fix: automatically add the workspace mount to allowed volumes (#1203)

Automatically allow workspace mounts in `valid_volumes` for the mounts done via `bind_workdir`, this obsoletes the need for `/workspace/**` or other insecure configurations which would expose workspaces between tasks.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1203
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

act/runner/run_context.go

@@ -246,6 +246,9 @@ func (rc *RunContext) validVolumes() []string {
 	if rc.Config.SharedToolCache {
 		volumes = append(volumes, sharedToolCacheVolume)
 	}
+	if rc.Config.BindWorkdir {
+		volumes = append(volumes, rc.Config.Workdir)
+	}
 	// TODO: add a new configuration to control whether the docker daemon can be mounted
 	return append(volumes, name, name+"-env",
 		getDockerDaemonSocketMountPath(rc.containerDaemonSocket()))

act/runner/run_context_test.go

@@ -604,6 +604,11 @@ func TestRunContextValidVolumes(t *testing.T) {
 	// a job may mount it only while the runner does
 	rc.Config.SharedToolCache = false
 	assert.NotContains(t, rc.validVolumes(), sharedToolCacheVolume)
+
+	rc.Config.Workdir = "/workspace/1/owner/repo"
+	assert.NotContains(t, rc.validVolumes(), rc.Config.Workdir)
+	rc.Config.BindWorkdir = true
+	assert.Contains(t, rc.validVolumes(), rc.Config.Workdir)
 }
 
 func TestCleanupJobResourcesCleansServicesWithoutJobContainer(t *testing.T) {