1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package app
4
5import (
6 "context"
7 "encoding/json"
8 "fmt"
9 "net/http/httptest"
10 "os"
11 "path/filepath"
12 "strings"
13 "testing"
14 "time"
15
16 "connectrpc.com/connect"
17 "github.com/stretchr/testify/assert"
18 "github.com/stretchr/testify/require"
19
20 pb "bnema.dev/ermite-api/gen/ermite"
21 "bnema.dev/ermite/internal/domain"
22 "bnema.dev/ermite/internal/ports"
23 "bnema.dev/ermite/internal/usecase"
24)
25
26const oneJob = `on:
27 push:
28 %s
29jobs:
30 j:
31 runs-on: ubuntu-latest
32 steps:
33 - run: echo hi
34`
35
36func workflowWith(filter string) string { return fmt.Sprintf(oneJob, filter) }
37
38// AC3: filters, tags, skip directives, invalid files and deletions.
39func TestCITriggerRules(t *testing.T) {
40 c := newCIHarness(t, nil)
41 c.registerRunner("alpha", "ubuntu-latest")
42 count := func() int { return len(c.runs()) }
43 settle := func() { time.Sleep(300 * time.Millisecond) } // a push that runs nothing leaves nothing to wait for
44
45 // A workflow with a branch filter does not run for another branch.
46 c.push("main", map[string]string{".github/workflows/only-main.yml": workflowWith("branches: [main]"), "src/a.go": "package a\n"}, "")
47 c.waitFor("main runs", func() bool { return count() == 1 })
48 c.push("other", map[string]string{"x.txt": "x\n"}, "")
49 settle()
50 assert.Equal(t, 1, count(), "branches: [main] does not run for other")
51
52 // A paths filter looks at the files of the push.
53 c.push("main", map[string]string{".github/workflows/paths.yml": workflowWith("paths: ['docs/**']")}, "")
54 c.waitFor("only-main runs again for the new commit", func() bool { return count() == 2 })
55 c.push("main", map[string]string{"docs/readme.md": "doc\n"}, "")
56 c.waitFor("both run for docs", func() bool { return count() == 4 })
57 c.push("main", map[string]string{"src/b.go": "package b\n"}, "")
58 c.waitFor("only-main runs for src", func() bool { return count() == 5 })
59 settle()
60 assert.Equal(t, 5, count(), "the paths filter kept paths.yml out")
61
62 // [skip ci] on the head commit.
63 c.push("main", map[string]string{"src/c.go": "package c\n"}, "wip [skip ci]")
64 settle()
65 assert.Equal(t, 5, count())
66
67 // An invalid workflow file is a failed run without a job.
68 c.push("main", map[string]string{".github/workflows/broken.yml": "on: push\njobs:\n j:\n steps: [\n"}, "")
69 c.waitFor("the invalid file gives a run", func() bool {
70 for _, r := range c.runs() {
71 if r.GetWorkflowPath() == ".github/workflows/broken.yml" {
72 return true
73 }
74 }
75 return false
76 })
77 var broken *pb.Run
78 for _, r := range c.runs() {
79 if r.GetWorkflowPath() == ".github/workflows/broken.yml" {
80 broken = r
81 }
82 }
83 assert.Equal(t, pb.CiStatus_CI_STATUS_COMPLETED, broken.GetStatus())
84 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_FAILURE, broken.GetConclusion())
85 assert.NotEmpty(t, broken.GetError())
86 assert.Empty(t, c.getRun(broken.GetId()).GetJobs(), "an invalid file has no job")
87 sha := strings.TrimSpace(c.mustGit(c.wt, "rev-parse", "HEAD"))
88 var failed []string
89 for _, ck := range c.checks(sha) {
90 if ck.GetConclusion() == pb.CiConclusion_CI_CONCLUSION_FAILURE {
91 failed = append(failed, ck.GetName())
92 }
93 }
94 assert.Equal(t, []string{".github/workflows/broken.yml"}, failed, "and a failed check on the commit")
95
96 // A push never fails for CI: the push above succeeded (mustGit). A deletion
97 // runs nothing.
98 before := count()
99 c.mustGit(c.wt, "push", "-q", c.urlAuth(adminToken, "/proj.git"), ":other")
100 settle()
101 assert.Equal(t, before, count())
102}
103
104// AC3: tags run tag-filtered workflows; more than 3 tags in one push run none.
