action.yaml

name: OverlayFS Workspace Checkout
description: Uses an OverlayFS mount of a golden workspace to provide zero-copy, instant checkouts.

inputs:
  ref:
    description: Git ref to checkout.
    required: true
  path:
    description: Destination path (e.g. cobalt).
    required: true
  run_sync:
    description: Whether or not to run gclient sync for the PR.
    default: 'true'

outputs:
  cache_hit:
    description: "Whether the golden workspace cache was hit on the node SSD."
    value: ${{ steps.prepare.outputs.cache_hit }}

runs:
  using: "composite"
  steps:
    - name: Prepare OverlayFS Workspace
      id: prepare
      shell: bash
      run: |
        # LOWER_DIR (Read-Only): The pristine golden workspace (tip of tree) on the node's SSD. All pods read from this.
        LOWER_DIR="/runner-cache/golden-workspace"

        # UPPER_DIR (Read-Write): The temporary layer where all file changes, build artifacts, and PR-specific git objects are written.
        UPPER_DIR="/runner-cache/workspaces/${GITHUB_RUN_ID}_${GITHUB_RUN_ATTEMPT}/upper"

        # WORK_DIR: Required by OverlayFS for atomic file operations. Must be on the same filesystem as UPPER_DIR.
        WORK_DIR="/runner-cache/workspaces/${GITHUB_RUN_ID}_${GITHUB_RUN_ATTEMPT}/work"

        # MERGED_DIR: The directory the CI job actually sees and works in. It seamlessly combines LOWER_DIR and UPPER_DIR.
        MERGED_DIR="${GITHUB_WORKSPACE}/${{ inputs.path }}"

        # Failsafe cleanup: Unmount and delete any orphaned workspaces from cancelled jobs
        # Since this node only runs one pod at a time, we can safely wipe all workspaces.
        echo "Cleaning up any orphaned overlay workspaces..."
        fusermount3 -u "$MERGED_DIR" || fusermount -u "$MERGED_DIR" || umount "$MERGED_DIR" || true
        rm -rf /runner-cache/workspaces/*

        # Ensure the directories exist
        mkdir -p "$UPPER_DIR" "$WORK_DIR" "$MERGED_DIR"

        # Add GoB Authentication
        if ! curl -s -m 2 -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email" > /dev/null; then
          echo "Metadata server not reachable. Skipping GoB authentication setup."
        else
          SERVICE_ACCOUNT=$(curl -s -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email")
          ACCESS_TOKEN=$(curl -s -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" | jq -r .access_token)
          if [[ -n "${SERVICE_ACCOUNT}" && -n "${ACCESS_TOKEN}" ]]; then
            echo "::add-mask::${ACCESS_TOKEN}"
            echo "Authenticating with ${SERVICE_ACCOUNT}"
            GITCOOKIES_PATH="/tmp/gitcookies"
            (umask 077 && printf ".googlesource.com\tTRUE\t/\tTRUE\t2147483647\to\tgit-%s=%s\ngooglesource.com\tTRUE\t/\tTRUE\t2147483647\to\tgit-%s=%s\n" \
              "${SERVICE_ACCOUNT}" "${ACCESS_TOKEN}" "${SERVICE_ACCOUNT}" "${ACCESS_TOKEN}" > "${GITCOOKIES_PATH}")
            git config --global http.cookiefile "${GITCOOKIES_PATH}"
          fi
        fi

        # If the golden workspace does not exist or is corrupted (missing .gclient), initialize it.
        # This will only happen once per node!
        if [ ! -f "$LOWER_DIR/.gclient" ]; then
          IS_CACHE_HOT="false"
          echo "cache_hit=false" >> $GITHUB_OUTPUT
          echo "Golden workspace not found or corrupted. Creating it now. This will take time..."

