fix(deps): update module github.com/docker/go-connections to v0.7.0

.gitea/workflows/pull-pr-title.yml

@@ -1,27 +0,0 @@
-name: pr-title
-
-on:
-  pull_request:
-    types:
-    - opened
-    - edited
-    - reopened
-    - synchronize
-    - ready_for_review
-
-permissions:
-  contents: read
-
-jobs:
-  lint-pr-title:
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-node@v7
-      with:
-        node-version: 24
-    - run: make lint-pr-title
-      env:
-        PR_TITLE: ${{ github.event.pull_request.title }}

.gitea/workflows/release-nightly.yml

@@ -17,14 +17,14 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release --nightly
@@ -43,33 +43,27 @@ jobs:
     strategy:
       matrix:
         variant:
-          # The basic image is built from source and can target any arch the
-          # toolchain supports. The dind variants are limited to the arches the
-          # docker:dind base image publishes.
           - target: basic
             tag_suffix: ""
-            platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
           - target: dind
             tag_suffix: "-dind"
-            platforms: linux/amd64,linux/arm64
           - target: dind-rootless
             tag_suffix: "-dind-rootless"
-            platforms: linux/amd64,linux/arm64
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -77,20 +71,15 @@ jobs:
       - name: Echo the tag
         run: echo "${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}"
 
-      - name: Get Meta
-        id: meta
-        run: |
-          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT
-
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           target: ${{ matrix.variant.target }}
-          platforms: ${{ matrix.variant.platforms }}
+          platforms: |
+            linux/amd64
+            linux/arm64
           push: true
           tags: |
             ${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}
-          build-args: |
-            VERSION=${{ steps.meta.outputs.REPO_VERSION }}

.gitea/workflows/release-tag.yml

@@ -9,7 +9,7 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
       - uses: actions/setup-go@v6
@@ -17,13 +17,13 @@ jobs:
           go-version-file: "go.mod"
       - name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@v6
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release
@@ -42,18 +42,12 @@ jobs:
     strategy:
       matrix:
         variant:
-          # The basic image is built from source and can target any arch the
-          # toolchain supports. The dind variants are limited to the arches the
-          # docker:dind base image publishes.
           - target: basic
             tag_suffix: ""
-            platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
           - target: dind
             tag_suffix: "-dind"
-            platforms: linux/amd64,linux/arm64
           - target: dind-rootless
             tag_suffix: "-dind-rootless"
-            platforms: linux/amd64,linux/arm64
     container:
       image: catthehacker/ubuntu:act-latest
     env:
@@ -61,25 +55,25 @@ jobs:
       DOCKER_LATEST: latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: "Docker meta"
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: https://github.com/docker/metadata-action@v5
         with:
           images: |
             ${{ env.DOCKER_ORG }}/runner
@@ -92,13 +86,13 @@ jobs:
             suffix=${{ matrix.variant.tag_suffix }},onlatest=true
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           target: ${{ matrix.variant.target }}
-          platforms: ${{ matrix.variant.platforms }}
+          platforms: |
+            linux/amd64
+            linux/arm64
           push: true
           tags: ${{ steps.docker_meta.outputs.tags }}
-          build-args: |
-            VERSION=${{ steps.docker_meta.outputs.version }}

.gitea/workflows/test.yml

@@ -9,40 +9,14 @@ jobs:
   lint:
     name: check and test
     runs-on: ubuntu-latest
-    env:
-      # The runner image ships a stale docker.io login; point docker at an empty config so
-      # image pulls go straight to anonymous instead of attempting (and failing) that auth
-      # first. The path must be a literal: the `runner` context is unavailable in job-level
-      # env, so `${{ runner.temp }}` would resolve to empty and config.Dir() would fall back
-      # to ~/.docker with the stale credentials.
-      DOCKER_CONFIG: /tmp/docker-noauth
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
-      - name: prepare anonymous docker config
-        run: mkdir -p "$DOCKER_CONFIG" && echo '{}' > "$DOCKER_CONFIG/config.json"
-      # Pre-pull act/runner's two largest base images so a slow pull can't dominate `make test`;
-      # the rest (alpine/ubuntu) pull on demand, absorbed by the make-test -timeout. The host
-      # daemon retains them between runs, so this is usually a fast manifest re-check.
-      - name: pre-pull test images
-        run: |
-          for img in node:24-bookworm-slim nginx:alpine; do
-            for try in 1 2 3; do docker pull "$img" && break || sleep 5; done
-          done
       - name: lint
         run: make lint
       - name: build
         run: make build
       - name: test
-        run: make test
+        run: make test
-      # Build the dind image and run the daemon-facing tests against the docker version it
-      # ships, catching daemon-level regressions (e.g. gitea/runner#981) before release. Runs
-      # after `make test` so the images it needs are already present on the host daemon.
-      - name: test against dind image
-        run: make test-dind
-      - name: coverage report
-        run: |
-          make coverage-report
-          cat .tmp/coverage.md >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -1,9 +1,7 @@
 /gitea-runner
 .env
-!/act/runner/testdata/secrets/.env
 .runner
 coverage.txt
-.tmp/
 /config.yaml
 
 # Jetbrains
@@ -12,5 +10,4 @@ coverage.txt
 .vscode
 __debug_bin
 # gorelease binary folder
-/dist
+dist
-.DS_Store

Dockerfile

@@ -1,7 +1,7 @@
 ### BUILDER STAGE
 #
 #
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.26-alpine AS builder
 
 # Do not remove `git` here, it is required for getting runner version when executing `make build`
 RUN apk add --no-cache make git
@@ -17,14 +17,9 @@ RUN make clean && make build
 ### DIND VARIANT
 #
 #
-FROM docker:29.6.1-dind AS dind
+FROM docker:28-dind AS dind
 
-ARG VERSION=dev
+RUN apk add --no-cache s6 bash git tzdata
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
-RUN apk add --no-cache s6 bash git tzdata nftables
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
 COPY scripts/run.sh /usr/local/bin/run.sh
@@ -37,15 +32,10 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### DIND-ROOTLESS VARIANT
 #
 #
-FROM docker:29.6.1-dind-rootless AS dind-rootless
+FROM docker:28-dind-rootless AS dind-rootless
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
 
 USER root
-RUN apk add --no-cache s6 bash git tzdata nftables
+RUN apk add --no-cache s6 bash git tzdata
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
 COPY scripts/run.sh /usr/local/bin/run.sh
@@ -63,13 +53,7 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### BASIC VARIANT
 #
 #
-FROM alpine:3.24 AS basic
+FROM alpine AS basic
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
 RUN apk add --no-cache tini bash git tzdata
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner

Makefile

@@ -18,8 +18,8 @@ DOCKER_TAG ?= nightly
 DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
 DOCKER_ROOTLESS_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)-dind-rootless
 
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.3.0
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
 
 STATIC ?=
 EXTLDFLAGS ?=
@@ -38,15 +38,12 @@ endif
 ifeq ($(OS), Windows_NT)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else ifeq ($(OS), Windows)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else
 	GOFLAGS := -v
 	EXECUTABLE ?= $(EXECUTABLE)
-	GO_ENV_WINDOWS := GOOS=windows
 endif
 
 STORED_VERSION_FILE := VERSION
@@ -111,25 +108,16 @@ deps-tools: ## install tool dependencies
 	wait
 
 .PHONY: lint
-lint: lint-go lint-go-windows ## lint everything
+lint: lint-go ## lint everything
 
 .PHONY: lint-go
 lint-go: ## lint go files
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run
 
-.PHONY: lint-go-windows
-lint-go-windows: ## lint Windows go files
-	$(GO) install $(GOLANGCI_LINT_PACKAGE)
-	$(GO_ENV_WINDOWS) golangci-lint run
-
 .PHONY: lint-go-fix
 lint-go-fix: ## lint go files and fix issues
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run --fix
 
-.PHONY: lint-pr-title
-lint-pr-title: ## lint PR title against Conventional Commits (set PR_TITLE=...)
-	@node ./tools/lint-pr-title.ts
-
 .PHONY: security-check
 security-check: deps-tools
 	GOEXPERIMENT= $(GO) run $(GOVULNCHECK_PACKAGE) -show color ./... || true
@@ -148,18 +136,8 @@ tidy-check: tidy
 	fi
 
 .PHONY: test
-test: fmt-check security-check ## test everything (integration tests self-skip without docker/network)
+test: fmt-check security-check ## test everything
-	@$(GO) test -race -timeout 20m -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
+	@$(GO) test -race -short -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
-
-.PHONY: coverage-report
-coverage-report: ## turn coverage.txt from `make test` into .tmp/coverage.md
-	@mkdir -p .tmp
-	@node ./tools/coverage-report.ts -i coverage.txt -o .tmp/coverage.md
-	@echo "Wrote .tmp/coverage.md"
-
-.PHONY: test-dind
-test-dind: ## run the daemon-facing tests against the built dind image (TARGET=dind|dind-rootless)
-	@./scripts/test-dind.sh $(TARGET)
 
 .PHONY: install
 install: $(GOFILES) ## install the runner binary via `go install`
@@ -224,7 +202,7 @@ docker: ## build the docker image
 .PHONY: clean
 clean: ## delete binary and coverage files
 	$(GO) clean -x -i ./...
-	rm -rf coverage.txt .tmp $(EXECUTABLE) $(DIST)
+	rm -rf coverage.txt $(EXECUTABLE) $(DIST)
 
 .PHONY: version
 version: ## print the version

README.md

@@ -85,48 +85,6 @@ docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRA
 
 Mount a volume on `/data` if you want the registration file and optional config to survive container recreation (see [scripts/run.sh](scripts/run.sh)).
 
-> **`/data` does not hold the image cache.** It is the runner's working directory and contains only the `.runner` registration file and, optionally, your config file. Images pulled for jobs live in the *Docker daemon's* data root, which for the `dind` flavours is inside the container (`/var/lib/docker`, or `/home/rootless/.local/share/docker` for `dind-rootless`). To keep the image cache across restarts, give that path its own volume as well — otherwise every new container re-pulls the job images. With the `basic` flavour the images live on whichever daemon you point the runner at, so there is nothing extra to persist.
-
-### Image flavours
-
-The image is published in three flavours, all built from the single multi-stage [Dockerfile](Dockerfile) in this repository. They differ only in how a Docker daemon is made available to the jobs the runner executes; the `gitea-runner` binary inside them is identical.
-
-| Tag | Build target | Base image | Docker daemon | Process supervisor | Runs as |
-| --- | --- | --- | --- | --- | --- |
-| `latest` (and `<version>`) | `basic` | `alpine` | none — uses an external daemon you provide | [`tini`](https://github.com/krallin/tini) | `root` |
-| `latest-dind` | `dind` | `docker:dind` | bundled, started inside the container | [`s6`](https://skarnet.org/software/s6/) | `root` (privileged) |
-| `latest-dind-rootless` | `dind-rootless` | `docker:dind-rootless` | bundled, started rootless inside the container | [`s6`](https://skarnet.org/software/s6/) | `rootless` (UID 1000) |
-
-#### `latest` — basic
-
-The default flavour ships only the runner on a minimal Alpine base. It contains **no Docker daemon of its own**: jobs that use `docker://` images need a daemon supplied from outside the container, typically by bind-mounting the host's socket:
-
-```bash
-docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/runner:latest
-```
-
-`tini` is the entrypoint (it reaps zombie processes), and it just runs [`scripts/run.sh`](scripts/run.sh), which registers the runner on first start and then execs `gitea-runner daemon`. This flavour does not need `--privileged`. The trade-off is that jobs share the host's daemon, so they can see other containers and images on that daemon.
-
-#### `latest-dind` — Docker-in-Docker
-
-This flavour is based on the official `docker:dind` image and bundles its own Docker daemon, so it needs no external socket — only the `--privileged` flag that Docker-in-Docker requires:
-
-```bash
-docker run --privileged -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  --name my_runner gitea/runner:latest-dind
-```
-
-Two processes have to run side by side here (the Docker daemon and the runner), so the entrypoint is the [`s6`](https://skarnet.org/software/s6/) supervision tree under [`scripts/s6`](scripts/s6) instead of `tini`. `s6` starts `dockerd`, and the runner service waits for the daemon to come up (`s6-svwait`) before launching [`run.sh`](scripts/run.sh). Each container has a private daemon isolated from the host's, at the cost of running privileged.
-
-#### `latest-dind-rootless` — rootless Docker-in-Docker
-
-Same idea as `dind`, but built on `docker:dind-rootless` so the bundled daemon and the runner run as an unprivileged user (`rootless`, UID 1000) rather than `root`. `DOCKER_HOST` is preset to `unix:///run/user/1000/docker.sock` so the runner talks to the rootless daemon. This reduces the blast radius compared to the privileged `dind` flavour, but rootless Docker carries the usual rootless limitations (networking, cgroups, storage drivers, and some operations that need additional host configuration such as `/etc/subuid` / `/etc/subgid` mappings and unprivileged user-namespace support).
-
-> **The UID is fixed at 1000.** It comes from the `rootless` user baked into the upstream `docker:dind-rootless` base image, and the bundled daemon always listens on `/run/user/1000/docker.sock` inside the container, so running this flavour as a different user (`--user 1001`) does not work. If you need the runner to talk to a *host* rootless daemon that runs under some other UID, use the `basic` flavour instead and bind-mount that daemon's socket (see [examples/vm/rootless-docker.md](examples/vm/rootless-docker.md)); pointing `DOCKER_HOST` at a host socket from inside `dind-rootless` will not work. Changing the UID otherwise means rebuilding the image from a base with a different `rootless` user.
-
-> **Note on Podman:** these images target the Docker daemon. The bundled `dind`/`dind-rootless` daemons are `dockerd`, not Podman, and the `basic` flavour expects a Docker-compatible socket. Running them under rootless Podman is not a supported configuration, though pointing the `basic` flavour at a Podman socket that emulates the Docker API may work for some workloads.
-
 ### Configuration
 
 The runner is configured with a YAML file. Generate a starting point (this matches what ships in the tree):
@@ -147,104 +105,26 @@ Every option is described in [config.example.yaml](internal/pkg/config/config.ex
 
 #### Without a config file
 
-If you omit `-c`, built-in defaults apply (same as an empty YAML document).
+If you omit `-c`, built-in defaults apply (same as an empty YAML document). A small set of **deprecated** environment variables can still override parts of that default config, but **only when no `-c` path was given**; they are ignored if you use a config file:
 
-Earlier releases let a small set of environment variables (`GITEA_DEBUG`, `GITEA_TRACE`, `GITEA_RUNNER_CAPACITY`, `GITEA_RUNNER_FILE`, `GITEA_RUNNER_ENVIRON`, `GITEA_RUNNER_ENV_FILE`) override parts of the default config. Those overrides have been removed — use a YAML config file for all settings instead. For the Docker images, the entrypoint still understands a separate set of variables (such as `RUNNER_STATE_FILE`); see [scripts/run.sh](scripts/run.sh) and the container documentation below.
+| Variable | Effect |
-
-### Labels
-
-Labels decide **which jobs a runner accepts** and **how it runs them**. A job's `runs-on` is matched against the runner's label names; the first match wins and selects the execution environment for that job.
-
-A label is written as:
-
-```text
-<name>[:<schema>[:<args>]]
-```
-
-| Part | Meaning |
 | --- | --- |
-| `name` | The name a workflow refers to in `runs-on`, e.g. `ubuntu-latest`. |
+| `GITEA_DEBUG` | If true, sets log level to `debug` |
-| `schema` | Either `docker` or `host`. Defaults to `host` when omitted. |
+| `GITEA_TRACE` | If true, sets log level to `trace` |
-| `args` | Only used by the `docker` schema: the image to run the job in. |
+| `GITEA_RUNNER_CAPACITY` | Concurrent jobs (integer) |
+| `GITEA_RUNNER_FILE` | Registration state file path (default `.runner`) |
+| `GITEA_RUNNER_ENVIRON` | Extra job env vars as comma-separated `KEY:VALUE` pairs |
+| `GITEA_RUNNER_ENV_FILE` | Path to an env file merged into job env (same idea as `runner.env_file` in YAML) |
 
-Two schemas are supported:
+Prefer a YAML file for all settings.
-
-- **`docker://<image>`** — the job runs inside a container created from `<image>`:
-
-  ```text
-  ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest
-  ```
-
-- **`host`** — the job's steps run directly on the machine the runner is on, using the tools installed there:
-
-  ```text
-  macos:host
-  ```
-
-So with the labels
-
-```text
-ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest,macos:host
-```
-
-a workflow with `runs-on: ubuntu-latest` is executed in the `runner-images:ubuntu-latest` container, and one with `runs-on: macos` is executed directly on the host.
-
-Names may themselves contain a colon (for example `pool:e57e18d4-10d4-406f-93bf-60f127221bdd`); only `host` and `docker` are treated as schemas.
-
-If a job's `runs-on` matches none of the runner's labels, the job still runs, in the default `docker.gitea.com/runner-images:ubuntu-latest` image. Images maintained for this purpose are listed at [gitea/runner-images](https://gitea.com/gitea/runner-images).
-
-Labels are chosen at registration time (`--labels`, or the interactive prompt) and can be changed afterwards by editing `runner.labels` in the config file, or in the Gitea UI under the runner's settings.
 
 #### Registration vs config labels
 
 If `runner.labels` is set in the YAML file, those labels are used during `register` and the `--labels` CLI flag is ignored.
 
-The `daemon` command also accepts `--labels` (which defaults to the `GITEA_RUNNER_LABELS` environment variable), so the labels of an already registered runner can be changed without deleting its registration file. The most explicit source wins:
+#### External cache (`actions/cache`)
 
-```
+If `cache.external_server` is set, you must set `cache.external_secret` to the same value on this runner and on the standalone cache server. Run the server with `gitea-runner cache-server` using a config that defines `cache.external_secret` (and matching `cache.dir` / host / port as needed). Flags `--dir`, `--host`, and `--port` on `cache-server` override the file.
---labels / GITEA_RUNNER_LABELS   >   runner.labels in the config file   >   labels in the .runner file
-```
-
-Whenever the resulting labels differ from the ones in the registration file, they are written back to it and re-declared to the Gitea instance on startup.
-
-> **Note:** A runner that only exposes `host` labels still needs access to a Docker daemon (e.g. a mounted `/var/run/docker.sock`) whenever a job uses a `docker://` action or a service container. `host` labels only change where the job's own steps run; container-based steps and actions are still executed with Docker.
-
-#### Caching (`actions/cache`)
-
-Each runner starts its own cache server automatically. Cache entries are local to that runner — runners do not share a cache by default.
-
-**Shared cache across multiple runners**
-
-Run one dedicated `gitea-runner cache-server` that all runners point at.
-
-1. Create a config file for the cache server host:
-
-   ```yaml
-   cache:
-     dir: /data/actcache
-     port: 8088
-     external_secret: "replace-with-a-strong-random-secret"
-   ```
-
-2. Start the server:
-
-   ```bash
-   gitea-runner -c cache-server-config.yaml cache-server
-   ```
-
-3. On every runner:
-
-   ```yaml
-   cache:
-     external_server: "http://<cache-server-host>:8088/"
-     external_secret: "replace-with-a-strong-random-secret"  # must match the server
-   ```
-
-Alternatively, mount the same NFS/CIFS share on every runner and point `cache.dir` at it — simpler, but with weaker isolation between repositories.
-
-**S3 / MinIO** — mount object storage as a FUSE filesystem (e.g. [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) or [goofys](https://github.com/kahing/goofys)) and set `cache.dir` to the mount point.
-
-Flags `--dir`, `--host`, and `--port` on `cache-server` override the corresponding `cache.*` YAML keys; all other settings, including `external_secret`, require the config file.
 
 #### Official Docker image
 
@@ -252,22 +132,6 @@ Besides `GITEA_INSTANCE_URL` and `GITEA_RUNNER_REGISTRATION_TOKEN`, the image en
 
 For a fuller container-oriented walkthrough, see [examples/docker](examples/docker/README.md).
 
-When `container.bind_workdir` is enabled, stale task workspace directories can be cleaned while the runner is idle:
-- directories older than `runner.workdir_cleanup_age` are removed (default: `24h`; set `0` to disable)
-- cleanup runs every `runner.idle_cleanup_interval` (default: `10m`; set `0` to disable)
-- only purely numeric subdirectories under `container.workdir_parent` are treated as task workspaces and may be removed
-- cleanup assumes `container.workdir_parent` is not shared across multiple runners
-
-#### Post-task script (`runner.post_task_script`)
-
-Optional host script that runs **after** each task's built-in cleanup (post-steps, container teardown, bind-workdir removal). Use it for extra machine housekeeping — Docker pruning, disk cleanup, and similar.
-
-**While the script runs, the runner stops task heartbeats and stays offline from Gitea's perspective until the script exits (or hits `runner.post_task_script_timeout`, default `5m`).** A script that blocks without exiting keeps the runner from taking new work for up to that timeout. Script output goes to the runner log, not the job log; a non-zero exit is warned but does not change the job result.
-
-On Windows, use `.exe`, `.bat`, or `.cmd` paths; **PowerShell (`.ps1`) is not supported yet** as the configured path — wrap commands in a `.cmd` file instead.
-
-See **[docs/post-task-script.md](docs/post-task-script.md)** for lifecycle details, environment variables, timeout interaction, and platform notes.
-
 ### Example Deployments
 
 Check out the [examples](examples) directory for sample deployment types.

act/artifactcache/handler.go

@@ -325,6 +325,10 @@ func (h *Handler) openDB() (*bolthold.Store, error) {
 func (h *Handler) find(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 	cred := credFromContext(r.Context())
 	keys := strings.Split(r.URL.Query().Get("keys"), ",")
+	// cache keys are case insensitive
+	for i, key := range keys {
+		keys[i] = strings.ToLower(key)
+	}
 	version := r.URL.Query().Get("version")
 
 	db, err := h.openDB()
@@ -367,6 +371,8 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, _ httprouter.P
 		h.responseJSON(w, r, 400, err)
 		return
 	}
+	// cache keys are case insensitive
+	api.Key = strings.ToLower(api.Key)
 
 	cache := api.ToCache()
 	cache.Repo = cred.Repo
@@ -431,7 +437,6 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprout
 	}
 	if err := h.storage.Write(cache.ID, start, r.Body); err != nil {
 		h.responseJSON(w, r, 500, err)
-		return
 	}
 	h.useCache(id)
 	h.responseJSON(w, r, 200)

act/artifactcache/handler_test.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -339,54 +338,6 @@ func TestHandler(t *testing.T) {
 		}
 	})
 
-	t.Run("upload write failure returns only error", func(t *testing.T) {
-		key := strings.ToLower(t.Name())
-		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
-		var id uint64
-		{
-			body, err := json.Marshal(&Request{
-				Key:     key,
-				Version: version,
-				Size:    100,
-			})
-			require.NoError(t, err)
-			resp, err := testClient.Post(base+"/caches", "application/json", bytes.NewReader(body))
-			require.NoError(t, err)
-			defer resp.Body.Close()
-			require.Equal(t, 200, resp.StatusCode)
-
-			got := struct {
-				CacheID uint64 `json:"cacheId"`
-			}{}
-			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
-			id = got.CacheID
-		}
-
-		storageFile := filepath.Join(dir, "not-a-directory")
-		require.NoError(t, os.WriteFile(storageFile, []byte("blocked"), 0o600))
-		originalStorage := handler.storage
-		handler.storage = &Storage{rootDir: storageFile}
-		defer func() {
-			handler.storage = originalStorage
-		}()
-
-		req, err := http.NewRequest(http.MethodPatch,
-			fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader(make([]byte, 100)))
-		require.NoError(t, err)
-		req.Header.Set("Content-Type", "application/octet-stream")
-		req.Header.Set("Content-Range", "bytes 0-99/*")
-		resp, err := testClient.Do(req)
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		require.Equal(t, 500, resp.StatusCode)
-
-		body, err := io.ReadAll(resp.Body)
-		require.NoError(t, err)
-		var got map[string]string
-		require.NoError(t, json.Unmarshal(body, &got))
-		assert.NotEmpty(t, got["error"])
-	})
-
 	t.Run("commit early", func(t *testing.T) {
 		key := strings.ToLower(t.Name())
 		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
@@ -508,20 +459,17 @@ func TestHandler(t *testing.T) {
 		assert.Equal(t, contents[except], content)
 	})
 
-	t.Run("case preserved", func(t *testing.T) {
+	t.Run("case insensitive", func(t *testing.T) {
-		// Some actions (e.g. actions/setup-go, actions/setup-node) build cache keys that contain mixed-case fragments such as RUNNER_OS=Linux,
-		// then compare the cacheKey returned by the cache server to their original key with case-sensitive equality to decide whether the
-		// cache was a complete hit. The server must therefore preserve the original key case.
-
 		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
-		key := strings.ToLower(t.Name()) + "_ABC"
+		key := strings.ToLower(t.Name())
 		content := make([]byte, 100)
 		_, err := rand.Read(content)
 		require.NoError(t, err)
-		uploadCacheNormally(t, base, key, version, content)
+		uploadCacheNormally(t, base, key+"_ABC", version, content)
 
 		{
-			resp, err := testClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			reqKey := key + "_aBc"
+			resp, err := testClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, reqKey, version))
 			require.NoError(t, err)
 			defer resp.Body.Close()
 			require.Equal(t, 200, resp.StatusCode)
@@ -532,8 +480,7 @@ func TestHandler(t *testing.T) {
 			}{}
 			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
 			assert.Equal(t, "hit", got.Result)
-			assert.Equal(t, key, got.CacheKey)
+			assert.Equal(t, key+"_abc", got.CacheKey)
-			assert.NotEqual(t, strings.ToLower(key), got.CacheKey)
 		}
 	})
 
@@ -696,7 +643,7 @@ func uploadCacheNormally(t *testing.T, base, key, version string, content []byte
 		}{}
 		require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
 		assert.Equal(t, "hit", got.Result)
-		assert.Equal(t, key, got.CacheKey)
+		assert.Equal(t, strings.ToLower(key), got.CacheKey)
 		archiveLocation = got.ArchiveLocation
 	}
 	{

act/artifactcache/testdata/example/example.yaml

@@ -0,0 +1,30 @@
+# Copied from https://github.com/actions/cache#example-cache-workflow
+name: Caching Primes
+
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - run: env
+
+      - uses: actions/checkout@v3
+
+      - name: Cache Primes
+        id: cache-primes
+        uses: actions/cache@v3
+        with:
+          path: prime-numbers
+          key: ${{ runner.os }}-primes-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-primes
+            ${{ runner.os }}
+
+      - name: Generate Prime Numbers
+        if: steps.cache-primes.outputs.cache-hit != 'true'
+        run: cat /proc/sys/kernel/random/uuid > prime-numbers
+
+      - name: Use Prime Numbers
+        run: cat prime-numbers

act/artifacts/server_test.go

@@ -5,25 +5,24 @@
 package artifacts
 
 import (
-	"bytes"
+	"context"
-	"compress/gzip"
 	"encoding/json"
 	"fmt"
-	"io"
-	"maps"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
 	"testing"
 	"testing/fstest"
-	"time"
+
+	"gitea.com/gitea/runner/act/model"
+	"gitea.com/gitea/runner/act/runner"
 
 	"github.com/julienschmidt/httprouter"
+	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 type writableMapFile struct {
@@ -235,133 +234,89 @@ func TestDownloadArtifactFile(t *testing.T) {
 	assert.Equal("content", string(data))
 }
 
-// TestArtifactFlow drives the real Serve() artifact server over a loopback socket, exercising
+type TestJobFileInfo struct {
-// the same upload -> finalize -> list -> download protocol the upload-artifact/download-artifact
+	workdir               string
-// actions speak. Running it in-process (rather than from a job container) keeps it network-free
+	workflowPath          string
-// and reachable everywhere, including when the CI job is itself a container.
+	eventName             string
+	errorMessage          string
+	platforms             map[string]string
+	containerArchitecture string
+}
+
+var (
+	artifactsPath = path.Join(os.TempDir(), "test-artifacts")
+	artifactsAddr = "127.0.0.1"
+	artifactsPort = "12345"
+)
+
 func TestArtifactFlow(t *testing.T) {
-	artifactPath := t.TempDir()
+	if testing.Short() {
-
+		t.Skip("skipping integration test")
-	// Serve the exact routes Serve() wires up, on a real loopback socket via httptest. httptest
-	// picks a free port and Close() tears the server down synchronously — avoiding both the
-	// port-rebind race and Serve()'s detached ListenAndServe goroutine, which logger.Fatal()s
-	// (process exit) on a bind error and can outlive the test's temp-dir cleanup.
-	router := httprouter.New()
-	fsys := readWriteFSImpl{}
-	uploads(router, artifactPath, fsys)
-	downloads(router, artifactPath, fsys)
-	server := httptest.NewServer(router)
-	defer server.Close()
-
-	baseURL := server.URL
-	client := server.Client()
-	client.Timeout = 5 * time.Second
-
-	// request performs one HTTP call and returns the status and body. The default transport adds
-	// Accept-Encoding: gzip and transparently decompresses, so gzipped downloads come back plain.
-	request := func(t *testing.T, method, rawURL string, body io.Reader, header http.Header) (int, []byte) {
-		t.Helper()
-		req, err := http.NewRequest(method, rawURL, body)
-		require.NoError(t, err)
-		maps.Copy(req.Header, header)
-		resp, err := client.Do(req)
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		data, err := io.ReadAll(resp.Body)
-		require.NoError(t, err)
-		return resp.StatusCode, data
 	}
 
-	t.Run("upload-and-download", func(t *testing.T) {
+	ctx := context.Background()
-		const runID, item, content = "1", "my-artifact/data.txt", "hello artifact\n"
 
-		status, data := request(t, http.MethodPost, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
+	cancel := Serve(ctx, artifactsPath, artifactsAddr, artifactsPort)
-		require.Equal(t, http.StatusOK, status, string(data))
+	defer cancel()
-		var prep FileContainerResourceURL
-		require.NoError(t, json.Unmarshal(data, &prep))
-		require.Equal(t, baseURL+"/upload/"+runID, prep.FileContainerResourceURL)
 
-		status, data = request(t, http.MethodPut, prep.FileContainerResourceURL+"?itemPath="+url.QueryEscape(item), strings.NewReader(content), nil)
+	platforms := map[string]string{
-		require.Equal(t, http.StatusOK, status, string(data))
+		"ubuntu-latest": "node:16-buster", // Don't use node:16-buster-slim because it doesn't have curl command, which is used in the tests
-		var msg ResponseMessage
+	}
-		require.NoError(t, json.Unmarshal(data, &msg))
-		require.Equal(t, "success", msg.Message)
 
-		status, data = request(t, http.MethodPatch, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
+	tables := []TestJobFileInfo{
-		require.Equal(t, http.StatusOK, status, string(data))
+		{"testdata", "upload-and-download", "push", "", platforms, ""},
+		{"testdata", "GHSL-2023-004", "push", "", platforms, ""},
+	}
+	log.SetLevel(log.DebugLevel)
 
-		status, data = request(t, http.MethodGet, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
+	for _, table := range tables {
-		require.Equal(t, http.StatusOK, status, string(data))
+		runTestJobFile(ctx, t, table)
-		var list NamedFileContainerResourceURLResponse
+	}
-		require.NoError(t, json.Unmarshal(data, &list))
+}
-		require.Equal(t, 1, list.Count)
-		require.Equal(t, "my-artifact", list.Value[0].Name)
 
-		status, data = request(t, http.MethodGet, list.Value[0].FileContainerResourceURL+"?itemPath=my-artifact", nil, nil)
+func runTestJobFile(ctx context.Context, t *testing.T, tjfi TestJobFileInfo) {
-		require.Equal(t, http.StatusOK, status, string(data))
+	t.Run(tjfi.workflowPath, func(t *testing.T) {
-		var items ContainerItemResponse
+		fmt.Printf("::group::%s\n", tjfi.workflowPath) //nolint:forbidigo // pre-existing issue from nektos/act
-		require.NoError(t, json.Unmarshal(data, &items))
-		require.Len(t, items.Value, 1)
-		require.Equal(t, "file", items.Value[0].ItemType)
-		require.Equal(t, "my-artifact/data.txt", items.Value[0].Path)
 
-		status, data = request(t, http.MethodGet, items.Value[0].ContentLocation, nil, nil)
+		if err := os.RemoveAll(artifactsPath); err != nil {
-		require.Equal(t, http.StatusOK, status)
+			panic(err)
-		require.Equal(t, content, string(data))
+		}
 
-		stored, err := os.ReadFile(filepath.Join(artifactPath, runID, "my-artifact", "data.txt"))
+		workdir, err := filepath.Abs(tjfi.workdir)
-		require.NoError(t, err)
+		assert.NoError(t, err, workdir) //nolint:testifylint // pre-existing issue from nektos/act
-		require.Equal(t, content, string(stored))
+		fullWorkflowPath := filepath.Join(workdir, tjfi.workflowPath)
-	})
+		runnerConfig := &runner.Config{
+			Workdir:               workdir,
+			BindWorkdir:           false,
+			EventName:             tjfi.eventName,
+			Platforms:             tjfi.platforms,
+			ReuseContainers:       false,
+			ContainerArchitecture: tjfi.containerArchitecture,
+			GitHubInstance:        "github.com",
+			ArtifactServerPath:    artifactsPath,
+			ArtifactServerAddr:    artifactsAddr,
+			ArtifactServerPort:    artifactsPort,
+		}
 
-	t.Run("gzip-roundtrip", func(t *testing.T) {
+		runner, err := runner.New(runnerConfig)
-		const runID, item, content = "2", "logs/app.log", "compressed payload\n"
+		assert.NoError(t, err, tjfi.workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
 
-		var buf bytes.Buffer
+		planner, err := model.NewWorkflowPlanner(fullWorkflowPath, true)
-		gz := gzip.NewWriter(&buf)
+		assert.NoError(t, err, fullWorkflowPath) //nolint:testifylint // pre-existing issue from nektos/act
-		_, err := gz.Write([]byte(content))
-		require.NoError(t, err)
-		require.NoError(t, gz.Close())
 
-		status, data := request(t, http.MethodPut, baseURL+"/upload/"+runID+"?itemPath="+url.QueryEscape(item),
+		plan, err := planner.PlanEvent(tjfi.eventName)
-			&buf, http.Header{"Content-Encoding": []string{"gzip"}})
+		if err == nil {
-		require.Equal(t, http.StatusOK, status, string(data))
+			err = runner.NewPlanExecutor(plan)(ctx)
+			if tjfi.errorMessage == "" {
+				assert.NoError(t, err, fullWorkflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+			} else {
+				assert.Error(t, err, tjfi.errorMessage) //nolint:testifylint // pre-existing issue from nektos/act
+			}
+		} else {
+			assert.Nil(t, plan)
+		}
 
-		// stored compressed, with the server's gzip marker suffix
+		fmt.Println("::endgroup::") //nolint:forbidigo // pre-existing issue from nektos/act
-		_, err = os.Stat(filepath.Join(artifactPath, runID, "logs", "app.log.gz__"))
-		require.NoError(t, err)
-
-		status, data = request(t, http.MethodGet, baseURL+"/download/"+runID+"?itemPath=logs", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var items ContainerItemResponse
-		require.NoError(t, json.Unmarshal(data, &items))
-		require.Len(t, items.Value, 1)
-		require.Equal(t, "logs/app.log", items.Value[0].Path)
-
-		status, data = request(t, http.MethodGet, items.Value[0].ContentLocation, nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
-	})
-
-	// GHSL-2023-004: an itemPath that climbs out of the run directory must be neutralised so the
-	// blob cannot be written outside the artifact root.
-	t.Run("GHSL-2023-004", func(t *testing.T) {
-		const runID, content = "3", "contained\n"
-
-		status, data := request(t, http.MethodPut, baseURL+"/upload/"+runID+"?itemPath="+url.QueryEscape("../../escape.txt"),
-			strings.NewReader(content), nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-
-		stored, err := os.ReadFile(filepath.Join(artifactPath, runID, "escape.txt"))
-		require.NoError(t, err)
-		require.Equal(t, content, string(stored))
-
-		_, err = os.Stat(filepath.Join(filepath.Dir(artifactPath), "escape.txt"))
-		require.True(t, os.IsNotExist(err), "upload escaped the artifact root")
-
-		status, data = request(t, http.MethodGet, baseURL+"/artifact/"+runID+"/escape.txt", nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
 	})
 }
 
@@ -390,43 +345,6 @@ func TestMkdirFsImplSafeResolve(t *testing.T) {
 	}
 }
 
-func TestReadWriteFSWritableAndAppendable(t *testing.T) {
-	fsys := readWriteFSImpl{}
-	name := filepath.Join(t.TempDir(), "nested", "artifact.txt")
-
-	w, err := fsys.OpenWritable(name)
-	require.NoError(t, err)
-	_, err = w.Write([]byte("first"))
-	require.NoError(t, err)
-	require.NoError(t, w.Close())
-
-	w, err = fsys.OpenAppendable(name)
-	require.NoError(t, err)
-	_, err = w.Write([]byte("-second"))
-	require.NoError(t, err)
-	require.NoError(t, w.Close())
-
-	got, err := os.ReadFile(name)
-	require.NoError(t, err)
-	require.Equal(t, "first-second", string(got))
-
-	w, err = fsys.OpenWritable(name)
-	require.NoError(t, err)
-	_, err = w.Write([]byte("replaced"))
-	require.NoError(t, err)
-	require.NoError(t, w.Close())
-
-	got, err = os.ReadFile(name)
-	require.NoError(t, err)
-	require.Equal(t, "replaced", string(got))
-}
-
-func TestServeEmptyArtifactPathReturnsCancelableNoop(t *testing.T) {
-	cancel := Serve(t.Context(), "", "127.0.0.1", "0")
-	require.NotNil(t, cancel)
-	cancel()
-}
-
 func TestDownloadArtifactFileUnsafePath(t *testing.T) {
 	assert := assert.New(t)
 

act/artifacts/testdata/GHSL-2023-004/artifacts.yml

@@ -0,0 +1,39 @@
+
+name: "GHSL-2023-0004"
+on: push
+
+jobs:
+  test-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "hello world" > test.txt
+      - name: curl upload
+        run: curl --silent --show-error --fail ${ACTIONS_RUNTIME_URL}upload/1?itemPath=../../my-artifact/secret.txt --upload-file test.txt
+      - uses: actions/download-artifact@v2
+        with:
+          name: my-artifact
+          path: test-artifacts
+      - name: 'Verify Artifact #1'
+        run: |
+          file="test-artifacts/secret.txt"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if [ "$(cat $file)" != "hello world" ] ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+      - name: Verify download should work by clean extra dots
+        run: curl --silent --show-error --fail --path-as-is -o out.txt ${ACTIONS_RUNTIME_URL}artifact/1/../../../1/my-artifact/secret.txt
+      - name: 'Verify download content'
+        run: |
+          file="out.txt"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if [ "$(cat $file)" != "hello world" ] ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi

act/artifacts/testdata/upload-and-download/artifacts.yml

@@ -0,0 +1,230 @@
+
+name: "Test that artifact uploads and downloads succeed"
+on: push
+
+jobs:
+  test-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - run: mkdir -p path/to/artifact
+      - run: echo hello > path/to/artifact/world.txt
+      - uses: actions/upload-artifact@v2
+        with:
+          name: my-artifact
+          path: path/to/artifact/world.txt
+
+      - run: rm -rf path
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: my-artifact
+      - name: Display structure of downloaded files
+        run: ls -la
+
+      # Test end-to-end by uploading two artifacts and then downloading them
+      - name: Create artifact files
+        run: |
+          mkdir -p path/to/dir-1
+          mkdir -p path/to/dir-2
+          mkdir -p path/to/dir-3
+          mkdir -p path/to/dir-5
+          mkdir -p path/to/dir-6
+          mkdir -p path/to/dir-7
+          echo "Lorem ipsum dolor sit amet" > path/to/dir-1/file1.txt
+          echo "Hello world from file #2" > path/to/dir-2/file2.txt
+          echo "This is a going to be a test for a large enough file that should get compressed with GZip. The @actions/artifact package uses GZip to upload files. This text should have a compression ratio greater than 100% so it should get uploaded using GZip" > path/to/dir-3/gzip.txt
+          dd if=/dev/random of=path/to/dir-5/file5.rnd bs=1024 count=1024
+          dd if=/dev/random of=path/to/dir-6/file6.rnd bs=1024 count=$((10*1024))
+          dd if=/dev/random of=path/to/dir-7/file7.rnd bs=1024 count=$((10*1024))
+
+      # Upload a single file artifact
+      - name: 'Upload artifact #1'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Artifact-A'
+          path: path/to/dir-1/file1.txt
+      
+      # Upload using a wildcard pattern, name should default to 'artifact' if not provided
+      - name: 'Upload artifact #2'
+        uses: actions/upload-artifact@v2
+        with:
+          path: path/**/dir*/
+      
+      # Upload a directory that contains a file that will be uploaded with GZip
+      - name: 'Upload artifact #3'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'GZip-Artifact'
+          path: path/to/dir-3/
+      
+      # Upload a directory that contains a file that will be uploaded with GZip
+      - name: 'Upload artifact #4'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Multi-Path-Artifact'
+          path: |
+            path/to/dir-1/*
+            path/to/dir-[23]/*
+            !path/to/dir-3/*.txt
+      
+      # Upload a mid-size file artifact
+      - name: 'Upload artifact #5'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Mid-Size-Artifact'
+          path: path/to/dir-5/file5.rnd
+      
+      # Upload a big file artifact
+      - name: 'Upload artifact #6'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Big-Artifact'
+          path: path/to/dir-6/file6.rnd
+
+      # Upload a big file artifact twice
+      - name: 'Upload artifact #7 (First)'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Big-Uploaded-Twice'
+          path: path/to/dir-7/file7.rnd
+
+      # Upload a big file artifact twice
+      - name: 'Upload artifact #7 (Second)'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Big-Uploaded-Twice'
+          path: path/to/dir-7/file7.rnd
+
+      # Verify artifacts. Switch to download-artifact@v2 once it's out of preview
+      
+      # Download Artifact #1 and verify the correctness of the content
+      - name: 'Download artifact #1'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Artifact-A'
+          path: some/new/path
+      
+      - name: 'Verify Artifact #1'
+        run: |
+          file="some/new/path/file1.txt"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if [ "$(cat $file)" != "Lorem ipsum dolor sit amet" ] ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+      
+      # Download Artifact #2 and verify the correctness of the content
+      - name: 'Download artifact #2'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'artifact'
+          path: some/other/path
+      
+      - name: 'Verify Artifact #2'
+        run: |
+          file1="some/other/path/to/dir-1/file1.txt"
+          file2="some/other/path/to/dir-2/file2.txt"
+          if [ ! -f $file1 -o ! -f $file2 ] ; then
+            echo "Expected files do not exist"
+            exit 1
+          fi
+          if [ "$(cat $file1)" != "Lorem ipsum dolor sit amet" -o "$(cat $file2)" != "Hello world from file #2" ] ; then
+            echo "File contents of downloaded artifacts are incorrect"
+            exit 1
+          fi
+      
+      # Download Artifact #3 and verify the correctness of the content
+      - name: 'Download artifact #3'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'GZip-Artifact'
+          path: gzip/artifact/path
+      
+      # Because a directory was used as input during the upload the parent directories, path/to/dir-3/, should not be included in the uploaded artifact
+      - name: 'Verify Artifact #3'
+        run: |
+          gzipFile="gzip/artifact/path/gzip.txt"
+          if [ ! -f $gzipFile ] ; then
+            echo "Expected file do not exist"
+            exit 1
+          fi
+          if [ "$(cat $gzipFile)" != "This is a going to be a test for a large enough file that should get compressed with GZip. The @actions/artifact package uses GZip to upload files. This text should have a compression ratio greater than 100% so it should get uploaded using GZip" ] ; then
+            echo "File contents of downloaded artifact is incorrect"
+            exit 1
+          fi
+      
+      - name: 'Download artifact #4'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Multi-Path-Artifact'
+          path: multi/artifact
+      
+      - name: 'Verify Artifact #4'
+        run: |
+          file1="multi/artifact/dir-1/file1.txt"
+          file2="multi/artifact/dir-2/file2.txt"
+          if [ ! -f $file1 -o ! -f $file2 ] ; then
+            echo "Expected files do not exist"
+            exit 1
+          fi
+          if [ "$(cat $file1)" != "Lorem ipsum dolor sit amet" -o "$(cat $file2)" != "Hello world from file #2" ] ; then
+            echo "File contents of downloaded artifacts are incorrect"
+            exit 1
+          fi
+      
+      - name: 'Download artifact #5'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Mid-Size-Artifact'
+          path: mid-size/artifact/path
+      
+      - name: 'Verify Artifact #5'
+        run: |
+          file="mid-size/artifact/path/file5.rnd"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if ! diff $file path/to/dir-5/file5.rnd ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+      
+      - name: 'Download artifact #6'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Big-Artifact'
+          path: big/artifact/path
+      
+      - name: 'Verify Artifact #6'
+        run: |
+          file="big/artifact/path/file6.rnd"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if ! diff $file path/to/dir-6/file6.rnd ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+
+      - name: 'Download artifact #7'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Big-Uploaded-Twice'
+          path: big-uploaded-twice/artifact/path
+
+      - name: 'Verify Artifact #7'
+        run: |
+          file="big-uploaded-twice/artifact/path/file7.rnd"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if ! diff $file path/to/dir-7/file7.rnd ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi

act/common/cartesian.go

@@ -4,8 +4,6 @@
 
 package common
 
-import "slices"
-
 // CartesianProduct takes map of lists and returns list of unique tuples
 func CartesianProduct(mapOfLists map[string][]any) []map[string]any {
 	listNames := make([]string, 0)
@@ -48,7 +46,7 @@ func cartN(a ...[]any) [][]any {
 		for j, n := range n {
 			pi[j] = a[j][n]
 		}
-		for j := range slices.Backward(n) {
+		for j := len(n) - 1; j >= 0; j-- {
 			n[j]++
 			if n[j] < len(a[j]) {
 				break

act/common/context_helpers_test.go

@@ -1,73 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-)
-
-func TestDryrunContext(t *testing.T) {
-	ctx := context.Background()
-	if Dryrun(ctx) {
-		t.Fatal("plain context should not be dryrun")
-	}
-	if !Dryrun(WithDryrun(ctx, true)) {
-		t.Fatal("WithDryrun(true) should set dryrun")
-	}
-	if Dryrun(WithDryrun(ctx, false)) {
-		t.Fatal("WithDryrun(false) should clear dryrun")
-	}
-}
-
-func TestJobErrorContainer(t *testing.T) {
-	ctx := context.Background()
-	err := errors.New("job failed")
-
-	SetJobError(ctx, err)
-	if got := JobError(ctx); got != nil {
-		t.Fatalf("JobError without container = %v, want nil", got)
-	}
-
-	ctx = WithJobErrorContainer(ctx)
-	SetJobError(ctx, err)
-	if got := JobError(ctx); !errors.Is(got, err) {
-		t.Fatalf("JobError = %v, want %v", got, err)
-	}
-}
-
-func TestLoggerAndHookContext(t *testing.T) {
-	ctx := context.Background()
-	if Logger(ctx) != logrus.StandardLogger() {
-		t.Fatal("plain context should use standard logger")
-	}
-	if LoggerHook(ctx) != nil {
-		t.Fatal("plain context should not have a logger hook")
-	}
-
-	logger := logrus.New()
-	ctx = WithLogger(ctx, logger)
-	if Logger(ctx) != logger {
-		t.Fatal("WithLogger should set logger")
-	}
-
-	hook := testHook{}
-	ctx = WithLoggerHook(ctx, hook)
-	if LoggerHook(ctx) != hook {
-		t.Fatal("WithLoggerHook should set hook")
-	}
-}
-
-type testHook struct{}
-
-func (testHook) Levels() []logrus.Level {
-	return logrus.AllLevels
-}
-
-func (testHook) Fire(*logrus.Entry) error {
-	return nil
-}

act/common/draw.go

@@ -0,0 +1,146 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package common
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+// Style is a specific style
+type Style int
+
+// Styles
+const (
+	StyleDoubleLine = iota
+	StyleSingleLine
+	StyleDashedLine
+	StyleNoLine
+)
+
+// NewPen creates a new pen
+func NewPen(style Style, color int) *Pen {
+	bgcolor := 49
+	if os.Getenv("CLICOLOR") == "0" {
+		color = 0
+		bgcolor = 0
+	}
+	return &Pen{
+		style:   style,
+		color:   color,
+		bgcolor: bgcolor,
+	}
+}
+
+type styleDef struct {
+	cornerTL string
+	cornerTR string
+	cornerBL string
+	cornerBR string
+	lineH    string
+	lineV    string
+}
+
+var styleDefs = []styleDef{
+	{"\u2554", "\u2557", "\u255a", "\u255d", "\u2550", "\u2551"},
+	{"\u256d", "\u256e", "\u2570", "\u256f", "\u2500", "\u2502"},
+	{"\u250c", "\u2510", "\u2514", "\u2518", "\u254c", "\u254e"},
+	{" ", " ", " ", " ", " ", " "},
+}
+
+// Pen struct
+type Pen struct {
+	style   Style
+	color   int
+	bgcolor int
+}
+
+// Drawing struct
+type Drawing struct {
+	buf   *strings.Builder
+	width int
+}
+
+func (p *Pen) drawTopBars(buf io.Writer, labels ...string) {
+	style := styleDefs[p.style]
+	for _, label := range labels {
+		bar := strings.Repeat(style.lineH, len(label)+2)
+		fmt.Fprintf(buf, " ")
+		fmt.Fprintf(buf, "\x1b[%d;%dm", p.color, p.bgcolor)
+		fmt.Fprintf(buf, "%s%s%s", style.cornerTL, bar, style.cornerTR)
+		fmt.Fprintf(buf, "\x1b[%dm", 0)
+	}
+	fmt.Fprintf(buf, "\n")
+}
+
+func (p *Pen) drawBottomBars(buf io.Writer, labels ...string) {
+	style := styleDefs[p.style]
+	for _, label := range labels {
+		bar := strings.Repeat(style.lineH, len(label)+2)
+		fmt.Fprintf(buf, " ")
+		fmt.Fprintf(buf, "\x1b[%d;%dm", p.color, p.bgcolor)
+		fmt.Fprintf(buf, "%s%s%s", style.cornerBL, bar, style.cornerBR)
+		fmt.Fprintf(buf, "\x1b[%dm", 0)
+	}
+	fmt.Fprintf(buf, "\n")
+}
+
+func (p *Pen) drawLabels(buf io.Writer, labels ...string) {
+	style := styleDefs[p.style]
+	for _, label := range labels {
+		fmt.Fprintf(buf, " ")
+		fmt.Fprintf(buf, "\x1b[%d;%dm", p.color, p.bgcolor)
+		fmt.Fprintf(buf, "%s %s %s", style.lineV, label, style.lineV)
+		fmt.Fprintf(buf, "\x1b[%dm", 0)
+	}
+	fmt.Fprintf(buf, "\n")
+}
+
+// DrawArrow between boxes
+func (p *Pen) DrawArrow() *Drawing {
+	drawing := &Drawing{
+		buf:   new(strings.Builder),
+		width: 1,
+	}
+	fmt.Fprintf(drawing.buf, "\x1b[%dm", p.color)
+	fmt.Fprintf(drawing.buf, "\u2b07")
+	fmt.Fprintf(drawing.buf, "\x1b[%dm", 0)
+	return drawing
+}
+
+// DrawBoxes to draw boxes
+func (p *Pen) DrawBoxes(labels ...string) *Drawing {
+	width := 0
+	for _, l := range labels {
+		width += len(l) + 2 + 2 + 1
+	}
+	drawing := &Drawing{
+		buf:   new(strings.Builder),
+		width: width,
+	}
+	p.drawTopBars(drawing.buf, labels...)
+	p.drawLabels(drawing.buf, labels...)
+	p.drawBottomBars(drawing.buf, labels...)
+
+	return drawing
+}
+
+// Draw to writer
+func (d *Drawing) Draw(writer io.Writer, centerOnWidth int) {
+	padSize := max((centerOnWidth-d.GetWidth())/2, 0)
+	for l := range strings.SplitSeq(d.buf.String(), "\n") {
+		if len(l) > 0 {
+			padding := strings.Repeat(" ", padSize)
+			fmt.Fprintf(writer, "%s%s\n", padding, l)
+		}
+	}
+}
+
+// GetWidth of drawing
+func (d *Drawing) GetWidth() int {
+	return d.width
+}

act/common/executor.go

@@ -12,6 +12,24 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+// Warning that implements `error` but safe to ignore
+type Warning struct {
+	Message string
+}
+
+// Error the contract for error
+func (w Warning) Error() string {
+	return w.Message
+}
+
+// Warningf create a warning
+func Warningf(format string, args ...any) Warning {
+	w := Warning{
+		Message: fmt.Sprintf(format, args...),
+	}
+	return w
+}
+
 // Executor define contract for the steps of a workflow
 type Executor func(ctx context.Context) error
 
@@ -79,12 +97,6 @@ func NewErrorExecutor(err error) Executor {
 
 // NewParallelExecutor creates a new executor from a parallel of other executors
 func NewParallelExecutor(parallel int, executors ...Executor) Executor {
-	if len(executors) == 0 {
-		return func(ctx context.Context) error {
-			return ctx.Err()
-		}
-	}
-
 	return func(ctx context.Context) error {
 		work := make(chan Executor, len(executors))
 		errs := make(chan error, len(executors))
@@ -144,8 +156,14 @@ func NewParallelExecutor(parallel int, executors ...Executor) Executor {
 // Then runs another executor if this executor succeeds
 func (e Executor) Then(then Executor) Executor {
 	return func(ctx context.Context) error {
-		if err := e(ctx); err != nil {
+		err := e(ctx)
-			return err
+		if err != nil {
+			switch err.(type) {
+			case Warning:
+				Logger(ctx).Warning(err.Error())
+			default:
+				return err
+			}
 		}
 		if ctx.Err() != nil {
 			return ctx.Err()

act/common/executor_parallel_advanced_test.go

@@ -170,6 +170,68 @@ func TestMaxParallelWithErrors(t *testing.T) {
 	})
 }
 
+// TestMaxParallelPerformance tests performance characteristics
+func TestMaxParallelPerformance(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping performance test in short mode")
+	}
+
+	t.Run("ParallelFasterThanSequential", func(t *testing.T) {
+		executors := make([]Executor, 10)
+		for i := range 10 {
+			executors[i] = func(ctx context.Context) error {
+				time.Sleep(50 * time.Millisecond)
+				return nil
+			}
+		}
+
+		ctx := context.Background()
+
+		// Sequential (max-parallel=1)
+		start := time.Now()
+		err := NewParallelExecutor(1, executors...)(ctx)
+		sequentialDuration := time.Since(start)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+		// Parallel (max-parallel=5)
+		start = time.Now()
+		err = NewParallelExecutor(5, executors...)(ctx)
+		parallelDuration := time.Since(start)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+		// Parallel should be significantly faster
+		assert.Less(t, parallelDuration, sequentialDuration/2,
+			"Parallel execution should be at least 2x faster")
+	})
+
+	t.Run("OptimalWorkerCount", func(t *testing.T) {
+		executors := make([]Executor, 20)
+		for i := range 20 {
+			executors[i] = func(ctx context.Context) error {
+				time.Sleep(10 * time.Millisecond)
+				return nil
+			}
+		}
+
+		ctx := context.Background()
+
+		// Test with different worker counts
+		workerCounts := []int{1, 2, 5, 10, 20}
+		durations := make(map[int]time.Duration)
+
+		for _, count := range workerCounts {
+			start := time.Now()
+			err := NewParallelExecutor(count, executors...)(ctx)
+			durations[count] = time.Since(start)
+			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+		}
+
+		// More workers should generally be faster (up to a point)
+		assert.Less(t, durations[5], durations[1], "5 workers should be faster than 1")
+		assert.Less(t, durations[10], durations[2], "10 workers should be faster than 2")
+	})
+}
+
 // TestMaxParallelResourceSharing tests resource sharing scenarios
 func TestMaxParallelResourceSharing(t *testing.T) {
 	t.Run("SharedResourceWithMutex", func(t *testing.T) {

act/common/executor_test.go

@@ -7,14 +7,11 @@ package common
 import (
 	"context"
 	"errors"
-	"reflect"
-	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestNewWorkflow(t *testing.T) {
@@ -122,19 +119,6 @@ func TestNewParallelExecutor(t *testing.T) {
 	assert.NoError(errSingle)
 }
 
