feat:python插件支持编译运行的时使用独立虚拟环境执行#12656

src/backend/ci/core/store/api-store/src/main/kotlin/com/tencent/devops/store/api/atom/BuildMarketAtomEnvResource.kt

@@ -91,4 +91,16 @@ interface BuildMarketAtomEnvResource {
         @Parameter(description = "插件市场工作台-更新插件执行环境信息请求报文体", required = true)
         atomEnvRequest: AtomEnvRequest
     ): Result<Boolean>
+
+    @Operation(summary = "判断插件是否在指定类型的白名单中")
+    @GET
+    @Path("/whitelist/types/{whitelistType}/codes/{atomCode}/check")
+    fun isAtomInWhitelist(
+        @Parameter(description = "白名单类型", required = true)
+        @PathParam("whitelistType")
+        whitelistType: String,
+        @Parameter(description = "插件代码", required = true)
+        @PathParam("atomCode")
+        atomCode: String
+    ): Result<Boolean>
 }

src/backend/ci/core/store/biz-store/src/main/kotlin/com/tencent/devops/store/atom/resources/BuildMarketAtomEnvResourceImpl.kt

@@ -30,14 +30,17 @@ package com.tencent.devops.store.atom.resources
 import com.tencent.devops.common.api.pojo.Result
 import com.tencent.devops.common.web.RestResource
 import com.tencent.devops.store.api.atom.BuildMarketAtomEnvResource
+import com.tencent.devops.store.atom.service.MarketAtomEnvService
+import com.tencent.devops.store.common.service.AtomWhitelistConfigService
 import com.tencent.devops.store.pojo.atom.AtomEnv
 import com.tencent.devops.store.pojo.atom.AtomEnvRequest
-import com.tencent.devops.store.atom.service.MarketAtomEnvService
 import org.springframework.beans.factory.annotation.Autowired
 
 @RestResource
-class BuildMarketAtomEnvResourceImpl @Autowired constructor(private val marketAtomEnvService: MarketAtomEnvService) :
-    BuildMarketAtomEnvResource {
+class BuildMarketAtomEnvResourceImpl @Autowired constructor(
+    private val marketAtomEnvService: MarketAtomEnvService,
+    private val atomWhitelistConfigService: AtomWhitelistConfigService
+) : BuildMarketAtomEnvResource {
 
     override fun getAtomEnv(
         projectCode: String,
@@ -67,4 +70,8 @@ class BuildMarketAtomEnvResourceImpl @Autowired constructor(private val marketAt
     ): Result<Boolean> {
         return marketAtomEnvService.updateMarketAtomEnvInfo(projectCode, atomCode, version, atomEnvRequest)
     }
+
+    override fun isAtomInWhitelist(whitelistType: String, atomCode: String): Result<Boolean> {
+        return Result(atomWhitelistConfigService.isAtomInWhitelist(atomCode, whitelistType))
+    }
 }

src/backend/ci/core/store/biz-store/src/main/kotlin/com/tencent/devops/store/common/service/AtomWhitelistConfigService.kt

@@ -0,0 +1,60 @@
+/*
+ * Tencent is pleased to support the open source community by making BK-CI 蓝鲸持续集成平台 available.
+ *
+ * Copyright (C) 2019 Tencent.  All rights reserved.
+ *
+ * BK-CI 蓝鲸持续集成平台 is licensed under the MIT license.
+ *
+ * A copy of the MIT License is included in this file.
+ *
+ *
+ * Terms of the MIT License:
+ * ---------------------------------------------------
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+ * documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial portions of
+ * the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+ * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+ * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+package com.tencent.devops.store.common.service
+
+import com.fasterxml.jackson.core.type.TypeReference
+import com.tencent.devops.common.api.util.JsonUtil
+import org.slf4j.LoggerFactory
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.stereotype.Service
+
+@Service
+class AtomWhitelistConfigService @Autowired constructor(
+    private val businessConfigService: BusinessConfigService
+) {
+    private val logger = LoggerFactory.getLogger(AtomWhitelistConfigService::class.java)
+
+    fun isAtomInWhitelist(atomCode: String, whitelistType: String): Boolean {
+        return try {
+            val configValue = businessConfigService.getConfigValue(
+                business = "ATOM",
+                feature = "ATOM_WHITELIST",
+                businessValue = whitelistType
+            )
+            val atomCodes = if (configValue != null) {
+                JsonUtil.to(configValue, object : TypeReference<List<String>>() {})
+            } else {
+                emptyList()
+            }
+            atomCodes.contains(atomCode)
+        } catch (ignored: Throwable) {
+            logger.warn("isAtomInWhitelist failed|atomCode=$atomCode|whitelistType=$whitelistType", ignored)
+            false
+        }
+    }
+}

src/backend/ci/core/store/biz-store/src/main/kotlin/com/tencent/devops/store/common/service/BusinessConfigService.kt

