+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| prepare-job.ts | +
+
+ |
+ 8.1% | +9/111 | +0% | +0/140 | +0% | +0/10 | +9.27% | +9/97 | +
| run-container-step.ts | +
+
+ |
+ 73.97% | +54/73 | +34.34% | +34/99 | +66.66% | +2/3 | +71.64% | +48/67 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 | 1x +1x + +1x + + + + + +1x +1x + + + + + + + +1x + + + + + + + + + +1x + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | import * as core from '@actions/core'
+import * as io from '@actions/io'
+import * as k8s from '@kubernetes/client-node'
+import {
+ JobContainerInfo,
+ ContextPorts,
+ PrepareJobArgs,
+ writeToResponseFile
+} from 'hooklib'
+import path from 'path'
+import {
+ containerPorts,
+ createPod,
+ isPodContainerAlpine,
+ prunePods,
+ waitForPodPhases,
+ getPrepareJobTimeoutSeconds
+} from '../k8s'
+import {
+ containerVolumes,
+ DEFAULT_CONTAINER_ENTRY_POINT,
+ DEFAULT_CONTAINER_ENTRY_POINT_ARGS,
+ generateContainerName,
+ mergeContainerWithOptions,
+ readExtensionFromFile,
+ PodPhase,
+ fixArgs
+} from '../k8s/utils'
+import { CONTAINER_EXTENSION_PREFIX, JOB_CONTAINER_NAME } from './constants'
+
+export async function prepareJob(
+ args: PrepareJobArgs,
+ responseFile
+): Promise<void> {
+ Iif (!args.container) {
+ throw new Error('Job Container is required.')
+ }
+
+ await prunePods()
+
+ const extension = readExtensionFromFile()
+ await copyExternalsToRoot()
+
+ let container: k8s.V1Container | undefined = undefined
+ Iif (args.container?.image) {
+ core.debug(`Using image '${args.container.image}' for job image`)
+ container = createContainerSpec(
+ args.container,
+ JOB_CONTAINER_NAME,
+ true,
+ extension
+ )
+ }
+
+ let services: k8s.V1Container[] = []
+ Iif (args.services?.length) {
+ services = args.services.map(service => {
+ core.debug(`Adding service '${service.image}' to pod definition`)
+ return createContainerSpec(
+ service,
+ generateContainerName(service.image),
+ false,
+ extension
+ )
+ })
+ }
+
+ Iif (!container && !services?.length) {
+ throw new Error('No containers exist, skipping hook invocation')
+ }
+
+ let createdPod: k8s.V1Pod | undefined = undefined
+ try {
+ createdPod = await createPod(
+ container,
+ services,
+ args.container.registry,
+ extension
+ )
+ } catch (err) {
+ await prunePods()
+ core.debug(`createPod failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to create job pod: ${message}`)
+ }
+
+ Iif (!createdPod?.metadata?.name) {
+ throw new Error('created pod should have metadata.name')
+ }
+ core.debug(
+ `Job pod created, waiting for it to come online ${createdPod?.metadata?.name}`
+ )
+
+ try {
+ await waitForPodPhases(
+ createdPod.metadata.name,
+ new Set([PodPhase.RUNNING]),
+ new Set([PodPhase.PENDING]),
+ getPrepareJobTimeoutSeconds()
+ )
+ } catch (err) {
+ try {
+ await prunePods()
+ } catch (pruneErr) {
+ core.error(`Failed to prune pods: ${pruneErr instanceof Error ? pruneErr.message : String(pruneErr)}`)
+ }
+ const message = err instanceof Error ? err.message : String(err)
+ throw new Error(`pod failed to come online:\n${message}`)
+ }
+
+ core.debug('Job pod is ready for traffic')
+
+ let isAlpine = false
+ try {
+ isAlpine = await isPodContainerAlpine(
+ createdPod.metadata.name,
+ JOB_CONTAINER_NAME
+ )
+ } catch (err) {
+ core.debug(
+ `Failed to determine if the pod is alpine: ${JSON.stringify(err)}`
+ )
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to determine if the pod is alpine: ${message}`)
+ }
+ core.debug(`Setting isAlpine to ${isAlpine}`)
+ generateResponseFile(responseFile, args, createdPod, isAlpine)
+}
+
+function generateResponseFile(
+ responseFile: string,
+ args: PrepareJobArgs,
+ appPod: k8s.V1Pod,
+ isAlpine
+): void {
+ Iif (!appPod.metadata?.name) {
+ throw new Error('app pod must have metadata.name specified')
+ }
+ const response = {
+ state: {
+ jobPod: appPod.metadata.name
+ },
+ context: {},
+ isAlpine
+ }
+
+ const mainContainer = appPod.spec?.containers?.find(
+ c => c.name === JOB_CONTAINER_NAME
+ )
+ Iif (mainContainer) {
+ const mainContainerContextPorts: ContextPorts = {}
+ Iif (mainContainer?.ports) {
+ for (const port of mainContainer.ports) {
+ mainContainerContextPorts[port.containerPort] =
+ mainContainerContextPorts.hostPort
+ }
+ }
+
+ response.context['container'] = {
+ image: mainContainer.image,
+ ports: mainContainerContextPorts
+ }
+ }
+
+ Iif (args.services?.length) {
+ const serviceContainerNames =
+ args.services?.map(s => generateContainerName(s.image)) || []
+
+ response.context['services'] = appPod?.spec?.containers
+ ?.filter(c => serviceContainerNames.includes(c.name))
+ .map(c => {
+ const ctxPorts: ContextPorts = {}
+ Iif (c.ports?.length) {
+ for (const port of c.ports) {
+ ctxPorts[port.containerPort] = port.hostPort
+ }
+ }
+
+ return {
+ image: c.image,
+ ports: ctxPorts
+ }
+ })
+ }
+
+ writeToResponseFile(responseFile, JSON.stringify(response))
+}
+
+async function copyExternalsToRoot(): Promise<void> {
+ const workspace = process.env['RUNNER_WORKSPACE']
+ if (Iworkspace) {
+ await io.cp(
+ path.join(workspace, '../../externals'),
+ path.join(workspace, '../externals'),
+ { force: true, recursive: true, copySourceDirectory: false }
+ )
+ }
+}
+
+export function createContainerSpec(
+ container: JobContainerInfo,
+ name: string,
+ IjobContainer = false,
+ extension?: k8s.V1PodTemplateSpec
+): k8s.V1Container {
+ Iif (!container.entryPoint && jobContainer) {
+ container.entryPoint = DEFAULT_CONTAINER_ENTRY_POINT
+ container.entryPointArgs = DEFAULT_CONTAINER_ENTRY_POINT_ARGS
+ }
+
+ const podContainer = {
+ name,
+ image: container.image,
+ ports: containerPorts(container)
+ } as k8s.V1Container
+ Iif (container.workingDirectory) {
+ podContainer.workingDir = container.workingDirectory
+ }
+
+ Iif (container.entryPoint) {
+ podContainer.command = [container.entryPoint]
+ }
+
+ Iif (container.entryPointArgs?.length > 0) {
+ podContainer.args = fixArgs(container.entryPointArgs)
+ }
+
+ podContainer.env = []
+ for (const [key, value] of Object.entries(
+ container['environmentVariables']
+ )) {
+ Iif (value && key !== 'HOME') {
+ podContainer.env.push({ name: key, value: value as string })
+ }
+ }
+
+ podContainer.env.push({
+ name: 'GITHUB_ACTIONS',
+ value: 'true'
+ })
+
+ Iif (!('CI' in container['environmentVariables'])) {
+ podContainer.env.push({
+ name: 'CI',
+ value: 'true'
+ })
+ }
+
+ podContainer.volumeMounts = containerVolumes(
+ container.userMountVolumes,
+ jobContainer
+ )
+
+ Iif (!extension) {
+ return podContainer
+ }
+
+ const from = extension.spec?.containers?.find(
+ c => c.name === CONTAINER_EXTENSION_PREFIX + name
+ )
+
+ Iif (from) {
+ mergeContainerWithOptions(podContainer, from)
+ }
+
+ return podContainer
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 | 1x +1x + +1x + + + + + + + + + + + +1x + + + + + + +1x + +1x + + +9x + + + +9x +14x + +4x + + +4x +4x +4x + +4x + +4x +4x +4x + + + +5x + +5x +5x + + + +5x + + + + + + +5x + + + + + + +5x + + + +5x + + + + + + +10x + + + + + + + + + +5x + +10x + +5x +10x + + +5x +5x + + +5x + + + + + + + + +5x +5x +5x +5x +5x + + +5x + + + + + + + + + + + + + +5x +5x +5x +5x +5x + + +5x + + + +5x + + + + + + + + + +5x + +5x +5x + + + + + + + + + + + + | import * as core from '@actions/core'
+import * as k8s from '@kubernetes/client-node'
+import { RunContainerStepArgs } from 'hooklib'
+import {
+ createJob,
+ createSecretForEnvs,
+ describePodFailure,
+ getContainerJobPodName,
+ getContainerTerminatedErrors,
+ getPodByName,
+ getPodLogs,
+ getPodStatus,
+ waitForJobToComplete,
+ waitForPodPhases
+} from '../k8s'
+import {
+ containerVolumes,
+ fixArgs,
+ mergeContainerWithOptions,
+ PodPhase,
+ readExtensionFromFile
+} from '../k8s/utils'
+import { JOB_CONTAINER_EXTENSION_NAME, JOB_CONTAINER_NAME } from './constants'
+
+export async function runContainerStep(
+ stepContainer: RunContainerStepArgs
+): Promise<number> {
+ Iif (stepContainer.dockerfile) {
+ throw new Error('Building container actions is not currently supported')
+ }
+
+ let secretName: string | undefined = undefined
+ if (stepContainer.environmentVariables) {
+ try {
+ const envs = JSON.parse(
+ JSON.stringify(stepContainer.environmentVariables)
+ )
+ envs['GITHUB_ACTIONS'] = 'true'
+ if (!('CI' in envs)) {
+ envs.CI = 'true'
+ }
+ secretName = await createSecretForEnvs(envs)
+ } catch (err) {
+ core.debug(`createSecretForEnvs failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to create script environment: ${message}`)
+ }
+ }
+
+ const extension = readExtensionFromFile()
+
+ core.debug(`Created secret ${secretName} for container job envs`)
+ const container = createContainerSpec(stepContainer, secretName, extension)
+
+ let job: k8s.V1Job
+ try {
+ job = await createJob(container, extension)
+ } catch (err) {
+ core.debug(`createJob failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to run script step: ${message}`)
+ }
+
+ Iif (!job.metadata?.name) {
+ throw new Error(
+ `Expected job ${JSON.stringify(
+ job
+ )} to have correctly set the metadata.name`
+ )
+ }
+ core.debug(`Job created, waiting for pod to start: ${job.metadata?.name}`)
+
+ let podName: string
+ try {
+ podName = await getContainerJobPodName(job.metadata.name)
+ } catch (err) {
+ core.debug(`getContainerJobPodName failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to get container job pod name: ${message}`)
+ }
+
+ await waitForPodPhases(
+ podName,
+ new Set([
+ PodPhase.COMPLETED,
+ PodPhase.RUNNING,
+ PodPhase.SUCCEEDED,
+ PodPhase.FAILED
+ ]),
+ new Set([PodPhase.PENDING, PodPhase.UNKNOWN])
+ )
+ core.debug('Container step is running or complete, pulling logs')
+
+ await getPodLogs(podName, JOB_CONTAINER_NAME)
+
+ core.debug('Waiting for container job to complete')
+ await waitForJobToComplete(job.metadata.name)
+
+ // pod has failed so pull the status code from the container
+ const status = await getPodStatus(podName)
+ Iif (status?.phase === 'Succeeded') {
+ return 0
+ }
+ Iif (!status?.containerStatuses?.length) {
+ core.error(
+ `Can't determine container status from response: ${JSON.stringify(
+ status
+ )}`
+ )
+ return 1
+ }
+
+ const pod = await getPodByName(podName)
+ const terminatedErrors = getContainerTerminatedErrors(pod)
+ if (IterminatedErrors.length > 0) {
+ const details = await describePodFailure(podName)
+ core.error(
+ `Pod ${podName} has unrecoverable container errors:\n${terminatedErrors.join('\n')}\n${details}`
+ )
+ return 1
+ }
+
+ const exitCode =
+ status.containerStatuses[status.containerStatuses.length - 1].state
+ ?.terminated?.exitCode
+ return Number(exitCode) || 1
+}
+
+function createContainerSpec(
+ container: RunContainerStepArgs,
+ secretName?: string,
+ extension?: k8s.V1PodTemplateSpec
+): k8s.V1Container {
+ const podContainer = new k8s.V1Container()
+ podContainer.name = JOB_CONTAINER_NAME
+ podContainer.image = container.image
+ podContainer.workingDir = container.workingDirectory
+ podContainer.command = container.entryPoint
+ ? [container.entryPoint]
+ : undefined
+ podContainer.args = container.entryPointArgs?.length
+ ? fixArgs(container.entryPointArgs)
+ : undefined
+
+ Iif (secretName) {
+ podContainer.envFrom = [
+ {
+ secretRef: {
+ name: secretName,
+ optional: false
+ }
+ }
+ ]
+ }
+ podContainer.volumeMounts = containerVolumes(undefined, false, true)
+
+ if (!extension) {
+ return podContainer
+ }
+
+ const from = extension.spec?.containers?.find(
+ c => c.name === JOB_CONTAINER_EXTENSION_NAME
+ )
+ Iif (from) {
+ mergeContainerWithOptions(podContainer, from)
+ }
+
+ return podContainer
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| src/hooks | +
+
+ |
