Documentation
¶
Overview ¶
Package actionrpc is the protocol between the workflow runner and its actions. Each action runs in a process of its own, started from the probe binary, and is called over go-plugin's gRPC transport.
Index ¶
- Constants
- Variables
- func CleanupExecutable(ctx context.Context, path string, sum []byte, call CleanupCall, ...) error
- func IsRefused(err error) bool
- func LogOutcome(log hclog.Logger, subject string, ret map[string]any, err error)
- func LogParams(log hclog.Logger, msg string, with map[string]any)
- func Refuse(format string, args ...any) error
- func Run(name string, with map[string]any, log hclog.Logger) (map[string]any, error)
- func RunExecutable(path string, sum []byte, with map[string]any, log hclog.Logger) (map[string]any, error)
- func RunExecutableStep(path string, sum []byte, call Call, log hclog.Logger) (map[string]any, map[string]any, error)
- func RunStep(name string, call Call, log hclog.Logger) (map[string]any, map[string]any, error)
- func Sendable(v map[string]any) (map[string]any, error)
- func Serve(newAction func(log hclog.Logger) Action)
- type Action
- type Call
- type Cleaner
- type CleanupCall
- type Cleanups
- type Client
- type Guard
- type Plugin
- type Refused
- type Server
- type Step
- type StepAction
Constants ¶
const ( // KindReadOnly is ReadOnly: the action refuses what writes. KindReadOnly = "read-only" // KindAllowHost is AllowHosts: the action refuses a host the guard does // not allow. KindAllowHost = "allow-host" )
The kinds of guard, as an action declares the ones it keeps to.
Variables ¶
var ( // BuiltinCmd is the subcommand of the probe binary that serves an action. BuiltinCmd = "builtin-actions" // Handshake is the go-plugin handshake both sides of an action agree on. Handshake = plugin.HandshakeConfig{ProtocolVersion: 1, MagicCookieKey: "probe", MagicCookieValue: "actions"} // PluginMap is the set of plugins the runner can dispense. PluginMap = map[string]plugin.Plugin{"actions": &Plugin{}} )
Functions ¶
func CleanupExecutable ¶ added in v1.27.0
func CleanupExecutable(ctx context.Context, path string, sum []byte, call CleanupCall, log hclog.Logger) error
CleanupExecutable starts the action served by the executable at path, as RunExecutable does, has it clean up after the run that call names, and stops it. The action is stopped where it is once ctx is done.
func LogOutcome ¶
LogOutcome records how an action finished. subject names what was attempted, for example "http request", and is used to build the message.
func LogParams ¶
LogParams records the parameters an action received, truncating long values so that a large request body does not flood the log. Actions are separate processes, so their log records reach the workflow runner as JSON on stderr and are re-filtered there by the runner's own level.
func Run ¶
Run starts the action named name from the running probe binary, calls it once with the given parameters, and stops it. The action's own log records reach log, which decides what of them is shown.
func RunExecutable ¶
func RunExecutable(path string, sum []byte, with map[string]any, log hclog.Logger) (map[string]any, error)
RunExecutable starts the action served by the executable at path, calls it once with the given parameters, and stops it, as Run does for a built-in one. When sum is not empty, the executable is started only if its SHA-256 digest is sum.
func RunExecutableStep ¶
func RunExecutableStep(path string, sum []byte, call Call, log hclog.Logger) (map[string]any, map[string]any, error)
RunExecutableStep is RunExecutable for a step, as RunStep is Run for one.
func RunStep ¶
RunStep is Run for a step: the action is told about the step and given the state it left in the job, and the state it leaves is returned, which is nil when it keeps none.
func Sendable ¶
Sendable returns a copy of v as an action in a process of its own sends it and the runner receives it: maps keyed by strings, lists, and plain values, with whole numbers as int64. The maps and lists are new, so the copy shares none of them with v. It fails for a value that cannot be sent, as sending it would.
Types ¶
type Action ¶
Action is what an action implements: it runs once with the step's `with` parameters and returns its result.
type Call ¶
type Call struct {
// With holds the step's with parameters, as Action.Run is given them.
With map[string]any
// State is the state the action left in the job, or nil when it left
// none. The runner keeps the state the action returns without reading
// it, and gives it to the action again in the next step of the job that
// uses it. The state starts empty in each run of a job, and a nil state
// returned keeps it as it was.
State map[string]any
// Step is the step the action runs for.
Step Step
// Guard is what the run allows the action to do. An action that keeps
// to it returns a Refused error for what it does not allow.
Guard Guard
// Actions are the names the workflow gives its external actions, each
// with the action it stands for in full, for an action that runs steps
// of its own, as embedded does, to read a uses by. A local action is an
// absolute path here.
Actions map[string]string
// Cleanups is not nil when the runner cleans up once the run is over:
// it calls Cleanup of the action, when its action.yml sets cleanup, and
// of those named here. It is nil for a runner that does not, such as a
// Probe from before there was a cleanup, under which what a step leaves
// behind stays; an action can refuse to leave anything then.