-func TestNewParallelExecutorEmpty(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-	require.NoError(t, NewParallelExecutor(2)(ctx))
-
-	canceledCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	err := NewParallelExecutor(2)(canceledCtx)
-	assert.ErrorIs(err, context.Canceled)
-}
-
 func TestNewParallelExecutorFailed(t *testing.T) {
 	assert := assert.New(t)
 
@@ -172,43 +156,3 @@ func TestNewParallelExecutorCanceled(t *testing.T) {
 	assert.Equal(int32(3), count.Load())
 	assert.Error(errExpected, err) //nolint:testifylint // pre-existing issue from nektos/act
 }
-
-func TestExecutorConditionalsAndFinally(t *testing.T) {
-	ctx := context.Background()
-	var calls []string
-	record := func(name string) Executor {
-		return func(ctx context.Context) error {
-			calls = append(calls, name)
-			return nil
-		}
-	}
-
-	require.NoError(t, record("if-true").If(func(context.Context) bool { return true })(ctx))
-	require.NoError(t, record("if-false").If(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-not").IfNot(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-bool").IfBool(true)(ctx))
-	require.NoError(t, record("main").Finally(record("finally"))(ctx))
-
-	want := []string{"if-true", "if-not", "if-bool", "main", "finally"}
-	if !reflect.DeepEqual(calls, want) {
-		t.Fatalf("calls = %v, want %v", calls, want)
-	}
-}
-
-func TestExecutorFinallyReturnsFinallyErrorWithOriginal(t *testing.T) {
-	mainErr := errors.New("main failed")
-	finalErr := errors.New("cleanup failed")
-
-	err := NewErrorExecutor(mainErr).Finally(NewErrorExecutor(finalErr))(context.Background())
-	require.Error(t, err)
-	if !strings.Contains(err.Error(), "cleanup failed") || !strings.Contains(err.Error(), "main failed") {
-		t.Fatalf("finally error = %q, want both cleanup and original error", err)
-	}
-}
-
-func TestConditionalNot(t *testing.T) {
-	cond := Conditional(func(context.Context) bool { return false })
-	if !cond.Not()(context.Background()) {
-		t.Fatal("inverted conditional should be true")
-	}
-}

act/common/file.go

@@ -0,0 +1,77 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package common
+
+import (
+	"fmt"
+	"io"
+	"os"
+)
+
+// CopyFile copy file
+func CopyFile(source, dest string) (err error) {
+	sourcefile, err := os.Open(source)
+	if err != nil {
+		return err
+	}
+
+	defer sourcefile.Close()
+
+	destfile, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+
+	defer destfile.Close()
+
+	_, err = io.Copy(destfile, sourcefile)
+	if err == nil {
+		sourceinfo, err := os.Stat(source)
+		if err != nil {
+			_ = os.Chmod(dest, sourceinfo.Mode())
+		}
+	}
+
+	return err
+}
+
+// CopyDir recursive copy of directory
+func CopyDir(source, dest string) (err error) {
+	// get properties of source dir
+	sourceinfo, err := os.Stat(source)
+	if err != nil {
+		return err
+	}
+
+	// create dest dir
+
+	err = os.MkdirAll(dest, sourceinfo.Mode())
+	if err != nil {
+		return err
+	}
+
+	objects, err := os.ReadDir(source)
+
+	for _, obj := range objects {
+		sourcefilepointer := source + "/" + obj.Name()
+
+		destinationfilepointer := dest + "/" + obj.Name()
+
+		if obj.IsDir() {
+			// create sub-directories - recursively
+			err = CopyDir(sourcefilepointer, destinationfilepointer)
+			if err != nil {
+				fmt.Println(err) //nolint:forbidigo // pre-existing issue from nektos/act
+			}
+		} else {
+			// perform copy
+			err = CopyFile(sourcefilepointer, destinationfilepointer)
+			if err != nil {
+				fmt.Println(err) //nolint:forbidigo // pre-existing issue from nektos/act
+			}
+		}
+	}
+	return err
+}

act/common/git/git.go

@@ -38,11 +38,9 @@ var (
 	ErrNoRepo   = errors.New("unable to find git repo")
 )
 
-// AcquireCloneLock returns an unlock function after locking the per-directory mutex for dir.
+// acquireCloneLock returns an unlock function after locking the per-directory mutex for dir.
-// Only concurrent operations targeting the same directory are serialized; clones into different directories run in parallel.
+// Only concurrent operations targeting the same directory are erialized; clones into different directories run in parallel.
-// Callers reading files inside dir (e.g. tarring a checked-out action into a job container) must hold this lock too,
+func acquireCloneLock(dir string) func() {
-// otherwise a concurrent NewGitCloneExecutor on the same dir can mutate the worktree mid-read.
-func AcquireCloneLock(dir string) func() {
 	v, _ := cloneLocks.LoadOrStore(dir, &sync.Mutex{})
 	mu := v.(*sync.Mutex)
 	mu.Lock()
@@ -66,21 +64,8 @@ func (e *Error) Commit() string {
 	return e.commit
 }
 
-// goGitMu serializes go-git repository access across the process. go-git is not safe for
-// concurrent use of the same repository (even read access decodes packfiles into shared
-// state), so parallel jobs inspecting the shared workdir repo race without this. The guarded
-// operations are fast local reads; gitea runs one job per process, so the lock is effectively
-// uncontended in production.
-var goGitMu sync.Mutex
-
 // FindGitRevision get the current git revision
 func FindGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-	return findGitRevision(ctx, file)
-}
-
-func findGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
 	logger := common.Logger(ctx)
 
 	gitDir, err := git.PlainOpenWithOptions(
@@ -112,13 +97,10 @@ func findGitRevision(ctx context.Context, file string) (shortSha, sha string, er
 
 // FindGitRef get the current git ref
 func FindGitRef(ctx context.Context, file string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-
 	logger := common.Logger(ctx)
 
 	logger.Debugf("Loading revision from git directory")
-	_, ref, err := findGitRevision(ctx, file)
+	_, ref, err := FindGitRevision(ctx, file)
 	if err != nil {
 		return "", err
 	}
@@ -190,8 +172,6 @@ func FindGitRef(ctx context.Context, file string) (string, error) {
 
 // FindGithubRepo get the repo
 func FindGithubRepo(ctx context.Context, file, githubInstance, remoteName string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
 	if remoteName == "" {
 		remoteName = "origin"
 	}
@@ -257,77 +237,51 @@ type NewGitCloneExecutorInput struct {
 	Token       string
 	OfflineMode bool
 
-	// Depth limits the clone/fetch to the given number of commits from the tip of the requested ref.
-	// 0 for full clone.
-	Depth int
-
-	// Quiet drops the informational clone line to debug level, for callers that log their own
-	// download summary (the setup section's action report).
-	Quiet bool
-
 	// For Gitea
 	InsecureSkipTLS bool
 }
 
-// CloneIfRequired returns the repository and a boolean indicating whether an existing local clone was reused.
+// CloneIfRequired ...
-func CloneIfRequired(ctx context.Context, refName plumbing.ReferenceName, input NewGitCloneExecutorInput, logger log.FieldLogger) (*git.Repository, bool, error) {
+func CloneIfRequired(ctx context.Context, refName plumbing.ReferenceName, input NewGitCloneExecutorInput, logger log.FieldLogger) (*git.Repository, error) {
 	r, err := git.PlainOpen(input.Dir)
-	if err == nil {
-		// Verify the cached clone still points to the resolved URL before reusing it.
-		remote, err := r.Remote("origin")
-		if err == nil && len(remote.Config().URLs) > 0 && remote.Config().URLs[0] == input.URL {
-			// Reuse existing clone
-			return r, true, nil
-		}
-
-		if err != nil {
-			logger.Debugf("Removing cached clone at %s because origin cannot be read: %v", input.Dir, err)
-		} else if len(remote.Config().URLs) == 0 {
-			logger.Debugf("Removing cached clone at %s because origin has no URL", input.Dir)
-		} else {
-			logger.Debugf("Removing cached clone at %s because origin URL changed from %s to %s", input.Dir, remote.Config().URLs[0], input.URL)
-		}
-		if err := os.RemoveAll(input.Dir); err != nil {
-			return nil, false, fmt.Errorf("remove cached clone %s: %w", input.Dir, err)
-		}
-	}
-
-	var progressWriter io.Writer
-	if isatty.IsTerminal(os.Stdout.Fd()) || isatty.IsCygwinTerminal(os.Stdout.Fd()) {
-		if entry, ok := logger.(*log.Entry); ok {
-			progressWriter = entry.WriterLevel(log.DebugLevel)
-		} else if lgr, ok := logger.(*log.Logger); ok {
-			progressWriter = lgr.WriterLevel(log.DebugLevel)
-		} else {
-			log.Errorf("Unable to get writer from logger (type=%T)", logger)
-			progressWriter = os.Stdout
-		}
-	}
-
-	cloneOptions := git.CloneOptions{
-		URL:      input.URL,
-		Progress: progressWriter,
-
-		InsecureSkipTLS: input.InsecureSkipTLS, // For Gitea
-	}
-	if input.Token != "" {
-		cloneOptions.Auth = &http.BasicAuth{
-			Username: "token",
-			Password: input.Token,
-		}
-	}
-
-	r, err = cloneAtDepth(ctx, input, cloneOptions, logger)
 	if err != nil {
-		logger.Errorf("Unable to clone %v %s: %v", input.URL, refName, err)
+		var progressWriter io.Writer
-		return nil, false, err
+		if isatty.IsTerminal(os.Stdout.Fd()) || isatty.IsCygwinTerminal(os.Stdout.Fd()) {
+			if entry, ok := logger.(*log.Entry); ok {
+				progressWriter = entry.WriterLevel(log.DebugLevel)
+			} else if lgr, ok := logger.(*log.Logger); ok {
+				progressWriter = lgr.WriterLevel(log.DebugLevel)
+			} else {
+				log.Errorf("Unable to get writer from logger (type=%T)", logger)
+				progressWriter = os.Stdout
+			}
+		}
+
+		cloneOptions := git.CloneOptions{
+			URL:      input.URL,
+			Progress: progressWriter,
+
+			InsecureSkipTLS: input.InsecureSkipTLS, // For Gitea
+		}
+		if input.Token != "" {
+			cloneOptions.Auth = &http.BasicAuth{
+				Username: "token",
+				Password: input.Token,
+			}
+		}
+
+		r, err = git.PlainCloneContext(ctx, input.Dir, false, &cloneOptions)
+		if err != nil {
+			logger.Errorf("Unable to clone %v %s: %v", input.URL, refName, err)
+			return nil, err
+		}
+
+		if err = os.Chmod(input.Dir, 0o755); err != nil {
+			return nil, err
+		}
 	}
 
-	if err = os.Chmod(input.Dir, 0o755); err != nil {
+	return r, nil
-		return nil, false, err
-	}
-
-	return r, false, nil
 }
 
 func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.PullOptions) {
@@ -351,17 +305,13 @@ func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.Pu
 func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		if input.Quiet {
+		logger.Infof("  \u2601  git clone '%s' # ref=%s", input.URL, input.Ref)
-			logger.Debugf("git clone '%s' # ref=%s", input.URL, input.Ref)
-		} else {
-			logger.Infof("git clone '%s' # ref=%s", input.URL, input.Ref)
-		}
 		logger.Debugf("  cloning %s to %s", input.URL, input.Dir)
 
-		defer AcquireCloneLock(input.Dir)()
+		defer acquireCloneLock(input.Dir)()
 
 		refName := plumbing.ReferenceName("refs/heads/" + input.Ref)
-		r, reused, err := CloneIfRequired(ctx, refName, input, logger)
+		r, err := CloneIfRequired(ctx, refName, input, logger)
 		if err != nil {
 			return err
 		}
@@ -376,16 +326,6 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 			pullOptions.InsecureSkipTLS = true
 		}
 
-		// Action clones only ever need the tip commit, so keep a shallow cache cheap on update at depth 1 regardless of its original depth
-		// Turning action_shallow_clone off does not convert an existing shallow cache; evict it for a full clone.
-		shallow := isShallow(r)
-		if shallow {
-			fetchOptions.Depth = 1
-			if spec, ok := shallowFetchRefSpec(r, input.Ref); ok {
-				fetchOptions.RefSpecs = []config.RefSpec{spec}
-			}
-		}
-
 		if !isOfflineMode {
 			err = r.Fetch(&fetchOptions)
 			if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
@@ -396,10 +336,10 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 		var hash *plumbing.Hash
 		rev := plumbing.Revision(input.Ref)
 		if hash, err = r.ResolveRevision(rev); err != nil {
-			// ResolveRevision returns a nil hash on error, and a branch ref legitimately fails
-			// here (no local refs/heads/<ref>); the duck-typing below resolves it.
 			logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-		} else if hash.String() != input.Ref && strings.HasPrefix(hash.String(), input.Ref) {
+		}
+
+		if hash.String() != input.Ref && strings.HasPrefix(hash.String(), input.Ref) {
 			return &Error{
 				err:    ErrShortRef,
 				commit: hash.String(),
@@ -450,20 +390,12 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 				return err
 			}
 		}
-
+		if !isOfflineMode {
-		reusedMsg := ""
-
-		switch {
-		case !isOfflineMode && !shallow:
-			// In shallow mode the depth-limited fetch above already advanced the ref.
 			if err = w.Pull(&pullOptions); err != nil && err != git.NoErrAlreadyUpToDate {
 				logger.Debugf("Unable to pull %s: %v", refName, err)
 			}
-		case isOfflineMode && reused:
-			reusedMsg = " (reused in offline mode)"
 		}
-
+		logger.Debugf("Cloned %s to %s", input.URL, input.Dir)
-		logger.Debugf("Cloned %s to %s%s", input.URL, input.Dir, reusedMsg)
 
 		if hash.String() != input.Ref && refType == "branch" {
 			logger.Debugf("Provided ref is not a sha. Updating branch ref after pull")
@@ -492,53 +424,3 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 		return nil
 	}
 }
-
-// cloneAtDepth clones input.URL into input.Dir using opts.
-// With input.Depth > 0 it first tries a shallow, single-branch clone of input.Ref, falling back when error.
-func cloneAtDepth(ctx context.Context, input NewGitCloneExecutorInput, opts git.CloneOptions, logger log.FieldLogger) (*git.Repository, error) {
-	if input.Depth > 0 {
-		for _, refName := range []plumbing.ReferenceName{
-			plumbing.NewBranchReferenceName(input.Ref),
-			plumbing.NewTagReferenceName(input.Ref),
-		} {
-			shallowOpts := opts
-			shallowOpts.Depth = input.Depth
-			shallowOpts.SingleBranch = true
-			shallowOpts.ReferenceName = refName
-			shallowOpts.Tags = git.NoTags
-
-			r, err := git.PlainCloneContext(ctx, input.Dir, false, &shallowOpts)
-			if err == nil {
-				return r, nil
-			}
-			logger.Debugf("Shallow clone of %s as %s failed: %v", input.URL, refName, err)
-			if rmErr := os.RemoveAll(input.Dir); rmErr != nil {
-				return nil, fmt.Errorf("remove partial clone %s: %w", input.Dir, rmErr)
-			}
-		}
-		logger.Debugf("Falling back to a full clone of %s for ref %q", input.URL, input.Ref)
-	}
-
-	return git.PlainCloneContext(ctx, input.Dir, false, &opts)
-}
-
-// isShallow reports whether the local repository was cloned with a limited depth.
-func isShallow(r *git.Repository) bool {
-	shallows, err := r.Storer.Shallow()
-	return err == nil && len(shallows) > 0
-}
-
-// shallowFetchRefSpec returns the single refspec that updates only input.Ref, keeping a shallow clone from re-downloading every branch's history.
-// ok is false when the ref is not present locally as a tag or remote-tracking branch, in which case the broad default refspec is used.
-func shallowFetchRefSpec(r *git.Repository, ref string) (config.RefSpec, bool) {
-	tagRef := plumbing.NewTagReferenceName(ref)
-	if _, err := r.Reference(tagRef, false); err == nil {
-		return config.RefSpec(fmt.Sprintf("+%s:%s", tagRef, tagRef)), true
-	}
-	remoteRef := plumbing.NewRemoteReferenceName("origin", ref)
-	if _, err := r.Reference(remoteRef, false); err == nil {
-		branchRef := plumbing.NewBranchReferenceName(ref)
-		return config.RefSpec(fmt.Sprintf("+%s:%s", branchRef, remoteRef)), true
-	}
-	return "", false
-}

act/common/git/git_test.go

@@ -10,17 +10,13 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"sync"
 	"syscall"
 	"testing"
 	"time"
 
-	"gitea.com/gitea/runner/act/common"
-
 	log "github.com/sirupsen/logrus"
-	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -54,11 +50,8 @@ func TestFindGitSlug(t *testing.T) {
 	}
 }
 
-func TestErrorWrapsCommitAndCause(t *testing.T) {
+func testDir(t *testing.T) string {
-	err := &Error{err: ErrShortRef, commit: "abc123"}
+	return t.TempDir()
-	require.Equal(t, ErrShortRef.Error(), err.Error())
-	require.ErrorIs(t, err, ErrShortRef)
-	require.Equal(t, "abc123", err.Commit())
 }
 
 func cleanGitHooks(dir string) error {
@@ -85,7 +78,8 @@ func cleanGitHooks(dir string) error {
 func TestFindGitRemoteURL(t *testing.T) {
 	assert := assert.New(t)
 
-	basedir := t.TempDir()
+	basedir := testDir(t)
+	gitConfig()
 	err := gitCmd("init", basedir)
 	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
 	err = cleanGitHooks(basedir)
@@ -107,24 +101,9 @@ func TestFindGitRemoteURL(t *testing.T) {
 	assert.Equal(remoteURL, u)
 }
 
-func TestFindGithubRepoUsesOriginAndCustomRemote(t *testing.T) {
-	basedir := t.TempDir()
-	require.NoError(t, gitCmd("init", basedir))
-	require.NoError(t, cleanGitHooks(basedir))
-	require.NoError(t, gitCmd("-C", basedir, "remote", "add", "origin", "https://github.com/owner/repo.git"))
-	require.NoError(t, gitCmd("-C", basedir, "remote", "add", "ghe", "git@git.example.com:team/project.git"))
-
-	slug, err := FindGithubRepo(context.Background(), basedir, "github.com", "")
-	require.NoError(t, err)
-	require.Equal(t, "owner/repo", slug)
-
-	slug, err = FindGithubRepo(context.Background(), basedir, "git.example.com", "ghe")
-	require.NoError(t, err)
-	require.Equal(t, "team/project", slug)
-}
-
 func TestGitFindRef(t *testing.T) {
-	basedir := t.TempDir()
+	basedir := testDir(t)
+	gitConfig()
 
 	for name, tt := range map[string]struct {
 		Prepare func(t *testing.T, dir string)
@@ -201,55 +180,36 @@ func TestGitFindRef(t *testing.T) {
 }
 
 func TestGitCloneExecutor(t *testing.T) {
-	// Build a local bare "remote" so this runs offline and fast. The cases below mirror
-	// the tag/branch/sha/short-sha ref paths the executor handles, formerly exercised by
-	// cloning actions/checkout and anchore/scan-action over the network.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v2"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v2"))
-
-	// A branch with a dash in the name (mirrors the historical scan-action@act-fails case).
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "act-fails"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "branch-commit"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "act-fails"))
-
-	out, err := exec.Command("git", "-C", workDir, "rev-parse", "main").Output()
-	require.NoError(t, err)
-	fullSha := strings.TrimSpace(string(out))
-
 	for name, tt := range map[string]struct {
-		Err error
+		Err      error
-		Ref string
+		URL, Ref string
 	}{
 		"tag": {
 			Err: nil,
+			URL: "https://github.com/actions/checkout",
 			Ref: "v2",
 		},
 		"branch": {
 			Err: nil,
+			URL: "https://github.com/anchore/scan-action",
 			Ref: "act-fails",
 		},
 		"sha": {
 			Err: nil,
-			Ref: fullSha,
+			URL: "https://github.com/actions/checkout",
+			Ref: "5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f", // v2
 		},
 		"short-sha": {
-			Err: &Error{ErrShortRef, fullSha},
+			Err: &Error{ErrShortRef, "5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f"},
-			Ref: fullSha[:7],
+			URL: "https://github.com/actions/checkout",
+			Ref: "5a4ac90", // v2
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			clone := NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL: remoteDir,
+				URL: tt.URL,
 				Ref: tt.Ref,
-				Dir: t.TempDir(),
+				Dir: testDir(t),
 			})
 
 			err := clone(context.Background())
@@ -263,56 +223,13 @@ func TestGitCloneExecutor(t *testing.T) {
 	}
 }
 
-func TestGitCloneExecutorReclonesWhenOriginURLChanges(t *testing.T) {
-	createRemote := func(message string) string {
-		remoteDir := t.TempDir()
-		require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-		workDir := t.TempDir()
-		require.NoError(t, gitCmd("clone", remoteDir, workDir))
-		require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", message))
-		require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-		return remoteDir
-	}
-
-	oldRemoteDir := createRemote("old-action")
-	newRemoteDir := createRemote("new-action")
-	cacheDir := t.TempDir()
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: oldRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	markerPath := filepath.Join(cacheDir, "stale-marker")
-	require.NoError(t, os.WriteFile(markerPath, []byte("stale"), 0o644))
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: newRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	originURL, err := findGitRemoteURL(t.Context(), cacheDir, "origin")
-	require.NoError(t, err)
-	assert.Equal(t, newRemoteDir, originURL)
-
-	out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	assert.Equal(t, "new-action", strings.TrimSpace(string(out)))
-
-	_, err = os.Stat(markerPath)
-	require.True(t, os.IsNotExist(err), "stale cached directory should be removed before recloning")
-}
-
 func TestGitCloneExecutorNonFastForwardRef(t *testing.T) {
 	// Simulate the scenario where a remote ref (e.g. a GitHub PR head ref) changes
 	// non-fast-forward between two fetches. Before the fix, the fetch used Force=false,
 	// causing go-git to return ErrForceNeeded and short-circuit the checkout.
 
+	gitConfig()
+
 	// Create a bare "remote" repo with an initial commit on main and a feature branch.
 	remoteDir := t.TempDir()
 	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
@@ -362,195 +279,22 @@ func TestGitCloneExecutorNonFastForwardRef(t *testing.T) {
 	assert.Equal(t, "second", strings.TrimSpace(string(out)), "working tree should be at the latest commit")
 }
 
-func TestGitCloneExecutorOfflineMode(t *testing.T) {
+func gitConfig() {
-	// Build a local "remote" with a single commit on main.
+	if os.Getenv("GITHUB_ACTIONS") == "true" {
-	remoteDir := t.TempDir()
+		var err error
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
+		if err = gitCmd("config", "--global", "user.email", "test@test.com"); err != nil {
-	workDir := t.TempDir()
+			log.Error(err)
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
+		}
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
+		if err = gitCmd("config", "--global", "user.name", "Unit Test"); err != nil {
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
+			log.Error(err)
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
+		}
-
-	// Prime the cache with an online clone of main.
-	cacheDir := t.TempDir()
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: remoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(context.Background()))
-
-	t.Run("cached branch resolves without fetching", func(t *testing.T) {
-		// Offline reuse of a cached branch must succeed even though ResolveRevision(input.Ref)
-		// finds no local refs/heads/<ref>.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "main",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.NoError(t, err)
-
-		out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-		require.NoError(t, err)
-		assert.Equal(t, "initial", strings.TrimSpace(string(out)))
-	})
-
-	t.Run("unresolvable cached ref returns error", func(t *testing.T) {
-		// The ref was never cached; offline mode cannot resolve it and must return an error.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "never-fetched",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.Error(t, err)
-	})
-}
-
-func TestGitCloneExecutorQuietDemotesCloneLine(t *testing.T) {
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Quiet callers report the download themselves, so the clone line must not reach the job log.
-	for name, quiet := range map[string]bool{"quiet": true, "not quiet": false} {
-		t.Run(name, func(t *testing.T) {
-			logger, hook := logrustest.NewNullLogger()
-			logger.SetLevel(log.InfoLevel)
-			ctx := common.WithLogger(context.Background(), logger.WithField("job", "j1"))
-
-			require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL:   remoteDir,
-				Ref:   "main",
-				Dir:   t.TempDir(),
-				Quiet: quiet,
-			})(ctx))
-
-			var cloneLines int
-			for _, entry := range hook.AllEntries() {
-				if strings.HasPrefix(entry.Message, "git clone ") {
-					cloneLines++
-				}
-			}
-			if quiet {
-				assert.Zero(t, cloneLines)
-			} else {
-				assert.Equal(t, 1, cloneLines)
-			}
-		})
 	}
 }
 
-func TestGitCloneExecutorShallow(t *testing.T) {
-	// Build a local "remote" with several commits on main plus a tag, so a full clone would pull noticeably more history than a shallow one.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	for _, m := range []string{"c1", "c2", "c3"} {
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", m))
-	}
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v1"))
-	sha := gitRevParse(t, workDir, "HEAD~1") // c2, a SHA that go-git cannot shallow-clone
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v1"))
-
-	shallowMarker := func(dir string) string { return filepath.Join(dir, ".git", "shallow") }
-
-	t.Run("branch is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir), "only the tip commit should be present")
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("tag is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "v1", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("SHA falls back to a full clone", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: sha, Dir: dir, Depth: 1,
-		})(t.Context()))
-		// go-git cannot shallow-clone a raw SHA, so it falls back to a full clone; the absence of a shallow marker proves the fallback happened.
-		assert.NoFileExists(t, shallowMarker(dir), "a SHA ref must not produce a shallow clone")
-		assert.Equal(t, sha, gitRevParse(t, dir, "HEAD"))
-	})
-
-	t.Run("moving branch updates while staying shallow", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		require.Equal(t, "c3", gitHeadSubject(t, dir))
-
-		// Advance main on the remote, then reuse the existing shallow clone.
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "c4"))
-		require.NoError(t, gitCmd("-C", workDir, "push", "origin", "main"))
-
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.Equal(t, "c4", gitHeadSubject(t, dir), "reused shallow clone should update to the new tip")
-		assert.FileExists(t, shallowMarker(dir), "repo should remain shallow after update")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-	})
-}
-
-func gitRevParse(t *testing.T, dir, rev string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-parse", rev).Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
-func gitRevCount(t *testing.T, dir string) int {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--count", "HEAD").Output()
-	require.NoError(t, err)
-	n, err := strconv.Atoi(strings.TrimSpace(string(out)))
-	require.NoError(t, err)
-	return n
-}
-
-func gitHeadSubject(t *testing.T, dir string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
 func gitCmd(args ...string) error {
 	cmd := exec.Command("git", args...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
-	// Inject a deterministic identity and ignore the host's global/system config so commits
-	// succeed regardless of the host having no user.name/user.email (e.g. CI, GITHUB_ACTIONS
-	// unset) or a global commit.gpgsign, and without mutating the developer's ~/.gitconfig.
-	cmd.Env = append(os.Environ(),
-		"GIT_AUTHOR_NAME=Unit Test",
-		"GIT_AUTHOR_EMAIL=test@test.com",
-		"GIT_COMMITTER_NAME=Unit Test",
-		"GIT_COMMITTER_EMAIL=test@test.com",
-		"GIT_CONFIG_GLOBAL=/dev/null",
-		"GIT_CONFIG_SYSTEM=/dev/null",
-	)
 
 	err := cmd.Run()
 	if exitError, ok := err.(*exec.ExitError); ok {
@@ -566,11 +310,11 @@ func TestAcquireCloneLock(t *testing.T) {
 	t.Run("same directory serializes", func(t *testing.T) {
 		dir := t.TempDir()
 
-		unlock1 := AcquireCloneLock(dir)
+		unlock1 := acquireCloneLock(dir)
 
 		secondAcquired := make(chan struct{})
 		go func() {
-			unlock := AcquireCloneLock(dir)
+			unlock := acquireCloneLock(dir)
 			close(secondAcquired)
 			unlock()
 		}()
@@ -594,12 +338,12 @@ func TestAcquireCloneLock(t *testing.T) {
 		dirA := t.TempDir()
 		dirB := t.TempDir()
 
-		unlockA := AcquireCloneLock(dirA)
+		unlockA := acquireCloneLock(dirA)
 		defer unlockA()
 
 		done := make(chan struct{})
 		go func() {
-			unlock := AcquireCloneLock(dirB)
+			unlock := acquireCloneLock(dirB)
 			unlock()
 			close(done)
 		}()

act/common/job_error.go

@@ -24,9 +24,7 @@ func JobError(ctx context.Context) error {
 }
 
 func SetJobError(ctx context.Context, err error) {
-	if container, ok := ctx.Value(jobErrorContextKeyVal).(map[string]error); ok {
+	ctx.Value(jobErrorContextKeyVal).(map[string]error)["error"] = err
-		container["error"] = err
-	}
 }
 
 // WithJobErrorContainer adds a value to the context as a container for an error

act/common/line_writer.go

@@ -12,13 +12,6 @@ import (
 // LineHandler is a callback function for handling a line
 type LineHandler func(line string) bool
 
-// Flusher is implemented by writers that buffer a trailing, not-yet-terminated
-// line. Callers should flush once the underlying stream has reached EOF so the
-// final line (when it is not newline-terminated) is not lost.
-type Flusher interface {
-	Flush()
-}
-
 type lineWriter struct {
 	buffer   bytes.Buffer
 	handlers []LineHandler
@@ -31,14 +24,6 @@ func NewLineWriter(handlers ...LineHandler) io.Writer {
 	return w
 }
 
-// FlushWriter flushes w if it implements Flusher. It is a no-op otherwise, so
-// callers can flush an io.Writer without knowing its concrete type.
-func FlushWriter(w io.Writer) {
-	if f, ok := w.(Flusher); ok {
-		f.Flush()
-	}
-}
-
 func (lw *lineWriter) Write(p []byte) (n int, err error) {
 	pBuf := bytes.NewBuffer(p)
 	written := 0
@@ -59,17 +44,6 @@ func (lw *lineWriter) Write(p []byte) (n int, err error) {
 	return written, nil
 }
 
-// Flush emits any buffered, not-yet-newline-terminated content as a final line.
-// It is safe to call multiple times; subsequent calls with an empty buffer are
-// no-ops.
-func (lw *lineWriter) Flush() {
-	if lw.buffer.Len() == 0 {
-		return
-	}
-	lw.handleLine(lw.buffer.String())
-	lw.buffer.Reset()
-}
-
 func (lw *lineWriter) handleLine(line string) {
 	for _, h := range lw.handlers {
 		ok := h(line)

act/common/line_writer_test.go

@@ -5,7 +5,6 @@
 package common
 
 import (
-	"io"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -40,33 +39,3 @@ func TestLineWriter(t *testing.T) {
 	assert.Equal(" and another\n", lines[2])
 	assert.Equal("last line\n", lines[3])
 }
-
-func TestLineWriterFlush(t *testing.T) {
-	lines := make([]string, 0)
-	lineHandler := func(s string) bool {
-		lines = append(lines, s)
-		return true
-	}
-
-	lineWriter := NewLineWriter(lineHandler)
-
-	assert := assert.New(t)
-	_, err := lineWriter.Write([]byte("complete line\npartial line without newline"))
-	assert.NoError(err) //nolint:testifylint // pre-existing pattern from nektos/act
-
-	// Only the newline-terminated line is emitted before flushing.
-	assert.Equal([]string{"complete line\n"}, lines)
-
-	// Flushing emits the buffered, not-yet-terminated trailing line.
-	FlushWriter(lineWriter)
-	assert.Equal([]string{"complete line\n", "partial line without newline"}, lines)
-
-	// Flushing again is a no-op: nothing is buffered.
-	FlushWriter(lineWriter)
-	assert.Len(lines, 2)
-}
-
-func TestFlushWriterIgnoresNonFlusher(t *testing.T) {
-	// FlushWriter must be a safe no-op for writers that do not buffer lines.
-	assert.NotPanics(t, func() { FlushWriter(io.Discard) })
-}

act/container/container_types.go

@@ -6,7 +6,6 @@ package container
 
 import (
 	"context"
-	"fmt"
 	"io"
 
 	"gitea.com/gitea/runner/act/common"
@@ -14,13 +13,6 @@ import (
 	"github.com/docker/go-connections/nat"
 )
 
-// ExitCodeError reports a non-zero process exit code from a container command.
-type ExitCodeError int
-
-func (e ExitCodeError) Error() string {
-	return fmt.Sprintf("Process completed with exit code %d.", int(e))
-}
-
 // NewContainerInput the input for the New function
 type NewContainerInput struct {
 	Image          string
@@ -47,7 +39,6 @@ type NewContainerInput struct {
 	// Gitea specific
 	AutoRemove   bool
 	ValidVolumes []string
-	AllocatePTY  bool // allocate a pseudo-TTY for the container's exec processes
 }
 
 // FileEntry is a file to copy to a container
@@ -84,12 +75,6 @@ type NewDockerBuildExecutorInput struct {
 	Platform     string
 }
 
-// NewDockerNetworkCreateExecutorInput the input for the NewDockerNetworkCreateExecutor function
-type NewDockerNetworkCreateExecutorInput struct {
-	EnableIPv4 *bool
-	EnableIPv6 *bool
-}
-
 // NewDockerPullExecutorInput the input for the NewDockerPullExecutor function
 type NewDockerPullExecutorInput struct {
 	Image     string

act/container/docker_auth.go

@@ -8,33 +8,34 @@ package container
 
 import (
 	"context"
+	"strings"
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/distribution/reference"
 	"github.com/docker/cli/cli/config"
-	"github.com/moby/moby/api/types/registry"
+	"github.com/docker/cli/cli/config/credentials"
+	"github.com/docker/docker/api/types/registry"
 )
 
 func LoadDockerAuthConfig(ctx context.Context, image string) (registry.AuthConfig, error) {
 	logger := common.Logger(ctx)
-	// config.LoadDefaultConfigFile panics on nil io.Writer when the config
+	config, err := config.Load(config.Dir())
-	// file is malformed; use config.Load to route errors through the logger.
-	cfg, err := config.Load(config.Dir())
 	if err != nil {
 		logger.Warnf("Could not load docker config: %v", err)
 		return registry.AuthConfig{}, err
 	}
-	registryKey := registryAuthConfigKey("docker.io")
+
-	if image != "" {
+	if !config.ContainsAuth() {
-		if registryRef, refErr := reference.ParseNormalizedNamed(image); refErr != nil {
+		config.CredentialsStore = credentials.DetectDefaultStore(config.CredentialsStore)
-			logger.Warnf("Could not normalize image reference: %v", refErr)
-		} else {
-			registryKey = registryAuthConfigKey(reference.Domain(registryRef))
-		}
 	}
 
-	authConfig, err := cfg.GetAuthConfig(registryKey)
+	hostName := "index.docker.io"
+	index := strings.IndexRune(image, '/')
+	if index > -1 && (strings.ContainsAny(image[:index], ".:") || image[:index] == "localhost") {
+		hostName = image[:index]
+	}
+
+	authConfig, err := config.GetAuthConfig(hostName)
 	if err != nil {
 		logger.Warnf("Could not get auth config from docker config: %v", err)
 		return registry.AuthConfig{}, err
@@ -45,16 +46,17 @@ func LoadDockerAuthConfig(ctx context.Context, image string) (registry.AuthConfi
 
 func LoadDockerAuthConfigs(ctx context.Context) map[string]registry.AuthConfig {
 	logger := common.Logger(ctx)
-	cfg, err := config.Load(config.Dir())
+	config, err := config.Load(config.Dir())
 	if err != nil {
 		logger.Warnf("Could not load docker config: %v", err)
 		return nil
 	}
-	creds, err := cfg.GetAllCredentials()
+
-	if err != nil {
+	if !config.ContainsAuth() {
-		logger.Warnf("Could not get docker auth configs: %v", err)
+		config.CredentialsStore = credentials.DetectDefaultStore(config.CredentialsStore)
-		return nil
 	}
+
+	creds, _ := config.GetAllCredentials()
 	authConfigs := make(map[string]registry.AuthConfig, len(creds))
 	for k, v := range creds {
 		authConfigs[k] = registry.AuthConfig(v)
@@ -62,10 +64,3 @@ func LoadDockerAuthConfigs(ctx context.Context) map[string]registry.AuthConfig {
 
 	return authConfigs
 }
-
-func registryAuthConfigKey(domainName string) string {
-	if domainName == "docker.io" || domainName == "index.docker.io" {
-		return "https://index.docker.io/v1/"
-	}
-	return domainName
-}

act/container/docker_build.go

@@ -14,12 +14,10 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/go-archive"
+	"github.com/docker/docker/api/types"
-	"github.com/moby/go-archive/compression"
+	"github.com/docker/docker/pkg/archive"
-	"github.com/moby/moby/client"
+	"github.com/moby/buildkit/frontend/dockerfile/dockerignore"
 	"github.com/moby/patternmatcher"
-	"github.com/moby/patternmatcher/ignorefile"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // NewDockerBuildExecutor function to create a run executor for the container
@@ -27,9 +25,9 @@ func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		if input.Platform != "" {
-			logger.Infof("docker build -t %s --platform %s %s", input.ImageTag, input.Platform, input.ContextDir)
+			logger.Infof("%sdocker build -t %s --platform %s %s", logPrefix, input.ImageTag, input.Platform, input.ContextDir)
 		} else {
-			logger.Infof("docker build -t %s %s", input.ImageTag, input.ContextDir)
+			logger.Infof("%sdocker build -t %s %s", logPrefix, input.ImageTag, input.ContextDir)
 		}
 		if common.Dryrun(ctx) {
 			return nil
@@ -44,19 +42,13 @@ func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 		logger.Debugf("Building image from '%v'", input.ContextDir)
 
 		tags := []string{input.ImageTag}
-		options := client.ImageBuildOptions{
+		options := types.ImageBuildOptions{
 			Tags:        tags,
 			Remove:      true,
+			Platform:    input.Platform,
 			AuthConfigs: LoadDockerAuthConfigs(ctx),
 			Dockerfile:  input.Dockerfile,
 		}
-		platform, err := parsePlatform(input.Platform)
-		if err != nil {
-			return err
-		}
-		if platform != nil {
-			options.Platforms = []specs.Platform{*platform}
-		}
 		var buildContext io.ReadCloser
 		if input.BuildContext != nil {
 			buildContext = io.NopCloser(input.BuildContext)
@@ -84,7 +76,7 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 	common.Logger(ctx).Debugf("Creating archive for build context dir '%s' with relative dockerfile '%s'", contextDir, relDockerfile)
 
 	// And canonicalize dockerfile name to a platform-independent one
-	relDockerfile = filepath.ToSlash(relDockerfile)
+	relDockerfile = archive.CanonicalTarNameForPath(relDockerfile)
 
 	f, err := os.Open(filepath.Join(contextDir, ".dockerignore"))
 	if err != nil && !os.IsNotExist(err) {
@@ -94,7 +86,7 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 
 	var excludes []string
 	if err == nil {
-		excludes, err = ignorefile.ReadAll(f)
+		excludes, err = dockerignore.ReadAll(f) //nolint:staticcheck // pre-existing issue from nektos/act
 		if err != nil {
 			return nil, err
 		}
@@ -114,8 +106,9 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 		includes = append(includes, ".dockerignore", relDockerfile)
 	}
 
+	compression := archive.Uncompressed
 	buildCtx, err := archive.TarWithOptions(contextDir, &archive.TarOptions{
-		Compression:     compression.None,
+		Compression:     compression,
 		ExcludePatterns: excludes,
 		IncludeFiles:    includes,
 	})

act/container/docker_cli_test.go

@@ -16,18 +16,15 @@ package container
 import (
 	"fmt"
 	"io"
-	"net/netip"
 	"os"
 	"runtime"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/docker/docker/api/types/container"
+	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/go-connections/nat"
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/moby/moby/api/types/container"
-	networktypes "github.com/moby/moby/api/types/network"
 	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
 	"gotest.tools/v3/assert"
@@ -80,21 +77,21 @@ func setupRunFlags() (*pflag.FlagSet, *containerOptions) {
 	return flags, copts
 }
 
-func mustParse(t *testing.T, args string) (*container.Config, *container.HostConfig, *networktypes.NetworkingConfig) {
+func mustParse(t *testing.T, args string) (*container.Config, *container.HostConfig) {
 	t.Helper()
-	config, hostConfig, networkingConfig, err := parseRun(append(strings.Split(args, " "), "ubuntu", "bash"))
+	config, hostConfig, _, err := parseRun(append(strings.Split(args, " "), "ubuntu", "bash"))
 	assert.NilError(t, err)
-	return config, hostConfig, networkingConfig
+	return config, hostConfig
 }
 
 func TestParseRunLinks(t *testing.T) {
-	if _, hostConfig, _ := mustParse(t, "--link a:b"); len(hostConfig.Links) == 0 || hostConfig.Links[0] != "a:b" {
+	if _, hostConfig := mustParse(t, "--link a:b"); len(hostConfig.Links) == 0 || hostConfig.Links[0] != "a:b" {
 		t.Fatalf("Error parsing links. Expected []string{\"a:b\"}, received: %v", hostConfig.Links)
 	}
-	if _, hostConfig, _ := mustParse(t, "--link a:b --link c:d"); len(hostConfig.Links) < 2 || hostConfig.Links[0] != "a:b" || hostConfig.Links[1] != "c:d" {
+	if _, hostConfig := mustParse(t, "--link a:b --link c:d"); len(hostConfig.Links) < 2 || hostConfig.Links[0] != "a:b" || hostConfig.Links[1] != "c:d" {
 		t.Fatalf("Error parsing links. Expected []string{\"a:b\", \"c:d\"}, received: %v", hostConfig.Links)
 	}
-	if _, hostConfig, _ := mustParse(t, ""); len(hostConfig.Links) != 0 {
+	if _, hostConfig := mustParse(t, ""); len(hostConfig.Links) != 0 {
 		t.Fatalf("Error parsing links. No link expected, received: %v", hostConfig.Links)
 	}
 }
@@ -143,7 +140,7 @@ func TestParseRunAttach(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.input, func(t *testing.T) {
-			config, _, _ := mustParse(t, tc.input)
+			config, _ := mustParse(t, tc.input)
 			assert.Equal(t, config.AttachStdin, tc.expected.AttachStdin)
 			assert.Equal(t, config.AttachStdout, tc.expected.AttachStdout)
 			assert.Equal(t, config.AttachStderr, tc.expected.AttachStderr)
@@ -197,10 +194,10 @@ func TestParseRunWithInvalidArgs(t *testing.T) {
 	}
 }
 
-func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from docker/cli tests
+func TestParseWithVolumes(t *testing.T) {
 	// A single volume
 	arr, tryit := setupPlatformVolume([]string{`/tmp`}, []string{`c:\tmp`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds != nil {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds != nil {
 		t.Fatalf("Error parsing volume flags, %q should not mount-bind anything. Received %v", tryit, hostConfig.Binds)
 	} else if _, exists := config.Volumes[arr[0]]; !exists {
 		t.Fatalf("Error parsing volume flags, %q is missing from volumes. Received %v", tryit, config.Volumes)
@@ -208,7 +205,7 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 
 	// Two volumes
 	arr, tryit = setupPlatformVolume([]string{`/tmp`, `/var`}, []string{`c:\tmp`, `c:\var`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds != nil {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds != nil {
 		t.Fatalf("Error parsing volume flags, %q should not mount-bind anything. Received %v", tryit, hostConfig.Binds)
 	} else if _, exists := config.Volumes[arr[0]]; !exists {
 		t.Fatalf("Error parsing volume flags, %s is missing from volumes. Received %v", arr[0], config.Volumes)
@@ -218,13 +215,13 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 
 	// A single bind mount
 	arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp`}, []string{os.Getenv("TEMP") + `:c:\containerTmp`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || hostConfig.Binds[0] != arr[0] {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || hostConfig.Binds[0] != arr[0] {
 		t.Fatalf("Error parsing volume flags, %q should mount-bind the path before the colon into the path after the colon. Received %v %v", arr[0], hostConfig.Binds, config.Volumes)
 	}
 
 	// Two bind mounts.
 	arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp`, `/hostVar:/containerVar`}, []string{os.Getenv("ProgramData") + `:c:\ContainerPD`, os.Getenv("TEMP") + `:c:\containerTmp`})
-	if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+	if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 		t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 	}
 
@@ -233,26 +230,26 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 	arr, tryit = setupPlatformVolume(
 		[]string{`/hostTmp:/containerTmp:ro`, `/hostVar:/containerVar:rw`},
 		[]string{os.Getenv("TEMP") + `:c:\containerTmp:rw`, os.Getenv("ProgramData") + `:c:\ContainerPD:rw`})
-	if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+	if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 		t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 	}
 
 	// Similar to previous test but with alternate modes which are only supported by Linux
 	if runtime.GOOS != "windows" {
 		arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp:ro,Z`, `/hostVar:/containerVar:rw,Z`}, []string{})
-		if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+		if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 			t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 		}
 
 		arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp:Z`, `/hostVar:/containerVar:z`}, []string{})
-		if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+		if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 			t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 		}
 	}
 
 	// One bind mount and one volume
 	arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp`, `/containerVar`}, []string{os.Getenv("TEMP") + `:c:\containerTmp`, `c:\containerTmp`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] {
 		t.Fatalf("Error parsing volume flags, %s and %s should only one and only one bind mount %s. Received %s", arr[0], arr[1], arr[0], hostConfig.Binds)
 	} else if _, exists := config.Volumes[arr[1]]; !exists {
 		t.Fatalf("Error parsing volume flags %s and %s. %s is missing from volumes. Received %v", arr[0], arr[1], arr[1], config.Volumes)
@@ -261,7 +258,7 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 	// Root to non-c: drive letter (Windows specific)
 	if runtime.GOOS == "windows" {
 		arr, tryit = setupPlatformVolume([]string{}, []string{os.Getenv("SystemDrive") + `\:d:`})
-		if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] || len(config.Volumes) != 0 {
+		if config, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] || len(config.Volumes) != 0 {
 			t.Fatalf("Error parsing %s. Should have a single bind mount and no volumes", arr[0])
 		}
 	}
@@ -297,36 +294,6 @@ func compareRandomizedStrings(a, b, c, d string) error {
 	return errors.Errorf("strings don't match")
 }
 
-func mustNetworkPort(t *testing.T, value string) networktypes.Port {
-	t.Helper()
-
-	port, err := networktypes.ParsePort(value)
-	if err != nil {
-		t.Fatalf("failed to parse network port %q: %v", value, err)
-	}
-	return port
-}
-
-func mustAddr(t *testing.T, value string) netip.Addr {
-	t.Helper()
-
-	addr, err := netip.ParseAddr(value)
-	if err != nil {
-		t.Fatalf("failed to parse address %q: %v", value, err)
-	}
-	return addr
-}
-
-func mustAddrs(t *testing.T, values ...string) []netip.Addr {
-	t.Helper()
-
-	addrs := make([]netip.Addr, 0, len(values))
-	for _, value := range values {
-		addrs = append(addrs, mustAddr(t, value))
-	}
-	return addrs
-}
-
 // Simple parse with MacAddress validation
 func TestParseWithMacAddress(t *testing.T) {
 	invalidMacAddress := "--mac-address=invalidMacAddress"
@@ -334,10 +301,9 @@ func TestParseWithMacAddress(t *testing.T) {
 	if _, _, _, err := parseRun([]string{invalidMacAddress, "img", "cmd"}); err != nil && err.Error() != "invalidMacAddress is not a valid mac address" {
 		t.Fatalf("Expected an error with %v mac-address, got %v", invalidMacAddress, err)
 	}
-	_, hostConfig, networkingConfig := mustParse(t, validMacAddress)
+	if config, _ := mustParse(t, validMacAddress); config.MacAddress != "92:d0:c6:0a:29:33" { //nolint:staticcheck // pre-existing issue from nektos/act
-	endpoint := networkingConfig.EndpointsConfig[string(hostConfig.NetworkMode)]
+		t.Fatalf("Expected the config to have '92:d0:c6:0a:29:33' as MacAddress, got '%v'", config.MacAddress) //nolint:staticcheck // pre-existing issue from nektos/act
-	assert.Check(t, endpoint != nil)
+	}
-	assert.Equal(t, "92:d0:c6:0a:29:33", endpoint.MacAddress.String())
 }
 
 func TestRunFlagsParseWithMemory(t *testing.T) {
@@ -346,7 +312,7 @@ func TestRunFlagsParseWithMemory(t *testing.T) {
 	err := flags.Parse(args)
 	assert.ErrorContains(t, err, `invalid argument "invalid" for "-m, --memory" flag`)
 
-	_, hostconfig, _ := mustParse(t, "--memory=1G")
+	_, hostconfig := mustParse(t, "--memory=1G")
 	assert.Check(t, is.Equal(int64(1073741824), hostconfig.Memory))
 }
 
@@ -356,10 +322,10 @@ func TestParseWithMemorySwap(t *testing.T) {
 	err := flags.Parse(args)
 	assert.ErrorContains(t, err, `invalid argument "invalid" for "--memory-swap" flag`)
 
-	_, hostconfig, _ := mustParse(t, "--memory-swap=1G")
+	_, hostconfig := mustParse(t, "--memory-swap=1G")
 	assert.Check(t, is.Equal(int64(1073741824), hostconfig.MemorySwap))
 
-	_, hostconfig, _ = mustParse(t, "--memory-swap=-1")
+	_, hostconfig = mustParse(t, "--memory-swap=-1")
 	assert.Check(t, is.Equal(int64(-1), hostconfig.MemorySwap))
 }
 
@@ -374,14 +340,14 @@ func TestParseHostname(t *testing.T) {
 	hostnameWithDomain := "--hostname=hostname.domainname"
 	hostnameWithDomainTld := "--hostname=hostname.domainname.tld"
 	for hostname, expectedHostname := range validHostnames {
-		if config, _, _ := mustParse(t, "--hostname="+hostname); config.Hostname != expectedHostname {
+		if config, _ := mustParse(t, "--hostname="+hostname); config.Hostname != expectedHostname {
 			t.Fatalf("Expected the config to have 'hostname' as %q, got %q", expectedHostname, config.Hostname)
 		}
 	}
-	if config, _, _ := mustParse(t, hostnameWithDomain); config.Hostname != "hostname.domainname" || config.Domainname != "" {
+	if config, _ := mustParse(t, hostnameWithDomain); config.Hostname != "hostname.domainname" || config.Domainname != "" {
 		t.Fatalf("Expected the config to have 'hostname' as hostname.domainname, got %q", config.Hostname)
 	}
-	if config, _, _ := mustParse(t, hostnameWithDomainTld); config.Hostname != "hostname.domainname.tld" || config.Domainname != "" {
+	if config, _ := mustParse(t, hostnameWithDomainTld); config.Hostname != "hostname.domainname.tld" || config.Domainname != "" {
 		t.Fatalf("Expected the config to have 'hostname' as hostname.domainname.tld, got %q", config.Hostname)
 	}
 }
@@ -395,28 +361,26 @@ func TestParseHostnameDomainname(t *testing.T) {
 		"domainname-63-bytes-long-should-be-valid-and-without-any-errors": "domainname-63-bytes-long-should-be-valid-and-without-any-errors",
 	}
 	for domainname, expectedDomainname := range validDomainnames {
-		if config, _, _ := mustParse(t, "--domainname="+domainname); config.Domainname != expectedDomainname {
+		if config, _ := mustParse(t, "--domainname="+domainname); config.Domainname != expectedDomainname {
 			t.Fatalf("Expected the config to have 'domainname' as %q, got %q", expectedDomainname, config.Domainname)
 		}
 	}
-	if config, _, _ := mustParse(t, "--hostname=some.prefix --domainname=domainname"); config.Hostname != "some.prefix" || config.Domainname != "domainname" {
+	if config, _ := mustParse(t, "--hostname=some.prefix --domainname=domainname"); config.Hostname != "some.prefix" || config.Domainname != "domainname" {
 		t.Fatalf("Expected the config to have 'hostname' as 'some.prefix' and 'domainname' as 'domainname', got %q and %q", config.Hostname, config.Domainname)
 	}
-	if config, _, _ := mustParse(t, "--hostname=another-prefix --domainname=domainname.tld"); config.Hostname != "another-prefix" || config.Domainname != "domainname.tld" {
+	if config, _ := mustParse(t, "--hostname=another-prefix --domainname=domainname.tld"); config.Hostname != "another-prefix" || config.Domainname != "domainname.tld" {
 		t.Fatalf("Expected the config to have 'hostname' as 'another-prefix' and 'domainname' as 'domainname.tld', got %q and %q", config.Hostname, config.Domainname)
 	}
 }
 
 func TestParseWithExpose(t *testing.T) {
-	invalids := []string{
+	invalids := map[string]string{
-		":",
+		":":                   "invalid port format for --expose: :",
-		"8080:9090",
+		"8080:9090":           "invalid port format for --expose: 8080:9090",
-		"/tcp",
+		"NaN/tcp":             `invalid range format for --expose: NaN/tcp, error: strconv.ParseUint: parsing "NaN": invalid syntax`,
-		"/udp",
+		"NaN-NaN/tcp":         `invalid range format for --expose: NaN-NaN/tcp, error: strconv.ParseUint: parsing "NaN": invalid syntax`,
-		"NaN/tcp",
+		"8080-NaN/tcp":        `invalid range format for --expose: 8080-NaN/tcp, error: strconv.ParseUint: parsing "NaN": invalid syntax`,
-		"NaN-NaN/tcp",
+		"1234567890-8080/tcp": `invalid range format for --expose: 1234567890-8080/tcp, error: strconv.ParseUint: parsing "1234567890": value out of range`,
-		"8080-NaN/tcp",
-		"1234567890-8080/tcp",
 	}
 	valids := map[string][]nat.Port{
 		"8080/tcp":      {"8080/tcp"},
@@ -425,9 +389,9 @@ func TestParseWithExpose(t *testing.T) {
 		"8080-8080/udp": {"8080/udp"},
 		"8080-8082/tcp": {"8080/tcp", "8081/tcp", "8082/tcp"},
 	}
-	for _, expose := range invalids {
+	for expose, expectedError := range invalids {
-		if _, _, _, err := parseRun([]string{fmt.Sprintf("--expose=%v", expose), "img", "cmd"}); err == nil {
+		if _, _, _, err := parseRun([]string{fmt.Sprintf("--expose=%v", expose), "img", "cmd"}); err == nil || err.Error() != expectedError {
-			t.Fatalf("Expected error with '--expose=%v', got none", expose)
+			t.Fatalf("Expected error '%v' with '--expose=%v', got '%v'", expectedError, expose, err)
 		}
 	}
 	for expose, exposedPorts := range valids {
@@ -439,7 +403,7 @@ func TestParseWithExpose(t *testing.T) {
 			t.Fatalf("Expected %v exposed port, got %v", len(exposedPorts), len(config.ExposedPorts))
 		}
 		for _, port := range exposedPorts {
-			if _, ok := config.ExposedPorts[mustNetworkPort(t, string(port))]; !ok {
+			if _, ok := config.ExposedPorts[port]; !ok {
 				t.Fatalf("Expected %v, got %v", exposedPorts, config.ExposedPorts)
 			}
 		}
@@ -454,7 +418,7 @@ func TestParseWithExpose(t *testing.T) {
 	}
 	ports := []nat.Port{"80/tcp", "81/tcp"}
 	for _, port := range ports {
-		if _, ok := config.ExposedPorts[mustNetworkPort(t, string(port))]; !ok {
+		if _, ok := config.ExposedPorts[port]; !ok {
 			t.Fatalf("Expected %v, got %v", ports, config.ExposedPorts)
 		}
 	}
@@ -498,79 +462,6 @@ func TestParseDevice(t *testing.T) {
 	}
 }
 
