Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
3,243 linesCodeBlameRaw
1//! A run's life: made, its jobs waiting on the jobs they need, each job
2//! skipped or expanded into its matrix and queued, started in a sandbox
3//! when its workspace has room, reporting its steps and logs as it goes,
4//! and finished; the run finishes with its last job.
5
6use g1t_actions::events::{RunInfo, runner_context};
7use g1t_actions::expr::{self, Scope, Status};
8use g1t_actions::matrix;
9use g1t_actions::workflow::{self, Workflow};
10use g1t_contracts::access::Capability;
11use g1t_contracts::actions::{JobCallArgs, RunActionArgs, RunApproval, StartJobArgs, WorkflowRun};
12use g1t_contracts::identity::{CreateJobTokenArgs, CreatedAccessToken, RevokeJobTokensArgs};
13use g1t_contracts::repos::{Repo, RepoPath};
14use g1t_contracts::time::rfc3339;
15use g1t_contracts::{FailureCode, Outcome, new_id};
16use g1t_kit::now_ms;
17use g1t_secrets::{random_hex, same, sha256_hex};
18use serde::Deserialize;
19use serde_json::{Map, Value, json};
20use worker::Result;
21
22use crate::broker::{self, Broker};
23use crate::protection::Gate;
24use crate::sync::WorkflowRow;
25use crate::{Actions, Count, MAX_TIMEOUT_MINUTES, RUNNING_PER_WORKSPACE, SELF_HOSTED_MAX_TIMEOUT_MINUTES, SILENT_MS, SITE, check, fail, optional, repo_path};
26use g1t_contracts::runners::{Wanted, waiting_reason};
27
28/// The most log one job keeps, in bytes; past it, the log says so and stops.
29const MAX_LOG_BYTES: usize = 4 * 1024 * 1024;
30/// The most a single log report may add.
31const MAX_CHUNK_BYTES: usize = 256 * 1024;
32const MAX_ANNOTATIONS: usize = 50;
33/// Swaps a running job's token for a new one, only while it still has the
34/// one the caller showed (`job_spec` with `rotate`), keeping the hash of
35/// the one it started with for `brokered_secrets` (migration 0020).
36const TOKEN_ROTATE: &str = "UPDATE jobs SET first_token_hash = COALESCE(first_token_hash, token_hash), token_hash = ?1
37 WHERE id = ?2 AND status = 'in_progress' AND token_hash = ?3 RETURNING id";
38
39/// Whether `token` is a running job's: its current one, or with `started`
40/// (`brokered_secrets` only) the one it started with before its harness
41/// swapped it.
42fn token_opens(current: Option<&str>, first: Option<&str>, token: &str, started: bool) -> bool {
43 let hash = sha256_hex(token);
44 current.is_some_and(|h| same(h, &hash)) || (started && first.is_some_and(|h| same(h, &hash)))
45}
46/// A batch of a job's log, under the next `seq` of that job's, worked out
47/// in the same statement (SQLite runs one write at a time). `?4` is the
48/// runner's number for the batch (null from runners that send none): a
49/// batch sent again, after an answer the runner did not hear, has the
50/// number of one already kept, and is not kept twice (migration 0016).
51pub(crate) const LOG_INSERT: &str = "INSERT INTO logs (job_id, seq, step, text, chunk)
52 SELECT ?1, COALESCE(MAX(seq), 0) + 1, ?2, ?3, ?4 FROM logs WHERE job_id = ?1
53 ON CONFLICT (job_id, chunk) DO NOTHING";
54/// The most one step's job summary keeps, in bytes, and how many steps of a
55/// job may have one, as on GitHub.
56pub(crate) const MAX_SUMMARY_BYTES: usize = 1024 * 1024;
57pub(crate) const MAX_SUMMARIES: u32 = 20;
58
59/// Whether a step's summary of `adding` bytes is kept: a job keeps up to
60/// 20 steps' summaries (`steps` it has, `mine` this step's bytes so far)
61/// of up to 1 MiB each.
62pub(crate) fn summary_fits(steps: u32, mine: Option<usize>, adding: usize) -> bool {
63 if adding == 0 {
64 return false;
65 }
66 match mine {
67 Some(used) => used + adding <= MAX_SUMMARY_BYTES,
68 None => steps < MAX_SUMMARIES && adding <= MAX_SUMMARY_BYTES,
69 }
70}
71
72/// The repository whose unfinished runs `event` stops, by id: one deleted,
73/// or archived (not unarchived).
74pub fn stops_runs(event: &g1t_contracts::events::Event) -> Option<String> {
75 let stops = match event.kind.as_str() {
76 "repo.deleted" => true,
77 "repo.archived" => event.data["archived"].as_bool() != Some(false),
78 _ => false,
79 };
80 if !stops {
81 return None;
82 }
83 event.repo_id.clone().or_else(|| event.data["repoId"].as_str().map(str::to_owned))
84}
85
86pub struct NewRun {
87 pub repo: Repo,
88 pub path: String,
89 pub source: String,
90 pub workflow: Workflow,
91 pub info: RunInfo,
92 pub action: Option<String>,
93 pub pull: Option<u32>,
94 pub title: String,
95 pub inputs: Map<String, Value>,
96 pub event_key: String,
97 pub actor_id: Option<String>,
98 pub actor: Option<String>,
99 pub trusted: bool,
100 /// Why the run waits for someone with the Write role to approve it
101 /// before anything starts: a pull request from outside (protection.rs).
102 pub approval: Option<String>,
103 /// The commit the run is listed, and its statuses and checks reported,
104 /// on when it is not the one it builds (`info.sha`): a pull request's
105 /// head, when the run builds its test merge commit, as on GitHub.
106 pub head_sha: Option<String>,
107}
108
109#[derive(Clone, Deserialize)]
110pub struct RunRow {
111 pub id: String,
112 pub workflow_id: String,
113 pub repo_id: String,
114 pub repo: String,
115 pub path: String,
116 pub name: String,
117 pub title: String,
118 pub number: u64,
119 pub attempt: u64,
120 pub event: String,
121 pub action: Option<String>,
122 pub git_ref: String,
123 pub sha: String,
124 pub pull: Option<u32>,
125 pub status: String,
126 pub conclusion: Option<String>,
127 pub error: Option<String>,
128 pub actor: Option<String>,
129 pub actor_id: Option<String>,
130 pub source: String,
131 pub info: String,
132 pub inputs: String,
133 pub trusted: u32,
134 pub concurrency_group: Option<String>,
135 pub created_at: String,
136 pub started_at: Option<String>,
137 pub finished_at: Option<String>,
138 /// JSON `RunApproval`, for a run that needed approval (migration 0006).
139 #[serde(default)]
140 pub approval: Option<String>,
141 /// Whether its concurrency group cancels what it replaces.
142 #[serde(default)]
143 pub cancel_in_progress: u32,
144 /// Who started the current attempt, once it is re-run (migration 0009).
145 #[serde(default)]
146 pub triggering_actor: Option<String>,
147 /// The current attempt runs with debug logging.
148 #[serde(default)]
149 pub debug: u32,
150}
151
152impl RunRow {
153 pub fn approval(&self) -> Option<RunApproval> {
154 self.approval.as_deref().and_then(|text| serde_json::from_str(text).ok())
155 }
156
157 pub fn info(&self) -> RunInfo {
158 let mut info: RunInfo = serde_json::from_str(&self.info).unwrap_or_default();
159 info.run_id = self.id.clone();
160 info.run_number = self.number;
161 info.run_attempt = self.attempt;
162 info.workflow_path = self.path.clone();
163 if info.workflow.is_empty() {
164 info.workflow = self.name.clone();
165 }
166 info
167 }
168
169 pub fn inputs(&self) -> Map<String, Value> {
170 serde_json::from_str(&self.inputs).unwrap_or_default()
171 }
172
173 pub fn summary(&self) -> WorkflowRun {
174 WorkflowRun {
175 id: self.id.clone(),
176 workflow_id: self.workflow_id.clone(),
177 path: self.path.clone(),
178 name: self.name.clone(),
179 title: self.title.clone(),
180 number: self.number,
181 attempt: self.attempt,
182 event: self.event.clone(),
183 git_ref: self.git_ref.clone(),
184 sha: self.sha.clone(),
185 pull: self.pull,
186 status: self.status.clone(),
187 conclusion: self.conclusion.clone(),
188 error: self.error.clone(),
189 actor: self.actor.clone(),
190 created_at: self.created_at.clone(),
191 started_at: self.started_at.clone(),
192 finished_at: self.finished_at.clone(),
193 }
194 }
195}
196
197#[derive(Clone, Deserialize)]
198pub struct JobRow {
199 pub id: String,
200 pub run_id: String,
201 pub repo_id: String,
202 pub namespace: String,
203 pub key: String,
204 pub ordinal: u32,
205 pub name: String,
206 pub needs: String,
207 pub matrix: Option<String>,
208 pub status: String,
209 pub conclusion: Option<String>,
210 pub steps: String,
211 pub annotations: String,
212 pub outputs: String,
213 pub reason: Option<String>,
214 pub token_hash: Option<String>,
215 pub timeout_minutes: u32,
216 pub continue_on_error: u32,
217 pub max_parallel: Option<u32>,
218 /// Set for a job that calls a reusable workflow, and for that
219 /// workflow's jobs (see migration 0002).
220 pub call: Option<String>,
221 pub seen_at: Option<String>,
222 pub started_at: Option<String>,
223 pub finished_at: Option<String>,
224 /// For a job whose `runs-on` names self-hosted runners: what it asks
225 /// for, as a JSON array (see `g1t_contracts::runners::Wanted`), when it
226 /// started waiting, and the runner that took it (migration 0004).
227 #[serde(default)]
228 pub labels: Option<String>,
229 #[serde(default)]
230 pub queued_at: Option<String>,
231 #[serde(default)]
232 pub runner_id: Option<String>,
233 #[serde(default)]
234 pub runner_name: Option<String>,
235 /// The environment it names, read when its needs were done; a job its
236 /// rules hold is `pending` (migration 0006).
237 #[serde(default)]
238 pub environment: Option<String>,
239 /// Its own `concurrency` group, and whether that cancels what it replaces.
240 #[serde(default)]
241 pub concurrency_group: Option<String>,
242 #[serde(default)]
243 pub cancel_in_progress: u32,
244 /// When it was told to stop, while it runs its cleanup steps
245 /// (migration 0009).
246 #[serde(default)]
247 pub cancel_requested_at: Option<String>,
248 /// Whether it was given stand-ins for brokered secrets (migration
249 /// 0019), so its log is masked for their values too.
250 #[serde(default)]
251 pub brokered: u32,
252 /// The hash of the token it started with, once its harness swapped that
253 /// for another (migration 0020): good for `brokered_secrets` only.
254 #[serde(default)]
255 pub first_token_hash: Option<String>,
256}
257
258/// How long a cancelled job has to run its `if: always()` and `cancelled()`
259/// steps and its post steps before it is stopped outright, as on GitHub.
260pub const CANCEL_GRACE_MS: u64 = 5 * 60 * 1000;
261
262/// Which jobs a re-run runs again.
263#[derive(Clone, Copy, Debug, PartialEq)]
264pub enum Rerun<'a> {
265 All,
266 /// Those that did not succeed.
267 Failed,
268 /// One job's key.
269 Job(&'a str),
270}
271
272/// The keys a re-run runs again, in `order`: those `which` names and,
273/// transitively, every key that needs one of them. `needs` gives a key's
274/// needs; `succeeded` whether every job of a key succeeded.
275pub fn rerun_keys(order: &[&str], needs: impl Fn(&str) -> Vec<String>, succeeded: impl Fn(&str) -> bool, which: Rerun) -> Vec<String> {
276 let mut again: Vec<String> = Vec::new();
277 for key in order {
278 let named = match which {
279 Rerun::All => true,
280 Rerun::Failed => !succeeded(key),
281 Rerun::Job(job) => *key == job,
282 };
283 if named || needs(key).iter().any(|need| again.contains(need)) {
284 again.push((*key).to_owned());
285 }
286 }
287 again
288}
289
290/// The key under `jobs:` a job belongs to: a called workflow's jobs
291/// (`build/test`, or `build[1]/test` for a matrix's second call) run again
292/// with the job that calls it (`build`).
293pub fn top_key(key: &str) -> &str {
294 let first = key.split('/').next().unwrap_or(key);
295 first.split('[').next().unwrap_or(first)
296}
297
298/// What the keys of the jobs a caller's call makes start with: the
299/// caller's key, and for a matrix the combination's index after it
300/// (`build[1]`), so each combination's call has jobs of its own. A job id
301/// has no `[`, so the two never meet.
302fn call_prefix(key: &str, index: Option<usize>) -> String {
303 match index {
304 Some(index) => format!("{key}[{index}]"),
305 None => key.to_owned(),
306 }
307}
308
309/// Whether a run may call one more reusable workflow, `file`, `depth`
310/// levels below the workflow it started from, having called `called`
311/// already (one name per call; repeats are one workflow). As on GitHub: ten
312/// levels of workflows at most, the top one and nine reusable ones below
313/// it, and 50 different reusable workflows in a run.
314fn call_allowed(depth: u64, called: &[&str], file: &str) -> std::result::Result<(), String> {
315 if depth > MAX_CALL_DEPTH {
316 return Err(format!(
317 "`{file}` would be the {}th level of workflows: a run connects at most ten, the workflow it started from and nine levels of reusable workflows below it.",
318 depth + 1
319 ));
320 }
321 let mut unique: Vec<&str> = called.to_vec();
322 unique.push(file);
323 unique.sort_unstable();
324 unique.dedup();
325 if unique.len() > MAX_CALLED_WORKFLOWS {
326 return Err(format!("Calling `{file}` would make {} reusable workflows in this run: a run calls at most {MAX_CALLED_WORKFLOWS} different ones.", unique.len()));
327 }
328 Ok(())
329}
330
331/// What a job is shown as: its `name` (else its id), under the job whose
332/// call made it (`caller`), read with its matrix when it has an
333/// expression, else with the matrix's values after it.
334fn shown_name(job: &workflow::Job, caller: Option<&str>, combination: &Map<String, Value>, scope: &Scope) -> String {
335 let base = job.name.clone().unwrap_or(job.id.clone());
336 let base = match caller {
337 Some(caller) => format!("{caller} / {base}"),
338 None => base,
339 };
340 if expr::has_expression(&base) {
341 expr::interpolate(&base, scope).unwrap_or(base)
342 } else if job.matrix.is_some() {
343 matrix::job_name(&base, combination)
344 } else {
345 base
346 }
347}
348
349/// Debug logging for a job, as a re-run with it turned on gives GitHub's:
350/// `RUNNER_DEBUG=1` and `runner.debug`, and `ACTIONS_STEP_DEBUG` and
351/// `ACTIONS_RUNNER_DEBUG` set, which the runner reads as the secrets of
352/// those names (`::debug::` lines shown, and how each step's `if` read).
353pub fn debug_logging(variables: &mut Map<String, Value>, runner: &mut Value) {
354 variables.insert("RUNNER_DEBUG".into(), json!("1"));
355 variables.insert("ACTIONS_STEP_DEBUG".into(), json!("true"));
356 variables.insert("ACTIONS_RUNNER_DEBUG".into(), json!("true"));
357 runner["debug"] = json!("1");
358}
359
360impl JobRow {
361 pub fn needs(&self) -> Vec<String> {
362 serde_json::from_str(&self.needs).unwrap_or_default()
363 }
364
365 pub fn call(&self) -> Option<Value> {
366 self.call.as_deref().and_then(|call| serde_json::from_str(call).ok())
367 }
368
369 /// For a job that calls a reusable workflow: what the keys of the jobs
370 /// its call makes start with (`call_prefix`).
371 pub fn call_prefix(&self) -> Option<String> {
372 let call = self.call().filter(|call| call["role"] == "caller")?;
373 Some(call["prefix"].as_str().unwrap_or(&self.key).to_owned())
374 }
375
376 /// A job that calls a reusable workflow and has not called it yet: it
377 /// waits for room under its matrix's `max-parallel`, or in its
378 /// concurrency group.
379 pub fn holds_call(&self) -> bool {
380 self.status == "waiting" && self.call_prefix().is_some()
381 }
382
383 /// For a job of a called workflow: that workflow, the job's own id in
384 /// it, and the job.
385 pub fn callee(&self) -> Option<(Workflow, workflow::Job, Value)> {
386 let call = self.call().filter(|call| call["role"] == "callee")?;
387 let called = workflow::parse(call["source"].as_str()?).ok()?;
388 let job = called.jobs.iter().find(|job| call["job"].as_str() == Some(job.id.as_str()))?.clone();
389 Some((called, job, call))
390 }
391}
392
393/// A job to decide on: its key, its definition, and what it needs, as
394/// (name in `needs`, key of the jobs).
395type Unit = (String, workflow::Job, Vec<(String, String)>);
396
397/// How many levels of reusable workflows may sit below the workflow a run
398/// started from, as on GitHub (ten levels of workflows in all).
399const MAX_CALL_DEPTH: u64 = 9;
400/// How many different reusable workflows a run may call, as on GitHub.
401const MAX_CALLED_WORKFLOWS: usize = 50;
402
403/// What the jobs of one key came to, for `needs.<key>`.
404fn key_result(rows: &[&JobRow]) -> &'static str {
405 let failed = |row: &&&JobRow| row.conclusion.as_deref() == Some("failure") && row.continue_on_error == 0;
406 if rows.iter().any(|row| failed(&row)) {
407 "failure"
408 } else if rows.iter().any(|row| row.conclusion.as_deref() == Some("cancelled")) {
409 "cancelled"
410 } else if rows.iter().all(|row| row.conclusion.as_deref() == Some("skipped")) {
411 "skipped"
412 } else {
413 "success"
414 }
415}
416
417/// Whether any job before `key` failed: one it needs, or one those need,
418/// however far back. A job after a skipped one still sees the failure
419/// that skipped it, as GitHub's failure() does. `needs_of`: each key's
420/// needs, as keys; `failed`: whether a key's jobs came to a failure.
421fn ancestor_failed(needs_of: &std::collections::HashMap<&str, Vec<&str>>, key: &str, failed: impl Fn(&str) -> bool) -> bool {
422 let mut seen = std::collections::HashSet::new();
423 let mut stack: Vec<&str> = needs_of.get(key).cloned().unwrap_or_default();
424 while let Some(next) = stack.pop() {
425 if !seen.insert(next) {
426 continue;
427 }
428 if failed(next) {
429 return true;
430 }
431 stack.extend(needs_of.get(next).into_iter().flatten().copied());
432 }
433 false
434}
435
436/// A job's `environment:`, as deployments read it: its name, the address in
437/// `environment.url` once its expressions are filled in from the run, and
438/// whether the job deploys to it. A job with `deployment: false` only reads
439/// the environment's secrets and variables, and makes no deployment.
