| 1 | // End-to-end: a real `wrangler dev` Worker, the real git CLI and the real runner agent. |
| 2 | // |
| 3 | // pnpm --filter @diffinery/runner build && pnpm --filter @diffinery/app e2e |
| 4 | // |
| 5 | // Covers: token auth, repo creation, git push/clone/fetch (protocol v2), push |
| 6 | // protection, workflows triggered by push and pull_request and executed by a |
| 7 | // self-hosted runner (the same agent that runs in Cloudflare Containers), |
| 8 | // check runs, branch protection with required checks and human review for |
| 9 | // agent-authored PRs, merging, the REST contents API, the MCP server and |
| 10 | // profile pictures (WASM image processing in the Worker). |
| 11 | import { spawn, spawnSync, execFileSync } from "node:child_process"; |
| 12 | import { mkdtempSync, writeFileSync, mkdirSync, readFileSync, existsSync, rmSync } from "node:fs"; |
| 13 | import { tmpdir } from "node:os"; |
| 14 | import { randomBytes } from "node:crypto"; |
| 15 | import { join, dirname, resolve } from "node:path"; |
| 16 | import { fileURLToPath } from "node:url"; |
| 17 | import { createServer } from "node:net"; |
| 18 | import { crc32, deflateSync } from "node:zlib"; |
| 19 | import { test, before, after } from "node:test"; |
| 20 | import assert from "node:assert/strict"; |
| 21 | |
| 22 | const APP = resolve(dirname(fileURLToPath(import.meta.url)), "../.."); |
| 23 | const AGENT = resolve(APP, "../../containers/runner/dist/agent.mjs"); |
| 24 | const work = mkdtempSync(join(tmpdir(), "diffinery-e2e-")); |
| 25 | let base; |
| 26 | let dev; |
| 27 | let devLog = ""; |
| 28 | let token; |
| 29 | let agentToken; |
| 30 | |
| 31 | const freePort = () => |
| 32 | new Promise((res) => { |
| 33 | const s = createServer(); |
| 34 | s.listen(0, "127.0.0.1", () => { |
| 35 | const { port } = s.address(); |
| 36 | s.close(() => res(port)); |
| 37 | }); |
| 38 | }); |
| 39 | |
| 40 | async function api(method, path, body, tok = token) { |
| 41 | const res = await fetch(`${base}/api/v3${path}`, { |
| 42 | method, |
| 43 | headers: { authorization: `Bearer ${tok}`, "content-type": "application/json" }, |
| 44 | body: body === undefined ? undefined : JSON.stringify(body), |
| 45 | }); |
| 46 | const text = await res.text(); |
| 47 | let json = null; |
| 48 | try { |
| 49 | json = text ? JSON.parse(text) : null; |
| 50 | } catch { |
| 51 | json = text; |
| 52 | } |
| 53 | return { status: res.status, json }; |
| 54 | } |
| 55 | async function ok(method, path, body, tok) { |
| 56 | const r = await api(method, path, body, tok); |
| 57 | assert.ok(r.status >= 200 && r.status < 300, `${method} ${path} -> ${r.status} ${JSON.stringify(r.json)}`); |
| 58 | return r.json; |
| 59 | } |
| 60 | |
| 61 | function git(cwd, args, tok = token, opts = {}) { |
| 62 | const auth = Buffer.from(`x-token:${tok}`).toString("base64"); |
| 63 | return execFileSync("git", ["-c", `http.extraHeader=Authorization: Basic ${auth}`, "-c", "protocol.version=2", ...args], { |
| 64 | cwd, |
| 65 | encoding: "utf8", |
| 66 | stdio: ["ignore", "pipe", "pipe"], |
| 67 | env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_AUTHOR_NAME: "E2E", GIT_AUTHOR_EMAIL: "e2e@example.com", GIT_COMMITTER_NAME: "E2E", GIT_COMMITTER_EMAIL: "e2e@example.com" }, |
| 68 | ...opts, |
| 69 | }); |
| 70 | } |
| 71 | function gitFails(cwd, args, tok) { |
| 72 | try { |
| 73 | git(cwd, args, tok); |
| 74 | } catch (e) { |
| 75 | return `${e.stdout ?? ""}${e.stderr ?? ""}`; |
| 76 | } |
| 77 | assert.fail(`expected git ${args.join(" ")} to fail`); |
| 78 | } |
| 79 | |
| 80 | const sleep = (ms) => new Promise((r) => setTimeout(r, ms)); |
| 81 | async function until(what, fn, timeoutMs = 60_000) { |
| 82 | const end = Date.now() + timeoutMs; |
| 83 | let last; |
| 84 | while (Date.now() < end) { |
| 85 | last = await fn(); |
| 86 | if (last) return last; |
| 87 | await sleep(500); |
| 88 | } |
| 89 | assert.fail(`timed out waiting for ${what}\n--- wrangler log tail ---\n${devLog.slice(-4000)}`); |
| 90 | } |
| 91 | |
| 92 | function spawnAsync(cmd, args, env, timeoutMs) { |
| 93 | return new Promise((done) => { |
| 94 | const child = spawn(cmd, args, { env: { ...process.env, ...env } }); |
| 95 | let stdout = ""; |
| 96 | let stderr = ""; |
| 97 | child.stdout.on("data", (d) => (stdout += d)); |
| 98 | child.stderr.on("data", (d) => (stderr += d)); |
| 99 | const t = setTimeout(() => child.kill("SIGKILL"), timeoutMs); |
| 100 | child.on("close", (status) => { |
| 101 | clearTimeout(t); |
| 102 | done({ status, stdout, stderr }); |
| 103 | }); |
| 104 | }); |
| 105 | } |
| 106 | |
| 107 | /** |
| 108 | * Claim one waiting self-hosted job and run it with the real agent. |
| 109 | * `envFor(claim)` adds environment for the agent (e.g. HOME, DIFFINERY_DISABLE_BUILTINS). |
| 110 | */ |
| 111 | async function runOneJob(owner, repo, { allowFailure = false, envFor = () => ({}), timeoutMs = 180_000, labels = ["linux"] } = {}) { |
| 112 | const claim = await until("a job to claim", async () => { |
| 113 | const r = await api("POST", `/repos/${owner}/${repo}/actions/runners/claim`, { name: "e2e", labels }); |
| 114 | return r.status === 200 ? r.json : null; |
| 115 | }); |
| 116 | const jobEnv = { ...envFor(claim), DIFFINERY_API_URL: claim.api_url, DIFFINERY_JOB_ID: claim.job_id, DIFFINERY_JOB_TOKEN: claim.token }; |
| 117 | // E2E_RUNNER_IMAGE runs the job inside the real runner image instead of the local agent bundle. |
| 118 | const image = process.env.E2E_RUNNER_IMAGE; |
| 119 | // Spawned asynchronously: a blocked event loop leaves undici holding keep-alive sockets the server already closed. |
| 120 | const r = image |
| 121 | ? await spawnAsync("docker", ["run", "--rm", "--network", "host", ...Object.entries(jobEnv).flatMap(([k, v]) => ["-e", `${k}=${v}`]), image], {}, timeoutMs + 120_000) |
| 122 | : await spawnAsync(process.execPath, [AGENT], { ...process.env, ...jobEnv, DIFFINERY_WORK_ROOT: join(work, `job-${claim.job_id}`) }, timeoutMs); |
| 123 | const out = `${r.stdout}${r.stderr}`; |
| 124 | if (r.status !== 0 && !allowFailure) { |
| 125 | const log = await fetch(`${base}/api/v3/repos/${owner}/${repo}/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } }).then((x) => x.text(), (e) => String(e)); |
| 126 | const job = await api("GET", `/repos/${owner}/${repo}/actions/jobs/${claim.job_id}`).catch((e) => ({ json: String(e) })); |
| 127 | assert.fail(`runner agent exited ${r.status}:\n${out}\n--- job ---\n${JSON.stringify(job.json, null, 2)}\n--- job log ---\n${log}\n--- wrangler log tail ---\n${devLog.slice(-3000)}`); |
| 128 | } |
| 129 | return { claim, out }; |
| 130 | } |
| 131 | |
| 132 | before(async () => { |
| 133 | assert.ok(existsSync(AGENT), `build the runner first: pnpm --filter @diffinery/runner build (missing ${AGENT})`); |
| 134 | const port = await freePort(); |
| 135 | base = `http://127.0.0.1:${port}`; |
| 136 | const persist = join(work, "state"); |
| 137 | execFileSync("pnpm", ["exec", "wrangler", "d1", "migrations", "apply", "diffinery-dev", "--local", "-e", "dev", "--persist-to", persist], { cwd: APP, stdio: "pipe", env: { ...process.env, CI: "1" } }); |
| 138 | // Until the web UI exists, run the same app through the API-only entry. |
| 139 | const entry = existsSync(join(APP, "src/web/routes.tsx")) ? [] : ["test/e2e/entry.ts"]; |
| 140 | dev = spawn("pnpm", ["exec", "wrangler", "dev", ...entry, "-e", "dev", "--ip", "127.0.0.1", "--port", String(port), "--inspector-port", String(await freePort()), "--persist-to", persist, "--var", `PUBLIC_URL:${base}`, "--var", `MASTER_KEY:${randomBytes(32).toString("base64")}`, "--show-interactive-dev-session=false"], { |
| 141 | cwd: APP, |
| 142 | env: { ...process.env, CI: "1", WRANGLER_SEND_METRICS: "false" }, |
| 143 | stdio: ["ignore", "pipe", "pipe"], |
| 144 | detached: true, |
| 145 | }); |
| 146 | dev.stdout.on("data", (d) => (devLog += d)); |
| 147 | dev.stderr.on("data", (d) => (devLog += d)); |
| 148 | await until("wrangler dev", async () => { |
| 149 | try { |
| 150 | return (await fetch(`${base}/healthz`)).ok; |
| 151 | } catch { |
| 152 | return false; |
| 153 | } |
| 154 | }, 120_000); |
| 155 | // DEV_AUTH signs requests without credentials in as dev@diffinery.local; mint a real token for everything else. |
| 156 | const res = await fetch(`${base}/api/v3/diffinery/tokens`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "e2e", scopes: ["admin"] }) }); |
| 157 | assert.equal(res.status, 201, await res.clone().text()); |
| 158 | token = (await res.json()).token; |
| 159 | }); |
| 160 | |
| 161 | after(() => { |
| 162 | if (dev?.pid) { |
| 163 | try { |
| 164 | process.kill(-dev.pid, "SIGTERM"); |
| 165 | } catch {} |
| 166 | } |
| 167 | if (process.env.E2E_KEEP !== "1") rmSync(work, { recursive: true, force: true }); |
| 168 | }); |
| 169 | |
| 170 | test("git hosting, Actions, protected PR flow and MCP", async () => { |
| 171 | const me = await ok("GET", "/user"); |
| 172 | const owner = me.login; |
| 173 | assert.ok(me.site_admin, "dev user is a bootstrap admin"); |
| 174 | |
| 175 | // ------------------------------------------------------------ repo + first push |
| 176 | const repo = await ok("POST", "/user/repos", { name: "demo", description: "e2e" }); |
| 177 | assert.equal(repo.full_name, `${owner}/demo`); |
| 178 | const src = join(work, "src"); |
| 179 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 180 | writeFileSync(join(src, "README.md"), "# demo\n"); |
| 181 | writeFileSync(join(src, "app.txt"), "one\ntwo\nthree\n"); |
| 182 | writeFileSync( |
| 183 | join(src, ".github/workflows/ci.yml"), |
| 184 | `name: CI |
| 185 | on: |
| 186 | push: |
| 187 | branches: [main] |
| 188 | pull_request: |
| 189 | jobs: |
| 190 | build: |
| 191 | runs-on: [self-hosted, linux] |
| 192 | steps: |
| 193 | - uses: actions/checkout@v4 |
| 194 | - name: Check files |
| 195 | run: | |
| 196 | test -f README.md |
| 197 | echo "event=\${{ github.event_name }} sha=\${{ github.sha }}" |
| 198 | grep -q bad app.txt && { echo "found bad line"; exit 1; } || true |
| 199 | - id: out |
| 200 | run: echo "lines=$(wc -l < app.txt | tr -d ' ')" >> "$GITHUB_OUTPUT" |
| 201 | - run: echo "app.txt has \${{ steps.out.outputs.lines }} lines" |
| 202 | `, |
| 203 | ); |
| 204 | git(src, ["init", "-q", "-b", "main"]); |
| 205 | git(src, ["add", "-A"]); |
| 206 | git(src, ["commit", "-q", "-m", "initial"]); |
| 207 | git(src, ["remote", "add", "origin", `${base}/${owner}/demo.git`]); |
| 208 | git(src, ["push", "-q", "origin", "main"]); |
| 209 | const mainSha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 210 | |
| 211 | const branch = await ok("GET", `/repos/${owner}/demo/branches/main`); |
| 212 | assert.equal(branch.commit.sha, mainSha); |
| 213 | |
| 214 | // ------------------------------------------------------------ the push ran CI on a self-hosted runner |
| 215 | const pushRun = await until("push run", async () => (await ok("GET", `/repos/${owner}/demo/actions/runs?event=push`)).workflow_runs[0]); |
| 216 | assert.equal(pushRun.head_sha, mainSha); |
| 217 | const job1 = await runOneJob(owner, "demo"); |
| 218 | const finished = await until("push run to complete", async () => { |
| 219 | const r = await ok("GET", `/repos/${owner}/demo/actions/runs/${pushRun.id}`); |
| 220 | return r.status === "completed" ? r : null; |
| 221 | }); |
| 222 | assert.equal(finished.conclusion, "success", job1.out); |
| 223 | const logs = await (await fetch(`${base}/api/v3/repos/${owner}/demo/actions/jobs/${job1.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 224 | assert.match(logs, /event=push/); |
| 225 | assert.match(logs, /app\.txt has 3 lines/); |
| 226 | const checks = await ok("GET", `/repos/${owner}/demo/commits/${mainSha}/check-runs`); |
| 227 | assert.equal(checks.check_runs.find((c) => c.name === "CI / build")?.conclusion, "success"); |
| 228 | |
| 229 | // ------------------------------------------------------------ clone over protocol v2 |
| 230 | const clone = join(work, "clone"); |
| 231 | git(work, ["clone", "-q", `${base}/${owner}/demo.git`, clone]); |
| 232 | assert.equal(readFileSync(join(clone, "app.txt"), "utf8"), "one\ntwo\nthree\n"); |
| 233 | |
| 234 | // ------------------------------------------------------------ secrets are blocked on push |
| 235 | // The key below is a fake that push protection must block in the pushed file; this |
| 236 | // marker exempts only the test source itself: diffinery:allow-secret |
| 237 | writeFileSync(join(clone, "config.env"), "AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPL3\n"); |
| 238 | git(clone, ["add", "-A"]); |
| 239 | git(clone, ["commit", "-q", "-m", "oops"]); |
| 240 | assert.match(gitFails(clone, ["push", "origin", "main"]), /secret|AWS/i); |
| 241 | // Objects from a blocked push are not kept, so retrying (even with push negotiation) is blocked too. |
| 242 | assert.match(gitFails(clone, ["-c", "push.negotiate=true", "push", "origin", "HEAD:refs/heads/fixture"]), /secret|AWS/i); |
| 243 | // A repository admin can push anyway by giving a reason; the bypass is audited. |
| 244 | assert.match(gitFails(clone, ["push", "-o", "allow-secrets=", "origin", "HEAD:refs/heads/fixture"]), /secret|AWS/i); |
| 245 | git(clone, ["push", "-q", "-o", "allow-secrets=fake key used by this test", "origin", "HEAD:refs/heads/fixture"]); |
| 246 | assert.ok((await ok("GET", `/repos/${owner}/demo/branches`)).some((b) => b.name === "fixture")); |
| 247 | git(clone, ["push", "-q", "origin", ":refs/heads/fixture"]); |
| 248 | git(clone, ["reset", "-q", "--hard", "origin/main"]); |
| 249 | |
| 250 | // ------------------------------------------------------------ protect main: PR + green CI + review |
| 251 | await ok("PUT", `/repos/${owner}/demo/branches/main/protection`, { |
| 252 | requirePullRequest: true, |
| 253 | requiredApprovals: 0, |
| 254 | dismissStaleReviews: true, |
| 255 | requiredChecks: ["CI / build"], |
| 256 | allowForcePush: false, |
| 257 | allowDeletion: false, |
| 258 | requireLinearHistory: false, |
| 259 | enforceAdmins: true, |
| 260 | agentsMayPush: false, |
| 261 | agentsMayMerge: false, |
| 262 | }); |
| 263 | writeFileSync(join(clone, "app.txt"), "one\ntwo\nthree\nfour\n"); |
| 264 | git(clone, ["commit", "-q", "-am", "direct push"]); |
| 265 | assert.match(gitFails(clone, ["push", "origin", "main"]), /pull request|protected/i); |
| 266 | git(clone, ["reset", "-q", "--hard", "origin/main"]); |
| 267 | |
| 268 | // ------------------------------------------------------------ an AI agent opens a PR |
| 269 | const created = await ok("POST", "/diffinery/agents", { login: "e2e-bot", name: "E2E Bot" }); |
| 270 | agentToken = created.token.token; |
| 271 | const agentClone = join(work, "agent"); |
| 272 | git(work, ["clone", "-q", `${base}/${owner}/demo.git`, agentClone], agentToken); |
| 273 | git(agentClone, ["checkout", "-q", "-b", "feature"], agentToken); |
| 274 | writeFileSync(join(agentClone, "app.txt"), "one\ntwo\nthree\nfour\n"); |
| 275 | git(agentClone, ["commit", "-q", "-am", "Add a fourth line"], agentToken); |
| 276 | assert.match(gitFails(agentClone, ["push", "origin", "HEAD:main"], agentToken), /agent|protected|pull request/i); |
| 277 | // push.negotiate=true makes git run a protocol v2 fetch with wait-for-done before pushing. |
| 278 | const negotiated = spawnSync("git", ["-c", `http.extraHeader=Authorization: Basic ${Buffer.from(`x-token:${agentToken}`).toString("base64")}`, "-c", "protocol.version=2", "-c", "push.negotiate=true", "push", "-q", "origin", "feature"], { cwd: agentClone, encoding: "utf8", env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } }); |
