /// The names of the sandbox's own variables, which a container does
103 /// not get.
104 host_env: BTreeSet<String>,
105 /// Whether this job has a Docker Engine of its own (g1t's machines).
106 pub(crate) docker_hosted: bool,
107 /// The job's network, once its containers have one.
108 pub(crate) network: Option<String>,
109 /// `services:`, by their names, and their containers' names.
110 pub(crate) services: Vec<(String, String)>,
111 /// `container:`, once started.
112 pub(crate) container: Option<containers::JobContainer>,
113 /// The `job` context's `container` and `services`.
114 pub(crate) job_context: Map<String, Value>,
115 /// Docker actions' images built in this job.
116 pub(crate) built_actions: containers::Built,
117 /// `RUNNER_TRACKING_ID`, which every process a step starts inherits.
118 tracking_id: String,
119 /// Why the job's brokered secrets will not be filled in, when its
120 /// proxy could not start (broker.rs), for "Set up job".
121 broker_problem: Option<String>,
122}
123
124fn text_map(value: Option<&Value>) -> BTreeMap<String, String> {
125 value
126 .and_then(Value::as_object)
127 .map(|map| map.iter().map(|(k, v)| (k.clone(), expr::to_text(v))).collect())
128 .unwrap_or_default()
129}
130
131/// Where `name_steps` puts a step's `GITHUB_ACTION`.
132const ACTION_NAME: &str = "__g1t_action";
133
134/// Gives each step its `GITHUB_ACTION`, as GitHub's runner names them: its
135/// `id`, else `__run` for a script and `__owner_repo` for an action
136/// (`__self` for one in the repository), the second of a name `_2`, the
137/// third `_3`.
138pub(crate) fn name_steps(steps: &mut [Map<String, Value>]) {
139 let mut taken: BTreeSet<String> = steps.iter().filter_map(|step| step.get("id").map(expr::to_text)).collect();
140 for step in steps.iter_mut() {
141 let name = match step.get("id").map(expr::to_text) {
142 Some(id) => id,
143 None => {
144 let base = match step.get("uses").map(expr::to_text) {
145 None => "run".to_owned(),
146 Some(uses) if uses.starts_with("./") => "self".to_owned(),
147 Some(uses) => {
148 let name = uses.split('@').next().unwrap_or_default();
149 let name = name.strip_prefix("docker://").unwrap_or(name);
150 let repository: Vec<&str> = name.splitn(3, '/').take(2).collect();
151 repository.join("_").chars().map(|c| if c.is_ascii_alphanumeric() || c == '_' || c == '-' { c } else { '_' }).collect()
152 }
153 };
154 let base = format!("__{base}");
155 let mut name = base.clone();
156 let mut n = 2;
157 while taken.contains(&name) {
158 name = format!("{base}_{n}");
159 n += 1;
160 }
161 taken.insert(name.clone());
162 name
163 }
164 };
165 step.insert(ACTION_NAME.into(), Value::String(name));
166 }
167}
168
169/// A step's title when it has no name, as GitHub shows it.
170fn default_title(step: &Map<String, Value>) -> String {
171 if let Some(uses) = step.get("uses").and_then(Value::as_str) {
172 return format!("Run {uses}");
173 }
174 let run = step.get("run").map(expr::to_text).unwrap_or_default();
175 let first = run.lines().find(|line| !line.trim().is_empty()).unwrap_or_default().trim();
176 format!("Run {first}")
177}
178
179/// What GitHub's runner sets on a step itself, which its `env:` list leaves out.
180const RUNNER_SET: [&str; 2] = ["GITHUB_ACTION", "GITHUB_ACTION_PATH"];
181
182/// The step's variables as GitHub lists them under `env:`: each name and
183/// its value (masked later, as every line is), a value of several lines
184/// with the rest indented beneath it.
185fn env_lines(env: &BTreeMap<String, String>) -> Vec<String> {
186 let listed: Vec<(&String, &String)> = env.iter().filter(|(name, _)| !RUNNER_SET.contains(&name.as_str())).collect();
187 if listed.is_empty() {
188 return Vec::new();
189 }
190 let mut lines = vec!["env:".to_owned()];
191 for (name, value) in listed {
192 let mut parts = value.split('\n');
193 lines.push(format!(" {name}: {}", parts.next().unwrap_or_default()));
194 lines.extend(parts.map(|part| format!(" {part}")));
195 }
196 lines
197}
198
199/// How GitHub's runner opens a `run` step, in a group that starts folded:
200/// `Run` and the script's first line, the whole script (in cyan, as
201/// GitHub draws it), the shell it runs in and the step's variables.
202pub(crate) fn script_header(script: &str, shell: &str, env: &BTreeMap<String, String>) -> Vec<String> {
203 let first = script.lines().find(|line| !line.trim().is_empty()).unwrap_or_default().trim();
204 let mut lines = vec![format!("##[group]Run {first}")];
205 lines.extend(script.trim_matches(['\n', '\r']).lines().map(|line| format!("\u{1b}[36;1m{line}\u{1b}[0m")));
206 lines.push(format!("shell: {shell}"));
207 lines.extend(env_lines(env));
208 lines.push("##[endgroup]".into());
209 lines
210}
211
212/// How GitHub's runner opens a `uses:` step: `Run` and the action, its
213/// inputs under `with:` and the step's variables under `env:`.
214pub(crate) fn uses_header(uses: &str, with: &BTreeMap<String, String>, env: &BTreeMap<String, String>) -> Vec<String> {
215 let mut lines = vec![format!("##[group]Run {uses}")];
216 if !with.is_empty() {
217 lines.push("with:".into());
218 for (name, value) in with {
219 let mut parts = value.trim_end_matches('\n').split('\n');
220 lines.push(format!(" {name}: {}", parts.next().unwrap_or_default()));
221 lines.extend(parts.map(|part| format!(" {part}")));
222 }
223 }
224 lines.extend(env_lines(env));
225 lines.push("##[endgroup]".into());
226 lines
227}
228
229impl Job {
230 /// A shell's whole path, found on the step's `PATH` as GitHub's runner
231 /// shows it (`/usr/bin/bash`), or its name when it is not there.
232 fn program_path(&self, program: &str) -> String {
233 if Path::new(program).is_absolute() {
234 return program.to_owned();
235 }
236 let path = self.base_env.get("PATH").cloned().unwrap_or_default();
237 let dirs = self.path_prepend.iter().map(String::as_str).chain(path.split(paths::PATH_SEPARATOR));
238 let names: Vec<String> = if cfg!(windows) { vec![format!("{program}.exe"), program.to_owned()] } else { vec![program.to_owned()] };
239 dirs.filter(|dir| !dir.is_empty())
240 .flat_map(|dir| names.iter().map(move |name| Path::new(dir).join(name)))
241 .find(|candidate| candidate.is_file())
242 .map_or_else(|| program.to_owned(), |found| found.display().to_string())
243 }
244
245 pub(crate) fn base_env_value(&self, name: &str) -> Option<String> {
246 self.base_env.get(name).cloned()
247 }
248
249 /// What earlier steps added to `PATH`, newest first.
250 pub(crate) fn path_prepend_entries(&self) -> &[String] {
251 &self.path_prepend
252 }
253
254 /// How the job is going, for `success()`, `failure()`, `cancelled()`
255 /// and `always()`: once the run is cancelled, only steps that ask for
256 /// `always()` or `cancelled()` run.
257 fn status(&self) -> Status {
258 if report::cancelled() {
259 Status::Cancelled
260 } else if self.failed {
261 Status::Failure
262 } else {
263 Status::Success
264 }
265 }
266
267 /// `job.status`.
268 fn status_word(&self) -> &'static str {
269 if report::cancelled() {
270 "cancelled"
271 } else if self.failed {
272 "failure"
273 } else {
274 "success"
275 }
276 }
277
278 /// The contexts an expression in a step can use.
279 pub(crate) fn contexts_for(&self, frame: &Frame, env: &BTreeMap<String, String>) -> Map<String, Value> {
280 let mut contexts = self.contexts.clone();
281 contexts.insert("env".into(), Value::Object(env.iter().map(|(k, v)| (k.clone(), Value::String(v.clone()))).collect()));
282 contexts.insert("steps".into(), Value::Object(frame.steps.clone()));
283 contexts.insert("job".into(), containers::job_context(self.status_word(), &self.job_context));
284 if let Some(inputs) = &frame.inputs {
285 contexts.insert("inputs".into(), inputs.clone());
286 }
287 if let Some(path) = &frame.action_path
288 && let Some(github) = contexts.get_mut("github")
289 {
290 github["action_path"] = Value::String(path.clone());
291 }
292 contexts
293 }
294
295 /// Runs `f` with a scope over these contexts.
