commit 95db6c67d7fa6324302fcfc1848b09884a12d0ac · pyrox.dev/nixpkgs

nixos/modules/services/continuous-integration/gitea-actions-runner.nix

···

       203
        
                   TOKEN = "${instance.token}";

     

       204
        
                 } // optionalAttrs (wantsPodman) {

     

       205
        
                   DOCKER_HOST = "unix:///run/podman/podman.sock";

     

       0
        
       
     

       0
        
       
     

       206
        
                 };

     

       207
        
                 path = with pkgs; [

     

       208
        
                   coreutils

···

       203
        
                   TOKEN = "${instance.token}";

     

       204
        
                 } // optionalAttrs (wantsPodman) {

     

       205
        
                   DOCKER_HOST = "unix:///run/podman/podman.sock";

     

       206
       +
                 } // {

     

       207
       +
                   HOME = "/var/lib/gitea-runner/${name}";

     

       208
        
                 };

     

       209
        
                 path = with pkgs; [

     

       210
        
                   coreutils

+115 -41

nixos/tests/forgejo.nix

···

       22
        
         '';

     

       23
        
         signingPrivateKeyId = "4D642DE8B678C79D";

     

       24
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       25
        
         supportedDbTypes = [ "mysql" "postgres" "sqlite3" ];

     

       26
       -
         makeGForgejoTest = type: nameValuePair type (makeTest {

     

       27
        
           name = "forgejo-${type}";

     

       28
        
           meta.maintainers = with maintainers; [ bendlas emilylange ];

     

       29
        
       

     
···

       36
        
                 settings.service.DISABLE_REGISTRATION = true;

     

       37
        
                 settings."repository.signing".SIGNING_KEY = signingPrivateKeyId;

     

       38
        
                 settings.actions.ENABLED = true;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       39
        
               };

     

       40
       -
               environment.systemPackages = [ config.services.forgejo.package pkgs.gnupg pkgs.jq pkgs.file ];

     

       41
        
               services.openssh.enable = true;

     

       42
        
       

     

       43
        
               specialisation.runner = {

     

       44
        
                 inheritParentConfig = true;

     

       45
       -
                 configuration.services.gitea-actions-runner.instances."test" = {

     

       46
       -
                   enable = true;

     

       47
       -
                   name = "ci";

     

       48
       -
                   url = "http://localhost:3000";

     

       49
       -
                   labels = [

     

       50
       -
                     # don't require docker/podman

     

       51
       -
                     "native:host"

     

       52
       -
                   ];

     

       53
       -
                   tokenFile = "/var/lib/forgejo/runner_token";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       54
        
                 };

     

       55
        
               };

     

       56
        
               specialisation.dump = {

     
···

       62
        
                 };

     

       63
        
               };

     

       64
        
             };

     

       65
       -
             client1 = { config, pkgs, ... }: {

     

       66
       -
               environment.systemPackages = [ pkgs.git ];

     

       67
       -
             };

     

       68
       -
             client2 = { config, pkgs, ... }: {

     

       69
       -
               environment.systemPackages = [ pkgs.git ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       70
        
             };

     

       71
        
           };

     

       72
        
       

     
···

       75
        
               inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;

     

       76
        
               serverSystem = nodes.server.system.build.toplevel;

     

       77
        
               dumpFile = with nodes.server.specialisation.dump.configuration.services.forgejo.dump; "${backupDir}/${file}";

     

       0
        
       
     

       0
        
       
     

       78
        
             in

     

       79
        
             ''

     

       80
        
               import json

     

       81
       -
               GIT_SSH_COMMAND = "ssh -i $HOME/.ssh/privk -o StrictHostKeyChecking=no"

     

       82
       -
               REPO = "forgejo@server:test/repo"

     

       83
       -
               PRIVK = "${snakeOilPrivateKey}"

     

       84
        
       

     

       85
        
               start_all()

     

       86
        
       

     

       87
       -
               client1.succeed("mkdir /tmp/repo")

     

       88
       -
               client1.succeed("mkdir -p $HOME/.ssh")

     

       89
       -
               client1.succeed(f"cat {PRIVK} > $HOME/.ssh/privk")

     

       90
       -
               client1.succeed("chmod 0400 $HOME/.ssh/privk")

     

       91
       -
               client1.succeed("git -C /tmp/repo init")

     

       92
       -
               client1.succeed("echo hello world > /tmp/repo/testfile")

     

       93
       -
               client1.succeed("git -C /tmp/repo add .")

