Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
1,356 linesCodeBlameRaw
1//! Keeping runs safe: a repository's choices for its workflows (what a
2//! job's token may do when its workflow says nothing, and which pull
3//! requests' runs wait for approval), environments' protection rules, the
4//! reviews of the jobs they hold, and approving a pull request's run.
5//!
6//! - A job that names an environment with rules is `pending` once its needs
7//! are done: until a reviewer approves it (when the environment has
8//! reviewers), its wait timer has run out (when it has one), and only on
9//! a ref the environment lets deploy. Its secrets are read when it
10//! starts, so the environment's are never handed out before then. One
11//! review approves every job of the run attempt that names the
12//! environment.
13//! - A run of a pull request from outside the workspace may wait as
14//! `action_required` until someone with the Write role approves it, by
15//! the repository's approval policy.
16
17use g1t_actions::filter::Pattern;
18use g1t_actions::permissions::TokenDefault;
19use g1t_contracts::access::{self, AccessSource, Capability, CollaboratorPermissionArgs, PermissionInfo};
20use g1t_contracts::actions::{
21 APPROVAL_POLICIES, actions_enabled, ActionsSettings, ActionsSettingsArgs, SetWorkspaceActionsSettingsArgs, WorkspaceActionsSettings,
22 WorkspaceActionsSettingsArgs, BranchPattern, DeleteEnvironmentArgs, Environment, EnvironmentReviewer,
23 EnvironmentsArgs, MAX_ENVIRONMENT_REVIEWERS, MAX_WAIT_MINUTES, PendingDeployment, PendingDeploymentsArgs, ReviewDeploymentsArgs,
24 RunActionArgs, RunApproval, SetActionsSettingsArgs, SetEnvironmentArgs, WorkflowRun,
25};
26use g1t_contracts::repos::{Repo, RepoPath};
27use g1t_contracts::time::rfc3339;
28use g1t_contracts::{FailureCode, Outcome, PrincipalKind, User, Viewer};
29use g1t_kit::now_ms;
30use serde::Deserialize;
31use serde_json::{Value, json};
32use worker::Result;
33
34use crate::plan::{JobRow, RunRow};
35use crate::{Actions, check, fail, optional};
36
37/// What the approval policy is when a repository chose none.
38pub const DEFAULT_APPROVAL_POLICY: &str = "outside_contributors";
39
40fn now() -> String {
41 rfc3339(now_ms())
42}
43
44/// A repository's own choices (migrations 0006 and 0007); null is unchosen.
45#[derive(Default, Deserialize)]
46struct SettingsRow {
47 default_permissions: Option<String>,
48 approval_policy: Option<String>,
49 can_approve_pulls: Option<u32>,
50 /// Migration 0008: who may use its actions and reusable workflows.
51 #[serde(default)]
52 access_level: Option<String>,
53 /// Migration 0023: whether its workflows run at all.
54 #[serde(default)]
55 enabled: Option<u32>,
56}
57
58#[derive(Deserialize)]
59struct WorkspaceRow {
60 default_permissions: String,
61 max_permissions: String,
62 can_approve_pulls: u32,
63}
64
65/// What a workflow without `permissions:` gets: the repository's choice,
66/// else `write` for a repository made before restricted tokens
67/// (`grandfathered`), else its workspace's default; never more than the
68/// workspace's maximum.
69pub(crate) fn effective_default(chosen: Option<TokenDefault>, grandfathered: bool, workspace_default: TokenDefault, maximum: TokenDefault) -> TokenDefault {
70 let wanted = chosen.unwrap_or(if grandfathered { TokenDefault::Permissive } else { workspace_default });
71 if maximum == TokenDefault::Restricted { TokenDefault::Restricted } else { wanted }
72}
73
74/// The workspace's policy, or its defaults.
75fn workspace_policy(row: Option<WorkspaceRow>) -> WorkspaceActionsSettings {
76 match row {
77 Some(row) => WorkspaceActionsSettings {
78 default_permissions: row.default_permissions,
79 max_permissions: row.max_permissions,
80 can_approve_pull_requests: row.can_approve_pulls != 0,
81 },
82 None => WorkspaceActionsSettings {
83 default_permissions: TokenDefault::Restricted.as_str().to_owned(),
84 max_permissions: TokenDefault::Permissive.as_str().to_owned(),
85 can_approve_pull_requests: false,
86 },
87 }
88}
89
90#[derive(Clone, Deserialize)]
91struct EnvRow {
92 name: String,
93 reviewers: String,
94 prevent_self_review: u32,
95 wait_minutes: u32,
96 branch_policy: String,
97 branch_patterns: String,
98 admins_bypass: u32,
99 updated_at: String,
100 updated_by: Option<String>,
101}
102
103impl EnvRow {
104 fn view(&self) -> Environment {
105 Environment {
106 name: self.name.clone(),
107 reviewers: serde_json::from_str(&self.reviewers).unwrap_or_default(),
108 prevent_self_review: self.prevent_self_review != 0,
109 wait_minutes: self.wait_minutes,
110 branch_policy: self.branch_policy.clone(),
111 branch_patterns: serde_json::from_str(&self.branch_patterns).unwrap_or_default(),
112 admins_bypass: self.admins_bypass != 0,
113 protected: true,
114 updated_at: Some(self.updated_at.clone()),
115 updated_by: self.updated_by.clone(),
116 }
117 }
118}
119
120/// An environment no rules hold.
121fn unprotected(name: &str) -> Environment {
122 Environment {
123 name: name.to_owned(),
124 reviewers: Vec::new(),
125 prevent_self_review: false,
126 wait_minutes: 0,
127 branch_policy: "all".to_owned(),
128 branch_patterns: Vec::new(),
129 admins_bypass: true,
130 protected: false,
131 updated_at: None,
132 updated_by: None,
133 }
134}
135
136#[derive(Clone, Deserialize)]
137struct GateRow {
138 environment: String,
139 state: String,
140 needs_review: u32,
141 wait_until: Option<String>,
142 reviewed_by: Option<String>,
143 comment: Option<String>,
144 reviewed_at: Option<String>,
145}
146
147/// An environment's name as rules and secrets keep it: lowercase, up to 40
148/// letters, digits, `-` and `_`.
149pub(crate) fn environment_name(name: &str) -> std::result::Result<String, String> {
150 let lower = name.trim().to_ascii_lowercase();
151 if lower.is_empty() || lower.len() > 40 || !lower.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') {
152 return Err(format!("`{}` is not an environment's name: up to 40 letters, digits, - and _.", name.trim()));
153 }
154 Ok(lower)
155}
156
157/// Whether `git_ref` may deploy to an environment by its `policy`.
158/// `protected` says whether the branch is protected, for `protected`.
159pub(crate) fn branch_allowed(policy: &str, patterns: &[BranchPattern], git_ref: &str, protected: bool, environment: &str) -> std::result::Result<(), String> {
160 let (kind, name) = match (git_ref.strip_prefix("refs/heads/"), git_ref.strip_prefix("refs/tags/")) {
161 (Some(branch), _) => ("branch", branch),
162 (_, Some(tag)) => ("tag", tag),
163 _ => ("ref", git_ref),
164 };
165 match policy {
166 "protected" if kind == "branch" && protected => Ok(()),
167 "protected" => Err(format!("{environment} takes deployments from protected branches only, and `{name}` is not one.")),
168 "selected" => {
169 let allowed = patterns
170 .iter()
171 .filter(|pattern| pattern.kind == kind)
172 .any(|pattern| Pattern::parse(&pattern.name).matches(name));
173 if allowed {
174 Ok(())
175 } else {
176 Err(format!("The {kind} `{name}` may not deploy to {environment}: its deployment rules list the branches and tags that may."))
177 }
178 }
179 _ => Ok(()),
180 }
181}
182
183/// How someone may decide on an environment's jobs.
184#[derive(Clone, Copy, Debug, PartialEq, Eq)]
185pub(crate) enum Reviewer {
186 /// One of its reviewers.
187 Listed,
188 /// An admin, past its rules, which also skips its wait timer.
189 AdminBypass,
190}
191
192/// Whether `username` (in `teams`, an admin or not) may approve or reject
193/// the environment's jobs in a run `started_by` began.