+ 36.55% | +87/238 | +12.89% | +33/256 | +16% | +4/25 | +38.24% | +83/217 | +
| src/k8s | +
+
+ |
+ 15.36% | +98/638 | +3.05% | +14/458 | +10.44% | +7/67 | +18.11% | +98/541 | +
| tests | +
+
+ |
+ 29.57% | +21/71 | +0% | +0/3 | +5.55% | +1/18 | +28.57% | +20/70 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| index.ts | +
+
+ |
+ 47.42% | +230/485 | +50.58% | +173/342 | +36.36% | +20/55 | +47.71% | +198/415 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 +269 +270 +271 +272 +273 +274 +275 +276 +277 +278 +279 +280 +281 +282 +283 +284 +285 +286 +287 +288 +289 +290 +291 +292 +293 +294 +295 +296 +297 +298 +299 +300 +301 +302 +303 +304 +305 +306 +307 +308 +309 +310 +311 +312 +313 +314 +315 +316 +317 +318 +319 +320 +321 +322 +323 +324 +325 +326 +327 +328 +329 +330 +331 +332 +333 +334 +335 +336 +337 +338 +339 +340 +341 +342 +343 +344 +345 +346 +347 +348 +349 +350 +351 +352 +353 +354 +355 +356 +357 +358 +359 +360 +361 +362 +363 +364 +365 +366 +367 +368 +369 +370 +371 +372 +373 +374 +375 +376 +377 +378 +379 +380 +381 +382 +383 +384 +385 +386 +387 +388 +389 +390 +391 +392 +393 +394 +395 +396 +397 +398 +399 +400 +401 +402 +403 +404 +405 +406 +407 +408 +409 +410 +411 +412 +413 +414 +415 +416 +417 +418 +419 +420 +421 +422 +423 +424 +425 +426 +427 +428 +429 +430 +431 +432 +433 +434 +435 +436 +437 +438 +439 +440 +441 +442 +443 +444 +445 +446 +447 +448 +449 +450 +451 +452 +453 +454 +455 +456 +457 +458 +459 +460 +461 +462 +463 +464 +465 +466 +467 +468 +469 +470 +471 +472 +473 +474 +475 +476 +477 +478 +479 +480 +481 +482 +483 +484 +485 +486 +487 +488 +489 +490 +491 +492 +493 +494 +495 +496 +497 +498 +499 +500 +501 +502 +503 +504 +505 +506 +507 +508 +509 +510 +511 +512 +513 +514 +515 +516 +517 +518 +519 +520 +521 +522 +523 +524 +525 +526 +527 +528 +529 +530 +531 +532 +533 +534 +535 +536 +537 +538 +539 +540 +541 +542 +543 +544 +545 +546 +547 +548 +549 +550 +551 +552 +553 +554 +555 +556 +557 +558 +559 +560 +561 +562 +563 +564 +565 +566 +567 +568 +569 +570 +571 +572 +573 +574 +575 +576 +577 +578 +579 +580 +581 +582 +583 +584 +585 +586 +587 +588 +589 +590 +591 +592 +593 +594 +595 +596 +597 +598 +599 +600 +601 +602 +603 +604 +605 +606 +607 +608 +609 +610 +611 +612 +613 +614 +615 +616 +617 +618 +619 +620 +621 +622 +623 +624 +625 +626 +627 +628 +629 +630 +631 +632 +633 +634 +635 +636 +637 +638 +639 +640 +641 +642 +643 +644 +645 +646 +647 +648 +649 +650 +651 +652 +653 +654 +655 +656 +657 +658 +659 +660 +661 +662 +663 +664 +665 +666 +667 +668 +669 +670 +671 +672 +673 +674 +675 +676 +677 +678 +679 +680 +681 +682 +683 +684 +685 +686 +687 +688 +689 +690 +691 +692 +693 +694 +695 +696 +697 +698 +699 +700 +701 +702 +703 +704 +705 +706 +707 +708 +709 +710 +711 +712 +713 +714 +715 +716 +717 +718 +719 +720 +721 +722 +723 +724 +725 +726 +727 +728 +729 +730 +731 +732 +733 +734 +735 +736 +737 +738 +739 +740 +741 +742 +743 +744 +745 +746 +747 +748 +749 +750 +751 +752 +753 +754 +755 +756 +757 +758 +759 +760 +761 +762 +763 +764 +765 +766 +767 +768 +769 +770 +771 +772 +773 +774 +775 +776 +777 +778 +779 +780 +781 +782 +783 +784 +785 +786 +787 +788 +789 +790 +791 +792 +793 +794 +795 +796 +797 +798 +799 +800 +801 +802 +803 +804 +805 +806 +807 +808 +809 +810 +811 +812 +813 +814 +815 +816 +817 +818 +819 +820 +821 +822 +823 +824 +825 +826 +827 +828 +829 +830 +831 +832 +833 +834 +835 +836 +837 +838 +839 +840 +841 +842 +843 +844 +845 +846 +847 +848 +849 +850 +851 +852 +853 +854 +855 +856 +857 +858 +859 +860 +861 +862 +863 +864 +865 +866 +867 +868 +869 +870 +871 +872 +873 +874 +875 +876 +877 +878 +879 +880 +881 +882 +883 +884 +885 +886 +887 +888 +889 +890 +891 +892 +893 +894 +895 +896 +897 +898 +899 +900 +901 +902 +903 +904 +905 +906 +907 +908 +909 +910 +911 +912 +913 +914 +915 +916 +917 +918 +919 +920 +921 +922 +923 +924 +925 +926 +927 +928 +929 +930 +931 +932 +933 +934 +935 +936 +937 +938 +939 +940 +941 +942 +943 +944 +945 +946 +947 +948 +949 +950 +951 +952 +953 +954 +955 +956 +957 +958 +959 +960 +961 +962 +963 +964 +965 +966 +967 +968 +969 +970 +971 +972 +973 +974 +975 +976 +977 +978 +979 +980 +981 +982 | 2x +2x + +2x +2x + + + + + + + +2x + + + + + + + +2x + +2x + +2x +2x +2x + +2x + +2x + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x + + +4x + +4x +4x +4x +4x +4x +4x + +4x + + +4x +4x +12x +12x + + +8x + + + +2x + + + +2x + + + + + + + + + + + + + + + + + + + +2x + + + + + + + +2x + + + + + +2x + + + + + +2x + +2x +22x +22x +19x + +3x +6x +6x +6x +3x + + +3x + + +2x +10x +10x +8x + +2x +4x +4x +4x +1x + + +2x + + +2x + +34x +34x +30x + +4x +9x +9x +9x +4x + + +4x + + +2x +19x +19x +19x + + + +38x +14x +14x +11x + + + + + + +19x + + +2x +7x + + +7x + + + + + + +6x + +1x + + + + +1x + + +6x +7x +7x + + + + +5x + + +6x + + +2x +13x +13x +11x +4x + + + + + + +13x + + +2x +28x +28x +28x + + + +56x +28x +28x +21x + + + + + + +28x + + +2x + + +8x + +1x + + + + +7x +7x + +7x +7x + + + + + +7x +1x + + +7x +7x + +7x +2x +2x + + + + + + + +7x + + + +7x +3x +3x +2x + + + + + +3x +3x +1x + + + + + + + + + +7x + +7x + + +7x + + + + + +7x + + + + + + +6x + +1x + + + + +1x + + +6x +6x +5x + + +1x + + + +1x + +1x +1x +1x +1x + + + +1x + + + + +1x + + +2x + + + +16x + +8x +8x +12x +12x +12x +12x +5x + + +13x +1x +1x + + + + +6x +11x +1x +1x + + + + + + +5x +9x +1x +1x + + + + + + + +8x + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + +20x +19x + + +2x + + + + + + + +2x +19x +3x + +16x + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + +2x + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x +38x +38x + + + + + + + + + + + +2x +8x +8x +8x +8x + + + + +2x +8x +4x + +4x +4x + + +4x +4x + +4x + + + +2x + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x + + + + | import * as core from '@actions/core'
+import * as k8s from '@kubernetes/client-node'
+import { ContainerInfo, Registry } from 'hooklib'
+import * as stream from 'stream'
+import {
+ getJobPodName,
+ getRunnerPodName,
+ getSecretName,
+ getStepPodName,
+ getVolumeClaimName,
+ RunnerInstanceLabel
+} from '../hooks/constants'
+import {
+ PodPhase,
+ mergePodSpecWithOptions,
+ mergeObjectMeta,
+ useKubeScheduler,
+ fixArgs
+} from './utils'
+
+const kc = new k8s.KubeConfig()
+
+kc.loadFromDefault()
+
+const k8sApi = kc.makeApiClient(k8s.CoreV1Api)
+const k8sBatchV1Api = kc.makeApiClient(k8s.BatchV1Api)
+const k8sAuthorizationV1Api = kc.makeApiClient(k8s.AuthorizationV1Api)
+
+const DEFAULT_WAIT_FOR_POD_TIME_SECONDS = 10 * 60 // 10 min
+
+export const POD_VOLUME_NAME = 'work'
+
+export const requiredPermissions = [
+ {
+ group: '',
+ verbs: ['get', 'list', 'create', 'delete'],
+ resource: 'pods',
+ subresource: ''
+ },
+ {
+ group: '',
+ verbs: ['get', 'create'],
+ resource: 'pods',
+ subresource: 'exec'
+ },
+ {
+ group: '',
+ verbs: ['get', 'list', 'watch'],
+ resource: 'pods',
+ subresource: 'log'
+ },
+ {
+ group: 'batch',
+ verbs: ['get', 'list', 'create', 'delete'],
+ resource: 'jobs',
+ subresource: ''
+ },
+ {
+ group: '',
+ verbs: ['create', 'delete', 'get', 'list'],
+ resource: 'secrets',
+ subresource: ''
+ }
+]
+
+export async function createPod(
+ jobContainer?: k8s.V1Container,
+ services?: k8s.V1Container[],
+ registry?: Registry,
+ extension?: k8s.V1PodTemplateSpec
+): Promise<k8s.V1Pod> {
+ const containers: k8s.V1Container[] = []
+ Iif (jobContainer) {
+ containers.push(jobContainer)
+ }
+ Iif (services?.length) {
+ containers.push(...services)
+ }
+
+ const appPod = new k8s.V1Pod()
+
+ appPod.apiVersion = 'v1'
+ appPod.kind = 'Pod'
+
+ appPod.metadata = new k8s.V1ObjectMeta()
+ appPod.metadata.name = getJobPodName()
+
+ const instanceLabel = new RunnerInstanceLabel()
+ appPod.metadata.labels = {
+ [instanceLabel.key]: instanceLabel.value
+ }
+ appPod.metadata.annotations = {}
+
+ appPod.spec = new k8s.V1PodSpec()
+ appPod.spec.containers = containers
+ appPod.spec.restartPolicy = 'Never'
+
+ const nodeName = await getCurrentNodeName()
+ if (IuseKubeScheduler()) {
+ appPod.spec.affinity = await getPodAffinity(nodeName)
+ } else {
+ appPod.spec.affinity = await getPreferredPodAffinity(nodeName)
+ }
+ const claimName = getVolumeClaimName()
+ appPod.spec.volumes = [
+ {
+ name: 'work',
+ persistentVolumeClaim: { claimName }
+ }
+ ]
+
+ if (Iregistry) {
+ const secret = await createDockerSecret(registry)
+ Iif (!secret?.metadata?.name) {
+ throw new Error(`created secret does not have secret.metadata.name`)
+ }
+ const secretReference = new k8s.V1LocalObjectReference()
+ secretReference.name = secret.metadata.name
+ appPod.spec.imagePullSecrets = [secretReference]
+ }
+
+ Iif (extension?.metadata) {
+ mergeObjectMeta(appPod, extension.metadata)
+ }
+
+ Iif (extension?.spec) {
+ mergePodSpecWithOptions(appPod.spec, extension.spec)
+ }
+
+ const { body } = await k8sApi.createNamespacedPod(namespace(), appPod)
+ return body
+}
+
+export async function createJob(
+ container: k8s.V1Container,
+ extension?: k8s.V1PodTemplateSpec
+): Promise<k8s.V1Job> {
+ const runnerInstanceLabel = new RunnerInstanceLabel()
+
+ const job = new k8s.V1Job()
+ job.apiVersion = 'batch/v1'
+ job.kind = 'Job'
+ job.metadata = new k8s.V1ObjectMeta()
+ job.metadata.name = getStepPodName()
+ job.metadata.labels = { [runnerInstanceLabel.key]: runnerInstanceLabel.value }
+ job.metadata.annotations = {}
+
+ job.spec = new k8s.V1JobSpec()
+ job.spec.ttlSecondsAfterFinished = 300
+ job.spec.backoffLimit = 0
+ job.spec.template = new k8s.V1PodTemplateSpec()
+
+ job.spec.template.spec = new k8s.V1PodSpec()
+ job.spec.template.metadata = new k8s.V1ObjectMeta()
+ job.spec.template.metadata.labels = {}
+ job.spec.template.metadata.annotations = {}
+ job.spec.template.spec.containers = [container]
+ job.spec.template.spec.restartPolicy = 'Never'
+
+ const nodeName = await getCurrentNodeName()
+ if (IuseKubeScheduler()) {
+ job.spec.template.spec.affinity = await getPodAffinity(nodeName)
+ } else {
+ job.spec.template.spec.affinity = await getPreferredPodAffinity(nodeName)
+ }
+
+ const claimName = getVolumeClaimName()
+ job.spec.template.spec.volumes = [
+ {
+ name: 'work',
+ persistentVolumeClaim: { claimName }
+ }
+ ]
+
+ Iif (extension) {
+ Iif (extension.metadata) {
+ // apply metadata both to the job and the pod created by the job
+ mergeObjectMeta(job, extension.metadata)
+ mergeObjectMeta(job.spec.template, extension.metadata)
+ }
+ Iif (extension.spec) {
+ mergePodSpecWithOptions(job.spec.template.spec, extension.spec)
+ }
+ }
+
+ const { body } = await k8sBatchV1Api.createNamespacedJob(namespace(), job)
+ return body
+}
+
+export async function getContainerJobPodName(jobName: string): Promise<string> {
+ const selector = `job-name=${jobName}`
+ const backOffManager = new BackOffManager(60)
+ while (Itrue) {
+ const podList = await k8sApi.listNamespacedPod(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ undefined,
+ selector,
+ 1
+ )
+
+ if (I!podList.body.items?.length) {
+ await backOffManager.backOff()
+ continue
+ }
+
+ Iif (!podList.body.items[0].metadata?.name) {
+ throw new Error(
+ `Failed to determine the name of the pod for job ${jobName}`
+ )
+ }
+ return podList.body.items[0].metadata.name
+ }
+}
+
+export async function deletePod(podName: string): Promise<void> {
+ await k8sApi.deleteNamespacedPod(
+ podName,
+ namespace(),
+ undefined,
+ undefined,
+ 0
+ )
+}
+
+export async function execPodStep(
+ command: string[],
+ podName: string,
+ containerName: string,
+ stdin?: stream.Readable
+): Promise<void> {
+ const exec = new k8s.Exec(kc)
+ command = fixArgs(command)
+ // Exec returns a websocket. If websocket fails, we should reject the promise. Otherwise, websocket will call a callback. Since at that point, websocket is not failing, we can safely resolve or reject the promise.