296 pub(crate) fn with_scope<T>(&self, contexts: &Map<String, Value>, f: impl FnOnce(&Scope) -> T) -> T {
297 let workspace = self.workspace.clone();
298 let hash = move |patterns: &[String]| files::hash_files(&workspace, patterns);
299 let scope = Scope {
300 contexts,
301 status: self.status(),
302 hash_files: Some(&hash),
303 };
304 f(&scope)
305 }
306
307 /// The `env` context for a step: the workflow's, the job's, what earlier
308 /// steps wrote to `GITHUB_ENV`, and the frame's.
309 pub(crate) fn env_context(&self, frame: &Frame) -> BTreeMap<String, String> {
310 let mut env = self.added_env.clone();
311 env.extend(self.workflow_env.clone());
312 env.extend(self.job_env.clone());
313 env.extend(frame.env.clone());
314 env
315 }
316
317 /// What a process for a step is given.
318 pub(crate) fn process_env(&self, env: &BTreeMap<String, String>, files: &StepFiles) -> BTreeMap<String, String> {
319 let mut out = self.base_env.clone();
320 out.extend(env.clone());
321 for (name, value) in files.variables() {
322 out.insert(name.to_owned(), value);
323 }
324 if !self.path_prepend.is_empty() {
325 let current = out.get("PATH").cloned().unwrap_or_default();
326 let separator = paths::PATH_SEPARATOR;
327 out.insert("PATH".into(), format!("{}{separator}{current}", self.path_prepend.join(separator)));
328 }
329 out
330 }
331
332 /// Takes in what a step wrote to its files. Returns its outputs.
333 pub(crate) fn absorb(&mut self, files: &StepFiles, commands: &Commands) -> (BTreeMap<String, String>, BTreeMap<String, String>) {
334 let mut outputs: BTreeMap<String, String> = commands.outputs.clone();
335 match files::key_values(&StepFiles::read(&files.output)) {
336 Ok(values) => outputs.extend(values),
337 Err(problem) => self.log.line(&format!("##[error]$GITHUB_OUTPUT: {problem}")),
338 }
339 match files::key_values(&StepFiles::read(&files.env)) {
340 Ok(values) => {
341 for (name, value) in values {
342 if name.starts_with("GITHUB_") || name == "NODE_OPTIONS" {
343 self.log.line(&format!("##[warning]{name} cannot be set through $GITHUB_ENV."));
344 continue;
345 }
346 self.added_env.insert(name, value);
347 }
348 }
349 Err(problem) => self.log.line(&format!("##[error]$GITHUB_ENV: {problem}")),
350 }
351 for line in StepFiles::read(&files.path).lines().map(str::trim).filter(|l| !l.is_empty()) {
352 self.path_prepend.insert(0, line.to_owned());
353 }
354 let mut state = commands.state.clone();
355 if let Ok(values) = files::key_values(&StepFiles::read(&files.state)) {
356 state.extend(values);
357 }
358 // The step's job summary, for the run's page (report.rs).
359 self.log.summary(&StepFiles::read(&files.summary));
360 (outputs, state)
361 }
362
363 pub(crate) fn remaining_time(&self) -> Duration {
364 self.remaining()
365 }
366
367 /// What is left for the running step: its `timeout-minutes`, within
368 /// the job's.
369 fn remaining(&self) -> Duration {
370 let until = self.step_deadline.map_or(self.deadline, |step| step.min(self.deadline));
371 until.saturating_duration_since(Instant::now())
372 }
373
374 /// What is left of the job's own time, whatever the step's.
375 fn job_remaining(&self) -> Duration {
376 self.deadline.saturating_duration_since(Instant::now())
377 }
378
379 /// Runs a shell script for a `run` step.
380 pub(crate) fn run_script(
381 &mut self,
382 script: &str,
383 shell: Option<&str>,
384 working_directory: Option<&str>,
385 env: &BTreeMap<String, String>,
386 timeout: Duration,
387 ) -> (bool, BTreeMap<String, String>, BTreeMap<String, String>) {
388 crate::abuse::touch();
389 // Mining is never a workflow's job (abuse.rs).
390 if let Some(miner) = crate::abuse::miner_in(script) {
391 self.log.line(&format!("##[error]g1t does not run cryptocurrency miners ({miner}). This step was not run."));
392 return (false, BTreeMap::new(), BTreeMap::new());
393 }
394 let id = format!("{:x}", rand_id());
395 let shell = shell.map(str::trim).filter(|s| !s.is_empty());
396 let (program, args, extension): (String, Vec<String>, &str) = match shell {
397 // A self-hosted Windows runner, as GitHub's: PowerShell.
398 None if cfg!(windows) => (windows_powershell(), powershell_args(), "ps1"),
399 // A job container without bash, as GitHub's runner does.
400 None if self.container.as_ref().is_some_and(|c| c.shell == "sh") => ("sh".into(), vec!["-e".into(), "{0}".into()], "sh"),
401 None => ("bash".into(), vec!["-e".into(), "{0}".into()], "sh"),
402 Some("bash") => ("bash".into(), vec!["--noprofile".into(), "--norc".into(), "-eo".into(), "pipefail".into(), "{0}".into()], "sh"),
403 Some("sh") => ("sh".into(), vec!["-e".into(), "{0}".into()], "sh"),
404 Some("python") => (self.python_program(), vec!["{0}".into()], "py"),
405 Some("pwsh") if cfg!(windows) || program_exists("pwsh") => ("pwsh".into(), powershell_args(), "ps1"),
406 Some("powershell") if cfg!(windows) => ("powershell".into(), powershell_args(), "ps1"),
407 Some("cmd") if cfg!(windows) => (
408 "cmd".into(),
409 vec!["/D".into(), "/E:ON".into(), "/V:OFF".into(), "/S".into(), "/C".into(), "CALL \"{0}\"".into()],
410 "cmd",
411 ),
412 Some(other @ ("pwsh" | "powershell" | "cmd")) => {
413 self.log.line(&format!(
414 "##[error]`shell: {other}` needs Windows or PowerShell, which g1t's Linux runners do not have. A self-hosted Windows runner can run it: `runs-on: [self-hosted, windows]`."
415 ));
416 return (false, BTreeMap::new(), BTreeMap::new());
417 }
418 Some(custom) => {
419 let mut parts = custom.split_whitespace().map(str::to_owned);
420 let program = parts.next().unwrap_or_default();
421 let mut args: Vec<String> = parts.collect();
422 if !args.iter().any(|a| a.contains("{0}")) {
423 args.push("{0}".into());
424 }
425 let extension = script_extension(&program);
426 (program, args, extension)
427 }
428 };
429 let script_path = self.temp.join(if extension.is_empty() { id.clone() } else { format!("{id}.{extension}") });
430 if let Err(error) = std::fs::write(&script_path, script_contents(&program, script)) {
431 self.log.line(&format!("##[error]Could not write the script: {error}"));
432 return (false, BTreeMap::new(), BTreeMap::new());
433 }
434 let files = match StepFiles::new(&self.temp, &id) {
435 Ok(files) => files,
436 Err(error) => {
437 self.log.line(&format!("##[error]Could not make the step's files: {error}"));
438 return (false, BTreeMap::new(), BTreeMap::new());
439 }
440 };
441 // GitHub's opening of a `run` step, folded: the script, the shell
442 // it runs in (the program's whole path) and the step's variables.
