1// SPDX-License-Identifier: MIT
2
3package host
4
5import (
6 "context"
7 "encoding/json"
8 "fmt"
9 "strings"
10 "unicode/utf8"
11
12 "connectrpc.com/connect"
13
14 ermite "bnema.dev/ermite-api/gen/ermite"
15
16 "bnema.dev/ermite-runner/internal/execstream/execpb"
17)
18
19// Limits of what the sandbox may ask the server through the host. The sandbox
20// runs untrusted code, so the host does not trust its requests.
21//
22// Resolutions are cached for the job, by "uses" value: an action that was
23// resolved once is never asked again (the same sha for the whole job is what the
24// server promises anyway), so a local composite action used 500 times costs one
25// resolution. The budget counts only what reaches the server:
26//
27// - a request from the sandbox has at most maxRequestRefs references (a
28// workflow has at most 1,000 steps), split into calls of maxResolveRefs, the
29// limit of ResolveActionsRequest;
30// - a job makes at most maxResolveRounds calls (up to 10 levels of repository
31// composites, then one call per local composite that brings new actions) and
32// asks for at most maxResolveRefsTotal distinct references.
33//
34// These are explicit limits of ermite, not of GitHub: a job that needs more
35// distinct actions than that fails "Set up job" with the message below.
36const (
37 maxRequestRefs = 1000
38 maxResolveRefs = 100 // per call to the server: ResolveActionsRequest.refs
39 maxResolveRounds = 128 // calls per job
40 maxResolveRefsTotal = 2048 // distinct references per job
41 maxRefLen = 1024 // the whole "uses" value
42 maxOwnerRepoLen = 100 // owner and repository names
43 maxPathElemLen = 255 // an element of the path of the action: a file name
44 maxRefNameLen = 255
45)
46
47// checkUses validates a "uses" value of a request: owner/repo[/path]@ref. The
48// owner and the repository have the characters of repository names; the path of
49// the action is a path in the repository (any characters but control ones, with
50// no empty, "." or ".." element and no backslash, which the runner reads as a
51// separator, action.ParseUses); the ref has the characters git allows. The
52// server decides whether the action exists; this keeps garbage and oversized
53// strings from reaching it.
54func checkUses(u string) error {
55 bad := func() error { return fmt.Errorf("%q is not a valid action reference", cut(u)) }
56 if u == "" || len(u) > maxRefLen || !utf8.ValidString(u) {
57 return bad()
58 }
59 name, ref, ok := strings.Cut(u, "@")
60 if !ok || ref == "" || len(ref) > maxRefNameLen || strings.ContainsFunc(ref, badRefRune) {
61 return bad()
62 }
63 segs := strings.Split(name, "/")
64 if len(segs) < 2 {
65 return bad()
66 }
67 for _, seg := range segs[:2] {
68 if seg == "" || seg == "." || seg == ".." || len(seg) > maxOwnerRepoLen || strings.ContainsFunc(seg, badSegmentRune) {
69 return bad()
70 }
71 }
72 for _, seg := range segs[2:] {
73 if seg == "" || seg == "." || seg == ".." || len(seg) > maxPathElemLen || strings.ContainsFunc(seg, badPathRune) {
74 return bad()
75 }
76 }
77 return nil
78}
79
80// badPathRune: control characters (NUL included) and the backslash. Invalid
81// UTF-8 is refused for the whole value by utf8.ValidString; a literal U+FFFD is a
82// valid character.
83func badPathRune(r rune) bool { return r < ' ' || r == 0x7f || r == '\\' }
84
85func cut(s string) string {
86 if len(s) > 80 {
87 return s[:80] + "..."
88 }
89 return s
90}
91
92func badSegmentRune(r rune) bool {
93 return (r < 'a' || r > 'z') && (r < 'A' || r > 'Z') && (r < '0' || r > '9') && r != '-' && r != '_' && r != '.'
94}
95
96// badRefRune: a ref is a branch, a tag or a sha; no control characters, spaces
97// or characters git refuses.
98func badRefRune(r rune) bool {
99 return r <= ' ' || r == 0x7f || strings.ContainsRune("~^:?*[\\@", r) // "@": a "uses" has exactly one (action.ParseUses)
100}
101
102// resolveActions answers a ResolveRequest of the executor with
103// RunnerService.ResolveActions. The job token stays here: the executor only
104// gets what the server returns (the per-archive tokens included, which it
105// masks). Requests come one at a time (see execstream.JobHandler.Resolve). What
106// was resolved before in the job comes from the cache; the rest goes to the
107// server in calls of at most maxResolveRefs, under the budget above. A call that
108// fails without a verdict is retried like the other job calls; a failure of the
109// call itself is reported to the executor, which fails "Set up job"
110// (ActionManager: FailedToResolveActionDownloadInfoException). ctx ends with the
111// session.
