| 1 | // End-to-end: a real `wrangler dev` Worker, the real git CLI and the real runner agent. |
| 2 | // |
| 3 | // pnpm --filter @diffinery/runner build && pnpm --filter @diffinery/app e2e |
| 4 | // |
| 5 | // Covers: token auth, repo creation, git push/clone/fetch (protocol v2), push |
| 6 | // protection, workflows triggered by push and pull_request and executed by a |
| 7 | // self-hosted runner (the same agent that runs in Cloudflare Containers), |
| 8 | // check runs, branch protection with required checks and human review for |
| 9 | // agent-authored PRs, merging, the REST contents API, the MCP server and |
| 10 | // profile pictures (WASM image processing in the Worker). |
| 11 | import { spawn, spawnSync, execFileSync } from "node:child_process"; |
| 12 | import { mkdtempSync, writeFileSync, mkdirSync, readFileSync, existsSync, rmSync } from "node:fs"; |
| 13 | import { tmpdir } from "node:os"; |
| 14 | import { randomBytes } from "node:crypto"; |
| 15 | import { join, dirname, resolve } from "node:path"; |
| 16 | import { fileURLToPath } from "node:url"; |
| 17 | import { createServer } from "node:net"; |
| 18 | import { crc32, deflateSync } from "node:zlib"; |
| 19 | import { test, before, after } from "node:test"; |
| 20 | import assert from "node:assert/strict"; |
| 21 | import { fakeGitHub, lfsObject } from "./fake-github.mjs"; |
| 22 | |
| 23 | const APP = resolve(dirname(fileURLToPath(import.meta.url)), "../.."); |
| 24 | const AGENT = resolve(APP, "../../containers/runner/dist/agent.mjs"); |
| 25 | const work = mkdtempSync(join(tmpdir(), "diffinery-e2e-")); |
| 26 | let base; |
| 27 | let dev; |
| 28 | let devLog = ""; |
| 29 | let token; |
| 30 | let agentToken; |
| 31 | |
| 32 | const freePort = () => |
| 33 | new Promise((res) => { |
| 34 | const s = createServer(); |
| 35 | s.listen(0, "127.0.0.1", () => { |
| 36 | const { port } = s.address(); |
| 37 | s.close(() => res(port)); |
| 38 | }); |
| 39 | }); |
| 40 | |
| 41 | async function api(method, path, body, tok = token) { |
| 42 | const res = await fetch(`${base}/api/v3${path}`, { |
| 43 | method, |
| 44 | headers: { ...(tok === null ? {} : { authorization: `Bearer ${tok}` }), "content-type": "application/json" }, |
| 45 | body: body === undefined ? undefined : JSON.stringify(body), |
| 46 | }); |
| 47 | const text = await res.text(); |
| 48 | let json = null; |
| 49 | try { |
| 50 | json = text ? JSON.parse(text) : null; |
| 51 | } catch { |
| 52 | json = text; |
| 53 | } |
| 54 | return { status: res.status, json }; |
| 55 | } |
| 56 | async function ok(method, path, body, tok) { |
| 57 | const r = await api(method, path, body, tok); |
| 58 | assert.ok(r.status >= 200 && r.status < 300, `${method} ${path} -> ${r.status} ${JSON.stringify(r.json)}`); |
| 59 | return r.json; |
| 60 | } |
| 61 | |
| 62 | function git(cwd, args, tok = token, opts = {}) { |
| 63 | const auth = Buffer.from(`x-token:${tok}`).toString("base64"); |
| 64 | return execFileSync("git", ["-c", `http.extraHeader=Authorization: Basic ${auth}`, "-c", "protocol.version=2", ...args], { |
| 65 | cwd, |
| 66 | encoding: "utf8", |
| 67 | stdio: ["ignore", "pipe", "pipe"], |
| 68 | env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_AUTHOR_NAME: "E2E", GIT_AUTHOR_EMAIL: "e2e@example.com", GIT_COMMITTER_NAME: "E2E", GIT_COMMITTER_EMAIL: "e2e@example.com" }, |
| 69 | ...opts, |
| 70 | }); |
| 71 | } |
| 72 | function gitFails(cwd, args, tok) { |
| 73 | try { |
| 74 | git(cwd, args, tok); |
| 75 | } catch (e) { |
| 76 | return `${e.stdout ?? ""}${e.stderr ?? ""}`; |
| 77 | } |
| 78 | assert.fail(`expected git ${args.join(" ")} to fail`); |
| 79 | } |
| 80 | |
| 81 | const sleep = (ms) => new Promise((r) => setTimeout(r, ms)); |
| 82 | async function until(what, fn, timeoutMs = 60_000) { |
| 83 | const end = Date.now() + timeoutMs; |
| 84 | let last; |
| 85 | while (Date.now() < end) { |
| 86 | last = await fn(); |
| 87 | if (last) return last; |
| 88 | await sleep(500); |
| 89 | } |
| 90 | assert.fail(`timed out waiting for ${what}\n--- wrangler log tail ---\n${devLog.slice(-4000)}`); |
| 91 | } |
| 92 | |
| 93 | function spawnAsync(cmd, args, env, timeoutMs) { |
| 94 | return new Promise((done) => { |
| 95 | const child = spawn(cmd, args, { env: { ...process.env, ...env } }); |
| 96 | let stdout = ""; |
| 97 | let stderr = ""; |
| 98 | child.stdout.on("data", (d) => (stdout += d)); |
| 99 | child.stderr.on("data", (d) => (stderr += d)); |
| 100 | const t = setTimeout(() => child.kill("SIGKILL"), timeoutMs); |
| 101 | child.on("close", (status) => { |
| 102 | clearTimeout(t); |
| 103 | done({ status, stdout, stderr }); |
| 104 | }); |
| 105 | }); |
| 106 | } |
| 107 | |
| 108 | /** |
| 109 | * Claim one waiting self-hosted job and run it with the real agent. |
| 110 | * `envFor(claim)` adds environment for the agent (e.g. HOME, DIFFINERY_DISABLE_BUILTINS). |
| 111 | */ |
| 112 | async function runOneJob(owner, repo, { allowFailure = false, envFor = () => ({}), timeoutMs = 180_000, labels = ["linux"] } = {}) { |
| 113 | const claim = await until("a job to claim", async () => { |
| 114 | const r = await api("POST", `/repos/${owner}/${repo}/actions/runners/claim`, { name: "e2e", labels }); |
| 115 | return r.status === 200 ? r.json : null; |
| 116 | }); |
| 117 | const jobEnv = { ...envFor(claim), DIFFINERY_API_URL: claim.api_url, DIFFINERY_JOB_ID: claim.job_id, DIFFINERY_JOB_TOKEN: claim.token }; |
| 118 | // E2E_RUNNER_IMAGE runs the job inside the real runner image instead of the local agent bundle. |
| 119 | const image = process.env.E2E_RUNNER_IMAGE; |
| 120 | // Spawned asynchronously: a blocked event loop leaves undici holding keep-alive sockets the server already closed. |
| 121 | const r = image |
| 122 | ? await spawnAsync("docker", ["run", "--rm", "--network", "host", ...Object.entries(jobEnv).flatMap(([k, v]) => ["-e", `${k}=${v}`]), image], {}, timeoutMs + 120_000) |
| 123 | : await spawnAsync(process.execPath, [AGENT], { ...process.env, ...jobEnv, DIFFINERY_WORK_ROOT: join(work, `job-${claim.job_id}`) }, timeoutMs); |
| 124 | const out = `${r.stdout}${r.stderr}`; |
| 125 | if (r.status !== 0 && !allowFailure) { |
| 126 | const log = await fetch(`${base}/api/v3/repos/${owner}/${repo}/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } }).then((x) => x.text(), (e) => String(e)); |
| 127 | const job = await api("GET", `/repos/${owner}/${repo}/actions/jobs/${claim.job_id}`).catch((e) => ({ json: String(e) })); |
| 128 | assert.fail(`runner agent exited ${r.status}:\n${out}\n--- job ---\n${JSON.stringify(job.json, null, 2)}\n--- job log ---\n${log}\n--- wrangler log tail ---\n${devLog.slice(-3000)}`); |
| 129 | } |
| 130 | return { claim, out }; |
| 131 | } |
| 132 | |
| 133 | before(async () => { |
| 134 | assert.ok(existsSync(AGENT), `build the runner first: pnpm --filter @diffinery/runner build (missing ${AGENT})`); |
| 135 | const port = await freePort(); |
| 136 | base = `http://127.0.0.1:${port}`; |
| 137 | const persist = join(work, "state"); |
| 138 | execFileSync("pnpm", ["exec", "wrangler", "d1", "migrations", "apply", "diffinery-dev", "--local", "-e", "dev", "--persist-to", persist], { cwd: APP, stdio: "pipe", env: { ...process.env, CI: "1" } }); |
| 139 | // Until the web UI exists, run the same app through the API-only entry. |
| 140 | const entry = existsSync(join(APP, "src/web/routes.tsx")) ? [] : ["test/e2e/entry.ts"]; |
| 141 | dev = spawn("pnpm", ["exec", "wrangler", "dev", ...entry, "-e", "dev", "--ip", "127.0.0.1", "--port", String(port), "--inspector-port", String(await freePort()), "--persist-to", persist, "--var", `PUBLIC_URL:${base}`, "--var", `MASTER_KEY:${randomBytes(32).toString("base64")}`, "--var", "SCHEDULE_TICK_MINUTES:1", "--show-interactive-dev-session=false"], { |
| 142 | cwd: APP, |
| 143 | env: { ...process.env, CI: "1", WRANGLER_SEND_METRICS: "false" }, |
| 144 | stdio: ["ignore", "pipe", "pipe"], |
| 145 | detached: true, |
| 146 | }); |
| 147 | dev.stdout.on("data", (d) => (devLog += d)); |
| 148 | dev.stderr.on("data", (d) => (devLog += d)); |
| 149 | await until("wrangler dev", async () => { |
| 150 | try { |
| 151 | return (await fetch(`${base}/healthz`)).ok; |
| 152 | } catch { |
| 153 | return false; |
| 154 | } |
| 155 | }, 120_000); |
| 156 | // DEV_AUTH signs requests without credentials in as dev@diffinery.local; mint a real token for everything else. |
| 157 | const res = await fetch(`${base}/api/v3/diffinery/tokens`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "e2e", scopes: ["admin"] }) }); |
| 158 | assert.equal(res.status, 201, await res.clone().text()); |
| 159 | token = (await res.json()).token; |
| 160 | }); |
| 161 | |
| 162 | after(() => { |
| 163 | if (dev?.pid) { |
| 164 | try { |
| 165 | process.kill(-dev.pid, "SIGTERM"); |
| 166 | } catch {} |
| 167 | } |
| 168 | if (process.env.E2E_KEEP !== "1") rmSync(work, { recursive: true, force: true }); |
| 169 | }); |
| 170 | |
| 171 | // Scheduled workflows: the dev environment has no cron trigger, like a deploy whose cron trigger |
| 172 | // hasn't been applied yet, so schedules must fire from the scheduler's own alarm. The schedule is |
| 173 | // registered first and checked by the last test, so its ticks (1 minute here) come while the rest runs. |
| 174 | let tickRepo; |
| 175 | test("scheduled workflows: a push to the default branch registers the schedule", async () => { |
| 176 | const me = await ok("GET", "/user"); |
| 177 | tickRepo = `${me.login}/schedules`; |
| 178 | await ok("POST", "/user/repos", { name: "schedules" }); |
| 179 | const src = join(work, "schedules"); |
| 180 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 181 | writeFileSync(join(src, ".github/workflows/tick.yml"), `on:\n schedule:\n - cron: "* * * * *"\njobs:\n tick:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo tick\n`); |
| 182 | git(src, ["init", "-q", "-b", "main"]); |
| 183 | git(src, ["add", "-A"]); |
| 184 | git(src, ["commit", "-q", "-m", "schedule"]); |
| 185 | git(src, ["push", "-q", `${base}/${tickRepo}.git`, "main"]); |
| 186 | }); |
| 187 | |
| 188 | test("git hosting, Actions, protected PR flow and MCP", async () => { |
| 189 | const me = await ok("GET", "/user"); |
| 190 | const owner = me.login; |
| 191 | assert.ok(me.site_admin, "dev user is a bootstrap admin"); |
| 192 | |
| 193 | // ------------------------------------------------------------ repo + first push |
| 194 | const repo = await ok("POST", "/user/repos", { name: "demo", description: "e2e" }); |
| 195 | assert.equal(repo.full_name, `${owner}/demo`); |
| 196 | const src = join(work, "src"); |
| 197 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 198 | writeFileSync(join(src, "README.md"), "# demo\n"); |
| 199 | writeFileSync(join(src, "app.txt"), "one\ntwo\nthree\n"); |
| 200 | writeFileSync( |
| 201 | join(src, ".github/workflows/ci.yml"), |
| 202 | `name: CI |
| 203 | on: |
| 204 | push: |
| 205 | branches: [main] |
| 206 | pull_request: |
| 207 | jobs: |
| 208 | build: |
| 209 | runs-on: [self-hosted, linux] |
| 210 | steps: |
| 211 | - uses: actions/checkout@v4 |
| 212 | - name: Check files |
| 213 | run: | |
| 214 | test -f README.md |
| 215 | echo "event=\${{ github.event_name }} sha=\${{ github.sha }}" |
| 216 | grep -q bad app.txt && { echo "found bad line"; exit 1; } || true |
| 217 | - id: out |
| 218 | run: echo "lines=$(wc -l < app.txt | tr -d ' ')" >> "$GITHUB_OUTPUT" |
| 219 | - run: echo "app.txt has \${{ steps.out.outputs.lines }} lines" |
| 220 | `, |
| 221 | ); |
| 222 | git(src, ["init", "-q", "-b", "main"]); |
| 223 | git(src, ["add", "-A"]); |
| 224 | git(src, ["commit", "-q", "-m", "initial"]); |
| 225 | git(src, ["remote", "add", "origin", `${base}/${owner}/demo.git`]); |
| 226 | git(src, ["push", "-q", "origin", "main"]); |
| 227 | const mainSha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 228 | |
| 229 | const branch = await ok("GET", `/repos/${owner}/demo/branches/main`); |
| 230 | assert.equal(branch.commit.sha, mainSha); |
| 231 | |
| 232 | // ------------------------------------------------------------ the push ran CI on a self-hosted runner |
| 233 | const pushRun = await until("push run", async () => (await ok("GET", `/repos/${owner}/demo/actions/runs?event=push`)).workflow_runs[0]); |
| 234 | assert.equal(pushRun.head_sha, mainSha); |
| 235 | const job1 = await runOneJob(owner, "demo"); |
| 236 | const finished = await until("push run to complete", async () => { |
| 237 | const r = await ok("GET", `/repos/${owner}/demo/actions/runs/${pushRun.id}`); |
| 238 | return r.status === "completed" ? r : null; |
| 239 | }); |
| 240 | assert.equal(finished.conclusion, "success", job1.out); |
| 241 | const logs = await (await fetch(`${base}/api/v3/repos/${owner}/demo/actions/jobs/${job1.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 242 | assert.match(logs, /event=push/); |
| 243 | assert.match(logs, /app\.txt has 3 lines/); |
| 244 | const checks = await ok("GET", `/repos/${owner}/demo/commits/${mainSha}/check-runs`); |
| 245 | assert.equal(checks.check_runs.find((c) => c.name === "CI / build")?.conclusion, "success"); |
| 246 | |
| 247 | // ------------------------------------------------------------ clone over protocol v2 |
| 248 | const clone = join(work, "clone"); |
| 249 | git(work, ["clone", "-q", `${base}/${owner}/demo.git`, clone]); |
| 250 | assert.equal(readFileSync(join(clone, "app.txt"), "utf8"), "one\ntwo\nthree\n"); |
| 251 | |
| 252 | // ------------------------------------------------------------ secrets are blocked on push |
| 253 | // The key below is a fake that push protection must block in the pushed file; this |
| 254 | // marker exempts only the test source itself: diffinery:allow-secret |
| 255 | writeFileSync(join(clone, "config.env"), "AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPL3\n"); |
| 256 | git(clone, ["add", "-A"]); |
| 257 | git(clone, ["commit", "-q", "-m", "oops"]); |
| 258 | assert.match(gitFails(clone, ["push", "origin", "main"]), /secret|AWS/i); |
| 259 | // Objects from a blocked push are not kept, so retrying (even with push negotiation) is blocked too. |
| 260 | assert.match(gitFails(clone, ["-c", "push.negotiate=true", "push", "origin", "HEAD:refs/heads/fixture"]), /secret|AWS/i); |
| 261 | // A repository admin can push anyway by giving a reason; the bypass is audited. |
| 262 | assert.match(gitFails(clone, ["push", "-o", "allow-secrets=", "origin", "HEAD:refs/heads/fixture"]), /secret|AWS/i); |
| 263 | git(clone, ["push", "-q", "-o", "allow-secrets=fake key used by this test", "origin", "HEAD:refs/heads/fixture"]); |
| 264 | assert.ok((await ok("GET", `/repos/${owner}/demo/branches`)).some((b) => b.name === "fixture")); |
| 265 | git(clone, ["push", "-q", "origin", ":refs/heads/fixture"]); |
| 266 | git(clone, ["reset", "-q", "--hard", "origin/main"]); |
| 267 | |
| 268 | // ------------------------------------------------------------ protect main: PR + green CI + review |
| 269 | await ok("PUT", `/repos/${owner}/demo/branches/main/protection`, { |
| 270 | requirePullRequest: true, |
| 271 | requiredApprovals: 0, |
| 272 | dismissStaleReviews: true, |
| 273 | requiredChecks: ["CI / build"], |
| 274 | allowForcePush: false, |
| 275 | allowDeletion: false, |
| 276 | requireLinearHistory: false, |
| 277 | enforceAdmins: true, |
| 278 | agentsMayPush: false, |
| 279 | agentsMayMerge: false, |
| 280 | }); |
| 281 | writeFileSync(join(clone, "app.txt"), "one\ntwo\nthree\nfour\n"); |
| 282 | git(clone, ["commit", "-q", "-am", "direct push"]); |
| 283 | assert.match(gitFails(clone, ["push", "origin", "main"]), /pull request|protected/i); |
| 284 | git(clone, ["reset", "-q", "--hard", "origin/main"]); |
| 285 | |
| 286 | // ------------------------------------------------------------ an AI agent opens a PR |
| 287 | const created = await ok("POST", "/diffinery/agents", { login: "e2e-bot", name: "E2E Bot" }, null); |
| 288 | agentToken = created.token.token; |
| 289 | const agentClone = join(work, "agent"); |
| 290 | git(work, ["clone", "-q", `${base}/${owner}/demo.git`, agentClone], agentToken); |
| 291 | git(agentClone, ["checkout", "-q", "-b", "feature"], agentToken); |
| 292 | writeFileSync(join(agentClone, "app.txt"), "one\ntwo\nthree\nfour\n"); |
| 293 | git(agentClone, ["commit", "-q", "-am", "Add a fourth line"], agentToken); |
| 294 | assert.match(gitFails(agentClone, ["push", "origin", "HEAD:main"], agentToken), /agent|protected|pull request/i); |
| 295 | // push.negotiate=true makes git run a protocol v2 fetch with wait-for-done before pushing. |
| 296 | const negotiated = spawnSync("git", ["-c", `http.extraHeader=Authorization: Basic ${Buffer.from(`x-token:${agentToken}`).toString("base64")}`, "-c", "protocol.version=2", "-c", "push.negotiate=true", "push", "-q", "origin", "feature"], { cwd: agentClone, encoding: "utf8", env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } }); |
| 297 | assert.equal(negotiated.status, 0, negotiated.stderr); |
| 298 | assert.doesNotMatch(negotiated.stderr, /negotiation failed|unexpected/i); |
| 299 | const pr = await ok("POST", `/repos/${owner}/demo/pulls`, { title: "Add a fourth line", head: "feature", base: "main", intent: "Extend app.txt for the e2e test" }, agentToken); |
| 300 | assert.equal(pr.number, 1); |
| 301 | |
| 302 | // The pull_request run executes; until then the PR is blocked on the required check. |
| 303 | let m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 304 | assert.equal(m.mergeable, false); |
| 305 | await runOneJob(owner, "demo"); |
| 306 | await until("PR check to pass", async () => { |
| 307 | const r = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 308 | return r.checks?.length > 0 && r.checks.every((c) => c.state === "success") ? r : null; |
| 309 | }); |
| 310 | m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 311 | assert.equal(m.mergeable, false, "agent-authored PRs need a human approval"); |
| 312 | assert.ok(JSON.stringify(m.blockers).match(/approv|human/i), JSON.stringify(m.blockers)); |
| 313 | |
| 314 | // The agent cannot approve or merge its own work. |
| 315 | const agentMerge = await api("PUT", `/repos/${owner}/demo/pulls/1/merge`, { merge_method: "squash" }, agentToken); |
| 316 | assert.ok([403, 405, 409].includes(agentMerge.status), JSON.stringify(agentMerge)); |
| 317 | |
| 318 | // Another agent's approval is advisory and does not unblock the merge. |
| 319 | const reviewer = (await ok("POST", "/diffinery/agents", { login: "e2e-reviewer" }, null)).token.token; |
| 320 | await ok("POST", `/repos/${owner}/demo/pulls/1/reviews`, { event: "APPROVE", body: "bot says ok" }, reviewer); |
| 321 | assert.equal((await ok("GET", `/repos/${owner}/demo/pulls/1/merge`)).mergeable, false); |
| 322 | |
| 323 | // A human reviews (line comment + approval) and merges. |
| 324 | await ok("POST", `/repos/${owner}/demo/pulls/1/reviews`, { event: "APPROVE", body: "LGTM", comments: [{ path: "app.txt", line: 4, body: "nice line" }] }); |
| 325 | m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 326 | assert.equal(m.mergeable, true, JSON.stringify(m)); |
| 327 | const merged = await ok("PUT", `/repos/${owner}/demo/pulls/1/merge`, { merge_method: "squash", delete_branch: true }); |
| 328 | assert.ok(merged.sha); |
| 329 | const prAfter = await ok("GET", `/repos/${owner}/demo/pulls/1`); |
| 330 | assert.equal(prAfter.merged, true); |
| 331 | |
| 332 | // ------------------------------------------------------------ fetch the merge, read through REST |
| 333 | git(clone, ["pull", "-q", "--ff-only", "origin", "main"]); |
| 334 | assert.equal(readFileSync(join(clone, "app.txt"), "utf8"), "one\ntwo\nthree\nfour\n"); |
| 335 | const content = await ok("GET", `/repos/${owner}/demo/contents/app.txt`); |
| 336 | assert.equal(Buffer.from(content.content, "base64").toString(), "one\ntwo\nthree\nfour\n"); |
| 337 | const branches = await ok("GET", `/repos/${owner}/demo/branches`); |
| 338 | assert.ok(!branches.some((b) => b.name === "feature"), "head branch deleted after merge"); |
| 339 | |
| 340 | // ------------------------------------------------------------ shallow clone, then deepen |
| 341 | const shallow = join(work, "shallow"); |
| 342 | git(work, ["clone", "-q", "--depth", "1", `${base}/${owner}/demo.git`, shallow]); |
| 343 | assert.equal(git(shallow, ["rev-list", "--count", "HEAD"]).trim(), "1"); |
| 344 | assert.equal(readFileSync(join(shallow, "app.txt"), "utf8"), "one\ntwo\nthree\nfour\n"); |
| 345 | git(shallow, ["fetch", "-q", "--unshallow"]); |
| 346 | assert.equal(git(shallow, ["rev-list", "--count", "HEAD"]).trim(), "2"); |
| 347 | git(shallow, ["fsck", "--no-progress"]); |
| 348 | |
| 349 | // ------------------------------------------------------------ MCP: the agent works without git |
| 350 | const rpc = async (method, params, id = 1) => { |
| 351 | const r = await fetch(`${base}/mcp`, { method: "POST", headers: { authorization: `Bearer ${agentToken}`, "content-type": "application/json", accept: "application/json, text/event-stream" }, body: JSON.stringify({ jsonrpc: "2.0", id, method, params }) }); |
| 352 | assert.equal(r.status, 200); |
| 353 | return (await r.json()).result; |
| 354 | }; |
| 355 | const init = await rpc("initialize", { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "e2e", version: "1" } }); |
| 356 | assert.equal(init.serverInfo.name, "diffinery"); |
| 357 | const tools = await rpc("tools/list", {}); |
| 358 | assert.ok(tools.tools.some((t) => t.name === "commit_files")); |
| 359 | const file = await rpc("tools/call", { name: "get_file", arguments: { owner, repo: "demo", path: "README.md" } }); |
| 360 | assert.equal(file.isError, false); |
| 361 | assert.equal(file.structuredContent.content, "# demo\n"); |
| 362 | const commit = await rpc("tools/call", { name: "commit_files", arguments: { owner, repo: "demo", branch: "mcp-change", create_branch_from: "main", message: "Edit via MCP", files: [{ path: "docs/notes.md", content: "hello\n" }] } }); |
| 363 | assert.equal(commit.isError, false, JSON.stringify(commit)); |
| 364 | const blocked = await rpc("tools/call", { name: "commit_files", arguments: { owner, repo: "demo", branch: "main", message: "sneaky", files: [{ path: "x", content: "y" }] } }); |
| 365 | assert.equal(blocked.isError, true); |
| 366 | const opened = await rpc("tools/call", { name: "create_pull_request", arguments: { owner, repo: "demo", title: "Notes", head: "mcp-change", intent: "Add notes" } }); |
| 367 | assert.equal(opened.isError, false, JSON.stringify(opened)); |
| 368 | assert.equal(opened.structuredContent.number, 2); |
| 369 | |
| 370 | // ------------------------------------------------------------ web UI renders the same data (signed in via DEV_AUTH) |
| 371 | for (const path of ["/", `/${owner}`, `/${owner}/demo`, `/${owner}/demo/blob/main/app.txt`, `/${owner}/demo/commits/main`, `/${owner}/demo/pulls`, `/${owner}/demo/pull/1`, `/${owner}/demo/pull/1/files`, `/${owner}/demo/actions`, `/${owner}/demo/actions/runs/${pushRun.id}`, `/${owner}/demo/actions/runs/${pushRun.id}/job/${job1.claim.job_id}`, `/${owner}/demo/settings/branches`, "/settings/tokens"]) { |