105func TestCITags(t *testing.T) {
106 c := newCIHarness(t, nil)
107 c.registerRunner("alpha", "ubuntu-latest")
108 c.push("main", map[string]string{".github/workflows/rel.yml": workflowWith("tags: ['v*']")}, "")
109 settle := func() { time.Sleep(300 * time.Millisecond) }
110 settle()
111 assert.Empty(t, c.runs(), "a tags-only workflow does not run for a branch")
112
113 c.mustGit(c.wt, "tag", "v1")
114 c.mustGit(c.wt, "push", "-q", c.urlAuth(adminToken, "/proj.git"), "v1")
115 c.waitFor("a tag runs", func() bool { return len(c.runs()) == 1 })
116 assert.Equal(t, "refs/tags/v1", c.runs()[0].GetRef())
117
118 for _, tag := range []string{"v2", "v3", "v4", "v5"} {
119 c.mustGit(c.wt, "tag", tag)
120 }
121 c.mustGit(c.wt, "push", "-q", c.urlAuth(adminToken, "/proj.git"), "v2", "v3", "v4", "v5")
122 settle()
123 assert.Len(t, c.runs(), 1, "more than 3 tags in one push run nothing")
124}
125
126// AC6: cancelling a run asks the runner to stop through WatchJob; a runner that
127// does not answer is ended by the server.
128func TestCICancelReachesTheRunnerAndIsEnforced(t *testing.T) {
129 c := newCIHarness(t, func(cfg *usecase.CIConfig) {
130 cfg.CancelGrace, cfg.Tick, cfg.PollTimeout = 400*time.Millisecond, 20*time.Millisecond, 100*time.Millisecond
131 })
132 runner := c.registerRunner("alpha", "ubuntu-latest")
133 c.push("main", map[string]string{".github/workflows/ci.yml": ciWorkflow}, "")
134 job := runner.await()
135 api := runner.jobAPI(job)
136 _, err := api.runner.Heartbeat(c.ctx, connect.NewRequest(&pb.HeartbeatRequest{JobId: job.GetJobId()}))
137 require.NoError(t, err)
138
139 watch, err := api.runner.WatchJob(c.ctx, connect.NewRequest(&pb.WatchJobRequest{JobId: job.GetJobId()}))
140 require.NoError(t, err)
141 run := c.runs()[0]
142
143 // A reader without ci:write cannot cancel.
144 reader := c.api(c.token(scopes(domain.ScopeRepoRead)))
145 _, err = reader.run.CancelRun(c.ctx, connect.NewRequest(&pb.CancelRunRequest{Repo: "proj", RunId: run.GetId()}))
146 assert.Equal(t, connect.CodePermissionDenied, ciErrCode(err))
147
148 _, err = c.root.run.CancelRun(c.ctx, connect.NewRequest(&pb.CancelRunRequest{Repo: "proj", RunId: run.GetId()}))
149 require.NoError(t, err)
150 // Cancelling again changes nothing.
151 _, err = c.root.run.CancelRun(c.ctx, connect.NewRequest(&pb.CancelRunRequest{Repo: "proj", RunId: run.GetId()}))
152 require.NoError(t, err)
153
154 var cancel *pb.CancelRequest
155 for watch.Receive() {
156 if m := watch.Msg().GetCancel(); m != nil {
157 cancel = m
158 break
159 }
160 }
161 require.NotNil(t, cancel, "the runner is told")
162 assert.Equal(t, pb.CancelReason_CANCEL_REASON_USER, cancel.GetReason())
163
164 // The queued job that needs it never ran: cancelled at once. The running
165 // one is ended by the server after the grace period.
166 c.waitFor("the server ends the job", func() bool {
167 return c.runs()[0].GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED
168 })
169 detail := c.getRun(run.GetId())
170 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_CANCELLED, detail.GetRun().GetConclusion())
171 for _, j := range detail.GetJobs() {
172 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_CANCELLED, j.GetConclusion(), j.GetKey())
173 }
174 assert.Contains(t, detail.GetJobs()[0].GetError(), "did not answer")
175
176 // The runner's late CompleteJob returns the server's result.
177 res, err := api.runner.CompleteJob(c.ctx, connect.NewRequest(&pb.CompleteJobRequest{
178 JobId: job.GetJobId(), Conclusion: pb.CiConclusion_CI_CONCLUSION_CANCELLED,
179 }))
180 require.NoError(t, err)
181 assert.False(t, res.Msg.GetApplied())
182
183 // A completed run cannot be cancelled.
184 _, err = c.root.run.CancelRun(c.ctx, connect.NewRequest(&pb.CancelRunRequest{Repo: "proj", RunId: run.GetId()}))
185 assert.Equal(t, connect.CodeFailedPrecondition, ciErrCode(err))
186}
187
188// A running job without heartbeats fails with GitHub's lost-runner message.
189func TestCILostRunnerFailsTheJob(t *testing.T) {
190 c := newCIHarness(t, func(cfg *usecase.CIConfig) {
191 cfg.HeartbeatDeadline, cfg.Tick, cfg.PollTimeout = 300*time.Millisecond, 20*time.Millisecond, 100*time.Millisecond
192 })
193 runner := c.registerRunner("alpha", "ubuntu-latest")
194 c.push("main", map[string]string{".github/workflows/ci.yml": strings.Split(ciWorkflow, " test:")[0]}, "")
195 job := runner.await()
196 _, err := runner.jobAPI(job).runner.Heartbeat(c.ctx, connect.NewRequest(&pb.HeartbeatRequest{JobId: job.GetJobId()}))
197 require.NoError(t, err)
198
199 c.waitFor("the job is lost", func() bool { return c.runs()[0].GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED })
200 j := c.getRun(c.runs()[0].GetId()).GetJobs()[0]
201 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_FAILURE, j.GetConclusion())
202 assert.Contains(t, j.GetError(), "The self-hosted runner: alpha lost communication with the server")
203}
204
205// AC6: a re-run is a new attempt of the same run; the failed-only variant keeps
206// the jobs that passed.
207func TestCIRerun(t *testing.T) {
208 c := newCIHarness(t, nil)
209 runner := c.registerRunner("alpha", "ubuntu-latest")
210 c.push("main", map[string]string{".github/workflows/ci.yml": ciWorkflow}, "")
211 run := func() *pb.Run { return c.runs()[0] }
212
213 build := runner.await()
214 runner.runJob(build, pb.CiConclusion_CI_CONCLUSION_SUCCESS, nil, "ok")
215 test := runner.await()
216 runner.runJob(test, pb.CiConclusion_CI_CONCLUSION_FAILURE, nil, "red")
217 c.waitFor("the run fails", func() bool { return run().GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED })
218 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_FAILURE, run().GetConclusion())
219 id, number := run().GetId(), run().GetNumber()
220
221 // A running run cannot be re-run; a completed one can, by who has ci:write.
222 reader := c.api(c.token(scopes(domain.ScopeRepoRead)))
223 _, err := reader.run.RerunRun(c.ctx, connect.NewRequest(&pb.RerunRunRequest{Repo: "proj", RunId: id}))
224 assert.Equal(t, connect.CodePermissionDenied, ciErrCode(err))
225
226 res, err := c.root.run.RerunRun(c.ctx, connect.NewRequest(&pb.RerunRunRequest{Repo: "proj", RunId: id, FailedOnly: true}))
227 require.NoError(t, err)
228 assert.Equal(t, id, res.Msg.GetRun().GetId())
229 assert.Equal(t, number, res.Msg.GetRun().GetNumber())
230 assert.EqualValues(t, 2, res.Msg.GetRun().GetAttempt())
231
232 // build keeps its attempt-1 result; only test runs again.
233 again := runner.await()
234 assert.Equal(t, "test", again.GetJobKey())
235 assert.EqualValues(t, 2, again.GetAttempt())
236 runner.runJob(again, pb.CiConclusion_CI_CONCLUSION_SUCCESS, nil, "green")
237 c.waitFor("attempt 2 passes", func() bool {
238 r := run()
239 return r.GetAttempt() == 2 && r.GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED
240 })
241 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_SUCCESS, run().GetConclusion())
242 detail := c.getRun(id)
243 require.Len(t, detail.GetJobs(), 2)
244 assert.EqualValues(t, 1, detail.GetJobs()[0].GetAttempt(), "build was kept from attempt 1")
245 assert.EqualValues(t, 2, detail.GetJobs()[1].GetAttempt())
246
247 // Attempt 1 is still readable, with its failure.
248 first, err := c.root.run.GetRun(c.ctx, connect.NewRequest(&pb.GetRunRequest{Repo: "proj", RunId: id, Attempt: 1}))
249 require.NoError(t, err)
250 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_FAILURE, first.Msg.GetRun().GetConclusion())
251 assert.EqualValues(t, 2, first.Msg.GetLatestAttempt())
252
253 // Re-running a run with nothing failed is refused with failed-only.
254 _, err = c.root.run.RerunRun(c.ctx, connect.NewRequest(&pb.RerunRunRequest{Repo: "proj", RunId: id, FailedOnly: true}))
255 assert.Equal(t, connect.CodeFailedPrecondition, ciErrCode(err))
256}
257
258// A matrix is expanded when its job is ready, with fail-fast.
259func TestCIMatrixAndFailFast(t *testing.T) {
260 c := newCIHarness(t, nil)
261 runner := c.registerRunner("alpha", "ubuntu-latest")
262 c.push("main", map[string]string{".github/workflows/m.yml": `on: push
263jobs:
264 build:
265 runs-on: ubuntu-latest
266 strategy:
267 matrix:
268 go: ['1.26', '1.27']
269 steps:
270 - run: echo ${{ matrix.go }}
271 after:
272 needs: build
273 if: always()
274 runs-on: ubuntu-latest
275 steps:
276 - run: echo done
277`}, "")
278 a := runner.await()
279 b := runner.await()
280 assert.Equal(t, "build", a.GetJobKey())
281 assert.JSONEq(t, `{"go":"1.26"}`, a.GetMatrix())
282 assert.JSONEq(t, `{"go":"1.27"}`, b.GetMatrix())
283 assert.Contains(t, a.GetContexts(), `"job-total":2`)
284
285 jobs := c.getRun(c.runs()[0].GetId()).GetJobs()
286 var names []string
287 for _, j := range jobs {
288 names = append(names, j.GetName())
289 }
290 assert.Equal(t, []string{"build (1.26)", "build (1.27)", "after"}, names)
291
292 // The first fails: fail-fast asks the second to stop.
