Merge branch 'ajwalker/script-to-script-step' into 'main'

Implement user script to step

See merge request https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6069

Merged-by: Arran Walker <ajwalker@gitlab.com>
Approved-by: Cameron Swords <cswords@gitlab.com>
Approved-by: Roshni Sarangadharan <rsarangadharan@gitlab.com>
Reviewed-by: Cameron Swords <cswords@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>

Author: saracen

.gitlab/ci/test.gitlab-ci.yml

@@ -77,6 +77,27 @@ integration test:
         -- -ldflags "$(make print_test_ldflags)" -timeout 25m
   parallel: 4
 
+integration test (docker, steps):
+  extends:
+    - integration test
+  variables:
+    RUNNER_TEST_FEATURE_FLAGS: "FF_SCRIPT_TO_STEP_MIGRATION"
+  script:
+    - docker import out/helper-images/prebuilt-alpine-latest-x86_64.tar.xz registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-latest
+    - go install gitlab.com/gitlab-org/fleeting/fleeting-plugin-static/cmd/fleeting-plugin-static@latest
+    - make splitic
+    - >
+      .tmp/bin/splitic test \
+        -junit-report .splitic/junit_${CI_NODE_INDEX}_docker_steps.xml \
+        -cover-report .splitic/cover_${CI_NODE_INDEX}_docker_steps.profile -cover -coverpkg gitlab.com/gitlab-org/gitlab-runner/... \
+        -env-passthrough ./scripts/envs/allowlist_common.env -env-passthrough ./scripts/envs/allowlist_unix.env \
+        -tags integration \
+        ./executors/docker \
+        -- -ldflags "$(make print_test_ldflags)" -timeout 1h
+  parallel: 1
+  when: manual
+  allow_failure: true
+
 integration test with race:
   extends:
     - integration test

commands/multi.go

@@ -37,7 +37,6 @@ import (
 	"gitlab.com/gitlab-org/gitlab-runner/log"
 	"gitlab.com/gitlab-org/gitlab-runner/network"
 	"gitlab.com/gitlab-org/gitlab-runner/session"
-	"gitlab.com/gitlab-org/gitlab-runner/steps"
 )
 
 const (
@@ -971,7 +970,6 @@ func (mr *RunCommand) processBuildOnRunner(
 	}
 	build.Session = buildSession
 	build.ArtifactUploader = mr.network.UploadRawArtifacts
-	build.ExecuteStepFn = steps.Execute
 
 	trace.SetDebugModeEnabled(build.IsDebugModeEnabled())
 

commands/steps/steps.go

@@ -18,6 +18,7 @@ import (
 	"google.golang.org/grpc"
 
 	"gitlab.com/gitlab-org/gitlab-runner/common"
+	"gitlab.com/gitlab-org/gitlab-runner/functions/script_legacy"
 	"gitlab.com/gitlab-org/step-runner/pkg/api"
 	"gitlab.com/gitlab-org/step-runner/pkg/api/proxy"
 	"gitlab.com/gitlab-org/step-runner/pkg/di"
@@ -75,7 +76,10 @@ func Serve(ctx context.Context, sockPath string, ioStreams IOStreams, cmdAndArgs
 	}
 	defer listener.Close()
 
-	service, err := di.NewContainer().StepRunnerService()
+	service, err := di.NewContainer(
+		di.WithStepFunc("script_legacy", script_legacy.Spec(), script_legacy.Run),
+	).StepRunnerService()
+
 	if err != nil {
 		return fmt.Errorf("initializing step-runner: %w", err)
 	}

common/build.go

@@ -30,6 +30,9 @@ import (
 	"gitlab.com/gitlab-org/gitlab-runner/session"
 	"gitlab.com/gitlab-org/gitlab-runner/session/proxy"
 	"gitlab.com/gitlab-org/gitlab-runner/session/terminal"
+	"gitlab.com/gitlab-org/gitlab-runner/steps"
+	"gitlab.com/gitlab-org/step-runner/pkg/api/client"
+	"gitlab.com/gitlab-org/step-runner/schema/v1"
 )
 
 type BuildRuntimeState string
@@ -159,8 +162,6 @@ type Build struct {
 	Referees         []referees.Referee
 	ArtifactUploader func(config JobCredentials, bodyProvider ContentProvider, options ArtifactsOptions) (UploadState, string)
 