| 372 | const res = await fetch(`${base}${path}`); |
| 373 | const html = await res.text(); |
| 374 | assert.equal(res.status, 200, `${path} -> ${res.status}\n${html.slice(0, 500)}`); |
| 375 | assert.match(res.headers.get("content-type") ?? "", /text\/html/, path); |
| 376 | } |
| 377 | assert.match(await (await fetch(`${base}/${owner}/demo/pull/1`)).text(), /Add a fourth line/); |
| 378 | const forged = await fetch(`${base}/${owner}/demo/issues/1/comment`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", origin: "https://evil.example", "sec-fetch-site": "cross-site" }, body: "body=hi" }); |
| 379 | assert.equal(forged.status, 403); |
| 380 | |
| 381 | // ------------------------------------------------------------ the CLI against the same server |
| 382 | const CLI = resolve(APP, "../cli/dist/diffinery.mjs"); |
| 383 | if (existsSync(CLI)) { |
| 384 | const cli = (...args) => execFileSync(process.execPath, [CLI, ...args], { encoding: "utf8", cwd: clone, env: { ...process.env, DIFFINERY_URL: base, DIFFINERY_TOKEN: token, NO_COLOR: "1", XDG_CONFIG_HOME: join(work, "cfg") } }); |
| 385 | assert.match(cli("whoami"), new RegExp(owner)); |
| 386 | const prs = JSON.parse(cli("pr", "list", "--state", "all", "--json")); |
| 387 | assert.ok(prs.some((p) => p.number === 1)); |
| 388 | assert.match(cli("workflow", "validate"), /ci\.yml/); |
| 389 | } |
| 390 | |
| 391 | // The commit made through MCP carries the agent's identity. |
| 392 | const agentCommit = await ok("GET", `/repos/${owner}/demo/commits/mcp-change`); |
| 393 | assert.match(JSON.stringify(agentCommit), /e2e-bot/); |
| 394 | }); |
| 395 | |
| 396 | test("reusable workflows: inputs, secrets, outputs, nesting and skipped calls", async () => { |
| 397 | const owner = (await ok("GET", "/user")).login; |
| 398 | await ok("POST", "/user/repos", { name: "reuse" }); |
| 399 | await api("PUT", `/repos/${owner}/reuse/actions/secrets/TOPSECRET`, { value: "s3cret" }); |
| 400 | const src = join(work, "reuse"); |
| 401 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 402 | writeFileSync( |
| 403 | join(src, ".github/workflows/lib.yml"), |
| 404 | `on: |
| 405 | workflow_call: |
| 406 | inputs: |
| 407 | greeting: { type: string, required: true } |
| 408 | loud: { type: boolean, default: false } |
| 409 | secrets: |
| 410 | TOPSECRET: { required: true } |
| 411 | outputs: |
| 412 | word: |
| 413 | value: \${{ jobs.shout.outputs.word }} |
| 414 | jobs: |
| 415 | say: |
| 416 | runs-on: [self-hosted, linux] |
| 417 | outputs: |
| 418 | word: \${{ steps.s.outputs.word }} |
| 419 | steps: |
| 420 | - id: s |
| 421 | run: echo "word=\${{ inputs.greeting }}-there" >> "$GITHUB_OUTPUT" |
| 422 | - run: echo "secret ok=\${{ secrets.TOPSECRET == 's3cret' }} loud=\${{ inputs.loud }} job=\${{ github.job }}" |
| 423 | shout: |
| 424 | needs: say |
| 425 | runs-on: [self-hosted, linux] |
| 426 | outputs: |
| 427 | word: \${{ steps.s.outputs.word }} |
| 428 | steps: |
| 429 | - id: s |
| 430 | run: echo "word=\${{ needs.say.outputs.word }}!" >> "$GITHUB_OUTPUT" |
| 431 | `, |
| 432 | ); |
| 433 | writeFileSync( |
| 434 | join(src, ".github/workflows/main.yml"), |
| 435 | `name: Main |
| 436 | on: push |
| 437 | jobs: |
| 438 | call: |
| 439 | name: Greeter |
| 440 | uses: ./.github/workflows/lib.yml |
| 441 | with: |
| 442 | greeting: \${{ github.event_name == 'push' && 'hi' || 'no' }} |
| 443 | loud: true |
| 444 | secrets: inherit |
| 445 | nope: |
| 446 | if: \${{ false }} |
| 447 | uses: ./.github/workflows/lib.yml |
| 448 | with: |
| 449 | greeting: never |
| 450 | secrets: |
| 451 | TOPSECRET: \${{ secrets.TOPSECRET }} |
| 452 | after: |
| 453 | needs: [call, nope] |
| 454 | if: \${{ always() }} |
| 455 | runs-on: [self-hosted, linux] |
| 456 | steps: |
| 457 | - run: echo "got=\${{ needs.call.outputs.word }} call=\${{ needs.call.result }} nope=\${{ needs.nope.result }}" |
| 458 | `, |
| 459 | ); |
| 460 | git(src, ["init", "-q", "-b", "main"]); |
| 461 | git(src, ["add", "."]); |
| 462 | git(src, ["commit", "-q", "-m", "reusable"]); |
| 463 | git(src, ["remote", "add", "origin", `${base}/${owner}/reuse.git`]); |
| 464 | git(src, ["push", "-q", "origin", "main"]); |
| 465 | |
| 466 | const run = await until("reuse run", async () => (await ok("GET", `/repos/${owner}/reuse/actions/runs`)).workflow_runs[0]); |
| 467 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/reuse/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 468 | const say = await runOneJob(owner, "reuse"); |
| 469 | assert.equal(say.claim.name, "Greeter / say"); |
| 470 | const sayLog = await logOf(say.claim.job_id); |
| 471 | assert.match(sayLog, /secret ok=true loud=true job=say/); |
| 472 | assert.doesNotMatch(sayLog, /s3cret/); |
| 473 | const shout = await runOneJob(owner, "reuse"); |
| 474 | assert.equal(shout.claim.name, "Greeter / shout"); |
| 475 | const after = await runOneJob(owner, "reuse"); |
| 476 | assert.equal(after.claim.name, "after"); |
| 477 | assert.match(await logOf(after.claim.job_id), /got=hi-there! call=success nope=skipped/); |
| 478 | const done = await until("reuse run to complete", async () => { |
| 479 | const r = await ok("GET", `/repos/${owner}/reuse/actions/runs/${run.id}`); |
| 480 | return r.status === "completed" ? r : null; |
| 481 | }); |
| 482 | assert.equal(done.conclusion, "success"); |
| 483 | const jobs = (await ok("GET", `/repos/${owner}/reuse/actions/runs/${run.id}/jobs`)).jobs; |
| 484 | assert.deepEqual(jobs.filter((j) => j.conclusion === "skipped").map((j) => j.name).sort(), ["nope / say", "nope / shout"]); |
| 485 | }); |
| 486 | |
| 487 | test("job graph: needs-only scheduling, skip cascades, per-leg runs-on, continue-on-error, job concurrency and public payloads", async () => { |
| 488 | const owner = (await ok("GET", "/user")).login; |
| 489 | await ok("POST", "/user/repos", { name: "graph", private: false }); |
| 490 | const src = join(work, "graph"); |
| 491 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 492 | writeFileSync( |
| 493 | join(src, ".github/workflows/graph.yml"), |
| 494 | `name: Graph |
| 495 | on: push |
| 496 | jobs: |
| 497 | slow: |
| 498 | runs-on: [self-hosted, e2e-slow] |
| 499 | steps: |
| 500 | - run: echo slow |
| 501 | fast: |
| 502 | runs-on: [self-hosted, linux] |
| 503 | steps: |
| 504 | - run: echo "private=\${{ github.event.repository.private }} visibility=\${{ github.event.repository.visibility }}" |
| 505 | after-fast: |
| 506 | needs: fast |
| 507 | runs-on: [self-hosted, linux] |
| 508 | steps: |
| 509 | - run: echo after-fast |
| 510 | gate: |
| 511 | if: \${{ github.event_name == 'nope' }} |
| 512 | runs-on: [self-hosted, linux] |
| 513 | steps: |
| 514 | - run: echo never |
| 515 | middle: |
| 516 | needs: gate |
| 517 | if: \${{ always() }} |
| 518 | runs-on: [self-hosted, linux] |
| 519 | steps: |
| 520 | - run: echo "gate=\${{ needs.gate.result }}" |
| 521 | leaf: |
| 522 | needs: middle |
| 523 | runs-on: [self-hosted, linux] |
| 524 | steps: |
| 525 | - run: echo leaf |
| 526 | rescued: |
| 527 | needs: middle |
| 528 | if: \${{ !cancelled() && !failure() }} |
| 529 | runs-on: [self-hosted, linux] |
| 530 | steps: |
| 531 | - run: echo "middle=\${{ needs.middle.result }}" |
| 532 | lanes: |
| 533 | name: lane \${{ matrix.lane }} |
| 534 | strategy: |
| 535 | matrix: |
| 536 | include: |
| 537 | - lane: red |
| 538 | runner: [self-hosted, e2e-red] |
| 539 | - lane: blue |
| 540 | runner: [self-hosted, e2e-blue] |
| 541 | runs-on: \${{ matrix.runner }} |
| 542 | continue-on-error: \${{ matrix.lane == 'red' }} |
| 543 | environment: e2e-\${{ matrix.lane }}-\${{ strategy.job-total }} |
| 544 | steps: |
| 545 | - run: echo "lane=\${{ matrix.lane }}" && test "\${{ matrix.lane }}" = blue |
| 546 | after-lanes: |
| 547 | needs: lanes |
| 548 | runs-on: [self-hosted, linux] |
| 549 | steps: |
| 550 | - run: echo "lanes=\${{ needs.lanes.result }}" |
| 551 | deploy: |
| 552 | strategy: |
| 553 | matrix: |
| 554 | target: [prod, staging] |
| 555 | concurrency: e2e-\${{ matrix.target }} |
| 556 | runs-on: [self-hosted, e2e-deploy] |
| 557 | steps: |
| 558 | - run: echo "deploy \${{ matrix.target }}" |
| 559 | hotfix: |
| 560 | strategy: |
| 561 | matrix: |
| 562 | target: [prod] |
| 563 | concurrency: e2e-\${{ matrix.target }} |
| 564 | runs-on: [self-hosted, e2e-deploy] |
| 565 | steps: |
| 566 | - run: echo "hotfix \${{ matrix.target }}" |
| 567 | `, |
| 568 | ); |
| 569 | git(src, ["init", "-q", "-b", "main"]); |
| 570 | git(src, ["add", "."]); |
| 571 | git(src, ["commit", "-q", "-m", "graph"]); |
| 572 | git(src, ["remote", "add", "origin", `${base}/${owner}/graph.git`]); |
| 573 | git(src, ["push", "-q", "origin", "main"]); |
| 574 | |
| 575 | const run = await until("graph run", async () => (await ok("GET", `/repos/${owner}/graph/actions/runs`)).workflow_runs[0]); |
| 576 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/graph/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 577 | const jobs = async () => (await ok("GET", `/repos/${owner}/graph/actions/runs/${run.id}/jobs`)).jobs; |
| 578 | |
| 579 | // Jobs start when their own needs finish: after-fast and rescued run while slow (no runner offers e2e-slow) still waits. |
| 580 | const linux = {}; |
| 581 | for (let i = 0; i < 4; i++) { |
| 582 | const j = await runOneJob(owner, "graph"); |
| 583 | linux[j.claim.name] = j.claim.job_id; |
| 584 | } |
| 585 | assert.deepEqual(Object.keys(linux).sort(), ["after-fast", "fast", "middle", "rescued"]); |
| 586 | assert.equal((await jobs()).find((j) => j.name === "slow").status, "waiting"); |
| 587 | assert.match(await logOf(linux.fast), /private=false visibility=public/); |
| 588 | assert.match(await logOf(linux.middle), /gate=skipped/); |
| 589 | assert.match(await logOf(linux.rescued), /middle=success/); |
| 590 | |
| 591 | // runs-on per matrix leg; the red leg fails but continues on error, so fail-fast spares the blue one. |
| 592 | const red = await runOneJob(owner, "graph", { labels: ["e2e-red"], allowFailure: true }); |
| 593 | assert.equal(red.claim.name, "lane red"); |
| 594 | const blue = await runOneJob(owner, "graph", { labels: ["e2e-blue"] }); |
| 595 | assert.equal(blue.claim.name, "lane blue"); |
| 596 | const afterLanes = await runOneJob(owner, "graph"); |
| 597 | assert.equal(afterLanes.claim.name, "after-lanes"); |
| 598 | assert.match(await logOf(afterLanes.claim.job_id), /lanes=success/); |
| 599 | const envs = (await ok("GET", `/repos/${owner}/graph/environments`)).environments.map((e) => e.name); |
| 600 | assert.ok(envs.includes("e2e-red-2") && envs.includes("e2e-blue-2"), `per-leg environments: ${envs}`); |
| 601 | |
| 602 | // Job-level concurrency, evaluated per leg: one of the two prod jobs waits as pending until the other finishes. |
| 603 | const pending = await until("a pending prod job", async () => (await jobs()).find((j) => j.status === "pending")); |
| 604 | assert.ok(["deploy (prod)", "hotfix (prod)"].includes(pending.name), pending.name); |
| 605 | const first = await runOneJob(owner, "graph", { labels: ["e2e-deploy"] }); |
| 606 | const second = await runOneJob(owner, "graph", { labels: ["e2e-deploy"] }); |
| 607 | assert.deepEqual([first.claim.name, second.claim.name].sort(), ["deploy (prod)", "deploy (staging)", "hotfix (prod)"].filter((n) => n !== pending.name).sort()); |
| 608 | const third = await runOneJob(owner, "graph", { labels: ["e2e-deploy"] }); |
| 609 | assert.equal(third.claim.name, pending.name); |
| 610 | |
| 611 | const slow = await runOneJob(owner, "graph", { labels: ["e2e-slow"] }); |
| 612 | assert.equal(slow.claim.name, "slow"); |
| 613 | const done = await until("graph run to complete", async () => { |
| 614 | const r = await ok("GET", `/repos/${owner}/graph/actions/runs/${run.id}`); |
| 615 | return r.status === "completed" ? r : null; |
| 616 | }); |
| 617 | assert.equal(done.conclusion, "success", "a failed leg with continue-on-error does not fail the run"); |
| 618 | const byName = Object.fromEntries((await jobs()).map((j) => [j.name, j])); |
| 619 | assert.equal(byName.gate.conclusion, "skipped"); |
| 620 | assert.equal(byName.leaf.conclusion, "skipped", "a skipped ancestor skips the jobs below it"); |
| 621 | assert.equal(byName["lane red"].conclusion, "failure"); |
| 622 | assert.equal(byName["lane blue"].conclusion, "success"); |
| 623 | }); |
| 624 | |
| 625 | test("workflow_run: a workflow follows another one on the default branch", async () => { |
| 626 | const owner = (await ok("GET", "/user")).login; |
| 627 | await ok("POST", "/user/repos", { name: "chain" }); |
| 628 | const src = join(work, "chain"); |
| 629 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 630 | writeFileSync(join(src, ".github/workflows/ci.yml"), `name: CI\non: push\njobs:\n build:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo built\n`); |
| 631 | writeFileSync( |
| 632 | join(src, ".github/workflows/after.yml"), |
| 633 | `name: After CI |
| 634 | on: |
| 635 | workflow_run: |
| 636 | workflows: [CI] |
| 637 | types: [completed] |
| 638 | branches: [main] |
| 639 | jobs: |
| 640 | report: |
| 641 | if: \${{ github.event.workflow_run.conclusion == 'success' }} |
| 642 | runs-on: [self-hosted, linux] |
| 643 | steps: |
| 644 | - run: echo "followed \${{ github.event.workflow_run.name }} on \${{ github.event.workflow_run.head_branch }} (\${{ github.event.action }}) ref=\${{ github.ref }}" |
| 645 | `, |
| 646 | ); |
| 647 | git(src, ["init", "-q", "-b", "main"]); |
| 648 | git(src, ["add", "."]); |
| 649 | git(src, ["commit", "-q", "-m", "chain"]); |
| 650 | git(src, ["remote", "add", "origin", `${base}/${owner}/chain.git`]); |
| 651 | git(src, ["push", "-q", "origin", "main"]); |
| 652 | |
| 653 | const runs = async () => (await ok("GET", `/repos/${owner}/chain/actions/runs`)).workflow_runs; |
| 654 | await until("CI run", async () => (await runs()).find((r) => r.name === "CI")); |
| 655 | assert.equal((await runs()).length, 1, "only CI runs before it completes"); |
| 656 | const build = await runOneJob(owner, "chain"); |
| 657 | assert.equal(build.claim.name, "build"); |
| 658 | const follower = await until("follower run", async () => (await runs()).find((r) => r.event === "workflow_run")); |
| 659 | assert.equal(follower.name, "After CI"); |
| 660 | assert.equal(follower.head_branch, "main"); |
| 661 | const report = await runOneJob(owner, "chain"); |
| 662 | assert.equal(report.claim.name, "report"); |
| 663 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/chain/actions/jobs/${report.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 664 | assert.match(log, /followed CI on main \(completed\) ref=refs\/heads\/main/); |
| 665 | const done = await until("follower to complete", async () => { |
| 666 | const r = await ok("GET", `/repos/${owner}/chain/actions/runs/${follower.id}`); |
| 667 | return r.status === "completed" ? r : null; |
| 668 | }); |
| 669 | assert.equal(done.conclusion, "success"); |
| 670 | assert.equal((await runs()).length, 2, "the follower does not trigger itself"); |
| 671 | |
| 672 | // A run whose jobs were all skipped is skipped, as on GitHub, so a follower that waits for success doesn't run. |
| 673 | writeFileSync(join(src, ".github/workflows/ci.yml"), `name: CI\non: push\njobs:\n build:\n if: \${{ false }}\n runs-on: [self-hosted, linux]\n steps:\n - run: echo built\n`); |
| 674 | git(src, ["commit", "-q", "-am", "skip the build"]); |
| 675 | git(src, ["push", "-q", "origin", "main"]); |
| 676 | const settled = await until("skipped CI and its follower", async () => { |
| 677 | const all = await runs(); |
| 678 | return all.length === 4 && all.every((r) => r.status === "completed") ? all : null; |
| 679 | }); |
| 680 | const sha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 681 | const skippedCi = settled.find((r) => r.name === "CI" && r.head_sha === sha); |
| 682 | assert.equal(skippedCi?.conclusion, "skipped"); |
| 683 | assert.equal(settled.find((r) => r.event === "workflow_run" && r.id !== follower.id)?.conclusion, "skipped"); |
| 684 | }); |
| 685 | |
| 686 | test("triggers from workflows: a job's repository_dispatch starts runs, a follower of agent code stays an agent's", { timeout: 600_000 }, async () => { |
| 687 | const owner = (await ok("GET", "/user")).login; |
| 688 | await ok("POST", "/user/repos", { name: "relay" }); |
| 689 | const bot = (await ok("POST", "/diffinery/agents", { login: "relay-bot" }, null)).token.token; |
| 690 | const src = join(work, "relay"); |
| 691 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 692 | writeFileSync( |
| 693 | join(src, ".github/workflows/send.yml"), |
| 694 | `name: Send |
| 695 | on: workflow_dispatch |
| 696 | jobs: |
| 697 | send: |
| 698 | runs-on: [self-hosted, linux] |
| 699 | permissions: { contents: write } |
| 700 | steps: |
| 701 | - env: { GH_TOKEN: "\${{ github.token }}" } |
| 702 | run: | |
| 703 | code=$(curl -s -o out.txt -w '%{http_code}' -X POST -H "authorization: Bearer $GH_TOKEN" -H 'content-type: application/json' -d '{"event_type":"ping","client_payload":{"from":"a job"}}' "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/dispatches") |
| 704 | echo "dispatch: $code $(cat out.txt)" |
| 705 | `, |
| 706 | ); |
| 707 | writeFileSync( |
| 708 | join(src, ".github/workflows/pinged.yml"), |
| 709 | `name: Pinged |
| 710 | on: |
| 711 | repository_dispatch: |
| 712 | types: [ping] |
| 713 | jobs: |
| 714 | pinged: |
| 715 | runs-on: [self-hosted, linux] |
| 716 | steps: |
| 717 | - run: echo "pinged from \${{ github.event.client_payload.from }}" |
| 718 | `, |
| 719 | ); |
| 720 | writeFileSync(join(src, ".github/workflows/ci.yml"), `name: CI\non: pull_request\njobs:\n build:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo built\n`); |
| 721 | writeFileSync( |
| 722 | join(src, ".github/workflows/after.yml"), |
| 723 | `name: After CI |
| 724 | on: |
| 725 | workflow_run: |
| 726 | workflows: [CI] |
| 727 | types: [completed] |
| 728 | jobs: |
| 729 | follow: |
| 730 | runs-on: [self-hosted, linux] |
| 731 | permissions: { contents: write } |
| 732 | steps: |
| 733 | - uses: actions/checkout@v4 |
| 734 | with: { ref: main } |
| 735 | - env: |
| 736 | GIT_AUTHOR_NAME: bot |
| 737 | GIT_AUTHOR_EMAIL: bot@example.com |
| 738 | GIT_COMMITTER_NAME: bot |
| 739 | GIT_COMMITTER_EMAIL: bot@example.com |
| 740 | run: | |
| 741 | echo "after \${{ github.event.workflow_run.head_branch }}" >> followed.txt |
| 742 | git add followed.txt && git commit -qm followed |
| 743 | if git push -q origin HEAD:main 2>err.txt; then echo "main push: ok"; else echo "main push: refused $(tr '\\n' ' ' < err.txt)"; fi |
| 744 | `, |
| 745 | ); |
| 746 | git(src, ["init", "-q", "-b", "main"]); |
| 747 | git(src, ["add", "."]); |
| 748 | git(src, ["commit", "-q", "-m", "relay"]); |
| 749 | git(src, ["remote", "add", "origin", `${base}/${owner}/relay.git`]); |
| 750 | git(src, ["push", "-q", "origin", "main"]); |
| 751 | |
| 752 | const runs = async () => (await ok("GET", `/repos/${owner}/relay/actions/runs`)).workflow_runs; |
| 753 | const logOf = async (claim) => (await (await fetch(`${base}/api/v3/repos/${owner}/relay/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text()).replace(/^\S+Z /gm, ""); |
| 754 | |
| 755 | // Like GitHub, a job's GITHUB_TOKEN may send repository_dispatch, and that starts runs. |
| 756 | await ok("POST", `/repos/${owner}/relay/actions/workflows/send.yml/dispatches`, { ref: "main" }); |
| 757 | const send = await runOneJob(owner, "relay"); |
| 758 | assert.equal(send.claim.name, "send"); |
| 759 | assert.match(await logOf(send.claim), /dispatch: 204/); |
| 760 | const pingedRun = await until("repository_dispatch run", async () => (await runs()).find((r) => r.event === "repository_dispatch")); |
| 761 | assert.equal(pingedRun.name, "Pinged"); |
| 762 | const pinged = await runOneJob(owner, "relay"); |
| 763 | assert.equal(pinged.claim.name, "pinged"); |
| 764 | assert.match(await logOf(pinged.claim), /pinged from a job/); |
| 765 | |
| 766 | /** Opens a pull request from `branch` as a person, runs its CI, then the follower; returns the follower's log. */ |
| 767 | const follow = async (branch) => { |
| 768 | const seen = new Set((await runs()).map((r) => r.id)); |
| 769 | await ok("POST", `/repos/${owner}/relay/pulls`, { title: branch, head: branch, base: "main" }); |
| 770 | await until("CI run", async () => (await runs()).find((r) => !seen.has(r.id) && r.name === "CI")); |
| 771 | const build = await runOneJob(owner, "relay"); |
| 772 | assert.equal(build.claim.name, "build"); |
| 773 | await until("follower run", async () => (await runs()).find((r) => !seen.has(r.id) && r.event === "workflow_run")); |
| 774 | const f = await runOneJob(owner, "relay"); |
| 775 | assert.equal(f.claim.name, "follow"); |
| 776 | return logOf(f.claim); |
| 777 | }; |
| 778 | |
| 779 | // A person's pull request: the follower writes to main with the token it was granted. |
| 780 | git(src, ["checkout", "-q", "-b", "person-work"]); |
| 781 | writeFileSync(join(src, "person.txt"), "from a person\n"); |
| 782 | git(src, ["add", "person.txt"]); |
| 783 | git(src, ["commit", "-q", "-m", "person change"]); |
| 784 | git(src, ["push", "-q", "origin", "person-work"]); |
| 785 | assert.match(await follow("person-work"), /main push: ok/); |
| 786 | |
| 787 | // A person opens a pull request from a branch an agent pushed. CI runs the agent's code, so |
| 788 | // the follower, which acts on what CI produced, is an agent's too and may not push to main. |
| 789 | const agentClone = join(work, "relay-agent"); |
| 790 | git(work, ["clone", "-q", `${base}/${owner}/relay.git`, agentClone], bot); |
| 791 | git(agentClone, ["checkout", "-q", "-b", "agent-work"], bot); |
| 792 | writeFileSync(join(agentClone, "agent.txt"), "from the agent\n"); |
| 793 | git(agentClone, ["add", "agent.txt"], bot); |
| 794 | git(agentClone, ["commit", "-q", "-m", "agent change"], bot); |
| 795 | git(agentClone, ["push", "-q", "origin", "agent-work"], bot); |
| 796 | assert.match(await follow("agent-work"), /main push: refused .*agents may not push to protected or default branches/); |
| 797 | }); |
| 798 | |
| 799 | test("pull requests: test merge commits, pull_request_target and the merge queue", async () => { |
| 800 | const owner = (await ok("GET", "/user")).login; |
| 801 | await ok("POST", "/user/repos", { name: "queue" }); |
| 802 | await api("PUT", `/repos/${owner}/queue/actions/secrets/TOPSECRET`, { value: "s3cret" }); |
| 803 | const src = join(work, "queue"); |
| 804 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 805 | writeFileSync(join(src, "app.txt"), "a\nb\nc\n"); |
| 806 | writeFileSync( |
| 807 | join(src, ".github/workflows/ci.yml"), |
| 808 | `name: CI |
| 809 | on: |
| 810 | pull_request: |
| 811 | merge_group: |
| 812 | jobs: |
