fix: improve behaviour across masking, commands and status (#1194)

Fixes 51 bugs discovered via comparison with `actions/runner`. Every fix has test coverage.

### Secrets

- A short secret registered no shifted-base64 form, so `base64("user:$TOKEN")` printed in the clear
- Encoded forms came only from the whole trimmed value, missing padded and per-line spellings
- Masks split only on `\n`, so `::add-mask::a%0Db` registered neither half
- Adds XML, expression-string and quote-trimming encoders

### Workflow commands

- Split at the last `::` or `]` rather than the first, so `::add-mask::a::b` registered no mask
- A command on the last line without a newline was ignored, and `::ADD-MASK::` did nothing
- `##[...]` did not decode `%3B`/`%5D`, properties lost anything after a second `=`
- `$GITHUB_ENV` and `::set-env::` now refuse `NODE_OPTIONS`

### Status

- `continue-on-error` reported failed, a cancelled job reported success, an `if:` error reported cancelled
- File commands ran after `continue-on-error`, failing the job while the step stayed green
- A bad job output aborted the whole run instead of that job

### Steps and actions

- `${{ matrix.* }}` and `${{ strategy.* }}` were empty inside composite actions
- Composite inputs leaked into nested actions as `INPUT_*`, `with:` matched case-sensitively, `pre` failures were dropped
- Docker actions dropped `runs.env` when the caller passed `with: args:`, and caller `args`/`entrypoint` beat the manifest
- An implicit shell ran with `pipefail`, a `shell:` without `{0}` passed without running
- `container.env` overrode job env and every `$GITHUB_ENV` write, heredocs lost leading blank lines, `$GITHUB_PATH` was not BOM-decoded

Written by Claude Opus 5.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1194
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

act/runner/run_context.go

@@ -37,6 +37,8 @@ import (
 	"github.com/moby/moby/api/types/mount"
 	"github.com/opencontainers/selinux/go-selinux"
 	"golang.org/x/sync/errgroup"
+	"golang.org/x/text/encoding/unicode"
+	"golang.org/x/text/transform"
 )
 
 // RunContext contains info about current job
@@ -88,6 +90,7 @@ type RunContext struct {
 	jobFailed bool
 	// empty for a host-mode job, which starts no container
 	jobContainerID string
+	hasBash        *bool // memoized implicit-shell probe, only set on the top-level RunContext
 	jobNetworkName string
 	// stepEnv is a copy of the running step's environment, so that workflow commands parsed out
 	// of the container's output can be judged against it. Written by runStepExecutor and read on
@@ -506,7 +509,6 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			serviceContainerName := createContainerName(rc.jobContainerName(), serviceID)
 			c := newContainer(&container.NewContainerInput{
 				Name:            serviceContainerName,
-				WorkingDir:      ext.ToContainerPath(rc.Config.Workdir),
 				Image:           serviceImage,
 				Username:        serviceUsername,
 				Password:        servicePassword,
@@ -679,13 +681,18 @@ func (rc *RunContext) UpdateExtraPath(ctx context.Context, githubEnvPath string)
 	if err != nil && err != io.EOF {
 		return err
 	}
-	s := bufio.NewScanner(reader)
+	decoded := transform.NewReader(reader, unicode.BOMOverride(unicode.UTF8.NewDecoder()))
+	s := bufio.NewScanner(decoded)
+	s.Buffer(make([]byte, 0, 64*1024), 16*1024*1024)
 	for s.Scan() {
 		line := s.Text()
 		if len(line) > 0 {
 			rc.addPath(ctx, line)
 		}
 	}
+	if err := s.Err(); err != nil {
+		return fmt.Errorf("reading path file: %w", err)
+	}
 	return nil
 }
 
@@ -917,11 +924,24 @@ func (rc *RunContext) interpolateOutputs() common.Executor {
 		// pristine snapshot (outputTemplate) and write under the lock, so each combo overwrites
 		// with its own resolved values (last wins, as on GitHub) instead of the first combo's
 		// resolved values freezing the shared template against later combos.
-		defer lockJob(job)()
+		// Resolved up front so one failure publishes none of them, as GitHub does.
+		outputs := make(map[string]string, len(rc.outputTemplate))
+		var err error
 		for k, v := range rc.outputTemplate {
-			job.Outputs[k] = ee.Interpolate(ctx, v)
+			if outputs[k], err = ee.interpolate(ctx, v); err != nil {
+				err = fmt.Errorf("failed to evaluate job output %q: %w", k, err)
+				break
+			}
 		}
-		return nil
+		defer lockJob(job)()
+		for k := range rc.outputTemplate {
+			if err != nil {
+				job.Outputs[k] = ""
+				continue
+			}
+			job.Outputs[k] = outputs[k]
+		}
+		return err
 	}
 }
 
@@ -1245,12 +1265,23 @@ func (rc *RunContext) getRunnerContext(ctx context.Context) map[string]any {
 	}
 	runnerContext["name"] = rc.Config.RunnerName
 	runnerContext["environment"] = "self-hosted"
+	runnerContext["workspace"] = parentDir(rc.githubWorkspace())
 	if rc.Config.RunnerDebug() {
 		runnerContext["debug"] = "1"
 	}
 	return runnerContext
 }
 
+func (rc *RunContext) githubWorkspace() string {
+	if rc.JobContainer != nil {
+		return rc.JobContainer.ToContainerPath(rc.Config.Workdir)
+	}
+	if workspace := rc.Config.Env["GITHUB_WORKSPACE"]; workspace != "" {
+		return workspace
+	}
+	return rc.Config.Workdir
+}
+
 func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext {
 	logger := common.Logger(ctx)
 	ghc := &model.GithubContext{
@@ -1277,11 +1308,10 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext
 		RefType:          rc.Config.Env["GITHUB_REF_TYPE"],
 		BaseRef:          rc.Config.Env["GITHUB_BASE_REF"],
 		HeadRef:          rc.Config.Env["GITHUB_HEAD_REF"],
-		Workspace:        rc.Config.Env["GITHUB_WORKSPACE"],
+		Workspace:        rc.githubWorkspace(),
 	}
 	if rc.JobContainer != nil {
 		ghc.EventPath = rc.JobContainer.GetActPath() + "/workflow/event.json"
-		ghc.Workspace = rc.JobContainer.ToContainerPath(rc.Config.Workdir)
 	}
 
 	if ghc.RunID == "" {