blob: 2748e49f21d1855ed5d051e5ebcfbb2601b3815d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
{ pkgs, ... }:
{
name = "github-runner";
meta = with pkgs.lib.maintainers; {
maintainers = [ veehaitch ];
};
nodes.machine =
{ pkgs, ... }:
let
appPrivateKey = pkgs.runCommand "github-app.pem" {
nativeBuildInputs = [ pkgs.openssl ];
} "openssl genrsa -out $out 2048";
in
{
services.github-runners.test = {
enable = true;
url = "https://github.com/yaxitech";
tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
};
services.github-runners.test-disabled = {
enable = false;
url = "https://github.com/yaxitech";
tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
};
# Runner authenticated via a GitHub App installation. This exercises the
# module evaluation and the App authentication code path up to the point it
# contacts the (stubbed) GitHub API; a successful registration would
# require talking to the real API.
services.github-runners.test-app = {
enable = true;
url = "https://github.com/yaxitech";
githubApp = {
id = 123456;
login = "yaxitech";
privateKeyFile = appPrivateKey;
};
};
# A single org/repo entry with `count > 1` fans out into one systemd
# service per replica, named `github-runner-<name>-<n>`.
services.github-runners.test-replicas = {
enable = true;
url = "https://github.com/yaxitech";
tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
count = 2;
};
# A single entry with `orgs` fans out into one systemd service per org and
# per replica, named `github-runner-<name>-<org>-<n>`.
services.github-runners.test-orgs = {
enable = true;
tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
orgs = {
yaxitech.count = 2;
another = { };
};
};
# `orgs` combined with a shared GitHub App: the same App is used for every
# org and only the per-org `login` changes (derived from the attribute
# name), so no entry-level `githubApp.login` is needed.
services.github-runners.test-orgs-app = {
enable = true;
githubApp = {
id = 123456;
privateKeyFile = appPrivateKey;
};
orgs = {
yaxitech = { };
"another-org" = { };
};
};
systemd.services.dummy-github-com = {
wantedBy = [ "multi-user.target" ];
before = [ "github-runner-test.service" ];
script = "${pkgs.netcat}/bin/nc -Fl 443 | true && touch /tmp/registration-connect";
};
networking.hosts."127.0.0.1" = [ "api.github.com" ];
};
testScript = ''
start_all()
machine.wait_for_unit("dummy-github-com")
try:
machine.wait_for_unit("github-runner-test")
except Exception:
pass
out = machine.succeed("journalctl -u github-runner-test")
assert "Self-hosted runner registration" in out, "did not read runner registration header"
machine.wait_until_succeeds("test -f /tmp/registration-connect")
# The GitHub App runner unit is generated and wired to the App auth path.
machine.succeed("systemctl cat github-runner-test-app.service | grep -F unconfigure-github-app")
# `count > 1` on a single entry fans out into one unit per replica with a
# `-<n>` suffix; there is no bare unit.
machine.succeed("systemctl cat github-runner-test-replicas-1.service")
machine.succeed("systemctl cat github-runner-test-replicas-2.service")
machine.fail("systemctl cat github-runner-test-replicas.service")
# `orgs` fans out into one unit per org and replica; there is no bare unit.
machine.succeed("systemctl cat github-runner-test-orgs-yaxitech-1.service")
machine.succeed("systemctl cat github-runner-test-orgs-yaxitech-2.service")
machine.succeed("systemctl cat github-runner-test-orgs-another-1.service")
machine.fail("systemctl cat github-runner-test-orgs.service")
# `orgs` with a shared GitHub App generates one App-authenticated unit per
# org, each with its per-org login derived from the attribute name.
machine.succeed("systemctl cat github-runner-test-orgs-app-yaxitech-1.service | grep -F unconfigure-github-app")
machine.succeed("systemctl cat github-runner-test-orgs-app-another-org-1.service | grep -F unconfigure-github-app")
machine.fail("systemctl list-unit-files | grep test-disabled")
'';
}
|