| 279 | assert.equal(negotiated.status, 0, negotiated.stderr); |
| 280 | assert.doesNotMatch(negotiated.stderr, /negotiation failed|unexpected/i); |
| 281 | const pr = await ok("POST", `/repos/${owner}/demo/pulls`, { title: "Add a fourth line", head: "feature", base: "main", intent: "Extend app.txt for the e2e test" }, agentToken); |
| 282 | assert.equal(pr.number, 1); |
| 283 | |
| 284 | // The pull_request run executes; until then the PR is blocked on the required check. |
| 285 | let m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 286 | assert.equal(m.mergeable, false); |
| 287 | await runOneJob(owner, "demo"); |
| 288 | await until("PR check to pass", async () => { |
| 289 | const r = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 290 | return r.checks?.length > 0 && r.checks.every((c) => c.state === "success") ? r : null; |
| 291 | }); |
| 292 | m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 293 | assert.equal(m.mergeable, false, "agent-authored PRs need a human approval"); |
| 294 | assert.ok(JSON.stringify(m.blockers).match(/approv|human/i), JSON.stringify(m.blockers)); |
| 295 | |
| 296 | // The agent cannot approve or merge its own work. |
| 297 | const agentMerge = await api("PUT", `/repos/${owner}/demo/pulls/1/merge`, { merge_method: "squash" }, agentToken); |
| 298 | assert.ok([403, 405, 409].includes(agentMerge.status), JSON.stringify(agentMerge)); |
| 299 | |
| 300 | // Another agent's approval is advisory and does not unblock the merge. |
| 301 | const reviewer = (await ok("POST", "/diffinery/agents", { login: "e2e-reviewer" })).token.token; |
| 302 | await ok("POST", `/repos/${owner}/demo/pulls/1/reviews`, { event: "APPROVE", body: "bot says ok" }, reviewer); |
| 303 | assert.equal((await ok("GET", `/repos/${owner}/demo/pulls/1/merge`)).mergeable, false); |
| 304 | |
| 305 | // A human reviews (line comment + approval) and merges. |
| 306 | await ok("POST", `/repos/${owner}/demo/pulls/1/reviews`, { event: "APPROVE", body: "LGTM", comments: [{ path: "app.txt", line: 4, body: "nice line" }] }); |
| 307 | m = await ok("GET", `/repos/${owner}/demo/pulls/1/merge`); |
| 308 | assert.equal(m.mergeable, true, JSON.stringify(m)); |
| 309 | const merged = await ok("PUT", `/repos/${owner}/demo/pulls/1/merge`, { merge_method: "squash", delete_branch: true }); |
| 310 | assert.ok(merged.sha); |
| 311 | const prAfter = await ok("GET", `/repos/${owner}/demo/pulls/1`); |
| 312 | assert.equal(prAfter.merged, true); |
| 313 | |
| 314 | // ------------------------------------------------------------ fetch the merge, read through REST |
| 315 | git(clone, ["pull", "-q", "--ff-only", "origin", "main"]); |
| 316 | assert.equal(readFileSync(join(clone, "app.txt"), "utf8"), "one\ntwo\nthree\nfour\n"); |
| 317 | const content = await ok("GET", `/repos/${owner}/demo/contents/app.txt`); |
| 318 | assert.equal(Buffer.from(content.content, "base64").toString(), "one\ntwo\nthree\nfour\n"); |
| 319 | const branches = await ok("GET", `/repos/${owner}/demo/branches`); |
| 320 | assert.ok(!branches.some((b) => b.name === "feature"), "head branch deleted after merge"); |
| 321 | |
| 322 | // ------------------------------------------------------------ shallow clone, then deepen |
| 323 | const shallow = join(work, "shallow"); |
| 324 | git(work, ["clone", "-q", "--depth", "1", `${base}/${owner}/demo.git`, shallow]); |
| 325 | assert.equal(git(shallow, ["rev-list", "--count", "HEAD"]).trim(), "1"); |
| 326 | assert.equal(readFileSync(join(shallow, "app.txt"), "utf8"), "one\ntwo\nthree\nfour\n"); |
| 327 | git(shallow, ["fetch", "-q", "--unshallow"]); |
| 328 | assert.equal(git(shallow, ["rev-list", "--count", "HEAD"]).trim(), "2"); |
| 329 | git(shallow, ["fsck", "--no-progress"]); |
| 330 | |
| 331 | // ------------------------------------------------------------ MCP: the agent works without git |
| 332 | const rpc = async (method, params, id = 1) => { |
| 333 | const r = await fetch(`${base}/mcp`, { method: "POST", headers: { authorization: `Bearer ${agentToken}`, "content-type": "application/json", accept: "application/json, text/event-stream" }, body: JSON.stringify({ jsonrpc: "2.0", id, method, params }) }); |
| 334 | assert.equal(r.status, 200); |
| 335 | return (await r.json()).result; |
| 336 | }; |
| 337 | const init = await rpc("initialize", { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "e2e", version: "1" } }); |
| 338 | assert.equal(init.serverInfo.name, "diffinery"); |
| 339 | const tools = await rpc("tools/list", {}); |
| 340 | assert.ok(tools.tools.some((t) => t.name === "commit_files")); |
| 341 | const file = await rpc("tools/call", { name: "get_file", arguments: { owner, repo: "demo", path: "README.md" } }); |
| 342 | assert.equal(file.isError, false); |
| 343 | assert.equal(file.structuredContent.content, "# demo\n"); |
| 344 | const commit = await rpc("tools/call", { name: "commit_files", arguments: { owner, repo: "demo", branch: "mcp-change", create_branch_from: "main", message: "Edit via MCP", files: [{ path: "docs/notes.md", content: "hello\n" }] } }); |
| 345 | assert.equal(commit.isError, false, JSON.stringify(commit)); |
| 346 | const blocked = await rpc("tools/call", { name: "commit_files", arguments: { owner, repo: "demo", branch: "main", message: "sneaky", files: [{ path: "x", content: "y" }] } }); |
| 347 | assert.equal(blocked.isError, true); |
| 348 | const opened = await rpc("tools/call", { name: "create_pull_request", arguments: { owner, repo: "demo", title: "Notes", head: "mcp-change", intent: "Add notes" } }); |
| 349 | assert.equal(opened.isError, false, JSON.stringify(opened)); |
| 350 | assert.equal(opened.structuredContent.number, 2); |
| 351 | |
| 352 | // ------------------------------------------------------------ web UI renders the same data (signed in via DEV_AUTH) |
| 353 | for (const path of ["/", `/${owner}`, `/${owner}/demo`, `/${owner}/demo/blob/main/app.txt`, `/${owner}/demo/commits/main`, `/${owner}/demo/pulls`, `/${owner}/demo/pull/1`, `/${owner}/demo/pull/1/files`, `/${owner}/demo/actions`, `/${owner}/demo/actions/runs/${pushRun.id}`, `/${owner}/demo/actions/runs/${pushRun.id}/job/${job1.claim.job_id}`, `/${owner}/demo/settings/branches`, "/settings/tokens"]) { |
| 354 | const res = await fetch(`${base}${path}`); |
| 355 | const html = await res.text(); |
| 356 | assert.equal(res.status, 200, `${path} -> ${res.status}\n${html.slice(0, 500)}`); |
| 357 | assert.match(res.headers.get("content-type") ?? "", /text\/html/, path); |
| 358 | } |
| 359 | assert.match(await (await fetch(`${base}/${owner}/demo/pull/1`)).text(), /Add a fourth line/); |
| 360 | const forged = await fetch(`${base}/${owner}/demo/issues/1/comment`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", origin: "https://evil.example", "sec-fetch-site": "cross-site" }, body: "body=hi" }); |
| 361 | assert.equal(forged.status, 403); |
| 362 | |
| 363 | // ------------------------------------------------------------ the CLI against the same server |
| 364 | const CLI = resolve(APP, "../cli/dist/diffinery.mjs"); |
| 365 | if (existsSync(CLI)) { |
| 366 | const cli = (...args) => execFileSync(process.execPath, [CLI, ...args], { encoding: "utf8", cwd: clone, env: { ...process.env, DIFFINERY_URL: base, DIFFINERY_TOKEN: token, NO_COLOR: "1", XDG_CONFIG_HOME: join(work, "cfg") } }); |
| 367 | assert.match(cli("whoami"), new RegExp(owner)); |
| 368 | const prs = JSON.parse(cli("pr", "list", "--state", "all", "--json")); |
| 369 | assert.ok(prs.some((p) => p.number === 1)); |
| 370 | assert.match(cli("workflow", "validate"), /ci\.yml/); |
| 371 | } |
| 372 | |
| 373 | // The commit made through MCP carries the agent's identity. |
| 374 | const agentCommit = await ok("GET", `/repos/${owner}/demo/commits/mcp-change`); |
| 375 | assert.match(JSON.stringify(agentCommit), /e2e-bot/); |
| 376 | }); |
| 377 | |
| 378 | test("reusable workflows: inputs, secrets, outputs, nesting and skipped calls", async () => { |
| 379 | const owner = (await ok("GET", "/user")).login; |
| 380 | await ok("POST", "/user/repos", { name: "reuse" }); |
| 381 | await api("PUT", `/repos/${owner}/reuse/actions/secrets/TOPSECRET`, { value: "s3cret" }); |
| 382 | const src = join(work, "reuse"); |
| 383 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 384 | writeFileSync( |
| 385 | join(src, ".github/workflows/lib.yml"), |
| 386 | `on: |
| 387 | workflow_call: |
| 388 | inputs: |
| 389 | greeting: { type: string, required: true } |
| 390 | loud: { type: boolean, default: false } |
| 391 | secrets: |
| 392 | TOPSECRET: { required: true } |
| 393 | outputs: |
| 394 | word: |
| 395 | value: \${{ jobs.shout.outputs.word }} |
| 396 | jobs: |
| 397 | say: |
| 398 | runs-on: [self-hosted, linux] |
| 399 | outputs: |
| 400 | word: \${{ steps.s.outputs.word }} |
| 401 | steps: |
| 402 | - id: s |
| 403 | run: echo "word=\${{ inputs.greeting }}-there" >> "$GITHUB_OUTPUT" |
| 404 | - run: echo "secret ok=\${{ secrets.TOPSECRET == 's3cret' }} loud=\${{ inputs.loud }} job=\${{ github.job }}" |
| 405 | shout: |
| 406 | needs: say |
| 407 | runs-on: [self-hosted, linux] |
| 408 | outputs: |
| 409 | word: \${{ steps.s.outputs.word }} |
| 410 | steps: |
| 411 | - id: s |
| 412 | run: echo "word=\${{ needs.say.outputs.word }}!" >> "$GITHUB_OUTPUT" |
| 413 | `, |
| 414 | ); |
| 415 | writeFileSync( |
| 416 | join(src, ".github/workflows/main.yml"), |
| 417 | `name: Main |
| 418 | on: push |
| 419 | jobs: |
| 420 | call: |
| 421 | name: Greeter |
| 422 | uses: ./.github/workflows/lib.yml |
| 423 | with: |
| 424 | greeting: \${{ github.event_name == 'push' && 'hi' || 'no' }} |
| 425 | loud: true |
| 426 | secrets: inherit |
| 427 | nope: |
| 428 | if: \${{ false }} |
| 429 | uses: ./.github/workflows/lib.yml |
| 430 | with: |
| 431 | greeting: never |
| 432 | secrets: |
| 433 | TOPSECRET: \${{ secrets.TOPSECRET }} |
| 434 | after: |
| 435 | needs: [call, nope] |
| 436 | if: \${{ always() }} |
| 437 | runs-on: [self-hosted, linux] |
| 438 | steps: |
| 439 | - run: echo "got=\${{ needs.call.outputs.word }} call=\${{ needs.call.result }} nope=\${{ needs.nope.result }}" |
| 440 | `, |
| 441 | ); |
| 442 | git(src, ["init", "-q", "-b", "main"]); |
| 443 | git(src, ["add", "."]); |
| 444 | git(src, ["commit", "-q", "-m", "reusable"]); |
| 445 | git(src, ["remote", "add", "origin", `${base}/${owner}/reuse.git`]); |
| 446 | git(src, ["push", "-q", "origin", "main"]); |
| 447 | |
| 448 | const run = await until("reuse run", async () => (await ok("GET", `/repos/${owner}/reuse/actions/runs`)).workflow_runs[0]); |
| 449 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/reuse/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 450 | const say = await runOneJob(owner, "reuse"); |
| 451 | assert.equal(say.claim.name, "Greeter / say"); |
| 452 | const sayLog = await logOf(say.claim.job_id); |
| 453 | assert.match(sayLog, /secret ok=true loud=true job=say/); |
| 454 | assert.doesNotMatch(sayLog, /s3cret/); |
| 455 | const shout = await runOneJob(owner, "reuse"); |
| 456 | assert.equal(shout.claim.name, "Greeter / shout"); |
| 457 | const after = await runOneJob(owner, "reuse"); |
| 458 | assert.equal(after.claim.name, "after"); |
| 459 | assert.match(await logOf(after.claim.job_id), /got=hi-there! call=success nope=skipped/); |
| 460 | const done = await until("reuse run to complete", async () => { |
| 461 | const r = await ok("GET", `/repos/${owner}/reuse/actions/runs/${run.id}`); |
| 462 | return r.status === "completed" ? r : null; |
| 463 | }); |
| 464 | assert.equal(done.conclusion, "success"); |
| 465 | const jobs = (await ok("GET", `/repos/${owner}/reuse/actions/runs/${run.id}/jobs`)).jobs; |
| 466 | assert.deepEqual(jobs.filter((j) => j.conclusion === "skipped").map((j) => j.name).sort(), ["nope / say", "nope / shout"]); |
| 467 | }); |
| 468 | |
| 469 | test("job graph: needs-only scheduling, skip cascades, per-leg runs-on, continue-on-error, job concurrency and public payloads", async () => { |
| 470 | const owner = (await ok("GET", "/user")).login; |
| 471 | await ok("POST", "/user/repos", { name: "graph", private: false }); |
| 472 | const src = join(work, "graph"); |
| 473 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 474 | writeFileSync( |
| 475 | join(src, ".github/workflows/graph.yml"), |
| 476 | `name: Graph |
| 477 | on: push |
| 478 | jobs: |
| 479 | slow: |
| 480 | runs-on: [self-hosted, e2e-slow] |
| 481 | steps: |
| 482 | - run: echo slow |
| 483 | fast: |
| 484 | runs-on: [self-hosted, linux] |
| 485 | steps: |
| 486 | - run: echo "private=\${{ github.event.repository.private }} visibility=\${{ github.event.repository.visibility }}" |
| 487 | after-fast: |
| 488 | needs: fast |
| 489 | runs-on: [self-hosted, linux] |
| 490 | steps: |
| 491 | - run: echo after-fast |
| 492 | gate: |
| 493 | if: \${{ github.event_name == 'nope' }} |
| 494 | runs-on: [self-hosted, linux] |
| 495 | steps: |
| 496 | - run: echo never |
| 497 | middle: |
| 498 | needs: gate |
| 499 | if: \${{ always() }} |
| 500 | runs-on: [self-hosted, linux] |
| 501 | steps: |
| 502 | - run: echo "gate=\${{ needs.gate.result }}" |
| 503 | leaf: |
| 504 | needs: middle |
| 505 | runs-on: [self-hosted, linux] |
| 506 | steps: |
| 507 | - run: echo leaf |
| 508 | rescued: |
| 509 | needs: middle |
| 510 | if: \${{ !cancelled() && !failure() }} |
| 511 | runs-on: [self-hosted, linux] |
| 512 | steps: |
| 513 | - run: echo "middle=\${{ needs.middle.result }}" |
| 514 | lanes: |
| 515 | name: lane \${{ matrix.lane }} |
| 516 | strategy: |
| 517 | matrix: |
| 518 | include: |
| 519 | - lane: red |
| 520 | runner: [self-hosted, e2e-red] |
| 521 | - lane: blue |
| 522 | runner: [self-hosted, e2e-blue] |
| 523 | runs-on: \${{ matrix.runner }} |
| 524 | continue-on-error: \${{ matrix.lane == 'red' }} |
| 525 | environment: e2e-\${{ matrix.lane }}-\${{ strategy.job-total }} |
| 526 | steps: |
| 527 | - run: echo "lane=\${{ matrix.lane }}" && test "\${{ matrix.lane }}" = blue |
| 528 | after-lanes: |
| 529 | needs: lanes |
| 530 | runs-on: [self-hosted, linux] |
| 531 | steps: |
| 532 | - run: echo "lanes=\${{ needs.lanes.result }}" |
| 533 | deploy: |
| 534 | strategy: |
| 535 | matrix: |
| 536 | target: [prod, staging] |
| 537 | concurrency: e2e-\${{ matrix.target }} |
| 538 | runs-on: [self-hosted, e2e-deploy] |
| 539 | steps: |
| 540 | - run: echo "deploy \${{ matrix.target }}" |
| 541 | hotfix: |
| 542 | strategy: |
| 543 | matrix: |
| 544 | target: [prod] |
| 545 | concurrency: e2e-\${{ matrix.target }} |
| 546 | runs-on: [self-hosted, e2e-deploy] |
| 547 | steps: |
| 548 | - run: echo "hotfix \${{ matrix.target }}" |
| 549 | `, |
| 550 | ); |
| 551 | git(src, ["init", "-q", "-b", "main"]); |
| 552 | git(src, ["add", "."]); |
| 553 | git(src, ["commit", "-q", "-m", "graph"]); |
| 554 | git(src, ["remote", "add", "origin", `${base}/${owner}/graph.git`]); |
| 555 | git(src, ["push", "-q", "origin", "main"]); |
| 556 | |
| 557 | const run = await until("graph run", async () => (await ok("GET", `/repos/${owner}/graph/actions/runs`)).workflow_runs[0]); |
| 558 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/graph/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 559 | const jobs = async () => (await ok("GET", `/repos/${owner}/graph/actions/runs/${run.id}/jobs`)).jobs; |
| 560 | |
| 561 | // Jobs start when their own needs finish: after-fast and rescued run while slow (no runner offers e2e-slow) still waits. |
| 562 | const linux = {}; |
| 563 | for (let i = 0; i < 4; i++) { |
| 564 | const j = await runOneJob(owner, "graph"); |
| 565 | linux[j.claim.name] = j.claim.job_id; |
| 566 | } |
| 567 | assert.deepEqual(Object.keys(linux).sort(), ["after-fast", "fast", "middle", "rescued"]); |
| 568 | assert.equal((await jobs()).find((j) => j.name === "slow").status, "waiting"); |
| 569 | assert.match(await logOf(linux.fast), /private=false visibility=public/); |
| 570 | assert.match(await logOf(linux.middle), /gate=skipped/); |
| 571 | assert.match(await logOf(linux.rescued), /middle=success/); |
| 572 | |
| 573 | // runs-on per matrix leg; the red leg fails but continues on error, so fail-fast spares the blue one. |
| 574 | const red = await runOneJob(owner, "graph", { labels: ["e2e-red"], allowFailure: true }); |
| 575 | assert.equal(red.claim.name, "lane red"); |
| 576 | const blue = await runOneJob(owner, "graph", { labels: ["e2e-blue"] }); |
| 577 | assert.equal(blue.claim.name, "lane blue"); |
| 578 | const afterLanes = await runOneJob(owner, "graph"); |
| 579 | assert.equal(afterLanes.claim.name, "after-lanes"); |
| 580 | assert.match(await logOf(afterLanes.claim.job_id), /lanes=success/); |
| 581 | const envs = (await ok("GET", `/repos/${owner}/graph/environments`)).environments.map((e) => e.name); |
| 582 | assert.ok(envs.includes("e2e-red-2") && envs.includes("e2e-blue-2"), `per-leg environments: ${envs}`); |
| 583 | |
| 584 | // Job-level concurrency, evaluated per leg: one of the two prod jobs waits as pending until the other finishes. |
| 585 | const pending = await until("a pending prod job", async () => (await jobs()).find((j) => j.status === "pending")); |
| 586 | assert.ok(["deploy (prod)", "hotfix (prod)"].includes(pending.name), pending.name); |
| 587 | const first = await runOneJob(owner, "graph", { labels: ["e2e-deploy"] }); |
| 588 | const second = await runOneJob(owner, "graph", { labels: ["e2e-deploy"] }); |
| 589 | assert.deepEqual([first.claim.name, second.claim.name].sort(), ["deploy (prod)", "deploy (staging)", "hotfix (prod)"].filter((n) => n !== pending.name).sort()); |
| 590 | const third = await runOneJob(owner, "graph", { labels: ["e2e-deploy"] }); |
| 591 | assert.equal(third.claim.name, pending.name); |
| 592 | |
| 593 | const slow = await runOneJob(owner, "graph", { labels: ["e2e-slow"] }); |
| 594 | assert.equal(slow.claim.name, "slow"); |
| 595 | const done = await until("graph run to complete", async () => { |
| 596 | const r = await ok("GET", `/repos/${owner}/graph/actions/runs/${run.id}`); |
| 597 | return r.status === "completed" ? r : null; |
| 598 | }); |
| 599 | assert.equal(done.conclusion, "success", "a failed leg with continue-on-error does not fail the run"); |
| 600 | const byName = Object.fromEntries((await jobs()).map((j) => [j.name, j])); |
| 601 | assert.equal(byName.gate.conclusion, "skipped"); |
| 602 | assert.equal(byName.leaf.conclusion, "skipped", "a skipped ancestor skips the jobs below it"); |
| 603 | assert.equal(byName["lane red"].conclusion, "failure"); |
| 604 | assert.equal(byName["lane blue"].conclusion, "success"); |
| 605 | }); |
| 606 | |
| 607 | test("workflow_run: a workflow follows another one on the default branch", async () => { |
| 608 | const owner = (await ok("GET", "/user")).login; |
| 609 | await ok("POST", "/user/repos", { name: "chain" }); |
| 610 | const src = join(work, "chain"); |
| 611 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 612 | writeFileSync(join(src, ".github/workflows/ci.yml"), `name: CI\non: push\njobs:\n build:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo built\n`); |
| 613 | writeFileSync( |
| 614 | join(src, ".github/workflows/after.yml"), |
| 615 | `name: After CI |
| 616 | on: |
| 617 | workflow_run: |
| 618 | workflows: [CI] |
| 619 | types: [completed] |
| 620 | branches: [main] |
| 621 | jobs: |
| 622 | report: |
| 623 | if: \${{ github.event.workflow_run.conclusion == 'success' }} |
| 624 | runs-on: [self-hosted, linux] |
| 625 | steps: |
| 626 | - run: echo "followed \${{ github.event.workflow_run.name }} on \${{ github.event.workflow_run.head_branch }} (\${{ github.event.action }}) ref=\${{ github.ref }}" |
| 627 | `, |
| 628 | ); |
| 629 | git(src, ["init", "-q", "-b", "main"]); |
| 630 | git(src, ["add", "."]); |
| 631 | git(src, ["commit", "-q", "-m", "chain"]); |
| 632 | git(src, ["remote", "add", "origin", `${base}/${owner}/chain.git`]); |
| 633 | git(src, ["push", "-q", "origin", "main"]); |
| 634 | |
| 635 | const runs = async () => (await ok("GET", `/repos/${owner}/chain/actions/runs`)).workflow_runs; |
| 636 | await until("CI run", async () => (await runs()).find((r) => r.name === "CI")); |
| 637 | assert.equal((await runs()).length, 1, "only CI runs before it completes"); |
| 638 | const build = await runOneJob(owner, "chain"); |
| 639 | assert.equal(build.claim.name, "build"); |
| 640 | const follower = await until("follower run", async () => (await runs()).find((r) => r.event === "workflow_run")); |
| 641 | assert.equal(follower.name, "After CI"); |
| 642 | assert.equal(follower.head_branch, "main"); |
| 643 | const report = await runOneJob(owner, "chain"); |
| 644 | assert.equal(report.claim.name, "report"); |
| 645 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/chain/actions/jobs/${report.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 646 | assert.match(log, /followed CI on main \(completed\) ref=refs\/heads\/main/); |
| 647 | const done = await until("follower to complete", async () => { |
| 648 | const r = await ok("GET", `/repos/${owner}/chain/actions/runs/${follower.id}`); |
| 649 | return r.status === "completed" ? r : null; |
| 650 | }); |
| 651 | assert.equal(done.conclusion, "success"); |
| 652 | assert.equal((await runs()).length, 2, "the follower does not trigger itself"); |
| 653 | }); |
| 654 | |
| 655 | test("pull requests: test merge commits, pull_request_target and the merge queue", async () => { |
| 656 | const owner = (await ok("GET", "/user")).login; |
| 657 | await ok("POST", "/user/repos", { name: "queue" }); |
| 658 | await api("PUT", `/repos/${owner}/queue/actions/secrets/TOPSECRET`, { value: "s3cret" }); |
| 659 | const src = join(work, "queue"); |
| 660 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 661 | writeFileSync(join(src, "app.txt"), "a\nb\nc\n"); |
| 662 | writeFileSync( |
| 663 | join(src, ".github/workflows/ci.yml"), |
| 664 | `name: CI |
| 665 | on: |
| 666 | pull_request: |
| 667 | merge_group: |
| 668 | jobs: |
| 669 | test: |
| 670 | runs-on: [self-hosted, linux] |
| 671 | steps: |
| 672 | - uses: actions/checkout@v4 |
| 673 | - run: | |
| 674 | echo "event=\${{ github.event_name }} ref=\${{ github.ref }} sha=\${{ github.sha }} head=$(git rev-parse HEAD)" |
| 675 | echo "parents=$(git rev-list --parents -n1 HEAD)" |
| 676 | echo "app=$(tr '\\n' ' ' < app.txt)" |
| 677 | if [ "\${{ github.event_name }}" = merge_group ] && grep -qs fail notes.txt; then echo "merge group failed"; exit 1; fi |
| 678 | `, |
| 679 | ); |
| 680 | writeFileSync( |
| 681 | join(src, ".github/workflows/target.yml"), |
| 682 | `name: Target |
| 683 | on: pull_request_target |
| 684 | jobs: |
| 685 | t: |
| 686 | runs-on: [self-hosted, linux] |
| 687 | steps: |
| 688 | - run: echo "target from base secret=\${{ secrets.TOPSECRET == 's3cret' }} ref=\${{ github.ref }} head=\${{ github.event.pull_request.head.sha }}" |
| 689 | `, |
| 690 | ); |
| 691 | git(src, ["init", "-q", "-b", "main"]); |
| 692 | git(src, ["add", "."]); |
| 693 | git(src, ["commit", "-q", "-m", "queue"]); |
| 694 | git(src, ["remote", "add", "origin", `${base}/${owner}/queue.git`]); |
| 695 | git(src, ["push", "-q", "origin", "main"]); |
| 696 | const root = git(src, ["rev-parse", "HEAD"]).trim(); |
| 697 | |
| 698 | // f1 changes the first line and tries to rewrite the pull_request_target workflow. |
| 699 | git(src, ["checkout", "-q", "-b", "f1"]); |
| 700 | writeFileSync(join(src, "app.txt"), "A\nb\nc\n"); |
| 701 | writeFileSync(join(src, ".github/workflows/target.yml"), `name: Target\non: pull_request_target\njobs:\n t:\n runs-on: [self-hosted, linux]\n steps:\n - run: echo "PWNED \${{ secrets.TOPSECRET }}"\n`); |
| 702 | git(src, ["commit", "-q", "-am", "f1"]); |
| 703 | git(src, ["push", "-q", "origin", "f1"]); |
| 704 | const f1 = git(src, ["rev-parse", "HEAD"]).trim(); |
| 705 | // main moves on, so the test merge commit differs from both sides. |
| 706 | git(src, ["checkout", "-q", "main"]); |
| 707 | writeFileSync(join(src, "app.txt"), "a\nb\nC\n"); |
| 708 | git(src, ["commit", "-q", "-am", "main moves"]); |
| 709 | git(src, ["push", "-q", "origin", "main"]); |
| 710 | const main1 = git(src, ["rev-parse", "HEAD"]).trim(); |
| 711 | |
| 712 | const pr1 = await ok("POST", `/repos/${owner}/queue/pulls`, { title: "Capitalise a", head: "f1", base: "main" }); |
| 713 | const runs = async (q = "") => (await ok("GET", `/repos/${owner}/queue/actions/runs${q}`)).workflow_runs; |
| 714 | const prRun = await until("pull_request run", async () => (await runs("?event=pull_request"))[0]); |
| 715 | assert.equal(prRun.ref, "refs/pull/1/merge"); |
| 716 | assert.equal(prRun.head_sha, f1, "pull_request runs report on the PR head"); |
| 717 | assert.notEqual(prRun.sha, f1, "pull_request runs check out the test merge commit"); |
| 718 | assert.equal(prRun.head_branch, "f1"); |
| 719 | const targetRun = (await runs("?event=pull_request_target"))[0]; |
| 720 | assert.equal(targetRun.ref, "refs/heads/main"); |
| 721 | assert.equal(targetRun.sha, main1, "pull_request_target runs on the base commit"); |
| 722 | assert.equal(targetRun.head_sha, f1); |
| 723 | // The merge ref is fetchable and its parents are [base, head]; refs/pull is read-only. |
| 724 | git(src, ["fetch", "-q", "origin", "+refs/pull/1/merge:refs/remotes/pr/1"]); |
| 725 | assert.equal(git(src, ["rev-parse", "refs/remotes/pr/1"]).trim(), prRun.sha); |
| 726 | assert.equal(git(src, ["rev-list", "--parents", "-n1", "refs/remotes/pr/1"]).trim(), `${prRun.sha} ${main1} ${f1}`); |
| 727 | assert.match(gitFails(src, ["push", "origin", `${root}:refs/pull/1/head`]), /refs\/pull|managed/); |
| 728 | |
| 729 | const logOf = async (id) => (await fetch(`${base}/api/v3/repos/${owner}/queue/actions/jobs/${id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 730 | const ran = {}; |
| 731 | for (let i = 0; i < 2; i++) { |
| 732 | const j = await runOneJob(owner, "queue"); |
| 733 | ran[j.claim.name] = await logOf(j.claim.job_id); |
| 734 | } |
| 735 | assert.match(ran.test, new RegExp(`event=pull_request ref=refs/pull/1/merge sha=${prRun.sha} head=${prRun.sha}`)); |
| 736 | assert.match(ran.test, /app=A b C/); |
| 737 | assert.match(ran.t, /target from base secret=true ref=refs\/heads\/main/); |
| 738 | assert.match(ran.t, new RegExp(`head=${f1}`)); |
| 739 | assert.doesNotMatch(ran.t, /PWNED/); |
| 740 | await until("PR #1 checks", async () => { |
| 741 | const c = (await ok("GET", `/repos/${owner}/queue/commits/${f1}/check-runs`)).check_runs; |
| 742 | return c.length === 2 && c.every((x) => x.conclusion === "success") ? c : null; |
| 743 | }); |
| 744 | |
| 745 | // ------------------------------------------------------------ merge queue |
| 746 | await ok("PUT", `/repos/${owner}/queue/branches/main/protection`, { requirePullRequest: true, requiredChecks: ["CI / test"], mergeQueue: { method: "merge", buildConcurrency: 5, checkTimeoutMinutes: 30 } }); |
| 747 | const direct = await api("PUT", `/repos/${owner}/queue/pulls/1/merge`, {}); |
| 748 | assert.equal(direct.status, 405); |
| 749 | assert.match(JSON.stringify(direct.json), /merge queue/); |
| 750 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1/merge`)).mergeQueue.method, "merge"); |
| 751 | |
| 752 | // Two more pull requests: one that merges cleanly and one that fails only in its merge group. |
| 753 | const branch = async (name, file, content) => { |
| 754 | git(src, ["checkout", "-q", "-b", name, main1]); |
| 755 | writeFileSync(join(src, file), content); |
| 756 | git(src, ["add", "."]); |
| 757 | git(src, ["commit", "-q", "-m", name]); |
| 758 | git(src, ["push", "-q", "origin", name]); |
| 759 | const sha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 760 | const pr = await ok("POST", `/repos/${owner}/queue/pulls`, { title: name, head: name, base: "main" }); |
| 761 | for (let i = 0; i < 2; i++) await runOneJob(owner, "queue"); |
| 762 | await until(`${name} checks`, async () => (await ok("GET", `/repos/${owner}/queue/commits/${sha}/check-runs`)).check_runs.filter((x) => x.conclusion === "success").length === 2); |
| 763 | return { pr, sha }; |
| 764 | }; |
| 765 | const f2 = await branch("f2", "two.txt", "two\n"); |
| 766 | const f3 = await branch("f3", "notes.txt", "fail\n"); |
| 767 | |
| 768 | const q1 = await ok("PUT", `/repos/${owner}/queue/pulls/1/merge-queue`, { delete_branch: true }); |
| 769 | assert.equal(q1.state, "queued"); |
| 770 | assert.equal(q1.entry.position, 1); |
| 771 | assert.equal(q1.entry.state, "checking"); |
| 772 | const q2 = await ok("PUT", `/repos/${owner}/queue/pulls/${f2.pr.number}/merge-queue`, {}); |
| 773 | const q3 = await ok("PUT", `/repos/${owner}/queue/pulls/${f3.pr.number}/merge-queue`, {}); |
| 774 | assert.equal(q2.entry.merge_group.base_sha, q1.entry.merge_group.head_sha, "each group builds on the one ahead"); |
| 775 | assert.equal(q3.entry.merge_group.base_sha, q2.entry.merge_group.head_sha); |
| 776 | assert.equal(q1.entry.merge_group.head_ref, `refs/heads/gh-readonly-queue/main/pr-1-${f1}`); |
| 777 | const queue = await ok("GET", `/repos/${owner}/queue/merge-queue/main`); |
| 778 | assert.deepEqual(queue.entries.map((e) => e.number), [1, f2.pr.number, f3.pr.number]); |
| 779 | assert.match(gitFails(src, ["push", "origin", `${root}:refs/heads/gh-readonly-queue/main/x`]), /read-only/); |
| 780 | |
| 781 | // Merge groups run merge_group workflows, oldest first. |
| 782 | const groupLogs = []; |
| 783 | for (let i = 0; i < 3; i++) { |
| 784 | const j = await runOneJob(owner, "queue", { allowFailure: i === 2 }); |
| 785 | groupLogs.push(await logOf(j.claim.job_id)); |
| 786 | } |
| 787 | assert.match(groupLogs[0], new RegExp(`event=merge_group ref=refs/heads/gh-readonly-queue/main/pr-1-${f1} sha=${q1.entry.merge_group.head_sha}`)); |
| 788 | assert.match(groupLogs[2], /merge group failed/); |
| 789 | const mainNow = await until("the queue to merge #1 and #2", async () => { |
| 790 | const b = await ok("GET", `/repos/${owner}/queue/branches/main`); |
| 791 | return b.commit.sha === q2.entry.merge_group.head_sha ? b : null; |
| 792 | }); |
| 793 | assert.ok(mainNow); |
| 794 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1`)).merged, true); |
| 795 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/${f2.pr.number}`)).merged, true); |
| 796 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/1`)).merge_commit_sha, q1.entry.merge_group.head_sha, "the tested commit is what merged"); |
| 797 | const f3After = await until("#3 to leave the queue", async () => { |
| 798 | const q = await ok("GET", `/repos/${owner}/queue/merge-queue/main`); |
| 799 | return q.entries.length === 0 ? q : null; |
| 800 | }); |
| 801 | assert.ok(f3After); |
| 802 | assert.equal((await ok("GET", `/repos/${owner}/queue/pulls/${f3.pr.number}`)).merged, false); |
| 803 | const comments = await ok("GET", `/repos/${owner}/queue/issues/${f3.pr.number}/comments`); |
| 804 | assert.match(JSON.stringify(comments), /removed from the merge queue: the required check 'CI \/ test' failed on its merge group/); |
| 805 | git(src, ["fetch", "-q", "origin"]); |
| 806 | assert.equal(git(src, ["show", "origin/main:app.txt"]), "A\nb\nC\n"); |
| 807 | assert.equal(git(src, ["show", "origin/main:two.txt"]), "two\n"); |
| 808 | assert.ok(!(await ok("GET", `/repos/${owner}/queue/branches`)).some((b) => b.name.startsWith("gh-readonly-queue/") || b.name === "f1"), "group branches and f1 are gone"); |
| 809 | |
| 810 | // A pull request that conflicts with its base runs no pull_request workflows (like GitHub), only pull_request_target. |
| 811 | git(src, ["checkout", "-q", "-b", "f4", root]); |
| 812 | writeFileSync(join(src, "app.txt"), "x\nb\nc\n"); |
| 813 | git(src, ["commit", "-q", "-am", "f4"]); |
| 814 | git(src, ["push", "-q", "origin", "f4"]); |
| 815 | const pr4 = await ok("POST", `/repos/${owner}/queue/pulls`, { title: "conflicts", head: "f4", base: "main" }); |
| 816 | const t4 = await until("pull_request_target run for #4", async () => (await runs("?event=pull_request_target")).find((r) => r.pull_request_number === pr4.number)); |
| 817 | assert.ok(t4); |
| 818 | assert.equal((await runs("?event=pull_request")).filter((r) => r.pull_request_number === pr4.number).length, 0); |
| 819 | await runOneJob(owner, "queue"); |
| 820 | |
| 821 | // The web UI shows the queue. |
| 822 | const page = async (path) => { |
| 823 | const res = await fetch(`${base}${path}`); |
| 824 | assert.equal(res.status, 200, path); |
| 825 | return res.text(); |
| 826 | }; |
| 827 | assert.match(await page(`/${owner}/queue/queue/main`), /The queue is empty/); |
| 828 | assert.match(await page(`/${owner}/queue/pull/${pr4.number}`), /Merge when ready/); |
| 829 | assert.match(await page(`/${owner}/queue/pull/${f3.pr.number}`), /removed from the merge queue/); |
| 830 | assert.match(await page(`/${owner}/queue/settings/branches`), /merge queue/); |
| 831 | }); |
| 832 | |
| 833 | const POLICY_WORKFLOW = `name: Policy |
| 834 | on: |
| 835 | push: |
| 836 | branches: [main, agent-work] |
| 837 | pull_request: |
| 838 | jobs: |
| 839 | probe: |
| 840 | runs-on: [self-hosted, linux] |
| 841 | permissions: { contents: write, pull-requests: write } |
| 842 | steps: |
| 843 | - uses: actions/checkout@v4 |
| 844 | with: { ref: main } |
| 845 | - name: Push to main, push a workflow change, approve the pull request |
| 846 | env: |
| 847 | GH_TOKEN: \${{ github.token }} |
| 848 | PR: \${{ github.event.pull_request.number }} |
| 849 | GIT_AUTHOR_NAME: bot |
| 850 | GIT_AUTHOR_EMAIL: bot@example.com |
| 851 | GIT_COMMITTER_NAME: bot |
| 852 | GIT_COMMITTER_EMAIL: bot@example.com |
| 853 | run: | |
| 854 | echo "run \${{ github.run_id }}" > note.txt |
| 855 | git add note.txt && git commit -qm note |
| 856 | if git push -q origin HEAD:main 2>err.txt; then echo "main push: ok"; else echo "main push: refused $(tr '\\n' ' ' < err.txt)"; fi |
| 857 | git reset -q --hard HEAD~1 |
| 858 | echo "# edited" >> .github/workflows/policy.yml |
| 859 | git commit -qam "edit the workflow" |
| 860 | if git push -q origin "HEAD:refs/heads/wf-\${{ github.run_id }}" 2>err.txt; then echo "workflow push: ok"; else echo "workflow push: refused $(tr '\\n' ' ' < err.txt)"; fi |
| 861 | if [ -n "$PR" ]; then |
| 862 | code=$(curl -s -o out.json -w '%{http_code}' -X POST -H "authorization: Bearer $GH_TOKEN" -H 'content-type: application/json' -d '{"event":"APPROVE","body":"from a workflow"}' "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/pulls/$PR/reviews") |
| 863 | echo "approve: $code $(cat out.json)" |
| 864 | fi |
| 865 | defaults: |
| 866 | if: github.event_name == 'push' && github.ref == 'refs/heads/main' |
| 867 | runs-on: [self-hosted, linux] |
| 868 | steps: |
| 869 | - env: { GH_TOKEN: "\${{ github.token }}" } |
| 870 | run: | |
| 871 | code=$(curl -s -o out.json -w '%{http_code}' -X POST -H "authorization: Bearer $GH_TOKEN" -H 'content-type: application/json' -d '{"title":"from the default token"}' "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/issues") |
| 872 | echo "default token issue write: $code $(cat out.json)" |
| 873 | code=$(curl -s -o /dev/null -w '%{http_code}' -H "authorization: Bearer $GH_TOKEN" "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/contents/README.md") |
| 874 | echo "default token contents read: $code" |
| 875 | `; |
| 876 | |
| 877 | test("workflow tokens: read-only default, no approvals or workflow edits, agent code stays an agent", { timeout: 600_000 }, async () => { |
| 878 | const owner = (await ok("GET", "/user")).login; |
| 879 | await ok("POST", "/user/repos", { name: "policy" }); |
| 880 | const settingsPath = `/repos/${owner}/policy/actions/permissions/workflow`; |
| 881 | // New repositories start like GitHub's: read-only token, no pull request approvals. |
| 882 | assert.deepEqual(await ok("GET", settingsPath), { default_workflow_permissions: "read", can_approve_pull_request_reviews: false }); |
| 883 | const bot = (await ok("POST", "/diffinery/agents", { login: "policy-bot" })).token.token; |
| 884 | assert.equal((await api("PUT", settingsPath, { can_approve_pull_request_reviews: true }, bot)).status, 403, "agents cannot change what workflows may do"); |
| 885 | assert.equal((await api("PUT", settingsPath, { default_workflow_permissions: "admin" })).status, 422); |
| 886 | |
| 887 | const src = join(work, "policy"); |
| 888 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 889 | writeFileSync(join(src, "README.md"), "# policy\n"); |
| 890 | writeFileSync(join(src, ".github/workflows/policy.yml"), POLICY_WORKFLOW); |
| 891 | git(src, ["init", "-q", "-b", "main"]); |
| 892 | git(src, ["add", "-A"]); |
| 893 | git(src, ["commit", "-q", "-m", "policy"]); |
| 894 | git(src, ["remote", "add", "origin", `${base}/${owner}/policy.git`]); |
| 895 | git(src, ["push", "-q", "origin", "main"]); |
| 896 | |
| 897 | /** Runs `count` jobs; returns their logs by job name. */ |
| 898 | const runJobs = async (count) => { |
| 899 | const logs = {}; |
| 900 | for (let i = 0; i < count; i++) { |
| 901 | const { claim } = await runOneJob(owner, "policy"); |
| 902 | const raw = await (await fetch(`${base}/api/v3/repos/${owner}/policy/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 903 | logs[claim.name] = raw.replace(/^\S+Z /gm, ""); |
| 904 | } |
| 905 | return logs; |
| 906 | }; |
| 907 | const refused = (path) => new RegExp(`workflow push: refused .*refusing to allow a GitHub App to create or update workflow \`${path.replace(/\./g, "\\.")}\` without \`workflows\` permission`); |
| 908 | |
| 909 | // A person's push: the job token writes what it was granted, but never workflow files; |
| 910 | // the default token (no permissions:) only reads. |
| 911 | let logs = await runJobs(2); |
| 912 | assert.match(logs.probe, /main push: ok/); |
| 913 | assert.match(logs.probe, refused(".github/workflows/policy.yml")); |
| 914 | assert.match(logs.defaults, /default token issue write: 403 .*issues: write/); |
| 915 | assert.match(logs.defaults, /default token contents read: 200/); |
| 916 | const branches = (await ok("GET", `/repos/${owner}/policy/branches`)).map((b) => b.name); |
| 917 | assert.ok(!branches.some((b) => b.startsWith("wf-")), JSON.stringify(branches)); |
| 918 | git(src, ["pull", "-q", "--ff-only", "origin", "main"]); |
| 919 | assert.match(readFileSync(join(src, "note.txt"), "utf8"), /^run \d+/); |
| 920 | |
| 921 | // An agent's push: the run executes the agent's code, so its token is an agent's and may not push to the default branch. |
| 922 | const agentClone = join(work, "policy-agent"); |
| 923 | git(work, ["clone", "-q", `${base}/${owner}/policy.git`, agentClone], bot); |
| 924 | git(agentClone, ["checkout", "-q", "-b", "agent-work"], bot); |
| 925 | writeFileSync(join(agentClone, "agent.txt"), "from the agent\n"); |
| 926 | git(agentClone, ["add", "agent.txt"], bot); |
| 927 | git(agentClone, ["commit", "-q", "-m", "agent change"], bot); |
| 928 | git(agentClone, ["push", "-q", "origin", "agent-work"], bot); |
| 929 | logs = await runJobs(1); |
| 930 | assert.match(logs.probe, /main push: refused .*agents may not push to protected or default branches/); |
| 931 | assert.match(logs.probe, refused(".github/workflows/policy.yml")); |
| 932 | |
| 933 | // A person opens a pull request from the branch the agent pushed: still the agent's code. |
| 934 | // Workflows may not approve pull requests unless the repository allows it. |
| 935 | const pr1 = await ok("POST", `/repos/${owner}/policy/pulls`, { title: "Agent work", head: "agent-work", base: "main" }); |
| 936 | logs = await runJobs(1); |
| 937 | assert.match(logs.probe, /main push: refused .*agents may not push/); |
| 938 | assert.match(logs.probe, /approve: 403 .*GitHub Actions is not permitted to approve pull requests/); |
| 939 | assert.equal((await ok("GET", `/repos/${owner}/policy/pulls/${pr1.number}/reviews`)).length, 0); |
| 940 | |
| 941 | // Allowed: the approval is recorded, but only people's approvals count toward the required ones. |
| 942 | await ok("PUT", settingsPath, { can_approve_pull_request_reviews: true }); |
| 943 | assert.deepEqual(await ok("GET", settingsPath), { default_workflow_permissions: "read", can_approve_pull_request_reviews: true }); |
| 944 | await ok("PUT", `/repos/${owner}/policy/branches/main/protection`, { |
| 945 | requirePullRequest: true, |
| 946 | requiredApprovals: 1, |
| 947 | dismissStaleReviews: false, |
| 948 | requiredChecks: [], |
| 949 | allowForcePush: false, |
| 950 | allowDeletion: false, |
| 951 | requireLinearHistory: false, |
| 952 | enforceAdmins: true, |
| 953 | agentsMayPush: false, |
| 954 | agentsMayMerge: false, |
| 955 | }); |
| 956 | git(src, ["checkout", "-q", "-b", "feature"]); |
| 957 | writeFileSync(join(src, "feature.txt"), "a person's change\n"); |
| 958 | git(src, ["add", "feature.txt"]); |
| 959 | git(src, ["commit", "-q", "-m", "feature"]); |
| 960 | git(src, ["push", "-q", "origin", "feature"]); |
| 961 | const pr2 = await ok("POST", `/repos/${owner}/policy/pulls`, { title: "Feature", head: "feature", base: "main" }); |
| 962 | logs = await runJobs(1); |
| 963 | assert.match(logs.probe, /main push: refused .*pull request/); |
| 964 | assert.match(logs.probe, /approve: 20[01] /); |
| 965 | const reviews = await ok("GET", `/repos/${owner}/policy/pulls/${pr2.number}/reviews`); |
| 966 | assert.deepEqual(reviews.map((r) => r.state), ["APPROVED"]); |
| 967 | const m = await ok("GET", `/repos/${owner}/policy/pulls/${pr2.number}/merge`); |
| 968 | assert.equal(m.mergeable, false, JSON.stringify(m)); |
| 969 | assert.equal(m.approvals, 0, JSON.stringify(m)); |
| 970 | assert.match(JSON.stringify(m.blockers), /needs 1 more approving review/); |
| 971 | }); |
| 972 | |
| 973 | const SCOPES_WORKFLOW = `name: Scopes |
| 974 | on: |
| 975 | push: |
| 976 | branches: [main, a, b] |
| 977 | pull_request: |
| 978 | jobs: |
| 979 | c: |
| 980 | runs-on: [self-hosted, linux] |
| 981 | steps: |
| 982 | - uses: actions/cache@v4 |
| 983 | with: { path: built, key: "b-\${{ github.run_id }}", restore-keys: "b-" } |
| 984 | - uses: actions/cache@v4 |
| 985 | env: { DIFFINERY_BUILTINS: "false" } |
| 986 | with: { path: real, key: "r-\${{ github.run_id }}", restore-keys: "r-" } |
| 987 | - run: | |
| 988 | echo "restored built=[$(cat built/from 2>/dev/null)] real=[$(cat real/from 2>/dev/null)]" |
| 989 | mkdir -p built real && echo "$GITHUB_REF" > built/from && echo "$GITHUB_REF" > real/from |
| 990 | - if: github.ref == 'refs/heads/main' |
| 991 | uses: actions/upload-artifact@v4 |
| 992 | with: { name: "builtin-\${{ github.run_id }}", path: built/from, retention-days: 1 } |
| 993 | - if: github.ref == 'refs/heads/main' |
| 994 | uses: actions/upload-artifact@v4 |
| 995 | env: { DIFFINERY_BUILTINS: "false" } |
| 996 | with: { name: "real-\${{ github.run_id }}", path: built/from, retention-days: 3 } |
| 997 | - if: github.ref == 'refs/heads/main' |
| 998 | uses: actions/upload-artifact@v4 |
| 999 | with: { name: "capped-\${{ github.run_id }}", path: built/from, retention-days: 400 } |
| 1000 | `; |
| 1001 | |
| 1002 | test("caches are scoped to branches and pull requests; artifacts keep their retention-days", { timeout: 900_000 }, async () => { |
| 1003 | const owner = (await ok("GET", "/user")).login; |
| 1004 | await ok("POST", "/user/repos", { name: "scopes" }); |
| 1005 | const src = join(work, "scopes"); |
| 1006 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1007 | writeFileSync(join(src, ".github/workflows/scopes.yml"), SCOPES_WORKFLOW); |
| 1008 | writeFileSync(join(src, "README.md"), "# scopes\n"); |
| 1009 | git(src, ["init", "-q", "-b", "main"]); |
| 1010 | git(src, ["add", "-A"]); |
| 1011 | git(src, ["commit", "-q", "-m", "scopes"]); |
| 1012 | git(src, ["remote", "add", "origin", `${base}/${owner}/scopes.git`]); |
| 1013 | /** Runs the job a push or pull request started; returns what its caches restored. */ |
| 1014 | const restored = async () => { |
| 1015 | const { claim } = await runOneJob(owner, "scopes", { timeoutMs: 300_000 }); |
| 1016 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/scopes/actions/jobs/${claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 1017 | const m = /^\S+ restored built=\[(.*?)\] real=\[(.*?)\]$/m.exec(log); |
| 1018 | assert.ok(m, log); |
| 1019 | return { builtin: m[1], real: m[2] }; |
| 1020 | }; |
| 1021 | const branch = (name, from, file) => { |
| 1022 | git(src, ["checkout", "-q", "-b", name, from]); |
| 1023 | if (file) { |
| 1024 | writeFileSync(join(src, file), `${name}\n`); |
| 1025 | git(src, ["add", file]); |
| 1026 | git(src, ["commit", "-q", "-m", name]); |
| 1027 | } |
| 1028 | git(src, ["push", "-q", "origin", name]); |
| 1029 | }; |
| 1030 | |
| 1031 | // The default branch starts empty and saves its own entries. |
| 1032 | git(src, ["push", "-q", "origin", "main"]); |
| 1033 | assert.deepEqual(await restored(), { builtin: "", real: "" }); |
| 1034 | // A branch falls back to the default branch's caches... |
| 1035 | branch("a", "main", "a.txt"); |
| 1036 | assert.deepEqual(await restored(), { builtin: "refs/heads/main", real: "refs/heads/main" }); |
| 1037 | // ...but never sees another branch's, though a's are newer and match the restore key. |
| 1038 | branch("b", "main", "b.txt"); |
| 1039 | assert.deepEqual(await restored(), { builtin: "refs/heads/main", real: "refs/heads/main" }); |
| 1040 | // A pull request reads its base branch's caches. |
| 1041 | branch("c", "a", "c.txt"); |
| 1042 | await ok("POST", `/repos/${owner}/scopes/pulls`, { title: "c into a", head: "c", base: "a" }); |
| 1043 | assert.deepEqual(await restored(), { builtin: "refs/heads/a", real: "refs/heads/a" }); |
| 1044 | // Another pull request doesn't see the first one's (saved under refs/pull/<n>/merge). |
| 1045 | branch("d", "main", "d.txt"); |
| 1046 | await ok("POST", `/repos/${owner}/scopes/pulls`, { title: "d into main", head: "d", base: "main" }); |
| 1047 | assert.deepEqual(await restored(), { builtin: "refs/heads/main", real: "refs/heads/main" }); |
| 1048 | const caches = await ok("GET", `/repos/${owner}/scopes/actions/caches?per_page=100`); |
| 1049 | assert.deepEqual([...new Set(caches.actions_caches.map((c) => c.ref))].sort(), ["refs/heads/a", "refs/heads/b", "refs/heads/main", "refs/pull/1/merge", "refs/pull/2/merge"]); |
| 1050 | |
| 1051 | // retention-days (the built-in and the real upload-artifact), capped at 90 days. |
| 1052 | const days = (iso) => Math.round((Date.parse(iso) - Date.now()) / 86_400_000); |
| 1053 | const artifacts = (await ok("GET", `/repos/${owner}/scopes/actions/runs/1/artifacts`)).artifacts; |
| 1054 | const byName = Object.fromEntries(artifacts.map((a) => [a.name.replace(/-\d+$/, ""), a])); |
| 1055 | assert.equal(days(byName.builtin.expires_at), 1, JSON.stringify(byName.builtin)); |
| 1056 | assert.equal(days(byName.real.expires_at), 3, JSON.stringify(byName.real)); |
| 1057 | assert.equal(days(byName.capped.expires_at), 90, JSON.stringify(byName.capped)); |
| 1058 | assert.ok(artifacts.every((a) => a.expired === false)); |
| 1059 | }); |
| 1060 | |
| 1061 | test("an older runner's cache API is scoped the same way", async () => { |
| 1062 | const owner = (await ok("GET", "/user")).login; |
| 1063 | await ok("POST", "/user/repos", { name: "legacy-cache" }); |
| 1064 | const src = join(work, "legacy-cache"); |
| 1065 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1066 | writeFileSync(join(src, ".github/workflows/w.yml"), "on:\n push:\n branches: [main, a, b]\njobs:\n j:\n runs-on: [self-hosted, linux]\n steps: [{ run: echo }]\n"); |
| 1067 | git(src, ["init", "-q", "-b", "main"]); |
| 1068 | git(src, ["add", "-A"]); |
| 1069 | git(src, ["commit", "-q", "-m", "legacy"]); |
| 1070 | git(src, ["remote", "add", "origin", `${base}/${owner}/legacy-cache.git`]); |
| 1071 | |
| 1072 | /** Claims the job a push started and starts it, as an older runner would, without running steps. */ |
| 1073 | const startJob = async () => { |
| 1074 | const claim = await until("a job to claim", async () => { |
| 1075 | const r = await api("POST", `/repos/${owner}/legacy-cache/actions/runners/claim`, { name: "old-runner", labels: ["linux"] }); |
| 1076 | return r.status === 200 ? r.json : null; |
| 1077 | }); |
| 1078 | const h = { authorization: `Bearer ${claim.token}` }; |
| 1079 | const at = `${base}/runner/jobs/${claim.job_id}`; |
| 1080 | assert.equal((await fetch(at, { headers: h })).status, 200); |
| 1081 | return { |
| 1082 | put: async (key, body) => (await fetch(`${at}/cache/${encodeURIComponent(key)}`, { method: "PUT", headers: { ...h, "content-length": String(body.length) }, body })).status, |
| 1083 | lookup: async (key, restore = "") => { |
| 1084 | const r = await fetch(`${at}/cache?key=${encodeURIComponent(key)}&restore=${encodeURIComponent(restore)}`, { headers: h }); |
| 1085 | if (r.status !== 200) return { status: r.status }; |
| 1086 | const hit = await r.json(); |
| 1087 | const blob = await fetch(hit.url, { headers: h }); |
| 1088 | return { key: hit.key, content: blob.status === 200 ? await blob.text() : blob.status }; |
| 1089 | }, |
| 1090 | blob: async (stored) => (await fetch(`${at}/cache/blob/${encodeURIComponent(stored)}`, { headers: h })).status, |
| 1091 | done: async () => assert.equal((await fetch(`${at}/complete`, { method: "POST", headers: { ...h, "content-type": "application/json" }, body: JSON.stringify({ conclusion: "success", outputs: {} }) })).status, 200), |
| 1092 | }; |
| 1093 | }; |
| 1094 | |
| 1095 | const branch = (name) => { |
| 1096 | git(src, ["checkout", "-q", "-b", name, "main"]); |
| 1097 | writeFileSync(join(src, `${name}.txt`), `${name}\n`); |
| 1098 | git(src, ["add", "-A"]); |
| 1099 | git(src, ["commit", "-q", "-m", name]); |
| 1100 | git(src, ["push", "-q", "origin", name]); |
| 1101 | }; |
| 1102 | |
| 1103 | git(src, ["push", "-q", "origin", "main"]); |
| 1104 | let job = await startJob(); |
| 1105 | assert.equal(await job.put("lk-main", "from main"), 200); |
| 1106 | await job.done(); |
| 1107 | |
| 1108 | branch("a"); |
| 1109 | job = await startJob(); |
| 1110 | assert.deepEqual(await job.lookup("lk-a", "lk-"), { key: "lk-main", content: "from main" }); |
| 1111 | assert.equal(await job.put("lk-a", "from a"), 200); |
| 1112 | assert.deepEqual(await job.lookup("lk-a"), { key: "lk-a", content: "from a" }); |
| 1113 | await job.done(); |
| 1114 | |
| 1115 | branch("b"); |
| 1116 | job = await startJob(); |
| 1117 | assert.deepEqual(await job.lookup("lk-a"), { status: 404 }); |
| 1118 | assert.deepEqual(await job.lookup("lk-x", "lk-"), { key: "lk-main", content: "from main" }); |
| 1119 | // a's entry can't be fetched directly either |
| 1120 | assert.equal(await job.blob("refs/heads/a\nlk-a"), 404); |
| 1121 | assert.equal(await job.blob("lk-a"), 404); |
| 1122 | await job.done(); |
| 1123 | }); |
| 1124 | |
| 1125 | const hasDocker = spawnSync("docker", ["info"], { stdio: "ignore", timeout: 15_000 }).status === 0; |
| 1126 | |
| 1127 | test("containers: a job container and service containers on a self-hosted runner", { skip: !hasDocker && "Docker is not available" }, async () => { |
| 1128 | const owner = (await ok("GET", "/user")).login; |
| 1129 | await ok("POST", "/user/repos", { name: "boxes" }); |
| 1130 | const src = join(work, "boxes"); |
| 1131 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1132 | // Docker Hub rate-limits anonymous pulls; mirror.gcr.io serves the same official images. |
| 1133 | writeFileSync( |
| 1134 | join(src, ".github/workflows/ci.yml"), |
| 1135 | `on: push |
| 1136 | jobs: |
| 1137 | boxed: |
| 1138 | runs-on: [self-hosted, linux] |
| 1139 | container: |
| 1140 | image: mirror.gcr.io/library/debian:\${{ github.event_name == 'push' && 'bookworm-slim' || 'nope' }} |
| 1141 | services: |
| 1142 | cache: |
| 1143 | image: mirror.gcr.io/library/redis:7-alpine |
| 1144 | options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30 |
| 1145 | steps: |
| 1146 | - run: | |
| 1147 | grep -q bookworm /etc/os-release && echo "inside debian" |
| 1148 | exec 3<>/dev/tcp/cache/6379 |
| 1149 | printf 'PING\\r\\n' >&3 |
| 1150 | read -r line <&3 |
| 1151 | echo "cache answered \${line%$'\\r'}" |
| 1152 | `, |
| 1153 | ); |
| 1154 | git(src, ["init", "-q", "-b", "main"]); |
| 1155 | git(src, ["add", "."]); |
| 1156 | git(src, ["commit", "-q", "-m", "containers"]); |
| 1157 | git(src, ["remote", "add", "origin", `${base}/${owner}/boxes.git`]); |
| 1158 | git(src, ["push", "-q", "origin", "main"]); |
| 1159 | |
| 1160 | const run = await until("boxes run", async () => (await ok("GET", `/repos/${owner}/boxes/actions/runs`)).workflow_runs[0]); |
| 1161 | const boxed = await runOneJob(owner, "boxes"); |
| 1162 | assert.equal(boxed.claim.name, "boxed"); |
| 1163 | const log = await (await fetch(`${base}/api/v3/repos/${owner}/boxes/actions/jobs/${boxed.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 1164 | assert.match(log, /inside debian/); |
| 1165 | assert.match(log, /cache answered \+PONG/); |
| 1166 | const done = await until("boxes run to complete", async () => { |
| 1167 | const r = await ok("GET", `/repos/${owner}/boxes/actions/runs/${run.id}`); |
| 1168 | return r.status === "completed" ? r : null; |
| 1169 | }); |
| 1170 | assert.equal(done.conclusion, "success"); |
| 1171 | }); |
| 1172 | |
| 1173 | // ---------------------------------------------------------------- the official actions, unmodified |
| 1174 | |
| 1175 | // No workflow-level permissions: jobs get the repository default (write), like GitHub's permissive default. |
| 1176 | const TOOLKIT_WORKFLOW = `name: Toolkit |
| 1177 | on: push |
| 1178 | jobs: |
| 1179 | produce: |
| 1180 | runs-on: [self-hosted, linux] |
| 1181 | steps: |
| 1182 | - uses: actions/checkout@v4 |
| 1183 | with: { lfs: true, submodules: true, persist-credentials: false } |
| 1184 | - name: LFS, submodules, no persisted credentials |
| 1185 | run: | |
| 1186 | cat big.bin lib/lib.txt |
| 1187 | git config --get-regexp 'extraheader' || echo "no persisted credentials" |
| 1188 | - uses: actions/checkout@v4 |
| 1189 | with: { path: sparse, sparse-checkout: docs } |
| 1190 | - run: echo "sparse=$(ls sparse | tr '\\n' ' ')" |
| 1191 | - id: real-cache |
| 1192 | uses: actions/cache@v4 |
| 1193 | env: { DIFFINERY_BUILTINS: "false" } |
| 1194 | with: { path: deps, key: "deps-\${{ hashFiles('lock.txt') }}" } |
| 1195 | - if: steps.real-cache.outputs.cache-hit != 'true' |
| 1196 | run: mkdir -p deps && echo "saved by run \${{ github.run_id }}" > deps/marker |
| 1197 | - run: echo "real-hit=\${{ steps.real-cache.outputs.cache-hit }} $(cat deps/marker)" |
| 1198 | - id: builtin-cache |
| 1199 | uses: actions/cache/restore@v4 |
| 1200 | with: { path: deps, key: "deps-\${{ hashFiles('lock.txt') }}", lookup-only: true } |
| 1201 | - id: v3-cache |
| 1202 | uses: actions/cache/restore@v3 |
| 1203 | env: { DIFFINERY_BUILTINS: "false" } |
| 1204 | with: { path: deps, key: "deps-\${{ hashFiles('lock.txt') }}", lookup-only: true } |
| 1205 | - run: echo "builtin-hit=\${{ steps.builtin-cache.outputs.cache-hit }} v3-hit=\${{ steps.v3-cache.outputs.cache-hit }}" |
| 1206 | - run: mkdir -p dist/sub && echo one > dist/one.txt && echo two > dist/sub/two.txt && echo hidden > dist/.hidden |
| 1207 | - id: up-real |
| 1208 | uses: actions/upload-artifact@v4 |
| 1209 | env: { DIFFINERY_BUILTINS: "false" } |
| 1210 | with: { name: dist-real, path: dist/, include-hidden-files: true, retention-days: 3 } |
| 1211 | - id: up-builtin |
| 1212 | uses: actions/upload-artifact@v4 |
| 1213 | with: { name: dist-builtin, path: dist/, compression-level: 0 } |
| 1214 | - run: echo "ids=\${{ steps.up-real.outputs.artifact-id }},\${{ steps.up-builtin.outputs.artifact-id }} url=\${{ steps.up-real.outputs.artifact-url }}" |
| 1215 | consume: |
| 1216 | needs: produce |
| 1217 | runs-on: [self-hosted, linux] |
| 1218 | steps: |
| 1219 | - uses: actions/download-artifact@v4 |
| 1220 | env: { DIFFINERY_BUILTINS: "false" } |
| 1221 | with: { path: all } |
| 1222 | - uses: actions/download-artifact@v4 |
| 1223 | with: { pattern: dist-*, path: merged, merge-multiple: true } |
| 1224 | - uses: actions/download-artifact@v4 |
| 1225 | env: { DIFFINERY_BUILTINS: "false" } |
| 1226 | with: { name: dist-builtin, path: one } |
| 1227 | - run: find all merged one -type f | LC_ALL=C sort | tr '\\n' ' ' |
| 1228 | - uses: actions/checkout@v4 |
| 1229 | with: { path: src } |
| 1230 | - id: prev |
| 1231 | run: echo "id=$(cat src/prev-run.txt 2>/dev/null)" >> "$GITHUB_OUTPUT" |
| 1232 | - if: steps.prev.outputs.id != '' |
| 1233 | uses: actions/download-artifact@v4 |
| 1234 | env: { DIFFINERY_BUILTINS: "false" } |
| 1235 | with: { name: dist-real, path: prev-real, run-id: "\${{ steps.prev.outputs.id }}", github-token: "\${{ github.token }}", repository: "\${{ github.repository }}" } |
| 1236 | - if: steps.prev.outputs.id != '' |
| 1237 | uses: actions/download-artifact@v4 |
| 1238 | with: { pattern: "dist-*", path: prev-builtin, run-id: "\${{ steps.prev.outputs.id }}", github-token: "\${{ github.token }}" } |
| 1239 | - if: steps.prev.outputs.id != '' |
| 1240 | run: echo "previous run $(cat prev-real/sub/two.txt) $(find prev-builtin -type f | LC_ALL=C sort | tr '\\n' ' ')" |
| 1241 | script: |
| 1242 | runs-on: [self-hosted, linux] |
| 1243 | steps: |
| 1244 | - id: gs |
| 1245 | uses: actions/github-script@v7 |
| 1246 | with: |
| 1247 | result-encoding: string |
| 1248 | script: | |
| 1249 | const { owner, repo } = context.repo; |
| 1250 | const label = \`from-run-\${context.runId}\`; |
| 1251 | await github.rest.issues.createLabel({ owner, repo, name: label, color: "ff0000" }); |
| 1252 | const { data: issue } = await github.rest.issues.create({ owner, repo, title: \`Opened by run \${context.runId}\`, body: "hello", labels: [label] }); |
| 1253 | await github.rest.issues.createComment({ owner, repo, issue_number: issue.number, body: "commented by github-script" }); |
| 1254 | const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number: issue.number }); |
| 1255 | const { data: got } = await github.rest.issues.get({ owner, repo, issue_number: issue.number }); |
| 1256 | const { data: pulls } = await github.rest.pulls.list({ owner, repo, state: "all" }); |
| 1257 | await github.rest.repos.createCommitStatus({ owner, repo, sha: context.sha, state: "success", context: "github-script", description: "set with the default GITHUB_TOKEN" }); |
| 1258 | return \`issue=\${issue.number} labels=\${got.labels.map((l) => l.name)} comments=\${comments.length} pulls=\${pulls.length} event=\${context.eventName} repo=\${context.payload.repository.full_name} sender=\${context.payload.sender.login}\`; |
| 1259 | - run: echo "script says $RESULT" |
| 1260 | env: { RESULT: "\${{ steps.gs.outputs.result }}" } |
| 1261 | restricted: |
| 1262 | runs-on: [self-hosted, linux] |
| 1263 | permissions: { contents: read } |
| 1264 | steps: |
| 1265 | - id: gs |
| 1266 | uses: actions/github-script@v7 |
| 1267 | with: |
| 1268 | result-encoding: string |
| 1269 | script: | |
| 1270 | const { owner, repo } = context.repo; |
| 1271 | const { data: meta } = await github.rest.repos.get({ owner, repo }); |
| 1272 | try { |
| 1273 | await github.rest.issues.create({ owner, repo, title: "must not be created" }); |
| 1274 | return "issue write allowed"; |
| 1275 | } catch (e) { |
| 1276 | return \`repo=\${meta.name} issue write -> \${e.status}: \${e.message}\`; |
| 1277 | } |
| 1278 | - run: echo "restricted says $RESULT" |
| 1279 | env: { RESULT: "\${{ steps.gs.outputs.result }}" } |
| 1280 | node: |
| 1281 | runs-on: [self-hosted, linux] |
| 1282 | steps: |
| 1283 | - uses: actions/checkout@v4 |
| 1284 | - id: node |
| 1285 | uses: actions/setup-node@v4 |
| 1286 | with: { node-version: 20, cache: npm } |
| 1287 | - run: npm ci --no-audit --no-fund && echo "node=$(node --version) npm-cache-hit=\${{ steps.node.outputs.cache-hit }}" |
| 1288 | java: |
| 1289 | runs-on: [self-hosted, linux] |
| 1290 | steps: |
| 1291 | - uses: actions/checkout@v4 |
| 1292 | - id: java |
| 1293 | uses: actions/setup-java@v4 |
| 1294 | with: { distribution: oracle, java-version: "21", cache: maven } |
| 1295 | - run: | |
| 1296 | mkdir -p ~/.m2/repository/e2e && echo "run \${{ github.run_id }}" > ~/.m2/repository/e2e/marker |
| 1297 | echo "java=$(java -version 2>&1 | grep version) maven-cache-hit=\${{ steps.java.outputs.cache-hit }} $(cat ~/.m2/repository/e2e/marker)" |
| 1298 | `; |
| 1299 | |
| 1300 | /** Runs every job of `run` with the real agent; returns their logs by job name. */ |
| 1301 | async function runToolkit(owner, run) { |
| 1302 | const home = join(work, "toolkit-home"); |
| 1303 | const logs = {}; |
| 1304 | for (let i = 0; i < 6; i++) { |
| 1305 | const job = await runOneJob(owner, "toolkit", { |
| 1306 | timeoutMs: 420_000, |
| 1307 | envFor: (claim) => { |
| 1308 | // A fresh HOME per job (at the same path, as on hosted runners): caches must come from the cache service. |
| 1309 | rmSync(home, { recursive: true, force: true }); |
| 1310 | mkdirSync(home, { recursive: true }); |
| 1311 | return { |
| 1312 | ...(process.env.E2E_RUNNER_IMAGE ? {} : { HOME: home, RUNNER_TOOL_CACHE: join(work, "toolcache") }), |
| 1313 | // The node job runs every action for real, checkout and setup-node included. |
| 1314 | ...(claim.name === "node" ? { DIFFINERY_DISABLE_BUILTINS: "1" } : {}), |
| 1315 | }; |
| 1316 | }, |
| 1317 | }); |
| 1318 | // Without the timestamps, so assertions can span lines. |
| 1319 | const raw = await (await fetch(`${base}/api/v3/repos/${owner}/toolkit/actions/jobs/${job.claim.job_id}/logs`, { headers: { authorization: `Bearer ${token}` } })).text(); |
| 1320 | logs[job.claim.name] = raw.replace(/^\S+Z /gm, ""); |
| 1321 | // Kept with E2E_KEEP=1 for debugging. |
| 1322 | mkdirSync(join(work, "toolkit-logs"), { recursive: true }); |
| 1323 | writeFileSync(join(work, "toolkit-logs", `run${run.run_number}-${job.claim.name}.log`), `${logs[job.claim.name]}\n--- agent ---\n${job.out}`); |
| 1324 | } |
| 1325 | const done = await until("toolkit run to complete", async () => { |
| 1326 | const r = await ok("GET", `/repos/${owner}/toolkit/actions/runs/${run.id}`); |
| 1327 | return r.status === "completed" ? r : null; |
| 1328 | }); |
| 1329 | assert.equal(done.conclusion, "success", JSON.stringify(logs, null, 2).slice(-8000)); |
| 1330 | return logs; |
| 1331 | } |
| 1332 | |
| 1333 | const toolkit = {}; |
| 1334 | |
| 1335 | test("official actions: checkout, cache, artifacts, github-script and setup-* run unmodified", { timeout: 1_200_000 }, async () => { |
| 1336 | const owner = (await ok("GET", "/user")).login; |
| 1337 | toolkit.owner = owner; |
| 1338 | // A submodule repository, then the main one (LFS object, submodule, sparse-checkout target). |
| 1339 | // Public: like GITHUB_TOKEN, the job token reads only its own repository and public ones. |
| 1340 | await ok("POST", "/user/repos", { name: "toolkit-lib", visibility: "public" }); |
| 1341 | const lib = join(work, "toolkit-lib"); |
| 1342 | mkdirSync(lib, { recursive: true }); |
| 1343 | writeFileSync(join(lib, "lib.txt"), "from the submodule\n"); |
| 1344 | git(lib, ["init", "-q", "-b", "main"]); |
| 1345 | git(lib, ["add", "."]); |
| 1346 | git(lib, ["commit", "-q", "-m", "lib"]); |
| 1347 | git(lib, ["remote", "add", "origin", `${base}/${owner}/toolkit-lib.git`]); |
| 1348 | git(lib, ["push", "-q", "origin", "main"]); |
| 1349 | const libSha = git(lib, ["rev-parse", "HEAD"]).trim(); |
| 1350 | |
| 1351 | await ok("POST", "/user/repos", { name: "toolkit" }); |
| 1352 | // Jobs without permissions: write with the default token (the setting older repositories keep). |
| 1353 | await ok("PUT", `/repos/${owner}/toolkit/actions/permissions/workflow`, { default_workflow_permissions: "write" }); |
| 1354 | const src = join(work, "toolkit"); |
| 1355 | toolkit.src = src; |
| 1356 | mkdirSync(join(src, ".github/workflows"), { recursive: true }); |
| 1357 | mkdirSync(join(src, "docs")); |
| 1358 | writeFileSync(join(src, ".github/workflows/toolkit.yml"), TOOLKIT_WORKFLOW); |
| 1359 | writeFileSync(join(src, "docs/guide.md"), "# guide\n"); |
| 1360 | writeFileSync(join(src, "README.md"), "# toolkit\n"); |
| 1361 | writeFileSync(join(src, "lock.txt"), "v1\n"); |
| 1362 | writeFileSync(join(src, "package.json"), JSON.stringify({ name: "toolkit", version: "1.0.0", private: true }, null, 2) + "\n"); |
| 1363 | writeFileSync(join(src, "package-lock.json"), JSON.stringify({ name: "toolkit", version: "1.0.0", lockfileVersion: 3, requires: true, packages: { "": { name: "toolkit", version: "1.0.0" } } }, null, 2) + "\n"); |
| 1364 | writeFileSync(join(src, "pom.xml"), "<project><modelVersion>4.0.0</modelVersion><groupId>e2e</groupId><artifactId>toolkit</artifactId><version>1</version></project>\n"); |
| 1365 | writeFileSync(join(src, ".gitmodules"), '[submodule "lib"]\n\tpath = lib\n\turl = ../toolkit-lib.git\n'); |
| 1366 | git(src, ["init", "-q", "-b", "main"]); |
| 1367 | git(src, ["lfs", "install", "--local"]); |
| 1368 | git(src, ["lfs", "track", "*.bin"]); |
| 1369 | writeFileSync(join(src, "big.bin"), "the real LFS content\n"); |
| 1370 | git(src, ["add", "-A"]); |
| 1371 | git(src, ["update-index", "--add", "--cacheinfo", `160000,${libSha},lib`]); |
| 1372 | git(src, ["commit", "-q", "-m", "toolkit"]); |
| 1373 | git(src, ["remote", "add", "origin", `${base}/${owner}/toolkit.git`]); |
| 1374 | git(src, ["push", "-q", "origin", "main"]); |
| 1375 | assert.match(git(src, ["show", "HEAD:big.bin"]), /git-lfs/, "big.bin is stored as an LFS pointer"); |
| 1376 | |
| 1377 | const run = await until("toolkit run", async () => (await ok("GET", `/repos/${owner}/toolkit/actions/runs`)).workflow_runs[0]); |
| 1378 | toolkit.firstRun = run; |
| 1379 | const logs = await runToolkit(owner, run); |
| 1380 | |
| 1381 | // checkout: LFS content, submodule over HTTP with the job token, credentials not persisted, sparse |
| 1382 | assert.match(logs.produce, /the real LFS content\nfrom the submodule/); |
| 1383 | assert.match(logs.produce, /no persisted credentials/); |
| 1384 | assert.match(logs.produce, /sparse=README\.md big\.bin docs lib lock\.txt package-lock\.json package\.json pom\.xml /); |
| 1385 | // cache: a miss on the first run, for the real action and the built-in alike |
| 1386 | assert.match(logs.produce, /real-hit= saved by run 1\b/); |
| 1387 | assert.match(logs.produce, /builtin-hit= v3-hit=/); |
| 1388 | assert.match(logs.produce, /Cache saved with (the )?key: deps-[0-9a-f]{64}/); |
| 1389 | // artifacts: ids from both uploads, the URL points back at this server |
| 1390 | assert.match(logs.produce, new RegExp(`ids=\\d+,\\d+ url=${base}/${owner}/toolkit/actions/runs/1/artifacts/\\d+`)); |
| 1391 | assert.match( |
| 1392 | logs.consume, |
| 1393 | /all\/dist-builtin\/one\.txt all\/dist-builtin\/sub\/two\.txt all\/dist-real\/\.hidden all\/dist-real\/one\.txt all\/dist-real\/sub\/two\.txt merged\/\.hidden merged\/one\.txt merged\/sub\/two\.txt one\/one\.txt one\/sub\/two\.txt/, |
| 1394 | ); |
| 1395 | // github-script: REST calls with the job token |
| 1396 | assert.match(logs.script, /script says issue=1 labels=from-run-1 comments=1 pulls=0 event=push repo=[^/]+\/toolkit sender=\S+/); |
| 1397 | const issue = await ok("GET", `/repos/${owner}/toolkit/issues/1`); |
| 1398 | assert.equal(issue.title, "Opened by run 1"); |
| 1399 | assert.deepEqual(issue.labels.map((l) => l.name), ["from-run-1"]); |
| 1400 | assert.equal((await ok("GET", `/repos/${owner}/toolkit/issues/1/comments`))[0].body, "commented by github-script"); |
| 1401 | const statuses = await ok("GET", `/repos/${owner}/toolkit/commits/${run.head_sha}/statuses`); |
| 1402 | assert.equal(statuses.find((s) => s.context === "github-script")?.state, "success", JSON.stringify(statuses)); |
| 1403 | // `permissions: { contents: read }`: reading works, issue writes are refused |
| 1404 | assert.match(logs.restricted, /restricted says repo=toolkit issue write -> 403: .*issues/); |
| 1405 | assert.equal((await ok("GET", `/repos/${owner}/toolkit/issues?state=all`)).filter((i) => i.title === "must not be created").length, 0); |
| 1406 | // setup-node (the real action, DIFFINERY_DISABLE_BUILTINS=1) and setup-java: installed, caches saved |
| 1407 | assert.match(logs.node, /node=v20\.\d+\.\d+ npm-cache-hit=false/); |
| 1408 | assert.match(logs.node, /Cache saved with (the )?key: node-cache-Linux-x64-npm-[0-9a-f]{64}/); |
| 1409 | assert.match(logs.java, /java=java version "21[^\n]* maven-cache-hit=false run 1/); |
| 1410 | assert.match(logs.java, /Cache saved with (the )?key: setup-java-Linux-x64-maven-[0-9a-f]{64}/); |
| 1411 | |
| 1412 | // the REST API lists the run's artifacts and caches |
| 1413 | const artifacts = await ok("GET", `/repos/${owner}/toolkit/actions/runs/1/artifacts`); |
| 1414 | assert.deepEqual(artifacts.artifacts.map((a) => a.name).sort(), ["dist-builtin", "dist-real"]); |
| 1415 | const caches = await ok("GET", `/repos/${owner}/toolkit/actions/caches`); |
| 1416 | assert.equal(caches.total_count, 3, JSON.stringify(caches)); |
| 1417 | const zip = await fetch(`${base}/api/v3/repos/${owner}/toolkit/actions/artifacts/${artifacts.artifacts[0].id}/zip`, { headers: { authorization: `Bearer ${token}` }, redirect: "manual" }); |
| 1418 | assert.equal(zip.status, 302); |
| 1419 | assert.equal((await fetch(zip.headers.get("location"))).headers.get("content-type"), "application/zip"); |
| 1420 | }); |
| 1421 | |
| 1422 | test("official actions: the second run hits every cache and reads the first run's artifacts", { timeout: 1_200_000 }, async () => { |
| 1423 | const { owner, src, firstRun } = toolkit; |
| 1424 | assert.ok(firstRun, "the first toolkit run must have completed"); |
| 1425 | writeFileSync(join(src, "prev-run.txt"), `${firstRun.run_number}\n`); |
| 1426 | git(src, ["add", "prev-run.txt"]); |
| 1427 | git(src, ["commit", "-q", "-m", "second run"]); |
| 1428 | git(src, ["push", "-q", "origin", "main"]); |
| 1429 | const run = await until("second toolkit run", async () => (await ok("GET", `/repos/${owner}/toolkit/actions/runs`)).workflow_runs.find((r) => r.run_number === 2)); |
| 1430 | const logs = await runToolkit(owner, run); |
| 1431 | |
| 1432 | // The entry the real action saved restores with the real action (v4 and v3) and the built-in. |
| 1433 | assert.match(logs.produce, /real-hit=true saved by run 1\b/); |
| 1434 | assert.match(logs.produce, /builtin-hit=true v3-hit=true/); |
| 1435 | assert.match(logs.produce, /Cache hit occurred on the primary key deps-[0-9a-f]{64}, not saving cache\./); |
| 1436 | assert.match(logs.node, /npm-cache-hit=true/); |
| 1437 | assert.match(logs.java, /maven-cache-hit=true run 2/); |
| 1438 | // Artifacts of another run, through the REST API with github-token (real action and built-in). |
| 1439 | assert.match(logs.consume, /previous run two prev-builtin\/dist-builtin\/one\.txt prev-builtin\/dist-builtin\/sub\/two\.txt prev-builtin\/dist-real\/\.hidden prev-builtin\/dist-real\/one\.txt prev-builtin\/dist-real\/sub\/two\.txt/); |
| 1440 | assert.match(logs.script, /script says issue=2 labels=from-run-2 comments=1/); |
| 1441 | }); |
| 1442 | |
| 1443 | test("D1 sessions: bookmarks for token clients and browsers", async () => { |
| 1444 | // Token clients get the bookmark in a header and can send it back to read their own writes. |
| 1445 | const r = await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}` } }); |
| 1446 | assert.equal(r.status, 200); |
| 1447 | const bookmark = r.headers.get("x-d1-bookmark"); |
| 1448 | assert.match(bookmark ?? "", /^[0-9a-f]+(-[0-9a-f]+)+$/i); |
| 1449 | assert.equal(r.headers.get("set-cookie"), null); |
| 1450 | const again = await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}`, "x-d1-bookmark": bookmark } }); |
| 1451 | assert.equal(again.status, 200); |
| 1452 | // A junk bookmark is ignored rather than breaking the request. |
| 1453 | assert.equal((await fetch(`${base}/api/v3/user`, { headers: { authorization: `Bearer ${token}`, "x-d1-bookmark": "nope" } })).status, 200); |
| 1454 | // Anonymous page views don't get a cookie; a browser that writes (any non-GET) does. |
| 1455 | assert.equal((await fetch(`${base}/`)).headers.get("set-cookie")?.includes("__Host-dfy_d1") ?? false, false); |
| 1456 | const post = await fetch(`${base}/auth/logout`, { method: "POST", redirect: "manual", headers: { "sec-fetch-site": "same-origin" } }); |
| 1457 | assert.match(post.headers.get("set-cookie") ?? "", /__Host-dfy_d1=[0-9a-f-]+; Max-Age=86400; Path=\/; HttpOnly; Secure; SameSite=Lax/); |
| 1458 | }); |
| 1459 | |
| 1460 | test("GitHub REST compatibility: Octokit against releases, statuses, git data, issues, deployments and search", async () => { |
| 1461 | const { Octokit } = await import("@octokit/rest"); |
| 1462 | const gh = new Octokit({ auth: token, baseUrl: `${base}/api/v3`, userAgent: "diffinery-e2e", request: { retries: 0 } }); |
| 1463 | const owner = (await gh.rest.users.getAuthenticated()).data.login; |
| 1464 | const repo = "compat"; |
| 1465 | const R = { owner, repo }; |
| 1466 | |
| 1467 | // ------------------------------------------------------------ repository, pushed with git |
| 1468 | const created = await gh.rest.repos.createForAuthenticatedUser({ name: repo, description: "Octokit compatibility" }); |
| 1469 | assert.equal(created.status, 201); |
| 1470 | assert.equal(created.data.full_name, `${owner}/${repo}`); |
| 1471 | assert.match(created.data.node_id, /\S/); |
| 1472 | assert.equal(created.data.owner.login, owner); |
| 1473 | const src = join(work, "compat"); |
| 1474 | mkdirSync(join(src, "src"), { recursive: true }); |
| 1475 | writeFileSync(join(src, "README.md"), "# compat\n"); |
| 1476 | writeFileSync(join(src, "src/main.ts"), "export const x = 1;\n"); |
| 1477 | git(src, ["init", "-q", "-b", "main"]); |
| 1478 | git(src, ["add", "-A"]); |
| 1479 | git(src, ["commit", "-q", "-m", "initial"]); |
| 1480 | git(src, ["remote", "add", "origin", `${base}/${owner}/${repo}.git`]); |
| 1481 | git(src, ["push", "-q", "origin", "main"]); |
| 1482 | const mainSha = git(src, ["rev-parse", "HEAD"]).trim(); |
| 1483 | |
| 1484 | const r = await gh.rest.repos.get(R); |
| 1485 | assert.equal(r.data.default_branch, "main"); |
| 1486 | assert.equal(r.data.permissions.admin, true); |
| 1487 | assert.equal(r.headers["x-github-media-type"], "github.v3; format=json"); |
| 1488 | const rate = await gh.rest.rateLimit.get(); |
| 1489 | assert.ok(rate.data.resources.core.remaining > 0); |
| 1490 | |
| 1491 | // GitHub error bodies: message and documentation_url, surfaced by Octokit's RequestError. |
| 1492 | await assert.rejects(gh.rest.repos.getContent({ ...R, path: "missing.txt" }), (e) => e.status === 404 && typeof e.response.data.message === "string" && typeof e.response.data.documentation_url === "string"); |
| 1493 | |
| 1494 | // ------------------------------------------------------------ contents |
| 1495 | const readme = await gh.rest.repos.getContent({ ...R, path: "README.md" }); |
| 1496 | assert.equal(readme.data.type, "file"); |
| 1497 | assert.equal(Buffer.from(readme.data.content, "base64").toString(), "# compat\n"); |
| 1498 | const rawReadme = await gh.rest.repos.getContent({ ...R, path: "README.md", mediaType: { format: "raw" } }); |
| 1499 | assert.equal(rawReadme.data, "# compat\n"); |
| 1500 | const dir = await gh.rest.repos.getContent({ ...R, path: "src" }); |
| 1501 | assert.deepEqual(dir.data.map((e) => e.name), ["main.ts"]); |
| 1502 | await assert.rejects(gh.rest.repos.createOrUpdateFileContents({ ...R, path: "README.md", message: "stale", content: Buffer.from("x").toString("base64"), sha: "0".repeat(40) }), (e) => e.status === 409); |
| 1503 | const put = await gh.rest.repos.createOrUpdateFileContents({ ...R, path: "README.md", message: "Update README", content: Buffer.from("# compat\n\nUpdated.\n").toString("base64"), sha: readme.data.sha, committer: { name: "Release Bot", email: "bot@example.com" } }); |
| 1504 | assert.equal(put.status, 200); |
| 1505 | assert.equal(put.data.commit.committer.name, "Release Bot"); |
| 1506 | const added = await gh.rest.repos.createOrUpdateFileContents({ ...R, path: "docs/guide.md", message: "Add guide", content: Buffer.from("guide\n").toString("base64") }); |
| 1507 | assert.equal(added.status, 201); |
| 1508 | const readmeApi = await gh.rest.repos.getReadme(R); |
| 1509 | assert.equal(readmeApi.data.path, "README.md"); |
| 1510 | |
| 1511 | // ------------------------------------------------------------ git data: blob -> tree -> commit -> ref, then git sees it |
| 1512 | const headSha = (await gh.rest.git.getRef({ ...R, ref: "heads/main" })).data.object.sha; |
| 1513 | assert.equal(headSha, added.data.commit.sha); |
| 1514 | const blob = await gh.rest.git.createBlob({ ...R, content: Buffer.from("made with the git data API\n").toString("base64"), encoding: "base64" }); |
| 1515 | assert.equal(blob.status, 201); |
| 1516 | assert.equal(Buffer.from((await gh.rest.git.getBlob({ ...R, file_sha: blob.data.sha })).data.content, "base64").toString(), "made with the git data API\n"); |
| 1517 | const headCommit = await gh.rest.git.getCommit({ ...R, commit_sha: headSha }); |
| 1518 | const tree = await gh.rest.git.createTree({ ...R, base_tree: headCommit.data.tree.sha, tree: [{ path: "gitdata/hello.txt", mode: "100644", type: "blob", sha: blob.data.sha }, { path: "inline.txt", mode: "100644", type: "blob", content: "inline\n" }] }); |
| 1519 | const full = await gh.rest.git.getTree({ ...R, tree_sha: tree.data.sha, recursive: "true" }); |
| 1520 | assert.ok(full.data.tree.some((e) => e.path === "gitdata/hello.txt" && e.type === "blob")); |
| 1521 | assert.ok(full.data.tree.some((e) => e.path === "src/main.ts")); |