| 813 | test: |
| 814 | runs-on: [self-hosted, linux] |
| 815 | steps: |
| 816 | - uses: actions/checkout@v4 |
| 817 | - run: | |
| 818 | echo "event=\${{ github.event_name }} ref=\${{ github.ref }} sha=\${{ github.sha }} head=$(git rev-parse HEAD)" |
| 819 | echo "parents=$(git rev-list --parents -n1 HEAD)" |
| 820 | echo "app=$(tr '\\n' ' ' < app.txt)" |
| 821 | if [ "\${{ github.event_name }}" = merge_group ] && grep -qs fail notes.txt; then echo "merge group failed"; exit 1; fi |
| 822 | `, |
| 823 | ); |
| 824 | writeFileSync( |
| 825 | join(src, ".github/workflows/target.yml"), |
| 826 | `name: Target |
| 827 | on: pull_request_target |
| 828 | jobs: |
| 829 | t: |
| 830 | runs-on: [self-hosted, linux] |
| 831 | steps: |
| 832 | - run: echo "target from base secret=\${{ secrets.TOPSECRET == 's3cret' }} ref=\${{ github.ref }} head=\${{ github.event.pull_request.head.sha }}" |
| 833 | `, |
| 834 | ); |
| 835 | git(src, ["init", "-q", "-b", "main"]); |
| 836 | git(src, ["add", "."]); |
| 837 | git(src, ["commit", "-q", "-m", "queue"]); |
| 838 | git(src, ["remote", "add", "origin", `${base}/${owner}/queue.git`]); |
| 839 | git(src, ["push", "-q", "origin", "main"]); |
| 840 | const root = git(src, ["rev-parse", "HEAD"]).trim(); |
| 841 | |
| 842 | // f1 changes the first line and tries to rewrite the pull_request_target workflow. |
| 843 | git(src, ["checkout", "-q", "-b", "f1"]); |
| 844 | writeFileSync(join(src, "app.txt"), "A\nb\nc\n"); |
| 845 | writeFileSync(join(src, ".github/workflows/target.yml"), `name: Target\non: pull_request_target\njobs:\n t:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo "PWNED \${{ secrets.TOPSECRET }}"\n`); |
| 846 | git(src, ["commit", "-q", "-am", "f1"]); |
| 847 | git(src, ["push", "-q", "origin", "f1"]); |
| 848 | const f1 = git(src, ["rev-parse", "HEAD"]).trim(); |
| 849 | // main moves on, so the test merge commit differs from both sides. |
| 850 | git(src, ["checkout", "-q", "main"]); |
| 851 | writeFileSync(join(src, "app.txt"), "a\nb\nC\n"); |
| 852 | git(src, ["commit", "-q", "-am", "main moves"]); |
| 853 | git(src, ["push", "-q", "origin", "main"]); |
| 854 | const main1 = git(src, ["rev-parse", "HEAD"]).trim(); |
| 855 | |
| 856 | const pr1 = await ok("POST", `/repos/${owner}/queue/pulls`, { title: "Capitalise a", head: "f1", base: "main" }); |
| 857 | const runs = async (q = "") => (await ok("GET", `/repos/${owner}/queue/actions/runs${q}`)).workflow_runs; |
| 858 | const prRun = await until("pull_request run", async () => (await runs("?event=pull_request"))[0]); |
| 859 | assert.equal(prRun.ref, "refs/pull/1/merge"); |
| 860 | assert.equal(prRun.head_sha, f1, "pull_request runs report on the PR head"); |
| 861 | assert.notEqual(prRun.sha, f1, "pull_request runs check out the test merge commit"); |
| 862 | assert.equal(prRun.head_branch, "f1"); |
| 863 | const targetRun = (await runs("?event=pull_request_target"))[0]; |
| 864 | assert.equal(targetRun.ref, "refs/heads/main"); |
| 865 | assert.equal(targetRun.sha, main1, "pull_request_target runs on the base commit"); |
| 866 | assert.equal(targetRun.head_sha, f1); |
| 867 | // The merge ref is fetchable and its parents are [base, head]; refs/pull is read-only. |
| 868 | git(src, ["fetch", "-q", "origin", "+refs/pull/1/merge:refs/remotes/pr/1"]); |
| 869 | assert.equal(git(src, ["rev-parse", "refs/remotes/pr/1"]).trim(), prRun.sha); |
| 870 | assert.equal(git(src, ["rev-list", "--parents", "-n1", "refs/remotes/pr/1"]).trim(), `${prRun.sha} ${main1} ${f1}`); |
| 871 | assert.match(gitFails(src, ["push", "origin", `${root}:refs/pull/1/head`]), /refs\/pull|managed/); |
| 872 | |
| 873 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/queue/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 874 | const ran = {}; |
| 875 | for (let i = 0; i < 2; i++) { |
| 876 | const j = await runOneJob(owner, "queue"); |
| 877 | ran[j.claim.name] = await logOf(j.claim.job_id); |
| 878 | } |
| 879 | assert.match(ran.test, new RegExp(`event=pull_request ref=refs/pull/1/merge sha=${prRun.sha} head=${prRun.sha}`)); |
| 880 | assert.match(ran.test, /app=A b C/); |
| 881 | assert.match(ran.t, /target from base secret=true ref=refs\/heads\/main/); |
| 882 | assert.match(ran.t, new RegExp(`head=${f1}`)); |
| 883 | assert.doesNotMatch(ran.t, /PWNED/); |
| 884 | await until("PR #1 checks", async () => { |
| 885 | const c = (await ok("GET", `/repos/${owner}/queue/commits/${f1}/check-runs`)).check_runs; |
| 886 | return c.length === 2 && c.every((x) => x.conclusion === "success") ? c : null; |
| 887 | }); |
| 888 | |
| 889 | // ------------------------------------------------------------ merge queue |
| 890 | await ok("PUT", `/repos/${owner}/queue/branches/main/protection`, { requirePullRequest: true, requiredChecks: ["CI / test"], mergeQueue: { method: "merge", buildConcurrency: 5, checkTimeoutMinutes: 30 } }); |
| 891 | const direct = await api("PUT", `/repos/${owner}/queue/pulls/1/merge`, {}); |
| 892 | assert.equal(direct.status, 405); |
| 893 | assert.match(JSON.stringify(direct.json), /merge queue/); |
| 894 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1/merge`)).mergeQueue.method, "merge"); |
| 895 | |
| 896 | // Two more pull requests: one that merges cleanly and one that fails only in its merge group. |
| 897 | const branch = async (name, file, content) => { |
| 898 | git(src, ["checkout", "-q", "-b", name, main1]); |
| 899 | writeFileSync(join(src, file), content); |
| 900 | git(src, ["add", "."]); |
| 901 | git(src, ["commit", "-q", "-m", name]); |
| 902 | git(src, ["push", "-q", "origin", name]); |
| 903 | const sha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 904 | const pr = await ok("POST", `/repos/${owner}/queue/pulls`, { title: name, head: name, base: "main" }); |
| 905 | for (let i = 0; i < 2; i++) await runOneJob(owner, "queue"); |
| 906 | await until(`${name} checks`, async () => (await ok("GET", `/repos/${owner}/queue/commits/${sha}/check-runs`)).check_runs.filter((x) => x.conclusion === "success").length === 2); |
| 907 | return { pr, sha }; |
| 908 | }; |
| 909 | const f2 = await branch("f2", "two.txt", "two\n"); |
| 910 | const f3 = await branch("f3", "notes.txt", "fail\n"); |
| 911 | |
| 912 | const q1 = await ok("PUT", `/repos/${owner}/queue/pulls/1/merge-queue`, { delete_branch: true }); |
| 913 | assert.equal(q1.state, "queued"); |
| 914 | assert.equal(q1.entry.position, 1); |
| 915 | assert.equal(q1.entry.state, "checking"); |
| 916 | const q2 = await ok("PUT", `/repos/${owner}/queue/pulls/${f2.pr.number}/merge-queue`, {}); |
| 917 | const q3 = await ok("PUT", `/repos/${owner}/queue/pulls/${f3.pr.number}/merge-queue`, {}); |
| 918 | assert.equal(q2.entry.merge_group.base_sha, q1.entry.merge_group.head_sha, "each group builds on the one ahead"); |
| 919 | assert.equal(q3.entry.merge_group.base_sha, q2.entry.merge_group.head_sha); |
| 920 | assert.equal(q1.entry.merge_group.head_ref, `refs/heads/gh-readonly-queue/main/pr-1-${f1}`); |
| 921 | const queue = await ok("GET", `/repos/${owner}/queue/merge-queue/main`); |
| 922 | assert.deepEqual(queue.entries.map((e) => e.number), [1, f2.pr.number, f3.pr.number]); |
| 923 | assert.match(gitFails(src, ["push", "origin", `${root}:refs/heads/gh-readonly-queue/main/x`]), /read-only/); |
| 924 | |
| 925 | // Merge groups run merge_group workflows, oldest first. |
| 926 | const groupLogs = []; |
| 927 | for (let i = 0; i < 3; i++) { |
| 928 | const j = await runOneJob(owner, "queue", { allowFailure: i === 2 }); |
| 929 | groupLogs.push(await logOf(j.claim.job_id)); |
| 930 | } |
| 931 | assert.match(groupLogs[0], new RegExp(`event=merge_group ref=refs/heads/gh-readonly-queue/main/pr-1-${f1} sha=${q1.entry.merge_group.head_sha}`)); |
| 932 | assert.match(groupLogs[2], /merge group failed/); |
| 933 | const mainNow = await until("the queue to merge #1 and #2", async () => { |
| 934 | const b = await ok("GET", `/repos/${owner}/queue/branches/main`); |
| 935 | return b.commit.sha === q2.entry.merge_group.head_sha ? b : null; |
| 936 | }); |
| 937 | assert.ok(mainNow); |
| 938 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1`)).merged, true); |
| 939 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/${f2.pr.number}`)).merged, true); |
| 940 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1`)).merge_commit_sha, q1.entry.merge_group.head_sha, "the tested commit is what merged"); |
| 941 | const f3After = await until("#3 to leave the queue", async () => { |
| 942 | const q = await ok("GET", `/repos/${owner}/queue/merge-queue/main`); |
| 943 | return q.entries.length === 0 ? q : null; |
| 944 | }); |
| 945 | assert.ok(f3After); |
| 946 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/${f3.pr.number}`)).merged, false); |
| 947 | const comments = await ok("GET", `/repos/${owner}/queue/issues/${f3.pr.number}/comments`); |
| 948 | assert.match(JSON.stringify(comments), /removed from the merge queue: the required check 'CI \/ test' failed on its merge group/); |
| 949 | git(src, ["fetch", "-q", "origin"]); |
| 950 | assert.equal(git(src, ["show", "origin/main:app.txt"]), "A\nb\nC\n"); |
| 951 | assert.equal(git(src, ["show", "origin/main:two.txt"]), "two\n"); |
| 952 | assert.ok(!(await ok("GET", `/repos/${owner}/queue/branches`)).some((b) => b.name.startsWith("gh-readonly-queue/") || b.name === "f1"), "group branches and f1 are gone"); |
| 953 | |
| 954 | // A pull request that conflicts with its base runs no pull_request workflows (like GitHub), only pull_request_target. |
| 955 | git(src, ["checkout", "-q", "-b", "f4", root]); |
| 956 | writeFileSync(join(src, "app.txt"), "x\nb\nc\n"); |
| 957 | git(src, ["commit", "-q", "-am", "f4"]); |
| 958 | git(src, ["push", "-q", "origin", "f4"]); |
| 959 | const pr4 = await ok("POST", `/repos/${owner}/queue/pulls`, { title: "conflicts", head: "f4", base: "main" }); |
| 960 | const t4 = await until("pull_request_target run for #4", async () => (await runs("?event=pull_request_target")).find((r) => r.pull_request_number === pr4.number)); |
| 961 | assert.ok(t4); |
| 962 | assert.equal((await runs("?event=pull_request")).filter((r) => r.pull_request_number === pr4.number).length, 0); |
| 963 | await runOneJob(owner, "queue"); |
| 964 | |
| 965 | // The web UI shows the queue. |
| 966 | const page = async (path) => { |
| 967 | const res = await fetch(`${base}${path}`); |
| 968 | assert.equal(res.status, 200, path); |
| 969 | return res.text(); |
| 970 | }; |
| 971 | assert.match(await page(`/${owner}/queue/queue/main`), /The queue is empty/); |
| 972 | assert.match(await page(`/${owner}/queue/pull/${pr4.number}`), /Merge when ready/); |
| 973 | assert.match(await page(`/${owner}/queue/pull/${f3.pr.number}`), /removed from the merge queue/); |
| 974 | assert.match(await page(`/${owner}/queue/settings/branches`), /merge queue/); |
| 975 | }); |
| 976 | |
| 977 | const POLICY_WORKFLOW = `name: Policy |
| 978 | on: |
| 979 | push: |
| 980 | branches: [main, agent-work] |
| 981 | pull_request: |
| 982 | jobs: |
| 983 | probe: |
| 984 | runs-on: [self-hosted, linux] |
| 985 | permissions: { contents: write, pull-requests: write } |
| 986 | steps: |
| 987 | - uses: actions/checkout@v4 |
| 988 | with: { ref: main } |
| 989 | - name: Push to main, push a workflow change, approve the pull request |
| 990 | env: |
| 991 | GH_TOKEN: \${{ github.token }} |
| 992 | PR: \${{ github.event.pull_request.number }} |
| 993 | GIT_AUTHOR_NAME: bot |
| 994 | GIT_AUTHOR_EMAIL: bot@example.com |
| 995 | GIT_COMMITTER_NAME: bot |
| 996 | GIT_COMMITTER_EMAIL: bot@example.com |
| 997 | run: | |
| 998 | echo "run \${{ github.run_id }}" > note.txt |
| 999 | git add note.txt && git commit -qm note |
| 1000 | if git push -q origin HEAD:main 2>err.txt; then echo "main push: ok"; else echo "main push: refused $(tr '\\n' ' ' < err.txt)"; fi |
| 1001 | git reset -q --hard HEAD~1 |
| 1002 | echo "# edited" >> .github/workflows/policy.yml |
| 1003 | git commit -qam "edit the workflow" |
| 1004 | if git push -q origin "HEAD:refs/heads/wf-\${{ github.run_id }}" 2>err.txt; then echo "workflow push: ok"; else echo "workflow push: refused $(tr '\\n' ' ' < err.txt)"; fi |
| 1005 | if [ -n "$PR" ]; then |
| 1006 | code=$(curl -s -o out.json -w '%{http_code}' -X POST -H "authorization: Bearer $GH_TOKEN" -H 'content-type: application/json' -d '{"event":"APPROVE","body":"from a workflow"}' "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/pulls/$PR/reviews") |
| 1007 | echo "approve: $code $(cat out.json)" |
| 1008 | fi |
| 1009 | defaults: |
| 1010 | if: github.event_name == 'push' && github.ref == 'refs/heads/main' |
| 1011 | runs-on: [self-hosted, linux] |
| 1012 | steps: |
| 1013 | - env: { GH_TOKEN: "\${{ github.token }}" } |
| 1014 | run: | |
| 1015 | code=$(curl -s -o out.json -w '%{http_code}' -X POST -H "authorization: Bearer $GH_TOKEN" -H 'content-type: application/json' -d '{"title":"from the default token"}' "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/issues") |
| 1016 | echo "default token issue write: $code $(cat out.json)" |
| 1017 | code=$(curl -s -o /dev/null -w '%{http_code}' -H "authorization: Bearer $GH_TOKEN" "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/contents/README.md") |
| 1018 | echo "default token contents read: $code" |
| 1019 | `; |
| 1020 | |
| 1021 | test("workflow tokens: read-only default, no approvals or workflow edits, agent code stays an agent", { timeout: 600_000 }, async () => { |
| 1022 | const owner = (await ok("GET", "/user")).login; |
| 1023 | await ok("POST", "/user/repos", { name: "policy" }); |
| 1024 | const settingsPath = `/repos/${owner}/policy/actions/permissions/workflow`; |
| 1025 | // New repositories start like GitHub's: read-only token, no pull request approvals. |
| 1026 | assert.deepEqual(await ok("GET", settingsPath), { default_workflow_permissions: "read", can_approve_pull_request_reviews: false, agent_runs_use_secrets: false }); |
| 1027 | const bot = (await ok("POST", "/diffinery/agents", { login: "policy-bot" }, null)).token.token; |
| 1028 | assert.equal((await api("PUT", settingsPath, { can_approve_pull_request_reviews: true }, bot)).status, 403, "agents cannot change what workflows may do"); |
| 1029 | assert.equal((await api("PUT", settingsPath, { default_workflow_permissions: "admin" })).status, 422); |
| 1030 | // The same settings on the repository's Settings → Actions page. |
| 1031 | const actionsPage = `/${owner}/policy/settings/actions`; |
| 1032 | const form = async (fields) => { |
| 1033 | const res = await fetch(`${base}${actionsPage}`); |
| 1034 | const html = await res.text(); |
| 1035 | assert.match(html, /Allow GitHub Actions to create and approve pull requests/); |
| 1036 | const csrf = /name="_csrf" value="([^"]+)"/.exec(html)?.[1]; |
| 1037 | const cookie = /dfy_csrf=([^;]+)/.exec(res.headers.get("set-cookie") ?? "")?.[1]; |
| 1038 | const r = await fetch(`${base}${actionsPage}`, { method: "POST", body: new URLSearchParams({ _csrf: csrf, ...fields }), redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}`, "sec-fetch-site": "same-origin" } }); |
| 1039 | assert.equal(r.status, 303); |
| 1040 | }; |
| 1041 | await form({ default_permissions: "write", can_approve: "1" }); |
| 1042 | assert.deepEqual(await ok("GET", settingsPath), { default_workflow_permissions: "write", can_approve_pull_request_reviews: true, agent_runs_use_secrets: false }); |
| 1043 | await form({ default_permissions: "read" }); |
| 1044 | assert.deepEqual(await ok("GET", settingsPath), { default_workflow_permissions: "read", can_approve_pull_request_reviews: false, agent_runs_use_secrets: false }); |
| 1045 | |
| 1046 | const src = join(work, "policy"); |
| 1047 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1048 | writeFileSync(join(src, "README.md"), "# policy\n"); |
| 1049 | writeFileSync(join(src, ".github/workflows/policy.yml"), POLICY_WORKFLOW); |
| 1050 | git(src, ["init", "-q", "-b", "main"]); |
| 1051 | git(src, ["add", "-A"]); |
| 1052 | git(src, ["commit", "-q", "-m", "policy"]); |
| 1053 | git(src, ["remote", "add", "origin", `${base}/${owner}/policy.git`]); |
| 1054 | git(src, ["push", "-q", "origin", "main"]); |
| 1055 | |
| 1056 | /** Runs `count` jobs; returns their logs by job name. */ |
| 1057 | const runJobs = async (count) => { |
| 1058 | const logs = {}; |
| 1059 | for (let i = 0; i < count; i++) { |
| 1060 | const { claim } = await runOneJob(owner, "policy"); |
| 1061 | const raw = await (await fetch(`${base}/api/v3/repos/${owner}/policy/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 1062 | logs[claim.name] = raw.replace(/^\S+Z /gm, ""); |
| 1063 | } |
| 1064 | return logs; |
| 1065 | }; |
| 1066 | const refused = (path) => new RegExp(`workflow push: refused .*refusing to allow a GitHub App to create or update workflow \`${path.replace(/\./g, "\\.")}\` without \`workflows\` permission`); |
| 1067 | |
| 1068 | // A person's push: the job token writes what it was granted, but never workflow files; |
| 1069 | // the default token (no permissions:) only reads. |
| 1070 | let logs = await runJobs(2); |
| 1071 | assert.match(logs.probe, /main push: ok/); |
| 1072 | assert.match(logs.probe, refused(".github/workflows/policy.yml")); |
| 1073 | assert.match(logs.defaults, /default token issue write: 403 .*issues: write/); |
| 1074 | assert.match(logs.defaults, /default token contents read: 200/); |
| 1075 | const branches = (await ok("GET", `/repos/${owner}/policy/branches`)).map((b) => b.name); |
| 1076 | assert.ok(!branches.some((b) => b.startsWith("wf-")), JSON.stringify(branches)); |
| 1077 | git(src, ["pull", "-q", "--ff-only", "origin", "main"]); |
| 1078 | assert.match(readFileSync(join(src, "note.txt"), "utf8"), /^run \d+/); |
| 1079 | |
| 1080 | // An agent's push: the run executes the agent's code, so its token is an agent's and may not push to the default branch. |
| 1081 | const agentClone = join(work, "policy-agent"); |
| 1082 | git(work, ["clone", "-q", `${base}/${owner}/policy.git`, agentClone], bot); |
| 1083 | git(agentClone, ["checkout", "-q", "-b", "agent-work"], bot); |
| 1084 | writeFileSync(join(agentClone, "agent.txt"), "from the agent\n"); |
| 1085 | git(agentClone, ["add", "agent.txt"], bot); |
| 1086 | git(agentClone, ["commit", "-q", "-m", "agent change"], bot); |
| 1087 | git(agentClone, ["push", "-q", "origin", "agent-work"], bot); |
| 1088 | logs = await runJobs(1); |
| 1089 | assert.match(logs.probe, /main push: refused .*agents may not push to protected or default branches/); |
| 1090 | assert.match(logs.probe, refused(".github/workflows/policy.yml")); |
| 1091 | |
| 1092 | // A person opens a pull request from the branch the agent pushed: still the agent's code. |
| 1093 | // Workflows may not approve pull requests unless the repository allows it. |
| 1094 | const pr1 = await ok("POST", `/repos/${owner}/policy/pulls`, { title: "Agent work", head: "agent-work", base: "main" }); |
| 1095 | logs = await runJobs(1); |
| 1096 | assert.match(logs.probe, /main push: refused .*agents may not push/); |
| 1097 | assert.match(logs.probe, /approve: 403 .*GitHub Actions is not permitted to approve pull requests/); |
| 1098 | assert.equal((await ok("GET", `/repos/${owner}/policy/pulls/${pr1.number}/reviews`)).length, 0); |
| 1099 | |
| 1100 | // Allowed: the approval is recorded, but only people's approvals count toward the required ones. |
| 1101 | await ok("PUT", settingsPath, { can_approve_pull_request_reviews: true }); |
| 1102 | assert.deepEqual(await ok("GET", settingsPath), { default_workflow_permissions: "read", can_approve_pull_request_reviews: true, agent_runs_use_secrets: false }); |
| 1103 | await ok("PUT", `/repos/${owner}/policy/branches/main/protection`, { |
| 1104 | requirePullRequest: true, |
| 1105 | requiredApprovals: 1, |
| 1106 | dismissStaleReviews: false, |
| 1107 | requiredChecks: [], |
| 1108 | allowForcePush: false, |
| 1109 | allowDeletion: false, |
| 1110 | requireLinearHistory: false, |
| 1111 | enforceAdmins: true, |
| 1112 | agentsMayPush: false, |
| 1113 | agentsMayMerge: false, |
| 1114 | }); |
| 1115 | git(src, ["checkout", "-q", "-b", "feature"]); |
| 1116 | writeFileSync(join(src, "feature.txt"), "a person's change\n"); |
| 1117 | git(src, ["add", "feature.txt"]); |
| 1118 | git(src, ["commit", "-q", "-m", "feature"]); |
| 1119 | git(src, ["push", "-q", "origin", "feature"]); |
| 1120 | const pr2 = await ok("POST", `/repos/${owner}/policy/pulls`, { title: "Feature", head: "feature", base: "main" }); |
| 1121 | logs = await runJobs(1); |
| 1122 | assert.match(logs.probe, /main push: refused .*pull request/); |
| 1123 | assert.match(logs.probe, /approve: 20[01] /); |
| 1124 | const reviews = await ok("GET", `/repos/${owner}/policy/pulls/${pr2.number}/reviews`); |
| 1125 | assert.deepEqual(reviews.map((r) => r.state), ["APPROVED"]); |
| 1126 | const m = await ok("GET", `/repos/${owner}/policy/pulls/${pr2.number}/merge`); |
| 1127 | assert.equal(m.mergeable, false, JSON.stringify(m)); |
| 1128 | assert.equal(m.approvals, 0, JSON.stringify(m)); |
| 1129 | assert.match(JSON.stringify(m.blockers), /needs 1 more approving review/); |
| 1130 | }); |
| 1131 | |
| 1132 | const SCOPES_WORKFLOW = `name: Scopes |
| 1133 | on: |
| 1134 | push: |
| 1135 | branches: [main, a, b] |
| 1136 | pull_request: |
| 1137 | jobs: |
| 1138 | c: |
| 1139 | runs-on: [self-hosted, linux] |
| 1140 | steps: |
| 1141 | - uses: actions/cache@v4 |
| 1142 | with: { path: built, key: "b-\${{ github.run_id }}", restore-keys: "b-" } |
| 1143 | - uses: actions/cache@v4 |
| 1144 | env: { DIFFINERY_BUILTINS: "false" } |
| 1145 | with: { path: real, key: "r-\${{ github.run_id }}", restore-keys: "r-" } |
| 1146 | - run: | |
| 1147 | echo "restored built=[$(cat built/from 2>/dev/null)] real=[$(cat real/from 2>/dev/null)]" |
| 1148 | mkdir -p built real && echo "$GITHUB_REF" > built/from && echo "$GITHUB_REF" > real/from |
| 1149 | - if: github.ref == 'refs/heads/main' |
| 1150 | uses: actions/upload-artifact@v4 |
| 1151 | with: { name: "builtin-\${{ github.run_id }}", path: built/from, retention-days: 1 } |
| 1152 | - if: github.ref == 'refs/heads/main' |
| 1153 | uses: actions/upload-artifact@v4 |
| 1154 | env: { DIFFINERY_BUILTINS: "false" } |
| 1155 | with: { name: "real-\${{ github.run_id }}", path: built/from, retention-days: 3 } |
| 1156 | - if: github.ref == 'refs/heads/main' |
| 1157 | uses: actions/upload-artifact@v4 |
| 1158 | with: { name: "capped-\${{ github.run_id }}", path: built/from, retention-days: 400 } |
| 1159 | `; |
| 1160 | |
| 1161 | test("caches are scoped to branches and pull requests; artifacts keep their retention-days", { timeout: 900_000 }, async () => { |
| 1162 | const owner = (await ok("GET", "/user")).login; |
| 1163 | await ok("POST", "/user/repos", { name: "scopes" }); |
| 1164 | const src = join(work, "scopes"); |
| 1165 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1166 | writeFileSync(join(src, ".github/workflows/scopes.yml"), SCOPES_WORKFLOW); |
