Skip to content

Commit a1f5dd7

Browse files
sillyguodongsillyguodong
authored
Make runs-on support variable expression (#29468)
As title. Close issue: https://gitea.com/gitea/act_runner/issues/445 Follow: https://gitea.com/gitea/act/pulls/91 Move `getSecretsOfTask` and `getVariablesOfTask` under `models` because of circular dependency issues.
1 parent c8f4897 commit a1f5dd7

File tree

6 files changed

+99
-72
lines changed

6 files changed

+99
-72
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ replace github.com/hashicorp/go-version => github.com/6543/go-version v1.3.1
302302

303303
replace github.com/shurcooL/vfsgen => github.com/lunny/vfsgen v0.0.0-20220105142115-2c99e1ffdfa0
304304

305-
replace github.com/nektos/act => gitea.com/gitea/act v0.2.51
305+
replace github.com/nektos/act => gitea.com/gitea/act v0.259.1
306306

307307
replace github.com/gorilla/feeds => github.com/yardenshoham/feeds v0.0.0-20240110072658-f3d0c21c0bd5
308308

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
4848
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
4949
git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078 h1:cliQ4HHsCo6xi2oWZYKWW4bly/Ory9FuTpFPRxj/mAg=
5050
git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078/go.mod h1:g/V2Hjas6Z1UHUp4yIx6bATpNzJ7DYtD0FG3+xARWxs=
51-
gitea.com/gitea/act v0.2.51 h1:gXc/B4OlTciTTzAx9cmNyw04n2SDO7exPjAsR5Idu+c=
52-
gitea.com/gitea/act v0.2.51/go.mod h1:CoaX2053jqBlD6JMgu4d4UgFL/rp2I14Kt5mMqcs0Z0=
51+
gitea.com/gitea/act v0.259.1 h1:8GG1o/xtUHl3qjn5f0h/2FXrT5ubBn05TJOM5ry+FBw=
52+
gitea.com/gitea/act v0.259.1/go.mod h1:UxZWRYqQG2Yj4+4OqfGWW5a3HELwejyWFQyU7F1jUD8=
5353
gitea.com/go-chi/binding v0.0.0-20230415142243-04b515c6d669 h1:RUBX+MK/TsDxpHmymaOaydfigEbbzqUnG1OTZU/HAeo=
5454
gitea.com/go-chi/binding v0.0.0-20230415142243-04b515c6d669/go.mod h1:77TZu701zMXWJFvB8gvTbQ92zQ3DQq/H7l5wAEjQRKc=
5555
gitea.com/go-chi/cache v0.0.0-20210110083709-82c4c9ce2d5e/go.mod h1:k2V/gPDEtXGjjMGuBJiapffAXTv76H4snSmlJRLUhH0=

‎models/actions/variable.go‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"strings"
1111

1212
"code.gitea.io/gitea/models/db"
13+
"code.gitea.io/gitea/modules/log"
1314
"code.gitea.io/gitea/modules/timeutil"
1415
"code.gitea.io/gitea/modules/util"
1516

@@ -82,3 +83,35 @@ func UpdateVariable(ctx context.Context, variable *ActionVariable) (bool, error)
8283
})
8384
return count != 0, err
8485
}
86+
87+
func GetVariablesOfRun(ctx context.Context, run *ActionRun) (map[string]string, error) {
88+
variables := map[string]string{}
89+
90+
// Global
91+
globalVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{})
92+
if err != nil {
93+
log.Error("find global variables: %v", err)
94+
return nil, err
95+
}
96+
97+
// Org / User level
98+
ownerVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{OwnerID: run.Repo.OwnerID})
99+
if err != nil {
100+
log.Error("find variables of org: %d, error: %v", run.Repo.OwnerID, err)
101+
return nil, err
102+
}
103+
104+
// Repo level
105+
repoVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{RepoID: run.RepoID})
106+
if err != nil {
107+
log.Error("find variables of repo: %d, error: %v", run.RepoID, err)
108+
return nil, err
109+
}
110+
111+
// Level precedence: Repo > Org / User > Global
112+
for _, v := range append(globalVariables, append(ownerVariables, repoVariables...)...) {
113+
variables[v.Name] = v.Data
114+
}
115+
116+
return variables, nil
117+
}

