归档：Kata / microVM runner 实验（2026-09-17 工作区快照）

从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17 stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。 Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-01 17:30:48 +00:00
parent 69d3476a6b
commit 55bb5be8b6
39 changed files with 1891 additions and 0 deletions
@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""Gitea workflow_job webhook to NATS JetStream producer."""
+
+import hashlib
+import hmac
+import json
+import os
+import ssl
+from pathlib import Path
+
+import nats
+from aiohttp import web
+from nats.js.api import DiscardPolicy, RetentionPolicy, StorageType, StreamConfig
+from nats.js.errors import NotFoundError
+
+LABEL = os.environ.get("RUNNER_LABEL", "kind-microvm")
+SUBJECT = os.environ.get("NATS_SUBJECT", f"ci.runner.{LABEL}")
+STREAM = os.environ.get("NATS_STREAM", "CI_RUNNER")
+NATS_URL = os.environ.get("NATS_URL", "tls://nats.nats.svc.cluster.local:4222")
+NATS_USER = os.environ.get("NATS_USER", "ci-producer")
+NATS_PASSWORD_FILE = Path(os.environ.get("NATS_PASSWORD_FILE", "/run/secrets/nats/password"))
+NATS_CA_FILE = os.environ.get("NATS_CA_FILE", "/etc/ssl/certs/ca-certificates.crt")
+WEBHOOK_SECRET_FILE = Path(os.environ.get("WEBHOOK_SECRET_FILE", "/run/secrets/gitea/webhook-secret"))
+
+
+def accepts(payload: object) -> tuple[bool, str | None]:
+    if not isinstance(payload, dict) or payload.get("action") != "queued":
+        return False, None
+    job = payload.get("workflow_job")
+    if not isinstance(job, dict) or LABEL not in job.get("labels", []):
+        return False, None
+    job_id = job.get("id")
+    if not isinstance(job_id, int):
+        return False, None
+    return True, str(job_id)
+
+
+def valid_signature(body: bytes, signature: str) -> bool:
+    expected = hmac.new(WEBHOOK_SECRET_FILE.read_bytes().strip(), body, hashlib.sha256).hexdigest()
+    return hmac.compare_digest(signature, expected)
+
+
+async def ensure_stream(js: object) -> None:
+    config = StreamConfig(
+        name=STREAM,
+        subjects=["ci.runner.*"],
+        retention=RetentionPolicy.WORK_QUEUE,
+        storage=StorageType.FILE,
+        discard=DiscardPolicy.OLD,
+        max_age=24 * 60 * 60,
+        max_msgs=10_000,
+        max_bytes=256 * 1024 * 1024,
+        duplicate_window=24 * 60 * 60,
+    )
+    try:
+        await js.stream_info(STREAM)
+    except NotFoundError:
+        await js.add_stream(config=config)
+    else:
+        await js.update_stream(config=config)
+
+
+async def webhook(request: web.Request) -> web.Response:
+    body = await request.read()
+    if not valid_signature(body, request.headers.get("X-Gitea-Signature", "")):
+        raise web.HTTPUnauthorized()
+    try:
+        payload = json.loads(body)
+    except json.JSONDecodeError as error:
+        raise web.HTTPBadRequest(text="invalid JSON\n") from error
+    accepted, job_id = accepts(payload)
+    if not accepted:
+        return web.Response(status=204)
+    await request.app["js"].publish(
+        SUBJECT,
+        body,
+        headers={"Nats-Msg-Id": f"gitea-workflow-job-{job_id}"},
+    )
+    return web.Response(status=202, text="queued\n")
+
+
+async def health(request: web.Request) -> web.Response:
+    return web.Response(text="ok\n" if request.app["nc"].is_connected else "disconnected\n",
+                        status=200 if request.app["nc"].is_connected else 503)
+
+
+async def nats_context(app: web.Application):
+    tls = ssl.create_default_context(cafile=NATS_CA_FILE)
+    nc = await nats.connect(
+        NATS_URL,
+        user=NATS_USER,
+        password=NATS_PASSWORD_FILE.read_text().strip(),
+        tls=tls,
+        name="microvm-runner-controller",
+    )
+    app["nc"] = nc
+    app["js"] = nc.jetstream()
+    await ensure_stream(app["js"])
+    yield
+    await nc.drain()
+
+
+def create_app() -> web.Application:
+    app = web.Application(client_max_size=1024 * 1024)
+    app.cleanup_ctx.append(nats_context)
+    app.router.add_post("/webhook", webhook)
+    app.router.add_get("/healthz", health)
+    return app
+
+
+if __name__ == "__main__":
+    web.run_app(create_app(), host=os.environ.get("LISTEN", "0.0.0.0"),
+                port=int(os.environ.get("PORT", "8787")))