Skip to content

feat(ci): built-in actions/checkout and uses handling#376

Merged
zoetaka38 merged 1 commit into
mainfrom
feat/ci-uses-checkout
Jul 7, 2026
Merged

feat(ci): built-in actions/checkout and uses handling#376
zoetaka38 merged 1 commit into
mainfrom
feat/ci-uses-checkout

Conversation

@zoetaka38

@zoetaka38 zoetaka38 commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Fourth PR completing the Actions executor: uses: steps (previously skipped silently).

What

  • actions/checkout (any version) is built in — clones the repository at the run's commit into the job's workspace, so subsequent run steps see the repo files. The on-disk repo path now rides on the run payload from the trigger.
  • Per-job workspace — each job instance gets its own temp workspace, so checkout starts clean and parallel matrix instances don't collide.
  • Other actions — any non-checkout uses: is logged as unsupported and skipped (not failed), so workflows referencing marketplace actions still make progress.
  • checkout / unsupported notes are emitted as job log lines, so they show in the web UI next to step output.

Also fixes a flaky frontend test: jsdom lacks EventSource, so render-only tests of the job-log page intermittently threw EventSource is not defined. Added an inert global stub in the vitest setup (streaming tests still install their own mock).

Verified live

Run actions/checkout (4793b4...)
v1.0                                  # cat VERSION.txt — checkout populated the workspace
Skipping unsupported action "docker/setup-buildx-action@v3" (only actions/checkout is built in)
run -> success

Unit tests: checkout invoked with repo path + head SHA + a dest dir; an unsupported action does not fail the run and later steps still run.

Follow-up: real sealed-box action secrets (the last known gap).

@orange-codens

orange-codens Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown

🍊 Orange Codens レビュー

🔒 セキュリティ: 本 diff は CI Runner における uses: ステップの実行と per-job ワークスペースの分離を追加する機能変更であり、セキュリティ上の懸念点は見つかりませんでした。特に defaultCheckout 内の git clone / git checkout コマンドは exec.CommandContext の引数リスト形式で呼び出しておりシェルを介さないため、CWE-78 (OS コマンドインジェクション) のリスクはありません。RepoGitPath、HeadSHA、HeadBranch がいずれも内部トリガー処理からの値であり外部ユーザー入力を直接受け取らない点も安全です。os.MkdirTemp による per-job ワークスペースの作成は 0700 権限で新規ディレクトリを生成するため、他ジョブとの衝突やシンボリックリンク攻撃のリスクもありません。

指摘事項はありません。✨

head: b361408 | 🍊 Reviewed by Orange Codens — AI code review & security audit

@zoetaka38
feat(ci): built-in actions/checkout, per-job workspace, uses handling
b361408 
Implements the `uses:` steps that were previously skipped silently.

- actions/checkout (any version) is built in: it clones the repository at the
  run's commit into the job's workspace, so subsequent run steps see the repo
  files (the on-disk repo path now rides on the run payload from the trigger).
- Every job instance gets its own workspace under the run's temp dir, so
  checkout starts clean and parallel matrix instances don't collide.
- Any other `uses:` action is logged as unsupported and skipped (not failed),
  so workflows referencing marketplace actions still make progress.
- checkout / unsupported-action notes are emitted as job log lines, so they
  show in the web UI alongside step output.

Also add an inert global EventSource stub to the vitest setup: jsdom lacks
EventSource, so render-only tests of the job-log page intermittently threw
"EventSource is not defined". Streaming tests still install their own mock.

Verified live: `uses: actions/checkout@v4` then `cat VERSION.txt` prints the
committed file; an unsupported action logs a skip note and the run still
succeeds.

Follow-up: real sealed-box action secrets.
@zoetaka38
zoetaka38 force-pushed the feat/ci-uses-checkout branch from a2b42ed to b361408 Compare July 7, 2026 03:45
@zoetaka38

zoetaka38 commented Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Rebased onto main. Note: #377 landed a ci_worker_test.go that does not compile (references undefined domainrepo.JobLogLine, a nonexistent ci_running table, and a missing mustExec helper), so go test ./... was failing to build the worker package on main. This rebase replaces that file with the working, comprehensive test suite (env/needs/skip/matrix/expression/checkout) and keeps #377's production ci_worker.go change (skip-path error handling). Backend compiles and tests pass again.

@zoetaka38
zoetaka38 merged commit 0dfc548 into main Jul 7, 2026
20 checks passed
@zoetaka38
zoetaka38 deleted the feat/ci-uses-checkout branch July 7, 2026 03:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zoetaka38