Skip to content
Sign up

flagon-io/g1t

public
0
811 linesCodeBlameRaw
1//! Self-hosted runners: a workspace's or a repository's own machines, which
2//! run its workflow jobs (and, when it says so, its agents' work) instead
3//! of g1t's sandboxes. Time on them costs nothing.
4//!
5//! The actions service keeps them, beside the jobs they run. A machine runs
6//! `g1t-runner` (`crates/runner`), which registers once with a short-lived
7//! registration token an admin made, gets a credential of its own, and then
8//! only ever calls out: it polls `api.g1t.sh` for work, runs what it is
9//! given with the same harness g1t's sandboxes use, and reports back. No
10//! port is opened on the machine.
11//!
12//! - A **registration token** (`g1trt_…`) is made by an owner of the
13//! workspace (or an admin of the repository) and lasts an hour. It can
14//! register any number of runners until then, and nothing else.
15//! - A **runner credential** (`g1tr_…`) belongs to one runner. It is stored
16//! only as a hash, rotates every day (the poll that rotates it hands the
17//! new one over), and is revoked when the runner is removed. It can poll
18//! for work, report on what that runner was given, and remove the runner;
19//! nothing else. Any other endpoint refuses it.
20//! - A job is given to a runner when every label in its `runs-on` is one
21//! of the runner's labels (ignoring case), and the runner's group lets
22//! the job's repository use it. A job whose `runs-on` names
23//! `self-hosted` (or a `group`) only ever runs on self-hosted runners; it
24//! waits, saying for which labels, until one picks it up, for a day at
25//! most.
26//!
27//! The management methods take an `actor` and an owner (`repo` or
28//! `workspace`), as secrets do. The runner's own methods take its id and
29//! credential. Mirrors `packages/contracts/src/runners.ts`.
30
31use serde::{Deserialize, Serialize};
32use serde_json::{Map, Value};
33
34use crate::User;
35use crate::repos::RepoPath;
36
37/// Every runner has these labels, whatever else it was given.
38pub const SELF_HOSTED: &str = "self-hosted";
39/// What a registration token starts with.
40pub const REGISTRATION_PREFIX: &str = "g1trt_";
41/// What a runner's credential starts with.
42pub const CREDENTIAL_PREFIX: &str = "g1tr_";
43/// How long a registration token lasts, in seconds.
44pub const REGISTRATION_TTL_SECONDS: u64 = 60 * 60;
45/// How long a job may wait for a self-hosted runner before it fails.
46pub const MAX_WAIT_HOURS: u64 = 24;
47/// A runner that has not polled for this long is offline.
48pub const ONLINE_WITHIN_MS: u64 = 90 * 1000;
49/// How long one poll waits for work before answering with none.
50pub const MAX_POLL_WAIT_MS: u64 = 20 * 1000;
51/// How often a runner's credential is replaced.
52pub const ROTATE_AFTER_MS: u64 = 24 * 60 * 60 * 1000;
53/// The most labels a runner has, and the longest one.
54pub const MAX_LABELS: usize = 30;
55pub const MAX_LABEL_LEN: usize = 64;
56/// The most runners a workspace has.
57pub const MAX_RUNNERS: u32 = 500;
58/// The most runners a workspace registers in one minute.
59pub const MAX_REGISTRATIONS_PER_MINUTE: u32 = 30;
60/// The most registration tokens a workspace makes in one hour.
61pub const MAX_TOKENS_PER_HOUR: u32 = 60;
62
63// --- What people see -------------------------------------------------------
64
65/// What a runner is doing now.
66#[derive(Clone, Debug, Serialize, Deserialize)]
67#[serde(rename_all = "camelCase")]
68pub struct RunnerWork {
69 /// `workflow` (a workflow job) or `agent` (an agent's run, checks, a
70 /// review, the merge queue).
71 pub kind: String,
72 pub id: String,
73 /// The job's name, or what the agent is doing.
74 pub name: String,
75 /// `owner/name`.
76 pub repo: Option<String>,
77 /// For a link: the workflow run the job is in, or for `agent` work
78 /// the agent run it is (`/<owner>/<name>/agents/runs/<id>`), when
79 /// the sandbox that handed it over said which.
80 pub run_id: Option<String>,
81 pub started_at: Option<String>,
82}
83
84#[derive(Clone, Debug, Serialize, Deserialize)]
85#[serde(rename_all = "camelCase")]
86pub struct Runner {
87 pub id: String,
88 pub name: String,
89 pub workspace: String,
90 /// `owner/name` for a repository's own runner; null for the workspace's.
91 pub repo: Option<String>,
92 /// Its group's name; null for a repository's runner.
93 pub group: Option<String>,
94 /// Every label, `self-hosted`, its OS and architecture among them.
95 pub labels: Vec<String>,
96 /// `linux`, `macos` or `windows`.
97 pub os: String,
98 /// `x64` or `arm64`.
99 pub arch: String,
100 /// The `g1t-runner` version it last reported.
101 pub version: String,
102 /// Runs one job, then removes itself.
103 pub ephemeral: bool,
104 /// `online`, `busy` or `offline`.
105 pub status: String,
106 pub work: Option<RunnerWork>,
107 pub last_seen_at: Option<String>,
108 pub created_at: String,
109 pub created_by: Option<String>,
110}
111
112/// Which of a workspace's repositories may use its runners.
113#[derive(Clone, Debug, Serialize, Deserialize)]
114#[serde(rename_all = "camelCase")]
115pub struct RunnerGroup {
116 pub id: String,
117 pub name: String,
118 /// The group runners join when none is named: every repository.
119 pub default: bool,
120 /// Repository names (without the workspace) that may use it; empty is
121 /// every repository in the workspace.
122 pub repositories: Vec<String>,
123 pub runners: u32,
124 pub updated_at: String,
125}
126
127/// A registration token, shown once.
128#[derive(Clone, Debug, Serialize, Deserialize)]
129#[serde(rename_all = "camelCase")]
130pub struct RegistrationToken {
131 pub token: String,
132 pub expires_at: String,
133 pub workspace: String,
134 pub repo: Option<String>,
135 pub group: Option<String>,
136 /// What to pass as `--url`.
137 pub url: String,
138}
139
140/// Where a workspace's (or a repository's) agents work, and whether pull
141/// requests from forks may use its runners.
142#[derive(Clone, Debug, Default, Serialize, Deserialize)]
143#[serde(rename_all = "camelCase")]
144pub struct RunnerSettings {
145 /// Agent runs, checks, reviews and the merge queue run on self-hosted
146 /// runners with `agent_labels`, instead of g1t's sandboxes.
147 pub agents_on_self_hosted: bool,
148 /// The labels a runner needs to take agent work; `self-hosted` is
149 /// always one.
150 pub agent_labels: Vec<String>,
151 /// Jobs of pull requests from forks may run on self-hosted runners.
152 /// Off by default: anyone who can open a pull request could run code
153 /// on the machine.
154 pub fork_pull_requests: bool,
155 /// For a repository: these are its workspace's, not its own.
156 pub inherited: bool,
157}
158
159// --- Management ------------------------------------------------------------
160
161/// A workspace's runners (`workspace`), or a repository's own (`repo`).
162#[derive(Clone, Debug, Default, Serialize, Deserialize)]
163pub struct RunnersOwner {
164 #[serde(default)]
165 pub repo: Option<RepoPath>,
166 #[serde(default)]
167 pub workspace: Option<String>,
168}
169
170/// `runners`: a workspace's runners (members), or a repository's own
171/// (its admins). Returns `Outcome<Vec<Runner>>`.
172#[derive(Debug, Serialize, Deserialize)]
173pub struct ListRunnersArgs {
174 pub actor: User,
175 #[serde(flatten)]
176 pub owner: RunnersOwner,
177}
178
179/// `create_registration_token`: owners of the workspace, or admins of the
180/// repository. Returns `Outcome<RegistrationToken>`.
181#[derive(Debug, Serialize, Deserialize)]
182pub struct CreateRegistrationTokenArgs {
183 pub actor: User,
184 #[serde(flatten)]
185 pub owner: RunnersOwner,
186 /// The group its runners join, by name or id; the default group if
187 /// left out. Not for a repository's runners.
188 #[serde(default)]
189 pub group: Option<String>,
190}
191
192/// `remove_runner`: as `create_registration_token`. A job it is running is
193/// cancelled. Returns `Outcome<bool>`.
194#[derive(Debug, Serialize, Deserialize)]
195pub struct RemoveRunnerArgs {
196 pub actor: User,
197 #[serde(flatten)]
198 pub owner: RunnersOwner,
199 pub id: String,
200}
201
202/// `runner_groups`: members. Returns `Outcome<Vec<RunnerGroup>>`.
203#[derive(Debug, Serialize, Deserialize)]
204pub struct RunnerGroupsArgs {
205 pub actor: User,
206 pub workspace: String,
207}
208
209/// `set_runner_group`: create one (no `id`) or change one. Owners.
210/// Returns `Outcome<RunnerGroup>`.
211#[derive(Debug, Serialize, Deserialize)]
212pub struct SetRunnerGroupArgs {
213 pub actor: User,
214 pub workspace: String,
215 #[serde(default)]
216 pub id: Option<String>,
217 #[serde(default)]
218 pub name: Option<String>,
219 /// Repository names; empty for every repository.
220 #[serde(default)]
221 pub repositories: Option<Vec<String>>,
222}
223
224/// `delete_runner_group`: owners. Its runners move to the default group,
225/// which cannot be deleted. Returns `Outcome<bool>`.
226#[derive(Debug, Serialize, Deserialize)]
227pub struct DeleteRunnerGroupArgs {
228 pub actor: User,
229 pub workspace: String,
230 pub id: String,
231}
232
233// --- The desktop app's runners ----------------------------------------------
234
235/// The desktop app keeps a runner on a person's computer while it is open
236/// (apps/desktop/src-tauri/src/runner). What it says of that runner, as it
237/// says it in its tray and settings (its diagnosis.rs, the one catalogue
238/// of those words), is kept here per computer, so the workspace's Runners
239/// page lists every desktop with the same state, why, and the fix. A
240/// desktop not heard from for `DESKTOP_OPEN_WITHIN_MS` has g1t closed, and
241/// shows `closed`, which the app sent too.
242pub const DESKTOP_OPEN_WITHIN_MS: u64 = 10 * 60 * 1000;
243/// The most desktops a workspace keeps reports for.
244pub const MAX_DESKTOPS: u32 = 200;
245
246/// A diagnosis, as the app made it.
247#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
248pub struct DesktopDiagnosis {
249 /// `idle`, `busy`, `no_docker`, `no_sandbox`, `not_allowed`, …
250 pub code: String,
251 /// `ok`, `working`, `off`, `warning` or `problem`.
252 pub tone: String,
253 pub title: String,
254 #[serde(default)]
255 pub cause: Option<String>,
256 #[serde(default)]
257 pub fix: Option<String>,
258}
259
260/// One person's computer, as its desktop app last said.
261#[derive(Clone, Debug, Serialize, Deserialize)]
262#[serde(rename_all = "camelCase")]
263pub struct DesktopRunner {
264 pub workspace: String,
265 /// The computer's name, which its runner has too.
266 pub machine: String,
267 /// Whose computer: their username.
268 pub person: String,
269 /// `sandboxed`, `docker` or `host`.
270 pub backend: String,
271 pub version: Option<String>,
272 pub diagnosis: DesktopDiagnosis,
273 /// What to show while g1t is closed on it.
274 pub closed: DesktopDiagnosis,
275 /// Heard from within `DESKTOP_OPEN_WITHIN_MS`: g1t is open there.
276 pub open: bool,
277 pub reported_at: String,
278}
279
280/// `report_desktop`: the person's own desktop app, through the site, for a
281/// workspace they own. Returns `Outcome<bool>`.
282#[derive(Debug, Serialize, Deserialize)]
283pub struct ReportDesktopArgs {
284 pub actor: User,
285 pub workspace: String,
286 pub machine: String,
287 pub backend: String,
288 #[serde(default)]
289 pub version: Option<String>,
290 pub diagnosis: DesktopDiagnosis,
291 pub closed: DesktopDiagnosis,
292}
293
294/// `desktop_runners`: owners of the workspace. Returns `Outcome<Vec<DesktopRunner>>`.
295#[derive(Debug, Serialize, Deserialize)]
296pub struct DesktopRunnersArgs {
297 pub actor: User,
298 pub workspace: String,
299}
300
301/// `runner_settings`: members of the workspace, or admins of the
302/// repository. Returns `Outcome<RunnerSettings>`.
303#[derive(Debug, Serialize, Deserialize)]
304pub struct RunnerSettingsArgs {
305 pub actor: User,
306 #[serde(flatten)]
307 pub owner: RunnersOwner,
308}
309
310/// `set_runner_settings`: owners, or admins of the repository. Left out is
311/// unchanged; `inherit` drops a repository's own settings. Returns
312/// `Outcome<RunnerSettings>`.
313#[derive(Debug, Serialize, Deserialize)]
314pub struct SetRunnerSettingsArgs {
315 pub actor: User,
316 #[serde(flatten)]
317 pub owner: RunnersOwner,
318 #[serde(default)]
319 pub agents_on_self_hosted: Option<bool>,
320 #[serde(default)]
321 pub agent_labels: Option<Vec<String>>,
322 #[serde(default)]
323 pub fork_pull_requests: Option<bool>,
324 #[serde(default)]
325 pub inherit: bool,
326}
327
328/// `stuck_jobs`: Mission control's Needs you. Returns `Vec<StuckJob>`.
329#[derive(Debug, Serialize, Deserialize)]
330pub struct StuckJobsArgs {
331 pub viewer: crate::Viewer,
332}
333
334/// `runner_activity`: what runs for a workspace now, on g1t's cloud and
335/// handed to its own runners, for the Runners page. Owners, as the
336/// workspace's runners are. Snake case both ways. Returns
337/// `Outcome<RunnerActivity>`.
338#[derive(Debug, Serialize, Deserialize)]
339pub struct RunnerActivityArgs {
340 pub actor: User,
341 pub workspace: String,
342}
343
344/// A workflow job running in one of g1t's sandboxes.
345#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
346pub struct CloudJob {
347 pub id: String,
348 pub name: String,
349 /// The workflow run it is in.
350 pub run_id: String,
351 /// `owner/name`.
352 pub repo: String,
353 pub started_at: Option<String>,
354}
355
356/// Agent work handed to one of the workspace's own runners, waiting for
357/// one or taken.
358#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
359pub struct HandedOverTask {
360 pub id: String,
361 /// The agent run it is, when the sandbox said; older tasks have none.
362 pub run_id: Option<String>,
363 /// `agent`, `checks`, `review`, `queue`…
364 pub kind: String,
365 pub title: String,
366 /// `owner/name`.
367 pub repo: String,
368 /// `queued` or `in_progress`.
369 pub status: String,
370 pub runner_name: Option<String>,
371 pub created_at: String,
372 pub started_at: Option<String>,
373}
374
375#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
376pub struct RunnerActivity {
377 /// Workflow jobs in g1t's sandboxes now, newest first, at most
378 /// `ACTIVITY_LIMIT`.
379 pub cloud_jobs: Vec<CloudJob>,
380 /// Workflow jobs queued for g1t's sandboxes.
381 pub cloud_jobs_queued: u32,
382 /// Agent work on, or waiting for, the workspace's own runners.
383 pub handed_over: Vec<HandedOverTask>,
384 /// Workflow jobs waiting for one of the workspace's own runners.
385 pub self_hosted_jobs_queued: u32,
386}
387
388/// The most jobs and tasks `runner_activity` lists of each.
389pub const ACTIVITY_LIMIT: u32 = 100;
390
391/// A job that has waited ten minutes or more for a self-hosted runner,
392/// with none that matches online.
393#[derive(Clone, Debug, Serialize, Deserialize)]
394#[serde(rename_all = "camelCase")]
395pub struct StuckJob {
396 pub id: String,
397 pub name: String,
398 pub run_id: String,
399 /// `owner/name`.
400 pub repo: String,
401 /// What it asks for, for people: `self-hosted, linux, gpu`.
402 pub labels: String,
403 pub queued_at: String,
404}
405
406// --- The runner's side (snake_case on the wire, as the API passes it) ------
407
408/// `runner_register`: a machine registering with a registration token.
409/// Returns `Outcome<Registered>`.
410#[derive(Clone, Debug, Default, Serialize, Deserialize)]
411pub struct RegisterArgs {
412 pub token: String,
413 pub name: String,
414 #[serde(default)]
415 pub labels: Vec<String>,
416 pub os: String,
417 pub arch: String,
418 #[serde(default)]
419 pub version: String,
420 #[serde(default)]
421 pub ephemeral: bool,
422 /// A group by name, for a workspace's token; the token's group, else
423 /// the default, if left out.
424 #[serde(default)]
425 pub group: Option<String>,
426 /// Replace a runner of the same name instead of refusing.
427 #[serde(default)]
428 pub replace: bool,
429 /// How the runner keeps work from its machine: `nested-container` (a
430 /// container per job, inside the runner's own sandboxed container),
431 /// `container` (a container per job, on a Docker Engine it shares with
432 /// its machine) or `host` (directly on the machine). A `host` runner is
433 /// given no public repository's work ([`isolation_allows`]); older
434 /// runners leave it out.
435 #[serde(default)]
436 pub isolation: Option<String>,
437}
438
439/// The isolation levels a runner may say it has (`RegisterArgs::isolation`).
440pub const ISOLATIONS: &[&str] = &["nested-container", "container", "host"];
441
442#[derive(Clone, Debug, Serialize, Deserialize)]
443pub struct Registered {
444 pub runner: Runner,
445 /// Shown once; the runner keeps it in its configuration.
446 pub credential: String,
447}
448
449/// Every call a registered runner makes carries its id and credential.
450#[derive(Clone, Debug, Default, Serialize, Deserialize)]
451pub struct RunnerAuth {
452 pub runner: String,
453 pub credential: String,
454}
455
456/// `runner_poll`: waits up to `wait_ms` for work. Doubles as the runner's
457/// heartbeat. Returns `Outcome<Poll>`.
458#[derive(Clone, Debug, Default, Serialize, Deserialize)]
459pub struct PollArgs {
460 #[serde(flatten)]
461 pub auth: RunnerAuth,
462 #[serde(default)]
463 pub version: String,
464 /// What it is running now; it is given nothing more while busy.
465 #[serde(default)]
466 pub running: Vec<String>,
467 #[serde(default)]
468 pub wait_ms: u64,
469 /// How the runner keeps work from its machine now, as at registration
470 /// (`RegisterArgs::isolation`); kept up to date from each poll. Older
471 /// runners leave it out.
472 #[serde(default)]
473 pub isolation: Option<String>,
474}
475
476/// Work for a runner.
477#[derive(Clone, Debug, Serialize, Deserialize)]
478pub struct Assignment {
479 /// `workflow` or `agent`.
480 pub kind: String,
481 pub id: String,
482 pub name: String,
483 pub repo: String,
484 pub timeout_minutes: u32,
485 /// The image to run it in: the job's `container:`, when it names one.
486 pub image: Option<String>,
487 /// A workflow job's own token, for `ACTIONS_JOB`/`ACTIONS_TOKEN`.
488 pub token: Option<String>,
489 /// An agent task's environment, as g1t's sandbox would have been
490 /// started with: `MODE`, the run's short-lived credentials, the model
491 /// proxy's address.
492 pub env: Option<Map<String, Value>>,
493 /// The repository's visibility, `public` or `private`, when g1t knows
494 /// it: a runner that runs work directly on its machine refuses a
495 /// public repository's. Older g1t leaves it out.
496 #[serde(default)]
497 pub visibility: Option<String>,
498}
499
500#[derive(Clone, Debug, Default, Serialize, Deserialize)]
501pub struct Poll {
502 pub assignment: Option<Assignment>,
503 /// Work it holds that it should stop: cancelled, timed out, removed.
504 #[serde(default)]
505 pub cancel: Vec<String>,
506 /// A new credential: it replaces the old, which stops working once this
507 /// one is used.
508 pub credential: Option<String>,
509 /// The runner was removed: stop and forget the credential.
510 #[serde(default)]
511 pub removed: bool,
512}
513
514/// `runner_finished`: a runner telling what became of work it was given.
515/// For a workflow job the harness has normally reported already; this
516/// covers one that crashed or was killed. Returns `Outcome<bool>` (whether
517/// it changed anything).
518#[derive(Clone, Debug, Default, Serialize, Deserialize)]
519pub struct FinishedArgs {
520 #[serde(flatten)]
521 pub auth: RunnerAuth,
522 pub id: String,
523 pub exit_code: i32,
524 #[serde(default)]
525 pub reason: Option<String>,
526}
527
528/// `runner_remove_self`: `g1t-runner remove`. Returns `Outcome<bool>`.
529#[derive(Clone, Debug, Default, Serialize, Deserialize)]
530pub struct RemoveSelfArgs {
531 #[serde(flatten)]
532 pub auth: RunnerAuth,
533}
534
535// --- Between services (camelCase, as every service speaks) ----------------
536
537/// `runner_route`: whether a kind of g1t's own work in a repository runs on
538/// self-hosted runners, and on which labels. Asked by the runner service
539/// before it starts a sandbox. Returns `Option<Vec<String>>`.
540#[derive(Clone, Debug, Serialize, Deserialize)]
541#[serde(rename_all = "camelCase")]
542pub struct RouteArgs {
543 pub workspace: String,
544 pub repo: RepoPath,
545}
546
547/// `enqueue_task`: agent work for a self-hosted runner, from the runner
548/// service's sandbox (`sandbox` is its Durable Object's id), which is told
549/// with `task_ended` how it went. Returns `Outcome<String>` (the task's id).
550#[derive(Clone, Debug, Serialize, Deserialize)]
551#[serde(rename_all = "camelCase")]
552pub struct EnqueueTaskArgs {
553 pub sandbox: String,
554 pub workspace: String,
555 pub repo: RepoPath,
556 /// The run kind: `agent`, `checks`, `review`, `queue`…
557 pub kind: String,
558 pub title: String,
559 pub labels: Vec<String>,
560 pub env: Map<String, Value>,
561 pub timeout_minutes: u32,
562 /// The agent run the work belongs to, when the sandbox opened one: what
563 /// people's pages link a runner's agent work to.
564 #[serde(default, alias = "run_id")]
565 pub run_id: Option<String>,
566}
567
568/// `cancel_task`: the sandbox's work stopped from g1t's side (a person, a
569/// time cap). Returns `Outcome<bool>`.
570#[derive(Clone, Debug, Serialize, Deserialize)]
571#[serde(rename_all = "camelCase")]
572pub struct CancelTaskArgs {
573 pub sandbox: String,
574 #[serde(default)]
575 pub reason: Option<String>,
576}
577
578// --- Labels ----------------------------------------------------------------
579
580/// A label as it is kept: trimmed and lowercase. `None` when it is not
581/// one: empty, too long, or with characters other than letters, digits,
582/// `-`, `_`, `.`, `:` and `/`.
583pub fn clean_label(label: &str) -> Option<String> {
584 let label = label.trim().to_ascii_lowercase();
585 let ok = !label.is_empty()
586 && label.len() <= MAX_LABEL_LEN
587 && label.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.' | ':' | '/'));
588 ok.then_some(label)
589}
590
591/// A runner's labels: what it was given, cleaned, with `self-hosted`, its
592/// OS and its architecture, each once, in that order first.
593pub fn runner_labels(given: &[String], os: &str, arch: &str) -> Result<Vec<String>, String> {
594 let mut labels: Vec<String> = Vec::new();
595 for label in [SELF_HOSTED, os, arch].iter().map(|s| s.to_string()).chain(given.iter().cloned()) {
596 let Some(clean) = clean_label(&label) else {
597 return Err(format!("`{label}` is not a label: use letters, digits, `-`, `_`, `.`, `:` and `/`, up to {MAX_LABEL_LEN} characters."));
598 };
599 if !labels.contains(&clean) {
600 labels.push(clean);
601 }
602 }
603 if labels.len() > MAX_LABELS {
604 return Err(format!("A runner has at most {MAX_LABELS} labels."));
605 }
606 Ok(labels)
607}
608
609/// The OS a runner reports, as its label: `linux`, `macos` or `windows`.
610pub fn os_label(os: &str) -> Option<&'static str> {
611 match os.trim().to_ascii_lowercase().as_str() {
612 "linux" => Some("linux"),
613 "macos" | "darwin" | "osx" | "mac" => Some("macos"),
614 "windows" | "win" => Some("windows"),
615 _ => None,
616 }
617}
618
619/// The architecture a runner reports, as its label: `x64` or `arm64`.
620pub fn arch_label(arch: &str) -> Option<&'static str> {
621 match arch.trim().to_ascii_lowercase().as_str() {
622 "x64" | "x86_64" | "amd64" => Some("x64"),
623 "arm64" | "aarch64" => Some("arm64"),
624 _ => None,
625 }
626}
627
628/// What a job's `runs-on` asks for, read for self-hosted runners: its
629/// labels, cleaned, and the group it names. `self_hosted` when it names
630/// `self-hosted` or a group, which only self-hosted runners can satisfy.
631#[derive(Clone, Debug, Default, PartialEq, Eq)]
632pub struct Wanted {
633 pub labels: Vec<String>,
634 pub group: Option<String>,
635 pub self_hosted: bool,
636}
637
638impl Wanted {
639 pub fn of(labels: &[String], group: Option<&str>) -> Wanted {
640 let mut out: Vec<String> = Vec::new();
641 for label in labels {
642 let clean = label.trim().to_ascii_lowercase();
643 if !clean.is_empty() && !out.contains(&clean) {
644 out.push(clean);
645 }
646 }
647 let group = group.map(|g| g.trim().to_owned()).filter(|g| !g.is_empty());
648 let self_hosted = group.is_some() || out.iter().any(|l| l == SELF_HOSTED);
649 Wanted { labels: out, group, self_hosted }
650 }
651
652 /// The job's labels as stored on it: its labels, then `group:<name>`.
653 pub fn stored(&self) -> Vec<String> {
654 let mut out = self.labels.clone();
655 if let Some(group) = &self.group {
656 out.push(format!("group:{}", group.to_ascii_lowercase()));
657 }
658 out
659 }
660
661 /// Back from what [`Wanted::stored`] kept.
662 pub fn from_stored(stored: &[String]) -> Wanted {
663 let group = stored.iter().find_map(|l| l.strip_prefix("group:").map(str::to_owned));
664 let labels: Vec<String> = stored.iter().filter(|l| !l.starts_with("group:")).cloned().collect();
665 Wanted::of(&labels, group.as_deref())
666 }
667
668 /// Whether a runner with `labels`, in the group called `group`, can
669 /// take it: every label it asks for, and its group if it names one.
670 pub fn matches(&self, labels: &[String], group: Option<&str>) -> bool {
671 let has = |wanted: &String| labels.iter().any(|l| l.eq_ignore_ascii_case(wanted));
672 let group_ok = match (&self.group, group) {
673 (None, _) => true,
674 (Some(wanted), Some(group)) => wanted.eq_ignore_ascii_case(group),
675 (Some(_), None) => false,
676 };
677 group_ok && self.labels.iter().all(has)
678 }
679
680 /// For people: `self-hosted, linux, gpu` (in group `build`).
681 pub fn describe(&self) -> String {
682 let labels = self.labels.join(", ");
683 match &self.group {
684 Some(group) if labels.is_empty() => format!("in group {group}"),
685 Some(group) => format!("{labels} in group {group}"),
686 None => labels,
687 }
688 }
689}
690
691/// What a public repository's job says while the only runners that could
692/// take it run jobs directly on their machines (`host` isolation), which
693/// are never given a public repository's work.
694pub const WAITING_FOR_SANDBOX: &str =
695 "Waiting for a sandboxed runner: this repository is public, and host-mode runners don't run public repositories' jobs.";
696
697/// Whether a runner of `isolation` may be given a repository's work, by
698/// its visibility (`public` or `private`; unknown lets it through, and the
699/// runner decides). A host-mode runner takes no public repository's work.
700pub fn isolation_allows(isolation: Option<&str>, visibility: Option<&str>) -> bool {
701 !(isolation == Some("host") && visibility == Some("public"))
702}
703
704/// What a job waiting for a runner says.
705pub fn waiting_reason(wanted: &Wanted) -> String {
706 format!("Waiting for a self-hosted runner with labels {}.", wanted.describe())
707}
708
709#[cfg(test)]
710mod tests {
711 use super::*;
712
713 fn strings(items: &[&str]) -> Vec<String> {
714 items.iter().map(|s| s.to_string()).collect()
715 }
716
717 #[test]
718 fn a_host_mode_runner_takes_no_public_repositorys_work() {
719 assert!(!isolation_allows(Some("host"), Some("public")));
720 assert!(isolation_allows(Some("host"), Some("private")));
721 assert!(isolation_allows(Some("host"), None));
722 assert!(isolation_allows(Some("container"), Some("public")));
723 assert!(isolation_allows(None, Some("public")), "an older runner decides itself");
724 let poll: PollArgs = serde_json::from_value(serde_json::json!({ "runner": "rnr_1", "credential": "c" })).unwrap();
725 assert_eq!(poll.isolation, None, "an older runner's poll");
726 }
727
728 #[test]
729 fn a_runner_always_has_self_hosted_its_os_and_its_arch() {
730 let labels = runner_labels(&strings(&["GPU", "gpu", " cuda-12 "]), "linux", "x64").unwrap();
731 assert_eq!(labels, strings(&["self-hosted", "linux", "x64", "gpu", "cuda-12"]));
732 assert!(runner_labels(&strings(&["has space"]), "linux", "x64").is_err());
733 assert!(runner_labels(&strings(&[""]), "linux", "x64").is_err());
734 }
735
736 #[test]
737 fn os_and_arch_are_read_as_people_write_them() {
738 assert_eq!(os_label("Darwin"), Some("macos"));
739 assert_eq!(os_label("Windows"), Some("windows"));
740 assert_eq!(os_label("plan9"), None);
741 assert_eq!(arch_label("x86_64"), Some("x64"));
742 assert_eq!(arch_label("aarch64"), Some("arm64"));
743 assert_eq!(arch_label("mips"), None);
744 }
745
746 #[test]
747 fn a_job_names_self_hosted_or_a_group_to_need_one() {
748 assert!(Wanted::of(&strings(&["Self-Hosted", "linux"]), None).self_hosted);
749 assert!(Wanted::of(&strings(&[]), Some("build")).self_hosted);
750 assert!(!Wanted::of(&strings(&["ubuntu-latest"]), None).self_hosted);
751 }
752
753 #[test]
754 fn every_label_the_job_names_must_be_the_runners() {
755 let runner = strings(&["self-hosted", "linux", "x64", "gpu"]);
756 assert!(Wanted::of(&strings(&["self-hosted"]), None).matches(&runner, Some("default")));
757 assert!(Wanted::of(&strings(&["self-hosted", "LINUX", "gpu"]), None).matches(&runner, None));
758 assert!(!Wanted::of(&strings(&["self-hosted", "linux", "arm64"]), None).matches(&runner, None));
759 assert!(!Wanted::of(&strings(&["self-hosted", "windows"]), None).matches(&runner, None));
760 }
761
762 #[test]
763 fn a_group_is_matched_by_name() {
764 let runner = strings(&["self-hosted", "linux", "x64"]);
765 let wanted = Wanted::of(&strings(&["linux"]), Some("Build"));
766 assert!(wanted.matches(&runner, Some("build")));
767 assert!(!wanted.matches(&runner, Some("default")));
768 assert!(!wanted.matches(&runner, None));
769 assert_eq!(Wanted::from_stored(&wanted.stored()), wanted.clone().tap_lower());
770 }
771
772 impl Wanted {
773 fn tap_lower(mut self) -> Wanted {
774 self.group = self.group.map(|g| g.to_ascii_lowercase());
775 self
776 }
777 }
778
779 #[test]
780 fn waiting_says_for_what() {
781 let wanted = Wanted::of(&strings(&["self-hosted", "linux", "gpu"]), None);
782 assert_eq!(waiting_reason(&wanted), "Waiting for a self-hosted runner with labels self-hosted, linux, gpu.");
783 }
784
785 #[test]
786 fn the_runners_wire_is_snake_case() {
787 let poll: PollArgs = serde_json::from_value(serde_json::json!({
788 "runner": "rnr_1", "credential": "g1tr_x", "version": "0.1.0", "running": ["job_1"], "wait_ms": 1000
789 }))
790 .unwrap();
791 assert_eq!(poll.auth.runner, "rnr_1");
792 assert_eq!(poll.wait_ms, 1000);
793 let assignment = serde_json::to_value(Assignment {
794 kind: "workflow".into(),
795 id: "job_1".into(),
796 name: "build".into(),
797 repo: "acme/web".into(),
798 timeout_minutes: 60,
799 image: None,
800 token: Some("t".into()),
801 env: None,
802 visibility: Some("private".into()),
803 })
804 .unwrap();
805 assert_eq!(assignment["timeout_minutes"], 60);
806 assert_eq!(assignment["visibility"], "private");
807 // An older runner's registration, without an isolation level.
808 let register: RegisterArgs = serde_json::from_value(serde_json::json!({ "token": "g1trt_x", "name": "a", "os": "linux", "arch": "x64" })).unwrap();
809 assert_eq!(register.isolation, None);
810 }
811}