feat: add log.job.dir (#1165)

`log.job.dir` makes the runner write a copy of every task's log to that directory, as `<start time>-task-<id>.log`: the rows exactly as Gitea received them, with the same masking and the job's result on the last line. Off by default, and what Gitea shows does not change.

`log.job.retention` (default `168h`) and `log.job.max_size` (default `1GB`) bound the directory. Documented in the README.

---------

Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1165
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>

.gitea/workflows/release-nightly.yml

@@ -20,11 +20,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      # Custom publishers (the R2 mirror below) run as the very last
+      # Custom publishers (the R2 upload below) run as the very last
       # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
+      # has already been created. Fail here instead, before anything
+      # is built or published, if the R2 secrets are missing.
       - name: check R2 configuration
         run: sh scripts/upload-r2.sh --check-config
         env:
@@ -43,11 +42,6 @@ jobs:
           args: release --nightly
         env:
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          AWS_REGION: ${{ secrets.AWS_REGION }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          S3_REGION: ${{ secrets.AWS_REGION }}
-          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
           R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
           R2_BUCKET: ${{ secrets.R2_BUCKET }}
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}

.gitea/workflows/release-tag.yml

@@ -12,11 +12,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # all history for all branches and tags
-      # Custom publishers (the R2 mirror below) run as the very last
+      # Custom publishers (the R2 upload below) run as the very last
       # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
+      # has already been created. Fail here instead, before anything
+      # is built or published, if the R2 secrets are missing.
       - name: check R2 configuration
         run: sh scripts/upload-r2.sh --check-config
         env:
@@ -42,11 +41,6 @@ jobs:
           args: release
         env:
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          AWS_REGION: ${{ secrets.AWS_REGION }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          S3_REGION: ${{ secrets.AWS_REGION }}
-          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
           R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
           R2_BUCKET: ${{ secrets.R2_BUCKET }}
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}

.goreleaser.yaml

@@ -65,7 +65,7 @@ builds:
   flags:
   - -trimpath
   ldflags:
-  - -s -w -X main.version={{ .Summary }}
+  - -s -w -X gitea.com/gitea/runner/internal/pkg/ver.version={{ .Summary }}
   binary: >-
     {{ .ProjectName }}-
     {{- .Version }}-
@@ -83,24 +83,12 @@ builds:
       - cmd: sh .goreleaser.checksum.sh {{ .Path }}
       - cmd: sh .goreleaser.checksum.sh {{ .Path }}.xz
 
-blobs:
-  -
-    provider: s3
-    bucket: "{{ .Env.S3_BUCKET }}"
-    region: "{{ .Env.S3_REGION }}"
-    directory: "gitea-runner/{{.Version}}"
-    extra_files:
-      - glob: ./**.xz
-      - glob: ./**.sha256
-
-# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the
-# parallel S3+R2 period (S3 will be removed once migration completes).
-# A second `blobs:` entry is impossible here since the blob pipe
-# authenticates from the global AWS_* env with no per-entry
-# credentials; `publishers:` supports per-entry `env:` instead, so
-# it's used to invoke scripts/upload-r2.sh once per artifact. Custom
-# publishers inherit almost nothing from the environment, hence the
-# explicit R2_* forwarding below.
+# Uploads every release artifact to Cloudflare R2. The `blobs:` pipe
+# isn't usable here since it authenticates from the global AWS_* env
+# with no per-entry credentials; `publishers:` supports per-entry
+# `env:` instead, so it's used to invoke scripts/upload-r2.sh once per
+# artifact. Custom publishers inherit almost nothing from the
+# environment, hence the explicit R2_* forwarding below.
 #
 # This publisher fires 109 times for 73 distinct keys because
 # goreleaser's release pipe already registers `release.extra_files`
@@ -125,7 +113,7 @@ publishers:
       - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }}
 
 archives:
-  - format: binary
+  - formats: [binary]
     name_template: "{{ .Binary }}"
     allow_different_binary_count: true
 

Dockerfile

@@ -17,7 +17,7 @@ RUN make clean && make build
 ### DIND VARIANT
 #
 #
-FROM docker:29.6.2-dind AS dind
+FROM docker:29.7.1-dind AS dind
 
 ARG VERSION=dev
 
@@ -37,7 +37,7 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### DIND-ROOTLESS VARIANT
 #
 #
-FROM docker:29.6.2-dind-rootless AS dind-rootless
+FROM docker:29.7.1-dind-rootless AS dind-rootless
 
 ARG VERSION=dev
 

Makefile

@@ -72,8 +72,7 @@ else
 endif
 
 TAGS ?=
-LDFLAGS ?= -X "main.version=v$(RELASE_VERSION)"
-VERSION_CHECK_BIN := $(DIST)/version-check$(suffix $(EXECUTABLE))
+LDFLAGS ?= -X "gitea.com/gitea/runner/internal/pkg/ver.version=v$(RELASE_VERSION)"
 
 .PHONY: all
 all: build
@@ -114,19 +113,7 @@ deps-tools: ## install tool dependencies
 	wait
 
 .PHONY: checks
-checks: tidy-check fmt-check security-check version-check ## run the non-lint source checks
-
-.PHONY: version-check
-version-check: ## verify the version is injected into the binary
-	@mkdir -p $(DIST)
-	@$(GO) build -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) -X "main.version=v0.0.0-injected"' -o $(VERSION_CHECK_BIN) .
-	@case "$$($(VERSION_CHECK_BIN) --version)" in \
-		*v0.0.0-injected*) ;; \
-		*) echo "version injection is broken, the Makefile -X target no longer matches a variable" >&2; exit 1;; \
-	esac
-	@rm -f $(VERSION_CHECK_BIN)
-	@# goreleaser builds releases from its own ldflags, so a stale -X target there ships an unversioned binary
-	@grep -q -- '-X main.version=' .goreleaser.yaml || { echo ".goreleaser.yaml no longer injects main.version" >&2; exit 1; }
+checks: tidy-check fmt-check security-check ## run the non-lint source checks
 
 .PHONY: lint
 lint: lint-go lint-go-windows ## lint everything

README.md

@@ -158,6 +158,32 @@ An edit keeps the comments and the key order of the file. Indentation becomes tw
 
 `config get`, `set`, `add` and `remove` use `config.yaml` (or `config.yml`) from the working directory, then from the directory of the binary, and print their choice to stderr. `config init` writes `config.yaml` in the working directory, and refuses to overwrite an existing config without `--force`. Pass `-c` for another path.
 
+#### Tool cache
+
+Setup actions like `setup-go` install tools into `RUNNER_TOOL_CACHE`, which is `/opt/hostedtoolcache` inside a job. `runner.tool_cache_mode` selects what backs it:
+
+| Mode | Tool cache | Trade-off |
+| --- | --- | --- |
+| `none` (default) | Per job, provided by the job image | A version the image lacks is downloaded in every job |
+| `shared` | One volume reused by every job | Two jobs writing the same tool version at once corrupt it, so use it only with `runner.capacity: 1` |
+
+With `none`, tools must come from the job image. Install them into `/opt/hostedtoolcache/<tool>/<version>/<arch>`, with an empty `<arch>.complete` file next to the directory:
+
+```dockerfile
+RUN GO=$(curl -fsSL 'https://go.dev/dl/?mode=json' | grep -oP '"version": "\Kgo1\.26\.[0-9]*' | head -1); \
+  DIR="/opt/hostedtoolcache/go/${GO#go}/x64" && \
+  mkdir -p "$(dirname "$DIR")" && \
+  curl -fsSL "https://dl.google.com/go/${GO}.linux-amd64.tar.gz" | tar -xz -C /tmp && \
+  mv /tmp/go "$DIR" && \
+  touch "${DIR}.complete"
+```
+
+A workflow requesting a minor version, `go-version: "1.26"`, resolves to the newest matching version in the cache, so a patch update in the image still hits it.
+
+Of the [runner images](https://gitea.com/gitea/runner-images), the `-full` flavour is the one that ships tools in this layout.
+
+`gitea-runner exec` reads no config file and takes `--tool-cache-mode` instead, defaulting to `none`.
+
 #### Environment variables
 
 Earlier releases let a few environment variables (`GITEA_DEBUG`, `GITEA_TRACE`, `GITEA_RUNNER_CAPACITY`, `GITEA_RUNNER_FILE`, `GITEA_RUNNER_ENVIRON`, `GITEA_RUNNER_ENV_FILE`) override parts of the config. They are gone, use the YAML file for all settings. The Docker images still read their own variables, such as `RUNNER_STATE_FILE`, see [scripts/run.sh](scripts/run.sh) and the container documentation below.
@@ -202,7 +228,7 @@ a workflow with `runs-on: ubuntu-latest` is executed in the `runner-images:ubunt
 
 Names may themselves contain a colon (for example `pool:e57e18d4-10d4-406f-93bf-60f127221bdd`); only `host` and `docker` are treated as schemas.
 
-If a job's `runs-on` matches none of the runner's labels, the job still runs, in the default `docker.gitea.com/runner-images:ubuntu-latest` image. Images maintained for this purpose are listed at [gitea/runner-images](https://gitea.com/gitea/runner-images).
+If a job's `runs-on` matches none of the runner's labels, or sets no `runs-on` at all, it still runs: in `runner.default_image` where docker is available, on the host where it is not. Images maintained for this purpose are listed at [gitea/runner-images](https://gitea.com/gitea/runner-images).
 
 Labels are chosen at registration time (`--labels`, or the interactive prompt) and can be changed afterwards by editing `runner.labels` in the config file, or in the Gitea UI under the runner's settings.
 
@@ -273,6 +299,12 @@ A password in a proxy URL is hidden in job logs. Any step can still read it, bec
 
 Each runner starts its own cache server automatically. Cache entries are local to that runner — runners do not share a cache by default.
 
+**Eviction**
+
+An entry nothing has read or written for `retention` is removed, and a repository past `repo_size_limit` loses its least recently accessed entries until it fits; `size_limit` caps the whole cache the same way. Age alone never retires an entry still in use, and whatever these allow, the cache keeps free space above `health_check.min_free_disk_space_mb` when health checks are enabled.
+
+These apply where the cache server runs, so on a shared server they belong in *its* config, not the runners'. See `retention`, `repo_size_limit`, `size_limit` and `sweep_interval` in [config.example.yaml](internal/pkg/config/config.example.yaml) for units and defaults.
+
 **Cache service v2**
 
 `actions/cache@v4.2` and later can use the *cache service v2* API. The runner serves it from the same store as v1, on by default, and it works with `external_server`. Turn it off with:
@@ -282,7 +314,7 @@ cache:
   v2: false
 ```
 
-Those actions refuse any host they do not take for GitHub. Rather than misreport the server URL, the runner edits that check out of the action's own bundle and keeps the untouched copy beside it; a bundle it does not recognise is left alone and keeps to v1. The same edit lets the stock `actions/upload-artifact` and `actions/download-artifact` work from `v4.4.0` on, without the `gitea-upload-artifact` fork.
+Those actions refuse any host they do not take for GitHub. Rather than misreport the server URL, the runner edits that check out of the action's own bundle on its way into the job, undone whenever the action is downloaded again. A bundle it does not recognise is left alone and keeps to v1. The same edit lets the stock `actions/upload-artifact` and `actions/download-artifact` work from `v4.4.0` on, without the `gitea-upload-artifact` fork, so it is made whatever `v2` says: that setting only governs the API the runner advertises. Set `runner.patch_actions: false` to leave every bundle exactly as shipped, an escape hatch for an action the edit breaks. The artifact actions then refuse again and the cache client keeps to v1.
 
 **Shared cache across multiple runners**
 
@@ -313,6 +345,8 @@ Run one dedicated `gitea-runner cache-server` that all runners point at.
      # external_secret_file: /path/to/secret # secret can also be passed via a file
    ```
 
+Jobs reach the cache server at `external_server`, so when a reverse proxy fronts the server, point `external_server` at the proxy. The cache server itself needs no extra configuration.
+
 Alternatively, mount the same NFS/CIFS share on every runner and point `cache.dir` at it — simpler, but with weaker isolation between repositories.
 
 **S3 / MinIO** — mount object storage as a FUSE filesystem (e.g. [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) or [goofys](https://github.com/kahing/goofys)) and set `cache.dir` to the mount point.
@@ -352,6 +386,12 @@ Both hooks are synchronous and block the job while they run. Either one exiting
 
 See **[docs/job-hooks.md](docs/job-hooks.md)** for the execution order, environment, and platform notes.
 
+#### Local job logs (`log.job.dir`)
+
+Set `log.job.dir` to a path and the runner writes a copy of every task's log there as `<start time>-task-<id>.log`: the rows exactly as Gitea received them, with the same secrets masked and the job's result on the last line. Off by default, and what Gitea shows does not change.
+
+`log.job.retention` (default `168h`) is how long a log is kept, expired ones being deleted as new tasks start, and `log.job.max_size` (default `1GB`) caps one log. Keep `retention` above `runner.timeout` so a long job cannot outlive its own log, and prefer local disk, the file is written while the job runs. Only the runner's own user can read it.
+
 ### Example Deployments
 
 Check out the [examples](examples) directory for sample deployment types.

act/artifactcache/handler.go

@@ -5,6 +5,7 @@
 package artifactcache
 
 import (
+	"cmp"
 	"context"
 	"crypto/hmac"
 	"crypto/rand"
@@ -20,6 +21,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -27,6 +29,7 @@ import (
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
+	"gitea.com/gitea/runner/internal/pkg/disk"
 
 	"github.com/julienschmidt/httprouter"
 	"github.com/sirupsen/logrus"
@@ -59,6 +62,9 @@ type JobCredential struct {
 	// remote runner registers with.
 	Results     string `json:"results"`
 	InsecureTLS bool   `json:"insecure_tls"`
+
+	// PublicURL is this server as a reverse proxy makes the job reach it, not the listen address.
+	PublicURL string `json:"public_url"`
 }
 
 // credEntry holds a registered job's credential along with an active
@@ -100,19 +106,38 @@ type Handler struct {
 
 	credMu sync.RWMutex
 	creds  map[string]*credEntry
+
+	policy Policy
+
+	// freeDisk is a field so tests can drive evictForFreeSpace without a full volume.
+	freeDisk func(string) (uint64, error)
+}
+
+// Options configures a cache server started by StartHandler; the zero value is usable.
+type Options struct {
+	Dir        string
+	OutboundIP string
+	Port       uint16
+
+	// InternalSecret, when non-empty, enables a control-plane API at
+	// /_internal/{register,revoke} that lets a remote runner pre-register the
+	// per-job ACTIONS_RUNTIME_TOKENs it expects this server to honor. The
+	// embedded in-process handler leaves it empty and registers tokens via the
+	// in-process RegisterJob method directly.
+	InternalSecret string
+
+	Policy Policy
+	Logger logrus.FieldLogger
 }
 
 // StartHandler opens the on-disk cache store and starts the HTTP server.
-//
-// internalSecret, when non-empty, enables a control-plane API at
-// /_internal/{register,revoke} that lets a remote runner pre-register the
-// per-job ACTIONS_RUNTIME_TOKENs it expects this server to honor. The
-// embedded in-process handler leaves it empty and registers tokens via the
-// in-process RegisterJob method directly.
-func StartHandler(dir, outboundIP string, port uint16, internalSecret string, logger logrus.FieldLogger) (*Handler, error) {
+func StartHandler(opts Options) (*Handler, error) {
+	dir, logger := opts.Dir, opts.Logger
 	h := &Handler{
 		creds:          make(map[string]*credEntry),
-		internalSecret: internalSecret,
+		internalSecret: opts.InternalSecret,
+		policy:         opts.Policy.withDefaults(),
+		freeDisk:       disk.FreeBytes,
 	}
 
 	if logger == nil {
@@ -142,8 +167,8 @@ func StartHandler(dir, outboundIP string, port uint16, internalSecret string, lo
 	}
 	h.storage = storage
 
-	if outboundIP != "" {
-		h.outboundIP = outboundIP
+	if opts.OutboundIP != "" {
+		h.outboundIP = opts.OutboundIP
 	} else if ip := common.GetOutboundIP(); ip == nil {
 		return nil, errors.New("unable to determine outbound IP address")
 	} else {
@@ -182,7 +207,7 @@ func StartHandler(dir, outboundIP string, port uint16, internalSecret string, lo
 	// can break Docker Desktop variants where the host's outbound IP is not
 	// routable from inside the container network. Authentication is enforced
 	// by the bearer middleware and per-repo scoping, not by reachability.
-	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
+	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", opts.Port))
 	if err != nil {
 		return nil, err
 	}
@@ -212,6 +237,13 @@ func (h *Handler) ExternalURL() string {
 	return fmt.Sprintf("http://%s:%d", h.outboundIP, h.port)
 }
 
+func (h *Handler) baseURL(cred JobCredential) string {
+	if base := strings.TrimRight(cred.PublicURL, "/"); base != "" {
+		return base
+	}
+	return h.ExternalURL()
+}
+
 // RegisterJob makes token a valid bearer credential for cache requests from
 // the given repository and returns a function that removes it. The runner
 // calls this at job start and defers the returned func so that the credential
@@ -359,7 +391,7 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request, _ httprouter.Para
 	}
 	h.responseJSON(w, r, 200, map[string]any{
 		"result":          "hit",
-		"archiveLocation": h.signedArtifactURL(cache.ID, time.Now().Add(artifactURLTTL)),
+		"archiveLocation": h.signedArtifactURL(cred, cache.ID, time.Now().Add(artifactURLTTL)),
 		"cacheKey":        cache.Key,
 	})
 }
@@ -380,6 +412,9 @@ func (h *Handler) lookupCache(db *bolthold.Store, repo string, keys []string, ve
 		_ = db.Delete(cache.ID, cache)
 		return nil, nil //nolint:nilnil // absence is not an error here
 	}
+	// Handing out a download URL counts as access, or eviction could drop the entry between
+	// this call and the GET that follows it.
+	h.touch(db, cache)
 	return cache, nil
 }
 
@@ -517,13 +552,22 @@ func (h *Handler) commitCache(cache *Cache) error {
 	// write real size back to cache, it may be different from the current value when the request doesn't specify it.
 	cache.Size = written
 	cache.Complete = true
+	cache.UsedAt = time.Now().Unix() // a just-written entry counts as accessed, so it cannot be its own eviction victim
 
 	db, err := h.openDB()
 	if err != nil {
 		return err
 	}
 	defer db.Close()
-	return db.Update(cache.ID, cache)
+	if err := db.Update(cache.ID, cache); err != nil {
+		return err
+	}
+	// A commit is the only thing that grows the store, so the only thing that can push the
+	// volume under the floor.
+	h.evictRepo(db, cache.Repo)
+	h.evictTotal(db)
+	h.evictForFreeSpace(db)
+	return nil
 }
 
 // GET /_apis/artifactcache/artifacts/:id
@@ -641,7 +685,7 @@ func (h *Handler) ResultsURL(cred JobCredential) string {
 	if h == nil || cred.Results == "" {
 		return ""
 	}
-	return h.ExternalURL()
+	return h.baseURL(cred)
 }
 
 func (h *Handler) internalRegister(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
@@ -700,16 +744,16 @@ func (h *Handler) computeSignature(purpose string, cacheID, exp int64) string {
 }
 
 // signedURL builds a URL under path that signedAuth accepts for the same purpose.
-func (h *Handler) signedURL(path, purpose string, cacheID uint64, exp time.Time) string {
+func (h *Handler) signedURL(cred JobCredential, path, purpose string, cacheID uint64, exp time.Time) string {
 	expUnix := exp.Unix()
 	q := url.Values{}
 	q.Set("exp", strconv.FormatInt(expUnix, 10))
 	q.Set("sig", h.computeSignature(purpose, int64(cacheID), expUnix))
-	return fmt.Sprintf("%s%s/%d?%s", h.ExternalURL(), path, cacheID, q.Encode())
+	return fmt.Sprintf("%s%s/%d?%s", h.baseURL(cred), path, cacheID, q.Encode())
 }
 
-func (h *Handler) signedArtifactURL(cacheID uint64, exp time.Time) string {
-	return h.signedURL(apiPath+"/artifacts", "", cacheID, exp)
+func (h *Handler) signedArtifactURL(cred JobCredential, cacheID uint64, exp time.Time) string {
+	return h.signedURL(cred, apiPath+"/artifacts", "", cacheID, exp)
 }
 
 // if not found, return (nil, nil) instead of an error.
@@ -811,12 +855,43 @@ func (h *Handler) touchCache(id uint64, requireIncomplete bool) error {
 }
 
 const (
-	keepUsed   = 30 * 24 * time.Hour
-	keepUnused = 7 * 24 * time.Hour
-	keepTemp   = 5 * time.Minute
-	keepOld    = 5 * time.Minute
+	miB = 1024 * 1024
+
+	defaultSweepInterval = time.Hour
+
+	// inUseGrace matches artifactURLTTL so an entry outlives every signed URL still usable
+	// for it, and no sweep cuts off a download in progress.
+	inUseGrace = artifactURLTTL
+
+	// uploadStallTimeout is how long a reservation may sit without a chunk before it counts
+	// as abandoned. Widening it also widens the window for findExactCache to hand a finalize
+	// a stale reservation.
+	uploadStallTimeout = 5 * time.Minute
+
+	defaultMinFreeDisk = 1024 * miB
 )
 
+// Policy bounds what the cache server keeps: a retention window counted from last access,
+// and size limits that evict least recently accessed first. A zero limit is no limit.
+type Policy struct {
+	Retention     time.Duration // Retention removes entries nothing has read or written within this window. Zero keeps them regardless of age.
+	RepoSizeLimit int64         // RepoSizeLimit caps one repository's completed entries in bytes, evicting least recently accessed first.
+	SizeLimit     int64         // SizeLimit caps every repository's completed entries together, in bytes.
+	SweepInterval time.Duration // SweepInterval is the minimum time between two eviction sweeps.
+	MinFreeDisk   int64         // MinFreeDisk is volume headroom the cache will not eat into. Tracks the runner's health-check floor rather than taking a key of its own.
+}
+
+func (p Policy) withDefaults() Policy {
+	// The limits default in config.LoadDefault, so a written 0 means off.
+	if p.MinFreeDisk <= 0 {
+		p.MinFreeDisk = defaultMinFreeDisk
+	}
+	if p.SweepInterval <= 0 {
+		p.SweepInterval = defaultSweepInterval
+	}
+	return p
+}
+
 func (h *Handler) gcCache() {
 	if h.gcing.Load() {
 		return
@@ -826,7 +901,7 @@ func (h *Handler) gcCache() {
 	}
 	defer h.gcing.Store(false)
 
-	if time.Since(h.gcAt) < time.Hour {
+	if time.Since(h.gcAt) < h.policy.SweepInterval {
 		h.logger.Debugf("skip gc: %v", h.gcAt.String())
 		return
 	}
@@ -839,95 +914,208 @@ func (h *Handler) gcCache() {
 	}
 	defer db.Close()
 
-	// Remove the caches which are not completed for a while, they are most likely to be broken.
-	var caches []*Cache
-	if err := db.Find(&caches, bolthold.
-		Where("UsedAt").Lt(time.Now().Add(-keepTemp).Unix()).
-		And("Complete").Eq(false),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
+	h.evictIncomplete(db)
+	h.evictExpired(db)
+	h.evictSuperseded(db)
+	h.evictOversized(db)
+	h.evictForFreeSpace(db)
+}
+
+// evictForFreeSpace bounds the volume itself, so it also covers bytes the cache never
+// accounted for.
+func (h *Handler) evictForFreeSpace(db *bolthold.Store) {
+	free, err := h.freeDisk(h.dir)
+	if err != nil {
+		h.logger.Debugf("free disk check: %v", err) // unsupported platform, treat as unavailable rather than full
+		return
+	}
+	if free >= uint64(h.policy.MinFreeDisk) {
+		return
 	}
 
-	// Remove the old caches which have not been used recently.
-	caches = caches[:0]
-	if err := db.Find(&caches, bolthold.
-		Where("UsedAt").Lt(time.Now().Add(-keepUnused).Unix()),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
+	caches := h.completedByUse(db)
+	total, shortfall := totalSize(caches), h.policy.MinFreeDisk-int64(free)
+	if total <= shortfall {
+		// Say so, or shedding everything and still being short reads as the backstop working.
+		h.logger.Warnf("cache volume is %d MiB short of the free space floor with only %d MiB of cache on it; something else is filling it", shortfall/miB, total/miB)
 	}
+	h.evictTo(db, caches, total-shortfall, "the cache volume")
+}
 
-	// Remove the old caches which are too old.
-	caches = caches[:0]
-	if err := db.Find(&caches, bolthold.
-		Where("CreatedAt").Lt(time.Now().Add(-keepUsed).Unix()),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
+// evictIncomplete removes uploads that stopped part way, which are most likely broken.
+func (h *Handler) evictIncomplete(db *bolthold.Store) {
+	h.sweep(db, bolthold.
+		Where("UsedAt").Lt(time.Now().Add(-uploadStallTimeout).Unix()).
+		And("Complete").Eq(false).
+		Index("UsedAt"))
+}
+
+func (h *Handler) evictExpired(db *bolthold.Store) {
+	if h.policy.Retention <= 0 {
+		return
 	}
+	// Never below inUseGrace, or a short retention would outrun a signed URL already issued.
+	window := max(h.policy.Retention, inUseGrace)
+	h.sweep(db, bolthold.Where("UsedAt").Lt(time.Now().Add(-window).Unix()).Index("UsedAt"))
+}
 
-	// Remove the old caches with the same key and version within the same
-	// repository, keep the latest one. Aggregation must include Repo so two
-	// repos that happen to share a (key, version) do not evict each other —
-	// otherwise per-repo scoping holds for reads but one repo can age
-	// another out after keepOld.
-	// Also keep the olds which have been used recently for a while in case of the cache is still in use.
-	if results, err := db.FindAggregate(
-		&Cache{},
-		bolthold.Where("Complete").Eq(true),
-		"Repo", "Key", "Version",
-	); err != nil {
+// evictSuperseded removes entries a newer one with the same key and version replaced. The
+// aggregation includes Repo so two repos sharing a (key, version) do not evict each other.
+func (h *Handler) evictSuperseded(db *bolthold.Store) {
+	results, err := db.FindAggregate(&Cache{}, bolthold.Where("Complete").Eq(true).Index("Complete"), "Repo", "Key", "Version")
+	if err != nil {
 		h.logger.Warnf("find aggregate caches: %v", err)
-	} else {
-		for _, result := range results {
-			if result.Count() <= 1 {
+		return
+	}
+	var caches []*Cache
+	for _, result := range results {
+		if result.Count() <= 1 {
+			continue
+		}
+		result.Sort("CreatedAt")
+		caches = caches[:0]
+		result.Reduction(&caches)
+		for _, cache := range caches[:len(caches)-1] {
+			if inUse(cache) {
 				continue
 			}
-			result.Sort("CreatedAt")
-			caches = caches[:0]
-			result.Reduction(&caches)
-			for _, cache := range caches[:len(caches)-1] {
-				if time.Since(time.Unix(cache.UsedAt, 0)) < keepOld {
-					// Keep it since it has been used recently, even if it's old.
-					// Or it could break downloading in process.
-					continue
-				}
-				h.storage.Remove(cache.ID)
-				if err := db.Delete(cache.ID, cache); err != nil {
-					h.logger.Warnf("delete cache: %v", err)
-					continue
-				}
-				h.logger.Infof("deleted cache: %+v", cache)
-			}
+			h.deleteCache(db, cache)
 		}
 	}
 }
 
+// evictOversized applies the per-repository limit, then the whole-store one. Only completed
+// entries count, since only those carry a size measured at commit rather than claimed.
+func (h *Handler) evictOversized(db *bolthold.Store) {
+	if h.policy.RepoSizeLimit > 0 {
+		byRepo := make(map[string][]*Cache)
+		for _, cache := range h.completedByUse(db) {
+			byRepo[cache.Repo] = append(byRepo[cache.Repo], cache)
+		}
+		for repo, caches := range byRepo {
+			h.evictTo(db, caches, h.policy.RepoSizeLimit, "repository "+repo)
+		}
+	}
+	h.evictTotal(db)
+}
+
+// evictTotal caps the store as a whole. It re-queries because the per-repo pass may have
+// deleted rows an earlier result still holds.
+func (h *Handler) evictTotal(db *bolthold.Store) {
+	if h.policy.SizeLimit <= 0 {
+		return
+	}
+	h.evictTo(db, h.completedByUse(db), h.policy.SizeLimit, "the cache")
+}
+
+// evictRepo reclaims space when a commit pushes a repo over, rather than at the next sweep.
+func (h *Handler) evictRepo(db *bolthold.Store, repo string) {
+	if h.policy.RepoSizeLimit <= 0 {
+		return
+	}
+	h.evictTo(db, h.cachesByUse(db, bolthold.Where("Repo").Eq(repo).And("Complete").Eq(true).Index("Repo")), h.policy.RepoSizeLimit, "repository "+repo)
+}
+
+// evictTo deletes until caches fit limit. caches must be ordered by UsedAt ascending.
+func (h *Handler) evictTo(db *bolthold.Store, caches []*Cache, limit int64, scope string) {
+	// An entry bigger than the limit never fits, so it goes on its own account instead of
+	// dragging every neighbour out first and then following them next sweep.
+	fits := caches[:0]
+	for _, cache := range caches {
+		if cache.Size <= limit {
+			fits = append(fits, cache)
+			continue
+		}
+		if !inUse(cache) {
+			h.logger.Warnf("cache %q is %d MiB on its own, over the limit for %s; dropping it", cache.Key, cache.Size/miB, scope)
+			h.deleteCache(db, cache)
+		}
+	}
+	caches = fits
+
+	total := totalSize(caches)
+	var freed int64
+	for _, cache := range caches {
+		if total <= limit {
+			break
+		}
+		if inUse(cache) || !h.deleteCache(db, cache) {
+			continue
+		}
+		total -= cache.Size
+		freed += cache.Size
+	}
+	if freed > 0 {
+		h.logger.Warnf("evicted %d MiB from %s, least recently used first", freed/miB, scope)
+	}
+}
+
+// inUse reports whether an entry was read or written recently enough that removing it
+// could break a download in progress.
+func inUse(cache *Cache) bool {
+	return time.Since(time.Unix(cache.UsedAt, 0)) < inUseGrace
+}
+
+// touch stamps UsedAt through the caller's store, a bolt write on the read path. It cannot
+// go through touchCache, which opens its own store and would block on the exclusive lock
+// for as long as the caller holds one.
+func (h *Handler) touch(db *bolthold.Store, cache *Cache) {
+	cache.UsedAt = time.Now().Unix()
+	if err := db.Update(cache.ID, cache); err != nil {
+		h.logger.Warnf("touch cache: %v", err)
+	}
+}
+
+func (h *Handler) sweep(db *bolthold.Store, query *bolthold.Query) {
+	for _, cache := range h.caches(db, query) {
+		h.deleteCache(db, cache)
+	}
+}
+
+func (h *Handler) caches(db *bolthold.Store, query *bolthold.Query) []*Cache {
+	var caches []*Cache
+	if err := db.Find(&caches, query); err != nil {
+		h.logger.Warnf("find caches: %v", err)
+	}
+	return caches
+}
+
+// cachesByUse returns matches least recently accessed first, sorting here rather than with
+// bolthold's SortBy, which reflects over every field it compares.
+func (h *Handler) cachesByUse(db *bolthold.Store, query *bolthold.Query) []*Cache {
+	caches := h.caches(db, query)
+	slices.SortFunc(caches, func(a, b *Cache) int { return cmp.Compare(a.UsedAt, b.UsedAt) })
+	return caches
+}
+
+// completedByUse returns every entry the size limits count, least recently accessed first.
+func (h *Handler) completedByUse(db *bolthold.Store) []*Cache {
+	return h.cachesByUse(db, bolthold.Where("Complete").Eq(true).Index("Complete"))
+}
+
+func totalSize(caches []*Cache) int64 {
+	var total int64
+	for _, cache := range caches {
+		total += cache.Size
+	}
+	return total
+}
+
+// deleteCache drops an entry and its bytes, reporting whether it went fully. The blob goes
+// first, so a failed unlink leaves the row for the next sweep instead of orphaning bytes.
+func (h *Handler) deleteCache(db *bolthold.Store, cache *Cache) bool {
+	if err := h.storage.Remove(cache.ID); err != nil {
+		h.logger.Warnf("remove cache blob: %v", err)
+		return false
+	}
+	if err := db.Delete(cache.ID, cache); err != nil {
+		h.logger.Warnf("delete cache: %v", err)
+		return false
+	}
+	h.logger.Infof("deleted cache: %+v", cache)
+	return true
+}
+
 func (h *Handler) responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	var data []byte

act/artifactcache/handler_test.go

@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"crypto/rand"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -41,16 +42,19 @@ func (b *bearerTransport) RoundTrip(r *http.Request) (*http.Response, error) {
 
 var testClient = &http.Client{Transport: &bearerTransport{token: testToken}}
 
+// testRetention mirrors config.DefaultCacheRetention; Policy has no defaults of its own.
+const testRetention = 7 * 24 * time.Hour
+
 // signArtifactURL builds a signed download URL the same way the server does;
 // tests use it to reach the get handler directly without going through a
 // find/cache-hit round trip.
 func signArtifactURL(h *Handler, id int64) string {
-	return h.signedArtifactURL(uint64(id), time.Now().Add(artifactURLTTL))
+	return h.signedArtifactURL(JobCredential{}, uint64(id), time.Now().Add(artifactURLTTL))
 }
 
 func TestHandler(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	handler.RegisterJob(testToken, JobCredential{Repo: testRepo})
 
@@ -656,7 +660,7 @@ func backdateCache(t *testing.T, handler *Handler, key string, age time.Duration
 	require.NoError(t, db.Update(caches[0].ID, caches[0]))
 }
 
-func uploadCacheNormally(t *testing.T, base, key, version string, content []byte) { //nolint:unparam // pre-existing issue from nektos/act
+func uploadCacheNormally(t *testing.T, base, key, version string, content []byte) {
 	var id uint64
 	{
 		body, err := json.Marshal(&Request{
@@ -722,7 +726,7 @@ func uploadCacheNormally(t *testing.T, base, key, version string, content []byte
 
 func TestHandler_gcCache(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir, Policy: Policy{Retention: testRetention}})
 	require.NoError(t, err)
 
 	defer func() {
@@ -752,8 +756,8 @@ func TestHandler_gcCache(t *testing.T) {
 				Key:       "test_key_2",
 				Version:   "test_version",
 				Complete:  false,
-				UsedAt:    now.Add(-(keepTemp + time.Second)).Unix(),
-				CreatedAt: now.Add(-(keepTemp + time.Hour)).Unix(),
+				UsedAt:    now.Add(-(inUseGrace + time.Second)).Unix(),
+				CreatedAt: now.Add(-(inUseGrace + time.Hour)).Unix(),
 			},
 			Kept: false,
 		},
@@ -763,21 +767,21 @@ func TestHandler_gcCache(t *testing.T) {
 				Key:       "test_key_3",
 				Version:   "test_version",
 				Complete:  true,
-				UsedAt:    now.Add(-(keepUnused + time.Second)).Unix(),
-				CreatedAt: now.Add(-(keepUnused + time.Hour)).Unix(),
+				UsedAt:    now.Add(-(testRetention + time.Second)).Unix(),
+				CreatedAt: now.Add(-(testRetention + time.Hour)).Unix(),
 			},
 			Kept: false,
 		},
 		{
-			// should be removed, since it's used but too old.
+			// should be kept, since age alone does not retire an entry that is still used.
 			Cache: &Cache{
 				Key:       "test_key_3",
 				Version:   "test_version",
 				Complete:  true,
 				UsedAt:    now.Unix(),
-				CreatedAt: now.Add(-(keepUsed + time.Second)).Unix(),
+				CreatedAt: now.Add(-365 * 24 * time.Hour).Unix(),
 			},
-			Kept: false,
+			Kept: true,
 		},
 		{
 			// should be kept, since it has a newer edition but be used recently.
@@ -785,7 +789,7 @@ func TestHandler_gcCache(t *testing.T) {
 				Key:       "test_key_1",
 				Version:   "test_version",
 				Complete:  true,
-				UsedAt:    now.Add(-(keepOld - time.Minute)).Unix(),
+				UsedAt:    now.Add(-(inUseGrace - time.Minute)).Unix(),
 				CreatedAt: now.Add(-(time.Hour + time.Second)).Unix(),
 			},
 			Kept: true,
@@ -796,7 +800,7 @@ func TestHandler_gcCache(t *testing.T) {
 				Key:       "test_key_1",
 				Version:   "test_version",
 				Complete:  true,
-				UsedAt:    now.Add(-(keepOld + time.Second)).Unix(),
+				UsedAt:    now.Add(-(inUseGrace + time.Second)).Unix(),
 				CreatedAt: now.Add(-(time.Hour + time.Second)).Unix(),
 			},
 			Kept: false,
@@ -829,11 +833,265 @@ func TestHandler_gcCache(t *testing.T) {
 	require.NoError(t, db.Close())
 }
 
+// TestHandler_evictPolicy covers the non-default policies; TestHandler_gcCache covers the
+// defaults across every pass.
+func TestHandler_evictPolicy(t *testing.T) {
+	now := time.Now()
+	stale := func(d time.Duration) int64 { return now.Add(-d).Unix() }
+	mib := func(n int64) int64 { return n * miB }
+
+	for _, tc := range []struct {
+		name    string
+		policy  Policy
+		entries []*Cache
+		kept    []string
+	}{
+		{
+			name:   "a zero retention keeps an entry nothing has touched",
+			policy: Policy{Retention: 0},
+			entries: []*Cache{
+				{Key: "idle", UsedAt: stale(testRetention + time.Hour)},
+			},
+			kept: []string{"idle"},
+		},
+		{
+			name:   "evicts least recently accessed until the repository fits",
+			policy: Policy{RepoSizeLimit: mib(10)},
+			entries: []*Cache{
+				{Repo: "o/a", Key: "oldest", Size: mib(4), UsedAt: stale(3 * time.Hour)},
+				{Repo: "o/a", Key: "middle", Size: mib(4), UsedAt: stale(2 * time.Hour)},
+				{Repo: "o/a", Key: "newest", Size: mib(4), UsedAt: stale(time.Hour)},
+			},
+			kept: []string{"middle", "newest"},
+		},
+		{
+			name:   "spares entries that may still be downloading",
+			policy: Policy{RepoSizeLimit: mib(10)},
+			entries: []*Cache{
+				{Repo: "o/a", Key: "fresh_1", Size: mib(6), UsedAt: stale(time.Minute)},
+				{Repo: "o/a", Key: "fresh_2", Size: mib(6), UsedAt: stale(time.Minute)},
+			},
+			kept: []string{"fresh_1", "fresh_2"},
+		},
+		{
+			name:   "one repository over its limit leaves another alone",
+			policy: Policy{RepoSizeLimit: mib(10)},
+			entries: []*Cache{
+				{Repo: "o/a", Key: "a_old", Size: mib(6), UsedAt: stale(3 * time.Hour)},
+				{Repo: "o/a", Key: "a_new", Size: mib(6), UsedAt: stale(time.Hour)},
+				{Repo: "o/b", Key: "b_old", Size: mib(6), UsedAt: stale(4 * time.Hour)},
+			},
+			kept: []string{"a_new", "b_old"},
+		},
+		{
+			name:   "the total limit evicts across repositories once each fits its own",
+			policy: Policy{RepoSizeLimit: mib(10), SizeLimit: mib(12)},
+			entries: []*Cache{
+				{Repo: "o/a", Key: "a_old", Size: mib(8), UsedAt: stale(3 * time.Hour)},
+				{Repo: "o/b", Key: "b_new", Size: mib(8), UsedAt: stale(time.Hour)},
+			},
+			kept: []string{"b_new"},
+		},
+		{
+			// Retention below inUseGrace would otherwise drop an entry whose signed URL a job
+			// is still holding.
+			name:   "a retention shorter than the grace still spares a just-served entry",
+			policy: Policy{Retention: time.Minute},
+			entries: []*Cache{
+				{Key: "just_served", UsedAt: stale(2 * time.Minute)},
+				{Key: "idle", UsedAt: stale(time.Hour)},
+			},
+			kept: []string{"just_served"},
+		},
+		{
+			name:   "an entry over the limit goes without emptying the repository",
+			policy: Policy{RepoSizeLimit: mib(10)},
+			entries: []*Cache{
+				{Repo: "o/a", Key: "keeps", Size: mib(4), UsedAt: stale(3 * time.Hour)},
+				{Repo: "o/a", Key: "huge", Size: mib(20), UsedAt: stale(2 * time.Hour)},
+			},
+			kept: []string{"keeps"},
+		},
+		{
+			name:   "a zero limit keeps everything",
+			policy: Policy{RepoSizeLimit: 0},
+			entries: []*Cache{
+				{Repo: "o/a", Key: "huge_1", Size: mib(100), UsedAt: stale(3 * time.Hour)},
+				{Repo: "o/a", Key: "huge_2", Size: mib(100), UsedAt: stale(2 * time.Hour)},
+			},
+			kept: []string{"huge_1", "huge_2"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			for _, e := range tc.entries {
+				e.Complete = true // only completed entries carry a measured size, so only they count
+			}
+			handler := newTestHandler(t, tc.policy, tc.entries...)
+			handler.gcAt = time.Time{} // ensure gcCache will not skip
+			handler.gcCache()
+			assert.ElementsMatch(t, tc.kept, keptKeys(t, handler, tc.entries))
+		})
+	}
+}
+
+// TestHandler_evictForFreeSpace proves the volume backstop sheds only what it must, and only
+// when the disk is actually short.
+func TestHandler_evictForFreeSpace(t *testing.T) {
+	free := func(n int64) func(string) (uint64, error) {
+		return func(string) (uint64, error) { return uint64(n), nil }
+	}
+
+	for _, tc := range []struct {
+		name     string
+		freeDisk func(string) (uint64, error)
+		kept     []string
+	}{
+		{"ample free space evicts nothing", free(defaultMinFreeDisk), []string{"oldest", "middle", "newest"}},
+		{"a small shortfall sheds one entry", free(defaultMinFreeDisk - 4*miB), []string{"middle", "newest"}},
+		{"a shortfall the cache cannot cover sheds all of it", free(0), nil},
+		{
+			"an unreadable volume is treated as unavailable, not as full",
+			func(string) (uint64, error) { return 0, errors.New("unsupported") },
+			[]string{"oldest", "middle", "newest"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			now := time.Now()
+			entries := []*Cache{
+				{Key: "oldest", Complete: true, Size: 4 * miB, UsedAt: now.Add(-3 * time.Hour).Unix()},
+				{Key: "middle", Complete: true, Size: 4 * miB, UsedAt: now.Add(-2 * time.Hour).Unix()},
+				{Key: "newest", Complete: true, Size: 4 * miB, UsedAt: now.Add(-time.Hour).Unix()},
+			}
+			handler := newTestHandler(t, Policy{}, entries...)
+			handler.freeDisk = tc.freeDisk
+
+			db, err := handler.openDB()
+			require.NoError(t, err)
+			handler.evictForFreeSpace(db)
+			require.NoError(t, db.Close())
+
+			assert.ElementsMatch(t, tc.kept, keptKeys(t, handler, entries))
+		})
+	}
+}
+
+// TestHandler_SweepKeepsEntryWhenBlobSurvives proves a failed unlink leaves the row in place,
+// so the next sweep retries rather than orphaning bytes no row points at and no limit counts.
+func TestHandler_SweepKeepsEntryWhenBlobSurvives(t *testing.T) {
+	cache := &Cache{Key: "stuck", Complete: true, UsedAt: time.Now().Add(-(testRetention + time.Hour)).Unix()}
+	handler := newTestHandler(t, Policy{Retention: testRetention}, cache)
+
+	// A non-empty directory where the blob belongs makes os.Remove fail on every platform.
+	blob := handler.storage.filename(cache.ID)
+	require.NoError(t, os.MkdirAll(blob, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(blob, "held"), []byte("x"), 0o600))
+
+	handler.gcAt = time.Time{}
+	handler.gcCache()
+
+	assert.Equal(t, []string{"stuck"}, keptKeys(t, handler, []*Cache{cache}), "the entry must outlive a blob that could not be removed")
+}
+
+// TestHandler_FindProtectsFromEviction covers the window between a find handing out a signed
+// download URL and the GET that redeems it: the entry promised to a job must not be the next
+// eviction victim just because its last access predates the find.
+func TestHandler_FindProtectsFromEviction(t *testing.T) {
+	// 12 MiB against a 10 MiB limit, so exactly one entry has to go.
+	wanted := &Cache{Repo: testRepo, Key: "wanted", Version: "v", Complete: true, Size: 4 * miB, UsedAt: time.Now().Add(-3 * time.Hour).Unix()}
+	other := &Cache{Repo: testRepo, Key: "other", Version: "v", Complete: true, Size: 4 * miB, UsedAt: time.Now().Add(-2 * time.Hour).Unix()}
+	newest := &Cache{Repo: testRepo, Key: "newest", Version: "v", Complete: true, Size: 4 * miB, UsedAt: time.Now().Add(-time.Hour).Unix()}
+	handler := newTestHandler(t, Policy{RepoSizeLimit: 10 * miB}, wanted, other, newest)
+	writeBlob(t, handler, wanted.ID) // find only reports a hit when the blob is on disk
+
+	resp, err := testClient.Get(fmt.Sprintf("%s%s/cache?keys=wanted&version=v", handler.ExternalURL(), apiPath))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, 200, resp.StatusCode)
+
+	// Evict directly: the request above kicked off an async gcCache, and writing gcAt here
+	// to drive gcCache would race its read.
+	db, err := handler.openDB()
+	require.NoError(t, err)
+	defer func() { require.NoError(t, db.Close()) }()
+	handler.evictOversized(db)
+
+	require.NoError(t, db.Get(wanted.ID, &Cache{}), "the entry just promised to a job must survive")
+	assert.ErrorIs(t, db.Get(other.ID, &Cache{}), bolthold.ErrNotFound, "the next least recently used goes instead")
+}
+
+// TestHandler_evictOnCommit proves a repository that goes over its limit gets space back at
+// once, rather than waiting out the collection interval.
+func TestHandler_evictOnCommit(t *testing.T) {
+	full := &Cache{Repo: testRepo, Key: "full", Version: "v", Complete: true, Size: 4 * miB, UsedAt: time.Now().Add(-time.Hour).Unix()}
+	handler := newTestHandler(t, Policy{RepoSizeLimit: 4 * miB}, full)
+
+	// StartHandler already stamped gcAt, so the periodic sweep stays rate-limited out and
+	// only the commit path can evict.
+	uploadCacheNormally(t, handler.ExternalURL()+apiPath, "new", "v", []byte("some content"))
+
+	assert.Empty(t, keptKeys(t, handler, []*Cache{full}))
+}
+
+func TestHandler_gcCacheInterval(t *testing.T) {
+	cache := &Cache{Key: "temp", UsedAt: time.Now().Add(-time.Hour).Unix()}
+	// Half the default, so a sweep 45m ago is still inside the default but past this one.
+	handler := newTestHandler(t, Policy{SweepInterval: 30 * time.Minute}, cache)
+
+	handler.gcAt = time.Now().Add(-45 * time.Minute) // past the configured interval, still inside the default
+	handler.gcCache()
+	assert.Empty(t, keptKeys(t, handler, []*Cache{cache}))
+}
+
+// newTestHandler starts a handler with testToken registered, seeded with entries.
+func newTestHandler(t *testing.T, policy Policy, entries ...*Cache) *Handler {
+	t.Helper()
+	handler, err := StartHandler(Options{
+		Dir:        filepath.Join(t.TempDir(), "artifactcache"),
+		OutboundIP: "127.0.0.1",
+		Policy:     policy,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, handler.Close()) })
+	handler.RegisterJob(testToken, JobCredential{Repo: testRepo})
+
+	db, err := handler.openDB()
+	require.NoError(t, err)
+	for _, e := range entries {
+		require.NoError(t, insertCache(db, e))
+	}
+	require.NoError(t, db.Close())
+	return handler
+}
+
+// keptKeys reports which of entries are still in the store.
+func keptKeys(t *testing.T, handler *Handler, entries []*Cache) []string {
+	t.Helper()
+	db, err := handler.openDB()
+	require.NoError(t, err)
+	defer func() { require.NoError(t, db.Close()) }()
+
+	var kept []string
+	for _, e := range entries {
+		if err := db.Get(e.ID, &Cache{}); err == nil {
+			kept = append(kept, e.Key)
+		}
+	}
+	return kept
+}
+
+// writeBlob gives an entry the on-disk bytes that find and get require.
+func writeBlob(t *testing.T, handler *Handler, id uint64) {
+	t.Helper()
+	require.NoError(t, handler.storage.Write(id, 0, strings.NewReader("a")))
+	_, err := handler.storage.Commit(id, 1)
+	require.NoError(t, err)
+}
+
 // TestHandler_RejectsMissingBearer covers the advisory's root cause:
 // unauthenticated access to management endpoints is now refused with 401.
 func TestHandler_RejectsMissingBearer(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 
@@ -866,7 +1124,7 @@ func TestHandler_RejectsMissingBearer(t *testing.T) {
 // accepted after RegisterJob; stale/forged tokens cannot be replayed.
 func TestHandler_RejectsUnknownBearer(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 
@@ -886,7 +1144,7 @@ func TestHandler_RejectsUnknownBearer(t *testing.T) {
 // working the moment the job ends instead of living for the runner's lifetime.
 func TestHandler_UnregisterRevokes(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 
@@ -917,7 +1175,7 @@ func TestHandler_UnregisterRevokes(t *testing.T) {
 // invisible to queries scoped to repoB.
 func TestHandler_CrossRepoIsolation(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 	handler.RegisterJob("token-a", JobCredential{Repo: "owner/repoA"})
@@ -983,7 +1241,7 @@ func TestHandler_CrossRepoIsolation(t *testing.T) {
 // working after artifactURLTTL even if the bearer token is still registered.
 func TestHandler_ArtifactSignature(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 	handler.RegisterJob(testToken, JobCredential{Repo: testRepo})
@@ -998,7 +1256,7 @@ func TestHandler_ArtifactSignature(t *testing.T) {
 	})
 
 	t.Run("tampered signature", func(t *testing.T) {
-		good := handler.signedArtifactURL(1, time.Now().Add(artifactURLTTL))
+		good := signArtifactURL(handler, 1)
 		bad := good[:len(good)-4] + "dead"
 		resp, err := testClient.Get(bad)
 		require.NoError(t, err)
@@ -1007,7 +1265,7 @@ func TestHandler_ArtifactSignature(t *testing.T) {
 	})
 
 	t.Run("expired signature", func(t *testing.T) {
-		expired := handler.signedArtifactURL(1, time.Now().Add(-time.Second))
+		expired := handler.signedArtifactURL(JobCredential{}, 1, time.Now().Add(-time.Second))
 		resp, err := testClient.Get(expired)
 		require.NoError(t, err)
 		resp.Body.Close()
@@ -1016,10 +1274,10 @@ func TestHandler_ArtifactSignature(t *testing.T) {
 
 	t.Run("signature from a different server", func(t *testing.T) {
 		dir2 := filepath.Join(t.TempDir(), "artifactcache2")
-		other, err := StartHandler(dir2, "", 0, "", nil)
+		other, err := StartHandler(Options{Dir: dir2})
 		require.NoError(t, err)
 		defer other.Close()
-		otherURL := other.signedArtifactURL(1, time.Now().Add(artifactURLTTL))
+		otherURL := signArtifactURL(other, 1)
 		// Rewrite the host so the request still lands on our handler, but
 		// the signature was computed with a different secret.
 		parts := strings.SplitN(otherURL, apiPath, 2)
@@ -1038,13 +1296,13 @@ func TestHandler_ArtifactSignature(t *testing.T) {
 func TestHandler_SecretPersistsAcrossRestarts(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
 
-	first, err := StartHandler(dir, "127.0.0.1", 0, "", nil)
+	first, err := StartHandler(Options{Dir: dir, OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	exp := time.Now().Add(artifactURLTTL).Unix()
 	sig := first.computeSignature("", 42, exp)
 	require.NoError(t, first.Close())
 
-	second, err := StartHandler(dir, "127.0.0.1", 0, "", nil)
+	second, err := StartHandler(Options{Dir: dir, OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	defer second.Close()
 
@@ -1056,7 +1314,7 @@ func TestHandler_SecretPersistsAcrossRestarts(t *testing.T) {
 // the auth refactor.
 func TestHandler_ArtifactSignatureDownload(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 	handler.RegisterJob(testToken, JobCredential{Repo: testRepo})
@@ -1096,7 +1354,7 @@ func TestHandler_ArtifactSignatureDownload(t *testing.T) {
 // (restart mid-task, retry), which must not kill the live job's auth.
 func TestHandler_RegisterJob_RefCounted(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 
