mirror of
https://github.com/go-gitea/gitea.git
synced 2026-07-30 20:37:52 +00:00
9dc04289aa
before: gitrepo vs git packages after: git package fully handle all git operations by the way, use `WithRepo(repo)` instead of `WithDir(repo.Path)` to hide path details. benefits: 1. remove all unnecessary wrappers, developers no need to struggle with "which package should be used" 2. simplify code, RepositoryFacade can (will) be used everywhere, all "path" details are (will be) hidden
783 lines
33 KiB
Go
783 lines
33 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
"time"
|
|
|
|
runnerv1 "gitea.dev/actions-proto-go/runner/v1"
|
|
actions_model "gitea.dev/models/actions"
|
|
auth_model "gitea.dev/models/auth"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/git"
|
|
"gitea.dev/modules/json"
|
|
api "gitea.dev/modules/structs"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestActionsReusableWorkflow(t *testing.T) {
|
|
onGiteaRun(t, func(t *testing.T, u *url.URL) {
|
|
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
user2Session := loginUser(t, user2.Name)
|
|
user2Token := getTokenForLoggedInUser(t, user2Session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
|
|
user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
|
|
user4Session := loginUser(t, user4.Name)
|
|
user4Token := getTokenForLoggedInUser(t, user4Session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
|
|
|
|
t.Run("Same-repo reusable workflow", func(t *testing.T) {
|
|
apiRepo := createActionsTestRepo(t, user2Token, "workflow-call-test", false)
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
|
|
|
|
defaultRunner := newMockRunner()
|
|
defaultRunner.registerAsRepoRunner(t, repo.OwnerName, repo.Name, "mock-default-runner", []string{"ubuntu-latest"}, false)
|
|
customRunner := newMockRunner()
|
|
customRunner.registerAsRepoRunner(t, repo.OwnerName, repo.Name, "mock-custom-runner", []string{"custom-os"}, false)
|
|
|
|
// add a variable for test
|
|
req := NewRequestWithJSON(t, "POST",
|
|
fmt.Sprintf("/api/v1/repos/%s/%s/actions/variables/myvar", repo.OwnerName, repo.Name), &api.CreateVariableOption{
|
|
Value: "abcdef",
|
|
}).
|
|
AddTokenAuth(user2Token)
|
|
MakeRequest(t, req, http.StatusCreated)
|
|
// add a secret for test
|
|
req = NewRequestWithJSON(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/%s/actions/secrets/mysecret", repo.OwnerName, repo.Name), api.CreateOrUpdateSecretOption{
|
|
Data: "secRET-t0Ken",
|
|
}).AddTokenAuth(user2Token)
|
|
MakeRequest(t, req, http.StatusCreated)
|
|
|
|
createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/reusable1.yaml",
|
|
`name: Reusable1
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
str_input:
|
|
type: string
|
|
num_input:
|
|
type: number
|
|
bool_input:
|
|
type: boolean
|
|
parent_var:
|
|
type: string
|
|
needs_out:
|
|
type: string
|
|
secrets:
|
|
PARENT_TOKEN:
|
|
outputs:
|
|
r1_out:
|
|
value: ${{ jobs.reusable1_job2.outputs.r1j2_out }}
|
|
|
|
jobs:
|
|
reusable1_job1:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo 'reusable1_job1'
|
|
|
|
reusable1_job2:
|
|
needs: [reusable1_job1]
|
|
outputs:
|
|
r1j2_out: ${{ steps.gen_r1j2_output.outputs.out }}
|
|
runs-on: custom-os
|
|
steps:
|
|
- id: gen_r1j2_output
|
|
run: |
|
|
echo "out=r1j2_out_data" >> "$GITHUB_OUTPUT"
|
|
|
|
reusable1_job3:
|
|
needs: [reusable1_job2]
|
|
uses: ./.gitea/workflows/reusable2.yaml
|
|
with:
|
|
msg: ${{ inputs.str_input }}
|
|
`)
|
|
|
|
createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/reusable2.yaml",
|
|
`name: Reusable2
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
msg:
|
|
type: string
|
|
|
|
jobs:
|
|
reusable2_job1:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo ${{ inputs.msg }}
|
|
`)
|
|
|
|
createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/caller.yaml",