     

       94
       -
               client1.succeed("git config --global user.email test@localhost")

     

       95
       -
               client1.succeed("git config --global user.name test")

     

       96
       -
               client1.succeed("git -C /tmp/repo commit -m 'Initial import'")

     

       97
       -
               client1.succeed(f"git -C /tmp/repo remote add origin {REPO}")

     

       98
        
       

     

       99
        
               server.wait_for_unit("forgejo.service")

     

       100
        
               server.wait_for_open_port(3000)

     
···

       143
        
                   + ' -d \'{"key":"${snakeOilPublicKey}","read_only":true,"title":"SSH"}\'''

     

       144
        
               )

     

       145
        
       

     

       146
       -
               client1.succeed(

     

       147
       -
                   f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git -C /tmp/repo push origin master"

     

       148
       -
               )

     

       149
        
       

     

       150
       -
               client2.succeed("mkdir -p $HOME/.ssh")

     

       151
       -
               client2.succeed(f"cat {PRIVK} > $HOME/.ssh/privk")

     

       152
       -
               client2.succeed("chmod 0400 $HOME/.ssh/privk")

     

       153
       -
               client2.succeed(f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git clone {REPO}")

     

       154
       -
               client2.succeed('test "$(cat repo/testfile | xargs echo -n)" = "hello world"')

     

       155
        
       

     

       156
        
               with subtest("Testing git protocol version=2 over ssh"):

     

       157
       -
                   git_protocol = client2.succeed(f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' GIT_TRACE2_EVENT=true git -C repo fetch |& grep negotiated-version")

     

       158
        
                   version = json.loads(git_protocol).get("value")

     

       159
        
                   assert version == "2", f"git did not negotiate protocol version 2, but version {version} instead."

     

       160
        
       

     
···

       164
        
                   timeout=10

     

       165
        
               )

     

       166
        
       

     

       167
       -
               with subtest("Testing runner registration"):

     

       168
        
                   server.succeed(

     

       169
        
                       "su -l forgejo -c 'GITEA_WORK_DIR=/var/lib/forgejo gitea actions generate-runner-token' | sed 's/^/TOKEN=/' | tee /var/lib/forgejo/runner_token"

     

       170
        
                   )

     
···

       172
        
                   server.wait_for_unit("gitea-runner-test.service")

     

       173
        
                   server.succeed("journalctl -o cat -u gitea-runner-test.service | grep -q 'Runner registered successfully'")

     

       174
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       175
        
               with subtest("Testing backup service"):

     

       176
        
                   server.succeed("${serverSystem}/specialisation/dump/bin/switch-to-configuration test")

     

       177
        
                   server.systemctl("start forgejo-dump")

     
···

       181
        
         });

     

       182
        
       in

     

       183
        
       

     

       184
       -
       listToAttrs (map makeGForgejoTest supportedDbTypes)

···

       22
        
         '';

     

       23
        
         signingPrivateKeyId = "4D642DE8B678C79D";

     

       24
        
       

     

       25
       +
         actionsWorkflowYaml = ''

     

       26
       +
           run-name: dummy workflow

     

       27
       +
           on:

     

       28
       +
             push:

     

       29
       +
           jobs:

     

       30
       +
             cat:

     

       31
       +
               runs-on: native

     

       32
       +
               steps:

     

       33
       +
                 - uses: http://localhost:3000/test/checkout@main

     

       34
       +
                 - run: cat testfile

     