@@ -1125,10 +1383,10 @@ func TestHandler_RegisterJob_RefCounted(t *testing.T) {
 
 // TestHandler_GC_PerRepoDedup ensures duplicate-pruning does not evict
 // another repo's entry. Two repos reserve the same (key, version); after the
-// keepOld window, GC must keep the one from each repo.
+// inUseGrace window, GC must keep the one from each repo.
 func TestHandler_GC_PerRepoDedup(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 	handler.RegisterJob("tok-a", JobCredential{Repo: "owner/repoA"})
@@ -1142,7 +1400,7 @@ func TestHandler_GC_PerRepoDedup(t *testing.T) {
 	db, err := handler.openDB()
 	require.NoError(t, err)
 	now := time.Now().Unix()
-	stale := time.Now().Add(-keepOld - time.Minute).Unix()
+	stale := time.Now().Add(-inUseGrace - time.Minute).Unix()
 	a := &Cache{Repo: "owner/repoA", Key: key, Version: version, Complete: true, CreatedAt: stale, UsedAt: stale, Size: 1}
 	b := &Cache{Repo: "owner/repoB", Key: key, Version: version, Complete: true, CreatedAt: now, UsedAt: now, Size: 1}
 	require.NoError(t, insertCache(db, a))
@@ -1179,7 +1437,7 @@ func TestHandler_GC_PerRepoDedup(t *testing.T) {
 // register/revoke when the feature is off.
 func TestHandler_InternalAPI_Disabled(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(dir, "", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: dir})
 	require.NoError(t, err)
 	defer handler.Close()
 
@@ -1197,7 +1455,7 @@ func TestHandler_InternalAPI_Disabled(t *testing.T) {
 func TestHandler_InternalAPI_AuthAndUsage(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
 	const secret = "internal-secret"
-	handler, err := StartHandler(dir, "", 0, secret, nil)
+	handler, err := StartHandler(Options{Dir: dir, InternalSecret: secret})
 	require.NoError(t, err)
 	defer handler.Close()
 

act/artifactcache/handler_v2.go

@@ -77,6 +77,7 @@ func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request, _ h
 		h.twirpError(w, r, twirpInternal, err)
 		return
 	} else if existing != nil {
+		h.touch(db, existing) // the client skips the upload, so this is the only sign the entry is still in use
 		h.twirpNotOK(w, r)
 		return
 	}
@@ -97,7 +98,7 @@ func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request, _ h
 
 	h.responseJSON(w, r, http.StatusOK, map[string]any{
 		"ok":                true,
-		"signed_upload_url": h.signedURL(blobPath, blobUploadPurpose, cache.ID, time.Now().Add(blobUploadURLTTL)),
+		"signed_upload_url": h.signedURL(cred, blobPath, blobUploadPurpose, cache.ID, time.Now().Add(blobUploadURLTTL)),
 	})
 }
 
@@ -168,7 +169,7 @@ func (h *Handler) v2GetCacheEntryDownloadURL(w http.ResponseWriter, r *http.Requ
 
 	h.responseJSON(w, r, http.StatusOK, map[string]any{
 		"ok":                  true,
-		"signed_download_url": h.signedArtifactURL(cache.ID, time.Now().Add(artifactURLTTL)),
+		"signed_download_url": h.signedArtifactURL(cred, cache.ID, time.Now().Add(artifactURLTTL)),
 		"matched_key":         cache.Key,
 	})
 }

act/artifactcache/handler_v2_test.go

@@ -10,8 +10,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"path/filepath"
 	"strconv"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -66,16 +66,6 @@ func getURL(t *testing.T, url string) []byte {
 	return body
 }
 
-func startTestHandler(t *testing.T) *Handler {
-	t.Helper()
-
-	handler, err := StartHandler(filepath.Join(t.TempDir(), "artifactcache"), "127.0.0.1", 0, "", nil)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = handler.Close() })
-	handler.RegisterJob(testToken, JobCredential{Repo: testRepo})
-	return handler
-}
-
 // saveV2 runs the reserve/upload/finalize sequence and returns the finalize response along
 // with the upload URL it used.
 func saveV2(t *testing.T, handler *Handler, key, version string, content []byte) (finalized map[string]any, uploadURL string) {
@@ -97,7 +87,7 @@ func saveV2(t *testing.T, handler *Handler, key, version string, content []byte)
 // URLs it is handed: unsigned requests are refused, an upload URL cannot be replayed to read
 // or to replace a finalized entry.
 func TestCacheServiceV2RoundTrip(t *testing.T) {
-	handler := startTestHandler(t)
+	handler := newTestHandler(t, Policy{})
 	content := []byte("the cached archive")
 
 	unsigned := fmt.Sprintf("%s%s/1", handler.ExternalURL(), blobPath)
@@ -126,7 +116,7 @@ func TestCacheServiceV2RoundTrip(t *testing.T) {
 // A large archive is staged as blocks and only put in order by the final block list, so
 // blocks that arrive out of order must still be assembled the way the client asked.
 func TestCacheServiceV2BlockUpload(t *testing.T) {
-	handler := startTestHandler(t)
+	handler := newTestHandler(t, Policy{})
 
 	created := v2Call(t, handler, testClient, "CreateCacheEntry", map[string]any{"key": "blocks", "version": "v1"})
 	uploadURL, _ := created["signed_upload_url"].(string)
@@ -163,7 +153,7 @@ func TestCacheServiceV2BlockUpload(t *testing.T) {
 }
 
 func TestCacheServiceV2Lookups(t *testing.T) {
-	handler := startTestHandler(t)
+	handler := newTestHandler(t, Policy{})
 	saved, _ := saveV2(t, handler, "deps-abc", "v1", []byte("x"))
 	require.Equal(t, true, saved["ok"])
 
@@ -198,6 +188,18 @@ func TestCacheServiceV2Lookups(t *testing.T) {
 		assert.NotEmpty(t, reserved["signed_upload_url"])
 	})
 
+	t.Run("a proxied job is handed the address its runner registered", func(t *testing.T) {
+		const proxy = "https://cache.example.invalid"
+		handler.RegisterJob("proxied", JobCredential{Repo: testRepo, PublicURL: proxy + "/"})
+		client := &http.Client{Transport: &bearerTransport{token: "proxied"}}
+
+		created := v2Call(t, handler, client, "CreateCacheEntry", map[string]any{"key": "proxied-key", "version": "v1"})
+		assert.True(t, strings.HasPrefix(created["signed_upload_url"].(string), proxy+blobPath+"/"))
+
+		got := v2Call(t, handler, client, "GetCacheEntryDownloadURL", map[string]any{"key": "deps-abc", "version": "v1"})
+		assert.True(t, strings.HasPrefix(got["signed_download_url"].(string), proxy+apiPath+"/artifacts/"))
+	})
+
 	t.Run("finalizing without a reservation is not ok", func(t *testing.T) {
 		got := v2Call(t, handler, testClient, "FinalizeCacheEntryUpload", map[string]any{
 			"key": "never-reserved", "version": "v1", "size_bytes": 1,

act/artifactcache/results_test.go

@@ -24,7 +24,7 @@ func TestFrontResultsService(t *testing.T) {
 	}))
 	defer gitea.Close()
 
-	handler, err := StartHandler(t.TempDir(), "127.0.0.1", 0, "", nil)
+	handler, err := StartHandler(Options{Dir: t.TempDir(), OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	defer handler.Close()
 	const token = "forward-token"

act/artifactcache/storage.go

@@ -143,9 +143,13 @@ func (s *Storage) Serve(w http.ResponseWriter, r *http.Request, id uint64) {
 	http.ServeFile(w, r, name)
 }
 
-func (s *Storage) Remove(id uint64) {
-	_ = os.Remove(s.filename(id))
-	_ = os.RemoveAll(s.tempDir(id))
+// Remove deletes an entry's blob and any staged parts. It reports failure so the caller can
+// keep the entry and retry, rather than dropping the only reference to bytes on disk.
+func (s *Storage) Remove(id uint64) error {
+	if err := os.Remove(s.filename(id)); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return os.RemoveAll(s.tempDir(id))
 }
 
 func (s *Storage) filename(id uint64) string {

act/common/cartesian.go

@@ -1,60 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import "slices"
-
-// CartesianProduct takes map of lists and returns list of unique tuples
-func CartesianProduct(mapOfLists map[string][]any) []map[string]any {
-	listNames := make([]string, 0)
-	lists := make([][]any, 0)
-	for k, v := range mapOfLists {
-		listNames = append(listNames, k)
-		lists = append(lists, v)
-	}
-
-	listCart := cartN(lists...)
-
-	rtn := make([]map[string]any, 0)
-	for _, list := range listCart {
-		vMap := make(map[string]any)
-		for i, v := range list {
-			vMap[listNames[i]] = v
-		}
-		rtn = append(rtn, vMap)
-	}
-	return rtn
-}
-
-func cartN(a ...[]any) [][]any {
-	c := 1
-	for _, a := range a {
-		c *= len(a)
-	}
-	if c == 0 || len(a) == 0 {
-		return nil
-	}
-	p := make([][]any, c)
-	b := make([]any, c*len(a))
-	n := make([]int, len(a))
-	s := 0
-	for i := range p {
-		e := s + len(a)
-		pi := b[s:e]
-		p[i] = pi
-		s = e
-		for j, n := range n {
-			pi[j] = a[j][n]
-		}
-		for j := range slices.Backward(n) {
-			n[j]++
-			if n[j] < len(a[j]) {
-				break
-			}
-			n[j] = 0
-		}
-	}
-	return p
-}

act/common/cartesian_test.go

@@ -1,43 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCartesianProduct(t *testing.T) {
-	assert := assert.New(t)
-	input := map[string][]any{
-		"foo": {1, 2, 3, 4},
-		"bar": {"a", "b", "c"},
-		"baz": {false, true},
-	}
-
-	output := CartesianProduct(input)
-	assert.Len(output, 24)
-
-	for _, v := range output {
-		assert.Len(v, 3)
-
-		assert.Contains(v, "foo")
-		assert.Contains(v, "bar")
-		assert.Contains(v, "baz")
-	}
-
-	input = map[string][]any{
-		"foo": {1, 2, 3, 4},
-		"bar": {},
-		"baz": {false, true},
-	}
-	output = CartesianProduct(input)
-	assert.Empty(output)
-
-	input = map[string][]any{}
-	output = CartesianProduct(input)
-	assert.Empty(output)
-}

act/common/git/git.go

@@ -345,6 +345,16 @@ func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.Pu
 	return fetchOptions, pullOptions
 }
 
+// staleRefreshErr reports why a failed refresh must abort: the resolve and
+// checkout that follow are local and succeed on a cancelled context, which
+// would hand back the cached revision as if it were fresh.
+func staleRefreshErr(ctx context.Context, err error) error {
+	if err == nil || errors.Is(err, git.NoErrAlreadyUpToDate) {
+		return nil
+	}
+	return ctx.Err()
+}
+
 // NewGitCloneExecutor creates an executor to clone git repos
 func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
@@ -385,7 +395,7 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 		}
 
 		if !isOfflineMode {
-			err = r.Fetch(&fetchOptions)
+			err = r.FetchContext(ctx, &fetchOptions)
 			if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
 				return err
 			}
@@ -454,9 +464,12 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 		switch {
 		case !isOfflineMode && !shallow:
 			// In shallow mode the depth-limited fetch above already advanced the ref.
-			if err = w.Pull(&pullOptions); err != nil && err != git.NoErrAlreadyUpToDate {
+			if err = w.PullContext(ctx, &pullOptions); err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
 				logger.Debugf("Unable to pull %s: %v", refName, err)
 			}
+			if err := staleRefreshErr(ctx, err); err != nil {
+				return err
+			}
 		case isOfflineMode && reused:
 			reusedMsg = " (reused in offline mode)"
 		}

act/common/git/git_test.go

@@ -6,18 +6,24 @@ package git
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"syscall"
 	"testing"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 
+	gogit "github.com/go-git/go-git/v5"
+	gogitconfig "github.com/go-git/go-git/v5/config"
 	log "github.com/sirupsen/logrus"
 	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
@@ -610,3 +616,55 @@ func TestAcquireCloneLock(t *testing.T) {
 		}
 	})
 }
+
+// An unresponsive remote must not pin a job: the refresh has to be interruptible.
+func TestNewGitCloneExecutorFetchHonoursContext(t *testing.T) {
+	block := make(chan struct{})
+	reached := make(chan struct{})
+	var once sync.Once
+	server := httptest.NewServer(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
+		once.Do(func() { close(reached) })
+		<-block
+	}))
+	t.Cleanup(func() {
+		close(block)
+		server.Close()
+	})
+
+	dir := filepath.Join(t.TempDir(), "cached-action")
+	repo, err := gogit.PlainInit(dir, false)
+	require.NoError(t, err)
+	_, err = repo.CreateRemote(&gogitconfig.RemoteConfig{Name: "origin", URLs: []string{server.URL}})
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	done := make(chan error, 1)
+	go func() {
+		done <- NewGitCloneExecutor(NewGitCloneExecutorInput{URL: server.URL, Ref: "main", Dir: dir})(ctx)
+	}()
+
+	select {
+	case <-reached:
+	case <-time.After(10 * time.Second):
+		t.Fatal("the executor never reached the remote")
+	}
+	cancel()
+
+	select {
+	case err := <-done:
+		require.Error(t, err)
+	case <-time.After(10 * time.Second):
+		t.Fatal("fetch ignored context cancellation")
+	}
+}
+
+func TestStaleRefreshErr(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	require.NoError(t, staleRefreshErr(ctx, errors.New("remote hung up")))
+
+	cancel()
+	require.ErrorIs(t, staleRefreshErr(ctx, errors.New("remote hung up")), context.Canceled)
+	require.NoError(t, staleRefreshErr(ctx, gogit.NoErrAlreadyUpToDate))
+}

act/container/docker_run.go

@@ -14,7 +14,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path"
 	"path/filepath"
 	"regexp"
 	"runtime"
@@ -89,14 +88,14 @@ func (cr *containerReference) connectToNetwork(name string, aliases []string) co
 	}
 }
 
-// supportsContainerImagePlatform returns true if the underlying Docker server
-// API version is 1.41 and beyond
-func supportsContainerImagePlatform(ctx context.Context, cli client.APIClient) bool {
+// supportsContainerImagePlatform reports whether the Docker server API version
+// is 1.41 and beyond
+func supportsContainerImagePlatform(ctx context.Context, cli client.APIClient) (bool, error) {
 	ver, err := cli.ServerVersion(ctx, client.ServerVersionOptions{})
 	if err != nil {
-		common.Logger(ctx).Panicf("Failed to get Docker API Version: %s", err)
+		return false, fmt.Errorf("get docker API version: %w", err)
 	}
-	return versions.GreaterThanOrEqualTo(ver.APIVersion, "1.41")
+	return versions.GreaterThanOrEqualTo(ver.APIVersion, "1.41"), nil
 }
 
 func (cr *containerReference) Create(capAdd, capDrop []string) common.Executor {
@@ -683,11 +682,17 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 		}
 
 		var platSpecs *specs.Platform
-		if cr.input.Platform != "" && supportsContainerImagePlatform(ctx, cr.cli) {
-			platSpecs, err = parsePlatform(cr.input.Platform)
+		if cr.input.Platform != "" {
+			// Dropping the platform silently would build for the host arch.
+			supported, err := supportsContainerImagePlatform(ctx, cr.cli)
 			if err != nil {
 				return err
 			}
+			if supported {
+				if platSpecs, err = parsePlatform(cr.input.Platform); err != nil {
+					return err
+				}
+			}
 		}
 
 		hostConfig := &container.HostConfig{
@@ -939,59 +944,24 @@ func (cr *containerReference) waitForCommand(ctx context.Context, resp client.Hi
 	}
 }
 
-// mkdirInContainer creates containerPath and returns it with the symlinked components
-// replaced by the targets the daemon reports for them. Docker 29.7 rejects tar entries
-// traversing a symlink to an absolute target, like the "/var/run" of most images, with
-// "path escapes from parent", and not every daemon creates the implied parents of a
-// directory entry, so one entry per missing component is extracted at the deepest
-// existing ancestor.
-// WORKAROUND: https://github.com/moby/moby/issues/53258
-func (cr *containerReference) mkdirInContainer(ctx context.Context, containerPath string) (string, error) {
-	parts := strings.Split(strings.Trim(path.Clean(containerPath), "/"), "/")
-	existing := "/"
-	for i, part := range parts {
-		if part == "" {
-			return existing, nil
-		}
-		stat, err := cr.cli.ContainerStatPath(ctx, cr.id, client.ContainerStatPathOptions{Path: path.Join(existing, part)})
-		if err != nil {
-			// nothing below exists either, so create the remaining components
-			return path.Join(existing, path.Join(parts[i:]...)), cr.mkdirEntries(ctx, existing, parts[i:])
-		}
-		existing = path.Join(existing, part)
-		if target := stat.Stat.LinkTarget; target != "" {
-			if !path.IsAbs(target) {
-				target = path.Join(path.Dir(existing), target)
-			}
-			existing = target
-		}
-	}
-	return existing, nil
-}
-
-func (cr *containerReference) mkdirEntries(ctx context.Context, destPath string, missing []string) error {
-	buf := &bytes.Buffer{}
-	tw := tar.NewWriter(buf)
-	for i := range missing {
-		_ = tw.WriteHeader(&tar.Header{
-			Name:     path.Join(missing[:i+1]...),
-			Mode:     0o777,
-			Typeflag: tar.TypeDir,
-		})
-	}
-	tw.Close()
-	_, err := cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
-		DestinationPath: destPath,
-		Content:         buf,
-	})
-	return err
-}
-
 func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string, tarStream io.Reader) error {
 	if cr.id == "" {
 		return cr.missingContainerError("copy to %s", destPath)
 	}
-	destPath, err := cr.mkdirInContainer(ctx, destPath)
+	// Mkdir, with a path relative to the DestinationPath ("/") below. Docker 29.5+
+	// rejects absolute tar entry names with "path escapes from parent".
+	buf := &bytes.Buffer{}
+	tw := tar.NewWriter(buf)
+	_ = tw.WriteHeader(&tar.Header{
+		Name:     strings.TrimPrefix(destPath, "/"),
+		Mode:     0o777,
+		Typeflag: tar.TypeDir,
+	})
+	tw.Close()
+	_, err := cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
+		DestinationPath: "/",
+		Content:         buf,
+	})
 	if err != nil {
 		return fmt.Errorf("failed to mkdir to copy content to container: %w", err)
 	}
@@ -1016,10 +986,6 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool
 			return cr.missingContainerError("copy directory to %s", dstPath)
 		}
 		logger := common.Logger(ctx)
-		dstPath, err := cr.mkdirInContainer(ctx, dstPath)
-		if err != nil {
-			return fmt.Errorf("failed to mkdir to copy directory to container: %w", err)
-		}
 		tarFile, err := os.CreateTemp("", "act")
 		if err != nil {
 			return err

act/container/docker_run_test.go

@@ -79,6 +79,11 @@ type mockDockerClient struct {
 	mock.Mock
 }
 
+func (m *mockDockerClient) ServerVersion(ctx context.Context, opts mobyclient.ServerVersionOptions) (mobyclient.ServerVersionResult, error) {
+	args := m.Called(ctx, opts)
+	return args.Get(0).(mobyclient.ServerVersionResult), args.Error(1)
+}
+
 func (m *mockDockerClient) ExecCreate(ctx context.Context, id string, opts mobyclient.ExecCreateOptions) (mobyclient.ExecCreateResult, error) {
 	args := m.Called(ctx, id, opts)
 	return args.Get(0).(mobyclient.ExecCreateResult), args.Error(1)
@@ -94,11 +99,6 @@ func (m *mockDockerClient) ExecInspect(ctx context.Context, execID string, opts
 	return args.Get(0).(mobyclient.ExecInspectResult), args.Error(1)
 }
 
-func (m *mockDockerClient) ContainerStatPath(ctx context.Context, containerID string, opts mobyclient.ContainerStatPathOptions) (mobyclient.ContainerStatPathResult, error) {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerStatPathResult), args.Error(1)
-}
-
 func (m *mockDockerClient) ContainerAttach(ctx context.Context, containerID string, opts mobyclient.ContainerAttachOptions) (mobyclient.ContainerAttachResult, error) {
 	args := m.Called(ctx, containerID, opts)
 	return args.Get(0).(mobyclient.ContainerAttachResult), args.Error(1)
@@ -342,37 +342,52 @@ func TestDockerWaitFailure(t *testing.T) {
 	client.AssertExpectations(t)
 }
 
-// stubStatPath answers path resolution: the given paths exist, mapped to their target
-// when they are a symlink, everything else does not exist.
-func stubStatPath(client *mockDockerClient, existing map[string]string) {
-	for containerPath, target := range existing {
-		client.On("ContainerStatPath", mock.Anything, "123", mobyclient.ContainerStatPathOptions{Path: containerPath}).
-			Return(mobyclient.ContainerStatPathResult{Stat: container.PathStat{LinkTarget: target}}, nil).Maybe()
+func TestDockerCopyTarStream(t *testing.T) {
+	ctx := context.Background()
+
+	client := &mockDockerClient{}
+	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+		return opts.DestinationPath == "/" && opts.Content != nil
+	})).Return(mobyclient.CopyToContainerResult{}, nil)
+	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
+	})).Return(mobyclient.CopyToContainerResult{}, nil)
+	cr := &containerReference{
+		id:  "123",
+		cli: client,
+		input: &NewContainerInput{
+			Image: "image",
+		},
 	}
-	client.On("ContainerStatPath", mock.Anything, "123", mock.Anything).
-		Return(mobyclient.ContainerStatPathResult{}, cerrdefs.ErrNotFound).Maybe()
+
+	_ = cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
+
+	client.AssertExpectations(t)
 }
 
-// The mkdir tarball is extracted at the deepest existing ancestor, with entries relative
-// to it that never traverse the "/var/run" symlink, see moby/moby#53258.
-func TestDockerCopyTarStream(t *testing.T) {
+// Docker 29.5+ rejects absolute names in the mkdir tarball with
+// "path escapes from parent", since it is extracted relative to "/".
+func TestDockerCopyTarStreamMkdirEntryIsRelative(t *testing.T) {
 	ctx := context.Background()
 
 	var mkdirNames []string
 	client := &mockDockerClient{}
-	stubStatPath(client, map[string]string{"/var": "", "/var/run": "/run", "/run": ""})
 	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		if opts.DestinationPath != "/run" || opts.Content == nil {
+		if opts.DestinationPath != "/" || opts.Content == nil {
 			return false
 		}
 		tr := tar.NewReader(opts.Content)
-		for hdr, err := tr.Next(); err == nil; hdr, err = tr.Next() {
+		for {
+			hdr, err := tr.Next()
+			if err != nil {
+				break
+			}
 			mkdirNames = append(mkdirNames, hdr.Name)
 		}
 		return true
 	})).Return(mobyclient.CopyToContainerResult{}, nil)
 	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/run/act" && opts.Content != nil
+		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
 	})).Return(mobyclient.CopyToContainerResult{}, nil)
 	cr := &containerReference{
 		id:  "123",
@@ -383,45 +398,58 @@ func TestDockerCopyTarStream(t *testing.T) {
 	}
 
 	require.NoError(t, cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{}))
-	assert.Equal(t, []string{"act"}, mkdirNames)
+	assert.Equal(t, []string{"var/run/act"}, mkdirNames)
 
 	client.AssertExpectations(t)
 }
 
-func TestDockerCopyTarStreamErrors(t *testing.T) {
+func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) {
+	ctx := context.Background()
+
 	merr := errors.New("Failure")
-	for _, testCase := range []struct {
-		name     string
-		mkdirErr error
-		copyErr  error
-	}{
-		{"mkdir", merr, nil},
-		{"copy content", nil, merr},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			ctx := context.Background()
 
-			client := &mockDockerClient{}
-			stubStatPath(client, map[string]string{"/var": "", "/var/run": ""})
-			client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-				return opts.DestinationPath == "/var/run" && opts.Content != nil
-			})).Return(mobyclient.CopyToContainerResult{}, testCase.mkdirErr)
-			client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-				return opts.DestinationPath == "/var/run/act" && opts.Content != nil
-			})).Return(mobyclient.CopyToContainerResult{}, testCase.copyErr).Maybe()
-			cr := &containerReference{
-				id:  "123",
-				cli: client,
-				input: &NewContainerInput{
-					Image: "image",
-				},
-			}
-
-			require.ErrorIs(t, cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{}), merr)
-
-			client.AssertExpectations(t)
-		})
+	client := &mockDockerClient{}
+	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+		return opts.DestinationPath == "/" && opts.Content != nil
+	})).Return(mobyclient.CopyToContainerResult{}, merr)
+	cr := &containerReference{
+		id:  "123",
+		cli: client,
+		input: &NewContainerInput{
+			Image: "image",
+		},
 	}
+
+	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
+	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
+
+	client.AssertExpectations(t)
+}
+
+func TestDockerCopyTarStreamErrorInMkdir(t *testing.T) {
+	ctx := context.Background()
+
+	merr := errors.New("Failure")
+
+	client := &mockDockerClient{}
+	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+		return opts.DestinationPath == "/" && opts.Content != nil
+	})).Return(mobyclient.CopyToContainerResult{}, nil)
+	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
+	})).Return(mobyclient.CopyToContainerResult{}, merr)
+	cr := &containerReference{
+		id:  "123",
+		cli: client,
+		input: &NewContainerInput{
+			Image: "image",
+		},
+	}
+
+	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
+	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
+
+	client.AssertExpectations(t)
 }
 
 // A remove that raced the daemon's AutoRemove teardown is not a failure and must not
@@ -612,9 +640,10 @@ func TestDockerCopyToSymlinkPath(t *testing.T) {
 		_ = rc.Close()(ctx)
 	})
 
-	// CopyTarStream resolves the var/run symlink and creates act below its target, the
-	// exact step that fails on a broken daemon.
-	err := rc.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
+	// CopyTarStream first creates the destination directory by extracting a tar at "/",
+	// which makes the daemon mkdir var, then var/run (the symlink), then act — the exact
+	// step that fails on the broken daemon.
+	err := rc.CopyTarStream(ctx, "/var/run/act/actions/", &bytes.Buffer{})
 	require.NoError(t, err)
 }
 
@@ -906,3 +935,15 @@ func TestMergeContainerConfigsVolumesReplaceRunnerMounts(t *testing.T) {
 	assert.Equal(t, []string{"/var/run/docker.sock:/var/run/docker.sock", "/host/tools:/opt/hostedtoolcache"}, hostConf.Binds)
 	assert.Empty(t, hostConf.Mounts)
 }
+
+// A dead daemon must fail the job, not panic through logrus and not silently
+// drop the requested platform.
+func TestSupportsContainerImagePlatformDaemonError(t *testing.T) {
+	cli := &mockDockerClient{}
+	cli.On("ServerVersion", mock.Anything, mock.Anything).
+		Return(mobyclient.ServerVersionResult{}, errors.New("cannot connect to the Docker daemon"))
+
+	supported, err := supportsContainerImagePlatform(t.Context(), cli)
+	require.ErrorContains(t, err, "cannot connect to the Docker daemon")
+	assert.False(t, supported)
+}

act/exprparser/functions.go

@@ -1,309 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package exprparser
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strconv"
-	"strings"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
-	"github.com/rhysd/actionlint"
-)
-
-func (impl *interperterImpl) contains(search, item reflect.Value) (bool, error) {
-	switch search.Kind() {
-	case reflect.String, reflect.Int, reflect.Float64, reflect.Bool, reflect.Invalid:
-		return strings.Contains(
-			strings.ToLower(CoerceToString(search)),
-			strings.ToLower(CoerceToString(item)),
-		), nil
-
-	case reflect.Slice:
-		for i := 0; i < search.Len(); i++ {
-			arrayItem := search.Index(i).Elem()
-			result, err := impl.compareValues(arrayItem, item, actionlint.CompareOpNodeKindEq)
-			if err != nil {
-				return false, err
-			}
-
-			if isEqual, ok := result.(bool); ok && isEqual {
-				return true, nil
-			}
-		}
-	}
-
-	return false, nil
-}
-
-func (impl *interperterImpl) startsWith(searchString, searchValue reflect.Value) (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return strings.HasPrefix(
-		strings.ToLower(CoerceToString(searchString)),
-		strings.ToLower(CoerceToString(searchValue)),
-	), nil
-}
-
-func (impl *interperterImpl) endsWith(searchString, searchValue reflect.Value) (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return strings.HasSuffix(
-		strings.ToLower(CoerceToString(searchString)),
-		strings.ToLower(CoerceToString(searchValue)),
-	), nil
-}
-
-const (
-	passThrough = iota
-	bracketOpen
-	bracketClose
-)
-
-func (impl *interperterImpl) format(str reflect.Value, replaceValue ...reflect.Value) (string, error) {
-	input := CoerceToString(str)
-	var output strings.Builder
-	replacementIndex := ""
-
-	state := passThrough
-	for _, character := range input {
-		switch state {
-		case passThrough: // normal buffer output
-			switch character {
-			case '{':
-				state = bracketOpen
-
-			case '}':
-				state = bracketClose
-
-			default:
-				output.WriteRune(character)
-			}
-
-		case bracketOpen: // found {
-			switch character {
-			case '{':
-				output.WriteString("{")
-				replacementIndex = ""
-				state = passThrough
-
-			case '}':
-				index, err := strconv.ParseInt(replacementIndex, 10, 32)
-				if err != nil {
-					return "", fmt.Errorf("The following format string is invalid: '%s'", input)
-				}
-
-				replacementIndex = ""
-
-				if len(replaceValue) <= int(index) {
-					return "", fmt.Errorf("The following format string references more arguments than were supplied: '%s'", input)
-				}
-
-				output.WriteString(CoerceToString(replaceValue[index]))
-
-				state = passThrough
-
-			default:
-				replacementIndex += string(character)
-			}
-
-		case bracketClose: // found }
-			switch character {
-			case '}':
-				output.WriteString("}")
-				replacementIndex = ""
-				state = passThrough
-
-			default:
-				return "", fmt.Errorf("Closing bracket without opening one. The following format string is invalid: '%s'", input)
-			}
-		}
-	}
-
-	if state != passThrough {
-		switch state {
-		case bracketOpen:
-			return "", fmt.Errorf("Unclosed brackets. The following format string is invalid: '%s'", input)
-
-		case bracketClose:
-			return "", fmt.Errorf("Closing bracket without opening one. The following format string is invalid: '%s'", input)
-		}
-	}
-
-	return output.String(), nil
-}
-
-func (impl *interperterImpl) join(array, sep reflect.Value) (string, error) { //nolint:unparam // pre-existing issue from nektos/act
-	separator := CoerceToString(sep)
-	switch array.Kind() {
-	case reflect.Slice:
-		var items []string
-		for i := 0; i < array.Len(); i++ {
-			items = append(items, CoerceToString(array.Index(i)))
-		}
-
-		return strings.Join(items, separator), nil
-	default:
-		return strings.Join([]string{CoerceToString(array)}, separator), nil
-	}
-}
-
-func (impl *interperterImpl) toJSON(value reflect.Value) (string, error) {
-	if value.Kind() == reflect.Invalid {
-		return "null", nil
-	}
-
-	json, err := json.MarshalIndent(value.Interface(), "", "  ")
-	if err != nil {
-		return "", fmt.Errorf("Cannot convert value to JSON. Cause: %v", err)
-	}
-
-	return string(json), nil
-}
-
-func (impl *interperterImpl) fromJSON(value reflect.Value) (any, error) {
-	if value.Kind() != reflect.String {
-		return nil, fmt.Errorf("Cannot parse non-string type %v as JSON", value.Kind())
-	}
-
-	var data any
-
-	err := json.Unmarshal([]byte(value.String()), &data)
-	if err != nil {
-		return nil, fmt.Errorf("Invalid JSON: %v", err)
-	}
-
-	return data, nil
-}
-
-func (impl *interperterImpl) hashFiles(paths ...reflect.Value) (string, error) {
-	var ps []gitignore.Pattern
-
-	const cwdPrefix = "." + string(filepath.Separator)
-	const excludeCwdPrefix = "!" + cwdPrefix
-	for _, path := range paths {
-		if path.Kind() == reflect.String {
-			cleanPath := path.String()
-			if strings.HasPrefix(cleanPath, cwdPrefix) {
-				cleanPath = cleanPath[len(cwdPrefix):]
-			} else if strings.HasPrefix(cleanPath, excludeCwdPrefix) {
-				cleanPath = "!" + cleanPath[len(excludeCwdPrefix):]
-			}
-			ps = append(ps, gitignore.ParsePattern(cleanPath, nil))
-		} else {
-			return "", errors.New("Non-string path passed to hashFiles")
-		}
-	}
-
-	matcher := gitignore.NewMatcher(ps)
-
-	var files []string
-	if err := filepath.Walk(impl.config.WorkingDir, func(path string, fi fs.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		sansPrefix := strings.TrimPrefix(path, impl.config.WorkingDir+string(filepath.Separator))
-		parts := strings.Split(sansPrefix, string(filepath.Separator))
-		if fi.IsDir() || !matcher.Match(parts, fi.IsDir()) {
-			return nil
-		}
-		files = append(files, path)
-		return nil
-	}); err != nil {
-		return "", fmt.Errorf("Unable to filepath.Walk: %v", err)
-	}
-
-	if len(files) == 0 {
-		return "", nil
-	}
-
-	hasher := sha256.New()
-
-	for _, file := range files {
-		f, err := os.Open(file)
-		if err != nil {
-			return "", fmt.Errorf("Unable to os.Open: %v", err)
-		}
-
-		if _, err := io.Copy(hasher, f); err != nil {
-			return "", fmt.Errorf("Unable to io.Copy: %v", err)
-		}
-
-		if err := f.Close(); err != nil {
-			return "", fmt.Errorf("Unable to Close file: %v", err)
-		}
-	}
-
-	return hex.EncodeToString(hasher.Sum(nil)), nil
-}
-
-func (impl *interperterImpl) getNeedsTransitive(job *model.Job) []string {
-	needs := job.Needs()
-
-	for _, need := range needs {
-		parentNeeds := impl.getNeedsTransitive(impl.config.Run.Workflow.GetJob(need))
-		needs = append(needs, parentNeeds...)
-	}
-
-	return needs
-}
-
-func (impl *interperterImpl) always() (bool, error) {
-	return true, nil
-}
-
-func (impl *interperterImpl) jobSuccess() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	jobs := impl.config.Run.Workflow.Jobs
-	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
-
-	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() != "success" {
-			return false, nil
-		}
-	}
-
-	return true, nil
-}
-
-// jobStatus returns the current job status, treating a nil Job context as an
-// empty status so status-check functions never panic on a nil dereference.
-func (impl *interperterImpl) jobStatus() string {
-	if impl.env.Job == nil {
-		return ""
-	}
-	return impl.env.Job.Status
-}
-
-func (impl *interperterImpl) stepSuccess() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "success", nil
-}
-
-func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	jobs := impl.config.Run.Workflow.Jobs
-	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
-
-	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() == "failure" {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-func (impl *interperterImpl) stepFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "failure", nil
-}
-
-func (impl *interperterImpl) cancelled() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "cancelled", nil
-}

act/exprparser/functions_test.go

@@ -1,283 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package exprparser
-
-import (
-	"path/filepath"
-	"testing"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestFunctionContains(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"contains('search', 'item') }}", false, "contains-str-str"},
-		{`cOnTaInS('Hello', 'll') }}`, true, "contains-str-casing"},
-		{`contains('HELLO', 'll') }}`, true, "contains-str-casing"},
-		{`contains('3.141592', 3.14) }}`, true, "contains-str-number"},
-		{`contains(3.141592, '3.14') }}`, true, "contains-number-str"},
-		{`contains(3.141592, 3.14) }}`, true, "contains-number-number"},
-		{`contains(true, 'u') }}`, true, "contains-bool-str"},
-		{`contains(null, '') }}`, true, "contains-null-str"},
-		{`contains(fromJSON('["first","second"]'), 'first') }}`, true, "contains-item"},
-		{`contains(fromJSON('[null,"second"]'), '') }}`, true, "contains-item-null-empty-str"},
-		{`contains(fromJSON('["","second"]'), null) }}`, true, "contains-item-empty-str-null"},
-		{`contains(fromJSON('[true,"second"]'), 'true') }}`, false, "contains-item-bool-arr"},
-		{`contains(fromJSON('["true","second"]'), true) }}`, false, "contains-item-str-bool"},
-		{`contains(fromJSON('[3.14,"second"]'), '3.14') }}`, true, "contains-item-number-str"},
-		{`contains(fromJSON('[3.14,"second"]'), 3.14) }}`, true, "contains-item-number-number"},
-		{`contains(fromJSON('["","second"]'), fromJSON('[]')) }}`, false, "contains-item-str-arr"},
-		{`contains(fromJSON('["","second"]'), fromJSON('{}')) }}`, false, "contains-item-str-obj"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionStartsWith(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"startsWith('search', 'se') }}", true, "startswith-string"},
-		{"startsWith('search', 'sa') }}", false, "startswith-string"},
-		{"startsWith('123search', '123s') }}", true, "startswith-string"},
-		{"startsWith(123, 's') }}", false, "startswith-string"},
-		{"startsWith(123, '12') }}", true, "startswith-string"},
-		{"startsWith('123', 12) }}", true, "startswith-string"},
-		{"startsWith(null, '42') }}", false, "startswith-string"},
-		{"startsWith('null', null) }}", true, "startswith-string"},
-		{"startsWith('null', '') }}", true, "startswith-string"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionEndsWith(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"endsWith('search', 'ch') }}", true, "endsWith-string"},
-		{"endsWith('search', 'sa') }}", false, "endsWith-string"},
-		{"endsWith('search123s', '123s') }}", true, "endsWith-string"},
-		{"endsWith(123, 's') }}", false, "endsWith-string"},
-		{"endsWith(123, '23') }}", true, "endsWith-string"},
-		{"endsWith('123', 23) }}", true, "endsWith-string"},
-		{"endsWith(null, '42') }}", false, "endsWith-string"},
-		{"endsWith('null', null) }}", true, "endsWith-string"},
-		{"endsWith('null', '') }}", true, "endsWith-string"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionJoin(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"join(fromJSON('[\"a\", \"b\"]'), ',')", "a,b", "join-arr"},
-		{"join('string', ',')", "string", "join-str"},
-		{"join(1, ',')", "1", "join-number"},
-		{"join(null, ',')", "", "join-number"},
-		{"join(fromJSON('[\"a\", \"b\", null]'), null)", "ab", "join-number"},
-		{"join(fromJSON('[\"a\", \"b\"]'))", "a,b", "join-number"},
-		{"join(fromJSON('[\"a\", \"b\", null]'), 1)", "a1b1", "join-number"},
-		{"join(fromJSON('[1, true, null]'), '-')", "1-true-", "join-mixed-types"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionToJSON(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"toJSON(env) }}", "{\n  \"key\": \"value\"\n}", "toJSON"},
-		{"toJSON(null)", "null", "toJSON-null"},
-	}
-
-	env := &EvaluationEnvironment{
-		Env: map[string]string{
-			"key": "value",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionFromJSON(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"fromJSON('{\"foo\":\"bar\"}') }}", map[string]any{
-			"foo": "bar",
-		}, "fromJSON"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionHashFiles(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"hashFiles('**/non-extant-files') }}", "", "hash-non-existing-file"},
-		{"hashFiles('**/non-extant-files', '**/more-non-extant-files') }}", "", "hash-multiple-non-existing-files"},
-		{"hashFiles('./for-hashing-1.txt') }}", "66a045b452102c59d840ec097d59d9467e13a3f34f6494e539ffd32c1bb35f18", "hash-single-file"},
-		{"hashFiles('./for-hashing-*.txt') }}", "8e5935e7e13368cd9688fe8f48a0955293676a021562582c7e848dafe13fb046", "hash-multiple-files"},
-		{"hashFiles('./for-hashing-*.txt', '!./for-hashing-2.txt') }}", "66a045b452102c59d840ec097d59d9467e13a3f34f6494e539ffd32c1bb35f18", "hash-negative-pattern"},
-		{"hashFiles('./for-hashing-**') }}", "c418ba693753c84115ced0da77f876cddc662b9054f4b129b90f822597ee2f94", "hash-multiple-files-and-directories"},
-		{"hashFiles('./for-hashing-3/**') }}", "6f5696b546a7a9d6d42a449dc9a56bef244aaa826601ef27466168846139d2c2", "hash-nested-directories"},
-		{"hashFiles('./for-hashing-3/**/nested-data.txt') }}", "8ecadfb49f7f978d0a9f3a957e9c8da6cc9ab871f5203b5d9f9d1dc87d8af18c", "hash-nested-directories-2"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			workdir, err := filepath.Abs("testdata")
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			output, err := NewInterpeter(env, Config{WorkingDir: workdir}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionFormat(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		error    any
-		name     string
-	}{
-		{"format('text')", "text", nil, "format-plain-string"},
-		{"format('Hello {0} {1} {2}!', 'Mona', 'the', 'Octocat')", "Hello Mona the Octocat!", nil, "format-with-placeholders"},
-		{"format('{{Hello {0} {1} {2}!}}', 'Mona', 'the', 'Octocat')", "{Hello Mona the Octocat!}", nil, "format-with-escaped-braces"},
