Runner updates for an organisation's own runners dc5c64296b0a

{# One level's update settings (oxygenhub#322); `top` is the site, which inherits from nothing. #}

{% macro policy_fields(p, top) %}

  <label class="pol">Updates <select name="updates">{% if !top %}<option value="inherit"{% if p.updates == "inherit" %} selected{% endif %}>inherit</option>{% endif %}<option value="off"{% if p.updates == "off" || (top && p.updates == "inherit") %} selected{% endif %}>off</option><option value="on"{% if p.updates == "on" %} selected{% endif %}>on</option></select></label>

  <label class="pol">Channel <input type="text" name="channel" value="{{ p.channel }}" placeholder="{% if top %}stable{% else %}inherit{% endif %}" size="9" list="update-channels"></label>

  <label class="pol">Window, UTC <input type="text" name="window" value="{{ p.window }}" placeholder="{% if top %}any time{% else %}inherit{% endif %}" size="7" title="Hours in which updates may start, from-to, e.g. 02-05"></label>

  <label class="pol">Dry run <select name="dry_run">{% if !top %}<option value="inherit"{% if p.dry_run == "inherit" %} selected{% endif %}>inherit</option>{% endif %}<option value="off"{% if p.dry_run == "off" || (top && p.dry_run == "inherit") %} selected{% endif %}>off</option><option value="on"{% if p.dry_run == "on" %} selected{% endif %}>on</option></select></label>

{% endmacro %}

- **Runner updates: policy, test groups and the offer (#322):** Admin › Runners › Updates sets where runner builds come from (a repository whose releases carry `flow-linux-ARCH` files, and `flow-windows-x86_64.exe` for Windows runners) and who takes them. Updates are off unless chosen; the site, an owner, a test group and a runner may each set updates on or off, a channel (`stable`, `canary` or a version), a window of hours (UTC) and dry run, and the nearest setting wins, each setting on its own. A test group is chosen runners or a percentage of the site's (or an owner's) runners, by a stable hash of each runner's id, so a share is the same machines every rollout and 10% sits inside 50%. `GET /api/v1/flow/runner/update` tells a runner its policy, where each setting came from, and the build to install (its BLAKE3, to check the download against); `POST` takes what the runner did, shown on the page and in the audit log. An organisation's owners set the same for their own runners in the organisation's Settings › Runner updates: the organisation's setting, test groups of its runners (chosen, or a percentage), and each runner's own; nothing of the site's or another owner's. Pins OxygenFlow's main.

        .route("/orgs/{name}/settings/runners/updates/policy", post(orgs::runner_updates_policy))

        .route("/orgs/{name}/settings/runners/updates/groups", post(orgs::runner_updates_group_new))

        .route("/orgs/{name}/settings/runners/updates/groups/{id}", post(orgs::runner_updates_group))

        .route("/orgs/{name}/settings/runners/updates/groups/{id}/delete", post(orgs::runner_updates_group_delete))

    /// Its runners' updates (oxygenhub#322): its setting, test groups and runners.

    updates: super::runner_updates::UpdateViews,

    let updates = super::runner_updates::views(app, &super::runner_updates::Reach::Org(org.name.clone()))

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

        updates,

}

/// `POST /orgs/{name}/settings/runners/updates/policy`: the organisation's,

/// one of its test groups' or one of its runners' update settings.

pub async fn runner_updates_policy(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(name): Path<String>,

    Form(f): Form<super::runner_updates::PolicyForm>,

) -> Result<Page<OrgSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings"), &viewer);

    let (me, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let reach = super::runner_updates::Reach::Org(org.name.clone());

    let outcome = super::runner_updates::apply_policy(&app, &me, &reach, &f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    org_page_after(&app, shell, org, outcome).await

}

/// `POST /orgs/{name}/settings/runners/updates/groups`: a test group of the organisation's runners.

pub async fn runner_updates_group_new(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(name): Path<String>,

    axum_extra::extract::Form(f): axum_extra::extract::Form<super::runner_updates::GroupForm>,

) -> Result<Page<OrgSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings"), &viewer);

    let (me, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let reach = super::runner_updates::Reach::Org(org.name.clone());

    let outcome = super::runner_updates::apply_create_group(&app, &me, &reach, &f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    org_page_after(&app, shell, org, outcome).await

}

/// `POST /orgs/{name}/settings/runners/updates/groups/{id}`: who is in one of its test groups.

