Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
1,196 linesCodeBlameRaw
1//! `uses:` steps: `actions/checkout` done natively against g1t, actions
2//! fetched from another repository on g1t (or else GitHub, at the commit
3//! g1t resolved its ref to, from the archive g1t keeps of it when it has
4//! one) and run as they are (JavaScript, composite and Docker),
5//! `docker://` images, and a few of GitHub's own whose services g1t does
6//! not have yet. Every action a job's steps name is downloaded before the
7//! first step runs, as GitHub's runner does.
8
9use std::collections::BTreeMap;
10use std::path::{Path, PathBuf};
11use std::process::Command;
12use std::time::Duration;
13
14use base64::Engine;
15use base64::engine::general_purpose::STANDARD;
16use g1t_actions::expr;
17use g1t_actions::workflow::yaml_to_json;
18use serde_json::{Map, Value, json};
19
20use super::containers::{self, DockerRun};
21use super::files::StepFiles;
22use super::process::{self, Commands, Ended};
23use super::{Frame, Job, Post, PostRun};
24
25const ACTIONS_DIR: &str = "/home/runner/_actions";
26
27/// Where an action comes from.
28enum Source {
29 Local(PathBuf),
30 /// Another repository: on g1t when g1t has it and this one may use
31 /// it, otherwise on GitHub.
32 GitHub { owner: String, repo: String, path: String, git_ref: String },
33}
34
35fn safe(part: &str) -> bool {
36 !part.is_empty() && part.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.' | '/')) && !part.contains("..")
37}
38
39fn is_sha(text: &str) -> bool {
40 text.len() == 40 && text.chars().all(|c| c.is_ascii_hexdigit())
41}
42
43/// Whether the runner does `name` (lowercased, without its ref) itself
44/// rather than fetching it.
45fn native(name: &str, docker_hosted: bool) -> bool {
46 matches!(
47 name,
48 "actions/checkout"
49 | "actions/upload-artifact"
50 | "actions/upload-artifact/merge"
51 | "actions/download-artifact"
52 ) || (docker_hosted && name == "docker/setup-buildx-action")
53}
54
55/// The repository and ref of an action `uses` fetches from another
56/// repository: (owner, repo, ref). None for one that is local, a Docker
57/// image, done natively, or not a name at all.
58fn remote_action(uses: &str, docker_hosted: bool) -> Option<(String, String, String)> {
59 let uses = uses.trim();
60 if uses.starts_with("./") || uses.starts_with("docker://") {
61 return None;
62 }
63 let (name, git_ref) = uses.split_once('@')?;
64 if git_ref.is_empty() || native(&name.to_ascii_lowercase(), docker_hosted) {
65 return None;
66 }
67 let mut parts = name.splitn(3, '/');
68 let (owner, repo) = (parts.next()?, parts.next()?);
69 (!owner.is_empty() && !repo.is_empty()).then(|| (owner.to_owned(), repo.to_owned(), git_ref.to_owned()))
70}
71
72/// Every branch, as a checkout with all history fetches them.
73const HEADS_REFSPEC: &str = "+refs/heads/*:refs/remotes/origin/*";
74/// Every tag, likewise.
75const TAGS_REFSPEC: &str = "+refs/tags/*:refs/tags/*";
76
77/// What a checkout fetches and where it ends, as `actions/checkout`
78/// decides it (its `getRefSpec`, `getRefSpecForAllHistory` and
79/// `getCheckoutInfo`).
80#[derive(Debug, PartialEq, Eq)]
81struct CheckoutPlan {
82 refspecs: Vec<String>,
83 /// The commit to end on, when it is known before the fetch.
84 sha: Option<String>,
85 /// The branch made there (or at its remote-tracking branch).
86 branch: Option<String>,
87 /// Where to end with neither: a tag, or another ref.
88 start: Option<String>,
89 /// A name that may be a branch or a tag; the fetch tells which.
90 unqualified: Option<String>,
91 /// The step's `ref` output.
92 output_ref: String,
93}
94
95/// `wanted` is the step's `ref` (or another repository's default branch);
96/// without one, the run's own ref and commit for its own repository.
97fn checkout_plan(wanted: Option<&str>, same: bool, run_ref: &str, run_sha: &str) -> CheckoutPlan {
98 let (git_ref, commit) = match wanted {
99 Some(r) if is_sha(r) => (String::new(), r.to_owned()),
100 Some(r) => (r.to_owned(), String::new()),
101 // Some events name a branch without `refs/heads/`.
102 None if same && !run_sha.is_empty() && !run_ref.is_empty() && !run_ref.starts_with("refs/") => (format!("refs/heads/{run_ref}"), run_sha.to_owned()),
103 None if same => (run_ref.to_owned(), run_sha.to_owned()),
104 None => (String::new(), String::new()),
105 };
106 let upper = git_ref.to_ascii_uppercase();
107 let rest = |prefix: &str| git_ref[prefix.len()..].to_owned();
108 let mut plan = CheckoutPlan { refspecs: Vec::new(), sha: None, branch: None, start: None, unqualified: None, output_ref: git_ref.clone() };
109 if !commit.is_empty() {
110 plan.refspecs.push(if upper.starts_with("REFS/HEADS/") {
111 plan.branch = Some(rest("refs/heads/"));
112 format!("+{commit}:refs/remotes/origin/{}", rest("refs/heads/"))
113 } else if upper.starts_with("REFS/PULL/") {
114 format!("+{commit}:refs/remotes/pull/{}", rest("refs/pull/"))
115 } else if upper.starts_with("REFS/TAGS/") {
116 format!("+{commit}:{git_ref}")
117 } else {
118 commit.clone()
119 });
120 plan.sha = Some(commit);
121 } else if git_ref.is_empty() {
122 plan.refspecs.push("HEAD".into());
123 } else if !upper.starts_with("REFS/") {
124 plan.refspecs.push(format!("+refs/heads/{git_ref}*:refs/remotes/origin/{git_ref}*"));
125 plan.refspecs.push(format!("+refs/tags/{git_ref}*:refs/tags/{git_ref}*"));
126 plan.unqualified = Some(git_ref.clone());
127 } else if upper.starts_with("REFS/HEADS/") {
128 plan.branch = Some(rest("refs/heads/"));
129 plan.refspecs.push(format!("+{git_ref}:refs/remotes/origin/{}", rest("refs/heads/")));
130 } else if upper.starts_with("REFS/PULL/") {
131 let local = format!("refs/remotes/pull/{}", rest("refs/pull/"));
132 plan.refspecs.push(format!("+{git_ref}:{local}"));
133 plan.start = Some(local);
134 } else {
135 plan.refspecs.push(format!("+{git_ref}:{git_ref}"));
136 plan.start = Some(git_ref.clone());
137 }
138 plan
139}
140
141impl Job {
142 /// Runs a git command, logging it; the credential header is never logged.
143 fn git(&mut self, dir: &Path, args: &[&str], auth: Option<&str>) -> bool {
144 let shown: Vec<&str> = args.to_vec();
145 self.log.line(&format!("[command]git {}", shown.join(" ")));
146 let mut command = Command::new("git");
147 command.current_dir(dir);
148 if let Some(header) = auth {
149 command.args(["-c", &format!("http.extraheader={header}")]);
150 }
151 command.args(args).env("GIT_TERMINAL_PROMPT", "0");
152 let mut commands = Commands::default();
153 matches!(process::run(command, Duration::from_secs(600).min(self.remaining_time()), &mut self.log, &mut commands), Ok(Ended::Exited(0)))
154 }
155
156 /// A fetch, tried again after a short wait when it fails: a transfer
157 /// cut short on the way ("transfer closed with N bytes remaining") is
158 /// over by the next try. Three tries in all, as actions/checkout does.
