Russia is currently at war with Ukraine. An attack against not-directly-military targets in Russia (from bridges and power plants to aircraft factories and government offices) is legal if it follows the usual tests of the law of war.
Armed forces can launch attack even if they expect collateral damage, as long as they expect the military damage to outweigh that. This is why protected sites like hospitals must be clearly marked, and not be used for other, military purposes (so they do not meet the necessity test).
The Russian President is the commander of the Russian forces and a legitimate target. So if Ukraine has a cruise missile that can hit his office, or his flat, they can try. Even if that missile may hit the flat next door. If they send uniformed troops hiking overland to Moscow, to make an infantry attack, that would also be legitimate. If the troops get captured, on the way in or the way out, they are entitled to POW status and cannot be punished for killing Russian soldiers.
Sending a plain-clothes assassin would not be covered. If such an assassin (or 'covert operator') is captured, the captors can try him or her in a criminal court, according to their domestic legal system. (So the issue of war crimes trials tends not to come up. Attempted murder is usually sufficient.) The definition of uniforms or 'distinctive insignia' was made to allow popular militas, guerillas, etc., as long as they behave in accordance with the laws of war. Here is an American study which concluded that Russia's 'polite green men' were probably covered, even without national insignia, because they were distinctive.
Other countries could join the war, either as allies of one side or the other, or as co-belligerents fighting the same enemy without being allied. (Finland claimed this status during WWII.) Once they are at war, the same rules apply to them.