diff --git a/internal/controller/project_controller.go b/internal/controller/project_controller.go
index 736ae29..c75526c 100644
--- a/internal/controller/project_controller.go
+++ b/internal/controller/project_controller.go
@@ -3,10 +3,12 @@ package controller
import (
"context"
"fmt"
+ "strings"
"time"
actionsv1alpha1 "github.com/kelos-dev/open-actions/api/v1alpha1"
githubclient "github.com/kelos-dev/open-actions/internal/github"
+ corev1 "k8s.io/api/core/v1"
apiEquality "k8s.io/apimachinery/pkg/api/equality"
"k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -64,13 +66,28 @@ func (r *ProjectReconciler) validate(ctx context.Context, project *actionsv1alph
github := project.Spec.Source.GitHub
privateKey, err := secretValue(ctx, r.APIReader, project.Namespace, github.PrivateKeySecretRef)
if err != nil {
- return "CredentialsUnavailable", err
+ return "CredentialsUnavailable", fmt.Errorf("validate Project %q credentials: %w", project.Name, err)
}
if err := githubclient.ValidatePrivateKey(privateKey); err != nil {
- return "InvalidCredentials", fmt.Errorf("validate GitHub App private key: %w", err)
+ return "InvalidCredentials", fmt.Errorf("validate Project %q GitHub App private key: %w", project.Name, err)
}
if _, err := secretValue(ctx, r.APIReader, project.Namespace, github.WebhookSecretRef); err != nil {
- return "CredentialsUnavailable", err
+ return "CredentialsUnavailable", fmt.Errorf("validate Project %q credentials: %w", project.Name, err)
+ }
+ environments := make(map[string]string, len(project.Spec.Environments))
+ for index := range project.Spec.Environments {
+ environment := &project.Spec.Environments[index]
+ canonicalName := strings.ToLower(environment.Name)
+ if other := environments[canonicalName]; other != "" {
+ return "EnvironmentInvalid", fmt.Errorf("Project %q contains case-insensitive duplicate environments %q and %q", project.Name, other, environment.Name)
+ }
+ environments[canonicalName] = environment.Name
+ if environment.SecretRef != nil && environment.SecretRef.Name == "" {
+ return "EnvironmentInvalid", fmt.Errorf("Project %q environment %q has an empty secretRef name", project.Name, environment.Name)
+ }
+ if _, err := environmentSecretValues(ctx, r.APIReader, project.Namespace, environment.SecretRef); err != nil {
+ return "EnvironmentSecretsUnavailable", fmt.Errorf("validate Project %q environment %q: %w", project.Name, environment.Name, err)
+ }
}
return "", nil
}
@@ -110,9 +127,31 @@ func (r *ProjectReconciler) SetupWithManager(manager ctrl.Manager) error {
return ctrl.NewControllerManagedBy(manager).
For(&actionsv1alpha1.Project{}).
Watches(&actionsv1alpha1.Project{}, handler.EnqueueRequestsFromMapFunc(r.projectsForInstallation)).
+ Watches(&corev1.Secret{}, handler.EnqueueRequestsFromMapFunc(r.projectsForSecret)).
Complete(r)
}
+func (r *ProjectReconciler) projectsForSecret(ctx context.Context, object client.Object) []reconcile.Request {
+ projects := &actionsv1alpha1.ProjectList{}
+ if err := r.List(ctx, projects, client.InNamespace(object.GetNamespace())); err != nil {
+ return nil
+ }
+ requests := []reconcile.Request{}
+ for index := range projects.Items {
+ project := &projects.Items[index]
+ github := project.Spec.Source.GitHub
+ matched := github != nil && (github.PrivateKeySecretRef.Name == object.GetName() || github.WebhookSecretRef.Name == object.GetName())
+ for environmentIndex := range project.Spec.Environments {
+ reference := project.Spec.Environments[environmentIndex].SecretRef
+ matched = matched || reference != nil && reference.Name == object.GetName()
+ }
+ if matched {
+ requests = append(requests, requestFor(project))
+ }
+ }
+ return requests
+}
+
func (r *ProjectReconciler) projectsForInstallation(ctx context.Context, object client.Object) []reconcile.Request {
project, ok := object.(*actionsv1alpha1.Project)
if !ok || project.Spec.Source.GitHub == nil {
diff --git a/internal/controller/project_controller_test.go b/internal/controller/project_controller_test.go
index c8c53e0..71ebcb9 100644
--- a/internal/controller/project_controller_test.go
+++ b/internal/controller/project_controller_test.go
@@ -6,6 +6,7 @@ import (
"crypto/rsa"
"crypto/x509"
"encoding/pem"
+ "strings"
"testing"
"time"
@@ -40,7 +41,7 @@ func TestProjectConfiguredConditionDescribesLocalValidation(t *testing.T) {
PrivateKeySecretRef: corev1.SecretKeySelector{LocalObjectReference: corev1.LocalObjectReference{Name: "github"}, Key: "private-key"},
WebhookSecretRef: corev1.SecretKeySelector{LocalObjectReference: corev1.LocalObjectReference{Name: "github"}, Key: "webhook-secret"},
},
- }},
+ }, Environments: []actionsv1alpha1.ProjectEnvironment{{Name: "production", SecretRef: &actionsv1alpha1.EnvironmentSecretReference{Name: "production-secrets"}}}},
}
secret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "github", Namespace: "default"},
@@ -49,7 +50,8 @@ func TestProjectConfiguredConditionDescribesLocalValidation(t *testing.T) {
"webhook-secret": []byte("secret"),
},
}
- clusterClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&actionsv1alpha1.Project{}).WithObjects(project, secret).Build()
+ environmentSecret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "production-secrets", Namespace: "default"}, Data: map[string][]byte{"DEPLOY_TOKEN": []byte("secret")}}
+ clusterClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&actionsv1alpha1.Project{}).WithObjects(project, secret, environmentSecret).Build()
reconciler := &ProjectReconciler{Client: clusterClient, APIReader: clusterClient}
if _, err := reconciler.Reconcile(context.Background(), ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "default", Name: "default"}}); err != nil {
t.Fatal(err)
@@ -64,6 +66,19 @@ func TestProjectConfiguredConditionDescribesLocalValidation(t *testing.T) {
}
}
+func TestProjectRejectsInvalidEnvironmentSecrets(t *testing.T) {
+ scheme := runtime.NewScheme()
+ if err := corev1.AddToScheme(scheme); err != nil {
+ t.Fatal(err)
+ }
+ secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "environment", Namespace: "default"}, Data: map[string][]byte{"GITHUB_TOKEN": []byte("override")}}
+ clusterClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
+ _, err := environmentSecretValues(context.Background(), clusterClient, "default", &actionsv1alpha1.EnvironmentSecretReference{Name: secret.Name})
+ if err == nil || !strings.Contains(err.Error(), `invalid GitHub secret name "GITHUB_TOKEN"`) {
+ t.Fatalf("environmentSecretValues() error = %v", err)
+ }
+}
+
func TestEarlierProjectOwnsInstallationAcrossNamespaces(t *testing.T) {
scheme := runtime.NewScheme()
if err := actionsv1alpha1.AddToScheme(scheme); err != nil {
diff --git a/internal/controller/runner_controller.go b/internal/controller/runner_controller.go
index 57fe92d..c8bb715 100644
--- a/internal/controller/runner_controller.go
+++ b/internal/controller/runner_controller.go
@@ -4,6 +4,7 @@ import (
"context"
"crypto/sha256"
"encoding/binary"
+ "encoding/json"
"errors"
"fmt"
"sort"
@@ -33,10 +34,13 @@ var (
const (
jobPlanVolume = "open-actions-job"
+ jobCredentialsVolume = "open-actions-credentials"
workspaceVolume = "open-actions-workspace"
dockerSocketVolume = "open-actions-docker-socket"
dockerStorageVolume = "open-actions-docker-storage"
jobPlanMountPath = "/var/run/open-actions"
+ jobCredentialsMountPath = "/var/run/open-actions-credentials"
+ jobSecretsKey = "secrets.json"
workspaceVolumeMountPath = "/workspace"
jobResultPath = "/dev/termination-log"
dockerSocketDirectory = "/var/run/open-actions-docker"
@@ -391,6 +395,9 @@ func (r *RunnerReconciler) executeWorkflowJob(ctx context.Context, runnerObject
if workflowJob.Labels[actionsv1alpha1.LabelProjectUID] != string(project.UID) {
return true, r.failAssignedWorkflowJob(ctx, workflowJob, "ProjectRecreated", fmt.Sprintf("Project %q was recreated before execution started", project.Name))
}
+ if !workflowJobEnvironmentApproved(workflowJob) {