443 let shown_program = if self.container.is_some() { program.clone() } else { self.program_path(&program) };
444 for line in script_header(script, &format!("{shown_program} {}", args.join(" ")), env) {
445 self.log.line(&line);
446 }
447 let args: Vec<String> = args.iter().map(|a| a.replace("{0}", &paths::shown(&script_path))).collect();
448 let dir = match working_directory {
449 Some(dir) if Path::new(dir).is_absolute() => PathBuf::from(dir),
450 Some(dir) => self.workspace.join(dir),
451 None => self.workspace.clone(),
452 };
453 let full = self.process_env(env, &files);
454 let in_container = self.container.as_ref().map(|c| c.path.clone()).and_then(|image_path| {
455 let inside = self.container_env(env, full.clone(), &image_path);
456 self.in_container(&program, &args, &dir, inside)
457 });
458 let command = match in_container {
459 Some(command) => command,
460 None => {
461 let mut command = Command::new(&program);
462 command.args(&args).current_dir(&dir).env_clear().envs(full);
463 command
464 }
465 };
466 let mut commands = Commands {
467 debug: self.debug,
468 ..Commands::default()
469 };
470 let ended = process::run(command, timeout.min(self.remaining()), &mut self.log, &mut commands);
471 let ok = match ended {
472 Ok(Ended::Exited(0)) => true,
473 Ok(Ended::Exited(code)) => {
474 self.log.line(&format!("##[error]Process completed with exit code {code}."));
475 false
476 }
477 Ok(Ended::TimedOut) => {
478 self.log.line("##[error]The step ran past its time limit and was stopped.");
479 false
480 }
481 Ok(Ended::Cancelled) => false,
482 Err(error) => {
483 self.log.line(&format!("##[error]{program} could not be started: {error}"));
484 false
485 }
486 };
487 let (outputs, state) = self.absorb(&files, &commands);
488 (ok, outputs, state)
489 }
490
491 /// Runs one step of a frame. Returns whether it succeeded (its
492 /// conclusion). `number` is the step the log belongs to.
493 pub(crate) fn step(&mut self, frame: &mut Frame, step: &Map<String, Value>, number: u32, report: bool, defaults: &Map<String, Value>) -> bool {
494 // A cancellation heard during an earlier step (which it stopped) or
495 // since: from here on, only cleanup steps run, and none is stopped
496 // for it again.
497 if report::cancelled() {
498 report::take_cancel();
499 }
500 let env_before = self.env_context(frame);
501 let contexts = self.contexts_for(frame, &env_before);
502 let title = match step.get("name").map(expr::to_text) {
503 Some(name) => self.with_scope(&contexts, |scope| expr::interpolate(&name, scope)).unwrap_or(name),
504 None => default_title(step),
505 };
506 let condition = step.get("if").map(expr::to_text).unwrap_or_default();
507 let read = self.with_scope(&contexts, |scope| expr::condition(&condition, scope));
508 // Debug logging: how the step's `if` read, as GitHub's runner says.
509 if self.debug {
510 let shown = if condition.trim().is_empty() { "success()" } else { condition.trim() };
511 self.log.line(&format!("##[debug]Evaluating condition for step: '{title}'"));
512 self.log.line(&format!("##[debug]Evaluating: {shown}"));
513 match &read {
514 Ok(result) => self.log.line(&format!("##[debug]Result: {result}")),
515 Err(problem) => self.log.line(&format!("##[debug]Failed: {problem}")),
516 }
517 }
518 let run_it = match read {
519 Ok(run_it) => run_it,
520 Err(problem) => {
521 self.log.line(&format!("##[error]The step's `if` does not read: {problem}"));
522 self.failed = true;
523 if report {
524 self.log.step_state(number, &title, "completed", Some("failure"));
525 }
526 return false;
527 }
528 };
529 let id = step.get("id").map(expr::to_text);
530 if !run_it {
531 if let Some(id) = &id {
532 frame.steps.insert(id.clone(), json!({ "outputs": {}, "outcome": "skipped", "conclusion": "skipped" }));
533 }
534 if report {
535 self.log.step_state(number, &title, "completed", Some("skipped"));
536 }
537 return true;
538 }
539 if report {
540 self.log.step(number);
541 self.log.step_state(number, &title, "in_progress", None);
542 }
543
544 // The step's own env, read with the contexts before it.
545 let env = self.step_env(step, &contexts, env_before.clone());
546 let action_name = step.get(ACTION_NAME).map(expr::to_text).or_else(|| id.clone()).unwrap_or_else(|| "__run".into());
547 let minutes = step
548 .get("timeout-minutes")
549 .and_then(|v| self.with_scope(&contexts, |scope| expr::interpolate_value(v, scope)).ok())
550 .and_then(|v| v.as_f64().or_else(|| expr::to_text(&v).parse().ok()));
551 let timeout = step_timeout(minutes);
552 // Every step stops at its own `timeout-minutes`, `run` or `uses`: a
553 // `uses:` step's action, and every process it starts, included.
554 let outer_deadline = self.step_deadline;
555 self.step_deadline = step_deadline(outer_deadline, Instant::now(), minutes);
556 let continue_on_error = step
557 .get("continue-on-error")
558 .and_then(|v| self.with_scope(&contexts, |scope| expr::interpolate_value(v, scope)).ok())
559 .is_some_and(|v| expr::truthy(&v));
560
561 let (ok, outputs) = if let Some(run) = step.get("run").map(expr::to_text) {
562 let script = match self.with_scope(&contexts, |scope| expr::interpolate(&run, scope)) {
563 Ok(script) => script,
564 Err(problem) => {
565 self.log.line(&format!("##[error]The script does not read: {problem}"));
566 String::new()
567 }
568 };
569 let shell = step
570 .get("shell")
571 .map(expr::to_text)
572 .or_else(|| defaults.get("shell").map(expr::to_text));
573 if frame.action_path.is_some() && shell.is_none() {
574 self.log.line("##[error]A composite action's `run` steps need a `shell`.");
575 (false, BTreeMap::new())
576 } else {
577 let working_directory = step
578 .get("working-directory")
579 .or_else(|| defaults.get("working-directory"))
580 .map(|v| self.with_scope(&contexts, |scope| expr::interpolate(&expr::to_text(v), scope)).unwrap_or_else(|_| expr::to_text(v)));
581 let mut env = env;
582 if let Some(path) = &frame.action_path {
583 env.insert("GITHUB_ACTION_PATH".into(), path.clone());
584 }
585 env.insert("GITHUB_ACTION".into(), action_name.clone());
586 let (ok, outputs, _) = self.run_script(&script, shell.as_deref(), working_directory.as_deref(), &env, timeout);
587 (ok, outputs)
588 }
589 } else if let Some(uses) = step.get("uses").map(expr::to_text) {
590 let with = self.step_with(step, &contexts);
591 self.uses(&uses, &with, &env, frame, &title, &action_name, timeout)
592 } else {
593 self.log.line("##[error]A step needs `run` or `uses`.");
594 (false, BTreeMap::new())
595 };
596 let own_deadline = self.step_deadline.filter(|_| self.step_deadline != outer_deadline);
597 self.step_deadline = outer_deadline;
598 let ok = if own_deadline.is_some_and(|until| Instant::now() >= until) {
599 self.log.line(&format!(
600 "##[error]The step ran past its timeout-minutes ({}) and was stopped.",
601 minutes.unwrap_or_default()
602 ));
603 false
604 } else {
605 ok
606 };
607
608 // A step the cancellation stopped ends cancelled, not failed.
609 let stopped = !ok && report::cancelled();
610 let outcome = if ok {
611 "success"
612 } else if stopped {
613 "cancelled"
614 } else {
615 "failure"
616 };
617 let conclusion = if ok || continue_on_error {
618 "success"
619 } else {
620 outcome
621 };
622 if !ok && continue_on_error && !stopped {
623 self.log.line("##[warning]The step failed, and `continue-on-error` lets the job go on.");
624 }
625 if let Some(id) = &id {
626 let outputs: Map<String, Value> = outputs.iter().map(|(k, v)| (k.clone(), Value::String(v.clone()))).collect();
627 frame.steps.insert(id.clone(), json!({ "outputs": outputs, "outcome": outcome, "conclusion": conclusion }));
628 }
629 if conclusion == "failure" {
630 self.failed = true;
631 }
632 if report {
633 self.log.step_state(number, &title, "completed", Some(conclusion));
634 }
635 conclusion == "success"
636 }
637
638 /// A step's own `env` over `base`, read with `contexts`.
639 fn step_env(&self, step: &Map<String, Value>, contexts: &Map<String, Value>, mut base: BTreeMap<String, String>) -> BTreeMap<String, String> {
640 if let Some(Value::Object(step_env)) = step.get("env") {
641 for (name, value) in step_env {
642 let value = self.with_scope(contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
643 base.insert(name.clone(), expr::to_text(&value));
644 }
645 }
646 base
647 }
648
649 /// A `uses:` step's `with`, read with `contexts`.
650 fn step_with(&self, step: &Map<String, Value>, contexts: &Map<String, Value>) -> BTreeMap<String, String> {
651 match step.get("with") {
652 Some(Value::Object(with)) => with
653 .iter()
654 .map(|(k, v)| {
655 let value = self.with_scope(contexts, |scope| expr::interpolate_value(v, scope)).unwrap_or(Value::Null);
656 (k.clone(), expr::to_text(&value))
657 })
658 .collect(),
659 _ => BTreeMap::new(),
660 }
661 }
662
663 fn report_steps(&self) {
664 self.log.steps(&self.step_names);
665 }
666}
667
668/// How long a step's processes may run: its `timeout-minutes`, or six
669/// hours (the job's own limit still applies).
