feat: artifact push and pull actions

internal/pull/pull.go

@@ -0,0 +1,250 @@
+package pull
+
+import (
+	"archive/zip"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"code.geekeey.de/actions/sdk"
+	"code.geekeey.de/actions/sdk/artifact"
+)
+
+type Action struct {
+	*sdk.Action
+}
+
+func New(action *sdk.Action) *Action {
+	return &Action{Action: action}
+}
+
+type config struct {
+	Name       string
+	Path       string
+	Repository string
+	RunID      string
+	Token      string
+}
+
+func parseConfig(get func(string) string) (*config, error) {
+	name := get("name")
+	if len(name) == 0 {
+		return nil, fmt.Errorf("input 'name': is empty")
+	}
+
+	path := get("path")
+	if len(path) == 0 {
+		path = "."
+	}
+	return &config{
+		Name:       name,
+		Path:       path,
+		Repository: get("repository"),
+		RunID:      get("run-id"),
+		Token:      get("github-token"),
+	}, nil
+}
+
+func (a *Action) Run(ctx context.Context) error {
+	cfg, err := parseConfig(a.GetInput)
+	if err != nil {
+		return err
+	}
+
+	// Only use the repository API when the artifact lives in another repository
+	// or another run. For the current run the results service is used instead.
+	if useRepositoryAPI(cfg, a.Context()) {
+		return a.pullFromRepository(ctx, cfg)
+	}
+
+	run, job, err := artifact.JobInfo()
+	if err != nil {
+		return fmt.Errorf("unable to get job info: %v", err)
+	}
+
+	client := artifact.NewClientFromEnv(os.Getenv)
+
+	signed, err := client.GetSignedArtifactURL(ctx, artifact.GetSignedArtifactURLRequest{
+		RunID:    run,
+		JobRunID: job,
+		Name:     cfg.Name,
+	})
+	if err != nil {
+		return fmt.Errorf("cannot get signed artifact URL: %w", err)
+	}
+	if signed.SignedUrl == "" {
+		return fmt.Errorf("no signed URL for artifact %q", cfg.Name)
+	}
+
+	tmp, err := os.CreateTemp("", "artifact-*.zip")
+	if err != nil {
+		return fmt.Errorf("cannot create temporary file: %w", err)
+	}
+	defer os.Remove(tmp.Name())
+	defer tmp.Close()
+
+	res, err := artifact.PullBlob(ctx, nil, tmp, signed.SignedUrl)
+	if err != nil {
+		return fmt.Errorf("cannot download artifact: %w", err)
+	}
+
+	if err := extractArchive(tmp.Name(), cfg.Path); err != nil {
+		return fmt.Errorf("cannot extract artifact: %w", err)
+	}
+
+	a.SetOutput("download-path", downloadPath(cfg.Path))
+	a.Noticef("downloaded artifact %s (%d bytes)", cfg.Name, res.Size)
+	return nil
+}
+
+// useRepositoryAPI reports whether the configured repository/run differs from
+// the current one and therefore has to be resolved through the repository API.
+// Empty values mean "current".
+func useRepositoryAPI(cfg *config, gh *sdk.GitHubContext) bool {
+	if cfg.Repository != "" && cfg.Repository != gh.Repository {
+		return true
+	}
+	if cfg.RunID != "" && cfg.RunID != gh.RunID {
+		return true
+	}
+	return false
+}
+
+// pullFromRepository downloads an artifact from a specific repository run using
+// the repository-scoped actions API, so it works across runs and repositories.
+func (a *Action) pullFromRepository(ctx context.Context, cfg *config) error {
+	gh := a.Context()
+
+	repository := cfg.Repository
+	if repository == "" {
+		repository = gh.Repository
+	}
+	owner, repo, ok := strings.Cut(repository, "/")
+	if !ok || owner == "" || repo == "" {
+		return fmt.Errorf("input 'repository': %q must be <owner>/<repo>", repository)
+	}
+
+	runID := cfg.RunID
+	if runID == "" {
+		runID = gh.RunID
+	}
+	id, err := strconv.ParseInt(runID, 10, 64)
+	if err != nil {
+		return fmt.Errorf("input 'run-id': %q is not a number", runID)
+	}
+
+	token := cfg.Token
+	if token == "" {
+		token = gh.Token
+	}
+
+	client := artifact.NewRepositoryClient(gh.APIURL, token)
+	list, err := client.ListRunArtifacts(ctx, owner, repo, id)
+	if err != nil {
+		return fmt.Errorf("cannot list artifacts: %w", err)
+	}
+
+	var found *artifact.RepositoryArtifact
+	for i := range list.Artifacts {
+		if list.Artifacts[i].Name == cfg.Name {
+			found = &list.Artifacts[i]
+			break
+		}
+	}
+	if found == nil {
+		return fmt.Errorf("artifact %q not found in %s run %s", cfg.Name, repository, runID)
+	}
+	if found.Expired {
+		return fmt.Errorf("artifact %q is expired", cfg.Name)
+	}
+
+	body, err := client.DownloadArtifact(ctx, owner, repo, found.Id)
+	if err != nil {
+		return fmt.Errorf("cannot download artifact: %w", err)
+	}
+	defer body.Close()
+
+	tmp, err := os.CreateTemp("", "artifact-*.zip")
+	if err != nil {
+		return fmt.Errorf("cannot create temporary file: %w", err)
+	}
+	defer os.Remove(tmp.Name())
+
+	if _, err := io.Copy(tmp, body); err != nil {
+		tmp.Close()
+		return fmt.Errorf("cannot download artifact: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+
+	if err := extractArchive(tmp.Name(), cfg.Path); err != nil {
+		return fmt.Errorf("cannot extract artifact: %w", err)
+	}
+
+	a.SetOutput("download-path", downloadPath(cfg.Path))
+	a.Noticef("downloaded artifact %s from %s run %s", cfg.Name, repository, runID)
+	return nil
+}
+
+// downloadPath returns the absolute path of the directory the artifact was
+// extracted into.
+func downloadPath(dest string) string {
+	abs, err := filepath.Abs(dest)
+	if err != nil {
+		return dest
+	}
+	return abs
+}
+
+// extractArchive extracts the zip file at zipPath into dest. Entries that would
+// escape dest are rejected.
+func extractArchive(zipPath, dest string) error {
+	r, err := zip.OpenReader(zipPath)
+	if err != nil {
+		return err
+	}
+	defer r.Close()
+
+	for _, f := range r.File {
+		if err := extractFile(f, dest); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func extractFile(f *zip.File, dest string) error {
+	cleanDest := filepath.Clean(dest)
+	target := filepath.Join(cleanDest, f.Name)
+	if target != cleanDest && !strings.HasPrefix(target, cleanDest+string(os.PathSeparator)) {
+		return fmt.Errorf("illegal file path %q", f.Name)
+	}
+
+	if f.FileInfo().IsDir() {
+		return os.MkdirAll(target, 0o755)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+		return err
+	}
+
+	rc, err := f.Open()
+	if err != nil {
+		return err
+	}
+	defer rc.Close()
+
+	out, err := os.OpenFile(target, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, rc)
+	return err
+}