293 apiB := runner.jobAPI(b)
294 _, err := apiB.runner.Heartbeat(c.ctx, connect.NewRequest(&pb.HeartbeatRequest{JobId: b.GetJobId()}))
295 require.NoError(t, err)
296 watch, err := apiB.runner.WatchJob(c.ctx, connect.NewRequest(&pb.WatchJobRequest{JobId: b.GetJobId()}))
297 require.NoError(t, err)
298 runner.runJob(a, pb.CiConclusion_CI_CONCLUSION_FAILURE, nil, "x")
299 var reason pb.CancelReason
300 for watch.Receive() {
301 if m := watch.Msg().GetCancel(); m != nil {
302 reason = m.GetReason()
303 break
304 }
305 }
306 assert.Equal(t, pb.CancelReason_CANCEL_REASON_FAIL_FAST, reason)
307 _, err = apiB.runner.CompleteJob(c.ctx, connect.NewRequest(&pb.CompleteJobRequest{JobId: b.GetJobId(), Conclusion: pb.CiConclusion_CI_CONCLUSION_CANCELLED}))
308 require.NoError(t, err)
309
310 // "after" has if: always(), so it runs once both ended.
311 after := runner.await()
312 assert.Equal(t, "after", after.GetJobKey())
313 assert.Contains(t, after.GetContexts(), `"result":"failure"`)
314 runner.runJob(after, pb.CiConclusion_CI_CONCLUSION_SUCCESS, nil, "done")
315 c.waitFor("the run ends", func() bool { return c.runs()[0].GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED })
316 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_FAILURE, c.runs()[0].GetConclusion())
317}
318
319// A job with a feature of a later phase fails clearly, never silently.
320func TestCIUnsupportedFeatureFailsTheJob(t *testing.T) {
321 c := newCIHarness(t, nil)
322 c.registerRunner("alpha", "ubuntu-latest")
323 c.push("main", map[string]string{".github/workflows/u.yml": `on: push
324jobs:
325 j:
326 runs-on: ubuntu-latest
327 concurrency: group
328 steps:
329 - run: echo
330`}, "")
331 c.waitFor("the run fails", func() bool { return len(c.runs()) == 1 && c.runs()[0].GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED })
332 j := c.getRun(c.runs()[0].GetId()).GetJobs()[0]
333 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_FAILURE, j.GetConclusion())
334 assert.Equal(t, "not supported yet: concurrency", j.GetError())
335}
336
337// A job for a label no runner has is "waiting for a runner" and fails after the
338// queue timeout.
339func TestCIQueueTimeout(t *testing.T) {
340 c := newCIHarness(t, func(cfg *usecase.CIConfig) { cfg.QueueTimeout, cfg.Tick = 300*time.Millisecond, 20*time.Millisecond })
341 c.registerRunner("alpha", "ubuntu-latest")
342 c.push("main", map[string]string{".github/workflows/q.yml": strings.Replace(workflowWith("branches: [main]"), "ubuntu-latest", "gpu", 1)}, "")
343 c.waitFor("the job fails", func() bool { return len(c.runs()) == 1 && c.runs()[0].GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED })
344 j := c.getRun(c.runs()[0].GetId()).GetJobs()[0]
345 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_FAILURE, j.GetConclusion())
346 assert.Contains(t, j.GetError(), "was not acquired")
347}
348
349// The runner API validates what it is given.
350func TestCIRunnerRegistrationRules(t *testing.T) {
351 c := newCIHarness(t, nil)
352 reg := func(api *clients, name string, replace bool) error {
353 _, err := api.runner.RegisterRunner(c.ctx, connect.NewRequest(&pb.RegisterRunnerRequest{
354 Name: name, Version: "v1", Isolation: pb.RunnerIsolation_RUNNER_ISOLATION_VM, Arch: "x64", Os: "linux", Replace: replace,
355 }))
356 return err
357 }
358 assert.Equal(t, connect.CodeUnauthenticated, ciErrCode(reg(c.api(""), "a", false)))
359 assert.Equal(t, connect.CodePermissionDenied, ciErrCode(reg(c.api(c.token(scopes(domain.ScopeRepoRead))), "a", false)))
360 assert.Equal(t, connect.CodePermissionDenied, ciErrCode(reg(c.api(c.token(scopes(domain.ScopeRunnerRegister), "proj")), "a", false)), "a repository-restricted token cannot register a runner")
361 reg1 := c.api(c.token(scopes(domain.ScopeRunnerRegister)))
362 require.NoError(t, reg(reg1, "a", false))
363 assert.Equal(t, connect.CodeAlreadyExists, ciErrCode(reg(reg1, "a", false)))
364 require.NoError(t, reg(reg1, "a", true), "replace")
365 assert.Equal(t, connect.CodeInvalidArgument, ciErrCode(reg(reg1, "bad name!", false)))
366
367 list, err := reg1.run.ListRunners(c.ctx, connect.NewRequest(&pb.ListRunnersRequest{}))
368 require.NoError(t, err)
369 require.Len(t, list.Msg.GetRunners(), 1)
370 assert.Equal(t, []string{"linux", "self-hosted", "x64"}, list.Msg.GetRunners()[0].GetLabels(), "implicit labels, sorted")
371}
372
373// AC2: after a restart of the server, running jobs go on with their tokens,
374// queued jobs stay queued, and a job whose runner kept quiet during the outage
375// is not failed for it.
