mirror of
https://github.com/actions/runner.git
synced 2025-12-10 12:36:23 +00:00
e291ebc58a
Add runner authentication/authorization documentation. This doc explains how auth is used at all phases of the runner lifetime (i.e. configuration, listener start, and workflow run), for both self-hosted and hosted runners.
52 lines
2.8 KiB
Plaintext
52 lines
2.8 KiB
Plaintext
# Markup used to generate the runner auth diagrams: https://websequencediagrams.com
|
|
|
|
title Runner Configuration (self-hosted only)
|
|
|
|
note left of Runner: GitHub repo URL as input
|
|
Runner->github.com: Retrieve Actions Service access using runner registration token
|
|
github.com->Runner: Access token for Actions Service
|
|
note left of Runner: Generate RSA key pair
|
|
note left of Runner: Store encrypted RSA private key on disk
|
|
Runner->Actions Service: Register runner using Actions Service access token
|
|
note right of Runner: Runner name, RSA public key sent
|
|
note right of Actions Service: Public key stored
|
|
Actions Service->Token Service: Register runner as an app along with the RSA public key
|
|
note right of Token Service: Public key stored
|
|
Token Service->Actions Service: Client Id for the runner application
|
|
Actions Service->Runner: Client Id and Token Endpoint URL
|
|
note left of Runner: Store runner configuration info into .runner file
|
|
note left of Runner: Store Token registration info into .credentials file
|
|
|
|
title Runner Start and Running (self-hosted only)
|
|
|
|
Runner.Listener->Runner.Listener: Start
|
|
note left of Runner.Listener: Load config info from .runner
|
|
note left of Runner.Listener: Load token registration from .credentials
|
|
Runner.Listener->Token Service: Exchange OAuth token (happens every 50 mins)
|
|
note right of Runner.Listener: Construct JWT token, use Client Id signed by RSA private key
|
|
note left of Actions Service: Find corresponding RSA public key, use Client Id\nVerify JWT token's signature
|
|
Token Service->Runner.Listener: OAuth token with limited permission and valid for 50 mins
|
|
Runner.Listener->Actions Service: Connect to Actions Service with OAuth token
|
|
Actions Service->Runner.Listener: Workflow job
|
|
|
|
title Running workflow
|
|
|
|
Runner.Listener->Service (Message Queue): Get message
|
|
note right of Runner.Listener: Authenticate with exchanged OAuth token
|
|
Event->Actions Service: Queue workflow
|
|
Actions Service->Actions Service: Generate OAuth token per job
|
|
Actions Service->Actions Service: Build job message with the OAuth token
|
|
Actions Service->Actions Service: Encrypt job message with the target runner's public key
|
|
Actions Service->Service (Message Queue): Send encrypted job message to runner
|
|
Service (Message Queue)->Runner.Listener: Send job
|
|
note right of Runner.Listener: Decrypt message with runner's private key
|
|
Runner.Listener->Runner.Worker: Create worker process per job and run the job
|
|
|
|
title Runner Configuration, Start and Running (hosted only)
|
|
|
|
Machine Management Service->Runner.Listener: Construct .runner configuration file, store token in .credentials
|
|
Runner.Listener->Runner.Listener: Start
|
|
note left of Runner.Listener: Load config info from .runner
|
|
note left of Runner.Listener: Load OAuth token from .credentials
|
|
Runner.Listener->Actions Service: Connect to Actions Service with OAuth token in .credentials
|
|
Actions Service->Runner.Listener: Workflow job |