670fn step_timeout(minutes: Option<f64>) -> Duration {
671 match minutes {
672 Some(minutes) if minutes.is_finite() && minutes > 0.0 => Duration::from_secs_f64(minutes * 60.0),
673 Some(_) => Duration::ZERO,
674 None => Duration::from_secs(6 * 3600),
675 }
676}
677
678/// When a step must end by: its `timeout-minutes` from `now`, or `outer`
679/// (the deadline of the `uses:` step it runs inside, for a composite
680/// action's step), whichever is nearer. None when neither sets one.
681fn step_deadline(outer: Option<Instant>, now: Instant, minutes: Option<f64>) -> Option<Instant> {
682 let own = minutes.map(|minutes| now + step_timeout(Some(minutes)));
683 match (outer, own) {
684 (Some(outer), Some(own)) => Some(outer.min(own)),
685 (outer, own) => outer.or(own),
686 }
687}
688
689/// PowerShell on Windows: `pwsh` (PowerShell 7) if it is installed, as on
690/// GitHub's Windows runners, else Windows PowerShell.
691fn windows_powershell() -> String {
692 if program_exists("pwsh") { "pwsh".into() } else { "powershell".into() }
693}
694
695/// How GitHub runs a PowerShell step: the script, stopping at the first error.
696fn powershell_args() -> Vec<String> {
697 vec!["-NoLogo".into(), "-NoProfile".into(), "-NonInteractive".into(), "-Command".into(), ". '{0}'".into()]
698}
699
700/// The name of a shell's program, without its folder or `.exe`.
701fn program_name(program: &str) -> &str {
702 let name = program.rsplit(['/', '\\']).next().unwrap_or(program);
703 name.strip_suffix(".exe").or_else(|| name.strip_suffix(".EXE")).unwrap_or(name)
704}
705
706/// The extension GitHub's runner gives a script, by its shell's program:
707/// none for a program it does not know.
708fn script_extension(program: &str) -> &'static str {
709 match program_name(program) {
710 "bash" | "sh" => "sh",
711 "pwsh" | "powershell" => "ps1",
712 "cmd" => "cmd",
713 "python" => "py",
714 _ => "",
715 }
716}
717
718/// A script as GitHub's runner writes it: for PowerShell, stopping at the
719/// first error and exiting with the last program's exit code.
720fn script_contents(program: &str, script: &str) -> String {
721 let newline = if cfg!(windows) { "\r\n" } else { "\n" };
722 match program_name(program) {
723 "pwsh" | "powershell" => format!(
724 "$ErrorActionPreference = 'stop'{newline}{script}{newline}if ((Test-Path -LiteralPath variable:\\LASTEXITCODE)) {{ exit $LASTEXITCODE }}"
725 ),
726 _ => script.to_owned(),
727 }
728}
729
730/// Whether `program` is a file in one of `path`'s folders (or, on
731/// Windows, `program.exe`), without running it.
732fn on_path(program: &str, path: &str) -> bool {
733 let names = if cfg!(windows) { vec![program.to_owned(), format!("{program}.exe")] } else { vec![program.to_owned()] };
734 path.split(paths::PATH_SEPARATOR).filter(|dir| !dir.is_empty()).any(|dir| names.iter().any(|name| Path::new(dir).join(name).is_file()))
735}
736
737impl Job {
738 /// `shell: python`'s program: `python`, as on GitHub, where there is
739 /// one, else `python3` (Debian has no `python`).
740 fn python_program(&self) -> String {
741 if let Some(container) = &self.container {
742 return container.python.into();
743 }
744 let path = std::iter::once(self.base_env.get("PATH").cloned().unwrap_or_default());
745 let path: Vec<String> = self.path_prepend.iter().cloned().chain(path).collect();
746 if on_path("python", &path.join(paths::PATH_SEPARATOR)) { "python".into() } else { "python3".into() }
747 }
748}
749
750/// Whether `program` is on `PATH`.
751fn program_exists(program: &str) -> bool {
752 Command::new(program)
753 .arg(if program == "cmd" { "/C" } else { "-Version" })
754 .stdout(std::process::Stdio::null())
755 .stderr(std::process::Stdio::null())
756 .status()
757 .is_ok()
758}
759
760/// An id for files, unique enough within one job.
761fn rand_id() -> u64 {
762 use std::sync::atomic::{AtomicU64, Ordering};
763 static NEXT: AtomicU64 = AtomicU64::new(1);
764 let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos() as u64).unwrap_or(0);
765 nanos ^ (NEXT.fetch_add(1, Ordering::Relaxed) << 48)
766}
767
768fn interpolated_map(job: &Job, value: Option<&Value>, contexts: &Map<String, Value>) -> BTreeMap<String, String> {
769 let mut out = BTreeMap::new();
770 if let Some(Value::Object(map)) = value {
771 for (name, value) in map {
772 let value = job.with_scope(contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
773 out.insert(name.clone(), expr::to_text(&value));
774 }
775 }
776 out
777}
778
779/// Whether `::debug::` lines are shown and steps' conditions explained:
780/// `ACTIONS_STEP_DEBUG` as a secret or a variable set to `true`, or a
781/// re-run with debug logging, which sets it and `RUNNER_DEBUG=1` among the
782/// job's variables.
783fn step_debug(contexts: &Map<String, Value>, variables: &Value) -> bool {
784 let named = |name: &str| {
785 contexts
786 .get("secrets")
787 .and_then(|s| s.get(name))
788 .or_else(|| contexts.get("vars").and_then(|v| v.get(name)))
789 .or_else(|| variables.get(name))
790 .is_some_and(|v| expr::to_text(v).eq_ignore_ascii_case("true"))
791 };
792 named("ACTIONS_STEP_DEBUG") || variables.get("RUNNER_DEBUG").is_some_and(|v| expr::to_text(v) == "1")
793}
794
795fn setup(spec: Value, api: Api) -> Result<Job> {
796 setup_in(spec, api, paths::under_home(WORKSPACE), paths::under_home(TEMP))
797}
798
799/// [`setup`] with the workspace and temporary folder given: a test's own.
800fn setup_in(mut spec: Value, api: Api, workspace: PathBuf, temp: PathBuf) -> Result<Job> {
801 let masks: Vec<String> = spec["masks"].as_array().map(|m| m.iter().filter_map(|v| v.as_str().map(str::to_owned)).collect()).unwrap_or_default();
802 // With the token the spec came with: the one the job started with is spent.
803 let relay = broker::Relay::new(&api);
804 let mut log = Log::new(api, masks);
805 // Variables GitHub sets that a g1t from before them does not send.
806 default_variables(&mut spec);
807 // On a self-hosted runner's own machine, GitHub's layout lives in a
808 // folder of the runner's (paths.rs).
809 for part in ["variables", "github"] {
810 paths::relocate(&mut spec[part]);
811 }
812 paths::relocate(&mut spec["contexts"]["runner"]);
813 log.matchers.workspace = workspace.clone();
814 std::fs::create_dir_all(&workspace).context("could not make the workspace")?;
815 std::fs::create_dir_all(&temp).context("could not make the temporary folder")?;
816 std::fs::write(temp.join("event.json"), serde_json::to_string_pretty(&spec["event"])?)?;
817
818 let mut host_env: BTreeSet<String> = std::env::vars().map(|(name, _)| name).collect();
819 // Docker of the job's own, on g1t's machines (crate::docker).
820 let docker_hosted = cfg!(target_os = "linux")
821 && std::env::var("G1T_DOCKER").as_deref() == Ok("on")
822 && spec["variables"]["RUNNER_ENVIRONMENT"].as_str() != Some("self-hosted");
823 // This process's environment, less what only it should see. `ImageOS`
824 // and `ImageVersion` come with it when the machine's image sets them,
825 // as GitHub's images do; nothing makes them up otherwise.
826 let mut base_env: BTreeMap<String, String> =
827 std::env::vars().filter(|(name, _)| !matches!(name.as_str(), "ACTIONS_TOKEN" | "ACTIONS_JOB" | "MODE") && !name.starts_with("G1T_")).collect();
828 base_env.insert("HOME".into(), std::env::var("HOME").unwrap_or_else(|_| "/home/node".into()));
829 base_env.extend(text_map(spec.get("variables")));
830 base_env.insert("GITHUB_EVENT_PATH".into(), paths::shown(&temp.join("event.json")));
831 // As GitHub's runner marks what a job starts, so "Complete job" finds
832 // what its steps left running (process::orphans).