Cleanups *Cleanups
}
Call is what a StepAction is given to run once for a step.
type Cleaner ¶ added in v1.27.0
type Cleaner interface {
Action
Cleanup(call CleanupCall) error
}
Cleaner is an Action that removes what its steps left behind in a run, such as the containers they started, once the run is over. The runner calls Cleanup only on an action whose action.yml sets cleanup, and once however many steps used it, so the action has to find what to remove by the run alone, such as by a label of the run's ID that its steps put on what they made.
Cleanup is called when the run ends by a signal as well, and then a step of the action may still be running, or may have been stopped halfway. It can be called again for the same run, and for a run that left nothing, so it must not fail for what is already gone.
type CleanupCall ¶ added in v1.27.0
type CleanupCall struct {
// RunID names the run that is over, as Step.RunID named it to each of
// its steps.
RunID string
}
CleanupCall is what a Cleaner is given to clean up after a run.
type Cleanups ¶ added in v1.27.0
type Cleanups struct {
// contains filtered or unexported fields
}
Cleanups is given to an action by a runner that cleans up once the run is over. It gathers the external actions that are to be cleaned up then, for an action that runs steps of its own to pass on those its steps used. A nil Cleanups gathers nothing.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client calls an Action in another process.
func (*Client) Cleanup ¶ added in v1.27.0
func (m *Client) Cleanup(ctx context.Context, call CleanupCall) error
Cleanup tells the action that the run is over, for it to remove what its steps left behind. It gives up once ctx is done.
type Guard ¶
type Guard struct {
// ReadOnly allows only what reads, and nothing that writes, such as an
// HTTP POST or an UPDATE.
ReadOnly bool
// AllowHosts are the hosts actions may connect to: a name or an address,
// with a port or without one for any port, or *.example.com for the
// names under example.com. Empty allows any host.
AllowHosts []string
// AllowActions are the actions run under the guard although they do not
// keep to it, as the person running probe asks.
AllowActions []string
// Keeps holds the kinds of guard each action says it keeps to itself,
// keyed by the action as a step's uses names it: a built-in action by
// what its package declares, an external one by its action.yml. An
// action is refused under a guard it does not keep to every kind of,
// unless AllowActions names it.
Keeps map[string][]string
}
Guard is what a run allows its actions to do. It is set by whoever runs probe, on the command line, rather than by the workflow, so that a workflow cannot loosen it. The zero Guard allows everything.
A guard keeps a workflow from writing to, or reaching, what it was not meant to; it is not a sandbox. An action keeps to it only as far as the action can tell what it is about to do.
func (Guard) AllowsHost ¶
AllowsHost reports whether the guard allows connecting to hostport, a host with or without a port.
func (Guard) CheckHost ¶
CheckHost returns a Refused error when the guard does not allow connecting to hostport.
func (Guard) Kinds ¶
Kinds returns the kinds of guard that limit the run, in the order of the constants.
func (Guard) Missing ¶
Missing returns the kinds of guard that limit the run and that the action named uses does not keep to.
type Plugin ¶
Plugin serves an Action over gRPC, and is what the runner dispenses to call one.
func (*Plugin) GRPCClient ¶
func (p *Plugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (any, error)
func (*Plugin) GRPCServer ¶
type Refused ¶
type Refused struct {
Reason string
}
Refused is the error an action returns for what the guard of the run does not allow. The runner tells it from other errors of an action.
type Server ¶
type Server struct {
Impl Action
// contains filtered or unexported fields
}
Server answers the runner's calls with an Action.
func (*Server) Cleanup ¶ added in v1.27.0
func (m *Server) Cleanup(ctx context.Context, req *pb.CleanupRequest) (*pb.CleanupResponse, error)
Cleanup has the action clean up after the run the request names. An action that is not a Cleaner has nothing to do it with, which is an error: the runner calls only an action that asked to be.
func (*Server) Run ¶
func (m *Server) Run(ctx context.Context, req *pb.RunRequest) (_ *pb.RunResponse, err error)
Run runs the action with the request's parameters.
type Step ¶
type Step struct {
// RunID names the run of probe, the same for every step of every job in
// it, and for a job run by the embedded action.
RunID string
JobID string
JobName string
// Index is the position of the step in the job, from 0.
Index int
// ID is the id the step is given, or empty.
ID string
Name string
// Repeat is which run of a repeated job this is, from 0.
Repeat int
// Attempt is which attempt of a retried step this is, from 1.
Attempt int
}
Step tells an action about the step it runs for.
type StepAction ¶
type StepAction interface {
Action
RunStep(call Call) (result, newState map[string]any, err error)
}
StepAction is an Action that is told about the step it runs for, and may keep state in a job from one step that uses it to the next, such as the cookies a server set. What it does with either is up to the action.