act_runner/act/runner/step_run.go

// Copyright 2022 The Gitea Authors. All rights reserved.
// Copyright 2022 The nektos/act Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package runner

import (
	"cmp"
	"context"
	"fmt"
	"io"
	"maps"
	"runtime"
	"slices"
	"strings"

	"gitea.com/gitea/runner/act/common"
	"gitea.com/gitea/runner/act/common/logging"
	"gitea.com/gitea/runner/act/container"
	"gitea.com/gitea/runner/act/lookpath"

	"gitea.dev/actionslib/pkg/model"
	"github.com/kballard/go-shellquote"
	yaml "go.yaml.in/yaml/v4"
)

type stepRun struct {
	Step               *model.Step
	RunContext         *RunContext
	cmd                []string
	cmdline            string
	env                map[string]string
	WorkingDirectory   string
	interpolatedScript string
	shellCommand       string
}

func (sr *stepRun) pre() common.Executor { return common.NewPipelineExecutor() }

func (sr *stepRun) main() common.Executor {
	sr.env = map[string]string{}
	return runStepExecutor(sr, stepStageMain, common.NewPipelineExecutor(
		func(ctx context.Context) error {
			scriptName, script, err := sr.setupShellCommand(ctx)
			if err != nil {
				return err
			}
			return sr.RunContext.JobContainer.Copy(sr.RunContext.JobContainer.GetActPath(), &container.FileEntry{
				Name: scriptName,
				Mode: 0o755,
				Body: script,
			})(ctx)
		},
		func(ctx context.Context) error {
			rc := sr.getRunContext()
			// Apply ::add-path:: effects before printing so PATH is accurate in the env: block.
			rc.ApplyExtraPath(ctx, &sr.env)
			sr.printRunScriptActionDetails(ctx)
			if he, ok := rc.JobContainer.(*container.HostEnvironment); ok && he != nil {
				return he.ExecWithCmdLine(sr.cmd, sr.cmdline, sr.env, sr.WorkingDirectory)(ctx)
			}
			return rc.JobContainer.Exec(sr.cmd, sr.env, "", sr.WorkingDirectory)(ctx)
		},
	))
}

// printRunScriptActionDetails mirrors actions/runner ScriptHandler.PrintActionDetails
// for script steps.
func (sr *stepRun) printRunScriptActionDetails(ctx context.Context) {
	rawLogger := common.Logger(ctx).With(rawOutputField, true)
	scriptLineLogger := rawLogger.With(scriptLineCyanField, true)

	normalized := strings.TrimRight(strings.ReplaceAll(sr.interpolatedScript, "\r\n", "\n"), "\n")

	rawLogger.Infof("::group::Run %s", EscapeCommandData(sr.runScriptGroupTitle(normalized)))

	if normalized != "" {
		for line := range strings.SplitSeq(normalized, "\n") {
			scriptLineLogger.Info(line)
		}
	}

	rawLogger.Infof("shell: %s", sr.shellCommand)

	printStepEnvBlock(ctx, sr.Step, sr.env, sr.getRunContext())
	rawLogger.Infof("::endgroup::")
}

// printRunActionHeader mirrors actions/runner's "Run <action>" header for `uses:` steps,
// including the with: inputs and the step-level env: block.
func printRunActionHeader(ctx context.Context, step *model.Step, action *model.Action, env map[string]string, rc *RunContext) {
	if step == nil {
		return
	}
	rawLogger := common.Logger(ctx).With(rawOutputField, true)

	rawLogger.Infof("::group::Run %s", EscapeCommandData(step.Uses))

	inputs := map[string]string{}
	maps.Copy(inputs, step.With)
	if action != nil {
		for name := range action.Inputs {
			if _, provided := lookupFold(step.With, name, true); !provided {
				inputs[name] = env[inputEnvKey(name)]
			}
		}
	}
	maps.DeleteFunc(inputs, func(_name, value string) bool { return value == "" })
	if len(inputs) > 0 {
		rawLogger.Infof("with:")
		for _, k := range slices.Sorted(maps.Keys(inputs)) {
			logKeyedValue(rawLogger, k, inputs[k])
		}
	}

	printStepEnvBlock(ctx, step, env, rc)
	rawLogger.Infof("::endgroup::")
}

// printStepEnvBlock emits the declared-env block (YAML order, internal vars filtered)
// shared by the run: and uses: "Run" headers.
func printStepEnvBlock(ctx context.Context, step *model.Step, env map[string]string, rc *RunContext) {
	rawLogger := common.Logger(ctx).With(rawOutputField, true)
	caseInsensitive := rc != nil && rc.JobContainer != nil && rc.JobContainer.IsEnvironmentCaseInsensitive()
	var visible []string
	for _, k := range stepDeclaredEnvKeysInOrder(step) {
		if !isInternalEnvKey(k, caseInsensitive) {
			visible = append(visible, k)
		}
	}
	if len(visible) == 0 {
		return
	}
	rawLogger.Infof("env:")
	envLookup := env
	if caseInsensitive {
		envLookup = make(map[string]string, len(env))
		for k, v := range env {
			envLookup[strings.ToUpper(k)] = v
		}
	}
	for _, k := range visible {
		lookupKey := k
		if caseInsensitive {
			lookupKey = strings.ToUpper(k)
		}
		logKeyedValue(rawLogger, k, envLookup[lookupKey])
	}
}

