Skip to content
Sign up

flagon-io/g1t

public
0
904 linesCodeBlameRaw
1//! Runs one GitHub Actions job, as GitHub's runner would: its steps in
2//! order, each `run` in a shell and each `uses` as the action it names,
3//! with the `${{ }}` contexts, the `GITHUB_*` variables and files, and the
4//! workflow commands steps print. It reports every step and the log to
5//! g1t as it goes.
6//!
7//! Configuration comes from the environment: `G1T_API`, and `ACTIONS_JOB`
8//! and `ACTIONS_TOKEN`, the job and its own token. Everything else, the
9//! job's definition, its contexts and its secrets, is fetched with them.
10
11mod blobs;
12mod containers;
13mod files;
14mod glob;
15mod paths;
16mod process;
17mod report;
18mod uses;
19/// Also unpacks the plugins a run gets from Customize (customize.rs).
20pub(crate) mod zip;
21
22use std::collections::{BTreeMap, BTreeSet};
23use std::path::{Path, PathBuf};
24use std::process::Command;
25use std::time::{Duration, Instant};
26
27use anyhow::{Context, Result};
28use g1t_actions::events::WORKSPACE;
29use g1t_actions::expr::{self, Scope, Status};
30use serde_json::{Map, Value, json};
31
32use files::StepFiles;
33use process::{Commands, Ended};
34use report::{Api, Log};
35
36const TEMP: &str = "/home/runner/_temp";
37
38/// Who is running steps: the job itself, or a composite action inside it.
39#[derive(Clone, Default)]
40pub(crate) struct Frame {
41 /// The `steps` context.
42 pub(crate) steps: Map<String, Value>,
43 /// A composite action's `inputs`, in place of the workflow's.
44 pub(crate) inputs: Option<Value>,
45 /// A composite action's folder, for `github.action_path`.
46 pub(crate) action_path: Option<String>,
47 /// Variables a composite action's caller set for its steps.
48 pub(crate) env: BTreeMap<String, String>,
49}
50
51/// A step run when the job's steps are done: an action's `post`, or
52/// saving the cache.
53pub(crate) struct Post {
54 pub(crate) name: String,
55 pub(crate) condition: String,
56 pub(crate) env: BTreeMap<String, String>,
57 pub(crate) run: PostRun,
58}
59
60pub(crate) enum PostRun {
61 Node { action_dir: PathBuf, script: String },
62 CacheSave { key: String, paths: Vec<String>, version: String },
63 /// A Docker action's `post-entrypoint`.
64 Docker(containers::DockerRun),
65}
66
67pub(crate) struct Job {
68 pub(crate) log: Log,
69 pub(crate) spec: Value,
70 pub(crate) workspace: PathBuf,
71 pub(crate) temp: PathBuf,
72 /// This process's own variables, less its credentials, and GitHub's.
73 base_env: BTreeMap<String, String>,
74 /// Written to `GITHUB_ENV` by earlier steps.
75 added_env: BTreeMap<String, String>,
76 /// Written to `GITHUB_PATH` by earlier steps, newest first.
77 path_prepend: Vec<String>,
78 workflow_env: BTreeMap<String, String>,
79 job_env: BTreeMap<String, String>,
80 /// github, vars, secrets, inputs, matrix, needs, strategy, runner.
81 pub(crate) contexts: Map<String, Value>,
82 pub(crate) failed: bool,
83 pub(crate) posts: Vec<Post>,
84 step_names: Vec<String>,
85 deadline: Instant,
86 /// The running step's `timeout-minutes`, as an instant: the nearest of
87 /// the step's own and those of the steps around it (a composite
88 /// action's step inside a `uses:` step). Every process a step starts
89 /// stops by it, as every one stops by the job's deadline.
90 step_deadline: Option<Instant>,
91 debug: bool,
92 /// What the last Node process left, for the step that ran it.
93 pub(crate) last_node_outputs: BTreeMap<String, String>,
94 pub(crate) last_node_state: BTreeMap<String, String>,
95 /// The names of the sandbox's own variables, which a container does
96 /// not get.
97 host_env: BTreeSet<String>,
98 /// Whether this job has a Docker Engine of its own (g1t's machines).
99 pub(crate) docker_hosted: bool,
100 /// The job's network, once its containers have one.
101 pub(crate) network: Option<String>,
102 /// `services:`, by their names, and their containers' names.
103 pub(crate) services: Vec<(String, String)>,
104 /// `container:`, once started.
105 pub(crate) container: Option<containers::JobContainer>,
106 /// The `job` context's `container` and `services`.
107 pub(crate) job_context: Map<String, Value>,
108 /// Docker actions' images built in this job.
109 pub(crate) built_actions: containers::Built,
110}
111
112fn text_map(value: Option<&Value>) -> BTreeMap<String, String> {
113 value
114 .and_then(Value::as_object)
115 .map(|map| map.iter().map(|(k, v)| (k.clone(), expr::to_text(v))).collect())
116 .unwrap_or_default()
117}
118
119/// A step's title when it has no name, as GitHub shows it.