-		{"format('{{0}}', 'test')", "{0}", nil, "format-with-escaped-braces"},
-		{"format('{{{0}}}', 'test')", "{test}", nil, "format-with-escaped-braces-and-value"},
-		{"format('}}')", "}", nil, "format-output-closing-brace"},
-		{`format('Hello "{0}" {1} {2} {3} {4}', null, true, -3.14, NaN, Infinity)`, `Hello "" true -3.14 NaN Infinity`, nil, "format-with-primitives"},
-		{`format('Hello "{0}" {1} {2}', fromJSON('[0, true, "abc"]'), fromJSON('[{"a":1}]'), fromJSON('{"a":{"b":1}}'))`, `Hello "Array" Array Object`, nil, "format-with-complex-types"},
-		{"format(true)", "true", nil, "format-with-primitive-args"},
-		{"format('{0}', github)", "Object", nil, "format-with-context"},
-		{"format('echo Hello {0} ${{Test}}', github.undefined_property)", "echo Hello  ${Test}", nil, "format-with-undefined-value"},
-		{"format('{0}}', '{1}', 'World')", nil, "Closing bracket without opening one. The following format string is invalid: '{0}}'", "format-invalid-format-string"},
-		{"format('a}b')", nil, "Closing bracket without opening one. The following format string is invalid: 'a}b'", "format-unmatched-closing-brace"},
-		{"format('{0', '{1}', 'World')", nil, "Unclosed brackets. The following format string is invalid: '{0'", "format-invalid-format-string"},
-		{"format('{2}', '{1}', 'World')", "", "The following format string references more arguments than were supplied: '{2}'", "format-invalid-replacement-reference"},
-		{"format('{2147483648}')", "", "The following format string is invalid: '{2147483648}'", "format-invalid-replacement-reference"},
-		{"format('{0} {1} {2} {3}', 1.0, 1.1, 1234567890.0, 12345678901234567890.0)", "1 1.1 1234567890 1.23456789012346E+19", nil, "format-floats"},
-	}
-
-	env := &EvaluationEnvironment{
-		Github: &model.GithubContext{},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			if tt.error != nil {
-				assert.Equal(t, tt.error, err.Error())
-			} else {
-				assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-				assert.Equal(t, tt.expected, output)
-			}
-		})
-	}
-}
-
-func TestStatusFunctionsNilJob(t *testing.T) {
-	// A nil Job context must not panic: the status-check functions should treat
-	// it as an empty status and return false rather than dereferencing nil.
-	env := &EvaluationEnvironment{}
-
-	table := []struct {
-		input   string
-		context string
-		name    string
-	}{
-		{"cancelled()", "job", "cancelled-nil-job"},
-		{"success()", "step", "step-success-nil-job"},
-		{"failure()", "step", "step-failure-nil-job"},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{Context: tt.context}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.Equal(t, false, output)
-		})
-	}
-}

act/exprparser/interpreter.go

@@ -1,666 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package exprparser
-
-import (
-	"encoding"
-	"errors"
-	"fmt"
-	"math"
-	"reflect"
-	"strconv"
-	"strings"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/rhysd/actionlint"
-)
-
-type EvaluationEnvironment struct {
-	Github    *model.GithubContext
-	Env       map[string]string
-	Job       *model.JobContext
-	Jobs      *map[string]*model.WorkflowCallResult
-	Steps     map[string]*model.StepResult
-	Runner    map[string]any
-	Secrets   map[string]string
-	Vars      map[string]string
-	Strategy  map[string]any
-	Matrix    map[string]any
-	Needs     map[string]Needs
-	Inputs    map[string]any
-	HashFiles func([]reflect.Value) (any, error)
-}
-
-type Needs struct {
-	Outputs map[string]string `json:"outputs"`
-	Result  string            `json:"result"`
-}
-
-type Config struct {
-	Run        *model.Run
-	WorkingDir string
-	Context    string
-}
-
-type DefaultStatusCheck int
-
-const (
-	DefaultStatusCheckNone DefaultStatusCheck = iota
-	DefaultStatusCheckSuccess
-	DefaultStatusCheckAlways
-	DefaultStatusCheckCanceled
-	DefaultStatusCheckFailure
-)
-
-func (dsc DefaultStatusCheck) String() string {
-	switch dsc {
-	case DefaultStatusCheckSuccess:
-		return "success"
-	case DefaultStatusCheckAlways:
-		return "always"
-	case DefaultStatusCheckCanceled:
-		return "cancelled"
-	case DefaultStatusCheckFailure:
-		return "failure"
-	}
-	return ""
-}
-
-type Interpreter interface {
-	Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (any, error)
-}
-
-type interperterImpl struct {
-	env    *EvaluationEnvironment
-	config Config
-}
-
-func NewInterpeter(env *EvaluationEnvironment, config Config) Interpreter {
-	return &interperterImpl{
-		env:    env,
-		config: config,
-	}
-}
-
-// Evaluate evaluates one expression. An empty input asks defaultStatusCheck on its own, which is
-// what a value that carries no expression of its own runs under.
-func (impl *interperterImpl) Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (any, error) {
-	input = strings.TrimPrefix(input, "${{")
-
-	if input == "" && defaultStatusCheck != DefaultStatusCheckNone {
-		return impl.evaluateNode(statusCheckNode(defaultStatusCheck))
-	}
-
-	parser := actionlint.NewExprParser()
-	exprNode, err := parser.Parse(actionlint.NewExprLexer(input + "}}"))
-	if err != nil {
-		return nil, fmt.Errorf("Failed to parse: %s", err.Message)
-	}
-
-	if defaultStatusCheck != DefaultStatusCheckNone && !CallsStatusFunction(exprNode) {
-		exprNode = &actionlint.LogicalOpNode{
-			Kind:  actionlint.LogicalOpNodeKindAnd,
-			Left:  statusCheckNode(defaultStatusCheck),
-			Right: exprNode,
-		}
-	}
-
-	result, err2 := impl.evaluateNode(exprNode)
-
-	return result, err2
-}
-
-func statusCheckNode(defaultStatusCheck DefaultStatusCheck) *actionlint.FuncCallNode {
-	return &actionlint.FuncCallNode{Callee: defaultStatusCheck.String(), Args: []actionlint.ExprNode{}}
-}
-
-// CallsStatusFunction reports whether the expression calls a status function, which counts as the
-// expression asking its own status question instead of the default one.
-func CallsStatusFunction(exprNode actionlint.ExprNode) bool {
-	found := false
-	actionlint.VisitExprNode(exprNode, func(node, _ actionlint.ExprNode, entering bool) {
-		if funcCallNode, ok := node.(*actionlint.FuncCallNode); entering && ok {
-			switch strings.ToLower(funcCallNode.Callee) {
-			case "success", "always", "cancelled", "failure":
-				found = true
-			}
-		}
-	})
-	return found
-}
-
-func (impl *interperterImpl) evaluateNode(exprNode actionlint.ExprNode) (any, error) {
-	switch node := exprNode.(type) {
-	case *actionlint.VariableNode:
-		return impl.evaluateVariable(node)
-	case *actionlint.BoolNode:
-		return node.Value, nil
-	case *actionlint.NullNode:
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-	case *actionlint.IntNode:
-		return node.Value, nil
-	case *actionlint.FloatNode:
-		return node.Value, nil
-	case *actionlint.StringNode:
-		return node.Value, nil
-	case *actionlint.IndexAccessNode:
-		return impl.evaluateIndexAccess(node)
-	case *actionlint.ObjectDerefNode:
-		return impl.evaluateObjectDeref(node)
-	case *actionlint.ArrayDerefNode:
-		return impl.evaluateArrayDeref(node)
-	case *actionlint.NotOpNode:
-		return impl.evaluateNot(node)
-	case *actionlint.CompareOpNode:
-		return impl.evaluateCompare(node)
-	case *actionlint.LogicalOpNode:
-		return impl.evaluateLogicalCompare(node)
-	case *actionlint.FuncCallNode:
-		return impl.evaluateFuncCall(node)
-	default:
-		return nil, fmt.Errorf("Fatal error! Unknown node type: %s node: %+v", reflect.TypeOf(exprNode), exprNode)
-	}
-}
-
-func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableNode) (any, error) {
-	switch strings.ToLower(variableNode.Name) {
-	case "github":
-		return impl.env.Github, nil
-	case "gitea": // compatible with Gitea
-		return impl.env.Github, nil
-	case "env":
-		return impl.env.Env, nil
-	case "job":
-		return impl.env.Job, nil
-	case "jobs":
-		if impl.env.Jobs == nil {
-			return nil, errors.New("Unavailable context: jobs")
-		}
-		return impl.env.Jobs, nil
-	case "steps":
-		return impl.env.Steps, nil
-	case "runner":
-		return impl.env.Runner, nil
-	case "secrets":
-		return impl.env.Secrets, nil
-	case "vars":
-		return impl.env.Vars, nil
-	case "strategy":
-		return impl.env.Strategy, nil
-	case "matrix":
-		return impl.env.Matrix, nil
-	case "needs":
-		return impl.env.Needs, nil
-	case "inputs":
-		return impl.env.Inputs, nil
-	case "infinity":
-		return math.Inf(1), nil
-	case "nan":
-		return math.NaN(), nil
-	default:
-		return nil, fmt.Errorf("Unavailable context: %s", variableNode.Name)
-	}
-}
-
-func (impl *interperterImpl) evaluateIndexAccess(indexAccessNode *actionlint.IndexAccessNode) (any, error) {
-	left, err := impl.evaluateNode(indexAccessNode.Operand)
-	if err != nil {
-		return nil, err
-	}
-
-	leftValue := reflect.ValueOf(left)
-
-	right, err := impl.evaluateNode(indexAccessNode.Index)
-	if err != nil {
-		return nil, err
-	}
-
-	rightValue := reflect.ValueOf(right)
-
-	switch rightValue.Kind() {
-	case reflect.String:
-		return impl.getPropertyValue(leftValue, rightValue.String())
-
-	case reflect.Int:
-		switch leftValue.Kind() {
-		case reflect.Slice:
-			if rightValue.Int() < 0 || rightValue.Int() >= int64(leftValue.Len()) {
-				return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-			}
-			return leftValue.Index(int(rightValue.Int())).Interface(), nil
-		default:
-			return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-		}
-
-	default:
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-	}
-}
-
-func (impl *interperterImpl) evaluateObjectDeref(objectDerefNode *actionlint.ObjectDerefNode) (any, error) {
-	left, err := impl.evaluateNode(objectDerefNode.Receiver)
-	if err != nil {
-		return nil, err
-	}
-
-	return impl.getPropertyValue(reflect.ValueOf(left), objectDerefNode.Property)
-}
-
-func (impl *interperterImpl) evaluateArrayDeref(arrayDerefNode *actionlint.ArrayDerefNode) (any, error) {
-	left, err := impl.evaluateNode(arrayDerefNode.Receiver)
-	if err != nil {
-		return nil, err
-	}
-
-	return impl.getSafeValue(reflect.ValueOf(left)), nil
-}
-
-func (impl *interperterImpl) getPropertyValue(left reflect.Value, property string) (value any, err error) {
-	switch left.Kind() {
-	case reflect.Pointer:
-		return impl.getPropertyValue(left.Elem(), property)
-
-	case reflect.Struct:
-		leftType := left.Type()
-		for field := range leftType.Fields() {
-			jsonName := field.Tag.Get("json")
-			if jsonName == property {
-				property = field.Name
-				break
-			}
-		}
-
-		fieldValue := left.FieldByNameFunc(func(name string) bool {
-			return strings.EqualFold(name, property)
-		})
-
-		if fieldValue.Kind() == reflect.Invalid {
-			return "", nil
-		}
-
-		i := fieldValue.Interface()
-		// The type stepStatus int is an integer, but should be treated as string
-		if m, ok := i.(encoding.TextMarshaler); ok {
-			text, err := m.MarshalText()
-			if err != nil {
-				return nil, err
-			}
-			return string(text), nil
-		}
-		return i, nil
-
-	case reflect.Map:
-		iter := left.MapRange()
-
-		for iter.Next() {
-			key := iter.Key()
-
-			switch key.Kind() {
-			case reflect.String:
-				if strings.EqualFold(key.String(), property) {
-					return impl.getMapValue(iter.Value())
-				}
-
-			default:
-				return nil, fmt.Errorf("'%s' in map key not implemented", key.Kind())
-			}
-		}
-
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-
-	case reflect.Slice:
-		var values []any
-
-		for i := 0; i < left.Len(); i++ {
-			value, err := impl.getPropertyValue(left.Index(i).Elem(), property)
-			if err != nil {
-				return nil, err
-			}
-
-			values = append(values, value)
-		}
-
-		return values, nil
-	}
-
-	return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-}
-
-func (impl *interperterImpl) getMapValue(value reflect.Value) (any, error) {
-	if value.Kind() == reflect.Pointer {
-		return impl.getMapValue(value.Elem())
-	}
-
-	return value.Interface(), nil
-}
-
-func (impl *interperterImpl) evaluateNot(notNode *actionlint.NotOpNode) (any, error) {
-	operand, err := impl.evaluateNode(notNode.Operand)
-	if err != nil {
-		return nil, err
-	}
-
-	return !IsTruthy(operand), nil
-}
-
-func (impl *interperterImpl) evaluateCompare(compareNode *actionlint.CompareOpNode) (any, error) {
-	left, err := impl.evaluateNode(compareNode.Left)
-	if err != nil {
-		return nil, err
-	}
-
-	right, err := impl.evaluateNode(compareNode.Right)
-	if err != nil {
-		return nil, err
-	}
-
-	leftValue := reflect.ValueOf(left)
-	rightValue := reflect.ValueOf(right)
-
-	return impl.compareValues(leftValue, rightValue, compareNode.Kind)
-}
-
-func (impl *interperterImpl) compareValues(leftValue, rightValue reflect.Value, kind actionlint.CompareOpNodeKind) (any, error) {
-	if leftValue.Kind() != rightValue.Kind() {
-		if !impl.isNumber(leftValue) {
-			leftValue = impl.coerceToNumber(leftValue)
-		}
-		if !impl.isNumber(rightValue) {
-			rightValue = impl.coerceToNumber(rightValue)
-		}
-	}
-
-	switch leftValue.Kind() {
-	case reflect.Bool:
-		return impl.compareNumber(float64(impl.coerceToNumber(leftValue).Int()), float64(impl.coerceToNumber(rightValue).Int()), kind)
-	case reflect.String:
-		return impl.compareString(strings.ToLower(leftValue.String()), strings.ToLower(rightValue.String()), kind)
-
-	case reflect.Int:
-		if rightValue.Kind() == reflect.Float64 {
-			return impl.compareNumber(float64(leftValue.Int()), rightValue.Float(), kind)
-		}
-
-		return impl.compareNumber(float64(leftValue.Int()), float64(rightValue.Int()), kind)
-
-	case reflect.Float64:
-		if rightValue.Kind() == reflect.Int {
-			return impl.compareNumber(leftValue.Float(), float64(rightValue.Int()), kind)
-		}
-
-		return impl.compareNumber(leftValue.Float(), rightValue.Float(), kind)
-
-	case reflect.Invalid:
-		if rightValue.Kind() == reflect.Invalid {
-			return true, nil
-		}
-
-		// not possible situation - params are converted to the same type in code above
-		return nil, fmt.Errorf("Compare params of Invalid type: left: %+v, right: %+v", leftValue.Kind(), rightValue.Kind())
-
-	default:
-		return nil, fmt.Errorf("Compare not implemented for types: left: %+v, right: %+v", leftValue.Kind(), rightValue.Kind())
-	}
-}
-
-func (impl *interperterImpl) coerceToNumber(value reflect.Value) reflect.Value {
-	switch value.Kind() {
-	case reflect.Invalid:
-		return reflect.ValueOf(0)
-
-	case reflect.Bool:
-		switch value.Bool() {
-		case true:
-			return reflect.ValueOf(1)
-		case false:
-			return reflect.ValueOf(0)
-		}
-
-	case reflect.String:
-		if value.String() == "" {
-			return reflect.ValueOf(0)
-		}
-
-		// try to parse the string as a number
-		evaluated, err := impl.Evaluate(value.String(), DefaultStatusCheckNone)
-		if err != nil {
-			return reflect.ValueOf(math.NaN())
-		}
-
-		if value := reflect.ValueOf(evaluated); impl.isNumber(value) {
-			return value
-		}
-	}
-
-	return reflect.ValueOf(math.NaN())
-}
-
-// CoerceToString converts an evaluated expression value to a string the way GitHub does,
-// see https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#operators
-// An already reflected value is accepted as-is, since Interface() would panic on an invalid one.
-func CoerceToString(v any) string {
-	value, ok := v.(reflect.Value)
-	if !ok {
-		value = reflect.ValueOf(v)
-	}
-
-	switch value.Kind() {
-	case reflect.Invalid:
-		return ""
-
-	case reflect.Bool:
-		return strconv.FormatBool(value.Bool())
-
-	case reflect.String:
-		return value.String()
-
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return strconv.FormatInt(value.Int(), 10)
-
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		return strconv.FormatUint(value.Uint(), 10)
-
-	case reflect.Float32, reflect.Float64:
-		if math.IsInf(value.Float(), 1) {
-			return "Infinity"
-		} else if math.IsInf(value.Float(), -1) {
-			return "-Infinity"
-		}
-		return fmt.Sprintf("%.15G", value.Float())
-
-	case reflect.Slice, reflect.Array:
-		return "Array"
-
-	// contexts such as `github` are pointers to structs, so they stringify as objects too
-	case reflect.Map, reflect.Struct:
-		return "Object"
-
-	case reflect.Interface, reflect.Pointer:
-		if value.IsNil() {
-			return ""
-		}
-		return CoerceToString(value.Elem())
-	}
-
-	return fmt.Sprintf("%v", value)
-}
-
-func (impl *interperterImpl) compareString(left, right string, kind actionlint.CompareOpNodeKind) (bool, error) {
-	switch kind {
-	case actionlint.CompareOpNodeKindLess:
-		return left < right, nil
-	case actionlint.CompareOpNodeKindLessEq:
-		return left <= right, nil
-	case actionlint.CompareOpNodeKindGreater:
-		return left > right, nil
-	case actionlint.CompareOpNodeKindGreaterEq:
-		return left >= right, nil
-	case actionlint.CompareOpNodeKindEq:
-		return left == right, nil
-	case actionlint.CompareOpNodeKindNotEq:
-		return left != right, nil
-	default:
-		return false, fmt.Errorf("TODO: not implemented to compare '%+v'", kind)
-	}
-}
-
-func (impl *interperterImpl) compareNumber(left, right float64, kind actionlint.CompareOpNodeKind) (bool, error) {
-	switch kind {
-	case actionlint.CompareOpNodeKindLess:
-		return left < right, nil
-	case actionlint.CompareOpNodeKindLessEq:
-		return left <= right, nil
-	case actionlint.CompareOpNodeKindGreater:
-		return left > right, nil
-	case actionlint.CompareOpNodeKindGreaterEq:
-		return left >= right, nil
-	case actionlint.CompareOpNodeKindEq:
-		return left == right, nil
-	case actionlint.CompareOpNodeKindNotEq:
-		return left != right, nil
-	default:
-		return false, fmt.Errorf("TODO: not implemented to compare '%+v'", kind)
-	}
-}
-
-func IsTruthy(input any) bool {
-	value := reflect.ValueOf(input)
-	switch value.Kind() {
-	case reflect.Bool:
-		return value.Bool()
-
-	case reflect.String:
-		return value.String() != ""
-
-	case reflect.Int:
-		return value.Int() != 0
-
-	case reflect.Float64:
-		if math.IsNaN(value.Float()) {
-			return false
-		}
-
-		return value.Float() != 0
-
-	case reflect.Map, reflect.Slice:
-		return true
-
-	default:
-		return false
-	}
-}
-
-func (impl *interperterImpl) isNumber(value reflect.Value) bool {
-	switch value.Kind() {
-	case reflect.Int, reflect.Float64:
-		return true
-	default:
-		return false
-	}
-}
-
-func (impl *interperterImpl) getSafeValue(value reflect.Value) any {
-	switch value.Kind() {
-	case reflect.Invalid:
-		return nil
-
-	case reflect.Float64:
-		if value.Float() == 0 {
-			return 0
-		}
-	}
-
-	return value.Interface()
-}
-
-func (impl *interperterImpl) evaluateLogicalCompare(compareNode *actionlint.LogicalOpNode) (any, error) {
-	left, err := impl.evaluateNode(compareNode.Left)
-	if err != nil {
-		return nil, err
-	}
-
-	leftValue := reflect.ValueOf(left)
-
-	if IsTruthy(left) == (compareNode.Kind == actionlint.LogicalOpNodeKindOr) {
-		return impl.getSafeValue(leftValue), nil
-	}
-
-	right, err := impl.evaluateNode(compareNode.Right)
-	if err != nil {
-		return nil, err
-	}
-
-	rightValue := reflect.ValueOf(right)
-
-	switch compareNode.Kind {
-	case actionlint.LogicalOpNodeKindAnd:
-		return impl.getSafeValue(rightValue), nil
-	case actionlint.LogicalOpNodeKindOr:
-		return impl.getSafeValue(rightValue), nil
-	}
-
-	return nil, fmt.Errorf("Unable to compare incompatibles types '%s' and '%s'", leftValue.Kind(), rightValue.Kind())
-}
-
-func (impl *interperterImpl) evaluateFuncCall(funcCallNode *actionlint.FuncCallNode) (any, error) {
-	args := make([]reflect.Value, 0)
-
-	for _, arg := range funcCallNode.Args {
-		value, err := impl.evaluateNode(arg)
-		if err != nil {
-			return nil, err
-		}
-
-		args = append(args, reflect.ValueOf(value))
-	}
-
-	switch strings.ToLower(funcCallNode.Callee) {
-	case "contains":
-		return impl.contains(args[0], args[1])
-	case "startswith":
-		return impl.startsWith(args[0], args[1])
-	case "endswith":
-		return impl.endsWith(args[0], args[1])
-	case "format":
-		return impl.format(args[0], args[1:]...)
-	case "join":
-		if len(args) == 1 {
-			return impl.join(args[0], reflect.ValueOf(","))
-		}
-		return impl.join(args[0], args[1])
-	case "tojson":
-		return impl.toJSON(args[0])
-	case "fromjson":
-		return impl.fromJSON(args[0])
-	case "hashfiles":
-		if impl.env.HashFiles != nil {
-			return impl.env.HashFiles(args)
-		}
-		return impl.hashFiles(args...)
-	case "always":
-		return impl.always()
-	case "success":
-		if impl.config.Context == "job" {
-			return impl.jobSuccess()
-		}
-		if impl.config.Context == "step" {
-			return impl.stepSuccess()
-		}
-		return nil, fmt.Errorf("Context '%s' must be one of 'job' or 'step'", impl.config.Context)
-	case "failure":
-		if impl.config.Context == "job" {
-			return impl.jobFailure()
-		}
-		if impl.config.Context == "step" {
-			return impl.stepFailure()
-		}
-		return nil, fmt.Errorf("Context '%s' must be one of 'job' or 'step'", impl.config.Context)
-	case "cancelled":
-		return impl.cancelled()
-	default:
-		return nil, fmt.Errorf("TODO: '%s' not implemented", funcCallNode.Callee)
-	}
-}

act/exprparser/interpreter_test.go

@@ -1,691 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package exprparser
-
-import (
-	"math"
-	"reflect"
-	"testing"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLiterals(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"true", true, "true"},
-		{"false", false, "false"},
-		{"null", nil, "null"},
-		{"123", 123, "integer"},
-		{"-9.7", -9.7, "float"},
-		{"0xff", 255, "hex"},
-		{"-2.99e-2", -2.99e-2, "exponential"},
-		{"'foo'", "foo", "string"},
-		{"'it''s foo'", "it's foo", "string"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestOperators(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-		error    string
-	}{
-		{"(false || (false || true))", true, "logical-grouping", ""},
-		{"github.action", "push", "property-dereference", ""},
-		{"github['action']", "push", "property-index", ""},
-		{"github.action[0]", nil, "string-index", ""},
-		{"github.action['0']", nil, "string-index", ""},
-		{"fromJSON('[0,1]')[1]", 1.0, "array-index", ""},
-		{"fromJSON('[0,1]')[1.1]", nil, "array-index", ""},
-		// Disabled weird things are happening
-		// {"fromJSON('[0,1]')['1.1']", nil, "array-index", ""},
-		{"(github.event.commits.*.author.username)[0]", "someone", "array-index-0", ""},
-		{"fromJSON('[0,1]')[2]", nil, "array-index-out-of-bounds-0", ""},
-		{"fromJSON('[0,1]')[34553]", nil, "array-index-out-of-bounds-1", ""},
-		{"fromJSON('[0,1]')[-1]", nil, "array-index-out-of-bounds-2", ""},
-		{"fromJSON('[0,1]')[-34553]", nil, "array-index-out-of-bounds-3", ""},
-		{"!true", false, "not", ""},
-		{"1 < 2", true, "less-than", ""},
-		{`'b' <= 'a'`, false, "less-than-or-equal", ""},
-		{"1 > 2", false, "greater-than", ""},
-		{`'b' >= 'a'`, true, "greater-than-or-equal", ""},
-		{`'a' == 'a'`, true, "equal", ""},
-		{`'a' != 'a'`, false, "not-equal", ""},
-		{`true && false`, false, "and", ""},
-		{`true || false`, true, "or", ""},
-		{`fromJSON('{}') && true`, true, "and-boolean-object", ""},
-		{`fromJSON('{}') || false`, make(map[string]any), "or-boolean-object", ""},
-		{"github.event.commits[0].author.username != github.event.commits[1].author.username", true, "property-comparison1", ""},
-		{"github.event.commits[0].author.username1 != github.event.commits[1].author.username", true, "property-comparison2", ""},
-		{"github.event.commits[0].author.username != github.event.commits[1].author.username1", true, "property-comparison3", ""},
-		{"github.event.commits[0].author.username1 != github.event.commits[1].author.username2", true, "property-comparison4", ""},
-		{"secrets != env", nil, "property-comparison5", "Compare not implemented for types: left: map, right: map"},
-	}
-
-	env := &EvaluationEnvironment{
-		Github: &model.GithubContext{
-			Action: "push",
-			Event: map[string]any{
-				"commits": []any{
-					map[string]any{
-						"author": map[string]any{
-							"username": "someone",
-						},
-					},
-					map[string]any{
-						"author": map[string]any{
-							"username": "someone-else",
-						},
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			if tt.error != "" {
-				assert.Error(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-				assert.Equal(t, tt.error, err.Error())
-			} else {
-				assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			}
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestOperatorsCompare(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"!null", true, "not-null"},
-		{"!-10", false, "not-neg-num"},
-		{"!0", true, "not-zero"},
-		{"!3.14", false, "not-pos-float"},
-		{"!''", true, "not-empty-str"},
-		{"!'abc'", false, "not-str"},
-		{"!fromJSON('{}')", false, "not-obj"},
-		{"!fromJSON('[]')", false, "not-arr"},
-		{`null == 0 }}`, true, "null-coercion"},
-		{`true == 1 }}`, true, "boolean-coercion"},
-		{`'' == 0 }}`, true, "string-0-coercion"},
-		{`'3' == 3 }}`, true, "string-3-coercion"},
-		{`0 == null }}`, true, "null-coercion-alt"},
-		{`1 == true }}`, true, "boolean-coercion-alt"},
-		{`0 == '' }}`, true, "string-0-coercion-alt"},
-		{`3 == '3' }}`, true, "string-3-coercion-alt"},
-		{`'TEST' == 'test' }}`, true, "string-casing"},
-		{"true > false }}", true, "bool-greater-than"},
-		{"true >= false }}", true, "bool-greater-than-eq"},
-		{"true >= true }}", true, "bool-greater-than-1"},
-		{"true != false }}", true, "bool-not-equal"},
-		{`fromJSON('{}') < 2 }}`, false, "object-with-less"},
-		{`fromJSON('{}') < fromJSON('[]') }}`, false, "object/arr-with-lt"},
-		{`fromJSON('{}') > fromJSON('[]') }}`, false, "object/arr-with-gt"},
-	}
-
-	env := &EvaluationEnvironment{
-		Github: &model.GithubContext{
-			Action: "push",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestOperatorsBooleanEvaluation(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		// true &&
-		{"true && true", true, "true-and"},
-		{"true && false", false, "true-and"},
-		{"true && null", nil, "true-and"},
-		{"true && -10", -10, "true-and"},
-		{"true && 0", 0, "true-and"},
-		{"true && 10", 10, "true-and"},
-		{"true && 3.14", 3.14, "true-and"},
-		{"true && 0.0", 0, "true-and"},
-		{"true && Infinity", math.Inf(1), "true-and"},
-		// {"true && -Infinity", math.Inf(-1), "true-and"},
-		{"true && NaN", math.NaN(), "true-and"},
-		{"true && ''", "", "true-and"},
-		{"true && 'abc'", "abc", "true-and"},
-		// false &&
-		{"false && true", false, "false-and"},
-		{"false && false", false, "false-and"},
-		{"false && null", false, "false-and"},
-		{"false && -10", false, "false-and"},
-		{"false && 0", false, "false-and"},
-		{"false && 10", false, "false-and"},
-		{"false && 3.14", false, "false-and"},
-		{"false && 0.0", false, "false-and"},
-		{"false && Infinity", false, "false-and"},
-		// {"false && -Infinity", false, "false-and"},
-		{"false && NaN", false, "false-and"},
-		{"false && ''", false, "false-and"},
-		{"false && 'abc'", false, "false-and"},
-		// true ||
-		{"true || true", true, "true-or"},
-		{"true || false", true, "true-or"},
-		{"true || null", true, "true-or"},
-		{"true || -10", true, "true-or"},
-		{"true || 0", true, "true-or"},
-		{"true || 10", true, "true-or"},
-		{"true || 3.14", true, "true-or"},
-		{"true || 0.0", true, "true-or"},
-		{"true || Infinity", true, "true-or"},
-		// {"true || -Infinity", true, "true-or"},
-		{"true || NaN", true, "true-or"},
-		{"true || ''", true, "true-or"},
-		{"true || 'abc'", true, "true-or"},
-		// false ||
-		{"false || true", true, "false-or"},
-		{"false || false", false, "false-or"},
-		{"false || null", nil, "false-or"},
-		{"false || -10", -10, "false-or"},
-		{"false || 0", 0, "false-or"},
-		{"false || 10", 10, "false-or"},
-		{"false || 3.14", 3.14, "false-or"},
-		{"false || 0.0", 0, "false-or"},
-		{"false || Infinity", math.Inf(1), "false-or"},
-		// {"false || -Infinity", math.Inf(-1), "false-or"},
-		{"false || NaN", math.NaN(), "false-or"},
-		{"false || ''", "", "false-or"},
-		{"false || 'abc'", "abc", "false-or"},
-		// null &&
-		{"null && true", nil, "null-and"},
-		{"null && false", nil, "null-and"},
-		{"null && null", nil, "null-and"},
-		{"null && -10", nil, "null-and"},
-		{"null && 0", nil, "null-and"},
-		{"null && 10", nil, "null-and"},
-		{"null && 3.14", nil, "null-and"},
-		{"null && 0.0", nil, "null-and"},
-		{"null && Infinity", nil, "null-and"},
-		// {"null && -Infinity", nil, "null-and"},
-		{"null && NaN", nil, "null-and"},
-		{"null && ''", nil, "null-and"},
-		{"null && 'abc'", nil, "null-and"},
-		// null ||
-		{"null || true", true, "null-or"},
-		{"null || false", false, "null-or"},
-		{"null || null", nil, "null-or"},
-		{"null || -10", -10, "null-or"},
-		{"null || 0", 0, "null-or"},
-		{"null || 10", 10, "null-or"},
-		{"null || 3.14", 3.14, "null-or"},
-		{"null || 0.0", 0, "null-or"},
-		{"null || Infinity", math.Inf(1), "null-or"},
-		// {"null || -Infinity", math.Inf(-1), "null-or"},
-		{"null || NaN", math.NaN(), "null-or"},
-		{"null || ''", "", "null-or"},
-		{"null || 'abc'", "abc", "null-or"},
-		// -10 &&
-		{"-10 && true", true, "neg-num-and"},
-		{"-10 && false", false, "neg-num-and"},
-		{"-10 && null", nil, "neg-num-and"},
-		{"-10 && -10", -10, "neg-num-and"},
-		{"-10 && 0", 0, "neg-num-and"},
-		{"-10 && 10", 10, "neg-num-and"},
-		{"-10 && 3.14", 3.14, "neg-num-and"},
-		{"-10 && 0.0", 0, "neg-num-and"},
-		{"-10 && Infinity", math.Inf(1), "neg-num-and"},
-		// {"-10 && -Infinity", math.Inf(-1), "neg-num-and"},
-		{"-10 && NaN", math.NaN(), "neg-num-and"},
-		{"-10 && ''", "", "neg-num-and"},
-		{"-10 && 'abc'", "abc", "neg-num-and"},
-		// -10 ||
-		{"-10 || true", -10, "neg-num-or"},
-		{"-10 || false", -10, "neg-num-or"},
-		{"-10 || null", -10, "neg-num-or"},
-		{"-10 || -10", -10, "neg-num-or"},
-		{"-10 || 0", -10, "neg-num-or"},
-		{"-10 || 10", -10, "neg-num-or"},
-		{"-10 || 3.14", -10, "neg-num-or"},
-		{"-10 || 0.0", -10, "neg-num-or"},
-		{"-10 || Infinity", -10, "neg-num-or"},
-		// {"-10 || -Infinity", -10, "neg-num-or"},
-		{"-10 || NaN", -10, "neg-num-or"},
-		{"-10 || ''", -10, "neg-num-or"},
-		{"-10 || 'abc'", -10, "neg-num-or"},
-		// 0 &&
-		{"0 && true", 0, "zero-and"},
-		{"0 && false", 0, "zero-and"},
-		{"0 && null", 0, "zero-and"},
-		{"0 && -10", 0, "zero-and"},
-		{"0 && 0", 0, "zero-and"},
-		{"0 && 10", 0, "zero-and"},
-		{"0 && 3.14", 0, "zero-and"},
-		{"0 && 0.0", 0, "zero-and"},
-		{"0 && Infinity", 0, "zero-and"},
-		// {"0 && -Infinity", 0, "zero-and"},
-		{"0 && NaN", 0, "zero-and"},
-		{"0 && ''", 0, "zero-and"},
-		{"0 && 'abc'", 0, "zero-and"},
-		// 0 ||
-		{"0 || true", true, "zero-or"},
-		{"0 || false", false, "zero-or"},
-		{"0 || null", nil, "zero-or"},
-		{"0 || -10", -10, "zero-or"},
-		{"0 || 0", 0, "zero-or"},
-		{"0 || 10", 10, "zero-or"},
-		{"0 || 3.14", 3.14, "zero-or"},
-		{"0 || 0.0", 0, "zero-or"},
-		{"0 || Infinity", math.Inf(1), "zero-or"},
-		// {"0 || -Infinity", math.Inf(-1), "zero-or"},
-		{"0 || NaN", math.NaN(), "zero-or"},
-		{"0 || ''", "", "zero-or"},
-		{"0 || 'abc'", "abc", "zero-or"},
-		// 10 &&
-		{"10 && true", true, "pos-num-and"},
-		{"10 && false", false, "pos-num-and"},
-		{"10 && null", nil, "pos-num-and"},
-		{"10 && -10", -10, "pos-num-and"},
-		{"10 && 0", 0, "pos-num-and"},
-		{"10 && 10", 10, "pos-num-and"},
-		{"10 && 3.14", 3.14, "pos-num-and"},
-		{"10 && 0.0", 0, "pos-num-and"},
-		{"10 && Infinity", math.Inf(1), "pos-num-and"},
-		// {"10 && -Infinity", math.Inf(-1), "pos-num-and"},
-		{"10 && NaN", math.NaN(), "pos-num-and"},
-		{"10 && ''", "", "pos-num-and"},
-		{"10 && 'abc'", "abc", "pos-num-and"},
-		// 10 ||
-		{"10 || true", 10, "pos-num-or"},
-		{"10 || false", 10, "pos-num-or"},
-		{"10 || null", 10, "pos-num-or"},
-		{"10 || -10", 10, "pos-num-or"},
-		{"10 || 0", 10, "pos-num-or"},
-		{"10 || 10", 10, "pos-num-or"},
-		{"10 || 3.14", 10, "pos-num-or"},
-		{"10 || 0.0", 10, "pos-num-or"},
-		{"10 || Infinity", 10, "pos-num-or"},
-		// {"10 || -Infinity", 10, "pos-num-or"},
-		{"10 || NaN", 10, "pos-num-or"},
-		{"10 || ''", 10, "pos-num-or"},
-		{"10 || 'abc'", 10, "pos-num-or"},
-		// 3.14 &&
-		{"3.14 && true", true, "pos-float-and"},
-		{"3.14 && false", false, "pos-float-and"},
-		{"3.14 && null", nil, "pos-float-and"},
-		{"3.14 && -10", -10, "pos-float-and"},
-		{"3.14 && 0", 0, "pos-float-and"},
-		{"3.14 && 10", 10, "pos-float-and"},
-		{"3.14 && 3.14", 3.14, "pos-float-and"},
-		{"3.14 && 0.0", 0, "pos-float-and"},
-		{"3.14 && Infinity", math.Inf(1), "pos-float-and"},
-		// {"3.14 && -Infinity", math.Inf(-1), "pos-float-and"},
-		{"3.14 && NaN", math.NaN(), "pos-float-and"},
-		{"3.14 && ''", "", "pos-float-and"},
-		{"3.14 && 'abc'", "abc", "pos-float-and"},
-		// 3.14 ||
-		{"3.14 || true", 3.14, "pos-float-or"},
-		{"3.14 || false", 3.14, "pos-float-or"},
-		{"3.14 || null", 3.14, "pos-float-or"},
-		{"3.14 || -10", 3.14, "pos-float-or"},
-		{"3.14 || 0", 3.14, "pos-float-or"},
-		{"3.14 || 10", 3.14, "pos-float-or"},
-		{"3.14 || 3.14", 3.14, "pos-float-or"},
-		{"3.14 || 0.0", 3.14, "pos-float-or"},
-		{"3.14 || Infinity", 3.14, "pos-float-or"},
-		// {"3.14 || -Infinity", 3.14, "pos-float-or"},
-		{"3.14 || NaN", 3.14, "pos-float-or"},
-		{"3.14 || ''", 3.14, "pos-float-or"},
-		{"3.14 || 'abc'", 3.14, "pos-float-or"},
-		// Infinity &&
-		{"Infinity && true", true, "pos-inf-and"},
-		{"Infinity && false", false, "pos-inf-and"},
-		{"Infinity && null", nil, "pos-inf-and"},
-		{"Infinity && -10", -10, "pos-inf-and"},
-		{"Infinity && 0", 0, "pos-inf-and"},
-		{"Infinity && 10", 10, "pos-inf-and"},
-		{"Infinity && 3.14", 3.14, "pos-inf-and"},
-		{"Infinity && 0.0", 0, "pos-inf-and"},
-		{"Infinity && Infinity", math.Inf(1), "pos-inf-and"},
-		// {"Infinity && -Infinity", math.Inf(-1), "pos-inf-and"},
-		{"Infinity && NaN", math.NaN(), "pos-inf-and"},
-		{"Infinity && ''", "", "pos-inf-and"},
-		{"Infinity && 'abc'", "abc", "pos-inf-and"},
-		// Infinity ||
-		{"Infinity || true", math.Inf(1), "pos-inf-or"},
-		{"Infinity || false", math.Inf(1), "pos-inf-or"},
-		{"Infinity || null", math.Inf(1), "pos-inf-or"},
-		{"Infinity || -10", math.Inf(1), "pos-inf-or"},
-		{"Infinity || 0", math.Inf(1), "pos-inf-or"},
-		{"Infinity || 10", math.Inf(1), "pos-inf-or"},
-		{"Infinity || 3.14", math.Inf(1), "pos-inf-or"},
-		{"Infinity || 0.0", math.Inf(1), "pos-inf-or"},
-		{"Infinity || Infinity", math.Inf(1), "pos-inf-or"},
-		// {"Infinity || -Infinity", math.Inf(1), "pos-inf-or"},
-		{"Infinity || NaN", math.Inf(1), "pos-inf-or"},
-		{"Infinity || ''", math.Inf(1), "pos-inf-or"},
-		{"Infinity || 'abc'", math.Inf(1), "pos-inf-or"},
-		// -Infinity &&
-		// {"-Infinity && true", true, "neg-inf-and"},
-		// {"-Infinity && false", false, "neg-inf-and"},
-		// {"-Infinity && null", nil, "neg-inf-and"},
-		// {"-Infinity && -10", -10, "neg-inf-and"},
-		// {"-Infinity && 0", 0, "neg-inf-and"},
-		// {"-Infinity && 10", 10, "neg-inf-and"},
-		// {"-Infinity && 3.14", 3.14, "neg-inf-and"},
-		// {"-Infinity && 0.0", 0, "neg-inf-and"},
-		// {"-Infinity && Infinity", math.Inf(1), "neg-inf-and"},
-		// {"-Infinity && -Infinity", math.Inf(-1), "neg-inf-and"},
-		// {"-Infinity && NaN", math.NaN(), "neg-inf-and"},
-		// {"-Infinity && ''", "", "neg-inf-and"},
-		// {"-Infinity && 'abc'", "abc", "neg-inf-and"},
-		// -Infinity ||
-		// {"-Infinity || true", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || false", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || null", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || -10", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || 0", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || 10", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || 3.14", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || 0.0", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || Infinity", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || -Infinity", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || NaN", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || ''", math.Inf(-1), "neg-inf-or"},
-		// {"-Infinity || 'abc'", math.Inf(-1), "neg-inf-or"},
-		// NaN &&
-		{"NaN && true", math.NaN(), "nan-and"},
-		{"NaN && false", math.NaN(), "nan-and"},
-		{"NaN && null", math.NaN(), "nan-and"},
-		{"NaN && -10", math.NaN(), "nan-and"},
-		{"NaN && 0", math.NaN(), "nan-and"},
-		{"NaN && 10", math.NaN(), "nan-and"},
-		{"NaN && 3.14", math.NaN(), "nan-and"},
-		{"NaN && 0.0", math.NaN(), "nan-and"},
-		{"NaN && Infinity", math.NaN(), "nan-and"},
-		// {"NaN && -Infinity", math.NaN(), "nan-and"},
-		{"NaN && NaN", math.NaN(), "nan-and"},
-		{"NaN && ''", math.NaN(), "nan-and"},
-		{"NaN && 'abc'", math.NaN(), "nan-and"},
-		// NaN ||
-		{"NaN || true", true, "nan-or"},
-		{"NaN || false", false, "nan-or"},
-		{"NaN || null", nil, "nan-or"},
-		{"NaN || -10", -10, "nan-or"},
-		{"NaN || 0", 0, "nan-or"},
-		{"NaN || 10", 10, "nan-or"},
-		{"NaN || 3.14", 3.14, "nan-or"},
-		{"NaN || 0.0", 0, "nan-or"},
-		{"NaN || Infinity", math.Inf(1), "nan-or"},
-		// {"NaN || -Infinity", math.Inf(-1), "nan-or"},
-		{"NaN || NaN", math.NaN(), "nan-or"},
-		{"NaN || ''", "", "nan-or"},
-		{"NaN || 'abc'", "abc", "nan-or"},
-		// "" &&
-		{"'' && true", "", "empty-str-and"},
-		{"'' && false", "", "empty-str-and"},
-		{"'' && null", "", "empty-str-and"},
-		{"'' && -10", "", "empty-str-and"},
-		{"'' && 0", "", "empty-str-and"},
-		{"'' && 10", "", "empty-str-and"},
-		{"'' && 3.14", "", "empty-str-and"},
-		{"'' && 0.0", "", "empty-str-and"},
-		{"'' && Infinity", "", "empty-str-and"},
-		// {"'' && -Infinity", "", "empty-str-and"},
-		{"'' && NaN", "", "empty-str-and"},
-		{"'' && ''", "", "empty-str-and"},
-		{"'' && 'abc'", "", "empty-str-and"},
-		// "" ||
-		{"'' || true", true, "empty-str-or"},
-		{"'' || false", false, "empty-str-or"},
-		{"'' || null", nil, "empty-str-or"},
-		{"'' || -10", -10, "empty-str-or"},
-		{"'' || 0", 0, "empty-str-or"},
-		{"'' || 10", 10, "empty-str-or"},
-		{"'' || 3.14", 3.14, "empty-str-or"},
-		{"'' || 0.0", 0, "empty-str-or"},
-		{"'' || Infinity", math.Inf(1), "empty-str-or"},
-		// {"'' || -Infinity", math.Inf(-1), "empty-str-or"},
-		{"'' || NaN", math.NaN(), "empty-str-or"},
-		{"'' || ''", "", "empty-str-or"},
-		{"'' || 'abc'", "abc", "empty-str-or"},
-		// "abc" &&
-		{"'abc' && true", true, "str-and"},
-		{"'abc' && false", false, "str-and"},
-		{"'abc' && null", nil, "str-and"},
-		{"'abc' && -10", -10, "str-and"},
-		{"'abc' && 0", 0, "str-and"},
-		{"'abc' && 10", 10, "str-and"},
-		{"'abc' && 3.14", 3.14, "str-and"},
-		{"'abc' && 0.0", 0, "str-and"},
-		{"'abc' && Infinity", math.Inf(1), "str-and"},
-		// {"'abc' && -Infinity", math.Inf(-1), "str-and"},
-		{"'abc' && NaN", math.NaN(), "str-and"},
-		{"'abc' && ''", "", "str-and"},
-		{"'abc' && 'abc'", "abc", "str-and"},
-		// "abc" ||
-		{"'abc' || true", "abc", "str-or"},
-		{"'abc' || false", "abc", "str-or"},
-		{"'abc' || null", "abc", "str-or"},
-		{"'abc' || -10", "abc", "str-or"},
-		{"'abc' || 0", "abc", "str-or"},
-		{"'abc' || 10", "abc", "str-or"},
-		{"'abc' || 3.14", "abc", "str-or"},
-		{"'abc' || 0.0", "abc", "str-or"},
-		{"'abc' || Infinity", "abc", "str-or"},
-		// {"'abc' || -Infinity", "abc", "str-or"},
-		{"'abc' || NaN", "abc", "str-or"},
-		{"'abc' || ''", "abc", "str-or"},
-		{"'abc' || 'abc'", "abc", "str-or"},
-		// extra tests
-		{"0.0 && true", 0, "float-evaluation-0-alt"},
-		{"-1.5 && true", true, "float-evaluation-neg-alt"},
-	}
-
-	env := &EvaluationEnvironment{
-		Github: &model.GithubContext{
-			Action: "push",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			if expected, ok := tt.expected.(float64); ok && math.IsNaN(expected) {
-				number, ok := output.(float64)
