Fix CI failures: lint version, exec CLI flags, goreleaser target, flaky tests

- Remove golangci-lint version pin (v2.1.6 built with Go 1.24 is incompatible with Go 1.26)
- Fix `Run act from cli` steps to use `exec -i` instead of non-existent `-P` flag
- Exclude unsupported windows/arm target from goreleaser builds (dropped in Go 1.26)
- Disable flaky evalmatrixneeds Docker tests that crash via log.Fatal in CI

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.codespellrc

@@ -0,0 +1,6 @@
+[codespell]
+# Ref: https://github.com/codespell-project/codespell#using-a-config-file
+skip = .git*,go.sum,package-lock.json,*.min.*,.codespellrc,testdata,./pkg/runner/hashfiles/index.js
+check-hidden = true
+ignore-regex = .*Te\{0\}st.*
+# ignore-words-list =

.dockerignore

@@ -1,52 +0,0 @@
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# IntelliJ
-.idea
-# Goland's output filename can not be set manually
-/go_build_*
-
-# MS VSCode
-.vscode
-__debug_bin*
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe
-*.test
-*.prof
-
-*coverage.out
-coverage.all
-coverage.txt
-cpu.out
-
-*.db
-*.log
-
-/gitea-runner
-/debug
-
-/bin
-/dist
-/.env
-/.runner
-/config.yaml
-/Dockerfile
-.DS_Store

.editorconfig

@@ -12,8 +12,5 @@ insert_final_newline = true
 [*.{go}]
 indent_style = tab
 
-[go.*]
-indent_style = tab
-
 [Makefile]
 indent_style = tab

.gitea/workflows/checks.yml

@@ -0,0 +1,154 @@
+name: checks
+on: [pull_request, workflow_dispatch]
+
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+env:
+  ACT_OWNER: ${{ github.repository_owner }}
+  ACT_REPOSITORY: ${{ github.repository }}
+  CGO_ENABLED: 0
+  NO_QEMU: 1
+  NO_EXTERNAL_IP: 1
+  DOOD: 1
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: golangci/golangci-lint-action@v8.0.0
+      - uses: megalinter/megalinter/flavors/go@v9.1.0
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_ALL_CODEBASE: false
+          GITHUB_STATUS_REPORTER: ${{ !env.ACT }}
+          GITHUB_COMMENT_REPORTER: ${{ !env.ACT }}
+
+  test-linux:
+    name: test-linux
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 2
+      - name: Cleanup Docker Engine
+        run: |
+          docker ps -a --format '{{ if eq (truncate .Names 4) "act-" }}
+          {{ .ID }}
+          {{end}}' | xargs -r docker rm -f || :
+          docker volume ls --format '{{ if eq (truncate .Name 4) "act-" }}
+          {{ .Name }}
+          {{ end }}' | xargs -r docker volume rm -f || :
+          docker images --format '{{ if eq (truncate .Repository 4) "act-" }}
+          {{ .ID }}
+          {{ end }}' | xargs -r docker rmi -f || :
+          docker images -q | xargs -r docker rmi || :
+      - name: Set up QEMU
+        if: '!env.NO_QEMU'
+        uses: docker/setup-qemu-action@v3
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: actions/cache@v4
+        if: ${{ !env.ACT }}
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: Install gotestfmt
+        run: go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@v2.5.0
+      # Regressions by Gitea Actions CI Migration
+      # GITHUB_REPOSITORY contains the server url
+      # ACTIONS_RUNTIME_URL provided to every step, act does not override
+      - name: Run Tests
+        run: |
+          unset ACTIONS_RUNTIME_URL
+          unset ACTIONS_RESULTS_URL
+          unset ACTIONS_RUNTIME_TOKEN
+          export GITHUB_REPOSITORY="${GITHUB_REPOSITORY#${SERVER_URL%/}/}"
+          export ACT_REPOSITORY="${GITHUB_REPOSITORY#${SERVER_URL%/}/}"
+          export ACT_OWNER="${ACT_OWNER#${SERVER_URL%/}/}"
+          env
+          go test -json -v -cover -coverpkg=./... -coverprofile=coverage.txt -covermode=atomic -timeout 20m ./... | gotestfmt -hide successful-packages,empty-packages 2>&1
+        env:
+          SERVER_URL: ${{ github.server_url }}
+      - name: Run act from cli
+        run: go run main.go exec -i node:16-buster-slim -C ./pkg/runner/testdata/ -W ./basic/push.yml
+      - name: Run act from cli without docker support
+        run: go run -tags WITHOUT_DOCKER main.go exec -i "-self-hosted" -C ./pkg/runner/testdata/ -W ./local-action-js/push.yml
+
+  snapshot:
+    name: snapshot
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: actions/cache@v4
+        if: ${{ !env.ACT }}
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: GoReleaser
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: v2
+          args: release --snapshot --clean
+      - name: Setup Node
+        continue-on-error: true
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+      - name: Install @actions/artifact@2.1.0
+        continue-on-error: true
+        run: npm install @actions/artifact@2.1.0
+      - name: Upload All
+        uses: actions/github-script@v8
+        continue-on-error: true
+        with:
+          script: |
+            // We do not use features depending on GITHUB_API_URL so we can hardcode it to avoid the GHES no support error
+            process.env["GITHUB_SERVER_URL"] = "https://github.com";
+            const {DefaultArtifactClient} = require('@actions/artifact');
+            const aartifact = new DefaultArtifactClient();
+            var artifacts = JSON.parse(process.env.ARTIFACTS);
+            for(var artifact of artifacts) {
+              if(artifact.type === "Binary") {
+                const {id, size} = await aartifact.uploadArtifact(
+                  // name of the artifact
+                  `${artifact.name}-${artifact.target}`,
+                  // files to include (supports absolute and relative paths)
+                  [artifact.path],
+                  process.cwd(),
+                  {
+                    // optional: how long to retain the artifact
+                    // if unspecified, defaults to repository/org retention settings (the limit of this value)
+                    retentionDays: 10
+                  }
+                );
+                console.log(`Created artifact with id: ${id} (bytes: ${size}`);
+              }
+            }
+        env:
+          ARTIFACTS: ${{ steps.goreleaser.outputs.artifacts }}
+      - name: Chocolatey
+        uses: ./.github/actions/choco
+        with:
+          version: v0.0.0-pr

.gitea/workflows/pull-pr-title.yml

@@ -1,27 +0,0 @@
-name: pr-title
-
-on:
-  pull_request:
-    types:
-    - opened
-    - edited
-    - reopened
-    - synchronize
-    - ready_for_review
-
-permissions:
-  contents: read
-
-jobs:
-  lint-pr-title:
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-node@v6
-      with:
-        node-version: 24
-    - run: make lint-pr-title
-      env:
-        PR_TITLE: ${{ github.event.pull_request.title }}

.gitea/workflows/release-nightly.yml

@@ -17,14 +17,14 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release --nightly
@@ -52,32 +52,27 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Echo the tag
-        run: echo "${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}"
-
-      - name: Get Meta
-        id: meta
-        run: |
-          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT
+        run: echo "${{ env.DOCKER_ORG }}/act_runner:nightly${{ matrix.variant.tag_suffix }}"
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
@@ -87,6 +82,4 @@ jobs:
             linux/arm64
           push: true
           tags: |
-            ${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}
-          build-args: |
-            VERSION=${{ steps.meta.outputs.REPO_VERSION }}
+            ${{ env.DOCKER_ORG }}/act_runner:nightly${{ matrix.variant.tag_suffix }}

.gitea/workflows/release-tag.yml

@@ -9,7 +9,7 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
       - uses: actions/setup-go@v6
@@ -17,13 +17,13 @@ jobs:
           go-version-file: "go.mod"
       - name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@v6
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release
@@ -39,15 +39,6 @@ jobs:
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
   release-image:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        variant:
-          - target: basic
-            tag_suffix: ""
-          - target: dind
-            tag_suffix: "-dind"
-          - target: dind-rootless
-            tag_suffix: "-dind-rootless"
     container:
       image: catthehacker/ubuntu:act-latest
     env:
@@ -55,46 +46,66 @@ jobs:
       DOCKER_LATEST: latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: "Docker meta"
-        id: docker_meta
-        uses: docker/metadata-action@v6
-        with:
-          images: |
-            ${{ env.DOCKER_ORG }}/runner
-          tags: |
-            type=semver,pattern={{major}}.{{minor}}.{{patch}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-          flavor: |
-            latest=true
-            suffix=${{ matrix.variant.tag_suffix }},onlatest=true
+      - name: Get Meta
+        id: meta
+        run: |
+          echo REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F"/" '{print $2}') >> $GITHUB_OUTPUT
+          echo REPO_VERSION=${GITHUB_REF_NAME#v} >> $GITHUB_OUTPUT
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
-          target: ${{ matrix.variant.target }}
+          target: basic
           platforms: |
             linux/amd64
             linux/arm64
           push: true
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          build-args: |
-            VERSION=${{ steps.docker_meta.outputs.version }}
+          tags: |
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ env.DOCKER_LATEST }}
+
+      - name: Build and push dind
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          target: dind
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          tags: |
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}-dind
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ env.DOCKER_LATEST }}-dind
+
+      - name: Build and push dind-rootless
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          target: dind-rootless
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          tags: |
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}-dind-rootless
+            ${{ env.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}:${{ env.DOCKER_LATEST }}-dind-rootless

.gitea/workflows/release.yml

@@ -0,0 +1,72 @@
+name: release
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  release:
+    # TODO use environment to scope secrets
+    name: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: actions/cache@v4
+        if: ${{ !env.ACT }}
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: latest
+          args: release --clean -f ./.goreleaser.yml -f ./.goreleaser.gitea.yml
+        env:
+          GITEA_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN || github.token }}
+      - name: Winget
+        uses: vedantmgoyal2009/winget-releaser@v2
+        with:
+          identifier: nektos.act
+          installers-regex: '_Windows_\w+\.zip$'
+          token: ${{ secrets.WINGET_TOKEN }}
+        if: env.ENABLED
+        env:
+          ENABLED: ${{ secrets.WINGET_TOKEN && '1' || '' }}
+      - name: Chocolatey
+        uses: ./.github/actions/choco
+        with:
+          version: ${{ github.ref }}
+          apiKey: ${{ secrets.CHOCO_APIKEY }}
+          push: true
+        if: env.ENABLED
+        env:
+          ENABLED: ${{ secrets.CHOCO_APIKEY && '1' || ''  }}
+      # TODO use ssh deployment key
+      - name: GitHub CLI extension
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.CLI_GITHUB_TOKEN || secrets.GORELEASER_GITHUB_TOKEN }}
+          script: |
+            const mainRef = (await github.rest.git.getRef({
+              owner: context.repo.owner,
+              repo: 'gh-act',
+              ref: 'heads/main',
+            })).data;
+            console.log(mainRef);
+            github.rest.git.createRef({
+              owner: 'nektos',
+              repo: 'gh-act',
+              ref: context.ref,
+              sha: mainRef.object.sha,
+            });
+        if: env.ENABLED
+        env:
+          ENABLED: ${{ (secrets.CLI_GITHUB_TOKEN || secrets.GORELEASER_GITHUB_TOKEN) && '1' || ''  }}

.gitea/workflows/test.yml

@@ -1,48 +1,34 @@
 name: checks
 on:
-  push:
-    branches:
-      - main
-  pull_request:
+  - push
+  - pull_request
+
+env:
+  DOOD: 1
+  NO_QEMU: 1
+  NO_EXTERNAL_IP: 1
 
 jobs:
   lint:
     name: check and test
     runs-on: ubuntu-latest
-    env:
-      # The runner image ships a stale docker.io login; point docker at an empty config so
-      # image pulls go straight to anonymous instead of attempting (and failing) that auth
-      # first. The path must be a literal: the `runner` context is unavailable in job-level
-      # env, so `${{ runner.temp }}` would resolve to empty and config.Dir() would fall back
-      # to ~/.docker with the stale credentials.
-      DOCKER_CONFIG: /tmp/docker-noauth
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
-      - name: prepare anonymous docker config
-        run: mkdir -p "$DOCKER_CONFIG" && echo '{}' > "$DOCKER_CONFIG/config.json"
-      # Pre-pull act/runner's two largest base images so a slow pull can't dominate `make test`;
-      # the rest (alpine/ubuntu) pull on demand, absorbed by the make-test -timeout. The host
-      # daemon retains them between runs, so this is usually a fast manifest re-check.
-      - name: pre-pull test images
-        run: |
-          for img in node:24-bookworm-slim nginx:alpine; do
-            for try in 1 2 3; do docker pull "$img" && break || sleep 5; done
-          done
       - name: lint
         run: make lint
       - name: build
         run: make build
       - name: test
-        run: make test
-      # Build the dind image and run the daemon-facing tests against the docker version it
-      # ships, catching daemon-level regressions (e.g. gitea/runner#981) before release. Runs
-      # after `make test` so the images it needs are already present on the host daemon.
-      - name: test against dind image
-        run: make test-dind
-      - name: coverage report
         run: |
-          make coverage-report
-          cat .tmp/coverage.md >> "$GITHUB_STEP_SUMMARY"
+          unset ACTIONS_RUNTIME_URL
+          unset ACTIONS_RESULTS_URL
+          unset ACTIONS_RUNTIME_TOKEN
+          export GITHUB_REPOSITORY="${GITHUB_REPOSITORY#${SERVER_URL%/}/}"
+          export ACT_REPOSITORY="${GITHUB_REPOSITORY}"
+          export ACT_OWNER="${ACT_REPOSITORY%%/*}"
+          make test
+        env:
+          SERVER_URL: ${{ github.server_url }}

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,88 @@
+name: Bug report
+description: Use this template for reporting bugs/issues.
+labels:
+  - 'kind/bug'
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+  - type: textarea
+    id: act-debug
+    attributes:
+      label: Bug report info
+      render: plain text
+      description: |
+        Output of `act --bug-report`
+      placeholder: |
+        act --bug-report
+    validations:
+      required: true
+  - type: textarea
+    id: act-command
+    attributes:
+      label: Command used with act
+      description: |
+        Please paste your whole command
+      placeholder: |
+        act -P ubuntu-latest=node:12 -v -d ...
+      render: sh
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: Describe issue
+      description: |
+        Also tell us what did you expect to happen?
+      placeholder: |
+        Describe issue
+    validations:
+      required: true
+  - type: input
+    id: repo
+    attributes:
+      label: Link to GitHub repository
+      description: |
+        Provide link to GitHub repository, you can skip it if the repository is private or you don't have it on GitHub, otherwise please provide it as it might help us troubleshoot problem
+      placeholder: |
+        https://github.com/nektos/act
+    validations:
+      required: false
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Workflow content
+      description: |
+        Please paste your **whole** workflow here
+      placeholder: |
+        name: My workflow
+        on: ['push', 'schedule']
+        jobs:
+          test:
+            runs-on: ubuntu-latest
+          env:
+            KEY: VAL
+        [...]
+      render: yml
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: |
+        Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks. Please verify that the log output doesn't contain any sensitive data.
+      render: sh
+      placeholder: |
+        Use `act -v` for verbose output
+    validations:
+      required: true
+  - type: textarea
+    id: additional-info
+    attributes:
+      label: Additional information
+      placeholder: |
+        Additional information that doesn't fit elsewhere
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Start a discussion
+    url: https://github.com/actions-oss/act-cli/discussions/new
+    about: You can ask for help here!
+  - name: Want to contribute to act?
+    url: https://github.com/actions-oss/act-cli/blob/main/CONTRIBUTING.md
+    about: Be sure to read contributing guidelines!

.github/ISSUE_TEMPLATE/feature_template.yml

@@ -0,0 +1,28 @@
+name: Feature request
+description: Use this template for requesting a feature/enhancement.
+labels:
+  - 'kind/feature-request'
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please note that incompatibility with GitHub Actions should be opened as a bug report, not a new feature.
+  - type: input
+    id: act-version
+    attributes:
+      label: Act version
+      description: |
+        What version of `act` are you using? Version can be obtained via `act --version`
+        If you've built it from source, please provide commit hash
+      placeholder: |
+        act --version
+    validations:
+      required: true
+  - type: textarea
+    id: feature
+    attributes:
+      label: Feature description
+      description: Describe feature that you would like to see
+      placeholder: ...
+    validations:
+      required: true

.github/actions/choco/Dockerfile

@@ -0,0 +1,20 @@
+FROM alpine:3.21
+
+ARG CHOCOVERSION=1.1.0
+
+RUN apk add --no-cache bash ca-certificates git \
+  && apk --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/edge/community add mono mono-dev \
+  && cert-sync /etc/ssl/certs/ca-certificates.crt \
+  && wget "https://github.com/chocolatey/choco/archive/${CHOCOVERSION}.tar.gz" -O- | tar -xzf - \
+  && cd choco-"${CHOCOVERSION}" \
+  && chmod +x build.sh zip.sh \
+  && ./build.sh -v \
+  && mv ./code_drop/chocolatey/console /opt/chocolatey \
+  && mkdir -p /opt/chocolatey/lib \
+  && rm -rf /choco-"${CHOCOVERSION}" \
+  && apk del mono-dev \
+  && rm -rf /var/cache/apk/*
+
+ENV ChocolateyInstall=/opt/chocolatey
+COPY entrypoint.sh /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]

.github/actions/choco/action.yml

@@ -0,0 +1,16 @@
+name: 'Chocolatey Packager'
+description: 'Create the choco package and push it'
+inputs:
+  version:
+    description: 'Version of package'
+    required: false
+  apiKey:
+    description: 'API Key for chocolately'
+    required: false
+  push:
+    description: 'Option for if package is going to be pushed'
+    required: false
+    default: 'false'
+runs:
+  using: 'docker'
+  image: 'Dockerfile'

.github/actions/choco/entrypoint.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+function choco {
+  mono /opt/chocolatey/choco.exe "$@" --allow-unofficial --nocolor
+}
+
+function get_version {
+  local version=${INPUT_VERSION:-$(git describe --tags)}
+  version=(${version//[!0-9.-]/})
+  local version_parts=(${version//-/ })
+  version=${version_parts[0]}
+  if [ ${#version_parts[@]} -gt 1 ]; then
+    version=${version_parts}.${version_parts[1]}
+  fi
+  echo "$version"
+}
+
+## Determine the version to pack
+VERSION=$(get_version)
+echo "Packing version ${VERSION} of act"
+rm -f act-cli.*.nupkg
+mkdir -p tools
+cp LICENSE tools/LICENSE.txt
+cp VERIFICATION tools/VERIFICATION.txt
+cp dist/act-cli_windows_amd64*/act.exe tools/
+choco pack act-cli.nuspec --version ${VERSION}
+if [[ "$INPUT_PUSH" == "true" ]]; then
+  choco push act-cli.${VERSION}.nupkg --api-key ${INPUT_APIKEY} -s https://push.chocolatey.org/ --timeout 180
+fi

.github/dependabot.yml

@@ -0,0 +1,23 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    groups:
+      dependencies:
+        patterns:
+        - '*'
+  - package-ecosystem: 'gomod'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    groups:
+      dependencies:
+        patterns:
+        - '*'

.github/workflows/.gitignore

@@ -0,0 +1 @@
+test-*.yml

.github/workflows/checks.yml

@@ -0,0 +1,151 @@
+name: checks
+on: [pull_request, workflow_dispatch]
+
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+env:
+  ACT_OWNER: ${{ github.repository_owner }}
+  ACT_REPOSITORY: ${{ github.repository }}
+  CGO_ENABLED: 0
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: golangci/golangci-lint-action@v8.0.0
+        with:
+          version: v2.1.6
+      - uses: megalinter/megalinter/flavors/go@v9.1.0
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_ALL_CODEBASE: false
+          GITHUB_STATUS_REPORTER: ${{ !env.ACT }}
+          GITHUB_COMMENT_REPORTER: ${{ !env.ACT }}
+
+  test-linux:
+    name: test-linux
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: actions/cache@v4
+        if: ${{ !env.ACT }}
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: Install gotestfmt
+        run: go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@v2.5.0
+      - name: Run Tests
+        run: go test -json -v -cover -coverpkg=./... -coverprofile=coverage.txt -covermode=atomic -timeout 20m ./... | gotestfmt -hide successful-packages,empty-packages 2>&1
+      - name: Run act from cli
+        run: go run main.go -P ubuntu-latest=node:16-buster-slim -C ./pkg/runner/testdata/ -W ./basic/push.yml
+      - name: Run act from cli without docker support
+        run: go run -tags WITHOUT_DOCKER main.go -P ubuntu-latest=-self-hosted -C ./pkg/runner/testdata/ -W ./local-action-js/push.yml
+      - name: Upload Codecov report
+        uses: codecov/codecov-action@v5
+        with:
+          files: coverage.txt
+          fail_ci_if_error: true # optional (default = false)
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  test-host:
+    strategy:
+      matrix:
+        os:
+          - windows-latest
+          - macos-latest
+    name: test-host-${{matrix.os}}
+    runs-on: ${{matrix.os}}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 2
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - name: Install gotestfmt
+        run: go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@v2.5.0
+      - name: Run Tests
+        run: go test -v -cover -coverpkg=./... -coverprofile=coverage.txt -covermode=atomic -timeout 20m -run ^TestRunEventHostEnvironment$ ./...
+        shell: bash
+
+
+  snapshot:
+    name: snapshot
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: actions/cache@v4
+        if: ${{ !env.ACT }}
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: GoReleaser
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: v2
+          args: release --snapshot --clean
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+      - name: Install @actions/artifact
+        run: npm install @actions/artifact
+      - name: Upload All
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const {DefaultArtifactClient} = require('@actions/artifact');
+            const aartifact = new DefaultArtifactClient();
+            var artifacts = JSON.parse(process.env.ARTIFACTS);
+            for(var artifact of artifacts) {
+              if(artifact.type === "Binary") {
+                const {id, size} = await aartifact.uploadArtifact(
+                  // name of the artifact
+                  `${artifact.name}-${artifact.target}`,
+                  // files to include (supports absolute and relative paths)
+                  [artifact.path],
+                  process.cwd(),
+                  {
+                    // optional: how long to retain the artifact
+                    // if unspecified, defaults to repository/org retention settings (the limit of this value)
+                    retentionDays: 10
+                  }
+                );
+                console.log(`Created artifact with id: ${id} (bytes: ${size}`);
+              }
+            }
+        env:
+          ARTIFACTS: ${{ steps.goreleaser.outputs.artifacts }}
+      - name: Chocolatey
+        uses: ./.github/actions/choco
+        with:
+          version: v0.0.0-pr

.github/workflows/codespell.yml

@@ -0,0 +1,23 @@
+# Codespell configuration is within .codespellrc
+---
+name: Codespell
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  codespell:
+    name: Check for spelling errors
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Codespell
+        uses: codespell-project/actions-codespell@v2

.github/workflows/promote.yml

@@ -0,0 +1,30 @@
+name: promote
+on:
+  schedule:
+    - cron: '0 2 1 * *'
+  workflow_dispatch: {}
+
+jobs:
+  release:
+    if: vars.ENABLE_PROMOTE || github.event_name != 'schedule'
+    name: promote
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          ref: master
+          token: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
+      - uses: fregante/setup-git-user@v2
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: actions/cache@v4
+        if: ${{ !env.ACT }}
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - run: make promote

.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: release
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  release:
+    # TODO use environment to scope secrets
+    name: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: actions/cache@v4
+        if: ${{ !env.ACT }}
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN || github.token }}
+      - name: Winget
+        uses: vedantmgoyal2009/winget-releaser@v2
+        with:
+          identifier: nektos.act
+          installers-regex: '_Windows_\w+\.zip$'
+          token: ${{ secrets.WINGET_TOKEN }}
+        if: env.ENABLED
+        env:
+          ENABLED: ${{ secrets.WINGET_TOKEN && '1' || '' }}
+      - name: Chocolatey
+        uses: ./.github/actions/choco
+        with:
+          version: ${{ github.ref }}
+          apiKey: ${{ secrets.CHOCO_APIKEY }}
+          push: true
+        if: env.ENABLED
+        env:
+          ENABLED: ${{ secrets.CHOCO_APIKEY && '1' || ''  }}
+      # TODO use ssh deployment key
+      - name: GitHub CLI extension
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.CLI_GITHUB_TOKEN || secrets.GORELEASER_GITHUB_TOKEN }}
+          script: |
+            const mainRef = (await github.rest.git.getRef({
+              owner: context.repo.owner,
+              repo: 'gh-act',
+              ref: 'heads/main',
+            })).data;
+            console.log(mainRef);
+            github.rest.git.createRef({
+              owner: 'nektos',
+              repo: 'gh-act',
+              ref: context.ref,
+              sha: mainRef.object.sha,
+            });
+        if: env.ENABLED
+        env:
+          ENABLED: ${{ (secrets.CLI_GITHUB_TOKEN || secrets.GORELEASER_GITHUB_TOKEN) && '1' || ''  }}

.github/workflows/stale.yml

@@ -0,0 +1,23 @@
+name: 'Close stale issues'
+on:
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  stale:
+    name: Stale
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v10
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          stale-issue-message: 'Issue is stale and will be closed in 14 days unless there is new activity'
+          stale-pr-message: 'PR is stale and will be closed in 14 days unless there is new activity'
+          stale-issue-label: 'stale'
+          exempt-issue-labels: 'stale-exempt,kind/feature-request'
+          stale-pr-label: 'stale'
+          exempt-pr-labels: 'stale-exempt'
+          remove-stale-when-updated: 'True'
+          operations-per-run: 500
+          days-before-stale: 180
+          days-before-close: 14

.gitignore

@@ -1,9 +1,8 @@
-/gitea-runner
+/act_runner
 .env
-!/act/runner/testdata/secrets/.env
 .runner
 coverage.txt
-.tmp/
+/gitea-vet
 /config.yaml
 
 # Jetbrains
@@ -12,5 +11,4 @@ coverage.txt
 .vscode
 __debug_bin
 # gorelease binary folder
-/dist
-.DS_Store
+dist

.gitleaksignore

@@ -0,0 +1,2 @@
+b910a42edfab7a02b08a52ecef203fd419725642:pkg/container/testdata/docker-pull-options/config.json:generic-api-key:4
+710a3ac94c3dc0eaf680d417c87f37f92b4887f4:pkg/container/docker_pull_test.go:generic-api-key:45

.golangci.yml

@@ -13,7 +13,6 @@ linters:
     - forbidigo
     - gocheckcompilerdirectives
     - gocritic
-    - goheader
     - govet
     - ineffassign
     - mirror
@@ -36,61 +35,23 @@ linters:
       rules:
         main:
           deny:
-            - pkg: io/ioutil
-              desc: use os or io instead
-            - pkg: golang.org/x/exp
-              desc: it's experimental and unreliable
             - pkg: github.com/pkg/errors
-              desc: use builtin errors package instead
-    nolintlint:
-      allow-unused: false
-      require-explanation: true
-      require-specific: true
+              desc: Please use "errors" package from standard library
+            - pkg: gotest.tools/v3
+              desc: Please keep tests unified using only github.com/stretchr/testify
+            - pkg: log
+              desc: Please keep logging unified using only github.com/sirupsen/logrus
     gocritic:
-      enabled-checks:
-        - equalFold
       disabled-checks:
         - ifElseChain
-    revive:
-      severity: error
-      rules:
-        - name: blank-imports
-        - name: constant-logical-expr
-        - name: context-as-argument
-        - name: context-keys-type
-        - name: dot-imports
-        - name: empty-lines
-        - name: error-return
-        - name: error-strings
-        - name: exported
-        - name: identical-branches
-        - name: if-return
-        - name: increment-decrement
-        - name: modifies-value-receiver
-        - name: package-comments
-        - name: redefines-builtin-id
-        - name: superfluous-else
-        - name: time-naming
-        - name: unexported-return
-        - name: var-declaration
-        - name: var-naming
-    staticcheck:
-      checks:
-        - all
-        - -ST1005
-    usetesting:
-      os-temp-dir: true
-    perfsprint:
-      concat-loop: false
-    govet:
-      enable:
-        - nilness
-        - unusedwrite
-    goheader:
-      values:
-        regexp:
-          HEADER: 'Copyright \d{4} The Gitea Authors\. All rights reserved\.(\nCopyright [^\n]+)*\nSPDX-License-Identifier: MIT'
-      template: '{{ HEADER }}'
+    gocyclo:
+      min-complexity: 20
+    importas:
+      alias:
+        - pkg: github.com/sirupsen/logrus
+          alias: log
+        - pkg: github.com/stretchr/testify/assert
+          alias: assert
   exclusions:
     generated: lax
     presets:
@@ -99,27 +60,23 @@ linters:
       - legacy
       - std-error-handling
     rules:
-      - linters:
-          - forbidigo
-        path: cmd
+      - linters: [revive]
+        text: avoid meaningless package names
+    paths:
+      - report
+      - third_party$
+      - builtin$
+      - examples$
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
 formatters:
   enable:
-    - gci
-    - gofumpt
-  settings:
-    gci:
-      custom-order: true
-      sections:
-        - standard
-        - prefix(gitea.com/gitea/runner)
-        - blank
-        - default
-    gofumpt:
-      extra-rules: true
+    - goimports
   exclusions:
     generated: lax
-run:
-  timeout: 10m
+    paths:
+      - report
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.gitea.yml

@@ -0,0 +1,3 @@
+gitea_urls:
+  api: https://gitea.com/api/v1/
+  download: https://gitea.com/

.goreleaser.yaml

@@ -1,7 +1,5 @@
 version: 2
 
-project_name: gitea-runner
-
 before:
   hooks:
     - go mod tidy
@@ -65,7 +63,7 @@ builds:
   flags:
   - -trimpath
   ldflags:
-  - -s -w -X gitea.com/gitea/runner/internal/pkg/ver.version={{ .Summary }}
+  - -s -w -X gitea.com/gitea/act_runner/internal/pkg/ver.version={{ .Summary }}
   binary: >-
     {{ .ProjectName }}-
     {{- .Version }}-
@@ -88,7 +86,7 @@ blobs:
     provider: s3
     bucket: "{{ .Env.S3_BUCKET }}"
     region: "{{ .Env.S3_REGION }}"
-    directory: "gitea-runner/{{.Version}}"
+    directory: "act_runner/{{.Version}}"
     extra_files:
       - glob: ./**.xz
       - glob: ./**.sha256

.goreleaser.yml

@@ -0,0 +1,54 @@
+version: 2
+before:
+  hooks:
+    - go mod tidy
+builds:
+  - env:
+      - CGO_ENABLED=0
+    goos:
+      - darwin
+      - linux
+      - windows
+    goarch:
+      - amd64
+      - '386'
+      - arm64
+      - arm
+      - riscv64
+    goarm:
+      - '6'
+      - '7'
+    ignore:
+      - goos: windows
+        goarch: arm
+    binary: act
+checksum:
+  name_template: 'checksums.txt'
+archives:
+  - name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    format_overrides:
+      - goos: windows
+        formats:
+        - zip
+changelog:
+  groups:
+    - title: 'New Features'
+      regexp: "^.*feat[(\\w)]*:+.*$"
+      order: 0
+    - title: 'Bug fixes'
+      regexp: "^.*fix[(\\w)]*:+.*$"
+      order: 1
+    - title: 'Documentation updates'
+      regexp: "^.*docs[(\\w)]*:+.*$"
+      order: 2
+    - title: 'Other'
+      order: 999
+release:
+  prerelease: auto
+  mode: append

.markdownlint.yml

@@ -0,0 +1,12 @@
+# Default state for all rules
+default: true
+
+# MD013/line-length - Line length
+MD013:
+  line_length: 1024
+
+# MD033/no-inline-html - Inline HTML
+MD033: false
+
+# MD041/first-line-heading/first-line-h1 - First line in a file should be a top-level heading
+MD041: false

.mega-linter.yml

@@ -0,0 +1,20 @@
+---
+APPLY_FIXES: none
+DISABLE:
+  - ACTION
+  - BASH
+  - COPYPASTE
+  - DOCKERFILE
+  - GO
+  - JAVASCRIPT
+  - SPELL
+DISABLE_LINTERS:
+  - YAML_YAMLLINT
+  - MARKDOWN_MARKDOWN_TABLE_FORMATTER
+  - MARKDOWN_MARKDOWN_LINK_CHECK
+  - REPOSITORY_CHECKOV
+  - REPOSITORY_TRIVY
+FILTER_REGEX_EXCLUDE: (.*testdata/*|install.sh|pkg/container/docker_cli.go|pkg/container/DOCKER_LICENSE|VERSION)
+MARKDOWN_MARKDOWNLINT_CONFIG_FILE: .markdownlint.yml
+PARALLEL: false
+PRINT_ALPACA: false

.mergify.yml

@@ -0,0 +1,98 @@
+
+pull_request_rules:
+  - name: warn on conflicts
+    conditions:
+      - -draft
+      - -closed
+      - -merged
+      - conflict
+    actions:
+      comment:
+        message: '@{{author}} this pull request is now in conflict 😩'
+      label:
+        add:
+          - conflict
+  - name: remove conflict label if not needed
+    conditions:
+      - -conflict
+    actions:
+      label:
+        remove:
+          - conflict
+  - name: warn on needs-work
+    conditions:
+      - -draft
+      - -closed
+      - -merged
+      - or:
+          - check-failure=lint
+          - check-failure=test-linux
+          - check-failure=codecov/patch
+          - check-failure=codecov/project
+          - check-failure=snapshot
+    actions:
+      comment:
+        message: '@{{author}} this pull request has failed checks 🛠'
+      label:
+        add:
+          - needs-work
+  - name: remove needs-work label if not needed
+    conditions:
+      - check-success=lint
+      - check-success=test-linux
+      - check-success=codecov/patch
+      - check-success=codecov/project
+      - check-success=snapshot
+    actions:
+      label:
+        remove:
+          - needs-work
+  - name: Automatic maintainer assignment
+    conditions:
+      - '-approved-reviews-by=@nektos/act-maintainers'
+      - -draft
+      - -merged
+      - -closed
+      - -conflict
+      - check-success=lint
+      - check-success=test-linux
+      - check-success=codecov/patch
+      - check-success=codecov/project
+      - check-success=snapshot
+    actions:
+      request_reviews:
+        teams:
+          - '@nektos/act-maintainers'
+  - name: Automatic merge on approval
+    conditions: []
+    actions:
+      queue:
+queue_rules:
+  - name: default
+    queue_conditions:
+      - '#changes-requested-reviews-by=0'
+      - or:
+          - 'approved-reviews-by=@nektos/act-committers'
+          - 'author~=^dependabot(|-preview)\[bot\]$'
+          - and:
+              - 'approved-reviews-by=@nektos/act-maintainers'
+              - '#approved-reviews-by>=2'
+          - and:
+              - 'author=@nektos/act-maintainers'
+              - 'approved-reviews-by=@nektos/act-maintainers'
+              - '#approved-reviews-by>=1'
+      - -draft
+      - -merged
+      - -closed
+      - check-success=lint
+      - check-success=test-linux
+      - check-success=codecov/patch
+      - check-success=codecov/project
+      - check-success=snapshot
+    merge_conditions:
+      - check-success=lint
+      - check-success=test-linux
+      - check-success=codecov/patch
+      - check-success=codecov/project
+      - check-success=snapshot
+    merge_method: squash

.prettierignore

@@ -0,0 +1,2 @@
+**/testdata
+pkg/runner/res

.prettierrc.yml

@@ -0,0 +1,7 @@
+overrides:
+  - files: '*.yml'
+    options:
+      singleQuote: true
+  - files: '*.json'
+    options:
+      singleQuote: false

.vscode/extensions.json

@@ -0,0 +1,9 @@
+{
+  "recommendations": [
+    "editorconfig.editorconfig",
+    "golang.go",
+    "davidanson.vscode-markdownlint",
+    "esbenp.prettier-vscode",
+    "redhat.vscode-yaml"
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,14 @@
+{
+  "go.lintTool": "golangci-lint",
+  "go.lintFlags": ["--fix"],
+  "go.testTimeout": "300s",
+  "[json]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  },
+  "[markdown]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  },
+  "[yaml]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  }
+}

AGENTS.md

@@ -1,10 +0,0 @@
-- Use `make help` to find available development targets
-- Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
-- Run `make tidy` after any `go.mod` changes
-- Run single go unit tests with `go test -run '^TestName$' ./modulepath/`
-- Add the current year into the copyright header of new `.go` files
-- Ensure no trailing whitespace in edited files
-- Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
-- Preserve existing code comments, do not remove or rewrite comments that are still relevant
-- Include authorship attribution in issue and pull request comments
-- Add `Co-Authored-By` lines to all commits, indicating name and model used

CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

CODEOWNERS

@@ -0,0 +1 @@
+*       @nektos/act-maintainers

CONTRIBUTING.md

@@ -0,0 +1,69 @@
+# Contributing to Act
+
+Help wanted! We'd love your contributions to Act. Please review the following guidelines before contributing. Also, feel free to propose changes to these guidelines by updating this file and submitting a pull request.
+
+- [I have a question...](#questions)
+- [I found a bug...](#bugs)
+- [I have a feature request...](#features)
+- [I have a contribution to share...](#process)
+
+## <a id="questions"></a> Have a Question?
+
+Please don't open a GitHub issue for questions about how to use `act`, as the goal is to use issues for managing bugs and feature requests. Issues that are related to general support will be closed and redirected to our gitter room.
+
+For all support related questions, please ask the question in discussions: [actions-oss/act-cli](https://github.com/actions-oss/act-cli/discussions).
+
+## <a id="bugs"></a> Found a Bug?
+
+If you've identified a bug in `act`, please [submit an issue](#issue) to our GitHub repo: [actions-oss/act-cli](https://github.com/actions-oss/act-cli/issues/new). Please also feel free to submit a [Pull Request](#pr) with a fix for the bug!
+
+## <a id="features"></a> Have a Feature Request?
+
+All feature requests should start with [submitting an issue](#issue) documenting the user story and acceptance criteria. Again, feel free to submit a [Pull Request](#pr) with a proposed implementation of the feature.
+
+## <a id="process"></a> Ready to Contribute
+
+### <a id="issue"></a> Create an issue
+
+Before submitting a new issue, please search the issues to make sure there isn't a similar issue doesn't already exist.
+
+Assuming no existing issues exist, please ensure you include required information when submitting the issue to ensure we can quickly reproduce your issue.
+
+We may have additional questions and will communicate through the GitHub issue, so please respond back to our questions to help reproduce and resolve the issue as quickly as possible.
+
+New issues can be created with in our [GitHub repo](https://github.com/actions-oss/act-cli/issues/new).
+
+### <a id="pr"></a>Pull Requests
+
+Pull requests should target the `master` branch. Please also reference the issue from the description of the pull request using [special keyword syntax](https://help.github.com/articles/closing-issues-via-commit-messages/) to auto close the issue when the PR is merged. For example, include the phrase `fixes #14` in the PR description to have issue #14 auto close. Please send documentation updates for the [act user guide](https://actions-oss.github.io/act-docs/) to [actions-oss/act-docs](https://github.com/actions-oss/act-docs).
+
+### <a id="style"></a> Styleguide
+
+When submitting code, please make every effort to follow existing conventions and style in order to keep the code as readable as possible. Here are a few points to keep in mind:
+
+- Please run `go fmt ./...` before committing to ensure code aligns with go standards.
+- We use [`golangci-lint`](https://golangci-lint.run/) for linting Go code, run `golangci-lint run --fix` before submitting PR. Editors such as Visual Studio Code or JetBrains IntelliJ; with Go support plugin will offer `golangci-lint` automatically.
+- There are additional linters and formatters for files such as Markdown documents or YAML/JSON:
+  - Please refer to the [Makefile](Makefile) or [`lint` job in our workflow](.github/workflows/checks.yml) to see how to those linters/formatters work.
+  - You can lint codebase by running `go run main.go -j lint --env RUN_LOCAL=true` or `act -j lint --env RUN_LOCAL=true`
+  - In `Makefile`, there are tools that require `npx` which is shipped with `nodejs`.
+  - Our `Makefile` exports `GITHUB_TOKEN` from `~/.config/github/token`, you have been warned.
+  - You can run `make pr` to cleanup dependencies, format/lint code and run tests.
+- All dependencies must be defined in the `go.mod` file.
+  - Advanced IDEs and code editors (like VSCode) will take care of that, but to be sure, run `go mod tidy` to validate dependencies.
+- For details on the approved style, check out [Effective Go](https://golang.org/doc/effective_go.html).
+- Before running tests, please be aware that they are multi-architecture so for them to not fail, you need to run `docker run --privileged --rm tonistiigi/binfmt --install amd64,arm64` before ([more info available in #765](https://github.com/nektos/act/issues/765)).
+
+Also, consider the original design principles:
+
+- **Polyglot** - There will be no prescribed language or framework for developing the microservices. The only requirement will be that the service will be run inside a container and exposed via an HTTP endpoint.
+- **Cloud Provider** - At this point, the tool will assume AWS for the cloud provider and will not be written in a cloud agnostic manner. However, this does not preclude refactoring to add support for other providers at a later time.
+- **Declarative** - All resource administration will be handled in a declarative vs. imperative manner. A file will be used to declared the desired state of the resources and the tool will simply assert the actual state matches the desired state. The tool will accomplish this by generating CloudFormation templates.
+- **Stateless** - The tool will not maintain its own state. Rather, it will rely on the CloudFormation stacks to determine the state of the platform.
+- **Secure** - All security will be managed by AWS IAM credentials. No additional authentication or authorization mechanisms will be introduced.
+
+### License
+
+By contributing your code, you agree to license your contribution under the terms of the [MIT License](LICENSE).
+
+All files are released with the MIT license.

Dockerfile

@@ -1,7 +1,7 @@
 ### BUILDER STAGE
 #
 #
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.26-alpine AS builder
 
 # Do not remove `git` here, it is required for getting runner version when executing `make build`
 RUN apk add --no-cache make git
@@ -9,24 +9,19 @@ RUN apk add --no-cache make git
 ARG GOPROXY
 ENV GOPROXY=${GOPROXY:-}
 
-COPY . /opt/src/runner
-WORKDIR /opt/src/runner
+COPY . /opt/src/act_runner
+WORKDIR /opt/src/act_runner
 
 RUN make clean && make build
 
 ### DIND VARIANT
 #
 #
-FROM docker:29.6.1-dind AS dind
+FROM docker:28-dind AS dind
 
-ARG VERSION=dev
+RUN apk add --no-cache s6 bash git tzdata
 
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
-RUN apk add --no-cache s6 bash git tzdata nftables
-
-COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
 COPY scripts/run.sh /usr/local/bin/run.sh
 COPY scripts/s6 /etc/s6
 
@@ -37,17 +32,12 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### DIND-ROOTLESS VARIANT
 #
 #
-FROM docker:29.6.1-dind-rootless AS dind-rootless
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
+FROM docker:28-dind-rootless AS dind-rootless
 
 USER root
-RUN apk add --no-cache s6 bash git tzdata nftables
+RUN apk add --no-cache s6 bash git tzdata
 
-COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
 COPY scripts/run.sh /usr/local/bin/run.sh
 COPY scripts/s6 /etc/s6
 
@@ -63,16 +53,10 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### BASIC VARIANT
 #
 #
-FROM alpine:3.24 AS basic
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
+FROM alpine AS basic
 RUN apk add --no-cache tini bash git tzdata
 
-COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
 COPY scripts/run.sh /usr/local/bin/run.sh
 
 VOLUME /data

Makefile

@@ -1,30 +1,32 @@
 DIST := dist
-EXECUTABLE := gitea-runner
+EXECUTABLE := act_runner
+GOFMT ?= gofumpt -l
 DIST_DIRS := $(DIST)/binaries $(DIST)/release
 GO ?= go
 SHASUM ?= shasum -a 256
 HAS_GO = $(shell hash $(GO) > /dev/null 2>&1 && echo "GO" || echo "NOGO" )
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
 XGO_VERSION := go-1.26.x
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.10
+GXZ_PAGAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.10
 
 LINUX_ARCHS ?= linux/amd64,linux/arm64
 DARWIN_ARCHS ?= darwin-12/amd64,darwin-12/arm64
 WINDOWS_ARCHS ?= windows/amd64
+GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*")
 GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*")
 
-DOCKER_IMAGE ?= gitea/runner
+DOCKER_IMAGE ?= gitea/act_runner
 DOCKER_TAG ?= nightly
 DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
 DOCKER_ROOTLESS_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)-dind-rootless
 
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.3.0
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
 
-STATIC ?=
-EXTLDFLAGS ?=
-ifneq ($(STATIC),)
-	EXTLDFLAGS = -extldflags "-static"
+ifneq ($(shell uname), Darwin)
+	EXTLDFLAGS = -extldflags "-static" $(null)
+else
+	EXTLDFLAGS =
 endif
 
 ifeq ($(HAS_GO), GO)
@@ -38,15 +40,12 @@ endif
 ifeq ($(OS), Windows_NT)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else ifeq ($(OS), Windows)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else
 	GOFLAGS := -v
 	EXECUTABLE ?= $(EXECUTABLE)
-	GO_ENV_WINDOWS := GOOS=windows
 endif
 
 STORED_VERSION_FILE := VERSION
@@ -69,19 +68,19 @@ else
 	endif
 endif
 
-TAGS ?=
-LDFLAGS ?= -X "gitea.com/gitea/runner/internal/pkg/ver.version=v$(RELASE_VERSION)"
+GO_PACKAGES_TO_VET ?= $(filter-out gitea.com/gitea/act_runner/cmd gitea.com/gitea/act_runner/internal/app/act-cli gitea.com/gitea/act_runner/internal/eval/functions gitea.com/gitea/act_runner/internal/eval/v2 gitea.com/gitea/act_runner/internal/expr gitea.com/gitea/act_runner/internal/model gitea.com/gitea/act_runner/internal/templateeval gitea.com/gitea/act_runner/pkg/artifactcache gitea.com/gitea/act_runner/pkg/artifacts gitea.com/gitea/act_runner/pkg/common gitea.com/gitea/act_runner/pkg/common/git gitea.com/gitea/act_runner/pkg/container gitea.com/gitea/act_runner/pkg/exprparser gitea.com/gitea/act_runner/pkg/filecollector gitea.com/gitea/act_runner/pkg/gh gitea.com/gitea/act_runner/pkg/model gitea.com/gitea/act_runner/pkg/runner gitea.com/gitea/act_runner/pkg/schema gitea.com/gitea/act_runner/pkg/tart gitea.com/gitea/act_runner/pkg/workflowpattern gitea.com/gitea/act_runner/pkg/lookpath gitea.com/gitea/act_runner/internal/pkg/client/mocks,$(shell $(GO) list ./...))
+
+
+TAGS ?=
+LDFLAGS ?= -X "gitea.com/gitea/act_runner/internal/pkg/ver.version=v$(RELASE_VERSION)"
 
-.PHONY: all
 all: build
 
-.PHONY: help
-help: Makefile ## print Makefile help information.
-	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m[TARGETS] default target: build\033[0m\n\n\033[35mTargets:\033[0m\n"} /^[0-9A-Za-z._-]+:.*?##/ { printf "  \033[36m%-45s\033[0m %s\n", $$1, $$2 }' Makefile
-
-.PHONY: fmt
-fmt: ## format the Go code
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) fmt
+fmt:
+	@hash gofumpt > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
+		$(GO) install mvdan.cc/gofumpt@latest; \
+	fi
+	$(GOFMT) -w $(GO_FMT_FILES)
 
 .PHONY: go-check
 go-check:
@@ -89,115 +88,100 @@ go-check:
 	$(eval MIN_GO_VERSION := $(shell printf "%03d%03d" $(shell echo '$(MIN_GO_VERSION_STR)' | tr '.' ' ')))
 	$(eval GO_VERSION := $(shell printf "%03d%03d" $(shell $(GO) version | grep -Eo '[0-9]+\.[0-9]+' | tr '.' ' ');))
 	@if [ "$(GO_VERSION)" -lt "$(MIN_GO_VERSION)" ]; then \
-		echo "Gitea Runner requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
+		echo "Act Runner requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
 		exit 1; \
 	fi
 
 .PHONY: fmt-check
-fmt-check: fmt
-	@diff=$$(git diff --color=always); \
+fmt-check:
+	@hash gofumpt > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
+		$(GO) install mvdan.cc/gofumpt@latest; \
+	fi
+	@diff=$$($(GOFMT) -d $(GO_FMT_FILES)); \
 	if [ -n "$$diff" ]; then \
 		echo "Please run 'make fmt' and commit the result:"; \
-		printf "%s" "$${diff}"; \
+		echo "$${diff}"; \
 		exit 1; \
-	fi
+	fi;
 
 .PHONY: deps-tools
 deps-tools: ## install tool dependencies
-	$(GO) install $(GOLANGCI_LINT_PACKAGE) & \
-	$(GO) install $(GXZ_PACKAGE) & \
-	$(GO) install $(XGO_PACKAGE) & \
-	$(GO) install $(GOVULNCHECK_PACKAGE) & \
-	wait
+	$(GO) install $(GOVULNCHECK_PACKAGE)
 
 .PHONY: lint
-lint: lint-go lint-go-windows ## lint everything
+lint: lint-go vet
 
 .PHONY: lint-go
 lint-go: ## lint go files
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run
 
-.PHONY: lint-go-windows
-lint-go-windows: ## lint Windows go files
-	$(GO) install $(GOLANGCI_LINT_PACKAGE)
-	$(GO_ENV_WINDOWS) golangci-lint run
-
 .PHONY: lint-go-fix
 lint-go-fix: ## lint go files and fix issues
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run --fix
 
-.PHONY: lint-pr-title
-lint-pr-title: ## lint PR title against Conventional Commits (set PR_TITLE=...)
-	@node ./tools/lint-pr-title.ts
-
 .PHONY: security-check
 security-check: deps-tools
 	GOEXPERIMENT= $(GO) run $(GOVULNCHECK_PACKAGE) -show color ./... || true
 
 .PHONY: tidy
-tidy: ## run go mod tidy
+tidy:
 	$(GO) mod tidy
 
 .PHONY: tidy-check
 tidy-check: tidy
-	@diff=$$(git diff --color=always -- go.mod go.sum); \
+	@diff=$$(git diff -- go.mod go.sum); \
 	if [ -n "$$diff" ]; then \
 		echo "Please run 'make tidy' and commit the result:"; \
-		printf "%s" "$${diff}"; \
+		echo "$${diff}"; \
 		exit 1; \
 	fi
 
-.PHONY: test
-test: fmt-check security-check ## test everything (integration tests self-skip without docker/network)
-	@$(GO) test -race -timeout 20m -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
+test: fmt-check security-check
+	@$(GO) test -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
 
-.PHONY: coverage-report
-coverage-report: ## turn coverage.txt from `make test` into .tmp/coverage.md
-	@mkdir -p .tmp
-	@node ./tools/coverage-report.ts -i coverage.txt -o .tmp/coverage.md
-	@echo "Wrote .tmp/coverage.md"
+.PHONY: vet
+vet:
+	@echo "Running go vet..."
+	@$(GO) build code.gitea.io/gitea-vet
+	@$(GO) vet -vettool=gitea-vet $(GO_PACKAGES_TO_VET)
 
-.PHONY: test-dind
-test-dind: ## run the daemon-facing tests against the built dind image (TARGET=dind|dind-rootless)
-	@./scripts/test-dind.sh $(TARGET)
+install: $(GOFILES)
+	$(GO) install -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)'
 
-.PHONY: install
-install: $(GOFILES) ## install the runner binary via `go install`
-	$(GO) install -v -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)'
-
-.PHONY: build
-build: go-check $(EXECUTABLE) ## build the runner binary
+build: go-check $(EXECUTABLE)
 
 $(EXECUTABLE): $(GOFILES)
-	$(GO) build -v -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@
+	$(GO) build -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)' -o $@
 
 .PHONY: deps-backend
-deps-backend: ## install backend dependencies
+deps-backend:
 	$(GO) mod download
+	$(GO) install $(GXZ_PAGAGE)
+	$(GO) install $(XGO_PACKAGE)
 
 .PHONY: release
-release: release-windows release-linux release-darwin release-copy release-compress release-check ## build release artifacts
+release: release-windows release-linux release-darwin release-copy release-compress release-check
 
 $(DIST_DIRS):
 	mkdir -p $(DIST_DIRS)
 
 .PHONY: release-windows
 release-windows: | $(DIST_DIRS)
-	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -buildmode exe -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w -linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(WINDOWS_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -buildmode exe -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(WINDOWS_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
 ifeq ($(CI),true)
 	cp -r /build/* $(DIST)/binaries/
 endif
 
 .PHONY: release-linux
 release-linux: | $(DIST_DIRS)
-	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w -linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(LINUX_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-linkmode external -extldflags "-static" $(LDFLAGS)' -targets '$(LINUX_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
 ifeq ($(CI),true)
 	cp -r /build/* $(DIST)/binaries/
 endif
 
 .PHONY: release-darwin
 release-darwin: | $(DIST_DIRS)
-	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '-s -w $(LDFLAGS)' -targets '$(DARWIN_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) run $(XGO_PACKAGE) -go $(XGO_VERSION) -dest $(DIST)/binaries -tags 'netgo osusergo $(TAGS)' -ldflags '$(LDFLAGS)' -targets '$(DARWIN_ARCHS)' -out $(EXECUTABLE)-$(VERSION) .
 ifeq ($(CI),true)
 	cp -r /build/* $(DIST)/binaries/
 endif
@@ -212,20 +196,18 @@ release-check: | $(DIST_DIRS)
 
 .PHONY: release-compress
 release-compress: | $(DIST_DIRS)
-	cd $(DIST)/release/; for file in `find . -type f -name "*"`; do echo "compressing $${file}" && $(GO) run $(GXZ_PACKAGE) -k -9 $${file}; done;
+	cd $(DIST)/release/; for file in `find . -type f -name "*"`; do echo "compressing $${file}" && $(GO) run $(GXZ_PAGAGE) -k -9 $${file}; done;
 
 .PHONY: docker
-docker: ## build the docker image
+docker:
 	if ! docker buildx version >/dev/null 2>&1; then \
 		ARG_DISABLE_CONTENT_TRUST=--disable-content-trust=false; \
 	fi; \
 	docker build $${ARG_DISABLE_CONTENT_TRUST} -t $(DOCKER_REF) .
 
