mirror of
https://gitea.com/gitea/act_runner.git
synced 2026-10-30 11:58:49 +08:00
d882311ec6
Removes dead code and redundant logic and consolidates tests, so there is less to read and maintain. No behavior change. 1. **act/runner**: inline single-use wrappers, compile regexes once instead of per call, embed the trampoline as a string, drop the unused legacy result of `parseActionCommand` 2. **act/container**: `sanitizeConfig` and `mergeContainerConfigs` stop returning the configs they already mutate in place, drop never-set option fields and the unused `user` parameter of `ExecWithCmdLine` 3. **act/common and cache server**: drop the unused `Trace`/`Tracef` loggers and the short SHA of `FindGitRevision`, `RegisterJob` releases through `RevokeJob` 4. **daemon, poller and reporter**: one shutdown wait for both poll modes, drop an unreachable fetch timeout branch, guard the reporter's last report time with its existing lock instead of an atomic 5. **build**: drop unused Makefile and release workflow variables, collapse the goreleaser ignore list to the same build targets 6. **tests**: fold near-duplicate tests into tables with shared setup Throughout, hand-rolled logic gives way to `cmp.Or`, `strings.Cut`, `slices` and `min`/`max`. Reviewed-on: https://gitea.com/gitea/runner/pulls/1335 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io>
90 lines
3.5 KiB
Go
90 lines
3.5 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package artifactcache
|
|
|
|
import (
|
|
"cmp"
|
|
"crypto/tls"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// The results service is one origin serving every github.actions.results.api.v1 service, and
|
|
// Gitea implements only the artifact half of it. Forwarding that half from here makes this origin
|
|
// the whole service, so ACTIONS_RESULTS_URL can point at it truthfully, which is what the clients
|
|
// this runner cannot patch need, docker buildx among them.
|
|
const artifactServicePath = "/twirp/github.actions.results.api.v1.ArtifactService/"
|
|
|
|
// forwardOrNotFound is the router's fallback: the artifact service of the instance the job
|
|
// registered with, and the 404 the router would have written otherwise.
|
|
func (h *Handler) forwardOrNotFound(w http.ResponseWriter, r *http.Request) {
|
|
if !strings.HasPrefix(r.URL.Path, artifactServicePath) {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
cred, ok := h.lookupCredential(bearerToken(r))
|
|
if !ok {
|
|
h.twirpError(w, r, twirpUnauthenticated, errors.New("unknown bearer token"))
|
|
return
|
|
}
|
|
if cred.Results == "" {
|
|
h.twirpError(w, r, twirpInternal, errors.New("no instance is registered for this job"))
|
|
return
|
|
}
|
|
target, err := url.Parse(strings.TrimSuffix(cred.Results, "/"))
|
|
if err == nil && (target.Hostname() == "" || (target.Scheme != "http" && target.Scheme != "https")) {
|
|
err = errors.New("not an absolute http or https URL the job could use")
|
|
}
|
|
if err != nil {
|
|
h.logger.Errorf("artifact service forward to %q: %v", cred.Results, err)
|
|
h.twirpError(w, r, twirpInternal, fmt.Errorf("artifact service address %q is unusable: %w", cred.Results, err))
|
|
return
|
|
}
|
|
if !h.mustProxy(r, cred, target) {
|
|
redirect := target.JoinPath(r.URL.EscapedPath())
|
|
redirect.RawQuery = mergeQuery(target.RawQuery, r.URL.RawQuery)
|
|
h.logger.Debugf("%s %s: redirecting to %s", r.Method, r.URL.Path, target)
|
|
http.Redirect(w, r, redirect.String(), http.StatusTemporaryRedirect)
|
|
return
|
|
}
|
|
h.logger.Debugf("%s %s: forwarding to %s", r.Method, r.URL.Path, target)
|
|
|
|
proxy := &httputil.ReverseProxy{
|
|
Rewrite: func(r *httputil.ProxyRequest) {
|
|
r.SetURL(target)
|
|
// Gitea builds the URLs it hands back from this Host, and their scheme from the
|
|
// connection unless a forwarded header overrides it, so artifact bodies go to Gitea
|
|
// directly and never through here.
|
|
r.Out.Host = target.Host
|
|
},
|
|
ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
|
|
h.logger.Warnf("artifact service forward to %s: %v", target, err)
|
|
h.twirpError(w, r, twirpInternal, fmt.Errorf("cache server cannot reach the artifact service at %s: %w", target, err))
|
|
},
|
|
}
|
|
if cred.InsecureTLS {
|
|
proxy.Transport = insecureTransport
|
|
}
|
|
proxy.ServeHTTP(w, r)
|
|
}
|
|
|
|
// A protocol switch loses the bearer or the agent, and an untrusted instance needs skipped verification.
|
|
func (h *Handler) mustProxy(r *http.Request, cred JobCredential, target *url.URL) bool {
|
|
return cred.InsecureTLS && target.Scheme == "https" || cmp.Or(r.Header.Get("X-Forwarded-Proto"), "http") != target.Scheme
|
|
}
|
|
|
|
func mergeQuery(target, request string) string {
|
|
if target == "" || request == "" {
|
|
return target + request
|
|
}
|
|
return target + "&" + request
|
|
}
|
|
|
|
// insecureTransport is shared, because a transport per request would pool no connections.
|
|
var insecureTransport = &http.Transport{Proxy: http.ProxyFromEnvironment, TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // the runner reaches its instance on the operator's say-so
|