Merge branch 'main' of gitea.com:gitea/act_runner into act-runner-actions-oss-act

update go mod

.dockerignore

@@ -1,52 +0,0 @@
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# IntelliJ
-.idea
-# Goland's output filename can not be set manually
-/go_build_*
-
-# MS VSCode
-.vscode
-__debug_bin*
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe
-*.test
-*.prof
-
-*coverage.out
-coverage.all
-coverage.txt
-cpu.out
-
-*.db
-*.log
-
-/gitea-runner
-/debug
-
-/bin
-/dist
-/.env
-/.runner
-/config.yaml
-/Dockerfile
-.DS_Store

.editorconfig

@@ -12,8 +12,5 @@ insert_final_newline = true
 [*.{go}]
 indent_style = tab
 
-[go.*]
-indent_style = tab
-
 [Makefile]
 indent_style = tab

.gitea/workflows/pull-pr-title.yml

@@ -1,27 +0,0 @@
-name: pr-title
-
-on:
-  pull_request:
-    types:
-    - opened
-    - edited
-    - reopened
-    - synchronize
-    - ready_for_review
-
-permissions:
-  contents: read
-
-jobs:
-  lint-pr-title:
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-      with:
-        node-version: 24
-    - run: make lint-pr-title
-      env:
-        PR_TITLE: ${{ github.event.pull_request.title }}

.gitea/workflows/release-nightly.yml

@@ -17,35 +17,24 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      # Custom publishers (the R2 upload below) run as the very last
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created. Fail here instead, before anything
-      # is built or published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
-          check-latest: true
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release --nightly
         env:
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          AWS_REGION: ${{ secrets.AWS_REGION }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          S3_REGION: ${{ secrets.AWS_REGION }}
+          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
           GORELEASER_FORCE_TOKEN: "gitea"
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -54,54 +43,43 @@ jobs:
     strategy:
       matrix:
         variant:
-          # The basic image is built from source and can target any arch the
-          # toolchain supports. The dind variants are limited to the arches the
-          # docker:dind base image publishes.
           - target: basic
             tag_suffix: ""
-            platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
           - target: dind
             tag_suffix: "-dind"
-            platforms: linux/amd64,linux/arm64
           - target: dind-rootless
             tag_suffix: "-dind-rootless"
-            platforms: linux/amd64,linux/arm64
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Echo the tag
-        run: echo "${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}"
-
-      - name: Get Meta
-        id: meta
-        run: |
-          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT
+        run: echo "${{ env.DOCKER_ORG }}/act_runner:nightly${{ matrix.variant.tag_suffix }}"
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           target: ${{ matrix.variant.target }}
-          platforms: ${{ matrix.variant.platforms }}
+          platforms: |
+            linux/amd64
+            linux/arm64
           push: true
           tags: |
-            ${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}
-          build-args: |
-            VERSION=${{ steps.meta.outputs.REPO_VERSION }}
+            ${{ env.DOCKER_ORG }}/act_runner:nightly${{ matrix.variant.tag_suffix }}

.gitea/workflows/release-tag.yml

@@ -9,62 +9,36 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
-      # Custom publishers (the R2 upload below) run as the very last
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created. Fail here instead, before anything
-      # is built or published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
-          check-latest: true
       - name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
+        uses: crazy-max/ghaction-import-gpg@v6
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release
         env:
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          AWS_REGION: ${{ secrets.AWS_REGION }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          S3_REGION: ${{ secrets.AWS_REGION }}
+          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
           GORELEASER_FORCE_TOKEN: "gitea"
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
   release-image:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        variant:
-          # The basic image is built from source and can target any arch the
-          # toolchain supports. The dind variants are limited to the arches the
-          # docker:dind base image publishes.
-          - target: basic
-            tag_suffix: ""
-            platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
-          - target: dind
-            tag_suffix: "-dind"
-            platforms: linux/amd64,linux/arm64
-          - target: dind-rootless
-            tag_suffix: "-dind-rootless"
-            platforms: linux/amd64,linux/arm64
     container:
       image: catthehacker/ubuntu:act-latest
     env:
@@ -72,44 +46,66 @@ jobs:
       DOCKER_LATEST: latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: "Docker meta"
-        id: docker_meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
-        with:
-          images: |
-            ${{ env.DOCKER_ORG }}/runner
-          tags: |
-            type=semver,pattern={{major}}.{{minor}}.{{patch}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-          flavor: |
-            latest=true
-            suffix=${{ matrix.variant.tag_suffix }},onlatest=true
+      - name: Get Meta
+        id: meta
+        run: |
+          echo REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F"/" '{print $2}') >> $GITHUB_OUTPUT
+          echo REPO_VERSION=${GITHUB_REF_NAME#v} >> $GITHUB_OUTPUT
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
-          target: ${{ matrix.variant.target }}
-          platforms: ${{ matrix.variant.platforms }}
+          target: basic
+          platforms: |
+            linux/amd64
+            linux/arm64
           push: true
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          build-args: |
-            VERSION=${{ steps.docker_meta.outputs.version }}
+          tags: |
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ env.DOCKER_LATEST }}
+
+      - name: Build and push dind
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          target: dind
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          tags: |
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}-dind
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ env.DOCKER_LATEST }}-dind
+
+      - name: Build and push dind-rootless
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          target: dind-rootless
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          tags: |
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}-dind-rootless
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ env.DOCKER_LATEST }}-dind-rootless

.gitea/workflows/test.yml

@@ -1,78 +1,20 @@
 name: checks
 on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-env:
-  # The runner image ships a stale docker.io login; point docker at an empty config so
-  # image pulls go straight to anonymous instead of attempting (and failing) that auth
-  # first. The path must be a literal: the `runner` context is unavailable in workflow-level
-  # env, so `${{ runner.temp }}` would resolve to empty and config.Dir() would fall back
-  # to ~/.docker with the stale credentials.
-  DOCKER_CONFIG: /tmp/docker-noauth
+  - push
+  - pull_request
 
 jobs:
   lint:
     name: check and test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
-          check-latest: true
-      - name: prepare anonymous docker config
-        run: mkdir -p "$DOCKER_CONFIG" && echo '{}' > "$DOCKER_CONFIG/config.json"
-      # Pre-pull act/runner's two largest base images so a slow pull can't dominate `make test`;
-      # the rest (alpine/ubuntu) pull on demand, absorbed by the make-test -timeout. The host
-      # daemon retains them between runs, so this is usually a fast manifest re-check.
-      - name: pre-pull test images
-        env:
-          TEST_JOB_IMAGE: node:24-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03 # renovate: datasource=docker
-          TEST_SERVICE_IMAGE: nginx:alpine@sha256:db35bfc6b2951e7f8a72db5db120288c127ffaeeb4a6d4b95a26fead017d5913 # renovate: datasource=docker
-        run: |
-          for image in "$TEST_JOB_IMAGE" "$TEST_SERVICE_IMAGE"; do
-            for attempt in 1 2 3; do
-              docker pull "$image" && break
-              [ "$attempt" = 3 ] || sleep 5
-            done
-            docker tag "$image" "${image%@*}"
-          done
       - name: lint
         run: make lint
-      - name: checks
-        run: make checks
       - name: build
         run: make build
       - name: test
         run: make test
-      # Build the dind image and run the daemon-facing tests against the docker version it
-      # ships, catching daemon-level regressions (e.g. gitea/runner#981) before release. Runs
-      # after `make test` so the images it needs are already present on the host daemon.
-      - name: test against dind image
-        run: make test-dind
-      - name: coverage report
-        run: |
-          make coverage-report
-          cat .tmp/coverage.md >> "$GITHUB_STEP_SUMMARY"
-
-  e2e:
-    name: gitea compatibility (${{ matrix.gitea_image }})
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        gitea_image:
-          - gitea/gitea:latest
-          - gitea/gitea:main-nightly
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: 'go.mod'
-          check-latest: true
-      - name: prepare anonymous docker config
-        run: mkdir -p "$DOCKER_CONFIG" && echo '{}' > "$DOCKER_CONFIG/config.json"
-      - name: e2e compatibility
-        run: make test-e2e E2E_GITEA_IMAGE=${{ matrix.gitea_image }}

.gitignore

@@ -1,10 +1,8 @@
-/gitea-runner
+/act_runner
 .env
-!/act/runner/testdata/secrets/.env
 .runner
-.runner.lock
 coverage.txt
-.tmp/
+/gitea-vet
 /config.yaml
 
 # Jetbrains
@@ -13,5 +11,4 @@ coverage.txt
 .vscode
 __debug_bin
 # gorelease binary folder
-/dist
-.DS_Store
+dist

.golangci.yml

@@ -11,10 +11,8 @@ linters:
     - dupl
     - errcheck
     - forbidigo
-    - forcetypeassert
     - gocheckcompilerdirectives
     - gocritic
-    - goheader
     - govet
     - ineffassign
     - mirror
@@ -37,8 +35,12 @@ linters:
       rules:
         main:
           deny:
+            - pkg: io/ioutil
+              desc: use os or io instead
             - pkg: golang.org/x/exp
               desc: it's experimental and unreliable
+            - pkg: github.com/pkg/errors
+              desc: use builtin errors package instead
     nolintlint:
       allow-unused: false
       require-explanation: true
@@ -46,7 +48,8 @@ linters:
     gocritic:
       enabled-checks:
         - equalFold
-      disabled-checks: []
+      disabled-checks:
+        - ifElseChain
     revive:
       severity: error
       rules:
@@ -70,14 +73,10 @@ linters:
         - name: unexported-return
         - name: var-declaration
         - name: var-naming
-          arguments:
-            - [] # AllowList - do not remove as args for the rule are positional and won't work without lists first
-            - [] # DenyList
-            - - skip-initialism-name-checks: true
     staticcheck:
       checks:
         - all
-    testifylint: {}
+        - -ST1005
     usetesting:
       os-temp-dir: true
     perfsprint:
@@ -86,41 +85,27 @@ linters:
       enable:
         - nilness
         - unusedwrite
-    goheader:
-      values:
-        regexp:
-          HEADER: 'Copyright \d{4} The Gitea Authors\. All rights reserved\.(\nCopyright [^\n]+)*\nSPDX-License-Identifier: MIT'
-      template: '{{ HEADER }}'
   exclusions:
     generated: lax
     presets:
       - comments
+      - common-false-positives
+      - legacy
       - std-error-handling
     rules:
       - linters:
           - forbidigo
         path: cmd
-      - linters:
-          - forcetypeassert
-        path: _test\.go
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
 formatters:
   enable:
-    - gci
+    - gofmt
     - gofumpt
   settings:
-    gci:
-      custom-order: true
-      sections:
-        - standard
-        - prefix(gitea.com/gitea/runner)
-        - blank
-        - default
     gofumpt:
-      extra:
-        group-params: true
+      extra-rules: true
   exclusions:
     generated: lax
 run:

.goreleaser.yaml

@@ -1,7 +1,5 @@
 version: 2
 
-project_name: gitea-runner
-
 before:
   hooks:
     - go mod tidy
@@ -65,7 +63,7 @@ builds:
   flags:
   - -trimpath
   ldflags:
-  - -s -w -X gitea.com/gitea/runner/internal/pkg/ver.version={{ .Summary }}
+  - -s -w -X gitea.com/gitea/act_runner/internal/pkg/ver.version={{ .Summary }}
   binary: >-
     {{ .ProjectName }}-
     {{- .Version }}-
@@ -83,37 +81,18 @@ builds:
       - cmd: sh .goreleaser.checksum.sh {{ .Path }}
       - cmd: sh .goreleaser.checksum.sh {{ .Path }}.xz
 
-# Uploads every release artifact to Cloudflare R2. The `blobs:` pipe
-# isn't usable here since it authenticates from the global AWS_* env
-# with no per-entry credentials; `publishers:` supports per-entry
-# `env:` instead, so it's used to invoke scripts/upload-r2.sh once per
-# artifact. Custom publishers inherit almost nothing from the
-# environment, hence the explicit R2_* forwarding below.
-#
-# This publisher fires 109 times for 73 distinct keys because
-# goreleaser's release pipe already registers `release.extra_files`
-# as UploadableFile artifacts, and `internal/exec`'s filterArtifacts
-# appends this block's own extra_files with no de-duplication. It
-# can't be globbed away, since gobwas/glob (via goreleaser/fileglob)
-# has no substring-exclusion matcher. It's harmless: PUT is
-# idempotent, and the `./**.xz` glob below is kept deliberately so
-# this publisher declares its own complete file set rather than
-# implicitly depending on the `release:` block's globs.
-publishers:
-  - name: cloudflare-r2
-    checksum: true
+blobs:
+  -
+    provider: s3
+    bucket: "{{ .Env.S3_BUCKET }}"
+    region: "{{ .Env.S3_REGION }}"
+    directory: "act_runner/{{.Version}}"
     extra_files:
       - glob: ./**.xz
       - glob: ./**.sha256
-    cmd: sh scripts/upload-r2.sh {{ abs .ArtifactPath }} gitea-runner/{{ .Version }}/{{ .ArtifactName }}
-    env:
-      - R2_ENDPOINT={{ index .Env "R2_ENDPOINT" }}
-      - R2_BUCKET={{ index .Env "R2_BUCKET" }}
-      - R2_ACCESS_KEY_ID={{ index .Env "R2_ACCESS_KEY_ID" }}
-      - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }}
 
 archives:
-  - formats: [binary]
+  - format: binary
     name_template: "{{ .Binary }}"
     allow_different_binary_count: true
 

AGENTS.md

@@ -1,19 +0,0 @@
-- Never assume, verify before claiming
-- Use `make help` to find available development targets
-- PR descriptions: minimal, only what and why, no task lists or file listings
-- Reference issues and PRs by full URL, not by number
-- Use Conventional Commits for commit messages and PR titles, plus the `enhance` type for user-facing enhancements
-- Add an `Assisted-by: AGENT_NAME:MODEL_VERSION` trailer to commit messages, never `Co-Authored-By` or `Signed-off-by`
-- Attribute agent authorship on one trailing line in issue and pull request comments, never as a PR description section
-- Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
-- Comments: write almost none, short and preferably same-line, explaining why for a future reader. Never narrate code, the change or the prompt. Preserve existing ones that still apply
-- Add the current year into the copyright header of new `.go` files
-- Read `DEVELOPMENT.md` for internals and conventions
-- Ensure no trailing whitespace in edited files
-- Run `make fmt` after `.go` edits, `make tidy` after `go.mod` edits, and `make checks` for the non-lint source checks
-- Lint what changed with `make lint-go`, and `make lint-go-windows` for Windows and platform-split files
-- Fix the cause rather than disabling a linter or weakening a test. Where unavoidable, use the narrowest scope with a trailing comment giving the reason
-- Run single go tests with `go test -run '^TestName$' ./modulepath/`. `make test` self-skips the integration tests without docker or network, `make test-dind` runs the daemon-facing tests against the built dind image
-- Write the fewest, fastest tests covering the behavior, extending an existing one where possible. Prefer unit tests where logic is testable in isolation
-- Wait on a deterministic condition rather than `sleep`
-- Update the files under `docs/` when behavior documented there changes

CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

DEVELOPMENT.md

@@ -1,41 +0,0 @@
-# Development
-
-## Job log line format
-
-Gitea stores one log row per line and its web UI decodes the payload, so getting the encoding
-wrong never fails a test here, it only shows up in the browser.
-
-**A row cannot contain a real newline.** `FormatLog` rewrites `\n` to a literal backslash-n and
-truncates at 64 KiB on a byte boundary.
-
-**The payload of a line starting with a recognised prefix is decoded**, with the escape set
-depending on the prefix:
-
-| prefix | decodes |
-| --- | --- |
-| `##[error]` `##[warning]` `##[notice]` `##[debug]` `##[group]` `##[endgroup]` `##[add-matcher]` | `%25` `%0D` `%0A` `%3B` `%5D` |
-| `::error::` `::warning::` `::notice::` `::debug::` (with or without ` key=value` properties), `::group::` `::endgroup::` `::add-matcher::` | `%25` `%0D` `%0A` |
-| `##[command]` `[command]`, or no recognised prefix | nothing |
-
-### Rules
-
-- **Emitting a command line?** Escape the payload with `runner.EscapeCommandData`. One escaper
-  covers both forms: it escapes `%` first, so a literal `%3B` becomes `%253B` that the extra
-  `##[…]` rules cannot match, and a raw `;` or `]` is never decoded. It is also what makes
-  multi-line work, `\n` becomes `%0A` and the UI turns it back into a line break.
-- **Forwarding a command from step output?** Leave the payload alone, it arrived escaped and is
-  decoded once. Decoding here double-decodes and destroys multi-line.
-- **No prefix?** Do not escape, and split multi-line values into one row each.
-- **Interpolating a secret?** Masking runs after escaping, so `AppendSecretMasker` registers the
-  encoded forms too.
-- Command *properties* also escape `%3A` and `%2C`, which the UI never decodes, so the reporter
-  decodes exactly those two when folding a location into an annotation.
-
-## End-to-end compatibility tests
-
-`make test-e2e` runs the runner against `E2E_GITEA_IMAGE`. It defaults to the nightly image.
-It requires Docker and is excluded from `make test`. CI runs stable and nightly variants in
-parallel.
-
-The suite shares one Gitea and regular runner. Cache and ephemeral scenarios use isolated
-repository runners. A run path is `<workflow>@<ref>` and a log row is `<timestamp>Z <payload>`.

Dockerfile

@@ -1,7 +1,7 @@
 ### BUILDER STAGE
 #
 #
-FROM golang:1.27-alpine3.23 AS builder
+FROM golang:1.26-alpine AS builder
 
 # Do not remove `git` here, it is required for getting runner version when executing `make build`
 RUN apk add --no-cache make git
@@ -9,24 +9,19 @@ RUN apk add --no-cache make git
 ARG GOPROXY
 ENV GOPROXY=${GOPROXY:-}
 
-COPY . /opt/src/runner
-WORKDIR /opt/src/runner
+COPY . /opt/src/act_runner
+WORKDIR /opt/src/act_runner
 
 RUN make clean && make build
 
 ### DIND VARIANT
 #
 #
-FROM docker:29.7.2-dind AS dind
+FROM docker:28-dind AS dind
 
-ARG VERSION=dev
+RUN apk add --no-cache s6 bash git tzdata
 
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
-RUN apk add --no-cache s6 bash git tzdata nftables
-
-COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
 COPY scripts/run.sh /usr/local/bin/run.sh
 COPY scripts/s6 /etc/s6
 
@@ -37,17 +32,12 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### DIND-ROOTLESS VARIANT
 #
 #
-FROM docker:29.7.2-dind-rootless AS dind-rootless
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
+FROM docker:28-dind-rootless AS dind-rootless
 
 USER root
-RUN apk add --no-cache s6 bash git tzdata nftables
+RUN apk add --no-cache s6 bash git tzdata
 
-COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
 COPY scripts/run.sh /usr/local/bin/run.sh
 COPY scripts/s6 /etc/s6
 
@@ -63,16 +53,10 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### BASIC VARIANT
 #
 #
-FROM alpine:3.24 AS basic
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
+FROM alpine AS basic
 RUN apk add --no-cache tini bash git tzdata
 
-COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
 COPY scripts/run.sh /usr/local/bin/run.sh
 
 VOLUME /data

Makefile

@@ -1,32 +1,32 @@
 DIST := dist
-EXECUTABLE := gitea-runner
+EXECUTABLE := act_runner
+GOFMT ?= gofumpt -l
 DIST_DIRS := $(DIST)/binaries $(DIST)/release
 GO ?= go
 SHASUM ?= shasum -a 256
 HAS_GO = $(shell hash $(GO) > /dev/null 2>&1 && echo "GO" || echo "NOGO" )
-XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
-XGO_VERSION := go-1.27.x
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.16 # renovate: datasource=go
+XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
+XGO_VERSION := go-1.26.x
+GXZ_PAGAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.10
 
 LINUX_ARCHS ?= linux/amd64,linux/arm64
 DARWIN_ARCHS ?= darwin-12/amd64,darwin-12/arm64
 WINDOWS_ARCHS ?= windows/amd64
+GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*")
 GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*")
 
-DOCKER_IMAGE ?= gitea/runner
+DOCKER_IMAGE ?= gitea/act_runner
 DOCKER_TAG ?= nightly
 DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
 DOCKER_ROOTLESS_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)-dind-rootless
 
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.7.0 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
 
-GOTEST_FLAGS ?= -race -timeout 20m -parallel 8
-
-STATIC ?=
-EXTLDFLAGS ?=
-ifneq ($(STATIC),)
-	EXTLDFLAGS = -extldflags "-static"
+ifneq ($(shell uname), Darwin)
+	EXTLDFLAGS = -extldflags "-static" $(null)
+else
+	EXTLDFLAGS =
 endif
 
 ifeq ($(HAS_GO), GO)
@@ -40,15 +40,12 @@ endif
 ifeq ($(OS), Windows_NT)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else ifeq ($(OS), Windows)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else
 	GOFLAGS := -v
 	EXECUTABLE ?= $(EXECUTABLE)
-	GO_ENV_WINDOWS := GOOS=windows
 endif
 
 STORED_VERSION_FILE := VERSION
@@ -71,19 +68,19 @@ else
 	endif
 endif
 
-TAGS ?=
-LDFLAGS ?= -X "gitea.com/gitea/runner/internal/pkg/ver.version=v$(RELASE_VERSION)"
+GO_PACKAGES_TO_VET ?= $(filter-out gitea.com/gitea/act_runner/internal/pkg/client/mocks,$(shell $(GO) list ./...))
+
+
+TAGS ?=
+LDFLAGS ?= -X "gitea.com/gitea/act_runner/internal/pkg/ver.version=v$(RELASE_VERSION)"
 
-.PHONY: all
 all: build
 
-.PHONY: help
-help: Makefile ## print Makefile help information.
-	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m[TARGETS] default target: build\033[0m\n\n\033[35mTargets:\033[0m\n"} /^[0-9A-Za-z._-]+:.*?##/ { printf "  \033[36m%-45s\033[0m %s\n", $$1, $$2 }' Makefile
-
-.PHONY: fmt
-fmt: ## format the Go code
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) fmt
+fmt:
+	@hash gofumpt > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
+		$(GO) install mvdan.cc/gofumpt@latest; \
+	fi
+	$(GOFMT) -w $(GO_FMT_FILES)
 
 .PHONY: go-check
 go-check:
@@ -91,132 +88,100 @@ go-check:
 	$(eval MIN_GO_VERSION := $(shell printf "%03d%03d" $(shell echo '$(MIN_GO_VERSION_STR)' | tr '.' ' ')))
 	$(eval GO_VERSION := $(shell printf "%03d%03d" $(shell $(GO) version | grep -Eo '[0-9]+\.[0-9]+' | tr '.' ' ');))
 	@if [ "$(GO_VERSION)" -lt "$(MIN_GO_VERSION)" ]; then \
-		echo "Gitea Runner requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
+		echo "Act Runner requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
 		exit 1; \
 	fi
 
 .PHONY: fmt-check
-fmt-check: fmt
-	@diff=$$(git diff --color=always -- '*.go'); \
+fmt-check:
+	@hash gofumpt > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
+		$(GO) install mvdan.cc/gofumpt@latest; \
+	fi
+	@diff=$$($(GOFMT) -d $(GO_FMT_FILES)); \
 	if [ -n "$$diff" ]; then \
 		echo "Please run 'make fmt' and commit the result:"; \
-		printf "%s" "$${diff}"; \
+		echo "$${diff}"; \
 		exit 1; \
-	fi
+	fi;
 
 .PHONY: deps-tools
 deps-tools: ## install tool dependencies
-	$(GO) install $(GOLANGCI_LINT_PACKAGE) & \
-	$(GO) install $(GXZ_PACKAGE) & \
-	$(GO) install $(XGO_PACKAGE) & \
-	$(GO) install $(GOVULNCHECK_PACKAGE) & \
-	wait
-
-.PHONY: checks
-checks: tidy-check fmt-check security-check ## run the non-lint source checks
+	$(GO) install $(GOVULNCHECK_PACKAGE)
 
 .PHONY: lint
-lint: lint-go lint-go-windows ## lint everything
+lint: lint-go vet
 
 .PHONY: lint-go
 lint-go: ## lint go files
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run
 
-.PHONY: lint-go-windows
-lint-go-windows: ## lint Windows go files
-	$(GO) install $(GOLANGCI_LINT_PACKAGE)
-	$(GO_ENV_WINDOWS) golangci-lint run
-
 .PHONY: lint-go-fix
 lint-go-fix: ## lint go files and fix issues
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run --fix
 
-.PHONY: lint-pr-title
-lint-pr-title: ## lint PR title against Conventional Commits (set PR_TITLE=...)
-	@node ./tools/lint-pr-title.ts
-
 .PHONY: security-check
-security-check:
-	$(GO) run $(GOVULNCHECK_PACKAGE) -show color ./... || true
+security-check: deps-tools
+	GOEXPERIMENT= $(GO) run $(GOVULNCHECK_PACKAGE) -show color ./... || true
 
 .PHONY: tidy
-tidy: ## run go mod tidy
-	$(eval GO_TOOLCHAIN := $(shell grep -Eo '^toolchain\s+go[0-9.]+' go.mod | cut -d' ' -f2))
+tidy:
 	$(GO) mod tidy
-	@# workaround https://github.com/golang/go/issues/75331: restore toolchain if tidy dropped it
-	@if [ -n "$(GO_TOOLCHAIN)" ] && ! grep -qE '^toolchain\s' go.mod; then \
-		$(GO) mod edit -toolchain=$(GO_TOOLCHAIN); \
-	fi
 
 .PHONY: tidy-check
 tidy-check: tidy
-	@diff=$$(git diff --color=always -- go.mod go.sum); \
+	@diff=$$(git diff -- go.mod go.sum); \
 	if [ -n "$$diff" ]; then \
 		echo "Please run 'make tidy' and commit the result:"; \
-		printf "%s" "$${diff}"; \
+		echo "$${diff}"; \
 		exit 1; \
 	fi
 
-.PHONY: test
-test: ## test everything (integration tests self-skip without docker/network)
-	@$(GO) test $(GOTEST_FLAGS) -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
+test: fmt-check security-check
+	@$(GO) test -race -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
 
-.PHONY: coverage-report
-coverage-report: ## turn coverage.txt from `make test` into .tmp/coverage.md
-	@mkdir -p .tmp
-	@node ./tools/coverage-report.ts -i coverage.txt -o .tmp/coverage.md
-	@echo "Wrote .tmp/coverage.md"
+.PHONY: vet
+vet:
+	@echo "Running go vet..."
+	@$(GO) build code.gitea.io/gitea-vet
+	@$(GO) vet -vettool=gitea-vet $(GO_PACKAGES_TO_VET)
 
-.PHONY: test-dind
-test-dind: ## run the daemon-facing tests against the built dind image (TARGET=dind|dind-rootless)
-	@./scripts/test-dind.sh $(TARGET)
+install: $(GOFILES)
+	$(GO) install -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)'
 
-E2E_JOB_IMAGE ?= node:24-bookworm@sha256:934240a162082fd8b8a2f90cd5114446443f1eba1c5378f6687167ca405e6584 # renovate: datasource=docker
-SERVICE_IMAGE ?= nginx:1.31.4-alpine@sha256:db35bfc6b2951e7f8a72db5db120288c127ffaeeb4a6d4b95a26fead017d5913 # renovate: datasource=docker
-E2E_GITEA_IMAGE ?= gitea/gitea:main-nightly
-E2E_CONCURRENCY ?= 8
-
-.PHONY: test-e2e
-test-e2e: ## run Gitea compatibility tests against E2E_GITEA_IMAGE
-	@E2E_CONCURRENCY=$(E2E_CONCURRENCY) E2E_GITEA_IMAGE=$(E2E_GITEA_IMAGE) E2E_JOB_IMAGE=$(E2E_JOB_IMAGE) GO=$(GO) SERVICE_IMAGE=$(SERVICE_IMAGE) ./tools/test-e2e.sh
-
-.PHONY: install
-install: $(GOFILES) ## install the runner binary via `go install`
-	$(GO) install -v -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)'
-
-.PHONY: build
-build: go-check $(EXECUTABLE) ## build the runner binary
+build: go-check $(EXECUTABLE)
 
 $(EXECUTABLE): $(GOFILES)
-	$(GO) build -v -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@
+	$(GO) build -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)' -o $@
 
 .PHONY: deps-backend
-deps-backend: ## install backend dependencies
+deps-backend:
 	$(GO) mod download
+	$(GO) install $(GXZ_PAGAGE)
+	$(GO) install $(XGO_PACKAGE)
 
 .PHONY: release
-release: release-windows release-linux release-darwin release-copy release-compress release-check ## build release artifacts
+release: release-windows release-linux release-darwin release-copy release-compress release-check
 
 $(DIST_DIRS):
 	mkdir -p $(DIST_DIRS)
 
 .PHONY: release-windows
 release-windows: | $(DIST_DIRS)
-	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -buildmode exe -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w -linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(WINDOWS_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -buildmode exe -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(WINDOWS_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
 ifeq ($(CI),true)
 	cp -r /build/* $(DIST)/binaries/
 endif
 
 .PHONY: release-linux
 release-linux: | $(DIST_DIRS)
-	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w -linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(LINUX_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(LINUX_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
 ifeq ($(CI),true)
 	cp -r /build/* $(DIST)/binaries/
 endif
 
 .PHONY: release-darwin
 release-darwin: | $(DIST_DIRS)
-	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w $(LDFLAGS)' -targets '$(DARWIN_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '$(LDFLAGS)' -targets '$(DARWIN_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
 ifeq ($(CI),true)
 	cp -r /build/* $(DIST)/binaries/
 endif
@@ -231,20 +196,18 @@ release-check: | $(DIST_DIRS)
 
 .PHONY: release-compress
 release-compress: | $(DIST_DIRS)
-	cd $(DIST)/release/; for file in `find . -type f -name "*"`; do echo "compressing $${file}" && $(GO) run $(GXZ_PACKAGE) -k -9 $${file}; done;
+	cd $(DIST)/release/; for file in `find . -type f -name "*"`; do echo "compressing $${file}" && $(GO) run $(GXZ_PAGAGE) -k -9 $${file}; done;
 
 .PHONY: docker
-docker: ## build the docker image
+docker:
 	if ! docker buildx version >/dev/null 2>&1; then \
 		ARG_DISABLE_CONTENT_TRUST=--disable-content-trust=false; \
 	fi; \
 	docker build $${ARG_DISABLE_CONTENT_TRUST} -t $(DOCKER_REF) .
 
-.PHONY: clean
-clean: ## delete binary and coverage files
+clean:
 	$(GO) clean -x -i ./...
-	rm -rf coverage.txt .tmp $(EXECUTABLE) $(DIST)
+	rm -rf coverage.txt $(EXECUTABLE) $(DIST)
 
-.PHONY: version
-version: ## print the version
+version:
 	@echo $(VERSION)

README.md

@@ -1,4 +1,6 @@
-# Gitea Runner
+# act runner
+
+Act runner is a runner for Gitea based on [Gitea fork](https://gitea.com/gitea/act) of [act](https://github.com/nektos/act).
 
 ## Installation
 
@@ -8,7 +10,7 @@ Docker Engine Community version is required for docker mode. To install Docker C
 
 ### Download pre-built binary
 
-Visit [here](https://dl.gitea.com/gitea-runner/) and download the right version for your platform.
+Visit [here](https://dl.gitea.com/act_runner/) and download the right version for your platform.
 
 ### Build from source
 
@@ -24,8 +26,8 @@ make docker
 
 ## Quickstart
 
-Actions are disabled by default, so you need to add the following to the configuration file of your Gitea instance to enable it:
-
+Actions are disabled by default, so you need to add the following to the configuration file of your Gitea instance to enable it: 
+  
 ```ini
 [actions]
 ENABLED=true
@@ -34,7 +36,7 @@ ENABLED=true
 ### Register
 
 ```bash
-./gitea-runner register
+./act_runner register
 ```
 
 And you will be asked to input:
@@ -66,7 +68,7 @@ INFO Runner registered successfully.
 You can also register with command line arguments.
 
 ```bash
-./gitea-runner register --instance http://192.168.8.8:3000 --token <my_runner_token> --no-interactive
+./act_runner register --instance http://192.168.8.8:3000 --token <my_runner_token> --no-interactive
 ```
 
 If the registry succeed, it will run immediately. Next time, you could run the runner directly.
@@ -74,327 +76,32 @@ If the registry succeed, it will run immediately. Next time, you could run the r
 ### Run
 
 ```bash
-./gitea-runner daemon
+./act_runner daemon
 ```
 
 ### Run with docker
 
 ```bash
-docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/runner:nightly
+docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/act_runner:nightly
 ```
 
-Mount a volume on `/data` if you want the registration file and optional config to survive container recreation (see [scripts/run.sh](scripts/run.sh)).
-
-> **`/data` does not hold the image cache.** It is the runner's working directory and contains only the `.runner` registration file and, optionally, your config file. Images pulled for jobs live in the *Docker daemon's* data root, which for the `dind` flavours is inside the container (`/var/lib/docker`, or `/home/rootless/.local/share/docker` for `dind-rootless`). To keep the image cache across restarts, give that path its own volume as well — otherwise every new container re-pulls the job images. With the `basic` flavour the images live on whichever daemon you point the runner at, so there is nothing extra to persist.
-
-### Image flavours
-
-The image is published in three flavours, all built from the single multi-stage [Dockerfile](Dockerfile) in this repository. They differ only in how a Docker daemon is made available to the jobs the runner executes; the `gitea-runner` binary inside them is identical.
-
-| Tag | Build target | Base image | Docker daemon | Process supervisor | Runs as |
-| --- | --- | --- | --- | --- | --- |
-| `latest` (and `<version>`) | `basic` | `alpine` | none — uses an external daemon you provide | [`tini`](https://github.com/krallin/tini) | `root` |
-| `latest-dind` | `dind` | `docker:dind` | bundled, started inside the container | [`s6`](https://skarnet.org/software/s6/) | `root` (privileged) |
-| `latest-dind-rootless` | `dind-rootless` | `docker:dind-rootless` | bundled, started rootless inside the container | [`s6`](https://skarnet.org/software/s6/) | `rootless` (UID 1000) |
-
-#### `latest` — basic
-
-The default flavour ships only the runner on a minimal Alpine base. It contains **no Docker daemon of its own**: jobs that use `docker://` images need a daemon supplied from outside the container, typically by bind-mounting the host's socket:
-
-```bash
-docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/runner:latest
-```
-
-`tini` is the entrypoint (it reaps zombie processes), and it just runs [`scripts/run.sh`](scripts/run.sh), which registers the runner on first start and then execs `gitea-runner daemon`. This flavour does not need `--privileged`. The trade-off is that jobs share the host's daemon, so they can see other containers and images on that daemon.
-
-#### `latest-dind` — Docker-in-Docker
-
-This flavour is based on the official `docker:dind` image and bundles its own Docker daemon, so it needs no external socket — only the `--privileged` flag that Docker-in-Docker requires:
-
-```bash
-docker run --privileged -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  --name my_runner gitea/runner:latest-dind
-```
-
-Two processes have to run side by side here (the Docker daemon and the runner), so the entrypoint is the [`s6`](https://skarnet.org/software/s6/) supervision tree under [`scripts/s6`](scripts/s6) instead of `tini`. `s6` starts `dockerd`, and the runner service waits for the daemon to come up (`s6-svwait`) before launching [`run.sh`](scripts/run.sh). Each container has a private daemon isolated from the host's, at the cost of running privileged.
-
-#### `latest-dind-rootless` — rootless Docker-in-Docker
-
-Same idea as `dind`, but built on `docker:dind-rootless` so the bundled daemon and the runner run as an unprivileged user (`rootless`, UID 1000) rather than `root`. `DOCKER_HOST` is preset to `unix:///run/user/1000/docker.sock` so the runner talks to the rootless daemon. This reduces the blast radius compared to the privileged `dind` flavour, but rootless Docker carries the usual rootless limitations (networking, cgroups, storage drivers, and some operations that need additional host configuration such as `/etc/subuid` / `/etc/subgid` mappings and unprivileged user-namespace support).
-
-> **The UID is fixed at 1000.** It comes from the `rootless` user baked into the upstream `docker:dind-rootless` base image, and the bundled daemon always listens on `/run/user/1000/docker.sock` inside the container, so running this flavour as a different user (`--user 1001`) does not work. If you need the runner to talk to a *host* rootless daemon that runs under some other UID, use the `basic` flavour instead and bind-mount that daemon's socket (see [examples/vm/rootless-docker.md](examples/vm/rootless-docker.md)); pointing `DOCKER_HOST` at a host socket from inside `dind-rootless` will not work. Changing the UID otherwise means rebuilding the image from a base with a different `rootless` user.
-
-> **Note on Podman:** these images target the Docker daemon. The bundled `dind`/`dind-rootless` daemons are `dockerd`, not Podman, and the `basic` flavour expects a Docker-compatible socket. Running them under rootless Podman is not a supported configuration, though pointing the `basic` flavour at a Podman socket that emulates the Docker API may work for some workloads.
-
 ### Configuration
 
-The runner reads a YAML file. Without one, every option keeps its default.
+You can also configure the runner with a configuration file.
+The configuration file is a YAML file, you can generate a sample configuration file with `./act_runner generate-config`.
 
 ```bash
-./gitea-runner config init             # write config.yaml, with no option set
-./gitea-runner config generate | less  # read what the options do
-./gitea-runner -c config.yaml daemon   # -c also works on register and cache-server
+./act_runner generate-config > config.yaml
 ```
 
-`config generate` prints [config.example.yaml](internal/pkg/config/config.example.yaml). Every value in it is commented out, so copy the lines you want to change into your own file and uncomment them.
-
-#### Editing a config file
-
-`config` edits a file in place, which is handy in provisioning scripts:
+You can specify the configuration file path with `-c`/`--config` argument.
 