-.PHONY: clean
-clean: ## delete binary and coverage files
+clean:
 	$(GO) clean -x -i ./...
-	rm -rf coverage.txt .tmp $(EXECUTABLE) $(DIST)
+	rm -rf coverage.txt $(EXECUTABLE) $(DIST)
 
-.PHONY: version
-version: ## print the version
+version:
 	@echo $(VERSION)

README.md

@@ -1,4 +1,6 @@
-# Gitea Runner
+# act runner
+
+Act runner is a runner for Gitea based on [Gitea fork](https://gitea.com/gitea/act) of [act](https://github.com/nektos/act).
 
 ## Installation
 
@@ -8,7 +10,7 @@ Docker Engine Community version is required for docker mode. To install Docker C
 
 ### Download pre-built binary
 
-Visit [here](https://dl.gitea.com/gitea-runner/) and download the right version for your platform.
+Visit [here](https://dl.gitea.com/act_runner/) and download the right version for your platform.
 
 ### Build from source
 
@@ -24,8 +26,8 @@ make docker
 
 ## Quickstart
 
-Actions are disabled by default, so you need to add the following to the configuration file of your Gitea instance to enable it:
-
+Actions are disabled by default, so you need to add the following to the configuration file of your Gitea instance to enable it: 
+  
 ```ini
 [actions]
 ENABLED=true
@@ -34,7 +36,7 @@ ENABLED=true
 ### Register
 
 ```bash
-./gitea-runner register
+./act_runner register
 ```
 
 And you will be asked to input:
@@ -66,7 +68,7 @@ INFO Runner registered successfully.
 You can also register with command line arguments.
 
 ```bash
-./gitea-runner register --instance http://192.168.8.8:3000 --token <my_runner_token> --no-interactive
+./act_runner register --instance http://192.168.8.8:3000 --token <my_runner_token> --no-interactive
 ```
 
 If the registry succeed, it will run immediately. Next time, you could run the runner directly.
@@ -74,150 +76,32 @@ If the registry succeed, it will run immediately. Next time, you could run the r
 ### Run
 
 ```bash
-./gitea-runner daemon
+./act_runner daemon
 ```
 
 ### Run with docker
 
 ```bash
-docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/runner:nightly
+docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/act_runner:nightly
 ```
 
-Mount a volume on `/data` if you want the registration file and optional config to survive container recreation (see [scripts/run.sh](scripts/run.sh)).
-
-### Image flavours
-
-The image is published in three flavours, all built from the single multi-stage [Dockerfile](Dockerfile) in this repository. They differ only in how a Docker daemon is made available to the jobs the runner executes; the `gitea-runner` binary inside them is identical.
-
-| Tag | Build target | Base image | Docker daemon | Process supervisor | Runs as |
-| --- | --- | --- | --- | --- | --- |
-| `latest` (and `<version>`) | `basic` | `alpine` | none — uses an external daemon you provide | [`tini`](https://github.com/krallin/tini) | `root` |
-| `latest-dind` | `dind` | `docker:dind` | bundled, started inside the container | [`s6`](https://skarnet.org/software/s6/) | `root` (privileged) |
-| `latest-dind-rootless` | `dind-rootless` | `docker:dind-rootless` | bundled, started rootless inside the container | [`s6`](https://skarnet.org/software/s6/) | `rootless` (UID 1000) |
-
-#### `latest` — basic
-
-The default flavour ships only the runner on a minimal Alpine base. It contains **no Docker daemon of its own**: jobs that use `docker://` images need a daemon supplied from outside the container, typically by bind-mounting the host's socket:
-
-```bash
-docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/runner:latest
-```
-
-`tini` is the entrypoint (it reaps zombie processes), and it just runs [`scripts/run.sh`](scripts/run.sh), which registers the runner on first start and then execs `gitea-runner daemon`. This flavour does not need `--privileged`. The trade-off is that jobs share the host's daemon, so they can see other containers and images on that daemon.
-
-#### `latest-dind` — Docker-in-Docker
-
-This flavour is based on the official `docker:dind` image and bundles its own Docker daemon, so it needs no external socket — only the `--privileged` flag that Docker-in-Docker requires:
-
-```bash
-docker run --privileged -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  --name my_runner gitea/runner:latest-dind
-```
-
-Two processes have to run side by side here (the Docker daemon and the runner), so the entrypoint is the [`s6`](https://skarnet.org/software/s6/) supervision tree under [`scripts/s6`](scripts/s6) instead of `tini`. `s6` starts `dockerd`, and the runner service waits for the daemon to come up (`s6-svwait`) before launching [`run.sh`](scripts/run.sh). Each container has a private daemon isolated from the host's, at the cost of running privileged.
-
-#### `latest-dind-rootless` — rootless Docker-in-Docker
-
-Same idea as `dind`, but built on `docker:dind-rootless` so the bundled daemon and the runner run as an unprivileged user (`rootless`, UID 1000) rather than `root`. `DOCKER_HOST` is preset to `unix:///run/user/1000/docker.sock` so the runner talks to the rootless daemon. This reduces the blast radius compared to the privileged `dind` flavour, but rootless Docker carries the usual rootless limitations (networking, cgroups, storage drivers, and some operations that need additional host configuration such as `/etc/subuid` / `/etc/subgid` mappings and unprivileged user-namespace support).
-
-> **Note on Podman:** these images target the Docker daemon. The bundled `dind`/`dind-rootless` daemons are `dockerd`, not Podman, and the `basic` flavour expects a Docker-compatible socket. Running them under rootless Podman is not a supported configuration, though pointing the `basic` flavour at a Podman socket that emulates the Docker API may work for some workloads.
-
 ### Configuration
 
-The runner is configured with a YAML file. Generate a starting point (this matches what ships in the tree):
+You can also configure the runner with a configuration file.
+The configuration file is a YAML file, you can generate a sample configuration file with `./act_runner generate-config`.
 
 ```bash
-./gitea-runner generate-config > config.yaml
+./act_runner generate-config > config.yaml
 ```
 
-Pass it with `-c` / `--config` on any command that loads configuration (`register`, `daemon`, `cache-server`):
+You can specify the configuration file path with `-c`/`--config` argument.
 
 ```bash
-./gitea-runner -c config.yaml register
-./gitea-runner -c config.yaml daemon
-./gitea-runner -c config.yaml cache-server
+./act_runner -c config.yaml register # register with config file
+./act_runner -c config.yaml daemon # run with config file
 ```
 
-Every option is described in [config.example.yaml](internal/pkg/config/config.example.yaml) (the same content `generate-config` prints).
-
-#### Without a config file
-
-If you omit `-c`, built-in defaults apply (same as an empty YAML document). A small set of **deprecated** environment variables can still override parts of that default config, but **only when no `-c` path was given**; they are ignored if you use a config file:
-
-| Variable | Effect |
-| --- | --- |
-| `GITEA_DEBUG` | If true, sets log level to `debug` |
-| `GITEA_TRACE` | If true, sets log level to `trace` |
-| `GITEA_RUNNER_CAPACITY` | Concurrent jobs (integer) |
-| `GITEA_RUNNER_FILE` | Registration state file path (default `.runner`) |
-| `GITEA_RUNNER_ENVIRON` | Extra job env vars as comma-separated `KEY:VALUE` pairs |
-| `GITEA_RUNNER_ENV_FILE` | Path to an env file merged into job env (same idea as `runner.env_file` in YAML) |
-
-Prefer a YAML file for all settings.
-
-#### Registration vs config labels
-
-If `runner.labels` is set in the YAML file, those labels are used during `register` and the `--labels` CLI flag is ignored.
-
-#### Caching (`actions/cache`)
-
-Each runner starts its own cache server automatically. Cache entries are local to that runner — runners do not share a cache by default.
-
-**Shared cache across multiple runners**
-
-Run one dedicated `gitea-runner cache-server` that all runners point at.
-
-1. Create a config file for the cache server host:
-
-   ```yaml
-   cache:
-     dir: /data/actcache
-     port: 8088
-     external_secret: "replace-with-a-strong-random-secret"
-   ```
-
-2. Start the server:
-
-   ```bash
-   gitea-runner -c cache-server-config.yaml cache-server
-   ```
-
-3. On every runner:
-
-   ```yaml
-   cache:
-     external_server: "http://<cache-server-host>:8088/"
-     external_secret: "replace-with-a-strong-random-secret"  # must match the server
-   ```
-
-Alternatively, mount the same NFS/CIFS share on every runner and point `cache.dir` at it — simpler, but with weaker isolation between repositories.
-
-**S3 / MinIO** — mount object storage as a FUSE filesystem (e.g. [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) or [goofys](https://github.com/kahing/goofys)) and set `cache.dir` to the mount point.
-
-Flags `--dir`, `--host`, and `--port` on `cache-server` override the corresponding `cache.*` YAML keys; all other settings, including `external_secret`, require the config file.
-
-#### Official Docker image
-
-Besides `GITEA_INSTANCE_URL` and `GITEA_RUNNER_REGISTRATION_TOKEN`, the image entrypoint supports optional variables such as `CONFIG_FILE` (passed through as `-c`), `GITEA_RUNNER_LABELS`, `GITEA_RUNNER_EPHEMERAL`, `GITEA_RUNNER_ONCE`, `GITEA_RUNNER_NAME`, `GITEA_MAX_REG_ATTEMPTS`, `RUNNER_STATE_FILE`, and `GITEA_RUNNER_REGISTRATION_TOKEN_FILE`. See [scripts/run.sh](scripts/run.sh) for exact behavior.
-
-For a fuller container-oriented walkthrough, see [examples/docker](examples/docker/README.md).
-
-When `container.bind_workdir` is enabled, stale task workspace directories can be cleaned while the runner is idle:
-- directories older than `runner.workdir_cleanup_age` are removed (default: `24h`; set `0` to disable)
-- cleanup runs every `runner.idle_cleanup_interval` (default: `10m`; set `0` to disable)
-- only purely numeric subdirectories under `container.workdir_parent` are treated as task workspaces and may be removed
-- cleanup assumes `container.workdir_parent` is not shared across multiple runners
-
-#### Post-task script (`runner.post_task_script`)
-
-Optional host script that runs **after** each task's built-in cleanup (post-steps, container teardown, bind-workdir removal). Use it for extra machine housekeeping — Docker pruning, disk cleanup, and similar.
-
-**While the script runs, the runner stops task heartbeats and stays offline from Gitea's perspective until the script exits (or hits `runner.post_task_script_timeout`, default `5m`).** A script that blocks without exiting keeps the runner from taking new work for up to that timeout. Script output goes to the runner log, not the job log; a non-zero exit is warned but does not change the job result.
-
-On Windows, use `.exe`, `.bat`, or `.cmd` paths; **PowerShell (`.ps1`) is not supported yet** as the configured path — wrap commands in a `.cmd` file instead.
-
-See **[docs/post-task-script.md](docs/post-task-script.md)** for lifecycle details, environment variables, timeout interaction, and platform notes.
+You can read the latest version of the configuration file online at [config.example.yaml](internal/pkg/config/config.example.yaml).
 
 ### Example Deployments
 

VERIFICATION

@@ -0,0 +1,5 @@
+VERIFICATION
+Verification is intended to assist the Chocolatey moderators and community
+in verifying that this package's contents are trustworthy.
+
+Checksums: https://github.com/nektos/act/releases, in the checksums.txt file

VERSION

@@ -0,0 +1 @@
+0.4.0

act-cli.nuspec

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Do not remove this test for UTF-8: if “Ω” doesn’t appear as greek uppercase omega letter enclosed in quotation marks, you should use an editor that supports UTF-8, not this one. -->
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>act-cli</id>
+    <version>0.0.0</version>
+    <packageSourceUrl>https://github.com/nektos/act</packageSourceUrl>
+    <owners>nektos</owners>
+    <title>act (GitHub Actions CLI)</title>
+    <authors>nektos</authors>
+    <projectUrl>https://github.com/nektos/act</projectUrl>
+    <iconUrl>https://raw.githubusercontent.com/wiki/nektos/act/img/logo-150.png</iconUrl>
+    <copyright>Nektos</copyright>
+    <licenseUrl>https://raw.githubusercontent.com/nektos/act/master/LICENSE</licenseUrl>
+    <requireLicenseAcceptance>true</requireLicenseAcceptance>
+    <projectSourceUrl>https://github.com/nektos/act</projectSourceUrl>
+    <docsUrl>https://raw.githubusercontent.com/nektos/act/master/README.md</docsUrl>
+    <bugTrackerUrl>https://github.com/nektos/act/issues</bugTrackerUrl>
+    <tags>act github-actions actions golang ci devops</tags>
+    <summary>Run your GitHub Actions locally 🚀</summary>
+    <description>Run your GitHub Actions locally 🚀</description>
+  </metadata>
+  <files>
+    <file src="tools/**" target="tools" />
+  </files>
+</package>

act/artifactcache/handler.go

@@ -1,879 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"context"
-	"crypto/hmac"
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/julienschmidt/httprouter"
-	"github.com/sirupsen/logrus"
-	"github.com/timshannon/bolthold"
-	"go.etcd.io/bbolt"
-)
-
-const (
-	apiPath      = "/_apis/artifactcache"
-	internalPath = "/_internal"
-
-	// artifactURLTTL bounds how long a signed artifactLocation URL stays valid.
-	// Short enough that a leaked URL is near-worthless; long enough to let the
-	// @actions/cache client download a big blob that was returned from /cache.
-	artifactURLTTL = 10 * time.Minute
-)
-
-type credKey struct{}
-
-// JobCredential ties a per-job bearer token (ACTIONS_RUNTIME_TOKEN) to the
-// repository that owns it. Every cache entry is stamped with Repo on
-// reserve/commit and checked on read/write so one repo can never observe or
-// poison another repo's cache, even from inside a container that reaches the
-// cache server over the docker bridge network.
-type JobCredential struct {
-	Repo string
-}
-
-// credEntry holds a registered job's credential along with an active
-// registration count. RegisterJob is reference-counted so that if two tasks
-// briefly share an ACTIONS_RUNTIME_TOKEN — e.g. a runner that retries a task
-// after a crash before the old registration is revoked — the first task's
-// revoker does not cut the second task's auth out from under it.
-type credEntry struct {
-	cred JobCredential
-	refs int
-}
-
-type Handler struct {
-	dir      string
-	storage  *Storage
-	router   *httprouter.Router
-	listener net.Listener
-	server   *http.Server
-	logger   logrus.FieldLogger
-
-	gcing atomic.Bool
-	gcAt  time.Time
-
-	outboundIP string
-
-	// internalSecret guards /_internal/{register,revoke}. When set, a remote
-	// runner can use these endpoints to pre-register per-job
-	// ACTIONS_RUNTIME_TOKENs against this server, enabling the same
-	// per-job auth and repo scoping as the embedded handler over the
-	// network. Empty disables the control-plane entirely.
-	internalSecret string
-
-	// secret signs short-lived artifact download URLs. The @actions/cache
-	// toolkit does not send Authorization on the download request, so blob
-	// GETs authenticate via a per-URL HMAC signature with expiry rather than
-	// via the bearer token used for management endpoints.
-	secret []byte
-
-	credMu sync.RWMutex
-	creds  map[string]*credEntry
-}
-
-// StartHandler opens the on-disk cache store and starts the HTTP server.
-//
-// internalSecret, when non-empty, enables a control-plane API at
-// /_internal/{register,revoke} that lets a remote runner pre-register the
-// per-job ACTIONS_RUNTIME_TOKENs it expects this server to honor. The
-// embedded in-process handler leaves it empty and registers tokens via the
-// in-process RegisterJob method directly.
-func StartHandler(dir, outboundIP string, port uint16, internalSecret string, logger logrus.FieldLogger) (*Handler, error) {
-	h := &Handler{
-		creds:          make(map[string]*credEntry),
-		internalSecret: internalSecret,
-	}
-
-	if logger == nil {
-		discard := logrus.New()
-		discard.Out = io.Discard
-		logger = discard
-	}
-	logger = logger.WithField("module", "artifactcache")
-	h.logger = logger
-
-	if dir == "" {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return nil, err
-		}
-		dir = filepath.Join(home, ".cache", "actcache")
-	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return nil, err
-	}
-
-	h.dir = dir
-
-	storage, err := NewStorage(filepath.Join(dir, "cache"))
-	if err != nil {
-		return nil, err
-	}
-	h.storage = storage
-
-	if outboundIP != "" {
-		h.outboundIP = outboundIP
-	} else if ip := common.GetOutboundIP(); ip == nil {
-		return nil, errors.New("unable to determine outbound IP address")
-	} else {
-		h.outboundIP = ip.String()
-	}
-
-	secret, err := loadOrCreateSecret(dir)
-	if err != nil {
-		return nil, err
-	}
-	h.secret = secret
-
-	router := httprouter.New()
-	router.GET(apiPath+"/cache", h.bearerAuth(h.find))
-	router.POST(apiPath+"/caches", h.bearerAuth(h.reserve))
-	router.PATCH(apiPath+"/caches/:id", h.bearerAuth(h.upload))
-	router.POST(apiPath+"/caches/:id", h.bearerAuth(h.commit))
-	router.POST(apiPath+"/clean", h.bearerAuth(h.clean))
-	// Artifact GET is signed via query-string HMAC because @actions/cache
-	// does not attach Authorization when downloading archiveLocation.
-	router.GET(apiPath+"/artifacts/:id", h.signedURLAuth(h.get))
-	// Control-plane: a remote runner registers/revokes per-job tokens so the
-	// cache API can authenticate them. Always wired so the routes exist; the
-	// handlers themselves 401 when internalSecret is unset.
-	router.POST(internalPath+"/register", h.internalAuth(h.internalRegister))
-	router.POST(internalPath+"/revoke", h.internalAuth(h.internalRevoke))
-
-	h.router = router
-
-	h.gcCache()
-
-	// Listen on all interfaces. Binding to outboundIP only would give no real
-	// security benefit (it is the LAN/internet-facing address either way) and
-	// can break Docker Desktop variants where the host's outbound IP is not
-	// routable from inside the container network. Authentication is enforced
-	// by the bearer middleware and per-repo scoping, not by reachability.
-	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
-	if err != nil {
-		return nil, err
-	}
-	server := &http.Server{
-		ReadHeaderTimeout: 2 * time.Second,
-		Handler:           router,
-	}
-	go func() {
-		if err := server.Serve(listener); err != nil && errors.Is(err, net.ErrClosed) {
-			logger.Errorf("http serve: %v", err)
-		}
-	}()
-	h.listener = listener
-	h.server = server
-
-	return h, nil
-}
-
-func (h *Handler) ExternalURL() string {
-	// TODO: make the external url configurable if necessary
-	return fmt.Sprintf("http://%s:%d",
-		h.outboundIP,
-		h.listener.Addr().(*net.TCPAddr).Port)
-}
-
-// RegisterJob makes token a valid bearer credential for cache requests from
-// the given repository and returns a function that removes it. The runner
-// calls this at job start and defers the returned func so that the credential
-// is only accepted while the job is running.
-//
-// Registrations are reference-counted: if a token is already registered, the
-// existing repo is kept and the refcount is incremented. The entry is
-// removed only when every revoker returned by RegisterJob has been called.
-// This keeps a stray re-registration from silently revoking a live job.
-func (h *Handler) RegisterJob(token, repo string) func() {
-	if h == nil || token == "" {
-		return func() {}
-	}
-	h.credMu.Lock()
-	if existing, ok := h.creds[token]; ok {
-		existing.refs++
-	} else {
-		h.creds[token] = &credEntry{
-			cred: JobCredential{Repo: repo},
-			refs: 1,
-		}
-	}
-	h.credMu.Unlock()
-	return func() {
-		h.credMu.Lock()
-		if entry, ok := h.creds[token]; ok {
-			entry.refs--
-			if entry.refs <= 0 {
-				delete(h.creds, token)
-			}
-		}
-		h.credMu.Unlock()
-	}
-}
-
-// RevokeJob explicitly revokes one registration of token, mirroring one call
-// of the closure returned by RegisterJob. Used by the control-plane endpoint
-// so a remote runner can revoke without holding the closure.
-func (h *Handler) RevokeJob(token string) {
-	if h == nil || token == "" {
-		return
-	}
-	h.credMu.Lock()
-	if entry, ok := h.creds[token]; ok {
-		entry.refs--
-		if entry.refs <= 0 {
-			delete(h.creds, token)
-		}
-	}
-	h.credMu.Unlock()
-}
-
-func (h *Handler) lookupCredential(token string) (JobCredential, bool) {
-	h.credMu.RLock()
-	entry, ok := h.creds[token]
-	h.credMu.RUnlock()
-	if !ok {
-		return JobCredential{}, false
-	}
-	return entry.cred, true
-}
-
-// loadOrCreateSecret returns the 32-byte HMAC signing key for artifact URLs,
-// persisted in dir/.secret so signed URLs handed out before a restart stay
-// valid across the restart and so the standalone cache-server can be pointed
-// at by config.Cache.ExternalServer without the URL rotating.
-func loadOrCreateSecret(dir string) ([]byte, error) {
-	path := filepath.Join(dir, ".secret")
-	if data, err := os.ReadFile(path); err == nil {
-		if secret, err := hex.DecodeString(strings.TrimSpace(string(data))); err == nil && len(secret) >= 32 {
-			return secret, nil
-		}
-	} else if !os.IsNotExist(err) {
-		return nil, fmt.Errorf("read cache secret: %w", err)
-	}
-	secret := make([]byte, 32)
-	if _, err := rand.Read(secret); err != nil {
-		return nil, fmt.Errorf("generate cache secret: %w", err)
-	}
-	if err := os.WriteFile(path, []byte(hex.EncodeToString(secret)), 0o600); err != nil {
-		return nil, fmt.Errorf("write cache secret: %w", err)
-	}
-	return secret, nil
-}
-
-func (h *Handler) Close() error {
-	if h == nil {
-		return nil
-	}
-	var retErr error
-	if h.server != nil {
-		err := h.server.Close()
-		if err != nil {
-			retErr = err
-		}
-		h.server = nil
-	}
-	if h.listener != nil {
-		err := h.listener.Close()
-		if errors.Is(err, net.ErrClosed) {
-			err = nil
-		}
-		if err != nil {
-			retErr = err
-		}
-		h.listener = nil
-	}
-	return retErr
-}
-
-func (h *Handler) openDB() (*bolthold.Store, error) {
-	return bolthold.Open(filepath.Join(h.dir, "bolt.db"), 0o644, &bolthold.Options{
-		Encoder: json.Marshal,
-		Decoder: json.Unmarshal,
-		Options: &bbolt.Options{
-			Timeout:      5 * time.Second,
-			NoGrowSync:   bbolt.DefaultOptions.NoGrowSync,
-			FreelistType: bbolt.DefaultOptions.FreelistType,
-		},
-	})
-}
-
-// GET /_apis/artifactcache/cache
-func (h *Handler) find(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	cred := credFromContext(r.Context())
-	keys := strings.Split(r.URL.Query().Get("keys"), ",")
-	version := r.URL.Query().Get("version")
-
-	db, err := h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
-
-	cache, err := findCache(db, cred.Repo, keys, version)
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	if cache == nil {
-		h.responseJSON(w, r, 204)
-		return
-	}
-
-	if ok, err := h.storage.Exist(cache.ID); err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	} else if !ok {
-		_ = db.Delete(cache.ID, cache)
-		h.responseJSON(w, r, 204)
-		return
-	}
-	h.responseJSON(w, r, 200, map[string]any{
-		"result":          "hit",
-		"archiveLocation": h.signedArtifactURL(cache.ID, time.Now().Add(artifactURLTTL)),
-		"cacheKey":        cache.Key,
-	})
-}
-
-// POST /_apis/artifactcache/caches
-func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	cred := credFromContext(r.Context())
-	api := &Request{}
-	if err := json.NewDecoder(r.Body).Decode(api); err != nil {
-		h.responseJSON(w, r, 400, err)
-		return
-	}
-
-	cache := api.ToCache()
-	cache.Repo = cred.Repo
-	db, err := h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
-
-	now := time.Now().Unix()
-	cache.CreatedAt = now
-	cache.UsedAt = now
-	if err := insertCache(db, cache); err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	h.responseJSON(w, r, 200, map[string]any{
-		"cacheId": cache.ID,
-	})
-}
-
-// PATCH /_apis/artifactcache/caches/:id
-func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
-	cred := credFromContext(r.Context())
-	id, err := strconv.ParseInt(params.ByName("id"), 10, 64)
-	if err != nil {
-		h.responseJSON(w, r, 400, err)
-		return
-	}
-
-	cache := &Cache{}
-	db, err := h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
-	if err := db.Get(id, cache); err != nil {
-		if errors.Is(err, bolthold.ErrNotFound) {
-			h.responseJSON(w, r, 400, fmt.Errorf("cache %d: not reserved", id))
-			return
-		}
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-
-	if cache.Repo != cred.Repo {
-		h.responseJSON(w, r, 403, fmt.Errorf("cache %d: forbidden", id))
-		return
-	}
-
-	if cache.Complete {
-		h.responseJSON(w, r, 400, fmt.Errorf("cache %v %q: already complete", cache.ID, cache.Key))
-		return
-	}
-	db.Close()
-	start, _, err := parseContentRange(r.Header.Get("Content-Range"))
-	if err != nil {
-		h.responseJSON(w, r, 400, err)
-		return
-	}
-	if err := h.storage.Write(cache.ID, start, r.Body); err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	h.useCache(id)
-	h.responseJSON(w, r, 200)
-}
-
-// POST /_apis/artifactcache/caches/:id
-func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
-	cred := credFromContext(r.Context())
-	id, err := strconv.ParseInt(params.ByName("id"), 10, 64)
-	if err != nil {
-		h.responseJSON(w, r, 400, err)
-		return
-	}
-
-	cache := &Cache{}
-	db, err := h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
-	if err := db.Get(id, cache); err != nil {
-		if errors.Is(err, bolthold.ErrNotFound) {
-			h.responseJSON(w, r, 400, fmt.Errorf("cache %d: not reserved", id))
-			return
-		}
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-
-	if cache.Repo != cred.Repo {
-		h.responseJSON(w, r, 403, fmt.Errorf("cache %d: forbidden", id))
-		return
-	}
-
-	if cache.Complete {
-		h.responseJSON(w, r, 400, fmt.Errorf("cache %v %q: already complete", cache.ID, cache.Key))
-		return
-	}
-
-	db.Close()
-
-	size, err := h.storage.Commit(cache.ID, cache.Size)
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	// write real size back to cache, it may be different from the current value when the request doesn't specify it.
-	cache.Size = size
-
-	db, err = h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
-
-	cache.Complete = true
-	if err := db.Update(cache.ID, cache); err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-
-	h.responseJSON(w, r, 200)
-}
-
-// GET /_apis/artifactcache/artifacts/:id
-// Authenticated via signed URL (see signedURLAuth), not bearer, because the
-// @actions/cache toolkit downloads archiveLocation without Authorization.
-// Repository scoping is already enforced at find() time; the signature binds
-// the URL to the specific cache ID and an expiry.
-func (h *Handler) get(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
-	id, err := strconv.ParseInt(params.ByName("id"), 10, 64)
-	if err != nil {
-		h.responseJSON(w, r, 400, err)
-		return
-	}
-	h.useCache(id)
-	h.storage.Serve(w, r, uint64(id))
-}
-
-// POST /_apis/artifactcache/clean
-func (h *Handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	// TODO: don't support force deleting cache entries
-	// see: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#force-deleting-cache-entries
-
-	h.responseJSON(w, r, 200)
-}
-
-// bearerAuth resolves ACTIONS_RUNTIME_TOKEN against the set of currently
-// registered jobs. A match attaches the job's JobCredential to the request
-// context; a miss returns 401 before the handler body runs.
-func (h *Handler) bearerAuth(handler httprouter.Handle) httprouter.Handle {
-	return func(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
-		h.logger.Debugf("%s %s", r.Method, r.URL.Path)
-		token := bearerToken(r)
-		if token == "" {
-			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("missing bearer token"))
-			return
-		}
-		cred, ok := h.lookupCredential(token)
-		if !ok {
-			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("unknown bearer token"))
-			return
-		}
-		ctx := context.WithValue(r.Context(), credKey{}, cred)
-		handler(w, r.WithContext(ctx), params)
-		go h.gcCache()
-	}
-}
-
-func (h *Handler) signedURLAuth(handler httprouter.Handle) httprouter.Handle {
-	return func(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
-		h.logger.Debugf("%s %s", r.Method, r.URL.Path)
-		id, err := strconv.ParseInt(params.ByName("id"), 10, 64)
-		if err != nil {
-			h.responseJSON(w, r, 400, err)
-			return
-		}
-		expStr := r.URL.Query().Get("exp")
-		sig := r.URL.Query().Get("sig")
-		if expStr == "" || sig == "" {
-			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("missing signature"))
-			return
-		}
-		exp, err := strconv.ParseInt(expStr, 10, 64)
-		if err != nil {
-			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("invalid expiry"))
-			return
-		}
-		if time.Now().Unix() > exp {
-			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("signature expired"))
-			return
-		}
-		expected := h.computeSignature(id, exp)
-		if !hmac.Equal([]byte(sig), []byte(expected)) {
-			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("bad signature"))
-			return
-		}
-		handler(w, r, params)
-		go h.gcCache()
-	}
-}
-
-// internalAuth gates the control-plane endpoints. The bearer must
-// constant-time-equal the configured internalSecret. If the secret is empty,
-// the control-plane is disabled and every request gets 404 — which matches
-// the upstream nektos/act behavior of "the route does not exist".
-func (h *Handler) internalAuth(handler httprouter.Handle) httprouter.Handle {
-	return func(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
-		if h.internalSecret == "" {
-			http.NotFound(w, r)
-			return
-		}
-		token := bearerToken(r)
-		if token == "" || !hmac.Equal([]byte(token), []byte(h.internalSecret)) {
-			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("internal: bad secret"))
-			return
-		}
-		handler(w, r, params)
-	}
-}
-
-type internalRegisterBody struct {
-	Token string `json:"token"`
-	Repo  string `json:"repo"`
-}
-
-type internalRevokeBody struct {
-	Token string `json:"token"`
-}
-
-// POST /_internal/register
-func (h *Handler) internalRegister(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	var body internalRegisterBody
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		h.responseJSON(w, r, http.StatusBadRequest, err)
-		return
-	}
-	if body.Token == "" {
-		h.responseJSON(w, r, http.StatusBadRequest, errors.New("token is required"))
-		return
-	}
-	h.RegisterJob(body.Token, body.Repo)
-	h.responseJSON(w, r, http.StatusOK)
-}
-
-// POST /_internal/revoke
-func (h *Handler) internalRevoke(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	var body internalRevokeBody
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		h.responseJSON(w, r, http.StatusBadRequest, err)
-		return
-	}
-	if body.Token == "" {
-		h.responseJSON(w, r, http.StatusBadRequest, errors.New("token is required"))
-		return
-	}
-	h.RevokeJob(body.Token)
-	h.responseJSON(w, r, http.StatusOK)
-}
-
-func bearerToken(r *http.Request) string {
-	auth := r.Header.Get("Authorization")
-	const prefix = "Bearer "
-	if len(auth) > len(prefix) && strings.EqualFold(auth[:len(prefix)], prefix) {
-		return auth[len(prefix):]
-	}
-	return ""
-}
-
-func credFromContext(ctx context.Context) JobCredential {
-	if cred, ok := ctx.Value(credKey{}).(JobCredential); ok {
-		return cred
-	}
-	return JobCredential{}
-}
-
-func (h *Handler) computeSignature(cacheID, exp int64) string {
-	mac := hmac.New(sha256.New, h.secret)
-	fmt.Fprintf(mac, "%d:%d", cacheID, exp)
-	return hex.EncodeToString(mac.Sum(nil))
-}
-
-func (h *Handler) signedArtifactURL(cacheID uint64, exp time.Time) string {
-	expUnix := exp.Unix()
-	sig := h.computeSignature(int64(cacheID), expUnix)
-	q := url.Values{}
-	q.Set("exp", strconv.FormatInt(expUnix, 10))
-	q.Set("sig", sig)
-	return fmt.Sprintf("%s%s/artifacts/%d?%s", h.ExternalURL(), apiPath, cacheID, q.Encode())
-}
-
-// if not found, return (nil, nil) instead of an error.
-func findCache(db *bolthold.Store, repo string, keys []string, version string) (*Cache, error) {
-	cache := &Cache{}
-	for _, prefix := range keys {
-		// if a key in the list matches exactly, don't return partial matches
-		if err := db.FindOne(cache,
-			bolthold.Where("Repo").Eq(repo).
-				And("Key").Eq(prefix).
-				And("Version").Eq(version).
-				And("Complete").Eq(true).
-				SortBy("CreatedAt").Reverse()); err == nil || !errors.Is(err, bolthold.ErrNotFound) {
-			if err != nil {
-				return nil, fmt.Errorf("find cache: %w", err)
-			}
-			return cache, nil
-		}
-		prefixPattern := "^" + regexp.QuoteMeta(prefix)
-		re, err := regexp.Compile(prefixPattern)
-		if err != nil {
-			continue
-		}
-		if err := db.FindOne(cache,
-			bolthold.Where("Repo").Eq(repo).
-				And("Key").RegExp(re).
-				And("Version").Eq(version).
-				And("Complete").Eq(true).
-				SortBy("CreatedAt").Reverse()); err != nil {
-			if errors.Is(err, bolthold.ErrNotFound) {
-				continue
-			}
-			return nil, fmt.Errorf("find cache: %w", err)
-		}
-		return cache, nil
-	}
-	return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-}
-
-func insertCache(db *bolthold.Store, cache *Cache) error {
-	if err := db.Insert(bolthold.NextSequence(), cache); err != nil {
-		return fmt.Errorf("insert cache: %w", err)
-	}
-	// write back id to db
-	if err := db.Update(cache.ID, cache); err != nil {
-		return fmt.Errorf("write back id to db: %w", err)
-	}
-	return nil
-}
-
-func (h *Handler) useCache(id int64) {
-	db, err := h.openDB()
-	if err != nil {
-		return
-	}
-	defer db.Close()
-	cache := &Cache{}
-	if err := db.Get(id, cache); err != nil {
-		return
-	}
-	cache.UsedAt = time.Now().Unix()
-	_ = db.Update(cache.ID, cache)
-}
-
-const (
-	keepUsed   = 30 * 24 * time.Hour
-	keepUnused = 7 * 24 * time.Hour
-	keepTemp   = 5 * time.Minute
-	keepOld    = 5 * time.Minute
-)
-
-func (h *Handler) gcCache() {
-	if h.gcing.Load() {
-		return
-	}
-	if !h.gcing.CompareAndSwap(false, true) {
-		return
-	}
-	defer h.gcing.Store(false)
-
-	if time.Since(h.gcAt) < time.Hour {
-		h.logger.Debugf("skip gc: %v", h.gcAt.String())
-		return
-	}
-	h.gcAt = time.Now()
-	h.logger.Debugf("gc: %v", h.gcAt.String())
-
-	db, err := h.openDB()
-	if err != nil {
-		return
-	}
-	defer db.Close()
-
-	// Remove the caches which are not completed for a while, they are most likely to be broken.
-	var caches []*Cache
-	if err := db.Find(&caches, bolthold.
-		Where("UsedAt").Lt(time.Now().Add(-keepTemp).Unix()).
-		And("Complete").Eq(false),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
-	}
-
-	// Remove the old caches which have not been used recently.
-	caches = caches[:0]
-	if err := db.Find(&caches, bolthold.
-		Where("UsedAt").Lt(time.Now().Add(-keepUnused).Unix()),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
-	}
-
-	// Remove the old caches which are too old.
-	caches = caches[:0]
-	if err := db.Find(&caches, bolthold.
-		Where("CreatedAt").Lt(time.Now().Add(-keepUsed).Unix()),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
-	}
-
-	// Remove the old caches with the same key and version within the same
-	// repository, keep the latest one. Aggregation must include Repo so two
-	// repos that happen to share a (key, version) do not evict each other —
-	// otherwise per-repo scoping holds for reads but one repo can age
-	// another out after keepOld.
-	// Also keep the olds which have been used recently for a while in case of the cache is still in use.
-	if results, err := db.FindAggregate(
-		&Cache{},
-		bolthold.Where("Complete").Eq(true),
-		"Repo", "Key", "Version",
-	); err != nil {
-		h.logger.Warnf("find aggregate caches: %v", err)
-	} else {
-		for _, result := range results {
-			if result.Count() <= 1 {
-				continue
-			}
-			result.Sort("CreatedAt")
-			caches = caches[:0]
-			result.Reduction(&caches)
-			for _, cache := range caches[:len(caches)-1] {
-				if time.Since(time.Unix(cache.UsedAt, 0)) < keepOld {
-					// Keep it since it has been used recently, even if it's old.
-					// Or it could break downloading in process.
-					continue
-				}
-				h.storage.Remove(cache.ID)
-				if err := db.Delete(cache.ID, cache); err != nil {
-					h.logger.Warnf("delete cache: %v", err)
-					continue
-				}
-				h.logger.Infof("deleted cache: %+v", cache)
-			}
-		}
-	}
-}
-
-func (h *Handler) responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	var data []byte
-	if len(v) == 0 || v[0] == nil {
-		data, _ = json.Marshal(struct{}{})
-	} else if err, ok := v[0].(error); ok {
-		h.logger.Errorf("%v %v: %v", r.Method, r.URL.Path, err)
-		data, _ = json.Marshal(map[string]any{
-			"error": err.Error(),
-		})
-	} else {
-		data, _ = json.Marshal(v[0])
-	}
-	w.WriteHeader(code)
-	_, _ = w.Write(data)
-}
-
-func parseContentRange(s string) (int64, int64, error) {
-	// support the format like "bytes 11-22/*" only
-	s, _, _ = strings.Cut(strings.TrimPrefix(s, "bytes "), "/")
-	s1, s2, _ := strings.Cut(s, "-")
-
-	start, err := strconv.ParseInt(s1, 10, 64)
-	if err != nil {
-		return 0, 0, fmt.Errorf("parse %q: %w", s, err)
-	}
-	stop, err := strconv.ParseInt(s2, 10, 64)
-	if err != nil {
-		return 0, 0, fmt.Errorf("parse %q: %w", s, err)
-	}
-	return start, stop, nil
-}

act/common/context_helpers_test.go

@@ -1,73 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-)
-
-func TestDryrunContext(t *testing.T) {
-	ctx := context.Background()
-	if Dryrun(ctx) {
-		t.Fatal("plain context should not be dryrun")
-	}
-	if !Dryrun(WithDryrun(ctx, true)) {
-		t.Fatal("WithDryrun(true) should set dryrun")
-	}
-	if Dryrun(WithDryrun(ctx, false)) {
-		t.Fatal("WithDryrun(false) should clear dryrun")
-	}
-}
-
-func TestJobErrorContainer(t *testing.T) {
-	ctx := context.Background()
-	err := errors.New("job failed")
-
-	SetJobError(ctx, err)
-	if got := JobError(ctx); got != nil {
-		t.Fatalf("JobError without container = %v, want nil", got)
-	}
-
-	ctx = WithJobErrorContainer(ctx)
-	SetJobError(ctx, err)
-	if got := JobError(ctx); !errors.Is(got, err) {
-		t.Fatalf("JobError = %v, want %v", got, err)
-	}
-}
-
-func TestLoggerAndHookContext(t *testing.T) {
-	ctx := context.Background()
-	if Logger(ctx) != logrus.StandardLogger() {
-		t.Fatal("plain context should use standard logger")
-	}
-	if LoggerHook(ctx) != nil {
-		t.Fatal("plain context should not have a logger hook")
-	}
-
-	logger := logrus.New()
-	ctx = WithLogger(ctx, logger)
-	if Logger(ctx) != logger {
-		t.Fatal("WithLogger should set logger")
-	}
-
-	hook := testHook{}
-	ctx = WithLoggerHook(ctx, hook)
-	if LoggerHook(ctx) != hook {
-		t.Fatal("WithLoggerHook should set hook")
-	}
-}
-
-type testHook struct{}
-
-func (testHook) Levels() []logrus.Level {
-	return logrus.AllLevels
-}
-
-func (testHook) Fire(*logrus.Entry) error {
-	return nil
-}

act/common/executor_max_parallel_test.go

@@ -1,89 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// Simple fast test that verifies max-parallel: 2 limits concurrency
-func TestMaxParallel2Quick(t *testing.T) {
-	ctx := context.Background()
-
-	var currentRunning atomic.Int32
-	var maxSimultaneous atomic.Int32
-
-	executors := make([]Executor, 4)
-	for i := range 4 {
-		executors[i] = func(ctx context.Context) error {
-			current := currentRunning.Add(1)
-
-			// Update max if needed
-			for {
-				maxValue := maxSimultaneous.Load()
-				if current <= maxValue || maxSimultaneous.CompareAndSwap(maxValue, current) {
-					break
-				}
-			}
-
-			time.Sleep(10 * time.Millisecond)
-			currentRunning.Add(-1)
-			return nil
-		}
-	}
-
-	err := NewParallelExecutor(2, executors...)(ctx)
-
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.LessOrEqual(t, maxSimultaneous.Load(), int32(2),
-		"Should not exceed max-parallel: 2")
-}
-
-// Test that verifies max-parallel: 1 enforces sequential execution
-func TestMaxParallel1Sequential(t *testing.T) {
-	ctx := context.Background()
-
-	var currentRunning atomic.Int32
-	var maxSimultaneous atomic.Int32
-	var executionOrder []int
-	var orderMutex sync.Mutex
-
-	executors := make([]Executor, 5)
-	for i := range 5 {
-		taskID := i
-		executors[i] = func(ctx context.Context) error {
-			current := currentRunning.Add(1)
-
-			// Track execution order
-			orderMutex.Lock()
-			executionOrder = append(executionOrder, taskID)
-			orderMutex.Unlock()
-
-			// Update max if needed
-			for {
-				maxValue := maxSimultaneous.Load()
-				if current <= maxValue || maxSimultaneous.CompareAndSwap(maxValue, current) {
-					break
-				}
-			}
-
-			time.Sleep(20 * time.Millisecond)
-			currentRunning.Add(-1)
-			return nil
-		}
-	}
-
-	err := NewParallelExecutor(1, executors...)(ctx)
-
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, int32(1), maxSimultaneous.Load(),
-		"max-parallel: 1 should only run 1 task at a time")
-	assert.Len(t, executionOrder, 5, "All 5 tasks should have executed")
-}

act/common/executor_parallel_advanced_test.go

@@ -1,221 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestMaxParallelJobExecution tests actual job execution with max-parallel
-func TestMaxParallelJobExecution(t *testing.T) {
-	t.Run("MaxParallel=1 Sequential", func(t *testing.T) {
-		var currentRunning atomic.Int32
-		var maxConcurrent int32
-		var executionOrder []int
-		var mu sync.Mutex
-
-		executors := make([]Executor, 5)
-		for i := range 5 {
-			taskID := i
-			executors[i] = func(ctx context.Context) error {
-				current := currentRunning.Add(1)
-
-				// Track max concurrent
-				for {
-					maxValue := atomic.LoadInt32(&maxConcurrent)
-					if current <= maxValue || atomic.CompareAndSwapInt32(&maxConcurrent, maxValue, current) {
-						break
-					}
-				}
-
-				mu.Lock()
-				executionOrder = append(executionOrder, taskID)
-				mu.Unlock()
-
-				time.Sleep(10 * time.Millisecond)
-				currentRunning.Add(-1)
-				return nil
-			}
-		}
-
-		ctx := context.Background()
-		err := NewParallelExecutor(1, executors...)(ctx)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-		assert.Equal(t, int32(1), maxConcurrent, "Should never exceed 1 concurrent execution")
-		assert.Len(t, executionOrder, 5, "All tasks should execute")
-	})
-
-	t.Run("MaxParallel=3 Limited", func(t *testing.T) {
-		var currentRunning atomic.Int32
-		var maxConcurrent int32
-
-		executors := make([]Executor, 10)
-		for i := range 10 {
-			executors[i] = func(ctx context.Context) error {
-				current := currentRunning.Add(1)
-
-				for {
-					maxValue := atomic.LoadInt32(&maxConcurrent)
-					if current <= maxValue || atomic.CompareAndSwapInt32(&maxConcurrent, maxValue, current) {
-						break
-					}
-				}
-
-				time.Sleep(20 * time.Millisecond)
-				currentRunning.Add(-1)
-				return nil
-			}
-		}
-
-		ctx := context.Background()
-		err := NewParallelExecutor(3, executors...)(ctx)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-		assert.LessOrEqual(t, int(maxConcurrent), 3, "Should never exceed 3 concurrent executions")
-		assert.GreaterOrEqual(t, int(maxConcurrent), 1, "Should have at least 1 concurrent execution")
-	})
-
-	t.Run("MaxParallel=0 Uses1Worker", func(t *testing.T) {
-		var maxConcurrent int32
-		var currentRunning atomic.Int32
-
-		executors := make([]Executor, 5)
-		for i := range 5 {
-			executors[i] = func(ctx context.Context) error {
-				current := currentRunning.Add(1)
-
-				for {
-					maxValue := atomic.LoadInt32(&maxConcurrent)
-					if current <= maxValue || atomic.CompareAndSwapInt32(&maxConcurrent, maxValue, current) {
-						break
-					}
-				}
-
-				time.Sleep(10 * time.Millisecond)
-				currentRunning.Add(-1)
-				return nil
-			}
-		}
-
-		ctx := context.Background()
-		// When maxParallel is 0 or negative, it defaults to 1
-		err := NewParallelExecutor(0, executors...)(ctx)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-		assert.Equal(t, int32(1), maxConcurrent, "Should use 1 worker when max-parallel is 0")
-	})
-}
-
-// TestMaxParallelWithErrors tests error handling with max-parallel
-func TestMaxParallelWithErrors(t *testing.T) {
-	t.Run("OneTaskFailsOthersContinue", func(t *testing.T) {
-		var successCount int32
-
-		executors := make([]Executor, 5)
-		for i := range 5 {
-			taskID := i
-			executors[i] = func(ctx context.Context) error {
-				if taskID == 2 {
-					return assert.AnError
-				}
-				atomic.AddInt32(&successCount, 1)
-				return nil
-			}
-		}
-
-		ctx := context.Background()
-		err := NewParallelExecutor(2, executors...)(ctx)
-
-		// Should return the error from task 2
-		assert.Error(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-		// Other tasks should still execute
-		assert.Equal(t, int32(4), successCount, "4 tasks should succeed")
-	})
-
-	t.Run("ContextCancellation", func(t *testing.T) {
-		ctx, cancel := context.WithCancel(context.Background())
-
-		var startedCount int32
-		executors := make([]Executor, 10)
-		for i := range 10 {
-			executors[i] = func(ctx context.Context) error {
-				atomic.AddInt32(&startedCount, 1)
-				time.Sleep(100 * time.Millisecond)
-				return nil
-			}
-		}
-
-		// Cancel after a short delay
-		go func() {
-			time.Sleep(30 * time.Millisecond)
-			cancel()
-		}()
-
-		err := NewParallelExecutor(3, executors...)(ctx)
-		assert.Error(t, err)                     //nolint:testifylint // pre-existing issue from nektos/act
-		assert.ErrorIs(t, err, context.Canceled) //nolint:testifylint // pre-existing issue from nektos/act
-
-		// Not all tasks should start due to cancellation (but timing may vary)
-		// Just verify cancellation occurred
-		t.Logf("Started %d tasks before cancellation", startedCount)
-	})
-}
-
-// TestMaxParallelResourceSharing tests resource sharing scenarios
-func TestMaxParallelResourceSharing(t *testing.T) {
-	t.Run("SharedResourceWithMutex", func(t *testing.T) {
-		var sharedCounter int
-		var mu sync.Mutex
-
-		executors := make([]Executor, 100)
-		for i := range 100 {
-			executors[i] = func(ctx context.Context) error {
-				mu.Lock()
-				sharedCounter++
-				mu.Unlock()
-				return nil
-			}
-		}
-
-		ctx := context.Background()
-		err := NewParallelExecutor(10, executors...)(ctx)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-		assert.Equal(t, 100, sharedCounter, "All tasks should increment counter")
-	})
-
-	t.Run("ChannelCommunication", func(t *testing.T) {
-		resultChan := make(chan int, 50)
-
-		executors := make([]Executor, 50)
-		for i := range 50 {
-			taskID := i
-			executors[i] = func(ctx context.Context) error {
-				resultChan <- taskID
-				return nil
-			}
-		}
-
-		ctx := context.Background()
-		err := NewParallelExecutor(5, executors...)(ctx)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-		close(resultChan)
-
-		results := make(map[int]bool)
-		for result := range resultChan {
-			results[result] = true
-		}
-
-		assert.Len(t, results, 50, "All task IDs should be received")
-	})
-}

act/common/executor_test.go

@@ -1,214 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"errors"
-	"reflect"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewWorkflow(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-
-	// empty
-	emptyWorkflow := NewPipelineExecutor()
-	assert.NoError(emptyWorkflow(ctx)) //nolint:testifylint // pre-existing issue from nektos/act
-
-	// error case
-	errorWorkflow := NewErrorExecutor(errors.New("test error"))
-	assert.Error(errorWorkflow(ctx)) //nolint:testifylint // pre-existing issue from nektos/act
-
-	// multiple success case
-	runcount := 0
-	successWorkflow := NewPipelineExecutor(
-		func(ctx context.Context) error {
-			runcount++
-			return nil
-		},
-		func(ctx context.Context) error {
-			runcount++
-			return nil
-		})
-	assert.NoError(successWorkflow(ctx)) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(2, runcount)
-}
-
-func TestNewConditionalExecutor(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-
-	trueCount := 0
-	falseCount := 0
-
-	err := NewConditionalExecutor(func(ctx context.Context) bool {
-		return false
-	}, func(ctx context.Context) error {
-		trueCount++
-		return nil
-	}, func(ctx context.Context) error {
-		falseCount++
-		return nil
-	})(ctx)
-
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(0, trueCount)
-	assert.Equal(1, falseCount)
-
-	err = NewConditionalExecutor(func(ctx context.Context) bool {
-		return true
-	}, func(ctx context.Context) error {
-		trueCount++
-		return nil
-	}, func(ctx context.Context) error {
-		falseCount++
-		return nil
-	})(ctx)
-
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(1, trueCount)
-	assert.Equal(1, falseCount)
-}
-
-func TestNewParallelExecutor(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-
-	var count, activeCount, maxCount atomic.Int32
-	emptyWorkflow := NewPipelineExecutor(func(ctx context.Context) error {
-		count.Add(1)
-
-		active := activeCount.Add(1)
-		for {
-			m := maxCount.Load()
-			if active <= m || maxCount.CompareAndSwap(m, active) {
-				break
-			}
-		}
-		time.Sleep(2 * time.Second)
-		activeCount.Add(-1)
-
-		return nil
-	})
-
-	err := NewParallelExecutor(2, emptyWorkflow, emptyWorkflow, emptyWorkflow)(ctx)
-
-	assert.Equal(int32(3), count.Load(), "should run all 3 executors")
-	assert.Equal(int32(2), maxCount.Load(), "should run at most 2 executors in parallel")
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-
-	// Reset to test running the executor with 0 parallelism
-	count.Store(0)
-	activeCount.Store(0)
-	maxCount.Store(0)
-
-	errSingle := NewParallelExecutor(0, emptyWorkflow, emptyWorkflow, emptyWorkflow)(ctx)
-
-	assert.Equal(int32(3), count.Load(), "should run all 3 executors")
-	assert.Equal(int32(1), maxCount.Load(), "should run at most 1 executors in parallel")
-	assert.NoError(errSingle)
-}
-
-func TestNewParallelExecutorEmpty(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-	require.NoError(t, NewParallelExecutor(2)(ctx))
-
-	canceledCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	err := NewParallelExecutor(2)(canceledCtx)
-	assert.ErrorIs(err, context.Canceled)
-}
-
-func TestNewParallelExecutorFailed(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	count := 0
-	errorWorkflow := NewPipelineExecutor(func(ctx context.Context) error {
-		count++
-		return errors.New("fake error")
-	})
-	err := NewParallelExecutor(1, errorWorkflow)(ctx)
-	assert.Equal(1, count)
-	assert.ErrorIs(context.Canceled, err)
-}
-
-func TestNewParallelExecutorCanceled(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	errExpected := errors.New("fake error")
-
-	var count atomic.Int32
-	successWorkflow := NewPipelineExecutor(func(ctx context.Context) error {
-		count.Add(1)
-		return nil
-	})
-	errorWorkflow := NewPipelineExecutor(func(ctx context.Context) error {
-		count.Add(1)
-		return errExpected
-	})
-	err := NewParallelExecutor(3, errorWorkflow, successWorkflow, successWorkflow)(ctx)
-	assert.Equal(int32(3), count.Load())
-	assert.Error(errExpected, err) //nolint:testifylint // pre-existing issue from nektos/act
-}
-
-func TestExecutorConditionalsAndFinally(t *testing.T) {
-	ctx := context.Background()
-	var calls []string
-	record := func(name string) Executor {
-		return func(ctx context.Context) error {
-			calls = append(calls, name)
-			return nil
-		}
-	}
-
-	require.NoError(t, record("if-true").If(func(context.Context) bool { return true })(ctx))
-	require.NoError(t, record("if-false").If(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-not").IfNot(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-bool").IfBool(true)(ctx))
-	require.NoError(t, record("main").Finally(record("finally"))(ctx))
-
-	want := []string{"if-true", "if-not", "if-bool", "main", "finally"}
-	if !reflect.DeepEqual(calls, want) {
-		t.Fatalf("calls = %v, want %v", calls, want)
-	}
-}
-
-func TestExecutorFinallyReturnsFinallyErrorWithOriginal(t *testing.T) {
-	mainErr := errors.New("main failed")
-	finalErr := errors.New("cleanup failed")
-
-	err := NewErrorExecutor(mainErr).Finally(NewErrorExecutor(finalErr))(context.Background())
-	require.Error(t, err)
-	if !strings.Contains(err.Error(), "cleanup failed") || !strings.Contains(err.Error(), "main failed") {
-		t.Fatalf("finally error = %q, want both cleanup and original error", err)
-	}
-}
-
-func TestConditionalNot(t *testing.T) {
-	cond := Conditional(func(context.Context) bool { return false })
-	if !cond.Not()(context.Background()) {
-		t.Fatal("inverted conditional should be true")
-	}
-}

act/common/git/git.go

@@ -1,536 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package git
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"regexp"
-	"strings"
-	"sync"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/config"
-	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/go-git/go-git/v5/plumbing/storer"
-	"github.com/go-git/go-git/v5/plumbing/transport/http"
-	"github.com/mattn/go-isatty"
-	log "github.com/sirupsen/logrus"
-)
-
-var (
-	codeCommitHTTPRegex = regexp.MustCompile(`^https?://git-codecommit\.(.+)\.amazonaws.com/v1/repos/(.+)$`)
-	codeCommitSSHRegex  = regexp.MustCompile(`ssh://git-codecommit\.(.+)\.amazonaws.com/v1/repos/(.+)$`)
-	githubHTTPRegex     = regexp.MustCompile(`^https?://.*github.com.*/(.+)/(.+?)(?:.git)?$`)
-	githubSSHRegex      = regexp.MustCompile(`github.com[:/](.+)/(.+?)(?:.git)?$`)
-
-	cloneLocks sync.Map // key: clone target directory; value: *sync.Mutex
-
-	ErrShortRef = errors.New("short SHA references are not supported")
-	ErrNoRepo   = errors.New("unable to find git repo")
-)
-
-// AcquireCloneLock returns an unlock function after locking the per-directory mutex for dir.
-// Only concurrent operations targeting the same directory are serialized; clones into different directories run in parallel.
-// Callers reading files inside dir (e.g. tarring a checked-out action into a job container) must hold this lock too,
-// otherwise a concurrent NewGitCloneExecutor on the same dir can mutate the worktree mid-read.
-func AcquireCloneLock(dir string) func() {
-	v, _ := cloneLocks.LoadOrStore(dir, &sync.Mutex{})
-	mu := v.(*sync.Mutex)
-	mu.Lock()
-	return mu.Unlock
-}
-
-type Error struct {
-	err    error
-	commit string
-}
-
-func (e *Error) Error() string {
-	return e.err.Error()
-}
-
-func (e *Error) Unwrap() error {
-	return e.err
-}
-
-func (e *Error) Commit() string {
-	return e.commit
-}
-
-// goGitMu serializes go-git repository access across the process. go-git is not safe for
-// concurrent use of the same repository (even read access decodes packfiles into shared
-// state), so parallel jobs inspecting the shared workdir repo race without this. The guarded
-// operations are fast local reads; gitea runs one job per process, so the lock is effectively
-// uncontended in production.
-var goGitMu sync.Mutex
-
-// FindGitRevision get the current git revision
-func FindGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-	return findGitRevision(ctx, file)
-}
-
-func findGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
-	logger := common.Logger(ctx)
-
-	gitDir, err := git.PlainOpenWithOptions(
-		file,
-		&git.PlainOpenOptions{
-			DetectDotGit:          true,
-			EnableDotGitCommonDir: true,
-		},
-	)
-	if err != nil {
-		logger.WithError(err).Error("path", file, "not located inside a git repository")
-		return "", "", err
-	}
-
-	head, err := gitDir.Reference(plumbing.HEAD, true)
-	if err != nil {
-		return "", "", err
-	}
-
-	if head.Hash().IsZero() {
-		return "", "", errors.New("HEAD sha1 could not be resolved")
-	}
-
-	hash := head.Hash().String()
-
-	logger.Debugf("Found revision: %s", hash)
-	return hash[:7], strings.TrimSpace(hash), nil
-}
-
-// FindGitRef get the current git ref
-func FindGitRef(ctx context.Context, file string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-
-	logger := common.Logger(ctx)
-
-	logger.Debugf("Loading revision from git directory")
-	_, ref, err := findGitRevision(ctx, file)
-	if err != nil {
-		return "", err
-	}
-
-	logger.Debugf("HEAD points to '%s'", ref)
-
-	// Prefer the git library to iterate over the references and find a matching tag or branch.
-	refTag := ""
-	refBranch := ""
-	repo, err := git.PlainOpenWithOptions(
-		file,
-		&git.PlainOpenOptions{
-			DetectDotGit:          true,
-			EnableDotGitCommonDir: true,
-		},
-	)
-	if err != nil {
-		return "", err
-	}
-
-	iter, err := repo.References()
-	if err != nil {
-		return "", err
-	}
-
-	// find the reference that matches the revision's has
-	err = iter.ForEach(func(r *plumbing.Reference) error {
-		/* tags and branches will have the same hash
-		 * when a user checks out a tag, it is not mentioned explicitly
-		 * in the go-git package, we must identify the revision
-		 * then check if any tag matches that revision,
-		 * if so then we checked out a tag
-		 * else we look for branches and if matches,
-		 * it means we checked out a branch
-		 *
-		 * If a branches matches first we must continue and check all tags (all references)
-		 * in case we match with a tag later in the interation
-		 */
-		if r.Hash().String() == ref {
-			if r.Name().IsTag() {
-				refTag = r.Name().String()
-			}
-			if r.Name().IsBranch() {
-				refBranch = r.Name().String()
-			}
-		}
-
-		// we found what we where looking for
-		if refTag != "" && refBranch != "" {
-			return storer.ErrStop
-		}
-
-		return nil
-	})
-	if err != nil {
-		return "", err
-	}
-
-	// order matters here see above comment.
-	if refTag != "" {
-		return refTag, nil
-	}
-	if refBranch != "" {
-		return refBranch, nil
-	}
-
-	return "", fmt.Errorf("failed to identify reference (tag/branch) for the checked-out revision '%s'", ref)
-}
-
-// FindGithubRepo get the repo
-func FindGithubRepo(ctx context.Context, file, githubInstance, remoteName string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-	if remoteName == "" {
-		remoteName = "origin"
-	}
-
-	url, err := findGitRemoteURL(ctx, file, remoteName)
-	if err != nil {
-		return "", err
-	}
-	_, slug, err := findGitSlug(url, githubInstance)
-	return slug, err
-}
-
-func findGitRemoteURL(_ context.Context, file, remoteName string) (string, error) {
-	repo, err := git.PlainOpenWithOptions(
-		file,
-		&git.PlainOpenOptions{
-			DetectDotGit:          true,
-			EnableDotGitCommonDir: true,
-		},
-	)
-	if err != nil {
-		return "", err
-	}
-
-	remote, err := repo.Remote(remoteName)
-	if err != nil {
-		return "", err
-	}
-
-	if len(remote.Config().URLs) < 1 {
-		return "", fmt.Errorf("remote '%s' exists but has no URL", remoteName)
-	}
-
-	return remote.Config().URLs[0], nil
-}
-
-func findGitSlug(url, githubInstance string) (string, string, error) { //nolint:unparam // pre-existing issue from nektos/act
-	if matches := codeCommitHTTPRegex.FindStringSubmatch(url); matches != nil {
-		return "CodeCommit", matches[2], nil
-	} else if matches := codeCommitSSHRegex.FindStringSubmatch(url); matches != nil {
-		return "CodeCommit", matches[2], nil
-	} else if matches := githubHTTPRegex.FindStringSubmatch(url); matches != nil {
-		return "GitHub", fmt.Sprintf("%s/%s", matches[1], matches[2]), nil
-	} else if matches := githubSSHRegex.FindStringSubmatch(url); matches != nil {
-		return "GitHub", fmt.Sprintf("%s/%s", matches[1], matches[2]), nil
-	} else if githubInstance != "github.com" {
-		gheHTTPRegex := regexp.MustCompile(fmt.Sprintf(`^https?://%s/(.+)/(.+?)(?:.git)?$`, githubInstance))
-		gheSSHRegex := regexp.MustCompile(githubInstance + "[:/](.+)/(.+?)(?:.git)?$")
-		if matches := gheHTTPRegex.FindStringSubmatch(url); matches != nil {
-			return "GitHubEnterprise", fmt.Sprintf("%s/%s", matches[1], matches[2]), nil
-		} else if matches := gheSSHRegex.FindStringSubmatch(url); matches != nil {
-			return "GitHubEnterprise", fmt.Sprintf("%s/%s", matches[1], matches[2]), nil
-		}
-	}
-	return "", url, nil
-}
-
-// NewGitCloneExecutorInput the input for the NewGitCloneExecutor
-type NewGitCloneExecutorInput struct {
-	URL         string
-	Ref         string
-	Dir         string
-	Token       string
-	OfflineMode bool
-
-	// Depth limits the clone/fetch to the given number of commits from the tip of the requested ref.
-	// 0 for full clone.
-	Depth int
-
-	// For Gitea
-	InsecureSkipTLS bool
-}
-
-// CloneIfRequired returns the repository and a boolean indicating whether an existing local clone was reused.
-func CloneIfRequired(ctx context.Context, refName plumbing.ReferenceName, input NewGitCloneExecutorInput, logger log.FieldLogger) (*git.Repository, bool, error) {
-	r, err := git.PlainOpen(input.Dir)
-	if err == nil {
-		// Verify the cached clone still points to the resolved URL before reusing it.
-		remote, err := r.Remote("origin")
-		if err == nil && len(remote.Config().URLs) > 0 && remote.Config().URLs[0] == input.URL {
-			// Reuse existing clone
-			return r, true, nil
-		}
-
-		if err != nil {
-			logger.Debugf("Removing cached clone at %s because origin cannot be read: %v", input.Dir, err)
-		} else if len(remote.Config().URLs) == 0 {
-			logger.Debugf("Removing cached clone at %s because origin has no URL", input.Dir)
-		} else {
-			logger.Debugf("Removing cached clone at %s because origin URL changed from %s to %s", input.Dir, remote.Config().URLs[0], input.URL)
-		}
-		if err := os.RemoveAll(input.Dir); err != nil {
-			return nil, false, fmt.Errorf("remove cached clone %s: %w", input.Dir, err)
-		}
-	}
-
-	var progressWriter io.Writer
-	if isatty.IsTerminal(os.Stdout.Fd()) || isatty.IsCygwinTerminal(os.Stdout.Fd()) {
-		if entry, ok := logger.(*log.Entry); ok {
-			progressWriter = entry.WriterLevel(log.DebugLevel)
-		} else if lgr, ok := logger.(*log.Logger); ok {
-			progressWriter = lgr.WriterLevel(log.DebugLevel)
-		} else {
-			log.Errorf("Unable to get writer from logger (type=%T)", logger)
-			progressWriter = os.Stdout
-		}
-	}
-
-	cloneOptions := git.CloneOptions{
-		URL:      input.URL,
-		Progress: progressWriter,
-
-		InsecureSkipTLS: input.InsecureSkipTLS, // For Gitea
-	}
-	if input.Token != "" {
-		cloneOptions.Auth = &http.BasicAuth{
-			Username: "token",
-			Password: input.Token,
-		}
-	}
-
-	r, err = cloneAtDepth(ctx, input, cloneOptions, logger)
-	if err != nil {
-		logger.Errorf("Unable to clone %v %s: %v", input.URL, refName, err)
-		return nil, false, err
-	}
-
-	if err = os.Chmod(input.Dir, 0o755); err != nil {
-		return nil, false, err
-	}
-
-	return r, false, nil
-}
-
-func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.PullOptions) {
-	fetchOptions.RefSpecs = []config.RefSpec{"refs/*:refs/*", "HEAD:refs/heads/HEAD"}
-	fetchOptions.Force = true
-	pullOptions.Force = true
-
-	if token != "" {
-		auth := &http.BasicAuth{
-			Username: "token",
-			Password: token,
-		}
-		fetchOptions.Auth = auth
-		pullOptions.Auth = auth
-	}
-
-	return fetchOptions, pullOptions
-}
-
-// NewGitCloneExecutor creates an executor to clone git repos
-func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		logger.Infof("git clone '%s' # ref=%s", input.URL, input.Ref)
-		logger.Debugf("  cloning %s to %s", input.URL, input.Dir)
-
-		defer AcquireCloneLock(input.Dir)()
-
-		refName := plumbing.ReferenceName("refs/heads/" + input.Ref)
-		r, reused, err := CloneIfRequired(ctx, refName, input, logger)
-		if err != nil {
-			return err
-		}
-
-		isOfflineMode := input.OfflineMode
-
-		// fetch latest changes
-		fetchOptions, pullOptions := gitOptions(input.Token)
-
-		if input.InsecureSkipTLS { // For Gitea
-			fetchOptions.InsecureSkipTLS = true
-			pullOptions.InsecureSkipTLS = true
-		}
-
-		// Action clones only ever need the tip commit, so keep a shallow cache cheap on update at depth 1 regardless of its original depth
-		// Turning action_shallow_clone off does not convert an existing shallow cache; evict it for a full clone.
-		shallow := isShallow(r)
-		if shallow {
-			fetchOptions.Depth = 1
-			if spec, ok := shallowFetchRefSpec(r, input.Ref); ok {
-				fetchOptions.RefSpecs = []config.RefSpec{spec}
-			}
-		}
-
-		if !isOfflineMode {
-			err = r.Fetch(&fetchOptions)
-			if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
-				return err
-			}
-		}
-
-		var hash *plumbing.Hash
-		rev := plumbing.Revision(input.Ref)
-		if hash, err = r.ResolveRevision(rev); err != nil {
-			// ResolveRevision returns a nil hash on error, and a branch ref legitimately fails
-			// here (no local refs/heads/<ref>); the duck-typing below resolves it.
-			logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-		} else if hash.String() != input.Ref && strings.HasPrefix(hash.String(), input.Ref) {
-			return &Error{
-				err:    ErrShortRef,
-				commit: hash.String(),
-			}
-		}
-
-		// At this point we need to know if it's a tag or a branch
-		// And the easiest way to do it is duck typing
-		//
-		// If err is nil, it's a tag so let's proceed with that hash like we would if
-		// it was a sha
-		refType := "tag"
-		rev = plumbing.Revision(path.Join("refs", "tags", input.Ref))
-		if _, err := r.Tag(input.Ref); errors.Is(err, git.ErrTagNotFound) {
-			rName := plumbing.ReferenceName(path.Join("refs", "remotes", "origin", input.Ref))
-			if _, err := r.Reference(rName, false); errors.Is(err, plumbing.ErrReferenceNotFound) {
-				refType = "sha"
-				rev = plumbing.Revision(input.Ref)
-			} else {
-				refType = "branch"
-				rev = plumbing.Revision(rName)
-			}
-		}
-
-		if hash, err = r.ResolveRevision(rev); err != nil {
-			logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-			return err
-		}
-
-		var w *git.Worktree
-		if w, err = r.Worktree(); err != nil {
-			return err
-		}
-
-		// If the hash resolved doesn't match the ref provided in a workflow then we're
-		// using a branch or tag ref, not a sha
-		//
-		// Repos on disk point to commit hashes, and need to checkout input.Ref before
-		// we try and pull down any changes
-		if hash.String() != input.Ref && refType == "branch" {
-			logger.Debugf("Provided ref is not a sha. Checking out branch before pulling changes")
-			sourceRef := plumbing.ReferenceName(path.Join("refs", "remotes", "origin", input.Ref))
-			if err = w.Checkout(&git.CheckoutOptions{
-				Branch: sourceRef,
-				Force:  true,
-			}); err != nil {
-				logger.Errorf("Unable to checkout %s: %v", sourceRef, err)
-				return err
-			}
-		}
-
-		reusedMsg := ""
-
-		switch {
-		case !isOfflineMode && !shallow:
-			// In shallow mode the depth-limited fetch above already advanced the ref.
-			if err = w.Pull(&pullOptions); err != nil && err != git.NoErrAlreadyUpToDate {
-				logger.Debugf("Unable to pull %s: %v", refName, err)
-			}
-		case isOfflineMode && reused:
-			reusedMsg = " (reused in offline mode)"
-		}
-
-		logger.Debugf("Cloned %s to %s%s", input.URL, input.Dir, reusedMsg)
-
-		if hash.String() != input.Ref && refType == "branch" {
-			logger.Debugf("Provided ref is not a sha. Updating branch ref after pull")
-			if hash, err = r.ResolveRevision(rev); err != nil {
-				logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-				return err
-			}
-		}
-		if err = w.Checkout(&git.CheckoutOptions{
-			Hash:  *hash,
-			Force: true,
-		}); err != nil {
-			logger.Errorf("Unable to checkout %s: %v", *hash, err)
-			return err
-		}
-
-		if err = w.Reset(&git.ResetOptions{
-			Mode:   git.HardReset,
-			Commit: *hash,
-		}); err != nil {
-			logger.Errorf("Unable to reset to %s: %v", hash.String(), err)
-			return err
-		}
-
-		logger.Debugf("Checked out %s", input.Ref)
-		return nil
-	}
-}
-
-// cloneAtDepth clones input.URL into input.Dir using opts.
-// With input.Depth > 0 it first tries a shallow, single-branch clone of input.Ref, falling back when error.
-func cloneAtDepth(ctx context.Context, input NewGitCloneExecutorInput, opts git.CloneOptions, logger log.FieldLogger) (*git.Repository, error) {
-	if input.Depth > 0 {
-		for _, refName := range []plumbing.ReferenceName{
-			plumbing.NewBranchReferenceName(input.Ref),
-			plumbing.NewTagReferenceName(input.Ref),
-		} {
-			shallowOpts := opts
-			shallowOpts.Depth = input.Depth
-			shallowOpts.SingleBranch = true
-			shallowOpts.ReferenceName = refName
-			shallowOpts.Tags = git.NoTags
-
-			r, err := git.PlainCloneContext(ctx, input.Dir, false, &shallowOpts)
-			if err == nil {
-				return r, nil
-			}
-			logger.Debugf("Shallow clone of %s as %s failed: %v", input.URL, refName, err)
-			if rmErr := os.RemoveAll(input.Dir); rmErr != nil {
-				return nil, fmt.Errorf("remove partial clone %s: %w", input.Dir, rmErr)
-			}
-		}
-		logger.Debugf("Falling back to a full clone of %s for ref %q", input.URL, input.Ref)
-	}
-
-	return git.PlainCloneContext(ctx, input.Dir, false, &opts)
-}
-
-// isShallow reports whether the local repository was cloned with a limited depth.
-func isShallow(r *git.Repository) bool {
-	shallows, err := r.Storer.Shallow()
-	return err == nil && len(shallows) > 0
-}
-
-// shallowFetchRefSpec returns the single refspec that updates only input.Ref, keeping a shallow clone from re-downloading every branch's history.
-// ok is false when the ref is not present locally as a tag or remote-tracking branch, in which case the broad default refspec is used.
-func shallowFetchRefSpec(r *git.Repository, ref string) (config.RefSpec, bool) {
-	tagRef := plumbing.NewTagReferenceName(ref)
-	if _, err := r.Reference(tagRef, false); err == nil {
-		return config.RefSpec(fmt.Sprintf("+%s:%s", tagRef, tagRef)), true
-	}
-	remoteRef := plumbing.NewRemoteReferenceName("origin", ref)
-	if _, err := r.Reference(remoteRef, false); err == nil {
-		branchRef := plumbing.NewBranchReferenceName(ref)
-		return config.RefSpec(fmt.Sprintf("+%s:%s", branchRef, remoteRef)), true
-	}
-	return "", false
-}

act/common/git/git_test.go

@@ -1,579 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package git
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestFindGitSlug(t *testing.T) {
-	assert := assert.New(t)
-
-	slugTests := []struct {
-		url      string // input
-		provider string // expected result
-		slug     string // expected result
-	}{
-		{"https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo-name", "CodeCommit", "my-repo-name"},
-		{"ssh://git-codecommit.us-west-2.amazonaws.com/v1/repos/my-repo", "CodeCommit", "my-repo"},
-		{"git@github.com:nektos/act.git", "GitHub", "nektos/act"},
-		{"git@github.com:nektos/act", "GitHub", "nektos/act"},
-		{"https://github.com/nektos/act.git", "GitHub", "nektos/act"},
-		{"http://github.com/nektos/act.git", "GitHub", "nektos/act"},
-		{"https://github.com/nektos/act", "GitHub", "nektos/act"},
-		{"http://github.com/nektos/act", "GitHub", "nektos/act"},
-		{"git+ssh://git@github.com/owner/repo.git", "GitHub", "owner/repo"},
-		{"http://myotherrepo.com/act.git", "", "http://myotherrepo.com/act.git"},
-	}
-
-	for _, tt := range slugTests {
-		provider, slug, err := findGitSlug(tt.url, "github.com")
-
-		assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-		assert.Equal(tt.provider, provider)
-		assert.Equal(tt.slug, slug)
-	}
-}
-
-func TestErrorWrapsCommitAndCause(t *testing.T) {
-	err := &Error{err: ErrShortRef, commit: "abc123"}
-	require.Equal(t, ErrShortRef.Error(), err.Error())
-	require.ErrorIs(t, err, ErrShortRef)
-	require.Equal(t, "abc123", err.Commit())
-}
-
-func cleanGitHooks(dir string) error {
-	hooksDir := filepath.Join(dir, ".git", "hooks")
-	files, err := os.ReadDir(hooksDir)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	for _, f := range files {
-		if f.IsDir() {
-			continue
-		}
-		relName := filepath.Join(hooksDir, f.Name())
-		if err := os.Remove(relName); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func TestFindGitRemoteURL(t *testing.T) {
-	assert := assert.New(t)
-
-	basedir := t.TempDir()
-	err := gitCmd("init", basedir)
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-	err = cleanGitHooks(basedir)
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-
-	remoteURL := "https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo-name"
-	err = gitCmd("-C", basedir, "remote", "add", "origin", remoteURL)
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-
-	u, err := findGitRemoteURL(context.Background(), basedir, "origin")
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(remoteURL, u)
-
-	remoteURL = "git@github.com/AwesomeOwner/MyAwesomeRepo.git"
-	err = gitCmd("-C", basedir, "remote", "add", "upstream", remoteURL)
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-	u, err = findGitRemoteURL(context.Background(), basedir, "upstream")
-	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(remoteURL, u)
-}
-
-func TestFindGithubRepoUsesOriginAndCustomRemote(t *testing.T) {
-	basedir := t.TempDir()
-	require.NoError(t, gitCmd("init", basedir))
-	require.NoError(t, cleanGitHooks(basedir))
-	require.NoError(t, gitCmd("-C", basedir, "remote", "add", "origin", "https://github.com/owner/repo.git"))
-	require.NoError(t, gitCmd("-C", basedir, "remote", "add", "ghe", "git@git.example.com:team/project.git"))
-
-	slug, err := FindGithubRepo(context.Background(), basedir, "github.com", "")
-	require.NoError(t, err)
-	require.Equal(t, "owner/repo", slug)
-
-	slug, err = FindGithubRepo(context.Background(), basedir, "git.example.com", "ghe")
-	require.NoError(t, err)
-	require.Equal(t, "team/project", slug)
-}
-
-func TestGitFindRef(t *testing.T) {
-	basedir := t.TempDir()
-
-	for name, tt := range map[string]struct {
-		Prepare func(t *testing.T, dir string)
-		Assert  func(t *testing.T, ref string, err error)
-	}{
-		"new_repo": {
-			Prepare: func(t *testing.T, dir string) {},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.Error(t, err)
-			},
-		},
-		"new_repo_with_commit": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/heads/master", ref)
-			},
-		},
-		"current_head_is_tag": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "commit msg"))
-				require.NoError(t, gitCmd("-C", dir, "tag", "v1.2.3"))
-				require.NoError(t, gitCmd("-C", dir, "checkout", "v1.2.3"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/tags/v1.2.3", ref)
-			},
-		},
-		"current_head_is_same_as_tag": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "1.4.2 release"))
-				require.NoError(t, gitCmd("-C", dir, "tag", "v1.4.2"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/tags/v1.4.2", ref)
-			},
-		},
-		"current_head_is_not_tag": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg"))
-				require.NoError(t, gitCmd("-C", dir, "tag", "v1.4.2"))
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg2"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/heads/master", ref)
-			},
-		},
-		"current_head_is_another_branch": {
-			Prepare: func(t *testing.T, dir string) {
-				require.NoError(t, gitCmd("-C", dir, "checkout", "-b", "mybranch"))
-				require.NoError(t, gitCmd("-C", dir, "commit", "--allow-empty", "-m", "msg"))
-			},
-			Assert: func(t *testing.T, ref string, err error) {
-				require.NoError(t, err)
-				require.Equal(t, "refs/heads/mybranch", ref)
-			},
-		},
-	} {
-		t.Run(name, func(t *testing.T) {
-			dir := filepath.Join(basedir, name)
-			require.NoError(t, os.MkdirAll(dir, 0o755))
-			require.NoError(t, gitCmd("-C", dir, "init", "--initial-branch=master"))
-			require.NoError(t, cleanGitHooks(dir))
-			tt.Prepare(t, dir)
-			ref, err := FindGitRef(context.Background(), dir)
-			tt.Assert(t, ref, err)
-		})
-	}
-}
-
-func TestGitCloneExecutor(t *testing.T) {
-	// Build a local bare "remote" so this runs offline and fast. The cases below mirror
-	// the tag/branch/sha/short-sha ref paths the executor handles, formerly exercised by
-	// cloning actions/checkout and anchore/scan-action over the network.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v2"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v2"))
-
-	// A branch with a dash in the name (mirrors the historical scan-action@act-fails case).
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "act-fails"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "branch-commit"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "act-fails"))
-
-	out, err := exec.Command("git", "-C", workDir, "rev-parse", "main").Output()
-	require.NoError(t, err)
-	fullSha := strings.TrimSpace(string(out))
-
-	for name, tt := range map[string]struct {
-		Err error
-		Ref string
-	}{
-		"tag": {
-			Err: nil,
-			Ref: "v2",
-		},
-		"branch": {
-			Err: nil,
-			Ref: "act-fails",
-		},
-		"sha": {
-			Err: nil,
-			Ref: fullSha,
-		},
-		"short-sha": {
-			Err: &Error{ErrShortRef, fullSha},
-			Ref: fullSha[:7],
-		},
-	} {
-		t.Run(name, func(t *testing.T) {
-			clone := NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL: remoteDir,
-				Ref: tt.Ref,
-				Dir: t.TempDir(),
-			})
-
-			err := clone(context.Background())
-			if tt.Err != nil {
-				assert.Error(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-				assert.Equal(t, tt.Err, err)
-			} else {
-				assert.Empty(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			}
-		})
-	}
-}
-
-func TestGitCloneExecutorReclonesWhenOriginURLChanges(t *testing.T) {
-	createRemote := func(message string) string {
-		remoteDir := t.TempDir()
-		require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-		workDir := t.TempDir()
-		require.NoError(t, gitCmd("clone", remoteDir, workDir))
-		require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", message))
-		require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-		return remoteDir
-	}
-
-	oldRemoteDir := createRemote("old-action")
-	newRemoteDir := createRemote("new-action")
-	cacheDir := t.TempDir()
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: oldRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	markerPath := filepath.Join(cacheDir, "stale-marker")
-	require.NoError(t, os.WriteFile(markerPath, []byte("stale"), 0o644))
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: newRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	originURL, err := findGitRemoteURL(t.Context(), cacheDir, "origin")
-	require.NoError(t, err)
-	assert.Equal(t, newRemoteDir, originURL)
-
-	out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	assert.Equal(t, "new-action", strings.TrimSpace(string(out)))
-
-	_, err = os.Stat(markerPath)
-	require.True(t, os.IsNotExist(err), "stale cached directory should be removed before recloning")
-}
-
-func TestGitCloneExecutorNonFastForwardRef(t *testing.T) {
-	// Simulate the scenario where a remote ref (e.g. a GitHub PR head ref) changes
-	// non-fast-forward between two fetches. Before the fix, the fetch used Force=false,
-	// causing go-git to return ErrForceNeeded and short-circuit the checkout.
-
-	// Create a bare "remote" repo with an initial commit on main and a feature branch.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-	// We need a working clone to push commits from.
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Create a feature branch (simulates refs/pull/N/head).
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "feature"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "feature-1"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "feature"))
-
-	// First clone via the executor — should succeed and cache the repo.
-	cloneDir := t.TempDir()
-	clone := NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: remoteDir,
-		Ref: "main",
-		Dir: cloneDir,
-	})
-	require.NoError(t, clone(context.Background()))
-
-	// Now force-push the feature branch to a non-fast-forward commit (simulates
-	// a PR rebase). This makes refs/heads/feature non-fast-forward.
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "branch", "-D", "feature"))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "feature"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "feature-rewritten"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "--force", "origin", "feature"))
-
-	// Also advance main so we can verify the clone picks up the new commit.
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "second"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "main"))
-
-	// Second clone to the same directory — before the fix this returned ErrForceNeeded
-	// and left the working tree at the old commit.
-	err := clone(context.Background())
-	require.NoError(t, err, "fetch with non-fast-forward refs must not fail when Force=true")
-
-	// Verify the working tree was actually updated to the latest main commit.
-	out, err := exec.Command("git", "-C", cloneDir, "log", "--oneline", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	assert.Equal(t, "second", strings.TrimSpace(string(out)), "working tree should be at the latest commit")
-}
-
-func TestGitCloneExecutorOfflineMode(t *testing.T) {
-	// Build a local "remote" with a single commit on main.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Prime the cache with an online clone of main.
-	cacheDir := t.TempDir()
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: remoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(context.Background()))
-
-	t.Run("cached branch resolves without fetching", func(t *testing.T) {
-		// Offline reuse of a cached branch must succeed even though ResolveRevision(input.Ref)
-		// finds no local refs/heads/<ref>.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "main",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.NoError(t, err)
-
-		out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-		require.NoError(t, err)
-		assert.Equal(t, "initial", strings.TrimSpace(string(out)))
-	})
-
-	t.Run("unresolvable cached ref returns error", func(t *testing.T) {
-		// The ref was never cached; offline mode cannot resolve it and must return an error.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "never-fetched",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.Error(t, err)
-	})
-}
-
-func TestGitCloneExecutorShallow(t *testing.T) {
-	// Build a local "remote" with several commits on main plus a tag, so a full clone would pull noticeably more history than a shallow one.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	for _, m := range []string{"c1", "c2", "c3"} {
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", m))
-	}
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v1"))
-	sha := gitRevParse(t, workDir, "HEAD~1") // c2, a SHA that go-git cannot shallow-clone
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v1"))
-
-	shallowMarker := func(dir string) string { return filepath.Join(dir, ".git", "shallow") }
-
-	t.Run("branch is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir), "only the tip commit should be present")
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("tag is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "v1", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("SHA falls back to a full clone", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: sha, Dir: dir, Depth: 1,
-		})(t.Context()))
-		// go-git cannot shallow-clone a raw SHA, so it falls back to a full clone; the absence of a shallow marker proves the fallback happened.
-		assert.NoFileExists(t, shallowMarker(dir), "a SHA ref must not produce a shallow clone")
-		assert.Equal(t, sha, gitRevParse(t, dir, "HEAD"))
-	})
-
-	t.Run("moving branch updates while staying shallow", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		require.Equal(t, "c3", gitHeadSubject(t, dir))
-
-		// Advance main on the remote, then reuse the existing shallow clone.
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "c4"))
-		require.NoError(t, gitCmd("-C", workDir, "push", "origin", "main"))
-
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.Equal(t, "c4", gitHeadSubject(t, dir), "reused shallow clone should update to the new tip")
-		assert.FileExists(t, shallowMarker(dir), "repo should remain shallow after update")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-	})
-}
-
-func gitRevParse(t *testing.T, dir, rev string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-parse", rev).Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
-func gitRevCount(t *testing.T, dir string) int {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--count", "HEAD").Output()
-	require.NoError(t, err)
-	n, err := strconv.Atoi(strings.TrimSpace(string(out)))
-	require.NoError(t, err)
-	return n
-}
-
-func gitHeadSubject(t *testing.T, dir string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
-func gitCmd(args ...string) error {
-	cmd := exec.Command("git", args...)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	// Inject a deterministic identity and ignore the host's global/system config so commits
-	// succeed regardless of the host having no user.name/user.email (e.g. CI, GITHUB_ACTIONS
-	// unset) or a global commit.gpgsign, and without mutating the developer's ~/.gitconfig.
-	cmd.Env = append(os.Environ(),
-		"GIT_AUTHOR_NAME=Unit Test",
-		"GIT_AUTHOR_EMAIL=test@test.com",
-		"GIT_COMMITTER_NAME=Unit Test",
-		"GIT_COMMITTER_EMAIL=test@test.com",
-		"GIT_CONFIG_GLOBAL=/dev/null",
-		"GIT_CONFIG_SYSTEM=/dev/null",
-	)
-
-	err := cmd.Run()
-	if exitError, ok := err.(*exec.ExitError); ok {
-		if waitStatus, ok := exitError.Sys().(syscall.WaitStatus); ok {
-			return fmt.Errorf("Exit error %d", waitStatus.ExitStatus())
-		}
-		return exitError
-	}
-	return nil
-}
-
-func TestAcquireCloneLock(t *testing.T) {
-	t.Run("same directory serializes", func(t *testing.T) {
-		dir := t.TempDir()
-
-		unlock1 := AcquireCloneLock(dir)
-
-		secondAcquired := make(chan struct{})
-		go func() {
-			unlock := AcquireCloneLock(dir)
-			close(secondAcquired)
-			unlock()
-		}()
-
-		select {
-		case <-secondAcquired:
-			t.Fatal("second acquire should block while first holds the lock")
-		case <-time.After(50 * time.Millisecond):
-		}
-
-		unlock1()
-
-		select {
-		case <-secondAcquired:
-		case <-time.After(time.Second):
-			t.Fatal("second acquire should proceed after first releases the lock")
-		}
-	})
-
-	t.Run("different directories do not block", func(t *testing.T) {
-		dirA := t.TempDir()
-		dirB := t.TempDir()
-
-		unlockA := AcquireCloneLock(dirA)
-		defer unlockA()
-
-		done := make(chan struct{})
-		go func() {
-			unlock := AcquireCloneLock(dirB)
-			unlock()
-			close(done)
-		}()
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Fatal("acquire on a different directory must not block")
-		}
-	})
-
-	t.Run("same directory reuses the same mutex", func(t *testing.T) {
-		dir := t.TempDir()
-
-		v1, _ := cloneLocks.LoadOrStore(dir, &sync.Mutex{})
-		v2, _ := cloneLocks.LoadOrStore(dir, &sync.Mutex{})
-		require.Same(t, v1, v2)
-	})
-}

act/common/job_error.go

@@ -1,36 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-)
-
-type jobErrorContextKey string
-
-const jobErrorContextKeyVal = jobErrorContextKey("job.error")
-
-// JobError returns the job error for current context if any
-func JobError(ctx context.Context) error {
-	val := ctx.Value(jobErrorContextKeyVal)
-	if val != nil {
-		if container, ok := val.(map[string]error); ok {
-			return container["error"]
-		}
-	}
-	return nil
-}
-
-func SetJobError(ctx context.Context, err error) {
-	if container, ok := ctx.Value(jobErrorContextKeyVal).(map[string]error); ok {
-		container["error"] = err
-	}
-}
-
-// WithJobErrorContainer adds a value to the context as a container for an error
-func WithJobErrorContainer(ctx context.Context) context.Context {
-	container := map[string]error{}
-	return context.WithValue(ctx, jobErrorContextKeyVal, container)
-}

act/common/line_writer.go

@@ -1,80 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"bytes"
-	"io"
-)
-
-// LineHandler is a callback function for handling a line
-type LineHandler func(line string) bool
-
-// Flusher is implemented by writers that buffer a trailing, not-yet-terminated
-// line. Callers should flush once the underlying stream has reached EOF so the
-// final line (when it is not newline-terminated) is not lost.
-type Flusher interface {
-	Flush()
-}
-
-type lineWriter struct {
-	buffer   bytes.Buffer
-	handlers []LineHandler
-}
-
-// NewLineWriter creates a new instance of a line writer
-func NewLineWriter(handlers ...LineHandler) io.Writer {
-	w := new(lineWriter)
-	w.handlers = handlers
-	return w
-}
-
-// FlushWriter flushes w if it implements Flusher. It is a no-op otherwise, so
-// callers can flush an io.Writer without knowing its concrete type.
-func FlushWriter(w io.Writer) {
-	if f, ok := w.(Flusher); ok {
-		f.Flush()
-	}
-}
-
-func (lw *lineWriter) Write(p []byte) (n int, err error) {
-	pBuf := bytes.NewBuffer(p)
-	written := 0
-	for {
-		line, err := pBuf.ReadString('\n')
-		w, _ := lw.buffer.WriteString(line)
-		written += w
-		if err == nil {
-			lw.handleLine(lw.buffer.String())
-			lw.buffer.Reset()
-		} else if err == io.EOF {
-			break
-		} else {
-			return written, err
-		}
-	}
-
-	return written, nil
-}
-
-// Flush emits any buffered, not-yet-newline-terminated content as a final line.
-// It is safe to call multiple times; subsequent calls with an empty buffer are
-// no-ops.
-func (lw *lineWriter) Flush() {
-	if lw.buffer.Len() == 0 {
-		return
-	}
-	lw.handleLine(lw.buffer.String())
-	lw.buffer.Reset()
-}
-
-func (lw *lineWriter) handleLine(line string) {
-	for _, h := range lw.handlers {
-		ok := h(line)
-		if !ok {
-			break
-		}
-	}
-}

act/common/line_writer_test.go

@@ -1,72 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"io"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestLineWriter(t *testing.T) {
-	lines := make([]string, 0)
-	lineHandler := func(s string) bool {
-		lines = append(lines, s)
-		return true
-	}
-
-	lineWriter := NewLineWriter(lineHandler)
-
-	assert := assert.New(t)
-	write := func(s string) {
-		n, err := lineWriter.Write([]byte(s))
-		assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-		assert.Equal(len(s), n, s)
-	}
-
-	write("hello")
-	write(" ")
-	write("world!!\nextra")
-	write(" line\n and another\nlast")
-	write(" line\n")
-	write("no newline here...")
-
-	assert.Len(lines, 4)
-	assert.Equal("hello world!!\n", lines[0])
-	assert.Equal("extra line\n", lines[1])
-	assert.Equal(" and another\n", lines[2])
-	assert.Equal("last line\n", lines[3])
-}
-
-func TestLineWriterFlush(t *testing.T) {
-	lines := make([]string, 0)
-	lineHandler := func(s string) bool {
-		lines = append(lines, s)
-		return true
-	}
-
-	lineWriter := NewLineWriter(lineHandler)
-
-	assert := assert.New(t)
-	_, err := lineWriter.Write([]byte("complete line\npartial line without newline"))
-	assert.NoError(err) //nolint:testifylint // pre-existing pattern from nektos/act
-
-	// Only the newline-terminated line is emitted before flushing.
-	assert.Equal([]string{"complete line\n"}, lines)
-
-	// Flushing emits the buffered, not-yet-terminated trailing line.
-	FlushWriter(lineWriter)
-	assert.Equal([]string{"complete line\n", "partial line without newline"}, lines)
-
-	// Flushing again is a no-op: nothing is buffered.
-	FlushWriter(lineWriter)
-	assert.Len(lines, 2)
-}
-
-func TestFlushWriterIgnoresNonFlusher(t *testing.T) {
-	// FlushWriter must be a safe no-op for writers that do not buffer lines.
-	assert.NotPanics(t, func() { FlushWriter(io.Discard) })
-}

act/common/logger.go

@@ -1,52 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-
-	"github.com/sirupsen/logrus"
-)
-
-type loggerContextKey string
-
-const loggerContextKeyVal = loggerContextKey("logrus.FieldLogger")
-
-// Logger returns the appropriate logger for current context
-func Logger(ctx context.Context) logrus.FieldLogger {
-	val := ctx.Value(loggerContextKeyVal)
-	if val != nil {
-		if logger, ok := val.(logrus.FieldLogger); ok {
-			return logger
-		}
-	}
-	return logrus.StandardLogger()
-}
-
-// WithLogger adds a value to the context for the logger
-func WithLogger(ctx context.Context, logger logrus.FieldLogger) context.Context {
-	return context.WithValue(ctx, loggerContextKeyVal, logger)
-}
-
-type loggerHookKey string
-
-const loggerHookKeyVal = loggerHookKey("logrus.Hook")
-
-// LoggerHook returns the appropriate logger hook for current context
-// the hook affects job logger, not global logger
-func LoggerHook(ctx context.Context) logrus.Hook {
-	val := ctx.Value(loggerHookKeyVal)
-	if val != nil {
-		if hook, ok := val.(logrus.Hook); ok {
-			return hook
-		}
-	}
-	return nil
-}
-
-// WithLoggerHook adds a value to the context for the logger hook
-func WithLoggerHook(ctx context.Context, hook logrus.Hook) context.Context {
-	return context.WithValue(ctx, loggerHookKeyVal, hook)
-}

act/container/docker_auth.go

@@ -1,71 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/distribution/reference"
-	"github.com/docker/cli/cli/config"
-	"github.com/moby/moby/api/types/registry"
-)
-
-func LoadDockerAuthConfig(ctx context.Context, image string) (registry.AuthConfig, error) {
-	logger := common.Logger(ctx)
-	// config.LoadDefaultConfigFile panics on nil io.Writer when the config
-	// file is malformed; use config.Load to route errors through the logger.
-	cfg, err := config.Load(config.Dir())
-	if err != nil {
-		logger.Warnf("Could not load docker config: %v", err)
-		return registry.AuthConfig{}, err
-	}
-	registryKey := registryAuthConfigKey("docker.io")
-	if image != "" {
-		if registryRef, refErr := reference.ParseNormalizedNamed(image); refErr != nil {
-			logger.Warnf("Could not normalize image reference: %v", refErr)
-		} else {
-			registryKey = registryAuthConfigKey(reference.Domain(registryRef))
-		}
-	}
-
-	authConfig, err := cfg.GetAuthConfig(registryKey)
-	if err != nil {
-		logger.Warnf("Could not get auth config from docker config: %v", err)
-		return registry.AuthConfig{}, err
-	}
-
-	return registry.AuthConfig(authConfig), nil
-}
-
-func LoadDockerAuthConfigs(ctx context.Context) map[string]registry.AuthConfig {
-	logger := common.Logger(ctx)
-	cfg, err := config.Load(config.Dir())
-	if err != nil {
-		logger.Warnf("Could not load docker config: %v", err)
-		return nil
-	}
-	creds, err := cfg.GetAllCredentials()
-	if err != nil {
-		logger.Warnf("Could not get docker auth configs: %v", err)
-		return nil
-	}
-	authConfigs := make(map[string]registry.AuthConfig, len(creds))
-	for k, v := range creds {
-		authConfigs[k] = registry.AuthConfig(v)
-	}
-
-	return authConfigs
-}
-
-func registryAuthConfigKey(domainName string) string {
-	if domainName == "docker.io" || domainName == "index.docker.io" {
-		return "https://index.docker.io/v1/"
-	}
-	return domainName
-}

act/container/docker_images_test.go

@@ -1,69 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func init() {
-	log.SetLevel(log.DebugLevel)
-}
-
-// buildScratchImage builds a tiny empty image for the given platform locally (FROM scratch, no
-// network or emulation since there is nothing to run) and returns its tag, removing it after
-// the test.
-func buildScratchImage(t *testing.T, platform string) string {
-	t.Helper()
-	tag := fmt.Sprintf("act-test-exists-%s:latest", strings.TrimPrefix(platform, "linux/"))
-	cmd := exec.Command("docker", "build", "--platform", platform, "-t", tag, "-")
-	cmd.Stdin = strings.NewReader("FROM scratch\nLABEL act-test=1\n")
-	// Force BuildKit: it records the requested architecture in the image config for a
-	// FROM-scratch build, whereas the classic builder ignores --platform and tags it with the
-	// host arch, which would break the per-platform existence assertions below.
-	cmd.Env = append(os.Environ(), "DOCKER_BUILDKIT=1")
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
-	t.Cleanup(func() { _ = exec.Command("docker", "rmi", "-f", tag).Run() })
-	return tag
-}
-
-func TestImageExistsLocally(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-
-	// a non-existent image is reported absent
-	missing, err := ImageExistsLocally(ctx, "library/alpine:this-random-tag-will-never-exist", "linux/amd64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, missing)
-
-	// Build tiny images for two architectures locally so per-platform existence can be checked
-	// offline (formerly pulled node:24-bookworm-slim for amd64 and arm64 over the network).
-	amd64Ref := buildScratchImage(t, "linux/amd64")
-	arm64Ref := buildScratchImage(t, "linux/arm64")
-
-	amd64Exists, err := ImageExistsLocally(ctx, amd64Ref, "linux/amd64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, amd64Exists)
-
-	// a non-host architecture image is detected for its own architecture
-	arm64Exists, err := ImageExistsLocally(ctx, arm64Ref, "linux/arm64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, arm64Exists)
-
-	// a present image is reported absent for a different platform
-	wrongPlatform, err := ImageExistsLocally(ctx, amd64Ref, "linux/arm64")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, wrongPlatform)
-}

act/container/docker_network.go

@@ -1,88 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"context"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/moby/moby/client"
-)
-
-func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		// Only create the network if it doesn't exist
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
-		if err != nil {
-			return err
-		}
-		// For Gitea, reduce log noise
-		// common.Logger(ctx).Debugf("%v", networks)
-		for _, n := range networks.Items {
-			if n.Name == name {
-				common.Logger(ctx).Debugf("Network %v exists", name)
-				return nil
-			}
-		}
-
-		_, err = cli.NetworkCreate(ctx, name, client.NetworkCreateOptions{
-			Driver:     "bridge",
-			Scope:      "local",
-			EnableIPv4: opts.EnableIPv4,
-			EnableIPv6: opts.EnableIPv6,
-		})
-		if err != nil {
-			return err
-		}
-
-		return nil
-	}
-}
-
-func NewDockerNetworkRemoveExecutor(name string) common.Executor {
-	return func(ctx context.Context) error {
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-
-		// Make sure that all network of the specified name are removed
-		// cli.NetworkRemove refuses to remove a network if there are duplicates
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
-		if err != nil {
-			return err
-		}
-		// For Gitea, reduce log noise
-		// common.Logger(ctx).Debugf("%v", networks)
-		for _, n := range networks.Items {
-			if n.Name == name {
-				result, err := cli.NetworkInspect(ctx, n.ID, client.NetworkInspectOptions{})
-				if err != nil {
-					return err
-				}
-
-				if len(result.Network.Containers) == 0 {
-					if _, err = cli.NetworkRemove(ctx, n.ID, client.NetworkRemoveOptions{}); err != nil {
-						common.Logger(ctx).Debugf("%v", err)
-					}
-				} else {
-					common.Logger(ctx).Debugf("Refusing to remove network %v because it still has active endpoints", name)
-				}
-			}
-		}
-
-		return err
-	}
-}

act/container/docker_platform.go

@@ -1,39 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// Copyright 2025 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"fmt"
-	"strings"
-
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// parsePlatform parses an "os/arch[/variant]" string into a Platform. An empty input
-// returns (nil, nil), meaning "no platform constraint". A non-empty but malformed
-// string is rejected explicitly so it cannot silently fall through to the daemon's
-// default architecture.
-func parsePlatform(platform string) (*specs.Platform, error) {
-	if platform == "" {
-		return nil, nil //nolint:nilnil // no platform constraint requested
-	}
-
-	parts := strings.Split(platform, "/")
-	if len(parts) < 2 || len(parts) > 3 || parts[0] == "" || parts[1] == "" || (len(parts) == 3 && parts[2] == "") {
-		return nil, fmt.Errorf("invalid platform %q: expected os/arch[/variant]", platform)
-	}
-
-	spec := &specs.Platform{
-		OS:           strings.ToLower(parts[0]),
-		Architecture: strings.ToLower(parts[1]),
-	}
-	if len(parts) == 3 {
-		spec.Variant = strings.ToLower(parts[2])
-	}
-
-	return spec, nil
-}

act/container/docker_platform_test.go

@@ -1,63 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParsePlatform(t *testing.T) {
-	t.Run("empty input returns nil platform without error", func(t *testing.T) {
-		got, err := parsePlatform("")
-		require.NoError(t, err)
-		assert.Nil(t, got)
-	})
-
-	t.Run("os/arch", func(t *testing.T) {
-		got, err := parsePlatform("linux/amd64")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Empty(t, got.Variant)
-	})
-
-	t.Run("os/arch/variant", func(t *testing.T) {
-		got, err := parsePlatform("linux/arm/v7")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "arm", got.Architecture)
-		assert.Equal(t, "v7", got.Variant)
-	})
-
-	t.Run("input is lowercased", func(t *testing.T) {
-		got, err := parsePlatform("Linux/AMD64/V8")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Equal(t, "v8", got.Variant)
-	})
-
-	for _, bad := range []string{
-		"amd64",
-		"linux",
-		"linux/",
-		"/amd64",
-		"/",
-		"//",
-		"linux/arm/",
-		"linux/arm/v7/extra",
-	} {
-		t.Run("rejects "+bad, func(t *testing.T) {
-			got, err := parsePlatform(bad)
-			require.Error(t, err)
-			assert.Nil(t, got)
-		})
-	}
-}

act/container/docker_run_test.go

@@ -1,623 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/binary"
-	"errors"
-	"io"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/pkg/stdcopy"
-	"github.com/moby/moby/api/types/container"
-	mobyclient "github.com/moby/moby/client"
-	"github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDocker(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-	client, err := GetDockerClient(ctx)
-	require.NoError(t, err)
-	defer client.Close()
-
-	dockerBuild := NewDockerBuildExecutor(NewDockerBuildExecutorInput{
-		ContextDir: "testdata",
-		ImageTag:   "envmergetest",
-	})
-
-	err = dockerBuild(ctx)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-	cr := &containerReference{
-		cli: client,
-		input: &NewContainerInput{
-			Image: "envmergetest",
-		},
-	}
-	env := map[string]string{
-		"PATH":         "/usr/local/bin:/usr/bin:/usr/sbin:/bin:/sbin",
-		"RANDOM_VAR":   "WITH_VALUE",
-		"ANOTHER_VAR":  "",
-		"CONFLICT_VAR": "I_EXIST_IN_MULTIPLE_PLACES",
-	}
-
-	envExecutor := cr.extractFromImageEnv(&env)
-	err = envExecutor(ctx)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, map[string]string{
-		"PATH":            "/usr/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/this/path/does/not/exists/anywhere:/this/either",
-		"RANDOM_VAR":      "WITH_VALUE",
-		"ANOTHER_VAR":     "",
-		"SOME_RANDOM_VAR": "",
-		"ANOTHER_ONE":     "BUT_I_HAVE_VALUE",
-		"CONFLICT_VAR":    "I_EXIST_IN_MULTIPLE_PLACES",
-	}, env)
-}
-
-type mockDockerClient struct {
-	mobyclient.APIClient
-	mock.Mock
-}
-
-func (m *mockDockerClient) ExecCreate(ctx context.Context, id string, opts mobyclient.ExecCreateOptions) (mobyclient.ExecCreateResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecCreateResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ExecAttach(ctx context.Context, id string, opts mobyclient.ExecAttachOptions) (mobyclient.ExecAttachResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecAttachResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ExecInspect(ctx context.Context, execID string, opts mobyclient.ExecInspectOptions) (mobyclient.ExecInspectResult, error) {
-	args := m.Called(ctx, execID, opts)
-	return args.Get(0).(mobyclient.ExecInspectResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerAttach(ctx context.Context, containerID string, opts mobyclient.ContainerAttachOptions) (mobyclient.ContainerAttachResult, error) {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerAttachResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerWait(ctx context.Context, containerID string, opts mobyclient.ContainerWaitOptions) mobyclient.ContainerWaitResult {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerWaitResult)
-}
-
-func (m *mockDockerClient) CopyToContainer(ctx context.Context, id string, options mobyclient.CopyToContainerOptions) (mobyclient.CopyToContainerResult, error) {
-	args := m.Called(ctx, id, options)
-	return args.Get(0).(mobyclient.CopyToContainerResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerInspect(ctx context.Context, id string, opts mobyclient.ContainerInspectOptions) (mobyclient.ContainerInspectResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerInspectResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerList(ctx context.Context, opts mobyclient.ContainerListOptions) (mobyclient.ContainerListResult, error) {
-	args := m.Called(ctx, opts)
-	return args.Get(0).(mobyclient.ContainerListResult), args.Error(1)
-}
-
-type endlessReader struct {
-	io.Reader
-}
-
-func (r endlessReader) Read(_ []byte) (n int, err error) {
-	return 1, nil
-}
-
-type mockConn struct {
-	net.Conn
-	mock.Mock
-}
-
-func (m *mockConn) Write(b []byte) (n int, err error) {
-	args := m.Called(b)
-	return args.Int(0), args.Error(1)
-}
-
-func (m *mockConn) Close() (err error) {
-	return nil
-}
-
-func TestDockerExecAbort(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-
-	conn := &mockConn{}
-	conn.On("Write", mock.AnythingOfType("[]uint8")).Return(1, nil)
-
-	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
-		HijackedResponse: mobyclient.HijackedResponse{
-			Conn:   conn,
-			Reader: bufio.NewReader(endlessReader{}),
-		},
-	}, nil)
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	channel := make(chan error)
-
-	go func() {
-		channel <- cr.exec([]string{""}, map[string]string{}, "user", "workdir")(ctx)
-	}()
-
-	time.Sleep(500 * time.Millisecond)
-
-	cancel()
-
-	err := <-channel
-	assert.ErrorIs(t, err, context.Canceled) //nolint:testifylint // pre-existing issue from nektos/act
-
-	conn.AssertExpectations(t)
-	client.AssertExpectations(t)
-}
-
-func TestDockerExecFailure(t *testing.T) {
-	ctx := context.Background()
-
-	conn := &mockConn{}
-
-	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
-		HijackedResponse: mobyclient.HijackedResponse{
-			Conn:   conn,
-			Reader: bufio.NewReader(strings.NewReader("output")),
-		},
-	}, nil)
-	client.On("ExecInspect", ctx, "id", mobyclient.ExecInspectOptions{}).Return(mobyclient.ExecInspectResult{
-		ExitCode: 1,
-	}, nil)
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	err := cr.exec([]string{""}, map[string]string{}, "user", "workdir")(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(1), exitErr)
-	assert.Equal(t, "Process completed with exit code 1.", err.Error())
-
-	conn.AssertExpectations(t)
-	client.AssertExpectations(t)
-}
-
-// stdcopyFrame wraps payload in a single Docker multiplexed-stream frame, the
-// format StdCopy expects: an 8-byte header (stream type + 4-byte big-endian
-// length) followed by the payload.
-func stdcopyFrame(stream stdcopy.StdType, payload string) []byte {
-	b := make([]byte, 8+len(payload))
-	b[0] = byte(stream)
-	binary.BigEndian.PutUint32(b[4:8], uint32(len(payload)))
-	copy(b[8:], payload)
-	return b
-}
-
-// TestDockerAttachFlushesTrailingLine verifies that wait() blocks until the
-// attach() streaming goroutine has drained and flushed the container's output,
-// so a final line without a trailing newline is not lost.
-func TestDockerAttachFlushesTrailingLine(t *testing.T) {
-	ctx := context.Background()
-
-	framed := bytes.NewBuffer(stdcopyFrame(stdcopy.Stdout, "line one\nlast line without newline"))
-
-	var lines []string
-	logWriter := common.NewLineWriter(func(s string) bool {
-		lines = append(lines, s)
-		return true
-	})
-
-	client := &mockDockerClient{}
-	client.On("ContainerAttach", ctx, "123", mock.AnythingOfType("client.ContainerAttachOptions")).
-		Return(mobyclient.ContainerAttachResult{
-			HijackedResponse: mobyclient.HijackedResponse{
-				Conn:   &mockConn{},
-				Reader: bufio.NewReader(framed),
-			},
-		}, nil)
-
-	statusCh := make(chan container.WaitResponse, 1)
-	statusCh <- container.WaitResponse{StatusCode: 0}
-	errCh := make(chan error, 1)
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image:  "image",
-			Stdout: logWriter,
-			Stderr: logWriter,
-		},
-	}
-
-	require.NoError(t, cr.attach()(ctx))
-	require.NoError(t, cr.wait()(ctx))
-
-	// wait() must have blocked until the goroutine drained AND flushed; the
-	// trailing, non-newline-terminated line must therefore be present. Reading
-	// lines here is race-free because wait() synchronizes on attachDone, which
-	// the goroutine closes after the final append.
-	assert.Equal(t, []string{"line one\n", "last line without newline"}, lines)
-
-	client.AssertExpectations(t)
-}
-
-func TestDockerWaitFailure(t *testing.T) {
-	ctx := context.Background()
-
-	statusCh := make(chan container.WaitResponse, 1)
-	statusCh <- container.WaitResponse{StatusCode: 2}
-	errCh := make(chan error, 1)
-
-	client := &mockDockerClient{}
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	err := cr.wait()(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(2), exitErr)
-	assert.Equal(t, "Process completed with exit code 2.", err.Error())
-
-	client.AssertExpectations(t)
-}
-
-func TestDockerCopyTarStream(t *testing.T) {
-	ctx := context.Background()
-
-	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	_ = cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
-
-	client.AssertExpectations(t)
-}
-
-func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) {
-	ctx := context.Background()
-
-	merr := errors.New("Failure")
-
-	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, merr)
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
-	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
-
-	client.AssertExpectations(t)
-}
-
-func TestDockerCopyTarStreamErrorInMkdir(t *testing.T) {
-	ctx := context.Background()
-
-	merr := errors.New("Failure")
-
-	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, merr)
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
-	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
-
-	client.AssertExpectations(t)
-}
-
-// find() must drop a stale cached id so later Copy/Exec don't hit the
-// daemon with a torn-down container.
-func TestFindRevalidatesStaleID(t *testing.T) {
-	ctx := context.Background()
-	notFound := cerrdefs.ErrNotFound.WithMessage("No such container")
-	boom := errors.New("daemon unreachable")
-	newCR := func(id string) (*containerReference, *mockDockerClient) {
-		client := &mockDockerClient{}
-		return &containerReference{id: id, cli: client, input: &NewContainerInput{Name: "job-1"}}, client
-	}
-	listOpts := mobyclient.ContainerListOptions{All: true}
-	inspectOpts := mobyclient.ContainerInspectOptions{}
-
-	t.Run("stale id cleared, name lookup empty", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Empty(t, cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("stale id cleared, name lookup repopulates", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "other", Names: []string{"/somebody-else"}},
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "fresh", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("live id kept", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("transient inspect error trusts cache", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, boom)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("list error propagates", func(t *testing.T) {
-		cr, client := newCR("")
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, boom)
-		require.ErrorIs(t, cr.find()(ctx), boom)
-		client.AssertExpectations(t)
-	})
-}
-
-// Every daemon entry point fails fast with a clear, container-named
-// error when no live cr.id is known.
-func TestRejectsMissingContainer(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).Return(mobyclient.ContainerListResult{}, nil)
-	cr := &containerReference{cli: client, input: &NewContainerInput{Name: "job-1"}}
-	check := func(op string, err error) {
-		t.Helper()
-		require.Error(t, err, op)
-		assert.Contains(t, err.Error(), `container "job-1" does not exist`, op)
-	}
-	check("copyContent", cr.copyContent("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	check("copyDir", cr.copyDir("/var/run/act", "/src", false)(ctx))
-	check("CopyTarStream", cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{}))
-	check("exec", cr.exec([]string{"echo"}, nil, "", "")(ctx))
-	_, err := cr.GetContainerArchive(ctx, "/var/run/act/x")
-	check("GetContainerArchive", err)
-}
-
-// End-to-end: a stale cr.id is cleared, repopulated from name lookup,
-// and the Copy completes against the fresh id.
-func TestPublicCopyPipelineHandlesStaleID(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerInspect", ctx, "stale", mobyclient.ContainerInspectOptions{}).
-		Return(mobyclient.ContainerInspectResult{}, cerrdefs.ErrNotFound.WithMessage("gone"))
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).
-		Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-	client.On("CopyToContainer", ctx, "fresh", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act"
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-
-	cr := &containerReference{id: "stale", cli: client, input: &NewContainerInput{Name: "job-1"}}
-	require.NoError(t, cr.Copy("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	assert.Equal(t, "fresh", cr.id)
-	client.AssertExpectations(t)
-}
-
-// TestDockerCopyToSymlinkPath is a regression test for gitea/runner#981. Most base images
-// symlink /var/run to /run, so copying into /var/run/act traverses that symlink. The broken
-// docker 29.5.1 daemon fails the extraction with "mkdirat var/run: file exists" (fixed in
-// 29.5.2). Running against the daemon shipped in the dind image, this catches a bad bump.
-func TestDockerCopyToSymlinkPath(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-
-	rc := NewContainer(&NewContainerInput{
-		Image:      "alpine:latest",
-		Entrypoint: []string{"sleep", "30"},
-		Name:       "act-test-symlink-" + time.Now().Format("20060102150405.000000"),
-		AutoRemove: true,
-	})
-	require.NoError(t, rc.Pull(false)(ctx))
-	require.NoError(t, rc.Create(nil, nil)(ctx))
-	require.NoError(t, rc.Start(false)(ctx))
-	t.Cleanup(func() {
-		_ = rc.Remove()(ctx)
-		_ = rc.Close()(ctx)
-	})
-
-	// CopyTarStream first creates the destination directory by extracting a tar at "/",
-	// which makes the daemon mkdir var, then var/run (the symlink), then act — the exact
-	// step that fails on the broken daemon.
-	err := rc.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
-	require.NoError(t, err)
-}
-
-// Type assert containerReference implements ExecutionsEnvironment
-var _ ExecutionsEnvironment = &containerReference{}
-
-func TestCheckVolumes(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		validVolumes  []string
-		binds         []string
-		expectedBinds []string
-	}{
-		{
-			desc:         "match all volumes",
-			validVolumes: []string{"**"},
-			binds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-			expectedBinds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-		},
-		{
-			desc:         "no volumes can be matched",
-			validVolumes: []string{},
-			binds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-			expectedBinds: []string{},
-		},
-		{
-			desc: "only allowed volumes can be matched",
-			validVolumes: []string{
-				"shared_volume",
-				"/home/test/data",
-				"/etc/conf.d/*.json",
-			},
-			binds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-				"sql_data:/sql_data",
-				"/secrets/keys:/keys",
-			},
-			expectedBinds: []string{
-				"shared_volume:/shared_volume",
-				"/home/test/data:/test_data",
-				"/etc/conf.d/base.json:/config/base.json",
-			},
-		},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			logger, _ := test.NewNullLogger()
-			ctx := common.WithLogger(context.Background(), logger)
-			cr := &containerReference{
-				input: &NewContainerInput{
-					ValidVolumes: tc.validVolumes,
-				},
-			}
-			_, hostConf := cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{Binds: tc.binds})
-			assert.Equal(t, tc.expectedBinds, hostConf.Binds)
-		})
-	}
-}
-
-func TestCheckVolumesRejectsEscapingHostPaths(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-
-	base := t.TempDir()
-	allowed := filepath.Join(base, "allowed")
-	denied := filepath.Join(base, "denied")
-	require.NoError(t, os.MkdirAll(allowed, 0o700))
-	require.NoError(t, os.MkdirAll(denied, 0o700))
-
-	cr := &containerReference{
-		input: &NewContainerInput{
-			ValidVolumes: []string{filepath.Join(allowed, "**")},
-		},
-	}
-
-	escapingPath := allowed + string(filepath.Separator) + ".." + string(filepath.Separator) + "denied"
-	_, hostConf := cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{escapingPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	linkPath := filepath.Join(allowed, "link")
-	if err := os.Symlink(denied, linkPath); err != nil {
-		t.Skipf("cannot create symlink: %v", err)
-	}
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{linkPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{filepath.Join(linkPath, "missing") + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-}

act/container/helpers_test.go

@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"testing"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}

act/container/host_environment.go

@@ -1,689 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync/atomic"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/filecollector"
-	"gitea.com/gitea/runner/act/lookpath"
-	"gitea.com/gitea/runner/internal/pkg/process"
-
-	"github.com/go-git/go-billy/v5/helper/polyfill"
-	"github.com/go-git/go-billy/v5/osfs"
-	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
-	"golang.org/x/term"
-)
-
-type HostEnvironment struct {
-	Path      string
-	TmpDir    string
-	ToolCache string
-	Workdir   string
-	// CleanWorkdir means teardown owns Workdir and may delete it. Leave false
-	// when Workdir points at a caller-owned checkout (e.g. `act` local mode).
-	CleanWorkdir bool
-	ActPath      string
-	CleanUp      func()
-	StdOut       io.Writer
-	AllocatePTY  bool // allocate a pseudo-TTY for each step's process
-}
-
-func (e *HostEnvironment) Create(_, _ []string) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func (e *HostEnvironment) ConnectToNetwork(name string) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func (e *HostEnvironment) Close() common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func (e *HostEnvironment) Copy(destPath string, files ...*FileEntry) common.Executor {
-	return func(ctx context.Context) error {
-		for _, f := range files {
-			if err := os.MkdirAll(filepath.Dir(filepath.Join(destPath, f.Name)), 0o777); err != nil {
-				return err
-			}
-			if err := os.WriteFile(filepath.Join(destPath, f.Name), []byte(f.Body), fs.FileMode(f.Mode)); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-}
-
-func (e *HostEnvironment) CopyTarStream(ctx context.Context, destPath string, tarStream io.Reader) error {
-	if err := os.RemoveAll(destPath); err != nil {
-		return err
-	}
-	tr := tar.NewReader(tarStream)
-	cp := &filecollector.CopyCollector{
-		DstDir: destPath,
-	}
-	for {
-		ti, err := tr.Next()
-		if errors.Is(err, io.EOF) {
-			return nil
-		} else if err != nil {
-			return err
-		}
-		if ti.FileInfo().IsDir() {
-			continue
-		}
-		if ctx.Err() != nil {
-			return errors.New("CopyTarStream has been cancelled")
-		}
-		if err := cp.WriteFile(ti.Name, ti.FileInfo(), ti.Linkname, tr); err != nil {
-			return err
-		}
-	}
-}
-
-func (e *HostEnvironment) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		srcPrefix := filepath.Dir(srcPath)
-		if !strings.HasSuffix(srcPrefix, string(filepath.Separator)) {
-			srcPrefix += string(filepath.Separator)
-		}
-		logger.Debugf("Stripping prefix:%s src:%s", srcPrefix, srcPath)
-		var ignorer gitignore.Matcher
-		if useGitIgnore {
-			ps, err := gitignore.ReadPatterns(polyfill.New(osfs.New(srcPath)), nil)
-			if err != nil {
-				logger.Debugf("Error loading .gitignore: %v", err)
-			}
-
-			ignorer = gitignore.NewMatcher(ps)
-		}
-		fc := &filecollector.FileCollector{
-			Fs:        &filecollector.DefaultFs{},
-			Ignorer:   ignorer,
-			SrcPath:   srcPath,
-			SrcPrefix: srcPrefix,
-			Handler: &filecollector.CopyCollector{
-				DstDir: destPath,
-			},
-		}
-		return filepath.Walk(srcPath, fc.CollectFiles(ctx, []string{}))
-	}
-}
-
-func (e *HostEnvironment) GetContainerArchive(ctx context.Context, srcPath string) (io.ReadCloser, error) {
-	buf := &bytes.Buffer{}
-	tw := tar.NewWriter(buf)
-	defer tw.Close()
-	srcPath = filepath.Clean(srcPath)
-	fi, err := os.Lstat(srcPath)
-	if err != nil {
-		return nil, err
-	}
-	tc := &filecollector.TarCollector{
-		TarWriter: tw,
-	}
-	if fi.IsDir() {
-		srcPrefix := srcPath
-		if !strings.HasSuffix(srcPrefix, string(filepath.Separator)) {
-			srcPrefix += string(filepath.Separator)
-		}
-		fc := &filecollector.FileCollector{
-			Fs:        &filecollector.DefaultFs{},
-			SrcPath:   srcPath,
-			SrcPrefix: srcPrefix,
-			Handler:   tc,
-		}
-		err = filepath.Walk(srcPath, fc.CollectFiles(ctx, []string{}))
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		var f io.ReadCloser
-		var linkname string
-		if fi.Mode()&fs.ModeSymlink != 0 {
-			linkname, err = os.Readlink(srcPath)
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			f, err = os.Open(srcPath)
-			if err != nil {
-				return nil, err
-			}
-			defer f.Close()
-		}
-		err := tc.WriteFile(fi.Name(), fi, linkname, f)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return io.NopCloser(buf), nil
-}
-
-func (e *HostEnvironment) Pull(_ bool) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func (e *HostEnvironment) Start(_ bool) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-type ptyWriter struct {
-	Out       io.Writer
-	AutoStop  atomic.Bool
-	dirtyLine bool
-}
-
-func (w *ptyWriter) Write(buf []byte) (int, error) {
-	if w.AutoStop.Load() && len(buf) > 0 && buf[len(buf)-1] == 4 {
-		n, err := w.Out.Write(buf[:len(buf)-1])
-		if err != nil {
-			return n, err
-		}
-		if w.dirtyLine || len(buf) > 1 && buf[len(buf)-2] != '\n' {
-			_, _ = w.Out.Write([]byte("\n"))
-			return n, io.EOF
-		}
-		return n, io.EOF
-	}
-	w.dirtyLine = strings.LastIndex(string(buf), "\n") < len(buf)-1
-	return w.Out.Write(buf)
-}
-
-type localEnv struct {
-	env map[string]string
-}
-
-func (l *localEnv) Getenv(name string) string {
-	if runtime.GOOS == "windows" {
-		for k, v := range l.env {
-			if strings.EqualFold(name, k) {
-				return v
-			}
-		}
-		return ""
-	}
-	return l.env[name]
-}
-
-func lookupPathHost(cmd string, env map[string]string, writer io.Writer) (string, error) {
-	f, err := lookpath.LookPath2(cmd, &localEnv{env: env})
-	if err != nil {
-		err := "Cannot find: " + cmd + " in PATH"
-		if _, _err := writer.Write([]byte(err + "\n")); _err != nil {
-			return "", fmt.Errorf("%v: %w", err, _err)
-		}
-		return "", errors.New(err)
-	}
-	return f, nil
-}
-
-func setupPty(cmd *exec.Cmd, cmdline string) (*os.File, *os.File, error) {
-	ppty, tty, err := openPty()
-	if err != nil {
-		return nil, nil, err
-	}
-	if term.IsTerminal(int(tty.Fd())) {
-		_, err := term.MakeRaw(int(tty.Fd()))
-		if err != nil {
-			ppty.Close()
-			tty.Close()
-			return nil, nil, err
-		}
-	}
-	cmd.Stdin = tty
-	cmd.Stdout = tty
-	cmd.Stderr = tty
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, true)
-	return ppty, tty, nil
-}
-
-func writeKeepAlive(ppty io.Writer) {
-	c := 1
-	var err error
-	for c == 1 && err == nil {
-		c, err = ppty.Write([]byte{4})
-		<-time.After(time.Second)
-	}
-}
-
-func copyPtyOutput(writer io.Writer, ppty io.Reader, finishLog context.CancelFunc) {
-	defer func() {
-		finishLog()
-	}()
-	if _, err := io.Copy(writer, ppty); err != nil {
-		return
-	}
-}
-
-func (e *HostEnvironment) UpdateFromImageEnv(_ *map[string]string) common.Executor {
-	return func(ctx context.Context) error {
-		return nil
-	}
-}
-
-func getEnvListFromMap(env map[string]string) []string {
-	envList := make([]string, 0)
-	for k, v := range env {
-		envList = append(envList, fmt.Sprintf("%s=%s", k, v))
-	}
-	return envList
-}
-
-func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline string, env map[string]string, _, workdir string) error {
-	envList := getEnvListFromMap(env)
-	var wd string
-	if workdir != "" {
-		if filepath.IsAbs(workdir) {
-			wd = workdir
-		} else {
-			wd = filepath.Join(e.Path, workdir)
-		}
-	} else {
-		wd = e.Path
-	}
-	f, err := lookupPathHost(command[0], env, e.StdOut)
-	if err != nil {
-		return err
-	}
-	cmd := exec.CommandContext(ctx, f)
-	cmd.Path = f
-	cmd.Args = command
-	cmd.Stdin = nil
-	cmd.Stdout = e.StdOut
-	cmd.Env = envList
-	cmd.Stderr = e.StdOut
-	cmd.Dir = wd
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, false)
-
-	// Kill the step's whole process tree on cancellation (a step often launches a
-	// shell that spawns further background or GUI children) and bound the post-exit
-	// I/O wait, so an orphan inheriting cmd's stdout/stderr pipe can never hang
-	// cmd.Wait() and the runner. See process.TreeKill. The PTY path below may
-	// override SysProcAttr, but never touches Cancel/WaitDelay.
-	treeKill := process.NewTreeKill(cmd)
-
-	var ppty *os.File
-	var tty *os.File
-	defer func() {
-		if ppty != nil {
-			ppty.Close()
-		}
-		if tty != nil {
-			tty.Close()
-		}
-	}()
-	if e.AllocatePTY {
-		var err error
-		ppty, tty, err = setupPty(cmd, cmdline)
-		if err != nil {
-			common.Logger(ctx).Debugf("Failed to setup Pty %v\n", err.Error())
-		}
-	}
-	var writer *ptyWriter
-	var logctx context.Context
-	if ppty != nil {
-		writer = &ptyWriter{Out: e.StdOut}
-		var finishLog context.CancelFunc
-		logctx, finishLog = context.WithCancel(context.Background())
-		go copyPtyOutput(writer, ppty, finishLog)
-		go writeKeepAlive(ppty)
-	}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	if k, kerr := treeKill.Capture(cmd.Process); kerr != nil {
-		common.Logger(ctx).Warnf("process tree kill setup failed, falling back to single-process kill: %v", kerr)
-	} else {
-		defer k.Close()
-	}
-	err = cmd.Wait()
-	if err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
-			return ExitCodeError(exitErr.ExitCode())
-		}
-		return err
-	}
-	if tty != nil {
-		writer.AutoStop.Store(true)
-		if _, err := tty.WriteString("\x04"); err != nil {
-			common.Logger(ctx).Debug("Failed to write EOT")
-		}
-		<-logctx.Done()
-		ppty.Close()
-		ppty = nil
-	}
-	return err
-}
-
-func (e *HostEnvironment) Exec(command []string /*cmdline string, */, env map[string]string, user, workdir string) common.Executor {
-	return e.ExecWithCmdLine(command, "", env, user, workdir)
-}
-
-func (e *HostEnvironment) ExecWithCmdLine(command []string, cmdline string, env map[string]string, user, workdir string) common.Executor {
-	return func(ctx context.Context) error {
-		if err := e.exec(ctx, command, cmdline, env, user, workdir); err != nil {
-			select {
-			case <-ctx.Done():
-				return fmt.Errorf("this step has been cancelled: %w", err)
-			default:
-				return err
-			}
-		}
-		return nil
-	}
-}
-
-func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
-	return parseEnvFile(e, srcPath, env)
-}
-
-// removeAll is the filesystem delete used by removeAllWithContext. A package
-// var so tests can substitute a blocking stub without patching os.RemoveAll.
-var removeAll = os.RemoveAll
-
-// removeAllWithContext runs removeAll in a goroutine and returns once it
-// finishes or ctx is cancelled. On cancellation the goroutine is left running —
-// a delete blocked inside a syscall cannot be interrupted (see runWithTimeout).
-func removeAllWithContext(ctx context.Context, path string) error {
-	done := make(chan error, 1)
-	go func() { done <- removeAll(path) }()
-	select {
-	case err := <-done:
-		return err
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
-func removePathWithRetry(ctx context.Context, path string) error {
-	if path == "" {
-		return nil
-	}
-	attempts := 1
-	delay := time.Duration(0)
-	if runtime.GOOS == "windows" {
-		attempts = 5
-		delay = 200 * time.Millisecond
-	}
-	var lastErr error
-	for i := 0; i < attempts; i++ {
-		if i > 0 {
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			case <-time.After(delay):
-			}
-		}
-		lastErr = removeAllWithContext(ctx, path)
-		if lastErr == nil {
-			return nil
-		}
-		if errors.Is(lastErr, context.DeadlineExceeded) {
