activities

package
v0.19.1159 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 2, 2026 License: AGPL-3.0 Imports: 29 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func EnsureACRAuth added in v0.19.1153

func EnsureACRAuth(ctx workflow.Context, cfg *configs.OCIRegistryRepository) error

EnsureACRAuth mints an ACR refresh token into cfg.OCIAuth so the runner can authenticate to a registry it has no identity for.

The runner only falls back to ambient Azure credentials when no token is supplied (see pkg/runner/registry/acr.FetchAccessInfo), which holds solely for registries in the same tenant as the runner's own managed identity. A vendor's registry lives in the vendor's tenant, and managed identity cannot cross that boundary, so the token has to be minted here.

Only applies when the config names an app registration. A plain ACR config keeps the existing ambient-identity behaviour, so same-tenant registries that work today are untouched.

Safe to call on any registry type; it is a no-op unless cfg is ACR with an app registration and no token already attached.

func EnsureGARAuth added in v0.19.1121

func EnsureGARAuth(ctx workflow.Context, cfg *configs.OCIRegistryRepository) error

EnsureGARAuth mints a GAR access token into cfg.OCIAuth so the runner can authenticate without GCP application default credentials of its own.

The runner only falls back to ADC when no token is supplied (see pkg/runner/registry/gar.FetchAccessInfo), which holds solely for runners that themselves run in GCP. A control plane in GCP can hand artifacts to a runner in AWS or Azure, so every plan carrying a GAR repository has to embed credentials minted here.

Safe to call on any registry type; it is a no-op unless cfg is GAR without a token already attached.

Types

type ACRAccessToken added in v0.19.1153

type ACRAccessToken struct {
	Username string
	Password string
}

type Activities

type Activities struct {
	// contains filtered or unexported fields
}

func New

func New(params Params) (*Activities, error)

func (*Activities) EnqueueSignalToOwner added in v0.19.850

EnqueueSignalToOwner sends a signal to a queue owned by a specific entity (e.g., runner, install). This enables cross-namespace signal sending where one namespace can trigger work in another.

@temporal-gen-v2 activity

func (*Activities) GetACRAccessToken added in v0.19.1153

func (a *Activities) GetACRAccessToken(ctx context.Context, req *GetACRAccessTokenRequest) (*ACRAccessToken, error)

GetACRAccessToken mints a registry refresh token for a vendor-owned ACR.

Like GetGARAccessToken this lives in the shared activity set because both the components namespace (pulling a source image for a build) and the installs namespace (resolving a sandbox artifact) schedule it.

@temporal-gen-v2 activity @max-retries 1

func (*Activities) GetGARAccessToken added in v0.19.1121

func (a *Activities) GetGARAccessToken(ctx context.Context, req *GetGARAccessTokenRequest) (*GARAccessToken, error)

GetGARAccessToken lives in the shared activity set because both the components namespace (pulling a source image for a build) and the installs namespace (resolving the sandbox artifact) schedule it. Activities are registered per worker, so a components-only registration is invisible to installs.

@temporal-gen-v2 activity @max-retries 1

func (*Activities) GetSandboxBuildOCIRegistry added in v0.19.1118

GetSandboxBuildOCIRegistry lives in the shared activity set because both the apps namespace (building the sandbox artifact) and the installs namespace (resolving it when planning a sandbox run) schedule it. Activities are registered per worker, so an apps-only registration is invisible to installs until it is called.

@temporal-gen-v2 activity @start-to-close-timeout 30s

func (*Activities) GetVersion

func (a *Activities) GetVersion(ctx context.Context, _ GetVersionRequest) (string, error)

@temporal-gen-v2 activity @schedule-to-close-timeout 1m @start-to-close-timeout 10s

func (*Activities) SendEmail

func (a *Activities) SendEmail(ctx context.Context, req SendNotificationRequest) error

@temporal-gen-v2 activity @schedule-to-close-timeout 1m @start-to-close-timeout 10s

type EnqueueSignalToOwnerRequest added in v0.19.850

type EnqueueSignalToOwnerRequest struct {
	OwnerID   string        `json:"owner_id" validate:"required"`
	OwnerType string        `json:"owner_type" validate:"required"`
	QueueName string        `json:"queue_name,omitempty"`
	Signal    signal.Signal `json:"signal" validate:"required"`

	// QueueID short-circuits the owner/name lookup when set.
	QueueID   string  `json:"queue_id,omitempty"`
	DedupeKey *string `json:"dedupe_key,omitempty"`

	// SignalOwnerID and SignalOwnerType are set on the QueueSignal record to track
	// which entity (e.g. workflow step) triggered this signal execution.
	SignalOwnerID   string `json:"signal_owner_id,omitempty"`
	SignalOwnerType string `json:"signal_owner_type,omitempty"`
	IdempotencyKey  string `json:"idempotency_key,omitempty" validate:"omitempty,max=255"`

	// Callback describes where the handler should send a Temporal signal on completion.
	// Deprecated: use Callbacks for new code.
	Callback callback.Ref `json:"callback,omitempty"`

	// Callbacks supports multiple completion targets.
	Callbacks callback.Refs `json:"callbacks,omitempty"`
}

type EnqueueSignalToOwnerResponse added in v0.19.850

type EnqueueSignalToOwnerResponse struct {
	QueueSignalID string `json:"queue_signal_id"`
	WorkflowID    string `json:"workflow_id"`
	Deduplicated  bool   `json:"deduplicated"`
}

type GARAccessToken added in v0.19.1121

type GARAccessToken struct {
	Username string
	Password string
}

type GetACRAccessTokenRequest added in v0.19.1153

type GetACRAccessTokenRequest struct {
	// ComponentID rather than an app ID: it is present on every build plan
	// without depending on a preload, and the activity has a DB handle anyway.
	ComponentID string
	LoginServer string
	TenantID    string
	ClientID    string

	ClientSecretName      string
	ClientCertificateName string
}

GetACRAccessTokenRequest names the credential rather than carrying it.

ClientSecretName and ClientCertificateName are AppSecret names, resolved against the DB inside the activity. Activity inputs are recorded in Temporal history, so passing the vendor's long-lived secret here would persist it; passing a name persists nothing. The minted refresh token does land in history as the activity result, but it expires in 60 minutes — the same exposure GAR tokens already have.

type GetGARAccessTokenRequest added in v0.19.1121

type GetGARAccessTokenRequest struct {
	ServiceAccountEmail      string
	WorkloadIdentityProvider string
}

type GetSandboxBuildOCIRegistryRequest added in v0.19.1118

type GetSandboxBuildOCIRegistryRequest struct {
	AppID string `json:"app_id" validate:"required"`
}

type GetVersionRequest

type GetVersionRequest struct{}

type Params

type Params struct {
	fx.In

	Cfg         *internal.Config
	V           *validator.Validate
	Notifs      *notifications.Notifications
	DB          *gorm.DB `name:"psql"`
	QueueClient *client.Client
}

type SendNotificationRequest

type SendNotificationRequest struct {
	OrgID string `validate:"required"`
	AppID string `validate:"required"`

	Type notifications.Type `validate:"required"`
	Vars map[string]string  `validate:"required"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL