@secureci/cli 0.5.1 → 0.7.0

package/dist/runner/executor.js

@@ -50,6 +50,7 @@ const job_runtime_1 = require("./job-runtime");
 const job_container_1 = require("./job-container");
 const steps_1 = require("./steps");
 const actions_1 = require("./actions");
+const scheduler_1 = require("./scheduler");
 // Public API, kept here so `executor` stays the entry point.
 var github_context_2 = require("./github-context");
 Object.defineProperty(exports, "parseRepositoryFromRemote", { enumerable: true, get: function () { return github_context_2.parseRepositoryFromRemote; } });
@@ -59,6 +60,8 @@ Object.defineProperty(exports, "topologicalJobOrder", { enumerable: true, get: f
 var job_container_2 = require("./job-container");
 Object.defineProperty(exports, "DEFAULT_CONTAINER_IMAGE", { enumerable: true, get: function () { return job_container_2.DEFAULT_CONTAINER_IMAGE; } });
 Object.defineProperty(exports, "DEFAULT_RUNNER_IMAGES", { enumerable: true, get: function () { return job_container_2.DEFAULT_RUNNER_IMAGES; } });
+/** The error of a step killed because its job was cancelled (GitHub's). */
+const CANCELLED_MESSAGE = 'The operation was canceled.';
 /**
  * Execute a reusable workflow called via `jobs.<id>.uses:`: a local path
  * (`./.github/workflows/x.yml`, relative to the repository root) or a
@@ -67,7 +70,7 @@ Object.defineProperty(exports, "DEFAULT_RUNNER_IMAGES", { enumerable: true, get:
  * (all of them with `secrets: inherit`), and its `on.workflow_call.outputs`
  * become the calling job's outputs.
  */
-async function executeReusableWorkflowJob(jobId, job, callerPath, options, ctx) {
+async function executeReusableWorkflowJob(jobId, job, callerPath, options, ctx, internal) {
     const startTime = Date.now();
     const uses = job.uses;
     const failed = (error) => {
@@ -111,8 +114,10 @@ async function executeReusableWorkflowJob(jobId, job, callerPath, options, ctx)
         ...options,
         inputs,
         secrets,
-        job: undefined
-    });
+        // --job and --matrix select the caller's jobs, not the called ones.
+        job: undefined,
+        matrix: undefined
+    }, internal);
     return {
         job: jobId,
         success: subResult.success,
@@ -122,9 +127,11 @@ async function executeReusableWorkflowJob(jobId, job, callerPath, options, ctx)
     };
 }
 /**
- * Execute a workflow or action file
+ * Execute a workflow or action file. Jobs whose `needs:` are done, and
+ * matrix combinations, run concurrently up to `options.parallel` (default
+ * 1: one after another).
  */
-async function executeWorkflow(filePath, options = {}) {
+async function executeWorkflow(filePath, options = {}, internal = {}) {
     const startTime = Date.now();
     logger_1.logger.registerSecrets(options.secrets);
     // One run id for every job and called workflow of this run.
@@ -164,32 +171,55 @@ async function executeWorkflow(filePath, options = {}) {
             const event = (0, github_context_1.loadEvent)(options, options.inputs ?? {}, parsed.file.on);
             const inputs = (0, github_context_1.typedInputs)(parsed.file.on, options.inputs ?? {});
             fs.writeFileSync(path.join(runDir, 'event.json'), JSON.stringify(event.payload));
-            const jobs = [];
-            const jobResults = new Map();
-            const jobOrder = (0, job_plan_1.topologicalJobOrder)(parsed.file.jobs);
-            for (const jobId of jobOrder) {
-                const job = parsed.file.jobs[jobId];
-                // Skip if specific job requested and this isn't it
-                if (options.job && jobId !== options.job) {
-                    continue;
+            const vars = options.vars ?? {};
+            const parallel = Math.max(1, Math.floor(options.parallel ?? 1));
+            const concurrent = parallel > 1;
+            const slots = internal.slots ?? new scheduler_1.Slots(parallel);
+            const matrixFilter = options.matrix ?? {};
+            const definedMatrixKeys = new Set();
+            let matrixUnmatched = false;
+            const order = (0, job_plan_1.topologicalJobOrder)(parsed.file.jobs).filter(
+            // With --job, only that job runs; its dependencies count as done.