‎models/secret/secret.go‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,10 @@ import (
99
"fmt"
1010
"strings"
1111

12+
actions_model "code.gitea.io/gitea/models/actions"
1213
"code.gitea.io/gitea/models/db"
14+
actions_module "code.gitea.io/gitea/modules/actions"
15+
"code.gitea.io/gitea/modules/log"
1316
secret_module "code.gitea.io/gitea/modules/secret"
1417
"code.gitea.io/gitea/modules/setting"
1518
"code.gitea.io/gitea/modules/timeutil"
@@ -112,3 +115,39 @@ func UpdateSecret(ctx context.Context, secretID int64, data string) error {
112115
}
113116
return err
114117
}
118+
119+
func GetSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) (map[string]string, error) {
120+
secrets := map[string]string{}
121+
122+
secrets["GITHUB_TOKEN"] = task.Token
123+
secrets["GITEA_TOKEN"] = task.Token
124+
125+
if task.Job.Run.IsForkPullRequest && task.Job.Run.TriggerEvent != actions_module.GithubEventPullRequestTarget {
126+
// ignore secrets for fork pull request, except GITHUB_TOKEN and GITEA_TOKEN which are automatically generated.
127+
// for the tasks triggered by pull_request_target event, they could access the secrets because they will run in the context of the base branch
128+
// see the documentation: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
129+
return secrets, nil
130+
}
131+
132+
ownerSecrets, err := db.Find[Secret](ctx, FindSecretsOptions{OwnerID: task.Job.Run.Repo.OwnerID})
133+
if err != nil {
134+
log.Error("find secrets of owner %v: %v", task.Job.Run.Repo.OwnerID, err)
135+
return nil, err
136+
}
137+
repoSecrets, err := db.Find[Secret](ctx, FindSecretsOptions{RepoID: task.Job.Run.RepoID})
138+
if err != nil {
139+
log.Error("find secrets of repo %v: %v", task.Job.Run.RepoID, err)
140+
return nil, err
141+
}
142+
143+
for _, secret := range append(ownerSecrets, repoSecrets...) {
144+
v, err := secret_module.DecryptSecret(setting.SecretKey, secret.Data)
145+
if err != nil {
146+
log.Error("decrypt secret %v %q: %v", secret.ID, secret.Name, err)
147+
return nil, err
148+
}
149+
secrets[secret.Name] = v
150+
}
151+
152+
return secrets, nil
153+
}

‎routers/api/actions/runner/utils.go‎

Lines changed: 12 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ import (
1515
"code.gitea.io/gitea/modules/git"
1616
"code.gitea.io/gitea/modules/json"
1717
"code.gitea.io/gitea/modules/log"
18-
secret_module "code.gitea.io/gitea/modules/secret"
1918
"code.gitea.io/gitea/modules/setting"
2019
"code.gitea.io/gitea/services/actions"
2120

@@ -32,14 +31,24 @@ func pickTask(ctx context.Context, runner *actions_model.ActionRunner) (*runnerv
3231
return nil, false, nil
3332
}
3433

34+
secrets, err := secret_model.GetSecretsOfTask(ctx, t)
35+
if err != nil {
36+
return nil, false, fmt.Errorf("GetSecretsOfTask: %w", err)
37+
}
38+
39+
vars, err := actions_model.GetVariablesOfRun(ctx, t.Job.Run)
40+
if err != nil {
41+
return nil, false, fmt.Errorf("GetVariablesOfRun: %w", err)
42+
}
43+
3544
actions.CreateCommitStatus(ctx, t.Job)
3645

3746
task := &runnerv1.Task{
3847
Id: t.ID,
3948
WorkflowPayload: t.Job.WorkflowPayload,
4049
Context: generateTaskContext(t),
41-
Secrets: getSecretsOfTask(ctx, t),
42-
Vars: getVariablesOfTask(ctx, t),
50+
Secrets: secrets,
51+
Vars: vars,
4352
}
4453

4554
if needs, err := findTaskNeeds(ctx, t); err != nil {
@@ -55,71 +64,6 @@ func pickTask(ctx context.Context, runner *actions_model.ActionRunner) (*runnerv
5564
return task, true, nil
5665
}
5766