376func TestCIRestartKeepsRunningAndQueuedJobs(t *testing.T) {
377 c := newCIHarness(t, func(cfg *usecase.CIConfig) { cfg.HeartbeatDeadline = 2 * time.Second })
378 runner := c.registerRunner("alpha", "ubuntu-latest")
379 c.push("main", map[string]string{".github/workflows/ci.yml": ciWorkflow}, "")
380 job := runner.await() // "build"; "test" waits for it
381 api := runner.jobAPI(job)
382 _, err := api.runner.Heartbeat(c.ctx, connect.NewRequest(&pb.HeartbeatRequest{JobId: job.GetJobId()}))
383 require.NoError(t, err)
384 _, err = api.runner.AppendLog(c.ctx, connect.NewRequest(&pb.AppendLogRequest{
385 JobId: job.GetJobId(), Step: 2, Offset: 0, Lines: []*pb.LogLine{{Time: now(), Text: "before the restart"}},
386 }))
387 require.NoError(t, err)
388
389 // Stop the server and start another on the same data directory.
390 cfg, hookExe := c.forge.cfg, binary(t)
391 c.srv.Close()
392 c.forge.Close(c.ctx)
393 f2, err := newForge(c.ctx, cfg, options{hookExe: hookExe, ci: func(cc *usecase.CIConfig) { cc.HeartbeatDeadline = 2 * time.Second }})
394 require.NoError(t, err)
395 t.Cleanup(func() { f2.Close(context.WithoutCancel(c.ctx)) })
396 srv := httptest.NewServer(f2.server.Handler())
397 t.Cleanup(srv.Close)
398 api2 := newClients(srv.URL+"/-/api", job.GetJobToken())
399
400 // The job token still works, and the log goes on from where it was.
401 _, err = api2.runner.Heartbeat(c.ctx, connect.NewRequest(&pb.HeartbeatRequest{JobId: job.GetJobId()}))
402 require.NoError(t, err, "the job token survives a restart")
403 next, err := api2.runner.AppendLog(c.ctx, connect.NewRequest(&pb.AppendLogRequest{
404 JobId: job.GetJobId(), Step: 2, Offset: 1, Lines: []*pb.LogLine{{Time: now(), Text: "after the restart"}},
405 }))
406 require.NoError(t, err)
407 assert.EqualValues(t, 2, next.Msg.GetNextOffset())
408
409 root2 := newClients(srv.URL+"/-/api", adminToken)
410 runs, err := root2.run.ListRuns(c.ctx, connect.NewRequest(&pb.ListRunsRequest{Repo: "proj"}))
411 require.NoError(t, err)
412 require.Len(t, runs.Msg.GetRuns(), 1)
413 assert.Equal(t, pb.CiStatus_CI_STATUS_IN_PROGRESS, runs.Msg.GetRuns()[0].GetStatus())
414
415 // Finish the job on the new server: its dependant is planned and ready.
416 _, err = api2.runner.CompleteJob(c.ctx, connect.NewRequest(&pb.CompleteJobRequest{
417 JobId: job.GetJobId(), Conclusion: pb.CiConclusion_CI_CONCLUSION_SUCCESS,
418 }))
419 require.NoError(t, err)
420 got := make(chan *pb.Job, 1)
421 go func() {
422 for range 50 {
423 res, err := newClients(srv.URL+"/-/api", c.runnerSecret(runner)).runner.FetchJob(c.ctx, connect.NewRequest(&pb.FetchJobRequest{}))
424 if err == nil && res.Msg.GetJob() != nil {
425 got <- res.Msg.GetJob()
426 return
427 }
428 }
429 got <- nil
430 }()
431 select {
432 case j := <-got:
433 require.NotNil(t, j, "the runner token and the queue survive a restart")
434 assert.Equal(t, "test", j.GetJobKey())
435 case <-time.After(30 * time.Second):
436 t.Fatal("no job after the restart")
437 }
438}
439
440// AC5: a head without any check merges, and so does one whose checks passed; a
441// merge runs the push workflows on the target.
