Sign in

flagon-io/g1t

public

g1t/crates/runner/src/actions/uses.rs

390 lines19,656 bytesCodeBlame
1//! `uses:` steps: `actions/checkout` done natively against g1t, actions
2//! fetched from GitHub and run as they are (JavaScript and composite), and
3//! a few of GitHub's own whose services g1t does not have yet.
4
5use std::collections::BTreeMap;
6use std::path::{Path, PathBuf};
7use std::process::Command;
8use std::time::Duration;
9
10use base64::Engine;
11use base64::engine::general_purpose::STANDARD;
12use g1t_actions::expr;
13use g1t_actions::workflow::yaml_to_json;
14use serde_json::{Map, Value, json};
15
16use super::files::StepFiles;
17use super::process::{self, Commands, Ended};
18use super::{Frame, Job, Post, PostRun};
19
20const ACTIONS_DIR: &str = "/home/runner/_actions";
21
22/// Where an action comes from.
23enum Source {
24 Local(PathBuf),
25 GitHub { owner: String, repo: String, path: String, git_ref: String },
26}
27
28fn safe(part: &str) -> bool {
29 !part.is_empty() && part.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.' | '/')) && !part.contains("..")
30}
31
32impl Job {
33 /// Runs a git command, logging it; the credential header is never logged.
34 fn git(&mut self, dir: &Path, args: &[&str], auth: Option<&str>) -> bool {
35 let shown: Vec<&str> = args.to_vec();
36 self.log.line(&format!("[command]git {}", shown.join(" ")));
37 let mut command = Command::new("git");
38 command.current_dir(dir);
39 if let Some(header) = auth {
40 command.args(["-c", &format!("http.extraheader={header}")]);
41 }
42 command.args(args).env("GIT_TERMINAL_PROMPT", "0");
43 let mut commands = Commands::default();
44 matches!(process::run(command, Duration::from_secs(600), &mut self.log, &mut commands), Ok(Ended::Exited(0)))
45 }
46
47 /// A fetch, tried again after a short wait when it fails: a transfer
48 /// cut short on the way ("transfer closed with N bytes remaining") is
49 /// over by the next try. Three tries in all, as actions/checkout does.
50 fn fetch_retrying(&mut self, dir: &Path, args: &[&str], auth: Option<&str>) -> bool {
51 for (attempt, wait) in [0u64, 2, 5].into_iter().enumerate() {
52 if attempt > 0 {
53 self.log.line(&format!("The fetch failed; trying again in {wait} s ({} of 3).", attempt + 1));
54 std::thread::sleep(Duration::from_secs(wait));
55 }
56 if self.git(dir, args, auth) {
57 return true;
58 }
59 }
60 false
61 }
62
63 /// `actions/checkout`, against g1t.
64 fn checkout(&mut self, with: &BTreeMap<String, String>) -> (bool, BTreeMap<String, String>) {
65 let checkout = self.spec["checkout"].clone();
66 let own = checkout["repository"].as_str().unwrap_or_default().to_owned();
67 let server = self.contexts["github"]["server_url"].as_str().unwrap_or("https://g1t.sh").to_owned();
68 let repository = with.get("repository").filter(|r| !r.is_empty()).cloned().unwrap_or(own.clone());
69 let same = repository.eq_ignore_ascii_case(&own);
70 let token = with.get("token").filter(|t| !t.is_empty()).cloned().or_else(|| checkout["token"].as_str().map(str::to_owned)).unwrap_or_default();
71 let url = if same { checkout["url"].as_str().unwrap_or_default().to_owned() } else { format!("{server}/{repository}.git") };
72 let path = with.get("path").filter(|p| !p.is_empty()).map_or(self.workspace.clone(), |p| self.workspace.join(p));
73 let depth: u32 = with.get("fetch-depth").and_then(|d| d.parse().ok()).unwrap_or(1);
74 let wanted_ref = with.get("ref").filter(|r| !r.is_empty()).cloned();
75 let auth = (!token.is_empty()).then(|| format!("AUTHORIZATION: basic {}", STANDARD.encode(format!("x-access-token:{token}"))));
76
77 self.log.line(&format!("Checking out {repository} into {}", path.display()));
78 if path.exists() {
79 let _ = std::fs::remove_dir_all(&path);
80 }
81 if let Err(error) = std::fs::create_dir_all(&path) {
82 self.log.line(&format!("##[error]Could not make {}: {error}", path.display()));
83 return (false, BTreeMap::new());
84 }
85 let _ = Command::new("git").args(["config", "--global", "--add", "safe.directory", "*"]).status();
86 if !self.git(&path, &["init", "--quiet"], None) || !self.git(&path, &["remote", "add", "origin", &url], None) {
87 return (false, BTreeMap::new());
88 }
89
90 // What to fetch, and which commit to end up on.