+ return false, fmt.Errorf("WorkflowJob %q environment is not approved", workflowJob.Name)
+ }
if workflowJobStarted(workflowJob) {
active, err := r.activeWorkflowJobPods(ctx, workflowJob)
if err != nil {
@@ -427,7 +434,15 @@ func (r *RunnerReconciler) executeWorkflowJob(ctx context.Context, runnerObject
} else if canceled {
return true, r.cancelWorkflowJob(ctx, workflowJob)
}
- if err := r.ensureAuthSecret(ctx, workflowJob, installation.Token()); err != nil {
+ var secretsReference *actionsv1alpha1.EnvironmentSecretReference
+ if workflowJob.Spec.Environment != nil {
+ secretsReference = workflowJob.Spec.Environment.SecretRef
+ }
+ environmentSecrets, err := environmentSecretValues(ctx, r.APIReader, project.Namespace, secretsReference)
+ if err != nil {
+ return false, fmt.Errorf("read environment secrets for WorkflowJob %q: %w", workflowJob.Name, err)
+ }
+ if err := r.ensureAuthSecret(ctx, workflowJob, installation.Token(), environmentSecrets); err != nil {
return false, err
}
nativeJob, err := r.buildJob(workflowJob, run, project, runnerObject)
@@ -615,7 +630,11 @@ func (r *RunnerReconciler) cleanupAuthSecret(ctx context.Context, workflowJob *a
return nil
}
-func (r *RunnerReconciler) ensureAuthSecret(ctx context.Context, workflowJob *actionsv1alpha1.WorkflowJob, token string) error {
+func (r *RunnerReconciler) ensureAuthSecret(ctx context.Context, workflowJob *actionsv1alpha1.WorkflowJob, token string, environmentSecrets map[string]string) error {
+ secretsData, err := json.Marshal(environmentSecrets)
+ if err != nil {
+ return fmt.Errorf("encode environment secrets for WorkflowJob %q: %w", workflowJob.Name, err)
+ }
secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{
Name: childName(workflowJob.Name, "auth"),
Namespace: workflowJob.Namespace,
@@ -623,7 +642,7 @@ func (r *RunnerReconciler) ensureAuthSecret(ctx context.Context, workflowJob *ac
actionsv1alpha1.LabelWorkflowRunUID: workflowJob.Labels[actionsv1alpha1.LabelWorkflowRunUID],
actionsv1alpha1.LabelWorkflowJobUID: string(workflowJob.UID),
},
- }, Data: map[string][]byte{"token": []byte(token)}}
+ }, Data: map[string][]byte{"token": []byte(token), jobSecretsKey: secretsData}}
if err := controllerutil.SetControllerReference(workflowJob, secret, r.Scheme()); err != nil {
return err
}
@@ -651,6 +670,7 @@ func (r *RunnerReconciler) ensureAuthSecret(ctx context.Context, workflowJob *ac
existing.Data = map[string][]byte{}
}
existing.Data["token"] = []byte(token)
+ existing.Data[jobSecretsKey] = secretsData
if apiEquality.Semantic.DeepEqual(before, existing) {
return nil
}
@@ -703,11 +723,13 @@ func (r *RunnerReconciler) buildJob(workflowJob *actionsv1alpha1.WorkflowJob, ru
}},
VolumeMounts: []corev1.VolumeMount{
{Name: jobPlanVolume, MountPath: jobPlanMountPath, ReadOnly: true},
+ {Name: jobCredentialsVolume, MountPath: jobCredentialsMountPath, ReadOnly: true},
{Name: workspaceVolume, MountPath: workspaceVolumeMountPath},
},
}},
Volumes: []corev1.Volume{
{Name: jobPlanVolume, VolumeSource: corev1.VolumeSource{ConfigMap: &corev1.ConfigMapVolumeSource{LocalObjectReference: corev1.LocalObjectReference{Name: childName(workflowJob.Name, "plan")}}}},
+ {Name: jobCredentialsVolume, VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: childName(workflowJob.Name, "auth")}}},
{Name: workspaceVolume, VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}},
},
},
@@ -997,12 +1019,19 @@ func (r *RunnerReconciler) runnersForWorkflowRun(ctx context.Context, object cli
func indexQueuedWorkflowJob(object client.Object) []string {
workflowJob := object.(*actionsv1alpha1.WorkflowJob)
- if workflowJob.DeletionTimestamp.IsZero() && workflowJob.Status.RunnerRef == nil && !terminalWorkflowJob(workflowJob) {
+ if workflowJob.DeletionTimestamp.IsZero() && workflowJob.Status.RunnerRef == nil && !terminalWorkflowJob(workflowJob) && workflowJobEnvironmentApproved(workflowJob) {
return []string{"true"}
}
return nil
}
+func workflowJobEnvironmentApproved(workflowJob *actionsv1alpha1.WorkflowJob) bool {
+ if workflowJob.Spec.Environment == nil {
+ return true
+ }
+ return meta.IsStatusConditionTrue(workflowJob.Status.Conditions, actionsv1alpha1.WorkflowJobConditionEnvironmentApproved)
+}
+
func indexWorkflowJobRunnerName(object client.Object) []string {
workflowJob := object.(*actionsv1alpha1.WorkflowJob)
if workflowJob.Status.RunnerRef == nil {
diff --git a/internal/controller/runner_controller_test.go b/internal/controller/runner_controller_test.go
index c75088c..afe08ec 100644
--- a/internal/controller/runner_controller_test.go
+++ b/internal/controller/runner_controller_test.go
@@ -2,6 +2,7 @@ package controller
import (
"context"
+ "encoding/json"
"errors"
"fmt"
"slices"
@@ -115,7 +116,7 @@ func TestRunnerBuildsOwnedJob(t *testing.T) {
container.SecurityContext.Capabilities == nil || !slices.Equal(container.SecurityContext.Capabilities.Drop, []corev1.Capability{"ALL"}) {
t.Errorf("container security context = %#v", container.SecurityContext)
}
- if len(job.Spec.Template.Spec.Volumes) != 2 {
+ if len(job.Spec.Template.Spec.Volumes) != 3 {
t.Errorf("volumes = %#v", job.Spec.Template.Spec.Volumes)
}
}
@@ -178,6 +179,7 @@ func TestRunnerBuildsDockerEnabledJob(t *testing.T) {
}
expectedRunnerMounts := []corev1.VolumeMount{
{Name: jobPlanVolume, MountPath: jobPlanMountPath, ReadOnly: true},
+ {Name: jobCredentialsVolume, MountPath: jobCredentialsMountPath, ReadOnly: true},
{Name: workspaceVolume, MountPath: workspaceVolumeMountPath},
{Name: dockerSocketVolume, MountPath: dockerSocketDirectory},
}
@@ -518,6 +520,26 @@ func TestDeletingWorkflowJobIsNotQueued(t *testing.T) {
}
}
+func TestEnvironmentApprovalControlsWorkflowJobQueue(t *testing.T) {
+ workflowJob := &actionsv1alpha1.WorkflowJob{Spec: actionsv1alpha1.WorkflowJobSpec{
+ Environment: &actionsv1alpha1.WorkflowJobEnvironment{
+ Name: "ok-to-test", Protection: &actionsv1alpha1.EnvironmentProtection{RequiredApproval: true},
+ },
+ }}
+ meta.SetStatusCondition(&workflowJob.Status.Conditions, metav1.Condition{
+ Type: actionsv1alpha1.WorkflowJobConditionEnvironmentApproved, Status: metav1.ConditionFalse, Reason: "ApprovalRequired",
+ })
+ if values := indexQueuedWorkflowJob(workflowJob); len(values) != 0 {
+ t.Fatalf("unapproved WorkflowJob queue index = %v", values)
+ }
+ meta.SetStatusCondition(&workflowJob.Status.Conditions, metav1.Condition{
+ Type: actionsv1alpha1.WorkflowJobConditionEnvironmentApproved, Status: metav1.ConditionTrue, Reason: "EnvironmentApproved",
+ })
+ if values := indexQueuedWorkflowJob(workflowJob); !slices.Equal(values, []string{"true"}) {
+ t.Fatalf("approved WorkflowJob queue index = %v", values)
+ }
+}
+
func TestTerminalWorkflowJobStatusIsDurableBeforeCredentialCleanup(t *testing.T) {
scheme := runnerTestScheme(t)
workflowJob := &actionsv1alpha1.WorkflowJob{
@@ -1119,7 +1141,7 @@ func TestEnsureAuthSecretRejectsUnownedCollision(t *testing.T) {
}
clusterClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(workflowJob, secret).Build()
reconciler := &RunnerReconciler{Client: clusterClient, APIReader: clusterClient}
- if err := reconciler.ensureAuthSecret(context.Background(), workflowJob, "replacement"); err == nil {
+ if err := reconciler.ensureAuthSecret(context.Background(), workflowJob, "replacement", nil); err == nil {
t.Fatal("unowned authentication Secret was accepted")
}
stored := &corev1.Secret{}
@@ -1131,6 +1153,30 @@ func TestEnsureAuthSecretRejectsUnownedCollision(t *testing.T) {
}
}
+func TestEnsureAuthSecretStoresEnvironmentSecretsSeparatelyFromToken(t *testing.T) {
+ scheme := runnerTestScheme(t)
+ workflowJob := &actionsv1alpha1.WorkflowJob{
+ TypeMeta: metav1.TypeMeta{APIVersion: actionsv1alpha1.GroupVersion.String(), Kind: "WorkflowJob"},
+ ObjectMeta: metav1.ObjectMeta{Name: "build", Namespace: "default", UID: types.UID("job-uid")},
+ }
+ clusterClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(workflowJob).Build()
+ reconciler := &RunnerReconciler{Client: clusterClient, APIReader: clusterClient}
+ if err := reconciler.ensureAuthSecret(context.Background(), workflowJob, "installation-token", map[string]string{"DEPLOY_TOKEN": "environment-token"}); err != nil {
+ t.Fatal(err)
+ }
+ stored := &corev1.Secret{}
+ if err := clusterClient.Get(context.Background(), client.ObjectKey{Namespace: "default", Name: childName(workflowJob.Name, "auth")}, stored); err != nil {
+ t.Fatal(err)
+ }
+ secrets := map[string]string{}
+ if err := json.Unmarshal(stored.Data[jobSecretsKey], &secrets); err != nil {
+ t.Fatal(err)
+ }
+ if string(stored.Data["token"]) != "installation-token" || secrets["DEPLOY_TOKEN"] != "environment-token" {
+ t.Fatalf("authentication Secret data = %#v, secrets = %#v", stored.Data, secrets)
+ }
+}
+
func TestDeletingBusyRunnerFinalizesItsWorkflowJob(t *testing.T) {
scheme := runnerTestScheme(t)
deletionTime := metav1.Now()
diff --git a/internal/controller/secrets.go b/internal/controller/secrets.go
index c6546c7..3b75233 100644
--- a/internal/controller/secrets.go
+++ b/internal/controller/secrets.go
@@ -3,11 +3,23 @@ package controller
import (
"context"
"fmt"
+ "regexp"
+ "sort"
+ "strings"
+ "unicode/utf8"
+ actionsv1alpha1 "github.com/kelos-dev/open-actions/api/v1alpha1"
corev1 "k8s.io/api/core/v1"
"sigs.k8s.io/controller-runtime/pkg/client"
)
+const (
+ maxEnvironmentSecrets = 100
+ maxEnvironmentSecretBytes = 8 << 10
+)
+
+var environmentSecretNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+
func secretValue(ctx context.Context, reader client.Reader, namespace string, selector corev1.SecretKeySelector) ([]byte, error) {
secret := &corev1.Secret{}
if err := reader.Get(ctx, client.ObjectKey{Namespace: namespace, Name: selector.Name}, secret); err != nil {
@@ -19,3 +31,39 @@ func secretValue(ctx context.Context, reader client.Reader, namespace string, se
}
return value, nil
}
+
+func environmentSecretValues(ctx context.Context, reader client.Reader, namespace string, reference *actionsv1alpha1.EnvironmentSecretReference) (map[string]string, error) {
+ if reference == nil {
+ return map[string]string{}, nil
+ }
+ secret := &corev1.Secret{}
+ if err := reader.Get(ctx, client.ObjectKey{Namespace: namespace, Name: reference.Name}, secret); err != nil {
+ return nil, fmt.Errorf("get environment Secret %q: %w", reference.Name, err)
+ }
+ if len(secret.Data) > maxEnvironmentSecrets {
+ return nil, fmt.Errorf("environment Secret %q contains %d keys; maximum is %d", secret.Name, len(secret.Data), maxEnvironmentSecrets)
+ }
+ names := make([]string, 0, len(secret.Data))
+ for name := range secret.Data {
+ names = append(names, name)
+ }
+ sort.Strings(names)
+ values := make(map[string]string, len(names))
+ canonicalNames := make(map[string]string, len(names))
+ for _, name := range names {
+ value := secret.Data[name]
+ canonical := strings.ToUpper(name)
+ if !environmentSecretNamePattern.MatchString(name) || strings.HasPrefix(canonical, "GITHUB_") {
+ return nil, fmt.Errorf("environment Secret %q contains invalid GitHub secret name %q", secret.Name, name)
+ }
+ if other := canonicalNames[canonical]; other != "" {
+ return nil, fmt.Errorf("environment Secret %q contains case-insensitive duplicate keys %q and %q", secret.Name, other, name)
+ }
+ if len(value) > maxEnvironmentSecretBytes || !utf8.Valid(value) {
+ return nil, fmt.Errorf("environment Secret %q value %q must be valid UTF-8 no larger than %d bytes", secret.Name, name, maxEnvironmentSecretBytes)
+ }
+ canonicalNames[canonical] = name
+ values[name] = string(value)
+ }
+ return values, nil
+}
diff --git a/internal/controller/workflowrun_controller.go b/internal/controller/workflowrun_controller.go
index b42cb42..7a12022 100644
--- a/internal/controller/workflowrun_controller.go
+++ b/internal/controller/workflowrun_controller.go
@@ -284,7 +284,11 @@ func (r *WorkflowRunReconciler) reconcileGitHubCheck(ctx context.Context, run *a
if !r.githubCheckEnabled(run) {
return nil
}
- report := workflowRunCheckReport(run)
+ jobs := &actionsv1alpha1.WorkflowJobList{}
+ if err := r.APIReader.List(ctx, jobs, client.InNamespace(run.Namespace), client.MatchingLabels{actionsv1alpha1.LabelWorkflowRunUID: string(run.UID)}); err != nil {
+ return fmt.Errorf("list WorkflowJobs for WorkflowRun %q GitHub check: %w", run.Name, err)
+ }
+ report := workflowRunCheckReportWithJobs(run, jobs.Items)
project := &actionsv1alpha1.Project{}
projectKey := client.ObjectKey{Namespace: run.Namespace, Name: run.Spec.ProjectRef.Name}
if err := r.APIReader.Get(ctx, projectKey, project); err != nil {
@@ -376,6 +380,10 @@ func checkRunReportDigest(request githubclient.CreateCheckRunRequest) string {
}
func workflowRunCheckReport(run *actionsv1alpha1.WorkflowRun) checkRunReport {
+ return workflowRunCheckReportWithJobs(run, nil)
+}
+
+func workflowRunCheckReportWithJobs(run *actionsv1alpha1.WorkflowRun, workflowJobs []actionsv1alpha1.WorkflowJob) checkRunReport {
title := run.Status.WorkflowName
if title == "" {
title = run.Spec.WorkflowPath
@@ -422,11 +430,59 @@ func workflowRunCheckReport(run *actionsv1alpha1.WorkflowRun) checkRunReport {
}
if run.Status.Jobs != nil {
jobs := run.Status.Jobs
- report.Output.Text = fmt.Sprintf("Jobs: %d total, %d queued, %d active, %d succeeded, %d failed.", jobs.Total, jobs.Queued, jobs.Active, jobs.Succeeded, jobs.Failed)
+ report.Output.Text = fmt.Sprintf("Jobs: %d total, %d waiting for approval, %d queued, %d active, %d succeeded, %d failed.", jobs.Total, jobs.WaitingForApproval, jobs.Queued, jobs.Active, jobs.Succeeded, jobs.Failed)
+ }
+ if environmentText := checkRunEnvironmentText(workflowJobs); environmentText != "" {
+ if report.Output.Text != "" {
+ report.Output.Text += "\n\n"
+ }
+ report.Output.Text += environmentText
}
return report
}
+func checkRunEnvironmentText(workflowJobs []actionsv1alpha1.WorkflowJob) string {
+ type environmentState struct {
+ name string
+ required bool
+ waiting bool
+ }
+ states := map[string]environmentState{}
+ for index := range workflowJobs {
+ job := &workflowJobs[index]
+ if job.Spec.Environment == nil {
+ continue
+ }
+ key := strings.ToLower(job.Spec.Environment.Name)
+ state := states[key]
+ state.name = job.Spec.Environment.Name
+ state.required = state.required || job.Spec.Environment.Protection != nil && job.Spec.Environment.Protection.RequiredApproval
+ state.waiting = state.waiting || !workflowJobEnvironmentApproved(job)
+ states[key] = state
+ }
+ if len(states) == 0 {
+ return ""
+ }
+ keys := make([]string, 0, len(states))
+ for key := range states {
+ keys = append(keys, key)
+ }
+ sort.Strings(keys)
+ lines := make([]string, 0, len(keys))
+ for _, key := range keys {
+ state := states[key]
+ approval := "approval not required"
+ if state.required {
+ approval = "approved"
+ }
+ if state.waiting {
+ approval = "waiting for approval"
+ }
+ lines = append(lines, fmt.Sprintf("Environment %q: %s.", state.name, approval))
+ }
+ return strings.Join(lines, "\n")
+}
+
func (r *checkRunReport) summaryFromCondition(condition *metav1.Condition) {
if condition.Message != "" {
r.Output.Summary = condition.Message
@@ -466,6 +522,7 @@ type plannedWorkflowJob struct {
displayName string
runsOn []string
matrix *actionsv1alpha1.WorkflowJobMatrix
+ environment *workflow.JobEnvironment
plan string
resultVersion string
}
@@ -486,6 +543,10 @@ func (r *WorkflowRunReconciler) ensureWorkflowJobs(ctx context.Context, run *act
for _, item := range plannedJobs {
id := item.id
+ environment, err := workflowJobEnvironment(project, item.environment)
+ if err != nil {
+ return &terminalPlanningError{cause: fmt.Errorf("job %q: %w", id, err)}
+ }
labels := workflowJobLabels(run, project, id)
annotations := map[string]string{actionsv1alpha1.AnnotationProjectName: project.Name}
if item.resultVersion != "" {
@@ -504,6 +565,7 @@ func (r *WorkflowRunReconciler) ensureWorkflowJobs(ctx context.Context, run *act
