fix(host): keep the runner's connection failures out of the job log

commit: 4421b4925ad0694ac3b409682a080fcec8a5c034
author: brice · 4d ago · 2026-10-17 19:45 UTC
parent: 21a5df7
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email
refs: fix/resolve-actions-message

2 files · +40 -9

M internal/host/resolve.go +4 -1


@@ -225,9 +225,12 @@ func (j jobRun) callResolve(ctx context.Context, uses []string) ([]execpb.Reso
225	225
226	226		// serverReason is the code of a failed call, followed by the message of the
227	227		// server when it gave one, so the job log names what could not be resolved.
	228	+	// Only a message the server sent goes in the job log, which the readers of the
	229	+	// repository see: a failure of the runner's own connection (DNS, TLS, an
	230	+	// address) stays in the runner's log.
228	231		func serverReason(err error) string {
229	232		var ce *connect.Error
230		-	if errors.As(err, &ce) && ce.Message() != "" {
	233	+	if errors.As(err, &ce) && connect.IsWireError(ce) && ce.Message() != "" {
231	234		return fmt.Sprintf("%s: %s", ce.Code(), ce.Message())
232	235		}
233	236		return connect.CodeOf(err).String()

 // serverReason is the code of a failed call, followed by the message of the
 // server when it gave one, so the job log names what could not be resolved.
+// Only a message the server sent goes in the job log, which the readers of the
+// repository see: a failure of the runner's own connection (DNS, TLS, an
+// address) stays in the runner's log.
 func serverReason(err error) string {
 	var ce *connect.Error
-	if errors.As(err, &ce) && ce.Message() != "" {
+	if errors.As(err, &ce) && connect.IsWireError(ce) && ce.Message() != "" {
 		return fmt.Sprintf("%s: %s", ce.Code(), ce.Message())
 	}
 	return connect.CodeOf(err).String()

M internal/host/resolve_test.go +36 -8


@@ -5,7 +5,10 @@ package host
5	5		import (
6	6		"context"
7	7		"encoding/json"
	8	+	"errors"
8	9		"fmt"
	10	+	"net/http"
	11	+	"net/http/httptest"
9	12		"strings"
10	13		"testing"
11	14		"time"

@@ -14,6 +17,7 @@ import (
14	17		"github.com/bnema/zerowrap"
15	18
16	19		ermite "bnema.dev/ermite-api/gen/ermite"
	20	+	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
17	21
18	22		"bnema.dev/ermite-runner/internal/execstream/execpb"
19	23		)

@@ -75,14 +79,6 @@ func TestResolveActionsFailures(t *testing.T) {
75	79		if r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"a/b@v1"}}); !strings.Contains(r.Error, "invalid_argument") {
76	80		t.Errorf("%+v", r)
77	81		}
78		-	c = &resolveStub{err: connect.NewError(connect.CodeUnavailable, fmt.Errorf("resolving `actions/checkout@v4`: github.com did not answer"))}
79		-	r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"actions/checkout@v4"}})
80		-	if want := "resolving actions failed: unavailable: resolving `actions/checkout@v4`: github.com did not answer"; r.Error != want {
81		-	t.Errorf("the job log must name the action: %q", r.Error)
82		-	}
83		-	if c.calls != 3 {
84		-	t.Errorf("an unavailable server is asked 3 times, got %d", c.calls)
85		-	}
86	82		c = &resolveStub{resp: &ermite.ResolveActionsResponse{}}
87	83		if r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"a/b@v1"}}); r.Error == "" {
88	84		t.Errorf("a short answer must fail: %+v", r)

@@ -311,3 +307,35 @@ func TestResolveResponseTokenOriginIPv6(t *testing.T) {
311	307		}
312	308		}
313	309		}
	310	+
	311	+	type unavailableServer struct {
	312	+	ermiteconnect.UnimplementedRunnerServiceHandler
	313	+	}
	314	+
	315	+	func (unavailableServer) ResolveActions(context.Context, connect.Request[ermite.ResolveActionsRequest]) (connect.Response[ermite.ResolveActionsResponse], error) {
	316	+	return nil, connect.NewError(connect.CodeUnavailable, errors.New("resolving `actions/checkout@v4`: github.com did not answer"))
	317	+	}
	318	+
	319	+	// The job log gives the reason the server sent, not the runner's own
	320	+	// connection failures.
	321	+	func TestResolveActionsServerReason(t *testing.T) {
	322	+	path, h := ermiteconnect.NewRunnerServiceHandler(unavailableServer{})
	323	+	mux := http.NewServeMux()
	324	+	mux.Handle(path, h)
	325	+	srv := httptest.NewServer(mux)
	326	+	t.Cleanup(srv.Close)
	327	+	uses := &execpb.ResolveRequest{Uses: []string{"actions/checkout@v4"}}
	328	+
	329	+	r := resolveJob(ermiteconnect.NewRunnerServiceClient(srv.Client(), srv.URL)).resolveActions(context.Background(), uses)
	330	+	if want := "resolving actions failed: unavailable: resolving `actions/checkout@v4`: github.com did not answer"; r.Error != want {
	331	+	t.Errorf("the job log must name the action: %q", r.Error)
	332	+	}
	333	+
	334	+	closed := httptest.NewServer(mux)
	335	+	url := closed.URL
	336	+	closed.Close()
	337	+	r = resolveJob(ermiteconnect.NewRunnerServiceClient(http.DefaultClient, url)).resolveActions(context.Background(), uses)
	338	+	if r.Error != "resolving actions failed: unavailable" {
	339	+	t.Errorf("a connection failure of the runner stays out of the job log: %q", r.Error)
	340	+	}
	341	+	}