+ await new Promise(function (resolve, reject) {
+ exec
+ .exec(
+ namespace(),
+ podName,
+ containerName,
+ command,
+ process.stdout,
+ process.stderr,
+ stdin ?? null,
+ false /* tty */,
+ resp => {
+ // kube.exec returns an error if exit code is not 0, but we can't actually get the exit code
+ if (resp.status === 'Success') {
+ resolve(resp.code)
+ } else {
+ core.debug(
+ JSON.stringify({
+ message: resp?.message,
+ details: resp?.details
+ })
+ )
+ reject(resp?.message)
+ }
+ }
+ )
+ // If exec.exec fails, explicitly reject the outer promise
+ // eslint-disable-next-line github/no-then
+ .catch(e => reject(e))
+ })
+}
+
+export async function waitForJobToComplete(jobName: string): Promise<void> {
+ const backOffManager = new BackOffManager()
+ while (Itrue) {
+ try {
+ Iif (await isJobSucceeded(jobName)) {
+ return
+ }
+ } catch (error) {
+ throw new Error(`job ${jobName} has failed`)
+ }
+ await backOffManager.backOff()
+ }
+}
+
+export async function createDockerSecret(
+ registry: Registry
+): Promise<k8s.V1Secret> {
+ const authContent = {
+ auths: {
+ [registry.serverUrl || 'https://index.docker.io/v1/']: {
+ username: registry.username,
+ password: registry.password,
+ auth: Buffer.from(`${registry.username}:${registry.password}`).toString(
+ 'base64'
+ )
+ }
+ }
+ }
+
+ const runnerInstanceLabel = new RunnerInstanceLabel()
+
+ const secretName = getSecretName()
+ const secret = new k8s.V1Secret()
+ secret.immutable = true
+ secret.apiVersion = 'v1'
+ secret.metadata = new k8s.V1ObjectMeta()
+ secret.metadata.name = secretName
+ secret.metadata.namespace = namespace()
+ secret.metadata.labels = {
+ [runnerInstanceLabel.key]: runnerInstanceLabel.value
+ }
+ secret.type = 'kubernetes.io/dockerconfigjson'
+ secret.kind = 'Secret'
+ secret.data = {
+ '.dockerconfigjson': Buffer.from(JSON.stringify(authContent)).toString(
+ 'base64'
+ )
+ }
+
+ const { body } = await k8sApi.createNamespacedSecret(namespace(), secret)
+ return body
+}
+
+export async function createSecretForEnvs(envs: {
+ [key: string]: string
+}): Promise<string> {
+ const runnerInstanceLabel = new RunnerInstanceLabel()
+
+ const secret = new k8s.V1Secret()
+ const secretName = getSecretName()
+ secret.immutable = true
+ secret.apiVersion = 'v1'
+ secret.metadata = new k8s.V1ObjectMeta()
+ secret.metadata.name = secretName
+
+ secret.metadata.labels = {
+ [runnerInstanceLabel.key]: runnerInstanceLabel.value
+ }
+ secret.kind = 'Secret'
+ secret.data = {}
+ for (const [key, value] of Object.entries(envs)) {
+ secret.data[key] = Buffer.from(value).toString('base64')
+ }
+
+ await k8sApi.createNamespacedSecret(namespace(), secret)
+ return secretName
+}
+
+export async function deleteSecret(secretName: string): Promise<void> {
+ await k8sApi.deleteNamespacedSecret(secretName, namespace())
+}
+
+export async function pruneSecrets(): Promise<void> {
+ const secretList = await k8sApi.listNamespacedSecret(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ undefined,
+ new RunnerInstanceLabel().toString()
+ )
+ Iif (!secretList.body.items.length) {
+ return
+ }
+
+ await Promise.all(
+ secretList.body.items.map(
+ secret => secret.metadata?.name && deleteSecret(secret.metadata.name)
+ )
+ )
+}
+
+export const UNRECOVERABLE_WAITING_REASONS = new Set([
+ 'ImagePullBackOff',
+ 'ErrImagePull',
+ 'InvalidImageName',
+ 'CreateContainerConfigError',
+ 'CreateContainerError'
+])
+
+export const UNRECOVERABLE_EVENT_REASONS = new Set([
+ 'FailedScheduling',
+ 'FailedBinding',
+ 'FailedMount'
+])
+
+export const UNRECOVERABLE_TERMINATED_REASONS = new Set([
+ 'OOMKilled',
+ 'Error',
+ 'FailedPostStartHookError'
+])
+
+const MAX_DIAGNOSTIC_EVENTS = 10
+
+export function getUnrecoverableWaitingReasons(): Set<string> {
+ const extra = process.env['ACTIONS_RUNNER_K8S_UNRECOVERABLE_WAITING_REASONS']
+ if (!extra) {
+ return UNRECOVERABLE_WAITING_REASONS
+ }
+ const reasons = new Set(UNRECOVERABLE_WAITING_REASONS)
+ for (const reason of extra.split(',')) {
+ const trimmed = reason.trim()
+ if (trimmed) {
+ reasons.add(trimmed)
+ }
+ }
+ return reasons
+}
+
+export function getUnrecoverableEventReasons(): Set<string> {
+ const extra = process.env['ACTIONS_RUNNER_K8S_UNRECOVERABLE_EVENT_REASONS']
+ if (!extra) {
+ return UNRECOVERABLE_EVENT_REASONS
+ }
+ const reasons = new Set(UNRECOVERABLE_EVENT_REASONS)
+ for (const reason of extra.split(',')) {
+ const trimmed = reason.trim()
+ if (trimmed) {
+ reasons.add(trimmed)
+ }
+ }
+ return reasons
+}
+
+export function getUnrecoverableTerminatedReasons(): Set<string> {
+ const extra =
+ process.env['ACTIONS_RUNNER_K8S_UNRECOVERABLE_TERMINATED_REASONS']
+ if (!extra) {
+ return UNRECOVERABLE_TERMINATED_REASONS
+ }
+ const reasons = new Set(UNRECOVERABLE_TERMINATED_REASONS)
+ for (const reason of extra.split(',')) {
+ const trimmed = reason.trim()
+ if (trimmed) {
+ reasons.add(trimmed)
+ }
+ }
+ return reasons
+}
+
+export function getContainerErrors(pod: k8s.V1Pod): string[] {
+ const errors: string[] = []
+ const unrecoverableReasons = getUnrecoverableWaitingReasons()
+ const allStatuses = [
+ ...(pod.status?.initContainerStatuses ?? []),
+ ...(pod.status?.containerStatuses ?? [])
+ ]
+ for (const cs of allStatuses) {
+ const waiting = cs.state?.waiting
+ if (waiting?.reason && unrecoverableReasons.has(waiting.reason)) {
+ errors.push(
+ `container "${cs.name}": ${waiting.reason}${
+ waiting.message ? ` - ${waiting.message}` : ''
+ }`
+ )
+ }
+ }
+ return errors
+}
+
+export async function getPodEventErrors(podName: string): Promise<string[]> {
+ const unrecoverableReasons = getUnrecoverableEventReasons()
+ let items: k8s.CoreV1Event[]
+ try {
+ const { body } = await k8sApi.listNamespacedEvent(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ `involvedObject.name=${podName}`
+ )
+ items = body.items
+ } catch (err) {
+ core.debug(
+ `Could not list events for pod ${podName} (the 'events' permission may be missing): ${
+ err instanceof Error ? err.message : String(err)
+ }`
+ )
+ return []
+ }
+
+ const errors: string[] = []
+ for (const e of items) {
+ if (
+ e.type === 'Warning' &&
+ e.reason &&
+ unrecoverableReasons.has(e.reason)
+ ) {
+ errors.push(`Event [Warning] ${e.reason}: ${e.message ?? ''}`)
+ }
+ }
+ return errors
+}
+
+export function getPodConditionErrors(pod: k8s.V1Pod): string[] {
+ const errors: string[] = []
+ for (const cond of pod.status?.conditions ?? []) {
+ if (cond.type === 'PodScheduled' && cond.status === 'False' && cond.reason === 'Unschedulable') {
+ errors.push(
+ `Condition ${cond.type}=False (reason: ${cond.reason ?? ''}): ${
+ cond.message ?? ''
+ }`
+ )
+ }
+ }
+ return errors
+}
+
+export function getContainerTerminatedErrors(pod: k8s.V1Pod): string[] {
+ const errors: string[] = []
+ const unrecoverableReasons = getUnrecoverableTerminatedReasons()
+ const allStatuses = [
+ ...(pod.status?.initContainerStatuses ?? []),
+ ...(pod.status?.containerStatuses ?? [])
+ ]
+ for (const cs of allStatuses) {
+ const terminated = cs.state?.terminated
+ if (terminated?.reason && unrecoverableReasons.has(terminated.reason)) {
+ errors.push(
+ `container "${cs.name}": ${terminated.reason} (exit code ${terminated.exitCode}) - ${
+ terminated.message ?? ''
+ }`
+ )
+ }
+ }
+ return errors
+}
+
+export async function describePodFailure(podName: string): Promise<string> {
+ let pod: k8s.V1Pod
+ try {
+ pod = await readPod(podName)
+ } catch (err) {
+ return `Could not read pod ${podName} for diagnostics: ${
+ err instanceof Error ? err.message : String(err)
+ }`
+ }
+
+ const lines: string[] = []
+ const status = pod.status
+
+ if (status?.phase) {
+ lines.push(
+ `Phase: ${status.phase}${
+ status.reason ? ` (reason: ${status.reason})` : ''
+ }`
+ )
+ }
+ if (status?.message) {
+ lines.push(`Message: ${status.message}`)
+ }
+
+ const separator = '────────────────────────────────────────────────────────────'
+ lines.push(separator)
+
+ for (const cond of status?.conditions ?? []) {
+ if (cond.status === 'False') {
+ lines.push(
+ ` ✗ ${cond.type}=False${
+ cond.reason ? ` (${cond.reason})` : ''
+ }${cond.message ? `: ${cond.message}` : ''}`
+ )
+ }
+ }
+
+ const allStatuses = [
+ ...(status?.initContainerStatuses ?? []),
+ ...(status?.containerStatuses ?? [])
+ ]
+ for (const cs of allStatuses) {
+ const waiting = cs.state?.waiting
+ if (waiting?.reason) {
+ lines.push(
+ ` ✗ container "${cs.name}": ${waiting.reason}${
+ waiting.message ? `\n ${waiting.message}` : ''
+ }`
+ )
+ }
+ const terminated = cs.state?.terminated
+ if (terminated) {
+ lines.push(
+ ` ✗ container "${cs.name}": ${
+ terminated.reason ?? 'Unknown'
+ } (exit code ${terminated.exitCode})${
+ terminated.message ? `\n ${terminated.message}` : ''
+ }`
+ )
+ }
+ }
+
+ lines.push(...(await describePodWarningEvents(podName)))
+
+ Iif (!lines.length) {
+ return `No additional diagnostic information available for pod ${podName}`
+ }
+ return lines.join('\n')
+}
+
+async function describePodWarningEvents(podName: string): Promise<string[]> {
+ let items: k8s.CoreV1Event[]
+ try {
+ const { body } = await k8sApi.listNamespacedEvent(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ `involvedObject.name=${podName}`
+ )
+ items = body.items
+ } catch (err) {
+ core.debug(
+ `Could not list events for pod ${podName} (the 'events' permission may be missing): ${
+ err instanceof Error ? err.message : String(err)
+ }`
+ )
+ return []
+ }
+
+ const warnings = items.filter(e => e.type === 'Warning')
+ if (!warnings.length) {
+ return []
+ }
+
+ const eventTime = (e: k8s.CoreV1Event): number => {
+ const t = e.lastTimestamp ?? e.eventTime ?? e.firstTimestamp
+ return t ? new Date(t).getTime() : 0
+ }
+ warnings.sort((a, b) => eventTime(a) - eventTime(b))
+
+ const recent = warnings.slice(-MAX_DIAGNOSTIC_EVENTS)
+ const lines = recent.map(e => {
+ const count = e.count && e.count > 1 ? ` (x${e.count})` : ''
+ return `Event [Warning] ${e.reason ?? ''}${count}: ${
+ e.message ?? ''
+ }`.trim()
+ })
+ Iif (warnings.length > recent.length) {
+ lines.unshift(
+ `(showing ${recent.length} of ${warnings.length} warning events)`
+ )
+ }
+ return lines
+}
+
+export async function waitForPodPhases(
+ podName: string,
+ awaitingPhases: Set<PodPhase>,
+ backOffPhases: Set<PodPhase>,
+ maxTimeSeconds = DEFAULT_WAIT_FOR_POD_TIME_SECONDS
+): Promise<void> {
+ const backOffManager = new BackOffManager(maxTimeSeconds)
+ let phase: PodPhase = PodPhase.UNKNOWN
+ while (Itrue) {
+ const pod = await readPod(podName)
+ phase = parsePodPhase(pod)
+ if (awaitingPhases.has(phase)) {
+ return
+ }
+
+ if (!backOffPhases.has(phase)) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} is unhealthy with phase status ${phase}\n${details}`
+ )
+ }
+
+ const containerErrors = getContainerErrors(pod)
+ if (containerErrors.length > 0) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} has unrecoverable container errors: ${containerErrors.join(
+ '; '
+ )}\n${details}`
+ )
+ }
+
+ const conditionErrors = getPodConditionErrors(pod)
+ if (conditionErrors.length > 0) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} has unrecoverable condition errors: ${conditionErrors.join(
+ '; '
+ )}\n${details}`
+ )
+ }
+
+ try {
+ await backOffManager.backOff()
+ } catch (error) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} is unhealthy: timed out after ${maxTimeSeconds}s in phase ${phase}\n${details}`
+ )
+ }
+ }
+}
+
+export function getPrepareJobTimeoutSeconds(): number {
+ const envTimeoutSeconds =
+ process.env['ACTIONS_RUNNER_PREPARE_JOB_TIMEOUT_SECONDS']
+
+ Iif (!envTimeoutSeconds) {
+ return DEFAULT_WAIT_FOR_POD_TIME_SECONDS
+ }
+