159 fn fetch_retrying(&mut self, dir: &Path, args: &[&str], auth: Option<&str>) -> bool {
160 for (attempt, wait) in [0u64, 2, 5].into_iter().enumerate() {
161 if attempt > 0 {
162 self.log.line(&format!("The fetch failed; trying again in {wait} s ({} of 3).", attempt + 1));
163 std::thread::sleep(Duration::from_secs(wait));
164 }
165 if self.git(dir, args, auth) {
166 return true;
167 }
168 }
169 false
170 }
171
172 /// A git command with `header` sent only to `server` (`http.<server>/.extraheader`),
173 /// so a submodule on another host never sees the job's token. Logged
174 /// without the header.
175 fn git_scoped(&mut self, dir: &Path, args: &[&str], server: &str, header: Option<&str>) -> bool {
176 self.log.line(&format!("[command]git {}", args.join(" ")));
177 let mut command = Command::new("git");
178 command.current_dir(dir);
179 if let Some(header) = header {
180 command.args(["-c", &format!("http.{server}/.extraheader={header}")]);
181 }
182 command.args(args).env("GIT_TERMINAL_PROMPT", "0");
183 let mut commands = Commands::default();
184 matches!(process::run(command, Duration::from_secs(600).min(self.remaining_time()), &mut self.log, &mut commands), Ok(Ended::Exited(0)))
185 }
186
187 /// `actions/checkout`, against g1t: the inputs of its version 4 and 5
188 /// but `ssh-key`, `lfs` and `clean: false`, fetching what it fetches
189 /// and ending on the same branch or commit.
190 fn checkout(&mut self, with: &BTreeMap<String, String>) -> (bool, BTreeMap<String, String>) {
191 let checkout = self.spec["checkout"].clone();
192 let own = checkout["repository"].as_str().unwrap_or_default().to_owned();
193 let server = self.contexts["github"]["server_url"].as_str().unwrap_or("https://g1t.sh").trim_end_matches('/').to_owned();
194 let input = |name: &str| with.get(name).map(|v| v.trim().to_owned()).filter(|v| !v.is_empty());
195 let yes = |name: &str, default: bool| input(name).map_or(default, |v| v.eq_ignore_ascii_case("true"));
196 let repository = input("repository").unwrap_or(own.clone());
197 let same = repository.eq_ignore_ascii_case(&own);
198 let token = input("token").or_else(|| checkout["token"].as_str().map(str::to_owned)).unwrap_or_default();
199 let url = if same { checkout["url"].as_str().unwrap_or_default().to_owned() } else { format!("{server}/{repository}.git") };
200 let path = input("path").map_or(self.workspace.clone(), |p| self.workspace.join(p));
201 // As the action reads it: not a number, or below zero, is all history.
202 let depth: u32 = input("fetch-depth").map_or(1, |d| d.parse::<f64>().ok().filter(|d| *d >= 0.0).map_or(0, |d| d as u32));
203 let wanted_ref = input("ref");
204 let filter = input("filter");
205 let sparse: Vec<String> = with.get("sparse-checkout").map(|s| s.lines().map(str::trim).filter(|l| !l.is_empty()).map(str::to_owned).collect()).unwrap_or_default();
206 let auth = (!token.is_empty()).then(|| format!("AUTHORIZATION: basic {}", STANDARD.encode(format!("x-access-token:{token}"))));
207 let header = auth.as_deref();
208
209 self.log.line(&format!("Syncing repository: {repository}"));
210 if path.exists() {
211 let _ = std::fs::remove_dir_all(&path);
212 }
213 if let Err(error) = std::fs::create_dir_all(&path) {
214 self.log.line(&format!("##[error]Could not make {}: {error}", path.display()));
215 return (false, BTreeMap::new());
216 }
217 // So git works on it in a container run as another user.
218 if yes("set-safe-directory", true) {
219 let _ = Command::new("git").args(["config", "--global", "--add", "safe.directory", "*"]).status();
220 }
221 if !self.git(&path, &["init", "--quiet"], None) || !self.git(&path, &["remote", "add", "origin", &url], None) {
222 return (false, BTreeMap::new());
223 }
224 let _ = Command::new("git").current_dir(&path).args(["config", "--local", "gc.auto", "0"]).status();
225
226 // Another repository with no ref: its default branch, as the
227 // action asks the API for it.
228 let default_branch = match (&wanted_ref, same) {
229 (None, false) => self.default_branch(&path, &server, header),
230 _ => None,
231 };
232 let plan = checkout_plan(
233 wanted_ref.as_deref().or(default_branch.as_deref()),
234 same,
235 checkout["ref"].as_str().unwrap_or_default(),
236 checkout["sha"].as_str().unwrap_or_default(),
237 );
238 let depth_arg = format!("--depth={depth}");
239 let filter_arg = filter.clone().or_else(|| (!sparse.is_empty()).then(|| "blob:none".to_owned())).map(|f| format!("--filter={f}"));
240 let fetch_args = |refspecs: &[String], tags: bool| {
241 let mut args: Vec<String> = ["-c", "protocol.version=2", "fetch", "--prune", "--no-recurse-submodules", "--quiet"].map(String::from).into();
242 if !tags {
243 args.push("--no-tags".into());
244 }
245 args.extend(filter_arg.clone());
246 if depth > 0 {
247 args.push(depth_arg.clone());
248 }
249 args.push("origin".into());
250 args.extend(refspecs.iter().cloned());
251 args
252 };
253 // All history: every branch and tag, then what the run names, which
254 // may be a commit its branch has since moved on from.
255 let everything = fetch_args(&[HEADS_REFSPEC.into(), TAGS_REFSPEC.into()], true);
256 let everything: Vec<&str> = everything.iter().map(String::as_str).collect();
257 let named = fetch_args(&plan.refspecs, yes("fetch-tags", false));
258 let named: Vec<&str> = named.iter().map(String::as_str).collect();
259 let fetched = (depth > 0 || self.fetch_retrying(&path, &everything, header)) && self.fetch_retrying(&path, &named, header);
260 let has = |target: &str| Command::new("git").current_dir(&path).args(["cat-file", "-e", &format!("{target}^{{commit}}")]).status().is_ok_and(|s| s.success());
261 // The commit may be further back than a shallow fetch reaches (the
262 // branch moved on after the run began), or not one the server
263 // gives by itself: then the whole history.
264 if let Some(sha) = plan.sha.as_deref().filter(|sha| !has(sha)) {
265 let shallow = path.join(".git").join("shallow").exists();
266 let mut deepen = vec!["-c", "protocol.version=2", "fetch", "--no-tags", "--quiet"];
267 if shallow {
268 deepen.push("--unshallow");
269 }
270 deepen.extend(["origin", HEADS_REFSPEC]);
271 if !self.fetch_retrying(&path, &deepen, header) || !has(sha) {
272 self.log.line(&format!("##[error]Could not fetch {sha} from {repository}."));
273 return (false, BTreeMap::new());
274 }
275 } else if !fetched {
276 self.log.line(&format!("##[error]Could not fetch {} from {repository}.", plan.refspecs.join(" ")));
277 return (false, BTreeMap::new());
278 }
279
280 // Where to end up: a branch made at its start point, or detached.
