Skip to content

ci: Run GitHub Actions jobs on Namespace runners #25547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JPeer264 wants to merge 1 commit into
base: develop
Choose a base branch
from
+147 −256
Open

ci: Run GitHub Actions jobs on Namespace runners #25547

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 16 additions & 15 deletions .github/actions/install-dependencies/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,31 @@
name: 'Install pnpm dependencies'
description: 'Installs pnpm dependencies and caches them.'

outputs:
cache_key:
description: 'The dependency cache key'
value: ${{ steps.compute_lockfile_hash.outputs.hash }}
description: 'Installs pnpm dependencies into node_modules folders on the Namespace cache volume.'

runs:
using: 'composite'
steps:
- name: Install pnpm
uses: ./.github/actions/install-pnpm

- name: Compute dependency cache key
id: compute_lockfile_hash
run: node ./scripts/dependency-hash-key.js >> "$GITHUB_OUTPUT"
- name: List dependency paths
id: paths
run: |
{
echo 'paths<<EOF'
node -e 'const { workspaces } = require("./package.json"); for (const dir of [".", ...workspaces]) console.log(require("path").resolve(dir, "node_modules"))'
echo '~/.cache/mongodb-binaries'
echo 'EOF'
} >> "$GITHUB_OUTPUT"
shell: bash

- name: Check dependency cache
uses: actions/cache@v6.1.0
id: cache_dependencies
- name: Mount dependency cache
uses: namespacelabs/nscloud-cache-action@1124a6f3ce44e5cf84cc22111530961f4d2a15f9 # v1.7.0
with:
path: ${{ env.CACHED_DEPENDENCY_PATHS }}
key: ${{ steps.compute_lockfile_hash.outputs.hash }}
cache: pnpm
path: ${{ steps.paths.outputs.paths }}

# The cache volume can hold node_modules of another commit or branch. This is a no-op when they match
# pnpm-lock.yaml.
- name: Install dependencies
if: steps.cache_dependencies.outputs.cache-hit != 'true'
run: pnpm install --frozen-lockfile

Check failure on line 30 in .github/actions/install-dependencies/action.yml

View check run for this annotation

@sentry/warden / warden: security-review

[WPE-THU] Shared PR cache volume lets untrusted PRs poison secret-bearing jobs (additional location) 

All `pull_request` jobs use one Namespace cache tag (`sentry-javascript-pr`), so a fork PR can rewrite mounted `node_modules`/pnpm store state that later same-repo PR jobs reuse—including `job_optional_e2e_tests` with Cloudflare/E2E API secrets. Partition the cache per PR (or per untrusted run) and do not share writable dependency volumes with secret-bearing jobs.
shell: bash
41 changes: 10 additions & 31 deletions .github/actions/install-playwright/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
name: 'Install Playwright dependencies'
description: 'Installs Playwright dependencies and caches them.'
description: 'Installs Playwright browsers and system dependencies, keeping both on the Namespace cache volume.'
inputs:
browsers:
description: 'What browsers to install.'
Expand All @@ -26,40 +26,19 @@
shell: bash
working-directory: ${{ inputs.cwd }}

- name: Restore cached playwright binaries
uses: actions/cache/restore@v6.1.0
id: playwright-cache
- name: Mount Playwright cache
uses: namespacelabs/nscloud-cache-action@1124a6f3ce44e5cf84cc22111530961f4d2a15f9 # v1.7.0
if: steps.playwright-version.outputs.version != ''
with:
path: |
~/.cache/ms-playwright
# Bump the iteration when bumping runner images to use a new cache
key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}
cache: |
playwright
apt

Check failure on line 35 in .github/actions/install-playwright/action.yml

View check run for this annotation

@sentry/warden / warden: security-review

Writable shared Playwright/apt cache allows cross-PR poisoning into secret-bearing jobs 

Playwright and apt caches are now always mounted writable on the Namespace volume with no develop-only write gate, so untrusted PR jobs can plant browser/apt payloads that later secret-bearing jobs reuse. Partition caches per PR (or make them read-only for untrusted events) and re-verify browsers before use in jobs with secrets.

# We always install all browsers, if uncached
- name: Install Playwright dependencies (uncached)
env:
PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
run: npx -y "playwright@$PLAYWRIGHT_VERSION" install chromium webkit firefox --with-deps
if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit != 'true'
shell: bash

- name: Install Playwright system dependencies only (cached)
# Downloads only the browsers and apt packages that are not on the cache volume yet
- name: Install Playwright
if: steps.playwright-version.outputs.version != ''
env:
PLAYWRIGHT_BROWSERS: ${{ inputs.browsers || 'chromium webkit firefox' }}
PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
run: npx -y "playwright@$PLAYWRIGHT_VERSION" install-deps "$PLAYWRIGHT_BROWSERS"
if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit == 'true'
run: npx -y "playwright@$PLAYWRIGHT_VERSION" install --with-deps $PLAYWRIGHT_BROWSERS
shell: bash

# Only store cache on develop branch
- name: Store cached playwright binaries
uses: actions/cache/save@v6.1.0
if:
steps.playwright-version.outputs.version != '' && github.event_name == 'push' && github.ref ==
'refs/heads/develop'
with:
path: |
~/.cache/ms-playwright
# Bump the iteration when bumping runner images to use a new cache
key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}
21 changes: 2 additions & 19 deletions .github/actions/restore-cache/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,13 @@
name: 'Restore dependency & build cache'
description: 'Restore the dependency & build cache.'

inputs:
dependency_cache_key:
description: 'The dependency cache key'
required: true
description: 'Installs dependencies from the Namespace cache volume and restores the build output.'

runs:
using: 'composite'
steps:
- name: Install pnpm
uses: ./.github/actions/install-pnpm

- name: Check dependency cache
id: dep-cache
uses: actions/cache/restore@v6.1.0
with:
path: ${{ env.CACHED_DEPENDENCY_PATHS }}
key: ${{ inputs.dependency_cache_key }}

- name: Restore build artifacts
uses: actions/download-artifact@v7
with:
name: build-output

- name: Install dependencies
if: steps.dep-cache.outputs.cache-hit != 'true'
run: pnpm install --frozen-lockfile
shell: bash
uses: ./.github/actions/install-dependencies
2 changes: 1 addition & 1 deletion .github/workflows/auto-fix-issue.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ concurrency:

jobs:
auto-fix-issue:
runs-on: ubuntu-latest
runs-on: namespace-profile-sentry-javascript
environment: ci-triage
permissions:
# Required to create a new branch and commit the fix
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/auto-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ permissions:

jobs:
release:
runs-on: ubuntu-24.04
runs-on: namespace-profile-sentry-javascript-small
name: 'Prepare a new version'

steps:
Expand Down
Loading
Loading