| 1167 | writeFileSync(join(src, "README.md"), "# scopes\n"); |
| 1168 | git(src, ["init", "-q", "-b", "main"]); |
| 1169 | git(src, ["add", "-A"]); |
| 1170 | git(src, ["commit", "-q", "-m", "scopes"]); |
| 1171 | git(src, ["remote", "add", "origin", `${base}/${owner}/scopes.git`]); |
| 1172 | /** Runs the job a push or pull request started; returns what its caches restored. */ |
| 1173 | const restored = async () => { |
| 1174 | const { claim } = await runOneJob(owner, "scopes", { timeoutMs: 300_000 }); |
| 1175 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/scopes/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 1176 | const m = /^\S+ restored built=\[(.*?)\] real=\[(.*?)\]$/m.exec(log); |
| 1177 | assert.ok(m, log); |
| 1178 | return { builtin: m[1], real: m[2] }; |
| 1179 | }; |
| 1180 | const branch = (name, from, file) => { |
| 1181 | git(src, ["checkout", "-q", "-b", name, from]); |
| 1182 | if (file) { |
| 1183 | writeFileSync(join(src, file), `${name}\n`); |
| 1184 | git(src, ["add", file]); |
| 1185 | git(src, ["commit", "-q", "-m", name]); |
| 1186 | } |
| 1187 | git(src, ["push", "-q", "origin", name]); |
| 1188 | }; |
| 1189 | |
| 1190 | // The default branch starts empty and saves its own entries. |
| 1191 | git(src, ["push", "-q", "origin", "main"]); |
| 1192 | assert.deepEqual(await restored(), { builtin: "", real: "" }); |
| 1193 | // A branch falls back to the default branch's caches... |
| 1194 | branch("a", "main", "a.txt"); |
| 1195 | assert.deepEqual(await restored(), { builtin: "refs/heads/main", real: "refs/heads/main" }); |
| 1196 | // ...but never sees another branch's, though a's are newer and match the restore key. |
| 1197 | branch("b", "main", "b.txt"); |
| 1198 | assert.deepEqual(await restored(), { builtin: "refs/heads/main", real: "refs/heads/main" }); |
| 1199 | // A pull request reads its base branch's caches. |
| 1200 | branch("c", "a", "c.txt"); |
| 1201 | await ok("POST", `/repos/${owner}/scopes/pulls`, { title: "c into a", head: "c", base: "a" }); |
| 1202 | assert.deepEqual(await restored(), { builtin: "refs/heads/a", real: "refs/heads/a" }); |
| 1203 | // Another pull request doesn't see the first one's (saved under refs/pull/<n>/merge). |
| 1204 | branch("d", "main", "d.txt"); |
| 1205 | await ok("POST", `/repos/${owner}/scopes/pulls`, { title: "d into main", head: "d", base: "main" }); |
| 1206 | assert.deepEqual(await restored(), { builtin: "refs/heads/main", real: "refs/heads/main" }); |
| 1207 | const caches = await ok("GET", `/repos/${owner}/scopes/actions/caches?per_page=100`); |
| 1208 | assert.deepEqual([...new Set(caches.actions_caches.map((c) => c.ref))].sort(), ["refs/heads/a", "refs/heads/b", "refs/heads/main", "refs/pull/1/merge", "refs/pull/2/merge"]); |
| 1209 | // A page at a time, with GitHub's Link header. |
| 1210 | const page = await fetch(`${base}/api/v3/repos/${owner}/scopes/actions/caches?per_page=2`, { headers: { authorization: `Bearer ${token}` } }); |
| 1211 | assert.equal((await page.json()).actions_caches.length, 2); |
| 1212 | assert.match(page.headers.get("link") ?? "", /[?&]page=2>; rel="next".*rel="last"/); |
| 1213 | |
| 1214 | // retention-days (the built-in and the real upload-artifact), capped at 90 days. |
| 1215 | const days = (iso) => Math.round((Date.parse(iso) - Date.now()) / 86_400_000); |
| 1216 | const artifacts = (await ok("GET", `/repos/${owner}/scopes/actions/runs/1/artifacts`)).artifacts; |
| 1217 | const byName = Object.fromEntries(artifacts.map((a) => [a.name.replace(/-\d+$/, ""), a])); |
| 1218 | assert.equal(days(byName.builtin.expires_at), 1, JSON.stringify(byName.builtin)); |
| 1219 | assert.equal(days(byName.real.expires_at), 3, JSON.stringify(byName.real)); |
| 1220 | assert.equal(days(byName.capped.expires_at), 90, JSON.stringify(byName.capped)); |
| 1221 | assert.ok(artifacts.every((a) => a.expired === false)); |
| 1222 | }); |
| 1223 | |
| 1224 | test("an older runner's cache API is scoped the same way", async () => { |
| 1225 | const owner = (await ok("GET", "/user")).login; |
| 1226 | await ok("POST", "/user/repos", { name: "legacy-cache" }); |
| 1227 | const src = join(work, "legacy-cache"); |
| 1228 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1229 | writeFileSync(join(src, ".github/workflows/w.yml"), "on:\n push:\n branches: [main, a, b]\njobs:\n j:\n runs-on: [self-hosted, linux]\n steps: [{ run: echo }]\n"); |
| 1230 | git(src, ["init", "-q", "-b", "main"]); |
| 1231 | git(src, ["add", "-A"]); |
| 1232 | git(src, ["commit", "-q", "-m", "legacy"]); |
| 1233 | git(src, ["remote", "add", "origin", `${base}/${owner}/legacy-cache.git`]); |
| 1234 | |
| 1235 | /** Claims the job a push started and starts it, as an older runner would, without running steps. */ |
| 1236 | const startJob = async () => { |
| 1237 | const claim = await until("a job to claim", async () => { |
| 1238 | const r = await api("POST", `/repos/${owner}/legacy-cache/actions/runners/claim`, { name: "old-runner", labels: ["linux"] }); |
| 1239 | return r.status === 200 ? r.json : null; |
| 1240 | }); |
| 1241 | const h = { authorization: `Bearer ${claim.token}` }; |
| 1242 | const at = `${base}/runner/jobs/${claim.job_id}`; |
| 1243 | assert.equal((await fetch(at, { headers: h })).status, 200); |
| 1244 | return { |
| 1245 | put: async (key, body) => (await fetch(`${at}/cache/${encodeURIComponent(key)}`, { method: "PUT", headers: { ...h, "content-length": String(body.length) }, body })).status, |
| 1246 | lookup: async (key, restore = "") => { |
| 1247 | const r = await fetch(`${at}/cache?key=${encodeURIComponent(key)}&restore=${encodeURIComponent(restore)}`, { headers: h }); |
| 1248 | if (r.status !== 200) return { status: r.status }; |
| 1249 | const hit = await r.json(); |
| 1250 | const blob = await fetch(hit.url, { headers: h }); |
| 1251 | return { key: hit.key, content: blob.status === 200 ? await blob.text() : blob.status }; |
| 1252 | }, |
| 1253 | blob: async (stored) => (await fetch(`${at}/cache/blob/${encodeURIComponent(stored)}`, { headers: h })).status, |
| 1254 | done: async () => assert.equal((await fetch(`${at}/complete`, { method: "POST", headers: { ...h, "content-type": "application/json" }, body: JSON.stringify({ conclusion: "success", outputs: {} }) })).status, 200), |
| 1255 | }; |
| 1256 | }; |
| 1257 | |
| 1258 | const branch = (name) => { |
| 1259 | git(src, ["checkout", "-q", "-b", name, "main"]); |
| 1260 | writeFileSync(join(src, `${name}.txt`), `${name}\n`); |
| 1261 | git(src, ["add", "-A"]); |
| 1262 | git(src, ["commit", "-q", "-m", name]); |
| 1263 | git(src, ["push", "-q", "origin", name]); |
| 1264 | }; |
| 1265 | |
| 1266 | git(src, ["push", "-q", "origin", "main"]); |
| 1267 | let job = await startJob(); |
| 1268 | assert.equal(await job.put("lk-main", "from main"), 200); |
| 1269 | await job.done(); |
| 1270 | |
| 1271 | branch("a"); |
| 1272 | job = await startJob(); |
| 1273 | assert.deepEqual(await job.lookup("lk-a", "lk-"), { key: "lk-main", content: "from main" }); |
| 1274 | assert.equal(await job.put("lk-a", "from a"), 200); |
| 1275 | assert.deepEqual(await job.lookup("lk-a"), { key: "lk-a", content: "from a" }); |
| 1276 | await job.done(); |
| 1277 | |
| 1278 | branch("b"); |
| 1279 | job = await startJob(); |
| 1280 | assert.deepEqual(await job.lookup("lk-a"), { status: 404 }); |
| 1281 | assert.deepEqual(await job.lookup("lk-x", "lk-"), { key: "lk-main", content: "from main" }); |
| 1282 | // a's entry can't be fetched directly either |
| 1283 | assert.equal(await job.blob("refs/heads/a\nlk-a"), 404); |
| 1284 | assert.equal(await job.blob("lk-a"), 404); |
| 1285 | await job.done(); |
| 1286 | }); |
| 1287 | |
| 1288 | test("an older runner's artifact API needs the job's own token", async () => { |
| 1289 | const owner = (await ok("GET", "/user")).login; |
| 1290 | await ok("POST", "/user/repos", { name: "legacy-artifacts" }); |
| 1291 | const src = join(work, "legacy-artifacts"); |
| 1292 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1293 | writeFileSync(join(src, ".github/workflows/w.yml"), "on: push\njobs:\n j:\n runs-on: [self-hosted, linux]\n steps: [{ run: echo }]\n"); |
| 1294 | git(src, ["init", "-q", "-b", "main"]); |
| 1295 | git(src, ["add", "-A"]); |
| 1296 | git(src, ["commit", "-q", "-m", "legacy"]); |
| 1297 | git(src, ["remote", "add", "origin", `${base}/${owner}/legacy-artifacts.git`]); |
| 1298 | git(src, ["push", "-q", "origin", "main"]); |
| 1299 | const claim = await until("a job to claim", async () => { |
| 1300 | const r = await api("POST", `/repos/${owner}/legacy-artifacts/actions/runners/claim`, { name: "old-runner", labels: ["linux"] }); |
| 1301 | return r.status === 200 ? r.json : null; |
| 1302 | }); |
| 1303 | const at = `${base}/runner/jobs/${claim.job_id}/artifacts/out`; |
| 1304 | const real = { authorization: `Bearer ${claim.token}` }; |
| 1305 | // Same shape (djt_<repo>_<job>_...) as the real token, but not it. |
| 1306 | const forged = { authorization: `Bearer ${claim.token.split("_").slice(0, 3).join("_")}_${"0".repeat(48)}` }; |
| 1307 | assert.equal((await fetch(`${base}/runner/jobs/${claim.job_id}`, { headers: real })).status, 200); |
| 1308 | const put = async (h, body) => (await fetch(at, { method: "PUT", headers: { ...h, "content-length": String(body.length) }, body })).status; |
| 1309 | const get = async (h) => { |
| 1310 | const r = await fetch(at, { headers: h }); |
| 1311 | return r.status === 200 ? await r.text() : r.status; |
| 1312 | }; |
| 1313 | assert.equal(await put(real, "real bytes"), 200); |
| 1314 | assert.equal(await put(forged, "forged bytes"), 401); |
| 1315 | assert.equal(await get(forged), 401); |
| 1316 | assert.equal(await get({}), 401); |
| 1317 | // The forged upload never reached storage. |
| 1318 | assert.equal(await get(real), "real bytes"); |
| 1319 | assert.equal((await fetch(`${base}/runner/jobs/${claim.job_id}/complete`, { method: "POST", headers: { ...real, "content-type": "application/json" }, body: JSON.stringify({ conclusion: "success", outputs: {} }) })).status, 200); |
| 1320 | // A finished job's token no longer reads or writes. |
| 1321 | assert.equal(await get(real), 401); |
| 1322 | }); |
| 1323 | |
| 1324 | test("an older runner's artifacts are listed, downloaded and deleted through the REST API", async () => { |
| 1325 | const owner = (await ok("GET", "/user")).login; |
| 1326 | await ok("POST", "/user/repos", { name: "legacy-rest" }); |
| 1327 | const src = join(work, "legacy-rest"); |
| 1328 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1329 | writeFileSync(join(src, ".github/workflows/w.yml"), "on: push\njobs:\n j:\n runs-on: [self-hosted, linux]\n steps: [{ run: echo }]\n"); |
| 1330 | git(src, ["init", "-q", "-b", "main"]); |
| 1331 | git(src, ["add", "-A"]); |
| 1332 | git(src, ["commit", "-q", "-m", "legacy"]); |
| 1333 | git(src, ["remote", "add", "origin", `${base}/${owner}/legacy-rest.git`]); |
| 1334 | git(src, ["push", "-q", "origin", "main"]); |
| 1335 | const claim = await until("a job to claim", async () => { |
| 1336 | const r = await api("POST", `/repos/${owner}/legacy-rest/actions/runners/claim`, { name: "old-runner", labels: ["linux"] }); |
| 1337 | return r.status === 200 ? r.json : null; |
| 1338 | }); |
| 1339 | const h = { authorization: `Bearer ${claim.token}` }; |
| 1340 | const at = `${base}/runner/jobs/${claim.job_id}`; |
| 1341 | assert.equal((await fetch(at, { headers: h })).status, 200); |
| 1342 | for (const name of ["one", "two", "three"]) { |
| 1343 | assert.equal((await fetch(`${at}/artifacts/${name}`, { method: "PUT", headers: { ...h, "content-length": String(name.length) }, body: name })).status, 200); |
| 1344 | } |
| 1345 | const rest = (path, init = {}) => fetch(`${base}/api/v3/repos/${owner}/legacy-rest${path}`, { ...init, headers: { authorization: `Bearer ${token}` } }); |
| 1346 | |
| 1347 | // Listed with numeric ids, across the repository and for the run, a page at a time. |
| 1348 | let r = await rest("/actions/artifacts?per_page=2"); |
| 1349 | let body = await r.json(); |
| 1350 | assert.equal(body.total_count, 3, JSON.stringify(body)); |
| 1351 | assert.equal(body.artifacts.length, 2); |
| 1352 | assert.ok(body.artifacts.every((a) => Number.isSafeInteger(a.id) && a.expired === false), JSON.stringify(body)); |
| 1353 | assert.match(r.headers.get("link") ?? "", /[?&]page=2>; rel="next"/); |
| 1354 | const runId = body.artifacts[0].workflow_run.id; |
| 1355 | r = await rest(`/actions/runs/${runId}/artifacts?per_page=2&page=2`); |
| 1356 | body = await r.json(); |
| 1357 | assert.equal(body.total_count, 3); |
| 1358 | assert.equal(body.artifacts.length, 1); |
| 1359 | assert.match(r.headers.get("link") ?? "", /rel="prev"/); |
| 1360 | assert.doesNotMatch(r.headers.get("link") ?? "", /rel="next"/); |
| 1361 | const two = (await (await rest(`/actions/runs/${runId}/artifacts?name=two`)).json()).artifacts[0]; |
| 1362 | assert.equal((await (await rest(`/actions/artifacts/${two.id}`)).json()).name, "two"); |
| 1363 | |
| 1364 | // The download is the tarball the runner uploaded. |
| 1365 | const zip = await rest(`/actions/artifacts/${two.id}/zip`, { redirect: "manual" }); |
| 1366 | assert.equal(zip.status, 302); |
| 1367 | const blob = await fetch(zip.headers.get("location")); |
| 1368 | assert.equal(blob.status, 200); |
| 1369 | assert.equal(blob.headers.get("content-type"), "application/gzip"); |
| 1370 | assert.match(blob.headers.get("content-disposition") ?? "", /two\.tar\.gz/); |
| 1371 | assert.equal(await blob.text(), "two"); |
| 1372 | |
| 1373 | // Deleting it removes it for the runner too. |
| 1374 | assert.equal((await rest(`/actions/artifacts/${two.id}`, { method: "DELETE" })).status, 204); |
| 1375 | assert.equal((await rest(`/actions/artifacts/${two.id}`)).status, 404); |
| 1376 | assert.equal((await fetch(`${at}/artifacts/two`, { headers: h })).status, 404); |
| 1377 | assert.equal(await (await fetch(`${at}/artifacts/one`, { headers: h })).text(), "one"); |
| 1378 | assert.equal((await (await rest("/actions/artifacts")).json()).total_count, 2); |
| 1379 | assert.equal((await fetch(`${at}/complete`, { method: "POST", headers: { ...h, "content-type": "application/json" }, body: JSON.stringify({ conclusion: "success", outputs: {} }) })).status, 200); |
| 1380 | }); |
| 1381 | |
| 1382 | const hasDocker = spawnSync("docker", ["info"], { stdio: "ignore", timeout: 15_000 }).status === 0; |
| 1383 | |
| 1384 | test("containers: a job container and service containers on a self-hosted runner", { skip: !hasDocker && "Docker is not available" }, async () => { |
| 1385 | const owner = (await ok("GET", "/user")).login; |
| 1386 | await ok("POST", "/user/repos", { name: "boxes" }); |
| 1387 | const src = join(work, "boxes"); |
| 1388 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1389 | // Docker Hub rate-limits anonymous pulls; mirror.gcr.io serves the same official images. |
| 1390 | writeFileSync( |
| 1391 | join(src, ".github/workflows/ci.yml"), |
| 1392 | `on: push |
| 1393 | jobs: |
| 1394 | boxed: |
| 1395 | runs-on: [self-hosted, linux] |
| 1396 | container: |
| 1397 | image: mirror.gcr.io/library/debian:\${{ github.event_name == 'push' && 'bookworm-slim' || 'nope' }} |
| 1398 | services: |
| 1399 | cache: |
| 1400 | image: mirror.gcr.io/library/redis:7-alpine |
| 1401 | options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30 |
| 1402 | steps: |
| 1403 | - run: | |
| 1404 | grep -q bookworm /etc/os-release && echo "inside debian" |
| 1405 | exec 3<>/dev/tcp/cache/6379 |
| 1406 | printf 'PING\\r\\n' >&3 |
| 1407 | read -r line <&3 |
| 1408 | echo "cache answered \${line%$'\\r'}" |
| 1409 | `, |
| 1410 | ); |
| 1411 | git(src, ["init", "-q", "-b", "main"]); |
| 1412 | git(src, ["add", "."]); |
| 1413 | git(src, ["commit", "-q", "-m", "containers"]); |
| 1414 | git(src, ["remote", "add", "origin", `${base}/${owner}/boxes.git`]); |
| 1415 | git(src, ["push", "-q", "origin", "main"]); |
| 1416 | |
| 1417 | const run = await until("boxes run", async () => (await ok("GET", `/repos/${owner}/boxes/actions/runs`)).workflow_runs[0]); |
| 1418 | const boxed = await runOneJob(owner, "boxes"); |
| 1419 | assert.equal(boxed.claim.name, "boxed"); |
| 1420 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/boxes/actions/jobs/${boxed.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 1421 | assert.match(log, /inside debian/); |
| 1422 | assert.match(log, /cache answered \+PONG/); |
| 1423 | const done = await until("boxes run to complete", async () => { |
| 1424 | const r = await ok("GET", `/repos/${owner}/boxes/actions/runs/${run.id}`); |
| 1425 | return r.status === "completed" ? r : null; |
| 1426 | }); |
| 1427 | assert.equal(done.conclusion, "success"); |
| 1428 | }); |
| 1429 | |
| 1430 | // ---------------------------------------------------------------- the official actions, unmodified |
| 1431 | |
| 1432 | // No workflow-level permissions: jobs get the repository default (write), like GitHub's permissive default. |
| 1433 | const TOOLKIT_WORKFLOW = `name: Toolkit |
| 1434 | on: push |
| 1435 | jobs: |
| 1436 | produce: |
| 1437 | runs-on: [self-hosted, linux] |
| 1438 | steps: |
| 1439 | - uses: actions/checkout@v4 |
| 1440 | with: { lfs: true, submodules: true, persist-credentials: false } |
| 1441 | - name: LFS, submodules, no persisted credentials |
| 1442 | run: | |
| 1443 | cat big.bin lib/lib.txt |
| 1444 | git config --get-regexp 'extraheader' || echo "no persisted credentials" |
| 1445 | - uses: actions/checkout@v4 |
| 1446 | with: { path: sparse, sparse-checkout: docs } |
| 1447 | - run: echo "sparse=$(ls sparse | tr '\\n' ' ')" |
| 1448 | - id: real-cache |
| 1449 | uses: actions/cache@v4 |
| 1450 | env: { DIFFINERY_BUILTINS: "false" } |
| 1451 | with: { path: deps, key: "deps-\${{ hashFiles('lock.txt') }}" } |
| 1452 | - if: steps.real-cache.outputs.cache-hit != 'true' |
| 1453 | run: mkdir -p deps && echo "saved by run \${{ github.run_id }}" > deps/marker |
| 1454 | - run: echo "real-hit=\${{ steps.real-cache.outputs.cache-hit }} $(cat deps/marker)" |
| 1455 | - id: builtin-cache |
| 1456 | uses: actions/cache/restore@v4 |
| 1457 | with: { path: deps, key: "deps-\${{ hashFiles('lock.txt') }}", lookup-only: true } |
| 1458 | - id: v3-cache |
| 1459 | uses: actions/cache/restore@v3 |
| 1460 | env: { DIFFINERY_BUILTINS: "false" } |
| 1461 | with: { path: deps, key: "deps-\${{ hashFiles('lock.txt') }}", lookup-only: true } |
| 1462 | - run: echo "builtin-hit=\${{ steps.builtin-cache.outputs.cache-hit }} v3-hit=\${{ steps.v3-cache.outputs.cache-hit }}" |
| 1463 | - run: mkdir -p dist/sub && echo one > dist/one.txt && echo two > dist/sub/two.txt && echo hidden > dist/.hidden |
| 1464 | - id: up-real |
| 1465 | uses: actions/upload-artifact@v4 |
| 1466 | env: { DIFFINERY_BUILTINS: "false" } |
| 1467 | with: { name: dist-real, path: dist/, include-hidden-files: true, retention-days: 3 } |
| 1468 | - id: up-builtin |
| 1469 | uses: actions/upload-artifact@v4 |
| 1470 | with: { name: dist-builtin, path: dist/, compression-level: 0 } |
| 1471 | - run: echo "ids=\${{ steps.up-real.outputs.artifact-id }},\${{ steps.up-builtin.outputs.artifact-id }} url=\${{ steps.up-real.outputs.artifact-url }}" |
| 1472 | consume: |
| 1473 | needs: produce |
| 1474 | runs-on: [self-hosted, linux] |
| 1475 | steps: |
| 1476 | - uses: actions/download-artifact@v4 |
| 1477 | env: { DIFFINERY_BUILTINS: "false" } |
| 1478 | with: { path: all } |
| 1479 | - uses: actions/download-artifact@v4 |
| 1480 | with: { pattern: dist-*, path: merged, merge-multiple: true } |
| 1481 | - uses: actions/download-artifact@v4 |
| 1482 | env: { DIFFINERY_BUILTINS: "false" } |
| 1483 | with: { name: dist-builtin, path: one } |
| 1484 | - run: find all merged one -type f | LC_ALL=C sort | tr '\\n' ' ' |
| 1485 | - uses: actions/checkout@v4 |
| 1486 | with: { path: src } |
| 1487 | - id: prev |
| 1488 | run: echo "id=$(cat src/prev-run.txt 2>/dev/null)" >> "$GITHUB_OUTPUT" |
| 1489 | - if: steps.prev.outputs.id != '' |
| 1490 | uses: actions/download-artifact@v4 |
| 1491 | env: { DIFFINERY_BUILTINS: "false" } |
| 1492 | with: { name: dist-real, path: prev-real, run-id: "\${{ steps.prev.outputs.id }}", github-token: "\${{ github.token }}", repository: "\${{ github.repository }}" } |
| 1493 | - if: steps.prev.outputs.id != '' |
| 1494 | uses: actions/download-artifact@v4 |
| 1495 | with: { pattern: "dist-*", path: prev-builtin, run-id: "\${{ steps.prev.outputs.id }}", github-token: "\${{ github.token }}" } |
| 1496 | - if: steps.prev.outputs.id != '' |
| 1497 | run: echo "previous run $(cat prev-real/sub/two.txt) $(find prev-builtin -type f | LC_ALL=C sort | tr '\\n' ' ')" |
| 1498 | script: |
| 1499 | runs-on: [self-hosted, linux] |
| 1500 | steps: |
| 1501 | - id: gs |
| 1502 | uses: actions/github-script@v7 |
| 1503 | with: |
| 1504 | result-encoding: string |
| 1505 | script: | |
| 1506 | const { owner, repo } = context.repo; |
| 1507 | const label = \`from-run-\${context.runId}\`; |
| 1508 | await github.rest.issues.createLabel({ owner, repo, name: label, color: "ff0000" }); |
| 1509 | const { data: issue } = await github.rest.issues.create({ owner, repo, title: \`Opened by run \${context.runId}\`, body: "hello", labels: [label] }); |
| 1510 | await github.rest.issues.createComment({ owner, repo, issue_number: issue.number, body: "commented by github-script" }); |
| 1511 | const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number: issue.number }); |
| 1512 | const { data: got } = await github.rest.issues.get({ owner, repo, issue_number: issue.number }); |
| 1513 | const { data: pulls } = await github.rest.pulls.list({ owner, repo, state: "all" }); |
| 1514 | await github.rest.repos.createCommitStatus({ owner, repo, sha: context.sha, state: "success", context: "github-script", description: "set with the default GITHUB_TOKEN" }); |
| 1515 | return \`issue=\${issue.number} labels=\${got.labels.map((l) => l.name)} comments=\${comments.length} pulls=\${pulls.length} event=\${context.eventName} repo=\${context.payload.repository.full_name} sender=\${context.payload.sender.login}\`; |
| 1516 | - run: echo "script says $RESULT" |
| 1517 | env: { RESULT: "\${{ steps.gs.outputs.result }}" } |
| 1518 | restricted: |
| 1519 | runs-on: [self-hosted, linux] |
| 1520 | permissions: { contents: read } |
| 1521 | steps: |
| 1522 | - id: gs |
| 1523 | uses: actions/github-script@v7 |
| 1524 | with: |
| 1525 | result-encoding: string |
| 1526 | script: | |
| 1527 | const { owner, repo } = context.repo; |
| 1528 | const { data: meta } = await github.rest.repos.get({ owner, repo }); |
| 1529 | try { |
| 1530 | await github.rest.issues.create({ owner, repo, title: "must not be created" }); |
| 1531 | return "issue write allowed"; |
| 1532 | } catch (e) { |
| 1533 | return \`repo=\${meta.name} issue write -> \${e.status}: \${e.message}\`; |
| 1534 | } |
| 1535 | - run: echo "restricted says $RESULT" |
