feat: support self-hosted runners (#170)

* feat: support self-hosted runners

similar to https://github.com/game-ci/unity-builder/pull/355

* Use $RUNNER_TEMP variable instead of hardcoded path for _github_home and _github_workflow
* create the folders if they don't exist
* mount volumes with :z for compatibility with SELinux

* compile typescript files

dist/index.js

@@ -44,6 +44,7 @@ function run() {
             const { dockerfile, workspace, actionFolder } = model_1.Action;
             const { unityVersion, customImage, projectPath, customParameters, testMode, artifactsPath, useHostNetwork, sshAgent, gitPrivateToken, githubToken, checkName, } = model_1.Input.getFromUser();
             const baseImage = new model_1.ImageTag({ version: unityVersion, customImage });
+            const runnerTempPath = process.env.RUNNER_TEMP;
             try {
                 // Build docker image
                 const actionImage = yield model_1.Docker.build({ path: actionFolder, dockerfile, baseImage });
@@ -59,6 +60,7 @@ function run() {
                     sshAgent,
                     gitPrivateToken,
                     githubToken,
+                    runnerTempPath,
                 });
             }
             finally {
@@ -150,15 +152,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+const fs_1 = __nccwpck_require__(7147);
 const image_tag_1 = __importDefault(__nccwpck_require__(7648));
 const exec_1 = __nccwpck_require__(1514);
+const path_1 = __importDefault(__nccwpck_require__(1017));
 const Docker = {
     build(buildParameters, silent = false) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { path, dockerfile, baseImage } = buildParameters;
+            const { path: buildPath, dockerfile, baseImage } = buildParameters;
             const { version } = baseImage;
             const tag = new image_tag_1.default({ version });
-            const command = `docker build ${path} \
+            const command = `docker build ${buildPath} \
       --file ${dockerfile} \
       --build-arg IMAGE=${baseImage} \
       --tag ${tag}`;
@@ -168,7 +172,13 @@ const Docker = {
     },
     run(image, parameters, silent = false) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { unityVersion, workspace, projectPath, customParameters, testMode, artifactsPath, useHostNetwork, sshAgent, gitPrivateToken, githubToken, } = parameters;
+            const { unityVersion, workspace, projectPath, customParameters, testMode, artifactsPath, useHostNetwork, sshAgent, gitPrivateToken, githubToken, runnerTempPath, } = parameters;
+            const githubHome = path_1.default.join(runnerTempPath, '_github_home');
+            if (!(0, fs_1.existsSync)(githubHome))
+                (0, fs_1.mkdirSync)(githubHome);
+            const githubWorkflow = path_1.default.join(runnerTempPath, '_github_workflow');
+            if (!(0, fs_1.existsSync)(githubWorkflow))
+                (0, fs_1.mkdirSync)(githubWorkflow);
             const command = `docker run \
         --workdir /github/workspace \
         --rm \
@@ -199,10 +209,10 @@ const Docker = {
         --env RUNNER_WORKSPACE \
         --env GIT_PRIVATE_TOKEN="${gitPrivateToken}" \
         ${sshAgent ? '--env SSH_AUTH_SOCK=/ssh-agent' : ''} \
-        --volume "/var/run/docker.sock":"/var/run/docker.sock" \
-        --volume "/home/runner/work/_temp/_github_home":"/root" \
-        --volume "/home/runner/work/_temp/_github_workflow":"/github/workflow" \
-        --volume "${workspace}":"/github/workspace" \
+        --volume "/var/run/docker.sock":"/var/run/docker.sock:z" \
+        --volume "${githubHome}":"/root:z" \
+        --volume "${githubWorkflow}":"/github/workflow:z" \
+        --volume "${workspace}":"/github/workspace:z" \
         ${sshAgent ? `--volume ${sshAgent}:/ssh-agent` : ''} \
         ${sshAgent ? '--volume /home/runner/.ssh/known_hosts:/root/.ssh/known_hosts:ro' : ''} \
         ${useHostNetwork ? '--net=host' : ''} \
@@ -12941,9 +12951,17 @@ AbortError.prototype = Object.create(Error.prototype);
 AbortError.prototype.constructor = AbortError;
 AbortError.prototype.name = 'AbortError';
 
