fix: improve runner fidelity and real-world conformance

Merged
BN
1mo ago
+46426-368

Summary

  • Match hosted runner workspace and guest layout (_work/<repo>/<repo>, /home/runner)
  • Fix composite action context, node externals compatibility, services-only PATH, and indexed expressions
  • Decode gzip-encoded Git smart HTTP requests so full-history checkout works
  • Raise artifact block limit to the 8 MiB used by upload-artifact
  • Adopt matched smolvm 1.15.0/libkrun bundle and allow safe concurrent CoW forks
  • Retain snapshots briefly after terminal completion for slow/reconnecting claims
  • Add real-world conformance campaign harness and evidence

Verification

  • preloop-runner: 565 lib tests passed
  • preloop-gha-protocol: 72 lib tests passed
  • preloop-runner-server: snapshot/blob tests passed; clippy clean
  • preloop-orchestrator: 85 lib tests passed; clippy clean
  • Live proof: pytest fetch-depth 0 + package build, hugo codegen, jekyll profiler, nushell std-lib

Remaining environment gaps

  • Windows/macOS hosts, i386 execution, external Incredibuild fleets, credentials-gated checks, and host-specific packages remain explicit conformance limitations.

Summary by cubic

Improves runner fidelity with hosted GitHub Actions by matching workspace and toolchain behavior and fixing protocol, expression, action-context, artifact, and lifecycle edge cases. It also adds real-world conformance campaigns covering 10 new repositories and five varied repositories.

Bug Fixes

  • Matches hosted workspace and guest layouts, runner-owned home and Rust tool directories, and runtime toolchain resolution in official runner images.
  • Fixes composite action context and restores github.action_path after nested composite actions exit.
  • Supports indexed expression properties, matrix-based reusable inputs, and needs expressions inside matrix axes.
  • Handles node externals, services-only PATH, and empty PATH behavior.
  • Decodes gzip-encoded Git Smart HTTP requests with a decompression limit so full-history checkout works.
  • Raises the artifact block limit to the 8 MiB used by upload-artifact while preserving artifact list authorization.
  • Allows concurrent CoW forks, retains terminal snapshots for reconnecting claims, and guards step manifests against stale restarts.
  • Binds admin, artifact-v2, and Results routes to job runtime tokens.
  • Purges stale ephemeral runner identities at startup and requeues their unfinished jobs.

Conformance & Migration

  • Records final campaign reports and archived logs, including targeted proofs for workspace layout, full-history checkout, tool caches, code generation, and artifact limits.
  • Routes the five-repository harness through the server golden path and caps VM storage for local runs.
  • Stores GitHub credentials in the OS credential store via keyring; the harness no longer falls back to a gh-auth token.
  • Parks .github/workflows/supply-chain.yml in .gitignore until the cargo vet backlog is cleared.
  • Remaining gaps include Windows/macOS hosts, i386 execution, external Incredibuild fleets, credentials-gated checks, and host-specific packages.

Summary by CodeRabbit

  • New Features

    • Added support for dynamic bracket indexing in workflow expressions.
    • Improved resolution of matrices that depend on upstream job outputs.
    • Added a command for locating packed runner artifacts.

  • Bug Fixes

    • Improved compatibility with GitHub-style workspace layouts, tool caches, and runner paths.
    • Fixed nested action input scoping, action path resolution, and working-directory handling.
    • Added support for gzip-encoded Git requests and improved empty-PATH behavior.

  • Tests

    • Added conformance campaigns and recorded results across real-world repositories.