pub async fn runner_updates_group(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((name, id)): Path<(String, i64)>,

    axum_extra::extract::Form(f): axum_extra::extract::Form<super::runner_updates::GroupForm>,

) -> Result<Page<OrgSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings"), &viewer);

    let (me, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let reach = super::runner_updates::Reach::Org(org.name.clone());

    let outcome = super::runner_updates::apply_save_group(&app, &me, &reach, id, &f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    org_page_after(&app, shell, org, outcome).await

}

/// `POST /orgs/{name}/settings/runners/updates/groups/{id}/delete`.

pub async fn runner_updates_group_delete(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((name, id)): Path<(String, i64)>,

    Form(f): Form<super::runner_updates::CsrfOnly>,

) -> Result<Page<OrgSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings"), &viewer);

    let (me, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let reach = super::runner_updates::Reach::Org(org.name.clone());

    let outcome = super::runner_updates::apply_delete_group(&app, &me, &reach, id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    org_page_after(&app, shell, org, outcome).await

}

/// The settings page saying what a change did.

async fn org_page_after(

    app: &Shared,

    shell: Shell,

    org: accounts::Organisation,

    outcome: super::runner_updates::Outcome,

) -> Result<Page<OrgSettingsPage>, Error> {

    match outcome {

        Ok(n) => org_page(app, shell, org, Some(n), None).await,

        Err(why) => org_page(app, shell, org, None, Some(why)).await,

    }

/// Who changes runner updates: the site's administrators anything; an

/// organisation's owners their organisation's setting, its test groups and

/// its runners (Andy: an organisation tries a build on some of its runners

/// before the rest).

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum Reach {

    Site,

    Org(String),

}

impl Reach {

    fn holds_runner(&self, r: &runners::Runner) -> bool {

        match self {

            Reach::Site => true,

            Reach::Org(o) => r.scope_owner == *o,

        }

    }

    fn holds_group(&self, g: &Group) -> bool {

        match self {

            Reach::Site => true,

            Reach::Org(o) => g.owner == *o,

        }

    }

}

/// What a page shows of runner updates, within `reach`.

pub struct UpdateViews {

    pub site: PolicyView,

    pub owners: Vec<PolicyView>,

    pub groups: Vec<GroupView>,

    pub runners: Vec<RunnerView>,

}

pub async fn views(app: &Shared, reach: &Reach) -> sqlx::Result<UpdateViews> {

    let levels = Levels::load(&app.db).await?;

    let all = runners::list(&app.db).await?;

    };

    let mut owners: Vec<PolicyView> = match reach {

        Reach::Site => {

            levels.policies.values().filter(|p| p.scope == "owner").map(|p| PolicyView::of(p, format!("owner {}", p.key))).collect()

        }

        Reach::Org(o) => vec![PolicyView::of(&policy("owner", o), format!("owner {o}"))],

        .filter(|g| reach.holds_group(g))

    let mut out = vec![];

    for r in all.into_iter().filter(|r| reach.holds_runner(r)) {

        let (_, offer) = ru::offer(&app.db, &r, &effective, hour).await?;

        out.push(RunnerView {

    }

    Ok(UpdateViews { site: PolicyView::of(&policy("site", ""), "the site".into()), owners, groups, runners: out })

}

async fn page(app: &Shared, shell: Shell, notice: Option<String>, error: Option<String>) -> Result<Page<UpdatesPage>, Error> {

    let e = |e| Error::from_db(shell.clone(), e);

    let repo = accounts::setting(&app.db, ru::SETTING_REPO).await.map_err(e)?.unwrap_or_default();

    let v = views(app, &Reach::Site).await.map_err(e)?;

    Ok(Page(UpdatesPage { shell, repo, site: v.site, owners: v.owners, groups: v.groups, runners: v.runners, notice, error }))

}

/// What a change did, to say on the page: `Ok` a notice, `Err` what was wrong.

pub type Outcome = Result<String, String>;

/// [`page`] saying what `outcome` did.

async fn page_after(app: &Shared, shell: Shell, outcome: Outcome) -> Result<Page<UpdatesPage>, Error> {

    match outcome {

        Ok(n) => page(app, shell, Some(n), None).await,

        Err(why) => page(app, shell, None, Some(why)).await,

    pub(crate) csrf_token: String,

/// Set one level's settings, within `reach`.

pub async fn apply_policy(app: &Shared, me: &accounts::Account, reach: &Reach, f: &PolicyForm) -> sqlx::Result<Outcome> {

    let label = match (f.scope.as_str(), reach) {

        ("site", Reach::Site) if key.is_empty() => "the site".to_string(),

        ("owner", Reach::Org(o)) if key != *o => return Ok(Err("An organisation sets its own runners' updates only.".into())),