-			return lastErr
-		}
-	}
-	return lastErr
-}
-
-// buildWindowsWorkspaceKillScript builds a PowerShell command that `taskkill
-// /T /F`s every process tree whose ExecutablePath or CommandLine references one
-// of the given absolute workspace dirs, releasing file handles for cleanup.
-//
-// Win32_Process is used because it exposes both ExecutablePath and CommandLine
-// (Get-Process doesn't, wmic is deprecated). Both match the dir+separator
-// prefix, so a sibling dir sharing a name prefix (job1 vs job10) is spared.
-// Ordinal String methods, not -like, so path metacharacters ([ ] ? *) stay
-// literal.
-//
-// Pure function so the quote-escaping can be unit-tested without PowerShell.
-func buildWindowsWorkspaceKillScript(dirs []string) string {
-	quoted := make([]string, len(dirs))
-	for i, d := range dirs {
-		// Single-quoted PowerShell literal; escape ' by doubling it.
-		quoted[i] = "'" + strings.ReplaceAll(d, "'", "''") + "'"
-	}
-
-	return `$paths = @(` + strings.Join(quoted, ",") + `)
-$selfPid = $PID
-Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
-    if ($_.ProcessId -eq $selfPid) { return $false }
-    foreach ($p in $paths) {
-        $prefix = $p + '\'
-        if ($_.ExecutablePath -and $_.ExecutablePath.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)) { return $true }
-        if ($_.CommandLine -and $_.CommandLine.IndexOf($prefix, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) { return $true }
-    }
-    return $false
-} | ForEach-Object {
-    & taskkill.exe /PID $_.ProcessId /T /F 2>$null | Out-Null
-}
-`
-}
-
-func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
-	if runtime.GOOS != "windows" {
-		return
-	}
-
-	// Detached: exec.CommandContext won't start on a cancelled ctx, and a
-	// server cancel has already cancelled the parent ctx.
-	killCtx, killCancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer killCancel()
-
-	logger := common.Logger(ctx)
-
-	// Workspace dirs we own. Any process running from or referencing one is a
-	// leftover job process. ToolCache is shared across jobs; Workdir only when
-	// we own it (else it's a caller-provided checkout, e.g. act local mode).
-	owned := []string{e.Path, e.TmpDir}
-	if e.CleanWorkdir {
-		owned = append(owned, e.Workdir)
-	}
-	dirs := make([]string, 0, len(owned))
-	for _, d := range owned {
-		if d == "" {
-			continue
-		}
-		abs, err := filepath.Abs(d)
-		if err != nil {
-			continue
-		}
-		dirs = append(dirs, abs)
-	}
-	if len(dirs) == 0 {
-		return
-	}
-
-	script := buildWindowsWorkspaceKillScript(dirs)
-
-	cmd := exec.CommandContext(killCtx, "powershell.exe", "-NoProfile", "-NonInteractive", "-Command", script)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		logger.Debugf("workspace process-tree kill via PowerShell failed: %v output=%s", err, strings.TrimSpace(string(out)))
-	}
-}
-
-// hostCleanupTimeout bounds each filesystem-teardown phase of the host
-// environment so a single stalled delete cannot wedge the runner slot forever.
-// A var (not const) so tests can shrink it.
-var hostCleanupTimeout = 30 * time.Second
-
-// runWithTimeout runs fn in a goroutine and returns once it finishes or timeout
-// elapses, whichever comes first. On timeout the goroutine is left running — an
-// os.RemoveAll blocked inside a delete syscall (AV/EDR filter drivers, an
-// unresponsive network mount, a dying disk) cannot be interrupted — and
-// context.DeadlineExceeded is returned. Leaking the goroutine and the scratch
-// state it was deleting is strictly better than blocking the caller forever and
-// permanently losing the runner's capacity slot; the leaked scratch dir is
-// reclaimed later by the runner's idle stale-dir sweep.
-func runWithTimeout(fn func(), timeout time.Duration) error {
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		fn()
-	}()
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-	select {
-	case <-done:
-		return nil
-	case <-timer.C:
-		return context.DeadlineExceeded
-	}
-}
-
-func (e *HostEnvironment) Remove() common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-
-		// Ensure any lingering child processes are ended before attempting
-		// to remove the workspace (Windows file locks otherwise prevent cleanup).
-		e.terminateRunningProcesses(ctx)
-
-		// Only removes per-job misc state. Must not remove the cache/toolcache root.
-		// Bound it: CleanUp is a caller-supplied, typically unbounded os.RemoveAll,
-		// and a delete stalled by a filesystem filter driver would otherwise hang
-		// the job forever at "Cleaning up container" and hold the capacity slot.
-		if e.CleanUp != nil {
-			logger.Debugf("running host environment cleanup callback")
-			if err := runWithTimeout(e.CleanUp, hostCleanupTimeout); err != nil {
-				logger.Warnf("host environment cleanup did not finish within %s; continuing job completion, scratch state may be leaked and is reclaimed by the idle stale-dir sweep", hostCleanupTimeout)
-			} else {
-				logger.Debugf("host environment cleanup callback finished")
-			}
-		}
-
-		// Detach: a cancelled ctx would skip removePathWithRetry's retries,
-		// which absorb Windows file-handle release lag after the kill above.
-		rmCtx, rmCancel := context.WithTimeout(context.Background(), hostCleanupTimeout)
-		defer rmCancel()
-
-		var errs []error
-		if err := removePathWithRetry(rmCtx, e.Path); err != nil {
-			logger.Warnf("failed to remove host misc state %s: %v", e.Path, err)
-			errs = append(errs, err)
-		}
-		if e.CleanWorkdir {
-			if err := removePathWithRetry(rmCtx, e.Workdir); err != nil {
-				logger.Warnf("failed to remove host workspace %s: %v", e.Workdir, err)
-				errs = append(errs, err)
-			}
-		}
-		for _, err := range errs {
-			if !errors.Is(err, context.DeadlineExceeded) {
-				return errors.Join(errs...)
-			}
-		}
-		// Bounded teardown timed out; warnings already logged above. Do not
-		// fail job completion — leaked scratch is reclaimed by the idle sweep.
-		return nil
-	}
-}
-
-func (e *HostEnvironment) ToContainerPath(path string) string {
-	if bp, err := filepath.Rel(e.Workdir, path); err != nil {
-		return filepath.Join(e.Path, bp)
-	} else if filepath.Clean(e.Workdir) == filepath.Clean(path) {
-		return e.Path
-	}
-	return path
-}
-
-func (e *HostEnvironment) GetActPath() string {
-	actPath := e.ActPath
-	if runtime.GOOS == "windows" {
-		actPath = strings.ReplaceAll(actPath, "\\", "/")
-	}
-	return actPath
-}
-
-func (*HostEnvironment) GetPathVariableName() string {
-	switch runtime.GOOS {
-	case "plan9":
-		return "path"
-	case "windows":
-		return "Path" // Actually we need a case insensitive map
-	}
-	return "PATH"
-}
-
-func (e *HostEnvironment) DefaultPathVariable() string {
-	v, _ := os.LookupEnv(e.GetPathVariableName())
-	return v
-}
-
-func (*HostEnvironment) JoinPathVariable(paths ...string) string {
-	return strings.Join(paths, string(filepath.ListSeparator))
-}
-
-// Reference for Arch values for runner.arch
-// https://docs.github.com/en/actions/learn-github-actions/contexts#runner-context
-func goArchToActionArch(arch string) string {
-	archMapper := map[string]string{
-		"x86_64":  "X64",
-		"386":     "X86",
-		"aarch64": "ARM64",
-	}
-	if arch, ok := archMapper[arch]; ok {
-		return arch
-	}
-	return arch
-}
-
-func goOsToActionOs(os string) string {
-	osMapper := map[string]string{
-		"darwin": "macOS",
-	}
-	if os, ok := osMapper[os]; ok {
-		return os
-	}
-	return os
-}
-
-func (e *HostEnvironment) GetRunnerContext(_ context.Context) map[string]any {
-	return map[string]any{
-		"os":         goOsToActionOs(runtime.GOOS),
-		"arch":       goArchToActionArch(runtime.GOARCH),
-		"temp":       e.TmpDir,
-		"tool_cache": e.ToolCache,
-	}
-}
-
-func (e *HostEnvironment) ReplaceLogWriter(stdout, _ io.Writer) (io.Writer, io.Writer) {
-	org := e.StdOut
-	e.StdOut = stdout
-	return org, org
-}
-
-func (*HostEnvironment) IsEnvironmentCaseInsensitive() bool {
-	return runtime.GOOS == "windows"
-}

act/container/host_environment_test.go

@@ -1,363 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"path"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// Type assert HostEnvironment implements ExecutionsEnvironment
-var _ ExecutionsEnvironment = &HostEnvironment{}
-
-func TestCopyDir(t *testing.T) {
-	dir := t.TempDir()
-	ctx := context.Background()
-	e := &HostEnvironment{
-		Path:      filepath.Join(dir, "path"),
-		TmpDir:    filepath.Join(dir, "tmp"),
-		ToolCache: filepath.Join(dir, "tool_cache"),
-		ActPath:   filepath.Join(dir, "act_path"),
-		StdOut:    os.Stdout,
-		Workdir:   path.Join("testdata", "scratch"),
-	}
-	_ = os.MkdirAll(e.Path, 0o700)
-	_ = os.MkdirAll(e.TmpDir, 0o700)
-	_ = os.MkdirAll(e.ToolCache, 0o700)
-	_ = os.MkdirAll(e.ActPath, 0o700)
-	err := e.CopyDir(e.Workdir, e.Path, true)(ctx)
-	assert.NoError(t, err)
-}
-
-func TestGetContainerArchive(t *testing.T) {
-	dir := t.TempDir()
-	ctx := context.Background()
-	e := &HostEnvironment{
-		Path:      filepath.Join(dir, "path"),
-		TmpDir:    filepath.Join(dir, "tmp"),
-		ToolCache: filepath.Join(dir, "tool_cache"),
-		ActPath:   filepath.Join(dir, "act_path"),
-		StdOut:    os.Stdout,
-		Workdir:   path.Join("testdata", "scratch"),
-	}
-	_ = os.MkdirAll(e.Path, 0o700)
-	_ = os.MkdirAll(e.TmpDir, 0o700)
-	_ = os.MkdirAll(e.ToolCache, 0o700)
-	_ = os.MkdirAll(e.ActPath, 0o700)
-	expectedContent := []byte("sdde/7sh")
-	err := os.WriteFile(filepath.Join(e.Path, "action.yml"), expectedContent, 0o600)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	archive, err := e.GetContainerArchive(ctx, e.Path)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	defer archive.Close()
-	reader := tar.NewReader(archive)
-	h, err := reader.Next()
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, "action.yml", h.Name)
-	content, err := io.ReadAll(reader)
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Equal(t, expectedContent, content)
-	_, err = reader.Next()
-	assert.ErrorIs(t, err, io.EOF)
-}
-
-func TestHostEnvironmentExecExitCode(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses POSIX shell")
-	}
-	dir := t.TempDir()
-	ctx := context.Background()
-	e := &HostEnvironment{
-		Path:      filepath.Join(dir, "path"),
-		TmpDir:    filepath.Join(dir, "tmp"),
-		ToolCache: filepath.Join(dir, "tool_cache"),
-		ActPath:   filepath.Join(dir, "act_path"),
-		StdOut:    io.Discard,
-		Workdir:   filepath.Join(dir, "path"),
-	}
-	for _, p := range []string{e.Path, e.TmpDir, e.ToolCache, e.ActPath} {
-		assert.NoError(t, os.MkdirAll(p, 0o700)) //nolint:testifylint // test setup
-	}
-
-	err := e.Exec([]string{"sh", "-c", "exit 3"}, map[string]string{"PATH": os.Getenv("PATH")}, "", "")(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(3), exitErr)
-	assert.Equal(t, "Process completed with exit code 3.", err.Error())
-}
-
-func TestHostEnvironmentAllocatePTY(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses POSIX shell")
-	}
-	for _, tc := range []struct {
-		name     string
-		allocPTY bool
-		expect   string
-	}{
-		{name: "off", allocPTY: false, expect: "NOTTY"},
-		{name: "on", allocPTY: true, expect: "TTY"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			buf := &bytes.Buffer{}
-			e := &HostEnvironment{
-				Path:        filepath.Join(dir, "path"),
-				TmpDir:      filepath.Join(dir, "tmp"),
-				ToolCache:   filepath.Join(dir, "tool_cache"),
-				ActPath:     filepath.Join(dir, "act_path"),
-				StdOut:      buf,
-				Workdir:     filepath.Join(dir, "path"),
-				AllocatePTY: tc.allocPTY,
-			}
-			for _, p := range []string{e.Path, e.TmpDir, e.ToolCache, e.ActPath} {
-				require.NoError(t, os.MkdirAll(p, 0o700))
-			}
-
-			err := e.Exec(
-				[]string{"sh", "-c", "[ -t 1 ] && printf TTY || printf NOTTY"},
-				map[string]string{"PATH": os.Getenv("PATH")}, "", "",
-			)(context.Background())
-			require.NoError(t, err)
-			got := strings.TrimSpace(strings.ReplaceAll(buf.String(), "\r", ""))
-			assert.Equal(t, tc.expect, got)
-		})
-	}
-}
-
-func TestHostEnvironmentRemovePreservesWorkdirByDefault(t *testing.T) {
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	miscRoot := filepath.Join(base, "misc")
-	path := filepath.Join(miscRoot, "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	workdir := filepath.Join(base, "workspace", "owner", "repo")
-	require.NoError(t, os.MkdirAll(workdir, 0o700))
-
-	e := &HostEnvironment{
-		Path:    path,
-		Workdir: workdir,
-		CleanUp: func() {
-			_ = os.RemoveAll(miscRoot)
-		},
-		StdOut: os.Stdout,
-	}
-	require.NoError(t, e.Remove()(ctx))
-	_, err := os.Stat(workdir)
-	require.NoError(t, err)
-}
-
-func TestHostEnvironmentRemoveCleansWorkdirWhenOwned(t *testing.T) {
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	miscRoot := filepath.Join(base, "misc")
-	path := filepath.Join(miscRoot, "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	workdir := filepath.Join(base, "workspace", "123", "owner", "repo")
-	require.NoError(t, os.MkdirAll(workdir, 0o700))
-
-	e := &HostEnvironment{
-		Path:         path,
-		Workdir:      workdir,
-		CleanWorkdir: true,
-		CleanUp: func() {
-			_ = os.RemoveAll(miscRoot)
-		},
-		StdOut: os.Stdout,
-	}
-	require.NoError(t, e.Remove()(ctx))
-	_, err := os.Stat(workdir)
-	assert.ErrorIs(t, err, os.ErrNotExist)
-}
-
-func TestRemoveAllWithContextDoesNotHangOnStuckDelete(t *testing.T) {
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	orig := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// removeAllWithContext intentionally leaks the delete goroutine on timeout,
-	// and that goroutine still references removeAll. Unblock it and wait for it
-	// to return before restoring the var, so the restore can't race the read.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = orig
-	})
-
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-
-	err := removeAllWithContext(ctx, t.TempDir())
-	require.ErrorIs(t, err, context.DeadlineExceeded)
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp guards against a stalled
-// CleanUp callback (e.g. an os.RemoveAll blocked by an AV/EDR filter driver or
-// an unresponsive mount) wedging the runner slot forever at "Cleaning up
-// container". Remove must time out the callback and complete job teardown.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp(t *testing.T) {
-	// Keep the suite fast: shrink the per-phase teardown timeout for this test.
-	orig := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = orig })
-
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	release := make(chan struct{})
-	t.Cleanup(func() { close(release) }) // unblock the leaked goroutine at test end
-
-	e := &HostEnvironment{
-		Path: path,
-		CleanUp: func() {
-			<-release // simulate a delete syscall stuck indefinitely
-		},
-		StdOut: os.Stdout,
-	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck CleanUp callback")
-	}
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval guards against a
-// stalled os.RemoveAll on the misc/workspace paths (same AV/EDR wedge as
-// #1023) wedging job completion after the CleanUp callback has already timed
-// out or finished.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval(t *testing.T) {
-	origTimeout := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = origTimeout })
-
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	origRemoveAll := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// The stuck delete goroutine outlives the timed-out Remove and still reads
-	// removeAll; unblock it and wait before restoring to avoid a restore/read race.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = origRemoveAll
-	})
-
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	e := &HostEnvironment{
-		Path:   path,
-		StdOut: os.Stdout,
-	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck path removal")
-	}
-}
-
-func TestBuildWindowsWorkspaceKillScript(t *testing.T) {
-	t.Run("single dir", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{`C:\workspace\job1`})
-		assert.Contains(t, s, `$paths = @('C:\workspace\job1')`)
-		// Self-PID guard is essential — without it the script could taskkill
-		// the PowerShell process running it.
-		assert.Contains(t, s, "$selfPid = $PID")
-		assert.Contains(t, s, "$_.ProcessId -eq $selfPid")
-		// Must match both ExecutablePath (binaries from the workspace) and
-		// CommandLine (system binaries invoked with workspace paths in args),
-		// both bounded by dir+separator so a name-prefix sibling is spared.
-		assert.Contains(t, s, `$prefix = $p + '\'`)
-		assert.Contains(t, s, "$_.ExecutablePath.StartsWith($prefix")
-		assert.Contains(t, s, "$_.CommandLine.IndexOf($prefix")
-		// Each matched PID must be tree-killed, not just stopped.
-		assert.Contains(t, s, "taskkill.exe /PID $_.ProcessId /T /F")
-	})
-
-	t.Run("multiple dirs comma-separated", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{
-			`C:\work\path`,
-			`C:\work\workdir`,
-			`C:\Users\runner\AppData\Local\Temp\job-42`,
-		})
-		assert.Contains(t, s, `'C:\work\path'`)
-		assert.Contains(t, s, `'C:\work\workdir'`)
-		assert.Contains(t, s, `'C:\Users\runner\AppData\Local\Temp\job-42'`)
-		// Commas between entries — no trailing comma, no leading comma.
-		assert.Contains(t, s, `'C:\work\path','C:\work\workdir',`)
-	})
-
-	t.Run("path with single quote is escaped", func(t *testing.T) {
-		// In PowerShell single-quoted strings the only special char is the
-		// quote itself, escaped by doubling. A workspace path that ever
-		// contained `'` would inject a command into the script otherwise.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\it's\path`})
-		assert.Contains(t, s, `'C:\work\it''s\path'`)
-		// And it must NOT appear unescaped — otherwise the quote would
-		// terminate the literal early.
-		assert.NotContains(t, s, `'C:\work\it's\path'`)
-	})
-
-	t.Run("path with wildcard metacharacters is matched literally", func(t *testing.T) {
-		// A path containing [ ] ? * must be embedded verbatim and matched with
-		// ordinal String methods, not -like, otherwise the metacharacters would
-		// be interpreted as wildcards and the leftover process could escape.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\[job]?1`})
-		assert.Contains(t, s, `'C:\work\[job]?1'`)
-		assert.NotContains(t, s, "-like")
-		assert.Contains(t, s, "StartsWith")
-		assert.Contains(t, s, "IndexOf")
-	})
-
-	t.Run("empty dir list still produces a valid script", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript(nil)
-		// Empty array literal — script runs, matches nothing, is a no-op.
-		assert.Contains(t, s, "$paths = @()")
-		assert.Contains(t, s, "Get-CimInstance Win32_Process")
-	})
-}

act/container/parse_env_file_test.go

@@ -1,75 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"bufio"
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func newTestHostEnv(t *testing.T) (*HostEnvironment, string) {
-	t.Helper()
-	e := &HostEnvironment{Path: t.TempDir()}
-	return e, filepath.Join(e.Path, "envfile")
-}
-
-func TestParseEnvFileSingleLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO=bar\nBAZ=qux\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-	assert.Equal(t, "qux", env["BAZ"])
-}
-
-func TestParseEnvFileMultiLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	content := "FOO<<EOF\nline1\nline2\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "line1\nline2", env["FOO"])
-}
-
-func TestParseEnvFileLargeValueWithinLimit(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	big := strings.Repeat("x", 2*1024*1024)
-	content := "FOO<<EOF\n" + big + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, big, env["FOO"])
-}
-
-func TestParseEnvFileLineExceedsBufferReportsScannerError(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	tooBig := strings.Repeat("x", 17*1024*1024) // over the 16 MiB cap
-	content := "FOO<<EOF\n" + tooBig + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.ErrorIs(t, err, bufio.ErrTooLong)
-	assert.Contains(t, err.Error(), "reading env file")
-}
-
-func TestParseEnvFileMissingDelimiter(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\nline2\n"), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "delimiter")
-}

act/container/util_openbsd_mips64.go

@@ -1,14 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"errors"
-	"os"
-)
-
-func openPty() (*os.File, *os.File, error) {
-	return nil, nil, errors.New("Unsupported")
-}

act/container/util_plan9.go

@@ -1,14 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"errors"
-	"os"
-)
-
-func openPty() (*os.File, *os.File, error) {
-	return nil, nil, errors.New("Unsupported")
-}

act/container/util_windows.go

@@ -1,14 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"errors"
-	"os"
-)
-
-func openPty() (*os.File, *os.File, error) {
-	return nil, nil, errors.New("Unsupported")
-}

act/exprparser/functions.go

@@ -1,300 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package exprparser
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strconv"
-	"strings"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
-	"github.com/rhysd/actionlint"
-)
-
-func (impl *interperterImpl) contains(search, item reflect.Value) (bool, error) {
-	switch search.Kind() {
-	case reflect.String, reflect.Int, reflect.Float64, reflect.Bool, reflect.Invalid:
-		return strings.Contains(
-			strings.ToLower(impl.coerceToString(search).String()),
-			strings.ToLower(impl.coerceToString(item).String()),
-		), nil
-
-	case reflect.Slice:
-		for i := 0; i < search.Len(); i++ {
-			arrayItem := search.Index(i).Elem()
-			result, err := impl.compareValues(arrayItem, item, actionlint.CompareOpNodeKindEq)
-			if err != nil {
-				return false, err
-			}
-
-			if isEqual, ok := result.(bool); ok && isEqual {
-				return true, nil
-			}
-		}
-	}
-
-	return false, nil
-}
-
-func (impl *interperterImpl) startsWith(searchString, searchValue reflect.Value) (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return strings.HasPrefix(
-		strings.ToLower(impl.coerceToString(searchString).String()),
-		strings.ToLower(impl.coerceToString(searchValue).String()),
-	), nil
-}
-
-func (impl *interperterImpl) endsWith(searchString, searchValue reflect.Value) (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return strings.HasSuffix(
-		strings.ToLower(impl.coerceToString(searchString).String()),
-		strings.ToLower(impl.coerceToString(searchValue).String()),
-	), nil
-}
-
-const (
-	passThrough = iota
-	bracketOpen
-	bracketClose
-)
-
-func (impl *interperterImpl) format(str reflect.Value, replaceValue ...reflect.Value) (string, error) {
-	input := impl.coerceToString(str).String()
-	var output strings.Builder
-	replacementIndex := ""
-
-	state := passThrough
-	for _, character := range input {
-		switch state {
-		case passThrough: // normal buffer output
-			switch character {
-			case '{':
-				state = bracketOpen
-
-			case '}':
-				state = bracketClose
-
-			default:
-				output.WriteRune(character)
-			}
-
-		case bracketOpen: // found {
-			switch character {
-			case '{':
-				output.WriteString("{")
-				replacementIndex = ""
-				state = passThrough
-
-			case '}':
-				index, err := strconv.ParseInt(replacementIndex, 10, 32)
-				if err != nil {
-					return "", fmt.Errorf("The following format string is invalid: '%s'", input)
-				}
-
-				replacementIndex = ""
-
-				if len(replaceValue) <= int(index) {
-					return "", fmt.Errorf("The following format string references more arguments than were supplied: '%s'", input)
-				}
-
-				output.WriteString(impl.coerceToString(replaceValue[index]).String())
-
-				state = passThrough
-
-			default:
-				replacementIndex += string(character)
-			}
-
-		case bracketClose: // found }
-			switch character {
-			case '}':
-				output.WriteString("}")
-				replacementIndex = ""
-				state = passThrough
-
-			default:
-				panic("Invalid format parser state")
-			}
-		}
-	}
-
-	if state != passThrough {
-		switch state {
-		case bracketOpen:
-			return "", fmt.Errorf("Unclosed brackets. The following format string is invalid: '%s'", input)
-
-		case bracketClose:
-			return "", fmt.Errorf("Closing bracket without opening one. The following format string is invalid: '%s'", input)
-		}
-	}
-
-	return output.String(), nil
-}
-
-func (impl *interperterImpl) join(array, sep reflect.Value) (string, error) { //nolint:unparam // pre-existing issue from nektos/act
-	separator := impl.coerceToString(sep).String()
-	switch array.Kind() {
-	case reflect.Slice:
-		var items []string
-		for i := 0; i < array.Len(); i++ {
-			items = append(items, impl.coerceToString(array.Index(i).Elem()).String())
-		}
-
-		return strings.Join(items, separator), nil
-	default:
-		return strings.Join([]string{impl.coerceToString(array).String()}, separator), nil
-	}
-}
-
-func (impl *interperterImpl) toJSON(value reflect.Value) (string, error) {
-	if value.Kind() == reflect.Invalid {
-		return "null", nil
-	}
-
-	json, err := json.MarshalIndent(value.Interface(), "", "  ")
-	if err != nil {
-		return "", fmt.Errorf("Cannot convert value to JSON. Cause: %v", err)
-	}
-
-	return string(json), nil
-}
-
-func (impl *interperterImpl) fromJSON(value reflect.Value) (any, error) {
-	if value.Kind() != reflect.String {
-		return nil, fmt.Errorf("Cannot parse non-string type %v as JSON", value.Kind())
-	}
-
-	var data any
-
-	err := json.Unmarshal([]byte(value.String()), &data)
-	if err != nil {
-		return nil, fmt.Errorf("Invalid JSON: %v", err)
-	}
-
-	return data, nil
-}
-
-func (impl *interperterImpl) hashFiles(paths ...reflect.Value) (string, error) {
-	var ps []gitignore.Pattern
-
-	const cwdPrefix = "." + string(filepath.Separator)
-	const excludeCwdPrefix = "!" + cwdPrefix
-	for _, path := range paths {
-		if path.Kind() == reflect.String {
-			cleanPath := path.String()
-			if strings.HasPrefix(cleanPath, cwdPrefix) {
-				cleanPath = cleanPath[len(cwdPrefix):]
-			} else if strings.HasPrefix(cleanPath, excludeCwdPrefix) {
-				cleanPath = "!" + cleanPath[len(excludeCwdPrefix):]
-			}
-			ps = append(ps, gitignore.ParsePattern(cleanPath, nil))
-		} else {
-			return "", errors.New("Non-string path passed to hashFiles")
-		}
-	}
-
-	matcher := gitignore.NewMatcher(ps)
-
-	var files []string
-	if err := filepath.Walk(impl.config.WorkingDir, func(path string, fi fs.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		sansPrefix := strings.TrimPrefix(path, impl.config.WorkingDir+string(filepath.Separator))
-		parts := strings.Split(sansPrefix, string(filepath.Separator))
-		if fi.IsDir() || !matcher.Match(parts, fi.IsDir()) {
-			return nil
-		}
-		files = append(files, path)
-		return nil
-	}); err != nil {
-		return "", fmt.Errorf("Unable to filepath.Walk: %v", err)
-	}
-
-	if len(files) == 0 {
-		return "", nil
-	}
-
-	hasher := sha256.New()
-
-	for _, file := range files {
-		f, err := os.Open(file)
-		if err != nil {
-			return "", fmt.Errorf("Unable to os.Open: %v", err)
-		}
-
-		if _, err := io.Copy(hasher, f); err != nil {
-			return "", fmt.Errorf("Unable to io.Copy: %v", err)
-		}
-
-		if err := f.Close(); err != nil {
-			return "", fmt.Errorf("Unable to Close file: %v", err)
-		}
-	}
-
-	return hex.EncodeToString(hasher.Sum(nil)), nil
-}
-
-func (impl *interperterImpl) getNeedsTransitive(job *model.Job) []string {
-	needs := job.Needs()
-
-	for _, need := range needs {
-		parentNeeds := impl.getNeedsTransitive(impl.config.Run.Workflow.GetJob(need))
-		needs = append(needs, parentNeeds...)
-	}
-
-	return needs
-}
-
-func (impl *interperterImpl) always() (bool, error) {
-	return true, nil
-}
-
-func (impl *interperterImpl) jobSuccess() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	jobs := impl.config.Run.Workflow.Jobs
-	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
-
-	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() != "success" {
-			return false, nil
-		}
-	}
-
-	return true, nil
-}
-
-func (impl *interperterImpl) stepSuccess() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.env.Job.Status == "success", nil
-}
-
-func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	jobs := impl.config.Run.Workflow.Jobs
-	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
-
-	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() == "failure" {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-func (impl *interperterImpl) stepFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.env.Job.Status == "failure", nil
-}
-
-func (impl *interperterImpl) cancelled() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.env.Job.Status == "cancelled", nil
-}

act/exprparser/functions_test.go

@@ -1,256 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package exprparser
-
-import (
-	"path/filepath"
-	"testing"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestFunctionContains(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"contains('search', 'item') }}", false, "contains-str-str"},
-		{`cOnTaInS('Hello', 'll') }}`, true, "contains-str-casing"},
-		{`contains('HELLO', 'll') }}`, true, "contains-str-casing"},
-		{`contains('3.141592', 3.14) }}`, true, "contains-str-number"},
-		{`contains(3.141592, '3.14') }}`, true, "contains-number-str"},
-		{`contains(3.141592, 3.14) }}`, true, "contains-number-number"},
-		{`contains(true, 'u') }}`, true, "contains-bool-str"},
-		{`contains(null, '') }}`, true, "contains-null-str"},
-		{`contains(fromJSON('["first","second"]'), 'first') }}`, true, "contains-item"},
-		{`contains(fromJSON('[null,"second"]'), '') }}`, true, "contains-item-null-empty-str"},
-		{`contains(fromJSON('["","second"]'), null) }}`, true, "contains-item-empty-str-null"},
-		{`contains(fromJSON('[true,"second"]'), 'true') }}`, false, "contains-item-bool-arr"},
-		{`contains(fromJSON('["true","second"]'), true) }}`, false, "contains-item-str-bool"},
-		{`contains(fromJSON('[3.14,"second"]'), '3.14') }}`, true, "contains-item-number-str"},
-		{`contains(fromJSON('[3.14,"second"]'), 3.14) }}`, true, "contains-item-number-number"},
-		{`contains(fromJSON('["","second"]'), fromJSON('[]')) }}`, false, "contains-item-str-arr"},
-		{`contains(fromJSON('["","second"]'), fromJSON('{}')) }}`, false, "contains-item-str-obj"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionStartsWith(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"startsWith('search', 'se') }}", true, "startswith-string"},
-		{"startsWith('search', 'sa') }}", false, "startswith-string"},
-		{"startsWith('123search', '123s') }}", true, "startswith-string"},
-		{"startsWith(123, 's') }}", false, "startswith-string"},
-		{"startsWith(123, '12') }}", true, "startswith-string"},
-		{"startsWith('123', 12) }}", true, "startswith-string"},
-		{"startsWith(null, '42') }}", false, "startswith-string"},
-		{"startsWith('null', null) }}", true, "startswith-string"},
-		{"startsWith('null', '') }}", true, "startswith-string"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionEndsWith(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"endsWith('search', 'ch') }}", true, "endsWith-string"},
-		{"endsWith('search', 'sa') }}", false, "endsWith-string"},
-		{"endsWith('search123s', '123s') }}", true, "endsWith-string"},
-		{"endsWith(123, 's') }}", false, "endsWith-string"},
-		{"endsWith(123, '23') }}", true, "endsWith-string"},
-		{"endsWith('123', 23) }}", true, "endsWith-string"},
-		{"endsWith(null, '42') }}", false, "endsWith-string"},
-		{"endsWith('null', null) }}", true, "endsWith-string"},
-		{"endsWith('null', '') }}", true, "endsWith-string"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionJoin(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"join(fromJSON('[\"a\", \"b\"]'), ',')", "a,b", "join-arr"},
-		{"join('string', ',')", "string", "join-str"},
-		{"join(1, ',')", "1", "join-number"},
-		{"join(null, ',')", "", "join-number"},
-		{"join(fromJSON('[\"a\", \"b\", null]'), null)", "ab", "join-number"},
-		{"join(fromJSON('[\"a\", \"b\"]'))", "a,b", "join-number"},
-		{"join(fromJSON('[\"a\", \"b\", null]'), 1)", "a1b1", "join-number"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionToJSON(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"toJSON(env) }}", "{\n  \"key\": \"value\"\n}", "toJSON"},
-		{"toJSON(null)", "null", "toJSON-null"},
-	}
-
-	env := &EvaluationEnvironment{
-		Env: map[string]string{
-			"key": "value",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionFromJSON(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"fromJSON('{\"foo\":\"bar\"}') }}", map[string]any{
-			"foo": "bar",
-		}, "fromJSON"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionHashFiles(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		name     string
-	}{
-		{"hashFiles('**/non-extant-files') }}", "", "hash-non-existing-file"},
-		{"hashFiles('**/non-extant-files', '**/more-non-extant-files') }}", "", "hash-multiple-non-existing-files"},
-		{"hashFiles('./for-hashing-1.txt') }}", "66a045b452102c59d840ec097d59d9467e13a3f34f6494e539ffd32c1bb35f18", "hash-single-file"},
-		{"hashFiles('./for-hashing-*.txt') }}", "8e5935e7e13368cd9688fe8f48a0955293676a021562582c7e848dafe13fb046", "hash-multiple-files"},
-		{"hashFiles('./for-hashing-*.txt', '!./for-hashing-2.txt') }}", "66a045b452102c59d840ec097d59d9467e13a3f34f6494e539ffd32c1bb35f18", "hash-negative-pattern"},
-		{"hashFiles('./for-hashing-**') }}", "c418ba693753c84115ced0da77f876cddc662b9054f4b129b90f822597ee2f94", "hash-multiple-files-and-directories"},
-		{"hashFiles('./for-hashing-3/**') }}", "6f5696b546a7a9d6d42a449dc9a56bef244aaa826601ef27466168846139d2c2", "hash-nested-directories"},
-		{"hashFiles('./for-hashing-3/**/nested-data.txt') }}", "8ecadfb49f7f978d0a9f3a957e9c8da6cc9ab871f5203b5d9f9d1dc87d8af18c", "hash-nested-directories-2"},
-	}
-
-	env := &EvaluationEnvironment{}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			workdir, err := filepath.Abs("testdata")
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			output, err := NewInterpeter(env, Config{WorkingDir: workdir}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			assert.Equal(t, tt.expected, output)
-		})
-	}
-}
-
-func TestFunctionFormat(t *testing.T) {
-	table := []struct {
-		input    string
-		expected any
-		error    any
-		name     string
-	}{
-		{"format('text')", "text", nil, "format-plain-string"},
-		{"format('Hello {0} {1} {2}!', 'Mona', 'the', 'Octocat')", "Hello Mona the Octocat!", nil, "format-with-placeholders"},
-		{"format('{{Hello {0} {1} {2}!}}', 'Mona', 'the', 'Octocat')", "{Hello Mona the Octocat!}", nil, "format-with-escaped-braces"},
-		{"format('{{0}}', 'test')", "{0}", nil, "format-with-escaped-braces"},
-		{"format('{{{0}}}', 'test')", "{test}", nil, "format-with-escaped-braces-and-value"},
-		{"format('}}')", "}", nil, "format-output-closing-brace"},
-		{`format('Hello "{0}" {1} {2} {3} {4}', null, true, -3.14, NaN, Infinity)`, `Hello "" true -3.14 NaN Infinity`, nil, "format-with-primitives"},
-		{`format('Hello "{0}" {1} {2}', fromJSON('[0, true, "abc"]'), fromJSON('[{"a":1}]'), fromJSON('{"a":{"b":1}}'))`, `Hello "Array" Array Object`, nil, "format-with-complex-types"},
-		{"format(true)", "true", nil, "format-with-primitive-args"},
-		{"format('echo Hello {0} ${{Test}}', github.undefined_property)", "echo Hello  ${Test}", nil, "format-with-undefined-value"},
-		{"format('{0}}', '{1}', 'World')", nil, "Closing bracket without opening one. The following format string is invalid: '{0}}'", "format-invalid-format-string"},
-		{"format('{0', '{1}', 'World')", nil, "Unclosed brackets. The following format string is invalid: '{0'", "format-invalid-format-string"},
-		{"format('{2}', '{1}', 'World')", "", "The following format string references more arguments than were supplied: '{2}'", "format-invalid-replacement-reference"},
-		{"format('{2147483648}')", "", "The following format string is invalid: '{2147483648}'", "format-invalid-replacement-reference"},
-		{"format('{0} {1} {2} {3}', 1.0, 1.1, 1234567890.0, 12345678901234567890.0)", "1 1.1 1234567890 1.23456789012346E+19", nil, "format-floats"},
-	}
-
-	env := &EvaluationEnvironment{
-		Github: &model.GithubContext{},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{}).Evaluate(tt.input, DefaultStatusCheckNone)
-			if tt.error != nil {
-				assert.Equal(t, tt.error, err.Error())
-			} else {
-				assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-				assert.Equal(t, tt.expected, output)
-			}
-		})
-	}
-}

act/exprparser/interpreter.go

@@ -1,644 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package exprparser
-
-import (
-	"encoding"
-	"errors"
-	"fmt"
-	"math"
-	"reflect"
-	"strings"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/rhysd/actionlint"
-)
-
-type EvaluationEnvironment struct {
-	Github    *model.GithubContext
-	Env       map[string]string
-	Job       *model.JobContext
-	Jobs      *map[string]*model.WorkflowCallResult
-	Steps     map[string]*model.StepResult
-	Runner    map[string]any
-	Secrets   map[string]string
-	Vars      map[string]string
-	Strategy  map[string]any
-	Matrix    map[string]any
-	Needs     map[string]Needs
-	Inputs    map[string]any
-	HashFiles func([]reflect.Value) (any, error)
-}
-
-type Needs struct {
-	Outputs map[string]string `json:"outputs"`
-	Result  string            `json:"result"`
-}
-
-type Config struct {
-	Run        *model.Run
-	WorkingDir string
-	Context    string
-}
-
-type DefaultStatusCheck int
-
-const (
-	DefaultStatusCheckNone DefaultStatusCheck = iota
-	DefaultStatusCheckSuccess
-	DefaultStatusCheckAlways
-	DefaultStatusCheckCanceled
-	DefaultStatusCheckFailure
-)
-
-func (dsc DefaultStatusCheck) String() string {
-	switch dsc {
-	case DefaultStatusCheckSuccess:
-		return "success"
-	case DefaultStatusCheckAlways:
-		return "always"
-	case DefaultStatusCheckCanceled:
-		return "cancelled"
-	case DefaultStatusCheckFailure:
-		return "failure"
-	}
-	return ""
-}
-
-type Interpreter interface {
-	Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (any, error)
-}
-
-type interperterImpl struct {
-	env    *EvaluationEnvironment
-	config Config
-}
-
-func NewInterpeter(env *EvaluationEnvironment, config Config) Interpreter {
-	return &interperterImpl{
-		env:    env,
-		config: config,
-	}
-}
-
-func (impl *interperterImpl) Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (any, error) {
-	input = strings.TrimPrefix(input, "${{")
-	if defaultStatusCheck != DefaultStatusCheckNone && input == "" {
-		input = "success()"
-	}
-	parser := actionlint.NewExprParser()
-	exprNode, err := parser.Parse(actionlint.NewExprLexer(input + "}}"))
-	if err != nil {
-		return nil, fmt.Errorf("Failed to parse: %s", err.Message)
-	}
-
-	if defaultStatusCheck != DefaultStatusCheckNone {
-		hasStatusCheckFunction := false
-		actionlint.VisitExprNode(exprNode, func(node, _ actionlint.ExprNode, entering bool) {
-			if funcCallNode, ok := node.(*actionlint.FuncCallNode); entering && ok {
-				switch strings.ToLower(funcCallNode.Callee) {
-				case "success", "always", "cancelled", "failure":
-					hasStatusCheckFunction = true
-				}
-			}
-		})
-
-		if !hasStatusCheckFunction {
-			exprNode = &actionlint.LogicalOpNode{
-				Kind: actionlint.LogicalOpNodeKindAnd,
-				Left: &actionlint.FuncCallNode{
-					Callee: defaultStatusCheck.String(),
-					Args:   []actionlint.ExprNode{},
-				},
-				Right: exprNode,
-			}
-		}
-	}
-
-	result, err2 := impl.evaluateNode(exprNode)
-
-	return result, err2
-}
-
-func (impl *interperterImpl) evaluateNode(exprNode actionlint.ExprNode) (any, error) {
-	switch node := exprNode.(type) {
-	case *actionlint.VariableNode:
-		return impl.evaluateVariable(node)
-	case *actionlint.BoolNode:
-		return node.Value, nil
-	case *actionlint.NullNode:
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-	case *actionlint.IntNode:
-		return node.Value, nil
-	case *actionlint.FloatNode:
-		return node.Value, nil
-	case *actionlint.StringNode:
-		return node.Value, nil
-	case *actionlint.IndexAccessNode:
-		return impl.evaluateIndexAccess(node)
-	case *actionlint.ObjectDerefNode:
-		return impl.evaluateObjectDeref(node)
-	case *actionlint.ArrayDerefNode:
-		return impl.evaluateArrayDeref(node)
-	case *actionlint.NotOpNode:
-		return impl.evaluateNot(node)
-	case *actionlint.CompareOpNode:
-		return impl.evaluateCompare(node)
-	case *actionlint.LogicalOpNode:
-		return impl.evaluateLogicalCompare(node)
-	case *actionlint.FuncCallNode:
-		return impl.evaluateFuncCall(node)
-	default:
-		return nil, fmt.Errorf("Fatal error! Unknown node type: %s node: %+v", reflect.TypeOf(exprNode), exprNode)
-	}
-}
-
-func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableNode) (any, error) {
-	switch strings.ToLower(variableNode.Name) {
-	case "github":
-		return impl.env.Github, nil
-	case "gitea": // compatible with Gitea
-		return impl.env.Github, nil
-	case "env":
-		return impl.env.Env, nil
-	case "job":
-		return impl.env.Job, nil
-	case "jobs":
-		if impl.env.Jobs == nil {
-			return nil, errors.New("Unavailable context: jobs")
-		}
-		return impl.env.Jobs, nil
-	case "steps":
-		return impl.env.Steps, nil
-	case "runner":
-		return impl.env.Runner, nil
-	case "secrets":
-		return impl.env.Secrets, nil
-	case "vars":
-		return impl.env.Vars, nil
-	case "strategy":
-		return impl.env.Strategy, nil
-	case "matrix":
-		return impl.env.Matrix, nil
-	case "needs":
-		return impl.env.Needs, nil
-	case "inputs":
-		return impl.env.Inputs, nil
-	case "infinity":
-		return math.Inf(1), nil
-	case "nan":
-		return math.NaN(), nil
-	default:
-		return nil, fmt.Errorf("Unavailable context: %s", variableNode.Name)
-	}
-}
-
-func (impl *interperterImpl) evaluateIndexAccess(indexAccessNode *actionlint.IndexAccessNode) (any, error) {
-	left, err := impl.evaluateNode(indexAccessNode.Operand)
-	if err != nil {
-		return nil, err
-	}
-
-	leftValue := reflect.ValueOf(left)
-
-	right, err := impl.evaluateNode(indexAccessNode.Index)
-	if err != nil {
-		return nil, err
-	}
-
-	rightValue := reflect.ValueOf(right)
-
-	switch rightValue.Kind() {
-	case reflect.String:
-		return impl.getPropertyValue(leftValue, rightValue.String())
-
-	case reflect.Int:
-		switch leftValue.Kind() {
-		case reflect.Slice:
-			if rightValue.Int() < 0 || rightValue.Int() >= int64(leftValue.Len()) {
-				return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-			}
-			return leftValue.Index(int(rightValue.Int())).Interface(), nil
-		default:
-			return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-		}
-
-	default:
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-	}
-}
-
-func (impl *interperterImpl) evaluateObjectDeref(objectDerefNode *actionlint.ObjectDerefNode) (any, error) {
-	left, err := impl.evaluateNode(objectDerefNode.Receiver)
-	if err != nil {
-		return nil, err
-	}
-
-	return impl.getPropertyValue(reflect.ValueOf(left), objectDerefNode.Property)
-}
-
-func (impl *interperterImpl) evaluateArrayDeref(arrayDerefNode *actionlint.ArrayDerefNode) (any, error) {
-	left, err := impl.evaluateNode(arrayDerefNode.Receiver)
-	if err != nil {
-		return nil, err
-	}
-
-	return impl.getSafeValue(reflect.ValueOf(left)), nil
-}
-
-func (impl *interperterImpl) getPropertyValue(left reflect.Value, property string) (value any, err error) {
-	switch left.Kind() {
-	case reflect.Pointer:
-		return impl.getPropertyValue(left.Elem(), property)
-
-	case reflect.Struct:
-		leftType := left.Type()
-		for field := range leftType.Fields() {
-			jsonName := field.Tag.Get("json")
-			if jsonName == property {
-				property = field.Name
-				break
-			}
-		}
-
-		fieldValue := left.FieldByNameFunc(func(name string) bool {
-			return strings.EqualFold(name, property)
-		})
-
-		if fieldValue.Kind() == reflect.Invalid {
-			return "", nil
-		}
-
-		i := fieldValue.Interface()
-		// The type stepStatus int is an integer, but should be treated as string
-		if m, ok := i.(encoding.TextMarshaler); ok {
-			text, err := m.MarshalText()
-			if err != nil {
-				return nil, err
-			}
-			return string(text), nil
-		}
-		return i, nil
-
-	case reflect.Map:
-		iter := left.MapRange()
-
-		for iter.Next() {
-			key := iter.Key()
-
-			switch key.Kind() {
-			case reflect.String:
-				if strings.EqualFold(key.String(), property) {
-					return impl.getMapValue(iter.Value())
-				}
-
-			default:
-				return nil, fmt.Errorf("'%s' in map key not implemented", key.Kind())
-			}
-		}
-
-		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-
-	case reflect.Slice:
-		var values []any
-
-		for i := 0; i < left.Len(); i++ {
-			value, err := impl.getPropertyValue(left.Index(i).Elem(), property)
-			if err != nil {
-				return nil, err
-			}
-
-			values = append(values, value)
-		}
-
-		return values, nil
-	}
-
-	return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
-}
-
-func (impl *interperterImpl) getMapValue(value reflect.Value) (any, error) {
-	if value.Kind() == reflect.Pointer {
-		return impl.getMapValue(value.Elem())
-	}
-
-	return value.Interface(), nil
-}
-
-func (impl *interperterImpl) evaluateNot(notNode *actionlint.NotOpNode) (any, error) {
-	operand, err := impl.evaluateNode(notNode.Operand)
-	if err != nil {
-		return nil, err
-	}
-
-	return !IsTruthy(operand), nil
-}
-
-func (impl *interperterImpl) evaluateCompare(compareNode *actionlint.CompareOpNode) (any, error) {
-	left, err := impl.evaluateNode(compareNode.Left)
-	if err != nil {
-		return nil, err
-	}
-
-	right, err := impl.evaluateNode(compareNode.Right)
-	if err != nil {
-		return nil, err
-	}
-
-	leftValue := reflect.ValueOf(left)
-	rightValue := reflect.ValueOf(right)
-
-	return impl.compareValues(leftValue, rightValue, compareNode.Kind)
-}
-
-func (impl *interperterImpl) compareValues(leftValue, rightValue reflect.Value, kind actionlint.CompareOpNodeKind) (any, error) {
-	if leftValue.Kind() != rightValue.Kind() {
-		if !impl.isNumber(leftValue) {
-			leftValue = impl.coerceToNumber(leftValue)
-		}
-		if !impl.isNumber(rightValue) {
-			rightValue = impl.coerceToNumber(rightValue)
-		}
-	}
-
-	switch leftValue.Kind() {
-	case reflect.Bool:
-		return impl.compareNumber(float64(impl.coerceToNumber(leftValue).Int()), float64(impl.coerceToNumber(rightValue).Int()), kind)
-	case reflect.String:
-		return impl.compareString(strings.ToLower(leftValue.String()), strings.ToLower(rightValue.String()), kind)
-
-	case reflect.Int:
-		if rightValue.Kind() == reflect.Float64 {
-			return impl.compareNumber(float64(leftValue.Int()), rightValue.Float(), kind)
-		}
-
-		return impl.compareNumber(float64(leftValue.Int()), float64(rightValue.Int()), kind)
-
-	case reflect.Float64:
-		if rightValue.Kind() == reflect.Int {
-			return impl.compareNumber(leftValue.Float(), float64(rightValue.Int()), kind)
-		}
-
-		return impl.compareNumber(leftValue.Float(), rightValue.Float(), kind)
-
-	case reflect.Invalid:
-		if rightValue.Kind() == reflect.Invalid {
-			return true, nil
-		}
-
-		// not possible situation - params are converted to the same type in code above
-		return nil, fmt.Errorf("Compare params of Invalid type: left: %+v, right: %+v", leftValue.Kind(), rightValue.Kind())
-
-	default:
-		return nil, fmt.Errorf("Compare not implemented for types: left: %+v, right: %+v", leftValue.Kind(), rightValue.Kind())
-	}
-}
-
-func (impl *interperterImpl) coerceToNumber(value reflect.Value) reflect.Value {
-	switch value.Kind() {
-	case reflect.Invalid:
-		return reflect.ValueOf(0)
-
-	case reflect.Bool:
-		switch value.Bool() {
-		case true:
-			return reflect.ValueOf(1)
-		case false:
-			return reflect.ValueOf(0)
-		}
-
-	case reflect.String:
-		if value.String() == "" {
-			return reflect.ValueOf(0)
-		}
-
-		// try to parse the string as a number
-		evaluated, err := impl.Evaluate(value.String(), DefaultStatusCheckNone)
-		if err != nil {
-			return reflect.ValueOf(math.NaN())
-		}
-
-		if value := reflect.ValueOf(evaluated); impl.isNumber(value) {
-			return value
-		}
-	}
-
-	return reflect.ValueOf(math.NaN())
-}
-
-func (impl *interperterImpl) coerceToString(value reflect.Value) reflect.Value {
-	switch value.Kind() {
-	case reflect.Invalid:
-		return reflect.ValueOf("")
-
-	case reflect.Bool:
-		switch value.Bool() {
-		case true:
-			return reflect.ValueOf("true")
-		case false:
-			return reflect.ValueOf("false")
-		}
-
-	case reflect.String:
-		return value
-
-	case reflect.Int:
-		return reflect.ValueOf(fmt.Sprint(value))
-
-	case reflect.Float64:
-		if math.IsInf(value.Float(), 1) {
-			return reflect.ValueOf("Infinity")
-		} else if math.IsInf(value.Float(), -1) {
-			return reflect.ValueOf("-Infinity")
-		}
-		return reflect.ValueOf(fmt.Sprintf("%.15G", value.Float()))
-
-	case reflect.Slice:
-		return reflect.ValueOf("Array")
-
-	case reflect.Map:
-		return reflect.ValueOf("Object")
-	}
-
-	return value
-}
-
-func (impl *interperterImpl) compareString(left, right string, kind actionlint.CompareOpNodeKind) (bool, error) {
-	switch kind {
-	case actionlint.CompareOpNodeKindLess:
-		return left < right, nil
-	case actionlint.CompareOpNodeKindLessEq:
-		return left <= right, nil
-	case actionlint.CompareOpNodeKindGreater:
-		return left > right, nil
-	case actionlint.CompareOpNodeKindGreaterEq:
-		return left >= right, nil
-	case actionlint.CompareOpNodeKindEq:
-		return left == right, nil
-	case actionlint.CompareOpNodeKindNotEq:
-		return left != right, nil
-	default:
-		return false, fmt.Errorf("TODO: not implemented to compare '%+v'", kind)
-	}
-}
-
-func (impl *interperterImpl) compareNumber(left, right float64, kind actionlint.CompareOpNodeKind) (bool, error) {
-	switch kind {
-	case actionlint.CompareOpNodeKindLess:
-		return left < right, nil
-	case actionlint.CompareOpNodeKindLessEq:
-		return left <= right, nil
-	case actionlint.CompareOpNodeKindGreater:
-		return left > right, nil
-	case actionlint.CompareOpNodeKindGreaterEq:
-		return left >= right, nil
-	case actionlint.CompareOpNodeKindEq:
-		return left == right, nil
-	case actionlint.CompareOpNodeKindNotEq:
-		return left != right, nil
-	default:
-		return false, fmt.Errorf("TODO: not implemented to compare '%+v'", kind)
-	}
-}
-
-func IsTruthy(input any) bool {
-	value := reflect.ValueOf(input)
-	switch value.Kind() {
-	case reflect.Bool:
-		return value.Bool()
-
-	case reflect.String:
-		return value.String() != ""
-
-	case reflect.Int:
-		return value.Int() != 0
-
-	case reflect.Float64:
-		if math.IsNaN(value.Float()) {
-			return false
-		}
-
-		return value.Float() != 0
-
-	case reflect.Map, reflect.Slice:
-		return true
-
-	default:
-		return false
-	}
-}
-
-func (impl *interperterImpl) isNumber(value reflect.Value) bool {
-	switch value.Kind() {
-	case reflect.Int, reflect.Float64:
-		return true
-	default:
-		return false
-	}
-}
-
-func (impl *interperterImpl) getSafeValue(value reflect.Value) any {
-	switch value.Kind() {
-	case reflect.Invalid:
-		return nil
-
-	case reflect.Float64:
-		if value.Float() == 0 {
-			return 0
-		}
-	}
-
-	return value.Interface()
-}
-
-func (impl *interperterImpl) evaluateLogicalCompare(compareNode *actionlint.LogicalOpNode) (any, error) {
-	left, err := impl.evaluateNode(compareNode.Left)
-	if err != nil {
-		return nil, err
-	}
-
-	leftValue := reflect.ValueOf(left)
-
-	if IsTruthy(left) == (compareNode.Kind == actionlint.LogicalOpNodeKindOr) {
-		return impl.getSafeValue(leftValue), nil
-	}
-
-	right, err := impl.evaluateNode(compareNode.Right)
-	if err != nil {
-		return nil, err
-	}
-
-	rightValue := reflect.ValueOf(right)
-
-	switch compareNode.Kind {
-	case actionlint.LogicalOpNodeKindAnd:
-		return impl.getSafeValue(rightValue), nil
-	case actionlint.LogicalOpNodeKindOr:
-		return impl.getSafeValue(rightValue), nil
-	}
-
-	return nil, fmt.Errorf("Unable to compare incompatibles types '%s' and '%s'", leftValue.Kind(), rightValue.Kind())
-}
-
-func (impl *interperterImpl) evaluateFuncCall(funcCallNode *actionlint.FuncCallNode) (any, error) {
-	args := make([]reflect.Value, 0)
-
-	for _, arg := range funcCallNode.Args {
-		value, err := impl.evaluateNode(arg)
-		if err != nil {
-			return nil, err
-		}
-
-		args = append(args, reflect.ValueOf(value))
-	}
-
-	switch strings.ToLower(funcCallNode.Callee) {
-	case "contains":
-		return impl.contains(args[0], args[1])
-	case "startswith":
-		return impl.startsWith(args[0], args[1])
-	case "endswith":
-		return impl.endsWith(args[0], args[1])
-	case "format":
-		return impl.format(args[0], args[1:]...)
-	case "join":
-		if len(args) == 1 {
-			return impl.join(args[0], reflect.ValueOf(","))
-		}
-		return impl.join(args[0], args[1])
-	case "tojson":
-		return impl.toJSON(args[0])
-	case "fromjson":
-		return impl.fromJSON(args[0])
-	case "hashfiles":
-		if impl.env.HashFiles != nil {
-			return impl.env.HashFiles(args)
-		}
-		return impl.hashFiles(args...)
-	case "always":
-		return impl.always()
-	case "success":
-		if impl.config.Context == "job" {
-			return impl.jobSuccess()
-		}
-		if impl.config.Context == "step" {
-			return impl.stepSuccess()
-		}
-		return nil, fmt.Errorf("Context '%s' must be one of 'job' or 'step'", impl.config.Context)
-	case "failure":
-		if impl.config.Context == "job" {
-			return impl.jobFailure()
-		}
-		if impl.config.Context == "step" {
-			return impl.stepFailure()
-		}
-		return nil, fmt.Errorf("Context '%s' must be one of 'job' or 'step'", impl.config.Context)
-	case "cancelled":
-		return impl.cancelled()
-	default:
-		return nil, fmt.Errorf("TODO: '%s' not implemented", funcCallNode.Callee)
-	}
-}

act/exprparser/testdata/for-hashing-1.txt

@@ -1 +0,0 @@
-Hello

act/exprparser/testdata/for-hashing-2.txt

@@ -1 +0,0 @@
-World!

act/exprparser/testdata/for-hashing-3/data.txt

@@ -1 +0,0 @@
-Knock knock!

act/exprparser/testdata/for-hashing-3/nested/nested-data.txt

@@ -1 +0,0 @@
-Anybody home?

act/lookpath/env.go

@@ -1,9 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package lookpath
-
-type Env interface {
-	Getenv(name string) string
-}

act/lookpath/lp_unix_test.go

@@ -1,74 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-
-package lookpath
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-type testEnv map[string]string
-
-func (e testEnv) Getenv(name string) string {
-	return e[name]
-}
-
-func TestLookPath2SearchesPathAndEmptyElement(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2("tool", testEnv{"PATH": string(filepath.ListSeparator) + dir})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2DirectPathDoesNotSearchPath(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2(exe, testEnv{"PATH": ""})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2ReportsPermissionAndNotFound(t *testing.T) {
-	dir := t.TempDir()
-	file := filepath.Join(dir, "not-executable")
-	if err := os.WriteFile(file, []byte("plain text"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := LookPath2(file, testEnv{"PATH": dir})
-	var pathErr *Error
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, fs.ErrPermission) {
-		t.Fatalf("LookPath2(non-executable) error = %v, want fs.ErrPermission wrapped in *Error", err)
-	}
-	if pathErr.Error() != fs.ErrPermission.Error() {
-		t.Fatalf("Error() = %q, want %q", pathErr.Error(), fs.ErrPermission.Error())
-	}
-
-	_, err = LookPath2("missing", testEnv{"PATH": dir})
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, ErrNotFound) {
-		t.Fatalf("LookPath2(missing) error = %v, want ErrNotFound wrapped in *Error", err)
-	}
-}

act/model/action_test.go

@@ -1,63 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestReadActionDefaultsAndCaseInsensitiveUsing(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-name: example
-runs:
-  using: NoDe24
-  main: dist/index.js
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.Using != ActionRunsUsingNode24 {
-		t.Fatalf("using = %q, want %q", action.Runs.Using, ActionRunsUsingNode24)
-	}
-	if action.Runs.PreIf != "always()" {
-		t.Fatalf("pre-if = %q, want always()", action.Runs.PreIf)
-	}
-	if action.Runs.PostIf != "always()" {
-		t.Fatalf("post-if = %q, want always()", action.Runs.PostIf)
-	}
-}
-
-func TestReadActionPreservesExplicitConditions(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-runs:
-  using: composite
-  pre-if: success()
-  post-if: failure()
-  steps:
-    - run: echo hello
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.PreIf != "success()" || action.Runs.PostIf != "failure()" {
-		t.Fatalf("conditions = %q/%q, want explicit values", action.Runs.PreIf, action.Runs.PostIf)
-	}
-	if !action.Runs.Using.IsComposite() || action.Runs.Using.IsDocker() || action.Runs.Using.IsNode() {
-		t.Fatalf("unexpected using predicates for %q", action.Runs.Using)
-	}
-}
-
-func TestReadActionRejectsUnknownUsing(t *testing.T) {
-	_, err := ReadAction(strings.NewReader(`
-runs:
-  using: node99
-`))
-	if err == nil {
-		t.Fatal("expected unknown runs.using to fail")
-	}
-	if !strings.Contains(err.Error(), "node99") {
-		t.Fatalf("error = %q, want invalid value", err)
-	}
-}

act/model/planner_test.go

@@ -1,199 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2021 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"path/filepath"
-	"strings"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type WorkflowPlanTest struct {
-	workflowPath      string
-	errorMessage      string
-	noWorkflowRecurse bool
-}
-
-func TestPlanner(t *testing.T) {
-	log.SetLevel(log.DebugLevel)
-
-	tables := []WorkflowPlanTest{
-		{"invalid-job-name/invalid-1.yml", "workflow is not valid. 'invalid-job-name-1': Job name 'invalid-JOB-Name-v1.2.3-docker_hub' is invalid. Names must start with a letter or '_' and contain only alphanumeric characters, '-', or '_'", false},
-		{"invalid-job-name/invalid-2.yml", "workflow is not valid. 'invalid-job-name-2': Job name '1234invalid-JOB-Name-v123-docker_hub' is invalid. Names must start with a letter or '_' and contain only alphanumeric characters, '-', or '_'", false},
-		{"invalid-job-name/valid-1.yml", "", false},
-		{"invalid-job-name/valid-2.yml", "", false},
-		{"empty-workflow", "unable to read workflow 'push.yml': file is empty: EOF", false},
-		{"nested", "unable to read workflow 'fail.yml': file is empty: EOF", false},
-		{"nested", "", true},
-	}
-
-	workdir, err := filepath.Abs("testdata")
-	assert.NoError(t, err, workdir) //nolint:testifylint // pre-existing issue from nektos/act
-	for _, table := range tables {
-		fullWorkflowPath := filepath.Join(workdir, table.workflowPath)
-		_, err = NewWorkflowPlanner(fullWorkflowPath, table.noWorkflowRecurse)
-		if table.errorMessage == "" {
-			assert.NoError(t, err, "WorkflowPlanner should exit without any error")
-		} else {
-			assert.EqualError(t, err, table.errorMessage)
-		}
-	}
-}
-
-func TestWorkflow(t *testing.T) {
-	log.SetLevel(log.DebugLevel)
-
-	workflow := Workflow{
-		Jobs: map[string]*Job{
-			"valid_job": {
-				Name: "valid_job",
-			},
-		},
-	}
-
-	// Check that an invalid job id returns error
-	result, err := createStages(&workflow, "invalid_job_id")
-	assert.Error(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.Nil(t, result)
-
-	// Check that an valid job id returns non-error
-	result, err = createStages(&workflow, "valid_job")
-	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.NotNil(t, result)
-}
-
-func TestNewSingleWorkflowPlannerAndPlanMethods(t *testing.T) {
-	planner, err := NewSingleWorkflowPlanner("ci.yml", strings.NewReader(`
-name: CI
-on: [push, pull_request]
-jobs:
-  build:
-    name: Build project
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-  test:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`))
-	require.NoError(t, err)
-
-	assert.Equal(t, []string{"pull_request", "push"}, planner.GetEvents())
-
-	eventPlan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, eventPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, eventPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, eventPlan.Stages[1].GetJobIDs())
-	assert.Equal(t, len("Build project"), eventPlan.MaxRunNameLen())
-	assert.Equal(t, "Build project", eventPlan.Stages[0].Runs[0].String())
-	assert.Equal(t, "build", eventPlan.Stages[0].Runs[0].JobID)
-	assert.NotNil(t, eventPlan.Stages[0].Runs[0].Job())
-
-	jobPlan, err := planner.PlanJob("test")
-	require.NoError(t, err)
-	require.Len(t, jobPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, jobPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, jobPlan.Stages[1].GetJobIDs())
-
-	allPlan, err := planner.PlanAll()
-	require.NoError(t, err)
-	require.Len(t, allPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, allPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, allPlan.Stages[1].GetJobIDs())
-}
-
-func TestCombineWorkflowPlannerMergesWorkflowStages(t *testing.T) {
-	first := mustReadWorkflow(t, `
-name: First
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-`)