112func (j *jobRun) resolveActions(ctx context.Context, req *execpb.ResolveRequest) *execpb.ResolveResponse {
113 fail := func(format string, a ...any) *execpb.ResolveResponse {
114 return &execpb.ResolveResponse{Error: fmt.Sprintf(format, a...)}
115 }
116 if len(req.Uses) == 0 {
117 return fail("an empty request for action resolution")
118 }
119 if len(req.Uses) > maxRequestRefs {
120 return fail("cannot resolve %d actions at once (the limit is %d)", len(req.Uses), maxRequestRefs)
121 }
122 for _, u := range req.Uses {
123 if err := checkUses(u); err != nil {
124 return fail("%v", err)
125 }
126 }
127 // The job ending, or the session, stops the calls.
128 ctx, cancel := context.WithCancel(ctx)
129 defer cancel()
130 stop := context.AfterFunc(j.ctx, cancel)
131 defer stop()
132
133 got := map[string]*execpb.ResolvedAction{}
134 var pending []string
135 j.mu.Lock()
136 for _, u := range req.Uses {
137 if _, dup := got[u]; dup {
138 continue
139 }
140 if c, ok := j.resolved[u]; ok {
141 got[u] = c
142 continue
143 }
144 got[u] = nil
145 pending = append(pending, u)
146 }
147 j.mu.Unlock()
148 for len(pending) > 0 {
149 n := min(len(pending), maxResolveRefs)
150 chunk := pending[:n]
151 pending = pending[n:]
152 j.mu.Lock()
153 j.resolveRounds++
154 j.resolveRefs += len(chunk)
155 over := j.resolveRounds > maxResolveRounds || j.resolveRefs > maxResolveRefsTotal
156 j.mu.Unlock()
157 if over {
158 return fail("this job asked to resolve too many actions (the limits are %d requests and %d distinct references)", maxResolveRounds, maxResolveRefsTotal)
159 }
160 res, errResp := j.callResolve(ctx, chunk)
161 if errResp != nil {
162 return errResp
163 }
164 j.mu.Lock()
165 for i, u := range chunk {
166 got[u] = res[i]
167 if res[i].Error == "" { // an error is not cached: it may be a passing one
168 if j.resolved == nil {
169 j.resolved = map[string]*execpb.ResolvedAction{}
170 }
171 j.resolved[u] = res[i]
172 }
173 }
174 j.mu.Unlock()
175 }
176 out := &execpb.ResolveResponse{}
177 for _, u := range req.Uses {
178 out.Actions = append(out.Actions, got[u])
179 }
180 return out
181}
182
183// callResolve makes one call to the server, with retries, and converts the
184// answer; the second result is the error to send to the executor.
185func (j *jobRun) callResolve(ctx context.Context, uses []string) ([]*execpb.ResolvedAction, *execpb.ResolveResponse) {
186 fail := func(format string, a ...any) ([]*execpb.ResolvedAction, *execpb.ResolveResponse) {
187 return nil, &execpb.ResolveResponse{Error: fmt.Sprintf(format, a...)}
188 }
189 refs := make([]*ermite.ActionRef, len(uses))
190 for i, u := range uses {
191 refs[i] = &ermite.ActionRef{Uses: u}
192 }
193 b := backoff{min: j.t.BackoffMin, max: j.t.BackoffMax}
194 for attempt := 1; ; attempt++ {
195 cctx, ccancel := context.WithTimeout(ctx, j.t.CallTimeout)
196 resp, err := j.client.ResolveActions(cctx, connect.NewRequest(&ermite.ResolveActionsRequest{JobId: j.job.JobId, Refs: refs}))
197 ccancel()
198 if err == nil {
199 conv := j.resolveResponse(resp.Msg, len(uses))
200 if conv.Error != "" {
201 return fail("%s", conv.Error)
202 }
203 return conv.Actions, nil
204 }
205 if ctx.Err() != nil {
206 return fail("the job was cancelled while its actions were resolved")
207 }
208 switch classify(err) {
209 case kindEnded, kindAbandoned:
210 j.abandon(err)
211 return fail("the server ended the job")
212 case kindPermanent:
213 return fail("resolving actions failed: %s", connect.CodeOf(err))
214 }
215 j.log.Warn().Err(err).Int("attempt", attempt).Msg("ResolveActions failed")
216 if attempt >= 3 || !sleep(ctx, b.next()) {
217 return fail("resolving actions failed: %s", connect.CodeOf(err))
218 }
219 }
220}
221
222// resolveResponse converts the answer of the server. The token of an archive is
223// a secret that the sandbox sends in an Authorization header, so it only goes
224// with an archive of the ermite source whose tarball URL is on an origin this
225// host knows to be ermite: the public origin of the job (github.server_url) or
226// the origin of the runner's own URL. The origin the sandbox must send it to is
227// AuthOrigin; with guest forge access the tarball URL on the public origin is
228// rewritten to the runner's, like the URLs of the contexts. A token that does
229// not satisfy this is dropped (the download then fails like an unauthorised
230// one).