194pub(crate) fn may_review(
195 environment: &Environment,
196 username: &str,
197 teams: &[String],
198 admin: bool,
199 started_by: Option<&str>,
200) -> std::result::Result<Reviewer, String> {
201 let listed = environment.reviewers.iter().any(|reviewer| match reviewer.kind.as_str() {
202 "team" => teams.iter().any(|team| team.eq_ignore_ascii_case(&reviewer.name)),
203 _ => reviewer.name.eq_ignore_ascii_case(username),
204 });
205 let started = started_by.is_some_and(|by| by.eq_ignore_ascii_case(username));
206 if listed && !(environment.prevent_self_review && started) {
207 return Ok(Reviewer::Listed);
208 }
209 if admin && environment.admins_bypass {
210 return Ok(Reviewer::AdminBypass);
211 }
212 Err(if listed {
213 format!("You started this run, and {} does not let whoever started a run approve its deployments.", environment.name)
214 } else if environment.reviewers.is_empty() {
215 format!("{} has no reviewers: its jobs wait for its timer. Only an admin can start them sooner.", environment.name)
216 } else {
217 format!("You are not one of {}'s reviewers.", environment.name)
218 })
219}
220
221/// Whether a gate lets its jobs start at `now`.
222pub(crate) fn gate_open(state: &str, needs_review: bool, wait_until: Option<&str>, now: &str) -> bool {
223 state != "rejected" && (!needs_review || state == "approved") && wait_until.is_none_or(|until| until <= now)
224}
225
226/// Why a pull request's run waits for approval, if it does, by `policy`:
227/// `member` of the workspace, whether they `can_push`, and whether this is
228/// their `first_time` (no pull request of theirs merged here).
229pub(crate) fn approval_reason(policy: &str, member: bool, can_push: bool, first_time: bool) -> Option<&'static str> {
230 if member {
231 return None;
232 }
233 match policy {
234 "all_external_contributors" => Some("is not a member of the workspace"),
235 "first_time_contributors" => first_time.then_some("has not had a pull request merged here yet"),
236 _ if !can_push => Some("cannot push to the repository"),
237 _ => first_time.then_some("has not had a pull request merged here yet"),
238 }
239}
240
241/// What a job waits for at its environment, in words.
242fn held_reason(environment: &str, needs_review: bool, wait_until: Option<&str>) -> String {
243 match (needs_review, wait_until) {
244 (true, Some(until)) => format!("Waiting for a review to deploy to {environment}, and for its wait timer, until {until}."),
245 (true, None) => format!("Waiting for a review to deploy to {environment}."),
246 (false, Some(until)) => format!("Waiting for {environment}'s wait timer, until {until}."),
247 (false, None) => format!("Waiting to deploy to {environment}."),
248 }
249}
250
251/// What an environment's rules say about a job that names it.
252pub(crate) enum Gate {
253 /// No rules hold it: it starts.
254 Open,
255 /// It waits, for this.
256 Held(String),
257 /// It may not deploy there.
258 Refused(String),
259}
260
261impl Actions {
262 // --- The repository's and workspace's choices -------------------------------
263
264 async fn repo_choices(&self, repo_id: &str) -> Result<SettingsRow> {
265 Ok(self
266 .db
267 .prepare("SELECT default_permissions, approval_policy, can_approve_pulls, access_level, enabled FROM repo_settings WHERE repo_id = ?")
268 .bind(&[repo_id.into()])?
269 .first::<SettingsRow>(None)
270 .await?
271 .unwrap_or_default())
272 }
273
274 /// A workspace's policy for its repositories' tokens, or the defaults.
275 pub(crate) async fn workspace_settings(&self, workspace: &str) -> Result<WorkspaceActionsSettings> {
276 let row = self
277 .db
278 .prepare("SELECT default_permissions, max_permissions, can_approve_pulls FROM workspace_actions_settings WHERE namespace = ?")
279 .bind(&[workspace.to_lowercase().into()])?
280 .first::<WorkspaceRow>(None)
281 .await?;
282 Ok(workspace_policy(row))
283 }
284
285 /// Whether `repo` was made before restricted tokens began, and so keeps
286 /// read and write until someone chooses otherwise.
287 async fn grandfathered(&self, repo: &Repo) -> Result<bool> {
288 #[derive(Deserialize)]
289 struct Since {
290 value: String,
291 }
292 let since = self
293 .db
294 .prepare("SELECT value FROM actions_meta WHERE key = 'restricted_since'")
295 .first::<Since>(None)
296 .await?;
297 Ok(since.is_some_and(|since| !repo.created_at.is_empty() && repo.created_at.as_str() < since.value.as_str()))
298 }
299
300 /// A repository's settings as they hold, its workspace's taken in.
301 pub(crate) async fn repo_settings(&self, repo: &Repo) -> Result<ActionsSettings> {
302 let row = self.repo_choices(&repo.id).await?;
303 let workspace = self.workspace_settings(&repo.namespace).await?;
304 let chosen = row.default_permissions.as_deref().and_then(TokenDefault::parse);
305 let default = effective_default(
306 chosen,
307 self.grandfathered(repo).await?,
308 TokenDefault::parse(&workspace.default_permissions).unwrap_or_default(),
309 TokenDefault::parse(&workspace.max_permissions).unwrap_or(TokenDefault::Permissive),
310 );
311 Ok(ActionsSettings {
312 default_permissions: default.as_str().to_owned(),
313 default_chosen: chosen.is_some(),
314 max_permissions: workspace.max_permissions.clone(),
315 approval_policy: row.approval_policy.unwrap_or_else(|| DEFAULT_APPROVAL_POLICY.to_owned()),
316 can_approve_pull_requests: workspace.can_approve_pull_requests && row.can_approve_pulls == Some(1),
317 workspace_allows_pull_requests: workspace.can_approve_pull_requests,
318 access_level: row.access_level.as_deref().and_then(g1t_contracts::actions::access_level).unwrap_or("none").to_owned(),
319 enabled: actions_enabled(row.enabled.map(|on| on == 1), repo.forked_from.is_some()),
320 enabled_chosen: row.enabled.is_some(),
321 })
322 }
323
324 /// Whether `repo`'s workflows run at all: as chosen, else on, and off
325 /// for a fork. Nothing starts a run while they are off.
326 pub(crate) async fn actions_on(&self, repo: &Repo) -> Result<bool> {
327 #[derive(Deserialize)]
328 struct Enabled {
329 enabled: Option<u32>,
330 }
331 let row = self
332 .db
333 .prepare("SELECT enabled FROM repo_settings WHERE repo_id = ?")
334 .bind(&[repo.id.as_str().into()])?
335 .first::<Enabled>(None)
336 .await?;
337 Ok(actions_enabled(row.and_then(|row| row.enabled).map(|on| on == 1), repo.forked_from.is_some()))
338 }
339
340 /// What a workflow without `permissions:` gets in the repository, and
341 /// whether its jobs may open and approve pull requests.
342 pub(crate) async fn token_policy(&self, repo_id: &str) -> Result<(TokenDefault, bool)> {
343 let Some((repo, _)) = self.repo_by_id(repo_id).await? else {
344 return Ok((TokenDefault::Restricted, false));
345 };
346 let settings = self.repo_settings(&repo).await?;
347 Ok((TokenDefault::parse(&settings.default_permissions).unwrap_or_default(), settings.can_approve_pull_requests))
348 }
349
350 /// The approval policy of a repository.
351 pub(crate) async fn approval_policy(&self, repo_id: &str) -> Result<String> {
352 Ok(self.repo_choices(repo_id).await?.approval_policy.unwrap_or_else(|| DEFAULT_APPROVAL_POLICY.to_owned()))
353 }
354
355 /// Who may use a repository's actions and reusable workflows when it is
356 /// private: `none` or `organization`.
357 pub(crate) async fn access_level_of(&self, repo_id: &str) -> Result<&'static str> {
358 Ok(self.repo_choices(repo_id).await?.access_level.as_deref().and_then(g1t_contracts::actions::access_level).unwrap_or("none"))
359 }
360
361 pub async fn actions_settings(&self, a: ActionsSettingsArgs) -> Result<Outcome<ActionsSettings>> {
362 let Some(repo) = self.visible_repo(&a.repo, &a.viewer).await? else {
363 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
364 };
365 Ok(Outcome::Ok(self.repo_settings(&repo).await?))
366 }
367
368 pub async fn set_actions_settings(&self, a: SetActionsSettingsArgs) -> Result<Outcome<ActionsSettings>> {
369 if let Some(refused) = refuse_job_token(&a.actor) {
370 return Ok(refused);
371 }
372 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
373 let mut row = self.repo_choices(&repo.id).await?;
374 let workspace = self.workspace_settings(&repo.namespace).await?;
375 if let Some(default) = a.default_permissions.as_deref().map(str::trim) {
376 row.default_permissions = match default {
377 "inherit" | "" => None,
378 other => match TokenDefault::parse(other) {
379 Some(TokenDefault::Permissive) if workspace.max_permissions == "read" => {
380 return Ok(fail(
381 FailureCode::Forbidden,
382 format!("{} holds its repositories' tokens to read-only: an owner can change that in the workspace's Actions settings.", repo.namespace),
383 ));
384 }
385 Some(parsed) => Some(parsed.as_str().to_owned()),
386 None => return Ok(fail(FailureCode::Invalid, "default_permissions is read, write or inherit.")),
387 },
388 };
389 }
390 if let Some(policy) = &a.approval_policy {
391 let policy = policy.trim();
392 if !APPROVAL_POLICIES.contains(&policy) {
393 return Ok(fail(FailureCode::Invalid, format!("approval_policy is one of {}.", APPROVAL_POLICIES.join(", "))));
394 }
395 row.approval_policy = Some(policy.to_owned());
396 }
397 if let Some(allow) = a.can_approve_pull_requests {
398 if allow && !workspace.can_approve_pull_requests {
399 return Ok(fail(
400 FailureCode::Forbidden,
401 format!("{} does not let its repositories' jobs open or approve pull requests: an owner can allow it in the workspace's Actions settings.", repo.namespace),
402 ));
403 }
404 row.can_approve_pulls = Some(u32::from(allow));
405 }
406 if let Some(level) = &a.access_level {
407 match g1t_contracts::actions::access_level(level) {
408 Some(level) => row.access_level = Some(level.to_owned()),
409 None => return Ok(fail(FailureCode::Invalid, "access_level is none or organization.")),
410 }
411 }
412 if let Some(on) = a.enabled {
413 row.enabled = Some(u32::from(on));
414 }
415 // 0006's artifact retention is kept, or its default for a new row.
416 self.db
417 .prepare(
418 "INSERT INTO repo_settings (repo_id, artifact_retention_days, default_permissions, approval_policy, can_approve_pulls, access_level, enabled, updated_at, updated_by)
419 VALUES (?1, ?7, ?2, ?3, ?4, ?8, ?9, ?5, ?6)
420 ON CONFLICT (repo_id) DO UPDATE SET default_permissions = ?2, approval_policy = ?3, can_approve_pulls = ?4,
421 access_level = ?8, enabled = ?9, updated_at = ?5, updated_by = ?6",
422 )
423 .bind(&[
424 repo.id.as_str().into(),
425 optional(row.default_permissions.as_deref()),
426 optional(row.approval_policy.as_deref()),
427 row.can_approve_pulls.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
428 now().into(),
429 a.actor.username.as_str().into(),
430 g1t_contracts::actions::ARTIFACT_RETENTION_DEFAULT_DAYS.into(),
431 optional(row.access_level.as_deref()),
432 row.enabled.map_or(worker::wasm_bindgen::JsValue::NULL, Into::into),
433 ])?
434 .run()
435 .await?;
436 Ok(Outcome::Ok(self.repo_settings(&repo).await?))
437 }
438
439 pub async fn workspace_actions_settings(&self, a: WorkspaceActionsSettingsArgs) -> Result<Outcome<WorkspaceActionsSettings>> {
440 let workspace = a.workspace.trim().to_lowercase();
441 if !a.viewer.as_ref().is_some_and(|viewer| viewer.is_member(&workspace)) {
442 return Ok(fail(FailureCode::NotFound, "There is no such workspace."));
443 }
444 Ok(Outcome::Ok(self.workspace_settings(&workspace).await?))
445 }
446
447 pub async fn set_workspace_actions_settings(&self, a: SetWorkspaceActionsSettingsArgs) -> Result<Outcome<WorkspaceActionsSettings>> {
448 if let Some(refused) = refuse_job_token(&a.actor) {
449 return Ok(refused);
450 }
451 let workspace = a.workspace.trim().to_lowercase();
452 if a.actor.kind != PrincipalKind::User || a.actor.role_in(&workspace) != Some(g1t_contracts::Role::Owner) {
453 return Ok(fail(FailureCode::Forbidden, format!("Only an owner of {workspace} can change its Actions settings.")));
454 }
455 let mut settings = self.workspace_settings(&workspace).await?;
456 let level = |text: &str, field: &str| -> std::result::Result<String, String> {
457 TokenDefault::parse(text.trim()).map(|parsed| parsed.as_str().to_owned()).ok_or_else(|| format!("{field} is read or write."))
458 };
459 if let Some(text) = &a.default_permissions {
460 match level(text, "default_permissions") {
461 Ok(parsed) => settings.default_permissions = parsed,
462 Err(problem) => return Ok(fail(FailureCode::Invalid, problem)),
463 }
464 }
465 if let Some(text) = &a.max_permissions {
466 match level(text, "max_permissions") {
467 Ok(parsed) => settings.max_permissions = parsed,
468 Err(problem) => return Ok(fail(FailureCode::Invalid, problem)),
469 }
470 }
471 if settings.max_permissions == "read" {
472 settings.default_permissions = "read".to_owned();
473 }
474 if let Some(allow) = a.can_approve_pull_requests {
475 settings.can_approve_pull_requests = allow;
476 }
477 self.db
478 .prepare(
479 "INSERT INTO workspace_actions_settings (namespace, default_permissions, max_permissions, can_approve_pulls, updated_at, updated_by)
480 VALUES (?1, ?2, ?3, ?4, ?5, ?6)
481 ON CONFLICT (namespace) DO UPDATE SET default_permissions = ?2, max_permissions = ?3, can_approve_pulls = ?4,
482 updated_at = ?5, updated_by = ?6",
483 )
484 .bind(&[
485 workspace.as_str().into(),
486 settings.default_permissions.as_str().into(),
487 settings.max_permissions.as_str().into(),
488 u32::from(settings.can_approve_pull_requests).into(),
489 now().into(),
490 a.actor.username.as_str().into(),
491 ])?
492 .run()
493 .await?;
494 Ok(Outcome::Ok(settings))
495 }
496
497 // --- Environments -------------------------------------------------------------
498
499 async fn environment_row(&self, repo_id: &str, name: &str) -> Result<Option<EnvRow>> {
500 self.db
501 .prepare("SELECT * FROM environments WHERE repo_id = ? AND name = ?")
502 .bind(&[repo_id.into(), name.to_ascii_lowercase().into()])?
503 .first::<EnvRow>(None)
504 .await
505 }
506
507 /// An environment and its rules; one without rules if it has none.
508 pub(crate) async fn environment_rules(&self, repo_id: &str, name: &str) -> Result<Environment> {
509 Ok(match self.environment_row(repo_id, name).await? {
510 Some(row) => row.view(),
511 None => unprotected(&name.to_ascii_lowercase()),
512 })
513 }
514
515 /// `environments`: every environment the repository's rules, secrets,
516 /// workflows or jobs name; or with `name`, the one.
517 pub async fn environments(&self, a: EnvironmentsArgs) -> Result<Outcome<Vec<Environment>>> {
518 let Some(repo) = self.visible_repo(&a.repo, &a.viewer).await? else {
519 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
520 };
521 if let Some(name) = &a.name {
522 let name = check!(environment_name(name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
523 return Ok(Outcome::Ok(vec![self.environment_rules(&repo.id, &name).await?]));
524 }
525 Ok(Outcome::Ok(self.environment_list(&repo.id).await?))
526 }
527
528 /// Every environment a repository has: those with rules, and those its
529 /// secrets, workflows or jobs name. Protected ones first.
