refactor: separate workload class from placement driver

internal/taskassignment/assignment.go

@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"slices"
 	"strconv"
 
 	"gitea.dev/actionslib/pkg/model"
@@ -16,34 +15,27 @@ import (
 	"git.ddupan.top/panxiao81/gitea-dynamic-runner/internal/taskidentity"
 )
 
-const wireVersion = 1
-
-type Backend string
-
-const (
-	BackendPod Backend = "pod"
-	BackendVM  Backend = "vm"
-)
+const wireVersion = 2
 
 // Assignment is the only document persisted in the handoff queue.
 type Assignment struct {
-	ID       string
-	Backend  Backend
-	Task     *runnerv1.Task
-	Identity taskidentity.Identity
+	ID        string
+	Placement Placement
+	Task      *runnerv1.Task
+	Identity  taskidentity.Identity
 }
 
 // FromMetadata reconstructs the minimal assignment needed to authorize an
-// already-running executor after a controller restart. Backend metadata was
+// already-running executor after a controller restart. Placement metadata was
 // originally derived from the trusted Gitea task and is validated again here.
 func FromMetadata(labels, annotations map[string]string, trustDomain string) (Assignment, error) {
 	taskID, err := strconv.ParseInt(labels["ci.ddupan.top/task-id"], 10, 64)
 	if err != nil || taskID < 1 {
 		return Assignment{}, errors.New("backend metadata has invalid task ID")
 	}
-	backend := Backend(labels["ci.ddupan.top/backend"])
-	if backend != BackendPod && backend != BackendVM {
-		return Assignment{}, errors.New("backend metadata has invalid backend")
+	placement := Placement{Class: WorkloadClass(labels["ci.ddupan.top/workload-class"]), Driver: Driver(labels["ci.ddupan.top/driver"])}
+	if err := placement.Validate(); err != nil {
+		return Assignment{}, err
 	}
 	id := labels["ci.ddupan.top/assignment-id"]
 	if id != fmt.Sprintf("gitea-task-%d", taskID) {
@@ -56,15 +48,15 @@ func FromMetadata(labels, annotations map[string]string, trustDomain string) (As
 	if err != nil {
 		return Assignment{}, err
 	}
-	return Assignment{ID: id, Backend: backend, Task: &runnerv1.Task{Id: taskID}, Identity: identity}, nil
+	return Assignment{ID: id, Placement: placement, Task: &runnerv1.Task{Id: taskID}, Identity: identity}, nil
 }
 
 type envelope struct {
-	Version  int                   `json:"version"`
-	ID       string                `json:"id"`
-	Backend  Backend               `json:"backend"`
-	Task     []byte                `json:"task"`
-	Identity taskidentity.Identity `json:"identity"`
+	Version   int                   `json:"version"`
+	ID        string                `json:"id"`
+	Placement Placement             `json:"placement"`
+	Task      []byte                `json:"task"`
+	Identity  taskidentity.Identity `json:"identity"`
 }
 
 // New derives all trusted assignment fields from the task fetched from Gitea.
@@ -76,40 +68,28 @@ func New(task *runnerv1.Task, trustDomain string) (Assignment, error) {
 	if err != nil {
 		return Assignment{}, err
 	}
-	backend, err := backendFromTask(task)
+	placement, err := placementFromTask(task)
 	if err != nil {
 		return Assignment{}, err
 	}
 	return Assignment{
-		ID:       fmt.Sprintf("gitea-task-%d", task.GetId()),
-		Backend:  backend,
-		Task:     task,
-		Identity: identity,
+		ID:        fmt.Sprintf("gitea-task-%d", task.GetId()),
+		Placement: placement,
+		Task:      task,
+		Identity:  identity,
 	}, nil
 }
 
-func backendFromTask(task *runnerv1.Task) (Backend, error) {
+func placementFromTask(task *runnerv1.Task) (Placement, error) {
 	workflow, err := model.ReadWorkflow(bytes.NewReader(task.GetWorkflowPayload()))
 	if err != nil {
-		return "", fmt.Errorf("parse task workflow for backend: %w", err)
+		return Placement{}, fmt.Errorf("parse task workflow for placement: %w", err)
 	}
 	jobIDs := workflow.GetJobIDs()
 	if len(jobIDs) != 1 || workflow.GetJob(jobIDs[0]) == nil {
-		return "", fmt.Errorf("task workflow must contain exactly one non-empty job")
+		return Placement{}, fmt.Errorf("task workflow must contain exactly one non-empty job")
 	}
-	labels := workflow.GetJob(jobIDs[0]).RunsOnLabels()
-	if !slices.Contains(labels, "self-hosted") {
-		return "", fmt.Errorf("task runs-on labels must include self-hosted: %v", labels)
-	}
-	hasPod := slices.Contains(labels, string(BackendPod))
-	hasVM := slices.Contains(labels, string(BackendVM)) || slices.Contains(labels, "vm-dev")
-	if hasPod == hasVM {
-		return "", fmt.Errorf("task runs-on labels must select exactly one of pod or vm: %v", labels)
-	}
-	if hasPod {
-		return BackendPod, nil
-	}
-	return BackendVM, nil
+	return PlacementFromLabels(workflow.GetJob(jobIDs[0]).RunsOnLabels())
 }
 