281 let ref_exists = |name: &str| Command::new("git").current_dir(&path).args(["rev-parse", "--verify", "--quiet", name]).output().is_ok_and(|o| o.status.success());
282 let (branch, target) = match (&plan.sha, &plan.branch, &plan.unqualified) {
283 (Some(sha), branch, _) => (branch.clone(), sha.clone()),
284 (None, Some(branch), _) => (Some(branch.clone()), format!("refs/remotes/origin/{branch}")),
285 (None, None, Some(name)) if ref_exists(&format!("refs/remotes/origin/{name}")) => (Some(name.clone()), format!("refs/remotes/origin/{name}")),
286 (None, None, Some(name)) if ref_exists(&format!("refs/tags/{name}")) => (None, format!("refs/tags/{name}")),
287 (None, None, Some(name)) => {
288 self.log.line(&format!("##[error]A branch or tag with the name '{name}' could not be found"));
289 return (false, BTreeMap::new());
290 }
291 (None, None, None) => (None, plan.start.clone().unwrap_or_else(|| "FETCH_HEAD".into())),
292 };
293 if !sparse.is_empty() {
294 let mut args = vec!["sparse-checkout", "set"];
295 args.push(if yes("sparse-checkout-cone-mode", true) { "--cone" } else { "--no-cone" });
296 args.extend(sparse.iter().map(String::as_str));
297 if !self.git(&path, &args, None) {
298 return (false, BTreeMap::new());
299 }
300 }
301 let checked_out = match &branch {
302 Some(branch) => self.git(&path, &["checkout", "--quiet", "--force", "-B", branch, &target], None),
303 None => self.git(&path, &["checkout", "--quiet", "--force", "--detach", &target], None),
304 };
305 if !checked_out {
306 return (false, BTreeMap::new());
307 }
308 let persist = yes("persist-credentials", true);
309 let key = format!("http.{server}/.extraheader");
310 if persist && let Some(header) = header {
311 let _ = Command::new("git").current_dir(&path).args(["config", "--local", &key, header]).status();
312 }
313 if let Some(submodules) = input("submodules").map(|s| s.to_ascii_lowercase()).filter(|s| s == "true" || s == "recursive") {
314 let recursive = submodules == "recursive";
315 // A submodule on g1t named by its SSH address is fetched over
316 // HTTPS with the token, as the action does.
317 let host = server.split_once("://").map_or(server.as_str(), |(_, host)| host).to_owned();
318 let instead = format!("url.{server}/.insteadOf=git@{host}:");
319 let mut sync = vec!["submodule", "sync", "--quiet"];
320 let mut update = vec!["-c", &instead, "-c", "protocol.version=2", "submodule", "update", "--init", "--force", "--quiet"];
321 if depth > 0 {
322 update.push(&depth_arg);
323 }
324 if recursive {
325 sync.push("--recursive");
326 update.push("--recursive");
327 }
328 if !self.git(&path, &sync, None) || !self.git_scoped(&path, &update, &server, header) {
329 self.log.line("##[error]The submodules could not all be checked out.");
330 return (false, BTreeMap::new());
331 }
332 if persist && let Some(header) = header {
333 let mut foreach = vec!["submodule", "foreach", "--quiet"];
334 if recursive {
335 foreach.push("--recursive");
336 }
337 foreach.push(r#"git config --local "$G1T_KEY" "$G1T_HEADER" && git config --local gc.auto 0"#);
338 let _ = Command::new("git").current_dir(&path).args(&foreach).env("G1T_KEY", &key).env("G1T_HEADER", header).status();
339 }
340 }
341 if yes("lfs", false) {
342 self.log.line("##[warning]Git LFS files are not fetched on g1t: g1t does not keep LFS objects yet.");
343 }
344 let commit = Command::new("git").current_dir(&path).args(["rev-parse", "HEAD"]).output().ok().map(|o| String::from_utf8_lossy(&o.stdout).trim().to_owned()).unwrap_or_default();
345 self.log.line(&format!("Checked out {commit}"));
346 let mut outputs = BTreeMap::new();
347 outputs.insert("ref".into(), plan.output_ref);
348 outputs.insert("commit".into(), commit);
349 (true, outputs)
350 }
351
352 /// Another repository's default branch, from what its remote says
353 /// `HEAD` is. None when it says nothing: the fetch then takes `HEAD`.
354 fn default_branch(&mut self, dir: &Path, server: &str, header: Option<&str>) -> Option<String> {
355 let mut command = Command::new("git");
356 command.current_dir(dir);
357 if let Some(header) = header {
358 command.args(["-c", &format!("http.{server}/.extraheader={header}")]);
359 }
360 let output = command.args(["ls-remote", "--quiet", "--symref", "origin", "HEAD"]).env("GIT_TERMINAL_PROMPT", "0").output().ok()?;
361 let text = String::from_utf8_lossy(&output.stdout);
362 let branch = text.lines().find_map(|line| line.strip_prefix("ref: ")?.split_once('\t')?.0.strip_prefix("refs/heads/").map(str::to_owned))?;
363 self.log.line(&format!("Default branch '{branch}'"));
364 Some(format!("refs/heads/{branch}"))
365 }
366
367 /// Fetches another repository's action, once per job: from g1t when
368 /// g1t has the repository and this one may use it, otherwise from
369 /// GitHub. A private repository on g1t that may not be used here fails
370 /// the step, saying why, rather than fetching something else by its
371 /// name.
372 fn fetch_remote_action(&mut self, owner: &str, repo: &str, git_ref: &str) -> Option<PathBuf> {
373 let on_g1t = super::paths::under_home(ACTIONS_DIR).join("_g1t").join(owner).join(repo).join(git_ref);
374 let on_github = super::paths::under_home(ACTIONS_DIR).join(owner).join(repo).join(git_ref);
375 for dir in [&on_g1t, &on_github] {
376 if dir.join(".g1t-fetched").exists() {
377 return Some(dir.clone());
378 }
379 }
380 if !(safe(owner) && safe(repo) && safe(git_ref)) {
381 self.log.line(&format!("##[error]`{owner}/{repo}@{git_ref}` is not a name g1t can fetch."));
382 return None;
383 }
384 match self.log.api.action(&format!("{owner}/{repo}"), git_ref) {
385 Ok(found) if found["source"] == "g1t" => self.fetch_g1t_action(&on_g1t, owner, repo, git_ref, &found),
386 Ok(found) => {
387 if let Some(note) = found["note"].as_str() {
388 self.log.line(&format!("##[warning]{note}"));
389 }
390 let sha = found["sha"].as_str().filter(|sha| is_sha(sha)).map(str::to_owned);
391 if let Some(sha) = &sha
392 && found["archive"] == true
393 && let Some(dir) = self.fetch_archived_action(owner, repo, git_ref, sha)
394 {
395 return Some(dir);
396 }
397 self.fetch_action(owner, repo, git_ref, sha.as_deref())
398 }
399 Err((true, why)) => {
400 self.log.line(&format!("##[error]{why}"));
401 None
402 }
403 Err((false, why)) => {
404 self.log.line(&format!("##[warning]g1t could not say where {owner}/{repo} is ({why}); fetching it from GitHub."));
405 self.fetch_action(owner, repo, git_ref, None)
406 }
407 }
408 }
409
410 /// Fetches an action from a repository on g1t, at its ref, with the
411 /// read-only token g1t gave for it when it is private.
412 fn fetch_g1t_action(&mut self, dir: &Path, owner: &str, repo: &str, git_ref: &str, found: &Value) -> Option<PathBuf> {
413 let url = found["url"].as_str().unwrap_or_default().to_owned();
414 let token = found["token"].as_str().filter(|token| !token.is_empty()).map(str::to_owned);
415 if let Some(token) = &token {
416 self.log.add_mask(token);
417 }
418 let auth = token.map(|token| format!("AUTHORIZATION: basic {}", STANDARD.encode(format!("x-access-token:{token}"))));
419 self.log.line(&format!("Download action repository '{owner}/{repo}@{git_ref}' from g1t"));
420 let _ = std::fs::remove_dir_all(dir);
421 if std::fs::create_dir_all(dir).is_err() || !self.git(dir, &["init", "--quiet"], None) || !self.git(dir, &["remote", "add", "origin", &url], None) {
422 return None;
423 }
424 // A branch or tag at its tip; a commit may need the history.
425 let shallow = self.fetch_retrying(dir, &["fetch", "--depth=1", "--no-tags", "--quiet", "origin", git_ref], auth.as_deref());
426 let checked_out = if shallow {
427 self.git(dir, &["checkout", "--quiet", "--force", "--detach", "FETCH_HEAD"], None)
428 } else {
429 self.fetch_retrying(dir, &["fetch", "--quiet", "--tags", "origin", "+refs/heads/*:refs/remotes/origin/*"], auth.as_deref())
430 && self.git(dir, &["checkout", "--quiet", "--force", "--detach", git_ref], None)
431 };
432 if !checked_out {
433 self.log.line(&format!("##[error]Could not fetch {owner}/{repo}@{git_ref} from g1t: is {git_ref} a branch, tag or commit there?"));
434 let _ = std::fs::remove_dir_all(dir);
435 return None;
436 }
437 let _ = std::fs::write(dir.join(".g1t-fetched"), "");
438 Some(dir.to_path_buf())
439 }
440
441 /// Downloads a GitHub action's archive that g1t keeps, at the commit
442 /// g1t resolved its ref to. None when it could not, and the job fetches
443 /// it from GitHub instead.
444 fn fetch_archived_action(&mut self, owner: &str, repo: &str, git_ref: &str, sha: &str) -> Option<PathBuf> {
445 let dir = super::paths::under_home(ACTIONS_DIR).join(owner).join(repo).join(git_ref);
446 self.log.line(&format!("Download action repository '{owner}/{repo}@{git_ref}' (SHA:{sha}) from g1t"));
447 let archive = self.temp.join(format!("action{}.tar.gz", super::rand_id()));
448 let downloaded = self.log.api.action_archive(&format!("{owner}/{repo}"), sha, &archive);
449 let unpacked = match downloaded {
450 Ok(_) => {
451 let _ = std::fs::remove_dir_all(&dir);
452 let _ = std::fs::create_dir_all(&dir);
453 let mut command = Command::new("tar");
454 command.arg("-xzf").arg(&archive).arg("-C").arg(&dir).arg("--strip-components=1");
455 if cfg!(windows) {
456 // GNU tar on Windows reads `C:...` as a host and a file.
457 command.arg("--force-local");
458 }
459 let mut commands = Commands::default();
460 matches!(process::run(command, Duration::from_secs(300).min(self.remaining_time()), &mut self.log, &mut commands), Ok(Ended::Exited(0)))
461 }
462 Err(why) => {
463 self.log.line(&format!("g1t could not send it ({why}); fetching it from GitHub."));
464 false
465 }
466 };
467 let _ = std::fs::remove_file(&archive);
468 if !unpacked {
469 let _ = std::fs::remove_dir_all(&dir);
470 return None;
471 }
472 let _ = std::fs::write(dir.join(".g1t-fetched"), "");
473 Some(dir)
474 }
475
476 /// Fetches an action from GitHub, once per job: at `sha` when g1t
477 /// resolved its ref to one, so it is the commit g1t named.
478 fn fetch_action(&mut self, owner: &str, repo: &str, git_ref: &str, sha: Option<&str>) -> Option<PathBuf> {
479 let dir = super::paths::under_home(ACTIONS_DIR).join(owner).join(repo).join(git_ref);
480 if dir.join(".g1t-fetched").exists() {
481 return Some(dir);
482 }
483 if !(safe(owner) && safe(repo) && safe(git_ref)) {
484 self.log.line(&format!("##[error]`{owner}/{repo}@{git_ref}` is not a name g1t can fetch."));
485 return None;
486 }
487 match sha {
488 Some(sha) => self.log.line(&format!("Download action repository '{owner}/{repo}@{git_ref}' (SHA:{sha})")),
489 None => self.log.line(&format!("Download action repository '{owner}/{repo}@{git_ref}'")),
490 }
491 let _ = std::fs::create_dir_all(&dir);
492 let url = format!("https://codeload.github.com/{owner}/{repo}/tar.gz/{}", sha.unwrap_or(git_ref));
493 let script = format!("set -o pipefail; curl -fsSL --retry 3 '{url}' | tar{} -xz -C '{}' --strip-components=1", super::blobs::tar_local(), dir.display());
494 let mut command = Command::new("bash");
495 command.args(["-c", &script]);
496 let mut commands = Commands::default();
497 match process::run(command, Duration::from_secs(300).min(self.remaining_time()), &mut self.log, &mut commands) {
498 Ok(Ended::Exited(0)) => {
499 let _ = std::fs::write(dir.join(".g1t-fetched"), "");
500 Some(dir)
501 }
502 _ => {
503 self.log.line(&format!("##[error]Could not download {owner}/{repo}@{git_ref} from GitHub."));
504 let _ = std::fs::remove_dir_all(&dir);
505 None
506 }
507 }
508 }
509
510 /// Downloads every action the job's steps fetch from other
511 /// repositories, before the first step runs, as GitHub's runner does in
512 /// "Set up job". False when one could not be: the job fails before
513 /// anything runs. Actions a composite action uses are fetched as it
514 /// runs.
515 pub(crate) fn prepare_actions(&mut self, steps: &[Map<String, Value>]) -> bool {
516 let mut wanted: Vec<(String, String, String)> = Vec::new();
517 for step in steps {
518 if let Some(found) = step.get("uses").and_then(Value::as_str).and_then(|uses| remote_action(uses, self.docker_hosted))
519 && !wanted.contains(&found)
520 {
521 wanted.push(found);
522 }
523 }
524 if wanted.is_empty() {
525 return true;
526 }
527 self.log.line("Prepare all required actions");
528 self.log.line("Getting action download info");
529 let mut ready = true;
530 for (owner, repo, git_ref) in &wanted {
531 if self.fetch_remote_action(owner, repo, git_ref).is_none() {
532 ready = false;
533 }
534 }
535 if !ready {
536 self.log.line("##[error]Not every action this job uses could be downloaded, so no step was run.");
537 }
538 ready
539 }
540
541 /// Runs a JavaScript file of an action with Node: the one its
542 /// `runs.using` names where the machine has it (`node_program`).
543 pub(crate) fn run_node(&mut self, action_dir: &Path, script: &str, env: &BTreeMap<String, String>, using: &str) -> bool {
544 let id = format!("node{}", super::rand_id());
545 let Ok(files) = StepFiles::new(&self.temp, &id) else { return false };
546 let full = self.process_env(env, &files);
547 let script_path = action_dir.join(script);
548 // In a job container whose image runs the runner's Node, the action
549 // runs there, as on GitHub.
550 let in_container = self.container.as_ref().filter(|c| c.node).map(|c| c.path.clone()).and_then(|image_path| {
551 let inside = self.container_env(env, full.clone(), &image_path);
552 self.in_container(containers::CONTAINER_NODE, &[script_path.display().to_string()], &self.workspace, inside)
553 });
554 let command = match in_container {
555 Some(command) => command,
556 None => {
557 let node = node_program(using, |name| std::env::var(name).ok(), |path| path.is_file());
558 let mut command = Command::new(node);
559 command.arg(&script_path).current_dir(&self.workspace).env_clear().envs(full);
560 command
561 }
562 };
563 let mut commands = Commands {
564 debug: self.debug,
565 ..Commands::default()
566 };
567 let ended = process::run(command, Duration::from_secs(6 * 3600).min(self.deadline_left()), &mut self.log, &mut commands);
568 let ok = matches!(ended, Ok(Ended::Exited(0)));
569 match ended {
570 Ok(Ended::Exited(code)) if code != 0 => self.log.line(&format!("##[error]The action exited with code {code}.")),
571 Ok(Ended::TimedOut) => self.log.line("##[error]The action ran past its time limit and was stopped."),
572 _ => {}
573 }
574 let (outputs, state) = self.absorb(&files, &commands);
575 self.last_node_outputs = outputs;
576 self.last_node_state = state;
577 ok
578 }
579
580 fn log_header(&mut self, uses: &str, with: &BTreeMap<String, String>, env: &BTreeMap<String, String>) {
581 for line in super::uses_header(uses, with, env) {
582 self.log.line(&line);
583 }
584 }
585
586 fn deadline_left(&self) -> Duration {
587 self.remaining_time()
588 }
589
590 /// Runs a `uses:` step. Returns whether it succeeded, and its outputs.