833 let tracking_id = format!("github_{:016x}{:016x}", rand_id(), rand_id());
834 base_env.insert("RUNNER_TRACKING_ID".into(), tracking_id.clone());
835
836 let mut contexts: Map<String, Value> = spec["contexts"].as_object().cloned().unwrap_or_default();
837 contexts.insert("github".into(), spec["github"].clone());
838 let debug = step_debug(&contexts, &spec["variables"]);
839
840 // `timeoutMinutes` is how the API spelled it before its bodies were
841 // `snake_case`.
842 let timeout = spec["timeout_minutes"]
843 .as_u64()
844 .or_else(|| spec["timeoutMinutes"].as_u64())
845 .unwrap_or(60);
846
847 // Brokered secrets on a self-hosted runner (broker.rs): the steps'
848 // HTTPS goes through the job's proxy, which passes requests carrying a
849 // stand-in to g1t. A container a step starts does not get these, as it
850 // gets none of this process's own variables.
851 let stand_ins = broker::stand_ins(&spec);
852 let mut broker_problem = None;
853 if !stand_ins.is_empty() {
854 match broker::start(stand_ins, relay, &temp.join("g1t-broker"), &base_env, Duration::from_secs(timeout * 60)) {
855 Ok((_proxy, vars)) => {
856 host_env.extend(broker::names(&vars));
857 base_env.extend(vars);
858 }
859 Err(problem) => broker_problem = Some(format!("{problem:#}")),
860 }
861 }
862 let mut job = Job {
863 log,
864 spec,
865 workspace,
866 temp,
867 base_env,
868 added_env: BTreeMap::new(),
869 path_prepend: Vec::new(),
870 workflow_env: BTreeMap::new(),
871 job_env: BTreeMap::new(),
872 contexts,
873 failed: false,
874 posts: Vec::new(),
875 step_names: Vec::new(),
876 deadline: Instant::now() + Duration::from_secs(timeout * 60),
877 step_deadline: None,
878 debug,
879 last_node_outputs: BTreeMap::new(),
880 last_node_state: BTreeMap::new(),
881 pre_state: BTreeMap::new(),
882 host_env,
883 docker_hosted,
884 network: None,
885 services: Vec::new(),
886 container: None,
887 job_context: Map::new(),
888 built_actions: containers::Built::new(),
889 tracking_id,
890 broker_problem,
891 };
892
893 // The workflow's env reads github, secrets, inputs and vars; the job's
894 // also its matrix, needs and strategy.
895 let mut contexts = job.contexts.clone();
896 contexts.insert("env".into(), json!({}));
897 job.workflow_env = interpolated_map(&job, job.spec["workflow"].get("env"), &contexts);
898 contexts.insert("env".into(), Value::Object(job.workflow_env.iter().map(|(k, v)| (k.clone(), json!(v))).collect()));
899 job.job_env = interpolated_map(&job, job.spec["spec"].get("env"), &contexts);
900 Ok(job)
901}
902
903/// `RUNNER_WORKSPACE` and `GITHUB_REPOSITORY_OWNER_ID` (with
904/// `github.repository_owner_id`), when the spec does not have them: the
905/// folder the workspace is in, and the owner's id from the event.
906fn default_variables(spec: &mut Value) {
907 if spec["variables"].is_object() && spec["variables"].get("RUNNER_WORKSPACE").is_none() {
908 spec["variables"]["RUNNER_WORKSPACE"] = json!(g1t_actions::events::RUNNER_WORKSPACE);
909 }
910 let owner_id = g1t_actions::events::owner_id(&spec["event"]);
911 if let Some(owner_id) = owner_id.filter(|id| !id.is_empty()) {
912 if spec["variables"].is_object() && spec["variables"].get("GITHUB_REPOSITORY_OWNER_ID").and_then(Value::as_str).is_none_or(str::is_empty) {
913 spec["variables"]["GITHUB_REPOSITORY_OWNER_ID"] = json!(owner_id);
914 }
915 if spec["github"].is_object() && spec["github"].get("repository_owner_id").and_then(Value::as_str).is_none_or(str::is_empty) {
916 spec["github"]["repository_owner_id"] = json!(owner_id);
917 }
918 }
919}
920
921/// What "Set up job" says of the runner and the machine it runs on.
922#[derive(Default)]
923pub(crate) struct Machine {
924 pub(crate) version: String,
925 pub(crate) self_hosted: bool,
926 pub(crate) runner_name: String,
927 /// `RUNNER_OS` and `RUNNER_ARCH`.
928 pub(crate) os: String,
929 pub(crate) arch: String,
930 /// `/etc/os-release`, where there is one.
931 pub(crate) os_release: Option<String>,
932 /// `ImageOS` and `ImageVersion`, when the machine's image sets them.
933 pub(crate) image: Option<(String, String)>,
934 pub(crate) cpus: usize,
935 pub(crate) memory_bytes: Option<u64>,
936 /// The job token's permissions, by GitHub's names.
937 pub(crate) permissions: Vec<(String, String)>,
938}
939
940impl Machine {
941 fn here(spec: &Value, base_env: &BTreeMap<String, String>) -> Machine {
942 let variables = &spec["variables"];
943 let text = |name: &str| variables[name].as_str().unwrap_or_default().to_owned();
944 let self_hosted = variables["RUNNER_ENVIRONMENT"] == "self-hosted";
945 let image = match (base_env.get("ImageOS"), base_env.get("ImageVersion")) {
946 (None, None) => None,
947 (os, version) => Some((os.cloned().unwrap_or_default(), version.cloned().unwrap_or_default())),
948 };
949 let permissions = spec
950 .get("permissions")
951 .and_then(Value::as_object)
952 .map(|map| map.iter().map(|(name, access)| (name.clone(), expr::to_text(access))).collect())
953 .unwrap_or_default();
954 Machine {
955 version: env!("CARGO_PKG_VERSION").to_owned(),
956 self_hosted,
957 runner_name: if self_hosted { text("RUNNER_NAME") } else { "g1t".to_owned() },
958 os: text("RUNNER_OS"),
959 arch: text("RUNNER_ARCH"),
960 os_release: std::fs::read_to_string("/etc/os-release").ok(),
961 image,
962 cpus: std::thread::available_parallelism().map_or(1, usize::from),
963 memory_bytes: memory_limit(
964 std::fs::read_to_string("/sys/fs/cgroup/memory.max").ok().as_deref(),
965 std::fs::read_to_string("/proc/meminfo").ok().as_deref(),
966 ),
967 permissions,
968 }
969 }
970}
971
972/// The memory a job has: its cgroup's limit, else the machine's.
973fn memory_limit(cgroup_max: Option<&str>, meminfo: Option<&str>) -> Option<u64> {
974 let total = meminfo.and_then(|info| {
975 info.lines().find_map(|line| line.strip_prefix("MemTotal:")).and_then(|rest| rest.trim().trim_end_matches("kB").trim().parse::<u64>().ok()).map(|kb| kb * 1024)
976 });
977 let limit = cgroup_max.and_then(|max| max.trim().parse::<u64>().ok());
978 match (limit, total) {
979 (Some(limit), Some(total)) => Some(limit.min(total)),
980 (limit, total) => limit.or(total),
981 }
982}
983
984/// `pull-requests` as GitHub's log names it: `PullRequests`.
985fn permission_title(name: &str) -> String {
986 name.split(['-', '_'])
987 .map(|word| {
988 let mut chars = word.chars();
989 chars.next().map(|first| first.to_ascii_uppercase().to_string() + chars.as_str()).unwrap_or_default()
990 })
991 .collect()
992}
993
994/// GitHub's "Set up job", before the actions are downloaded: the runner's
995/// version and name, the operating system, the image, the machine, what
996/// the job's token may do and where its secrets come from.