+            (jobId) => !options.job || jobId === options.job);
+            // Label log lines with their job only when jobs can interleave.
+            const prefixJobs = concurrent &&
+                (order.length > 1 ||
+                    order.some((jobId) => parsed.file.jobs[jobId].strategy?.matrix));
+            const tagged = (label, fn, replace = false) => (prefixJobs ? logger_1.logger.withJob(label, fn, replace) : fn());
+            const needsOf = (jobId) => {
+                const needs = parsed.file.jobs[jobId].needs;
+                return needs ? (Array.isArray(needs) ? needs : [needs]) : [];
+            };
+            const selectCombinations = (jobId, combinations) => {
+                for (const combo of combinations) {
+                    Object.keys(combo).forEach((key) => definedMatrixKeys.add(key));
+                }
+                const { keys, matches } = (0, job_plan_1.filterMatrix)(combinations, matrixFilter);
+                if (keys.length > 0 && matches.length === 0) {
+                    logger_1.logger.warn((0, job_plan_1.noMatrixMatchMessage)(jobId, matrixFilter, combinations));
+                    matrixUnmatched = true;
                 }
+                return matches;
+            };
+            // Each job's results, in matrix order; collected in `order` at the end
+            // so the report doesn't depend on which job finished first.
+            const resultsByJob = new Map();
+            const runJob = (jobId, depResults) => tagged(jobId, async () => {
+                const job = parsed.file.jobs[jobId];
+                const jobs = [];
+                resultsByJob.set(jobId, jobs);
                 const github = (0, github_context_1.buildGithubContext)(parsed.file.name, jobId, process.cwd(), event, options.secrets?.GITHUB_TOKEN, options.runId);
                 // `needs` results feed the job's `if:` (implicitly `success()`,
                 // which requires every dependency to have succeeded). With --job,
                 // dependencies aren't run and count as successful.
-                const needsIds = job.needs
-                    ? Array.isArray(job.needs)
-                        ? job.needs
-                        : [job.needs]
-                    : [];
+                const needsIds = needsOf(jobId);
                 const needs = {};
                 for (const dep of needsIds) {
-                    needs[dep] = jobResults.get(dep) ?? {
+                    needs[dep] = depResults[dep] ?? {
                         result: 'success',
                         outputs: {}
                     };
                 }
-                const vars = options.vars ?? {};
                 const jobIfCtx = {
                     ...(0, expression_1.createContext)({}, inputs, options.secrets, github),
                     needs,
@@ -199,276 +229,360 @@ async function executeWorkflow(filePath, options = {}) {
                         anyFailed: Object.values(needs).some((n) => n.result === 'failure')
                     }
                 };
-                let runJob;
+                let runThisJob;
                 try {
-                    runJob = (0, expression_1.evaluateCondition)((0, expression_1.withImplicitSuccess)(job.if), jobIfCtx);
+                    runThisJob = (0, expression_1.evaluateCondition)((0, expression_1.withImplicitSuccess)(job.if), jobIfCtx);
                 }
                 catch (error) {
                     // An if: that can't be evaluated fails the job, as on GitHub.
                     logger_1.logger.error((0, expression_1.ifEvaluationError)(`job '${jobId}'`, error));
                     jobs.push({ job: jobId, success: false, steps: [], duration: 0 });
-                    jobResults.set(jobId, { result: 'failure', outputs: {} });
-                    continue;
+                    return { result: 'failure', outputs: {} };
                 }
-                if (!runJob) {
+                if (!runThisJob) {
                     const notOk = needsIds.find((dep) => needs[dep].result !== 'success');
                     logger_1.logger.info(notOk
                         ? `Skipping job: ${jobId} (dependency "${notOk}" ${needs[notOk].result === 'skipped' ? 'was skipped' : 'did not succeed'})`
                         : `Skipping job: ${jobId} (condition not met)`);
-                    jobResults.set(jobId, { result: 'skipped', outputs: {} });
-                    continue;
-                }
-                // Handle reusable workflow calls (once per matrix combination)
-                if (job.uses) {
-                    const combinations = (0, job_plan_1.expandMatrix)(job.strategy?.matrix, jobIfCtx);
-                    const callOutputs = {};
-                    let callFailed = false;
-                    for (const matrixValues of combinations) {
-                        if (callFailed && job.strategy?.['fail-fast'] !== false)
-                            break;
-                        const label = combinations.length > 1
-                            ? `${jobId} (${(0, job_plan_1.matrixLabel)(matrixValues)})`
-                            : jobId;
-                        const reusableResult = await executeReusableWorkflowJob(label, job, filePath, options, { ...jobIfCtx, matrix: matrixValues });
-                        jobs.push(reusableResult);
-                        Object.assign(callOutputs, reusableResult.outputs);
-                        if (!reusableResult.success)
-                            callFailed = true;
-                    }
-                    jobResults.set(jobId, {
-                        result: callFailed ? 'failure' : 'success',
-                        outputs: callOutputs
-                    });
-                    if (!callFailed) {
-                        logger_1.logger.success(`Job ${jobId} completed successfully`);
-                    }
-                    continue;
+                    return { result: 'skipped', outputs: {} };
                 }
                 const matrixCombinations = (0, job_plan_1.expandMatrix)(job.strategy?.matrix, jobIfCtx);
+                const selected = selectCombinations(jobId, matrixCombinations);
+                if (selected.length === 0)
+                    return { result: 'skipped', outputs: {} };
                 const failFast = job.strategy?.['fail-fast'] !== false;
-                let matrixFailed = false;
-                const jobOutputs = {};
-                for (const [jobIndex, matrixValues] of matrixCombinations.entries()) {
-                    if (matrixFailed && failFast) {
-                        logger_1.logger.info(`Skipping remaining matrix jobs for ${jobId} (fail-fast)`);
-                        break;
-                    }
-                    const matrixSuffix = matrixCombinations.length > 1
-                        ? ` (${(0, job_plan_1.matrixLabel)(matrixValues)})`
-                        : '';
-                    const jobLabel = `${jobId}${matrixSuffix}`;
-                    const runtime = (0, job_runtime_1.createJobRuntime)(github, runDir, {
-                        shell: job.defaults?.run?.shell ?? parsed.file.defaults?.run?.shell,
-                        workingDirectory: job.defaults?.run?.['working-directory'] ??
-                            parsed.file.defaults?.run?.['working-directory']
-                    });
-                    // Workflow-level env can't reference `env` itself; job-level env
-                    // sees the workflow env plus matrix (matching GitHub's contexts).
-                    const workflowEnv = {
-                        ...options.env,
-                        ...(0, expression_1.substituteRecord)(parsed.file.env, {
-                            ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, github),
+                const maxParallel = (0, job_plan_1.numberSetting)(job.strategy?.['max-parallel'], jobIfCtx);
+                const labelOf = (matrixValues) => matrixCombinations.length > 1
+                    ? `${jobId} (${(0, job_plan_1.matrixLabel)(matrixValues)})`
+                    : jobId;
+                // Each combination's result and outputs, by combination index.
+                const unitResults = [];
+                const unitOutputs = [];
+                let outcomes;
+                if (job.uses) {
+                    // A reusable workflow call (once per matrix combination). The
+                    // call itself holds no slot: the called workflow's jobs do.
+                    outcomes = await (0, scheduler_1.runMatrix)(selected.length, (index, signal) => {
+                        const { index: combinationIndex, values: matrixValues } = selected[index];
+                        const label = labelOf(matrixValues);
+                        return tagged(label, async () => {
+                            const reusableResult = await executeReusableWorkflowJob(label, job, filePath, options, { ...jobIfCtx, matrix: matrixValues }, { slots, signal });
+                            const cancelled = !reusableResult.success && signal.aborted;
+                            unitResults[combinationIndex] = cancelled
+                                ? { ...reusableResult, cancelled: true }
+                                : reusableResult;
+                            unitOutputs[combinationIndex] =
+                                reusableResult.outputs ?? {};
+                            return {
+                                result: reusableResult.success
+                                    ? 'success'
+                                    : cancelled
+                                        ? 'cancelled'
+                                        : 'failure'
+                            };
+                        }, true);
+                    }, { failFast, maxParallel, signal: internal.signal });
+                }
+                else {
+                    // Outputs so far, as each combination's result reports them.
+                    const jobOutputs = {};
+                    // One matrix combination (or the job itself): its container,
+                    // services and steps. A cancelled combination (fail-fast) has
+                    // its running step killed and its containers removed.
+                    const runCombination = async (jobIndex, matrixValues, signal) => {
+                        const jobLabel = labelOf(matrixValues);
+                        const runtime = (0, job_runtime_1.createJobRuntime)(github, runDir, {
+                            shell: job.defaults?.run?.shell ?? parsed.file.defaults?.run?.shell,
+                            workingDirectory: job.defaults?.run?.['working-directory'] ??
+                                parsed.file.defaults?.run?.['working-directory']
+                        });
+                        runtime.signal = signal;
+                        // Workflow-level env can't reference `env` itself; job-level
+                        // env sees the workflow env plus matrix (matching GitHub's
+                        // contexts).
+                        const workflowEnv = {
+                            ...options.env,
+                            ...(0, expression_1.substituteRecord)(parsed.file.env, {
+                                ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, github),
+                                vars
+                            })
+                        };
+                        const jobEnv = (0, expression_1.substituteRecord)(job.env, {
+                            ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, github, matrixValues),
+                            needs,
                             vars
-                        })
-                    };
-                    const jobEnv = (0, expression_1.substituteRecord)(job.env, {
-                        ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, github, matrixValues),
-                        needs,
-                        vars
-                    });
-                    const jobCtx = {
-                        ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, github, matrixValues),
-                        needs,
-                        vars,
-                        job: { status: 'success' },
-                        runner: (0, job_runtime_1.runnerContext)(runtime),
-                        strategy: {
-                            'fail-fast': failFast,
-                            'job-index': jobIndex,
-                            'job-total': matrixCombinations.length,
-                            'max-parallel': job.strategy?.['max-parallel'] ?? matrixCombinations.length
-                        }
-                    };
-                    logger_1.logger.step(`Executing job: ${jobLabel}`);
-                    const jobStartTime = Date.now();
-                    const jobTimeoutMinutes = (0, job_plan_1.numberSetting)(job['timeout-minutes'], jobCtx);
-                    const jobDeadline = jobTimeoutMinutes
-                        ? jobStartTime + jobTimeoutMinutes * 60000
-                        : undefined;
-                    const jobTimeoutMessage = `The job running on runner secureci has exceeded the maximum execution time of ${jobTimeoutMinutes} minutes.`;
-                    const stepResults = [];
-                    if (!(await (0, job_container_1.startJobServices)(job, jobCtx, options, runtime)) ||
-                        !(await (0, job_container_1.startJobContainer)(job, jobCtx, options, runtime, runDir))) {
-                        await (0, job_container_1.stopJobContainer)(runtime);
-                        jobs.push({
-                            job: jobLabel,
-                            success: false,
-                            steps: [],
-                            duration: Date.now() - jobStartTime
                         });
-                        matrixFailed = true;
-                        continue;
-                    }
-                    if (!runtime.container) {
-                        (0, actions_1.warnUnsandboxedActions)(job.steps ?? [], jobCtx, options);
-                    }
-                    try {
-                        await (0, actions_1.runPreSteps)(job.steps ?? [], options, runtime, jobCtx, stepResults);
-                        // Execute each step
-                        for (const step of job.steps || []) {
-                            jobCtx.job = {
-                                ...jobCtx.job,
-                                status: jobCtx.jobFailed ? 'failure' : 'success'
-                            };
-                            // `$GITHUB_ENV` additions from earlier steps sit between the
-                            // job env and this step's own `env:`.
-                            const envCtx = {
-                                ...jobCtx,
-                                env: { ...jobCtx.env, ...runtime.env }
-                            };
-                            runtime.actionEnv = (0, job_runtime_1.stepActionEnv)(runtime, step);
-                            const stepCtx = {
-                                ...envCtx,
-                                github: {
-                                    ...envCtx.github,
-                                    action: runtime.actionEnv.GITHUB_ACTION
-                                },
-                                env: { ...envCtx.env, ...(0, expression_1.substituteRecord)(step.env, envCtx) }
-                            };
-                            // After a failure, only steps whose `if:` uses a status
-                            // function (always(), failure(), ...) still run.
-                            let runStep;
-                            try {
-                                runStep = (0, expression_1.evaluateCondition)((0, expression_1.withImplicitSuccess)(step.if), stepCtx);
+                        const jobCtx = {
+                            ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, github, matrixValues),
+                            needs,
+                            vars,
+                            job: { status: 'success' },
+                            runner: (0, job_runtime_1.runnerContext)(runtime),
+                            strategy: {
+                                'fail-fast': failFast,
+                                'job-index': jobIndex,
+                                'job-total': matrixCombinations.length,
+                                'max-parallel': job.strategy?.['max-parallel'] ?? matrixCombinations.length
                             }
-                            catch (error) {
-                                // An if: that can't be evaluated fails the step.
-                                const message = (0, expression_1.ifEvaluationError)(`step '${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}'`, error);
-                                logger_1.logger.error(message);
-                                stepResults.push({
-                                    step,
+                        };
+                        logger_1.logger.step(`Executing job: ${jobLabel}`);
+                        const jobStartTime = Date.now();
+                        const jobTimeoutMinutes = (0, job_plan_1.numberSetting)(job['timeout-minutes'], jobCtx);
+                        const jobDeadline = jobTimeoutMinutes
+                            ? jobStartTime + jobTimeoutMinutes * 60000
+                            : undefined;
+                        const jobTimeoutMessage = `The job running on runner secureci has exceeded the maximum execution time of ${jobTimeoutMinutes} minutes.`;
+                        const stepResults = [];
+                        const cancelledResult = () => {
+                            logger_1.logger.warn(`Cancelled job: ${jobLabel}`);
+                            unitResults[jobIndex] = {
+                                job: jobLabel,
+                                success: false,
+                                cancelled: true,
+                                steps: stepResults,
+                                duration: Date.now() - jobStartTime
+                            };
+                            return { result: 'cancelled' };
+                        };
+                        // Once the containers are up, cancelling removes them, which
+                        // ends the step running in them.
+                        let stopping;
+                        const onAbort = () => {
+                            stopping = (0, job_container_1.stopJobContainer)(runtime);
+                        };
+                        try {
+                            if (!(await (0, job_container_1.startJobServices)(job, jobCtx, options, runtime)) ||
+                                !(await (0, job_container_1.startJobContainer)(job, jobCtx, options, runtime, runDir))) {
+                                await (0, job_container_1.stopJobContainer)(runtime);
+                                if (signal.aborted)
+                                    return cancelledResult();
+                                unitResults[jobIndex] = {
+                                    job: jobLabel,
                                     success: false,
-                                    error: message,
-                                    duration: 0
-                                });
-                                if (step.id) {
-                                    jobCtx.steps[step.id] = {
-                                        outcome: 'failure',
-                                        conclusion: 'failure',
-                                        outputs: {}
-                                    };
-                                }
-                                jobCtx.jobFailed = true;
-                                continue;
-                            }
-                            if (!runStep) {
-                                logger_1.logger.info(`Skipping step: ${(0, job_runtime_1.stepDisplayName)(step, stepCtx)} (condition not met)`);
-                                const skippedResult = {
-                                    step,
-                                    success: true,
-                                    outcome: 'skipped',
-                                    output: 'Skipped: condition not met',
-                                    duration: 0
+                                    steps: [],
+                                    duration: Date.now() - jobStartTime
                                 };
-                                stepResults.push(skippedResult);
-                                if (step.id) {
-                                    jobCtx.steps[step.id] = {
-                                        outcome: 'skipped',
-                                        conclusion: 'skipped',
-                                        outputs: {}
-                                    };
-                                }
-                                continue;
+                                return { result: 'failure' };
+                            }
+                            if (signal.aborted) {
+                                await (0, job_container_1.stopJobContainer)(runtime);
+                                return cancelledResult();
+                            }
+                            signal.addEventListener('abort', onAbort, { once: true });
+                            if (!runtime.container) {
+                                (0, actions_1.warnUnsandboxedActions)(job.steps ?? [], jobCtx, options);
                             }
-                            // timeout-minutes: the step's own, or what's left of the job's.
-                            const stepMinutes = (0, job_plan_1.numberSetting)(step['timeout-minutes'], stepCtx);
-                            const jobLeft = jobDeadline !== undefined
-                                ? Math.max(jobDeadline - Date.now(), 1)
-                                : undefined;
-                            const stepMs = stepMinutes ? stepMinutes * 60000 : undefined;
-                            runtime.stepTimeout =
-                                jobLeft !== undefined &&
-                                    (stepMs === undefined || jobLeft < stepMs)
-                                    ? { ms: jobLeft, message: jobTimeoutMessage }
-                                    : stepMs !== undefined
-                                        ? {
-                                            ms: stepMs,
-                                            message: `The action '${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}' has timed out after ${stepMinutes} minutes.`
+                            try {
+                                await (0, actions_1.runPreSteps)(job.steps ?? [], options, runtime, jobCtx, stepResults);
+                                // Execute each step
+                                for (const step of job.steps || []) {
+                                    if (signal.aborted)
+                                        break;
+                                    jobCtx.job = {
+                                        ...jobCtx.job,
+                                        status: jobCtx.jobFailed ? 'failure' : 'success'
+                                    };
+                                    // `$GITHUB_ENV` additions from earlier steps sit between
+                                    // the job env and this step's own `env:`.
+                                    const envCtx = {
+                                        ...jobCtx,
+                                        env: { ...jobCtx.env, ...runtime.env }
+                                    };
+                                    runtime.actionEnv = (0, job_runtime_1.stepActionEnv)(runtime, step);
+                                    const stepCtx = {
+                                        ...envCtx,
+                                        github: {
+                                            ...envCtx.github,
+                                            action: runtime.actionEnv.GITHUB_ACTION
+                                        },
+                                        env: {
+                                            ...envCtx.env,
+                                            ...(0, expression_1.substituteRecord)(step.env, envCtx)
                                         }
+                                    };
+                                    // After a failure, only steps whose `if:` uses a status
+                                    // function (always(), failure(), ...) still run.
+                                    let runStep;
+                                    try {
+                                        runStep = (0, expression_1.evaluateCondition)((0, expression_1.withImplicitSuccess)(step.if), stepCtx);
+                                    }
+                                    catch (error) {
+                                        // An if: that can't be evaluated fails the step.
+                                        const message = (0, expression_1.ifEvaluationError)(`step '${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}'`, error);
+                                        logger_1.logger.error(message);
+                                        stepResults.push({
+                                            step,
+                                            success: false,
+                                            error: message,
+                                            duration: 0
+                                        });
+                                        if (step.id) {
+                                            jobCtx.steps[step.id] = {
+                                                outcome: 'failure',
+                                                conclusion: 'failure',
+                                                outputs: {}
+                                            };
+                                        }
+                                        jobCtx.jobFailed = true;
+                                        continue;
+                                    }
+                                    if (!runStep) {
+                                        logger_1.logger.info(`Skipping step: ${(0, job_runtime_1.stepDisplayName)(step, stepCtx)} (condition not met)`);
+                                        const skippedResult = {
+                                            step,
+                                            success: true,
+                                            outcome: 'skipped',
+                                            output: 'Skipped: condition not met',
+                                            duration: 0
+                                        };
+                                        stepResults.push(skippedResult);
+                                        if (step.id) {
+                                            jobCtx.steps[step.id] = {
+                                                outcome: 'skipped',
+                                                conclusion: 'skipped',
+                                                outputs: {}
+                                            };
+                                        }
+                                        continue;
+                                    }
+                                    // timeout-minutes: the step's own, or what's left of the
+                                    // job's.
+                                    const stepMinutes = (0, job_plan_1.numberSetting)(step['timeout-minutes'], stepCtx);
+                                    const jobLeft = jobDeadline !== undefined
+                                        ? Math.max(jobDeadline - Date.now(), 1)
                                         : undefined;
-                            const stepResult = await (0, steps_1.executeStep)(step, options, runtime, stepCtx);
-                            runtime.stepTimeout = undefined;
-                            stepResults.push(stepResult);
-                            if (jobDeadline !== undefined && Date.now() >= jobDeadline) {
-                                // The job is cancelled: no further steps run.
