fix: improve behaviour across masking, commands and status (#1194)

Fixes 51 bugs discovered via comparison with `actions/runner`. Every fix has test coverage.

### Secrets

- A short secret registered no shifted-base64 form, so `base64("user:$TOKEN")` printed in the clear
- Encoded forms came only from the whole trimmed value, missing padded and per-line spellings
- Masks split only on `\n`, so `::add-mask::a%0Db` registered neither half
- Adds XML, expression-string and quote-trimming encoders

### Workflow commands

- Split at the last `::` or `]` rather than the first, so `::add-mask::a::b` registered no mask
- A command on the last line without a newline was ignored, and `::ADD-MASK::` did nothing
- `##[...]` did not decode `%3B`/`%5D`, properties lost anything after a second `=`
- `$GITHUB_ENV` and `::set-env::` now refuse `NODE_OPTIONS`

### Status

- `continue-on-error` reported failed, a cancelled job reported success, an `if:` error reported cancelled
- File commands ran after `continue-on-error`, failing the job while the step stayed green
- A bad job output aborted the whole run instead of that job

### Steps and actions

- `${{ matrix.* }}` and `${{ strategy.* }}` were empty inside composite actions
- Composite inputs leaked into nested actions as `INPUT_*`, `with:` matched case-sensitively, `pre` failures were dropped
- Docker actions dropped `runs.env` when the caller passed `with: args:`, and caller `args`/`entrypoint` beat the manifest
- An implicit shell ran with `pipefail`, a `shell:` without `{0}` passed without running
- `container.env` overrode job env and every `$GITHUB_ENV` write, heredocs lost leading blank lines, `$GITHUB_PATH` was not BOM-decoded

Written by Claude Opus 5.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1194
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

act/runner/run_context_test.go

@@ -9,6 +9,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"runtime"
 	"strings"
@@ -326,6 +327,7 @@ jobs:
 	require.Equal(t, []string{"data"}, redis.ValidVolumes)
 	require.Equal(t, map[string]string{"data": "/data"}, redis.Mounts)
 	require.Empty(t, redis.Binds) // the docker socket is the job container's alone
+	require.Empty(t, redis.WorkingDir)
 }
 
 // Only the workflow's options may be stripped later, so the two sources have to reach the
@@ -1352,10 +1354,15 @@ func TestRunContextGetRunnerContext(t *testing.T) {
 	t.Run("adds the runner values the container cannot know", func(t *testing.T) {
 		rc := createRunsOnRunContext(t, "ubuntu-latest")
 		rc.Config.RunnerName = "runner-1"
+		rc.Config.Workdir = "/workspace/owner/repo"
 
 		runnerContext := rc.getRunnerContext(ctx)
 		assert.Equal(t, "runner-1", runnerContext["name"])
 		assert.Equal(t, "self-hosted", runnerContext["environment"])
+		assert.Equal(t, "/workspace/owner", runnerContext["workspace"])
+		assert.Equal(t, "/workspace/owner/repo", rc.getGithubContext(ctx).Workspace)
+		rc.Config.Env = map[string]string{"GITHUB_WORKSPACE": "/configured/work"}
+		assert.Equal(t, "/configured/work", rc.getGithubContext(ctx).Workspace)
 		assert.NotContains(t, runnerContext, "debug")
 	})
 
@@ -1368,15 +1375,52 @@ func TestRunContextGetRunnerContext(t *testing.T) {
 
 	t.Run("keeps the execution environment values", func(t *testing.T) {
 		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.JobContainer = &container.HostEnvironment{TmpDir: "/tmp/act", ToolCache: "/tmp/tool_cache"}
+		rc.Config.Workdir = "/host/work/owner/repo"
+		rc.JobContainer = &container.HostEnvironment{Workdir: rc.Config.Workdir, Path: "/container/work/owner/repo", TmpDir: "/tmp/act", ToolCache: "/tmp/tool_cache"}
 
 		runnerContext := rc.getRunnerContext(ctx)
 		assert.Equal(t, "/tmp/act", runnerContext["temp"])
 		assert.Equal(t, "/tmp/tool_cache", runnerContext["tool_cache"])
+		assert.Equal(t, "/container/work/owner", runnerContext["workspace"])
+		assert.Equal(t, "/container/work/owner/repo", rc.getGithubContext(ctx).Workspace)
 		assert.NotEmpty(t, runnerContext["os"])
 	})
 }
 
+func TestRunContextUpdateExtraPath(t *testing.T) {
+	longPath := strings.Repeat("x", 64*1024+1)
+	for _, testcase := range []struct {
+		name    string
+		content []byte
+		want    string
+		wantErr bool
+	}{
+		{name: "UTF-8 BOM", content: []byte("\xef\xbb\xbf/utf8/tools\n"), want: "/utf8/tools"},
+		{name: "UTF-16 BOM", content: []byte{0xff, 0xfe, 'C', 0, ':', 0, '\\', 0, 't', 0, 'o', 0, 'o', 0, 'l', 0, 's', 0, '\n', 0}, want: `C:\tools`},
+		{name: "over 64 KiB", content: []byte(longPath + "\n"), want: longPath},
+		{name: "over 16 MiB", content: []byte(strings.Repeat("x", 16*1024*1024+1)), wantErr: true},
+	} {
+		t.Run(testcase.name, func(t *testing.T) {
+			logger := log.New()
+			logger.SetOutput(io.Discard)
+			ctx := common.WithLogger(t.Context(), logger)
+			jobContainer := &containerMock{}
+			jobContainer.On("GetContainerArchive", mock.Anything, "/github/path").
+				Return(io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "path", body: string(testcase.content)}))), nil).Once()
+			defer jobContainer.AssertExpectations(t)
+			rc := &RunContext{JobContainer: jobContainer}
+
+			err := rc.UpdateExtraPath(ctx, "/github/path")
+			if testcase.wantErr {
+				require.ErrorContains(t, err, "reading path file")
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, []string{testcase.want}, rc.ExtraPath)
+		})
+	}
+}
+
 func TestParentDir(t *testing.T) {
 	assert.Empty(t, parentDir(""))
 	assert.Empty(t, parentDir("repo"))