// logKeyedValue prints one row per line of value: Gitea stores one log row per line, so an
// embedded newline would reach the user as a literal "\n".
func logKeyedValue(rawLogger *logging.Logger, key, value string) {
	lines := strings.Split(strings.ReplaceAll(value, "\r\n", "\n"), "\n")
	rawLogger.Infof("  %s: %s", key, lines[0])
	for _, line := range lines[1:] {
		rawLogger.Infof("    %s", line)
	}
}

// isInternalEnvKey matches actions/runner's filtered set of vars that are hidden
// from the "Run" header's env: block because they are injected by the runner itself.
func isInternalEnvKey(k string, caseInsensitive bool) bool {
	upper := k
	if caseInsensitive {
		upper = strings.ToUpper(k)
	}
	switch upper {
	case "PATH", "HOME", "CI":
		return true
	}
	return strings.HasPrefix(upper, "GITHUB_") ||
		strings.HasPrefix(upper, "GITEA_") ||
		strings.HasPrefix(upper, "RUNNER_") ||
		strings.HasPrefix(upper, "INPUT_")
}

func (sr *stepRun) runScriptGroupTitle(normalizedScript string) string {
	trimmed := strings.TrimLeft(normalizedScript, " \t\r\n")
	if idx := strings.IndexAny(trimmed, "\r\n"); idx >= 0 {
		trimmed = trimmed[:idx]
	}
	if trimmed != "" {
		return trimmed
	}
	if sr.Step != nil {
		if sr.Step.Name != "" {
			return sr.Step.Name
		}
		return sr.Step.ID
	}
	return ""
}

// stepDeclaredEnvKeysInOrder walks the raw YAML Env mapping so keys are emitted in
// the order the workflow author wrote them; step.Environment() decodes into a Go map
// and loses ordering.
func stepDeclaredEnvKeysInOrder(step *model.Step) []string {
	if step == nil || step.Env.Kind != yaml.MappingNode {
		return nil
	}
	content := step.Env.Content
	keys := make([]string, 0, len(content)/2)
	seen := make(map[string]struct{}, len(content)/2)
	for i := 0; i+1 < len(content); i += 2 {
		k := content[i]
		if k.Kind != yaml.ScalarNode || k.Tag == "!!merge" || k.Value == "<<" {
			continue
		}
		if _, dup := seen[k.Value]; dup {
			continue
		}
		seen[k.Value] = struct{}{}
		keys = append(keys, k.Value)
	}
	return keys
}

func (sr *stepRun) post() common.Executor { return common.NewPipelineExecutor() }

func (sr *stepRun) getRunContext() *RunContext {
	return sr.RunContext
}

func (sr *stepRun) getGithubContext(ctx context.Context) *model.GithubContext {
	return sr.getRunContext().getGithubContext(ctx)
}

func (sr *stepRun) getStepModel() *model.Step {
	return sr.Step
}

func (sr *stepRun) getEnv() *map[string]string {
	return &sr.env
}

func (sr *stepRun) getIfExpression(_ context.Context, _ stepStage) string {
	return sr.Step.If.Value
}

// TODO: Currently we just ignore top level keys, BUT we should return proper error on them
// BUTx2 I leave this for when we rewrite act to use actionlint for workflow validation
// so we return proper errors before any execution or spawning containers
// it will error anyway with:
// OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: "${{": executable file not found in $PATH: unknown
func (sr *stepRun) setupShellCommand(ctx context.Context) (name, script string, err error) {
	logger := common.Logger(ctx)
	eval := sr.RunContext.NewStepExpressionEvaluator(ctx, sr)
	implicitShell, err := sr.setupShell(ctx, eval)
	if err != nil {
		return "", "", err
	}
	if err := sr.setupWorkingDirectory(ctx, eval); err != nil {
		return "", "", err
	}

	step := sr.Step

	script, err = eval.Interpolate(ctx, step.Run)
	if err != nil {
		return "", "", fmt.Errorf("unable to interpolate the run script: %w", err)
	}
	sr.interpolatedScript = script