442func TestCIMergeWithoutChecksAndWithPassingChecks(t *testing.T) {
443 c := newCIHarness(t, nil)
444 runner := c.registerRunner("alpha", "ubuntu-latest")
445 c.push("main", map[string]string{"README": "x\n"}, "")
446 headOf := func(branch string) string { return strings.TrimSpace(c.bareGit("proj", "rev-parse", branch)) }
447 merge := func(n int64, head string) error {
448 _, err := c.root.mr.MergeMergeRequest(c.ctx, connect.NewRequest(&pb.MergeMergeRequestRequest{Repo: "proj", Number: n, HeadId: head}))
449 return err
450 }
451
452 // No workflow on the branch: no check, the merge goes through.
453 c.push("plain", map[string]string{"a.txt": "a\n"}, "")
454 mr1, err := c.root.mr.CreateMergeRequest(c.ctx, connect.NewRequest(&pb.CreateMergeRequestRequest{Repo: "proj", Title: "plain", SourceBranch: "plain"}))
455 require.NoError(t, err)
456 require.NoError(t, merge(mr1.Msg.GetMergeRequest().GetNumber(), headOf("plain")))
457
458 // A branch with a workflow: merge after its check passed. The merge itself
459 // triggers the workflow on main (GitHub runs push workflows on a merge).
460 c.mustGit(c.wt, "checkout", "-q", "main")
461 c.mustGit(c.wt, "pull", "-q", c.urlAuth(adminToken, "/proj.git"), "main")
462 c.mustGit(c.wt, "checkout", "-q", "-b", "ci")
463 c.writeFile(c.wt, ".github/workflows/ci.yml", []byte(strings.Replace(workflowWith("branches: [main, ci]"), "echo hi", "echo ci", 1)))
464 c.mustGit(c.wt, "push", "-q", c.urlAuth(adminToken, "/proj.git"), "ci")
465 head := headOf("ci")
466 c.waitFor("the run on ci", func() bool { return len(c.checks(head)) == 1 })
467 mr2, err := c.root.mr.CreateMergeRequest(c.ctx, connect.NewRequest(&pb.CreateMergeRequestRequest{Repo: "proj", Title: "ci", SourceBranch: "ci"}))
468 require.NoError(t, err)
469 job := runner.await()
470 runner.runJob(job, pb.CiConclusion_CI_CONCLUSION_SUCCESS, nil, "ok")
471 c.waitFor("the check passes", func() bool {
472 cs := c.checks(head)
473 return len(cs) == 1 && cs[0].GetConclusion() == pb.CiConclusion_CI_CONCLUSION_SUCCESS
474 })
475 require.NoError(t, merge(mr2.Msg.GetMergeRequest().GetNumber(), head))
476
477 // The fast-forward merge moved main to the same commit: the workflow runs
478 // again for main, with the owner as the actor.
479 c.waitFor("the merge triggers a run on main", func() bool {
480 for _, r := range c.runs() {
481 if r.GetRef() == "refs/heads/main" && r.GetSha() == head {
482 return true
483 }
484 }
485 return false
486 })
487 for _, r := range c.runs() {
488 if r.GetRef() == "refs/heads/main" {
489 assert.Equal(t, "owner", r.GetActor())
490 }
491 }
492}
493
494// Repository deletion removes the runs, the checks and the logs; a repository
495// created again starts at run number 1.
496func TestCIRepositoryDeletionRemovesRunsAndLogs(t *testing.T) {
497 c := newCIHarness(t, nil)
498 runner := c.registerRunner("alpha", "ubuntu-latest")
499 sha := c.push("main", map[string]string{".github/workflows/ci.yml": strings.Split(ciWorkflow, " test:")[0]}, "")
500 job := runner.await()
501 runner.runJob(job, pb.CiConclusion_CI_CONCLUSION_SUCCESS, nil, "line")
502 logDir := filepath.Join(c.data, "ci", "logs")
503 entries, err := os.ReadDir(logDir)
504 require.NoError(t, err)
505 require.NotEmpty(t, entries, "the log is a file under ci/logs")
506
507 _, err = c.root.repo.DeleteRepo(c.ctx, connect.NewRequest(&pb.DeleteRepoRequest{Repo: "proj"}))
508 require.NoError(t, err)
509 _, err = c.root.run.ListRuns(c.ctx, connect.NewRequest(&pb.ListRunsRequest{Repo: "proj"}))
510 assert.Equal(t, connect.CodeNotFound, ciErrCode(err))
511 entries, err = os.ReadDir(logDir)
512 require.NoError(t, err)
513 assert.Empty(t, entries, "the logs are removed with the repository")
514
515 _, err = c.forge.Repos.Create(c.ctx, domain.Root(), ports.CreateRepoParams{Name: c.name("proj"), Visibility: domain.VisibilityPrivate})
516 require.NoError(t, err)
517 assert.Empty(t, c.checks(sha), "no check survives the repository")
518 c.push("main", map[string]string{".github/workflows/ci.yml": strings.Split(ciWorkflow, " test:")[0] + "# again\n"}, "again")
519 c.waitFor("a run", func() bool { return len(c.runs()) == 1 })
520 assert.EqualValues(t, 1, c.runs()[0].GetNumber(), "run numbers start again with the repository")
521 assert.Greater(t, c.runs()[0].GetId(), int64(1), "run ids are never reused")
522}
523
524// The events of a run and its jobs are published on the repository topic.