+const URL$1 = Url.URL || whatwgUrl.URL;
+
 // fix an issue where "PassThrough", "resolve" aren't a named export for node <10
 const PassThrough$1 = Stream.PassThrough;
-const resolve_url = Url.resolve;
+
+const isDomainOrSubdomain = function isDomainOrSubdomain(destination, original) {
+	const orig = new URL$1(original).hostname;
+	const dest = new URL$1(destination).hostname;
+
+	return orig === dest || orig[orig.length - dest.length - 1] === '.' && orig.endsWith(dest);
+};
 
 /**
  * Fetch function
@@ -13031,7 +13049,19 @@ function fetch(url, opts) {
 				const location = headers.get('Location');
 
 				// HTTP fetch step 5.3
-				const locationURL = location === null ? null : resolve_url(request.url, location);
+				let locationURL = null;
+				try {
+					locationURL = location === null ? null : new URL$1(location, request.url).toString();
+				} catch (err) {
+					// error here can only be invalid URL in Location: header
+					// do not throw when options.redirect == manual
+					// let the user extract the errorneous redirect URL
+					if (request.redirect !== 'manual') {
+						reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect'));
+						finalize();
+						return;
+					}
+				}
 
 				// HTTP fetch step 5.5
 				switch (request.redirect) {
@@ -13079,6 +13109,12 @@ function fetch(url, opts) {
 							size: request.size
 						};
 
+						if (!isDomainOrSubdomain(request.url, locationURL)) {
+							for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
+								requestOpts.headers.delete(name);
+							}
+						}
+
 						// HTTP-redirect fetch step 9
 						if (res.statusCode !== 303 && request.body && getTotalBytes(request) === null) {
 							reject(new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect'));

src/index.ts

@@ -20,6 +20,7 @@ async function run() {
       checkName,
     } = Input.getFromUser();
     const baseImage = new ImageTag({ version: unityVersion, customImage });
+    const runnerTempPath = process.env.RUNNER_TEMP;
 
     try {
       // Build docker image
@@ -37,6 +38,7 @@ async function run() {
         sshAgent,
         gitPrivateToken,
         githubToken,
+        runnerTempPath,
       });
     } finally {
       // Set output

src/model/docker.ts

@@ -1,13 +1,15 @@
+import { existsSync, mkdirSync } from 'fs';
 import ImageTag from './image-tag';
 import { exec } from '@actions/exec';
+import path from 'path';
 
 const Docker = {
   async build(buildParameters, silent = false) {
-    const { path, dockerfile, baseImage } = buildParameters;
+    const { path: buildPath, dockerfile, baseImage } = buildParameters;
     const { version } = baseImage;
 
     const tag = new ImageTag({ version });
-    const command = `docker build ${path} \
+    const command = `docker build ${buildPath} \
       --file ${dockerfile} \
       --build-arg IMAGE=${baseImage} \
       --tag ${tag}`;
@@ -29,8 +31,14 @@ const Docker = {
       sshAgent,
       gitPrivateToken,
       githubToken,
+      runnerTempPath,
     } = parameters;
 
+    const githubHome = path.join(runnerTempPath, '_github_home');
+    if (!existsSync(githubHome)) mkdirSync(githubHome);
+    const githubWorkflow = path.join(runnerTempPath, '_github_workflow');
+    if (!existsSync(githubWorkflow)) mkdirSync(githubWorkflow);
+
     const command = `docker run \
         --workdir /github/workspace \
         --rm \
@@ -61,10 +69,10 @@ const Docker = {
         --env RUNNER_WORKSPACE \
         --env GIT_PRIVATE_TOKEN="${gitPrivateToken}" \
         ${sshAgent ? '--env SSH_AUTH_SOCK=/ssh-agent' : ''} \
-        --volume "/var/run/docker.sock":"/var/run/docker.sock" \
-        --volume "/home/runner/work/_temp/_github_home":"/root" \
-        --volume "/home/runner/work/_temp/_github_workflow":"/github/workflow" \
-        --volume "${workspace}":"/github/workspace" \
+        --volume "/var/run/docker.sock":"/var/run/docker.sock:z" \
+        --volume "${githubHome}":"/root:z" \
+        --volume "${githubWorkflow}":"/github/workflow:z" \
+        --volume "${workspace}":"/github/workspace:z" \
         ${sshAgent ? `--volume ${sshAgent}:/ssh-agent` : ''} \
         ${sshAgent ? '--volume /home/runner/.ssh/known_hosts:/root/.ssh/known_hosts:ro' : ''} \
         ${useHostNetwork ? '--net=host' : ''} \