530 pub(crate) async fn environment_list(&self, repo_id: &str) -> Result<Vec<Environment>> {
531 let rows = self
532 .db
533 .prepare("SELECT * FROM environments WHERE repo_id = ? ORDER BY name")
534 .bind(&[repo_id.into()])?
535 .all()
536 .await?
537 .results::<EnvRow>()?;
538 let mut out: Vec<Environment> = rows.iter().map(EnvRow::view).collect();
539 let mut named: Vec<String> = self.secret_environments(repo_id).await?;
540 #[derive(Deserialize)]
541 struct Named {
542 environment: String,
543 }
544 let used = self
545 .db
546 .prepare("SELECT DISTINCT environment FROM jobs WHERE repo_id = ? AND environment IS NOT NULL LIMIT 100")
547 .bind(&[repo_id.into()])?
548 .all()
549 .await?
550 .results::<Named>()?;
551 named.extend(used.into_iter().map(|n| n.environment));
552 #[derive(Deserialize)]
553 struct Source {
554 source: String,
555 }
556 let sources = self
557 .db
558 .prepare("SELECT source FROM workflows WHERE repo_id = ? AND error IS NULL")
559 .bind(&[repo_id.into()])?
560 .all()
561 .await?
562 .results::<Source>()?;
563 for source in sources {
564 let Ok(workflow) = g1t_actions::workflow::parse(&source.source) else { continue };
565 for job in &workflow.jobs {
566 let written = match job.raw.get("environment") {
567 Some(Value::String(name)) => Some(name.clone()),
568 Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).map(str::to_owned),
569 _ => None,
570 };
571 if let Some(name) = written.filter(|name| !name.contains("${{")) {
572 named.push(name);
573 }
574 }
575 }
576 for name in named {
577 if let Ok(name) = environment_name(&name)
578 && !out.iter().any(|env| env.name == name)
579 {
580 out.push(unprotected(&name));
581 }
582 }
583 out.sort_by(|a, b| b.protected.cmp(&a.protected).then(a.name.cmp(&b.name)));
584 Ok(out)
585 }
586
587 pub async fn set_environment(&self, a: SetEnvironmentArgs) -> Result<Outcome<Environment>> {
588 if let Some(refused) = refuse_job_token(&a.actor) {
589 return Ok(refused);
590 }
591 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
592 let name = check!(environment_name(&a.name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
593 let mut env = self.environment_rules(&repo.id, &name).await?;
594 if let Some(reviewers) = a.reviewers {
595 let reviewers = check!(self.valid_reviewers(&repo, reviewers).await?);
596 env.reviewers = reviewers;
597 }
598 if let Some(flag) = a.prevent_self_review {
599 env.prevent_self_review = flag;
600 }
601 if let Some(minutes) = a.wait_minutes {
602 if minutes > MAX_WAIT_MINUTES {
603 return Ok(fail(FailureCode::Invalid, format!("A wait timer is at most {MAX_WAIT_MINUTES} minutes (30 days).")));
604 }
605 env.wait_minutes = minutes;
606 }
607 if let Some(policy) = a.branch_policy {
608 let policy = policy.trim().to_owned();
609 if !["all", "protected", "selected"].contains(&policy.as_str()) {
610 return Ok(fail(FailureCode::Invalid, "branch_policy is all, protected or selected."));
611 }
612 env.branch_policy = policy;
613 }
614 if let Some(patterns) = a.branch_patterns {
615 let mut clean: Vec<BranchPattern> = Vec::new();
616 for pattern in patterns {
617 let name = pattern.name.trim().to_owned();
618 let kind = pattern.kind.trim().to_ascii_lowercase();
619 if name.is_empty() || name.len() > 255 {
620 return Ok(fail(FailureCode::Invalid, "A branch or tag pattern is 1 to 255 characters."));
621 }
622 if kind != "branch" && kind != "tag" {
623 return Ok(fail(FailureCode::Invalid, format!("`{name}`: a pattern's type is branch or tag.")));
624 }
625 if !clean.iter().any(|known| known.name == name && known.kind == kind) {
626 clean.push(BranchPattern { name, kind });
627 }
628 }
629 if clean.len() > 50 {
630 return Ok(fail(FailureCode::Invalid, "An environment lists at most 50 branch and tag patterns."));
631 }
632 env.branch_patterns = clean;
633 }
634 if let Some(flag) = a.admins_bypass {
635 env.admins_bypass = flag;
636 }
637 let at = now();
638 self.db
639 .prepare(
640 "INSERT INTO environments (repo_id, name, reviewers, prevent_self_review, wait_minutes, branch_policy, branch_patterns,
641 admins_bypass, created_at, updated_at, updated_by)
642 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?9, ?10)
643 ON CONFLICT (repo_id, name) DO UPDATE SET reviewers = ?3, prevent_self_review = ?4, wait_minutes = ?5,
644 branch_policy = ?6, branch_patterns = ?7, admins_bypass = ?8, updated_at = ?9, updated_by = ?10",
645 )
646 .bind(&[
647 repo.id.as_str().into(),
648 name.as_str().into(),
649 serde_json::to_string(&env.reviewers)?.into(),
650 u32::from(env.prevent_self_review).into(),
651 env.wait_minutes.into(),
652 env.branch_policy.as_str().into(),
653 serde_json::to_string(&env.branch_patterns)?.into(),
654 u32::from(env.admins_bypass).into(),
655 at.as_str().into(),
656 a.actor.username.as_str().into(),
657 ])?
658 .run()
659 .await?;
660 Ok(Outcome::Ok(self.environment_rules(&repo.id, &name).await?))
661 }
662
663 pub async fn delete_environment(&self, a: DeleteEnvironmentArgs) -> Result<Outcome<bool>> {
664 if let Some(refused) = refuse_job_token(&a.actor) {
665 return Ok(refused);
666 }
667 let repo = check!(self.may(&a.actor, &a.repo, Capability::ManageIntegrations).await?);
668 let name = check!(environment_name(&a.name).map_or_else(|problem| fail(FailureCode::Invalid, problem), Outcome::Ok));
669 let removed = self
670 .db
671 .prepare("DELETE FROM environments WHERE repo_id = ? AND name = ? RETURNING name")
672 .bind(&[repo.id.as_str().into(), name.as_str().into()])?
673 .first::<Value>(None)
674 .await?;
675 if removed.is_none() {
676 return Ok(fail(FailureCode::NotFound, format!("{name} has no protection rules.")));
677 }
678 Ok(Outcome::Ok(true))
679 }
680
681 /// Reviewers as given, checked: at most six, each a person with access
682 /// to the repository or a team of its workspace.
683 async fn valid_reviewers(&self, repo: &Repo, given: Vec<EnvironmentReviewer>) -> Result<Outcome<Vec<EnvironmentReviewer>>> {
684 if given.len() > MAX_ENVIRONMENT_REVIEWERS {
685 return Ok(fail(FailureCode::Invalid, format!("An environment has at most {MAX_ENVIRONMENT_REVIEWERS} reviewers.")));
686 }
687 let Some(ws) = self.workspace_actor(&repo.namespace).await? else {
688 return Ok(fail(FailureCode::NotFound, "There is no such workspace."));
689 };
690 let mut out: Vec<EnvironmentReviewer> = Vec::new();
691 for reviewer in given {
692 let kind = reviewer.kind.trim().to_ascii_lowercase();
693 let name = reviewer.name.trim().trim_start_matches('@').to_ascii_lowercase();
694 match kind.as_str() {
695 "user" => {
696 let permission: Outcome<PermissionInfo> = g1t_kit::call(
697 &self.identity,
698 "collaborator_permission",
699 &CollaboratorPermissionArgs {
700 viewer: Some(ws.clone()),
701 path: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
702 username: name.clone(),
703 },
704 )
705 .await?;
706 if !permission.into_result().ok().is_some_and(|info| info.role.is_some()) {
707 return Ok(fail(FailureCode::Invalid, format!("{name} has no access to {}/{}, so cannot review.", repo.namespace, repo.name)));
708 }
709 }
710 "team" => {
711 let slug = name.rsplit('/').next().unwrap_or(&name).to_owned();
712 if self.team_people(&repo.namespace, &slug).await?.is_none() {
713 return Ok(fail(FailureCode::Invalid, format!("{} has no team called {slug}.", repo.namespace)));
714 }
715 if !out.iter().any(|known| known.kind == "team" && known.name == slug) {
716 out.push(EnvironmentReviewer { kind, name: slug });
717 }
718 continue;
719 }
720 _ => return Ok(fail(FailureCode::Invalid, "A reviewer's type is user or team.")),
721 }
722 if !out.iter().any(|known| known.kind == kind && known.name == name) {
723 out.push(EnvironmentReviewer { kind, name });
724 }
725 }
726 Ok(Outcome::Ok(out))
727 }
728
729 /// Everyone in a team of `workspace` and its child teams, by username;
730 /// `None` when there is no such team.