| 1536 | env: { RESULT: "\${{ steps.gs.outputs.result }}" } |
| 1537 | node: |
| 1538 | runs-on: [self-hosted, linux] |
| 1539 | steps: |
| 1540 | - uses: actions/checkout@v4 |
| 1541 | - id: node |
| 1542 | uses: actions/setup-node@v4 |
| 1543 | with: { node-version: 20, cache: npm } |
| 1544 | - run: npm ci --no-audit --no-fund && echo "node=$(node --version) npm-cache-hit=\${{ steps.node.outputs.cache-hit }}" |
| 1545 | java: |
| 1546 | runs-on: [self-hosted, linux] |
| 1547 | steps: |
| 1548 | - uses: actions/checkout@v4 |
| 1549 | - id: java |
| 1550 | uses: actions/setup-java@v4 |
| 1551 | with: { distribution: oracle, java-version: "21", cache: maven } |
| 1552 | - run: | |
| 1553 | mkdir -p ~/.m2/repository/e2e && echo "run \${{ github.run_id }}" > ~/.m2/repository/e2e/marker |
| 1554 | echo "java=$(java -version 2>&1 | grep version) maven-cache-hit=\${{ steps.java.outputs.cache-hit }} $(cat ~/.m2/repository/e2e/marker)" |
| 1555 | `; |
| 1556 | |
| 1557 | /** Runs every job of `run` with the real agent; returns their logs by job name. */ |
| 1558 | async function runToolkit(owner, run) { |
| 1559 | const home = join(work, "toolkit-home"); |
| 1560 | const logs = {}; |
| 1561 | for (let i = 0; i < 6; i++) { |
| 1562 | const job = await runOneJob(owner, "toolkit", { |
| 1563 | timeoutMs: 420_000, |
| 1564 | envFor: (claim) => { |
| 1565 | // A fresh HOME per job (at the same path, as on hosted runners): caches must come from the cache service. |
| 1566 | rmSync(home, { recursive: true, force: true }); |
| 1567 | mkdirSync(home, { recursive: true }); |
| 1568 | return { |
| 1569 | ...(process.env.E2E_RUNNER_IMAGE ? {} : { HOME: home, RUNNER_TOOL_CACHE: join(work, "toolcache") }), |
| 1570 | // The node job runs every action for real, checkout and setup-node included. |
| 1571 | ...(claim.name === "node" ? { DIFFINERY_DISABLE_BUILTINS: "1" } : {}), |
| 1572 | }; |
| 1573 | }, |
| 1574 | }); |
| 1575 | // Without the timestamps, so assertions can span lines. |
| 1576 | const raw = await (await fetch(`${base}/api/v3/repos/${owner}/toolkit/actions/jobs/${job.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 1577 | logs[job.claim.name] = raw.replace(/^\S+Z /gm, ""); |
| 1578 | // Kept with E2E_KEEP=1 for debugging. |
| 1579 | mkdirSync(join(work, "toolkit-logs"), { recursive: true }); |
| 1580 | writeFileSync(join(work, "toolkit-logs", `run${run.run_number}-${job.claim.name}.log`), `${logs[job.claim.name]}\n--- agent ---\n${job.out}`); |
| 1581 | } |
| 1582 | const done = await until("toolkit run to complete", async () => { |
| 1583 | const r = await ok("GET", `/repos/${owner}/toolkit/actions/runs/${run.id}`); |
| 1584 | return r.status === "completed" ? r : null; |
| 1585 | }); |
| 1586 | assert.equal(done.conclusion, "success", JSON.stringify(logs, null, 2).slice(-8000)); |
| 1587 | return logs; |
| 1588 | } |
| 1589 | |
| 1590 | const toolkit = {}; |
| 1591 | |
| 1592 | test("official actions: checkout, cache, artifacts, github-script and setup-* run unmodified", { timeout: 1_200_000 }, async () => { |
| 1593 | const owner = (await ok("GET", "/user")).login; |
| 1594 | toolkit.owner = owner; |
| 1595 | // A submodule repository, then the main one (LFS object, submodule, sparse-checkout target). |
| 1596 | // Public: like GITHUB_TOKEN, the job token reads only its own repository and public ones. |
| 1597 | await ok("POST", "/user/repos", { name: "toolkit-lib", visibility: "public" }); |
| 1598 | const lib = join(work, "toolkit-lib"); |
| 1599 | mkdirSync(lib, { recursive: true }); |
| 1600 | writeFileSync(join(lib, "lib.txt"), "from the submodule\n"); |
| 1601 | git(lib, ["init", "-q", "-b", "main"]); |
| 1602 | git(lib, ["add", "."]); |
| 1603 | git(lib, ["commit", "-q", "-m", "lib"]); |
| 1604 | git(lib, ["remote", "add", "origin", `${base}/${owner}/toolkit-lib.git`]); |
| 1605 | git(lib, ["push", "-q", "origin", "main"]); |
| 1606 | const libSha = git(lib, ["rev-parse", "HEAD"]).trim(); |
| 1607 | |
| 1608 | await ok("POST", "/user/repos", { name: "toolkit" }); |
| 1609 | // Jobs without permissions: write with the default token (the setting older repositories keep). |
| 1610 | await ok("PUT", `/repos/${owner}/toolkit/actions/permissions/workflow`, { default_workflow_permissions: "write" }); |
| 1611 | const src = join(work, "toolkit"); |
| 1612 | toolkit.src = src; |
| 1613 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1614 | mkdirSync(join(src, "docs")); |
| 1615 | writeFileSync(join(src, ".github/workflows/toolkit.yml"), TOOLKIT_WORKFLOW); |
| 1616 | writeFileSync(join(src, "docs/guide.md"), "# guide\n"); |
| 1617 | writeFileSync(join(src, "README.md"), "# toolkit\n"); |
| 1618 | writeFileSync(join(src, "lock.txt"), "v1\n"); |
| 1619 | writeFileSync(join(src, "package.json"), JSON.stringify({ name: "toolkit", version: "1.0.0", private: true }, null, 2) + "\n"); |
| 1620 | writeFileSync(join(src, "package-lock.json"), JSON.stringify({ name: "toolkit", version: "1.0.0", lockfileVersion: 3, requires: true, packages: { "": { name: "toolkit", version: "1.0.0" } } }, null, 2) + "\n"); |
| 1621 | writeFileSync(join(src, "pom.xml"), "<project><modelVersion>4.0.0</modelVersion><groupId>e2e</groupId><artifactId>toolkit</artifactId><version>1</version></project>\n"); |
| 1622 | writeFileSync(join(src, ".gitmodules"), '[submodule "lib"]\n\tpath = lib\n\turl = ../toolkit-lib.git\n'); |
| 1623 | git(src, ["init", "-q", "-b", "main"]); |
| 1624 | git(src, ["lfs", "install", "--local"]); |
| 1625 | git(src, ["lfs", "track", "*.bin"]); |
| 1626 | writeFileSync(join(src, "big.bin"), "the real LFS content\n"); |
| 1627 | git(src, ["add", "-A"]); |
| 1628 | git(src, ["update-index", "--add", "--cacheinfo", `160000,${libSha},lib`]); |
| 1629 | git(src, ["commit", "-q", "-m", "toolkit"]); |
| 1630 | git(src, ["remote", "add", "origin", `${base}/${owner}/toolkit.git`]); |
| 1631 | git(src, ["push", "-q", "origin", "main"]); |
| 1632 | assert.match(git(src, ["show", "HEAD:big.bin"]), /git-lfs/, "big.bin is stored as an LFS pointer"); |
| 1633 | |
| 1634 | const run = await until("toolkit run", async () => (await ok("GET", `/repos/${owner}/toolkit/actions/runs`)).workflow_runs[0]); |
| 1635 | toolkit.firstRun = run; |
| 1636 | const logs = await runToolkit(owner, run); |
| 1637 | |
| 1638 | // checkout: LFS content, submodule over HTTP with the job token, credentials not persisted, sparse |
| 1639 | assert.match(logs.produce, /the real LFS content\nfrom the submodule/); |
| 1640 | assert.match(logs.produce, /no persisted credentials/); |
| 1641 | assert.match(logs.produce, /sparse=README\.md big\.bin docs lib lock\.txt package-lock\.json package\.json pom\.xml /); |
| 1642 | // cache: a miss on the first run, for the real action and the built-in alike |
| 1643 | assert.match(logs.produce, /real-hit= saved by run 1\b/); |
| 1644 | assert.match(logs.produce, /builtin-hit= v3-hit=/); |
| 1645 | assert.match(logs.produce, /Cache saved with (the )?key: deps-[0-9a-f]{64}/); |
| 1646 | // artifacts: ids from both uploads, the URL points back at this server |
| 1647 | assert.match(logs.produce, new RegExp(`ids=\\d+,\\d+ url=${base}/${owner}/toolkit/actions/runs/1/artifacts/\\d+`)); |
| 1648 | assert.match( |
| 1649 | logs.consume, |
| 1650 | /all\/dist-builtin\/one\.txt all\/dist-builtin\/sub\/two\.txt all\/dist-real\/\.hidden all\/dist-real\/one\.txt all\/dist-real\/sub\/two\.txt merged\/\.hidden merged\/one\.txt merged\/sub\/two\.txt one\/one\.txt one\/sub\/two\.txt/, |
| 1651 | ); |
| 1652 | // github-script: REST calls with the job token |
| 1653 | assert.match(logs.script, /script says issue=1 labels=from-run-1 comments=1 pulls=0 event=push repo=[^/]+\/toolkit sender=\S+/); |
| 1654 | const issue = await ok("GET", `/repos/${owner}/toolkit/issues/1`); |
| 1655 | assert.equal(issue.title, "Opened by run 1"); |
| 1656 | assert.deepEqual(issue.labels.map((l) => l.name), ["from-run-1"]); |
| 1657 | assert.equal((await ok("GET", `/repos/${owner}/toolkit/issues/1/comments`))[0].body, "commented by github-script"); |
| 1658 | const statuses = await ok("GET", `/repos/${owner}/toolkit/commits/${run.head_sha}/statuses`); |
| 1659 | assert.equal(statuses.find((s) => s.context === "github-script")?.state, "success", JSON.stringify(statuses)); |
| 1660 | // `permissions: { contents: read }`: reading works, issue writes are refused |
| 1661 | assert.match(logs.restricted, /restricted says repo=toolkit issue write -> 403: .*issues/); |
| 1662 | assert.equal((await ok("GET", `/repos/${owner}/toolkit/issues?state=all`)).filter((i) => i.title === "must not be created").length, 0); |
| 1663 | // setup-node (the real action, DIFFINERY_DISABLE_BUILTINS=1) and setup-java: installed, caches saved |
| 1664 | assert.match(logs.node, /node=v20\.\d+\.\d+ npm-cache-hit=false/); |
| 1665 | assert.match(logs.node, /Cache saved with (the )?key: node-cache-Linux-x64-npm-[0-9a-f]{64}/); |
| 1666 | assert.match(logs.java, /java=java version "21[^\n]* maven-cache-hit=false run 1/); |
| 1667 | assert.match(logs.java, /Cache saved with (the )?key: setup-java-Linux-x64-maven-[0-9a-f]{64}/); |
| 1668 | |
| 1669 | // the REST API lists the run's artifacts and caches |
| 1670 | const artifacts = await ok("GET", `/repos/${owner}/toolkit/actions/runs/1/artifacts`); |
| 1671 | assert.deepEqual(artifacts.artifacts.map((a) => a.name).sort(), ["dist-builtin", "dist-real"]); |
| 1672 | const caches = await ok("GET", `/repos/${owner}/toolkit/actions/caches`); |
| 1673 | assert.equal(caches.total_count, 3, JSON.stringify(caches)); |
| 1674 | const zip = await fetch(`${base}/api/v3/repos/${owner}/toolkit/actions/artifacts/${artifacts.artifacts[0].id}/zip`, { headers: { authorization: `Bearer ${token}` }, redirect: "manual" }); |
| 1675 | assert.equal(zip.status, 302); |
| 1676 | assert.equal((await fetch(zip.headers.get("location"))).headers.get("content-type"), "application/zip"); |
| 1677 | }); |
| 1678 | |
| 1679 | test("official actions: the second run hits every cache and reads the first run's artifacts", { timeout: 1_200_000 }, async () => { |
| 1680 | const { owner, src, firstRun } = toolkit; |
| 1681 | assert.ok(firstRun, "the first toolkit run must have completed"); |
| 1682 | writeFileSync(join(src, "prev-run.txt"), `${firstRun.run_number}\n`); |
| 1683 | git(src, ["add", "prev-run.txt"]); |
| 1684 | git(src, ["commit", "-q", "-m", "second run"]); |
| 1685 | git(src, ["push", "-q", "origin", "main"]); |
| 1686 | const run = await until("second toolkit run", async () => (await ok("GET", `/repos/${owner}/toolkit/actions/runs`)).workflow_runs.find((r) => r.run_number === 2)); |
| 1687 | const logs = await runToolkit(owner, run); |
| 1688 | |
| 1689 | // The entry the real action saved restores with the real action (v4 and v3) and the built-in. |
| 1690 | assert.match(logs.produce, /real-hit=true saved by run 1\b/); |
| 1691 | assert.match(logs.produce, /builtin-hit=true v3-hit=true/); |
| 1692 | assert.match(logs.produce, /Cache hit occurred on the primary key deps-[0-9a-f]{64}, not saving cache\./); |
| 1693 | assert.match(logs.node, /npm-cache-hit=true/); |
| 1694 | assert.match(logs.java, /maven-cache-hit=true run 2/); |
| 1695 | // Artifacts of another run, through the REST API with github-token (real action and built-in). |
| 1696 | assert.match(logs.consume, /previous run two prev-builtin\/dist-builtin\/one\.txt prev-builtin\/dist-builtin\/sub\/two\.txt prev-builtin\/dist-real\/\.hidden prev-builtin\/dist-real\/one\.txt prev-builtin\/dist-real\/sub\/two\.txt/); |
| 1697 | assert.match(logs.script, /script says issue=2 labels=from-run-2 comments=1/); |
| 1698 | }); |
| 1699 | |
| 1700 | test("D1 sessions: bookmarks for token clients and browsers", async () => { |
| 1701 | // Token clients get the bookmark in a header and can send it back to read their own writes. |
| 1702 | const r = await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}` } }); |
| 1703 | assert.equal(r.status, 200); |
| 1704 | const bookmark = r.headers.get("x-d1-bookmark"); |
| 1705 | assert.match(bookmark ?? "", /^[0-9a-f]+(-[0-9a-f]+)+$/i); |
| 1706 | assert.equal(r.headers.get("set-cookie"), null); |
| 1707 | const again = await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}`, "x-d1-bookmark": bookmark } }); |
| 1708 | assert.equal(again.status, 200); |
| 1709 | // A junk bookmark is ignored rather than breaking the request. |
| 1710 | assert.equal((await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}`, "x-d1-bookmark": "nope" } })).status, 200); |
| 1711 | // Anonymous page views don't get a cookie; a browser that writes (any non-GET) does. |
| 1712 | assert.equal((await fetch(`${base}/`)).headers.get("set-cookie")?.includes("__Host-dfy_d1") ?? false, false); |
| 1713 | const post = await fetch(`${base}/auth/logout`, { method: "POST", redirect: "manual", headers: { "sec-fetch-site": "same-origin" } }); |
| 1714 | assert.match(post.headers.get("set-cookie") ?? "", /__Host-dfy_d1=[0-9a-f-]+; Max-Age=86400; Path=\/; HttpOnly; Secure; SameSite=Lax/); |
| 1715 | }); |
| 1716 | |
| 1717 | test("GitHub REST compatibility: Octokit against releases, statuses, git data, issues, deployments and search", async () => { |
| 1718 | const { Octokit } = await import("@octokit/rest"); |
| 1719 | const gh = new Octokit({ auth: token, baseUrl: `${base}/api/v3`, userAgent: "diffinery-e2e", request: { retries: 0 } }); |
| 1720 | const owner = (await gh.rest.users.getAuthenticated()).data.login; |
| 1721 | const repo = "compat"; |
| 1722 | const R = { owner, repo }; |
| 1723 | |
| 1724 | // ------------------------------------------------------------ repository, pushed with git |
| 1725 | const created = await gh.rest.repos.createForAuthenticatedUser({ name: repo, description: "Octokit compatibility" }); |
| 1726 | assert.equal(created.status, 201); |
| 1727 | assert.equal(created.data.full_name, `${owner}/${repo}`); |
| 1728 | assert.match(created.data.node_id, /\S/); |
| 1729 | assert.equal(created.data.owner.login, owner); |
| 1730 | const src = join(work, "compat"); |
| 1731 | mkdirSync(join(src, "src"), { recursive: true }); |
| 1732 | writeFileSync(join(src, "README.md"), "# compat\n"); |
| 1733 | writeFileSync(join(src, "src/main.ts"), "export const x = 1;\n"); |
| 1734 | git(src, ["init", "-q", "-b", "main"]); |
| 1735 | git(src, ["add", "-A"]); |
| 1736 | git(src, ["commit", "-q", "-m", "initial"]); |
| 1737 | git(src, ["remote", "add", "origin", `${base}/${owner}/${repo}.git`]); |
| 1738 | git(src, ["push", "-q", "origin", "main"]); |
| 1739 | const mainSha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 1740 | |
| 1741 | const r = await gh.rest.repos.get(R); |
| 1742 | assert.equal(r.data.default_branch, "main"); |
| 1743 | assert.equal(r.data.permissions.admin, true); |
| 1744 | assert.equal(r.headers["x-github-media-type"], "github.v3; format=json"); |
| 1745 | const rate = await gh.rest.rateLimit.get(); |
| 1746 | assert.ok(rate.data.resources.core.remaining > 0); |
| 1747 | |
| 1748 | // GitHub error bodies: message and documentation_url, surfaced by Octokit's RequestError. |
| 1749 | await assert.rejects(gh.rest.repos.getContent({ ...R, path: "missing.txt" }), (e) => e.status === 404 && typeof e.response.data.message === "string" && typeof e.response.data.documentation_url === "string"); |
| 1750 | |
| 1751 | // ------------------------------------------------------------ contents |
| 1752 | const readme = await gh.rest.repos.getContent({ ...R, path: "README.md" }); |
| 1753 | assert.equal(readme.data.type, "file"); |
| 1754 | assert.equal(Buffer.from(readme.data.content, "base64").toString(), "# compat\n"); |
| 1755 | const rawReadme = await gh.rest.repos.getContent({ ...R, path: "README.md", mediaType: { format: "raw" } }); |
| 1756 | assert.equal(rawReadme.data, "# compat\n"); |
| 1757 | const dir = await gh.rest.repos.getContent({ ...R, path: "src" }); |
| 1758 | assert.deepEqual(dir.data.map((e) => e.name), ["main.ts"]); |
| 1759 | await assert.rejects(gh.rest.repos.createOrUpdateFileContents({ ...R, path: "README.md", message: "stale", content: Buffer.from("x").toString("base64"), sha: "0".repeat(40) }), (e) => e.status === 409); |
| 1760 | const put = await gh.rest.repos.createOrUpdateFileContents({ ...R, path: "README.md", message: "Update README", content: Buffer.from("# compat\n\nUpdated.\n").toString("base64"), sha: readme.data.sha, committer: { name: "Release Bot", email: "bot@example.com" } }); |
| 1761 | assert.equal(put.status, 200); |
| 1762 | assert.equal(put.data.commit.committer.name, "Release Bot"); |
| 1763 | const added = await gh.rest.repos.createOrUpdateFileContents({ ...R, path: "docs/guide.md", message: "Add guide", content: Buffer.from("guide\n").toString("base64") }); |
| 1764 | assert.equal(added.status, 201); |
| 1765 | const readmeApi = await gh.rest.repos.getReadme(R); |
| 1766 | assert.equal(readmeApi.data.path, "README.md"); |
| 1767 | |
| 1768 | // ------------------------------------------------------------ git data: blob -> tree -> commit -> ref, then git sees it |
| 1769 | const headSha = (await gh.rest.git.getRef({ ...R, ref: "heads/main" })).data.object.sha; |
| 1770 | assert.equal(headSha, added.data.commit.sha); |
| 1771 | const blob = await gh.rest.git.createBlob({ ...R, content: Buffer.from("made with the git data API\n").toString("base64"), encoding: "base64" }); |
| 1772 | assert.equal(blob.status, 201); |
| 1773 | assert.equal(Buffer.from((await gh.rest.git.getBlob({ ...R, file_sha: blob.data.sha })).data.content, "base64").toString(), "made with the git data API\n"); |
| 1774 | const headCommit = await gh.rest.git.getCommit({ ...R, commit_sha: headSha }); |
| 1775 | const tree = await gh.rest.git.createTree({ ...R, base_tree: headCommit.data.tree.sha, tree: [{ path: "gitdata/hello.txt", mode: "100644", type: "blob", sha: blob.data.sha }, { path: "inline.txt", mode: "100644", type: "blob", content: "inline\n" }] }); |
| 1776 | const full = await gh.rest.git.getTree({ ...R, tree_sha: tree.data.sha, recursive: "true" }); |
| 1777 | assert.ok(full.data.tree.some((e) => e.path === "gitdata/hello.txt" && e.type === "blob")); |
| 1778 | assert.ok(full.data.tree.some((e) => e.path === "src/main.ts")); |
| 1779 | const commit = await gh.rest.git.createCommit({ ...R, message: "Commit from the git data API", tree: tree.data.sha, parents: [headSha], author: { name: "Diffy", email: "diffy@example.com", date: "2024-05-06T07:08:09Z" } }); |
| 1780 | assert.equal(commit.data.author.name, "Diffy"); |
| 1781 | assert.deepEqual(commit.data.parents.map((p) => p.sha), [headSha]); |
| 1782 | const ref = await gh.rest.git.createRef({ ...R, ref: "refs/heads/feature", sha: commit.data.sha }); |
| 1783 | assert.equal(ref.data.ref, "refs/heads/feature"); |
| 1784 | assert.equal(ref.data.object.type, "commit"); |
| 1785 | await assert.rejects(gh.rest.git.createRef({ ...R, ref: "refs/heads/feature", sha: commit.data.sha }), (e) => e.status === 422); |
| 1786 | const matching = await gh.rest.git.listMatchingRefs({ ...R, ref: "heads/f" }); |
| 1787 | assert.deepEqual(matching.data.map((x) => x.ref), ["refs/heads/feature"]); |
| 1788 | const tag = await gh.rest.git.createTag({ ...R, tag: "v0.1.0", message: "Annotated tag", object: commit.data.sha, type: "commit", tagger: { name: "Diffy", email: "diffy@example.com", date: "2024-05-06T07:08:09Z" } }); |
| 1789 | await gh.rest.git.createRef({ ...R, ref: "refs/tags/v0.1.0", sha: tag.data.sha }); |
| 1790 | assert.equal((await gh.rest.git.getTag({ ...R, tag_sha: tag.data.sha })).data.object.sha, commit.data.sha); |
| 1791 | assert.equal((await gh.rest.git.getRef({ ...R, ref: "tags/v0.1.0" })).data.object.type, "tag"); |
| 1792 | git(src, ["fetch", "-q", "origin", "feature", "--tags"]); |
| 1793 | assert.equal(git(src, ["show", "FETCH_HEAD:gitdata/hello.txt"]), "made with the git data API\n"); |
| 1794 | assert.equal(git(src, ["cat-file", "-t", "v0.1.0"]).trim(), "tag"); |
| 1795 | |
| 1796 | // ------------------------------------------------------------ commit statuses count as checks, also for required checks |
| 1797 | await ok("PUT", `/repos/${owner}/${repo}/branches/main/protection`, { requirePullRequest: true, requiredChecks: ["ci/external"] }); |
| 1798 | const pr = await gh.rest.pulls.create({ ...R, title: "Feature", head: "feature", base: "main", body: "Adds files" }); |
| 1799 | assert.equal(pr.status, 201); |
| 1800 | const pending = await until("mergeability", async () => { |
| 1801 | const p = (await gh.rest.pulls.get({ ...R, pull_number: pr.data.number })).data; |
| 1802 | return typeof p.mergeable === "boolean" ? p : null; |
| 1803 | }); |
| 1804 | assert.equal(pending.mergeable, true); |
| 1805 | assert.equal(pending.mergeable_state, "blocked"); |
| 1806 | assert.equal(pending.head.sha, commit.data.sha); |
| 1807 | const st = await gh.rest.repos.createCommitStatus({ ...R, sha: commit.data.sha, state: "success", context: "ci/external", description: "External CI passed", target_url: "https://ci.example.com/build/1" }); |
| 1808 | assert.equal(st.status, 201); |
| 1809 | assert.equal(st.data.creator.login, owner); |
| 1810 | await assert.rejects(gh.rest.repos.createCommitStatus({ ...R, sha: commit.data.sha, state: "great" }), (e) => e.status === 422); |
| 1811 | const combined = await gh.rest.repos.getCombinedStatusForRef({ ...R, ref: "feature" }); |
| 1812 | assert.equal(combined.data.state, "success"); |
| 1813 | assert.equal(combined.data.total_count, 1); |
| 1814 | assert.equal(combined.data.statuses[0].context, "ci/external"); |
| 1815 | assert.equal((await gh.rest.repos.listCommitStatusesForRef({ ...R, ref: commit.data.sha })).data.length, 1); |
| 1816 | const clean = (await gh.rest.pulls.get({ ...R, pull_number: pr.data.number })).data; |
| 1817 | assert.equal(clean.mergeable_state, "clean"); |
| 1818 | const prPage = await (await fetch(`${base}/${owner}/${repo}/pull/${pr.data.number}/checks`)).text(); |
| 1819 | assert.match(prPage, /ci\/external/); |
| 1820 | assert.match(prPage, /https:\/\/ci\.example\.com\/build\/1/); |
| 1821 | |
| 1822 | // ------------------------------------------------------------ pull request sub-resources |
| 1823 | const byHead = await gh.rest.pulls.list({ ...R, head: `${owner}:feature`, state: "open" }); |
| 1824 | assert.deepEqual(byHead.data.map((p) => p.number), [pr.data.number]); |
| 1825 | assert.equal((await gh.rest.pulls.list({ ...R, base: "other" })).data.length, 0); |
| 1826 | const assoc = await gh.rest.repos.listPullRequestsAssociatedWithCommit({ ...R, commit_sha: commit.data.sha }); |
| 1827 | assert.deepEqual(assoc.data.map((p) => p.number), [pr.data.number]); |
| 1828 | const rc = await gh.rest.pulls.createReviewComment({ ...R, pull_number: pr.data.number, body: "Why this file?", commit_id: commit.data.sha, path: "inline.txt", line: 1, side: "RIGHT" }); |
| 1829 | assert.equal(rc.status, 201); |
| 1830 | assert.equal(rc.data.path, "inline.txt"); |
| 1831 | const reply = await gh.rest.pulls.createReplyForReviewComment({ ...R, pull_number: pr.data.number, comment_id: rc.data.id, body: "For the test." }); |
| 1832 | assert.equal(reply.data.in_reply_to_id, rc.data.id); |
| 1833 | // Numeric ids, like GitHub's: actions parse them with Number() and pass them back. |
| 1834 | assert.equal(typeof rc.data.id, "number"); |
| 1835 | assert.equal(typeof rc.data.pull_request_review_id, "number"); |
| 1836 | assert.equal((await gh.rest.pulls.listReviewComments({ ...R, pull_number: pr.data.number })).data.length, 2); |
| 1837 | await gh.rest.reactions.createForPullRequestReviewComment({ ...R, comment_id: rc.data.id, content: "eyes" }); |
| 1838 | const merged = await gh.rest.pulls.merge({ ...R, pull_number: pr.data.number, merge_method: "squash" }); |
| 1839 | assert.equal(merged.data.merged, true); |
| 1840 | const merges = await gh.rest.issues.listEventsForTimeline({ ...R, issue_number: pr.data.number }); |
| 1841 | assert.ok(merges.data.some((e) => e.event === "merged")); |
| 1842 | |
| 1843 | // ------------------------------------------------------------ releases and assets |
| 1844 | const rel = await gh.rest.repos.createRelease({ ...R, tag_name: "v1.0.0", target_commitish: "main", name: "First", generate_release_notes: true }); |
| 1845 | assert.equal(rel.status, 201); |
| 1846 | assert.match(rel.data.body, /Full Changelog/); |
| 1847 | assert.match(rel.data.body, /Feature by @/); |
| 1848 | assert.equal(rel.data.author.login, owner); |
| 1849 | assert.match(rel.data.upload_url, /\/api\/uploads\/repos\/.+\/releases\/\d+\/assets\{\?name,label\}$/); |
| 1850 | assert.match(git(src, ["ls-remote", "--tags", "origin"]), /refs\/tags\/v1\.0\.0/); |
| 1851 | const bytes = Buffer.from("hello from a release asset\n"); |
| 1852 | const up = await gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "hello.txt", label: "Greeting", data: bytes, url: rel.data.upload_url, headers: { "content-type": "text/plain", "content-length": bytes.length } }); |
| 1853 | assert.equal(up.status, 201); |
| 1854 | assert.equal(up.data.name, "hello.txt"); |
| 1855 | assert.equal(up.data.size, bytes.length); |
| 1856 | assert.equal(up.data.state, "uploaded"); |
| 1857 | const bin = Buffer.from(randomBytes(70_000)); |
| 1858 | const up2 = await gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "tool linux.bin", data: bin, baseUrl: `${base}/api/uploads`, headers: { "content-type": "application/octet-stream", "content-length": bin.length } }); |
| 1859 | assert.equal(up2.data.name, "tool.linux.bin"); |
| 1860 | await assert.rejects(gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "hello.txt", data: bytes, url: rel.data.upload_url, headers: { "content-type": "text/plain", "content-length": bytes.length } }), (e) => e.status === 422); |
| 1861 | const viaApi = await gh.rest.repos.getReleaseAsset({ ...R, asset_id: up2.data.id, headers: { accept: "application/octet-stream" } }); |
| 1862 | assert.deepEqual(Buffer.from(viaApi.data), bin); |
| 1863 | const browser = await fetch(up.data.browser_download_url); |
| 1864 | assert.equal(browser.status, 200); |
| 1865 | assert.equal(await browser.text(), bytes.toString()); |
| 1866 | assert.match(browser.headers.get("content-disposition") ?? "", /attachment/); |
| 1867 | assert.equal((await gh.rest.repos.getReleaseAsset({ ...R, asset_id: up.data.id })).data.download_count, 1); |
| 1868 | assert.deepEqual((await gh.rest.repos.listReleaseAssets({ ...R, release_id: rel.data.id })).data.map((a) => a.name), ["hello.txt", "tool.linux.bin"]); |
| 1869 | assert.equal((await gh.rest.repos.updateReleaseAsset({ ...R, asset_id: up.data.id, label: "Hello" })).data.label, "Hello"); |
| 1870 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.id, rel.data.id); |
| 1871 | assert.equal((await gh.rest.repos.getReleaseByTag({ ...R, tag: "v1.0.0" })).data.assets.length, 2); |
| 1872 | const notes = await gh.rest.repos.generateReleaseNotes({ ...R, tag_name: "v1.1.0", previous_tag_name: "v1.0.0" }); |
| 1873 | assert.match(notes.data.body, /compare\/v1\.0\.0\.\.\.v1\.1\.0/); |
| 1874 | await gh.rest.reactions.createForRelease({ ...R, release_id: rel.data.id, content: "rocket" }); |
| 1875 | assert.equal((await gh.rest.repos.getRelease({ ...R, release_id: rel.data.id })).data.reactions.rocket, 1); |
| 1876 | |
| 1877 | // Drafts are for writers only; a read-only token sees neither the draft nor its tag lookup. |
| 1878 | const draft = await gh.rest.repos.createRelease({ ...R, tag_name: "v2.0.0-rc.1", name: "Next", draft: true, prerelease: true }); |
| 1879 | assert.equal(draft.data.draft, true); |
| 1880 | const reader = await ok("POST", "/diffinery/tokens", { name: "reader", scopes: ["read"] }, null); |
| 1881 | const ro = new Octokit({ auth: reader.token, baseUrl: `${base}/api/v3`, request: { retries: 0 } }); |
| 1882 | assert.deepEqual((await ro.rest.repos.listReleases(R)).data.map((x) => x.tag_name), ["v1.0.0"]); |
| 1883 | await assert.rejects(ro.rest.repos.getRelease({ ...R, release_id: draft.data.id }), (e) => e.status === 404); |
| 1884 | await assert.rejects(ro.rest.repos.createRelease({ ...R, tag_name: "v9" }), (e) => e.status === 403 || e.status === 404); |
| 1885 | const published = await gh.rest.repos.updateRelease({ ...R, release_id: draft.data.id, draft: false, make_latest: "false" }); |
| 1886 | assert.equal(published.data.draft, false); |
| 1887 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.tag_name, "v1.0.0"); |
| 1888 | await gh.rest.repos.deleteReleaseAsset({ ...R, asset_id: up2.data.id }); |
| 1889 | assert.equal((await fetch(`${base}/${owner}/${repo}/releases/download/v1.0.0/tool.linux.bin`)).status, 404); |
| 1890 | await gh.rest.repos.deleteRelease({ ...R, release_id: published.data.id }); |
| 1891 | await assert.rejects(gh.rest.repos.getReleaseByTag({ ...R, tag: "v2.0.0-rc.1" }), (e) => e.status === 404); |
| 1892 | |
| 1893 | // Archives |
| 1894 | const zipball = await gh.rest.repos.downloadZipballArchive({ ...R, ref: "v1.0.0" }); |
| 1895 | assert.equal(Buffer.from(zipball.data).subarray(0, 2).toString(), "PK"); |
| 1896 | const tarball = await gh.rest.repos.downloadTarballArchive({ ...R, ref: "main" }); |
| 1897 | assert.deepEqual([...Buffer.from(tarball.data).subarray(0, 2)], [0x1f, 0x8b]); |
| 1898 | const tgz = join(work, "compat.tar.gz"); |
| 1899 | writeFileSync(tgz, Buffer.from(tarball.data)); |
| 1900 | assert.match(execFileSync("tar", ["tzf", tgz], { encoding: "utf8" }), /\/gitdata\/hello\.txt/); |
| 1901 | |
| 1902 | // The web UI: releases list, the release page and the form (CSRF, Kumo controls, multipart upload). |
| 1903 | const list = await (await fetch(`${base}/${owner}/${repo}/releases`)).text(); |
| 1904 | assert.match(list, /First/); |
| 1905 | assert.match(list, /hello\.txt/); |
| 1906 | const form = await fetch(`${base}/${owner}/${repo}/releases/new`); |
| 1907 | const html = await form.text(); |
| 1908 | assert.doesNotMatch(html, /<select|type="checkbox"|type="radio"/); |
| 1909 | const csrf = /name="_csrf" value="([^"]+)"/.exec(html)?.[1]; |
| 1910 | const cookie = /dfy_csrf=([^;]+)/.exec(form.headers.get("set-cookie") ?? "")?.[1]; |
| 1911 | assert.ok(csrf && cookie); |
| 1912 | const fd = new FormData(); |
| 1913 | for (const [k, v] of Object.entries({ _csrf: csrf, tag: "", new_tag: "v3.0.0", target: "main", name: "From the web", body: "Notes from the form.", latest: "1", action: "publish" })) fd.append(k, v); |
| 1914 | fd.append("assets", new Blob(["web upload\n"], { type: "text/plain" }), "web.txt"); |
| 1915 | const submit = await fetch(`${base}/${owner}/${repo}/releases`, { method: "POST", body: fd, redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}` } }); |
| 1916 | assert.equal(submit.status, 303, await submit.text()); |
| 1917 | assert.equal(submit.headers.get("location"), `/${owner}/${repo}/releases/tag/v3.0.0`); |
| 1918 | assert.equal(await (await fetch(`${base}/${owner}/${repo}/releases/download/v3.0.0/web.txt`)).text(), "web upload\n"); |
| 1919 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.tag_name, "v3.0.0"); |
| 1920 | assert.match(await (await fetch(`${base}/${owner}/${repo}`)).text(), /From the web/); |
| 1921 | |
| 1922 | // ------------------------------------------------------------ issues: labels, assignees, lock, reactions, events, pagination |
| 1923 | await gh.rest.issues.createLabel({ ...R, name: "bug", color: "d73a4a", description: "Something is broken" }); |
| 1924 | await assert.rejects(gh.rest.issues.createLabel({ ...R, name: "bug", color: "d73a4a" }), (e) => e.status === 422); |
| 1925 | const issue = await gh.rest.issues.create({ ...R, title: "Crash on start", body: "It crashes.", labels: ["bug"], assignees: [owner] }); |
| 1926 | assert.deepEqual(issue.data.labels.map((l) => [l.name, l.color]), [["bug", "d73a4a"]]); |
| 1927 | assert.equal(issue.data.assignees[0].login, owner); |
| 1928 | assert.equal(issue.data.user.login, owner); |
| 1929 | assert.match(issue.data.html_url, new RegExp(`/${owner}/${repo}/issues/${issue.data.number}$`)); |
| 1930 | const n = issue.data.number; |
| 1931 | await gh.rest.issues.addLabels({ ...R, issue_number: n, labels: ["triage"] }); |
| 1932 | assert.deepEqual((await gh.rest.issues.listLabelsOnIssue({ ...R, issue_number: n })).data.map((l) => l.name).sort(), ["bug", "triage"]); |
| 1933 | await gh.rest.issues.removeLabel({ ...R, issue_number: n, name: "triage" }); |
| 1934 | await gh.rest.issues.removeAssignees({ ...R, issue_number: n, assignees: [owner] }); |
| 1935 | await gh.rest.issues.addAssignees({ ...R, issue_number: n, assignees: [owner] }); |
| 1936 | assert.equal((await gh.rest.issues.checkUserCanBeAssigned({ ...R, assignee: owner })).status, 204); |
| 1937 | const comment = await gh.rest.issues.createComment({ ...R, issue_number: n, body: "Same here." }); |
| 1938 | assert.equal(typeof comment.data.id, "number"); |
| 1939 | assert.equal((await gh.rest.issues.getComment({ ...R, comment_id: comment.data.id })).data.body, "Same here."); |
| 1940 | await gh.rest.issues.updateComment({ ...R, comment_id: comment.data.id, body: "Same here!" }); |
| 1941 | assert.equal((await gh.rest.issues.getComment({ ...R, comment_id: String(comment.data.id) })).data.body, "Same here!"); |
| 1942 | await gh.rest.reactions.createForIssue({ ...R, issue_number: n, content: "+1" }); |
| 1943 | const heart = await gh.rest.reactions.createForIssueComment({ ...R, comment_id: comment.data.id, content: "heart" }); |
| 1944 | assert.equal(heart.status, 201); |
| 1945 | assert.equal((await gh.rest.reactions.createForIssueComment({ ...R, comment_id: comment.data.id, content: "heart" })).status, 200); |
| 1946 | assert.deepEqual((await gh.rest.reactions.listForIssue({ ...R, issue_number: n })).data.map((x) => x.content), ["+1"]); |
| 1947 | assert.equal((await gh.rest.issues.get({ ...R, issue_number: n })).data.reactions["+1"], 1); |
| 1948 | await gh.rest.issues.lock({ ...R, issue_number: n, lock_reason: "resolved" }); |
| 1949 | const locked = await gh.rest.issues.get({ ...R, issue_number: n }); |
| 1950 | assert.equal(locked.data.locked, true); |
| 1951 | assert.equal(locked.data.active_lock_reason, "resolved"); |
| 1952 | await gh.rest.issues.unlock({ ...R, issue_number: n }); |
| 1953 | await gh.rest.issues.update({ ...R, issue_number: n, title: "Crash on startup", state: "closed", state_reason: "completed" }); |
| 1954 | const events = (await gh.rest.issues.listEvents({ ...R, issue_number: n })).data.map((e) => e.event); |
| 1955 | for (const e of ["labeled", "unlabeled", "unassigned", "assigned", "locked", "unlocked", "renamed", "closed"]) assert.ok(events.includes(e), `${e} in ${events}`); |
| 1956 | const timeline = (await gh.rest.issues.listEventsForTimeline({ ...R, issue_number: n })).data; |
| 1957 | assert.ok(timeline.some((e) => e.event === "commented" && e.body === "Same here!" && e.id === comment.data.id)); |
| 1958 | assert.ok((await gh.rest.issues.listCommentsForRepo(R)).data.some((x) => x.id === comment.data.id)); |
| 1959 | await gh.rest.issues.deleteComment({ ...R, comment_id: comment.data.id }); |
| 1960 | await assert.rejects(gh.rest.issues.getComment({ ...R, comment_id: comment.data.id }), (e) => e.status === 404); |
| 1961 | |
| 1962 | for (let i = 0; i < 3; i++) await gh.rest.issues.create({ ...R, title: `Paged ${i}` }); |
| 1963 | const page1 = await gh.rest.issues.listForRepo({ ...R, state: "all", per_page: 2 }); |
| 1964 | assert.equal(page1.data.length, 2); |
| 1965 | assert.match(page1.headers.link ?? "", /rel="next"/); |
| 1966 | const all = await gh.paginate(gh.rest.issues.listForRepo, { ...R, state: "all", per_page: 2 }); |
| 1967 | assert.equal(new Set(all.map((x) => x.number)).size, all.length); |
| 1968 | assert.ok(all.length >= 5, `paginated ${all.length} issues and pull requests`); |
| 1969 | |
| 1970 | // ------------------------------------------------------------ search, over readable repositories only |
| 1971 | const found = await until("issue search", async () => { |
| 1972 | const s = await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:issue label:bug crash` }); |
| 1973 | return s.data.total_count ? s.data : null; |
| 1974 | }); |
| 1975 | assert.deepEqual(found.items.map((x) => x.number), [n]); |
| 1976 | assert.equal((await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:pr is:merged` })).data.items[0].number, pr.data.number); |
| 1977 | assert.equal((await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:issue -label:bug Paged`, sort: "created", order: "asc" })).data.items.map((x) => x.title).join(","), "Paged 0,Paged 1,Paged 2"); |
| 1978 | await gh.rest.repos.replaceAllTopics({ ...R, names: ["octokit", "e2e"] }); |
| 1979 | assert.deepEqual((await gh.rest.repos.getAllTopics(R)).data.names, ["octokit", "e2e"]); |
| 1980 | const repos = await gh.rest.search.repos({ q: `topic:octokit user:${owner}` }); |
| 1981 | assert.deepEqual(repos.data.items.map((x) => x.full_name), [`${owner}/${repo}`]); |
| 1982 | assert.ok("TypeScript" in (await gh.rest.repos.listLanguages(R)).data); |
| 1983 | |
| 1984 | // ------------------------------------------------------------ deployments and environments |
| 1985 | const env = await gh.rest.repos.createOrUpdateEnvironment({ ...R, environment_name: "staging" }); |
| 1986 | assert.equal(env.data.name, "staging"); |
| 1987 | const dep = await gh.rest.repos.createDeployment({ ...R, ref: "main", environment: "staging", auto_merge: false, required_contexts: [], payload: { region: "eu" }, description: "Deploy to staging" }); |
| 1988 | assert.equal(dep.status, 201); |
| 1989 | assert.equal(dep.data.sha, (await gh.rest.git.getRef({ ...R, ref: "heads/main" })).data.object.sha); |
| 1990 | assert.deepEqual(dep.data.payload, { region: "eu" }); |
| 1991 | await gh.rest.repos.createDeploymentStatus({ ...R, deployment_id: dep.data.id, state: "in_progress" }); |
| 1992 | const ds = await gh.rest.repos.createDeploymentStatus({ ...R, deployment_id: dep.data.id, state: "success", environment_url: "https://staging.example.com", log_url: "https://ci.example.com/deploy/1" }); |
| 1993 | assert.equal(ds.data.state, "success"); |
| 1994 | assert.deepEqual((await gh.rest.repos.listDeploymentStatuses({ ...R, deployment_id: dep.data.id })).data.map((x) => x.state), ["success", "in_progress"]); |
| 1995 | assert.equal((await gh.rest.repos.listDeployments({ ...R, environment: "staging" })).data.length, 1); |
| 1996 | assert.ok((await gh.rest.repos.getAllEnvironments(R)).data.environments.some((e) => e.name === "staging")); |
| 1997 | await gh.rest.actions.createEnvironmentVariable({ ...R, environment_name: "staging", name: "REGION", value: "eu" }); |
| 1998 | assert.equal((await gh.rest.actions.getEnvironmentVariable({ ...R, environment_name: "staging", name: "REGION" })).data.value, "eu"); |
| 1999 | await gh.rest.repos.deleteAnEnvironment({ ...R, environment_name: "staging" }); |
| 2000 | |
| 2001 | // ------------------------------------------------------------ repository_dispatch and repository variables |
| 2002 | assert.equal((await gh.rest.repos.createDispatchEvent({ ...R, event_type: "deploy", client_payload: { env: "prod" } })).status, 204); |
| 2003 | await gh.rest.actions.createRepoVariable({ ...R, name: "COLOR", value: "blue" }); |
| 2004 | await gh.rest.actions.updateRepoVariable({ ...R, name: "COLOR", value: "green" }); |
| 2005 | assert.equal((await gh.rest.actions.getRepoVariable({ ...R, name: "COLOR" })).data.value, "green"); |
| 2006 | }); |
| 2007 | |
| 2008 | /** A small opaque RGBA PNG (a gradient), built by hand so the test needs no image tools. */ |
| 2009 | function pngGradient(width, height) { |
| 2010 | const chunk = (type, body) => { |
| 2011 | const out = Buffer.alloc(12 + body.length); |
| 2012 | out.writeUInt32BE(body.length, 0); |
| 2013 | out.write(type, 4, "latin1"); |
| 2014 | body.copy(out, 8); |
| 2015 | out.writeUInt32BE(crc32(out.subarray(4, 8 + body.length)), 8 + body.length); |
| 2016 | return out; |
| 2017 | }; |
| 2018 | const ihdr = Buffer.alloc(13); |
| 2019 | ihdr.writeUInt32BE(width, 0); |
| 2020 | ihdr.writeUInt32BE(height, 4); |
| 2021 | ihdr.set([8, 6, 0, 0, 0], 8); |
| 2022 | const raw = Buffer.alloc((width * 4 + 1) * height); |
| 2023 | for (let y = 0; y < height; y++) |
| 2024 | for (let x = 0; x < width; x++) raw.set([(x * 255) / width, (y * 255) / height, 128, 255], y * (width * 4 + 1) + 1 + x * 4); |
| 2025 | return Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]), chunk("IHDR", ihdr), chunk("IDAT", deflateSync(raw)), chunk("IEND", Buffer.alloc(0))]); |
| 2026 | } |
| 2027 | |
| 2028 | /** Width and height of a lossy or extended WebP, or null when it is not one. */ |
| 2029 | function webpSize(b) { |
| 2030 | if (b.toString("latin1", 0, 4) !== "RIFF" || b.toString("latin1", 8, 12) !== "WEBP") return null; |
| 2031 | const chunk = b.toString("latin1", 12, 16); |
| 2032 | if (chunk === "VP8 ") return { width: b.readUInt16LE(26) & 0x3fff, height: b.readUInt16LE(28) & 0x3fff }; |
| 2033 | if (chunk === "VP8X") return { width: b.readUIntLE(24, 3) + 1, height: b.readUIntLE(27, 3) + 1 }; |
| 2034 | return null; |
| 2035 | } |
| 2036 | |
| 2037 | test("people and profiles: visibility, repository invitations, blank names and usernames", async () => { |
| 2038 | const me = await ok("GET", "/user"); |
| 2039 | // A form post as the signed-in dev user, with the CSRF double-submit pair taken from `page`. |
| 2040 | const submit = async (page, action, fields) => { |
| 2041 | const res = await fetch(`${base}${page}`); |
| 2042 | const csrf = /name="_csrf" value="([^"]+)"/.exec(await res.text())?.[1]; |
| 2043 | const cookie = /dfy_csrf=([^;]+)/.exec(res.headers.get("set-cookie") ?? "")?.[1]; |
| 2044 | assert.ok(csrf && cookie, `no CSRF pair on ${page}`); |
| 2045 | return fetch(`${base}${action}`, { method: "POST", body: new URLSearchParams({ _csrf: csrf, ...fields }), redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}`, "sec-fetch-site": "same-origin" } }); |
| 2046 | }; |
| 2047 | const flashOf = (res) => decodeURIComponent(decodeURIComponent(res.headers.get("set-cookie") ?? "")); |
| 2048 | |
| 2049 | // "internal" is gone: creating and updating refuse it the same way. |
| 2050 | const created = await api("POST", "/user/repos", { name: "people-rules", visibility: "internal" }); |
| 2051 | assert.equal(created.status, 422); |
| 2052 | await ok("POST", "/user/repos", { name: "people-rules" }); |
| 2053 | const patched = await api("PATCH", `/repos/${me.login}/people-rules`, { visibility: "internal" }); |
| 2054 | assert.equal(patched.status, 422); |
| 2055 | assert.equal(created.json.message, patched.json.message); |
| 2056 | assert.deepEqual(created.json.errors, patched.json.errors); |
| 2057 | |
| 2058 | // Inviting the same email to a repository twice (any letter case) is refused. |
| 2059 | const access = `/${me.login}/people-rules/settings/access`; |
| 2060 | const first = await submit(access, `${access}/people`, { who: "newcomer@example.com", role: "read" }); |
| 2061 | assert.equal(first.status, 200, flashOf(first)); |
| 2062 | assert.match(await first.text(), /newcomer@example\.com/); |
| 2063 | const second = await submit(access, `${access}/people`, { who: "NewComer@Example.com", role: "write" }); |
| 2064 | assert.equal(second.status, 303); |
| 2065 | assert.match(flashOf(second), /already has a pending invitation/); |
| 2066 | |
| 2067 | // ...and it can be revoked: on the access page, in the API and over MCP. Then the address can be invited again. |
| 2068 | const mcp = async (name, args) => { |
| 2069 | const r = await fetch(`${base}/mcp`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json", accept: "application/json, text/event-stream" }, body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }) }); |
| 2070 | const { result } = await r.json(); |
| 2071 | assert.equal(result.isError, false, result.content[0].text); |
| 2072 | return result.structuredContent; |
| 2073 | }; |
| 2074 | const repoInvites = async () => ok("GET", `/repos/${me.login}/people-rules/invitations`); |
| 2075 | const [pending] = await repoInvites(); |
| 2076 | assert.equal(pending.email, "newcomer@example.com"); |
| 2077 | assert.match(await (await fetch(`${base}${access}`)).text(), new RegExp(`action="${access}/invites/${pending.id}/revoke"`)); |
| 2078 | const revoked = await submit(access, `${access}/invites/${pending.id}/revoke`, {}); |
| 2079 | assert.match(flashOf(revoked), /Invitation revoked/); |
| 2080 | assert.deepEqual(await repoInvites(), []); |
| 2081 | assert.equal((await submit(access, `${access}/people`, { who: "newcomer@example.com", role: "read" })).status, 200); |
| 2082 | const [again] = await repoInvites(); |
| 2083 | assert.equal((await api("DELETE", `/repos/${me.login}/people-rules/invitations/${again.id}`)).status, 204); |
| 2084 | assert.equal((await api("DELETE", `/repos/${me.login}/people-rules/invitations/${again.id}`)).status, 404); |
| 2085 | await submit(access, `${access}/people`, { who: "newcomer@example.com", role: "read" }); |
| 2086 | const listed = (await mcp("list_invitations", { owner: me.login, repo: "people-rules" })).result; |
| 2087 | assert.deepEqual(listed.map((i) => i.email), ["newcomer@example.com"]); |
| 2088 | assert.equal((await mcp("revoke_invitation", { owner: me.login, repo: "people-rules", invitation_id: listed[0].id })).revoked, true); |
| 2089 | assert.deepEqual(await repoInvites(), []); |
| 2090 | |
| 2091 | // Organization and site invitations too; each revoke only reaches its own kind. |
| 2092 | await ok("POST", "/user/orgs", { login: "revokers" }); |
| 2093 | const orgInvite = await ok("POST", "/orgs/revokers/invitations", { email: "joiner@example.com" }); |
| 2094 | const siteInvite = await ok("POST", "/invitations", { email: "visitor@example.com" }); |
| 2095 | assert.deepEqual((await ok("GET", "/orgs/revokers/invitations")).map((i) => i.id), [orgInvite.id]); |
| 2096 | const site = await ok("GET", "/invitations"); |
| 2097 | assert.ok(site.some((i) => i.id === siteInvite.id) && !site.some((i) => i.id === orgInvite.id)); |
