monitor: tokenless runner select route

Author: delan

monitor/src/github.rs

@@ -30,6 +30,17 @@ pub struct ApiRunnerLabel {
     pub name: String,
 }
 
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ApiWorkflowRunArtifactsResponse {
+    pub artifacts: Vec<ApiArtifact>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ApiArtifact {
+    pub name: String,
+    pub archive_download_url: String,
+}
+
 impl ApiRunner {
     pub fn labels(&self) -> impl Iterator<Item = &str> {
         self.labels.iter().map(|label| label.name.as_str())
@@ -130,3 +141,19 @@ pub fn unregister_runner(id: usize) -> eyre::Result<()> {
 
     Ok(())
 }
+
+pub fn list_workflow_run_artifacts(
+    qualified_repo: &str,
+    run_id: &str,
+) -> eyre::Result<Vec<ApiArtifact>> {
+    // FIXME: breaks if we have more than 100 artifacts
+    let result = run_fun!(gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28"
+        "/repos/$qualified_repo/actions/runs/$run_id/artifacts?per_page=100")?;
+    let result: ApiWorkflowRunArtifactsResponse =
+        serde_json::from_str(&result).wrap_err("Failed to parse JSON")?;
+    Ok(result.artifacts)
+}
+
+pub fn download_artifact_string(url: &str) -> eyre::Result<String> {
+    Ok(run_fun!(gh api -- $url | funzip)?)
+}

monitor/src/main.rs

@@ -23,7 +23,7 @@ use std::{
 use askama::Template;
 use askama_web::WebTemplate;
 use crossbeam_channel::{Receiver, Sender};
-use jane_eyre::eyre::{self, eyre, Context, OptionExt};
+use jane_eyre::eyre::{self, bail, eyre, Context, OptionExt};
 use mktemp::Temp;
 use rocket::{
     delete,
@@ -47,7 +47,10 @@ use web::{
 use crate::{
     dashboard::Dashboard,
     data::{get_profile_data_path, get_runner_data_path, run_migrations},
-    github::{list_registered_runners_for_host, Cache},
+    github::{
+        download_artifact_string, list_registered_runners_for_host, list_workflow_run_artifacts,
+        Cache,
+    },
     id::IdGen,
     image::{start_libvirt_guest, Rebuilds},
     libvirt::list_runner_guests,
@@ -230,6 +233,77 @@ fn take_runners_route(
     Ok(RawJson(result))
 }
 
+#[post("/select-runner?<unique_id>&<qualified_repo>&<run_id>")]
+fn select_runner_route(
+    unique_id: String,
+    qualified_repo: String,
+    run_id: String,
+) -> rocket_eyre::Result<RawJson<String>> {
+    let artifacts = list_workflow_run_artifacts(&qualified_repo, &run_id)?;
+    let done_artifact = format!("servo-ci-runners_{unique_id}_done");
+    if artifacts
+        .iter()
+        .find(|artifact| artifact.name == done_artifact)
+        .is_some()
+    {
+        Err(EyreReport::InternalServerError(eyre!(
+            "Job has artifact marking it as done: {done_artifact}"
+        )))?;
+    }
+    let args_artifact = format!("servo-ci-runners_{unique_id}");
+    let Some(args_artifact) = artifacts
+        .into_iter()
+        .find(|artifact| artifact.name == args_artifact)
+    else {
+        Err(EyreReport::InternalServerError(eyre!(
+            "No args artifact found: {args_artifact}"
+        )))?
+    };
+    let args_artifact = download_artifact_string(&args_artifact.archive_download_url)?;
+    let mut args = args_artifact
+        .lines()
+        .flat_map(|line| line.split_once("="))
+        .collect::<BTreeMap<&str, &str>>();
+    if args.remove("unique_id") != Some(&*unique_id) {
+        Err(EyreReport::InternalServerError(eyre!(
+            "Wrong unique_id in artifact"
+        )))?;
+    }
+    if args.remove("qualified_repo") != Some(&*qualified_repo) {
+        Err(EyreReport::InternalServerError(eyre!(
+            "Wrong qualified_repo in artifact"
+        )))?;
+    }
+    if args.remove("run_id") != Some(&*run_id) {
+        Err(EyreReport::InternalServerError(eyre!(
+            "Wrong run_id in artifact"
+        )))?;
+    }
+    let Some(profile_key) = args.remove("self_hosted_image_name") else {
+        Err(EyreReport::InternalServerError(eyre!(
+            "Wrong run_id in artifact"
+        )))?
+    };
+
+    let (response_tx, response_rx) = crossbeam_channel::bounded(0);
+    REQUEST.sender.send_timeout(
+        Request::TakeRunners {
+            response_tx,
+            profile_key: profile_key.to_owned(),
+            query: TakeRunnerQuery {
+                unique_id,
+                qualified_repo,
+                run_id,
+            },
+            count: 1,
+        },
+        DOTENV.monitor_thread_send_timeout,
+    )?;
+    let result = response_rx.recv_timeout(DOTENV.monitor_thread_recv_timeout)?;
+
+    Ok(RawJson(result))
+}
+
 #[get("/policy/override")]
 fn get_override_policy_route() -> rocket_eyre::Result<Json<Option<Override>>> {
     let (response_tx, response_rx) = crossbeam_channel::bounded(0);
@@ -388,6 +462,7 @@ async fn main() -> eyre::Result<()> {
                 dashboard_json_route,
                 take_runner_route,
                 take_runners_route,
+                select_runner_route,
                 get_override_policy_route,
                 override_policy_route,
                 delete_override_policy_route,

server/nixos/monitor.nix

@@ -16,6 +16,7 @@
   libvirt,
   openssh,
   time,
+  unzip,
   virt-manager,
   zfs,
   zsh,
@@ -55,10 +56,10 @@ in stdenv.mkDerivation rec {
     libvirt  # for virsh(1)
     openssh  # for ssh(1)
     time  # for time(1)
+    unzip  # for funzip(1)
     virt-manager  # for virt-clone(1)
     zfs
     zsh
-    # TODO: list other commands needed by scripts here
   ];
 
   # Some of the scripts run in the guest, like {macos13,ubuntu2204}/init.sh.