-func TestParseDeviceByServerOS(t *testing.T) {
-	tests := []struct {
-		name     string
-		device   string
-		serverOS string
-		want     container.DeviceMapping
-		wantErr  string
-	}{
-		{
-			name:     "linux source only",
-			device:   "/dev/snd",
-			serverOS: "linux",
-			want: container.DeviceMapping{
-				PathOnHost:        "/dev/snd",
-				PathInContainer:   "/dev/snd",
-				CgroupPermissions: "rwm",
-			},
-		},
-		{
-			name:     "linux source and mode",
-			device:   "/dev/snd:rw",
-			serverOS: "linux",
-			want: container.DeviceMapping{
-				PathOnHost:        "/dev/snd",
-				PathInContainer:   "/dev/snd",
-				CgroupPermissions: "rw",
-			},
-		},
-		{
-			name:     "linux source target and mode",
-			device:   "/dev/snd:/container/snd:m",
-			serverOS: "linux",
-			want: container.DeviceMapping{
-				PathOnHost:        "/dev/snd",
-				PathInContainer:   "/container/snd",
-				CgroupPermissions: "m",
-			},
-		},
-		{
-			name:     "windows passes value through",
-			device:   `class/GUID`,
-			serverOS: "windows",
-			want: container.DeviceMapping{
-				PathOnHost: `class/GUID`,
-			},
-		},
-		{
-			name:     "invalid server OS",
-			device:   "/dev/snd",
-			serverOS: "plan9",
-			wantErr:  "unknown server OS: plan9",
-		},
-		{
-			name:     "too many linux fields",
-			device:   "/dev/snd:/container/snd:rw:extra",
-			serverOS: "linux",
-			wantErr:  "invalid device specification: /dev/snd:/container/snd:rw:extra",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := parseDevice(tc.device, tc.serverOS)
-			if tc.wantErr != "" {
-				assert.Error(t, err, tc.wantErr)
-				return
-			}
-			assert.NilError(t, err)
-			assert.Equal(t, got, tc.want)
-		})
-	}
-}
-
 func TestParseNetworkConfig(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -607,9 +498,9 @@ func TestParseNetworkConfig(t *testing.T) {
 			expected: map[string]*networktypes.EndpointSettings{
 				"net1": {
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address:  mustAddr(t, "172.20.88.22"),
+						IPv4Address:  "172.20.88.22",
-						IPv6Address:  mustAddr(t, "2001:db8::8822"),
+						IPv6Address:  "2001:db8::8822",
-						LinkLocalIPs: mustAddrs(t, "169.254.2.2", "fe80::169:254:2:2"),
+						LinkLocalIPs: []string{"169.254.2.2", "fe80::169:254:2:2"},
 					},
 					Links:   []string{"foo:bar", "bar:baz"},
 					Aliases: []string{"web1", "web2"},
@@ -636,9 +527,9 @@ func TestParseNetworkConfig(t *testing.T) {
 				"net1": {
 					DriverOpts: map[string]string{"field1": "value1"},
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address:  mustAddr(t, "172.20.88.22"),
+						IPv4Address:  "172.20.88.22",
-						IPv6Address:  mustAddr(t, "2001:db8::8822"),
+						IPv6Address:  "2001:db8::8822",
-						LinkLocalIPs: mustAddrs(t, "169.254.2.2", "fe80::169:254:2:2"),
+						LinkLocalIPs: []string{"169.254.2.2", "fe80::169:254:2:2"},
 					},
 					Links:   []string{"foo:bar", "bar:baz"},
 					Aliases: []string{"web1", "web2"},
@@ -647,8 +538,8 @@ func TestParseNetworkConfig(t *testing.T) {
 				"net3": {
 					DriverOpts: map[string]string{"field3": "value3"},
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address: mustAddr(t, "172.20.88.22"),
+						IPv4Address: "172.20.88.22",
-						IPv6Address: mustAddr(t, "2001:db8::8822"),
+						IPv6Address: "2001:db8::8822",
 					},
 					Aliases: []string{"web3"},
 				},
@@ -665,8 +556,8 @@ func TestParseNetworkConfig(t *testing.T) {
 						"field2": "value2",
 					},
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address: mustAddr(t, "172.20.88.22"),
+						IPv4Address: "172.20.88.22",
-						IPv6Address: mustAddr(t, "2001:db8::8822"),
+						IPv6Address: "2001:db8::8822",
 					},
 					Aliases: []string{"web1", "web2"},
 				},
@@ -719,9 +610,7 @@ func TestParseNetworkConfig(t *testing.T) {
 
 			assert.NilError(t, err)
 			assert.DeepEqual(t, hConfig.NetworkMode, tc.expectedCfg.NetworkMode)
-			if diff := cmp.Diff(tc.expected, nwConfig.EndpointsConfig, cmpopts.EquateComparable(netip.Addr{})); diff != "" {
+			assert.DeepEqual(t, nwConfig.EndpointsConfig, tc.expected)
-				t.Fatalf("unexpected endpoints (-want +got):\n%s", diff)
-			}
 		})
 	}
 }
@@ -742,7 +631,7 @@ func TestParseModes(t *testing.T) {
 	}
 
 	// uts ko
-	_, _, _, err = parseRun([]string{"--uts=container:", "img", "cmd"}) //nolint:dogsled // verbatim copy from docker/cli tests
+	_, _, _, err = parseRun([]string{"--uts=container:", "img", "cmd"})
 	assert.ErrorContains(t, err, "--uts: invalid UTS mode")
 
 	// uts ok
@@ -802,9 +691,10 @@ func TestParseRestartPolicy(t *testing.T) {
 }
 
 func TestParseRestartPolicyAutoRemove(t *testing.T) {
-	_, _, _, err := parseRun([]string{"--rm", "--restart=always", "img", "cmd"}) //nolint:dogsled // verbatim copy from docker/cli tests
+	expected := "Conflicting options: --restart and --rm"
-	if err == nil {
+	_, _, _, err := parseRun([]string{"--rm", "--restart=always", "img", "cmd"})
-		t.Fatal("Expected error for conflicting --restart and --rm, but got none")
+	if err == nil || err.Error() != expected {
+		t.Fatalf("Expected error %v, but got none", expected)
 	}
 }
 
@@ -862,7 +752,7 @@ func TestParseLoggingOpts(t *testing.T) {
 	}
 }
 
-func TestParseEnvfileVariables(t *testing.T) { //nolint:dupl // verbatim copy from docker/cli tests
+func TestParseEnvfileVariables(t *testing.T) { //nolint:dupl // pre-existing issue from nektos/act
 	e := "open nonexistent: no such file or directory"
 	if runtime.GOOS == "windows" {
 		e = "open nonexistent: The system cannot find the file specified."
@@ -905,7 +795,7 @@ func TestParseEnvfileVariablesWithBOMUnicode(t *testing.T) {
 	}
 
 	// UTF16 with BOM
-	e := "invalid env file"
+	e := "contains invalid utf8 bytes at line"
 	if _, _, _, err := parseRun([]string{"--env-file=testdata/utf16.env", "img", "cmd"}); err == nil || !strings.Contains(err.Error(), e) {
 		t.Fatalf("Expected an error with message '%s', got %v", e, err)
 	}
@@ -915,7 +805,7 @@ func TestParseEnvfileVariablesWithBOMUnicode(t *testing.T) {
 	}
 }
 
-func TestParseLabelfileVariables(t *testing.T) { //nolint:dupl // verbatim copy from docker/cli tests
+func TestParseLabelfileVariables(t *testing.T) { //nolint:dupl // pre-existing issue from nektos/act
 	e := "open nonexistent: no such file or directory"
 	if runtime.GOOS == "windows" {
 		e = "open nonexistent: The system cannot find the file specified."
@@ -1003,82 +893,6 @@ func TestValidateDevice(t *testing.T) {
 	}
 }
 
-func TestValidateDeviceByServerOS(t *testing.T) {
-	tests := []struct {
-		name      string
-		value     string
-		serverOS  string
-		want      string
-		wantError string
-	}{
-		{
-			name:     "linux preserves three-field container path",
-			value:    "/host:/container/../device:rw",
-			serverOS: "linux",
-			want:     "/host:/container/../device:rw",
-		},
-		{
-			name:     "linux source path can be relative when target is absolute",
-			value:    "relative-host:/container/device",
-			serverOS: "linux",
-			want:     "relative-host:/container/device",
-		},
-		{
-			name:     "windows defers validation",
-			value:    `class/GUID`,
-			serverOS: "windows",
-			want:     `class/GUID`,
-		},
-		{
-			name:      "linux rejects bad mode",
-			value:     "/host:/container:ro",
-			serverOS:  "linux",
-			wantError: "bad mode specified: ro",
-		},
-		{
-			name:      "linux target must be absolute",
-			value:     "/host:relative",
-			serverOS:  "linux",
-			wantError: "relative is not an absolute path",
-		},
-		{
-			name:      "unknown server OS",
-			value:     "/dev/snd",
-			serverOS:  "plan9",
-			wantError: "unknown server OS: plan9",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := validateDevice(tc.value, tc.serverOS)
-			if tc.wantError != "" {
-				assert.Error(t, err, tc.wantError)
-				return
-			}
-			assert.NilError(t, err)
-			assert.Equal(t, got, tc.want)
-		})
-	}
-}
-
-func TestDeviceCgroupRulesAndInvalidParameter(t *testing.T) {
-	got, err := validateDeviceCgroupRule("c 1:3 rwm")
-	assert.NilError(t, err)
-	assert.Equal(t, got, "c 1:3 rwm")
-
-	_, err = validateDeviceCgroupRule("invalid")
-	assert.Error(t, err, "invalid device cgroup format 'invalid'")
-
-	if invalidParameter(nil) != nil {
-		t.Fatal("invalidParameter(nil) should be nil")
-	}
-	err = invalidParameter(errors.New("bad input"))
-	assert.Assert(t, err != nil)
-	var invalid interface{ InvalidParameter() }
-	assert.Assert(t, errors.As(err, &invalid))
-}
-
 func TestParseSystemPaths(t *testing.T) {
 	tests := []struct {
 		doc                       string

act/container/docker_images.go

@@ -10,8 +10,8 @@ import (
 	"context"
 	"fmt"
 
-	cerrdefs "github.com/containerd/errdefs"
+	"github.com/docker/docker/api/types"
-	"github.com/moby/moby/client"
+	"github.com/docker/docker/client"
 )
 
 // ImageExistsLocally returns a boolean indicating if an image with the
@@ -23,8 +23,8 @@ func ImageExistsLocally(ctx context.Context, imageName, platform string) (bool,
 	}
 	defer cli.Close()
 
-	inspectImage, err := cli.ImageInspect(ctx, imageName)
+	inspectImage, _, err := cli.ImageInspectWithRaw(ctx, imageName)
-	if cerrdefs.IsNotFound(err) {
+	if client.IsErrNotFound(err) {
 		return false, nil
 	} else if err != nil {
 		return false, err
@@ -46,14 +46,14 @@ func RemoveImage(ctx context.Context, imageName string, force, pruneChildren boo
 	}
 	defer cli.Close()
 
-	inspectImage, err := cli.ImageInspect(ctx, imageName)
+	inspectImage, _, err := cli.ImageInspectWithRaw(ctx, imageName)
-	if cerrdefs.IsNotFound(err) {
+	if client.IsErrNotFound(err) {
 		return false, nil
 	} else if err != nil {
 		return false, err
 	}
 
-	if _, err = cli.ImageRemove(ctx, inspectImage.ID, client.ImageRemoveOptions{
+	if _, err = cli.ImageRemove(ctx, inspectImage.ID, types.ImageRemoveOptions{
 		Force:         force,
 		PruneChildren: pruneChildren,
 	}); err != nil {

act/container/docker_images_test.go

@@ -6,64 +6,66 @@ package container
 
 import (
 	"context"
-	"fmt"
+	"io"
-	"os"
-	"os/exec"
-	"strings"
 	"testing"
 
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/client"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func init() {
 	log.SetLevel(log.DebugLevel)
 }
 
-// buildScratchImage builds a tiny empty image for the given platform locally (FROM scratch, no
-// network or emulation since there is nothing to run) and returns its tag, removing it after
-// the test.
-func buildScratchImage(t *testing.T, platform string) string {
-	t.Helper()
-	tag := fmt.Sprintf("act-test-exists-%s:latest", strings.TrimPrefix(platform, "linux/"))
-	cmd := exec.Command("docker", "build", "--platform", platform, "-t", tag, "-")
-	cmd.Stdin = strings.NewReader("FROM scratch\nLABEL act-test=1\n")
-	// Force BuildKit: it records the requested architecture in the image config for a
-	// FROM-scratch build, whereas the classic builder ignores --platform and tags it with the
-	// host arch, which would break the per-platform existence assertions below.
-	cmd.Env = append(os.Environ(), "DOCKER_BUILDKIT=1")
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
-	t.Cleanup(func() { _ = exec.Command("docker", "rmi", "-f", tag).Run() })
-	return tag
-}
-
 func TestImageExistsLocally(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	ctx := context.Background()
+	// to help make this test reliable and not flaky, we need to have
+	// an image that will exist, and onew that won't exist
 
-	// a non-existent image is reported absent
+	// Test if image exists with specific tag
-	missing, err := ImageExistsLocally(ctx, "library/alpine:this-random-tag-will-never-exist", "linux/amd64")
+	invalidImageTag, err := ImageExistsLocally(ctx, "library/alpine:this-random-tag-will-never-exist", "linux/amd64")
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, missing)
+	assert.False(t, invalidImageTag)
 
-	// Build tiny images for two architectures locally so per-platform existence can be checked
+	// Test if image exists with specific architecture (image platform)
-	// offline (formerly pulled node:24-bookworm-slim for amd64 and arm64 over the network).
+	invalidImagePlatform, err := ImageExistsLocally(ctx, "alpine:latest", "windows/amd64")
-	amd64Ref := buildScratchImage(t, "linux/amd64")
-	arm64Ref := buildScratchImage(t, "linux/arm64")
-
-	amd64Exists, err := ImageExistsLocally(ctx, amd64Ref, "linux/amd64")
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, amd64Exists)
+	assert.False(t, invalidImagePlatform)
 
-	// a non-host architecture image is detected for its own architecture
+	// pull an image
-	arm64Exists, err := ImageExistsLocally(ctx, arm64Ref, "linux/arm64")
+	cli, err := client.NewClientWithOpts(client.FromEnv)
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, arm64Exists)
+	cli.NegotiateAPIVersion(context.Background())
 
-	// a present image is reported absent for a different platform
+	// Chose alpine latest because it's so small
-	wrongPlatform, err := ImageExistsLocally(ctx, amd64Ref, "linux/arm64")
+	// maybe we should build an image instead so that tests aren't reliable on dockerhub
+	readerDefault, err := cli.ImagePull(ctx, "node:16-buster-slim", types.ImagePullOptions{
+		Platform: "linux/amd64",
+	})
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, wrongPlatform)
+	defer readerDefault.Close()
+	_, err = io.ReadAll(readerDefault)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	imageDefaultArchExists, err := ImageExistsLocally(ctx, "node:16-buster-slim", "linux/amd64")
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.True(t, imageDefaultArchExists)
+
+	// Validate if another architecture platform can be pulled
+	readerArm64, err := cli.ImagePull(ctx, "node:16-buster-slim", types.ImagePullOptions{
+		Platform: "linux/arm64",
+	})
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	defer readerArm64.Close()
+	_, err = io.ReadAll(readerArm64)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	imageArm64Exists, err := ImageExistsLocally(ctx, "node:16-buster-slim", "linux/arm64")
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.True(t, imageArm64Exists)
 }

act/container/docker_logger.go

@@ -26,6 +26,8 @@ type dockerMessage struct {
 	Progress string `json:"progress"`
 }
 
+const logPrefix = "  \U0001F433  "
+
 func logDockerResponse(logger logrus.FieldLogger, dockerResponse io.ReadCloser, isError bool) error {
 	if dockerResponse == nil {
 		return nil

act/container/docker_network.go

@@ -11,10 +11,10 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/moby/client"
+	"github.com/docker/docker/api/types"
 )
 
-func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExecutorInput) common.Executor {
+func NewDockerNetworkCreateExecutor(name string) common.Executor {
 	return func(ctx context.Context) error {
 		cli, err := GetDockerClient(ctx)
 		if err != nil {
@@ -23,24 +23,22 @@ func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExec
 		defer cli.Close()
 
 		// Only create the network if it doesn't exist
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
+		networks, err := cli.NetworkList(ctx, types.NetworkListOptions{})
 		if err != nil {
 			return err
 		}
 		// For Gitea, reduce log noise
 		// common.Logger(ctx).Debugf("%v", networks)
-		for _, n := range networks.Items {
+		for _, network := range networks {
-			if n.Name == name {
+			if network.Name == name {
 				common.Logger(ctx).Debugf("Network %v exists", name)
 				return nil
 			}
 		}
 
-		_, err = cli.NetworkCreate(ctx, name, client.NetworkCreateOptions{
+		_, err = cli.NetworkCreate(ctx, name, types.NetworkCreate{
-			Driver:     "bridge",
+			Driver: "bridge",
-			Scope:      "local",
+			Scope:  "local",
-			EnableIPv4: opts.EnableIPv4,
-			EnableIPv6: opts.EnableIPv6,
 		})
 		if err != nil {
 			return err
@@ -58,23 +56,23 @@ func NewDockerNetworkRemoveExecutor(name string) common.Executor {
 		}
 		defer cli.Close()
 
-		// Make sure that all network of the specified name are removed
+		// Make shure that all network of the specified name are removed
 		// cli.NetworkRemove refuses to remove a network if there are duplicates
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
+		networks, err := cli.NetworkList(ctx, types.NetworkListOptions{})
 		if err != nil {
 			return err
 		}
 		// For Gitea, reduce log noise
 		// common.Logger(ctx).Debugf("%v", networks)
-		for _, n := range networks.Items {
+		for _, network := range networks {
-			if n.Name == name {
+			if network.Name == name {
-				result, err := cli.NetworkInspect(ctx, n.ID, client.NetworkInspectOptions{})
+				result, err := cli.NetworkInspect(ctx, network.ID, types.NetworkInspectOptions{})
 				if err != nil {
 					return err
 				}
 
-				if len(result.Network.Containers) == 0 {
+				if len(result.Containers) == 0 {
-					if _, err = cli.NetworkRemove(ctx, n.ID, client.NetworkRemoveOptions{}); err != nil {
+					if err = cli.NetworkRemove(ctx, network.ID); err != nil {
 						common.Logger(ctx).Debugf("%v", err)
 					}
 				} else {

act/container/docker_platform.go

@@ -1,39 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// Copyright 2025 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"fmt"
-	"strings"
-
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// parsePlatform parses an "os/arch[/variant]" string into a Platform. An empty input
-// returns (nil, nil), meaning "no platform constraint". A non-empty but malformed
-// string is rejected explicitly so it cannot silently fall through to the daemon's
-// default architecture.
-func parsePlatform(platform string) (*specs.Platform, error) {
-	if platform == "" {
-		return nil, nil //nolint:nilnil // no platform constraint requested
-	}
-
-	parts := strings.Split(platform, "/")
-	if len(parts) < 2 || len(parts) > 3 || parts[0] == "" || parts[1] == "" || (len(parts) == 3 && parts[2] == "") {
-		return nil, fmt.Errorf("invalid platform %q: expected os/arch[/variant]", platform)
-	}
-
-	spec := &specs.Platform{
-		OS:           strings.ToLower(parts[0]),
-		Architecture: strings.ToLower(parts[1]),
-	}
-	if len(parts) == 3 {
-		spec.Variant = strings.ToLower(parts[2])
-	}
-
-	return spec, nil
-}

act/container/docker_platform_test.go

@@ -1,63 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParsePlatform(t *testing.T) {
-	t.Run("empty input returns nil platform without error", func(t *testing.T) {
-		got, err := parsePlatform("")
-		require.NoError(t, err)
-		assert.Nil(t, got)
-	})
-
-	t.Run("os/arch", func(t *testing.T) {
-		got, err := parsePlatform("linux/amd64")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Empty(t, got.Variant)
-	})
-
-	t.Run("os/arch/variant", func(t *testing.T) {
-		got, err := parsePlatform("linux/arm/v7")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "arm", got.Architecture)
-		assert.Equal(t, "v7", got.Variant)
-	})
-
-	t.Run("input is lowercased", func(t *testing.T) {
-		got, err := parsePlatform("Linux/AMD64/V8")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Equal(t, "v8", got.Variant)
-	})
-
-	for _, bad := range []string{
-		"amd64",
-		"linux",
-		"linux/",
-		"/amd64",
-		"/",
-		"//",
-		"linux/arm/",
-		"linux/arm/v7/extra",
-	} {
-		t.Run("rejects "+bad, func(t *testing.T) {
-			got, err := parsePlatform(bad)
-			require.Error(t, err)
-			assert.Nil(t, got)
-		})
-	}
-}

act/container/docker_pull.go

@@ -8,23 +8,23 @@ package container
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
 
 	"github.com/distribution/reference"
-	"github.com/moby/moby/api/pkg/authconfig"
+	"github.com/docker/docker/api/types"
-	"github.com/moby/moby/api/types/registry"
+	"github.com/docker/docker/api/types/registry"
-	"github.com/moby/moby/client"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // NewDockerPullExecutor function to create a run executor for the container
 func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		logger.Debugf("docker pull %v", input.Image)
+		logger.Debugf("%sdocker pull %v", logPrefix, input.Image)
 
 		if common.Dryrun(ctx) {
 			return nil
@@ -72,37 +72,32 @@ func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
 
 				_ = logDockerResponse(logger, reader, err != nil)
 			}
-			if err != nil {
+			return err
-				return fmt.Errorf("failed to pull image '%s' (%s): %w", imageRef, input.Platform, err)
-			}
 		}
 		return nil
 	}
 }
 
-func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput) (client.ImagePullOptions, error) {
+func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput) (types.ImagePullOptions, error) {
-	imagePullOptions := client.ImagePullOptions{}
+	imagePullOptions := types.ImagePullOptions{
-	platform, err := parsePlatform(input.Platform)
+		Platform: input.Platform,
-	if err != nil {
-		return imagePullOptions, err
-	}
-	if platform != nil {
-		imagePullOptions.Platforms = []specs.Platform{*platform}
 	}
 	logger := common.Logger(ctx)
 
 	if input.Username != "" && input.Password != "" {
 		logger.Debugf("using authentication for docker pull")
 
-		encodedAuth, err := authconfig.Encode(registry.AuthConfig{
+		authConfig := registry.AuthConfig{
 			Username: input.Username,
 			Password: input.Password,
-		})
+		}
+
+		encodedJSON, err := json.Marshal(authConfig)
 		if err != nil {
 			return imagePullOptions, err
 		}
 
-		imagePullOptions.RegistryAuth = encodedAuth
+		imagePullOptions.RegistryAuth = base64.URLEncoding.EncodeToString(encodedJSON)
 	} else {
 		authConfig, err := LoadDockerAuthConfig(ctx, input.Image)
 		if err != nil {
@@ -113,17 +108,19 @@ func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput)
 		}
 		logger.Info("using DockerAuthConfig authentication for docker pull")
 
-		imagePullOptions.RegistryAuth, err = authconfig.Encode(authConfig)
+		encodedJSON, err := json.Marshal(authConfig)
 		if err != nil {
 			return imagePullOptions, err
 		}
+
+		imagePullOptions.RegistryAuth = base64.URLEncoding.EncodeToString(encodedJSON)
 	}
 
 	return imagePullOptions, nil
 }
 
-func cleanImage(ctx context.Context, imageName string) string {
+func cleanImage(ctx context.Context, image string) string {
-	ref, err := reference.ParseAnyReference(imageName)
+	ref, err := reference.ParseAnyReference(image)
 	if err != nil {
 		common.Logger(ctx).Error(err)
 		return ""

act/container/docker_pull_test.go

@@ -40,9 +40,6 @@ func TestCleanImage(t *testing.T) {
 func TestGetImagePullOptions(t *testing.T) {
 	ctx := context.Background()
 
-	orig := config.Dir()
-	t.Cleanup(func() { config.SetDir(orig) })
-
 	config.SetDir("/non-existent/docker")
 
 	options, err := getImagePullOptions(ctx, NewDockerPullExecutorInput{})

act/container/docker_run.go

@@ -17,42 +17,33 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
-	"slices"
 	"strconv"
 	"strings"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/filecollector"
 
-	"dario.cat/mergo"
 	"github.com/Masterminds/semver"
-	cerrdefs "github.com/containerd/errdefs"
 	"github.com/docker/cli/cli/compose/loader"
 	"github.com/docker/cli/cli/connhelper"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
 	"github.com/go-git/go-billy/v5/helper/polyfill"
 	"github.com/go-git/go-billy/v5/osfs"
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
 	"github.com/gobwas/glob"
+	"github.com/imdario/mergo"
 	"github.com/joho/godotenv"
 	"github.com/kballard/go-shellquote"
-	"github.com/moby/moby/api/pkg/stdcopy"
-	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/mount"
-	"github.com/moby/moby/api/types/network"
-	"github.com/moby/moby/api/types/system"
-	"github.com/moby/moby/client"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/spf13/pflag"
+	"golang.org/x/term"
 )
 
-// drainGracePeriod bounds how long we wait for an output-copy goroutine to
-// finish draining a container's output before returning, so that neither a
-// cancellation (waitForCommand) nor a normal container exit (wait) truncates
-// the tail of the log. It is a safety bound: in the common case the stream
-// reaches EOF and the goroutine returns well before this elapses.
-const drainGracePeriod = 2 * time.Second
-
 // NewContainer creates a reference to a container
 func NewContainer(input *NewContainerInput) ExecutionsEnvironment {
 	cr := new(containerReference)
@@ -62,7 +53,7 @@ func NewContainer(input *NewContainerInput) ExecutionsEnvironment {
 
 func (cr *containerReference) ConnectToNetwork(name string) common.Executor {
 	return common.
-		NewDebugExecutor("docker network connect %s %s", name, cr.input.Name).
+		NewDebugExecutor("%sdocker network connect %s %s", logPrefix, name, cr.input.Name).
 		Then(
 			common.NewPipelineExecutor(
 				cr.connect(),
@@ -73,13 +64,9 @@ func (cr *containerReference) ConnectToNetwork(name string) common.Executor {
 
 func (cr *containerReference) connectToNetwork(name string, aliases []string) common.Executor {
 	return func(ctx context.Context) error {
-		_, err := cr.cli.NetworkConnect(ctx, name, client.NetworkConnectOptions{
+		return cr.cli.NetworkConnect(ctx, name, cr.input.Name, &network.EndpointSettings{
-			Container: cr.input.Name,
+			Aliases: aliases,
-			EndpointConfig: &network.EndpointSettings{
-				Aliases: aliases,
-			},
 		})
-		return err
 	}
 }
 
@@ -87,7 +74,7 @@ func (cr *containerReference) connectToNetwork(name string, aliases []string) co
 // API version is 1.41 and beyond
 func supportsContainerImagePlatform(ctx context.Context, cli client.APIClient) bool {
 	logger := common.Logger(ctx)
-	ver, err := cli.ServerVersion(ctx, client.ServerVersionOptions{})
+	ver, err := cli.ServerVersion(ctx)
 	if err != nil {
 		logger.Panicf("Failed to get Docker API Version: %s", err)
 		return false
@@ -103,7 +90,7 @@ func supportsContainerImagePlatform(ctx context.Context, cli client.APIClient) b
 
 func (cr *containerReference) Create(capAdd, capDrop []string) common.Executor {
 	return common.
-		NewInfoExecutor("docker create image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
+		NewInfoExecutor("%sdocker create image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", logPrefix, cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
 		Then(
 			common.NewPipelineExecutor(
 				cr.connect(),
@@ -115,7 +102,7 @@ func (cr *containerReference) Create(capAdd, capDrop []string) common.Executor {
 
 func (cr *containerReference) Start(attach bool) common.Executor {
 	return common.
-		NewInfoExecutor("docker run image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
+		NewInfoExecutor("%sdocker run image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", logPrefix, cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
 		Then(
 			common.NewPipelineExecutor(
 				cr.connect(),
@@ -138,7 +125,7 @@ func (cr *containerReference) Start(attach bool) common.Executor {
 
 func (cr *containerReference) Pull(forcePull bool) common.Executor {
 	return common.
-		NewInfoExecutor("docker pull image=%s platform=%s username=%s forcePull=%t", cr.input.Image, cr.input.Platform, cr.input.Username, forcePull).
+		NewInfoExecutor("%sdocker pull image=%s platform=%s username=%s forcePull=%t", logPrefix, cr.input.Image, cr.input.Platform, cr.input.Username, forcePull).
 		Then(
 			NewDockerPullExecutor(NewDockerPullExecutorInput{
 				Image:     cr.input.Image,
@@ -160,9 +147,7 @@ func (cr *containerReference) Copy(destPath string, files ...*FileEntry) common.
 
 func (cr *containerReference) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
 	return common.NewPipelineExecutor(
-		common.NewInfoExecutor("docker cp src=%s dst=%s", srcPath, destPath),
+		common.NewInfoExecutor("%sdocker cp src=%s dst=%s", logPrefix, srcPath, destPath),
-		cr.connect(),
-		cr.find(),
 		cr.copyDir(destPath, srcPath, useGitIgnore),
 		func(ctx context.Context) error {
 			// If this fails, then folders have wrong permissions on non root container
@@ -178,21 +163,8 @@ func (cr *containerReference) GetContainerArchive(ctx context.Context, srcPath s
 	if common.Dryrun(ctx) {
 		return nil, errors.New("DRYRUN is not supported in GetContainerArchive")
 	}
-	// Direct entry point (no pipeline) — revalidate cr.id ourselves.
+	a, _, err := cr.cli.CopyFromContainer(ctx, cr.id, srcPath)
-	if err := cr.connect()(ctx); err != nil {
+	return a, err
-		return nil, err
-	}
-	if err := cr.find()(ctx); err != nil {
-		return nil, err
-	}
-	if cr.id == "" {
-		return nil, cr.missingContainerError("get archive %s", srcPath)
-	}
-	result, err := cr.cli.CopyFromContainer(ctx, cr.id, client.CopyFromContainerOptions{SourcePath: srcPath})
-	if err != nil {
-		return nil, err
-	}
-	return result.Content, nil
 }
 
 func (cr *containerReference) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
@@ -205,7 +177,7 @@ func (cr *containerReference) UpdateFromImageEnv(env *map[string]string) common.
 
 func (cr *containerReference) Exec(command []string, env map[string]string, user, workdir string) common.Executor {
 	return common.NewPipelineExecutor(
-		common.NewInfoExecutor("docker exec cmd=[%s] user=%s workdir=%s", strings.Join(command, " "), user, workdir),
+		common.NewInfoExecutor("%sdocker exec cmd=[%s] user=%s workdir=%s", logPrefix, strings.Join(command, " "), user, workdir),
 		cr.connect(),
 		cr.find(),
 		cr.exec(command, env, user, workdir),
@@ -237,10 +209,6 @@ type containerReference struct {
 	input *NewContainerInput
 	UID   int
 	GID   int
-	// attachDone is closed by the attach() streaming goroutine once it has
-	// drained and flushed the container's output. wait() blocks on it so the
-	// tail of the log lands before the step proceeds.
-	attachDone chan struct{}
 	LinuxContainerEnvironmentExtensions
 }
 
@@ -254,27 +222,22 @@ func GetDockerClient(ctx context.Context) (cli client.APIClient, err error) {
 		if err != nil {
 			return nil, err
 		}
-		cli, err = client.New(
+		cli, err = client.NewClientWithOpts(
 			client.WithHost(helper.Host),
 			client.WithDialContext(helper.Dialer),
 		)
 	} else {
-		cli, err = client.New(client.FromEnv)
+		cli, err = client.NewClientWithOpts(client.FromEnv)
 	}
 	if err != nil {
 		return nil, fmt.Errorf("failed to connect to docker daemon: %w", err)
 	}
-	// Best-effort API version negotiation, matching the old client.NegotiateAPIVersion
+	cli.NegotiateAPIVersion(ctx)
-	// behaviour. Ping failures here are non-fatal: the connection is exercised again on
-	// the first real call, and the client falls back to the daemon's default API version.
-	if _, err := cli.Ping(ctx, client.PingOptions{NegotiateAPIVersion: true}); err != nil {
-		common.Logger(ctx).Warnf("docker daemon ping during version negotiation failed, continuing: %v", err)
-	}
 
 	return cli, nil
 }
 
-func GetHostInfo(ctx context.Context) (info system.Info, err error) {
+func GetHostInfo(ctx context.Context) (info types.Info, err error) { //nolint:staticcheck // pre-existing issue from nektos/act
 	var cli client.APIClient
 	cli, err = GetDockerClient(ctx)
 	if err != nil {
@@ -282,12 +245,12 @@ func GetHostInfo(ctx context.Context) (info system.Info, err error) {
 	}
 	defer cli.Close()
 
-	result, err := cli.Info(ctx, client.InfoOptions{})
+	info, err = cli.Info(ctx)
 	if err != nil {
 		return info, err
 	}
 
-	return result.Info, nil
+	return info, nil
 }
 
 // Arch fetches values from docker info and translates architecture to
@@ -339,31 +302,19 @@ func (cr *containerReference) Close() common.Executor {
 	}
 }
 
-// missingContainerError is the shared "container X does not exist" error
-// used by ops that need a live cr.id.
-func (cr *containerReference) missingContainerError(format string, args ...any) error {
-	return fmt.Errorf("container %q does not exist; cannot "+format, append([]any{cr.input.Name}, args...)...)
-}
-
 func (cr *containerReference) find() common.Executor {
 	return func(ctx context.Context) error {
 		if cr.id != "" {
-			// Validate cached id; clear only on definitive NotFound so a
+			return nil
-			// transient daemon error doesn't abort cleanup pipelines.
-			_, err := cr.cli.ContainerInspect(ctx, cr.id, client.ContainerInspectOptions{})
-			if !cerrdefs.IsNotFound(err) {
-				return nil
-			}
-			cr.id = ""
 		}
-		containers, err := cr.cli.ContainerList(ctx, client.ContainerListOptions{
+		containers, err := cr.cli.ContainerList(ctx, types.ContainerListOptions{ //nolint:staticcheck // pre-existing issue from nektos/act
 			All: true,
 		})
 		if err != nil {
 			return fmt.Errorf("failed to list containers: %w", err)
 		}
 
-		for _, c := range containers.Items {
+		for _, c := range containers {
 			for _, name := range c.Names {
 				if name[1:] == cr.input.Name {
 					cr.id = c.ID
@@ -372,15 +323,11 @@ func (cr *containerReference) find() common.Executor {
 			}
 		}
 
+		cr.id = ""
 		return nil
 	}
 }
 
-// isContainerGone reports whether a failed remove still left the container gone (NotFound or Conflict).
-func isContainerGone(err error) bool {
-	return cerrdefs.IsNotFound(err) || cerrdefs.IsConflict(err)
-}
-
 func (cr *containerReference) remove() common.Executor {
 	return func(ctx context.Context) error {
 		if cr.id == "" {
@@ -388,11 +335,11 @@ func (cr *containerReference) remove() common.Executor {
 		}
 
 		logger := common.Logger(ctx)
-		_, err := cr.cli.ContainerRemove(ctx, cr.id, client.ContainerRemoveOptions{
+		err := cr.cli.ContainerRemove(ctx, cr.id, types.ContainerRemoveOptions{ //nolint:staticcheck // pre-existing issue from nektos/act
 			RemoveVolumes: true,
 			Force:         true,
 		})
-		if err != nil && !isContainerGone(err) {
+		if err != nil {
 			logger.Error(fmt.Errorf("failed to remove container: %w", err))
 		}
 
@@ -491,22 +438,15 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 			return nil
 		}
 		logger := common.Logger(ctx)
+		isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
 		input := cr.input
-		exposedPorts, err := convertPortSet(input.ExposedPorts)
-		if err != nil {
-			return err
-		}
-		portBindings, err := convertPortMap(input.PortBindings)
-		if err != nil {
-			return err
-		}
 
 		config := &container.Config{
 			Image:        input.Image,
 			WorkingDir:   input.WorkingDir,
 			Env:          input.Env,
-			ExposedPorts: exposedPorts,
+			ExposedPorts: input.ExposedPorts,
-			Tty:          input.AllocatePTY,
+			Tty:          isTerminal,
 		}
 		// For Gitea, reduce log noise
 		// logger.Debugf("Common container.Config ==> %+v", config)
@@ -530,9 +470,15 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 
 		var platSpecs *specs.Platform
 		if supportsContainerImagePlatform(ctx, cr.cli) && cr.input.Platform != "" {
-			platSpecs, err = parsePlatform(cr.input.Platform)
+			desiredPlatform := strings.SplitN(cr.input.Platform, `/`, 2)
-			if err != nil {
+
-				return err
+			if len(desiredPlatform) != 2 {
+				return fmt.Errorf("incorrect container platform option '%s'", cr.input.Platform)
+			}
+
+			platSpecs = &specs.Platform{
+				Architecture: desiredPlatform[1],
+				OS:           desiredPlatform[0],
 			}
 		}
 
@@ -544,13 +490,13 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 			NetworkMode:  container.NetworkMode(input.NetworkMode),
 			Privileged:   input.Privileged,
 			UsernsMode:   container.UsernsMode(input.UsernsMode),
-			PortBindings: portBindings,
+			PortBindings: input.PortBindings,
 			AutoRemove:   input.AutoRemove,
 		}
 		// For Gitea, reduce log noise
 		// logger.Debugf("Common container.HostConfig ==> %+v", hostConfig)
 
-		config, hostConfig, err = cr.mergeContainerConfigs(ctx, config, hostConfig)
+		config, hostConfig, err := cr.mergeContainerConfigs(ctx, config, hostConfig)
 		if err != nil {
 			return err
 		}
@@ -574,13 +520,7 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 			}
 		}
 
-		resp, err := cr.cli.ContainerCreate(ctx, client.ContainerCreateOptions{
+		resp, err := cr.cli.ContainerCreate(ctx, config, hostConfig, networkingConfig, platSpecs, input.Name)
-			Config:           config,
-			HostConfig:       hostConfig,
-			NetworkingConfig: networkingConfig,
-			Platform:         platSpecs,
-			Name:             input.Name,
-		})
 		if err != nil {
 			return fmt.Errorf("failed to create container: '%w'", err)
 		}
@@ -598,7 +538,7 @@ func (cr *containerReference) extractFromImageEnv(env *map[string]string) common
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 
-		inspect, err := cr.cli.ImageInspect(ctx, cr.input.Image)
+		inspect, _, err := cr.cli.ImageInspectWithRaw(ctx, cr.input.Image)
 		if err != nil {
 			logger.Error(err)
 			return fmt.Errorf("inspect image: %w", err)
@@ -633,9 +573,6 @@ func (cr *containerReference) extractFromImageEnv(env *map[string]string) common
 
 func (cr *containerReference) exec(cmd []string, env map[string]string, user, workdir string) common.Executor {
 	return func(ctx context.Context) error {
-		if cr.id == "" {
-			return cr.missingContainerError("exec %v", cmd)
-		}
 		logger := common.Logger(ctx)
 		// Fix slashes when running on Windows
 		if runtime.GOOS == "windows" {
@@ -647,7 +584,7 @@ func (cr *containerReference) exec(cmd []string, env map[string]string, user, wo
 		}
 
 		logger.Debugf("Exec command '%s'", cmd)
-		isTerminal := cr.input.AllocatePTY
+		isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
 		envList := make([]string, 0)
 		for k, v := range env {
 			envList = append(envList, fmt.Sprintf("%s=%s", k, v))
@@ -665,12 +602,12 @@ func (cr *containerReference) exec(cmd []string, env map[string]string, user, wo
 		}
 		logger.Debugf("Working directory '%s'", wd)
 
-		idResp, err := cr.cli.ExecCreate(ctx, cr.id, client.ExecCreateOptions{
+		idResp, err := cr.cli.ContainerExecCreate(ctx, cr.id, types.ExecConfig{
 			User:         user,
 			Cmd:          cmd,
 			WorkingDir:   wd,
 			Env:          envList,
-			TTY:          isTerminal,
+			Tty:          isTerminal,
 			AttachStderr: true,
 			AttachStdout: true,
 		})
@@ -678,34 +615,38 @@ func (cr *containerReference) exec(cmd []string, env map[string]string, user, wo
 			return fmt.Errorf("failed to create exec: %w", err)
 		}
 
-		resp, err := cr.cli.ExecAttach(ctx, idResp.ID, client.ExecAttachOptions{
+		resp, err := cr.cli.ContainerExecAttach(ctx, idResp.ID, types.ExecStartCheck{
-			TTY: isTerminal,
+			Tty: isTerminal,
 		})
 		if err != nil {
 			return fmt.Errorf("failed to attach to exec: %w", err)
 		}
 		defer resp.Close()
 
-		err = cr.waitForCommand(ctx, isTerminal, resp.HijackedResponse, idResp, user, workdir)
+		err = cr.waitForCommand(ctx, isTerminal, resp, idResp, user, workdir)
 		if err != nil {
 			return err
 		}
 
-		inspectResp, err := cr.cli.ExecInspect(ctx, idResp.ID, client.ExecInspectOptions{})
+		inspectResp, err := cr.cli.ContainerExecInspect(ctx, idResp.ID)
 		if err != nil {
 			return fmt.Errorf("failed to inspect exec: %w", err)
 		}
 
-		if inspectResp.ExitCode == 0 {
+		switch inspectResp.ExitCode {
+		case 0:
 			return nil
+		case 127:
+			return fmt.Errorf("exitcode '%d': command not found, please refer to https://github.com/nektos/act/issues/107 for more information", inspectResp.ExitCode)
+		default:
+			return fmt.Errorf("exitcode '%d': failure", inspectResp.ExitCode)
 		}
-		return ExitCodeError(inspectResp.ExitCode)
 	}
 }
 
 func (cr *containerReference) tryReadID(opt string, cbk func(id int)) common.Executor {
 	return func(ctx context.Context) error {
-		idResp, err := cr.cli.ExecCreate(ctx, cr.id, client.ExecCreateOptions{
+		idResp, err := cr.cli.ContainerExecCreate(ctx, cr.id, types.ExecConfig{
 			Cmd:          []string{"id", opt},
 			AttachStdout: true,
 			AttachStderr: true,
@@ -714,7 +655,7 @@ func (cr *containerReference) tryReadID(opt string, cbk func(id int)) common.Exe
 			return nil
 		}
 
-		resp, err := cr.cli.ExecAttach(ctx, idResp.ID, client.ExecAttachOptions{})
+		resp, err := cr.cli.ContainerExecAttach(ctx, idResp.ID, types.ExecStartCheck{})
 		if err != nil {
 			return nil
 		}
@@ -744,12 +685,10 @@ func (cr *containerReference) tryReadGID() common.Executor {
 	return cr.tryReadID("-g", func(id int) { cr.GID = id })
 }
 
-func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal bool, resp client.HijackedResponse, _ client.ExecCreateResult, _, _ string) error {
+func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal bool, resp types.HijackedResponse, _ types.IDResponse, _, _ string) error {
 	logger := common.Logger(ctx)
 
-	// Buffered so the copy goroutine never blocks on send if the grace-period
+	cmdResponse := make(chan error)
-	// drain below times out and no one is left to receive.
-	cmdResponse := make(chan error, 1)
 
 	go func() {
 		var outWriter io.Writer
@@ -768,11 +707,6 @@ func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal boo
 		} else {
 			_, err = io.Copy(outWriter, resp.Reader)
 		}
-		// Flush any buffered, not-yet-newline-terminated trailing line so the
-		// final line of a command's output is not lost (e.g. an error message
-		// printed without a trailing newline before the process exits).
-		common.FlushWriter(outWriter)
-		common.FlushWriter(errWriter)
 		cmdResponse <- err
 	}()
 
@@ -784,16 +718,6 @@ func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal boo
 			logger.Warnf("Failed to send CTRL+C: %+s", err)
 		}
 
-		// Give the copy goroutine a brief grace period to drain output already
-		// produced by the command before we return, so cancellation does not
-		// truncate the tail of the log. The goroutine exits once the hijacked
-		// stream is closed by resp.Close() in the caller's defer.
-		select {
-		case <-cmdResponse:
-		case <-time.After(drainGracePeriod):
-			logger.Warn("Timed out draining command output after cancellation")
-		}
-
 		// we return the context canceled error to prevent other steps
 		// from executing
 		return ctx.Err()
@@ -807,9 +731,6 @@ func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal boo
 }
 
 func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string, tarStream io.Reader) error {
-	if cr.id == "" {
-		return cr.missingContainerError("copy to %s", destPath)
-	}
 	// Mkdir
 	buf := &bytes.Buffer{}
 	tw := tar.NewWriter(buf)
@@ -819,18 +740,12 @@ func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string
 		Typeflag: tar.TypeDir,
 	})
 	tw.Close()
-	_, err := cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
+	err := cr.cli.CopyToContainer(ctx, cr.id, "/", buf, types.CopyToContainerOptions{})
-		DestinationPath: "/",
-		Content:         buf,
-	})
 	if err != nil {
 		return fmt.Errorf("failed to mkdir to copy content to container: %w", err)
 	}
 	// Copy Content
-	_, err = cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
+	err = cr.cli.CopyToContainer(ctx, cr.id, destPath, tarStream, types.CopyToContainerOptions{})
-		DestinationPath: destPath,
-		Content:         tarStream,
-	})
 	if err != nil {
 		return fmt.Errorf("failed to copy content to container: %w", err)
 	}
@@ -843,9 +758,6 @@ func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string
 
 func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool) common.Executor {
 	return func(ctx context.Context) error {
-		if cr.id == "" {
-			return cr.missingContainerError("copy directory to %s", dstPath)
-		}
 		logger := common.Logger(ctx)
 		tarFile, err := os.CreateTemp("", "act")
 		if err != nil {
@@ -907,10 +819,7 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool
 		if err != nil {
 			return fmt.Errorf("failed to seek tar archive: %w", err)
 		}
-		_, err = cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
+		err = cr.cli.CopyToContainer(ctx, cr.id, "/", tarFile, types.CopyToContainerOptions{})
-			DestinationPath: "/",
-			Content:         tarFile,
-		})
 		if err != nil {
 			return fmt.Errorf("failed to copy content to container: %w", err)
 		}
@@ -920,9 +829,6 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool
 
 func (cr *containerReference) copyContent(dstPath string, files ...*FileEntry) common.Executor {
 	return func(ctx context.Context) error {
-		if cr.id == "" {
-			return cr.missingContainerError("copy to %s", dstPath)
-		}
 		logger := common.Logger(ctx)
 		var buf bytes.Buffer
 		tw := tar.NewWriter(&buf)
@@ -947,10 +853,7 @@ func (cr *containerReference) copyContent(dstPath string, files ...*FileEntry) c
 		}
 
 		logger.Debugf("Extracting content to '%s'", dstPath)
-		_, err := cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
+		err := cr.cli.CopyToContainer(ctx, cr.id, dstPath, &buf, types.CopyToContainerOptions{})
-			DestinationPath: dstPath,
-			Content:         &buf,
-		})
 		if err != nil {
 			return fmt.Errorf("failed to copy content to container: %w", err)
 		}
@@ -960,7 +863,7 @@ func (cr *containerReference) copyContent(dstPath string, files ...*FileEntry) c
 
 func (cr *containerReference) attach() common.Executor {
 	return func(ctx context.Context) error {
-		out, err := cr.cli.ContainerAttach(ctx, cr.id, client.ContainerAttachOptions{
+		out, err := cr.cli.ContainerAttach(ctx, cr.id, types.ContainerAttachOptions{ //nolint:staticcheck // pre-existing issue from nektos/act
 			Stream: true,
 			Stdout: true,
 			Stderr: true,
@@ -968,7 +871,7 @@ func (cr *containerReference) attach() common.Executor {
 		if err != nil {
 			return fmt.Errorf("failed to attach to container: %w", err)
 		}
-		isTerminal := cr.input.AllocatePTY
+		isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
 
 		var outWriter io.Writer
 		outWriter = cr.input.Stdout
@@ -979,23 +882,14 @@ func (cr *containerReference) attach() common.Executor {
 		if errWriter == nil {
 			errWriter = os.Stderr
 		}
-		done := make(chan struct{})
-		cr.attachDone = done
 		go func() {
-			defer close(done)
-			var copyErr error
 			if !isTerminal || os.Getenv("NORAW") != "" {
-				_, copyErr = stdcopy.StdCopy(outWriter, errWriter, out.Reader)
+				_, err = stdcopy.StdCopy(outWriter, errWriter, out.Reader)
 			} else {
-				_, copyErr = io.Copy(outWriter, out.Reader)
+				_, err = io.Copy(outWriter, out.Reader)
 			}
-			// Flush any buffered, not-yet-newline-terminated trailing line once
+			if err != nil {
-			// the stream reaches EOF, so the final line of the container's
+				common.Logger(ctx).Error(err)
-			// output is not lost when it is not newline-terminated.
-			common.FlushWriter(outWriter)
-			common.FlushWriter(errWriter)
-			if copyErr != nil {
-				common.Logger(ctx).Error(copyErr)
 			}
 		}()
 		return nil
@@ -1007,7 +901,7 @@ func (cr *containerReference) start() common.Executor {
 		logger := common.Logger(ctx)
 		logger.Debugf("Starting container: %v", cr.id)
 
-		if _, err := cr.cli.ContainerStart(ctx, cr.id, client.ContainerStartOptions{}); err != nil {
+		if err := cr.cli.ContainerStart(ctx, cr.id, types.ContainerStartOptions{}); err != nil { //nolint:staticcheck // pre-existing issue from nektos/act
 			return fmt.Errorf("failed to start container: %w", err)
 		}
 
@@ -1019,38 +913,24 @@ func (cr *containerReference) start() common.Executor {
 func (cr *containerReference) wait() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		waitResult := cr.cli.ContainerWait(ctx, cr.id, client.ContainerWaitOptions{
+		statusCh, errCh := cr.cli.ContainerWait(ctx, cr.id, container.WaitConditionNotRunning)
-			Condition: container.WaitConditionNotRunning,
-		})
 		var statusCode int64
 		select {
-		case err := <-waitResult.Error:
+		case err := <-errCh:
 			if err != nil {
 				return fmt.Errorf("failed to wait for container: %w", err)
 			}
-		case status := <-waitResult.Result:
+		case status := <-statusCh:
 			statusCode = status.StatusCode
 		}
 
 		logger.Debugf("Return status: %v", statusCode)
 
-		// The container has exited; wait for the attach() streaming goroutine to
-		// finish draining and flushing its output before returning, so the tail
-		// of the log is not lost. Bounded so a stuck stream cannot hang the step.
-		if cr.attachDone != nil {
-			select {
-			case <-cr.attachDone:
-			case <-time.After(drainGracePeriod):
-				logger.Warn("Timed out draining container output")
-			}
-			cr.attachDone = nil
-		}
-
 		if statusCode == 0 {
 			return nil
 		}
 
-		return ExitCodeError(statusCode)
+		return fmt.Errorf("exit with `FAILURE`: %v", statusCode)
 	}
 }
 