120fn default_title(step: &Map<String, Value>) -> String {
121 if let Some(uses) = step.get("uses").and_then(Value::as_str) {
122 return format!("Run {uses}");
123 }
124 let run = step.get("run").map(expr::to_text).unwrap_or_default();
125 let first = run.lines().find(|line| !line.trim().is_empty()).unwrap_or_default().trim();
126 format!("Run {first}")
127}
128
129impl Job {
130 pub(crate) fn base_env_value(&self, name: &str) -> Option<String> {
131 self.base_env.get(name).cloned()
132 }
133
134 /// What earlier steps added to `PATH`, newest first.
135 pub(crate) fn path_prepend_entries(&self) -> &[String] {
136 &self.path_prepend
137 }
138
139 /// How the job is going, for `success()`, `failure()`, `cancelled()`
140 /// and `always()`: once the run is cancelled, only steps that ask for
141 /// `always()` or `cancelled()` run.
142 fn status(&self) -> Status {
143 if report::cancelled() {
144 Status::Cancelled
145 } else if self.failed {
146 Status::Failure
147 } else {
148 Status::Success
149 }
150 }
151
152 /// `job.status`.
153 fn status_word(&self) -> &'static str {
154 if report::cancelled() {
155 "cancelled"
156 } else if self.failed {
157 "failure"
158 } else {
159 "success"
160 }
161 }
162
163 /// The contexts an expression in a step can use.
164 pub(crate) fn contexts_for(&self, frame: &Frame, env: &BTreeMap<String, String>) -> Map<String, Value> {
165 let mut contexts = self.contexts.clone();
166 contexts.insert("env".into(), Value::Object(env.iter().map(|(k, v)| (k.clone(), Value::String(v.clone()))).collect()));
167 contexts.insert("steps".into(), Value::Object(frame.steps.clone()));
168 contexts.insert("job".into(), containers::job_context(self.status_word(), &self.job_context));
169 if let Some(inputs) = &frame.inputs {
170 contexts.insert("inputs".into(), inputs.clone());
171 }
172 if let Some(path) = &frame.action_path
173 && let Some(github) = contexts.get_mut("github")
174 {
175 github["action_path"] = Value::String(path.clone());
176 }
177 contexts
178 }
179
180 /// Runs `f` with a scope over these contexts.
181 pub(crate) fn with_scope<T>(&self, contexts: &Map<String, Value>, f: impl FnOnce(&Scope) -> T) -> T {
182 let workspace = self.workspace.clone();
183 let hash = move |patterns: &[String]| files::hash_files(&workspace, patterns);
184 let scope = Scope {
185 contexts,
186 status: self.status(),
187 hash_files: Some(&hash),
188 };
189 f(&scope)
190 }
191
192 /// The `env` context for a step: the workflow's, the job's, what earlier
193 /// steps wrote to `GITHUB_ENV`, and the frame's.
194 pub(crate) fn env_context(&self, frame: &Frame) -> BTreeMap<String, String> {
195 let mut env = self.added_env.clone();
196 env.extend(self.workflow_env.clone());
197 env.extend(self.job_env.clone());
198 env.extend(frame.env.clone());
199 env
200 }
201
202 /// What a process for a step is given.
203 pub(crate) fn process_env(&self, env: &BTreeMap<String, String>, files: &StepFiles) -> BTreeMap<String, String> {
204 let mut out = self.base_env.clone();
205 out.extend(env.clone());
206 for (name, value) in files.variables() {
207 out.insert(name.to_owned(), value);
208 }
209 if !self.path_prepend.is_empty() {
210 let current = out.get("PATH").cloned().unwrap_or_default();
211 let separator = paths::PATH_SEPARATOR;
212 out.insert("PATH".into(), format!("{}{separator}{current}", self.path_prepend.join(separator)));
213 }
214 out
215 }
216
217 /// Takes in what a step wrote to its files. Returns its outputs.
218 pub(crate) fn absorb(&mut self, files: &StepFiles, commands: &Commands) -> (BTreeMap<String, String>, BTreeMap<String, String>) {
219 let mut outputs: BTreeMap<String, String> = commands.outputs.clone();
220 match files::key_values(&StepFiles::read(&files.output)) {
221 Ok(values) => outputs.extend(values),
222 Err(problem) => self.log.line(&format!("##[error]$GITHUB_OUTPUT: {problem}")),
223 }
224 match files::key_values(&StepFiles::read(&files.env)) {
225 Ok(values) => {
226 for (name, value) in values {
227 if name.starts_with("GITHUB_") || name == "NODE_OPTIONS" {
228 self.log.line(&format!("##[warning]{name} cannot be set through $GITHUB_ENV."));
229 continue;
230 }
231 self.added_env.insert(name, value);
232 }
233 }
234 Err(problem) => self.log.line(&format!("##[error]$GITHUB_ENV: {problem}")),
235 }
236 for line in StepFiles::read(&files.path).lines().map(str::trim).filter(|l| !l.is_empty()) {
237 self.path_prepend.insert(0, line.to_owned());
238 }
239 let mut state = commands.state.clone();
240 if let Ok(values) = files::key_values(&StepFiles::read(&files.state)) {
241 state.extend(values);
242 }
243 // The step's job summary, for the run's page (report.rs).