| 1522 | const commit = await gh.rest.git.createCommit({ ...R, message: "Commit from the git data API", tree: tree.data.sha, parents: [headSha], author: { name: "Octo Cat", email: "octo@example.com", date: "2024-05-06T07:08:09Z" } }); |
| 1523 | assert.equal(commit.data.author.name, "Octo Cat"); |
| 1524 | assert.deepEqual(commit.data.parents.map((p) => p.sha), [headSha]); |
| 1525 | const ref = await gh.rest.git.createRef({ ...R, ref: "refs/heads/feature", sha: commit.data.sha }); |
| 1526 | assert.equal(ref.data.ref, "refs/heads/feature"); |
| 1527 | assert.equal(ref.data.object.type, "commit"); |
| 1528 | await assert.rejects(gh.rest.git.createRef({ ...R, ref: "refs/heads/feature", sha: commit.data.sha }), (e) => e.status === 422); |
| 1529 | const matching = await gh.rest.git.listMatchingRefs({ ...R, ref: "heads/f" }); |
| 1530 | assert.deepEqual(matching.data.map((x) => x.ref), ["refs/heads/feature"]); |
| 1531 | const tag = await gh.rest.git.createTag({ ...R, tag: "v0.1.0", message: "Annotated tag", object: commit.data.sha, type: "commit", tagger: { name: "Octo Cat", email: "octo@example.com", date: "2024-05-06T07:08:09Z" } }); |
| 1532 | await gh.rest.git.createRef({ ...R, ref: "refs/tags/v0.1.0", sha: tag.data.sha }); |
| 1533 | assert.equal((await gh.rest.git.getTag({ ...R, tag_sha: tag.data.sha })).data.object.sha, commit.data.sha); |
| 1534 | assert.equal((await gh.rest.git.getRef({ ...R, ref: "tags/v0.1.0" })).data.object.type, "tag"); |
| 1535 | git(src, ["fetch", "-q", "origin", "feature", "--tags"]); |
| 1536 | assert.equal(git(src, ["show", "FETCH_HEAD:gitdata/hello.txt"]), "made with the git data API\n"); |
| 1537 | assert.equal(git(src, ["cat-file", "-t", "v0.1.0"]).trim(), "tag"); |
| 1538 | |
| 1539 | // ------------------------------------------------------------ commit statuses count as checks, also for required checks |
| 1540 | await ok("PUT", `/repos/${owner}/${repo}/branches/main/protection`, { requirePullRequest: true, requiredChecks: ["ci/external"] }); |
| 1541 | const pr = await gh.rest.pulls.create({ ...R, title: "Feature", head: "feature", base: "main", body: "Adds files" }); |
| 1542 | assert.equal(pr.status, 201); |
| 1543 | const pending = await until("mergeability", async () => { |
| 1544 | const p = (await gh.rest.pulls.get({ ...R, pull_number: pr.data.number })).data; |
| 1545 | return typeof p.mergeable === "boolean" ? p : null; |
| 1546 | }); |
| 1547 | assert.equal(pending.mergeable, true); |
| 1548 | assert.equal(pending.mergeable_state, "blocked"); |
| 1549 | assert.equal(pending.head.sha, commit.data.sha); |
| 1550 | const st = await gh.rest.repos.createCommitStatus({ ...R, sha: commit.data.sha, state: "success", context: "ci/external", description: "External CI passed", target_url: "https://ci.example.com/build/1" }); |
| 1551 | assert.equal(st.status, 201); |
| 1552 | assert.equal(st.data.creator.login, owner); |
| 1553 | await assert.rejects(gh.rest.repos.createCommitStatus({ ...R, sha: commit.data.sha, state: "great" }), (e) => e.status === 422); |
| 1554 | const combined = await gh.rest.repos.getCombinedStatusForRef({ ...R, ref: "feature" }); |
| 1555 | assert.equal(combined.data.state, "success"); |
| 1556 | assert.equal(combined.data.total_count, 1); |
| 1557 | assert.equal(combined.data.statuses[0].context, "ci/external"); |
| 1558 | assert.equal((await gh.rest.repos.listCommitStatusesForRef({ ...R, ref: commit.data.sha })).data.length, 1); |
| 1559 | const clean = (await gh.rest.pulls.get({ ...R, pull_number: pr.data.number })).data; |
| 1560 | assert.equal(clean.mergeable_state, "clean"); |
| 1561 | const prPage = await (await fetch(`${base}/${owner}/${repo}/pull/${pr.data.number}/checks`)).text(); |
| 1562 | assert.match(prPage, /ci\/external/); |
| 1563 | assert.match(prPage, /https:\/\/ci\.example\.com\/build\/1/); |
| 1564 | |
| 1565 | // ------------------------------------------------------------ pull request sub-resources |
| 1566 | const byHead = await gh.rest.pulls.list({ ...R, head: `${owner}:feature`, state: "open" }); |
| 1567 | assert.deepEqual(byHead.data.map((p) => p.number), [pr.data.number]); |
| 1568 | assert.equal((await gh.rest.pulls.list({ ...R, base: "other" })).data.length, 0); |
| 1569 | const assoc = await gh.rest.repos.listPullRequestsAssociatedWithCommit({ ...R, commit_sha: commit.data.sha }); |
| 1570 | assert.deepEqual(assoc.data.map((p) => p.number), [pr.data.number]); |
| 1571 | const rc = await gh.rest.pulls.createReviewComment({ ...R, pull_number: pr.data.number, body: "Why this file?", commit_id: commit.data.sha, path: "inline.txt", line: 1, side: "RIGHT" }); |
| 1572 | assert.equal(rc.status, 201); |
| 1573 | assert.equal(rc.data.path, "inline.txt"); |
| 1574 | const reply = await gh.rest.pulls.createReplyForReviewComment({ ...R, pull_number: pr.data.number, comment_id: rc.data.id, body: "For the test." }); |
| 1575 | assert.equal(reply.data.in_reply_to_id, rc.data.id); |
| 1576 | // Numeric ids, like GitHub's: actions parse them with Number() and pass them back. |
| 1577 | assert.equal(typeof rc.data.id, "number"); |
| 1578 | assert.equal(typeof rc.data.pull_request_review_id, "number"); |
| 1579 | assert.equal((await gh.rest.pulls.listReviewComments({ ...R, pull_number: pr.data.number })).data.length, 2); |
| 1580 | await gh.rest.reactions.createForPullRequestReviewComment({ ...R, comment_id: rc.data.id, content: "eyes" }); |
| 1581 | const merged = await gh.rest.pulls.merge({ ...R, pull_number: pr.data.number, merge_method: "squash" }); |
| 1582 | assert.equal(merged.data.merged, true); |
| 1583 | const merges = await gh.rest.issues.listEventsForTimeline({ ...R, issue_number: pr.data.number }); |
| 1584 | assert.ok(merges.data.some((e) => e.event === "merged")); |
| 1585 | |
| 1586 | // ------------------------------------------------------------ releases and assets |
| 1587 | const rel = await gh.rest.repos.createRelease({ ...R, tag_name: "v1.0.0", target_commitish: "main", name: "First", generate_release_notes: true }); |
| 1588 | assert.equal(rel.status, 201); |
| 1589 | assert.match(rel.data.body, /Full Changelog/); |
| 1590 | assert.match(rel.data.body, /Feature by @/); |
| 1591 | assert.equal(rel.data.author.login, owner); |
| 1592 | assert.match(rel.data.upload_url, /\/api\/uploads\/repos\/.+\/releases\/\d+\/assets\{\?name,label\}$/); |
| 1593 | assert.match(git(src, ["ls-remote", "--tags", "origin"]), /refs\/tags\/v1\.0\.0/); |
| 1594 | const bytes = Buffer.from("hello from a release asset\n"); |
| 1595 | const up = await gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "hello.txt", label: "Greeting", data: bytes, url: rel.data.upload_url, headers: { "content-type": "text/plain", "content-length": bytes.length } }); |
| 1596 | assert.equal(up.status, 201); |
| 1597 | assert.equal(up.data.name, "hello.txt"); |
| 1598 | assert.equal(up.data.size, bytes.length); |
| 1599 | assert.equal(up.data.state, "uploaded"); |
| 1600 | const bin = Buffer.from(randomBytes(70_000)); |
| 1601 | const up2 = await gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "tool linux.bin", data: bin, baseUrl: `${base}/api/uploads`, headers: { "content-type": "application/octet-stream", "content-length": bin.length } }); |
| 1602 | assert.equal(up2.data.name, "tool.linux.bin"); |
| 1603 | await assert.rejects(gh.rest.repos.uploadReleaseAsset({ ...R, release_id: rel.data.id, name: "hello.txt", data: bytes, url: rel.data.upload_url, headers: { "content-type": "text/plain", "content-length": bytes.length } }), (e) => e.status === 422); |
| 1604 | const viaApi = await gh.rest.repos.getReleaseAsset({ ...R, asset_id: up2.data.id, headers: { accept: "application/octet-stream" } }); |
| 1605 | assert.deepEqual(Buffer.from(viaApi.data), bin); |
| 1606 | const browser = await fetch(up.data.browser_download_url); |
| 1607 | assert.equal(browser.status, 200); |
| 1608 | assert.equal(await browser.text(), bytes.toString()); |
| 1609 | assert.match(browser.headers.get("content-disposition") ?? "", /attachment/); |
| 1610 | assert.equal((await gh.rest.repos.getReleaseAsset({ ...R, asset_id: up.data.id })).data.download_count, 1); |
| 1611 | assert.deepEqual((await gh.rest.repos.listReleaseAssets({ ...R, release_id: rel.data.id })).data.map((a) => a.name), ["hello.txt", "tool.linux.bin"]); |
| 1612 | assert.equal((await gh.rest.repos.updateReleaseAsset({ ...R, asset_id: up.data.id, label: "Hello" })).data.label, "Hello"); |
| 1613 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.id, rel.data.id); |
| 1614 | assert.equal((await gh.rest.repos.getReleaseByTag({ ...R, tag: "v1.0.0" })).data.assets.length, 2); |
| 1615 | const notes = await gh.rest.repos.generateReleaseNotes({ ...R, tag_name: "v1.1.0", previous_tag_name: "v1.0.0" }); |
| 1616 | assert.match(notes.data.body, /compare\/v1\.0\.0\.\.\.v1\.1\.0/); |
| 1617 | await gh.rest.reactions.createForRelease({ ...R, release_id: rel.data.id, content: "rocket" }); |
| 1618 | assert.equal((await gh.rest.repos.getRelease({ ...R, release_id: rel.data.id })).data.reactions.rocket, 1); |
| 1619 | |
| 1620 | // Drafts are for writers only; a read-only token sees neither the draft nor its tag lookup. |
| 1621 | const draft = await gh.rest.repos.createRelease({ ...R, tag_name: "v2.0.0-rc.1", name: "Next", draft: true, prerelease: true }); |
| 1622 | assert.equal(draft.data.draft, true); |
| 1623 | const reader = await ok("POST", "/diffinery/tokens", { name: "reader", scopes: ["read"] }); |
| 1624 | const ro = new Octokit({ auth: reader.token, baseUrl: `${base}/api/v3`, request: { retries: 0 } }); |
| 1625 | assert.deepEqual((await ro.rest.repos.listReleases(R)).data.map((x) => x.tag_name), ["v1.0.0"]); |
| 1626 | await assert.rejects(ro.rest.repos.getRelease({ ...R, release_id: draft.data.id }), (e) => e.status === 404); |
| 1627 | await assert.rejects(ro.rest.repos.createRelease({ ...R, tag_name: "v9" }), (e) => e.status === 403 || e.status === 404); |
| 1628 | const published = await gh.rest.repos.updateRelease({ ...R, release_id: draft.data.id, draft: false, make_latest: "false" }); |
| 1629 | assert.equal(published.data.draft, false); |
| 1630 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.tag_name, "v1.0.0"); |
| 1631 | await gh.rest.repos.deleteReleaseAsset({ ...R, asset_id: up2.data.id }); |
| 1632 | assert.equal((await fetch(`${base}/${owner}/${repo}/releases/download/v1.0.0/tool.linux.bin`)).status, 404); |
| 1633 | await gh.rest.repos.deleteRelease({ ...R, release_id: published.data.id }); |
| 1634 | await assert.rejects(gh.rest.repos.getReleaseByTag({ ...R, tag: "v2.0.0-rc.1" }), (e) => e.status === 404); |
| 1635 | |
| 1636 | // Archives |
| 1637 | const zipball = await gh.rest.repos.downloadZipballArchive({ ...R, ref: "v1.0.0" }); |
| 1638 | assert.equal(Buffer.from(zipball.data).subarray(0, 2).toString(), "PK"); |
| 1639 | const tarball = await gh.rest.repos.downloadTarballArchive({ ...R, ref: "main" }); |
| 1640 | assert.deepEqual([...Buffer.from(tarball.data).subarray(0, 2)], [0x1f, 0x8b]); |
| 1641 | const tgz = join(work, "compat.tar.gz"); |
| 1642 | writeFileSync(tgz, Buffer.from(tarball.data)); |
| 1643 | assert.match(execFileSync("tar", ["tzf", tgz], { encoding: "utf8" }), /\/gitdata\/hello\.txt/); |
| 1644 | |
| 1645 | // The web UI: releases list, the release page and the form (CSRF, Kumo controls, multipart upload). |
| 1646 | const list = await (await fetch(`${base}/${owner}/${repo}/releases`)).text(); |
| 1647 | assert.match(list, /First/); |
| 1648 | assert.match(list, /hello\.txt/); |
| 1649 | const form = await fetch(`${base}/${owner}/${repo}/releases/new`); |
| 1650 | const html = await form.text(); |
| 1651 | assert.doesNotMatch(html, /<select|type="checkbox"|type="radio"/); |
| 1652 | const csrf = /name="_csrf" value="([^"]+)"/.exec(html)?.[1]; |
| 1653 | const cookie = /dfy_csrf=([^;]+)/.exec(form.headers.get("set-cookie") ?? "")?.[1]; |
| 1654 | assert.ok(csrf && cookie); |
| 1655 | const fd = new FormData(); |
| 1656 | for (const [k, v] of Object.entries({ _csrf: csrf, tag: "", new_tag: "v3.0.0", target: "main", name: "From the web", body: "Notes from the form.", latest: "1", action: "publish" })) fd.append(k, v); |
| 1657 | fd.append("assets", new Blob(["web upload\n"], { type: "text/plain" }), "web.txt"); |
| 1658 | const submit = await fetch(`${base}/${owner}/${repo}/releases`, { method: "POST", body: fd, redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}` } }); |
| 1659 | assert.equal(submit.status, 303, await submit.text()); |
| 1660 | assert.equal(submit.headers.get("location"), `/${owner}/${repo}/releases/tag/v3.0.0`); |
| 1661 | assert.equal(await (await fetch(`${base}/${owner}/${repo}/releases/download/v3.0.0/web.txt`)).text(), "web upload\n"); |
| 1662 | assert.equal((await gh.rest.repos.getLatestRelease(R)).data.tag_name, "v3.0.0"); |
| 1663 | assert.match(await (await fetch(`${base}/${owner}/${repo}`)).text(), /From the web/); |
| 1664 | |
| 1665 | // ------------------------------------------------------------ issues: labels, assignees, lock, reactions, events, pagination |
| 1666 | await gh.rest.issues.createLabel({ ...R, name: "bug", color: "d73a4a", description: "Something is broken" }); |
| 1667 | await assert.rejects(gh.rest.issues.createLabel({ ...R, name: "bug", color: "d73a4a" }), (e) => e.status === 422); |
| 1668 | const issue = await gh.rest.issues.create({ ...R, title: "Crash on start", body: "It crashes.", labels: ["bug"], assignees: [owner] }); |
| 1669 | assert.deepEqual(issue.data.labels.map((l) => [l.name, l.color]), [["bug", "d73a4a"]]); |
| 1670 | assert.equal(issue.data.assignees[0].login, owner); |
| 1671 | assert.equal(issue.data.user.login, owner); |
| 1672 | assert.match(issue.data.html_url, new RegExp(`/${owner}/${repo}/issues/${issue.data.number}$`)); |
| 1673 | const n = issue.data.number; |
| 1674 | await gh.rest.issues.addLabels({ ...R, issue_number: n, labels: ["triage"] }); |
| 1675 | assert.deepEqual((await gh.rest.issues.listLabelsOnIssue({ ...R, issue_number: n })).data.map((l) => l.name).sort(), ["bug", "triage"]); |
| 1676 | await gh.rest.issues.removeLabel({ ...R, issue_number: n, name: "triage" }); |
| 1677 | await gh.rest.issues.removeAssignees({ ...R, issue_number: n, assignees: [owner] }); |
| 1678 | await gh.rest.issues.addAssignees({ ...R, issue_number: n, assignees: [owner] }); |
| 1679 | assert.equal((await gh.rest.issues.checkUserCanBeAssigned({ ...R, assignee: owner })).status, 204); |
| 1680 | const comment = await gh.rest.issues.createComment({ ...R, issue_number: n, body: "Same here." }); |
| 1681 | assert.equal(typeof comment.data.id, "number"); |
| 1682 | assert.equal((await gh.rest.issues.getComment({ ...R, comment_id: comment.data.id })).data.body, "Same here."); |
| 1683 | await gh.rest.issues.updateComment({ ...R, comment_id: comment.data.id, body: "Same here!" }); |
| 1684 | assert.equal((await gh.rest.issues.getComment({ ...R, comment_id: String(comment.data.id) })).data.body, "Same here!"); |
| 1685 | await gh.rest.reactions.createForIssue({ ...R, issue_number: n, content: "+1" }); |
| 1686 | const heart = await gh.rest.reactions.createForIssueComment({ ...R, comment_id: comment.data.id, content: "heart" }); |
| 1687 | assert.equal(heart.status, 201); |
| 1688 | assert.equal((await gh.rest.reactions.createForIssueComment({ ...R, comment_id: comment.data.id, content: "heart" })).status, 200); |
| 1689 | assert.deepEqual((await gh.rest.reactions.listForIssue({ ...R, issue_number: n })).data.map((x) => x.content), ["+1"]); |
| 1690 | assert.equal((await gh.rest.issues.get({ ...R, issue_number: n })).data.reactions["+1"], 1); |
| 1691 | await gh.rest.issues.lock({ ...R, issue_number: n, lock_reason: "resolved" }); |
| 1692 | const locked = await gh.rest.issues.get({ ...R, issue_number: n }); |
| 1693 | assert.equal(locked.data.locked, true); |
| 1694 | assert.equal(locked.data.active_lock_reason, "resolved"); |
| 1695 | await gh.rest.issues.unlock({ ...R, issue_number: n }); |
| 1696 | await gh.rest.issues.update({ ...R, issue_number: n, title: "Crash on startup", state: "closed", state_reason: "completed" }); |
| 1697 | const events = (await gh.rest.issues.listEvents({ ...R, issue_number: n })).data.map((e) => e.event); |
| 1698 | for (const e of ["labeled", "unlabeled", "unassigned", "assigned", "locked", "unlocked", "renamed", "closed"]) assert.ok(events.includes(e), `${e} in ${events}`); |
| 1699 | const timeline = (await gh.rest.issues.listEventsForTimeline({ ...R, issue_number: n })).data; |
| 1700 | assert.ok(timeline.some((e) => e.event === "commented" && e.body === "Same here!" && e.id === comment.data.id)); |
| 1701 | assert.ok((await gh.rest.issues.listCommentsForRepo(R)).data.some((x) => x.id === comment.data.id)); |
| 1702 | await gh.rest.issues.deleteComment({ ...R, comment_id: comment.data.id }); |
| 1703 | await assert.rejects(gh.rest.issues.getComment({ ...R, comment_id: comment.data.id }), (e) => e.status === 404); |
| 1704 | |
| 1705 | for (let i = 0; i < 3; i++) await gh.rest.issues.create({ ...R, title: `Paged ${i}` }); |
| 1706 | const page1 = await gh.rest.issues.listForRepo({ ...R, state: "all", per_page: 2 }); |
| 1707 | assert.equal(page1.data.length, 2); |
| 1708 | assert.match(page1.headers.link ?? "", /rel="next"/); |
| 1709 | const all = await gh.paginate(gh.rest.issues.listForRepo, { ...R, state: "all", per_page: 2 }); |
| 1710 | assert.equal(new Set(all.map((x) => x.number)).size, all.length); |
| 1711 | assert.ok(all.length >= 5, `paginated ${all.length} issues and pull requests`); |
| 1712 | |
| 1713 | // ------------------------------------------------------------ search, over readable repositories only |
| 1714 | const found = await until("issue search", async () => { |
| 1715 | const s = await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:issue label:bug crash` }); |
| 1716 | return s.data.total_count ? s.data : null; |
| 1717 | }); |
| 1718 | assert.deepEqual(found.items.map((x) => x.number), [n]); |
| 1719 | assert.equal((await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:pr is:merged` })).data.items[0].number, pr.data.number); |
| 1720 | assert.equal((await gh.rest.search.issuesAndPullRequests({ q: `repo:${owner}/${repo} is:issue -label:bug Paged`, sort: "created", order: "asc" })).data.items.map((x) => x.title).join(","), "Paged 0,Paged 1,Paged 2"); |
| 1721 | await gh.rest.repos.replaceAllTopics({ ...R, names: ["octokit", "e2e"] }); |
| 1722 | assert.deepEqual((await gh.rest.repos.getAllTopics(R)).data.names, ["octokit", "e2e"]); |
| 1723 | const repos = await gh.rest.search.repos({ q: `topic:octokit user:${owner}` }); |
| 1724 | assert.deepEqual(repos.data.items.map((x) => x.full_name), [`${owner}/${repo}`]); |
| 1725 | assert.ok("TypeScript" in (await gh.rest.repos.listLanguages(R)).data); |
| 1726 | |
| 1727 | // ------------------------------------------------------------ deployments and environments |
| 1728 | const env = await gh.rest.repos.createOrUpdateEnvironment({ ...R, environment_name: "staging" }); |
| 1729 | assert.equal(env.data.name, "staging"); |
| 1730 | const dep = await gh.rest.repos.createDeployment({ ...R, ref: "main", environment: "staging", auto_merge: false, required_contexts: [], payload: { region: "eu" }, description: "Deploy to staging" }); |
| 1731 | assert.equal(dep.status, 201); |
| 1732 | assert.equal(dep.data.sha, (await gh.rest.git.getRef({ ...R, ref: "heads/main" })).data.object.sha); |
| 1733 | assert.deepEqual(dep.data.payload, { region: "eu" }); |
| 1734 | await gh.rest.repos.createDeploymentStatus({ ...R, deployment_id: dep.data.id, state: "in_progress" }); |
| 1735 | const ds = await gh.rest.repos.createDeploymentStatus({ ...R, deployment_id: dep.data.id, state: "success", environment_url: "https://staging.example.com", log_url: "https://ci.example.com/deploy/1" }); |
| 1736 | assert.equal(ds.data.state, "success"); |
| 1737 | assert.deepEqual((await gh.rest.repos.listDeploymentStatuses({ ...R, deployment_id: dep.data.id })).data.map((x) => x.state), ["success", "in_progress"]); |
| 1738 | assert.equal((await gh.rest.repos.listDeployments({ ...R, environment: "staging" })).data.length, 1); |
| 1739 | assert.ok((await gh.rest.repos.getAllEnvironments(R)).data.environments.some((e) => e.name === "staging")); |
| 1740 | await gh.rest.actions.createEnvironmentVariable({ ...R, environment_name: "staging", name: "REGION", value: "eu" }); |
| 1741 | assert.equal((await gh.rest.actions.getEnvironmentVariable({ ...R, environment_name: "staging", name: "REGION" })).data.value, "eu"); |
| 1742 | await gh.rest.repos.deleteAnEnvironment({ ...R, environment_name: "staging" }); |
| 1743 | |
| 1744 | // ------------------------------------------------------------ repository_dispatch and repository variables |
| 1745 | assert.equal((await gh.rest.repos.createDispatchEvent({ ...R, event_type: "deploy", client_payload: { env: "prod" } })).status, 204); |
| 1746 | await gh.rest.actions.createRepoVariable({ ...R, name: "COLOR", value: "blue" }); |
| 1747 | await gh.rest.actions.updateRepoVariable({ ...R, name: "COLOR", value: "green" }); |
| 1748 | assert.equal((await gh.rest.actions.getRepoVariable({ ...R, name: "COLOR" })).data.value, "green"); |
| 1749 | }); |
| 1750 | |
| 1751 | /** A small opaque RGBA PNG (a gradient), built by hand so the test needs no image tools. */ |
| 1752 | function pngGradient(width, height) { |
| 1753 | const chunk = (type, body) => { |
| 1754 | const out = Buffer.alloc(12 + body.length); |
| 1755 | out.writeUInt32BE(body.length, 0); |
| 1756 | out.write(type, 4, "latin1"); |
| 1757 | body.copy(out, 8); |
| 1758 | out.writeUInt32BE(crc32(out.subarray(4, 8 + body.length)), 8 + body.length); |
| 1759 | return out; |
| 1760 | }; |
| 1761 | const ihdr = Buffer.alloc(13); |
| 1762 | ihdr.writeUInt32BE(width, 0); |
| 1763 | ihdr.writeUInt32BE(height, 4); |
| 1764 | ihdr.set([8, 6, 0, 0, 0], 8); |
| 1765 | const raw = Buffer.alloc((width * 4 + 1) * height); |
| 1766 | for (let y = 0; y < height; y++) |
| 1767 | for (let x = 0; x < width; x++) raw.set([(x * 255) / width, (y * 255) / height, 128, 255], y * (width * 4 + 1) + 1 + x * 4); |
| 1768 | return Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]), chunk("IHDR", ihdr), chunk("IDAT", deflateSync(raw)), chunk("IEND", Buffer.alloc(0))]); |
| 1769 | } |
| 1770 | |
| 1771 | /** Width and height of a lossy or extended WebP, or null when it is not one. */ |
| 1772 | function webpSize(b) { |
| 1773 | if (b.toString("latin1", 0, 4) !== "RIFF" || b.toString("latin1", 8, 12) !== "WEBP") return null; |
| 1774 | const chunk = b.toString("latin1", 12, 16); |
| 1775 | if (chunk === "VP8 ") return { width: b.readUInt16LE(26) & 0x3fff, height: b.readUInt16LE(28) & 0x3fff }; |
| 1776 | if (chunk === "VP8X") return { width: b.readUIntLE(24, 3) + 1, height: b.readUIntLE(27, 3) + 1 }; |
| 1777 | return null; |
| 1778 | } |
| 1779 | |
| 1780 | test("people and profiles: visibility, repository invitations, blank names and usernames", async () => { |
| 1781 | const me = await ok("GET", "/user"); |
| 1782 | // A form post as the signed-in dev user, with the CSRF double-submit pair taken from `page`. |
| 1783 | const submit = async (page, action, fields) => { |
| 1784 | const res = await fetch(`${base}${page}`); |
| 1785 | const csrf = /name="_csrf" value="([^"]+)"/.exec(await res.text())?.[1]; |
| 1786 | const cookie = /dfy_csrf=([^;]+)/.exec(res.headers.get("set-cookie") ?? "")?.[1]; |
| 1787 | assert.ok(csrf && cookie, `no CSRF pair on ${page}`); |
| 1788 | return fetch(`${base}${action}`, { method: "POST", body: new URLSearchParams({ _csrf: csrf, ...fields }), redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}`, "sec-fetch-site": "same-origin" } }); |
| 1789 | }; |
| 1790 | const flashOf = (res) => decodeURIComponent(decodeURIComponent(res.headers.get("set-cookie") ?? "")); |
| 1791 | |
| 1792 | // "internal" is gone: creating and updating refuse it the same way. |
| 1793 | const created = await api("POST", "/user/repos", { name: "people-rules", visibility: "internal" }); |
| 1794 | assert.equal(created.status, 422); |
| 1795 | await ok("POST", "/user/repos", { name: "people-rules" }); |
| 1796 | const patched = await api("PATCH", `/repos/${me.login}/people-rules`, { visibility: "internal" }); |
| 1797 | assert.equal(patched.status, 422); |
| 1798 | assert.equal(created.json.message, patched.json.message); |
| 1799 | assert.deepEqual(created.json.errors, patched.json.errors); |
| 1800 | |
| 1801 | // Inviting the same email to a repository twice (any letter case) is refused. |
| 1802 | const access = `/${me.login}/people-rules/settings/access`; |
| 1803 | const first = await submit(access, `${access}/people`, { who: "newcomer@example.com", role: "read" }); |
| 1804 | assert.equal(first.status, 200, flashOf(first)); |
| 1805 | assert.match(await first.text(), /newcomer@example\.com/); |
| 1806 | const second = await submit(access, `${access}/people`, { who: "NewComer@Example.com", role: "write" }); |
| 1807 | assert.equal(second.status, 303); |
| 1808 | assert.match(flashOf(second), /already has a pending invitation/); |
| 1809 | |
| 1810 | // A blank display name falls back to the username. |
| 1811 | const saved = await submit("/settings", "/settings/profile", { login: me.login, name: " " }); |
| 1812 | assert.match(flashOf(saved), /Profile saved\./); |
| 1813 | assert.equal((await ok("GET", `/users/${me.login}`)).name, null); |
| 1814 | assert.match(await (await fetch(`${base}/${me.login}`)).text(), new RegExp(`<h1[^>]*>${me.login}</h1>`)); |
| 1815 | |
| 1816 | // Usernames: the browser's pattern and the server agree that dots aren't allowed. |
| 1817 | const settings = await (await fetch(`${base}/settings`)).text(); |
| 1818 | const pattern = /name="login"[^>]*pattern="([^"]+)"/.exec(settings)?.[1]; |
| 1819 | assert.ok(pattern, "the username field has a pattern"); |
| 1820 | assert.equal(new RegExp(`^(?:${pattern.replaceAll("&", "&")})$`, "v").test("dot.name"), false); |
| 1821 | assert.equal((await api("POST", "/user/orgs", { login: "dot.name" })).status, 422); |
| 1822 | }); |
| 1823 | |
| 1824 | test("profile pictures: upload, resize, serve, cache headers and removal", async () => { |
| 1825 | const me = await ok("GET", "/user"); |
| 1826 | const avatar = async (login, query = "") => { |
| 1827 | const r = await fetch(`${base}/api/avatars/${login}${query}`); |
| 1828 | assert.equal(r.status, 200); |
| 1829 | return { type: r.headers.get("content-type"), cache: r.headers.get("cache-control"), csp: r.headers.get("content-security-policy"), body: Buffer.from(await r.arrayBuffer()) }; |
| 1830 | }; |
| 1831 | const put = (path, body, tok = token) => fetch(`${base}/api/v3${path}`, { method: "PUT", headers: { authorization: `Bearer ${tok}`, "content-type": "image/png" }, body }); |
| 1832 | |
| 1833 | // Before any upload: generated initials, also for logins that don't exist. |
| 1834 | const initials = await avatar(me.login, "?s=64"); |
| 1835 | assert.match(initials.type, /^image\/svg\+xml/); |
| 1836 | assert.equal(initials.csp, "default-src 'none'; style-src 'unsafe-inline'"); |
| 1837 | assert.match((await avatar("no-such-user-here")).type, /^image\/svg\+xml/); |
| 1838 | |
| 1839 | // REST upload: a 600×400 PNG becomes centred square WebPs. |
| 1840 | const up = await put("/user/avatar", pngGradient(600, 400)); |
| 1841 | assert.equal(up.status, 200, await up.clone().text()); |
| 1842 | const { avatar_url } = await up.json(); |
| 1843 | const version = new URL(avatar_url).searchParams.get("v"); |
| 1844 | assert.match(version ?? "", /^\d+$/); |
| 1845 | for (const s of [64, 128, 256]) { |
| 1846 | const a = await avatar(me.login, `?s=${s}&v=${version}`); |
| 1847 | assert.equal(a.type, "image/webp"); |
| 1848 | assert.deepEqual(webpSize(a.body), { width: s, height: s }); |
| 1849 | assert.ok(a.body.length < 10_000, `${s}px WebP is ${a.body.length} bytes`); |
| 1850 | assert.match(a.cache, /immutable/); |
| 1851 | } |
| 1852 | const current = await avatar(me.login, "?s=64"); |
| 1853 | assert.equal(current.type, "image/webp"); |
| 1854 | assert.match(current.cache, /max-age=600/); |
| 1855 | |
| 1856 | // Only JPEG, PNG and WebP, sniffed from the bytes. |
| 1857 | const gif = await put("/user/avatar", Buffer.from("GIF89a\x01\x00\x01\x00\x00\x00\x00;", "latin1")); |
| 1858 | assert.equal(gif.status, 422); |
| 1859 | assert.equal((await gif.json()).message, "Use a JPEG, PNG or WebP image."); |
| 1860 | // Read-only tokens can't change a profile. |
| 1861 | const ro = (await ok("POST", "/diffinery/tokens", { name: "ro", scopes: ["read"] })).token; |
| 1862 | assert.equal((await put("/user/avatar", pngGradient(8, 8), ro)).status, 403); |
| 1863 | |
| 1864 | // The web form (multipart, CSRF double-submit) takes the original file and the server resizes it. |
| 1865 | const page = await fetch(`${base}/settings`); |
| 1866 | const csrf = /name="_csrf" value="([^"]+)"/.exec(await page.text())?.[1]; |
| 1867 | const cookie = /dfy_csrf=([^;]+)/.exec(page.headers.get("set-cookie") ?? "")?.[1]; |
| 1868 | assert.ok(csrf && cookie); |
| 1869 | const form = new FormData(); |
| 1870 | form.set("_csrf", csrf); |
| 1871 | form.set("avatar", new Blob([pngGradient(300, 500)], { type: "image/png" }), "me.png"); |
| 1872 | const posted = await fetch(`${base}/settings/avatar`, { method: "POST", body: form, redirect: "manual", headers: { cookie: `dfy_csrf=${cookie}`, "sec-fetch-site": "same-origin" } }); |
| 1873 | assert.equal(posted.status, 303); |
| 1874 | assert.match(decodeURIComponent(decodeURIComponent(posted.headers.get("set-cookie") ?? "")), /"kind":"notice","message":"Profile picture updated\."/); |
| 1875 | const settings = await (await fetch(`${base}/settings`)).text(); |
| 1876 | const newVersion = /\/api\/avatars\/[^"?]+\?s=256&v=(\d+)/.exec(settings)?.[1]; |
| 1877 | assert.ok(newVersion && newVersion !== version, "the settings page links the new version"); |
| 1878 | // An old version's URL gets the current picture, but not as an immutable response. |
| 1879 | assert.match((await avatar(me.login, `?s=64&v=${version}`)).cache, /max-age=600/); |
| 1880 | |
| 1881 | // Organizations: owners (admins get a 403; see the security tests). |
| 1882 | await ok("POST", "/user/orgs", { login: "picture-org" }); |
| 1883 | const org = await put("/orgs/picture-org/avatar", pngGradient(64, 64)); |
| 1884 | assert.equal(org.status, 200, await org.clone().text()); |
| 1885 | assert.equal((await avatar("picture-org", "?s=128")).type, "image/webp"); |
| 1886 | assert.equal((await fetch(`${base}/api/v3/orgs/picture-org/avatar`, { method: "DELETE", headers: { authorization: `Bearer ${token}` } })).status, 200); |
| 1887 | assert.match((await avatar("picture-org", "?s=128")).type, /^image\/svg\+xml/); |
| 1888 | |
| 1889 | // Removal falls back to initials straight away (the cached copies are purged). |
| 1890 | const del = await fetch(`${base}/api/v3/user/avatar`, { method: "DELETE", headers: { authorization: `Bearer ${token}` } }); |
| 1891 | assert.deepEqual(await del.json(), { avatar_url: `${base}/api/avatars/${me.login}` }); |
| 1892 | assert.match((await avatar(me.login, "?s=64")).type, /^image\/svg\+xml/); |
| 1893 | }); |