 // Marshal encodes a versioned assignment. Protobuf preserves the exact Gitea task.
@@ -117,13 +97,16 @@ func Marshal(assignment Assignment) ([]byte, error) {
 	if assignment.Task == nil {
 		return nil, errors.New("assignment task is required")
 	}
+	if err := assignment.Placement.Validate(); err != nil {
+		return nil, err
+	}
 	task, err := proto.Marshal(assignment.Task)
 	if err != nil {
 		return nil, fmt.Errorf("marshal Gitea task: %w", err)
 	}
 	return json.Marshal(envelope{
 		Version: wireVersion,
-		ID:      assignment.ID, Backend: assignment.Backend,
+		ID:      assignment.ID, Placement: assignment.Placement,
 		Task: task, Identity: assignment.Identity,
 	})
 }
@@ -145,7 +128,7 @@ func Unmarshal(data []byte, trustDomain string) (Assignment, error) {
 	if err != nil {
 		return Assignment{}, err
 	}
-	if wire.ID != canonical.ID || wire.Backend != canonical.Backend || wire.Identity != canonical.Identity {
+	if wire.ID != canonical.ID || wire.Placement != canonical.Placement || wire.Identity != canonical.Identity {
 		return Assignment{}, errors.New("assignment metadata does not match its Gitea task")
 	}
 	return canonical, nil

internal/taskassignment/assignment_test.go

@@ -21,29 +21,37 @@ func task(t *testing.T, labels string) *runnerv1.Task {
 	}
 }
 
-func TestNewSelectsBackendFromRunsOn(t *testing.T) {
+func TestNewSelectsPlacementFromRunsOn(t *testing.T) {
 	for _, test := range []struct {
-		labels  string
-		backend Backend
+		labels    string
+		placement Placement
 	}{
-		{"[self-hosted, pod]", BackendPod},
-		{"[self-hosted, vm]", BackendVM},
-		{"[self-hosted, vm-dev]", BackendVM},
+		{"[self-hosted, pod]", KubernetesContainer},
+		{"[self-hosted, container]", KubernetesContainer},
+		{"[self-hosted, container, kubernetes]", KubernetesContainer},
+		{"[self-hosted, vm]", OpenSandboxVM},
+		{"[self-hosted, vm-dev]", OpenSandboxVM},
+		{"[self-hosted, vm, opensandbox]", OpenSandboxVM},
 	} {
 		assignment, err := New(task(t, test.labels), "ddupan.top")
 		if err != nil {
 			t.Fatal(err)
 		}
-		if assignment.Backend != test.backend || assignment.ID != "gitea-task-42" {
+		if assignment.Placement != test.placement || assignment.ID != "gitea-task-42" {
 			t.Fatalf("assignment = %#v", assignment)
 		}
 	}
 }
 
-func TestNewRejectsAmbiguousBackend(t *testing.T) {
+func TestNewRejectsInvalidPlacement(t *testing.T) {
 	for _, labels := range []string{
 		"[self-hosted]",
 		"[self-hosted, pod, vm]",
+		"[self-hosted, pod, container]",
+		"[self-hosted, pod, kubernetes]",
+		"[self-hosted, container, opensandbox]",
+		"[self-hosted, vm, kubernetes]",
+		"[self-hosted, container, kubernetes, opensandbox]",
 		"[pod]",
 	} {
 		if _, err := New(task(t, labels), "ddupan.top"); err == nil {
@@ -65,27 +73,28 @@ func TestAssignmentWireRoundTripAndValidation(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got.ID != want.ID || got.Backend != want.Backend || got.Identity != want.Identity || !bytes.Equal(got.Task.WorkflowPayload, want.Task.WorkflowPayload) {
+	if got.ID != want.ID || got.Placement != want.Placement || got.Identity != want.Identity || !bytes.Equal(got.Task.WorkflowPayload, want.Task.WorkflowPayload) {
 		t.Fatalf("round trip = %#v, want %#v", got, want)
 	}
 