244 self.log.summary(&StepFiles::read(&files.summary));
245 (outputs, state)
246 }
247
248 pub(crate) fn remaining_time(&self) -> Duration {
249 self.remaining()
250 }
251
252 /// What is left for the running step: its `timeout-minutes`, within
253 /// the job's.
254 fn remaining(&self) -> Duration {
255 let until = self.step_deadline.map_or(self.deadline, |step| step.min(self.deadline));
256 until.saturating_duration_since(Instant::now())
257 }
258
259 /// What is left of the job's own time, whatever the step's.
260 fn job_remaining(&self) -> Duration {
261 self.deadline.saturating_duration_since(Instant::now())
262 }
263
264 /// Runs a shell script for a `run` step.
265 pub(crate) fn run_script(
266 &mut self,
267 script: &str,
268 shell: Option<&str>,
269 working_directory: Option<&str>,
270 env: &BTreeMap<String, String>,
271 timeout: Duration,
272 ) -> (bool, BTreeMap<String, String>, BTreeMap<String, String>) {
273 crate::abuse::touch();
274 // Mining is never a workflow's job (abuse.rs).
275 if let Some(miner) = crate::abuse::miner_in(script) {
276 self.log.line(&format!("##[error]g1t does not run cryptocurrency miners ({miner}). This step was not run."));
277 return (false, BTreeMap::new(), BTreeMap::new());
278 }
279 let id = format!("{:x}", rand_id());
280 let shell = shell.map(str::trim).filter(|s| !s.is_empty());
281 let (program, args, extension): (String, Vec<String>, &str) = match shell {
282 // A self-hosted Windows runner, as GitHub's: PowerShell.
283 None if cfg!(windows) => (windows_powershell(), powershell_args(), "ps1"),
284 // A job container without bash, as GitHub's runner does.
285 None if self.container.as_ref().is_some_and(|c| c.shell == "sh") => ("sh".into(), vec!["-e".into(), "{0}".into()], "sh"),
286 None => ("bash".into(), vec!["-e".into(), "{0}".into()], "sh"),
287 Some("bash") => ("bash".into(), vec!["--noprofile".into(), "--norc".into(), "-eo".into(), "pipefail".into(), "{0}".into()], "sh"),
288 Some("sh") => ("sh".into(), vec!["-e".into(), "{0}".into()], "sh"),
289 Some("python") => ("python3".into(), vec!["{0}".into()], "py"),
290 Some("pwsh") if cfg!(windows) || program_exists("pwsh") => ("pwsh".into(), powershell_args(), "ps1"),
291 Some("powershell") if cfg!(windows) => ("powershell".into(), powershell_args(), "ps1"),
292 Some("cmd") if cfg!(windows) => (
293 "cmd".into(),
294 vec!["/D".into(), "/E:ON".into(), "/V:OFF".into(), "/S".into(), "/C".into(), "CALL \"{0}\"".into()],
295 "cmd",
296 ),
297 Some(other @ ("pwsh" | "powershell" | "cmd")) => {
298 self.log.line(&format!(
299 "##[error]`shell: {other}` needs Windows or PowerShell, which g1t's Linux runners do not have. A self-hosted Windows runner can run it: `runs-on: [self-hosted, windows]`."
300 ));
301 return (false, BTreeMap::new(), BTreeMap::new());
302 }
303 Some(custom) => {
304 let mut parts = custom.split_whitespace().map(str::to_owned);
305 let program = parts.next().unwrap_or_default();
306 let mut args: Vec<String> = parts.collect();
307 if !args.iter().any(|a| a.contains("{0}")) {
308 args.push("{0}".into());
309 }
310 (program, args, "sh")
311 }
312 };
313 let script_path = self.temp.join(format!("{id}.{extension}"));
314 if let Err(error) = std::fs::write(&script_path, script) {
315 self.log.line(&format!("##[error]Could not write the script: {error}"));
316 return (false, BTreeMap::new(), BTreeMap::new());
317 }
318 let files = match StepFiles::new(&self.temp, &id) {
319 Ok(files) => files,
320 Err(error) => {
321 self.log.line(&format!("##[error]Could not make the step's files: {error}"));
322 return (false, BTreeMap::new(), BTreeMap::new());
323 }
324 };
325 let args: Vec<String> = args.iter().map(|a| a.replace("{0}", &paths::shown(&script_path))).collect();
326 self.log.line(&format!("shell: {program} {}", args.join(" ")));
327 let dir = match working_directory {
328 Some(dir) if Path::new(dir).is_absolute() => PathBuf::from(dir),
329 Some(dir) => self.workspace.join(dir),
330 None => self.workspace.clone(),
331 };
332 let full = self.process_env(env, &files);
333 let in_container = self.container.as_ref().map(|c| c.path.clone()).and_then(|image_path| {
334 let inside = self.container_env(env, full.clone(), &image_path);
335 self.in_container(&program, &args, &dir, inside)
336 });
337 let command = match in_container {
338 Some(command) => command,
339 None => {
340 let mut command = Command::new(&program);
341 command.args(&args).current_dir(&dir).env_clear().envs(full);
342 command
343 }
344 };
345 let mut commands = Commands {
346 debug: self.debug,
347 ..Commands::default()
348 };
349 let ended = process::run(command, timeout.min(self.remaining()), &mut self.log, &mut commands);
350 let ok = match ended {
351 Ok(Ended::Exited(0)) => true,
352 Ok(Ended::Exited(code)) => {
353 self.log.line(&format!("##[error]Process completed with exit code {code}."));
354 false
355 }
356 Ok(Ended::TimedOut) => {
357 self.log.line("##[error]The step ran past its time limit and was stopped.");
358 false
359 }
360 Ok(Ended::Cancelled) => false,
361 Err(error) => {
362 self.log.line(&format!("##[error]{program} could not be started: {error}"));
363 false
364 }
365 };
366 let (outputs, state) = self.absorb(&files, &commands);
367 (ok, outputs, state)
368 }
369
370 /// Runs one step of a frame. Returns whether it succeeded (its
371 /// conclusion). `number` is the step the log belongs to.
