feat(run-environment): support CircleCI for GitHub repositories

The build runs on CircleCI while commits and pull requests live on GitHub, so a
run is reported against the GitHub commit and pull request. Detection is
`CIRCLECI=true`, and the repository comes from `CIRCLE_REPOSITORY_URL`. CircleCI
also builds Bitbucket and GitLab repositories, so the remote's domain is checked
and anything but `github.com` is refused with an error naming the domain found.
That domain is the only signal available at runtime: `pipeline.project.type` is a
pipeline value, interpolated when the config is compiled, so it never reaches the
job as an environment variable.

`runId` is `CIRCLE_WORKFLOW_ID`, shared by every job and every parallel container
of a workflow; the per-job `CIRCLE_WORKFLOW_JOB_ID` would split one workflow into
unrelated runs. `runPartId` is `{CIRCLE_JOB}-{CIRCLE_NODE_INDEX}`, to stay unique
along both fan-out axes. No commit hash override is needed, as CircleCI checks
out the associated commit rather than a synthetic merge ref.

Uploads authenticate with an OIDC token the job mints for itself, so they need no
`CODSPEED_TOKEN` secret. The token CircleCI exposes in `CIRCLE_OIDC_TOKEN` and
`CIRCLE_OIDC_TOKEN_V2` cannot be used: its audience is fixed to the id of the
CircleCI organization, while CodSpeed requires its own. Only the `circleci` CLI
can request a custom audience — CircleCI publishes no endpoint for it, unlike the
`ACTIONS_ID_TOKEN_REQUEST_URL` GitHub Actions provides — so the runner shells out
to `circleci run oidc get`, once per upload, as a token expires an hour after it
is minted.

Whether a job can mint at all is settled by minting a token and throwing it away,
before the benchmarks run: a CLI can be installed and still predate
`run oidc get`, so probing for the binary would pass and the mint would fail once
the benchmarks had run for nothing. A static `CODSPEED_TOKEN` is used as is when
one is set, and stays required for a pull request opened from a fork, whose token
names the fork.

`baseRef` and `sender` are left empty: CircleCI exposes neither a base-branch
variable nor the id the repository provider gives the user who triggered a build.

Closes COD-2995
Closes COD-3257

Author: fargito

src/run_environment/circleci/logger.rs

@@ -0,0 +1,105 @@
+use console::style;
+use log::*;
+use simplelog::SharedLogger;
+use std::{env, io::Write};
+
+use crate::{
+    logger::{GroupEvent, get_announcement_event, get_group_event, get_json_event},
+    run_environment::logger::should_provider_logger_handle_record,
+};
+
+/// A logger that prints logs in the format expected by CircleCI
+///
+/// CircleCI has no collapsible section markers, so groups are printed as plain
+/// headers.
+pub struct CircleCILogger {
+    log_level: LevelFilter,
+}
+
+impl CircleCILogger {
+    pub fn new() -> Self {
+        // force activation of colors: CircleCI renders ANSI sequences in its UI, but
+        // the output is not a TTY so colors would be disabled by default.
+        console::set_colors_enabled(true);
+
+        let log_level = env::var("CODSPEED_LOG")
+            .ok()
+            .and_then(|log_level| log_level.parse::<log::LevelFilter>().ok())
+            .unwrap_or(log::LevelFilter::Info);
+        Self { log_level }
+    }
+}
+
+impl Log for CircleCILogger {
+    fn enabled(&self, _metadata: &Metadata) -> bool {
+        true
+    }
+
+    fn log(&self, record: &Record) {
+        if !should_provider_logger_handle_record(record) {
+            return;
+        }
+
+        let level = record.level();
+        let message = record.args();
+
+        if let Some(group_event) = get_group_event(record) {
+            match group_event {
+                GroupEvent::Start(name) | GroupEvent::StartOpened(name) => {
+                    println!("{}", style(name).cyan().bold());
+                }
+                GroupEvent::End => {}
+            }
+            return;
+        }
+
+        if get_json_event(record).is_some() {
+            return;
+        }
+
+        if let Some(announcement) = get_announcement_event(record) {
+            println!("{}", style(announcement).green());
+            return;
+        }
+
+        if level > self.log_level {
+            return;
+        }
+
+        match level {
+            Level::Error => {
+                println!("{}", style(message).red());
+            }
+            Level::Warn => {
+                println!("{}", style(message).yellow());
+            }
+            Level::Info => {
+                println!("{message}");
+            }
+            Level::Debug => {
+                println!("{}", style(message).cyan());
+            }
+            Level::Trace => {
+                println!("{}", style(message).magenta());
+            }
+        }
+    }
+
+    fn flush(&self) {
+        std::io::stdout().flush().unwrap();
+    }
+}
+
+impl SharedLogger for CircleCILogger {
+    fn level(&self) -> LevelFilter {
+        self.log_level
+    }
+
+    fn config(&self) -> Option<&simplelog::Config> {
+        None
+    }
+
+    fn as_log(self: Box<Self>) -> Box<dyn Log> {
+        Box::new(*self)
+    }
+}

src/run_environment/circleci/mod.rs

@@ -0,0 +1,5 @@
+mod logger;
+mod oidc;
+mod provider;
+
+pub use provider::CircleCIProvider;

src/run_environment/circleci/oidc.rs

@@ -0,0 +1,47 @@
+use std::process::Command;
+
+use crate::prelude::*;
+
+/// The CLI CircleCI makes available inside jobs.
+const CIRCLECI_CLI: &str = "circleci";
+
+/// Mints an OIDC token for `audience`.
+///
+/// The token CircleCI puts in `CIRCLE_OIDC_TOKEN` and `CIRCLE_OIDC_TOKEN_V2` cannot
+/// be used instead: its audience is the id of the CircleCI organization, while
+/// CodSpeed requires its own. Requesting the audience is what makes a token minted
+/// for another integration unusable against CodSpeed, and vice versa.
+///
+/// Errors carry what the CLI itself reported, as only the first error of a chain is
+/// shown outside of debug logging: callers should add their advice to that message
+/// rather than wrap it.
+///
+/// <https://circleci.com/docs/guides/permissions-authentication/oidc-tokens-with-custom-claims/>
+pub fn mint_token(audience: &str) -> Result<String> {
+    let claims = serde_json::json!({ "aud": audience }).to_string();
+
+    let output = Command::new(CIRCLECI_CLI)
+        .args(["run", "oidc", "get", "--claims", &claims])
+        .output()
+        .map_err(|error| anyhow!("Failed to run the `circleci` CLI: {error}"))?;
+
+    if !output.status.success() {
+        bail!(
+            "`circleci run oidc get` failed: {}",
+            String::from_utf8_lossy(&output.stderr).trim()
+        );
+    }
+
+    // CircleCI does not mask tokens minted this way in the job output, so the token
+    // must not reach the logs, here or in the callers.
+    let token = String::from_utf8(output.stdout)
+        .map_err(|_| anyhow!("The OIDC token minted by CircleCI is not valid UTF-8"))?
+        .trim()
+        .to_string();
+
+    if token.is_empty() {
+        bail!("`circleci run oidc get` returned an empty token");
+    }
+
+    Ok(token)
+}