-	second := mustReadWorkflow(t, `
-name: Second
-on: push
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make lint
-  test:
-    needs: lint
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`)
-
-	planner := CombineWorkflowPlanner(first, second)
-	plan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, plan.Stages, 2)
-	assert.ElementsMatch(t, []string{"build", "lint"}, plan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, plan.Stages[1].GetJobIDs())
-
-	empty, err := planner.PlanEvent("schedule")
-	require.NoError(t, err)
-	assert.Empty(t, empty.Stages)
-}
-
-func TestPlannerErrorsForMissingAndCyclicJobs(t *testing.T) {
-	workflow := mustReadWorkflow(t, `
-name: Cyclic
-on: push
-jobs:
-  a:
-    needs: b
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo a
-  b:
-    needs: a
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo b
-`)
-	planner := CombineWorkflowPlanner(workflow)
-
-	plan, err := planner.PlanJob("missing")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "Could not find any stages")
-
-	plan, err = planner.PlanEvent("push")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "unable to build dependency graph")
-}
-
-func TestNewSingleWorkflowPlannerErrors(t *testing.T) {
-	_, err := NewSingleWorkflowPlanner("empty.yml", strings.NewReader(""))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "file is empty")
-
-	_, err = NewSingleWorkflowPlanner("invalid.yml", strings.NewReader("jobs: ["))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "workflow is not valid")
-}
-
-func mustReadWorkflow(t *testing.T, content string) *Workflow {
-	t.Helper()
-
-	workflow, err := ReadWorkflow(strings.NewReader(content))
-	require.NoError(t, err)
-	if workflow.Name == "" {
-		workflow.Name = "workflow"
-	}
-	return workflow
-}

act/runner/action.go

@@ -1,770 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"crypto/sha256"
-	"embed"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path"
-	"path/filepath"
-	"regexp"
-	"runtime"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/kballard/go-shellquote"
-)
-
-type actionStep interface {
-	step
-
-	getActionModel() *model.Action
-	getCompositeRunContext(context.Context) *RunContext
-	getCompositeSteps() *compositeSteps
-}
-
-type readAction func(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error)
-
-type actionYamlReader func(filename string) (io.Reader, io.Closer, error)
-
-type fileWriter func(filename string, data []byte, perm fs.FileMode) error
-
-type runAction func(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor
-
-//go:embed res/trampoline.js
-var trampoline embed.FS
-
-var (
-	ContainerImageExistsLocally     = container.ImageExistsLocally
-	ContainerNewDockerBuildExecutor = container.NewDockerBuildExecutor
-)
-
-func readActionImpl(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
-	logger := common.Logger(ctx)
-	allErrors := []error{}
-	addError := func(fileName string, err error) {
-		if err != nil {
-			allErrors = append(allErrors, fmt.Errorf("failed to read '%s' from action '%s' with path '%s' of step %w", fileName, step.String(), actionPath, err))
-		} else {
-			// One successful read, clear error state
-			allErrors = nil
-		}
-	}
-	reader, closer, err := readFile("action.yml")
-	addError("action.yml", err)
-	if os.IsNotExist(err) {
-		reader, closer, err = readFile("action.yaml")
-		addError("action.yaml", err)
-		if os.IsNotExist(err) {
-			_, closer, err := readFile("Dockerfile")
-			addError("Dockerfile", err)
-			if err == nil {
-				closer.Close()
-				action := &model.Action{
-					Name: "(Synthetic)",
-					Runs: model.ActionRuns{
-						Using: "docker",
-						Image: "Dockerfile",
-					},
-				}
-				logger.Debugf("Using synthetic action %v for Dockerfile", action)
-				return action, nil
-			}
-			if step.With != nil {
-				if val, ok := step.With["args"]; ok {
-					var b []byte
-					if b, err = trampoline.ReadFile("res/trampoline.js"); err != nil {
-						return nil, err
-					}
-					err2 := writeFile(filepath.Join(actionDir, actionPath, "trampoline.js"), b, 0o400)
-					if err2 != nil {
-						return nil, err2
-					}
-					action := &model.Action{
-						Name: "(Synthetic)",
-						Inputs: map[string]model.Input{
-							"cwd": {
-								Description: "(Actual working directory)",
-								Required:    false,
-								Default:     filepath.Join(actionDir, actionPath),
-							},
-							"command": {
-								Description: "(Actual program)",
-								Required:    false,
-								Default:     val,
-							},
-						},
-						Runs: model.ActionRuns{
-							Using: "node12",
-							Main:  "trampoline.js",
-						},
-					}
-					logger.Debugf("Using synthetic action %v", action)
-					return action, nil
-				}
-			}
-		}
-	}
-	if allErrors != nil {
-		return nil, errors.Join(allErrors...)
-	}
-	defer closer.Close()
-
-	action, err := model.ReadAction(reader)
-	// For Gitea, reduce log noise
-	// logger.Debugf("Read action %v from '%s'", action, "Unknown")
-	return action, err
-}
-
-func maybeCopyToActionDir(ctx context.Context, step actionStep, actionDir, actionPath, containerActionDir string) error {
-	logger := common.Logger(ctx)
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	if stepModel.Type() != model.StepTypeUsesActionRemote {
-		return nil
-	}
-
-	var containerActionDirCopy string
-	containerActionDirCopy = strings.TrimSuffix(containerActionDir, actionPath)
-	logger.Debug(containerActionDirCopy)
-
-	if !strings.HasSuffix(containerActionDirCopy, `/`) {
-		containerActionDirCopy += `/`
-	}
-
-	if rc.Config != nil && rc.Config.ActionCache != nil {
-		raction := step.(*stepActionRemote)
-		ta, err := rc.Config.ActionCache.GetTarArchive(ctx, raction.cacheDir, raction.resolvedSha, "")
-		if err != nil {
-			return err
-		}
-		defer ta.Close()
-		return rc.JobContainer.CopyTarStream(ctx, containerActionDirCopy, ta)
-	}
-
-	defer git.AcquireCloneLock(actionDir)()
-
-	if err := removeGitIgnore(ctx, actionDir); err != nil {
-		return err
-	}
-
-	return rc.JobContainer.CopyDir(containerActionDirCopy, actionDir+"/", rc.Config.UseGitIgnore)(ctx)
-}
-
-func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		actionPath := ""
-		if remoteAction != nil && remoteAction.Path != "" {
-			actionPath = remoteAction.Path
-		}
-
-		action := step.getActionModel()
-		// For Gitea, reduce log noise
-		// logger.Debugf("About to run action %v", action)
-
-		err := setupActionEnv(ctx, step, remoteAction)
-		if err != nil {
-			return err
-		}
-
-		actionLocation := path.Join(actionDir, actionPath)
-		actionName, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
-
-		logger.Debugf("type=%v actionDir=%s actionPath=%s workdir=%s actionCacheDir=%s actionName=%s containerActionDir=%s", stepModel.Type(), actionDir, actionPath, rc.Config.Workdir, rc.ActionCacheDir(), actionName, containerActionDir)
-
-		x := action.Runs.Using
-		switch {
-		case x.IsNode():
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Main)}
-			logger.Debugf("executing remote job container: %s", containerArgs)
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
-		case x.IsDocker():
-			location := actionLocation
-			if remoteAction == nil {
-				location = containerActionDir
-			}
-			return execAsDocker(ctx, step, actionName, actionDir, location, remoteAction == nil)
-		case x.IsComposite():
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			return execAsComposite(step)(ctx)
-		case x == model.ActionRunsUsingGo:
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			execFileName := action.Runs.Main + ".out"
-			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Main}
-			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
-
-			return common.NewPipelineExecutor(
-				rc.execJobContainer(buildArgs, *step.getEnv(), "", containerActionDir),
-				rc.execJobContainer(execArgs, *step.getEnv(), "", ""),
-			)(ctx)
-		default:
-			return fmt.Errorf("The runs.using key must be one of: %v, got %s", []string{
-				model.ActionRunsUsingDocker,
-				model.ActionRunsUsingNode12,
-				model.ActionRunsUsingNode16,
-				model.ActionRunsUsingNode20,
-				model.ActionRunsUsingNode24,
-				model.ActionRunsUsingComposite,
-				model.ActionRunsUsingGo,
-			}, action.Runs.Using)
-		}
-	}
-}
-
-func setupActionEnv(ctx context.Context, step actionStep, _ *remoteAction) error {
-	rc := step.getRunContext()
-
-	// A few fields in the environment (e.g. GITHUB_ACTION_REPOSITORY)
-	// are dependent on the action. That means we can complete the
-	// setup only after resolving the whole action model and cloning
-	// the action
-	rc.withGithubEnv(ctx, step.getGithubContext(ctx), *step.getEnv())
-	populateEnvsFromSavedState(step.getEnv(), step, rc)
-	populateEnvsFromInput(ctx, step.getEnv(), step.getActionModel(), rc)
-
-	return nil
-}
-
-// https://github.com/nektos/act/issues/228#issuecomment-629709055
-// files in .gitignore are not copied in a Docker container
-// this causes issues with actions that ignore other important resources
-// such as `node_modules` for example
-func removeGitIgnore(ctx context.Context, directory string) error {
-	gitIgnorePath := path.Join(directory, ".gitignore")
-	if _, err := os.Stat(gitIgnorePath); err == nil {
-		// .gitignore exists
-		common.Logger(ctx).Debugf("Removing %s before docker cp", gitIgnorePath)
-		err := os.Remove(gitIgnorePath)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// dockerActionImageTag derives the local docker image tag used when an action
-// is built from a Dockerfile.
-//
-// For Gitea: a local action (`uses: ./` or `uses: ./path`) has an actionName
-// that is the workspace-relative path of the action. That path is identical
-// across repositories (e.g. "./" for a self-referencing action), so without
-// namespacing, every repository's local docker action would build and reuse the
-// same `act-dockeraction:latest` image on a shared docker daemon. A subsequent
-// repository would then silently run the image built for an earlier one.
-// Including the repository keeps the tag stable for caching within a repository
-// while preventing cross-repository collisions.
-// See https://gitea.com/gitea/runner/issues/1039.
-func dockerActionImageTag(repository, actionName string, localAction bool) string {
-	name := actionName
-	if localAction {
-		name = path.Join(repository, actionName)
-	}
-	// The human-readable name is sanitized by collapsing every non-alphanumeric character to "-".
-	sanitized := regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(name, "-")
-	if localAction {
-		// For local actions a short hash of the raw repository and action path is appended so the tag stays unique per repository.
-		sum := sha256.Sum256([]byte(repository + "\x00" + actionName))
-		sanitized += "-" + hex.EncodeToString(sum[:])[:12]
-	}
-	// "-dockeraction" ensures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
-	image := fmt.Sprintf("%s-dockeraction:%s", sanitized, "latest")
-	image = "act-" + strings.TrimLeft(image, "-")
-	return strings.ToLower(image)
-}
-
-// TODO: break out parts of function to reduce complexicity
-func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, basedir string, localAction bool) error {
-	logger := common.Logger(ctx)
-	rc := step.getRunContext()
-	action := step.getActionModel()
-
-	var prepImage common.Executor
-	var image string
-	forcePull := false
-	if after, ok := strings.CutPrefix(action.Runs.Image, "docker://"); ok {
-		image = after
-		// Apply forcePull only for prebuild docker images
-		forcePull = rc.Config.ForcePull
-	} else {
-		image = dockerActionImageTag(step.getGithubContext(ctx).Repository, actionName, localAction)
-		contextDir, fileName := filepath.Split(filepath.Join(basedir, action.Runs.Image))
-
-		anyArchExists, err := ContainerImageExistsLocally(ctx, image, "any")
-		if err != nil {
-			return err
-		}
-
-		correctArchExists, err := ContainerImageExistsLocally(ctx, image, rc.Config.ContainerArchitecture)
-		if err != nil {
-			return err
-		}
-
-		if anyArchExists && !correctArchExists {
-			wasRemoved, err := container.RemoveImage(ctx, image, true, true)
-			if err != nil {
-				return err
-			}
-			if !wasRemoved {
-				return fmt.Errorf("failed to remove image '%s'", image)
-			}
-		}
-
-		if !correctArchExists || rc.Config.ForceRebuild {
-			logger.Debugf("image '%s' for architecture '%s' will be built from context '%s", image, rc.Config.ContainerArchitecture, contextDir)
-			var buildContext io.ReadCloser
-			if localAction {
-				buildContext, err = rc.JobContainer.GetContainerArchive(ctx, contextDir+"/.")
-				if err != nil {
-					return err
-				}
-				defer buildContext.Close()
-			} else if rc.Config.ActionCache != nil {
-				rstep := step.(*stepActionRemote)
-				buildContext, err = rc.Config.ActionCache.GetTarArchive(ctx, rstep.cacheDir, rstep.resolvedSha, contextDir)
-				if err != nil {
-					return err
-				}
-				defer buildContext.Close()
-			}
-			prepImage = ContainerNewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
-				ContextDir:   contextDir,
-				Dockerfile:   fileName,
-				ImageTag:     image,
-				BuildContext: buildContext,
-				Platform:     rc.Config.ContainerArchitecture,
-			})
-			if buildContext == nil {
-				// Held across the whole build: the daemon drains contextDir lazily.
-				inner := prepImage
-				prepImage = func(ctx context.Context) error {
-					defer git.AcquireCloneLock(actionDir)()
-					return inner(ctx)
-				}
-			}
-		} else {
-			logger.Debugf("image '%s' for architecture '%s' already exists", image, rc.Config.ContainerArchitecture)
-		}
-	}
-	eval := rc.NewStepExpressionEvaluator(ctx, step)
-	cmd, err := shellquote.Split(eval.Interpolate(ctx, step.getStepModel().With["args"]))
-	if err != nil {
-		return err
-	}
-	if len(cmd) == 0 {
-		cmd = action.Runs.Args
-		evalDockerArgs(ctx, step, action, &cmd)
-	}
-	entrypoint := strings.Fields(eval.Interpolate(ctx, step.getStepModel().With["entrypoint"]))
-	if len(entrypoint) == 0 {
-		if action.Runs.Entrypoint != "" {
-			entrypoint, err = shellquote.Split(action.Runs.Entrypoint)
-			if err != nil {
-				return err
-			}
-		} else {
-			entrypoint = nil
-		}
-	}
-	stepContainer := newStepContainer(ctx, step, image, cmd, entrypoint)
-	return common.NewPipelineExecutor(
-		prepImage,
-		stepContainer.Pull(forcePull),
-		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
-		stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
-		stepContainer.Start(true),
-	).Finally(
-		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
-	).Finally(stepContainer.Close())(ctx)
-}
-
-func evalDockerArgs(ctx context.Context, step step, action *model.Action, cmd *[]string) {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	inputs := make(map[string]string)
-	eval := rc.NewExpressionEvaluator(ctx)
-	// Set Defaults
-	for k, input := range action.Inputs {
-		inputs[k] = eval.Interpolate(ctx, input.Default)
-	}
-	if stepModel.With != nil {
-		for k, v := range stepModel.With {
-			inputs[k] = eval.Interpolate(ctx, v)
-		}
-	}
-	mergeIntoMap(step, step.getEnv(), inputs)
-
-	stepEE := rc.NewStepExpressionEvaluator(ctx, step)
-	for i, v := range *cmd {
-		(*cmd)[i] = stepEE.Interpolate(ctx, v)
-	}
-	mergeIntoMap(step, step.getEnv(), action.Runs.Env)
-
-	ee := rc.NewStepExpressionEvaluator(ctx, step)
-	for k, v := range *step.getEnv() {
-		(*step.getEnv())[k] = ee.Interpolate(ctx, v)
-	}
-}
-
-func newStepContainer(ctx context.Context, step step, image string, cmd, entrypoint []string) container.Container {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-	rawLogger := common.Logger(ctx).WithField("raw_output", true)
-	logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
-		if rc.Config.LogOutput {
-			rawLogger.Infof("%s", s)
-		} else {
-			rawLogger.Debugf("%s", s)
-		}
-		return true
-	})
-	envList := make([]string, 0)
-	for k, v := range *step.getEnv() {
-		envList = append(envList, fmt.Sprintf("%s=%s", k, v))
-	}
-
-	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TOOL_CACHE", "/opt/hostedtoolcache"))
-	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_OS", "Linux"))
-	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_ARCH", container.RunnerArch(ctx)))
-	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TEMP", "/tmp"))
-
-	binds, mounts := rc.GetBindsAndMounts()
-	networkMode := "container:" + rc.jobContainerName()
-	if rc.IsHostEnv(ctx) {
-		networkMode = "default"
-	}
-	stepContainer := ContainerNewContainer(&container.NewContainerInput{
-		Cmd:          cmd,
-		Entrypoint:   entrypoint,
-		WorkingDir:   rc.JobContainer.ToContainerPath(rc.Config.Workdir),
-		Image:        image,
-		Name:         createContainerName(rc.jobContainerName(), "STEP-"+stepModel.ID),
-		Env:          envList,
-		Mounts:       mounts,
-		NetworkMode:  networkMode,
-		Binds:        binds,
-		Stdout:       logWriter,
-		Stderr:       logWriter,
-		Privileged:   rc.Config.Privileged,
-		UsernsMode:   rc.Config.UsernsMode,
-		Platform:     rc.Config.ContainerArchitecture,
-		Options:      rc.Config.ContainerOptions,
-		AutoRemove:   rc.Config.AutoRemove,
-		ValidVolumes: rc.validVolumes(),
-		AllocatePTY:  rc.Config.AllocatePTY,
-	})
-	return stepContainer
-}
-
-func populateEnvsFromSavedState(env *map[string]string, step actionStep, rc *RunContext) {
-	state, ok := rc.IntraActionState[step.getStepModel().ID]
-	if ok {
-		for name, value := range state {
-			envName := "STATE_" + name
-			(*env)[envName] = value
-		}
-	}
-}
-
-func populateEnvsFromInput(ctx context.Context, env *map[string]string, action *model.Action, rc *RunContext) {
-	eval := rc.NewExpressionEvaluator(ctx)
-	for inputID, input := range action.Inputs {
-		envKey := regexp.MustCompile("[^A-Z0-9-]").ReplaceAllString(strings.ToUpper(inputID), "_")
-		envKey = "INPUT_" + envKey
-		if _, ok := (*env)[envKey]; !ok {
-			(*env)[envKey] = eval.Interpolate(ctx, input.Default)
-		}
-	}
-}
-
-func getContainerActionPaths(step *model.Step, actionDir string, rc *RunContext) (string, string) {
-	actionName := ""
-	containerActionDir := "."
-	if step.Type() != model.StepTypeUsesActionRemote {
-		actionName = getOsSafeRelativePath(actionDir, rc.Config.Workdir)
-		containerActionDir = rc.JobContainer.ToContainerPath(rc.Config.Workdir) + "/" + actionName
-		actionName = "./" + actionName
-	} else if step.Type() == model.StepTypeUsesActionRemote {
-		actionName = getOsSafeRelativePath(actionDir, rc.ActionCacheDir())
-		containerActionDir = rc.JobContainer.GetActPath() + "/actions/" + actionName
-	}
-
-	if actionName == "" {
-		actionName = filepath.Base(actionDir)
-		if runtime.GOOS == "windows" {
-			actionName = strings.ReplaceAll(actionName, "\\", "/")
-		}
-	}
-	return actionName, containerActionDir
-}
-
-func getOsSafeRelativePath(s, prefix string) string {
-	actionName := strings.TrimPrefix(s, prefix)
-	if runtime.GOOS == "windows" {
-		actionName = strings.ReplaceAll(actionName, "\\", "/")
-	}
-	actionName = strings.TrimPrefix(actionName, "/")
-
-	return actionName
-}
-
-func shouldRunPreStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		log := common.Logger(ctx)
-
-		if step.getActionModel() == nil {
-			log.Debugf("skip pre step for '%s': no action model available", step.getStepModel())
-			return false
-		}
-
-		return true
-	}
-}
-
-func hasPreStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		action := step.getActionModel()
-		return action.Runs.Using.IsComposite() ||
-			(action.Runs.Using.IsNode() &&
-				action.Runs.Pre != "") ||
-			(action.Runs.Using == model.ActionRunsUsingGo &&
-				action.Runs.Pre != "")
-	}
-}
-
-func runPreStep(step actionStep) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		logger.Debugf("run pre step for '%s'", step.getStepModel())
-
-		rc := step.getRunContext()
-		stepModel := step.getStepModel()
-		action := step.getActionModel()
-
-		x := action.Runs.Using
-		switch {
-		case x.IsNode():
-			// defaults in pre steps were missing, however provided inputs are available
-			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-			// todo: refactor into step
-			var actionDir string
-			var actionPath string
-			if _, ok := step.(*stepActionRemote); ok {
-				actionPath = newRemoteAction(stepModel.Uses).Path
-				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
-			} else {
-				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
-				actionPath = ""
-			}
-
-			var actionLocation string
-			if actionPath != "" {
-				actionLocation = path.Join(actionDir, actionPath)
-			} else {
-				actionLocation = actionDir
-			}
-
-			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
-
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Pre)}
-			logger.Debugf("executing remote job container: %s", containerArgs)
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
-
-		case x.IsComposite():
-			if step.getCompositeSteps() == nil {
-				step.getCompositeRunContext(ctx)
-			}
-
-			if steps := step.getCompositeSteps(); steps != nil && steps.pre != nil {
-				return steps.pre(ctx)
-			}
-			return errors.New("missing steps in composite action")
-
-		case x == model.ActionRunsUsingGo:
-			// defaults in pre steps were missing, however provided inputs are available
-			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-			// todo: refactor into step
-			var actionDir string
-			var actionPath string
-			if _, ok := step.(*stepActionRemote); ok {
-				actionPath = newRemoteAction(stepModel.Uses).Path
-				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
-			} else {
-				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
-				actionPath = ""
-			}
-
-			var actionLocation string
-			if actionPath != "" {
-				actionLocation = path.Join(actionDir, actionPath)
-			} else {
-				actionLocation = actionDir
-			}
-
-			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
-
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			execFileName := action.Runs.Pre + ".out"
-			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Pre}
-			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
-
-			return common.NewPipelineExecutor(
-				rc.execJobContainer(buildArgs, *step.getEnv(), "", containerActionDir),
-				rc.execJobContainer(execArgs, *step.getEnv(), "", ""),
-			)(ctx)
-		default:
-			return nil
-		}
-	}
-}
-
-func shouldRunPostStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		log := common.Logger(ctx)
-		stepResults := step.getRunContext().getStepsContext()
-		stepResult := stepResults[step.getStepModel().ID]
-
-		if stepResult == nil {
-			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s'; step was not executed", step.getStepModel())
-			return false
-		}
-
-		if stepResult.Conclusion == model.StepStatusSkipped {
-			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s'; main step was skipped", step.getStepModel())
-			return false
-		}
-
-		if step.getActionModel() == nil {
-			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s': no action model available", step.getStepModel())
-			return false
-		}
-
-		return true
-	}
-}
-
-func hasPostStep(step actionStep) common.Conditional {
-	return func(ctx context.Context) bool {
-		action := step.getActionModel()
-		return action.Runs.Using.IsComposite() ||
-			(action.Runs.Using.IsNode() &&
-				action.Runs.Post != "") ||
-			(action.Runs.Using == model.ActionRunsUsingGo &&
-				action.Runs.Post != "")
-	}
-}
-
-func runPostStep(step actionStep) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		logger.Debugf("run post step for '%s'", step.getStepModel())
-
-		rc := step.getRunContext()
-		stepModel := step.getStepModel()
-		action := step.getActionModel()
-
-		// todo: refactor into step
-		var actionDir string
-		var actionPath string
-		if _, ok := step.(*stepActionRemote); ok {
-			actionPath = newRemoteAction(stepModel.Uses).Path
-			actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
-		} else {
-			actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
-			actionPath = ""
-		}
-
-		var actionLocation string
-		if actionPath != "" {
-			actionLocation = path.Join(actionDir, actionPath)
-		} else {
-			actionLocation = actionDir
-		}
-
-		_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
-
-		x := action.Runs.Using
-		switch {
-		case x.IsNode():
-
-			populateEnvsFromSavedState(step.getEnv(), step, rc)
-
-			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Post)}
-			logger.Debugf("executing remote job container: %s", containerArgs)
-
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
-
-		case x.IsComposite():
-			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
-				return err
-			}
-
-			if steps := step.getCompositeSteps(); steps != nil && steps.post != nil {
-				return steps.post(ctx)
-			}
-			return errors.New("missing steps in composite action")
-
-		case x == model.ActionRunsUsingGo:
-			populateEnvsFromSavedState(step.getEnv(), step, rc)
-			rc.ApplyExtraPath(ctx, step.getEnv())
-
-			execFileName := action.Runs.Post + ".out"
-			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Post}
-			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
-
-			return common.NewPipelineExecutor(
-				rc.execJobContainer(buildArgs, *step.getEnv(), "", containerActionDir),
-				rc.execJobContainer(execArgs, *step.getEnv(), "", ""),
-			)(ctx)
-
-		default:
-			return nil
-		}
-	}
-}

act/runner/action_cache.go

@@ -1,156 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"archive/tar"
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"errors"
-	"io"
-	"io/fs"
-	"path"
-	"strings"
-
-	git "github.com/go-git/go-git/v5"
-	config "github.com/go-git/go-git/v5/config"
-	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/go-git/go-git/v5/plumbing/object"
-	"github.com/go-git/go-git/v5/plumbing/transport"
-	"github.com/go-git/go-git/v5/plumbing/transport/http"
-)
-
-type ActionCache interface {
-	Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error)
-	GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error)
-}
-
-type GoGitActionCache struct {
-	Path string
-}
-
-func (c GoGitActionCache) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {
-	gitPath := path.Join(c.Path, safeFilename(cacheDir)+".git")
-	gogitrepo, err := git.PlainInit(gitPath, true)
-	if errors.Is(err, git.ErrRepositoryAlreadyExists) {
-		gogitrepo, err = git.PlainOpen(gitPath)
-	}
-	if err != nil {
-		return "", err
-	}
-	tmpBranch := make([]byte, 12)
-	if _, err := rand.Read(tmpBranch); err != nil {
-		return "", err
-	}
-	branchName := hex.EncodeToString(tmpBranch)
-
-	var auth transport.AuthMethod
-	if token != "" {
-		auth = &http.BasicAuth{
-			Username: "token",
-			Password: token,
-		}
-	}
-	remote, err := gogitrepo.CreateRemoteAnonymous(&config.RemoteConfig{
-		Name: "anonymous",
-		URLs: []string{
-			url,
-		},
-	})
-	if err != nil {
-		return "", err
-	}
-	defer func() {
-		_ = gogitrepo.DeleteBranch(branchName)
-	}()
-	if err := remote.FetchContext(ctx, &git.FetchOptions{
-		RefSpecs: []config.RefSpec{
-			config.RefSpec(ref + ":" + branchName),
-		},
-		Auth:  auth,
-		Force: true,
-	}); err != nil {
-		return "", err
-	}
-	hash, err := gogitrepo.ResolveRevision(plumbing.Revision(branchName))
-	if err != nil {
-		return "", err
-	}
-	return hash.String(), nil
-}
-
-func (c GoGitActionCache) GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error) {
-	gitPath := path.Join(c.Path, safeFilename(cacheDir)+".git")
-	gogitrepo, err := git.PlainOpen(gitPath)
-	if err != nil {
-		return nil, err
-	}
-	commit, err := gogitrepo.CommitObject(plumbing.NewHash(sha))
-	if err != nil {
-		return nil, err
-	}
-	files, err := commit.Files()
-	if err != nil {
-		return nil, err
-	}
-	rpipe, wpipe := io.Pipe()
-	// Interrupt io.Copy using ctx
-	ch := make(chan int, 1)
-	go func() {
-		select {
-		case <-ctx.Done():
-			wpipe.CloseWithError(ctx.Err())
-		case <-ch:
-		}
-	}()
-	go func() {
-		defer wpipe.Close()
-		defer close(ch)
-		tw := tar.NewWriter(wpipe)
-		cleanIncludePrefix := path.Clean(includePrefix)
-		wpipe.CloseWithError(files.ForEach(func(f *object.File) error {
-			if err := ctx.Err(); err != nil {
-				return err
-			}
-			name := f.Name
-			if strings.HasPrefix(name, cleanIncludePrefix+"/") {
-				name = name[len(cleanIncludePrefix)+1:]
-			} else if cleanIncludePrefix != "." && name != cleanIncludePrefix {
-				return nil
-			}
-			fmode, err := f.Mode.ToOSFileMode()
-			if err != nil {
-				return err
-			}
-			if fmode&fs.ModeSymlink == fs.ModeSymlink {
-				content, err := f.Contents()
-				if err != nil {
-					return err
-				}
-				return tw.WriteHeader(&tar.Header{
-					Name:     name,
-					Mode:     int64(fmode),
-					Linkname: content,
-				})
-			}
-			err = tw.WriteHeader(&tar.Header{
-				Name: name,
-				Mode: int64(fmode),
-				Size: f.Size,
-			})
-			if err != nil {
-				return err
-			}
-			reader, err := f.Reader()
-			if err != nil {
-				return err
-			}
-			_, err = io.Copy(tw, reader)
-			return err
-		}))
-	}()
-	return rpipe, err
-}

act/runner/action_cache_test.go

@@ -1,157 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// Copyright 2023 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func runGit(t *testing.T, dir string, args ...string) {
-	t.Helper()
-	if dir != "" {
-		args = append([]string{"-C", dir}, args...)
-	}
-	cmd := exec.Command("git", args...)
-	// Fixed identity and host-config isolation so commits succeed offline regardless of the
-	// host's git config (mirrors gitCmd in act/common/git).
-	cmd.Env = append(os.Environ(),
-		"GIT_AUTHOR_NAME=test", "GIT_AUTHOR_EMAIL=test@example.com",
-		"GIT_COMMITTER_NAME=test", "GIT_COMMITTER_EMAIL=test@example.com",
-		"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null",
-	)
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
-}
-
-// TestShortShaActionRejected verifies a `uses` ref that is a shortened commit SHA is rejected
-// with a clear error. The action is resolved from a local repo (via DefaultActionInstance) so
-// this runs offline.
-func TestShortShaActionRejected(t *testing.T) {
-	// a local "remote" action repo at <root>/actions/hello-world-docker-action
-	actionRoot := t.TempDir()
-	repo := filepath.Join(actionRoot, "actions", "hello-world-docker-action")
-	require.NoError(t, os.MkdirAll(repo, 0o755))
-	runGit(t, "", "init", "--initial-branch=main", repo)
-	require.NoError(t, os.WriteFile(filepath.Join(repo, "action.yml"),
-		[]byte("name: hello\nruns:\n  using: node24\n  main: index.js\n"), 0o644))
-	runGit(t, repo, "add", ".")
-	runGit(t, repo, "commit", "-m", "initial")
-	out, err := exec.Command("git", "-C", repo, "rev-parse", "HEAD").Output()
-	require.NoError(t, err)
-	shortSha := strings.TrimSpace(string(out))[:7]
-
-	// a workflow that uses the action at the short SHA
-	wfDir := filepath.Join(t.TempDir(), "wf")
-	require.NoError(t, os.MkdirAll(wfDir, 0o755))
-	wf := fmt.Sprintf("on: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/hello-world-docker-action@%s\n", shortSha)
-	require.NoError(t, os.WriteFile(filepath.Join(wfDir, "push.yml"), []byte(wf), 0o644))
-
-	runner, err := New(&Config{
-		Workdir:               wfDir,
-		EventName:             "push",
-		Platforms:             map[string]string{"ubuntu-latest": baseImage},
-		GitHubInstance:        "github.com",
-		DefaultActionInstance: actionRoot,
-		ContainerMaxLifetime:  time.Hour,
-	})
-	require.NoError(t, err)
-	planner, err := model.NewWorkflowPlanner(wfDir, true)
-	require.NoError(t, err)
-	plan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-
-	err = runner.NewPlanExecutor(plan)(common.WithDryrun(context.Background(), true))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "shortened version of a commit SHA")
-}
-
-func TestActionCache(t *testing.T) {
-	a := assert.New(t)
-	ctx := context.Background()
-
-	// Build a local bare repo with a `js` action dir so this runs offline (formerly cloned
-	// github.com/nektos/act-test-actions over the network). allowAnySHA1InWant lets the
-	// "Fetch Sha" case fetch a commit hash directly.
-	remoteDir := t.TempDir()
-	runGit(t, "", "init", "--bare", "--initial-branch=main", remoteDir)
-	runGit(t, remoteDir, "config", "uploadpack.allowAnySHA1InWant", "true")
-
-	workDir := t.TempDir()
-	runGit(t, "", "clone", remoteDir, workDir)
-	require.NoError(t, os.MkdirAll(filepath.Join(workDir, "js"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, "js", "action.yml"),
-		[]byte("name: js\nruns:\n  using: node24\n  main: index.js\n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, "js", "index.js"),
-		[]byte("console.log('hello');\n"), 0o644))
-	runGit(t, workDir, "add", ".")
-	runGit(t, workDir, "commit", "-m", "initial")
-	runGit(t, workDir, "push", "-u", "origin", "main")
-
-	out, err := exec.Command("git", "-C", workDir, "rev-parse", "main").Output()
-	require.NoError(t, err)
-	fullSha := strings.TrimSpace(string(out))
-
-	cache := &GoGitActionCache{
-		Path: t.TempDir(),
-	}
-	cacheDir := "local/act-test-actions"
-	refs := []struct {
-		Name string
-		Ref  string
-	}{
-		{Name: "Fetch Branch Name", Ref: "main"},
-		{Name: "Fetch Branch Name Absolutely", Ref: "refs/heads/main"},
-		{Name: "Fetch HEAD", Ref: "HEAD"},
-		{Name: "Fetch Sha", Ref: fullSha},
-	}
-	for _, c := range refs {
-		t.Run(c.Name, func(t *testing.T) {
-			sha, err := cache.Fetch(ctx, cacheDir, remoteDir, c.Ref, "")
-			if !a.NoError(err) || !a.NotEmpty(sha) { //nolint:testifylint // pre-existing issue from nektos/act
-				return
-			}
-			atar, err := cache.GetTarArchive(ctx, cacheDir, sha, "js")
-			// NotNil, not NotEmpty: atar is a live io.PipeReader whose producer goroutine is
-			// writing concurrently; NotEmpty deep-reflects over its internals and races.
-			if !a.NoError(err) || !a.NotNil(atar) { //nolint:testifylint // pre-existing issue from nektos/act
-				return
-			}
-			// GetTarArchive streams from a background goroutine walking the shared repo.
-			// Drain and close so it finishes before the next subtest fetches into the same
-			// repo; otherwise the lingering walk races with that fetch.
-			defer func() {
-				_, _ = io.Copy(io.Discard, atar)
-				_ = atar.Close()
-			}()
-			mytar := tar.NewReader(atar)
-			th, err := mytar.Next()
-			if !a.NoError(err) || !a.NotEqual(0, th.Size) { //nolint:testifylint // pre-existing issue from nektos/act
-				return
-			}
-			buf := &bytes.Buffer{}
-			// G110: Potential DoS vulnerability via decompression bomb (gosec)
-			_, err = io.Copy(buf, mytar)
-			a.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
-			str := buf.String()
-			a.NotEmpty(str)
-		})
-	}
-}

act/runner/action_composite_test.go

@@ -1,70 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestAppendUniqueMasks(t *testing.T) {
-	tests := []struct {
-		name string
-		dst  []string
-		src  []string
-		want []string
-	}{
-		{
-			name: "appends new masks",
-			dst:  []string{"a"},
-			src:  []string{"b", "c"},
-			want: []string{"a", "b", "c"},
-		},
-		{
-			name: "skips masks already present",
-			dst:  []string{"a", "b"},
-			src:  []string{"a", "b"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "deduplicates within src",
-			dst:  []string{"a"},
-			src:  []string{"b", "b", "a"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "empty src leaves dst unchanged",
-			dst:  []string{"a"},
-			src:  nil,
-			want: []string{"a"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, appendUniqueMasks(tt.dst, tt.src))
-		})
-	}
-}
-
-// TestAppendUniqueMasksNoExponentialGrowth reproduces the exponential growth of
-// the parent's Masks slice observed with nested/repeated composite actions. A
-// composite RunContext is seeded with its parent's masks and the whole seeded
-// slice was previously appended back into the parent, doubling its length on
-// every composite action.
-func TestAppendUniqueMasksNoExponentialGrowth(t *testing.T) {
-	parentMasks := []string{"secret"}
-
-	for range 20 {
-		// compositeRC.Masks starts as a copy of the parent's masks (it is
-		// seeded with parent.Masks in newCompositeRunContext).
-		compositeMasks := make([]string, len(parentMasks))
-		copy(compositeMasks, parentMasks)
-
-		parentMasks = appendUniqueMasks(parentMasks, compositeMasks)
-	}
-
-	assert.Equal(t, []string{"secret"}, parentMasks)
-}

act/runner/action_test.go

@@ -1,504 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"io"
-	"io/fs"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-)
-
-type closerMock struct {
-	mock.Mock
-}
-
-func (m *closerMock) Close() error {
-	m.Called()
-	return nil
-}
-
-func TestActionReader(t *testing.T) {
-	yaml := strings.ReplaceAll(`
-name: 'name'
-runs:
-	using: 'node16'
-	main: 'main.js'
-`, "\t", "  ")
-
-	table := []struct {
-		name        string
-		step        *model.Step
-		filename    string
-		fileContent string
-		expected    *model.Action
-	}{
-		{
-			name:        "readActionYml",
-			step:        &model.Step{},
-			filename:    "action.yml",
-			fileContent: yaml,
-			expected: &model.Action{
-				Name: "name",
-				Runs: model.ActionRuns{
-					Using:  "node16",
-					Main:   "main.js",
-					PreIf:  "always()",
-					PostIf: "always()",
-				},
-			},
-		},
-		{
-			name:        "readActionYaml",
-			step:        &model.Step{},
-			filename:    "action.yaml",
-			fileContent: yaml,
-			expected: &model.Action{
-				Name: "name",
-				Runs: model.ActionRuns{
-					Using:  "node16",
-					Main:   "main.js",
-					PreIf:  "always()",
-					PostIf: "always()",
-				},
-			},
-		},
-		{
-			name:        "readDockerfile",
-			step:        &model.Step{},
-			filename:    "Dockerfile",
-			fileContent: "FROM ubuntu:20.04",
-			expected: &model.Action{
-				Name: "(Synthetic)",
-				Runs: model.ActionRuns{
-					Using: "docker",
-					Image: "Dockerfile",
-				},
-			},
-		},
-		{
-			name: "readWithArgs",
-			step: &model.Step{
-				With: map[string]string{
-					"args": "cmd",
-				},
-			},
-			expected: &model.Action{
-				Name: "(Synthetic)",
-				Inputs: map[string]model.Input{
-					"cwd": {
-						Description: "(Actual working directory)",
-						Required:    false,
-						Default:     "actionDir/actionPath",
-					},
-					"command": {
-						Description: "(Actual program)",
-						Required:    false,
-						Default:     "cmd",
-					},
-				},
-				Runs: model.ActionRuns{
-					Using: "node12",
-					Main:  "trampoline.js",
-				},
-			},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			closerMock := &closerMock{}
-
-			readFile := func(filename string) (io.Reader, io.Closer, error) {
-				if tt.filename != filename {
-					return nil, nil, fs.ErrNotExist
-				}
-
-				return strings.NewReader(tt.fileContent), closerMock, nil
-			}
-
-			writeFile := func(filename string, data []byte, perm fs.FileMode) error {
-				assert.Equal(t, "actionDir/actionPath/trampoline.js", filename)
-				assert.Equal(t, fs.FileMode(0o400), perm)
-				return nil
-			}
-
-			if tt.filename != "" {
-				closerMock.On("Close")
-			}
-
-			action, err := readActionImpl(context.Background(), tt.step, "actionDir", "actionPath", readFile, writeFile)
-
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.Equal(t, tt.expected, action)
-
-			closerMock.AssertExpectations(t)
-		})
-	}
-}
-
-func TestActionRunner(t *testing.T) {
-	table := []struct {
-		name        string
-		step        actionStep
-		expectedEnv map[string]string
-	}{
-		{
-			name: "with-input",
-			step: &stepActionRemote{
-				Step: &model.Step{
-					Uses: "org/repo/path@ref",
-				},
-				RunContext: &RunContext{
-					Config: &Config{},
-					Run: &model.Run{
-						JobID: "job",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"job": {
-									Name: "job",
-								},
-							},
-						},
-					},
-				},
-				action: &model.Action{
-					Inputs: map[string]model.Input{
-						"key": {
-							Default: "default value",
-						},
-					},
-					Runs: model.ActionRuns{
-						Using: "node16",
-					},
-				},
-				env: map[string]string{},
-			},
-			expectedEnv: map[string]string{"INPUT_KEY": "default value"},
-		},
-		{
-			name: "restore-saved-state",
-			step: &stepActionRemote{
-				Step: &model.Step{
-					ID:   "step",
-					Uses: "org/repo/path@ref",
-				},
-				RunContext: &RunContext{
-					ActionPath: "path",
-					Config:     &Config{},
-					Run: &model.Run{
-						JobID: "job",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"job": {
-									Name: "job",
-								},
-							},
-						},
-					},
-					CurrentStep: "post-step",
-					StepResults: map[string]*model.StepResult{
-						"step": {},
-					},
-					IntraActionState: map[string]map[string]string{
-						"step": {
-							"name": "state value",
-						},
-					},
-				},
-				action: &model.Action{
-					Runs: model.ActionRuns{
-						Using: "node16",
-					},
-				},
-				env: map[string]string{},
-			},
-			expectedEnv: map[string]string{"STATE_name": "state value"},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			cm := &containerMock{}
-			cm.On("CopyDir", "/var/run/act/actions/dir/", "dir/", false).Return(func(ctx context.Context) error { return nil })
-
-			envMatcher := mock.MatchedBy(func(env map[string]string) bool {
-				for k, v := range tt.expectedEnv {
-					if env[k] != v {
-						return false
-					}
-				}
-				return true
-			})
-
-			cm.On("Exec", []string{"node", "/var/run/act/actions/dir/path"}, envMatcher, "", "").Return(func(ctx context.Context) error { return nil })
-
-			tt.step.getRunContext().JobContainer = cm
-
-			err := runActionImpl(tt.step, "dir", newRemoteAction("org/repo/path@ref"))(ctx)
-
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			cm.AssertExpectations(t)
-		})
-	}
-}
-
-func TestNewStepContainerDoesNotUseDockerSecrets(t *testing.T) {
-	cm := &containerMock{}
-
-	var captured *container.NewContainerInput
-	origContainerNewContainer := ContainerNewContainer
-	ContainerNewContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-		captured = input
-		return cm
-	}
-	defer func() {
-		ContainerNewContainer = origContainerNewContainer
-	}()
-
-	ctx := context.Background()
-	rc := &RunContext{
-		Name: "job",
-		Config: &Config{
-			Secrets: map[string]string{
-				"DOCKER_USERNAME": "docker-user",
-				"DOCKER_PASSWORD": "docker-password",
-			},
-		},
-		Run: &model.Run{
-			JobID: "job",
-			Workflow: &model.Workflow{
-				Name: "test",
-				Jobs: map[string]*model.Job{
-					"job": {},
-				},
-			},
-		},
-		JobContainer: cm,
-		StepResults:  map[string]*model.StepResult{},
-	}
-	env := map[string]string{}
-	step := &stepMock{}
-	step.On("getRunContext").Return(rc)
-	step.On("getStepModel").Return(&model.Step{ID: "action"})
-	step.On("getEnv").Return(&env)
-
-	_ = newStepContainer(ctx, step, "registry.example.com/action:tag", nil, nil)
-
-	// DOCKER_USERNAME/DOCKER_PASSWORD should not be injected as pull credentials for docker action containers.
-	assert.Empty(t, captured.Username)
-	assert.Empty(t, captured.Password)
-	step.AssertExpectations(t)
-}
-
-func TestMaybeCopyToActionDirHoldsCloneLock(t *testing.T) {
-	ctx := context.Background()
-
-	actionDir := t.TempDir()
-
-	releaseCopy := make(chan struct{})
-	release := sync.OnceFunc(func() { close(releaseCopy) })
-	defer release()
-
-	copyEntered := make(chan struct{})
-
-	cm := &containerMock{}
-	cm.On("CopyDir", "/var/run/act/actions/", actionDir+"/", false).Return(func(ctx context.Context) error {
-		close(copyEntered)
-		<-releaseCopy
-		return nil
-	})
-
-	step := &stepActionRemote{
-		Step: &model.Step{Uses: "remote/action@v1"},
-		RunContext: &RunContext{
-			Config:       &Config{},
-			JobContainer: cm,
-		},
-	}
-
-	copyDone := make(chan error, 1)
-	go func() {
-		copyDone <- maybeCopyToActionDir(ctx, step, actionDir, "", "/var/run/act/actions/")
-	}()
-
-	select {
-	case <-copyEntered:
-	case err := <-copyDone:
-		t.Fatalf("maybeCopyToActionDir returned before CopyDir was entered: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("CopyDir was not entered within 1 second")
-	}
-
-	peerAcquired := make(chan struct{})
-	go func() {
-		unlock := git.AcquireCloneLock(actionDir)
-		close(peerAcquired)
-		unlock()
-	}()
-
-	select {
-	case <-peerAcquired:
-		t.Fatal("peer AcquireCloneLock returned while CopyDir was running")
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	release()
-
-	select {
-	case err := <-copyDone:
-		if err != nil {
-			t.Fatalf("maybeCopyToActionDir returned error: %v", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("maybeCopyToActionDir did not return after CopyDir was unblocked")
-	}
-
-	select {
-	case <-peerAcquired:
-	case <-time.After(time.Second):
-		t.Fatal("peer AcquireCloneLock did not proceed after lock released")
-	}
-
-	cm.AssertExpectations(t)
-}
-
-func TestExecAsDockerHoldsCloneLockForRemoteUncached(t *testing.T) {
-	actionDir := t.TempDir()
-
-	unlockOnce := sync.OnceFunc(git.AcquireCloneLock(actionDir))
-	defer unlockOnce()
-
-	innerEntered := make(chan struct{})
-	releaseInner := make(chan struct{})
-	releaseOnce := sync.OnceFunc(func() { close(releaseInner) })
-	defer releaseOnce()
-
-	origImageExists := ContainerImageExistsLocally
-	ContainerImageExistsLocally = func(_ context.Context, _, _ string) (bool, error) {
-		return false, nil
-	}
-	defer func() { ContainerImageExistsLocally = origImageExists }()
-
-	origBuildExec := ContainerNewDockerBuildExecutor
-	ContainerNewDockerBuildExecutor = func(_ container.NewDockerBuildExecutorInput) common.Executor {
-		return func(_ context.Context) error {
-			close(innerEntered)
-			<-releaseInner
-			return nil
-		}
-	}
-	defer func() { ContainerNewDockerBuildExecutor = origBuildExec }()
-
-	step := &stepActionRemote{
-		Step: &model.Step{ID: "1", Uses: "remote/action@v1", With: map[string]string{}},
-		RunContext: &RunContext{
-			Config: &Config{},
-			Run: &model.Run{
-				JobID: "1",
-				Workflow: &model.Workflow{
-					Name: "wf",
-					Jobs: map[string]*model.Job{"1": {}},
-				},
-			},
-			JobContainer: &containerMock{},
-		},
-		action: &model.Action{Runs: model.ActionRuns{Using: "docker", Image: "Dockerfile"}},
-		env:    map[string]string{},
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	done := make(chan error, 1)
-	go func() { done <- execAsDocker(ctx, step, "test-action", actionDir, actionDir, false) }()
-
-	select {
-	case <-innerEntered:
-		t.Fatal("inner build executor ran before clone lock was released")
-	case err := <-done:
-		t.Fatalf("execAsDocker returned before inner was entered: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	unlockOnce()
-
-	select {
-	case <-innerEntered:
-	case err := <-done:
-		t.Fatalf("execAsDocker returned without entering inner: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("inner build executor not entered after lock released")
-	}
-
-	cancel()
-	releaseOnce()
-
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("execAsDocker did not return after inner was released and ctx was canceled")
-	}
-}
-
-func TestDockerActionImageTag(t *testing.T) {
-	// Remote actions already carry a unique, ref-scoped actionName (the uses
-	// hash), so the tag must be left untouched for backwards compatibility.
-	assert.Equal(t,
-		"act-abc123-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "abc123", false),
-	)
-
-	// Local actions keep a human-readable, repository-namespaced prefix and gain a short hash suffix that makes the tag unique per (repository, actionName).
-	// See https://gitea.com/gitea/runner/issues/1039.
-	assert.Equal(t,
-		"act-owner-repo-baca2daaa2fe-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./", true),
-	)
-	assert.Equal(t,
-		"act-owner-repo-sub-e847b61255a8-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-
-	// Sanitizing every non-alphanumeric character to "-" is lossy, so distinct inputs can collapse to the same readable prefix.
-	// The hash suffix must keep such cases apart, otherwise an image built for one repository is reused for another.
-	collisions := [][2]struct {
-		repoName   string
-		actionName string
-	}{
-		// Two different repositories, both `uses: ./`: "a/b-c" and "a-b/c" both sanitize to "a-b-c".
-		{{"a/b-c", "./"}, {"a-b/c", "./"}},
-		// A repository's root action vs another repository's sub-path action:
-		// "owner/repo-a" + "./" and "owner/repo" + "./a" both sanitize to "owner-repo-a".
-		{{"owner/repo-a", "./"}, {"owner/repo", "./a"}},
-	}
-	for _, c := range collisions {
-		assert.NotEqual(t,
-			dockerActionImageTag(c[0].repoName, c[0].actionName, true),
-			dockerActionImageTag(c[1].repoName, c[1].actionName, true),
-			"local docker action tags must differ for %q/%q vs %q/%q",
-			c[0].repoName, c[0].actionName, c[1].repoName, c[1].actionName,
-		)
-	}
-
-	// Distinct local actions within the same repository keep distinct tags.
-	assert.NotEqual(t,
-		dockerActionImageTag("owner/repo", "./", true),
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-}

act/runner/cancellation_test.go

@@ -1,285 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v4"
-)
-
-// TestCancelledJobStatusEnablesAlwaysAndCancelledSteps verifies that once a job is
-// cancelled, getJobContext reports the "cancelled" status so the step `if` functions
-// evaluate the way GitHub Actions does: cancelled()/always() are true, success()/failure()
-// are false. A step that defaults to success() is therefore skipped while an always() step
-// still runs. Before the fix the status could only ever be success/failure, so cancelled()
-// was structurally impossible and cancel-only cleanup steps never ran.
-func TestCancelledJobStatusEnablesAlwaysAndCancelledSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	rc.markCancelled()
-
-	// The core fix: the job status context now reports "cancelled" instead of being
-	// pinned to success/failure.
-	jobCtx := rc.getJobContext()
-	require.Equal(t, "cancelled", jobCtx.Status)
-
-	// Feed that status through the step-context expression functions, which is what a
-	// step `if` evaluates. On a cancelled job only always()/cancelled() are true.
-	interp := exprparser.NewInterpeter(
-		&exprparser.EvaluationEnvironment{Job: jobCtx},
-		exprparser.Config{Context: "step"},
-	)
-	for expr, want := range map[string]bool{
-		"cancelled()":  true,
-		"always()":     true,
-		"success()":    false,
-		"failure()":    false,
-		"!cancelled()": false,
-	} {
-		got, err := interp.Evaluate(expr, exprparser.DefaultStatusCheckNone)
-		require.NoErrorf(t, err, "Evaluate(%q)", expr)
-		assert.Equalf(t, want, got, "Evaluate(%q) on a cancelled job", expr)
-	}
-
-	// A step without an `if` defaults to success() and must be skipped on cancel,
-	// while an `if: always()` step must still run.
-	disabled, err := interp.Evaluate("", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, false, disabled, "default-success step must be skipped on a cancelled job")
-
-	enabled, err := interp.Evaluate("always()", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, true, enabled, "`if: always()` step must run on a cancelled job")
-}
-
-// TestMainStepsExecutorRunsAlwaysStepsAfterCancel verifies that newMainStepsExecutor does
-// not abandon the remaining steps when the run is cancelled mid-pipeline. The later step
-// still runs (so a main-stage always() step is reached), it runs under a fresh,
-// non-cancelled context, and the job is marked cancelled. The interrupt error is still
-// propagated so callers up the chain see the cancellation.
-func TestMainStepsExecutorRunsAlwaysStepsAfterCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "step1")
-			cancel() // server cancellation lands while step1 runs
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "interrupt error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after cancel")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps guards the timeout path's symmetry with the cancel path.
-// When the job deadline (timeout-minutes) lands in the gap between two steps, the job must be marked as failed (not cancelled),
-// so always()/failure() cleanup steps run while default success() steps skip, and so the timed-out job is not reported as success.
-func TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	// A short deadline that we let elapse between steps, so no step records the error itself.
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
-	defer cancel()
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(c context.Context) error {
-			ran = append(ran, "step1")
-			// Block until the job deadline elapses, then return cleanly: the interrupt lands in the loop's between-steps check, not inside a step.
-			<-c.Done()
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.DeadlineExceeded, "the timeout error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after a timeout")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-expired context")
-	assert.True(t, rc.jobFailed, "a job timeout marks the job failed")
-	assert.False(t, rc.jobCancelled, "a timeout is not a cancellation")
-
-	// The status the real main-step `if` evaluation sees: "failure", so default success() steps skip while always()/failure() steps run.
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreCancel verifies that a cancellation landing during the
-// pre phase does not abandon the main steps: newStepsExecutor still runs the main-steps executor,
-// so a main-stage always()/cancelled() step is reached (under a fresh, non-cancelled context),
-// the job is marked cancelled, and the cancellation is propagated. Before the fix the `.Then(...)`
-// short-circuit skipped the main steps entirely when a pre step was cancelled.
-func TestStepsExecutorRunsMainStepsAfterPreCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var mainStepCtxErr error
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			cancel() // server cancellation lands during the pre phase
-			return nil
-		},
-	}
-	steps := []common.Executor{
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			mainStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "the cancellation is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-phase cancel")
-	require.NoError(t, mainStepCtxErr, "the main step runs under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreFailure verifies that a failing pre step does not abandon
-// the main steps: they still run (so a main-stage always()/failure() step is reached), and the
-// pre-step error is propagated so the job is reported as failed. The main steps' own `if`
-// evaluation is what skips success()-default steps, so running them here is safe.
-func TestStepsExecutorRunsMainStepsAfterPreFailure(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	var ran []string
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			return assert.AnError
-		},
-	}
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "always-step")
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(context.Background())
-
-	require.ErrorIs(t, err, assert.AnError, "the pre-step error is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-step failure")
-	assert.False(t, rc.jobCancelled, "a pre-step failure is not a cancellation")
-}
-
-// TestPreStepFailureAffectsMainStepIfStatus verifies the status path used by real
-// main-step `if` evaluation. A pre-step failure is not present in StepResults, so
-// recording only the context job error is not enough: getJobContext must also report
-// failure so success()-default main steps skip and failure() steps run.
-func TestPreStepFailureAffectsMainStepIfStatus(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	ctx := common.WithJobErrorContainer(context.Background())
-
-	reportStepError(ctx, rc, assert.AnError)
-
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-	require.ErrorIs(t, common.JobError(ctx), assert.AnError)
-
-	defaultStep := &stepRun{
-		RunContext: rc,
-		Step:       &model.Step{ID: "default-step"},
-		env:        map[string]string{},
-	}
-	defaultEnabled, err := isStepEnabled(ctx, defaultStep.getIfExpression(ctx, stepStageMain), defaultStep, stepStageMain)
-	require.NoError(t, err)
-	assert.False(t, defaultEnabled, "default success() main step must skip after a pre-step failure")
-
-	failureStep := &stepRun{
-		RunContext: rc,
-		Step: &model.Step{
-			ID: "failure-step",
-			If: yaml.Node{Value: "failure()"},
-		},
-		env: map[string]string{},
-	}
-	failureEnabled, err := isStepEnabled(ctx, failureStep.getIfExpression(ctx, stepStageMain), failureStep, stepStageMain)
-	require.NoError(t, err)
-	assert.True(t, failureEnabled, "failure() main step must run after a pre-step failure")
-}
-
-// TestPostStepsContextCancelledIsUsableForFailingStep guards against a panic: post/cleanup
-// steps run on a context derived from the cancelled job context, and a failing post step
-// records its error via common.SetJobError. If that derived context lacks a job-error container,
-// SetJobError dereferences a nil map and panics. The post context must therefore be detached
-// from cancellation (so the steps run) yet still carry a usable error container.
-func TestPostStepsContextCancelledIsUsableForFailingStep(t *testing.T) {
-	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-	cancel()
-	require.ErrorIs(t, cancelled.Err(), context.Canceled)
-
-	postCtx, done := postStepsContext(cancelled)
-	defer done()
-
-	// Detached from cancellation, so the post steps actually run.
-	require.NoError(t, postCtx.Err(), "post context must not be cancelled")
-
-	// A failing post step records its error instead of panicking.
-	require.NotPanics(t, func() {
-		common.SetJobError(postCtx, assert.AnError)
-	}, "a failing post step must not panic on the cancel path")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError)
-}
-
-// TestPostStepsContextDeadlinePreservesJobError verifies the job-timeout path keeps the original
-// job-error container (via context.WithoutCancel), so the timeout failure and any post-step error
-// survive into the post phase and the job is still reported as failed.
-func TestPostStepsContextDeadlinePreservesJobError(t *testing.T) {
-	base := common.WithJobErrorContainer(context.Background())
-	common.SetJobError(base, assert.AnError)
-	expired, cancel := context.WithDeadline(base, time.Now().Add(-time.Hour))
-	defer cancel()
-	require.ErrorIs(t, expired.Err(), context.DeadlineExceeded)
-
-	postCtx, done := postStepsContext(expired)
-	defer done()
-
-	require.NoError(t, postCtx.Err(), "post context must not carry the expired deadline")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError, "the timeout job error must be preserved")
-}

act/runner/helpers_test.go

@@ -1,66 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"net"
-	"os/exec"
-	"runtime"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/container"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireLinuxDocker skips on non-Linux hosts. Some integration workflows need Docker features
-// that only a Linux daemon provides (host networking, host /proc bind mounts); Docker Desktop
-// on macOS/Windows does not, so those tests can only run on Linux.
-func requireLinuxDocker(t *testing.T) {
-	t.Helper()
-	if runtime.GOOS != "linux" {
-		t.Skip("skipping: requires a Linux Docker host")
-	}
-}
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := container.GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}
-
-// requireNetwork skips the test unless github.com is reachable. A few tests exercise behaviour
-// that inherently needs the network (force-pulling an image, resolving a remote short-sha ref);
-// gating lets the rest of the suite run offline without these failing.
-func requireNetwork(t *testing.T) {
-	t.Helper()
-	conn, err := net.DialTimeout("tcp", "github.com:443", 3*time.Second)
-	if err != nil {
-		t.Skipf("skipping: network unavailable: %v", err)
-	}
-	_ = conn.Close()
-}
-
-// requireHostTools skips the test unless every named executable is on PATH. Used by the
-// self-hosted (host environment) suite, which runs steps directly on the host.
-func requireHostTools(t *testing.T, tools ...string) {
-	t.Helper()
-	for _, tool := range tools {
-		if _, err := exec.LookPath(tool); err != nil {
-			t.Skipf("skipping: required host tool %q not found: %v", tool, err)
-		}
-	}
-}

act/runner/job_executor.go

@@ -1,594 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"path"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-	"unicode"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
-)
-
-const maxJobSummaryBytes = 1024 * 1024
-
-// jobSummaryTruncationMarker is appended to a summary that exceeded the size limit
-// so the rendered output makes the truncation visible instead of silently cutting off.
-const jobSummaryTruncationMarker = "\n\n---\n\n*Job summary truncated: it exceeded the maximum allowed size.*\n"