372 pub(crate) fn step(&mut self, frame: &mut Frame, step: &Map<String, Value>, number: u32, report: bool, defaults: &Map<String, Value>) -> bool {
373 // A cancellation heard during an earlier step (which it stopped) or
374 // since: from here on, only cleanup steps run, and none is stopped
375 // for it again.
376 if report::cancelled() {
377 report::take_cancel();
378 }
379 let env_before = self.env_context(frame);
380 let contexts = self.contexts_for(frame, &env_before);
381 let title = match step.get("name").map(expr::to_text) {
382 Some(name) => self.with_scope(&contexts, |scope| expr::interpolate(&name, scope)).unwrap_or(name),
383 None => default_title(step),
384 };
385 let condition = step.get("if").map(expr::to_text).unwrap_or_default();
386 let read = self.with_scope(&contexts, |scope| expr::condition(&condition, scope));
387 // Debug logging: how the step's `if` read, as GitHub's runner says.
388 if self.debug {
389 let shown = if condition.trim().is_empty() { "success()" } else { condition.trim() };
390 self.log.line(&format!("##[debug]Evaluating condition for step: '{title}'"));
391 self.log.line(&format!("##[debug]Evaluating: {shown}"));
392 match &read {
393 Ok(result) => self.log.line(&format!("##[debug]Result: {result}")),
394 Err(problem) => self.log.line(&format!("##[debug]Failed: {problem}")),
395 }
396 }
397 let run_it = match read {
398 Ok(run_it) => run_it,
399 Err(problem) => {
400 self.log.line(&format!("##[error]The step's `if` does not read: {problem}"));
401 self.failed = true;
402 if report {
403 self.log.step_state(number, &title, "completed", Some("failure"));
404 }
405 return false;
406 }
407 };
408 let id = step.get("id").map(expr::to_text);
409 if !run_it {
410 if let Some(id) = &id {
411 frame.steps.insert(id.clone(), json!({ "outputs": {}, "outcome": "skipped", "conclusion": "skipped" }));
412 }
413 if report {
414 self.log.step_state(number, &title, "completed", Some("skipped"));
415 }
416 return true;
417 }
418 if report {
419 self.log.step(number);
420 self.log.step_state(number, &title, "in_progress", None);
421 }
422
423 // The step's own env, read with the contexts before it.
424 let mut env = env_before.clone();
425 if let Some(Value::Object(step_env)) = step.get("env") {
426 for (name, value) in step_env {
427 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
428 env.insert(name.clone(), expr::to_text(&value));
429 }
430 }
431 let minutes = step
432 .get("timeout-minutes")
433 .and_then(|v| self.with_scope(&contexts, |scope| expr::interpolate_value(v, scope)).ok())
434 .and_then(|v| v.as_f64().or_else(|| expr::to_text(&v).parse().ok()));
435 let timeout = step_timeout(minutes);
436 // Every step stops at its own `timeout-minutes`, `run` or `uses`: a
437 // `uses:` step's action, and every process it starts, included.
