fix: improve behaviour across masking, commands and status (#1194)

Fixes 51 bugs discovered via comparison with `actions/runner`. Every fix has test coverage.

### Secrets

- A short secret registered no shifted-base64 form, so `base64("user:$TOKEN")` printed in the clear
- Encoded forms came only from the whole trimmed value, missing padded and per-line spellings
- Masks split only on `\n`, so `::add-mask::a%0Db` registered neither half
- Adds XML, expression-string and quote-trimming encoders

### Workflow commands

- Split at the last `::` or `]` rather than the first, so `::add-mask::a::b` registered no mask
- A command on the last line without a newline was ignored, and `::ADD-MASK::` did nothing
- `##[...]` did not decode `%3B`/`%5D`, properties lost anything after a second `=`
- `$GITHUB_ENV` and `::set-env::` now refuse `NODE_OPTIONS`

### Status

- `continue-on-error` reported failed, a cancelled job reported success, an `if:` error reported cancelled
- File commands ran after `continue-on-error`, failing the job while the step stayed green
- A bad job output aborted the whole run instead of that job

### Steps and actions

- `${{ matrix.* }}` and `${{ strategy.* }}` were empty inside composite actions
- Composite inputs leaked into nested actions as `INPUT_*`, `with:` matched case-sensitively, `pre` failures were dropped
- Docker actions dropped `runs.env` when the caller passed `with: args:`, and caller `args`/`entrypoint` beat the manifest
- An implicit shell ran with `pipefail`, a `shell:` without `{0}` passed without running
- `container.env` overrode job env and every `$GITHUB_ENV` write, heredocs lost leading blank lines, `$GITHUB_PATH` was not BOM-decoded

Written by Claude Opus 5.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1194
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

act/runner/step_run_test.go

@@ -8,6 +8,9 @@ import (
 	"bytes"
 	"context"
 	"io"
+	"os"
+	"path/filepath"
+	"runtime"
 	"testing"
 
 	"gitea.com/gitea/runner/act/container"
@@ -15,8 +18,13 @@ import (
 	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
 )
 
+type shellContainerMock struct{ *containerMock }
+
+func (*shellContainerMock) ReplaceLogWriter(_, _ io.Writer) (io.Writer, io.Writer) { return nil, nil }
+
 func TestStepRun(t *testing.T) {
 	cm := &containerMock{}
 	fileEntry := &container.FileEntry{
@@ -73,3 +81,103 @@ func TestStepRun(t *testing.T) {
 
 	cm.AssertExpectations(t)
 }
+
+func TestStepRunShellParity(t *testing.T) {
+	tests := []struct {
+		name, shell, workingDir string
+		env                     map[string]string
+		host                    bool
+		probeErr                error
+		wantExt                 string
+		wantCmd                 []string
+		wantErr                 string
+	}{
+		{
+			name:    "implicit host bash",
+			host:    true,
+			wantCmd: []string{"bash", "-e", "/var/run/act/workflow/1.sh"},
+		},
+		{
+			name:    "implicit container bash",
+			wantCmd: []string{"bash", "-e", "/var/run/act/workflow/1.sh"},
+		},
+		{
+			name:     "implicit container sh fallback",
+			probeErr: assert.AnError,
+			wantCmd:  []string{"sh", "-e", "/var/run/act/workflow/1.sh"},
+		},
+		{
+			name:    "custom pwsh template",
+			shell:   "pwsh -NoProfile -File {0}",
+			wantExt: ".ps1",
+			wantCmd: []string{"pwsh", "-NoProfile", "-File", "/var/run/act/workflow/1.ps1"},
+		},
+		{
+			name:    "missing placeholder",
+			shell:   "bash -e",
+			wantErr: `invalid shell option "bash -e": format must contain {0}`,
+		},
+		{
+			name:    "all placeholders",
+			shell:   "bash -c '. {0}; . {0}'",
+			wantCmd: []string{"bash", "-c", ". /var/run/act/workflow/1.sh; . /var/run/act/workflow/1.sh"},
+		},
+		{
+			name:       "step env expressions",
+			shell:      "${{ env.SHELL }}",
+			workingDir: "${{ env.DIR }}",
+			env:        map[string]string{"SHELL": "python {0}", "DIR": "subdir"},
+			wantExt:    ".py",
+			wantCmd:    []string{"python", "/var/run/act/workflow/1.py"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cm := &containerMock{}
+			var jobContainer container.ExecutionsEnvironment = &shellContainerMock{cm}
+			if test.host {
+				if runtime.GOOS == "windows" {
+					t.Skip("Linux host shell selection")
+				}
+				test.env = map[string]string{"PATH": t.TempDir()}
+				require.NoError(t, os.WriteFile(filepath.Join(test.env["PATH"], "bash"), nil, 0o755))
+				jobContainer = &container.HostEnvironment{ActPath: "/var/run/act"}
+			} else if test.shell == "" {
+				cm.On("Exec", []string{"sh", "-c", "command -v bash >/dev/null 2>&1"},
+					mock.AnythingOfType("map[string]string"), "", "").Return(func(context.Context) error {
+					return test.probeErr
+				})
+			}
+
+			sr := &stepRun{
+				RunContext: &RunContext{
+					Config:       &Config{},
+					Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
+					JobContainer: jobContainer,
+				},
+				Step: &model.Step{ID: "1", Run: "echo hi", Shell: test.shell, WorkingDirectory: test.workingDir},
+				env:  test.env,
+			}
+
+			name, script, err := sr.setupShellCommand(t.Context())
+			if test.wantErr != "" {
+				require.EqualError(t, err, test.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			if test.wantExt == "" {
+				test.wantExt = ".sh"
+			}
+			wantScript := "\necho hi\n"
+			if test.wantExt == ".ps1" {
+				wantScript = "$ErrorActionPreference = 'stop'\necho hi\nif ((Test-Path -LiteralPath variable:/LASTEXITCODE)) { exit $LASTEXITCODE }"
+			}
+			assert.Equal(t, "workflow/1"+test.wantExt, name)
+			assert.Equal(t, wantScript, script)
+			assert.Equal(t, test.wantCmd, sr.cmd)
+			assert.Equal(t, test.env["DIR"], sr.WorkingDirectory)
+			cm.AssertExpectations(t)
+		})
+	}
+}