fix!: make exactMatch truly bidirectional for label matching

BREAKING CHANGE: The exactMatch option for runner label matching now
requires labels to be identical in both directions. Previously, a runner
with labels [A, B, C, D] would match a job requesting [A, B, C] when
exactMatch was true. Now, exactMatch=true requires the labels to be
exactly identical - the runner will only match if the job requests
exactly [A, B, C, D].

This change affects users who have runners with extra labels (e.g.,
on-demand) that were previously matching jobs not explicitly
requesting those labels. After this change, such runners will only
be used when jobs explicitly request all of the runner labels.

Before: Job [A,B,C] + Runner [A,B,C,D] + exactMatch=true -> Match
After:  Job [A,B,C] + Runner [A,B,C,D] + exactMatch=true -> No Match

To migrate, either:
1. Remove extra labels from runner configurations, or
2. Add the extra labels to your workflow job runs-on

Signed-off-by: Brend Smits <brend.smits@philips.com>

Co-authored-by: Stuart Pearson <stuart.pearson@philips.com>

Author: Brend-Smits

lambdas/functions/webhook/src/ConfigLoader.test.ts

@@ -165,7 +165,7 @@ describe('ConfigLoader Tests', () => {
       });
 
       await expect(ConfigWebhook.load()).rejects.toThrow(
-        'Failed to load config: Failed to load parameter for matcherConfig from path /path/to/matcher/config: Failed to load matcher config', // eslint-disable-line max-len
+        'Failed to load config: Failed to load parameter for matcherConfig from path /path/to/matcher/config: Failed to load matcher config',
       );
     });
 
@@ -213,7 +213,7 @@ describe('ConfigLoader Tests', () => {
       });
 
       await expect(ConfigWebhook.load()).rejects.toThrow(
-        "Failed to load config: Failed to parse combined matcher config: Expected ',' or ']' after array element in JSON at position 196", // eslint-disable-line max-len
+        "Failed to load config: Failed to parse combined matcher config: Expected ',' or ']' after array element in JSON at position 196",
       );
     });
   });
@@ -244,7 +244,7 @@ describe('ConfigLoader Tests', () => {
       });
 
       await expect(ConfigWebhookEventBridge.load()).rejects.toThrow(
-        'Failed to load config: Environment variable for eventBusName is not set and no default value provided., Failed to load parameter for webhookSecret from path undefined: Parameter undefined not found', // eslint-disable-line max-len
+        'Failed to load config: Environment variable for eventBusName is not set and no default value provided., Failed to load parameter for webhookSecret from path undefined: Parameter undefined not found',
       );
     });
   });
@@ -309,7 +309,7 @@ describe('ConfigLoader Tests', () => {
       });
 
       await expect(ConfigDispatcher.load()).rejects.toThrow(
-        'Failed to load config: Failed to load parameter for matcherConfig from path undefined: Parameter undefined not found', // eslint-disable-line max-len
+        'Failed to load config: Failed to load parameter for matcherConfig from path undefined: Parameter undefined not found',
       );
     });
 

lambdas/functions/webhook/src/ConfigLoader.ts

@@ -61,7 +61,7 @@ abstract class BaseConfig {
         this.loadProperty(propertyName, value);
       })
       .catch((error) => {
-        const errorMessage = `Failed to load parameter for ${String(propertyName)} from path ${paramPath}: ${(error as Error).message}`; // eslint-disable-line max-len
+        const errorMessage = `Failed to load parameter for ${String(propertyName)} from path ${paramPath}: ${(error as Error).message}`;
         this.configLoadingErrors.push(errorMessage);
       });
   }

lambdas/functions/webhook/src/runners/dispatch.test.ts

@@ -190,10 +190,10 @@ describe('Dispatcher', () => {
       expect(canRunJob(workflowLabels, runnerLabels, true)).toBe(true);
     });
 
-    it('should accept job with an exact match and runner supports requested capabilities.', () => {
+    it('should NOT accept job with exact match when runner has extra labels.', () => {
       const workflowLabels = ['self-hosted', 'linux', 'x64'];
       const runnerLabels = [['self-hosted', 'linux', 'x64', 'ubuntu-latest']];
-      expect(canRunJob(workflowLabels, runnerLabels, true)).toBe(true);
+      expect(canRunJob(workflowLabels, runnerLabels, true)).toBe(false);
     });
 
     it('should NOT accept job with an exact match and runner not matching requested capabilities.', () => {
@@ -225,6 +225,18 @@ describe('Dispatcher', () => {
       const runnerLabels = [['self-hosted', 'linux', 'x64']];
       expect(canRunJob(workflowLabels, runnerLabels, false)).toBe(true);
     });
+
+    it('should NOT match when runner has more labels than workflow requests (exactMatch=true).', () => {
+      const workflowLabels = ['self-hosted', 'linux', 'x64', 'staging', 'ubuntu-2404'];
+      const runnerLabels = [['self-hosted', 'linux', 'x64', 'staging', 'ubuntu-2404', 'on-demand']];
+      expect(canRunJob(workflowLabels, runnerLabels, true)).toBe(false);
+    });
+
+    it('should match when labels are exactly identical with exactMatch=true.', () => {
+      const workflowLabels = ['self-hosted', 'linux', 'on-demand'];
+      const runnerLabels = [['self-hosted', 'linux', 'on-demand']];
+      expect(canRunJob(workflowLabels, runnerLabels, true)).toBe(true);
+    });
   });
 });
 

lambdas/functions/webhook/src/runners/dispatch.ts

@@ -84,10 +84,19 @@ export function canRunJob(
   runnerLabelsMatchers = runnerLabelsMatchers.map((runnerLabel) => {
     return runnerLabel.map((label) => label.toLowerCase());
   });
-  const matchLabels = workflowLabelCheckAll
-    ? runnerLabelsMatchers.some((rl) => workflowJobLabels.every((wl) => rl.includes(wl.toLowerCase())))
-    : runnerLabelsMatchers.some((rl) => workflowJobLabels.some((wl) => rl.includes(wl.toLowerCase())));
-  const match = workflowJobLabels.length === 0 ? !matchLabels : matchLabels;
+  const workflowLabelsLower = workflowJobLabels.map((wl) => wl.toLowerCase());
+
+  let match: boolean;
+  if (workflowLabelCheckAll) {
+    match = runnerLabelsMatchers.some(
+      (rl) => workflowLabelsLower.every((wl) => rl.includes(wl)) && rl.every((r) => workflowLabelsLower.includes(r)),
+    );
+  } else {
+    const matchLabels = runnerLabelsMatchers.some((rl) =>
+      workflowJobLabels.some((wl) => rl.includes(wl.toLowerCase())),
+    );
+    match = workflowJobLabels.length === 0 ? !matchLabels : matchLabels;
+  }
 
   logger.debug(
     `Received workflow job event with labels: '${JSON.stringify(workflowJobLabels)}'. The event does ${