-
Notifications
You must be signed in to change notification settings - Fork 3
Support GitHub job container options and volumes #373
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
lox
wants to merge
15
commits into
main
Choose a base branch
from
compat/job-container-options-volumes
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
15 commits
Select commit
Hold shift + click to select a range
2fd054a
Support bounded job container options and volumes
ampagent dd79972
Clean volumes after ambiguous container creation
ampagent 8242455
Reject duplicate job container volume targets
ampagent ca3d86a
Reject unsupported short job volume names
ampagent beeebc6
Reconcile job volumes after setup cancellation
ampagent 8242ff4
Preserve container ownership edge cases
ampagent 3a5e598
Match GitHub job container controls
ampagent 51be880
Align job container plan schema
ampagent 77a101a
Retry ambiguous job container cleanup
ampagent d65ec6f
Retry ambiguous volume cleanup
ampagent 330ca5c
Track volume ownership reconciliation
ampagent cab308b
Guard Docker volume ownership baseline
ampagent 0f12a7b
Simplify container create reconciliation
ampagent 79a8dff
Integrate job containers with workflow programs
ampagent 327e242
Inventory job container program fields
ampagent File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,141 @@ | ||
| // Package containerpolicy owns the job-container Docker syntax that workflows | ||
| // may control. | ||
| package containerpolicy | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "path" | ||
| "regexp" | ||
| "strings" | ||
| ) | ||
|
|
||
| const MaxJobVolumes = 128 | ||
| const MaxJobOptionsLength = 65536 | ||
|
|
||
| var volumeNamePattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*$`) | ||
|
|
||
| // JobOptions splits options using the GitHub runner's argument rules and | ||
| // rejects the network and entrypoint overrides that GitHub does not support. | ||
| // It returns the exact Docker argv without invoking a shell. | ||
| func JobOptions(value string) ([]string, error) { | ||
| if len(value) > MaxJobOptionsLength || strings.ContainsAny(value, "\x00\r\n") { | ||
| return nil, fmt.Errorf("options exceed %d bytes or contain a control character", MaxJobOptionsLength) | ||
| } | ||
| args := ArgumentList(value) | ||
| for _, arg := range args { | ||
| for _, unsupported := range []string{"--network", "--net", "--entrypoint"} { | ||
| if arg == unsupported || strings.HasPrefix(arg, unsupported+"=") { | ||
| return nil, fmt.Errorf("option %q is unsupported", arg) | ||
| } | ||
| } | ||
| } | ||
| return args, nil | ||
| } | ||
|
|
||
| // ValidateJobVolume accepts GitHub's named, anonymous, and absolute host-bind | ||
| // volume syntax with an absolute container destination. | ||
| func ValidateJobVolume(value string) error { | ||
| if value == "" || len(value) > 4096 || hasASCIIControl(value) { | ||
| return fmt.Errorf("volume is empty, too long, or contains a control character") | ||
| } | ||
| parts := strings.Split(value, ":") | ||
| var source, target, mode string | ||
| switch len(parts) { | ||
| case 1: | ||
| target = parts[0] | ||
| case 2: | ||
| source, target = parts[0], parts[1] | ||
| if source == "" { | ||
| return fmt.Errorf("volume source is empty") | ||
| } | ||
| case 3: | ||
| source, target, mode = parts[0], parts[1], parts[2] | ||
| if source == "" { | ||
| return fmt.Errorf("volume source is empty") | ||
| } | ||
| default: | ||
| return fmt.Errorf("volume must be DESTINATION or SOURCE:DESTINATION[:ro|rw]") | ||
| } | ||
| if source != "" && !path.IsAbs(source) && !volumeNamePattern.MatchString(source) { | ||
| return fmt.Errorf("volume source %q must be a name or absolute host path", source) | ||
| } | ||
| if !path.IsAbs(target) { | ||
| return fmt.Errorf("volume target %q must be an absolute path", target) | ||
| } | ||
| if mode != "" && mode != "ro" && mode != "rw" { | ||
| return fmt.Errorf("volume mode %q is unsupported", mode) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // ValidateJobVolumes applies the bounded list contract used by plans and the | ||
| // runtime boundary. | ||
| func ValidateJobVolumes(values []string) error { | ||
| if len(values) > MaxJobVolumes { | ||
| return fmt.Errorf("more than %d volumes", MaxJobVolumes) | ||
| } | ||
| seen := map[string]bool{} | ||
| for _, value := range values { | ||
| if seen[value] { | ||
| return fmt.Errorf("volume %q is repeated", value) | ||
| } | ||
| seen[value] = true | ||
| if err := ValidateJobVolume(value); err != nil { | ||
| return fmt.Errorf("invalid volume %q: %w", value, err) | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func hasASCIIControl(value string) bool { | ||
| return strings.ContainsFunc(value, func(r rune) bool { return r < 0x20 || r == 0x7f }) | ||
| } | ||
|
|
||
| // ArgumentList matches the argument splitting used by the pinned | ||
| // actions/runner ProcessStartInfo.Arguments path. Single quotes are ordinary | ||
| // characters; double quotes group arguments; backslashes only escape quotes. | ||
| func ArgumentList(value string) []string { | ||
|
lox marked this conversation as resolved.