997pub(crate) fn setup_header(machine: &Machine) -> Vec<String> {
998 let mut lines = vec![format!("Current runner version: '{}'", machine.version), format!("Runner name: '{}'", machine.runner_name)];
999 lines.push("##[group]Operating System".into());
1000 let release = machine.os_release.as_deref().unwrap_or_default();
1001 let field = |key: &str| {
1002 release.lines().find_map(|line| line.strip_prefix(key).and_then(|rest| rest.strip_prefix('='))).map(|value| value.trim().trim_matches('"').to_owned()).filter(|v| !v.is_empty())
1003 };
1004 match field("NAME") {
1005 Some(name) => {
1006 lines.push(name);
1007 lines.extend(field("VERSION").or_else(|| field("VERSION_ID")));
1008 }
1009 None => lines.push(format!("{} {}", machine.os, machine.arch).trim().to_owned()),
1010 }
1011 lines.push("##[endgroup]".into());
1012 if machine.image.is_some() || !machine.self_hosted {
1013 lines.push("##[group]Runner Image".into());
1014 if let Some((os, version)) = &machine.image {
1015 if !os.is_empty() {
1016 lines.push(format!("Image: {os}"));
1017 }
1018 if !version.is_empty() {
1019 lines.push(format!("Version: {version}"));
1020 }
1021 }
1022 if !machine.self_hosted {
1023 lines.push("Included Software: Node 24, Python 3, Go, Rust".into());
1024 }
1025 lines.push("##[endgroup]".into());
1026 }
1027 lines.push("##[group]Machine".into());
1028 lines.push(if machine.self_hosted { "Self-hosted".into() } else { "Hosted by g1t".to_owned() });
1029 lines.push(format!("Architecture: {}", machine.arch));
1030 lines.push(format!("CPUs: {}", machine.cpus));
1031 if let Some(bytes) = machine.memory_bytes {
1032 let gib = bytes as f64 / (1024.0 * 1024.0 * 1024.0);
1033 let shown = if (gib - gib.round()).abs() < 0.05 { format!("{}", gib.round()) } else { format!("{gib:.1}") };
1034 lines.push(format!("Memory: {shown} GB"));
1035 }
1036 lines.push("##[endgroup]".into());
1037 let granted: Vec<&(String, String)> = machine.permissions.iter().filter(|(_, access)| access != "none" && !access.is_empty()).collect();
1038 if !granted.is_empty() {
1039 lines.push("##[group]G1T_TOKEN Permissions".into());
1040 lines.extend(granted.iter().map(|(name, access)| format!("{}: {access}", permission_title(name))));
1041 lines.push("##[endgroup]".into());
1042 }
1043 lines.push("Secret source: Actions".into());
1044 lines.push("Prepare workflow directory".into());
1045 lines
1046}
1047
1048/// The job's `defaults.run`, its own over the workflow's.
1049fn run_defaults(spec: &Value) -> Map<String, Value> {
1050 let mut defaults = spec["workflow"]["defaults"]["run"].as_object().cloned().unwrap_or_default();
1051 if let Some(own) = spec["spec"]["defaults"]["run"].as_object() {
1052 defaults.extend(own.clone());
1053 }
1054 defaults
1055}
1056
1057fn run_job(job: &mut Job) {
1058 let mut steps: Vec<Map<String, Value>> = job.spec["spec"]["steps"]
1059 .as_array()
1060 .map(|steps| steps.iter().filter_map(|s| s.as_object().cloned()).collect())
1061 .unwrap_or_default();
1062 name_steps(&mut steps);
1063 let defaults = run_defaults(&job.spec);
1064
1065 // Step names as they read before anything has run.
1066 let frame = Frame::default();
1067 let env = job.env_context(&frame);
1068 let contexts = job.contexts_for(&frame, &env);
1069 job.step_names = steps
1070 .iter()
1071 .map(|step| match step.get("name").map(expr::to_text) {
1072 Some(name) => job.with_scope(&contexts, |scope| expr::interpolate(&name, scope)).unwrap_or(name),
1073 None => default_title(step),
1074 })
1075 .collect();
1076 job.report_steps();
1077
1078 job.log.step(0);
1079 // GitHub's "Set up job": the runner, the machine, the token, then the
1080 // actions the job uses.
1081 for line in setup_header(&Machine::here(&job.spec, &job.base_env)) {
1082 job.log.line(&line);
1083 }
1084 if let Some(Value::Object(matrix)) = job.contexts.get("matrix")
1085 && !matrix.is_empty()
1086 {
1087 job.log.line(&format!("Matrix: {}", serde_json::to_string(matrix).unwrap_or_default()));
1088 }
1089 if job.docker_hosted {
1090 let registry = job.contexts["github"]["server_url"].as_str().and_then(crate::docker::engine::registry_host);
1091 let token = job.contexts.get("secrets").and_then(|s| s.get("G1T_TOKEN")).map(expr::to_text).filter(|t| !t.is_empty());
1092 let options = crate::docker::engine::Options { registry: registry.zip(token) };
1093 if let Err(problem) = crate::docker::engine::enable(options) {
1094 job.log.line(&format!("##[warning]Docker is not available in this job: {problem}"));
1095 job.docker_hosted = false;
1096 }
1097 }
1098 // A self-hosted runner's word on how this job was run (selfhosted/exec.rs).
1099 if let Ok(notice) = std::env::var("G1T_JOB_NOTICE") {
1100 job.log.line(&format!("##[warning]{notice}"));
1101 }
1102 if let Some(problem) = job.broker_problem.take() {
1103 job.log.line(&format!("##[warning]This job's brokered secrets will not be filled in: {problem}"));
1104 }
1105 // Actions first, then containers, as GitHub's "Set up job" and
1106 // "Initialize containers". Each action's `pre` (read from the actions
1107 // just downloaded) is a step of its own, "Pre <step>", before the
1108 // job's first step.
1109 let prepared = job.prepare_actions(&steps);
1110 let pres = if prepared { job.pre_steps(&steps) } else { Vec::new() };
1111 if !pres.is_empty() {
1112 let mut names: Vec<String> = pres.iter().map(|(index, _)| format!("Pre {}", job.step_names[*index])).collect();
1113 names.extend(job.step_names.iter().cloned());
1114 job.step_names = names;
1115 job.report_steps();
1116 }
1117 if prepared {
1118 job.log.line(&format!("Complete job name: {}", job.spec["name"].as_str().unwrap_or_default()));
1119 }
1120 let containers_started = prepared && job.start_containers();
1121 job.log.flush();
1122
1123 let mut frame = Frame::default();
1124 if !containers_started {
1125 job.failed = true;
1126 for (index, name) in job.step_names.clone().iter().enumerate() {
1127 job.log.step_state(index as u32 + 1, name, "completed", Some("skipped"));
1128 }
1129 }
1130 for (index, (_, pre)) in pres.iter().enumerate().filter(|_| containers_started) {
1131 let number = index as u32 + 1;
1132 let name = job.step_names[index].clone();
1133 if report::cancelled() {
1134 report::take_cancel();
1135 }
1136 if !job.pre_runs(pre) {
1137 job.log.step_state(number, &name, "completed", Some("skipped"));
1138 continue;
1139 }
1140 job.log.step(number);
1141 job.log.step_state(number, &name, "in_progress", None);
1142 let ok = job.run_pre(pre);
1143 if !ok {
1144 job.failed = true;
1145 }
1146 let conclusion = if ok {
1147 "success"
1148 } else if report::cancelled() {
1149 "cancelled"
1150 } else {
1151 "failure"
1152 };
1153 job.log.step_state(number, &name, "completed", Some(conclusion));
1154 }
1155 let offset = pres.len() as u32;
1156 for (index, step) in steps.iter().enumerate().filter(|_| containers_started) {
1157 job.step(&mut frame, step, offset + index as u32 + 1, true, &defaults);
1158 job.log_docker_notes();
1159 if job.job_remaining().is_zero() {
1160 job.log.line("##[error]The job ran past its time limit.");
1161 job.failed = true;
1162 break;
1163 }
1164 }
1165
1166 // Post steps, last registered first.
1167 let posts: Vec<Post> = std::mem::take(&mut job.posts);
1168 for post in posts.into_iter().rev() {
1169 let number = job.step_names.len() as u32 + 1;
1170 job.step_names.push(post.name.clone());
1171 job.report_steps();
1172 let contexts = job.contexts_for(&frame, &job.env_context(&frame));
1173 let run_it = job.with_scope(&contexts, |scope| expr::condition(&post.condition, scope)).unwrap_or(true);
1174 if !run_it {
1175 job.log.step_state(number, &post.name, "completed", Some("skipped"));
1176 continue;
1177 }
1178 job.log.step(number);
1179 job.log.step_state(number, &post.name, "in_progress", None);
1180 let ok = match &post.run {
1181 PostRun::Node { action_dir, script, using } => job.run_node(action_dir, script, &post.env, using),
1182 PostRun::Docker(run) => job.run_docker(run).0,
1183 };
1184 job.log.step_state(number, &post.name, "completed", Some(if ok { "success" } else { "failure" }));
1185 if !ok {
1186 job.failed = true;
1187 }
1188 }
1189
1190 // GitHub's "Stop containers": services' logs, and everything removed.
