fix: follow the act move in the paths outside Go code

`make test-dind` runs a hardcoded package path, and the `.gitignore`
negation for the test secrets fixture stopped matching.

Assisted-by: Codet:GPT-5.1-Codex

.gitea/workflows/test.yml

@@ -24,7 +24,7 @@ jobs:
           check-latest: true
       - name: prepare anonymous docker config
         run: mkdir -p "$DOCKER_CONFIG" && echo '{}' > "$DOCKER_CONFIG/config.json"
-      # Pre-pull act/runner's two largest base images so a slow pull can't dominate `make test`;
+      # Pre-pull internal/act/runner's two largest base images so a slow pull can't dominate `make test`;
       # the rest (alpine/ubuntu) pull on demand, absorbed by the make-test -timeout. The host
       # daemon retains them between runs, so this is usually a fast manifest re-check.
       - name: pre-pull test images
@@ -48,4 +48,4 @@ jobs:
       - name: coverage report
         run: |
           make coverage-report
-          cat .tmp/coverage.md >> "$GITHUB_STEP_SUMMARY"
+          cat .tmp/coverage.md >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -1,6 +1,6 @@
 /gitea-runner
 .env
-!/act/runner/testdata/secrets/.env
+!/internal/act/runner/testdata/secrets/.env
 .runner
 .runner.lock
 coverage.txt
@@ -14,4 +14,4 @@ coverage.txt
 __debug_bin
 # gorelease binary folder
 /dist
-.DS_Store
+.DS_Store

internal/act/runner/action_cache_test.go

@@ -31,7 +31,7 @@ func runGit(t *testing.T, dir string, args ...string) {
 	}
 	cmd := exec.Command("git", args...)
 	// Fixed identity and host-config isolation so commits succeed offline regardless of the
-	// host's git config (mirrors gitCmd in act/common/git).
+	// host's git config (mirrors gitCmd in internal/act/common/git).
 	cmd.Env = append(os.Environ(),
 		"GIT_AUTHOR_NAME=test", "[email protected]",
 		"GIT_COMMITTER_NAME=test", "[email protected]",

internal/app/run/runner.go

@@ -216,7 +216,7 @@ func isTaskIDDir(name string) bool {
 
 // isHostScratchDir reports whether name is a per-job host-mode scratch dir:
 // hex.EncodeToString of 8 random bytes, i.e. exactly 16 lowercase hex chars
-// (see startHostEnvironment in act/runner/run_context.go). The narrow match
+// (see startHostEnvironment in internal/act/runner/run_context.go). The narrow match
 // leaves the sibling shared "tool_cache" dir and any operator data untouched.
 func isHostScratchDir(name string) bool {
 	if len(name) != 16 {
@@ -557,7 +557,7 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 }
 
 // patchToolkit reports whether act should edit the toolkit bundled into an action. It follows the
-// cache URL, because that is what the edits point the client at; see act/runner/toolkit_patch.go.
+// cache URL, because that is what the edits point the client at; see internal/act/runner/toolkit_patch.go.
 func (r *Runner) patchToolkit() bool {
 	return r.envs["ACTIONS_CACHE_URL"] != "" && (r.cfg.Cache.V2 == nil || *r.cfg.Cache.V2)
 }

scripts/test-dind.sh

@@ -25,7 +25,7 @@ case "${1:-}" in
   dind|dind-rootless) target="$1"; shift ;;
 esac
 [ "${1:-}" = "--" ] && shift
-[ $# -eq 0 ] && set -- -race -run '^TestDocker$|^TestDockerCopyToSymlinkPath$' ./act/container/
+[ $# -eq 0 ] && set -- -race -run '^TestDocker$|^TestDockerCopyToSymlinkPath$' ./internal/act/container/
 
 port="${DIND_TEST_PORT:-32375}"
 name="gitea-runner-dind-test-$$"