init

2026-08-26 09:56:43 +08:00
parent 2b4974b561
commit 8e02a316fa
93 changed files with 21749 additions and 0 deletions
@@ -0,0 +1,395 @@
+package runtime
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"browser.local/run/protocol"
+)
+
+func TestWorkerDistributionBuildCompilesAndUploadsRawRunExecutable(t *testing.T) {
+	client := newFakeWorkerClient()
+	cfg := workerTestConfig(t)
+	cfg.BuildSourceRoot = ".."
+	worker, err := NewWorker(cfg, client)
+	if err != nil {
+		t.Fatalf("new worker: %v", err)
+	}
+	worker.state.SessionToken = "session-token"
+
+	output := "run"
+	if runtime.GOOS == "windows" {
+		output = "run.exe"
+	}
+	assignment := protocol.RunJobAssignment{
+		JobID:            "job-distribution-build-test",
+		ServerInstanceID: "server-build-test",
+		RunEndpointID:    "run-test",
+		Capability:       protocol.RunCapabilityDistributionBuild,
+		TargetKey:        "distribution/run",
+		InputRef:         "input://distribution-build/run-test",
+		IdempotencyKey:   "distribution-build:test",
+		State:            "running",
+		LeaseToken:       "lease-test",
+		Attempt:          1,
+	}
+	client.claimJob = assignment
+	client.buildInput = protocol.DistributionBuildInputResponse{
+		JobID:            assignment.JobID,
+		ComponentKind:    "run",
+		ServerInstanceID: assignment.ServerInstanceID,
+		PluginID:         "game.scum",
+		RunEndpointID:    assignment.RunEndpointID,
+		TargetOS:         runtime.GOOS,
+		TargetArch:       runtime.GOARCH,
+		TargetRelease:    "run-release-test",
+		PlatformURL:      "https://scum.npc0.com",
+		PackageFormat:    "raw-executable",
+		ArtifactID:       "artifact-built-run",
+		OutputFilename:   output,
+		SecretRef:        "secret://runtime-keys/server-build-test/run/current",
+		KeyGeneration:    1,
+		AuthKey:          "test-component-key",
+	}
+
+	result := worker.executeDistributionBuild(context.Background(), assignment)
+	if result.State != lifecycleResultStateSucceeded || result.ResultRef != "artifact://artifact-built-run" {
+		t.Fatalf("expected successful real build, got %+v", result)
+	}
+	if len(client.artifactPayload) < 1024 {
+		t.Fatalf("expected compiled executable payload, got %d bytes", len(client.artifactPayload))
+	}
+	extracted := t.TempDir()
+	binaryPath := filepath.Join(extracted, output)
+	if err := os.WriteFile(binaryPath, client.artifactPayload, 0o700); err != nil {
+		t.Fatalf("write uploaded run executable: %v", err)
+	}
+	command := exec.Command(binaryPath)
+	command.Env = append(os.Environ(), "RUN_MODE=smoke")
+	smokeOutput, err := command.CombinedOutput()
+	if err != nil {
+		t.Fatalf("execute generated run package smoke mode: %v output=%s", err, smokeOutput)
+	}
+	var summary map[string]any
+	if err := json.Unmarshal(smokeOutput, &summary); err != nil {
+		t.Fatalf("decode generated package smoke output: %v body=%s", err, smokeOutput)
+	}
+	if summary["status"] != "ok" || summary["mode"] != "smoke" {
+		t.Fatalf("expected generated package to run smoke mode, got %+v", summary)
+	}
+	if summary["platformUrl"] != "https://scum.npc0.com" {
+		t.Fatalf("expected generated executable to use compiled platform URL, got %+v", summary)
+	}
+	joinedProgress := make([]string, 0, len(client.progressRequests))
+	for _, request := range client.progressRequests {
+		joinedProgress = append(joinedProgress, request.Progress.Message)
+	}
+	progress := strings.Join(joinedProgress, "\n")
+	for _, stage := range []string{"git_sync:", "env_check:", "deps_download:", "build_compile:", "package_finalize:"} {
+		if !strings.Contains(progress, stage) {
+			t.Fatalf("expected real progress stage %q in %q", stage, progress)
+		}
+	}
+}
+
+func TestWorkerDistributionBuildCrossCompilesWindowsAMD64Run(t *testing.T) {
+	client := newFakeWorkerClient()
+	cfg := workerTestConfig(t)
+	cfg.BuildSourceRoot = ".."