 ```bash
-./gitea-runner config set runner.capacity 4
-./gitea-runner config set runner.timeout 90m  # written as 1h30m0s
-./gitea-runner config set runner.envs.MY_VAR value
-./gitea-runner config add runner.labels 'ubuntu:docker://node:22'
-./gitea-runner config remove runner.labels 'ubuntu:docker://node:22'
-./gitea-runner config get runner.labels
+./act_runner -c config.yaml register # register with config file
+./act_runner -c config.yaml daemon # run with config file
 ```
 
-A key is its dotted YAML path. An unknown key, a value of the wrong type, or `add`/`remove` on anything but a list is refused before the file is touched. `set` replaces a whole list when you give it several values.
-
-An edit keeps the comments and the key order of the file. Indentation becomes two spaces, and a blank line between two values is dropped.
-
-`config get`, `set`, `add` and `remove` use `config.yaml` (or `config.yml`) from the working directory, then from the directory of the binary, and print their choice to stderr. `config init` writes `config.yaml` in the working directory, and refuses to overwrite an existing config without `--force`. Pass `-c` for another path.
-
-#### Tool cache
-
-Setup actions like `setup-go` install tools into `RUNNER_TOOL_CACHE`, which is `/opt/hostedtoolcache` inside a job. `runner.tool_cache_mode` selects what backs it:
-
-| Mode | Tool cache | Trade-off |
-| --- | --- | --- |
-| `none` (default) | Per job, provided by the job image | A version the image lacks is downloaded in every job |
-| `shared` | One volume reused by every job | Two jobs writing the same tool version at once corrupt it, so use it only with `runner.capacity: 1` |
-
-With `none`, tools must come from the job image. Install them into `/opt/hostedtoolcache/<tool>/<version>/<arch>`, with an empty `<arch>.complete` file next to the directory:
-
-```dockerfile
-RUN GO=$(curl -fsSL 'https://go.dev/dl/?mode=json' | grep -oP '"version": "\Kgo1\.26\.[0-9]*' | head -1); \
-  DIR="/opt/hostedtoolcache/go/${GO#go}/x64" && \
-  mkdir -p "$(dirname "$DIR")" && \
-  curl -fsSL "https://dl.google.com/go/${GO}.linux-amd64.tar.gz" | tar -xz -C /tmp && \
-  mv /tmp/go "$DIR" && \
-  touch "${DIR}.complete"
-```
-
-A workflow requesting a minor version, `go-version: "1.26"`, resolves to the newest matching version in the cache, so a patch update in the image still hits it.
-
-Of the [runner images](https://gitea.com/gitea/runner-images), the `-full` flavour is the one that ships tools in this layout.
-
-`gitea-runner exec` reads no config file and takes `--tool-cache-mode` instead, defaulting to `none`.
-
-#### Environment variables
-
-Earlier releases let a few environment variables (`GITEA_DEBUG`, `GITEA_TRACE`, `GITEA_RUNNER_CAPACITY`, `GITEA_RUNNER_FILE`, `GITEA_RUNNER_ENVIRON`, `GITEA_RUNNER_ENV_FILE`) override parts of the config. They are gone, use the YAML file for all settings. The Docker images still read their own variables, such as `RUNNER_STATE_FILE`, see [scripts/run.sh](scripts/run.sh) and the container documentation below.
-
-### Labels
-
-Labels decide **which jobs a runner accepts** and **how it runs them**. A job's `runs-on` is matched against the runner's label names; the first match wins and selects the execution environment for that job.
-
-A label is written as:
-
-```text
-<name>[:<schema>[:<args>]]
-```
-
-| Part | Meaning |
-| --- | --- |
-| `name` | The name a workflow refers to in `runs-on`, e.g. `ubuntu-latest`. |
-| `schema` | Either `docker` or `host`. Defaults to `host` when omitted. |
-| `args` | Only used by the `docker` schema: the image to run the job in. |
-
-Two schemas are supported:
-
-- **`docker://<image>`** — the job runs inside a container created from `<image>`:
-
-  ```text
-  ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest
-  ```
-
-- **`host`** — the job's steps run directly on the machine the runner is on, using the tools installed there:
-
-  ```text
-  macos:host
-  ```
-
-So with the labels
-
-```text
-ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest,macos:host
-```
-
-a workflow with `runs-on: ubuntu-latest` is executed in the `runner-images:ubuntu-latest` container, and one with `runs-on: macos` is executed directly on the host.
-
-Names may themselves contain a colon (for example `pool:e57e18d4-10d4-406f-93bf-60f127221bdd`); only `host` and `docker` are treated as schemas.
-
-If a job's `runs-on` matches none of the runner's labels, or sets no `runs-on` at all, it still runs: in `runner.default_image` where docker is available, on the host where it is not. Images maintained for this purpose are listed at [gitea/runner-images](https://gitea.com/gitea/runner-images).
-
-Labels are chosen at registration time (`--labels`, or the interactive prompt) and can be changed afterwards by editing `runner.labels` in the config file, or in the Gitea UI under the runner's settings.
-
-#### Registration vs config labels
-
-If `runner.labels` is set in the YAML file, those labels are used during `register` and the `--labels` CLI flag is ignored.
-
-The `daemon` command also accepts `--labels` (which defaults to the `GITEA_RUNNER_LABELS` environment variable), so the labels of an already registered runner can be changed without deleting its registration file. The most explicit source wins:
-
-```
---labels / GITEA_RUNNER_LABELS   >   runner.labels in the config file   >   labels in the .runner file
-```
-
-Whenever the resulting labels differ from the ones in the registration file, they are written back to it and re-declared to the Gitea instance on startup.
-
-> **Note:** A runner that only exposes `host` labels still needs access to a Docker daemon (e.g. a mounted `/var/run/docker.sock`) whenever a job uses a `docker://` action or a service container. `host` labels only change where the job's own steps run; container-based steps and actions are still executed with Docker.
-
-#### Service containers
-
-A job's `services` are started before its steps run. When a service's image or its `options` declare a healthcheck, the runner waits for it to report healthy, so a workflow does not have to poll for its own services:
-
-```yaml
-services:
-  postgres:
-    image: postgres:17
-    options: >-
-      --health-cmd pg_isready
-      --health-interval 5s
-      --health-retries 10
-```
-
-A service that reports unhealthy fails the job right away, with its container log. One that never becomes healthy fails it after `container.service_ready_timeout` (default `5m`, negative disables the wait). A service that exits without declaring a healthcheck only gets its log and a warning.
-
-A job in a container reaches a service by its id on the job network, on the port the service listens on, for example `psql -h postgres -p 5432`. The started containers also fill the `job` context: `job.container.{id,network}` and `job.services.<id>.{id,network,ports}`, where `ports` maps a container port to the host port Docker published it on, for the services that publish one.
-
-Unlike GitHub, a job whose steps run on the host (a `host` label without `container:`) starts no service containers, so `job.services` and `job.container` stay empty. Give such a job a `container:` when it needs services.
-
-#### Proxy
-
-Set these variables in the runner's environment, with systemd `Environment=`, `docker run -e`, or Kubernetes `env:`:
-
-```sh
-http_proxy=http://proxy.example:3128
-https_proxy=http://proxy.example:3128
-no_proxy=gitea.internal,.example.local
-```
-
-The runner uses them for its own requests and gives them to every job, in lower and upper case.
-
-These hosts are added to `no_proxy` for jobs, so they are always reached directly:
-
-- the cache server
-- `localhost`, `127.0.0.1` and `::1`
-- the job's service containers
-- the Docker daemon, when it is reached over `tcp://`
-
-Gitea is not added. Add it to `no_proxy` yourself if it should be reached directly.
-
-To change a value for one job, set it in a step's `env:` or in the job's `container.env`. Setting it at workflow or job level has no effect. To change it for the whole runner, set it in `runner.envs`. A `no_proxy` set there is added to the list above instead of replacing it.
-
-Images are pulled by the Docker daemon, which needs its own proxy setting. In the `dind` images the daemon runs in the same container and reads the variables above. For any other daemon, see [the Docker documentation](https://docs.docker.com/engine/daemon/proxy/). The runner logs a warning at startup if it has a proxy and the daemon does not.
-
-Dockerfile actions are built with these variables as build arguments, so their `RUN` steps can reach the network.
-
-A password in a proxy URL is hidden in job logs. Any step can still read it, because the step is given the proxy URL in its environment.
-
-#### Caching (`actions/cache`)
-
-Each runner starts its own cache server automatically. Cache entries are local to that runner — runners do not share a cache by default.
-
-**Eviction**
-
-An entry nothing has read or written for `retention` is removed, and a repository past `repo_size_limit` loses its least recently accessed entries until it fits; `size_limit` caps the whole cache the same way. Age alone never retires an entry still in use, and whatever these allow, the cache keeps free space above `health_check.min_free_disk_space_mb` when health checks are enabled.
-
-These apply where the cache server runs, so on a shared server they belong in *its* config, not the runners'. See `retention`, `repo_size_limit`, `size_limit` and `sweep_interval` in [config.example.yaml](internal/pkg/config/config.example.yaml) for units and defaults.
-
-**Cache service v2**
-
-`actions/cache@v4.2` and later can use the *cache service v2* API. The runner serves it from the same store as v1, on by default, and it works with `external_server`. Turn it off with:
-
-```yaml
-cache:
-  v2: false
-```
-
-Those actions refuse any host they do not take for GitHub. Rather than misreport the server URL, the runner edits that check out of the action's own bundle on its way into the job, undone whenever the action is downloaded again. A bundle it does not recognise is left alone and keeps to v1. The same edit lets the stock `actions/upload-artifact` and `actions/download-artifact` work from `v4.4.0` on, without the `gitea-upload-artifact` fork, so it is made whatever `v2` says: that setting only governs the API the runner advertises. Set `runner.patch_actions: false` to leave every bundle exactly as shipped, an escape hatch for an action the edit breaks. The artifact actions then refuse again and the cache client keeps to v1.
-
-**Shared cache across multiple runners**
-
-Run one dedicated `gitea-runner cache-server` that all runners point at.
-
-1. Create a config file for the cache server host:
-
-   ```yaml
-   cache:
-     dir: /data/actcache
-     port: 8088
-     external_secret: "replace-with-a-strong-random-secret"
-     # external_secret_file: /path/to/secret # secret can also be passed via a file
-   ```
-
-2. Start the server:
-
-   ```bash
-   gitea-runner -c cache-server-config.yaml cache-server
-   ```
-
-3. On every runner:
-
-   ```yaml
-   cache:
-     external_server: "http://<cache-server-host>:8088/"
-     external_secret: "replace-with-a-strong-random-secret"  # must match the server
-     # external_secret_file: /path/to/secret # secret can also be passed via a file
-   ```
-
-Jobs reach the cache server at `external_server`, so when a reverse proxy fronts the server, point `external_server` at the proxy. The cache server itself needs no extra configuration.
-
-Alternatively, mount the same NFS/CIFS share on every runner and point `cache.dir` at it — simpler, but with weaker isolation between repositories.
-
-**S3 / MinIO** — mount object storage as a FUSE filesystem (e.g. [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) or [goofys](https://github.com/kahing/goofys)) and set `cache.dir` to the mount point.
-
-Flags `--dir`, `--host`, and `--port` on `cache-server` override the corresponding `cache.*` YAML keys; all other settings, including `external_secret`, require the config file.
-
-#### Official Docker image
-
-Besides `GITEA_INSTANCE_URL` and `GITEA_RUNNER_REGISTRATION_TOKEN`, the image entrypoint supports optional variables such as `CONFIG_FILE` (passed through as `-c`), `GITEA_RUNNER_LABELS`, `GITEA_RUNNER_EPHEMERAL`, `GITEA_RUNNER_ONCE`, `GITEA_RUNNER_NAME`, `GITEA_MAX_REG_ATTEMPTS`, `RUNNER_STATE_FILE`, and `GITEA_RUNNER_REGISTRATION_TOKEN_FILE`. See [scripts/run.sh](scripts/run.sh) for exact behavior.
-
-For a fuller container-oriented walkthrough, see [examples/docker](examples/docker/README.md).
-
-While the runner is idle it cleans up after earlier jobs:
-- when `container.bind_workdir` is enabled, stale task workspace directories older than `runner.workdir_cleanup_age` are removed (default: `24h`; set `0` to disable)
-- only purely numeric subdirectories under `container.workdir_parent` are treated as task workspaces and may be removed
-- cleanup assumes `container.workdir_parent` is not shared across multiple runners
-- on runners that use docker, per-job networks left behind by jobs the runner did not live to tear down are removed, identified by the `com.gitea.runner.uuid` label carrying this runner's uuid
-- cleanup runs every `runner.idle_cleanup_interval` (default: `10m`; set `0` to disable), and setting either knob to `0` disables all of the above
-
-#### Post-task script (`runner.post_task_script`)
-
-Optional host script that runs **after** each task's built-in cleanup (post-steps, container teardown, bind-workdir removal). Use it for extra machine housekeeping — Docker pruning, disk cleanup, and similar.
-
-**While the script runs, the runner stops task heartbeats and stays offline from Gitea's perspective until the script exits (or hits `runner.post_task_script_timeout`, default `5m`).** A script that blocks without exiting keeps the runner from taking new work for up to that timeout. Script output goes to the runner log, not the job log; a non-zero exit is warned but does not change the job result.
-
-On Windows, use `.exe`, `.bat`, or `.cmd` paths; **PowerShell (`.ps1`) is not supported yet** as the configured path — wrap commands in a `.cmd` file instead.
-
-See **[docs/post-task-script.md](docs/post-task-script.md)** for lifecycle details, environment variables, timeout interaction, and platform notes.
-
-#### Job hooks (`runner.hooks.job_started`, `runner.hooks.job_completed`)
-
-Optional scripts that run **inside the job environment** (the job container, or the host in host mode), before the job's first step and after its last one. They are the equivalent of GitHub's `ACTIONS_RUNNER_HOOK_JOB_STARTED` / `ACTIONS_RUNNER_HOOK_JOB_COMPLETED`, which are read when the settings are unset.
-
-Because they run where the steps run and see the job's environment, they are the place for per-job setup no workflow should have to carry: registry logins, mirror configuration, or masking runner-wide secrets with `::add-mask::`. Their output is part of the job log and is scanned for workflow commands, and they can export to the job through `$GITHUB_ENV` and `$GITHUB_PATH`.
-
-Both hooks are synchronous and block the job while they run. Either one exiting non-zero fails the job, and there is no per-hook timeout.
-
-See **[docs/job-hooks.md](docs/job-hooks.md)** for the execution order, environment, and platform notes.
-
-#### Local job logs (`log.job.dir`)
-
-Set `log.job.dir` to a path and the runner writes a copy of every task's log there as `<start time>-task-<id>.log`: the rows exactly as Gitea received them, with the same secrets masked and the job's result on the last line. Off by default, and what Gitea shows does not change.
-
-#### Secret masking
-
-A job's secrets and its `::add-mask::` values are hidden from what the runner writes and uploads: the job log, the local copy above, job summaries, and the names of the containers it creates. A job output carrying one is skipped with a warning rather than sent masked, as GitHub does, so a downstream `needs.<job>.outputs.<name>` reading it is empty.
-
-`log.job.retention` (default `168h`) is how long a log is kept, expired ones being deleted as new tasks start, and `log.job.max_size` (default `1GB`) caps one log. Keep `retention` above `runner.timeout` so a long job cannot outlive its own log, and prefer local disk, the file is written while the job runs. Only the runner's own user can read it.
+You can read the latest version of the configuration file online at [config.example.yaml](internal/pkg/config/config.example.yaml).
 
 ### Example Deployments
 

act/LICENSE

@@ -1,22 +0,0 @@
-MIT License
-
-Copyright (c) 2022 The Gitea Authors
-Copyright (c) 2019
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

act/artifactcache/doc.go

@@ -1,12 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-// Package artifactcache provides a cache handler for the runner.
-//
-// Inspired by https://github.com/sp-ricard-valverde/github-act-cache-server
-//
-// TODO: Authorization
-// TODO: Restrictions for accessing a cache, see https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache
-// TODO: Force deleting cache entries, see https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#force-deleting-cache-entries
-package artifactcache

act/artifactcache/handler_v2.go

@@ -1,300 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"cmp"
-	"encoding/json/jsontext"
-	"encoding/json/v2"
-	"encoding/xml"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/julienschmidt/httprouter"
-)
-
-// The cache service v2 API. A client on this version talks twirp to
-// `github.actions.results.api.v1.CacheService` instead of the /_apis/artifactcache
-// endpoints, and uploads the archive to the returned URL with the Azure blob protocol.
-// Both API versions are served from the same store, so a repository keeps its cache
-// when a workflow moves between action versions.
-//
-// Responses carry the proto field names, which is what Gitea's own results API emits and the only
-// spelling the Go clients parse. The JavaScript toolkit accepts either.
-const (
-	cacheServiceV2Path = "/twirp/github.actions.results.api.v1.CacheService"
-
-	// blobPath authenticates by signature, because the client uploads without an
-	// Authorization header. Downloads are handed the v1 artifact URL instead.
-	blobPath = apiPath + "/blobs"
-
-	// blobUploadPurpose keeps an upload URL from being replayed to read an entry.
-	blobUploadPurpose = "upload:"
-
-	blobUploadURLTTL = time.Hour
-
-	// twirpInternal is the only error code that is not the client's fault.
-	twirpInternal = "internal"
-)
-
-func (h *Handler) registerV2Routes(router *httprouter.Router) {
-	router.POST(cacheServiceV2Path+"/CreateCacheEntry", h.bearerAuth(h.v2CreateCacheEntry))
-	router.POST(cacheServiceV2Path+"/FinalizeCacheEntryUpload", h.bearerAuth(h.v2FinalizeCacheEntryUpload))
-	router.POST(cacheServiceV2Path+"/GetCacheEntryDownloadURL", h.bearerAuth(h.v2GetCacheEntryDownloadURL))
-	router.PUT(blobPath+"/:id", h.signedAuth(blobUploadPurpose, h.v2UploadBlob))
-}
-
-// An entry that already exists is reported as not ok, which is how the client learns to skip
-// the upload.
-func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	cred := credFromContext(r.Context())
-	req, err := decodeTwirpRequest[v2CreateRequest](r)
-	if err != nil {
-		h.twirpError(w, r, "malformed_request", err)
-		return
-	}
-	if req.Key == "" || req.Version == "" {
-		h.twirpError(w, r, "invalid_argument", errors.New("key and version are required"))
-		return
-	}
-
-	db, err := h.openDB()
-	if err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	}
-	defer db.Close()
-
-	// An exact (key, version) match means the entry is already cached; the client then skips
-	// the upload. A prefix match must not count here, or a shorter key would be reported as
-	// existing and silently never saved.
-	if existing, err := findExactCache(db, cred.Repo, req.Key, req.Version, true); err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	} else if existing != nil {
-		h.touch(db, existing) // the client skips the upload, so this is the only sign the entry is still in use
-		h.twirpNotOK(w, r)
-		return
-	}
-
-	now := time.Now().Unix()
-	cache := &Cache{
-		Repo:      cred.Repo,
-		Key:       req.Key,
-		Version:   req.Version,
-		Size:      -1, // the size is only known at finalize time
-		CreatedAt: now,
-		UsedAt:    now,
-	}
-	if err := insertCache(db, cache); err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	}
-
-	h.responseJSON(w, r, http.StatusOK, map[string]any{
-		"ok":                true,
-		"signed_upload_url": h.signedURL(cred, blobPath, blobUploadPurpose, cache.ID, time.Now().Add(blobUploadURLTTL)),
-	})
-}
-
-func (h *Handler) v2FinalizeCacheEntryUpload(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	cred := credFromContext(r.Context())
-	req, err := decodeTwirpRequest[v2FinalizeRequest](r)
-	if err != nil {
-		h.twirpError(w, r, "malformed_request", err)
-		return
-	}
-
-	db, err := h.openDB()
-	if err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	}
-	defer db.Close()
-
-	cache, err := findExactCache(db, cred.Repo, req.Key, req.Version, false)
-	if err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	}
-	if cache == nil {
-		h.twirpNotOK(w, r)
-		return
-	}
-	db.Close() // commitCache needs the store closed
-
-	cache.Size = int64(cmp.Or(req.SizeBytes, req.SizeBytesCamel))
-	if err := h.commitCache(cache); err != nil {
-		h.logger.Errorf("finalize cache %d (%s): %v", cache.ID, cache.Key, err)
-		h.twirpNotOK(w, r)
-		return
-	}
-
-	h.responseJSON(w, r, http.StatusOK, map[string]any{
-		"ok": true,
-		// int64 fields travel as strings in the proto JSON mapping.
-		"entry_id": strconv.FormatUint(cache.ID, 10),
-	})
-}
-
-func (h *Handler) v2GetCacheEntryDownloadURL(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	cred := credFromContext(r.Context())
-	req, err := decodeTwirpRequest[v2DownloadRequest](r)
-	if err != nil {
-		h.twirpError(w, r, "malformed_request", err)
-		return
-	}
-
-	db, err := h.openDB()
-	if err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	}
-	defer db.Close()
-
-	cache, err := h.lookupCache(db, cred.Repo, req.keys(), req.Version)
-	if err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	}
-	if cache == nil {
-		h.twirpNotOK(w, r)
-		return
-	}
-
-	h.responseJSON(w, r, http.StatusOK, map[string]any{
-		"ok":                  true,
-		"signed_download_url": h.signedArtifactURL(cred, cache.ID, time.Now().Add(artifactURLTTL)),
-		"matched_key":         cache.Key,
-	})
-}
-
-// The archive arrives over the subset of the Azure blob API the toolkit uses: a small
-// cache is a single PUT, a large one is staged as blocks that a final block list puts
-// in order.
-func (h *Handler) v2UploadBlob(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
-	id, err := strconv.ParseUint(params.ByName("id"), 10, 64)
-	if err != nil {
-		h.responseJSON(w, r, http.StatusBadRequest, err)
-		return
-	}
-
-	if err := h.touchCache(id, true); err != nil {
-		h.responseJSON(w, r, http.StatusBadRequest, err)
-		return
-	}
-
-	query := r.URL.Query()
-	switch strings.ToLower(query.Get("comp")) {
-	case "block":
-		blockID := query.Get("blockid")
-		if blockID == "" {
-			h.responseJSON(w, r, http.StatusBadRequest, errors.New("missing blockid"))
-			return
-		}
-		err = h.storage.WriteBlock(id, blockID, r.Body)
-	case "blocklist":
-		var list struct{ Latest []string }
-		if err := xml.NewDecoder(io.LimitReader(r.Body, 8<<20)).Decode(&list); err != nil {
-			h.responseJSON(w, r, http.StatusBadRequest, fmt.Errorf("malformed block list: %w", err))
-			return
-		}
-		err = h.storage.OrderBlocks(id, list.Latest)
-	default:
-		err = h.storage.Write(id, 0, r.Body)
-	}
-	if err != nil {
-		h.responseJSON(w, r, http.StatusInternalServerError, err)
-		return
-	}
-
-	// The Azure SDK client dereferences this without checking, so its absence panics the caller.
-	w.Header().Set("x-ms-request-id", strconv.FormatInt(time.Now().UnixNano(), 10))
-	w.WriteHeader(http.StatusCreated)
-}
-
-// twirpNotOK is the negative answer all three endpoints share: no such entry to restore, no
-// reservation to finalize, or an entry that already exists and need not be uploaded again.
-func (h *Handler) twirpNotOK(w http.ResponseWriter, r *http.Request) {
-	h.responseJSON(w, r, http.StatusOK, map[string]any{"ok": false})
-}
-
-// twirpError reports in the shape a twirp client expects, so the toolkit surfaces the message
-// instead of a parse error.
-func (h *Handler) twirpError(w http.ResponseWriter, r *http.Request, code string, err error) {
-	h.logger.Debugf("%s %s: %v", r.Method, r.URL.Path, err)
-	status := http.StatusBadRequest
-	if code == twirpInternal {
-		status = http.StatusInternalServerError
-	}
-	h.responseJSON(w, r, status, map[string]any{"code": code, "msg": err.Error()})
-}
-
-// The twirp request bodies. The toolkit's client serialises with useProtoFieldName, so the proto
-// names are what arrive; the camelCase spellings of the same mapping are accepted too, as are
-// int64s sent as a bare number rather than the string the mapping prescribes.
-type (
-	v2CreateRequest struct {
-		Key     string `json:"key"`
-		Version string `json:"version"`
-	}
-
-	v2FinalizeRequest struct {
-		Key            string     `json:"key"`
-		Version        string     `json:"version"`
-		SizeBytes      twirpInt64 `json:"size_bytes"`
-		SizeBytesCamel twirpInt64 `json:"sizeBytes"`
-	}
-
-	v2DownloadRequest struct {
-		Key              string   `json:"key"`
-		Version          string   `json:"version"`
-		RestoreKeys      []string `json:"restore_keys"`
-		RestoreKeysCamel []string `json:"restoreKeys"`
-	}
-)
-
-// twirpInt64 accepts its value as the JSON string the mapping prescribes or as a bare number.
-type twirpInt64 int64
-
-func (n *twirpInt64) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
-	val, err := dec.ReadValue()
-	if err != nil {
-		return err
-	}
-	digits := []byte(val)
-	switch val.Kind() {
-	case 'n': // absent, keep the zero value
-		return nil
-	case '"':
-		if digits, err = jsontext.AppendUnquote(nil, val); err != nil {
-			return err
-		}
-	}
-	parsed, err := strconv.ParseInt(string(digits), 10, 64)
-	if err != nil {
-		return err
-	}
-	*n = twirpInt64(parsed)
-	return nil
-}
-
-func (d v2DownloadRequest) keys() []string {
-	restoreKeys := d.RestoreKeys
-	if len(restoreKeys) == 0 {
-		restoreKeys = d.RestoreKeysCamel
-	}
-	return append([]string{d.Key}, restoreKeys...)
-}
-
-func decodeTwirpRequest[T any](r *http.Request) (T, error) {
-	var req T
-	err := json.UnmarshalRead(io.LimitReader(r.Body, 1<<20), &req)
-	return req, err
-}

act/artifactcache/handler_v2_test.go

@@ -1,243 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"bytes"
-	"encoding/base64"
-	"encoding/json/v2"
-	"fmt"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// v2Call posts a twirp request to the cache service and returns the decoded response.
-// Field names are the proto ones, which is what the toolkit's client sends.
-func v2Call(t *testing.T, handler *Handler, client *http.Client, method string, request any) map[string]any {
-	t.Helper()
-
-	body, err := json.Marshal(request)
-	require.NoError(t, err)
-
-	resp, err := client.Post(handler.ExternalURL()+cacheServiceV2Path+"/"+method, "application/json", bytes.NewReader(body))
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode)
-
-	got := map[string]any{}
-	require.NoError(t, json.UnmarshalRead(resp.Body, &got))
-	return got
-}
-
-// putBlob uploads to a signed URL and returns the status, so a test can assert a refusal.
-func putBlob(t *testing.T, url string, content []byte) int {
-	t.Helper()
-
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodPut, url, bytes.NewReader(content))
-	require.NoError(t, err)
-	resp, err := http.DefaultClient.Do(req)
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	if resp.StatusCode == http.StatusCreated {
-		// The Azure SDK client dereferences this header without checking, so a blob upload that
-		// omits it panics the caller rather than failing it.
-		require.NotEmpty(t, resp.Header.Get("x-ms-request-id"))
-	}
-	return resp.StatusCode
-}
-
-func getURL(t *testing.T, url string) []byte {
-	t.Helper()
-
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url, nil)
-	require.NoError(t, err)
-	resp, err := http.DefaultClient.Do(req)
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-	return body
-}
-
-// saveV2 runs the reserve/upload/finalize sequence and returns the finalize response along
-// with the upload URL it used.
-func saveV2(t *testing.T, handler *Handler, key, version string, content []byte) (finalized map[string]any, uploadURL string) {
-	t.Helper()
-
-	created := v2Call(t, handler, testClient, "CreateCacheEntry", map[string]any{"key": key, "version": version})
-	require.Equal(t, true, created["ok"])
-	uploadURL, _ = created["signed_upload_url"].(string)
-	require.NotEmpty(t, uploadURL)
-	require.Equal(t, http.StatusCreated, putBlob(t, uploadURL, content))
-
-	return v2Call(t, handler, testClient, "FinalizeCacheEntryUpload", map[string]any{
-		"key": key, "version": version,
-		"size_bytes": strconv.Itoa(len(content)),
-	}), uploadURL
-}
-
-// The whole round trip an actions/cache v2 client makes, plus the guarantees on the signed
-// URLs it is handed: unsigned requests are refused, an upload URL cannot be replayed to read
-// or to replace a finalized entry.
-func TestCacheServiceV2RoundTrip(t *testing.T) {
-	handler := newTestHandler(t, Policy{})
-	content := []byte("the cached archive")
-
-	unsigned := fmt.Sprintf("%s%s/1", handler.ExternalURL(), blobPath)
-	assert.Equal(t, http.StatusUnauthorized, putBlob(t, unsigned, content))
-
-	finalized, uploadURL := saveV2(t, handler, "deps-v1", "abc123", content)
-	require.Equal(t, true, finalized["ok"])
-	assert.NotEmpty(t, finalized["entry_id"])
-
-	// The upload URL outlives the finalize call, so replaying it must not poison the entry,
-	// and it is an upload URL only: nothing reads a blob back through it.
-	assert.Equal(t, http.StatusBadRequest, putBlob(t, uploadURL, []byte("poisoned")))
-	resp, err := http.Get(uploadURL) //nolint:noctx // the URL is the server under test
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode)
-
-	got := v2Call(t, handler, testClient, "GetCacheEntryDownloadURL", map[string]any{"key": "deps-v1", "version": "abc123"})
-	require.Equal(t, true, got["ok"])
-	assert.Equal(t, "deps-v1", got["matched_key"])
-	downloadURL, _ := got["signed_download_url"].(string)
-	require.NotEmpty(t, downloadURL)
-	assert.Equal(t, content, getURL(t, downloadURL))
-}
-
-// A large archive is staged as blocks and only put in order by the final block list, so
-// blocks that arrive out of order must still be assembled the way the client asked.
-func TestCacheServiceV2BlockUpload(t *testing.T) {
-	handler := newTestHandler(t, Policy{})
-
-	created := v2Call(t, handler, testClient, "CreateCacheEntry", map[string]any{"key": "blocks", "version": "v1"})
-	uploadURL, _ := created["signed_upload_url"].(string)
-	require.NotEmpty(t, uploadURL)
-
-	blocks := map[string][]byte{}
-	var order []string
-	for i, part := range []string{"hello ", "world", "!"} {
-		blockID := base64.StdEncoding.EncodeToString(fmt.Appendf(nil, "block-%d", i))
-		blocks[blockID] = []byte(part)
-		order = append(order, blockID)
-	}
-	// Upload in an order that is not the block list order.
-	for _, blockID := range []string{order[2], order[0], order[1]} {
-		require.Equal(t, http.StatusCreated, putBlob(t, uploadURL+"&comp=block&blockid="+blockID, blocks[blockID]))
-	}
-
-	var list bytes.Buffer
-	list.WriteString(`<?xml version="1.0" encoding="utf-8"?><BlockList>`)
-	for _, blockID := range order {
-		fmt.Fprintf(&list, "<Latest>%s</Latest>", blockID)
-	}
-	list.WriteString(`</BlockList>`)
-	require.Equal(t, http.StatusCreated, putBlob(t, uploadURL+"&comp=blocklist", list.Bytes()))
-
-	finalized := v2Call(t, handler, testClient, "FinalizeCacheEntryUpload", map[string]any{
-		"key": "blocks", "version": "v1", "size_bytes": len("hello world!"),
-	})
-	require.Equal(t, true, finalized["ok"])
-
-	got := v2Call(t, handler, testClient, "GetCacheEntryDownloadURL", map[string]any{"key": "blocks", "version": "v1"})
-	require.Equal(t, true, got["ok"])
-	assert.Equal(t, "hello world!", string(getURL(t, got["signed_download_url"].(string))))
-}
-
-func TestCacheServiceV2Lookups(t *testing.T) {
-	handler := newTestHandler(t, Policy{})
-	saved, _ := saveV2(t, handler, "deps-abc", "v1", []byte("x"))
-	require.Equal(t, true, saved["ok"])
-
-	t.Run("reports a miss for an unknown key", func(t *testing.T) {
-		got := v2Call(t, handler, testClient, "GetCacheEntryDownloadURL", map[string]any{"key": "nothing", "version": "v1"})
-		assert.Equal(t, false, got["ok"])
-	})
-
-	// The toolkit serialises with the proto field names; the camelCase spellings of the same
-	// proto JSON mapping are accepted alongside them.
-	for _, field := range []string{"restore_keys", "restoreKeys"} {
-		t.Run("restore keys match by prefix, spelled "+field, func(t *testing.T) {
-			got := v2Call(t, handler, testClient, "GetCacheEntryDownloadURL", map[string]any{
-				"key": "deps-zzz", field: []string{"deps-"}, "version": "v1",
-			})
-			require.Equal(t, true, got["ok"])
-			assert.Equal(t, "deps-abc", got["matched_key"])
-		})
-	}
-
-	t.Run("an existing entry is not reserved twice", func(t *testing.T) {
-		again := v2Call(t, handler, testClient, "CreateCacheEntry", map[string]any{"key": "deps-abc", "version": "v1"})
-		assert.Equal(t, false, again["ok"])
-	})
-
-	// A key that is only a prefix of an existing one is a different entry, so the
-	// reservation check must be exact and not a restore-key prefix match, or the shorter
-	// key would be reported as existing and silently never saved.
-	t.Run("a prefix of an existing key is still reserved", func(t *testing.T) {
-		reserved := v2Call(t, handler, testClient, "CreateCacheEntry", map[string]any{"key": "deps", "version": "v1"})
-		require.Equal(t, true, reserved["ok"])
-		assert.NotEmpty(t, reserved["signed_upload_url"])
-	})
-
-	t.Run("a proxied job is handed the address its runner registered", func(t *testing.T) {
-		const proxy = "https://cache.example.invalid"
-		handler.RegisterJob("proxied", JobCredential{Repo: testRepo, PublicURL: proxy + "/"})
-		client := &http.Client{Transport: &bearerTransport{token: "proxied"}}
-
-		created := v2Call(t, handler, client, "CreateCacheEntry", map[string]any{"key": "proxied-key", "version": "v1"})
-		assert.True(t, strings.HasPrefix(created["signed_upload_url"].(string), proxy+blobPath+"/"))
-
-		got := v2Call(t, handler, client, "GetCacheEntryDownloadURL", map[string]any{"key": "deps-abc", "version": "v1"})
-		assert.True(t, strings.HasPrefix(got["signed_download_url"].(string), proxy+apiPath+"/artifacts/"))
-	})
-
-	t.Run("finalizing without a reservation is not ok", func(t *testing.T) {
-		got := v2Call(t, handler, testClient, "FinalizeCacheEntryUpload", map[string]any{
-			"key": "never-reserved", "version": "v1", "size_bytes": 1,
-		})
-		assert.Equal(t, false, got["ok"])
-	})
-
-	// The size the client declares is what Commit validates the assembled archive against.
-	t.Run("finalizing with the wrong size is not ok", func(t *testing.T) {
-		created := v2Call(t, handler, testClient, "CreateCacheEntry", map[string]any{"key": "wrong-size", "version": "v1"})
-		require.Equal(t, http.StatusCreated, putBlob(t, created["signed_upload_url"].(string), []byte("four")))
-
-		got := v2Call(t, handler, testClient, "FinalizeCacheEntryUpload", map[string]any{
-			"key": "wrong-size", "version": "v1", "size_bytes": 99,
-		})
-		assert.Equal(t, false, got["ok"])
-	})
-
-	// Both API versions are served from one store, so an entry written through v2 is a hit for
-	// a v1 client asking for the same key and version.
-	t.Run("a v1 client sees an entry written through v2", func(t *testing.T) {
-		resp, err := testClient.Get(fmt.Sprintf("%s%s/cache?keys=deps-abc&version=v1", handler.ExternalURL(), apiPath))
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		require.Equal(t, http.StatusOK, resp.StatusCode)
-
-		got := map[string]any{}
-		require.NoError(t, json.UnmarshalRead(resp.Body, &got))
-		assert.Equal(t, "deps-abc", got["cacheKey"])
-		assert.NotEmpty(t, got["archiveLocation"])
-	})
-
-	// The cache of one repository must stay invisible to another, as it does for the v1 API.
-	t.Run("another repository sees nothing", func(t *testing.T) {
-		handler.RegisterJob("other-runtime-token", JobCredential{Repo: "other/repo"})
-		otherClient := &http.Client{Transport: &bearerTransport{token: "other-runtime-token"}}
-
-		got := v2Call(t, handler, otherClient, "GetCacheEntryDownloadURL", map[string]any{"key": "deps-abc", "version": "v1"})
-		assert.Equal(t, false, got["ok"])
-	})
-}

act/artifactcache/model.go

@@ -1,22 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-type Request struct {
-	Key     string `json:"key" `
-	Version string `json:"version"`
-	Size    int64  `json:"cacheSize"`
-}
-
-type Cache struct {
-	ID        uint64 `json:"id" boltholdKey:"ID"`
-	Repo      string `json:"repo" boltholdIndex:"Repo"`
-	Key       string `json:"key" boltholdIndex:"Key"`
-	Version   string `json:"version" boltholdIndex:"Version"`
-	Size      int64  `json:"cacheSize"`
-	Complete  bool   `json:"complete" boltholdIndex:"Complete"`
-	UsedAt    int64  `json:"usedAt" boltholdIndex:"UsedAt"`
-	CreatedAt int64  `json:"createdAt" boltholdIndex:"CreatedAt"`
-}

act/artifactcache/results.go

@@ -1,59 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"crypto/tls"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"strings"
-)
-
-// The results service is one origin serving every github.actions.results.api.v1 service, and
-// Gitea implements only the artifact half of it. Forwarding that half from here makes this origin
-// the whole service, so ACTIONS_RESULTS_URL can point at it truthfully, which is what the clients
-// this runner cannot patch need, docker buildx among them.
-//
-// The instance to forward to travels with the job registration rather than with configuration, so
-// a cache server shared between runners serves each of their instances.
-const artifactServicePath = "/twirp/github.actions.results.api.v1.ArtifactService/"
-
-// forwardOrNotFound is the router's fallback: the artifact service of the instance the job
-// registered with, and the 404 the router would have written otherwise.
-func (h *Handler) forwardOrNotFound(w http.ResponseWriter, r *http.Request) {
-	cred, ok := h.lookupCredential(bearerToken(r))
-	if !ok || cred.Results == "" || !strings.HasPrefix(r.URL.Path, artifactServicePath) {
-		http.NotFound(w, r)
-		return
-	}
-	target, err := url.Parse(strings.TrimSuffix(cred.Results, "/"))
-	if err != nil {
-		h.logger.Errorf("artifact service forward to %q: %v", cred.Results, err)
-		w.WriteHeader(http.StatusBadGateway)
-		return
-	}
-	h.logger.Debugf("%s %s: forwarding to %s", r.Method, r.URL.Path, target)
-
-	proxy := &httputil.ReverseProxy{
-		Rewrite: func(r *httputil.ProxyRequest) {
-			r.SetURL(target)
-			// Gitea builds the URLs it hands back from this Host, and their scheme from the
-			// connection unless a forwarded header overrides it, so artifact bodies go to Gitea
-			// directly and never through here.
-			r.Out.Host = target.Host
-		},
-		ErrorHandler: func(w http.ResponseWriter, _ *http.Request, err error) {
-			h.logger.Warnf("artifact service forward to %s: %v", target, err)
-			w.WriteHeader(http.StatusBadGateway)
-		},
-	}
-	if cred.InsecureTLS {
-		proxy.Transport = insecureTransport
-	}
-	proxy.ServeHTTP(w, r)
-}
-
-// insecureTransport is shared, because a transport per request would pool no connections.
-var insecureTransport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // the runner reaches its instance on the operator's say-so

act/artifactcache/results_test.go

@@ -1,56 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The artifact half is forwarded under the Host Gitea knows itself by, so the URLs it hands back
-// still point at Gitea, and nothing else is proxied.
-func TestFrontResultsService(t *testing.T) {
-	var gotHost, gotPath, gotProto string
-	gitea := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotHost, gotPath, gotProto = r.Host, r.URL.Path, r.Header.Get("X-Forwarded-Proto")
-		_, _ = io.WriteString(w, `{"ok":true}`)
-	}))
-	defer gitea.Close()
-
-	handler, err := StartHandler(Options{Dir: t.TempDir(), OutboundIP: "127.0.0.1"})
-	require.NoError(t, err)
-	defer handler.Close()
-	const token = "forward-token"
-
-	client := &http.Client{Transport: &bearerTransport{token: token}}
-	post := func(path string) int {
-		req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, handler.ExternalURL()+path, nil)
-		require.NoError(t, err)
-		resp, err := client.Do(req)
-		require.NoError(t, err)
-		resp.Body.Close()
-		return resp.StatusCode
-	}
-
-	assert.Equal(t, http.StatusNotFound, post(artifactServicePath+"CreateArtifact"),
-		"an unregistered token is forwarded nowhere")
-
-	defer handler.RegisterJob(token, JobCredential{Repo: "owner/repo", Results: gitea.URL})()
-
-	assert.Equal(t, http.StatusOK, post(artifactServicePath+"CreateArtifact"))
-	assert.Equal(t, strings.TrimPrefix(gitea.URL, "http://"), gotHost, "Gitea must see the host it mints its URLs from")
-	assert.Empty(t, gotProto, "a forwarded scheme would make an https Gitea mint http URLs")
-	assert.Equal(t, artifactServicePath+"CreateArtifact", gotPath)
-
-	gotPath = ""
-	assert.Equal(t, http.StatusNotFound, post("/twirp/github.actions.results.api.v1.OtherService/Do"))
-	assert.Equal(t, http.StatusNotFound, post("/api/v1/repos/owner/repo"))
-	assert.Empty(t, gotPath, "only the artifact service is forwarded")
-}

act/artifactcache/storage.go

@@ -1,191 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-)
-
-type Storage struct {
-	rootDir string
-}
-
-func NewStorage(rootDir string) (*Storage, error) {
-	if err := os.MkdirAll(rootDir, 0o755); err != nil {
-		return nil, err
-	}
-	return &Storage{
-		rootDir: rootDir,
-	}, nil
-}
-
-func (s *Storage) Exist(id uint64) (bool, error) {
-	name := s.filename(id)
-	if _, err := os.Stat(name); os.IsNotExist(err) {
-		return false, nil
-	} else if err != nil {
-		return false, err
-	}
-	return true, nil
-}
-
-func (s *Storage) Write(id uint64, offset int64, reader io.Reader) error {
-	return s.writeFile(s.tempName(id, offset), reader)
-}
-
-func (s *Storage) writeFile(name string, reader io.Reader) error {
-	if err := os.MkdirAll(filepath.Dir(name), 0o755); err != nil {
-		return err
-	}
-	file, err := os.Create(name)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-
-	_, err = io.Copy(file, reader)
-	return err
-}
-
-func (s *Storage) WriteBlock(id uint64, blockID string, reader io.Reader) error {
-	return s.writeFile(s.blockName(id, blockID), reader)
-}
-
-// OrderBlocks renames the staged blocks into the order the block list gives. A block the list
-// does not name keeps its staged name, which is how Commit leaves it out, as Azure drops it. One
-// rename pass is safe because a staged name always carries blockFilePrefix and a target name
-// never does, so no rename can collide with a block not yet moved.
-func (s *Storage) OrderBlocks(id uint64, blockIDs []string) error {
-	for i, blockID := range blockIDs {
-		if err := os.Rename(s.blockName(id, blockID), s.tempName(id, int64(i))); err != nil {
-			if os.IsNotExist(err) {
-				return fmt.Errorf("block %q of cache %d was never uploaded: %w", blockID, id, err)
-			}
-			return err
-		}
-	}
-	return nil
-}
-
-func (s *Storage) Commit(id uint64, size int64) (int64, error) {
-	defer func() {
-		_ = os.RemoveAll(s.tempDir(id))
-	}()
-
-	name := s.filename(id)
-	tempNames, err := s.tempNames(id)
-	if err != nil {
-		return 0, err
-	}
-
-	if err := os.MkdirAll(filepath.Dir(name), 0o755); err != nil {
-		return 0, err
-	}
-	written, err := assemble(name, tempNames)
-	if err != nil {
-		return 0, err
-	}
-	// If size is less than 0, it means the size is unknown.
-	// We can't check the size of the file, just skip the check.
-	// It happens when the request comes from old versions of actions, like `actions/cache@v2`.
-	if size >= 0 && written != size {
-		_ = os.Remove(name)
-		return 0, fmt.Errorf("broken file: %v != %v", written, size)
-	}
-	return written, nil
-}
-
-// assemble concatenates the uploaded parts into name. A single part, which is what the v2 API
-// produces below the client's block threshold, is already the whole archive and is moved.
-func assemble(name string, tempNames []string) (int64, error) {
-	if len(tempNames) == 1 {
-		info, err := os.Stat(tempNames[0])
-		if err != nil {
-			return 0, err
-		}
-		return info.Size(), os.Rename(tempNames[0], name)
-	}
-
-	file, err := os.Create(name)
-	if err != nil {
-		return 0, err
-	}
-	defer file.Close()
-
-	var written int64
-	for _, v := range tempNames {
-		f, err := os.Open(v)
-		if err != nil {
-			return 0, err
-		}
-		n, err := io.Copy(file, f)
-		_ = f.Close()
-		if err != nil {
-			return 0, err
-		}
-		written += n
-	}
-	return written, nil
-}
-
-func (s *Storage) Serve(w http.ResponseWriter, r *http.Request, id uint64) {
-	name := s.filename(id)
-	http.ServeFile(w, r, name)
-}
-
-// Remove deletes an entry's blob and any staged parts. It reports failure so the caller can
-// keep the entry and retry, rather than dropping the only reference to bytes on disk.
-func (s *Storage) Remove(id uint64) error {
-	if err := os.Remove(s.filename(id)); err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	return os.RemoveAll(s.tempDir(id))
-}
-
-func (s *Storage) filename(id uint64) string {
-	return filepath.Join(s.rootDir, fmt.Sprintf("%02x", id%0xff), strconv.FormatUint(id, 10))
-}
-
-func (s *Storage) tempDir(id uint64) string {
-	return filepath.Join(s.rootDir, "tmp", strconv.FormatUint(id, 10))
-}
-
-func (s *Storage) tempName(id uint64, offset int64) string {
-	return filepath.Join(s.tempDir(id), fmt.Sprintf("%016x", offset))
-}
-
-// blockFilePrefix marks a staged, not yet ordered block, so that tempNames can keep it out of
-// Commit's name-ordered concatenation.
-const blockFilePrefix = "block-"
-
-func (s *Storage) blockName(id uint64, blockID string) string {
-	// The block id is client-chosen (base64), so it is hashed rather than trusted as a
-	// path element.
-	sum := sha256.Sum256([]byte(blockID))
-	return filepath.Join(s.tempDir(id), blockFilePrefix+hex.EncodeToString(sum[:]))
-}
-
-func (s *Storage) tempNames(id uint64) ([]string, error) {
-	dir := s.tempDir(id)
-	files, err := os.ReadDir(dir)
-	if err != nil {
-		return nil, err
-	}
-	var names []string
-	for _, v := range files {
-		if !v.IsDir() && !strings.HasPrefix(v.Name(), blockFilePrefix) {
-			names = append(names, filepath.Join(dir, v.Name()))
-		}
-	}
-	return names, nil
-}

act/artifacts/server.go

@@ -1,247 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifacts
-
-import (
-	"context"
-	"encoding/json/v2"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/julienschmidt/httprouter"
-)
-
-type FileContainerResourceURL struct {
-	FileContainerResourceURL string `json:"fileContainerResourceUrl"`
-}
-
-type NamedFileContainerResourceURL struct {
-	Name                     string `json:"name"`
-	FileContainerResourceURL string `json:"fileContainerResourceUrl"`
-}
-
-type NamedFileContainerResourceURLResponse struct {
-	Count int                             `json:"count"`
-	Value []NamedFileContainerResourceURL `json:"value"`
-}
-
-type ContainerItem struct {
-	Path            string `json:"path"`
-	ItemType        string `json:"itemType"`
-	ContentLocation string `json:"contentLocation"`
-}
-
-type ContainerItemResponse struct {
-	Value []ContainerItem `json:"value"`
-}
-
-type ResponseMessage struct {
-	Message string `json:"message"`
-}
-
-var gzipExtension = ".gz__"
-
-func safeResolve(baseDir, relPath string) string {
-	return filepath.Join(baseDir, filepath.Clean(filepath.Join(string(os.PathSeparator), relPath)))
-}
-
-func writeJSON(w http.ResponseWriter, value any) {
-	data, err := json.Marshal(value)
-	if err != nil {
-		panic(err)
-	}
-	if _, err := w.Write(data); err != nil {
-		panic(err)
-	}
-}
-
-func uploads(router *httprouter.Router, baseDir string) {
-	router.POST("/_apis/pipelines/workflows/:runId/artifacts", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		runID := params.ByName("runId")
-
-		writeJSON(w, FileContainerResourceURL{
-			FileContainerResourceURL: fmt.Sprintf("http://%s/upload/%s", req.Host, runID),
-		})
-	})
-
-	router.PUT("/upload/:runId", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		itemPath := req.URL.Query().Get("itemPath")
-		runID := params.ByName("runId")
-
-		if req.Header.Get("Content-Encoding") == "gzip" {
-			itemPath += gzipExtension
-		}
-
-		safeRunPath := safeResolve(baseDir, runID)
-		safePath := safeResolve(safeRunPath, itemPath)
-
-		if err := os.MkdirAll(filepath.Dir(safePath), os.ModePerm); err != nil {
-			panic(err)
-		}
-		flags := os.O_CREATE | os.O_WRONLY | os.O_TRUNC
-		appendUpload := req.Header.Get("Content-Range")
-		if appendUpload != "" && !strings.HasPrefix(appendUpload, "bytes 0-") {
-			flags = os.O_CREATE | os.O_WRONLY | os.O_APPEND
-		}
-		file, err := os.OpenFile(safePath, flags, 0o644)
-		if err != nil {
-			panic(err)
-		}
-		defer file.Close()
-		if req.Body == nil {
-			panic(errors.New("no body given"))
-		}
-
-		_, err = io.Copy(file, req.Body)
-		if err != nil {
-			panic(err)
-		}
-
-		writeJSON(w, ResponseMessage{
-			Message: "success",
-		})
-	})
-
-	router.PATCH("/_apis/pipelines/workflows/:runId/artifacts", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		writeJSON(w, ResponseMessage{
-			Message: "success",
-		})
-	})
-}
-
-func downloads(router *httprouter.Router, baseDir string) {
-	router.GET("/_apis/pipelines/workflows/:runId/artifacts", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		runID := params.ByName("runId")
-
-		safePath := safeResolve(baseDir, runID)
-
-		entries, err := os.ReadDir(safePath)
-		if err != nil {
-			panic(err)
-		}
-
-		var list []NamedFileContainerResourceURL
-		for _, entry := range entries {
-			list = append(list, NamedFileContainerResourceURL{
-				Name:                     entry.Name(),
-				FileContainerResourceURL: fmt.Sprintf("http://%s/download/%s", req.Host, runID),
-			})
-		}
-
-		writeJSON(w, NamedFileContainerResourceURLResponse{
-			Count: len(list),
-			Value: list,
-		})
-	})
-
-	router.GET("/download/:container", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		container := params.ByName("container")
-		itemPath := req.URL.Query().Get("itemPath")
-		safePath := safeResolve(baseDir, filepath.Join(container, itemPath))
-
-		var files []ContainerItem
-		err := filepath.WalkDir(safePath, func(path string, entry fs.DirEntry, err error) error {
-			if !entry.IsDir() {
-				rel, err := filepath.Rel(safePath, path)
-				if err != nil {
-					panic(err)
-				}
-
-				// if it was upload as gzip
-				rel = strings.TrimSuffix(rel, gzipExtension)
-				path := filepath.Join(itemPath, rel)
-
-				rel = filepath.ToSlash(rel)
-				path = filepath.ToSlash(path)
-
-				files = append(files, ContainerItem{
-					Path:            path,
-					ItemType:        "file",
-					ContentLocation: fmt.Sprintf("http://%s/artifact/%s/%s/%s", req.Host, container, itemPath, rel),
-				})
-			}
-			return nil
-		})
-		if err != nil {
-			panic(err)
-		}
-
-		writeJSON(w, ContainerItemResponse{
-			Value: files,
-		})
-	})
-
-	router.GET("/artifact/*path", func(w http.ResponseWriter, req *http.Request, params httprouter.Params) {
-		path := params.ByName("path")[1:]
-
-		safePath := safeResolve(baseDir, path)
-
-		file, err := os.Open(safePath)
-		if err != nil {
-			// try gzip file
-			file, err = os.Open(safePath + gzipExtension)
-			if err != nil {
-				panic(err)
-			}
-			w.Header().Add("Content-Encoding", "gzip")
-		}
-		defer file.Close()
-
-		_, err = io.Copy(w, file)
-		if err != nil {
-			panic(err)
-		}
-	})
-}
-
-func Serve(ctx context.Context, artifactPath, addr, port string) context.CancelFunc {
-	serverContext, cancel := context.WithCancel(ctx)
-	logger := common.Logger(serverContext)
-
-	if artifactPath == "" {
-		return cancel
-	}
-
-	router := httprouter.New()
-
-	logger.Debugf("Artifacts base path '%s'", artifactPath)
-	uploads(router, artifactPath)
-	downloads(router, artifactPath)
-
-	server := &http.Server{
-		Addr:              fmt.Sprintf("%s:%s", addr, port),
-		ReadHeaderTimeout: 2 * time.Second,
-		Handler:           router,
-	}
-
-	// run server
-	go func() {
-		logger.Infof("Start server on http://%s:%s", addr, port)
-		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-			logger.Fatal(err)
-		}
-	}()
-
-	// wait for cancel to gracefully shutdown server
-	go func() {
-		<-serverContext.Done()
-
-		if err := server.Shutdown(ctx); err != nil {
-			logger.Errorf("Failed shutdown gracefully - force shutdown: %v", err)
-			server.Close()
-		}
-	}()
-
-	return cancel
-}

act/artifacts/server_test.go

@@ -1,189 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifacts
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/json/v2"
-	"io"
-	"maps"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/julienschmidt/httprouter"
-	"github.com/stretchr/testify/require"
-)
-
-func TestArtifactFlow(t *testing.T) {
-	artifactPath := t.TempDir()
-
-	router := httprouter.New()
-	uploads(router, artifactPath)
-	downloads(router, artifactPath)
-	server := httptest.NewServer(router)
-	defer server.Close()
-
-	baseURL := server.URL
-	client := server.Client()
-	client.Timeout = 5 * time.Second
-
-	request := func(t *testing.T, method, rawURL string, body io.Reader, header http.Header) (int, []byte) {
-		t.Helper()
-		req, err := http.NewRequest(method, rawURL, body)
-		require.NoError(t, err)
-		maps.Copy(req.Header, header)
-		resp, err := client.Do(req)
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		data, err := io.ReadAll(resp.Body)
-		require.NoError(t, err)
-		return resp.StatusCode, data
-	}
-
-	t.Run("upload-and-download", func(t *testing.T) {
-		const runID, item, content = "1", "my-artifact/data.txt", "hello artifact\n"
-
-		status, data := request(t, http.MethodPost, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var prep FileContainerResourceURL
-		require.NoError(t, json.Unmarshal(data, &prep))
-		require.Equal(t, baseURL+"/upload/"+runID, prep.FileContainerResourceURL)
-
-		status, data = request(t, http.MethodPut, prep.FileContainerResourceURL+"?itemPath="+url.QueryEscape(item), strings.NewReader(content), nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var msg ResponseMessage
-		require.NoError(t, json.Unmarshal(data, &msg))