-                                if (stepResult.success) {
-                                    stepResult.success = false;
-                                    stepResult.error = jobTimeoutMessage;
+                                    const stepMs = stepMinutes
+                                        ? stepMinutes * 60000
+                                        : undefined;
+                                    runtime.stepTimeout =
+                                        jobLeft !== undefined &&
+                                            (stepMs === undefined || jobLeft < stepMs)
+                                            ? { ms: jobLeft, message: jobTimeoutMessage }
+                                            : stepMs !== undefined
+                                                ? {
+                                                    ms: stepMs,
+                                                    message: `The action '${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}' has timed out after ${stepMinutes} minutes.`
+                                                }
+                                                : undefined;
+                                    const stepResult = await (0, steps_1.executeStep)(step, options, runtime, stepCtx);
+                                    runtime.stepTimeout = undefined;
+                                    stepResults.push(stepResult);
+                                    if (signal.aborted) {
+                                        // Cancelled: the step was killed; nothing else runs.
+                                        if (!stepResult.success) {
+                                            stepResult.error = CANCELLED_MESSAGE;
+                                        }
+                                        break;
+                                    }
+                                    if (jobDeadline !== undefined &&
+                                        Date.now() >= jobDeadline) {
+                                        // The job is cancelled: no further steps run.
+                                        if (stepResult.success) {
+                                            stepResult.success = false;
+                                            stepResult.error = jobTimeoutMessage;
+                                        }
+                                        logger_1.logger.error(jobTimeoutMessage);
+                                        jobCtx.jobFailed = true;
+                                        break;
+                                    }
+                                    const outcome = stepResult.success ? 'success' : 'failure';
+                                    if (step.id) {
+                                        jobCtx.steps[step.id] = {
+                                            outcome,
+                                            // continue-on-error turns a failure into a successful
+                                            // conclusion, which is what success()/failure() see.
+                                            conclusion: step['continue-on-error']
+                                                ? 'success'
+                                                : outcome,
+                                            outputs: stepResult.outputs || {}
+                                        };
+                                    }
+                                    if (!stepResult.success && !step['continue-on-error']) {
+                                        jobCtx.jobFailed = true;
+                                        logger_1.logger.error(`Step failed: ${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}`);
+                                    }
                                 }
-                                logger_1.logger.error(jobTimeoutMessage);
-                                jobCtx.jobFailed = true;
-                                break;
-                            }
-                            const outcome = stepResult.success ? 'success' : 'failure';
-                            if (step.id) {
-                                jobCtx.steps[step.id] = {
-                                    outcome,
-                                    // continue-on-error turns a failure into a successful
-                                    // conclusion, which is what success()/failure() see.
-                                    conclusion: step['continue-on-error'] ? 'success' : outcome,
-                                    outputs: stepResult.outputs || {}
+                                if (signal.aborted)
+                                    return cancelledResult();
+                                await (0, job_runtime_1.runPostSteps)(runtime, jobCtx, stepResults);
+                                if (runtime.summary.trim()) {
+                                    logger_1.logger.info(`Job summary (${jobLabel}):\n${runtime.summary.trim()}`);
+                                }
+                                jobCtx.job = {
+                                    ...jobCtx.job,
+                                    status: jobCtx.jobFailed ? 'failure' : 'success'
                                 };
+                                unitOutputs[jobIndex] = (0, expression_1.substituteRecord)(job.outputs, {
+                                    ...jobCtx,
+                                    env: { ...jobCtx.env, ...runtime.env }
+                                });
+                                Object.assign(jobOutputs, unitOutputs[jobIndex]);
                             }
-                            if (!stepResult.success && !step['continue-on-error']) {
-                                jobCtx.jobFailed = true;
-                                logger_1.logger.error(`Step failed: ${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}`);
+                            finally {
+                                signal.removeEventListener('abort', onAbort);
+                                await stopping;
+                                await (0, job_container_1.stopJobContainer)(runtime);
                             }
                         }
-                        await (0, job_runtime_1.runPostSteps)(runtime, jobCtx, stepResults);
-                        if (runtime.summary.trim()) {
-                            logger_1.logger.info(`Job summary (${jobLabel}):\n${runtime.summary.trim()}`);
+                        finally {
+                            await stopping;
                         }
-                        jobCtx.job = {
-                            ...jobCtx.job,
-                            status: jobCtx.jobFailed ? 'failure' : 'success'
+                        const jobSuccess = stepResults.every((s) => s.success || s.step['continue-on-error']);
+                        // Job-level continue-on-error (often
+                        // `${{ matrix.experimental }}`) lets this combination fail
+                        // without failing the job or run.