        ("owner", _) => {

            let known = accounts::account_by_name(&app.db, &key).await?.is_some() || accounts::org_by_name(&app.db, &key).await?.is_some();

                return Ok(Err(format!("There is no account or organisation {key:?}.")));

        ("group", _) => match key.parse().ok() {

            Some(id) => match rdb::group(&app.db, id).await?.filter(|g| reach.holds_group(g)) {

                None => return Ok(Err("That test group is gone.".into())),

            None => return Ok(Err("That test group is gone.".into())),

        ("runner", _) => match key.parse().ok() {

            Some(id) => match runners::get(&app.db, id).await?.filter(|r| reach.holds_runner(r)) {

                None => return Ok(Err("That runner is gone.".into())),

            None => return Ok(Err("That runner is gone.".into())),

        _ => return Ok(Err("Choose the site, an owner, a test group or a runner.".into())),

        return Ok(Err(format!("A channel is stable, canary or a version such as 0.3.4, not {channel:?}.")));

        Err(why) => return Ok(Err(format!("{why}."))),

    rdb::set_policy(&app.db, &p).await?;

    accounts::audit(&app.db, Some(me), "runner.updates.policy", &label, &words).await.ok();

    Ok(Ok(format!("Saved for {label}: {words}.")))

}

/// `POST /admin/runners/updates/policy`: one level's settings.

pub async fn save_policy(State(app): State<Shared>, viewer: Viewer, Form(f): Form<PolicyForm>) -> Result<Page<UpdatesPage>, Error> {

    let shell = Shell::new(&app, "/admin/runners/updates", &viewer);

    let me = require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let outcome = apply_policy(&app, &me, &Reach::Site, &f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    page_after(&app, shell, outcome).await

    pub(crate) csrf_token: String,

/// The chosen runners a form names that `owner`'s group may hold.

async fn chosen_in_reach(app: &Shared, owner: &str, f: &GroupForm) -> sqlx::Result<Vec<i64>> {

    let all = runners::list(&app.db).await?;

    Ok(f.runner.iter().copied().filter(|id| all.iter().any(|r| r.id == *id && (owner.is_empty() || r.scope_owner == owner))).collect())

}

/// Make a test group, within `reach` (an organisation's are its own).

pub async fn apply_create_group(app: &Shared, me: &accounts::Account, reach: &Reach, f: &GroupForm) -> sqlx::Result<Outcome> {

        return Ok(Err("A test group needs a name of up to 60 characters.".into()));

    let owner = match reach {

        Reach::Site => f.owner.trim().to_string(),

        Reach::Org(o) => o.clone(),

    };

        && accounts::account_by_name(&app.db, &owner).await?.is_none()

        && accounts::org_by_name(&app.db, &owner).await?.is_none()

        return Ok(Err(format!("There is no account or organisation {owner:?}.")));

    let percent = match percent_of(f) {

        Err(why) => return Ok(Err(why)),

    if rdb::groups(&app.db).await?.iter().any(|g| g.owner == owner && g.name == name) {

        return Ok(Err(format!("There is already a test group {name:?} for those runners.")));

    let chosen = chosen_in_reach(app, &owner, f).await?;

    let g = rdb::create_group(&app.db, &owner, &name, percent).await?;

        rdb::set_members(&app.db, g.id, &chosen).await?;

        None => format!("{} chosen runners", chosen.len()),

    accounts::audit(&app.db, Some(me), "runner.updates.group", &name, &format!("created: {what}")).await.ok();

    Ok(Ok(format!("Test group {name} made: {what}. Give it its settings below.")))

/// `POST /admin/runners/updates/groups`: a new test group.

pub async fn create_group(

    let outcome = apply_create_group(&app, &me, &Reach::Site, &f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    page_after(&app, shell, outcome).await

}

/// Set who is in test group `id`, within `reach`.

pub async fn apply_save_group(app: &Shared, me: &accounts::Account, reach: &Reach, id: i64, f: &GroupForm) -> sqlx::Result<Outcome> {

    let Some(g) = rdb::group(&app.db, id).await?.filter(|g| reach.holds_group(g)) else {

        return Ok(Err("That test group is gone.".into()));

    let percent = match percent_of(f) {

        Err(why) => return Ok(Err(why)),

    let chosen = if percent.is_some() { vec![] } else { chosen_in_reach(app, &g.owner, f).await? };

    rdb::set_percent(&app.db, id, percent).await?;

    rdb::set_members(&app.db, id, &chosen).await?;