@@ -109,4 +109,14 @@ class BusinessConfigService @Autowired constructor(
     fun deleteBusinessConfigById(id: Int): Int {
         return businessConfigDao.delete(dslContext, id)
     }
+
+    fun getConfigValue(business: String, feature: String, businessValue: String): String? {
+        val record = businessConfigDao.get(
+            dslContext = dslContext,
+            business = business,
+            feature = feature,
+            businessValue = businessValue
+        )
+        return record?.configValue
+    }
 }

src/backend/ci/core/worker/worker-api-sdk/src/main/kotlin/com/tencent/devops/worker/common/api/atom/AtomArchiveResourceApi.kt

@@ -68,6 +68,7 @@ import java.net.URLEncoder
 import okhttp3.MediaType.Companion.toMediaTypeOrNull
 import okhttp3.MultipartBody
 import okhttp3.RequestBody
+import okhttp3.RequestBody.Companion.toRequestBody
 
 class AtomArchiveResourceApi : AbstractBuildResourceApi(), AtomArchiveSDKApi {
 
@@ -327,16 +328,36 @@ class AtomArchiveResourceApi : AbstractBuildResourceApi(), AtomArchiveSDKApi {
         return objectMapper.readValue(responseContent)
     }
 
+    /**
+     * 检查插件是否在指定类型的白名单中
+     * HTTP 异常时返回 Result(false) fail-close 不放行
+     */
+    override fun isAtomInWhitelist(
+        atomCode: String,
+        whitelistType: String
+    ): Result<Boolean> {
+        return try {
+            val path = "/ms/store/api/build/market/atom/env/whitelist/types/$whitelistType/codes/$atomCode/check"
+            val request = buildGet(path)
+            val responseContent = request(request, "atom whitelist check fail")
+            objectMapper.readValue(responseContent)
+        } catch (e: Throwable) {
+            logger.warn("isAtomInWhitelist fail|atomCode=$atomCode|type=$whitelistType", e)
+            Result(false)
+        }
+    }
+
     override fun updateAtomVersionPkgSize(
         atomId: String,
         storePackageInfoReqs: List<StorePackageInfoReq>
     ): Result<Boolean> {
-        val path = "/ms/store/api/service/store/components/storeIds/$atomId/version/info/update"
+        if (storePackageInfoReqs.isEmpty()) {
+            logger.info("updateAtomVersionPkgSize|storePackageInfoReqs is empty, skip")
+            return Result(true)
+        }
+        val path = "/ms/store/api/build/store/storeIds/$atomId/version/info/update"
         val jsonBody = objectMapper.writeValueAsString(storePackageInfoReqs)
-        val body = RequestBody.create(
-            "application/json; charset=utf-8".toMediaTypeOrNull(),
-            jsonBody
-        )
+        val body = jsonBody.toRequestBody("application/json; charset=utf-8".toMediaTypeOrNull())
         val request = buildPut(path, body)
         val responseContent = request(
             request,

src/backend/ci/core/worker/worker-common/src/main/kotlin/com/tencent/devops/worker/common/Constants.kt

@@ -72,3 +72,7 @@ const val LOG_FILE_LENGTH_LIMIT = 1073741824 // 1 GB = 1073741824 Byte
 val PIPELINE_SCRIPT_ATOM_CODE = listOf("PipelineScriptDev", "PipelineScriptTest", "PipelineScript")
 
 const val BK_CI_ATOM_EXECUTE_ENV_PATH = "BK_CI_ATOM_EXECUTE_ENV_PATH"
+
+const val BK_ATOM_PYTHON_VENV_ENABLED = "BK_ATOM_PYTHON_VENV_ENABLED"
+
+const val PYTHON_VENV_DIR = ".venv"

src/backend/ci/core/worker/worker-common/src/main/kotlin/com/tencent/devops/worker/common/api/atom/AtomArchiveSDKApi.kt

@@ -119,6 +119,17 @@ interface AtomArchiveSDKApi : WorkerRestApiSDK {
         runtimeVersion: String
     ): Result<StorePkgRunEnvInfo?>
 
+    /**
+     * 检查插件是否在指定类型的白名单中
+     * @param atomCode 插件代码
+     * @param whitelistType 白名单类型
+     * @return Result<Boolean> true-在白名单中且启用, false-不在白名单中或未启用
+     */
+    fun isAtomInWhitelist(
+        atomCode: String,
+        whitelistType: String
+    ): Result<Boolean>
+
     /**
      * 更新插件版本日志文件大小
      */

src/backend/ci/core/worker/worker-common/src/main/kotlin/com/tencent/devops/worker/common/service/AtomRunConditionHandleService.kt