-				require.True(t, ok, "want a number, got %T", output)
-				assert.True(t, math.IsNaN(number))
-			} else {
-				assert.Equal(t, tt.expected, output)
-			}
-		})
-	}
-}
-
-func TestContexts(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"github.action", "push", "github-context"},
-		{"github.event.commits[0].message", nil, "github-context-noexist-prop"},
-		{"fromjson('{\"commits\":[]}').commits[0].message", nil, "github-context-noexist-prop"},
-		{"github.event.pull_request.labels.*.name", nil, "github-context-noexist-prop"},
-		{"env.TEST", "value", "env-context"},
-		{"job.status", "success", "job-context"},
-		{"steps.step-id.outputs.name", "value", "steps-context"},
-		{"steps.step-id.conclusion", "success", "steps-context-conclusion"},
-		{"steps.step-id.conclusion && true", true, "steps-context-conclusion"},
-		{"steps.step-id2.conclusion", "skipped", "steps-context-conclusion"},
-		{"steps.step-id2.conclusion && true", true, "steps-context-conclusion"},
-		{"steps.step-id.outcome", "success", "steps-context-outcome"},
-		{"steps.step-id['outcome']", "success", "steps-context-outcome"},
-		{"steps.step-id.outcome == 'success'", true, "steps-context-outcome"},
-		{"steps.step-id['outcome'] == 'success'", true, "steps-context-outcome"},
-		{"steps.step-id.outcome && true", true, "steps-context-outcome"},
-		{"steps['step-id']['outcome'] && true", true, "steps-context-outcome"},
-		{"steps.step-id2.outcome", "failure", "steps-context-outcome"},
-		{"steps.step-id2.outcome && true", true, "steps-context-outcome"},
-		// Disabled, since the interpreter is still too broken
-		// {"contains(steps.*.outcome, 'success')", true, "steps-context-array-outcome"},
-		// {"contains(steps.*.outcome, 'failure')", true, "steps-context-array-outcome"},
-		// {"contains(steps.*.outputs.name, 'value')", true, "steps-context-array-outputs"},
-		{"runner.os", "Linux", "runner-context"},
-		{"secrets.name", "value", "secrets-context"},
-		{"vars.name", "value", "vars-context"},
-		{"strategy.fail-fast", true, "strategy-context"},
-		{"matrix.os", "Linux", "matrix-context"},
-		{"needs.job-id.outputs.output-name", "value", "needs-context"},
-		{"needs.job-id.result", "success", "needs-context"},
-		{"inputs.name", "value", "inputs-context"},
-	}
-
-	env := &EvaluationEnvironment{
-		Github: &model.GithubContext{
-			Action: "push",
-		},
-		Env: map[string]string{
-			"TEST": "value",
-		},
-		Job: &model.JobContext{
-			Status: "success",
-		},
-		Steps: map[string]*model.StepResult{
-			"step-id": {
-				Outputs: map[string]string{
-					"name": "value",
-				},
-			},
-			"step-id2": {
-				Outcome:    model.StepStatusFailure,
-				Conclusion: model.StepStatusSkipped,
-			},
-		},
-		Runner: map[string]any{
-			"os":         "Linux",
-			"temp":       "/tmp",
-			"tool_cache": "/opt/hostedtoolcache",
-		},
-		Secrets: map[string]string{
-			"name": "value",
-		},
-		Vars: map[string]string{
-			"name": "value",
-		},
-		Strategy: map[string]any{
-			"fail-fast": true,
-		},
-		Matrix: map[string]any{
-			"os": "Linux",
-		},
-		Needs: map[string]Needs{
-			"job-id": {
-				Outputs: map[string]string{
-					"output-name": "value",
-				},
-				Result: "success",
-			},
-		},
-		Inputs: map[string]any{
-			"name": "value",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestCoerceToString(t *testing.T) {
-	type object struct{ Name string }
-	obj := object{Name: "x"}
-	var nilPointer *object
-	var nilMap map[string]any
-	var nilSlice []any
-
-	table := []struct {
-		input    any
-		expected string
-		name     string
-	}{
-		{nil, "", "null"},
-		{true, "true", "true"},
-		{false, "false", "false"},
-		{"foo", "foo", "string"},
-		{"", "", "empty-string"},
-		{123, "123", "int"},
-		{int64(-9), "-9", "int64"},
-		{uint8(7), "7", "uint8"},
-		{1.0, "1", "float-integral"},
-		{-9.7, "-9.7", "float"},
-		{2.99e-2, "0.0299", "float-exponential"},
-		{1e21, "1E+21", "float-large"},
-		{float32(1.5), "1.5", "float32"},
-		{math.NaN(), "NaN", "nan"},
-		{math.Inf(1), "Infinity", "positive-infinity"},
-		{math.Inf(-1), "-Infinity", "negative-infinity"},
-		{[]any{1, 2}, "Array", "slice"},
-		{nilSlice, "Array", "nil-slice"},
-		{[2]int{1, 2}, "Array", "fixed-size-array"},
-		{map[string]any{"a": 1}, "Object", "map"},
-		{nilMap, "Object", "nil-map"},
-		{obj, "Object", "struct"},
-		{&obj, "Object", "pointer-to-struct"},
-		{nilPointer, "", "nil-pointer"},
-		{&model.GithubContext{Action: "push"}, "Object", "github-context"},
-		{reflect.ValueOf(42), "42", "reflected-value"},
-		{reflect.Value{}, "", "invalid-reflected-value"},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, CoerceToString(tt.input))
-		})
-	}
-}
-
-func TestEvaluateEmptyInputAsksItsOwnStatusCheck(t *testing.T) {
-	// always() needs no job or step context, so it shows which function an empty input asks for
-	output, err := NewInterpeter(&EvaluationEnvironment{}, Config{}).Evaluate("", DefaultStatusCheckAlways)
-	require.NoError(t, err)
-	assert.Equal(t, true, output)
-}

act/exprparser/testdata/for-hashing-1.txt

@@ -1 +0,0 @@
-Hello

act/exprparser/testdata/for-hashing-2.txt

@@ -1 +0,0 @@
-World!

act/exprparser/testdata/for-hashing-3/data.txt

@@ -1 +0,0 @@
-Knock knock!

act/exprparser/testdata/for-hashing-3/nested/nested-data.txt

@@ -1 +0,0 @@
-Anybody home?

act/ghcontext/github_context.go

@@ -0,0 +1,138 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2021 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Package ghcontext fills a model.GithubContext from the local git checkout.
+// The pure data parts of the context live in the shared
+// gitea.dev/actionslib/pkg/model package, only the helpers that need a
+// git repository on disk are kept here.
+package ghcontext
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"gitea.com/gitea/runner/act/common"
+	"gitea.com/gitea/runner/act/common/git"
+
+	"gitea.dev/actionslib/pkg/model"
+)
+
+var (
+	findGitRef      = git.FindGitRef
+	findGitRevision = git.FindGitRevision
+	findGithubRepo  = git.FindGithubRepo
+)
+
+func withDefaultBranch(ctx context.Context, b string, event map[string]any) map[string]any {
+	repoI, ok := event["repository"]
+	if !ok {
+		repoI = make(map[string]any)
+	}
+
+	repo, ok := repoI.(map[string]any)
+	if !ok {
+		common.Logger(ctx).Warnf("unable to set default branch to %v", b)
+		return event
+	}
+
+	// if the branch is already there return with no changes
+	if _, ok = repo["default_branch"]; ok {
+		return event
+	}
+
+	repo["default_branch"] = b
+	event["repository"] = repo
+
+	return event
+}
+
+// SetRef resolves the ref of the context from its event payload, falling back
+// to the ref checked out in repoPath.
+func SetRef(ctx context.Context, ghc *model.GithubContext, defaultBranch, repoPath string) {
+	logger := common.Logger(ctx)
+
+	// https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
+	// https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads
+	switch ghc.EventName {
+	case "pull_request_target":
+		ghc.Ref = "refs/heads/" + ghc.BaseRef
+	case "pull_request", "pull_request_review", "pull_request_review_comment":
+		ghc.Ref = fmt.Sprintf("refs/pull/%.0f/merge", ghc.Event["number"])
+	case "deployment", "deployment_status":
+		ghc.Ref = model.AsString(model.NestedMapLookup(ghc.Event, "deployment", "ref"))
+	case "release":
+		ghc.Ref = "refs/tags/" + model.AsString(model.NestedMapLookup(ghc.Event, "release", "tag_name"))
+	case "push", "create", "workflow_dispatch":
+		ghc.Ref = model.AsString(ghc.Event["ref"])
+	default:
+		defaultBranch := model.AsString(model.NestedMapLookup(ghc.Event, "repository", "default_branch"))
+		if defaultBranch != "" {
+			ghc.Ref = "refs/heads/" + defaultBranch
+		}
+	}
+
+	if ghc.Ref == "" {
+		ref, err := findGitRef(ctx, repoPath)
+		if err != nil {
+			logger.Warningf("unable to get git ref: %v", err)
+		} else {
+			logger.Debugf("using github ref: %s", ref)
+			ghc.Ref = ref
+		}
+
+		// set the branch in the event data
+		if defaultBranch != "" {
+			ghc.Event = withDefaultBranch(ctx, defaultBranch, ghc.Event)
+		} else {
+			ghc.Event = withDefaultBranch(ctx, "master", ghc.Event)
+		}
+
+		if ghc.Ref == "" {
+			ghc.Ref = "refs/heads/" + model.AsString(model.NestedMapLookup(ghc.Event, "repository", "default_branch"))
+		}
+	}
+}
+
+// SetSha resolves the commit of the context from its event payload, falling
+// back to the revision checked out in repoPath.
+func SetSha(ctx context.Context, ghc *model.GithubContext, repoPath string) {
+	logger := common.Logger(ctx)
+
+	// https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
+	// https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads
+	switch ghc.EventName {
+	case "pull_request_target":
+		ghc.Sha = model.AsString(model.NestedMapLookup(ghc.Event, "pull_request", "base", "sha"))
+	case "deployment", "deployment_status":
+		ghc.Sha = model.AsString(model.NestedMapLookup(ghc.Event, "deployment", "sha"))
+	case "push", "create", "workflow_dispatch":
+		if deleted, ok := ghc.Event["deleted"].(bool); ok && !deleted {
+			ghc.Sha = model.AsString(ghc.Event["after"])
+		}
+	}
+
+	if ghc.Sha == "" {
+		_, sha, err := findGitRevision(ctx, repoPath)
+		if err != nil {
+			logger.Warningf("unable to get git revision: %v", err)
+		} else {
+			ghc.Sha = sha
+		}
+	}
+}
+
+// SetRepositoryAndOwner resolves the repository of the context from the git
+// remote in repoPath when it is not set yet, and derives its owner.
+func SetRepositoryAndOwner(ctx context.Context, ghc *model.GithubContext, githubInstance, remoteName, repoPath string) {
+	if ghc.Repository == "" {
+		repo, err := findGithubRepo(ctx, repoPath, githubInstance, remoteName)
+		if err != nil {
+			common.Logger(ctx).Warningf("unable to get git repo (githubInstance: %v; remoteName: %v, repoPath: %v): %v", githubInstance, remoteName, repoPath, err)
+			return
+		}
+		ghc.Repository = repo
+	}
+	ghc.RepositoryOwner = strings.Split(ghc.Repository, "/")[0]
+}

act/ghcontext/github_context_test.go

@@ -2,13 +2,14 @@
 // Copyright 2022 The nektos/act Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-package model
+package ghcontext
 
 import (
 	"context"
 	"errors"
 	"testing"
 
+	"gitea.dev/actionslib/pkg/model"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 )
@@ -97,13 +98,13 @@ func TestSetRef(t *testing.T) {
 
 	for _, table := range tables {
 		t.Run(table.eventName, func(t *testing.T) {
-			ghc := &GithubContext{
+			ghc := &model.GithubContext{
 				EventName: table.eventName,
 				BaseRef:   "master",
 				Event:     table.event,
 			}
 
-			ghc.SetRef(context.Background(), "main", "/some/dir")
+			SetRef(context.Background(), ghc, "main", "/some/dir")
 			ghc.SetRefTypeAndName()
 
 			assert.Equal(t, table.ref, ghc.Ref)
@@ -116,12 +117,12 @@ func TestSetRef(t *testing.T) {
 			return "", errors.New("no default branch")
 		}
 
-		ghc := &GithubContext{
+		ghc := &model.GithubContext{
 			EventName: "no-default-branch",
 			Event:     map[string]any{},
 		}
 
-		ghc.SetRef(context.Background(), "", "/some/dir")
+		SetRef(context.Background(), ghc, "", "/some/dir")
 
 		assert.Equal(t, "refs/heads/master", ghc.Ref)
 	})
@@ -202,13 +203,13 @@ func TestSetSha(t *testing.T) {
 
 	for _, table := range tables {
 		t.Run(table.eventName, func(t *testing.T) {
-			ghc := &GithubContext{
+			ghc := &model.GithubContext{
 				EventName: table.eventName,
 				BaseRef:   "master",
 				Event:     table.event,
 			}
 
-			ghc.SetSha(context.Background(), "/some/dir")
+			SetSha(context.Background(), ghc, "/some/dir")
 
 			assert.Equal(t, table.sha, ghc.Sha)
 		})

act/model/action.go

@@ -1,138 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"fmt"
-	"io"
-	"strings"
-
-	"go.yaml.in/yaml/v4"
-)
-
-// ActionRunsUsing is the type of runner for the action
-type ActionRunsUsing string
-
-func (a *ActionRunsUsing) UnmarshalYAML(unmarshal func(any) error) error {
-	var using string
-	if err := unmarshal(&using); err != nil {
-		return err
-	}
-
-	// Force input to lowercase for case insensitive comparison
-	format := ActionRunsUsing(strings.ToLower(using))
-	switch format {
-	case ActionRunsUsingNode24, ActionRunsUsingNode20, ActionRunsUsingNode16, ActionRunsUsingNode12, ActionRunsUsingDocker, ActionRunsUsingComposite, ActionRunsUsingGo:
-		*a = format
-	default:
-		return fmt.Errorf("The runs.using key in action.yml must be one of: %v, got %s", []string{
-			ActionRunsUsingComposite,
-			ActionRunsUsingDocker,
-			ActionRunsUsingNode12,
-			ActionRunsUsingNode16,
-			ActionRunsUsingNode20,
-			ActionRunsUsingNode24,
-			ActionRunsUsingGo,
-		}, format)
-	}
-	return nil
-}
-
-const (
-	// ActionRunsUsingNode12 for running with node12
-	ActionRunsUsingNode12 = "node12"
-	// ActionRunsUsingNode16 for running with node16
-	ActionRunsUsingNode16 = "node16"
-	// ActionRunsUsingNode20 for running with node20
-	ActionRunsUsingNode20 = "node20"
-	// ActionRunsUsingNode24 for running with node24
-	ActionRunsUsingNode24 = "node24"
-	// ActionRunsUsingDocker for running with docker
-	ActionRunsUsingDocker = "docker"
-	// ActionRunsUsingComposite for running composite
-	ActionRunsUsingComposite = "composite"
-	// ActionRunsUsingGo for running with go
-	ActionRunsUsingGo = "go"
-)
-
-func (a ActionRunsUsing) IsNode() bool {
-	switch a {
-	case ActionRunsUsingNode12, ActionRunsUsingNode16, ActionRunsUsingNode20, ActionRunsUsingNode24:
-		return true
-	default:
-		return false
-	}
-}
-
-func (a ActionRunsUsing) IsDocker() bool {
-	return a == ActionRunsUsingDocker
-}
-
-func (a ActionRunsUsing) IsComposite() bool {
-	return a == ActionRunsUsingComposite
-}
-
-// ActionRuns are a field in Action
-type ActionRuns struct {
-	Using          ActionRunsUsing   `yaml:"using"`
-	Env            map[string]string `yaml:"env"`
-	Main           string            `yaml:"main"`
-	Pre            string            `yaml:"pre"`
-	PreIf          string            `yaml:"pre-if"`
-	Post           string            `yaml:"post"`
-	PostIf         string            `yaml:"post-if"`
-	Image          string            `yaml:"image"`
-	PreEntrypoint  string            `yaml:"pre-entrypoint"`
-	Entrypoint     string            `yaml:"entrypoint"`
-	PostEntrypoint string            `yaml:"post-entrypoint"`
-	Args           []string          `yaml:"args"`
-	Steps          []Step            `yaml:"steps"`
-}
-
-// Action describes a metadata file for GitHub actions. The metadata filename must be either action.yml or action.yaml. The data in the metadata file defines the inputs, outputs and main entrypoint for your action.
-type Action struct {
-	Name        string            `yaml:"name"`
-	Author      string            `yaml:"author"`
-	Description string            `yaml:"description"`
-	Inputs      map[string]Input  `yaml:"inputs"`
-	Outputs     map[string]Output `yaml:"outputs"`
-	Runs        ActionRuns        `yaml:"runs"`
-	Branding    struct {
-		Color string `yaml:"color"`
-		Icon  string `yaml:"icon"`
-	} `yaml:"branding"`
-}
-
-// Input parameters allow you to specify data that the action expects to use during runtime. GitHub stores input parameters as environment variables. Input ids with uppercase letters are converted to lowercase during runtime. We recommended using lowercase input ids.
-type Input struct {
-	Description string `yaml:"description"`
-	Required    bool   `yaml:"required"`
-	Default     string `yaml:"default"`
-}
-
-// Output parameters allow you to declare data that an action sets. Actions that run later in a workflow can use the output data set in previously run actions. For example, if you had an action that performed the addition of two inputs (x + y = z), the action could output the sum (z) for other actions to use as an input.
-type Output struct {
-	Description string `yaml:"description"`
-	Value       string `yaml:"value"`
-}
-
-// ReadAction reads an action from a reader
-func ReadAction(in io.Reader) (*Action, error) {
-	a := new(Action)
-	err := yaml.NewDecoder(in).Decode(a)
-	if err != nil {
-		return nil, err
-	}
-
-	// set defaults
-	if a.Runs.PreIf == "" {
-		a.Runs.PreIf = "always()"
-	}
-	if a.Runs.PostIf == "" {
-		a.Runs.PostIf = "always()"
-	}
-
-	return a, nil
-}

act/model/action_test.go

@@ -1,82 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestReadActionDefaultsAndCaseInsensitiveUsing(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-name: example
-runs:
-  using: NoDe24
-  main: dist/index.js
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.Using != ActionRunsUsingNode24 {
-		t.Fatalf("using = %q, want %q", action.Runs.Using, ActionRunsUsingNode24)
-	}
-	if action.Runs.PreIf != "always()" {
-		t.Fatalf("pre-if = %q, want always()", action.Runs.PreIf)
-	}
-	if action.Runs.PostIf != "always()" {
-		t.Fatalf("post-if = %q, want always()", action.Runs.PostIf)
-	}
-}
-
-func TestReadActionPreservesExplicitConditions(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-runs:
-  using: composite
-  pre-if: success()
-  post-if: failure()
-  steps:
-    - run: echo hello
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.PreIf != "success()" || action.Runs.PostIf != "failure()" {
-		t.Fatalf("conditions = %q/%q, want explicit values", action.Runs.PreIf, action.Runs.PostIf)
-	}
-	if !action.Runs.Using.IsComposite() || action.Runs.Using.IsDocker() || action.Runs.Using.IsNode() {
-		t.Fatalf("unexpected using predicates for %q", action.Runs.Using)
-	}
-}
-
-func TestReadActionRejectsUnknownUsing(t *testing.T) {
-	_, err := ReadAction(strings.NewReader(`
-runs:
-  using: node99
-`))
-	if err == nil {
-		t.Fatal("expected unknown runs.using to fail")
-	}
-	if !strings.Contains(err.Error(), "node99") {
-		t.Fatalf("error = %q, want invalid value", err)
-	}
-}
-
-func TestReadActionDockerEntrypoints(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-runs:
-  using: docker
-  image: Dockerfile
-  pre-entrypoint: pre.sh
-  post-entrypoint: post.sh
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.PreEntrypoint != "pre.sh" {
-		t.Fatalf("pre-entrypoint = %q, want pre.sh", action.Runs.PreEntrypoint)
-	}
-	if action.Runs.PostEntrypoint != "post.sh" {
-		t.Fatalf("post-entrypoint = %q, want post.sh", action.Runs.PostEntrypoint)
-	}
-}

act/model/github_context.go

@@ -1,222 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-)
-
-type GithubContext struct {
-	Event            map[string]any `json:"event"`
-	EventPath        string         `json:"event_path"`
-	Workflow         string         `json:"workflow"`
-	RunID            string         `json:"run_id"`
-	RunNumber        string         `json:"run_number"`
-	Actor            string         `json:"actor"`
-	Repository       string         `json:"repository"`
-	EventName        string         `json:"event_name"`
-	Sha              string         `json:"sha"`
-	Ref              string         `json:"ref"`
-	RefName          string         `json:"ref_name"`
-	RefType          string         `json:"ref_type"`
-	HeadRef          string         `json:"head_ref"`
-	BaseRef          string         `json:"base_ref"`
-	Token            string         `json:"token"`
-	Workspace        string         `json:"workspace"`
-	Action           string         `json:"action"`
-	ActionPath       string         `json:"action_path"`
-	ActionRef        string         `json:"action_ref"`
-	ActionRepository string         `json:"action_repository"`
-	Job              string         `json:"job"`
-	JobName          string         `json:"job_name"`
-	RepositoryOwner  string         `json:"repository_owner"`
-	RetentionDays    string         `json:"retention_days"`
-	RunnerPerflog    string         `json:"runner_perflog"`
-	RunnerTrackingID string         `json:"runner_tracking_id"`
-	ServerURL        string         `json:"server_url"`
-	APIURL           string         `json:"api_url"`
-	GraphQLURL       string         `json:"graphql_url"`
-
-	// For Gitea
-	RunAttempt string `json:"run_attempt"`
-}
-
-func asString(v any) string {
-	if v == nil {
-		return ""
-	} else if s, ok := v.(string); ok {
-		return s
-	}
-	return ""
-}
-
-func nestedMapLookup(m map[string]any, ks ...string) (rval any) {
-	var ok bool
-
-	if len(ks) == 0 { // degenerate input
-		return nil
-	}
-	if rval, ok = m[ks[0]]; !ok {
-		return nil
-	} else if len(ks) == 1 { // we've reached the final key
-		return rval
-	} else if m, ok = rval.(map[string]any); !ok {
-		return nil
-	} else { // 1+ more keys
-		return nestedMapLookup(m, ks[1:]...)
-	}
-}
-
-func withDefaultBranch(ctx context.Context, b string, event map[string]any) map[string]any {
-	repoI, ok := event["repository"]
-	if !ok {
-		repoI = make(map[string]any)
-	}
-
-	repo, ok := repoI.(map[string]any)
-	if !ok {
-		common.Logger(ctx).Warnf("unable to set default branch to %v", b)
-		return event
-	}
-
-	// if the branch is already there return with no changes
-	if _, ok = repo["default_branch"]; ok {
-		return event
-	}
-
-	repo["default_branch"] = b
-	event["repository"] = repo
-
-	return event
-}
-
-var (
-	findGitRef      = git.FindGitRef
-	findGitRevision = git.FindGitRevision
-)
-
-func (ghc *GithubContext) SetRef(ctx context.Context, defaultBranch, repoPath string) {
-	logger := common.Logger(ctx)
-
-	// https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
-	// https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads
-	switch ghc.EventName {
-	case "pull_request_target":
-		ghc.Ref = "refs/heads/" + ghc.BaseRef
-	case "pull_request", "pull_request_review", "pull_request_review_comment":
-		ghc.Ref = fmt.Sprintf("refs/pull/%.0f/merge", ghc.Event["number"])
-	case "deployment", "deployment_status":
-		ghc.Ref = asString(nestedMapLookup(ghc.Event, "deployment", "ref"))
-	case "release":
-		ghc.Ref = "refs/tags/" + asString(nestedMapLookup(ghc.Event, "release", "tag_name"))
-	case "push", "create", "workflow_dispatch":
-		ghc.Ref = asString(ghc.Event["ref"])
-	default:
-		defaultBranch := asString(nestedMapLookup(ghc.Event, "repository", "default_branch"))
-		if defaultBranch != "" {
-			ghc.Ref = "refs/heads/" + defaultBranch
-		}
-	}
-
-	if ghc.Ref == "" {
-		ref, err := findGitRef(ctx, repoPath)
-		if err != nil {
-			logger.Warningf("unable to get git ref: %v", err)
-		} else {
-			logger.Debugf("using github ref: %s", ref)
-			ghc.Ref = ref
-		}
-
-		// set the branch in the event data
-		if defaultBranch != "" {
-			ghc.Event = withDefaultBranch(ctx, defaultBranch, ghc.Event)
-		} else {
-			ghc.Event = withDefaultBranch(ctx, "master", ghc.Event)
-		}
-
-		if ghc.Ref == "" {
-			ghc.Ref = "refs/heads/" + asString(nestedMapLookup(ghc.Event, "repository", "default_branch"))
-		}
-	}
-}
-
-func (ghc *GithubContext) SetSha(ctx context.Context, repoPath string) {
-	logger := common.Logger(ctx)
-
-	// https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
-	// https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads
-	switch ghc.EventName {
-	case "pull_request_target":
-		ghc.Sha = asString(nestedMapLookup(ghc.Event, "pull_request", "base", "sha"))
-	case "deployment", "deployment_status":
-		ghc.Sha = asString(nestedMapLookup(ghc.Event, "deployment", "sha"))
-	case "push", "create", "workflow_dispatch":
-		if deleted, ok := ghc.Event["deleted"].(bool); ok && !deleted {
-			ghc.Sha = asString(ghc.Event["after"])
-		}
-	}
-
-	if ghc.Sha == "" {
-		_, sha, err := findGitRevision(ctx, repoPath)
-		if err != nil {
-			logger.Warningf("unable to get git revision: %v", err)
-		} else {
-			ghc.Sha = sha
-		}
-	}
-}
-
-func (ghc *GithubContext) SetRepositoryAndOwner(ctx context.Context, githubInstance, remoteName, repoPath string) {
-	if ghc.Repository == "" {
-		repo, err := git.FindGithubRepo(ctx, repoPath, githubInstance, remoteName)
-		if err != nil {
-			common.Logger(ctx).Warningf("unable to get git repo (githubInstance: %v; remoteName: %v, repoPath: %v): %v", githubInstance, remoteName, repoPath, err)
-			return
-		}
-		ghc.Repository = repo
-	}
-	ghc.RepositoryOwner = strings.Split(ghc.Repository, "/")[0]
-}
-
-func (ghc *GithubContext) SetRefTypeAndName() {
-	var refType, refName string
-
-	// https://docs.github.com/en/actions/learn-github-actions/environment-variables
-	if strings.HasPrefix(ghc.Ref, "refs/tags/") {
-		refType = "tag"
-		refName = ghc.Ref[len("refs/tags/"):]
-	} else if strings.HasPrefix(ghc.Ref, "refs/heads/") {
-		refType = "branch"
-		refName = ghc.Ref[len("refs/heads/"):]
-	} else if strings.HasPrefix(ghc.Ref, "refs/pull/") {
-		refType = ""
-		refName = ghc.Ref[len("refs/pull/"):]
-	}
-
-	if ghc.RefType == "" {
-		ghc.RefType = refType
-	}
-
-	if ghc.RefName == "" {
-		ghc.RefName = refName
-	}
-}
-
-func (ghc *GithubContext) SetBaseAndHeadRef() {
-	if ghc.EventName == "pull_request" || ghc.EventName == "pull_request_target" {
-		if ghc.BaseRef == "" {
-			ghc.BaseRef = asString(nestedMapLookup(ghc.Event, "pull_request", "base", "ref"))
-		}
-
-		if ghc.HeadRef == "" {
-			ghc.HeadRef = asString(nestedMapLookup(ghc.Event, "pull_request", "head", "ref"))
-		}
-	}
-}

act/model/job_context.go

@@ -1,22 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-type JobContext struct {
-	Status    string                `json:"status"`
-	Container JobContainerContext   `json:"container"`
-	Services  map[string]JobService `json:"services"`
-}
-
-type JobContainerContext struct {
-	ID      string `json:"id"`
-	Network string `json:"network"`
-}
-
-type JobService struct {
-	ID      string            `json:"id"`
-	Network string            `json:"network"`
-	Ports   map[string]string `json:"ports"` // container port to the published host port
-}

act/model/planner.go

@@ -1,410 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"math"
-	"os"
-	"path/filepath"
-	"regexp"
-	"slices"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// WorkflowPlanner contains methods for creating plans
-type WorkflowPlanner interface {
-	PlanEvent(eventName string) (*Plan, error)
-	PlanJob(jobName string) (*Plan, error)
-	PlanAll() (*Plan, error)
-	GetEvents() []string
-}
-
-// Plan contains a list of stages to run in series
-type Plan struct {
-	Stages []*Stage
-}
-
-// Stage contains a list of runs to execute in parallel
-type Stage struct {
-	Runs []*Run
-}
-
-// Run represents a job from a workflow that needs to be run
-type Run struct {
-	Workflow *Workflow
-	JobID    string
-}
-
-func (r *Run) String() string {
-	jobName := r.Job().Name
-	if jobName == "" {
-		jobName = r.JobID
-	}
-	return jobName
-}
-
-// Job returns the job for this Run
-func (r *Run) Job() *Job {
-	return r.Workflow.GetJob(r.JobID)
-}
-
-type WorkflowFiles struct {
-	workflowDirEntry os.DirEntry
-	dirPath          string
-}
-
-// NewWorkflowPlanner will load a specific workflow, all workflows from a directory or all workflows from a directory and its subdirectories
-func NewWorkflowPlanner(path string, noWorkflowRecurse bool) (WorkflowPlanner, error) {
-	path, err := filepath.Abs(path)
-	if err != nil {
-		return nil, err
-	}
-
-	fi, err := os.Stat(path)
-	if err != nil {
-		return nil, err
-	}
-
-	var workflows []WorkflowFiles
-
-	if fi.IsDir() {
-		log.Debugf("Loading workflows from '%s'", path)
-		if noWorkflowRecurse {
-			files, err := os.ReadDir(path)
-			if err != nil {
-				return nil, err
-			}
-
-			for _, v := range files {
-				workflows = append(workflows, WorkflowFiles{
-					dirPath:          path,
-					workflowDirEntry: v,
-				})
-			}
-		} else {
-			log.Debug("Loading workflows recursively")
-			if err := filepath.Walk(path,
-				func(p string, f os.FileInfo, err error) error {
-					if err != nil {
-						return err
-					}
-
-					if !f.IsDir() {
-						log.Debugf("Found workflow '%s' in '%s'", f.Name(), p)
-						workflows = append(workflows, WorkflowFiles{
-							dirPath:          filepath.Dir(p),
-							workflowDirEntry: fs.FileInfoToDirEntry(f),
-						})
-					}
-
-					return nil
-				}); err != nil {
-				return nil, err
-			}
-		}
-	} else {
-		log.Debugf("Loading workflow '%s'", path)
-		dirname := filepath.Dir(path)
-
-		workflows = append(workflows, WorkflowFiles{
-			dirPath:          dirname,
-			workflowDirEntry: fs.FileInfoToDirEntry(fi),
-		})
-	}
-
-	wp := new(workflowPlanner)
-	for _, wf := range workflows {
-		ext := filepath.Ext(wf.workflowDirEntry.Name())
-		if ext == ".yml" || ext == ".yaml" {
-			f, err := os.Open(filepath.Join(wf.dirPath, wf.workflowDirEntry.Name()))
-			if err != nil {
-				return nil, err
-			}
-
-			log.Debugf("Reading workflow '%s'", f.Name())
-			workflow, err := ReadWorkflow(f)
-			if err != nil {
-				_ = f.Close()
-				if err == io.EOF {
-					return nil, fmt.Errorf("unable to read workflow '%s': file is empty: %w", wf.workflowDirEntry.Name(), err)
-				}
-				return nil, fmt.Errorf("workflow is not valid. '%s': %w", wf.workflowDirEntry.Name(), err)
-			}
-			_, err = f.Seek(0, 0)
-			if err != nil {
-				_ = f.Close()
-				return nil, fmt.Errorf("error occurring when resetting io pointer in '%s': %w", wf.workflowDirEntry.Name(), err)
-			}
-
-			workflow.File = wf.workflowDirEntry.Name()
-			if workflow.Name == "" {
-				workflow.Name = wf.workflowDirEntry.Name()
-			}
-
-			err = validateJobName(workflow)
-			if err != nil {
-				_ = f.Close()
-				return nil, err
-			}
-
-			wp.workflows = append(wp.workflows, workflow)
-			_ = f.Close()
-		}
-	}
-
-	return wp, nil
-}
-
-// CombineWorkflowPlanner combines workflows to a WorkflowPlanner
-func CombineWorkflowPlanner(workflows ...*Workflow) WorkflowPlanner {
-	return &workflowPlanner{
-		workflows: workflows,
-	}
-}
-
-func NewSingleWorkflowPlanner(name string, f io.Reader) (WorkflowPlanner, error) {
-	wp := new(workflowPlanner)
-
-	log.Debugf("Reading workflow %s", name)
-	workflow, err := ReadWorkflow(f)
-	if err != nil {
-		if err == io.EOF {
-			return nil, fmt.Errorf("unable to read workflow '%s': file is empty: %w", name, err)
-		}
-		return nil, fmt.Errorf("workflow is not valid. '%s': %w", name, err)
-	}
-	workflow.File = name
-	if workflow.Name == "" {
-		workflow.Name = name
-	}
-
-	err = validateJobName(workflow)
-	if err != nil {
-		return nil, err
-	}
-
-	wp.workflows = append(wp.workflows, workflow)
-
-	return wp, nil
-}
-
-func validateJobName(workflow *Workflow) error {
-	jobNameRegex := regexp.MustCompile(`^([[:alpha:]_][[:alnum:]_\-]*)$`)
-	for k := range workflow.Jobs {
-		if ok := jobNameRegex.MatchString(k); !ok {
-			return fmt.Errorf("workflow is not valid. '%s': Job name '%s' is invalid. Names must start with a letter or '_' and contain only alphanumeric characters, '-', or '_'", workflow.Name, k)
-		}
-	}
-	return nil
-}
-
-type workflowPlanner struct {
-	workflows []*Workflow
-}
-
-// PlanEvent builds a new list of runs to execute in parallel for an event name
-func (wp *workflowPlanner) PlanEvent(eventName string) (*Plan, error) {
-	plan := new(Plan)
-	if len(wp.workflows) == 0 {
-		log.Debug("no workflows found by planner")
-		return plan, nil
-	}
-	var lastErr error
-
-	for _, w := range wp.workflows {
-		events := w.On()
-		if len(events) == 0 {
-			log.Debugf("no events found for workflow: %s", w.File)
-			continue
-		}
-
-		for _, e := range events {
-			if e == eventName {
-				stages, err := createStages(w, w.GetJobIDs()...)
-				if err != nil {
-					log.Warn(err)
-					lastErr = err
-				} else {
-					plan.mergeStages(stages)
-				}
-			}
-		}
-	}
-	return plan, lastErr
-}
-
-// PlanJob builds a new run to execute in parallel for a job name
-func (wp *workflowPlanner) PlanJob(jobName string) (*Plan, error) {
-	plan := new(Plan)
-	if len(wp.workflows) == 0 {
-		log.Debugf("no jobs found for workflow: %s", jobName)
-	}
-	var lastErr error
-
-	for _, w := range wp.workflows {
-		stages, err := createStages(w, jobName)
-		if err != nil {
-			log.Warn(err)
-			lastErr = err
-		} else {
-			plan.mergeStages(stages)
-		}
-	}
-	return plan, lastErr
-}
-
-// PlanAll builds a new run to execute in parallel all
-func (wp *workflowPlanner) PlanAll() (*Plan, error) {
-	plan := new(Plan)
-	if len(wp.workflows) == 0 {
-		log.Debug("no workflows found by planner")
-		return plan, nil
-	}
-	var lastErr error
-
-	for _, w := range wp.workflows {
-		stages, err := createStages(w, w.GetJobIDs()...)
-		if err != nil {
-			log.Warn(err)
-			lastErr = err
-		} else {
-			plan.mergeStages(stages)
-		}
-	}
-
-	return plan, lastErr
-}
-
-// GetEvents gets all the events in the workflows file
-func (wp *workflowPlanner) GetEvents() []string {
-	events := make([]string, 0)
-	for _, w := range wp.workflows {
-		found := false
-		for _, e := range events {
-			if slices.Contains(w.On(), e) {
-				found = true
-			}
-			if found {
-				break
-			}
-		}
-
-		if !found {
-			events = append(events, w.On()...)
-		}
-	}
-
-	// sort the list based on depth of dependencies
-	slices.Sort(events)
-
-	return events
-}
-
-// MaxRunNameLen determines the max name length of all jobs
-func (p *Plan) MaxRunNameLen() int {
-	maxRunNameLen := 0
-	for _, stage := range p.Stages {
-		for _, run := range stage.Runs {
-			runNameLen := len(run.String())
-			if runNameLen > maxRunNameLen {
-				maxRunNameLen = runNameLen
-			}
-		}
-	}
-	return maxRunNameLen
-}
-
-// GetJobIDs will get all the job names in the stage
-func (s *Stage) GetJobIDs() []string {
-	names := make([]string, 0)
-	for _, r := range s.Runs {
-		names = append(names, r.JobID)
-	}
-	return names
-}
-
-// Merge stages with existing stages in plan
-func (p *Plan) mergeStages(stages []*Stage) {
-	newStages := make([]*Stage, int(math.Max(float64(len(p.Stages)), float64(len(stages)))))
-	for i := range newStages {
-		newStages[i] = new(Stage)
-		if i >= len(p.Stages) {
-			newStages[i].Runs = append(newStages[i].Runs, stages[i].Runs...)
-		} else if i >= len(stages) {
-			newStages[i].Runs = append(newStages[i].Runs, p.Stages[i].Runs...)
-		} else {
-			newStages[i].Runs = append(newStages[i].Runs, p.Stages[i].Runs...)
-			newStages[i].Runs = append(newStages[i].Runs, stages[i].Runs...)
-		}
-	}
-	p.Stages = newStages
-}
-
-func createStages(w *Workflow, jobIDs ...string) ([]*Stage, error) {
-	// first, build a list of all the necessary jobs to run, and their dependencies
-	jobDependencies := make(map[string][]string)
-	for len(jobIDs) > 0 {
-		newJobIDs := make([]string, 0)
-		for _, jID := range jobIDs {
-			// make sure we haven't visited this job yet
-			if _, ok := jobDependencies[jID]; !ok {
-				if job := w.GetJob(jID); job != nil {
-					jobDependencies[jID] = job.Needs()
-					newJobIDs = append(newJobIDs, job.Needs()...)
-				}
-			}
-		}
-		jobIDs = newJobIDs
-	}
-
-	// next, build an execution graph
-	stages := make([]*Stage, 0)
-	for len(jobDependencies) > 0 {
-		stage := new(Stage)
-		for jID, jDeps := range jobDependencies {
-			// make sure all deps are in the graph already
-			if listInStages(jDeps, stages...) {
-				stage.Runs = append(stage.Runs, &Run{
-					Workflow: w,
-					JobID:    jID,
-				})
-				delete(jobDependencies, jID)
-			}
-		}
-		if len(stage.Runs) == 0 {
-			return nil, fmt.Errorf("unable to build dependency graph for %s (%s)", w.Name, w.File)
-		}
-		stages = append(stages, stage)
-	}
-
-	if len(stages) == 0 {
-		return nil, errors.New("Could not find any stages to run. View the valid jobs with `act --list`. Use `act --help` to find how to filter by Job ID/Workflow/Event Name")
-	}
-
-	return stages, nil
-}
-
-// return true iff all strings in srcList exist in at least one of the stages
-func listInStages(srcList []string, stages ...*Stage) bool {
-	for _, src := range srcList {
-		found := false
-		for _, stage := range stages {
-			for _, search := range stage.GetJobIDs() {
-				if src == search {
-					found = true
-				}
-			}
-		}
-		if !found {
-			return false
-		}
-	}
-	return true
-}

act/model/planner_test.go

@@ -1,199 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"path/filepath"
-	"strings"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type WorkflowPlanTest struct {
-	workflowPath      string
-	errorMessage      string
-	noWorkflowRecurse bool
-}
-
-func TestPlanner(t *testing.T) {
-	log.SetLevel(log.DebugLevel)
-
-	tables := []WorkflowPlanTest{
-		{"invalid-job-name/invalid-1.yml", "workflow is not valid. 'invalid-job-name-1': Job name 'invalid-JOB-Name-v1.2.3-docker_hub' is invalid. Names must start with a letter or '_' and contain only alphanumeric characters, '-', or '_'", false},
-		{"invalid-job-name/invalid-2.yml", "workflow is not valid. 'invalid-job-name-2': Job name '1234invalid-JOB-Name-v123-docker_hub' is invalid. Names must start with a letter or '_' and contain only alphanumeric characters, '-', or '_'", false},
-		{"invalid-job-name/valid-1.yml", "", false},
-		{"invalid-job-name/valid-2.yml", "", false},
-		{"empty-workflow", "unable to read workflow 'push.yml': file is empty: EOF", false},
-		{"nested", "unable to read workflow 'fail.yml': file is empty: EOF", false},
-		{"nested", "", true},
-	}
-
-	workdir, err := filepath.Abs("testdata")
-	assert.NoError(t, err, workdir) //nolint:testifylint // pre-existing issue from nektos/act
-	for _, table := range tables {
-		fullWorkflowPath := filepath.Join(workdir, table.workflowPath)
-		_, err = NewWorkflowPlanner(fullWorkflowPath, table.noWorkflowRecurse)
-		if table.errorMessage == "" {
-			assert.NoError(t, err, "WorkflowPlanner should exit without any error")
-		} else {
-			assert.EqualError(t, err, table.errorMessage)
-		}
-	}
-}
-
-func TestWorkflow(t *testing.T) {
-	log.SetLevel(log.DebugLevel)
-
-	workflow := Workflow{
-		Jobs: map[string]*Job{
-			"valid_job": {
-				Name: "valid_job",
-			},
-		},
-	}
-
-	// Check that an invalid job id returns error
-	result, err := createStages(&workflow, "invalid_job_id")
-	assert.Error(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Nil(t, result)
-
-	// Check that an valid job id returns non-error
-	result, err = createStages(&workflow, "valid_job")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.NotNil(t, result)
-}
-
-func TestNewSingleWorkflowPlannerAndPlanMethods(t *testing.T) {
-	planner, err := NewSingleWorkflowPlanner("ci.yml", strings.NewReader(`
-name: CI
-on: [push, pull_request]
-jobs:
-  build:
-    name: Build project
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-  test:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`))
-	require.NoError(t, err)
-
-	assert.Equal(t, []string{"pull_request", "push"}, planner.GetEvents())
-
-	eventPlan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, eventPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, eventPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, eventPlan.Stages[1].GetJobIDs())
-	assert.Equal(t, len("Build project"), eventPlan.MaxRunNameLen())
-	assert.Equal(t, "Build project", eventPlan.Stages[0].Runs[0].String())
-	assert.Equal(t, "build", eventPlan.Stages[0].Runs[0].JobID)
-	assert.NotNil(t, eventPlan.Stages[0].Runs[0].Job())
-
-	jobPlan, err := planner.PlanJob("test")
-	require.NoError(t, err)
-	require.Len(t, jobPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, jobPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, jobPlan.Stages[1].GetJobIDs())
-
-	allPlan, err := planner.PlanAll()
-	require.NoError(t, err)
-	require.Len(t, allPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, allPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, allPlan.Stages[1].GetJobIDs())
-}
-
-func TestCombineWorkflowPlannerMergesWorkflowStages(t *testing.T) {
-	first := mustReadWorkflow(t, `
-name: First