|
|
`name: Caller
|
|
on:
|
|
push:
|
|
paths:
|
|
- '.gitea/workflows/caller.yaml'
|
|
jobs:
|
|
caller_job1:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
prepared: ${{ steps.gen_output.outputs.pd }}
|
|
steps:
|
|
- id: gen_output
|
|
run: |
|
|
echo "pd=prepared_data" >> "$GITHUB_OUTPUT"
|
|
|
|
caller_job2:
|
|
needs: [caller_job1]
|
|
uses: './.gitea/workflows/reusable1.yaml'
|
|
with:
|
|
str_input: 'from_caller_job2'
|
|
num_input: ${{ 2.3e2 }}
|
|
bool_input: ${{ gitea.event_name == 'push' }}
|
|
parent_var: ${{ vars.myvar }}
|
|
needs_out: ${{ needs.caller_job1.outputs.prepared }}
|
|
secrets:
|
|
PARENT_TOKEN: ${{ secrets.mysecret }}
|
|
|
|
caller_job3:
|
|
needs: [caller_job2]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: |
|
|
echo ${{ needs.caller_job1.outputs.r1_out }}
|
|
`)
|
|
|
|
var (
|
|
runID int64
|
|
callerJob2ID, callerJob2AttemptJobID int64
|
|
callerJob3AttemptJobID int64
|
|
r1Job2ID, r1Job2AttemptJobID int64
|
|
r1Job3ID, r1Job3AttemptJobID int64
|
|
r2Job1AttemptJobID int64
|
|
)
|
|
|
|
t.Run("Check initialized jobs", func(t *testing.T) {
|
|
// run
|
|
assert.Equal(t, 1, unittest.GetCount(t, &actions_model.ActionRun{RepoID: repo.ID}))
|
|
run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: repo.ID})
|
|
runID = run.ID
|
|
|
|
// caller_job1
|
|
assert.Equal(t, 3, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID}))
|
|
callerJob1 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "caller_job1"})
|
|
assert.Equal(t, actions_model.StatusWaiting, callerJob1.Status)
|
|
assert.False(t, callerJob1.IsReusableCaller)
|
|
|
|
// caller_job2
|
|
callerJob2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "caller_job2"})
|
|
callerJob2ID = callerJob2.ID
|
|
callerJob2AttemptJobID = callerJob2.AttemptJobID
|
|
assert.Equal(t, actions_model.StatusBlocked, callerJob2.Status)
|
|
assert.True(t, callerJob2.IsReusableCaller)
|
|
|
|
// caller_job3
|
|
callerJob3 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "caller_job3"})
|
|
callerJob3AttemptJobID = callerJob3.AttemptJobID
|
|
assert.Equal(t, actions_model.StatusBlocked, callerJob3.Status)
|
|
assert.False(t, callerJob3.IsReusableCaller)
|
|
})
|
|
|
|
t.Run("First run", func(t *testing.T) {
|
|
callerJob1Task := defaultRunner.fetchTask(t) // for caller_job1
|
|
_, callerJob1, _ := getTaskAndJobAndRunByTaskID(t, callerJob1Task.Id)
|
|
assert.Equal(t, "caller_job1", callerJob1.JobID)
|
|
defaultRunner.fetchNoTask(t)
|
|
defaultRunner.execTask(t, callerJob1Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
outputs: map[string]string{
|
|
"prepared": "prepared_data",
|
|
},
|
|
})
|
|
|
|
r1Job1Task := defaultRunner.fetchTask(t) // for reusable1_job1
|
|
_, r1Job1, _ := getTaskAndJobAndRunByTaskID(t, r1Job1Task.Id)
|
|
assert.Equal(t, "reusable1_job1", r1Job1.JobID)
|
|
assert.Equal(t, callerJob2ID, r1Job1.ParentJobID)
|
|
payload := getWorkflowCallPayloadFromTask(t, r1Job1Task)
|
|
if assert.Len(t, payload.Inputs, 5) {
|
|
assert.Equal(t, "from_caller_job2", payload.Inputs["str_input"])
|
|
assert.EqualValues(t, 230, payload.Inputs["num_input"])
|
|
assert.Equal(t, true, payload.Inputs["bool_input"])
|
|
assert.Equal(t, "abcdef", payload.Inputs["parent_var"])
|
|
assert.Equal(t, "prepared_data", payload.Inputs["needs_out"])
|
|
}
|
|
if assert.Len(t, r1Job1Task.Secrets, 3) {
|
|
assert.Contains(t, r1Job1Task.Secrets, "GITEA_TOKEN")
|
|
assert.Contains(t, r1Job1Task.Secrets, "GITHUB_TOKEN")
|
|
assert.Equal(t, "secRET-t0Ken", r1Job1Task.Secrets["PARENT_TOKEN"])
|
|
}
|
|
customRunner.fetchNoTask(t)
|
|
defaultRunner.execTask(t, r1Job1Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
})
|
|
|
|
// reusable1_job3 (a nested caller) needs reusable1_job2, so it stays Blocked until r1j2 succeeds.