440#[derive(Clone, Debug, Default, PartialEq)]
441pub(crate) struct JobEnvironment {
442 pub(crate) name: String,
443 pub(crate) url: Option<String>,
444 pub(crate) deploys: bool,
445}
446
447/// The environment `environment:` names, as written in `raw` (a job), with
448/// `contexts` to fill in expressions: null when it names none, or only
449/// through an expression this cannot read before the job runs.
450pub(crate) fn environment_of(raw: &Value, contexts: &Map<String, Value>) -> Option<JobEnvironment> {
451 let scope = Scope { contexts, status: Status::Success, hash_files: None };
452 let plain = |value: &Value| -> Option<String> {
453 let text = match value {
454 Value::String(text) if text.contains("${{") => expr::interpolate_value(value, &scope).ok().map(|v| expr::to_text(&v))?,
455 Value::String(text) => text.clone(),
456 _ => return None,
457 };
458 let text = text.trim().to_owned();
459 (!text.is_empty()).then_some(text)
460 };
461 match raw.get("environment")? {
462 name @ Value::String(_) => Some(JobEnvironment { name: plain(name)?, url: None, deploys: workflow::records_deployment(raw) }),
463 Value::Object(env) => {
464 let name = plain(env.get("name")?)?;
465 let url = env
466 .get("url")
467 .and_then(plain)
468 .filter(|url| url.starts_with("https://") || url.starts_with("http://"));
469 Some(JobEnvironment { name, url, deploys: workflow::records_deployment(raw) })
470 }
471 _ => None,
472 }
473}
474
475/// The contexts a job's `runs-on` and `environment` are read with before it
476/// runs: the run's `github`, its inputs, and the job's matrix.
477fn start_contexts(run: &RunRow, job: &JobRow, key: &str) -> Map<String, Value> {
478 let mut contexts = Map::new();
479 contexts.insert("github".into(), run.info().context(key, "", run.action.as_deref()));
480 contexts.insert("inputs".into(), Value::Object(run.inputs()));
481 contexts.insert("matrix".into(), job.matrix.as_deref().and_then(|m| serde_json::from_str(m).ok()).unwrap_or_else(|| json!({})));
482 contexts
483}
484
485/// The job as its workflow (or the workflow it calls) defines it.
486fn job_spec(run: &RunRow, job: &JobRow) -> Option<workflow::Job> {
487 match job.callee() {
488 Some((_, spec, _)) => Some(spec),
489 None => workflow::parse(&run.source).ok().and_then(|w| w.jobs.into_iter().find(|j| j.id == job.key)),
490 }
491}
492
493/// The environment a job deploys to, if it deploys: by the name read when
494/// its needs were done (which may have needed their outputs), else as
495/// its `environment:` reads now.
496pub(crate) fn deploys_to(run: &RunRow, job: &JobRow) -> Option<JobEnvironment> {
497 let spec = job_spec(run, job)?;
498 let read = environment_of(&spec.raw, &start_contexts(run, job, &spec.id));
499 let env = match (read, &job.environment) {
500 (Some(env), Some(name)) => Some(JobEnvironment { name: name.clone(), ..env }),
501 (Some(env), None) => Some(env),
502 (None, Some(name)) => Some(JobEnvironment { name: name.clone(), url: None, deploys: workflow::records_deployment(&spec.raw) }),
503 (None, None) => None,
504 };
505 env.filter(|env| env.deploys)
506}
507
508/// The machine a job's `runs-on` asks for (`instance_for`), for the
509/// runner: none for the standard one.
510fn start_instance(run: &RunRow, job: &JobRow) -> Option<String> {
511 let spec = match job.callee() {
512 Some((_, spec, _)) => spec,
513 None => workflow::parse(&run.source).ok().and_then(|w| w.jobs.into_iter().find(|j| j.id == job.key))?,
514 };
515 // `runs-on` as the job was queued with: its matrix and the run's
516 // inputs. A label that needs more than those is the standard machine.
517 let contexts = start_contexts(run, job, &spec.id);
518 let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
519 let labels: Vec<String> = match expr::interpolate_value(&spec.runs_on, &scope).unwrap_or(Value::Null) {
520 Value::String(label) => vec![label],
521 Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
522 Value::Object(given) => match given.get("labels") {
523 Some(Value::Array(labels)) => labels.iter().map(expr::to_text).collect(),
524 Some(label) => vec![expr::to_text(label)],
525 None => Vec::new(),
526 },
527 _ => Vec::new(),
528 };
529 let instance = g1t_contracts::actions::instance_for(&labels);
530 (instance != g1t_contracts::actions::STANDARD_INSTANCE).then(|| instance.label.to_owned())
531}
532
533fn now() -> String {
534 rfc3339(now_ms())
535}
536
537/// How a finished run went for one environment, from the conclusions of
538/// the jobs that deploy to it: failed if any failed, an error if any was
539/// cancelled, else a success; nothing when none ran (all skipped).
540pub(crate) fn deployment_outcome(conclusions: &[Option<String>]) -> Option<&'static str> {
541 let ran: Vec<&str> = conclusions.iter().flatten().map(String::as_str).filter(|c| *c != "skipped").collect();
542 if ran.is_empty() {
543 return None;
544 }
545 if ran.iter().any(|c| *c == "failure" || *c == "timed_out") {
546 return Some("failure");
547 }
548 if ran.contains(&"cancelled") {
549 return Some("error");
550 }
551 Some("success")
552}
553
554impl Actions {
555 pub async fn run_row(&self, id: &str) -> Result<Option<RunRow>> {
556 self.db.prepare("SELECT * FROM runs WHERE id = ?").bind(&[id.into()])?.first::<RunRow>(None).await
557 }
558
559 pub async fn job_rows(&self, run_id: &str) -> Result<Vec<JobRow>> {
560 self.db
561 .prepare("SELECT * FROM jobs WHERE run_id = ? ORDER BY rowid")
562 .bind(&[run_id.into()])?
563 .all()
564 .await?
565 .results::<JobRow>()
566 }
567
568 pub async fn run_summary(&self, id: &str) -> Result<Outcome<WorkflowRun>> {
569 Ok(match self.run_row(id).await? {
570 Some(row) => Outcome::Ok(row.summary()),
571 None => fail(FailureCode::NotFound, "No such run."),
572 })
573 }
574
575 /// The contexts every expression outside a job's steps may use.
576 fn base_contexts(run: &RunRow, vars: &Map<String, Value>, job: &str) -> Map<String, Value> {
577 let mut contexts = Map::new();
578 contexts.insert("github".into(), run.info().context(job, "", run.action.as_deref()));
579 contexts.insert("inputs".into(), Value::Object(run.inputs()));
580 contexts.insert("vars".into(), Value::Object(vars.clone()));
581 contexts.insert("needs".into(), json!({}));
582 contexts.insert("runner".into(), runner_context());
583 contexts
584 }
585
586 /// Whether `namespace` is a person's own workspace: usernames and
587 /// workspaces share one namespace, so it is when someone has that
588 /// username. Kept in the isolate for a few minutes, so a burst of
589 /// runs asks identity once.
590 async fn personal_namespace(&self, namespace: &str) -> Result<bool> {
591 const KEEP_MS: u64 = 5 * 60 * 1000;
592 thread_local! {
593 static PERSONAL: std::cell::RefCell<std::collections::HashMap<String, (bool, u64)>> = Default::default();
594 }
595 let now = now_ms();
596 let key = namespace.to_ascii_lowercase();
597 if let Some(personal) = PERSONAL.with(|kept| kept.borrow().get(&key).filter(|(_, at)| now.saturating_sub(*at) < KEEP_MS).map(|(personal, _)| *personal)) {
598 return Ok(personal);
599 }
600 let found: g1t_contracts::Viewer = g1t_kit::call(
601 &self.identity,
602 "user_by_username",
603 &g1t_contracts::identity::UsernameArgs { username: key.clone() },
604 )
605 .await?;
606 let personal = found.is_some_and(|user| user.username.eq_ignore_ascii_case(namespace));
607 PERSONAL.with(|kept| {
608 let mut kept = kept.borrow_mut();
609 if kept.len() > 1000 {
610 kept.clear();
611 }
612 kept.insert(key, (personal, now));
613 });
614 Ok(personal)
615 }
616
617 /// Makes a run and its jobs, and starts what can start. `None` when the
618 /// event already started this workflow.
619 pub async fn create_run(&self, new: NewRun) -> Result<Option<String>> {
620 self.create_run_with(new, false).await
621 }
622
623 /// As `create_run`, but the run's pending status must reach Work: one
624 /// that cannot is cancelled and the error returned, so that a caller
625 /// waiting on statuses (the merge queue) never reads "no workflows" or
626 /// a premature pass from a run nothing was told about.
627 pub async fn create_run_registered(&self, new: NewRun) -> Result<Option<String>> {
628 self.create_run_with(new, true).await
629 }
630
631 async fn create_run_with(&self, new: NewRun, strict: bool) -> Result<Option<String>> {
632 // Nothing starts on an archived repository. A deleted one is never
633 // found to start anything on.
634 if new.repo.archived() {
635 return Ok(None);
636 }
637 // Nor while its Actions are off (Settings, Actions; a fork's are
638 // until someone turns them on), whatever started it. This is the
639 // gate; read once per request, so the runs of one push share it.
640 if !self.actions_on(&new.repo).await? {
641 return Ok(None);
642 }
643 let workflow_row = self.workflow_row(&new.repo, &new.path, &new.workflow.display_name(&new.path), &new.source).await?;
644 let numbered = self
645 .db
646 .prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")
647 .bind(&[workflow_row.id.as_str().into()])?
648 .first::<Count>(None)
649 .await?
650 .map_or(1, |count| count.n);
651 let id = new_id("run", now_ms());
652 let mut info = new.info.clone();
653 // A personal workspace's repositories are a `User`'s, as on GitHub.
654 if self.personal_namespace(&new.repo.namespace).await? {
655 crate::payload::owned_by_person(&mut info.event, &new.repo.namespace);
656 }
657 info.workflow = new.workflow.display_name(&new.path);
658 info.workflow_path = new.path.clone();
659 info.run_id = id.clone();
660 info.run_number = u64::from(numbered);
661 let vars = self
662 .variables_for(&new.repo.id, &format!("{}/{}", new.repo.namespace, new.repo.name), None, new.trusted)
663 .await?;
664
665 // run-name and the concurrency group read github, inputs and vars.
666 let mut contexts = Map::new();
667 contexts.insert("github".into(), info.context("", "", new.action.as_deref()));
668 contexts.insert("inputs".into(), Value::Object(new.inputs.clone()));
669 contexts.insert("vars".into(), Value::Object(vars));
670 let scope = Scope {
671 contexts: &contexts,
672 status: Status::Success,
673 hash_files: None,
674 };
675 let title = new
676 .workflow
677 .run_name
678 .as_deref()
679 .and_then(|run_name| expr::interpolate(run_name, &scope).ok())
680 .filter(|title| !title.trim().is_empty())
681 .unwrap_or(new.title.clone());
682 let group = new.workflow.concurrency.as_ref().and_then(|c| expr::interpolate(&c.group, &scope).ok());
683 let cancel_in_progress = new
684 .workflow
685 .concurrency
686 .as_ref()
687 .and_then(|c| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())
688 .is_some_and(|value| expr::truthy(&value));
689
690 let approval = new.approval.as_ref().map(|reason| RunApproval { state: "required".into(), reason: reason.clone(), approved_by: None });
691 let inserted = self
692 .db
693 .prepare(
694 "INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, action, git_ref, sha,
695 pull, status, actor, actor_id, source, info, inputs, trusted, concurrency_group, event_key, created_at,
696 approval, cancel_in_progress)
697 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id",
698 )
699 .bind(&[
700 id.as_str().into(),
701 workflow_row.id.as_str().into(),
702 new.repo.id.as_str().into(),
703 format!("{}/{}", new.repo.namespace, new.repo.name).into(),
704 new.path.as_str().into(),
705 info.workflow.as_str().into(),
706 title.as_str().into(),
707 numbered.into(),
708 info.event_name.as_str().into(),
709 optional(new.action.as_deref()),
710 info.git_ref.as_str().into(),
711 new.head_sha.as_deref().unwrap_or(&info.sha).into(),
712 new.pull.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
713 if approval.is_some() { "action_required" } else { "queued" }.into(),
714 optional(new.actor.as_deref()),
715 optional(new.actor_id.as_deref()),
716 new.source.as_str().into(),
717 serde_json::to_string(&info)?.into(),
718 serde_json::to_string(&new.inputs)?.into(),
719 u32::from(new.trusted).into(),
720 optional(group.as_deref()),
721 new.event_key.as_str().into(),
722 now().into(),
723 approval.as_ref().map(serde_json::to_string).transpose()?.as_deref().map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
724 u32::from(cancel_in_progress).into(),
725 ])?
726 .first::<Value>(None)
727 .await?;
728 if inserted.is_none() {
729 return Ok(None);
730 }
731 let mut unregistered = None;
732 if let Some(run) = self.run_row(&id).await? {
733 if strict {
734 if let Err(error) = self.try_report_pending(&run).await {
735 unregistered = Some((run, error));
736 }
737 } else {
738 self.report_pending(&run).await?;
739 }
740 }
741
742 // Every job, waiting; each is expanded when the jobs it needs are done.
743 let mut statements = Vec::new();
744 for job in &new.workflow.jobs {
745 statements.push(
746 self.db
747 .prepare(
748 "INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting')",
749 )
750 .bind(&[
751 new_id("job", now_ms()).into(),
752 id.as_str().into(),
753 new.repo.id.as_str().into(),
754 new.repo.namespace.as_str().into(),
755 job.id.as_str().into(),
756 job.name.clone().filter(|n| !expr::has_expression(n)).unwrap_or(job.id.clone()).into(),
757 serde_json::to_string(&job.needs)?.into(),
758 ])?,
759 );
760 }
761 self.db.batch(statements).await?;
762 if let Some((run, error)) = unregistered {
763 self.cancel_run(&run, "Its pending status could not be registered.", false).await?;
764 return Err(error);
765 }
766
767 // A pull request's run from outside waits to be approved; it joins
768 // its concurrency group once it is (protection.rs, approve_run).
769 if approval.is_some() {
770 return Ok(Some(id));
771 }
772 if let Some(run) = self.run_row(&id).await? {
773 self.enter_group(&run).await?;
774 }
775 Ok(Some(id))
776 }
777
778 /// A run about to start: one run at a time per concurrency group, as on
779 /// GitHub. A newer run replaces one that waits in the group, and with
780 /// `cancel-in-progress` the one that runs; otherwise it waits as
781 /// `pending` for the one that runs. Then it moves along.
782 pub(crate) async fn enter_group(&self, run: &RunRow) -> Result<()> {
783 if let Some(group) = &run.concurrency_group {
784 let cancel_in_progress = run.cancel_in_progress != 0;
785 let others = self
786 .db
787 .prepare(
788 "SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND id != ? AND status NOT IN ('completed', 'action_required') ORDER BY id",
789 )
790 .bind(&[run.repo_id.as_str().into(), group.as_str().into(), run.id.as_str().into()])?
791 .all()
792 .await?
793 .results::<RunRow>()?;
794 for other in &others {
795 if cancel_in_progress || other.status == "pending" {
796 // A newer run replaces a waiting one, as on GitHub.
797 self.cancel_run(other, "A newer run in the same concurrency group replaced it.", false).await?;
798 }
799 }
800 if !cancel_in_progress && others.iter().any(|other| other.status != "pending") {
801 self.db
802 .prepare("UPDATE runs SET status = 'pending' WHERE id = ?")
803 .bind(&[run.id.as_str().into()])?
804 .run()
805 .await?;
806 return Ok(());
807 }
808 }
809 self.advance(&run.id).await
810 }
811
812 /// A run that could not start, such as for a workflow file that does
813 /// not read. None while `repo`'s Actions are off, as for `create_run`.
814 #[allow(clippy::too_many_arguments)]
815 pub async fn record_failed_run(
816 &self,
817 repo: &Repo,
818 row: &WorkflowRow,
819 git_ref: &str,
820 sha: &str,
821 event_key: &str,
822 actor_id: Option<&str>,
823 actor: &str,
824 problem: &str,
825 ) -> Result<()> {
826 if !self.actions_on(repo).await? {
827 return Ok(());
828 }
829 let numbered = self
830 .db
831 .prepare("UPDATE workflows SET run_count = run_count + 1 WHERE id = ? RETURNING run_count AS n")
832 .bind(&[row.id.as_str().into()])?
833 .first::<Count>(None)
834 .await?
835 .map_or(1, |count| count.n);
836 let at = now();
837 self.db
838 .prepare(
839 "INSERT OR IGNORE INTO runs (id, workflow_id, repo_id, repo, path, name, title, number, event, git_ref, sha, status,
840 conclusion, error, actor, actor_id, source, info, event_key, created_at, finished_at)
841 VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'push', ?, ?, 'completed', 'failure', ?, ?, ?, ?, '{}', ?, ?, ?)",
842 )
843 .bind(&[
844 new_id("run", now_ms()).into(),
845 row.id.as_str().into(),
846 row.repo_id.as_str().into(),
847 row.repo.as_str().into(),
848 row.path.as_str().into(),
849 row.path.as_str().into(),
850 "Invalid workflow file".into(),
851 numbered.into(),
852 git_ref.into(),
853 sha.into(),
854 problem.into(),
855 actor.into(),
856 optional(actor_id),
857 row.source.as_str().into(),
858 event_key.into(),
859 at.as_str().into(),
860 at.as_str().into(),
861 ])?
862 .run()
863 .await?;
864 Ok(())
865 }
866
867 /// Moves a run along: jobs whose needs are done are decided on, and
868 /// jobs that can start are started.
869 pub async fn advance(&self, run_id: &str) -> Result<()> {
870 // Each pass may finish jobs (skipped ones), which may free others.
871 for _ in 0..20 {
872 let Some(run) = self.run_row(run_id).await? else { return Ok(()) };
873 if matches!(run.status.as_str(), "completed" | "pending" | "action_required") {
874 return Ok(());
875 }
876 let workflow = match workflow::parse(&run.source) {
877 Ok(workflow) => workflow,
878 Err(problem) => {
879 self.finish_run(&run, Some(&problem)).await?;
880 return Ok(());
881 }
882 };
883 let jobs = self.job_rows(run_id).await?;
884 let mut changed = false;
885 // What to decide on: the workflow's jobs, and the jobs of the
886 // workflows they call, each with its needs as (name, key).