	// GitHub matches the built-in names case-insensitively, so `shell: PWSH` is valid
	switch shell := strings.ToLower(step.Shell); shell {
	case "bash", "sh", "pwsh", "powershell", "cmd", "python":
		step.Shell = shell
	}

	scCmd := step.ShellCommand()
	if step.Shell == "pwsh" || step.Shell == "powershell" {
		scCmd = step.Shell + ` -command ". '{0}'"`
	}
	if implicitShell && (step.Shell == "bash" || step.Shell == "sh") {
		scCmd = step.Shell + " -e {0}"
	}
	if !strings.Contains(scCmd, "{0}") {
		return "", "", fmt.Errorf("invalid shell option %q: format must contain {0}", step.Shell)
	}
	sr.shellCommand = scCmd

	name = step.ID
	for rc := sr.RunContext; rc.Parent != nil; rc = rc.Parent {
		name = fmt.Sprintf("%s-composite-%s", rc.Parent.CurrentStep, name)
	}
	name = "workflow/" + name

	// Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L47-L64
	// Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L19-L27
	runPrepend := ""
	runAppend := ""
	shellCommand, _, _ := strings.Cut(step.Shell, " ")
	switch shellCommand {
	case "bash", "sh":
		name += ".sh"
	case "pwsh", "powershell":
		name += ".ps1"
		runPrepend = "$ErrorActionPreference = 'stop'"
		runAppend = "if ((Test-Path -LiteralPath variable:/LASTEXITCODE)) { exit $LASTEXITCODE }"
	case "cmd":
		name += ".cmd"
		runPrepend = "@echo off"
	case "python":
		name += ".py"
	}

	script = fmt.Sprintf("%s\n%s\n%s", runPrepend, script, runAppend)

	if !strings.Contains(script, "::add-mask::") && !sr.RunContext.Config.InsecureSecrets {
		logger.Debugf("Wrote command \n%s\n to '%s'", script, name)
	} else {
		logger.Debugf("Wrote add-mask command to '%s'", name)
	}

	rc := sr.getRunContext()
	scriptPath := fmt.Sprintf("%s/%s", rc.JobContainer.GetActPath(), name)
	sr.cmdline = strings.ReplaceAll(scCmd, `{0}`, scriptPath)
	sr.cmd, err = shellquote.Split(sr.cmdline)

	return name, script, err
}

func (sr *stepRun) setupShell(ctx context.Context, eval *expressionEvaluator) (bool, error) {
	rc := sr.RunContext
	step := sr.Step

	shell, err := eval.Interpolate(ctx, step.Shell)
	if err != nil {
		return false, fmt.Errorf("unable to interpolate the shell: %w", err)
	}
	step.Shell = cmp.Or(shell, rc.jobRunDefaults.Shell, rc.Run.Workflow.Defaults.Run.Shell)

	implicitShell := step.Shell == ""
	if implicitShell {
		shellWithFallback := []string{"bash", "sh"}
		env := maps.Clone(sr.env)
		rc.ApplyExtraPath(ctx, &env)
		if _, ok := rc.JobContainer.(*container.HostEnvironment); ok {
			// Don't use bash on windows by default, if not using a docker container
			if runtime.GOOS == "windows" {
				shellWithFallback = []string{"pwsh", "powershell"}
			}
			step.Shell = shellWithFallback[0]
			_, err := lookpath.LookPath2(shellWithFallback[0], env)
			if err != nil {
				step.Shell = shellWithFallback[1]
			}
		} else {
			step.Shell = shellWithFallback[0]
			if !rc.containerHasBash(ctx, env) {
				step.Shell = shellWithFallback[1]
			}
		}
	}
	return implicitShell, nil
}

// containerHasBash probes once per job, else every implicit-shell step pays for an exec.
func (rc *RunContext) containerHasBash(ctx context.Context, env map[string]string) bool {
	top := rc.topLevelRunContext()
	if top.hasBash == nil {
		stdout, stderr := rc.JobContainer.ReplaceLogWriter(io.Discard, io.Discard)
		found := rc.JobContainer.Exec([]string{"sh", "-c", "command -v bash >/dev/null 2>&1"}, env, "", "")(ctx) == nil
		rc.JobContainer.ReplaceLogWriter(stdout, stderr)
		top.hasBash = &found
	}
	return *top.hasBash
}

func (sr *stepRun) setupWorkingDirectory(ctx context.Context, eval *expressionEvaluator) error {
	rc := sr.RunContext
	workingdirectory, err := eval.Interpolate(ctx, sr.Step.WorkingDirectory)
	if err != nil {
		return fmt.Errorf("unable to interpolate the working directory: %w", err)
	}
	// top level keys in workflow file like `defaults` or `env` can't hold expressions
	sr.WorkingDirectory = cmp.Or(workingdirectory, rc.jobRunDefaults.WorkingDirectory, rc.Run.Workflow.Defaults.Run.WorkingDirectory)
	return nil
}