DisplayName: item.displayName,
RunsOn: append([]string(nil), item.runsOn...),
Matrix: item.matrix.DeepCopy(),
+ Environment: environment,
},
}
if err := controllerutil.SetControllerReference(run, workflowJob, r.Scheme()); err != nil {
@@ -531,10 +593,71 @@ func (r *WorkflowRunReconciler) ensureWorkflowJobs(ctx context.Context, run *act
if err := r.ensurePlanConfigMap(ctx, workflowJob, item.plan); err != nil {
return err
}
+ if err := r.reconcileEnvironmentApproval(ctx, workflowJob); err != nil {
+ return err
+ }
}
return nil
}
+func workflowJobEnvironment(project *actionsv1alpha1.Project, requested *workflow.JobEnvironment) (*actionsv1alpha1.WorkflowJobEnvironment, error) {
+ if requested == nil {
+ return nil, nil
+ }
+ var matched *actionsv1alpha1.ProjectEnvironment
+ for index := range project.Spec.Environments {
+ configured := &project.Spec.Environments[index]
+ if !strings.EqualFold(configured.Name, requested.Name) {
+ continue
+ }
+ if matched != nil {
+ return nil, fmt.Errorf("environment %q is configured more than once on Project %q", requested.Name, project.Name)
+ }
+ matched = configured
+ }
+ if matched != nil {
+ return &actionsv1alpha1.WorkflowJobEnvironment{
+ Name: matched.Name, URL: requested.URL,
+ SecretRef: matched.SecretRef.DeepCopy(), Protection: matched.Protection.DeepCopy(),
+ }, nil
+ }
+ return nil, fmt.Errorf("environment %q is not configured on Project %q", requested.Name, project.Name)
+}
+
+func (r *WorkflowRunReconciler) reconcileEnvironmentApproval(ctx context.Context, workflowJob *actionsv1alpha1.WorkflowJob) error {
+ environment := workflowJob.Spec.Environment
+ if environment == nil {
+ return nil
+ }
+ required := environment.Protection != nil && environment.Protection.RequiredApproval
+ approved := !required || strings.EqualFold(workflowJob.Annotations[actionsv1alpha1.AnnotationEnvironmentApproved], environment.Name)
+ current := meta.FindStatusCondition(workflowJob.Status.Conditions, actionsv1alpha1.WorkflowJobConditionEnvironmentApproved)
+ if workflowJob.Status.RunnerRef != nil && current != nil && current.Status == metav1.ConditionTrue {
+ approved = true
+ }
+ status := metav1.ConditionFalse
+ reason := "ApprovalRequired"
+ message := fmt.Sprintf("Environment %q requires approval", environment.Name)
+ if approved {
+ status = metav1.ConditionTrue
+ reason = "EnvironmentApproved"
+ message = fmt.Sprintf("Environment %q was approved", environment.Name)
+ if !required {
+ reason = "ApprovalNotRequired"
+ message = fmt.Sprintf("Environment %q does not require approval", environment.Name)
+ }
+ }
+ before := workflowJob.Status.DeepCopy()
+ meta.SetStatusCondition(&workflowJob.Status.Conditions, metav1.Condition{
+ Type: actionsv1alpha1.WorkflowJobConditionEnvironmentApproved, Status: status,
+ ObservedGeneration: workflowJob.Generation, Reason: reason, Message: message,
+ })
+ if apiEquality.Semantic.DeepEqual(before, &workflowJob.Status) {
+ return nil
+ }
+ return r.Status().Update(ctx, workflowJob)
+}
+
func (r *WorkflowRunReconciler) planWorkflowJobs(run *actionsv1alpha1.WorkflowRun, definition *workflow.Definition, inputValues map[string]any) ([]plannedWorkflowJob, error) {
jobIDs := make([]string, 0, len(definition.Jobs))
for id := range definition.Jobs {
@@ -601,7 +724,8 @@ func (r *WorkflowRunReconciler) planWorkflowJobs(run *actionsv1alpha1.WorkflowRu
resultVersion = jobResultVersion
}
plannedJobs = append(plannedJobs, plannedWorkflowJob{
- id: expandedID, displayName: displayName, runsOn: append([]string(nil), resolvedJob.RunsOn...), matrix: matrixSpec, plan: string(data), resultVersion: resultVersion,
+ id: expandedID, displayName: displayName, runsOn: append([]string(nil), resolvedJob.RunsOn...), matrix: matrixSpec,
+ environment: resolvedJob.Environment, plan: string(data), resultVersion: resultVersion,
})
}
}
@@ -1017,6 +1141,9 @@ func (r *WorkflowRunReconciler) observeWorkflowJobs(ctx context.Context, run *ac
}
for index := range jobs.Items {
job := &jobs.Items[index]
+ if err := r.reconcileEnvironmentApproval(ctx, job); err != nil {
+ return ctrl.Result{}, err
+ }
condition := meta.FindStatusCondition(job.Status.Conditions, actionsv1alpha1.WorkflowJobConditionSucceeded)
if condition == nil || (condition.Status != metav1.ConditionTrue && condition.Status != metav1.ConditionFalse) {
plan := &corev1.ConfigMap{}
@@ -1052,6 +1179,8 @@ func (r *WorkflowRunReconciler) observeWorkflowJobs(ctx context.Context, run *ac
status.Failed++
case job.Status.RunnerRef != nil:
status.Active++
+ case !workflowJobEnvironmentApproved(job):
+ status.WaitingForApproval++
default:
status.Queued++
}
@@ -1110,6 +1239,8 @@ func (r *WorkflowRunReconciler) observeWorkflowJobs(ctx context.Context, run *ac
now := metav1.Now()
run.Status.CompletionTime = &now
meta.SetStatusCondition(&run.Status.Conditions, metav1.Condition{Type: actionsv1alpha1.WorkflowRunConditionSucceeded, Status: metav1.ConditionTrue, ObservedGeneration: run.Generation, Reason: "JobsSucceeded", Message: "All WorkflowJobs succeeded"})
+ case status.WaitingForApproval > 0:
+ meta.SetStatusCondition(&run.Status.Conditions, metav1.Condition{Type: actionsv1alpha1.WorkflowRunConditionSucceeded, Status: metav1.ConditionUnknown, ObservedGeneration: run.Generation, Reason: "JobsWaitingForApproval", Message: "WorkflowJobs are waiting for environment approval"})
case status.Queued > 0:
meta.SetStatusCondition(&run.Status.Conditions, metav1.Condition{Type: actionsv1alpha1.WorkflowRunConditionSucceeded, Status: metav1.ConditionUnknown, ObservedGeneration: run.Generation, Reason: "JobsQueued", Message: "WorkflowJobs are waiting for matching Runners"})
default:
diff --git a/internal/controller/workflowrun_controller_test.go b/internal/controller/workflowrun_controller_test.go
index a9283e1..845d8aa 100644
--- a/internal/controller/workflowrun_controller_test.go
+++ b/internal/controller/workflowrun_controller_test.go
@@ -22,6 +22,7 @@ import (
"github.com/kelos-dev/open-actions/internal/workflow"
batchv1 "k8s.io/api/batch/v1"
corev1 "k8s.io/api/core/v1"
+ apiEquality "k8s.io/apimachinery/pkg/api/equality"
apierrors "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -523,6 +524,22 @@ func TestWorkflowRunCheckReportMapsLifecycle(t *testing.T) {
}
}
+func TestWorkflowRunCheckReportIncludesEnvironmentApproval(t *testing.T) {
+ run := &actionsv1alpha1.WorkflowRun{Status: actionsv1alpha1.WorkflowRunStatus{Jobs: &actionsv1alpha1.WorkflowRunJobStatus{Total: 1, WaitingForApproval: 1}}}
+ job := actionsv1alpha1.WorkflowJob{Spec: actionsv1alpha1.WorkflowJobSpec{Environment: &actionsv1alpha1.WorkflowJobEnvironment{
+ Name: "ok-to-test", Protection: &actionsv1alpha1.EnvironmentProtection{RequiredApproval: true},
+ }}}
+ report := workflowRunCheckReportWithJobs(run, []actionsv1alpha1.WorkflowJob{job})
+ if !strings.Contains(report.Output.Text, "1 waiting for approval") || !strings.Contains(report.Output.Text, `Environment "ok-to-test": waiting for approval.`) {
+ t.Fatalf("check output = %q", report.Output.Text)
+ }
+ meta.SetStatusCondition(&job.Status.Conditions, metav1.Condition{Type: actionsv1alpha1.WorkflowJobConditionEnvironmentApproved, Status: metav1.ConditionTrue, Reason: "EnvironmentApproved"})
+ report = workflowRunCheckReportWithJobs(run, []actionsv1alpha1.WorkflowJob{job})
+ if !strings.Contains(report.Output.Text, `Environment "ok-to-test": approved.`) {
+ t.Fatalf("approved check output = %q", report.Output.Text)
+ }
+}
+
func TestCompletedWorkflowRunTTL(t *testing.T) {
now := time.Date(2026, time.August, 10, 12, 0, 0, 0, time.UTC)
completedAt := metav1.NewTime(now.Add(-2 * time.Hour))
@@ -1021,6 +1038,81 @@ func TestEnsureWorkflowJobsCreatesReadableNames(t *testing.T) {
}
}
+func TestEnsureWorkflowJobsFreezesEnvironmentAndRequiresApproval(t *testing.T) {
+ scheme := runtime.NewScheme()
+ if err := actionsv1alpha1.AddToScheme(scheme); err != nil {
+ t.Fatal(err)
+ }
+ if err := corev1.AddToScheme(scheme); err != nil {
+ t.Fatal(err)
+ }
+ run := &actionsv1alpha1.WorkflowRun{ObjectMeta: metav1.ObjectMeta{Name: "deploy", Namespace: "default", UID: "run-uid"}}
+ project := &actionsv1alpha1.Project{
+ ObjectMeta: metav1.ObjectMeta{Name: "project", Namespace: "default", UID: "project-uid"},
+ Spec: actionsv1alpha1.ProjectSpec{Environments: []actionsv1alpha1.ProjectEnvironment{{
+ Name: "ok-to-test", SecretRef: &actionsv1alpha1.EnvironmentSecretReference{Name: "e2e-secrets"},
+ Protection: &actionsv1alpha1.EnvironmentProtection{RequiredApproval: true},
+ }}},
+ }
+ clusterClient := fake.NewClientBuilder().WithScheme(scheme).WithStatusSubresource(&actionsv1alpha1.WorkflowJob{}).WithObjects(run, project).Build()
+ reconciler := &WorkflowRunReconciler{Client: clusterClient, APIReader: clusterClient}
+ planned := []plannedWorkflowJob{{
+ id: "e2e", displayName: "E2E", runsOn: []string{"linux"}, plan: "{}",
+ environment: &workflow.JobEnvironment{Name: "OK-TO-TEST", URL: "https://deploy.example/e2e"},
+ }}
+ if err := reconciler.ensureWorkflowJobs(context.Background(), run, project, planned); err != nil {
+ t.Fatal(err)
+ }
+ job := &actionsv1alpha1.WorkflowJob{}
+ if err := clusterClient.Get(context.Background(), client.ObjectKey{Namespace: run.Namespace, Name: workflowJobName(run.Name, "e2e")}, job); err != nil {
+ t.Fatal(err)
+ }
+ if job.Spec.Environment == nil || job.Spec.Environment.Name != "ok-to-test" || job.Spec.Environment.URL != "https://deploy.example/e2e" || job.Spec.Environment.SecretRef == nil || job.Spec.Environment.SecretRef.Name != "e2e-secrets" {
+ t.Fatalf("WorkflowJob environment = %#v", job.Spec.Environment)
+ }
+ approved := meta.FindStatusCondition(job.Status.Conditions, actionsv1alpha1.WorkflowJobConditionEnvironmentApproved)
+ if approved == nil || approved.Status != metav1.ConditionFalse || approved.Reason != "ApprovalRequired" {
+ t.Fatalf("environment approval condition = %#v", approved)
+ }
+ beforeSpec := job.Spec.DeepCopy()
+ if job.Annotations == nil {
+ job.Annotations = map[string]string{}
+ }
+ job.Annotations[actionsv1alpha1.AnnotationEnvironmentApproved] = "ok-to-test"
+ if err := clusterClient.Update(context.Background(), job); err != nil {
+ t.Fatal(err)
+ }
+ if err := reconciler.reconcileEnvironmentApproval(context.Background(), job); err != nil {
+ t.Fatal(err)
+ }
+ if !meta.IsStatusConditionTrue(job.Status.Conditions, actionsv1alpha1.WorkflowJobConditionEnvironmentApproved) {
+ t.Fatalf("environment approval condition = %#v", job.Status.Conditions)
+ }
+ if !apiEquality.Semantic.DeepEqual(beforeSpec, &job.Spec) {
+ t.Fatalf("approval changed immutable WorkflowJob spec: %#v", job.Spec)
+ }
+}
+
+func TestEnsureWorkflowJobsRejectsUnconfiguredEnvironment(t *testing.T) {
+ scheme := runtime.NewScheme()
+ if err := actionsv1alpha1.AddToScheme(scheme); err != nil {
+ t.Fatal(err)
+ }
+ if err := corev1.AddToScheme(scheme); err != nil {
+ t.Fatal(err)
+ }
+ run := &actionsv1alpha1.WorkflowRun{ObjectMeta: metav1.ObjectMeta{Name: "deploy", Namespace: "default", UID: "run-uid"}}
+ project := &actionsv1alpha1.Project{ObjectMeta: metav1.ObjectMeta{Name: "project", Namespace: "default", UID: "project-uid"}}
+ clusterClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(run, project).Build()
+ reconciler := &WorkflowRunReconciler{Client: clusterClient, APIReader: clusterClient}
+ err := reconciler.ensureWorkflowJobs(context.Background(), run, project, []plannedWorkflowJob{{
+ id: "deploy", runsOn: []string{"linux"}, plan: "{}", environment: &workflow.JobEnvironment{Name: "production"},
+ }})
+ if err == nil || !strings.Contains(err.Error(), `environment "production" is not configured on Project "project"`) {
+ t.Fatalf("ensureWorkflowJobs() error = %v", err)
+ }
+}
+
func TestEnsureWorkflowJobsPreservesMatrixIdentity(t *testing.T) {
scheme := runtime.NewScheme()
if err := actionsv1alpha1.AddToScheme(scheme); err != nil {
@@ -1191,6 +1283,48 @@ func TestPlannedWorkflowRunIsObservedWithoutPlanningDependencies(t *testing.T) {
}
}
+func TestPlannedWorkflowRunReportsEnvironmentApprovalWait(t *testing.T) {
+ scheme := runtime.NewScheme()
+ if err := actionsv1alpha1.AddToScheme(scheme); err != nil {
+ t.Fatal(err)
+ }
+ if err := corev1.AddToScheme(scheme); err != nil {
+ t.Fatal(err)
+ }
+ run := &actionsv1alpha1.WorkflowRun{
+ ObjectMeta: metav1.ObjectMeta{Name: "ci", Namespace: "default", UID: types.UID("run-uid")},
+ Status: actionsv1alpha1.WorkflowRunStatus{
+ WorkflowName: "CI", Jobs: &actionsv1alpha1.WorkflowRunJobStatus{Total: 1},
+ Conditions: []metav1.Condition{plannedCondition(metav1.ConditionTrue, "JobsPlanned")},
+ },
+ }
+ job := &actionsv1alpha1.WorkflowJob{
+ ObjectMeta: metav1.ObjectMeta{Name: "e2e", Namespace: "default", UID: types.UID("job-uid"), Labels: map[string]string{actionsv1alpha1.LabelWorkflowRunUID: string(run.UID)}},
+ Spec: actionsv1alpha1.WorkflowJobSpec{Environment: &actionsv1alpha1.WorkflowJobEnvironment{
+ Name: "ok-to-test", Protection: &actionsv1alpha1.EnvironmentProtection{RequiredApproval: true},
+ }},
+ }
+ plan := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: childName(job.Name, "plan"), Namespace: job.Namespace}}
+ if err := controllerutil.SetControllerReference(job, plan, scheme); err != nil {
+ t.Fatal(err)
+ }
+ clusterClient := fake.NewClientBuilder().WithScheme(scheme).
+ WithStatusSubresource(&actionsv1alpha1.WorkflowRun{}, &actionsv1alpha1.WorkflowJob{}).
+ WithObjects(run, job, plan).Build()
+ reconciler := &WorkflowRunReconciler{Client: clusterClient, APIReader: clusterClient}
+ if _, err := reconciler.Reconcile(context.Background(), ctrl.Request{NamespacedName: client.ObjectKeyFromObject(run)}); err != nil {
+ t.Fatal(err)
+ }
+ stored := &actionsv1alpha1.WorkflowRun{}
+ if err := clusterClient.Get(context.Background(), client.ObjectKeyFromObject(run), stored); err != nil {
+ t.Fatal(err)
+ }
+ condition := meta.FindStatusCondition(stored.Status.Conditions, actionsv1alpha1.WorkflowRunConditionSucceeded)
+ if stored.Status.Jobs == nil || stored.Status.Jobs.WaitingForApproval != 1 || stored.Status.Jobs.Queued != 0 || condition == nil || condition.Reason != "JobsWaitingForApproval" {
+ t.Fatalf("WorkflowRun status = %#v", stored.Status)
+ }
+}
+
func TestPlannedWorkflowRunFailsWhenAChildIsMissing(t *testing.T) {
scheme := runtime.NewScheme()
if err := actionsv1alpha1.AddToScheme(scheme); err != nil {
diff --git a/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_projects.yaml b/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_projects.yaml
index 4b9bbe5..7fe0030 100644
--- a/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_projects.yaml
+++ b/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_projects.yaml
@@ -53,6 +53,55 @@ spec:
description: ProjectSpec describes the workflow source for an Open Actions
Project.
properties:
+ environments:
+ description: |-
+ Environments defines the environment names workflows may select. Each
+ environment may expose one Secret and require approval before its jobs can
+ be assigned to a Runner.
+ items:
+ description: |-
+ ProjectEnvironment configures one workflow environment. Environment names
+ are matched without regard to ASCII case.
+ properties:
+ name:
+ description: Name is the GitHub-compatible environment name
+ selected by a workflow job.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^\x00-\x1f\x7f]+$
+ type: string
+ protection:
+ description: Protection configures the gate enforced before
+ a job can be assigned.
+ properties:
+ requiredApproval:
+ description: |-
+ RequiredApproval requires an authorized user to approve each WorkflowJob
+ before a Runner can claim it.
+ type: boolean
+ type: object
+ secretRef:
+ description: |-
+ SecretRef identifies a Secret in the Project namespace whose data keys
+ populate the secrets expression context for jobs in this environment.