|
|
r1Job3Pre := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable1_job3"})
|
|
assert.Equal(t, actions_model.StatusBlocked, r1Job3Pre.Status)
|
|
assert.False(t, r1Job3Pre.IsExpanded)
|
|
assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable2_job1"}))
|
|
|
|
r1Job2Task := customRunner.fetchTask(t) // for reusable1_job2
|
|
_, r1Job2, _ := getTaskAndJobAndRunByTaskID(t, r1Job2Task.Id)
|
|
assert.Equal(t, "reusable1_job2", r1Job2.JobID)
|
|
r1Job2ID = r1Job2.ID
|
|
r1Job2AttemptJobID = r1Job2.AttemptJobID
|
|
if assert.Len(t, r1Job2Task.Needs, 1) {
|
|
assert.Contains(t, r1Job2Task.Needs, "reusable1_job1")
|
|
assert.Equal(t, runnerv1.Result_RESULT_SUCCESS, r1Job2Task.Needs["reusable1_job1"].Result)
|
|
}
|
|
customRunner.execTask(t, r1Job2Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
outputs: map[string]string{
|
|
"r1j2_out": "r1j2_out_data",
|
|
},
|
|
})
|
|
|
|
// Now reusable1_job3 expands and reusable2_job1 becomes runnable.
|
|
r1Job3 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable1_job3"})
|
|
assert.True(t, r1Job3.IsReusableCaller)
|
|
assert.True(t, r1Job3.IsExpanded)
|
|
assert.Equal(t, callerJob2ID, r1Job3.ParentJobID)
|
|
r1Job3ID = r1Job3.ID
|
|
r1Job3AttemptJobID = r1Job3.AttemptJobID
|
|
r2Job1 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable2_job1"})
|
|
assert.Equal(t, r1Job3ID, r2Job1.ParentJobID)
|
|
r2Job1AttemptJobID = r2Job1.AttemptJobID
|
|
|
|
r2Job1Task := defaultRunner.fetchTask(t) // for reusable2_job1
|
|
_, fetchedR2Job1, _ := getTaskAndJobAndRunByTaskID(t, r2Job1Task.Id)
|
|
assert.Equal(t, "reusable2_job1", fetchedR2Job1.JobID)
|
|
assert.Equal(t, r1Job3ID, fetchedR2Job1.ParentJobID)
|
|
r2Job1Payload := getWorkflowCallPayloadFromTask(t, r2Job1Task)
|
|
if assert.Len(t, r2Job1Payload.Inputs, 1) {
|
|
assert.Equal(t, "from_caller_job2", r2Job1Payload.Inputs["msg"])
|
|
}
|
|
defaultRunner.execTask(t, r2Job1Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
})
|
|
|
|
callerJob2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: callerJob2ID})
|
|
assert.Equal(t, actions_model.StatusSuccess, callerJob2.Status)
|
|
|
|
callerJob3Task := defaultRunner.fetchTask(t) // for caller_job3
|
|
_, callerJob3, _ := getTaskAndJobAndRunByTaskID(t, callerJob3Task.Id)
|
|
assert.Equal(t, "caller_job3", callerJob3.JobID)
|
|
if assert.Len(t, callerJob3Task.Needs, 1) {
|
|
assert.Contains(t, callerJob3Task.Needs, "caller_job2")
|
|
assert.Equal(t, runnerv1.Result_RESULT_SUCCESS, callerJob3Task.Needs["caller_job2"].Result)
|
|
if assert.Len(t, callerJob3Task.Needs["caller_job2"].Outputs, 1) {
|
|
assert.Equal(t, "r1j2_out_data", callerJob3Task.Needs["caller_job2"].Outputs["r1_out"])
|
|
}
|
|
}
|
|
defaultRunner.execTask(t, callerJob3Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
})
|
|
callerRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
|
|
assert.Equal(t, actions_model.StatusSuccess, callerRun.Status)
|
|
})
|
|
|
|
t.Run("Rerun 'reusable1_job2'", func(t *testing.T) {
|
|
req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d/rerun", repo.OwnerName, repo.Name, runID, r1Job2ID))
|
|
user2Session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
|
|
assert.Equal(t, actions_model.StatusWaiting, run.Status)
|
|
attempt2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunAttempt{RunID: runID, Attempt: 2})
|
|
assert.Equal(t, actions_model.StatusWaiting, attempt2.Status)
|
|
callerJob2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: callerJob2AttemptJobID})
|
|
assert.Equal(t, actions_model.StatusWaiting, callerJob2.Status)
|
|
callerJob3 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: callerJob3AttemptJobID})
|
|
assert.Equal(t, actions_model.StatusBlocked, callerJob3.Status)
|
|
|
|
// reusable1_job3 needs reusable1_job2, so rerunning r1j2 pulls r1j3 (and its subtree) into the rerun set
|
|
r1Job3Attempt2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: r1Job3AttemptJobID})
|
|
assert.Equal(t, actions_model.StatusBlocked, r1Job3Attempt2.Status)
|
|
assert.True(t, r1Job3Attempt2.IsReusableCaller)