       35
       +
         '';

     

       36
       +
         # https://github.com/actions/checkout/releases

     

       37
       +
         checkoutActionSource = pkgs.fetchFromGitHub {

     

       38
       +
           owner = "actions";

     

       39
       +
           repo = "checkout";

     

       40
       +
           rev = "v4.1.1";

     

       41
       +
           hash = "sha256-h2/UIp8IjPo3eE4Gzx52Fb7pcgG/Ww7u31w5fdKVMos=";

     

       42
       +
         };

     

       43
       +
       

     

       44
        
         supportedDbTypes = [ "mysql" "postgres" "sqlite3" ];

     

       45
       +
         makeForgejoTest = type: nameValuePair type (makeTest {

     

       46
        
           name = "forgejo-${type}";

     

       47
        
           meta.maintainers = with maintainers; [ bendlas emilylange ];

     

       48
        
       

     
···

       55
        
                 settings.service.DISABLE_REGISTRATION = true;

     

       56
        
                 settings."repository.signing".SIGNING_KEY = signingPrivateKeyId;

     

       57
        
                 settings.actions.ENABLED = true;

     

       58
       +
                 settings.repository = {

     

       59
       +
                   ENABLE_PUSH_CREATE_USER = true;

     

       60
       +
                   DEFAULT_PUSH_CREATE_PRIVATE = false;

     

       61
       +
                 };

     

       62
        
               };

     

       63
       +
               environment.systemPackages = [ config.services.forgejo.package pkgs.gnupg pkgs.jq pkgs.file pkgs.htmlq ];

     

       64
        
               services.openssh.enable = true;

     

       65
        
       

     

       66
        
               specialisation.runner = {

     

       67
        
                 inheritParentConfig = true;

     

       68
       +
                 configuration.services.gitea-actions-runner = {

     

       69
       +
                   package = pkgs.forgejo-runner;

     

       70
       +
                   instances."test" = {

     

       71
       +
                     enable = true;

     

       72
       +
                     name = "ci";

     

       73
       +
                     url = "http://localhost:3000";

     

       74
       +
                     labels = [

     

       75
       +
                       # type ":host" does not depend on docker/podman/lxc

     

       76
       +
                       "native:host"

     

       77
       +
                     ];

     

       78
       +
                     tokenFile = "/var/lib/forgejo/runner_token";

     

       79
       +
                   };

     

       80
        
                 };

     

       81
        
               };

     

       82
        
               specialisation.dump = {

     
···

       88
        
                 };

     

       89
        
               };

     

       90
        
             };

     

       91
       +
             client = { ... }: {

     

       92
       +
               programs.git = {

     

       93
       +
                 enable = true;

     

       94
       +
                 config = {

     

       95
       +
                   user.email = "test@localhost";

     

       96
       +
                   user.name = "test";

     

       97
       +
                   init.defaultBranch = "main";

     

       98
       +
                 };

     

       99
       +
               };

     

       100
       +
               programs.ssh.extraConfig = ''

     

       101
       +
                 Host *

     

       102
       +
                   StrictHostKeyChecking no

     

       103
       +
                   IdentityFile ~/.ssh/privk

     

       104
       +
               '';

     

       105
        
             };

     

       106
        
           };

     

       107
        
       

     
···

       110
        
               inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;

     

       111
        
               serverSystem = nodes.server.system.build.toplevel;

     

       112
        
               dumpFile = with nodes.server.specialisation.dump.configuration.services.forgejo.dump; "${backupDir}/${file}";

     

       113
       +
               remoteUri = "forgejo@server:test/repo";

     

       114
       +
               remoteUriCheckoutAction = "forgejo@server:test/checkout";

     

       115
        
             in

     

       116
        
             ''

     

       117
        
               import json

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       118
        
       

     

       119
        
               start_all()

     

       120
        
       

     

       121
       +
               client.succeed("mkdir -p ~/.ssh")

     

       122
       +
               client.succeed("(umask 0077; cat ${snakeOilPrivateKey} > ~/.ssh/privk)")

     

       123
       +
       

     

       124
       +
               client.succeed("mkdir /tmp/repo")

     

       125
       +
               client.succeed("git -C /tmp/repo init")

     

       126
       +
               client.succeed("echo 'hello world' > /tmp/repo/testfile")

     

       127
       +
               client.succeed("git -C /tmp/repo add .")