-		require.Equal(t, "success", msg.Message)
-
-		status, data = request(t, http.MethodPatch, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		require.NoError(t, json.Unmarshal(data, &msg))
-		require.Equal(t, "success", msg.Message)
-
-		status, data = request(t, http.MethodGet, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var list NamedFileContainerResourceURLResponse
-		require.NoError(t, json.Unmarshal(data, &list))
-		require.Equal(t, 1, list.Count)
-		require.Equal(t, "my-artifact", list.Value[0].Name)
-
-		status, data = request(t, http.MethodGet, list.Value[0].FileContainerResourceURL+"?itemPath=my-artifact", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var items ContainerItemResponse
-		require.NoError(t, json.Unmarshal(data, &items))
-		require.Len(t, items.Value, 1)
-		require.Equal(t, "file", items.Value[0].ItemType)
-		require.Equal(t, "my-artifact/data.txt", items.Value[0].Path)
-
-		status, data = request(t, http.MethodGet, items.Value[0].ContentLocation, nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
-
-		stored, err := os.ReadFile(filepath.Join(artifactPath, runID, "my-artifact", "data.txt"))
-		require.NoError(t, err)
-		require.Equal(t, content, string(stored))
-	})
-
-	t.Run("content-range", func(t *testing.T) {
-		const rawURL = "/upload/4?itemPath=chunks.txt"
-		status, data := request(t, http.MethodPut, baseURL+rawURL, strings.NewReader("first"),
-			http.Header{"Content-Range": []string{"bytes 0-4/11"}})
-		require.Equal(t, http.StatusOK, status, string(data))
-
-		status, data = request(t, http.MethodPut, baseURL+rawURL, strings.NewReader("-second"),
-			http.Header{"Content-Range": []string{"bytes 5-11/11"}})
-		require.Equal(t, http.StatusOK, status, string(data))
-
-		stored, err := os.ReadFile(filepath.Join(artifactPath, "4", "chunks.txt"))
-		require.NoError(t, err)
-		require.Equal(t, "first-second", string(stored))
-	})
-
-	t.Run("gzip-roundtrip", func(t *testing.T) {
-		const runID, item, content = "2", "logs/app.log", "compressed payload\n"
-
-		var buf bytes.Buffer
-		gz := gzip.NewWriter(&buf)
-		_, err := gz.Write([]byte(content))
-		require.NoError(t, err)
-		require.NoError(t, gz.Close())
-
-		status, data := request(t, http.MethodPut, baseURL+"/upload/"+runID+"?itemPath="+url.QueryEscape(item),
-			&buf, http.Header{"Content-Encoding": []string{"gzip"}})
-		require.Equal(t, http.StatusOK, status, string(data))
-
-		// stored compressed, with the server's gzip marker suffix
-		_, err = os.Stat(filepath.Join(artifactPath, runID, "logs", "app.log.gz__"))
-		require.NoError(t, err)
-
-		status, data = request(t, http.MethodGet, baseURL+"/download/"+runID+"?itemPath=logs", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var items ContainerItemResponse
-		require.NoError(t, json.Unmarshal(data, &items))
-		require.Len(t, items.Value, 1)
-		require.Equal(t, "logs/app.log", items.Value[0].Path)
-
-		status, data = request(t, http.MethodGet, items.Value[0].ContentLocation, nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
-	})
-
-	// GHSL-2023-004: an itemPath that climbs out of the run directory must be neutralised so the
-	// blob cannot be written outside the artifact root.
-	t.Run("GHSL-2023-004", func(t *testing.T) {
-		const runID, content = "3", "contained\n"
-
-		status, data := request(t, http.MethodPut, baseURL+"/upload/"+runID+"?itemPath="+url.QueryEscape("../../escape.txt"),
-			strings.NewReader(content), nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-
-		stored, err := os.ReadFile(filepath.Join(artifactPath, runID, "escape.txt"))
-		require.NoError(t, err)
-		require.Equal(t, content, string(stored))
-
-		_, err = os.Stat(filepath.Join(filepath.Dir(artifactPath), "escape.txt"))
-		require.True(t, os.IsNotExist(err), "upload escaped the artifact root")
-
-		status, data = request(t, http.MethodGet, baseURL+"/artifact/"+runID+"/escape.txt", nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
-	})
-}
-
-func TestSafeResolve(t *testing.T) {
-	baseDir := "/foo/bar"
-
-	tests := map[string]struct {
-		input string
-		want  string
-	}{
-		"simple":         {input: "baz", want: "/foo/bar/baz"},
-		"nested":         {input: "baz/blue", want: "/foo/bar/baz/blue"},
-		"dots in middle": {input: "baz/../../blue", want: "/foo/bar/blue"},
-		"leading dots":   {input: "../../parent", want: "/foo/bar/parent"},
-		"root path":      {input: "/root", want: "/foo/bar/root"},
-		"root":           {input: "/", want: "/foo/bar"},
-		"empty":          {input: "", want: "/foo/bar"},
-	}
-
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			require.Equal(t, tc.want, safeResolve(baseDir, tc.input))
-		})
-	}
-}
-
-func TestServeEmptyArtifactPathReturnsCancelableNoop(t *testing.T) {
-	cancel := Serve(t.Context(), "", "127.0.0.1", "0")
-	require.NotNil(t, cancel)
-	cancel()
-}

act/common/context_helpers_test.go

@@ -1,73 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-)
-
-func TestDryrunContext(t *testing.T) {
-	ctx := context.Background()
-	if Dryrun(ctx) {
-		t.Fatal("plain context should not be dryrun")
-	}
-	if !Dryrun(WithDryrun(ctx, true)) {
-		t.Fatal("WithDryrun(true) should set dryrun")
-	}
-	if Dryrun(WithDryrun(ctx, false)) {
-		t.Fatal("WithDryrun(false) should clear dryrun")
-	}
-}
-
-func TestJobErrorContainer(t *testing.T) {
-	ctx := context.Background()
-	err := errors.New("job failed")
-
-	SetJobError(ctx, err)
-	if got := JobError(ctx); got != nil {
-		t.Fatalf("JobError without container = %v, want nil", got)
-	}
-
-	ctx = WithJobErrorContainer(ctx)
-	SetJobError(ctx, err)
-	if got := JobError(ctx); !errors.Is(got, err) {
-		t.Fatalf("JobError = %v, want %v", got, err)
-	}
-}
-
-func TestLoggerAndHookContext(t *testing.T) {
-	ctx := context.Background()
-	if Logger(ctx) != logrus.StandardLogger() {
-		t.Fatal("plain context should use standard logger")
-	}
-	if LoggerHook(ctx) != nil {
-		t.Fatal("plain context should not have a logger hook")
-	}
-
-	logger := logrus.New()
-	ctx = WithLogger(ctx, logger)
-	if Logger(ctx) != logger {
-		t.Fatal("WithLogger should set logger")
-	}
-
-	hook := testHook{}
-	ctx = WithLoggerHook(ctx, hook)
-	if LoggerHook(ctx) != hook {
-		t.Fatal("WithLoggerHook should set hook")
-	}
-}
-
-type testHook struct{}
-
-func (testHook) Levels() []logrus.Level {
-	return logrus.AllLevels
-}
-
-func (testHook) Fire(*logrus.Entry) error {
-	return nil
-}

act/common/dryrun.go

@@ -1,29 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-)
-
-type dryrunContextKey string
-
-const dryrunContextKeyVal = dryrunContextKey("dryrun")
-
-// Dryrun returns true if the current context is dryrun
-func Dryrun(ctx context.Context) bool {
-	val := ctx.Value(dryrunContextKeyVal)
-	if val != nil {
-		if dryrun, ok := val.(bool); ok {
-			return dryrun
-		}
-	}
-	return false
-}
-
-// WithDryrun adds a value to the context for dryrun
-func WithDryrun(ctx context.Context, dryrun bool) context.Context {
-	return context.WithValue(ctx, dryrunContextKeyVal, dryrun)
-}

act/common/executor.go

@@ -1,178 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"fmt"
-	"runtime/debug"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// Executor define contract for the steps of a workflow
-type Executor func(ctx context.Context) error
-
-// Conditional define contract for the conditional predicate
-type Conditional func(ctx context.Context) bool
-
-// NewInfoExecutor is an executor that logs messages
-func NewInfoExecutor(format string, args ...any) Executor {
-	return func(ctx context.Context) error {
-		logger := Logger(ctx)
-		logger.Infof(format, args...)
-		return nil
-	}
-}
-
-// NewDebugExecutor is an executor that logs messages
-func NewDebugExecutor(format string, args ...any) Executor {
-	return func(ctx context.Context) error {
-		logger := Logger(ctx)
-		logger.Debugf(format, args...)
-		return nil
-	}
-}
-
-// NewPipelineExecutor creates a new executor from a series of other executors
-func NewPipelineExecutor(executors ...Executor) Executor {
-	if len(executors) == 0 {
-		return func(ctx context.Context) error {
-			return nil
-		}
-	}
-	var rtn Executor
-	for _, executor := range executors {
-		if rtn == nil {
-			rtn = executor
-		} else {
-			rtn = rtn.Then(executor)
-		}
-	}
-	return rtn
-}
-
-// NewErrorExecutor creates a new executor that always errors out
-func NewErrorExecutor(err error) Executor {
-	return func(ctx context.Context) error {
-		return err
-	}
-}
-
-// NewParallelExecutor creates a new executor from a parallel of other executors
-func NewParallelExecutor(parallel int, executors ...Executor) Executor {
-	if len(executors) == 0 {
-		return func(ctx context.Context) error {
-			return ctx.Err()
-		}
-	}
-
-	return func(ctx context.Context) error {
-		work := make(chan Executor, len(executors))
-		errs := make(chan error, len(executors))
-
-		if 1 > parallel {
-			log.Debugf("Parallel tasks (%d) below minimum, setting to 1", parallel)
-			parallel = 1
-		}
-
-		log.Infof("NewParallelExecutor: Creating %d workers for %d executors", parallel, len(executors))
-
-		for i := 0; i < parallel; i++ {
-			go func(workerID int, work <-chan Executor, errs chan<- error) {
-				log.Debugf("Worker %d started", workerID)
-				taskCount := 0
-				for executor := range work {
-					taskCount++
-					log.Debugf("Worker %d executing task %d", workerID, taskCount)
-					// Recover from panics in executors to avoid crashing the worker
-					// goroutine which would leave the runner process hung.
-					// https://gitea.com/gitea/runner/issues/371
-					errs <- func() (err error) {
-						defer func() {
-							if r := recover(); r != nil {
-								log.Errorf("panic in executor: %v\n%s", r, debug.Stack())
-								err = fmt.Errorf("panic: %v", r)
-							}
-						}()
-						return executor(ctx)
-					}()
-				}
-				log.Debugf("Worker %d finished (%d tasks executed)", workerID, taskCount)
-			}(i, work, errs)
-		}
-
-		for i := range executors {
-			work <- executors[i]
-		}
-		close(work)
-
-		// Executor waits all executors to cleanup these resources.
-		var firstErr error
-		for range executors {
-			err := <-errs
-			if firstErr == nil {
-				firstErr = err
-			}
-		}
-
-		if err := ctx.Err(); err != nil {
-			return err
-		}
-		return firstErr
-	}
-}
-
-// Then runs another executor if this executor succeeds
-func (e Executor) Then(then Executor) Executor {
-	return func(ctx context.Context) error {
-		if err := e(ctx); err != nil {
-			return err
-		}
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-		return then(ctx)
-	}
-}
-
-// If only runs this executor if conditional is true
-func (e Executor) If(conditional Conditional) Executor {
-	return func(ctx context.Context) error {
-		if conditional(ctx) {
-			return e(ctx)
-		}
-		return nil
-	}
-}
-
-// IfNot only runs this executor if conditional is true
-func (e Executor) IfNot(conditional Conditional) Executor {
-	return func(ctx context.Context) error {
-		if !conditional(ctx) {
-			return e(ctx)
-		}
-		return nil
-	}
-}
-
-// IfBool only runs this executor if conditional is true
-func (e Executor) IfBool(conditional bool) Executor {
-	return e.If(func(ctx context.Context) bool {
-		return conditional
-	})
-}
-
-// Finally adds an executor to run after other executor
-func (e Executor) Finally(finally Executor) Executor {
-	return func(ctx context.Context) error {
-		err := e(ctx)
-		err2 := finally(ctx)
-		if err2 != nil {
-			return fmt.Errorf("error occurred running finally: %v (original error: %v)", err2, err)
-		}
-		return err
-	}
-}

act/common/executor_test.go

@@ -1,188 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"errors"
-	"reflect"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewWorkflow(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-
-	// empty
-	emptyWorkflow := NewPipelineExecutor()
-	assert.NoError(emptyWorkflow(ctx)) //nolint:testifylint // pre-existing issue from nektos/act
-
-	// error case
-	errorWorkflow := NewErrorExecutor(errors.New("test error"))
-	assert.Error(errorWorkflow(ctx)) //nolint:testifylint // pre-existing issue from nektos/act
-
-	// multiple success case
-	runcount := 0
-	successWorkflow := NewPipelineExecutor(
-		func(ctx context.Context) error {
-			runcount++
-			return nil
-		},
-		func(ctx context.Context) error {
-			runcount++
-			return nil
-		})
-	assert.NoError(successWorkflow(ctx)) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(2, runcount)
-}
-
-// concurrencyProbe returns an executor recording the peak number of concurrent copies. Copies
-// block until wantActive are in flight so the peak is exact without sleeping, and later copies
-// find the gate already open so the last one still finishes with no partner left.
-func concurrencyProbe(wantActive int32) (exec Executor, count, maxActive *atomic.Int32) {
-	var counted, active, peak atomic.Int32
-	var once sync.Once
-	reached := make(chan struct{})
-
-	return func(ctx context.Context) error {
-		counted.Add(1)
-		running := active.Add(1)
-		for {
-			seen := peak.Load()
-			if running <= seen || peak.CompareAndSwap(seen, running) {
-				break
-			}
-		}
-		if running >= wantActive {
-			once.Do(func() { close(reached) })
-		}
-		<-reached
-		active.Add(-1)
-		return nil
-	}, &counted, &peak
-}
-
-func TestNewParallelExecutor(t *testing.T) {
-	ctx := context.Background()
-
-	exec, count, maxActive := concurrencyProbe(2)
-	require.NoError(t, NewParallelExecutor(2, exec, exec, exec)(ctx))
-	assert.Equal(t, int32(3), count.Load(), "should run all 3 executors")
-	assert.Equal(t, int32(2), maxActive.Load(), "should run at most 2 executors in parallel")
-
-	// parallelism below 1 falls back to a single worker
-	exec, count, maxActive = concurrencyProbe(1)
-	require.NoError(t, NewParallelExecutor(0, exec, exec, exec)(ctx))
-	assert.Equal(t, int32(3), count.Load(), "should run all 3 executors")
-	assert.Equal(t, int32(1), maxActive.Load(), "should run at most 1 executor in parallel")
-}
-
-func TestNewParallelExecutorEmpty(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-	require.NoError(t, NewParallelExecutor(2)(ctx))
-
-	canceledCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	err := NewParallelExecutor(2)(canceledCtx)
-	assert.ErrorIs(err, context.Canceled)
-}
-
-func TestNewParallelExecutorFailed(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	count := 0
-	errorWorkflow := NewPipelineExecutor(func(ctx context.Context) error {
-		count++
-		return errors.New("fake error")
-	})
-	err := NewParallelExecutor(1, errorWorkflow)(ctx)
-	assert.Equal(1, count)
-	assert.ErrorIs(context.Canceled, err)
-}
-
-func TestNewParallelExecutorCanceled(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	errExpected := errors.New("fake error")
-
-	var count atomic.Int32
-	successWorkflow := NewPipelineExecutor(func(ctx context.Context) error {
-		count.Add(1)
-		return nil
-	})
-	errorWorkflow := NewPipelineExecutor(func(ctx context.Context) error {
-		count.Add(1)
-		return errExpected
-	})
-	err := NewParallelExecutor(3, errorWorkflow, successWorkflow, successWorkflow)(ctx)
-	assert.Equal(int32(3), count.Load())
-	assert.Error(errExpected, err) //nolint:testifylint // pre-existing issue from nektos/act
-}
-
-func TestNewParallelExecutorRunsRemainingAfterFailure(t *testing.T) {
-	var successCount atomic.Int32
-	executors := make([]Executor, 5)
-	for i := range executors {
-		executors[i] = func(ctx context.Context) error {
-			if i == 2 {
-				return errors.New("fake error")
-			}
-			successCount.Add(1)
-			return nil
-		}
-	}
-
-	require.Error(t, NewParallelExecutor(2, executors...)(context.Background()))
-	assert.Equal(t, int32(4), successCount.Load(), "a failing executor must not stop the others")
-}
-
-func TestExecutorConditionalsAndFinally(t *testing.T) {
-	ctx := context.Background()
-	var calls []string
-	record := func(name string) Executor {
-		return func(ctx context.Context) error {
-			calls = append(calls, name)
-			return nil
-		}
-	}
-
-	require.NoError(t, record("if-true").If(func(context.Context) bool { return true })(ctx))
-	require.NoError(t, record("if-false").If(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-not").IfNot(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-bool").IfBool(true)(ctx))
-	require.NoError(t, record("main").Finally(record("finally"))(ctx))
-
-	want := []string{"if-true", "if-not", "if-bool", "main", "finally"}
-	if !reflect.DeepEqual(calls, want) {
-		t.Fatalf("calls = %v, want %v", calls, want)
-	}
-}
-
-func TestExecutorFinallyReturnsFinallyErrorWithOriginal(t *testing.T) {
-	mainErr := errors.New("main failed")
-	finalErr := errors.New("cleanup failed")
-
-	err := NewErrorExecutor(mainErr).Finally(NewErrorExecutor(finalErr))(context.Background())
-	require.Error(t, err)
-	if !strings.Contains(err.Error(), "cleanup failed") || !strings.Contains(err.Error(), "main failed") {
-		t.Fatalf("finally error = %q, want both cleanup and original error", err)
-	}
-}

act/common/git/git.go

@@ -1,552 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package git
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"regexp"
-	"strings"
-	"sync"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/internal/pkg/lock"
-
-	"github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/config"
-	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/go-git/go-git/v5/plumbing/storer"
-	"github.com/go-git/go-git/v5/plumbing/transport/http"
-	"github.com/mattn/go-isatty"
-	log "github.com/sirupsen/logrus"
-)
-
-var (
-	codeCommitHTTPRegex = regexp.MustCompile(`^https?://git-codecommit\.(.+)\.amazonaws.com/v1/repos/(.+)$`)
-	codeCommitSSHRegex  = regexp.MustCompile(`ssh://git-codecommit\.(.+)\.amazonaws.com/v1/repos/(.+)$`)
-	githubHTTPRegex     = regexp.MustCompile(`^https?://.*github.com.*/(.+)/(.+?)(?:.git)?$`)
-	githubSSHRegex      = regexp.MustCompile(`github.com[:/](.+)/(.+?)(?:.git)?$`)
-
-	cloneLocks lock.Keyed[string] // key: clone target directory
-
-	ErrShortRef = errors.New("short SHA references are not supported")
-)
-
-// AcquireCloneLock returns an unlock function after locking the per-directory mutex for dir.
-// Only concurrent operations targeting the same directory are serialized; clones into different directories run in parallel.
-// Callers reading files inside dir (e.g. tarring a checked-out action into a job container) must hold this lock too,
-// otherwise a concurrent NewGitCloneExecutor on the same dir can mutate the worktree mid-read.
-func AcquireCloneLock(dir string) func() {
-	return cloneLocks.Lock(dir)
-}
-
-type Error struct {
-	err    error
-	commit string
-}
-
-func (e *Error) Error() string {
-	return e.err.Error()
-}
-
-func (e *Error) Unwrap() error {
-	return e.err
-}
-
-func (e *Error) Commit() string {
-	return e.commit
-}
-
-// goGitMu serializes go-git repository access across the process. go-git is not safe for
-// concurrent use of the same repository (even read access decodes packfiles into shared
-// state), so parallel jobs inspecting the shared workdir repo race without this. The guarded
-// operations are fast local reads; gitea runs one job per process, so the lock is effectively
-// uncontended in production.
-var goGitMu sync.Mutex
-
-// FindGitRevision get the current git revision
-func FindGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-	return findGitRevision(ctx, file)
-}
-
-func findGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
-	logger := common.Logger(ctx)
-
-	gitDir, err := git.PlainOpenWithOptions(
-		file,
-		&git.PlainOpenOptions{
-			DetectDotGit:          true,
-			EnableDotGitCommonDir: true,
-		},
-	)
-	if err != nil {
-		logger.WithError(err).Error("path", file, "not located inside a git repository")
-		return "", "", err
-	}
-
-	head, err := gitDir.Reference(plumbing.HEAD, true)
-	if err != nil {
-		return "", "", err
-	}
-
-	if head.Hash().IsZero() {
-		return "", "", errors.New("HEAD sha1 could not be resolved")
-	}
-
-	hash := head.Hash().String()
-
-	logger.Debugf("Found revision: %s", hash)
-	return hash[:7], strings.TrimSpace(hash), nil
-}
-
-// FindGitRef get the current git ref
-func FindGitRef(ctx context.Context, file string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-
-	logger := common.Logger(ctx)
-
-	logger.Debugf("Loading revision from git directory")
-	_, ref, err := findGitRevision(ctx, file)
-	if err != nil {
-		return "", err
-	}
-
-	logger.Debugf("HEAD points to '%s'", ref)
-
-	// Prefer the git library to iterate over the references and find a matching tag or branch.
-	refTag := ""
-	refBranch := ""
-	repo, err := git.PlainOpenWithOptions(
-		file,
-		&git.PlainOpenOptions{
-			DetectDotGit:          true,
-			EnableDotGitCommonDir: true,
-		},
-	)
-	if err != nil {
-		return "", err
-	}
-
-	iter, err := repo.References()
-	if err != nil {
-		return "", err
-	}
-
-	// find the reference that matches the revision's has
-	err = iter.ForEach(func(r *plumbing.Reference) error {
-		/* tags and branches will have the same hash
-		 * when a user checks out a tag, it is not mentioned explicitly
-		 * in the go-git package, we must identify the revision
-		 * then check if any tag matches that revision,
-		 * if so then we checked out a tag
-		 * else we look for branches and if matches,
-		 * it means we checked out a branch
-		 *
-		 * If a branches matches first we must continue and check all tags (all references)
-		 * in case we match with a tag later in the interation
-		 */
-		if r.Hash().String() == ref {
-			if r.Name().IsTag() {
-				refTag = r.Name().String()
-			}
-			if r.Name().IsBranch() {
-				refBranch = r.Name().String()
-			}
-		}
-
-		// we found what we where looking for
-		if refTag != "" && refBranch != "" {
-			return storer.ErrStop
-		}
-
-		return nil
-	})
-	if err != nil {
-		return "", err
-	}
-
-	// order matters here see above comment.
-	if refTag != "" {
-		return refTag, nil
-	}
-	if refBranch != "" {
-		return refBranch, nil
-	}
-
-	return "", fmt.Errorf("failed to identify reference (tag/branch) for the checked-out revision '%s'", ref)
-}
-
-// FindGithubRepo get the repo
-func FindGithubRepo(ctx context.Context, file, githubInstance string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-
-	url, err := findGitRemoteURL(ctx, file, "origin")
-	if err != nil {
-		return "", err
-	}
-	_, slug := findGitSlug(url, githubInstance)
-	return slug, nil
-}
-
-func findGitRemoteURL(_ context.Context, file, remoteName string) (string, error) {
-	repo, err := git.PlainOpenWithOptions(
-		file,
-		&git.PlainOpenOptions{
-			DetectDotGit:          true,
-			EnableDotGitCommonDir: true,
-		},
-	)
-	if err != nil {
-		return "", err
-	}
-
-	remote, err := repo.Remote(remoteName)
-	if err != nil {
-		return "", err
-	}
-
-	if len(remote.Config().URLs) < 1 {
-		return "", fmt.Errorf("remote '%s' exists but has no URL", remoteName)
-	}
-
-	return remote.Config().URLs[0], nil
-}
-
-func findGitSlug(url, githubInstance string) (string, string) {
-	if matches := codeCommitHTTPRegex.FindStringSubmatch(url); matches != nil {
-		return "CodeCommit", matches[2]
-	} else if matches := codeCommitSSHRegex.FindStringSubmatch(url); matches != nil {
-		return "CodeCommit", matches[2]
-	} else if matches := githubHTTPRegex.FindStringSubmatch(url); matches != nil {
-		return "GitHub", fmt.Sprintf("%s/%s", matches[1], matches[2])
-	} else if matches := githubSSHRegex.FindStringSubmatch(url); matches != nil {
-		return "GitHub", fmt.Sprintf("%s/%s", matches[1], matches[2])
-	} else if githubInstance != "github.com" {
-		gheHTTPRegex := regexp.MustCompile(fmt.Sprintf(`^https?://%s/(.+)/(.+?)(?:.git)?$`, githubInstance))
-		gheSSHRegex := regexp.MustCompile(githubInstance + "[:/](.+)/(.+?)(?:.git)?$")
-		if matches := gheHTTPRegex.FindStringSubmatch(url); matches != nil {
-			return "GitHubEnterprise", fmt.Sprintf("%s/%s", matches[1], matches[2])
-		} else if matches := gheSSHRegex.FindStringSubmatch(url); matches != nil {
-			return "GitHubEnterprise", fmt.Sprintf("%s/%s", matches[1], matches[2])
-		}
-	}
-	return "", url
-}
-
-// NewGitCloneExecutorInput the input for the NewGitCloneExecutor
-type NewGitCloneExecutorInput struct {
-	URL         string
-	Ref         string
-	Dir         string
-	Token       string
-	OfflineMode bool
-
-	// Depth limits the clone/fetch to the given number of commits from the tip of the requested ref.
-	// 0 for full clone.
-	Depth int
-
-	// Quiet drops the informational clone line to debug level, for callers that log their own
-	// download summary (the setup section's action report).
-	Quiet bool
-
-	// For Gitea
-	InsecureSkipTLS bool
-}
-
-// CloneIfRequired returns the repository and a boolean indicating whether an existing local clone was reused.
-func CloneIfRequired(ctx context.Context, refName plumbing.ReferenceName, input NewGitCloneExecutorInput, logger log.FieldLogger) (*git.Repository, bool, error) {
-	r, err := git.PlainOpen(input.Dir)
-	if err == nil {
-		// Verify the cached clone still points to the resolved URL before reusing it.
-		remote, err := r.Remote("origin")
-		if err == nil && len(remote.Config().URLs) > 0 && remote.Config().URLs[0] == input.URL {
-			// Reuse existing clone
-			return r, true, nil
-		}
-
-		switch {
-		case err != nil:
-			logger.Debugf("Removing cached clone at %s because origin cannot be read: %v", input.Dir, err)
-		case len(remote.Config().URLs) == 0:
-			logger.Debugf("Removing cached clone at %s because origin has no URL", input.Dir)
-		default:
-			logger.Debugf("Removing cached clone at %s because origin URL changed from %s to %s", input.Dir, remote.Config().URLs[0], input.URL)
-		}
-		if err := os.RemoveAll(input.Dir); err != nil {
-			return nil, false, fmt.Errorf("remove cached clone %s: %w", input.Dir, err)
-		}
-	}
-
-	var progressWriter io.Writer
-	if isatty.IsTerminal(os.Stdout.Fd()) || isatty.IsCygwinTerminal(os.Stdout.Fd()) {
-		if entry, ok := logger.(*log.Entry); ok {
-			progressWriter = entry.WriterLevel(log.DebugLevel)
-		} else if lgr, ok := logger.(*log.Logger); ok {
-			progressWriter = lgr.WriterLevel(log.DebugLevel)
-		} else {
-			log.Errorf("Unable to get writer from logger (type=%T)", logger)
-			progressWriter = os.Stdout
-		}
-	}
-
-	cloneOptions := git.CloneOptions{
-		URL:      input.URL,
-		Progress: progressWriter,
-
-		InsecureSkipTLS: input.InsecureSkipTLS, // For Gitea
-	}
-	if input.Token != "" {
-		cloneOptions.Auth = &http.BasicAuth{
-			Username: "token",
-			Password: input.Token,
-		}
-	}
-
-	r, err = cloneAtDepth(ctx, input, cloneOptions, logger)
-	if err != nil {
-		logger.Errorf("Unable to clone %v %s: %v", input.URL, refName, err)
-		return nil, false, err
-	}
-
-	if err = os.Chmod(input.Dir, 0o755); err != nil {
-		return nil, false, err
-	}
-
-	return r, false, nil
-}
-
-func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.PullOptions) {
-	fetchOptions.RefSpecs = []config.RefSpec{"refs/*:refs/*", "HEAD:refs/heads/HEAD"}
-	fetchOptions.Force = true
-	pullOptions.Force = true
-
-	if token != "" {
-		auth := &http.BasicAuth{
-			Username: "token",
-			Password: token,
-		}
-		fetchOptions.Auth = auth
-		pullOptions.Auth = auth
-	}
-
-	return fetchOptions, pullOptions
-}
-
-// staleRefreshErr reports why a failed refresh must abort: the resolve and
-// checkout that follow are local and succeed on a cancelled context, which
-// would hand back the cached revision as if it were fresh.
-func staleRefreshErr(ctx context.Context, err error) error {
-	if err == nil || errors.Is(err, git.NoErrAlreadyUpToDate) {
-		return nil
-	}
-	return ctx.Err()
-}
-
-// NewGitCloneExecutor creates an executor to clone git repos
-func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		if input.Quiet {
-			logger.Debugf("git clone '%s' # ref=%s", input.URL, input.Ref)
-		} else {
-			logger.Infof("git clone '%s' # ref=%s", input.URL, input.Ref)
-		}
-		logger.Debugf("  cloning %s to %s", input.URL, input.Dir)
-
-		defer AcquireCloneLock(input.Dir)()
-
-		refName := plumbing.ReferenceName("refs/heads/" + input.Ref)
-		r, reused, err := CloneIfRequired(ctx, refName, input, logger)
-		if err != nil {
-			return err
-		}
-
-		isOfflineMode := input.OfflineMode
-
-		// fetch latest changes
-		fetchOptions, pullOptions := gitOptions(input.Token)
-
-		if input.InsecureSkipTLS { // For Gitea
-			fetchOptions.InsecureSkipTLS = true
-			pullOptions.InsecureSkipTLS = true
-		}
-
-		// Action clones only ever need the tip commit, so keep a shallow cache cheap on update at depth 1 regardless of its original depth
-		// Turning action_shallow_clone off does not convert an existing shallow cache; evict it for a full clone.
-		shallow := isShallow(r)
-		if shallow {
-			fetchOptions.Depth = 1
-			if spec, ok := shallowFetchRefSpec(r, input.Ref); ok {
-				fetchOptions.RefSpecs = []config.RefSpec{spec}
-			}
-		}
-
-		if !isOfflineMode {
-			err = r.FetchContext(ctx, &fetchOptions)
-			if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
-				return err
-			}
-		}
-
-		var hash *plumbing.Hash
-		rev := plumbing.Revision(input.Ref)
-		if hash, err = r.ResolveRevision(rev); err != nil {
-			// ResolveRevision returns a nil hash on error, and a branch ref legitimately fails
-			// here (no local refs/heads/<ref>); the duck-typing below resolves it.
-			logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-		} else if hash.String() != input.Ref && strings.HasPrefix(hash.String(), input.Ref) {
-			return &Error{
-				err:    ErrShortRef,
-				commit: hash.String(),
-			}
-		}
-
-		// At this point we need to know if it's a tag or a branch
-		// And the easiest way to do it is duck typing
-		//
-		// If err is nil, it's a tag so let's proceed with that hash like we would if
-		// it was a sha
-		refType := "tag"
-		rev = plumbing.Revision(path.Join("refs", "tags", input.Ref))
-		if _, err := r.Tag(input.Ref); errors.Is(err, git.ErrTagNotFound) {
-			rName := plumbing.ReferenceName(path.Join("refs", "remotes", "origin", input.Ref))
-			if _, err := r.Reference(rName, false); errors.Is(err, plumbing.ErrReferenceNotFound) {
-				refType = "sha"
-				rev = plumbing.Revision(input.Ref)
-			} else {
-				refType = "branch"
-				rev = plumbing.Revision(rName)
-			}
-		}
-
-		if hash, err = r.ResolveRevision(rev); err != nil {
-			logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-			return err
-		}
-
-		var w *git.Worktree
-		if w, err = r.Worktree(); err != nil {
-			return err
-		}
-
-		// If the hash resolved doesn't match the ref provided in a workflow then we're
-		// using a branch or tag ref, not a sha
-		//
-		// Repos on disk point to commit hashes, and need to checkout input.Ref before
-		// we try and pull down any changes
-		if hash.String() != input.Ref && refType == "branch" {
-			logger.Debugf("Provided ref is not a sha. Checking out branch before pulling changes")
-			sourceRef := plumbing.ReferenceName(path.Join("refs", "remotes", "origin", input.Ref))
-			if err = w.Checkout(&git.CheckoutOptions{
-				Branch: sourceRef,
-				Force:  true,
-			}); err != nil {
-				logger.Errorf("Unable to checkout %s: %v", sourceRef, err)
-				return err
-			}
-		}
-
-		reusedMsg := ""
-
-		switch {
-		case !isOfflineMode && !shallow:
-			// In shallow mode the depth-limited fetch above already advanced the ref.
-			if err = w.PullContext(ctx, &pullOptions); err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
-				logger.Debugf("Unable to pull %s: %v", refName, err)
-			}
-			if err := staleRefreshErr(ctx, err); err != nil {
-				return err
-			}
-		case isOfflineMode && reused:
-			reusedMsg = " (reused in offline mode)"
-		}
-
-		logger.Debugf("Cloned %s to %s%s", input.URL, input.Dir, reusedMsg)
-
-		if hash.String() != input.Ref && refType == "branch" {
-			logger.Debugf("Provided ref is not a sha. Updating branch ref after pull")
-			if hash, err = r.ResolveRevision(rev); err != nil {
-				logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-				return err
-			}
-		}
-		if err = w.Checkout(&git.CheckoutOptions{
-			Hash:  *hash,
-			Force: true,
-		}); err != nil {
-			logger.Errorf("Unable to checkout %s: %v", *hash, err)
-			return err
-		}
-
-		if err = w.Reset(&git.ResetOptions{
-			Mode:   git.HardReset,
-			Commit: *hash,
-		}); err != nil {
-			logger.Errorf("Unable to reset to %s: %v", hash.String(), err)
-			return err
-		}
-
-		logger.Debugf("Checked out %s", input.Ref)
-		return nil
-	}
-}
-
-// cloneAtDepth clones input.URL into input.Dir using opts.
-// With input.Depth > 0 it first tries a shallow, single-branch clone of input.Ref, falling back when error.
-func cloneAtDepth(ctx context.Context, input NewGitCloneExecutorInput, opts git.CloneOptions, logger log.FieldLogger) (*git.Repository, error) {
-	if input.Depth > 0 {
-		for _, refName := range []plumbing.ReferenceName{
-			plumbing.NewBranchReferenceName(input.Ref),
-			plumbing.NewTagReferenceName(input.Ref),
-		} {
-			shallowOpts := opts
-			shallowOpts.Depth = input.Depth
-			shallowOpts.SingleBranch = true
-			shallowOpts.ReferenceName = refName
-			shallowOpts.Tags = git.NoTags
-
-			r, err := git.PlainCloneContext(ctx, input.Dir, false, &shallowOpts)
-			if err == nil {
-				return r, nil
-			}
-			logger.Debugf("Shallow clone of %s as %s failed: %v", input.URL, refName, err)
-			if rmErr := os.RemoveAll(input.Dir); rmErr != nil {
-				return nil, fmt.Errorf("remove partial clone %s: %w", input.Dir, rmErr)
-			}
-		}
-		logger.Debugf("Falling back to a full clone of %s for ref %q", input.URL, input.Ref)
-	}
-
-	return git.PlainCloneContext(ctx, input.Dir, false, &opts)
-}
-
-// isShallow reports whether the local repository was cloned with a limited depth.
-func isShallow(r *git.Repository) bool {
-	shallows, err := r.Storer.Shallow()
-	return err == nil && len(shallows) > 0
-}
-
-// shallowFetchRefSpec returns the single refspec that updates only input.Ref, keeping a shallow clone from re-downloading every branch's history.
-// ok is false when the ref is not present locally as a tag or remote-tracking branch, in which case the broad default refspec is used.
-func shallowFetchRefSpec(r *git.Repository, ref string) (config.RefSpec, bool) {
-	tagRef := plumbing.NewTagReferenceName(ref)
-	if _, err := r.Reference(tagRef, false); err == nil {
-		return config.RefSpec(fmt.Sprintf("+%s:%s", tagRef, tagRef)), true
-	}
-	remoteRef := plumbing.NewRemoteReferenceName("origin", ref)
-	if _, err := r.Reference(remoteRef, false); err == nil {
-		branchRef := plumbing.NewBranchReferenceName(ref)
-		return config.RefSpec(fmt.Sprintf("+%s:%s", branchRef, remoteRef)), true
-	}
-	return "", false
-}

act/common/git/git_test.go

@@ -1,643 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package git
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"syscall"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	gogit "github.com/go-git/go-git/v5"
-	gogitconfig "github.com/go-git/go-git/v5/config"
-	log "github.com/sirupsen/logrus"
-	logrustest "github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestFindGitSlug(t *testing.T) {
-	assert := assert.New(t)
-
-	slugTests := []struct {
-		url      string // input
-		provider string // expected result
-		slug     string // expected result
-	}{
-		{"https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo-name", "CodeCommit", "my-repo-name"},
-		{"ssh://git-codecommit.us-west-2.amazonaws.com/v1/repos/my-repo", "CodeCommit", "my-repo"},
-		{"git@github.com:nektos/act.git", "GitHub", "nektos/act"},
-		{"git@github.com:nektos/act", "GitHub", "nektos/act"},
-		{"https://github.com/nektos/act.git", "GitHub", "nektos/act"},
-		{"http://github.com/nektos/act.git", "GitHub", "nektos/act"},
-		{"https://github.com/nektos/act", "GitHub", "nektos/act"},
-		{"http://github.com/nektos/act", "GitHub", "nektos/act"},
-		{"git+ssh://git@github.com/owner/repo.git", "GitHub", "owner/repo"},
-		{"http://myotherrepo.com/act.git", "", "http://myotherrepo.com/act.git"},
-	}
-
-	for _, tt := range slugTests {
-		provider, slug := findGitSlug(tt.url, "github.com")
-		assert.Equal(tt.provider, provider)
-		assert.Equal(tt.slug, slug)
-	}
-}
-
-func TestErrorWrapsCommitAndCause(t *testing.T) {
-	err := &Error{err: ErrShortRef, commit: "abc123"}
-	require.Equal(t, ErrShortRef.Error(), err.Error())
-	require.ErrorIs(t, err, ErrShortRef)
-	require.Equal(t, "abc123", err.Commit())
-}
-
-func cleanGitHooks(dir string) error {
-	hooksDir := filepath.Join(dir, ".git", "hooks")
-	files, err := os.ReadDir(hooksDir)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	for _, f := range files {
-		if f.IsDir() {
-			continue
-		}
-		relName := filepath.Join(hooksDir, f.Name())
-		if err := os.Remove(relName); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func TestFindGithubRepoUsesOrigin(t *testing.T) {
-	basedir := t.TempDir()
-	const remoteURL = "https://github.com/owner/repo.git"
-	require.NoError(t, gitCmd("init", basedir))
-	require.NoError(t, cleanGitHooks(basedir))
-	require.NoError(t, gitCmd("-C", basedir, "remote", "add", "origin", remoteURL))
-
-	url, err := findGitRemoteURL(context.Background(), basedir, "origin")
-	require.NoError(t, err)
-	require.Equal(t, remoteURL, url)
-
-	slug, err := FindGithubRepo(context.Background(), basedir, "github.com")
-	require.NoError(t, err)
-	require.Equal(t, "owner/repo", slug)
-}
-
-func TestGitFindRef(t *testing.T) {
-	basedir := t.TempDir()
-
-	for name, tt := range map[string]struct {
-		Prepare func(t *testing.T, dir string)
-		Assert  func(t *testing.T, ref string, err error)
-	}{
-		"new_repo": {
-			Prepare: func(t *testing.T, dir string) {},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.Error(t, err)
-			},
-		},
-		"new_repo_with_commit": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/heads/master", ref)
-			},
-		},
-		"current_head_is_tag": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "commit msg"))
-				require.NoError(t, gitCmd("-C", dir, "tag", "v1.2.3"))
-				require.NoError(t, gitCmd("-C", dir, "checkout", "v1.2.3"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/tags/v1.2.3", ref)
-			},
-		},
-		"current_head_is_same_as_tag": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "1.4.2 release"))
-				require.NoError(t, gitCmd("-C", dir, "tag", "v1.4.2"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/tags/v1.4.2", ref)
-			},
-		},
-		"current_head_is_not_tag": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg"))
-				require.NoError(t, gitCmd("-C", dir, "tag", "v1.4.2"))
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg2"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/heads/master", ref)
-			},
-		},
-		"current_head_is_another_branch": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "checkout", "-b", "mybranch"))
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/heads/mybranch", ref)
-			},
-		},
-	} {
-		t.Run(name, func(t *testing.T) {
-			dir := filepath.Join(basedir, name)
-			require.NoError(t, os.MkdirAll(dir, 0o755))
-			require.NoError(t, gitCmd("-C", dir, "init", "--initial-branch=master"))
-			require.NoError(t, cleanGitHooks(dir))
-			tt.Prepare(t, dir)
-			ref, err := FindGitRef(context.Background(), dir)
-			tt.Assert(t, ref, err)
-		})
-	}
-}
-
-func TestGitCloneExecutor(t *testing.T) {
-	// Build a local bare "remote" so this runs offline and fast. The cases below mirror
-	// the tag/branch/sha/short-sha ref paths the executor handles, formerly exercised by
-	// cloning actions/checkout and anchore/scan-action over the network.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v2"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v2"))
-
-	// A branch with a dash in the name (mirrors the historical scan-action@act-fails case).
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "act-fails"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "branch-commit"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "act-fails"))
-
-	out, err := exec.Command("git", "-C", workDir, "rev-parse", "main").Output()
-	require.NoError(t, err)
-	fullSha := strings.TrimSpace(string(out))
-
-	for name, tt := range map[string]struct {
-		Err error
-		Ref string
-	}{
-		"tag": {
-			Err: nil,
-			Ref: "v2",
-		},
-		"branch": {
-			Err: nil,
-			Ref: "act-fails",
-		},
-		"sha": {
-			Err: nil,
-			Ref: fullSha,
-		},
-		"short-sha": {
-			Err: &Error{ErrShortRef, fullSha},
-			Ref: fullSha[:7],
-		},
-	} {
-		t.Run(name, func(t *testing.T) {
-			clone := NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL: remoteDir,
-				Ref: tt.Ref,
-				Dir: t.TempDir(),
-			})
-
-			err := clone(context.Background())
-			if tt.Err != nil {
-				assert.Error(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-				assert.Equal(t, tt.Err, err)
-			} else {
-				assert.Empty(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			}
-		})
-	}
-}
-
-func TestGitCloneExecutorReclonesWhenOriginURLChanges(t *testing.T) {
-	createRemote := func(message string) string {
-		remoteDir := t.TempDir()
-		require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-		workDir := t.TempDir()
-		require.NoError(t, gitCmd("clone", remoteDir, workDir))
-		require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", message))
-		require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-		return remoteDir
-	}
-
-	oldRemoteDir := createRemote("old-action")
-	newRemoteDir := createRemote("new-action")
-	cacheDir := t.TempDir()
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: oldRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	markerPath := filepath.Join(cacheDir, "stale-marker")
-	require.NoError(t, os.WriteFile(markerPath, []byte("stale"), 0o644))
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: newRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	originURL, err := findGitRemoteURL(t.Context(), cacheDir, "origin")
-	require.NoError(t, err)
-	assert.Equal(t, newRemoteDir, originURL)
-
-	out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	assert.Equal(t, "new-action", strings.TrimSpace(string(out)))
-
-	_, err = os.Stat(markerPath)
-	require.True(t, os.IsNotExist(err), "stale cached directory should be removed before recloning")
-}
-
-func TestGitCloneExecutorNonFastForwardRef(t *testing.T) {
-	// Simulate the scenario where a remote ref (e.g. a GitHub PR head ref) changes
-	// non-fast-forward between two fetches. Before the fix, the fetch used Force=false,
-	// causing go-git to return ErrForceNeeded and short-circuit the checkout.
-
-	// Create a bare "remote" repo with an initial commit on main and a feature branch.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-	// We need a working clone to push commits from.
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Create a feature branch (simulates refs/pull/N/head).
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "feature"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "feature-1"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "feature"))
-
-	// First clone via the executor — should succeed and cache the repo.
-	cloneDir := t.TempDir()
-	clone := NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: remoteDir,
-		Ref: "main",
-		Dir: cloneDir,
-	})
-	require.NoError(t, clone(context.Background()))
-
-	// Now force-push the feature branch to a non-fast-forward commit (simulates
-	// a PR rebase). This makes refs/heads/feature non-fast-forward.
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "branch", "-D", "feature"))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "feature"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "feature-rewritten"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "--force", "origin", "feature"))
-
-	// Also advance main so we can verify the clone picks up the new commit.
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "second"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "main"))
-
-	// Second clone to the same directory — before the fix this returned ErrForceNeeded
-	// and left the working tree at the old commit.
-	err := clone(context.Background())
-	require.NoError(t, err, "fetch with non-fast-forward refs must not fail when Force=true")
-
-	// Verify the working tree was actually updated to the latest main commit.
-	out, err := exec.Command("git", "-C", cloneDir, "log", "--oneline", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	assert.Equal(t, "second", strings.TrimSpace(string(out)), "working tree should be at the latest commit")
-}
-
-func TestGitCloneExecutorOfflineMode(t *testing.T) {
-	// Build a local "remote" with a single commit on main.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Prime the cache with an online clone of main.
-	cacheDir := t.TempDir()
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: remoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(context.Background()))
-
-	t.Run("cached branch resolves without fetching", func(t *testing.T) {
-		// Offline reuse of a cached branch must succeed even though ResolveRevision(input.Ref)
-		// finds no local refs/heads/<ref>.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "main",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.NoError(t, err)
-
-		out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-		require.NoError(t, err)
-		assert.Equal(t, "initial", strings.TrimSpace(string(out)))
-	})
-
-	t.Run("unresolvable cached ref returns error", func(t *testing.T) {
-		// The ref was never cached; offline mode cannot resolve it and must return an error.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "never-fetched",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.Error(t, err)
-	})
-}
-
-func TestGitCloneExecutorQuietDemotesCloneLine(t *testing.T) {
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Quiet callers report the download themselves, so the clone line must not reach the job log.
-	for name, quiet := range map[string]bool{"quiet": true, "not quiet": false} {
-		t.Run(name, func(t *testing.T) {
-			logger, hook := logrustest.NewNullLogger()
-			logger.SetLevel(log.InfoLevel)
-			ctx := common.WithLogger(context.Background(), logger.WithField("job", "j1"))
-
-			require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL:   remoteDir,
-				Ref:   "main",
-				Dir:   t.TempDir(),
-				Quiet: quiet,
-			})(ctx))
-
-			var cloneLines int
-			for _, entry := range hook.AllEntries() {
-				if strings.HasPrefix(entry.Message, "git clone ") {
-					cloneLines++
-				}
-			}
-			if quiet {
-				assert.Zero(t, cloneLines)
-			} else {
-				assert.Equal(t, 1, cloneLines)
-			}
-		})
-	}
-}
-
-func TestGitCloneExecutorShallow(t *testing.T) {
-	// Build a local "remote" with several commits on main plus a tag, so a full clone would pull noticeably more history than a shallow one.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	for _, m := range []string{"c1", "c2", "c3"} {
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", m))
-	}
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v1"))
-	sha := gitRevParse(t, workDir, "HEAD~1") // c2, a SHA that go-git cannot shallow-clone
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v1"))
-
-	shallowMarker := func(dir string) string { return filepath.Join(dir, ".git", "shallow") }
-
-	t.Run("branch is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir), "only the tip commit should be present")
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("tag is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "v1", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("SHA falls back to a full clone", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: sha, Dir: dir, Depth: 1,
-		})(t.Context()))
-		// go-git cannot shallow-clone a raw SHA, so it falls back to a full clone; the absence of a shallow marker proves the fallback happened.
-		assert.NoFileExists(t, shallowMarker(dir), "a SHA ref must not produce a shallow clone")
-		assert.Equal(t, sha, gitRevParse(t, dir, "HEAD"))
-	})
-
-	t.Run("moving branch updates while staying shallow", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		require.Equal(t, "c3", gitHeadSubject(t, dir))
-
-		// Advance main on the remote, then reuse the existing shallow clone.
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "c4"))
-		require.NoError(t, gitCmd("-C", workDir, "push", "origin", "main"))
-
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.Equal(t, "c4", gitHeadSubject(t, dir), "reused shallow clone should update to the new tip")
-		assert.FileExists(t, shallowMarker(dir), "repo should remain shallow after update")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-	})
-}
-
-func gitRevParse(t *testing.T, dir, rev string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-parse", rev).Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
-func gitRevCount(t *testing.T, dir string) int {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--count", "HEAD").Output()
-	require.NoError(t, err)
-	n, err := strconv.Atoi(strings.TrimSpace(string(out)))
-	require.NoError(t, err)
-	return n
-}
-
-func gitHeadSubject(t *testing.T, dir string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
-func gitCmd(args ...string) error {
-	cmd := exec.Command("git", args...)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	// Inject a deterministic identity and ignore the host's global/system config so commits
-	// succeed regardless of the host having no user.name/user.email (e.g. CI, GITHUB_ACTIONS
-	// unset) or a global commit.gpgsign, and without mutating the developer's ~/.gitconfig.
-	cmd.Env = append(os.Environ(),
-		"GIT_AUTHOR_NAME=Unit Test",
-		"GIT_AUTHOR_EMAIL=test@test.com",
-		"GIT_COMMITTER_NAME=Unit Test",
-		"GIT_COMMITTER_EMAIL=test@test.com",
-		"GIT_CONFIG_GLOBAL=/dev/null",
-		"GIT_CONFIG_SYSTEM=/dev/null",
-	)
-
-	err := cmd.Run()
-	if exitError, ok := err.(*exec.ExitError); ok {
-		if waitStatus, ok := exitError.Sys().(syscall.WaitStatus); ok {
-			return fmt.Errorf("Exit error %d", waitStatus.ExitStatus())
-		}
-		return exitError
-	}
-	return nil
-}
-
-func TestAcquireCloneLock(t *testing.T) {
-	t.Run("same directory serializes", func(t *testing.T) {
-		dir := t.TempDir()
-
-		unlock1 := AcquireCloneLock(dir)
-
-		secondAcquired := make(chan struct{})
-		go func() {
-			unlock := AcquireCloneLock(dir)
-			close(secondAcquired)
-			unlock()
-		}()
-
-		select {
-		case <-secondAcquired:
-			t.Fatal("second acquire should block while first holds the lock")
-		case <-time.After(50 * time.Millisecond):
-		}
-
-		unlock1()
-
-		select {
-		case <-secondAcquired:
-		case <-time.After(time.Second):
-			t.Fatal("second acquire should proceed after first releases the lock")
-		}
-	})
-
-	t.Run("different directories do not block", func(t *testing.T) {
-		dirA := t.TempDir()
-		dirB := t.TempDir()
-
-		unlockA := AcquireCloneLock(dirA)
-		defer unlockA()
-
-		done := make(chan struct{})
-		go func() {
-			unlock := AcquireCloneLock(dirB)
-			unlock()
-			close(done)
-		}()
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Fatal("acquire on a different directory must not block")
-		}
-	})
-}
-
-// An unresponsive remote must not pin a job: the refresh has to be interruptible.
-func TestNewGitCloneExecutorFetchHonoursContext(t *testing.T) {
-	block := make(chan struct{})
-	reached := make(chan struct{})
-	var once sync.Once
-	server := httptest.NewServer(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		once.Do(func() { close(reached) })
-		<-block
-	}))
-	t.Cleanup(func() {
-		close(block)
-		server.Close()
-	})
-
-	dir := filepath.Join(t.TempDir(), "cached-action")
-	repo, err := gogit.PlainInit(dir, false)
-	require.NoError(t, err)
-	_, err = repo.CreateRemote(&gogitconfig.RemoteConfig{Name: "origin", URLs: []string{server.URL}})
-	require.NoError(t, err)
-
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
-
-	done := make(chan error, 1)
-	go func() {
-		done <- NewGitCloneExecutor(NewGitCloneExecutorInput{URL: server.URL, Ref: "main", Dir: dir})(ctx)
-	}()
-
-	select {
-	case <-reached:
-	case <-time.After(10 * time.Second):
-		t.Fatal("the executor never reached the remote")
-	}
-	cancel()
-
-	select {
-	case err := <-done:
-		require.Error(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("fetch ignored context cancellation")
-	}
-}
-
-func TestStaleRefreshErr(t *testing.T) {
-	ctx, cancel := context.WithCancel(t.Context())
-	require.NoError(t, staleRefreshErr(ctx, errors.New("remote hung up")))
-
-	cancel()
-	require.ErrorIs(t, staleRefreshErr(ctx, errors.New("remote hung up")), context.Canceled)
-	require.NoError(t, staleRefreshErr(ctx, gogit.NoErrAlreadyUpToDate))
-}

act/common/job_error.go

@@ -1,36 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-)
-
-type jobErrorContextKey string
-
-const jobErrorContextKeyVal = jobErrorContextKey("job.error")
-
-// JobError returns the job error for current context if any
-func JobError(ctx context.Context) error {
-	val := ctx.Value(jobErrorContextKeyVal)
-	if val != nil {
-		if container, ok := val.(map[string]error); ok {
-			return container["error"]
-		}
-	}
-	return nil
-}
-
-func SetJobError(ctx context.Context, err error) {
-	if container, ok := ctx.Value(jobErrorContextKeyVal).(map[string]error); ok {
-		container["error"] = err
-	}
-}
-
-// WithJobErrorContainer adds a value to the context as a container for an error
-func WithJobErrorContainer(ctx context.Context) context.Context {
-	container := map[string]error{}
-	return context.WithValue(ctx, jobErrorContextKeyVal, container)
-}

act/common/line_writer.go

@@ -1,80 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"bytes"
-	"io"
-)
-
-// LineHandler is a callback function for handling a line
-type LineHandler func(line string) bool
-
-// Flusher is implemented by writers that buffer a trailing, not-yet-terminated
-// line. Callers should flush once the underlying stream has reached EOF so the
-// final line (when it is not newline-terminated) is not lost.
-type Flusher interface {
-	Flush()
-}
-
-type lineWriter struct {
-	buffer   bytes.Buffer
-	handlers []LineHandler
-}
-
-// NewLineWriter creates a new instance of a line writer
-func NewLineWriter(handlers ...LineHandler) io.Writer {
-	w := new(lineWriter)
-	w.handlers = handlers
-	return w
-}
-
-// FlushWriter flushes w if it implements Flusher. It is a no-op otherwise, so
-// callers can flush an io.Writer without knowing its concrete type.
-func FlushWriter(w io.Writer) {
-	if f, ok := w.(Flusher); ok {
-		f.Flush()
-	}
-}
-
-func (lw *lineWriter) Write(p []byte) (n int, err error) {
-	pBuf := bytes.NewBuffer(p)
-	written := 0
-	for {
-		line, err := pBuf.ReadString('\n')
-		w, _ := lw.buffer.WriteString(line)
-		written += w
-		if err != nil {
-			if err == io.EOF {
-				break
-			}
-			return written, err
-		}
-		lw.handleLine(lw.buffer.String())
-		lw.buffer.Reset()
-	}
-
-	return written, nil
-}
-
-// Flush emits any buffered, not-yet-newline-terminated content as a final line.
-// It is safe to call multiple times; subsequent calls with an empty buffer are
-// no-ops.