438 let outer_deadline = self.step_deadline;
439 self.step_deadline = step_deadline(outer_deadline, Instant::now(), minutes);
440 let continue_on_error = step
441 .get("continue-on-error")
442 .and_then(|v| self.with_scope(&contexts, |scope| expr::interpolate_value(v, scope)).ok())
443 .is_some_and(|v| expr::truthy(&v));
444
445 let (ok, outputs) = if let Some(run) = step.get("run").map(expr::to_text) {
446 let script = match self.with_scope(&contexts, |scope| expr::interpolate(&run, scope)) {
447 Ok(script) => script,
448 Err(problem) => {
449 self.log.line(&format!("##[error]The script does not read: {problem}"));
450 String::new()
451 }
452 };
453 self.log.line(&format!("##[group]{title}"));
454 for line in script.lines() {
455 self.log.line(line);
456 }
457 self.log.line("##[endgroup]");
458 let shell = step
459 .get("shell")
460 .map(expr::to_text)
461 .or_else(|| defaults.get("shell").map(expr::to_text));
462 if frame.action_path.is_some() && shell.is_none() {
463 self.log.line("##[error]A composite action's `run` steps need a `shell`.");
464 (false, BTreeMap::new())
465 } else {
466 let working_directory = step
467 .get("working-directory")
468 .or_else(|| defaults.get("working-directory"))
469 .map(|v| self.with_scope(&contexts, |scope| expr::interpolate(&expr::to_text(v), scope)).unwrap_or_else(|_| expr::to_text(v)));
470 let mut env = env;
471 if let Some(path) = &frame.action_path {
472 env.insert("GITHUB_ACTION_PATH".into(), path.clone());
473 }
474 let (ok, outputs, _) = self.run_script(&script, shell.as_deref(), working_directory.as_deref(), &env, timeout);
475 (ok, outputs)
476 }
477 } else if let Some(uses) = step.get("uses").map(expr::to_text) {
478 let with: BTreeMap<String, String> = match step.get("with") {
479 Some(Value::Object(with)) => with
480 .iter()
481 .map(|(k, v)| {
482 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(v, scope)).unwrap_or(Value::Null);
483 (k.clone(), expr::to_text(&value))
484 })
485 .collect(),
486 _ => BTreeMap::new(),
487 };
488 self.uses(&uses, &with, &env, frame, &title, id.as_deref(), timeout)
489 } else {
490 self.log.line("##[error]A step needs `run` or `uses`.");
491 (false, BTreeMap::new())
492 };
493 let own_deadline = self.step_deadline.filter(|_| self.step_deadline != outer_deadline);
494 self.step_deadline = outer_deadline;
495 let ok = if own_deadline.is_some_and(|until| Instant::now() >= until) {
496 self.log.line(&format!(
497 "##[error]The step ran past its timeout-minutes ({}) and was stopped.",
498 minutes.unwrap_or_default()
499 ));
500 false
501 } else {
502 ok
503 };
504
505 // A step the cancellation stopped ends cancelled, not failed.
506 let stopped = !ok && report::cancelled();
507 let outcome = if ok {
508 "success"
509 } else if stopped {
510 "cancelled"
511 } else {
512 "failure"
513 };
514 let conclusion = if ok || continue_on_error {
515 "success"
516 } else {
517 outcome
518 };
519 if !ok && continue_on_error && !stopped {
520 self.log.line("##[warning]The step failed, and `continue-on-error` lets the job go on.");
521 }
522 if let Some(id) = &id {
523 let outputs: Map<String, Value> = outputs.iter().map(|(k, v)| (k.clone(), Value::String(v.clone()))).collect();
524 frame.steps.insert(id.clone(), json!({ "outputs": outputs, "outcome": outcome, "conclusion": conclusion }));
525 }
526 if conclusion == "failure" {
527 self.failed = true;
528 }
529 if report {
530 self.log.step_state(number, &title, "completed", Some(conclusion));
531 }
532 conclusion == "success"
533 }
534
535 fn report_steps(&self) {
536 self.log.steps(&self.step_names);
537 }
538}
539
540/// How long a step's processes may run: its `timeout-minutes`, or six
541/// hours (the job's own limit still applies).
542fn step_timeout(minutes: Option<f64>) -> Duration {
543 match minutes {
544 Some(minutes) if minutes.is_finite() && minutes > 0.0 => Duration::from_secs_f64(minutes * 60.0),
545 Some(_) => Duration::ZERO,
546 None => Duration::from_secs(6 * 3600),
547 }
548}
549
550/// When a step must end by: its `timeout-minutes` from `now`, or `outer`
551/// (the deadline of the `uses:` step it runs inside, for a composite
552/// action's step), whichever is nearer. None when neither sets one.
553fn step_deadline(outer: Option<Instant>, now: Instant, minutes: Option<f64>) -> Option<Instant> {
554 let own = minutes.map(|minutes| now + step_timeout(Some(minutes)));
555 match (outer, own) {
556 (Some(outer), Some(own)) => Some(outer.min(own)),
557 (outer, own) => outer.or(own),
558 }
559}
560
561/// PowerShell on Windows: `pwsh` (PowerShell 7) if it is installed, as on
562/// GitHub's Windows runners, else Windows PowerShell.
563fn windows_powershell() -> String {
564 if program_exists("pwsh") { "pwsh".into() } else { "powershell".into() }
565}
566
567/// How GitHub runs a PowerShell step: the script, stopping at the first error.
568fn powershell_args() -> Vec<String> {
569 vec!["-NoLogo".into(), "-NoProfile".into(), "-NonInteractive".into(), "-Command".into(), ". '{0}'".into()]
570}
571
572/// Whether `program` is on `PATH`.
573fn program_exists(program: &str) -> bool {
574 Command::new(program)
575 .arg(if program == "cmd" { "/C" } else { "-Version" })
576 .stdout(std::process::Stdio::null())
577 .stderr(std::process::Stdio::null())
578 .status()
579 .is_ok()
580}
581
582/// An id for files, unique enough within one job.