525func TestCIEventsAreStreamedOnTheRepositoryTopic(t *testing.T) {
526 c := newCIHarness(t, nil)
527 runner := c.registerRunner("alpha", "ubuntu-latest")
528 s := c.watch(c.root, "", "repo:proj")
529 c.push("main", map[string]string{".github/workflows/ci.yml": strings.Split(ciWorkflow, " test:")[0]}, "")
530 job := runner.await()
531 runner.runJob(job, pb.CiConclusion_CI_CONCLUSION_SUCCESS, nil, "x")
532
533 var runUpdates, jobUpdates int
534 var lastRun *pb.Run
535 deadline := time.After(10 * time.Second)
536 for lastRun.GetStatus() != pb.CiStatus_CI_STATUS_COMPLETED {
537 select {
538 case ev := <-s.events:
539 if r := ev.GetRunUpdated(); r != nil {
540 runUpdates++
541 if r.GetRun().GetVersion() >= lastRun.GetVersion() {
542 lastRun = r.GetRun()
543 }
544 }
545 if ev.GetJobUpdated() != nil {
546 jobUpdates++
547 }
548 case <-deadline:
549 t.Fatalf("no completed run event: %d run and %d job events", runUpdates, jobUpdates)
550 }
551 }
552 assert.GreaterOrEqual(t, runUpdates, 2)
553 assert.GreaterOrEqual(t, jobUpdates, 2)
554
555 // They are never sent on "home".
556 home := c.watch(c.root, "", "home")
557 _, err := c.root.run.RerunRun(c.ctx, connect.NewRequest(&pb.RerunRunRequest{Repo: "proj", RunId: lastRun.GetId()}))
558 require.NoError(t, err)
559 c.sentinel(t, home, "sentinel")
560}
561
562// A new branch at a commit that already exists, and a branch rewound to an
563// ancestor, bring no new commit: GitHub still runs the push workflows (those
564// without a paths filter, as no file changed).
565func TestCIPushWithoutNewCommitsStillRuns(t *testing.T) {
566 c := newCIHarness(t, nil)
567 c.registerRunner("alpha", "ubuntu-latest")
568 c.push("main", map[string]string{".github/workflows/any.yml": workflowWith("branches: ['**']")}, "")
569 c.waitFor("main runs", func() bool { return len(c.runs()) == 1 })
570 first := strings.TrimSpace(c.mustGit(c.wt, "rev-parse", "HEAD"))
571
572 // A new branch at the commit main already has.
573 c.mustGit(c.wt, "push", "-q", c.urlAuth(adminToken, "/proj.git"), "HEAD:refs/heads/same")
574 c.waitFor("the new branch runs", func() bool { return len(c.runs()) == 2 })
575 assert.Equal(t, "refs/heads/same", c.runs()[0].GetRef())
576 assert.Equal(t, first, c.runs()[0].GetSha())
577
578 // A branch moved forward, then rewound to its ancestor (a forced push).
579 c.push("main", map[string]string{"a.txt": "a\n"}, "")
580 c.waitFor("the push runs", func() bool { return len(c.runs()) == 3 })
581 c.mustGit(c.wt, "push", "-q", "-f", c.urlAuth(adminToken, "/proj.git"), first+":refs/heads/main")
582 c.waitFor("the rewind runs", func() bool { return len(c.runs()) == 4 })
583 assert.Equal(t, first, c.runs()[0].GetSha())
584}
585
586// CI is on once a runner is registered: before that a push makes no run and no
587// check; after, it does.
588func TestCINoRunnerNoRunsNoChecks(t *testing.T) {
589 c := newCIHarness(t, nil)
590 sha := c.push("main", map[string]string{".github/workflows/ci.yml": ciWorkflow}, "")
591 time.Sleep(400 * time.Millisecond)
592 assert.Empty(t, c.runs())
593 assert.Empty(t, c.checks(sha))
594
595 c.registerRunner("alpha", "ubuntu-latest")
596 c.push("main", map[string]string{"a.txt": "a\n"}, "")
597 c.waitFor("a run once a runner exists", func() bool { return len(c.runs()) == 1 })
598}
599
600// A job that fail-fast cancelled while its assignment was not acknowledged is
601// over when the assignment is cancelled: it is not given to a runner again.