1191 if job.has_containers() {
1192 let number = job.step_names.len() as u32 + 1;
1193 job.step_names.push("Stop containers".into());
1194 job.report_steps();
1195 job.log.step(number);
1196 job.log.step_state(number, "Stop containers", "in_progress", None);
1197 job.stop_containers();
1198 job.log.step_state(number, "Stop containers", "completed", Some("success"));
1199 }
1200
1201 // The job's outputs, read now that every step has run.
1202 let env = job.env_context(&frame);
1203 let contexts = job.contexts_for(&frame, &env);
1204 // GitHub's "Complete job": the job's outputs set, and whatever its
1205 // steps left running stopped.
1206 let number = job.step_names.len() as u32 + 1;
1207 job.step_names.push("Complete job".into());
1208 job.report_steps();
1209 job.log.step(number);
1210 job.log.step_state(number, "Complete job", "in_progress", None);
1211 let mut outputs = Map::new();
1212 if let Some(Value::Object(declared)) = job.spec["spec"].get("outputs") {
1213 job.log.line("Evaluate and set job outputs");
1214 for (name, value) in declared {
1215 let value = job.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
1216 job.log.line(&format!("Set output '{name}'"));
1217 outputs.insert(name.clone(), Value::String(expr::to_text(&value)));
1218 }
1219 }
1220 let outputs = job.log.withhold_secrets(&outputs);
1221 job.log.line("Cleaning up orphan processes");
1222 let orphans = process::orphans(&job.tracking_id);
1223 for (pid, name) in &orphans {
1224 job.log.line(&format!("Terminate orphan process: pid ({pid}) ({name})"));
1225 }
1226 process::kill_orphans(&orphans);
1227 job.log.step_state(number, "Complete job", "completed", Some("success"));
1228 // Cancelled, the job ends so however its cleanup went (and g1t holds
1229 // to that whatever it is told).
1230 let conclusion = if report::cancelled() {
1231 "cancelled"
1232 } else if job.failed {
1233 "failure"
1234 } else {
1235 "success"
1236 };
1237 job.log.done(conclusion, &outputs, None);
1238}
1239
1240pub(crate) fn main() -> i32 {
1241 let mut api = match (crate::env("G1T_API"), crate::env("ACTIONS_JOB"), crate::env("ACTIONS_TOKEN")) {
1242 (Ok(base), Ok(job), Ok(token)) => Api { base, job, token },
1243 _ => {
1244 eprintln!("g1t-runner: G1T_API, ACTIONS_JOB and ACTIONS_TOKEN are needed");
1245 return 2;
1246 }
1247 };
1248 // A self-hosted runner asks for the token to be spent on the spec
1249 // (selfhosted/exec.rs): there, the token it was given sits where the
1250 // computer can see it (a Windows job's script, a container's
1251 // environment). g1t's own sandboxes keep theirs to report a sandbox
1252 // that stopped, and do not ask.
1253 let rotate = std::env::var(ROTATE_TOKEN).is_ok_and(|v| v == "1");
1254 // Only a self-hosted runner's harness brokers: g1t's own sandboxes
1255 // have their requests filled in as they leave.
1256 let brokers = rotate && broker::possible(|name| std::env::var(name).ok());
1257 let spec = match api.spec(rotate, brokers) {
1258 Ok(spec) => spec,
1259 Err(error) => {
1260 eprintln!("g1t-runner: could not fetch the job: {error:#}");
1261 api.report(json!({ "kind": "done", "conclusion": "failure", "reason": format!("The runner could not fetch the job: {error}") }));
1262 return 1;
1263 }
1264 };
1265 let reporter = Api {
1266 base: api.base.clone(),
1267 job: api.job.clone(),
1268 token: api.token.clone(),
1269 };
1270 let mut job = match setup(spec, reporter) {
1271 Ok(job) => job,
1272 Err(error) => {
1273 api.report(json!({ "kind": "done", "conclusion": "failure", "reason": format!("The runner could not set up: {error:#}") }));
1274 return 1;
1275 }
1276 };
1277 run_job(&mut job);
1278 if job.failed || report::cancelled() { 1 } else { 0 }
1279}
1280
1281#[cfg(test)]
1282mod tests {
1283 use serde_json::{Map, Value, json};
1284
1285 use super::*;
1286
1287 #[test]
1288 fn set_up_job_says_what_runs_the_job_as_github_does() {
1289 let machine = Machine {
1290 version: "0.2.0".into(),
1291 runner_name: "g1t".into(),
1292 os: "Linux".into(),
1293 arch: "X64".into(),
1294 os_release: Some("PRETTY_NAME=\"Debian GNU/Linux 12 (bookworm)\"\nNAME=\"Debian GNU/Linux\"\nVERSION_ID=\"12\"\nVERSION=\"12 (bookworm)\"\n".into()),
1295 image: Some(("ubuntu24".into(), "20261005.1".into())),
1296 cpus: 4,
1297 memory_bytes: Some(12 * 1024 * 1024 * 1024),
1298 permissions: vec![("contents".into(), "read".into()), ("id-token".into(), "none".into()), ("metadata".into(), "read".into()), ("pull-requests".into(), "write".into())],
1299 ..Machine::default()
1300 };
1301 let text = setup_header(&machine).join("\n");
1302 assert_eq!(
1303 text,
1304 "Current runner version: '0.2.0'\nRunner name: 'g1t'\n\
1305 ##[group]Operating System\nDebian GNU/Linux\n12 (bookworm)\n##[endgroup]\n\
1306 ##[group]Runner Image\nImage: ubuntu24\nVersion: 20261005.1\nIncluded Software: Node 24, Python 3, Go, Rust\n##[endgroup]\n\
1307 ##[group]Machine\nHosted by g1t\nArchitecture: X64\nCPUs: 4\nMemory: 12 GB\n##[endgroup]\n\
1308 ##[group]G1T_TOKEN Permissions\nContents: read\nMetadata: read\nPullRequests: write\n##[endgroup]\n\
1309 Secret source: Actions\nPrepare workflow directory"
1310 );
1311 // A self-hosted machine without an image of GitHub's, or an os-release.
1312 let own = Machine { version: "0.2.0".into(), self_hosted: true, runner_name: "build-box".into(), os: "macOS".into(), arch: "ARM64".into(), cpus: 8, ..Machine::default() };
1313 let text = setup_header(&own).join("\n");
1314 assert!(text.contains("Runner name: 'build-box'\n##[group]Operating System\nmacOS ARM64\n##[endgroup]\n##[group]Machine\nSelf-hosted"), "{text}");
1315 assert!(!text.contains("Runner Image") && !text.contains("Memory") && !text.contains("Permissions"), "{text}");
1316 assert_eq!(memory_limit(Some("max\n"), Some("MemTotal: 16384000 kB\n")), Some(16_384_000 * 1024));
1317 assert_eq!(memory_limit(Some("4294967296\n"), Some("MemTotal: 16384000 kB\n")), Some(4_294_967_296));
1318 assert_eq!(memory_limit(None, None), None);
1319 assert_eq!(permission_title("security-events"), "SecurityEvents");
1320 }
1321
1322 #[test]
1323 fn a_run_step_opens_with_its_script_shell_and_variables_folded() {
1324 let env: BTreeMap<String, String> = [("CARGO_TERM_COLOR", "always"), ("GITHUB_ACTION", "__run"), ("KEY", "line one\nline two")]
1325 .into_iter()
1326 .map(|(k, v)| (k.to_owned(), v.to_owned()))
1327 .collect();
1328 let lines = script_header("\n node build.mjs --all\necho done\n", "/usr/bin/bash -e {0}", &env);
1329 assert_eq!(
1330 lines,
1331 [
1332 "##[group]Run node build.mjs --all",
1333 "\u{1b}[36;1m node build.mjs --all\u{1b}[0m",
1334 "\u{1b}[36;1mecho done\u{1b}[0m",
1335 "shell: /usr/bin/bash -e {0}",
1336 "env:",
1337 " CARGO_TERM_COLOR: always",
1338 " KEY: line one",
1339 " line two",
1340 "##[endgroup]",
1341 ]
1342 );
1343 // No variables: no `env:`.