@@ -5,7 +5,10 @@ package host
5		import (	5		import (
6		"context"	6		"context"
7		"encoding/json"	7		"encoding/json"
			8	+	"errors"
8		"fmt"	9		"fmt"
			10	+	"net/http"
			11	+	"net/http/httptest"
9		"strings"	12		"strings"
10		"testing"	13		"testing"
11		"time"	14		"time"

@@ -14,6 +17,7 @@ import (
14		"github.com/bnema/zerowrap"	17		"github.com/bnema/zerowrap"
15			18
16		ermite "bnema.dev/ermite-api/gen/ermite"	19		ermite "bnema.dev/ermite-api/gen/ermite"
			20	+	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
17			21
18		"bnema.dev/ermite-runner/internal/execstream/execpb"	22		"bnema.dev/ermite-runner/internal/execstream/execpb"
19		)	23		)

@@ -75,14 +79,6 @@ func TestResolveActionsFailures(t *testing.T) {
75		if r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"a/b@v1"}}); !strings.Contains(r.Error, "invalid_argument") {	79		if r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"a/b@v1"}}); !strings.Contains(r.Error, "invalid_argument") {
76		t.Errorf("%+v", r)	80		t.Errorf("%+v", r)
77		}	81		}
78	-	c = &resolveStub{err: connect.NewError(connect.CodeUnavailable, fmt.Errorf("resolving `actions/checkout@v4`: github.com did not answer"))}
79	-	r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"actions/checkout@v4"}})
80	-	if want := "resolving actions failed: unavailable: resolving `actions/checkout@v4`: github.com did not answer"; r.Error != want {
81	-	t.Errorf("the job log must name the action: %q", r.Error)
82	-	}
83	-	if c.calls != 3 {
84	-	t.Errorf("an unavailable server is asked 3 times, got %d", c.calls)
85	-	}
86		c = &resolveStub{resp: &ermite.ResolveActionsResponse{}}	82		c = &resolveStub{resp: &ermite.ResolveActionsResponse{}}
87		if r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"a/b@v1"}}); r.Error == "" {	83		if r := resolveJob(c).resolveActions(context.Background(), &execpb.ResolveRequest{Uses: []string{"a/b@v1"}}); r.Error == "" {
88		t.Errorf("a short answer must fail: %+v", r)	84		t.Errorf("a short answer must fail: %+v", r)

@@ -311,3 +307,35 @@ func TestResolveResponseTokenOriginIPv6(t *testing.T) {
311		}	307		}
312		}	308		}
313		}	309		}
			310	+
			311	+	type unavailableServer struct {
			312	+	ermiteconnect.UnimplementedRunnerServiceHandler
			313	+	}
			314	+
			315	+	func (unavailableServer) ResolveActions(context.Context, connect.Request[ermite.ResolveActionsRequest]) (connect.Response[ermite.ResolveActionsResponse], error) {
			316	+	return nil, connect.NewError(connect.CodeUnavailable, errors.New("resolving `actions/checkout@v4`: github.com did not answer"))
			317	+	}
			318	+
			319	+	// The job log gives the reason the server sent, not the runner's own
			320	+	// connection failures.
			321	+	func TestResolveActionsServerReason(t *testing.T) {
			322	+	path, h := ermiteconnect.NewRunnerServiceHandler(unavailableServer{})
			323	+	mux := http.NewServeMux()
			324	+	mux.Handle(path, h)
			325	+	srv := httptest.NewServer(mux)
			326	+	t.Cleanup(srv.Close)
			327	+	uses := &execpb.ResolveRequest{Uses: []string{"actions/checkout@v4"}}
			328	+
			329	+	r := resolveJob(ermiteconnect.NewRunnerServiceClient(srv.Client(), srv.URL)).resolveActions(context.Background(), uses)
			330	+	if want := "resolving actions failed: unavailable: resolving `actions/checkout@v4`: github.com did not answer"; r.Error != want {
			331	+	t.Errorf("the job log must name the action: %q", r.Error)
			332	+	}
			333	+
			334	+	closed := httptest.NewServer(mux)
			335	+	url := closed.URL
			336	+	closed.Close()
			337	+	r = resolveJob(ermiteconnect.NewRunnerServiceClient(http.DefaultClient, url)).resolveActions(context.Background(), uses)
			338	+	if r.Error != "resolving actions failed: unavailable" {
			339	+	t.Errorf("a connection failure of the runner stays out of the job log: %q", r.Error)
			340	+	}
			341	+	}