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-`)
-	second := mustReadWorkflow(t, `
-name: Second
-on: push
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make lint
-  test:
-    needs: lint
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`)
-
-	planner := CombineWorkflowPlanner(first, second)
-	plan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, plan.Stages, 2)
-	assert.ElementsMatch(t, []string{"build", "lint"}, plan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, plan.Stages[1].GetJobIDs())
-
-	empty, err := planner.PlanEvent("schedule")
-	require.NoError(t, err)
-	assert.Empty(t, empty.Stages)
-}
-
-func TestPlannerErrorsForMissingAndCyclicJobs(t *testing.T) {
-	workflow := mustReadWorkflow(t, `
-name: Cyclic
-on: push
-jobs:
-  a:
-    needs: b
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo a
-  b:
-    needs: a
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo b
-`)
-	planner := CombineWorkflowPlanner(workflow)
-
-	plan, err := planner.PlanJob("missing")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "Could not find any stages")
-
-	plan, err = planner.PlanEvent("push")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "unable to build dependency graph")
-}
-
-func TestNewSingleWorkflowPlannerErrors(t *testing.T) {
-	_, err := NewSingleWorkflowPlanner("empty.yml", strings.NewReader(""))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "file is empty")
-
-	_, err = NewSingleWorkflowPlanner("invalid.yml", strings.NewReader("jobs: ["))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "workflow is not valid")
-}
-
-func mustReadWorkflow(t *testing.T, content string) *Workflow {
-	t.Helper()
-
-	workflow, err := ReadWorkflow(strings.NewReader(content))
-	require.NoError(t, err)
-	if workflow.Name == "" {
-		workflow.Name = "workflow"
-	}
-	return workflow
-}

act/model/step_result.go

@@ -1,49 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import "fmt"
-
-type stepStatus int
-
-const (
-	StepStatusSuccess stepStatus = iota
-	StepStatusFailure
-	StepStatusSkipped
-)
-
-var stepStatusStrings = [...]string{
-	"success",
-	"failure",
-	"skipped",
-}
-
-func (s stepStatus) MarshalText() ([]byte, error) {
-	return []byte(s.String()), nil
-}
-
-func (s *stepStatus) UnmarshalText(b []byte) error {
-	str := string(b)
-	for i, name := range stepStatusStrings {
-		if name == str {
-			*s = stepStatus(i)
-			return nil
-		}
-	}
-	return fmt.Errorf("invalid step status %q", str)
-}
-
-func (s stepStatus) String() string {
-	if int(s) >= len(stepStatusStrings) {
-		return ""
-	}
-	return stepStatusStrings[s]
-}
-
-type StepResult struct {
-	Outputs    map[string]string `json:"outputs"`
-	Conclusion stepStatus        `json:"conclusion"`
-	Outcome    stepStatus        `json:"outcome"`
-}

act/model/testdata/invalid-job-name/invalid-1.yml

@@ -1,12 +0,0 @@
-name: invalid-job-name-1
-on: push
-
-jobs:
-  invalid-JOB-Name-v1.2.3-docker_hub:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo hi
-  valid-JOB-Name-v123-docker_hub:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo hi

act/model/testdata/invalid-job-name/invalid-2.yml

@@ -1,8 +0,0 @@
-name: invalid-job-name-2
-on: push
-
-jobs:
-  1234invalid-JOB-Name-v123-docker_hub:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo hi

act/model/testdata/invalid-job-name/valid-1.yml

@@ -1,8 +0,0 @@
-name: valid-job-name-1
-on: push
-
-jobs:
-  valid-JOB-Name-v123-docker_hub:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo hi

act/model/testdata/invalid-job-name/valid-2.yml

@@ -1,8 +0,0 @@
-name: valid-job-name-2
-on: push
-
-jobs:
-  ___valid-JOB-Name-v123-docker_hub:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo hi

act/model/testdata/nested/success.yml

@@ -1,9 +0,0 @@
-name: Hello World Workflow
-on: push
-
-jobs:
-  hello-world:
-    name: Hello World Job
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "Hello World!"

act/model/testdata/strategy/push.yml

@@ -1,50 +0,0 @@
----
-jobs:
-  strategy-all:
-    name: ${{ matrix.node-version }} | ${{ matrix.site }} | ${{ matrix.datacenter }}
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo 'Hello!'
-    strategy:
-      fail-fast: false
-      matrix:
-        datacenter:
-          - site-c
-          - site-d
-        exclude:
-          - datacenter: site-d
-            node-version: 14.x
-            site: staging
-        include:
-          - php-version: 5.4
-          - datacenter: site-a
-            node-version: 10.x
-            site: prod
-          - datacenter: site-b
-            node-version: 12.x
-            site: dev
-        node-version: [14.x, 16.x]
-        site:
-          - staging
-      max-parallel: 2
-  strategy-no-matrix:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo 'Hello!'
-    strategy:
-      fail-fast: false
-      max-parallel: 2
-  strategy-only-fail-fast:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo 'Hello!'
-    strategy:
-      fail-fast: false
-  strategy-only-max-parallel:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo 'Hello!'
-    strategy:
-      max-parallel: 2
-'on':
-  push: null

act/model/workflow.go

@@ -1,916 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"io"
-	"maps"
-	"reflect"
-	"regexp"
-	"slices"
-	"strconv"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-
-	log "github.com/sirupsen/logrus"
-	"go.yaml.in/yaml/v4"
-)
-
-// Workflow is the structure of the files in .github/workflows
-type Workflow struct {
-	File           string
-	Name           string            `yaml:"name"`
-	RawOn          yaml.Node         `yaml:"on"`
-	Env            map[string]string `yaml:"env"`
-	Jobs           map[string]*Job   `yaml:"jobs"`
-	Defaults       Defaults          `yaml:"defaults"`
-	RawConcurrency *RawConcurrency   `yaml:"concurrency"`
-	RawPermissions yaml.Node         `yaml:"permissions"`
-}
-
-// On events for the workflow
-func (w *Workflow) On() []string {
-	switch w.RawOn.Kind {
-	case yaml.ScalarNode:
-		var val string
-		err := w.RawOn.Decode(&val)
-		if err != nil {
-			log.Fatal(err)
-		}
-		return []string{val}
-	case yaml.SequenceNode:
-		var val []string
-		err := w.RawOn.Decode(&val)
-		if err != nil {
-			log.Fatal(err)
-		}
-		return val
-	case yaml.MappingNode:
-		var val map[string]any
-		err := w.RawOn.Decode(&val)
-		if err != nil {
-			log.Fatal(err)
-		}
-		var keys []string
-		for k := range val {
-			keys = append(keys, k)
-		}
-		return keys
-	}
-	return nil
-}
-
-func (w *Workflow) OnEvent(event string) any {
-	if w.RawOn.Kind == yaml.MappingNode {
-		var val map[string]any
-		if !decodeNode(w.RawOn, &val) {
-			return nil
-		}
-		return val[event]
-	}
-	return nil
-}
-
-func (w *Workflow) OnSchedule() []string {
-	schedules := w.OnEvent("schedule")
-	if schedules == nil {
-		return []string{}
-	}
-
-	switch val := schedules.(type) {
-	case []any:
-		allSchedules := []string{}
-		for _, v := range val {
-			entry, ok := v.(map[string]any)
-			if !ok {
-				continue
-			}
-			if cron, ok := entry["cron"].(string); ok {
-				allSchedules = append(allSchedules, cron)
-			}
-		}
-		return allSchedules
-	default:
-	}
-
-	return []string{}
-}
-
-type WorkflowDispatchInput struct {
-	Description string   `yaml:"description"`
-	Required    bool     `yaml:"required"`
-	Default     string   `yaml:"default"`
-	Type        string   `yaml:"type"`
-	Options     []string `yaml:"options"`
-}
-
-type WorkflowDispatch struct {
-	Inputs map[string]WorkflowDispatchInput `yaml:"inputs"`
-}
-
-func (w *Workflow) WorkflowDispatchConfig() *WorkflowDispatch {
-	switch w.RawOn.Kind {
-	case yaml.ScalarNode:
-		var val string
-		if !decodeNode(w.RawOn, &val) {
-			return nil
-		}
-		if val == "workflow_dispatch" {
-			return &WorkflowDispatch{}
-		}
-	case yaml.SequenceNode:
-		var val []string
-		if !decodeNode(w.RawOn, &val) {
-			return nil
-		}
-		if slices.Contains(val, "workflow_dispatch") {
-			return &WorkflowDispatch{}
-		}
-	case yaml.MappingNode:
-		var val map[string]yaml.Node
-		if !decodeNode(w.RawOn, &val) {
-			return nil
-		}
-
-		n, found := val["workflow_dispatch"]
-		var workflowDispatch WorkflowDispatch
-		if found && decodeNode(n, &workflowDispatch) {
-			return &workflowDispatch
-		}
-	default:
-		return nil
-	}
-	return nil
-}
-
-type WorkflowCallInput struct {
-	Description string `yaml:"description"`
-	Required    bool   `yaml:"required"`
-	Default     string `yaml:"default"`
-	Type        string `yaml:"type"`
-}
-
-type WorkflowCallOutput struct {
-	Description string `yaml:"description"`
-	Value       string `yaml:"value"`
-}
-
-type WorkflowCall struct {
-	Inputs  map[string]WorkflowCallInput  `yaml:"inputs"`
-	Outputs map[string]WorkflowCallOutput `yaml:"outputs"`
-}
-
-type WorkflowCallResult struct {
-	Outputs map[string]string
-}
-
-func (w *Workflow) WorkflowCallConfig() *WorkflowCall {
-	if w.RawOn.Kind != yaml.MappingNode {
-		// The callers expect for "on: workflow_call" and "on: [ workflow_call ]" a non nil return value
-		return &WorkflowCall{}
-	}
-
-	var val map[string]yaml.Node
-	if !decodeNode(w.RawOn, &val) {
-		return &WorkflowCall{}
-	}
-
-	var config WorkflowCall
-	node := val["workflow_call"]
-	if !decodeNode(node, &config) {
-		return &WorkflowCall{}
-	}
-
-	return &config
-}
-
-// Job is the structure of one job in a workflow
-type Job struct {
-	Name               string                    `yaml:"name"`
-	RawNeeds           yaml.Node                 `yaml:"needs"`
-	RawRunsOn          yaml.Node                 `yaml:"runs-on"`
-	Env                yaml.Node                 `yaml:"env"`
-	If                 yaml.Node                 `yaml:"if"`
-	Steps              []*Step                   `yaml:"steps"`
-	TimeoutMinutes     string                    `yaml:"timeout-minutes"`
-	RawContinueOnError string                    `yaml:"continue-on-error"`
-	Services           map[string]*ContainerSpec `yaml:"services"`
-	Strategy           *Strategy                 `yaml:"strategy"`
-	RawContainer       yaml.Node                 `yaml:"container"`
-	Defaults           Defaults                  `yaml:"defaults"`
-	Outputs            map[string]string         `yaml:"outputs"`
-	Uses               string                    `yaml:"uses"`
-	With               map[string]any            `yaml:"with"`
-	RawSecrets         yaml.Node                 `yaml:"secrets"`
-	RawPermissions     yaml.Node                 `yaml:"permissions"`
-	Result             string
-	// Runtime fields set during execution (not from YAML):
-	ContinueOnError bool // true when all failing matrix combinations had continue-on-error=true
-	hasFirmFailure  bool // true once any combination failed without continue-on-error
-}
-
-// SetContinueOnError records whether this combination's failure should not fail the workflow.
-// Must be called under the job lock. Safe across parallel matrix combinations.
-func (j *Job) SetContinueOnError(continueOnErr bool) {
-	if continueOnErr {
-		if !j.hasFirmFailure {
-			j.ContinueOnError = true
-		}
-	} else {
-		j.hasFirmFailure = true
-		j.ContinueOnError = false
-	}
-}
-
-// NeedsResult returns the job result as seen by dependent jobs through the
-// `needs` context. A job that failed but was tolerated via continue-on-error
-// reports "success" to its dependents, matching GitHub: such a failure must not
-// block jobs gated on the default `if: success()`, even though the overall
-// workflow run is still marked as failed.
-func (j *Job) NeedsResult() string {
-	if j.Result == "failure" && j.ContinueOnError {
-		return "success"
-	}
-	return j.Result
-}
-
-// Strategy for the job
-type Strategy struct {
-	FailFast          bool
-	MaxParallel       int
-	FailFastString    string    `yaml:"fail-fast"`
-	MaxParallelString string    `yaml:"max-parallel"`
-	RawMatrix         yaml.Node `yaml:"matrix"`
-}
-
-// Default settings that will apply to all steps in the job or workflow
-type Defaults struct {
-	Run RunDefaults `yaml:"run"`
-}
-
-// Defaults for all run steps in the job or workflow
-type RunDefaults struct {
-	Shell            string `yaml:"shell"`
-	WorkingDirectory string `yaml:"working-directory"`
-}
-
-// GetMaxParallel sets default and returns value for `max-parallel`
-func (s Strategy) GetMaxParallel() int {
-	// MaxParallel default value is `GitHub will maximize the number of jobs run in parallel depending on the available runners on GitHub-hosted virtual machines`
-	// So I take the liberty to hardcode default limit to 4 and this is because:
-	// 1: tl;dr: self-hosted does only 1 parallel job - https://github.com/actions/runner/issues/639#issuecomment-825212735
-	// 2: GH has 20 parallel job limit (for free tier) - https://github.com/github/docs/blob/3ae84420bd10997bb5f35f629ebb7160fe776eae/content/actions/reference/usage-limits-billing-and-administration.md?plain=1#L45
-	// 3: I want to add support for MaxParallel to act and 20! parallel jobs is a bit overkill IMHO
-	maxParallel := 4
-	if s.MaxParallelString != "" {
-		var err error
-		if maxParallel, err = strconv.Atoi(s.MaxParallelString); err != nil {
-			log.Errorf("Failed to parse 'max-parallel' option: %v", err)
-		}
-	}
-	return maxParallel
-}
-
-// GetFailFast sets default and returns value for `fail-fast`
-func (s Strategy) GetFailFast() bool {
-	// FailFast option is true by default: https://github.com/github/docs/blob/3ae84420bd10997bb5f35f629ebb7160fe776eae/content/actions/reference/workflow-syntax-for-github-actions.md?plain=1#L1107
-	failFast := true
-	log.Debug(s.FailFastString)
-	if s.FailFastString != "" {
-		var err error
-		if failFast, err = strconv.ParseBool(s.FailFastString); err != nil {
-			log.Errorf("Failed to parse 'fail-fast' option: %v", err)
-		}
-	}
-	return failFast
-}
-
-func (j *Job) InheritSecrets() bool {
-	if j.RawSecrets.Kind != yaml.ScalarNode {
-		return false
-	}
-
-	var val string
-	if !decodeNode(j.RawSecrets, &val) {
-		return false
-	}
-
-	return val == "inherit"
-}
-
-func (j *Job) Secrets() map[string]string {
-	if j.RawSecrets.Kind != yaml.MappingNode {
-		return nil
-	}
-
-	var val map[string]string
-	if !decodeNode(j.RawSecrets, &val) {
-		return nil
-	}
-
-	return val
-}
-
-// Container details for the job
-func (j *Job) Container() *ContainerSpec {
-	var val *ContainerSpec
-	switch j.RawContainer.Kind {
-	case yaml.ScalarNode:
-		val = new(ContainerSpec)
-		if !decodeNode(j.RawContainer, &val.Image) {
-			return nil
-		}
-	case yaml.MappingNode:
-		val = new(ContainerSpec)
-		if !decodeNode(j.RawContainer, val) {
-			return nil
-		}
-	}
-	return val
-}
-
-// Needs list for Job
-func (j *Job) Needs() []string {
-	switch j.RawNeeds.Kind {
-	case yaml.ScalarNode:
-		var val string
-		if !decodeNode(j.RawNeeds, &val) {
-			return nil
-		}
-		return []string{val}
-	case yaml.SequenceNode:
-		var val []string
-		if !decodeNode(j.RawNeeds, &val) {
-			return nil
-		}
-		return val
-	}
-	return nil
-}
-
-// RunsOn list for Job
-func (j *Job) RunsOn() []string {
-	return RunsOnFromNode(j.RawRunsOn)
-}
-
-// RunsOnFromNode parses the runs-on labels from a raw runs-on node, so callers can evaluate a
-// copy of the node (avoiding mutation of the shared Job) before reading the labels.
-func RunsOnFromNode(rawRunsOn yaml.Node) []string {
-	switch rawRunsOn.Kind {
-	case yaml.MappingNode:
-		var val struct {
-			Group  string
-			Labels yaml.Node
-		}
-
-		if !decodeNode(rawRunsOn, &val) {
-			return nil
-		}
-
-		labels := nodeAsStringSlice(val.Labels)
-
-		if val.Group != "" {
-			labels = append(labels, val.Group)
-		}
-
-		return labels
-	default:
-		return nodeAsStringSlice(rawRunsOn)
-	}
-}
-
-func nodeAsStringSlice(node yaml.Node) []string {
-	switch node.Kind {
-	case yaml.ScalarNode:
-		var val string
-		if !decodeNode(node, &val) {
-			return nil
-		}
-		return []string{val}
-	case yaml.SequenceNode:
-		var val []string
-		if !decodeNode(node, &val) {
-			return nil
-		}
-		return val
-	}
-	return nil
-}
-
-func environment(yml yaml.Node) map[string]string {
-	env := make(map[string]string)
-	if yml.Kind == yaml.MappingNode {
-		if !decodeNode(yml, &env) {
-			return nil
-		}
-	}
-	return env
-}
-
-// Environment returns string-based key=value map for a job
-func (j *Job) Environment() map[string]string {
-	return environment(j.Env)
-}
-
-// normalizeMatrixValue converts a matrix value to []interface{}.
-// Arrays pass through unchanged; scalars are wrapped in a single-element array.
-// Unevaluated template expressions are wrapped as a fallback — proper resolution
-// happens via EvaluateYamlNode before Matrix() is called. Nested maps are rejected.
-func normalizeMatrixValue(key string, val any) ([]any, error) {
-	switch t := val.(type) {
-	case []any:
-		// Already an array - use as-is
-		return t, nil
-	case string, int, float64, bool, nil:
-		// Valid scalar types that can appear in YAML
-		// These can be unevaluated template expressions (strings) or literal values
-		return []any{t}, nil
-	case map[string]any:
-		// Nested map indicates misconfiguration - likely user error
-		return nil, fmt.Errorf("matrix key %q has invalid nested object value - expected scalar or array, got map", key)
-	default:
-		// Unknown types might indicate parsing issues
-		log.Warnf("matrix key %q has unexpected type %T, wrapping as single value", key, t)
-		return []any{t}, nil
-	}
-}
-
-// Matrix decodes the RawMatrix YAML node into a map[string][]interface{}.
-// Scalar values are wrapped into single-element arrays automatically.
-// Template expressions are resolved by EvaluateYamlNode before this method is
-// called; if unresolved, the literal string is wrapped as a one-element fallback.
-func (j *Job) Matrix() (map[string][]any, error) {
-	if j.Strategy == nil || j.Strategy.RawMatrix.Kind != yaml.MappingNode {
-		return map[string][]any{}, nil
-	}
-
-	// Decode to flexible map first so that scalar values don't cause a type error.
-	var flexVal map[string]any
-	err := j.Strategy.RawMatrix.Decode(&flexVal)
-	if err != nil {
-		// Fall back to the strict array-only format for backward compatibility.
-		var val map[string][]any
-		if !decodeNode(j.Strategy.RawMatrix, &val) {
-			return map[string][]any{}, nil
-		}
-		return val, nil
-	}
-
-	// Convert flexible format to expected format with validation
-	val := make(map[string][]any)
-	for k, v := range flexVal {
-		normalized, err := normalizeMatrixValue(k, v)
-		if err != nil {
-			return nil, err
-		}
-		val[k] = normalized
-	}
-	return val, nil
-}
-
-// GetMatrixes returns the matrix cross product
-// It skips includes and hard fails excludes for non-existing keys
-func (j *Job) GetMatrixes() ([]map[string]any, error) {
-	matrixes := make([]map[string]any, 0)
-	if j.Strategy != nil {
-		// Always set these values, even if there's an error later
-		j.Strategy.FailFast = j.Strategy.GetFailFast()
-		j.Strategy.MaxParallel = j.Strategy.GetMaxParallel()
-
-		m, err := j.Matrix()
-		if err != nil {
-			return nil, err
-		}
-		if len(m) > 0 {
-			includes := make([]map[string]any, 0)
-			extraIncludes := make([]map[string]any, 0)
-			addInclude := func(raw any) error {
-				include, ok := raw.(map[string]any)
-				if !ok {
-					return fmt.Errorf("the workflow is not valid. Matrix include %v is not a map of matrix keys to values", raw)
-				}
-				for k := range include {
-					if _, ok := m[k]; ok {
-						includes = append(includes, include)
-						return nil
-					}
-				}
-				extraIncludes = append(extraIncludes, include)
-				return nil
-			}
-			for _, v := range m["include"] {
-				switch t := v.(type) {
-				case []any:
-					for _, i := range t {
-						if err := addInclude(i); err != nil {
-							return nil, err
-						}
-					}
-				case any:
-					if err := addInclude(t); err != nil {
-						return nil, err
-					}
-				}
-			}
-			delete(m, "include")
-
-			excludes := make([]map[string]any, 0)
-			for _, e := range m["exclude"] {
-				exclude, ok := e.(map[string]any)
-				if !ok {
-					return nil, fmt.Errorf("the workflow is not valid. Matrix exclude %v is not a map of matrix keys to values", e)
-				}
-				for k := range exclude {
-					if _, ok := m[k]; ok {
-						excludes = append(excludes, exclude)
-					} else {
-						// We fail completely here because that's what GitHub does for non-existing matrix keys, fail on exclude, silent skip on include
-						return nil, fmt.Errorf("the workflow is not valid. Matrix exclude key %q does not match any key within the matrix", k)
-					}
-				}
-			}
-			delete(m, "exclude")
-
-			matrixProduct := common.CartesianProduct(m)
-		MATRIX:
-			for _, matrix := range matrixProduct {
-				for _, exclude := range excludes {
-					if commonKeysMatch(matrix, exclude) {
-						log.Debugf("Skipping matrix '%v' due to exclude '%v'", matrix, exclude)
-						continue MATRIX
-					}
-				}
-				matrixes = append(matrixes, matrix)
-			}
-			for _, include := range includes {
-				matched := false
-				for _, matrix := range matrixes {
-					if commonKeysMatch2(matrix, include, m) {
-						matched = true
-						log.Debugf("Adding include values '%v' to existing entry", include)
-						maps.Copy(matrix, include)
-					}
-				}
-				if !matched {
-					extraIncludes = append(extraIncludes, include)
-				}
-			}
-			for _, include := range extraIncludes {
-				log.Debugf("Adding include '%v'", include)
-				matrixes = append(matrixes, include)
-			}
-			if len(matrixes) == 0 {
-				matrixes = append(matrixes, make(map[string]any))
-			}
-		} else {
-			matrixes = append(matrixes, make(map[string]any))
-		}
-	} else {
-		matrixes = append(matrixes, make(map[string]any))
-		log.Debugf("Empty Strategy, matrixes=%v", matrixes)
-	}
-	return matrixes, nil
-}
-
-func commonKeysMatch(a, b map[string]any) bool {
-	for aKey, aVal := range a {
-		if bVal, ok := b[aKey]; ok && !reflect.DeepEqual(aVal, bVal) {
-			return false
-		}
-	}
-	return true
-}
-
-func commonKeysMatch2(a, b map[string]any, m map[string][]any) bool {
-	for aKey, aVal := range a {
-		_, useKey := m[aKey]
-		if bVal, ok := b[aKey]; useKey && ok && !reflect.DeepEqual(aVal, bVal) {
-			return false
-		}
-	}
-	return true
-}
-
-// JobType describes what type of job we are about to run
-type JobType int
-
-const (
-	// JobTypeDefault is all jobs that have a `run` attribute
-	JobTypeDefault JobType = iota
-
-	// JobTypeReusableWorkflowLocal is all jobs that have a `uses` that is a local workflow in the .github/workflows directory
-	JobTypeReusableWorkflowLocal
-
-	// JobTypeReusableWorkflowRemote is all jobs that have a `uses` that references a workflow file in a github repo
-	JobTypeReusableWorkflowRemote
-
-	// JobTypeInvalid represents a job which is not configured correctly
-	JobTypeInvalid
-)
-
-func (j JobType) String() string {
-	switch j {
-	case JobTypeDefault:
-		return "default"
-	case JobTypeReusableWorkflowLocal:
-		return "local-reusable-workflow"
-	case JobTypeReusableWorkflowRemote:
-		return "remote-reusable-workflow"
-	}
-	return "unknown"
-}
-
-// Type returns the type of the job
-func (j *Job) Type() (JobType, error) {
-	isReusable := j.Uses != ""
-
-	if isReusable {
-		isYaml, _ := regexp.MatchString(`\.(ya?ml)(?:$|@)`, j.Uses)
-
-		if isYaml {
-			isLocalPath := strings.HasPrefix(j.Uses, "./")
-			isRemotePath, _ := regexp.MatchString(`^[^.](.+?/){2,}.+\.ya?ml@`, j.Uses)
-			hasVersion, _ := regexp.MatchString(`\.ya?ml@`, j.Uses)
-
-			if isLocalPath {
-				return JobTypeReusableWorkflowLocal, nil
-			} else if isRemotePath && hasVersion {
-				return JobTypeReusableWorkflowRemote, nil
-			}
-		}
-
-		return JobTypeInvalid, fmt.Errorf("`uses` key references invalid workflow path '%s'. Must start with './' if it's a local workflow, or must start with '<org>/<repo>/' and include an '@' if it's a remote workflow", j.Uses)
-	}
-
-	return JobTypeDefault, nil
-}
-
-// ContainerSpec is the specification of the container to use for the job
-type ContainerSpec struct {
-	Image       string            `yaml:"image"`
-	Env         map[string]string `yaml:"env"`
-	Ports       []string          `yaml:"ports"`
-	Volumes     []string          `yaml:"volumes"`
-	Options     string            `yaml:"options"`
-	Credentials map[string]string `yaml:"credentials"`
-	Entrypoint  string
-	Args        string
-	Name        string
-	Reuse       bool
-
-	// Gitea specific
-	Cmd []string `yaml:"cmd"`
-}
-
-// Step is the structure of one step in a job
-type Step struct {
-	Number             int               `yaml:"-"`
-	ID                 string            `yaml:"id"`
-	If                 yaml.Node         `yaml:"if"`
-	Name               string            `yaml:"name"`
-	Uses               string            `yaml:"uses"`
-	Run                string            `yaml:"run"`
-	WorkingDirectory   string            `yaml:"working-directory"`
-	Shell              string            `yaml:"shell"`
-	Env                yaml.Node         `yaml:"env"`
-	With               map[string]string `yaml:"with"`
-	RawContinueOnError string            `yaml:"continue-on-error"`
-	TimeoutMinutes     string            `yaml:"timeout-minutes"`
-}
-
-// Clone returns a deep copy safe to mutate independently of s. Job steps are shared across
-// parallel matrix runs, which mutate per-job fields (ID, Number, Shell) and evaluate the If/Env
-// yaml.Nodes in place, so each job must own its copy.
-func (s *Step) Clone() *Step {
-	clone := *s
-	clone.If = CloneYamlNode(s.If)
-	clone.Env = CloneYamlNode(s.Env)
-	clone.With = maps.Clone(s.With)
-	return &clone
-}
-
-// CloneYamlNode returns a deep copy of a yaml.Node so callers can evaluate it in place without
-// mutating a node shared across parallel jobs.
-func CloneYamlNode(n yaml.Node) yaml.Node {
-	clone := n
-	if n.Content != nil {
-		clone.Content = make([]*yaml.Node, len(n.Content))
-		for i, child := range n.Content {
-			if child != nil {
-				childClone := CloneYamlNode(*child)
-				clone.Content[i] = &childClone
-			}
-		}
-	}
-	return clone
-}
-
-// String gets the name of step
-func (s *Step) String() string {
-	if s.Name != "" {
-		return s.Name
-	} else if s.Uses != "" {
-		return s.Uses
-	} else if s.Run != "" {
-		return s.Run
-	}
-	return s.ID
-}
-
-// Environment returns string-based key=value map for a step
-func (s *Step) Environment() map[string]string {
-	return environment(s.Env)
-}
-
-// GetEnv gets the env for a step
-func (s *Step) GetEnv() map[string]string {
-	env := s.Environment()
-
-	for k, v := range s.With {
-		envKey := regexp.MustCompile("[^A-Z0-9-]").ReplaceAllString(strings.ToUpper(k), "_")
-		envKey = "INPUT_" + strings.ToUpper(envKey)
-		env[envKey] = v
-	}
-	return env
-}
-
-// ShellCommand returns the command for the shell
-func (s *Step) ShellCommand() string {
-	var shellCommand string
-
-	// Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L9-L17
-	switch s.Shell {
-	case "", "bash":
-		shellCommand = "bash --noprofile --norc -e -o pipefail {0}"
-	case "pwsh":
-		shellCommand = "pwsh -command . '{0}'"
-	case "python":
-		shellCommand = "python {0}"
-	case "sh":
-		shellCommand = "sh -e {0}"
-	case "cmd":
-		shellCommand = "cmd /D /E:ON /V:OFF /S /C \"CALL \"{0}\"\""
-	case "powershell":
-		shellCommand = "powershell -command . '{0}'"
-	default:
-		shellCommand = s.Shell
-	}
-	return shellCommand
-}
-
-// StepType describes what type of step we are about to run
-type StepType int
-
-const (
-	// StepTypeRun is all steps that have a `run` attribute
-	StepTypeRun StepType = iota
-
-	// StepTypeUsesDockerURL is all steps that have a `uses` that is of the form `docker://...`
-	StepTypeUsesDockerURL
-
-	// StepTypeUsesActionLocal is all steps that have a `uses` that is a local action in a subdirectory
-	StepTypeUsesActionLocal
-
-	// StepTypeUsesActionRemote is all steps that have a `uses` that is a reference to a github repo
-	StepTypeUsesActionRemote
-
-	// StepTypeReusableWorkflowLocal is all steps that have a `uses` that is a local workflow in the .github/workflows directory
-	StepTypeReusableWorkflowLocal
-
-	// StepTypeReusableWorkflowRemote is all steps that have a `uses` that references a workflow file in a github repo
-	StepTypeReusableWorkflowRemote
-
-	// StepTypeInvalid is for steps that have invalid step action
-	StepTypeInvalid
-)
-
-func (s StepType) String() string {
-	switch s {
-	case StepTypeInvalid:
-		return "invalid"
-	case StepTypeRun:
-		return "run"
-	case StepTypeUsesActionLocal:
-		return "local-action"
-	case StepTypeUsesActionRemote:
-		return "remote-action"
-	case StepTypeUsesDockerURL:
-		return "docker"
-	case StepTypeReusableWorkflowLocal:
-		return "local-reusable-workflow"
-	case StepTypeReusableWorkflowRemote:
-		return "remote-reusable-workflow"
-	}
-	return "unknown"
-}
-
-// Type returns the type of the step
-func (s *Step) Type() StepType {
-	if s.Run == "" && s.Uses == "" {
-		return StepTypeInvalid
-	}
-
-	if s.Run != "" {
-		if s.Uses != "" {
-			return StepTypeInvalid
-		}
-		return StepTypeRun
-	} else if strings.HasPrefix(s.Uses, "docker://") {
-		return StepTypeUsesDockerURL
-	} else if strings.HasPrefix(s.Uses, "./.github/workflows") && (strings.HasSuffix(s.Uses, ".yml") || strings.HasSuffix(s.Uses, ".yaml")) {
-		return StepTypeReusableWorkflowLocal
-	} else if !strings.HasPrefix(s.Uses, "./") && strings.Contains(s.Uses, ".github/workflows") && (strings.Contains(s.Uses, ".yml@") || strings.Contains(s.Uses, ".yaml@")) {
-		return StepTypeReusableWorkflowRemote
-	} else if strings.HasPrefix(s.Uses, "./") {
-		return StepTypeUsesActionLocal
-	}
-	return StepTypeUsesActionRemote // `$/` self-repository refs land here and resolve in prepareActionExecutor
-}
-
-// UsesHash returns a hash of the uses string.
-// For Gitea.
-func (s *Step) UsesHash() string {
-	return UsesHash(s.Uses)
-}
-
-// UsesHash returns a hash of a `uses:` value.
-// For Gitea.
-func UsesHash(uses string) string {
-	return fmt.Sprintf("%x", sha256.Sum256([]byte(uses)))
-}
-
-// ReadWorkflow returns a list of jobs for a given workflow file reader
-func ReadWorkflow(in io.Reader) (*Workflow, error) {
-	w := new(Workflow)
-	err := yaml.NewDecoder(in).Decode(w)
-	return w, err
-}
-
-// GetJob will get a job by name in the workflow
-func (w *Workflow) GetJob(jobID string) *Job {
-	for id, j := range w.Jobs {
-		if jobID == id {
-			if j.Name == "" {
-				j.Name = id
-			}
-			if j.If.Value == "" {
-				j.If.Value = "success()"
-			}
-			return j
-		}
-	}
-	return nil
-}
-
-// GetJobIDs will get all the job names in the workflow
-func (w *Workflow) GetJobIDs() []string {
-	ids := make([]string, 0)
-	for id := range w.Jobs {
-		ids = append(ids, id)
-	}
-	return ids
-}
-
-var OnDecodeNodeError = func(node yaml.Node, out any, err error) {
-	log.Fatalf("Failed to decode node %v into %T: %v", node, out, err)
-}
-
-func decodeNode(node yaml.Node, out any) bool {
-	if err := node.Decode(out); err != nil {
-		if OnDecodeNodeError != nil {
-			OnDecodeNodeError(node, out, err)
-		}
-		return false
-	}
-	return true
-}
-
-// For Gitea
-// RawConcurrency represents a workflow concurrency or a job concurrency with uninterpolated options
-type RawConcurrency struct {
-	Group            string `yaml:"group,omitempty"`
-	CancelInProgress string `yaml:"cancel-in-progress,omitempty"`
-	RawExpression    string `yaml:"-,omitempty"`
-}
-
-type objectConcurrency RawConcurrency
-
-func (r *RawConcurrency) UnmarshalYAML(n *yaml.Node) error {
-	if err := n.Decode(&r.RawExpression); err == nil {
-		return nil
-	}
-	return n.Decode((*objectConcurrency)(r))
-}
-
-func (r *RawConcurrency) MarshalYAML() (any, error) {
-	if r.RawExpression != "" {
-		return r.RawExpression, nil
-	}
-
-	return (*objectConcurrency)(r), nil
-}

act/runner/action.go

@@ -23,8 +23,8 @@ import (
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/kballard/go-shellquote"
 )
 
@@ -167,6 +167,11 @@ func maybeCopyToActionDir(ctx context.Context, step actionStep, actionDir, actio
 
 	defer git.AcquireCloneLock(actionDir)()
 
+	if !rc.Config.NoActionPatch {
+		// A concurrent job's prepare resets this directory, so patch under the copy's lock.
+		patchActions(ctx, actionScriptPaths(filepath.Join(actionDir, actionPath), step.getActionModel()))
+	}
+
 	if err := removeGitIgnore(ctx, actionDir); err != nil {
 		return err
 	}

act/runner/action_cache_test.go

@@ -18,8 +18,8 @@ import (
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

act/runner/action_composite.go

@@ -13,7 +13,8 @@ import (
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
+
+	"gitea.dev/actionslib/pkg/model"
 )
 
 func evaluateCompositeInputAndEnv(ctx context.Context, parent *RunContext, step actionStep) map[string]string {

act/runner/action_test.go

@@ -16,8 +16,8 @@ import (
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"

act/runner/cancellation_test.go

@@ -9,9 +9,9 @@ import (
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/exprparser"
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"

act/runner/command_test.go

@@ -12,8 +12,8 @@ import (
 	"testing"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

act/runner/expression.go

@@ -7,7 +7,6 @@ package runner
 import (
 	"bytes"
 	"context"
-	"errors"
 	"fmt"
 	"maps"
 	"path"
@@ -18,12 +17,12 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
 
 	_ "embed"
 
-	"github.com/rhysd/actionlint"
+	"gitea.dev/actionslib/pkg/expreval"
+	"gitea.dev/actionslib/pkg/exprparser"
+	"gitea.dev/actionslib/pkg/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -235,137 +234,16 @@ func (ee expressionEvaluator) evaluate(ctx context.Context, in string, defaultSt
 	return evaluated, err
 }
 
-func (ee expressionEvaluator) evaluateScalarYamlNode(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
-	var in string
-	if err := node.Decode(&in); err != nil {
-		return nil, err
-	}
-	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-	}
-	res, err := ee.evaluateScalar(ctx, in)
-	if err != nil {
-		return nil, err
-	}
-	ret := &yaml.Node{}
-	if err := ret.Encode(res); err != nil {
-		return nil, err
-	}
-	return ret, err
-}
-
-func (ee expressionEvaluator) evaluateMappingYamlNode(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
-	var ret *yaml.Node
-	// GitHub has this undocumented feature to merge maps, called insert directive
-	insertDirective := regexp.MustCompile(`\${{\s*insert\s*}}`)
-	for i := 0; i < len(node.Content)/2; i++ {
-		changed := func() error {
-			if ret == nil {
-				ret = &yaml.Node{}
-				if err := ret.Encode(node); err != nil {
-					return err
-				}
-				ret.Content = ret.Content[:i*2]
-			}
-			return nil
-		}
-		k := node.Content[i*2]
-		v := node.Content[i*2+1]
-		ev, err := ee.evaluateYamlNodeInternal(ctx, v)
-		if err != nil {
-			return nil, err
-		}
-		if ev != nil {
-			if err := changed(); err != nil {
-				return nil, err
-			}
-		} else {
-			ev = v
-		}
-		var sk string
-		// Merge the nested map of the insert directive
-		if k.Decode(&sk) == nil && insertDirective.MatchString(sk) {
-			if ev.Kind != yaml.MappingNode {
-				return nil, fmt.Errorf("failed to insert node %v into mapping %v unexpected type %v expected MappingNode", ev, node, ev.Kind)
-			}
-			if err := changed(); err != nil {
-				return nil, err
-			}
-			ret.Content = append(ret.Content, ev.Content...)
-		} else {
-			ek, err := ee.evaluateYamlNodeInternal(ctx, k)
-			if err != nil {
-				return nil, err
-			}
-			if ek != nil {
-				if err := changed(); err != nil {
-					return nil, err
-				}
-			} else {
-				ek = k
-			}
-			if ret != nil {
-				ret.Content = append(ret.Content, ek, ev)
-			}
-		}
-	}
-	return ret, nil
-}
-
-func (ee expressionEvaluator) evaluateSequenceYamlNode(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
-	var ret *yaml.Node
-	for i := 0; i < len(node.Content); i++ {
-		v := node.Content[i]
-		// Preserve nested sequences
-		wasseq := v.Kind == yaml.SequenceNode
-		ev, err := ee.evaluateYamlNodeInternal(ctx, v)
-		if err != nil {
-			return nil, err
-		}
-		if ev != nil {
-			if ret == nil {
-				ret = &yaml.Node{}
-				if err := ret.Encode(node); err != nil {
-					return nil, err
-				}
-				ret.Content = ret.Content[:i]
-			}
-			// GitHub has this undocumented feature to merge sequences / arrays
-			// We have a nested sequence via evaluation, merge the arrays
-			if ev.Kind == yaml.SequenceNode && !wasseq {
-				ret.Content = append(ret.Content, ev.Content...)
-			} else {
-				ret.Content = append(ret.Content, ev)
-			}
-		} else if ret != nil {
-			ret.Content = append(ret.Content, v)
-		}
-	}
-	return ret, nil
-}
-
-func (ee expressionEvaluator) evaluateYamlNodeInternal(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
-	switch node.Kind {
-	case yaml.ScalarNode:
-		return ee.evaluateScalarYamlNode(ctx, node)
-	case yaml.MappingNode:
-		return ee.evaluateMappingYamlNode(ctx, node)
-	case yaml.SequenceNode:
-		return ee.evaluateSequenceYamlNode(ctx, node)
-	default:
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-	}
+// shared returns the evaluation layer of the shared library, bound to this context so the
+// evaluation of every single expression is still logged and masked here.
+func (ee expressionEvaluator) shared(ctx context.Context) expreval.Evaluator {
+	return expreval.New(func(in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) {
+		return ee.evaluate(ctx, in, defaultStatusCheck)
+	})
 }
 
 func (ee expressionEvaluator) EvaluateYamlNode(ctx context.Context, node *yaml.Node) error {
-	ret, err := ee.evaluateYamlNodeInternal(ctx, node)
-	if err != nil {
-		return err
-	}
-	if ret != nil {
-		return ret.Decode(node)
-	}
-	return nil
+	return ee.shared(ctx).EvaluateYamlNode(node)
 }
 
 func (ee expressionEvaluator) Interpolate(ctx context.Context, in string) string {
@@ -377,138 +255,16 @@ func (ee expressionEvaluator) Interpolate(ctx context.Context, in string) string
 	return out
 }
 
-// interpolate evaluates every part on its own, so a malformed one cannot restructure its neighbours
 func (ee expressionEvaluator) interpolate(ctx context.Context, in string) (string, error) {
-	parts, err := splitSubExpressions(in)
-	if err != nil {
-		return "", err
-	}
-	if len(parts) == 1 && !parts[0].isExpr {
-		return in, nil
-	}
-	var out strings.Builder
-	out.Grow(len(in))
-	for _, part := range parts {
-		if !part.isExpr {
-			out.WriteString(part.text)
-			continue
-		}
-		evaluated, err := ee.evaluate(ctx, part.text, exprparser.DefaultStatusCheckNone)
-		if err != nil {
-			return "", err
-		}
-		out.WriteString(exprparser.CoerceToString(evaluated))
-	}
-	return out.String(), nil
-}
-
-// evaluateScalar keeps the type of a lone expression, so `${{ fromJSON('[1,2]') }}` stays an array
-func (ee expressionEvaluator) evaluateScalar(ctx context.Context, in string) (any, error) {
-	parts, err := splitSubExpressions(in)
-	if err != nil {
-		return nil, err
-	}
-	if len(parts) == 1 && parts[0].isExpr {
-		return ee.evaluate(ctx, parts[0].text, exprparser.DefaultStatusCheckNone)
-	}
-	return ee.interpolate(ctx, in)
+	return ee.shared(ctx).Interpolate(in)
 }
 
 // EvalBool evaluates an expression against given evaluator. An `if:` is an expression even without
 // `${{ }}`, while literal text around one makes the whole value a string.
 func EvalBool(ctx context.Context, evaluator ExpressionEvaluator, expr string, defaultStatusCheck exprparser.DefaultStatusCheck) (bool, error) {
-	parts, err := splitSubExpressions(expr)
-	if err != nil {
-		return false, err
-	}
-	if len(parts) == 1 {
