Add endpoint deleting workflow run

[NorthRealm]

Add endpoint deleting workflow run
Resolves #26219

/claim #26219

[wxiaoguang]

FYI: there are some "Details" in Clear the data/log for jobs in Gitea Actions that are too old #24256 , if these are all addressed, then we could move on.

[NorthRealm]

FYI: there are some "Details" in Clear the data/log for jobs in Gitea Actions that are too old #24256 , if these are all addressed, then we could move on.

You mean there's somewhere missing out in this pr?

[wxiaoguang]

You mean there's somewhere missing out in this pr?

Just FYI, I haven't fully read this PR or that issue, I just recalled there are some "details".

[NorthRealm]

You mean there's somewhere missing out in this pr?

Just FYI, I haven't fully read this PR or that issue, I just recalled there are some "details".

I referred a lot from DeleteRepositoryDirectly in services/repository/delete.go.
According to #24256 #26275, most concerns in details should be addressed already in this PR.

update NumActionRuns and NumClosedActionRuns of Repository.

Do we have to touch these explicitly?

[wxiaoguang]

update NumActionRuns and NumClosedActionRuns of Repository.

Do we have to touch these explicitly?

IIRC there is a updateRepoRunsNumbers

[NorthRealm]

update NumActionRuns and NumClosedActionRuns of Repository.

Do we have to touch these explicitly?

IIRC there is a updateRepoRunsNumbers

Then I think #24256 details are all addressed. I just updated the function deleting ActionTaskOutput
Just simply delete database records, and files on storage.

[ChristopherHX]

Since you delete potentially the only task an ephemeral act_runner has ever run, please delete the affected runners first.

one of

• call cleanup ephemeral runners first
• delete affected ephemeral act_runners
• I would make ephemeral runners fully delete directly before formally finishing the task

[NorthRealm]

Do you mean there's a chance where ephemeral doesn't get deleted from database because of missing task record?
I just looked at services/actions/task.go, in PickTask, deletion is triggered by runner fetching tasks.
This is out of context of this pr imo. Surely can have a better way to delete ephemeral runners.

[ChristopherHX]

Do you mean there's a chance where ephemeral doesn't get deleted from database because of missing task record?

Yes exactly, the pickTask detection is only triggered when trying to exploit gitea.
A well behaving runner will never call pickTask that way.

Calling this method before deletion is for me in scope of secure deletion

gitea/services/actions/cleanup.go

Line 136 in 2fbc8f9

func CleanupEphemeralRunners(ctx context.Context) error {

[NorthRealm]

Do you mean there's a chance where ephemeral doesn't get deleted from database because of missing task record? I just looked at services/actions/task.go, in PickTask, deletion is triggered by runner fetching tasks. This is out of context of the pr imo. Surely can have a better way to delete ephemeral runners.

Do you mean there's a chance where ephemeral doesn't get deleted from database because of missing task record?

Yes exactly, the pickTask detection is only triggered when trying to exploit gitea. A well behaving runner will never call pickTask that way.

Calling this method before deletion is for me in scope of secure deletion

gitea/services/actions/cleanup.go

Line 136 in 2fbc8f9

func CleanupEphemeralRunners(ctx context.Context) error {

So to say, under current ephemeral runner implementation that relies on existing task record deliberately throwing error killing remote runner daemon, "ephemeral" will be broken (fetching another task).

[NorthRealm]

@ChristopherHX
Isn't it possible/ok to just immediately delete ephemeral runner once task status gets updated to done (Success, Failure, Cancelled, Skipped)? In routers/api/actions/runner/runner.go at task.Status.IsDone() In UpdateTask

[NorthRealm]

Anyway let us keep focus on deletion in this pr.

[ChristopherHX]

So to say, under current ephemeral runner implementation that relies on existing task record deliberately throwing error killing remote runner daemon, "ephemeral" will be broken (fetching another task).

Yes also CleanupEphemeralRunners will no longer delete the runner after the task is away.

routers/api/actions/runner/runner.go at task.Status.IsDone() In UpdateTask

The Gitea code is more complex. You can set the task status to completed by

• abandoning jobs
• cancel jobs

UpdateTask is skipped.

IMHO a single CleanupEphemeralRunners call before deleting anything else and I am fine.

[ChristopherHX]

Anyway let us keep focus on deletion in this pr.

Sure we can, if you think this is not related to your pr.

I am silent now about this topic, no problem :)

[NorthRealm]

Anyway let us keep focus on deletion in this pr.

Sure we can, if you think this is not related to your pr.

I am silent now about this topic, no problem :)

@ChristopherHX One more thing. Surely can have a more solid way to delete ephemeral runners. Basically for a ephemeral need to track whether it has taken a task or not. A solution I can come up with is adding another boolean field for ephemeral runner, which is set to true once it takes a task.

[NorthRealm]

Anyway let us keep focus on deletion in this pr.

Sure we can, if you think this is not related to your pr.

I am silent now about this topic, no problem :)

@ChristopherHX I just tried adding CleanupEphemeralRunners to modules/actions/run.go and cannot compile. Import cycle error.

[ChristopherHX]

@ChristopherHX I just tried adding CleanupEphemeralRunners to modules/actions/run.go and cannot compile. Import cycle error.

Just a random idea:
Move your code from actions modules to actions services? so both are in the same module.

AFAIK Web and rest api can reference service, but I didn't think about where your deletion code is, relative to my cleanup function.

Anything else about ephemeral runners might be better discussed in a new issue / proposal. The old code works, because tasks that are finished within 24h are never deleted yet.

[NorthRealm]

@ChristopherHX I just tried adding CleanupEphemeralRunners to modules/actions/run.go and cannot compile. Import cycle error.

Just a random idea: Move your code from actions modules to actions services? so both are in the same module.

AFAIK Web and rest api can reference service, but I didn't think about where your deletion code is, relative to my cleanup function.

Anything else about ephemeral runners might be better discussed in a new issue / proposal. The old code works, because tasks that are finished within 24h are never deleted yet.

Just pushed new commits. Please check.