-	ExecuteStepFn func(ctx context.Context, connector Connector, build *Build, trace JobTrace) error
-
 	urlHelper urlHelper
 
 	OnBuildStageStartFn OnBuildStageFn
@@ -407,7 +408,7 @@ func (b *Build) StartBuild(
 	return nil
 }
 
-func (b *Build) executeStepStage(ctx context.Context, connector Connector, buildStage BuildStage, trace JobTrace) error {
+func (b *Build) executeStepStage(ctx context.Context, connector steps.Connector, buildStage BuildStage, req []schema.Step) error {
 	if ctx.Err() != nil {
 		return ctx.Err()
 	}
@@ -430,14 +431,53 @@ func (b *Build) executeStepStage(ctx context.Context, connector Connector, build
 			)
 			b.logger.Println(msg)
 
-			return b.ExecuteStepFn(ctx, connector, b, trace)
+			// todo: step-runner should eventually:
+			// - format its own logs to the Runner log spec
+			// - provides its own timestamps and mask its own secrets
+			// for now though, we wrap its logs providing this, and treat everything as stdout
+			stdout := b.logger.Stream(buildlogger.StreamWorkLevel, buildlogger.Stdout)
+
+			info := steps.JobInfo{
+				ID:         b.ID,
+				ProjectDir: b.FullProjectDir(),
+				Variables:  b.GetAllVariables(),
+			}
+
+			err := steps.Execute(ctx, connector, info, req, stdout)
+			if err != nil {
+				berr := &BuildError{Inner: err}
+
+				var cserr *steps.ClientStatusError
+				if errors.As(err, &cserr) {
+					switch cserr.Status.State {
+					case client.StateUnspecified:
+						berr.FailureReason = UnknownFailure
+					case client.StateFailure:
+						berr.FailureReason = ScriptFailure
+					}
+				}
+
+				return berr
+			}
+
+			return err
 		},
 	}
 
 	return section.Execute(&b.logger)
 }
 
+//nolint:gocognit
 func (b *Build) executeStage(ctx context.Context, buildStage BuildStage, executor Executor) error {
+	if b.UseNativeSteps() {
+		connector, ok := executor.(steps.Connector)
+		if ok {
+			if handled, steps := stepDispatch(b, executor, buildStage); handled {
+				return b.executeStepStage(ctx, connector, buildStage, steps)
+			}
+		}
+	}
+
 	if ctx.Err() != nil {
 		return ctx.Err()
 	}
@@ -585,13 +625,11 @@ func (b *Build) executeScript(ctx context.Context, trace JobTrace, executor Exec
 	// execute user provided scripts
 	//nolint:nestif
 	if err == nil {
-		if b.UseNativeSteps() && b.ExecuteStepFn != nil {
-			connector, ok := executor.(Connector)
-			if ok {
-				err = b.executeStepStage(ctx, connector, BuildStage("step_"+spec.StepNameRun), trace)
-			} else {
+		if b.UseNativeSteps() && len(b.Job.Run) > 0 {
+			if _, ok := executor.(steps.Connector); !ok {
 				return ExecutorStepRunnerConnectNotSupported
 			}
+			err = b.executeStage(ctx, stepRunBuildStage, executor)
 		} else {
 			err = b.executeUserScripts(ctx, trace, executor)
 		}

common/build_settings.go

@@ -1,10 +1,13 @@
 package common
 
 import (
+	"flag"
 	"fmt"
+	"os"
 	"slices"
 	"strconv"
 	"strings"
+	"unicode"
 
 	"gitlab.com/gitlab-org/gitlab-runner/common/spec"
 	"gitlab.com/gitlab-org/gitlab-runner/helpers/featureflags"
@@ -218,13 +221,31 @@ func validate[T any](variables spec.Variables, name string, value *T, def T) err
 	return nil
 }
 
+//nolint:gocognit
 func populateFeatureFlags(b *Build, variables spec.Variables) []error {
 	var errs []error
 
+	// test mode only: in tests, we provide a mechanism for providing
+	// feature flags via RUNNER_TEST_FEATURE_FLAGS, if the flag is present,
+	// we treat it as a toggle to the default flag value.
+	var testFlags []string
+	if flag.Lookup("test.v") != nil {
+		testFlags = strings.FieldsFunc(os.Getenv("RUNNER_TEST_FEATURE_FLAGS"), func(r rune) bool {
+			return r == ',' || unicode.IsSpace(r)
+		})
+	}
+
 	b.buildSettings.FeatureFlags = make(map[string]bool)
 	for _, ff := range featureflags.GetAll() {
 		b.buildSettings.FeatureFlags[ff.Name] = ff.DefaultValue
 