+	worker, err := NewWorker(cfg, client)
+	if err != nil {
+		t.Fatalf("new worker: %v", err)
+	}
+	worker.state.SessionToken = "session-token"
+	assignment := protocol.RunJobAssignment{JobID: "job-distribution-build-windows", ServerInstanceID: "server-build-windows", RunEndpointID: "run-builder", Capability: protocol.RunCapabilityDistributionBuild, TargetKey: "distribution/run", InputRef: "input://distribution-build/windows", IdempotencyKey: "distribution-build:windows", State: "running", LeaseToken: "lease-windows", Attempt: 1}
+	client.claimJob = assignment
+	client.buildInput = protocol.DistributionBuildInputResponse{JobID: assignment.JobID, ComponentKind: "run", ServerInstanceID: assignment.ServerInstanceID, PluginID: "game.scum", RunEndpointID: "server-run-server-build-windows", TargetOS: "windows", TargetArch: "amd64", TargetRelease: "run-release-windows", PlatformURL: "https://scum.npc0.com", PackageFormat: "raw-executable", ArtifactID: "artifact-built-windows-run", OutputFilename: "run.exe", SecretRef: "secret://runtime-keys/server-build-windows/run/current", KeyGeneration: 1, AuthKey: "test-component-key"}
+
+	result := worker.executeDistributionBuild(context.Background(), assignment)
+	if result.State != lifecycleResultStateSucceeded || result.ResultRef != "artifact://artifact-built-windows-run" {
+		t.Fatalf("expected successful Windows build, got %+v", result)
+	}
+	if len(client.artifactPayload) < 1024 || !bytes.HasPrefix(client.artifactPayload, []byte("MZ")) {
+		t.Fatalf("expected Windows PE executable payload, got %d bytes", len(client.artifactPayload))
+	}
+}
+
+func TestDistributionBuildIsolationUsesPluginJobWorkspaceAndDistinctPackageState(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	firstAssignment := protocol.RunJobAssignment{JobID: "job-distribution-build-scum-alpha", ServerInstanceID: "scum-alpha", RunEndpointID: "run-test"}
+	secondAssignment := protocol.RunJobAssignment{JobID: "job-distribution-build-scum-beta", ServerInstanceID: "scum-beta", RunEndpointID: "run-test"}
+	firstInput := protocol.DistributionBuildInputResponse{
+		JobID:            firstAssignment.JobID,
+		ComponentKind:    "run",
+		ServerInstanceID: firstAssignment.ServerInstanceID,
+		PluginID:         "game.scum",
+		RunEndpointID:    firstAssignment.RunEndpointID,
+		TargetOS:         "linux",
+		TargetArch:       "amd64",
+		PlatformURL:      "https://scum.npc0.com",
+		PackageFormat:    "raw-executable",
+		ArtifactID:       "artifact-run-dist-scum-alpha",
+		OutputFilename:   "run",
+		SecretRef:        "secret://runtime-keys/scum-alpha/run/current",
+		KeyGeneration:    1,
+		AuthKey:          "alpha-component-key",
+	}
+	secondInput := firstInput
+	secondInput.JobID = secondAssignment.JobID
+	secondInput.ServerInstanceID = secondAssignment.ServerInstanceID
+	secondInput.ArtifactID = "artifact-run-dist-scum-beta"
+	secondInput.SecretRef = "secret://runtime-keys/scum-beta/run/current"
+	secondInput.AuthKey = "beta-component-key"
+
+	firstWorkspace := distributionBuildWorkspace(workspaceRoot, firstInput.PluginID, firstAssignment.JobID)
+	secondWorkspace := distributionBuildWorkspace(workspaceRoot, secondInput.PluginID, secondAssignment.JobID)
+	if firstWorkspace == secondWorkspace {
+		t.Fatalf("expected same-plugin builds to use distinct job workspaces")
+	}
+	if filepath.Dir(firstWorkspace) != filepath.Dir(secondWorkspace) || filepath.Base(filepath.Dir(firstWorkspace)) != "game-scum" {
+		t.Fatalf("expected workspaces under the same plugin queue directory, first=%s second=%s", firstWorkspace, secondWorkspace)
+	}
+	firstFlags := buildRunLDFlags(firstInput, "https://scum.npc0.com")
+	secondFlags := buildRunLDFlags(secondInput, "https://scum.npc0.com")
+	if !strings.Contains(firstFlags, "BuildServerInstanceID=scum-alpha") || !strings.Contains(firstFlags, "BuildRegistrationToken=alpha-component-key") {
+		t.Fatalf("expected first build flags to carry first server identity, got %q", firstFlags)
+	}
+	if !strings.Contains(secondFlags, "BuildServerInstanceID=scum-beta") || !strings.Contains(secondFlags, "BuildRegistrationToken=beta-component-key") {
+		t.Fatalf("expected second build flags to carry second server identity, got %q", secondFlags)
+	}
+	if firstFlags == secondFlags {
+		t.Fatalf("expected same-plugin run builds to stay per-server")
+	}
+
+	client := newFakeWorkerClient()
+	worker := &Worker{cfg: workerTestConfig(t), client: client}
+	worker.state.RunEndpointID = "run-test"
+	worker.state.SessionToken = "session-token"
+	client.buildInput = firstInput
+	if err := worker.uploadDistributionArtifact(context.Background(), firstAssignment, firstInput.ArtifactID, []byte("alpha archive")); err != nil {
+		t.Fatalf("upload first artifact: %v", err)
+	}
+	client.artifactPayload = nil
+	client.buildInput = secondInput
+	if err := worker.uploadDistributionArtifact(context.Background(), secondAssignment, secondInput.ArtifactID, []byte("beta archive")); err != nil {
+		t.Fatalf("upload second artifact: %v", err)
+	}
+	if len(client.artifactOpenRequests) != 2 {
+		t.Fatalf("expected two artifact transfer opens, got %+v", client.artifactOpenRequests)
+	}
+	if client.artifactOpenRequests[0].ArtifactID != firstInput.ArtifactID || client.artifactOpenRequests[0].OwnerID != firstAssignment.JobID {
+		t.Fatalf("first artifact upload used wrong scope: %+v", client.artifactOpenRequests[0])
+	}
+	if client.artifactOpenRequests[1].ArtifactID != secondInput.ArtifactID || client.artifactOpenRequests[1].OwnerID != secondAssignment.JobID {
+		t.Fatalf("second artifact upload used wrong scope: %+v", client.artifactOpenRequests[1])
+	}
+}
+
+func TestCreateDistributionArchiveIncludesExecutableAndConfigForSupportedFormats(t *testing.T) {
+	for _, format := range []string{"tar.gz", "zip"} {
+		t.Run(format, func(t *testing.T) {
+			root := t.TempDir()
+			executableName := "run"
+			if format == "zip" {
+				executableName = "run.exe"
+			}
+			binaryPath := filepath.Join(root, executableName)
+			configPath := filepath.Join(root, "config.json")
+			if err := os.WriteFile(binaryPath, []byte("binary"), 0o700); err != nil {
+				t.Fatalf("write binary: %v", err)
+			}
+			if err := os.WriteFile(configPath, []byte(`{"kind":"run"}`), 0o600); err != nil {
+				t.Fatalf("write config: %v", err)
+			}
+			archivePath := filepath.Join(root, "package."+strings.ReplaceAll(format, ".", ""))
+			if err := createDistributionArchive(archivePath, format, binaryPath, configPath); err != nil {
+				t.Fatalf("create archive: %v", err)
+			}
+			payload, err := os.ReadFile(archivePath)
+			if err != nil {
+				t.Fatalf("read archive: %v", err)
+			}
+			entries := archiveEntries(t, format, payload)
+			if !entries[executableName] || !entries["config.json"] {
+				t.Fatalf("expected executable and config in %s archive, got %+v", format, entries)
+			}
+		})
+	}
+}
+
+func TestPrepareDistributionSourceCopiesTrustedRunSourceIntoWorkspace(t *testing.T) {
+	sourceRoot := t.TempDir()
+	if err := os.WriteFile(filepath.Join(sourceRoot, "go.mod"), []byte("module example.test/trusted\n\ngo 1.24\n"), 0o600); err != nil {
+		t.Fatalf("write go.mod: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(sourceRoot, "main.go"), []byte("package main\nfunc main() {}\n"), 0o600); err != nil {
+		t.Fatalf("write main.go: %v", err)
+	}
+	workspace := t.TempDir()
+	worker := &Worker{cfg: workerTestConfig(t)}
+	worker.cfg.BuildSourceRoot = sourceRoot
+	seed := base64.StdEncoding.EncodeToString([]byte(`[{"path":"actions/install.json","content":"{}"}]`))
+
+	prepared, err := worker.prepareDistributionSource(context.Background(), workspace, protocol.DistributionBuildInputResponse{ComponentKind: "run", WorkspaceSeed: seed})
+	if err != nil {
+		t.Fatalf("prepare trusted run source: %v", err)
+	}
+	if prepared != filepath.Join(workspace, "source") {
+		t.Fatalf("expected isolated source under workspace, got %s", prepared)
+	}
+	if _, err := os.Stat(filepath.Join(prepared, "main.go")); err != nil {
+		t.Fatalf("expected copied source file: %v", err)
+	}
+	seedConfig, err := os.ReadFile(filepath.Join(prepared, "config", "workspace_seed_generated.go"))
+	if err != nil || !strings.Contains(string(seedConfig), seed) {
+		t.Fatalf("expected generated workspace seed config, body=%q err=%v", seedConfig, err)
+	}
+	if err := os.WriteFile(filepath.Join(prepared, "main.go"), []byte("package main\n// isolated mutation\nfunc main() {}\n"), 0o600); err != nil {
+		t.Fatalf("mutate isolated copy: %v", err)
+	}
+	original, err := os.ReadFile(filepath.Join(sourceRoot, "main.go"))
+	if err != nil || strings.Contains(string(original), "isolated mutation") {
+		t.Fatalf("trusted source was mutated, body=%q err=%v", original, err)
+	}
+}
+
+func TestValidateDistributionBuildInputRejectsUnapprovedClientSource(t *testing.T) {
+	assignment := protocol.RunJobAssignment{JobID: "job-build", ServerInstanceID: "server-build", RunEndpointID: "run-build"}
+	base := protocol.DistributionBuildInputResponse{
+		JobID: assignment.JobID, ComponentKind: "client-manager", ServerInstanceID: assignment.ServerInstanceID, RunEndpointID: assignment.RunEndpointID,
+		PluginID: "game.scum", TargetOS: "linux", TargetArch: "amd64", PackageFormat: "tar.gz", ArtifactID: "artifact-build", OutputFilename: "manager", AuthKey: "key", SourceRevision: "main",
+	}
+	for _, repository := range []string{"http://example.test/manager.git", "https://token@example.test/manager.git", "https://example.test/manager.git?ref=main"} {
+		input := base
+		input.RepositoryURL = repository
+		if err := validateDistributionBuildInput(assignment, input); err == nil {
+			t.Fatalf("expected repository %q to be rejected", repository)
+		}
+	}
+	base.RepositoryURL = "https://example.test/manager.git"
+	base.SourceRevision = ""
+	if err := validateDistributionBuildInput(assignment, base); err == nil {
+		t.Fatal("expected an unpinned client-manager source to be rejected")
+	}
+}
+
+func TestValidateDistributionBuildInputAllowsDedicatedRunIdentity(t *testing.T) {
+	assignment := protocol.RunJobAssignment{JobID: "job-build", ServerInstanceID: "server-build", RunEndpointID: "run-local-debug"}
