fix: drop action outputs whose value exceeds the size limit (#1070)

`SetOutputs` logged "ignore output because the value is too long" for values
larger than 1 MiB but then fell through and stored the value anyway, sending
it upstream via `UpdateTask`. The key-too-long branch directly above correctly
skips oversized keys with `continue`; this adds the same `continue` to the
value branch so the size guard is actually enforced and the log message
matches the behavior.

Adds regression coverage in `TestReporter_SetOutputs` for an oversized value
(dropped) and a value at exactly the 1 MiB limit (retained).

---------

Co-authored-by: Zettat123 <39446+zettat123@noreply.gitea.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1070
Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>

go.mod

@@ -39,7 +39,7 @@ require (
 	go.etcd.io/bbolt v1.5.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
 	golang.org/x/sys v0.47.0
-	golang.org/x/term v0.44.0
+	golang.org/x/term v0.45.0
 	google.golang.org/protobuf v1.36.11
 	gotest.tools/v3 v3.5.2
 	tags.cncf.io/container-device-interface v1.1.0

go.sum

@@ -267,6 +267,8 @@ golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
 golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=

internal/pkg/report/reporter.go

@@ -26,6 +26,12 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
+// Size limits for the outputs reported to the server.
+const (
+	maxOutputKeyLen   = 255
+	maxOutputValueLen = 1024 * 1024 // 1 MiB
+)
+
 type Reporter struct {
 	ctx    context.Context
 	cancel context.CancelFunc
@@ -390,13 +396,15 @@ func (r *Reporter) SetOutputs(outputs map[string]string) {
 	defer r.stateMu.Unlock()
 
 	for k, v := range outputs {
-		if len(k) > 255 {
-			r.logf("ignore output because the key is too long: %q", k)
+		if l := len(k); l > maxOutputKeyLen {
+			log.Warnf("ignore output %q because the key is too long: %d > %d", k, l, maxOutputKeyLen)
+			r.logf("ignore output %q because the key is too long: %d > %d", k, l, maxOutputKeyLen)
 			continue
 		}
-		if l := len(v); l > 1024*1024 {
-			log.Println("ignore output because the value is too long:", k, l)
-			r.logf("ignore output because the value %q is too long: %d", k, l)
+		if l := len(v); l > maxOutputValueLen {
+			log.Warnf("ignore output %q because the value is too long: %d > %d", k, l, maxOutputValueLen)
+			r.logf("ignore output %q because the value is too long: %d > %d", k, l, maxOutputValueLen)
+			continue
 		}
 		if _, ok := r.outputs.Load(k); ok {
 			continue

internal/pkg/report/reporter_test.go

@@ -1020,11 +1020,24 @@ func TestReporter_SetOutputs(t *testing.T) {
 	got, _ = r.outputs.Load("foo")
 	assert.Equal(t, "bar", got)
 
-	// keys longer than 255 chars are dropped
-	longKey := strings.Repeat("k", 256)
+	// keys longer than maxOutputKeyLen are dropped
+	longKey := strings.Repeat("k", maxOutputKeyLen+1)
 	r.SetOutputs(map[string]string{longKey: "v"})
 	_, ok = r.outputs.Load(longKey)
 	assert.False(t, ok)
+
+	// values longer than maxOutputValueLen are dropped
+	longValue := strings.Repeat("v", maxOutputValueLen+1)
+	r.SetOutputs(map[string]string{"big": longValue})
+	_, ok = r.outputs.Load("big")
+	assert.False(t, ok)
+
+	// a value at exactly the limit is still stored
+	maxValue := strings.Repeat("v", maxOutputValueLen)
+	r.SetOutputs(map[string]string{"atlimit": maxValue})
+	got, ok = r.outputs.Load("atlimit")
+	require.True(t, ok)
+	assert.Len(t, got, maxOutputValueLen)
 }
 
 func TestReporter_EffectiveCloseTimeout(t *testing.T) {