+ const timeoutSeconds = parseInt(envTimeoutSeconds, 10)
+ Iif (!timeoutSeconds || timeoutSeconds <= 0) {
+ core.warning(
+ `Prepare job timeout is invalid ("${timeoutSeconds}"): use an int > 0`
+ )
+ return DEFAULT_WAIT_FOR_POD_TIME_SECONDS
+ }
+
+ return timeoutSeconds
+}
+
+async function readPod(podName: string): Promise<k8s.V1Pod> {
+ const { body } = await k8sApi.readNamespacedPod(podName, namespace())
+ return body
+}
+
+const podPhaseLookup = new Set<string>([
+ PodPhase.PENDING,
+ PodPhase.RUNNING,
+ PodPhase.SUCCEEDED,
+ PodPhase.FAILED,
+ PodPhase.UNKNOWN
+])
+
+export function parsePodPhase(pod: k8s.V1Pod): PodPhase {
+ if (!pod.status?.phase || !podPhaseLookup.has(pod.status.phase)) {
+ return PodPhase.UNKNOWN
+ }
+ return pod.status.phase as PodPhase
+}
+
+async function isJobSucceeded(jobName: string): Promise<boolean> {
+ const { body } = await k8sBatchV1Api.readNamespacedJob(jobName, namespace())
+ const job = body
+ Iif (job.status?.failed) {
+ throw new Error(`job ${jobName} has failed`)
+ }
+ return !!job.status?.succeeded
+}
+
+export async function getPodLogs(
+ podName: string,
+ containerName: string
+): Promise<void> {
+ const log = new k8s.Log(kc)
+ const logStream = new stream.PassThrough()
+ logStream.on('data', chunk => {
+ // use write rather than console.log to prevent double line feed
+ process.stdout.write(chunk)
+ })
+
+ logStream.on('error', err => {
+ process.stderr.write(err.message)
+ })
+
+ const r = await log.log(namespace(), podName, containerName, logStream, {
+ follow: true,
+ pretty: false,
+ timestamps: false
+ })
+ await new Promise(resolve => r.on('close', () => resolve(null)))
+}
+
+export async function prunePods(): Promise<void> {
+ const podList = await k8sApi.listNamespacedPod(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ undefined,
+ new RunnerInstanceLabel().toString()
+ )
+ Iif (!podList.body.items.length) {
+ return
+ }
+
+ await Promise.all(
+ podList.body.items.map(
+ pod => pod.metadata?.name && deletePod(pod.metadata.name)
+ )
+ )
+}
+
+export async function getPodStatus(
+ name: string
+): Promise<k8s.V1PodStatus | undefined> {
+ const { body } = await k8sApi.readNamespacedPod(name, namespace())
+ return body.status
+}
+
+export async function isAuthPermissionsOK(): Promise<boolean> {
+ const sar = new k8s.V1SelfSubjectAccessReview()
+ const asyncs: Promise<{
+ response: unknown
+ body: k8s.V1SelfSubjectAccessReview
+ }>[] = []
+ for (const resource of requiredPermissions) {
+ for (const verb of resource.verbs) {
+ sar.spec = new k8s.V1SelfSubjectAccessReviewSpec()
+ sar.spec.resourceAttributes = new k8s.V1ResourceAttributes()
+ sar.spec.resourceAttributes.verb = verb
+ sar.spec.resourceAttributes.namespace = namespace()
+ sar.spec.resourceAttributes.group = resource.group
+ sar.spec.resourceAttributes.resource = resource.resource
+ sar.spec.resourceAttributes.subresource = resource.subresource
+ asyncs.push(k8sAuthorizationV1Api.createSelfSubjectAccessReview(sar))
+ }
+ }
+ const responses = await Promise.all(asyncs)
+ return responses.every(resp => resp.body.status?.allowed)
+}
+
+export async function isPodContainerAlpine(
+ podName: string,
+ containerName: string
+): Promise<boolean> {
+ let isAlpine = true
+ try {
+ await execPodStep(
+ [
+ 'sh',
+ '-c',
+ `'[ $(cat /etc/*release* | grep -i -e "^ID=*alpine*" -c) != 0 ] || exit 1'`
+ ],
+ podName,
+ containerName
+ )
+ } catch (err) {
+ isAlpine = false
+ }
+
+ return isAlpine
+}
+
+async function getCurrentNodeName(): Promise<string> {
+ const resp = await k8sApi.readNamespacedPod(getRunnerPodName(), namespace())
+
+ const nodeName = resp.body.spec?.nodeName
+ Iif (!nodeName) {
+ throw new Error('Failed to determine node name')
+ }
+ return nodeName
+}
+
+async function getPodAffinity(nodeName: string): Promise<k8s.V1Affinity> {
+ const affinity = new k8s.V1Affinity()
+ affinity.nodeAffinity = new k8s.V1NodeAffinity()
+ affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution =
+ new k8s.V1NodeSelector()
+ affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms =
+ [
+ {
+ matchExpressions: [
+ {
+ key: 'kubernetes.io/hostname',
+ operator: 'In',
+ values: [nodeName]
+ }
+ ]
+ }
+ ]
+ return affinity
+}
+
+async function getPreferredPodAffinity(
+ nodeName: string
+): Promise<k8s.V1Affinity> {
+ const affinity = new k8s.V1Affinity()
+ affinity.nodeAffinity = new k8s.V1NodeAffinity()
+
+ // 创建 PreferredSchedulingTerm 对象
+ const preferredTerm = new k8s.V1PreferredSchedulingTerm()
+ preferredTerm.weight = 1 // 设置权重（1-100）
+
+ // 创建 NodeSelectorTerm
+ preferredTerm.preference = new k8s.V1NodeSelectorTerm()
+ preferredTerm.preference.matchExpressions = [
+ {
+ key: 'kubernetes.io/hostname',
+ operator: 'In',
+ values: [nodeName]
+ }
+ ]
+
+ // 将 PreferredSchedulingTerm 添加到数组中
+ affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution = [
+ preferredTerm
+ ]
+
+ return affinity
+}
+
+export function namespace(): string {
+ if (process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE']) {
+ return process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE']
+ }
+
+ const context = kc.getContexts().find(ctx => ctx.namespace)
+ Iif (!context?.namespace) {
+ throw new Error(
+ 'Failed to determine namespace, falling back to `default`. Namespace should be set in context, or in env variable "ACTIONS_RUNNER_KUBERNETES_NAMESPACE"'
+ )
+ }
+ return context.namespace
+}
+
+class BackOffManager {
+ private backOffSeconds = 1
+ totalTime = 0
+ constructor(private throwAfterSeconds?: number) {
+ Iif (!throwAfterSeconds || throwAfterSeconds < 0) {
+ this.throwAfterSeconds = undefined
+ }
+ }
+
+ async backOff(): Promise<void> {
+ await new Promise(resolve =>
+ setTimeout(resolve, this.backOffSeconds * 1000)
+ )
+ this.totalTime += this.backOffSeconds
+ Iif (this.throwAfterSeconds && this.throwAfterSeconds < this.totalTime) {
+ throw new Error('backoff timeout')
+ }
+ if (this.backOffSeconds < 20) {
+ this.backOffSeconds *= 2
+ }
+ Iif (this.backOffSeconds > 20) {
+ this.backOffSeconds = 20
+ }
+ }
+}
+
+export function containerPorts(
+ container: ContainerInfo
+): k8s.V1ContainerPort[] {
+ const ports: k8s.V1ContainerPort[] = []
+ Iif (!container.portMappings?.length) {
+ return ports
+ }
+ for (const portDefinition of container.portMappings) {
+ const portProtoSplit = portDefinition.split('/')
+ Iif (portProtoSplit.length > 2) {
+ throw new Error(`Unexpected port format: ${portDefinition}`)
+ }
+
+ const port = new k8s.V1ContainerPort()
+ port.protocol =
+ portProtoSplit.length === 2 ? portProtoSplit[1].toUpperCase() : 'TCP'
+
+ const portSplit = portProtoSplit[0].split(':')
+ Iif (portSplit.length > 2) {
+ throw new Error('ports should have at most one ":" separator')
+ }
+
+ const parsePort = (p: string): number => {
+ const num = Number(p)
+ Iif (!Number.isInteger(num) || num < 1 || num > 65535) {
+ throw new Error(`invalid container port: ${p}`)
+ }
+ return num
+ }
+
+ if (portSplit.length === 1) {
+ port.containerPort = parsePort(portSplit[0])
+ } else {
+ port.hostPort = parsePort(portSplit[0])
+ port.containerPort = parsePort(portSplit[1])
+ }
+
+ ports.push(port)
+ }
+ return ports
+}
+
+export async function getPodByName(name): Promise<k8s.V1Pod> {
+ const { body } = await k8sApi.readNamespacedPod(name, namespace())
+ return body
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 | 1x + +1x + + + | import { prunePods, pruneSecrets } from '../k8s'
+
+export async function cleanupJob(): Promise<void> {
+ await Promise.all([prunePods(), pruneSecrets()])
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 | 1x + +1x + + + + + + + + + +1x + + + + + + +1x + + + + + + +1x + + + + + + + +1x + + + + + + +1x +1x +1x +1x +1x + +1x + + + + + +1x + + + +1x + + + +1x + + +1x + | import { v4 as uuidv4 } from 'uuid'
+
+export function getRunnerPodName(): string {
+ const name = process.env.ACTIONS_RUNNER_POD_NAME
+ Iif (!name) {
+ throw new Error(
+ "'ACTIONS_RUNNER_POD_NAME' env is required, please contact your self hosted runner administrator"
+ )
+ }
+ return name
+}
+
+export function getJobPodName(): string {
+ return `${getRunnerPodName().substring(
+ 0,
+ MAX_POD_NAME_LENGTH - '-workflow'.length
+ )}-workflow`
+}
+
+export function getStepPodName(): string {
+ return `${getRunnerPodName().substring(
+ 0,
+ MAX_POD_NAME_LENGTH - ('-step-'.length + STEP_POD_NAME_SUFFIX_LENGTH)
+ )}-step-${uuidv4().substring(0, STEP_POD_NAME_SUFFIX_LENGTH)}`
+}
+
+export function getVolumeClaimName(): string {
+ const name = process.env.ACTIONS_RUNNER_CLAIM_NAME
+ Iif (!name) {
+ return `${getRunnerPodName()}-work`
+ }
+ return name
+}
+
+export function getSecretName(): string {
+ return `${getRunnerPodName().substring(
+ 0,
+ MAX_POD_NAME_LENGTH - ('-secret-'.length + STEP_POD_NAME_SUFFIX_LENGTH)
+ )}-secret-${uuidv4().substring(0, STEP_POD_NAME_SUFFIX_LENGTH)}`
+}
+
+export const MAX_POD_NAME_LENGTH = 63
+export const STEP_POD_NAME_SUFFIX_LENGTH = 8
+export const CONTAINER_EXTENSION_PREFIX = '$'
+export const JOB_CONTAINER_NAME = 'job'
+export const JOB_CONTAINER_EXTENSION_NAME = '$job'
+
+export class RunnerInstanceLabel {
+ private podName: string
+ constructor() {
+ this.podName = getRunnerPodName()
+ }
+
+ get key(): string {
+ return 'runner-pod'
+ }
+
+ get value(): string {
+ return this.podName
+ }
+
+ toString(): string {
+ return `runner-pod=${this.podName}`
+ }
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| cleanup-job.ts | +
+
+ |
+ 66.66% | +2/3 | +0% | +0/1 | +0% | +0/1 | +66.66% | +2/3 | +
| constants.ts | +
+
+ |
+ 53.12% | +17/32 | +0% | +0/2 | +10% | +1/10 | +51.61% | +16/31 | +
| index.ts | +
+
+ |
+ 100% | +4/4 | +100% | +0/0 | +100% | +0/0 | +100% | +4/4 | +
| prepare-job.ts | +
+
+ |
+ 46.84% | +52/111 | +23.57% | +33/140 | +30% | +3/10 | +50.51% | +49/97 | +
| run-container-step.ts | +
+
+ |
+ 8.21% | +6/73 | +0% | +0/99 | +0% | +0/3 | +8.95% | +6/67 | +
| run-script-step.ts | +
+
+ |
+ 40% | +6/15 | +0% | +0/14 | +0% | +0/1 | +40% | +6/15 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 | 1x +1x +1x +1x + | export * from './cleanup-job' +export * from './prepare-job' +export * from './run-script-step' +export * from './run-container-step' + |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 | 1x +1x + +1x + + + + + +1x +1x + + + + + + + +1x + + + + + + + + + +1x + +1x + + + +3x + + + +6x + +3x +6x + +3x +3x +3x +3x + + + + + + + +3x +3x + + + + + + + + + + + +3x + + + +3x + +3x + + + + + + + + + + + + +3x + + +3x + + + + +6x + + + + + + + +6x + +2x + +3x +3x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +3x +6x + + + + + + + + +1x + + +3x + + +3x +3x +3x + + +3x + + + + +3x + + + +3x +3x + + +3x +3x + + +3x +3x + + + + + + + +3x + + + + +3x +3x + + + + + +3x + + + + +3x +3x + + + + + + + + + + + + + | import * as core from '@actions/core'
+import * as io from '@actions/io'
+import * as k8s from '@kubernetes/client-node'
+import {
+ JobContainerInfo,
+ ContextPorts,
+ PrepareJobArgs,
+ writeToResponseFile
+} from 'hooklib'
+import path from 'path'
+import {
+ containerPorts,
+ createPod,
+ isPodContainerAlpine,
+ prunePods,
+ waitForPodPhases,
+ getPrepareJobTimeoutSeconds
+} from '../k8s'
+import {
+ containerVolumes,
+ DEFAULT_CONTAINER_ENTRY_POINT,
+ DEFAULT_CONTAINER_ENTRY_POINT_ARGS,
+ generateContainerName,
+ mergeContainerWithOptions,
+ readExtensionFromFile,
+ PodPhase,
+ fixArgs
+} from '../k8s/utils'
+import { CONTAINER_EXTENSION_PREFIX, JOB_CONTAINER_NAME } from './constants'
+
+export async function prepareJob(
+ args: PrepareJobArgs,
+ responseFile
+): Promise<void> {
+ Iif (!args.container) {
+ throw new Error('Job Container is required.')