+	input := protocol.DistributionBuildInputResponse{JobID: assignment.JobID, ComponentKind: "run", ServerInstanceID: assignment.ServerInstanceID, RunEndpointID: "server-run-server-build", PluginID: "game.scum", TargetOS: "windows", TargetArch: "amd64", TargetRelease: "release-1", PlatformURL: "https://scum.npc0.com", PackageFormat: "raw-executable", ArtifactID: "artifact-build", OutputFilename: "run.exe", AuthKey: "key"}
+	if err := validateDistributionBuildInput(assignment, input); err != nil {
+		t.Fatalf("dedicated Run identity must be accepted for a builder job: %v", err)
+	}
+	input.WorkspaceSeed = "not-base64"
+	if err := validateDistributionBuildInput(assignment, input); err == nil || !strings.Contains(err.Error(), "workspace seed") {
+		t.Fatalf("expected invalid run workspace seed rejection, got %v", err)
+	}
+	input.WorkspaceSeed = ""
+	input.ComponentKind = "client-manager"
+	input.PackageFormat = "zip"
+	input.RepositoryURL = "https://example.test/manager.git"
+	input.SourceRevision = "main"
+	if err := validateDistributionBuildInput(assignment, input); err == nil {
+		t.Fatal("client-manager build must remain bound to its assigned builder")
+	}
+}
+
+func archiveEntries(t *testing.T, format string, payload []byte) map[string]bool {
+	t.Helper()
+	entries := map[string]bool{}
+	if format == "zip" {
+		reader, err := zip.NewReader(bytes.NewReader(payload), int64(len(payload)))
+		if err != nil {
+			t.Fatalf("open zip: %v", err)
+		}
+		for _, file := range reader.File {
+			entries[file.Name] = true
+		}
+		return entries
+	}
+	gzipReader, err := gzip.NewReader(bytes.NewReader(payload))
+	if err != nil {
+		t.Fatalf("open gzip: %v", err)
+	}
+	defer gzipReader.Close()
+	reader := tar.NewReader(gzipReader)
+	for {
+		header, err := reader.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatalf("read tar: %v", err)
+		}
+		entries[header.Name] = true
+	}
+	return entries
+}
+
+func extractArchive(t *testing.T, format string, payload []byte, destination string) {
+	t.Helper()
+	if format == "zip" {
+		reader, err := zip.NewReader(bytes.NewReader(payload), int64(len(payload)))
+		if err != nil {
+			t.Fatalf("open zip: %v", err)
+		}
+		for _, file := range reader.File {
+			input, err := file.Open()
+			if err != nil {
+				t.Fatalf("open zip entry: %v", err)
+			}
+			body, err := io.ReadAll(input)
+			closeErr := input.Close()
+			if err != nil || closeErr != nil {
+				t.Fatalf("read zip entry: err=%v close=%v", err, closeErr)
+			}
+			mode := os.FileMode(0o600)
+			if file.Name == "run" || strings.HasSuffix(file.Name, ".exe") {
+				mode = 0o700
+			}
+			if err := os.WriteFile(filepath.Join(destination, file.Name), body, mode); err != nil {
+				t.Fatalf("write zip entry: %v", err)
+			}
+		}
+		return
+	}
+	gzipReader, err := gzip.NewReader(bytes.NewReader(payload))
+	if err != nil {
+		t.Fatalf("open gzip: %v", err)
+	}
+	defer gzipReader.Close()
+	reader := tar.NewReader(gzipReader)
+	for {
+		header, err := reader.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatalf("read tar: %v", err)
+		}
+		mode := os.FileMode(header.Mode)
+		if err := os.WriteFile(filepath.Join(destination, header.Name), mustReadAll(t, reader), mode); err != nil {
+			t.Fatalf("write tar entry: %v", err)
+		}
+	}
+}
+
+func mustReadAll(t *testing.T, reader io.Reader) []byte {
+	t.Helper()
+	body, err := io.ReadAll(reader)
+	if err != nil {
+		t.Fatalf("read archive entry: %v", err)
+	}
+	return body
+}