runners

package
v1.81.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 9, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AzurePipeline 

type AzurePipeline struct {
	*Generic
}

func NewAzurePipeline 

func NewAzurePipeline() *AzurePipeline

func (*AzurePipeline) CheckEnv 

func (r *AzurePipeline) CheckEnv() bool

Figure out if we are in a Azure Pipeline job or not

func (*AzurePipeline) Environment added in v1.0.0 

func (r *AzurePipeline) Environment() RunnerEnvironment

func (*AzurePipeline) ID 

func (r *AzurePipeline) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*AzurePipeline) IsAuthenticated added in v1.0.0 

func (r *AzurePipeline) IsAuthenticated() bool

func (*AzurePipeline) ListEnvVars 

func (r *AzurePipeline) ListEnvVars() []*EnvVarDefinition

func (*AzurePipeline) Report added in v1.71.2 

func (r *AzurePipeline) Report(_ []byte, _ string) error

func (*AzurePipeline) ResolveEnvVars 

func (r *AzurePipeline) ResolveEnvVars() (map[string]string, []*error)

func (*AzurePipeline) RunURI 

func (r *AzurePipeline) RunURI() (url string)

func (*AzurePipeline) VerifyCommitSignature added in v1.70.0 

func (r *AzurePipeline) VerifyCommitSignature(_ context.Context, _ string) *commitverification.CommitVerification

func (*AzurePipeline) WorkflowFilePath added in v1.0.0 

func (r *AzurePipeline) WorkflowFilePath() string

type CircleCIBuild 

type CircleCIBuild struct {
	*Generic
}

func NewCircleCIBuild 

func NewCircleCIBuild() *CircleCIBuild

func (*CircleCIBuild) CheckEnv 

func (r *CircleCIBuild) CheckEnv() bool

func (*CircleCIBuild) Environment added in v1.0.0 

func (r *CircleCIBuild) Environment() RunnerEnvironment

func (*CircleCIBuild) ID 

func (r *CircleCIBuild) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*CircleCIBuild) IsAuthenticated added in v1.0.0 

func (r *CircleCIBuild) IsAuthenticated() bool

func (*CircleCIBuild) ListEnvVars 

func (r *CircleCIBuild) ListEnvVars() []*EnvVarDefinition

func (*CircleCIBuild) Report added in v1.71.2 

func (r *CircleCIBuild) Report(_ []byte, _ string) error

func (*CircleCIBuild) ResolveEnvVars 

func (r *CircleCIBuild) ResolveEnvVars() (map[string]string, []*error)

func (*CircleCIBuild) RunURI 

func (r *CircleCIBuild) RunURI() string

func (*CircleCIBuild) VerifyCommitSignature added in v1.70.0 

func (r *CircleCIBuild) VerifyCommitSignature(_ context.Context, _ string) *commitverification.CommitVerification

func (*CircleCIBuild) WorkflowFilePath added in v1.0.0 

func (r *CircleCIBuild) WorkflowFilePath() string

type DaggerPipeline 

type DaggerPipeline struct {
	*Generic
	// contains filtered or unexported fields
}

func NewDaggerPipeline 

func NewDaggerPipeline(_ string, logger *zerolog.Logger) *DaggerPipeline

func (*DaggerPipeline) CheckEnv 

func (r *DaggerPipeline) CheckEnv() bool

func (*DaggerPipeline) Environment added in v1.0.0 

func (r *DaggerPipeline) Environment() RunnerEnvironment

func (*DaggerPipeline) ID 

func (r *DaggerPipeline) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*DaggerPipeline) IsAuthenticated added in v1.0.0 

func (r *DaggerPipeline) IsAuthenticated() bool

func (*DaggerPipeline) ListEnvVars 

func (r *DaggerPipeline) ListEnvVars() []*EnvVarDefinition

func (*DaggerPipeline) Report added in v1.71.2 

func (r *DaggerPipeline) Report(_ []byte, _ string) error

func (*DaggerPipeline) ResolveEnvVars 

func (r *DaggerPipeline) ResolveEnvVars() (map[string]string, []*error)

func (*DaggerPipeline) RunURI 

func (r *DaggerPipeline) RunURI() string

TODO: figure out an URL and or more useful information

func (*DaggerPipeline) VerifyCommitSignature added in v1.70.0 

func (r *DaggerPipeline) VerifyCommitSignature(ctx context.Context, commitHash string) *commitverification.CommitVerification