+		if len(testFlags) > 0 {
+			if slices.Contains(testFlags, ff.Name) {
+				b.buildSettings.FeatureFlags[ff.Name] = !ff.DefaultValue
+				continue
+			}
+		}
+
 		// runner setting takes precedence if defined
 		if b.Runner != nil && b.Runner.FeatureFlags != nil {
 			val, ok := b.Runner.FeatureFlags[ff.Name]

common/build_step_dispatch.go

@@ -0,0 +1,81 @@
+package common
+
+import (
+	"gitlab.com/gitlab-org/gitlab-runner/common/spec"
+	"gitlab.com/gitlab-org/gitlab-runner/helpers/featureflags"
+	"gitlab.com/gitlab-org/step-runner/schema/v1"
+)
+
+const stepRunBuildStage = BuildStage("step_" + spec.StepNameRun)
+
+// stepDispatch converts a build stage to a list of steps to run.
+//
+// Depending on the configuration, this can also include stages that we're
+// in the process of migrating (from scripts) to a step.
+//
+//nolint:gocognit
+func stepDispatch(build *Build, executor Executor, stage BuildStage) (bool, []schema.Step) {
+	switch stage {
+	case BuildStagePrepare, BuildStageGetSources, BuildStageClearWorktree, BuildStageRestoreCache, BuildStageDownloadArtifacts, BuildStageArchiveOnSuccessCache, BuildStageArchiveOnFailureCache, BuildStageUploadOnFailureArtifacts, BuildStageUploadOnSuccessArtifacts, BuildStageCleanup:
+		// don't handle non-user script stages
+		return false, nil
+
+	case stepRunBuildStage:
+		return true, build.Job.Run
+
+	case BuildStageAfterScript:
+		// don't handle after_script (yet)
+		return false, nil
+
+	default: // user script
+		if !build.IsFeatureFlagOn(featureflags.UseScriptToStepMigration) {
+			return false, nil
+		}
+
+		shell := executor.Shell()
+		if shell == nil {
+			return false, nil
+		}
+
+		var script []string
+
+		if shell.PreBuildScript != "" {
+			script = append(script, shell.PreBuildScript)
+		}
+
+		for _, step := range build.Steps {
+			if StepToBuildStage(step) == stage {
+				script = append(script, step.Script...)
+				if step.Name == "release" {
+					for i, s := range step.Script {
+						script[i] = build.GetAllVariables().ExpandValue(s)
+					}
+				}
+				break
+			}
+		}
+
+		if shell.PostBuildScript != "" {
+			script = append(script, shell.PostBuildScript)
+		}
+
+		// if no script, no-op
+		if len(script) == 0 {
+			return true, nil // handled, but nothing to do
+		}
+
+		return true, []schema.Step{
+			{
+				Name: func(s string) *string { return &s }("user_script"),
+				Step: "builtin://script_legacy",
+				Inputs: schema.StepInputs{
+					"script":           script,
+					"debug_trace":      build.IsDebugTraceEnabled(),
+					"posix_escape":     true,
+					"check_for_errors": build.IsFeatureFlagOn(featureflags.EnableBashExitCodeCheck),
+					"trace_sections":   build.IsFeatureFlagOn(featureflags.ScriptSections),
+				},
+			},
+		}
+	}
+}

common/buildtest/masking.go

@@ -28,6 +28,7 @@ func RunBuildWithMasking(t *testing.T, config *common.RunnerConfig, setup BuildS
 			"Job failed: exit status 1",
 			"Job failed: run exit (exit code: 1)",
 			"Job failed: command terminated with exit code 1",
+			"Job failed: step \"user_script\": exec: executing script: exit status 1",
 		}
 
 		build := &common.Build{

common/executor.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
 
 	"github.com/sirupsen/logrus"
 
@@ -79,10 +78,6 @@ type Executor interface {
 
 var ExecutorStepRunnerConnectNotSupported = fmt.Errorf("executor does not support step-runner connect")
 
-type Connector interface {
-	Connect(ctx context.Context) (io.ReadWriteCloser, error)
-}
-
 type ManagedExecutorProvider interface {
 	// Init initializes the executor provider.
 	//