mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
1a7e97fb14
Adds the executor a flow `script:` step runs on: a fresh Node child per step, a protocol over its IPC channel, and the two watchdogs that make a hung or runaway script the runner's problem rather than the host's. The step itself is not here. This branch stops at the executor and its unit tests; `feat/flow-script-step` stacks the YAML directive, the runner integration, and the reference docs on top. ## What it does - **One child per step.** Spawned with an old-space heap limit, an explicit working directory, and an environment built from an allowlist rather than copied from the tool server. - **A deadline and a lifeline.** A separate watchdog holds the deadline, so a script that wedges the event loop still dies on time; a second one reaps the whole process tree when the parent goes away, so a grandchild cannot outlive the run. - **A concurrency queue.** Slots are bounded per server. A step that never gets one is refused with a message that says so, and an aborted run frees its slot immediately. - **Log budgets.** 64 KiB per step and 256 KiB per run, counted on the bytes the report keeps: redaction and V8 frame collapsing both run before anything is counted, so what the limits bound is the size of the report rather than the size of the script's writes. - **Secret hold-back.** The scrub walks a chunk and stops where a value could still begin, so neither half of a value split across two chunks is released on its own, and a shorter value is never taken where the longer one containing it has not arrived yet. - **A failure taxonomy.** Twelve kinds, split into what the script did (it threw, it did not load, it exited non-zero, it wrote an unusable `output`) and what the host did to it (a limit, a signal, a spawn that failed, a queue slot it never got). ## Docs `packages/docs/docs/reference/configuration.mdx` lists the two configuration keys this branch adds, `scripts.maxTimeoutMs` and `scripts.heapLimitMb`. The `script:` step itself is documented with the step, on `feat/flow-script-step`. ## Verification `npm run build`, `npx eslint . --max-warnings 0`, `npx prettier --check .`, `npm run knip`, `npm run typecheck:scripts`, the test typecheck across every workspace, the tool-server suite (4719 passed, 1 skipped) and `npm run test:scripts` (92 tests) are green, as is `npx docusaurus build`. The executor's own behaviour is covered by the eight `test/flows/script/` files added here, against real child processes, and the compiled `dist/` executor was driven against its copied runner assets over every path the review reached. Each review fix carries the run that reproduced it before the change and the mutation that proves the new test fails without it: the prefix-secret leak and all three npm `node-options` routes were reproduced end to end through the executor against real child processes, and the five coverage findings were confirmed by re-applying the exact mutation each thread named. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added reliable execution of trusted flow scripts with concurrency control, cancellation, timeouts, memory limits, logging, and detailed failure reporting. * Added safeguards for process cleanup, watchdog termination, output validation, and secret redaction. * Added global configuration for maximum script runtime and memory usage. * **Bug Fixes** * Improved handling of script failures, stalled processes, malformed output, and child-process termination. * **Documentation** * Documented script resource limits and global configuration behavior. * **Chores** * Updated builds and packaging to include required flow-script runtime assets. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Hubert Gancarczyk <claude-hubert.gancarczyk@swmansion.com>
132 lines
5.4 KiB
YAML
132 lines
5.4 KiB
YAML
name: Vega VVD E2E (remote + screenshot)
|
|
|
|
# Regression guard for argent's Vega (Fire TV) `remote` + `screenshot` tools on a
|
|
# free GitHub-hosted runner. Builds THIS branch's tool-server, boots the Vega
|
|
# Virtual Device (VVD) via finloop/vega-virtual-device-action (a QEMU emulator in
|
|
# a Docker container, KVM-accelerated, software-GL — no GPU, no self-hosted
|
|
# runner), installs the kepler video sample app, and drives the two tools over
|
|
# the tool-server HTTP API (scripts/ci/vega-vvd-test.sh).
|
|
#
|
|
# Both tools are pure adb now: screenshot → `adb emu screenrecord`, remote →
|
|
# `adb shell inputd-cli button_press` (the channel proven to work on the CI VVD;
|
|
# the old vega-fast-cli host binary was a no-op there). So there is no
|
|
# per-platform binary, no glibc/arch handling, nothing to bundle. The Vega
|
|
# analogue of wayland-e2e.yml.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "packages/tool-server/src/tools/tv-remote/**"
|
|
- "packages/tool-server/src/tools/keyboard/index.ts"
|
|
- "packages/tool-server/src/tools/screenshot/index.ts"
|
|
- "packages/tool-server/src/tools/describe/platforms/vega/**"
|
|
- "packages/tool-server/src/tools/describe/platforms/vega.ts"
|
|
- "packages/tool-server/src/tools/devices/boot-device.ts"
|
|
- "packages/tool-server/src/tools/devices/list-devices.ts"
|
|
- "packages/tool-server/src/utils/vega-*.ts"
|
|
- "packages/tool-server/src/utils/device-info.ts"
|
|
- "scripts/ci/vega-vvd-test.sh"
|
|
- ".github/workflows/vega-vvd-e2e.yml"
|
|
|
|
concurrency:
|
|
group: vega-vvd-e2e-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Third-party actions and the fixture are pinned to immutable refs (this job runs
|
|
# on untrusted `pull_request`). Re-pin deliberately when bumping.
|
|
env:
|
|
KEPLER_FIXTURE_URL: "https://github.com/finloop/vega-virtual-device-action/releases/download/fixtures-keplervideoapp-0.22.1/keplervideoapp_aarch64.vpkg"
|
|
# Verified against the downloaded fixture below (the release tag is mutable).
|
|
KEPLER_FIXTURE_SHA256: "4ec7e0db348fe53bf3798410b4de1cf4aed5fc1f6935dff0b890d0611559201e"
|
|
|
|
jobs:
|
|
vega-vvd-e2e:
|
|
name: Boot VVD, drive remote + screenshot
|
|
# Pin to 24.04 to match the host container (ubuntu:24.04), so the
|
|
# runner-built node_modules native prebuilts (tree-sitter, esbuild) run
|
|
# unchanged inside it — same glibc, no cross-version skew.
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
# The action builds the host image on the runner (no registry pull).
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
# The host image is large (Vega SDK + emulator); reclaim runner disk first.
|
|
- name: Free disk space
|
|
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
|
|
with:
|
|
tool-cache: true
|
|
android: true
|
|
dotnet: true
|
|
haskell: true
|
|
large-packages: false
|
|
swap-storage: false
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "20"
|
|
|
|
# Build this branch's tool-server. The action runs it (node dist/index.js)
|
|
# inside the container against this bind-mounted node_modules + dist.
|
|
- name: Build tool-server
|
|
run: |
|
|
npm ci
|
|
npm run build
|
|
|
|
- name: Enable KVM
|
|
# The VVD's QEMU needs /dev/kvm; ubuntu runners expose it but the runner
|
|
# user isn't in the kvm group until this rule lands.
|
|
run: |
|
|
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
|
|
| sudo tee /etc/udev/rules.d/99-kvm4all.rules
|
|
sudo udevadm control --reload-rules
|
|
sudo udevadm trigger --name-match=kvm
|
|
|
|
- name: Download kepler video app fixture
|
|
# Prebuilt aarch64 Release vpkg (AmazonAppDev/vega-video-sample@v0.22.1),
|
|
# hosted on the action repo's fixtures release. Lands in the checkout so
|
|
# the action bind-mounts it into the container at /workspace/fixtures.
|
|
run: |
|
|
mkdir -p fixtures
|
|
curl -fsSL -o fixtures/keplervideoapp_aarch64.vpkg "$KEPLER_FIXTURE_URL"
|
|
# The release tag is mutable, so verify the asset's content against the
|
|
# pinned checksum — fail loudly if it changed under us.
|
|
echo "${KEPLER_FIXTURE_SHA256} fixtures/keplervideoapp_aarch64.vpkg" | sha256sum -c -
|
|
ls -la fixtures
|
|
|
|
- name: Boot VVD; drive remote + screenshot
|
|
id: vvd
|
|
# No `image:` → the action builds the host image on the runner, with the
|
|
# SDK version pinned via the action's `.sdk-version`.
|
|
uses: finloop/vega-virtual-device-action/vega-virtual-device-action@a0f17767abafb27ec9b58974d94643fc46a4a35d # main
|
|
with:
|
|
boot-timeout: 420
|
|
screenshot-path: artifacts/vvd-ready.png
|
|
container-options: -e KEPLER_VPKG=fixtures/keplervideoapp_aarch64.vpkg
|
|
script: |
|
|
set -ex
|
|
bash scripts/ci/vega-vvd-test.sh
|
|
|
|
- name: Show action outputs
|
|
if: always()
|
|
run: |
|
|
echo "boot-status=${{ steps.vvd.outputs.boot-status }}"
|
|
echo "screenshot=${{ steps.vvd.outputs.screenshot }}"
|
|
|
|
- name: Upload screenshots + logs
|
|
if: always()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: vega-vvd-e2e-artifacts
|
|
path: artifacts/
|
|
if-no-files-found: warn
|
|
retention-days: 7
|