591 #[allow(clippy::too_many_arguments)]
592 pub(crate) fn uses(
593 &mut self,
594 uses: &str,
595 with: &BTreeMap<String, String>,
596 env: &BTreeMap<String, String>,
597 frame: &Frame,
598 title: &str,
599 action_name: &str,
600 _timeout: Duration,
601 ) -> (bool, BTreeMap<String, String>) {
602 let uses = uses.trim();
603 let (name, git_ref) = uses.split_once('@').unwrap_or((uses, ""));
604 let lower = name.to_ascii_lowercase();
605 // The step opens as GitHub's do: `Run` and the action, its inputs
606 // and variables, folded. An action fetched from a repository lists
607 // its inputs as they are read, its defaults among them.
608 let fetched = !uses.starts_with("docker://") && !native(&lower, self.docker_hosted);
609 if !fetched {
610 self.log_header(uses, with, env);
611 }
612 if let Some(image) = uses.strip_prefix("docker://") {
613 // `with.args` and `with.entrypoint` are the container's; every
614 // input is also an `INPUT_` variable, as on GitHub.
615 let mut step_env = env.clone();
616 step_env.insert("GITHUB_ACTION".into(), action_name.to_owned());
617 for (input, value) in with {
618 step_env.insert(format!("INPUT_{}", input.replace(' ', "_").to_ascii_uppercase()), value.clone());
619 }
620 let run = DockerRun {
621 image: image.to_owned(),
622 entrypoint: with.get("entrypoint").filter(|e| !e.is_empty()).cloned(),
623 args: with.get("args").map(|a| containers::split_words(a)).unwrap_or_default(),
624 env: step_env,
625 };
626 let (ok, outputs, _) = self.run_docker(&run);
627 return (ok, outputs);
628 }
629 if lower == "docker/setup-buildx-action" && native(&lower, self.docker_hosted) {
630 return self.setup_buildx(with);
631 }
632 match lower.as_str() {
633 "actions/checkout" => return self.checkout(with),
634 "actions/upload-artifact" => return self.upload_artifact(with),
635 "actions/upload-artifact/merge" => return self.merge_artifacts(with),
636 "actions/download-artifact" => return self.download_artifact(with),
637 _ => {}
638 }
639 let Some(found) = self.resolve_action(uses) else {
640 self.log_header(uses, with, env);
641 return (false, BTreeMap::new());
642 };
643 let Action { dir, local, manifest: action, .. } = &found;
644
645 // Inputs: what the step gives, else the action's defaults.
646 let env_context = env.clone();
647 let contexts = self.contexts_for(frame, &env_context);
648 let inputs = self.action_inputs(action, with, &contexts, true);
649 self.log_header(uses, &inputs, env);
650
651 let runs = action.get("runs").cloned().unwrap_or(Value::Null);
652 let using = runs.get("using").map(expr::to_text).unwrap_or_default().to_ascii_lowercase();
653 let mut step_env = action_env(env, action_name, &found, git_ref);
654
655 if using.starts_with("node") {
656 for (input, value) in &inputs {
657 step_env.insert(format!("INPUT_{}", input.replace(' ', "_").to_ascii_uppercase()), value.clone());
658 }
659 let condition_of = |key: &str| runs.get(key).map(expr::to_text).unwrap_or_else(|| "always()".into());
660 // State an action saves, `STATE_<name>` for its later stages.
661 let mut state = BTreeMap::new();
662 if let Some(pre) = runs.get("pre").map(expr::to_text) {
663 if frame.action_path.is_some() {
664 // An action inside a composite action: its `pre` right
665 // before its `main`.
666 let run_pre = self.with_scope(&contexts, |scope| expr::condition(&condition_of("pre-if"), scope)).unwrap_or(true);
667 if run_pre {
668 if !self.run_node(dir, &pre, &step_env, &using) {
669 return (false, BTreeMap::new());
670 }
671 state = std::mem::take(&mut self.last_node_state);
672 }
673 } else if *local {
674 self.log.line(&format!("##[warning]`pre` execution is not supported for local action from '{uses}'"));
675 } else {
676 // Run before the job's first step (`pre_steps`).
677 state = self.pre_state.remove(action_name).unwrap_or_default();
678 }
679 }
680 let Some(main) = runs.get("main").map(expr::to_text) else {
681 self.log.line(&format!("##[error]`{uses}` has no `runs.main`."));
682 return (false, BTreeMap::new());
683 };
684 let mut main_env = step_env.clone();
685 for (name, value) in &state {
686 main_env.insert(format!("STATE_{name}"), value.clone());
687 }
688 let ok = self.run_node(dir, &main, &main_env, &using);
689 let outputs = std::mem::take(&mut self.last_node_outputs);
690 state.extend(std::mem::take(&mut self.last_node_state));
691 if let Some(post) = runs.get("post").map(expr::to_text) {
692 let mut post_env = step_env.clone();
693 for (name, value) in state {
694 post_env.insert(format!("STATE_{name}"), value);
695 }
696 self.posts.push(Post {
697 name: format!("Post {title}"),
698 condition: condition_of("post-if"),
699 env: post_env,
700 run: PostRun::Node { action_dir: dir.clone(), script: post, using: using.clone() },
701 });
702 }
703 return (ok, outputs);
704 }
705 if using == "composite" {
706 let mut inner = Frame {
707 steps: Map::new(),
708 inputs: Some(Value::Object(inputs.iter().map(|(k, v)| (k.clone(), json!(v))).collect())),
709 action_path: Some(dir.display().to_string()),
710 env: env.clone(),
711 };
712 let mut steps: Vec<Map<String, Value>> = runs.get("steps").and_then(Value::as_array).map(|s| s.iter().filter_map(|s| s.as_object().cloned()).collect()).unwrap_or_default();
713 super::name_steps(&mut steps);
714 let was_failed = self.failed;
715 // A composite's steps see their own success, not the job's.
716 self.failed = false;
717 let mut ok = true;
718 for step in &steps {
719 if !self.step(&mut inner, step, 0, false, &Map::new()) {
720 ok = false;
721 }
722 }
723 let contexts = self.contexts_for(&inner, &inner.env.clone());
724 let mut outputs = BTreeMap::new();
725 if let Some(Value::Object(declared)) = action.get("outputs") {
726 for (name, spec) in declared {
727 if let Some(value) = spec.get("value") {
728 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
729 outputs.insert(name.clone(), expr::to_text(&value));
730 }
731 }
732 }
733 self.failed = was_failed;
734 return (ok, outputs);
735 }
736 if using == "docker" {
737 return self.docker_action(uses, dir, &runs, &inputs, &step_env, frame, title);
738 }
739 self.log.line(&format!("##[error]`{uses}` runs with `{using}`, which g1t does not know."));
740 (false, BTreeMap::new())
741 }
742
743 /// A Docker action: its image built from its Dockerfile (or pulled,
744 /// for `docker://`), then run with its `args`, `entrypoint` and `env`,
745 /// its inputs as `INPUT_` variables, and `pre-entrypoint` and
746 /// `post-entrypoint` around it.
747 #[allow(clippy::too_many_arguments)]
748 fn docker_action(
749 &mut self,
750 uses: &str,
751 dir: &Path,
752 runs: &Value,
753 inputs: &BTreeMap<String, String>,
754 step_env: &BTreeMap<String, String>,
755 frame: &Frame,
756 title: &str,
757 ) -> (bool, BTreeMap<String, String>) {
758 let image = runs.get("image").map(expr::to_text).unwrap_or_default();
759 let image = if let Some(pulled) = image.strip_prefix("docker://") {
760 pulled.to_owned()
761 } else if image.is_empty() {
762 self.log.line(&format!("##[error]`{uses}` has no `runs.image`."));
763 return (false, BTreeMap::new());
764 } else {
765 match self.build_action_image(dir, &image, uses) {
766 Some(tag) => tag,
767 None => return (false, BTreeMap::new()),
768 }
769 };
770 // `args` and `env` read with the action's own inputs.