     

       128
       +
               client.succeed("git -C /tmp/repo commit -m 'Initial import'")

     

       129
       +
               client.succeed("git -C /tmp/repo remote add origin ${remoteUri}")

     

       0
        
       
     

       0
        
       
     

       130
        
       

     

       131
        
               server.wait_for_unit("forgejo.service")

     

       132
        
               server.wait_for_open_port(3000)

     
···

       175
        
                   + ' -d \'{"key":"${snakeOilPublicKey}","read_only":true,"title":"SSH"}\'''

     

       176
        
               )

     

       177
        
       

     

       178
       +
               client.succeed("git -C /tmp/repo push origin main")

     

       0
        
       
     

       0
        
       
     

       179
        
       

     

       180
       +
               client.succeed("git clone ${remoteUri} /tmp/repo-clone")

     

       181
       +
               print(client.succeed("ls -lash /tmp/repo-clone"))

     

       182
       +
               assert "hello world" == client.succeed("cat /tmp/repo-clone/testfile").strip()

     

       0
        
       
     

       0
        
       
     

       183
        
       

     

       184
        
               with subtest("Testing git protocol version=2 over ssh"):

     

       185
       +
                   git_protocol = client.succeed("GIT_TRACE2_EVENT=true git -C /tmp/repo-clone fetch |& grep negotiated-version")

     

       186
        
                   version = json.loads(git_protocol).get("value")

     

       187
        
                   assert version == "2", f"git did not negotiate protocol version 2, but version {version} instead."

     

       188
        
       

     
···

       192
        
                   timeout=10

     

       193
        
               )

     

       194
        
       

     

       195
       +
               with subtest("Testing runner registration and action workflow"):

     

       196
        
                   server.succeed(

     

       197
        
                       "su -l forgejo -c 'GITEA_WORK_DIR=/var/lib/forgejo gitea actions generate-runner-token' | sed 's/^/TOKEN=/' | tee /var/lib/forgejo/runner_token"

     

       198
        
                   )

     
···

       200
        
                   server.wait_for_unit("gitea-runner-test.service")

     

       201
        
                   server.succeed("journalctl -o cat -u gitea-runner-test.service | grep -q 'Runner registered successfully'")

     

       202
        
       

     

       203
       +
                   # enable actions feature for this repository, defaults to disabled

     

       204
       +
                   server.succeed(

     

       205
       +
                       "curl --fail -X PATCH http://localhost:3000/api/v1/repos/test/repo "

     

       206
       +
                       + "-H 'Accept: application/json' -H 'Content-Type: application/json' "

     

       207
       +
                       + f"-H 'Authorization: token {api_token}'"

     

       208
       +
                       + ' -d \'{"has_actions":true}\'''

     

       209
       +
                   )

     

       210
       +
       

     

       211
       +
                   # mirror "actions/checkout" action

     

       212
       +
                   client.succeed("cp -R ${checkoutActionSource}/ /tmp/checkout")

     

       213
       +
                   client.succeed("git -C /tmp/checkout init")

     

       214
       +
                   client.succeed("git -C /tmp/checkout add .")

     

       215
       +
                   client.succeed("git -C /tmp/checkout commit -m 'Initial import'")

     

       216
       +
                   client.succeed("git -C /tmp/checkout remote add origin ${remoteUriCheckoutAction}")

     

       217
       +
                   client.succeed("git -C /tmp/checkout push origin main")

     

       218
       +
       

     

       219
       +
                   # push workflow to initial repo

     

       220
       +
                   client.succeed("mkdir -p /tmp/repo/.forgejo/workflows")

     

       221
       +
                   client.succeed("cp ${pkgs.writeText "dummy-workflow.yml" actionsWorkflowYaml} /tmp/repo/.forgejo/workflows/")

     

       222
       +
                   client.succeed("git -C /tmp/repo add .")