+ }
+
+ await prunePods()
+
+ const extension = readExtensionFromFile()
+ await copyExternalsToRoot()
+
+ let container: k8s.V1Container | undefined = undefined
+ if (args.container?.image) {
+ core.debug(`Using image '${args.container.image}' for job image`)
+ container = createContainerSpec(
+ args.container,
+ JOB_CONTAINER_NAME,
+ true,
+ extension
+ )
+ }
+
+ let services: k8s.V1Container[] = []
+ Iif (args.services?.length) {
+ services = args.services.map(service => {
+ core.debug(`Adding service '${service.image}' to pod definition`)
+ return createContainerSpec(
+ service,
+ generateContainerName(service.image),
+ false,
+ extension
+ )
+ })
+ }
+
+ Iif (!container && !services?.length) {
+ throw new Error('No containers exist, skipping hook invocation')
+ }
+
+ let createdPod: k8s.V1Pod | undefined = undefined
+ try {
+ createdPod = await createPod(
+ container,
+ services,
+ args.container.registry,
+ extension
+ )
+ } catch (err) {
+ await prunePods()
+ core.debug(`createPod failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to create job pod: ${message}`)
+ }
+
+ Iif (!createdPod?.metadata?.name) {
+ throw new Error('created pod should have metadata.name')
+ }
+ core.debug(
+ `Job pod created, waiting for it to come online ${createdPod?.metadata?.name}`
+ )
+
+ try {
+ await waitForPodPhases(
+ createdPod.metadata.name,
+ new Set([PodPhase.RUNNING]),
+ new Set([PodPhase.PENDING]),
+ getPrepareJobTimeoutSeconds()
+ )
+ } catch (err) {
+ try {
+ await prunePods()
+ } catch (pruneErr) {
+ core.error(`Failed to prune pods: ${pruneErr instanceof Error ? pruneErr.message : String(pruneErr)}`)
+ }
+ const message = err instanceof Error ? err.message : String(err)
+ throw new Error(`pod failed to come online:\n${message}`)
+ }
+
+ core.debug('Job pod is ready for traffic')
+
+ let isAlpine = false
+ try {
+ isAlpine = await isPodContainerAlpine(
+ createdPod.metadata.name,
+ JOB_CONTAINER_NAME
+ )
+ } catch (err) {
+ core.debug(
+ `Failed to determine if the pod is alpine: ${JSON.stringify(err)}`
+ )
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to determine if the pod is alpine: ${message}`)
+ }
+ core.debug(`Setting isAlpine to ${isAlpine}`)
+ generateResponseFile(responseFile, args, createdPod, isAlpine)
+}
+
+function generateResponseFile(
+ responseFile: string,
+ args: PrepareJobArgs,
+ appPod: k8s.V1Pod,
+ isAlpine
+): void {
+ Iif (!appPod.metadata?.name) {
+ throw new Error('app pod must have metadata.name specified')
+ }
+ const response = {
+ state: {
+ jobPod: appPod.metadata.name
+ },
+ context: {},
+ isAlpine
+ }
+
+ const mainContainer = appPod.spec?.containers?.find(
+ c => c.name === JOB_CONTAINER_NAME
+ )
+ Iif (mainContainer) {
+ const mainContainerContextPorts: ContextPorts = {}
+ Iif (mainContainer?.ports) {
+ for (const port of mainContainer.ports) {
+ mainContainerContextPorts[port.containerPort] =
+ mainContainerContextPorts.hostPort
+ }
+ }
+
+ response.context['container'] = {
+ image: mainContainer.image,
+ ports: mainContainerContextPorts
+ }
+ }
+
+ Iif (args.services?.length) {
+ const serviceContainerNames =
+ args.services?.map(s => generateContainerName(s.image)) || []
+
+ response.context['services'] = appPod?.spec?.containers
+ ?.filter(c => serviceContainerNames.includes(c.name))
+ .map(c => {
+ const ctxPorts: ContextPorts = {}
+ Iif (c.ports?.length) {
+ for (const port of c.ports) {
+ ctxPorts[port.containerPort] = port.hostPort
+ }
+ }
+
+ return {
+ image: c.image,
+ ports: ctxPorts
+ }
+ })
+ }
+
+ writeToResponseFile(responseFile, JSON.stringify(response))
+}
+
+async function copyExternalsToRoot(): Promise<void> {
+ const workspace = process.env['RUNNER_WORKSPACE']
+ if (workspace) {
+ await io.cp(
+ path.join(workspace, '../../externals'),
+ path.join(workspace, '../externals'),
+ { force: true, recursive: true, copySourceDirectory: false }
+ )
+ }
+}
+
+export function createContainerSpec(
+ container: JobContainerInfo,
+ name: string,
+ IjobContainer = false,
+ extension?: k8s.V1PodTemplateSpec
+): k8s.V1Container {
+ if (!container.entryPoint && jobContainer) {
+ container.entryPoint = DEFAULT_CONTAINER_ENTRY_POINT
+ container.entryPointArgs = DEFAULT_CONTAINER_ENTRY_POINT_ARGS
+ }
+
+ const podContainer = {
+ name,
+ image: container.image,
+ ports: containerPorts(container)
+ } as k8s.V1Container
+ Iif (container.workingDirectory) {
+ podContainer.workingDir = container.workingDirectory
+ }
+
+ if (container.entryPoint) {
+ podContainer.command = [container.entryPoint]
+ }
+
+ if (container.entryPointArgs?.length > 0) {
+ podContainer.args = fixArgs(container.entryPointArgs)
+ }
+
+ podContainer.env = []
+ for (const [key, value] of Object.entries(
+ container['environmentVariables']
+ )) {
+ Iif (value && key !== 'HOME') {
+ podContainer.env.push({ name: key, value: value as string })
+ }
+ }
+
+ podContainer.env.push({
+ name: 'GITHUB_ACTIONS',
+ value: 'true'
+ })
+
+ if (!('CI' in container['environmentVariables'])) {
+ podContainer.env.push({
+ name: 'CI',
+ value: 'true'
+ })
+ }
+
+ podContainer.volumeMounts = containerVolumes(
+ container.userMountVolumes,
+ jobContainer
+ )
+
+ if (!extension) {
+ return podContainer
+ }
+
+ const from = extension.spec?.containers?.find(
+ c => c.name === CONTAINER_EXTENSION_PREFIX + name
+ )
+
+ Iif (from) {
+ mergeContainerWithOptions(podContainer, from)
+ }
+
+ return podContainer
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 | 1x +1x + +1x + + + + + + + + + + + +1x + + + + + + +1x + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | import * as core from '@actions/core'
+import * as k8s from '@kubernetes/client-node'
+import { RunContainerStepArgs } from 'hooklib'
+import {
+ createJob,
+ createSecretForEnvs,
+ describePodFailure,
+ getContainerJobPodName,
+ getContainerTerminatedErrors,
+ getPodByName,
+ getPodLogs,
+ getPodStatus,
+ waitForJobToComplete,
+ waitForPodPhases
+} from '../k8s'
+import {
+ containerVolumes,
+ fixArgs,
+ mergeContainerWithOptions,
+ PodPhase,
+ readExtensionFromFile
+} from '../k8s/utils'
+import { JOB_CONTAINER_EXTENSION_NAME, JOB_CONTAINER_NAME } from './constants'
+
+export async function runContainerStep(
+ stepContainer: RunContainerStepArgs
+): Promise<number> {
+ Iif (stepContainer.dockerfile) {
+ throw new Error('Building container actions is not currently supported')
+ }
+
+ let secretName: string | undefined = undefined
+ if (IstepContainer.environmentVariables) {
+ try {
+ const envs = JSON.parse(
+ JSON.stringify(stepContainer.environmentVariables)
+ )
+ envs['GITHUB_ACTIONS'] = 'true'
+ Iif (!('CI' in envs)) {
+ envs.CI = 'true'
+ }
+ secretName = await createSecretForEnvs(envs)
+ } catch (err) {
+ core.debug(`createSecretForEnvs failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to create script environment: ${message}`)
+ }
+ }
+
+ const extension = readExtensionFromFile()
+
+ core.debug(`Created secret ${secretName} for container job envs`)
+ const container = createContainerSpec(stepContainer, secretName, extension)
+
+ let job: k8s.V1Job
+ try {
+ job = await createJob(container, extension)
+ } catch (err) {
+ core.debug(`createJob failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to run script step: ${message}`)
+ }
+
+ Iif (!job.metadata?.name) {
+ throw new Error(
+ `Expected job ${JSON.stringify(
+ job
+ )} to have correctly set the metadata.name`
+ )
+ }
+ core.debug(`Job created, waiting for pod to start: ${job.metadata?.name}`)
+
+ let podName: string
+ try {
+ podName = await getContainerJobPodName(job.metadata.name)
+ } catch (err) {
+ core.debug(`getContainerJobPodName failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to get container job pod name: ${message}`)
+ }
+
+ await waitForPodPhases(
+ podName,
+ new Set([
+ PodPhase.COMPLETED,
+ PodPhase.RUNNING,
+ PodPhase.SUCCEEDED,
+ PodPhase.FAILED
+ ]),
+ new Set([PodPhase.PENDING, PodPhase.UNKNOWN])
+ )
+ core.debug('Container step is running or complete, pulling logs')
+
+ await getPodLogs(podName, JOB_CONTAINER_NAME)
+
+ core.debug('Waiting for container job to complete')
+ await waitForJobToComplete(job.metadata.name)
+
+ // pod has failed so pull the status code from the container
+ const status = await getPodStatus(podName)
+ Iif (status?.phase === 'Succeeded') {
+ return 0
+ }
+ Iif (!status?.containerStatuses?.length) {
+ core.error(
+ `Can't determine container status from response: ${JSON.stringify(
+ status
+ )}`
+ )
+ return 1
+ }
+
+ const pod = await getPodByName(podName)
+ const terminatedErrors = getContainerTerminatedErrors(pod)
+ if (IterminatedErrors.length > 0) {
+ const details = await describePodFailure(podName)
+ core.error(
+ `Pod ${podName} has unrecoverable container errors:\n${terminatedErrors.join('\n')}\n${details}`
+ )
+ return 1
+ }
+
+ const exitCode =
+ status.containerStatuses[status.containerStatuses.length - 1].state
+ ?.terminated?.exitCode
+ return Number(exitCode) || 1
+}
+
+function createContainerSpec(
+ container: RunContainerStepArgs,
+ secretName?: string,
+ extension?: k8s.V1PodTemplateSpec
+): k8s.V1Container {
+ const podContainer = new k8s.V1Container()
+ podContainer.name = JOB_CONTAINER_NAME
+ podContainer.image = container.image
+ podContainer.workingDir = container.workingDirectory
+ podContainer.command = container.entryPoint
+ ? [container.entryPoint]
+ : undefined
+ podContainer.args = container.entryPointArgs?.length
+ ? fixArgs(container.entryPointArgs)
+ : undefined
+
+ Iif (secretName) {
+ podContainer.envFrom = [
+ {
+ secretRef: {
+ name: secretName,
+ optional: false
+ }
+ }
+ ]
+ }
+ podContainer.volumeMounts = containerVolumes(undefined, false, true)
+
+ Iif (!extension) {
+ return podContainer
+ }
+
+ const from = extension.spec?.containers?.find(
+ c => c.name === JOB_CONTAINER_EXTENSION_NAME
+ )
+ Iif (from) {
+ mergeContainerWithOptions(podContainer, from)
+ }
+
+ return podContainer
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 | +1x +1x + +1x +1x +1x + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | /* eslint-disable @typescript-eslint/no-unused-vars */
+import * as fs from 'fs'
+import * as core from '@actions/core'
+import { RunScriptStepArgs } from 'hooklib'
+import { execPodStep } from '../k8s'
+import { writeEntryPointScript } from '../k8s/utils'
+import { JOB_CONTAINER_NAME } from './constants'
+
+export async function runScriptStep(
+ args: RunScriptStepArgs,
+ state,
+ responseFile
+): Promise<void> {
+ const { entryPoint, entryPointArgs, environmentVariables } = args
+ const { containerPath, runnerPath } = writeEntryPointScript(
+ args.workingDirectory,
+ entryPoint,
+ entryPointArgs,
+ args.prependPath,
+ environmentVariables
+ )
+
+ args.entryPoint = 'sh'
+ args.entryPointArgs = ['-e', containerPath]
+ try {
+ await execPodStep(
+ [args.entryPoint, ...args.entryPointArgs],
+ state.jobPod,
+ JOB_CONTAINER_NAME
+ )
+ } catch (err) {
+ core.debug(`execPodStep failed: ${JSON.stringify(err)}`)
+ const message = (err as any)?.response?.body?.message || err
+ throw new Error(`failed to run script step: ${message}`)
+ } finally {
+ fs.rmSync(runnerPath)
+ }
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ ++ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 +269 +270 +271 +272 +273 +274 +275 +276 +277 +278 +279 +280 +281 +282 +283 +284 +285 +286 +287 +288 +289 +290 +291 +292 +293 +294 +295 +296 +297 +298 +299 +300 +301 +302 +303 +304 +305 +306 +307 +308 +309 +310 +311 +312 +313 +314 +315 +316 +317 +318 +319 +320 +321 +322 +323 +324 +325 +326 +327 +328 +329 +330 +331 +332 +333 +334 +335 +336 +337 +338 +339 +340 +341 +342 +343 +344 +345 +346 +347 +348 +349 +350 +351 +352 +353 +354 +355 +356 +357 +358 +359 +360 +361 +362 +363 +364 +365 +366 +367 +368 +369 +370 +371 +372 +373 +374 +375 +376 +377 +378 +379 +380 +381 +382 +383 +384 +385 +386 +387 +388 +389 +390 +391 +392 +393 +394 +395 +396 +397 +398 +399 +400 +401 +402 +403 +404 +405 +406 +407 +408 +409 +410 +411 +412 +413 +414 +415 +416 +417 +418 +419 +420 +421 +422 +423 +424 +425 +426 +427 +428 +429 +430 +431 +432 +433 +434 +435 +436 +437 +438 +439 +440 +441 +442 +443 +444 +445 +446 +447 +448 +449 +450 +451 +452 +453 +454 +455 +456 +457 +458 +459 +460 +461 +462 +463 +464 +465 +466 +467 +468 +469 +470 +471 +472 +473 +474 +475 +476 +477 +478 +479 +480 +481 +482 +483 +484 +485 +486 +487 +488 +489 +490 +491 +492 +493 +494 +495 +496 +497 +498 +499 +500 +501 +502 +503 +504 +505 +506 +507 +508 +509 +510 +511 +512 +513 +514 +515 +516 +517 +518 +519 +520 +521 +522 +523 +524 +525 +526 +527 +528 +529 +530 +531 +532 +533 +534 +535 +536 +537 +538 +539 +540 +541 +542 +543 +544 +545 +546 +547 +548 +549 +550 +551 +552 +553 +554 +555 +556 +557 +558 +559 +560 +561 +562 +563 +564 +565 +566 +567 +568 +569 +570 +571 +572 +573 +574 +575 +576 +577 +578 +579 +580 +581 +582 +583 +584 +585 +586 +587 +588 +589 +590 +591 +592 +593 +594 +595 +596 +597 +598 +599 +600 +601 +602 +603 +604 +605 +606 +607 +608 +609 +610 +611 +612 +613 +614 +615 +616 +617 +618 +619 +620 +621 +622 +623 +624 +625 +626 +627 +628 +629 +630 +631 +632 +633 +634 +635 +636 +637 +638 +639 +640 +641 +642 +643 +644 +645 +646 +647 +648 +649 +650 +651 +652 +653 +654 +655 +656 +657 +658 +659 +660 +661 +662 +663 +664 +665 +666 +667 +668 +669 +670 +671 +672 +673 +674 +675 +676 +677 +678 +679 +680 +681 +682 +683 +684 +685 +686 +687 +688 +689 +690 +691 +692 +693 +694 +695 +696 +697 +698 +699 +700 +701 +702 +703 +704 +705 +706 +707 +708 +709 +710 +711 +712 +713 +714 +715 +716 +717 +718 +719 +720 +721 +722 +723 +724 +725 +726 +727 +728 +729 +730 +731 +732 +733 +734 +735 +736 +737 +738 +739 +740 +741 +742 +743 +744 +745 +746 +747 +748 +749 +750 +751 +752 +753 +754 +755 +756 +757 +758 +759 +760 +761 +762 +763 +764 +765 +766 +767 +768 +769 +770 +771 +772 +773 +774 +775 +776 +777 +778 +779 +780 +781 +782 +783 +784 +785 +786 +787 +788 +789 +790 +791 +792 +793 +794 +795 +796 +797 +798 +799 +800 +801 +802 +803 +804 +805 +806 +807 +808 +809 +810 +811 +812 +813 +814 +815 +816 +817 +818 +819 +820 +821 +822 +823 +824 +825 +826 +827 +828 +829 +830 +831 +832 +833 +834 +835 +836 +837 +838 +839 +840 +841 +842 +843 +844 +845 +846 +847 +848 +849 +850 +851 +852 +853 +854 +855 +856 +857 +858 +859 +860 +861 +862 +863 +864 +865 +866 +867 +868 +869 +870 +871 +872 +873 +874 +875 +876 +877 +878 +879 +880 +881 +882 +883 +884 +885 +886 +887 +888 +889 +890 +891 +892 +893 +894 +895 +896 +897 +898 +899 +900 +901 +902 +903 +904 +905 +906 +907 +908 +909 +910 +911 +912 +913 +914 +915 +916 +917 +918 +919 +920 +921 +922 +923 +924 +925 +926 +927 +928 +929 +930 +931 +932 +933 +934 +935 +936 +937 +938 +939 +940 +941 +942 +943 +944 +945 +946 +947 +948 +949 +950 +951 +952 +953 +954 +955 +956 +957 +958 +959 +960 +961 +962 +963 +964 +965 +966 +967 +968 +969 +970 +971 +972 +973 +974 +975 +976 +977 +978 +979 +980 +981 +982 | 1x +1x + +1x +1x + + + + + + + +1x + + + + + + + +1x + +1x + +1x +1x +1x + +1x + +1x + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + +1x + + + + + + + + + + + + + + + + + + + +1x + + + + + + + +1x + + + + + +1x + + + + + +1x + +1x + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + +3x + +3x +3x + + + + + + + + + + + + + + + + + + +1x + + + + + + + +1x + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + +1x + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + +1x + + + + + + + + +1x + + + + + + + + + + + + + + +1x + +1x + + +3x +3x +3x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + | import * as core from '@actions/core'