771 let mut env = step_env.clone();
772 for (input, value) in inputs {
773 env.insert(format!("INPUT_{}", input.replace(' ', "_").to_ascii_uppercase()), value.clone());
774 }
775 let mut scope_frame = frame.clone();
776 scope_frame.inputs = Some(Value::Object(inputs.iter().map(|(k, v)| (k.clone(), json!(v))).collect()));
777 let contexts = self.contexts_for(&scope_frame, &env);
778 if let Some(Value::Object(own)) = runs.get("env") {
779 for (name, value) in own {
780 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
781 env.insert(name.clone(), expr::to_text(&value));
782 }
783 }
784 let args: Vec<String> = match runs.get("args") {
785 Some(Value::Array(items)) => items
786 .iter()
787 .map(|item| {
788 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(item, scope)).unwrap_or(Value::Null);
789 expr::to_text(&value)
790 })
791 .collect(),
792 _ => Vec::new(),
793 };
794 let entry = |key: &str| runs.get(key).map(expr::to_text).filter(|e| !e.is_empty());
795 if let Some(pre) = entry("pre-entrypoint") {
796 let run = DockerRun { image: image.clone(), entrypoint: Some(pre), args: Vec::new(), env: env.clone() };
797 if !self.run_docker(&run).0 {
798 return (false, BTreeMap::new());
799 }
800 }
801 let run = DockerRun { image: image.clone(), entrypoint: entry("entrypoint"), args, env: env.clone() };
802 let (ok, outputs, state) = self.run_docker(&run);
803 if let Some(post) = entry("post-entrypoint") {
804 let mut post_env = env;
805 for (name, value) in state {
806 post_env.insert(format!("STATE_{name}"), value);
807 }
808 self.posts.push(Post {
809 name: format!("Post {title}"),
810 condition: runs.get("post-if").map(expr::to_text).unwrap_or_else(|| "always()".into()),
811 env: BTreeMap::new(),
812 run: PostRun::Docker(DockerRun { image, entrypoint: Some(post), args: Vec::new(), env: post_env }),
813 });
814 }
815 (ok, outputs)
816 }
817}
818
819/// An action, read from its action.yml.
820pub(crate) struct Action {
821 pub(crate) dir: PathBuf,
822 /// `owner/repo`, or empty for one in the repository.
823 pub(crate) repository: String,
824 pub(crate) local: bool,
825 pub(crate) manifest: Value,
826}
827
828/// An action's `pre`, run before the job's first step.
829pub(crate) struct PreStep {
830 /// Its step's `GITHUB_ACTION`, by which the step finds the state it saved.
831 pub(crate) key: String,
832 /// `pre-if`, `always()` when it has none.
833 pub(crate) condition: String,
834 pub(crate) action_dir: PathBuf,
835 pub(crate) script: String,
836 pub(crate) using: String,
837 /// The `env` context its condition reads.
838 pub(crate) context_env: BTreeMap<String, String>,
839 /// What its process is given: the step's variables and inputs.
840 pub(crate) env: BTreeMap<String, String>,
841}
842
843impl Job {
844 /// Finds `uses` (fetching it when it is another repository's) and reads
845 /// its action.yml. A problem is told in the log.
846 fn resolve_action(&mut self, uses: &str) -> Option<Action> {
847 let (name, git_ref) = uses.split_once('@').unwrap_or((uses, ""));
848 let source = if let Some(local) = name.strip_prefix("./") {
849 // A repository moved from GitHub renamed `.github` to `.g1t`, but
850 // its workflows still say `./.github/actions/…`.
851 let mut dir = self.workspace.join(local);
852 if let Some(rest) = local.strip_prefix(".github/")
853 && !dir.exists()
854 {
855 dir = self.workspace.join(".g1t").join(rest);
856 }
857 Source::Local(dir)
858 } else {
859 let mut parts = name.splitn(3, '/');
860 let (Some(owner), Some(repo)) = (parts.next(), parts.next()) else {
861 self.log.line(&format!("##[error]`{uses}` is not an action: use owner/repo@ref, owner/repo/path@ref, or ./path."));
862 return None;
863 };
864 if git_ref.is_empty() {
865 self.log.line(&format!("##[error]`{uses}` needs a version, such as @v4."));
866 return None;
867 }
868 Source::GitHub {
869 owner: owner.to_owned(),
870 repo: repo.to_owned(),
871 path: parts.next().unwrap_or_default().to_owned(),
872 git_ref: git_ref.to_owned(),
873 }
874 };
875 let (dir, repository) = match &source {
876 Source::Local(dir) => (dir.clone(), String::new()),
877 Source::GitHub { owner, repo, path, git_ref } => {
878 let root = self.fetch_remote_action(owner, repo, git_ref)?;
879 (if path.is_empty() { root } else { root.join(path) }, format!("{owner}/{repo}"))
880 }
881 };
882 let Some(manifest) = ["action.yml", "action.yaml"].iter().map(|f| dir.join(f)).find(|p| p.exists()) else {
883 self.log.line(&format!("##[error]`{uses}` has no action.yml."));
884 return None;
885 };
886 let Some(yaml) = std::fs::read_to_string(&manifest).ok().and_then(|text| serde_yaml::from_str::<serde_yaml::Value>(&text).ok()) else {
887 self.log.line(&format!("##[error]`{uses}`: its action.yml does not read."));
888 return None;
889 };
890 Some(Action { dir, repository, local: matches!(source, Source::Local(_)), manifest: yaml_to_json(&yaml) })
891 }
892
893 /// An action's inputs: what the step gives, else the action's defaults,
894 /// read with `contexts`. With `warn`, inputs the action does not declare
895 /// are warned of, as GitHub's runner does.
896 fn action_inputs(&mut self, action: &Value, with: &BTreeMap<String, String>, contexts: &Map<String, Value>, warn: bool) -> BTreeMap<String, String> {
897 let mut inputs: BTreeMap<String, String> = BTreeMap::new();
898 let mut declared_names = Vec::new();
899 if let Some(Value::Object(declared)) = action.get("inputs") {
900 for (input, spec) in declared {
901 declared_names.push(input.clone());
902 let given = with.iter().find(|(k, _)| k.eq_ignore_ascii_case(input)).map(|(_, v)| v.clone());
903 let value = match given {
904 Some(value) => value,
905 None => match spec.get("default") {
906 Some(default) => {
907 let default = self.with_scope(contexts, |scope| expr::interpolate_value(default, scope)).unwrap_or(Value::Null);
908 expr::to_text(&default)
909 }
910 None => String::new(),
911 },
912 };
913 inputs.insert(input.clone(), value);
914 }
915 }
916 for (key, value) in with {
917 if !inputs.keys().any(|k| k.eq_ignore_ascii_case(key)) {
918 inputs.insert(key.clone(), value.clone());
919 }
920 }
921 let docker = action["runs"]["using"].as_str().is_some_and(|u| u.eq_ignore_ascii_case("docker"));
922 if warn && let Some(warning) = unexpected_inputs(&declared_names, &with.keys().cloned().collect::<Vec<_>>(), docker) {
923 self.log.line(&format!("##[warning]{warning}"));
924 }
925 inputs
926 }
927
928 /// The `pre`s of the job's steps, in step order, each with its step's
929 /// index: those of JavaScript actions from other repositories, fetched
930 /// now, as GitHub's runner fetches every action while it sets up the
931 /// job. An action in the repository is not there yet, so its `pre` is
932 /// not run, as on GitHub.
933 pub(crate) fn pre_steps(&mut self, steps: &[Map<String, Value>]) -> Vec<(usize, PreStep)> {
934 let frame = Frame::default();
935 let mut pres = Vec::new();
936 for (index, step) in steps.iter().enumerate() {
937 let Some(uses) = step.get("uses").map(|u| expr::to_text(u).trim().to_owned()) else { continue };
938 // Only another repository's action, which `prepare_actions` has
939 // already downloaded.