+ properties:
+ name:
+ description: Name is the Secret resource name.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?([.][a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?)*$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - name
+ type: object
+ maxItems: 100
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
source:
description: Source selects and configures the external workflow source.
properties:
@@ -202,6 +251,10 @@ spec:
required:
- source
type: object
+ x-kubernetes-validations:
+ - message: environment names must be unique ignoring ASCII case
+ rule: '!has(self.environments) || self.environments.all(e, self.environments.exists_one(other,
+ e.name.lowerAscii() == other.name.lowerAscii()))'
status:
description: ProjectStatus contains observations made by the project controller.
properties:
diff --git a/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowjobs.yaml b/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowjobs.yaml
index 57f6c2f..03fc494 100644
--- a/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowjobs.yaml
+++ b/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowjobs.yaml
@@ -25,6 +25,12 @@ spec:
- jsonPath: .status.runnerRef.name
name: Runner
type: string
+ - jsonPath: .spec.environment.name
+ name: Environment
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="EnvironmentApproved")].status
+ name: Approved
+ type: string
- jsonPath: .status.conditions[?(@.type=="Scheduled")].status
name: Scheduled
type: string
@@ -71,6 +77,50 @@ spec:
maxLength: 256
minLength: 1
type: string
+ environment:
+ description: |-
+ Environment contains the selected workflow environment and the Project
+ policy resolved for this job.
+ properties:
+ name:
+ description: Name is the configured Project environment name.
+ maxLength: 255
+ minLength: 1
+ pattern: ^[^\x00-\x1f\x7f]+$
+ type: string
+ protection:
+ description: Protection is the Project environment gate resolved
+ for this job.
+ properties:
+ requiredApproval:
+ description: |-
+ RequiredApproval requires an authorized user to approve each WorkflowJob
+ before a Runner can claim it.
+ type: boolean
+ type: object
+ secretRef:
+ description: |-
+ SecretRef identifies the Project Secret whose data keys are available to
+ this job through the secrets expression context.
+ properties:
+ name:
+ description: Name is the Secret resource name.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?([.][a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?)*$
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: URL is the optional deployment target URL resolved
+ from the workflow.
+ maxLength: 2048
+ minLength: 1
+ type: string
+ required:
+ - name
+ type: object
jobID:
description: |-
JobID is the stable workflow-local identifier of this expanded job. For a
@@ -170,9 +220,10 @@ spec:
type: string
conditions:
description: |-
- Conditions describe Runner assignment and the terminal result. Scheduled
- is true after the scheduler assigns status.runnerRef. Known condition types
- are Scheduled and Succeeded.
+ Conditions describe environment approval, Runner assignment, and the
+ terminal result. EnvironmentApproved is present for jobs that select an
+ environment. Scheduled is true after the scheduler assigns status.runnerRef.
+ Known condition types are EnvironmentApproved, Scheduled, and Succeeded.
items:
description: Condition contains details for one aspect of the current
state of this API Resource.
diff --git a/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowruns.yaml b/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowruns.yaml
index 1358dd6..e57f995 100644
--- a/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowruns.yaml
+++ b/internal/manifests/charts/open-actions/templates/crds/actions.kelos.dev_workflowruns.yaml
@@ -731,6 +731,14 @@ spec:
maximum: 100000
minimum: 0
type: integer
+ waitingForApproval:
+ description: |-
+ WaitingForApproval is the number of jobs blocked by an environment
+ approval gate and therefore not yet queued for a Runner.
+ format: int32
+ maximum: 100000
+ minimum: 0
+ type: integer
type: object
observedGeneration:
description: |-
diff --git a/internal/runner/expression.go b/internal/runner/expression.go
index 6140bef..1738c2d 100644
--- a/internal/runner/expression.go
+++ b/internal/runner/expression.go
@@ -10,19 +10,20 @@ import (
)
var (
- runnerJobAvailability = workflowexpression.NewAvailability("github", "matrix", "inputs")
- runnerStepAvailability = workflowexpression.NewAvailability("github", "matrix", "runner", "env", "inputs", "steps")
+ runnerJobAvailability = workflowexpression.NewAvailability("github", "matrix", "inputs", "secrets")
+ runnerStepAvailability = workflowexpression.NewAvailability("github", "matrix", "runner", "env", "inputs", "secrets", "steps")
runnerConditionAvailability = workflowexpression.NewAvailability("github", "matrix", "runner", "env", "inputs", "steps").WithStatusFunctions()
compositeAvailability = workflowexpression.NewAvailability("github", "runner", "env", "inputs", "steps")
compositeConditionAvailability = workflowexpression.NewAvailability("github", "runner", "env", "inputs", "steps").WithStatusFunctions()
+ actionDefaultAvailability = workflowexpression.NewAvailability("github", "matrix", "inputs")
)
-func resolveJobEnvironment(values map[string]string, plan *Plan, environment []string, token string) (map[string]string, error) {
- return resolveExpressionMap(values, expressionContext(plan, environment, "", nil, runnerJobAvailability, nil, token))
+func resolveJobEnvironment(values map[string]string, plan *Plan, environment []string, token string, secrets map[string]string) (map[string]string, error) {
+ return resolveExpressionMap(values, expressionContext(plan, environment, "", nil, runnerJobAvailability, nil, token, secrets))
}
func resolveActionDefaultExpression(input string, plan *Plan, environment []string, token string) (string, error) {
- context := expressionContext(plan, environment, "", nil, runnerJobAvailability, nil, token)
+ context := expressionContext(plan, environment, "", nil, actionDefaultAvailability, nil, token, nil)
return resolveExpressionString(input, context)
}
@@ -77,7 +78,7 @@ func workflowStepCondition(input string, environment map[string]string, status w
func workflowExpressionContext(state *executionState, environment []string, availability workflowexpression.Availability, status *workflowexpression.Status) workflowexpression.Context {
values := map[string]any{"steps": state.stepOutputs}
- return expressionContext(state.plan, environment, "", values, availability, status, state.githubToken)
+ return expressionContext(state.plan, environment, "", values, availability, status, state.githubToken, state.secrets)
}
func compositeExpressionContext(compositeContext *compositeContext, availability workflowexpression.Availability, status *workflowexpression.Status) workflowexpression.Context {
@@ -90,10 +91,10 @@ func compositeExpressionContext(compositeContext *compositeContext, availability
"inputs": compositeContext.inputs,
"steps": steps,
}
- return expressionContext(compositeContext.state.plan, environment, compositeContext.actionPath, values, availability, status, compositeContext.state.githubToken)
+ return expressionContext(compositeContext.state.plan, environment, compositeContext.actionPath, values, availability, status, compositeContext.state.githubToken, nil)
}
-func expressionContext(plan *Plan, environment []string, actionPath string, extra map[string]any, availability workflowexpression.Availability, status *workflowexpression.Status, token string) workflowexpression.Context {
+func expressionContext(plan *Plan, environment []string, actionPath string, extra map[string]any, availability workflowexpression.Availability, status *workflowexpression.Status, token string, secrets map[string]string) workflowexpression.Context {
pullRequestRefs := planPullRequestRefs(plan)
github := map[string]any{
"workflow": plan.WorkflowName,
@@ -125,6 +126,12 @@ func expressionContext(plan *Plan, environment []string, actionPath string, extr
},
"env": environmentContext(environment),
}
+ secretValues := make(map[string]any, len(secrets)+1)
+ for name, value := range secrets {
+ secretValues[name] = workflowexpression.Secret(value)
+ }
+ secretValues["GITHUB_TOKEN"] = workflowexpression.Secret(token)
+ values["secrets"] = secretValues
for name, value := range extra {
values[name] = value
}
diff --git a/internal/runner/runner.go b/internal/runner/runner.go
index 095da60..a58f75b 100644
--- a/internal/runner/runner.go
+++ b/internal/runner/runner.go
@@ -23,7 +23,7 @@ import (
const (
minimumPlanVersion = 1
- PlanVersion = 4
+ PlanVersion = 5
ContainerName = "runner"
)
@@ -120,6 +120,7 @@ type Step struct {
type ExecutorConfig struct {
Logger *slog.Logger
GitHubToken string
+ Secrets map[string]string
Environment []string
Stdout io.Writer
Stderr io.Writer
@@ -128,6 +129,7 @@ type ExecutorConfig struct {
type Executor struct {
logger *slog.Logger
githubToken string
+ secrets map[string]string
environment []string
stdout io.Writer
stderr io.Writer
@@ -142,6 +144,7 @@ type executionState struct {
temporaryDirectory string
environment []string
githubToken string
+ secrets map[string]string
resolver *actionResolver
posts []*actionInvocation
compositeStack map[string]bool
@@ -155,9 +158,18 @@ func NewExecutor(config ExecutorConfig) (*Executor, error) {
}
masker := newOutputMasker(config.GitHubToken)
masker.add(base64.StdEncoding.EncodeToString([]byte("x-access-token:" + config.GitHubToken)))
+ secrets := make(map[string]string, len(config.Secrets))
+ for name, value := range config.Secrets {
+ if len(value) > maxMaskValueBytes {
+ return nil, fmt.Errorf("workflow job secret %q exceeds %d bytes", name, maxMaskValueBytes)
+ }
+ secrets[name] = value
+ masker.add(value)
+ }
return &Executor{
logger: config.Logger.With(runnerLogMarker, true),
githubToken: config.GitHubToken,
+ secrets: secrets,
environment: append([]string(nil), config.Environment...),
stdout: config.Stdout,
stderr: config.Stderr,
@@ -166,6 +178,24 @@ func NewExecutor(config ExecutorConfig) (*Executor, error) {
}, nil
}
+// LoadSecrets reads the environment-scoped secret values supplied separately
+// from the non-secret workflow plan.
+func LoadSecrets(path string) (map[string]string, error) {
+ data, err := os.ReadFile(path)
+ if err != nil {
+ return nil, fmt.Errorf("read workflow job secrets: %w", err)
+ }
+ secrets := map[string]string{}
+ decoder := json.NewDecoder(bytes.NewReader(data))
+ if err := decoder.Decode(&secrets); err != nil {
+ return nil, fmt.Errorf("decode workflow job secrets: %w", err)
+ }
+ if err := decoder.Decode(&struct{}{}); err != io.EOF {
+ return nil, errors.New("decode workflow job secrets: trailing JSON value")
+ }
+ return secrets, nil
+}
+
func LoadPlan(path string) (*Plan, error) {
data, err := os.ReadFile(path)
if err != nil {
@@ -264,7 +294,7 @@ func (e *Executor) executePlan(ctx context.Context, plan *Plan, workspace string
"RUNNER_TEMP="+filepath.Join(temporaryDirectory, "temp"),
"RUNNER_TOOL_CACHE="+filepath.Join(temporaryDirectory, "tool-cache"),
)
- jobEnvironment, err := resolveJobEnvironment(plan.Env, plan, environment, e.githubToken)
+ jobEnvironment, err := resolveJobEnvironment(plan.Env, plan, environment, e.githubToken, e.secrets)
if err != nil {
return emptyResult, fmt.Errorf("resolve job environment: %w", err)
}
@@ -282,6 +312,7 @@ func (e *Executor) executePlan(ctx context.Context, plan *Plan, workspace string
temporaryDirectory: temporaryDirectory,
environment: environment,
githubToken: e.githubToken,
+ secrets: e.secrets,
resolver: newActionResolver(plan.Repository.ActionCloneBaseURL, filepath.Join(temporaryDirectory, "actions"), environment, e.executeCommand),
compositeStack: map[string]bool{},
stepOutputs: map[string]map[string]any{},
diff --git a/internal/runner/runner_test.go b/internal/runner/runner_test.go
index 11530f1..1c86916 100644
--- a/internal/runner/runner_test.go
+++ b/internal/runner/runner_test.go
@@ -391,13 +391,50 @@ func TestResolvedStepBytesEnforcesFieldLimits(t *testing.T) {
func TestExecuteRejectsUnavailableExpressionContext(t *testing.T) {
plan := testPlan()
- plan.Env = map[string]string{"TOKEN": "${{ secrets.TOKEN }}"}
+ plan.Steps[0].If = "${{ secrets.TOKEN }}"
err := testExecutor(t, io.Discard, io.Discard).Execute(context.Background(), plan, t.TempDir())
if err == nil || !strings.Contains(err.Error(), `context "secrets" is unavailable`) {
t.Fatalf("error = %v, want unavailable secrets context", err)
}
}
+func TestExecuteResolvesAndMasksEnvironmentSecrets(t *testing.T) {
+ plan := testPlan()
+ plan.Env = map[string]string{
+ "DEPLOY_TOKEN": "${{ secrets.DEPLOY_TOKEN }}",
+ "GITHUB_SECRET": "${{ secrets.GITHUB_TOKEN }}",
+ }
+ plan.Steps = []Step{{Run: `printf '%s %s\n' "$DEPLOY_TOKEN" "$GITHUB_SECRET"`}}
+ var output bytes.Buffer
+ executor, err := NewExecutor(ExecutorConfig{
+ Logger: slog.New(slog.NewTextHandler(io.Discard, nil)), GitHubToken: "installation-token",
+ Secrets: map[string]string{"DEPLOY_TOKEN": "environment-token"}, Environment: os.Environ(), Stdout: &output, Stderr: &output,
+ })
+ if err != nil {
+ t.Fatal(err)
+ }
+ if err := executor.Execute(context.Background(), plan, t.TempDir()); err != nil {
+ t.Fatal(err)
+ }
+ if strings.Contains(output.String(), "environment-token") || strings.Contains(output.String(), "installation-token") || !strings.Contains(output.String(), "***") {
+ t.Fatalf("secret output was not masked: %q", output.String())
+ }
+}
+
+func TestLoadSecrets(t *testing.T) {
+ path := filepath.Join(t.TempDir(), "secrets.json")
+ if err := os.WriteFile(path, []byte(`{"DEPLOY_TOKEN":"value"}`), 0o600); err != nil {
+ t.Fatal(err)
+ }
+ secrets, err := LoadSecrets(path)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if secrets["DEPLOY_TOKEN"] != "value" {
+ t.Fatalf("secrets = %#v", secrets)
+ }
+}
+
func TestLoadPlanSupportsCompatibleVersions(t *testing.T) {
for version := minimumPlanVersion; version <= PlanVersion; version++ {
t.Run(fmt.Sprintf("version %d", version), func(t *testing.T) {
@@ -421,7 +458,7 @@ func TestExpressionContextsPreserveTriggerInputTypes(t *testing.T) {
plan := testPlan()
plan.Inputs = map[string]any{"enabled": false, "retries": float64(2)}
plan.Event.Schedule = "0 6 * * *"
- context := expressionContext(plan, nil, "", nil, runnerConditionAvailability, nil, "token")
+ context := expressionContext(plan, nil, "", nil, runnerConditionAvailability, nil, "token", nil)
enabled, err := evaluateCondition("${{ inputs.enabled }}", context, true)
if err != nil {
t.Fatal(err)
@@ -537,6 +574,16 @@ func TestNewExecutorRequiresGitHubToken(t *testing.T) {
}
}
+func TestNewExecutorRejectsSecretTooLargeToMask(t *testing.T) {
+ _, err := NewExecutor(ExecutorConfig{
+ Logger: slog.New(slog.NewTextHandler(io.Discard, nil)), GitHubToken: "token",
+ Secrets: map[string]string{"TOKEN": strings.Repeat("x", maxMaskValueBytes+1)}, Environment: os.Environ(), Stdout: io.Discard, Stderr: io.Discard,
+ })
+ if err == nil || !strings.Contains(err.Error(), "exceeds") {
+ t.Fatalf("NewExecutor() error = %v", err)
+ }
+}
+
func TestActionCloneTokenIsLimitedToWorkflowRepository(t *testing.T) {
plan := testPlan()
sameRepository := actionref.Reference{Owner: "ACME", Repository: "Example"}
diff --git a/internal/workflow/workflow.go b/internal/workflow/workflow.go
index d5283a1..5637375 100644
--- a/internal/workflow/workflow.go
+++ b/internal/workflow/workflow.go
@@ -27,6 +27,8 @@ const (
maxMatrixValueLength = 1024
maxJobIDLength = 256
maxJobNameLength = 256
+ maxEnvironmentNameLength = 255
+ maxEnvironmentURLLength = 2048
maxRunnerLabels = 16
maxSteps = 100
MaxStepIDLength = 256
@@ -121,16 +123,57 @@ func (schedule *Schedule) UnmarshalYAML(node *yaml.Node) error {
}
type Job struct {
- Name string `yaml:"name"`
- RunsOn StringList `yaml:"runs-on"`
- Needs StringList `yaml:"needs"`
- Outputs map[string]any `yaml:"outputs"`
- Steps []Step `yaml:"steps"`
- Strategy Strategy `yaml:"strategy"`
- Container yaml.Node `yaml:"container"`
- Services yaml.Node `yaml:"services"`
- If string `yaml:"if"`
- Env map[string]any `yaml:"env"`
+ Name string `yaml:"name"`
+ RunsOn StringList `yaml:"runs-on"`
+ Needs StringList `yaml:"needs"`
+ Outputs map[string]any `yaml:"outputs"`
+ Steps []Step `yaml:"steps"`
+ Strategy Strategy `yaml:"strategy"`
+ Container yaml.Node `yaml:"container"`
+ Services yaml.Node `yaml:"services"`
+ If string `yaml:"if"`
+ Env map[string]any `yaml:"env"`
+ Environment *JobEnvironment `yaml:"environment"`
+}
+
+// JobEnvironment is the environment selected by a workflow job.
+type JobEnvironment struct {
+ Name string `yaml:"name"`
+ URL string `yaml:"url"`
+ urlSet bool
+}
+
+func (environment *JobEnvironment) UnmarshalYAML(node *yaml.Node) error {
+ switch node.Kind {
+ case yaml.ScalarNode:
+ if err := node.Decode(&environment.Name); err != nil {
+ return fmt.Errorf("environment must be a string or mapping")
+ }
+ return nil
+ case yaml.MappingNode:
+ if err := rejectDuplicateMappingKeys(node, "environment"); err != nil {
+ return err
+ }
+ for index := 0; index < len(node.Content); index += 2 {
+ name := node.Content[index].Value
+ switch name {
+ case "name":
+ if err := node.Content[index+1].Decode(&environment.Name); err != nil {
+ return fmt.Errorf("environment name must be a string")
+ }
+ case "url":
+ environment.urlSet = true
+ if err := node.Content[index+1].Decode(&environment.URL); err != nil {
+ return fmt.Errorf("environment url must be a string")
+ }
+ default:
+ return fmt.Errorf("unsupported environment field %q", name)
+ }
+ }
+ return nil
+ default:
+ return fmt.Errorf("environment must be a string or mapping")
+ }
}
type Strategy struct {
@@ -208,6 +251,8 @@ type Repository struct {
var (
workflowConcurrencyAvailability = expression.NewAvailability("github", "inputs", "vars")
jobNameAvailability = expression.NewAvailability("github", "needs", "strategy", "matrix", "vars", "inputs")
+ jobEnvironmentNameAvailability = expression.NewAvailability("github", "needs", "strategy", "matrix", "vars", "inputs")
+ jobEnvironmentURLAvailability = expression.NewAvailability("github", "needs", "strategy", "matrix", "vars", "inputs")
jobEnvironmentAvailability = expression.NewAvailability("github", "needs", "strategy", "matrix", "vars", "secrets", "inputs")
stepAvailability = expression.NewAvailability("github", "needs", "strategy", "matrix", "job", "runner", "env", "vars", "secrets", "steps", "inputs")
stepConditionAvailability = expression.NewAvailability("github", "needs", "strategy", "matrix", "job", "runner", "env", "vars", "steps", "inputs").WithStatusFunctions()
@@ -287,6 +332,26 @@ func validateJob(id string, job *Job) error {
if err := validateTemplate(fmt.Sprintf("job %q name", id), job.Name, jobNameAvailability); err != nil {
return err
}
+ if job.Environment != nil {
+ if job.Environment.Name == "" {
+ return fmt.Errorf("job %q environment name must not be empty", id)
+ }
+ if utf8.RuneCountInString(job.Environment.Name) > maxEnvironmentNameLength {
+ return fmt.Errorf("job %q environment name exceeds %d characters", id, maxEnvironmentNameLength)
+ }
+ if err := validateTemplate(fmt.Sprintf("job %q environment name", id), job.Environment.Name, jobEnvironmentNameAvailability); err != nil {
+ return err
+ }
+ if job.Environment.urlSet && job.Environment.URL == "" {
+ return fmt.Errorf("job %q environment url must not be empty", id)
+ }
+ if utf8.RuneCountInString(job.Environment.URL) > maxEnvironmentURLLength {
+ return fmt.Errorf("job %q environment url exceeds %d characters", id, maxEnvironmentURLLength)
+ }
+ if err := validateTemplate(fmt.Sprintf("job %q environment url", id), job.Environment.URL, jobEnvironmentURLAvailability); err != nil {
+ return err
+ }
+ }
if len(job.RunsOn) == 0 {
return fmt.Errorf("job %q must define runs-on", id)
}
@@ -583,6 +648,28 @@ func EvaluateJob(id string, job Job, context expression.Context) (Job, error) {
if utf8.RuneCountInString(job.Name) > maxJobNameLength {
return Job{}, fmt.Errorf("job %q evaluated name exceeds %d characters", id, maxJobNameLength)
}
+ if job.Environment != nil {
+ environment := *job.Environment
+ name, err := evaluateTemplateString(environment.Name, context)
+ if err != nil {
+ return Job{}, fmt.Errorf("job %q environment name: %w", id, err)
+ }
+ if name == "" || utf8.RuneCountInString(name) > maxEnvironmentNameLength {
+ return Job{}, fmt.Errorf("job %q evaluated an invalid environment name", id)
+ }
+ environment.Name = name
+ if environment.URL != "" {
+ url, err := evaluateTemplateString(environment.URL, context)
+ if err != nil {
+ return Job{}, fmt.Errorf("job %q environment url: %w", id, err)
+ }
+ if url == "" || utf8.RuneCountInString(url) > maxEnvironmentURLLength {
+ return Job{}, fmt.Errorf("job %q evaluated an invalid environment url", id)
+ }
+ environment.URL = url
+ }
+ job.Environment = &environment
+ }
job.RunsOn = append(StringList(nil), job.RunsOn...)
labels := make(map[string]struct{}, len(job.RunsOn))
@@ -612,6 +699,18 @@ func EvaluateJob(id string, job Job, context expression.Context) (Job, error) {
return job, nil
}
+func evaluateTemplateString(input string, context expression.Context) (string, error) {
+ program, err := expression.Parse(input)
+ if err != nil {
+ return "", err
+ }
+ result, err := program.Evaluate(context)
+ if err != nil {
+ return "", err
+ }
+ return result.String()
+}
+
func EvaluateConcurrency(definition *Definition, event Event) (string, bool, error) {
if definition.Concurrency.Group == "" {
return "", false, nil
diff --git a/internal/workflow/workflow_test.go b/internal/workflow/workflow_test.go
index ca57d0b..cfd26a6 100644
--- a/internal/workflow/workflow_test.go
+++ b/internal/workflow/workflow_test.go
@@ -36,6 +36,51 @@ func TestParseRemainingKelosTriggers(t *testing.T) {
}
}
+func TestJobEnvironmentScalarAndMappingForms(t *testing.T) {
+ for _, test := range []struct {
+ name string
+ value string
+ wantName string
+ wantURL string
+ }{
+ {name: "scalar", value: "staging", wantName: "staging"},
+ {name: "mapping", value: "\n name: ${{ inputs.environment }}-${{ matrix.arch }}\n url: https://deploy.example/${{ matrix.arch }}", wantName: "production-arm64", wantURL: "https://deploy.example/arm64"},
+ } {
+ t.Run(test.name, func(t *testing.T) {
+ definition, err := Parse([]byte("name: Deploy\non: push\njobs:\n deploy:\n runs-on: ubuntu-latest\n environment: " + test.value + "\n strategy:\n matrix:\n arch: [arm64]\n steps:\n - run: deploy\n"))
+ if err != nil {
+ t.Fatal(err)
+ }
+ job, err := EvaluateJob("deploy", definition.Jobs["deploy"], workflowexpression.Context{
+ Availability: workflowexpression.NewAvailability("github", "inputs", "matrix"),
+ Values: map[string]any{
+ "github": map[string]any{}, "inputs": map[string]any{"environment": "production"}, "matrix": map[string]any{"arch": "arm64"},
+ },
+ })
+ if err != nil {
+ t.Fatal(err)
+ }
+ if job.Environment == nil || job.Environment.Name != test.wantName || job.Environment.URL != test.wantURL {
+ t.Fatalf("environment = %#v, want name %q url %q", job.Environment, test.wantName, test.wantURL)
+ }
+ })
+ }
+}
+
+func TestJobEnvironmentRejectsInvalidForms(t *testing.T) {
+ for _, environment := range []string{
+ "{}",
+ "{name: production, unknown: value}",
+ "{name: production, name: staging}",
+ "${{ secrets.ENVIRONMENT }}",
+ } {
+ workflowText := "name: Deploy\non: push\njobs:\n deploy:\n runs-on: ubuntu-latest\n environment: " + environment + "\n steps:\n - run: deploy\n"
+ if _, err := Parse([]byte(workflowText)); err == nil {
+ t.Fatalf("Parse() accepted environment %q", environment)
+ }
+ }
+}
+
func TestMatchWorkflowRunFilters(t *testing.T) {
definition, err := Parse([]byte("name: Deploy\non:\n workflow_run:\n workflows: [Release]\n types: [completed]\n branches: [main]\n" + minimalJob))
if err != nil {
diff --git a/internal/workflowstatus/status.go b/internal/workflowstatus/status.go
index 01efd93..f1938c4 100644
--- a/internal/workflowstatus/status.go
+++ b/internal/workflowstatus/status.go
@@ -8,6 +8,7 @@ import (
const (
queued = "Queued"
+ waiting = "Waiting for approval"
running = "Running"
succeeded = "Succeeded"
failed = "Failed"
@@ -46,6 +47,9 @@ func Job(job *actionsv1alpha1.WorkflowJob) string {
if job.Status.RunnerRef != nil {
return running
}
+ if job.Spec.Environment != nil && !meta.IsStatusConditionTrue(job.Status.Conditions, actionsv1alpha1.WorkflowJobConditionEnvironmentApproved) {
+ return waiting
+ }
return queued
}
diff --git a/internal/workflowstatus/status_test.go b/internal/workflowstatus/status_test.go
index 8983c62..08b8472 100644
--- a/internal/workflowstatus/status_test.go
+++ b/internal/workflowstatus/status_test.go
@@ -5,6 +5,7 @@ import (
actionsv1alpha1 "github.com/kelos-dev/open-actions/api/v1alpha1"
corev1 "k8s.io/api/core/v1"
+ "k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
@@ -36,6 +37,7 @@ func TestJob(t *testing.T) {
want string
}{
{name: "waiting", job: &actionsv1alpha1.WorkflowJob{}, want: "Queued"},
+ {name: "waiting for approval", job: workflowJobWaitingForApproval(), want: "Waiting for approval"},
{name: "running", job: &actionsv1alpha1.WorkflowJob{Status: actionsv1alpha1.WorkflowJobStatus{RunnerRef: &corev1.LocalObjectReference{Name: "runner"}}}, want: "Running"},
{name: "succeeded", job: workflowJobWithCondition(metav1.ConditionTrue), want: "Succeeded"},
{name: "failed", job: workflowJobWithCondition(metav1.ConditionFalse), want: "Failed"},
@@ -48,6 +50,12 @@ func TestJob(t *testing.T) {
}
}
+func workflowJobWaitingForApproval() *actionsv1alpha1.WorkflowJob {
+ job := &actionsv1alpha1.WorkflowJob{Spec: actionsv1alpha1.WorkflowJobSpec{Environment: &actionsv1alpha1.WorkflowJobEnvironment{Name: "production"}}}
+ meta.SetStatusCondition(&job.Status.Conditions, metav1.Condition{Type: actionsv1alpha1.WorkflowJobConditionEnvironmentApproved, Status: metav1.ConditionFalse, Reason: "ApprovalRequired"})
+ return job
+}
+
func TestJobTerminal(t *testing.T) {
for _, test := range []struct {
status metav1.ConditionStatus