|
|
assert.False(t, r1Job3Attempt2.IsExpanded)
|
|
assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, JobID: "reusable2_job1"}))
|
|
|
|
defaultRunner.fetchNoTask(t)
|
|
r1Job2Task := customRunner.fetchTask(t)
|
|
_, r1Job2, _ := getTaskAndJobAndRunByTaskID(t, r1Job2Task.Id)
|
|
assert.Equal(t, "reusable1_job2", r1Job2.JobID)
|
|
assert.Equal(t, callerJob2.ID, r1Job2.ParentJobID)
|
|
assert.Equal(t, r1Job2AttemptJobID, r1Job2.AttemptJobID)
|
|
assert.Equal(t, actions_model.StatusRunning, r1Job2.Status)
|
|
run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
|
|
assert.Equal(t, actions_model.StatusRunning, run.Status)
|
|
customRunner.execTask(t, r1Job2Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
outputs: map[string]string{
|
|
"r1j2_out": "r1j2_out_data_updated",
|
|
},
|
|
})
|
|
|
|
// r1j3 expands again. Its child reuses the AttemptJobID from attempt 1
|
|
r1Job3Attempt2 = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: r1Job3AttemptJobID})
|
|
assert.True(t, r1Job3Attempt2.IsExpanded)
|
|
r2Job1Attempt2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, JobID: "reusable2_job1"})
|
|
assert.Equal(t, r2Job1AttemptJobID, r2Job1Attempt2.AttemptJobID)
|
|
assert.Equal(t, r1Job3Attempt2.ID, r2Job1Attempt2.ParentJobID)
|
|
|
|
r2Job1Task := defaultRunner.fetchTask(t)
|
|
_, fetchedR2Job1, _ := getTaskAndJobAndRunByTaskID(t, r2Job1Task.Id)
|
|
assert.Equal(t, "reusable2_job1", fetchedR2Job1.JobID)
|
|
defaultRunner.execTask(t, r2Job1Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
})
|
|
|
|
callerJob2 = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: callerJob2.ID})
|
|
assert.Equal(t, actions_model.StatusSuccess, callerJob2.Status)
|
|
|
|
callerJob3Task := defaultRunner.fetchTask(t)
|
|
_, callerJob3, _ = getTaskAndJobAndRunByTaskID(t, callerJob3Task.Id)
|
|
assert.Equal(t, "caller_job3", callerJob3.JobID)
|
|
if assert.Len(t, callerJob3Task.Needs, 1) {
|
|
assert.Contains(t, callerJob3Task.Needs, "caller_job2")
|
|
assert.Equal(t, runnerv1.Result_RESULT_SUCCESS, callerJob3Task.Needs["caller_job2"].Result)
|
|
if assert.Len(t, callerJob3Task.Needs["caller_job2"].Outputs, 1) {
|
|
assert.Equal(t, "r1j2_out_data_updated", callerJob3Task.Needs["caller_job2"].Outputs["r1_out"])
|
|
}
|
|
}
|
|
defaultRunner.execTask(t, callerJob3Task, &mockTaskOutcome{
|
|
result: runnerv1.Result_RESULT_SUCCESS,
|
|
})
|
|
attempt2 = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunAttempt{RunID: runID, Attempt: 2})
|
|
assert.Equal(t, actions_model.StatusSuccess, attempt2.Status)
|
|
run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
|
|
assert.Equal(t, actions_model.StatusSuccess, run.Status)
|
|
})
|
|
})
|
|
|
|
t.Run("Cross-repo reusable workflow with collaborative owner", func(t *testing.T) {
|
|
// libRepo: private, owned by user2.
|
|
libAPIRepo := createActionsTestRepo(t, user2Token, "reusable-lib-private", true)
|
|
libRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: libAPIRepo.ID})
|
|
createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/reusable_lib.yaml",
|
|
`name: ReusableLib
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
from:
|
|
type: string
|
|
|
|
jobs:
|
|
lib_job:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo hello-${{ inputs.from }}
|
|
`)
|
|
|
|
// consumerRepo: private, owned by user4.
|
|
consumerAPIRepo := createActionsTestRepo(t, user4Token, "workflow-call-cross-repo", true)
|
|
consumerRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: consumerAPIRepo.ID})
|
|
|
|
runner := newMockRunner()
|
|
runner.registerAsRepoRunner(t, consumerRepo.OwnerName, consumerRepo.Name, "mock-cross-runner", []string{"ubuntu-latest"}, false)
|
|
|
|
createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/cross-caller.yaml",
|
|
`name: CrossCaller
|
|
on: push
|
|
jobs:
|
|
cross_job:
|
|
uses: user2/reusable-lib-private/.gitea/workflows/reusable_lib.yaml@main
|
|
with:
|
|
from: 'consumer'
|
|
`)
|
|
|
|
// Phase 1: no grant. The cross-repo read check fails, and NO ActionRun row gets persisted.