731 async fn team_people(&self, workspace: &str, slug: &str) -> Result<Option<Vec<String>>> {
732 let resolved: Vec<Value> = g1t_kit::call(
733 &self.identity,
734 "resolve_teams",
735 &json!({ "teams": [format!("{workspace}/{slug}")] }),
736 )
737 .await
738 .unwrap_or_default();
739 Ok(resolved.into_iter().next().map(|team| {
740 ["members", "child_members"]
741 .iter()
742 .flat_map(|key| team[*key].as_array().cloned().unwrap_or_default())
743 .filter_map(|person| person["username"].as_str().map(str::to_lowercase))
744 .collect()
745 }))
746 }
747
748 /// The teams of the environment's reviewers that `username` is in.
749 async fn reviewer_teams(&self, workspace: &str, environment: &Environment, username: &str) -> Result<Vec<String>> {
750 let mut teams = Vec::new();
751 for reviewer in environment.reviewers.iter().filter(|r| r.kind == "team") {
752 if self
753 .team_people(workspace, &reviewer.name)
754 .await?
755 .is_some_and(|people| people.iter().any(|person| person.eq_ignore_ascii_case(username)))
756 {
757 teams.push(reviewer.name.clone());
758 }
759 }
760 Ok(teams)
761 }
762
763 // --- Gates ---------------------------------------------------------------------
764
765 /// What `environment`'s rules say about a job of `run` that names it,
766 /// recording the run's gate there the first time one of its jobs
767 /// reaches it.
768 pub(crate) async fn gate(&self, run: &RunRow, environment: &str) -> Result<Gate> {
769 let Ok(name) = environment_name(environment) else {
770 return Ok(Gate::Open);
771 };
772 let Some(row) = self.environment_row(&run.repo_id, &name).await? else {
773 return Ok(Gate::Open);
774 };
775 let env = row.view();
776 // Which refs may deploy, before anything waits.
777 let protected = if env.branch_policy == "protected" { self.branch_protected(run).await? } else { false };
778 if let Err(problem) = branch_allowed(&env.branch_policy, &env.branch_patterns, &run.git_ref, protected, &name) {
779 return Ok(Gate::Refused(problem));
780 }
781 let needs_review = !env.reviewers.is_empty();
782 if !needs_review && env.wait_minutes == 0 {
783 return Ok(Gate::Open);
784 }
785 let existing = self.gate_row(&run.id, run.attempt as u32, &name).await?;
786 let gate = match existing {
787 Some(gate) => gate,
788 None => {
789 let wait_until = (env.wait_minutes > 0).then(|| rfc3339(now_ms() + u64::from(env.wait_minutes) * 60_000));
790 self.db
791 .prepare(
792 "INSERT OR IGNORE INTO environment_gates (run_id, attempt, environment, repo_id, state, needs_review, wait_until, created_at)
793 VALUES (?, ?, ?, ?, 'waiting', ?, ?, ?)",
794 )
795 .bind(&[
796 run.id.as_str().into(),
797 (run.attempt as u32).into(),
798 name.as_str().into(),
799 run.repo_id.as_str().into(),
800 u32::from(needs_review).into(),
801 optional(wait_until.as_deref()),
802 now().into(),
803 ])?
804 .run()
805 .await?;
806 if needs_review {
807 self.ask_reviewers(run, &env).await;
808 }
809 match self.gate_row(&run.id, run.attempt as u32, &name).await? {
810 Some(gate) => gate,
811 None => return Ok(Gate::Held(held_reason(&name, needs_review, wait_until.as_deref()))),
812 }
813 }
814 };
815 if gate.state == "rejected" {
816 let by = gate.reviewed_by.as_deref().unwrap_or("A reviewer");
817 return Ok(Gate::Refused(format!("{by} rejected the deployment to {name}.")));
818 }
819 if gate_open(&gate.state, gate.needs_review != 0, gate.wait_until.as_deref(), &now()) {
820 return Ok(Gate::Open);
821 }
822 let review_left = gate.needs_review != 0 && gate.state != "approved";
823 Ok(Gate::Held(held_reason(&name, review_left, gate.wait_until.as_deref())))
824 }
825
826 async fn gate_row(&self, run_id: &str, attempt: u32, environment: &str) -> Result<Option<GateRow>> {
827 self.db
828 .prepare("SELECT * FROM environment_gates WHERE run_id = ? AND attempt = ? AND environment = ?")
829 .bind(&[run_id.into(), attempt.into(), environment.into()])?
830 .first::<GateRow>(None)
831 .await
832 }
833
834 /// Whether the run's branch is protected: the default branch, or one an
835 /// active rule holds.
836 async fn branch_protected(&self, run: &RunRow) -> Result<bool> {
837 let Some(branch) = run.git_ref.strip_prefix("refs/heads/") else { return Ok(false) };
838 let path = crate::repo_path(&run.repo);
839 let Some(ws) = self.workspace_actor(&path.namespace).await? else { return Ok(false) };
840 let rules: Outcome<Value> = g1t_kit::call(
841 &self.work,
842 "effective_rules",
843 &json!({ "viewer": ws, "repo": path, "name": branch, "target": "branch" }),
844 )
845 .await
846 .unwrap_or_else(|_| Outcome::Ok(Value::Null));
847 Ok(match rules {
848 Outcome::Ok(rules) => {
849 rules["default_branch"].as_bool() == Some(true)
850 || rules["rules"].as_array().is_some_and(|rules| rules.iter().any(|rule| rule["enforcement"] == "active"))
851 }
852 Outcome::Fail(_) => false,
853 })
854 }
855
856 /// Tells an environment's reviewers that a run waits for them.
857 async fn ask_reviewers(&self, run: &RunRow, env: &Environment) {
858 let path = crate::repo_path(&run.repo);
859 let mut people: Vec<String> = Vec::new();
860 for reviewer in &env.reviewers {
861 let names = match reviewer.kind.as_str() {
862 "team" => self.team_people(&path.namespace, &reviewer.name).await.ok().flatten().unwrap_or_default(),
863 _ => vec![reviewer.name.clone()],
864 };
865 for name in names {
866 // Never whoever cannot approve their own run.
867 let own = env.prevent_self_review && run.actor.as_deref().is_some_and(|by| by.eq_ignore_ascii_case(&name));
868 if !own && !people.contains(&name) {
869 people.push(name);
870 }
871 }
872 }
873 if people.is_empty() {
874 return;
875 }
876 let published: Result<()> = g1t_kit::call(
877 &self.events,
878 "publish",
879 &g1t_contracts::events::Publish {
880 events: vec![g1t_contracts::events::NewEvent {
881 kind: "deployment.review_requested",
882 source: "actions",
883 repo_id: Some(run.repo_id.clone()),
884 actor: run.actor_id.clone(),
885 data: json!({
886 "repoId": run.repo_id,
887 "runId": run.id,
888 "attempt": run.attempt,
889 "environment": env.name,
890 "workflow": run.name,
891 "title": run.title,
892 "number": run.number,
893 "notify": people,
894 "link": format!("/{}/actions/runs/{}", run.repo, run.id),
895 }),
896 }],
897 },
898 )
899 .await;
900 if let Err(error) = published {
901 worker::console_error!("actions: reviewers of {} not told for run {}: {error}", env.name, run.id);
902 }
903 }
904
905 /// The environments holding a run's jobs this attempt, and whether
906 /// `viewer` may decide on each.
907 pub(crate) async fn pending_for(&self, run: &RunRow, viewer: &Viewer) -> Result<Vec<PendingDeployment>> {
908 let gates = self
909 .db
910 .prepare("SELECT * FROM environment_gates WHERE run_id = ? AND attempt = ? ORDER BY environment")
911 .bind(&[run.id.as_str().into(), (run.attempt as u32).into()])?
912 .all()
913 .await?
914 .results::<GateRow>()?;
915 if gates.is_empty() {
916 return Ok(Vec::new());
917 }
918 let jobs = self.job_rows(&run.id).await?;
919 let repo = self.visible_repo(&crate::repo_path(&run.repo), viewer).await?;
920 let mut out = Vec::new();
921 for gate in gates {
922 let env = self.environment_rules(&run.repo_id, &gate.environment).await?;
923 let held: Vec<&JobRow> = jobs.iter().filter(|job| job.environment.as_deref().is_some_and(|e| e.eq_ignore_ascii_case(&gate.environment))).collect();
924 let waiting = gate.state == "waiting" && held.iter().any(|job| job.status == "pending");
925 let can_review = match (viewer, &repo, waiting) {
926 (Some(user), Some(repo), true) if user.kind == PrincipalKind::User && user.token.as_ref().is_none_or(|t| t.job.is_none()) => {
927 let teams = self.reviewer_teams(&repo.namespace, &env, &user.username).await?;
928 let admin = access::can(Some(user), repo, Capability::Administer);
929 may_review(&env, &user.username, &teams, admin, run.actor.as_deref()).is_ok()
930 }
931 _ => false,
932 };
933 out.push(PendingDeployment {
934 environment: gate.environment.clone(),
935 state: gate.state.clone(),
936 needs_review: gate.needs_review != 0,
937 wait_until: gate.wait_until.clone(),
938 reviewers: env.reviewers.clone(),
939 jobs: held.iter().map(|job| job.name.clone()).collect(),
940 can_review,
941 reviewed_by: gate.reviewed_by.clone(),
942 comment: gate.comment.clone(),
943 reviewed_at: gate.reviewed_at.clone(),
944 });
945 }
946 Ok(out)
947 }
948
949 pub async fn pending_deployments(&self, a: PendingDeploymentsArgs) -> Result<Outcome<Vec<PendingDeployment>>> {
950 if self.visible_repo(&a.repo, &a.viewer).await?.is_none() {
951 return Ok(fail(FailureCode::NotFound, "There is no such repository."));
952 }
953 let run = check!(self.run_in(&a.repo, &a.id).await?);
954 Ok(Outcome::Ok(self.pending_for(&run, &a.viewer).await?))
955 }
956
957 /// `review_deployments`: a reviewer approves or rejects the jobs an
958 /// environment holds in a run.
959 pub async fn review_deployments(&self, a: ReviewDeploymentsArgs) -> Result<Outcome<Vec<PendingDeployment>>> {
960 if let Some(refused) = refuse_job_token(&a.actor) {
961 return Ok(refused);
962 }
963 if a.actor.kind != PrincipalKind::User {
964 return Ok(fail(FailureCode::Forbidden, "Only a person can review a deployment."));
965 }
966 let repo = check!(self.may(&a.actor, &a.repo, Capability::Read).await?);
967 let approve = match a.state.trim() {
968 "approved" | "approve" => true,
969 "rejected" | "reject" => false,
970 _ => return Ok(fail(FailureCode::Invalid, "state is approved or rejected.")),
971 };
972 let run = check!(self.run_in(&a.repo, &a.id).await?);
973 let wanted: Vec<String> = a.environments.iter().filter_map(|name| environment_name(name).ok()).collect();
974 let pending = self.pending_for(&run, &Some(a.actor.clone())).await?;
975 let waiting: Vec<&PendingDeployment> = pending
976 .iter()
977 .filter(|p| p.state == "waiting" && !p.jobs.is_empty())
978 .filter(|p| wanted.is_empty() || wanted.contains(&p.environment))
979 .collect();
980 if waiting.is_empty() {
981 return Ok(fail(FailureCode::Conflict, "No deployment of this run is waiting for review."));
982 }
983 let comment: Option<String> = a.comment.as_deref().map(str::trim).filter(|c| !c.is_empty()).map(|c| c.chars().take(1000).collect());
984 let admin = access::can(Some(&a.actor), &repo, Capability::Administer);
985 let at = now();
986 for pending in &waiting {
987 let env = self.environment_rules(&run.repo_id, &pending.environment).await?;
988 let teams = self.reviewer_teams(&repo.namespace, &env, &a.actor.username).await?;
989 let how = match may_review(&env, &a.actor.username, &teams, admin, run.actor.as_deref()) {
990 Ok(how) => how,
991 Err(problem) => return Ok(fail(FailureCode::Forbidden, problem)),
992 };
993 let state = if approve { "approved" } else { "rejected" };
994 // An admin's approval past the rules skips the wait timer too.
995 let clear_wait = approve && how == Reviewer::AdminBypass;
996 self.db
997 .prepare(
998 "UPDATE environment_gates SET state = ?, reviewed_by = ?, comment = ?, reviewed_at = ?,
999 wait_until = CASE WHEN ? THEN NULL ELSE wait_until END
1000 WHERE run_id = ? AND attempt = ? AND environment = ? AND state = 'waiting'",
1001 )
1002 .bind(&[
1003 state.into(),
1004 a.actor.username.as_str().into(),
1005 optional(comment.as_deref()),
1006 at.as_str().into(),
1007 u32::from(clear_wait).into(),
1008 run.id.as_str().into(),
1009 (run.attempt as u32).into(),
1010 pending.environment.as_str().into(),
1011 ])?
1012 .run()
1013 .await?;
1014 if !approve {
1015 let reason = match &comment {
1016 Some(comment) => format!("{} rejected the deployment to {}: {comment}", a.actor.username, pending.environment),
1017 None => format!("{} rejected the deployment to {}.", a.actor.username, pending.environment),
1018 };
1019 self.db
1020 .prepare(
1021 "UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ?
1022 WHERE run_id = ? AND status = 'pending' AND lower(environment) = ?",
1023 )
1024 .bind(&[reason.into(), at.as_str().into(), run.id.as_str().into(), pending.environment.as_str().into()])?
1025 .run()
1026 .await?;
1027 }
1028 }
1029 self.release_gates_of(&run).await?;
1030 self.advance(&run.id).await?;
1031 let run = self.run_row(&run.id).await?.unwrap_or(run);
1032 Ok(Outcome::Ok(self.pending_for(&run, &Some(a.actor.clone())).await?))
1033 }
1034
1035 /// Queues a run's pending jobs whose environments now let them start.
1036 pub(crate) async fn release_gates_of(&self, run: &RunRow) -> Result<bool> {
1037 let jobs = self.job_rows(&run.id).await?;
1038 let at = now();
1039 let mut released = false;
1040 for job in jobs.iter().filter(|job| job.status == "pending") {
1041 let Some(environment) = job.environment.as_deref() else { continue };
1042 match self.gate(run, environment).await? {
1043 Gate::Open => {
1044 // A self-hosted job waits for a runner again.
1045 let reason = job
1046 .labels
1047 .as_deref()
1048 .and_then(|labels| serde_json::from_str::<Vec<String>>(labels).ok())
1049 .map(|stored| g1t_contracts::runners::waiting_reason(&g1t_contracts::runners::Wanted::from_stored(&stored)));
1050 self.db
1051 .prepare("UPDATE jobs SET status = 'queued', reason = ?, queued_at = ? WHERE id = ? AND status = 'pending'")
1052 .bind(&[optional(reason.as_deref()), at.as_str().into(), job.id.as_str().into()])?
