v1.25.0

Highlights

• A job file run by the embedded action uses the names the workflow gives its external actions under actions.
• A uses that names no action stops the run before its first job, and says which. This changes the exit status of such a run from 3 to 2.
• The dns action waits for a server as long as its timeout, not 2 seconds.
• For library users: actionrpc.Call.Actions, (*Job).UseActions, WithActions, WithBuiltinActions and their counterparts in embedded are new. Nothing breaks.

Names of external actions in embedded job files

v1.24.0 let a workflow name its external actions once, under actions. A job file run by the embedded action did not see the names, and had to name each action in full. It is now read by the names of the workflow that embeds it, in uses and in the keys of defaults:

# workflow.yml
actions:
  redis: github.com/mozership/probe-redis@7d60e0699a914e3c987ed5f2403ed8a7f3d176fa # v0.1.0

jobs:
- name: Session
  steps:
    - name: Check the session store
      uses: embedded
      with:
        path: "./jobs/session.yml"
      test: res.code == 0

# jobs/session.yml
name: Session store
defaults:
  redis:
    url: redis://localhost:6379
steps:
  - name: The store answers
    uses: redis
    with:
      commands: [PING]
    test: res.results[0] == "PONG"

• The commit is written once, in the workflow, for the job files it embeds as well. The job file has no actions of its own, so one embedded by two workflows runs the action each of them names.
• A job file embedded by a job file is read by the same names.
• A name that stands for a local path, as greet: ./greet does, stands for the directory next to the workflow file, wherever the job file is.
• Under a guard, --allow-action takes the action in full, not the name. For a name that stands for a local path, that is the absolute path of the directory in a job file.
• probe check reads the job file of an embedded step, and the ones that job embeds, when the path is not a template. It reports a uses that names no action, and an external action named wrongly, on the line of the path. It did not read job files before, so a job file with a misspelt action is now a finding.

See Named External Actions.

A uses that names no action stops the run

A uses that is not an external action was taken for an action of Probe and started as one. A name that is none, such as uses: shel, failed its step with the error of a plugin that did not start, which listed causes that were not the cause. In a job file run by embedded, the name was not shown at all.

A run now checks every uses before its first job, and stops with exit status 2:

[ERROR] configuration error in resolve_action: failed to resolve an action (caused by: job "first", step 1: unknown action "shel": it is not an action of Probe, an external action, or a name given under actions; did you mean "shell"?)

• The steps of the workflow are checked, and those of the job files its steps embed, when the path is written as it is or reads only the workflow's vars.
• A job file whose path only the run knows, such as one read from outputs, is checked as the embedded action starts the job. The step that embeds it fails with the same message.
• A path made from a declared secret is hidden in the error, as <secret:NAME>.

What changes for a workflow that has such a uses:

• It failed only when the step ran. It now stops before anything runs, even when the step would be skipped.
• Its exit status is 2, a configuration error, where it was 3, an action error.

probe check already reported an unknown action of a workflow, and still does.

dns waits as long as its timeout

The dns action of v1.24.0 gave up on a server that does not answer after 2 seconds, whatever its timeout: with the default 5s, or timeout: 30s, a step failed after 2 seconds with no answer from the DNS server, and did not say it had timed out.

• A step with server, or a machine with one resolver, waits as long as timeout says, and fails with timed out after <timeout>.
• Without server, each resolver of the machine is given an equal part of the time that is left, so that one that does not answer leaves time for the next. With two resolvers and 5s, the first has 2.5 seconds.

See DNS.

For library users

Nothing breaks in this release. New public API:

• actionrpc.Call.Actions, the names the workflow gives its external actions, each with the action in full, which Probe tells every action. pb.RunRequest has the field actions for it.
• (*Job).UseActions(names), which reads a job by such names, and the StandaloneOption WithActions(names), which tells them to the steps of a job RunStandalone runs.
• The StandaloneOption WithBuiltinActions(names), which stops a job before its first step for a uses that is not an external action or one of names.
• embedded.WithActions, embedded.WithBuiltinActions and embedded.ServeWithActions, by which the embedded action is given both.

Workflow.Start checks each uses against Config.Actions. With none given, nothing is checked and a run behaves as before.

Changelog

• 1493336 Check the job files a job file embeds, and the external actions they name
• 289ac56 Merge branch 'feat/embedded-action-names' into feat/unknown-action-before-run
• 03526af Merge branch 'main' of github.com:mozership/probe into feat/unknown-action-before-run
• b4b2314 Merge pull request #369 from mozership/feat/embedded-action-names
• 7aaef5d Merge pull request #370 from mozership/feat/unknown-action-before-run
• 13ca0fb Merge pull request #371 from mozership/fix/dns-timeout-race
• 73b53b6 Read a job the embedded action runs by the names of the workflow
• 65a941b Read embedded job files with the vars of the run, and mask the error
• 2bad2aa Stop a run before its first job for a uses that names no action
• b35a2a2 Take back what go fix rewrote in files this change touches
• 03cc2e3 Tell a DNS query that timed out as one when the connection finds it first
• 23e9544 Wait for a DNS server as long as the timeout of the step