|
|
assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRun{RepoID: consumerRepo.ID}))
|
|
runner.fetchNoTask(t)
|
|
|
|
// Phase 2: user2 (libRepo owner) adds user4 (consumer owner) as a Collaborative Owner of libRepo.
|
|
addCollabReq := NewRequestWithValues(t, "POST",
|
|
fmt.Sprintf("/%s/%s/settings/actions/general/collaborative_owner/add", libRepo.OwnerName, libRepo.Name),
|
|
map[string]string{"collaborative_owner": user4.Name})
|
|
user2Session.MakeRequest(t, addCollabReq, http.StatusOK)
|
|
|
|
// Phase 3: trigger the workflow again
|
|
createRepoWorkflowFile(t, user4, user4Token, consumerRepo, "marker.txt", "trigger after grant")
|
|
|
|
run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: consumerRepo.ID})
|
|
crossJob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "cross_job"})
|
|
assert.True(t, crossJob.IsReusableCaller)
|
|
assert.True(t, crossJob.IsExpanded)
|
|
assert.Equal(t, actions_model.StatusWaiting, crossJob.Status)
|
|
|
|
libJobTask := runner.fetchTask(t)
|
|
_, fetchedLibJob, _ := getTaskAndJobAndRunByTaskID(t, libJobTask.Id)
|
|
assert.Equal(t, "lib_job", fetchedLibJob.JobID)
|
|
assert.Equal(t, crossJob.ID, fetchedLibJob.ParentJobID)
|
|
assert.Equal(t, consumerRepo.ID, fetchedLibJob.RepoID)
|
|
payload := getWorkflowCallPayloadFromTask(t, libJobTask)
|
|
if assert.Len(t, payload.Inputs, 1) {
|
|
assert.Equal(t, "consumer", payload.Inputs["from"])
|
|
}
|
|
crossJob = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: crossJob.ID})
|
|
assert.Equal(t, actions_model.StatusRunning, crossJob.Status)
|
|
runner.execTask(t, libJobTask, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
|
|
|
|
crossJob = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: crossJob.ID})
|
|
assert.Equal(t, actions_model.StatusSuccess, crossJob.Status)
|
|
run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
|
|
assert.Equal(t, actions_model.StatusSuccess, run.Status)
|
|
})
|
|
|
|
t.Run("Public caller denied private target even with collaborative owner", func(t *testing.T) {
|
|
// Isolates the run.Repo.IsPrivate gate: a public caller must be denied a private target even with a
|
|
// collaborative-owner grant, since allowing it would expose private workflow content in a public run.
|
|
|
|
// libRepo: private, owned by user2.
|
|
libAPIRepo := createActionsTestRepo(t, user2Token, "reusable-lib-public-denied", true)
|
|
libRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: libAPIRepo.ID})
|
|
createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/reusable_lib.yaml",
|
|
`name: ReusableLib
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
lib_job:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo hello
|
|
`)
|
|
|
|
// Grant first: user2 adds user4 as a collaborative owner of the private libRepo, so the grant is
|
|
// satisfied and the public-caller gate is the only thing that can deny access.
|
|
addCollabReq := NewRequestWithValues(t, "POST",
|
|
fmt.Sprintf("/%s/%s/settings/actions/general/collaborative_owner/add", libRepo.OwnerName, libRepo.Name),
|
|
map[string]string{"collaborative_owner": user4.Name})
|
|
user2Session.MakeRequest(t, addCollabReq, http.StatusOK)
|
|
|
|
// consumerRepo: public, owned by user4.
|
|
consumerAPIRepo := createActionsTestRepo(t, user4Token, "workflow-call-public-denied", false)
|
|
consumerRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: consumerAPIRepo.ID})
|
|
|
|
runner := newMockRunner()
|
|
runner.registerAsRepoRunner(t, consumerRepo.OwnerName, consumerRepo.Name, "mock-public-denied-runner", []string{"ubuntu-latest"}, false)
|
|
|
|
createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/cross-caller.yaml",
|
|
`name: CrossCaller
|
|
on: push
|
|
jobs:
|
|
cross_job:
|
|
uses: user2/reusable-lib-public-denied/.gitea/workflows/reusable_lib.yaml@main
|
|
`)
|
|
|
|
// Denied: the cross-repo read check fails for the public caller, so NO ActionRun is persisted and no task is dispatched.
|
|
assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRun{RepoID: consumerRepo.ID}))
|
|
runner.fetchNoTask(t)
|
|
})
|
|
|
|
t.Run("Cross-repo callee with same-repo nested uses", func(t *testing.T) {
|
|
// A same-repo `uses: ./...` inside a cross-repo reusable callee must resolve relative to the callee's own repo (matching GitHub's behavior), not the original triggering repo.