|
||
| var args []string | ||
| for i := 0; i < len(value); { | ||
| for i < len(value) && (value[i] == ' ' || value[i] == '\t') { | ||
| i++ | ||
| } | ||
| if i == len(value) { | ||
| break | ||
| } | ||
| var arg strings.Builder | ||
| quoted := false | ||
| for i < len(value) { | ||
| if !quoted && (value[i] == ' ' || value[i] == '\t') { | ||
| break | ||
| } | ||
| backslashes := 0 | ||
| for i < len(value) && value[i] == '\\' { | ||
| backslashes++ | ||
| i++ | ||
| } | ||
| copyCharacter := true | ||
| if i < len(value) && value[i] == '"' { | ||
| if backslashes%2 == 0 { | ||
| if quoted && i+1 < len(value) && value[i+1] == '"' { | ||
| i++ | ||
| } else { | ||
| copyCharacter = false | ||
| quoted = !quoted | ||
| } | ||
| } | ||
| backslashes /= 2 | ||
| } | ||
| arg.WriteString(strings.Repeat("\\", backslashes)) | ||
| if i == len(value) || !quoted && (value[i] == ' ' || value[i] == '\t') { | ||
| break | ||
| } | ||
| if copyCharacter { | ||
| arg.WriteByte(value[i]) | ||
| } | ||
| i++ | ||
| } | ||
| args = append(args, arg.String()) | ||
| } | ||
| return args | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| package containerpolicy | ||
|
|
||
| import ( | ||
| "slices" | ||
| "strings" | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestJobOptionsAcceptedSyntax(t *testing.T) { | ||
| value := `--privileged --user 1000 --label "description=two words" --mount type=tmpfs,dst=/tmp --name=custom` | ||
| want := []string{"--privileged", "--user", "1000", "--label", "description=two words", "--mount", "type=tmpfs,dst=/tmp", "--name=custom"} | ||
| got, err := JobOptions(value) | ||
| if err != nil || !slices.Equal(got, want) { | ||
| t.Fatalf("JobOptions(%q) = %#v, %v; want %#v", value, got, err, want) | ||
| } | ||
| } | ||
|
|
||
| func TestJobOptionsRejectsUnsupportedOverrides(t *testing.T) { | ||
| for _, value := range []string{ | ||
| "--network host", "--network=host", "--net host", "--net=host", | ||
| "--entrypoint sh", "--entrypoint=sh", | ||
| } { | ||
| t.Run(value, func(t *testing.T) { | ||
| if _, err := JobOptions(value); err == nil { | ||
| t.Fatal("JobOptions() accepted an unsupported override") | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestJobOptionsInputBounds(t *testing.T) { | ||
| if _, err := JobOptions(strings.Repeat("x", MaxJobOptionsLength)); err != nil { | ||
| t.Fatalf("JobOptions() rejected the maximum input length: %v", err) | ||
| } | ||
| for _, value := range []string{strings.Repeat("x", MaxJobOptionsLength+1), "--label=a\n--privileged", "--label=a\x00b"} { | ||
| if _, err := JobOptions(value); err == nil { | ||
| t.Fatal("JobOptions() accepted out-of-bounds input") | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func TestArgumentList(t *testing.T) { | ||
| t.Parallel() | ||
| for _, test := range []struct { | ||
| name, value string | ||
| want []string | ||
| }{ | ||
| {name: "empty argument", value: `--env ""`, want: []string{"--env", ""}}, | ||
| {name: "double quotes", value: `--health-cmd "pg_isready -U postgres"`, want: []string{"--health-cmd", "pg_isready -U postgres"}}, | ||
| {name: "single quotes are literal", value: `--label 'two words'`, want: []string{"--label", "'two", "words'"}}, | ||
| {name: "escaped quote", value: `one\"two`, want: []string{`one"two`}}, | ||
| {name: "unmatched quote", value: `"two words`, want: []string{"two words"}}, | ||
| {name: "newline is literal", value: "one\ntwo", want: []string{"one\ntwo"}}, | ||
| {name: "consecutive quotes", value: `"one""two"`, want: []string{`one"two`}}, | ||
| } { | ||
| t.Run(test.name, func(t *testing.T) { | ||
| if got := ArgumentList(test.value); !slices.Equal(got, test.want) { | ||
| t.Fatalf("ArgumentList(%q) = %#v; want %#v", test.value, got, test.want) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestValidateJobVolume(t *testing.T) { | ||
| for _, value := range []string{ | ||
| "v:/data", "cache:/cache", "cache.v1:/var/cache:ro", "CACHE_1:/data:rw", | ||
| "/anonymous", "/srv/cache:/cache", "/srv/cache:/cache:rw", | ||
| } { | ||
| if err := ValidateJobVolume(value); err != nil { | ||
| t.Errorf("ValidateJobVolume(%q) = %v", value, err) | ||
| } | ||
| } | ||
| for _, value := range []string{"-bad:/data", "relative/path:/data", "cache:data", "cache:/data:z", ":/data", "/anonymous:ro"} { | ||
| if err := ValidateJobVolume(value); err == nil { | ||
| t.Errorf("ValidateJobVolume(%q) accepted invalid volume", value) | ||
| } | ||
| } | ||
| if err := ValidateJobVolumes([]string{"cache:/one", "cache:/one"}); err == nil { | ||
| t.Error("ValidateJobVolumes() accepted a repeated volume") | ||
| } | ||
| if err := ValidateJobVolumes([]string{"one:/cache", "two:/cache"}); err != nil { | ||
| t.Errorf("ValidateJobVolumes() rejected Docker-owned duplicate target validation: %v", err) | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.