58-
func getSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) map[string]string {
59-
secrets := map[string]string{}
60-
61-
secrets["GITHUB_TOKEN"] = task.Token
62-
secrets["GITEA_TOKEN"] = task.Token
63-
64-
if task.Job.Run.IsForkPullRequest && task.Job.Run.TriggerEvent != actions_module.GithubEventPullRequestTarget {
65-
// ignore secrets for fork pull request, except GITHUB_TOKEN and GITEA_TOKEN which are automatically generated.
66-
// for the tasks triggered by pull_request_target event, they could access the secrets because they will run in the context of the base branch
67-
// see the documentation: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
68-
return secrets
69-
}
70-
71-
ownerSecrets, err := db.Find[secret_model.Secret](ctx, secret_model.FindSecretsOptions{OwnerID: task.Job.Run.Repo.OwnerID})
72-
if err != nil {
73-
log.Error("find secrets of owner %v: %v", task.Job.Run.Repo.OwnerID, err)
74-
// go on
75-
}
76-
repoSecrets, err := db.Find[secret_model.Secret](ctx, secret_model.FindSecretsOptions{RepoID: task.Job.Run.RepoID})
77-
if err != nil {
78-
log.Error("find secrets of repo %v: %v", task.Job.Run.RepoID, err)
79-
// go on
80-
}
81-
82-
for _, secret := range append(ownerSecrets, repoSecrets...) {
83-
if v, err := secret_module.DecryptSecret(setting.SecretKey, secret.Data); err != nil {
84-
log.Error("decrypt secret %v %q: %v", secret.ID, secret.Name, err)
85-
// go on
86-
} else {
87-
secrets[secret.Name] = v
88-
}
89-
}
90-
91-
return secrets
92-
}
93-
94-
func getVariablesOfTask(ctx context.Context, task *actions_model.ActionTask) map[string]string {
95-
variables := map[string]string{}
96-
97-
// Global
98-
globalVariables, err := db.Find[actions_model.ActionVariable](ctx, actions_model.FindVariablesOpts{})
99-
if err != nil {
100-
log.Error("find global variables: %v", err)
101-
}
102-
103-
// Org / User level
104-
ownerVariables, err := db.Find[actions_model.ActionVariable](ctx, actions_model.FindVariablesOpts{OwnerID: task.Job.Run.Repo.OwnerID})
105-
if err != nil {
106-
log.Error("find variables of org: %d, error: %v", task.Job.Run.Repo.OwnerID, err)
107-
}
108-
109-
// Repo level
110-
repoVariables, err := db.Find[actions_model.ActionVariable](ctx, actions_model.FindVariablesOpts{RepoID: task.Job.Run.RepoID})
111-
if err != nil {
112-
log.Error("find variables of repo: %d, error: %v", task.Job.Run.RepoID, err)
113-
}
114-
115-
// Level precedence: Repo > Org / User > Global
116-
for _, v := range append(globalVariables, append(ownerVariables, repoVariables...)...) {
117-
variables[v.Name] = v.Data
118-
}
119-
120-
return variables
121-
}
122-
12367
func generateTaskContext(t *actions_model.ActionTask) *structpb.Struct {
12468
event := map[string]any{}
12569
_ = json.Unmarshal([]byte(t.Job.Run.EventPayload), &event)

‎services/actions/notifier_helper.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -296,7 +296,18 @@ func handleWorkflows(
296296
run.NeedApproval = need
297297
}
298298

299-
jobs, err := jobparser.Parse(dwf.Content)
299+
if err := run.LoadAttributes(ctx); err != nil {
300+
log.Error("LoadAttributes: %v", err)
301+
continue
302+
}
303+
304+
vars, err := actions_model.GetVariablesOfRun(ctx, run)
305+
if err != nil {
306+
log.Error("GetVariablesOfRun: %v", err)
307+
continue
308+
}
309+
310+
jobs, err := jobparser.Parse(dwf.Content, jobparser.WithVars(vars))
300311
if err != nil {
301312
log.Error("jobparser.Parse: %v", err)
302313
continue

0 commit comments

Comments
 (0)