-
-var (
-	jobSummaryUploadRetryDelay = time.Second
-	// jobSummaryUploadRequestTimeout bounds a single step upload request. It is kept
-	// below jobSummaryUploadPhaseTimeout so one slow or unreachable request times out
-	// and lets the remaining steps still upload within the phase budget, instead of a
-	// single stuck request consuming the whole phase.
-	jobSummaryUploadRequestTimeout = 5 * time.Second
-	// jobSummaryUploadPhaseTimeout bounds the total time spent uploading all step
-	// summaries. The uploads run inside the job cleanup budget that is also used to
-	// stop and remove the container, so a slow or unreachable endpoint must not be
-	// allowed to consume it; this keeps the remaining budget available for teardown.
-	jobSummaryUploadPhaseTimeout = 15 * time.Second
-)
-
-type jobInfo interface {
-	matrix() map[string]any
-	steps() []*model.Step
-	startContainer() common.Executor
-	stopContainer() common.Executor
-	closeContainer() common.Executor
-	interpolateOutputs() common.Executor
-	result(result string)
-}
-
-// reportStepError emits the GitHub Actions ##[error] annotation and records
-// the error against the job so the job is reported as failed.
-func reportStepError(ctx context.Context, rc *RunContext, err error) {
-	common.Logger(ctx).Errorf("##[error]%v", err)
-	common.SetJobError(ctx, err)
-	rc.markFailed()
-}
-
-func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executor {
-	steps := make([]common.Executor, 0)
-	preSteps := make([]common.Executor, 0)
-	var postExecutor common.Executor
-
-	steps = append(steps, func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		if len(info.matrix()) > 0 {
-			logger.Infof("Matrix: %v", info.matrix())
-		}
-		return nil
-	})
-
-	infoSteps := info.steps()
-
-	if len(infoSteps) == 0 {
-		return common.NewDebugExecutor("No steps found")
-	}
-
-	preSteps = append(preSteps, func(ctx context.Context) error {
-		// Have to be skipped for some Tests
-		if rc.Run == nil {
-			return nil
-		}
-		rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-		// evaluate environment variables since they can contain
-		// GitHub's special environment variables.
-		for k, v := range rc.GetEnv() {
-			rc.Env[k] = rc.ExprEval.Interpolate(ctx, v)
-		}
-		return nil
-	})
-
-	for i, stepModel := range infoSteps {
-		if stepModel == nil {
-			return func(ctx context.Context) error {
-				return fmt.Errorf("invalid Step %v: missing run or uses key", i)
-			}
-		}
-		if stepModel.ID == "" {
-			stepModel.ID = strconv.Itoa(i)
-		}
-		stepModel.Number = i
-
-		step, err := sf.newStep(stepModel, rc)
-		if err != nil {
-			return common.NewErrorExecutor(err)
-		}
-
-		stepIdx := stepModel.Number
-		preExec := step.pre()
-		preSteps = append(preSteps, useStepLogger(rc, stepModel, stepStagePre, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
-			preErr := preExec(ctx)
-			if preErr != nil {
-				reportStepError(ctx, rc, preErr)
-			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
-			}
-			return preErr
-		}))
-
-		stepExec := step.main()
-		steps = append(steps, useStepLogger(rc, stepModel, stepStageMain, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
-			err := stepExec(ctx)
-			if err != nil {
-				reportStepError(ctx, rc, err)
-			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
-			}
-			return nil
-		}))
-
-		postFn := step.post()
-		postExec := useStepLogger(rc, stepModel, stepStagePost, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
-			err := postFn(ctx)
-			if err != nil {
-				reportStepError(ctx, rc, err)
-			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
-			}
-			return err
-		})
-		if postExecutor != nil {
-			// run the post executor in reverse order
-			postExecutor = postExec.Finally(postExecutor)
-		} else {
-			postExecutor = postExec
-		}
-	}
-
-	postExecutor = postExecutor.Finally(func(ctx context.Context) error {
-		jobError := common.JobError(ctx)
-		var err error
-		// jobError == nil keeps a failed job's container alive for post-mortem debugging when
-		// AutoRemove is off (the act-CLI --rm behavior; the shipped runner always sets
-		// AutoRemove). A cancelled run is not a failure to inspect, and the cancel-path post
-		// context now carries its own error container so a failing post step makes jobError
-		// non-nil — OR in rc.jobCancelled so cancellation still always tears the container down.
-		if rc.Config.AutoRemove || jobError == nil || rc.jobCancelled {
-			// always allow 1 min for stopping and removing the runner, even if we were cancelled
-			ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
-			defer cancel()
-
-			logger := common.Logger(ctx)
-			tryUploadJobSummary(ctx, rc)
-			// For Gitea
-			// We don't need to call `stopServiceContainers` here since it will be called by following `info.stopContainer`
-			// logger.Infof("Cleaning up services for job %s", rc.JobName)
-			// if err := rc.stopServiceContainers()(ctx); err != nil {
-			// 	logger.Errorf("Error while cleaning services: %v", err)
-			// }
-
-			logger.Infof("Cleaning up container for job %s", rc.JobName)
-			if err = info.stopContainer()(ctx); err != nil {
-				logger.Errorf("Error while stop job container: %v", err)
-			}
-
-			// For Gitea
-			// We don't need to call `NewDockerNetworkRemoveExecutor` here since it is called by above `info.stopContainer`
-			// if !rc.IsHostEnv(ctx) && rc.Config.ContainerNetworkMode == "" {
-			// 	// clean network in docker mode only
-			// 	// if the value of `ContainerNetworkMode` is empty string,
-			// 	// it means that the network to which containers are connecting is created by `runner`,
-			// 	// so, we should remove the network at last.
-			// 	networkName, _ := rc.networkName()
-			// 	logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, networkName)
-			// 	if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil {
-			// 		logger.Errorf("Error while cleaning network: %v", err)
-			// 	}
-			// }
-		}
-		setJobResult(ctx, info, rc, jobError == nil)
-		setJobOutputs(ctx, rc)
-
-		return err
-	})
-
-	stepsExecutor := newStepsExecutor(rc, preSteps, steps)
-
-	return common.NewPipelineExecutor(info.startContainer(), stepsExecutor.
-		Finally(func(ctx context.Context) error {
-			// Record an interrupt (backstop for interrupts that land outside the main
-			// step loop) so the post steps observe the cancelled/failed job status.
-			rc.markInterrupted(ctx.Err())
-			postCtx, cancel := postStepsContext(ctx)
-			defer cancel()
-			return postExecutor(postCtx)
-		}).
-		Finally(info.interpolateOutputs()).
-		Finally(info.closeContainer()))
-}
-
-// postStepsContext derives the context used to run the job's post/cleanup steps from the
-// finished main-pipeline context. Cleanup has to run even when the run was interrupted, so the
-// returned context always carries a fresh bounded deadline and is never itself cancelled.
-//
-//   - context.Canceled (server cancel): detach from the cancelled context via a fresh root so
-//     the post steps can run.
-//   - context.DeadlineExceeded (job timeout): detach the deadline with WithoutCancel, which
-//     keeps the original values — including the job-error container — so the timeout failure and
-//     any post-step error are preserved and the job is still reported as failed.
-//   - otherwise: run on the live context unchanged.
-func postStepsContext(ctx context.Context) (context.Context, context.CancelFunc) {
-	switch ctx.Err() {
-	case context.Canceled:
-		// The cancelled context is abandoned for a fresh root, which drops the job-error
-		// container installed at the job root. Re-attach a fresh one so a failing post step
-		// records its error via SetJobError instead of panicking on a nil container.
-		return context.WithTimeout(common.WithJobErrorContainer(common.WithLogger(context.Background(), common.Logger(ctx))), 5*time.Minute)
-	case context.DeadlineExceeded:
-		return context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	default:
-		return ctx, func() {}
-	}
-}
-
-// newStepsExecutor sequences the job's pre steps and main steps.
-//
-// The pre steps run as a normal pipeline that short-circuits on the first failure or
-// cancellation. The main-steps executor then runs unconditionally — even if a pre step failed
-// or the job was interrupted — so always()/cancelled()/failure() main steps still run, mirroring
-// GitHub Actions. This is safe because each main step re-evaluates its own `if` (a pre-step
-// failure flips the expression job status to failure, so success()-default steps skip) and
-// newMainStepsExecutor detaches from an interrupted context before running the remaining steps.
-//
-// A pre-step failure or interrupt is still propagated so the job is reported with the correct
-// conclusion; the pre error takes precedence since it happened first.
-func newStepsExecutor(rc *RunContext, preSteps, steps []common.Executor) common.Executor {
-	preExecutor := common.NewPipelineExecutor(preSteps...)
-	mainExecutor := newMainStepsExecutor(rc, steps)
-	return func(ctx context.Context) error {
-		preErr := preExecutor(ctx)
-		mainErr := mainExecutor(ctx)
-		if preErr != nil {
-			return preErr
-		}
-		return mainErr
-	}
-}
-
-// newMainStepsExecutor runs the job's main-stage step executors in order. Unlike a plain
-// pipeline, an interruption (context.Canceled from a server cancel, or context.DeadlineExceeded
-// from the job timeout) does not abandon the remaining steps: it marks the job cancelled when
-// appropriate and keeps iterating under a fresh, bounded context so steps whose `if` still
-// evaluates true — always() and cancelled() — run for cleanup, mirroring GitHub Actions. Steps
-// that default to success() skip themselves because success() is false once the job is no longer
-// successful. The main-step wrappers report their own errors and return nil, so the loop drives
-// step ordering off the context, not return values.
-func newMainStepsExecutor(rc *RunContext, steps []common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		for i, step := range steps {
-			if ctx.Err() != nil {
-				return runMainStepsAfterInterrupt(ctx, rc, steps[i:])
-			}
-			_ = step(ctx)
-		}
-		// An interrupt can land during the final step, after the loop's last context
-		// check; record it so the post steps still observe the cancelled/failed status.
-		rc.markInterrupted(ctx.Err())
-		return nil
-	}
-}
-
-// runMainStepsAfterInterrupt runs the remaining main steps after the job context was cancelled or
-// timed out. It detaches from the interrupted context (keeping its values: logger and job error)
-// and applies a fresh deadline so always()/cancelled() steps run to completion. The original
-// interrupt error is returned so callers up the chain still see the job as cancelled/timed out.
-func runMainStepsAfterInterrupt(ctx context.Context, rc *RunContext, steps []common.Executor) error {
-	interruptErr := ctx.Err()
-	rc.markInterrupted(interruptErr)
-	freshCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	defer cancel()
-	for _, step := range steps {
-		_ = step(freshCtx)
-	}
-	return interruptErr
-}
-
-func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success bool) {
-	logger := common.Logger(ctx)
-
-	// Matrix combinations share one *model.Job and run in parallel; serialize the
-	// read-modify-write of the job result so a failing combination is not lost-updated by a
-	// concurrent succeeding one.
-	job := rc.Run.Job()
-	var continueOnError bool
-	if !success {
-		// Use a fresh context so an expired job timeout cannot block expression evaluation.
-		evalCtx := common.WithLogger(context.Background(), common.Logger(ctx))
-		continueOnError = evaluateJobContinueOnError(evalCtx, rc, job)
-	}
-	jobResult := func() string {
-		defer lockJob(job)()
-		result := "success"
-		// we have only one result for a whole matrix build, so we need
-		// to keep an existing result state if we run a matrix
-		if len(info.matrix()) > 0 && job.Result != "" {
-			result = job.Result
-		}
-		if !success {
-			result = "failure"
-			job.SetContinueOnError(continueOnError)
-		}
-		info.result(result)
-		return result
-	}()
-
-	if rc.caller != nil {
-		// set reusable workflow job result
-		rc.caller.setReusedWorkflowJobResult(rc.JobName, jobResult) // For Gitea
-		return
-	}
-
-	jobResultMessage := "succeeded"
-	if jobResult != "success" {
-		jobResultMessage = "failed"
-	}
-
-	logger.WithField("jobResult", jobResult).Infof("Job %s", jobResultMessage)
-}
-
-func setJobOutputs(ctx context.Context, rc *RunContext) {
-	if rc.caller != nil {
-		// map outputs for reusable workflows
-		callerOutputs := make(map[string]string)
-
-		ee := rc.NewExpressionEvaluator(ctx)
-
-		for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs {
-			callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value))
-		}
-
-		// Matrix combinations of a reusable-workflow caller share the caller's *model.Job;
-		// serialize the write so parallel combos don't race on its Outputs field.
-		callerJob := rc.caller.runContext.Run.Job()
-		defer lockJob(callerJob)()
-		callerJob.Outputs = callerOutputs
-	}
-}
-
-// applyJobTimeout applies the job-level timeout-minutes to ctx, mirroring the
-// step-level evaluateStepTimeout in step.go.
-func applyJobTimeout(ctx context.Context, rc *RunContext, job *model.Job) (context.Context, context.CancelFunc) {
-	timeout := rc.ExprEval.Interpolate(ctx, job.TimeoutMinutes)
-	if timeout != "" {
-		if timeoutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil {
-			return context.WithTimeout(ctx, time.Duration(timeoutMinutes)*time.Minute)
-		}
-	}
-	return ctx, func() {}
-}
-
-// evaluateJobContinueOnError evaluates the job-level continue-on-error expression.
-func evaluateJobContinueOnError(ctx context.Context, rc *RunContext, job *model.Job) bool {
-	expr := strings.TrimSpace(job.RawContinueOnError)
-	if expr == "" {
-		return false
-	}
-	continueOnError, err := EvalBool(ctx, rc.NewExpressionEvaluator(ctx), expr, exprparser.DefaultStatusCheckNone)
-	if err != nil {
-		common.Logger(ctx).Warnf("continue-on-error expression %q evaluation failed: %v", expr, err)
-		return false
-	}
-	return continueOnError
-}
-
-func tryUploadJobSummary(ctx context.Context, rc *RunContext) {
-	if rc == nil || rc.JobContainer == nil || rc.Config == nil {
-		return
-	}
-	// Bound the whole upload phase so a slow or unreachable endpoint cannot consume
-	// the job cleanup budget reserved for stopping and removing the container.
-	ctx, cancel := context.WithTimeout(ctx, jobSummaryUploadPhaseTimeout)
-	defer cancel()
-	env := rc.GetEnv()
-	caps := strings.TrimSpace(env["GITEA_ACTIONS_CAPABILITIES"])
-	if !hasJobSummaryCapability(caps) {
-		// Server did not advertise support. Do not attempt upload.
-		return
-	}
-	runtimeURL := strings.TrimSpace(env["ACTIONS_RUNTIME_URL"])
-	runtimeToken := strings.TrimSpace(env["ACTIONS_RUNTIME_TOKEN"])
-	runID := strings.TrimSpace(env["GITEA_RUN_ID"])
-	if runtimeURL == "" || runtimeToken == "" || runID == "" {
-		return
-	}
-	if rc.Run == nil || rc.Run.Job() == nil {
-		return
-	}
-	// The numeric ActionRunJob ID is not exposed in the proto Task message or task context,
-	// but the server signs it into the ACTIONS_RUNTIME_TOKEN JWT claims. We decode the
-	// unverified claims to retrieve it; the server re-verifies the token on the request.
-	jobID := extractJobIDFromRuntimeToken(runtimeToken)
-	if jobID <= 0 {
-		return
-	}
-
-	base := strings.TrimRight(runtimeURL, "/") + "/_apis/pipelines/workflows/" + runID +
-		"/jobs/" + strconv.FormatInt(jobID, 10) + "/steps/"
-	actPath := rc.JobContainer.GetActPath()
-	// Reuse a single client across all step uploads so connections can be pooled.
-	client := &http.Client{Timeout: jobSummaryUploadRequestTimeout}
-	for i := range rc.Run.Job().Steps {
-		summaryPath := path.Join(actPath, "workflow", "step-summary-"+strconv.Itoa(i)+".md")
-		body, ok := readSingleFileFromContainerArchive(ctx, rc.JobContainer, summaryPath, maxJobSummaryBytes)
-		if !ok || len(body) == 0 {
-			continue
-		}
-		uploadJobSummary(ctx, client, base+strconv.Itoa(i)+"/summary", runtimeToken, body)
-	}
-}
-
-// extractJobIDFromRuntimeToken returns the JobID claim from an ACTIONS_RUNTIME_TOKEN JWT
-// without verifying its signature. Returns 0 if the token is unparseable or has no JobID.
-func extractJobIDFromRuntimeToken(token string) int64 {
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return 0
-	}
-	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
-	if err != nil {
-		return 0
-	}
-	var claims struct {
-		JobID int64 `json:"JobID"`
-	}
-	if err := json.Unmarshal(payload, &claims); err != nil {
-		return 0
-	}
-	return claims.JobID
-}
-
-func hasJobSummaryCapability(caps string) bool {
-	return slices.Contains(strings.FieldsFunc(caps, func(r rune) bool {
-		return r == ',' || unicode.IsSpace(r)
-	}), "job-summary")
-}
-
-func uploadJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) {
-	logger := common.Logger(ctx)
-
-	var lastStatus int
-	var lastErr error
-	for attempt := 0; attempt < 2; attempt++ {
-		status, err := putJobSummary(ctx, client, url, runtimeToken, body)
-		if err == nil && status/100 == 2 {
-			return
-		}
-		lastStatus = status
-		lastErr = err
-		if attempt == 1 || !isTransientJobSummaryUploadFailure(status, err) {
-			break
-		}
-		timer := time.NewTimer(jobSummaryUploadRetryDelay)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			lastErr = ctx.Err()
-			attempt = 1
-		case <-timer.C:
-		}
-	}
-
-	// Best-effort only; do not fail job, but log because capability was advertised.
-	if lastErr != nil {
-		logger.WithError(lastErr).Warn("job summary upload failed")
-		return
-	}
-	logger.Warnf("job summary upload failed: status=%d", lastStatus)
-}
-
-func putJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) (int, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(body))
-	if err != nil {
-		return 0, err
-	}
-	req.Header.Set("Authorization", "Bearer "+runtimeToken)
-	req.Header.Set("Content-Type", "text/markdown; charset=utf-8")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return 0, err
-	}
-	defer resp.Body.Close()
-	_, _ = io.Copy(io.Discard, resp.Body)
-	return resp.StatusCode, nil
-}
-
-func isTransientJobSummaryUploadFailure(status int, err error) bool {
-	return err != nil || status == http.StatusRequestTimeout || status == http.StatusTooManyRequests || status/100 == 5
-}
-
-func readSingleFileFromContainerArchive(ctx context.Context, env container.ExecutionsEnvironment, p string, maxBytes int64) ([]byte, bool) {
-	rc, err := env.GetContainerArchive(ctx, p)
-	if err != nil {
-		return nil, false
-	}
-	defer rc.Close()
-
-	tr := tar.NewReader(rc)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			return nil, false
-		}
-		if err != nil {
-			return nil, false
-		}
-		if header.Typeflag != tar.TypeReg {
-			continue
-		}
-		if !archiveEntryMatchesPath(header.Name, p) {
-			continue
-		}
-		// Summaries larger than the limit are truncated rather than dropped, so the
-		// user still gets the leading content (mirroring how GitHub caps oversized
-		// step summaries instead of discarding them). Read one extra byte so an
-		// over-limit file is detected from the actual stream rather than trusting
-		// header.Size, then cap the returned content at maxBytes.
-		b, err := io.ReadAll(io.LimitReader(tr, maxBytes+1))
-		if err != nil {
-			return nil, false
-		}
-		if int64(len(b)) > maxBytes {
-			// Reserve room for the marker so the marked-up result still fits in maxBytes.
-			marker := []byte(jobSummaryTruncationMarker)
-			keep := max(maxBytes-int64(len(marker)), 0)
-			b = append(b[:keep], marker...)
-			common.Logger(ctx).Warnf("job summary truncated: path=%s max=%d", p, maxBytes)
-		}
-		return b, true
-	}
-}
-
-func archiveEntryMatchesPath(entryName, requestedPath string) bool {
-	entryName = path.Clean(strings.TrimPrefix(entryName, "/"))
-	requestedPath = path.Clean(strings.TrimPrefix(requestedPath, "/"))
-	return entryName == requestedPath || entryName == path.Base(requestedPath)
-}
-
-func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		ctx = withStepLogger(ctx, stepModel.Number, stepModel.ID, rc.ExprEval.Interpolate(ctx, stepModel.String()), stage.String())
-
-		rawLogger := common.Logger(ctx).WithField("raw_output", true)
-		logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
-			if rc.Config.LogOutput {
-				rawLogger.Infof("%s", s)
-			} else {
-				rawLogger.Debugf("%s", s)
-			}
-			return true
-		})
-
-		oldout, olderr := rc.JobContainer.ReplaceLogWriter(logWriter, logWriter)
-		defer rc.JobContainer.ReplaceLogWriter(oldout, olderr)
-
-		// Flush any buffered, not-yet-newline-terminated trailing line once the
-		// step has finished, so the final line of the step's output is not lost
-		// when it is not newline-terminated.
-		defer common.FlushWriter(logWriter)
-
-		return executor(ctx)
-	}
-}

act/runner/job_executor_test.go

@@ -1,905 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"archive/tar"
-	"bytes"
-	"context"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
-
-	logrustest "github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-	yaml "go.yaml.in/yaml/v4"
-)
-
-func TestJobExecutor(t *testing.T) {
-	// Dryrun only checks syntax/planning; all cases resolve locally, so this runs offline.
-	tables := []TestJobFileInfo{
-		{workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets},
-		{workdir, "uses-github-empty", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
-		{workdir, "uses-github-noref", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
-		{workdir, "uses-github-root", "push", "", platforms, secrets},
-		{workdir, "uses-docker-url", "push", "", platforms, secrets},
-		{workdir, "job-nil-step", "push", "invalid Step 0: missing run or uses key", platforms, secrets},
-	}
-	// These tests are sufficient to only check syntax.
-	ctx := common.WithDryrun(context.Background(), true)
-	for _, table := range tables {
-		t.Run(table.workflowPath, func(t *testing.T) {
-			table.runTest(ctx, t, &Config{})
-		})
-	}
-}
-
-type jobInfoMock struct {
-	mock.Mock
-}
-
-func (jim *jobInfoMock) matrix() map[string]any {
-	args := jim.Called()
-	return args.Get(0).(map[string]any)
-}
-
-func (jim *jobInfoMock) steps() []*model.Step {
-	args := jim.Called()
-
-	return args.Get(0).([]*model.Step)
-}
-
-func (jim *jobInfoMock) startContainer() common.Executor {
-	args := jim.Called()
-
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (jim *jobInfoMock) stopContainer() common.Executor {
-	args := jim.Called()
-
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (jim *jobInfoMock) closeContainer() common.Executor {
-	args := jim.Called()
-
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (jim *jobInfoMock) interpolateOutputs() common.Executor {
-	args := jim.Called()
-
-	return args.Get(0).(func(context.Context) error)
-}
-
-func (jim *jobInfoMock) result(result string) {
-	jim.Called(result)
-}
-
-type jobContainerMock struct {
-	container.Container
-	container.LinuxContainerEnvironmentExtensions
-}
-
-func (jcm *jobContainerMock) ReplaceLogWriter(_, _ io.Writer) (io.Writer, io.Writer) {
-	return nil, nil
-}
-
-type stepFactoryMock struct {
-	mock.Mock
-}
-
-func (sfm *stepFactoryMock) newStep(model *model.Step, rc *RunContext) (step, error) {
-	args := sfm.Called(model, rc)
-	return args.Get(0).(step), args.Error(1)
-}
-
-func TestNewJobExecutor(t *testing.T) {
-	table := []struct {
-		name          string
-		steps         []*model.Step
-		preSteps      []bool
-		postSteps     []bool
-		executedSteps []string
-		result        string
-		hasError      bool
-	}{
-		{
-			name:          "zeroSteps",
-			steps:         []*model.Step{},
-			preSteps:      []bool{},
-			postSteps:     []bool{},
-			executedSteps: []string{},
-			result:        "success",
-			hasError:      false,
-		},
-		{
-			name: "stepWithoutPrePost",
-			steps: []*model.Step{{
-				ID: "1",
-			}},
-			preSteps:  []bool{false},
-			postSteps: []bool{false},
-			executedSteps: []string{
-				"startContainer",
-				"step1",
-				"stopContainer",
-				"interpolateOutputs",
-				"closeContainer",
-			},
-			result:   "success",
-			hasError: false,
-		},
-		{
-			name: "stepWithFailure",
-			steps: []*model.Step{{
-				ID: "1",
-			}},
-			preSteps:  []bool{false},
-			postSteps: []bool{false},
-			executedSteps: []string{
-				"startContainer",
-				"step1",
-				"interpolateOutputs",
-				"closeContainer",
-			},
-			result:   "failure",
-			hasError: true,
-		},
-		{
-			name: "stepWithPre",
-			steps: []*model.Step{{
-				ID: "1",
-			}},
-			preSteps:  []bool{true},
-			postSteps: []bool{false},
-			executedSteps: []string{
-				"startContainer",
-				"pre1",
-				"step1",
-				"stopContainer",
-				"interpolateOutputs",
-				"closeContainer",
-			},
-			result:   "success",
-			hasError: false,
-		},
-		{
-			name: "stepWithPost",
-			steps: []*model.Step{{
-				ID: "1",
-			}},
-			preSteps:  []bool{false},
-			postSteps: []bool{true},
-			executedSteps: []string{
-				"startContainer",
-				"step1",
-				"post1",
-				"stopContainer",
-				"interpolateOutputs",
-				"closeContainer",
-			},
-			result:   "success",
-			hasError: false,
-		},
-		{
-			name: "stepWithPreAndPost",
-			steps: []*model.Step{{
-				ID: "1",
-			}},
-			preSteps:  []bool{true},
-			postSteps: []bool{true},
-			executedSteps: []string{
-				"startContainer",
-				"pre1",
-				"step1",
-				"post1",
-				"stopContainer",
-				"interpolateOutputs",
-				"closeContainer",
-			},
-			result:   "success",
-			hasError: false,
-		},
-		{
-			name: "stepsWithPreAndPost",
-			steps: []*model.Step{{
-				ID: "1",
-			}, {
-				ID: "2",
-			}, {
-				ID: "3",
-			}},
-			preSteps:  []bool{true, false, true},
-			postSteps: []bool{false, true, true},
-			executedSteps: []string{
-				"startContainer",
-				"pre1",
-				"pre3",
-				"step1",
-				"step2",
-				"step3",
-				"post3",
-				"post2",
-				"stopContainer",
-				"interpolateOutputs",
-				"closeContainer",
-			},
-			result:   "success",
-			hasError: false,
-		},
-	}
-
-	contains := func(needle string, haystack []string) bool {
-		return slices.Contains(haystack, needle)
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			fmt.Printf("::group::%s\n", tt.name) //nolint:forbidigo // pre-existing issue from nektos/act
-
-			ctx := common.WithJobErrorContainer(context.Background())
-			jim := &jobInfoMock{}
-			sfm := &stepFactoryMock{}
-			rc := &RunContext{
-				JobContainer: &jobContainerMock{},
-				Run: &model.Run{
-					JobID: "test",
-					Workflow: &model.Workflow{
-						Jobs: map[string]*model.Job{
-							"test": {},
-						},
-					},
-				},
-				Config: &Config{},
-			}
-			rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-			executorOrder := make([]string, 0)
-
-			jim.On("steps").Return(tt.steps)
-
-			if len(tt.steps) > 0 {
-				jim.On("startContainer").Return(func(ctx context.Context) error {
-					executorOrder = append(executorOrder, "startContainer")
-					return nil
-				})
-			}
-
-			for i, stepModel := range tt.steps {
-				sm := &stepMock{}
-
-				sfm.On("newStep", stepModel, rc).Return(sm, nil)
-
-				sm.On("pre").Return(func(ctx context.Context) error {
-					if tt.preSteps[i] {
-						executorOrder = append(executorOrder, "pre"+stepModel.ID)
-					}
-					return nil
-				})
-
-				sm.On("main").Return(func(ctx context.Context) error {
-					executorOrder = append(executorOrder, "step"+stepModel.ID)
-					if tt.hasError {
-						return errors.New("error")
-					}
-					return nil
-				})
-
-				sm.On("post").Return(func(ctx context.Context) error {
-					if tt.postSteps[i] {
-						executorOrder = append(executorOrder, "post"+stepModel.ID)
-					}
-					return nil
-				})
-
-				defer sm.AssertExpectations(t)
-			}
-
-			if len(tt.steps) > 0 {
-				jim.On("matrix").Return(map[string]any{})
-
-				jim.On("interpolateOutputs").Return(func(ctx context.Context) error {
-					executorOrder = append(executorOrder, "interpolateOutputs")
-					return nil
-				})
-
-				if contains("stopContainer", tt.executedSteps) {
-					jim.On("stopContainer").Return(func(ctx context.Context) error {
-						executorOrder = append(executorOrder, "stopContainer")
-						return nil
-					})
-				}
-
-				jim.On("result", tt.result)
-
-				jim.On("closeContainer").Return(func(ctx context.Context) error {
-					executorOrder = append(executorOrder, "closeContainer")
-					return nil
-				})
-			}
-
-			executor := newJobExecutor(jim, sfm, rc)
-			err := executor(ctx)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.Equal(t, tt.executedSteps, executorOrder)
-
-			jim.AssertExpectations(t)
-			sfm.AssertExpectations(t)
-
-			fmt.Println("::endgroup::") //nolint:forbidigo // pre-existing issue from nektos/act
-		})
-	}
-}
-
-// TestNewJobExecutorRunsPostStepsAfterTimeout guards the timeout-minutes cleanup
-// path: when a job exceeds its timeout the job context is DeadlineExceeded, but
-// the post steps (cleanup hooks like actions/checkout post and cache save) must
-// still run against a fresh, non-expired context, and the job must still be
-// reported as failed.
-func TestNewJobExecutorRunsPostStepsAfterTimeout(t *testing.T) {
-	ctx := common.WithJobErrorContainer(context.Background())
-	// The timeout is generous so the main step (which blocks on ctx.Done below) is
-	// always reached before the deadline fires; otherwise the pipeline would
-	// short-circuit before the step runs and the job error would never be set.
-	ctx, cancel := context.WithTimeout(ctx, 200*time.Millisecond)
-	defer cancel()
-
-	jim := &jobInfoMock{}
-	sfm := &stepFactoryMock{}
-	rc := &RunContext{
-		JobContainer: &jobContainerMock{},
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{
-					"test": {},
-				},
-			},
-		},
-		Config: &Config{},
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-
-	stepModel := &model.Step{ID: "1"}
-	jim.On("steps").Return([]*model.Step{stepModel})
-	jim.On("matrix").Return(map[string]any{})
-	jim.On("startContainer").Return(func(ctx context.Context) error { return nil })
-	jim.On("interpolateOutputs").Return(func(ctx context.Context) error { return nil })
-	jim.On("closeContainer").Return(func(ctx context.Context) error { return nil })
-	// The job timed out, so it must be reported as failed. stopContainer is left
-	// unexpected on purpose: a timed-out (failed) job preserves its error state, so
-	// the graceful stop is skipped exactly like any other failure without AutoRemove.
-	jim.On("result", "failure")
-
-	sm := &stepMock{}
-	sfm.On("newStep", stepModel, rc).Return(sm, nil)
-	sm.On("pre").Return(func(ctx context.Context) error { return nil })
-	// The main step runs past the job timeout: it blocks until the job context is
-	// done, mirroring a step that overruns timeout-minutes.
-	sm.On("main").Return(func(ctx context.Context) error {
-		<-ctx.Done()
-		return ctx.Err()
-	})
-
-	var postRan bool
-	var postCtxErr error
-	sm.On("post").Return(func(ctx context.Context) error {
-		postRan = true
-		postCtxErr = ctx.Err()
-		return nil
-	})
-
-	executor := newJobExecutor(jim, sfm, rc)
-	// The executor itself returns nil on timeout: the failure is surfaced through
-	// the job result ("failure", asserted via the result mock below), not the
-	// return value.
-	require.NoError(t, executor(ctx))
-
-	assert.True(t, postRan, "post step must run after a job timeout")
-	require.NoError(t, postCtxErr, "post step must run against a fresh, non-expired context")
-
-	jim.AssertExpectations(t)
-	sfm.AssertExpectations(t)
-	sm.AssertExpectations(t)
-}
-
-// TestSetJobResultMatrixContinueOnError exercises the parallel-matrix path
-// end-to-end: two combinations share one *model.Job and continue-on-error is
-// keyed on matrix.experimental, so one combination tolerates its failure and the
-// other does not. The job is reported as continue-on-error only when EVERY failing
-// combination was tolerated; a single firm failure makes the whole job firm, and
-// handleFailure then fails the run.
-func TestSetJobResultMatrixContinueOnError(t *testing.T) {
-	const jobYAML = "continue-on-error: ${{ matrix.experimental }}\nruns-on: ubuntu-latest"
-
-	newSharedJob := func(t *testing.T) (*model.Job, *model.Workflow) {
-		t.Helper()
-		var job *model.Job
-		require.NoError(t, yaml.Unmarshal([]byte(jobYAML), &job))
-		return job, &model.Workflow{
-			Name: "workflow1",
-			Jobs: map[string]*model.Job{"job1": job},
-		}
-	}
-
-	planFor := func(wf *model.Workflow) *model.Plan {
-		return &model.Plan{Stages: []*model.Stage{{Runs: []*model.Run{{Workflow: wf, JobID: "job1"}}}}}
-	}
-
-	ctx := context.Background()
-
-	// fail drives a single matrix combination through the failure path; each
-	// RunContext is its own jobInfo (rc implements jobInfo) and shares the job.
-	fail := func(wf *model.Workflow, experimental bool) {
-		rc := newTestRC(wf, map[string]any{"experimental": experimental})
-		setJobResult(ctx, rc, rc, false)
-	}
-
-	t.Run("one tolerated and one firm failure fails the run", func(t *testing.T) {
-		job, wf := newSharedJob(t)
-		// Order is intentional: the tolerated combination finishes first, then the
-		// firm one. The firm-failure latch must still win regardless of order.
-		fail(wf, true)
-		fail(wf, false)
-
-		assert.Equal(t, "failure", job.Result)
-		assert.False(t, job.ContinueOnError, "a single firm failure must make the whole job firm")
-		assert.Error(t, handleFailure(planFor(wf))(ctx))
-	})
-
-	t.Run("all tolerated failures do not fail the run", func(t *testing.T) {
-		job, wf := newSharedJob(t)
-		fail(wf, true)
-		fail(wf, true)
-
-		assert.Equal(t, "failure", job.Result)
-		assert.True(t, job.ContinueOnError, "every failing combination was tolerated")
-		assert.NoError(t, handleFailure(planFor(wf))(ctx))
-	})
-}
-
-func TestHasJobSummaryCapability(t *testing.T) {
-	assert.True(t, hasJobSummaryCapability("cache,job-summary artifacts"))
-	assert.True(t, hasJobSummaryCapability("cache,\njob-summary\tartifacts"))
-	assert.False(t, hasJobSummaryCapability("not-job-summary,job-summary-v2"))
-}
-
-// fakeRuntimeToken builds a JWT-shaped string whose middle (claims) segment encodes
-// the given JobID. The header and signature segments are filler — the runner does not
-// verify the signature; the server does.
-func fakeRuntimeToken(jobID int64) string {
-	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"HS256","typ":"JWT"}`))
-	claims := base64.RawURLEncoding.EncodeToString(fmt.Appendf(nil, `{"JobID":%d}`, jobID))
-	sig := base64.RawURLEncoding.EncodeToString([]byte("sig"))
-	return header + "." + claims + "." + sig
-}
-
-func newJobSummaryRC(env map[string]string, jobContainer container.ExecutionsEnvironment, stepCount int) *RunContext {
-	steps := make([]*model.Step, stepCount)
-	for i := range steps {
-		steps[i] = &model.Step{ID: strconv.Itoa(i)}
-	}
-	return &RunContext{
-		Config:       &Config{},
-		JobContainer: jobContainer,
-		Env:          env,
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{
-					"test": {Steps: steps},
-				},
-			},
-		},
-	}
-}
-
-func TestTryUploadJobSummaryRetriesTransientFailure(t *testing.T) {
-	oldDelay := jobSummaryUploadRetryDelay
-	jobSummaryUploadRetryDelay = 0
-	defer func() {
-		jobSummaryUploadRetryDelay = oldDelay
-	}()
-
-	runtimeToken := fakeRuntimeToken(34)
-
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		assert.Equal(t, http.MethodPut, r.Method)
-		assert.Equal(t, "/_apis/pipelines/workflows/12/jobs/34/steps/0/summary", r.URL.Path)
-		assert.Equal(t, "Bearer "+runtimeToken, r.Header.Get("Authorization"))
-		assert.Equal(t, "text/markdown; charset=utf-8", r.Header.Get("Content-Type"))
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		assert.Equal(t, []byte("# summary"), body)
-		if requests == 1 {
-			w.WriteHeader(http.StatusInternalServerError)
-			return
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "# summary"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "cache, job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 1)
-
-	tryUploadJobSummary(ctx, rc)
-
-	assert.Equal(t, 2, requests)
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryStopsAtPhaseTimeout(t *testing.T) {
-	oldPhase := jobSummaryUploadPhaseTimeout
-	jobSummaryUploadPhaseTimeout = 100 * time.Millisecond
-	defer func() {
-		jobSummaryUploadPhaseTimeout = oldPhase
-	}()
-
-	runtimeToken := fakeRuntimeToken(34)
-
-	// The server blocks until either the request context is cancelled (the behaviour
-	// under test: the phase timeout aborts the in-flight upload) or the test tears it
-	// down. Without the phase timeout the upload would hang until the 30s client
-	// timeout instead of releasing the cleanup budget. The release channel guarantees
-	// the handler always returns so server.Close() cannot itself hang.
-	release := make(chan struct{})
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		select {
-		case <-r.Context().Done():
-		case <-release:
-		}
-	}))
-	defer server.Close()
-	defer close(release)
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "# summary"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 1)
-
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		tryUploadJobSummary(ctx, rc)
-	}()
-
-	select {
-	case <-done:
-	case <-time.After(5 * time.Second):
-		t.Fatal("tryUploadJobSummary did not honour the phase timeout")
-	}
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryUploadsEachStepIndependently(t *testing.T) {
-	runtimeToken := fakeRuntimeToken(34)
-
-	type upload struct {
-		path string
-		body string
-	}
-	var got []upload
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		got = append(got, upload{r.URL.Path, string(body)})
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	// Three steps: 0 has content, 1 has empty content (skipped), 2 has content.
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "first"}))),
-		nil,
-	).Once()
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-1.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-1.md", body: ""}))),
-		nil,
-	).Once()
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-2.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-2.md", body: "third"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 3)
-
-	tryUploadJobSummary(ctx, rc)
-
-	assert.Equal(t, []upload{
-		{"/_apis/pipelines/workflows/12/jobs/34/steps/0/summary", "first"},
-		{"/_apis/pipelines/workflows/12/jobs/34/steps/2/summary", "third"},
-	}, got)
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryRequiresExactCapability(t *testing.T) {
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "not-job-summary,job-summary-v2",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      fakeRuntimeToken(34),
-		"GITEA_RUN_ID":               "12",
-	}, &containerMock{}, 1)
-
-	tryUploadJobSummary(context.Background(), rc)
-
-	assert.Equal(t, 0, requests)
-}
-
-func TestTryUploadJobSummarySkipsWhenJobIDMissingFromToken(t *testing.T) {
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      "not-a-jwt",
-		"GITEA_RUN_ID":               "12",
-	}, &containerMock{}, 1)
-
-	tryUploadJobSummary(context.Background(), rc)
-
-	assert.Equal(t, 0, requests)
-}
-
-func TestExtractJobIDFromRuntimeToken(t *testing.T) {
-	assert.Equal(t, int64(42), extractJobIDFromRuntimeToken(fakeRuntimeToken(42)))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken("not-a-jwt"))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken("a.b.c"))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken(""))
-}
-
-func TestReadSingleFileFromContainerArchiveFindsMatchingRegularFile(t *testing.T) {
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t,
-			tarEntry{name: "workflow", typeflag: tar.TypeDir},
-			tarEntry{name: "other.md", body: "wrong"},
-			tarEntry{name: "SUMMARY.md", body: "right"},
-		))),
-		nil,
-	).Once()
-
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", 1024)
-
-	assert.True(t, ok)
-	assert.Equal(t, []byte("right"), body)
-	cm.AssertExpectations(t)
-}
-
-func TestReadSingleFileFromContainerArchiveTruncatesWhenTooLarge(t *testing.T) {
-	logger, hook := logrustest.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	cm := &containerMock{}
-	content := strings.Repeat("a", 300)
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "SUMMARY.md", body: content}))),
-		nil,
-	).Once()
-
-	const maxBytes = 200
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", maxBytes)
-
-	// Oversized summaries are truncated to the limit (reserving room for the marker)
-	// rather than dropped entirely, and the truncation marker is appended.
-	assert.True(t, ok)
-	assert.LessOrEqual(t, len(body), maxBytes)
-	keep := maxBytes - len(jobSummaryTruncationMarker)
-	assert.Equal(t, []byte(content[:keep]+jobSummaryTruncationMarker), body)
-	if assert.Len(t, hook.Entries, 1) {
-		assert.Contains(t, hook.Entries[0].Message, "job summary truncated")
-	}
-	cm.AssertExpectations(t)
-}
-
-func TestReadSingleFileFromContainerArchiveKeepsExactLimitWithoutWarning(t *testing.T) {
-	logger, hook := logrustest.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "SUMMARY.md", body: "abc"}))),
-		nil,
-	).Once()
-
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", 3)
-
-	// A summary that is exactly at the limit is kept whole and not flagged as truncated.
-	assert.True(t, ok)
-	assert.Equal(t, []byte("abc"), body)
-	assert.Empty(t, hook.Entries)
-	cm.AssertExpectations(t)
-}
-
-type tarEntry struct {
-	name     string
-	body     string
-	typeflag byte
-}
-
-func tarArchive(t *testing.T, entries ...tarEntry) []byte {
-	t.Helper()
-
-	buf := &bytes.Buffer{}
-	tw := tar.NewWriter(buf)
-	for _, entry := range entries {
-		typeflag := entry.typeflag
-		if typeflag == 0 {
-			typeflag = tar.TypeReg
-		}
-		header := &tar.Header{
-			Name:     entry.name,
-			Typeflag: typeflag,
-			Mode:     0o644,
-			Size:     int64(len(entry.body)),
-		}
-		if typeflag == tar.TypeDir {
-			header.Mode = 0o755
-			header.Size = 0
-		}
-		require.NoError(t, tw.WriteHeader(header))
-		if typeflag == tar.TypeReg {
-			_, err := tw.Write([]byte(entry.body))
-			require.NoError(t, err)
-		}
-	}
-	require.NoError(t, tw.Close())
-	return buf.Bytes()
-}
-
-func newTestRC(wf *model.Workflow, matrix map[string]any) *RunContext {
-	return &RunContext{
-		Config: &Config{
-			Workdir: ".",
-			Platforms: map[string]string{
-				"ubuntu-latest": "ubuntu-latest",
-			},
-		},
-		StepResults: map[string]*model.StepResult{},
-		Env:         map[string]string{},
-		Matrix:      matrix,
-		Run:         &model.Run{JobID: "job1", Workflow: wf},
-	}
-}
-
-func makeTestRC(t *testing.T, jobYAML string) *RunContext {
-	t.Helper()
-	var job *model.Job
-	require.NoError(t, yaml.Unmarshal([]byte(jobYAML), &job))
-	rc := newTestRC(&model.Workflow{
-		Name: "workflow1",
-		Jobs: map[string]*model.Job{"job1": job},
-	}, nil)
-	rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
-	return rc
-}
-
-func TestApplyJobTimeout(t *testing.T) {
-	cases := []struct {
-		name        string
-		yaml        string
-		wantTimeout bool
-	}{
-		{"empty", "runs-on: ubuntu-latest", false},
-		{"integer", "timeout-minutes: 5\nruns-on: ubuntu-latest", true},
-		{"non-numeric ignored", "timeout-minutes: abc\nruns-on: ubuntu-latest", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rc := makeTestRC(t, tc.yaml)
-			ctx := context.Background()
-			newCtx, cancel := applyJobTimeout(ctx, rc, rc.Run.Job())
-			defer cancel()
-			_, hasDeadline := newCtx.Deadline()
-			assert.Equal(t, tc.wantTimeout, hasDeadline)
-		})
-	}
-}
-
-func TestEvaluateJobContinueOnError(t *testing.T) {
-	cases := []struct {
-		name string
-		yaml string
-		want bool
-	}{
-		{"absent", "runs-on: ubuntu-latest", false},
-		{"true", "continue-on-error: true\nruns-on: ubuntu-latest", true},
-		{"false", "continue-on-error: false\nruns-on: ubuntu-latest", false},
-		{"expression true", "continue-on-error: ${{ 'x' == 'x' }}\nruns-on: ubuntu-latest", true},
-		{"expression false", "continue-on-error: ${{ 'x' != 'x' }}\nruns-on: ubuntu-latest", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rc := makeTestRC(t, tc.yaml)
-			got := evaluateJobContinueOnError(context.Background(), rc, rc.Run.Job())
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}
-
-func TestJobSetContinueOnError(t *testing.T) {
-	t.Run("first call true", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		assert.True(t, j.ContinueOnError)
-	})
-	t.Run("first call false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(false)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("true then false locks to false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		j.SetContinueOnError(false)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("false then true stays false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(false)
-		j.SetContinueOnError(true)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("true then true stays true", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		j.SetContinueOnError(true)
-		assert.True(t, j.ContinueOnError)
-	})
-}

act/runner/logger_test.go

@@ -1,52 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestValueMasker(t *testing.T) {
-	table := []struct {
-		name       string
-		lines      string
-		secrets    map[string]string
-		masks      []string
-		disallowed []string
-	}{
-		{
-			name:  "Multiline Private Key",
-			lines: "cat << EOF > private.key\nPRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END\nEOF",
-			secrets: map[string]string{
-				"PRIVATE_KEY": "PRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END",
-			},
-			disallowed: []string{"KEY", "dsdfseffefsefes", "PRIVATE_KEY_END"},
-		},
-		{
-			name:       "Multiline Private Key in masks",
-			lines:      "cat << EOF > private.key\nPRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END\nEOF",
-			masks:      []string{"PRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END"},
-			disallowed: []string{"KEY", "dsdfseffefsefes", "PRIVATE_KEY_END"},
-		},
-	}
-	for _, entry := range table {
-		t.Run(entry.name, func(t *testing.T) {
-			ctx := WithMasks(t.Context(), &entry.masks)
-			masker := valueMasker(false, entry.secrets)
-			for line := range strings.SplitSeq(entry.lines, "\n") {
-				lentry := masker(&logrus.Entry{
-					Context: ctx,
-					Message: line,
-				})
-				for _, line := range entry.disallowed {
-					assert.NotContains(t, lentry.Message, line)
-				}
-			}
-		})
-	}
-}

act/runner/max_parallel_test.go

@@ -1,67 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"testing"
-
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"go.yaml.in/yaml/v4"
-)
-
-func TestMaxParallelStrategy(t *testing.T) {
-	tests := []struct {
-		name                string
-		maxParallelString   string
-		expectedMaxParallel int
-	}{
-		{
-			name:                "max-parallel-1",
-			maxParallelString:   "1",
-			expectedMaxParallel: 1,
-		},
-		{
-			name:                "max-parallel-2",
-			maxParallelString:   "2",
-			expectedMaxParallel: 2,
-		},
-		{
-			name:                "max-parallel-default",
-			maxParallelString:   "",
-			expectedMaxParallel: 4,
-		},
-		{
-			name:                "max-parallel-10",
-			maxParallelString:   "10",
-			expectedMaxParallel: 10,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			matrix := map[string][]any{
-				"version": {1, 2, 3, 4, 5},
-			}
-
-			var rawMatrix yaml.Node
-			err := rawMatrix.Encode(matrix)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-
-			job := &model.Job{
-				Strategy: &model.Strategy{
-					MaxParallelString: tt.maxParallelString,
-					RawMatrix:         rawMatrix,
-				},
-			}
-
-			matrixes, err := job.GetMatrixes()
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.NotNil(t, matrixes)
-			assert.Len(t, matrixes, 5)
-			assert.Equal(t, tt.expectedMaxParallel, job.Strategy.MaxParallel)
-		})
-	}
-}

act/runner/res/trampoline.js

@@ -1,14 +0,0 @@
-const { spawnSync } = require('child_process')
-const spawnArguments = {
-  cwd: process.env.INPUT_CWD,
-  stdio: [
-    process.stdin,
-    process.stdout,
-    process.stderr
-  ]
-}
-const child = spawnSync(
-  '/bin/sh',
-  ['-c'].concat(process.env.INPUT_COMMAND),
-  spawnArguments)
-process.exit(child.status)

act/runner/reusable_workflow.go

@@ -1,349 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"archive/tar"
-	"context"
-	"fmt"
-	"net/url"
-	"path"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
-)
-
-func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
-	if !rc.Config.NoSkipCheckout {
-		fullPath := rc.Run.Job().Uses
-
-		fileName := path.Base(fullPath)
-		workflowDir := strings.TrimSuffix(fullPath, path.Join("/", fileName))
-		workflowDir = strings.TrimPrefix(workflowDir, "./")
-
-		return common.NewPipelineExecutor(
-			// resolve the local workflow against the workspace root, not the process
-			// working directory, so it is found regardless of where the runner is invoked
-			newReusableWorkflowExecutor(rc, filepath.Join(rc.Config.Workdir, workflowDir), fileName),
-		)
-	}
-
-	// ./.gitea/workflows/wf.yml -> .gitea/workflows/wf.yml
-	trimmedUses := strings.TrimPrefix(rc.Run.Job().Uses, "./")
-	// uses string format is {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}
-	uses := fmt.Sprintf("%s/%s@%s", rc.Config.PresetGitHubContext.Repository, trimmedUses, rc.Config.PresetGitHubContext.Sha)
-
-	remoteReusableWorkflow := newRemoteReusableWorkflowWithPlat(rc.Config.GitHubInstance, uses)
-	if remoteReusableWorkflow == nil {
-		return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
-	}
-
-	workflowDir := fmt.Sprintf("%s/%s", rc.ActionCacheDir(), safeFilename(uses))
-
-	// If the repository is private, we need a token to clone it
-	token := rc.Config.GetToken()
-
-	return common.NewPipelineExecutor(
-		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
-		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
-	)
-}
-
-func newRemoteReusableWorkflowExecutor(rc *RunContext) common.Executor {
-	uses := rc.Run.Job().Uses
-
-	var remoteReusableWorkflow *remoteReusableWorkflow
-	if strings.HasPrefix(uses, "http://") || strings.HasPrefix(uses, "https://") {
-		remoteReusableWorkflow = newRemoteReusableWorkflowFromAbsoluteURL(uses)
-		if remoteReusableWorkflow == nil {
-			return common.NewErrorExecutor(fmt.Errorf("expected format http(s)://{domain}/{owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
-		}
-	} else {
-		remoteReusableWorkflow = newRemoteReusableWorkflowWithPlat(rc.Config.GitHubInstance, uses)
-		if remoteReusableWorkflow == nil {
-			return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
-		}
-	}
-
-	// uses with safe filename makes the target directory look something like this {owner}-{repo}-.github-workflows-{filename}@{ref}
-	// instead we will just use {owner}-{repo}@{ref} as our target directory. This should also improve performance when we are using
-	// multiple reusable workflows from the same repository and ref since for each workflow we won't have to clone it again
-	filename := fmt.Sprintf("%s/%s@%s", remoteReusableWorkflow.Org, remoteReusableWorkflow.Repo, remoteReusableWorkflow.Ref)
-	workflowDir := fmt.Sprintf("%s/%s", rc.ActionCacheDir(), safeFilename(filename))
-
-	if rc.Config.ActionCache != nil {
-		return newActionCacheReusableWorkflowExecutor(rc, filename, remoteReusableWorkflow)
-	}
-
-	token := getGitCloneToken(rc.Config, remoteReusableWorkflow.CloneURL())
-
-	return common.NewPipelineExecutor(
-		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
-		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
-	)
-}
-
-func newActionCacheReusableWorkflowExecutor(rc *RunContext, filename string, remoteReusableWorkflow *remoteReusableWorkflow) common.Executor {
-	return func(ctx context.Context) error {
-		ghctx := rc.getGithubContext(ctx)
-		remoteReusableWorkflow.URL = ghctx.ServerURL
-		sha, err := rc.Config.ActionCache.Fetch(ctx, filename, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, ghctx.Token)
-		if err != nil {
-			return err
-		}
-		archive, err := rc.Config.ActionCache.GetTarArchive(ctx, filename, sha, ".github/workflows/"+remoteReusableWorkflow.Filename)
-		if err != nil {
-			return err
-		}
-		defer archive.Close()
-		treader := tar.NewReader(archive)
-		if _, err = treader.Next(); err != nil {
-			return err
-		}
-		planner, err := model.NewSingleWorkflowPlanner(remoteReusableWorkflow.Filename, treader)
-		if err != nil {
-			return err
-		}
-		plan, err := planner.PlanEvent("workflow_call")
-		if err != nil {
-			return err
-		}
-
-		runner, err := NewReusableWorkflowRunner(rc)
-		if err != nil {
-			return err
-		}
-
-		return runner.NewPlanExecutor(plan)(ctx)
-	}
-}
-
-// cloneRemoteReusableWorkflow always invokes the clone executor — moving refs
-// (branches, tags) must be re-resolved each run, matching GitHub Actions.
-//
-// Callers must not change remoteReusableWorkflow.URL, because:
-//  1. Gitea doesn't support specifying GithubContext.ServerURL by the GITHUB_SERVER_URL env
-//  2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflowWithPlat
-//
-// remoteReusableWorkflow.URL = rc.getGithubContext(ctx).ServerURL
-func cloneRemoteReusableWorkflow(rc *RunContext, cloneURL, ref, targetDirectory, token string) common.Executor {
-	return func(ctx context.Context) error {
-		cloneURL = rc.NewExpressionEvaluator(ctx).Interpolate(ctx, cloneURL)
-		return git.NewGitCloneExecutor(git.NewGitCloneExecutorInput{
-			URL:         cloneURL,
-			Ref:         ref,
-			Dir:         targetDirectory,
-			Token:       token,
-			OfflineMode: rc.Config.ActionOfflineMode,
-			Depth:       rc.Config.ActionCloneDepth,
-		})(ctx)
-	}
-}
-
-var modelNewWorkflowPlanner = model.NewWorkflowPlanner
-
-func newReusableWorkflowExecutor(rc *RunContext, directory, workflow string) common.Executor {
-	return func(ctx context.Context) error {
-		// Scoped to the yaml read so concurrent invocations don't serialize
-		// on the whole job run.
-		planner, err := func() (model.WorkflowPlanner, error) {
-			defer git.AcquireCloneLock(directory)()
-			return modelNewWorkflowPlanner(path.Join(directory, workflow), true)
-		}()
-		if err != nil {
-			return err
-		}
-
-		plan, err := planner.PlanEvent("workflow_call")
-		if err != nil {
-			return err
-		}
-
-		runner, err := NewReusableWorkflowRunner(rc)
-		if err != nil {
-			return err
-		}
-
-		// return runner.NewPlanExecutor(plan)(ctx)
-		return common.NewPipelineExecutor( // For Gitea
-			runner.NewPlanExecutor(plan),
-			setReusedWorkflowCallerResult(rc, runner),
-		)(ctx)
-	}
-}
-
-func NewReusableWorkflowRunner(rc *RunContext) (Runner, error) {
-	runner := &runnerImpl{
-		config:    rc.Config,
-		eventJSON: rc.EventJSON,
-		caller: &caller{
-			runContext: rc,
-
-			reusedWorkflowJobResults: map[string]string{}, // For Gitea
-		},
-	}
-
-	return runner.configure()
-}
-
-type remoteReusableWorkflow struct {
-	URL      string
-	Org      string
-	Repo     string
-	Filename string
-	Ref      string
-
-	GitPlatform string
-}
-
-func (r *remoteReusableWorkflow) CloneURL() string {
-	// In Gitea, r.URL always has the protocol prefix, we don't need to add extra prefix in this case.
-	if strings.HasPrefix(r.URL, "http://") || strings.HasPrefix(r.URL, "https://") {
-		return fmt.Sprintf("%s/%s/%s", r.URL, r.Org, r.Repo)
-	}
-	return fmt.Sprintf("https://%s/%s/%s", r.URL, r.Org, r.Repo)
-}
-
-func (r *remoteReusableWorkflow) FilePath() string {
-	return fmt.Sprintf("./.%s/workflows/%s", r.GitPlatform, r.Filename)
-}
-
-// For Gitea
-// newRemoteReusableWorkflowWithPlat create a `remoteReusableWorkflow`
-// workflows from `.gitea/workflows` and `.github/workflows` are supported
-func newRemoteReusableWorkflowWithPlat(url, uses string) *remoteReusableWorkflow {
-	// GitHub docs:
-	// https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_iduses
-	r := regexp.MustCompile(`^([^/]+)/([^/]+)/\.([^/]+)/workflows/([^@]+)@(.*)$`)
-	matches := r.FindStringSubmatch(uses)
-	if len(matches) != 6 {
-		return nil
-	}
-	return &remoteReusableWorkflow{
-		Org:         matches[1],
-		Repo:        matches[2],
-		GitPlatform: matches[3],
-		Filename:    matches[4],
-		Ref:         matches[5],
-		URL:         url,
-	}
-}
-
-// For Gitea
-// newRemoteReusableWorkflowWithPlat create a `remoteReusableWorkflow` from an absolute url
-func newRemoteReusableWorkflowFromAbsoluteURL(uses string) *remoteReusableWorkflow {
-	r := regexp.MustCompile(`^(https?://.*)/([^/]+)/([^/]+)/\.([^/]+)/workflows/([^@]+)@(.*)$`)
-	matches := r.FindStringSubmatch(uses)
-	if len(matches) != 7 {
-		return nil
-	}
-	return &remoteReusableWorkflow{
-		URL:         matches[1],
-		Org:         matches[2],
-		Repo:        matches[3],
-		GitPlatform: matches[4],
-		Filename:    matches[5],
-		Ref:         matches[6],
-	}
-}
-
-// For Gitea
-func setReusedWorkflowCallerResult(rc *RunContext, runner Runner) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-
-		runnerImpl, ok := runner.(*runnerImpl)
-		if !ok {
-			logger.Warn("Failed to get caller from runner")
-			return nil
-		}
-		caller := runnerImpl.caller
-
-		allJobDone := true
-		hasFailure := false
-		for _, result := range caller.reusedWorkflowJobResults {
-			if result == "pending" {
-				allJobDone = false
-				break
-			}
-			if result == "failure" {
-				hasFailure = true
-			}
-		}
-
-		if allJobDone {
-			reusedWorkflowJobResult := "success"
-			reusedWorkflowJobResultMessage := "succeeded"
-			if hasFailure {
-				reusedWorkflowJobResult = "failure"
-				reusedWorkflowJobResultMessage = "failed"
-			}
-
-			if rc.caller != nil {
-				rc.caller.setReusedWorkflowJobResult(rc.JobName, reusedWorkflowJobResult)
-			} else {
-				// Serialize this shared Job.Result write against the other matrix combos
-				// and setJobResult (same lockJob key).
-				unlock := lockJob(rc.Run.Job())
-				rc.result(reusedWorkflowJobResult)
-				unlock()
-				logger.WithField("jobResult", reusedWorkflowJobResult).Infof("Job %s", reusedWorkflowJobResultMessage)
-			}
-		}
-
-		return nil
-	}
-}
-
-// For Gitea
-// getGitCloneToken returns GITEA_TOKEN when shouldCloneURLUseToken returns true,
-// otherwise returns an empty string
-func getGitCloneToken(conf *Config, cloneURL string) string {
-	if !shouldCloneURLUseToken(conf.GitHubInstance, conf.trustedActionInstance(), cloneURL) {
-		return ""
-	}
-	return conf.GetToken()
-}
-
-// For Gitea
-// trustedActionInstance returns the self-hosted DEFAULT_ACTIONS_URL host that may carry the
-// task token, or "" when actions resolve to github.com / a GithubMirror (never trusted).
-func (c Config) trustedActionInstance() string {
-	if c.DefaultActionInstanceIsSelfHosted {
-		return c.DefaultActionInstance
-	}
-	return ""
-}
-
-// For Gitea
-// shouldCloneURLUseToken returns true when the following conditions are met:
-//  1. cloneURL's host matches this Gitea instance: either the registered instance
-//     (instanceURL) or, for DEFAULT_ACTIONS_URL=self on a different hostname, the
-//     self-hosted action instance (trustedActionInstance, "" when not trusted)
-//  2. the cloneURL does not have basic auth embedded
-func shouldCloneURLUseToken(instanceURL, trustedActionInstance, cloneURL string) bool {
-	u2, err := url.Parse(cloneURL)
-	if err != nil || u2.User != nil {
-		return false
-	}
-
-	for _, candidate := range []string{instanceURL, trustedActionInstance} {
-		if candidate == "" {
-			continue
-		}
-		if !strings.HasPrefix(candidate, "http://") &&
-			!strings.HasPrefix(candidate, "https://") {
-			candidate = "https://" + candidate
-		}
-		if u1, err := url.Parse(candidate); err == nil && u1.Host == u2.Host {
-			return true
-		}
-	}
-	return false
-}

act/runner/reusable_workflow_test.go

@@ -1,237 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Regression test for go-gitea/gitea#37483: a remote reusable workflow at a moving
-// ref (branch/tag) must reflect the new tip on every invocation, not stay pinned
-// to the cache populated on the first run.
-func TestReusableWorkflowCachedBranchRefRefreshes(t *testing.T) {
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("git not available in PATH")
-	}
-
-	remoteDir := t.TempDir()
-	gitMust(t, "", "init", "--bare", "--initial-branch=master", remoteDir)
-
-	workDir := t.TempDir()
-	gitMust(t, "", "clone", remoteDir, workDir)
-	gitMust(t, workDir, "config", "user.email", "test@test")
-	gitMust(t, workDir, "config", "user.name", "test")
-	gitMust(t, workDir, "checkout", "-b", "master")
-
-	const workflowPath = ".gitea/workflows/reusable.yml"
-	tmpl := func(tag string) string {