|
|
|
|
// Place a util.yaml with a distinguishable job name in BOTH repos to detect mis-resolution.
|
|
|
|
libAPIRepo := createActionsTestRepo(t, user2Token, "reusable-lib-nested", false)
|
|
libRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: libAPIRepo.ID})
|
|
createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/util.yaml",
|
|
`name: UtilLib
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
util_lib_job:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo from-lib
|
|
`)
|
|
createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/lib.yaml",
|
|
`name: LibNested
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
call_util_in_lib:
|
|
uses: ./.gitea/workflows/util.yaml
|
|
`)
|
|
|
|
consumerAPIRepo := createActionsTestRepo(t, user4Token, "consumer-nested-uses", false)
|
|
consumerRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: consumerAPIRepo.ID})
|
|
|
|
// A *different* util.yaml in the consumer repo: if `./` mis-resolves we'd see this job's name.
|
|
createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/util.yaml",
|
|
`name: UtilConsumer
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
util_consumer_job:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo from-consumer
|
|
`)
|
|
|
|
runner := newMockRunner()
|
|
runner.registerAsRepoRunner(t, consumerRepo.OwnerName, consumerRepo.Name, "mock-nested-runner", []string{"ubuntu-latest"}, false)
|
|
|
|
createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/caller.yaml",
|
|
`name: NestedCaller
|
|
on: push
|
|
jobs:
|
|
cross_job:
|
|
uses: user2/reusable-lib-nested/.gitea/workflows/lib.yaml@main
|
|
`)
|
|
|
|
run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: consumerRepo.ID})
|
|
crossJob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "cross_job"})
|
|
assert.True(t, crossJob.IsReusableCaller)
|
|
assert.True(t, crossJob.IsExpanded)
|
|
|
|
// cross_job's children come from libRepo/lib.yaml - their source must be libRepo + libRepo's commit.
|
|
libHead, err := git.GetBranchCommitID(t.Context(), libRepo, libRepo.DefaultBranch)
|
|
require.NoError(t, err)
|
|
callUtilJob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "call_util_in_lib", ParentJobID: crossJob.ID})
|
|
assert.True(t, callUtilJob.IsReusableCaller)
|
|
assert.Equal(t, libRepo.ID, callUtilJob.WorkflowSourceRepoID)
|
|
assert.Equal(t, libHead, callUtilJob.WorkflowSourceCommitSHA)
|
|
|
|
// call_util_in_lib has `uses: ./.gitea/workflows/util.yaml`, so its children should come from libRepo/util.yaml
|
|
assert.True(t, callUtilJob.IsExpanded)
|
|
unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "util_lib_job", ParentJobID: callUtilJob.ID})
|
|
unittest.AssertNotExistsBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "util_consumer_job"})
|
|
})
|
|
|
|
t.Run("Missing callee file", func(t *testing.T) {
|
|
// A caller workflow references a callee path that does not exist in the repo.
|
|
|
|
apiRepo := createActionsTestRepo(t, user2Token, "caller-missing-callee", false)
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
|
|
|
|
createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/caller.yaml",
|
|
`name: Caller
|
|
on: push
|
|
jobs:
|
|
plain_job:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo 'job'
|
|
call_missing:
|
|
uses: ./.gitea/workflows/does-not-exist.yml
|
|
`)
|
|
|
|
assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRun{RepoID: repo.ID}))
|
|
})
|
|
|
|
t.Run("Fork PR with secrets: inherit does not leak base repo secrets", func(t *testing.T) {
|
|
// user2 owns the base repo, configures a secret, and registers a reusable workflow that declares a required secret.
|
|
// The caller workflow uses `secrets: inherit`.
|
|
|
|
apiBaseRepo := createActionsTestRepo(t, user2Token, "fork-pr-inherit-test", false)
|
|
baseRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiBaseRepo.ID})
|
|
user2APICtx := NewAPITestContext(t, baseRepo.OwnerName, baseRepo.Name, auth_model.AccessTokenScopeWriteRepository)
|
|
defer doAPIDeleteRepository(user2APICtx)(t)
|
|
|
|
// Real secret that must never reach a fork PR task.