940 if remote_action(&uses, self.docker_hosted).is_none() {
941 continue;
942 }
943 let Some(found) = self.resolve_action(&uses) else { continue };
944 let runs = found.manifest.get("runs").cloned().unwrap_or(Value::Null);
945 let using = runs.get("using").map(expr::to_text).unwrap_or_default().to_ascii_lowercase();
946 let Some(script) = runs.get("pre").map(expr::to_text).filter(|_| using.starts_with("node")) else { continue };
947 let env_before = self.env_context(&frame);
948 let contexts = self.contexts_for(&frame, &env_before);
949 let with = self.step_with(step, &contexts);
950 let context_env = self.step_env(step, &contexts, env_before);
951 let contexts = self.contexts_for(&frame, &context_env);
952 let inputs = self.action_inputs(&found.manifest, &with, &contexts, false);
953 let key = step.get(super::ACTION_NAME).map(expr::to_text).unwrap_or_default();
954 let git_ref = uses.split_once('@').map_or("", |(_, r)| r);
955 let mut env = action_env(&context_env, &key, &found, git_ref);
956 for (input, value) in &inputs {
957 env.insert(format!("INPUT_{}", input.replace(' ', "_").to_ascii_uppercase()), value.clone());
958 }
959 let condition = runs.get("pre-if").map(expr::to_text).unwrap_or_else(|| "always()".into());
960 pres.push((index, PreStep { key, condition, action_dir: found.dir, script, using, context_env, env }));
961 }
962 pres
963 }
964
965 /// Whether a `pre`'s `pre-if` holds, read against the job's status.
966 pub(crate) fn pre_runs(&self, pre: &PreStep) -> bool {
967 let contexts = self.contexts_for(&Frame::default(), &pre.context_env);
968 self.with_scope(&contexts, |scope| expr::condition(&pre.condition, scope)).unwrap_or(true)
969 }
970
971 /// Runs a `pre`, keeping the state it saves for its step's main and post.
972 pub(crate) fn run_pre(&mut self, pre: &PreStep) -> bool {
973 let ok = self.run_node(&pre.action_dir, &pre.script, &pre.env, &pre.using);
974 let state = std::mem::take(&mut self.last_node_state);
975 self.last_node_outputs.clear();
976 self.pre_state.insert(pre.key.clone(), state);
977 ok
978 }
979}
980
981/// The variables a step running an action gets over its own: which
982/// action it is and where.
983fn action_env(env: &BTreeMap<String, String>, action_name: &str, action: &Action, git_ref: &str) -> BTreeMap<String, String> {
984 let mut step_env = env.clone();
985 step_env.insert("GITHUB_ACTION".into(), action_name.to_owned());
986 step_env.insert("GITHUB_ACTION_REPOSITORY".into(), action.repository.clone());
987 step_env.insert("GITHUB_ACTION_REF".into(), git_ref.to_owned());
988 step_env.insert("GITHUB_ACTION_PATH".into(), action.dir.display().to_string());
989 step_env
990}
991
992/// GitHub's warning for inputs a step gives that its action does not
993/// declare (a Docker action also takes `entryPoint` and `args`), if any.
994fn unexpected_inputs(declared: &[String], given: &[String], docker: bool) -> Option<String> {
995 let mut valid: Vec<String> = declared.to_vec();
996 if docker {
997 valid.extend(["entryPoint".to_owned(), "args".to_owned()]);
998 }
999 let unexpected: Vec<&str> = given.iter().filter(|g| !valid.iter().any(|v| v.eq_ignore_ascii_case(g))).map(String::as_str).collect();
1000 if unexpected.is_empty() {
1001 return None;
1002 }
1003 Some(format!("Unexpected input(s) '{}', valid inputs are ['{}']", unexpected.join("', '"), valid.join("', '")))
1004}
1005
1006/// The Node an action's `runs.using` asks for: for `node20` (or any
1007/// `nodeNN`), the binary `G1T_NODE20` names or `/opt/node20/bin/node`,
1008/// when there is one; otherwise, and for anything else, the `node` on
1009/// `PATH`, the runner's own (Node 24). Nothing is logged either way.
1010pub(crate) fn node_program(using: &str, var: impl Fn(&str) -> Option<String>, exists: impl Fn(&Path) -> bool) -> String {
1011 let using = using.trim().to_ascii_lowercase();
1012 let versioned = using.strip_prefix("node").is_some_and(|v| !v.is_empty() && v.chars().all(|c| c.is_ascii_digit()));
1013 if versioned {
1014 let named = var(&format!("G1T_{}", using.to_ascii_uppercase())).filter(|p| !p.is_empty() && exists(Path::new(p)));
1015 if let Some(path) = named {
1016 return path;
1017 }
1018 let standard = format!("/opt/{using}/bin/node");
1019 if exists(Path::new(&standard)) {
1020 return standard;
1021 }
1022 }
1023 "node".into()
1024}
1025
1026#[cfg(test)]
1027mod tests {
1028 use super::*;
1029
1030 #[test]
1031 fn the_actions_fetched_before_the_first_step_are_other_repositories() {
1032 let found = |uses: &str| remote_action(uses, true);
1033 assert_eq!(found("actions/setup-node@v4"), Some(("actions".into(), "setup-node".into(), "v4".into())));
1034 assert_eq!(found(" github/codeql-action/init@v3 "), Some(("github".into(), "codeql-action".into(), "v3".into())));
1035 // Done by the runner itself, local, an image, or no version.
1036 assert_eq!(found("actions/checkout@v4"), None);
1037 // actions/cache is the real action, fetched like any other.
1038 assert_eq!(found("Actions/Cache/Restore@v4"), Some(("Actions".into(), "Cache".into(), "v4".into())));
1039 assert_eq!(found("docker/setup-buildx-action@v3"), None);
1040 assert!(remote_action("docker/setup-buildx-action@v3", false).is_some());
1041 assert_eq!(found("./.g1t/actions/setup"), None);
1042 assert_eq!(found("docker://alpine:3"), None);
1043 assert_eq!(found("actions/setup-node"), None);
1044 assert_eq!(found("setup-node@v4"), None);
1045 }
1046
1047 #[test]
1048 fn a_checkout_fetches_what_actions_checkout_fetches() {
1049 let sha = "0123456789abcdef0123456789abcdef01234567";
1050 let specs = |plan: &CheckoutPlan| plan.refspecs.clone();
1051 // A push: the run's commit, as its branch.
1052 let push = checkout_plan(None, true, "refs/heads/main", sha);
1053 assert_eq!(specs(&push), [format!("+{sha}:refs/remotes/origin/main")]);
1054 assert_eq!((push.sha.as_deref(), push.branch.as_deref(), push.output_ref.as_str()), (Some(sha), Some("main"), "refs/heads/main"));
1055 // An unqualified branch from the event is qualified first.
1056 assert_eq!(checkout_plan(None, true, "main", sha).output_ref, "refs/heads/main");
1057 // A pull request: its commit under refs/remotes/pull, detached.
1058 let pull = checkout_plan(None, true, "refs/pull/7/merge", sha);
1059 assert_eq!(specs(&pull), [format!("+{sha}:refs/remotes/pull/7/merge")]);
1060 assert_eq!(pull.branch, None);
1061 // A tag push, and a deployment of a bare commit.
1062 assert_eq!(specs(&checkout_plan(None, true, "refs/tags/v1", sha)), [format!("+{sha}:refs/tags/v1")]);
1063 assert_eq!(specs(&checkout_plan(None, true, "", sha)), [sha]);
1064 // `ref:` a commit, a branch, a tag or a name that may be either.
1065 let by_sha = checkout_plan(Some(sha), true, "refs/heads/main", "ffff");
1066 assert_eq!((specs(&by_sha), by_sha.sha.as_deref(), by_sha.output_ref.as_str()), (vec![sha.to_owned()], Some(sha), ""));
1067 let branch = checkout_plan(Some("refs/heads/dev"), true, "refs/heads/main", sha);
1068 assert_eq!((specs(&branch), branch.sha, branch.branch.as_deref()), (vec!["+refs/heads/dev:refs/remotes/origin/dev".to_owned()], None, Some("dev")));
1069 let tag = checkout_plan(Some("refs/tags/v2"), true, "", "");
1070 assert_eq!((specs(&tag), tag.start.as_deref()), (vec!["+refs/tags/v2:refs/tags/v2".to_owned()], Some("refs/tags/v2")));
1071 let name = checkout_plan(Some("v2"), false, "", "");
1072 assert_eq!(specs(&name), ["+refs/heads/v2*:refs/remotes/origin/v2*", "+refs/tags/v2*:refs/tags/v2*"]);
1073 assert_eq!(name.unqualified.as_deref(), Some("v2"));
1074 // Another repository whose default branch is not known: its HEAD.