-		return "name: reusable\non:\n  workflow_call:\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo " + tag + "\n"
-	}
-
-	require.NoError(t, os.MkdirAll(filepath.Join(workDir, ".gitea/workflows"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, workflowPath), []byte(tmpl("v1")), 0o644))
-	gitMust(t, workDir, "add", workflowPath)
-	gitMust(t, workDir, "commit", "-m", "v1")
-	gitMust(t, workDir, "push", "-u", "origin", "master")
-
-	rc := &RunContext{
-		Config: &Config{},
-		Run: &model.Run{
-			JobID: "j1",
-			Workflow: &model.Workflow{
-				Name: "wf",
-				Jobs: map[string]*model.Job{"j1": {}},
-			},
-		},
-	}
-	cacheDir := t.TempDir()
-
-	require.NoError(t, cloneRemoteReusableWorkflow(rc, remoteDir, "master", cacheDir, "")(context.Background()))
-	got, err := os.ReadFile(filepath.Join(cacheDir, workflowPath))
-	require.NoError(t, err)
-	require.Equal(t, tmpl("v1"), string(got))
-
-	// Branch tip moves; cache key (cacheDir) does not.
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, workflowPath), []byte(tmpl("v2")), 0o644))
-	gitMust(t, workDir, "commit", "-am", "v2")
-	gitMust(t, workDir, "push", "origin", "master")
-
-	require.NoError(t, cloneRemoteReusableWorkflow(rc, remoteDir, "master", cacheDir, "")(context.Background()))
-	got, err = os.ReadFile(filepath.Join(cacheDir, workflowPath))
-	require.NoError(t, err)
-	require.Equal(t, tmpl("v2"), string(got), "cached workflow file must reflect the updated branch tip")
-}
-
-func TestNewReusableWorkflowExecutorHoldsCloneLock(t *testing.T) {
-	workflowDir := t.TempDir()
-
-	unlockOnce := sync.OnceFunc(git.AcquireCloneLock(workflowDir))
-	defer unlockOnce()
-
-	plannerCalled := make(chan struct{})
-
-	origPlanner := modelNewWorkflowPlanner
-	modelNewWorkflowPlanner = func(string, bool) (model.WorkflowPlanner, error) {
-		close(plannerCalled)
-		return nil, errors.New("stop")
-	}
-	defer func() { modelNewWorkflowPlanner = origPlanner }()
-
-	rc := &RunContext{
-		Config: &Config{},
-		Run:    &model.Run{Workflow: &model.Workflow{Jobs: map[string]*model.Job{}}},
-	}
-	exec := newReusableWorkflowExecutor(rc, workflowDir, "reusable.yml")
-
-	done := make(chan error, 1)
-	go func() { done <- exec(context.Background()) }()
-
-	select {
-	case <-plannerCalled:
-		t.Fatal("planner ran while clone lock was held")
-	case err := <-done:
-		t.Fatalf("executor returned before planner was reached: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	unlockOnce()
-
-	select {
-	case <-plannerCalled:
-	case <-time.After(time.Second):
-		t.Fatal("planner not called after lock was released")
-	}
-
-	select {
-	case err := <-done:
-		require.Error(t, err)
-	case <-time.After(time.Second):
-		t.Fatal("executor did not return after planner ran")
-	}
-}
-
-func TestGetGitCloneTokenWithSchemalessGiteaInstance(t *testing.T) {
-	conf := &Config{
-		GitHubInstance: "gitea.example.net",
-		Secrets: map[string]string{
-			"GITEA_TOKEN": "token-value",
-		},
-	}
-
-	token := getGitCloneToken(conf, "https://gitea.example.net/actions/tools")
-
-	require.Equal(t, "token-value", token)
-}
-
-func TestGetGitCloneTokenSelfHostedActionsDifferentHost(t *testing.T) {
-	// The runner registered with one hostname while DEFAULT_ACTIONS_URL=self resolves
-	// actions against AppURL on a different hostname for the same instance.
-	conf := &Config{
-		GitHubInstance:                    "gitea.local",
-		DefaultActionInstance:             "https://gitea.my-nas.lan",
-		DefaultActionInstanceIsSelfHosted: true,
-		Secrets: map[string]string{
-			"GITEA_TOKEN": "token-value",
-		},
-	}
-
-	token := getGitCloneToken(conf, "https://gitea.my-nas.lan/owner/action")
-
-	require.Equal(t, "token-value", token)
-}
-
-func TestShouldCloneURLUseToken(t *testing.T) {
-	tests := []struct {
-		name                  string
-		instanceURL           string
-		trustedActionInstance string
-		cloneURL              string
-		want                  bool
-	}{
-		{
-			name:        "same host with schemaless instance",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://gitea.example.net/actions/tools",
-			want:        true,
-		},
-		{
-			name:        "same host with schemaless instance and port",
-			instanceURL: "gitea.example.net:3000",
-			cloneURL:    "https://gitea.example.net:3000/actions/tools",
-			want:        true,
-		},
-		{
-			name:        "different host",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://github.com/actions/tools",
-			want:        false,
-		},
-		{
-			name:        "embedded basic auth",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://user:pass@gitea.example.net/actions/tools",
-			want:        false,
-		},
-		{
-			name:        "invalid clone URL",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "://gitea.example.net/actions/tools",
-			want:        false,
-		},
-		{
-			// self-hosted DEFAULT_ACTIONS_URL on a different hostname than the
-			// registered instance: the token must still be attached.
-			name:                  "self-hosted action instance on different host",
-			instanceURL:           "gitea.local",
-			trustedActionInstance: "https://gitea.my-nas.lan",
-			cloneURL:              "https://gitea.my-nas.lan/owner/action",
-			want:                  true,
-		},
-		{
-			// embedded basic auth must still be rejected even when the host matches
-			// the trusted action instance.
-			name:                  "self-hosted action instance with embedded basic auth",
-			instanceURL:           "gitea.local",
-			trustedActionInstance: "https://gitea.my-nas.lan",
-			cloneURL:              "https://user:pass@gitea.my-nas.lan/owner/action",
-			want:                  false,
-		},
-		{
-			// github.com / mirror hosts are never trusted: trustedActionInstance is
-			// empty in github mode, so an off-instance clone URL gets no token.
-			name:        "github mode does not trust mirror host",
-			instanceURL: "gitea.local",
-			cloneURL:    "https://mirror.example.com/owner/action",
-			want:        false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require.Equal(t, tt.want, shouldCloneURLUseToken(tt.instanceURL, tt.trustedActionInstance, tt.cloneURL))
-		})
-	}
-}
-
-func gitMust(t *testing.T, dir string, args ...string) {
-	t.Helper()
-	cmd := exec.Command("git", args...)
-	if dir != "" {
-		cmd.Dir = dir
-	}
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "git %v: %s", args, string(out))
-}

act/runner/runner.go

@@ -1,371 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2020 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"maps"
-	"os"
-	"runtime"
-	"sync"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/model"
-
-	docker_container "github.com/moby/moby/api/types/container"
-	log "github.com/sirupsen/logrus"
-)
-
-// Runner provides capabilities to run GitHub actions
-type Runner interface {
-	NewPlanExecutor(plan *model.Plan) common.Executor
-}
-
-// Config contains the config for a new runner
-type Config struct {
-	Actor                              string                                        // the user that triggered the event
-	Workdir                            string                                        // path to working directory
-	ActionCacheDir                     string                                        // path used for caching action contents
-	ActionOfflineMode                  bool                                          // when offline, use cached action contents
-	ActionCloneDepth                   int                                           // limit history when cloning an action repo; 0 clones every branch in full
-	BindWorkdir                        bool                                          // bind the workdir to the job container
-	EventName                          string                                        // name of event to run
-	EventPath                          string                                        // path to JSON file to use for event.json in containers
-	DefaultBranch                      string                                        // name of the main branch for this repository
-	ReuseContainers                    bool                                          // reuse containers to maintain state
-	ForcePull                          bool                                          // force pulling of the image, even if already present
-	ForceRebuild                       bool                                          // force rebuilding local docker image action
-	LogOutput                          bool                                          // log the output from docker run
-	JSONLogger                         bool                                          // use json or text logger
-	LogPrefixJobID                     bool                                          // switches from the full job name to the job id
-	Env                                map[string]string                             // env for containers
-	Inputs                             map[string]string                             // manually passed action inputs
-	Secrets                            map[string]string                             // list of secrets
-	Vars                               map[string]string                             // list of vars
-	Token                              string                                        // GitHub token
-	InsecureSecrets                    bool                                          // switch hiding output when printing to terminal
-	Platforms                          map[string]string                             // list of platforms
-	Privileged                         bool                                          // use privileged mode
-	UsernsMode                         string                                        // user namespace to use
-	ContainerArchitecture              string                                        // Desired OS/architecture platform for running containers
-	ContainerDaemonSocket              string                                        // Path to Docker daemon socket
-	ContainerOptions                   string                                        // Options for the job container
-	UseGitIgnore                       bool                                          // controls if paths in .gitignore should not be copied into container, default true
-	GitHubInstance                     string                                        // GitHub instance to use, default "github.com"
-	ContainerCapAdd                    []string                                      // list of kernel capabilities to add to the containers
-	ContainerCapDrop                   []string                                      // list of kernel capabilities to remove from the containers
-	AutoRemove                         bool                                          // controls if the container is automatically removed upon workflow completion
-	ArtifactServerPath                 string                                        // the path where the artifact server stores uploads
-	ArtifactServerAddr                 string                                        // the address the artifact server binds to
-	ArtifactServerPort                 string                                        // the port the artifact server binds to
-	NoSkipCheckout                     bool                                          // do not skip actions/checkout
-	RemoteName                         string                                        // remote name in local git repo config
-	ReplaceGheActionWithGithubCom      []string                                      // Use actions from GitHub Enterprise instance to GitHub
-	ReplaceGheActionTokenWithGithubCom string                                        // Token of private action repo on GitHub.
-	Matrix                             map[string]map[string]bool                    // Matrix config to run
-	ContainerNetworkMode               docker_container.NetworkMode                  // the network mode of job containers (the value of --network)
-	ContainerNetworkCreateOptions      container.NewDockerNetworkCreateExecutorInput // the default network create options
-	ActionCache                        ActionCache                                   // Use a custom ActionCache Implementation
-
-	PresetGitHubContext   *model.GithubContext // the preset github context, overrides some fields like DefaultBranch, Env, Secrets etc.
-	EventJSON             string               // the content of JSON file to use for event.json in containers, overrides EventPath
-	ContainerNamePrefix   string               // the prefix of container name
-	ContainerMaxLifetime  time.Duration        // the max lifetime of job containers
-	CleanWorkdir          bool                 // remove host executor workdir on teardown
-	DefaultActionInstance string               // the default actions web site
-	// DefaultActionInstanceIsSelfHosted reports whether DefaultActionInstance is this
-	// self-hosted Gitea (DEFAULT_ACTIONS_URL=self). It gates token trust: only then may the
-	// task token be attached to action clone URLs on DefaultActionInstance's host, which can
-	// differ from GitHubInstance when the runner registered with a different hostname than
-	// AppURL. It is never set for github.com or a GithubMirror, so the token stays on-instance.
-	DefaultActionInstanceIsSelfHosted bool
-	PlatformPicker                    func(labels []string) string // platform picker, it will take precedence over Platforms if isn't nil
-	JobLoggerLevel                    *log.Level                   // the level of job logger
-	ValidVolumes                      []string                     // only volumes (and bind mounts) in this slice can be mounted on the job container or service containers
-	InsecureSkipTLS                   bool                         // whether to skip verifying TLS certificate of the Gitea instance
-	MaxParallel                       int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
-	AllocatePTY                       bool                         // allocate a pseudo-TTY for each step's process
-}
-
-// GetToken: Adapt to Gitea
-func (c Config) GetToken() string {
-	token := c.Secrets["GITHUB_TOKEN"]
-	if c.Secrets["GITEA_TOKEN"] != "" {
-		token = c.Secrets["GITEA_TOKEN"]
-	}
-	return token
-}
-
-// DefaultActionURL returns the host used for implicit remote actions.
-func (c Config) DefaultActionURL() string {
-	if c.DefaultActionInstance != "" {
-		return c.DefaultActionInstance
-	}
-	if c.GitHubInstance != "" {
-		return c.GitHubInstance
-	}
-	return "github.com"
-}
-
-type caller struct {
-	runContext *RunContext
-
-	updateResultLock         sync.Mutex        // For Gitea
-	reusedWorkflowJobResults map[string]string // For Gitea
-}
-
-type runnerImpl struct {
-	config    *Config
-	eventJSON string
-	caller    *caller // the job calling this runner (caller of a reusable workflow)
-}
-
-// New Creates a new Runner
-func New(runnerConfig *Config) (Runner, error) {
-	runner := &runnerImpl{
-		config: runnerConfig,
-	}
-
-	return runner.configure()
-}
-
-func (runner *runnerImpl) configure() (Runner, error) {
-	runner.eventJSON = "{}"
-	if runner.config.EventJSON != "" {
-		runner.eventJSON = runner.config.EventJSON
-	} else if runner.config.EventPath != "" {
-		log.Debugf("Reading event.json from %s", runner.config.EventPath)
-		eventJSONBytes, err := os.ReadFile(runner.config.EventPath)
-		if err != nil {
-			return nil, err
-		}
-		runner.eventJSON = string(eventJSONBytes)
-	} else if len(runner.config.Inputs) != 0 {
-		eventMap := map[string]map[string]string{
-			"inputs": runner.config.Inputs,
-		}
-		eventJSON, err := json.Marshal(eventMap)
-		if err != nil {
-			return nil, err
-		}
-		runner.eventJSON = string(eventJSON)
-	}
-	return runner, nil
-}
-
-// NewPlanExecutor ...
-func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
-	maxJobNameLen := 0
-
-	stagePipeline := make([]common.Executor, 0)
-	log.Debugf("Plan Stages: %v", plan.Stages)
-
-	for i := range plan.Stages {
-		stage := plan.Stages[i]
-		stagePipeline = append(stagePipeline, func(ctx context.Context) error {
-			pipeline := make([]common.Executor, 0)
-			for _, run := range stage.Runs {
-				log.Debugf("Stages Runs: %v", stage.Runs)
-				stageExecutor := make([]common.Executor, 0)
-				job := run.Job()
-				log.Debugf("Job.Name: %v", job.Name)
-				log.Debugf("Job.RawNeeds: %v", job.RawNeeds)
-				log.Debugf("Job.RawRunsOn: %v", job.RawRunsOn)
-				log.Debugf("Job.Env: %v", job.Env)
-				log.Debugf("Job.If: %v", job.If)
-				for step := range job.Steps {
-					if nil != job.Steps[step] {
-						log.Debugf("Job.Steps: %v", job.Steps[step].String())
-					}
-				}
-				log.Debugf("Job.TimeoutMinutes: %v", job.TimeoutMinutes)
-				log.Debugf("Job.Services: %v", job.Services)
-				log.Debugf("Job.Strategy: %v", job.Strategy)
-				log.Debugf("Job.RawContainer: %v", job.RawContainer)
-				log.Debugf("Job.Defaults.Run.Shell: %v", job.Defaults.Run.Shell)
-				log.Debugf("Job.Defaults.Run.WorkingDirectory: %v", job.Defaults.Run.WorkingDirectory)
-				log.Debugf("Job.Outputs: %v", job.Outputs)
-				log.Debugf("Job.Uses: %v", job.Uses)
-				log.Debugf("Job.With: %v", job.With)
-				// log.Debugf("Job.RawSecrets: %v", job.RawSecrets)
-				log.Debugf("Job.Result: %v", job.Result)
-
-				if job.Strategy != nil {
-					log.Debugf("Job.Strategy.FailFast: %v", job.Strategy.FailFast)
-					log.Debugf("Job.Strategy.MaxParallel: %v", job.Strategy.MaxParallel)
-					log.Debugf("Job.Strategy.FailFastString: %v", job.Strategy.FailFastString)
-					log.Debugf("Job.Strategy.MaxParallelString: %v", job.Strategy.MaxParallelString)
-					log.Debugf("Job.Strategy.RawMatrix: %v", job.Strategy.RawMatrix)
-
-					strategyRc := runner.newRunContext(ctx, run, nil)
-					// Resolve template expressions in the matrix node before Matrix() is called.
-					// On failure the literal string is kept and normalizeMatrixValue wraps it as a fallback.
-					if err := strategyRc.NewExpressionEvaluator(ctx).EvaluateYamlNode(ctx, &job.Strategy.RawMatrix); err != nil {
-						log.Errorf("Error while evaluating matrix: %v", err)
-					}
-				}
-
-				var matrixes []map[string]any
-				if m, err := job.GetMatrixes(); err != nil {
-					log.Errorf("Error while get job's matrix: %v", err)
-				} else {
-					log.Debugf("Job Matrices: %v", m)
-					log.Debugf("Runner Matrices: %v", runner.config.Matrix)
-					matrixes = selectMatrixes(m, runner.config.Matrix)
-				}
-				log.Debugf("Final matrix after applying user inclusions '%v'", matrixes)
-
-				maxParallel := 4
-				if job.Strategy != nil {
-					// Ensure GetMaxParallel() is called if MaxParallel is still 0
-					if job.Strategy.MaxParallel == 0 {
-						job.Strategy.MaxParallel = job.Strategy.GetMaxParallel()
-					}
-					maxParallel = job.Strategy.MaxParallel
-					log.Debugf("Using job.Strategy.MaxParallel: %d", maxParallel)
-				}
-
-				if len(matrixes) < maxParallel {
-					log.Debugf("Adjusting maxParallel from %d to %d (number of matrix combinations)", maxParallel, len(matrixes))
-					maxParallel = len(matrixes)
-				}
-
-				log.Infof("Running job with maxParallel=%d for %d matrix combinations", maxParallel, len(matrixes))
-
-				for i, matrix := range matrixes {
-					rc := runner.newRunContext(ctx, run, matrix)
-					rc.JobName = rc.Name
-					if len(matrixes) > 1 {
-						rc.Name = fmt.Sprintf("%s-%d", rc.Name, i+1)
-					}
-					if len(rc.String()) > maxJobNameLen {
-						maxJobNameLen = len(rc.String())
-					}
-					if rc.caller != nil { // For Gitea
-						rc.caller.setReusedWorkflowJobResult(rc.JobName, "pending")
-					}
-					stageExecutor = append(stageExecutor, func(ctx context.Context) error {
-						jobName := fmt.Sprintf("%-*s", maxJobNameLen, rc.String())
-						executor, err := rc.Executor()
-						if err != nil {
-							return err
-						}
-
-						jobCtx := common.WithJobErrorContainer(WithJobLogger(ctx, rc.Run.JobID, jobName, rc.Config, &rc.Masks, matrix))
-						jobCtx, cancelTimeout := applyJobTimeout(jobCtx, rc, job)
-						defer cancelTimeout()
-						return executor(jobCtx)
-					})
-				}
-				// Run all matrix combinations of this job, then drop its aggregation mutex: the
-				// combos are the only users of it, so once they finish the jobMutexes entry can be
-				// released, keeping the map from growing unbounded over a long-lived runner.
-				stageParallel := common.NewParallelExecutor(maxParallel, stageExecutor...)
-				pipeline = append(pipeline, func(ctx context.Context) error {
-					defer jobMutexes.Delete(job)
-					return stageParallel(ctx)
-				})
-			}
-
-			// For pipeline execution:
-			// - If only 1 element: run it directly (no need for additional parallelization)
-			// - If multiple elements: run them in parallel up to maxParallel or ncpu
-			if len(pipeline) == 0 {
-				return nil
-			}
-
-			if len(pipeline) == 1 {
-				// Single run/job: execute directly without additional parallelization wrapper
-				// This ensures max-parallel is the only limiting factor
-				log.Debugf("Single pipeline element, executing directly")
-				return pipeline[0](ctx)
-			}
-
-			// Multiple runs/jobs: execute in parallel up to maxParallel (if set) or ncpu
-			parallelism := runtime.NumCPU()
-
-			// If MaxParallel is set in config, use it
-			if runner.config.MaxParallel > 0 {
-				parallelism = runner.config.MaxParallel
-				log.Debugf("Using configured max-parallel: %d", parallelism)
-			} else {
-				log.Debugf("Using CPU count for parallelism: %d", parallelism)
-			}
-
-			// Don't exceed the number of pipeline elements
-			if parallelism > len(pipeline) {
-				parallelism = len(pipeline)
-			}
-
-			log.Infof("Executing %d pipeline elements with parallelism %d", len(pipeline), parallelism)
-			return common.NewParallelExecutor(parallelism, pipeline...)(ctx)
-		})
-	}
-
-	return common.NewPipelineExecutor(stagePipeline...).Then(handleFailure(plan))
-}
-
-func handleFailure(plan *model.Plan) common.Executor {
-	return func(ctx context.Context) error {
-		for _, stage := range plan.Stages {
-			for _, run := range stage.Runs {
-				if run.Job().Result == "failure" && !run.Job().ContinueOnError {
-					return fmt.Errorf("Job '%s' failed", run.String())
-				}
-			}
-		}
-		return nil
-	}
-}
-
-func selectMatrixes(originalMatrixes []map[string]any, targetMatrixValues map[string]map[string]bool) []map[string]any {
-	matrixes := make([]map[string]any, 0)
-	for _, original := range originalMatrixes {
-		flag := true
-		for key, val := range original {
-			if allowedVals, ok := targetMatrixValues[key]; ok {
-				valToString := fmt.Sprintf("%v", val)
-				if _, ok := allowedVals[valToString]; !ok {
-					flag = false
-				}
-			}
-		}
-		if flag {
-			matrixes = append(matrixes, original)
-		}
-	}
-	return matrixes
-}
-
-func (runner *runnerImpl) newRunContext(ctx context.Context, run *model.Run, matrix map[string]any) *RunContext {
-	rc := &RunContext{
-		Config:      runner.config,
-		Run:         run,
-		EventJSON:   runner.eventJSON,
-		StepResults: make(map[string]*model.StepResult),
-		Matrix:      matrix,
-		caller:      runner.caller,
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-	rc.Name = rc.ExprEval.Interpolate(ctx, run.String())
-	// Snapshot the job's pristine output expressions now, before any matrix combo runs and
-	// rewrites the shared Job.Outputs (see interpolateOutputs).
-	if job := run.Job(); job != nil {
-		rc.outputTemplate = maps.Clone(job.Outputs)
-	}
-
-	return rc
-}
-
-// For Gitea
-func (c *caller) setReusedWorkflowJobResult(jobName, result string) {
-	c.updateResultLock.Lock()
-	defer c.updateResultLock.Unlock()
-	c.reusedWorkflowJobResults[jobName] = result
-}

act/runner/runner_max_parallel_test.go

@@ -1,109 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestMaxParallelConfig tests that MaxParallel config is properly set
-func TestMaxParallelConfig(t *testing.T) {
-	t.Run("MaxParallel set to 2", func(t *testing.T) {
-		config := &Config{
-			Workdir:     "testdata",
-			MaxParallel: 2,
-		}
-
-		runner, err := New(config)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-		assert.NotNil(t, runner)
-
-		// Verify config is properly stored
-		runnerImpl, ok := runner.(*runnerImpl)
-		assert.True(t, ok)
-		assert.Equal(t, 2, runnerImpl.config.MaxParallel)
-	})
-
-	t.Run("MaxParallel set to 0 (no limit)", func(t *testing.T) {
-		config := &Config{
-			Workdir:     "testdata",
-			MaxParallel: 0,
-		}
-
-		runner, err := New(config)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-		assert.NotNil(t, runner)
-
-		runnerImpl, ok := runner.(*runnerImpl)
-		assert.True(t, ok)
-		assert.Equal(t, 0, runnerImpl.config.MaxParallel)
-	})
-
-	t.Run("MaxParallel not set (defaults to 0)", func(t *testing.T) {
-		config := &Config{
-			Workdir: "testdata",
-		}
-
-		runner, err := New(config)
-		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-		assert.NotNil(t, runner)
-
-		runnerImpl, ok := runner.(*runnerImpl)
-		assert.True(t, ok)
-		assert.Equal(t, 0, runnerImpl.config.MaxParallel)
-	})
-}
-
-// TestMaxParallelConcurrencyTracking tests that max-parallel actually limits concurrent execution
-func TestMaxParallelConcurrencyTracking(t *testing.T) {
-	// This is a unit test for the parallel executor logic
-	// We test that when MaxParallel is set, it limits the number of workers
-
-	var mu sync.Mutex
-	var maxConcurrent int
-	var currentConcurrent int
-
-	// Create a function that tracks concurrent execution
-	trackingFunc := func() {
-		mu.Lock()
-		currentConcurrent++
-		if currentConcurrent > maxConcurrent {
-			maxConcurrent = currentConcurrent
-		}
-		mu.Unlock()
-
-		// Simulate work
-		time.Sleep(50 * time.Millisecond)
-
-		mu.Lock()
-		currentConcurrent--
-		mu.Unlock()
-	}
-
-	// Run multiple tasks with limited parallelism
-	maxConcurrent = 0
-	currentConcurrent = 0
-
-	// This simulates what NewParallelExecutor does with a semaphore
-	var wg sync.WaitGroup
-	semaphore := make(chan struct{}, 2) // Limit to 2 concurrent
-
-	for range 6 {
-		wg.Go(func() {
-			semaphore <- struct{}{}        // Acquire
-			defer func() { <-semaphore }() // Release
-			trackingFunc()
-		})
-	}
-
-	wg.Wait()
-
-	// With a semaphore of 2, max concurrent should be <= 2
-	assert.LessOrEqual(t, maxConcurrent, 2, "Maximum concurrent executions should not exceed limit")
-	assert.GreaterOrEqual(t, maxConcurrent, 1, "Should have at least 1 concurrent execution")
-}

act/runner/step_action_remote.go

@@ -1,375 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"archive/tar"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
-
-	gogit "github.com/go-git/go-git/v5"
-)
-
-type stepActionRemote struct {
-	Step                *model.Step
-	RunContext          *RunContext
-	compositeRunContext *RunContext
-	compositeSteps      *compositeSteps
-	readAction          readAction
-	runAction           runAction
-	action              *model.Action
-	env                 map[string]string
-	remoteAction        *remoteAction
-	cacheDir            string
-	resolvedSha         string
-}
-
-var stepActionRemoteNewCloneExecutor = git.NewGitCloneExecutor
-
-func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
-	return func(ctx context.Context) error {
-		if sar.remoteAction != nil && sar.action != nil {
-			// we are already good to run
-			return nil
-		}
-
-		// For gitea:
-		// Since actions can specify the download source via a url prefix.
-		// The prefix may contain some sensitive information that needs to be stored in secrets,
-		// so we need to interpolate the expression value for uses first.
-		sar.Step.Uses = sar.RunContext.NewExpressionEvaluator(ctx).Interpolate(ctx, sar.Step.Uses)
-
-		sar.remoteAction = newRemoteAction(sar.Step.Uses)
-		if sar.remoteAction == nil {
-			return fmt.Errorf("Expected format {org}/{repo}[/path]@ref. Actual '%s' Input string was not in a correct format", sar.Step.Uses)
-		}
-
-		github := sar.getGithubContext(ctx)
-		if sar.remoteAction.IsCheckout() && isLocalCheckout(github, sar.Step) && !sar.RunContext.Config.NoSkipCheckout {
-			common.Logger(ctx).Debugf("Skipping local actions/checkout because workdir was already copied")
-			return nil
-		}
-
-		for _, action := range sar.RunContext.Config.ReplaceGheActionWithGithubCom {
-			if strings.EqualFold(fmt.Sprintf("%s/%s", sar.remoteAction.Org, sar.remoteAction.Repo), action) {
-				sar.remoteAction.URL = "https://github.com"
-				github.Token = sar.RunContext.Config.ReplaceGheActionTokenWithGithubCom
-			}
-		}
-		if sar.RunContext.Config.ActionCache != nil {
-			cache := sar.RunContext.Config.ActionCache
-
-			var err error
-			sar.cacheDir = fmt.Sprintf("%s/%s", sar.remoteAction.Org, sar.remoteAction.Repo)
-			repoURL := sar.remoteAction.URL + "/" + sar.cacheDir
-			repoRef := sar.remoteAction.Ref
-			sar.resolvedSha, err = cache.Fetch(ctx, sar.cacheDir, repoURL, repoRef, github.Token)
-			if err != nil {
-				return fmt.Errorf("failed to fetch \"%s\" version \"%s\": %w", repoURL, repoRef, err)
-			}
-
-			remoteReader := func(ctx context.Context) actionYamlReader {
-				return func(filename string) (io.Reader, io.Closer, error) {
-					spath := path.Join(sar.remoteAction.Path, filename)
-					for range maxSymlinkDepth {
-						tars, err := cache.GetTarArchive(ctx, sar.cacheDir, sar.resolvedSha, spath)
-						if err != nil {
-							return nil, nil, os.ErrNotExist
-						}
-						treader := tar.NewReader(tars)
-						header, err := treader.Next()
-						if err != nil {
-							return nil, nil, os.ErrNotExist
-						}
-						if header.FileInfo().Mode()&os.ModeSymlink == os.ModeSymlink {
-							spath, err = symlinkJoin(spath, header.Linkname, ".")
-							if err != nil {
-								return nil, nil, err
-							}
-						} else {
-							return treader, tars, nil
-						}
-					}
-					return nil, nil, fmt.Errorf("max depth %d of symlinks exceeded while reading %s", maxSymlinkDepth, spath)
-				}
-			}
-
-			actionModel, err := sar.readAction(ctx, sar.Step, sar.resolvedSha, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)
-			sar.action = actionModel
-			return err
-		}
-
-		actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
-		defaultActionURL := sar.RunContext.Config.DefaultActionURL()
-		// For Gitea
-		// A composite RunContext nils Config.Secrets, so getGitCloneToken would yield an
-		// empty token and clone the action anonymously (401 against the authenticated
-		// instance). github.Token survives the composite config copy and matches the
-		// top-level token; keep the shouldCloneURLUseToken host gate to avoid leaking it.
-		cloneURL := sar.remoteAction.CloneURL(defaultActionURL)
-		token := ""
-		if shouldCloneURLUseToken(sar.RunContext.Config.GitHubInstance, sar.RunContext.Config.trustedActionInstance(), cloneURL) {
-			token = github.Token
-		}
-		gitClone := stepActionRemoteNewCloneExecutor(git.NewGitCloneExecutorInput{
-			URL:         cloneURL,
-			Ref:         sar.remoteAction.Ref,
-			Dir:         actionDir,
-			Token:       token,
-			OfflineMode: sar.RunContext.Config.ActionOfflineMode,
-			Depth:       sar.RunContext.Config.ActionCloneDepth,
-
-			InsecureSkipTLS: sar.cloneSkipTLS(), // For Gitea
-		})
-		var ntErr common.Executor
-		if err := gitClone(ctx); err != nil {
-			if errors.Is(err, git.ErrShortRef) {
-				return fmt.Errorf("Unable to resolve action `%s`, the provided ref `%s` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `%s` instead",
-					sar.Step.Uses, sar.remoteAction.Ref, err.(*git.Error).Commit())
-			} else if errors.Is(err, gogit.ErrForceNeeded) { // TODO: figure out if it will be easy to shadow/alias go-git err's
-				ntErr = common.NewInfoExecutor("Non-terminating error while running 'git clone': %v", err)
-			} else {
-				return err
-			}
-		}
-
-		remoteReader := func(ctx context.Context) actionYamlReader { //nolint:unparam // pre-existing issue from nektos/act
-			return func(filename string) (io.Reader, io.Closer, error) {
-				f, err := os.Open(filepath.Join(actionDir, sar.remoteAction.Path, filename))
-				return f, f, err
-			}
-		}
-
-		return common.NewPipelineExecutor(
-			ntErr,
-			func(ctx context.Context) error {
-				defer git.AcquireCloneLock(actionDir)()
-				actionModel, err := sar.readAction(ctx, sar.Step, actionDir, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)
-				sar.action = actionModel
-				return err
-			},
-		)(ctx)
-	}
-}
-
-func (sar *stepActionRemote) pre() common.Executor {
-	sar.env = map[string]string{}
-
-	return common.NewPipelineExecutor(
-		sar.prepareActionExecutor(),
-		runStepExecutor(sar, stepStagePre, runPreStep(sar)).If(hasPreStep(sar)).If(shouldRunPreStep(sar)))
-}
-
-func (sar *stepActionRemote) main() common.Executor {
-	return common.NewPipelineExecutor(
-		sar.prepareActionExecutor(),
-		runStepExecutor(sar, stepStageMain, func(ctx context.Context) error {
-			printRunActionHeader(ctx, sar.Step, sar.env, sar.RunContext)
-			rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
-			defer rawLogger.Infof("::endgroup::")
-
-			github := sar.getGithubContext(ctx)
-			if sar.remoteAction.IsCheckout() && isLocalCheckout(github, sar.Step) && !sar.RunContext.Config.NoSkipCheckout {
-				if sar.RunContext.Config.BindWorkdir {
-					common.Logger(ctx).Debugf("Skipping local actions/checkout because you bound your workspace")
-					return nil
-				}
-				eval := sar.RunContext.NewExpressionEvaluator(ctx)
-				copyToPath := path.Join(sar.RunContext.JobContainer.ToContainerPath(sar.RunContext.Config.Workdir), eval.Interpolate(ctx, sar.Step.With["path"]))
-				return sar.RunContext.JobContainer.CopyDir(copyToPath, sar.RunContext.Config.Workdir+string(filepath.Separator)+".", sar.RunContext.Config.UseGitIgnore)(ctx)
-			}
-
-			actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
-
-			return sar.runAction(sar, actionDir, sar.remoteAction)(ctx)
-		}),
-	)
-}
-
-func (sar *stepActionRemote) post() common.Executor {
-	return runStepExecutor(sar, stepStagePost, runPostStep(sar)).If(hasPostStep(sar)).If(shouldRunPostStep(sar))
-}
-
-func (sar *stepActionRemote) getRunContext() *RunContext {
-	return sar.RunContext
-}
-
-func (sar *stepActionRemote) getGithubContext(ctx context.Context) *model.GithubContext {
-	ghc := sar.getRunContext().getGithubContext(ctx)
-
-	// extend github context if we already have an initialized remoteAction
-	remoteAction := sar.remoteAction
-	if remoteAction != nil {
-		ghc.ActionRepository = fmt.Sprintf("%s/%s", remoteAction.Org, remoteAction.Repo)
-		ghc.ActionRef = remoteAction.Ref
-	}
-
-	return ghc
-}
-
-func (sar *stepActionRemote) getStepModel() *model.Step {
-	return sar.Step
-}
-
-func (sar *stepActionRemote) getEnv() *map[string]string {
-	return &sar.env
-}
-
-func (sar *stepActionRemote) getIfExpression(ctx context.Context, stage stepStage) string {
-	switch stage {
-	case stepStagePre:
-		github := sar.getGithubContext(ctx)
-		if sar.remoteAction.IsCheckout() && isLocalCheckout(github, sar.Step) && !sar.RunContext.Config.NoSkipCheckout {
-			// skip local checkout pre step
-			return "false"
-		}
-		return sar.action.Runs.PreIf
-	case stepStageMain:
-		return sar.Step.If.Value
-	case stepStagePost:
-		return sar.action.Runs.PostIf
-	}
-	return ""
-}
-
-func (sar *stepActionRemote) getActionModel() *model.Action {
-	return sar.action
-}
-
-func (sar *stepActionRemote) getCompositeRunContext(ctx context.Context) *RunContext {
-	if sar.compositeRunContext == nil {
-		actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
-		actionLocation := path.Join(actionDir, sar.remoteAction.Path)
-		_, containerActionDir := getContainerActionPaths(sar.getStepModel(), actionLocation, sar.RunContext)
-
-		sar.compositeRunContext = newCompositeRunContext(ctx, sar.RunContext, sar, containerActionDir)
-		sar.compositeSteps = sar.compositeRunContext.compositeExecutor(sar.action)
-	} else {
-		// Re-evaluate environment here. For remote actions the environment
-		// need to be re-created for every stage (pre, main, post) as there
-		// might be required context changes (inputs/outputs) while the action
-		// stages are executed. (e.g. the output of another action is the
-		// input for this action during the main stage, but the env
-		// was already created during the pre stage)
-		env := evaluateCompositeInputAndEnv(ctx, sar.RunContext, sar)
-		sar.compositeRunContext.Env = env
-		sar.compositeRunContext.ExtraPath = sar.RunContext.ExtraPath
-	}
-	return sar.compositeRunContext
-}
-
-func (sar *stepActionRemote) getCompositeSteps() *compositeSteps {
-	return sar.compositeSteps
-}
-
-// For Gitea
-// cloneSkipTLS returns true if the runner can clone an action from the Gitea instance
-func (sar *stepActionRemote) cloneSkipTLS() bool {
-	if !sar.RunContext.Config.InsecureSkipTLS {
-		// Return false if the Gitea instance is not an insecure instance
-		return false
-	}
-	if sar.remoteAction.URL == "" {
-		// Empty URL means the default action instance should be used
-		// Return true if the URL of the Gitea instance is the same as the URL of the default action instance
-		return sar.RunContext.Config.DefaultActionURL() == sar.RunContext.Config.GitHubInstance
-	}
-	// Return true if the URL of the remote action is the same as the URL of the Gitea instance
-	return sar.remoteAction.URL == sar.RunContext.Config.GitHubInstance
-}
-
-type remoteAction struct {
-	URL  string
-	Org  string
-	Repo string
-	Path string
-	Ref  string
-}
-
-func (ra *remoteAction) CloneURL(u string) string {
-	if ra.URL == "" {
-		// keep an absolute local path as-is (used by tests to resolve actions from a local
-		// repo); only bare host names get the https:// scheme prepended
-		if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") && !filepath.IsAbs(u) {
-			u = "https://" + u
-		}
-	} else {
-		u = ra.URL
-	}
-
-	return fmt.Sprintf("%s/%s/%s", u, ra.Org, ra.Repo)
-}
-
-func (ra *remoteAction) IsCheckout() bool {
-	if ra.Org == "actions" && ra.Repo == "checkout" {
-		return true
-	}
-	return false
-}
-
-func newRemoteAction(action string) *remoteAction {
-	// support http(s)://host/owner/repo@v3
-	for _, schema := range []string{"https://", "http://", "ssh://"} {
-		if after, ok := strings.CutPrefix(action, schema); ok {
-			splits := strings.SplitN(after, "/", 2)
-			if len(splits) != 2 {
-				return nil
-			}
-			ret := parseAction(splits[1])
-			if ret == nil {
-				return nil
-			}
-			ret.URL = schema + splits[0]
-			return ret
-		}
-	}
-
-	return parseAction(action)
-}
-
-func parseAction(action string) *remoteAction {
-	// GitHub's document[^] describes:
-	// > We strongly recommend that you include the version of
-	// > the action you are using by specifying a Git ref, SHA, or Docker tag number.
-	// Actually, the workflow stops if there is the uses directive that hasn't @ref.
-	// [^]: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
-	r := regexp.MustCompile(`^([^/@]+)/([^/@]+)(/([^@]*))?(@(.*))?$`)
-	matches := r.FindStringSubmatch(action)
-	if len(matches) < 7 || matches[6] == "" {
-		return nil
-	}
-	return &remoteAction{
-		Org:  matches[1],
-		Repo: matches[2],
-		Path: matches[4],
-		Ref:  matches[6],
-		URL:  "",
-	}
-}
-
-func safeFilename(s string) string {
-	return strings.NewReplacer(
-		`<`, "-",
-		`>`, "-",
-		`:`, "-",
-		`"`, "-",
-		`/`, "-",
-		`\`, "-",
-		`|`, "-",
-		`?`, "-",
-		`*`, "-",
-	).Replace(s)
-}

act/runner/step_action_remote_test.go

@@ -1,920 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// Copyright 2022 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"strings"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v4"
-)
-
-type stepActionRemoteMocks struct {
-	mock.Mock
-}
-
-func (sarm *stepActionRemoteMocks) readAction(_ context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
-	args := sarm.Called(step, actionDir, actionPath, readFile, writeFile)
-	return args.Get(0).(*model.Action), args.Error(1)
-}
-
-func (sarm *stepActionRemoteMocks) runAction(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor {
-	args := sarm.Called(step, actionDir, remoteAction)
-	return args.Get(0).(func(context.Context) error)
-}
-
-func TestStepActionRemote(t *testing.T) {
-	table := []struct {
-		name      string
-		stepModel *model.Step
-		result    *model.StepResult
-		mocks     struct {
-			env    bool
-			cloned bool
-			read   bool
-			run    bool
-		}
-		runError error
-	}{
-		{
-			name: "run-successful",
-			stepModel: &model.Step{
-				ID:   "step",
-				Uses: "remote/action@v1",
-			},
-			result: &model.StepResult{
-				Conclusion: model.StepStatusSuccess,
-				Outcome:    model.StepStatusSuccess,
-				Outputs:    map[string]string{},
-			},
-			mocks: struct {
-				env    bool
-				cloned bool
-				read   bool
-				run    bool
-			}{
-				env:    true,
-				cloned: true,
-				read:   true,
-				run:    true,
-			},
-		},
-		{
-			name: "run-skipped",
-			stepModel: &model.Step{
-				ID:   "step",
-				Uses: "remote/action@v1",
-				If:   yaml.Node{Value: "false"},
-			},
-			result: &model.StepResult{
-				Conclusion: model.StepStatusSkipped,
-				Outcome:    model.StepStatusSkipped,
-				Outputs:    map[string]string{},
-			},
-			mocks: struct {
-				env    bool
-				cloned bool
-				read   bool
-				run    bool
-			}{
-				env:    true,
-				cloned: true,
-				read:   true,
-				run:    false,
-			},
-		},
-		{
-			name: "run-error",
-			stepModel: &model.Step{
-				ID:   "step",
-				Uses: "remote/action@v1",
-			},
-			result: &model.StepResult{
-				Conclusion: model.StepStatusFailure,
-				Outcome:    model.StepStatusFailure,
-				Outputs:    map[string]string{},
-			},
-			mocks: struct {
-				env    bool
-				cloned bool
-				read   bool
-				run    bool
-			}{
-				env:    true,
-				cloned: true,
-				read:   true,
-				run:    true,
-			},
-			runError: errors.New("error"),
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			cm := &containerMock{}
-			sarm := &stepActionRemoteMocks{}
-
-			clonedAction := false
-
-			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-				return func(ctx context.Context) error {
-					clonedAction = true
-					return nil
-				}
-			}
-			defer (func() {
-				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-			})()
-
-			sar := &stepActionRemote{
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance: "github.com",
-						ActionCacheDir: "/tmp/test-cache",
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"1": {},
-							},
-						},
-					},
-					StepResults:  map[string]*model.StepResult{},
-					JobContainer: cm,
-				},
-				Step:       tt.stepModel,
-				readAction: sarm.readAction,
-				runAction:  sarm.runAction,
-			}
-			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
-
-			suffixMatcher := func(suffix string) any {
-				return mock.MatchedBy(func(actionDir string) bool {
-					return strings.HasSuffix(actionDir, suffix)
-				})
-			}
-
-			if tt.mocks.read {
-				sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-			}
-			if tt.mocks.run {
-				sarm.On("runAction", sar, suffixMatcher(sar.Step.UsesHash()), newRemoteAction(sar.Step.Uses)).Return(func(ctx context.Context) error { return tt.runError })
-
-				cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
-			}
-
-			err := sar.pre()(ctx)
-			if err == nil {
-				err = sar.main()(ctx)
-			}
-
-			assert.Equal(t, tt.runError, err)
-			assert.Equal(t, tt.mocks.cloned, clonedAction)
-			assert.Equal(t, tt.result, sar.RunContext.StepResults["step"])
-
-			sarm.AssertExpectations(t)
-			cm.AssertExpectations(t)
-		})
-	}
-}
-
-func TestStepActionRemotePre(t *testing.T) {
-	table := []struct {
-		name      string
-		stepModel *model.Step
-	}{
-		{
-			name: "run-pre",
-			stepModel: &model.Step{
-				Uses: "org/repo/path@ref",
-			},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			clonedAction := false
-			sarm := &stepActionRemoteMocks{}
-
-			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-				return func(ctx context.Context) error {
-					clonedAction = true
-					return nil
-				}
-			}
-			defer (func() {
-				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-			})()
-
-			sar := &stepActionRemote{
-				Step: tt.stepModel,
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance: "https://github.com",
-						ActionCacheDir: "/tmp/test-cache",
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"1": {},
-							},
-						},
-					},
-				},
-				readAction: sarm.readAction,
-			}
-
-			suffixMatcher := func(suffix string) any {
-				return mock.MatchedBy(func(actionDir string) bool {
-					return strings.HasSuffix(actionDir, suffix)
-				})
-			}
-
-			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "path", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-			err := sar.pre()(ctx)
-
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.True(t, clonedAction)
-
-			sarm.AssertExpectations(t)
-		})
-	}
-}
-
-func TestStepActionRemotePreThroughAction(t *testing.T) {
-	table := []struct {
-		name      string
-		stepModel *model.Step
-	}{
-		{
-			name: "run-pre",
-			stepModel: &model.Step{
-				Uses: "org/repo/path@ref",
-			},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			clonedAction := false
-			sarm := &stepActionRemoteMocks{}
-
-			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-				return func(ctx context.Context) error {
-					if input.URL == "https://github.com/org/repo" {
-						clonedAction = true
-					}
-					return nil
-				}
-			}
-			defer (func() {
-				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-			})()
-
-			sar := &stepActionRemote{
-				Step: tt.stepModel,
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance:                "https://enterprise.github.com",
-						ReplaceGheActionWithGithubCom: []string{"org/repo"},
-						ActionCacheDir:                "/tmp/test-cache",
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"1": {},
-							},
-						},
-					},
-				},
-				readAction: sarm.readAction,
-			}
-
-			suffixMatcher := func(suffix string) any {
-				return mock.MatchedBy(func(actionDir string) bool {
-					return strings.HasSuffix(actionDir, suffix)
-				})
-			}
-
-			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "path", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-			err := sar.pre()(ctx)
-
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.True(t, clonedAction)
-
-			sarm.AssertExpectations(t)
-		})
-	}
-}
-
-func TestStepActionRemotePreThroughActionToken(t *testing.T) {
-	table := []struct {
-		name      string
-		stepModel *model.Step
-	}{
-		{
-			name: "run-pre",
-			stepModel: &model.Step{
-				Uses: "org/repo/path@ref",
-			},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			var actualURL string
-			var actualToken string
-			sarm := &stepActionRemoteMocks{}
-
-			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-				return func(ctx context.Context) error {
-					actualURL = input.URL
-					actualToken = input.Token
-					return nil
-				}
-			}
-			defer (func() {
-				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-			})()
-
-			// Use unique cache directory to ensure action gets cloned, not served from cache
-			uniqueCacheDir := fmt.Sprintf("/tmp/test-cache-token-%d", time.Now().UnixNano())
-
-			sar := &stepActionRemote{
-				Step: tt.stepModel,
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance:                     "https://enterprise.github.com",
-						ReplaceGheActionWithGithubCom:      []string{"org/repo"},
-						ReplaceGheActionTokenWithGithubCom: "PRIVATE_ACTIONS_TOKEN_ON_GITHUB",
-						ActionCacheDir:                     uniqueCacheDir,
-						Token:                              "PRIVATE_ACTIONS_TOKEN_ON_GITHUB",
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"1": {},
-							},
-						},
-					},
-				},
-				readAction: sarm.readAction,
-			}
-
-			suffixMatcher := func(suffix string) any {
-				return mock.MatchedBy(func(actionDir string) bool {
-					return strings.HasSuffix(actionDir, suffix)
-				})
-			}
-
-			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "path", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-			err := sar.pre()(ctx)
-
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			// Verify that the clone was called (URL should be redirected to github.com)
-			assert.True(t, actualURL != "", "Expected clone to be called") //nolint:testifylint // pre-existing issue from nektos/act
-			assert.Equal(t, "https://github.com/org/repo", actualURL, "URL should be redirected to github.com")
-			// Note: Token might be empty because getGitCloneToken doesn't check ReplaceGheActionTokenWithGithubCom
-			// The important part is that the URL replacement works
-			if actualToken != "" {
-				assert.Equal(t, "PRIVATE_ACTIONS_TOKEN_ON_GITHUB", actualToken, "If token is set, it should be the replacement token")
-			}
-
-			sarm.AssertExpectations(t)
-		})
-	}
-}
-
-func TestStepActionRemoteUsesGitHubInstanceWhenDefaultActionInstanceEmpty(t *testing.T) {
-	ctx := context.Background()
-
-	var actualURL string
-	sarm := &stepActionRemoteMocks{}
-
-	origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-	stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-		return func(ctx context.Context) error {
-			actualURL = input.URL
-			return nil
-		}
-	}
-	defer func() {
-		stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-	}()
-
-	sar := &stepActionRemote{
-		Step: &model.Step{
-			Uses: "actions/setup-go@v4",
-		},
-		RunContext: &RunContext{
-			Config: &Config{
-				GitHubInstance:        "gitea.example",
-				DefaultActionInstance: "",
-				ActionCacheDir:        t.TempDir(),
-			},
-			Run: &model.Run{
-				JobID: "1",
-				Workflow: &model.Workflow{
-					Jobs: map[string]*model.Job{
-						"1": {},
-					},
-				},
-			},
-		},
-		readAction: sarm.readAction,
-	}
-
-	suffixMatcher := func(suffix string) any {
-		return mock.MatchedBy(func(actionDir string) bool {
-			return strings.HasSuffix(actionDir, suffix)
-		})
-	}
-	sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-	require.NoError(t, sar.prepareActionExecutor()(ctx))
-	assert.Equal(t, "https://gitea.example/actions/setup-go", actualURL)
-	sarm.AssertExpectations(t)
-}
-
-func TestStepActionRemotePost(t *testing.T) {
-	table := []struct {
-		name               string
-		stepModel          *model.Step
-		actionModel        *model.Action
-		initialStepResults map[string]*model.StepResult
-		IntraActionState   map[string]map[string]string
-		expectedEnv        map[string]string
-		err                error
-		mocks              struct {
-			env  bool
-			exec bool
-		}
-	}{
-		{
-			name: "main-success",
-			stepModel: &model.Step{
-				ID:   "step",
-				Uses: "remote/action@v1",
-			},
-			actionModel: &model.Action{
-				Runs: model.ActionRuns{
-					Using:  "node16",
-					Post:   "post.js",
-					PostIf: "always()",
-				},
-			},
-			initialStepResults: map[string]*model.StepResult{
-				"step": {
-					Conclusion: model.StepStatusSuccess,
-					Outcome:    model.StepStatusSuccess,
-					Outputs:    map[string]string{},
-				},
-			},
-			IntraActionState: map[string]map[string]string{
-				"step": {
-					"key": "value",
-				},
-			},
-			expectedEnv: map[string]string{
-				"STATE_key": "value",
-			},
-			mocks: struct {
-				env  bool
-				exec bool
-			}{
-				env:  true,
-				exec: true,
-			},
-		},
-		{
-			name: "main-failed",
-			stepModel: &model.Step{
-				ID:   "step",
-				Uses: "remote/action@v1",
-			},
-			actionModel: &model.Action{
-				Runs: model.ActionRuns{
-					Using:  "node16",
-					Post:   "post.js",
-					PostIf: "always()",
-				},
-			},
-			initialStepResults: map[string]*model.StepResult{
-				"step": {
-					Conclusion: model.StepStatusFailure,
-					Outcome:    model.StepStatusFailure,
-					Outputs:    map[string]string{},
-				},
-			},
-			mocks: struct {
-				env  bool
-				exec bool
-			}{
-				env:  true,
-				exec: true,
-			},
-		},
-		{
-			name: "skip-if-failed",
-			stepModel: &model.Step{
-				ID:   "step",
-				Uses: "remote/action@v1",
-			},
-			actionModel: &model.Action{
-				Runs: model.ActionRuns{
-					Using:  "node16",
-					Post:   "post.js",
-					PostIf: "success()",
-				},
-			},
-			initialStepResults: map[string]*model.StepResult{
-				"step": {
-					Conclusion: model.StepStatusFailure,
-					Outcome:    model.StepStatusFailure,
-					Outputs:    map[string]string{},
-				},
-			},
-			mocks: struct {
-				env  bool
-				exec bool
-			}{
-				env:  true,
-				exec: false,
-			},
-		},
-		{
-			name: "skip-if-main-skipped",
-			stepModel: &model.Step{
-				ID:   "step",
-				If:   yaml.Node{Value: "failure()"},
-				Uses: "remote/action@v1",
-			},
-			actionModel: &model.Action{
-				Runs: model.ActionRuns{
-					Using:  "node16",
-					Post:   "post.js",
-					PostIf: "always()",
-				},
-			},
-			initialStepResults: map[string]*model.StepResult{
-				"step": {
-					Conclusion: model.StepStatusSkipped,
-					Outcome:    model.StepStatusSkipped,
-					Outputs:    map[string]string{},
-				},
-			},
-			mocks: struct {
-				env  bool
-				exec bool
-			}{
-				env:  false,
-				exec: false,
-			},
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			cm := &containerMock{}
-
-			sar := &stepActionRemote{
-				env: map[string]string{},
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance: "https://github.com",
-						ActionCacheDir: "/tmp/test-cache",
-					},
-					JobContainer: cm,
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{
-								"1": {},
-							},
-						},
-					},
-					StepResults:      tt.initialStepResults,
-					IntraActionState: tt.IntraActionState,
-				},
-				Step:   tt.stepModel,
-				action: tt.actionModel,
-			}
-			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
-
-			if tt.mocks.exec {
-				// Use mock.MatchedBy to match the exec command with hash-based path
-				execMatcher := mock.MatchedBy(func(args []string) bool {
-					if len(args) != 2 {
-						return false
-					}
-					return args[0] == "node" && strings.Contains(args[1], "post.js")
-				})
-
-				cm.On("Exec", execMatcher, sar.env, "", "").Return(func(ctx context.Context) error { return tt.err })
-
-				cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
-					return nil
-				})
-
-				cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
-			}
-
-			err := sar.post()(ctx)
-
-			assert.Equal(t, tt.err, err)
-			if tt.expectedEnv != nil {
-				for key, value := range tt.expectedEnv {
-					assert.Equal(t, value, sar.env[key])
-				}
-			}
-			// Enshure that StepResults is nil in this test
-			assert.Equal(t, sar.RunContext.StepResults["post-step"], (*model.StepResult)(nil)) //nolint:testifylint // pre-existing issue from nektos/act
-			cm.AssertExpectations(t)
-		})
-	}
-}
-
-func Test_newRemoteAction(t *testing.T) {
-	tests := []struct {
-		action       string
-		want         *remoteAction
-		wantCloneURL string
-	}{
-		{
-			action: "actions/heroku@main",
-			want: &remoteAction{
-				URL:  "",
-				Org:  "actions",
-				Repo: "heroku",
-				Path: "",
-				Ref:  "main",
-			},
-			wantCloneURL: "https://github.com/actions/heroku",
-		},
-		{
-			action: "actions/aws/ec2@main",
-			want: &remoteAction{
-				URL:  "",
-				Org:  "actions",
-				Repo: "aws",
-				Path: "ec2",
-				Ref:  "main",
-			},
-			wantCloneURL: "https://github.com/actions/aws",
-		},
-		{
-			action: "./.github/actions/my-action", // it's valid for GitHub, but act don't support it
-			want:   nil,
-		},
-		{
-			action: "docker://alpine:3.8", // it's valid for GitHub, but act don't support it
-			want:   nil,
-		},
-		{
-			action: "https://gitea.com/actions/heroku@main", // it's invalid for GitHub, but gitea supports it
-			want: &remoteAction{
-				URL:  "https://gitea.com",
-				Org:  "actions",
-				Repo: "heroku",
-				Path: "",
-				Ref:  "main",
-			},
-			wantCloneURL: "https://gitea.com/actions/heroku",
-		},
-		{
-			action: "https://gitea.com/actions/aws/ec2@main", // it's invalid for GitHub, but gitea supports it
-			want: &remoteAction{
-				URL:  "https://gitea.com",
-				Org:  "actions",
-				Repo: "aws",
-				Path: "ec2",
-				Ref:  "main",
-			},
-			wantCloneURL: "https://gitea.com/actions/aws",
-		},
-		{
-			action: "http://gitea.com/actions/heroku@main", // it's invalid for GitHub, but gitea supports it
-			want: &remoteAction{
-				URL:  "http://gitea.com",
-				Org:  "actions",
-				Repo: "heroku",
-				Path: "",
-				Ref:  "main",
-			},
-			wantCloneURL: "http://gitea.com/actions/heroku",
-		},
-		{
-			action: "http://gitea.com/actions/aws/ec2@main", // it's invalid for GitHub, but gitea supports it
-			want: &remoteAction{
-				URL:  "http://gitea.com",
-				Org:  "actions",
-				Repo: "aws",
-				Path: "ec2",
-				Ref:  "main",
-			},
-			wantCloneURL: "http://gitea.com/actions/aws",
-		},
-		{
-			action: "ssh://git@gitea.com/actions/heroku@main", // it's invalid for GitHub, but gitea supports it
-			want: &remoteAction{
-				URL:  "ssh://git@gitea.com",
-				Org:  "actions",
-				Repo: "heroku",
-				Path: "",
-				Ref:  "main",
-			},
-			wantCloneURL: "ssh://git@gitea.com/actions/heroku",
-		},
-		{
-			action: "ssh://git@gitea.com/actions/aws/ec2@main", // the ssh user is kept as part of the host segment
-			want: &remoteAction{
-				URL:  "ssh://git@gitea.com",
-				Org:  "actions",
-				Repo: "aws",
-				Path: "ec2",
-				Ref:  "main",
-			},
-			wantCloneURL: "ssh://git@gitea.com/actions/aws",
-		},
-		{
-			action: "ssh://gitea.com/onlyonesegment@main", // missing org/repo after the host
-			want:   nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.action, func(t *testing.T) {
-			got := newRemoteAction(tt.action)
-			assert.Equalf(t, tt.want, got, "newRemoteAction(%v)", tt.action)
-			cloneURL := ""
-			if got != nil {
-				cloneURL = got.CloneURL("github.com")
-			}
-			assert.Equalf(t, tt.wantCloneURL, cloneURL, "newRemoteAction(%v).CloneURL()", tt.action)
-		})
-	}
-}
-
-func Test_safeFilename(t *testing.T) {
-	tests := []struct {
-		s    string
-		want string
-	}{
-		{
-			s:    "https://test.com/test/",
-			want: "https---test.com-test-",
-		},
-		{
-			s:    `<>:"/\|?*`,
-			want: "---------",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.s, func(t *testing.T) {
-			assert.Equalf(t, tt.want, safeFilename(tt.s), "safeFilename(%v)", tt.s)
-		})
-	}
-}
-
-// Regression: a nested action in a composite cloned anonymously (401) because the
-// composite RunContext nils Config.Secrets. The token must come from github.Token,
-// which survives the config copy; the host gate must still withhold it cross-host.
-func TestStepActionRemoteCloneTokenSurvivesNilSecrets(t *testing.T) {
-	const wantToken = "job-token"
-
-	table := []struct {
-		name                  string
-		gitHubInstance        string
-		defaultActionInstance string
-		wantCloneToken        string
-	}{
-		{
-			name:           "same host forwards token despite nil secrets",
-			gitHubInstance: "gitea.example.com",
-			wantCloneToken: wantToken,
-		},
-		{
-			name:                  "foreign host is not given the token",
-			gitHubInstance:        "gitea.example.com",
-			defaultActionInstance: "github.com",
-			wantCloneToken:        "",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			var capturedToken string
-			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-				capturedToken = input.Token
-				return func(ctx context.Context) error { return nil }
-			}
-			defer (func() {
-				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-			})()
-
-			sarm := &stepActionRemoteMocks{}
-			sar := &stepActionRemote{
-				Step: &model.Step{Uses: "org/repo@v1"},
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance:        tt.gitHubInstance,
-						DefaultActionInstance: tt.defaultActionInstance,
-						ActionCacheDir:        "/tmp/test-cache",
-						// Mirrors the state of a composite RunContext: job secrets are
-						// stripped, but the job token is still reachable via Config.Token.
-						Secrets: nil,
-						Token:   wantToken,
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{"1": {}},
-						},
-					},
-					StepResults: map[string]*model.StepResult{},
-				},
-				readAction: sarm.readAction,
-			}
-			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
-
-			suffixMatcher := func(suffix string) any {
-				return mock.MatchedBy(func(actionDir string) bool {
-					return strings.HasSuffix(actionDir, suffix)
-				})
-			}
-			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-			err := sar.prepareActionExecutor()(ctx)
-			require.NoError(t, err)
-			assert.Equal(t, tt.wantCloneToken, capturedToken)
-
-			sarm.AssertExpectations(t)
-		})
-	}
-}