mirror of
https://gitea.com/gitea/runner.git
synced 2026-08-27 22:37:46 +00:00
12dc9d26a2
Fixes 51 bugs discovered via comparison with `actions/runner`. Every fix has test coverage.
### Secrets
- A short secret registered no shifted-base64 form, so `base64("user:$TOKEN")` printed in the clear
- Encoded forms came only from the whole trimmed value, missing padded and per-line spellings
- Masks split only on `\n`, so `::add-mask::a%0Db` registered neither half
- Adds XML, expression-string and quote-trimming encoders
### Workflow commands
- Split at the last `::` or `]` rather than the first, so `::add-mask::a::b` registered no mask
- A command on the last line without a newline was ignored, and `::ADD-MASK::` did nothing
- `##[...]` did not decode `%3B`/`%5D`, properties lost anything after a second `=`
- `$GITHUB_ENV` and `::set-env::` now refuse `NODE_OPTIONS`
### Status
- `continue-on-error` reported failed, a cancelled job reported success, an `if:` error reported cancelled
- File commands ran after `continue-on-error`, failing the job while the step stayed green
- A bad job output aborted the whole run instead of that job
### Steps and actions
- `${{ matrix.* }}` and `${{ strategy.* }}` were empty inside composite actions
- Composite inputs leaked into nested actions as `INPUT_*`, `with:` matched case-sensitively, `pre` failures were dropped
- Docker actions dropped `runs.env` when the caller passed `with: args:`, and caller `args`/`entrypoint` beat the manifest
- An implicit shell ran with `pipefail`, a `shell:` without `{0}` passed without running
- `container.env` overrode job env and every `$GITHUB_ENV` write, heredocs lost leading blank lines, `$GITHUB_PATH` was not BOM-decoded
Written by Claude Opus 5.
Reviewed-on: https://gitea.com/gitea/runner/pulls/1194
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
184 lines
5.4 KiB
Go
184 lines
5.4 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// Copyright 2022 The nektos/act Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package runner
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
|
|
"gitea.com/gitea/runner/act/container"
|
|
|
|
"gitea.dev/actionslib/pkg/model"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/mock"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type shellContainerMock struct{ *containerMock }
|
|
|
|
func (*shellContainerMock) ReplaceLogWriter(_, _ io.Writer) (io.Writer, io.Writer) { return nil, nil }
|
|
|
|
func TestStepRun(t *testing.T) {
|
|
cm := &containerMock{}
|
|
fileEntry := &container.FileEntry{
|
|
Name: "workflow/1.sh",
|
|
Mode: 0o755,
|
|
Body: "\ncmd\n",
|
|
}
|
|
|
|
sr := &stepRun{
|
|
RunContext: &RunContext{
|
|
StepResults: map[string]*model.StepResult{},
|
|
ExprEval: &expressionEvaluator{},
|
|
Config: &Config{},
|
|
Run: &model.Run{
|
|
JobID: "1",
|
|
Workflow: &model.Workflow{
|
|
Jobs: map[string]*model.Job{
|
|
"1": {
|
|
Defaults: model.Defaults{
|
|
Run: model.RunDefaults{
|
|
Shell: "bash",
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
JobContainer: cm,
|
|
},
|
|
Step: &model.Step{
|
|
ID: "1",
|
|
Run: "cmd",
|
|
WorkingDirectory: "workdir",
|
|
},
|
|
}
|
|
|
|
cm.On("Copy", "/var/run/act", []*container.FileEntry{fileEntry}).Return(noopExecutor)
|
|
cm.On("Exec", []string{"bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "/var/run/act/workflow/1.sh"}, mock.AnythingOfType("map[string]string"), "", "workdir").Return(noopExecutor)
|
|
|
|
cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(noopExecutor)
|
|
|
|
cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(noopExecutor)
|
|
|
|
cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(noopExecutor)
|
|
|
|
cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(noopExecutor)
|
|
|
|
ctx := context.Background()
|
|
|
|
cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
|
|
|
|
err := sr.main()(ctx)
|
|
assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
|
|
|
|
cm.AssertExpectations(t)
|
|
}
|
|
|
|
func TestStepRunShellParity(t *testing.T) {
|
|
tests := []struct {
|
|
name, shell, workingDir string
|
|
env map[string]string
|
|
host bool
|
|
probeErr error
|
|
wantExt string
|
|
wantCmd []string
|
|
wantErr string
|
|
}{
|
|
{
|
|
name: "implicit host bash",
|
|
host: true,
|
|
wantCmd: []string{"bash", "-e", "/var/run/act/workflow/1.sh"},
|
|
},
|
|
{
|
|
name: "implicit container bash",
|
|
wantCmd: []string{"bash", "-e", "/var/run/act/workflow/1.sh"},
|
|
},
|
|
{
|
|
name: "implicit container sh fallback",
|
|
probeErr: assert.AnError,
|
|
wantCmd: []string{"sh", "-e", "/var/run/act/workflow/1.sh"},
|
|
},
|
|
{
|
|
name: "custom pwsh template",
|
|
shell: "pwsh -NoProfile -File {0}",
|
|
wantExt: ".ps1",
|
|
wantCmd: []string{"pwsh", "-NoProfile", "-File", "/var/run/act/workflow/1.ps1"},
|
|
},
|
|
{
|
|
name: "missing placeholder",
|
|
shell: "bash -e",
|
|
wantErr: `invalid shell option "bash -e": format must contain {0}`,
|
|
},
|
|
{
|
|
name: "all placeholders",
|
|
shell: "bash -c '. {0}; . {0}'",
|
|
wantCmd: []string{"bash", "-c", ". /var/run/act/workflow/1.sh; . /var/run/act/workflow/1.sh"},
|
|
},
|
|
{
|
|
name: "step env expressions",
|
|
shell: "${{ env.SHELL }}",
|
|
workingDir: "${{ env.DIR }}",
|
|
env: map[string]string{"SHELL": "python {0}", "DIR": "subdir"},
|
|
wantExt: ".py",
|
|
wantCmd: []string{"python", "/var/run/act/workflow/1.py"},
|
|
},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
cm := &containerMock{}
|
|
var jobContainer container.ExecutionsEnvironment = &shellContainerMock{cm}
|
|
if test.host {
|
|
if runtime.GOOS == "windows" {
|
|
t.Skip("Linux host shell selection")
|
|
}
|
|
test.env = map[string]string{"PATH": t.TempDir()}
|
|
require.NoError(t, os.WriteFile(filepath.Join(test.env["PATH"], "bash"), nil, 0o755))
|
|
jobContainer = &container.HostEnvironment{ActPath: "/var/run/act"}
|
|
} else if test.shell == "" {
|
|
cm.On("Exec", []string{"sh", "-c", "command -v bash >/dev/null 2>&1"},
|
|
mock.AnythingOfType("map[string]string"), "", "").Return(func(context.Context) error {
|
|
return test.probeErr
|
|
})
|
|
}
|
|
|
|
sr := &stepRun{
|
|
RunContext: &RunContext{
|
|
Config: &Config{},
|
|
Run: &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
|
|
JobContainer: jobContainer,
|
|
},
|
|
Step: &model.Step{ID: "1", Run: "echo hi", Shell: test.shell, WorkingDirectory: test.workingDir},
|
|
env: test.env,
|
|
}
|
|
|
|
name, script, err := sr.setupShellCommand(t.Context())
|
|
if test.wantErr != "" {
|
|
require.EqualError(t, err, test.wantErr)
|
|
return
|
|
}
|
|
require.NoError(t, err)
|
|
if test.wantExt == "" {
|
|
test.wantExt = ".sh"
|
|
}
|
|
wantScript := "\necho hi\n"
|
|
if test.wantExt == ".ps1" {
|
|
wantScript = "$ErrorActionPreference = 'stop'\necho hi\nif ((Test-Path -LiteralPath variable:/LASTEXITCODE)) { exit $LASTEXITCODE }"
|
|
}
|
|
assert.Equal(t, "workflow/1"+test.wantExt, name)
|
|
assert.Equal(t, wantScript, script)
|
|
assert.Equal(t, test.wantCmd, sr.cmd)
|
|
assert.Equal(t, test.env["DIR"], sr.WorkingDirectory)
|
|
cm.AssertExpectations(t)
|
|
})
|
|
}
|
|
}
|