-		evaluated, err := evaluator.evaluate(ctx, parts[0].text, defaultStatusCheck)
-		if err != nil {
-			return false, err
-		}
-		return exprparser.IsTruthy(evaluated), nil
-	}
-
-	// mixed content is a string, so the status check applies to it separately
-	if defaultStatusCheck != exprparser.DefaultStatusCheckNone && !callsStatusFunction(parts) {
-		status, err := evaluator.evaluate(ctx, "", defaultStatusCheck)
-		if err != nil {
-			return false, err
-		}
-		if !exprparser.IsTruthy(status) {
-			return false, nil
-		}
-	}
-	interpolated, err := evaluator.interpolate(ctx, expr)
-	if err != nil {
-		return false, err
-	}
-	return exprparser.IsTruthy(interpolated), nil
-}
-
-// callsStatusFunction reports whether any part calls a status function. A part that does not parse
-// counts as one, so the evaluation reports it against the real values.
-func callsStatusFunction(parts []exprPart) bool {
-	for _, part := range parts {
-		if !part.isExpr {
-			continue
-		}
-		// The lexer needs the closing `}}` that the scanner strips.
-		exprNode, err := actionlint.NewExprParser().Parse(actionlint.NewExprLexer(part.text + "}}"))
-		if err != nil || exprparser.CallsStatusFunction(exprNode) {
-			return true
-		}
-	}
-	return false
-}
-
-type exprPart struct {
-	text   string
-	isExpr bool
-}
-
-// splitSubExpressions splits in the way GitHub's template reader does, leaving a value without a
-// complete expression literal.
-func splitSubExpressions(in string) ([]exprPart, error) {
-	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
-		return []exprPart{{text: in}}, nil
-	}
-
-	parts := make([]exprPart, 0, 2*strings.Count(in, "${{")+1)
-	for {
-		start := strings.Index(in, "${{")
-		if start < 0 {
-			if in != "" {
-				parts = append(parts, exprPart{text: in})
-			}
-			return parts, nil
-		}
-		if start > 0 {
-			parts = append(parts, exprPart{text: in[:start]})
-		}
-		rest := in[start+len("${{"):]
-		end := indexExprEnd(rest)
-		if end < 0 {
-			return nil, errors.New("unclosed expression")
-		}
-		parts = append(parts, exprPart{text: strings.TrimSpace(rest[:end]), isExpr: true})
-		in = rest[end+len("}}"):]
-	}
-}
-
-// indexExprEnd returns the offset of the `}}` ending an expression, or -1. A quote toggles string
-// state, so a `}}` inside a string does not end it.
-func indexExprEnd(in string) int {
-	inString := false
-	for i := range len(in) {
-		switch {
-		case in[i] == '\'':
-			inString = !inString
-		case !inString && in[i] == '}' && i+1 < len(in) && in[i+1] == '}':
-			return i
-		}
-	}
-	return -1
+	return expreval.New(func(in string, dsc exprparser.DefaultStatusCheck) (any, error) {
+		return evaluator.evaluate(ctx, in, dsc)
+	}).EvalBool(expr, defaultStatusCheck)
 }
 
 func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *model.GithubContext) map[string]any {

act/runner/expression_test.go

@@ -9,9 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
-
+	"gitea.dev/actionslib/pkg/exprparser"
+	"gitea.dev/actionslib/pkg/model"
 	assert "github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	yaml "go.yaml.in/yaml/v4"
@@ -279,41 +278,6 @@ func TestInterpolate(t *testing.T) {
 	}
 }
 
-func TestSplitSubExpressions(t *testing.T) {
-	expr := func(text string) exprPart { return exprPart{text: text, isExpr: true} }
-	literal := func(text string) exprPart { return exprPart{text: text} }
-
-	for _, tt := range []struct {
-		in   string
-		want []exprPart
-	}{
-		{"Hello World", []exprPart{literal("Hello World")}},
-		{"${{ true }}", []exprPart{expr("true")}},
-		{"${{ true }} ${{ false }}", []exprPart{expr("true"), literal(" "), expr("false")}},
-		{"Hello ${{ 'World' }}", []exprPart{literal("Hello "), expr("'World'")}},
-		// a quote toggles string state, so a `}}` inside a string does not end the expression
-		{"${{ '}}' }}", []exprPart{expr("'}}'")}},
-		{"${{ '''}}''' }}", []exprPart{expr("'''}}'''")}},
-		{"${{ '''' }}", []exprPart{expr("''''")}},
-		{`${{ fromJSON('"}}"') }}`, []exprPart{expr(`fromJSON('"}}"')`)}},
-		{`${{ fromJSON('"\"}}\""') }}`, []exprPart{expr(`fromJSON('"\"}}\""')`)}},
-		{`${{ fromJSON('"''}}"') }}`, []exprPart{expr(`fromJSON('"''}}"')`)}},
-		// without a complete literal the value stays text, as GitHub's template reader leaves it
-		{"${{ 1", []exprPart{literal("${{ 1")}},
-		// a malformed part stays one part, so it cannot restructure its neighbours
-		{"${{ 1) && (2 }}", []exprPart{expr("1) && (2")}},
-	} {
-		got, err := splitSubExpressions(tt.in)
-		require.NoError(t, err, tt.in)
-		assert.Equal(t, tt.want, got, tt.in)
-	}
-
-	for _, in := range []string{"${{ 'a' }} ${{ b", "${{ 'a }}"} {
-		_, err := splitSubExpressions(in)
-		assert.ErrorContains(t, err, "unclosed expression", in)
-	}
-}
-
 func TestGetEvaluatorInputsBoolean(t *testing.T) {
 	workflows := map[string]string{
 		"workflow_call": `

act/runner/job_executor.go

@@ -23,8 +23,9 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
+
+	"gitea.dev/actionslib/pkg/exprparser"
+	"gitea.dev/actionslib/pkg/model"
 )
 
 const maxJobSummaryBytes = 1024 * 1024

act/runner/job_executor_test.go

@@ -22,8 +22,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	log "github.com/sirupsen/logrus"
 	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"

act/runner/job_hooks_test.go

@@ -12,8 +12,8 @@ import (
 	"testing"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

act/runner/max_parallel_test.go

@@ -6,8 +6,7 @@ package runner
 import (
 	"testing"
 
-	"gitea.com/gitea/runner/act/model"
-
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"go.yaml.in/yaml/v4"
 )

act/runner/patch_actions.go

@@ -12,8 +12,8 @@ import (
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
+
+	"gitea.dev/actionslib/pkg/model"
 )
 
 // Actions bundle the @actions toolkit into their own JavaScript, and two of its lines keep it
@@ -40,8 +40,7 @@ const (
 	cacheURLEnv       = "ACTIONS_CACHE_URL"
 	resultsURLEnv     = "ACTIONS_RESULTS_URL"
 
-	// localhostHost is the suffix isGhes accepts; emptying the test is what opens the gate,
-	// because every hostname ends with the empty string.
+	// localhostHost is the suffix isGhes accepts.
 	localhostHost = ".LOCALHOST"
 
 	// artifactRefusal is the only thing the gate guards in @actions/artifact, which is what makes
@@ -49,13 +48,6 @@ const (
 	// runner has not looked at, and is left alone.
 	artifactRefusal = "GHESNotSupportedError"
 
-	// sidecarSuffix names the directory of untouched copies, a sibling of the action directory
-	// because that directory is copied wholesale into job containers.
-	sidecarSuffix = ".toolkit-patch"
-
-	// skipMarker in the sidecar means a patched bundle already failed once here.
-	skipMarker = "skip"
-
 	maxBundleSize = 64 << 20
 )
 
@@ -100,156 +92,64 @@ func actionScriptPaths(dir string, action *model.Action) []string {
 	}
 	var paths []string
 	for _, script := range []string{action.Runs.Pre, action.Runs.Main, action.Runs.Post} {
-		if script != "" {
-			paths = append(paths, filepath.Join(dir, script))
+		if script == "" {
+			continue
 		}
+		path := filepath.Join(dir, script)
+		// `runs` is the action's own yaml, and a key pointing outside its directory is not ours.
+		if rel, err := filepath.Rel(dir, path); err != nil || strings.HasPrefix(rel, "..") {
+			continue
+		}
+		paths = append(paths, path)
 	}
 	return paths
 }
 
-// patchToolkit edits the toolkit in an action's bundles, keeping each original beside them. Every
-// failure is silent and leaves the bundle as it was, which costs the cache client the v2 API and
-// an artifact action nothing at all.
-func patchToolkit(ctx context.Context, actionDir string, scripts []string) {
-	if len(scripts) == 0 {
-		return
-	}
-	if _, err := os.Stat(filepath.Join(sidecarDir(actionDir), skipMarker)); err == nil {
-		return
-	}
-	defer git.AcquireCloneLock(actionDir)()
-
+// patchActions edits the toolkit in an action's bundles. The caller holds the action directory's
+// clone lock, which is what keeps another job's checkout from resetting them before the copy.
+func patchActions(ctx context.Context, scripts []string) {
 	for _, script := range scripts {
-		if err := patchBundle(script, originalFor(actionDir, script)); err != nil {
-			common.Logger(ctx).Debugf("actions toolkit: %s left unpatched: %v", filepath.Base(script), err)
+		switch patched, err := patchBundle(script); {
+		case err != nil:
+			common.Logger(ctx).Warnf("actions toolkit: %s left unpatched: %v", script, err)
+		case patched:
+			common.Logger(ctx).Debugf("actions toolkit: patched %s", script)
 		}
 	}
 }
 
-// revertToolkit puts the originals back and stops this action being patched again, so the next job
-// runs it exactly as shipped. Called when a step failed with a patched bundle; it does not re-run
-// the step, because a step's outputs and env-file writes are already recorded by then.
-func revertToolkit(ctx context.Context, actionDir string, scripts []string) {
-	if len(scripts) == 0 {
-		return
-	}
-	if _, err := os.Stat(sidecarDir(actionDir)); err != nil {
-		return
-	}
-	defer git.AcquireCloneLock(actionDir)()
-
-	reverted := false
-	for _, script := range scripts {
-		original := originalFor(actionDir, script)
-		if !isPatchOf(original, script) {
-			continue
-		}
-		if err := os.Rename(original, script); err == nil {
-			reverted = true
-		}
-	}
-	if reverted {
-		_ = os.WriteFile(filepath.Join(sidecarDir(actionDir), skipMarker), nil, 0o600)
-		common.Logger(ctx).Warnf("actions toolkit: restored the original %s, it will not be patched again", filepath.Base(actionDir))
-	}
-}
-
-// sidecarDir holds an action's untouched bundles, and the marker that stops it being patched.
-func sidecarDir(actionDir string) string {
-	return actionDir + sidecarSuffix
-}
-
-// originalFor is where a script's untouched copy lives, or "" for a script the action's own
-// `runs` keys placed outside its directory, which is not this runner's to rewrite.
-func originalFor(actionDir, script string) string {
-	rel, err := filepath.Rel(actionDir, script)
-	if err != nil || strings.HasPrefix(rel, "..") {
-		return ""
-	}
-	return filepath.Join(sidecarDir(actionDir), rel)
-}
-
-// patchBundle rewrites one entrypoint in place. The untouched copy kept beside it is what marks
-// the bundle as already patched.
-func patchBundle(script, original string) error {
-	if original == "" {
-		return nil
-	}
-	if _, err := os.Stat(original); err == nil {
-		if isPatchOf(original, script) {
-			return nil
-		}
-		// The action's ref moved and git checked the new bundle out over the patched one, so
-		// the pair no longer belongs together. Patch afresh rather than keep an original that
-		// would restore an older version of the action.
-		if err := os.Remove(original); err != nil {
-			return err
-		}
-	}
+func patchBundle(script string) (bool, error) {
 	info, err := os.Stat(script)
 	if err != nil {
-		return err
+		return false, err
 	}
 	if info.Size() > maxBundleSize {
-		return nil
+		return false, nil
 	}
 	data, err := os.ReadFile(script)
 	if err != nil {
-		return err
+		return false, err
 	}
 	patched, ok := patchedBundle(data)
 	if !ok {
-		return nil
+		return false, nil
 	}
-	if err := os.MkdirAll(filepath.Dir(original), 0o755); err != nil {
-		return err
-	}
-	// The copy is taken before the bundle is replaced, so a write that fails part way can put the
-	// action back as it was. A crash needs no handling: the clone executor checks the action out
-	// and hard resets it on every prepare, so a half-written bundle never outlives the job.
-	if err := os.WriteFile(original, data, info.Mode().Perm()); err != nil {
-		return err
-	}
-	if err := os.WriteFile(script, patched, info.Mode().Perm()); err != nil {
-		_ = os.Rename(original, script)
-		return err
-	}
-	return nil
-}
-
-// isPatchOf reports whether script is exactly what patching original produced. It is what proves
-// the two still belong together: an action whose ref moved is checked out over the patched bundle,
-// leaving an original that would restore the version before the move.
-func isPatchOf(original, script string) bool {
-	data, err := os.ReadFile(original)
-	if err != nil {
-		return false
-	}
-	current, err := os.ReadFile(script)
-	if err != nil {
-		return false
-	}
-	patched, ok := patchedBundle(data)
-	return ok && bytes.Equal(patched, current)
+	// No atomic write needed: every prepare checks the action out and hard resets it.
+	return true, os.WriteFile(script, patched, info.Mode().Perm())
 }
 
 // patchedBundle opens the GHES gate, and where the cache toolkit is present, points the cache
 // service at the cache server. A bundle this runner cannot account for comes back untouched.
 func patchedBundle(data []byte) ([]byte, bool) {
-	if !localhostTest.Match(data) {
+	// Literals before regex: most bundles carry neither toolkit and stop here. The artifact gate
+	// guards a refusal with no URL to move, so it opens alone; the cache gate opens only with its
+	// service URL, since a bundle whose getter this cannot find is better left on v1.
+	artifact := bytes.Contains(data, []byte(artifactRefusal))
+	cache := bytes.Contains(data, []byte(CacheServiceV2Env)) && serviceURLBranches.Match(data)
+	if !artifact && !cache {
 		return data, false
 	}
-	switch {
-	case bytes.Contains(data, []byte(CacheServiceV2Env)):
-		// The cache toolkit: both edits or neither, because choosing v2 without redirecting the
-		// URL would send the client to a results URL that serves no cache service.
-		if !serviceURLBranches.Match(data) {
-			return data, false
-		}
-	case bytes.Contains(data, []byte(artifactRefusal)):
-		// The artifact toolkit, where the gate is a plain refusal and there is no URL to move:
-		// artifacts already go to Gitea, which implements that service.
-	default:
+	if !localhostTest.Match(data) {
 		return data, false
 	}
 
@@ -258,5 +158,8 @@ func patchedBundle(data []byte) ([]byte, bool) {
 		// quoting survives and the result stays valid even inside a string literal.
 		return bytes.Replace(test, []byte(localhostHost), nil, 1)
 	})
-	return serviceURLBranches.ReplaceAll(opened, cacheURLFirst), true
+	if cache {
+		opened = serviceURLBranches.ReplaceAll(opened, cacheURLFirst)
+	}
+	return opened, true
 }

act/runner/patch_actions_e2e_test.go

@@ -108,17 +108,15 @@ func runActionEntrypoint(t *testing.T, script string, env jobEnv, inputs map[str
 	return string(out)
 }
 
-// patchedAction downloads one entrypoint and patches it exactly as a downloaded action would be,
-// keeping the untouched original in the sidecar beside it.
+// patchedAction downloads one entrypoint and patches it exactly as a downloaded action would be.
 func patchedAction(t *testing.T, repo, ref, entrypoint string) string {
 	t.Helper()
 
 	body, err := os.ReadFile(bundleFromGitHub(t, repo, ref, entrypoint))
 	require.NoError(t, err)
-	dir := tempDirPath(t)
-	script := filepath.Join(dir, filepath.Base(entrypoint))
+	script := filepath.Join(tempDirPath(t), filepath.Base(entrypoint))
 	require.NoError(t, os.WriteFile(script, body, 0o600))
-	patchToolkit(t.Context(), dir, []string{script})
+	patchActions(t.Context(), []string{script})
 	return script
 }
 
@@ -144,7 +142,7 @@ func TestCacheServiceV2EndToEnd(t *testing.T) {
 	restore := patchedAction(t, "actions/cache", actionsCacheRef, "dist/restore/index.js")
 	save := patchedAction(t, "actions/cache", actionsCacheRef, "dist/save/index.js")
 
-	handler, err := artifactcache.StartHandler(filepath.Join(t.TempDir(), "cache"), "127.0.0.1", 0, "", nil)
+	handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: filepath.Join(t.TempDir(), "cache"), OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = handler.Close() })
 	const token, repo = "e2e-runtime-token", "testuser/testrepo"
@@ -184,7 +182,7 @@ func TestCacheServiceV2EndToEnd(t *testing.T) {
 	// cache server on its own address. That is what a runner without a results service of its own
 	// leaves its jobs with, so it has to round trip too.
 	env.workspace = tempDirPath(t)
-	v1 := runActionEntrypoint(t, filepath.Join(sidecarDir(filepath.Dir(restore)), "index.js"), env, inputs)
+	v1 := runActionEntrypoint(t, bundleFromGitHub(t, "actions/cache", actionsCacheRef, "dist/restore/index.js"), env, inputs)
 	require.Contains(t, v1, "Cache service version: v1")
 	require.Contains(t, v1, "Cache restored from key: "+key)
 }
@@ -194,7 +192,7 @@ func TestCacheServiceV2EndToEnd(t *testing.T) {
 // anchored on that distance. One entrypoint from each of the families that bundle the cache
 // toolkit, patched but not run, is what keeps a future release from quietly matching only one of
 // the two shapes and leaving every cache on v1.
-func TestToolkitPatchAcrossActions(t *testing.T) {
+func TestPatchedBundleAcrossActions(t *testing.T) {
 	for _, tc := range []struct {
 		repo, ref, path string
 		wantPatched     bool
@@ -291,7 +289,7 @@ func TestUploadArtifactThroughTheResultsService(t *testing.T) {
 	}))
 	defer gitea.Close()
 
-	handler, err := artifactcache.StartHandler(filepath.Join(t.TempDir(), "cache"), "127.0.0.1", 0, "", nil)
+	handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: filepath.Join(t.TempDir(), "cache"), OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = handler.Close() })
 	// The artifact client decodes the runtime token for the run ids it puts in its requests, where
@@ -345,7 +343,7 @@ func TestSetupActionFindsTheCacheService(t *testing.T) {
 
 	setup := patchedAction(t, "actions/setup-node", "v7.0.0", "dist/setup/index.js")
 
-	handler, err := artifactcache.StartHandler(filepath.Join(t.TempDir(), "cache"), "127.0.0.1", 0, "", nil)
+	handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: filepath.Join(t.TempDir(), "cache"), OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = handler.Close() })
 	const token = "setup-runtime-token"

act/runner/patch_actions_test.go

@@ -5,16 +5,15 @@ package runner
 
 import (
 	"context"
-	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
 
-	"gitea.com/gitea/runner/act/model"
-
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -173,51 +172,42 @@ func TestPatchedBundleSurvivesInsideAStringLiteral(t *testing.T) {
 	require.NoError(t, err, "%s", checked)
 }
 
-func TestPatchBundleKeepsTheOriginal(t *testing.T) {
-	dir, script := bundleFile(t, gateTSC)
-	original := originalFor(dir, script)
+// An action with a pre step is copied, and so patched, twice.
+func TestPatchBundleIsIdempotent(t *testing.T) {
+	script := bundleFile(t, gateTSC)
 
-	require.NoError(t, patchBundle(script, original))
+	done, err := patchBundle(script)
+	require.NoError(t, err)
+	require.True(t, done)
 	patched, err := os.ReadFile(script)
 	require.NoError(t, err)
-	assert.True(t, gateOpened(string(patched)))
+	require.True(t, gateOpened(string(patched)))
 
-	kept, err := os.ReadFile(original)
+	done, err = patchBundle(script)
 	require.NoError(t, err)
-	assert.Equal(t, gateTSC, string(kept), "the untouched bundle is kept outside the action tree")
-	assert.NotContains(t, original, dir+string(filepath.Separator), "originals must not ship into job containers")
-
-	// Patching again must not stack, and must not overwrite the kept original.
-	require.NoError(t, patchBundle(script, original))
+	assert.False(t, done, "a patched bundle is not patched again")
 	again, err := os.ReadFile(script)
 	require.NoError(t, err)
 	assert.Equal(t, string(patched), string(again))
-	kept, err = os.ReadFile(original)
-	require.NoError(t, err)
-	assert.Equal(t, gateTSC, string(kept))
 }
 
-// A bundle with nothing to patch is left exactly as it was, with no original kept beside it.
 func TestPatchBundleLeavesOtherActionsAlone(t *testing.T) {
-	dir, script := bundleFile(t, `console.log("checkout")`)
-	original := originalFor(dir, script)
+	script := bundleFile(t, `console.log("checkout")`)
 
-	require.NoError(t, patchBundle(script, original))
+	done, err := patchBundle(script)
+	require.NoError(t, err)
+	assert.False(t, done)
 	body, err := os.ReadFile(script)
 	require.NoError(t, err)
 	assert.Equal(t, `console.log("checkout")`, string(body))
-	_, err = os.Stat(original)
-	assert.True(t, os.IsNotExist(err), "no original is kept for a bundle that was not patched")
 }
 
-// bundleFile writes one entrypoint into a fresh action directory.
-func bundleFile(t *testing.T, body string) (dir, script string) {
+func bundleFile(t *testing.T, body string) string {
 	t.Helper()
 
-	dir = t.TempDir()
-	script = filepath.Join(dir, "index.js")
+	script := filepath.Join(t.TempDir(), "index.js")
 	require.NoError(t, os.WriteFile(script, []byte(body), 0o600))
-	return dir, script
+	return script
 }
 
 func TestActionScriptPaths(t *testing.T) {
@@ -227,101 +217,50 @@ func TestActionScriptPaths(t *testing.T) {
 	// Only a node action has a bundle to patch.
 	assert.Nil(t, actionScriptPaths("/a", &model.Action{Runs: model.ActionRuns{Using: "docker", Image: "alpine"}}))
 	assert.Nil(t, actionScriptPaths("/a", nil))
+
+	// An action naming a file outside its own directory does not get it rewritten.
+	escaping := &model.Action{Runs: model.ActionRuns{Using: "node20", Main: "../../elsewhere/index.js"}}
+	assert.Nil(t, actionScriptPaths("/a", escaping))
 }
 
-// A step that fails with a patched bundle gets the untouched bundle back, and the action is not
-// patched again, so later jobs run it exactly as its author shipped it.
-func TestRevertToolkit(t *testing.T) {
-	dir, script := bundleFile(t, gateTSC)
-	scripts := []string{script}
-
-	patchToolkit(t.Context(), dir, scripts)
-	body, err := os.ReadFile(script)
-	require.NoError(t, err)
-	require.True(t, gateOpened(string(body)), "precondition: the bundle is patched")
-
-	revertToolkit(t.Context(), dir, scripts)
-	body, err = os.ReadFile(script)
-	require.NoError(t, err)
-	assert.Equal(t, gateTSC, string(body), "the original bundle is back")
-
-	// The skip marker survives, so the action stays unpatched from now on.
-	patchToolkit(t.Context(), dir, scripts)
-	body, err = os.ReadFile(script)
-	require.NoError(t, err)
-	assert.Equal(t, gateTSC, string(body), "a reverted action stays unpatched")
-}
-
-// An action whose ref moves is checked out over the patched bundle. The kept original then
-// belongs to the version before the move, and must not be restored over the new one.
-func TestPatchBundleAfterTheActionMoved(t *testing.T) {
-	dir, script := bundleFile(t, gateTSC)
-	original := originalFor(dir, script)
-	scripts := []string{script}
-
-	patchToolkit(t.Context(), dir, scripts)
-	require.NoError(t, os.WriteFile(script, []byte(gateWebpack), 0o600)) // the new version lands
-
-	// Reverting must not roll the action back to the version the original came from.
-	revertToolkit(t.Context(), dir, scripts)
-	body, err := os.ReadFile(script)
-	require.NoError(t, err)
-	assert.Equal(t, gateWebpack, string(body))
-
-	// Nothing was reverted, so the action is not marked off either: the new version is patched
-	// in its own right, and keeps its own original.
-	require.NoFileExists(t, filepath.Join(sidecarDir(dir), skipMarker))
-	require.NoError(t, patchBundle(script, original))
-	body, err = os.ReadFile(script)
-	require.NoError(t, err)
-	assert.True(t, gateOpened(string(body)))
-	kept, err := os.ReadFile(original)
-	require.NoError(t, err)
-	assert.Equal(t, gateWebpack, string(kept))
-}
-
-// The wiring: a step patches its own bundles only when the runner serves the v2 API, and a step
-// that fails gets them back. The action's path inside its repository is part of where they live.
-func TestStepActionRemoteToolkitPatch(t *testing.T) {
-	newStep := func(t *testing.T, patch bool) (*stepActionRemote, string) {
+// The bundle has to be patched whatever state the shared action directory is in, because a
+// concurrent job's prepare checks the action out again and resets it.
+func TestPatchActionsAtTheContainerCopy(t *testing.T) {
+	copiedBundle := func(t *testing.T, noPatch bool) string {
 		t.Helper()
 
+		cm := &containerMock{}
 		sar := &stepActionRemote{
 			Step:         &model.Step{Uses: "owner/repo/sub@v1"},
 			remoteAction: &remoteAction{Org: "owner", Repo: "repo", Path: "sub", Ref: "v1"},
 			action:       &model.Action{Runs: model.ActionRuns{Using: "node20", Main: "index.js"}},
 			RunContext: &RunContext{
-				Config: &Config{ActionCacheDir: t.TempDir(), PatchToolkit: patch},
+				Config:       &Config{ActionCacheDir: t.TempDir(), NoActionPatch: noPatch},
+				JobContainer: cm,
 			},
 		}
 		script := filepath.Join(sar.actionDir(), "sub", "index.js")
 		require.NoError(t, os.MkdirAll(filepath.Dir(script), 0o755))
 		require.NoError(t, os.WriteFile(script, []byte(gateTSC), 0o600))
-		return sar, script
+
+		var copied string
+		cm.On("CopyDir", mock.Anything, mock.Anything, mock.Anything).Return(func(context.Context) error {
+			body, err := os.ReadFile(script)
+			require.NoError(t, err)
+			copied = string(body)
+			return nil
+		})
+		require.NoError(t, maybeCopyToActionDir(t.Context(), sar, sar.actionDir(), "sub", "/var/run/act/actions/repo/sub"))
+		return copied
 	}
 
-	t.Run("left alone when the runner does not patch", func(t *testing.T) {
-		sar, script := newStep(t, false)
-		require.NoError(t, sar.patchActionToolkit(t.Context()))
-
-		body, err := os.ReadFile(script)
-		require.NoError(t, err)
-		assert.Equal(t, gateTSC, string(body))
+	t.Run("patched on its way in", func(t *testing.T) {
+		assert.True(t, gateOpened(copiedBundle(t, false)))
 	})
 
-	t.Run("patched, and put back when the step fails", func(t *testing.T) {
-		sar, script := newStep(t, true)
-		require.NoError(t, sar.patchActionToolkit(t.Context()))
-
-		body, err := os.ReadFile(script)
-		require.NoError(t, err)
-		require.True(t, gateOpened(string(body)))
-
-		failed := errors.New("the step failed")
-		require.ErrorIs(t, sar.revertToolkitOnFailure(func(context.Context) error { return failed })(t.Context()), failed)
-
-		body, err = os.ReadFile(script)
-		require.NoError(t, err)
-		assert.Equal(t, gateTSC, string(body))
+	// The escape hatch, for an action the edit breaks: the artifact actions refuse again, and the
+	// cache client keeps to v1.
+	t.Run("as shipped when the runner is told not to patch", func(t *testing.T) {
+		assert.Equal(t, gateTSC, copiedBundle(t, true))
 	})
 }

act/runner/reusable_workflow.go

@@ -16,7 +16,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
+
+	"gitea.dev/actionslib/pkg/model"
 )
 
 func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {

act/runner/reusable_workflow_test.go

@@ -14,8 +14,8 @@ import (
 	"time"
 
 	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/require"
 )
 

act/runner/run_context.go

@@ -27,10 +27,11 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
+	"gitea.com/gitea/runner/act/ghcontext"
 	"gitea.com/gitea/runner/internal/pkg/lock"
 
+	"gitea.dev/actionslib/pkg/exprparser"
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/docker/cli/cli/compose/loader"
 	"github.com/docker/go-connections/nat"
 	"github.com/moby/moby/api/types/mount"
@@ -228,14 +229,19 @@ func (rc *RunContext) containerDaemonSocket() string {
 	return rc.Config.ContainerDaemonSocket
 }
 
+const sharedToolCacheVolume = "act-toolcache" // mounted only when the tool cache is shared
+
 // validVolumes returns the volumes allowed on this job's containers: the configured base
 // plus the volumes the runner mounts automatically. It derives a fresh slice every call and
 // never mutates the shared Config (see containerDaemonSocket).
 func (rc *RunContext) validVolumes() []string {
 	name := rc.jobContainerName()
 	volumes := slices.Clone(rc.Config.ValidVolumes)
+	if rc.Config.SharedToolCache {
+		volumes = append(volumes, sharedToolCacheVolume)
+	}
 	// TODO: add a new configuration to control whether the docker daemon can be mounted
-	return append(volumes, "act-toolcache", name, name+"-env",
+	return append(volumes, name, name+"-env",
 		getDockerDaemonSocketMountPath(rc.containerDaemonSocket()))
 }
 
@@ -308,8 +314,10 @@ func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) {
 	if daemonSocket := rc.containerDaemonSocket(); daemonSocket != "-" && !claimed["/var/run/docker.sock"] {
 		binds = append(binds, getDockerDaemonSocketMountPath(daemonSocket)+":/var/run/docker.sock")
 	}
-	if toolCache := rc.toolCache(container.DefaultToolCache); !claimed[toolCache] {
-		mounts["act-toolcache"] = toolCache
+	if rc.Config.SharedToolCache {
+		if toolCache := rc.toolCache(container.DefaultToolCache); !claimed[toolCache] {
+			mounts[sharedToolCacheVolume] = toolCache
+		}
 	}
 	mounts[name+"-env"] = ext.GetActPath() // runner-internal, never overridable
 
@@ -359,7 +367,11 @@ func (rc *RunContext) startHostEnvironment() common.Executor {
 		if err := os.MkdirAll(runnerTmp, 0o777); err != nil {
 			return err
 		}
-		toolCache := rc.toolCache(filepath.Join(cacheDir, "tool_cache"))
+		toolCacheParent := miscpath // per job, so cleanup removes it with the job
+		if rc.Config.SharedToolCache {
+			toolCacheParent = cacheDir
+		}
+		toolCache := rc.toolCache(filepath.Join(toolCacheParent, "tool_cache"))
 		if err := os.MkdirAll(toolCache, 0o777); err != nil {
 			return err
 		}
@@ -1355,12 +1367,12 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext
 
 	ghc.SetBaseAndHeadRef()
 	repoPath := rc.Config.Workdir
-	ghc.SetRepositoryAndOwner(ctx, rc.Config.GitHubInstance, rc.Config.RemoteName, repoPath)
+	ghcontext.SetRepositoryAndOwner(ctx, ghc, rc.Config.GitHubInstance, rc.Config.RemoteName, repoPath)
 	if ghc.Ref == "" {
-		ghc.SetRef(ctx, rc.Config.DefaultBranch, repoPath)
+		ghcontext.SetRef(ctx, ghc, rc.Config.DefaultBranch, repoPath)
 	}
 	if ghc.Sha == "" {
-		ghc.SetSha(ctx, repoPath)
+		ghcontext.SetSha(ctx, ghc, repoPath)
 	}
 
 	ghc.SetRefTypeAndName()

act/runner/run_context_test.go

@@ -17,9 +17,9 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/exprparser"
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/docker/cli/cli/compose/loader"
 	log "github.com/sirupsen/logrus"
 	assert "github.com/stretchr/testify/assert"
@@ -502,7 +502,8 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 						},
 					},
 					Config: &Config{
-						BindWorkdir: false,
+						BindWorkdir:     false,
+						SharedToolCache: true, // so OverridesToolCache has a mount to displace
 					},
 				}
 				rc.Run.JobID = "job1"
@@ -543,25 +544,44 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 			})
 		}
 	})
+
+	t.Run("ToolCacheMount", func(t *testing.T) {
+		rc := &RunContext{
+			Name:   "TestRCName",
+			Run:    &model.Run{Workflow: &model.Workflow{Name: "TestWorkflowName"}},
+			Config: &Config{},
+		}
+
+		_, gotmount := rc.GetBindsAndMounts()
+		assert.NotContains(t, gotmount, sharedToolCacheVolume)
+
+		rc.Config.SharedToolCache = true
+		_, gotmount = rc.GetBindsAndMounts()
+		assert.Equal(t, container.DefaultToolCache, gotmount[sharedToolCacheVolume])
+	})
 }
 
 func TestRunContextValidVolumes(t *testing.T) {
 	rc := &RunContext{
 		Name:   "job",
 		Run:    &model.Run{Workflow: &model.Workflow{Name: "wf"}},
-		Config: &Config{ValidVolumes: []string{"my-vol", "/host/path"}},
+		Config: &Config{ValidVolumes: []string{"my-vol", "/host/path"}, SharedToolCache: true},
 	}
 	name := rc.jobContainerName()
 
 	got := rc.validVolumes()
 
-	// the configured volumes plus the four the runner mounts automatically
-	assert.Subset(t, got, []string{"my-vol", "/host/path", "act-toolcache", name, name + "-env", "/var/run/docker.sock"})
+	// the configured volumes plus the ones the runner mounts automatically
+	assert.Subset(t, got, []string{"my-vol", "/host/path", sharedToolCacheVolume, name, name + "-env", "/var/run/docker.sock"})
 
 	// deriving the list must never mutate or grow the shared Config slice: parallel matrix
 	// combinations share one *Config, and the previous in-place append was a data race.
 	assert.Equal(t, []string{"my-vol", "/host/path"}, rc.Config.ValidVolumes)
 	assert.Len(t, rc.validVolumes(), len(got), "repeated calls must be stable, not accumulate")
+
+	// a job may mount it only while the runner does
+	rc.Config.SharedToolCache = false
+	assert.NotContains(t, rc.validVolumes(), sharedToolCacheVolume)
 }
 
 func TestCleanupJobResourcesCleansServicesWithoutJobContainer(t *testing.T) {

act/runner/runner.go

@@ -16,8 +16,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	docker_container "github.com/moby/moby/api/types/container"
 	log "github.com/sirupsen/logrus"
 )
@@ -74,7 +74,7 @@ type Config struct {
 	ContainerNetworkCreateOptions      container.NewDockerNetworkCreateExecutorInput // the default network create options
 	ActionCache                        ActionCache                                   // Use a custom ActionCache Implementation
 	ProxyEnv                           map[string]string                             // the proxy variables the job runs with, also given to service containers and image builds
-	PatchToolkit                       bool                                          // edit the @actions toolkit bundled into an action so it works against Gitea, see toolkit_patch.go
+	NoActionPatch                      bool                                          // run actions exactly as published, applying no compatibility patches, see patch_actions.go
 
 	PresetGitHubContext   *model.GithubContext // the preset github context, overrides some fields like DefaultBranch, Env, Secrets etc.
 	EventJSON             string               // the content of JSON file to use for event.json in containers, overrides EventPath
@@ -91,6 +91,7 @@ type Config struct {
 	PlatformPicker                    func(labels []string) string // platform picker, it will take precedence over Platforms if isn't nil
 	JobLoggerLevel                    *log.Level                   // the level of job logger
 	ValidVolumes                      []string                     // only volumes (and bind mounts) in this slice can be mounted on the job container or service containers
+	SharedToolCache                   bool                         // one tool cache for all jobs instead of one per job
 	InsecureSkipTLS                   bool                         // whether to skip verifying TLS certificate of the Gitea instance
 	MaxParallel                       int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
 	AllocatePTY                       bool                         // allocate a pseudo-TTY for each step's process

act/runner/runner_test.go

@@ -19,8 +19,8 @@ import (
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/joho/godotenv"
 	log "github.com/sirupsen/logrus"
 	assert "github.com/stretchr/testify/assert"
@@ -312,7 +312,7 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "workflow_dispatch-scalar", "workflow_dispatch", "", platforms, secrets},
 		{workdir, "workflow_dispatch-scalar-composite-action", "workflow_dispatch", "", platforms, secrets},
 		{workdir, "job-needs-context-contains-result", "push", "", platforms, secrets},
-		{"../model/testdata", "container-volumes", "push", "", platforms, secrets},
+		{workdir, "container-volumes", "push", "", platforms, secrets},
 		{workdir, "path-handling", "push", "", platforms, secrets},
 		{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
 		{workdir, "set-env-step-env-override", "push", "", platforms, secrets},

act/runner/step.go

@@ -15,8 +15,9 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
+
+	"gitea.dev/actionslib/pkg/exprparser"
+	"gitea.dev/actionslib/pkg/model"
 )
 
 type step interface {

act/runner/step_action_local.go

@@ -16,7 +16,8 @@ import (
 	"path/filepath"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
+
+	"gitea.dev/actionslib/pkg/model"
 )
 
 type stepActionLocal struct {

act/runner/step_action_local_test.go

@@ -13,8 +13,8 @@ import (
 	"testing"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"go.yaml.in/yaml/v4"

act/runner/step_action_remote.go

@@ -18,8 +18,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	gogit "github.com/go-git/go-git/v5"
 )
 
@@ -180,9 +180,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 				sar.action = actionModel
 				return err
 			},
-			// A stage of its own: it takes the same clone lock, and it has to land before
-			// runAction copies the action into the job container.
-			sar.patchActionToolkit,
 		)(ctx)
 	}
 }
@@ -201,7 +198,7 @@ func (sar *stepActionRemote) pre() common.Executor {
 
 	return common.NewPipelineExecutor(
 		sar.prepareActionExecutor(),
-		runStepExecutor(sar, stepStagePre, sar.revertToolkitOnFailure(runPreStep(sar))).If(hasPreStep(sar)).If(shouldRunPreStep(sar)))
+		runStepExecutor(sar, stepStagePre, runPreStep(sar)).If(hasPreStep(sar)).If(shouldRunPreStep(sar)))
 }
 
 func (sar *stepActionRemote) main() common.Executor {
@@ -223,47 +220,13 @@ func (sar *stepActionRemote) main() common.Executor {
 				return sar.RunContext.JobContainer.CopyDir(copyToPath, sar.RunContext.Config.Workdir+string(filepath.Separator)+".", sar.RunContext.Config.UseGitIgnore)(ctx)
 			}
 
-			actionDir := sar.actionDir()
-
-			return sar.revertToolkitOnFailure(sar.runAction(sar, actionDir, sar.remoteAction))(ctx)
+			return sar.runAction(sar, sar.actionDir(), sar.remoteAction)(ctx)
 		}),
 	)
 }
 
 func (sar *stepActionRemote) post() common.Executor {
-	return runStepExecutor(sar, stepStagePost, sar.revertToolkitOnFailure(runPostStep(sar))).If(hasPostStep(sar)).If(shouldRunPostStep(sar))
-}
-
-// toolkitBundles is the action directory and the entrypoints the toolkit may live in.
-func (sar *stepActionRemote) toolkitBundles() (string, []string) {
-	if sar.remoteAction == nil {
-		return "", nil
-	}
-	dir := sar.actionDir()
-	return dir, actionScriptPaths(filepath.Join(dir, sar.remoteAction.Path), sar.action)
-}
-
-// patchActionToolkit edits the bundled toolkit so it works against Gitea: the artifact actions
-// stop refusing, and the cache client keeps to the cache server whichever API version it picks.
-func (sar *stepActionRemote) patchActionToolkit(ctx context.Context) error {
-	if sar.RunContext.Config.PatchToolkit {
-		dir, scripts := sar.toolkitBundles()
-		patchToolkit(ctx, dir, scripts)
-	}
-	return nil
-}
-
-// revertToolkitOnFailure restores the untouched bundles when the action fails, so a later job
-// runs it as shipped rather than repeating a failure the patch may have caused.
-func (sar *stepActionRemote) revertToolkitOnFailure(exec common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		err := exec(ctx)
-		if err != nil {
-			dir, scripts := sar.toolkitBundles()
-			revertToolkit(ctx, dir, scripts)
-		}
-		return err
-	}
+	return runStepExecutor(sar, stepStagePost, runPostStep(sar)).If(hasPostStep(sar)).If(shouldRunPostStep(sar))
 }
 
 func (sar *stepActionRemote) actionDir() string {

act/runner/step_action_remote_test.go

@@ -19,8 +19,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"

act/runner/step_docker.go

@@ -11,8 +11,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/kballard/go-shellquote"
 )
 

act/runner/step_docker_test.go

@@ -12,8 +12,8 @@ import (
 	"testing"
 
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"

act/runner/step_factory.go

@@ -7,7 +7,7 @@ package runner
 import (
 	"fmt"
 
-	"gitea.com/gitea/runner/act/model"
+	"gitea.dev/actionslib/pkg/model"
 )
 
 type stepFactory interface {

act/runner/step_factory_test.go

@@ -7,8 +7,7 @@ package runner
 import (
 	"testing"
 
-	"gitea.com/gitea/runner/act/model"
-
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 )
 

act/runner/step_run.go