-func (lw *lineWriter) Flush() {
-	if lw.buffer.Len() == 0 {
-		return
-	}
-	lw.handleLine(lw.buffer.String())
-	lw.buffer.Reset()
-}
-
-func (lw *lineWriter) handleLine(line string) {
-	for _, h := range lw.handlers {
-		ok := h(line)
-		if !ok {
-			break
-		}
-	}
-}

act/common/line_writer_test.go

@@ -1,72 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"io"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestLineWriter(t *testing.T) {
-	lines := make([]string, 0)
-	lineHandler := func(s string) bool {
-		lines = append(lines, s)
-		return true
-	}
-
-	lineWriter := NewLineWriter(lineHandler)
-
-	assert := assert.New(t)
-	write := func(s string) {
-		n, err := lineWriter.Write([]byte(s))
-		assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-		assert.Equal(len(s), n, s)
-	}
-
-	write("hello")
-	write(" ")
-	write("world!!\nextra")
-	write(" line\n and another\nlast")
-	write(" line\n")
-	write("no newline here...")
-
-	assert.Len(lines, 4)
-	assert.Equal("hello world!!\n", lines[0])
-	assert.Equal("extra line\n", lines[1])
-	assert.Equal(" and another\n", lines[2])
-	assert.Equal("last line\n", lines[3])
-}
-
-func TestLineWriterFlush(t *testing.T) {
-	lines := make([]string, 0)
-	lineHandler := func(s string) bool {
-		lines = append(lines, s)
-		return true
-	}
-
-	lineWriter := NewLineWriter(lineHandler)
-
-	assert := assert.New(t)
-	_, err := lineWriter.Write([]byte("complete line\npartial line without newline"))
-	assert.NoError(err) //nolint:testifylint // pre-existing pattern from nektos/act
-
-	// Only the newline-terminated line is emitted before flushing.
-	assert.Equal([]string{"complete line\n"}, lines)
-
-	// Flushing emits the buffered, not-yet-terminated trailing line.
-	FlushWriter(lineWriter)
-	assert.Equal([]string{"complete line\n", "partial line without newline"}, lines)
-
-	// Flushing again is a no-op: nothing is buffered.
-	FlushWriter(lineWriter)
-	assert.Len(lines, 2)
-}
-
-func TestFlushWriterIgnoresNonFlusher(t *testing.T) {
-	// FlushWriter must be a safe no-op for writers that do not buffer lines.
-	assert.NotPanics(t, func() { FlushWriter(io.Discard) })
-}

act/common/logger.go

@@ -1,52 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-
-	"github.com/sirupsen/logrus"
-)
-
-type loggerContextKey string
-
-const loggerContextKeyVal = loggerContextKey("logrus.FieldLogger")
-
-// Logger returns the appropriate logger for current context
-func Logger(ctx context.Context) logrus.FieldLogger {
-	val := ctx.Value(loggerContextKeyVal)
-	if val != nil {
-		if logger, ok := val.(logrus.FieldLogger); ok {
-			return logger
-		}
-	}
-	return logrus.StandardLogger()
-}
-
-// WithLogger adds a value to the context for the logger
-func WithLogger(ctx context.Context, logger logrus.FieldLogger) context.Context {
-	return context.WithValue(ctx, loggerContextKeyVal, logger)
-}
-
-type loggerHookKey string
-
-const loggerHookKeyVal = loggerHookKey("logrus.Hook")
-
-// LoggerHook returns the appropriate logger hook for current context
-// the hook affects job logger, not global logger
-func LoggerHook(ctx context.Context) logrus.Hook {
-	val := ctx.Value(loggerHookKeyVal)
-	if val != nil {
-		if hook, ok := val.(logrus.Hook); ok {
-			return hook
-		}
-	}
-	return nil
-}
-
-// WithLoggerHook adds a value to the context for the logger hook
-func WithLoggerHook(ctx context.Context, hook logrus.Hook) context.Context {
-	return context.WithValue(ctx, loggerHookKeyVal, hook)
-}

act/common/outbound_ip.go

@@ -1,81 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"net"
-	"sort"
-	"strings"
-)
-
-// GetOutboundIP returns an outbound IP address of this machine.
-// It tries to access the internet and returns the local IP address of the connection.
-// If the machine cannot access the internet, it returns a preferred IP address from network interfaces.
-// It returns nil if no IP address is found.
-func GetOutboundIP() net.IP {
-	// See https://stackoverflow.com/a/37382208
-	conn, err := net.Dial("udp", "8.8.8.8:80")
-	if err == nil {
-		defer conn.Close()
-		if addr, ok := conn.LocalAddr().(*net.UDPAddr); ok {
-			return addr.IP
-		}
-	}
-
-	// So the machine cannot access the internet. Pick an IP address from network interfaces.
-	if ifs, err := net.Interfaces(); err == nil {
-		type IP struct {
-			net.IP
-			net.Interface
-		}
-		var ips []IP
-		for _, i := range ifs {
-			if addrs, err := i.Addrs(); err == nil {
-				for _, addr := range addrs {
-					var ip net.IP
-					switch v := addr.(type) {
-					case *net.IPNet:
-						ip = v.IP
-					case *net.IPAddr:
-						ip = v.IP
-					}
-					if ip.IsGlobalUnicast() {
-						ips = append(ips, IP{ip, i})
-					}
-				}
-			}
-		}
-		if len(ips) > 1 {
-			sort.Slice(ips, func(i, j int) bool {
-				ifi := ips[i].Interface
-				ifj := ips[j].Interface
-
-				// ethernet is preferred
-				if vi, vj := strings.HasPrefix(ifi.Name, "e"), strings.HasPrefix(ifj.Name, "e"); vi != vj {
-					return vi
-				}
-
-				ipi := ips[i].IP
-				ipj := ips[j].IP
-
-				// IPv4 is preferred
-				if vi, vj := ipi.To4() != nil, ipj.To4() != nil; vi != vj {
-					return vi
-				}
-
-				// en0 is preferred to en1
-				if ifi.Name != ifj.Name {
-					return ifi.Name < ifj.Name
-				}
-
-				// fallback
-				return ipi.String() < ipj.String()
-			})
-			return ips[0].IP
-		}
-	}
-
-	return nil
-}

act/container/DOCKER_LICENSE

@@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        https://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2013-2017 Docker, Inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       https://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

act/container/container_types.go

@@ -1,131 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/docker/go-connections/nat"
-	"github.com/moby/moby/api/types/container"
-)
-
-// ExitCodeError reports a non-zero process exit code from a container command.
-type ExitCodeError int
-
-func (e ExitCodeError) Error() string {
-	return fmt.Sprintf("Process completed with exit code %d.", int(e))
-}
-
-// NewContainerInput the input for the New function
-type NewContainerInput struct {
-	Image           string
-	Username        string
-	Password        string
-	Entrypoint      []string
-	Cmd             []string
-	WorkingDir      string
-	Env             []string
-	Binds           []string
-	Mounts          map[string]string
-	Name            string
-	Stdout          io.Writer
-	Stderr          io.Writer
-	NetworkMode     string
-	Privileged      bool
-	UsernsMode      string
-	Platform        string
-	RunnerOptions   string // container options the runner was configured with, trusted
-	WorkflowOptions string // container options the workflow asked for, untrusted
-	NetworkAliases  []string
-	ExposedPorts    nat.PortSet
-	PortBindings    nat.PortMap
-
-	// Gitea specific
-	AutoRemove   bool
-	ValidVolumes []string
-	AllocatePTY  bool // allocate a pseudo-TTY for the container's exec processes
-}
-
-// FileEntry is a file to copy to a container
-type FileEntry struct {
-	Name string
-	Mode int64
-	Body string
-}
-
-// Container and healthcheck states, as plain strings so a caller of Info needs no docker
-// SDK of its own.
-const (
-	StateRunning = string(container.StateRunning)
-
-	HealthNone      = string(container.NoHealthcheck)
-	HealthStarting  = string(container.Starting)
-	HealthHealthy   = string(container.Healthy)
-	HealthUnhealthy = string(container.Unhealthy)
-)
-
-// ErrContainerNotFound reports a container the daemon no longer knows. Its text is a
-// fragment, missingContainerError composes it into the message every operation shares.
-var ErrContainerNotFound = errors.New("does not exist")
-
-// Info is a snapshot of a container, as of one inspect.
-type Info struct {
-	ID       string
-	State    string // the docker container state: "created", "running", "exited", ...
-	ExitCode int
-	Health   string // one of the Health* constants
-	// HealthOutput is the last healthcheck probe's output.
-	HealthOutput string
-	Ports        map[string]string // container port ("5432") to the host port it is published on
-}
-
-// Container for managing docker run containers
-type Container interface {
-	Create(capAdd, capDrop []string) common.Executor
-	Copy(destPath string, files ...*FileEntry) common.Executor
-	CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor
-	GetContainerArchive(ctx context.Context, srcPath string) (io.ReadCloser, error)
-	Inspect(ctx context.Context) (*Info, error)
-	DumpLogs(ctx context.Context) error
-	Pull(forcePull bool) common.Executor
-	Start(attach bool) common.Executor
-	Exec(command []string, env map[string]string, user, workdir string) common.Executor
-	UpdateFromEnv(srcPath string, env *map[string]string) common.Executor
-	UpdateFromImageEnv(env *map[string]string) common.Executor
-	Remove() common.Executor
-	Close() common.Executor
-	ReplaceLogWriter(io.Writer, io.Writer) (io.Writer, io.Writer)
-}
-
-// NewDockerBuildExecutorInput the input for the NewDockerBuildExecutor function
-type NewDockerBuildExecutorInput struct {
-	ContextDir   string
-	Dockerfile   string
-	BuildContext io.Reader
-	ImageTag     string
-	Platform     string
-	BuildArgs    map[string]*string
-}
-
-// NewDockerNetworkCreateExecutorInput the input for the NewDockerNetworkCreateExecutor function
-type NewDockerNetworkCreateExecutorInput struct {
-	EnableIPv4 *bool
-	EnableIPv6 *bool
-	RunnerUUID string
-}
-
-// NewDockerPullExecutorInput the input for the NewDockerPullExecutor function
-type NewDockerPullExecutorInput struct {
-	Image     string
-	ForcePull bool
-	Platform  string
-	Username  string
-	Password  string
-}

act/container/docker_auth.go

@@ -1,71 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/distribution/reference"
-	"github.com/docker/cli/cli/config"
-	"github.com/moby/moby/api/types/registry"
-)
-
-func LoadDockerAuthConfig(ctx context.Context, image string) (registry.AuthConfig, error) {
-	logger := common.Logger(ctx)
-	// config.LoadDefaultConfigFile panics on nil io.Writer when the config
-	// file is malformed; use config.Load to route errors through the logger.
-	cfg, err := config.Load(config.Dir())
-	if err != nil {
-		logger.Warnf("Could not load docker config: %v", err)
-		return registry.AuthConfig{}, err
-	}
-	registryKey := registryAuthConfigKey("docker.io")
-	if image != "" {
-		if registryRef, refErr := reference.ParseNormalizedNamed(image); refErr != nil {
-			logger.Warnf("Could not normalize image reference: %v", refErr)
-		} else {
-			registryKey = registryAuthConfigKey(reference.Domain(registryRef))
-		}
-	}
-
-	authConfig, err := cfg.GetAuthConfig(registryKey)
-	if err != nil {
-		logger.Warnf("Could not get auth config from docker config: %v", err)
-		return registry.AuthConfig{}, err
-	}
-
-	return registry.AuthConfig(authConfig), nil
-}
-
-func LoadDockerAuthConfigs(ctx context.Context) map[string]registry.AuthConfig {
-	logger := common.Logger(ctx)
-	cfg, err := config.Load(config.Dir())
-	if err != nil {
-		logger.Warnf("Could not load docker config: %v", err)
-		return nil
-	}
-	creds, err := cfg.GetAllCredentials()
-	if err != nil {
-		logger.Warnf("Could not get docker auth configs: %v", err)
-		return nil
-	}
-	authConfigs := make(map[string]registry.AuthConfig, len(creds))
-	for k, v := range creds {
-		authConfigs[k] = registry.AuthConfig(v)
-	}
-
-	return authConfigs
-}
-
-func registryAuthConfigKey(domainName string) string {
-	if domainName == "docker.io" || domainName == "index.docker.io" {
-		return "https://index.docker.io/v1/"
-	}
-	return domainName
-}

act/container/docker_build.go

@@ -1,128 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-	"io"
-	"os"
-	"path/filepath"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/moby/go-archive"
-	"github.com/moby/go-archive/compression"
-	"github.com/moby/moby/client"
-	"github.com/moby/patternmatcher"
-	"github.com/moby/patternmatcher/ignorefile"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// NewDockerBuildExecutor function to create a run executor for the container
-func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		if input.Platform != "" {
-			logger.Infof("docker build -t %s --platform %s %s", input.ImageTag, input.Platform, input.ContextDir)
-		} else {
-			logger.Infof("docker build -t %s %s", input.ImageTag, input.ContextDir)
-		}
-		if common.Dryrun(ctx) {
-			return nil
-		}
-
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		logger.Debugf("Building image from '%v'", input.ContextDir)
-
-		tags := []string{input.ImageTag}
-		options := client.ImageBuildOptions{
-			Tags:        tags,
-			Remove:      true,
-			AuthConfigs: LoadDockerAuthConfigs(ctx),
-			Dockerfile:  input.Dockerfile,
-			BuildArgs:   input.BuildArgs,
-		}
-		platform, err := parsePlatform(input.Platform)
-		if err != nil {
-			return err
-		}
-		if platform != nil {
-			options.Platforms = []specs.Platform{*platform}
-		}
-		var buildContext io.ReadCloser
-		if input.BuildContext != nil {
-			buildContext = io.NopCloser(input.BuildContext)
-		} else {
-			buildContext, err = createBuildContext(ctx, input.ContextDir, input.Dockerfile)
-		}
-		if err != nil {
-			return err
-		}
-
-		defer buildContext.Close()
-
-		logger.Debugf("Creating image from context dir '%s' with tag '%s' and platform '%s'", input.ContextDir, input.ImageTag, input.Platform)
-		resp, err := cli.ImageBuild(ctx, buildContext, options)
-
-		err = logDockerResponse(logger, resp.Body, err != nil)
-		if err != nil {
-			return err
-		}
-		return nil
-	}
-}
-
-func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (io.ReadCloser, error) {
-	common.Logger(ctx).Debugf("Creating archive for build context dir '%s' with relative dockerfile '%s'", contextDir, relDockerfile)
-
-	// And canonicalize dockerfile name to a platform-independent one
-	relDockerfile = filepath.ToSlash(relDockerfile)
-
-	f, err := os.Open(filepath.Join(contextDir, ".dockerignore"))
-	if err != nil && !os.IsNotExist(err) {
-		return nil, err
-	}
-	defer f.Close()
-
-	var excludes []string
-	if err == nil {
-		excludes, err = ignorefile.ReadAll(f)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// If .dockerignore mentions .dockerignore or the Dockerfile
-	// then make sure we send both files over to the daemon
-	// because Dockerfile is, obviously, needed no matter what, and
-	// .dockerignore is needed to know if either one needs to be
-	// removed. The daemon will remove them for us, if needed, after it
-	// parses the Dockerfile. Ignore errors here, as they will have been
-	// caught by validateContextDirectory above.
-	includes := []string{"."}
-	keepThem1, _ := patternmatcher.Matches(".dockerignore", excludes)
-	keepThem2, _ := patternmatcher.Matches(relDockerfile, excludes)
-	if keepThem1 || keepThem2 {
-		includes = append(includes, ".dockerignore", relDockerfile)
-	}
-
-	buildCtx, err := archive.TarWithOptions(contextDir, &archive.TarOptions{
-		Compression:     compression.None,
-		ExcludePatterns: excludes,
-		IncludeFiles:    includes,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return buildCtx, nil
-}

act/container/docker_create_flags.go

@@ -1,113 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"slices"
-	"strings"
-
-	"github.com/docker/cli/opts"
-	"github.com/kballard/go-shellquote"
-	"github.com/spf13/pflag"
-)
-
-const (
-	pullPolicyAlways  = "always"
-	pullPolicyMissing = "missing"
-	pullPolicyNever   = "never"
-)
-
-var pullPolicies = []string{pullPolicyAlways, pullPolicyMissing, pullPolicyNever}
-
-// createFlags are the flags docker/cli registers on the `create` and `run` commands
-// instead of in addFlags, so they are not part of containerOptions.
-type createFlags struct {
-	platform     string
-	pull         string
-	name         string
-	useAPISocket bool
-}
-
-func registerCreateFlags(flags *pflag.FlagSet) *createFlags {
-	cf := new(createFlags)
-	flags.StringVar(&cf.platform, "platform", "", "Set platform if server is multi-platform capable")
-	flags.StringVar(&cf.pull, "pull", pullPolicyMissing, `Pull image before creating ("always", "missing", "never")`)
-	flags.StringVar(&cf.name, "name", "", "Assign a name to the container")
-	flags.BoolVar(&cf.useAPISocket, "use-api-socket", false, "Bind mount Docker API socket and required auth")
-	// Accepted without effect: pull progress is only logged at debug level, and docker
-	// no longer implements content trust.
-	flags.BoolP("quiet", "q", false, "Suppress the pull output")
-	flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
-	return cf
-}
-
-// parseContainerOptions parses a container options string. The flags are returned even
-// on error, holding whatever was read before the failure.
-func parseContainerOptions(options string) (*pflag.FlagSet, *containerOptions, *createFlags, error) {
-	flags := pflag.NewFlagSet("container_flags", pflag.ContinueOnError)
-	flags.SetOutput(io.Discard)
-	copts := addFlags(flags)
-	copts.env = opts.NewListOpts(validateEnv) // addFlags registered this field's address, so the swap takes effect
-	cf := registerCreateFlags(flags)
-
-	args, err := shellquote.Split(options)
-	if err != nil {
-		return flags, copts, cf, fmt.Errorf("cannot split container options: '%s': '%w'", options, err)
-	}
-
-	if err := flags.Parse(args); err != nil {
-		return flags, copts, cf, fmt.Errorf("cannot parse container options: '%s': '%w'", options, err)
-	}
-
-	return flags, copts, cf, nil
-}
-
-// createFlagsFromOptions reads the create-level flags that have to be known before the
-// container is created. Malformed options keep the defaults here and are reported by
-// mergeContainerConfigs at create time.
-func createFlagsFromOptions(options string) *createFlags {
-	_, _, cf, _ := parseContainerOptions(options)
-	return cf
-}
-
-// validateEnv is opts.ValidateEnv without its lookup of a bare name in the runner's environment.
-func validateEnv(val string) (string, error) {
-	if name, _, _ := strings.Cut(val, "="); name == "" {
-		return "", errors.New("invalid environment variable: " + val)
-	}
-	return val, nil
-}
-
-// rejectHostReadingOptions refuses the flags naming files that are read here, on the
-// runner, rather than in the container.
-func rejectHostReadingOptions(options string) error {
-	flags, _, _, err := parseContainerOptions(options)
-	if err != nil {
-		return err
-	}
-
-	for _, name := range []string{"env-file", "label-file"} {
-		if flags.Changed(name) {
-			return fmt.Errorf("container option --%s reads files from the runner and is not allowed in a workflow", name)
-		}
-	}
-	return nil
-}
-
-func (cf *createFlags) validate() error {
-	if !slices.Contains(pullPolicies, cf.pull) {
-		return fmt.Errorf("invalid --pull option %q: must be one of %q", cf.pull, pullPolicies)
-	}
-
-	if cf.useAPISocket {
-		return errors.New("--use-api-socket is not supported, use the runner's container.docker_host setting to expose a docker socket")
-	}
-
-	return nil
-}

act/container/docker_create_flags_test.go

@@ -1,62 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCreateFlagsFromOptions(t *testing.T) {
-	for _, tc := range []struct {
-		options  string
-		platform string
-		pull     string
-	}{
-		{"", "", pullPolicyMissing},
-		{"-v /a:/b --platform=linux/arm64 --pull always", "linux/arm64", pullPolicyAlways},
-		{"--platform linux/arm/v7 --pull never", "linux/arm/v7", pullPolicyNever},
-		{`--platform "linux/amd64`, "", pullPolicyMissing}, // malformed, defaults kept
-	} {
-		t.Run(tc.options, func(t *testing.T) {
-			cf := createFlagsFromOptions(tc.options)
-			assert.Equal(t, tc.platform, cf.platform)
-			assert.Equal(t, tc.pull, cf.pull)
-		})
-	}
-}
-
-func TestCreateFlagsValidate(t *testing.T) {
-	for _, tc := range []struct {
-		options string
-		wantErr string
-	}{
-		{"--quiet --disable-content-trust --name mine", ""},
-		{"--pull sometimes", `invalid --pull option "sometimes"`},
-		{"--use-api-socket", "--use-api-socket is not supported"},
-	} {
-		t.Run(tc.options, func(t *testing.T) {
-			err := createFlagsFromOptions(tc.options).validate()
-			if tc.wantErr == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tc.wantErr)
-		})
-	}
-}
-
-func TestNewContainerAppliesCreateFlags(t *testing.T) {
-	input := &NewContainerInput{Platform: "linux/amd64", RunnerOptions: "--pull never", WorkflowOptions: "--platform linux/arm64"}
-	cr, ok := NewContainer(input).(*containerReference)
-	require.True(t, ok)
-	assert.Equal(t, "linux/arm64", input.Platform)
-	assert.Equal(t, pullPolicyNever, cr.pullPolicy)
-
-	kept := &NewContainerInput{Platform: "linux/amd64", RunnerOptions: "--privileged"}
-	NewContainer(kept)
-	assert.Equal(t, "linux/amd64", kept.Platform)
-}

act/container/docker_images.go

@@ -1,64 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-	"fmt"
-
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/client"
-)
-
-// ImageExistsLocally returns a boolean indicating if an image with the
-// requested name, tag and architecture exists in the local docker image store
-func ImageExistsLocally(ctx context.Context, imageName, platform string) (bool, error) {
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		return false, err
-	}
-	defer cli.Close()
-
-	inspectImage, err := cli.ImageInspect(ctx, imageName)
-	if cerrdefs.IsNotFound(err) {
-		return false, nil
-	} else if err != nil {
-		return false, err
-	}
-
-	if platform == "" || platform == "any" || fmt.Sprintf("%s/%s", inspectImage.Os, inspectImage.Architecture) == platform {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-// RemoveImage removes image from local store, the function is used to run different
-// container image architectures
-func RemoveImage(ctx context.Context, imageName string, force, pruneChildren bool) (bool, error) {
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		return false, err
-	}
-	defer cli.Close()
-
-	inspectImage, err := cli.ImageInspect(ctx, imageName)
-	if cerrdefs.IsNotFound(err) {
-		return false, nil
-	} else if err != nil {
-		return false, err
-	}
-
-	if _, err = cli.ImageRemove(ctx, inspectImage.ID, client.ImageRemoveOptions{
-		Force:         force,
-		PruneChildren: pruneChildren,
-	}); err != nil {
-		return false, err
-	}
-
-	return true, nil
-}

act/container/docker_images_test.go

@@ -1,69 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func init() {
-	log.SetLevel(log.DebugLevel)
-}
-
-// buildScratchImage builds a tiny empty image for the given platform locally (FROM scratch, no
-// network or emulation since there is nothing to run) and returns its tag, removing it after
-// the test.
-func buildScratchImage(t *testing.T, platform string) string {
-	t.Helper()
-	tag := fmt.Sprintf("act-test-exists-%s:latest", strings.TrimPrefix(platform, "linux/"))
-	cmd := exec.Command("docker", "build", "--platform", platform, "-t", tag, "-")
-	cmd.Stdin = strings.NewReader("FROM scratch\nLABEL act-test=1\n")
-	// Force BuildKit: it records the requested architecture in the image config for a
-	// FROM-scratch build, whereas the classic builder ignores --platform and tags it with the
-	// host arch, which would break the per-platform existence assertions below.
-	cmd.Env = append(os.Environ(), "DOCKER_BUILDKIT=1")
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
-	t.Cleanup(func() { _ = exec.Command("docker", "rmi", "-f", tag).Run() })
-	return tag
-}
-
-func TestImageExistsLocally(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-
-	// a non-existent image is reported absent
-	missing, err := ImageExistsLocally(ctx, "library/alpine:this-random-tag-will-never-exist", "linux/amd64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, missing)
-
-	// Build tiny images for two architectures locally so per-platform existence can be checked
-	// offline (formerly pulled node:24-bookworm-slim for amd64 and arm64 over the network).
-	amd64Ref := buildScratchImage(t, "linux/amd64")
-	arm64Ref := buildScratchImage(t, "linux/arm64")
-
-	amd64Exists, err := ImageExistsLocally(ctx, amd64Ref, "linux/amd64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, amd64Exists)
-
-	// a non-host architecture image is detected for its own architecture
-	arm64Exists, err := ImageExistsLocally(ctx, arm64Ref, "linux/arm64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, arm64Exists)
-
-	// a present image is reported absent for a different platform
-	wrongPlatform, err := ImageExistsLocally(ctx, amd64Ref, "linux/arm64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, wrongPlatform)
-}

act/container/docker_logger.go

@@ -1,86 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"bufio"
-	"encoding/json/v2"
-	"errors"
-	"io"
-
-	"github.com/sirupsen/logrus"
-)
-
-type dockerMessage struct {
-	ID          string `json:"id"`
-	Stream      string `json:"stream"`
-	Error       string `json:"error"`
-	ErrorDetail struct {
-		Message string `json:"message"`
-	} `json:"errorDetail"`
-	Status   string `json:"status"`
-	Progress string `json:"progress"`
-}
-
-func logDockerResponse(logger logrus.FieldLogger, dockerResponse io.ReadCloser, isError bool) error {
-	if dockerResponse == nil {
-		return nil
-	}
-	defer dockerResponse.Close()
-
-	scanner := bufio.NewScanner(dockerResponse)
-	msg := dockerMessage{}
-
-	for scanner.Scan() {
-		line := scanner.Bytes()
-
-		msg.ID = ""
-		msg.Stream = ""
-		msg.Error = ""
-		msg.ErrorDetail.Message = ""
-		msg.Status = ""
-		msg.Progress = ""
-
-		if err := json.Unmarshal(line, &msg); err != nil {
-			writeLog(logger, false, "Unable to unmarshal line [%s] ==> %v", string(line), err)
-			continue
-		}
-
-		if msg.Error != "" {
-			writeLog(logger, isError, "%s", msg.Error)
-			return errors.New(msg.Error)
-		}
-
-		if msg.ErrorDetail.Message != "" {
-			writeLog(logger, isError, "%s", msg.ErrorDetail.Message)
-			return errors.New(msg.ErrorDetail.Message)
-		}
-
-		switch {
-		case msg.Status != "":
-			if msg.Progress != "" {
-				writeLog(logger, isError, "%s :: %s :: %s\n", msg.Status, msg.ID, msg.Progress)
-			} else {
-				writeLog(logger, isError, "%s :: %s\n", msg.Status, msg.ID)
-			}
-		case msg.Stream != "":
-			writeLog(logger, isError, "%s", msg.Stream)
-		default:
-			writeLog(logger, false, "Unable to handle line: %s", string(line))
-		}
-	}
-
-	return nil
-}
-
-func writeLog(logger logrus.FieldLogger, isError bool, format string, args ...any) {
-	if isError {
-		logger.Errorf(format, args...)
-	} else {
-		logger.Debugf(format, args...)
-	}
-}

act/container/docker_network.go

@@ -1,174 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/moby/moby/client"
-)
-
-const (
-	networkCreateAttempts   = 3
-	networkCreateRetryDelay = time.Second
-
-	// marks the networks a runner creates for its jobs, so it can tell its own leftovers from
-	// those of another runner sharing the daemon
-	runnerUUIDLabel = "com.gitea.runner.uuid"
-)
-
-// RemoveOrphanNetworks removes the networks this runner created for jobs whose teardown did
-// not get to them: the runner died with the job, the teardown timed out, or the network still
-// had an endpoint on it at the time. Each one holds a subnet of the daemon's address pool
-// until it is removed. Networks created after createdBefore are left alone, so a job starting
-// while this runs cannot lose the network it has created but not yet attached a container to.
-func RemoveOrphanNetworks(ctx context.Context, runnerUUID string, createdBefore time.Time) error {
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to connect to the docker daemon: %w", err)
-	}
-	defer cli.Close()
-
-	return removeOrphanNetworks(ctx, cli, runnerUUID, createdBefore)
-}
-
-func removeOrphanNetworks(ctx context.Context, cli client.APIClient, runnerUUID string, createdBefore time.Time) error {
-	networks, err := cli.NetworkList(ctx, client.NetworkListOptions{
-		Filters: make(client.Filters).Add("label", runnerUUIDLabel+"="+runnerUUID),
-	})
-	if err != nil {
-		return err
-	}
-
-	var errs []error
-	for _, n := range networks.Items {
-		result, err := cli.NetworkInspect(ctx, n.ID, client.NetworkInspectOptions{})
-		if err != nil {
-			errs = append(errs, fmt.Errorf("failed to inspect network %s: %w", n.Name, err))
-			continue
-		}
-		// the emptiness check, not the label, is what keeps a live job of another process
-		// sharing this registration safe
-		if len(result.Network.Containers) != 0 || result.Network.Created.After(createdBefore) {
-			continue
-		}
-		if _, err := cli.NetworkRemove(ctx, n.ID, client.NetworkRemoveOptions{}); err != nil {
-			errs = append(errs, fmt.Errorf("failed to remove network %s: %w", n.Name, err))
-			continue
-		}
-		common.Logger(ctx).Infof("removed docker network %s left behind by an earlier job", n.Name)
-	}
-	return errors.Join(errs...)
-}
-
-func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		// Only create the network if it doesn't exist
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
-		if err != nil {
-			return err
-		}
-		// For Gitea, reduce log noise
-		// common.Logger(ctx).Debugf("%v", networks)
-		for _, n := range networks.Items {
-			if n.Name == name {
-				common.Logger(ctx).Debugf("Network %v exists", name)
-				return nil
-			}
-		}
-
-		for i := range networkCreateAttempts {
-			if i > 0 {
-				common.Logger(ctx).Infof("Waiting for a free docker address pool to create network %s", name)
-				select {
-				case <-ctx.Done():
-					return ctx.Err()
-				case <-time.After(time.Duration(i) * networkCreateRetryDelay):
-				}
-			}
-			if _, err = cli.NetworkCreate(ctx, name, client.NetworkCreateOptions{
-				Driver:     "bridge",
-				Scope:      "local",
-				EnableIPv4: opts.EnableIPv4,
-				EnableIPv6: opts.EnableIPv6,
-				Labels:     runnerLabels(opts.RunnerUUID),
-			}); err == nil {
-				return nil
-			}
-			if !isAddressPoolExhausted(err) {
-				return err
-			}
-		}
-		return fmt.Errorf("docker has no address pool left for this job's network, lower runner.capacity or widen default-address-pools in the docker daemon config: %w", err)
-	}
-}
-
-func runnerLabels(runnerUUID string) map[string]string {
-	if runnerUUID == "" {
-		return nil
-	}
-	return map[string]string{runnerUUIDLabel: runnerUUID}
-}
-
-// The daemon reports this as a plain invalid-parameter error, the same kind it uses for every
-// malformed request, so the message is the only discriminator.
-func isAddressPoolExhausted(err error) bool {
-	msg := err.Error()
-	return strings.Contains(msg, "all predefined address pools have been fully subnetted") ||
-		strings.Contains(msg, "could not find an available, non-overlapping IPv4 address pool among the defaults") // docker 24 and older
-}
-
-func NewDockerNetworkRemoveExecutor(name string) common.Executor {
-	return func(ctx context.Context) error {
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		// Make sure that all network of the specified name are removed
-		// cli.NetworkRemove refuses to remove a network if there are duplicates
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
-		if err != nil {
-			return err
-		}
-		// For Gitea, reduce log noise
-		// common.Logger(ctx).Debugf("%v", networks)
-		var errs []error
-		for _, n := range networks.Items {
-			if n.Name == name {
-				result, err := cli.NetworkInspect(ctx, n.ID, client.NetworkInspectOptions{})
-				if err != nil {
-					return err
-				}
-
-				// it holds a subnet out of the daemon's pool until something reclaims it
-				if len(result.Network.Containers) != 0 {
-					common.Logger(ctx).Warnf("Refusing to remove network %s because it still has active endpoints, the idle cleanup reclaims it once they are gone", name)
-					continue
-				}
-				if _, err = cli.NetworkRemove(ctx, n.ID, client.NetworkRemoveOptions{}); err != nil {
-					errs = append(errs, fmt.Errorf("failed to remove network %s: %w", name, err))
-				}
-			}
-		}
-
-		return errors.Join(errs...)
-	}
-}

act/container/docker_network_test.go

@@ -1,50 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/types/network"
-	mobyclient "github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestIsAddressPoolExhausted(t *testing.T) {
-	assert.True(t, isAddressPoolExhausted(cerrdefs.ErrInvalidArgument.WithMessage("Error response from daemon: all predefined address pools have been fully subnetted")))
-	assert.True(t, isAddressPoolExhausted(errors.New("could not find an available, non-overlapping IPv4 address pool among the defaults to assign to the network")))
-	assert.False(t, isAddressPoolExhausted(cerrdefs.ErrInvalidArgument.WithMessage("invalid subnet 10.0.0.0/8: it overlaps with an existing network")))
-}
-
-// Of this runner's networks, only the ones nothing is attached to and old enough to predate
-// any job now starting are the runner's to reclaim. An unexpected NetworkRemove fails the
-// test on its own, since testify has no expectation to match it against.
-func TestRemoveOrphanNetworks(t *testing.T) {
-	ctx := context.Background()
-	cutoff := time.Date(2026, time.April, 29, 20, 0, 0, 0, time.UTC)
-	client := &mockDockerClient{}
-	client.On("NetworkList", ctx, mobyclient.NetworkListOptions{
-		Filters: make(mobyclient.Filters).Add("label", runnerUUIDLabel+"=runner-1"),
-	}).Return(mobyclient.NetworkListResult{Items: []network.Summary{
-		{ID: "orphan"},
-		{ID: "busy"},
-		{ID: "starting"},
-	}}, nil)
-	client.On("NetworkInspect", ctx, "orphan", mobyclient.NetworkInspectOptions{}).
-		Return(mobyclient.NetworkInspectResult{}, nil)
-	client.On("NetworkInspect", ctx, "busy", mobyclient.NetworkInspectOptions{}).
-		Return(mobyclient.NetworkInspectResult{Network: network.Inspect{Containers: map[string]network.EndpointResource{"c": {}}}}, nil)
-	client.On("NetworkInspect", ctx, "starting", mobyclient.NetworkInspectOptions{}).
-		Return(mobyclient.NetworkInspectResult{Network: network.Inspect{Network: network.Network{Created: cutoff.Add(time.Second)}}}, nil)
-	client.On("NetworkRemove", ctx, "orphan", mobyclient.NetworkRemoveOptions{}).
-		Return(mobyclient.NetworkRemoveResult{}, nil)
-
-	require.NoError(t, removeOrphanNetworks(ctx, client, "runner-1", cutoff))
-	client.AssertExpectations(t)
-}

act/container/docker_platform.go

@@ -1,39 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// Copyright 2025 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"fmt"
-	"strings"
-
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// parsePlatform parses an "os/arch[/variant]" string into a Platform. An empty input
-// returns (nil, nil), meaning "no platform constraint". A non-empty but malformed
-// string is rejected explicitly so it cannot silently fall through to the daemon's
-// default architecture.
-func parsePlatform(platform string) (*specs.Platform, error) {
-	if platform == "" {
-		return nil, nil //nolint:nilnil // no platform constraint requested
-	}
-
-	parts := strings.Split(platform, "/")
-	if len(parts) < 2 || len(parts) > 3 || parts[0] == "" || parts[1] == "" || (len(parts) == 3 && parts[2] == "") {
-		return nil, fmt.Errorf("invalid platform %q: expected os/arch[/variant]", platform)
-	}
-
-	spec := &specs.Platform{
-		OS:           strings.ToLower(parts[0]),
-		Architecture: strings.ToLower(parts[1]),
-	}
-	if len(parts) == 3 {
-		spec.Variant = strings.ToLower(parts[2])
-	}
-
-	return spec, nil
-}

act/container/docker_platform_test.go

@@ -1,63 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParsePlatform(t *testing.T) {
-	t.Run("empty input returns nil platform without error", func(t *testing.T) {
-		got, err := parsePlatform("")
-		require.NoError(t, err)
-		assert.Nil(t, got)
-	})
-
-	t.Run("os/arch", func(t *testing.T) {
-		got, err := parsePlatform("linux/amd64")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Empty(t, got.Variant)
-	})
-
-	t.Run("os/arch/variant", func(t *testing.T) {
-		got, err := parsePlatform("linux/arm/v7")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "arm", got.Architecture)
-		assert.Equal(t, "v7", got.Variant)
-	})
-
-	t.Run("input is lowercased", func(t *testing.T) {
-		got, err := parsePlatform("Linux/AMD64/V8")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Equal(t, "v8", got.Variant)
-	})
-
-	for _, bad := range []string{
-		"amd64",
-		"linux",
-		"linux/",
-		"/amd64",
-		"/",
-		"//",
-		"linux/arm/",
-		"linux/arm/v7/extra",
-	} {
-		t.Run("rejects "+bad, func(t *testing.T) {
-			got, err := parsePlatform(bad)
-			require.Error(t, err)
-			assert.Nil(t, got)
-		})
-	}
-}

act/container/docker_pull.go

@@ -1,148 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/distribution/reference"
-	"github.com/moby/moby/api/pkg/authconfig"
-	"github.com/moby/moby/api/types/registry"
-	"github.com/moby/moby/client"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// NewDockerPullExecutor function to create a run executor for the container
-func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		logger.Debugf("docker pull %v", input.Image)
-
-		if common.Dryrun(ctx) {
-			return nil
-		}
-
-		// skip the pull when the image is already here: either none was forced, or a digest
-		// pins the content so a forced pull could only fetch the same bytes again
-		if !input.ForcePull || isPinnedImage(input.Image) {
-			imageExists, err := ImageExistsLocally(ctx, input.Image, input.Platform)
-			logger.Debugf("Image exists? %v", imageExists)
-			if err != nil {
-				return fmt.Errorf("unable to determine if image already exists for image '%s' (%s): %w", input.Image, input.Platform, err)
-			}
-			if imageExists {
-				return nil
-			}
-		}
-
-		imageRef := cleanImage(ctx, input.Image)
-		logger.Debugf("pulling image '%v' (%s)", imageRef, input.Platform)
-
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		imagePullOptions, err := getImagePullOptions(ctx, input)
-		if err != nil {
-			return err
-		}
-
-		// the daemon reports a failure that happens after the first progress line in the
-		// stream rather than on the call itself, so both have to be checked
-		pullOnce := func(opts client.ImagePullOptions) error {
-			reader, err := cli.ImagePull(ctx, imageRef, opts)
-			streamErr := logDockerResponse(logger, reader, err != nil)
-			if err != nil {
-				return err
-			}
-			return streamErr
-		}
-
-		err = pullOnce(imagePullOptions)
-		if err != nil && imagePullOptions.RegistryAuth != "" && strings.Contains(err.Error(), "unauthorized") {
-			logger.Errorf("pulling image '%v' (%s) failed with credentials %s retrying without them, please check for stale docker config files", imageRef, input.Platform, err.Error())
-			imagePullOptions.RegistryAuth = ""
-			err = pullOnce(imagePullOptions)
-		}
-		if err == nil {
-			return nil
-		}
-		// a registry that is down should not fail a job whose image is already here
-		if exists, existsErr := ImageExistsLocally(ctx, input.Image, input.Platform); existsErr == nil && exists {
-			logger.Warnf("could not update image '%s' (%s), continuing with the local copy: %v", imageRef, input.Platform, err)
-			return nil
-		}
-		return fmt.Errorf("failed to pull image '%s' (%s): %w", imageRef, input.Platform, err)
-	}
-}
-
-func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput) (client.ImagePullOptions, error) {
-	imagePullOptions := client.ImagePullOptions{}
-	platform, err := parsePlatform(input.Platform)
-	if err != nil {
-		return imagePullOptions, err
-	}
-	if platform != nil {
-		imagePullOptions.Platforms = []specs.Platform{*platform}
-	}
-	logger := common.Logger(ctx)
-
-	if input.Username != "" && input.Password != "" {
-		logger.Debugf("using authentication for docker pull")
-
-		encodedAuth, err := authconfig.Encode(registry.AuthConfig{
-			Username: input.Username,
-			Password: input.Password,
-		})
-		if err != nil {
-			return imagePullOptions, err
-		}
-
-		imagePullOptions.RegistryAuth = encodedAuth
-	} else {
-		authConfig, err := LoadDockerAuthConfig(ctx, input.Image)
-		if err != nil {
-			return imagePullOptions, err
-		}
-		if authConfig.Username == "" && authConfig.Password == "" {
-			return imagePullOptions, nil
-		}
-		logger.Info("using DockerAuthConfig authentication for docker pull")
-
-		imagePullOptions.RegistryAuth, err = authconfig.Encode(authConfig)
-		if err != nil {
-			return imagePullOptions, err
-		}
-	}
-
-	return imagePullOptions, nil
-}
-
-func isPinnedImage(image string) bool {
-	ref, err := reference.ParseAnyReference(image)
-	if err != nil {
-		return false
-	}
-	_, pinned := ref.(reference.Canonical)
-	return pinned
-}
-
-func cleanImage(ctx context.Context, imageName string) string {
-	ref, err := reference.ParseAnyReference(imageName)
-	if err != nil {
-		common.Logger(ctx).Error(err)
-		return ""
-	}
-
-	return ref.String()
-}

act/container/docker_pull_test.go

@@ -1,89 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/docker/cli/cli/config"
-	log "github.com/sirupsen/logrus"
-	"github.com/sirupsen/logrus/hooks/test"
-	assert "github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func init() {
-	log.SetLevel(log.DebugLevel)
-}
-
-func TestCleanImage(t *testing.T) {
-	tables := []struct {
-		imageIn  string
-		imageOut string
-	}{
-		{"myhost.com/foo/bar", "myhost.com/foo/bar"},
-		{"localhost:8000/canonical/ubuntu", "localhost:8000/canonical/ubuntu"},
-		{"localhost/canonical/ubuntu:latest", "localhost/canonical/ubuntu:latest"},
-		{"localhost:8000/canonical/ubuntu:latest", "localhost:8000/canonical/ubuntu:latest"},
-		{"ubuntu", "docker.io/library/ubuntu"},
-		{"ubuntu:18.04", "docker.io/library/ubuntu:18.04"},
-		{"cibuilds/hugo:0.53", "docker.io/cibuilds/hugo:0.53"},
-	}
-
-	for _, table := range tables {
-		imageOut := cleanImage(context.Background(), table.imageIn)
-		assert.Equal(t, table.imageOut, imageOut)
-	}
-}
-
-func TestGetImagePullOptions(t *testing.T) {
-	ctx := context.Background()
-
-	orig := config.Dir()
-	t.Cleanup(func() { config.SetDir(orig) })
-
-	config.SetDir("/non-existent/docker")
-
-	options, err := getImagePullOptions(ctx, NewDockerPullExecutorInput{})
-	assert.NoError(t, err, "Failed to create ImagePullOptions")                                                 //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, "", options.RegistryAuth, "RegistryAuth should be empty if no username or password is set") //nolint:testifylint // pre-existing issue from nektos/act
-
-	options, err = getImagePullOptions(ctx, NewDockerPullExecutorInput{
-		Image:    "",
-		Username: "username",
-		Password: "password",
-	})
-	assert.NoError(t, err, "Failed to create ImagePullOptions") //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, "eyJ1c2VybmFtZSI6InVzZXJuYW1lIiwicGFzc3dvcmQiOiJwYXNzd29yZCJ9", options.RegistryAuth, "Username and Password should be provided")
-
-	config.SetDir("testdata/docker-pull-options")
-
-	options, err = getImagePullOptions(ctx, NewDockerPullExecutorInput{
-		Image: "nektos/act",
-	})
-	assert.NoError(t, err, "Failed to create ImagePullOptions") //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, "eyJ1c2VybmFtZSI6InVzZXJuYW1lIiwicGFzc3dvcmQiOiJwYXNzd29yZFxuIiwic2VydmVyYWRkcmVzcyI6Imh0dHBzOi8vaW5kZXguZG9ja2VyLmlvL3YxLyJ9", options.RegistryAuth, "RegistryAuth should be taken from local docker config")
-}
-
-// A digest-pinned image is immutable, so its local copy is always current.
-func TestIsPinnedImage(t *testing.T) {
-	assert.True(t, isPinnedImage("alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"))
-	assert.False(t, isPinnedImage("alpine:latest"))
-}
-
-// The pull path reports a failure the daemon sent mid-stream, so it must carry the reason
-// whichever of the two shapes the daemon used.
-func TestLogDockerResponseError(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-	streamErr := func(line string) error {
-		return logDockerResponse(logger, io.NopCloser(strings.NewReader(line)), false)
-	}
-	require.EqualError(t, streamErr(`{"error":"toomanyrequests: rate limit exceeded"}`), "toomanyrequests: rate limit exceeded")
-	require.EqualError(t, streamErr(`{"errorDetail":{"message":"unexpected EOF"}}`), "unexpected EOF")
-	require.NoError(t, streamErr(`{"status":"Downloading"}`))
-}

act/container/docker_run_test.go

@@ -1,857 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/binary"
-	"errors"
-	"io"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"gitea.com/gitea/runner/act/common"
-
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/pkg/stdcopy"
-	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/mount"
-	"github.com/moby/moby/api/types/network"
-	mobyclient "github.com/moby/moby/client"
-	"github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDocker(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-	client, err := GetDockerClient(ctx)
-	require.NoError(t, err)
-	defer client.Close()
-
-	dockerBuild := NewDockerBuildExecutor(NewDockerBuildExecutorInput{
-		ContextDir: "testdata",
-		ImageTag:   "envmergetest",
-	})
-
-	err = dockerBuild(ctx)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-	cr := &containerReference{
-		cli: client,
-		input: &NewContainerInput{
-			Image: "envmergetest",
-		},
-	}
-	env := map[string]string{
-		"PATH":         "/usr/local/bin:/usr/bin:/usr/sbin:/bin:/sbin",
-		"RANDOM_VAR":   "WITH_VALUE",
-		"ANOTHER_VAR":  "",
-		"CONFLICT_VAR": "I_EXIST_IN_MULTIPLE_PLACES",
-	}
-
-	envExecutor := cr.extractFromImageEnv(&env)
-	err = envExecutor(ctx)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, map[string]string{
-		"PATH":            "/usr/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/this/path/does/not/exists/anywhere:/this/either",
-		"RANDOM_VAR":      "WITH_VALUE",
-		"ANOTHER_VAR":     "",
-		"SOME_RANDOM_VAR": "",
-		"ANOTHER_ONE":     "BUT_I_HAVE_VALUE",
-		"CONFLICT_VAR":    "I_EXIST_IN_MULTIPLE_PLACES",
-	}, env)
-}
-
-type mockDockerClient struct {
-	mobyclient.APIClient
-	mock.Mock
-}
-
-func (m *mockDockerClient) ServerVersion(ctx context.Context, opts mobyclient.ServerVersionOptions) (mobyclient.ServerVersionResult, error) {
-	args := m.Called(ctx, opts)
-	return args.Get(0).(mobyclient.ServerVersionResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ExecCreate(ctx context.Context, id string, opts mobyclient.ExecCreateOptions) (mobyclient.ExecCreateResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecCreateResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ExecAttach(ctx context.Context, id string, opts mobyclient.ExecAttachOptions) (mobyclient.ExecAttachResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecAttachResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ExecInspect(ctx context.Context, execID string, opts mobyclient.ExecInspectOptions) (mobyclient.ExecInspectResult, error) {
-	args := m.Called(ctx, execID, opts)
-	return args.Get(0).(mobyclient.ExecInspectResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerAttach(ctx context.Context, containerID string, opts mobyclient.ContainerAttachOptions) (mobyclient.ContainerAttachResult, error) {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerAttachResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerWait(ctx context.Context, containerID string, opts mobyclient.ContainerWaitOptions) mobyclient.ContainerWaitResult {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerWaitResult)
-}
-
-func (m *mockDockerClient) CopyToContainer(ctx context.Context, id string, options mobyclient.CopyToContainerOptions) (mobyclient.CopyToContainerResult, error) {
-	args := m.Called(ctx, id, options)
-	return args.Get(0).(mobyclient.CopyToContainerResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerInspect(ctx context.Context, id string, opts mobyclient.ContainerInspectOptions) (mobyclient.ContainerInspectResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerInspectResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerList(ctx context.Context, opts mobyclient.ContainerListOptions) (mobyclient.ContainerListResult, error) {
-	args := m.Called(ctx, opts)
-	return args.Get(0).(mobyclient.ContainerListResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerRemove(ctx context.Context, id string, opts mobyclient.ContainerRemoveOptions) (mobyclient.ContainerRemoveResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerRemoveResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerKill(ctx context.Context, id string, opts mobyclient.ContainerKillOptions) (mobyclient.ContainerKillResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerKillResult), args.Error(1)
-}
-
-func (m *mockDockerClient) NetworkList(ctx context.Context, opts mobyclient.NetworkListOptions) (mobyclient.NetworkListResult, error) {
-	args := m.Called(ctx, opts)
-	return args.Get(0).(mobyclient.NetworkListResult), args.Error(1)
-}
-
-func (m *mockDockerClient) NetworkInspect(ctx context.Context, id string, opts mobyclient.NetworkInspectOptions) (mobyclient.NetworkInspectResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.NetworkInspectResult), args.Error(1)
-}
-
-func (m *mockDockerClient) NetworkRemove(ctx context.Context, id string, opts mobyclient.NetworkRemoveOptions) (mobyclient.NetworkRemoveResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.NetworkRemoveResult), args.Error(1)
-}
-
-type interruptReader struct {
-	started     chan struct{}
-	interrupted chan struct{}
-	stopped     chan struct{}
-}
-
-func (r *interruptReader) Read(_ []byte) (int, error) {
-	close(r.started)
-	<-r.interrupted
-	close(r.stopped)
-	return 0, io.EOF
-}
-
-type mockConn struct {
-	net.Conn
-	mock.Mock
-}
-
-func (m *mockConn) Write(b []byte) (n int, err error) {
-	args := m.Called(b)
-	return args.Int(0), args.Error(1)
-}
-
-func (m *mockConn) Close() (err error) {
-	return nil
-}
-
-func TestDockerExecAbort(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-
-	reader := &interruptReader{started: make(chan struct{}), interrupted: make(chan struct{}), stopped: make(chan struct{})}
-	conn := &mockConn{}
-	conn.On("Write", []byte{3}).
-		Run(func(mock.Arguments) { close(reader.interrupted) }).
-		Return(1, nil)
-
-	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
-		Conn:   conn,
-		Reader: bufio.NewReader(reader),
-	}, nil)
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	channel := make(chan error)
-
-	go func() {
-		channel <- cr.exec([]string{""}, map[string]string{}, "user", "workdir")(ctx)
-	}()
-
-	<-reader.started
-	cancel()
-
-	err := <-channel
-	<-reader.stopped
-	assert.ErrorIs(t, err, context.Canceled) //nolint:testifylint // pre-existing issue from nektos/act
-
-	conn.AssertExpectations(t)
-	client.AssertExpectations(t)
-}
-
-func TestDockerExecFailure(t *testing.T) {
-	ctx := context.Background()
-
-	conn := &mockConn{}
-
-	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
-		Conn:   conn,
-		Reader: bufio.NewReader(strings.NewReader("output")),
-	}, nil)
-	client.On("ExecInspect", ctx, "id", mobyclient.ExecInspectOptions{}).Return(mobyclient.ExecInspectResult{
-		ExitCode: 1,
-	}, nil)
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	err := cr.exec([]string{""}, map[string]string{}, "user", "workdir")(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(1), exitErr)
-	assert.Equal(t, "Process completed with exit code 1.", err.Error())
-
-	conn.AssertExpectations(t)
-	client.AssertExpectations(t)
-}
-
-// stdcopyFrame wraps payload in a single Docker multiplexed-stream frame, the
-// format StdCopy expects: an 8-byte header (stream type + 4-byte big-endian
-// length) followed by the payload.
-func stdcopyFrame(stream stdcopy.StdType, payload string) []byte {
-	b := make([]byte, 8+len(payload))
-	b[0] = byte(stream)
-	binary.BigEndian.PutUint32(b[4:8], uint32(len(payload)))
-	copy(b[8:], payload)
-	return b
-}
-
-// TestDockerAttachFlushesTrailingLine verifies that wait() blocks until the
-// attach() streaming goroutine has drained and flushed the container's output,
-// so a final line without a trailing newline is not lost.
-func TestDockerAttachFlushesTrailingLine(t *testing.T) {
-	ctx := context.Background()
-
-	framed := bytes.NewBuffer(stdcopyFrame(stdcopy.Stdout, "line one\nlast line without newline"))
-
-	var lines []string
-	logWriter := common.NewLineWriter(func(s string) bool {
-		lines = append(lines, s)
-		return true
-	})
-
-	client := &mockDockerClient{}
-	client.On("ContainerAttach", ctx, "123", mock.AnythingOfType("client.ContainerAttachOptions")).
-		Return(mobyclient.ContainerAttachResult{
-			Conn:   &mockConn{},
-			Reader: bufio.NewReader(framed),
-		}, nil)
-
-	statusCh := make(chan container.WaitResponse, 1)
-	statusCh <- container.WaitResponse{StatusCode: 0}
-	errCh := make(chan error, 1)
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image:  "image",
-			Stdout: logWriter,
-			Stderr: logWriter,
-		},
-	}
-
-	require.NoError(t, cr.attach()(ctx))
-	require.NoError(t, cr.wait()(ctx))
-
-	// wait() must have blocked until the goroutine drained AND flushed; the
-	// trailing, non-newline-terminated line must therefore be present. Reading
-	// lines here is race-free because wait() synchronizes on attachDone, which
-	// the goroutine closes after the final append.
-	assert.Equal(t, []string{"line one\n", "last line without newline"}, lines)
-
-	client.AssertExpectations(t)
-}
-
-func TestDockerWaitFailure(t *testing.T) {
-	ctx := context.Background()
-
-	statusCh := make(chan container.WaitResponse, 1)
-	statusCh <- container.WaitResponse{StatusCode: 2}
-	errCh := make(chan error, 1)
-
-	client := &mockDockerClient{}
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	err := cr.wait()(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(2), exitErr)
-	assert.Equal(t, "Process completed with exit code 2.", err.Error())
-
-	client.AssertExpectations(t)
-}
-
-// A remove that raced the daemon's AutoRemove teardown is not a failure and must not
-// be logged as one.
-func TestRemoveIgnoresAutoRemoveRace(t *testing.T) {
-	removeOpts := mobyclient.ContainerRemoveOptions{RemoveVolumes: true, Force: true}
-	killOpts := mobyclient.ContainerKillOptions{Signal: "SIGKILL"}
-	for _, tc := range []struct {
-		name        string
-		err         error
-		wantWait    bool
-		wantFailure bool
-	}{
-		{name: "removal in progress", err: cerrdefs.ErrConflict.WithMessage("removal of container abc is already in progress"), wantWait: true},
-		{name: "already removed", err: cerrdefs.ErrNotFound.WithMessage("No such container: abc")},
-		{name: "removed cleanly", err: nil},
-		{name: "real failure", err: errors.New("driver failed to remove root filesystem"), wantFailure: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			logger, hook := test.NewNullLogger()
-			ctx := common.WithLogger(context.Background(), logger)
-			client := &mockDockerClient{}
-			client.On("ContainerKill", ctx, "abc", killOpts).Return(mobyclient.ContainerKillResult{}, nil)
-			client.On("ContainerRemove", ctx, "abc", removeOpts).Return(mobyclient.ContainerRemoveResult{}, tc.err)
-			if tc.wantWait {
-				removed := make(chan container.WaitResponse, 1)
-				removed <- container.WaitResponse{}
-				client.On("ContainerWait", mock.Anything, "abc", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionRemoved}).
-					Return(mobyclient.ContainerWaitResult{Result: removed})
-			}
-			cr := &containerReference{id: "abc", cli: client}
-
-			require.NoError(t, cr.remove()(ctx))
-			// a failure keeps the id, so a later Remove() can retry it
-			if tc.wantFailure {
-				assert.Equal(t, "abc", cr.id)
-				assert.Len(t, hook.AllEntries(), 1)
-			} else {
-				assert.Empty(t, cr.id)
-				assert.Empty(t, hook.AllEntries())
-			}
-			client.AssertExpectations(t)
-		})
-	}
-}
-
-// A container whose id was never learned, because find() could not reach the daemon or
-// create() lost its reply, must still be removed rather than leaking with its network. It
-// was never started here, so it is not worth a kill of its own.
-func TestRemoveWithoutIDUsesName(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerRemove", ctx, "job-1", mobyclient.ContainerRemoveOptions{RemoveVolumes: true, Force: true}).
-		Return(mobyclient.ContainerRemoveResult{}, nil)
-	cr := &containerReference{cli: client, input: &NewContainerInput{Name: "job-1"}}
-
-	require.NoError(t, cr.remove()(ctx))
-	client.AssertExpectations(t)
-}
-
-// find() must drop a stale cached id so later Copy/Exec don't hit the
-// daemon with a torn-down container.
-func TestFindRevalidatesStaleID(t *testing.T) {
-	ctx := context.Background()
-	notFound := cerrdefs.ErrNotFound.WithMessage("No such container")
-	boom := errors.New("daemon unreachable")
-	newCR := func(id string) (*containerReference, *mockDockerClient) {
-		client := &mockDockerClient{}
-		return &containerReference{id: id, cli: client, input: &NewContainerInput{Name: "job-1"}}, client
-	}
-	listOpts := mobyclient.ContainerListOptions{All: true}
-	inspectOpts := mobyclient.ContainerInspectOptions{}
-
-	t.Run("stale id cleared, name lookup empty", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Empty(t, cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("stale id cleared, name lookup repopulates", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "other", Names: []string{"/somebody-else"}},
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "fresh", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("live id kept", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("transient inspect error trusts cache", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, boom)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("list error propagates", func(t *testing.T) {
-		cr, client := newCR("")
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, boom)
-		require.ErrorIs(t, cr.find()(ctx), boom)
-		client.AssertExpectations(t)
-	})
-}
-
-// Every daemon entry point fails fast with a clear, container-named
-// error when no live cr.id is known.
-func TestRejectsMissingContainer(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).Return(mobyclient.ContainerListResult{}, nil)
-	cr := &containerReference{cli: client, input: &NewContainerInput{Name: "job-1"}}
-	check := func(op string, err error) {
-		t.Helper()
-		require.ErrorIs(t, err, ErrContainerNotFound, op)
-		assert.Contains(t, err.Error(), `container "job-1" does not exist`, op)
-	}
-	check("copyContent", cr.copyContent("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	check("copyDir", cr.copyDir("/var/run/act", "/src", false)(ctx))
-	check("exec", cr.exec([]string{"echo"}, nil, "", "")(ctx))
-	_, err := cr.GetContainerArchive(ctx, "/var/run/act/x")
-	check("GetContainerArchive", err)
-	_, err = cr.Inspect(ctx)
-	check("Inspect", err)
-
-	// a known id the daemon has since dropped
-	client.On("ContainerInspect", ctx, "gone", mobyclient.ContainerInspectOptions{}).
-		Return(mobyclient.ContainerInspectResult{}, cerrdefs.ErrNotFound)
-	removed := &containerReference{id: "gone", cli: client, input: &NewContainerInput{Name: "job-1"}}
-	_, err = removed.Inspect(ctx)
-	check("Inspect after removal", err)
-}
-
-// End-to-end: a stale cr.id is cleared, repopulated from name lookup,
-// and the Copy completes against the fresh id.
-func TestPublicCopyPipelineHandlesStaleID(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerInspect", ctx, "stale", mobyclient.ContainerInspectOptions{}).
-		Return(mobyclient.ContainerInspectResult{}, cerrdefs.ErrNotFound.WithMessage("gone"))
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).
-		Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-	client.On("CopyToContainer", ctx, "fresh", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act"
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-
-	cr := &containerReference{id: "stale", cli: client, input: &NewContainerInput{Name: "job-1"}}
-	require.NoError(t, cr.Copy("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	assert.Equal(t, "fresh", cr.id)
-	client.AssertExpectations(t)
-}
-
-// Type assert containerReference implements ExecutionsEnvironment
-var _ ExecutionsEnvironment = &containerReference{}
-
-func TestCheckVolumes(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		validVolumes  []string
-		binds         []string
-		expectedBinds []string
-	}{
-		{
-			desc:         "match all volumes",
-			validVolumes: []string{"**"},
-			binds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-			expectedBinds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-		},
-		{
-			desc:         "no volumes can be matched",
-			validVolumes: []string{},
-			binds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-			expectedBinds: []string{},
-		},
-		{
-			desc: "only allowed volumes can be matched",
-			validVolumes: []string{
-				"shared_volume",
-				"/home/test/data",
-				"/etc/conf.d/*.json",
-			},
-			binds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-			expectedBinds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-			},
-		},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			logger, hook := test.NewNullLogger()
-			ctx := common.WithLogger(context.Background(), logger)
-			cr := &containerReference{
-				input: &NewContainerInput{
-					ValidVolumes: tc.validVolumes,
-				},
-			}
-			_, hostConf := cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{Binds: tc.binds})
-			assert.Equal(t, tc.expectedBinds, hostConf.Binds)
-			assert.Len(t, hook.AllEntries(), len(tc.binds)-len(tc.expectedBinds)) // every drop is warned about
-		})
-	}
-}
-
-// A volume driver decides for itself what it mounts, e.g. the local driver with device= binds
-// any host path, which valid_volumes never gets to see.
-func TestMergeContainerConfigsDropsVolumeDriversFromWorkflows(t *testing.T) {
-	const escape = "--mount type=volume,src=job-escape,dst=/host,volume-driver=local,volume-opt=type=none,volume-opt=o=bind,volume-opt=device=/"
-
-	hostConfig, _ := mergeOptions(t, "", escape+" --mount type=volume,src=job-plain,dst=/cache", false)
-	require.Len(t, hostConfig.Mounts, 1)
-	assert.Equal(t, "job-plain", hostConfig.Mounts[0].Source)
-
-	// the same mount from the runner's own options is the administrator's to make
-	hostConfig, _ = mergeOptions(t, escape, "", false)
-	require.Len(t, hostConfig.Mounts, 1)
-	assert.Equal(t, "job-escape", hostConfig.Mounts[0].Source)
-}
-
-// Both of these are read here, on the runner, so a workflow could read the runner's files
-// and environment with them.
-func TestMergeContainerConfigsKeepsTheRunnersFilesAndEnvToItself(t *testing.T) {
-	hostFile := filepath.Join(t.TempDir(), "host.env")
-	require.NoError(t, os.WriteFile(hostFile, []byte("STOLEN=from-the-host\n"), 0o600))
-	t.Setenv("RUNNER_SECRET", "s3cr3t")
-
-	for _, option := range []string{"--env-file " + hostFile, "--label-file " + hostFile} {
-		logger, _ := test.NewNullLogger()
-		cr := &containerReference{input: &NewContainerInput{NetworkMode: "bridge", WorkflowOptions: option}}
-
-		_, _, err := cr.mergeContainerConfigs(common.WithLogger(context.Background(), logger), &container.Config{}, &container.HostConfig{})
-		require.ErrorContains(t, err, "not allowed in a workflow")
-
-		// the runner reading its own files is what those options are for
-		cr = &containerReference{input: &NewContainerInput{NetworkMode: "bridge", RunnerOptions: option}}
-		_, _, err = cr.mergeContainerConfigs(common.WithLogger(context.Background(), logger), &container.Config{}, &container.HostConfig{})
-		require.NoError(t, err)
-	}
-
-	// a bare name is no longer resolved from the runner's environment, for either source
-	logger, _ := test.NewNullLogger()
-	cr := &containerReference{input: &NewContainerInput{
-		NetworkMode:     "bridge",
-		RunnerOptions:   "--env RUNNER_SECRET",
-		WorkflowOptions: "--env RUNNER_SECRET --env GIVEN=value",
-	}}
-
-	config, _, err := cr.mergeContainerConfigs(common.WithLogger(context.Background(), logger), &container.Config{}, &container.HostConfig{})
-	require.NoError(t, err)
-	assert.Equal(t, []string{"RUNNER_SECRET", "RUNNER_SECRET", "GIVEN=value"}, config.Env)
-}
-
-func TestSanitizeOptionsHostConfig(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-
-	// every field the sanitizer resets, so a reset dropped in a refactor fails here
-	hostConfig := &container.HostConfig{
-		PidMode:           "host",
-		IpcMode:           "host",
-		UTSMode:           "host",
-		CgroupnsMode:      "host",
-		UsernsMode:        "host",
-		CapAdd:            []string{"ALL"},
-		SecurityOpt:       []string{"seccomp=unconfined", "apparmor=unconfined"},
-		VolumesFrom:       []string{"other"},
-		Runtime:           "runc",
-		Isolation:         "process",
-		VolumeDriver:      "rogue",
-		MaskedPaths:       []string{},
-		ReadonlyPaths:     []string{},
-		CgroupParent:      "/custom",
-		Devices:           []container.DeviceMapping{{PathOnHost: "/dev/sda", PathInContainer: "/dev/sda", CgroupPermissions: "rwm"}},
-		DeviceCgroupRules: []string{"a *:* rwm"},
-		DeviceRequests:    []container.DeviceRequest{{Count: -1, Capabilities: [][]string{{"gpu"}}}},
-		Sysctls:           map[string]string{"net.ipv4.ip_forward": "1"},
-	}
-
-	sanitizeOptionsHostConfig(logger, hostConfig, &container.HostConfig{})
-
-	assert.Equal(t, &container.HostConfig{}, hostConfig)
-}
-
-// mergeOptions merges both option sources into a bare container, returning the result and its log.
-func mergeOptions(t *testing.T, runnerOptions, workflowOptions string, privileged bool) (*container.HostConfig, *test.Hook) {
-	t.Helper()
-	logger, hook := test.NewNullLogger()
-	cr := &containerReference{input: &NewContainerInput{
-		RunnerOptions:   runnerOptions,
-		WorkflowOptions: workflowOptions,
-		NetworkMode:     "bridge",
-		UsernsMode:      "private",
-	}}
-
-	_, hostConfig, err := cr.mergeContainerConfigs(common.WithLogger(context.Background(), logger), &container.Config{}, &container.HostConfig{
-		Privileged:  privileged,
-		UsernsMode:  container.UsernsMode("private"),
-		NetworkMode: container.NetworkMode("bridge"),
-	})
-	require.NoError(t, err)
-	return hostConfig, hook
-}
-
-func TestMergeContainerConfigsStripsDangerousOptionsWhenUnprivileged(t *testing.T) {
-	// OS-independent options only, --device and --gpus need a linux/windows server OS
-	const dangerousOptions = "--pid=host --ipc=host --uts=host --cgroupns=host " +
-		"--userns=host --cap-add=ALL --security-opt seccomp=unconfined " +
-		"--security-opt apparmor=unconfined --volumes-from other --isolation process " +
-		"--runtime runc --cgroup-parent /custom --sysctl net.ipv4.ip_forward=1"
-
-	// whatever the workflow adds, an unprivileged container comes out exactly as the runner's
-	// own options alone describe it, field for field
-	for _, runnerOptions := range []string{"--shm-size 1g", dangerousOptions, "--cap-add SYS_ADMIN --security-opt seccomp=unconfined"} {
-		runnerOnly, _ := mergeOptions(t, runnerOptions, "", false)
-		withWorkflow, _ := mergeOptions(t, runnerOptions, dangerousOptions, false)
-
-		assert.Equal(t, runnerOnly, withWorkflow, "runner options: %q", runnerOptions)
-	}
-
-	// the same options from the runner reach the daemon, even --userns, which no workflow may set
-	kept, _ := mergeOptions(t, dangerousOptions, "", false)
-	assert.Equal(t, "host", string(kept.PidMode))
-	assert.Equal(t, []string{"ALL"}, kept.CapAdd)
-	assert.Equal(t, "runc", kept.Runtime)
-	assert.Equal(t, "host", string(kept.UsernsMode))
-	assert.False(t, kept.Privileged)
-
-	// privileged is the administrator opting in, so the workflow's options are honored
-	privileged, _ := mergeOptions(t, "", dangerousOptions, true)
-	assert.Equal(t, "host", string(privileged.PidMode))
-	assert.Equal(t, []string{"ALL"}, privileged.CapAdd)
-	assert.Equal(t, []string{"seccomp=unconfined", "apparmor=unconfined"}, privileged.SecurityOpt)
-}
-
-func TestCheckVolumesRejectsEscapingHostPaths(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-
-	base := t.TempDir()
-	allowed := filepath.Join(base, "allowed")
-	denied := filepath.Join(base, "denied")
-	require.NoError(t, os.MkdirAll(allowed, 0o700))
-	require.NoError(t, os.MkdirAll(denied, 0o700))
-
-	cr := &containerReference{
-		input: &NewContainerInput{
-			ValidVolumes: []string{filepath.Join(allowed, "**")},
-		},
-	}
-
-	escapingPath := allowed + string(filepath.Separator) + ".." + string(filepath.Separator) + "denied"
-	_, hostConf := cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{escapingPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	linkPath := filepath.Join(allowed, "link")
-	if err := os.Symlink(denied, linkPath); err != nil {
-		t.Skipf("cannot create symlink: %v", err)
-	}
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{linkPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{filepath.Join(linkPath, "missing") + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-}
-
-func TestContainerInfoFromInspect(t *testing.T) {
-	t.Run("reports no healthcheck when the image declares none", func(t *testing.T) {
-		info := containerInfoFromInspect(container.InspectResponse{
-			ID:    "abc123",
-			State: &container.State{Status: "running", Running: true},
-		})
-
-		assert.Equal(t, "abc123", info.ID)
-		assert.Equal(t, "running", info.State)
-		assert.Equal(t, HealthNone, info.Health)
-		assert.Empty(t, info.Ports)
-	})
-
-	t.Run("reports the health status and the last probe output", func(t *testing.T) {
-		info := containerInfoFromInspect(container.InspectResponse{
-			State: &container.State{
-				Status: "running",
-				Health: &container.Health{
-					Status: container.Unhealthy,
-					Log: []*container.HealthcheckResult{
-						{Output: "first\n"},
-						{Output: "connection refused\n"},
-					},
-				},
-			},
-		})
-
-		assert.Equal(t, HealthUnhealthy, info.Health)
-		assert.Equal(t, "connection refused", info.HealthOutput)
-	})
-
-	t.Run("reports the published ports", func(t *testing.T) {
-		info := containerInfoFromInspect(container.InspectResponse{
-			State: &container.State{Status: "running"},
-			NetworkSettings: &container.NetworkSettings{
-				Ports: network.PortMap{
-					network.MustParsePort("5432/tcp"): []network.PortBinding{{HostPort: "49153"}},
-					network.MustParsePort("6379/tcp"): nil,
-				},
-			},
-		})
-
-		assert.Equal(t, map[string]string{"5432": "49153"}, info.Ports)
-	})
-
-	t.Run("tolerates a container without state", func(t *testing.T) {
-		info := containerInfoFromInspect(container.InspectResponse{ID: "abc123"})
-
-		assert.Equal(t, "abc123", info.ID)
-		assert.Equal(t, HealthNone, info.Health)
-	})
-}
-
-func TestMergeContainerConfigsVolumesReplaceRunnerMounts(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	cr := &containerReference{
-		input: &NewContainerInput{
-			NetworkMode:   "bridge",
-			RunnerOptions: "--volume /host/tools:/opt/hostedtoolcache",
-		},
-	}
-
-	_, hostConf, err := cr.mergeContainerConfigs(ctx, &container.Config{}, &container.HostConfig{
-		Binds:  []string{"/var/run/docker.sock:/var/run/docker.sock"},
-		Mounts: []mount.Mount{{Type: mount.TypeVolume, Source: "act-toolcache", Target: "/opt/hostedtoolcache"}},
-	})
-	require.NoError(t, err)
-	assert.Equal(t, []string{"/var/run/docker.sock:/var/run/docker.sock", "/host/tools:/opt/hostedtoolcache"}, hostConf.Binds)
-	assert.Empty(t, hostConf.Mounts)
-}
-
-func TestMergeContainerConfigsWarnsOnlyAboutOptionsThatWereGiven(t *testing.T) {
-	warnings := func(runnerOptions, workflowOptions string) int {
-		_, hook := mergeOptions(t, runnerOptions, workflowOptions, false)
-		return len(hook.AllEntries())
-	}
-
-	assert.Zero(t, warnings("--volume /host/tools:/opt/hostedtoolcache", ""))
-	assert.Zero(t, warnings("", "--shm-size 1g"))
-	assert.Equal(t, 1, warnings("--network host", ""))
-}
-
-func TestMergeContainerConfigsKeepsNetworkAliasesFromOptions(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-	cr := &containerReference{input: &NewContainerInput{
-		NetworkMode: "job-network", NetworkAliases: []string{"redis"}, WorkflowOptions: "--network-alias redis-primary",
-	}}
-
-	_, _, err := cr.mergeContainerConfigs(common.WithLogger(t.Context(), logger), &container.Config{}, &container.HostConfig{})
-	require.NoError(t, err)
-	assert.Equal(t, []string{"redis", "redis-primary"}, cr.input.NetworkAliases)
-}
-
-// A dead daemon must fail the job, not panic through logrus and not silently
-// drop the requested platform.
-func TestSupportsContainerImagePlatformDaemonError(t *testing.T) {
-	cli := &mockDockerClient{}
-	cli.On("ServerVersion", mock.Anything, mock.Anything).
-		Return(mobyclient.ServerVersionResult{}, errors.New("cannot connect to the Docker daemon"))
-
-	supported, err := supportsContainerImagePlatform(t.Context(), cli)
-	require.ErrorContains(t, err, "cannot connect to the Docker daemon")
-	assert.False(t, supported)
-}

act/container/docker_stub.go

@@ -1,79 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)
-
-package container
-
-import (
-	"context"
-	"errors"
-	"runtime"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/moby/moby/api/types/system"
-)
-
-// ImageExistsLocally returns a boolean indicating if an image with the
-// requested name, tag and architecture exists in the local docker image store
-func ImageExistsLocally(ctx context.Context, imageName, platform string) (bool, error) {
-	return false, errors.New("Unsupported Operation")
-}
-
-// RemoveImage removes image from local store, the function is used to run different
-// container image architectures
-func RemoveImage(ctx context.Context, imageName string, force, pruneChildren bool) (bool, error) {
-	return false, errors.New("Unsupported Operation")
-}
-
-// NewDockerBuildExecutor function to create a run executor for the container
-func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		return errors.New("Unsupported Operation")
-	}
-}
-
-// NewDockerPullExecutor function to create a run executor for the container
-func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		return errors.New("Unsupported Operation")
-	}
-}
-
-// NewContainer creates a reference to a container
-func NewContainer(input *NewContainerInput) ExecutionsEnvironment {
-	return nil
-}
-
-func RunnerArch(ctx context.Context) string {
-	return runtime.GOOS
-}
-
-func GetHostInfo(ctx context.Context) (info system.Info, err error) {
-	return system.Info{}, nil
-}
-
-func NewDockerVolumeRemoveExecutor(volume string, force bool) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func NewDockerNetworkRemoveExecutor(name string) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func RemoveOrphanNetworks(ctx context.Context, runnerUUID string, createdBefore time.Time) error {
-	return nil
-}

act/container/docker_volume.go

@@ -1,59 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/moby/moby/client"
-)
-
-func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executor {
-	return func(ctx context.Context) error {
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		list, err := cli.VolumeList(ctx, client.VolumeListOptions{})
-		if err != nil {
-			return err
-		}
-
-		for _, vol := range list.Items {
-			if vol.Name == volumeName {
-				return removeExecutor(volumeName, force)(ctx)
-			}
-		}
-
-		// Volume not found - do nothing
-		return nil
-	}
-}
-
-func removeExecutor(volume string, force bool) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		logger.Debugf("docker volume rm %s", volume)
-
-		if common.Dryrun(ctx) {
-			return nil
-		}
-
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		_, err = cli.VolumeRemove(ctx, volume, client.VolumeRemoveOptions{Force: force})
-		return err
-	}
-}

act/container/executions_environment.go

@@ -1,19 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import "context"
-
-type ExecutionsEnvironment interface {
-	Container
-	ToContainerPath(string) string
-	GetActPath() string
-	GetPathVariableName() string
-	DefaultPathVariable() string
-	JoinPathVariable(...string) string
-	GetRunnerContext(ctx context.Context) map[string]any
-	// On windows PATH and Path are the same key
-	IsEnvironmentCaseInsensitive() bool
-}

act/container/helpers_test.go

@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"testing"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}

act/container/host_environment.go

@@ -1,673 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/filecollector"
-	"gitea.com/gitea/runner/act/lookpath"
-	"gitea.com/gitea/runner/internal/pkg/process"
-
-	"github.com/creack/pty"
-	"github.com/go-git/go-billy/v5/helper/polyfill"
-	"github.com/go-git/go-billy/v5/osfs"
-	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
-	"golang.org/x/term"
-)
-
-type HostEnvironment struct {
-	Path      string
-	TmpDir    string
-	ToolCache string
-	Workdir   string
-	// CleanWorkdir means teardown owns Workdir and may delete it. Leave false
-	// when Workdir points at a caller-owned checkout (e.g. `act` local mode).
-	CleanWorkdir bool
-	ActPath      string
-	CleanUp      func()
-	StdOut       io.Writer
-	AllocatePTY  bool // allocate a pseudo-TTY for each step's process
-
-	// procGroup owns every process the job's steps start. Atomic: Remove may read
-	// it while a step is still starting.
-	procGroupOnce sync.Once
-	procGroup     atomic.Pointer[process.Group]
-}
-
-// processGroup returns the job-scoped process group, creating it on first use.
-// Returns nil if the job object could not be created; Group is nil-safe.
-func (e *HostEnvironment) processGroup(ctx context.Context) *process.Group {
-	e.procGroupOnce.Do(func() {
-		group, err := process.NewGroup()
-		if err != nil {
-			common.Logger(ctx).Warnf("could not create the job's process group; processes a step leaves behind can only be reclaimed by the workspace scan: %v", err)
-			return
-		}
-		e.procGroup.Store(group)
-	})
-	return e.procGroup.Load()
-}
-
-func (e *HostEnvironment) Create(_, _ []string) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func (e *HostEnvironment) Close() common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func (e *HostEnvironment) Copy(destPath string, files ...*FileEntry) common.Executor {
-	return func(ctx context.Context) error {
-		for _, f := range files {
-			if err := os.MkdirAll(filepath.Dir(filepath.Join(destPath, f.Name)), 0o777); err != nil {
-				return err
-			}
-			if err := os.WriteFile(filepath.Join(destPath, f.Name), []byte(f.Body), fs.FileMode(f.Mode)); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-}
-
-func (e *HostEnvironment) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		srcPrefix := filepath.Dir(srcPath)
-		if !strings.HasSuffix(srcPrefix, string(filepath.Separator)) {
-			srcPrefix += string(filepath.Separator)
-		}
-		logger.Debugf("Stripping prefix:%s src:%s", srcPrefix, srcPath)
-		var ignorer gitignore.Matcher
-		if useGitIgnore {
-			ps, err := gitignore.ReadPatterns(polyfill.New(osfs.New(srcPath)), nil)
-			if err != nil {
-				logger.Debugf("Error loading .gitignore: %v", err)
-			}
-
-			ignorer = gitignore.NewMatcher(ps)
-		}
-		fc := &filecollector.FileCollector{
-			Ignorer:   ignorer,
-			SrcPath:   srcPath,
-			SrcPrefix: srcPrefix,
-			Handler: &filecollector.CopyCollector{
-				DstDir: destPath,
-			},
-		}
-		return filepath.Walk(srcPath, fc.CollectFiles(ctx, []string{}))
-	}
-}
-
-func (e *HostEnvironment) DumpLogs(_ context.Context) error {
-	return nil
-}
-
-func (e *HostEnvironment) Inspect(_ context.Context) (*Info, error) {
-	return &Info{Health: HealthNone, Ports: map[string]string{}}, nil
-}
-
-func (e *HostEnvironment) GetContainerArchive(ctx context.Context, srcPath string) (io.ReadCloser, error) {
-	buf := &bytes.Buffer{}
-	tw := tar.NewWriter(buf)
-	defer tw.Close()
-	srcPath = filepath.Clean(srcPath)
-	fi, err := os.Lstat(srcPath)
-	if err != nil {
-		return nil, err
-	}
-	tc := &filecollector.TarCollector{
-		TarWriter: tw,
-	}
-	if fi.IsDir() {
-		srcPrefix := srcPath
-		if !strings.HasSuffix(srcPrefix, string(filepath.Separator)) {
-			srcPrefix += string(filepath.Separator)
-		}
-		fc := &filecollector.FileCollector{
-			SrcPath:   srcPath,
-			SrcPrefix: srcPrefix,
-			Handler:   tc,
-		}
-		err = filepath.Walk(srcPath, fc.CollectFiles(ctx, []string{}))
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		var f io.ReadCloser
-		var linkname string
-		if fi.Mode()&fs.ModeSymlink != 0 {
-			linkname, err = os.Readlink(srcPath)
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			f, err = os.Open(srcPath)
-			if err != nil {
-				return nil, err
-			}
-			defer f.Close()
-		}
-		err := tc.WriteFile(fi.Name(), fi, linkname, f)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return io.NopCloser(buf), nil
-}
-
-func (e *HostEnvironment) Pull(_ bool) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func (e *HostEnvironment) Start(_ bool) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-type ptyWriter struct {
-	Out       io.Writer
-	AutoStop  atomic.Bool
-	dirtyLine bool
-}
-
-func (w *ptyWriter) Write(buf []byte) (int, error) {
-	if w.AutoStop.Load() && len(buf) > 0 && buf[len(buf)-1] == 4 {
-		n, err := w.Out.Write(buf[:len(buf)-1])
-		if err != nil {
-			return n, err
-		}
-		if w.dirtyLine || len(buf) > 1 && buf[len(buf)-2] != '\n' {
-			_, _ = w.Out.Write([]byte("\n"))
-			return n, io.EOF
-		}
-		return n, io.EOF
-	}
-	w.dirtyLine = strings.LastIndex(string(buf), "\n") < len(buf)-1
-	return w.Out.Write(buf)
-}
-
-func lookupPathHost(cmd string, env map[string]string, writer io.Writer) (string, error) {
-	f, err := lookpath.LookPath2(cmd, env)
-	if err != nil {
-		err := "Cannot find: " + cmd + " in PATH"
-		if _, _err := writer.Write([]byte(err + "\n")); _err != nil {
-			return "", fmt.Errorf("%v: %w", err, _err)
-		}
-		return "", errors.New(err)
-	}
-	return f, nil
-}
-
-func setupPty(cmd *exec.Cmd, cmdline string) (*os.File, *os.File, error) {
-	ppty, tty, err := pty.Open()
-	if err != nil {
-		return nil, nil, err
-	}
-	if term.IsTerminal(int(tty.Fd())) {
-		_, err := term.MakeRaw(int(tty.Fd()))
-		if err != nil {
-			ppty.Close()
-			tty.Close()
-			return nil, nil, err
-		}
-	}
-	cmd.Stdin = tty
-	cmd.Stdout = tty
-	cmd.Stderr = tty
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, true)
-	return ppty, tty, nil
-}
-
-func writeKeepAlive(ppty io.Writer) {
-	c := 1
-	var err error
-	for c == 1 && err == nil {
-		c, err = ppty.Write([]byte{4})
-		<-time.After(time.Second)
-	}
-}
-
-func copyPtyOutput(writer io.Writer, ppty io.Reader, finishLog context.CancelFunc) {
-	defer func() {
-		finishLog()
-	}()
-	if _, err := io.Copy(writer, ppty); err != nil {
-		return
-	}
-}
-
-func (e *HostEnvironment) UpdateFromImageEnv(_ *map[string]string) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func getEnvListFromMap(env map[string]string) []string {
-	envList := make([]string, 0)
-	for k, v := range env {
-		envList = append(envList, fmt.Sprintf("%s=%s", k, v))
-	}
-	return envList
-}
-
-func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline string, env map[string]string, _, workdir string) error {
-	envList := getEnvListFromMap(env)
-	var wd string
-	if workdir != "" {
-		if filepath.IsAbs(workdir) {
-			wd = workdir
-		} else {
-			wd = filepath.Join(e.Path, workdir)
-		}
-	} else {
-		wd = e.Path
-	}
-	// Flush any buffered, not-yet-newline-terminated trailing line, as the docker backend
-	// does in waitForCommand, so the final line of a command's output is not lost.
-	defer common.FlushWriter(e.StdOut)
-
-	f, err := lookupPathHost(command[0], env, e.StdOut)
-	if err != nil {
-		return err
-	}
-	cmd := exec.CommandContext(ctx, f)
-	cmd.Path = f
-	cmd.Args = command
-	cmd.Stdin = nil
-	cmd.Stdout = e.StdOut
-	cmd.Env = envList
-	cmd.Stderr = e.StdOut
-	cmd.Dir = wd
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, false)
-
-	// Kills the step's whole tree on cancellation and bounds the post-exit I/O
-	// wait, so an orphan holding cmd's stdout pipe cannot hang cmd.Wait().
-	treeKill := process.NewTreeKill(cmd)
-
-	var ppty *os.File
-	var tty *os.File
-	defer func() {
-		if ppty != nil {
-			ppty.Close()
-		}
-		if tty != nil {
-			tty.Close()
-		}
-	}()
-	if e.AllocatePTY {
-		var err error
-		ppty, tty, err = setupPty(cmd, cmdline)
-		if err != nil {
-			common.Logger(ctx).Debugf("Failed to setup Pty %v\n", err.Error())
-		}
-	}
-	var writer *ptyWriter
-	var logctx context.Context
-	if ppty != nil {
-		writer = &ptyWriter{Out: e.StdOut}
-		var finishLog context.CancelFunc
-		logctx, finishLog = context.WithCancel(context.Background())
-		go copyPtyOutput(writer, ppty, finishLog)
-		go writeKeepAlive(ppty)
-	}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	// Assign before the step's Killer so the step's job nests inside the group's;
-	// cancellation still scopes to this step's tree.
-	if err := e.processGroup(ctx).Assign(cmd.Process); err != nil {
-		common.Logger(ctx).Warnf("could not assign the step's process to the job's process group; a process it leaves behind may outlive the job: %v", err)
-	}
-	if k, kerr := treeKill.Capture(cmd.Process); kerr != nil {
-		common.Logger(ctx).Warnf("process tree kill setup failed, falling back to single-process kill: %v", kerr)
-	} else {
-		defer k.Close()
-	}
-	err = cmd.Wait()
-	if err != nil {
-		if exitErr, ok := errors.AsType[*exec.ExitError](err); ok {
-			return ExitCodeError(exitErr.ExitCode())
-		}
-		return err
-	}
-	if tty != nil {
-		writer.AutoStop.Store(true)
-		if _, err := tty.WriteString("\x04"); err != nil {
-			common.Logger(ctx).Debug("Failed to write EOT")
-		}
-		<-logctx.Done()
-		ppty.Close()
-		ppty = nil
-	}
-	return err
-}
-
-func (e *HostEnvironment) Exec(command []string /*cmdline string, */, env map[string]string, user, workdir string) common.Executor {
-	return e.ExecWithCmdLine(command, "", env, user, workdir)
-}
-
-func (e *HostEnvironment) ExecWithCmdLine(command []string, cmdline string, env map[string]string, user, workdir string) common.Executor {
-	return func(ctx context.Context) error {
-		if err := e.exec(ctx, command, cmdline, env, user, workdir); err != nil {
-			select {
-			case <-ctx.Done():
-				return fmt.Errorf("this step has been cancelled: %w", err)
-			default:
-				return err
-			}
-		}
-		return nil
-	}
-}
-
-func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
-	return parseEnvFile(e, srcPath, env)
-}
-
-// removeAll is a var so tests can substitute a blocking stub.
-var removeAll = os.RemoveAll
-
-// removeAllWithContext returns once the delete finishes or ctx is cancelled. On
-// cancellation the goroutine leaks: a delete inside a syscall cannot be
-// interrupted (see runWithTimeout).
-func removeAllWithContext(ctx context.Context, path string) error {
-	done := make(chan error, 1)
-	go func() { done <- removeAll(path) }()
-	select {
-	case err := <-done:
-		return err
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
-func removePathWithRetry(ctx context.Context, path string) error {
-	if path == "" {
-		return nil
-	}
-	attempts := 1
-	delay := time.Duration(0)
-	if runtime.GOOS == "windows" {
-		attempts = 5
-		delay = 200 * time.Millisecond
-	}
-	var lastErr error
-	for i := 0; i < attempts; i++ {
-		if i > 0 {
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			case <-time.After(delay):
-			}
-		}
-		lastErr = removeAllWithContext(ctx, path)
-		if lastErr == nil {
-			return nil
-		}
-		if errors.Is(lastErr, context.DeadlineExceeded) {
-			return lastErr
-		}
-	}
-	return lastErr
-}
-
-// buildWindowsWorkspaceKillScript builds a PowerShell command that taskkills
-// every process tree whose ExecutablePath or CommandLine references one of the
-// given workspace dirs, releasing file handles for cleanup. Win32_Process
-// exposes both fields (Get-Process doesn't, wmic is deprecated); matching is on
-// the dir+separator prefix via ordinal String methods, so a name-prefix sibling
-// (job1 vs job10) is spared and path metacharacters stay literal.
-func buildWindowsWorkspaceKillScript(dirs []string) string {
-	quoted := make([]string, len(dirs))
-	for i, d := range dirs {
-		// Single-quoted PowerShell literal; escape ' by doubling it.
-		quoted[i] = "'" + strings.ReplaceAll(d, "'", "''") + "'"
-	}
-
-	return `$paths = @(` + strings.Join(quoted, ",") + `)
-$selfPid = $PID
-Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
-    if ($_.ProcessId -eq $selfPid) { return $false }
-    foreach ($p in $paths) {
-        $prefix = $p + '\'
-        if ($_.ExecutablePath -and $_.ExecutablePath.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)) { return $true }
-        if ($_.CommandLine -and $_.CommandLine.IndexOf($prefix, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) { return $true }
-    }
-    return $false
-} | ForEach-Object {
-    & taskkill.exe /PID $_.ProcessId /T /F 2>$null | Out-Null
-}
-`
-}
-
-func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
-	if runtime.GOOS != "windows" {
-		return
-	}
-
-	// Detached: exec.CommandContext won't start on a cancelled ctx, and a
-	// server cancel has already cancelled the parent ctx.
-	killCtx, killCancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer killCancel()
-
-	logger := common.Logger(ctx)
-
-	// Dirs we own; a process referencing one is a leftover. ToolCache is shared
-	// across jobs, and Workdir may be a caller-owned checkout.
-	owned := []string{e.Path, e.TmpDir}
-	if e.CleanWorkdir {
-		owned = append(owned, e.Workdir)
-	}
-	dirs := make([]string, 0, len(owned))
-	for _, d := range owned {
-		if d == "" {
-			continue
-		}
-		abs, err := filepath.Abs(d)
-		if err != nil {
-			continue
-		}
-		dirs = append(dirs, abs)
-	}
-	if len(dirs) == 0 {
-		return
-	}
-
-	script := buildWindowsWorkspaceKillScript(dirs)
-
-	cmd := exec.CommandContext(killCtx, "powershell.exe", "-NoProfile", "-NonInteractive", "-Command", script)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		logger.Debugf("workspace process-tree kill via PowerShell failed: %v output=%s", err, strings.TrimSpace(string(out)))
-	}
-
-	// Win32_Process exposes no working directory, so the scan above misses a
-	// process that merely runs in a workspace dir while pinning a handle on it.
-	if killed, err := process.KillProcessesWithCWDUnder(killCtx, dirs); err != nil {
-		logger.Debugf("workspace process kill by working directory reported errors: %v", err)
-	} else if killed > 0 {
-		logger.Debugf("terminated %d leftover process(es) by workspace working directory", killed)
-	}
-}
-
-// hostCleanupTimeout bounds each teardown phase so one stalled delete cannot
-// wedge the runner slot. A var so tests can shrink it.
-var hostCleanupTimeout = 30 * time.Second
-
-// runWithTimeout returns context.DeadlineExceeded once timeout elapses, leaking
-// the goroutine: a delete blocked in a syscall (AV filter driver, dead network
-// mount) cannot be interrupted, and leaking scratch state beats losing the
-// runner's capacity slot forever. The idle stale-dir sweep reclaims it later.
-func runWithTimeout(fn func(), timeout time.Duration) error {
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		fn()
-	}()
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-	select {
-	case <-done:
-		return nil
-	case <-timer.C:
-		return context.DeadlineExceeded
-	}
-}
-
-func (e *HostEnvironment) Remove() common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-
-		// End lingering processes before removing the workspace; on Windows their
-		// file locks block cleanup. Closing the group is deterministic, the scan a net.
-		if err := e.procGroup.Load().Close(); err != nil {
-			logger.Debugf("closing the job's process group failed: %v", err)
-		}
-		e.terminateRunningProcesses(ctx)
-
-		// Removes per-job misc state only, never the toolcache root. Bounded because
-		// CleanUp is a caller-supplied, typically unbounded os.RemoveAll.
-		if e.CleanUp != nil {
-			logger.Debugf("running host environment cleanup callback")
-			if err := runWithTimeout(e.CleanUp, hostCleanupTimeout); err != nil {
-				logger.Warnf("host environment cleanup did not finish within %s; continuing job completion, scratch state may be leaked and is reclaimed by the idle stale-dir sweep", hostCleanupTimeout)
-			} else {
-				logger.Debugf("host environment cleanup callback finished")
-			}
-		}
-
-		// Detach: a cancelled ctx would skip removePathWithRetry's retries,
-		// which absorb Windows file-handle release lag after the kill above.
-		rmCtx, rmCancel := context.WithTimeout(context.Background(), hostCleanupTimeout)
-		defer rmCancel()
-
-		var errs []error
-		if err := removePathWithRetry(rmCtx, e.Path); err != nil {
-			logger.Warnf("failed to remove host misc state %s: %v", e.Path, err)
-			errs = append(errs, err)
-		}
-		if e.CleanWorkdir {
-			if err := removePathWithRetry(rmCtx, e.Workdir); err != nil {
-				logger.Warnf("failed to remove host workspace %s: %v", e.Workdir, err)
-				errs = append(errs, err)
-			}
-		}
-		for _, err := range errs {
-			if !errors.Is(err, context.DeadlineExceeded) {
-				return errors.Join(errs...)
-			}
-		}
-		// Teardown timed out; warned above. Do not fail job completion over it.
-		return nil
-	}
-}
-
-func (e *HostEnvironment) ToContainerPath(path string) string {
-	if bp, err := filepath.Rel(e.Workdir, path); err != nil {
-		return filepath.Join(e.Path, bp)
-	} else if filepath.Clean(e.Workdir) == filepath.Clean(path) {
-		return e.Path
-	}
-	return path
-}
-
-func (e *HostEnvironment) GetActPath() string {
-	actPath := e.ActPath
-	if runtime.GOOS == "windows" {
-		actPath = strings.ReplaceAll(actPath, "\\", "/")
-	}
-	return actPath
-}
-
-func (*HostEnvironment) GetPathVariableName() string {
-	switch runtime.GOOS {
-	case "plan9":
-		return "path"
-	case "windows":
-		return "Path" // Actually we need a case insensitive map
-	}
-	return "PATH"
-}
-
-func (e *HostEnvironment) DefaultPathVariable() string {
-	v, _ := os.LookupEnv(e.GetPathVariableName())
-	return v
-}
-
-func (*HostEnvironment) JoinPathVariable(paths ...string) string {
-	return strings.Join(paths, string(filepath.ListSeparator))
-}
-
-// Reference for Arch values for runner.arch
-// https://docs.github.com/en/actions/learn-github-actions/contexts#runner-context
-func goArchToActionArch(arch string) string {
-	archMapper := map[string]string{
-		"x86_64":  "X64",
-		"amd64":   "X64",
-		"386":     "X86",
-		"arm":     "ARM",
-		"aarch64": "ARM64",
-		"arm64":   "ARM64",
-	}
-	if arch, ok := archMapper[arch]; ok {
-		return arch
-	}
-	return arch
-}
-
-func goOsToActionOs(os string) string {
-	osMapper := map[string]string{
-		"linux":   "Linux",
-		"darwin":  "macOS",
-		"windows": "Windows",
-	}
-	if os, ok := osMapper[os]; ok {
-		return os
-	}
-	return os
-}
-
-func (e *HostEnvironment) GetRunnerContext(_ context.Context) map[string]any {
-	return map[string]any{
-		"os":         goOsToActionOs(runtime.GOOS),
-		"arch":       goArchToActionArch(runtime.GOARCH),
-		"temp":       e.TmpDir,
-		"tool_cache": e.ToolCache,
-	}
-}
-
-func (e *HostEnvironment) ReplaceLogWriter(stdout, _ io.Writer) (io.Writer, io.Writer) {
-	org := e.StdOut
-	e.StdOut = stdout
-	return org, org
-}
-
-func (*HostEnvironment) IsEnvironmentCaseInsensitive() bool {
-	return runtime.GOOS == "windows"
-}

act/container/host_environment_test.go

@@ -1,368 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"path"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// Type assert HostEnvironment implements ExecutionsEnvironment
-var _ ExecutionsEnvironment = &HostEnvironment{}
-
-func TestActionPlatformNames(t *testing.T) {
-	assert.Equal(t, []string{"Linux", "macOS", "Windows"}, []string{goOsToActionOs("linux"), goOsToActionOs("darwin"), goOsToActionOs("windows")})
-	assert.Equal(t, []string{"X86", "X64", "ARM", "ARM64"}, []string{goArchToActionArch("386"), goArchToActionArch("amd64"), goArchToActionArch("arm"), goArchToActionArch("arm64")})
-}
-
-func TestCopyDir(t *testing.T) {
-	dir := t.TempDir()
-	ctx := context.Background()
-	e := &HostEnvironment{
-		Path:      filepath.Join(dir, "path"),
-		TmpDir:    filepath.Join(dir, "tmp"),
-		ToolCache: filepath.Join(dir, "tool_cache"),
-		ActPath:   filepath.Join(dir, "act_path"),
-		StdOut:    os.Stdout,
-		Workdir:   path.Join("testdata", "scratch"),
-	}
-	_ = os.MkdirAll(e.Path, 0o700)
-	_ = os.MkdirAll(e.TmpDir, 0o700)
-	_ = os.MkdirAll(e.ToolCache, 0o700)
-	_ = os.MkdirAll(e.ActPath, 0o700)
-	err := e.CopyDir(e.Workdir, e.Path, true)(ctx)
-	assert.NoError(t, err)
-}
-
-func TestGetContainerArchive(t *testing.T) {
-	dir := t.TempDir()
-	ctx := context.Background()
-	e := &HostEnvironment{
-		Path:      filepath.Join(dir, "path"),
-		TmpDir:    filepath.Join(dir, "tmp"),
-		ToolCache: filepath.Join(dir, "tool_cache"),
-		ActPath:   filepath.Join(dir, "act_path"),
-		StdOut:    os.Stdout,
-		Workdir:   path.Join("testdata", "scratch"),
-	}
-	_ = os.MkdirAll(e.Path, 0o700)
-	_ = os.MkdirAll(e.TmpDir, 0o700)
-	_ = os.MkdirAll(e.ToolCache, 0o700)
-	_ = os.MkdirAll(e.ActPath, 0o700)
-	expectedContent := []byte("sdde/7sh")
-	err := os.WriteFile(filepath.Join(e.Path, "action.yml"), expectedContent, 0o600)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	archive, err := e.GetContainerArchive(ctx, e.Path)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	defer archive.Close()
-	reader := tar.NewReader(archive)
-	h, err := reader.Next()
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, "action.yml", h.Name)
-	content, err := io.ReadAll(reader)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, expectedContent, content)
-	_, err = reader.Next()
-	assert.ErrorIs(t, err, io.EOF)
-}
-
-func TestHostEnvironmentExecExitCode(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses POSIX shell")
-	}
-	dir := t.TempDir()
-	ctx := context.Background()
-	e := &HostEnvironment{
-		Path:      filepath.Join(dir, "path"),
-		TmpDir:    filepath.Join(dir, "tmp"),
-		ToolCache: filepath.Join(dir, "tool_cache"),
-		ActPath:   filepath.Join(dir, "act_path"),
-		StdOut:    io.Discard,
-		Workdir:   filepath.Join(dir, "path"),
-	}
-	for _, p := range []string{e.Path, e.TmpDir, e.ToolCache, e.ActPath} {
-		assert.NoError(t, os.MkdirAll(p, 0o700)) //nolint:testifylint // test setup
-	}
-
-	err := e.Exec([]string{"sh", "-c", "exit 3"}, map[string]string{"PATH": os.Getenv("PATH")}, "", "")(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(3), exitErr)
-	assert.Equal(t, "Process completed with exit code 3.", err.Error())
-}
-
-func TestHostEnvironmentAllocatePTY(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses POSIX shell")
-	}
-	for _, tc := range []struct {
-		name     string
-		allocPTY bool
-		expect   string
-	}{
-		{name: "off", allocPTY: false, expect: "NOTTY"},
-		{name: "on", allocPTY: true, expect: "TTY"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			buf := &bytes.Buffer{}
-			e := &HostEnvironment{
-				Path:        filepath.Join(dir, "path"),
-				TmpDir:      filepath.Join(dir, "tmp"),
-				ToolCache:   filepath.Join(dir, "tool_cache"),
-				ActPath:     filepath.Join(dir, "act_path"),
-				StdOut:      buf,
-				Workdir:     filepath.Join(dir, "path"),
-				AllocatePTY: tc.allocPTY,
-			}
-			for _, p := range []string{e.Path, e.TmpDir, e.ToolCache, e.ActPath} {
-				require.NoError(t, os.MkdirAll(p, 0o700))
-			}
-
-			err := e.Exec(
-				[]string{"sh", "-c", "[ -t 1 ] && printf TTY || printf NOTTY"},
-				map[string]string{"PATH": os.Getenv("PATH")}, "", "",
-			)(context.Background())
-			require.NoError(t, err)
-			got := strings.TrimSpace(strings.ReplaceAll(buf.String(), "\r", ""))
-			assert.Equal(t, tc.expect, got)
-		})
-	}
-}
-
-func TestHostEnvironmentRemovePreservesWorkdirByDefault(t *testing.T) {
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	miscRoot := filepath.Join(base, "misc")
-	path := filepath.Join(miscRoot, "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	workdir := filepath.Join(base, "workspace", "owner", "repo")
-	require.NoError(t, os.MkdirAll(workdir, 0o700))
-
-	e := &HostEnvironment{
-		Path:    path,
-		Workdir: workdir,
-		CleanUp: func() {
-			_ = os.RemoveAll(miscRoot)
-		},
-		StdOut: os.Stdout,
-	}
-	require.NoError(t, e.Remove()(ctx))
-	_, err := os.Stat(workdir)
-	require.NoError(t, err)
-}
-
-func TestHostEnvironmentRemoveCleansWorkdirWhenOwned(t *testing.T) {
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	miscRoot := filepath.Join(base, "misc")
-	path := filepath.Join(miscRoot, "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	workdir := filepath.Join(base, "workspace", "123", "owner", "repo")
-	require.NoError(t, os.MkdirAll(workdir, 0o700))
-
-	e := &HostEnvironment{
-		Path:         path,
-		Workdir:      workdir,
-		CleanWorkdir: true,
-		CleanUp: func() {
-			_ = os.RemoveAll(miscRoot)
-		},
-		StdOut: os.Stdout,
-	}
-	require.NoError(t, e.Remove()(ctx))
-	_, err := os.Stat(workdir)
-	assert.ErrorIs(t, err, os.ErrNotExist)
-}
-
-func TestRemoveAllWithContextDoesNotHangOnStuckDelete(t *testing.T) {
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	orig := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// removeAllWithContext intentionally leaks the delete goroutine on timeout,
-	// and that goroutine still references removeAll. Unblock it and wait for it
-	// to return before restoring the var, so the restore can't race the read.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = orig
-	})
-
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-
-	err := removeAllWithContext(ctx, t.TempDir())
-	require.ErrorIs(t, err, context.DeadlineExceeded)
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp guards against a stalled
-// CleanUp callback (e.g. an os.RemoveAll blocked by an AV/EDR filter driver or
-// an unresponsive mount) wedging the runner slot forever at "Cleaning up
-// container". Remove must time out the callback and complete job teardown.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp(t *testing.T) {
-	// Keep the suite fast: shrink the per-phase teardown timeout for this test.
-	orig := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = orig })
-
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	release := make(chan struct{})
-	t.Cleanup(func() { close(release) }) // unblock the leaked goroutine at test end
-
-	e := &HostEnvironment{
-		Path: path,
-		CleanUp: func() {
-			<-release // simulate a delete syscall stuck indefinitely
-		},
-		StdOut: os.Stdout,
-	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck CleanUp callback")
-	}
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval guards against a
-// stalled os.RemoveAll on the misc/workspace paths (same AV/EDR wedge as
-// #1023) wedging job completion after the CleanUp callback has already timed
-// out or finished.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval(t *testing.T) {
-	origTimeout := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = origTimeout })
-
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	origRemoveAll := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// The stuck delete goroutine outlives the timed-out Remove and still reads
-	// removeAll; unblock it and wait before restoring to avoid a restore/read race.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = origRemoveAll
-	})
-
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	e := &HostEnvironment{
-		Path:   path,
-		StdOut: os.Stdout,
-	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck path removal")
-	}
-}
-
-func TestBuildWindowsWorkspaceKillScript(t *testing.T) {
-	t.Run("single dir", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{`C:\workspace\job1`})
-		assert.Contains(t, s, `$paths = @('C:\workspace\job1')`)
-		// Self-PID guard is essential — without it the script could taskkill
-		// the PowerShell process running it.
-		assert.Contains(t, s, "$selfPid = $PID")
-		assert.Contains(t, s, "$_.ProcessId -eq $selfPid")
-		// Must match both ExecutablePath (binaries from the workspace) and
-		// CommandLine (system binaries invoked with workspace paths in args),
-		// both bounded by dir+separator so a name-prefix sibling is spared.
-		assert.Contains(t, s, `$prefix = $p + '\'`)
-		assert.Contains(t, s, "$_.ExecutablePath.StartsWith($prefix")
-		assert.Contains(t, s, "$_.CommandLine.IndexOf($prefix")
-		// Each matched PID must be tree-killed, not just stopped.
-		assert.Contains(t, s, "taskkill.exe /PID $_.ProcessId /T /F")
-	})
-
-	t.Run("multiple dirs comma-separated", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{
-			`C:\work\path`,
-			`C:\work\workdir`,
-			`C:\Users\runner\AppData\Local\Temp\job-42`,
-		})
-		assert.Contains(t, s, `'C:\work\path'`)
-		assert.Contains(t, s, `'C:\work\workdir'`)
-		assert.Contains(t, s, `'C:\Users\runner\AppData\Local\Temp\job-42'`)
-		// Commas between entries — no trailing comma, no leading comma.
-		assert.Contains(t, s, `'C:\work\path','C:\work\workdir',`)
-	})
-
-	t.Run("path with single quote is escaped", func(t *testing.T) {
-		// In PowerShell single-quoted strings the only special char is the
-		// quote itself, escaped by doubling. A workspace path that ever
-		// contained `'` would inject a command into the script otherwise.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\it's\path`})
-		assert.Contains(t, s, `'C:\work\it''s\path'`)
-		// And it must NOT appear unescaped — otherwise the quote would
-		// terminate the literal early.
-		assert.NotContains(t, s, `'C:\work\it's\path'`)
-	})
-
-	t.Run("path with wildcard metacharacters is matched literally", func(t *testing.T) {
-		// A path containing [ ] ? * must be embedded verbatim and matched with
-		// ordinal String methods, not -like, otherwise the metacharacters would
-		// be interpreted as wildcards and the leftover process could escape.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\[job]?1`})
-		assert.Contains(t, s, `'C:\work\[job]?1'`)
-		assert.NotContains(t, s, "-like")
-		assert.Contains(t, s, "StartsWith")
-		assert.Contains(t, s, "IndexOf")
-	})
-
-	t.Run("empty dir list still produces a valid script", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript(nil)
-		// Empty array literal — script runs, matches nothing, is a no-op.
-		assert.Contains(t, s, "$paths = @()")
-		assert.Contains(t, s, "Get-CimInstance Win32_Process")
-	})
-}

act/container/linux_container_environment_extensions.go

@@ -1,83 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"path/filepath"
-	"regexp"
-	"runtime"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-)
-
-type LinuxContainerEnvironmentExtensions struct{}
-
-// Resolves the equivalent host path inside the container
-// This is required for windows and WSL 2 to translate things like C:\Users\Myproject to /mnt/users/Myproject
-// For use in docker volumes and binds
-func (*LinuxContainerEnvironmentExtensions) ToContainerPath(path string) string {
-	if runtime.GOOS == "windows" && strings.Contains(path, "/") {
-		log.Error("You cannot specify linux style local paths (/mnt/etc) on Windows as it does not understand them.")
-		return ""
-	}
-
-	abspath, err := filepath.Abs(path)
-	if err != nil {
-		log.Error(err)
-		return ""
-	}
-
-	// Test if the path is a windows path
-	windowsPathRegex := regexp.MustCompile(`^([a-zA-Z]):\\(.+)$`)
-	windowsPathComponents := windowsPathRegex.FindStringSubmatch(abspath)
-
-	// Return as-is if no match
-	if windowsPathComponents == nil {
-		return abspath
-	}
-
-	// Convert to WSL2-compatible path if it is a windows path
-	// NOTE: Cannot use filepath because it will use the wrong path separators assuming we want the path to be windows
-	// based if running on Windows, and because we are feeding this to Docker, GoLang auto-path-translate doesn't work.
-	driveLetter := strings.ToLower(windowsPathComponents[1])
-	translatedPath := strings.ReplaceAll(windowsPathComponents[2], `\`, `/`)
-	// Should make something like /mnt/c/Users/person/My Folder/MyActProject
-	result := strings.Join([]string{"/mnt", driveLetter, translatedPath}, `/`)
-	return result
-}
-
-func (*LinuxContainerEnvironmentExtensions) GetActPath() string {
-	return "/var/run/act"
-}
-
-func (*LinuxContainerEnvironmentExtensions) GetPathVariableName() string {
-	return "PATH"
-}
-
-func (*LinuxContainerEnvironmentExtensions) DefaultPathVariable() string {
-	return "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-}
-
-func (*LinuxContainerEnvironmentExtensions) JoinPathVariable(paths ...string) string {
-	return strings.Join(paths, ":")
-}
-
-// DefaultToolCache is where the runner mounts the tool cache inside job containers.
-const DefaultToolCache = "/opt/hostedtoolcache"
-
-func (*LinuxContainerEnvironmentExtensions) GetRunnerContext(ctx context.Context) map[string]any {
-	return map[string]any{
-		"os":         "Linux",
-		"arch":       RunnerArch(ctx),
-		"temp":       "/tmp",
-		"tool_cache": DefaultToolCache,
-	}
-}
-
-func (*LinuxContainerEnvironmentExtensions) IsEnvironmentCaseInsensitive() bool {
-	return false
-}

act/container/linux_container_environment_extensions_test.go

@@ -1,70 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"fmt"
-	"os"
-	"runtime"
-	"strings"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestContainerPath(t *testing.T) {
-	type containerPathJob struct {
-		destinationPath string
-		sourcePath      string
-		workDir         string
-	}
-
-	linuxcontainerext := &LinuxContainerEnvironmentExtensions{}
-
-	if runtime.GOOS == "windows" {
-		cwd, err := os.Getwd()
-		if err != nil {
-			log.Error(err)
-		}
-
-		rootDrive := os.Getenv("SystemDrive")
-		rootDriveLetter := strings.ReplaceAll(strings.ToLower(rootDrive), `:`, "")
-		for _, v := range []containerPathJob{
-			{"/mnt/c/Users/act/go/src/github.com/nektos/act", "C:\\Users\\act\\go\\src\\github.com\\nektos\\act\\", ""},
-			{"/mnt/f/work/dir", `F:\work\dir`, ""},
-			{"/mnt/c/windows/to/unix", "windows\\to\\unix", rootDrive + "\\"},
-			{fmt.Sprintf("/mnt/%v/act", rootDriveLetter), "act", rootDrive + "\\"},
-		} {
-			if v.workDir != "" {
-				t.Chdir(v.workDir)
-			}
-
-			assert.Equal(t, v.destinationPath, linuxcontainerext.ToContainerPath(v.sourcePath))
-		}
-
-		t.Chdir(cwd)
-	} else {
-		cwd, err := os.Getwd()
-		if err != nil {
-			log.Error(err)
-		}
-		for _, v := range []containerPathJob{
-			{"/home/act/go/src/github.com/nektos/act", "/home/act/go/src/github.com/nektos/act", ""},
