package ci
import (
"errors"
"fmt"
"log"
"net/url"
"path"
"strings"
)
// errTransient marks a launch failure that says nothing about the
// check-in's own pipelines — the store answered strangely, or the
// engine could not be reached. The watermark must NOT advance past
// one: the next round retries, and nothing is silently lost. Its
// counterpart is the content fault (a pipeline that does not compile,
// an engine that refused the document), which DOES advance, because
// retrying a bad definition forever would wedge the watermark — the
// original rationale, kept.
var errTransient = errors.New("transient")
// transient wraps err so the trigger holds the watermark.
func transient(err error) error {
return fmt.Errorf("%w: %w", errTransient, err)
}
// engineUnreachable reports a network-shaped engine error — the engine
// never answered, as opposed to answering with a refusal.
func engineUnreachable(err error) bool {
var u *url.Error
return errors.As(err, &u)
}
// Store is the record-keeping the trigger needs; the OLTP database
// satisfies it.
type Store interface {
CIWatermark(repo string) (string, bool)
SetCIWatermark(repo, checkin string) error
AddRun(runID, repo, checkin, workflow, pipeline, status string) error
}
// Repo is the read side the trigger needs: which check-ins are new, and
// what the repository's pipelines look like AT that check-in.
type Repo interface {
// NewCheckins returns check-ins after the watermark, oldest first.
// An empty watermark means "the tip only" — a first run must not
// launch a pipeline for every check-in in a repository's history,
// which on an imported corpus would be tens of thousands.
NewCheckins(after string, limit int) ([]Checkin, error)
// Files lists a check-in's paths.
Files(version string) ([]string, error)
// Read returns one file's bytes at a check-in.
Read(path, version string) ([]byte, error)
}
// Checkin is the context a pipeline receives.
type Checkin struct {
Hash string
Branch string
Date string
User string
Comment string
}
// Trigger launches pipelines for check-ins a repository has not seen.
// It is deliberately quiet about the ordinary case — most repositories
// have no ci/ directory, and that is not a condition worth logging on
// every sync round.
func Trigger(e *Engine, st Store, repo string, r Repo, cloneURL string) error {
if !e.Enabled() {
return nil
}
mark, ok := st.CIWatermark(repo)
if !ok {
// First sight of this repository: take the tip as the watermark
// without running anything. Launching the whole history would
// be a denial of service against the engine and would say
// nothing useful about code nobody just changed.
tip, err := r.NewCheckins("", 1)
if err != nil || len(tip) == 0 {
return err
}
return st.SetCIWatermark(repo, tip[len(tip)-1].Hash)
}
fresh, err := r.NewCheckins(mark, 20)
if err != nil {
return err
}
for _, c := range fresh {
if err := launch(e, st, repo, r, c, cloneURL); err != nil {
if errors.Is(err, errTransient) {
// The failure says nothing about this check-in's own
// pipelines. Hold the watermark and stop — the next
// round retries from here, in order, losing nothing.
// (2026-08-29: a drifted zit parser answered "no
// files" for three trunk check-ins and the old code
// walked the watermark past all of them, silently.)
log.Printf("ci: %s %.12s: %v — watermark held, retrying next round", repo, c.Hash, err)
return nil
}
// A content fault — the pipeline itself, or the engine's
// judgment of it. Advancing is right: retrying a bad
// definition forever would wedge the watermark.
log.Printf("ci: %s %.12s: %v", repo, c.Hash, err)
}
if err := st.SetCIWatermark(repo, c.Hash); err != nil {
return err
}
}
return nil
}
// RunAt launches a check-in's pipelines regardless of the watermark —
// the re-run path (RFC 0009 §triggers). An empty checkin means the tip.
func RunAt(e *Engine, st Store, repo string, r Repo, cloneURL, checkin string) error {
if !e.Enabled() {
return fmt.Errorf("ci: no engine configured")
}
var c Checkin
if checkin == "" {
tip, err := r.NewCheckins("", 1)
if err != nil {
return err
}
if len(tip) == 0 {
return fmt.Errorf("ci: %s has no check-ins", repo)
}
c = tip[len(tip)-1]
} else {
c = Checkin{Hash: checkin}
}
return launch(e, st, repo, r, c, cloneURL)
}
func launch(e *Engine, st Store, repo string, r Repo, c Checkin, cloneURL string) error {
files, err := r.Files(c.Hash)
if err != nil {
return transient(err)
}
if len(files) == 0 {
// A check-in always has files. An empty answer is a parser or
// index fault (zit 0.3.0's ls drift read exactly like this),
// never evidence of "no pipelines".
return transient(fmt.Errorf("the store answered no files at all for this check-in"))
}
var pipelines []string
for _, f := range files {
if IsPipeline(f) {
pipelines = append(pipelines, f)
}
}
if len(pipelines) == 0 {
return nil // no ci/ directory: the common case, silently fine
}
for _, p := range pipelines {
def, err := r.Read(p, c.Hash)
if err != nil {
return transient(fmt.Errorf("read %s: %w", p, err))
}
// Registered from the definition AT THIS CHECK-IN, so a pipeline
// edit takes effect for the check-in that made it and not before.
// A ci.yml is named by its file stem — the spec language has no
// name field of its own — which is the same posture JSON
// pipelines already take on a shared engine: the register just
// before every Start keeps each run on its own definition.
// Registered under a name that names the REPOSITORY as well as
// the file, because the engine is shared and a file stem is not
// unique across repositories. See ScopedName.
stem := strings.TrimSuffix(strings.TrimSuffix(path.Base(p), ".yml"), ".yaml")
stem = strings.TrimSuffix(stem, ".json")
name := ScopedName(repo, stem)
var wf Workflow
if strings.HasSuffix(p, ".json") {
wf, err = e.RegisterNamed(name, def)
} else {
wf, err = e.RegisterYAML(name, def)
}
if err != nil {
if engineUnreachable(err) {
return transient(err)
}
return err // the engine answered: a content refusal
}
labels := map[string]string{"repo": repo, "checkin": c.Hash, "pipeline": p}
if c.Branch != "" {
labels["branch"] = c.Branch
// A new check-in on a branch makes the branch's still-running
// builds stale; stop them (dagnats#629, best-effort).
if n, err := e.Supersede(wf.Name, map[string]string{
"repo": repo, "branch": c.Branch, "pipeline": p,
}); err == nil && n > 0 {
log.Printf("ci: %s %s: superseded %d run(s)", repo, c.Branch, n)
}
}
runID, err := e.Start(wf.Name, map[string]any{
"repo": repo,
"checkin": c.Hash,
"branch": c.Branch,
"date": c.Date,
"user": c.User,
"comment": c.Comment,
"cloneUrl": cloneURL,
"pipeline": p,
}, labels)
if err != nil {
if engineUnreachable(err) {
return transient(err)
}
return err
}
if err := st.AddRun(runID, repo, c.Hash, wf.Name, p, "running"); err != nil {
// The run is launched but unrecorded; losing the mapping
// by advancing would orphan it.
return transient(err)
}
log.Printf("ci: %s %.12s -> %s run %s", repo, c.Hash, wf.Name, runID)
}
return nil
}