1053 .run()
1054 .await?;
1055 released = true;
1056 }
1057 Gate::Held(reason) => {
1058 if job.reason.as_deref() != Some(reason.as_str()) {
1059 self.db
1060 .prepare("UPDATE jobs SET reason = ? WHERE id = ? AND status = 'pending'")
1061 .bind(&[reason.into(), job.id.as_str().into()])?
1062 .run()
1063 .await?;
1064 }
1065 }
1066 Gate::Refused(reason) => {
1067 self.db
1068 .prepare("UPDATE jobs SET status = 'completed', conclusion = 'failure', reason = ?, finished_at = ? WHERE id = ? AND status = 'pending'")
1069 .bind(&[reason.into(), at.as_str().into(), job.id.as_str().into()])?
1070 .run()
1071 .await?;
1072 released = true;
1073 }
1074 }
1075 }
1076 Ok(released)
1077 }
1078
1079 /// Every minute: runs whose jobs wait at an environment whose timer has
1080 /// run out, or whose review came in, move along.
1081 pub(crate) async fn release_gates(&self) -> Result<()> {
1082 #[derive(Deserialize)]
1083 struct Waiting {
1084 run_id: String,
1085 }
1086 let runs = self
1087 .db
1088 .prepare("SELECT DISTINCT run_id FROM jobs WHERE status = 'pending' LIMIT 100")
1089 .all()
1090 .await?
1091 .results::<Waiting>()?;
1092 for waiting in runs {
1093 let Some(run) = self.run_row(&waiting.run_id).await? else { continue };
1094 if self.release_gates_of(&run).await? {
1095 self.advance(&run.id).await?;
1096 }
1097 }
1098 Ok(())
1099 }
1100
1101 // --- Approving runs of pull requests from outside --------------------------
1102
1103 /// Why a pull request's run waits for approval, if it does: by the
1104 /// repository's policy, whoever the pull request is for (its owner).
1105 pub(crate) async fn approval_needed(&self, repo: &Repo, owner: &User, ws: &User) -> Result<Option<String>> {
1106 // g1t's own work, nobody asked for, is the workspace's.
1107 if owner.kind == PrincipalKind::System {
1108 return Ok(None);
1109 }
1110 let policy = self.approval_policy(&repo.id).await?;
1111 let permission: Outcome<PermissionInfo> = g1t_kit::call(
1112 &self.identity,
1113 "collaborator_permission",
1114 &CollaboratorPermissionArgs {
1115 viewer: Some(ws.clone()),
1116 path: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
1117 username: owner.username.clone(),
1118 },
1119 )
1120 .await?;
1121 let info = permission.into_result().ok();
1122 let member = owner.is_member(&repo.namespace.to_lowercase())
1123 || info.as_ref().is_some_and(|info| matches!(info.source, Some(AccessSource::Owner | AccessSource::Base | AccessSource::Team)));
1124 if member {
1125 return Ok(None);
1126 }
1127 let can_push = info.as_ref().and_then(|info| info.role).is_some_and(|role| access::allows(role, Capability::Push));
1128 let first_time = !self.has_merged(repo, owner, ws).await?;
1129 Ok(approval_reason(&policy, member, can_push, first_time).map(|why| format!("{} {why}, so someone with the Write role approves its runs first.", owner.username)))
1130 }
1131
1132 /// Whether a pull request of `owner`'s has been merged into `repo`.
1133 async fn has_merged(&self, repo: &Repo, owner: &User, ws: &User) -> Result<bool> {
1134 let closed: Outcome<Vec<g1t_contracts::work::Pull>> = g1t_kit::call(
1135 &self.work,
1136 "list_pulls",
1137 &g1t_contracts::work::ListPullsArgs {
1138 repo: RepoPath { namespace: repo.namespace.clone(), name: repo.name.clone() },
1139 viewer: Some(ws.clone()),
1140 state: Some(g1t_contracts::work::State::Closed),
1141 label: None,
1142 milestone: None,
1143 base: None,
1144 },
1145 )
1146 .await
1147 .unwrap_or_else(|_| Outcome::Ok(Vec::new()));
1148 Ok(closed.into_result().unwrap_or_default().iter().any(|pull| pull.merged_at.is_some() && pull.owner().id == owner.id))
1149 }
1150
1151 /// `approve_run`: someone with the Write role lets a pull request's run
1152 /// that waits for approval start.
1153 pub async fn approve_run(&self, a: RunActionArgs) -> Result<Outcome<WorkflowRun>> {
1154 if let Some(refused) = refuse_job_token(&a.actor) {
1155 return Ok(refused);
1156 }
1157 check!(self.may(&a.actor, &a.repo, Capability::Run).await?);
1158 let run = check!(self.run_in(&a.repo, &a.id).await?);
1159 if run.status != "action_required" {
1160 return Ok(fail(FailureCode::Conflict, "This run is not waiting for approval."));
1161 }
1162 let mut approval = run.approval().unwrap_or(RunApproval { state: "required".into(), reason: String::new(), approved_by: None });
1163 approval.state = "approved".to_owned();
1164 approval.approved_by = Some(a.actor.username.clone());
1165 let started = self
1166 .db
1167 .prepare("UPDATE runs SET status = 'queued', approval = ?, approved_by = ? WHERE id = ? AND status = 'action_required' RETURNING id")
1168 .bind(&[serde_json::to_string(&approval)?.into(), a.actor.username.as_str().into(), run.id.as_str().into()])?
1169 .first::<Value>(None)
1170 .await?;
1171 if started.is_none() {
1172 return Ok(fail(FailureCode::Conflict, "This run is not waiting for approval."));
1173 }
1174 if let Some(run) = self.run_row(&run.id).await? {
1175 self.enter_group(&run).await?;
1176 }
1177 self.run_summary(&run.id).await
1178 }
1179}
1180
1181/// A workflow job's own token may not approve or change what keeps runs
1182/// safe: a workflow could otherwise let itself through.
1183fn refuse_job_token<T>(actor: &User) -> Option<Outcome<T>> {
1184 actor
1185 .token
1186 .as_ref()
1187 .is_some_and(|token| token.job.is_some())
1188 .then(|| fail(FailureCode::Forbidden, "A workflow job's token cannot approve runs or deployments, or change their rules."))
1189}
1190
1191#[cfg(test)]
1192mod tests {
1193 use super::*;
1194
1195 #[test]
1196 fn actions_are_on_unless_a_fork_or_turned_off() {
1197 // Unchosen: on for a repository, off for a fork.
1198 assert!(actions_enabled(None, false));
1199 assert!(!actions_enabled(None, true));
1200 // Chosen: as chosen, fork or not.
1201 assert!(actions_enabled(Some(true), true));
1202 assert!(!actions_enabled(Some(false), false));
1203 assert!(actions_enabled(Some(true), false));
1204 assert!(!actions_enabled(Some(false), true));
1205 assert_eq!(
1206 g1t_contracts::actions::actions_disabled_message("ada", "fork"),
1207 "Actions is turned off for ada/fork. Turn it on in Settings → Actions."
1208 );
1209 }
1210
1211 fn env(reviewers: &[(&str, &str)]) -> Environment {
1212 Environment {
1213 reviewers: reviewers.iter().map(|(kind, name)| EnvironmentReviewer { kind: (*kind).into(), name: (*name).into() }).collect(),
1214 ..unprotected("production")
1215 }
1216 }
1217
1218 fn pattern(name: &str, kind: &str) -> BranchPattern {
1219 BranchPattern { name: name.into(), kind: kind.into() }
1220 }
1221
1222 #[test]
1223 fn the_default_token_the_github_way() {
1224 use TokenDefault::{Permissive, Restricted};
1225 // A new repository takes its workspace's default: read-only unless it says.
1226 assert_eq!(effective_default(None, false, Restricted, Permissive), Restricted);
1227 assert_eq!(effective_default(None, false, Permissive, Permissive), Permissive);
1228 // One made before restricted tokens keeps read and write.
1229 assert_eq!(effective_default(None, true, Restricted, Permissive), Permissive);
1230 // A repository's own choice wins...
1231 assert_eq!(effective_default(Some(Restricted), true, Permissive, Permissive), Restricted);
1232 assert_eq!(effective_default(Some(Permissive), false, Restricted, Permissive), Permissive);
1233 // ...but never past the workspace's maximum.