        None => format!("{} chosen runners", chosen.len()),

    accounts::audit(&app.db, Some(me), "runner.updates.group", &g.name, &what).await.ok();

    Ok(Ok(format!("Test group {} is now {what}.", g.name)))

/// `POST /admin/runners/updates/groups/{id}`: who is in a test group.

pub async fn save_group(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<i64>,

    axum_extra::extract::Form(f): axum_extra::extract::Form<GroupForm>,

) -> Result<Page<UpdatesPage>, Error> {

    let shell = Shell::new(&app, "/admin/runners/updates", &viewer);

    let me = require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let outcome = apply_save_group(&app, &me, &Reach::Site, id, &f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    page_after(&app, shell, outcome).await

}

    pub(crate) csrf_token: String,

/// Remove test group `id`, within `reach`.

pub async fn apply_delete_group(app: &Shared, me: &accounts::Account, reach: &Reach, id: i64) -> sqlx::Result<Outcome> {

    let Some(g) = rdb::group(&app.db, id).await?.filter(|g| reach.holds_group(g)) else {

        return Ok(Err("That test group is gone.".into()));

    };

    rdb::delete_group(&app.db, id).await?;

    accounts::audit(&app.db, Some(me), "runner.updates.group", &g.name, "removed").await.ok();

    Ok(Ok(format!("Test group {} removed; its runners follow the levels above it.", g.name)))

}

    let outcome = apply_delete_group(&app, &me, &Reach::Site, id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    page_after(&app, shell, outcome).await

/// oxygenhub#322: an organisation's owners set their own runners' updates,

/// test groups of their own runners, and nothing beyond them.

#[tokio::test(flavor = "multi_thread")]

async fn an_organisation_sets_its_own_runners_updates() {

    use oxy_core::identity::SecretKey;

    let h = hub().await;

    let res = oxygenhub::router(h.app.clone())

        .oneshot(

            Request::post("/register")

                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")

                .body(Body::from("username=andy&email=andy%40example.com&password=correct-horse-battery&setup=test-setup"))

                .unwrap(),

        )

        .await

        .unwrap();

    let cookie = res.headers().get(header::SET_COOKIE).unwrap().to_str().unwrap().split(';').next().unwrap().to_string();

    let web = |method: &'static str, path: String, body: Option<String>| {

        let (app, cookie) = (h.app.clone(), cookie.clone());

        async move {

            let mut req = Request::builder().method(method).uri(path).header(header::COOKIE, cookie);

            if body.is_some() {

                req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");

            }

            let res = oxygenhub::router(app).oneshot(req.body(body.map(Body::from).unwrap_or_else(Body::empty)).unwrap()).await.unwrap();

            let st = res.status();

            (st, String::from_utf8_lossy(&res.into_body().collect().await.unwrap().to_bytes()).into_owned())

        }

    };

    let csrf_of = |page: &str| {

        let i = page.find("name=\"_csrf\" value=\"").unwrap() + "name=\"_csrf\" value=\"".len();

        page[i..].split('"').next().unwrap().to_string()

    };

    let (_, page) = web("GET", "/orgs/new".into(), None).await;

    let csrf = csrf_of(&page);

    web("POST", "/orgs/new".into(), Some(format!("_csrf={csrf}&name=acme&display_name=Acme"))).await;

    // Two of acme's runners, and the site's (hub.toml's, from its first claim).

    let mut creds = vec![];

    for name in ["a1", "a2"] {

        let (_, page) = web("POST", "/orgs/acme/settings/runners/token".into(), Some(format!("_csrf={csrf}"))).await;

        let i = page.find("--token ").unwrap() + "--token ".len();

        let token: String = page[i..].chars().take_while(|c| !c.is_whitespace()).collect();

        let identity = SecretKey::generate().identity(name, "", 1);

        let info = serde_json::json!({ "arch": "x86_64", "os": "linux", "version": "0.1.0", "max_jobs": 1 });

        let reg = serde_json::json!({ "token": token, "name": name, "identity": hex::encode(identity.encode()), "info": info });

        let (st, body) = call(&h.app, "POST", "/api/v1/flow/runners/register", None, Some(reg.to_string())).await;

        assert_eq!(st, StatusCode::OK, "{body}");

        creds.push(serde_json::from_str::<serde_json::Value>(&body).unwrap()["credential"].as_str().unwrap().to_string());