@@ -1060,7 +940,22 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 	logger := common.Logger(ctx)
 
 	if len(cr.input.ValidVolumes) > 0 {
-		matcher := newValidVolumeMatcher(ctx, cr.input.ValidVolumes)
+		globs := make([]glob.Glob, 0, len(cr.input.ValidVolumes))
+		for _, v := range cr.input.ValidVolumes {
+			if g, err := glob.Compile(v); err != nil {
+				logger.Errorf("create glob from %s error: %v", v, err)
+			} else {
+				globs = append(globs, g)
+			}
+		}
+		isValid := func(v string) bool {
+			for _, g := range globs {
+				if g.Match(v) {
+					return true
+				}
+			}
+			return false
+		}
 		// sanitize binds
 		sanitizedBinds := make([]string, 0, len(hostConfig.Binds))
 		for _, bind := range hostConfig.Binds {
@@ -1074,7 +969,7 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 				sanitizedBinds = append(sanitizedBinds, bind)
 				continue
 			}
-			if matcher.isValid(parsed.Source, mount.Type(parsed.Type)) {
+			if isValid(parsed.Source) {
 				sanitizedBinds = append(sanitizedBinds, bind)
 			} else {
 				logger.Warnf("[%s] is not a valid volume, will be ignored", parsed.Source)
@@ -1084,7 +979,7 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 		// sanitize mounts
 		sanitizedMounts := make([]mount.Mount, 0, len(hostConfig.Mounts))
 		for _, mt := range hostConfig.Mounts {
-			if matcher.isValid(mt.Source, mt.Type) {
+			if isValid(mt.Source) {
 				sanitizedMounts = append(sanitizedMounts, mt)
 			} else {
 				logger.Warnf("[%s] is not a valid volume, will be ignored", mt.Source)
@@ -1098,129 +993,3 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 
 	return config, hostConfig
 }
-
-type validVolumeMatcher struct {
-	allowAll bool
-	named    []glob.Glob
-	host     []glob.Glob
-}
-
-func newValidVolumeMatcher(ctx context.Context, validVolumes []string) validVolumeMatcher {
-	logger := common.Logger(ctx)
-	ret := validVolumeMatcher{
-		named: make([]glob.Glob, 0, len(validVolumes)),
-		host:  make([]glob.Glob, 0, len(validVolumes)),
-	}
-
-	for _, v := range validVolumes {
-		if v == "**" {
-			ret.allowAll = true
-			continue
-		}
-		if !isHostVolumePattern(v) {
-			if g, err := glob.Compile(v); err != nil {
-				logger.Errorf("create glob from %s error: %v", v, err)
-			} else {
-				ret.named = append(ret.named, g)
-			}
-			continue
-		}
-		normalized, err := normalizeHostVolumePath(v)
-		if err != nil {
-			logger.Errorf("normalize volume pattern %s error: %v", v, err)
-			continue
-		}
-		if g, err := glob.Compile(normalized); err != nil {
-			logger.Errorf("create glob from %s error: %v", normalized, err)
-		} else {
-			ret.host = append(ret.host, g)
-		}
-	}
-
-	return ret
-}
-
-func (m validVolumeMatcher) isValid(source string, sourceType mount.Type) bool {
-	if m.allowAll {
-		return true
-	}
-	if isHostVolumeSource(source, sourceType) {
-		normalized, err := normalizeHostVolumePath(source)
-		if err != nil {
-			return false
-		}
-		for _, g := range m.host {
-			if g.Match(normalized) {
-				return true
-			}
-		}
-		return false
-	}
-	for _, g := range m.named {
-		if g.Match(source) {
-			return true
-		}
-	}
-	return false
-}
-
-func isHostVolumePattern(pattern string) bool {
-	return filepath.IsAbs(pattern) ||
-		strings.HasPrefix(pattern, "."+string(filepath.Separator)) ||
-		strings.HasPrefix(pattern, ".."+string(filepath.Separator)) ||
-		strings.Contains(pattern, "/") ||
-		strings.Contains(pattern, `\`)
-}
-
-func isHostVolumeSource(source string, sourceType mount.Type) bool {
-	if sourceType == mount.TypeBind {
-		return true
-	}
-	if sourceType == mount.TypeVolume {
-		return false
-	}
-	return isHostVolumePattern(source)
-}
-
-func normalizeHostVolumePath(path string) (string, error) {
-	abs, err := filepath.Abs(path)
-	if err != nil {
-		return "", err
-	}
-	return evalSymlinksExistingPrefix(abs)
-}
-
-func evalSymlinksExistingPrefix(path string) (string, error) {
-	resolved, err := filepath.EvalSymlinks(path)
-	if err == nil {
-		return filepath.Clean(resolved), nil
-	}
-	if !errors.Is(err, os.ErrNotExist) {
-		return "", err
-	}
-
-	current := path
-	var missing []string
-	for {
-		_, err := os.Lstat(current)
-		if err == nil {
-			resolved, err := filepath.EvalSymlinks(current)
-			if err != nil {
-				return "", err
-			}
-			for _, name := range slices.Backward(missing) {
-				resolved = filepath.Join(resolved, name)
-			}
-			return filepath.Clean(resolved), nil
-		}
-		if !errors.Is(err, os.ErrNotExist) {
-			return "", err
-		}
-		parent := filepath.Dir(current)
-		if parent == current {
-			return filepath.Clean(path), nil
-		}
-		missing = append(missing, filepath.Base(current))
-		current = parent
-	}
-}

act/container/docker_run_test.go

@@ -8,33 +8,27 @@ import (
 	"bufio"
 	"bytes"
 	"context"
-	"encoding/binary"
 	"errors"
 	"io"
 	"net"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 
-	cerrdefs "github.com/containerd/errdefs"
+	"github.com/docker/docker/api/types"
-	"github.com/moby/moby/api/pkg/stdcopy"
+	"github.com/docker/docker/api/types/container"
-	"github.com/moby/moby/api/types/container"
+	"github.com/docker/docker/client"
-	mobyclient "github.com/moby/moby/client"
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 )
 
 func TestDocker(t *testing.T) {
-	requireDocker(t)
 	ctx := context.Background()
 	client, err := GetDockerClient(ctx)
-	require.NoError(t, err)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
 	defer client.Close()
 
 	dockerBuild := NewDockerBuildExecutor(NewDockerBuildExecutorInput{
@@ -72,53 +66,28 @@ func TestDocker(t *testing.T) {
 }
 
 type mockDockerClient struct {
-	mobyclient.APIClient
+	client.APIClient
 	mock.Mock
 }
 
-func (m *mockDockerClient) ExecCreate(ctx context.Context, id string, opts mobyclient.ExecCreateOptions) (mobyclient.ExecCreateResult, error) {
+func (m *mockDockerClient) ContainerExecCreate(ctx context.Context, id string, opts types.ExecConfig) (types.IDResponse, error) {
 	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecCreateResult), args.Error(1)
+	return args.Get(0).(types.IDResponse), args.Error(1)
 }
 
-func (m *mockDockerClient) ExecAttach(ctx context.Context, id string, opts mobyclient.ExecAttachOptions) (mobyclient.ExecAttachResult, error) {
+func (m *mockDockerClient) ContainerExecAttach(ctx context.Context, id string, opts types.ExecStartCheck) (types.HijackedResponse, error) {
 	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecAttachResult), args.Error(1)
+	return args.Get(0).(types.HijackedResponse), args.Error(1)
 }
 
-func (m *mockDockerClient) ExecInspect(ctx context.Context, execID string, opts mobyclient.ExecInspectOptions) (mobyclient.ExecInspectResult, error) {
+func (m *mockDockerClient) ContainerExecInspect(ctx context.Context, execID string) (types.ContainerExecInspect, error) {
-	args := m.Called(ctx, execID, opts)
+	args := m.Called(ctx, execID)
-	return args.Get(0).(mobyclient.ExecInspectResult), args.Error(1)
+	return args.Get(0).(types.ContainerExecInspect), args.Error(1)
 }
 
-func (m *mockDockerClient) ContainerAttach(ctx context.Context, containerID string, opts mobyclient.ContainerAttachOptions) (mobyclient.ContainerAttachResult, error) {
+func (m *mockDockerClient) CopyToContainer(ctx context.Context, id, path string, content io.Reader, options types.CopyToContainerOptions) error {
-	args := m.Called(ctx, containerID, opts)
+	args := m.Called(ctx, id, path, content, options)
-	return args.Get(0).(mobyclient.ContainerAttachResult), args.Error(1)
+	return args.Error(0)
-}
-
-func (m *mockDockerClient) ContainerWait(ctx context.Context, containerID string, opts mobyclient.ContainerWaitOptions) mobyclient.ContainerWaitResult {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerWaitResult)
-}
-
-func (m *mockDockerClient) CopyToContainer(ctx context.Context, id string, options mobyclient.CopyToContainerOptions) (mobyclient.CopyToContainerResult, error) {
-	args := m.Called(ctx, id, options)
-	return args.Get(0).(mobyclient.CopyToContainerResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerInspect(ctx context.Context, id string, opts mobyclient.ContainerInspectOptions) (mobyclient.ContainerInspectResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerInspectResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerList(ctx context.Context, opts mobyclient.ContainerListOptions) (mobyclient.ContainerListResult, error) {
-	args := m.Called(ctx, opts)
-	return args.Get(0).(mobyclient.ContainerListResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerRemove(ctx context.Context, id string, opts mobyclient.ContainerRemoveOptions) (mobyclient.ContainerRemoveResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerRemoveResult), args.Error(1)
 }
 
 type endlessReader struct {
@@ -150,12 +119,10 @@ func TestDockerExecAbort(t *testing.T) {
 	conn.On("Write", mock.AnythingOfType("[]uint8")).Return(1, nil)
 
 	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
+	client.On("ContainerExecCreate", ctx, "123", mock.AnythingOfType("types.ExecConfig")).Return(types.IDResponse{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
+	client.On("ContainerExecAttach", ctx, "id", mock.AnythingOfType("types.ExecStartCheck")).Return(types.HijackedResponse{
-		HijackedResponse: mobyclient.HijackedResponse{
+		Conn:   conn,
-			Conn:   conn,
+		Reader: bufio.NewReader(endlessReader{}),
-			Reader: bufio.NewReader(endlessReader{}),
-		},
 	}, nil)
 
 	cr := &containerReference{
@@ -189,14 +156,12 @@ func TestDockerExecFailure(t *testing.T) {
 	conn := &mockConn{}
 
 	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
+	client.On("ContainerExecCreate", ctx, "123", mock.AnythingOfType("types.ExecConfig")).Return(types.IDResponse{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
+	client.On("ContainerExecAttach", ctx, "id", mock.AnythingOfType("types.ExecStartCheck")).Return(types.HijackedResponse{
-		HijackedResponse: mobyclient.HijackedResponse{
+		Conn:   conn,
-			Conn:   conn,
+		Reader: bufio.NewReader(strings.NewReader("output")),
-			Reader: bufio.NewReader(strings.NewReader("output")),
-		},
 	}, nil)
-	client.On("ExecInspect", ctx, "id", mobyclient.ExecInspectOptions{}).Return(mobyclient.ExecInspectResult{
+	client.On("ContainerExecInspect", ctx, "id").Return(types.ContainerExecInspect{
 		ExitCode: 1,
 	}, nil)
 
@@ -209,121 +174,20 @@ func TestDockerExecFailure(t *testing.T) {
 	}
 
 	err := cr.exec([]string{""}, map[string]string{}, "user", "workdir")(ctx)
-	var exitErr ExitCodeError
+	assert.Error(t, err, "exit with `FAILURE`: 1") //nolint:testifylint // pre-existing issue from nektos/act
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(1), exitErr)
-	assert.Equal(t, "Process completed with exit code 1.", err.Error())
 
 	conn.AssertExpectations(t)
 	client.AssertExpectations(t)
 }
 
-// stdcopyFrame wraps payload in a single Docker multiplexed-stream frame, the
-// format StdCopy expects: an 8-byte header (stream type + 4-byte big-endian
-// length) followed by the payload.
-func stdcopyFrame(stream stdcopy.StdType, payload string) []byte {
-	b := make([]byte, 8+len(payload))
-	b[0] = byte(stream)
-	binary.BigEndian.PutUint32(b[4:8], uint32(len(payload)))
-	copy(b[8:], payload)
-	return b
-}
-
-// TestDockerAttachFlushesTrailingLine verifies that wait() blocks until the
-// attach() streaming goroutine has drained and flushed the container's output,
-// so a final line without a trailing newline is not lost.
-func TestDockerAttachFlushesTrailingLine(t *testing.T) {
-	ctx := context.Background()
-
-	framed := bytes.NewBuffer(stdcopyFrame(stdcopy.Stdout, "line one\nlast line without newline"))
-
-	var lines []string
-	logWriter := common.NewLineWriter(func(s string) bool {
-		lines = append(lines, s)
-		return true
-	})
-
-	client := &mockDockerClient{}
-	client.On("ContainerAttach", ctx, "123", mock.AnythingOfType("client.ContainerAttachOptions")).
-		Return(mobyclient.ContainerAttachResult{
-			HijackedResponse: mobyclient.HijackedResponse{
-				Conn:   &mockConn{},
-				Reader: bufio.NewReader(framed),
-			},
-		}, nil)
-
-	statusCh := make(chan container.WaitResponse, 1)
-	statusCh <- container.WaitResponse{StatusCode: 0}
-	errCh := make(chan error, 1)
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image:  "image",
-			Stdout: logWriter,
-			Stderr: logWriter,
-		},
-	}
-
-	require.NoError(t, cr.attach()(ctx))
-	require.NoError(t, cr.wait()(ctx))
-
-	// wait() must have blocked until the goroutine drained AND flushed; the
-	// trailing, non-newline-terminated line must therefore be present. Reading
-	// lines here is race-free because wait() synchronizes on attachDone, which
-	// the goroutine closes after the final append.
-	assert.Equal(t, []string{"line one\n", "last line without newline"}, lines)
-
-	client.AssertExpectations(t)
-}
-
-func TestDockerWaitFailure(t *testing.T) {
-	ctx := context.Background()
-
-	statusCh := make(chan container.WaitResponse, 1)
-	statusCh <- container.WaitResponse{StatusCode: 2}
-	errCh := make(chan error, 1)
-
-	client := &mockDockerClient{}
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image: "image",
-		},
-	}
-
-	err := cr.wait()(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(2), exitErr)
-	assert.Equal(t, "Process completed with exit code 2.", err.Error())
-
-	client.AssertExpectations(t)
-}
-
 func TestDockerCopyTarStream(t *testing.T) {
 	ctx := context.Background()
 
+	conn := &mockConn{}
+
 	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(nil)
-		return opts.DestinationPath == "/" && opts.Content != nil
+	client.On("CopyToContainer", ctx, "123", "/var/run/act", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(nil)
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
 	cr := &containerReference{
 		id:  "123",
 		cli: client,
@@ -334,18 +198,20 @@ func TestDockerCopyTarStream(t *testing.T) {
 
 	_ = cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
 
+	conn.AssertExpectations(t)
 	client.AssertExpectations(t)
 }
 
 func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) {
 	ctx := context.Background()
 
+	conn := &mockConn{}
+
 	merr := errors.New("Failure")
 
 	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(merr)
-		return opts.DestinationPath == "/" && opts.Content != nil
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(merr)
-	})).Return(mobyclient.CopyToContainerResult{}, merr)
 	cr := &containerReference{
 		id:  "123",
 		cli: client,
@@ -357,21 +223,20 @@ func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) {
 	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
 	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
 
+	conn.AssertExpectations(t)
 	client.AssertExpectations(t)
 }
 
 func TestDockerCopyTarStreamErrorInMkdir(t *testing.T) {
 	ctx := context.Background()
 
+	conn := &mockConn{}
+
 	merr := errors.New("Failure")
 
 	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(nil)
-		return opts.DestinationPath == "/" && opts.Content != nil
+	client.On("CopyToContainer", ctx, "123", "/var/run/act", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(merr)
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, merr)
 	cr := &containerReference{
 		id:  "123",
 		cli: client,
@@ -383,171 +248,10 @@ func TestDockerCopyTarStreamErrorInMkdir(t *testing.T) {
 	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
 	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
 
+	conn.AssertExpectations(t)
 	client.AssertExpectations(t)
 }
 
-// A remove that raced the daemon's AutoRemove teardown is not a failure and must not
-// be logged as one.
-func TestRemoveIgnoresAutoRemoveRace(t *testing.T) {
-	removeOpts := mobyclient.ContainerRemoveOptions{RemoveVolumes: true, Force: true}
-	for _, tc := range []struct {
-		name     string
-		err      error
-		wantLogs bool
-	}{
-		{name: "removal in progress", err: cerrdefs.ErrConflict.WithMessage("removal of container abc is already in progress")},
-		{name: "already removed", err: cerrdefs.ErrNotFound.WithMessage("No such container: abc")},
-		{name: "removed cleanly", err: nil},
-		{name: "real failure", err: errors.New("driver failed to remove root filesystem"), wantLogs: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			logger, hook := test.NewNullLogger()
-			ctx := common.WithLogger(context.Background(), logger)
-			client := &mockDockerClient{}
-			client.On("ContainerRemove", ctx, "abc", removeOpts).Return(mobyclient.ContainerRemoveResult{}, tc.err)
-			cr := &containerReference{id: "abc", cli: client}
-
-			require.NoError(t, cr.remove()(ctx))
-			assert.Empty(t, cr.id)
-
-			if tc.wantLogs {
-				assert.Len(t, hook.AllEntries(), 1)
-			} else {
-				assert.Empty(t, hook.AllEntries())
-			}
-			client.AssertExpectations(t)
-		})
-	}
-}
-
-// find() must drop a stale cached id so later Copy/Exec don't hit the
-// daemon with a torn-down container.
-func TestFindRevalidatesStaleID(t *testing.T) {
-	ctx := context.Background()
-	notFound := cerrdefs.ErrNotFound.WithMessage("No such container")
-	boom := errors.New("daemon unreachable")
-	newCR := func(id string) (*containerReference, *mockDockerClient) {
-		client := &mockDockerClient{}
-		return &containerReference{id: id, cli: client, input: &NewContainerInput{Name: "job-1"}}, client
-	}
-	listOpts := mobyclient.ContainerListOptions{All: true}
-	inspectOpts := mobyclient.ContainerInspectOptions{}
-
-	t.Run("stale id cleared, name lookup empty", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Empty(t, cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("stale id cleared, name lookup repopulates", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "other", Names: []string{"/somebody-else"}},
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "fresh", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("live id kept", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("transient inspect error trusts cache", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, boom)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("list error propagates", func(t *testing.T) {
-		cr, client := newCR("")
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, boom)
-		require.ErrorIs(t, cr.find()(ctx), boom)
-		client.AssertExpectations(t)
-	})
-}
-
-// Every daemon entry point fails fast with a clear, container-named
-// error when no live cr.id is known.
-func TestRejectsMissingContainer(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).Return(mobyclient.ContainerListResult{}, nil)
-	cr := &containerReference{cli: client, input: &NewContainerInput{Name: "job-1"}}
-	check := func(op string, err error) {
-		t.Helper()
-		require.Error(t, err, op)
-		assert.Contains(t, err.Error(), `container "job-1" does not exist`, op)
-	}
-	check("copyContent", cr.copyContent("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	check("copyDir", cr.copyDir("/var/run/act", "/src", false)(ctx))
-	check("CopyTarStream", cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{}))
-	check("exec", cr.exec([]string{"echo"}, nil, "", "")(ctx))
-	_, err := cr.GetContainerArchive(ctx, "/var/run/act/x")
-	check("GetContainerArchive", err)
-}
-
-// End-to-end: a stale cr.id is cleared, repopulated from name lookup,
-// and the Copy completes against the fresh id.
-func TestPublicCopyPipelineHandlesStaleID(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerInspect", ctx, "stale", mobyclient.ContainerInspectOptions{}).
-		Return(mobyclient.ContainerInspectResult{}, cerrdefs.ErrNotFound.WithMessage("gone"))
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).
-		Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-	client.On("CopyToContainer", ctx, "fresh", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act"
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-
-	cr := &containerReference{id: "stale", cli: client, input: &NewContainerInput{Name: "job-1"}}
-	require.NoError(t, cr.Copy("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	assert.Equal(t, "fresh", cr.id)
-	client.AssertExpectations(t)
-}
-
-// TestDockerCopyToSymlinkPath is a regression test for gitea/runner#981. Most base images
-// symlink /var/run to /run, so copying into /var/run/act traverses that symlink. The broken
-// docker 29.5.1 daemon fails the extraction with "mkdirat var/run: file exists" (fixed in
-// 29.5.2). Running against the daemon shipped in the dind image, this catches a bad bump.
-func TestDockerCopyToSymlinkPath(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-
-	rc := NewContainer(&NewContainerInput{
-		Image:      "alpine:latest",
-		Entrypoint: []string{"sleep", "30"},
-		Name:       "act-test-symlink-" + time.Now().Format("20060102150405.000000"),
-		AutoRemove: true,
-	})
-	require.NoError(t, rc.Pull(false)(ctx))
-	require.NoError(t, rc.Create(nil, nil)(ctx))
-	require.NoError(t, rc.Start(false)(ctx))
-	t.Cleanup(func() {
-		_ = rc.Remove()(ctx)
-		_ = rc.Close()(ctx)
-	})
-
-	// CopyTarStream first creates the destination directory by extracting a tar at "/",
-	// which makes the daemon mkdir var, then var/run (the symlink), then act — the exact
-	// step that fails on the broken daemon.
-	err := rc.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
-	require.NoError(t, err)
-}
-
 // Type assert containerReference implements ExecutionsEnvironment
 var _ ExecutionsEnvironment = &containerReference{}
 
@@ -623,40 +327,3 @@ func TestCheckVolumes(t *testing.T) {
 		})
 	}
 }
-
-func TestCheckVolumesRejectsEscapingHostPaths(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-
-	base := t.TempDir()
-	allowed := filepath.Join(base, "allowed")
-	denied := filepath.Join(base, "denied")
-	require.NoError(t, os.MkdirAll(allowed, 0o700))
-	require.NoError(t, os.MkdirAll(denied, 0o700))
-
-	cr := &containerReference{
-		input: &NewContainerInput{
-			ValidVolumes: []string{filepath.Join(allowed, "**")},
-		},
-	}
-
-	escapingPath := allowed + string(filepath.Separator) + ".." + string(filepath.Separator) + "denied"
-	_, hostConf := cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{escapingPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	linkPath := filepath.Join(allowed, "link")
-	if err := os.Symlink(denied, linkPath); err != nil {
-		t.Skipf("cannot create symlink: %v", err)
-	}
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{linkPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{filepath.Join(linkPath, "missing") + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-}

act/container/docker_socket_test.go

@@ -18,19 +18,9 @@ func init() {
 
 var originalCommonSocketLocations = CommonSocketLocations
 
-func isolateSocketEnv(t *testing.T) {
-	t.Helper()
-	t.Cleanup(func() { CommonSocketLocations = originalCommonSocketLocations })
-	if host, ok := os.LookupEnv("DOCKER_HOST"); ok {
-		t.Setenv("DOCKER_HOST", host)
-	} else {
-		t.Cleanup(func() { os.Unsetenv("DOCKER_HOST") })
-	}
-}
-
 func TestGetSocketAndHostWithSocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
+	CommonSocketLocations = originalCommonSocketLocations
 	dockerHost := "unix:///my/docker/host.sock"
 	socketURI := "/path/to/my.socket"
 	t.Setenv("DOCKER_HOST", dockerHost)
@@ -58,9 +48,9 @@ func TestGetSocketAndHostNoSocket(t *testing.T) {
 
 func TestGetSocketAndHostOnlySocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	socketURI := "/path/to/my.socket"
 	os.Unsetenv("DOCKER_HOST")
+	CommonSocketLocations = originalCommonSocketLocations
 	defaultSocket, defaultSocketFound := socketLocation()
 
 	// Act
@@ -75,7 +65,7 @@ func TestGetSocketAndHostOnlySocket(t *testing.T) {
 
 func TestGetSocketAndHostDontMount(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
+	CommonSocketLocations = originalCommonSocketLocations
 	dockerHost := "unix:///my/docker/host.sock"
 	t.Setenv("DOCKER_HOST", dockerHost)
 
@@ -89,7 +79,7 @@ func TestGetSocketAndHostDontMount(t *testing.T) {
 
 func TestGetSocketAndHostNoHostNoSocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
+	CommonSocketLocations = originalCommonSocketLocations
 	os.Unsetenv("DOCKER_HOST")
 	defaultSocket, found := socketLocation()
 
@@ -107,7 +97,6 @@ func TestGetSocketAndHostNoHostNoSocket(t *testing.T) {
 // > This happens if neither DOCKER_HOST nor --container-daemon-socket has a value, but socketLocation() returns a URI
 func TestGetSocketAndHostNoHostNoSocketDefaultLocation(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	mySocketFile, tmpErr := os.CreateTemp(t.TempDir(), "act-*.sock")
 	mySocket := mySocketFile.Name()
 	unixSocket := "unix://" + mySocket
@@ -130,7 +119,6 @@ func TestGetSocketAndHostNoHostNoSocketDefaultLocation(t *testing.T) {
 
 func TestGetSocketAndHostNoHostInvalidSocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	os.Unsetenv("DOCKER_HOST")
 	mySocket := "/my/socket/path.sock"
 	CommonSocketLocations = []string{"/unusual", "/socket", "/location"}
@@ -148,7 +136,6 @@ func TestGetSocketAndHostNoHostInvalidSocket(t *testing.T) {
 
 func TestGetSocketAndHostOnlySocketValidButUnusualLocation(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	socketURI := "unix:///path/to/my.socket"
 	CommonSocketLocations = []string{"/unusual", "/location"}
 	os.Unsetenv("DOCKER_HOST")

act/container/docker_stub.go

@@ -12,7 +12,7 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/moby/api/types/system"
+	"github.com/docker/docker/api/types"
 	"github.com/pkg/errors"
 )
 
@@ -51,8 +51,8 @@ func RunnerArch(ctx context.Context) string {
 	return runtime.GOOS
 }
 
-func GetHostInfo(ctx context.Context) (info system.Info, err error) {
+func GetHostInfo(ctx context.Context) (info types.Info, err error) {
-	return system.Info{}, nil
+	return types.Info{}, nil
 }
 
 func NewDockerVolumeRemoveExecutor(volume string, force bool) common.Executor {
@@ -61,7 +61,7 @@ func NewDockerVolumeRemoveExecutor(volume string, force bool) common.Executor {
 	}
 }
 
-func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExecutorInput) common.Executor {
+func NewDockerNetworkCreateExecutor(name string) common.Executor {
 	return func(ctx context.Context) error {
 		return nil
 	}

act/container/docker_volume.go

@@ -11,7 +11,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/moby/client"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/volume"
 )
 
 func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executor {
@@ -22,12 +23,12 @@ func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executo
 		}
 		defer cli.Close()
 
-		list, err := cli.VolumeList(ctx, client.VolumeListOptions{})
+		list, err := cli.VolumeList(ctx, volume.ListOptions{Filters: filters.NewArgs()})
 		if err != nil {
 			return err
 		}
 
-		for _, vol := range list.Items {
+		for _, vol := range list.Volumes {
 			if vol.Name == volumeName {
 				return removeExecutor(volumeName, force)(ctx)
 			}
@@ -41,7 +42,7 @@ func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executo
 func removeExecutor(volume string, force bool) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		logger.Debugf("docker volume rm %s", volume)
+		logger.Debugf("%sdocker volume rm %s", logPrefix, volume)
 
 		if common.Dryrun(ctx) {
 			return nil
@@ -53,7 +54,6 @@ func removeExecutor(volume string, force bool) common.Executor {
 		}
 		defer cli.Close()
 
-		_, err = cli.VolumeRemove(ctx, volume, client.VolumeRemoveOptions{Force: force})
+		return cli.VolumeRemove(ctx, volume, force)
-		return err
 	}
 }

act/container/helpers_test.go

@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"testing"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}

act/container/host_environment.go

@@ -17,14 +17,11 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
-	"sync"
-	"sync/atomic"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/filecollector"
 	"gitea.com/gitea/runner/act/lookpath"
-	"gitea.com/gitea/runner/internal/pkg/process"
 
 	"github.com/go-git/go-billy/v5/helper/polyfill"
 	"github.com/go-git/go-billy/v5/osfs"
@@ -37,32 +34,9 @@ type HostEnvironment struct {
 	TmpDir    string
 	ToolCache string
 	Workdir   string
-	// CleanWorkdir means teardown owns Workdir and may delete it. Leave false
+	ActPath   string
-	// when Workdir points at a caller-owned checkout (e.g. `act` local mode).
+	CleanUp   func()
-	CleanWorkdir bool
+	StdOut    io.Writer
-	ActPath      string
-	CleanUp      func()
-	StdOut       io.Writer
-	AllocatePTY  bool // allocate a pseudo-TTY for each step's process
-
-	// procGroup owns every process the job's steps start. Atomic: Remove may read
-	// it while a step is still starting.
-	procGroupOnce sync.Once
-	procGroup     atomic.Pointer[process.Group]
-}
-
-// processGroup returns the job-scoped process group, creating it on first use.
-// Returns nil if the job object could not be created; Group is nil-safe.
-func (e *HostEnvironment) processGroup(ctx context.Context) *process.Group {
-	e.procGroupOnce.Do(func() {
-		group, err := process.NewGroup()
-		if err != nil {
-			common.Logger(ctx).Warnf("could not create the job's process group; processes a step leaves behind can only be reclaimed by the workspace scan: %v", err)
-			return
-		}
-		e.procGroup.Store(group)
-	})
-	return e.procGroup.Load()
 }
 
 func (e *HostEnvironment) Create(_, _ []string) common.Executor {
@@ -218,12 +192,12 @@ func (e *HostEnvironment) Start(_ bool) common.Executor {
 
 type ptyWriter struct {
 	Out       io.Writer
-	AutoStop  atomic.Bool
+	AutoStop  bool
 	dirtyLine bool
 }
 
 func (w *ptyWriter) Write(buf []byte) (int, error) {
-	if w.AutoStop.Load() && len(buf) > 0 && buf[len(buf)-1] == 4 {
+	if w.AutoStop && len(buf) > 0 && buf[len(buf)-1] == 4 {
 		n, err := w.Out.Write(buf[:len(buf)-1])
 		if err != nil {
 			return n, err
@@ -282,7 +256,7 @@ func setupPty(cmd *exec.Cmd, cmdline string) (*os.File, *os.File, error) {
 	cmd.Stdin = tty
 	cmd.Stdout = tty
 	cmd.Stderr = tty
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, true)
+	cmd.SysProcAttr = getSysProcAttr(cmdline, true)
 	return ppty, tty, nil
 }
 
@@ -342,12 +316,7 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 	cmd.Env = envList
 	cmd.Stderr = e.StdOut
 	cmd.Dir = wd
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, false)
+	cmd.SysProcAttr = getSysProcAttr(cmdline, false)
-
-	// Kills the step's whole tree on cancellation and bounds the post-exit I/O
-	// wait, so an orphan holding cmd's stdout pipe cannot hang cmd.Wait().
-	treeKill := process.NewTreeKill(cmd)
-
 	var ppty *os.File
 	var tty *os.File
 	defer func() {
@@ -358,49 +327,36 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 			tty.Close()
 		}
 	}()
-	if e.AllocatePTY {
+	if true /* allocate Terminal */ {
 		var err error
 		ppty, tty, err = setupPty(cmd, cmdline)
 		if err != nil {
 			common.Logger(ctx).Debugf("Failed to setup Pty %v\n", err.Error())
 		}
 	}
-	var writer *ptyWriter
+	writer := &ptyWriter{Out: e.StdOut}
-	var logctx context.Context
+	logctx, finishLog := context.WithCancel(context.Background())
 	if ppty != nil {
-		writer = &ptyWriter{Out: e.StdOut}
-		var finishLog context.CancelFunc
-		logctx, finishLog = context.WithCancel(context.Background())
 		go copyPtyOutput(writer, ppty, finishLog)
+	} else {
+		finishLog()
+	}
+	if ppty != nil {
 		go writeKeepAlive(ppty)
 	}
-	if err := cmd.Start(); err != nil {
+	err = cmd.Run()
-		return err
-	}
-	// Assign before the step's Killer so the step's job nests inside the group's;
-	// cancellation still scopes to this step's tree.
-	if err := e.processGroup(ctx).Assign(cmd.Process); err != nil {
-		common.Logger(ctx).Warnf("could not assign the step's process to the job's process group; a process it leaves behind may outlive the job: %v", err)
-	}
-	if k, kerr := treeKill.Capture(cmd.Process); kerr != nil {
-		common.Logger(ctx).Warnf("process tree kill setup failed, falling back to single-process kill: %v", kerr)
-	} else {
-		defer k.Close()
-	}
-	err = cmd.Wait()
 	if err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
-			return ExitCodeError(exitErr.ExitCode())
-		}
 		return err
 	}
 	if tty != nil {
-		writer.AutoStop.Store(true)
+		writer.AutoStop = true
 		if _, err := tty.WriteString("\x04"); err != nil {
 			common.Logger(ctx).Debug("Failed to write EOT")
 		}
-		<-logctx.Done()
+	}
+	<-logctx.Done()
+
+	if ppty != nil {
 		ppty.Close()
 		ppty = nil
 	}
@@ -429,201 +385,12 @@ func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string)
 	return parseEnvFile(e, srcPath, env)
 }
 
-// removeAll is a var so tests can substitute a blocking stub.
-var removeAll = os.RemoveAll
-
-// removeAllWithContext returns once the delete finishes or ctx is cancelled. On
-// cancellation the goroutine leaks: a delete inside a syscall cannot be
-// interrupted (see runWithTimeout).
-func removeAllWithContext(ctx context.Context, path string) error {
-	done := make(chan error, 1)
-	go func() { done <- removeAll(path) }()
-	select {
-	case err := <-done:
-		return err
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
-func removePathWithRetry(ctx context.Context, path string) error {
-	if path == "" {
-		return nil
-	}
-	attempts := 1
-	delay := time.Duration(0)
-	if runtime.GOOS == "windows" {
-		attempts = 5
-		delay = 200 * time.Millisecond
-	}
-	var lastErr error
-	for i := 0; i < attempts; i++ {
-		if i > 0 {
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			case <-time.After(delay):
-			}
-		}
-		lastErr = removeAllWithContext(ctx, path)
-		if lastErr == nil {
-			return nil
-		}
-		if errors.Is(lastErr, context.DeadlineExceeded) {
-			return lastErr
-		}
-	}
-	return lastErr
-}
-
-// buildWindowsWorkspaceKillScript builds a PowerShell command that taskkills
-// every process tree whose ExecutablePath or CommandLine references one of the
-// given workspace dirs, releasing file handles for cleanup. Win32_Process
-// exposes both fields (Get-Process doesn't, wmic is deprecated); matching is on
-// the dir+separator prefix via ordinal String methods, so a name-prefix sibling
-// (job1 vs job10) is spared and path metacharacters stay literal.
-func buildWindowsWorkspaceKillScript(dirs []string) string {
-	quoted := make([]string, len(dirs))
-	for i, d := range dirs {
-		// Single-quoted PowerShell literal; escape ' by doubling it.
-		quoted[i] = "'" + strings.ReplaceAll(d, "'", "''") + "'"
-	}
-
-	return `$paths = @(` + strings.Join(quoted, ",") + `)
-$selfPid = $PID
-Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
-    if ($_.ProcessId -eq $selfPid) { return $false }
-    foreach ($p in $paths) {
-        $prefix = $p + '\'
-        if ($_.ExecutablePath -and $_.ExecutablePath.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)) { return $true }
-        if ($_.CommandLine -and $_.CommandLine.IndexOf($prefix, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) { return $true }
-    }
-    return $false
-} | ForEach-Object {
-    & taskkill.exe /PID $_.ProcessId /T /F 2>$null | Out-Null
-}
-`
-}
-
-func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
-	if runtime.GOOS != "windows" {
-		return
-	}
-
-	// Detached: exec.CommandContext won't start on a cancelled ctx, and a
-	// server cancel has already cancelled the parent ctx.
-	killCtx, killCancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer killCancel()
-
-	logger := common.Logger(ctx)
-
-	// Dirs we own; a process referencing one is a leftover. ToolCache is shared
-	// across jobs, and Workdir may be a caller-owned checkout.
-	owned := []string{e.Path, e.TmpDir}
-	if e.CleanWorkdir {
-		owned = append(owned, e.Workdir)
-	}
-	dirs := make([]string, 0, len(owned))
-	for _, d := range owned {
-		if d == "" {
-			continue
-		}
-		abs, err := filepath.Abs(d)
-		if err != nil {
-			continue
-		}
-		dirs = append(dirs, abs)
-	}
-	if len(dirs) == 0 {
-		return
-	}
-
-	script := buildWindowsWorkspaceKillScript(dirs)
-
-	cmd := exec.CommandContext(killCtx, "powershell.exe", "-NoProfile", "-NonInteractive", "-Command", script)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		logger.Debugf("workspace process-tree kill via PowerShell failed: %v output=%s", err, strings.TrimSpace(string(out)))
-	}
-
-	// Win32_Process exposes no working directory, so the scan above misses a
-	// process that merely runs in a workspace dir while pinning a handle on it.
-	if killed, err := process.KillProcessesWithCWDUnder(killCtx, dirs); err != nil {
-		logger.Debugf("workspace process kill by working directory reported errors: %v", err)
-	} else if killed > 0 {
-		logger.Debugf("terminated %d leftover process(es) by workspace working directory", killed)
-	}
-}
-
-// hostCleanupTimeout bounds each teardown phase so one stalled delete cannot
-// wedge the runner slot. A var so tests can shrink it.
-var hostCleanupTimeout = 30 * time.Second
-
-// runWithTimeout returns context.DeadlineExceeded once timeout elapses, leaking
-// the goroutine: a delete blocked in a syscall (AV filter driver, dead network
-// mount) cannot be interrupted, and leaking scratch state beats losing the
-// runner's capacity slot forever. The idle stale-dir sweep reclaims it later.
-func runWithTimeout(fn func(), timeout time.Duration) error {
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		fn()
-	}()
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-	select {
-	case <-done:
-		return nil
-	case <-timer.C:
-		return context.DeadlineExceeded
-	}
-}
-
 func (e *HostEnvironment) Remove() common.Executor {
 	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-
-		// End lingering processes before removing the workspace; on Windows their
-		// file locks block cleanup. Closing the group is deterministic, the scan a net.
-		if err := e.procGroup.Load().Close(); err != nil {
-			logger.Debugf("closing the job's process group failed: %v", err)
-		}
-		e.terminateRunningProcesses(ctx)
-
-		// Removes per-job misc state only, never the toolcache root. Bounded because
-		// CleanUp is a caller-supplied, typically unbounded os.RemoveAll.
 		if e.CleanUp != nil {
-			logger.Debugf("running host environment cleanup callback")
+			e.CleanUp()
-			if err := runWithTimeout(e.CleanUp, hostCleanupTimeout); err != nil {
-				logger.Warnf("host environment cleanup did not finish within %s; continuing job completion, scratch state may be leaked and is reclaimed by the idle stale-dir sweep", hostCleanupTimeout)
-			} else {
-				logger.Debugf("host environment cleanup callback finished")
-			}
 		}
-
+		return os.RemoveAll(e.Path)
-		// Detach: a cancelled ctx would skip removePathWithRetry's retries,
-		// which absorb Windows file-handle release lag after the kill above.
-		rmCtx, rmCancel := context.WithTimeout(context.Background(), hostCleanupTimeout)
-		defer rmCancel()
-
-		var errs []error
-		if err := removePathWithRetry(rmCtx, e.Path); err != nil {
-			logger.Warnf("failed to remove host misc state %s: %v", e.Path, err)
-			errs = append(errs, err)
-		}
-		if e.CleanWorkdir {
-			if err := removePathWithRetry(rmCtx, e.Workdir); err != nil {
-				logger.Warnf("failed to remove host workspace %s: %v", e.Workdir, err)
-				errs = append(errs, err)
-			}
-		}
-		for _, err := range errs {
-			if !errors.Is(err, context.DeadlineExceeded) {
-				return errors.Join(errs...)
-			}
-		}
-		// Teardown timed out; warned above. Do not fail job completion over it.
-		return nil
 	}
 }
 

act/container/host_environment_test.go

@@ -6,22 +6,14 @@ package container
 
 import (
 	"archive/tar"
-	"bytes"
 	"context"
 	"io"
 	"os"
 	"path"
 	"path/filepath"
-	"runtime"
-	"strings"
 	"testing"
-	"time"
 
-	"gitea.com/gitea/runner/act/common"
-
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // Type assert HostEnvironment implements ExecutionsEnvironment
@@ -77,287 +69,3 @@ func TestGetContainerArchive(t *testing.T) {
 	_, err = reader.Next()
 	assert.ErrorIs(t, err, io.EOF)
 }
-
-func TestHostEnvironmentExecExitCode(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses POSIX shell")
-	}
-	dir := t.TempDir()
-	ctx := context.Background()
-	e := &HostEnvironment{
-		Path:      filepath.Join(dir, "path"),
-		TmpDir:    filepath.Join(dir, "tmp"),
-		ToolCache: filepath.Join(dir, "tool_cache"),
-		ActPath:   filepath.Join(dir, "act_path"),
-		StdOut:    io.Discard,
-		Workdir:   filepath.Join(dir, "path"),
-	}
-	for _, p := range []string{e.Path, e.TmpDir, e.ToolCache, e.ActPath} {
-		assert.NoError(t, os.MkdirAll(p, 0o700)) //nolint:testifylint // test setup
-	}
-
-	err := e.Exec([]string{"sh", "-c", "exit 3"}, map[string]string{"PATH": os.Getenv("PATH")}, "", "")(ctx)
-	var exitErr ExitCodeError
-	require.ErrorAs(t, err, &exitErr)
-	assert.Equal(t, ExitCodeError(3), exitErr)
-	assert.Equal(t, "Process completed with exit code 3.", err.Error())
-}
-
-func TestHostEnvironmentAllocatePTY(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses POSIX shell")
-	}
-	for _, tc := range []struct {
-		name     string
-		allocPTY bool
-		expect   string
-	}{
-		{name: "off", allocPTY: false, expect: "NOTTY"},
-		{name: "on", allocPTY: true, expect: "TTY"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			buf := &bytes.Buffer{}
-			e := &HostEnvironment{
-				Path:        filepath.Join(dir, "path"),
-				TmpDir:      filepath.Join(dir, "tmp"),
-				ToolCache:   filepath.Join(dir, "tool_cache"),
-				ActPath:     filepath.Join(dir, "act_path"),
-				StdOut:      buf,
-				Workdir:     filepath.Join(dir, "path"),
-				AllocatePTY: tc.allocPTY,
-			}
-			for _, p := range []string{e.Path, e.TmpDir, e.ToolCache, e.ActPath} {
-				require.NoError(t, os.MkdirAll(p, 0o700))
-			}
-
-			err := e.Exec(
-				[]string{"sh", "-c", "[ -t 1 ] && printf TTY || printf NOTTY"},
-				map[string]string{"PATH": os.Getenv("PATH")}, "", "",
-			)(context.Background())
-			require.NoError(t, err)
-			got := strings.TrimSpace(strings.ReplaceAll(buf.String(), "\r", ""))
-			assert.Equal(t, tc.expect, got)
-		})
-	}
-}
-
-func TestHostEnvironmentRemovePreservesWorkdirByDefault(t *testing.T) {
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	miscRoot := filepath.Join(base, "misc")
-	path := filepath.Join(miscRoot, "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	workdir := filepath.Join(base, "workspace", "owner", "repo")
-	require.NoError(t, os.MkdirAll(workdir, 0o700))
-
-	e := &HostEnvironment{
-		Path:    path,
-		Workdir: workdir,
-		CleanUp: func() {
-			_ = os.RemoveAll(miscRoot)
-		},
-		StdOut: os.Stdout,
-	}
-	require.NoError(t, e.Remove()(ctx))
-	_, err := os.Stat(workdir)
-	require.NoError(t, err)
-}
-
-func TestHostEnvironmentRemoveCleansWorkdirWhenOwned(t *testing.T) {
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	miscRoot := filepath.Join(base, "misc")
-	path := filepath.Join(miscRoot, "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	workdir := filepath.Join(base, "workspace", "123", "owner", "repo")
-	require.NoError(t, os.MkdirAll(workdir, 0o700))
-
-	e := &HostEnvironment{
-		Path:         path,
-		Workdir:      workdir,
-		CleanWorkdir: true,
-		CleanUp: func() {
-			_ = os.RemoveAll(miscRoot)
-		},
-		StdOut: os.Stdout,
-	}
-	require.NoError(t, e.Remove()(ctx))
-	_, err := os.Stat(workdir)
-	assert.ErrorIs(t, err, os.ErrNotExist)
-}
-
-func TestRemoveAllWithContextDoesNotHangOnStuckDelete(t *testing.T) {
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	orig := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// removeAllWithContext intentionally leaks the delete goroutine on timeout,
-	// and that goroutine still references removeAll. Unblock it and wait for it
-	// to return before restoring the var, so the restore can't race the read.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = orig
-	})
-
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-
-	err := removeAllWithContext(ctx, t.TempDir())
-	require.ErrorIs(t, err, context.DeadlineExceeded)
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp guards against a stalled
-// CleanUp callback (e.g. an os.RemoveAll blocked by an AV/EDR filter driver or
-// an unresponsive mount) wedging the runner slot forever at "Cleaning up
-// container". Remove must time out the callback and complete job teardown.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp(t *testing.T) {
-	// Keep the suite fast: shrink the per-phase teardown timeout for this test.
-	orig := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = orig })
-
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	release := make(chan struct{})
-	t.Cleanup(func() { close(release) }) // unblock the leaked goroutine at test end
-
-	e := &HostEnvironment{
-		Path: path,
-		CleanUp: func() {
-			<-release // simulate a delete syscall stuck indefinitely
-		},
-		StdOut: os.Stdout,
-	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck CleanUp callback")
-	}
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval guards against a
-// stalled os.RemoveAll on the misc/workspace paths (same AV/EDR wedge as
-// #1023) wedging job completion after the CleanUp callback has already timed
-// out or finished.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval(t *testing.T) {
-	origTimeout := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = origTimeout })
-
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	origRemoveAll := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// The stuck delete goroutine outlives the timed-out Remove and still reads
-	// removeAll; unblock it and wait before restoring to avoid a restore/read race.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = origRemoveAll
-	})
-
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	e := &HostEnvironment{
-		Path:   path,
-		StdOut: os.Stdout,
-	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck path removal")
-	}
-}
-
-func TestBuildWindowsWorkspaceKillScript(t *testing.T) {
-	t.Run("single dir", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{`C:\workspace\job1`})
-		assert.Contains(t, s, `$paths = @('C:\workspace\job1')`)
-		// Self-PID guard is essential — without it the script could taskkill
-		// the PowerShell process running it.
-		assert.Contains(t, s, "$selfPid = $PID")
-		assert.Contains(t, s, "$_.ProcessId -eq $selfPid")
-		// Must match both ExecutablePath (binaries from the workspace) and
-		// CommandLine (system binaries invoked with workspace paths in args),
-		// both bounded by dir+separator so a name-prefix sibling is spared.
-		assert.Contains(t, s, `$prefix = $p + '\'`)
-		assert.Contains(t, s, "$_.ExecutablePath.StartsWith($prefix")
-		assert.Contains(t, s, "$_.CommandLine.IndexOf($prefix")
-		// Each matched PID must be tree-killed, not just stopped.
-		assert.Contains(t, s, "taskkill.exe /PID $_.ProcessId /T /F")
-	})
-
-	t.Run("multiple dirs comma-separated", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{
-			`C:\work\path`,
-			`C:\work\workdir`,
-			`C:\Users\runner\AppData\Local\Temp\job-42`,
-		})
-		assert.Contains(t, s, `'C:\work\path'`)
-		assert.Contains(t, s, `'C:\work\workdir'`)
-		assert.Contains(t, s, `'C:\Users\runner\AppData\Local\Temp\job-42'`)
-		// Commas between entries — no trailing comma, no leading comma.
-		assert.Contains(t, s, `'C:\work\path','C:\work\workdir',`)
-	})
-
-	t.Run("path with single quote is escaped", func(t *testing.T) {
-		// In PowerShell single-quoted strings the only special char is the
-		// quote itself, escaped by doubling. A workspace path that ever
-		// contained `'` would inject a command into the script otherwise.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\it's\path`})
-		assert.Contains(t, s, `'C:\work\it''s\path'`)
-		// And it must NOT appear unescaped — otherwise the quote would
-		// terminate the literal early.
-		assert.NotContains(t, s, `'C:\work\it's\path'`)
-	})
-
-	t.Run("path with wildcard metacharacters is matched literally", func(t *testing.T) {
-		// A path containing [ ] ? * must be embedded verbatim and matched with
-		// ordinal String methods, not -like, otherwise the metacharacters would
-		// be interpreted as wildcards and the leftover process could escape.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\[job]?1`})
-		assert.Contains(t, s, `'C:\work\[job]?1'`)
-		assert.NotContains(t, s, "-like")
-		assert.Contains(t, s, "StartsWith")
-		assert.Contains(t, s, "IndexOf")
-	})
-
-	t.Run("empty dir list still produces a valid script", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript(nil)
-		// Empty array literal — script runs, matches nothing, is a no-op.
-		assert.Contains(t, s, "$paths = @()")
-		assert.Contains(t, s, "Get-CimInstance Win32_Process")
-	})
-}

act/container/parse_env_file.go

@@ -13,9 +13,6 @@ import (
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
-
-	"golang.org/x/text/encoding/unicode"
-	"golang.org/x/text/transform"
 )
 
 func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Executor {
@@ -31,19 +28,9 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Ex
 		if err != nil && err != io.EOF {
 			return err
 		}
-		// Decode by BOM: Windows PowerShell 5.1 redirection writes UTF-16, and some
+		s := bufio.NewScanner(reader)
-		// tools emit a UTF-8 BOM. Without a BOM the file is read as UTF-8, as before.
-		decoded := transform.NewReader(reader, unicode.BOMOverride(unicode.UTF8.NewDecoder()))
-
-		s := bufio.NewScanner(decoded)
-		// Default 64 KiB max token size is too small for realistic env-file lines; allow up to 16 MiB.
-		s.Buffer(make([]byte, 0, 64*1024), 16*1024*1024)
 		for s.Scan() {
 			line := s.Text()
-			// GitHub's runner ignores blank lines
-			if strings.TrimSpace(line) == "" {
-				continue
-			}
 			singleLineEnv := strings.Index(line, "=")
 			multiLineEnv := strings.Index(line, "<<")
 			if singleLineEnv != -1 && (multiLineEnv == -1 || singleLineEnv < multiLineEnv) {
@@ -63,9 +50,6 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Ex
 					}
 					multiLineEnvContent += content
 				}
-				if err := s.Err(); err != nil {
-					return fmt.Errorf("reading env file: %w", err)
-				}
 				if !delimiterFound {
 					return fmt.Errorf("invalid format delimiter '%v' not found before end of file", multiLineEnvDelimiter)
 				}
@@ -74,9 +58,6 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Ex
 				return fmt.Errorf("invalid format '%v', expected a line with '=' or '<<'", line)
 			}
 		}
-		if err := s.Err(); err != nil {
-			return fmt.Errorf("reading env file: %w", err)
-		}
 		env = &localEnv
 		return nil
 	}

act/container/parse_env_file_test.go

@@ -1,134 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"bufio"
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/text/encoding"
-	"golang.org/x/text/encoding/unicode"
-)
-
-func newTestHostEnv(t *testing.T) (*HostEnvironment, string) {
-	t.Helper()
-	e := &HostEnvironment{Path: t.TempDir()}
-	return e, filepath.Join(e.Path, "envfile")
-}
-
-func TestParseEnvFileSingleLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO=bar\nBAZ=qux\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-	assert.Equal(t, "qux", env["BAZ"])
-}
-
-func TestParseEnvFileMultiLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	content := "FOO<<EOF\nline1\nline2\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "line1\nline2", env["FOO"])
-}
-
-func TestParseEnvFileLargeValueWithinLimit(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	big := strings.Repeat("x", 2*1024*1024)
-	content := "FOO<<EOF\n" + big + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, big, env["FOO"])
-}
-
-func TestParseEnvFileLineExceedsBufferReportsScannerError(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	tooBig := strings.Repeat("x", 17*1024*1024) // over the 16 MiB cap
-	content := "FOO<<EOF\n" + tooBig + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.ErrorIs(t, err, bufio.ErrTooLong)
-	assert.Contains(t, err.Error(), "reading env file")
-}
-
-// Regression test: a blank line used to fail the job at "Complete Job", after
-// every step had already been recorded as successful.
-func TestParseEnvFileBlankLines(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("\nFOO=bar\n\n   \nBAZ=qux\n\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-	assert.Equal(t, "qux", env["BAZ"])
-}
-
-// blank lines inside a heredoc value are content, not separators
-func TestParseEnvFileMultiLineKeepsBlankLines(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\n\nline2\nEOF\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "line1\n\nline2", env["FOO"])
-}
-
-func TestParseEnvFileUTF8BOM(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	content := append([]byte{0xEF, 0xBB, 0xBF}, []byte("FOO=bar\n")...)
-	require.NoError(t, os.WriteFile(envPath, content, 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-}
-
-// Windows host mode: PowerShell 5.1 redirection writes UTF-16, which used to be
-// unrecognisable as KEY=VALUE, so the writes were silently ignored.
-func TestParseEnvFileUTF16(t *testing.T) {
-	tests := []struct {
-		name    string
-		encoder *encoding.Encoder
-	}{
-		{"little endian", unicode.UTF16(unicode.LittleEndian, unicode.UseBOM).NewEncoder()},
-		{"big endian", unicode.UTF16(unicode.BigEndian, unicode.UseBOM).NewEncoder()},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			e, envPath := newTestHostEnv(t)
-			content, err := tt.encoder.Bytes([]byte("FOO=bar\r\nMULTI<<EOF\r\nline1\r\nEOF\r\n"))
-			require.NoError(t, err)
-			require.NoError(t, os.WriteFile(envPath, content, 0o600))
-
-			env := map[string]string{}
-			require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-			assert.Equal(t, "bar", env["FOO"])
-			assert.Equal(t, "line1", env["MULTI"])
-		})
-	}
-}
-
-func TestParseEnvFileMissingDelimiter(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\nline2\n"), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "delimiter")
-}

act/container/util.go

@@ -8,10 +8,23 @@ package container
 
 import (
 	"os"
+	"syscall"
 
 	"github.com/creack/pty"
 )
 
+func getSysProcAttr(_ string, tty bool) *syscall.SysProcAttr {
+	if tty {
+		return &syscall.SysProcAttr{
+			Setsid:  true,
+			Setctty: true,
+		}
+	}
+	return &syscall.SysProcAttr{
+		Setpgid: true,
+	}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return pty.Open()
 }

act/container/util_openbsd_mips64.go

@@ -7,8 +7,15 @@ package container
 import (
 	"errors"
 	"os"
+	"syscall"
 )
 
+func getSysProcAttr(cmdLine string, tty bool) *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{
+		Setpgid: true,
+	}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return nil, nil, errors.New("Unsupported")
 }

act/container/util_plan9.go

@@ -7,8 +7,15 @@ package container
 import (
 	"errors"
 	"os"
+	"syscall"
 )
 
+func getSysProcAttr(cmdLine string, tty bool) *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{
+		Rfork: syscall.RFNOTEG,
+	}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return nil, nil, errors.New("Unsupported")
 }

act/container/util_windows.go

@@ -7,8 +7,13 @@ package container
 import (
 	"errors"
 	"os"
+	"syscall"
 )
 
+func getSysProcAttr(cmdLine string, tty bool) *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{CmdLine: cmdLine, CreationFlags: syscall.CREATE_NEW_PROCESS_GROUP}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return nil, nil, errors.New("Unsupported")
 }

act/exprparser/functions.go

@@ -266,7 +266,7 @@ func (impl *interperterImpl) jobSuccess() (bool, error) { //nolint:unparam // pr
 	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
 
 	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() != "success" {
+		if jobs[needs].Result != "success" {
 			return false, nil
 		}
 	}
@@ -274,17 +274,8 @@ func (impl *interperterImpl) jobSuccess() (bool, error) { //nolint:unparam // pr
 	return true, nil
 }
 
-// jobStatus returns the current job status, treating a nil Job context as an
-// empty status so status-check functions never panic on a nil dereference.
-func (impl *interperterImpl) jobStatus() string {
-	if impl.env.Job == nil {
-		return ""
-	}
-	return impl.env.Job.Status
-}
-
 func (impl *interperterImpl) stepSuccess() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "success", nil
+	return impl.env.Job.Status == "success", nil
 }
 
 func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
@@ -292,7 +283,7 @@ func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pr
 	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
 