1234 assert_eq!(effective_default(Some(Permissive), true, Permissive, Restricted), Restricted);
1235 assert_eq!(effective_default(None, true, Restricted, Restricted), Restricted);
1236 // A workspace without a row: new repositories read-only, writes allowed, no pull requests.
1237 let policy = workspace_policy(None);
1238 assert_eq!((policy.default_permissions.as_str(), policy.max_permissions.as_str()), ("read", "write"));
1239 assert!(!policy.can_approve_pull_requests);
1240 }
1241
1242 #[test]
1243 fn which_refs_may_deploy() {
1244 assert!(branch_allowed("all", &[], "refs/pull/3/merge", false, "production").is_ok());
1245 assert!(branch_allowed("protected", &[], "refs/heads/main", true, "production").is_ok());
1246 assert!(branch_allowed("protected", &[], "refs/heads/feature", false, "production").unwrap_err().contains("protected branches only"));
1247 // A pull request's merge ref is never a protected branch.
1248 assert!(branch_allowed("protected", &[], "refs/pull/3/merge", true, "production").is_err());
1249 let selected = [pattern("main", "branch"), pattern("release/*", "branch"), pattern("v*", "tag")];
1250 assert!(branch_allowed("selected", &selected, "refs/heads/release/1.x", false, "production").is_ok());
1251 assert!(branch_allowed("selected", &selected, "refs/tags/v1.2.0", false, "production").is_ok());
1252 assert!(branch_allowed("selected", &selected, "refs/heads/feature", false, "production").is_err());
1253 // A tag pattern does not let a branch of that name through.
1254 assert!(branch_allowed("selected", &[pattern("v*", "tag")], "refs/heads/v2", false, "production").is_err());
1255 assert!(branch_allowed("selected", &[], "refs/heads/main", false, "production").is_err());
1256 }
1257
1258 #[test]
1259 fn who_may_review() {
1260 let production = env(&[("user", "ada"), ("team", "deployers")]);
1261 assert_eq!(may_review(&production, "ada", &[], false, Some("bo")), Ok(Reviewer::Listed));
1262 assert_eq!(may_review(&production, "Ada", &[], false, None), Ok(Reviewer::Listed), "names compare without case");
1263 assert_eq!(may_review(&production, "cy", &["deployers".into()], false, None), Ok(Reviewer::Listed));
1264 assert!(may_review(&production, "cy", &[], false, None).unwrap_err().contains("not one of"));
1265 // An admin past the rules, unless the environment says no.
1266 assert_eq!(may_review(&production, "cy", &[], true, None), Ok(Reviewer::AdminBypass));
1267 let strict = Environment { admins_bypass: false, ..production.clone() };
1268 assert!(may_review(&strict, "cy", &[], true, None).is_err());
1269 // Whoever started the run, when self-review is off.
1270 let no_self = Environment { prevent_self_review: true, ..production.clone() };
1271 assert!(may_review(&no_self, "ada", &[], false, Some("ada")).unwrap_err().contains("You started this run"));
1272 assert_eq!(may_review(&no_self, "ada", &[], false, Some("bo")), Ok(Reviewer::Listed));
1273 assert_eq!(may_review(&no_self, "ada", &[], true, Some("ada")), Ok(Reviewer::AdminBypass));
1274 // Without reviewers there is nothing to review; an admin may start it.
1275 let timer = Environment { wait_minutes: 30, ..env(&[]) };
1276 assert!(may_review(&timer, "ada", &[], false, None).unwrap_err().contains("no reviewers"));
1277 assert_eq!(may_review(&timer, "ada", &[], true, None), Ok(Reviewer::AdminBypass));
1278 }
1279
1280 #[test]
1281 fn a_gate_opens_on_review_and_time() {
1282 let now = "2026-10-08T12:00:00Z";
1283 assert!(!gate_open("waiting", true, None, now));
1284 assert!(gate_open("approved", true, None, now));
1285 assert!(!gate_open("approved", true, Some("2026-10-08T12:30:00Z"), now));
1286 assert!(gate_open("approved", true, Some("2026-10-08T11:30:00Z"), now));
1287 assert!(gate_open("waiting", false, Some("2026-10-08T11:59:00Z"), now));
1288 assert!(!gate_open("waiting", false, Some("2026-10-08T12:01:00Z"), now));
1289 assert!(!gate_open("rejected", false, None, now));
1290 assert_eq!(held_reason("production", true, None), "Waiting for a review to deploy to production.");
1291 assert!(held_reason("staging", false, Some("2026-10-08T12:30:00Z")).contains("wait timer"));
1292 }
1293
1294 #[test]
1295 fn which_pull_requests_wait_for_approval() {
1296 // Members never wait.
1297 for policy in APPROVAL_POLICIES {
1298 assert_eq!(approval_reason(policy, true, true, true), None);
1299 }
1300 // The default: anyone who cannot push, and an outside collaborator's first.
1301 assert!(approval_reason("outside_contributors", false, false, false).is_some());
1302 assert!(approval_reason("outside_contributors", false, true, true).is_some());
1303 assert_eq!(approval_reason("outside_contributors", false, true, false), None);
1304 // First-time contributors only.
1305 assert!(approval_reason("first_time_contributors", false, false, true).is_some());
1306 assert_eq!(approval_reason("first_time_contributors", false, false, false), None);
1307 // Everyone outside the workspace.
1308 assert!(approval_reason("all_external_contributors", false, true, false).is_some());
1309 }
1310
1311 #[test]
1312 fn a_jobs_permissions_are_g1t_scopes_and_outside_runs_read_only() {
1313 use g1t_actions::permissions::{Access, Permissions};
1314 use g1t_contracts::scopes::{Level, Scope, TokenAccess};
1315 for scope in Permissions::all(Access::Write).scopes() {
1316 assert!(Scope::parse(scope).is_some(), "{scope} is not a g1t scope");
1317 }
1318 let token = |permissions: &Permissions| TokenAccess {
1319 scopes: Some(permissions.scopes().into_iter().map(str::to_owned).collect()),
1320 repo: Some("acme/web".into()),
1321 ..TokenAccess::default()
1322 };
1323 // The default: it can clone, and nothing more.
1324 let restricted = token(&Permissions::default_for(TokenDefault::Restricted));
1325 assert!(restricted.allows(Scope::CodeRead));
1326 assert!(!restricted.allows(Scope::CodeWrite));
1327 assert!(!restricted.allows(Scope::IssuesWrite));
1328 // A pull request from outside reads, whatever it asks for.
1329 let outside = token(&Permissions::all(Access::Write).read_only());
1330 assert!(Scope::ALL.iter().filter(|scope| outside.allows(**scope)).all(|scope| scope.level() == Level::Read));
1331 // Never more than a repository's: no admin, no secrets, no agents.
1332 let everything = token(&Permissions::all(Access::Write));
1333 for never in [Scope::RepoAdmin, Scope::SecretsRead, Scope::AgentsRun, Scope::WorkspaceRead, Scope::RunnersRead] {
1334 assert!(!everything.allows(never), "{}", never.as_str());
1335 }
1336 }
1337
1338 #[test]
1339 fn environment_names_are_checked() {
1340 assert_eq!(environment_name(" Production ").unwrap(), "production");
1341 assert!(environment_name("staging env").is_err());
1342 assert!(environment_name("").is_err());
1343 assert!(environment_name(&"a".repeat(41)).is_err());
1344 }
1345
1346 #[test]
1347 fn a_job_token_cannot_let_itself_through() {
1348 let mut actor = User { id: "wsp_1".into(), username: "acme".into(), kind: PrincipalKind::Workspace, ..User::default() };
1349 assert!(refuse_job_token::<()>(&actor).is_none());
1350 actor.token = Some(Box::new(g1t_contracts::scopes::TokenAccess {
1351 job: Some(g1t_contracts::scopes::JobToken { run_id: "run_1".into(), job_id: "job_1".into(), pull_requests: false }),
1352 ..Default::default()
1353 }));
1354 assert!(refuse_job_token::<()>(&actor).is_some());
1355 }
1356}