887 let mut units: Vec<Unit> = workflow
888 .jobs
889 .iter()
890 .map(|job| (job.id.clone(), job.clone(), job.needs.iter().map(|n| (n.clone(), n.clone())).collect()))
891 .collect();
892 let mut seen = std::collections::HashSet::new();
893 for row in &jobs {
894 if !seen.insert(row.key.clone()) {
895 continue;
896 }
897 if let Some((_, job, call)) = row.callee() {
898 let parent = call["parent"].as_str().unwrap_or_default().to_owned();
899 let needs = job.needs.iter().map(|n| (n.clone(), format!("{parent}/{n}"))).collect();
900 units.push((row.key.clone(), job, needs));
901 }
902 }
903 // Each key's needs, as keys, to look back through for failure().
904 let needs_of: std::collections::HashMap<&str, Vec<&str>> =
905 units.iter().map(|(key, _, needs)| (key.as_str(), needs.iter().map(|(_, need)| need.as_str()).collect())).collect();
906 let key_failed = |key: &str| key_result(&jobs.iter().filter(|row| row.key == key).collect::<Vec<_>>()) == "failure";
907 for (key, job, needs) in &units {
908 let rows: Vec<&JobRow> = jobs.iter().filter(|row| &row.key == key).collect();
909 if rows.is_empty() || !rows.iter().all(|row| row.status == "waiting" && !row.holds_call()) {
910 continue;
911 }
912 let needed: Vec<(&String, Vec<&JobRow>)> =
913 needs.iter().map(|(name, need)| (name, jobs.iter().filter(|row| &row.key == need).collect())).collect();
914 if !needed.iter().all(|(_, rows)| rows.iter().all(|row| row.status == "completed")) {
915 continue;
916 }
917 let failed_before = ancestor_failed(&needs_of, key, key_failed);
918 self.decide(&run, job, rows[0], &needed, failed_before).await?;
919 changed = true;
920 }
921 // A job that called a workflow finishes with that workflow's jobs.
922 for row in jobs.iter().filter(|row| row.status == "calling") {
923 let prefix = row.call_prefix().unwrap_or(row.key.clone());
924 let children: Vec<&JobRow> = jobs
925 .iter()
926 .filter(|child| child.call().is_some_and(|call| call["role"] == "callee" && call["parent"].as_str() == Some(prefix.as_str())))
927 .collect();
928 if !children.is_empty() && children.iter().all(|child| child.status == "completed") {
929 self.finish_call(&run, row, &children).await?;
930 changed = true;
931 }
932 }
933 // Calls that wait start while their matrix's `max-parallel` and
934 // their concurrency group have room.
935 let mut calling: std::collections::HashMap<&str, u32> = std::collections::HashMap::new();
936 for row in jobs.iter().filter(|row| row.status == "calling") {
937 *calling.entry(row.key.as_str()).or_default() += 1;
938 }
939 for row in jobs.iter().filter(|row| row.holds_call()) {
940 let running = calling.get(row.key.as_str()).copied().unwrap_or(0);
941 if row.max_parallel.is_some_and(|max| running >= max) || self.group_busy(row).await? {
942 continue;
943 }
944 if self.start_call(row).await? {
945 calling.insert(row.key.as_str(), running + 1);
946 changed = true;
947 }
948 }
949 if !changed {
950 break;
951 }
952 }
953 self.start_queued().await?;
954 self.finish_if_done(run_id).await
955 }
956
957 /// Decides on one job whose needs are done: skip it, fail it, or expand
958 /// it into its matrix and queue it. `failed_before`: whether any job
959 /// before it failed, however far back (`ancestor_failed`).
960 async fn decide(&self, run: &RunRow, job: &workflow::Job, row: &JobRow, needed: &[(&String, Vec<&JobRow>)], failed_before: bool) -> Result<()> {
961 let vars = self.variables_for(&run.repo_id, &run.repo, None, run.trusted != 0).await?;
962 let mut contexts = Self::base_contexts(run, &vars, &job.id);
963 // A called workflow's jobs read the inputs they were called with.
964 let call = row.call();
965 // Shown under the job whose call made it, by that job's name.
966 let caller = call.as_ref().filter(|c| c["role"] == "callee").and_then(|c| {
967 c["title"].as_str().map(str::to_owned).or_else(|| c["parent"].as_str().map(|parent| parent.replace('/', " / ")))
968 });
969 if let Some(call) = call.as_ref().filter(|c| c["role"] == "callee") {
970 contexts.insert("inputs".into(), call["inputs"].clone());
971 }
972 let mut needs = Map::new();
973 let mut results = Vec::new();
974 for (key, rows) in needed {
975 let result = key_result(rows);
976 let mut outputs = Map::new();
977 for row in rows {
978 if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {
979 outputs.extend(more);
980 }
981 }
982 results.push(result);
983 needs.insert((*key).clone(), json!({ "result": result, "outputs": outputs }));
984 }
985 // As on GitHub: a need that was skipped makes success() false but
986 // not failure(); failure() is a failure anywhere before the job.
987 let status = expr::job_status(results, failed_before, run.conclusion.as_deref() == Some("cancelled"));
988 contexts.insert("needs".into(), Value::Object(needs));
989 let scope = Scope {
990 contexts: &contexts,
991 status,
992 hash_files: None,
993 };
994 let condition = job.condition.as_deref().unwrap_or_default();
995 match expr::condition(condition, &scope) {
996 Ok(true) => {}
997 Ok(false) => return self.skip_job(row, None).await,
998 Err(problem) => return self.fail_job(row, &format!("Its `if` does not read: {problem}")).await,
999 }
1000 // Its matrix, which may come from a needed job's outputs.
1001 let combinations = match &job.matrix {
1002 None => vec![Map::new()],
1003 Some(matrix) => {
1004 let value = match expr::interpolate_value(matrix, &scope) {
1005 Ok(value) => value,
1006 Err(problem) => return self.fail_job(row, &format!("Its matrix does not read: {problem}")).await,
1007 };
1008 match matrix::expand(&value) {
1009 Ok(combinations) if !combinations.is_empty() => combinations,
1010 Ok(_) => return self.fail_job(row, "Its matrix makes no jobs.").await,
1011 Err(problem) => return self.fail_job(row, &problem).await,
1012 }
1013 }
1014 };
1015 // A job that calls a reusable workflow calls it once for each.
1016 if let Some(uses) = &job.uses {
1017 return self.call_workflow(run, job, row, uses, &contexts, &combinations, caller.as_deref()).await;
1018 }
1019 let total = combinations.len();
1020 let raw = job.raw.as_object().cloned().unwrap_or_default();
1021 // Whether pull requests from forks may use self-hosted runners here,
1022 // asked once, and only for a run that is not trusted.
1023 let mut forks_allowed: Option<bool> = None;
1024 // Each concurrency group its jobs join, and whether it cancels.
1025 let mut groups: Vec<(String, bool)> = Vec::new();
1026 let mut statements = Vec::new();
1027 for (index, combination) in combinations.iter().enumerate() {
1028 let mut contexts = contexts.clone();
1029 contexts.insert("matrix".into(), Value::Object(combination.clone()));
1030 contexts.insert(
1031 "strategy".into(),
1032 json!({ "fail-fast": job.fail_fast, "job-index": index, "job-total": total, "max-parallel": job.max_parallel.unwrap_or(total as u32) }),
1033 );
1034 let scope = Scope {
1035 contexts: &contexts,
1036 status: Status::Success,
1037 hash_files: None,
1038 };
1039 let name = shown_name(job, caller.as_deref(), combination, &scope);
1040 let runs_on = expr::interpolate_value(&job.runs_on, &scope).unwrap_or(Value::Null);
1041 let labels = match &runs_on {
1042 Value::String(label) => vec![label.clone()],
1043 Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
1044 Value::Object(spec) => spec.get("labels").map(|l| match l {
1045 Value::Array(labels) => labels.iter().map(expr::to_text).collect(),
1046 other => vec![expr::to_text(other)],
1047 }).unwrap_or_default(),
1048 _ => Vec::new(),
1049 };
1050 // `runs-on: self-hosted` (or a group): the workspace's own
1051 // machines, which may run any OS. Otherwise g1t's Linux sandboxes.
1052 let group = match &runs_on {
1053 Value::Object(spec) => spec.get("group").map(expr::to_text),
1054 _ => None,
1055 };
1056 let wanted = Wanted::of(&labels, group.as_deref());
1057 let mut reason = if wanted.self_hosted {
1058 None
1059 } else {
1060 labels
1061 .iter()
1062 .find(|label| {
1063 let lower = label.to_ascii_lowercase();
1064 lower.contains("windows") || lower.contains("macos")
1065 })
1066 .map(|label| {
1067 let os = if label.to_ascii_lowercase().contains("windows") { "windows" } else { "macos" };
1068 format!("`runs-on: {label}`: g1t's own runners are Linux. A self-hosted runner can run it: `runs-on: [self-hosted, {os}]`.")
1069 })
1070 };
1071 // A pull request from a fork runs code anyone could write: never
1072 // on the workspace's machines unless it said they may.
1073 if wanted.self_hosted && run.trusted == 0 {
1074 let allowed = match forks_allowed {
1075 Some(allowed) => allowed,
1076 None => {
1077 let allowed = self.effective_runner_settings(&row.namespace, Some(&run.repo_id)).await?.fork_pull_requests;
1078 forks_allowed = Some(allowed);
1079 allowed
1080 }
1081 };
1082 if !allowed {
1083 reason = Some(
1084 "Pull requests from forks do not run on self-hosted runners here. An admin can allow it under Settings, Runners.".to_owned(),
1085 );
1086 }
1087 }
1088 let max_minutes = if wanted.self_hosted { SELF_HOSTED_MAX_TIMEOUT_MINUTES } else { MAX_TIMEOUT_MINUTES };
1089 let timeout = raw
1090 .get("timeout-minutes")
1091 .and_then(|value| expr::interpolate_value(value, &scope).ok())
1092 .and_then(|value| value.as_f64().or_else(|| expr::to_text(&value).parse().ok()))
1093 .map_or(g1t_actions::workflow::DEFAULT_TIMEOUT_MINUTES.min(max_minutes), |minutes| (minutes.ceil() as u32).clamp(1, max_minutes));
1094 let continue_on_error = raw
1095 .get("continue-on-error")
1096 .and_then(|value| expr::interpolate_value(value, &scope).ok())
1097 .is_some_and(|value| expr::truthy(&value));
1098 let (mut status, mut conclusion, mut finished) = match &reason {
1099 Some(_) => ("completed", Some("failure"), Some(now())),
1100 None => ("queued", None, None),
1101 };
1102 // A self-hosted job waits, saying for what, until a runner takes it.
1103 let (labels_json, queued_at) = if wanted.self_hosted && reason.is_none() {
1104 reason = Some(waiting_reason(&wanted));
1105 (Some(serde_json::to_string(&wanted.stored())?), Some(now()))
1106 } else {
1107 (None, None)
1108 };
1109 // The environment it names, an expression read now, and what
1110 // that environment's protection rules say: it starts, waits as
1111 // `pending` (protection.rs), or may not deploy there.
1112 let environment = environment_of(&job.raw, &contexts).map(|env| env.name);
1113 if status == "queued"
1114 && let Some(name) = &environment
1115 {
1116 match self.gate(run, name).await? {
1117 Gate::Open => {}
1118 Gate::Held(why) => {
1119 status = "pending";
1120 reason = Some(why);
1121 }
1122 Gate::Refused(why) => {
1123 (status, conclusion, finished) = ("completed", Some("failure"), Some(now()));
1124 reason = Some(why);
1125 }
1126 }
1127 }
1128 // Its own concurrency group.
1129 let job_group = job
1130 .concurrency
1131 .as_ref()
1132 .and_then(|c| expr::interpolate(&c.group, &scope).ok())
1133 .map(|group| group.trim().to_owned())
1134 .filter(|group| !group.is_empty());
1135 let job_cancel = job
1136 .concurrency
1137 .as_ref()
1138 .and_then(|c| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())
1139 .is_some_and(|value| expr::truthy(&value));
1140 if status != "completed"
1141 && let Some(group) = &job_group
1142 && !groups.iter().any(|(known, _)| known == group)
1143 {
1144 groups.push((group.clone(), job_cancel));
1145 }
1146 let values: Vec<worker::wasm_bindgen::JsValue> = vec![
1147 name.into(),
1148 serde_json::to_string(combination)?.into(),
1149 status.into(),
1150 optional(conclusion),
1151 optional(reason.as_deref()),
1152 timeout.into(),
1153 u32::from(continue_on_error).into(),
1154 job.max_parallel.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
1155 optional(finished.as_deref()),
1156 optional(labels_json.as_deref()),
1157 optional(queued_at.as_deref()),
1158 optional(environment.as_deref()),
1159 optional(job_group.as_deref()),
1160 u32::from(job_cancel).into(),
1161 ];
1162 if index == 0 {
1163 let mut bound = values;
1164 bound.push(row.id.as_str().into());
1165 statements.push(
1166 self.db
1167 .prepare(
1168 "UPDATE jobs SET name = ?, matrix = ?, status = ?, conclusion = ?, reason = ?, timeout_minutes = ?,
1169 continue_on_error = ?, max_parallel = ?, finished_at = ?, labels = ?, queued_at = ?, environment = ?,
1170 concurrency_group = ?, cancel_in_progress = ? WHERE id = ?",
1171 )
1172 .bind(&bound)?,
1173 );
1174 } else {
1175 let mut bound: Vec<worker::wasm_bindgen::JsValue> = vec![
1176 new_id("job", now_ms()).into(),
1177 row.run_id.as_str().into(),
1178 row.repo_id.as_str().into(),
1179 row.namespace.as_str().into(),
1180 row.key.as_str().into(),
1181 (index as u32).into(),
1182 row.needs.as_str().into(),
1183 optional(row.call.as_deref()),
1184 ];
1185 bound.extend(values);
1186 statements.push(
1187 self.db
1188 .prepare(
1189 "INSERT INTO jobs (id, run_id, repo_id, namespace, key, ordinal, needs, call, name, matrix, status, conclusion, reason,
1190 timeout_minutes, continue_on_error, max_parallel, finished_at, labels, queued_at, environment,
1191 concurrency_group, cancel_in_progress)
1192 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
1193 )
1194 .bind(&bound)?,
1195 );
1196 }
1197 }
1198 self.db.batch(statements).await?;
1199 self.replace_in_groups(run, &row.key, &groups).await
1200 }
1201
1202 /// A job queued in its own concurrency group: with `cancel-in-progress`
1203 /// it cancels the group's other jobs; otherwise it replaces any that
1204 /// are queued and not started, and waits for the one running
1205 /// (`start_queued` starts one of a group at a time). As on GitHub.
1206 async fn replace_in_groups(&self, run: &RunRow, key: &str, groups: &[(String, bool)]) -> Result<()> {
1207 if groups.is_empty() {
1208 return Ok(());
1209 }
1210 #[derive(Deserialize)]
1211 struct Id {
1212 id: String,
1213 }
1214 let mine: Vec<String> = self
1215 .db
1216 .prepare("SELECT id FROM jobs WHERE run_id = ? AND key = ?")
1217 .bind(&[run.id.as_str().into(), key.into()])?
1218 .all()
1219 .await?
1220 .results::<Id>()?
1221 .into_iter()
1222 .map(|row| row.id)
1223 .collect();
1224 let mut moved: Vec<String> = Vec::new();
1225 for (group, cancel) in groups {
1226 let others = self
1227 .db
1228 // A call that waits in the group, or calls, is in it too.
1229 .prepare("SELECT * FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status IN ('waiting', 'queued', 'pending', 'in_progress', 'calling')")
1230 .bind(&[run.repo_id.as_str().into(), group.as_str().into()])?
1231 .all()
1232 .await?
1233 .results::<JobRow>()?;
1234 for other in others.iter().filter(|other| !mine.contains(&other.id)) {
1235 if *cancel || matches!(other.status.as_str(), "queued" | "waiting") {
1236 self.stop_job(other, "A newer job in the same concurrency group replaced it.").await?;
1237 if !moved.contains(&other.run_id) {
1238 moved.push(other.run_id.clone());
1239 }
1240 }
1241 }
1242 }
1243 for other_run in moved.iter().filter(|id| **id != run.id) {
1244 Box::pin(self.advance(other_run)).await?;
1245 }
1246 Ok(())
1247 }
1248
1249 /// A job that calls a reusable workflow, in the repository or another
1250 /// (reach.rs): once for each combination of its matrix, as on GitHub,
1251 /// each with the inputs and secrets it passes read with that
1252 /// combination's `matrix`. Each call waits (`holds_call`) until its
1253 /// matrix's `max-parallel` and its concurrency group have room, when
1254 /// `start_call` puts the workflow's jobs in the run under it.
1255 #[allow(clippy::too_many_arguments)]
1256 async fn call_workflow(
1257 &self,
1258 run: &RunRow,
1259 job: &workflow::Job,
1260 row: &JobRow,
1261 uses: &str,
1262 contexts: &Map<String, Value>,
1263 combinations: &[Map<String, Value>],
1264 caller: Option<&str>,
1265 ) -> Result<()> {
1266 let depth = row.call().and_then(|c| c["depth"].as_u64()).unwrap_or(0) + 1;
1267 if depth > MAX_CALL_DEPTH {
1268 return self.fail_job(row, &call_allowed(depth, &[], uses).unwrap_err()).await;
1269 }
1270 let (file, source, origin) = match self.called_workflow(run, row, uses).await? {
1271 Ok(found) => found,
1272 Err(why) => return self.fail_job(row, &why).await,
1273 };
1274 let jobs = self.job_rows(&run.id).await?;
1275 // Each call so far, by the workflow it called.
1276 let called_paths: Vec<String> = jobs
1277 .iter()
1278 .filter(|other| other.call_prefix().is_some())
1279 .filter_map(JobRow::call)
1280 .filter_map(|call| call["path"].as_str().map(str::to_owned))
1281 .collect();
1282 let called_already: Vec<&str> = called_paths.iter().map(String::as_str).collect();
1283 if let Err(why) = call_allowed(depth, &called_already, &file) {
1284 return self.fail_job(row, &why).await;
1285 }
1286 let called = match workflow::parse(&source) {
1287 Ok(called) => called,
1288 Err(problem) => return self.fail_job(row, &format!("`{file}` does not read: {problem}")).await,
1289 };
1290 let Some(trigger) = called.trigger("workflow_call") else {
1291 return self.fail_job(row, &format!("`{file}` cannot be called: it has no `on: workflow_call`.")).await;
1292 };
1293 // Secrets: none but the job's token unless `secrets:` passes them,
1294 // by name or with `inherit`; read when each job starts (job_spec).