583fn rand_id() -> u64 {
584 use std::sync::atomic::{AtomicU64, Ordering};
585 static NEXT: AtomicU64 = AtomicU64::new(1);
586 let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos() as u64).unwrap_or(0);
587 nanos ^ (NEXT.fetch_add(1, Ordering::Relaxed) << 48)
588}
589
590fn interpolated_map(job: &Job, value: Option<&Value>, contexts: &Map<String, Value>) -> BTreeMap<String, String> {
591 let mut out = BTreeMap::new();
592 if let Some(Value::Object(map)) = value {
593 for (name, value) in map {
594 let value = job.with_scope(contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
595 out.insert(name.clone(), expr::to_text(&value));
596 }
597 }
598 out
599}
600
601/// Whether `::debug::` lines are shown and steps' conditions explained:
602/// `ACTIONS_STEP_DEBUG` as a secret or a variable set to `true`, or a
603/// re-run with debug logging, which sets it and `RUNNER_DEBUG=1` among the
604/// job's variables.
605fn step_debug(contexts: &Map<String, Value>, variables: &Value) -> bool {
606 let named = |name: &str| {
607 contexts
608 .get("secrets")
609 .and_then(|s| s.get(name))
610 .or_else(|| contexts.get("vars").and_then(|v| v.get(name)))
611 .or_else(|| variables.get(name))
612 .is_some_and(|v| expr::to_text(v).eq_ignore_ascii_case("true"))
613 };
614 named("ACTIONS_STEP_DEBUG") || variables.get("RUNNER_DEBUG").is_some_and(|v| expr::to_text(v) == "1")
615}
616
617fn setup(mut spec: Value, api: Api) -> Result<Job> {
618 let masks: Vec<String> = spec["masks"].as_array().map(|m| m.iter().filter_map(|v| v.as_str().map(str::to_owned)).collect()).unwrap_or_default();
619 let log = Log::new(api, masks);
620 // On a self-hosted runner's own machine, GitHub's layout lives in a
621 // folder of the runner's (paths.rs).
622 for part in ["variables", "github"] {
623 paths::relocate(&mut spec[part]);
624 }
625 paths::relocate(&mut spec["contexts"]["runner"]);
626 let workspace = paths::under_home(WORKSPACE);
627 let temp = paths::under_home(TEMP);
628 std::fs::create_dir_all(&workspace).context("could not make the workspace")?;
629 std::fs::create_dir_all(&temp).context("could not make the temporary folder")?;
630 std::fs::write(temp.join("event.json"), serde_json::to_string_pretty(&spec["event"])?)?;
631
632 let host_env: BTreeSet<String> = std::env::vars().map(|(name, _)| name).collect();
633 // Docker of the job's own, on g1t's machines (crate::docker).
634 let docker_hosted = cfg!(target_os = "linux")
635 && std::env::var("G1T_DOCKER").as_deref() == Ok("on")
636 && spec["variables"]["RUNNER_ENVIRONMENT"].as_str() != Some("self-hosted");
637 // This process's environment, less what only it should see.
638 let mut base_env: BTreeMap<String, String> =
639 std::env::vars().filter(|(name, _)| !matches!(name.as_str(), "ACTIONS_TOKEN" | "ACTIONS_JOB" | "MODE") && !name.starts_with("G1T_")).collect();
640 base_env.insert("HOME".into(), std::env::var("HOME").unwrap_or_else(|_| "/home/node".into()));
641 base_env.extend(text_map(spec.get("variables")));
642 base_env.insert("GITHUB_EVENT_PATH".into(), paths::shown(&temp.join("event.json")));
643
644 let mut contexts: Map<String, Value> = spec["contexts"].as_object().cloned().unwrap_or_default();
645 contexts.insert("github".into(), spec["github"].clone());
646 let debug = step_debug(&contexts, &spec["variables"]);
647
648 // `timeoutMinutes` is how the API spelled it before its bodies were
649 // `snake_case`.
650 let timeout = spec["timeout_minutes"]
651 .as_u64()
652 .or_else(|| spec["timeoutMinutes"].as_u64())
653 .unwrap_or(60);
654 let mut job = Job {
655 log,
656 spec,
657 workspace,
658 temp,
659 base_env,
660 added_env: BTreeMap::new(),
661 path_prepend: Vec::new(),
662 workflow_env: BTreeMap::new(),
663 job_env: BTreeMap::new(),
664 contexts,
665 failed: false,
666 posts: Vec::new(),
667 step_names: Vec::new(),
668 deadline: Instant::now() + Duration::from_secs(timeout * 60),
669 step_deadline: None,
670 debug,
671 last_node_outputs: BTreeMap::new(),
672 last_node_state: BTreeMap::new(),
673 host_env,
674 docker_hosted,
675 network: None,
676 services: Vec::new(),
677 container: None,
678 job_context: Map::new(),
679 built_actions: containers::Built::new(),
680 };
681
682 // The workflow's env reads github, secrets, inputs and vars; the job's
683 // also its matrix, needs and strategy.
684 let mut contexts = job.contexts.clone();
685 contexts.insert("env".into(), json!({}));
686 job.workflow_env = interpolated_map(&job, job.spec["workflow"].get("env"), &contexts);
687 contexts.insert("env".into(), Value::Object(job.workflow_env.iter().map(|(k, v)| (k.clone(), json!(v))).collect()));
688 job.job_env = interpolated_map(&job, job.spec["spec"].get("env"), &contexts);
689 Ok(job)
690}
691
692/// The job's `defaults.run`, its own over the workflow's.