    }

    claim(&h.app).await;

    let all = db::runners::list(&h.app.db).await.unwrap();

    let id = |n: &str| all.iter().find(|r| r.name == n).unwrap().id;

    let set = |form: String| web("POST", "/orgs/acme/settings/runners/updates/policy".into(), Some(format!("_csrf={csrf}&{form}")));

    let (_, page) = set("scope=owner&key=acme&updates=on".into()).await;

    assert!(page.contains("Saved for owner acme: updates on."), "{page}");

    let (_, page) = set("scope=site&updates=on".into()).await;

    assert!(page.contains("Choose the site, an owner, a test group or a runner."), "not the site's: {page}");

    let (_, page) = set("scope=owner&key=andy&updates=on".into()).await;

    assert!(page.contains("An organisation sets its own runners"), "{page}");

    let (_, page) = set(format!("scope=runner&key={}&updates=on", id("test-1"))).await;

    assert!(page.contains("That runner is gone."), "the site's runner is not acme's: {page}");

    // A test group of acme's runners; a runner not acme's is left out.

    let (_, page) = web(

        "POST",

        "/orgs/acme/settings/runners/updates/groups".into(),

        Some(format!("_csrf={csrf}&name=canary&owner=&mode=chosen&runner={}&runner={}", id("a1"), id("test-1"))),

    )

    .await;

    assert!(page.contains("Test group canary made: 1 chosen runners"), "{page}");

    let canary = db::runner_updates::groups(&h.app.db).await.unwrap().remove(0);

    assert_eq!(canary.owner, "acme", "an organisation's groups are its own");

    let (_, page) = set(format!("scope=group&key={}&channel=canary", canary.id)).await;

    assert!(page.contains("Saved for group canary: channel canary."), "{page}");

    let (_, page) = set(format!("scope=runner&key={}&updates=off", id("a2"))).await;

    assert!(page.contains("Saved for runner a2: updates off."), "{page}");

    // A site group is not the organisation's to change.

    let site = db::runner_updates::create_group(&h.app.db, "", "everyone", Some(100)).await.unwrap();

    let (_, page) =

        web("POST", format!("/orgs/acme/settings/runners/updates/groups/{}/delete", site.id), Some(format!("_csrf={csrf}"))).await;

    assert!(page.contains("That test group is gone."), "{page}");

    assert!(db::runner_updates::group(&h.app.db, site.id).await.unwrap().is_some());

    // The page shows it; each runner gets its policy.

    let (_, page) = web("GET", "/orgs/acme/settings".into(), None).await;

    assert!(page.contains("id=\"runner-updates\"") && page.contains(">canary <small"), "{page}");

    assert!(page.contains("updates on (owner acme)") && page.contains("updates off (runner)"), "{page}");

    let ask = |cred: String| {

        let app = h.app.clone();

        async move {

            let (_, body) = call(&app, "GET", "/api/v1/flow/runner/update", Some(&cred), None).await;

            serde_json::from_str::<flow_core::api::UpdateAnswer>(&body).unwrap().policy

        }

    };

    let a1 = ask(creds[0].clone()).await;

    assert!(a1.updates && a1.channel == "canary" && a1.from[..2] == ["owner acme".to_string(), "group canary".to_string()], "{a1:?}");

    assert!(!ask(creds[1].clone()).await.updates, "a2's own setting wins");

}

{% import "runner_update_fields.html" as ruf %}

  <div class="pol-row">{% call ruf::policy_fields(site, true) %}</div>

    <strong>{{ o.key }}</strong>{% call ruf::policy_fields(o, false) %}<button type="submit">Save</button>

    <label class="pol">Owner <input type="text" name="key" size="12" placeholder="account or org" required></label>{% call ruf::policy_fields(site, false) %}<button type="submit">Add</button>

      {% call ruf::policy_fields(gv.policy, false) %}<button type="submit">Save settings</button>

      {% call ruf::policy_fields(rv.policy, false) %}<button type="submit">set</button></form></td>

{% import "runner_update_fields.html" as ruf %}

<section class="panel" id="runner-updates">

  <h2>Runner updates</h2>

  <p class="small">The organisation's own runners can update themselves: off unless chosen. Try a build on a test group first (runners you pick, or a percentage of them, the same machines every time), then turn updates on for the rest. A runner's own setting wins over a group's, a group's over the organisation's, the organisation's over the site's.</p>

