mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-01 20:59:45 +09:00
Zettat123
a71c5c94c5
Align job and `runs-on` validation with github.com, as implemented by the parser in https://github.com/actions/runner. A job without `runs-on` could be claimed by any runner, so a job meant for a container could run on the host. - Jobs without `runs-on` fail with `Required property is missing: runs-on`, called workflows included - Unknown job keys and callers (`uses:`) mixed with steps-only keys like `runs-on` are rejected - Empty, null and nested `runs-on` values are rejected - A `runs-on` evaluating to such a value fails only that job - Called workflows are validated at run creation, an invalid one fails the run as an invalid workflow file - Zero labels (`runs-on: []` or `{}`) never match a runner, including jobs queued before upgrading <img width="960" alt="image" src="https://github.com/user-attachments/assets/e746ce5a-b711-4e8b-aab8-81336ff53d86" /> **Behavior Change:** workflows that omit `runs-on`, use unknown job keys or mix `uses` with `runs-on` stop running until fixed. --------- Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io>
75 lines
3.4 KiB
Go
75 lines
3.4 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
actions_model "gitea.dev/models/actions"
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/db"
|
|
git_model "gitea.dev/models/git"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/commitstatus"
|
|
"gitea.dev/modules/json"
|
|
"gitea.dev/routers/web/repo/actions"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestActionsInvalidWorkflowPush(t *testing.T) {
|
|
onGiteaRun(t, func(t *testing.T, _ *url.URL) {
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
session := loginUser(t, user.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
|
|
for _, testCase := range []struct {
|
|
name string
|
|
content string
|
|
wantErrors []string
|
|
}{
|
|
{"expression", "on: push\nrun-name: '${{ github.ref'\njobs: {check: {runs-on: ubuntu-latest, if: unknown.x}}\n", []string{"Unrecognized named-value: 'unknown'", "unclosed expression"}},
|
|
{"trigger", "on:\njobs: {check: {runs-on: ubuntu-latest, steps: [{run: echo hello}]}}\n", []string{"invalid event"}},
|
|
} {
|
|
t.Run(testCase.name, func(t *testing.T) {
|
|
repo := createActionsTestRepo(t, token, "invalid-workflow-"+testCase.name, false)
|
|
createWorkflowFile(t, token, user.Name, repo.Name, ".gitea/workflows/invalid.yml",
|
|
getWorkflowCreateFileOptions(user, repo.DefaultBranch, "invalid workflow", testCase.content))
|
|
|
|
runs, err := db.Find[actions_model.ActionRun](t.Context(), actions_model.FindRunOptions{RepoID: repo.ID})
|
|
require.NoError(t, err)
|
|
require.Len(t, runs, 1)
|
|
run := runs[0]
|
|
assert.Equal(t, actions_model.StatusFailure, run.Status)
|
|
|
|
statuses, err := git_model.GetLatestCommitStatus(t.Context(), repo.ID, run.CommitSHA, db.ListOptionsAll)
|
|
require.NoError(t, err)
|
|
require.Len(t, statuses, 1)
|
|
assert.Equal(t, commitstatus.CommitStatusFailure, statuses[0].State)
|
|
|
|
view := session.MakeRequest(t, NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d", user.Name, repo.Name, run.ID)), http.StatusOK)
|
|
var viewResponse actions.ViewResponse
|
|
require.NoError(t, json.Unmarshal(view.Body.Bytes(), &viewResponse))
|
|
assert.Empty(t, viewResponse.State.Run.Jobs)
|
|
require.Len(t, viewResponse.State.Run.JobSummaries, 1)
|
|
assert.Equal(t, "invalid.yml", viewResponse.State.Run.JobSummaries[0].JobName)
|
|
assert.Contains(t, string(viewResponse.State.Run.JobSummaries[0].SummaryHTML), "Invalid workflow file: invalid.yml")
|
|
actionsPage := session.MakeRequest(t, NewRequest(t, "GET", fmt.Sprintf("/%s/%s/actions", user.Name, repo.Name)), http.StatusOK)
|
|
filePage := session.MakeRequest(t, NewRequest(t, "GET", fmt.Sprintf("/%s/%s/src/branch/%s/.gitea/workflows/invalid.yml", user.Name, repo.Name, repo.DefaultBranch)), http.StatusOK)
|
|
for _, wantError := range testCase.wantErrors {
|
|
assert.Contains(t, string(viewResponse.State.Run.JobSummaries[0].SummaryHTML), wantError)
|
|
assert.Contains(t, actionsPage.Body.String(), wantError)
|
|
assert.Contains(t, filePage.Body.String(), wantError)
|
|
}
|
|
|
|
session.MakeRequest(t, NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/rerun", user.Name, repo.Name, run.ID)), http.StatusBadRequest)
|
|
})
|
|
}
|
|
})
|
|
}
|