1295 let outer = row.call().filter(|c| c["role"] == "callee").and_then(|c| c.get("secrets").cloned());
1296 let total = combinations.len();
1297 let mut groups: Vec<(String, bool)> = Vec::new();
1298 let mut statements = Vec::new();
1299 for (index, combination) in combinations.iter().enumerate() {
1300 let mut contexts = contexts.clone();
1301 contexts.insert("matrix".into(), Value::Object(combination.clone()));
1302 contexts.insert(
1303 "strategy".into(),
1304 json!({ "fail-fast": job.fail_fast, "job-index": index, "job-total": total, "max-parallel": job.max_parallel.unwrap_or(total as u32) }),
1305 );
1306 let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
1307 let name = shown_name(job, caller, combination, &scope);
1308 // Inputs: what `with:` passes, as the called workflow types them.
1309 let given = match job.raw.get("with") {
1310 Some(with) => match expr::interpolate_value(with, &scope) {
1311 Ok(Value::Object(given)) => Ok(given),
1312 Ok(_) => Ok(Map::new()),
1313 Err(problem) => Err(format!("Its `with` does not read: {problem}")),
1314 },
1315 None => Ok(Map::new()),
1316 };
1317 let inputs = given.and_then(|given| crate::reach::call_inputs(&file, &trigger.inputs, &given));
1318 let secrets = crate::reach::secrets_plan(&job.raw, &contexts, outer.clone());
1319 let problem = match &inputs {
1320 Err(why) => Some(why.clone()),
1321 Ok(_) => crate::reach::missing_secrets(&called.raw, &secrets)
1322 .first()
1323 .map(|name| format!("`{file}` needs the secret `{name}`: pass it under `secrets:`, or use `secrets: inherit`."))
1324 .or_else(|| {
1325 crate::reach::undeclared_secrets(&called.raw, &secrets)
1326 .first()
1327 .map(|name| format!("Invalid secret: `{name}` is not defined in `{file}`."))
1328 }),
1329 };
1330 // Its own concurrency group, which it holds while its workflow runs.
1331 let group = job
1332 .concurrency
1333 .as_ref()
1334 .and_then(|c| expr::interpolate(&c.group, &scope).ok())
1335 .map(|group| group.trim().to_owned())
1336 .filter(|group| !group.is_empty());
1337 let cancel = job
1338 .concurrency
1339 .as_ref()
1340 .and_then(|c| expr::interpolate_value(&c.cancel_in_progress, &scope).ok())
1341 .is_some_and(|value| expr::truthy(&value));
1342 if problem.is_none()
1343 && let Some(group) = &group
1344 && !groups.iter().any(|(known, _)| known == group)
1345 {
1346 groups.push((group.clone(), cancel));
1347 }
1348 let call = json!({
1349 "role": "caller", "path": file, "source": source, "origin": origin, "depth": depth,
1350 "prefix": call_prefix(&row.key, job.matrix.is_some().then_some(index)), "title": name,
1351 "inputs": inputs.unwrap_or_default(), "secrets": secrets, "fail_fast": job.fail_fast,
1352 });
1353 let (status, conclusion, finished) = match &problem {
1354 Some(_) => ("completed", Some("failure"), Some(now())),
1355 None => ("waiting", None, None),
1356 };
1357 let values: Vec<worker::wasm_bindgen::JsValue> = vec![
1358 name.as_str().into(),
1359 serde_json::to_string(combination)?.into(),
1360 status.into(),
1361 optional(conclusion),
1362 optional(problem.as_deref()),
1363 job.max_parallel.map(|max| max.max(1)).map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
1364 optional(finished.as_deref()),
1365 optional(group.as_deref()),
1366 u32::from(cancel).into(),
1367 serde_json::to_string(&call)?.into(),
1368 ];
1369 if index == 0 {
1370 let mut bound = values;
1371 bound.push(row.id.as_str().into());
1372 statements.push(
1373 self.db
1374 .prepare(
1375 "UPDATE jobs SET name = ?, matrix = ?, status = ?, conclusion = ?, reason = ?, max_parallel = ?, finished_at = ?,
1376 concurrency_group = ?, cancel_in_progress = ?, call = ? WHERE id = ?",
1377 )
1378 .bind(&bound)?,
1379 );
1380 } else {
1381 let mut bound: Vec<worker::wasm_bindgen::JsValue> = vec![
1382 new_id("job", now_ms()).into(),
1383 row.run_id.as_str().into(),
1384 row.repo_id.as_str().into(),
1385 row.namespace.as_str().into(),
1386 row.key.as_str().into(),
1387 (index as u32).into(),
1388 row.needs.as_str().into(),
1389 ];
1390 bound.extend(values);
1391 statements.push(
1392 self.db
1393 .prepare(
1394 "INSERT INTO jobs (id, run_id, repo_id, namespace, key, ordinal, needs, name, matrix, status, conclusion, reason,
1395 max_parallel, finished_at, concurrency_group, cancel_in_progress, call)
1396 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
1397 )
1398 .bind(&bound)?,
1399 );
1400 }
1401 }
1402 self.db.batch(statements).await?;
1403 self.replace_in_groups(run, &row.key, &groups).await
1404 }
1405
1406 /// Whether another job of `row`'s concurrency group runs, or calls a
1407 /// workflow, so that `row` waits for it.
1408 async fn group_busy(&self, row: &JobRow) -> Result<bool> {
1409 let Some(group) = &row.concurrency_group else { return Ok(false) };
1410 let busy = self
1411 .db
1412 .prepare("SELECT COUNT(*) AS n FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status IN ('in_progress', 'calling') AND id != ?")
1413 .bind(&[row.repo_id.as_str().into(), group.as_str().into(), row.id.as_str().into()])?
1414 .first::<Count>(None)
1415 .await?
1416 .map_or(0, |count| count.n);
1417 Ok(busy > 0)
1418 }
1419
1420 /// A call that waited (`holds_call`) is made: the called workflow's
1421 /// jobs join the run under it, named under its name and keyed under its
1422 /// prefix. False when it no longer waits.
1423 async fn start_call(&self, row: &JobRow) -> Result<bool> {
1424 let Some(call) = row.call() else { return Ok(false) };
1425 let Some(prefix) = row.call_prefix() else { return Ok(false) };
1426 let Some(called) = call["source"].as_str().and_then(|source| workflow::parse(source).ok()) else { return Ok(false) };
1427 let file = call["path"].as_str().unwrap_or_default();
1428 let started = self
1429 .db
1430 .prepare("UPDATE jobs SET status = 'calling', reason = ?, started_at = ? WHERE id = ? AND status = 'waiting' RETURNING id")
1431 .bind(&[format!("Calls `{file}`.").into(), now().into(), row.id.as_str().into()])?
1432 .first::<Value>(None)
1433 .await?;
1434 if started.is_none() {
1435 return Ok(false);
1436 }
1437 let mut statements = Vec::new();
1438 for called_job in &called.jobs {
1439 let needs: Vec<String> = called_job.needs.iter().map(|n| format!("{prefix}/{n}")).collect();
1440 let callee = json!({
1441 "role": "callee", "parent": prefix, "title": row.name, "job": called_job.id, "path": file,
1442 "source": call["source"], "inputs": call["inputs"], "depth": call["depth"], "origin": call["origin"], "secrets": call["secrets"],
1443 });
1444 statements.push(
1445 self.db
1446 .prepare("INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, needs, status, call) VALUES (?, ?, ?, ?, ?, ?, ?, 'waiting', ?)")
1447 .bind(&[
1448 new_id("job", now_ms()).into(),
1449 row.run_id.as_str().into(),
1450 row.repo_id.as_str().into(),
1451 row.namespace.as_str().into(),
1452 format!("{prefix}/{}", called_job.id).into(),
1453 format!("{} / {}", row.name, called_job.name.clone().unwrap_or(called_job.id.clone())).into(),
1454 serde_json::to_string(&needs)?.into(),
1455 serde_json::to_string(&callee)?.into(),
1456 ])?,
1457 );
1458 }
1459 if !statements.is_empty() {
1460 self.db.batch(statements).await?;
1461 }
1462 Ok(true)
1463 }
1464
1465 /// The runs with a call waiting in `group`, but `run_id`, moved along
1466 /// now that a job of the group has finished.
1467 async fn wake_group(&self, repo_id: &str, group: &str, run_id: &str) -> Result<()> {
1468 #[derive(Deserialize)]
1469 struct RunId {
1470 run_id: String,
1471 }
1472 let waiting = self
1473 .db
1474 .prepare("SELECT DISTINCT run_id FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status = 'waiting' AND run_id != ?")
1475 .bind(&[repo_id.into(), group.into(), run_id.into()])?
1476 .all()
1477 .await?
1478 .results::<RunId>()?;
1479 for other in waiting {
1480 Box::pin(self.advance(&other.run_id)).await?;
1481 }
1482 Ok(())
1483 }
1484
1485 /// A job that called a workflow, finished with its jobs: their result,
1486 /// and the outputs the workflow declares. A failed call of a fail-fast
1487 /// matrix stops the matrix's other calls.
1488 async fn finish_call(&self, run: &RunRow, row: &JobRow, children: &[&JobRow]) -> Result<()> {
1489 let call = row.call().unwrap_or_default();
1490 let called = call["source"].as_str().and_then(|s| workflow::parse(s).ok());
1491 let mut jobs_context = Map::new();
1492 let mut by_key: std::collections::BTreeMap<String, Vec<&JobRow>> = std::collections::BTreeMap::new();
1493 for child in children {
1494 by_key.entry(child.key.clone()).or_default().push(child);
1495 }
1496 for (key, rows) in &by_key {
1497 let mut outputs = Map::new();
1498 for child in rows {
1499 if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&child.outputs) {
1500 outputs.extend(more);
1501 }
1502 }
1503 let id = key.rsplit('/').next().unwrap_or(key);
1504 jobs_context.insert(id.to_owned(), json!({ "result": key_result(rows), "outputs": outputs }));
1505 }
1506 let inputs = children.first().and_then(|c| c.call()).map(|c| c["inputs"].clone()).unwrap_or(json!({}));
1507 let mut contexts = Map::new();
1508 contexts.insert("jobs".into(), Value::Object(jobs_context));
1509 contexts.insert("inputs".into(), inputs);
1510 let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
1511 let mut outputs = Map::new();
1512 if let Some(Value::Object(declared)) = called.as_ref().map(|w| {
1513 let on = w.raw.get("on").or_else(|| w.raw.get("true")).cloned().unwrap_or(Value::Null);
1514 on.get("workflow_call").and_then(|c| c.get("outputs")).cloned().unwrap_or(Value::Null)
1515 }) {
1516 for (name, spec) in declared {
1517 if let Some(value) = spec.get("value") {
1518 let value = expr::interpolate_value(value, &scope).unwrap_or(Value::Null);
1519 outputs.insert(name, Value::String(expr::to_text(&value)));
1520 }
1521 }
1522 }
1523 let conclusion = key_result(children);
1524 let finished = self
1525 .db
1526 .prepare("UPDATE jobs SET status = 'completed', conclusion = ?, outputs = ?, finished_at = ? WHERE id = ? AND status = 'calling' RETURNING id")
1527 .bind(&[conclusion.into(), serde_json::to_string(&outputs)?.into(), now().into(), row.id.as_str().into()])?
1528 .first::<Value>(None)
1529 .await?;
1530 if finished.is_none() {
1531 return Ok(());
1532 }
1533 if conclusion == "failure" && row.matrix.as_deref().is_some_and(|m| m != "{}") && call["fail_fast"] != json!(false) {
1534 let siblings = self
1535 .db
1536 .prepare("SELECT * FROM jobs WHERE run_id = ? AND key = ? AND status != 'completed'")
1537 .bind(&[row.run_id.as_str().into(), row.key.as_str().into()])?
1538 .all()
1539 .await?
1540 .results::<JobRow>()?;
1541 for sibling in siblings {
1542 self.stop_job(&sibling, "Another job of its matrix failed, and the matrix is fail-fast.").await?;
1543 }
1544 }
1545 if let Some(group) = &row.concurrency_group {
1546 self.wake_group(&run.repo_id, group, &run.id).await?;
1547 }
1548 Ok(())
1549 }
1550
1551 /// A file's text at a commit, if it is there.
1552 pub(crate) async fn read_file(&self, path: &RepoPath, ws: &g1t_contracts::User, sha: &str, file: &str) -> Result<Option<String>> {
1553 let blob: Outcome<g1t_contracts::repos::BlobView> = g1t_kit::call(
1554 &self.repos,
1555 "blob",
1556 &g1t_contracts::repos::BlobArgs {
1557 path: path.clone(),
1558 viewer: Some(ws.clone()),
1559 git_ref: sha.to_owned(),
1560 file_path: file.to_owned(),
1561 },
1562 )
1563 .await?;
1564 Ok(match blob {
1565 Outcome::Ok(view) => view.text,
1566 Outcome::Fail(_) => None,
1567 })
1568 }
1569
1570 async fn skip_job(&self, row: &JobRow, reason: Option<&str>) -> Result<()> {
1571 self.db
1572 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'skipped', reason = ?, finished_at = ? WHERE id = ?")
1573 .bind(&[optional(reason), now().into(), row.id.as_str().into()])?
1574 .run()
1575 .await?;
1576 Ok(())
1577 }
1578
1579 async fn fail_job(&self, row: &JobRow, reason: &str) -> Result<()> {
1580 self.db
1581 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ? WHERE id = ? AND status != 'completed'")
1582 .bind(&[reason.into(), now().into(), row.id.as_str().into()])?
1583 .run()
1584 .await?;
1585 Ok(())
1586 }
1587
1588 /// Starts queued jobs, oldest first, while their workspace has room.
1589 pub async fn start_queued(&self) -> Result<()> {
1590 let queued = self
1591 .db
1592 // Self-hosted jobs are taken by their runners (runners.rs).
1593 .prepare("SELECT * FROM jobs WHERE status = 'queued' AND labels IS NULL ORDER BY rowid LIMIT 50")
1594 .all()
1595 .await?
1596 .results::<JobRow>()?;
1597 let mut running: std::collections::HashMap<String, u32> = std::collections::HashMap::new();
1598 for job in queued {
1599 let in_workspace = match running.get(&job.namespace) {
1600 Some(n) => *n,
1601 None => {
1602 let n = self
1603 .db
1604 // Only g1t's own sandboxes count against the workspace's room.
1605 .prepare("SELECT COUNT(*) AS n FROM jobs WHERE status = 'in_progress' AND namespace = ? AND runner_id IS NULL")
1606 .bind(&[job.namespace.as_str().into()])?
1607 .first::<Count>(None)
1608 .await?
1609 .map_or(0, |count| count.n);
1610 running.insert(job.namespace.clone(), n);
1611 n
1612 }
1613 };
1614 if in_workspace >= RUNNING_PER_WORKSPACE {
1615 continue;
1616 }
1617 if let Some(max) = job.max_parallel {
1618 let siblings = self
1619 .db
1620 .prepare("SELECT COUNT(*) AS n FROM jobs WHERE run_id = ? AND key = ? AND status = 'in_progress'")
1621 .bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?
1622 .first::<Count>(None)
1623 .await?
1624 .map_or(0, |count| count.n);
1625 if siblings >= max {
1626 continue;
1627 }
1628 }
1629 // One job of a concurrency group runs at a time.
1630 if let Some(group) = &job.concurrency_group {
1631 let running = self
1632 .db
1633 .prepare("SELECT COUNT(*) AS n FROM jobs WHERE repo_id = ? AND concurrency_group = ? AND status IN ('in_progress', 'calling') AND id != ?")
1634 .bind(&[job.repo_id.as_str().into(), group.as_str().into(), job.id.as_str().into()])?
1635 .first::<Count>(None)
1636 .await?
1637 .map_or(0, |count| count.n);
1638 if running > 0 {
1639 continue;
1640 }
1641 }
1642 let token = random_hex(24);
1643 let at = now();
1644 let claimed = self
1645 .db
1646 .prepare(
1647 "UPDATE jobs SET status = 'in_progress', token_hash = ?, first_token_hash = NULL, started_at = ?, seen_at = ? WHERE id = ? AND status = 'queued' RETURNING id",
1648 )
1649 .bind(&[sha256_hex(&token).into(), at.as_str().into(), at.as_str().into(), job.id.as_str().into()])?
1650 .first::<Value>(None)
1651 .await?;
1652 if claimed.is_none() {
1653 continue;
1654 }
1655 running.insert(job.namespace.clone(), in_workspace + 1);
1656 self.db
1657 .prepare("UPDATE runs SET status = 'in_progress', started_at = COALESCE(started_at, ?) WHERE id = ? AND status = 'queued'")
1658 .bind(&[at.as_str().into(), job.run_id.as_str().into()])?
1659 .run()
1660 .await?;
1661 let run = self.run_row(&job.run_id).await?;
1662 let repo: RepoPath = run.as_ref().map(|run| repo_path(&run.repo)).unwrap_or(RepoPath {
1663 namespace: job.namespace.clone(),
1664 name: String::new(),
1665 });
1666 // The machine it asked for, for the runner.
1667 let instance = run.as_ref().and_then(|run| start_instance(run, &job));
1668 let trusted = run.as_ref().is_some_and(|run| run.trusted != 0);
1669 // Only a trusted run's jobs get secrets, brokered ones included.
1670 let brokered = trusted && self.may_broker(&job.repo_id, &job.namespace).await?;
1671 let started: Outcome<Value> = g1t_kit::call(
1672 &self.runner,
1673 "start_actions_job",
1674 &StartJobArgs {
1675 job: job.id.clone(),
1676 token,
1677 repo,
1678 timeout_minutes: job.timeout_minutes,
1679 instance,
1680 brokered,
1681 },
1682 )
1683 .await
1684 .unwrap_or_else(|error| fail(FailureCode::Conflict, format!("The runner could not be reached: {error}")));
1685 if let Outcome::Fail(refused) = started {
1686 // Billing would not pay for a scheduled run's job: the
1687 // schedule waits rather than making runs only to refuse them.
1688 if refused.code == FailureCode::PaymentRequired
1689 && let Some(run) = run.as_ref().filter(|run| run.event == "schedule")
1690 {
1691 self.db
1692 .prepare("UPDATE workflows SET schedule_refused_until = ? WHERE id = ?")
1693 .bind(&[rfc3339(now_ms() + crate::SCHEDULE_REFUSED_MS).into(), run.workflow_id.as_str().into()])?
1694 .run()
1695 .await?;
1696 }
1697 Box::pin(self.finish_job(&job.id, "failure", Some(&refused.message), None)).await?;
1698 } else {
1699 self.job_started(&job.id).await?;
1700 }
1701 }
1702 Ok(())
1703 }
1704
1705 /// Finishes a job and moves its run along.