-			{"/home/act", `/home/act/`, ""},
-			{cwd, ".", ""},
-		} {
-			assert.Equal(t, v.destinationPath, linuxcontainerext.ToContainerPath(v.sourcePath))
-		}
-	}
-}
-
-type typeAssertMockContainer struct {
-	Container
-	LinuxContainerEnvironmentExtensions
-}
-
-// Type assert Container + LinuxContainerEnvironmentExtensions implements ExecutionsEnvironment
-var _ ExecutionsEnvironment = &typeAssertMockContainer{}

act/container/parse_env_file.go

@@ -1,81 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"archive/tar"
-	"bufio"
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"golang.org/x/text/encoding/unicode"
-	"golang.org/x/text/transform"
-)
-
-func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Executor {
-	localEnv := *env
-	return func(ctx context.Context) error {
-		envTar, err := e.GetContainerArchive(ctx, srcPath)
-		if err != nil {
-			return nil
-		}
-		defer envTar.Close()
-		reader := tar.NewReader(envTar)
-		_, err = reader.Next()
-		if err != nil && err != io.EOF {
-			return err
-		}
-		// Decode by BOM: Windows PowerShell 5.1 redirection writes UTF-16, and some
-		// tools emit a UTF-8 BOM. Without a BOM the file is read as UTF-8, as before.
-		decoded := transform.NewReader(reader, unicode.BOMOverride(unicode.UTF8.NewDecoder()))
-
-		s := bufio.NewScanner(decoded)
-		// Default 64 KiB max token size is too small for realistic env-file lines; allow up to 16 MiB.
-		s.Buffer(make([]byte, 0, 64*1024), 16*1024*1024)
-		for s.Scan() {
-			line := s.Text()
-			// GitHub's runner ignores blank lines
-			if strings.TrimSpace(line) == "" {
-				continue
-			}
-			singleLineEnv := strings.Index(line, "=")
-			multiLineEnv := strings.Index(line, "<<")
-			switch {
-			case singleLineEnv != -1 && (multiLineEnv == -1 || singleLineEnv < multiLineEnv):
-				localEnv[line[:singleLineEnv]] = line[singleLineEnv+1:]
-			case multiLineEnv != -1:
-				var multiLineEnvContent []string
-				multiLineEnvDelimiter := line[multiLineEnv+2:]
-				delimiterFound := false
-				for s.Scan() {
-					content := s.Text()
-					if content == multiLineEnvDelimiter {
-						delimiterFound = true
-						break
-					}
-					multiLineEnvContent = append(multiLineEnvContent, content)
-				}
-				if err := s.Err(); err != nil {
-					return fmt.Errorf("reading env file: %w", err)
-				}
-				if !delimiterFound {
-					return fmt.Errorf("invalid format delimiter '%v' not found before end of file", multiLineEnvDelimiter)
-				}
-				localEnv[line[:multiLineEnv]] = strings.Join(multiLineEnvContent, "\n")
-			default:
-				return fmt.Errorf("invalid format '%v', expected a line with '=' or '<<'", line)
-			}
-		}
-		if err := s.Err(); err != nil {
-			return fmt.Errorf("reading env file: %w", err)
-		}
-		env = &localEnv
-		return nil
-	}
-}

act/container/parse_env_file_test.go

@@ -1,139 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"bufio"
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/text/encoding"
-	"golang.org/x/text/encoding/unicode"
-)
-
-func newTestHostEnv(t *testing.T) (*HostEnvironment, string) {
-	t.Helper()
-	e := &HostEnvironment{Path: t.TempDir()}
-	return e, filepath.Join(e.Path, "envfile")
-}
-
-func TestParseEnvFileSingleLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO=bar\nBAZ=qux\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-	assert.Equal(t, "qux", env["BAZ"])
-}
-
-func TestParseEnvFileMultiLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	content := "FOO<<EOF\nline1\nline2\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "line1\nline2", env["FOO"])
-}
-
-func TestParseEnvFileLargeValueWithinLimit(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	big := strings.Repeat("x", 2*1024*1024)
-	content := "FOO<<EOF\n" + big + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, big, env["FOO"])
-}
-
-func TestParseEnvFileLineExceedsBufferReportsScannerError(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	tooBig := strings.Repeat("x", 17*1024*1024) // over the 16 MiB cap
-	content := "FOO<<EOF\n" + tooBig + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.ErrorIs(t, err, bufio.ErrTooLong)
-	assert.Contains(t, err.Error(), "reading env file")
-}
-
-// Regression test: a blank line used to fail the job at "Complete Job", after
-// every step had already been recorded as successful.
-func TestParseEnvFileBlankLines(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("\nFOO=bar\n\n   \nBAZ=qux\n\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-	assert.Equal(t, "qux", env["BAZ"])
-}
-
-// blank lines inside a heredoc value are content, not separators
-func TestParseEnvFileMultiLineKeepsBlankLines(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\n\nline2\nEOF\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "line1\n\nline2", env["FOO"])
-
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\n\nline2\nEOF\n"), 0o600))
-	env = map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "\nline2", env["FOO"])
-}
-
-func TestParseEnvFileUTF8BOM(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	content := append([]byte{0xEF, 0xBB, 0xBF}, []byte("FOO=bar\n")...)
-	require.NoError(t, os.WriteFile(envPath, content, 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-}
-
-// Windows host mode: PowerShell 5.1 redirection writes UTF-16, which used to be
-// unrecognisable as KEY=VALUE, so the writes were silently ignored.
-func TestParseEnvFileUTF16(t *testing.T) {
-	tests := []struct {
-		name    string
-		encoder *encoding.Encoder
-	}{
-		{"little endian", unicode.UTF16(unicode.LittleEndian, unicode.UseBOM).NewEncoder()},
-		{"big endian", unicode.UTF16(unicode.BigEndian, unicode.UseBOM).NewEncoder()},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			e, envPath := newTestHostEnv(t)
-			content, err := tt.encoder.Bytes([]byte("FOO=bar\r\nMULTI<<EOF\r\nline1\r\nEOF\r\n"))
-			require.NoError(t, err)
-			require.NoError(t, os.WriteFile(envPath, content, 0o600))
-
-			env := map[string]string{}
-			require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-			assert.Equal(t, "bar", env["FOO"])
-			assert.Equal(t, "line1", env["MULTI"])
-		})
-	}
-}
-
-func TestParseEnvFileMissingDelimiter(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\nline2\n"), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "delimiter")
-}

act/container/testdata/Dockerfile

@@ -1,5 +0,0 @@
-FROM scratch
-ENV PATH="/this/path/does/not/exists/anywhere:/this/either"
-ENV SOME_RANDOM_VAR=""
-ENV ANOTHER_ONE="BUT_I_HAVE_VALUE"
-ENV CONFLICT_VAR="I_EXIST_ONLY_HERE"

act/container/testdata/docker-pull-options/config.json

@@ -1,7 +0,0 @@
-{
-  "auths": {
-          "https://index.docker.io/v1/": {
-                  "auth": "dXNlcm5hbWU6cGFzc3dvcmQK"
-          }
-  }
-}

act/container/testdata/scratch/test.txt

@@ -1 +0,0 @@
-testfile

act/container/testdata/utf8.env

@@ -1,3 +0,0 @@
-FOO=BAR
-HELLO=您好
-BAR=FOO

act/container/testdata/valid.env

@@ -1 +0,0 @@
-ENV1=value1

act/container/testdata/valid.label

@@ -1 +0,0 @@
-LABEL1=value1

act/filecollector/file_collector.go

@@ -1,181 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// Copyright 2024 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package filecollector
-
-import (
-	"archive/tar"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-
-	git "github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing/filemode"
-	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
-	"github.com/go-git/go-git/v5/plumbing/format/index"
-)
-
-type Handler interface {
-	WriteFile(path string, fi fs.FileInfo, linkName string, f io.Reader) error
-}
-
-type TarCollector struct {
-	TarWriter *tar.Writer
-	UID       int
-	GID       int
-	DstDir    string
-}
-
-func (tc TarCollector) WriteFile(fpath string, fi fs.FileInfo, linkName string, f io.Reader) error {
-	// create a new dir/file header
-	header, err := tar.FileInfoHeader(fi, linkName)
-	if err != nil {
-		return err
-	}
-
-	// update the name to correctly reflect the desired destination when untaring
-	header.Name = path.Join(tc.DstDir, fpath)
-	header.Mode = int64(fi.Mode())
-	header.ModTime = fi.ModTime()
-	header.Uid = tc.UID
-	header.Gid = tc.GID
-
-	// write the header
-	if err := tc.TarWriter.WriteHeader(header); err != nil {
-		return err
-	}
-
-	// this is a symlink no reader provided
-	if f == nil {
-		return nil
-	}
-
-	// copy file data into tar writer
-	if _, err := io.Copy(tc.TarWriter, f); err != nil {
-		return err
-	}
-	return nil
-}
-
-type CopyCollector struct {
-	DstDir string
-}
-
-func (cc *CopyCollector) WriteFile(fpath string, fi fs.FileInfo, linkName string, f io.Reader) error {
-	fdestpath := filepath.Join(cc.DstDir, fpath)
-	if err := os.MkdirAll(filepath.Dir(fdestpath), 0o777); err != nil {
-		return err
-	}
-	// Remove any existing destination so we can overwrite read-only files
-	// (e.g. git pack files at mode 0444 trip EACCES on macOS and "Access is
-	// denied" on Windows when reopened with O_WRONLY) and so os.Symlink does
-	// not fail with EEXIST. os.Remove clears the Windows read-only attribute
-	// internally; on Unix unlink only needs write permission on the parent.
-	_ = os.Remove(fdestpath)
-	if f == nil {
-		return os.Symlink(linkName, fdestpath)
-	}
-	df, err := os.OpenFile(fdestpath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fi.Mode())
-	if err != nil {
-		return err
-	}
-	defer df.Close()
-	if _, err := io.Copy(df, f); err != nil {
-		return err
-	}
-	return nil
-}
-
-type FileCollector struct {
-	Ignorer   gitignore.Matcher
-	SrcPath   string
-	SrcPrefix string
-	Handler   Handler
-}
-
-func openGitIndex(path string) (*index.Index, error) {
-	repo, err := git.PlainOpen(path)
-	if err != nil {
-		return nil, err
-	}
-	return repo.Storer.Index()
-}
-
-func (fc *FileCollector) CollectFiles(ctx context.Context, submodulePath []string) filepath.WalkFunc {
-	i, _ := openGitIndex(path.Join(fc.SrcPath, path.Join(submodulePath...)))
-	return func(file string, fi os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		if ctx != nil && ctx.Err() != nil {
-			return errors.New("copy cancelled")
-		}
-
-		sansPrefix := strings.TrimPrefix(file, fc.SrcPrefix)
-		split := strings.Split(sansPrefix, string(filepath.Separator))
-		// The root folders should be skipped, submodules only have the last path component set to "." by filepath.Walk
-		if fi.IsDir() && len(split) > 0 && split[len(split)-1] == "." {
-			return nil
-		}
-		var entry *index.Entry
-		if i != nil {
-			entry, err = i.Entry(strings.Join(split[len(submodulePath):], "/"))
-		} else {
-			err = index.ErrEntryNotFound
-		}
-		if err != nil && fc.Ignorer != nil && fc.Ignorer.Match(split, fi.IsDir()) {
-			if fi.IsDir() {
-				if i != nil {
-					ms, err := i.Glob(strings.Join(append(split[len(submodulePath):], "**"), "/"))
-					if err != nil || len(ms) == 0 {
-						return filepath.SkipDir
-					}
-				} else {
-					return filepath.SkipDir
-				}
-			} else {
-				return nil
-			}
-		}
-		if err == nil && entry.Mode == filemode.Submodule {
-			err = filepath.Walk(file, fc.CollectFiles(ctx, split))
-			if err != nil {
-				return err
-			}
-			return filepath.SkipDir
-		}
-		path := filepath.ToSlash(sansPrefix)
-
-		// return on non-regular files (thanks to [kumo](https://medium.com/@komuw/just-like-you-did-fbdd7df829d3) for this suggested update)
-		if fi.Mode()&os.ModeSymlink == os.ModeSymlink {
-			linkName, err := os.Readlink(file)
-			if err != nil {
-				return fmt.Errorf("unable to readlink '%s': %w", file, err)
-			}
-			return fc.Handler.WriteFile(path, fi, linkName, nil)
-		} else if !fi.Mode().IsRegular() {
-			return nil
-		}
-
-		// open file
-		f, err := os.Open(file)
-		if err != nil {
-			return err
-		}
-		defer f.Close()
-
-		if ctx != nil {
-			stop := context.AfterFunc(ctx, func() { _ = f.Close() })
-			defer stop()
-		}
-
-		return fc.Handler.WriteFile(path, fi, "", f)
-	}
-}

act/filecollector/file_collector_test.go

@@ -1,153 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// Copyright 2024 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package filecollector
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	git "github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestIgnoredTrackedfile(t *testing.T) {
-	repoDir := filepath.Join(t.TempDir(), "mygitrepo")
-	repo, err := git.PlainInit(repoDir, false)
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(filepath.Join(repoDir, ".gitignore"), []byte(".*\n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(repoDir, ".env"), []byte("test=val1\n"), 0o644))
-	worktree, err := repo.Worktree()
-	require.NoError(t, err)
-	_, err = worktree.Add(".gitignore")
-	require.NoError(t, err)
-
-	var archive bytes.Buffer
-	tw := tar.NewWriter(&archive)
-	patterns, err := gitignore.ReadPatterns(worktree.Filesystem, nil)
-	require.NoError(t, err)
-	ignorer := gitignore.NewMatcher(patterns)
-	fc := &FileCollector{
-		Ignorer:   ignorer,
-		SrcPath:   repoDir,
-		SrcPrefix: repoDir + string(filepath.Separator),
-		Handler: &TarCollector{
-			TarWriter: tw,
-		},
-	}
-	err = filepath.Walk(repoDir, fc.CollectFiles(context.Background(), nil))
-	assert.NoError(t, err, "successfully collect files")
-	require.NoError(t, tw.Close())
-	tr := tar.NewReader(&archive)
-	h, err := tr.Next()
-	assert.NoError(t, err, "tar must not be empty") //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, ".gitignore", h.Name)
-	_, err = tr.Next()
-	assert.ErrorIs(t, err, io.EOF, "tar must only contain one element")
-}
-
-func TestSymlinks(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating symlinks requires elevated privileges on Windows")
-	}
-	repoDir := filepath.Join(t.TempDir(), "mygitrepo")
-	repo, err := git.PlainInit(repoDir, false)
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(filepath.Join(repoDir, ".env"), []byte("test=val1\n"), 0o644))
-	require.NoError(t, os.Symlink(".env", filepath.Join(repoDir, "test.env")))
-	worktree, err := repo.Worktree()
-	require.NoError(t, err)
-	_, err = worktree.Add("test.env")
-	require.NoError(t, err)
-
-	var archive bytes.Buffer
-	tw := tar.NewWriter(&archive)
-	fc := &FileCollector{
-		SrcPath:   repoDir,
-		SrcPrefix: repoDir + string(filepath.Separator),
-		Handler: &TarCollector{
-			TarWriter: tw,
-		},
-	}
-	err = filepath.Walk(repoDir, fc.CollectFiles(context.Background(), nil))
-	assert.NoError(t, err, "successfully collect files")
-	require.NoError(t, tw.Close())
-	tr := tar.NewReader(&archive)
-	h, err := tr.Next()
-	files := map[string]tar.Header{}
-	for err == nil {
-		files[h.Name] = *h
-		h, err = tr.Next()
-	}
-
-	assert.Equal(t, ".env", files[".env"].Name)
-	assert.Equal(t, "test.env", files["test.env"].Name)
-	assert.Equal(t, ".env", files["test.env"].Linkname)
-	assert.ErrorIs(t, err, io.EOF, "tar must be read cleanly to EOF")
-}
-
-// Regression for https://gitea.com/gitea/runner/issues/876 and /941:
-// re-copying an action directory must overwrite a pre-existing read-only
-// file (e.g. a git pack .idx at mode 0444) instead of failing with EACCES
-// on macOS or "Access is denied" on Windows.
-func TestCopyCollectorWriteFileOverwritesReadOnlyFile(t *testing.T) {
-	dst := t.TempDir()
-	target := filepath.Join(dst, "sub", "pack.idx")
-	require.NoError(t, os.MkdirAll(filepath.Dir(target), 0o755))
-	require.NoError(t, os.WriteFile(target, []byte("old"), 0o444))
-
-	src := filepath.Join(t.TempDir(), "pack.idx")
-	require.NoError(t, os.WriteFile(src, []byte("new"), 0o444))
-	fi, err := os.Stat(src)
-	require.NoError(t, err)
-
-	cc := &CopyCollector{DstDir: dst}
-	require.NoError(t, cc.WriteFile("sub/pack.idx", fi, "", strings.NewReader("new")))
-
-	got, err := os.ReadFile(target)
-	require.NoError(t, err)
-	assert.Equal(t, "new", string(got))
-}
-
-// Without the destination removal, os.Symlink fails with EEXIST when the
-// path already holds a regular file from an earlier copy of the action.
-func TestCopyCollectorWriteFileOverwritesFileWithSymlink(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating symlinks requires elevated privileges on Windows")
-	}
-	dst := t.TempDir()
-	target := filepath.Join(dst, "link")
-	require.NoError(t, os.WriteFile(target, []byte("stale"), 0o644))
-
-	fi, err := os.Lstat(target)
-	require.NoError(t, err)
-
-	cc := &CopyCollector{DstDir: dst}
-	require.NoError(t, cc.WriteFile("link", fi, "target", nil))
-
-	resolved, err := os.Readlink(target)
-	require.NoError(t, err)
-	assert.Equal(t, "target", resolved)
-}
-
-func TestFileCollectorCancellationAndWalkError(t *testing.T) {
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-	walk := (&FileCollector{}).CollectFiles(ctx, nil)
-
-	err := walk("file", nil, nil)
-	require.EqualError(t, err, "copy cancelled")
-
-	err = walk("file", nil, os.ErrPermission)
-	require.ErrorIs(t, err, os.ErrPermission)
-}

act/ghcontext/github_context.go

@@ -1,119 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-// Package ghcontext fills a model.GithubContext from the local git checkout.
-// The pure data parts of the context live in the shared
-// gitea.dev/actionslib/pkg/model package, only the helpers that need a
-// git repository on disk are kept here.
-package ghcontext
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-
-	"gitea.dev/actionslib/pkg/model"
-)
-
-var (
-	findGitRef      = git.FindGitRef
-	findGitRevision = git.FindGitRevision
-	findGithubRepo  = git.FindGithubRepo
-)
-
-// SetRef resolves the ref of the context from its event payload, falling back
-// to the ref checked out in repoPath.
-func SetRef(ctx context.Context, ghc *model.GithubContext, repoPath string) {
-	logger := common.Logger(ctx)
-
-	// https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
-	// https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads
-	switch ghc.EventName {
-	case "pull_request_target":
-		ghc.Ref = "refs/heads/" + ghc.BaseRef
-	case "pull_request", "pull_request_review", "pull_request_review_comment":
-		ghc.Ref = fmt.Sprintf("refs/pull/%.0f/merge", ghc.Event["number"])
-	case "deployment", "deployment_status":
-		ghc.Ref = model.AsString(model.NestedMapLookup(ghc.Event, "deployment", "ref"))
-	case "release":
-		ghc.Ref = "refs/tags/" + model.AsString(model.NestedMapLookup(ghc.Event, "release", "tag_name"))
-	case "push", "create", "workflow_dispatch":
-		ghc.Ref = model.AsString(ghc.Event["ref"])
-	default:
-		defaultBranch := model.AsString(model.NestedMapLookup(ghc.Event, "repository", "default_branch"))
-		if defaultBranch != "" {
-			ghc.Ref = "refs/heads/" + defaultBranch
-		}
-	}
-
-	if ghc.Ref == "" {
-		ref, err := findGitRef(ctx, repoPath)
-		if err != nil {
-			logger.Warningf("unable to get git ref: %v", err)
-		} else {
-			logger.Debugf("using github ref: %s", ref)
-			ghc.Ref = ref
-		}
-
-		repository, exists := ghc.Event["repository"]
-		if !exists {
-			repository = map[string]any{}
-		}
-		if repository, ok := repository.(map[string]any); !ok {
-			logger.Warn("unable to set default branch to master")
-		} else if _, exists := repository["default_branch"]; !exists {
-			repository["default_branch"] = "master"
-			ghc.Event["repository"] = repository
-		}
-
-		if ghc.Ref == "" {
-			ghc.Ref = "refs/heads/" + model.AsString(model.NestedMapLookup(ghc.Event, "repository", "default_branch"))
-		}
-	}
-}
-
-// SetSha resolves the commit of the context from its event payload, falling
-// back to the revision checked out in repoPath.
-func SetSha(ctx context.Context, ghc *model.GithubContext, repoPath string) {
-	logger := common.Logger(ctx)
-
-	// https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
-	// https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads
-	switch ghc.EventName {
-	case "pull_request_target":
-		ghc.Sha = model.AsString(model.NestedMapLookup(ghc.Event, "pull_request", "base", "sha"))
-	case "deployment", "deployment_status":
-		ghc.Sha = model.AsString(model.NestedMapLookup(ghc.Event, "deployment", "sha"))
-	case "push", "create", "workflow_dispatch":
-		if deleted, ok := ghc.Event["deleted"].(bool); ok && !deleted {
-			ghc.Sha = model.AsString(ghc.Event["after"])
-		}
-	}
-
-	if ghc.Sha == "" {
-		_, sha, err := findGitRevision(ctx, repoPath)
-		if err != nil {
-			logger.Warningf("unable to get git revision: %v", err)
-		} else {
-			ghc.Sha = sha
-		}
-	}
-}
-
-// SetRepositoryAndOwner resolves the repository of the context from the git
-// remote in repoPath when it is not set yet, and derives its owner.
-func SetRepositoryAndOwner(ctx context.Context, ghc *model.GithubContext, githubInstance, repoPath string) {
-	if ghc.Repository == "" {
-		repo, err := findGithubRepo(ctx, repoPath, githubInstance)
-		if err != nil {
-			common.Logger(ctx).Warningf("unable to get git repo (githubInstance: %v, repoPath: %v): %v", githubInstance, repoPath, err)
-			return
-		}
-		ghc.Repository = repo
-	}
-	ghc.RepositoryOwner = strings.Split(ghc.Repository, "/")[0]
-}

act/ghcontext/github_context_test.go

@@ -1,217 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package ghcontext
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"gitea.dev/actionslib/pkg/model"
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestSetRef(t *testing.T) {
-	log.SetLevel(log.DebugLevel)
-
-	oldFindGitRef := findGitRef
-	oldFindGitRevision := findGitRevision
-	defer func() { findGitRef = oldFindGitRef }()
-	defer func() { findGitRevision = oldFindGitRevision }()
-
-	findGitRef = func(ctx context.Context, file string) (string, error) {
-		return "refs/heads/master", nil
-	}
-
-	findGitRevision = func(ctx context.Context, file string) (string, string, error) {
-		return "", "1234fakesha", nil
-	}
-
-	tables := []struct {
-		eventName string
-		event     map[string]any
-		ref       string
-		refName   string
-	}{
-		{
-			eventName: "pull_request_target",
-			event:     map[string]any{},
-			ref:       "refs/heads/master",
-			refName:   "master",
-		},
-		{
-			eventName: "pull_request",
-			event: map[string]any{
-				"number": 1234.,
-			},
-			ref:     "refs/pull/1234/merge",
-			refName: "1234/merge",
-		},
-		{
-			eventName: "deployment",
-			event: map[string]any{
-				"deployment": map[string]any{
-					"ref": "refs/heads/somebranch",
-				},
-			},
-			ref:     "refs/heads/somebranch",
-			refName: "somebranch",
-		},
-		{
-			eventName: "release",
-			event: map[string]any{
-				"release": map[string]any{
-					"tag_name": "v1.0.0",
-				},
-			},
-			ref:     "refs/tags/v1.0.0",
-			refName: "v1.0.0",
-		},
-		{
-			eventName: "push",
-			event: map[string]any{
-				"ref": "refs/heads/somebranch",
-			},
-			ref:     "refs/heads/somebranch",
-			refName: "somebranch",
-		},
-		{
-			eventName: "unknown",
-			event: map[string]any{
-				"repository": map[string]any{
-					"default_branch": "main",
-				},
-			},
-			ref:     "refs/heads/main",
-			refName: "main",
-		},
-		{
-			eventName: "no-event",
-			event:     map[string]any{},
-			ref:       "refs/heads/master",
-			refName:   "master",
-		},
-	}
-
-	for _, table := range tables {
-		t.Run(table.eventName, func(t *testing.T) {
-			ghc := &model.GithubContext{
-				EventName: table.eventName,
-				BaseRef:   "master",
-				Event:     table.event,
-			}
-
-			SetRef(context.Background(), ghc, "/some/dir")
-			ghc.SetRefTypeAndName()
-
-			assert.Equal(t, table.ref, ghc.Ref)
-			assert.Equal(t, table.refName, ghc.RefName)
-		})
-	}
-
-	t.Run("no-default-branch", func(t *testing.T) {
-		findGitRef = func(ctx context.Context, file string) (string, error) {
-			return "", errors.New("no default branch")
-		}
-
-		ghc := &model.GithubContext{
-			EventName: "no-default-branch",
-			Event:     map[string]any{},
-		}
-
-		SetRef(context.Background(), ghc, "/some/dir")
-
-		assert.Equal(t, "refs/heads/master", ghc.Ref)
-	})
-}
-
-func TestSetSha(t *testing.T) {
-	log.SetLevel(log.DebugLevel)
-
-	oldFindGitRef := findGitRef
-	oldFindGitRevision := findGitRevision
-	defer func() { findGitRef = oldFindGitRef }()
-	defer func() { findGitRevision = oldFindGitRevision }()
-
-	findGitRef = func(ctx context.Context, file string) (string, error) {
-		return "refs/heads/master", nil
-	}
-
-	findGitRevision = func(ctx context.Context, file string) (string, string, error) {
-		return "", "1234fakesha", nil
-	}
-
-	tables := []struct {
-		eventName string
-		event     map[string]any
-		sha       string
-	}{
-		{
-			eventName: "pull_request_target",
-			event: map[string]any{
-				"pull_request": map[string]any{
-					"base": map[string]any{
-						"sha": "pr-base-sha",
-					},
-				},
-			},
-			sha: "pr-base-sha",
-		},
-		{
-			eventName: "pull_request",
-			event: map[string]any{
-				"number": 1234.,
-			},
-			sha: "1234fakesha",
-		},
-		{
-			eventName: "deployment",
-			event: map[string]any{
-				"deployment": map[string]any{
-					"sha": "deployment-sha",
-				},
-			},
-			sha: "deployment-sha",
-		},
-		{
-			eventName: "release",
-			event:     map[string]any{},
-			sha:       "1234fakesha",
-		},
-		{
-			eventName: "push",
-			event: map[string]any{
-				"after":   "push-sha",
-				"deleted": false,
-			},
-			sha: "push-sha",
-		},
-		{
-			eventName: "unknown",
-			event:     map[string]any{},
-			sha:       "1234fakesha",
-		},
-		{
-			eventName: "no-event",
-			event:     map[string]any{},
-			sha:       "1234fakesha",
-		},
-	}
-
-	for _, table := range tables {
-		t.Run(table.eventName, func(t *testing.T) {
-			ghc := &model.GithubContext{
-				EventName: table.eventName,
-				BaseRef:   "master",
-				Event:     table.event,
-			}
-
-			SetSha(context.Background(), ghc, "/some/dir")
-
-			assert.Equal(t, table.sha, ghc.Sha)
-		})
-	}
-}

act/lookpath/LICENSE

@@ -1,27 +0,0 @@
-Copyright (c) 2009 The Go Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-	* Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-	* Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-	* Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

act/lookpath/env.go

@@ -1,21 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package lookpath
-
-import (
-	"runtime"
-	"strings"
-)
-
-func getenv(env map[string]string, name string) string {
-	if runtime.GOOS == "windows" {
-		for key, value := range env {
-			if strings.EqualFold(name, key) {
-				return value
-			}
-		}
-	}
-	return env[name]
-}

act/lookpath/error.go

@@ -1,14 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package lookpath
-
-type Error struct {
-	Name string
-	Err  error
-}
-
-func (e *Error) Error() string {
-	return e.Err.Error()
-}

act/lookpath/lp_js.go

@@ -1,24 +0,0 @@
-//nolint:goheader // pre-existing issue from nektos/act
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build js && wasm
-
-package lookpath
-
-import (
-	"errors"
-)
-
-// ErrNotFound is the error resulting if a path search failed to find an executable file.
-var ErrNotFound = errors.New("executable file not found in $PATH")
-
-// LookPath searches for an executable named file in the
-// directories named by the PATH environment variable.
-// If file contains a slash, it is tried directly and the PATH is not consulted.
-// The result may be an absolute path or a path relative to the current directory.
-func LookPath2(file string, _ map[string]string) (string, error) {
-	// Wasm can not execute processes, so act as if there are no executables at all.
-	return "", &Error{file, ErrNotFound}
-}

act/lookpath/lp_plan9.go

@@ -1,57 +0,0 @@
-//nolint:goheader // pre-existing issue from nektos/act
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package lookpath
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// ErrNotFound is the error resulting if a path search failed to find an executable file.
-var ErrNotFound = errors.New("executable file not found in $path")
-
-func findExecutable(file string) error {
-	d, err := os.Stat(file)
-	if err != nil {
-		return err
-	}
-	if m := d.Mode(); !m.IsDir() && m&0o111 != 0 {
-		return nil
-	}
-	return fs.ErrPermission
-}
-
-// LookPath searches for an executable named file in the
-// directories named by the path environment variable.
-// If file begins with "/", "#", "./", or "../", it is tried
-// directly and the path is not consulted.
-// The result may be an absolute path or a path relative to the current directory.
-func LookPath2(file string, env map[string]string) (string, error) {
-	// skip the path lookup for these prefixes
-	skip := []string{"/", "#", "./", "../"}
-
-	for _, p := range skip {
-		if strings.HasPrefix(file, p) {
-			err := findExecutable(file)
-			if err == nil {
-				return file, nil
-			}
-			return "", &Error{file, err}
-		}
-	}
-
-	path := getenv(env, "path")
-	for _, dir := range filepath.SplitList(path) {
-		path := filepath.Join(dir, file)
-		if err := findExecutable(path); err == nil {
-			return path, nil
-		}
-	}
-	return "", &Error{file, ErrNotFound}
-}

act/lookpath/lp_unix.go

@@ -1,60 +0,0 @@
-//nolint:goheader // pre-existing issue from nektos/act
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-
-package lookpath
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// ErrNotFound is the error resulting if a path search failed to find an executable file.
-var ErrNotFound = errors.New("executable file not found in $PATH")
-
-func findExecutable(file string) error {
-	d, err := os.Stat(file)
-	if err != nil {
-		return err
-	}
-	if m := d.Mode(); !m.IsDir() && m&0o111 != 0 {
-		return nil
-	}
-	return fs.ErrPermission
-}
-
-// LookPath searches for an executable named file in the
-// directories named by the PATH environment variable.
-// If file contains a slash, it is tried directly and the PATH is not consulted.
-// The result may be an absolute path or a path relative to the current directory.
-func LookPath2(file string, env map[string]string) (string, error) {
-	// NOTE(rsc): I wish we could use the Plan 9 behavior here
-	// (only bypass the path if file begins with / or ./ or ../)
-	// but that would not match all the Unix shells.
-
-	if strings.Contains(file, "/") {
-		err := findExecutable(file)
-		if err == nil {
-			return file, nil
-		}
-		return "", &Error{file, err}
-	}
-	path := getenv(env, "PATH")
-	for _, dir := range filepath.SplitList(path) {
-		if dir == "" {
-			// Unix shell semantics: path element "" means "."
-			dir = "."
-		}
-		path := filepath.Join(dir, file)
-		if err := findExecutable(path); err == nil {
-			return path, nil
-		}
-	}
-	return "", &Error{file, ErrNotFound}
-}

act/lookpath/lp_unix_test.go

@@ -1,68 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-
-package lookpath
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestLookPath2SearchesPathAndEmptyElement(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2("tool", map[string]string{"PATH": string(filepath.ListSeparator) + dir})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2DirectPathDoesNotSearchPath(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2(exe, map[string]string{"PATH": ""})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2ReportsPermissionAndNotFound(t *testing.T) {
-	dir := t.TempDir()
-	file := filepath.Join(dir, "not-executable")
-	if err := os.WriteFile(file, []byte("plain text"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := LookPath2(file, map[string]string{"PATH": dir})
-	var pathErr *Error
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, fs.ErrPermission) {
-		t.Fatalf("LookPath2(non-executable) error = %v, want fs.ErrPermission wrapped in *Error", err)
-	}
-	if pathErr.Error() != fs.ErrPermission.Error() {
-		t.Fatalf("Error() = %q, want %q", pathErr.Error(), fs.ErrPermission.Error())
-	}
-
-	_, err = LookPath2("missing", map[string]string{"PATH": dir})
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, ErrNotFound) {
-		t.Fatalf("LookPath2(missing) error = %v, want ErrNotFound wrapped in *Error", err)
-	}
-}

act/lookpath/lp_windows.go

@@ -1,95 +0,0 @@
-//nolint:goheader // pre-existing issue from nektos/act
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package lookpath
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// ErrNotFound is the error resulting if a path search failed to find an executable file.
-var ErrNotFound = errors.New("executable file not found in %PATH%")
-
-func chkStat(file string) error {
-	d, err := os.Stat(file)
-	if err != nil {
-		return err
-	}
-	if d.IsDir() {
-		return fs.ErrPermission
-	}
-	return nil
-}
-
-func hasExt(file string) bool {
-	i := strings.LastIndex(file, ".")
-	if i < 0 {
-		return false
-	}
-	return strings.LastIndexAny(file, `:\/`) < i
-}
-
-func findExecutable(file string, exts []string) (string, error) {
-	if len(exts) == 0 {
-		return file, chkStat(file)
-	}
-	if hasExt(file) {
-		if chkStat(file) == nil {
-			return file, nil
-		}
-	}
-	for _, e := range exts {
-		if f := file + e; chkStat(f) == nil {
-			return f, nil
-		}
-	}
-	return "", fs.ErrNotExist
-}
-
-// LookPath searches for an executable named file in the
-// directories named by the PATH environment variable.
-// If file contains a slash, it is tried directly and the PATH is not consulted.
-// LookPath also uses PATHEXT environment variable to match
-// a suitable candidate.
-// The result may be an absolute path or a path relative to the current directory.
-func LookPath2(file string, env map[string]string) (string, error) {
-	var exts []string
-	x := getenv(env, `PATHEXT`)
-	if x != "" {
-		for e := range strings.SplitSeq(strings.ToLower(x), `;`) {
-			if e == "" {
-				continue
-			}
-			if e[0] != '.' {
-				e = "." + e
-			}
-			exts = append(exts, e)
-		}
-	} else {
-		exts = []string{".com", ".exe", ".bat", ".cmd"}
-	}
-
-	if strings.ContainsAny(file, `:\/`) {
-		if f, err := findExecutable(file, exts); err == nil {
-			return f, nil
-		} else {
-			return "", &Error{file, err}
-		}
-	}
-	if f, err := findExecutable(filepath.Join(".", file), exts); err == nil {
-		return f, nil
-	}
-	path := getenv(env, "path")
-	for _, dir := range filepath.SplitList(path) {
-		if f, err := findExecutable(filepath.Join(dir, file), exts); err == nil {
-			return f, nil
-		}
-	}
-	return "", &Error{file, ErrNotFound}
-}

act/runner/action.go

@@ -1,735 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"crypto/sha256"
-	"embed"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path"
-	"path/filepath"
-	"regexp"
-	"runtime"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/container"
-
-	"gitea.dev/actionslib/pkg/model"
-	"github.com/kballard/go-shellquote"
-)
-
-type actionStep interface {
-	step
-
-	getActionModel() *model.Action
-	getCompositeRunContext(context.Context) *RunContext
-	getCompositeSteps() *compositeSteps
-}
-
-type readAction func(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error)
-
-type actionYamlReader func(filename string) (io.Reader, io.Closer, error)
-
-type fileWriter func(filename string, data []byte, perm fs.FileMode) error
-
-type runAction func(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor
-
-//go:embed res/trampoline.js
-var trampoline embed.FS
-
-var (
-	ContainerImageExistsLocally     = container.ImageExistsLocally
-	ContainerNewDockerBuildExecutor = container.NewDockerBuildExecutor
-)
-
-func readActionImpl(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
-	logger := common.Logger(ctx)
-	allErrors := []error{}
-	addError := func(fileName string, err error) {
-		if err != nil {
-			allErrors = append(allErrors, fmt.Errorf("failed to read '%s' from action '%s' with path '%s' of step %w", fileName, step.String(), actionPath, err))
-		} else {
-			// One successful read, clear error state
-			allErrors = nil
-		}
-	}
-	reader, closer, err := readFile("action.yml")
-	addError("action.yml", err)
-	if os.IsNotExist(err) {
-		reader, closer, err = readFile("action.yaml")
-		addError("action.yaml", err)
-		if os.IsNotExist(err) {
-			_, closer, err := readFile("Dockerfile")
-			addError("Dockerfile", err)
-			if err == nil {
-				closer.Close()
-				action := &model.Action{
-					Name: "(Synthetic)",
-					Runs: model.ActionRuns{
-						Using: "docker",
-						Image: "Dockerfile",
-					},
-				}
-				logger.Debugf("Using synthetic action %v for Dockerfile", action)
-				return action, nil
-			}
-			if step.With != nil {
-				if val, ok := step.With["args"]; ok {
-					var b []byte
-					if b, err = trampoline.ReadFile("res/trampoline.js"); err != nil {
-						return nil, err
-					}
-					err2 := writeFile(filepath.Join(actionDir, actionPath, "trampoline.js"), b, 0o400)
-					if err2 != nil {
-						return nil, err2
-					}
-					action := &model.Action{
-						Name: "(Synthetic)",
-						Inputs: map[string]model.Input{
-							"cwd": {
-								Description: "(Actual working directory)",
-								Required:    false,
-								Default:     filepath.Join(actionDir, actionPath),
-							},
-							"command": {
-								Description: "(Actual program)",
-								Required:    false,
-								Default:     val,
-							},
-						},
-						Runs: model.ActionRuns{
-							Using: "node12",
-							Main:  "trampoline.js",
-						},
-					}
-					logger.Debugf("Using synthetic action %v", action)
-					return action, nil
-				}
-			}
-		}
-	}
-	if allErrors != nil {
-		return nil, errors.Join(allErrors...)
-	}
-	defer closer.Close()
-
-	action, err := model.ReadAction(reader)
-	return action, err
-}
-
-func maybeCopyToActionDir(ctx context.Context, step actionStep, actionDir, actionPath, containerActionDir string) error {
-	logger := common.Logger(ctx)
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	if stepModel.Type() != model.StepTypeUsesActionRemote {
-		return nil
-	}
-
-	containerActionDirCopy := strings.TrimSuffix(containerActionDir, actionPath)
-	logger.Debug(containerActionDirCopy)
-
-	if !strings.HasSuffix(containerActionDirCopy, `/`) {
-		containerActionDirCopy += `/`
-	}
-
-	defer git.AcquireCloneLock(actionDir)()
-
-	if !rc.Config.NoActionPatch {
-		// A concurrent job's prepare resets this directory, so patch under the copy's lock.
-		patchActions(ctx, actionScriptPaths(filepath.Join(actionDir, actionPath), step.getActionModel()))
-	}
-
-	if err := removeGitIgnore(ctx, actionDir); err != nil {
-		return err
-	}
-
-	return rc.JobContainer.CopyDir(containerActionDirCopy, actionDir+"/", rc.Config.UseGitIgnore)(ctx)
-}
-
-func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		actionPath := ""
-		if remoteAction != nil && remoteAction.Path != "" {
-			actionPath = remoteAction.Path
-		}
-
-		action := step.getActionModel()
-
-		rc.withGithubEnv(ctx, step.getGithubContext(ctx), *step.getEnv())
-		populateEnvsFromSavedState(step.getEnv(), step, rc)
-		populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-
-		actionLocation := path.Join(actionDir, actionPath)
-		actionName, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
-
-		logger.Debugf("type=%v actionDir=%s actionPath=%s workdir=%s actionCacheDir=%s actionName=%s containerActionDir=%s", stepModel.Type(), actionDir, actionPath, rc.Config.Workdir, rc.ActionCacheDir(), actionName, containerActionDir)
-
-		x := action.Runs.Using
-		switch {
-		case x.IsNode():
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Main)}
-			logger.Debugf("executing remote job container: %s", containerArgs)
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			return rc.JobContainer.Exec(containerArgs, *step.getEnv(), "", "")(ctx)
-		case x.IsDocker():
-			location := actionLocation
-			if remoteAction == nil {
-				location = containerActionDir
-			}
-			return execAsDocker(ctx, step, actionName, actionDir, location, remoteAction == nil, stepStageMain)
-		case x.IsComposite():
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			return execAsComposite(step)(ctx)
-		case x == model.ActionRunsUsingGo:
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			execFileName := action.Runs.Main + ".out"
-			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Main}
-			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
-
-			return common.NewPipelineExecutor(
-				rc.JobContainer.Exec(buildArgs, *step.getEnv(), "", containerActionDir),
-				rc.JobContainer.Exec(execArgs, *step.getEnv(), "", ""),
-			)(ctx)
-		default:
-			return fmt.Errorf("the runs.using key must be one of: %v, got %s", []string{
-				model.ActionRunsUsingDocker,
-				model.ActionRunsUsingNode12,
-				model.ActionRunsUsingNode16,
-				model.ActionRunsUsingNode20,
-				model.ActionRunsUsingNode24,
-				model.ActionRunsUsingComposite,
-				model.ActionRunsUsingGo,
-			}, action.Runs.Using)
-		}
-	}
-}
-
-// https://github.com/nektos/act/issues/228#issuecomment-629709055
-// files in .gitignore are not copied in a Docker container
-// this causes issues with actions that ignore other important resources
-// such as `node_modules` for example
-func removeGitIgnore(ctx context.Context, directory string) error {
-	gitIgnorePath := path.Join(directory, ".gitignore")
-	if _, err := os.Stat(gitIgnorePath); err == nil {
-		// .gitignore exists
-		common.Logger(ctx).Debugf("Removing %s before docker cp", gitIgnorePath)
-		err := os.Remove(gitIgnorePath)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// dockerActionImageTag derives the local docker image tag used when an action
-// is built from a Dockerfile.
-//
-// For Gitea: a local action (`uses: ./` or `uses: ./path`) has an actionName
-// that is the workspace-relative path of the action. That path is identical
-// across repositories (e.g. "./" for a self-referencing action), so without
-// namespacing, every repository's local docker action would build and reuse the
-// same `act-dockeraction:latest` image on a shared docker daemon. A subsequent
-// repository would then silently run the image built for an earlier one.
-// Including the repository keeps the tag stable for caching within a repository
-// while preventing cross-repository collisions.
-// See https://gitea.com/gitea/runner/issues/1039.
-func dockerActionImageTag(repository, actionName string, localAction bool) string {
-	name := actionName
-	if localAction {
-		name = path.Join(repository, actionName)
-	}
-	// The human-readable name is sanitized by collapsing every non-alphanumeric character to "-".
-	sanitized := regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(name, "-")
-	if localAction {
-		// For local actions a short hash of the raw repository and action path is appended so the tag stays unique per repository.
-		sum := sha256.Sum256([]byte(repository + "\x00" + actionName))
-		sanitized += "-" + hex.EncodeToString(sum[:])[:12]
-	}
-	// "-dockeraction" ensures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
-	image := fmt.Sprintf("%s-dockeraction:%s", sanitized, "latest")
-	image = "act-" + strings.TrimLeft(image, "-")
-	return strings.ToLower(image)
-}
-
-// TODO: break out parts of function to reduce complexicity
-func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, basedir string, localAction bool, stage stepStage) error {
-	logger := common.Logger(ctx)
-	rc := step.getRunContext()
-	action := step.getActionModel()
-
-	var prepImage common.Executor
-	var image string
-	forcePull := false
-	if after, ok := strings.CutPrefix(action.Runs.Image, "docker://"); ok {
-		image = after
-		// Apply forcePull only for prebuild docker images
-		forcePull = rc.Config.ForcePull
-	} else {
-		image = dockerActionImageTag(step.getGithubContext(ctx).Repository, actionName, localAction)
-		contextDir, fileName := filepath.Split(filepath.Join(basedir, action.Runs.Image))
-
-		anyArchExists, err := ContainerImageExistsLocally(ctx, image, "any")
-		if err != nil {
-			return err
-		}
-
-		correctArchExists, err := ContainerImageExistsLocally(ctx, image, rc.Config.ContainerArchitecture)
-		if err != nil {
-			return err
-		}
-
-		if anyArchExists && !correctArchExists {
-			wasRemoved, err := container.RemoveImage(ctx, image, true, true)
-			if err != nil {
-				return err
-			}
-			if !wasRemoved {
-				return fmt.Errorf("failed to remove image '%s'", image)
-			}
-		}
-
-		if !correctArchExists || rc.Config.ForceRebuild {
-			logger.Debugf("image '%s' for architecture '%s' will be built from context '%s", image, rc.Config.ContainerArchitecture, contextDir)
-			var buildContext io.ReadCloser
-			if localAction {
-				buildContext, err = rc.JobContainer.GetContainerArchive(ctx, contextDir+"/.")
-				if err != nil {
-					return err
-				}
-				defer buildContext.Close()
-			}
-			prepImage = ContainerNewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
-				ContextDir:   contextDir,
-				Dockerfile:   fileName,
-				ImageTag:     image,
-				BuildContext: buildContext,
-				Platform:     rc.Config.ContainerArchitecture,
-				BuildArgs:    rc.proxyBuildArgs(),
-			})
-			if buildContext == nil {
-				// Held across the whole build: the daemon drains contextDir lazily.
-				inner := prepImage
-				prepImage = func(ctx context.Context) error {
-					defer git.AcquireCloneLock(actionDir)()
-					return inner(ctx)
-				}
-			}
-		} else {
-			logger.Debugf("image '%s' for architecture '%s' already exists", image, rc.Config.ContainerArchitecture)
-		}
-	}
-	eval := rc.NewActionInputsExpressionEvaluator(ctx, step)
-	cmd, err := shellquote.Split(eval.Interpolate(ctx, step.getStepModel().With["args"]))
-	if err != nil {
-		return err
-	}
-	ee := evalDockerEnv(ctx, step, action)
-	if action.Runs.Args != nil {
-		// a fresh slice, the manifest is evaluated again for every stage
-		cmd = make([]string, len(action.Runs.Args))
-		for i, v := range action.Runs.Args {
-			cmd[i] = ee.Interpolate(ctx, v)
-		}
-	}
-	entrypoint, err := dockerEntrypoint(ctx, step, eval, stage)
-	if err != nil {
-		return err
-	}
-	stepContainer := newStepContainer(ctx, step, image, cmd, entrypoint, rc.Config.ContainerOptions)
-	return common.NewPipelineExecutor(
-		prepImage,
-		stepContainer.Pull(forcePull),
-		stepContainer.Remove(),
-		stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
-		stepContainer.Start(true),
-	).Finally(stepContainer.Close())(ctx)
-}
-
-// dockerEntrypoint returns the entrypoint the action's image runs with for the given
-// stage. Only the main stage honours the `entrypoint` input.
-func dockerEntrypoint(ctx context.Context, step actionStep, eval *expressionEvaluator, stage stepStage) ([]string, error) {
-	runs := step.getActionModel().Runs
-
-	var entrypoint string
-	switch stage {
-	case stepStagePre:
-		entrypoint = runs.PreEntrypoint
-	case stepStagePost:
-		entrypoint = runs.PostEntrypoint
-	default:
-		entrypoint = runs.Entrypoint
-		if entrypoint == "" {
-			if fields := strings.Fields(eval.Interpolate(ctx, step.getStepModel().With["entrypoint"])); len(fields) > 0 {
-				return fields, nil
-			}
-		}
-	}
-
-	if entrypoint == "" {
-		return nil, nil
-	}
-	return shellquote.Split(entrypoint)
-}
-
-// evalDockerEnv returns an evaluator bound to the environment it installed.
-func evalDockerEnv(ctx context.Context, step step, action *model.Action) *expressionEvaluator {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	inputs := make(map[string]string)
-	eval := rc.NewExpressionEvaluator(ctx)
-	// Set Defaults
-	for k, input := range action.Inputs {
-		inputs[k] = eval.Interpolate(ctx, input.Default)
-	}
-	if stepModel.With != nil {
-		for k, v := range stepModel.With {
-			inputs[k] = eval.Interpolate(ctx, v)
-		}
-	}
-	mergeIntoMap(step, step.getEnv(), inputs)
-
-	env := make(map[string]string, len(action.Runs.Env)+len(*step.getEnv()))
-	mergeIntoMap(step, &env, action.Runs.Env, *step.getEnv())
-	*step.getEnv() = env
-
-	ee := rc.NewActionInputsExpressionEvaluator(ctx, step)
-	for k, v := range *step.getEnv() {
-		(*step.getEnv())[k] = ee.Interpolate(ctx, v)
-	}
-	return ee
-}
-
-func newStepContainer(ctx context.Context, step step, image string, cmd, entrypoint []string, runnerOptions string) container.Container {
-	rc := step.getRunContext()
-	logWriter := rc.commandLogWriter(ctx)
-	envList := make([]string, 0)
-	for k, v := range *step.getEnv() {
-		envList = append(envList, fmt.Sprintf("%s=%s", k, v))
-	}
-
-	envList = append(envList, rc.runnerEnv(ctx)...)
-
-	binds, mounts := rc.GetBindsAndMounts()
-	networkMode := "container:" + rc.jobContainerName()
-	if rc.IsHostEnv(ctx) {
-		networkMode = "default"
-	}
-	return ContainerNewContainer(&container.NewContainerInput{
-		Cmd:           cmd,
-		Entrypoint:    entrypoint,
-		WorkingDir:    rc.JobContainer.ToContainerPath(rc.Config.Workdir),
-		Image:         image,
-		Name:          createContainerName(rc.jobContainerName(), "STEP-"+step.getStepModel().ID),
-		Env:           envList,
-		Mounts:        mounts,
-		NetworkMode:   networkMode,
-		Binds:         binds,
-		Stdout:        logWriter,
-		Stderr:        logWriter,
-		Privileged:    rc.Config.Privileged,
-		UsernsMode:    rc.Config.UsernsMode,
-		Platform:      rc.Config.ContainerArchitecture,
-		RunnerOptions: runnerOptions,
-		AutoRemove:    true,
-		ValidVolumes:  rc.validVolumes(),
-		AllocatePTY:   rc.Config.AllocatePTY,
-	})
-}
-
-func populateEnvsFromSavedState(env *map[string]string, step actionStep, rc *RunContext) {
-	state, ok := rc.IntraActionState[step.getStepModel().ID]
-	if ok {
-		for name, value := range state {
-			envName := "STATE_" + name
-			(*env)[envName] = value
-		}
-	}
-}
-
-func populateEnvsFromInput(ctx context.Context, env *map[string]string, action *model.Action, rc *RunContext) {
-	eval := rc.NewExpressionEvaluator(ctx)
-	for inputID, input := range action.Inputs {
-		envKey := regexp.MustCompile("[^A-Z0-9-]").ReplaceAllString(strings.ToUpper(inputID), "_")
-		envKey = "INPUT_" + envKey
-		if _, ok := (*env)[envKey]; !ok {
-			(*env)[envKey] = eval.Interpolate(ctx, input.Default)
-		}
-	}
-}
-
-func getContainerActionPaths(step *model.Step, actionDir string, rc *RunContext) (string, string) {
-	actionName := ""
-	containerActionDir := "."
-	if step.Type() != model.StepTypeUsesActionRemote {
-		actionName = getOsSafeRelativePath(actionDir, rc.Config.Workdir)
-		containerActionDir = rc.JobContainer.ToContainerPath(rc.Config.Workdir) + "/" + actionName
-		actionName = "./" + actionName
-	} else if step.Type() == model.StepTypeUsesActionRemote {
-		actionName = getOsSafeRelativePath(actionDir, rc.ActionCacheDir())
-		containerActionDir = rc.JobContainer.GetActPath() + "/actions/" + actionName
-	}
-
-	if actionName == "" {
-		actionName = filepath.Base(actionDir)
-		if runtime.GOOS == "windows" {
-			actionName = strings.ReplaceAll(actionName, "\\", "/")
-		}
-	}
-	return actionName, containerActionDir
-}
-
-func getOsSafeRelativePath(s, prefix string) string {
-	actionName := strings.TrimPrefix(s, prefix)
-	if runtime.GOOS == "windows" {
-		actionName = strings.ReplaceAll(actionName, "\\", "/")
-	}
-	actionName = strings.TrimPrefix(actionName, "/")
-
-	return actionName
-}
-
-func shouldRunPreStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		log := common.Logger(ctx)
-
-		if step.getActionModel() == nil {
-			log.Debugf("skip pre step for '%s': no action model available", step.getStepModel())
-			return false
-		}
-
-		return true
-	}
-}
-
-func hasPreStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		action := step.getActionModel()
-		return action.Runs.Using.IsComposite() ||
-			(action.Runs.Using.IsNode() &&
-				action.Runs.Pre != "") ||
-			(action.Runs.Using.IsDocker() &&
-				action.Runs.PreEntrypoint != "") ||
-			(action.Runs.Using == model.ActionRunsUsingGo &&
-				action.Runs.Pre != "")
-	}
-}
-
-// actionStagePaths resolves where a step's action lives and where the job container sees
-// it, for the pre and post stage.
-func actionStagePaths(step actionStep) (actionDir, actionPath, actionName, containerActionDir string) {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	if sar, ok := step.(*stepActionRemote); ok {
-		actionDir = sar.actionDir()
-		actionPath = sar.remoteAction.Path
-	} else {
-		actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
-	}
-
-	actionName, containerActionDir = getContainerActionPaths(stepModel, path.Join(actionDir, actionPath), rc)
-	return actionDir, actionPath, actionName, containerActionDir
-}
-
-// execDockerActionStage runs a docker action's image for its pre or post stage.
-func execDockerActionStage(ctx context.Context, step actionStep, stage stepStage) error {
-	actionDir, actionPath, actionName, containerActionDir := actionStagePaths(step)
-
-	_, remote := step.(*stepActionRemote)
-	location := containerActionDir
-	if remote {
-		location = path.Join(actionDir, actionPath)
-	}
-	return execAsDocker(ctx, step, actionName, actionDir, location, !remote, stage)
-}
-
-func runPreStep(step actionStep) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		logger.Debugf("run pre step for '%s'", step.getStepModel())
-
-		rc := step.getRunContext()
-		action := step.getActionModel()
-
-		actionDir, actionPath, _, containerActionDir := actionStagePaths(step)
-
-		x := action.Runs.Using
-		switch {
-		case x.IsNode():
-			// defaults in pre steps were missing, however provided inputs are available
-			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Pre)}
-			logger.Debugf("executing remote job container: %s", containerArgs)
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			return rc.JobContainer.Exec(containerArgs, *step.getEnv(), "", "")(ctx)
-
-		case x.IsDocker():
-			// defaults in pre steps were missing, however provided inputs are available
-			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-
-			return execDockerActionStage(ctx, step, stepStagePre)
-
-		case x.IsComposite():
-			if step.getCompositeSteps() == nil {
-				step.getCompositeRunContext(ctx)
-			}
-
-			if steps := step.getCompositeSteps(); steps != nil && steps.pre != nil {
-				return steps.pre(ctx)
-			}
-			return errors.New("missing steps in composite action")
-
-		case x == model.ActionRunsUsingGo:
-			// defaults in pre steps were missing, however provided inputs are available
-			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			execFileName := action.Runs.Pre + ".out"
-			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Pre}
-			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
-
-			return common.NewPipelineExecutor(
-				rc.JobContainer.Exec(buildArgs, *step.getEnv(), "", containerActionDir),
-				rc.JobContainer.Exec(execArgs, *step.getEnv(), "", ""),
-			)(ctx)
-		default:
-			return nil
-		}
-	}
-}
-
-func shouldRunPostStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		log := common.Logger(ctx)
-		stepResults := step.getRunContext().getStepsContext()
-		stepResult := stepResults[step.getStepModel().ID]
-
-		if stepResult == nil {
-			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s'; step was not executed", step.getStepModel())
-			return false
-		}
-
-		if stepResult.Conclusion == model.StepStatusSkipped {
-			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s'; main step was skipped", step.getStepModel())
-			return false
-		}
-
-		if step.getActionModel() == nil {
-			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s': no action model available", step.getStepModel())
-			return false