func (*DaggerPipeline) WorkflowFilePath added in v1.0.0 

func (r *DaggerPipeline) WorkflowFilePath() string

type EnvVarDefinition 

type EnvVarDefinition struct {
	Name     string
	Optional bool
}

type Generic 

type Generic struct{}

func NewGeneric 

func NewGeneric() *Generic

func (*Generic) CheckEnv 

func (r *Generic) CheckEnv() bool

func (*Generic) Environment added in v1.0.0 

func (r *Generic) Environment() RunnerEnvironment

func (*Generic) FederatedToken added in v1.81.0 

func (r *Generic) FederatedToken() string

func (*Generic) ID 

func (r *Generic) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*Generic) IsAuthenticated added in v1.0.0 

func (r *Generic) IsAuthenticated() bool

func (*Generic) ListEnvVars 

func (r *Generic) ListEnvVars() []*EnvVarDefinition

Returns a list of environment variables names. This list is used to automatically inject environment variables into the attestation.

func (*Generic) Report added in v1.71.2 

func (r *Generic) Report(_ []byte, _ string) error

func (*Generic) ResolveEnvVars 

func (r *Generic) ResolveEnvVars() (map[string]string, []*error)

func (*Generic) RunURI 

func (r *Generic) RunURI() string

func (*Generic) VerifyCommitSignature added in v1.70.0 

func (r *Generic) VerifyCommitSignature(_ context.Context, _ string) *commitverification.CommitVerification

func (*Generic) WorkflowFilePath added in v1.0.0 

func (r *Generic) WorkflowFilePath() string

type GitHubAction 

type GitHubAction struct {
	*Generic
	// contains filtered or unexported fields
}

func NewGithubAction 

func NewGithubAction(ctx context.Context, logger *zerolog.Logger) *GitHubAction

func (*GitHubAction) CheckEnv 

func (r *GitHubAction) CheckEnv() bool

Figure out if we are in a Github Action job or not

func (*GitHubAction) Environment added in v1.0.0 

func (r *GitHubAction) Environment() RunnerEnvironment

func (*GitHubAction) FederatedToken added in v1.81.0 

func (r *GitHubAction) FederatedToken() string

func (*GitHubAction) ID 

func (r *GitHubAction) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*GitHubAction) IsAuthenticated added in v1.0.0 

func (r *GitHubAction) IsAuthenticated() bool

func (*GitHubAction) ListEnvVars 

func (r *GitHubAction) ListEnvVars() []*EnvVarDefinition

func (*GitHubAction) Report added in v1.71.2 

func (r *GitHubAction) Report(tableOutput []byte, attestationViewURL string) error

Report writes attestation table output to GitHub Step Summary

func (*GitHubAction) ResolveEnvVars 

func (r *GitHubAction) ResolveEnvVars() (map[string]string, []*error)

func (*GitHubAction) RunURI 

func (r *GitHubAction) RunURI() (url string)

func (*GitHubAction) VerifyCommitSignature added in v1.70.0 

func (r *GitHubAction) VerifyCommitSignature(ctx context.Context, commitHash string) *commitverification.CommitVerification

VerifyCommitSignature checks if a commit's signature is verified by GitHub

func (*GitHubAction) WorkflowFilePath added in v1.0.0 

func (r *GitHubAction) WorkflowFilePath() string

type GitlabPipeline 

type GitlabPipeline struct {
	*Generic
	// contains filtered or unexported fields
}

func NewGitlabPipeline 

func NewGitlabPipeline(ctx context.Context, authToken string, logger *zerolog.Logger) *GitlabPipeline

authtoken is a possible oidc token that could be used to authenticate the runner

func (*GitlabPipeline) CheckEnv 

func (r *GitlabPipeline) CheckEnv() bool

Figure out if we are in a Github Action job or not

func (*GitlabPipeline) Environment added in v1.0.0 

func (r *GitlabPipeline) Environment() RunnerEnvironment

func (*GitlabPipeline) FederatedToken added in v1.81.0 

func (r *GitlabPipeline) FederatedToken() string

func (*GitlabPipeline) ID 

func (r *GitlabPipeline) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*GitlabPipeline) IsAuthenticated added in v1.0.0 

func (r *GitlabPipeline) IsAuthenticated() bool

func (*GitlabPipeline) ListEnvVars 

func (r *GitlabPipeline) ListEnvVars() []*EnvVarDefinition

func (*GitlabPipeline) Report added in v1.71.2 

func (r *GitlabPipeline) Report(tableOutput []byte, attestationViewURL string) error