+                        const allowedFailure = !jobSuccess &&
+                            (0, job_plan_1.isTruthySetting)(job['continue-on-error'], jobCtx);
+                        unitResults[jobIndex] = {
+                            job: jobLabel,
+                            success: jobSuccess,
+                            ...(allowedFailure ? { continueOnError: true } : {}),
+                            ...(runtime.summary ? { summary: runtime.summary } : {}),
+                            steps: stepResults,
+                            outputs: { ...jobOutputs },
+                            duration: Date.now() - jobStartTime
                         };
-                        Object.assign(jobOutputs, (0, expression_1.substituteRecord)(job.outputs, {
-                            ...jobCtx,
-                            env: { ...jobCtx.env, ...runtime.env }
-                        }));
-                    }
-                    finally {
-                        await (0, job_container_1.stopJobContainer)(runtime);
-                    }
-                    const jobSuccess = stepResults.every((s) => s.success || s.step['continue-on-error']);
-                    // Job-level continue-on-error (often `${{ matrix.experimental }}`)
-                    // lets this combination fail without failing the job or run.
-                    const allowedFailure = !jobSuccess && (0, job_plan_1.isTruthySetting)(job['continue-on-error'], jobCtx);
-                    jobs.push({
-                        job: jobLabel,
-                        success: jobSuccess,
-                        ...(allowedFailure ? { continueOnError: true } : {}),
-                        ...(runtime.summary ? { summary: runtime.summary } : {}),
-                        steps: stepResults,
-                        outputs: { ...jobOutputs },
-                        duration: Date.now() - jobStartTime
+                        return {
+                            result: jobSuccess ? 'success' : 'failure',
+                            allowedFailure
+                        };
+                    };
+                    outcomes = await (0, scheduler_1.runMatrix)(selected.length, (index, signal) => {
+                        const { index: jobIndex, values: matrixValues } = selected[index];
+                        return tagged(labelOf(matrixValues), () => runCombination(jobIndex, matrixValues, signal), true);
+                    }, {
+                        failFast,
+                        maxParallel,
+                        slots,
+                        signal: internal.signal,
+                        onFailFast: () => logger_1.logger.info(concurrent
+                            ? `Cancelling remaining matrix jobs for ${jobId} (fail-fast)`
+                            : `Skipping remaining matrix jobs for ${jobId} (fail-fast)`)
                     });
-                    if (!jobSuccess && !allowedFailure) {
-                        matrixFailed = true;
-                    }
                 }
-                const jobSuccess = !matrixFailed;
-                jobResults.set(jobId, {
-                    result: jobSuccess ? 'success' : 'failure',
-                    outputs: jobOutputs
-                });
-                if (jobSuccess) {
+                for (const result of unitResults) {
+                    if (result)
+                        jobs.push(result);
+                }
+                const failed = outcomes.some((o) => o?.result === 'failure' && !o.allowedFailure);
+                const cancelled = !failed && outcomes.some((o) => o?.result === 'cancelled');
+                if (!failed && !cancelled) {
                     logger_1.logger.success(`Job ${jobId} completed successfully`);
                 }
+                return {
+                    result: failed ? 'failure' : cancelled ? 'cancelled' : 'success',
+                    // As if the combinations ran in order: the last one's value wins.
+                    outputs: Object.assign({}, ...unitOutputs)
+                };
+            });
+            const jobResults = await (0, scheduler_1.runJobGraph)(order, needsOf, runJob, concurrent);
+            const jobs = order.flatMap((jobId) => resultsByJob.get(jobId) ?? []);
+            for (const key of (0, job_plan_1.unknownMatrixKeys)(matrixFilter, definedMatrixKeys)) {
+                logger_1.logger.warn(`--matrix ${key}: no matrix job defines this key; it was ignored`);
             }
             const callOutputs = (0, github_context_1.workflowCallOutputs)(parsed.file.on);
             return {
-                success: jobs.every((j) => j.success || j.continueOnError),
+                success: !matrixUnmatched && jobs.every((j) => j.success || j.continueOnError),
                 jobs,
                 duration: Date.now() - startTime,
                 ...(callOutputs