693fn run_defaults(spec: &Value) -> Map<String, Value> {
694 let mut defaults = spec["workflow"]["defaults"]["run"].as_object().cloned().unwrap_or_default();
695 if let Some(own) = spec["spec"]["defaults"]["run"].as_object() {
696 defaults.extend(own.clone());
697 }
698 defaults
699}
700
701fn run_job(job: &mut Job) {
702 let steps: Vec<Map<String, Value>> = job.spec["spec"]["steps"]
703 .as_array()
704 .map(|steps| steps.iter().filter_map(|s| s.as_object().cloned()).collect())
705 .unwrap_or_default();
706 let defaults = run_defaults(&job.spec);
707
708 // Step names as they read before anything has run.
709 let frame = Frame::default();
710 let env = job.env_context(&frame);
711 let contexts = job.contexts_for(&frame, &env);
712 job.step_names = steps
713 .iter()
714 .map(|step| match step.get("name").map(expr::to_text) {
715 Some(name) => job.with_scope(&contexts, |scope| expr::interpolate(&name, scope)).unwrap_or(name),
716 None => default_title(step),
717 })
718 .collect();
719 job.report_steps();
720
721 job.log.step(0);
722 job.log.line(&format!("Job: {}", job.spec["name"].as_str().unwrap_or_default()));
723 let variables = &job.spec["variables"];
724 if variables["RUNNER_ENVIRONMENT"] == "self-hosted" {
725 let text = |name: &str| variables[name].as_str().unwrap_or_default().to_owned();
726 job.log.line(&format!("Runner: {}, self-hosted, {} {}", text("RUNNER_NAME"), text("RUNNER_OS"), text("RUNNER_ARCH")));
727 } else {
728 job.log.line("Runner: g1t, Linux X64 (Debian bookworm, Node 24, Python 3, Go, Rust)");
729 }
730 if let Some(Value::Object(matrix)) = job.contexts.get("matrix")
731 && !matrix.is_empty()
732 {
733 job.log.line(&format!("Matrix: {}", serde_json::to_string(matrix).unwrap_or_default()));
734 }
735 // What its G1T_TOKEN may do, as its `permissions:` gave it.
736 if let Some(Value::Object(permissions)) = job.spec.get("permissions").cloned() {
737 job.log.line("##[group]G1T_TOKEN permissions");
738 for (name, access) in &permissions {
739 if access.as_str() != Some("none") {
740 job.log.line(&format!("{name}: {}", access.as_str().unwrap_or_default()));
741 }
742 }
743 job.log.line("##[endgroup]");
744 }
745 if job.docker_hosted {
746 let registry = job.contexts["github"]["server_url"].as_str().and_then(crate::docker::engine::registry_host);
747 let token = job.contexts.get("secrets").and_then(|s| s.get("G1T_TOKEN")).map(expr::to_text).filter(|t| !t.is_empty());
748 let options = crate::docker::engine::Options { registry: registry.zip(token) };
749 if let Err(problem) = crate::docker::engine::enable(options) {
750 job.log.line(&format!("##[warning]Docker is not available in this job: {problem}"));
751 job.docker_hosted = false;
752 }
753 }
754 // Actions first, then containers, as GitHub's "Set up job" and
755 // "Initialize containers".
756 let containers_started = job.prepare_actions(&steps) && job.start_containers();
757 job.log.flush();
758
759 let mut frame = Frame::default();
760 if !containers_started {
761 job.failed = true;
762 for (index, name) in job.step_names.clone().iter().enumerate() {
763 job.log.step_state(index as u32 + 1, name, "completed", Some("skipped"));
764 }
765 }
766 for (index, step) in steps.iter().enumerate().filter(|_| containers_started) {
767 job.step(&mut frame, step, index as u32 + 1, true, &defaults);
768 job.log_docker_notes();
769 if job.job_remaining().is_zero() {
770 job.log.line("##[error]The job ran past its time limit.");
771 job.failed = true;
772 break;
773 }
774 }
775
776 // Post steps, last registered first.
777 let posts: Vec<Post> = std::mem::take(&mut job.posts);
778 for post in posts.into_iter().rev() {
779 let number = job.step_names.len() as u32 + 1;
780 job.step_names.push(post.name.clone());
781 job.report_steps();
782 let contexts = job.contexts_for(&frame, &job.env_context(&frame));
783 let run_it = job.with_scope(&contexts, |scope| expr::condition(&post.condition, scope)).unwrap_or(true);
784 if !run_it {
785 job.log.step_state(number, &post.name, "completed", Some("skipped"));
786 continue;
787 }
788 job.log.step(number);
789 job.log.step_state(number, &post.name, "in_progress", None);
790 let ok = match &post.run {
791 PostRun::Node { action_dir, script } => job.run_node(action_dir, script, &post.env),
792 PostRun::CacheSave { key, paths, version } => job.cache_save(key, paths, version),
793 PostRun::Docker(run) => job.run_docker(run).0,
794 };
795 job.log.step_state(number, &post.name, "completed", Some(if ok { "success" } else { "failure" }));
796 if !ok {
797 job.failed = true;
798 }
799 }
800
801 // GitHub's "Stop containers": services' logs, and everything removed.