Report writes attestation table output as text artifact

func (*GitlabPipeline) ResolveEnvVars 

func (r *GitlabPipeline) ResolveEnvVars() (map[string]string, []*error)

func (*GitlabPipeline) RunURI 

func (r *GitlabPipeline) RunURI() (url string)

func (*GitlabPipeline) VerifyCommitSignature added in v1.70.0 

func (r *GitlabPipeline) VerifyCommitSignature(ctx context.Context, commitHash string) *commitverification.CommitVerification

VerifyCommitSignature checks if a commit's signature is verified by GitLab

func (*GitlabPipeline) WorkflowFilePath added in v1.0.0 

func (r *GitlabPipeline) WorkflowFilePath() string

type JenkinsJob 

type JenkinsJob struct {
	*Generic
}

func NewJenkinsJob 

func NewJenkinsJob() *JenkinsJob

func (*JenkinsJob) CheckEnv 

func (r *JenkinsJob) CheckEnv() bool

Checks whether we are within a Jenkins job

func (*JenkinsJob) Environment added in v1.0.0 

func (r *JenkinsJob) Environment() RunnerEnvironment

func (*JenkinsJob) ID 

func (r *JenkinsJob) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*JenkinsJob) IsAuthenticated added in v1.0.0 

func (r *JenkinsJob) IsAuthenticated() bool

func (*JenkinsJob) ListEnvVars 

func (r *JenkinsJob) ListEnvVars() []*EnvVarDefinition

func (*JenkinsJob) Report added in v1.71.2 

func (r *JenkinsJob) Report(_ []byte, _ string) error

func (*JenkinsJob) ResolveEnvVars 

func (r *JenkinsJob) ResolveEnvVars() (map[string]string, []*error)

func (*JenkinsJob) RunURI 

func (r *JenkinsJob) RunURI() string

func (*JenkinsJob) VerifyCommitSignature added in v1.70.0 

func (r *JenkinsJob) VerifyCommitSignature(_ context.Context, _ string) *commitverification.CommitVerification

func (*JenkinsJob) WorkflowFilePath added in v1.0.0 

func (r *JenkinsJob) WorkflowFilePath() string

type RunnerEnvironment added in v1.0.0 

type RunnerEnvironment int
const (
	Managed RunnerEnvironment = iota
	SelfHosted
	Unknown
)

func (RunnerEnvironment) String added in v1.0.0 

func (r RunnerEnvironment) String() string

type TeamCityPipeline added in v1.3.0 

type TeamCityPipeline struct {
	*Generic
}

func NewTeamCityPipeline added in v1.3.0 

func NewTeamCityPipeline() *TeamCityPipeline

func (*TeamCityPipeline) CheckEnv added in v1.3.0 

func (r *TeamCityPipeline) CheckEnv() bool

Checks whether we are within a TeamCity pipeline

func (*TeamCityPipeline) Environment added in v1.3.0 

func (r *TeamCityPipeline) Environment() RunnerEnvironment

func (*TeamCityPipeline) ID added in v1.3.0 

func (r *TeamCityPipeline) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*TeamCityPipeline) IsAuthenticated added in v1.3.0 

func (r *TeamCityPipeline) IsAuthenticated() bool

func (*TeamCityPipeline) ListEnvVars added in v1.3.0 

func (r *TeamCityPipeline) ListEnvVars() []*EnvVarDefinition

func (*TeamCityPipeline) Report added in v1.71.2 

func (r *TeamCityPipeline) Report(_ []byte, _ string) error

func (*TeamCityPipeline) ResolveEnvVars added in v1.3.0 

func (r *TeamCityPipeline) ResolveEnvVars() (map[string]string, []*error)

func (*TeamCityPipeline) RunURI added in v1.3.0 

func (r *TeamCityPipeline) RunURI() string

func (*TeamCityPipeline) VerifyCommitSignature added in v1.70.0 

func (r *TeamCityPipeline) VerifyCommitSignature(_ context.Context, _ string) *commitverification.CommitVerification

func (*TeamCityPipeline) WorkflowFilePath added in v1.3.0 

func (r *TeamCityPipeline) WorkflowFilePath() string

type TektonPipeline added in v1.67.0 

type TektonPipeline struct {
	*Generic
	// contains filtered or unexported fields
}

TektonPipeline implements the SupportedRunner interface for Tekton Pipeline environments. It discovers Tekton metadata natively using a two-tier approach:

  • Tier 1: HOSTNAME env var and SA namespace file (always available in K8s pods)
  • Tier 2: K8s API pod labels for rich tekton.dev/* metadata (best-effort)

func NewTektonPipeline added in v1.67.0 

func NewTektonPipeline(ctx context.Context, logger *zerolog.Logger, opts ...TektonPipelineOption) *TektonPipeline

NewTektonPipeline creates a new TektonPipeline runner with two-tier native metadata discovery. ctx is used for K8s API calls; if nil, context.Background() is used as a safety fallback. The logger is required for debug-level logging of discovery failures. Functional options allow injecting test dependencies.

func (*TektonPipeline) CheckEnv added in v1.67.0 

func (r *TektonPipeline) CheckEnv() bool

CheckEnv detects if we're running in a Tekton environment by checking for the existence of Tekton-specific directories

func (*TektonPipeline) Environment added in v1.67.0 

func (r *TektonPipeline) Environment() RunnerEnvironment

Environment detects managed K8s (GKE/EKS/AKS) vs self-hosted via cloud-provider env vars. These env vars are genuinely injected by the cloud platform when workload identity is configured, NOT by user configuration. Returns SelfHosted for plain K8s and Unknown if not in K8s at all.

func (*TektonPipeline) ID added in v1.67.0 

func (r *TektonPipeline) ID() schemaapi.CraftingSchema_Runner_RunnerType

func (*TektonPipeline) IsAuthenticated added in v1.67.0 

func (r *TektonPipeline) IsAuthenticated() bool

func (*TektonPipeline) ListEnvVars added in v1.67.0 

func (r *TektonPipeline) ListEnvVars() []*EnvVarDefinition

func (*TektonPipeline) Report added in v1.71.2 

func (r *TektonPipeline) Report(tableOutput []byte, attestationViewURL string) error

Report writes attestation summary to Tekton Results with 3500-byte truncation. The Tekton Results system has a default max-result-size of 4096 bytes (shared with internal metadata), so we truncate at 3500 bytes to leave room for Tekton overhead.

func (*TektonPipeline) ResolveEnvVars added in v1.67.0 

func (r *TektonPipeline) ResolveEnvVars() (map[string]string, []*error)

ResolveEnvVars returns internally-discovered metadata as key-value entries. Unlike other runners, this does NOT delegate to resolveEnvVars(r.ListEnvVars()) because the real metadata comes from K8s API labels and filesystem, not from env vars. The returned keys (TEKTON_TASKRUN_NAME, etc.) are synthesized from discovered labels -- they are NOT actual environment variables in the container.

Required vars (TEKTON_TASKRUN_NAME, TEKTON_NAMESPACE) return errors if not resolved, blocking attestation. This forces proper RBAC configuration for pod get permissions. Optional vars (HOSTNAME, TEKTON_TASK_NAME, pipeline-specific labels) are silently skipped if empty. TEKTON_TASK_NAME is optional because inline taskSpec pipelines lack the tekton.dev/task pod label.

func (*TektonPipeline) RunURI added in v1.67.0 

func (r *TektonPipeline) RunURI() string

func (*TektonPipeline) VerifyCommitSignature added in v1.70.0 

func (r *TektonPipeline) VerifyCommitSignature(_ context.Context, _ string) *commitverification.CommitVerification

func (*TektonPipeline) WorkflowFilePath added in v1.67.0 

func (r *TektonPipeline) WorkflowFilePath() string

type TektonPipelineOption added in v1.81.0 

type TektonPipelineOption func(*TektonPipeline)

TektonPipelineOption is a functional option for configuring TektonPipeline.

func WithCACertPath added in v1.81.0 

func WithCACertPath(path string) TektonPipelineOption

WithCACertPath overrides the default service account CA certificate file path.

func WithHTTPClient added in v1.81.0 

func WithHTTPClient(client *http.Client) TektonPipelineOption

WithHTTPClient sets a custom HTTP client for K8s API calls. This is primarily used for testing with httptest.NewTLSServer.

func WithNamespacePath added in v1.81.0 

func WithNamespacePath(path string) TektonPipelineOption

WithNamespacePath overrides the default service account namespace file path.

func WithResultsDir added in v1.81.0 

func WithResultsDir(dir string) TektonPipelineOption

WithResultsDir overrides the default Tekton Results directory path. This is primarily used for testing Report() without requiring /tekton/results.

func WithSATokenPath added in v1.81.0 

func WithSATokenPath(path string) TektonPipelineOption

WithSATokenPath overrides the default service account token file path.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.