 	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() == "failure" {
+		if jobs[needs].Result == "failure" {
 			return true, nil
 		}
 	}
@@ -301,9 +292,9 @@ func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pr
 }
 
 func (impl *interperterImpl) stepFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "failure", nil
+	return impl.env.Job.Status == "failure", nil
 }
 
 func (impl *interperterImpl) cancelled() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "cancelled", nil
+	return impl.env.Job.Status == "cancelled", nil
 }

act/exprparser/functions_test.go

@@ -254,27 +254,3 @@ func TestFunctionFormat(t *testing.T) {
 		})
 	}
 }
-
-func TestStatusFunctionsNilJob(t *testing.T) {
-	// A nil Job context must not panic: the status-check functions should treat
-	// it as an empty status and return false rather than dereferencing nil.
-	env := &EvaluationEnvironment{}
-
-	table := []struct {
-		input   string
-		context string
-		name    string
-	}{
-		{"cancelled()", "job", "cancelled-nil-job"},
-		{"success()", "step", "step-success-nil-job"},
-		{"failure()", "step", "step-failure-nil-job"},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{Context: tt.context}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.Equal(t, false, output)
-		})
-	}
-}

act/exprparser/interpreter.go

@@ -251,7 +251,7 @@ func (impl *interperterImpl) evaluateArrayDeref(arrayDerefNode *actionlint.Array
 
 func (impl *interperterImpl) getPropertyValue(left reflect.Value, property string) (value any, err error) {
 	switch left.Kind() {
-	case reflect.Pointer:
+	case reflect.Ptr:
 		return impl.getPropertyValue(left.Elem(), property)
 
 	case reflect.Struct:
@@ -321,7 +321,7 @@ func (impl *interperterImpl) getPropertyValue(left reflect.Value, property strin
 }
 
 func (impl *interperterImpl) getMapValue(value reflect.Value) (any, error) {
-	if value.Kind() == reflect.Pointer {
+	if value.Kind() == reflect.Ptr {
 		return impl.getMapValue(value.Elem())
 	}
 

act/filecollector/file_collector.go

@@ -73,16 +73,10 @@ func (cc *CopyCollector) WriteFile(fpath string, fi fs.FileInfo, linkName string
 	if err := os.MkdirAll(filepath.Dir(fdestpath), 0o777); err != nil {
 		return err
 	}
-	// Remove any existing destination so we can overwrite read-only files
-	// (e.g. git pack files at mode 0444 trip EACCES on macOS and "Access is
-	// denied" on Windows when reopened with O_WRONLY) and so os.Symlink does
-	// not fail with EEXIST. os.Remove clears the Windows read-only attribute
-	// internally; on Unix unlink only needs write permission on the parent.
-	_ = os.Remove(fdestpath)
 	if f == nil {
 		return os.Symlink(linkName, fdestpath)
 	}
-	df, err := os.OpenFile(fdestpath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fi.Mode())
+	df, err := os.OpenFile(fdestpath, os.O_CREATE|os.O_WRONLY, fi.Mode())
 	if err != nil {
 		return err
 	}

act/filecollector/file_collector_test.go

@@ -8,12 +8,9 @@ import (
 	"archive/tar"
 	"context"
 	"io"
-	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-billy/v5/memfs"
@@ -23,7 +20,6 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/format/index"
 	"github.com/go-git/go-git/v5/storage/filesystem"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 type memoryFs struct {
@@ -178,107 +174,3 @@ func TestSymlinks(t *testing.T) {
 	assert.Equal(t, ".env", files["test.env"].Linkname)
 	assert.ErrorIs(t, err, io.EOF, "tar must be read cleanly to EOF")
 }
-
-// Regression for https://gitea.com/gitea/runner/issues/876 and /941:
-// re-copying an action directory must overwrite a pre-existing read-only
-// file (e.g. a git pack .idx at mode 0444) instead of failing with EACCES
-// on macOS or "Access is denied" on Windows.
-func TestCopyCollectorWriteFileOverwritesReadOnlyFile(t *testing.T) {
-	dst := t.TempDir()
-	target := filepath.Join(dst, "sub", "pack.idx")
-	require.NoError(t, os.MkdirAll(filepath.Dir(target), 0o755))
-	require.NoError(t, os.WriteFile(target, []byte("old"), 0o444))
-
-	src := filepath.Join(t.TempDir(), "pack.idx")
-	require.NoError(t, os.WriteFile(src, []byte("new"), 0o444))
-	fi, err := os.Stat(src)
-	require.NoError(t, err)
-
-	cc := &CopyCollector{DstDir: dst}
-	require.NoError(t, cc.WriteFile("sub/pack.idx", fi, "", strings.NewReader("new")))
-
-	got, err := os.ReadFile(target)
-	require.NoError(t, err)
-	assert.Equal(t, "new", string(got))
-}
-
-// Without the destination removal, os.Symlink fails with EEXIST when the
-// path already holds a regular file from an earlier copy of the action.
-func TestCopyCollectorWriteFileOverwritesFileWithSymlink(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating symlinks requires elevated privileges on Windows")
-	}
-	dst := t.TempDir()
-	target := filepath.Join(dst, "link")
-	require.NoError(t, os.WriteFile(target, []byte("stale"), 0o644))
-
-	fi, err := os.Lstat(target)
-	require.NoError(t, err)
-
-	cc := &CopyCollector{DstDir: dst}
-	require.NoError(t, cc.WriteFile("link", fi, "target", nil))
-
-	resolved, err := os.Readlink(target)
-	require.NoError(t, err)
-	assert.Equal(t, "target", resolved)
-}
-
-func TestDefaultFsOpenReadlinkAndWalk(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating symlinks requires elevated privileges on Windows")
-	}
-
-	root := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(root, "file.txt"), []byte("content"), 0o644))
-	require.NoError(t, os.Symlink("file.txt", filepath.Join(root, "link.txt")))
-
-	fsys := &DefaultFs{}
-	var walked []string
-	require.NoError(t, fsys.Walk(root, func(path string, info os.FileInfo, err error) error {
-		require.NoError(t, err)
-		walked = append(walked, info.Name())
-		return nil
-	}))
-	require.Contains(t, walked, "file.txt")
-	require.Contains(t, walked, "link.txt")
-
-	file, err := fsys.Open(filepath.Join(root, "file.txt"))
-	require.NoError(t, err)
-	data, err := io.ReadAll(file)
-	require.NoError(t, err)
-	require.NoError(t, file.Close())
-	require.Equal(t, "content", string(data))
-
-	link, err := fsys.Readlink(filepath.Join(root, "link.txt"))
-	require.NoError(t, err)
-	require.Equal(t, "file.txt", link)
-}
-
-func TestFileCollectorCancellationAndWalkError(t *testing.T) {
-	fc := &FileCollector{Fs: &memoryFs{Filesystem: memfs.New()}}
-	walk := fc.CollectFiles(cancelledContext(t), nil)
-
-	err := walk("file", fakeFileInfo{name: "file"}, nil)
-	require.EqualError(t, err, "copy cancelled")
-
-	err = walk("file", fakeFileInfo{name: "file"}, os.ErrPermission)
-	require.ErrorIs(t, err, os.ErrPermission)
-}
-
-func cancelledContext(t *testing.T) context.Context {
-	t.Helper()
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	return ctx
-}
-
-type fakeFileInfo struct {
-	name string
-}
-
-func (f fakeFileInfo) Name() string       { return f.name }
-func (f fakeFileInfo) Size() int64        { return 0 }
-func (f fakeFileInfo) Mode() os.FileMode  { return 0o644 }
-func (f fakeFileInfo) ModTime() time.Time { return time.Time{} }
-func (f fakeFileInfo) IsDir() bool        { return false }
-func (f fakeFileInfo) Sys() any           { return nil }

act/lookpath/env.go

@@ -4,6 +4,18 @@
 
 package lookpath
 
+import "os"
+
 type Env interface {
 	Getenv(name string) string
 }
+
+type defaultEnv struct{}
+
+func (*defaultEnv) Getenv(name string) string {
+	return os.Getenv(name)
+}
+
+func LookPath(file string) (string, error) {
+	return LookPath2(file, &defaultEnv{})
+}

act/lookpath/lp_unix_test.go

@@ -1,74 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-
-package lookpath
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-type testEnv map[string]string
-
-func (e testEnv) Getenv(name string) string {
-	return e[name]
-}
-
-func TestLookPath2SearchesPathAndEmptyElement(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2("tool", testEnv{"PATH": string(filepath.ListSeparator) + dir})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2DirectPathDoesNotSearchPath(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2(exe, testEnv{"PATH": ""})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2ReportsPermissionAndNotFound(t *testing.T) {
-	dir := t.TempDir()
-	file := filepath.Join(dir, "not-executable")
-	if err := os.WriteFile(file, []byte("plain text"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := LookPath2(file, testEnv{"PATH": dir})
-	var pathErr *Error
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, fs.ErrPermission) {
-		t.Fatalf("LookPath2(non-executable) error = %v, want fs.ErrPermission wrapped in *Error", err)
-	}
-	if pathErr.Error() != fs.ErrPermission.Error() {
-		t.Fatalf("Error() = %q, want %q", pathErr.Error(), fs.ErrPermission.Error())
-	}
-
-	_, err = LookPath2("missing", testEnv{"PATH": dir})
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, ErrNotFound) {
-		t.Fatalf("LookPath2(missing) error = %v, want ErrNotFound wrapped in *Error", err)
-	}
-}

act/lookpath/lp_windows.go

@@ -62,7 +62,7 @@ func LookPath2(file string, lenv Env) (string, error) {
 	var exts []string
 	x := lenv.Getenv(`PATHEXT`)
 	if x != "" {
-		for e := range strings.SplitSeq(strings.ToLower(x), `;`) {
+		for _, e := range strings.Split(strings.ToLower(x), `;`) {
 			if e == "" {
 				continue
 			}

act/model/action_test.go

@@ -1,63 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestReadActionDefaultsAndCaseInsensitiveUsing(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-name: example
-runs:
-  using: NoDe24
-  main: dist/index.js
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.Using != ActionRunsUsingNode24 {
-		t.Fatalf("using = %q, want %q", action.Runs.Using, ActionRunsUsingNode24)
-	}
-	if action.Runs.PreIf != "always()" {
-		t.Fatalf("pre-if = %q, want always()", action.Runs.PreIf)
-	}
-	if action.Runs.PostIf != "always()" {
-		t.Fatalf("post-if = %q, want always()", action.Runs.PostIf)
-	}
-}
-
-func TestReadActionPreservesExplicitConditions(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-runs:
-  using: composite
-  pre-if: success()
-  post-if: failure()
-  steps:
-    - run: echo hello
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.PreIf != "success()" || action.Runs.PostIf != "failure()" {
-		t.Fatalf("conditions = %q/%q, want explicit values", action.Runs.PreIf, action.Runs.PostIf)
-	}
-	if !action.Runs.Using.IsComposite() || action.Runs.Using.IsDocker() || action.Runs.Using.IsNode() {
-		t.Fatalf("unexpected using predicates for %q", action.Runs.Using)
-	}
-}
-
-func TestReadActionRejectsUnknownUsing(t *testing.T) {
-	_, err := ReadAction(strings.NewReader(`
-runs:
-  using: node99
-`))
-	if err == nil {
-		t.Fatal("expected unknown runs.using to fail")
-	}
-	if !strings.Contains(err.Error(), "node99") {
-		t.Fatalf("error = %q, want invalid value", err)
-	}
-}

act/model/planner_test.go

@@ -6,12 +6,10 @@ package model
 
 import (
 	"path/filepath"
-	"strings"
 	"testing"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 type WorkflowPlanTest struct {
@@ -67,133 +65,3 @@ func TestWorkflow(t *testing.T) {
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
 	assert.NotNil(t, result)
 }
-
-func TestNewSingleWorkflowPlannerAndPlanMethods(t *testing.T) {
-	planner, err := NewSingleWorkflowPlanner("ci.yml", strings.NewReader(`
-name: CI
-on: [push, pull_request]
-jobs:
-  build:
-    name: Build project
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-  test:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`))
-	require.NoError(t, err)
-
-	assert.Equal(t, []string{"pull_request", "push"}, planner.GetEvents())
-
-	eventPlan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, eventPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, eventPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, eventPlan.Stages[1].GetJobIDs())
-	assert.Equal(t, len("Build project"), eventPlan.MaxRunNameLen())
-	assert.Equal(t, "Build project", eventPlan.Stages[0].Runs[0].String())
-	assert.Equal(t, "build", eventPlan.Stages[0].Runs[0].JobID)
-	assert.NotNil(t, eventPlan.Stages[0].Runs[0].Job())
-
-	jobPlan, err := planner.PlanJob("test")
-	require.NoError(t, err)
-	require.Len(t, jobPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, jobPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, jobPlan.Stages[1].GetJobIDs())
-
-	allPlan, err := planner.PlanAll()
-	require.NoError(t, err)
-	require.Len(t, allPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, allPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, allPlan.Stages[1].GetJobIDs())
-}
-
-func TestCombineWorkflowPlannerMergesWorkflowStages(t *testing.T) {
-	first := mustReadWorkflow(t, `
-name: First
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-`)
-	second := mustReadWorkflow(t, `
-name: Second
-on: push
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make lint
-  test:
-    needs: lint
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`)
-
-	planner := CombineWorkflowPlanner(first, second)
-	plan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, plan.Stages, 2)
-	assert.ElementsMatch(t, []string{"build", "lint"}, plan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, plan.Stages[1].GetJobIDs())
-
-	empty, err := planner.PlanEvent("schedule")
-	require.NoError(t, err)
-	assert.Empty(t, empty.Stages)
-}
-
-func TestPlannerErrorsForMissingAndCyclicJobs(t *testing.T) {
-	workflow := mustReadWorkflow(t, `
-name: Cyclic
-on: push
-jobs:
-  a:
-    needs: b
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo a
-  b:
-    needs: a
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo b
-`)
-	planner := CombineWorkflowPlanner(workflow)
-
-	plan, err := planner.PlanJob("missing")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "Could not find any stages")
-
-	plan, err = planner.PlanEvent("push")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "unable to build dependency graph")
-}
-
-func TestNewSingleWorkflowPlannerErrors(t *testing.T) {
-	_, err := NewSingleWorkflowPlanner("empty.yml", strings.NewReader(""))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "file is empty")
-
-	_, err = NewSingleWorkflowPlanner("invalid.yml", strings.NewReader("jobs: ["))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "workflow is not valid")
-}
-
-func mustReadWorkflow(t *testing.T, content string) *Workflow {
-	t.Helper()
-
-	workflow, err := ReadWorkflow(strings.NewReader(content))
-	require.NoError(t, err)
-	if workflow.Name == "" {
-		workflow.Name = "workflow"
-	}
-	return workflow
-}

act/model/testdata/container-volumes/push.yml

@@ -5,7 +5,7 @@ jobs:
   with-volumes:
     runs-on: ubuntu-latest
     container:
-      image: node:24-bookworm-slim
+      image: node:16-buster-slim
       volumes:
         - my_docker_volume:/path/to/volume
         - /path/to/nonexist/directory

act/model/workflow.go

@@ -190,52 +190,23 @@ func (w *Workflow) WorkflowCallConfig() *WorkflowCall {
 
 // Job is the structure of one job in a workflow
 type Job struct {
-	Name               string                    `yaml:"name"`
+	Name           string                    `yaml:"name"`
-	RawNeeds           yaml.Node                 `yaml:"needs"`
+	RawNeeds       yaml.Node                 `yaml:"needs"`
-	RawRunsOn          yaml.Node                 `yaml:"runs-on"`
+	RawRunsOn      yaml.Node                 `yaml:"runs-on"`
-	Env                yaml.Node                 `yaml:"env"`
+	Env            yaml.Node                 `yaml:"env"`
-	If                 yaml.Node                 `yaml:"if"`
+	If             yaml.Node                 `yaml:"if"`
-	Steps              []*Step                   `yaml:"steps"`
+	Steps          []*Step                   `yaml:"steps"`
-	TimeoutMinutes     string                    `yaml:"timeout-minutes"`
+	TimeoutMinutes string                    `yaml:"timeout-minutes"`
-	RawContinueOnError string                    `yaml:"continue-on-error"`
+	Services       map[string]*ContainerSpec `yaml:"services"`
-	Services           map[string]*ContainerSpec `yaml:"services"`
+	Strategy       *Strategy                 `yaml:"strategy"`
-	Strategy           *Strategy                 `yaml:"strategy"`
+	RawContainer   yaml.Node                 `yaml:"container"`
-	RawContainer       yaml.Node                 `yaml:"container"`
+	Defaults       Defaults                  `yaml:"defaults"`
-	Defaults           Defaults                  `yaml:"defaults"`
+	Outputs        map[string]string         `yaml:"outputs"`
-	Outputs            map[string]string         `yaml:"outputs"`
+	Uses           string                    `yaml:"uses"`
-	Uses               string                    `yaml:"uses"`
+	With           map[string]any            `yaml:"with"`
-	With               map[string]any            `yaml:"with"`
+	RawSecrets     yaml.Node                 `yaml:"secrets"`
-	RawSecrets         yaml.Node                 `yaml:"secrets"`
+	RawPermissions yaml.Node                 `yaml:"permissions"`
-	RawPermissions     yaml.Node                 `yaml:"permissions"`
+	Result         string
-	Result             string
-	// Runtime fields set during execution (not from YAML):
-	ContinueOnError bool // true when all failing matrix combinations had continue-on-error=true
-	hasFirmFailure  bool // true once any combination failed without continue-on-error
-}
-
-// SetContinueOnError records whether this combination's failure should not fail the workflow.
-// Must be called under the job lock. Safe across parallel matrix combinations.
-func (j *Job) SetContinueOnError(continueOnErr bool) {
-	if continueOnErr {
-		if !j.hasFirmFailure {
-			j.ContinueOnError = true
-		}
-	} else {
-		j.hasFirmFailure = true
-		j.ContinueOnError = false
-	}
-}
-
-// NeedsResult returns the job result as seen by dependent jobs through the
-// `needs` context. A job that failed but was tolerated via continue-on-error
-// reports "success" to its dependents, matching GitHub: such a failure must not
-// block jobs gated on the default `if: success()`, even though the overall
-// workflow run is still marked as failed.
-func (j *Job) NeedsResult() string {
-	if j.Result == "failure" && j.ContinueOnError {
-		return "success"
-	}
-	return j.Result
 }
 
 // Strategy for the job
@@ -354,20 +325,14 @@ func (j *Job) Needs() []string {
 
 // RunsOn list for Job
 func (j *Job) RunsOn() []string {
-	return RunsOnFromNode(j.RawRunsOn)
+	switch j.RawRunsOn.Kind {
-}
-
-// RunsOnFromNode parses the runs-on labels from a raw runs-on node, so callers can evaluate a
-// copy of the node (avoiding mutation of the shared Job) before reading the labels.
-func RunsOnFromNode(rawRunsOn yaml.Node) []string {
-	switch rawRunsOn.Kind {
 	case yaml.MappingNode:
 		var val struct {
 			Group  string
 			Labels yaml.Node
 		}
 
-		if !decodeNode(rawRunsOn, &val) {
+		if !decodeNode(j.RawRunsOn, &val) {
 			return nil
 		}
 
@@ -379,7 +344,7 @@ func RunsOnFromNode(rawRunsOn yaml.Node) []string {
 
 		return labels
 	default:
-		return nodeAsStringSlice(rawRunsOn)
+		return nodeAsStringSlice(j.RawRunsOn)
 	}
 }
 
@@ -680,33 +645,6 @@ type Step struct {
 	TimeoutMinutes     string            `yaml:"timeout-minutes"`
 }
 
-// Clone returns a deep copy safe to mutate independently of s. Job steps are shared across
-// parallel matrix runs, which mutate per-job fields (ID, Number, Shell) and evaluate the If/Env
-// yaml.Nodes in place, so each job must own its copy.
-func (s *Step) Clone() *Step {
-	clone := *s
-	clone.If = CloneYamlNode(s.If)
-	clone.Env = CloneYamlNode(s.Env)
-	clone.With = maps.Clone(s.With)
-	return &clone
-}
-
-// CloneYamlNode returns a deep copy of a yaml.Node so callers can evaluate it in place without
-// mutating a node shared across parallel jobs.
-func CloneYamlNode(n yaml.Node) yaml.Node {
-	clone := n
-	if n.Content != nil {
-		clone.Content = make([]*yaml.Node, len(n.Content))
-		for i, child := range n.Content {
-			if child != nil {
-				childClone := CloneYamlNode(*child)
-				clone.Content[i] = &childClone
-			}
-		}
-	}
-	return clone
-}
-
 // String gets the name of step
 func (s *Step) String() string {
 	if s.Name != "" {

act/model/workflow_test.go

@@ -5,244 +5,13 @@
 package model
 
 import (
-	"fmt"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
 )
 
-// TestStepCloneIsolatesMutableFields guards the parallel-matrix race fix: combinations share the
-// job's *Step, and Clone() must hand each a copy whose If/Env nodes and With map can be mutated
-// independently. A shallow copy would share Env.Content's backing array (and the With map) and
-// leak writes across combinations.
-func TestStepCloneIsolatesMutableFields(t *testing.T) {
-	var orig Step
-	require.NoError(t, yaml.Unmarshal([]byte("if: ${{ env.X == 'a' }}\nenv:\n  KEY: original\nwith:\n  arg: original\n"), &orig))
-	require.Len(t, orig.Env.Content, 2) // [key, value]
-
-	clone := orig.Clone()
-	clone.If.Value = "changed"
-	clone.Env.Content[1].Value = "changed"
-	clone.With["arg"] = "changed"
-
-	assert.Equal(t, "${{ env.X == 'a' }}", orig.If.Value, "If must not be shared with the clone")
-	assert.Equal(t, "original", orig.Env.Content[1].Value, "Env nodes must not be shared with the clone")
-	assert.Equal(t, "original", orig.With["arg"], "With map must not be shared with the clone")
-}
-
-// TestJobNeedsResult guards the continue-on-error semantics exposed to dependent
-// jobs through the `needs` context: a failed-but-tolerated job reports "success"
-// so it does not block dependents gated on the default `if: success()`, matching
-// GitHub. A firm failure and any non-failure result are reported verbatim.
-func TestJobNeedsResult(t *testing.T) {
-	cases := []struct {
-		name            string
-		result          string
-		continueOnError bool
-		want            string
-	}{
-		{"tolerated failure reports success", "failure", true, "success"},
-		{"firm failure reports failure", "failure", false, "failure"},
-		{"success is unchanged", "success", false, "success"},
-		{"success with continue-on-error is unchanged", "success", true, "success"},
-		{"empty result is unchanged", "", true, ""},
-		{"skipped is unchanged", "skipped", true, "skipped"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			j := &Job{Result: tc.result, ContinueOnError: tc.continueOnError}
-			assert.Equal(t, tc.want, j.NeedsResult())
-		})
-	}
-}
-
-func TestJobSetContinueOnErrorFirmFailureWins(t *testing.T) {
-	job := &Job{}
-	job.SetContinueOnError(true)
-	assert.True(t, job.ContinueOnError)
-
-	job.SetContinueOnError(false)
-	assert.False(t, job.ContinueOnError)
-
-	job.SetContinueOnError(true)
-	assert.False(t, job.ContinueOnError, "a later tolerated failure must not hide an earlier firm failure")
-}
-
-func TestStepStatusText(t *testing.T) {
-	for _, tc := range []struct {
-		status stepStatus
-		text   string
-	}{
-		{StepStatusSuccess, "success"},
-		{StepStatusFailure, "failure"},
-		{StepStatusSkipped, "skipped"},
-	} {
-		t.Run(tc.text, func(t *testing.T) {
-			got, err := tc.status.MarshalText()
-			require.NoError(t, err)
-			assert.Equal(t, tc.text, string(got))
-
-			var parsed stepStatus
-			require.NoError(t, parsed.UnmarshalText(got))
-			assert.Equal(t, tc.status, parsed)
-			assert.Equal(t, tc.text, parsed.String())
-		})
-	}
-
-	var parsed stepStatus
-	require.Error(t, parsed.UnmarshalText([]byte("cancelled")))
-	assert.Empty(t, stepStatus(99).String())
-}
-
-func TestWorkflowCallConfig(t *testing.T) {
-	workflow, err := ReadWorkflow(strings.NewReader(`
-on:
-  workflow_call:
-    inputs:
-      name:
-        required: true
-        type: string
-    outputs:
-      digest:
-        value: ${{ jobs.build.outputs.digest }}
-jobs: {}
-`))
-	require.NoError(t, err)
-
-	config := workflow.WorkflowCallConfig()
-	require.NotNil(t, config)
-	require.Contains(t, config.Inputs, "name")
-	assert.True(t, config.Inputs["name"].Required)
-	assert.Equal(t, "string", config.Inputs["name"].Type)
-	assert.Equal(t, "${{ jobs.build.outputs.digest }}", config.Outputs["digest"].Value)
-
-	listWorkflow, err := ReadWorkflow(strings.NewReader("on: [workflow_call]\njobs: {}\n"))
-	require.NoError(t, err)
-	assert.NotNil(t, listWorkflow.WorkflowCallConfig())
-	assert.Empty(t, listWorkflow.WorkflowCallConfig().Inputs)
-}
-
-func TestJobSecretsAndEnvironment(t *testing.T) {
-	inheritJob := readJob(t, `
-secrets: inherit
-env:
-  A: one
-  B: two
-`)
-	assert.True(t, inheritJob.InheritSecrets())
-	assert.Nil(t, inheritJob.Secrets())
-	assert.Equal(t, map[string]string{"A": "one", "B": "two"}, inheritJob.Environment())
-
-	mappingJob := readJob(t, `
-secrets:
-  TOKEN: ${{ secrets.TOKEN }}
-`)
-	assert.False(t, mappingJob.InheritSecrets())
-	assert.Equal(t, map[string]string{"TOKEN": "${{ secrets.TOKEN }}"}, mappingJob.Secrets())
-}
-
-func TestJobTypeAndString(t *testing.T) {
-	tests := []struct {
-		job     Job
-		want    JobType
-		wantErr bool
-	}{
-		{job: Job{}, want: JobTypeDefault},
-		{job: Job{Uses: "./.github/workflows/reuse.yml"}, want: JobTypeReusableWorkflowLocal},
-		{job: Job{Uses: "owner/repo/.github/workflows/reuse.yaml@v1"}, want: JobTypeReusableWorkflowRemote},
-		{job: Job{Uses: "owner/repo/.github/workflows/reuse.yaml"}, want: JobTypeInvalid, wantErr: true},
-	}
-
-	for _, tc := range tests {
-		t.Run(fmt.Sprintf("%s/%s", tc.job.Uses, tc.want), func(t *testing.T) {
-			got, err := tc.job.Type()
-			if tc.wantErr {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
-			assert.Equal(t, tc.want, got)
-		})
-	}
-
-	assert.Equal(t, "default", JobTypeDefault.String())
-	assert.Equal(t, "local-reusable-workflow", JobTypeReusableWorkflowLocal.String())
-	assert.Equal(t, "remote-reusable-workflow", JobTypeReusableWorkflowRemote.String())
-	assert.Equal(t, "unknown", JobType(99).String())
-}
-
-func TestStepStringEnvironmentEnvAndType(t *testing.T) {
-	step := readStep(t, `
-id: example
-env:
-  DIRECT: value
-with:
-  mixed-key: input
-`)
-	assert.Equal(t, "example", step.String())
-	assert.Equal(t, map[string]string{"DIRECT": "value"}, step.Environment())
-	assert.Equal(t, map[string]string{"DIRECT": "value", "INPUT_MIXED-KEY": "input"}, step.GetEnv())
-
-	for _, tc := range []struct {
-		step Step
-		want StepType
-	}{
-		{step: Step{}, want: StepTypeInvalid},
-		{step: Step{Run: "echo hi"}, want: StepTypeRun},
-		{step: Step{Run: "echo hi", Uses: "actions/checkout@v4"}, want: StepTypeInvalid},
-		{step: Step{Uses: "docker://alpine:latest"}, want: StepTypeUsesDockerURL},
-		{step: Step{Uses: "./.github/workflows/reuse.yml"}, want: StepTypeReusableWorkflowLocal},
-		{step: Step{Uses: "owner/repo/.github/workflows/reuse.yml@v1"}, want: StepTypeReusableWorkflowRemote},
-		{step: Step{Uses: "./actions/local"}, want: StepTypeUsesActionLocal},
-		{step: Step{Uses: "actions/checkout@v4"}, want: StepTypeUsesActionRemote},
-	} {
-		t.Run(tc.want.String(), func(t *testing.T) {
-			assert.Equal(t, tc.want, tc.step.Type())
-		})
-	}
-
-	assert.Equal(t, "invalid", StepTypeInvalid.String())
-	assert.Equal(t, "run", StepTypeRun.String())
-	assert.Equal(t, "local-action", StepTypeUsesActionLocal.String())
-	assert.Equal(t, "remote-action", StepTypeUsesActionRemote.String())
-	assert.Equal(t, "docker", StepTypeUsesDockerURL.String())
-	assert.Equal(t, "local-reusable-workflow", StepTypeReusableWorkflowLocal.String())
-	assert.Equal(t, "remote-reusable-workflow", StepTypeReusableWorkflowRemote.String())
-	assert.Equal(t, "unknown", StepType(99).String())
-	assert.NotEmpty(t, (&Step{Uses: "actions/checkout@v4"}).UsesHash())
-}
-
-func TestWorkflowGetJobAndIDs(t *testing.T) {
-	workflow := &Workflow{Jobs: map[string]*Job{"build": {}}}
-	assert.Equal(t, []string{"build"}, workflow.GetJobIDs())
-
-	job := workflow.GetJob("build")
-	require.NotNil(t, job)
-	assert.Equal(t, "build", job.Name)
-	assert.Equal(t, "success()", job.If.Value)
-	assert.Nil(t, workflow.GetJob("missing"))
-}
-
-func TestRawConcurrencyYaml(t *testing.T) {
-	var expr RawConcurrency
-	require.NoError(t, yaml.Unmarshal([]byte("group-${{ github.ref }}"), &expr))
-	assert.Equal(t, "group-${{ github.ref }}", expr.RawExpression)
-	marshaled, err := expr.MarshalYAML()
-	require.NoError(t, err)
-	assert.Equal(t, "group-${{ github.ref }}", marshaled)
-
-	var object RawConcurrency
-	require.NoError(t, yaml.Unmarshal([]byte("group: ci\ncancel-in-progress: true\n"), &object))
-	assert.Equal(t, "ci", object.Group)
-	assert.Equal(t, "true", object.CancelInProgress)
-	marshaled, err = object.MarshalYAML()
-	require.NoError(t, err)
-	assert.Equal(t, (*objectConcurrency)(&object), marshaled)
-}
-
 func TestReadWorkflow_ScheduleEvent(t *testing.T) {
 	yaml := `
 name: local-action-docker-url
@@ -1137,19 +906,3 @@ func TestJobMatrixValidation(t *testing.T) {
 		assert.Nil(t, matrix, "matrix with nested map should return nil")
 	})
 }
-
-func readJob(t *testing.T, content string) *Job {
-	t.Helper()
-
-	var job Job
-	require.NoError(t, yaml.Unmarshal([]byte(content), &job))
-	return &job
-}
-
-func readStep(t *testing.T, content string) *Step {
-	t.Helper()
-
-	var step Step
-	require.NoError(t, yaml.Unmarshal([]byte(content), &step))
-	return &step
-}

act/runner/action.go

@@ -6,9 +6,7 @@ package runner
 
 import (
 	"context"
-	"crypto/sha256"
 	"embed"
-	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -21,7 +19,6 @@ import (
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
 	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
@@ -47,11 +44,6 @@ type runAction func(step actionStep, actionDir string, remoteAction *remoteActio
 //go:embed res/trampoline.js
 var trampoline embed.FS
 
-var (
-	ContainerImageExistsLocally     = container.ImageExistsLocally
-	ContainerNewDockerBuildExecutor = container.NewDockerBuildExecutor
-)
-
 func readActionImpl(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
 	logger := common.Logger(ctx)
 	allErrors := []error{}
@@ -156,8 +148,6 @@ func maybeCopyToActionDir(ctx context.Context, step actionStep, actionDir, actio
 		return rc.JobContainer.CopyTarStream(ctx, containerActionDirCopy, ta)
 	}
 
-	defer git.AcquireCloneLock(actionDir)()
-
 	if err := removeGitIgnore(ctx, actionDir); err != nil {
 		return err
 	}
@@ -207,7 +197,7 @@ func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction
 			if remoteAction == nil {
 				location = containerActionDir
 			}
-			return execAsDocker(ctx, step, actionName, actionDir, location, remoteAction == nil)
+			return execAsDocker(ctx, step, actionName, location, remoteAction == nil)
 		case x.IsComposite():
 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
@@ -274,38 +264,8 @@ func removeGitIgnore(ctx context.Context, directory string) error {
 	return nil
 }
 
-// dockerActionImageTag derives the local docker image tag used when an action
-// is built from a Dockerfile.
-//
-// For Gitea: a local action (`uses: ./` or `uses: ./path`) has an actionName
-// that is the workspace-relative path of the action. That path is identical
-// across repositories (e.g. "./" for a self-referencing action), so without
-// namespacing, every repository's local docker action would build and reuse the
-// same `act-dockeraction:latest` image on a shared docker daemon. A subsequent
-// repository would then silently run the image built for an earlier one.
-// Including the repository keeps the tag stable for caching within a repository
-// while preventing cross-repository collisions.
-// See https://gitea.com/gitea/runner/issues/1039.
-func dockerActionImageTag(repository, actionName string, localAction bool) string {
-	name := actionName
-	if localAction {
-		name = path.Join(repository, actionName)
-	}
-	// The human-readable name is sanitized by collapsing every non-alphanumeric character to "-".
-	sanitized := regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(name, "-")
-	if localAction {
-		// For local actions a short hash of the raw repository and action path is appended so the tag stays unique per repository.
-		sum := sha256.Sum256([]byte(repository + "\x00" + actionName))
-		sanitized += "-" + hex.EncodeToString(sum[:])[:12]
-	}
-	// "-dockeraction" ensures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
-	image := fmt.Sprintf("%s-dockeraction:%s", sanitized, "latest")
-	image = "act-" + strings.TrimLeft(image, "-")
-	return strings.ToLower(image)
-}
-
 // TODO: break out parts of function to reduce complexicity
-func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, basedir string, localAction bool) error {
+func execAsDocker(ctx context.Context, step actionStep, actionName, basedir string, localAction bool) error {
 	logger := common.Logger(ctx)
 	rc := step.getRunContext()
 	action := step.getActionModel()
@@ -318,15 +278,18 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 		// Apply forcePull only for prebuild docker images
 		forcePull = rc.Config.ForcePull
 	} else {
-		image = dockerActionImageTag(step.getGithubContext(ctx).Repository, actionName, localAction)
+		// "-dockeraction" enshures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
+		image = fmt.Sprintf("%s-dockeraction:%s", regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(actionName, "-"), "latest")
+		image = "act-" + strings.TrimLeft(image, "-")
+		image = strings.ToLower(image)
 		contextDir, fileName := filepath.Split(filepath.Join(basedir, action.Runs.Image))
 
-		anyArchExists, err := ContainerImageExistsLocally(ctx, image, "any")
+		anyArchExists, err := container.ImageExistsLocally(ctx, image, "any")
 		if err != nil {
 			return err
 		}
 
-		correctArchExists, err := ContainerImageExistsLocally(ctx, image, rc.Config.ContainerArchitecture)
+		correctArchExists, err := container.ImageExistsLocally(ctx, image, rc.Config.ContainerArchitecture)
 		if err != nil {
 			return err
 		}
@@ -358,21 +321,13 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 				}
 				defer buildContext.Close()
 			}
-			prepImage = ContainerNewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
+			prepImage = container.NewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
 				ContextDir:   contextDir,
 				Dockerfile:   fileName,
 				ImageTag:     image,
 				BuildContext: buildContext,
 				Platform:     rc.Config.ContainerArchitecture,
 			})
-			if buildContext == nil {
-				// Held across the whole build: the daemon drains contextDir lazily.
-				inner := prepImage
-				prepImage = func(ctx context.Context) error {
-					defer git.AcquireCloneLock(actionDir)()
-					return inner(ctx)
-				}
-			}
 		} else {
 			logger.Debugf("image '%s' for architecture '%s' already exists", image, rc.Config.ContainerArchitecture)
 		}
@@ -405,7 +360,7 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 		stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
 		stepContainer.Start(true),
 	).Finally(
-		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers && !rc.Config.AutoRemove),
+		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
 	).Finally(stepContainer.Close())(ctx)
 }
 
@@ -465,11 +420,13 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo
 	if rc.IsHostEnv(ctx) {
 		networkMode = "default"
 	}
-	stepContainer := ContainerNewContainer(&container.NewContainerInput{
+	stepContainer := container.NewContainer(&container.NewContainerInput{
 		Cmd:          cmd,
 		Entrypoint:   entrypoint,
 		WorkingDir:   rc.JobContainer.ToContainerPath(rc.Config.Workdir),
 		Image:        image,
+		Username:     rc.Config.Secrets["DOCKER_USERNAME"],
+		Password:     rc.Config.Secrets["DOCKER_PASSWORD"],
 		Name:         createContainerName(rc.jobContainerName(), "STEP-"+stepModel.ID),
 		Env:          envList,
 		Mounts:       mounts,
@@ -482,8 +439,7 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo
 		Platform:     rc.Config.ContainerArchitecture,
 		Options:      rc.Config.ContainerOptions,
 		AutoRemove:   rc.Config.AutoRemove,
-		ValidVolumes: rc.validVolumes(),
+		ValidVolumes: rc.Config.ValidVolumes,
-		AllocatePTY:  rc.Config.AllocatePTY,
 	})
 	return stepContainer
 }

act/runner/action_cache_offline_mode.go

@@ -0,0 +1,45 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// Copyright 2024 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"io"
+	"path"
+
+	git "github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+type GoGitActionCacheOfflineMode struct {
+	Parent GoGitActionCache
+}
+
+func (c GoGitActionCacheOfflineMode) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {
+	sha, fetchErr := c.Parent.Fetch(ctx, cacheDir, url, ref, token)
+	gitPath := path.Join(c.Parent.Path, safeFilename(cacheDir)+".git")
+	gogitrepo, err := git.PlainOpen(gitPath)
+	if err != nil {
+		return "", fetchErr
+	}
+	refName := plumbing.ReferenceName("refs/action-cache-offline/" + ref)
+	r, err := gogitrepo.Reference(refName, true)
+	if fetchErr == nil {
+		if err != nil || sha != r.Hash().String() {
+			if err == nil {
+				refName = r.Name()
+			}
+			ref := plumbing.NewHashReference(refName, plumbing.NewHash(sha))
+			_ = gogitrepo.Storer.SetReference(ref)
+		}
+	} else if err == nil {
+		return r.Hash().String(), nil
+	}
+	return sha, fetchErr
+}
+
+func (c GoGitActionCacheOfflineMode) GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error) {
+	return c.Parent.GetTarArchive(ctx, cacheDir, sha, includePrefix)
+}

act/runner/action_cache_test.go

@@ -8,139 +8,64 @@ import (
 	"archive/tar"
 	"bytes"
 	"context"
-	"fmt"
 	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
 	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
-func runGit(t *testing.T, dir string, args ...string) {
-	t.Helper()
-	if dir != "" {
-		args = append([]string{"-C", dir}, args...)
-	}
-	cmd := exec.Command("git", args...)
-	// Fixed identity and host-config isolation so commits succeed offline regardless of the
-	// host's git config (mirrors gitCmd in act/common/git).
-	cmd.Env = append(os.Environ(),
-		"GIT_AUTHOR_NAME=test", "GIT_AUTHOR_EMAIL=test@example.com",
-		"GIT_COMMITTER_NAME=test", "GIT_COMMITTER_EMAIL=test@example.com",
-		"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null",
-	)
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
-}
-
-// TestShortShaActionRejected verifies a `uses` ref that is a shortened commit SHA is rejected
-// with a clear error. The action is resolved from a local repo (via DefaultActionInstance) so
-// this runs offline.
-func TestShortShaActionRejected(t *testing.T) {
-	// a local "remote" action repo at <root>/actions/hello-world-docker-action
-	actionRoot := t.TempDir()
-	repo := filepath.Join(actionRoot, "actions", "hello-world-docker-action")
-	require.NoError(t, os.MkdirAll(repo, 0o755))
-	runGit(t, "", "init", "--initial-branch=main", repo)
-	require.NoError(t, os.WriteFile(filepath.Join(repo, "action.yml"),
-		[]byte("name: hello\nruns:\n  using: node24\n  main: index.js\n"), 0o644))
-	runGit(t, repo, "add", ".")
-	runGit(t, repo, "commit", "-m", "initial")
-	out, err := exec.Command("git", "-C", repo, "rev-parse", "HEAD").Output()
-	require.NoError(t, err)
-	shortSha := strings.TrimSpace(string(out))[:7]
-
-	// a workflow that uses the action at the short SHA
-	wfDir := filepath.Join(t.TempDir(), "wf")
-	require.NoError(t, os.MkdirAll(wfDir, 0o755))
-	wf := fmt.Sprintf("on: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/hello-world-docker-action@%s\n", shortSha)
-	require.NoError(t, os.WriteFile(filepath.Join(wfDir, "push.yml"), []byte(wf), 0o644))
-
-	runner, err := New(&Config{
-		Workdir:               wfDir,
-		EventName:             "push",
-		Platforms:             map[string]string{"ubuntu-latest": baseImage},
-		GitHubInstance:        "github.com",
-		DefaultActionInstance: actionRoot,
-		ContainerMaxLifetime:  time.Hour,
-	})
-	require.NoError(t, err)
-	planner, err := model.NewWorkflowPlanner(wfDir, true)
-	require.NoError(t, err)
-	plan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-
-	err = runner.NewPlanExecutor(plan)(common.WithDryrun(context.Background(), true))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "shortened version of a commit SHA")
-}
-
 func TestActionCache(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	a := assert.New(t)
-	ctx := context.Background()
-
-	// Build a local bare repo with a `js` action dir so this runs offline (formerly cloned
-	// github.com/nektos/act-test-actions over the network). allowAnySHA1InWant lets the
-	// "Fetch Sha" case fetch a commit hash directly.
-	remoteDir := t.TempDir()
-	runGit(t, "", "init", "--bare", "--initial-branch=main", remoteDir)
-	runGit(t, remoteDir, "config", "uploadpack.allowAnySHA1InWant", "true")
-
-	workDir := t.TempDir()
-	runGit(t, "", "clone", remoteDir, workDir)
-	require.NoError(t, os.MkdirAll(filepath.Join(workDir, "js"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, "js", "action.yml"),
-		[]byte("name: js\nruns:\n  using: node24\n  main: index.js\n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, "js", "index.js"),
-		[]byte("console.log('hello');\n"), 0o644))
-	runGit(t, workDir, "add", ".")
-	runGit(t, workDir, "commit", "-m", "initial")
-	runGit(t, workDir, "push", "-u", "origin", "main")
-
-	out, err := exec.Command("git", "-C", workDir, "rev-parse", "main").Output()
-	require.NoError(t, err)
-	fullSha := strings.TrimSpace(string(out))
-
 	cache := &GoGitActionCache{
 		Path: t.TempDir(),
 	}
-	cacheDir := "local/act-test-actions"
+	ctx := context.Background()
+	cacheDir := "nektos/act-test-actions"
+	repo := "https://github.com/nektos/act-test-actions"
 	refs := []struct {
-		Name string
+		Name     string
-		Ref  string
+		CacheDir string
+		Repo     string
+		Ref      string
 	}{
-		{Name: "Fetch Branch Name", Ref: "main"},
+		{
-		{Name: "Fetch Branch Name Absolutely", Ref: "refs/heads/main"},
+			Name:     "Fetch Branch Name",
-		{Name: "Fetch HEAD", Ref: "HEAD"},
+			CacheDir: cacheDir,
-		{Name: "Fetch Sha", Ref: fullSha},
+			Repo:     repo,
+			Ref:      "main",
+		},
+		{
+			Name:     "Fetch Branch Name Absolutely",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "refs/heads/main",
+		},
+		{
+			Name:     "Fetch HEAD",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "HEAD",
+		},
+		{
+			Name:     "Fetch Sha",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "de984ca37e4df4cb9fd9256435a3b82c4a2662b1",
+		},
 	}
 	for _, c := range refs {
 		t.Run(c.Name, func(t *testing.T) {
-			sha, err := cache.Fetch(ctx, cacheDir, remoteDir, c.Ref, "")
+			sha, err := cache.Fetch(ctx, c.CacheDir, c.Repo, c.Ref, "")
 			if !a.NoError(err) || !a.NotEmpty(sha) { //nolint:testifylint // pre-existing issue from nektos/act
 				return
 			}
-			atar, err := cache.GetTarArchive(ctx, cacheDir, sha, "js")
+			atar, err := cache.GetTarArchive(ctx, c.CacheDir, sha, "js")
-			// NotNil, not NotEmpty: atar is a live io.PipeReader whose producer goroutine is
+			if !a.NoError(err) || !a.NotEmpty(atar) { //nolint:testifylint // pre-existing issue from nektos/act
-			// writing concurrently; NotEmpty deep-reflects over its internals and races.
-			if !a.NoError(err) || !a.NotNil(atar) { //nolint:testifylint // pre-existing issue from nektos/act
 				return
 			}
-			// GetTarArchive streams from a background goroutine walking the shared repo.
-			// Drain and close so it finishes before the next subtest fetches into the same
-			// repo; otherwise the lingering walk races with that fetch.
-			defer func() {
-				_, _ = io.Copy(io.Discard, atar)
-				_ = atar.Close()
-			}()
 			mytar := tar.NewReader(atar)
 			th, err := mytar.Next()
 			if !a.NoError(err) || !a.NotEqual(0, th.Size) { //nolint:testifylint // pre-existing issue from nektos/act

act/runner/action_composite.go

@@ -8,7 +8,6 @@ import (
 	"context"
 	"errors"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -86,19 +85,6 @@ func newCompositeRunContext(ctx context.Context, parent *RunContext, step action
 	return compositerc
 }
 
-// appendUniqueMasks appends the masks from src to dst, skipping any mask that
-// is already present in dst. This prevents the parent RunContext's Masks slice
-// from growing exponentially when composite actions are nested or repeated,
-// since each composite RunContext is seeded with its parent's masks.
-func appendUniqueMasks(dst, src []string) []string {
-	for _, m := range src {
-		if !slices.Contains(dst, m) {
-			dst = append(dst, m)
-		}
-	}
-	return dst
-}
-
 func execAsComposite(step actionStep) common.Executor {
 	rc := step.getRunContext()
 	action := step.getActionModel()
@@ -124,11 +110,7 @@ func execAsComposite(step actionStep) common.Executor {
 			}, eval.Interpolate(ctx, output.Value))
 		}
 
-		// compositeRC.Masks is seeded with rc.Masks (see newCompositeRunContext)
+		rc.Masks = append(rc.Masks, compositeRC.Masks...)
-		// and may have additional masks appended while the composite action runs.
-		// Only append masks that are not already present, otherwise nested or
-		// repeated composite actions grow rc.Masks exponentially.
-		rc.Masks = appendUniqueMasks(rc.Masks, compositeRC.Masks)
 		rc.ExtraPath = compositeRC.ExtraPath
 		// compositeRC.Env is dirty, contains INPUT_ and merged step env, only rely on compositeRC.GlobalEnv
 		mergeIntoMap := mergeIntoMapCaseSensitive

act/runner/action_composite_test.go

@@ -1,70 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestAppendUniqueMasks(t *testing.T) {
-	tests := []struct {
-		name string
-		dst  []string
-		src  []string
-		want []string
-	}{
-		{
-			name: "appends new masks",
-			dst:  []string{"a"},
-			src:  []string{"b", "c"},
-			want: []string{"a", "b", "c"},
-		},
-		{
-			name: "skips masks already present",
-			dst:  []string{"a", "b"},
-			src:  []string{"a", "b"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "deduplicates within src",
-			dst:  []string{"a"},
-			src:  []string{"b", "b", "a"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "empty src leaves dst unchanged",
-			dst:  []string{"a"},
-			src:  nil,
-			want: []string{"a"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, appendUniqueMasks(tt.dst, tt.src))
-		})
-	}
-}
-
-// TestAppendUniqueMasksNoExponentialGrowth reproduces the exponential growth of
-// the parent's Masks slice observed with nested/repeated composite actions. A
-// composite RunContext is seeded with its parent's masks and the whole seeded
-// slice was previously appended back into the parent, doubling its length on
-// every composite action.
-func TestAppendUniqueMasksNoExponentialGrowth(t *testing.T) {
-	parentMasks := []string{"secret"}
-
-	for range 20 {
-		// compositeRC.Masks starts as a copy of the parent's masks (it is
-		// seeded with parent.Masks in newCompositeRunContext).
-		compositeMasks := make([]string, len(parentMasks))
-		copy(compositeMasks, parentMasks)
-
-		parentMasks = appendUniqueMasks(parentMasks, compositeMasks)
-	}
-
-	assert.Equal(t, []string{"secret"}, parentMasks)
-}

act/runner/action_test.go

@@ -9,18 +9,12 @@ import (
 	"io"
 	"io/fs"
 	"strings"
-	"sync"
 	"testing"
-	"time"
 