|
|
req := NewRequestWithJSON(t, "PUT",
|
|
fmt.Sprintf("/api/v1/repos/%s/%s/actions/secrets/leaked_secret", baseRepo.OwnerName, baseRepo.Name),
|
|
api.CreateOrUpdateSecretOption{Data: "MUST-NOT-LEAK"}).AddTokenAuth(user2Token)
|
|
MakeRequest(t, req, http.StatusCreated)
|
|
|
|
runner := newMockRunner()
|
|
runner.registerAsRepoRunner(t, baseRepo.OwnerName, baseRepo.Name, "mock-fork-runner", []string{"ubuntu-latest"}, false)
|
|
|
|
createRepoWorkflowFile(t, user2, user2Token, baseRepo, ".gitea/workflows/reusable.yaml",
|
|
`name: Reusable
|
|
on:
|
|
workflow_call:
|
|
secrets:
|
|
leaked_secret:
|
|
|
|
jobs:
|
|
callee:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo
|
|
`)
|
|
createRepoWorkflowFile(t, user2, user2Token, baseRepo, ".gitea/workflows/caller.yaml",
|
|
`name: Caller
|
|
on: pull_request
|
|
jobs:
|
|
call_reusable:
|
|
uses: ./.gitea/workflows/reusable.yaml
|
|
secrets: inherit
|
|
`)
|
|
|
|
// user4 forks
|
|
req = NewRequestWithJSON(t, "POST",
|
|
fmt.Sprintf("/api/v1/repos/%s/%s/forks", baseRepo.OwnerName, baseRepo.Name),
|
|
&api.CreateForkOption{Name: new("fork-pr-inherit-test-fork")}).AddTokenAuth(user4Token)
|
|
resp := MakeRequest(t, req, http.StatusAccepted)
|
|
apiForkRepo := DecodeJSON(t, resp, &api.Repository{})
|
|
forkRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiForkRepo.ID})
|
|
user4APICtx := NewAPITestContext(t, user4.Name, forkRepo.Name, auth_model.AccessTokenScopeWriteRepository)
|
|
defer doAPIDeleteRepository(user4APICtx)(t)
|
|
|
|
// user4 pushes a change on the fork and opens a PR to base
|
|
doAPICreateFile(user4APICtx, "user4-fix.txt", &api.CreateFileOptions{
|
|
FileOptions: api.FileOptions{
|
|
NewBranchName: "user4/branch",
|
|
Message: "create user4-fix.txt",
|
|
Author: api.Identity{Name: user4.Name, Email: user4.Email},
|
|
Committer: api.Identity{Name: user4.Name, Email: user4.Email},
|
|
Dates: api.CommitDateOptions{Author: time.Now(), Committer: time.Now()},
|
|
},
|
|
ContentBase64: base64.StdEncoding.EncodeToString([]byte("fix")),
|
|
})(t)
|
|
doAPICreatePullRequest(user4APICtx, baseRepo.OwnerName, baseRepo.Name, baseRepo.DefaultBranch, user4.Name+":user4/branch")(t)
|
|
|
|
// Approve the fork PR run.
|
|
forkRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: baseRepo.ID, TriggerUserID: user4.ID})
|
|
assert.True(t, forkRun.IsForkPullRequest)
|
|
req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/approve", baseRepo.OwnerName, baseRepo.Name, forkRun.ID))
|
|
user2Session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
task := runner.fetchTask(t)
|
|
_, taskJob, taskRun := getTaskAndJobAndRunByTaskID(t, task.Id)
|
|
assert.Equal(t, "callee", taskJob.JobID)
|
|
assert.Equal(t, forkRun.ID, taskRun.ID)
|
|
|
|
// Only the auto-issued tokens should be present. The user-defined `leaked_secret` must not appear.
|
|
assert.Contains(t, task.Secrets, "GITEA_TOKEN")
|
|
assert.Contains(t, task.Secrets, "GITHUB_TOKEN")
|
|
assert.NotContains(t, task.Secrets, "leaked_secret")
|
|
for name, value := range task.Secrets {
|
|
assert.NotEqual(t, "MUST-NOT-LEAK", value, "secret %q leaked the base repo's secret value into a fork PR task", name)
|
|
}
|
|
|
|
runner.execTask(t, task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
|
|
})
|
|
|
|
t.Run("Caller alternates expanding across attempts", func(t *testing.T) {
|
|
apiRepo := createActionsTestRepo(t, user2Token, "caller-walkback-test", false)
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
|
|
|
|
runner := newMockRunner()
|
|
runner.registerAsRepoRunner(t, repo.OwnerName, repo.Name, "mock-walkback-runner", []string{"ubuntu-latest"}, false)
|
|
|
|
// Scenario:
|
|
// attempt 1: gate succeeds -> caller expands -> inner runs (records inner.AttemptJobID = N)
|
|
// attempt 2: rerun gate, mock Failure -> caller is Skipped without expanding (no children inserted)
|
|
// attempt 3: rerun gate, mock Success -> caller expands again -> inner.AttemptJobID must equal N
|
|
|
|
createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/lib.yaml",
|
|
`name: Lib
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
inner:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo inner
|
|
`)
|
|
createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/main.yaml",
|
|
`name: Main
|
|
on:
|
|
push:
|
|