| 2098 | assert.equal((await api("DELETE", `/invitations/${orgInvite.id}`)).status, 404); |
| 2099 | assert.equal((await api("DELETE", `/orgs/revokers/invitations/${siteInvite.id}`)).status, 404); |
| 2100 | assert.equal((await api("DELETE", `/orgs/revokers/invitations/${orgInvite.id}`)).status, 204); |
| 2101 | await ok("POST", "/orgs/revokers/invitations", { email: "joiner@example.com" }); |
| 2102 | const [orgAgain] = (await mcp("list_invitations", { org: "revokers" })).result; |
| 2103 | assert.equal((await mcp("revoke_invitation", { org: "revokers", invitation_id: orgAgain.id })).revoked, true); |
| 2104 | assert.match(await (await fetch(`${base}/settings/admin`)).text(), new RegExp(`/settings/admin/invites/${siteInvite.id}/revoke`)); |
| 2105 | assert.match(flashOf(await submit("/settings/admin", `/settings/admin/invites/${siteInvite.id}/revoke`, {})), /Invitation revoked/); |
| 2106 | assert.ok(!(await ok("GET", "/invitations")).some((i) => i.id === siteInvite.id)); |
| 2107 | |
| 2108 | // A blank display name falls back to the username. |
| 2109 | const saved = await submit("/settings", "/settings/profile", { login: me.login, name: " " }); |
| 2110 | assert.match(flashOf(saved), /Profile saved\./); |
| 2111 | assert.equal((await ok("GET", `/users/${me.login}`)).name, null); |
| 2112 | assert.match(await (await fetch(`${base}/${me.login}`)).text(), new RegExp(`<h1[^>]*>${me.login}</h1>`)); |
| 2113 | |
| 2114 | // Usernames: the browser's pattern and the server agree that dots aren't allowed. |
| 2115 | const settings = await (await fetch(`${base}/settings`)).text(); |
| 2116 | const pattern = /name="login"[^>]*pattern="([^"]+)"/.exec(settings)?.[1]; |
| 2117 | assert.ok(pattern, "the username field has a pattern"); |
| 2118 | assert.equal(new RegExp(`^(?:${pattern.replaceAll("&", "&")})$`, "v").test("dot.name"), false); |
| 2119 | assert.equal((await api("POST", "/user/orgs", { login: "dot.name" })).status, 422); |
| 2120 | }); |
| 2121 | |
| 2122 | test("profile pictures: upload, resize, serve, cache headers and removal", async () => { |
| 2123 | const me = await ok("GET", "/user"); |
| 2124 | const avatar = async (login, query = "") => { |
| 2125 | const r = await fetch(`${base}/api/avatars/${login}${query}`); |
| 2126 | assert.equal(r.status, 200); |
| 2127 | return { type: r.headers.get("content-type"), cache: r.headers.get("cache-control"), csp: r.headers.get("content-security-policy"), body: Buffer.from(await r.arrayBuffer()) }; |
| 2128 | }; |
| 2129 | const put = (path, body, tok = token) => fetch(`${base}/api/v3${path}`, { method: "PUT", headers: { authorization: `Bearer ${tok}`, "content-type": "image/png" }, body }); |
| 2130 | |
| 2131 | // Before any upload: generated initials, also for logins that don't exist. |
| 2132 | const initials = await avatar(me.login, "?s=64"); |
| 2133 | assert.match(initials.type, /^image\/svg\+xml/); |
| 2134 | assert.equal(initials.csp, "default-src 'none'; style-src 'unsafe-inline'"); |
| 2135 | assert.match((await avatar("no-such-user-here")).type, /^image\/svg\+xml/); |
| 2136 | |
| 2137 | // REST upload: a 600×400 PNG becomes centred square WebPs. |
| 2138 | const up = await put("/user/avatar", pngGradient(600, 400)); |
| 2139 | assert.equal(up.status, 200, await up.clone().text()); |
| 2140 | const { avatar_url } = await up.json(); |
| 2141 | const version = new URL(avatar_url).searchParams.get("v"); |
| 2142 | assert.match(version ?? "", /^\d+$/); |
| 2143 | for (const s of [64, 128, 256]) { |
| 2144 | const a = await avatar(me.login, `?s=${s}&v=${version}`); |
| 2145 | assert.equal(a.type, "image/webp"); |
| 2146 | assert.deepEqual(webpSize(a.body), { width: s, height: s }); |
| 2147 | assert.ok(a.body.length < 10_000, `${s}px WebP is ${a.body.length} bytes`); |
| 2148 | assert.match(a.cache, /immutable/); |
| 2149 | } |
| 2150 | const current = await avatar(me.login, "?s=64"); |
| 2151 | assert.equal(current.type, "image/webp"); |
| 2152 | assert.match(current.cache, /max-age=600/); |
| 2153 | |
| 2154 | // Only JPEG, PNG and WebP, sniffed from the bytes. |
| 2155 | const gif = await put("/user/avatar", Buffer.from("GIF89a\x01\x00\x01\x00\x00\x00\x00;", "latin1")); |
| 2156 | assert.equal(gif.status, 422); |
| 2157 | assert.equal((await gif.json()).message, "Use a JPEG, PNG or WebP image."); |
| 2158 | // Read-only tokens can't change a profile. |
| 2159 | const ro = (await ok("POST", "/diffinery/tokens", { name: "ro", scopes: ["read"] }, null)).token; |
| 2160 | assert.equal((await put("/user/avatar", pngGradient(8, 8), ro)).status, 403); |
| 2161 | |
| 2162 | // The web form (multipart, CSRF double-submit) takes the original file and the server resizes it. |
| 2163 | const page = await fetch(`${base}/settings`); |
| 2164 | const csrf = /name="_csrf" value="([^"]+)"/.exec(await page.text())?.[1]; |
| 2165 | const cookie = /dfy_csrf=([^;]+)/.exec(page.headers.get("set-cookie") ?? "")?.[1]; |
| 2166 | assert.ok(csrf && cookie); |
| 2167 | const form = new FormData(); |
| 2168 | form.set("_csrf", csrf); |
| 2169 | form.set("avatar", new Blob([pngGradient(300, 500)], { type: "image/png" }), "me.png"); |
| 2170 | const posted = await fetch(`${base}/settings/avatar`, { method: "POST", body: form, redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}`, "sec-fetch-site": "same-origin" } }); |
| 2171 | assert.equal(posted.status, 303); |
| 2172 | assert.match(decodeURIComponent(decodeURIComponent(posted.headers.get("set-cookie") ?? "")), /"kind":"notice","message":"Profile picture updated\."/); |
| 2173 | const settings = await (await fetch(`${base}/settings`)).text(); |
| 2174 | const newVersion = /\/api\/avatars\/[^"?]+\?s=256&v=(\d+)/.exec(settings)?.[1]; |
| 2175 | assert.ok(newVersion && newVersion !== version, "the settings page links the new version"); |
| 2176 | // An old version's URL gets the current picture, but not as an immutable response. |
| 2177 | assert.match((await avatar(me.login, `?s=64&v=${version}`)).cache, /max-age=600/); |
| 2178 | |
| 2179 | // Organizations: owners (admins get a 403; see the security tests). |
| 2180 | await ok("POST", "/user/orgs", { login: "picture-org" }); |
| 2181 | const org = await put("/orgs/picture-org/avatar", pngGradient(64, 64)); |
| 2182 | assert.equal(org.status, 200, await org.clone().text()); |
| 2183 | assert.equal((await avatar("picture-org", "?s=128")).type, "image/webp"); |
| 2184 | assert.equal((await fetch(`${base}/api/v3/orgs/picture-org/avatar`, { method: "DELETE", headers: { authorization: `Bearer ${token}` } })).status, 200); |
| 2185 | assert.match((await avatar("picture-org", "?s=128")).type, /^image\/svg\+xml/); |
| 2186 | |
| 2187 | // Removal falls back to initials straight away (the cached copies are purged). |
| 2188 | const del = await fetch(`${base}/api/v3/user/avatar`, { method: "DELETE", headers: { authorization: `Bearer ${token}` } }); |
| 2189 | assert.deepEqual(await del.json(), { avatar_url: `${base}/api/avatars/${me.login}` }); |
| 2190 | assert.match((await avatar(me.login, "?s=64")).type, /^image\/svg\+xml/); |
| 2191 | }); |
| 2192 | |
| 2193 | // ---------------------------------------------------------------- GitHub imports |
| 2194 | |
| 2195 | /** Build the fake GitHub's repositories with real git: history with a merged pull request, a draft, a fork head, tags, LFS and an old secret. */ |
| 2196 | function githubFixture(root) { |
| 2197 | const g = (cwd, ...args) => execFileSync("git", args, { cwd, encoding: "utf8", env: { ...process.env, GIT_AUTHOR_NAME: "Octo", GIT_AUTHOR_EMAIL: "octo@example.com", GIT_COMMITTER_NAME: "Octo", GIT_COMMITTER_EMAIL: "octo@example.com" } }).trim(); |
| 2198 | const src = join(root, "work-app"); |
| 2199 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 2200 | g(root, "init", "-q", "-b", "main", src); |
| 2201 | const asset = lfsObject(`binary asset ${randomBytes(8).toString("hex")}\n`); |
| 2202 | writeFileSync(join(src, "README.md"), "# app\n"); |
| 2203 | writeFileSync(join(src, ".gitattributes"), "*.bin filter=lfs diff=lfs merge=lfs -text\n"); |
| 2204 | writeFileSync(join(src, "asset.bin"), asset.pointer); |
| 2205 | // Would start a run on every push if imports fired workflows. |
| 2206 | writeFileSync(join(src, ".github/workflows/ci.yml"), "name: CI\non: [push, pull_request]\njobs:\n build:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo hi\n"); |
| 2207 | // A credential committed long ago (built here so this file has none). |
| 2208 | writeFileSync(join(src, "settings.env"), `AWS_ACCESS_KEY_ID=${"AKIA"}${"Q3EGRK5V7XJZ2MWN"}\n`); |
| 2209 | g(src, "add", "-A"); |
| 2210 | g(src, "-c", "core.hooksPath=/dev/null", "commit", "-q", "-m", "initial"); |
| 2211 | g(src, "tag", "v0.1"); |
| 2212 | g(src, "rm", "-q", "settings.env"); |
| 2213 | g(src, "commit", "-q", "-m", "remove credentials"); |
| 2214 | // Enough data that a small push budget needs several chunks. |
| 2215 | for (let i = 0; i < 4; i++) { |
| 2216 | writeFileSync(join(src, `data${i}.bin.txt`), randomBytes(90 * 1024).toString("base64")); |
| 2217 | g(src, "add", "-A"); |
| 2218 | g(src, "commit", "-q", "-m", `data ${i}`); |
| 2219 | } |
| 2220 | g(src, "checkout", "-q", "-b", "feature"); |
| 2221 | writeFileSync(join(src, "feature.txt"), "feature\n"); |
| 2222 | g(src, "add", "-A"); |
| 2223 | g(src, "commit", "-q", "-m", "feature"); |
| 2224 | const featureSha = g(src, "rev-parse", "HEAD"); |
| 2225 | g(src, "checkout", "-q", "main"); |
| 2226 | g(src, "merge", "-q", "--no-ff", "-m", "Merge pull request #2 from octo/feature", "feature"); |
| 2227 | const mergeSha = g(src, "rev-parse", "HEAD"); |
| 2228 | g(src, "tag", "-a", "v1.0", "-m", "Version 1.0"); |
| 2229 | g(src, "checkout", "-q", "-b", "draft-work"); |
| 2230 | writeFileSync(join(src, "draft.txt"), "wip\n"); |
| 2231 | g(src, "add", "-A"); |
| 2232 | g(src, "commit", "-q", "-m", "draft"); |
| 2233 | const draftSha = g(src, "rev-parse", "HEAD"); |
| 2234 | // A fork's commit: only GitHub's refs/pull/6/head points at it. |
| 2235 | g(src, "checkout", "-q", "--detach", "main"); |
| 2236 | writeFileSync(join(src, "fork.txt"), "from a fork\n"); |
| 2237 | g(src, "add", "-A"); |
| 2238 | g(src, "commit", "-q", "-m", "fork change"); |
| 2239 | const forkSha = g(src, "rev-parse", "HEAD"); |
| 2240 | g(src, "checkout", "-q", "main"); |
| 2241 | const bare = join(root, "octo", "app.git"); |
| 2242 | mkdirSync(join(root, "octo"), { recursive: true }); |
| 2243 | g(root, "clone", "-q", "--bare", src, bare); |
| 2244 | g(bare, "update-ref", "refs/pull/2/head", featureSha); |
| 2245 | g(bare, "update-ref", "refs/pull/2/merge", mergeSha); |
| 2246 | g(bare, "update-ref", "refs/pull/5/head", draftSha); |
| 2247 | g(bare, "update-ref", "refs/pull/6/head", forkSha); |
| 2248 | g(bare, "update-ref", "refs/heads/gh-readonly-queue/main/pr-9-0123456789abcdef", mergeSha); |
| 2249 | // A second repository for the organization import. |
| 2250 | const lib = join(root, "work-lib"); |
| 2251 | g(root, "init", "-q", "-b", "trunk", lib); |
| 2252 | writeFileSync(join(lib, "lib.txt"), "lib\n"); |
| 2253 | g(lib, "add", "-A"); |
| 2254 | g(lib, "commit", "-q", "-m", "lib"); |
| 2255 | g(root, "clone", "-q", "--bare", lib, join(root, "octo", "lib.git")); |
| 2256 | return { asset, featureSha, mergeSha, draftSha, forkSha, mainSha: mergeSha }; |
| 2257 | } |
| 2258 | |
| 2259 | test("import from GitHub: git data, issues and pull requests with their numbers, no side effects", async () => { |
| 2260 | const me = await ok("GET", "/user"); |
| 2261 | const owner = me.login; |
| 2262 | const ghRoot = join(work, "github"); |
| 2263 | const fx = githubFixture(ghRoot); |
| 2264 | const GH_TOKEN = `ghfake${randomBytes(12).toString("hex")}`; |
| 2265 | const t = "2024-01-02T03:04:05Z"; |
| 2266 | const u = (login, id) => ({ login, id, type: "User" }); |
| 2267 | const octoDev = u("octo-dev", 1001); |
| 2268 | const alice = u("alice", 2001); |
| 2269 | const bob = u("bob", 3001); |
| 2270 | let ghBase; |
| 2271 | let linkNonce = ""; // set from the link challenge, then served back in octo-dev's public gist |
| 2272 | let listHuge = false; // the organization lists an oversized repository once set |
| 2273 | const pr = (number, extra) => ({ number, title: `PR ${number}`, body: `Body of #${number}`, state: "open", user: alice, labels: [], assignees: [], milestone: null, locked: false, created_at: t, updated_at: t, closed_at: null, draft: false, merged_at: null, merge_commit_sha: null, requested_reviewers: [], head: { ref: "x", sha: fx.mainSha, label: "octo:x", repo: { full_name: "octo/app" } }, base: { ref: "main", repo: { full_name: "octo/app" } }, ...extra }); |
| 2274 | const issue = (number, extra) => ({ number, title: `Issue ${number}`, body: `Body of #${number}`, state: "open", state_reason: null, user: octoDev, labels: [], assignees: [], milestone: null, locked: false, created_at: t, updated_at: t, closed_at: null, ...extra }); |
| 2275 | const pulls = [ |
| 2276 | pr(2, { title: "Add feature", state: "closed", closed_at: "2024-02-01T00:00:00Z", merged_at: "2024-02-01T00:00:00Z", merge_commit_sha: fx.mergeSha, labels: [{ name: "docs" }], head: { ref: "feature", sha: fx.featureSha, label: "octo:feature", repo: { full_name: "octo/app" } } }), |
| 2277 | pr(5, { title: "Work in progress", draft: true, requested_reviewers: [bob], head: { ref: "draft-work", sha: fx.draftSha, label: "octo:draft-work", repo: { full_name: "octo/app" } } }), |
| 2278 | pr(6, { title: "From a fork", state: "closed", closed_at: "2024-03-01T00:00:00Z", head: { ref: "patch", sha: fx.forkSha, label: "forker:patch", repo: { full_name: "forker/app" } } }), |
| 2279 | ]; |
| 2280 | const issues = [ |
| 2281 | issue(1, { title: "First bug", labels: [{ name: "bug", color: "d73a4a" }], assignees: [octoDev], milestone: { number: 1 } }), |
| 2282 | ...pulls.map((p) => ({ ...p, pull_request: { url: "x" } })), |
| 2283 | issue(3, { title: "Won't fix", user: alice, state: "closed", state_reason: "not_planned", closed_at: "2024-01-05T00:00:00Z", locked: true }), |
| 2284 | // #4 was deleted on GitHub: the number stays unused. |
| 2285 | issue(7, { title: "Latest", user: { login: "ghost-user", id: 9999 } }), |
| 2286 | ]; |
| 2287 | const repoJson = (name, extra) => ({ name, full_name: `octo/${name}`, owner: { login: "octo" }, private: true, visibility: "private", fork: false, archived: false, description: `The ${name}`, homepage: "https://app.example.com", topics: ["demo", "import"], default_branch: "main", ...extra }); |
| 2288 | const empty = []; |
| 2289 | const routes = { |
| 2290 | "GET /user": octoDev, |
| 2291 | // Gist-proof account linking: octo-dev's public profile, their gists, and the gist body with the nonce. |
| 2292 | "GET /users/octo-dev": octoDev, |
| 2293 | "GET /users/octo-dev/gists": () => [{ id: "proofgist", public: true, description: "", files: { "proof.md": { raw_url: `${ghBase}/raw/proofgist` } } }], |
| 2294 | "GET /gists/proofgist": () => ({ files: { "proof.md": { content: `linking to diffinery: ${linkNonce}` } } }), |
| 2295 | "GET /users/octo": { login: "octo", type: "Organization" }, |
| 2296 | "GET /orgs/octo/repos": () => [repoJson("app"), repoJson("lib", { default_branch: "trunk", topics: [] }), ...(listHuge ? [repoJson("huge", { size: 99_999_999 })] : [])].map((r) => ({ ...r, clone_url: `${ghBase}/${r.full_name}.git` })), |
| 2297 | "GET /repos/octo/huge": () => ({ ...repoJson("huge", { size: 99_999_999 }), clone_url: `${ghBase}/octo/huge.git` }), |
| 2298 | // Only ORG_REGION reaches every repository on GitHub; Diffinery's organization variables always do. |
| 2299 | "GET /orgs/octo/actions/variables": { variables: [{ name: "ORG_REGION", value: "eu-west", visibility: "all" }, { name: "ORG_PRIVATE_HOST", value: "internal.example", visibility: "private" }, { name: "ORG_SELECTED_KEY", value: "few", visibility: "selected" }] }, |
| 2300 | "GET /orgs/octo/actions/secrets": { secrets: [{ name: "ORG_DEPLOY_KEY" }] }, |
| 2301 | "GET /repos/octo/app": () => ({ ...repoJson("app"), clone_url: `${ghBase}/octo/app.git`, html_url: `${ghBase}/octo/app` }), |
| 2302 | "GET /repos/octo/app/labels": [{ name: "bug", color: "d73a4a", description: "Something isn't working" }, { name: "docs", color: "0075ca", description: "Documentation" }, { name: "wontfix", color: "ffffff", description: "" }], |
| 2303 | "GET /repos/octo/app/milestones": [{ number: 1, title: "v1", description: "First release", state: "open", due_on: "2030-01-01T00:00:00Z", created_at: t, updated_at: t, closed_at: null, creator: octoDev }], |
| 2304 | "GET /repos/octo/app/pulls": pulls, |
| 2305 | "GET /repos/octo/app/issues": issues, |
| 2306 | "GET /repos/octo/app/issues/comments": () => [ |
| 2307 | { id: 11, body: "I can reproduce this", user: alice, created_at: "2024-01-03T00:00:00Z", updated_at: "2024-01-03T00:00:00Z", issue_url: `${ghBase}/api/v3/repos/octo/app/issues/1` }, |
| 2308 | { id: 12, body: "Thanks!", user: octoDev, created_at: "2024-01-04T00:00:00Z", updated_at: "2024-01-04T00:00:00Z", issue_url: `${ghBase}/api/v3/repos/octo/app/issues/1` }, |
| 2309 | { id: 13, body: "Merging this", user: octoDev, created_at: "2024-01-31T00:00:00Z", updated_at: "2024-01-31T00:00:00Z", issue_url: `${ghBase}/api/v3/repos/octo/app/issues/2` }, |
| 2310 | ], |
| 2311 | "GET /repos/octo/app/pulls/2/reviews": [{ id: 501, user: bob, state: "APPROVED", body: "Looks good", commit_id: fx.featureSha, submitted_at: "2024-01-30T00:00:00Z" }], |
| 2312 | "GET /repos/octo/app/pulls/5/reviews": [{ id: 505, user: octoDev, state: "APPROVED", body: "looks fine", commit_id: fx.draftSha, submitted_at: "2024-01-20T00:00:00Z" }], |
| 2313 | "GET /repos/octo/app/pulls/6/reviews": [{ id: 502, user: alice, state: "PENDING", body: "", commit_id: fx.forkSha, submitted_at: null }], |
| 2314 | "GET /repos/octo/app/pulls/2": { ...pulls[0], merged_by: octoDev }, |
| 2315 | "GET /repos/octo/app/pulls/comments": () => [ |
| 2316 | { id: 601, pull_request_review_id: 501, pull_request_url: `${ghBase}/api/v3/repos/octo/app/pulls/2`, user: bob, body: "Nice file", path: "feature.txt", line: 1, side: "RIGHT", commit_id: fx.featureSha, created_at: "2024-01-30T00:00:00Z", updated_at: "2024-01-30T00:00:00Z" }, |
| 2317 | { id: 602, pull_request_review_id: 503, pull_request_url: `${ghBase}/api/v3/repos/octo/app/pulls/2`, in_reply_to_id: 601, user: alice, body: "Agreed", path: "feature.txt", line: 1, side: "RIGHT", commit_id: fx.featureSha, created_at: "2024-01-30T01:00:00Z", updated_at: "2024-01-30T01:00:00Z" }, |
| 2318 | ], |
| 2319 | "GET /repos/octo/app/branches": [{ name: "main" }], |
| 2320 | "GET /repos/octo/app/branches/main/protection": { required_status_checks: { contexts: ["build"] }, required_pull_request_reviews: { required_approving_review_count: 1, dismiss_stale_reviews: true }, enforce_admins: { enabled: false }, allow_force_pushes: { enabled: false } }, |
| 2321 | "GET /repos/octo/app/actions/variables": { variables: [{ name: "DEPLOY_ENV", value: "staging" }, { name: "REGION", value: "us" }] }, |
| 2322 | "GET /repos/octo/app/actions/secrets": { secrets: [{ name: "NPM_TOKEN" }, { name: "SLACK_WEBHOOK" }] }, |
| 2323 | "GET /repos/octo/app/releases": [{ id: 1, tag_name: "v1.0.0", name: "1.0.0", body: "first release", draft: false, prerelease: false, created_at: "2024-01-01T00:00:00Z", published_at: "2024-01-01T00:00:00Z", author: { login: "octocat", id: 1 }, assets: [] }], |
| 2324 | "GET /repos/octo/lib": () => ({ ...repoJson("lib", { default_branch: "trunk", topics: [] }), clone_url: `${ghBase}/octo/lib.git` }), |
| 2325 | "GET /repos/octo/lib/labels": empty, |
| 2326 | "GET /repos/octo/lib/milestones": empty, |
| 2327 | "GET /repos/octo/lib/pulls": empty, |
| 2328 | "GET /repos/octo/lib/issues": [issue(1, { title: "Lib issue" })], |
| 2329 | "GET /repos/octo/lib/issues/comments": empty, |
| 2330 | "GET /repos/octo/lib/pulls/comments": empty, |
| 2331 | "GET /repos/octo/lib/branches": empty, |
| 2332 | "GET /repos/octo/lib/actions/variables": { variables: [] }, |
| 2333 | "GET /repos/octo/lib/actions/secrets": { secrets: [] }, |
| 2334 | "GET /repos/octo/lib/releases": empty, |
| 2335 | }; |
| 2336 | const gh = fakeGitHub({ root: ghRoot, token: GH_TOKEN, routes, lfs: new Map([[fx.asset.oid, fx.asset.data]]), anonymous: ["octo/lib"] }); |
| 2337 | ghBase = await gh.listen(); |
| 2338 | const apiUrl = `${ghBase}/api/v3`; |
| 2339 | |
| 2340 | /** Run the import agent (the runner image's import mode) for an import waiting for one, like the container would. */ |
| 2341 | const transfer = async (id) => { |
| 2342 | await until(`import ${id} to wait for an agent`, async () => (await ok("GET", `/diffinery/imports/${id}`)).git?.phase === "waiting", 120_000); |
| 2343 | const { token: pushToken } = await ok("POST", `/diffinery/imports/${id}/claim`); |
| 2344 | const r = await spawnAsync(process.execPath, [AGENT], { DIFFINERY_API_URL: base, DIFFINERY_IMPORT_ID: id, DIFFINERY_IMPORT_TOKEN: pushToken, DIFFINERY_IMPORT_CHUNK_BYTES: String(160 * 1024), DIFFINERY_WORK_ROOT: join(work, `import-${id}`) }, 240_000); |
| 2345 | const out = `${r.stdout}${r.stderr}`; |
| 2346 | assert.ok(!out.includes(GH_TOKEN) && !out.includes(pushToken), "the agent never prints tokens"); |
| 2347 | return { ...r, out, pushToken }; |
| 2348 | }; |
| 2349 | const finished = (id, timeout = 180_000) => |
| 2350 | until(`import ${id} to finish`, async () => { |
| 2351 | const r = await ok("GET", `/diffinery/imports/${id}`); |
| 2352 | return ["succeeded", "failed", "cancelled"].includes(r.status) ? r : null; |
| 2353 | }, timeout); |
| 2354 | |
| 2355 | // ------------------------------------------------------------ people: link a GitHub account by gist proof (no token) |
| 2356 | const challenge = await ok("POST", "/diffinery/user/linked-accounts/github/challenge", { api_url: apiUrl }); |
| 2357 | assert.match(challenge.nonce, /^diffinery-link-[0-9a-f]+$/); |
| 2358 | // Before the gist carries the nonce, linking is refused. |
| 2359 | assert.equal((await api("POST", "/diffinery/user/linked-accounts/github", { login: "octo-dev", api_url: apiUrl })).status, 422); |
| 2360 | linkNonce = challenge.nonce; // now octo-dev's public gist contains it |
| 2361 | const link = await ok("POST", "/diffinery/user/linked-accounts/github", { login: "octo-dev", api_url: apiUrl }); |
| 2362 | assert.equal(link.login, "octo-dev"); |
| 2363 | |
| 2364 | // ------------------------------------------------------------ input validation and permissions |
| 2365 | assert.equal((await api("POST", "/diffinery/imports", { source: "octo/app", owner, options: { nope: true }, github_api_url: apiUrl })).status, 422); |
| 2366 | assert.equal((await api("POST", "/diffinery/imports", { source: "octo/app", owner: "nobody-here", github_api_url: apiUrl })).status, 422); |
| 2367 | assert.equal((await api("POST", "/diffinery/imports", { source: "octo/app", owner, github_token: "wrong", github_api_url: apiUrl })).status, 422); |
| 2368 | const bot = (await ok("POST", "/diffinery/agents", { login: "import-bot" }, null)).token.token; |
| 2369 | // An agent may import where its owner may, its owner's own account included: this one gets past |
| 2370 | // the permission check and stops only because the GitHub repository does not exist. |
| 2371 | const botTry = await api("POST", "/diffinery/imports", { source: "octo/missing", owner, github_token: GH_TOKEN, github_api_url: apiUrl }, bot); |
| 2372 | assert.equal(botTry.status, 422, JSON.stringify(botTry.json)); |
| 2373 | assert.match(botTry.json.message, /octo\/missing was not found/); |
| 2374 | |
| 2375 | // ------------------------------------------------------------ one repository |
| 2376 | const started = await ok("POST", "/diffinery/imports", { source: "octo/app", owner, name: "imported-app", github_token: GH_TOKEN, github_api_url: apiUrl }); |
| 2377 | assert.equal(started.status, "queued"); |
| 2378 | assert.ok(!JSON.stringify(started).includes(GH_TOKEN), "the token is never returned"); |
| 2379 | // While the import holds the repository it created, nothing else writes to it: the REST API, the |
| 2380 | // web UI and MCP get 423 Locked (reads still work). The import's own writes go through below. |
| 2381 | await until(`import ${started.id} to wait for an agent`, async () => (await ok("GET", `/diffinery/imports/${started.id}`)).git?.phase === "waiting", 120_000); |
| 2382 | const L = `/repos/${owner}/imported-app`; |
| 2383 | for (const [method, path, body] of [ |
| 2384 | ["POST", `${L}/hooks`, { config: { url: "https://hooks.invalid/import-sink" }, events: ["*"] }], |
| 2385 | ["POST", `${L}/issues`, { title: "too early" }], |
| 2386 | ["PUT", `${L}/contents/early.txt`, { message: "too early", content: Buffer.from("early\n").toString("base64") }], |
| 2387 | ["POST", `${L}/labels`, { name: "early", color: "ffffff" }], |
| 2388 | ["PATCH", L, { description: "changed during the import" }], |
| 2389 | ]) { |
| 2390 | const r = await api(method, path, body); |
| 2391 | assert.equal(r.status, 423, `${method} ${path} -> ${r.status} ${JSON.stringify(r.json)}`); |
| 2392 | assert.match(r.json.message, /locked by an import/); |
| 2393 | } |
| 2394 | assert.equal((await api("GET", `${L}/issues`)).status, 200, "reads are not locked"); |
| 2395 | const csrf = randomBytes(16).toString("hex"); |
| 2396 | const webWrite = await fetch(`${base}/${owner}/imported-app/issues`, { method: "POST", headers: { cookie: `dfy_csrf=${csrf}`, "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ _csrf: csrf, title: "too early" }), redirect: "manual" }); |
| 2397 | assert.equal(webWrite.status, 423, await webWrite.text()); |
| 2398 | const mcpWrite = await fetch(`${base}/mcp`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json", accept: "application/json, text/event-stream" }, body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "create_issue", arguments: { owner, repo: "imported-app", title: "too early" } } }) }).then((r) => r.json()); |
| 2399 | assert.equal(mcpWrite.result.isError, true, JSON.stringify(mcpWrite)); |
| 2400 | assert.match(mcpWrite.result.content[0].text, /locked by an import/); |
| 2401 | const agent = await transfer(started.id); |
| 2402 | assert.equal(agent.status, 0, agent.out); |
| 2403 | const done = await finished(started.id); |
| 2404 | assert.equal(done.status, "succeeded", JSON.stringify(done, null, 2)); |
| 2405 | // No side effects: no workflow runs (ci.yml runs on push and pull_request), no webhook deliveries. |
| 2406 | // The lock is released: a webhook can be added now, and nothing the import queued reaches it. |
| 2407 | const hook = await ok("POST", `/repos/${owner}/imported-app/hooks`, { config: { url: "https://hooks.invalid/import-sink" }, events: ["*"] }); |
| 2408 | await sleep(2000); |
| 2409 | assert.equal((await ok("GET", `/repos/${owner}/imported-app/actions/runs`)).total_count, 0); |
| 2410 | const sink = (await ok("GET", `/repos/${owner}/imported-app/hooks`)).find((h) => h.id === hook.id); |
| 2411 | assert.equal(sink.last_response.code, null, "no webhook was delivered"); |
| 2412 | assert.equal(sink.last_response.status, "unused"); |
| 2413 | assert.ok(done.steps.every((s) => s.status === "done" || s.status === "skipped"), JSON.stringify(done.steps)); |
| 2414 | assert.ok(done.summary.git.chunks >= 3, `history went in chunks: ${JSON.stringify(done.summary.git)}`); |
| 2415 | assert.equal(done.summary.git.branches, 3); |
| 2416 | assert.equal(done.summary.git.tags, 2); |
| 2417 | assert.equal(done.summary.git.lfsObjects, 1); |
| 2418 | assert.deepEqual(done.summary.secretNames, ["NPM_TOKEN", "SLACK_WEBHOOK"]); |
| 2419 | assert.ok(done.summary.findings.some((f) => f.kind === "AWS access key"), "bypassed findings are listed"); |
| 2420 | assert.ok(done.summary.people.imported.includes("alice") && done.summary.people.linked.includes("octo-dev")); |
| 2421 | // Releases are imported over the REST API (not just their tags). |
| 2422 | assert.equal(done.summary.releases?.imported, 1, JSON.stringify(done.summary.releases)); |
| 2423 | const releases = await ok("GET", `/repos/${owner}/imported-app/releases`); |
| 2424 | assert.deepEqual(releases.map((r) => r.tag_name), ["v1.0.0"]); |
| 2425 | |
| 2426 | // Repository settings |
| 2427 | const repo = await ok("GET", `/repos/${owner}/imported-app`); |
| 2428 | assert.equal(repo.visibility, "private"); |
| 2429 | assert.equal(repo.default_branch, "main"); |
| 2430 | assert.equal(repo.description, "The app"); |
| 2431 | assert.equal(repo.homepage, "https://app.example.com"); |
| 2432 | assert.deepEqual(repo.topics, ["demo", "import"]); |
| 2433 | |
| 2434 | // Git: branches, tags and pull request heads; no merge queue branches, merge refs or import refs. |
| 2435 | const refs = Object.fromEntries( |
| 2436 | git(work, ["ls-remote", `${base}/${owner}/imported-app.git`]) |
| 2437 | .trim() |
| 2438 | .split("\n") |
| 2439 | .map((l) => l.split("\t").reverse()), |
| 2440 | ); |
| 2441 | assert.equal(refs["refs/heads/main"], fx.mainSha); |
| 2442 | assert.equal(refs["refs/heads/feature"], fx.featureSha); |
| 2443 | assert.equal(refs["refs/heads/draft-work"], fx.draftSha); |
| 2444 | assert.ok(refs["refs/tags/v1.0"] && refs["refs/tags/v0.1"]); |
| 2445 | assert.equal(refs["refs/pull/2/head"], fx.featureSha); |
| 2446 | assert.equal(refs["refs/pull/5/head"], fx.draftSha); |
| 2447 | assert.equal(refs["refs/pull/6/head"], fx.forkSha); |
| 2448 | assert.ok(!Object.keys(refs).some((r) => r.startsWith("refs/heads/gh-readonly-queue/") || r.startsWith("refs/diffinery-import/") || r === "refs/pull/2/merge"), Object.keys(refs).join("\n")); |
| 2449 | const copy = join(work, "imported-app"); |
| 2450 | git(work, ["clone", "-q", "--mirror", `${base}/${owner}/imported-app.git`, copy], token, { env: { ...process.env, GIT_LFS_SKIP_SMUDGE: "1", GIT_TERMINAL_PROMPT: "0" } }); |
| 2451 | git(copy, ["fsck", "--no-progress"]); |
| 2452 | git(copy, ["cat-file", "-e", fx.forkSha]); |
| 2453 | // The LFS object is stored in Diffinery. |
| 2454 | const lfsRes = await fetch(`${base}/${owner}/imported-app.git/info/lfs/objects/batch`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/vnd.git-lfs+json" }, body: JSON.stringify({ operation: "download", objects: [{ oid: fx.asset.oid, size: fx.asset.data.length }] }) }); |
| 2455 | const lfsBody = await lfsRes.json(); |
| 2456 | assert.ok(lfsBody.objects[0].actions?.download, `${JSON.stringify(lfsBody)}\n${JSON.stringify(done.warnings)}\n${agent.out}\n${devLog.split("\n").filter((l) => /lfs|rror/i.test(l)).slice(-40).join("\n")}`); |
| 2457 | const blob = await fetch(lfsBody.objects[0].actions.download.href, { headers: { authorization: `Bearer ${token}` } }); |
| 2458 | assert.equal(Buffer.from(await blob.arrayBuffer()).toString(), fx.asset.data.toString()); |
| 2459 | // The push token is revoked. |
| 2460 | assert.equal((await api("GET", "/user", undefined, agent.pushToken)).status, 401); |
| 2461 | |
| 2462 | // Issues keep their numbers, people, state and dates. |
| 2463 | const i1 = await ok("GET", `/repos/${owner}/imported-app/issues/1`); |
| 2464 | assert.equal(i1.title, "First bug"); |
| 2465 | assert.equal(i1.user.login, owner, "a linked GitHub account maps to its Diffinery account"); |
| 2466 | assert.deepEqual(i1.assignees.map((a) => a.login), [owner]); |
| 2467 | assert.deepEqual(i1.labels.map((l) => l.name), ["bug"]); |
| 2468 | assert.equal(i1.milestone.title, "v1"); |
| 2469 | assert.equal(i1.created_at, t); |
| 2470 | const i3 = await ok("GET", `/repos/${owner}/imported-app/issues/3`); |
| 2471 | assert.equal(i3.state, "closed"); |
| 2472 | assert.equal(i3.state_reason, "not_planned"); |
| 2473 | assert.equal(i3.user.login, "github:alice"); |
| 2474 | assert.equal((await api("GET", `/repos/${owner}/imported-app/issues/4`)).status, 404, "a deleted GitHub issue leaves its number unused"); |
| 2475 | const c1 = await ok("GET", `/repos/${owner}/imported-app/issues/1/comments`); |
| 2476 | assert.deepEqual(c1.map((c) => [c.user.login, c.body, c.created_at]), [["github:alice", "I can reproduce this", "2024-01-03T00:00:00Z"], [owner, "Thanks!", "2024-01-04T00:00:00Z"]]); |
| 2477 | // Pull requests: merged state, who merged, reviews and line comments with replies. |
| 2478 | const p2 = await ok("GET", `/repos/${owner}/imported-app/pulls/2`); |
| 2479 | assert.equal(p2.merged, true); |
| 2480 | assert.equal(p2.merged_by.login, owner); |
| 2481 | assert.equal(p2.merge_commit_sha, fx.mergeSha); |
| 2482 | assert.equal(p2.head.ref, "feature"); |
| 2483 | assert.equal(p2.head.sha, fx.featureSha); |
| 2484 | const reviews = await ok("GET", `/repos/${owner}/imported-app/pulls/2/reviews`); |
| 2485 | assert.deepEqual(reviews.map((r) => [r.user.login, r.state, r.body]), [["github:bob", "APPROVED", "Looks good"]]); |
| 2486 | const lineComments = await ok("GET", `/repos/${owner}/imported-app/pulls/2/comments`); |
| 2487 | assert.equal(lineComments.length, 2); |
| 2488 | assert.equal(lineComments[0].path, "feature.txt"); |
| 2489 | assert.equal(lineComments[1].in_reply_to_id, lineComments[0].id); |
| 2490 | const p5 = await ok("GET", `/repos/${owner}/imported-app/pulls/5`); |
| 2491 | assert.equal(p5.draft, true); |
| 2492 | assert.equal(p5.state, "open"); |
| 2493 | assert.deepEqual(p5.requested_reviewers.map((r) => r.login), ["github:bob"]); |
| 2494 | // M1: an imported review is history, not a vote — even when its author is a linked Diffinery account. |
| 2495 | const r5 = await ok("GET", `/repos/${owner}/imported-app/pulls/5/reviews`); |
| 2496 | assert.deepEqual(r5.map((r) => [r.user.login, r.state]), [[owner, "APPROVED"]], "the imported approval is kept as history"); |
| 2497 | assert.equal(p5.approvals, 0, "an imported approval does not count toward the required approvals"); |
| 2498 | assert.equal(p5.required_approvals, 1); |
| 2499 | const p6 = await ok("GET", `/repos/${owner}/imported-app/pulls/6`); |
| 2500 | assert.equal(p6.head.ref, "forker:patch"); |
| 2501 | assert.equal(p6.head.sha, fx.forkSha); |
| 2502 | assert.equal(p6.merged, false); |
| 2503 | // A pull request from a fork runs the fork's code, so its jobs get what GitHub gives them: |
| 2504 | // a read-only token and no secrets. |
| 2505 | assert.equal((await api("PUT", `/repos/${owner}/imported-app/actions/secrets/DEPLOY_KEY`, { value: "never-for-forks" })).status, 204); |
| 2506 | await ok("PATCH", `/repos/${owner}/imported-app/pulls/6`, { state: "open" }); |
| 2507 | const forkJob = await until("the fork pull request's job", async () => { |
| 2508 | const r = await api("POST", `/repos/${owner}/imported-app/actions/runners/claim`, { name: "fork-runner", labels: ["linux"] }); |
| 2509 | return r.status === 200 ? r.json : null; |
| 2510 | }); |
| 2511 | const forkSpec = await (await fetch(`${base}/runner/jobs/${forkJob.job_id}`, { headers: { authorization: `Bearer ${forkJob.token}` } })).json(); |
| 2512 | assert.equal(forkSpec.github.event_name, "pull_request"); |
| 2513 | assert.deepEqual(Object.keys(forkSpec.secrets).sort(), ["DIFFINERY_TOKEN", "GITHUB_TOKEN"]); |
| 2514 | assert.equal((await api("POST", `/repos/${owner}/imported-app/issues`, { title: "from a fork's job" }, forkJob.token)).status, 403); |
| 2515 | await fetch(`${base}/runner/jobs/${forkJob.job_id}/complete`, { method: "POST", headers: { authorization: `Bearer ${forkJob.token}`, "content-type": "application/json" }, body: JSON.stringify({ conclusion: "success", outputs: {} }) }); |
| 2516 | await ok("PATCH", `/repos/${owner}/imported-app/pulls/6`, { state: "closed" }); |
| 2517 | // New issues continue after the highest imported number. |
| 2518 | assert.equal((await ok("POST", `/repos/${owner}/imported-app/issues`, { title: "After import" })).number, 8); |
| 2519 | // Labels, milestones, protection, variables. |
| 2520 | const labels = await ok("GET", `/repos/${owner}/imported-app/labels`); |
| 2521 | { |
| 2522 | const bug = labels.find((l) => l.name === "bug"); |
| 2523 | assert.deepEqual([bug.name, bug.color, bug.description], ["bug", "d73a4a", "Something isn't working"]); |
| 2524 | } |
| 2525 | const milestones = await ok("GET", `/repos/${owner}/imported-app/milestones?state=all`); |
| 2526 | assert.equal(milestones.length, 1); |
| 2527 | assert.equal(milestones[0].due_on, "2030-01-01T00:00:00Z"); |
| 2528 | assert.equal(milestones[0].open_issues, 1); |
| 2529 | const protection = await ok("GET", `/repos/${owner}/imported-app/branches/main/protection`); |
| 2530 | assert.match(JSON.stringify(protection), /CI \/ build/); |
| 2531 | const vars = await ok("GET", `/repos/${owner}/imported-app/actions/variables`); |
| 2532 | assert.deepEqual(vars.variables.map((v) => [v.name, v.value]).sort(), [["DEPLOY_ENV", "staging"], ["REGION", "us"]]); |
| 2533 | assert.ok((await ok("GET", "/diffinery/imports")).some((x) => x.id === started.id)); |
| 2534 | |
| 2535 | // ------------------------------------------------------------ secrets policy "stop" fails with a clear message |
| 2536 | const strict = await ok("POST", "/diffinery/imports", { source: "octo/app", owner, name: "strict-app", github_token: GH_TOKEN, github_api_url: apiUrl, options: { secrets: "stop", issues: false } }); |
| 2537 | const strictAgent = await transfer(strict.id); |
| 2538 | assert.equal(strictAgent.status, 1, strictAgent.out); |
| 2539 | assert.match(strictAgent.out, /secret/i); |
| 2540 | const strictDone = await finished(strict.id); |
| 2541 | assert.equal(strictDone.status, "failed"); |
| 2542 | assert.match(strictDone.error, /secrets/); |
| 2543 | |
| 2544 | // ------------------------------------------------------------ a whole organization, into an organization |
| 2545 | await ok("POST", "/user/orgs", { login: "acme-imports" }); |
| 2546 | const bulk = await ok("POST", "/diffinery/imports", { source_owner: "octo", owner: "acme-imports", github_token: GH_TOKEN, github_api_url: apiUrl, concurrency: 2, options: { lfs: false } }); |
| 2547 | assert.equal(bulk.kind, "organization"); |
| 2548 | assert.deepEqual(bulk.children.map((ch) => ch.source).sort(), ["octo/app", "octo/lib"]); |
| 2549 | for (const ch of bulk.children) assert.equal((await transfer(ch.id)).status, 0); |
| 2550 | const bulkDone = await finished(bulk.id, 300_000); |
| 2551 | assert.equal(bulkDone.status, "succeeded", JSON.stringify(bulkDone, null, 2)); |
| 2552 | assert.deepEqual(bulkDone.summary.orgSecretNames, ["ORG_DEPLOY_KEY"]); |
| 2553 | const orgVars = await ok("GET", "/orgs/acme-imports/actions/variables"); |
| 2554 | assert.deepEqual(orgVars.variables.map((v) => [v.name, v.value]), [["ORG_REGION", "eu-west"]]); |
| 2555 | assert.ok(bulkDone.warnings.some((w) => /ORG_PRIVATE_HOST/.test(w)) && bulkDone.warnings.some((w) => /ORG_SELECTED_KEY/.test(w)), JSON.stringify(bulkDone.warnings)); |
| 2556 | assert.equal((await ok("GET", "/repos/acme-imports/lib")).default_branch, "trunk"); |
| 2557 | assert.equal((await ok("GET", "/repos/acme-imports/lib/issues/1")).title, "Lib issue"); |
| 2558 | assert.equal((await ok("GET", "/repos/acme-imports/app/pulls/2")).merged, true); |
| 2559 | |
| 2560 | // ------------------------------------------------------------ without a token: everything public comes across, variables are skipped |
| 2561 | // GitHub answers Actions variables, secrets and environments only with a token (401 otherwise). |
| 2562 | const anon = await ok("POST", "/diffinery/imports", { source: "octo/lib", owner, name: "anon-lib", github_api_url: apiUrl, options: { lfs: false } }); |
| 2563 | assert.equal((await transfer(anon.id)).status, 0); |
| 2564 | const anonDone = await finished(anon.id); |
| 2565 | assert.equal(anonDone.status, "succeeded", JSON.stringify(anonDone, null, 2)); |
| 2566 | const anonVars = anonDone.steps.find((st) => st.name === "variables"); |
| 2567 | assert.equal(anonVars.status, "skipped", JSON.stringify(anonDone.steps)); |
| 2568 | assert.match(anonVars.message, /needs a GitHub token/); |
| 2569 | assert.ok(anonDone.warnings.some((w) => /variables, secret names and environments were not imported/.test(w)), JSON.stringify(anonDone.warnings)); |
| 2570 | assert.equal((await ok("GET", `/repos/${owner}/anon-lib/issues/1`)).title, "Lib issue"); |
| 2571 | assert.equal((await ok("GET", `/repos/${owner}/anon-lib`)).default_branch, "trunk"); |
| 2572 | |
| 2573 | // ------------------------------------------------------------ an agent's organization import cannot touch variables (H1) |
| 2574 | const agentBulk = await api("POST", "/diffinery/imports", { source_owner: "octo", owner: "acme-imports", github_token: GH_TOKEN, github_api_url: apiUrl, concurrency: 1, options: { lfs: false } }, bot); |
| 2575 | assert.equal(agentBulk.status, 201, JSON.stringify(agentBulk.json)); |
| 2576 | const agentBulkDone = await finished(agentBulk.json.id, 180_000); |
| 2577 | const orgStep = agentBulkDone.steps.find((s) => s.name === "organization"); |
| 2578 | assert.equal(orgStep.status, "skipped", JSON.stringify(agentBulkDone.steps)); |
| 2579 | assert.match(orgStep.message, /agents cannot manage variables/); |
| 2580 | // The organization's variable is untouched by the agent import. |
| 2581 | assert.deepEqual((await ok("GET", "/orgs/acme-imports/actions/variables")).variables.map((v) => v.name), ["ORG_REGION"]); |
| 2582 | |
| 2583 | // ------------------------------------------------------------ a retry onto a repository adopted since is refused (H2) |
| 2584 | await ok("POST", `/repos/${owner}/strict-app/issues`, { title: "adopted after the failed import" }); |
| 2585 | await ok("POST", `/diffinery/imports/${strict.id}/retry`, { github_token: GH_TOKEN }); |
| 2586 | const reDone = await finished(strict.id); |
| 2587 | assert.equal(reDone.status, "failed"); |
| 2588 | assert.match(reDone.error, /holds content|start a new import/); |
| 2589 | |
| 2590 | // ------------------------------------------------------------ a stale (revoked) import push token cannot push in import mode (M4) |
| 2591 | const stalePush = gitFails(copy, ["push", `${base}/${owner}/imported-app.git`, "--push-option=diffinery-import", "refs/heads/main:refs/heads/stale-attempt"], agent.pushToken); |
| 2592 | assert.match(stalePush, /401|403|denied|forbidden|authentication|fatal/i, stalePush); |
| 2593 | |
| 2594 | // ------------------------------------------------------------ an organization import holds each repository to the size limit |
| 2595 | listHuge = true; |
| 2596 | const hugeBulk = await ok("POST", "/diffinery/imports", { source_owner: "octo", repositories: ["huge"], owner: "acme-imports", github_token: GH_TOKEN, github_api_url: apiUrl, concurrency: 1, options: { lfs: false } }); |
| 2597 | const hugeChild = await until("the oversized repository to be refused", async () => { |
| 2598 | const ch = (await ok("GET", `/diffinery/imports/${hugeBulk.id}`)).children?.find((c) => c.source === "octo/huge"); |
| 2599 | return ch?.status === "failed" ? ch : ch?.git?.phase === "waiting" ? Promise.reject(new Error("the oversized repository was queued for transfer")) : null; |
| 2600 | }, 120_000); |
| 2601 | assert.match(hugeChild.error ?? (await ok("GET", `/diffinery/imports/${hugeChild.id}`)).error, /import limit/); |
| 2602 | assert.equal((await api("GET", "/repos/acme-imports/huge")).status, 404); |
| 2603 | await finished(hugeBulk.id); |
| 2604 | |
| 2605 | // ------------------------------------------------------------ the web UI (signed in via DEV_AUTH) |
| 2606 | for (const path of ["/new/import", "/imports", `/imports/${started.id}`, `/imports/${started.id}/secrets`, `/imports/${bulk.id}`, "/settings/linked-accounts", `/${owner}/imported-app/issues/1`, `/${owner}/imported-app/pull/2`]) { |
| 2607 | const res = await fetch(`${base}${path}`); |
| 2608 | const html = await res.text(); |
| 2609 | assert.equal(res.status, 200, `${path} -> ${res.status}\n${html.slice(0, 500)}`); |
| 2610 | assert.ok(!/<select|type="checkbox"|type="radio"/.test(html.replace(/<template[\s\S]*?<\/template>/g, "")) || path.startsWith(`/${owner}`), `${path} renders Kumo controls, not native ones`); |
| 2611 | } |
| 2612 | assert.match(await (await fetch(`${base}/imports/${started.id}`)).text(), /NPM_TOKEN/); |
| 2613 | assert.match(await (await fetch(`${base}/${owner}/imported-app/issues/1`)).text(), /v1/); |
| 2614 | assert.match(await (await fetch(`${base}/${owner}/imported-app/issues/3`)).text(), /alice/); |
| 2615 | await gh.close(); |
| 2616 | }); |
| 2617 | |
| 2618 | test("scheduled workflows: the schedule fires without a cron trigger", async () => { |
| 2619 | assert.ok(tickRepo, "the schedule was registered"); |
| 2620 | const runs = await until("a scheduled run", async () => { |
| 2621 | const r = await ok("GET", `/repos/${tickRepo}/actions/runs?event=schedule`); |
| 2622 | return r.total_count > 0 && r.workflow_runs; |
| 2623 | }, 150_000); |
| 2624 | assert.equal(runs[0].event, "schedule"); |
| 2625 | assert.equal(runs[0].path, ".github/workflows/tick.yml"); |
| 2626 | assert.equal(runs[0].actor.login, "diffinery-scheduler"); |
| 2627 | // One run per tick, never two for the same minute. |
| 2628 | const minutes = runs.map((r) => r.created_at.slice(0, 16)); |
| 2629 | assert.equal(new Set(minutes).size, minutes.length, `two runs in one tick: ${minutes.join(", ")}`); |
| 2630 | // Site admins can see the scheduler's state (the live test reports it when no run comes). |
| 2631 | const state = await ok("GET", "/diffinery/admin/scheduler"); |
| 2632 | assert.equal(state.tick_minutes, 1); |
| 2633 | assert.ok(state.last_tick_at && state.covered_until, JSON.stringify(state)); |
| 2634 | assert.ok(Date.parse(state.next_tick_at) > Date.parse(state.last_tick_at), JSON.stringify(state)); |
| 2635 | // A push without the schedule removes it. |
| 2636 | const src = join(work, "schedules"); |
| 2637 | rmSync(join(src, ".github/workflows/tick.yml")); |
| 2638 | git(src, ["commit", "-q", "-am", "no schedule"]); |
| 2639 | git(src, ["push", "-q", `${base}/${tickRepo}.git`, "main"]); |
| 2640 | }); |