@@ -15,8 +15,8 @@ import (
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/lookpath"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/kballard/go-shellquote"
 	"github.com/sirupsen/logrus"
 	yaml "go.yaml.in/yaml/v4"

act/runner/step_run_print_test.go

@@ -11,8 +11,8 @@ import (
 	"testing"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

act/runner/step_run_test.go

@@ -11,8 +11,8 @@ import (
 	"testing"
 
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )

act/runner/step_test.go

@@ -10,8 +10,8 @@ import (
 	"testing"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
+	"gitea.dev/actionslib/pkg/model"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"

examples/kubernetes/README.md

@@ -11,6 +11,8 @@ Each example persists **two** things, and it is worth knowing which is which:
 - `/data` is the runner's working directory. It holds the `.runner` registration file and, optionally, the config file — so the runner re-attaches to the server instead of registering again.
 - The Docker daemon's data root holds the images pulled for jobs (`/var/lib/docker` for the dind sidecar, `/home/rootless/.local/share/docker` for `dind-rootless`). It is *not* under `/data`. If you drop this volume, the examples still work, but the image cache is discarded whenever the pod is recreated and every job re-pulls its images.
 
+- Kubernetes SIGKILLs a pod 30s after SIGTERM by default, long before a job finishes and reports its result, which leaves tasks the server can only reap as zombies. The manifests raise `terminationGracePeriodSeconds` to three hours, matching the systemd example and the `runner.timeout` job ceiling; set `runner.shutdown_timeout` below that so the runner drains jobs within the window rather than being killed mid-cleanup.
+
 Files in this directory:
 
 - [`dind-docker.yaml`](dind-docker.yaml)

examples/kubernetes/dind-docker.yaml

@@ -56,6 +56,7 @@ spec:
         app: runner
     spec:
       restartPolicy: Always
+      terminationGracePeriodSeconds: 10800 # keep above runner.shutdown_timeout, see README
       volumes:
       - name: docker-socket
         emptyDir: {}

examples/kubernetes/manifests_test.go

@@ -0,0 +1,38 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package kubernetes_test
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var gracePeriod = regexp.MustCompile(`terminationGracePeriodSeconds: (\d+)`)
+
+// Without it Kubernetes SIGKILLs the pod 30s after SIGTERM, mid-job.
+func TestManifestsSetTerminationGracePeriod(t *testing.T) {
+	files, err := filepath.Glob("*.yaml")
+	require.NoError(t, err)
+	require.NotEmpty(t, files)
+
+	for _, file := range files {
+		content, err := os.ReadFile(file)
+		require.NoError(t, err)
+		if !strings.Contains(string(content), "containers:") {
+			continue
+		}
+		match := gracePeriod.FindStringSubmatch(string(content))
+		require.NotNil(t, match, file)
+		seconds, err := strconv.Atoi(match[1])
+		require.NoError(t, err)
+		assert.GreaterOrEqual(t, seconds, 3600, file)
+	}
+}

examples/kubernetes/rootless-docker.yaml

@@ -56,6 +56,7 @@ spec:
         app: runner
     spec:
       restartPolicy: Always
+      terminationGracePeriodSeconds: 10800 # keep above runner.shutdown_timeout, see README
       volumes:
       - name: runner-data
         persistentVolumeClaim:

examples/kubernetes/statefulset-dind.yaml

@@ -33,6 +33,7 @@ spec:
         app: runner
     spec:
       restartPolicy: Always
+      terminationGracePeriodSeconds: 10800 # keep above runner.shutdown_timeout, see README
       volumes:
       - name: docker-socket
         emptyDir: {}

go.mod

@@ -7,22 +7,23 @@ toolchain go1.26.5
 require (
 	connectrpc.com/connect v1.20.0
 	dario.cat/mergo v1.0.2
-	gitea.dev/actions-proto-go v0.6.0
+	gitea.dev/actionslib v0.7.0
 	github.com/avast/retry-go/v5 v5.0.0
 	github.com/containerd/errdefs v1.0.0
 	github.com/creack/pty v1.1.24
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v29.6.2+incompatible
+	github.com/docker/cli v29.7.1+incompatible
 	github.com/docker/go-connections v0.8.1
+	github.com/docker/go-units v0.5.0
 	github.com/go-git/go-billy/v5 v5.9.1
-	github.com/go-git/go-git/v5 v5.19.1
+	github.com/go-git/go-git/v5 v5.19.2
 	github.com/gobwas/glob v0.2.3
 	github.com/google/go-cmp v0.7.0
 	github.com/joho/godotenv v1.5.1
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/mattn/go-isatty v0.0.24
-	github.com/moby/go-archive v0.2.1
+	github.com/moby/go-archive v0.3.2
 	github.com/moby/moby/api v1.55.0
 	github.com/moby/moby/client v0.5.1
 	github.com/moby/patternmatcher v0.6.1
@@ -30,7 +31,6 @@ require (
 	github.com/opencontainers/selinux v1.15.1
 	github.com/prometheus/client_golang v1.24.1
 	github.com/prometheus/client_model v0.6.2
-	github.com/rhysd/actionlint v1.7.12
 	github.com/sirupsen/logrus v1.9.4
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
@@ -62,7 +62,6 @@ require (
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/docker-credential-helpers v0.9.6 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -90,6 +89,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/rhysd/actionlint v1.7.12 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect

go.sum

@@ -4,8 +4,8 @@ cyphar.com/go-pathrs v0.2.3 h1:0pH8gep37wB0BgaXrEaN1OtZhUMeS7VvaejSr6i822o=
 cyphar.com/go-pathrs v0.2.3/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-gitea.dev/actions-proto-go v0.6.0 h1:gjllYQ5vmwlkqOeofTQu5qKTZpmf7kWsafoHvoPCSzY=
-gitea.dev/actions-proto-go v0.6.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
+gitea.dev/actionslib v0.7.0 h1:JCV8eeIGwjlXcuSr7ojEdQC22VoE2466+K+D9vuQWKQ=
+gitea.dev/actionslib v0.7.0/go.mod h1:DI3Lqp+8TrycM7/semMdqsDQOHaBskjIAuMn+SXfZJ0=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -45,8 +45,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw=
-github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.7.1+incompatible h1:ILZpP6B7fedIr6ANy824QkDp1WMJuouIq0O2SrBkB2w=
+github.com/docker/cli v29.7.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.6 h1:cT2PbRPSlnMmNTfT2TDMXRyQ1KMWHG7xoTLBcn1ZNv0=
 github.com/docker/docker-credential-helpers v0.9.6/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
@@ -69,8 +69,8 @@ github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryL
 github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
-github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -123,8 +123,8 @@ github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebG
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/go-archive v0.2.1 h1:fAa0wUS/ikZKyx7o/1fhUYmhZ7RgpthdeoDhJvunTLc=
-github.com/moby/go-archive v0.2.1/go.mod h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
+github.com/moby/go-archive v0.3.2 h1:x893kC3zRygv2C+k4Y9kMxYRPLCj4XEJB0srbAP06Hw=
+github.com/moby/go-archive v0.3.2/go.mod h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
 github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
 github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
 github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=

internal/app/cmd/cache-server.go

@@ -10,6 +10,7 @@ import (
 	"os/signal"
 
 	"gitea.com/gitea/runner/act/artifactcache"
+	"gitea.com/gitea/runner/internal/app/run"
 	"gitea.com/gitea/runner/internal/pkg/config"
 
 	log "github.com/sirupsen/logrus"
@@ -52,13 +53,14 @@ func runCacheServer(configFile *string, cacheArgs *cacheServerArgs) func(cmd *co
 		if secret == "" {
 			return errors.New("cache.external_secret (or cache.external_secret_file) must be set for cache-server; configure the same value on each runner that points at this server via cache.external_server")
 		}
-		cacheHandler, err := artifactcache.StartHandler(
-			dir,
-			host,
-			port,
-			secret,
-			log.StandardLogger().WithField("module", "cache_request"),
-		)
+		cacheHandler, err := artifactcache.StartHandler(artifactcache.Options{
+			Dir:            dir,
+			OutboundIP:     host,
+			Port:           port,
+			InternalSecret: secret,
+			Policy:         run.CachePolicy(cfg),
+			Logger:         log.StandardLogger().WithField("module", "cache_request"),
+		})
 		if err != nil {
 			return err
 		}

internal/app/cmd/daemon.go

@@ -158,6 +158,7 @@ func runDaemon(ctx context.Context, daemArgs *daemonArgs, configFile *string) fu
 			cfg.Runner.Insecure,
 			reg.UUID,
 			reg.Token,
+			config.RequestTimeout,
 		)
 
 		runner := run.NewRunner(cfg, reg, cli)

internal/app/cmd/exec.go

@@ -13,6 +13,7 @@ import (
 	"maps"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -20,10 +21,11 @@ import (
 	"gitea.com/gitea/runner/act/artifactcache"
 	"gitea.com/gitea/runner/act/artifacts"
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 	"gitea.com/gitea/runner/act/runner"
 	"gitea.com/gitea/runner/internal/app/run"
+	"gitea.com/gitea/runner/internal/pkg/config"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/joho/godotenv"
 	"github.com/moby/moby/api/types/container"
 	log "github.com/sirupsen/logrus"
@@ -67,6 +69,15 @@ type executeArgs struct {
 	cacheHandler          *artifactcache.Handler
 	network               string
 	githubInstance        string
+	toolCacheMode         string
+}
+
+// sharedToolCache reports whether mode mounts one tool cache for every job.
+func sharedToolCache(mode string) (bool, error) {
+	if !slices.Contains(config.ToolCacheModes, mode) {
+		return false, fmt.Errorf("invalid --tool-cache-mode %q: must be one of %q", mode, config.ToolCacheModes)
+	}
+	return mode == config.ToolCacheModeShared, nil
 }
 
 // WorkflowsPath returns path to workflow file(s)
@@ -374,7 +385,10 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command
 		}
 
 		// init a cache server
-		handler, err := artifactcache.StartHandler("", "", 0, "", log.StandardLogger().WithField("module", "cache_request"))
+		handler, err := artifactcache.StartHandler(artifactcache.Options{
+			Policy: run.CachePolicy(&config.Config{Cache: config.DefaultCache()}),
+			Logger: log.StandardLogger().WithField("module", "cache_request"),
+		})
 		if err != nil {
 			return err
 		}
@@ -423,11 +437,15 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command
 		proxyEnv := run.JobProxyEnv(env, env["ACTIONS_CACHE_URL"], nil)
 		maps.Copy(env, proxyEnv)
 
+		shared, err := sharedToolCache(execArgs.toolCacheMode)
+		if err != nil {
+			return err
+		}
+
 		// run the plan
 		config := &runner.Config{
 			Workdir:               execArgs.Workdir(),
 			BindWorkdir:           false,
-			PatchToolkit:          true, // the cache server started above is what the patch points at
 			ReuseContainers:       false,
 			ForcePull:             execArgs.forcePull,
 			ForceRebuild:          execArgs.forceRebuild,
@@ -463,7 +481,8 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command
 			PlatformPicker: func(_ []string) string {
 				return execArgs.image
 			},
-			ValidVolumes: []string{"**"}, // All volumes are allowed for `exec` command
+			ValidVolumes:    []string{"**"}, // All volumes are allowed for `exec` command
+			SharedToolCache: shared,
 		}
 
 		config.Env["ACT_EXEC"] = "true"
@@ -538,7 +557,8 @@ func loadExecCmd(ctx context.Context) *cobra.Command {
 	execCmd.PersistentFlags().BoolVarP(&execArg.noSkipCheckout, "no-skip-checkout", "", false, "Do not skip actions/checkout")
 	execCmd.PersistentFlags().BoolVarP(&execArg.debug, "debug", "d", false, "enable debug log")
 	execCmd.PersistentFlags().BoolVarP(&execArg.dryrun, "dryrun", "n", false, "dryrun mode")
-	execCmd.PersistentFlags().StringVarP(&execArg.image, "image", "i", "docker.gitea.com/runner-images:ubuntu-latest", "Docker image to use. Use \"-self-hosted\" to run directly on the host.")
+	execCmd.PersistentFlags().StringVarP(&execArg.image, "image", "i", config.DefaultImage, "Docker image to use. Use \"-self-hosted\" to run directly on the host.")
+	execCmd.PersistentFlags().StringVarP(&execArg.toolCacheMode, "tool-cache-mode", "", config.ToolCacheModeNone, "What to mount at RUNNER_TOOL_CACHE: none, or shared to reuse one tool cache across runs")
 	execCmd.PersistentFlags().StringVarP(&execArg.network, "network", "", "", "Specify the network to which the container will connect")
 	execCmd.PersistentFlags().StringVarP(&execArg.githubInstance, "gitea-instance", "", "", "Gitea instance to use.")
 

internal/app/cmd/exec_test.go

@@ -12,8 +12,9 @@ import (
 	"strings"
 	"testing"
 
-	"gitea.com/gitea/runner/act/model"
+	"gitea.com/gitea/runner/internal/pkg/config"
 
+	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
 )
@@ -29,6 +30,19 @@ func TestExecuteArgsResolve(t *testing.T) {
 	require.Equal(t, abs, args.resolve(abs))
 }
 
+func TestSharedToolCache(t *testing.T) {
+	shared, err := sharedToolCache(config.ToolCacheModeShared)
+	require.NoError(t, err)
+	require.True(t, shared)
+
+	shared, err = sharedToolCache(config.ToolCacheModeNone)
+	require.NoError(t, err)
+	require.False(t, shared)
+
+	_, err = sharedToolCache("everyone")
+	require.ErrorContains(t, err, "tool-cache-mode")
+}
+
 func TestExecuteArgsPaths(t *testing.T) {
 	workdir := t.TempDir()
 	args := &executeArgs{

internal/app/cmd/register.go

@@ -22,8 +22,8 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/ver"
 
 	"connectrpc.com/connect"
-	pingv1 "gitea.dev/actions-proto-go/ping/v1"
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	pingv1 "gitea.dev/actionslib/ping/v1"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	"github.com/mattn/go-isatty"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -366,6 +366,7 @@ func doRegister(ctx context.Context, cfg *config.Config, inputs *registerInputs)
 		cfg.Runner.Insecure,
 		"",
 		"",
+		config.RequestTimeout,
 	)
 
 	for {

internal/app/poll/poller.go

@@ -17,7 +17,7 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/metrics"
 
 	"connectrpc.com/connect"
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -68,6 +68,8 @@ type Poller struct {
 type workerState struct {
 	consecutiveEmpty  int64
 	consecutiveErrors int64
+	// fetchTimedOut suppresses repeats of the fetch timeout warning.
+	fetchTimedOut bool
 	// lastBackoff is the last interval reported to the PollBackoffSeconds gauge;
 	// used to suppress redundant no-op Set calls when the backoff plateaus
 	// (e.g. at FetchIntervalMax).
@@ -346,16 +348,20 @@ func (p *Poller) fetchTask(ctx context.Context, s *workerState) (*runnerv1.Task,
 		TasksVersion: v,
 	}))
 
-	// DeadlineExceeded is the designed idle path for a long-poll: the server
-	// found no work within FetchTimeout. Treat it as an empty response and do
-	// not record the duration — the timeout value would swamp the histogram.
+	// Our own deadline proves nothing either way: today Gitea answers immediately,
+	// so it means a slow server, and once it holds the request open it is an idle
+	// poll. Back off without claiming the server is healthy, warn once a streak so
+	// neither case floods, and keep it out of the latency histogram.
 	if errors.Is(err, context.DeadlineExceeded) {
-		p.markHealthyPoll()
+		if !s.fetchTimedOut {
+			s.fetchTimedOut = true
+			log.Warnf("fetching a task timed out after %s, raise runner.fetch_timeout if this persists", p.cfg.Runner.FetchTimeout)
+		}
 		s.consecutiveEmpty++
-		s.consecutiveErrors = 0 // timeout is a healthy idle response
 		metrics.PollFetchTotal.WithLabelValues(metrics.LabelResultEmpty).Inc()
 		return nil, false
 	}
+	s.fetchTimedOut = false
 	metrics.PollFetchDuration.Observe(time.Since(start).Seconds())
 
 	if err != nil {
@@ -368,7 +374,13 @@ func (p *Poller) fetchTask(ctx context.Context, s *workerState) (*runnerv1.Task,
 			p.shutdownPolling()
 			return nil, false
 		}
-		log.WithError(err).Error("failed to fetch task")
+		// Not a long poll, so a deadline can mean the server assigned a task
+		// this runner never received.
+		if errors.Is(err, context.DeadlineExceeded) {
+			log.WithError(err).Errorf("fetching a task timed out after %s", p.cfg.Runner.FetchTimeout)
+		} else {
+			log.WithError(err).Error("failed to fetch task")
+		}
 		p.lastPollFailed.Store(true)
 		s.consecutiveErrors++
 		metrics.PollFetchTotal.WithLabelValues(metrics.LabelResultError).Inc()

internal/app/poll/poller_test.go

@@ -15,7 +15,8 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/config"
 
 	connect_go "connectrpc.com/connect"
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
+	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
@@ -61,11 +62,7 @@ func TestPoller_WorkerStateCounters(t *testing.T) {
 // increments only the per-worker error counter, not the empty counter.
 func TestPoller_FetchErrorIncrementsErrorsOnly(t *testing.T) {
 	client := mocks.NewClient(t)
-	client.On("FetchTask", mock.Anything, mock.Anything).Return(
-		func(_ context.Context, _ *connect_go.Request[runnerv1.FetchTaskRequest]) (*connect_go.Response[runnerv1.FetchTaskResponse], error) {
-			return nil, errors.New("network unreachable")
-		},
-	)
+	client.On("FetchTask", mock.Anything, mock.Anything).Return(nil, errors.New("network unreachable"))
 
 	cfg, err := config.LoadDefault("")
 	require.NoError(t, err)
@@ -78,6 +75,33 @@ func TestPoller_FetchErrorIncrementsErrorsOnly(t *testing.T) {
 	assert.Equal(t, int64(0), s.consecutiveEmpty)
 }
 
+// A deadline is the idle path once the server holds the request open, and a
+// symptom before then, so it must neither reset the error count nor assert that
+// the server is reachable.
+func TestPoller_FetchTimeoutIsNoSignal(t *testing.T) {
+	client := mocks.NewClient(t)
+	client.On("FetchTask", mock.Anything, mock.Anything).Return(nil, context.DeadlineExceeded)
+
+	cfg, err := config.LoadDefault("")
+	require.NoError(t, err)
+	p := &Poller{client: client, cfg: cfg}
+	p.lastPollFailed.Store(true)
+
+	hook := test.NewGlobal()
+	defer hook.Reset()
+
+	s := &workerState{consecutiveErrors: 2}
+	_, ok := p.fetchTask(context.Background(), s)
+	require.False(t, ok)
+	assert.Equal(t, int64(2), s.consecutiveErrors)
+	assert.Equal(t, int64(1), s.consecutiveEmpty)
+	assert.True(t, p.lastPollFailed.Load(), "a timeout must not clear a known failure")
+
+	// An idle runner against a server holding the request open must not flood.
+	_, _ = p.fetchTask(context.Background(), s)
+	assert.Len(t, hook.AllEntries(), 1)
+}
+
 // TestPoller_FetchUnauthenticatedStopsPolling verifies that an Unauthenticated
 // response marks the runner as unregistered and cancels the polling context so
 // the daemon can exit instead of retrying forever.

internal/app/run/post_task_script.go

@@ -19,7 +19,7 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/process"
 	"gitea.com/gitea/runner/internal/pkg/report"
 
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	log "github.com/sirupsen/logrus"
 )
 

internal/app/run/post_task_script_test.go

@@ -14,7 +14,7 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/metrics"
 	"gitea.com/gitea/runner/internal/pkg/report"
 
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

internal/app/run/runner.go

@@ -24,17 +24,19 @@ import (
 	"gitea.com/gitea/runner/act/artifactcache"
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
 	"gitea.com/gitea/runner/act/runner"
 	"gitea.com/gitea/runner/internal/pkg/client"
 	"gitea.com/gitea/runner/internal/pkg/config"
+	"gitea.com/gitea/runner/internal/pkg/disk"
+	"gitea.com/gitea/runner/internal/pkg/envcheck"
 	"gitea.com/gitea/runner/internal/pkg/labels"
 	"gitea.com/gitea/runner/internal/pkg/metrics"
 	"gitea.com/gitea/runner/internal/pkg/report"
 	"gitea.com/gitea/runner/internal/pkg/ver"
 
 	"connectrpc.com/connect"
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/actionslib/pkg/model"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	docker_container "github.com/moby/moby/api/types/container"
 	log "github.com/sirupsen/logrus"
 )
@@ -89,17 +91,18 @@ func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client)
 	var cacheHandler *artifactcache.Handler
 	if cfg.Cache.Enabled == nil || *cfg.Cache.Enabled {
 		if cfg.Cache.ExternalServer != "" {
+			warnIgnoredCachePolicy(cfg)
 			// The v1 client appends its path to this without a separator, so the slash is required.
 			envs["ACTIONS_CACHE_URL"] = strings.TrimRight(cfg.Cache.ExternalServer, "/") + "/"
 		} else {
 			warnIgnoredCacheSecret(cfg)
-			handler, err := artifactcache.StartHandler(
-				cfg.Cache.Dir,
-				cfg.Cache.Host,
-				cfg.Cache.Port,
-				"",
-				log.StandardLogger().WithField("module", "cache_request"),
-			)
+			handler, err := artifactcache.StartHandler(artifactcache.Options{
+				Dir:        cfg.Cache.Dir,
+				OutboundIP: cfg.Cache.Host,
+				Port:       cfg.Cache.Port,
+				Policy:     CachePolicy(cfg),
+				Logger:     log.StandardLogger().WithField("module", "cache_request"),
+			})
 			if err != nil {
 				log.Errorf("cannot init cache server, it will be disabled: %v", err)
 				// go on
@@ -157,8 +160,8 @@ func (r *Runner) OnIdle(ctx context.Context) {
 	}
 	// Host mode: reclaim per-job scratch dirs left behind when HostEnvironment
 	// cleanup timed out (e.g. a delete stalled by an AV/EDR filter driver). They
-	// sit under the host workdir parent alongside the shared tool_cache, which
-	// the name match leaves untouched. No-op when no host-mode job ever ran.
+	// sit under the host workdir parent next to a shared tool_cache, which the name
+	// match leaves untouched. No-op when no host-mode job ever ran.
 	if hostRoot := filepath.FromSlash(r.cfg.Host.WorkdirParent); hostRoot != "" {
 		r.cleanupStaleDirs(ctx, hostRoot, isHostScratchDir)
 	}
@@ -170,7 +173,7 @@ func (r *Runner) OnIdle(ctx context.Context) {
 // directories above, a task beginning during the pass is safe because the cutoff keeps a
 // network it has created but not yet attached a container to out of scope.
 func (r *Runner) cleanupOrphanNetworks(ctx context.Context) {
-	if r.uuid == "" || !r.labels.RequireDocker() && !r.cfg.Container.RequireDocker {
+	if r.uuid == "" || !r.requiresDocker() {
 		return
 	}
 	cutoff := r.now().Add(-r.cfg.Runner.WorkdirCleanupAge)
@@ -217,7 +220,7 @@ func isTaskIDDir(name string) bool {
 // isHostScratchDir reports whether name is a per-job host-mode scratch dir:
 // hex.EncodeToString of 8 random bytes, i.e. exactly 16 lowercase hex chars
 // (see startHostEnvironment in act/runner/run_context.go). The narrow match
-// leaves the sibling shared "tool_cache" dir and any operator data untouched.
+// leaves a sibling shared "tool_cache" dir and any operator data untouched.
 func isHostScratchDir(name string) bool {
 	if len(name) != 16 {
 		return false
@@ -345,6 +348,27 @@ func (r *Runner) isSelfHostedActionsURL(task *runnerv1.Task) bool {
 	return giteaDefaultActionsURL != "" && giteaDefaultActionsURL != "https://github.com"
 }
 
+// dockerReachable is a variable so tests can substitute one that needs no Docker daemon. It
+// probes the environment act connects through, not container.docker_host, which act ignores.
+var dockerReachable = func(ctx context.Context) bool {
+	ctx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+	return envcheck.CheckIfDockerRunning(ctx, "") == nil
+}
+
+func (r *Runner) requiresDocker() bool {
+	return r.labels.RequireDocker() || r.cfg.Container.RequireDocker
+}
+
+// fallbackPlatform is where a job runs whose runs-on matches no label, as any job without a
+// runs-on does, since Gitea sends those to every runner.
+func (r *Runner) fallbackPlatform(ctx context.Context) string {
+	if r.requiresDocker() || dockerReachable(ctx) {
+		return r.cfg.Runner.DefaultImage
+	}
+	return labels.SelfHostedPlatform
+}
+
 func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.Reporter) (err error) {
 	defer func() {
 		if r := recover(); r != nil {
@@ -437,10 +461,13 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	// is that server's responsibility to authenticate requests.
 	revokeCache, resultsURL := r.registerCacheForTask(giteaRuntimeToken, preset.Repository, reporter)
 	defer revokeCache()
-	// A cache server that agreed to forward the artifact half is the whole results service, so
-	// the job is pointed at it and the v2 variable is finally true.
+	// A cache server that agreed to forward the artifact half is the whole results service, so the
+	// job is pointed at it.
 	if resultsURL != "" {
-		envs["ACTIONS_RESULTS_URL"], envs[runner.CacheServiceV2Env] = resultsURL, "true"
+		envs["ACTIONS_RESULTS_URL"] = resultsURL
+		if r.cacheServiceV2() {
+			envs[runner.CacheServiceV2Env] = "true"
+		}
 	}
 
 	eventJSON, err := json.Marshal(preset.Event)
@@ -473,6 +500,15 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	// Without bind_workdir, the workspace path omits the task id; concurrent host-mode jobs
 	// for the same repository would share this directory and can race with per-job cleanup.
 
+	// act asks for the platform once per step, so resolve the fallback at most once per task.
+	fallbackPlatform := sync.OnceValue(func() string { return r.fallbackPlatform(ctx) })
+	platformPicker := func(runsOn []string) string {
+		if platform := r.labels.PickPlatform(runsOn); platform != "" {
+			return platform
+		}
+		return fallbackPlatform()
+	}
+
 	runnerConfig := &runner.Config{
 		// On Linux, Workdir will be like "/<parent_directory>/<owner>/<repo>"
 		// On Windows, Workdir will be like "\<parent_directory>\<owner>\<repo>"
@@ -482,7 +518,7 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		AllocatePTY:       r.cfg.Runner.AllocatePTY,
 		ActionOfflineMode: r.cfg.Cache.OfflineMode,
 		ActionCloneDepth:  actionCloneDepth,
-		PatchToolkit:      r.patchToolkit(),
+		NoActionPatch:     r.cfg.Runner.PatchActions != nil && !*r.cfg.Runner.PatchActions,
 
 		ReuseContainers:      false,
 		ForcePull:            r.cfg.Container.ForcePull,
@@ -515,11 +551,12 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		Privileged:                        r.cfg.Container.Privileged,
 		DefaultActionInstance:             r.getDefaultActionsURL(task),
 		DefaultActionInstanceIsSelfHosted: r.isSelfHostedActionsURL(task),
-		PlatformPicker:                    r.labels.PickPlatform,
+		PlatformPicker:                    platformPicker,
 		JobStartedHook:                    r.cfg.Runner.Hooks.JobStarted,
 		JobCompletedHook:                  r.cfg.Runner.Hooks.JobCompleted,
 		Vars:                              task.Vars,
 		ValidVolumes:                      r.cfg.Container.ValidVolumes,
+		SharedToolCache:                   r.cfg.Runner.ToolCacheMode == config.ToolCacheModeShared,
 		InsecureSkipTLS:                   r.cfg.Runner.Insecure,
 		RunnerName:                        r.name,
 	}
@@ -556,10 +593,10 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	return execErr
 }
 
-// patchToolkit reports whether act should edit the toolkit bundled into an action. It follows the
-// cache URL, because that is what the edits point the client at; see act/runner/toolkit_patch.go.
-func (r *Runner) patchToolkit() bool {
-	return r.envs["ACTIONS_CACHE_URL"] != "" && (r.cfg.Cache.V2 == nil || *r.cfg.Cache.V2)
+// cacheServiceV2 reports whether jobs are told the cache service speaks v2. It is all cache.v2
+// turns off: the bundle edit that reaches it is what the artifact actions need too.
+func (r *Runner) cacheServiceV2() bool {
+	return r.cfg.Cache.V2 == nil || *r.cfg.Cache.V2
 }
 
 // registerCacheForTask tells the cache server to accept requests authenticated
@@ -605,14 +642,15 @@ func (r *Runner) registerExternalCacheJob(token string, cred artifactcache.JobCr
 	resultsURL := ""
 	if body, err := postInternalCache(base+"/_internal/register", r.cfg.Cache.ExternalSecret, map[string]any{
 		"token": token, "repo": cred.Repo, "results": cred.Results, "insecure_tls": cred.InsecureTLS,
+		"public_url": base,
 	}); err != nil {
 		log.Warnf("cache external_server register failed (%s): %v", base, err)
 		if reporter != nil {
 			reporter.Logf("::warning::%s", runner.EscapeCommandData(fmt.Sprintf(
 				"cache external_server register failed (%s): %v — cache requests from this job will be unauthenticated and likely return 401", base, err)))
 		}
-	} else {
-		resultsURL, _ = body["results_url"].(string) // absent from a server too old to forward
+	} else if forwarded, _ := body["results_url"].(string); forwarded != "" {
+		resultsURL = base // the answer only says it forwards, its own address need not be the job's
 	}
 	return func() {
 		if _, err := postInternalCache(base+"/_internal/revoke", r.cfg.Cache.ExternalSecret,
@@ -692,7 +730,7 @@ func checkFreeDisk(cfg *config.Config) (bool, string) {
 		root = filepath.FromSlash("/" + strings.TrimLeft(cfg.Container.WorkdirParent, "/"))
 	}
 	root = nearestExistingPath(root)
-	available, err := freeDiskBytes(root)
+	available, err := disk.FreeBytes(root)
 	if err != nil {
 		return false, fmt.Sprintf("cannot determine free disk space for %s: %v", root, err)
 	}
@@ -725,6 +763,35 @@ func (r *Runner) Declare(ctx context.Context, labels []string) (*connect.Respons
 	}))
 }
 
+// minFreeDisk keeps the cache from growing past the point where the runner stops taking
+// work, but only when health checks are on, since the key is documented as opt-in.
+func minFreeDisk(cfg *config.Config) int64 {
+	if !cfg.HealthCheck.Enabled {
+		return 0
+	}
+	return cfg.HealthCheck.MinFreeDiskSpaceMB * 1024 * 1024
+}
+
+// CachePolicy maps the cache config onto the cache server's own type, in bytes not MiB.
+func CachePolicy(cfg *config.Config) artifactcache.Policy {
+	return artifactcache.Policy{
+		Retention:     cfg.Cache.Retention,
+		RepoSizeLimit: int64(cfg.Cache.RepoSizeLimit),
+		SizeLimit:     int64(cfg.Cache.SizeLimit),
+		SweepInterval: cfg.Cache.SweepInterval,
+		MinFreeDisk:   minFreeDisk(cfg),
+	}
+}
+
+// warnIgnoredCachePolicy flags eviction settings configured on a runner that points at an external cache server.
+func warnIgnoredCachePolicy(cfg *config.Config) {
+	defaults := config.DefaultCache()
+	if cfg.Cache.Retention != defaults.Retention || cfg.Cache.RepoSizeLimit != defaults.RepoSizeLimit ||
+		cfg.Cache.SizeLimit != defaults.SizeLimit || cfg.Cache.SweepInterval != defaults.SweepInterval {
+		log.Warn("cache eviction settings are ignored when cache.external_server is set; configure them on that server instead")
+	}
+}
+
 // warnIgnoredCacheSecret flags an external cache server secret configured on a runner that uses the built-in cache server.
 func warnIgnoredCacheSecret(cfg *config.Config) {
 	if cfg.Cache.ExternalServer != "" {

internal/app/run/runner_cache_test.go

@@ -25,7 +25,7 @@ func emptyCfg() *config.Config { return &config.Config{} }
 
 func TestRunner_registerCacheForTask(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := artifactcache.StartHandler(dir, "127.0.0.1", 0, "", nil)
+	handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: dir, OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	defer handler.Close()
 
@@ -62,7 +62,7 @@ func TestRunner_registerCacheForTask_NoOps(t *testing.T) {
 
 	t.Run("empty token", func(t *testing.T) {
 		dir := filepath.Join(t.TempDir(), "artifactcache")
-		handler, err := artifactcache.StartHandler(dir, "127.0.0.1", 0, "", nil)
+		handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: dir, OutboundIP: "127.0.0.1"})
 		require.NoError(t, err)
 		defer handler.Close()
 
@@ -77,7 +77,7 @@ func TestRunner_registerCacheForTask_NoOps(t *testing.T) {
 // /find, no auth on the signed archiveLocation download.
 func TestRunner_CacheFullFlow_MatchesToolkit(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := artifactcache.StartHandler(dir, "127.0.0.1", 0, "", nil)
+	handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: dir, OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	defer handler.Close()
 
@@ -157,14 +157,15 @@ func decodeJSON(resp *http.Response, v any) error {
 
 // End-to-end against a remote cache-server: token unknown → 401, register →
 // reserve/upload/commit/find/download all OK, revoke → 401 again. Registering also names the
-// instance, and the server answering with its own address is what makes a shared cache server the
+// instance and the address its jobs reach the server at, which makes a shared cache server the
 // whole results service, as the built-in one is.
 func TestRunner_ExternalCacheServer_RegisterRevoke(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "remote-cache")
 	const secret = "shared-secret-for-tests"
-	remote, err := artifactcache.StartHandler(dir, "127.0.0.1", 0, secret, nil)
+	remote, err := artifactcache.StartHandler(artifactcache.Options{Dir: dir, OutboundIP: "127.0.0.2", InternalSecret: secret}) // advertised, never dialled
 	require.NoError(t, err)
 	defer remote.Close()
+	external := strings.Replace(remote.ExternalURL(), "127.0.0.2", "127.0.0.1", 1)
 	gitea := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, `{"ok":true}`)
 	}))
@@ -172,7 +173,7 @@ func TestRunner_ExternalCacheServer_RegisterRevoke(t *testing.T) {
 
 	r := &Runner{
 		cfg: &config.Config{Cache: config.Cache{
-			ExternalServer: remote.ExternalURL(),
+			ExternalServer: external,
 			ExternalSecret: secret,
 		}},
 		envs: map[string]string{"ACTIONS_RESULTS_URL": gitea.URL},
@@ -180,7 +181,7 @@ func TestRunner_ExternalCacheServer_RegisterRevoke(t *testing.T) {
 
 	token := "external-task-token"
 	repo := "owner/repoX"
-	base := remote.ExternalURL() + "/_apis/artifactcache"
+	base := external + "/_apis/artifactcache"
 	probe := func() int {
 		req, _ := http.NewRequest(http.MethodGet, base+"/cache?keys=k&version=v", nil)
 		req.Header.Set("Authorization", "Bearer "+token)
@@ -198,7 +199,7 @@ func TestRunner_ExternalCacheServer_RegisterRevoke(t *testing.T) {
 		"token must be accepted after registerCacheForTask")
 
 	// The server took the results service over, so the artifact half reaches Gitea through it.
-	require.Equal(t, remote.ExternalURL(), resultsURL)
+	require.Equal(t, external, resultsURL)
 	artifact, err := http.NewRequestWithContext(t.Context(), http.MethodPost,
 		resultsURL+"/twirp/github.actions.results.api.v1.ArtifactService/CreateArtifact", nil)
 	require.NoError(t, err)
@@ -248,7 +249,7 @@ func TestRunner_ExternalCacheServer_RegisterRevoke(t *testing.T) {
 		ArchiveLocation string `json:"archiveLocation"`
 	}
 	require.NoError(t, decodeJSON(resp, &hit))
-	require.NotEmpty(t, hit.ArchiveLocation)
+	require.True(t, strings.HasPrefix(hit.ArchiveLocation, external), hit.ArchiveLocation)
 
 	dl, err := http.Get(hit.ArchiveLocation)
 	require.NoError(t, err)

internal/app/run/runner_test.go

@@ -12,10 +12,11 @@ import (
 	"gitea.com/gitea/runner/act/runner"
 	clientmocks "gitea.com/gitea/runner/internal/pkg/client/mocks"
 	"gitea.com/gitea/runner/internal/pkg/config"
+	"gitea.com/gitea/runner/internal/pkg/labels"
 	"gitea.com/gitea/runner/internal/pkg/ver"
 
 	"connectrpc.com/connect"
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
@@ -98,6 +99,34 @@ func TestNewRunnerInitializesLabelsAndEnvironment(t *testing.T) {
 	require.Empty(t, r.envs[runner.CacheServiceV2Env], "no cache server, nothing to serve v2 from")
 }
 
+func TestRunnerFallbackPlatform(t *testing.T) {
+	tests := []struct {
+		name          string
+		label         string
+		dockerRunning bool
+		want          string
+	}{
+		{"a docker label needs no daemon probe", "ubuntu:docker://node:18", false, "mirror.example/ci:noble"},
+		{"host labels keep the image where docker runs", "ubuntu:host", true, "mirror.example/ci:noble"},
+		{"host labels without docker run on the host", "ubuntu:host", false, labels.SelfHostedPlatform},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reachable := dockerReachable
+			dockerReachable = func(context.Context) bool { return tt.dockerRunning }
+			t.Cleanup(func() { dockerReachable = reachable })
+
+			label, err := labels.Parse(tt.label)
+			require.NoError(t, err)
+			cfg := &config.Config{}
+			cfg.Runner.DefaultImage = "mirror.example/ci:noble"
+			r := &Runner{cfg: cfg, labels: labels.Labels{label}}
+
+			require.Equal(t, tt.want, r.fallbackPlatform(t.Context()))
+		})
+	}
+}
+
 // Proxy variables are assembled per task, because a job's service containers have to be
 // reached directly and they are only known once the workflow is parsed.
 func TestNewRunnerLeavesProxyToTheTask(t *testing.T) {
@@ -140,7 +169,6 @@ func TestNewRunnerCacheServiceV2(t *testing.T) {
 
 	assert.Equal(t, "https://gitea.example", r.envs["ACTIONS_RESULTS_URL"])
 	assert.Empty(t, r.envs[runner.CacheServiceV2Env], "a promise the runner has not made yet")
-	assert.True(t, r.patchToolkit())
 
 	// The registration is what makes it true: the cache server takes the results service over,
 	// having been told which instance to forward the artifact half to.
@@ -161,6 +189,11 @@ func TestNewRunnerCacheServiceV2(t *testing.T) {
 	defer resp.Body.Close()
 
 	assert.Equal(t, http.StatusOK, resp.StatusCode, "the advertised results service serves no cache service")
+
+	// Turning v2 off withdraws the advertisement and nothing else.
+	assert.True(t, r.cacheServiceV2())
+	cfg.Cache.V2 = new(bool)
+	assert.False(t, r.cacheServiceV2())
 }
 
 // The v1 cache client appends its path to ACTIONS_CACHE_URL without a separator, so a configured
@@ -174,9 +207,8 @@ func TestNewRunnerNormalizesTheExternalCacheServer(t *testing.T) {
 	r := NewRunner(cfg, &config.Registration{Name: "runner"}, cli)
 
 	assert.Equal(t, "http://cache.local:8088/", r.envs["ACTIONS_CACHE_URL"])
-	// Nothing to front the results service with, so the variable stays unset, but the bundles are
-	// still patched: artifacts v4 need that, and the patch keeps the cache client on the cache URL.
+	// Nothing to front the results service with, so the variable stays unset and the client keeps
+	// to v1, which reads the cache URL first.
 	assert.Equal(t, "https://gitea.example", r.envs["ACTIONS_RESULTS_URL"])
 	assert.Empty(t, r.envs[runner.CacheServiceV2Env])
-	assert.True(t, r.patchToolkit())
 }

internal/app/run/setup.go

@@ -5,15 +5,18 @@ package run
 
 import (
 	"fmt"
+	"maps"
 	"os"
 	"runtime"
+	"slices"
 	"strconv"
 	"strings"
 
 	"gitea.com/gitea/runner/internal/pkg/report"
 	"gitea.com/gitea/runner/internal/pkg/ver"
 
-	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	runnerv1 "gitea.dev/actionslib/runner/v1"
+	"google.golang.org/protobuf/types/known/structpb"
 )
 
 // osReleasePath describes the host distribution on Linux; absent elsewhere, where the platform
@@ -46,12 +49,27 @@ func (r *Runner) setupLines(task *runnerv1.Task) []string {
 		"Repository: "+fields["repository"].GetStringValue(),
 		"Triggered by event: "+fields["event_name"].GetStringValue(),
 		"::endgroup::",
-		"::group::Operating System",
 	)
+	lines = append(lines, inputLines(fields)...)
+	lines = append(lines, "::group::Operating System")
 	lines = append(lines, osInfo()...)
 	return append(lines, "::endgroup::")
 }
 
+// inputLines lists the inputs the run was triggered with, as workflow_dispatch and workflow_call
+// carry them in the event payload. Empty when the event has none.
+func inputLines(fields map[string]*structpb.Value) []string {
+	inputs := fields["event"].GetStructValue().GetFields()["inputs"].GetStructValue().GetFields()
+	if len(inputs) == 0 {
+		return nil
+	}
+	lines := []string{"::group::Inputs"}
+	for _, name := range slices.Sorted(maps.Keys(inputs)) {
+		lines = append(lines, fmt.Sprintf("%s: %v", name, inputs[name].AsInterface()))
+	}
+	return append(lines, "::endgroup::")
+}
+
 // osInfo describes the host the runner executes on.
 func osInfo() []string {
 	lines := make([]string, 0, 2)