     

       223
       +
                   client.succeed("git -C /tmp/repo commit -m 'Add dummy workflow'")

     

       224
       +
                   client.succeed("git -C /tmp/repo push origin main")

     

       225
       +
       

     

       226
       +
                   def poll_workflow_action_status(_) -> bool:

     

       227
       +
                       output = server.succeed(

     

       228
       +
                           "curl --fail http://localhost:3000/test/repo/actions | "

     

       229
       +
                           + 'htmlq ".flex-item-leading span" --attribute "data-tooltip-content"'

     

       230
       +
                       ).strip()

     

       231
       +
       

     

       232
       +
                       # values taken from https://codeberg.org/forgejo/forgejo/src/commit/af47c583b4fb3190fa4c4c414500f9941cc02389/options/locale/locale_en-US.ini#L3649-L3661

     

       233
       +
                       if output in [ "Failure", "Canceled", "Skipped", "Blocked" ]:

     

       234
       +
                           raise Exception(f"Workflow status is '{output}', which we consider failed.")

     

       235
       +
                           server.log(f"Command returned '{output}', which we consider failed.")

     

       236
       +
       

     

       237
       +
                       elif output in [ "Unknown", "Waiting", "Running", "" ]:

     

       238
       +
                           server.log(f"Workflow status is '{output}'. Waiting some more...")

     

       239
       +
                           return False

     

       240
       +
       

     

       241
       +
                       elif output in [ "Success" ]:

     

       242
       +
                           return True

     

       243
       +
       

     

       244
       +
                       raise Exception(f"Workflow status is '{output}', which we don't know. Value mappings likely need updating.")

     

       245
       +
       

     

       246
       +
                   with server.nested("Waiting for the workflow run to be successful"):

     

       247
       +
                       retry(poll_workflow_action_status)

     

       248
       +
       

     

       249
        
               with subtest("Testing backup service"):

     

       250
        
                   server.succeed("${serverSystem}/specialisation/dump/bin/switch-to-configuration test")

     

       251
        
                   server.systemctl("start forgejo-dump")

     
···

       255
        
         });

     

       256
        
       in

     

       257
        
       

     

       258
       +
       listToAttrs (map makeForgejoTest supportedDbTypes)

+7 -3

pkgs/by-name/fo/forgejo-runner/package.nix

···

       3
        
       , fetchFromGitea

     

       4
        
       , testers

     

       5
        
       , forgejo-runner

     

       0
        
       
     

       6
        
       }:

     

       7
        
       

     

       8
        
       buildGoModule rec {

     
···

       27
        
       

     

       28
        
         doCheck = false; # Test try to lookup code.forgejo.org.

     

       29
        
       

     

       30
       -
         passthru.tests.version = testers.testVersion {

     

       31
       -
           package = forgejo-runner;

     

       32
       -
           version = src.rev;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       33
        
         };

     

       34
        
       

     

       35
        
         meta = with lib; {

···

       3
        
       , fetchFromGitea

     

       4
        
       , testers

     

       5
        
       , forgejo-runner

     

       6
       +
       , nixosTests

     

       7
        
       }:

     

       8
        
       

     

       9
        
       buildGoModule rec {

     
···

       28
        
       

     

       29
        
         doCheck = false; # Test try to lookup code.forgejo.org.

     

       30
        
       

     

       31
       +
         passthru.tests = {

     

       32
       +
           inherit (nixosTests.forgejo) sqlite3;

     

       33
       +
           version = testers.testVersion {

     

       34
       +
             package = forgejo-runner;

     

       35
       +
             version = src.rev;

     

       36
       +
           };

     

       37
        
         };

     

       38
        
       

     

       39
        
         meta = with lib; {