Commit `d1680a097f`

d1680a097f126b17d9da6d067381f87b042ca8c8

parent: a5d7a5dfdc

Verified · cmc ci/build: success ci/test: success

cmc <hello@cleberg.net> · 2026-08-31 21:19 UTC

Let a runner name the repositories it builds

runner next claimed the oldest pending build in the whole queue, so every
runner executed every repository's steps. That is fine on the server and
rules out running one anywhere else: a runner on a machine that should
build one project would sooner or later claim someone else's build, and
with open registration that someone need not be known to the operator.

runner next now takes optional owner/name arguments and the runner takes
-repos. Empty means any, so an existing runner behaves as before.

The scoping is what the runner asks for, not an ACL the server holds over
it — the operator decides what a runner executes by how they start it.

Closes #66

Layout: unified · split

cmd/gitbay-runner/main.go +11 −1

 	cloneBase string // e.g. ssh://git@gitbay.org
 	workdir   string
 	timeout   time.Duration
+	// repos limits which repositories this runner claims builds for. Empty
+	// means any, which is what a runner on the server itself wants; a runner
+	// somewhere that should not execute every repository's steps names them.
+	repos []string
 }
 func main() {
 		workdir   = flag.String("workdir", filepath.Join(os.TempDir(), "gitbay-runner"), "build workspace root")
 		poll      = flag.Duration("poll", 5*time.Second, "idle poll interval")
 		timeout   = flag.Duration("timeout", 30*time.Minute, "per-build time limit")
+		repos     = flag.String("repos", "", "only claim builds for these repositories, comma-separated owner/name (default: any)")
 		once      = flag.Bool("once", false, "process at most one build, then exit")
 		version   = flag.Bool("version", false, "print the commit this binary was built from, then exit")
 	)
 	if *sshOpts != "" {
 		r.sshOpts = strings.Fields(*sshOpts)
 	}
+	for _, name := range strings.Split(*repos, ",") {
+		if name = strings.TrimSpace(name); name != "" {
+			r.repos = append(r.repos, name)
+		}
+	}
 	if r.cloneBase == "" {
 		r.cloneBase = "ssh://" + *remote
 	}
 // step claims and executes at most one build. ran reports whether there was
 // one, so the caller knows when to idle.
 func (r *runner) step() (bool, error) {
-	out, err := r.ssh(nil, "runner", "next", "--json")
+	out, err := r.ssh(nil, append([]string{"runner", "next"}, append(r.repos, "--json")...)...)
 	if err != nil {
 		return false, fmt.Errorf("claiming build: %w (%s)", err, out)
 	}