-		}
-
-		return true
-	}
-}
-
-func hasPostStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		action := step.getActionModel()
-		return action.Runs.Using.IsComposite() ||
-			(action.Runs.Using.IsNode() &&
-				action.Runs.Post != "") ||
-			(action.Runs.Using.IsDocker() &&
-				action.Runs.PostEntrypoint != "") ||
-			(action.Runs.Using == model.ActionRunsUsingGo &&
-				action.Runs.Post != "")
-	}
-}
-
-func runPostStep(step actionStep) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		logger.Debugf("run post step for '%s'", step.getStepModel())
-
-		rc := step.getRunContext()
-		action := step.getActionModel()
-
-		actionDir, actionPath, _, containerActionDir := actionStagePaths(step)
-
-		x := action.Runs.Using
-		switch {
-		case x.IsNode():
-
-			populateEnvsFromSavedState(step.getEnv(), step, rc)
-
-			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Post)}
-			logger.Debugf("executing remote job container: %s", containerArgs)
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			return rc.JobContainer.Exec(containerArgs, *step.getEnv(), "", "")(ctx)
-
-		case x.IsDocker():
-			populateEnvsFromSavedState(step.getEnv(), step, rc)
-
-			return execDockerActionStage(ctx, step, stepStagePost)
-
-		case x.IsComposite():
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			if steps := step.getCompositeSteps(); steps != nil && steps.post != nil {
-				return steps.post(ctx)
-			}
-			return errors.New("missing steps in composite action")
-
-		case x == model.ActionRunsUsingGo:
-			populateEnvsFromSavedState(step.getEnv(), step, rc)
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			execFileName := action.Runs.Post + ".out"
-			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Post}
-			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
-
-			return common.NewPipelineExecutor(
-				rc.JobContainer.Exec(buildArgs, *step.getEnv(), "", containerActionDir),
-				rc.JobContainer.Exec(execArgs, *step.getEnv(), "", ""),
-			)(ctx)
-
-		default:
-			return nil
-		}
-	}
-}

act/runner/action_composite.go

@@ -1,252 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"errors"
-	"regexp"
-	"slices"
-	"strconv"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"gitea.dev/actionslib/pkg/model"
-)
-
-func evaluateCompositeInputAndEnv(ctx context.Context, parent *RunContext, step actionStep) map[string]string {
-	env := make(map[string]string)
-	stepEnv := *step.getEnv()
-	for k, v := range stepEnv {
-		// do not set current inputs into composite action
-		// the required inputs are added in the second loop
-		if !strings.HasPrefix(k, "INPUT_") {
-			env[k] = v
-		}
-	}
-
-	ee := parent.NewActionInputsExpressionEvaluator(ctx, step)
-
-	for inputID, input := range step.getActionModel().Inputs {
-		envKey := regexp.MustCompile("[^A-Z0-9-]").ReplaceAllString(strings.ToUpper(inputID), "_")
-		envKey = "INPUT_" + strings.ToUpper(envKey)
-
-		// lookup if key is defined in the step but the already
-		// evaluated value from the environment
-		defined := false
-		for key := range step.getStepModel().With {
-			if strings.EqualFold(key, inputID) {
-				defined = true
-				break
-			}
-		}
-		if value, ok := stepEnv[envKey]; defined && ok {
-			env[envKey] = value
-		} else {
-			// defaults could contain expressions
-			env[envKey] = ee.Interpolate(ctx, input.Default)
-		}
-	}
-	gh := step.getGithubContext(ctx)
-	env["GITHUB_ACTION_REPOSITORY"] = gh.ActionRepository
-	env["GITHUB_ACTION_REF"] = gh.ActionRef
-
-	return env
-}
-
-func (rc *RunContext) setCompositeActionEnv(env map[string]string) {
-	rc.setActionEnv(env)
-	for key := range rc.Env {
-		if strings.HasPrefix(key, "INPUT_") {
-			delete(rc.Env, key)
-		}
-	}
-}
-
-func newCompositeRunContext(ctx context.Context, parent *RunContext, step actionStep, actionPath string) *RunContext {
-	env := evaluateCompositeInputAndEnv(ctx, parent, step)
-
-	// run with the global config but without secrets
-	configCopy := *parent.Config
-	configCopy.Secrets = nil
-
-	// create a run context for the composite action to run in
-	compositerc := &RunContext{
-		Name:    parent.Name,
-		JobName: parent.JobName,
-		Matrix:  parent.Matrix,
-		Run: &model.Run{
-			JobID: parent.Run.JobID,
-			Workflow: &model.Workflow{
-				Name: parent.Run.Workflow.Name,
-				Jobs: map[string]*model.Job{
-					parent.Run.JobID: {Strategy: parent.Run.Job().Strategy},
-				},
-			},
-		},
-		Config:       &configCopy,
-		StepResults:  map[string]*model.StepResult{},
-		JobContainer: parent.JobContainer,
-		ActionPath:   actionPath,
-		GlobalEnv:    parent.GlobalEnv,
-		Masks:        parent.Masks,
-		ExtraPath:    parent.ExtraPath,
-		Parent:       parent,
-		EventJSON:    parent.EventJSON,
-	}
-	compositerc.setCompositeActionEnv(env)
-	compositerc.ExprEval = compositerc.NewExpressionEvaluator(ctx)
-
-	return compositerc
-}
-
-// appendUniqueMasks appends the masks from src to dst, skipping any mask that
-// is already present in dst. This prevents the parent RunContext's Masks slice
-// from growing exponentially when composite actions are nested or repeated,
-// since each composite RunContext is seeded with its parent's masks.
-func appendUniqueMasks(dst, src []string) []string {
-	for _, m := range src {
-		if !slices.Contains(dst, m) {
-			dst = append(dst, m)
-		}
-	}
-	return dst
-}
-
-func execAsComposite(step actionStep) common.Executor {
-	rc := step.getRunContext()
-	action := step.getActionModel()
-
-	return func(ctx context.Context) error {
-		compositeRC := step.getCompositeRunContext(ctx)
-
-		steps := step.getCompositeSteps()
-
-		if steps == nil || steps.main == nil {
-			return errors.New("missing steps in composite action")
-		}
-
-		ctx = WithCompositeLogger(ctx, &compositeRC.Masks)
-
-		err := steps.main(ctx)
-
-		// Map outputs from composite RunContext to job RunContext
-		eval := compositeRC.NewExpressionEvaluator(ctx)
-		for outputName, output := range action.Outputs {
-			rc.setOutput(ctx, map[string]string{
-				"name": outputName,
-			}, eval.Interpolate(ctx, output.Value))
-		}
-
-		// compositeRC.Masks is seeded with rc.Masks (see newCompositeRunContext)
-		// and may have additional masks appended while the composite action runs.
-		// Only append masks that are not already present, otherwise nested or
-		// repeated composite actions grow rc.Masks exponentially.
-		rc.Masks = appendUniqueMasks(rc.Masks, compositeRC.Masks)
-		rc.ExtraPath = compositeRC.ExtraPath
-		// Propagate GlobalEnv only, so composite inputs and step-local values do not escape.
-		mergeIntoMap := mergeIntoMapCaseSensitive
-		if rc.JobContainer.IsEnvironmentCaseInsensitive() {
-			mergeIntoMap = mergeIntoMapCaseInsensitive
-		}
-		if rc.GlobalEnv == nil {
-			rc.GlobalEnv = map[string]string{}
-		}
-		mergeIntoMap(rc.GlobalEnv, compositeRC.GlobalEnv)
-		mergeIntoMap(rc.Env, compositeRC.GlobalEnv)
-
-		return err
-	}
-}
-
-type compositeSteps struct {
-	pre  common.Executor
-	main common.Executor
-	post common.Executor
-}
-
-// Executor returns a pipeline executor for all the steps in the job
-func (rc *RunContext) compositeExecutor(action *model.Action) *compositeSteps {
-	steps := make([]common.Executor, 0)
-	preSteps := make([]common.Executor, 0)
-	var postExecutor common.Executor
-
-	sf := &stepFactoryImpl{}
-
-	for i, step := range action.Runs.Steps {
-		if step.ID == "" {
-			step.ID = strconv.Itoa(i)
-		}
-		step.Number = i
-
-		// create a copy of the step, since this composite action could
-		// run multiple times and we might modify the instance
-		stepcopy := step
-
-		step, err := sf.newStep(&stepcopy, rc)
-		if err != nil {
-			return &compositeSteps{
-				main: common.NewErrorExecutor(err),
-			}
-		}
-
-		stepID := step.getStepModel().ID
-		stepPre := rc.newCompositeCommandExecutor(step.pre())
-		preSteps = append(preSteps, newCompositeStepLogExecutor(stepPre, stepID))
-
-		steps = append(steps, newCompositeStepLogExecutor(rc.newCompositeCommandExecutor(step.main()), stepID))
-
-		// run the post executor in reverse order
-		if postExecutor != nil {
-			stepPost := rc.newCompositeCommandExecutor(step.post())
-			postExecutor = newCompositeStepLogExecutor(stepPost.Finally(postExecutor), stepID)
-		} else {
-			stepPost := rc.newCompositeCommandExecutor(step.post())
-			postExecutor = newCompositeStepLogExecutor(stepPost, stepID)
-		}
-	}
-
-	steps = append(steps, common.JobError)
-	preSteps = append(preSteps, common.JobError)
-	return &compositeSteps{
-		pre: func(ctx context.Context) error {
-			return common.NewPipelineExecutor(preSteps...)(common.WithJobErrorContainer(ctx))
-		},
-		main: func(ctx context.Context) error {
-			return common.NewPipelineExecutor(steps...)(common.WithJobErrorContainer(ctx))
-		},
-		post: postExecutor,
-	}
-}
-
-func (rc *RunContext) newCompositeCommandExecutor(executor common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		ctx = WithCompositeLogger(ctx, &rc.Masks)
-
-		logWriter := rc.commandLogWriter(ctx)
-
-		oldout, olderr := rc.JobContainer.ReplaceLogWriter(logWriter, logWriter)
-		defer rc.JobContainer.ReplaceLogWriter(oldout, olderr)
-
-		return executor(ctx)
-	}
-}
-
-func newCompositeStepLogExecutor(runStep common.Executor, stepID string) common.Executor {
-	return func(ctx context.Context) error {
-		ctx = WithCompositeStepLogger(ctx, stepID)
-		logger := common.Logger(ctx)
-		err := runStep(ctx)
-		if err != nil {
-			logger.Errorf("##[error]%s", EscapeCommandData(err.Error()))
-			common.SetJobError(ctx, err)
-		} else if ctx.Err() != nil {
-			logger.Errorf("##[error]%s", EscapeCommandData(ctx.Err().Error()))
-			common.SetJobError(ctx, ctx.Err())
-		}
-		return nil
-	}
-}

act/runner/action_composite_test.go

@@ -1,114 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"testing"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-
-	"gitea.dev/actionslib/pkg/model"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCompositeActionParity(t *testing.T) {
-	t.Run("inherits contexts without leaking inputs", func(t *testing.T) {
-		ctx := t.Context()
-		strategy := &model.Strategy{MaxParallel: 3}
-		parent := &RunContext{
-			Config:       &Config{},
-			Matrix:       map[string]any{"os": "linux"},
-			Run:          &model.Run{JobID: "job", Workflow: &model.Workflow{Name: "workflow", Jobs: map[string]*model.Job{"job": {Strategy: strategy}}}},
-			JobContainer: &jobContainerMock{},
-		}
-		composite := newCompositeRunContext(ctx, parent, &stepActionRemote{
-			Step:       &model.Step{With: map[string]string{"SHARED": "outer"}},
-			RunContext: parent,
-			action:     &model.Action{Inputs: map[string]model.Input{"shared": {Default: "outer-default"}}},
-			env:        map[string]string{"INPUT_SHARED": "outer"},
-		}, "/action")
-
-		assert.Same(t, strategy, composite.Run.Job().Strategy)
-		assert.Equal(t, "linux|3|outer", composite.NewExpressionEvaluator(ctx).Interpolate(ctx,
-			"${{ matrix.os }}|${{ strategy.max-parallel }}|${{ inputs.shared }}"))
-		assert.NotContains(t, composite.Env, "INPUT_SHARED")
-
-		nestedEnv := composite.GetEnv()
-		populateEnvsFromInput(ctx, &nestedEnv, &model.Action{Inputs: map[string]model.Input{"shared": {Default: "inner-default"}}}, composite)
-		assert.Equal(t, "inner-default", nestedEnv["INPUT_SHARED"])
-	})
-
-	t.Run("propagates pre failures", func(t *testing.T) {
-		setCloneExecutor(t, func(git.NewGitCloneExecutorInput) common.Executor { return common.NewErrorExecutor(assert.AnError) })
-		rc := &RunContext{
-			Config:       &Config{GitHubInstance: "github.com", ActionCacheDir: t.TempDir()},
-			Run:          &model.Run{JobID: "job", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"job": {}}}},
-			JobContainer: &jobContainerMock{},
-		}
-
-		require.ErrorIs(t, rc.compositeExecutor(&model.Action{Runs: model.ActionRuns{Using: "composite", Steps: []model.Step{{ID: "nested", Uses: "org/action@v1"}}}}).pre(t.Context()), assert.AnError)
-	})
-}
-
-func TestAppendUniqueMasks(t *testing.T) {
-	tests := []struct {
-		name string
-		dst  []string
-		src  []string
-		want []string
-	}{
-		{
-			name: "appends new masks",
-			dst:  []string{"a"},
-			src:  []string{"b", "c"},
-			want: []string{"a", "b", "c"},
-		},
-		{
-			name: "skips masks already present",
-			dst:  []string{"a", "b"},
-			src:  []string{"a", "b"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "deduplicates within src",
-			dst:  []string{"a"},
-			src:  []string{"b", "b", "a"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "empty src leaves dst unchanged",
-			dst:  []string{"a"},
-			src:  nil,
-			want: []string{"a"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, appendUniqueMasks(tt.dst, tt.src))
-		})
-	}
-}
-
-// TestAppendUniqueMasksNoExponentialGrowth reproduces the exponential growth of
-// the parent's Masks slice observed with nested/repeated composite actions. A
-// composite RunContext is seeded with its parent's masks and the whole seeded
-// slice was previously appended back into the parent, doubling its length on
-// every composite action.
-func TestAppendUniqueMasksNoExponentialGrowth(t *testing.T) {
-	parentMasks := []string{"secret"}
-
-	for range 20 {
-		// compositeRC.Masks starts as a copy of the parent's masks (it is
-		// seeded with parent.Masks in newCompositeRunContext).
-		compositeMasks := make([]string, len(parentMasks))
-		copy(compositeMasks, parentMasks)
-
-		parentMasks = appendUniqueMasks(parentMasks, compositeMasks)
-	}
-
-	assert.Equal(t, []string{"secret"}, parentMasks)
-}

act/runner/action_test.go

@@ -1,605 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"io"
-	"io/fs"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/container"
-
-	"gitea.dev/actionslib/pkg/model"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-type closerFunc func()
-
-func (close closerFunc) Close() error {
-	close()
-	return nil
-}
-
-func TestActionReader(t *testing.T) {
-	yaml := strings.ReplaceAll(`
-name: 'name'
-runs:
-	using: 'node16'
-	main: 'main.js'
-`, "\t", "  ")
-	yamlAction := &model.Action{
-		Name: "name",
-		Runs: model.ActionRuns{
-			Using:  "node16",
-			Main:   "main.js",
-			PreIf:  "always()",
-			PostIf: "always()",
-		},
-	}
-
-	table := []struct {
-		name        string
-		step        *model.Step
-		filename    string
-		fileContent string
-		expected    *model.Action
-	}{
-		{
-			name:        "readActionYml",
-			step:        &model.Step{},
-			filename:    "action.yml",
-			fileContent: yaml,
-			expected:    yamlAction,
-		},
-		{
-			name:        "readActionYaml",
-			step:        &model.Step{},
-			filename:    "action.yaml",
-			fileContent: yaml,
-			expected:    yamlAction,
-		},
-		{
-			name:        "readDockerfile",
-			step:        &model.Step{},
-			filename:    "Dockerfile",
-			fileContent: "FROM ubuntu:20.04",
-			expected: &model.Action{
-				Name: "(Synthetic)",
-				Runs: model.ActionRuns{
-					Using: "docker",
-					Image: "Dockerfile",
-				},
-			},
-		},
-		{
-			name: "readWithArgs",
-			step: &model.Step{
-				With: map[string]string{
-					"args": "cmd",
-				},
-			},
-			expected: &model.Action{
-				Name: "(Synthetic)",
-				Inputs: map[string]model.Input{
-					"cwd": {
-						Description: "(Actual working directory)",
-						Required:    false,
-						Default:     "actionDir/actionPath",
-					},
-					"command": {
-						Description: "(Actual program)",
-						Required:    false,
-						Default:     "cmd",
-					},
-				},
-				Runs: model.ActionRuns{
-					Using: "node12",
-					Main:  "trampoline.js",
-				},
-			},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			closed := false
-
-			readFile := func(filename string) (io.Reader, io.Closer, error) {
-				if tt.filename != filename {
-					return nil, nil, fs.ErrNotExist
-				}
-
-				return strings.NewReader(tt.fileContent), closerFunc(func() { closed = true }), nil
-			}
-
-			writeFile := func(filename string, data []byte, perm fs.FileMode) error {
-				assert.Equal(t, "actionDir/actionPath/trampoline.js", filename)
-				assert.Equal(t, fs.FileMode(0o400), perm)
-				return nil
-			}
-
-			action, err := readActionImpl(context.Background(), tt.step, "actionDir", "actionPath", readFile, writeFile)
-
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.Equal(t, tt.expected, action)
-
-			assert.Equal(t, tt.filename != "", closed)
-		})
-	}
-}
-
-func TestActionRunner(t *testing.T) {
-	table := []struct {
-		name        string
-		step        actionStep
-		expectedEnv map[string]string
-	}{
-		{
-			name: "with-input",
-			step: &stepActionRemote{
-				Step: &model.Step{
-					Uses: "org/repo/path@ref",
-				},
-				RunContext: &RunContext{
-					Config: &Config{},
-					Run: &model.Run{
-						JobID: "job",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"job": {
-									Name: "job",
-								},
-							},
-						},
-					},
-				},
-				action: &model.Action{
-					Inputs: map[string]model.Input{
-						"key": {
-							Default: "default value",
-						},
-					},
-					Runs: model.ActionRuns{
-						Using: "node16",
-					},
-				},
-				env: map[string]string{},
-			},
-			expectedEnv: map[string]string{"INPUT_KEY": "default value"},
-		},
-		{
-			name: "restore-saved-state",
-			step: &stepActionRemote{
-				Step: &model.Step{
-					ID:   "step",
-					Uses: "org/repo/path@ref",
-				},
-				RunContext: &RunContext{
-					ActionPath: "path",
-					Config:     &Config{},
-					Run: &model.Run{
-						JobID: "job",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"job": {
-									Name: "job",
-								},
-							},
-						},
-					},
-					CurrentStep: "post-step",
-					StepResults: map[string]*model.StepResult{
-						"step": {},
-					},
-					IntraActionState: map[string]map[string]string{
-						"step": {
-							"name": "state value",
-						},
-					},
-				},
-				action: &model.Action{
-					Runs: model.ActionRuns{
-						Using: "node16",
-					},
-				},
-				env: map[string]string{},
-			},
-			expectedEnv: map[string]string{"STATE_name": "state value"},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			cm := &containerMock{}
-			cm.On("CopyDir", "/var/run/act/actions/dir/", "dir/", false).Return(func(ctx context.Context) error { return nil })
-
-			envMatcher := mock.MatchedBy(func(env map[string]string) bool {
-				for k, v := range tt.expectedEnv {
-					if env[k] != v {
-						return false
-					}
-				}
-				return true
-			})
-
-			cm.On("Exec", []string{"node", "/var/run/act/actions/dir/path"}, envMatcher, "", "").Return(func(ctx context.Context) error { return nil })
-
-			tt.step.getRunContext().JobContainer = cm
-
-			err := runActionImpl(tt.step, "dir", newRemoteAction("org/repo/path@ref"))(ctx)
-
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			cm.AssertExpectations(t)
-		})
-	}
-}
-
-func TestNewStepContainerDoesNotUseDockerSecrets(t *testing.T) {
-	cm := &containerMock{}
-
-	var captured *container.NewContainerInput
-	origContainerNewContainer := ContainerNewContainer
-	ContainerNewContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-		captured = input
-		return cm
-	}
-	defer func() {
-		ContainerNewContainer = origContainerNewContainer
-	}()
-
-	ctx := context.Background()
-	rc := &RunContext{
-		Name: "job",
-		Config: &Config{
-			Secrets: map[string]string{
-				"DOCKER_USERNAME": "docker-user",
-				"DOCKER_PASSWORD": "docker-password",
-			},
-		},
-		Run: &model.Run{
-			JobID: "job",
-			Workflow: &model.Workflow{
-				Name: "test",
-				Jobs: map[string]*model.Job{
-					"job": {},
-				},
-			},
-		},
-		JobContainer: cm,
-		StepResults:  map[string]*model.StepResult{},
-	}
-	env := map[string]string{}
-	step := &stepMock{}
-	step.On("getRunContext").Return(rc)
-	step.On("getStepModel").Return(&model.Step{ID: "action"})
-	step.On("getEnv").Return(&env)
-
-	_ = newStepContainer(ctx, step, "registry.example.com/action:tag", nil, nil, "")
-
-	// DOCKER_USERNAME/DOCKER_PASSWORD should not be injected as pull credentials for docker action containers.
-	assert.Empty(t, captured.Username)
-	assert.Empty(t, captured.Password)
-	assert.True(t, captured.AutoRemove)
-	step.AssertExpectations(t)
-}
-
-func TestMaybeCopyToActionDirHoldsCloneLock(t *testing.T) {
-	ctx := context.Background()
-
-	actionDir := t.TempDir()
-
-	releaseCopy := make(chan struct{})
-	release := sync.OnceFunc(func() { close(releaseCopy) })
-	defer release()
-
-	copyEntered := make(chan struct{})
-
-	cm := &containerMock{}
-	cm.On("CopyDir", "/var/run/act/actions/", actionDir+"/", false).Return(func(ctx context.Context) error {
-		close(copyEntered)
-		<-releaseCopy
-		return nil
-	})
-
-	step := &stepActionRemote{
-		Step: &model.Step{Uses: "remote/action@v1"},
-		RunContext: &RunContext{
-			Config:       &Config{},
-			JobContainer: cm,
-		},
-	}
-
-	copyDone := make(chan error, 1)
-	go func() {
-		copyDone <- maybeCopyToActionDir(ctx, step, actionDir, "", "/var/run/act/actions/")
-	}()
-
-	select {
-	case <-copyEntered:
-	case err := <-copyDone:
-		t.Fatalf("maybeCopyToActionDir returned before CopyDir was entered: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("CopyDir was not entered within 1 second")
-	}
-
-	peerAcquired := make(chan struct{})
-	go func() {
-		unlock := git.AcquireCloneLock(actionDir)
-		close(peerAcquired)
-		unlock()
-	}()
-
-	select {
-	case <-peerAcquired:
-		t.Fatal("peer AcquireCloneLock returned while CopyDir was running")
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	release()
-
-	select {
-	case err := <-copyDone:
-		if err != nil {
-			t.Fatalf("maybeCopyToActionDir returned error: %v", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("maybeCopyToActionDir did not return after CopyDir was unblocked")
-	}
-
-	select {
-	case <-peerAcquired:
-	case <-time.After(time.Second):
-		t.Fatal("peer AcquireCloneLock did not proceed after lock released")
-	}
-
-	cm.AssertExpectations(t)
-}
-
-func TestExecAsDockerHoldsCloneLockForRemoteUncached(t *testing.T) {
-	actionDir := t.TempDir()
-
-	unlockOnce := sync.OnceFunc(git.AcquireCloneLock(actionDir))
-	defer unlockOnce()
-
-	innerEntered := make(chan struct{})
-	releaseInner := make(chan struct{})
-	releaseOnce := sync.OnceFunc(func() { close(releaseInner) })
-	defer releaseOnce()
-
-	origImageExists := ContainerImageExistsLocally
-	ContainerImageExistsLocally = func(_ context.Context, _, _ string) (bool, error) {
-		return false, nil
-	}
-	defer func() { ContainerImageExistsLocally = origImageExists }()
-
-	origBuildExec := ContainerNewDockerBuildExecutor
-	ContainerNewDockerBuildExecutor = func(_ container.NewDockerBuildExecutorInput) common.Executor {
-		return func(_ context.Context) error {
-			close(innerEntered)
-			<-releaseInner
-			return nil
-		}
-	}
-	defer func() { ContainerNewDockerBuildExecutor = origBuildExec }()
-
-	step := &stepActionRemote{
-		Step: &model.Step{ID: "1", Uses: "remote/action@v1", With: map[string]string{}},
-		RunContext: &RunContext{
-			Config: &Config{},
-			Run: &model.Run{
-				JobID: "1",
-				Workflow: &model.Workflow{
-					Name: "wf",
-					Jobs: map[string]*model.Job{"1": {}},
-				},
-			},
-			JobContainer: &containerMock{},
-		},
-		action: &model.Action{Runs: model.ActionRuns{Using: "docker", Image: "Dockerfile"}},
-		env:    map[string]string{},
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	done := make(chan error, 1)
-	go func() { done <- execAsDocker(ctx, step, "test-action", actionDir, actionDir, false, stepStageMain) }()
-
-	select {
-	case <-innerEntered:
-		t.Fatal("inner build executor ran before clone lock was released")
-	case err := <-done:
-		t.Fatalf("execAsDocker returned before inner was entered: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	unlockOnce()
-
-	select {
-	case <-innerEntered:
-	case err := <-done:
-		t.Fatalf("execAsDocker returned without entering inner: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("inner build executor not entered after lock released")
-	}
-
-	cancel()
-	releaseOnce()
-
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("execAsDocker did not return after inner was released and ctx was canceled")
-	}
-}
-
-func TestDockerActionImageTag(t *testing.T) {
-	// Remote actions already carry a unique, ref-scoped actionName (the uses
-	// hash), so the tag must be left untouched for backwards compatibility.
-	assert.Equal(t,
-		"act-abc123-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "abc123", false),
-	)
-
-	// Local actions keep a human-readable, repository-namespaced prefix and gain a short hash suffix that makes the tag unique per (repository, actionName).
-	// See https://gitea.com/gitea/runner/issues/1039.
-	assert.Equal(t,
-		"act-owner-repo-baca2daaa2fe-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./", true),
-	)
-	assert.Equal(t,
-		"act-owner-repo-sub-e847b61255a8-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-
-	// Sanitizing every non-alphanumeric character to "-" is lossy, so distinct inputs can collapse to the same readable prefix.
-	// The hash suffix must keep such cases apart, otherwise an image built for one repository is reused for another.
-	collisions := [][2]struct {
-		repoName   string
-		actionName string
-	}{
-		// Two different repositories, both `uses: ./`: "a/b-c" and "a-b/c" both sanitize to "a-b-c".
-		{{"a/b-c", "./"}, {"a-b/c", "./"}},
-		// A repository's root action vs another repository's sub-path action:
-		// "owner/repo-a" + "./" and "owner/repo" + "./a" both sanitize to "owner-repo-a".
-		{{"owner/repo-a", "./"}, {"owner/repo", "./a"}},
-	}
-	for _, c := range collisions {
-		assert.NotEqual(t,
-			dockerActionImageTag(c[0].repoName, c[0].actionName, true),
-			dockerActionImageTag(c[1].repoName, c[1].actionName, true),
-			"local docker action tags must differ for %q/%q vs %q/%q",
-			c[0].repoName, c[0].actionName, c[1].repoName, c[1].actionName,
-		)
-	}
-
-	// Distinct local actions within the same repository keep distinct tags.
-	assert.NotEqual(t,
-		dockerActionImageTag("owner/repo", "./", true),
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-}
-
-func TestExecAsDockerStageEntrypoint(t *testing.T) {
-	orig := ContainerNewContainer
-	defer func() { ContainerNewContainer = orig }()
-
-	for _, tc := range []struct {
-		name           string
-		stage          stepStage
-		with           map[string]string
-		runs           model.ActionRuns
-		env            map[string]string
-		wantCmd        []string
-		wantEntrypoint []string
-	}{
-		{
-			name:  "main stage prefers manifest values",
-			stage: stepStageMain,
-			with:  map[string]string{"args": "caller", "entrypoint": "input.sh"},
-			runs: model.ActionRuns{
-				Entrypoint: "main.sh",
-				Args:       []string{"manifest"},
-				Env:        map[string]string{"ACTION_ONLY": "manifest"},
-			},
-			wantCmd:        []string{"manifest"},
-			wantEntrypoint: []string{"main.sh"},
-		},
-		{
-			name:           "main stage uses caller fallbacks",
-			stage:          stepStageMain,
-			with:           map[string]string{"args": "caller --flag", "entrypoint": "input.sh --verbose"},
-			runs:           model.ActionRuns{Env: map[string]string{"ACTION_ONLY": "manifest"}},
-			wantCmd:        []string{"caller", "--flag"},
-			wantEntrypoint: []string{"input.sh", "--verbose"},
-		},
-		{
-			name:    "explicit empty manifest args suppress caller args",
-			stage:   stepStageMain,
-			with:    map[string]string{"args": "caller"},
-			runs:    model.ActionRuns{Args: []string{}},
-			wantCmd: []string{},
-		},
-		{
-			name:  "pre stage keeps step environment",
-			stage: stepStagePre,
-			with:  map[string]string{"entrypoint": "input.sh"},
-			runs: model.ActionRuns{
-				PreEntrypoint: "pre.sh --verbose",
-				Args:          []string{"hello"},
-				Env:           map[string]string{"SHARED": "manifest"},
-			},
-			env:            map[string]string{"SHARED": "step"},
-			wantCmd:        []string{"hello"},
-			wantEntrypoint: []string{"pre.sh", "--verbose"},
-		},
-		{
-			name:           "post stage uses manifest entrypoint",
-			stage:          stepStagePost,
-			runs:           model.ActionRuns{PostEntrypoint: "post.sh", Args: []string{"hello"}},
-			wantCmd:        []string{"hello"},
-			wantEntrypoint: []string{"post.sh"},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			tc.runs.Using, tc.runs.Image = "docker", "docker://node:14"
-			cm := &containerMock{}
-			var input *container.NewContainerInput
-			ContainerNewContainer = func(in *container.NewContainerInput) container.ExecutionsEnvironment {
-				input = in
-				return cm
-			}
-
-			step := &stepActionRemote{
-				Step: &model.Step{ID: "1", Uses: "org/action@v1", With: tc.with},
-				RunContext: &RunContext{
-					Config:       &Config{},
-					Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
-					JobContainer: cm,
-				},
-				action: &model.Action{Runs: tc.runs},
-				env:    mergeMaps(tc.env),
-			}
-
-			cm.On("Pull", false).Return(func(context.Context) error { return nil })
-			cm.On("Remove").Return(func(context.Context) error { return nil })
-			cm.On("Create", []string(nil), []string(nil)).Return(func(context.Context) error { return nil })
-			cm.On("Start", true).Return(func(context.Context) error { return nil })
-			cm.On("Close").Return(func(context.Context) error { return nil })
-
-			require.NoError(t, execAsDocker(context.Background(), step, "action", t.TempDir(), t.TempDir(), false, tc.stage))
-			require.NotNil(t, input)
-			assert.Equal(t, tc.wantCmd, input.Cmd)
-			assert.Equal(t, tc.wantEntrypoint, input.Entrypoint)
-			for key, value := range mergeMaps(tc.runs.Env, tc.env) {
-				assert.Contains(t, input.Env, key+"="+value)
-			}
-		})
-	}
-}
-
-func TestDockerActionHasPreAndPostStep(t *testing.T) {
-	newStep := func(runs model.ActionRuns) actionStep {
-		return &stepActionRemote{action: &model.Action{Runs: runs}}
-	}
-	ctx := context.Background()
-
-	assert.False(t, hasPreStep(newStep(model.ActionRuns{Using: "docker", Image: "Dockerfile"}))(ctx))
-	assert.False(t, hasPostStep(newStep(model.ActionRuns{Using: "docker", Image: "Dockerfile"}))(ctx))
-
-	withStages := model.ActionRuns{Using: "docker", Image: "Dockerfile", PreEntrypoint: "pre.sh", PostEntrypoint: "post.sh"}
-	assert.True(t, hasPreStep(newStep(withStages))(ctx))
-	assert.True(t, hasPostStep(newStep(withStages))(ctx))
-}

act/runner/cancellation_test.go

@@ -1,311 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"gitea.dev/actionslib/pkg/exprparser"
-	"gitea.dev/actionslib/pkg/model"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v4"
-)
-
-// TestCancelledJobStatusEnablesAlwaysAndCancelledSteps verifies that once a job is
-// cancelled, getJobContext reports the "cancelled" status so the step `if` functions
-// evaluate the way GitHub Actions does: cancelled()/always() are true, success()/failure()
-// are false. A step that defaults to success() is therefore skipped while an always() step
-// still runs. Before the fix the status could only ever be success/failure, so cancelled()
-// was structurally impossible and cancel-only cleanup steps never ran.
-func TestCancelledJobStatusEnablesAlwaysAndCancelledSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	rc.markCancelled()
-
-	// The core fix: the job status context now reports "cancelled" instead of being
-	// pinned to success/failure.
-	jobCtx := rc.getJobContext()
-	require.Equal(t, "cancelled", jobCtx.Status)
-
-	// Feed that status through the step-context expression functions, which is what a
-	// step `if` evaluates. On a cancelled job only always()/cancelled() are true.
-	interp := exprparser.NewInterpeter(
-		&exprparser.EvaluationEnvironment{Job: jobCtx},
-		exprparser.Config{Context: "step"},
-	)
-	for expr, want := range map[string]bool{
-		"cancelled()":  true,
-		"always()":     true,
-		"success()":    false,
-		"failure()":    false,
-		"!cancelled()": false,
-	} {
-		got, err := interp.Evaluate(expr, exprparser.DefaultStatusCheckNone)
-		require.NoErrorf(t, err, "Evaluate(%q)", expr)
-		assert.Equalf(t, want, got, "Evaluate(%q) on a cancelled job", expr)
-	}
-
-	// A step without an `if` defaults to success() and must be skipped on cancel,
-	// while an `if: always()` step must still run.
-	disabled, err := interp.Evaluate("", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, false, disabled, "default-success step must be skipped on a cancelled job")
-
-	enabled, err := interp.Evaluate("always()", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, true, enabled, "`if: always()` step must run on a cancelled job")
-	setJobResult(context.Background(), rc, rc, true)
-	assert.Equal(t, "cancelled", rc.Run.Job().Result)
-}
-
-// TestMainStepsExecutorRunsAlwaysStepsAfterCancel verifies that newMainStepsExecutor does
-// not abandon the remaining steps when the run is cancelled mid-pipeline. The later step
-// still runs (so a main-stage always() step is reached), it runs under a fresh,
-// non-cancelled context, and the job is marked cancelled. The interrupt error is still
-// propagated so callers up the chain see the cancellation.
-func TestMainStepsExecutorRunsAlwaysStepsAfterCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "step1")
-			cancel() // server cancellation lands while step1 runs
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "interrupt error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after cancel")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps guards the timeout path's symmetry with the cancel path.
-// When the job deadline (timeout-minutes) lands in the gap between two steps, the job must be marked as failed (not cancelled),
-// so always()/failure() cleanup steps run while default success() steps skip, and so the timed-out job is not reported as success.
-func TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx := newControllableDeadlineContext(context.Background())
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(context.Context) error {
-			ran = append(ran, "step1")
-			ctx.expire()
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.DeadlineExceeded, "the timeout error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after a timeout")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-expired context")
-	assert.True(t, rc.jobFailed, "a job timeout marks the job failed")
-	assert.False(t, rc.jobCancelled, "a timeout is not a cancellation")
-
-	// The status the real main-step `if` evaluation sees: "failure", so default success() steps skip while always()/failure() steps run.
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreCancel verifies that a cancellation landing during the
-// pre phase does not abandon the main steps: newStepsExecutor still runs the main-steps executor,
-// so a main-stage always()/cancelled() step is reached (under a fresh, non-cancelled context),
-// the job is marked cancelled, and the cancellation is propagated. Before the fix the `.Then(...)`
-// short-circuit skipped the main steps entirely when a pre step was cancelled.
-func TestStepsExecutorRunsMainStepsAfterPreCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var mainStepCtxErr error
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			cancel() // server cancellation lands during the pre phase
-			return nil
-		},
-	}
-	steps := []common.Executor{
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			mainStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "the cancellation is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-phase cancel")
-	require.NoError(t, mainStepCtxErr, "the main step runs under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreFailure verifies that a failing pre step does not abandon
-// the main steps: they still run (so a main-stage always()/failure() step is reached), and the
-// pre-step error is propagated so the job is reported as failed. The main steps' own `if`
-// evaluation is what skips success()-default steps, so running them here is safe.
-func TestStepsExecutorRunsMainStepsAfterPreFailure(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	var ran []string
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			return assert.AnError
-		},
-	}
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "always-step")
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(context.Background())
-
-	require.ErrorIs(t, err, assert.AnError, "the pre-step error is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-step failure")
-	assert.False(t, rc.jobCancelled, "a pre-step failure is not a cancellation")
-}
-
-// TestPreStepFailureAffectsMainStepIfStatus verifies the status path used by real
-// main-step `if` evaluation. A pre-step failure is not present in StepResults, so
-// recording only the context job error is not enough: getJobContext must also report
-// failure so success()-default main steps skip and failure() steps run.
-func TestPreStepFailureAffectsMainStepIfStatus(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	ctx := common.WithJobErrorContainer(context.Background())
-
-	reportStepError(ctx, rc, assert.AnError)
-
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-	require.ErrorIs(t, common.JobError(ctx), assert.AnError)
-
-	defaultStep := &stepRun{
-		RunContext: rc,
-		Step:       &model.Step{ID: "default-step"},
-		env:        map[string]string{},
-	}
-	defaultEnabled, err := isStepEnabled(ctx, defaultStep.getIfExpression(ctx, stepStageMain), defaultStep, stepStageMain)
-	require.NoError(t, err)
-	assert.False(t, defaultEnabled, "default success() main step must skip after a pre-step failure")
-
-	failureStep := &stepRun{
-		RunContext: rc,
-		Step: &model.Step{
-			ID: "failure-step",
-			If: yaml.Node{Value: "failure()"},
-		},
-		env: map[string]string{},
-	}
-	failureEnabled, err := isStepEnabled(ctx, failureStep.getIfExpression(ctx, stepStageMain), failureStep, stepStageMain)
-	require.NoError(t, err)
-	assert.True(t, failureEnabled, "failure() main step must run after a pre-step failure")
-}
-
-// TestPostStepsContextCancelledIsUsableForFailingStep guards against a panic: post/cleanup
-// steps run on a context derived from the cancelled job context, and a failing post step
-// records its error via common.SetJobError. If that derived context lacks a job-error container,
-// SetJobError dereferences a nil map and panics. The post context must therefore be detached
-// from cancellation (so the steps run) yet still carry a usable error container.
-func TestPostStepsContextCancelledIsUsableForFailingStep(t *testing.T) {
-	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-	cancel()
-	require.ErrorIs(t, cancelled.Err(), context.Canceled)
-
-	postCtx, done := postStepsContext(cancelled)
-	defer done()
-
-	// Detached from cancellation, so the post steps actually run.
-	require.NoError(t, postCtx.Err(), "post context must not be cancelled")
-
-	// A failing post step records its error instead of panicking.
-	require.NotPanics(t, func() {
-		common.SetJobError(postCtx, assert.AnError)
-	}, "a failing post step must not panic on the cancel path")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError)
-}
-
-// TestPostStepsContextDeadlinePreservesJobError verifies the job-timeout path keeps the original
-// job-error container (via context.WithoutCancel), so the timeout failure and any post-step error
-// survive into the post phase and the job is still reported as failed.
-func TestPostStepsContextDeadlinePreservesJobError(t *testing.T) {
-	base := common.WithJobErrorContainer(context.Background())
-	common.SetJobError(base, assert.AnError)
-	expired, cancel := context.WithDeadline(base, time.Now().Add(-time.Hour))
-	defer cancel()
-	require.ErrorIs(t, expired.Err(), context.DeadlineExceeded)
-
-	postCtx, done := postStepsContext(expired)
-	defer done()
-
-	require.NoError(t, postCtx.Err(), "post context must not carry the expired deadline")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError, "the timeout job error must be preserved")
-}
-
-// reportStepError must treat a context.Canceled (e.g. a teardown-cancelled read) as an
-// interruption, never a job failure.
-func TestReportStepErrorTreatsCancelAsInterruption(t *testing.T) {
-	rc := &RunContext{}
-
-	// stray read cancellation while the job context is live: ignored, not a failure
-	live := common.WithJobErrorContainer(context.Background())
-	reportStepError(live, rc, context.Canceled)
-	require.NoError(t, common.JobError(live))
-	assert.False(t, rc.jobFailed)
-	assert.False(t, rc.jobCancelled)
-
-	// genuine job cancellation: recorded as cancelled, still not a failure
-	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-	cancel()
-	reportStepError(cancelled, rc, context.Canceled)
-	require.NoError(t, common.JobError(cancelled))
-	assert.False(t, rc.jobFailed)
-	assert.True(t, rc.jobCancelled)
-
-	// a real error still fails the job
-	failed := common.WithJobErrorContainer(context.Background())
-	reportStepError(failed, rc, assert.AnError)
-	require.ErrorIs(t, common.JobError(failed), assert.AnError)
-	assert.True(t, rc.jobFailed)
-}

act/runner/command.go

@@ -1,272 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-)
-
-var commandPatternGA *regexp.Regexp
-
-var commandPatternADO *regexp.Regexp
-
-func init() {
-	commandPatternGA = regexp.MustCompile("^::([^ ]+?)( (.+?))?::([^\r\n]*)[\r\n]*$")
-	// excluding ']' ends the command info at the first bracket, as GitHub does
-	commandPatternADO = regexp.MustCompile("^##\\[([^ \\]]+)( ([^\\]]*))?]([^\r\n]*)[\r\n]*$")
-}
-
-func tryParseRawActionCommand(line string) (command string, kvPairs map[string]string, arg string, ok bool) {
-	command, kvPairs, arg, _, ok = tryParseActionCommand(line)
-	return command, kvPairs, arg, ok
-}
-
-func tryParseActionCommand(line string) (command string, kvPairs map[string]string, arg string, legacy, ok bool) {
-	if m := commandPatternGA.FindStringSubmatch(line); m != nil {
-		command = m[1]
-		kvPairs = parseKeyValuePairs(m[3], ",")
-		arg = m[4]
-		ok = true
-	} else if m := commandPatternADO.FindStringSubmatch(line); m != nil {
-		command = m[1]
-		kvPairs = parseKeyValuePairs(m[3], ";")
-		arg = m[4]
-		legacy = true
-		ok = true
-	}
-	return command, kvPairs, arg, legacy, ok
-}
-
-func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler {
-	logger := common.Logger(ctx)
-	resumeCommand := ""
-	return func(line string) bool {
-		command, kvPairs, arg, legacy, ok := tryParseActionCommand(line)
-		if !ok {
-			return true
-		}
-		command = strings.ToLower(command)
-
-		if resumeCommand != "" {
-			// There should not be any emojis in the log output for Gitea.
-			// Return true (not false) so the line still reaches the raw_output
-			// log handler; otherwise everything between ::stop-commands:: and
-			// its end token is silently dropped from the step log.
-			logger.Infof("%s", line)
-			// Resumed here rather than from the switch, because the end token is arbitrary
-			// and a token naming a real command would otherwise never resume.
-			if strings.EqualFold(command, resumeCommand) {
-				resumeCommand = ""
-			}
-			return true
-		}
-		if legacy {
-			arg = UnescapeLegacyCommand(arg)
-			kvPairs = unescapeKvPairs(kvPairs, UnescapeLegacyCommand)
-		} else {
-			arg = UnescapeCommandData(arg)
-			kvPairs = unescapeKvPairs(kvPairs, unescapeCommandProperty)
-		}
-		if (command == "set-env" || command == "add-path") && rc.refuseUnsecureCommand(ctx, command) {
-			return true
-		}
-		switch command {
-		case "set-env":
-			rc.setEnv(ctx, kvPairs, arg, true)
-		case "set-output":
-			rc.setOutput(ctx, kvPairs, arg)
-		case "add-path":
-			rc.addPath(ctx, arg)
-		case "add-mask":
-			rc.AddMask(arg)
-			logger.Infof("%s", "***")
-			// The raw line is still forwarded, carrying the secret: that is how the reporter
-			// learns the mask, and it drops the row rather than writing it out.
-		case "stop-commands":
-			resumeCommand = arg
-			logger.Infof("%s", line)
-		case "save-state":
-			logger.Infof("%s", line)
-			rc.saveState(ctx, kvPairs, arg)
-		default:
-			// ::debug::, ::error::, ::warning::, ::add-matcher:: and anything unrecognised are
-			// passed through for the reporter and Gitea's web UI to render.
-			logger.Infof("%s", line)
-		}
-
-		// return true to let gitea's logger handle these special outputs also
-		return true
-	}
-}
-
-const allowUnsecureCommandsVar = "ACTIONS_ALLOW_UNSECURE_COMMANDS"
-
-// refuseUnsecureCommand reports whether a deprecated ::set-env:: or ::add-path:: command must
-// not run, recording the error that fails the step. GitHub disabled both because a step that
-// echoes untrusted content can use them to set NODE_OPTIONS or PATH for every later step.
-func (rc *RunContext) refuseUnsecureCommand(ctx context.Context, command string) bool {
-	if rc.allowUnsecureCommandsOptIn() {
-		return false
-	}
-
-	// The step executor logs the failure itself, so keep this line's wording distinct.
-	common.Logger(ctx).WithField(rawOutputField, true).Errorf("##[error]%s", EscapeCommandData(fmt.Sprintf(
-		"The `%s` command is disabled: it can set the environment of every later step from untrusted output. "+
-			"Write to $GITHUB_ENV or $GITHUB_PATH instead, or set ACTIONS_ALLOW_UNSECURE_COMMANDS to allow it",
-		command)))
-
-	rc.unsecureCommandMu.Lock()
-	defer rc.unsecureCommandMu.Unlock()
-	if rc.unsecureCommandErr == nil {
-		rc.unsecureCommandErr = fmt.Errorf("the `%s` workflow command is disabled", command)
-	}
-	return true
-}
-
-// allowUnsecureCommandsOptIn reports whether the workflow itself asked for the deprecated
-// commands, from any env scope, as it can on GitHub.
-func (rc *RunContext) allowUnsecureCommandsOptIn() bool {
-	return isTruthyEnv(rc.currentStepEnv()[allowUnsecureCommandsVar]) ||
-		isTruthyEnv(rc.Env[allowUnsecureCommandsVar]) ||
-		isTruthyEnv(rc.GlobalEnv[allowUnsecureCommandsVar])
-}
-
-// isTruthyEnv mirrors GitHub's bool.TryParse: only "true", in any casing.
-func isTruthyEnv(v string) bool {
-	return strings.EqualFold(strings.TrimSpace(v), "true")
-}
-
-// takeUnsecureCommandError returns and clears the error left by a refused command.
-func (rc *RunContext) takeUnsecureCommandError() error {
-	rc.unsecureCommandMu.Lock()
-	defer rc.unsecureCommandMu.Unlock()
-	err := rc.unsecureCommandErr
-	rc.unsecureCommandErr = nil
-	return err
-}
-
-func (rc *RunContext) setEnv(ctx context.Context, kvPairs map[string]string, arg string, fromCommand bool) {
-	name := kvPairs["name"]
-	if strings.EqualFold(name, "NODE_OPTIONS") {
-		message := "Can't store NODE_OPTIONS output parameter using '$GITHUB_ENV' command."
-		if fromCommand {
-			message = "Can't update NODE_OPTIONS environment variable using ::set-env:: command."
-		}
-		common.Logger(ctx).WithField(rawOutputField, true).Errorf("##[error]%s", EscapeCommandData(message))
-		return
-	}
-	common.Logger(ctx).Infof("::set-env:: %s=%s", name, arg)
-	if rc.Env == nil {
-		rc.Env = make(map[string]string)
-	}
-	if rc.GlobalEnv == nil {
-		rc.GlobalEnv = map[string]string{}
-	}
-	newenv := map[string]string{
-		name: arg,
-	}
-	mergeIntoMap := mergeIntoMapCaseSensitive
-	if rc.JobContainer != nil && rc.JobContainer.IsEnvironmentCaseInsensitive() {
-		mergeIntoMap = mergeIntoMapCaseInsensitive
-	}
-	mergeIntoMap(rc.Env, newenv)
-	mergeIntoMap(rc.GlobalEnv, newenv)
-}
-
-func (rc *RunContext) setEnvFile(ctx context.Context, kvPairs map[string]string, arg string) {
-	rc.setEnv(ctx, kvPairs, arg, false)
-}
-
-func (rc *RunContext) setOutput(ctx context.Context, kvPairs map[string]string, arg string) {
-	logger := common.Logger(ctx)
-	stepID := rc.CurrentStep
-	outputName := kvPairs["name"]
-
-	result, ok := rc.StepResults[stepID]
-	if !ok {
-		logger.Infof("No outputs registered for step '%s'", stepID)
-		return
-	}
-
-	logger.Infof("::set-output:: %s=%s", outputName, arg)
-	result.Outputs[outputName] = arg
-}
-
-func (rc *RunContext) addPath(ctx context.Context, arg string) {
-	common.Logger(ctx).Infof("::add-path:: %s", arg)
-	extraPath := []string{arg}
-	for _, v := range rc.ExtraPath {
-		if v != arg {
-			extraPath = append(extraPath, v)
-		}
-	}
-	rc.ExtraPath = extraPath
-}
-
-func parseKeyValuePairs(kvPairs, separator string) map[string]string {
-	rtn := make(map[string]string)
-	kvPairList := strings.SplitSeq(kvPairs, separator)
-	for kvPair := range kvPairList {
-		kv := strings.SplitN(kvPair, "=", 2)
-		if len(kv) == 2 {
-			rtn[kv[0]] = kv[1]
-		}
-	}
-	return rtn
-}
-
-// A Replacer never rescans what it wrote, so "%250A" stays a literal "%0A".
-var (
-	commandDataEscaper       = strings.NewReplacer("%", "%25", "\r", "%0D", "\n", "%0A")
-	commandDataUnescaper     = strings.NewReplacer("%25", "%", "%0D", "\r", "%0A", "\n")
-	commandPropertyUnescaper = strings.NewReplacer("%25", "%", "%0D", "\r", "%0A", "\n", "%3A", ":", "%2C", ",")
-	legacyCommandUnescaper   = strings.NewReplacer("%3B", ";", "%0D", "\r", "%0A", "\n", "%5D", "]", "%25", "%")
-)
-
-// EscapeCommandData encodes the data part of a "::cmd::" or "##[cmd]" line the runner writes itself,
-// so the log renderer decodes it back. Lines forwarded from step output are already escaped.
-func EscapeCommandData(arg string) string {
-	return commandDataEscaper.Replace(arg)
-}
-
-func UnescapeCommandData(arg string) string {
-	return commandDataUnescaper.Replace(arg)
-}
-
-func unescapeCommandProperty(arg string) string {
-	return commandPropertyUnescaper.Replace(arg)
-}
-
-// UnescapeLegacyCommand decodes a "##[cmd]" line, which also spells ";" and "]" escaped.
-func UnescapeLegacyCommand(arg string) string {
-	return legacyCommandUnescaper.Replace(arg)
-}
-
-func unescapeKvPairs(kvPairs map[string]string, unescape func(string) string) map[string]string {
-	for k, v := range kvPairs {
-		kvPairs[k] = unescape(v)
-	}
-	return kvPairs
-}
-
-func (rc *RunContext) saveState(_ context.Context, kvPairs map[string]string, arg string) {
-	stepID := rc.CurrentStep
-	if stepID != "" {
-		if rc.IntraActionState == nil {
-			rc.IntraActionState = map[string]map[string]string{}
-		}
-		state, ok := rc.IntraActionState[stepID]
-		if !ok {
-			state = map[string]string{}
-			rc.IntraActionState[stepID] = state
-		}
-		state[kvPairs["name"]] = arg
-	}
-}

act/runner/command_test.go

@@ -1,302 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"testing"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"gitea.dev/actionslib/pkg/model"
-	"github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// unsecureRC opts into ::set-env:: and ::add-path::, which are refused without it.
-func unsecureRC() *RunContext {
-	return &RunContext{Env: map[string]string{allowUnsecureCommandsVar: "true"}}
-}
-
-func TestSetEnv(t *testing.T) {
-	a := assert.New(t)
-	logger, hook := test.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	rc := unsecureRC()
-	handler := rc.commandHandler(ctx)
-
-	handler("::set-env name=x::valz\n")
-	a.Equal("valz", rc.Env["x"])
-	handler("::SET-ENV name=NODE_OPTIONS::--require command.js\n")
-	rc.setEnvFile(ctx, map[string]string{"name": "node_options"}, "--require env.js")
-	a.NotContains(rc.Env, "NODE_OPTIONS")
-	a.NotContains(rc.Env, "node_options")
-	entries := hook.AllEntries()
-	require.Len(t, entries, 3)
-	a.Equal("##[error]Can't update NODE_OPTIONS environment variable using ::set-env:: command.", entries[1].Message)
-	a.Equal("##[error]Can't store NODE_OPTIONS output parameter using '$GITHUB_ENV' command.", entries[2].Message)
-}
-
-func TestStopCommandsKeepsSuppressedLinesInLog(t *testing.T) {
-	a := assert.New(t)
-	ctx := context.Background()
-	rc := unsecureRC()
-	handler := rc.commandHandler(ctx)
-
-	// Stop command processing until the matching end token is seen.
-	a.True(handler("::stop-commands::my-end-token\n"))
-
-	// A command-shaped line while stopped must not be executed (env unchanged),
-	// but must still return true so it reaches the raw_output log handler and is
-	// not dropped from the step log.
-	a.True(handler("::set-env name=x::valz\n"))
-	a.NotContains(rc.Env, "x")
-
-	// The matching end token resumes command processing.
-	a.True(handler("::my-end-token::\n"))
-
-	// Commands are processed again after resuming.
-	a.True(handler("::set-env name=y::valy\n"))
-	a.Equal("valy", rc.Env["y"])
-}
-
-func TestSetOutput(t *testing.T) {
-	a := assert.New(t)
-	ctx := context.Background()
-	rc := new(RunContext)
-	rc.StepResults = make(map[string]*model.StepResult)
-	handler := rc.commandHandler(ctx)
-
-	rc.CurrentStep = "my-step"
-	rc.StepResults[rc.CurrentStep] = &model.StepResult{
-		Outputs: make(map[string]string),
-	}
-	handler("::set-output name=x::valz\n")
-	a.Equal("valz", rc.StepResults["my-step"].Outputs["x"])
-
-	handler("::set-output name=x::percent2%25\n")
-	a.Equal("percent2%", rc.StepResults["my-step"].Outputs["x"])
-
-	handler("::set-output name=x::percent2%25%0Atest\n")
-	a.Equal("percent2%\ntest", rc.StepResults["my-step"].Outputs["x"])
-
-	handler("::set-output name=x::percent2%25%0Atest another3%25test\n")
-	a.Equal("percent2%\ntest another3%test", rc.StepResults["my-step"].Outputs["x"])
-
-	handler("::set-output name=x%3A::percent2%25%0Atest\n")
-	a.Equal("percent2%\ntest", rc.StepResults["my-step"].Outputs["x:"])
-
-	handler("::set-output name=x%3A%2C%0A%25%0D%3A::percent2%25%0Atest\n")
-	a.Equal("percent2%\ntest", rc.StepResults["my-step"].Outputs["x:,\n%\r:"])
-	handler("::set-output name=symbol::std::vector")
-	a.Equal("std::vector", rc.StepResults["my-step"].Outputs["symbol"])
-	handler("::set-output name=a=b::value\n")
-	a.Equal("value", rc.StepResults["my-step"].Outputs["a=b"])
-	handler("##[set-output name=legacy%3B%5D]value%3B%5D")
-	a.Equal("value;]", rc.StepResults["my-step"].Outputs["legacy;]"])
-	handler("##[set-output name=bracket]value]tail")
-	a.Equal("value]tail", rc.StepResults["my-step"].Outputs["bracket"])
-	handler("::set-output name=modern%3B%5D::value%3B%5D\n")
-	a.Equal("value%3B%5D", rc.StepResults["my-step"].Outputs["modern%3B%5D"])
-}
-
-func TestAddpath(t *testing.T) {
-	a := assert.New(t)
-	ctx := context.Background()
-	rc := unsecureRC()
-	handler := rc.commandHandler(ctx)
-
-	handler("::add-path::/zoo\n")
-	a.Equal("/zoo", rc.ExtraPath[0])
-
-	handler("::add-path::/boo\n")
-	a.Equal("/boo", rc.ExtraPath[0])
-}
-
-func TestStopCommands(t *testing.T) {
-	logger, hook := test.NewNullLogger()
-
-	a := assert.New(t)
-	ctx := common.WithLogger(context.Background(), logger)
-	rc := unsecureRC()
-	handler := rc.commandHandler(ctx)
-
-	handler("::set-env name=x::valz\n")
-	a.Equal("valz", rc.Env["x"])
-	handler("::stop-commands::MY-END-TOKEN\n")
-	handler("::set-env name=x::abcd\n")
-	a.Equal("valz", rc.Env["x"])
-	handler("::my-end-token::\n")
-	handler("::set-env name=x::abcd\n")
-	a.Equal("abcd", rc.Env["x"])
-
-	messages := make([]string, 0)
-	for _, entry := range hook.AllEntries() {
-		messages = append(messages, entry.Message)
-	}
-
-	a.Contains(messages, "::set-env name=x::abcd\n")
-}
-
-// The end token is arbitrary, so one that happens to name a real command must still resume
-// rather than being swallowed by that command's case.