paths:
|
|
- '.gitea/workflows/main.yaml'
|
|
jobs:
|
|
gate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: echo gate
|
|
|
|
caller:
|
|
needs: [gate]
|
|
uses: ./.gitea/workflows/lib.yaml
|
|
`)
|
|
|
|
run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: repo.ID})
|
|
runID := run.ID
|
|
|
|
latestAttempt := func() *actions_model.ActionRunAttempt {
|
|
r := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
|
|
return unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunAttempt{ID: r.LatestAttemptID})
|
|
}
|
|
jobInLatest := func(jobID string) *actions_model.ActionRunJob {
|
|
a := latestAttempt()
|
|
return unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: a.ID, JobID: jobID})
|
|
}
|
|
|
|
// attempt 1: gate Success -> caller expands -> inner runs
|
|
gate1Task := runner.fetchTask(t)
|
|
_, gate1, _ := getTaskAndJobAndRunByTaskID(t, gate1Task.Id)
|
|
assert.Equal(t, "gate", gate1.JobID)
|
|
runner.execTask(t, gate1Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
|
|
|
|
inner1Task := runner.fetchTask(t)
|
|
_, inner1, _ := getTaskAndJobAndRunByTaskID(t, inner1Task.Id)
|
|
assert.Equal(t, "inner", inner1.JobID)
|
|
innerAttemptJobID := inner1.AttemptJobID
|
|
callerAttempt1 := jobInLatest("caller")
|
|
assert.True(t, callerAttempt1.IsExpanded)
|
|
assert.Equal(t, callerAttempt1.ID, inner1.ParentJobID)
|
|
runner.execTask(t, inner1Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
|
|
|
|
run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
|
|
assert.Equal(t, actions_model.StatusSuccess, run.Status)
|
|
|
|
// attempt 2: rerun gate, mock Failure -> caller stays unexpanded (Skipped)
|
|
gateLatest := jobInLatest("gate")
|
|
req := NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d/rerun", repo.OwnerName, repo.Name, runID, gateLatest.ID))
|
|
user2Session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
gate2Task := runner.fetchTask(t)
|
|
_, gate2, _ := getTaskAndJobAndRunByTaskID(t, gate2Task.Id)
|
|
assert.Equal(t, "gate", gate2.JobID)
|
|
runner.execTask(t, gate2Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_FAILURE})
|
|
|
|
runner.fetchNoTask(t) // no inner because caller did not expand
|
|
attempt2 := latestAttempt()
|
|
assert.Equal(t, actions_model.StatusFailure, attempt2.Status)
|
|
callerAttempt2 := jobInLatest("caller")
|
|
assert.Equal(t, actions_model.StatusSkipped, callerAttempt2.Status)
|
|
assert.False(t, callerAttempt2.IsExpanded)
|
|
assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, JobID: "inner"}))
|
|
|
|
// attempt 3: rerun gate, mock Success -> caller expands and inner reuses attempt 1's AttemptJobID
|
|
gateLatest = jobInLatest("gate")
|
|
req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d/rerun", repo.OwnerName, repo.Name, runID, gateLatest.ID))
|
|
user2Session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
gate3Task := runner.fetchTask(t)
|
|
runner.execTask(t, gate3Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
|
|
|
|
inner3Task := runner.fetchTask(t)
|
|
_, inner3, _ := getTaskAndJobAndRunByTaskID(t, inner3Task.Id)
|
|
assert.Equal(t, "inner", inner3.JobID)
|
|
assert.Equal(t, innerAttemptJobID, inner3.AttemptJobID)
|
|
runner.execTask(t, inner3Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
|
|
|
|
run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
|
|
assert.Equal(t, actions_model.StatusSuccess, run.Status)
|
|
})
|
|
})
|
|
}
|
|
|
|
// token must belong to u (the commit identity) and have write access to repo. Reuse the caller's
|
|
// existing token rather than logging in per call, which would re-run bcrypt password verification each time.
|
|
func createRepoWorkflowFile(t *testing.T, u *user_model.User, token string, repo *repo_model.Repository, treePath, content string) {
|
|
opts := getWorkflowCreateFileOptions(u, repo.DefaultBranch, "create "+treePath, content)
|
|
createWorkflowFile(t, token, repo.OwnerName, repo.Name, treePath, opts)
|
|
}
|
|
|
|
func getWorkflowCallPayloadFromTask(t *testing.T, runnerTask *runnerv1.Task) *api.WorkflowCallPayload {
|
|
eventJSON, err := runnerTask.GetContext().Fields["event"].GetStructValue().MarshalJSON()
|
|
assert.NoError(t, err)
|
|
var payload api.WorkflowCallPayload
|
|
assert.NoError(t, json.Unmarshal(eventJSON, &payload))
|
|
return &payload
|
|
}
|