e2e/runner_scope_test.go added +60

@@ -0,0 +1,60 @@
	1	package e2e
	2
	3	import (
	4	"os"
	5	"path/filepath"
	6	"strings"
	7	"testing"
	8	)
	9
	10	// A runner names the repositories it will take builds for. Without that, any
	11	// runner claims whatever is next in the global queue, so a runner on a machine
	12	// that should only build one project ends up executing every repository's
	13	// steps — including those of a repository it has nothing to do with.
	14	func TestRunnerNextScopedToRepos(t *testing.T) {
	15	inst := startInstance(t)
	16	aliceKey := inst.newKey(t, "alice")
	17	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
	18	runnerKey := inst.newKey(t, "ci")
	19	inst.admin(t, "admin", "user", "create", "ci", "--key", runnerKey+".pub", "--admin")
	20
	21	// Two repositories, each with a build queued. "other" is pushed first, so
	22	// an unscoped claim would take it.
	23	for _, name := range []string{"other", "site"} {
	24	if _, errOut, code := inst.ssh(t, aliceKey, "", "repo", "create", "alice/"+name); code != 0 {
	25	t.Fatalf("repo create %s: %s", name, errOut)
	26	}
	27	work := t.TempDir()
	28	env := inst.gitEnv(aliceKey)
	29	mustGit(t, work, env, "clone", inst.sshURL("alice/"+name), "w")
	30	dir := filepath.Join(work, "w")
	31	os.MkdirAll(filepath.Join(dir, ".gitbay"), 0o755)
	32	os.WriteFile(filepath.Join(dir, ".gitbay", "ci.yml"), []byte(
	33	"jobs:\n "+name+":\n steps:\n - echo hi\n"), 0o644)
	34	mustGit(t, dir, env, "checkout", "-q", "-b", "main")
	35	mustGit(t, dir, env, "add", ".")
	36	mustGit(t, dir, env, "commit", "-q", "-m", "base")
	37	mustGit(t, dir, env, "push", "-q", "origin", "main")
	38	}
	39
	40	// Scoped to alice/site: takes the site build, not the older other build.
	41	out, errOut, code := inst.ssh(t, runnerKey, "", "runner", "next", "alice/site", "--json")
	42	if code != 0 {
	43	t.Fatalf("runner next: %s", errOut)
	44	}
	45	if !strings.Contains(out, `"repo":"alice/site"`) {
	46	t.Fatalf("scoped claim took the wrong repo:\n%s", out)
	47	}
	48
	49	// That scope is now empty, though alice/other is still pending.
	50	out, _, code = inst.ssh(t, runnerKey, "", "runner", "next", "alice/site", "--json")
	51	if code != 0 \|\| strings.Contains(out, `"repo":`) {
	52	t.Fatalf("scoped claim took a build outside its scope:\n%s", out)
	53	}
	54
	55	// An unscoped runner still takes it, so the default is unchanged.
	56	out, _, code = inst.ssh(t, runnerKey, "", "runner", "next", "--json")
	57	if code != 0 \|\| !strings.Contains(out, `"repo":"alice/other"`) {
	58	t.Fatalf("unscoped claim did not take the remaining build:\n%s", out)
	59	}
	60	}

internal/control/build.go +13 −2

 	// instance operator's call.
 	register(Command{Path: []string{"runner", "next"},
 		Summary: "claim the oldest pending build (runner protocol)",
-		Usage:   "runner next", SSHOnly: true, Run: runRunnerNext})
+		Usage:   "runner next [<owner/name>...]", SSHOnly: true, Run: runRunnerNext})
 	register(Command{Path: []string{"runner", "log"},
 		Summary: "append a build's log from stdin",
 		Usage:   "runner log <build-id>", SSHOnly: true, ReadsStdin: true, Run: runRunnerLog})
 				"build abandoned", url, c.User.ID)
 		}
 	}
-	b, ok, err := c.Store.ClaimBuild()
+	// A runner may limit itself to named repositories. The operator chooses
+	// what a given runner executes by how they start it; this is scoping the
+	// runner asks for, not an ACL the server holds over it.
+	var repoIDs []int64
+	for _, arg := range args {
+		repo, code := resolveRepo(c, arg, policy.CanRead)
+		if code >= 0 {
+			return code
+		}
+		repoIDs = append(repoIDs, repo.ID)
+	}
+	b, ok, err := c.Store.ClaimBuild(repoIDs)
 	if err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}

internal/store/builds.go +17 −2

 import (
 	"database/sql"
 	"errors"
+	"strings"
 	"time"
 )
 }
 // ClaimBuild atomically hands the oldest pending build to a runner.
-func (s *Store) ClaimBuild() (Build, bool, error) {
+// ClaimBuild takes the oldest pending build and marks it running. A
+// non-empty repoIDs restricts the claim to those repositories, which is how
+// a runner on a machine that should not execute every repository's steps
+// limits what it picks up.
+func (s *Store) ClaimBuild(repoIDs []int64) (Build, bool, error) {
 	tx, err := s.DB.Begin()
 	if err != nil {
 		return Build{}, false, err
 	}
 	defer tx.Rollback()
+	query := "SELECT id FROM builds WHERE status = 'pending' ORDER BY id LIMIT 1"
+	args := []any{}
+	if len(repoIDs) > 0 {
+		marks := strings.TrimSuffix(strings.Repeat("?,", len(repoIDs)), ",")
+		query = "SELECT id FROM builds WHERE status = 'pending' AND repo_id IN (" +
+			marks + ") ORDER BY id LIMIT 1"
+		for _, id := range repoIDs {
+			args = append(args, id)
+		}
+	}
 	var id int64
-	err = tx.QueryRow("SELECT id FROM builds WHERE status = 'pending' ORDER BY id LIMIT 1").Scan(&id)
+	err = tx.QueryRow(query, args...).Scan(&id)
 	if errors.Is(err, sql.ErrNoRows) {
 		return Build{}, false, nil
 	}

