Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support actions/upload-artifact@v4, actions/download-artifact@v4 #28853

Closed
lunny opened this issue Jan 19, 2024 · 4 comments · Fixed by #28965
Closed

Support actions/upload-artifact@v4, actions/download-artifact@v4 #28853

lunny opened this issue Jan 19, 2024 · 4 comments · Fixed by #28965
Labels
topic/gitea-actions related to the actions of Gitea type/proposal The new feature has not been accepted yet but needs to be discussed first.
Milestone

Comments

@lunny
Copy link
Member

lunny commented Jan 19, 2024

Feature Description

The v4 has a different protocol than before.

Screenshots

No response

@lunny lunny added type/proposal The new feature has not been accepted yet but needs to be discussed first. topic/gitea-actions related to the actions of Gitea labels Jan 19, 2024
@ChristopherHX
Copy link
Contributor

ChristopherHX commented Jan 20, 2024

Could be helpful: nektos/act#2135

I have had already reverse engineered this to run locally.

Currently we would also have to patch away the GHES not supported flag in the client code to actually test it via gitea.

@ChristopherHX
Copy link
Contributor

Does Gitea Allow JWT Auth already? I'm not that familar with Gitea's Server Code.

The old artifacts v3 backend uses some sort of PAT token.

GitHub reads the scp claim of the ACTIONS_RUNTIME_TOKEN as jwt or throws

@ChristopherHX
Copy link
Contributor

I'm trying to transist the ACTIONS_RUNTIME_TOKEN to jwt in #28885 using a backward compatible way. Requires runner changes.

In case you wonder why this is needed here the error message

| Artifact name is valid!
| Root directory input is valid!
[e.yml/_0]   ❗  ::error::Failed to get backend IDs: The provided JWT token is invalid and/or missing claims
[e.yml/_0]   ❌  Failure - Main actions/upload-artifact@v4

After this change to both runner and server, we get

[e.yml/_0]   💬  ::debug::Workflow Run Backend ID: 17
[e.yml/_0]   💬  ::debug::Workflow Job Run Backend ID: 45
[e.yml/_0]   ❗  ::error::Unable to get the ACTIONS_RESULTS_URL env variable

assigning ACTIONS_RESULTS_URL and implementing the backend in gitea is an open task. I did this in my runner.server project in December and it is possible to do.

@lunny lunny added this to the 1.22.0 milestone Jan 22, 2024
@ChristopherHX
Copy link
Contributor

ChristopherHX commented Jan 22, 2024

Uploading POC works for me locally using further Gitea changes

on:
  push:
jobs:
  _0:
    runs-on: self-hosted
    steps:
    - run: env
    - run: |
        github:
        ${{ tojson(github) }}
        inputs:
        ${{ tojson(inputs) }}
        matrix:
        ${{ tojson(matrix) }}
        needs:
        ${{ tojson(needs) }}
        strategy:
        ${{ tojson(strategy) }}                
      shell: cp {0} context.txt
    - uses: christopherhx/gitea-upload-artifact@v4
      with:
        name: test
        path: context.txt

image

ChristopherHX/gitea@jwt-based-actions-runtime-token...ChristopherHX:gitea:gitea-artifacts-v4

Until finished, I'm not yet open a PR. Just for your information of the current state.

act_runner also need to set ACTIONS_RESULTS_URL to gitea.server_url.
Gitea Hosted with subpath in server_url are not supported

christopherhx/gitea-upload-artifact@v4 and christopherhx/gitea-download-artifact@v4 are removing the GHES error message until GitHub removes the not supported fatal error themself.

I don't like how GitHub blocks GHES using hardcoded asserts, until they support them officially

image

Download artifact now working as well.......

lunny pushed a commit that referenced this issue Feb 2, 2024
This change allows act_runner / actions_runner to use jwt tokens for
`ACTIONS_RUNTIME_TOKEN` that are compatible with
actions/upload-artifact@v4.

The official Artifact actions are now validating and extracting the jwt
claim scp to get the runid and jobid, the old artifact backend also
needs to accept the same token jwt.

---
Related to #28853

I'm not familar with the auth system, maybe you know how to improve this

I have tested
- the jwt token is a valid token for artifact uploading
- the jwt token can be parsed by actions/upload-artifact@v4 and passes
their scp claim validation

Next steps would be a new artifacts@v4 backend.

~~I'm linking the act_runner change soonish.~~
act_runner change to make the change effective and use jwt tokens
<https://gitea.com/gitea/act_runner/pulls/471>
silverwind pushed a commit to silverwind/gitea that referenced this issue Feb 20, 2024
This change allows act_runner / actions_runner to use jwt tokens for
`ACTIONS_RUNTIME_TOKEN` that are compatible with
actions/upload-artifact@v4.

The official Artifact actions are now validating and extracting the jwt
claim scp to get the runid and jobid, the old artifact backend also
needs to accept the same token jwt.

---
Related to go-gitea#28853

I'm not familar with the auth system, maybe you know how to improve this

I have tested
- the jwt token is a valid token for artifact uploading
- the jwt token can be parsed by actions/upload-artifact@v4 and passes
their scp claim validation

Next steps would be a new artifacts@v4 backend.

~~I'm linking the act_runner change soonish.~~
act_runner change to make the change effective and use jwt tokens
<https://gitea.com/gitea/act_runner/pulls/471>
lunny pushed a commit that referenced this issue Mar 2, 2024
Fixes #28853 

Needs both https://gitea.com/gitea/act_runner/pulls/473 and
https://gitea.com/gitea/act_runner/pulls/471 on the runner side and
patched `actions/upload-artifact@v4` / `actions/download-artifact@v4`,
like `christopherhx/gitea-upload-artifact@v4` and
`christopherhx/gitea-download-artifact@v4`, to not return errors due to
GHES not beeing supported yet.
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 13, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
topic/gitea-actions related to the actions of Gitea type/proposal The new feature has not been accepted yet but needs to be discussed first.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants