144 lines
4.7 KiB
Python
144 lines
4.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Gitea workflow_job webhook to the OpenSandbox Lifecycle API."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
import logging
|
|
import os
|
|
from pathlib import Path
|
|
|
|
from aiohttp import web
|
|
|
|
from .models import RunnerRequest
|
|
from .opensandbox import OpenSandboxClient
|
|
from .opensandbox_worker import OpenSandboxScheduler, RegistrationTokens
|
|
|
|
|
|
LOG = logging.getLogger(__name__)
|
|
WEBHOOK_SECRET_FILE = Path(
|
|
os.environ.get("WEBHOOK_SECRET_FILE", "/run/secrets/gitea/webhook-secret")
|
|
)
|
|
REGISTRATION_TOKEN_FILE = Path(
|
|
os.environ.get(
|
|
"REGISTRATION_TOKEN_FILE", "/run/secrets/gitea/registration-token"
|
|
)
|
|
)
|
|
OPENSANDBOX_API = os.environ.get(
|
|
"OPENSANDBOX_API", "http://10.60.0.13:8080"
|
|
)
|
|
OPENSANDBOX_API_KEY_FILE = Path(
|
|
os.environ.get(
|
|
"OPENSANDBOX_API_KEY_FILE",
|
|
"/run/secrets/opensandbox/api-key",
|
|
)
|
|
)
|
|
|
|
|
|
def accepts(payload: object) -> tuple[bool, str | None]:
|
|
request = RunnerRequest.from_webhook(payload)
|
|
return (request is not None, str(request.job_id) if request else None)
|
|
|
|
|
|
def valid_signature(body: bytes, signature: str) -> bool:
|
|
expected = hmac.new(
|
|
WEBHOOK_SECRET_FILE.read_bytes().strip(), body, hashlib.sha256
|
|
).hexdigest()
|
|
return hmac.compare_digest(signature.removeprefix("sha256="), expected)
|
|
|
|
|
|
async def webhook(request: web.Request) -> web.Response:
|
|
body = await request.read()
|
|
if not valid_signature(body, request.headers.get("X-Gitea-Signature", "")):
|
|
raise web.HTTPUnauthorized()
|
|
try:
|
|
payload = json.loads(body)
|
|
except json.JSONDecodeError as error:
|
|
raise web.HTTPBadRequest(text="invalid JSON\n") from error
|
|
context = _webhook_context(payload)
|
|
LOG.info("workflow_job webhook received %s", context)
|
|
|
|
runner_request = RunnerRequest.from_webhook(payload)
|
|
if runner_request is None:
|
|
LOG.info("workflow_job webhook ignored %s", context)
|
|
return web.Response(status=204)
|
|
|
|
scheduler: OpenSandboxScheduler = request.app["scheduler"]
|
|
try:
|
|
sandbox_id = await scheduler.create(runner_request)
|
|
except ValueError as error:
|
|
LOG.info("duplicate workflow_job webhook ignored: %s", error)
|
|
return web.Response(status=202, text="already scheduled\n")
|
|
except Exception:
|
|
LOG.exception("failed to create OpenSandbox runner %s", context)
|
|
raise web.HTTPServiceUnavailable(text="sandbox unavailable\n")
|
|
return web.Response(status=202, text=f"sandbox={sandbox_id}\n")
|
|
|
|
|
|
async def registration_token(request: web.Request) -> web.Response:
|
|
scheduler: OpenSandboxScheduler = request.app["scheduler"]
|
|
value = await scheduler.tokens.consume(request.match_info["nonce"])
|
|
if value is None:
|
|
raise web.HTTPNotFound()
|
|
return web.Response(body=value, headers={"Cache-Control": "no-store"})
|
|
|
|
|
|
def _webhook_context(payload: object) -> str:
|
|
if not isinstance(payload, dict):
|
|
return f"payload_type={type(payload).__name__}"
|
|
job = payload.get("workflow_job")
|
|
repository = payload.get("repository")
|
|
job = job if isinstance(job, dict) else {}
|
|
repository = repository if isinstance(repository, dict) else {}
|
|
return (
|
|
f"action={payload.get('action')!r} job_id={job.get('id')!r} "
|
|
f"run_id={job.get('run_id')!r} runner_name={job.get('runner_name')!r} "
|
|
f"repository={repository.get('full_name')!r} job_name={job.get('name')!r} "
|
|
f"labels={job.get('labels')!r}"
|
|
)
|
|
|
|
|
|
async def health(request: web.Request) -> web.Response:
|
|
client: OpenSandboxClient = request.app["opensandbox_client"]
|
|
return web.Response(
|
|
text="ok\n" if client.session is not None else "disconnected\n",
|
|
status=200 if client.session is not None else 503,
|
|
)
|
|
|
|
|
|
async def opensandbox_context(app: web.Application):
|
|
tokens = RegistrationTokens(REGISTRATION_TOKEN_FILE.read_bytes())
|
|
async with OpenSandboxClient(
|
|
api_url=OPENSANDBOX_API,
|
|
api_key_file=OPENSANDBOX_API_KEY_FILE,
|
|
) as client:
|
|
scheduler = OpenSandboxScheduler(client, tokens)
|
|
app["opensandbox_client"] = client
|
|
app["scheduler"] = scheduler
|
|
yield
|
|
await scheduler.close()
|
|
|
|
|
|
def create_app() -> web.Application:
|
|
app = web.Application(client_max_size=1024 * 1024)
|
|
app.cleanup_ctx.append(opensandbox_context)
|
|
app.router.add_post("/webhook", webhook)
|
|
app.router.add_get("/token/{nonce}", registration_token)
|
|
app.router.add_get("/healthz", health)
|
|
return app
|
|
|
|
|
|
def main() -> None:
|
|
logging.basicConfig(level=os.environ.get("LOG_LEVEL", "INFO"))
|
|
web.run_app(
|
|
create_app(),
|
|
host=os.environ.get("LISTEN", "0.0.0.0"),
|
|
port=int(os.environ.get("PORT", "8787")),
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|