internal/pull/pull_test.go

@@ -0,0 +1,173 @@
+package pull
+
+import (
+	"archive/zip"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"code.geekeey.de/actions/sdk"
+)
+
+func TestParseConfig(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name    string
+		env     map[string]string
+		want    *config
+		wantErr bool
+	}{
+		{
+			name: "default path",
+			env:  map[string]string{"name": "foo"},
+			want: &config{Name: "foo", Path: "."},
+		},
+		{
+			name: "explicit path",
+			env:  map[string]string{"name": "foo", "path": "out"},
+			want: &config{Name: "foo", Path: "out"},
+		},
+		{
+			name: "other repository",
+			env: map[string]string{
+				"name": "foo", "repository": "owner/repo", "run-id": "42", "github-token": "tok",
+			},
+			want: &config{Name: "foo", Path: ".", Repository: "owner/repo", RunID: "42", Token: "tok"},
+		},
+		{
+			name:    "missing name",
+			env:     map[string]string{},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := parseConfig(func(k string) string { return tc.env[k] })
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got %+v", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("expected %+v, got %+v", tc.want, got)
+			}
+		})
+	}
+}
+
+func TestUseRepositoryAPI(t *testing.T) {
+	t.Parallel()
+
+	gh := &sdk.GitHubContext{Repository: "owner/repo", RunID: "100"}
+
+	cases := []struct {
+		name string
+		cfg  *config
+		want bool
+	}{
+		{"current", &config{Repository: "owner/repo", RunID: "100"}, false},
+		{"empty means current", &config{}, false},
+		{"other repository", &config{Repository: "other/repo", RunID: "100"}, true},
+		{"other run", &config{Repository: "owner/repo", RunID: "200"}, true},
+		{"repository only matches", &config{Repository: "owner/repo"}, false},
+		{"repository only differs", &config{Repository: "other/repo"}, true},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := useRepositoryAPI(tc.cfg, gh); got != tc.want {
+				t.Errorf("expected %v, got %v", tc.want, got)
+			}
+		})
+	}
+}
+
+func TestExtractArchive(t *testing.T) {
+	t.Parallel()
+
+	zipPath := filepath.Join(t.TempDir(), "artifact.zip")
+	writeZip(t, zipPath, map[string]string{
+		"a.txt":     "a",
+		"sub/b.txt": "b",
+	})
+
+	dest := t.TempDir()
+	if err := extractArchive(zipPath, dest); err != nil {
+		t.Fatal(err)
+	}
+
+	for name, want := range map[string]string{"a.txt": "a", "sub/b.txt": "b"} {
+		got, err := os.ReadFile(filepath.Join(dest, name))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if string(got) != want {
+			t.Errorf("expected %q to contain %q, got %q", name, want, got)
+		}
+	}
+}
+
+func TestExtractArchive_PathTraversal(t *testing.T) {
+	t.Parallel()
+
+	zipPath := filepath.Join(t.TempDir(), "artifact.zip")
+	writeZip(t, zipPath, map[string]string{"../evil.txt": "evil"})
+
+	if err := extractArchive(zipPath, t.TempDir()); err == nil {
+		t.Fatal("expected error for path traversal entry")
+	}
+}
+
+func TestDownloadPath(t *testing.T) {
+	t.Parallel()
+
+	abs := t.TempDir()
+	if got := downloadPath(abs); got != abs {
+		t.Errorf("expected %q, got %q", abs, got)
+	}
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := downloadPath("out"), filepath.Join(wd, "out"); got != want {
+		t.Errorf("expected %q, got %q", want, got)
+	}
+}
+
+func writeZip(t *testing.T, path string, files map[string]string) {
+	t.Helper()
+
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+
+	zw := zip.NewWriter(f)
+	for name, content := range files {
+		w, err := zw.Create(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := w.Write([]byte(content)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+}