91 let run_ref = checkout["ref"].as_str().unwrap_or_default().to_owned();
92 let run_sha = checkout["sha"].as_str().unwrap_or_default().to_owned();
93 let is_sha = |r: &str| r.len() == 40 && r.chars().all(|c| c.is_ascii_hexdigit());
94 let (fetch, sha, branch): (String, Option<String>, Option<String>) = match &wanted_ref {
95 Some(r) if is_sha(r) => ("HEAD".into(), Some(r.clone()), None),
96 Some(r) if r.starts_with("refs/") => (r.clone(), None, r.strip_prefix("refs/heads/").map(str::to_owned)),
97 Some(r) => (r.clone(), None, Some(r.clone())),
98 None if same && run_ref.starts_with("refs/pull/") => ("HEAD".into(), Some(run_sha.clone()), None),
99 None if same => (run_ref.clone(), Some(run_sha.clone()), run_ref.strip_prefix("refs/heads/").map(str::to_owned)),
100 None => ("HEAD".into(), None, None),
101 };
102 let depth_arg = format!("--depth={depth}");
103 let mut args = vec!["fetch", "--no-tags", "--prune", "--quiet"];
104 if depth > 0 {
105 args.push(&depth_arg);
106 }
107 if with.get("fetch-tags").is_some_and(|t| t == "true") {
108 args.retain(|a| *a != "--no-tags");
109 }
110 args.push("origin");
111 args.push(&fetch);
112 if !self.fetch_retrying(&path, &args, auth.as_deref()) {
113 self.log.line(&format!("##[error]Could not fetch {fetch} from {repository}."));
114 return (false, BTreeMap::new());
115 }
116 let target = sha.clone().unwrap_or_else(|| "FETCH_HEAD".into());
117 // The commit may be further back than a shallow fetch reaches.
118 let present = Command::new("git").current_dir(&path).args(["cat-file", "-e", &format!("{target}^{{commit}}")]).status().is_ok_and(|s| s.success());
119 if !present && !self.fetch_retrying(&path, &["fetch", "--no-tags", "--quiet", "origin"], auth.as_deref()) {
120 return (false, BTreeMap::new());
121 }
122 let checked_out = match &branch {
123 Some(branch) => self.git(&path, &["checkout", "--quiet", "--force", "-B", branch, &target], None),
124 None => self.git(&path, &["checkout", "--quiet", "--force", "--detach", &target], None),
125 };
126 if !checked_out {
127 return (false, BTreeMap::new());
128 }
129 if with.get("persist-credentials").is_none_or(|p| p != "false")
130 && let Some(header) = &auth
131 {
132 let key = format!("http.{server}/.extraheader");
133 let _ = Command::new("git").current_dir(&path).args(["config", "--local", &key, header]).status();
134 }
135 if let Some(submodules) = with.get("submodules").filter(|s| *s == "true" || *s == "recursive") {
136 let mut args = vec!["submodule", "update", "--init", "--quiet"];
137 if submodules == "recursive" {
138 args.push("--recursive");
139 }
140 if !self.git(&path, &args, auth.as_deref()) {
141 self.log.line("##[warning]Submodules could not all be checked out; only those hosted on g1t can be.");
142 }
143 }
144 if with.get("lfs").is_some_and(|l| l == "true") {
145 self.log.line("##[warning]Git LFS files are not fetched on g1t yet.");
146 }
147 let commit = Command::new("git").current_dir(&path).args(["rev-parse", "HEAD"]).output().ok().map(|o| String::from_utf8_lossy(&o.stdout).trim().to_owned()).unwrap_or_default();
148 self.log.line(&format!("Checked out {commit}"));
149 let mut outputs = BTreeMap::new();
150 outputs.insert("ref".into(), wanted_ref.unwrap_or(run_ref));
151 outputs.insert("commit".into(), commit);
152 (true, outputs)
153 }
154
155 /// Fetches an action from GitHub, once per job.