1075 assert_eq!(specs(&checkout_plan(None, false, "refs/heads/main", sha)), ["HEAD"]);
1076 }
1077
1078 /// Checks out repositories of its own over `file://`, where git is
1079 /// installed: the run's commit behind its branch's tip, all history,
1080 /// a tag and a branch by name, a sparse checkout, and another
1081 /// repository's default branch.
1082 #[test]
1083 fn a_checkout_ends_where_actions_checkout_ends() {
1084 let git = |dir: &Path, args: &[&str]| {
1085 let out = Command::new("git").current_dir(dir).args(args).output().expect("git");
1086 assert!(out.status.success(), "git {args:?}: {}", String::from_utf8_lossy(&out.stderr));
1087 String::from_utf8_lossy(&out.stdout).trim().to_owned()
1088 };
1089 if Command::new("git").arg("--version").output().is_err() {
1090 return;
1091 }
1092 let root = std::env::temp_dir().join(format!("g1t-checkout-test-{}", std::process::id()));
1093 let _ = std::fs::remove_dir_all(&root);
1094 let make = |name: &str, branch: &str| {
1095 let dir = root.join("src").join(name);
1096 std::fs::create_dir_all(&dir).unwrap();
1097 git(&dir, &["init", "--quiet", "-b", branch]);
1098 for (key, value) in [("user.name", "t"), ("user.email", "t@example.com"), ("commit.gpgsign", "false"), ("tag.gpgsign", "false")] {
1099 git(&dir, &["config", key, value]);
1100 }
1101 dir
1102 };
1103 let commit = |dir: &Path, file: &str, message: &str| {
1104 std::fs::create_dir_all(dir.join(file).parent().unwrap()).unwrap();
1105 std::fs::write(dir.join(file), message).unwrap();
1106 git(dir, &["add", "."]);
1107 git(dir, &["commit", "--quiet", "-m", message]);
1108 };
1109 let app = make("app", "main");
1110 commit(&app, "docs/a.md", "one");
1111 commit(&app, "src/main.rs", "two");
1112 git(&app, &["tag", "v1"]);
1113 git(&app, &["checkout", "--quiet", "-b", "feature"]);
1114 commit(&app, "feature.txt", "feature");
1115 git(&app, &["checkout", "--quiet", "main"]);
1116 commit(&app, "README.md", "three");
1117 let other = make("other", "trunk");
1118 commit(&other, "o.txt", "o");
1119 let served = root.join("srv").join("acme");
1120 std::fs::create_dir_all(&served).unwrap();
1121 for name in ["app", "other"] {
1122 let src = root.join("src").join(name);
1123 git(&served, &["clone", "--quiet", "--bare", &src.display().to_string(), &format!("{name}.git")]);
1124 git(&served.join(format!("{name}.git")), &["config", "uploadpack.allowFilter", "true"]);
1125 }
1126 let server = format!("file://{}", root.join("srv").display());
1127 let behind = git(&app, &["rev-parse", "main~1"]);
1128 let spec = json!({
1129 "checkout": { "repository": "acme/app", "url": format!("{server}/acme/app.git"), "ref": "refs/heads/main", "sha": behind, "token": "" },
1130 "github": { "server_url": server },
1131 "variables": {},
1132 "contexts": {},
1133 });
1134 let workspace = root.join("work");
1135 let mut job = super::super::setup_in(spec, super::super::report::Api::offline(), workspace.clone(), root.join("temp")).unwrap();
1136 let mut run = |inputs: &[(&str, &str)]| {
1137 let mut with: BTreeMap<String, String> = inputs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect();
1138 with.insert("set-safe-directory".into(), "false".into());
1139 job.checkout(&with)
1140 };
1141
1142 // A push whose branch moved on: the run's commit, on its branch.
1143 let (ok, outputs) = run(&[]);
1144 assert!(ok);
1145 assert_eq!((git(&workspace, &["rev-parse", "HEAD"]), git(&workspace, &["branch", "--show-current"])), (behind.clone(), "main".to_owned()));
1146 assert_eq!((outputs["ref"].as_str(), outputs["commit"].as_str()), ("refs/heads/main", behind.as_str()));
1147 // All history: every branch and tag.
1148 assert!(run(&[("fetch-depth", "0")]).0);
1149 assert!(!workspace.join(".git/shallow").exists());
1150 assert_eq!(git(&workspace, &["branch", "-r"]).split_whitespace().collect::<Vec<_>>(), ["origin/feature", "origin/main"]);
1151 assert_eq!(git(&workspace, &["tag"]), "v1");
1152 // A tag by name, detached; a branch by name, as the branch.
1153 assert!(run(&[("ref", "v1")]).0);
1154 assert_eq!((git(&workspace, &["describe", "--tags"]), git(&workspace, &["branch", "--show-current"])), ("v1".to_owned(), String::new()));
1155 assert!(run(&[("ref", "feature")]).0);
1156 assert_eq!(git(&workspace, &["branch", "--show-current"]), "feature");
1157 // Sparse: only the folders named, from a blobless fetch.
1158 assert!(run(&[("sparse-checkout", "docs\n")]).0);
1159 assert!(workspace.join("docs/a.md").exists() && !workspace.join("src").exists());
1160 assert_eq!(git(&workspace, &["config", "remote.origin.partialclonefilter"]), "blob:none");
1161 // Another repository without a ref: its default branch.
1162 let (ok, outputs) = run(&[("repository", "acme/other"), ("path", "other")]);
1163 assert!(ok);
1164 assert_eq!(git(&workspace.join("other"), &["branch", "--show-current"]), "trunk");
1165 assert_eq!(outputs["ref"], "refs/heads/trunk");
1166 let _ = std::fs::remove_dir_all(&root);
1167 }
1168
1169 #[test]
1170 fn unexpected_inputs_are_named_with_the_valid_ones() {
1171 let declared = vec!["token".to_owned(), "path".to_owned()];
1172 assert_eq!(unexpected_inputs(&declared, &["Token".into()], false), None);
1173 assert_eq!(
1174 unexpected_inputs(&declared, &["token".into(), "foo".into(), "bar".into()], false).as_deref(),
1175 Some("Unexpected input(s) 'foo', 'bar', valid inputs are ['token', 'path']")
1176 );
1177 assert_eq!(unexpected_inputs(&[], &["x".into()], false).as_deref(), Some("Unexpected input(s) 'x', valid inputs are ['']"));
1178 // A Docker action takes `entrypoint` and `args` too.
1179 assert_eq!(unexpected_inputs(&declared, &["entrypoint".into(), "args".into()], true), None);
1180 assert!(unexpected_inputs(&declared, &["args".into()], false).is_some());
1181 }
1182
1183 #[test]
1184 fn node20_runs_with_a_node20_where_there_is_one() {
1185 let none = |_: &str| None;
1186 assert_eq!(node_program("node20", none, |_| false), "node");
1187 assert_eq!(node_program("node20", none, |p| p == Path::new("/opt/node20/bin/node")), "/opt/node20/bin/node");
1188 let named = |name: &str| (name == "G1T_NODE20").then(|| "/usr/local/n20/bin/node".to_owned());
1189 assert_eq!(node_program("Node20", named, |_| true), "/usr/local/n20/bin/node");
1190 // A named Node that is not there is passed over.
1191 assert_eq!(node_program("node20", named, |p| p == Path::new("/opt/node20/bin/node")), "/opt/node20/bin/node");
1192 assert_eq!(node_program("node24", none, |_| false), "node");
1193 assert_eq!(node_program("composite", none, |_| true), "node");
1194 assert_eq!(node_program("node", none, |_| true), "node");
1195 }
1196}