802 if job.has_containers() {
803 let number = job.step_names.len() as u32 + 1;
804 job.step_names.push("Stop containers".into());
805 job.report_steps();
806 job.log.step(number);
807 job.log.step_state(number, "Stop containers", "in_progress", None);
808 job.stop_containers();
809 job.log.step_state(number, "Stop containers", "completed", Some("success"));
810 }
811
812 // The job's outputs, read now that every step has run.
813 let env = job.env_context(&frame);
814 let contexts = job.contexts_for(&frame, &env);
815 let mut outputs = Map::new();
816 if let Some(Value::Object(declared)) = job.spec["spec"].get("outputs") {
817 for (name, value) in declared {
818 let value = job.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
819 outputs.insert(name.clone(), Value::String(expr::to_text(&value)));
820 }
821 }
822 // Cancelled, the job ends so however its cleanup went (and g1t holds
823 // to that whatever it is told).
824 let conclusion = if report::cancelled() {
825 "cancelled"
826 } else if job.failed {
827 "failure"
828 } else {
829 "success"
830 };
831 job.log.done(conclusion, &outputs, None);
832}
833
834pub(crate) fn main() -> i32 {
835 let api = match (crate::env("G1T_API"), crate::env("ACTIONS_JOB"), crate::env("ACTIONS_TOKEN")) {
836 (Ok(base), Ok(job), Ok(token)) => Api { base, job, token },
837 _ => {
838 eprintln!("g1t-runner: G1T_API, ACTIONS_JOB and ACTIONS_TOKEN are needed");
839 return 2;
840 }
841 };
842 let spec = match api.spec() {
843 Ok(spec) => spec,
844 Err(error) => {
845 eprintln!("g1t-runner: could not fetch the job: {error:#}");
846 api.report(json!({ "kind": "done", "conclusion": "failure", "reason": format!("The runner could not fetch the job: {error}") }));
847 return 1;
848 }
849 };
850 let reporter = Api {
851 base: api.base.clone(),
852 job: api.job.clone(),
853 token: api.token.clone(),
854 };
855 let mut job = match setup(spec, reporter) {
856 Ok(job) => job,
857 Err(error) => {
858 api.report(json!({ "kind": "done", "conclusion": "failure", "reason": format!("The runner could not set up: {error:#}") }));
859 return 1;
860 }
861 };
862 run_job(&mut job);
863 if job.failed || report::cancelled() { 1 } else { 0 }
864}
865
866#[cfg(test)]
867mod tests {
868 use serde_json::{Map, Value, json};
869
870 use super::*;
871
872 #[test]
873 fn debug_logging_comes_from_a_secret_a_variable_or_a_debug_rerun() {
874 let contexts = |value: Value| -> Map<String, Value> { serde_json::from_value(value).unwrap() };
875 let none = json!({});
876 assert!(!step_debug(&contexts(json!({ "secrets": {}, "vars": {} })), &none));
877 assert!(step_debug(&contexts(json!({ "secrets": { "ACTIONS_STEP_DEBUG": "true" } })), &none));
878 assert!(step_debug(&contexts(json!({ "vars": { "ACTIONS_STEP_DEBUG": "TRUE" } })), &none));
879 assert!(!step_debug(&contexts(json!({ "vars": { "ACTIONS_STEP_DEBUG": "false" } })), &none));
880 // A re-run with debug logging sets these among the job's variables.
881 assert!(step_debug(&contexts(json!({})), &json!({ "RUNNER_DEBUG": "1" })));
882 assert!(step_debug(&contexts(json!({})), &json!({ "ACTIONS_STEP_DEBUG": "true" })));
883 assert!(!step_debug(&contexts(json!({})), &json!({ "RUNNER_DEBUG": "0" })));
884 }
885
886 #[test]
887 fn a_steps_timeout_is_its_own_or_the_nearer_one_around_it() {
888 let now = Instant::now();
889 // No timeout-minutes anywhere: only the job's deadline applies.
890 assert_eq!(step_deadline(None, now, None), None);
891 // A step's own, in minutes, fractions included.
892 assert_eq!(step_deadline(None, now, Some(1.5)), Some(now + Duration::from_secs(90)));
893 // A composite action's step inside a `uses:` step with its own:
894 // the nearer of the two.
895 let outer = now + Duration::from_secs(60);
896 assert_eq!(step_deadline(Some(outer), now, Some(10.0)), Some(outer));
897 assert_eq!(step_deadline(Some(outer), now, Some(0.5)), Some(now + Duration::from_secs(30)));
898 assert_eq!(step_deadline(Some(outer), now, None), Some(outer));
899 // Zero or less is a time already up.
900 assert_eq!(step_deadline(None, now, Some(0.0)), Some(now));
901 assert_eq!(step_timeout(None), Duration::from_secs(6 * 3600));
902 assert_eq!(step_timeout(Some(-1.0)), Duration::ZERO);
903 }
904}