+import * as k8s from '@kubernetes/client-node'
+import { ContainerInfo, Registry } from 'hooklib'
+import * as stream from 'stream'
+import {
+ getJobPodName,
+ getRunnerPodName,
+ getSecretName,
+ getStepPodName,
+ getVolumeClaimName,
+ RunnerInstanceLabel
+} from '../hooks/constants'
+import {
+ PodPhase,
+ mergePodSpecWithOptions,
+ mergeObjectMeta,
+ useKubeScheduler,
+ fixArgs
+} from './utils'
+
+const kc = new k8s.KubeConfig()
+
+kc.loadFromDefault()
+
+const k8sApi = kc.makeApiClient(k8s.CoreV1Api)
+const k8sBatchV1Api = kc.makeApiClient(k8s.BatchV1Api)
+const k8sAuthorizationV1Api = kc.makeApiClient(k8s.AuthorizationV1Api)
+
+const DEFAULT_WAIT_FOR_POD_TIME_SECONDS = 10 * 60 // 10 min
+
+export const POD_VOLUME_NAME = 'work'
+
+export const requiredPermissions = [
+ {
+ group: '',
+ verbs: ['get', 'list', 'create', 'delete'],
+ resource: 'pods',
+ subresource: ''
+ },
+ {
+ group: '',
+ verbs: ['get', 'create'],
+ resource: 'pods',
+ subresource: 'exec'
+ },
+ {
+ group: '',
+ verbs: ['get', 'list', 'watch'],
+ resource: 'pods',
+ subresource: 'log'
+ },
+ {
+ group: 'batch',
+ verbs: ['get', 'list', 'create', 'delete'],
+ resource: 'jobs',
+ subresource: ''
+ },
+ {
+ group: '',
+ verbs: ['create', 'delete', 'get', 'list'],
+ resource: 'secrets',
+ subresource: ''
+ }
+]
+
+export async function createPod(
+ jobContainer?: k8s.V1Container,
+ services?: k8s.V1Container[],
+ registry?: Registry,
+ extension?: k8s.V1PodTemplateSpec
+): Promise<k8s.V1Pod> {
+ const containers: k8s.V1Container[] = []
+ Iif (jobContainer) {
+ containers.push(jobContainer)
+ }
+ Iif (services?.length) {
+ containers.push(...services)
+ }
+
+ const appPod = new k8s.V1Pod()
+
+ appPod.apiVersion = 'v1'
+ appPod.kind = 'Pod'
+
+ appPod.metadata = new k8s.V1ObjectMeta()
+ appPod.metadata.name = getJobPodName()
+
+ const instanceLabel = new RunnerInstanceLabel()
+ appPod.metadata.labels = {
+ [instanceLabel.key]: instanceLabel.value
+ }
+ appPod.metadata.annotations = {}
+
+ appPod.spec = new k8s.V1PodSpec()
+ appPod.spec.containers = containers
+ appPod.spec.restartPolicy = 'Never'
+
+ const nodeName = await getCurrentNodeName()
+ if (IuseKubeScheduler()) {
+ appPod.spec.affinity = await getPodAffinity(nodeName)
+ } else {
+ appPod.spec.affinity = await getPreferredPodAffinity(nodeName)
+ }
+ const claimName = getVolumeClaimName()
+ appPod.spec.volumes = [
+ {
+ name: 'work',
+ persistentVolumeClaim: { claimName }
+ }
+ ]
+
+ if (Iregistry) {
+ const secret = await createDockerSecret(registry)
+ Iif (!secret?.metadata?.name) {
+ throw new Error(`created secret does not have secret.metadata.name`)
+ }
+ const secretReference = new k8s.V1LocalObjectReference()
+ secretReference.name = secret.metadata.name
+ appPod.spec.imagePullSecrets = [secretReference]
+ }
+
+ Iif (extension?.metadata) {
+ mergeObjectMeta(appPod, extension.metadata)
+ }
+
+ Iif (extension?.spec) {
+ mergePodSpecWithOptions(appPod.spec, extension.spec)
+ }
+
+ const { body } = await k8sApi.createNamespacedPod(namespace(), appPod)
+ return body
+}
+
+export async function createJob(
+ container: k8s.V1Container,
+ extension?: k8s.V1PodTemplateSpec
+): Promise<k8s.V1Job> {
+ const runnerInstanceLabel = new RunnerInstanceLabel()
+
+ const job = new k8s.V1Job()
+ job.apiVersion = 'batch/v1'
+ job.kind = 'Job'
+ job.metadata = new k8s.V1ObjectMeta()
+ job.metadata.name = getStepPodName()
+ job.metadata.labels = { [runnerInstanceLabel.key]: runnerInstanceLabel.value }
+ job.metadata.annotations = {}
+
+ job.spec = new k8s.V1JobSpec()
+ job.spec.ttlSecondsAfterFinished = 300
+ job.spec.backoffLimit = 0
+ job.spec.template = new k8s.V1PodTemplateSpec()
+
+ job.spec.template.spec = new k8s.V1PodSpec()
+ job.spec.template.metadata = new k8s.V1ObjectMeta()
+ job.spec.template.metadata.labels = {}
+ job.spec.template.metadata.annotations = {}
+ job.spec.template.spec.containers = [container]
+ job.spec.template.spec.restartPolicy = 'Never'
+
+ const nodeName = await getCurrentNodeName()
+ if (IuseKubeScheduler()) {
+ job.spec.template.spec.affinity = await getPodAffinity(nodeName)
+ } else {
+ job.spec.template.spec.affinity = await getPreferredPodAffinity(nodeName)
+ }
+
+ const claimName = getVolumeClaimName()
+ job.spec.template.spec.volumes = [
+ {
+ name: 'work',
+ persistentVolumeClaim: { claimName }
+ }
+ ]
+
+ Iif (extension) {
+ Iif (extension.metadata) {
+ // apply metadata both to the job and the pod created by the job
+ mergeObjectMeta(job, extension.metadata)
+ mergeObjectMeta(job.spec.template, extension.metadata)
+ }
+ Iif (extension.spec) {
+ mergePodSpecWithOptions(job.spec.template.spec, extension.spec)
+ }
+ }
+
+ const { body } = await k8sBatchV1Api.createNamespacedJob(namespace(), job)
+ return body
+}
+
+export async function getContainerJobPodName(jobName: string): Promise<string> {
+ const selector = `job-name=${jobName}`
+ const backOffManager = new BackOffManager(60)
+ while (Itrue) {
+ const podList = await k8sApi.listNamespacedPod(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ undefined,
+ selector,
+ 1
+ )
+
+ if (I!podList.body.items?.length) {
+ await backOffManager.backOff()
+ continue
+ }
+
+ Iif (!podList.body.items[0].metadata?.name) {
+ throw new Error(
+ `Failed to determine the name of the pod for job ${jobName}`
+ )
+ }
+ return podList.body.items[0].metadata.name
+ }
+}
+
+export async function deletePod(podName: string): Promise<void> {
+ await k8sApi.deleteNamespacedPod(
+ podName,
+ namespace(),
+ undefined,
+ undefined,
+ 0
+ )
+}
+
+export async function execPodStep(
+ command: string[],
+ podName: string,
+ containerName: string,
+ stdin?: stream.Readable
+): Promise<void> {
+ const exec = new k8s.Exec(kc)
+ command = fixArgs(command)
+ // Exec returns a websocket. If websocket fails, we should reject the promise. Otherwise, websocket will call a callback. Since at that point, websocket is not failing, we can safely resolve or reject the promise.
+ await new Promise(function (resolve, reject) {
+ exec
+ .exec(
+ namespace(),
+ podName,
+ containerName,
+ command,
+ process.stdout,
+ process.stderr,
+ stdin ?? null,
+ false /* tty */,
+ resp => {
+ // kube.exec returns an error if exit code is not 0, but we can't actually get the exit code
+ if (resp.status === 'Success') {
+ resolve(resp.code)
+ } else {
+ core.debug(
+ JSON.stringify({
+ message: resp?.message,
+ details: resp?.details
+ })
+ )
+ reject(resp?.message)
+ }
+ }
+ )
+ // If exec.exec fails, explicitly reject the outer promise
+ // eslint-disable-next-line github/no-then
+ .catch(e => reject(e))
+ })
+}
+
+export async function waitForJobToComplete(jobName: string): Promise<void> {
+ const backOffManager = new BackOffManager()
+ while (Itrue) {
+ try {
+ Iif (await isJobSucceeded(jobName)) {
+ return
+ }
+ } catch (error) {
+ throw new Error(`job ${jobName} has failed`)
+ }
+ await backOffManager.backOff()
+ }
+}
+
+export async function createDockerSecret(
+ registry: Registry
+): Promise<k8s.V1Secret> {
+ const authContent = {
+ auths: {
+ [registry.serverUrl || 'https://index.docker.io/v1/']: {
+ username: registry.username,
+ password: registry.password,
+ auth: Buffer.from(`${registry.username}:${registry.password}`).toString(
+ 'base64'
+ )
+ }
+ }
+ }
+
+ const runnerInstanceLabel = new RunnerInstanceLabel()
+
+ const secretName = getSecretName()
+ const secret = new k8s.V1Secret()
+ secret.immutable = true
+ secret.apiVersion = 'v1'
+ secret.metadata = new k8s.V1ObjectMeta()
+ secret.metadata.name = secretName
+ secret.metadata.namespace = namespace()
+ secret.metadata.labels = {
+ [runnerInstanceLabel.key]: runnerInstanceLabel.value
+ }
+ secret.type = 'kubernetes.io/dockerconfigjson'
+ secret.kind = 'Secret'
+ secret.data = {
+ '.dockerconfigjson': Buffer.from(JSON.stringify(authContent)).toString(
+ 'base64'
+ )
+ }
+
+ const { body } = await k8sApi.createNamespacedSecret(namespace(), secret)
+ return body
+}
+
+export async function createSecretForEnvs(envs: {
+ [key: string]: string
+}): Promise<string> {
+ const runnerInstanceLabel = new RunnerInstanceLabel()
+
+ const secret = new k8s.V1Secret()
+ const secretName = getSecretName()
+ secret.immutable = true
+ secret.apiVersion = 'v1'
+ secret.metadata = new k8s.V1ObjectMeta()
+ secret.metadata.name = secretName
+
+ secret.metadata.labels = {
+ [runnerInstanceLabel.key]: runnerInstanceLabel.value
+ }
+ secret.kind = 'Secret'
+ secret.data = {}
+ for (const [key, value] of Object.entries(envs)) {
+ secret.data[key] = Buffer.from(value).toString('base64')
+ }
+
+ await k8sApi.createNamespacedSecret(namespace(), secret)
+ return secretName
+}
+
+export async function deleteSecret(secretName: string): Promise<void> {
+ await k8sApi.deleteNamespacedSecret(secretName, namespace())
+}
+
+export async function pruneSecrets(): Promise<void> {
+ const secretList = await k8sApi.listNamespacedSecret(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ undefined,
+ new RunnerInstanceLabel().toString()
+ )
+ Iif (!secretList.body.items.length) {
+ return
+ }
+
+ await Promise.all(
+ secretList.body.items.map(
+ secret => secret.metadata?.name && deleteSecret(secret.metadata.name)
+ )
+ )
+}
+
+export const UNRECOVERABLE_WAITING_REASONS = new Set([
+ 'ImagePullBackOff',
+ 'ErrImagePull',
+ 'InvalidImageName',
+ 'CreateContainerConfigError',
+ 'CreateContainerError'
+])
+
+export const UNRECOVERABLE_EVENT_REASONS = new Set([
+ 'FailedScheduling',
+ 'FailedBinding',
+ 'FailedMount'
+])
+
+export const UNRECOVERABLE_TERMINATED_REASONS = new Set([
+ 'OOMKilled',
+ 'Error',
+ 'FailedPostStartHookError'
+])
+
+const MAX_DIAGNOSTIC_EVENTS = 10
+
+export function getUnrecoverableWaitingReasons(): Set<string> {
+ const extra = process.env['ACTIONS_RUNNER_K8S_UNRECOVERABLE_WAITING_REASONS']
+ Iif (!extra) {
+ return UNRECOVERABLE_WAITING_REASONS
+ }
+ const reasons = new Set(UNRECOVERABLE_WAITING_REASONS)
+ for (const reason of extra.split(',')) {
+ const trimmed = reason.trim()
+ Iif (trimmed) {
+ reasons.add(trimmed)
+ }
+ }
+ return reasons
+}
+
+export function getUnrecoverableEventReasons(): Set<string> {
+ const extra = process.env['ACTIONS_RUNNER_K8S_UNRECOVERABLE_EVENT_REASONS']
+ Iif (!extra) {
+ return UNRECOVERABLE_EVENT_REASONS
+ }
+ const reasons = new Set(UNRECOVERABLE_EVENT_REASONS)
+ for (const reason of extra.split(',')) {
+ const trimmed = reason.trim()
+ Iif (trimmed) {
+ reasons.add(trimmed)
+ }
+ }
+ return reasons
+}
+
+export function getUnrecoverableTerminatedReasons(): Set<string> {
+ const extra =
+ process.env['ACTIONS_RUNNER_K8S_UNRECOVERABLE_TERMINATED_REASONS']
+ Iif (!extra) {
+ return UNRECOVERABLE_TERMINATED_REASONS
+ }
+ const reasons = new Set(UNRECOVERABLE_TERMINATED_REASONS)
+ for (const reason of extra.split(',')) {
+ const trimmed = reason.trim()
+ Iif (trimmed) {
+ reasons.add(trimmed)
+ }
+ }
+ return reasons
+}
+
+export function getContainerErrors(pod: k8s.V1Pod): string[] {
+ const errors: string[] = []
+ const unrecoverableReasons = getUnrecoverableWaitingReasons()
+ const allStatuses = [
+ ...(pod.status?.initContainerStatuses ?? []),
+ ...(pod.status?.containerStatuses ?? [])
+ ]
+ for (const cs of allStatuses) {
+ const waiting = cs.state?.waiting
+ Iif (waiting?.reason && unrecoverableReasons.has(waiting.reason)) {
+ errors.push(
+ `container "${cs.name}": ${waiting.reason}${
+ waiting.message ? ` - ${waiting.message}` : ''
+ }`
+ )
+ }
+ }
+ return errors
+}
+
+export async function getPodEventErrors(podName: string): Promise<string[]> {
+ const unrecoverableReasons = getUnrecoverableEventReasons()
+ let items: k8s.CoreV1Event[]
+ try {
+ const { body } = await k8sApi.listNamespacedEvent(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ `involvedObject.name=${podName}`
+ )
+ items = body.items
+ } catch (err) {
+ core.debug(
+ `Could not list events for pod ${podName} (the 'events' permission may be missing): ${
+ err instanceof Error ? err.message : String(err)
+ }`
+ )
+ return []
+ }
+
+ const errors: string[] = []
+ for (const e of items) {
+ Iif (
+ e.type === 'Warning' &&
+ e.reason &&
+ unrecoverableReasons.has(e.reason)
+ ) {
+ errors.push(`Event [Warning] ${e.reason}: ${e.message ?? ''}`)
+ }
+ }
+ return errors
+}
+
+export function getPodConditionErrors(pod: k8s.V1Pod): string[] {
+ const errors: string[] = []
+ for (const cond of pod.status?.conditions ?? []) {
+ Iif (cond.type === 'PodScheduled' && cond.status === 'False' && cond.reason === 'Unschedulable') {
+ errors.push(
+ `Condition ${cond.type}=False (reason: ${cond.reason ?? ''}): ${
+ cond.message ?? ''
+ }`
+ )
+ }
+ }
+ return errors
+}
+
+export function getContainerTerminatedErrors(pod: k8s.V1Pod): string[] {
+ const errors: string[] = []
+ const unrecoverableReasons = getUnrecoverableTerminatedReasons()
+ const allStatuses = [
+ ...(pod.status?.initContainerStatuses ?? []),
+ ...(pod.status?.containerStatuses ?? [])
+ ]
+ for (const cs of allStatuses) {
+ const terminated = cs.state?.terminated
+ Iif (terminated?.reason && unrecoverableReasons.has(terminated.reason)) {
+ errors.push(
+ `container "${cs.name}": ${terminated.reason} (exit code ${terminated.exitCode}) - ${
+ terminated.message ?? ''
+ }`
+ )
+ }
+ }
+ return errors
+}
+
+export async function describePodFailure(podName: string): Promise<string> {
+ let pod: k8s.V1Pod
+ try {
+ pod = await readPod(podName)
+ } catch (err) {
+ return `Could not read pod ${podName} for diagnostics: ${
+ err instanceof Error ? err.message : String(err)
+ }`
+ }
+
+ const lines: string[] = []
+ const status = pod.status
+
+ Iif (status?.phase) {
+ lines.push(
+ `Phase: ${status.phase}${
+ status.reason ? ` (reason: ${status.reason})` : ''
+ }`
+ )
+ }
+ Iif (status?.message) {
+ lines.push(`Message: ${status.message}`)
+ }
+
+ const separator = '────────────────────────────────────────────────────────────'
+ lines.push(separator)
+
+ for (const cond of status?.conditions ?? []) {
+ Iif (cond.status === 'False') {
+ lines.push(
+ ` ✗ ${cond.type}=False${
+ cond.reason ? ` (${cond.reason})` : ''
+ }${cond.message ? `: ${cond.message}` : ''}`
+ )
+ }
+ }
+
+ const allStatuses = [
+ ...(status?.initContainerStatuses ?? []),
+ ...(status?.containerStatuses ?? [])
+ ]
+ for (const cs of allStatuses) {
+ const waiting = cs.state?.waiting
+ Iif (waiting?.reason) {
+ lines.push(
+ ` ✗ container "${cs.name}": ${waiting.reason}${
+ waiting.message ? `\n ${waiting.message}` : ''
+ }`
+ )
+ }
+ const terminated = cs.state?.terminated
+ Iif (terminated) {
+ lines.push(
+ ` ✗ container "${cs.name}": ${
+ terminated.reason ?? 'Unknown'
+ } (exit code ${terminated.exitCode})${
+ terminated.message ? `\n ${terminated.message}` : ''
+ }`
+ )
+ }
+ }
+
+ lines.push(...(await describePodWarningEvents(podName)))
+
+ Iif (!lines.length) {
+ return `No additional diagnostic information available for pod ${podName}`
+ }
+ return lines.join('\n')
+}
+
+async function describePodWarningEvents(podName: string): Promise<string[]> {
+ let items: k8s.CoreV1Event[]
+ try {
+ const { body } = await k8sApi.listNamespacedEvent(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ `involvedObject.name=${podName}`
+ )
+ items = body.items
+ } catch (err) {
+ core.debug(
+ `Could not list events for pod ${podName} (the 'events' permission may be missing): ${
+ err instanceof Error ? err.message : String(err)
+ }`
+ )
+ return []
+ }
+
+ const warnings = items.filter(e => e.type === 'Warning')
+ Iif (!warnings.length) {
+ return []
+ }
+
+ const eventTime = (e: k8s.CoreV1Event): number => {
+ const t = e.lastTimestamp ?? e.eventTime ?? e.firstTimestamp
+ return t ? new Date(t).getTime() : 0
+ }
+ warnings.sort((a, b) => eventTime(a) - eventTime(b))
+
+ const recent = warnings.slice(-MAX_DIAGNOSTIC_EVENTS)
+ const lines = recent.map(e => {
+ const count = e.count && e.count > 1 ? ` (x${e.count})` : ''
+ return `Event [Warning] ${e.reason ?? ''}${count}: ${
+ e.message ?? ''
+ }`.trim()
+ })
+ Iif (warnings.length > recent.length) {
+ lines.unshift(
+ `(showing ${recent.length} of ${warnings.length} warning events)`
+ )
+ }
+ return lines
+}
+
+export async function waitForPodPhases(
+ podName: string,
+ awaitingPhases: Set<PodPhase>,
+ backOffPhases: Set<PodPhase>,
+ ImaxTimeSeconds = DEFAULT_WAIT_FOR_POD_TIME_SECONDS
+): Promise<void> {
+ const backOffManager = new BackOffManager(maxTimeSeconds)
+ let phase: PodPhase = PodPhase.UNKNOWN
+ while (Itrue) {
+ const pod = await readPod(podName)
+ phase = parsePodPhase(pod)
+ Iif (awaitingPhases.has(phase)) {
+ return
+ }
+
+ if (I!backOffPhases.has(phase)) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} is unhealthy with phase status ${phase}\n${details}`
+ )
+ }
+
+ const containerErrors = getContainerErrors(pod)
+ if (IcontainerErrors.length > 0) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} has unrecoverable container errors: ${containerErrors.join(
+ '; '
+ )}\n${details}`
+ )
+ }
+
+ const conditionErrors = getPodConditionErrors(pod)
+ if (IconditionErrors.length > 0) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} has unrecoverable condition errors: ${conditionErrors.join(
+ '; '
+ )}\n${details}`
+ )
+ }
+
+ try {
+ await backOffManager.backOff()
+ } catch (error) {
+ const details = await describePodFailure(podName)
+ throw new Error(
+ `Pod ${podName} is unhealthy: timed out after ${maxTimeSeconds}s in phase ${phase}\n${details}`
+ )
+ }
+ }
+}
+
+export function getPrepareJobTimeoutSeconds(): number {
+ const envTimeoutSeconds =
+ process.env['ACTIONS_RUNNER_PREPARE_JOB_TIMEOUT_SECONDS']
+
+ if (!envTimeoutSeconds) {
+ return DEFAULT_WAIT_FOR_POD_TIME_SECONDS
+ }
+
+ const timeoutSeconds = parseInt(envTimeoutSeconds, 10)
+ Iif (!timeoutSeconds || timeoutSeconds <= 0) {
+ core.warning(
+ `Prepare job timeout is invalid ("${timeoutSeconds}"): use an int > 0`
+ )
+ return DEFAULT_WAIT_FOR_POD_TIME_SECONDS
+ }
+
+ return timeoutSeconds
+}
+
+async function readPod(podName: string): Promise<k8s.V1Pod> {
+ const { body } = await k8sApi.readNamespacedPod(podName, namespace())
+ return body
+}
+
+const podPhaseLookup = new Set<string>([
+ PodPhase.PENDING,
+ PodPhase.RUNNING,
+ PodPhase.SUCCEEDED,
+ PodPhase.FAILED,
+ PodPhase.UNKNOWN
+])
+
+export function parsePodPhase(pod: k8s.V1Pod): PodPhase {
+ Iif (!pod.status?.phase || !podPhaseLookup.has(pod.status.phase)) {
+ return PodPhase.UNKNOWN
+ }
+ return pod.status.phase as PodPhase
+}
+
+async function isJobSucceeded(jobName: string): Promise<boolean> {
+ const { body } = await k8sBatchV1Api.readNamespacedJob(jobName, namespace())
+ const job = body
+ Iif (job.status?.failed) {
+ throw new Error(`job ${jobName} has failed`)
+ }
+ return !!job.status?.succeeded
+}
+
+export async function getPodLogs(
+ podName: string,
+ containerName: string
+): Promise<void> {
+ const log = new k8s.Log(kc)
+ const logStream = new stream.PassThrough()
+ logStream.on('data', chunk => {
+ // use write rather than console.log to prevent double line feed
+ process.stdout.write(chunk)
+ })
+
+ logStream.on('error', err => {
+ process.stderr.write(err.message)
+ })
+
+ const r = await log.log(namespace(), podName, containerName, logStream, {
+ follow: true,
+ pretty: false,
+ timestamps: false
+ })
+ await new Promise(resolve => r.on('close', () => resolve(null)))
+}
+
+export async function prunePods(): Promise<void> {
+ const podList = await k8sApi.listNamespacedPod(
+ namespace(),
+ undefined,
+ undefined,
+ undefined,
+ undefined,
+ new RunnerInstanceLabel().toString()
+ )
+ Iif (!podList.body.items.length) {
+ return
+ }
+
+ await Promise.all(
+ podList.body.items.map(
+ pod => pod.metadata?.name && deletePod(pod.metadata.name)
+ )
+ )
+}
+
+export async function getPodStatus(
+ name: string
+): Promise<k8s.V1PodStatus | undefined> {
+ const { body } = await k8sApi.readNamespacedPod(name, namespace())
+ return body.status
+}
+
+export async function isAuthPermissionsOK(): Promise<boolean> {
+ const sar = new k8s.V1SelfSubjectAccessReview()
+ const asyncs: Promise<{
+ response: unknown
+ body: k8s.V1SelfSubjectAccessReview
+ }>[] = []
+ for (const resource of requiredPermissions) {
+ for (const verb of resource.verbs) {
+ sar.spec = new k8s.V1SelfSubjectAccessReviewSpec()
+ sar.spec.resourceAttributes = new k8s.V1ResourceAttributes()
+ sar.spec.resourceAttributes.verb = verb
+ sar.spec.resourceAttributes.namespace = namespace()
+ sar.spec.resourceAttributes.group = resource.group
+ sar.spec.resourceAttributes.resource = resource.resource
+ sar.spec.resourceAttributes.subresource = resource.subresource
+ asyncs.push(k8sAuthorizationV1Api.createSelfSubjectAccessReview(sar))
+ }
+ }
+ const responses = await Promise.all(asyncs)
+ return responses.every(resp => resp.body.status?.allowed)
+}
+
+export async function isPodContainerAlpine(
+ podName: string,
+ containerName: string
+): Promise<boolean> {
+ let isAlpine = true
+ try {
+ await execPodStep(
+ [
+ 'sh',
+ '-c',
+ `'[ $(cat /etc/*release* | grep -i -e "^ID=*alpine*" -c) != 0 ] || exit 1'`
+ ],
+ podName,
+ containerName
+ )
+ } catch (err) {
+ isAlpine = false
+ }
+
+ return isAlpine
+}
+
+async function getCurrentNodeName(): Promise<string> {
+ const resp = await k8sApi.readNamespacedPod(getRunnerPodName(), namespace())
+
+ const nodeName = resp.body.spec?.nodeName
+ Iif (!nodeName) {
+ throw new Error('Failed to determine node name')
+ }
+ return nodeName
+}
+
+async function getPodAffinity(nodeName: string): Promise<k8s.V1Affinity> {
+ const affinity = new k8s.V1Affinity()
+ affinity.nodeAffinity = new k8s.V1NodeAffinity()
+ affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution =
+ new k8s.V1NodeSelector()
+ affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms =
+ [
+ {
+ matchExpressions: [
+ {
+ key: 'kubernetes.io/hostname',
+ operator: 'In',
+ values: [nodeName]
+ }
+ ]
+ }
+ ]
+ return affinity
+}
+
+async function getPreferredPodAffinity(
+ nodeName: string
+): Promise<k8s.V1Affinity> {
+ const affinity = new k8s.V1Affinity()
+ affinity.nodeAffinity = new k8s.V1NodeAffinity()
+
+ // 创建 PreferredSchedulingTerm 对象
+ const preferredTerm = new k8s.V1PreferredSchedulingTerm()
+ preferredTerm.weight = 1 // 设置权重（1-100）
+
+ // 创建 NodeSelectorTerm
+ preferredTerm.preference = new k8s.V1NodeSelectorTerm()
+ preferredTerm.preference.matchExpressions = [
+ {
+ key: 'kubernetes.io/hostname',
+ operator: 'In',
+ values: [nodeName]
+ }
+ ]
+
+ // 将 PreferredSchedulingTerm 添加到数组中
+ affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution = [
+ preferredTerm
+ ]
+
+ return affinity
+}
+
+export function namespace(): string {
+ Iif (process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE']) {
+ return process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE']
+ }
+
+ const context = kc.getContexts().find(ctx => ctx.namespace)
+ Iif (!context?.namespace) {
+ throw new Error(
+ 'Failed to determine namespace, falling back to `default`. Namespace should be set in context, or in env variable "ACTIONS_RUNNER_KUBERNETES_NAMESPACE"'
+ )
+ }
+ return context.namespace
+}
+
+class BackOffManager {
+ private backOffSeconds = 1
+ totalTime = 0
+ constructor(private throwAfterSeconds?: number) {
+ Iif (!throwAfterSeconds || throwAfterSeconds < 0) {
+ this.throwAfterSeconds = undefined
+ }
+ }
+
+ async backOff(): Promise<void> {
+ await new Promise(resolve =>
+ setTimeout(resolve, this.backOffSeconds * 1000)
+ )
+ this.totalTime += this.backOffSeconds
+ Iif (this.throwAfterSeconds && this.throwAfterSeconds < this.totalTime) {
+ throw new Error('backoff timeout')
+ }
+ Iif (this.backOffSeconds < 20) {
+ this.backOffSeconds *= 2
+ }
+ Iif (this.backOffSeconds > 20) {
+ this.backOffSeconds = 20
+ }
+ }
+}
+
+export function containerPorts(
+ container: ContainerInfo
+): k8s.V1ContainerPort[] {
+ const ports: k8s.V1ContainerPort[] = []
+ if (!container.portMappings?.length) {
+ return ports
+ }
+ for (const portDefinition of container.portMappings) {
+ const portProtoSplit = portDefinition.split('/')
+ Iif (portProtoSplit.length > 2) {
+ throw new Error(`Unexpected port format: ${portDefinition}`)
+ }
+
+ const port = new k8s.V1ContainerPort()
+ port.protocol =
+ portProtoSplit.length === 2 ? portProtoSplit[1].toUpperCase() : 'TCP'
+
+ const portSplit = portProtoSplit[0].split(':')
+ Iif (portSplit.length > 2) {
+ throw new Error('ports should have at most one ":" separator')
+ }
+
+ const parsePort = (p: string): number => {
+ const num = Number(p)
+ Iif (!Number.isInteger(num) || num < 1 || num > 65535) {
+ throw new Error(`invalid container port: ${p}`)
+ }
+ return num
+ }
+
+ if (portSplit.length === 1) {
+ port.containerPort = parsePort(portSplit[0])
+ } else {
+ port.hostPort = parsePort(portSplit[0])
+ port.containerPort = parsePort(portSplit[1])
+ }
+
+ ports.push(port)
+ }
+ return ports
+}
+
+export async function getPodByName(name): Promise<k8s.V1Pod> {
+ const { body } = await k8sApi.readNamespacedPod(name, namespace())
+ return body
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 +269 +270 +271 +272 +273 +274 +275 +276 +277 +278 +279 +280 +281 +282 +283 +284 +285 +286 +287 +288 +289 +290 +291 +292 +293 +294 +295 +296 +297 +298 +299 +300 +301 +302 | +1x +1x +1x + +1x +1x +1x +1x +1x + +1x +1x + +1x +1x + +1x +6x +3x +6x + +3x + + + + + + +3x +3x + + + + + + + + + + + + + + + + + + + + + + + + + + + +3x + + + +3x + + + + + + + + + + + + + + + + + +3x +3x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x +3x +3x +3x + + + + + + + + +1x + + + +1x +1x +1x +1x +1x +1x +1x + + + + + + + + + + + +1x +3x + + | import * as k8s from '@kubernetes/client-node'