1706 pub async fn finish_job(&self, job_id: &str, conclusion: &str, reason: Option<&str>, outputs: Option<&Map<String, Value>>) -> Result<()> {
1707 let finished = self
1708 .db
1709 .prepare(
1710 "UPDATE jobs SET status = 'completed', conclusion = ?, reason = COALESCE(?, reason), outputs = COALESCE(?, outputs),
1711 finished_at = ?, token_hash = NULL, first_token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *",
1712 )
1713 .bind(&[
1714 conclusion.into(),
1715 optional(reason),
1716 outputs.map(|o| serde_json::to_string(o).unwrap_or_default()).as_deref().map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
1717 now().into(),
1718 job_id.into(),
1719 ])?
1720 .first::<JobRow>(None)
1721 .await?;
1722 let Some(job) = finished else { return Ok(()) };
1723 self.tell_live(&job.repo_id, &job.run_id, None, None).await;
1724 // Its G1T_TOKEN stops working with it.
1725 self.revoke_job_tokens(&job.id).await;
1726 // A g1t.page build it opened and did not finish fails now, not at
1727 // the deployments sweep. Only a job that ran can have opened one.
1728 if job.started_at.is_some() {
1729 self.end_job_builds(&job.id, conclusion).await;
1730 }
1731 // A job that deploys failed: so did its run's deployment, now.
1732 if conclusion == "failure" && job.continue_on_error == 0 && job.started_at.is_some()
1733 && let Some(run) = self.run_row(&job.run_id).await?
1734 && let Some(env) = deploys_to(&run, &job)
1735 {
1736 self.report_deployment(&run, &env, "failure", false).await;
1737 }
1738 // A self-hosted runner's job: the runner is free again, and its time
1739 // is recorded, at nothing.
1740 if job.runner_id.is_some() {
1741 self.released(&job).await?;
1742 }
1743 // Steps still marked as going are not going any more.
1744 let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
1745 let mut touched = false;
1746 for step in steps.iter_mut() {
1747 if step["status"] != "completed" {
1748 let was_running = step["status"] == "in_progress";
1749 step["status"] = json!("completed");
1750 step["conclusion"] = json!(if was_running { conclusion } else { "skipped" });
1751 touched = true;
1752 }
1753 }
1754 if touched {
1755 self.db
1756 .prepare("UPDATE jobs SET steps = ? WHERE id = ?")
1757 .bind(&[serde_json::to_string(&steps)?.into(), job.id.as_str().into()])?
1758 .run()
1759 .await?;
1760 }
1761 // fail-fast: one failed combination stops the rest of its matrix.
1762 if conclusion == "failure" && job.continue_on_error == 0 && job.matrix.as_deref().is_some_and(|m| m != "{}") {
1763 let run = self.run_row(&job.run_id).await?;
1764 // As its workflow, or the workflow it is a job of, says.
1765 let fail_fast = run.as_ref().and_then(|run| job_spec(run, &job)).is_none_or(|j| j.fail_fast);
1766 if fail_fast {
1767 let siblings = self
1768 .db
1769 .prepare("SELECT * FROM jobs WHERE run_id = ? AND key = ? AND status != 'completed'")
1770 .bind(&[job.run_id.as_str().into(), job.key.as_str().into()])?
1771 .all()
1772 .await?
1773 .results::<JobRow>()?;
1774 for sibling in siblings {
1775 self.stop_job(&sibling, "Another job of its matrix failed, and the matrix is fail-fast.").await?;
1776 }
1777 }
1778 }
1779 // A call waiting in its concurrency group, in another run, may start.
1780 if let Some(group) = &job.concurrency_group {
1781 self.wake_group(&job.repo_id, group, &job.run_id).await?;
1782 }
1783 Box::pin(self.advance(&job.run_id)).await
1784 }
1785
1786 /// Cancels a job. One that is running is told to stop (the answer to
1787 /// its next report), and runs its `if: always()` and `cancelled()`
1788 /// steps and its post steps before it ends `cancelled`; one that has
1789 /// not started is cancelled at once.
1790 async fn stop_job(&self, job: &JobRow, reason: &str) -> Result<()> {
1791 // A job calling a workflow stops with that workflow's jobs.
1792 if job.status == "calling"
1793 && let Some(prefix) = job.call_prefix()
1794 {
1795 let under = format!("{prefix}/");
1796 for child in self.job_rows(&job.run_id).await?.iter().filter(|child| child.key.starts_with(&under) && child.status != "completed") {
1797 Box::pin(self.stop_job(child, reason)).await?;
1798 }
1799 }
1800 if job.status == "in_progress" && job.started_at.is_some() {
1801 self.db
1802 .prepare("UPDATE jobs SET cancel_requested_at = COALESCE(cancel_requested_at, ?), reason = ? WHERE id = ? AND status = 'in_progress'")
1803 .bind(&[now().into(), reason.into(), job.id.as_str().into()])?
1804 .run()
1805 .await?;
1806 return Ok(());
1807 }
1808 self.hard_stop(job, reason).await
1809 }
1810
1811 /// Cancels a job outright, stopping its sandbox if it has one.
1812 async fn hard_stop(&self, job: &JobRow, reason: &str) -> Result<()> {
1813 // A self-hosted runner hears it was cancelled on its next poll.
1814 if job.status == "in_progress" && job.runner_id.is_none() {
1815 let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;
1816 }
1817 let stopped = self
1818 .db
1819 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'cancelled', reason = ?, finished_at = ?, token_hash = NULL, first_token_hash = NULL WHERE id = ? AND status != 'completed' RETURNING *")
1820 .bind(&[reason.into(), now().into(), job.id.as_str().into()])?
1821 .first::<JobRow>(None)
1822 .await?;
1823 if stopped.as_ref().is_some_and(|row| row.started_at.is_some()) {
1824 self.revoke_job_tokens(&job.id).await;
1825 self.end_job_builds(&job.id, "cancelled").await;
1826 }
1827 if let Some(stopped) = stopped.filter(|row| row.runner_id.is_some()) {
1828 self.released(&stopped).await?;
1829 }
1830 Ok(())
1831 }
1832
1833 /// Ends a job's tokens at once. A failure is logged: the token expires
1834 /// on its own soon after the job's time limit.
1835 async fn revoke_job_tokens(&self, job_id: &str) {
1836 let revoked: Result<bool> =
1837 g1t_kit::call(&self.identity, "revoke_job_tokens", &RevokeJobTokensArgs { job_id: job_id.to_owned() }).await;
1838 if let Err(error) = revoked {
1839 worker::console_error!("actions: the tokens of job {job_id} were not revoked: {error}");
1840 }
1841 }
1842
1843 /// Finishes the run when every job has.
1844 async fn finish_if_done(&self, run_id: &str) -> Result<()> {
1845 let Some(run) = self.run_row(run_id).await? else { return Ok(()) };
1846 if matches!(run.status.as_str(), "completed" | "pending" | "action_required") {
1847 return Ok(());
1848 }
1849 let jobs = self.job_rows(run_id).await?;
1850 if !jobs.iter().all(|job| job.status == "completed") {
1851 return Ok(());
1852 }
1853 self.finish_run(&run, None).await
1854 }
1855
1856 async fn finish_run(&self, run: &RunRow, error: Option<&str>) -> Result<()> {
1857 let jobs = self.job_rows(&run.id).await?;
1858 let rows: Vec<&JobRow> = jobs.iter().collect();
1859 let conclusion = if error.is_some() {
1860 "failure"
1861 } else if run.conclusion.as_deref() == Some("cancelled") {
1862 "cancelled"
1863 } else if rows.is_empty() {
1864 "skipped"
1865 } else {
1866 key_result(&rows)
1867 };
1868 let done = self
1869 .db
1870 .prepare("UPDATE runs SET status = 'completed', conclusion = ?, error = COALESCE(?, error), finished_at = ? WHERE id = ? AND status != 'completed' RETURNING id")
1871 .bind(&[conclusion.into(), optional(error), now().into(), run.id.as_str().into()])?
1872 .first::<Value>(None)
1873 .await?;
1874 if done.is_none() {
1875 return Ok(());
1876 }
1877 self.report_status(run, conclusion).await?;
1878 self.settle_deployments(run, &jobs, conclusion == "cancelled").await;
1879 let published: Result<()> = g1t_kit::call(
1880 &self.events,
1881 "publish",
1882 &g1t_contracts::events::Publish {
1883 events: vec![g1t_contracts::events::NewEvent {
1884 kind: "workflow.completed",
1885 source: "actions",
1886 repo_id: Some(run.repo_id.clone()),
1887 actor: run.actor_id.clone(),
1888 data: g1t_contracts::events::WorkflowEvent {
1889 run_id: run.id.clone(),
1890 repo_id: run.repo_id.clone(),
1891 workflow: run.name.clone(),
1892 path: run.path.clone(),
1893 number: run.number,
1894 event: run.event.clone(),
1895 conclusion: conclusion.to_owned(),
1896 git_ref: run.git_ref.clone(),
1897 sha: run.sha.clone(),
1898 pull: run.pull,
1899 },
1900 }],
1901 },
1902 )
1903 .await;
1904 if let Err(error) = published {
1905 worker::console_error!("actions: could not publish workflow.completed: {error}");
1906 }
1907 // The next run waiting in its concurrency group.
1908 if let Some(group) = &run.concurrency_group {
1909 let next = self
1910 .db
1911 .prepare("SELECT * FROM runs WHERE repo_id = ? AND concurrency_group = ? AND status = 'pending' ORDER BY id LIMIT 1")
1912 .bind(&[run.repo_id.as_str().into(), group.as_str().into()])?
1913 .first::<RunRow>(None)
1914 .await?;
1915 if let Some(next) = next {
1916 self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[next.id.as_str().into()])?.run().await?;
1917 Box::pin(self.advance(&next.id)).await?;
1918 }
1919 }
1920 Ok(())
1921 }
1922
1923 /// Tells the deployments service that a job ended (`workflow_job_ended`),
1924 /// so a build it opened with `start_from_workflow` and left open fails
1925 /// at once. Never fails the job: an answer that does not come is
1926 /// logged, and the sweep fails the build later.
1927 async fn end_job_builds(&self, job_id: &str, conclusion: &str) {
1928 let ended: Result<Value> =
1929 g1t_kit::call(&self.deployments, "workflow_job_ended", &json!({ "jobId": job_id, "conclusion": conclusion })).await;
1930 if let Err(error) = ended {
1931 worker::console_log!("actions: could not tell deployments that job {job_id} ended: {error}");
1932 }
1933 }
1934
1935 /// Tells the deployments service how a run's deployment to `env` stands:
1936 /// made when its first job naming the environment starts, failed when one
1937 /// of them fails, and settled (`last`) when the run finishes. Never fails
1938 /// the run: a deployment that could not be recorded is logged.
1939 async fn report_deployment(&self, run: &RunRow, env: &JobEnvironment, state: &str, last: bool) {
1940 let path = repo_path(&run.repo);
1941 let reported: Result<Value> = g1t_kit::call(
1942 &self.deployments,
1943 "actions_deployment",
1944 &json!({
1945 "repoId": run.repo_id,
1946 "repo": { "namespace": path.namespace, "name": path.name },
1947 "runId": run.id,
1948 "attempt": run.attempt,
1949 "runUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
1950 "environment": env.name,
1951 "url": env.url,
1952 "ref": run.git_ref,
1953 "sha": run.sha,
1954 "state": state,
1955 "final": last,
1956 "creator": run.actor,
1957 "workflow": run.name,
1958 }),
1959 )
1960 .await;
1961 if let Err(error) = reported {
1962 worker::console_error!("actions: deployment to {} not recorded for run {}: {error}", env.name, run.id);
1963 }
1964 }
1965
1966 /// A job that deploys has started: its run's deployment to the
1967 /// environment is under way.
1968 pub(crate) async fn job_started(&self, job_id: &str) -> Result<()> {
1969 let Some(job) = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[job_id.into()])?.first::<JobRow>(None).await? else {
1970 return Ok(());
1971 };
1972 let Some(run) = self.run_row(&job.run_id).await? else { return Ok(()) };
1973 self.tell_live(&run.repo_id, &run.id, Some(&run.sha), run.pull).await;
1974 if let Some(env) = deploys_to(&run, &job) {
1975 self.report_deployment(&run, &env, "in_progress", false).await;
1976 }
1977 Ok(())
1978 }
1979
1980 /// Pages open on the repository hear that a run's job started or
1981 /// finished, which is no event (`g1t_contracts::live`). Logged and left
1982 /// when notify cannot be reached: the pages catch up by themselves.
1983 pub(crate) async fn tell_live(&self, repo_id: &str, run_id: &str, sha: Option<&str>, pull: Option<u32>) {
1984 let Some(notify) = &self.notify else { return };
1985 let change = g1t_contracts::live::RepoChange {
1986 repo_id: repo_id.to_owned(),
1987 kind: g1t_contracts::live::RUN_UPDATED.to_owned(),
1988 run: Some(run_id.to_owned()),
1989 sha: sha.map(str::to_owned),
1990 number: pull,
1991 at: now(),
1992 ..Default::default()
1993 };
1994 let args = g1t_contracts::live::RepoChangedArgs { changes: vec![change] };
1995 let told: Result<Value> = g1t_kit::call(notify, g1t_contracts::live::REPO_CHANGED, &args).await;
1996 if let Err(error) = told {
1997 worker::console_error!("actions: live pages not told of run {run_id}: {error}");
1998 }
1999 }
2000
2001 /// The run is over: each environment its jobs deployed to takes the
2002 /// outcome of those jobs (`deployment_outcome`).
2003 async fn settle_deployments(&self, run: &RunRow, jobs: &[JobRow], cancelled: bool) {
2004 let mut seen: Vec<(JobEnvironment, Vec<Option<String>>)> = Vec::new();
2005 for job in jobs {
2006 let Some(env) = deploys_to(run, job) else { continue };
2007 let conclusion = if cancelled && job.conclusion.as_deref() != Some("skipped") && job.started_at.is_some() {
2008 Some("cancelled".to_owned())
2009 } else if job.started_at.is_none() {
2010 Some("skipped".to_owned())
2011 } else {
2012 job.conclusion.clone()
2013 };
2014 match seen.iter_mut().find(|(known, _)| known.name.eq_ignore_ascii_case(&env.name)) {
2015 Some((known, conclusions)) => {
2016 if known.url.is_none() {
2017 known.url = env.url.clone();
2018 }
2019 conclusions.push(conclusion);
2020 }
2021 None => seen.push((env, vec![conclusion])),
2022 }
2023 }
2024 for (env, conclusions) in seen {
2025 if let Some(state) = deployment_outcome(&conclusions) {
2026 self.report_deployment(run, &env, state, true).await;
2027 }
2028 }
2029 }
2030
2031 /// Tells the pull request (or commit) how the run went, as a status.
2032 async fn report_status(&self, run: &RunRow, conclusion: &str) -> Result<()> {
2033 let state = match conclusion {
2034 "success" | "skipped" => "success",
2035 "cancelled" => "error",
2036 _ => "failure",
2037 };
2038 let _: Result<Value> = g1t_kit::call(
2039 &self.work,
2040 "set_commit_status",
2041 &json!({
2042 "repoId": run.repo_id,
2043 "sha": run.sha,
2044 "context": format!("{} / {}", run.name, run.event),
2045 "state": state,
2046 "description": format!("{} {}", run.name, match conclusion {
2047 "success" => "passed",
2048 "skipped" => "was skipped",
2049 "cancelled" => "was cancelled",
2050 _ => "failed",
2051 }),
2052 "targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
2053 "source": "actions",
2054 }),
2055 )
2056 .await;
2057 Ok(())
2058 }
2059
2060 /// Tells the pull request a run has started on its head.
2061 pub async fn report_pending(&self, run: &RunRow) -> Result<()> {
2062 if let Err(error) = self.try_report_pending(run).await {
2063 worker::console_warn!("pending status for run {} not reported: {error}", run.id);
2064 }
2065 Ok(())
2066 }
2067
2068 /// Reports a run as pending on its commit, failing when Work did not
2069 /// store it.
2070 pub async fn try_report_pending(&self, run: &RunRow) -> Result<()> {
2071 let stored: Outcome<bool> = g1t_kit::call(
2072 &self.work,
2073 "set_commit_status",
2074 &json!({
2075 "repoId": run.repo_id,
2076 "sha": run.sha,
2077 "context": format!("{} / {}", run.name, run.event),
2078 "state": "pending",
2079 "description": if run.status == "action_required" {
2080 format!("{} is waiting for approval", run.name)
2081 } else {
2082 format!("{} is running", run.name)
2083 },
2084 "targetUrl": format!("{SITE}/{}/actions/runs/{}", run.repo, run.id),
2085 "source": "actions",
2086 }),
2087 )
2088 .await?;
2089 match stored {
2090 Outcome::Ok(_) => Ok(()),
2091 Outcome::Fail(failure) => Err(worker::Error::RustError(format!("pending status refused: {}", failure.message))),
2092 }
2093 }
2094
2095 /// Cancels a run: its waiting and queued jobs at once, and its running
2096 /// ones gracefully (`stop_job`), or outright when `force`.
2097 pub async fn cancel_run(&self, run: &RunRow, reason: &str, force: bool) -> Result<()> {
2098 self.db
2099 .prepare("UPDATE runs SET conclusion = 'cancelled' WHERE id = ? AND status != 'completed'")
2100 .bind(&[run.id.as_str().into()])?
2101 .run()
2102 .await?;
2103 for job in self.job_rows(&run.id).await?.iter().filter(|job| job.status != "completed") {
2104 if force {
2105 self.hard_stop(job, reason).await?;
2106 } else {
2107 self.stop_job(job, reason).await?;
2108 }
2109 }
2110 if run.status == "pending" || run.status == "action_required" {
2111 self.db.prepare("UPDATE runs SET status = 'queued' WHERE id = ?").bind(&[run.id.as_str().into()])?.run().await?;
2112 }
2113 self.advance(&run.id).await
2114 }
2115
2116 /// Cancels every run of the repository that has not finished, for
2117 /// `repo.deleted` and `repo.archived`.
2118 pub async fn stop_runs(&self, repo_id: &str) -> Result<()> {
2119 let runs = self
2120 .db
2121 .prepare("SELECT * FROM runs WHERE repo_id = ? AND status != 'completed'")
2122 .bind(&[repo_id.into()])?
2123 .all()
2124 .await?
2125 .results::<RunRow>()?;
2126 for run in runs {
2127 self.cancel_run(&run, "The repository was archived or deleted.", true).await?;
2128 }
2129 Ok(())
2130 }
2131
2132 pub async fn cancel(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
2133 if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {
2134 return Ok(Outcome::Fail(refused));
2135 }
2136 let run = check!(self.run_in(&a.repo, &a.id).await?);
2137 if run.status == "completed" {
2138 return Ok(fail(FailureCode::Conflict, "The run has already finished."));
2139 }
2140 // Cancelling a run that is already cancelling stops its jobs
2141 // outright, without waiting for their cleanup steps.