-func TestStopCommandsResumesOnCommandNamedToken(t *testing.T) {
-	a := assert.New(t)
-	rc := unsecureRC()
-	handler := rc.commandHandler(context.Background())
-
-	handler("::stop-commands::add-mask\n")
-	handler("::set-env name=x::suppressed\n")
-	a.NotContains(rc.Env, "x")
-
-	handler("::add-mask::\n")
-	handler("::set-env name=x::resumed\n")
-	a.Equal("resumed", rc.Env["x"])
-}
-
-func TestAddpathADO(t *testing.T) {
-	a := assert.New(t)
-	ctx := context.Background()
-	rc := unsecureRC()
-	handler := rc.commandHandler(ctx)
-
-	handler("##[add-path]/zoo\n")
-	a.Equal("/zoo", rc.ExtraPath[0])
-
-	handler("##[add-path]/boo\n")
-	a.Equal("/boo", rc.ExtraPath[0])
-}
-
-func TestAddmask(t *testing.T) {
-	logger, hook := test.NewNullLogger()
-
-	a := assert.New(t)
-	ctx := context.Background()
-	loggerCtx := common.WithLogger(ctx, logger)
-
-	rc := new(RunContext)
-	handler := rc.commandHandler(loggerCtx)
-	handler("::ADD-MASK::my::secret")
-
-	a.Equal("***", hook.LastEntry().Message)
-	a.Equal([]string{"my::secret"}, rc.Masks)
-}
-
-// based on https://stackoverflow.com/a/10476304
-func captureOutput(t *testing.T, f func()) string {
-	old := os.Stdout
-	r, w, _ := os.Pipe()
-	os.Stdout = w
-
-	f()
-
-	outC := make(chan string)
-
-	go func() {
-		var buf bytes.Buffer
-		_, err := io.Copy(&buf, r)
-		if err != nil {
-			a := assert.New(t)
-			a.Fail("io.Copy failed")
-		}
-		outC <- buf.String()
-	}()
-
-	w.Close()
-	os.Stdout = old
-	out := <-outC
-
-	return out
-}
-
-func TestAddmaskUsemask(t *testing.T) {
-	rc := new(RunContext)
-	rc.StepResults = make(map[string]*model.StepResult)
-	rc.CurrentStep = "my-step"
-	rc.StepResults[rc.CurrentStep] = &model.StepResult{
-		Outputs: make(map[string]string),
-	}
-
-	a := assert.New(t)
-
-	config := &Config{
-		Secrets:         map[string]string{},
-		InsecureSecrets: false,
-	}
-
-	re := captureOutput(t, func() {
-		ctx := context.Background()
-		ctx = WithJobLogger(ctx, "0", "testjob", config, &rc.Masks, map[string]any{})
-
-		handler := rc.commandHandler(ctx)
-		handler("::add-mask::secret\n")
-		handler("::set-output:: token=secret\n")
-	})
-
-	a.Equal("[testjob] ***\n[testjob] ::set-output:: = token=***\n", re)
-}
-
-func TestSaveState(t *testing.T) {
-	rc := &RunContext{
-		CurrentStep: "step",
-		StepResults: map[string]*model.StepResult{},
-	}
-
-	ctx := context.Background()
-
-	handler := rc.commandHandler(ctx)
-	handler("::save-state name=state-name::state-value\n")
-
-	assert.Equal(t, "state-value", rc.IntraActionState["step"]["state-name"])
-}
-
-func TestEscapeCommandData(t *testing.T) {
-	a := assert.New(t)
-
-	a.Equal("a%25b%0Dc%0Ad%250A", EscapeCommandData("a%b\rc\nd%0A"))
-	a.Equal("a%b\rc\nd%0A", UnescapeCommandData("a%25b%0Dc%0Ad%250A"))
-}
-
-func TestUnsecureCommands(t *testing.T) {
-	tests := []struct {
-		name    string
-		jobEnv  map[string]string
-		stepEnv map[string]string
-		optedIn bool
-	}{
-		{name: "refused with no opt-in"},
-		// GitHub reads the opt-in with bool.TryParse, so "1" is not one.
-		{name: "refused for a value bool.TryParse rejects", jobEnv: map[string]string{allowUnsecureCommandsVar: "1"}},
-		{name: "opted in through the step environment", stepEnv: map[string]string{allowUnsecureCommandsVar: "true"}, optedIn: true},
-		{name: "opted in through the job environment", jobEnv: map[string]string{allowUnsecureCommandsVar: "TRUE"}, optedIn: true},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			a := assert.New(t)
-			rc := &RunContext{Env: tt.jobEnv}
-			rc.setCurrentStepEnv(tt.stepEnv)
-			handler := rc.commandHandler(context.Background())
-
-			handler("::set-env name=x::valz\n")
-			handler("::add-path::/opt/bin\n")
-
-			if !tt.optedIn {
-				a.Empty(rc.Env["x"])
-				a.Empty(rc.ExtraPath)
-				// The refusal fails the step that produced it, once.
-				require.ErrorContains(t, rc.takeUnsecureCommandError(), "set-env")
-				a.NoError(rc.takeUnsecureCommandError())
-				return
-			}
-			a.Equal("valz", rc.Env["x"])
-			a.Equal([]string{"/opt/bin"}, rc.ExtraPath)
-			a.NoError(rc.takeUnsecureCommandError())
-		})
-	}
-}

act/runner/container_mock_test.go

@@ -1,88 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"io"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-
-	"github.com/stretchr/testify/mock"
-)
-
-var noopExecutor = func(context.Context) error { return nil }
-
-type containerMock struct {
-	mock.Mock
-	container.Container
-	container.LinuxContainerEnvironmentExtensions
-}
-
-func (cm *containerMock) Create(capAdd, capDrop []string) common.Executor {
-	args := cm.Called(capAdd, capDrop)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) Pull(forcePull bool) common.Executor {
-	args := cm.Called(forcePull)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) Start(attach bool) common.Executor {
-	args := cm.Called(attach)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) Remove() common.Executor {
-	args := cm.Called()
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) Close() common.Executor {
-	args := cm.Called()
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
-	args := cm.Called(srcPath, env)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) Copy(destPath string, files ...*container.FileEntry) common.Executor {
-	args := cm.Called(destPath, files)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
-	args := cm.Called(destPath, srcPath, useGitIgnore)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) Exec(command []string, env map[string]string, user, workdir string) common.Executor {
-	args := cm.Called(command, env, user, workdir)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (cm *containerMock) GetContainerArchive(ctx context.Context, srcPath string) (io.ReadCloser, error) {
-	args := cm.Called(ctx, srcPath)
-	err, hasErr := args.Get(1).(error)
-	if !hasErr {
-		err = nil
-	}
-	return args.Get(0).(io.ReadCloser), err
-}
-
-func (cm *containerMock) DumpLogs(ctx context.Context) error {
-	return cm.Called(ctx).Error(0)
-}
-
-func (cm *containerMock) Inspect(ctx context.Context) (*container.Info, error) {
-	args := cm.Called(ctx)
-	info, _ := args.Get(0).(*container.Info)
-	err, _ := args.Get(1).(error)
-	return info, err
-}

act/runner/expression.go

@@ -1,380 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"maps"
-	"path"
-	"reflect"
-	"regexp"
-	"strings"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-
-	_ "embed"
-
-	"gitea.dev/actionslib/pkg/expreval"
-	"gitea.dev/actionslib/pkg/exprparser"
-	"gitea.dev/actionslib/pkg/model"
-	"go.yaml.in/yaml/v4"
-)
-
-// NewExpressionEvaluator creates a new evaluator
-func (rc *RunContext) NewExpressionEvaluator(ctx context.Context) *ExpressionEvaluator {
-	return rc.NewExpressionEvaluatorWithEnv(ctx, rc.GetEnv())
-}
-
-func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map[string]string) *ExpressionEvaluator {
-	var workflowCallResult map[string]*model.WorkflowCallResult
-
-	// todo: cleanup EvaluationEnvironment creation
-	using := make(map[string]exprparser.Needs)
-	strategy := make(map[string]any)
-	if rc.Run != nil {
-		job := rc.Run.Job()
-		if job != nil && job.Strategy != nil {
-			strategy["fail-fast"] = job.Strategy.FailFast
-			strategy["max-parallel"] = job.Strategy.MaxParallel
-		}
-
-		jobs := rc.Run.Workflow.Jobs
-		jobNeeds := rc.Run.Job().Needs()
-
-		for _, needs := range jobNeeds {
-			using[needs] = exprparser.Needs{
-				Outputs: jobs[needs].Outputs,
-				Result:  jobs[needs].NeedsResult(),
-			}
-		}
-
-		// only setup jobs context in case of workflow_call
-		// and existing expression evaluator (this means, jobs are at
-		// least ready to run)
-		if rc.caller != nil && rc.ExprEval != nil {
-			workflowCallResult = map[string]*model.WorkflowCallResult{}
-
-			for jobName, job := range jobs {
-				result := model.WorkflowCallResult{
-					Outputs: map[string]string{},
-				}
-				maps.Copy(result.Outputs, job.Outputs)
-				workflowCallResult[jobName] = &result
-			}
-		}
-	}
-
-	ghc := rc.getGithubContext(ctx)
-	inputs := getEvaluatorInputs(ctx, rc, rc.actionInputs, ghc)
-
-	ee := &exprparser.EvaluationEnvironment{
-		Github: ghc,
-		Env:    env,
-		Job:    rc.getJobContext(),
-		Jobs:   &workflowCallResult,
-		// todo: should be unavailable
-		// but required to interpolate/evaluate the step outputs on the job
-		Steps:     rc.getStepsContext(),
-		Secrets:   getWorkflowSecrets(ctx, rc),
-		Vars:      getWorkflowVars(ctx, rc),
-		Strategy:  strategy,
-		Matrix:    rc.Matrix,
-		Needs:     using,
-		Inputs:    inputs,
-		HashFiles: getHashFilesFunction(ctx, rc),
-	}
-	ee.Runner = rc.getRunnerContext(ctx)
-	return &expressionEvaluator{
-		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
-			Run:        rc.Run,
-			WorkingDir: rc.Config.Workdir,
-			Context:    "job",
-		}),
-	}
-}
-
-//go:embed hashfiles/index.js
-var hashfiles string
-
-// NewStepExpressionEvaluator creates a new evaluator with the `inputs` of the enclosing workflow or composite action
-func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step) *ExpressionEvaluator {
-	return rc.newStepExpressionEvaluator(ctx, step, rc.actionInputs)
-}
-
-// NewActionInputsExpressionEvaluator creates a new evaluator with the step's own with: values as `inputs`
-func (rc *RunContext) NewActionInputsExpressionEvaluator(ctx context.Context, step step) *ExpressionEvaluator {
-	return rc.newStepExpressionEvaluator(ctx, step, inputsFromEnv(*step.getEnv()))
-}
-
-func (rc *RunContext) newStepExpressionEvaluator(ctx context.Context, step step, stepInputs map[string]any) *ExpressionEvaluator {
-	// todo: cleanup EvaluationEnvironment creation
-	job := rc.Run.Job()
-	strategy := make(map[string]any)
-	if job.Strategy != nil {
-		strategy["fail-fast"] = job.Strategy.FailFast
-		strategy["max-parallel"] = job.Strategy.MaxParallel
-	}
-
-	jobs := rc.Run.Workflow.Jobs
-	jobNeeds := rc.Run.Job().Needs()
-
-	using := make(map[string]exprparser.Needs)
-	for _, needs := range jobNeeds {
-		using[needs] = exprparser.Needs{
-			Outputs: jobs[needs].Outputs,
-			Result:  jobs[needs].NeedsResult(),
-		}
-	}
-
-	ee := &exprparser.EvaluationEnvironment{
-		Github:   step.getGithubContext(ctx),
-		Env:      *step.getEnv(),
-		Job:      rc.getJobContext(),
-		Steps:    rc.getStepsContext(),
-		Secrets:  getWorkflowSecrets(ctx, rc),
-		Vars:     getWorkflowVars(ctx, rc),
-		Strategy: strategy,
-		Matrix:   rc.Matrix,
-		Needs:    using,
-		// todo: should be unavailable
-		// but required to interpolate/evaluate the inputs in actions/composite
-		Inputs:    getEvaluatorInputs(ctx, rc, stepInputs, rc.getGithubContext(ctx)),
-		HashFiles: getHashFilesFunction(ctx, rc),
-	}
-	ee.Runner = rc.getRunnerContext(ctx)
-	return &expressionEvaluator{
-		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
-			Run:        rc.Run,
-			WorkingDir: rc.Config.Workdir,
-			Context:    "step",
-		}),
-	}
-}
-
-func getHashFilesFunction(ctx context.Context, rc *RunContext) func(v []reflect.Value) (any, error) {
-	hashFiles := func(v []reflect.Value) (any, error) {
-		if rc.JobContainer != nil {
-			timeed, cancel := context.WithTimeout(ctx, time.Minute)
-			defer cancel()
-			name := "workflow/hashfiles/index.js"
-			hout := &bytes.Buffer{}
-			herr := &bytes.Buffer{}
-			patterns := []string{}
-			followSymlink := false
-
-			for i, p := range v {
-				s := p.String()
-				if i == 0 {
-					if strings.HasPrefix(s, "--") {
-						if strings.EqualFold(s, "--follow-symbolic-links") {
-							followSymlink = true
-							continue
-						}
-						return "", fmt.Errorf("invalid glob option %s, available option: '--follow-symbolic-links'", s)
-					}
-				}
-				patterns = append(patterns, s)
-			}
-			env := map[string]string{}
-			maps.Copy(env, rc.Env)
-			env["patterns"] = strings.Join(patterns, "\n")
-			if followSymlink {
-				env["followSymbolicLinks"] = "true"
-			}
-
-			stdout, stderr := rc.JobContainer.ReplaceLogWriter(hout, herr)
-			_ = rc.JobContainer.Copy(rc.JobContainer.GetActPath(), &container.FileEntry{
-				Name: name,
-				Mode: 0o644,
-				Body: hashfiles,
-			}).
-				Then(rc.JobContainer.Exec([]string{"node", path.Join(rc.JobContainer.GetActPath(), name)},
-					env, "", "")).
-				Finally(func(context.Context) error {
-					rc.JobContainer.ReplaceLogWriter(stdout, stderr)
-					return nil
-				})(timeed)
-			output := hout.String() + "\n" + herr.String()
-			guard := "__OUTPUT__"
-			outstart := strings.Index(output, guard)
-			if outstart != -1 {
-				outstart += len(guard)
-				outend := strings.Index(output[outstart:], guard)
-				if outend != -1 {
-					return output[outstart : outstart+outend], nil
-				}
-			}
-		}
-		return "", nil
-	}
-	return hashFiles
-}
-
-type expressionEvaluator struct {
-	interpreter exprparser.Interpreter
-}
-
-type ExpressionEvaluator = expressionEvaluator
-
-func (ee expressionEvaluator) evaluate(ctx context.Context, in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) {
-	logger := common.Logger(ctx)
-	logger.Debugf("evaluating expression '%s'", in)
-	evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck)
-
-	// evaluated is an any: %t renders everything but a bool as "%!t(string=...)"
-	printable := regexp.MustCompile(`::add-mask::.*`).ReplaceAllString(fmt.Sprintf("%v", evaluated), "::add-mask::***)")
-	logger.Debugf("expression '%s' evaluated to '%s'", in, printable)
-
-	return evaluated, err
-}
-
-// shared returns the evaluation layer of the shared library, bound to this context so the
-// evaluation of every single expression is still logged and masked here.
-func (ee expressionEvaluator) shared(ctx context.Context) expreval.Evaluator {
-	return expreval.New(func(in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) {
-		return ee.evaluate(ctx, in, defaultStatusCheck)
-	})
-}
-
-func (ee expressionEvaluator) EvaluateYamlNode(ctx context.Context, node *yaml.Node) error {
-	return ee.shared(ctx).EvaluateYamlNode(node)
-}
-
-func (ee expressionEvaluator) Interpolate(ctx context.Context, in string) string {
-	out, err := ee.interpolate(ctx, in)
-	if err != nil {
-		common.Logger(ctx).Errorf("Unable to interpolate expression '%s': %s", in, err)
-		return ""
-	}
-	return out
-}
-
-func (ee expressionEvaluator) interpolate(ctx context.Context, in string) (string, error) {
-	return ee.shared(ctx).Interpolate(in)
-}
-
-// EvalBool evaluates an expression against given evaluator. An `if:` is an expression even without
-// `${{ }}`, while literal text around one makes the whole value a string.
-func EvalBool(ctx context.Context, evaluator *expressionEvaluator, expr string, defaultStatusCheck exprparser.DefaultStatusCheck) (bool, error) {
-	return expreval.New(func(in string, dsc exprparser.DefaultStatusCheck) (any, error) {
-		return evaluator.evaluate(ctx, in, dsc)
-	}).EvalBool(expr, defaultStatusCheck)
-}
-
-func inputsFromEnv(env map[string]string) map[string]any {
-	inputs := map[string]any{}
-	for k, v := range env {
-		if after, ok := strings.CutPrefix(k, "INPUT_"); ok {
-			inputs[strings.ToLower(after)] = v
-		}
-	}
-	return inputs
-}
-
-func getEvaluatorInputs(ctx context.Context, rc *RunContext, stepInputs map[string]any, ghc *model.GithubContext) map[string]any {
-	inputs := map[string]any{}
-
-	setupWorkflowInputs(ctx, &inputs, rc)
-	maps.Copy(inputs, stepInputs)
-
-	if ghc.EventName == "workflow_dispatch" {
-		config := rc.Run.Workflow.WorkflowDispatchConfig()
-		if config != nil && config.Inputs != nil {
-			for k, v := range config.Inputs {
-				value := nestedMapLookup(ghc.Event, "inputs", k)
-				if value == nil {
-					value = v.Default
-				}
-				inputs[k] = coerceInputValue(value, v.Type)
-			}
-		}
-	}
-
-	if ghc.EventName == "workflow_call" {
-		config := rc.Run.Workflow.WorkflowCallConfig()
-		if config != nil && config.Inputs != nil {
-			for k, v := range config.Inputs {
-				value := nestedMapLookup(ghc.Event, "inputs", k)
-				if value == nil {
-					value = v.Default
-				}
-				inputs[k] = coerceInputValue(value, v.Type)
-			}
-		}
-	}
-	return inputs
-}
-
-// coerceInputValue converts an input value to the type declared by the workflow.
-// The event payload carries natively typed JSON values on newer Gitea versions,
-// while defaults and older servers provide strings.
-func coerceInputValue(value any, inputType string) any {
-	if inputType != "boolean" {
-		return value
-	}
-	if b, ok := value.(bool); ok {
-		return b
-	}
-	return value == "true"
-}
-
-func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunContext) {
-	if rc.caller != nil {
-		config := rc.Run.Workflow.WorkflowCallConfig()
-
-		for name, input := range config.Inputs {
-			value := rc.caller.runContext.Run.Job().With[name]
-			if value != nil {
-				if str, ok := value.(string); ok {
-					// evaluate using the calling RunContext (outside)
-					value = rc.caller.runContext.ExprEval.Interpolate(ctx, str)
-				}
-			}
-
-			if value == nil && config != nil && config.Inputs != nil {
-				value = input.Default
-				if rc.ExprEval != nil {
-					if str, ok := value.(string); ok {
-						// evaluate using the called RunContext (inside)
-						value = rc.ExprEval.Interpolate(ctx, str)
-					}
-				}
-			}
-
-			(*inputs)[name] = coerceInputValue(value, input.Type)
-		}
-	}
-}
-
-func getWorkflowSecrets(ctx context.Context, rc *RunContext) map[string]string {
-	if rc.caller != nil {
-		job := rc.caller.runContext.Run.Job()
-		secrets := job.Secrets()
-
-		if secrets == nil && job.InheritSecrets() {
-			secrets = rc.caller.runContext.Config.Secrets
-		}
-
-		// Interpolate into a new map. secrets may be the shared Config.Secrets (or the job's
-		// map), which other parallel jobs read concurrently (e.g. log masking), so mutating it
-		// in place is a data race.
-		interpolated := make(map[string]string, len(secrets))
-		for k, v := range secrets {
-			interpolated[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v)
-		}
-
-		return interpolated
-	}
-
-	return rc.Config.Secrets
-}
-
-func getWorkflowVars(_ context.Context, rc *RunContext) map[string]string {
-	return rc.Config.Vars
-}

act/runner/expression_test.go

@@ -1,383 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"gitea.dev/actionslib/pkg/exprparser"
-	"gitea.dev/actionslib/pkg/model"
-	assert "github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	yaml "go.yaml.in/yaml/v4"
-)
-
-func createRunContext(t *testing.T) *RunContext {
-	var yml yaml.Node
-	err := yml.Encode(map[string][]any{
-		"os":  {"Linux", "Windows"},
-		"foo": {"bar", "baz"},
-	})
-	assert.NoError(t, err)
-
-	return &RunContext{
-		Config: &Config{
-			Workdir: ".",
-			Secrets: map[string]string{
-				"CASE_INSENSITIVE_SECRET": "value",
-			},
-			Vars: map[string]string{
-				"CASE_INSENSITIVE_VAR": "value",
-			},
-		},
-		Env: map[string]string{
-			"key": "value",
-		},
-		Run: &model.Run{
-			JobID: "job1",
-			Workflow: &model.Workflow{
-				Name: "test-workflow",
-				Jobs: map[string]*model.Job{
-					"job1": {
-						Strategy: &model.Strategy{
-							RawMatrix: yml,
-						},
-					},
-				},
-			},
-		},
-		Matrix: map[string]any{
-			"os":  "Linux",
-			"foo": "bar",
-		},
-		StepResults: map[string]*model.StepResult{
-			"idwithnothing": {
-				Conclusion: model.StepStatusSuccess,
-				Outcome:    model.StepStatusFailure,
-				Outputs: map[string]string{
-					"foowithnothing": "barwithnothing",
-				},
-			},
-			"id-with-hyphens": {
-				Conclusion: model.StepStatusSuccess,
-				Outcome:    model.StepStatusFailure,
-				Outputs: map[string]string{
-					"foo-with-hyphens": "bar-with-hyphens",
-				},
-			},
-			"id_with_underscores": {
-				Conclusion: model.StepStatusSuccess,
-				Outcome:    model.StepStatusFailure,
-				Outputs: map[string]string{
-					"foo_with_underscores": "bar_with_underscores",
-				},
-			},
-		},
-	}
-}
-
-func TestEvaluateRunContext(t *testing.T) {
-	rc := createRunContext(t)
-	ee := rc.NewExpressionEvaluator(context.Background())
-
-	tables := []struct {
-		in      string
-		out     any
-		errMesg string
-	}{
-		{" 1 ", 1, ""},
-		// {"1 + 3", "4", ""},
-		// {"(1 + 3) * -2", "-8", ""},
-		{"'my text'", "my text", ""},
-		{"contains('my text', 'te')", true, ""},
-		{"contains('my TEXT', 'te')", true, ""},
-		{"contains(fromJSON('[\"my text\"]'), 'te')", false, ""},
-		{"contains(fromJSON('[\"foo\",\"bar\"]'), 'bar')", true, ""},
-		{"startsWith('hello world', 'He')", true, ""},
-		{"endsWith('hello world', 'ld')", true, ""},
-		{"format('0:{0} 2:{2} 1:{1}', 'zero', 'one', 'two')", "0:zero 2:two 1:one", ""},
-		{"join(fromJSON('[\"hello\"]'),'octocat')", "hello", ""},
-		{"join(fromJSON('[\"hello\",\"mona\",\"the\"]'),'octocat')", "hellooctocatmonaoctocatthe", ""},
-		{"join('hello','mona')", "hello", ""},
-		{"toJSON(env)", "{\n  \"ACT\": \"true\",\n  \"ACT_SKIP_CHECKOUT\": \"true\",\n  \"key\": \"value\"\n}", ""},
-		{"toJson(env)", "{\n  \"ACT\": \"true\",\n  \"ACT_SKIP_CHECKOUT\": \"true\",\n  \"key\": \"value\"\n}", ""},
-		{"(fromJSON('{\"foo\":\"bar\"}')).foo", "bar", ""},
-		{"(fromJson('{\"foo\":\"bar\"}')).foo", "bar", ""},
-		{"(fromJson('[\"foo\",\"bar\"]'))[1]", "bar", ""},
-		// github does return an empty string for non-existent files
-		{"hashFiles('**/non-extant-files')", "", ""},
-		{"hashFiles('**/non-extant-files', '**/more-non-extant-files')", "", ""},
-		{"hashFiles('**/non.extant.files')", "", ""},
-		{"hashFiles('**/non''extant''files')", "", ""},
-		{"success()", true, ""},
-		{"failure()", false, ""},
-		{"always()", true, ""},
-		{"cancelled()", false, ""},
-		{"github.workflow", "test-workflow", ""},
-		{"github.actor", "nektos/act", ""},
-		{"github.run_id", "1", ""},
-		{"github.run_number", "1", ""},
-		{"job.status", "success", ""},
-		{"matrix.os", "Linux", ""},
-		{"matrix.foo", "bar", ""},
-		{"env.key", "value", ""},
-		{"secrets.CASE_INSENSITIVE_SECRET", "value", ""},
-		{"secrets.case_insensitive_secret", "value", ""},
-		{"vars.CASE_INSENSITIVE_VAR", "value", ""},
-		{"vars.case_insensitive_var", "value", ""},
-		{"format('{{0}}', 'test')", "{0}", ""},
-		{"format('{{{0}}}', 'test')", "{test}", ""},
-		{"format('}}')", "}", ""},
-		{"format('echo Hello {0} ${{Test}}', 'World')", "echo Hello World ${Test}", ""},
-		{"format('echo Hello {0} ${{Test}}', github.undefined_property)", "echo Hello  ${Test}", ""},
-		{"format('echo Hello {0}{1} ${{Te{0}st}}', github.undefined_property, 'World')", "echo Hello World ${Test}", ""},
-		{"format('{0}', '{1}', 'World')", "{1}", ""},
-		{"format('{{{0}', '{1}', 'World')", "{{1}", ""},
-	}
-
-	for _, table := range tables {
-		t.Run(table.in, func(t *testing.T) {
-			assertObject := assert.New(t)
-			out, err := ee.evaluate(context.Background(), table.in, exprparser.DefaultStatusCheckNone)
-			if table.errMesg == "" {
-				assertObject.NoError(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
-				assertObject.Equal(table.out, out, table.in)
-			} else {
-				assertObject.Error(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
-				assertObject.Equal(table.errMesg, err.Error(), table.in)
-			}
-		})
-	}
-}
-
-func TestEvaluateStep(t *testing.T) {
-	rc := createRunContext(t)
-	rc.Env["INPUT_FORGED"] = "leaked"
-	step := &stepRun{
-		RunContext: rc,
-		env:        map[string]string{"INPUT_FORGED": "leaked"},
-	}
-
-	ee := rc.NewStepExpressionEvaluator(context.Background(), step)
-
-	tables := []struct {
-		in      string
-		out     any
-		errMesg string
-	}{
-		{"steps.idwithnothing.conclusion", model.StepStatusSuccess.String(), ""},
-		{"steps.idwithnothing.outcome", model.StepStatusFailure.String(), ""},
-		{"steps.idwithnothing.outputs.foowithnothing", "barwithnothing", ""},
-		{"steps.id-with-hyphens.conclusion", model.StepStatusSuccess.String(), ""},
-		{"steps.id-with-hyphens.outcome", model.StepStatusFailure.String(), ""},
-		{"steps.id-with-hyphens.outputs.foo-with-hyphens", "bar-with-hyphens", ""},
-		{"steps.id_with_underscores.conclusion", model.StepStatusSuccess.String(), ""},
-		{"steps.id_with_underscores.outcome", model.StepStatusFailure.String(), ""},
-		{"steps.id_with_underscores.outputs.foo_with_underscores", "bar_with_underscores", ""},
-		{"inputs.forged", nil, ""}, // INPUT_* env is not an input
-	}
-
-	for _, table := range tables {
-		t.Run(table.in, func(t *testing.T) {
-			assertObject := assert.New(t)
-			out, err := ee.evaluate(context.Background(), table.in, exprparser.DefaultStatusCheckNone)
-			if table.errMesg == "" {
-				assertObject.NoError(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
-				assertObject.Equal(table.out, out, table.in)
-			} else {
-				assertObject.Error(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
-				assertObject.Equal(table.errMesg, err.Error(), table.in)
-			}
-		})
-	}
-}
-
-func TestInterpolate(t *testing.T) {
-	rc := &RunContext{
-		Config: &Config{
-			Workdir: ".",
-			Secrets: map[string]string{
-				"CASE_INSENSITIVE_SECRET": "value",
-			},
-			Vars: map[string]string{
-				"CASE_INSENSITIVE_VAR": "value",
-			},
-		},
-		Env: map[string]string{
-			"KEYWITHNOTHING":       "valuewithnothing",
-			"KEY-WITH-HYPHENS":     "value-with-hyphens",
-			"KEY_WITH_UNDERSCORES": "value_with_underscores",
-			"SOMETHING_TRUE":       "true",
-			"SOMETHING_FALSE":      "false",
-		},
-		Run: &model.Run{
-			JobID: "job1",
-			Workflow: &model.Workflow{
-				Name: "test-workflow",
-				Jobs: map[string]*model.Job{
-					"job1": {},
-				},
-			},
-		},
-	}
-	ee := rc.NewExpressionEvaluator(context.Background())
-	tables := []struct {
-		in  string
-		out string
-	}{
-		{" text ", " text "},
-		{" $text ", " $text "},
-		{" ${text} ", " ${text} "},
-		{" ${{          1                         }} to ${{2}} ", " 1 to 2 "},
-		{" ${{  (true || false)  }} to ${{2}} ", " true to 2 "},
-		{" ${{  (false   ||  '}}'  )    }} to ${{2}} ", " }} to 2 "},
-		{" ${{ env.KEYWITHNOTHING }} ", " valuewithnothing "},
-		{" ${{ env.KEY-WITH-HYPHENS }} ", " value-with-hyphens "},
-		{" ${{ env.KEY_WITH_UNDERSCORES }} ", " value_with_underscores "},
-		{"${{ secrets.CASE_INSENSITIVE_SECRET }}", "value"},
-		{"${{ secrets.case_insensitive_secret }}", "value"},
-		{"${{ vars.CASE_INSENSITIVE_VAR }}", "value"},
-		{"${{ vars.case_insensitive_var }}", "value"},
-		{"${{ env.UNKNOWN }}", ""},
-		{"${{ env.SOMETHING_TRUE }}", "true"},
-		{"${{ env.SOMETHING_FALSE }}", "false"},
-		{"${{ !env.SOMETHING_TRUE }}", "false"},
-		{"${{ !env.SOMETHING_FALSE }}", "false"},
-		{"${{ !env.SOMETHING_TRUE && true }}", "false"},
-		{"${{ !env.SOMETHING_FALSE && true }}", "false"},
-		{"${{ env.SOMETHING_TRUE && true }}", "true"},
-		{"${{ env.SOMETHING_FALSE && true }}", "true"},
-		{"${{ !env.SOMETHING_TRUE || true }}", "true"},
-		{"${{ !env.SOMETHING_FALSE || true }}", "true"},
-		{"${{ !env.SOMETHING_TRUE && false }}", "false"},
-		{"${{ !env.SOMETHING_FALSE && false }}", "false"},
-		{"${{ !env.SOMETHING_TRUE || false }}", "false"},
-		{"${{ !env.SOMETHING_FALSE || false }}", "false"},
-		{"${{ env.SOMETHING_TRUE || false }}", "true"},
-		{"${{ env.SOMETHING_FALSE || false }}", "false"},
-		{"${{ env.SOMETHING_FALSE }} && ${{ env.SOMETHING_TRUE }}", "false && true"},
-		{"${{ fromJSON('{}') < 2 }}", "false"},
-		{"${{ 1 }}", "1"},
-		{"${{ 1.0 }}", "1"},
-		{"${{ null }}", ""},
-		{"${{ fromJSON('[1,2]') }}", "Array"},
-		{"${{ fromJSON('{\"a\":1}') }}", "Object"},
-		// a malformed part must not restructure its neighbours, and it interpolates to nothing
-		{"${{ 1) && (2 }}", ""},
-		{"run ${{ 1) && (2 }} now", ""},
-		{"${{ 1", "${{ 1"},
-	}
-
-	for _, table := range tables {
-		t.Run("interpolate", func(t *testing.T) {
-			assertObject := assert.New(t)
-			out := ee.Interpolate(context.Background(), table.in)
-			assertObject.Equal(table.out, out, table.in)
-		})
-	}
-}
-
-func TestGetEvaluatorInputsBoolean(t *testing.T) {
-	workflows := map[string]string{
-		"workflow_call": `
-on:
-  workflow_call:
-    inputs:
-      flag:
-        type: boolean
-        default: true
-      name:
-        type: string
-        default: gitea
-`,
-		"workflow_dispatch": `
-on:
-  workflow_dispatch:
-    inputs:
-      flag:
-        type: boolean
-        default: true
-      name:
-        type: string
-        default: gitea
-`,
-	}
-
-	tables := []struct {
-		name  string
-		event map[string]any
-		flag  any
-	}{
-		{
-			// Gitea >= 1.27 resolves the inputs server-side and sends native JSON types
-			name:  "native bool true",
-			event: map[string]any{"inputs": map[string]any{"flag": true}},
-			flag:  true,
-		},
-		{
-			name:  "native bool false",
-			event: map[string]any{"inputs": map[string]any{"flag": false}},
-			flag:  false,
-		},
-		{
-			name:  "string true",
-			event: map[string]any{"inputs": map[string]any{"flag": "true"}},
-			flag:  true,
-		},
-		{
-			name:  "string false",
-			event: map[string]any{"inputs": map[string]any{"flag": "false"}},
-			flag:  false,
-		},
-		{
-			name:  "default is used when the event carries no inputs",
-			event: map[string]any{},
-			flag:  true,
-		},
-	}
-
-	for eventName, workflow := range workflows {
-		for _, table := range tables {
-			t.Run(eventName+"/"+table.name, func(t *testing.T) {
-				wf, err := model.ReadWorkflow(strings.NewReader(workflow))
-				require.NoError(t, err)
-
-				rc := &RunContext{
-					Config: &Config{Workdir: "."},
-					Run:    &model.Run{JobID: "job1", Workflow: wf},
-				}
-				ghc := &model.GithubContext{EventName: eventName, Event: table.event}
-
-				inputs := getEvaluatorInputs(context.Background(), rc, nil, ghc)
-				assert.Equal(t, table.flag, inputs["flag"])
-				assert.Equal(t, "gitea", inputs["name"])
-			})
-		}
-	}
-}
-
-func TestJobNameMasksSecrets(t *testing.T) {
-	workflow, err := model.ReadWorkflow(strings.NewReader(`
-jobs:
-  a:
-    name: deploy ${{ secrets.A }}
-  b:
-    name: deploy ${{ secrets.B }}
-`))
-	require.NoError(t, err)
-
-	runner := &runnerImpl{config: &Config{Secrets: map[string]string{"A": "s3cr3t-a", "B": "s3cr3t-b"}}}
-	containerName := func(jobID string) string {
-		rc := runner.newRunContext(t.Context(), &model.Run{JobID: jobID, Workflow: workflow}, nil)
-		assert.NotContains(t, rc.Name, "s3cr3t")
-		return rc.jobContainerName()
-	}
-
-	a, b := containerName("a"), containerName("b")
-	assert.NotContains(t, a, "s3cr3t") // it reaches the container name, which no log masker covers
-	assert.NotEqual(t, a, b)           // masking the name must not collapse two jobs onto one container
-}

act/runner/helpers_test.go

@@ -1,52 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"os/exec"
-	"runtime"
-	"testing"
-
-	"gitea.com/gitea/runner/act/container"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireLinuxDocker skips on non-Linux hosts. Some integration workflows need Docker features
-// that only a Linux daemon provides (host networking, host /proc bind mounts); Docker Desktop
-// on macOS/Windows does not, so those tests can only run on Linux.
-func requireLinuxDocker(t *testing.T) {
-	t.Helper()
-	if runtime.GOOS != "linux" {
-		t.Skip("skipping: requires a Linux Docker host")
-	}
-}
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := container.GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}
-
-// requireHostTools skips the test unless every named executable is on PATH. Used by the
-// self-hosted (host environment) suite, which runs steps directly on the host.
-func requireHostTools(t *testing.T, tools ...string) {
-	t.Helper()
-	for _, tool := range tools {
-		if _, err := exec.LookPath(tool); err != nil {
-			t.Skipf("skipping: required host tool %q not found: %v", tool, err)
-		}
-	}
-}

act/runner/job_executor.go

@@ -1,652 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json/v2"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"path"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-	"unicode"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-
-	"gitea.dev/actionslib/pkg/exprparser"
-	"gitea.dev/actionslib/pkg/model"
-)
-
-const maxJobSummaryBytes = 1024 * 1024
-
-// jobSummaryTruncationMarker is appended to a summary that exceeded the size limit
-// so the rendered output makes the truncation visible instead of silently cutting off.
-const jobSummaryTruncationMarker = "\n\n---\n\n*Job summary truncated: it exceeded the maximum allowed size.*\n"
-
-var (
-	jobSummaryUploadRetryDelay = time.Second
-	// jobSummaryUploadRequestTimeout bounds a single step upload request. It is kept
-	// below jobSummaryUploadPhaseTimeout so one slow or unreachable request times out
-	// and lets the remaining steps still upload within the phase budget, instead of a
-	// single stuck request consuming the whole phase.
-	jobSummaryUploadRequestTimeout = 5 * time.Second
-	// jobSummaryUploadPhaseTimeout bounds the total time spent uploading all step
-	// summaries. The uploads run inside the job cleanup budget that is also used to
-	// stop and remove the container, so a slow or unreachable endpoint must not be
-	// allowed to consume it; this keeps the remaining budget available for teardown.
-	jobSummaryUploadPhaseTimeout = 15 * time.Second
-)
-
-type jobInfo interface {
-	matrix() map[string]any
-	steps() []*model.Step
-	startContainer() common.Executor
-	stopContainer() common.Executor
-	closeContainer() common.Executor
-	interpolateOutputs() common.Executor
-	result(result string)
-}
-
-// reportStepError records a step error so the job is reported failed — except a
-// cancellation, which is an interruption, not a failure.
-func reportStepError(ctx context.Context, rc *RunContext, err error) {
-	if errors.Is(err, context.Canceled) {
-		// Defer to the job context: a genuine cancel reports cancelled, a stray teardown
-		// cancellation on a live ctx is ignored — never a step FAILURE.
-		rc.markInterrupted(ctx.Err())
-		return
-	}
-	common.Logger(ctx).Errorf("##[error]%s", EscapeCommandData(err.Error()))
-	common.SetJobError(ctx, err)
-	rc.markFailed()
-}
-
-// actionPreparer is implemented by steps that download an action before they run, so the job
-// executor can fetch all of them up front.
-type actionPreparer interface {
-	prepareActionExecutor() common.Executor
-	actionDownloadInfo() (reference, sha string, ok bool)
-}
-
-// printPrepareActions downloads every action the job uses before its first step runs and reports
-// them as actions/runner's "Prepare all required actions" section does. The steps still call
-// prepareActionExecutor themselves; it is a no-op once the action is resolved here.
-func printPrepareActions(rc *RunContext, preparers []actionPreparer) common.Executor {
-	return func(ctx context.Context) error {
-		if len(preparers) == 0 {
-			return nil
-		}
-
-		rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
-		rawLogger.Infof("Prepare all required actions")
-
-		for _, preparer := range preparers {
-			if err := preparer.prepareActionExecutor()(ctx); err != nil {
-				// No step has run yet, so the failure belongs to the job.
-				reportStepError(ctx, rc, err)
-				return err
-			}
-			reference, sha, ok := preparer.actionDownloadInfo()
-			if !ok {
-				continue
-			}
-			if sha == "" {
-				rawLogger.Infof("Download action repository '%s'", reference)
-			} else {
-				rawLogger.Infof("Download action repository '%s' (SHA:%s)", reference, sha)
-			}
-		}
-		return nil
-	}
-}
-
-// printCompleteJobName closes the setup section the way actions/runner ends its "Set up job" step.
-func printCompleteJobName(rc *RunContext) common.Executor {
-	return func(ctx context.Context) error {
-		// Name holds a matrix combination; JobName is the shared name GitHub reports.
-		name := rc.JobName
-		if name == "" {
-			name = rc.Name
-		}
-		if name == "" && rc.Run != nil {
-			name = rc.Run.JobID
-		}
-		common.Logger(ctx).WithField(rawOutputField, true).Infof("Complete job name: %s", name)
-		return nil
-	}
-}
-
-func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executor {
-	steps := make([]common.Executor, 0)
-	preSteps := make([]common.Executor, 0)
-	// Collected separately: every action is downloaded before the first pre step runs.
-	stepPreSteps := make([]common.Executor, 0)
-	preparers := make([]actionPreparer, 0)
-	var postExecutor common.Executor
-
-	steps = append(steps, func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		if len(info.matrix()) > 0 {
-			logger.Infof("Matrix: %v", info.matrix())
-		}
-		return nil
-	})
-
-	infoSteps := info.steps()
-
-	if len(infoSteps) == 0 {
-		return common.NewDebugExecutor("No steps found")
-	}
-
-	preSteps = append(preSteps, func(ctx context.Context) error {
-		// Have to be skipped for some Tests
-		if rc.Run == nil {
-			return nil
-		}
-		rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-		// evaluate environment variables since they can contain
-		// GitHub's special environment variables.
-		for k, v := range rc.GetEnv() {
-			rc.Env[k] = rc.ExprEval.Interpolate(ctx, v)
-		}
-		return nil
-	})
-
-	for i, stepModel := range infoSteps {
-		if stepModel == nil {
-			return func(ctx context.Context) error {
-				return fmt.Errorf("invalid Step %v: missing run or uses key", i)
-			}
-		}
-		if stepModel.ID == "" {
-			stepModel.ID = strconv.Itoa(i)
-		}
-		stepModel.Number = i
-
-		step, err := sf.newStep(stepModel, rc)
-		if err != nil {
-			return common.NewErrorExecutor(err)
-		}
-
-		if preparer, ok := step.(actionPreparer); ok {
-			preparers = append(preparers, preparer)
-		}
-
-		stepIdx := stepModel.Number
-		preExec := step.pre()
-		stepPreSteps = append(stepPreSteps, useStepLogger(rc, stepModel, stepStagePre, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
-			preErr := preExec(ctx)
-			if preErr != nil {
-				reportStepError(ctx, rc, preErr)
-			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
-			}
-			return preErr
-		}))
-
-		stepExec := step.main()
-		steps = append(steps, useStepLogger(rc, stepModel, stepStageMain, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
-			err := stepExec(ctx)
-			if err != nil {
-				reportStepError(ctx, rc, err)
-			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
-			}
-			return nil
-		}))
-
-		postFn := step.post()
-		postExec := useStepLogger(rc, stepModel, stepStagePost, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
-			err := postFn(ctx)
-			if err != nil {
-				reportStepError(ctx, rc, err)
-			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
-			}
-			return err
-		})
-		if postExecutor != nil {
-			// run the post executor in reverse order
-			postExecutor = postExec.Finally(postExecutor)
-		} else {
-			postExecutor = postExec
-		}
-	}
-
-	// The setup section of the job log. The started hook goes first, so what it sets up is
-	// in place for the first action download and the first step.
-	preSteps = append(preSteps, rc.runJobStartedHook)
-	preSteps = append(preSteps, printPrepareActions(rc, preparers))
-	preSteps = append(preSteps, stepPreSteps...)
-	preSteps = append(preSteps, printCompleteJobName(rc))
-
-	// Ahead of the teardown below, while the job environment is still up.
-	postExecutor = postExecutor.Finally(rc.runJobCompletedHook)
-	postExecutor = postExecutor.Finally(func(ctx context.Context) error {
-		// swallowed: a bad output fails this job, it must not abandon the rest of the plan
-		if err := info.interpolateOutputs()(ctx); err != nil {
-			reportStepError(ctx, rc, err)
-		}
-		return nil
-	})
-
-	postExecutor = postExecutor.Finally(func(ctx context.Context) error {
-		jobError := common.JobError(ctx)
-		var err error
-		// always allow 1 min for stopping and removing the runner, even if we were cancelled
-		ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
-		defer cancel()
-
-		logger := common.Logger(ctx)
-		tryUploadJobSummary(ctx, rc)
-		logger.Infof("Cleaning up container for job %s", rc.JobName)
-		if err = info.stopContainer()(ctx); err != nil {
-			logger.Errorf("##[error]%s", EscapeCommandData("Error while stop job container: "+err.Error()))
-		}
-		setJobResult(ctx, info, rc, jobError == nil)
-		setJobOutputs(ctx, rc)
-
-		return err
-	})
-
-	stepsExecutor := newStepsExecutor(rc, preSteps, steps)
-
-	return common.NewPipelineExecutor(info.startContainer(), stepsExecutor.
-		Finally(func(ctx context.Context) error {
-			// Record an interrupt (backstop for interrupts that land outside the main
-			// step loop) so the post steps observe the cancelled/failed job status.
-			rc.markInterrupted(ctx.Err())
-			postCtx, cancel := postStepsContext(ctx)
-			defer cancel()
-			return postExecutor(postCtx)
-		}).
-		Finally(info.closeContainer()))
-}
-
-// postStepsContext derives the context used to run the job's post/cleanup steps from the
-// finished main-pipeline context. Cleanup has to run even when the run was interrupted, so the
-// returned context always carries a fresh bounded deadline and is never itself cancelled.
-//
-//   - context.Canceled (server cancel): detach from the cancelled context via a fresh root so
-//     the post steps can run.
-//   - context.DeadlineExceeded (job timeout): detach the deadline with WithoutCancel, which
-//     keeps the original values — including the job-error container — so the timeout failure and
-//     any post-step error are preserved and the job is still reported as failed.
-//   - otherwise: run on the live context unchanged.
-func postStepsContext(ctx context.Context) (context.Context, context.CancelFunc) {
-	switch ctx.Err() {
-	case context.Canceled:
-		// The cancelled context is abandoned for a fresh root, which drops the job-error
-		// container installed at the job root. Re-attach a fresh one so a failing post step
-		// records its error via SetJobError instead of panicking on a nil container.
-		return context.WithTimeout(common.WithJobErrorContainer(common.WithLogger(context.Background(), common.Logger(ctx))), 5*time.Minute)
-	case context.DeadlineExceeded:
-		return context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	default:
-		return ctx, func() {}
-	}
-}
-
-// newStepsExecutor sequences the job's pre steps and main steps.
-//
-// The pre steps run as a normal pipeline that short-circuits on the first failure or
-// cancellation. The main-steps executor then runs unconditionally — even if a pre step failed
-// or the job was interrupted — so always()/cancelled()/failure() main steps still run, mirroring
-// GitHub Actions. This is safe because each main step re-evaluates its own `if` (a pre-step
-// failure flips the expression job status to failure, so success()-default steps skip) and
-// newMainStepsExecutor detaches from an interrupted context before running the remaining steps.
-//
-// A pre-step failure or interrupt is still propagated so the job is reported with the correct
-// conclusion; the pre error takes precedence since it happened first.
-func newStepsExecutor(rc *RunContext, preSteps, steps []common.Executor) common.Executor {
-	preExecutor := common.NewPipelineExecutor(preSteps...)
-	mainExecutor := newMainStepsExecutor(rc, steps)
-	return func(ctx context.Context) error {
-		preErr := preExecutor(ctx)
-		mainErr := mainExecutor(ctx)
-		if preErr != nil {
-			return preErr
-		}
-		return mainErr
-	}
-}
-
-// newMainStepsExecutor runs the job's main-stage step executors in order. Unlike a plain
-// pipeline, an interruption (context.Canceled from a server cancel, or context.DeadlineExceeded
-// from the job timeout) does not abandon the remaining steps: it marks the job cancelled when
-// appropriate and keeps iterating under a fresh, bounded context so steps whose `if` still
-// evaluates true — always() and cancelled() — run for cleanup, mirroring GitHub Actions. Steps
-// that default to success() skip themselves because success() is false once the job is no longer
-// successful. The main-step wrappers report their own errors and return nil, so the loop drives
-// step ordering off the context, not return values.
-func newMainStepsExecutor(rc *RunContext, steps []common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		for i, step := range steps {
-			if ctx.Err() != nil {
-				return runMainStepsAfterInterrupt(ctx, rc, steps[i:])
-			}
-			_ = step(ctx)
-		}
-		// An interrupt can land during the final step, after the loop's last context
-		// check; record it so the post steps still observe the cancelled/failed status.
-		rc.markInterrupted(ctx.Err())
-		return nil
-	}
-}
-
-// runMainStepsAfterInterrupt runs the remaining main steps after the job context was cancelled or
-// timed out. It detaches from the interrupted context (keeping its values: logger and job error)
-// and applies a fresh deadline so always()/cancelled() steps run to completion. The original
-// interrupt error is returned so callers up the chain still see the job as cancelled/timed out.
-func runMainStepsAfterInterrupt(ctx context.Context, rc *RunContext, steps []common.Executor) error {
-	interruptErr := ctx.Err()
-	rc.markInterrupted(interruptErr)
-	freshCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	defer cancel()
-	for _, step := range steps {
-		_ = step(freshCtx)
-	}
-	return interruptErr
-}
-
-func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success bool) {
-	logger := common.Logger(ctx)
-
-	// Matrix combinations share one *model.Job and run in parallel; serialize the
-	// read-modify-write of the job result so a failing combination is not lost-updated by a
-	// concurrent succeeding one.
-	job := rc.Run.Job()
-	var continueOnError bool
-	if !success && !rc.jobCancelled {
-		// Use a fresh context so an expired job timeout cannot block expression evaluation.
-		evalCtx := common.WithLogger(context.Background(), common.Logger(ctx))
-		continueOnError = evaluateJobContinueOnError(evalCtx, rc, job)
-	}
-	jobResult := func() string {
-		defer lockJob(job)()
-		result := "success"
-		// we have only one result for a whole matrix build, so we need
-		// to keep an existing result state if we run a matrix
-		if len(info.matrix()) > 0 && job.Result != "" {
-			result = job.Result
-		}
-		// cancelled is sticky, so a sibling combination finishing last cannot mask it
-		switch {
-		case rc.jobCancelled:
-			result = "cancelled"
-		case !success && result != "cancelled":
-			result = "failure"
-			job.SetContinueOnError(continueOnError)
-		}
-		info.result(result)
-		return result
-	}()
-
-	if rc.caller != nil {
-		// set reusable workflow job result
-		rc.caller.setReusedWorkflowJobResult(rc.Run.JobID, jobResult) // For Gitea
-		return
-	}
-
-	jobResultMessage := "failed"
-	switch jobResult {
-	case "success":
-		jobResultMessage = "succeeded"
-	case "cancelled":
-		jobResultMessage = "cancelled"
-	}
-
-	logger.WithField("jobResult", jobResult).Infof("Job %s", jobResultMessage)
-}
-
-func setJobOutputs(ctx context.Context, rc *RunContext) {
-	if rc.caller != nil {
-		// map outputs for reusable workflows
-		callerOutputs := make(map[string]string)
-
-		ee := rc.NewExpressionEvaluator(ctx)
-
-		for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs {
-			callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value))
-		}
-
-		// Matrix combinations of a reusable-workflow caller share the caller's *model.Job;
-		// serialize the write so parallel combos don't race on its Outputs field.
-		callerJob := rc.caller.runContext.Run.Job()
-		defer lockJob(callerJob)()
-		callerJob.Outputs = callerOutputs
-	}
-}
-
-// applyJobTimeout applies the job-level timeout-minutes to ctx, mirroring the
-// step-level evaluateStepTimeout in step.go.
-func applyJobTimeout(ctx context.Context, rc *RunContext, job *model.Job) (context.Context, context.CancelFunc) {
-	timeout := rc.ExprEval.Interpolate(ctx, job.TimeoutMinutes)
-	if timeout != "" {
-		if timeoutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil {
-			return context.WithTimeout(ctx, time.Duration(timeoutMinutes)*time.Minute)
-		}
-	}
-	return ctx, func() {}
-}
-
-// evaluateJobContinueOnError evaluates the job-level continue-on-error expression.
-func evaluateJobContinueOnError(ctx context.Context, rc *RunContext, job *model.Job) bool {
-	expr := strings.TrimSpace(job.RawContinueOnError)
-	if expr == "" {
-		return false
-	}
-	continueOnError, err := EvalBool(ctx, rc.NewExpressionEvaluator(ctx), expr, exprparser.DefaultStatusCheckNone)
-	if err != nil {
-		common.Logger(ctx).Warnf("continue-on-error expression %q evaluation failed: %v", expr, err)
-		return false
-	}
-	return continueOnError
-}
-
-func tryUploadJobSummary(ctx context.Context, rc *RunContext) {
-	if rc == nil || rc.JobContainer == nil || rc.Config == nil {
-		return
-	}
-	// Bound the whole upload phase so a slow or unreachable endpoint cannot consume
-	// the job cleanup budget reserved for stopping and removing the container.
-	ctx, cancel := context.WithTimeout(ctx, jobSummaryUploadPhaseTimeout)
-	defer cancel()
-	env := rc.GetEnv()
-	caps := strings.TrimSpace(env["GITEA_ACTIONS_CAPABILITIES"])
-	if !hasJobSummaryCapability(caps) {
-		// Server did not advertise support. Do not attempt upload.
-		return
-	}
-	runtimeURL := strings.TrimSpace(env["ACTIONS_RUNTIME_URL"])
-	runtimeToken := strings.TrimSpace(env["ACTIONS_RUNTIME_TOKEN"])
-	runID := strings.TrimSpace(env["GITEA_RUN_ID"])
-	if runtimeURL == "" || runtimeToken == "" || runID == "" {
-		return
-	}
-	if rc.Run == nil || rc.Run.Job() == nil {
-		return
-	}
-	// The numeric ActionRunJob ID is not exposed in the proto Task message or task context,
-	// but the server signs it into the ACTIONS_RUNTIME_TOKEN JWT claims. We decode the
-	// unverified claims to retrieve it; the server re-verifies the token on the request.
-	jobID := extractJobIDFromRuntimeToken(runtimeToken)
-	if jobID <= 0 {
-		return
-	}
-
-	base := strings.TrimRight(runtimeURL, "/") + "/_apis/pipelines/workflows/" + runID +
-		"/jobs/" + strconv.FormatInt(jobID, 10) + "/steps/"
-	actPath := rc.JobContainer.GetActPath()
-	// Reuse a single client across all step uploads so connections can be pooled.
-	client := &http.Client{Timeout: jobSummaryUploadRequestTimeout}
-	for i := range rc.Run.Job().Steps {
-		summaryPath := path.Join(actPath, "workflow", "step-summary-"+strconv.Itoa(i)+".md")
-		body, ok := readSingleFileFromContainerArchive(ctx, rc.JobContainer, summaryPath, maxJobSummaryBytes)
-		if !ok || len(body) == 0 {
-			continue
-		}
-		// Gitea renders summaries on the run page, so mask before the upload.
-		uploadJobSummary(ctx, client, base+strconv.Itoa(i)+"/summary", runtimeToken, []byte(rc.maskSecrets(string(body))))
-	}
-}
-
-// extractJobIDFromRuntimeToken returns the JobID claim from an ACTIONS_RUNTIME_TOKEN JWT
-// without verifying its signature. Returns 0 if the token is unparseable or has no JobID.
-func extractJobIDFromRuntimeToken(token string) int64 {
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return 0
-	}
-	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
-	if err != nil {
-		return 0
-	}
-	var claims struct {
-		JobID int64 `json:"JobID"`
-	}
-	if err := json.Unmarshal(payload, &claims); err != nil {
-		return 0
-	}
-	return claims.JobID
-}
-
-func hasJobSummaryCapability(caps string) bool {
-	return slices.Contains(strings.FieldsFunc(caps, func(r rune) bool {
-		return r == ',' || unicode.IsSpace(r)
-	}), "job-summary")
-}
-
-func uploadJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) {
-	logger := common.Logger(ctx)
-
-	var lastStatus int
-	var lastErr error
-	for attempt := 0; attempt < 2; attempt++ {
-		status, err := putJobSummary(ctx, client, url, runtimeToken, body)
-		if err == nil && status/100 == 2 {
-			return
-		}
-		lastStatus = status
-		lastErr = err
-		if attempt == 1 || !isTransientJobSummaryUploadFailure(status, err) {
-			break
-		}
-		timer := time.NewTimer(jobSummaryUploadRetryDelay)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			lastErr = ctx.Err()
-			attempt = 1
-		case <-timer.C:
-		}
-	}
-
-	// Best-effort only; do not fail job, but log because capability was advertised.
-	if lastErr != nil {
-		logger.WithError(lastErr).Warn("job summary upload failed")
-		return
-	}
-	logger.Warnf("job summary upload failed: status=%d", lastStatus)
-}
-
-func putJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) (int, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(body))
-	if err != nil {
-		return 0, err
-	}
-	req.Header.Set("Authorization", "Bearer "+runtimeToken)
-	req.Header.Set("Content-Type", "text/markdown; charset=utf-8")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return 0, err
-	}
-	defer resp.Body.Close()
-	_, _ = io.Copy(io.Discard, resp.Body)
-	return resp.StatusCode, nil
-}
-
-func isTransientJobSummaryUploadFailure(status int, err error) bool {
-	return err != nil || status == http.StatusRequestTimeout || status == http.StatusTooManyRequests || status/100 == 5
-}
-
-func readSingleFileFromContainerArchive(ctx context.Context, env container.ExecutionsEnvironment, p string, maxBytes int64) ([]byte, bool) {
-	rc, err := env.GetContainerArchive(ctx, p)
-	if err != nil {
-		return nil, false
-	}
-	defer rc.Close()
-
-	tr := tar.NewReader(rc)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			return nil, false
-		}
-		if err != nil {
-			return nil, false
-		}
-		if header.Typeflag != tar.TypeReg {
-			continue
-		}
-		if !archiveEntryMatchesPath(header.Name, p) {
-			continue
-		}
-		// Summaries larger than the limit are truncated rather than dropped, so the
-		// user still gets the leading content (mirroring how GitHub caps oversized
-		// step summaries instead of discarding them). Read one extra byte so an
-		// over-limit file is detected from the actual stream rather than trusting
-		// header.Size, then cap the returned content at maxBytes.
-		b, err := io.ReadAll(io.LimitReader(tr, maxBytes+1))
-		if err != nil {
-			return nil, false
-		}
-		if int64(len(b)) > maxBytes {
-			// Reserve room for the marker so the marked-up result still fits in maxBytes.
-			marker := []byte(jobSummaryTruncationMarker)
-			keep := max(maxBytes-int64(len(marker)), 0)
-			b = append(b[:keep], marker...)
-			common.Logger(ctx).Warnf("job summary truncated: path=%s max=%d", p, maxBytes)
-		}
-		return b, true
-	}
-}
-
-func archiveEntryMatchesPath(entryName, requestedPath string) bool {
-	entryName = path.Clean(strings.TrimPrefix(entryName, "/"))
-	requestedPath = path.Clean(strings.TrimPrefix(requestedPath, "/"))
-	return entryName == requestedPath || entryName == path.Base(requestedPath)
-}
-
-func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		ctx = withStepLogger(ctx, stepModel.Number, stepModel.ID, rc.ExprEval.Interpolate(ctx, stepModel.String()), stage.String())
-
-		logWriter := rc.commandLogWriter(ctx)
-
-		oldout, olderr := rc.JobContainer.ReplaceLogWriter(logWriter, logWriter)
-		defer rc.JobContainer.ReplaceLogWriter(oldout, olderr)
-
-		// Flush any buffered, not-yet-newline-terminated trailing line once the
-		// step has finished, so the final line of the step's output is not lost
-		// when it is not newline-terminated.
-		defer common.FlushWriter(logWriter)
-
-		return executor(ctx)
-	}
-}