156 fn fetch_action(&mut self, owner: &str, repo: &str, git_ref: &str) -> Option<PathBuf> {
157 let dir = super::paths::under_home(ACTIONS_DIR).join(owner).join(repo).join(git_ref);
158 if dir.join(".g1t-fetched").exists() {
159 return Some(dir);
160 }
161 if !(safe(owner) && safe(repo) && safe(git_ref)) {
162 self.log.line(&format!("##[error]`{owner}/{repo}@{git_ref}` is not a name g1t can fetch."));
163 return None;
164 }
165 self.log.line(&format!("Download action repository '{owner}/{repo}@{git_ref}'"));
166 let _ = std::fs::create_dir_all(&dir);
167 let url = format!("https://codeload.github.com/{owner}/{repo}/tar.gz/{git_ref}");
168 let script = format!("set -o pipefail; curl -fsSL --retry 3 '{url}' | tar -xz -C '{}' --strip-components=1", dir.display());
169 let mut command = Command::new("bash");
170 command.args(["-c", &script]);
171 let mut commands = Commands::default();
172 match process::run(command, Duration::from_secs(300), &mut self.log, &mut commands) {
173 Ok(Ended::Exited(0)) => {
174 let _ = std::fs::write(dir.join(".g1t-fetched"), "");
175 Some(dir)
176 }
177 _ => {
178 self.log.line(&format!("##[error]Could not download {owner}/{repo}@{git_ref} from GitHub."));
179 let _ = std::fs::remove_dir_all(&dir);
180 None
181 }
182 }
183 }
184
185 /// Runs a JavaScript file of an action with Node.
186 pub(crate) fn run_node(&mut self, action_dir: &Path, script: &str, env: &BTreeMap<String, String>) -> bool {
187 let id = format!("node{}", super::rand_id());
188 let Ok(files) = StepFiles::new(&self.temp, &id) else { return false };
189 let mut command = Command::new("node");
190 command.arg(action_dir.join(script)).current_dir(&self.workspace).env_clear().envs(self.process_env(env, &files));
191 let mut commands = Commands {
192 debug: false,
193 ..Commands::default()
194 };
195 let ended = process::run(command, Duration::from_secs(6 * 3600).min(self.deadline_left()), &mut self.log, &mut commands);
196 let ok = matches!(ended, Ok(Ended::Exited(0)));
197 if let Ok(Ended::Exited(code)) = ended
198 && code != 0
199 {
200 self.log.line(&format!("##[error]The action exited with code {code}."));
201 }
202 let (outputs, state) = self.absorb(&files, &commands);
203 self.last_node_outputs = outputs;
204 self.last_node_state = state;
205 ok
206 }
207
208 fn deadline_left(&self) -> Duration {
209 self.remaining_time()
210 }
211
212 /// Runs a `uses:` step. Returns whether it succeeded, and its outputs.