1344 assert!(!script_header("make", "sh -e {0}", &BTreeMap::new()).contains(&"env:".to_owned()));
1345 let with: BTreeMap<String, String> = [("path", "~/.cargo\ntarget\n"), ("key", "k")].into_iter().map(|(k, v)| (k.to_owned(), v.to_owned())).collect();
1346 assert_eq!(
1347 uses_header("actions/cache@v4", &with, &BTreeMap::new()),
1348 ["##[group]Run actions/cache@v4", "with:", " key: k", " path: ~/.cargo", " target", "##[endgroup]"]
1349 );
1350 }
1351
1352 #[test]
1353 fn debug_logging_comes_from_a_secret_a_variable_or_a_debug_rerun() {
1354 let contexts = |value: Value| -> Map<String, Value> { serde_json::from_value(value).unwrap() };
1355 let none = json!({});
1356 assert!(!step_debug(&contexts(json!({ "secrets": {}, "vars": {} })), &none));
1357 assert!(step_debug(&contexts(json!({ "secrets": { "ACTIONS_STEP_DEBUG": "true" } })), &none));
1358 assert!(step_debug(&contexts(json!({ "vars": { "ACTIONS_STEP_DEBUG": "TRUE" } })), &none));
1359 assert!(!step_debug(&contexts(json!({ "vars": { "ACTIONS_STEP_DEBUG": "false" } })), &none));
1360 // A re-run with debug logging sets these among the job's variables.
1361 assert!(step_debug(&contexts(json!({})), &json!({ "RUNNER_DEBUG": "1" })));
1362 assert!(step_debug(&contexts(json!({})), &json!({ "ACTIONS_STEP_DEBUG": "true" })));
1363 assert!(!step_debug(&contexts(json!({})), &json!({ "RUNNER_DEBUG": "0" })));
1364 }
1365
1366 #[test]
1367 fn scripts_get_githubs_extension_for_their_shell() {
1368 assert_eq!(script_extension("bash"), "sh");
1369 assert_eq!(script_extension("/usr/bin/sh"), "sh");
1370 assert_eq!(script_extension("pwsh"), "ps1");
1371 assert_eq!(script_extension("C:\\Windows\\powershell.exe"), "ps1");
1372 assert_eq!(script_extension("cmd"), "cmd");
1373 assert_eq!(script_extension("python"), "py");
1374 // A program GitHub does not know: no extension.
1375 assert_eq!(script_extension("perl"), "");
1376 assert_eq!(script_extension("python3"), "");
1377 }
1378
1379 #[test]
1380 fn powershell_scripts_stop_at_errors_and_keep_the_exit_code() {
1381 let newline = if cfg!(windows) { "\r\n" } else { "\n" };
1382 assert_eq!(
1383 script_contents("pwsh", "Write-Output hi"),
1384 format!("$ErrorActionPreference = 'stop'{newline}Write-Output hi{newline}if ((Test-Path -LiteralPath variable:\\LASTEXITCODE)) {{ exit $LASTEXITCODE }}")
1385 );
1386 assert!(script_contents("powershell.exe", "x").starts_with("$ErrorActionPreference = 'stop'"));
1387 assert_eq!(script_contents("bash", "echo hi"), "echo hi");
1388 }
1389
1390 #[test]
1391 fn programs_are_found_on_path_without_running_them() {
1392 let dir = std::env::temp_dir().join(format!("g1t-on-path-{}", std::process::id()));
1393 std::fs::create_dir_all(&dir).unwrap();
1394 std::fs::write(dir.join("python"), "").unwrap();
1395 let path = format!("/nowhere{}{}", paths::PATH_SEPARATOR, dir.display());
1396 assert!(on_path("python", &path));
1397 assert!(!on_path("python9", &path));
1398 assert!(!on_path("python", ""));
1399 let _ = std::fs::remove_dir_all(&dir);
1400 }
1401
1402 #[test]
1403 fn steps_are_named_for_github_action_as_github_names_them() {
1404 let mut steps: Vec<Map<String, Value>> = serde_json::from_value(json!([
1405 { "run": "a" },
1406 { "run": "b" },
1407 { "id": "build", "run": "c" },
1408 { "uses": "actions/setup-node@v4" },
1409 { "uses": "actions/cache/restore@v4" },
1410 { "uses": "actions/setup-node@v4" },
1411 { "uses": "./.github/actions/x" },
1412 { "run": "d" },
1413 { "id": "__run_4", "run": "e" },
1414 { "run": "f" },
1415 ]))
1416 .unwrap();
1417 name_steps(&mut steps);
1418 let names: Vec<String> = steps.iter().map(|s| expr::to_text(&s[ACTION_NAME])).collect();
1419 assert_eq!(
1420 names,
1421 ["__run", "__run_2", "build", "__actions_setup-node", "__actions_cache", "__actions_setup-node_2", "__self", "__run_3", "__run_4", "__run_5"]
1422 );
1423 }
1424
1425 #[test]
1426 fn variables_a_spec_lacks_are_filled_in() {
1427 let mut spec = json!({
1428 "variables": { "CI": "true" },
1429 "github": { "repository_owner_id": "" },
1430 "event": { "repository": { "owner": { "id": 7 } } },
1431 });
1432 default_variables(&mut spec);
1433 assert_eq!(spec["variables"]["RUNNER_WORKSPACE"], "/home/runner/work");
1434 assert_eq!(spec["variables"]["GITHUB_REPOSITORY_OWNER_ID"], "7");
1435 assert_eq!(spec["github"]["repository_owner_id"], "7");
1436 // What g1t sent stands.
1437 let mut spec = json!({ "variables": { "RUNNER_WORKSPACE": "/w", "GITHUB_REPOSITORY_OWNER_ID": "9" }, "github": {}, "event": {} });
1438 default_variables(&mut spec);
1439 assert_eq!(spec["variables"]["RUNNER_WORKSPACE"], "/w");
1440 assert_eq!(spec["variables"]["GITHUB_REPOSITORY_OWNER_ID"], "9");
1441 }
1442
1443 #[test]
1444 fn a_steps_timeout_is_its_own_or_the_nearer_one_around_it() {
1445 let now = Instant::now();
1446 // No timeout-minutes anywhere: only the job's deadline applies.
1447 assert_eq!(step_deadline(None, now, None), None);
1448 // A step's own, in minutes, fractions included.
1449 assert_eq!(step_deadline(None, now, Some(1.5)), Some(now + Duration::from_secs(90)));
1450 // A composite action's step inside a `uses:` step with its own:
1451 // the nearer of the two.
1452 let outer = now + Duration::from_secs(60);
1453 assert_eq!(step_deadline(Some(outer), now, Some(10.0)), Some(outer));
1454 assert_eq!(step_deadline(Some(outer), now, Some(0.5)), Some(now + Duration::from_secs(30)));
1455 assert_eq!(step_deadline(Some(outer), now, None), Some(outer));
1456 // Zero or less is a time already up.
1457 assert_eq!(step_deadline(None, now, Some(0.0)), Some(now));
1458 assert_eq!(step_timeout(None), Duration::from_secs(6 * 3600));
1459 assert_eq!(step_timeout(Some(-1.0)), Duration::ZERO);
1460 }
1461
1462 /// `core.getIDToken()` reads the OIDC variables from the step's own
1463 /// environment, so they have to reach every step's process as the API
1464 /// put them in the spec: the URL untouched by path relocation, and the
1465 /// token not dropped with the runner's own credentials.
1466 #[test]
1467 fn a_steps_process_gets_the_oidc_request_variables() {
1468 let dir = std::env::temp_dir().join(format!("g1t-oidc-env-{}-{}", std::process::id(), rand_id()));
1469 let url = "https://api.g1t.sh/actions/oidc/token?api-version=2.0";
1470 let spec = json!({
1471 "variables": {
1472 "ACTIONS_RUNTIME_TOKEN": "h.p.s",
1473 "ACTIONS_ID_TOKEN_REQUEST_URL": url,
1474 "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "h.p.s",
1475 },
1476 "github": {},
1477 "event": {},
1478 "masks": ["h.p.s"],
1479 });
1480 let job = setup_in(spec, Api::offline(), dir.join("work"), dir.join("temp")).unwrap();
1481 let files = StepFiles::new(&job.temp, "oidc").unwrap();
1482 let env = job.process_env(&BTreeMap::new(), &files);
1483 assert_eq!(env.get("ACTIONS_ID_TOKEN_REQUEST_URL").map(String::as_str), Some(url));
1484 assert_eq!(env.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN").map(String::as_str), Some("h.p.s"));
1485 assert_eq!(env.get("ACTIONS_RUNTIME_TOKEN").map(String::as_str), Some("h.p.s"));
1486 let _ = std::fs::remove_dir_all(&dir);
1487 }
1488}