实现持久化 assignment handoff

internal/taskassignment/assignment.go

@@ -0,0 +1,125 @@
+// Package taskassignment defines the durable handoff between the scheduler and workers.
+package taskassignment
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+
+	"gitea.dev/actionslib/pkg/model"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
+	"google.golang.org/protobuf/proto"
+
+	"git.ddupan.top/panxiao81/gitea-dynamic-runner/internal/taskidentity"
+)
+
+const wireVersion = 1
+
+type Backend string
+
+const (
+	BackendPod Backend = "pod"
+	BackendVM  Backend = "vm"
+)
+
+// Assignment is the only document persisted in the handoff queue.
+type Assignment struct {
+	ID       string
+	Backend  Backend
+	Task     *runnerv1.Task
+	Identity taskidentity.Identity
+}
+
+type envelope struct {
+	Version  int                   `json:"version"`
+	ID       string                `json:"id"`
+	Backend  Backend               `json:"backend"`
+	Task     []byte                `json:"task"`
+	Identity taskidentity.Identity `json:"identity"`
+}
+
+// New derives all trusted assignment fields from the task fetched from Gitea.
+func New(task *runnerv1.Task, trustDomain string) (Assignment, error) {
+	if task == nil || task.GetId() <= 0 {
+		return Assignment{}, errors.New("positive Gitea task ID is required")
+	}
+	identity, err := taskidentity.FromTask(task, trustDomain)
+	if err != nil {
+		return Assignment{}, err
+	}
+	backend, err := backendFromTask(task)
+	if err != nil {
+		return Assignment{}, err
+	}
+	return Assignment{
+		ID:       fmt.Sprintf("gitea-task-%d", task.GetId()),
+		Backend:  backend,
+		Task:     task,
+		Identity: identity,
+	}, nil
+}
+
+func backendFromTask(task *runnerv1.Task) (Backend, error) {
+	workflow, err := model.ReadWorkflow(bytes.NewReader(task.GetWorkflowPayload()))
+	if err != nil {
+		return "", fmt.Errorf("parse task workflow for backend: %w", err)
+	}
+	jobIDs := workflow.GetJobIDs()
+	if len(jobIDs) != 1 || workflow.GetJob(jobIDs[0]) == nil {
+		return "", fmt.Errorf("task workflow must contain exactly one non-empty job")
+	}
+	labels := workflow.GetJob(jobIDs[0]).RunsOnLabels()
+	if !slices.Contains(labels, "self-hosted") {
+		return "", fmt.Errorf("task runs-on labels must include self-hosted: %v", labels)
+	}
+	hasPod := slices.Contains(labels, string(BackendPod))
+	hasVM := slices.Contains(labels, string(BackendVM))
+	if hasPod == hasVM {
+		return "", fmt.Errorf("task runs-on labels must select exactly one of pod or vm: %v", labels)
+	}
+	if hasPod {
+		return BackendPod, nil
+	}
+	return BackendVM, nil
+}
+
+// Marshal encodes a versioned assignment. Protobuf preserves the exact Gitea task.
+func Marshal(assignment Assignment) ([]byte, error) {
+	if assignment.Task == nil {
+		return nil, errors.New("assignment task is required")
+	}
+	task, err := proto.Marshal(assignment.Task)
+	if err != nil {
+		return nil, fmt.Errorf("marshal Gitea task: %w", err)
+	}
+	return json.Marshal(envelope{
+		Version: wireVersion,
+		ID:      assignment.ID, Backend: assignment.Backend,
+		Task: task, Identity: assignment.Identity,
+	})
+}
+
+// Unmarshal re-derives trusted fields instead of trusting duplicated queue metadata.
+func Unmarshal(data []byte, trustDomain string) (Assignment, error) {
+	var wire envelope
+	if err := json.Unmarshal(data, &wire); err != nil {
+		return Assignment{}, fmt.Errorf("decode assignment: %w", err)
+	}
+	if wire.Version != wireVersion {
+		return Assignment{}, fmt.Errorf("unsupported assignment version %d", wire.Version)
+	}
+	task := new(runnerv1.Task)
+	if err := proto.Unmarshal(wire.Task, task); err != nil {
+		return Assignment{}, fmt.Errorf("unmarshal Gitea task: %w", err)
+	}
+	canonical, err := New(task, trustDomain)
+	if err != nil {
+		return Assignment{}, err
+	}
+	if wire.ID != canonical.ID || wire.Backend != canonical.Backend || wire.Identity != canonical.Identity {
+		return Assignment{}, errors.New("assignment metadata does not match its Gitea task")
+	}
+	return canonical, nil
+}

internal/taskassignment/assignment_test.go

@@ -0,0 +1,75 @@
+package taskassignment
+
+import (
+	"bytes"
+	"testing"
+
+	runnerv1 "gitea.dev/actionslib/runner/v1"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func task(t *testing.T, labels string) *runnerv1.Task {
+	t.Helper()
+	context, err := structpb.NewStruct(map[string]any{"repository": "owner/repo"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &runnerv1.Task{
+		Id:              42,
+		Context:         context,
+		WorkflowPayload: []byte("jobs:\n  publish:\n    runs-on: " + labels + "\n    steps: []\n"),
+	}
+}
+
+func TestNewSelectsBackendFromRunsOn(t *testing.T) {
+	for _, test := range []struct {
+		labels  string
+		backend Backend
+	}{
+		{"[self-hosted, pod]", BackendPod},
+		{"[self-hosted, vm]", BackendVM},
+	} {
+		assignment, err := New(task(t, test.labels), "ddupan.top")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if assignment.Backend != test.backend || assignment.ID != "gitea-task-42" {
+			t.Fatalf("assignment = %#v", assignment)
+		}
+	}
+}
+
+func TestNewRejectsAmbiguousBackend(t *testing.T) {
+	for _, labels := range []string{
+		"[self-hosted]",
+		"[self-hosted, pod, vm]",
+		"[pod]",
+	} {
+		if _, err := New(task(t, labels), "ddupan.top"); err == nil {
+			t.Fatalf("expected labels %s to fail", labels)
+		}
+	}
+}
+
+func TestAssignmentWireRoundTripAndValidation(t *testing.T) {
+	want, err := New(task(t, "[self-hosted, pod]"), "ddupan.top")
+	if err != nil {
+		t.Fatal(err)
+	}
+	data, err := Marshal(want)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := Unmarshal(data, "ddupan.top")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ID != want.ID || got.Backend != want.Backend || got.Identity != want.Identity || !bytes.Equal(got.Task.WorkflowPayload, want.Task.WorkflowPayload) {
+		t.Fatalf("round trip = %#v, want %#v", got, want)
+	}
+
+	tampered := bytes.Replace(data, []byte(`"backend":"pod"`), []byte(`"backend":"vm"`), 1)
+	if _, err := Unmarshal(tampered, "ddupan.top"); err == nil {
+		t.Fatal("expected tampered backend to fail")
+	}
+}