Merge branch 'main' into renovate/actions-checkout-6.x

Author: mergify[bot]

pkg/cache/filelock.go

@@ -21,7 +21,7 @@ type FileLock interface {
 	WithRLock(fn func() error) error
 
 	// TryWithRLock executes fn while holding a shared read lock when it can be
-	// acquired immediately. It returns false, nil when another process holds an
+	// acquired quickly. It returns false, nil when another process holds an
 	// exclusive lock. On Windows, it executes without locking and returns true.
 	TryWithRLock(fn func() error) (acquired bool, err error)
 }

pkg/cache/filelock_unix.go

@@ -14,6 +14,17 @@ import (
 
 const cacheLockTimeout = 2 * time.Second
 
+// tryReadLockTimeout bounds the "best-effort, non-blocking" read-lock attempts
+// in WithRLock and TryWithRLock. It must stay well under cacheLockTimeout so
+// these still fail fast under genuine contention, but 1ms (the original
+// value) was tight enough that ordinary scheduling/IO jitter on a loaded CI
+// runner -- not actual lock contention -- could make an uncontended
+// acquisition miss its deadline, which TryWithRLock's callers (e.g. workdir
+// metadata reads) treat identically to "lock held by another process."
+// 50ms comfortably exceeds filelock's internal retryDelay (10ms), so a
+// briefly-held exclusive lock also has a real chance to clear within budget.
+const tryReadLockTimeout = 50 * time.Millisecond
+
 type flockFileLock struct{ lockPath string }
 
 // NewFileLock preserves the cache package API while using a stable sibling
@@ -50,8 +61,8 @@ func (l *flockFileLock) WithRLock(fn func() error) error {
 	defer perf.Track(nil, "cache.flockFileLock.WithRLock")()
 
 	// Cache reads are deliberately best-effort. Preserve the old non-blocking
-	// behavior by reading without a lock when one is immediately unavailable.
-	ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+	// behavior by reading without a lock when one isn't quickly available.
+	ctx, cancel := context.WithTimeout(context.Background(), tryReadLockTimeout)
 	defer cancel()
 	err := filelock.New(l.lockPath).WithShared(ctx, fn)
 	if errors.Is(err, filelock.ErrAcquire) && ctx.Err() != nil {
@@ -68,11 +79,11 @@ func cacheLockError(err error) error {
 }
 
 // TryWithRLock executes fn only when a shared read lock can be acquired
-// immediately.
+// quickly (see tryReadLockTimeout).
 func (f *flockFileLock) TryWithRLock(fn func() error) (bool, error) {
 	defer perf.Track(nil, "cache.flockFileLock.TryWithRLock")()
 
-	ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+	ctx, cancel := context.WithTimeout(context.Background(), tryReadLockTimeout)
 	defer cancel()
 	err := filelock.New(f.lockPath).WithShared(ctx, fn)
 	if errors.Is(err, filelock.ErrAcquire) {

pkg/provisioner/workdir/metadata_lock_unix_test.go

@@ -204,7 +204,7 @@ func TestWithMetadataFileLockUnix_LockUnavailable(t *testing.T) {
 // which succeeds against a directory). Instead, point the metadata file at a
 // path whose parent directory does not exist, so the open() call inside
 // TryWithRLock fails immediately with ENOENT (a hard error) rather than the
-// 1ms internal timeout merely expiring without an error - deterministically
+// internal try-lock timeout merely expiring without an error - deterministically
 // forcing the hard-error variant.
 func TestLoadMetadataWithReadLockUnix_LockUnavailable(t *testing.T) {
 	tmpDir := t.TempDir()
@@ -221,8 +221,8 @@ func TestLoadMetadataWithReadLockUnix_LockUnavailable(t *testing.T) {
 // "!acquired && err == nil" branch (the "return nil, nil" contended-read
 // path). This is genuinely distinct from both LockUnavailable tests above:
 // here the lock file opens fine but is already held exclusively by another
-// holder, so TryWithRLock's 1ms internal timeout expires without an OS-level
-// error. The existing goroutine-based TestLoadMetadataWithReadLockUnix_ConcurrentReads
+// holder, so TryWithRLock's internal try-lock timeout expires without an
+// OS-level error. The existing goroutine-based TestLoadMetadataWithReadLockUnix_ConcurrentReads
 // doesn't reliably hit this branch because shared (read) locks don't
 // contend with each other, so this test forces it deterministically by
 // holding a separate exclusive lock, matching the style of

