jojo/tests/integration/ephemeral_actions_runner_deletion_test.go
Manuel Ganter 5b6bbabd74 feat: implement ephemeral runners (#9962)
As described in [this comment](https://gitea.com/gitea/act_runner/issues/19#issuecomment-739221) one-job runners are not secure when running in host mode. We implemented a routine preventing runner tokens from receiving a second job in order to render a potentially compromised token useless. Also we implemented a routine that removes finished runners as soon as possible.

Big thanks to [ChristopherHX](https://github.com/ChristopherHX) who did all the work for gitea!

Rel: #9407

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9962
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Manuel Ganter <manuel.ganter@think-ahead.tech>
Co-committed-by: Manuel Ganter <manuel.ganter@think-ahead.tech>
2026-02-16 18:56:56 +01:00

170 lines
5.9 KiB
Go

// Copyright 2025 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package integration
import (
"context"
"net/url"
"testing"
actions_model "forgejo.org/models/actions"
org_model "forgejo.org/models/organization"
"forgejo.org/models/unittest"
user_model "forgejo.org/models/user"
"forgejo.org/modules/setting"
"forgejo.org/modules/util"
actions_service "forgejo.org/services/actions"
org_service "forgejo.org/services/org"
repo_service "forgejo.org/services/repository"
user_service "forgejo.org/services/user"
runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1"
"connectrpc.com/connect"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
// Test that the ephemeral runner is deleted when the task is finished
func TestEphemeralRunnerDeletionByTaskCompletion(t *testing.T) {
if !setting.Database.Type.IsSQLite3() {
t.Skip()
}
defer unittest.OverrideFixtures("tests/integration/fixtures/TestEphemeralRunner")()
onApplicationRun(t, func(t *testing.T, u *url.URL) {
// Verify runner exists before the test
runner, err := actions_model.GetRunnerByID(context.Background(), 10000008)
require.NoError(t, err)
require.NotNil(t, runner)
require.True(t, runner.Ephemeral, "runner should be ephemeral")
// Verify task exists and is running
task := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 10054})
assert.Equal(t, actions_model.StatusRunning, task.Status)
assert.Equal(t, int64(10000008), task.RunnerID)
// Token can be found in models/fixtures/action_runner.yml with id: 10000008
runnerClient := newMockRunnerClient(
runner.UUID,
"mysuuupersecrettoekn",
)
// Finish the Task
resp, err := runnerClient.runnerServiceClient.UpdateTask(
context.Background(),
connect.NewRequest(&runnerv1.UpdateTaskRequest{
State: &runnerv1.TaskState{
Id: task.ID,
Result: runnerv1.Result_RESULT_SUCCESS,
},
}),
)
require.NoError(t, err)
require.NotNil(t, resp)
assert.Equal(t, runnerv1.Result_RESULT_SUCCESS, resp.Msg.State.Result)
// Expect the ephemeral runner has been deleted
_, err = actions_model.GetRunnerByID(context.Background(), 10000008)
assert.ErrorIs(t, err, util.ErrNotExist, "ephemeral runner should be deleted after task completion")
})
}
func TestEphemeralRunnerDeletedByTaskZombieCleanup(t *testing.T) {
if !setting.Database.Type.IsSQLite3() {
t.Skip()
}
defer unittest.OverrideFixtures("tests/integration/fixtures/TestEphemeralRunner")()
onApplicationRun(t, func(t *testing.T, u *url.URL) {
// Verify runner exists before the test
runner, err := actions_model.GetRunnerByID(context.Background(), 10000011)
require.NoError(t, err)
require.NotNil(t, runner)
require.True(t, runner.Ephemeral, "runner should be ephemeral")
// Verify zombie task exists and is running
task := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 10055})
assert.Equal(t, actions_model.StatusRunning, task.Status)
assert.Equal(t, int64(10000011), task.RunnerID)
// Run zombie task cleanup
err = actions_service.StopZombieTasks(context.Background())
require.NoError(t, err)
// Expect the ephemeral runner has been deleted
_, err = actions_model.GetRunnerByID(context.Background(), 10000011)
assert.ErrorIs(t, err, util.ErrNotExist, "ephemeral runner should be deleted after zombie task cleanup")
})
}
func TestEphemeralRunnerDeletionOnRepositoryDeletion(t *testing.T) {
if !setting.Database.Type.IsSQLite3() {
t.Skip()
}
defer unittest.OverrideFixtures("tests/integration/fixtures/TestEphemeralRunner")()
onApplicationRun(t, func(t *testing.T, u *url.URL) {
runner, err := actions_model.GetRunnerByID(t.Context(), 10000008)
require.NoError(t, err)
assert.Equal(t, int64(0), runner.OwnerID, "runner should not start in user scope")
assert.NotEqual(t, int64(0), runner.RepoID, "runner should start in repo scope")
task := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 10054})
assert.Equal(t, actions_model.StatusRunning, task.Status)
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
err = repo_service.DeleteRepositoryDirectly(t.Context(), user, task.RepoID, true)
require.NoError(t, err)
_, err = actions_model.GetRunnerByID(t.Context(), 10000008)
assert.ErrorIs(t, err, util.ErrNotExist)
})
}
// Test that the ephemeral runner is deleted when a user is deleted
func TestEphemeralRunnerDeletionOnUserDeletion(t *testing.T) {
if !setting.Database.Type.IsSQLite3() {
t.Skip()
}
defer unittest.OverrideFixtures("tests/integration/fixtures/TestEphemeralRunner")()
onApplicationRun(t, func(t *testing.T, u *url.URL) {
runner, err := actions_model.GetRunnerByID(t.Context(), 10000012)
require.NoError(t, err)
assert.NotEqual(t, int64(0), runner.OwnerID, "runner should start in user scope")
assert.Equal(t, int64(0), runner.RepoID, "runner should not start in repo scope")
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
err = user_service.DeleteUser(t.Context(), user, true)
require.NoError(t, err)
unittest.AssertNotExistsBean(t, runner)
})
}
// Test that the ephemeral runner is deleted when an organization is deleted
func TestEphemeralRunnerDeletionOnOrgDeletion(t *testing.T) {
if !setting.Database.Type.IsSQLite3() {
t.Skip()
}
defer unittest.OverrideFixtures("tests/integration/fixtures/TestEphemeralRunner")()
onApplicationRun(t, func(t *testing.T, u *url.URL) {
runner, err := actions_model.GetRunnerByID(t.Context(), 10000013)
require.NoError(t, err)
assert.NotEqual(t, int64(0), runner.OwnerID, "runner should start in org scope")
assert.Equal(t, int64(0), runner.RepoID, "runner should not start in repo scope")
org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{ID: runner.OwnerID})
err = org_service.DeleteOrganization(t.Context(), org, true)
require.NoError(t, err)
unittest.AssertNotExistsBean(t, runner)
})
}