2142 let force = a.force || run.conclusion.as_deref() == Some("cancelled");
2143 let reason = if force {
2144 format!("{} stopped the run without waiting for its cleanup steps.", a.actor.username)
2145 } else {
2146 format!("{} cancelled the run.", a.actor.username)
2147 };
2148 self.cancel_run(&run, &reason, force).await?;
2149 self.run_summary(&run.id).await
2150 }
2151
2152 /// Runs again, as a new attempt: every job, with `failed_only` those
2153 /// that did not succeed, or with `job` that one; each with the jobs that
2154 /// need them. The attempt that ends is kept, its jobs and their logs and
2155 /// summaries with it (`job_attempts`, `run_attempts`).
2156 pub async fn rerun(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
2157 if let Outcome::Fail(refused) = self.may(&a.actor, &a.repo, Capability::Run).await? {
2158 return Ok(Outcome::Fail(refused));
2159 }
2160 // A job alone (`POST …/jobs/{job}/rerun`) names its run.
2161 let run_id = match (&a.job, a.id.is_empty()) {
2162 (Some(job), true) => {
2163 #[derive(Deserialize)]
2164 struct Of {
2165 run_id: String,
2166 }
2167 let of = self.db.prepare("SELECT run_id FROM jobs WHERE id = ?").bind(&[job.as_str().into()])?.first::<Of>(None).await?;
2168 match of {
2169 Some(of) => of.run_id,
2170 None => return Ok(fail(FailureCode::NotFound, "No such job.")),
2171 }
2172 }
2173 _ => a.id.clone(),
2174 };
2175 let run = check!(self.run_in(&a.repo, &run_id).await?);
2176 if run.status != "completed" {
2177 return Ok(fail(FailureCode::Conflict, "The run is still going: cancel it first."));
2178 }
2179 // Nothing starts again on an archived repository.
2180 match self.visible_repo(&a.repo, &Some(a.actor.clone())).await? {
2181 Some(repo) if repo.archived() => {
2182 return Ok(fail(FailureCode::Forbidden, g1t_contracts::repos::archived_message(&repo.namespace, &repo.name)));
2183 }
2184 Some(repo) if !self.actions_on(&repo).await? => {
2185 return Ok(fail(FailureCode::Forbidden, g1t_contracts::actions::actions_disabled_message(&repo.namespace, &repo.name)));
2186 }
2187 Some(_) => {}
2188 None => return Ok(fail(FailureCode::NotFound, "There is no such repository.")),
2189 }
2190 if run.error.is_some() {
2191 return Ok(fail(FailureCode::Conflict, "This run never started: fix the workflow file and push again."));
2192 }
2193 let jobs = self.job_rows(&run.id).await?;
2194 let workflow = workflow::parse(&run.source).ok();
2195 let target = match &a.job {
2196 Some(id) => match jobs.iter().find(|job| &job.id == id) {
2197 Some(job) => Some(top_key(&job.key).to_owned()),
2198 None => return Ok(fail(FailureCode::NotFound, "That job is not in the run's latest attempt.")),
2199 },
2200 None => None,
2201 };
2202 let which = match (&target, a.failed_only) {
2203 (Some(key), _) => Rerun::Job(key),
2204 (None, true) => Rerun::Failed,
2205 (None, false) => Rerun::All,
2206 };
2207 let order = workflow.as_ref().map(|w| w.job_order()).unwrap_or_default();
2208 let again = rerun_keys(
2209 &order,
2210 |key| jobs.iter().find(|j| j.key == key).map(JobRow::needs).unwrap_or_default(),
2211 |key| jobs.iter().filter(|j| j.key == key).all(|j| j.conclusion.as_deref() == Some("success")),
2212 which,
2213 );
2214 if again.is_empty() {
2215 return Ok(fail(FailureCode::Conflict, "Every job succeeded: there is nothing to run again."));
2216 }
2217 // The jobs that run again, a called workflow's with the job calling it.
2218 let rerun_ids: Vec<&str> = jobs.iter().filter(|job| again.iter().any(|key| key == top_key(&job.key))).map(|job| job.id.as_str()).collect();
2219 let ids = serde_json::to_string(&rerun_ids)?;
2220 let ended = run.attempt.to_string();
2221 let ended = ended.as_str();
2222 let mut statements = vec![
2223 // The attempt that ends, as it ended.
2224 self.db
2225 .prepare(
2226 "INSERT OR REPLACE INTO run_attempts (run_id, attempt, repo_id, conclusion, actor, debug, started_at, finished_at)
2227 SELECT id, attempt, repo_id, conclusion, COALESCE(triggering_actor, actor), debug, started_at, finished_at FROM runs WHERE id = ?",
2228 )
2229 .bind(&[run.id.as_str().into()])?,
2230 // Earlier attempts that showed a job's logs from where it ran
2231 // then now find them where they move to.
2232 self.db
2233 .prepare("UPDATE job_attempts SET log_id = log_id || '.' || ?1 WHERE run_id = ?2 AND log_id IN (SELECT value FROM json_each(?3))")
2234 .bind(&[ended.into(), run.id.as_str().into(), ids.as_str().into()])?,
2235 // Each of its jobs: one that runs again keeps its logs under
2236 // `{id}.{attempt}`; one left alone is still the live job's.
2237 self.db
2238 .prepare(
2239 "INSERT OR REPLACE INTO job_attempts (id, run_id, repo_id, attempt, job_id, log_id, key, ordinal, name, needs, status, conclusion,
2240 steps, annotations, reason, environment, labels, runner_name, started_at, finished_at)
2241 SELECT id || '.' || ?1, run_id, repo_id, ?1, id,
2242 CASE WHEN id IN (SELECT value FROM json_each(?3)) THEN id || '.' || ?1 ELSE id END,
2243 key, ordinal, name, needs, status, conclusion, steps, annotations, reason, environment, labels, runner_name, started_at, finished_at
2244 FROM jobs WHERE run_id = ?2 ORDER BY rowid",
2245 )
2246 .bind(&[ended.into(), run.id.as_str().into(), ids.as_str().into()])?,
2247 self.db
2248 .prepare("UPDATE logs SET job_id = job_id || '.' || ?1 WHERE job_id IN (SELECT value FROM json_each(?2))")
2249 .bind(&[ended.into(), ids.as_str().into()])?,
2250 self.db
2251 .prepare("UPDATE job_summaries SET job_id = job_id || '.' || ?1 WHERE job_id IN (SELECT value FROM json_each(?2))")
2252 .bind(&[ended.into(), ids.as_str().into()])?,
2253 ];
2254 for key in &again {
2255 statements.push(self.db.prepare("DELETE FROM jobs WHERE run_id = ? AND key = ? AND ordinal > 0").bind(&[run.id.as_str().into(), key.as_str().into()])?);
2256 // The jobs of a workflow it called (each matrix combination's
2257 // under `key[i]/`) are made again when it calls it again.
2258 statements.push(
2259 self.db
2260 .prepare("DELETE FROM jobs WHERE run_id = ? AND (key LIKE ? OR key LIKE ?)")
2261 .bind(&[run.id.as_str().into(), format!("{key}/%").into(), format!("{key}[%").into()])?,
2262 );
2263 statements.push(
2264 self.db
2265 .prepare(
2266 "UPDATE jobs SET status = 'waiting', conclusion = NULL, steps = '[]', annotations = '[]', outputs = '{}', reason = NULL,
2267 matrix = NULL, call = NULL, token_hash = NULL, first_token_hash = NULL, seen_at = NULL, started_at = NULL, finished_at = NULL,
2268 labels = NULL, queued_at = NULL, runner_id = NULL, runner_name = NULL, environment = NULL,
2269 concurrency_group = NULL, cancel_in_progress = 0, cancel_requested_at = NULL WHERE run_id = ? AND key = ?",
2270 )
2271 .bind(&[run.id.as_str().into(), key.as_str().into()])?,
2272 );
2273 }
2274 statements.push(
2275 self.db
2276 .prepare(
2277 "UPDATE runs SET status = 'queued', conclusion = NULL, attempt = attempt + 1, started_at = NULL, finished_at = NULL,
2278 triggering_actor = ?, debug = ? WHERE id = ?",
2279 )
2280 .bind(&[a.actor.username.as_str().into(), u32::from(a.debug).into(), run.id.as_str().into()])?,
2281 );
2282 self.db.batch(statements).await?;
2283 if let Some(run) = self.run_row(&run.id).await? {
2284 self.report_pending(&run).await?;
2285 }
2286 self.advance(&run.id).await?;
2287 // A page left open on the attempt that ended, which asks for nothing
2288 // while its run is over, hears that it is going again: re-run from
2289 // the API, the MCP tool, a pull request or another tab, as well as
2290 // from that page, it offers Cancel run and not the re-runs.
2291 self.tell_live(&run.repo_id, &run.id, Some(&run.sha), run.pull).await;
2292 self.run_summary(&run.id).await
2293 }
2294
2295 pub async fn run_in(&self, repo: &RepoPath, id: &str) -> Result<Outcome<RunRow>> {
2296 let row = self
2297 .db
2298 .prepare("SELECT * FROM runs WHERE id = ? AND lower(repo) = lower(?)")
2299 .bind(&[id.into(), format!("{}/{}", repo.namespace, repo.name).into()])?
2300 .first::<RunRow>(None)
2301 .await?;
2302 Ok(row.map_or_else(|| fail(FailureCode::NotFound, "No such run."), Outcome::Ok))
2303 }
2304
2305 // --- The sandbox's side -----------------------------------------------------
2306
2307 pub(crate) async fn job_for_token(&self, a: &JobCallArgs) -> Result<Outcome<JobRow>> {
2308 self.job_for(a, false).await
2309 }
2310
2311 /// As [`Self::job_for_token`], and also with the token the job started
2312 /// with after its harness swapped it (`job_spec` with `rotate`): for
2313 /// `brokered_secrets` alone, which the runner Worker asks with the
2314 /// token it was given at the start, and which no API route passes on.
2315 pub(crate) async fn job_for_started_token(&self, a: &JobCallArgs) -> Result<Outcome<JobRow>> {
2316 self.job_for(a, true).await
2317 }
2318
2319 async fn job_for(&self, a: &JobCallArgs, started: bool) -> Result<Outcome<JobRow>> {
2320 let job = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[a.job.as_str().into()])?.first::<JobRow>(None).await?;
2321 Ok(match job {
2322 Some(job) if job.status == "in_progress" && token_opens(job.token_hash.as_deref(), job.first_token_hash.as_deref(), &a.token, started) => Outcome::Ok(job),
2323 _ => fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."),
2324 })
2325 }
2326
2327 /// `job_auth`: which run and repository a running job's token is for,
2328 /// so the API can keep its artifacts and cache.
2329 pub async fn job_auth(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
2330 let job = check!(self.job_for_token(&a).await?);
2331 Ok(Outcome::Ok(json!({ "run": job.run_id, "repoId": job.repo_id })))
2332 }
2333
2334 /// `job_spec`: everything the sandbox needs to run the job.
2335 pub async fn job_spec(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
2336 let job = check!(self.job_for_token(&a).await?);
2337 // Asked to, the token the harness asked with is spent here: it gets
2338 // a new one with the spec, for everything after, so a copy of the
2339 // first left on the runner's computer (a Windows job's script, a
2340 // container's environment) cannot fetch the secrets again. The new
2341 // token is made now, as the runtime token is signed with its hash,
2342 // and swapped in last, so a spec that could not be made leaves the
2343 // old one working.
2344 let next = a.rotate.then(|| random_hex(24));
2345 let token_hash = match &next {
2346 Some(next) => sha256_hex(next),
2347 None => job.token_hash.clone().unwrap_or_default(),
2348 };
2349 let Some(run) = self.run_row(&job.run_id).await? else {
2350 return Ok(fail(FailureCode::NotFound, "No such run."));
2351 };
2352 let Ok(caller) = workflow::parse(&run.source) else {
2353 return Ok(fail(FailureCode::Invalid, "The workflow no longer reads."));
2354 };
2355 // A called workflow's job runs as that workflow defines it.
2356 let callee = job.callee();
2357 let (workflow, spec, call_inputs) = match callee {
2358 Some((called, spec, call)) => (called, spec, Some(call["inputs"].clone())),
2359 None => match caller.jobs.iter().find(|j| j.id == job.key) {
2360 Some(spec) => (caller.clone(), spec.clone(), None),
2361 None => return Ok(fail(FailureCode::NotFound, "The job is not in the workflow.")),
2362 },
2363 };
2364 let spec = &spec;
2365 let repo = repo_path(&run.repo);
2366 let trusted = run.trusted != 0;
2367 // The job's `environment:`, by name, as read when its needs were done
2368 // (an expression included), once the environment's protection rules
2369 // let it start: entries with a value for it give that value instead
2370 // of their default, as GitHub's environment secrets do.
2371 let environment: Option<String> = job.environment.clone();
2372 // What its token may do: its `permissions:` (a called workflow's
2373 // jobs no more than the job that calls it), else the repository's
2374 // default; read-only for a pull request from outside.
2375 // The repository's default, its workspace's taken in, and whether
2376 // its jobs may open and approve pull requests.
2377 let (default, pull_requests) = self.token_policy(&run.repo_id).await?;
2378 let mut permissions = spec.permissions(&workflow, default);
2379 if let Some(parent) = &job.call().filter(|c| c["role"] == "callee").and_then(|c| c["parent"].as_str().map(str::to_owned)) {
2380 let top = top_key(parent);
2381 if let Some(caller_job) = caller.jobs.iter().find(|j| j.id == top) {
2382 permissions = permissions.capped_by(&caller_job.permissions(&caller, default));
2383 }
2384 }
2385 if !trusted {
2386 permissions = permissions.read_only();
2387 }
2388 // G1T_TOKEN, and GITHUB_TOKEN as its alias: a token of the
2389 // workspace's that reaches this repository only, with the scopes
2390 // its permissions give, until the job ends.
2391 let token = match self.workspace_actor(&repo.namespace).await? {
2392 Some(workspace) => {
2393 let created: CreatedAccessToken = g1t_kit::call(
2394 &self.identity,
2395 "create_job_token",
2396 &CreateJobTokenArgs {
2397 workspace,
2398 repo: repo.clone(),
2399 run_id: run.id.clone(),
2400 job_id: job.id.clone(),
2401 name: format!("G1T_TOKEN for {} run {}", run.repo, run.number),
2402 ttl_seconds: u64::from(job.timeout_minutes) * 60 + 600,
2403 scopes: permissions.scopes().into_iter().map(str::to_owned).collect(),
2404 pull_requests: pull_requests && trusted,
2405 },
2406 )
2407 .await?;
2408 created.token
2409 }
2410 None => String::new(),
2411 };
2412 // A run that is not trusted (a pull request from outside the
2413 // workspace) gets no secrets and an empty token.
2414 let passed = job.call().filter(|c| c["role"] == "callee").and_then(|c| c.get("secrets").cloned());
2415 // Brokered secrets among them (broker.rs), whatever keys they reach
2416 // the job under.
2417 let mut brokers: Vec<Broker> = Vec::new();
2418 let mut secrets = match (trusted, passed) {
2419 (false, _) => Map::new(),
2420 (true, None) => {
2421 let resolved = self.secrets_for(&run.repo_id, &run.repo, environment.as_deref(), true).await?;
2422 brokers.extend(resolved.brokers());
2423 resolved.values
2424 }
2425 // A called workflow's job: what its callers passed it (reach.rs),
2426 // and its own environment's secrets over them.
2427 (true, Some(plan)) => {
2428 let base = self.secrets_for(&run.repo_id, &run.repo, None, true).await?;
2429 brokers.extend(base.brokers());
2430 let base = base.values;
2431 let vars = self.variables_for(&run.repo_id, &run.repo, None, true).await?;
2432 let github = run.info().context(&job.key, "", run.action.as_deref());
2433 let mut passed = crate::reach::resolve_secrets(&plan, &base, &github, &vars);
2434 if let Some(name) = environment.as_deref() {
2435 let own = self.secrets_for(&run.repo_id, &run.repo, Some(name), true).await?;
2436 brokers.extend(own.brokers());
2437 for (key, value) in own.values {
2438 if base.get(&key) != Some(&value) {
2439 passed.insert(key, value);
2440 }
2441 }
2442 }
2443 passed
2444 }
2445 };
2446 // A brokered secret's value never reaches the sandbox: the job gets
2447 // a stand-in, which the runner Worker fills in on its requests to
2448 // the secret's hosts. A self-hosted runner's requests never pass
2449 // the Worker: a harness there that brokers is given each stand-in's
2450 // hosts, and passes its job's requests to them through g1t
2451 // (broker.rs); any other keeps a stand-in that does nothing, and
2452 // the log says so.
2453 let stand_ins = broker::substitute(&mut secrets, &brokers, broker::stand_in);
2454 let relayed = job.runner_id.is_some() && a.broker && !stand_ins.is_empty();
2455 if !stand_ins.is_empty() {
2456 self.keep_stand_ins(&job.id, job.timeout_minutes, &stand_ins).await?;
2457 if job.runner_id.is_some() {
2458 let mut made: Vec<&broker::StandIn> = stand_ins.iter().collect();
2459 made.sort_unstable_by(|a, b| a.broker.name.cmp(&b.broker.name));
2460 let notes: String = made
2461 .iter()
2462 .map(|made| {
2463 let note = if relayed { broker::brokered_note(&made.broker.name, &made.broker.hosts) } else { broker::self_hosted_note(&made.broker.name) };
2464 note + "\n"
2465 })
2466 .collect();
2467 self.note_log(&job.id, 0, &notes).await?;
2468 }
2469 }
2470 secrets.insert("G1T_TOKEN".into(), Value::String(token.clone()));
2471 secrets.insert("GITHUB_TOKEN".into(), Value::String(token.clone()));
2472 // Each secret as it is, a line at a time, base64 and JSON-escaped.
2473 let mut masks: Vec<String> = g1t_actions::mask::all_variants(secrets.values().filter_map(|v| v.as_str()));
2474 let vars = self.variables_for(&run.repo_id, &run.repo, environment.as_deref(), trusted).await?;
2475 // The toolkit's runtime token (runtime.rs), for as long as the job
2476 // may run; the API puts it and the toolkit's addresses in the
2477 // job's variables.
2478 let runtime_token = crate::runtime::runtime_token(
2479 &job.id,
2480 &job.run_id,
2481 &token_hash,
2482 now_ms() / 1000,
2483 u64::from(job.timeout_minutes) * 60 + 600,
2484 );
2485 masks.push(runtime_token.clone());
2486 let retention_days = self.retention_setting(&run.repo_id).await?;
2487
2488 let jobs = self.job_rows(&run.id).await?;
2489 let mut needs = Map::new();
2490 // In a called workflow, its jobs' keys sit under the job that called it.
2491 let parent = job.call().filter(|c| c["role"] == "callee").and_then(|c| c["parent"].as_str().map(str::to_owned));
2492 for need in &spec.needs {
2493 let key = match &parent {
2494 Some(parent) => format!("{parent}/{need}"),
2495 None => need.clone(),
2496 };
2497 let rows: Vec<&JobRow> = jobs.iter().filter(|row| row.key == key).collect();
2498 let mut outputs = Map::new();
2499 for row in &rows {
2500 if let Ok(Value::Object(more)) = serde_json::from_str::<Value>(&row.outputs) {
2501 outputs.extend(more);
2502 }
2503 }
2504 needs.insert(need.clone(), json!({ "result": key_result(&rows), "outputs": outputs }));
2505 }
2506 let siblings = jobs.iter().filter(|row| row.key == job.key).count();
2507 let matrix: Value = job.matrix.as_deref().and_then(|m| serde_json::from_str(m).ok()).unwrap_or(json!({}));
2508 let info = run.info();
2509 let mut github = info.context(&job.key, &token, run.action.as_deref());
2510 github["token"] = json!(token);
2511 github["retention_days"] = json!(retention_days);
2512 // On a self-hosted runner, `runner` and `RUNNER_*` describe that
2513 // machine rather than g1t's sandbox.
2514 let mut variables = info.variables(&job.key);
2515 variables.insert("GITHUB_RETENTION_DAYS".into(), json!(retention_days.to_string()));
2516 let mut runner = match &job.runner_id {
2517 Some(id) => self.runner_context_for(id, &mut variables).await?,
2518 None => runner_context(),
2519 };
2520 // A re-run with debug logging: what GitHub sets for one.
2521 if run.debug != 0 {
2522 debug_logging(&mut variables, &mut runner);
2523 }
2524
2525 // Where to check out: the repository, which holds a pull request's
2526 // test merge commit; a pull request's fork when the run builds its
2527 // head instead (`run.sha` is the head, `info.sha` what is built).
2528 let clone_url = match run.pull {
2529 Some(number) if run.event.starts_with("pull_request") && run.event != "pull_request_target" && info.sha == run.sha => {
2530 let located: Outcome<g1t_contracts::work::PullDetail> = g1t_kit::call(
2531 &self.work,
2532 "get_pull",
2533 &g1t_contracts::work::ViewArgs {
2534 repo: repo.clone(),
2535 number,
2536 viewer: self.workspace_actor(&repo.namespace).await?,
2537 after_seq: 0,
2538 },
2539 )
2540 .await?;
2541 match located {
2542 Outcome::Ok(detail) => match detail.pull.fork.or(detail.pull.head_repo) {
2543 Some(fork) => format!("{SITE}/{}/{}.git", fork.namespace, fork.name),
2544 None => format!("{SITE}/{}.git", run.repo),
2545 },
2546 Outcome::Fail(_) => format!("{SITE}/{}.git", run.repo),
2547 }
2548 }
2549 _ => format!("{SITE}/{}.git", run.repo),
2550 };
2551
2552 // Only one fetch with a token gets its spec: of two at once, the
2553 // second finds the hash already changed and is refused.
2554 if next.is_some() {
2555 let swapped = self
2556 .db
2557 .prepare(TOKEN_ROTATE)
2558 .bind(&[token_hash.as_str().into(), job.id.as_str().into(), job.token_hash.as_deref().unwrap_or_default().into()])?
2559 .first::<Value>(None)
2560 .await?;
2561 if swapped.is_none() {
2562 return Ok(fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."));
2563 }
2564 }
2565
2566 let mut spec = json!({
2567 "job": job.id,
2568 "run": run.id,
2569 "key": job.key,
2570 "name": job.name,
2571 "spec": spec.raw,
2572 "workflow": {
2573 "env": workflow.env,
2574 "defaults": workflow.raw.get("defaults").cloned().unwrap_or(Value::Null),
2575 },
2576 "github": github,
2577 "variables": variables,
2578 "event": info.event,
2579 "contexts": {
2580 "vars": vars,
2581 "secrets": secrets,
2582 "inputs": call_inputs.unwrap_or_else(|| Value::Object(run.inputs())),
2583 "matrix": matrix,
2584 "needs": needs,
2585 "strategy": {
2586 "fail-fast": spec.fail_fast,
2587 "job-index": job.ordinal,
2588 "job-total": siblings,
2589 "max-parallel": spec.max_parallel.unwrap_or(siblings as u32),
2590 },
2591 "runner": runner,
2592 },
2593 "checkout": {
2594 "repository": run.repo,
2595 "url": clone_url,
2596 "sha": info.sha,
2597 "ref": run.git_ref,
2598 "token": token,
2599 },
2600 "timeoutMinutes": job.timeout_minutes,
2601 "masks": masks,
2602 // As the job's log lists them at its start.
2603 "permissions": permissions.listed().into_iter().map(|(name, access)| (name.to_owned(), json!(access.as_str()))).collect::<Map<String, Value>>(),
2604 // Whether the job may ask for an OIDC token decides whether it
2605 // is told where to.
2606 "runtime": {
2607 "token": runtime_token,
2608 "idToken": self.oidc_allowed(&run, &job),
2609 },
2610 });
2611 if let Some(next) = next {
2612 spec["nextToken"] = json!(next);
2613 }
2614 if relayed {
2615 spec["brokered"] = broker::spec_entries(&stand_ins);
2616 }
2617 Ok(Outcome::Ok(spec))
2618 }
2619
2620 /// `job_report`: the sandbox telling how the job is going.
2621 pub async fn job_report(&self, a: JobCallArgs) -> Result<Outcome<Value>> {
2622 let job = check!(self.job_for_token(&a).await?);
2623 let report = &a.report;
2624 let at = now();
2625 match report["kind"].as_str().unwrap_or_default() {
2626 "steps" => {
2627 // The list can grow as the job goes (post steps), so steps
2628 // already reported keep where they stand.
2629 let known: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
2630 let steps: Vec<Value> = report["steps"]
2631 .as_array()
2632 .map(|names| {
2633 names
2634 .iter()
2635 .enumerate()
2636 .map(|(i, name)| match known.get(i) {
2637 Some(step) if step["status"] != "queued" => step.clone(),
2638 _ => json!({ "number": i + 1, "name": expr::to_text(name), "status": "queued", "conclusion": null, "startedAt": null, "finishedAt": null }),
2639 })
2640 .collect()
2641 })
2642 .unwrap_or_default();
2643 self.db
2644 .prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")
2645 .bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?
2646 .run()
2647 .await?;
2648 }
2649 "step" => {
2650 let number = report["number"].as_u64().unwrap_or(0) as usize;
2651 let mut steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
2652 if let Some(step) = number.checked_sub(1).and_then(|i| steps.get_mut(i)) {
2653 let status = report["status"].as_str().unwrap_or("in_progress");
2654 step["status"] = json!(status);
2655 if status == "in_progress" {
2656 step["startedAt"] = json!(at);
2657 }
2658 if status == "completed" {
2659 step["finishedAt"] = json!(at);
2660 step["conclusion"] = report["conclusion"].clone();
2661 }
2662 if let Some(name) = report["name"].as_str() {
2663 step["name"] = json!(name);
2664 }
2665 }
2666 self.db
2667 .prepare("UPDATE jobs SET steps = ?, seen_at = ? WHERE id = ?")
2668 .bind(&[serde_json::to_string(&steps)?.into(), at.as_str().into(), job.id.as_str().into()])?
2669 .run()
2670 .await?;
2671 }
2672 // A line from g1t itself, not the job: the runner Worker's note
2673 // that a brokered secret went to a host it is not for. Put
2674 // under the step that is running.
2675 "note" => {
2676 let text = report["text"].as_str().unwrap_or_default().chars().take(1000).collect::<String>();
2677 let steps: Vec<Value> = serde_json::from_str(&job.steps).unwrap_or_default();
2678 let step = steps.iter().rev().find(|step| step["status"] == "in_progress").and_then(|step| step["number"].as_u64()).unwrap_or(0);
2679 if !text.trim().is_empty() {
2680 self.note_log(&job.id, step as u32, &text).await?;
2681 }
2682 }
2683 "log" => {
2684 let mut text = report["text"].as_str().unwrap_or_default().to_owned();
2685 // A brokered secret's value never enters the sandbox, but an
2686 // answer that echoed it whole could carry it in; it is
2687 // masked here, where the value is known.
2688 if job.brokered != 0 {
2689 let values: Vec<String> = self.stand_ins_of(&job.id).await?.into_iter().map(|secret| secret.value).collect();
2690 if !values.is_empty() {
2691 text = g1t_actions::mask::apply(&text, &g1t_actions::mask::all_variants(values.iter().map(String::as_str)));
2692 }
2693 }
2694 if text.len() > MAX_CHUNK_BYTES {
2695 let mut cut = MAX_CHUNK_BYTES;
2696 while !text.is_char_boundary(cut) {
2697 cut -= 1;
2698 }
2699 text.truncate(cut);
2700 }
2701 #[derive(Deserialize)]
2702 struct Size {
2703 n: Option<f64>,
2704 }
2705 let size = self
2706 .db
2707 .prepare("SELECT SUM(LENGTH(text)) AS n FROM logs WHERE job_id = ?")
2708 .bind(&[job.id.as_str().into()])?
2709 .first::<Size>(None)
2710 .await?;
2711 let used = size.and_then(|s| s.n).unwrap_or(0.0) as usize;
2712 if used < MAX_LOG_BYTES {
2713 if used + text.len() >= MAX_LOG_BYTES {
2714 text.push_str("\n… The log reached its limit of 4 MB; the rest is not kept.\n");
2715 }
2716 // The next `seq` is taken in the insert itself, so two
2717 // batches at once (a report sent again while the first
2718 // was still being written) never reach for the same one
2719 // and lose a chunk to the primary key.
2720 self.db
2721 .prepare(LOG_INSERT)
2722 .bind(&[
2723 job.id.as_str().into(),
2724 (report["step"].as_u64().unwrap_or(0) as u32).into(),
2725 text.into(),
2726 report["chunk"].as_u64().map_or(worker::wasm_bindgen::JsValue::NULL, |n| (n as f64).into()),
2727 ])?
2728 .run()
2729 .await?;
2730 }
2731 self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;
2732 }
2733 "summary" => {
2734 // `$GITHUB_STEP_SUMMARY`, masked by the runner: added to the
2735 // step's summary, up to 1 MiB a step and 20 steps a job.
2736 let step = report["step"].as_u64().unwrap_or(0) as u32;
2737 let markdown = report["markdown"].as_str().unwrap_or_default();
2738 #[derive(Deserialize)]
2739 struct Held {
2740 steps: u32,
2741 mine: Option<f64>,
2742 }
2743 let held = self
2744 .db
2745 .prepare("SELECT COUNT(*) AS steps, MAX(CASE WHEN step = ? THEN LENGTH(markdown) END) AS mine FROM job_summaries WHERE job_id = ?")
2746 .bind(&[step.into(), job.id.as_str().into()])?
2747 .first::<Held>(None)
2748 .await?;
2749 let (steps, mine) = held.map_or((0, None), |held| (held.steps, held.mine.map(|n| n as usize)));
2750 if summary_fits(steps, mine, markdown.len()) {
2751 self.db
2752 .prepare(
2753 "INSERT INTO job_summaries (job_id, step, markdown) VALUES (?, ?, ?)
2754 ON CONFLICT (job_id, step) DO UPDATE SET markdown = job_summaries.markdown || excluded.markdown",
2755 )
2756 .bind(&[job.id.as_str().into(), step.into(), markdown.into()])?
2757 .run()
2758 .await?;
2759 }
2760 self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;
2761 }
2762 "annotation" => {
2763 let mut annotations: Vec<Value> = serde_json::from_str(&job.annotations).unwrap_or_default();
2764 if annotations.len() < MAX_ANNOTATIONS {
2765 annotations.push(json!({
2766 "level": report["level"].as_str().unwrap_or("notice"),
2767 "message": report["message"].as_str().unwrap_or_default().chars().take(4000).collect::<String>(),
2768 "title": report["title"],
2769 "file": report["file"],
2770 "line": report["line"],
2771 }));
2772 self.db
2773 .prepare("UPDATE jobs SET annotations = ?, seen_at = ? WHERE id = ?")
2774 .bind(&[serde_json::to_string(&annotations)?.into(), at.as_str().into(), job.id.as_str().into()])?
2775 .run()
2776 .await?;
2777 }
2778 }
2779 // Nothing to tell; the answer says whether to stop.
2780 "ping" => {
2781 self.db.prepare("UPDATE jobs SET seen_at = ? WHERE id = ?").bind(&[at.into(), job.id.as_str().into()])?.run().await?;
2782 }
2783 "done" => {
2784 // A job told to stop ends cancelled, however its cleanup went.
2785 let conclusion = if job.cancel_requested_at.is_some() {
2786 "cancelled"
2787 } else {
2788 report["conclusion"]
2789 .as_str()
2790 .filter(|c| matches!(*c, "success" | "failure" | "cancelled"))
2791 .unwrap_or("failure")
2792 };
2793 let outputs = report["outputs"].as_object().cloned();
2794 Box::pin(self.finish_job(&job.id, conclusion, report["reason"].as_str(), outputs.as_ref())).await?;
2795 }
2796 other => return Ok(fail(FailureCode::Invalid, format!("There is no report called `{other}`."))),
2797 }
2798 // `cancelled`: the run was cancelled, and the runner should stop
2799 // the step it is on and run only its cleanup steps.
2800 Ok(Outcome::Ok(json!({ "ok": true, "cancelled": job.cancel_requested_at.is_some() })))
2801 }
2802
2803 // --- Every minute ---------------------------------------------------------------
2804
2805 pub async fn on_minute(&self, now_ms: u64) -> Result<()> {
2806 let minute = now_ms / 60_000 * 60_000;
2807 // Repositories a workspace's managed workflows changed in, beyond
2808 // those synced at once (managed.rs): their schedules wait for it.
2809 if let Err(error) = self.catch_up_syncs().await {
2810 worker::console_error!("actions: catching up syncs failed: {error}");
2811 }
2812 // Staff (or billing's usage watcher) paused scheduled runs across
2813 // g1t: this minute's schedules are skipped, not queued for later.
2814 // Kept 30 seconds in the isolate (g1t_kit::pause).
2815 if g1t_kit::pause::paused(&self.billing, g1t_contracts::billing::PauseLevel::Schedules).await {
2816 worker::console_log!("actions: schedules are paused across g1t; skipped this minute's");
2817 } else if let Err(error) = self.run_schedules(minute).await {
2818 worker::console_error!("actions: schedules failed: {error}");
2819 }
2820 // Jobs whose sandbox went quiet or ran past their time.
2821 let running = self.db.prepare("SELECT * FROM jobs WHERE status = 'in_progress'").all().await?.results::<JobRow>()?;
2822 for job in running {
2823 // Times in g1t's format compare as text.
2824 let before = |ms: u64| rfc3339(now_ms.saturating_sub(ms));
2825 let silent = job.seen_at.as_deref().is_some_and(|seen| seen < before(SILENT_MS).as_str());
2826 let limit = (u64::from(job.timeout_minutes) * 60 + 120) * 1000;
2827 let over = job.started_at.as_deref().is_some_and(|started| started < before(limit).as_str());
2828 let cancel_overdue = job.cancel_requested_at.as_deref().is_some_and(|at| at < before(CANCEL_GRACE_MS).as_str());
2829 if cancel_overdue {
2830 // Cancelled, and still going after its grace period.
2831 self.hard_stop(&job, "It was cancelled, and did not finish its cleanup steps within 5 minutes.").await?;
2832 self.advance(&job.run_id).await?;
2833 } else if over {
2834 let reason = format!("It ran longer than its time limit of {} minutes.", job.timeout_minutes);
2835 // A self-hosted runner is told to stop on its next poll.
2836 if job.runner_id.is_none() {
2837 let _: Result<Value> = g1t_kit::call(&self.runner, "stop_actions_job", &json!({ "job": job.id })).await;
2838 }
2839 self.finish_job(&job.id, "failure", Some(&reason), None).await?;
2840 } else if silent {
2841 let reason = match &job.runner_name {
2842 Some(name) => format!("The self-hosted runner {name} stopped answering."),
2843 None => "The runner stopped answering.".to_owned(),
2844 };
2845 self.finish_job(&job.id, "failure", Some(&reason), None).await?;
2846 }
2847 }
2848 // Calls of reusable workflows waiting in a concurrency group, in
2849 // case the job they waited for was cancelled in another run.
2850 #[derive(Deserialize)]
2851 struct RunId {
2852 run_id: String,
2853 }
2854 let held = self
2855 .db
2856 .prepare("SELECT DISTINCT run_id FROM jobs WHERE status = 'waiting' AND concurrency_group IS NOT NULL LIMIT 20")
2857 .all()
2858 .await?
2859 .results::<RunId>()?;
2860 for run in held {
2861 self.advance(&run.run_id).await?;
2862 }
2863 if let Err(error) = self.sweep_runners(now_ms).await {
2864 worker::console_error!("actions: the runners' sweep failed: {error}");
2865 }
2866 // Jobs held at an environment whose wait timer has run out.
2867 if let Err(error) = self.release_gates().await {
2868 worker::console_error!("actions: environments' gates failed: {error}");
2869 }
2870 // Once an hour: the cache's expired entries, and its storage.
2871 if (now_ms / 60_000) % 60 == 7
2872 && let Err(error) = self.sweep_cache(now_ms).await
2873 {
2874 worker::console_error!("actions: the cache's sweep failed: {error}");
2875 }
2876 // And the archives of GitHub's actions no job uses any more.
2877 if (now_ms / 60_000) % 60 == 47
2878 && let Err(error) = self.sweep_action_archives(now_ms).await
2879 {
2880 worker::console_error!("actions: the action archives' sweep failed: {error}");
2881 }
2882 // And artifacts past their time, and the toolkit's abandoned parts.
2883 if (now_ms / 60_000) % 60 == 37 {
2884 if let Err(error) = self.sweep_artifacts(now_ms).await {
2885 worker::console_error!("actions: the artifacts' sweep failed: {error}");
2886 }
2887 if let Err(error) = self.sweep_blob_parts(now_ms).await {
2888 worker::console_error!("actions: the blob parts' sweep failed: {error}");
2889 }
2890 }
2891 // And logs of jobs that finished longer ago than LOG_RETENTION_DAYS.