213 #[allow(clippy::too_many_arguments)]
214 pub(crate) fn uses(
215 &mut self,
216 uses: &str,
217 with: &BTreeMap<String, String>,
218 env: &BTreeMap<String, String>,
219 frame: &Frame,
220 title: &str,
221 id: Option<&str>,
222 _timeout: Duration,
223 ) -> (bool, BTreeMap<String, String>) {
224 let uses = uses.trim();
225 if uses.starts_with("docker://") {
226 self.log.line(&format!("##[error]`{uses}`: Docker actions do not run on g1t yet."));
227 return (false, BTreeMap::new());
228 }
229 let (name, git_ref) = uses.split_once('@').unwrap_or((uses, ""));
230 let lower = name.to_ascii_lowercase();
231 match lower.as_str() {
232 "actions/checkout" => return self.checkout(with),
233 "actions/upload-artifact" => return self.upload_artifact(with),
234 "actions/download-artifact" => return self.download_artifact(with),
235 "actions/cache" => return self.cache(with, true, title),
236 "actions/cache/restore" => return self.cache(with, false, title),
237 "actions/cache/save" => return self.cache_save_now(with),
238 _ => {}
239 }
240 let source = if let Some(local) = name.strip_prefix("./") {
241 // A repository moved from GitHub renamed `.github` to `.g1t`, but
242 // its workflows still say `./.github/actions/…`.
243 let mut dir = self.workspace.join(local);
244 if let Some(rest) = local.strip_prefix(".github/")
245 && !dir.exists()
246 {
247 dir = self.workspace.join(".g1t").join(rest);
248 }
249 Source::Local(dir)
250 } else {
251 let mut parts = name.splitn(3, '/');
252 let (Some(owner), Some(repo)) = (parts.next(), parts.next()) else {
253 self.log.line(&format!("##[error]`{uses}` is not an action: use owner/repo@ref, owner/repo/path@ref, or ./path."));
254 return (false, BTreeMap::new());
255 };
256 if git_ref.is_empty() {
257 self.log.line(&format!("##[error]`{uses}` needs a version, such as @v4."));
258 return (false, BTreeMap::new());
259 }
260 Source::GitHub {
261 owner: owner.to_owned(),
262 repo: repo.to_owned(),
263 path: parts.next().unwrap_or_default().to_owned(),
264 git_ref: git_ref.to_owned(),
265 }
266 };
267 let (dir, repository) = match &source {
268 Source::Local(dir) => (dir.clone(), String::new()),
269 Source::GitHub { owner, repo, path, git_ref } => match self.fetch_action(owner, repo, git_ref) {
270 Some(root) => (if path.is_empty() { root } else { root.join(path) }, format!("{owner}/{repo}")),
271 None => return (false, BTreeMap::new()),
272 },
273 };
274 let manifest = ["action.yml", "action.yaml"].iter().map(|f| dir.join(f)).find(|p| p.exists());
275 let Some(manifest) = manifest else {
276 self.log.line(&format!("##[error]`{uses}` has no action.yml."));
277 return (false, BTreeMap::new());
278 };
279 let action = match std::fs::read_to_string(&manifest).ok().and_then(|text| serde_yaml::from_str::<serde_yaml::Value>(&text).ok()) {
280 Some(yaml) => yaml_to_json(&yaml),
281 None => {
282 self.log.line(&format!("##[error]`{uses}`: its action.yml does not read."));
283 return (false, BTreeMap::new());
284 }
285 };
286
287 // Inputs: what the step gives, else the action's defaults.