602func TestCICancelledUnacknowledgedAssignmentIsNotAssignedAgain(t *testing.T) {
603 c := newCIHarness(t, func(cfg *usecase.CIConfig) {
604 cfg.AckTimeout, cfg.Tick, cfg.PollTimeout = 300*time.Millisecond, 20*time.Millisecond, 100*time.Millisecond
605 })
606 runner := c.registerRunner("alpha", "ubuntu-latest")
607 c.push("main", map[string]string{".github/workflows/m.yml": `on: push
608jobs:
609 build:
610 runs-on: ubuntu-latest
611 strategy:
612 matrix:
613 n: [1, 2]
614 steps:
615 - run: echo ${{ matrix.n }}
616`}, "")
617 a, b := runner.await(), runner.await() // both assigned, neither acknowledged yet
618 assert.NotEqual(t, a.GetJobId(), b.GetJobId())
619
620 runner.runJob(a, pb.CiConclusion_CI_CONCLUSION_FAILURE, nil, "x") // fail-fast asks b to stop
621
622 c.waitFor("the run ends", func() bool { return c.runs()[0].GetStatus() == pb.CiStatus_CI_STATUS_COMPLETED })
623 for _, j := range c.getRun(c.runs()[0].GetId()).GetJobs() {
624 if j.GetId() == b.GetJobId() {
625 assert.Equal(t, pb.CiConclusion_CI_CONCLUSION_CANCELLED, j.GetConclusion())
626 }
627 }
628 again, err := runner.fetch("")
629 require.NoError(t, err)
630 assert.Nil(t, again, "a cancelled job is not given again")
631}
632
633// Once the runner acknowledged a job, a retried poll with the same poll_id has
634// nothing to repeat: the plaintext token is no longer kept.
635func TestCIAcknowledgedAssignmentIsNotRepeated(t *testing.T) {
636 c := newCIHarness(t, func(cfg *usecase.CIConfig) { cfg.PollTimeout = 150 * time.Millisecond })
637 runner := c.registerRunner("alpha", "ubuntu-latest")
638 c.push("main", map[string]string{".github/workflows/ci.yml": strings.Split(ciWorkflow, " test:")[0]}, "")
639 var job *pb.Job
640 c.waitFor("a job", func() bool {
641 j, err := runner.fetch("poll-9")
642 require.NoError(t, err)
643 job = j
644 return j != nil
645 })
646 _, err := runner.jobAPI(job).runner.Heartbeat(c.ctx, connect.NewRequest(&pb.HeartbeatRequest{JobId: job.GetJobId()}))
647 require.NoError(t, err)
648 again, err := runner.fetch("poll-9")
649 require.NoError(t, err)
650 assert.Nil(t, again, "the acknowledged assignment is not handed out again")
651}
652
653// The push payload follows GitHub's (checked against the recordings of
654// ermite-conformance): 12-character ids in "compare", the commit page for a
655// created ref and a compare range for an update, the default branch of the
656// repository, a tree id, and string counters.
657func TestCIGithubContextOfAPush(t *testing.T) {
658 c := newCIHarness(t, nil)
659 runner := c.registerRunner("alpha", "ubuntu-latest")
660 oneJobWF := strings.Split(ciWorkflow, " test:")[0]
661 first := c.push("main", map[string]string{".github/workflows/ci.yml": oneJobWF}, "")
662 ev := func() (map[string]any, map[string]any) {
663 job := runner.await()
664 var ctxs map[string]map[string]any
665 require.NoError(t, json.Unmarshal([]byte(job.GetContexts()), &ctxs))
666 gh := ctxs["github"]
667 runner.runJob(job, pb.CiConclusion_CI_CONCLUSION_SUCCESS, nil, "x")
668 return gh, gh["event"].(map[string]any)
669 }
670
671 gh, event := ev()
672 assert.Equal(t, publicOrigin+"/owner/proj/commit/"+first[:12], event["compare"], "a created ref compares as its commit")
673 assert.Equal(t, true, event["created"])
674 assert.Equal(t, domain.ZeroOID, event["before"])
675 repo := event["repository"].(map[string]any)
676 assert.Equal(t, "main", repo["default_branch"])
677 assert.Equal(t, "main", repo["master_branch"])
678 assert.Equal(t, "90", gh["retention_days"], "a string, from the configured retention")
679 head := event["head_commit"].(map[string]any)
680 tree := strings.TrimSpace(c.bareGit("proj", "rev-parse", first+"^{tree}"))
681 assert.Equal(t, tree, head["tree_id"])
682
683 second := c.push("main", map[string]string{"a.txt": "a\n"}, "")
684 _, event = ev()
685 assert.Equal(t, publicOrigin+"/owner/proj/compare/"+first[:12]+"..."+second[:12], event["compare"])
686 assert.Equal(t, false, event["created"])
687}