2892 if (now_ms / 60_000) % 60 == 17
2893 && let Err(error) = self.sweep_logs(now_ms).await
2894 {
2895 worker::console_error!("actions: the logs' sweep failed: {error}");
2896 }
2897 self.start_queued().await
2898 }
2899}
2900
2901
2902#[cfg(test)]
2903mod log_chunks {
2904 use rusqlite::{Connection, params};
2905
2906 use super::LOG_INSERT;
2907
2908 /// The logs table as the migrations leave it.
2909 fn database() -> Connection {
2910 let db = Connection::open_in_memory().unwrap();
2911 for name in ["0001_init.sql", "0016_log_chunks.sql"] {
2912 let path = format!("{}/migrations/{name}", env!("CARGO_MANIFEST_DIR"));
2913 db.execute_batch(&std::fs::read_to_string(path).unwrap()).unwrap();
2914 }
2915 db
2916 }
2917
2918 fn log(db: &Connection, job: &str) -> Vec<(i64, i64, String)> {
2919 let mut rows = db.prepare("SELECT seq, step, text FROM logs WHERE job_id = ? ORDER BY seq").unwrap();
2920 rows.query_map([job], |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?))).unwrap().map(Result::unwrap).collect()
2921 }
2922
2923 #[test]
2924 fn a_batch_sent_again_is_kept_once() {
2925 let db = database();
2926 let insert = |job: &str, step: i64, text: &str, chunk: Option<i64>| db.execute(LOG_INSERT, params![job, step, text, chunk]).unwrap();
2927 assert_eq!(insert("job_1", 0, "one\n", Some(1)), 1);
2928 // The runner did not hear the answer and sent the batch again.
2929 assert_eq!(insert("job_1", 0, "one\n", Some(1)), 0);
2930 assert_eq!(insert("job_1", 1, "two\n", Some(2)), 1);
2931 // Another job numbers its batches from 1 too.
2932 assert_eq!(insert("job_2", 0, "other\n", Some(1)), 1);
2933 // A runner that numbers nothing has every batch kept, as before.
2934 assert_eq!(insert("job_3", 0, "a\n", None), 1);
2935 assert_eq!(insert("job_3", 0, "a\n", None), 1);
2936 assert_eq!(log(&db, "job_1"), [(1, 0, "one\n".into()), (2, 1, "two\n".into())]);
2937 assert_eq!(log(&db, "job_2"), [(1, 0, "other\n".into())]);
2938 assert_eq!(log(&db, "job_3").len(), 2);
2939 // A job run again moves its log aside (`{id}.{attempt}`), and the
2940 // new attempt's runner numbers from 1 again.
2941 db.execute("UPDATE logs SET job_id = job_id || '.1' WHERE job_id = 'job_1'", []).unwrap();
2942 assert_eq!(insert("job_1", 0, "again\n", Some(1)), 1);
2943 assert_eq!(log(&db, "job_1"), [(1, 0, "again\n".into())]);
2944 assert_eq!(log(&db, "job_1.1").len(), 2);
2945 }
2946}
2947
2948#[cfg(test)]
2949mod token_rotation {
2950 use g1t_secrets::sha256_hex;
2951 use rusqlite::{Connection, OptionalExtension, params};
2952
2953 use super::{TOKEN_ROTATE, token_opens};
2954
2955 fn database() -> Connection {
2956 let db = Connection::open_in_memory().unwrap();
2957 for name in ["0001_init.sql", "0020_job_token_rotation.sql"] {
2958 let path = format!("{}/migrations/{name}", env!("CARGO_MANIFEST_DIR"));
2959 db.execute_batch(&std::fs::read_to_string(path).unwrap()).unwrap();
2960 }
2961 db.execute(
2962 "INSERT INTO jobs (id, run_id, repo_id, namespace, key, name, status, token_hash) VALUES ('job_1', 'run_1', 'repo_1', 'acme', 'build', 'build', 'in_progress', ?1)",
2963 [sha256_hex("first")],
2964 )
2965 .unwrap();
2966 db
2967 }
2968
2969 fn rotate(db: &Connection, next: &str, shown: &str) -> bool {
2970 db.query_row(TOKEN_ROTATE, params![sha256_hex(next), "job_1", sha256_hex(shown)], |row| row.get::<_, String>(0))
2971 .optional()
2972 .unwrap()
2973 .is_some()
2974 }
2975
2976 /// The job's current token's hash, and the one it started with.
2977 fn hashes(db: &Connection) -> (Option<String>, Option<String>) {
2978 db.query_row("SELECT token_hash, first_token_hash FROM jobs WHERE id = 'job_1'", [], |row| Ok((row.get(0)?, row.get(1)?))).unwrap()
2979 }
2980
2981 #[test]
2982 fn a_job_token_fetches_its_spec_once() {
2983 let db = database();
2984 assert!(rotate(&db, "second", "first"));
2985 assert_eq!(hashes(&db), (Some(sha256_hex("second")), Some(sha256_hex("first"))));
2986 // The first token, shown again (a copy left on the computer, or a
2987 // second fetch racing the first), swaps nothing and is refused.
2988 assert!(!rotate(&db, "third", "first"));
2989 assert_eq!(hashes(&db).0, Some(sha256_hex("second")));
2990 // A job that ended has no token to swap.
2991 db.execute("UPDATE jobs SET status = 'completed', token_hash = NULL, first_token_hash = NULL", []).unwrap();
2992 assert!(!rotate(&db, "fourth", "second"));
2993 assert_eq!(hashes(&db), (None, None));
2994 }
2995
2996 #[test]
2997 fn the_worker_finds_brokered_secrets_with_the_token_the_job_started_with() {
2998 let db = database();
2999 let opens = |db: &Connection, token: &str, started: bool| {
3000 let (current, first) = hashes(db);
3001 token_opens(current.as_deref(), first.as_deref(), token, started)
3002 };
3003 // Before any swap, the job's one token opens everything.
3004 assert!(opens(&db, "first", false) && opens(&db, "first", true));
3005 assert!(rotate(&db, "second", "first"));
3006 // The harness's new token opens everything.
3007 assert!(opens(&db, "second", false) && opens(&db, "second", true));
3008 // The token it started with, which the runner Worker holds, still
3009 // finds the job's brokered secrets, and opens nothing else.
3010 assert!(opens(&db, "first", true));
3011 assert!(!opens(&db, "first", false));
3012 assert!(!opens(&db, "other", true));
3013 // Another swap keeps the token it started with, not the one between.
3014 assert!(rotate(&db, "third", "second"));
3015 assert!(opens(&db, "first", true));
3016 assert!(!opens(&db, "second", true));
3017 }
3018
3019 #[test]
3020 fn the_runtime_token_is_signed_for_the_token_that_replaces_the_first() {
3021 let now = 1_800_000_000;
3022 let token = crate::runtime::runtime_token("job_1", "run_1", &sha256_hex("second"), now, 600);
3023 assert!(crate::runtime::runtime_valid(&token, "job_1", &sha256_hex("second"), now));
3024 assert!(!crate::runtime::runtime_valid(&token, "job_1", &sha256_hex("first"), now));
3025 }
3026}
3027
3028#[cfg(test)]
3029mod stopping {
3030 use super::stops_runs;
3031 use g1t_contracts::events::Event;
3032 use serde_json::{Value, json};
3033
3034 fn event(kind: &str, data: Value) -> Event {
3035 Event {
3036 id: "evt_1".into(),
3037 kind: kind.into(),
3038 source: "repos".into(),
3039 time: "2026-10-05T00:00:00Z".into(),
3040 repo_id: Some("rep_1".into()),
3041 actor: None,
3042 data,
3043 }
3044 }
3045
3046 #[test]
3047 fn deleting_or_archiving_stops_runs() {
3048 assert_eq!(stops_runs(&event("repo.deleted", json!({ "repoId": "rep_1" }))).as_deref(), Some("rep_1"));
3049 assert_eq!(stops_runs(&event("repo.archived", json!({ "archived": true }))).as_deref(), Some("rep_1"));
3050 assert_eq!(stops_runs(&event("repo.unarchived", json!({ "archived": false }))), None);
3051 assert_eq!(stops_runs(&event("repo.restored", json!({}))), None);
3052 assert_eq!(stops_runs(&event("git.push", json!({}))), None);
3053 }
3054}
3055
3056#[cfg(test)]
3057mod status_of_needs {
3058 use std::collections::HashMap;
3059
3060 use super::ancestor_failed;
3061
3062 /// check -> plan -> (migrate) -> core -> edge, as deploy.yml has them,
3063 /// and a job that needs only the last.
3064 fn graph() -> HashMap<&'static str, Vec<&'static str>> {
3065 HashMap::from([
3066 ("check", vec![]),
3067 ("plan", vec!["check"]),
3068 ("migrate", vec!["plan"]),
3069 ("core", vec!["plan", "migrate"]),
3070 ("edge", vec!["plan", "migrate", "core"]),
3071 ("notify", vec!["edge"]),
3072 ])
3073 }
3074
3075 #[test]
3076 fn a_failure_is_seen_however_far_back() {
3077 let needs = graph();
3078 let failed = |which: &'static str| move |key: &str| key == which;
3079 // check failed; plan, and everything after, was skipped for it.
3080 assert!(ancestor_failed(&needs, "notify", failed("check")));
3081 assert!(ancestor_failed(&needs, "core", failed("check")));
3082 assert!(ancestor_failed(&needs, "edge", failed("core")));
3083 // Nothing before a job failed: a skipped migrate is not a failure.
3084 assert!(!ancestor_failed(&needs, "edge", |_| false));
3085 assert!(!ancestor_failed(&needs, "core", failed("edge")));
3086 assert!(!ancestor_failed(&needs, "check", failed("check")));
3087 }
3088
3089 #[test]
3090 fn cycles_and_unknown_keys_end() {
3091 let needs = HashMap::from([("a", vec!["b"]), ("b", vec!["a"])]);
3092 assert!(!ancestor_failed(&needs, "a", |_| false));
3093 assert!(!ancestor_failed(&needs, "missing", |_| true));
3094 }
3095}
3096
3097#[cfg(test)]
3098mod deployments {
3099 use serde_json::{Map, Value, json};
3100
3101 use super::{JobEnvironment, deployment_outcome, environment_of};
3102
3103 #[test]
3104 fn a_jobs_environment_is_read_for_deployments() {
3105 let contexts: Map<String, Value> = serde_json::from_value(json!({
3106 "github": { "ref_name": "main", "repository": "acme/web" },
3107 "inputs": { "target": "staging" },
3108 "matrix": {},
3109 }))
3110 .unwrap();
3111 let read = |raw: Value| environment_of(&raw, &contexts);
3112 assert_eq!(read(json!({})), None);
3113 assert_eq!(
3114 read(json!({ "environment": "production" })),
3115 Some(JobEnvironment { name: "production".into(), url: None, deploys: true })
3116 );
3117 assert_eq!(
3118 read(json!({ "environment": { "name": "production", "url": "https://g1t.sh" } })),
3119 Some(JobEnvironment { name: "production".into(), url: Some("https://g1t.sh".into()), deploys: true })
3120 );
3121 // Expressions are filled in from the run.
3122 assert_eq!(
3123 read(json!({ "environment": { "name": "${{ inputs.target }}", "url": "https://${{ github.ref_name }}.example.com" } })),
3124 Some(JobEnvironment { name: "staging".into(), url: Some("https://main.example.com".into()), deploys: true })
3125 );
3126 // Secrets only: no deployment.
3127 assert!(!read(json!({ "environment": { "name": "production", "deployment": false } })).unwrap().deploys);
3128 // The same, said in the job's g1t settings.
3129 assert!(!read(json!({ "environment": "production", "g1t": { "deployment": false } })).unwrap().deploys);
3130 assert!(!read(json!({ "environment": { "name": "production" }, "g1t": { "deployment": false } })).unwrap().deploys);
3131 // Only http(s) addresses.
3132 assert_eq!(read(json!({ "environment": { "name": "production", "url": "javascript:alert(1)" } })).unwrap().url, None);
3133 }
3134
3135 #[test]
3136 fn a_runs_outcome_for_an_environment() {
3137 let of = |list: &[&str]| deployment_outcome(&list.iter().map(|c| Some((*c).to_owned())).collect::<Vec<_>>());
3138 assert_eq!(of(&["success", "skipped"]), Some("success"));
3139 assert_eq!(of(&["success", "failure"]), Some("failure"));
3140 assert_eq!(of(&["success", "cancelled"]), Some("error"));
3141 assert_eq!(of(&["skipped"]), None);
3142 assert_eq!(deployment_outcome(&[None]), None);
3143 }
3144}
3145
3146#[cfg(test)]
3147mod reruns {
3148 use serde_json::{Map, Value, json};
3149
3150 use super::{MAX_SUMMARIES, MAX_SUMMARY_BYTES, Rerun, Scope, Status, call_allowed, call_prefix, debug_logging, rerun_keys, shown_name, summary_fits, top_key};
3151
3152 /// build ← test ← deploy, and lint on its own.
3153 fn keys(which: Rerun, failed: &[&str]) -> Vec<String> {
3154 let order = ["build", "lint", "test", "deploy"];
3155 let needs = |key: &str| -> Vec<String> {
3156 match key {
3157 "test" => vec!["build".into()],
3158 "deploy" => vec!["test".into()],
3159 _ => Vec::new(),
3160 }
3161 };
3162 rerun_keys(&order, needs, |key| !failed.contains(&key), which)
3163 }
3164
3165 #[test]
3166 fn a_rerun_takes_the_jobs_it_names_and_those_that_need_them() {
3167 assert_eq!(keys(Rerun::All, &[]), ["build", "lint", "test", "deploy"]);
3168 assert_eq!(keys(Rerun::Failed, &["test"]), ["test", "deploy"]);
3169 assert_eq!(keys(Rerun::Failed, &["lint"]), ["lint"]);
3170 assert!(keys(Rerun::Failed, &[]).is_empty());
3171 // One job, whatever it came to, and what depends on it.
3172 assert_eq!(keys(Rerun::Job("build"), &[]), ["build", "test", "deploy"]);
3173 assert_eq!(keys(Rerun::Job("lint"), &["test"]), ["lint"]);
3174 assert_eq!(keys(Rerun::Job("deploy"), &[]), ["deploy"]);
3175 assert!(keys(Rerun::Job("missing"), &[]).is_empty());
3176 }
3177
3178 #[test]
3179 fn a_called_workflows_jobs_run_again_with_the_job_that_calls_it() {
3180 assert_eq!(top_key("build/test"), "build");
3181 assert_eq!(top_key("build/inner/test"), "build");
3182 assert_eq!(top_key("lint"), "lint");
3183 // A matrix's calls each have their own jobs, under `key[i]/`.
3184 assert_eq!(top_key("build[1]/test"), "build");
3185 assert_eq!(top_key("build/inner[0]/test"), "build");
3186 assert_eq!(call_prefix("build", Some(1)), "build[1]");
3187 assert_eq!(call_prefix("build/inner", None), "build/inner");
3188 }
3189
3190 #[test]
3191 fn a_run_connects_ten_levels_of_workflows_and_fifty_reusable_ones() {
3192 assert!(call_allowed(1, &[], "a.yml").is_ok());
3193 assert!(call_allowed(9, &[], "a.yml").is_ok());
3194 let deep = call_allowed(10, &[], "a.yml").unwrap_err();
3195 assert!(deep.contains("at most ten") && deep.contains("nine levels"), "{deep}");
3196 let names: Vec<String> = (0..50).map(|n| format!("w{n}.yml")).collect();
3197 let fifty: Vec<&str> = names.iter().map(String::as_str).collect();
3198 // A workflow called again, as by each combination of a matrix, is one.
3199 assert!(call_allowed(1, &fifty, "w3.yml").is_ok());
3200 assert!(call_allowed(1, &fifty, "another.yml").unwrap_err().contains("at most 50 different"));
3201 }
3202
3203 #[test]
3204 fn a_matrixs_calls_are_named_by_the_caller_and_its_values() {
3205 let workflow = super::workflow::parse(
3206 "on: push\njobs:\n build:\n name: Build\n strategy:\n matrix: { os: [linux], node: [20] }\n uses: ./.g1t/workflows/b.yml\n plain:\n uses: ./.g1t/workflows/b.yml\n test:\n name: Test ${{ matrix.os }}\n strategy:\n matrix: { os: [linux] }\n runs-on: ubuntu-latest\n steps: [{ run: 'true' }]",
3207 )
3208 .unwrap();
3209 let job = |id: &str| workflow.jobs.iter().find(|job| job.id == id).unwrap();
3210 let combination: Map<String, Value> = serde_json::from_value(json!({ "os": "linux", "node": 20 })).unwrap();
3211 let mut contexts = Map::new();
3212 contexts.insert("matrix".into(), Value::Object(combination.clone()));
3213 let scope = Scope { contexts: &contexts, status: Status::Success, hash_files: None };
3214 assert_eq!(shown_name(job("build"), None, &combination, &scope), "Build (linux, 20)");
3215 assert_eq!(shown_name(job("plain"), None, &Map::new(), &scope), "plain");
3216 // A called workflow's job, under the call that made it.
3217 assert_eq!(shown_name(job("plain"), Some("Build (linux, 20)"), &Map::new(), &scope), "Build (linux, 20) / plain");
3218 assert_eq!(shown_name(job("test"), Some("Build"), &combination, &scope), "Build / Test linux");
3219 }
3220
3221 #[test]
3222 fn a_job_keeps_twenty_steps_summaries_of_a_mebibyte_each() {
3223 assert!(summary_fits(0, None, 10));
3224 assert!(!summary_fits(0, None, 0), "nothing to keep");
3225 assert!(!summary_fits(MAX_SUMMARIES, None, 10), "a twenty-first step's summary is dropped");
3226 assert!(summary_fits(MAX_SUMMARIES, Some(10), 10), "a step that has one may add to it");
3227 assert!(summary_fits(1, Some(MAX_SUMMARY_BYTES - 10), 10));
3228 assert!(!summary_fits(1, Some(MAX_SUMMARY_BYTES - 10), 11));
3229 assert!(!summary_fits(0, None, MAX_SUMMARY_BYTES + 1));
3230 }
3231
3232 #[test]
3233 fn a_debug_rerun_sets_what_github_sets() {
3234 let mut variables = Map::new();
3235 let mut runner = json!({ "name": "g1t", "debug": "" });
3236 debug_logging(&mut variables, &mut runner);
3237 assert_eq!(variables["RUNNER_DEBUG"], "1");
3238 assert_eq!(variables["ACTIONS_STEP_DEBUG"], "true");
3239 assert_eq!(variables["ACTIONS_RUNNER_DEBUG"], "true");
3240 assert_eq!(runner["debug"], Value::String("1".into()));
3241 assert_eq!(runner["name"], "g1t");
3242 }
3243}