@@ -33,27 +33,27 @@ import java.io.File
 interface AtomRunConditionHandleService {
 
     /**
-     * 准备运行时环境
-     * @param osType 操作系统类型
-     * @param language 开发语言
-     * @param runtimeVersion 运行时版本
-     * @param workspace 工作空间
-     * @return 布尔值
+     * 准备运行时环境，返回虚拟环境bin路径（null表示未设置环境路径）
+     * @param atomCode 插件代码
      */
     fun prepareRunEnv(
+        atomCode: String? = null,
         osType: OSType,
         language: String,
         runtimeVersion: String,
-        workspace: File
-    ): Boolean
+        workspace: File,
+        atomTmpSpace: File? = null,
+        runtimeVariables: Map<String, String> = emptyMap()
+    ): String?
 
     /**
      * 处理target入口命令逻辑
      */
     fun handleAtomTarget(
         target: String,
         osType: OSType,
-        postEntryParam: String?
+        postEntryParam: String?,
+        atomExecuteEnvPath: String? = null
     ): String
 
     /**
@@ -68,6 +68,7 @@ interface AtomRunConditionHandleService {
         preCmd: String,
         osName: String,
         pkgName: String,
-        runtimeVersion: String? = null
+        runtimeVersion: String? = null,
+        atomExecuteEnvPath: String? = null
     ): String
 }

src/backend/ci/core/worker/worker-common/src/main/kotlin/com/tencent/devops/worker/common/service/impl/CommonAtomRunConditionHandleServiceImpl.kt

@@ -34,18 +34,22 @@ import java.io.File
 class CommonAtomRunConditionHandleServiceImpl : AtomRunConditionHandleService {
 
     override fun prepareRunEnv(
+        atomCode: String?,
         osType: OSType,
         language: String,
         runtimeVersion: String,
-        workspace: File
-    ): Boolean {
-        return true
+        workspace: File,
+        atomTmpSpace: File?,
+        runtimeVariables: Map<String, String>
+    ): String? {
+        return null
     }
 
     override fun handleAtomTarget(
         target: String,
         osType: OSType,
-        postEntryParam: String?
+        postEntryParam: String?,
+        atomExecuteEnvPath: String?
     ): String {
         return target
     }
@@ -54,7 +58,8 @@ class CommonAtomRunConditionHandleServiceImpl : AtomRunConditionHandleService {
         preCmd: String,
         osName: String,
         pkgName: String,
-        runtimeVersion: String?
+        runtimeVersion: String?,
+        atomExecuteEnvPath: String?
     ): String {
         return preCmd
     }

src/backend/ci/core/worker/worker-common/src/main/kotlin/com/tencent/devops/worker/common/service/impl/GolangAtomRunConditionHandleServiceImpl.kt

@@ -31,26 +31,30 @@ import com.tencent.devops.common.api.enums.OSType
 import com.tencent.devops.common.api.util.JsonUtil
 import com.tencent.devops.common.service.utils.CommonUtils
 import com.tencent.devops.worker.common.service.AtomRunConditionHandleService
-import org.slf4j.LoggerFactory
 import java.io.File
+import org.slf4j.LoggerFactory
 
 class GolangAtomRunConditionHandleServiceImpl : AtomRunConditionHandleService {
 
     private val logger = LoggerFactory.getLogger(GolangAtomRunConditionHandleServiceImpl::class.java)
 
     override fun prepareRunEnv(
+        atomCode: String?,
         osType: OSType,
         language: String,
         runtimeVersion: String,
-        workspace: File
-    ): Boolean {
-        return true
+        workspace: File,
+        atomTmpSpace: File?,
+        runtimeVariables: Map<String, String>
+    ): String? {
+        return null
     }
 
     override fun handleAtomTarget(
         target: String,
         osType: OSType,
-        postEntryParam: String?
+        postEntryParam: String?,
+        atomExecuteEnvPath: String?
     ): String {
         var convertTarget = target
         if (!postEntryParam.isNullOrBlank()) {
@@ -64,7 +68,8 @@ class GolangAtomRunConditionHandleServiceImpl : AtomRunConditionHandleService {
         preCmd: String,
         osName: String,
         pkgName: String,
-        runtimeVersion: String?
+        runtimeVersion: String?,
+        atomExecuteEnvPath: String?
     ): String {
         val preCmds = CommonUtils.strToList(preCmd).toMutableList()
         if (osName != OSType.WINDOWS.name.lowercase()) {