          # Aggressively clean up any corrupted state from previous bad runs
          rm -rf "$LOWER_DIR"
          mkdir -p "$LOWER_DIR"
          cd "$LOWER_DIR"

          git clone https://github.com/youtube/cobalt.git src
          # Clone depot_tools
          git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git depot_tools
          export PATH="$LOWER_DIR/depot_tools:$PATH"

          gclient config \
            --name=src \
            --custom-var="rbe_instance=\"projects/cobalt-actions-prod/instances/default_instance\"" \
            "https://github.com/youtube/cobalt.git"
          echo "target_os=['android', 'linux']" >> .gclient
          echo "target_cpu=['x64', 'arm', 'arm64']" >> .gclient
          gclient sync -D --no-history
        else
          IS_CACHE_HOT="true"
          echo "cache_hit=true" >> $GITHUB_OUTPUT
        fi

        echo "Logging workspace cache status to Cloud Logging..."
        LOG_PAYLOAD=$(jq -n \
          --arg workflow "$GITHUB_WORKFLOW" \
          --arg job "$GITHUB_JOB" \
          --arg runner "$RUNNER_NAME" \
          --arg run_id "$GITHUB_RUN_ID" \
          --arg url "https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
          --argjson cache_hit "$IS_CACHE_HOT" \
          '{workflow: $workflow, job: $job, runner: $runner, run_id: $run_id, url: $url, cache_hit: $cache_hit}')

        gcloud logging write github-actions-runners "$LOG_PAYLOAD" --payload-type=json || true

        echo "Mounting OverlayFS..."
        # Depending on your runner's privilege, use sudo mount or fuse-overlayfs
        fuse-overlayfs -o lowerdir="$LOWER_DIR",upperdir="$UPPER_DIR",workdir="$WORK_DIR" "$MERGED_DIR"

        # Avoid git ownership errors inside the container
        git config --global --add safe.directory "$MERGED_DIR"
        git config --global --add safe.directory "$MERGED_DIR/src"
        git config --global --add safe.directory "$MERGED_DIR/depot_tools"

        echo "Updating PR commit in upper layer..."
        cd "$MERGED_DIR/src"
        git fetch origin ${{ inputs.ref }}
        git checkout ${{ inputs.ref }}

        echo "Applying gclient configuration..."
        cd "$MERGED_DIR"
        export PATH="$MERGED_DIR/depot_tools:$PATH"

        # Persist depot_tools and CIPD cache to the GitHub Actions environment for subsequent steps
        echo "$MERGED_DIR/depot_tools" >> $GITHUB_PATH
        echo "CIPD_CACHE_DIR=/runner-cache/cipd-cache" >> $GITHUB_ENV

        echo "Bootstrapping Python 3 for depot_tools..."
        # Must be run manually as $DEPOT_TOOLS_UPDATE is 0 in CI, skipping the bootstrap.
        source "$MERGED_DIR/depot_tools/bootstrap_python3" && bootstrap_python3

        # Disable Chromium client side build telemetry
        build_telemetry opt-out

        # Set target OS
        if [[ "${{ matrix.platform }}" == *"android"* ]]; then
          echo "target_os=['android']" >> .gclient
        elif [[ "${{ matrix.platform }}" == *"tvos"* ]]; then
          echo "target_os=['ios']" >> .gclient
        fi

        # Set target CPU
        if [[ "${{ matrix.platform }}" == *"evergreen-arm64"* ]]; then
          echo "target_cpu=['x64', 'arm64']" >> .gclient
        elif [[ "${{ matrix.platform }}" == *"raspi-2"* || "${{ matrix.platform }}" == *"evergreen-arm"* ]]; then
          echo "target_cpu=['x64', 'arm']" >> .gclient
        fi

        if [[ "${{ inputs.run_sync }}" == "true" ]]; then
          echo "Syncing specific dependencies needed for this PR..."
          cd "$MERGED_DIR"
          gclient sync \
            --verbose \
            --shallow \
            --no-history \
            --reset \
            --nohooks \
            --force \
            --delete_unversioned_trees \
            --revision "${{ inputs.ref }}"

          echo "Running gclient runhooks..."
          gclient runhooks --verbose
        fi