  {% let ou = updates.owners[0] %}

  <form class="pol-form" method="post" action="/orgs/{{ org.name }}/settings/runners/updates/policy">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="scope" value="owner"><input type="hidden" name="key" value="{{ org.name }}">

    <strong>The organisation</strong>{% call ruf::policy_fields(ou, false) %}<button type="submit">Save</button>

  </form>

  <h3>Test groups</h3>

  {% if updates.groups.is_empty() %}<p class="mute small">None yet.</p>{% endif %}

  {% for gv in updates.groups %}{% let g = gv.g %}

  <div class="card wide update-group">

    <h3>{{ g.name }} <small class="mute">{% if let Some(p) = g.percent %}{{ p }}%{% else %}chosen{% endif %} · {{ gv.members.len()|plural("runner", "runners") }} now</small></h3>

    <p class="small">{% for m in gv.members %}<span class="lbl">{{ m }}</span> {% endfor %}</p>

    <form class="pol-form" method="post" action="/orgs/{{ org.name }}/settings/runners/updates/policy">

      <input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="scope" value="group"><input type="hidden" name="key" value="{{ g.id }}">

      {% call ruf::policy_fields(gv.policy, false) %}<button type="submit">Save settings</button>

    </form>

    <details><summary class="small">Who is in it</summary>

    <form method="post" action="/orgs/{{ org.name }}/settings/runners/updates/groups/{{ g.id }}">

      <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

      <label class="pol"><input type="radio" name="mode" value="percent"{% if g.percent.is_some() %} checked{% endif %}> a percentage: <input type="number" name="percent" min="1" max="100" value="{% if let Some(p) = g.percent %}{{ p }}{% endif %}">%</label>

      <label class="pol"><input type="radio" name="mode" value="chosen"{% if g.percent.is_none() %} checked{% endif %}> these runners:</label>

      <div class="pol-row">{% for rv in updates.runners %}<label class="pol"><input type="checkbox" name="runner" value="{{ rv.r.id }}"{% if gv.chosen.contains(rv.r.id) %} checked{% endif %}> {{ rv.r.name }}</label>{% endfor %}</div>

      <button type="submit">Save members</button>

    </form>

    <form class="tiny" method="post" action="/orgs/{{ org.name }}/settings/runners/updates/groups/{{ g.id }}/delete" data-confirm="Remove the test group {{ g.name }}?"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button class="danger-btn">remove group</button></form>

    </details>

  </div>

  {% endfor %}

  <form class="card wide" method="post" action="/orgs/{{ org.name }}/settings/runners/updates/groups">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <h3>New test group</h3>

    <label class="pol">Name <input type="text" name="name" size="14" required placeholder="canary"></label>

    <label class="pol"><input type="radio" name="mode" value="percent"> a percentage of the organisation's runners: <input type="number" name="percent" min="1" max="100">%</label>

    <label class="pol"><input type="radio" name="mode" value="chosen" checked> these runners:</label>

    <div class="pol-row">{% for rv in updates.runners %}<label class="pol"><input type="checkbox" name="runner" value="{{ rv.r.id }}"> {{ rv.r.name }}</label>{% endfor %}</div>

    <button type="submit">Make group</button>

  </form>

  {% if !updates.runners.is_empty() %}

  <h3>The organisation's runners</h3>

  <div class="table"><table>

  <tr><th>Runner</th><th>Runs</th><th>Its policy</th><th>Now</th><th>Last said</th><th>Its own settings</th></tr>

  {% for rv in updates.runners %}{% let r = rv.r %}

  <tr><td><strong>{{ r.name }}</strong>{% for g in rv.groups %} <span class="lbl">{{ g }}</span>{% endfor %}</td>

    <td class="small">{% if r.version.is_empty() %}<span class="mute">unknown</span>{% else %}flow {{ r.version }}{% endif %}</td>

    <td class="small">{{ rv.effective_words() }}</td><td class="small">{{ rv.offer }}</td>

    <td class="small">{% if r.update_note.is_empty() %}<span class="mute">nothing yet</span>{% else %}{{ r.update_note }}{% endif %}</td>

    <td><form class="pol-form tiny" method="post" action="/orgs/{{ org.name }}/settings/runners/updates/policy"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="scope" value="runner"><input type="hidden" name="key" value="{{ r.id }}">{% call ruf::policy_fields(rv.policy, false) %}<button type="submit">set</button></form></td></tr>

  {% endfor %}

  </table></div>

  {% endif %}

</section>