288 let env_context = env.clone();
289 let contexts = self.contexts_for(frame, &env_context);
290 let mut inputs: BTreeMap<String, String> = BTreeMap::new();
291 if let Some(Value::Object(declared)) = action.get("inputs") {
292 for (input, spec) in declared {
293 let given = with.iter().find(|(k, _)| k.eq_ignore_ascii_case(input)).map(|(_, v)| v.clone());
294 let value = match given {
295 Some(value) => value,
296 None => match spec.get("default") {
297 Some(default) => {
298 let default = self.with_scope(&contexts, |scope| expr::interpolate_value(default, scope)).unwrap_or(Value::Null);
299 expr::to_text(&default)
300 }
301 None => String::new(),
302 },
303 };
304 inputs.insert(input.clone(), value);
305 }
306 }
307 for (key, value) in with {
308 if !inputs.keys().any(|k| k.eq_ignore_ascii_case(key)) {
309 inputs.insert(key.clone(), value.clone());
310 }
311 }
312
313 let runs = action.get("runs").cloned().unwrap_or(Value::Null);
314 let using = runs.get("using").map(expr::to_text).unwrap_or_default().to_ascii_lowercase();
315 let mut step_env = env.clone();
316 step_env.insert("GITHUB_ACTION".into(), id.map_or_else(|| format!("__{}", repository.replace('/', "_")), str::to_owned));
317 step_env.insert("GITHUB_ACTION_REPOSITORY".into(), repository.clone());
318 step_env.insert("GITHUB_ACTION_REF".into(), git_ref.to_owned());
319 step_env.insert("GITHUB_ACTION_PATH".into(), dir.display().to_string());
320
321 if using.starts_with("node") {
322 for (input, value) in &inputs {
323 step_env.insert(format!("INPUT_{}", input.replace(' ', "_").to_ascii_uppercase()), value.clone());
324 }
325 let condition_of = |key: &str| runs.get(key).map(expr::to_text).unwrap_or_else(|| "always()".into());
326 if let Some(pre) = runs.get("pre").map(expr::to_text) {
327 let run_pre = self.with_scope(&contexts, |scope| expr::condition(&condition_of("pre-if"), scope)).unwrap_or(true);
328 if run_pre && !self.run_node(&dir, &pre, &step_env) {
329 return (false, BTreeMap::new());
330 }
331 }
332 let Some(main) = runs.get("main").map(expr::to_text) else {
333 self.log.line(&format!("##[error]`{uses}` has no `runs.main`."));
334 return (false, BTreeMap::new());
335 };
336 let ok = self.run_node(&dir, &main, &step_env);
337 let outputs = std::mem::take(&mut self.last_node_outputs);
338 let state = std::mem::take(&mut self.last_node_state);
339 if let Some(post) = runs.get("post").map(expr::to_text) {
340 let mut post_env = step_env.clone();
341 for (name, value) in state {
342 post_env.insert(format!("STATE_{name}"), value);
343 }
344 self.posts.push(Post {
345 name: format!("Post {title}"),
346 condition: condition_of("post-if"),
347 env: post_env,
348 run: PostRun::Node { action_dir: dir.clone(), script: post },
349 });
350 }
351 return (ok, outputs);
352 }
353 if using == "composite" {
354 let mut inner = Frame {
355 steps: Map::new(),
356 inputs: Some(Value::Object(inputs.iter().map(|(k, v)| (k.clone(), json!(v))).collect())),
357 action_path: Some(dir.display().to_string()),
358 env: env.clone(),
359 };
360 let steps: Vec<Map<String, Value>> = runs.get("steps").and_then(Value::as_array).map(|s| s.iter().filter_map(|s| s.as_object().cloned()).collect()).unwrap_or_default();
361 let was_failed = self.failed;
362 // A composite's steps see their own success, not the job's.
363 self.failed = false;
364 let mut ok = true;
365 for step in &steps {
366 if !self.step(&mut inner, step, 0, false, &Map::new()) {
367 ok = false;
368 }
369 }
370 let contexts = self.contexts_for(&inner, &inner.env.clone());
371 let mut outputs = BTreeMap::new();
372 if let Some(Value::Object(declared)) = action.get("outputs") {
373 for (name, spec) in declared {
374 if let Some(value) = spec.get("value") {
375 let value = self.with_scope(&contexts, |scope| expr::interpolate_value(value, scope)).unwrap_or(Value::Null);
376 outputs.insert(name.clone(), expr::to_text(&value));
377 }
378 }
379 }
380 self.failed = was_failed;
381 return (ok, outputs);
382 }
383 if using == "docker" {
384 self.log.line(&format!("##[error]`{uses}` is a Docker action, which does not run on g1t yet."));
385 return (false, BTreeMap::new());
386 }
387 self.log.line(&format!("##[error]`{uses}` runs with `{using}`, which g1t does not know."));
388 (false, BTreeMap::new())
389 }
390}