pkg/toolchain/installer/asset.go

@@ -2,6 +2,7 @@ package installer
 
 import (
 	"fmt"
+	"path"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -42,6 +43,10 @@ func (i *Installer) buildAssetURLForPlatform(tool *registry.Tool, version, goos,
 		return i.buildHTTPAssetURLForPlatform(tool, version, goos, goarch)
 	case "github_release":
 		return i.buildGitHubReleaseURLForPlatform(tool, version, goos, goarch)
+	case "github_archive":
+		return i.buildGitHubArchiveURL(tool, version)
+	case "github_content":
+		return i.buildGitHubContentURL(tool, version)
 	default:
 		return "", fmt.Errorf("%w: unsupported tool type: %s", ErrInvalidToolSpec, tool.Type)
 	}
@@ -100,6 +105,61 @@ func (i *Installer) buildGitHubReleaseURLForPlatform(tool *registry.Tool, versio
 	return url, nil
 }
 
+// buildGitHubArchiveURL builds an asset URL for github_archive type tools.
+// Matches upstream aquaproj/aqua behavior: always uses GitHub's tag archive endpoint
+// with .tar.gz format. The Asset, URL, Format, and FormatOverrides fields are
+// intentionally ignored (Aqua's GetFormat() hardcodes "tar.gz" for github_archive).
+// See: https://github.com/aquaproj/aqua/blob/main/pkg/download/github_archive.go.
+func (i *Installer) buildGitHubArchiveURL(tool *registry.Tool, version string) (string, error) {
+	defer perf.Track(nil, "Installer.buildGitHubArchiveURL")()
+
+	if tool.RepoOwner == "" || tool.RepoName == "" {
+		return "", fmt.Errorf("%w: RepoOwner and RepoName must be set for github_archive type (got RepoOwner=%q, RepoName=%q)",
+			ErrInvalidToolSpec, tool.RepoOwner, tool.RepoName)
+	}
+
+	data := buildTemplateData(tool, version)
+	return fmt.Sprintf("https://github.com/%s/%s/archive/refs/tags/%s.tar.gz",
+		tool.RepoOwner, tool.RepoName, data.Version), nil
+}
+
+// buildGitHubContentURL builds an asset URL for github_content type tools.
+// Matches upstream aquaproj/aqua behavior: downloads a single file from a repo
+// at a tag via raw.githubusercontent.com. The Asset, URL, Format, and
+// FormatOverrides fields are intentionally ignored for this type.
+// See: https://github.com/aquaproj/aqua/blob/main/pkg/download/github_content.go.
+func (i *Installer) buildGitHubContentURL(tool *registry.Tool, version string) (string, error) {
+	defer perf.Track(nil, "Installer.buildGitHubContentURL")()
+
+	if err := validateGitHubContentFields(tool); err != nil {
+		return "", err
+	}
+	data := buildTemplateData(tool, version)
+	return formatGitHubContentURL(tool.RepoOwner, tool.RepoName, data.Version, tool.Path), nil
+}
+
+// validateGitHubContentFields verifies that a github_content tool has the
+// required RepoOwner, RepoName, and Path fields. Pure function: no I/O, no state.
+func validateGitHubContentFields(tool *registry.Tool) error {
+	if tool.RepoOwner == "" || tool.RepoName == "" || tool.Path == "" {
+		return fmt.Errorf("%w: RepoOwner, RepoName, and Path must be set for github_content type (got RepoOwner=%q, RepoName=%q, Path=%q)",
+			ErrInvalidToolSpec, tool.RepoOwner, tool.RepoName, tool.Path)
+	}
+	// Path is a repo-relative URL segment (always forward-slash, regardless of
+	// host OS), so use the "path" package rather than "path/filepath" here.
+	if path.IsAbs(tool.Path) || strings.Contains(tool.Path, "..") {
+		return fmt.Errorf("%w: Path must be a relative repository path for github_content type (got Path=%q)",
+			ErrInvalidToolSpec, tool.Path)
+	}
+	return nil
+}
+
+// formatGitHubContentURL formats a raw.githubusercontent.com URL from its
+// component parts. Pure function: no inputs beyond the parameters.
+func formatGitHubContentURL(owner, repo, version, path string) string {
+	return fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/%s/%s", owner, repo, version, path)
+}
+
 // archiveExtensions contains known archive file extensions.
 var archiveExtensions = []string{
 	".tar.gz", ".tgz", ".zip", ".gz",