231func (j *jobRun) resolveResponse(m *ermite.ResolveActionsResponse, want int) *execpb.ResolveResponse {
232 if len(m.Actions) != want {
233 return &execpb.ResolveResponse{Error: fmt.Sprintf("the server resolved %d actions out of %d", len(m.Actions), want)}
234 }
235 out := &execpb.ResolveResponse{}
236 for _, a := range m.Actions {
237 ra := &execpb.ResolvedAction{
238 Ref: a.Ref, NameWithOwner: a.NameWithOwner, Path: a.Path, ResolvedSha: a.ResolvedSha,
239 TarballUrl: a.TarballUrl, Source: a.Source.String(), Error: a.Error,
240 }
241 if a.Source == ermite.ActionSource_ACTION_SOURCE_ERMITE {
242 if origin := originOf(a.TarballUrl); origin != "" {
243 if j.guestForge != "" && origin == j.publicOrigin {
244 ra.TarballUrl = j.guestForge + strings.TrimPrefix(a.TarballUrl, a.TarballUrl[:strings.Index(a.TarballUrl, "://")+3+hostLen(a.TarballUrl)])
245 origin = j.guestForge
246 }
247 if a.Token != "" && (origin == j.guestForge || origin == j.publicOrigin || origin == j.serverOrigin) {
248 ra.Token, ra.AuthOrigin = a.Token, origin
249 }
250 }
251 }
252 out.Actions = append(out.Actions, ra)
253 }
254 return out
255}
256
257// setOrigins records the origins that are ermite for this job: the public one
258// (the origin of github.server_url as the server sent it), the runner's own
259// (ERMITE_RUNNER_URL) and the guest forge origin, "" when it is off.
260func (j *jobRun) setOrigins(contexts, serverURL, guestForge string) {
261 j.serverOrigin = originOf(serverURL)
262 j.guestForge = guestForge
263 if guestForge != "" {
264 j.guestForge = originOf(guestForge)
265 }
266 if top, err := parseObject([]byte(contexts)); err == nil {
267 for _, m := range top {
268 if m.key != "github" {
269 continue
270 }
271 gh, err := parseObject(m.val)
272 if err != nil {
273 break
274 }
275 for _, g := range gh {
276 var s string
277 if g.key == "server_url" && json.Unmarshal(g.val, &s) == nil {
278 j.publicOrigin = originOf(s)
279 }
280 }
281 }
282 }
283}
284
285// SetGitHubToken returns the contexts JSON of a job with github.token set to
286// token (the job repository token, Job.github_token). The key is added first,
287// like the runner does (ExecutionContext.cs:1023: token, then what the server
288// gave); an empty token leaves the contexts as they are.
289func SetGitHubToken(contexts, token string) (string, error) {
290 if token == "" {
291 return contexts, nil
292 }
293 top, err := parseObject([]byte(contexts))
294 if err != nil {
295 return "", fmt.Errorf("job contexts: %w", err)
296 }
297 gi := -1
298 for i, m := range top {
299 if m.key == "github" {
300 gi = i
301 }
302 }
303 var gh []jsonMember
304 if gi >= 0 {
305 if gh, err = parseObject(top[gi].val); err != nil {
306 return "", fmt.Errorf("job contexts: github: %w", err)
307 }
308 }
309 tv, err := json.Marshal(token)
310 if err != nil {
311 return "", err
312 }
313 set := false
314 for i, m := range gh {
315 if m.key == "token" {
316 gh[i].val, set = tv, true
317 }
318 }
319 if !set {
320 gh = append([]jsonMember{{"token", tv}}, gh...)
321 }
322 ghv, err := encodeObject(gh)
323 if err != nil {
324 return "", err
325 }
326 if gi >= 0 {
327 top[gi].val = ghv
328 } else {
329 top = append(top, jsonMember{"github", ghv})
330 }
331 out, err := encodeObject(top)
332 return string(out), err
333}
334
335// hostLen is the length of the authority of an absolute URL.
336func hostLen(u string) int {
337 rest := u[strings.Index(u, "://")+3:]
338 if i := strings.IndexAny(rest, "/?#"); i >= 0 {
339 return i
340 }
341 return len(rest)
342}