+import * as fs from 'fs'
+import * as yaml from 'js-yaml'
+import * as core from '@actions/core'
+import { Mount } from 'hooklib'
+import * as path from 'path'
+import { v1 as uuidv4 } from 'uuid'
+import { POD_VOLUME_NAME } from './index'
+import { CONTAINER_EXTENSION_PREFIX } from '../hooks/constants'
+import * as shlex from 'shlex'
+
+export const DEFAULT_CONTAINER_ENTRY_POINT_ARGS = [`-f`, `/dev/null`]
+export const DEFAULT_CONTAINER_ENTRY_POINT = 'tail'
+
+export const ENV_HOOK_TEMPLATE_PATH = 'ACTIONS_RUNNER_CONTAINER_HOOK_TEMPLATE'
+export const ENV_USE_KUBE_SCHEDULER = 'ACTIONS_RUNNER_USE_KUBE_SCHEDULER'
+
+export function containerVolumes(
+ userMountVolumes: Mount[] = [],
+ IjobContainer = true,
+ containerAction = false
+): k8s.V1VolumeMount[] {
+ const mounts: k8s.V1VolumeMount[] = [
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/__w'
+ }
+ ]
+
+ const workspacePath = process.env.GITHUB_WORKSPACE as string
+ Iif (containerAction) {
+ const i = workspacePath.lastIndexOf('_work/')
+ const workspaceRelativePath = workspacePath.slice(i + '_work/'.length)
+ mounts.push(
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/github/workspace',
+ subPath: workspaceRelativePath
+ },
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/github/file_commands',
+ subPath: '_temp/_runner_file_commands'
+ },
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/github/home',
+ subPath: '_temp/_github_home'
+ },
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/github/workflow',
+ subPath: '_temp/_github_workflow'
+ }
+ )
+ return mounts
+ }
+
+ Iif (!jobContainer) {
+ return mounts
+ }
+
+ mounts.push(
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/__e',
+ subPath: 'externals'
+ },
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/github/home',
+ subPath: '_temp/_github_home'
+ },
+ {
+ name: POD_VOLUME_NAME,
+ mountPath: '/github/workflow',
+ subPath: '_temp/_github_workflow'
+ }
+ )
+
+ if (!userMountVolumes?.length) {
+ return mounts
+ }
+
+ for (const userVolume of userMountVolumes) {
+ let sourceVolumePath = ''
+ if (path.isAbsolute(userVolume.sourceVolumePath)) {
+ Iif (!userVolume.sourceVolumePath.startsWith(workspacePath)) {
+ throw new Error(
+ 'Volume mounts outside of the work folder are not supported'
+ )
+ }
+ // source volume path should be relative path
+ sourceVolumePath = userVolume.sourceVolumePath.slice(
+ workspacePath.length + 1
+ )
+ } else {
+ sourceVolumePath = userVolume.sourceVolumePath
+ }
+
+ mounts.push({
+ name: POD_VOLUME_NAME,
+ mountPath: userVolume.targetVolumePath,
+ subPath: sourceVolumePath,
+ readOnly: userVolume.readOnly
+ })
+ }
+
+ return mounts
+}
+
+export function writeEntryPointScript(
+ workingDirectory: string,
+ entryPoint: string,
+ entryPointArgs?: string[],
+ prependPath?: string[],
+ environmentVariables?: { [key: string]: string }
+): { containerPath: string; runnerPath: string } {
+ let exportPath = ''
+ Iif (prependPath?.length) {
+ // TODO: remove compatibility with typeof prependPath === 'string' as we bump to next major version, the hooks will lose PrependPath compat with runners 2.293.0 and older
+ const prepend =
+ typeof prependPath === 'string' ? prependPath : prependPath.join(':')
+ exportPath = `export PATH=${prepend}:$PATH`
+ }
+ let environmentPrefix = ''
+
+ Iif (environmentVariables && Object.entries(environmentVariables).length) {
+ const envBuffer: string[] = []
+ for (const [key, value] of Object.entries(environmentVariables)) {
+ Iif (
+ key.includes(`=`) ||
+ key.includes(`'`) ||
+ key.includes(`"`) ||
+ key.includes(`$`)
+ ) {
+ throw new Error(
+ `environment key ${key} is invalid - the key must not contain =, $, ', or "`
+ )
+ }
+ envBuffer.push(
+ `"${key}=${value
+ .replace(/\\/g, '\\\\')
+ .replace(/"/g, '\\"')
+ .replace(/\$/g, '\\$')
+ .replace(/`/g, '\\`')}"`
+ )
+ }
+ environmentPrefix = `env ${envBuffer.join(' ')} `
+ }
+
+ const content = `#!/bin/sh -l
+${exportPath}
+cd ${workingDirectory} && \
+exec ${environmentPrefix} ${entryPoint} ${
+ entryPointArgs?.length ? entryPointArgs.join(' ') : ''
+ }
+`
+ const filename = `${uuidv4()}.sh`
+ const entryPointPath = `${process.env.RUNNER_TEMP}/${filename}`
+ fs.writeFileSync(entryPointPath, content)
+ return {
+ containerPath: `/__w/_temp/${filename}`,
+ runnerPath: entryPointPath
+ }
+}
+
+export function generateContainerName(image: string): string {
+ const nameWithTag = image.split('/').pop()
+ const name = nameWithTag?.split(':').at(0)
+
+ Iif (!name) {
+ throw new Error(`Image definition '${image}' is invalid`)
+ }
+
+ return name
+}
+
+// Overwrite or append based on container options
+//
+// Keep in mind, envs and volumes could be passed as fields in container definition
+// so default volume mounts and envs are appended first, and then create options are used
+// to append more values
+//
+// Rest of the fields are just applied
+// For example, container.createOptions.container.image is going to overwrite container.image field
+export function mergeContainerWithOptions(
+ base: k8s.V1Container,
+ from: k8s.V1Container
+): void {
+ for (const [key, value] of Object.entries(from)) {
+ if (key === 'name') {
+ Iif (value !== CONTAINER_EXTENSION_PREFIX + base.name) {
+ core.warning("Skipping name override: name can't be overwritten")
+ }
+ continue
+ } else if (key === 'image') {
+ core.warning("Skipping image override: image can't be overwritten")
+ continue
+ } else if (key === 'env') {
+ const envs = value as k8s.V1EnvVar[]
+ base.env = mergeLists(base.env, envs)
+ } else if (key === 'volumeMounts' && value) {
+ const volumeMounts = value as k8s.V1VolumeMount[]
+ base.volumeMounts = mergeLists(base.volumeMounts, volumeMounts)
+ } else if (key === 'ports' && value) {
+ const ports = value as k8s.V1ContainerPort[]
+ base.ports = mergeLists(base.ports, ports)
+ } else {
+ base[key] = value
+ }
+ }
+}
+
+export function mergePodSpecWithOptions(
+ base: k8s.V1PodSpec,
+ from: k8s.V1PodSpec
+): void {
+ for (const [key, value] of Object.entries(from)) {
+ if (key === 'containers') {
+ base.containers.push(
+ ...from.containers.filter(
+ e => !e.name?.startsWith(CONTAINER_EXTENSION_PREFIX)
+ )
+ )
+ } else if (key === 'volumes' && value) {
+ const volumes = value as k8s.V1Volume[]
+ base.volumes = mergeLists(base.volumes, volumes)
+ } else {
+ base[key] = value
+ }
+ }
+}
+
+export function mergeObjectMeta(
+ base: { metadata?: k8s.V1ObjectMeta },
+ from: k8s.V1ObjectMeta
+): void {
+ Iif (!base.metadata?.labels || !base.metadata?.annotations) {
+ throw new Error(
+ "Can't merge metadata: base.metadata or base.annotations field is undefined"
+ )
+ }
+ Iif (from?.labels) {
+ for (const [key, value] of Object.entries(from.labels)) {
+ Iif (base.metadata?.labels?.[key]) {
+ core.warning(`Label ${key} is already defined and will be overwritten`)
+ }
+ base.metadata.labels[key] = value
+ }
+ }
+
+ Iif (from?.annotations) {
+ for (const [key, value] of Object.entries(from.annotations)) {
+ Iif (base.metadata?.annotations?.[key]) {
+ core.warning(
+ `Annotation ${key} is already defined and will be overwritten`
+ )
+ }
+ base.metadata.annotations[key] = value
+ }
+ }
+}
+
+export function readExtensionFromFile(): k8s.V1PodTemplateSpec | undefined {
+ const filePath = process.env[ENV_HOOK_TEMPLATE_PATH]
+ if (!filePath) {
+ return undefined
+ }
+ const doc = yaml.load(fs.readFileSync(filePath, 'utf8'))
+ Iif (!doc || typeof doc !== 'object') {
+ throw new Error(`Failed to parse ${filePath}`)
+ }
+ return doc as k8s.V1PodTemplateSpec
+}
+
+export function useKubeScheduler(): boolean {
+ return process.env[ENV_USE_KUBE_SCHEDULER] === 'true'
+}
+
+export enum PodPhase {
+ PENDING = 'Pending',
+ RUNNING = 'Running',
+ SUCCEEDED = 'Succeeded',
+ FAILED = 'Failed',
+ UNKNOWN = 'Unknown',
+ COMPLETED = 'Completed'
+}
+
+function mergeLists<T>(base?: T[], from?: T[]): T[] {
+ const b: T[] = base || []
+ Iif (!from?.length) {
+ return b
+ }
+ b.push(...from)
+ return b
+}
+
+export function fixArgs(args: string[]): string[] {
+ return shlex.split(args.join(' '))
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| test-setup.ts | +
+
+ |
+ 29.57% | +21/71 | +0% | +0/3 | +5.55% | +1/18 | +28.57% | +20/70 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 | 1x +1x + +1x +1x + +1x + +1x + +1x +1x + +1x + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + +1x + + + + +1x + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + + + + + + +1x + + + + + + + + + + + +1x + + + + + + + + + + + + +1x + | import * as k8s from '@kubernetes/client-node'
+import * as fs from 'fs'
+import { HookData } from 'hooklib/lib'
+import * as path from 'path'
+import { v4 as uuidv4 } from 'uuid'
+
+const kc = new k8s.KubeConfig()
+
+kc.loadFromDefault()
+
+const k8sApi = kc.makeApiClient(k8s.CoreV1Api)
+const k8sStorageApi = kc.makeApiClient(k8s.StorageV1Api)
+
+export class TestHelper {
+ private tempDirPath: string
+ private podName: string
+ constructor() {
+ this.tempDirPath = `${__dirname}/_temp/runner`
+ this.podName = uuidv4().replace(/-/g, '')
+ }
+
+ public async initialize(): Promise<void> {
+ process.env['ACTIONS_RUNNER_POD_NAME'] = `${this.podName}`
+ process.env['RUNNER_WORKSPACE'] = `${this.tempDirPath}/_work/repo`
+ process.env['RUNNER_TEMP'] = `${this.tempDirPath}/_work/_temp`
+ process.env['GITHUB_WORKSPACE'] = `${this.tempDirPath}/_work/repo/repo`
+ process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE'] = 'default'
+
+ fs.mkdirSync(`${this.tempDirPath}/_work/repo/repo`, { recursive: true })
+ fs.mkdirSync(`${this.tempDirPath}/externals`, { recursive: true })
+ fs.mkdirSync(process.env.RUNNER_TEMP, { recursive: true })
+
+ fs.copyFileSync(
+ path.resolve(`${__dirname}/../../../examples/example-script.sh`),
+ `${process.env.RUNNER_TEMP}/example-script.sh`
+ )
+
+ await this.cleanupK8sResources()
+ try {
+ await this.createTestVolume()
+ await this.createTestJobPod()
+ } catch (e) {
+ console.log(e)
+ }
+ }
+
+ public async cleanup(): Promise<void> {
+ try {
+ await this.cleanupK8sResources()
+ fs.rmSync(this.tempDirPath, { recursive: true })
+ } catch {}
+ }
+ public async cleanupK8sResources() {
+ await k8sApi
+ .deleteNamespacedPersistentVolumeClaim(
+ `${this.podName}-work`,
+ 'default',
+ undefined,
+ undefined,
+ 0
+ )
+ .catch(e => {})
+ await k8sApi.deletePersistentVolume(`${this.podName}-pv`).catch(e => {})
+ await k8sStorageApi.deleteStorageClass('local-storage').catch(e => {})
+ await k8sApi
+ .deleteNamespacedPod(this.podName, 'default', undefined, undefined, 0)
+ .catch(e => {})
+ await k8sApi
+ .deleteNamespacedPod(
+ `${this.podName}-workflow`,
+ 'default',
+ undefined,
+ undefined,
+ 0
+ )
+ .catch(e => {})
+ }
+ public createFile(fileName?: string): string {
+ const filePath = `${this.tempDirPath}/${fileName || uuidv4()}`
+ fs.writeFileSync(filePath, '')
+ return filePath
+ }
+
+ public removeFile(fileName: string): void {
+ const filePath = `${this.tempDirPath}/${fileName}`
+ fs.rmSync(filePath)
+ }
+
+ public async createTestJobPod() {
+ const container = {
+ name: 'nginx',
+ image: 'nginx:latest',
+ imagePullPolicy: 'IfNotPresent'
+ } as k8s.V1Container
+
+ const pod: k8s.V1Pod = {
+ metadata: {
+ name: this.podName
+ },
+ spec: {
+ restartPolicy: 'Never',
+ containers: [container]
+ }
+ } as k8s.V1Pod
+ await k8sApi.createNamespacedPod('default', pod)
+ }
+
+ public async createTestVolume() {
+ var sc: k8s.V1StorageClass = {
+ metadata: {
+ name: 'local-storage'
+ },
+ provisioner: 'kubernetes.io/no-provisioner',
+ volumeBindingMode: 'Immediate'
+ }
+ await k8sStorageApi.createStorageClass(sc)
+
+ var volume: k8s.V1PersistentVolume = {
+ metadata: {
+ name: `${this.podName}-pv`
+ },
+ spec: {
+ storageClassName: 'local-storage',
+ capacity: {
+ storage: '2Gi'
+ },
+ volumeMode: 'Filesystem',
+ accessModes: ['ReadWriteOnce'],
+ hostPath: {
+ path: `${this.tempDirPath}/_work`
+ }
+ }
+ }
+ await k8sApi.createPersistentVolume(volume)
+ var volumeClaim: k8s.V1PersistentVolumeClaim = {
+ metadata: {
+ name: `${this.podName}-work`
+ },
+ spec: {
+ accessModes: ['ReadWriteOnce'],
+ volumeMode: 'Filesystem',
+ storageClassName: 'local-storage',
+ volumeName: `${this.podName}-pv`,
+ resources: {
+ requests: {
+ storage: '1Gi'
+ }
+ }
+ }
+ }
+ await k8sApi.createNamespacedPersistentVolumeClaim('default', volumeClaim)
+ }
+
+ public getPrepareJobDefinition(): HookData {
+ const prepareJob = JSON.parse(
+ fs.readFileSync(
+ path.resolve(__dirname + '/../../../examples/prepare-job.json'),
+ 'utf8'
+ )
+ )
+
+ prepareJob.args.container.userMountVolumes = undefined
+ prepareJob.args.container.registry = null
+ prepareJob.args.services.forEach(s => {
+ s.registry = null
+ })
+
+ return prepareJob
+ }
+
+ public getRunScriptStepDefinition(): HookData {
+ const runScriptStep = JSON.parse(
+ fs.readFileSync(
+ path.resolve(__dirname + '/../../../examples/run-script-step.json'),
+ 'utf8'
+ )
+ )
+
+ runScriptStep.args.entryPointArgs[1] = `/__w/_temp/example-script.sh`
+ return runScriptStep
+ }
+
+ public getRunContainerStepDefinition(): HookData {
+ const runContainerStep = JSON.parse(
+ fs.readFileSync(
+ path.resolve(__dirname + '/../../../examples/run-container-step.json'),
+ 'utf8'
+ )
+ )
+
+ runContainerStep.args.entryPointArgs[1] = `/__w/_temp/example-script.sh`
+ runContainerStep.args.userMountVolumes = undefined
+ runContainerStep.args.registry = null
+ return runContainerStep
+ }
+}
+ |