internal/store/builds_test.go +49 −1

	@@ -32,7 +32,7 @@ func TestReapStaleBuilds(t *testing.T) {
32		32
33	// Claim both, then age only the first past the deadline.	33	// Claim both, then age only the first past the deadline.
34	for range 2 {	34	for range 2 {
35	if _, ok, err := s.ClaimBuild(); err != nil \|\| !ok {	35	if _, ok, err := s.ClaimBuild(nil); err != nil \|\| !ok {
36	t.Fatalf("claim: %v ok=%v", err, ok)	36	t.Fatalf("claim: %v ok=%v", err, ok)
37	}	37	}
38	}	38	}
	@@ -118,3 +118,51 @@ func TestBuildsForCommitTiming(t *testing.T) {
118	t.Fatalf("unfinished build reported %s", d)	118	t.Fatalf("unfinished build reported %s", d)
119	}	119	}
120	}	120	}
		121
		122	// A runner that names repositories claims only their builds, so a runner on a
		123	// machine that should not execute every repository's steps does not pick one
		124	// up by being first to ask.
		125	func TestClaimBuildScopedToRepos(t *testing.T) {
		126	s := open(t)
		127	if err := s.MigrateUp(); err != nil {
		128	t.Fatal(err)
		129	}
		130	uid, err := s.CreateUser("cmc", true)
		131	if err != nil {
		132	t.Fatal(err)
		133	}
		134	mine, err := s.CreateRepo("user", uid, "site", "public")
		135	if err != nil {
		136	t.Fatal(err)
		137	}
		138	theirs, err := s.CreateRepo("user", uid, "stranger", "public")
		139	if err != nil {
		140	t.Fatal(err)
		141	}
		142	// Queued first, so an unscoped claim would take it.
		143	if _, err := s.CreateBuild(theirs, "evil", "abc123", "main", `["true"]`); err != nil {
		144	t.Fatal(err)
		145	}
		146	wanted, err := s.CreateBuild(mine, "deploy", "def456", "main", `["true"]`)
		147	if err != nil {
		148	t.Fatal(err)
		149	}
		150
		151	b, ok, err := s.ClaimBuild([]int64{mine})
		152	if err != nil \|\| !ok {
		153	t.Fatalf("claim: %v ok=%v", err, ok)
		154	}
		155	if b.RepoID != mine \|\| b.Number != wanted {
		156	t.Fatalf("claimed repo %d build %d, want repo %d build %d",
		157	b.RepoID, b.Number, mine, wanted)
		158	}
		159
		160	// Nothing left for that scope, even though another repo's build is pending.
		161	if _, ok, err := s.ClaimBuild([]int64{mine}); err != nil \|\| ok {
		162	t.Fatalf("second scoped claim: err=%v ok=%v, want no build", err, ok)
		163	}
		164	// An unscoped runner still takes it.
		165	if b, ok, err := s.ClaimBuild(nil); err != nil \|\| !ok \|\| b.RepoID != theirs {
		166	t.Fatalf("unscoped claim: err=%v ok=%v repo=%d", err, ok, b.RepoID)
		167	}
		168	}

Commit d1680a097f

Commit `d1680a097f`