c44c8a6
c44c8a6e120d326bdae56dada4aa208807a7d47934b84f5
157743b| Status | File | + | - |
|---|---|---|---|
| M |
docs/internal/actions-runner-api.md
|
9 | 0 |
| M |
docs/internal/actions-schema.md
|
10 | 1 |
| M |
docs/internal/permissions.md
|
2 | 0 |
docs/internal/actions-runner-api.mdmodified@@ -84,6 +84,11 @@ Returns 204 when no matching job is claimable. Returns 200 with | ||
| 84 | 84 | `token`, `expires_at`, and `job` when a job is claimed. Capacity is |
| 85 | 85 | enforced server-side by counting current `workflow_jobs.status = |
| 86 | 86 | 'running'` rows for the runner while holding a row lock on the runner. |
| 87 | +Claiming also enforces the effective Actions policy for the repository: | |
| 88 | +disabled repos, approval-pending runs, per-repo concurrent job caps, and | |
| 89 | +per-owner/org concurrent job caps are not dispatchable. Approval simply | |
| 90 | +sets `workflow_runs.approved_by_user_id`; the next heartbeat can claim the | |
| 91 | +same queued jobs, so no duplicate run is created. | |
| 87 | 92 | The job payload includes `checkout_url`, `checkout_token`, resolved |
| 88 | 93 | `secrets`, and `mask_values`; repo secrets shadow org secrets with the |
| 89 | 94 | same name. The server also stores an encrypted claim-time copy of the mask |
@@ -91,6 +96,10 @@ values on `workflow_job_secret_masks` so later log uploads are scrubbed | ||
| 91 | 96 | against the secrets that were actually handed to the runner, even if an |
| 92 | 97 | operator rotates or deletes a secret mid-job. |
| 93 | 98 | |
| 99 | +Pull request runs receive no org or repo secrets in v1, even after a | |
| 100 | +maintainer approves dispatch. This is intentionally stricter than the | |
| 101 | +approval gate until environments/protected deployment secrets exist. | |
| 102 | + | |
| 94 | 103 | `POST /api/v1/jobs/{id}/logs` |
| 95 | 104 | |
| 96 | 105 | Auth: job JWT. Body: |
docs/internal/actions-schema.mdmodified@@ -12,7 +12,7 @@ without churning under them. | ||
| 12 | 12 | |
| 13 | 13 | ## SQL schema |
| 14 | 14 | |
| 15 | -Actions migrations currently span 0042–0051, 0053, 0057, and 0060. | |
| 15 | +Actions migrations currently span 0042–0051, 0053, 0057, 0060, and 0064–0066. | |
| 16 | 16 | Migration 0052 belongs to the repo source-remotes feature, 0054 |
| 17 | 17 | belongs to push event protocol tracking, 0055 belongs to the social |
| 18 | 18 | feed, 0056 belongs to user profile contribution settings, 0058 belongs |
@@ -33,6 +33,7 @@ to repo name reuse, and 0059 belongs to GitHub org imports. | ||
| 33 | 33 | | 0053 | `runner_jwt_used` | Single-use replay gate for runner job JWTs | |
| 34 | 34 | | 0057 | `workflow_job_secret_masks` | Encrypted claim-time log mask snapshots per job | |
| 35 | 35 | | 0060 | Actions retention indexes | Narrow cleanup indexes for terminal steps/runs | |
| 36 | +| 0066 | `actions_*_policies`, `workflow_run_approvals` | Enablement, runner-pool caps, and approval decisions | | |
| 36 | 37 | |
| 37 | 38 | A few load-bearing choices, called out so they're easy to spot in a |
| 38 | 39 | later schema diff: |
@@ -77,6 +78,14 @@ later schema diff: | ||
| 77 | 78 | claim time, preventing a rotated or deleted secret from disappearing |
| 78 | 79 | from server-side masking while the old value is still in a runner's |
| 79 | 80 | job payload. |
| 81 | +- **`actions_site_policy`, `actions_org_policies`, | |
| 82 | + `actions_repo_policies`** — inherited Actions enablement and abuse | |
| 83 | + caps. Runner claim and trigger enqueue both read the effective policy: | |
| 84 | + repo override, then org override, then site default. | |
| 85 | +- **`workflow_run_approvals`** — one approval-decision row for every run | |
| 86 | + whose `workflow_runs.need_approval` flag is set. Approval records the | |
| 87 | + maintainer and lets runner heartbeats claim the existing queued jobs; | |
| 88 | + rejection completes the run with `action_required`. | |
| 80 | 89 | |
| 81 | 90 | The `version` and `run_index` patterns are the two pieces I'd point |
| 82 | 91 | out to a future maintainer first. Both are cheap to add now and |
docs/internal/permissions.mdmodified@@ -56,6 +56,8 @@ The complete map (also enforced by the matrix test): | ||
| 56 | 56 | | `repo:delete` | `admin` | |
| 57 | 57 | | `repo:transfer` | `admin` | |
| 58 | 58 | | `repo:visibility` | `admin` | |
| 59 | +| `actions:run` | `write` | | |
| 60 | +| `actions:approve` | `maintain` | | |
| 59 | 61 | | `issue:read` | `read` (private) | |
| 60 | 62 | | `issue:create` | logged in on public; `read` on private | |
| 61 | 63 | | `issue:comment` | logged in on public; `read` on private | |