-	tampered := bytes.Replace(data, []byte(`"backend":"pod"`), []byte(`"backend":"vm"`), 1)
+	tampered := bytes.Replace(data, []byte(`"driver":"kubernetes"`), []byte(`"driver":"opensandbox"`), 1)
 	if _, err := Unmarshal(tampered, "ddupan.top"); err == nil {
-		t.Fatal("expected tampered backend to fail")
+		t.Fatal("expected tampered placement to fail")
 	}
 }
 
 func TestFromMetadataRecoversMinimalAssignment(t *testing.T) {
 	assignment, err := FromMetadata(map[string]string{
-		"ci.ddupan.top/assignment-id": "gitea-task-42",
-		"ci.ddupan.top/task-id":       "42",
-		"ci.ddupan.top/backend":       "vm",
+		"ci.ddupan.top/assignment-id":  "gitea-task-42",
+		"ci.ddupan.top/task-id":        "42",
+		"ci.ddupan.top/workload-class": "vm",
+		"ci.ddupan.top/driver":         "opensandbox",
 	}, map[string]string{
 		"ci.ddupan.top/repository": "owner/repo",
 		"ci.ddupan.top/job-key":    "publish",
 		"ci.ddupan.top/spiffe-id":  "spiffe://ddupan.top/ci/owner/repo/publish",
 	}, "ddupan.top")
-	if err != nil || assignment.Task.GetId() != 42 || assignment.Backend != BackendVM {
+	if err != nil || assignment.Task.GetId() != 42 || assignment.Placement != OpenSandboxVM {
 		t.Fatalf("assignment=%#v err=%v", assignment, err)
 	}
 }

internal/taskassignment/placement.go

@@ -0,0 +1,76 @@
+package taskassignment
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+)
+
+type WorkloadClass string
+
+const (
+	WorkloadContainer WorkloadClass = "container"
+	WorkloadVM        WorkloadClass = "vm"
+)
+
+type Driver string
+
+const (
+	DriverKubernetes  Driver = "kubernetes"
+	DriverOpenSandbox Driver = "opensandbox"
+)
+
+type Placement struct {
+	Class  WorkloadClass `json:"workload_class"`
+	Driver Driver        `json:"driver"`
+}
+
+var (
+	KubernetesContainer = Placement{Class: WorkloadContainer, Driver: DriverKubernetes}
+	OpenSandboxVM       = Placement{Class: WorkloadVM, Driver: DriverOpenSandbox}
+)
+
+func (p Placement) Validate() error {
+	switch p {
+	case KubernetesContainer, OpenSandboxVM:
+		return nil
+	default:
+		return fmt.Errorf("unsupported workload placement %s/%s", p.Class, p.Driver)
+	}
+}
+
+func (p Placement) Key() string { return string(p.Class) + "." + string(p.Driver) }
+
+func PlacementFromLabels(labels []string) (Placement, error) {
+	if !slices.Contains(labels, "self-hosted") {
+		return Placement{}, fmt.Errorf("task runs-on labels must include self-hosted: %v", labels)
+	}
+	legacyPod := slices.Contains(labels, "pod")
+	container := slices.Contains(labels, string(WorkloadContainer))
+	vm := slices.Contains(labels, string(WorkloadVM)) || slices.Contains(labels, "vm-dev")
+	kubernetes := slices.Contains(labels, string(DriverKubernetes))
+	opensandbox := slices.Contains(labels, string(DriverOpenSandbox))
+
+	if legacyPod {
+		if container || vm || kubernetes || opensandbox {
+			return Placement{}, errors.New("legacy pod label cannot be combined with workload or VM driver labels")
+		}
+		return KubernetesContainer, nil
+	}
+	if container == vm {
+		return Placement{}, fmt.Errorf("task runs-on labels must select exactly one workload class: %v", labels)
+	}
+	if kubernetes && opensandbox {
+		return Placement{}, fmt.Errorf("task runs-on labels select multiple drivers: %v", labels)
+	}
+	if container {
+		if opensandbox {
+			return Placement{}, fmt.Errorf("opensandbox does not support container workloads")
+		}
+		return KubernetesContainer, nil
+	}
+	if kubernetes {
+		return Placement{}, fmt.Errorf("kubernetes does not support VM workloads")
+	}
+	return OpenSandboxVM, nil
+}