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 )
 
 type closerMock struct {
@@ -151,44 +145,6 @@ runs:
 	}
 }
 
-// With AutoRemove the daemon reaps the container on exit, so act must not remove it afterwards.
-func TestExecAsDockerAutoRemove(t *testing.T) {
-	orig := ContainerNewContainer
-	defer func() { ContainerNewContainer = orig }()
-
-	for _, tc := range []struct {
-		autoRemove bool
-		removes    int
-	}{
-		{false, 2}, // stale + post-run
-		{true, 1},  // post-run skipped
-	} {
-		cm := &containerMock{}
-		ContainerNewContainer = func(*container.NewContainerInput) container.ExecutionsEnvironment { return cm }
-
-		step := &stepActionRemote{
-			Step: &model.Step{ID: "1", Uses: "org/action@v1"},
-			RunContext: &RunContext{
-				Config:       &Config{AutoRemove: tc.autoRemove},
-				Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
-				JobContainer: cm,
-			},
-			action: &model.Action{Runs: model.ActionRuns{Using: "docker", Image: "docker://node:14"}},
-		}
-
-		removes := 0
-		cm.On("Pull", false).Return(func(context.Context) error { return nil })
-		cm.On("Remove").Return(func(context.Context) error { removes++; return nil })
-		cm.On("Create", []string(nil), []string(nil)).Return(func(context.Context) error { return nil })
-		cm.On("Start", true).Return(func(context.Context) error { return nil })
-		cm.On("Close").Return(func(context.Context) error { return nil })
-
-		require.NoError(t, execAsDocker(context.Background(), step, "action", t.TempDir(), t.TempDir(), false))
-		cm.AssertExpectations(t)
-		assert.Equal(t, tc.removes, removes)
-	}
-}
-
 func TestActionRunner(t *testing.T) {
 	table := []struct {
 		name        string
@@ -296,248 +252,3 @@ func TestActionRunner(t *testing.T) {
 		})
 	}
 }
-
-func TestNewStepContainerDoesNotUseDockerSecrets(t *testing.T) {
-	cm := &containerMock{}
-
-	var captured *container.NewContainerInput
-	origContainerNewContainer := ContainerNewContainer
-	ContainerNewContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-		captured = input
-		return cm
-	}
-	defer func() {
-		ContainerNewContainer = origContainerNewContainer
-	}()
-
-	ctx := context.Background()
-	rc := &RunContext{
-		Name: "job",
-		Config: &Config{
-			Secrets: map[string]string{
-				"DOCKER_USERNAME": "docker-user",
-				"DOCKER_PASSWORD": "docker-password",
-			},
-		},
-		Run: &model.Run{
-			JobID: "job",
-			Workflow: &model.Workflow{
-				Name: "test",
-				Jobs: map[string]*model.Job{
-					"job": {},
-				},
-			},
-		},
-		JobContainer: cm,
-		StepResults:  map[string]*model.StepResult{},
-	}
-	env := map[string]string{}
-	step := &stepMock{}
-	step.On("getRunContext").Return(rc)
-	step.On("getStepModel").Return(&model.Step{ID: "action"})
-	step.On("getEnv").Return(&env)
-
-	_ = newStepContainer(ctx, step, "registry.example.com/action:tag", nil, nil)
-
-	// DOCKER_USERNAME/DOCKER_PASSWORD should not be injected as pull credentials for docker action containers.
-	assert.Empty(t, captured.Username)
-	assert.Empty(t, captured.Password)
-	step.AssertExpectations(t)
-}
-
-func TestMaybeCopyToActionDirHoldsCloneLock(t *testing.T) {
-	ctx := context.Background()
-
-	actionDir := t.TempDir()
-
-	releaseCopy := make(chan struct{})
-	release := sync.OnceFunc(func() { close(releaseCopy) })
-	defer release()
-
-	copyEntered := make(chan struct{})
-
-	cm := &containerMock{}
-	cm.On("CopyDir", "/var/run/act/actions/", actionDir+"/", false).Return(func(ctx context.Context) error {
-		close(copyEntered)
-		<-releaseCopy
-		return nil
-	})
-
-	step := &stepActionRemote{
-		Step: &model.Step{Uses: "remote/action@v1"},
-		RunContext: &RunContext{
-			Config:       &Config{},
-			JobContainer: cm,
-		},
-	}
-
-	copyDone := make(chan error, 1)
-	go func() {
-		copyDone <- maybeCopyToActionDir(ctx, step, actionDir, "", "/var/run/act/actions/")
-	}()
-
-	select {
-	case <-copyEntered:
-	case err := <-copyDone:
-		t.Fatalf("maybeCopyToActionDir returned before CopyDir was entered: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("CopyDir was not entered within 1 second")
-	}
-
-	peerAcquired := make(chan struct{})
-	go func() {
-		unlock := git.AcquireCloneLock(actionDir)
-		close(peerAcquired)
-		unlock()
-	}()
-
-	select {
-	case <-peerAcquired:
-		t.Fatal("peer AcquireCloneLock returned while CopyDir was running")
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	release()
-
-	select {
-	case err := <-copyDone:
-		if err != nil {
-			t.Fatalf("maybeCopyToActionDir returned error: %v", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("maybeCopyToActionDir did not return after CopyDir was unblocked")
-	}
-
-	select {
-	case <-peerAcquired:
-	case <-time.After(time.Second):
-		t.Fatal("peer AcquireCloneLock did not proceed after lock released")
-	}
-
-	cm.AssertExpectations(t)
-}
-
-func TestExecAsDockerHoldsCloneLockForRemoteUncached(t *testing.T) {
-	actionDir := t.TempDir()
-
-	unlockOnce := sync.OnceFunc(git.AcquireCloneLock(actionDir))
-	defer unlockOnce()
-
-	innerEntered := make(chan struct{})
-	releaseInner := make(chan struct{})
-	releaseOnce := sync.OnceFunc(func() { close(releaseInner) })
-	defer releaseOnce()
-
-	origImageExists := ContainerImageExistsLocally
-	ContainerImageExistsLocally = func(_ context.Context, _, _ string) (bool, error) {
-		return false, nil
-	}
-	defer func() { ContainerImageExistsLocally = origImageExists }()
-
-	origBuildExec := ContainerNewDockerBuildExecutor
-	ContainerNewDockerBuildExecutor = func(_ container.NewDockerBuildExecutorInput) common.Executor {
-		return func(_ context.Context) error {
-			close(innerEntered)
-			<-releaseInner
-			return nil
-		}
-	}
-	defer func() { ContainerNewDockerBuildExecutor = origBuildExec }()
-
-	step := &stepActionRemote{
-		Step: &model.Step{ID: "1", Uses: "remote/action@v1", With: map[string]string{}},
-		RunContext: &RunContext{
-			Config: &Config{},
-			Run: &model.Run{
-				JobID: "1",
-				Workflow: &model.Workflow{
-					Name: "wf",
-					Jobs: map[string]*model.Job{"1": {}},
-				},
-			},
-			JobContainer: &containerMock{},
-		},
-		action: &model.Action{Runs: model.ActionRuns{Using: "docker", Image: "Dockerfile"}},
-		env:    map[string]string{},
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	done := make(chan error, 1)
-	go func() { done <- execAsDocker(ctx, step, "test-action", actionDir, actionDir, false) }()
-
-	select {
-	case <-innerEntered:
-		t.Fatal("inner build executor ran before clone lock was released")
-	case err := <-done:
-		t.Fatalf("execAsDocker returned before inner was entered: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	unlockOnce()
-
-	select {
-	case <-innerEntered:
-	case err := <-done:
-		t.Fatalf("execAsDocker returned without entering inner: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("inner build executor not entered after lock released")
-	}
-
-	cancel()
-	releaseOnce()
-
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("execAsDocker did not return after inner was released and ctx was canceled")
-	}
-}
-
-func TestDockerActionImageTag(t *testing.T) {
-	// Remote actions already carry a unique, ref-scoped actionName (the uses
-	// hash), so the tag must be left untouched for backwards compatibility.
-	assert.Equal(t,
-		"act-abc123-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "abc123", false),
-	)
-
-	// Local actions keep a human-readable, repository-namespaced prefix and gain a short hash suffix that makes the tag unique per (repository, actionName).
-	// See https://gitea.com/gitea/runner/issues/1039.
-	assert.Equal(t,
-		"act-owner-repo-baca2daaa2fe-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./", true),
-	)
-	assert.Equal(t,
-		"act-owner-repo-sub-e847b61255a8-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-
-	// Sanitizing every non-alphanumeric character to "-" is lossy, so distinct inputs can collapse to the same readable prefix.
-	// The hash suffix must keep such cases apart, otherwise an image built for one repository is reused for another.
-	collisions := [][2]struct {
-		repoName   string
-		actionName string
-	}{
-		// Two different repositories, both `uses: ./`: "a/b-c" and "a-b/c" both sanitize to "a-b-c".
-		{{"a/b-c", "./"}, {"a-b/c", "./"}},
-		// A repository's root action vs another repository's sub-path action:
-		// "owner/repo-a" + "./" and "owner/repo" + "./a" both sanitize to "owner-repo-a".
-		{{"owner/repo-a", "./"}, {"owner/repo", "./a"}},
-	}
-	for _, c := range collisions {
-		assert.NotEqual(t,
-			dockerActionImageTag(c[0].repoName, c[0].actionName, true),
-			dockerActionImageTag(c[1].repoName, c[1].actionName, true),
-			"local docker action tags must differ for %q/%q vs %q/%q",
-			c[0].repoName, c[0].actionName, c[1].repoName, c[1].actionName,
-		)
-	}
-
-	// Distinct local actions within the same repository keep distinct tags.
-	assert.NotEqual(t,
-		dockerActionImageTag("owner/repo", "./", true),
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-}

act/runner/cancellation_test.go

@@ -1,312 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v4"
-)
-
-// TestCancelledJobStatusEnablesAlwaysAndCancelledSteps verifies that once a job is
-// cancelled, getJobContext reports the "cancelled" status so the step `if` functions
-// evaluate the way GitHub Actions does: cancelled()/always() are true, success()/failure()
-// are false. A step that defaults to success() is therefore skipped while an always() step
-// still runs. Before the fix the status could only ever be success/failure, so cancelled()
-// was structurally impossible and cancel-only cleanup steps never ran.
-func TestCancelledJobStatusEnablesAlwaysAndCancelledSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	rc.markCancelled()
-
-	// The core fix: the job status context now reports "cancelled" instead of being
-	// pinned to success/failure.
-	jobCtx := rc.getJobContext()
-	require.Equal(t, "cancelled", jobCtx.Status)
-
-	// Feed that status through the step-context expression functions, which is what a
-	// step `if` evaluates. On a cancelled job only always()/cancelled() are true.
-	interp := exprparser.NewInterpeter(
-		&exprparser.EvaluationEnvironment{Job: jobCtx},
-		exprparser.Config{Context: "step"},
-	)
-	for expr, want := range map[string]bool{
-		"cancelled()":  true,
-		"always()":     true,
-		"success()":    false,
-		"failure()":    false,
-		"!cancelled()": false,
-	} {
-		got, err := interp.Evaluate(expr, exprparser.DefaultStatusCheckNone)
-		require.NoErrorf(t, err, "Evaluate(%q)", expr)
-		assert.Equalf(t, want, got, "Evaluate(%q) on a cancelled job", expr)
-	}
-
-	// A step without an `if` defaults to success() and must be skipped on cancel,
-	// while an `if: always()` step must still run.
-	disabled, err := interp.Evaluate("", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, false, disabled, "default-success step must be skipped on a cancelled job")
-
-	enabled, err := interp.Evaluate("always()", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, true, enabled, "`if: always()` step must run on a cancelled job")
-}
-
-// TestMainStepsExecutorRunsAlwaysStepsAfterCancel verifies that newMainStepsExecutor does
-// not abandon the remaining steps when the run is cancelled mid-pipeline. The later step
-// still runs (so a main-stage always() step is reached), it runs under a fresh,
-// non-cancelled context, and the job is marked cancelled. The interrupt error is still
-// propagated so callers up the chain see the cancellation.
-func TestMainStepsExecutorRunsAlwaysStepsAfterCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "step1")
-			cancel() // server cancellation lands while step1 runs
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "interrupt error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after cancel")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps guards the timeout path's symmetry with the cancel path.
-// When the job deadline (timeout-minutes) lands in the gap between two steps, the job must be marked as failed (not cancelled),
-// so always()/failure() cleanup steps run while default success() steps skip, and so the timed-out job is not reported as success.
-func TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	// A short deadline that we let elapse between steps, so no step records the error itself.
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
-	defer cancel()
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(c context.Context) error {
-			ran = append(ran, "step1")
-			// Block until the job deadline elapses, then return cleanly: the interrupt lands in the loop's between-steps check, not inside a step.
-			<-c.Done()
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.DeadlineExceeded, "the timeout error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after a timeout")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-expired context")
-	assert.True(t, rc.jobFailed, "a job timeout marks the job failed")
-	assert.False(t, rc.jobCancelled, "a timeout is not a cancellation")
-
-	// The status the real main-step `if` evaluation sees: "failure", so default success() steps skip while always()/failure() steps run.
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreCancel verifies that a cancellation landing during the
-// pre phase does not abandon the main steps: newStepsExecutor still runs the main-steps executor,
-// so a main-stage always()/cancelled() step is reached (under a fresh, non-cancelled context),
-// the job is marked cancelled, and the cancellation is propagated. Before the fix the `.Then(...)`
-// short-circuit skipped the main steps entirely when a pre step was cancelled.
-func TestStepsExecutorRunsMainStepsAfterPreCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var mainStepCtxErr error
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			cancel() // server cancellation lands during the pre phase
-			return nil
-		},
-	}
-	steps := []common.Executor{
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			mainStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "the cancellation is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-phase cancel")
-	require.NoError(t, mainStepCtxErr, "the main step runs under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreFailure verifies that a failing pre step does not abandon
-// the main steps: they still run (so a main-stage always()/failure() step is reached), and the
-// pre-step error is propagated so the job is reported as failed. The main steps' own `if`
-// evaluation is what skips success()-default steps, so running them here is safe.
-func TestStepsExecutorRunsMainStepsAfterPreFailure(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	var ran []string
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			return assert.AnError
-		},
-	}
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "always-step")
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(context.Background())
-
-	require.ErrorIs(t, err, assert.AnError, "the pre-step error is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-step failure")
-	assert.False(t, rc.jobCancelled, "a pre-step failure is not a cancellation")
-}
-
-// TestPreStepFailureAffectsMainStepIfStatus verifies the status path used by real
-// main-step `if` evaluation. A pre-step failure is not present in StepResults, so
-// recording only the context job error is not enough: getJobContext must also report
-// failure so success()-default main steps skip and failure() steps run.
-func TestPreStepFailureAffectsMainStepIfStatus(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	ctx := common.WithJobErrorContainer(context.Background())
-
-	reportStepError(ctx, rc, assert.AnError)
-
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-	require.ErrorIs(t, common.JobError(ctx), assert.AnError)
-
-	defaultStep := &stepRun{
-		RunContext: rc,
-		Step:       &model.Step{ID: "default-step"},
-		env:        map[string]string{},
-	}
-	defaultEnabled, err := isStepEnabled(ctx, defaultStep.getIfExpression(ctx, stepStageMain), defaultStep, stepStageMain)
-	require.NoError(t, err)
-	assert.False(t, defaultEnabled, "default success() main step must skip after a pre-step failure")
-
-	failureStep := &stepRun{
-		RunContext: rc,
-		Step: &model.Step{
-			ID: "failure-step",
-			If: yaml.Node{Value: "failure()"},
-		},
-		env: map[string]string{},
-	}
-	failureEnabled, err := isStepEnabled(ctx, failureStep.getIfExpression(ctx, stepStageMain), failureStep, stepStageMain)
-	require.NoError(t, err)
-	assert.True(t, failureEnabled, "failure() main step must run after a pre-step failure")
-}
-
-// TestPostStepsContextCancelledIsUsableForFailingStep guards against a panic: post/cleanup
-// steps run on a context derived from the cancelled job context, and a failing post step
-// records its error via common.SetJobError. If that derived context lacks a job-error container,
-// SetJobError dereferences a nil map and panics. The post context must therefore be detached
-// from cancellation (so the steps run) yet still carry a usable error container.
-func TestPostStepsContextCancelledIsUsableForFailingStep(t *testing.T) {
-	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-	cancel()
-	require.ErrorIs(t, cancelled.Err(), context.Canceled)
-
-	postCtx, done := postStepsContext(cancelled)
-	defer done()
-
-	// Detached from cancellation, so the post steps actually run.
-	require.NoError(t, postCtx.Err(), "post context must not be cancelled")
-
-	// A failing post step records its error instead of panicking.
-	require.NotPanics(t, func() {
-		common.SetJobError(postCtx, assert.AnError)
-	}, "a failing post step must not panic on the cancel path")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError)
-}
-
-// TestPostStepsContextDeadlinePreservesJobError verifies the job-timeout path keeps the original
-// job-error container (via context.WithoutCancel), so the timeout failure and any post-step error
-// survive into the post phase and the job is still reported as failed.
-func TestPostStepsContextDeadlinePreservesJobError(t *testing.T) {
-	base := common.WithJobErrorContainer(context.Background())
-	common.SetJobError(base, assert.AnError)
-	expired, cancel := context.WithDeadline(base, time.Now().Add(-time.Hour))
-	defer cancel()
-	require.ErrorIs(t, expired.Err(), context.DeadlineExceeded)
-
-	postCtx, done := postStepsContext(expired)
-	defer done()
-
-	require.NoError(t, postCtx.Err(), "post context must not carry the expired deadline")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError, "the timeout job error must be preserved")
-}
-
-// reportStepError must treat a context.Canceled (e.g. a teardown-cancelled read) as an
-// interruption, never a job failure.
-func TestReportStepErrorTreatsCancelAsInterruption(t *testing.T) {
-	rc := &RunContext{}
-
-	// stray read cancellation while the job context is live: ignored, not a failure
-	live := common.WithJobErrorContainer(context.Background())
-	reportStepError(live, rc, context.Canceled)
-	require.NoError(t, common.JobError(live))
-	assert.False(t, rc.jobFailed)
-	assert.False(t, rc.jobCancelled)
-
-	// genuine job cancellation: recorded as cancelled, still not a failure
-	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-	cancel()
-	reportStepError(cancelled, rc, context.Canceled)
-	require.NoError(t, common.JobError(cancelled))
-	assert.False(t, rc.jobFailed)
-	assert.True(t, rc.jobCancelled)
-
-	// a real error still fails the job
-	failed := common.WithJobErrorContainer(context.Background())
-	reportStepError(failed, rc, assert.AnError)
-	require.ErrorIs(t, common.JobError(failed), assert.AnError)
-	assert.True(t, rc.jobFailed)
-}

act/runner/command.go

@@ -48,13 +48,10 @@ func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler {
 		if resumeCommand != "" && command != resumeCommand {
 			// There should not be any emojis in the log output for Gitea.
 			// The code in the switch statement is the same.
-			// Return true (not false) so the line still reaches the raw_output
-			// log handler; otherwise everything between ::stop-commands:: and
-			// its end token is silently dropped from the step log.
 			logger.Infof("%s", line)
-			return true
+			return false
 		}
-		arg = UnescapeCommandData(arg)
+		arg = unescapeCommandData(arg)
 		kvPairs = unescapeKvPairs(kvPairs)
 		switch command {
 		case "set-env":
@@ -123,7 +120,7 @@ func (rc *RunContext) setOutput(ctx context.Context, kvPairs map[string]string,
 
 	result, ok := rc.StepResults[stepID]
 	if !ok {
-		logger.Infof("No outputs registered for step '%s'", stepID)
+		logger.Infof("  \U00002757  no outputs used step '%s'", stepID)
 		return
 	}
 
@@ -154,7 +151,7 @@ func parseKeyValuePairs(kvPairs, separator string) map[string]string {
 	return rtn
 }
 
-func UnescapeCommandData(arg string) string {
+func unescapeCommandData(arg string) string {
 	escapeMap := map[string]string{
 		"%25": "%",
 		"%0D": "\r",

act/runner/command_test.go

@@ -28,29 +28,6 @@ func TestSetEnv(t *testing.T) {
 	a.Equal("valz", rc.Env["x"])
 }
 
-func TestStopCommandsKeepsSuppressedLinesInLog(t *testing.T) {
-	a := assert.New(t)
-	ctx := context.Background()
-	rc := new(RunContext)
-	handler := rc.commandHandler(ctx)
-
-	// Stop command processing until the matching end token is seen.
-	a.True(handler("::stop-commands::my-end-token\n"))
-
-	// A command-shaped line while stopped must not be executed (env unchanged),
-	// but must still return true so it reaches the raw_output log handler and is
-	// not dropped from the step log.
-	a.True(handler("::set-env name=x::valz\n"))
-	a.NotContains(rc.Env, "x")
-
-	// The matching end token resumes command processing.
-	a.True(handler("::my-end-token::\n"))
-
-	// Commands are processed again after resuming.
-	a.True(handler("::set-env name=y::valy\n"))
-	a.Equal("valy", rc.Env["y"])
-}
-
 func TestSetOutput(t *testing.T) {
 	a := assert.New(t)
 	ctx := context.Background()

act/runner/expression.go

@@ -56,7 +56,7 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map
 		for _, needs := range jobNeeds {
 			using[needs] = exprparser.Needs{
 				Outputs: jobs[needs].Outputs,
-				Result:  jobs[needs].NeedsResult(),
+				Result:  jobs[needs].Result,
 			}
 		}
 
@@ -127,7 +127,7 @@ func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step)
 	for _, needs := range jobNeeds {
 		using[needs] = exprparser.Needs{
 			Outputs: jobs[needs].Outputs,
-			Result:  jobs[needs].NeedsResult(),
+			Result:  jobs[needs].Result,
 		}
 	}
 
@@ -229,8 +229,7 @@ func (ee expressionEvaluator) evaluate(ctx context.Context, in string, defaultSt
 	logger.Debugf("evaluating expression '%s'", in)
 	evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck)
 
-	// evaluated is an any: %t renders everything but a bool as "%!t(string=...)"
+	printable := regexp.MustCompile(`::add-mask::.*`).ReplaceAllString(fmt.Sprintf("%t", evaluated), "::add-mask::***)")
-	printable := regexp.MustCompile(`::add-mask::.*`).ReplaceAllString(fmt.Sprintf("%v", evaluated), "::add-mask::***)")
 	logger.Debugf("expression '%s' evaluated to '%s'", in, printable)
 
 	return evaluated, err
@@ -498,7 +497,11 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod
 				if value == nil {
 					value = v.Default
 				}
-				inputs[k] = coerceInputValue(value, v.Type)
+				if v.Type == "boolean" {
+					inputs[k] = value == "true"
+				} else {
+					inputs[k] = value
+				}
 			}
 		}
 	}
@@ -511,26 +514,17 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod
 				if value == nil {
 					value = v.Default
 				}
-				inputs[k] = coerceInputValue(value, v.Type)
+				if v.Type == "boolean" {
+					inputs[k] = value == "true"
+				} else {
+					inputs[k] = value
+				}
 			}
 		}
 	}
 	return inputs
 }
 
-// coerceInputValue converts an input value to the type declared by the workflow.
-// The event payload carries natively typed JSON values on newer Gitea versions,
-// while defaults and older servers provide strings.
-func coerceInputValue(value any, inputType string) any {
-	if inputType != "boolean" {
-		return value
-	}
-	if b, ok := value.(bool); ok {
-		return b
-	}
-	return value == "true"
-}
-
 func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunContext) {
 	if rc.caller != nil {
 		config := rc.Run.Workflow.WorkflowCallConfig()
@@ -554,7 +548,7 @@ func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunCon
 				}
 			}
 
-			(*inputs)[name] = coerceInputValue(value, input.Type)
+			(*inputs)[name] = value
 		}
 	}
 }
@@ -568,15 +562,15 @@ func getWorkflowSecrets(ctx context.Context, rc *RunContext) map[string]string {
 			secrets = rc.caller.runContext.Config.Secrets
 		}
 
-		// Interpolate into a new map. secrets may be the shared Config.Secrets (or the job's
+		if secrets == nil {
-		// map), which other parallel jobs read concurrently (e.g. log masking), so mutating it
+			secrets = map[string]string{}
-		// in place is a data race.
-		interpolated := make(map[string]string, len(secrets))
-		for k, v := range secrets {
-			interpolated[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v)
 		}
 
-		return interpolated
+		for k, v := range secrets {
+			secrets[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v)
+		}
+
+		return secrets
 	}
 
 	return rc.Config.Secrets

act/runner/expression_test.go

@@ -6,14 +6,12 @@ package runner
 
 import (
 	"context"
-	"strings"
 	"testing"
 
 	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
 
 	assert "github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	yaml "go.yaml.in/yaml/v4"
 )
 
@@ -323,82 +321,3 @@ func TestRewriteSubExpressionForceFormat(t *testing.T) {
 		})
 	}
 }
-
-func TestGetEvaluatorInputsBoolean(t *testing.T) {
-	workflows := map[string]string{
-		"workflow_call": `
-on:
-  workflow_call:
-    inputs:
-      flag:
-        type: boolean
-        default: true
-      name:
-        type: string
-        default: gitea
-`,
-		"workflow_dispatch": `
-on:
-  workflow_dispatch:
-    inputs:
-      flag:
-        type: boolean
-        default: true
-      name:
-        type: string
-        default: gitea
-`,
-	}
-
-	tables := []struct {
-		name  string
-		event map[string]any
-		flag  any
-	}{
-		{
-			// Gitea >= 1.27 resolves the inputs server-side and sends native JSON types
-			name:  "native bool true",
-			event: map[string]any{"inputs": map[string]any{"flag": true}},
-			flag:  true,
-		},
-		{
-			name:  "native bool false",
-			event: map[string]any{"inputs": map[string]any{"flag": false}},
-			flag:  false,
-		},
-		{
-			name:  "string true",
-			event: map[string]any{"inputs": map[string]any{"flag": "true"}},
-			flag:  true,
-		},
-		{
-			name:  "string false",
-			event: map[string]any{"inputs": map[string]any{"flag": "false"}},
-			flag:  false,
-		},
-		{
-			name:  "default is used when the event carries no inputs",
-			event: map[string]any{},
-			flag:  true,
-		},
-	}
-
-	for eventName, workflow := range workflows {
-		for _, table := range tables {
-			t.Run(eventName+"/"+table.name, func(t *testing.T) {
-				wf, err := model.ReadWorkflow(strings.NewReader(workflow))
-				require.NoError(t, err)
-
-				rc := &RunContext{
-					Config: &Config{Workdir: "."},
-					Run:    &model.Run{JobID: "job1", Workflow: wf},
-				}
-				ghc := &model.GithubContext{EventName: eventName, Event: table.event}
-
-				inputs := getEvaluatorInputs(context.Background(), rc, nil, ghc)
-				assert.Equal(t, table.flag, inputs["flag"])
-				assert.Equal(t, "gitea", inputs["name"])
-			})
-		}
-	}
-}

act/runner/helpers_test.go

@@ -1,66 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"net"
-	"os/exec"
-	"runtime"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/container"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireLinuxDocker skips on non-Linux hosts. Some integration workflows need Docker features
-// that only a Linux daemon provides (host networking, host /proc bind mounts); Docker Desktop
-// on macOS/Windows does not, so those tests can only run on Linux.
-func requireLinuxDocker(t *testing.T) {
-	t.Helper()
-	if runtime.GOOS != "linux" {
-		t.Skip("skipping: requires a Linux Docker host")
-	}
-}
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := container.GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}
-
-// requireNetwork skips the test unless github.com is reachable. A few tests exercise behaviour
-// that inherently needs the network (force-pulling an image, resolving a remote short-sha ref);
-// gating lets the rest of the suite run offline without these failing.
-func requireNetwork(t *testing.T) {
-	t.Helper()
-	conn, err := net.DialTimeout("tcp", "github.com:443", 3*time.Second)
-	if err != nil {
-		t.Skipf("skipping: network unavailable: %v", err)
-	}
-	_ = conn.Close()
-}
-
-// requireHostTools skips the test unless every named executable is on PATH. Used by the
-// self-hosted (host environment) suite, which runs steps directly on the host.
-func requireHostTools(t *testing.T, tools ...string) {
-	t.Helper()
-	for _, tool := range tools {
-		if _, err := exec.LookPath(tool); err != nil {
-			t.Skipf("skipping: required host tool %q not found: %v", tool, err)
-		}
-	}
-}

act/runner/job_executor.go

@@ -5,48 +5,15 @@
 package runner
 
 import (
-	"archive/tar"
-	"bytes"
 	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
 	"fmt"
-	"io"
-	"net/http"
-	"path"
-	"slices"
 	"strconv"
-	"strings"
 	"time"
-	"unicode"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
 )
 
-const maxJobSummaryBytes = 1024 * 1024
-
-// jobSummaryTruncationMarker is appended to a summary that exceeded the size limit
-// so the rendered output makes the truncation visible instead of silently cutting off.
-const jobSummaryTruncationMarker = "\n\n---\n\n*Job summary truncated: it exceeded the maximum allowed size.*\n"
-
-var (
-	jobSummaryUploadRetryDelay = time.Second
-	// jobSummaryUploadRequestTimeout bounds a single step upload request. It is kept
-	// below jobSummaryUploadPhaseTimeout so one slow or unreachable request times out
-	// and lets the remaining steps still upload within the phase budget, instead of a
-	// single stuck request consuming the whole phase.
-	jobSummaryUploadRequestTimeout = 5 * time.Second
-	// jobSummaryUploadPhaseTimeout bounds the total time spent uploading all step
-	// summaries. The uploads run inside the job cleanup budget that is also used to
-	// stop and remove the container, so a slow or unreachable endpoint must not be
-	// allowed to consume it; this keeps the remaining budget available for teardown.
-	jobSummaryUploadPhaseTimeout = 15 * time.Second
-)
-
 type jobInfo interface {
 	matrix() map[string]any
 	steps() []*model.Step
@@ -57,87 +24,15 @@ type jobInfo interface {
 	result(result string)
 }
 
-// reportStepError records a step error so the job is reported failed — except a
-// cancellation, which is an interruption, not a failure.
-func reportStepError(ctx context.Context, rc *RunContext, err error) {
-	if errors.Is(err, context.Canceled) {
-		// Defer to the job context: a genuine cancel reports cancelled, a stray teardown
-		// cancellation on a live ctx is ignored — never a step FAILURE.
-		rc.markInterrupted(ctx.Err())
-		return
-	}
-	common.Logger(ctx).Errorf("##[error]%v", err)
-	common.SetJobError(ctx, err)
-	rc.markFailed()
-}
-
-// actionPreparer is implemented by steps that download an action before they run, so the job
-// executor can fetch all of them up front.
-type actionPreparer interface {
-	prepareActionExecutor() common.Executor
-	actionDownloadInfo() (reference, sha string, ok bool)
-}
-
-// printPrepareActions downloads every action the job uses before its first step runs and reports
-// them as actions/runner's "Prepare all required actions" section does. The steps still call
-// prepareActionExecutor themselves; it is a no-op once the action is resolved here.
-func printPrepareActions(rc *RunContext, preparers []actionPreparer) common.Executor {
-	return func(ctx context.Context) error {
-		if len(preparers) == 0 {
-			return nil
-		}
-
-		rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
-		rawLogger.Infof("Prepare all required actions")
-
-		for _, preparer := range preparers {
-			if err := preparer.prepareActionExecutor()(ctx); err != nil {
-				// No step has run yet, so the failure belongs to the job.
-				reportStepError(ctx, rc, err)
-				return err
-			}
-			reference, sha, ok := preparer.actionDownloadInfo()
-			if !ok {
-				continue
-			}
-			if sha == "" {
-				rawLogger.Infof("Download action repository '%s'", reference)
-			} else {
-				rawLogger.Infof("Download action repository '%s' (SHA:%s)", reference, sha)
-			}
-		}
-		return nil
-	}
-}
-
-// printCompleteJobName closes the setup section the way actions/runner ends its "Set up job" step.
-func printCompleteJobName(rc *RunContext) common.Executor {
-	return func(ctx context.Context) error {
-		// Name holds a matrix combination; JobName is the shared name GitHub reports.
-		name := rc.JobName
-		if name == "" {
-			name = rc.Name
-		}
-		if name == "" && rc.Run != nil {
-			name = rc.Run.JobID
-		}
-		common.Logger(ctx).WithField(rawOutputField, true).Infof("Complete job name: %s", name)
-		return nil
-	}
-}
-
 func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executor {
 	steps := make([]common.Executor, 0)
 	preSteps := make([]common.Executor, 0)
-	// Collected separately: every action is downloaded before the first pre step runs.
-	stepPreSteps := make([]common.Executor, 0)
-	preparers := make([]actionPreparer, 0)
 	var postExecutor common.Executor
 
 	steps = append(steps, func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		if len(info.matrix()) > 0 {
-			logger.Infof("Matrix: %v", info.matrix())
+			logger.Infof("\U0001F9EA  Matrix: %v", info.matrix())
 		}
 		return nil
 	})
@@ -178,46 +73,35 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 			return common.NewErrorExecutor(err)
 		}
 
-		if preparer, ok := step.(actionPreparer); ok {
-			preparers = append(preparers, preparer)
-		}
-
-		stepIdx := stepModel.Number
 		preExec := step.pre()
-		stepPreSteps = append(stepPreSteps, useStepLogger(rc, stepModel, stepStagePre, func(ctx context.Context) error {
+		preSteps = append(preSteps, useStepLogger(rc, stepModel, stepStagePre, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
+			logger := common.Logger(ctx)
 			preErr := preExec(ctx)
 			if preErr != nil {
-				reportStepError(ctx, rc, preErr)
+				logger.Errorf("%v", preErr)
+				common.SetJobError(ctx, preErr)
 			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
+				logger.Errorf("%v", ctx.Err())
+				common.SetJobError(ctx, ctx.Err())
 			}
 			return preErr
 		}))
 
 		stepExec := step.main()
 		steps = append(steps, useStepLogger(rc, stepModel, stepStageMain, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
+			logger := common.Logger(ctx)
 			err := stepExec(ctx)
 			if err != nil {
-				reportStepError(ctx, rc, err)
+				logger.Errorf("%v", err)
+				common.SetJobError(ctx, err)
 			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
+				logger.Errorf("%v", ctx.Err())
+				common.SetJobError(ctx, ctx.Err())
 			}
 			return nil
 		}))
 
-		postFn := step.post()
+		postExec := useStepLogger(rc, stepModel, stepStagePost, step.post())
-		postExec := useStepLogger(rc, stepModel, stepStagePost, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
-			err := postFn(ctx)
-			if err != nil {
-				reportStepError(ctx, rc, err)
-			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
-			}
-			return err
-		})
 		if postExecutor != nil {
 			// run the post executor in reverse order
 			postExecutor = postExec.Finally(postExecutor)
@@ -226,26 +110,15 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 		}
 	}
 
-	// The setup section of the job log: download the actions, run the pre steps, then name the job.
-	preSteps = append(preSteps, printPrepareActions(rc, preparers))
-	preSteps = append(preSteps, stepPreSteps...)
-	preSteps = append(preSteps, printCompleteJobName(rc))
-
 	postExecutor = postExecutor.Finally(func(ctx context.Context) error {
 		jobError := common.JobError(ctx)
 		var err error
-		// jobError == nil keeps a failed job's container alive for post-mortem debugging when
+		if rc.Config.AutoRemove || jobError == nil {
-		// AutoRemove is off (the act-CLI --rm behavior; the shipped runner always sets
-		// AutoRemove). A cancelled run is not a failure to inspect, and the cancel-path post
-		// context now carries its own error container so a failing post step makes jobError
-		// non-nil — OR in rc.jobCancelled so cancellation still always tears the container down.
-		if rc.Config.AutoRemove || jobError == nil || rc.jobCancelled {
 			// always allow 1 min for stopping and removing the runner, even if we were cancelled
 			ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
 			defer cancel()
 
 			logger := common.Logger(ctx)
-			tryUploadJobSummary(ctx, rc)
 			// For Gitea
 			// We don't need to call `stopServiceContainers` here since it will be called by following `info.stopContainer`
 			// logger.Infof("Cleaning up services for job %s", rc.JobName)
@@ -278,136 +151,40 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 		return err
 	})
 
-	stepsExecutor := newStepsExecutor(rc, preSteps, steps)
+	pipeline := make([]common.Executor, 0)
+	pipeline = append(pipeline, preSteps...)
+	pipeline = append(pipeline, steps...)
 
-	return common.NewPipelineExecutor(info.startContainer(), stepsExecutor.
+	return common.NewPipelineExecutor(info.startContainer(), common.NewPipelineExecutor(pipeline...).
 		Finally(func(ctx context.Context) error {
-			// Record an interrupt (backstop for interrupts that land outside the main
+			var cancel context.CancelFunc
-			// step loop) so the post steps observe the cancelled/failed job status.
+			if ctx.Err() == context.Canceled {
-			rc.markInterrupted(ctx.Err())
+				// in case of an aborted run, we still should execute the
-			postCtx, cancel := postStepsContext(ctx)
+				// post steps to allow cleanup.
-			defer cancel()
+				ctx, cancel = context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), 5*time.Minute)
-			return postExecutor(postCtx)
+				defer cancel()
+			}
+			return postExecutor(ctx)
 		}).
 		Finally(info.interpolateOutputs()).
 		Finally(info.closeContainer()))
 }
 
-// postStepsContext derives the context used to run the job's post/cleanup steps from the
-// finished main-pipeline context. Cleanup has to run even when the run was interrupted, so the
-// returned context always carries a fresh bounded deadline and is never itself cancelled.
-//
-//   - context.Canceled (server cancel): detach from the cancelled context via a fresh root so
-//     the post steps can run.
-//   - context.DeadlineExceeded (job timeout): detach the deadline with WithoutCancel, which
-//     keeps the original values — including the job-error container — so the timeout failure and
-//     any post-step error are preserved and the job is still reported as failed.
-//   - otherwise: run on the live context unchanged.
-func postStepsContext(ctx context.Context) (context.Context, context.CancelFunc) {
-	switch ctx.Err() {
-	case context.Canceled:
-		// The cancelled context is abandoned for a fresh root, which drops the job-error
-		// container installed at the job root. Re-attach a fresh one so a failing post step
-		// records its error via SetJobError instead of panicking on a nil container.
-		return context.WithTimeout(common.WithJobErrorContainer(common.WithLogger(context.Background(), common.Logger(ctx))), 5*time.Minute)
-	case context.DeadlineExceeded:
-		return context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	default:
-		return ctx, func() {}
-	}
-}
-
-// newStepsExecutor sequences the job's pre steps and main steps.
-//
-// The pre steps run as a normal pipeline that short-circuits on the first failure or
-// cancellation. The main-steps executor then runs unconditionally — even if a pre step failed
-// or the job was interrupted — so always()/cancelled()/failure() main steps still run, mirroring
-// GitHub Actions. This is safe because each main step re-evaluates its own `if` (a pre-step
-// failure flips the expression job status to failure, so success()-default steps skip) and
-// newMainStepsExecutor detaches from an interrupted context before running the remaining steps.
-//
-// A pre-step failure or interrupt is still propagated so the job is reported with the correct
-// conclusion; the pre error takes precedence since it happened first.
-func newStepsExecutor(rc *RunContext, preSteps, steps []common.Executor) common.Executor {
-	preExecutor := common.NewPipelineExecutor(preSteps...)
-	mainExecutor := newMainStepsExecutor(rc, steps)
-	return func(ctx context.Context) error {
-		preErr := preExecutor(ctx)
-		mainErr := mainExecutor(ctx)
-		if preErr != nil {
-			return preErr
-		}
-		return mainErr
-	}
-}
-
-// newMainStepsExecutor runs the job's main-stage step executors in order. Unlike a plain
-// pipeline, an interruption (context.Canceled from a server cancel, or context.DeadlineExceeded
-// from the job timeout) does not abandon the remaining steps: it marks the job cancelled when
-// appropriate and keeps iterating under a fresh, bounded context so steps whose `if` still
-// evaluates true — always() and cancelled() — run for cleanup, mirroring GitHub Actions. Steps
-// that default to success() skip themselves because success() is false once the job is no longer
-// successful. The main-step wrappers report their own errors and return nil, so the loop drives
-// step ordering off the context, not return values.
-func newMainStepsExecutor(rc *RunContext, steps []common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		for i, step := range steps {
-			if ctx.Err() != nil {
-				return runMainStepsAfterInterrupt(ctx, rc, steps[i:])
-			}
-			_ = step(ctx)
-		}
-		// An interrupt can land during the final step, after the loop's last context
-		// check; record it so the post steps still observe the cancelled/failed status.
-		rc.markInterrupted(ctx.Err())
-		return nil
-	}
-}
-
-// runMainStepsAfterInterrupt runs the remaining main steps after the job context was cancelled or
-// timed out. It detaches from the interrupted context (keeping its values: logger and job error)
-// and applies a fresh deadline so always()/cancelled() steps run to completion. The original
-// interrupt error is returned so callers up the chain still see the job as cancelled/timed out.
-func runMainStepsAfterInterrupt(ctx context.Context, rc *RunContext, steps []common.Executor) error {
-	interruptErr := ctx.Err()
-	rc.markInterrupted(interruptErr)
-	freshCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	defer cancel()
-	for _, step := range steps {
-		_ = step(freshCtx)
-	}
-	return interruptErr
-}
-
 func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success bool) {
 	logger := common.Logger(ctx)
 
-	// Matrix combinations share one *model.Job and run in parallel; serialize the
+	jobResult := "success"
-	// read-modify-write of the job result so a failing combination is not lost-updated by a
+	// we have only one result for a whole matrix build, so we need
-	// concurrent succeeding one.
+	// to keep an existing result state if we run a matrix
-	job := rc.Run.Job()
+	if len(info.matrix()) > 0 && rc.Run.Job().Result != "" {
-	var continueOnError bool
+		jobResult = rc.Run.Job().Result
-	if !success {
-		// Use a fresh context so an expired job timeout cannot block expression evaluation.
-		evalCtx := common.WithLogger(context.Background(), common.Logger(ctx))
-		continueOnError = evaluateJobContinueOnError(evalCtx, rc, job)
 	}
-	jobResult := func() string {
-		defer lockJob(job)()
-		result := "success"
-		// we have only one result for a whole matrix build, so we need
-		// to keep an existing result state if we run a matrix
-		if len(info.matrix()) > 0 && job.Result != "" {
-			result = job.Result
-		}
-		if !success {
-			result = "failure"
-			job.SetContinueOnError(continueOnError)
-		}
-		info.result(result)
-		return result
-	}()
 
+	if !success {
+		jobResult = "failure"
+	}
+
+	info.result(jobResult)
 	if rc.caller != nil {
 		// set reusable workflow job result
 		rc.caller.setReusedWorkflowJobResult(rc.JobName, jobResult) // For Gitea
@@ -419,7 +196,7 @@ func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success boo
 		jobResultMessage = "failed"
 	}
 
-	logger.WithField("jobResult", jobResult).Infof("Job %s", jobResultMessage)
+	logger.WithField("jobResult", jobResult).Infof("\U0001F3C1  Job %s", jobResultMessage)
 }
 
 func setJobOutputs(ctx context.Context, rc *RunContext) {
@@ -433,214 +210,10 @@ func setJobOutputs(ctx context.Context, rc *RunContext) {
 			callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value))
 		}
 
-		// Matrix combinations of a reusable-workflow caller share the caller's *model.Job;
+		rc.caller.runContext.Run.Job().Outputs = callerOutputs
-		// serialize the write so parallel combos don't race on its Outputs field.
-		callerJob := rc.caller.runContext.Run.Job()
-		defer lockJob(callerJob)()
-		callerJob.Outputs = callerOutputs
 	}
 }
 
-// applyJobTimeout applies the job-level timeout-minutes to ctx, mirroring the
-// step-level evaluateStepTimeout in step.go.
-func applyJobTimeout(ctx context.Context, rc *RunContext, job *model.Job) (context.Context, context.CancelFunc) {
-	timeout := rc.ExprEval.Interpolate(ctx, job.TimeoutMinutes)
-	if timeout != "" {
-		if timeoutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil {
-			return context.WithTimeout(ctx, time.Duration(timeoutMinutes)*time.Minute)
-		}
-	}
-	return ctx, func() {}
-}
-
-// evaluateJobContinueOnError evaluates the job-level continue-on-error expression.
-func evaluateJobContinueOnError(ctx context.Context, rc *RunContext, job *model.Job) bool {
-	expr := strings.TrimSpace(job.RawContinueOnError)
-	if expr == "" {
-		return false
-	}
-	continueOnError, err := EvalBool(ctx, rc.NewExpressionEvaluator(ctx), expr, exprparser.DefaultStatusCheckNone)
-	if err != nil {
-		common.Logger(ctx).Warnf("continue-on-error expression %q evaluation failed: %v", expr, err)
-		return false
-	}
-	return continueOnError
-}
-
-func tryUploadJobSummary(ctx context.Context, rc *RunContext) {
-	if rc == nil || rc.JobContainer == nil || rc.Config == nil {
-		return
-	}
-	// Bound the whole upload phase so a slow or unreachable endpoint cannot consume
-	// the job cleanup budget reserved for stopping and removing the container.
-	ctx, cancel := context.WithTimeout(ctx, jobSummaryUploadPhaseTimeout)
-	defer cancel()
-	env := rc.GetEnv()
-	caps := strings.TrimSpace(env["GITEA_ACTIONS_CAPABILITIES"])
-	if !hasJobSummaryCapability(caps) {
-		// Server did not advertise support. Do not attempt upload.
-		return
-	}
-	runtimeURL := strings.TrimSpace(env["ACTIONS_RUNTIME_URL"])
-	runtimeToken := strings.TrimSpace(env["ACTIONS_RUNTIME_TOKEN"])
-	runID := strings.TrimSpace(env["GITEA_RUN_ID"])
-	if runtimeURL == "" || runtimeToken == "" || runID == "" {
-		return
-	}
-	if rc.Run == nil || rc.Run.Job() == nil {
-		return
-	}
-	// The numeric ActionRunJob ID is not exposed in the proto Task message or task context,
-	// but the server signs it into the ACTIONS_RUNTIME_TOKEN JWT claims. We decode the
-	// unverified claims to retrieve it; the server re-verifies the token on the request.
-	jobID := extractJobIDFromRuntimeToken(runtimeToken)
-	if jobID <= 0 {
-		return
-	}
-
-	base := strings.TrimRight(runtimeURL, "/") + "/_apis/pipelines/workflows/" + runID +
-		"/jobs/" + strconv.FormatInt(jobID, 10) + "/steps/"
-	actPath := rc.JobContainer.GetActPath()
-	// Reuse a single client across all step uploads so connections can be pooled.
-	client := &http.Client{Timeout: jobSummaryUploadRequestTimeout}
-	for i := range rc.Run.Job().Steps {
-		summaryPath := path.Join(actPath, "workflow", "step-summary-"+strconv.Itoa(i)+".md")
-		body, ok := readSingleFileFromContainerArchive(ctx, rc.JobContainer, summaryPath, maxJobSummaryBytes)
-		if !ok || len(body) == 0 {
-			continue
-		}
-		uploadJobSummary(ctx, client, base+strconv.Itoa(i)+"/summary", runtimeToken, body)
-	}
-}
-
-// extractJobIDFromRuntimeToken returns the JobID claim from an ACTIONS_RUNTIME_TOKEN JWT
-// without verifying its signature. Returns 0 if the token is unparseable or has no JobID.
-func extractJobIDFromRuntimeToken(token string) int64 {
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return 0
-	}
-	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
-	if err != nil {
-		return 0
-	}
-	var claims struct {
-		JobID int64 `json:"JobID"`
-	}
-	if err := json.Unmarshal(payload, &claims); err != nil {
-		return 0
-	}
-	return claims.JobID
-}
-
-func hasJobSummaryCapability(caps string) bool {
-	return slices.Contains(strings.FieldsFunc(caps, func(r rune) bool {
-		return r == ',' || unicode.IsSpace(r)
-	}), "job-summary")
-}
-
-func uploadJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) {
-	logger := common.Logger(ctx)
-
-	var lastStatus int
-	var lastErr error
-	for attempt := 0; attempt < 2; attempt++ {
-		status, err := putJobSummary(ctx, client, url, runtimeToken, body)
-		if err == nil && status/100 == 2 {
-			return
-		}
-		lastStatus = status
-		lastErr = err
-		if attempt == 1 || !isTransientJobSummaryUploadFailure(status, err) {
-			break
-		}
-		timer := time.NewTimer(jobSummaryUploadRetryDelay)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			lastErr = ctx.Err()
-			attempt = 1
-		case <-timer.C:
-		}
-	}
-
-	// Best-effort only; do not fail job, but log because capability was advertised.
-	if lastErr != nil {
-		logger.WithError(lastErr).Warn("job summary upload failed")
-		return
-	}
-	logger.Warnf("job summary upload failed: status=%d", lastStatus)
-}
-
-func putJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) (int, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(body))
-	if err != nil {
-		return 0, err
-	}
-	req.Header.Set("Authorization", "Bearer "+runtimeToken)
-	req.Header.Set("Content-Type", "text/markdown; charset=utf-8")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return 0, err
-	}
-	defer resp.Body.Close()
-	_, _ = io.Copy(io.Discard, resp.Body)
-	return resp.StatusCode, nil
-}
-
-func isTransientJobSummaryUploadFailure(status int, err error) bool {
-	return err != nil || status == http.StatusRequestTimeout || status == http.StatusTooManyRequests || status/100 == 5
-}
-
-func readSingleFileFromContainerArchive(ctx context.Context, env container.ExecutionsEnvironment, p string, maxBytes int64) ([]byte, bool) {
-	rc, err := env.GetContainerArchive(ctx, p)
-	if err != nil {
-		return nil, false
-	}
-	defer rc.Close()
-
-	tr := tar.NewReader(rc)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			return nil, false
-		}
-		if err != nil {
-			return nil, false
-		}
-		if header.Typeflag != tar.TypeReg {
-			continue
-		}
-		if !archiveEntryMatchesPath(header.Name, p) {
-			continue
-		}
-		// Summaries larger than the limit are truncated rather than dropped, so the
-		// user still gets the leading content (mirroring how GitHub caps oversized
-		// step summaries instead of discarding them). Read one extra byte so an
-		// over-limit file is detected from the actual stream rather than trusting
-		// header.Size, then cap the returned content at maxBytes.
-		b, err := io.ReadAll(io.LimitReader(tr, maxBytes+1))
-		if err != nil {
-			return nil, false
-		}
-		if int64(len(b)) > maxBytes {
-			// Reserve room for the marker so the marked-up result still fits in maxBytes.
-			marker := []byte(jobSummaryTruncationMarker)
-			keep := max(maxBytes-int64(len(marker)), 0)
-			b = append(b[:keep], marker...)
-			common.Logger(ctx).Warnf("job summary truncated: path=%s max=%d", p, maxBytes)
-		}
-		return b, true
-	}
-}
-
-func archiveEntryMatchesPath(entryName, requestedPath string) bool {
-	entryName = path.Clean(strings.TrimPrefix(entryName, "/"))
-	requestedPath = path.Clean(strings.TrimPrefix(requestedPath, "/"))
-	return entryName == requestedPath || entryName == path.Base(requestedPath)
-}
-
 func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor {
 	return func(ctx context.Context) error {
 		ctx = withStepLogger(ctx, stepModel.Number, stepModel.ID, rc.ExprEval.Interpolate(ctx, stepModel.String()), stage.String())
@@ -658,11 +231,6 @@ func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, execu
 		oldout, olderr := rc.JobContainer.ReplaceLogWriter(logWriter, logWriter)
 		defer rc.JobContainer.ReplaceLogWriter(oldout, olderr)
 
-		// Flush any buffered, not-yet-newline-terminated trailing line once the
-		// step has finished, so the final line of the step's output is not lost
-		// when it is not newline-terminated.
-		defer common.FlushWriter(logWriter)
-
 		return executor(ctx)
 	}
 }

act/runner/job_executor_test.go

@@ -5,41 +5,34 @@
 package runner
 
 import (
-	"archive/tar"
-	"bytes"
 	"context"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
-	"net/http/httptest"
 	"slices"
-	"strconv"
-	"strings"
 	"testing"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
-	log "github.com/sirupsen/logrus"
-	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-	yaml "go.yaml.in/yaml/v4"
 )
 
 func TestJobExecutor(t *testing.T) {
-	// Dryrun only checks syntax/planning; all cases resolve locally, so this runs offline.
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	tables := []TestJobFileInfo{
 		{workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets},
 		{workdir, "uses-github-empty", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
 		{workdir, "uses-github-noref", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
 		{workdir, "uses-github-root", "push", "", platforms, secrets},
+		{workdir, "uses-github-path", "push", "", platforms, secrets},
 		{workdir, "uses-docker-url", "push", "", platforms, secrets},
+		{workdir, "uses-github-full-sha", "push", "", platforms, secrets},
+		{workdir, "uses-github-short-sha", "push", "Unable to resolve action `actions/hello-world-docker-action@b136eb8`, the provided ref `b136eb8` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `b136eb8894c5cb1dd5807da824be97ccdf9b5423` instead", platforms, secrets},
 		{workdir, "job-nil-step", "push", "invalid Step 0: missing run or uses key", platforms, secrets},
 	}
 	// These tests are sufficient to only check syntax.
@@ -112,182 +105,6 @@ func (sfm *stepFactoryMock) newStep(model *model.Step, rc *RunContext) (step, er
 	return args.Get(0).(step), args.Error(1)
 }
 
-// actionPreparerMock stands in for a step whose action is downloaded before the job's first step.
-type actionPreparerMock struct {
-	reference string
-	sha       string
-	ok        bool
-	err       error
-	prepared  int
-}
-
-func (apm *actionPreparerMock) prepareActionExecutor() common.Executor {
-	return func(context.Context) error {
-		apm.prepared++
-		return apm.err
-	}
-}
-
-func (apm *actionPreparerMock) actionDownloadInfo() (string, string, bool) {
-	return apm.reference, apm.sha, apm.ok
-}
-
-func TestPrintPrepareActionsGolden(t *testing.T) {
-	buf := &bytes.Buffer{}
-	logger := log.New()
-	logger.SetOutput(buf)
-	logger.SetLevel(log.InfoLevel)
-	logger.SetFormatter(&jobLogFormatter{color: cyan})
-	ctx := common.WithLogger(context.Background(), logger.WithFields(log.Fields{"job": "j1"}))
-
-	preparers := []actionPreparer{
-		&actionPreparerMock{reference: "actions/checkout@v7", sha: "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", ok: true},
-		// A resolved commit is best effort; the ref alone is reported when it is unknown.
-		&actionPreparerMock{reference: "actions/setup-go@v6", ok: true},
-		// A step that downloads nothing, such as the checkout of the workflow's own repository.
-		&actionPreparerMock{ok: false},
-	}
-	require.NoError(t, printPrepareActions(&RunContext{}, preparers)(ctx))
-
-	want := strings.Join([]string{
-		"[j1]   | Prepare all required actions",
-		"[j1]   | Download action repository 'actions/checkout@v7' (SHA:9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)",
-		"[j1]   | Download action repository 'actions/setup-go@v6'",
-		"",
-	}, "\n")
-	assert.Equal(t, want, buf.String())
-}
-
-func TestPrintPrepareActionsSkipsWithoutActions(t *testing.T) {
-	buf := &bytes.Buffer{}
-	logger := log.New()
-	logger.SetOutput(buf)
-	logger.SetFormatter(&jobLogFormatter{color: cyan})
-	ctx := common.WithLogger(context.Background(), logger.WithFields(log.Fields{"job": "j1"}))
-
-	require.NoError(t, printPrepareActions(&RunContext{}, nil)(ctx))
-
-	assert.Empty(t, buf.String())
-}
-
-func TestPrintPrepareActionsFailsJobOnDownloadError(t *testing.T) {
-	logger, _ := logrustest.NewNullLogger()
-	ctx := common.WithJobErrorContainer(common.WithLogger(context.Background(), logger.WithField("job", "j1")))
-
-	downloadErr := errors.New("failed to fetch \"actions/checkout\"")
-	rc := &RunContext{}
-	remaining := &actionPreparerMock{reference: "actions/setup-go@v6", ok: true}
-
-	err := printPrepareActions(rc, []actionPreparer{
-		&actionPreparerMock{err: downloadErr},
-		remaining,
-	})(ctx)
-
-	require.ErrorIs(t, err, downloadErr)
-	// No step has run yet, so the failure has to be recorded against the job itself.
-	assert.Equal(t, downloadErr, common.JobError(ctx))
-	assert.True(t, rc.jobFailed)
-	assert.Zero(t, remaining.prepared)
-}
-
-func TestPrintCompleteJobName(t *testing.T) {
-	for name, tt := range map[string]struct {
-		rc   *RunContext
-		want string
-	}{
-		"job name":            {rc: &RunContext{JobName: "lint", Name: "lint-1"}, want: "lint"},
-		"falls back to name":  {rc: &RunContext{Name: "lint-1"}, want: "lint-1"},
-		"falls back to jobID": {rc: &RunContext{Run: &model.Run{JobID: "lint"}}, want: "lint"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := log.New()
-			logger.SetOutput(buf)
-			logger.SetFormatter(&jobLogFormatter{color: cyan})
-			ctx := common.WithLogger(context.Background(), logger.WithFields(log.Fields{"job": "j1"}))
-
-			require.NoError(t, printCompleteJobName(tt.rc)(ctx))
-
-			assert.Equal(t, "[j1]   | Complete job name: "+tt.want+"\n", buf.String())
-		})
-	}
-}
-
-// actionStepMock is a step whose action has to be downloaded before it can run.
-type actionStepMock struct {
-	*stepMock
-	*actionPreparerMock
-}
-
-// TestNewJobExecutorDownloadsAllActionsBeforeTheFirstStep pins the shape of the setup section:
-// every action is downloaded before any step runs, and the job name closes the section. A pre
-// step that downloaded its own action would leave the log interleaved with the downloads.
-func TestNewJobExecutorDownloadsAllActionsBeforeTheFirstStep(t *testing.T) {
-	ctx := common.WithJobErrorContainer(context.Background())
-	jim := &jobInfoMock{}
-	sfm := &stepFactoryMock{}
-	rc := &RunContext{
-		JobContainer: &jobContainerMock{},
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{"test": {}},
-			},
-		},
-		Config: &Config{},
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-
-	steps := []*model.Step{{ID: "1"}, {ID: "2"}}
-	executorOrder := make([]string, 0)
-
-	jim.On("steps").Return(steps)
-	jim.On("matrix").Return(map[string]any{})
-	jim.On("startContainer").Return(func(context.Context) error { return nil })
-	jim.On("stopContainer").Return(func(context.Context) error { return nil })
-	jim.On("closeContainer").Return(func(context.Context) error { return nil })
-	jim.On("interpolateOutputs").Return(func(context.Context) error { return nil })
-	jim.On("result", "success")
-
-	for _, stepModel := range steps {
-		sm := &stepMock{}
-		apm := &actionPreparerMock{reference: "actions/checkout@v" + stepModel.ID, ok: true}
-		sfm.On("newStep", stepModel, rc).Return(&actionStepMock{stepMock: sm, actionPreparerMock: apm}, nil)
-
-		sm.On("pre").Return(func(context.Context) error {
-			executorOrder = append(executorOrder, "pre"+stepModel.ID)
-			return nil
-		})
-		sm.On("main").Return(func(context.Context) error {
-			executorOrder = append(executorOrder, "step"+stepModel.ID)
-			return nil
-		})
-		sm.On("post").Return(func(context.Context) error { return nil })
-
-		defer sm.AssertExpectations(t)
-	}
-
-	logger, hook := logrustest.NewNullLogger()
-	err := newJobExecutor(jim, sfm, rc)(common.WithLogger(ctx, logger.WithField("job", "test")))
-	require.NoError(t, err)
-
-	assert.Equal(t, []string{"pre1", "pre2", "step1", "step2"}, executorOrder)
-
-	setup := make([]string, 0)
-	for _, entry := range hook.AllEntries() {
-		if strings.HasPrefix(entry.Message, "Prepare all required actions") || strings.HasPrefix(entry.Message, "Download action") ||
-			strings.HasPrefix(entry.Message, "Complete job name") {
-			setup = append(setup, entry.Message)
-		}
-	}
-	assert.Equal(t, []string{
-		"Prepare all required actions",
-		"Download action repository 'actions/checkout@v1'",
-		"Download action repository 'actions/checkout@v2'",
-		"Complete job name: test",
-	}, setup)
-}
-
 func TestNewJobExecutor(t *testing.T) {
 	table := []struct {
 		name          string
@@ -524,559 +341,3 @@ func TestNewJobExecutor(t *testing.T) {
 		})
 	}
 }
-
-// TestNewJobExecutorRunsPostStepsAfterTimeout guards the timeout-minutes cleanup
-// path: when a job exceeds its timeout the job context is DeadlineExceeded, but
-// the post steps (cleanup hooks like actions/checkout post and cache save) must
-// still run against a fresh, non-expired context, and the job must still be
-// reported as failed.
-func TestNewJobExecutorRunsPostStepsAfterTimeout(t *testing.T) {
-	ctx := common.WithJobErrorContainer(context.Background())
-	// The timeout is generous so the main step (which blocks on ctx.Done below) is
-	// always reached before the deadline fires; otherwise the pipeline would
-	// short-circuit before the step runs and the job error would never be set.
-	ctx, cancel := context.WithTimeout(ctx, 200*time.Millisecond)
-	defer cancel()
-
-	jim := &jobInfoMock{}
-	sfm := &stepFactoryMock{}
-	rc := &RunContext{
-		JobContainer: &jobContainerMock{},
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{
-					"test": {},
-				},
-			},
-		},
-		Config: &Config{},
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-
-	stepModel := &model.Step{ID: "1"}
-	jim.On("steps").Return([]*model.Step{stepModel})
-	jim.On("matrix").Return(map[string]any{})
-	jim.On("startContainer").Return(func(ctx context.Context) error { return nil })
-	jim.On("interpolateOutputs").Return(func(ctx context.Context) error { return nil })
-	jim.On("closeContainer").Return(func(ctx context.Context) error { return nil })
-	// The job timed out, so it must be reported as failed. stopContainer is left
-	// unexpected on purpose: a timed-out (failed) job preserves its error state, so
-	// the graceful stop is skipped exactly like any other failure without AutoRemove.
-	jim.On("result", "failure")
-
-	sm := &stepMock{}
-	sfm.On("newStep", stepModel, rc).Return(sm, nil)
-	sm.On("pre").Return(func(ctx context.Context) error { return nil })
-	// The main step runs past the job timeout: it blocks until the job context is
-	// done, mirroring a step that overruns timeout-minutes.
-	sm.On("main").Return(func(ctx context.Context) error {
-		<-ctx.Done()
-		return ctx.Err()
-	})
-
-	var postRan bool
-	var postCtxErr error
-	sm.On("post").Return(func(ctx context.Context) error {
-		postRan = true
-		postCtxErr = ctx.Err()
-		return nil
-	})
-
-	executor := newJobExecutor(jim, sfm, rc)
-	// The executor itself returns nil on timeout: the failure is surfaced through
-	// the job result ("failure", asserted via the result mock below), not the
-	// return value.
-	require.NoError(t, executor(ctx))
-
-	assert.True(t, postRan, "post step must run after a job timeout")
-	require.NoError(t, postCtxErr, "post step must run against a fresh, non-expired context")
-
-	jim.AssertExpectations(t)
-	sfm.AssertExpectations(t)
-	sm.AssertExpectations(t)
-}
-
-// TestSetJobResultMatrixContinueOnError exercises the parallel-matrix path
-// end-to-end: two combinations share one *model.Job and continue-on-error is
-// keyed on matrix.experimental, so one combination tolerates its failure and the
-// other does not. The job is reported as continue-on-error only when EVERY failing
-// combination was tolerated; a single firm failure makes the whole job firm, and
-// handleFailure then fails the run.
-func TestSetJobResultMatrixContinueOnError(t *testing.T) {
-	const jobYAML = "continue-on-error: ${{ matrix.experimental }}\nruns-on: ubuntu-latest"
-
-	newSharedJob := func(t *testing.T) (*model.Job, *model.Workflow) {
-		t.Helper()
-		var job *model.Job
-		require.NoError(t, yaml.Unmarshal([]byte(jobYAML), &job))
-		return job, &model.Workflow{
-			Name: "workflow1",
-			Jobs: map[string]*model.Job{"job1": job},
-		}
-	}
-
-	planFor := func(wf *model.Workflow) *model.Plan {
-		return &model.Plan{Stages: []*model.Stage{{Runs: []*model.Run{{Workflow: wf, JobID: "job1"}}}}}
-	}
-
-	ctx := context.Background()
-
-	// fail drives a single matrix combination through the failure path; each
-	// RunContext is its own jobInfo (rc implements jobInfo) and shares the job.
-	fail := func(wf *model.Workflow, experimental bool) {
-		rc := newTestRC(wf, map[string]any{"experimental": experimental})
-		setJobResult(ctx, rc, rc, false)
-	}
-
-	t.Run("one tolerated and one firm failure fails the run", func(t *testing.T) {
-		job, wf := newSharedJob(t)
-		// Order is intentional: the tolerated combination finishes first, then the
-		// firm one. The firm-failure latch must still win regardless of order.
-		fail(wf, true)
-		fail(wf, false)
-
-		assert.Equal(t, "failure", job.Result)
-		assert.False(t, job.ContinueOnError, "a single firm failure must make the whole job firm")
-		assert.Error(t, handleFailure(planFor(wf))(ctx))
-	})
-
-	t.Run("all tolerated failures do not fail the run", func(t *testing.T) {
-		job, wf := newSharedJob(t)
-		fail(wf, true)
-		fail(wf, true)
-
-		assert.Equal(t, "failure", job.Result)
-		assert.True(t, job.ContinueOnError, "every failing combination was tolerated")
-		assert.NoError(t, handleFailure(planFor(wf))(ctx))
-	})
-}
-
-func TestHasJobSummaryCapability(t *testing.T) {
-	assert.True(t, hasJobSummaryCapability("cache,job-summary artifacts"))
-	assert.True(t, hasJobSummaryCapability("cache,\njob-summary\tartifacts"))
-	assert.False(t, hasJobSummaryCapability("not-job-summary,job-summary-v2"))
-}
-
-// fakeRuntimeToken builds a JWT-shaped string whose middle (claims) segment encodes
-// the given JobID. The header and signature segments are filler — the runner does not
-// verify the signature; the server does.
-func fakeRuntimeToken(jobID int64) string {
-	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"HS256","typ":"JWT"}`))
-	claims := base64.RawURLEncoding.EncodeToString(fmt.Appendf(nil, `{"JobID":%d}`, jobID))
-	sig := base64.RawURLEncoding.EncodeToString([]byte("sig"))
-	return header + "." + claims + "." + sig
-}
-
-func newJobSummaryRC(env map[string]string, jobContainer container.ExecutionsEnvironment, stepCount int) *RunContext {
-	steps := make([]*model.Step, stepCount)
-	for i := range steps {
-		steps[i] = &model.Step{ID: strconv.Itoa(i)}
-	}
-	return &RunContext{
-		Config:       &Config{},
-		JobContainer: jobContainer,
-		Env:          env,
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{
-					"test": {Steps: steps},
-				},
-			},
-		},
-	}
-}
-
-func TestTryUploadJobSummaryRetriesTransientFailure(t *testing.T) {
-	oldDelay := jobSummaryUploadRetryDelay
-	jobSummaryUploadRetryDelay = 0
-	defer func() {
-		jobSummaryUploadRetryDelay = oldDelay
-	}()
-
-	runtimeToken := fakeRuntimeToken(34)
-
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		assert.Equal(t, http.MethodPut, r.Method)
-		assert.Equal(t, "/_apis/pipelines/workflows/12/jobs/34/steps/0/summary", r.URL.Path)
-		assert.Equal(t, "Bearer "+runtimeToken, r.Header.Get("Authorization"))
-		assert.Equal(t, "text/markdown; charset=utf-8", r.Header.Get("Content-Type"))
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		assert.Equal(t, []byte("# summary"), body)
-		if requests == 1 {
-			w.WriteHeader(http.StatusInternalServerError)
-			return
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "# summary"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "cache, job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 1)
-
-	tryUploadJobSummary(ctx, rc)
-
-	assert.Equal(t, 2, requests)
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryStopsAtPhaseTimeout(t *testing.T) {
-	oldPhase := jobSummaryUploadPhaseTimeout
-	jobSummaryUploadPhaseTimeout = 100 * time.Millisecond
-	defer func() {
-		jobSummaryUploadPhaseTimeout = oldPhase
-	}()
-
-	runtimeToken := fakeRuntimeToken(34)
-
-	// The server blocks until either the request context is cancelled (the behaviour
-	// under test: the phase timeout aborts the in-flight upload) or the test tears it
-	// down. Without the phase timeout the upload would hang until the 30s client
-	// timeout instead of releasing the cleanup budget. The release channel guarantees
-	// the handler always returns so server.Close() cannot itself hang.
-	release := make(chan struct{})
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		select {
-		case <-r.Context().Done():
-		case <-release:
-		}
-	}))
-	defer server.Close()
-	defer close(release)
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "# summary"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 1)
-
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		tryUploadJobSummary(ctx, rc)
-	}()
-
-	select {
-	case <-done:
-	case <-time.After(5 * time.Second):
-		t.Fatal("tryUploadJobSummary did not honour the phase timeout")
-	}
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryUploadsEachStepIndependently(t *testing.T) {
-	runtimeToken := fakeRuntimeToken(34)
-
-	type upload struct {
-		path string
-		body string
-	}
-	var got []upload
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		got = append(got, upload{r.URL.Path, string(body)})
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	// Three steps: 0 has content, 1 has empty content (skipped), 2 has content.
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "first"}))),
-		nil,
-	).Once()
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-1.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-1.md", body: ""}))),
-		nil,
-	).Once()
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-2.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-2.md", body: "third"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 3)
-
-	tryUploadJobSummary(ctx, rc)
-
-	assert.Equal(t, []upload{
-		{"/_apis/pipelines/workflows/12/jobs/34/steps/0/summary", "first"},
-		{"/_apis/pipelines/workflows/12/jobs/34/steps/2/summary", "third"},
-	}, got)
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryRequiresExactCapability(t *testing.T) {
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "not-job-summary,job-summary-v2",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      fakeRuntimeToken(34),
-		"GITEA_RUN_ID":               "12",
-	}, &containerMock{}, 1)
-
-	tryUploadJobSummary(context.Background(), rc)
-
-	assert.Equal(t, 0, requests)
-}
-
-func TestTryUploadJobSummarySkipsWhenJobIDMissingFromToken(t *testing.T) {
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      "not-a-jwt",
-		"GITEA_RUN_ID":               "12",
-	}, &containerMock{}, 1)
-
-	tryUploadJobSummary(context.Background(), rc)
-
-	assert.Equal(t, 0, requests)
-}
-
-func TestExtractJobIDFromRuntimeToken(t *testing.T) {
-	assert.Equal(t, int64(42), extractJobIDFromRuntimeToken(fakeRuntimeToken(42)))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken("not-a-jwt"))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken("a.b.c"))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken(""))
-}
-
-func TestReadSingleFileFromContainerArchiveFindsMatchingRegularFile(t *testing.T) {
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t,
-			tarEntry{name: "workflow", typeflag: tar.TypeDir},
-			tarEntry{name: "other.md", body: "wrong"},
-			tarEntry{name: "SUMMARY.md", body: "right"},
-		))),
-		nil,
-	).Once()
-
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", 1024)
-
-	assert.True(t, ok)
-	assert.Equal(t, []byte("right"), body)
-	cm.AssertExpectations(t)
-}
-
-func TestReadSingleFileFromContainerArchiveTruncatesWhenTooLarge(t *testing.T) {
-	logger, hook := logrustest.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	cm := &containerMock{}
-	content := strings.Repeat("a", 300)
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "SUMMARY.md", body: content}))),
-		nil,
-	).Once()
-
-	const maxBytes = 200
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", maxBytes)
-
-	// Oversized summaries are truncated to the limit (reserving room for the marker)
-	// rather than dropped entirely, and the truncation marker is appended.
-	assert.True(t, ok)
-	assert.LessOrEqual(t, len(body), maxBytes)
-	keep := maxBytes - len(jobSummaryTruncationMarker)
-	assert.Equal(t, []byte(content[:keep]+jobSummaryTruncationMarker), body)
-	if assert.Len(t, hook.Entries, 1) {
-		assert.Contains(t, hook.Entries[0].Message, "job summary truncated")
-	}
-	cm.AssertExpectations(t)
-}
-
-func TestReadSingleFileFromContainerArchiveKeepsExactLimitWithoutWarning(t *testing.T) {
-	logger, hook := logrustest.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "SUMMARY.md", body: "abc"}))),
-		nil,
-	).Once()
-
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", 3)
-
-	// A summary that is exactly at the limit is kept whole and not flagged as truncated.
-	assert.True(t, ok)
-	assert.Equal(t, []byte("abc"), body)
-	assert.Empty(t, hook.Entries)
-	cm.AssertExpectations(t)
-}
-
-type tarEntry struct {
-	name     string
-	body     string
-	typeflag byte
-}
-
-func tarArchive(t *testing.T, entries ...tarEntry) []byte {
-	t.Helper()
-
-	buf := &bytes.Buffer{}
-	tw := tar.NewWriter(buf)
-	for _, entry := range entries {
-		typeflag := entry.typeflag
-		if typeflag == 0 {
-			typeflag = tar.TypeReg
-		}
-		header := &tar.Header{
-			Name:     entry.name,
-			Typeflag: typeflag,
-			Mode:     0o644,
-			Size:     int64(len(entry.body)),
-		}
-		if typeflag == tar.TypeDir {
-			header.Mode = 0o755
-			header.Size = 0
-		}
-		require.NoError(t, tw.WriteHeader(header))
-		if typeflag == tar.TypeReg {
-			_, err := tw.Write([]byte(entry.body))
-			require.NoError(t, err)
-		}
-	}
-	require.NoError(t, tw.Close())
-	return buf.Bytes()
-}
-
-func newTestRC(wf *model.Workflow, matrix map[string]any) *RunContext {
-	return &RunContext{
-		Config: &Config{
-			Workdir: ".",
-			Platforms: map[string]string{
-				"ubuntu-latest": "ubuntu-latest",
-			},
-		},
-		StepResults: map[string]*model.StepResult{},
-		Env:         map[string]string{},
-		Matrix:      matrix,
-		Run:         &model.Run{JobID: "job1", Workflow: wf},
-	}
-}
-
-func makeTestRC(t *testing.T, jobYAML string) *RunContext {
-	t.Helper()
-	var job *model.Job
-	require.NoError(t, yaml.Unmarshal([]byte(jobYAML), &job))
-	rc := newTestRC(&model.Workflow{
-		Name: "workflow1",
-		Jobs: map[string]*model.Job{"job1": job},
-	}, nil)
-	rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
-	return rc
-}
-
-func TestApplyJobTimeout(t *testing.T) {
-	cases := []struct {
-		name        string
-		yaml        string
-		wantTimeout bool
-	}{
-		{"empty", "runs-on: ubuntu-latest", false},
-		{"integer", "timeout-minutes: 5\nruns-on: ubuntu-latest", true},
-		{"non-numeric ignored", "timeout-minutes: abc\nruns-on: ubuntu-latest", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rc := makeTestRC(t, tc.yaml)
-			ctx := context.Background()
-			newCtx, cancel := applyJobTimeout(ctx, rc, rc.Run.Job())
-			defer cancel()
-			_, hasDeadline := newCtx.Deadline()
-			assert.Equal(t, tc.wantTimeout, hasDeadline)
-		})
-	}
-}
-
-func TestEvaluateJobContinueOnError(t *testing.T) {
-	cases := []struct {
-		name string
-		yaml string
-		want bool
-	}{
-		{"absent", "runs-on: ubuntu-latest", false},
-		{"true", "continue-on-error: true\nruns-on: ubuntu-latest", true},
-		{"false", "continue-on-error: false\nruns-on: ubuntu-latest", false},
-		{"expression true", "continue-on-error: ${{ 'x' == 'x' }}\nruns-on: ubuntu-latest", true},
-		{"expression false", "continue-on-error: ${{ 'x' != 'x' }}\nruns-on: ubuntu-latest", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rc := makeTestRC(t, tc.yaml)
-			got := evaluateJobContinueOnError(context.Background(), rc, rc.Run.Job())
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}
-
-func TestJobSetContinueOnError(t *testing.T) {
-	t.Run("first call true", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		assert.True(t, j.ContinueOnError)
-	})
-	t.Run("first call false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(false)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("true then false locks to false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		j.SetContinueOnError(false)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("false then true stays false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(false)
-		j.SetContinueOnError(true)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("true then true stays true", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		j.SetContinueOnError(true)
-		assert.True(t, j.ContinueOnError)
-	})
-}

act/runner/logger.go

@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"slices"
 	"strings"
 	"sync"
 
@@ -167,29 +166,9 @@ func withStepLogger(ctx context.Context, stepNumber int, stepID, stepName, stage
 
 type entryProcessor func(entry *logrus.Entry) *logrus.Entry
 
-func AppendSecretMasker(oldnew []string, v string) []string {
-	ret := oldnew
-
-	for l := range strings.SplitSeq(v, "\n") {
-		tm := strings.TrimSpace(l)
-		// formatted JSON secrets could otherwise mask {,[,],} everywhere
-		if len(tm) > 1 {
-			ret = append(ret, tm, "***")
-		}
-	}
-
-	return ret
-}
-
 // valueMasker applies secrets and ::add-mask:: patterns to every log entry, including
 // raw_output (command/stream) lines; there is no bypass by field.
 func valueMasker(insecureSecrets bool, secrets map[string]string) entryProcessor {
-	var oldnew []string
-	for _, v := range secrets {
-		oldnew = AppendSecretMasker(oldnew, v)
-	}
-	oldnew = slices.Clip(oldnew)
-	defReplacer := strings.NewReplacer(oldnew...)
 	return func(entry *logrus.Entry) *logrus.Entry {
 		if insecureSecrets {
 			return entry
@@ -197,16 +176,16 @@ func valueMasker(insecureSecrets bool, secrets map[string]string) entryProcessor
 
 		masks := Masks(entry.Context)
 
-		if len(*masks) == 0 {
+		for _, v := range secrets {
-			entry.Message = defReplacer.Replace(entry.Message)
+			if v != "" {
-		} else {
+				entry.Message = strings.ReplaceAll(entry.Message, v, "***")
-			cmasker := oldnew
-
-			for _, v := range *masks {
-				cmasker = AppendSecretMasker(cmasker, v)
 			}
+		}
 
-			entry.Message = strings.NewReplacer(cmasker...).Replace(entry.Message)
+		for _, v := range *masks {
+			if v != "" {
+				entry.Message = strings.ReplaceAll(entry.Message, v, "***")
+			}
 		}
 
 		return entry

act/runner/logger_test.go

@@ -1,52 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestValueMasker(t *testing.T) {
-	table := []struct {
-		name       string
-		lines      string
-		secrets    map[string]string
-		masks      []string
-		disallowed []string
-	}{
-		{
-			name:  "Multiline Private Key",
-			lines: "cat << EOF > private.key\nPRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END\nEOF",
-			secrets: map[string]string{
-				"PRIVATE_KEY": "PRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END",
-			},
-			disallowed: []string{"KEY", "dsdfseffefsefes", "PRIVATE_KEY_END"},
-		},
-		{
-			name:       "Multiline Private Key in masks",
-			lines:      "cat << EOF > private.key\nPRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END\nEOF",
-			masks:      []string{"PRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END"},
-			disallowed: []string{"KEY", "dsdfseffefsefes", "PRIVATE_KEY_END"},
-		},
-	}
-	for _, entry := range table {
-		t.Run(entry.name, func(t *testing.T) {
-			ctx := WithMasks(t.Context(), &entry.masks)
-			masker := valueMasker(false, entry.secrets)
-			for line := range strings.SplitSeq(entry.lines, "\n") {
-				lentry := masker(&logrus.Entry{
-					Context: ctx,
-					Message: line,
-				})
-				for _, line := range entry.disallowed {
-					assert.NotContains(t, lentry.Message, line)
-				}
-			}
-		})
-	}
-}

act/runner/reusable_workflow.go

@@ -7,12 +7,15 @@ package runner
 import (
 	"archive/tar"
 	"context"
+	"errors"
 	"fmt"
+	"io/fs"
 	"net/url"
+	"os"
 	"path"
-	"path/filepath"
 	"regexp"
 	"strings"
+	"sync"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
@@ -28,9 +31,7 @@ func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
 		workflowDir = strings.TrimPrefix(workflowDir, "./")
 
 		return common.NewPipelineExecutor(
-			// resolve the local workflow against the workspace root, not the process
+			newReusableWorkflowExecutor(rc, workflowDir, fileName),
-			// working directory, so it is found regardless of where the runner is invoked
-			newReusableWorkflowExecutor(rc, filepath.Join(rc.Config.Workdir, workflowDir), fileName),
 		)
 	}
 
@@ -50,7 +51,7 @@ func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
 	token := rc.Config.GetToken()
 
 	return common.NewPipelineExecutor(
-		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
+		newMutexExecutor(cloneIfRequired(rc, *remoteReusableWorkflow, workflowDir, token)),
 		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
 	)
 }
@@ -84,7 +85,7 @@ func newRemoteReusableWorkflowExecutor(rc *RunContext) common.Executor {
 	token := getGitCloneToken(rc.Config, remoteReusableWorkflow.CloneURL())
 
 	return common.NewPipelineExecutor(
-		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
+		newMutexExecutor(cloneIfRequired(rc, *remoteReusableWorkflow, workflowDir, token)),
 		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
 	)
 }
@@ -124,38 +125,46 @@ func newActionCacheReusableWorkflowExecutor(rc *RunContext, filename string, rem
 	}
 }
 
-// cloneRemoteReusableWorkflow always invokes the clone executor — moving refs
+var executorLock sync.Mutex
-// (branches, tags) must be re-resolved each run, matching GitHub Actions.
+
-//
+func newMutexExecutor(executor common.Executor) common.Executor {
-// Callers must not change remoteReusableWorkflow.URL, because:
-//  1. Gitea doesn't support specifying GithubContext.ServerURL by the GITHUB_SERVER_URL env
-//  2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflowWithPlat
-//
-// remoteReusableWorkflow.URL = rc.getGithubContext(ctx).ServerURL
-func cloneRemoteReusableWorkflow(rc *RunContext, cloneURL, ref, targetDirectory, token string) common.Executor {
 	return func(ctx context.Context) error {
-		cloneURL = rc.NewExpressionEvaluator(ctx).Interpolate(ctx, cloneURL)
+		executorLock.Lock()
-		return git.NewGitCloneExecutor(git.NewGitCloneExecutorInput{
+		defer executorLock.Unlock()
-			URL:         cloneURL,
+
-			Ref:         ref,
+		return executor(ctx)
-			Dir:         targetDirectory,
-			Token:       token,
-			OfflineMode: rc.Config.ActionOfflineMode,
-			Depth:       rc.Config.ActionCloneDepth,
-		})(ctx)
 	}
 }
 
-var modelNewWorkflowPlanner = model.NewWorkflowPlanner
+func cloneIfRequired(rc *RunContext, remoteReusableWorkflow remoteReusableWorkflow, targetDirectory, token string) common.Executor {
+	return common.NewConditionalExecutor(
+		func(ctx context.Context) bool {
+			_, err := os.Stat(targetDirectory)
+			notExists := errors.Is(err, fs.ErrNotExist)
+			return notExists
+		},
+		func(ctx context.Context) error {
+			// interpolate the cloneURL
+			cloneURL := rc.NewExpressionEvaluator(ctx).Interpolate(ctx, remoteReusableWorkflow.CloneURL())
+			// Do not change the remoteReusableWorkflow.URL, because:
+			// 	1. Gitea doesn't support specifying GithubContext.ServerURL by the GITHUB_SERVER_URL env
+			//	2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflowWithPlat
+			// remoteReusableWorkflow.URL = rc.getGithubContext(ctx).ServerURL
+			return git.NewGitCloneExecutor(git.NewGitCloneExecutorInput{
+				URL:         cloneURL,
+				Ref:         remoteReusableWorkflow.Ref,
+				Dir:         targetDirectory,
+				Token:       token,
+				OfflineMode: rc.Config.ActionOfflineMode,
+			})(ctx)
+		},
+		nil,
+	)
+}
 
 func newReusableWorkflowExecutor(rc *RunContext, directory, workflow string) common.Executor {
 	return func(ctx context.Context) error {
-		// Scoped to the yaml read so concurrent invocations don't serialize
+		planner, err := model.NewWorkflowPlanner(path.Join(directory, workflow), true)
-		// on the whole job run.
-		planner, err := func() (model.WorkflowPlanner, error) {
-			defer git.AcquireCloneLock(directory)()
-			return modelNewWorkflowPlanner(path.Join(directory, workflow), true)
-		}()
 		if err != nil {
 			return err
 		}
@@ -288,12 +297,8 @@ func setReusedWorkflowCallerResult(rc *RunContext, runner Runner) common.Executo
 			if rc.caller != nil {
 				rc.caller.setReusedWorkflowJobResult(rc.JobName, reusedWorkflowJobResult)
 			} else {
-				// Serialize this shared Job.Result write against the other matrix combos
-				// and setJobResult (same lockJob key).
-				unlock := lockJob(rc.Run.Job())
 				rc.result(reusedWorkflowJobResult)
-				unlock()
+				logger.WithField("jobResult", reusedWorkflowJobResult).Infof("\U0001F3C1  Job %s", reusedWorkflowJobResultMessage)
-				logger.WithField("jobResult", reusedWorkflowJobResult).Infof("Job %s", reusedWorkflowJobResultMessage)
 			}
 		}
 
@@ -305,45 +310,25 @@ func setReusedWorkflowCallerResult(rc *RunContext, runner Runner) common.Executo
 // getGitCloneToken returns GITEA_TOKEN when shouldCloneURLUseToken returns true,
 // otherwise returns an empty string
 func getGitCloneToken(conf *Config, cloneURL string) string {
-	if !shouldCloneURLUseToken(conf.GitHubInstance, conf.trustedActionInstance(), cloneURL) {
+	if !shouldCloneURLUseToken(conf.GitHubInstance, cloneURL) {
 		return ""
 	}
 	return conf.GetToken()
 }
 
-// For Gitea
-// trustedActionInstance returns the self-hosted DEFAULT_ACTIONS_URL host that may carry the
-// task token, or "" when actions resolve to github.com / a GithubMirror (never trusted).
-func (c Config) trustedActionInstance() string {
-	if c.DefaultActionInstanceIsSelfHosted {
-		return c.DefaultActionInstance
-	}
-	return ""
-}
-
 // For Gitea
 // shouldCloneURLUseToken returns true when the following conditions are met:
-//  1. cloneURL's host matches this Gitea instance: either the registered instance
+// 1. cloneURL is from the same Gitea instance that the runner is registered to
-//     (instanceURL) or, for DEFAULT_ACTIONS_URL=self on a different hostname, the
+// 2. the cloneURL does not have basic auth embedded
-//     self-hosted action instance (trustedActionInstance, "" when not trusted)
+func shouldCloneURLUseToken(instanceURL, cloneURL string) bool {
-//  2. the cloneURL does not have basic auth embedded
+	u1, err1 := url.Parse(instanceURL)
-func shouldCloneURLUseToken(instanceURL, trustedActionInstance, cloneURL string) bool {
+	u2, err2 := url.Parse(cloneURL)
-	u2, err := url.Parse(cloneURL)
+	if err1 != nil || err2 != nil {
-	if err != nil || u2.User != nil {
+		return false
+	}
+	if u2.User != nil {
 		return false
 	}
 
-	for _, candidate := range []string{instanceURL, trustedActionInstance} {
+	return u1.Host == u2.Host
-		if candidate == "" {
-			continue
-		}
-		if !strings.HasPrefix(candidate, "http://") &&
-			!strings.HasPrefix(candidate, "https://") {
-			candidate = "https://" + candidate
-		}
-		if u1, err := url.Parse(candidate); err == nil && u1.Host == u2.Host {
-			return true
-		}
-	}
-	return false
 }

act/runner/reusable_workflow_test.go

@@ -1,237 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Regression test for go-gitea/gitea#37483: a remote reusable workflow at a moving
-// ref (branch/tag) must reflect the new tip on every invocation, not stay pinned
-// to the cache populated on the first run.
-func TestReusableWorkflowCachedBranchRefRefreshes(t *testing.T) {
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("git not available in PATH")
-	}
-
-	remoteDir := t.TempDir()
-	gitMust(t, "", "init", "--bare", "--initial-branch=master", remoteDir)
-
-	workDir := t.TempDir()
-	gitMust(t, "", "clone", remoteDir, workDir)
-	gitMust(t, workDir, "config", "user.email", "test@test")
-	gitMust(t, workDir, "config", "user.name", "test")
-	gitMust(t, workDir, "checkout", "-b", "master")
-
-	const workflowPath = ".gitea/workflows/reusable.yml"
-	tmpl := func(tag string) string {
-		return "name: reusable\non:\n  workflow_call:\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo " + tag + "\n"
-	}
-
-	require.NoError(t, os.MkdirAll(filepath.Join(workDir, ".gitea/workflows"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, workflowPath), []byte(tmpl("v1")), 0o644))
-	gitMust(t, workDir, "add", workflowPath)
-	gitMust(t, workDir, "commit", "-m", "v1")
-	gitMust(t, workDir, "push", "-u", "origin", "master")
-
-	rc := &RunContext{
-		Config: &Config{},
-		Run: &model.Run{
-			JobID: "j1",
-			Workflow: &model.Workflow{
-				Name: "wf",
-				Jobs: map[string]*model.Job{"j1": {}},
-			},
-		},
-	}
-	cacheDir := t.TempDir()
-
-	require.NoError(t, cloneRemoteReusableWorkflow(rc, remoteDir, "master", cacheDir, "")(context.Background()))
-	got, err := os.ReadFile(filepath.Join(cacheDir, workflowPath))
-	require.NoError(t, err)
-	require.Equal(t, tmpl("v1"), string(got))
-
-	// Branch tip moves; cache key (cacheDir) does not.
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, workflowPath), []byte(tmpl("v2")), 0o644))
-	gitMust(t, workDir, "commit", "-am", "v2")
-	gitMust(t, workDir, "push", "origin", "master")
-
-	require.NoError(t, cloneRemoteReusableWorkflow(rc, remoteDir, "master", cacheDir, "")(context.Background()))
-	got, err = os.ReadFile(filepath.Join(cacheDir, workflowPath))
-	require.NoError(t, err)
-	require.Equal(t, tmpl("v2"), string(got), "cached workflow file must reflect the updated branch tip")
-}
-
-func TestNewReusableWorkflowExecutorHoldsCloneLock(t *testing.T) {
-	workflowDir := t.TempDir()
-
-	unlockOnce := sync.OnceFunc(git.AcquireCloneLock(workflowDir))
-	defer unlockOnce()
-
-	plannerCalled := make(chan struct{})
-
-	origPlanner := modelNewWorkflowPlanner
-	modelNewWorkflowPlanner = func(string, bool) (model.WorkflowPlanner, error) {
-		close(plannerCalled)
-		return nil, errors.New("stop")
-	}
-	defer func() { modelNewWorkflowPlanner = origPlanner }()
-
-	rc := &RunContext{
-		Config: &Config{},
-		Run:    &model.Run{Workflow: &model.Workflow{Jobs: map[string]*model.Job{}}},
-	}
-	exec := newReusableWorkflowExecutor(rc, workflowDir, "reusable.yml")
-
-	done := make(chan error, 1)
-	go func() { done <- exec(context.Background()) }()
-
-	select {
-	case <-plannerCalled:
-		t.Fatal("planner ran while clone lock was held")
-	case err := <-done:
-		t.Fatalf("executor returned before planner was reached: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	unlockOnce()
-
-	select {
-	case <-plannerCalled:
-	case <-time.After(time.Second):
-		t.Fatal("planner not called after lock was released")
-	}
-
-	select {
-	case err := <-done:
-		require.Error(t, err)
-	case <-time.After(time.Second):
-		t.Fatal("executor did not return after planner ran")
-	}
-}
-
-func TestGetGitCloneTokenWithSchemalessGiteaInstance(t *testing.T) {
-	conf := &Config{
-		GitHubInstance: "gitea.example.net",
-		Secrets: map[string]string{
-			"GITEA_TOKEN": "token-value",
-		},
-	}
-
-	token := getGitCloneToken(conf, "https://gitea.example.net/actions/tools")
-
-	require.Equal(t, "token-value", token)
-}
-
-func TestGetGitCloneTokenSelfHostedActionsDifferentHost(t *testing.T) {
-	// The runner registered with one hostname while DEFAULT_ACTIONS_URL=self resolves
-	// actions against AppURL on a different hostname for the same instance.
-	conf := &Config{
-		GitHubInstance:                    "gitea.local",
-		DefaultActionInstance:             "https://gitea.my-nas.lan",
-		DefaultActionInstanceIsSelfHosted: true,
-		Secrets: map[string]string{
-			"GITEA_TOKEN": "token-value",
-		},
-	}
-
-	token := getGitCloneToken(conf, "https://gitea.my-nas.lan/owner/action")
-
-	require.Equal(t, "token-value", token)
-}
-
-func TestShouldCloneURLUseToken(t *testing.T) {
-	tests := []struct {
-		name                  string
-		instanceURL           string
-		trustedActionInstance string
-		cloneURL              string
-		want                  bool
-	}{
-		{
-			name:        "same host with schemaless instance",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://gitea.example.net/actions/tools",
-			want:        true,
-		},
-		{
-			name:        "same host with schemaless instance and port",
-			instanceURL: "gitea.example.net:3000",
-			cloneURL:    "https://gitea.example.net:3000/actions/tools",
-			want:        true,
-		},
-		{
-			name:        "different host",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://github.com/actions/tools",
-			want:        false,
-		},
-		{
-			name:        "embedded basic auth",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://user:pass@gitea.example.net/actions/tools",
-			want:        false,
-		},
-		{
-			name:        "invalid clone URL",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "://gitea.example.net/actions/tools",
-			want:        false,
-		},
-		{
-			// self-hosted DEFAULT_ACTIONS_URL on a different hostname than the
-			// registered instance: the token must still be attached.
-			name:                  "self-hosted action instance on different host",
-			instanceURL:           "gitea.local",
-			trustedActionInstance: "https://gitea.my-nas.lan",
-			cloneURL:              "https://gitea.my-nas.lan/owner/action",
-			want:                  true,
-		},
-		{
-			// embedded basic auth must still be rejected even when the host matches
-			// the trusted action instance.
-			name:                  "self-hosted action instance with embedded basic auth",
-			instanceURL:           "gitea.local",
-			trustedActionInstance: "https://gitea.my-nas.lan",
-			cloneURL:              "https://user:pass@gitea.my-nas.lan/owner/action",
-			want:                  false,
-		},
-		{
-			// github.com / mirror hosts are never trusted: trustedActionInstance is
-			// empty in github mode, so an off-instance clone URL gets no token.
-			name:        "github mode does not trust mirror host",
-			instanceURL: "gitea.local",
-			cloneURL:    "https://mirror.example.com/owner/action",
-			want:        false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require.Equal(t, tt.want, shouldCloneURLUseToken(tt.instanceURL, tt.trustedActionInstance, tt.cloneURL))
-		})
-	}
-}
-
-func gitMust(t *testing.T, dir string, args ...string) {
-	t.Helper()
-	cmd := exec.Command("git", args...)
-	if dir != "" {
-		cmd.Dir = dir
-	}
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "git %v: %s", args, string(out))
-}

act/runner/run_context.go

@@ -20,9 +20,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
-	"slices"
 	"strings"
-	"sync"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
@@ -36,19 +34,15 @@ import (
 
 // RunContext contains info about current job
 type RunContext struct {
-	Name        string
+	Name                string
-	Config      *Config
+	Config              *Config
-	Matrix      map[string]any
+	Matrix              map[string]any
-	Run         *model.Run
+	Run                 *model.Run
-	EventJSON   string
+	EventJSON           string
-	Env         map[string]string
+	Env                 map[string]string
-	GlobalEnv   map[string]string // to pass env changes of GITHUB_ENV and set-env correctly, due to dirty Env field
+	GlobalEnv           map[string]string // to pass env changes of GITHUB_ENV and set-env correctly, due to dirty Env field
-	ExtraPath   []string
+	ExtraPath           []string
-	CurrentStep string
+	CurrentStep         string
-	// CurrentStepIndex is the index of the top-level job step currently executing
-	// (model.Step.Number). Composite sub-steps inherit the outer step's index by
-	// walking the Parent chain; see topLevelRunContext.
-	CurrentStepIndex    int
 	StepResults         map[string]*model.StepResult
 	IntraActionState    map[string]map[string]string
 	ExprEval            ExpressionEvaluator
@@ -61,51 +55,6 @@ type RunContext struct {
 	Masks               []string
 	cleanUpJobContainer common.Executor
 	caller              *caller // job calling this RunContext (reusable workflows)
-	// summaryFileInitialized tracks which per-step summary files (workflow/step-summary-N.md)
-	// have already been created on the JobContainer. The runner sets up file-command files
-	// via JobContainer.Copy at the start of every phase, which truncates them — fine for
-	// GITHUB_ENV/OUTPUT/STATE/PATH (consumed per phase) but wrong for GITHUB_STEP_SUMMARY,
-	// which has accumulating semantics. We initialize each step's summary file exactly once
-	// so writes from later phases and from composite sub-steps append to the same file.
-	// Only populated on the top-level RunContext; child RCs walk Parent via topLevelRunContext.
-	summaryFileInitialized map[int]bool
-	// outputTemplate is this combination's pristine snapshot of the job's output expressions,
-	// captured before execution so each matrix combo interpolates from the originals rather
-	// than from a sibling's already-resolved values written into the shared Job.Outputs.
-	outputTemplate map[string]string
-	// jobCancelled records that this job's run was cancelled (context.Canceled). It makes
-	// getJobContext report the "cancelled" status so cancelled()/always() evaluate the way
-	// GitHub Actions does, letting cleanup and always() steps run while normal steps skip.
-	jobCancelled bool
-	// jobFailed records failures outside normal main-step results, such as action pre-step
-	// failures. Those failures must still make success() false and failure() true for later
-	// main-step if evaluation.
-	jobFailed bool
-}
-
-// markCancelled flags the job as cancelled so subsequent step `if` evaluations and the
-// job status context observe the "cancelled" state.
-func (rc *RunContext) markCancelled() {
-	rc.jobCancelled = true
-}
-
-// markFailed flags the job as failed so subsequent step `if` evaluations observe
-// failure even when the error happened outside a main step result.
-func (rc *RunContext) markFailed() {
-	rc.jobFailed = true
-}
-
-// markInterrupted records the job's interruption status from a context error so later step `if` evaluations and the job result observe it,
-// keeping the timeout path symmetric with the cancel path:
-//   - context.Canceled (server cancel) marks the job cancelled, matching GitHub's "only always()/cancelled() run on cancel".
-//   - context.DeadlineExceeded (job timeout-minutes) marks the job failed, matching the "Timeout -> FAILURE" reporting semantics.
-func (rc *RunContext) markInterrupted(err error) {
-	switch {
-	case errors.Is(err, context.Canceled):
-		rc.markCancelled()
-	case errors.Is(err, context.DeadlineExceeded):
-		rc.markFailed()
-	}
 }
 
 func (rc *RunContext) AddMask(mask string) {
@@ -138,9 +87,7 @@ func (rc *RunContext) GetEnv() map[string]string {
 			}
 		}
 	}
-	if !rc.Config.DisableActEnv {
+	rc.Env["ACT"] = "true"
-		rc.Env["ACT"] = "true"
-	}
 
 	if !rc.Config.NoSkipCheckout {
 		rc.Env["ACT_SKIP_CHECKOUT"] = "true"
@@ -183,34 +130,17 @@ func getDockerDaemonSocketMountPath(daemonPath string) string {
 	return daemonPath
 }
 
-// containerDaemonSocket returns the configured Docker daemon socket, applying the default
-// without mutating the shared Config. Parallel jobs in a plan share one *Config, so a job
-// must never write to it.
-func (rc *RunContext) containerDaemonSocket() string {
-	if rc.Config.ContainerDaemonSocket == "" {
-		return "/var/run/docker.sock"
-	}
-	return rc.Config.ContainerDaemonSocket
-}
-
-// validVolumes returns the volumes allowed on this job's containers: the configured base
-// plus the volumes the runner mounts automatically. It derives a fresh slice every call and
-// never mutates the shared Config (see containerDaemonSocket).
-func (rc *RunContext) validVolumes() []string {
-	name := rc.jobContainerName()
-	volumes := slices.Clone(rc.Config.ValidVolumes)
-	// TODO: add a new configuration to control whether the docker daemon can be mounted
-	return append(volumes, "act-toolcache", name, name+"-env",
-		getDockerDaemonSocketMountPath(rc.containerDaemonSocket()))
-}
-
 // Returns the binds and mounts for the container, resolving paths as appopriate
 func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) {
 	name := rc.jobContainerName()
 
+	if rc.Config.ContainerDaemonSocket == "" {
+		rc.Config.ContainerDaemonSocket = "/var/run/docker.sock"
+	}
+
 	binds := []string{}
-	if daemonSocket := rc.containerDaemonSocket(); daemonSocket != "-" {
+	if rc.Config.ContainerDaemonSocket != "-" {
-		daemonPath := getDockerDaemonSocketMountPath(daemonSocket)
+		daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)
 		binds = append(binds, fmt.Sprintf("%s:%s", daemonPath, "/var/run/docker.sock"))
 	}
 
@@ -224,9 +154,6 @@ func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) {
 	if job := rc.Run.Job(); job != nil {
 		if container := job.Container(); container != nil {
 			for _, v := range container.Volumes {
-				if rc.ExprEval != nil {
-					v = rc.ExprEval.Interpolate(context.Background(), v)
-				}
 				if !strings.Contains(v, ":") || filepath.IsAbs(v) {
 					// Bind anonymous volume or host file.
 					binds = append(binds, v)
@@ -252,13 +179,21 @@ func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) {
 		mounts[name] = ext.ToContainerPath(rc.Config.Workdir)
 	}
 
+	// For Gitea
+	// add some default binds and mounts to ValidVolumes
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, "act-toolcache")
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, name)
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, name+"-env")
+	// TODO: add a new configuration to control whether the docker daemon can be mounted
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket))
+
 	return binds, mounts
 }
 
 func (rc *RunContext) startHostEnvironment() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		rawLogger := logger.WithField(rawOutputField, true)
+		rawLogger := logger.WithField("raw_output", true)
 		logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
 			if rc.Config.LogOutput {
 				rawLogger.Infof("%s", s)
@@ -285,17 +220,15 @@ func (rc *RunContext) startHostEnvironment() common.Executor {
 		}
 		toolCache := filepath.Join(cacheDir, "tool_cache")
 		rc.JobContainer = &container.HostEnvironment{
-			Path:         path,
+			Path:      path,
-			TmpDir:       runnerTmp,
+			TmpDir:    runnerTmp,
-			ToolCache:    toolCache,
+			ToolCache: toolCache,
-			Workdir:      rc.Config.Workdir,
+			Workdir:   rc.Config.Workdir,
-			CleanWorkdir: rc.Config.CleanWorkdir,
+			ActPath:   actPath,
-			ActPath:      actPath,
 			CleanUp: func() {
 				os.RemoveAll(miscpath)
 			},
-			StdOut:      logWriter,
+			StdOut: logWriter,
-			AllocatePTY: rc.Config.AllocatePTY,
 		}
 		rc.cleanUpJobContainer = rc.JobContainer.Remove()
 		for k, v := range rc.JobContainer.GetRunnerContext(ctx) {
@@ -326,27 +259,11 @@ func (rc *RunContext) startHostEnvironment() common.Executor {
 	}
 }
 
-// printStartJobContainerGroup mirrors actions/runner's "Starting job container"
-// section: emit the group header and summary, return a closer for ::endgroup::.
-func printStartJobContainerGroup(ctx context.Context, image, name, network string) func() {
-	rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
-	rawLogger.Infof("::group::Starting job container")
-	rawLogger.Infof("image: %s", image)
-	rawLogger.Infof("name: %s", name)
-	rawLogger.Infof("network: %s", network)
-	return func() {
-		rawLogger.Infof("::endgroup::")
-	}
-}
-
-// newContainer is a variable so tests can substitute a container that needs no Docker daemon.
-var newContainer = container.NewContainer
-
 func (rc *RunContext) startJobContainer() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		image := rc.platformImage(ctx)
-		rawLogger := logger.WithField(rawOutputField, true)
+		rawLogger := logger.WithField("raw_output", true)
 		logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
 			if rc.Config.LogOutput {
 				rawLogger.Infof("%s", s)
@@ -361,6 +278,7 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			return fmt.Errorf("failed to handle credentials: %s", err)
 		}
 
+		logger.Infof("\U0001f680  Start image=%s", image)
 		name := rc.jobContainerName()
 		// For gitea, to support --volumes-from <container_name_or_id> in options.
 		// We need to set the container name to the environment variable.
@@ -384,13 +302,6 @@ func (rc *RunContext) startJobContainer() common.Executor {
 
 		// add service containers
 		for serviceID, spec := range rc.Run.Job().Services {
-			// GitHub compatibility: skip services whose image evaluates to an
-			// empty string, enabling conditional services via expressions
-			serviceImage := rc.ExprEval.Interpolate(ctx, spec.Image)
-			if serviceImage == "" {
-				logger.Infof("The service '%s' will not be started because the container definition has an empty image.", serviceID)
-				continue
-			}
 			// interpolate env
 			interpolatedEnvs := make(map[string]string, len(spec.Env))
 			for k, v := range spec.Env {
@@ -405,9 +316,7 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			for _, v := range spec.Cmd {
 				interpolatedCmd = append(interpolatedCmd, rc.ExprEval.Interpolate(ctx, v))
 			}
-			// keep these local: reusing username/password would overwrite the
+			username, password, err = rc.handleServiceCredentials(ctx, spec.Credentials)
-			// credentials the job container is pulled with further down
-			serviceUsername, servicePassword, err := rc.handleServiceCredentials(ctx, spec.Credentials)
 			if err != nil {
 				return fmt.Errorf("failed to handle service %s credentials: %w", serviceID, err)
 			}
@@ -428,12 +337,12 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			}
 
 			serviceContainerName := createContainerName(rc.jobContainerName(), serviceID)
-			c := newContainer(&container.NewContainerInput{
+			c := container.NewContainer(&container.NewContainerInput{
 				Name:           serviceContainerName,
 				WorkingDir:     ext.ToContainerPath(rc.Config.Workdir),
-				Image:          serviceImage,
+				Image:          rc.ExprEval.Interpolate(ctx, spec.Image),
-				Username:       serviceUsername,
+				Username:       username,
-				Password:       servicePassword,
+				Password:       password,
 				Cmd:            interpolatedCmd,
 				Env:            envs,
 				Mounts:         serviceMounts,
@@ -449,7 +358,6 @@ func (rc *RunContext) startJobContainer() common.Executor {
 				NetworkAliases: []string{serviceID},
 				ExposedPorts:   exposedPorts,
 				PortBindings:   portBindings,
-				AllocatePTY:    rc.Config.AllocatePTY,
 			})
 			rc.ServiceContainers = append(rc.ServiceContainers, c)
 		}
@@ -489,7 +397,7 @@ func (rc *RunContext) startJobContainer() common.Executor {
 		// For Gitea, `jobContainerNetwork` should be the same as `networkName`
 		jobContainerNetwork := networkName
 
-		rc.JobContainer = newContainer(&container.NewContainerInput{
+		rc.JobContainer = container.NewContainer(&container.NewContainerInput{
 			Cmd:            nil,
 			Entrypoint:     []string{"/bin/sleep", fmt.Sprint(rc.Config.ContainerMaxLifetime.Round(time.Second).Seconds())},
 			WorkingDir:     ext.ToContainerPath(rc.Config.Workdir),
@@ -509,20 +417,17 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			Platform:       rc.Config.ContainerArchitecture,
 			Options:        rc.options(ctx),
 			AutoRemove:     rc.Config.AutoRemove,
-			ValidVolumes:   rc.validVolumes(),
+			ValidVolumes:   rc.Config.ValidVolumes,
-			AllocatePTY:    rc.Config.AllocatePTY,
 		})
 		if rc.JobContainer == nil {
 			return errors.New("Failed to create job container")
 		}
 
-		defer printStartJobContainerGroup(ctx, image, name, networkName)()
 		return common.NewPipelineExecutor(
 			rc.pullServicesImages(rc.Config.ForcePull),
 			rc.JobContainer.Pull(rc.Config.ForcePull),
 			rc.stopJobContainer(),
-			container.NewDockerNetworkCreateExecutor(networkName, rc.Config.ContainerNetworkCreateOptions).
+			container.NewDockerNetworkCreateExecutor(networkName).IfBool(createAndDeleteNetwork),
-				IfBool(createAndDeleteNetwork),
 			rc.startServiceContainers(networkName),
 			rc.JobContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
 			rc.JobContainer.Start(false),
@@ -664,29 +569,14 @@ func (rc *RunContext) ActionCacheDir() string {
 }
 
 // Interpolate outputs after a job is done
-// jobMutexes serializes per-job result/output aggregation across the matrix combinations that
-// share one *model.Job and run in parallel. Keyed by the shared *model.Job (mirrors the
-// per-directory AcquireCloneLock pattern).
-var jobMutexes sync.Map // key: *model.Job; value: *sync.Mutex
-
-func lockJob(job *model.Job) func() {
-	v, _ := jobMutexes.LoadOrStore(job, &sync.Mutex{})
-	mu := v.(*sync.Mutex)
-	mu.Lock()
-	return mu.Unlock
-}
-
 func (rc *RunContext) interpolateOutputs() common.Executor {
 	return func(ctx context.Context) error {
 		ee := rc.NewExpressionEvaluator(ctx)
-		job := rc.Run.Job()
+		for k, v := range rc.Run.Job().Outputs {
-		// Matrix combinations share this Job and its Outputs map. Interpolate from this combo's
+			interpolated := ee.Interpolate(ctx, v)
-		// pristine snapshot (outputTemplate) and write under the lock, so each combo overwrites
+			if v != interpolated {
-		// with its own resolved values (last wins, as on GitHub) instead of the first combo's
+				rc.Run.Job().Outputs[k] = interpolated
-		// resolved values freezing the shared template against later combos.
+			}
-		defer lockJob(job)()
-		for k, v := range rc.outputTemplate {
-			job.Outputs[k] = ee.Interpolate(ctx, v)
 		}
 		return nil
 	}
@@ -694,34 +584,10 @@ func (rc *RunContext) interpolateOutputs() common.Executor {
 
 func (rc *RunContext) startContainer() common.Executor {
 	return func(ctx context.Context) error {
-		var err error
 		if rc.IsHostEnv(ctx) {
-			err = rc.startHostEnvironment()(ctx)
+			return rc.startHostEnvironment()(ctx)
-		} else {
-			err = rc.startJobContainer()(ctx)
 		}
-		if err != nil {
+		return rc.startJobContainer()(ctx)
-			// The job executor's teardown only runs after a successful start, so a failed
-			// start would otherwise leak the per-job network and container.
-			rc.cleanupFailedStart(ctx)
-		}
-		return err
-	}
-}
-
-func (rc *RunContext) cleanupFailedStart(ctx context.Context) {
-	if rc.cleanUpJobContainer == nil {
-		return
-	}
-	cleanCtx := ctx
-	if ctx.Err() != nil {
-		// the start likely failed because ctx was cancelled, detach so teardown still runs
-		var cancel context.CancelFunc
-		cleanCtx, cancel = context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
-		defer cancel()
-	}
-	if err := rc.cleanUpJobContainer(cleanCtx); err != nil {
-		common.Logger(ctx).Errorf("Error while cleaning up after failed container start for job %s: %v", rc.JobName, err)
 	}
 }
 
@@ -753,29 +619,7 @@ func (rc *RunContext) result(result string) {
 }
 
 func (rc *RunContext) steps() []*model.Step {
-	// Return per-job copies of the steps. Matrix combinations run in parallel and share the
+	return rc.Run.Job().Steps
-	// workflow model, but step execution mutates per-job fields and evaluates the If/Env nodes
-	// in place, so the *model.Step instances must not be shared across jobs (see Step.Clone).
-	shared := rc.Run.Job().Steps
-	steps := make([]*model.Step, len(shared))
-	for i, step := range shared {
-		if step == nil {
-			continue
-		}
-		steps[i] = step.Clone()
-	}
-	return steps
-}
-
-// topLevelRunContext walks the Parent chain to the outermost RunContext. Composite
-// actions create child RunContexts whose sub-steps need to share the outer job step's
-// summary file path so that nested writes accumulate under the right step_index.
-func (rc *RunContext) topLevelRunContext() *RunContext {
-	top := rc
-	for top.Parent != nil {
-		top = top.Parent
-	}
-	return top
 }
 
 // Executor returns a pipeline executor for all the steps in the job
@@ -797,13 +641,7 @@ func (rc *RunContext) Executor() (common.Executor, error) {
 	return func(ctx context.Context) error {
 		res, err := rc.isEnabled(ctx)
 		if err != nil {
-			// Record the failure so a job whose if-expression fails to evaluate
+			rc.caller.setReusedWorkflowJobResult(rc.JobName, "failure") // For Gitea
-			// gets a result (and therefore a stop time) instead of being left
-			// unfinished. rc.caller is only set for reusable workflows.
-			rc.result("failure")
-			if rc.caller != nil { // For Gitea
-				rc.caller.setReusedWorkflowJobResult(rc.JobName, "failure")
-			}
 			return err
 		}
 		if res {
@@ -858,15 +696,12 @@ func (rc *RunContext) runsOnPlatformNames(ctx context.Context) []string {
 		return []string{}
 	}
 
-	// Evaluate a copy: RawRunsOn is shared across parallel matrix jobs, so interpolating it in
+	if err := rc.ExprEval.EvaluateYamlNode(ctx, &job.RawRunsOn); err != nil {
-	// place would race and leak one matrix combination's runs-on into the others.
-	rawRunsOn := model.CloneYamlNode(job.RawRunsOn)
-	if err := rc.ExprEval.EvaluateYamlNode(ctx, &rawRunsOn); err != nil {
 		common.Logger(ctx).Errorf("Error while evaluating runs-on: %v", err)
 		return []string{}
 	}
 
-	return model.RunsOnFromNode(rawRunsOn)
+	return job.RunsOn()
 }
 
 func (rc *RunContext) platformImage(ctx context.Context) string {
@@ -894,7 +729,7 @@ func (rc *RunContext) isEnabled(ctx context.Context) (bool, error) {
 	jobType, jobTypeErr := job.Type()
 
 	if runJobErr != nil {
-		return false, fmt.Errorf("if-expression %q evaluation failed: %s", job.If.Value, runJobErr)
+		return false, fmt.Errorf("  \u274C  Error in if-expression: \"if: %s\" (%s)", job.If.Value, runJobErr)
 	}
 
 	if jobType == model.JobTypeInvalid {
@@ -917,7 +752,7 @@ func (rc *RunContext) isEnabled(ctx context.Context) (bool, error) {
 	img := rc.platformImage(ctx)
 	if img == "" {
 		for _, platformName := range rc.runsOnPlatformNames(ctx) {
-			l.Infof("Skipping unsupported platform -- Try running with `-P %+v=...`", platformName)
+			l.Infof("\U0001F6A7  Skipping unsupported platform -- Try running with `-P %+v=...`", platformName)
 		}
 		return false, nil
 	}
@@ -957,21 +792,12 @@ func trimToLen(s string, l int) string {
 
 func (rc *RunContext) getJobContext() *model.JobContext {
 	jobStatus := "success"
-	if rc.jobFailed {
-		jobStatus = "failure"
-	}
 	for _, stepStatus := range rc.StepResults {
 		if stepStatus.Conclusion == model.StepStatusFailure {
 			jobStatus = "failure"
 			break
 		}
 	}
-	// A cancelled run takes precedence over success/failure so cancelled() is true and
-	// success()/failure() are false, matching GitHub Actions: on cancellation only
-	// always() and cancelled() steps run.
-	if rc.jobCancelled {
-		jobStatus = "cancelled"
-	}
 	return &model.JobContext{
 		Status: jobStatus,
 	}
@@ -1241,18 +1067,21 @@ func setActionRuntimeVars(rc *RunContext, env map[string]string) {
 }
 
 func (rc *RunContext) handleCredentials(ctx context.Context) (string, string, error) {
+	// TODO: remove below 2 lines when we can release act with breaking changes
+	username := rc.Config.Secrets["DOCKER_USERNAME"]
+	password := rc.Config.Secrets["DOCKER_PASSWORD"]
+
 	container := rc.Run.Job().Container()
 	if container == nil || container.Credentials == nil {
-		return "", "", nil
+		return username, password, nil
 	}
 
-	if len(container.Credentials) != 2 {
+	if container.Credentials != nil && len(container.Credentials) != 2 {
 		err := errors.New("invalid property count for key 'credentials:'")
 		return "", "", err
 	}
 
 	ee := rc.NewExpressionEvaluator(ctx)
-	var username, password string
 	if username = ee.Interpolate(ctx, container.Credentials["username"]); username == "" {
 		err := errors.New("failed to interpolate container.credentials.username")
 		return "", "", err
@@ -1295,9 +1124,12 @@ func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[st
 
 // GetServiceBindsAndMounts returns the binds and mounts for the service container, resolving paths as appopriate
 func (rc *RunContext) GetServiceBindsAndMounts(svcVolumes []string) ([]string, map[string]string) {
+	if rc.Config.ContainerDaemonSocket == "" {
+		rc.Config.ContainerDaemonSocket = "/var/run/docker.sock"
+	}
 	binds := []string{}
-	if daemonSocket := rc.containerDaemonSocket(); daemonSocket != "-" {
+	if rc.Config.ContainerDaemonSocket != "-" {
-		daemonPath := getDockerDaemonSocketMountPath(daemonSocket)
+		daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)
 		binds = append(binds, fmt.Sprintf("%s:%s", daemonPath, "/var/run/docker.sock"))
 	}
 

act/runner/run_context_test.go

@@ -5,7 +5,6 @@
 package runner
 
 import (
-	"bytes"
 	"context"
 	"fmt"
 	"os"
@@ -13,14 +12,11 @@ import (
 	"strings"
 	"testing"
 
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
 
 	log "github.com/sirupsen/logrus"
 	assert "github.com/stretchr/testify/assert"
-	require "github.com/stretchr/testify/require"
 	yaml "go.yaml.in/yaml/v4"
 )
 
@@ -171,125 +167,6 @@ func TestRunContext_EvalBool(t *testing.T) {
 	}
 }
 
-func TestRunContextHandleCredentialsDoesNotUseDockerSecrets(t *testing.T) {
-	workflow, err := model.ReadWorkflow(strings.NewReader(`
-name: test
-on: push
-jobs:
-  job:
-    runs-on: ubuntu-latest
-    steps: []
-`))
-	require.NoError(t, err)
-
-	rc := &RunContext{
-		Config: &Config{
-			Secrets: map[string]string{
-				"DOCKER_USERNAME": "docker-user",
-				"DOCKER_PASSWORD": "docker-password",
-			},
-			Env: map[string]string{},
-		},
-		Run: &model.Run{
-			JobID:    "job",
-			Workflow: workflow,
-		},
-	}
-
-	// DOCKER_USERNAME/DOCKER_PASSWORD secrets should not be used as implicit job container pull credentials.
-	username, password, err := rc.handleCredentials(t.Context())
-	require.NoError(t, err)
-	assert.Empty(t, username)
-	assert.Empty(t, password)
-}
-
-// fakeContainer turns every container operation into a no-op, so startJobContainer
-// runs without a Docker daemon. The embedded interface is nil, so any method the
-// test does not exercise panics rather than silently doing the wrong thing.
-type fakeContainer struct {
-	container.ExecutionsEnvironment
-}
-
-func (fakeContainer) Pull(bool) common.Executor  { return func(context.Context) error { return nil } }
-func (fakeContainer) Start(bool) common.Executor { return func(context.Context) error { return nil } }
-func (fakeContainer) Remove() common.Executor    { return func(context.Context) error { return nil } }
-func (fakeContainer) Close() common.Executor     { return func(context.Context) error { return nil } }
-func (fakeContainer) GetActPath() string         { return "/var/run/act" }
-func (fakeContainer) Create([]string, []string) common.Executor {
-	return func(context.Context) error { return nil }
-}
-
-func (fakeContainer) Copy(string, ...*container.FileEntry) common.Executor {
-	return func(context.Context) error { return nil }
-}
-
-// Regression test: a service without a `credentials:` block resolves to empty
-// credentials, which used to overwrite the job container's own credentials.
-func TestStartJobContainerKeepsJobCredentialsWithServices(t *testing.T) {
-	workflow, err := model.ReadWorkflow(strings.NewReader(`
-name: test
-on: push
-jobs:
-  job:
-    runs-on: ubuntu-latest
-    container:
-      image: registry.example/private:latest
-      credentials:
-        username: job-user
-        password: job-password
-    services:
-      redis:
-        image: redis:latest
-      db:
-        image: postgres:latest
-        credentials:
-          username: db-user
-          password: db-password
-    steps: []
-`))
-	require.NoError(t, err)
-
-	var inputs []*container.NewContainerInput
-	origNewContainer := newContainer
-	newContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-		inputs = append(inputs, input)
-		return fakeContainer{}
-	}
-	t.Cleanup(func() { newContainer = origNewContainer })
-
-	rc := &RunContext{
-		Name: "test",
-		Config: &Config{
-			Workdir: "/tmp",
-			// no daemon: an explicit network mode creates no network, and
-			// reusing containers short-circuits the volume cleanup executors
-			ContainerNetworkMode: "host",
-			ReuseContainers:      true,
-			Env:                  map[string]string{},
-			Secrets:              map[string]string{},
-		},
-		Env: map[string]string{},
-		Run: &model.Run{
-			JobID:    "job",
-			Workflow: workflow,
-		},
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(t.Context())
-
-	require.NoError(t, rc.startJobContainer()(t.Context()))
-
-	credentials := map[string][2]string{}
-	for _, in := range inputs {
-		credentials[in.Image] = [2]string{in.Username, in.Password}
-	}
-
-	// the job container keeps its own credentials, whichever services exist
-	require.Equal(t, [2]string{"job-user", "job-password"}, credentials["registry.example/private:latest"])
-	// each service keeps its own, and a service without credentials gets none
-	require.Equal(t, [2]string{"db-user", "db-password"}, credentials["postgres:latest"])
-	require.Equal(t, [2]string{"", ""}, credentials["redis:latest"])
-}
-
 func TestRunContext_GetBindsAndMounts(t *testing.T) {
 	rctemplate := &RunContext{
 		Name: "TestRCName",
@@ -364,37 +241,6 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 			{"MountExistingVolume", []string{"volume-id:/volume"}, "", map[string]string{"volume-id": "/volume"}},
 		}
 
-		t.Run("InterpolatedContainerVolumes", func(t *testing.T) {
-			job := &model.Job{}
-			err := job.RawContainer.Encode(map[string][]string{
-				"volumes": {"${{ secrets.MAME }}:/root/.mame/roms:ro"},
-			})
-			require.NoError(t, err)
-
-			rc := &RunContext{
-				Name: "TestRCName",
-				Run: &model.Run{
-					Workflow: &model.Workflow{
-						Name: "TestWorkflowName",
-					},
-				},
-				Config: &Config{
-					BindWorkdir: false,
-					Secrets: map[string]string{
-						"MAME": "/host/mame/roms",
-					},
-				},
-			}
-			rc.Run.JobID = "job1"
-			rc.Run.Workflow.Jobs = map[string]*model.Job{"job1": job}
-			rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
-
-			gotbind, gotmount := rc.GetBindsAndMounts()
-			assert.Contains(t, gotbind, "/host/mame/roms:/root/.mame/roms:ro")
-			assert.NotContains(t, gotbind, "${{ secrets.MAME }}")
-			assert.NotContains(t, gotmount, "${{ secrets.MAME }}")
-		})
-
 		for _, testcase := range tests {
 			t.Run(testcase.name, func(t *testing.T) {
 				job := &model.Job{}
@@ -432,44 +278,6 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 	})
 }
 
-func TestRunContextValidVolumes(t *testing.T) {
-	rc := &RunContext{
-		Name:   "job",
-		Run:    &model.Run{Workflow: &model.Workflow{Name: "wf"}},
-		Config: &Config{ValidVolumes: []string{"my-vol", "/host/path"}},
-	}
-	name := rc.jobContainerName()
-
-	got := rc.validVolumes()
-
-	// the configured volumes plus the four the runner mounts automatically
-	assert.Subset(t, got, []string{"my-vol", "/host/path", "act-toolcache", name, name + "-env", "/var/run/docker.sock"})
-
-	// deriving the list must never mutate or grow the shared Config slice: parallel matrix
-	// combinations share one *Config, and the previous in-place append was a data race.
-	assert.Equal(t, []string{"my-vol", "/host/path"}, rc.Config.ValidVolumes)
-	assert.Len(t, rc.validVolumes(), len(got), "repeated calls must be stable, not accumulate")
-}
-
-// TestInterpolateOutputsIsPerMatrixCombo guards the matrix-output fix: combinations share one
-// *model.Job, so each must interpolate from its own pristine snapshot. Otherwise the first
-// combo's resolved value freezes the shared template and later combos can't resolve their own.
-func TestInterpolateOutputsIsPerMatrixCombo(t *testing.T) {
-	job := &model.Job{Outputs: map[string]string{"o": "${{ matrix.v }}"}}
-	run := &model.Run{JobID: "j", Workflow: &model.Workflow{Name: "w", Jobs: map[string]*model.Job{"j": job}}}
-	r := &runnerImpl{config: &Config{}}
-	ctx := context.Background()
-
-	rcA := r.newRunContext(ctx, run, map[string]any{"v": "a"})
-	rcB := r.newRunContext(ctx, run, map[string]any{"v": "b"})
-
-	require.NoError(t, rcA.interpolateOutputs()(ctx))
-	require.NoError(t, rcB.interpolateOutputs()(ctx))
-
-	// Last combo wins (matching GitHub) instead of being frozen to combo A's "a".
-	require.Equal(t, "b", job.Outputs["o"])
-}
-
 func TestGetGitHubContext(t *testing.T) {
 	log.SetLevel(log.DebugLevel)
 
@@ -827,75 +635,3 @@ func TestCreateContainerNameBoundedForLongMatrixInput(t *testing.T) {
 	assert.LessOrEqual(t, len(name+"-network"), 255)
 	assert.LessOrEqual(t, len(name+"-job1234567890"), 255)
 }
-
-func TestPrintStartJobContainerGroupGolden(t *testing.T) {
-	buf := &bytes.Buffer{}
-	logger := log.New()
-	logger.SetOutput(buf)
-	logger.SetLevel(log.InfoLevel)
-	logger.SetFormatter(&jobLogFormatter{color: cyan})
-	entry := logger.WithFields(log.Fields{"job": "j1"})
-	ctx := common.WithLogger(context.Background(), entry)
-
-	printStartJobContainerGroup(ctx, "node:20", "GITEA-WORKFLOW-build-JOB-test", "gitea-runner-network")()
-
-	want := strings.Join([]string{
-		"[j1]   | ::group::Starting job container",
-		"[j1]   | image: node:20",
-		"[j1]   | name: GITEA-WORKFLOW-build-JOB-test",
-		"[j1]   | network: gitea-runner-network",
-		"[j1]   | ::endgroup::",
-		"",
-	}, "\n")
-	assert.Equal(t, want, buf.String())
-}
-
-func TestRunContext_cleanupFailedStart(t *testing.T) {
-	type ctxKey string
-	const sentinel = ctxKey("sentinel")
-
-	// the fresh context is cancelled via defer on return, so capture state inside the stub
-	type capture struct {
-		calls    int
-		err      error
-		sentinel any
-	}
-	newRC := func(c *capture) *RunContext {
-		return &RunContext{
-			JobName: "job",
-			cleanUpJobContainer: func(ctx context.Context) error {
-				c.calls++
-				c.err = ctx.Err()
-				c.sentinel = ctx.Value(sentinel)
-				return nil
-			},
-		}
-	}
-
-	t.Run("runs teardown on the live context", func(t *testing.T) {
-		var c capture
-		ctx := context.WithValue(context.Background(), sentinel, "v")
-
-		newRC(&c).cleanupFailedStart(ctx)
-
-		assert.Equal(t, 1, c.calls)
-		require.NoError(t, c.err)
-		assert.Equal(t, "v", c.sentinel)
-	})
-
-	t.Run("falls back to a fresh context when the input is done", func(t *testing.T) {
-		var c capture
-		ctx, cancel := context.WithCancel(context.WithValue(context.Background(), sentinel, "v"))
-		cancel()
-
-		newRC(&c).cleanupFailedStart(ctx)
-
-		assert.Equal(t, 1, c.calls)
-		require.NoError(t, c.err)
-		assert.Nil(t, c.sentinel)
-	})
-
-	t.Run("no-op when there is nothing to clean up", func(t *testing.T) {
-		assert.NotPanics(t, func() { (&RunContext{}).cleanupFailedStart(context.Background()) })
-	})
-}

act/runner/runner.go

@@ -8,17 +8,15 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"os"
 	"runtime"
 	"sync"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
-	docker_container "github.com/moby/moby/api/types/container"
+	docker_container "github.com/docker/docker/api/types/container"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -29,69 +27,58 @@ type Runner interface {
 
 // Config contains the config for a new runner
 type Config struct {
-	Actor                              string                                        // the user that triggered the event
+	Actor                              string                       // the user that triggered the event
-	Workdir                            string                                        // path to working directory
+	Workdir                            string                       // path to working directory
-	ActionCacheDir                     string                                        // path used for caching action contents
+	ActionCacheDir                     string                       // path used for caching action contents
-	ActionOfflineMode                  bool                                          // when offline, use cached action contents
+	ActionOfflineMode                  bool                         // when offline, use caching action contents
-	ActionCloneDepth                   int                                           // limit history when cloning an action repo; 0 clones every branch in full
+	BindWorkdir                        bool                         // bind the workdir to the job container
-	BindWorkdir                        bool                                          // bind the workdir to the job container
+	EventName                          string                       // name of event to run
-	EventName                          string                                        // name of event to run
+	EventPath                          string                       // path to JSON file to use for event.json in containers
-	EventPath                          string                                        // path to JSON file to use for event.json in containers
+	DefaultBranch                      string                       // name of the main branch for this repository
-	DefaultBranch                      string                                        // name of the main branch for this repository
+	ReuseContainers                    bool                         // reuse containers to maintain state
-	ReuseContainers                    bool                                          // reuse containers to maintain state
+	ForcePull                          bool                         // force pulling of the image, even if already present
-	ForcePull                          bool                                          // force pulling of the image, even if already present
+	ForceRebuild                       bool                         // force rebuilding local docker image action
-	ForceRebuild                       bool                                          // force rebuilding local docker image action
+	LogOutput                          bool                         // log the output from docker run
-	LogOutput                          bool                                          // log the output from docker run
+	JSONLogger                         bool                         // use json or text logger
-	JSONLogger                         bool                                          // use json or text logger
+	LogPrefixJobID                     bool                         // switches from the full job name to the job id
-	LogPrefixJobID                     bool                                          // switches from the full job name to the job id
+	Env                                map[string]string            // env for containers
-	Env                                map[string]string                             // env for containers
+	Inputs                             map[string]string            // manually passed action inputs
-	Inputs                             map[string]string                             // manually passed action inputs
+	Secrets                            map[string]string            // list of secrets
-	Secrets                            map[string]string                             // list of secrets
+	Vars                               map[string]string            // list of vars
-	Vars                               map[string]string                             // list of vars
+	Token                              string                       // GitHub token
-	Token                              string                                        // GitHub token
+	InsecureSecrets                    bool                         // switch hiding output when printing to terminal
-	InsecureSecrets                    bool                                          // switch hiding output when printing to terminal
+	Platforms                          map[string]string            // list of platforms
-	Platforms                          map[string]string                             // list of platforms
+	Privileged                         bool                         // use privileged mode
-	Privileged                         bool                                          // use privileged mode
+	UsernsMode                         string                       // user namespace to use
-	UsernsMode                         string                                        // user namespace to use
+	ContainerArchitecture              string                       // Desired OS/architecture platform for running containers
-	ContainerArchitecture              string                                        // Desired OS/architecture platform for running containers
+	ContainerDaemonSocket              string                       // Path to Docker daemon socket
-	ContainerDaemonSocket              string                                        // Path to Docker daemon socket
+	ContainerOptions                   string                       // Options for the job container
-	ContainerOptions                   string                                        // Options for the job container
+	UseGitIgnore                       bool                         // controls if paths in .gitignore should not be copied into container, default true
-	UseGitIgnore                       bool                                          // controls if paths in .gitignore should not be copied into container, default true
+	GitHubInstance                     string                       // GitHub instance to use, default "github.com"
-	GitHubInstance                     string                                        // GitHub instance to use, default "github.com"
+	ContainerCapAdd                    []string                     // list of kernel capabilities to add to the containers
-	ContainerCapAdd                    []string                                      // list of kernel capabilities to add to the containers
+	ContainerCapDrop                   []string                     // list of kernel capabilities to remove from the containers
-	ContainerCapDrop                   []string                                      // list of kernel capabilities to remove from the containers
+	AutoRemove                         bool                         // controls if the container is automatically removed upon workflow completion
-	AutoRemove                         bool                                          // controls if the container is automatically removed upon workflow completion
+	ArtifactServerPath                 string                       // the path where the artifact server stores uploads
-	ArtifactServerPath                 string                                        // the path where the artifact server stores uploads
+	ArtifactServerAddr                 string                       // the address the artifact server binds to
-	ArtifactServerAddr                 string                                        // the address the artifact server binds to
+	ArtifactServerPort                 string                       // the port the artifact server binds to
-	ArtifactServerPort                 string                                        // the port the artifact server binds to
+	NoSkipCheckout                     bool                         // do not skip actions/checkout
-	NoSkipCheckout                     bool                                          // do not skip actions/checkout
+	RemoteName                         string                       // remote name in local git repo config
-	DisableActEnv                      bool                                          // do not inject the ACT=true environment variable into jobs
+	ReplaceGheActionWithGithubCom      []string                     // Use actions from GitHub Enterprise instance to GitHub
-	RemoteName                         string                                        // remote name in local git repo config
+	ReplaceGheActionTokenWithGithubCom string                       // Token of private action repo on GitHub.
-	ReplaceGheActionWithGithubCom      []string                                      // Use actions from GitHub Enterprise instance to GitHub
+	Matrix                             map[string]map[string]bool   // Matrix config to run
-	ReplaceGheActionTokenWithGithubCom string                                        // Token of private action repo on GitHub.
+	ContainerNetworkMode               docker_container.NetworkMode // the network mode of job containers (the value of --network)
-	Matrix                             map[string]map[string]bool                    // Matrix config to run
+	ActionCache                        ActionCache                  // Use a custom ActionCache Implementation
-	ContainerNetworkMode               docker_container.NetworkMode                  // the network mode of job containers (the value of --network)
-	ContainerNetworkCreateOptions      container.NewDockerNetworkCreateExecutorInput // the default network create options
-	ActionCache                        ActionCache                                   // Use a custom ActionCache Implementation
 
-	PresetGitHubContext   *model.GithubContext // the preset github context, overrides some fields like DefaultBranch, Env, Secrets etc.
+	PresetGitHubContext   *model.GithubContext         // the preset github context, overrides some fields like DefaultBranch, Env, Secrets etc.
-	EventJSON             string               // the content of JSON file to use for event.json in containers, overrides EventPath
+	EventJSON             string                       // the content of JSON file to use for event.json in containers, overrides EventPath
-	ContainerNamePrefix   string               // the prefix of container name
+	ContainerNamePrefix   string                       // the prefix of container name
-	ContainerMaxLifetime  time.Duration        // the max lifetime of job containers
+	ContainerMaxLifetime  time.Duration                // the max lifetime of job containers
-	CleanWorkdir          bool                 // remove host executor workdir on teardown
+	DefaultActionInstance string                       // the default actions web site
-	DefaultActionInstance string               // the default actions web site
+	PlatformPicker        func(labels []string) string // platform picker, it will take precedence over Platforms if isn't nil
-	// DefaultActionInstanceIsSelfHosted reports whether DefaultActionInstance is this
+	JobLoggerLevel        *log.Level                   // the level of job logger
-	// self-hosted Gitea (DEFAULT_ACTIONS_URL=self). It gates token trust: only then may the
+	ValidVolumes          []string                     // only volumes (and bind mounts) in this slice can be mounted on the job container or service containers
-	// task token be attached to action clone URLs on DefaultActionInstance's host, which can
+	InsecureSkipTLS       bool                         // whether to skip verifying TLS certificate of the Gitea instance
-	// differ from GitHubInstance when the runner registered with a different hostname than
+	MaxParallel           int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
-	// AppURL. It is never set for github.com or a GithubMirror, so the token stays on-instance.
-	DefaultActionInstanceIsSelfHosted bool
-	PlatformPicker                    func(labels []string) string // platform picker, it will take precedence over Platforms if isn't nil
-	JobLoggerLevel                    *log.Level                   // the level of job logger
-	ValidVolumes                      []string                     // only volumes (and bind mounts) in this slice can be mounted on the job container or service containers
-	InsecureSkipTLS                   bool                         // whether to skip verifying TLS certificate of the Gitea instance
-	MaxParallel                       int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
-	AllocatePTY                       bool                         // allocate a pseudo-TTY for each step's process
 }
 
 // GetToken: Adapt to Gitea
@@ -103,17 +90,6 @@ func (c Config) GetToken() string {
 	return token
 }
 
-// DefaultActionURL returns the host used for implicit remote actions.
-func (c Config) DefaultActionURL() string {
-	if c.DefaultActionInstance != "" {
-		return c.DefaultActionInstance
-	}
-	if c.GitHubInstance != "" {
-		return c.GitHubInstance
-	}
-	return "github.com"
-}
-
 type caller struct {
 	runContext *RunContext
 
@@ -258,20 +234,10 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
 							return err
 						}
 
-						jobCtx := common.WithJobErrorContainer(WithJobLogger(ctx, rc.Run.JobID, jobName, rc.Config, &rc.Masks, matrix))
+						return executor(common.WithJobErrorContainer(WithJobLogger(ctx, rc.Run.JobID, jobName, rc.Config, &rc.Masks, matrix)))
-						jobCtx, cancelTimeout := applyJobTimeout(jobCtx, rc, job)
-						defer cancelTimeout()
-						return executor(jobCtx)
 					})
 				}
-				// Run all matrix combinations of this job, then drop its aggregation mutex: the
+				pipeline = append(pipeline, common.NewParallelExecutor(maxParallel, stageExecutor...))
-				// combos are the only users of it, so once they finish the jobMutexes entry can be
-				// released, keeping the map from growing unbounded over a long-lived runner.
-				stageParallel := common.NewParallelExecutor(maxParallel, stageExecutor...)
-				pipeline = append(pipeline, func(ctx context.Context) error {
-					defer jobMutexes.Delete(job)
-					return stageParallel(ctx)
-				})
 			}
 
 			// For pipeline execution:
@@ -316,7 +282,7 @@ func handleFailure(plan *model.Plan) common.Executor {
 	return func(ctx context.Context) error {
 		for _, stage := range plan.Stages {
 			for _, run := range stage.Runs {
-				if run.Job().Result == "failure" && !run.Job().ContinueOnError {
+				if run.Job().Result == "failure" {
 					return fmt.Errorf("Job '%s' failed", run.String())
 				}
 			}
@@ -355,11 +321,6 @@ func (runner *runnerImpl) newRunContext(ctx context.Context, run *model.Run, mat
 	}
 	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
 	rc.Name = rc.ExprEval.Interpolate(ctx, run.String())
-	// Snapshot the job's pristine output expressions now, before any matrix combo runs and
-	// rewrites the shared Job.Outputs (see interpolateOutputs).
-	if job := run.Job(); job != nil {
-		rc.outputTemplate = maps.Clone(job.Outputs)
-	}
 
 	return rc
 }

act/runner/runner_test.go

@@ -15,7 +15,6 @@ import (
 	"runtime"
 	"strings"
 	"testing"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/model"
@@ -27,7 +26,7 @@ import (
 )
 
 var (
-	baseImage = "node:24-bookworm-slim"
+	baseImage = "node:16-buster-slim"
 	platforms map[string]string
 	logLevel  = log.DebugLevel
 	workdir   = "testdata"
@@ -188,17 +187,13 @@ func (j *TestJobFileInfo) runTest(ctx context.Context, t *testing.T, cfg *Config
 		EventPath:             cfg.EventPath,
 		Platforms:             j.platforms,
 		ReuseContainers:       false,
-		ForceRebuild:          true,
 		Env:                   cfg.Env,
 		Secrets:               cfg.Secrets,
 		Inputs:                cfg.Inputs,
 		GitHubInstance:        "github.com",
-		DefaultActionInstance: cfg.DefaultActionInstance,
 		ContainerArchitecture: cfg.ContainerArchitecture,
-		ContainerMaxLifetime:  time.Hour,
 		Matrix:                cfg.Matrix,
 		ActionCache:           cfg.ActionCache,
-		ValidVolumes:          []string{"**"}, // allow workflow-declared volumes (e.g. container-volumes)
 	}
 
 	runner, err := New(runnerConfig)
@@ -226,14 +221,20 @@ type TestConfig struct {
 }
 
 func TestRunEvent(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	ctx := context.Background()
 
 	tables := []TestJobFileInfo{
 		// Shells
 		{workdir, "shells/defaults", "push", "", platforms, secrets},
+		// TODO: figure out why it fails
+		// {workdir, "shells/custom", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, }, // custom image with pwsh
+		{workdir, "shells/pwsh", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, secrets}, // custom image with pwsh
 		{workdir, "shells/bash", "push", "", platforms, secrets},
+		{workdir, "shells/python", "push", "", map[string]string{"ubuntu-latest": "node:16-buster"}, secrets}, // slim doesn't have python
 		{workdir, "shells/sh", "push", "", platforms, secrets},
 
 		// Local action
@@ -245,6 +246,11 @@ func TestRunEvent(t *testing.T) {
 		// Uses
 		{workdir, "uses-composite", "push", "", platforms, secrets},
 		{workdir, "uses-composite-with-error", "push", "Job 'failing-composite-action' failed", platforms, secrets},
+		{workdir, "uses-nested-composite", "push", "", platforms, secrets},
+		{workdir, "remote-action-composite-js-pre-with-defaults", "push", "", platforms, secrets},
+		{workdir, "remote-action-composite-action-ref", "push", "", platforms, secrets},
+		{workdir, "uses-workflow", "push", "", platforms, map[string]string{"secret": "keep_it_private"}},
+		{workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}},
 		{workdir, "uses-docker-url", "push", "", platforms, secrets},
 		{workdir, "act-composite-env-test", "push", "", platforms, secrets},
 
@@ -254,15 +260,21 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "evalmatrixneeds2", "push", "", platforms, secrets},
 		{workdir, "evalmatrix-merge-map", "push", "", platforms, secrets},
 		{workdir, "evalmatrix-merge-array", "push", "", platforms, secrets},
+		{workdir, "issue-1195", "push", "", platforms, secrets},
 
 		{workdir, "basic", "push", "", platforms, secrets},
 		{workdir, "fail", "push", "exit with `FAILURE`: 1", platforms, secrets},
+		{workdir, "runs-on", "push", "", platforms, secrets},
 		{workdir, "checkout", "push", "", platforms, secrets},
 		{workdir, "job-container", "push", "", platforms, secrets},
 		{workdir, "job-container-non-root", "push", "", platforms, secrets},
 		{workdir, "job-container-invalid-credentials", "push", "failed to handle credentials: failed to interpolate container.credentials.password", platforms, secrets},
 		{workdir, "container-hostname", "push", "", platforms, secrets},
+		{workdir, "remote-action-docker", "push", "", platforms, secrets},
+		{workdir, "remote-action-js", "push", "", platforms, secrets},
+		{workdir, "remote-action-js-node-user", "push", "", platforms, secrets}, // Test if this works with non root container
 		{workdir, "matrix", "push", "", platforms, secrets},
+		{workdir, "matrix-include-exclude", "push", "", platforms, secrets},
 		{workdir, "matrix-exitcode", "push", "Job 'test' failed", platforms, secrets},
 		{workdir, "commands", "push", "", platforms, secrets},
 		{workdir, "workdir", "push", "", platforms, secrets},
@@ -283,6 +295,7 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "job-status-check", "push", "job 'fail' failed", platforms, secrets},
 		{workdir, "if-expressions", "push", "Job 'mytest' failed", platforms, secrets},
 		{workdir, "actions-environment-and-context-tests", "push", "", platforms, secrets},
+		{workdir, "uses-action-with-pre-and-post-step", "push", "", platforms, secrets},
 		{workdir, "evalenv", "push", "", platforms, secrets},
 		{workdir, "docker-action-custom-path", "push", "", platforms, secrets},
 		{workdir, "GITHUB_ENV-use-in-env-ctx", "push", "", platforms, secrets},
@@ -293,6 +306,7 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "workflow_dispatch-scalar", "workflow_dispatch", "", platforms, secrets},
 		{workdir, "workflow_dispatch-scalar-composite-action", "workflow_dispatch", "", platforms, secrets},
 		{workdir, "job-needs-context-contains-result", "push", "", platforms, secrets},
+		{"../model/testdata", "strategy", "push", "", platforms, secrets}, // TODO: move all testdata into pkg so we can validate it with planner and runner
 		{"../model/testdata", "container-volumes", "push", "", platforms, secrets},
 		{workdir, "path-handling", "push", "", platforms, secrets},
 		{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
@@ -302,8 +316,8 @@ func TestRunEvent(t *testing.T) {
 
 		// services
 		{workdir, "services", "push", "", platforms, secrets},
+		{workdir, "services-host-network", "push", "", platforms, secrets},
 		{workdir, "services-with-container", "push", "", platforms, secrets},
-		{workdir, "services-empty-image", "push", "", platforms, secrets},
 
 		// local remote action overrides
 		{workdir, "local-remote-action-overrides", "push", "", platforms, secrets},
@@ -311,11 +325,6 @@ func TestRunEvent(t *testing.T) {
 
 	for _, table := range tables {
 		t.Run(table.workflowPath, func(t *testing.T) {
-			if table.workflowPath == "container-volumes" {
-				// host /proc bind mounts are Linux-Docker-only
-				requireLinuxDocker(t)
-			}
-
 			config := &Config{
 				Secrets: table.secrets,
 			}
@@ -347,12 +356,9 @@ func TestRunEvent(t *testing.T) {
 }
 
 func TestRunEventHostEnvironment(t *testing.T) {
-	// Runs steps directly on the host (the "-self-hosted" platform), so it needs the shells
+	if testing.Short() {
-	// and tools the workflows invoke. No network gate: every action these workflows reference
+		t.Skip("skipping integration test")
-	// is a local `./` fixture or the skipped actions/checkout, so the suite runs offline (same
+	}
-	// as TestRunEvent). Only the broadly-used interpreters are required up front; the pwsh- and
-	// nix-specific cases gate on their own tool below so a missing pwsh/nix skips just those.
-	requireHostTools(t, "bash", "node")
 
 	ctx := context.Background()
 
@@ -368,6 +374,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			{workdir, "shells/defaults", "push", "", platforms, secrets},
 			{workdir, "shells/pwsh", "push", "", platforms, secrets},
 			{workdir, "shells/bash", "push", "", platforms, secrets},
+			{workdir, "shells/python", "push", "", platforms, secrets},
 			{workdir, "shells/sh", "push", "", platforms, secrets},
 
 			// Local action
@@ -376,6 +383,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			// Uses
 			{workdir, "uses-composite", "push", "", platforms, secrets},
 			{workdir, "uses-composite-with-error", "push", "Job 'failing-composite-action' failed", platforms, secrets},
+			{workdir, "uses-nested-composite", "push", "", platforms, secrets},
 			{workdir, "act-composite-env-test", "push", "", platforms, secrets},
 
 			// Eval
@@ -384,10 +392,14 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			{workdir, "evalmatrixneeds2", "push", "", platforms, secrets},
 			{workdir, "evalmatrix-merge-map", "push", "", platforms, secrets},
 			{workdir, "evalmatrix-merge-array", "push", "", platforms, secrets},
+			{workdir, "issue-1195", "push", "", platforms, secrets},
 
 			{workdir, "fail", "push", "exit with `FAILURE`: 1", platforms, secrets},
+			{workdir, "runs-on", "push", "", platforms, secrets},
 			{workdir, "checkout", "push", "", platforms, secrets},
+			{workdir, "remote-action-js", "push", "", platforms, secrets},
 			{workdir, "matrix", "push", "", platforms, secrets},
+			{workdir, "matrix-include-exclude", "push", "", platforms, secrets},
 			{workdir, "commands", "push", "", platforms, secrets},
 			{workdir, "defaults-run", "push", "", platforms, secrets},
 			{workdir, "composite-fail-with-output", "push", "", platforms, secrets},
@@ -401,6 +413,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			{workdir, "steps-context/outcome", "push", "", platforms, secrets},
 			{workdir, "job-status-check", "push", "job 'fail' failed", platforms, secrets},
 			{workdir, "if-expressions", "push", "Job 'mytest' failed", platforms, secrets},
+			{workdir, "uses-action-with-pre-and-post-step", "push", "", platforms, secrets},
 			{workdir, "evalenv", "push", "", platforms, secrets},
 			{workdir, "ensure-post-steps", "push", "Job 'second-post-step-should-fail' failed", platforms, secrets},
 		}...)
@@ -433,26 +446,24 @@ func TestRunEventHostEnvironment(t *testing.T) {
 
 	for _, table := range tables {
 		t.Run(table.workflowPath, func(t *testing.T) {
-			switch table.workflowPath {
-			case "shells/pwsh":
-				requireHostTools(t, "pwsh")
-			case "nix-prepend-path":
-				requireHostTools(t, "nix")
-			}
 			table.runTest(ctx, t, &Config{})
 		})
 	}
 }
 
 func TestDryrunEvent(t *testing.T) {
-	// Dryrun plans without containers or network (shells and local actions only).
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
 	ctx := common.WithDryrun(context.Background(), true)
 
 	tables := []TestJobFileInfo{
 		// Shells
 		{workdir, "shells/defaults", "push", "", platforms, secrets},
-		{workdir, "shells/pwsh", "push", "", platforms, secrets},
+		{workdir, "shells/pwsh", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, secrets}, // custom image with pwsh
 		{workdir, "shells/bash", "push", "", platforms, secrets},
+		{workdir, "shells/python", "push", "", map[string]string{"ubuntu-latest": "node:16-buster"}, secrets}, // slim doesn't have python
 		{workdir, "shells/sh", "push", "", platforms, secrets},
 
 		// Local action
@@ -469,18 +480,10 @@ func TestDryrunEvent(t *testing.T) {
 	}
 }
 
-// TestReusableWorkflowCaller exercises the reusable-workflow caller path against a local
-// reusable workflow (typed inputs, secrets as both a map and `inherit`, and reading the called
-// workflow's outputs via `needs`).
-func TestReusableWorkflowCaller(t *testing.T) {
-	requireDocker(t)
-	table := TestJobFileInfo{workdir, "uses-workflow", "push", "", platforms, map[string]string{"secret": "keep_it_private"}}
-	table.runTest(context.Background(), t, &Config{Secrets: table.secrets})
-}
-
 func TestDockerActionForcePullForceRebuild(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
-	requireNetwork(t) // force-pulls a docker action image
+		t.Skip("skipping integration test")
+	}
 
 	ctx := context.Background()
 
@@ -501,6 +504,22 @@ func TestDockerActionForcePullForceRebuild(t *testing.T) {
 	}
 }
 
+func TestRunDifferentArchitecture(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: "basic",
+		eventName:    "push",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	tjfi.runTest(context.Background(), t, &Config{ContainerArchitecture: "linux/arm64"})
+}
+
 type maskJobLoggerFactory struct {
 	Output bytes.Buffer
 }
@@ -521,7 +540,9 @@ func TestMaskValues(t *testing.T) {
 		assert.False(t, strings.Contains(text, "composite secret")) //nolint:testifylint // pre-existing issue from nektos/act
 	}
 
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	log.SetLevel(log.DebugLevel)
 
@@ -542,7 +563,9 @@ func TestMaskValues(t *testing.T) {
 }
 
 func TestRunEventSecrets(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	workflowPath := "secrets"
 
 	tjfi := TestJobFileInfo{
@@ -562,13 +585,15 @@ func TestRunEventSecrets(t *testing.T) {
 }
 
 func TestRunWithService(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	log.SetLevel(log.DebugLevel)
 	ctx := context.Background()
 
 	platforms := map[string]string{
-		"ubuntu-latest": "node:24-bookworm-slim",
+		"ubuntu-latest": "node:12.20.1-buster-slim",
 	}
 
 	workflowPath := "services"
@@ -578,11 +603,10 @@ func TestRunWithService(t *testing.T) {
 	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
 
 	runnerConfig := &Config{
-		Workdir:              workdir,
+		Workdir:         workdir,
-		EventName:            eventName,
+		EventName:       eventName,
-		Platforms:            platforms,
+		Platforms:       platforms,
-		ReuseContainers:      false,
+		ReuseContainers: false,
-		ContainerMaxLifetime: time.Hour, // otherwise the job container is `sleep 0` and exits at once
 	}
 	runner, err := New(runnerConfig)
 	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
@@ -598,7 +622,9 @@ func TestRunWithService(t *testing.T) {
 }
 
 func TestRunActionInputs(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	workflowPath := "input-from-cli"
 
 	tjfi := TestJobFileInfo{
@@ -617,7 +643,9 @@ func TestRunActionInputs(t *testing.T) {
 }
 
 func TestRunEventPullRequest(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	workflowPath := "pull-request"
 
@@ -633,7 +661,9 @@ func TestRunEventPullRequest(t *testing.T) {
 }
 
 func TestRunMatrixWithUserDefinedInclusions(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	workflowPath := "matrix-with-user-inclusions"
 
 	tjfi := TestJobFileInfo{

act/runner/step.go

@@ -107,13 +107,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 		if strings.Contains(stepString, "::add-mask::") {
 			stepString = "add-mask command"
 		}
-		if stage == stepStageMain {
+		logger.Infof("\u2B50 Run %s %s", stage, stepString)
-			// Main steps print their own raw "Run <title>" header, so this line is redundant and
-			// only leaks into the "Set up job" section for the first step; keep it as a debug trace.
-			logger.Debugf("Run %s %s", stage, stepString)
-		} else {
-			logger.Infof("Run %s %s", stage, stepString)
-		}
 
 		// Prepare and clean Runner File Commands
 		actPath := rc.JobContainer.GetActPath()
@@ -130,12 +124,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 		envFileCommand := path.Join("workflow", "envs.txt")
 		(*step.getEnv())["GITHUB_ENV"] = path.Join(actPath, envFileCommand)
 
-		// Per-step summary file. Composite sub-steps share the outer job step's index
+		summaryFileCommand := path.Join("workflow", "SUMMARY.md")
-		// via the Parent chain so all writes from within a composite action accumulate
-		// in the same file and upload under the outer step_index.
-		topRC := rc.topLevelRunContext()
-		stepSummaryIndex := topRC.CurrentStepIndex
-		summaryFileCommand := path.Join("workflow", "step-summary-"+strconv.Itoa(stepSummaryIndex)+".md")
 		(*step.getEnv())["GITHUB_STEP_SUMMARY"] = path.Join(actPath, summaryFileCommand)
 
 		{
@@ -147,30 +136,29 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			(*step.getEnv())["GITEA_STEP_SUMMARY"] = (*step.getEnv())["GITHUB_STEP_SUMMARY"]
 		}
 
-		// Reset the per-phase file-command files. GITHUB_STEP_SUMMARY is intentionally
+		_ = rc.JobContainer.Copy(actPath, &container.FileEntry{
-		// excluded here and initialized below at most once per step so writes from later
+			Name: outputFileCommand,
-		// phases and from composite sub-steps accumulate instead of being truncated.
+			Mode: 0o666,
-		files := []*container.FileEntry{
+		}, &container.FileEntry{
-			{Name: outputFileCommand, Mode: 0o666},
+			Name: stateFileCommand,
-			{Name: stateFileCommand, Mode: 0o666},
+			Mode: 0o666,
-			{Name: pathFileCommand, Mode: 0o666},
+		}, &container.FileEntry{
-			{Name: envFileCommand, Mode: 0o666},
+			Name: pathFileCommand,
-		}
+			Mode: 0o666,
-		if topRC.summaryFileInitialized == nil {
+		}, &container.FileEntry{
-			topRC.summaryFileInitialized = map[int]bool{}
+			Name: envFileCommand,
-		}
+			Mode: 0o666,
-		if !topRC.summaryFileInitialized[stepSummaryIndex] {
+		}, &container.FileEntry{
-			files = append(files, &container.FileEntry{Name: summaryFileCommand, Mode: 0o666})
+			Name: summaryFileCommand,
-			topRC.summaryFileInitialized[stepSummaryIndex] = true
+			Mode: 0o666,
-		}
+		})(ctx)
-		_ = rc.JobContainer.Copy(actPath, files...)(ctx)
 
 		timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, rc.ExprEval, stepModel)
 		defer cancelTimeOut()
 		err = executor(timeoutctx)
 
 		if err == nil {
-			logger.WithField("stepResult", stepResult.Outcome).Infof("Success - %s %s", stage, stepString)
+			logger.WithField("stepResult", stepResult.Outcome).Infof("  \u2705  Success - %s %s", stage, stepString)
 		} else {
 			stepResult.Outcome = model.StepStatusFailure
 
@@ -181,7 +169,6 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			}
 
 			if continueOnError {
-				logger.Errorf("##[error]%v", err)
 				logger.Infof("Failed but continue next step")
 				err = nil
 				stepResult.Conclusion = model.StepStatusSuccess
@@ -189,9 +176,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 				stepResult.Conclusion = model.StepStatusFailure
 			}
 
-			// Infof: Errorf entries are promoted to the user log by the reporter,
+			logger.WithField("stepResult", stepResult.Outcome).Errorf("  \u274C  Failure - %s %s", stage, stepString)
-			// which would duplicate the ##[error] annotation emitted elsewhere.
-			logger.WithField("stepResult", stepResult.Outcome).Infof("Failure - %s %s", stage, stepString)
 		}
 		// Process Runner File Commands
 		orgerr := err
@@ -283,7 +268,7 @@ func isStepEnabled(ctx context.Context, expr string, step step, stage stepStage)
 
 	runStep, err := EvalBool(ctx, rc.NewStepExpressionEvaluator(ctx, step), expr, defaultStatusCheck)
 	if err != nil {
-		return false, fmt.Errorf("if-expression %q evaluation failed: %s", expr, err)
+		return false, fmt.Errorf("  \u274C  Error in if-expression: \"if: %s\" (%s)", expr, err)
 	}
 
 	return runStep, nil
@@ -299,7 +284,7 @@ func isContinueOnError(ctx context.Context, expr string, step step, _ stepStage)
 
 	continueOnError, err := EvalBool(ctx, rc.NewStepExpressionEvaluator(ctx, step), expr, exprparser.DefaultStatusCheckNone)
 	if err != nil {
-		return false, fmt.Errorf("continue-on-error expression %q evaluation failed: %s", expr, err)
+		return false, fmt.Errorf("  \u274C  Error in continue-on-error-expression: \"continue-on-error: %s\" (%s)", expr, err)
 	}
 
 	return continueOnError, nil

act/runner/step_action_remote.go

@@ -113,26 +113,13 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 		}
 
 		actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
-		defaultActionURL := sar.RunContext.Config.DefaultActionURL()
+		token := getGitCloneToken(sar.getRunContext().Config, sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance))
-		// For Gitea
-		// A composite RunContext nils Config.Secrets, so getGitCloneToken would yield an
-		// empty token and clone the action anonymously (401 against the authenticated
-		// instance). github.Token survives the composite config copy and matches the
-		// top-level token; keep the shouldCloneURLUseToken host gate to avoid leaking it.
-		cloneURL := sar.remoteAction.CloneURL(defaultActionURL)
-		token := ""
-		if shouldCloneURLUseToken(sar.RunContext.Config.GitHubInstance, sar.RunContext.Config.trustedActionInstance(), cloneURL) {
-			token = github.Token
-		}
 		gitClone := stepActionRemoteNewCloneExecutor(git.NewGitCloneExecutorInput{
-			URL:         cloneURL,
+			URL:         sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance),
 			Ref:         sar.remoteAction.Ref,
 			Dir:         actionDir,
 			Token:       token,
 			OfflineMode: sar.RunContext.Config.ActionOfflineMode,
-			Depth:       sar.RunContext.Config.ActionCloneDepth,
-			// printPrepareActions reports the download with its resolved commit.
-			Quiet: true,
 
 			InsecureSkipTLS: sar.cloneSkipTLS(), // For Gitea
 		})
@@ -148,13 +135,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 			}
 		}
 
-		// Best effort: the download report falls back to the ref alone when the commit is unknown.
-		if _, sha, err := git.FindGitRevision(ctx, actionDir); err != nil {
-			common.Logger(ctx).Debugf("unable to resolve the commit of %s: %v", sar.remoteAction.Reference(), err)
-		} else {
-			sar.resolvedSha = sha
-		}
-
 		remoteReader := func(ctx context.Context) actionYamlReader { //nolint:unparam // pre-existing issue from nektos/act
 			return func(filename string) (io.Reader, io.Closer, error) {
 				f, err := os.Open(filepath.Join(actionDir, sar.remoteAction.Path, filename))
@@ -165,7 +145,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 		return common.NewPipelineExecutor(
 			ntErr,
 			func(ctx context.Context) error {
-				defer git.AcquireCloneLock(actionDir)()
 				actionModel, err := sar.readAction(ctx, sar.Step, actionDir, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)
 				sar.action = actionModel
 				return err
@@ -174,15 +153,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 	}
 }
 
-// actionDownloadInfo reports the action this step downloaded and the commit it resolved to. ok is
-// false when nothing was fetched, as for the local checkout of the workflow's own repository.
-func (sar *stepActionRemote) actionDownloadInfo() (reference, sha string, ok bool) {
-	if sar.remoteAction == nil || sar.action == nil {
-		return "", "", false
-	}
-	return sar.remoteAction.Reference(), sar.resolvedSha, true
-}
-
 func (sar *stepActionRemote) pre() common.Executor {
 	sar.env = map[string]string{}
 
@@ -303,7 +273,7 @@ func (sar *stepActionRemote) cloneSkipTLS() bool {
 	if sar.remoteAction.URL == "" {
 		// Empty URL means the default action instance should be used
 		// Return true if the URL of the Gitea instance is the same as the URL of the default action instance
-		return sar.RunContext.Config.DefaultActionURL() == sar.RunContext.Config.GitHubInstance
+		return sar.RunContext.Config.DefaultActionInstance == sar.RunContext.Config.GitHubInstance
 	}
 	// Return true if the URL of the remote action is the same as the URL of the Gitea instance
 	return sar.remoteAction.URL == sar.RunContext.Config.GitHubInstance
@@ -319,9 +289,7 @@ type remoteAction struct {
 
 func (ra *remoteAction) CloneURL(u string) string {
 	if ra.URL == "" {
-		// keep an absolute local path as-is (used by tests to resolve actions from a local
+		if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") {
-		// repo); only bare host names get the https:// scheme prepended
-		if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") && !filepath.IsAbs(u) {
 			u = "https://" + u
 		}
 	} else {
@@ -331,16 +299,6 @@ func (ra *remoteAction) CloneURL(u string) string {
 	return fmt.Sprintf("%s/%s/%s", u, ra.Org, ra.Repo)
 }
 
-// Reference renders the action as {org}/{repo}[/path]@{ref}, omitting the download source, which
-// can be interpolated from a secret.
-func (ra *remoteAction) Reference() string {
-	repo := fmt.Sprintf("%s/%s", ra.Org, ra.Repo)
-	if ra.Path != "" {
-		repo = fmt.Sprintf("%s/%s", repo, ra.Path)
-	}
-	return fmt.Sprintf("%s@%s", repo, ra.Ref)
-}
-
 func (ra *remoteAction) IsCheckout() bool {
 	if ra.Org == "actions" && ra.Repo == "checkout" {
 		return true
@@ -350,7 +308,7 @@ func (ra *remoteAction) IsCheckout() bool {
 
 func newRemoteAction(action string) *remoteAction {
 	// support http(s)://host/owner/repo@v3
-	for _, schema := range []string{"https://", "http://", "ssh://"} {
+	for _, schema := range []string{"https://", "http://"} {
 		if after, ok := strings.CutPrefix(action, schema); ok {
 			splits := strings.SplitN(after, "/", 2)
 			if len(splits) != 2 {

act/runner/step_action_remote_test.go

@@ -10,9 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -23,7 +20,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -438,57 +434,6 @@ func TestStepActionRemotePreThroughActionToken(t *testing.T) {
 	}
 }
 
-func TestStepActionRemoteUsesGitHubInstanceWhenDefaultActionInstanceEmpty(t *testing.T) {
-	ctx := context.Background()
-
-	var actualURL string
-	sarm := &stepActionRemoteMocks{}
-
-	origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-	stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-		return func(ctx context.Context) error {
-			actualURL = input.URL
-			return nil
-		}
-	}
-	defer func() {
-		stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-	}()
-
-	sar := &stepActionRemote{
-		Step: &model.Step{
-			Uses: "actions/setup-go@v4",
-		},
-		RunContext: &RunContext{
-			Config: &Config{
-				GitHubInstance:        "gitea.example",
-				DefaultActionInstance: "",
-				ActionCacheDir:        t.TempDir(),
-			},
-			Run: &model.Run{
-				JobID: "1",
-				Workflow: &model.Workflow{
-					Jobs: map[string]*model.Job{
-						"1": {},
-					},
-				},
-			},
-		},
-		readAction: sarm.readAction,
-	}
-
-	suffixMatcher := func(suffix string) any {
-		return mock.MatchedBy(func(actionDir string) bool {
-			return strings.HasSuffix(actionDir, suffix)
-		})
-	}
-	sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-	require.NoError(t, sar.prepareActionExecutor()(ctx))
-	assert.Equal(t, "https://gitea.example/actions/setup-go", actualURL)
-	sarm.AssertExpectations(t)
-}
-
 func TestStepActionRemotePost(t *testing.T) {
 	table := []struct {
 		name               string
@@ -781,32 +726,6 @@ func Test_newRemoteAction(t *testing.T) {
 			},
 			wantCloneURL: "http://gitea.com/actions/aws",
 		},
-		{
-			action: "ssh://git@gitea.com/actions/heroku@main", // it's invalid for GitHub, but gitea supports it
-			want: &remoteAction{
-				URL:  "ssh://git@gitea.com",
-				Org:  "actions",
-				Repo: "heroku",
-				Path: "",
-				Ref:  "main",
-			},
-			wantCloneURL: "ssh://git@gitea.com/actions/heroku",
-		},
-		{
-			action: "ssh://git@gitea.com/actions/aws/ec2@main", // the ssh user is kept as part of the host segment
-			want: &remoteAction{
-				URL:  "ssh://git@gitea.com",
-				Org:  "actions",
-				Repo: "aws",
-				Path: "ec2",
-				Ref:  "main",
-			},
-			wantCloneURL: "ssh://git@gitea.com/actions/aws",
-		},
-		{
-			action: "ssh://gitea.com/onlyonesegment@main", // missing org/repo after the host
-			want:   nil,
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.action, func(t *testing.T) {
@@ -821,97 +740,6 @@ func Test_newRemoteAction(t *testing.T) {
 	}
 }
 
-func Test_remoteActionReference(t *testing.T) {
-	tests := []struct {
-		uses string
-		want string
-	}{
-		{uses: "actions/checkout@v7", want: "actions/checkout@v7"},
-		{uses: "actions/aws/ec2@main", want: "actions/aws/ec2@main"},
-		// The download source can be interpolated from a secret and must stay out of the log.
-		{uses: "https://gitea.example.com/actions/checkout@v7", want: "actions/checkout@v7"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.uses, func(t *testing.T) {
-			assert.Equal(t, tt.want, newRemoteAction(tt.uses).Reference())
-		})
-	}
-}
-
-// TestStepActionRemotePreResolvesDownloadedCommit runs the real download path against a local
-// git repository standing in for the actions instance, so the reported commit is the one the
-// clone actually checked out.
-func TestStepActionRemotePreResolvesDownloadedCommit(t *testing.T) {
-	instance := t.TempDir()
-	actionDir := filepath.Join(instance, "actions", "setup-go")
-	require.NoError(t, os.MkdirAll(actionDir, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(actionDir, "action.yml"),
-		[]byte("name: setup-go\nruns:\n  using: node20\n  main: index.js\n"), 0o600))
-
-	// Supply an identity on the commit so the test does not depend on a
-	// git identity being configured in the environment; a CI runner without
-	// user.name/user.email would otherwise fail "commit" with exit code 128.
-	for _, args := range [][]string{
-		{"init", "--initial-branch=main", actionDir},
-		{"-C", actionDir, "add", "action.yml"},
-		{"-C", actionDir, "-c", "user.name=runner", "-c", "user.email=runner@example.com", "-c", "commit.gpgsign=false", "commit", "-m", "action"},
-	} {
-		cmd := exec.Command("git", args...)
-		require.NoError(t, cmd.Run(), "git %v", args)
-	}
-	out, err := exec.Command("git", "-C", actionDir, "rev-parse", "HEAD").Output()
-	require.NoError(t, err)
-	wantSha := strings.TrimSpace(string(out))
-
-	sar := &stepActionRemote{
-		Step: &model.Step{Uses: "actions/setup-go@main"},
-		RunContext: &RunContext{
-			Config: &Config{
-				GitHubInstance:        "https://gitea.example.com",
-				DefaultActionInstance: instance,
-				ActionCacheDir:        t.TempDir(),
-			},
-			Run: &model.Run{
-				JobID:    "1",
-				Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}},
-			},
-		},
-		readAction: readActionImpl,
-	}
-
-	require.NoError(t, sar.prepareActionExecutor()(context.Background()))
-
-	reference, sha, ok := sar.actionDownloadInfo()
-	assert.True(t, ok)
-	assert.Equal(t, "actions/setup-go@main", reference)
-	assert.Equal(t, wantSha, sha)
-}
-
-func TestStepActionRemoteActionDownloadInfo(t *testing.T) {
-	t.Run("reports the action and its resolved commit", func(t *testing.T) {
-		sar := &stepActionRemote{
-			remoteAction: newRemoteAction("actions/checkout@v7"),
-			action:       &model.Action{},
-			resolvedSha:  "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
-		}
-
-		reference, sha, ok := sar.actionDownloadInfo()
-
-		assert.True(t, ok)
-		assert.Equal(t, "actions/checkout@v7", reference)
-		assert.Equal(t, "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", sha)
-	})
-
-	t.Run("reports nothing when no action was downloaded", func(t *testing.T) {
-		// The local checkout of the workflow's own repository resolves no action.
-		sar := &stepActionRemote{remoteAction: newRemoteAction("actions/checkout@v7")}
-
-		_, _, ok := sar.actionDownloadInfo()
-
-		assert.False(t, ok)
-	})
-}
-
 func Test_safeFilename(t *testing.T) {
 	tests := []struct {
 		s    string
@@ -932,83 +760,3 @@ func Test_safeFilename(t *testing.T) {
 		})
 	}
 }
-
-// Regression: a nested action in a composite cloned anonymously (401) because the
-// composite RunContext nils Config.Secrets. The token must come from github.Token,
-// which survives the config copy; the host gate must still withhold it cross-host.
-func TestStepActionRemoteCloneTokenSurvivesNilSecrets(t *testing.T) {
-	const wantToken = "job-token"
-
-	table := []struct {
-		name                  string
-		gitHubInstance        string
-		defaultActionInstance string
-		wantCloneToken        string
-	}{
-		{
-			name:           "same host forwards token despite nil secrets",
-			gitHubInstance: "gitea.example.com",
-			wantCloneToken: wantToken,
-		},
-		{
-			name:                  "foreign host is not given the token",
-			gitHubInstance:        "gitea.example.com",
-			defaultActionInstance: "github.com",
-			wantCloneToken:        "",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			var capturedToken string
-			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-				capturedToken = input.Token
-				return func(ctx context.Context) error { return nil }
-			}
-			defer (func() {
-				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-			})()
-
-			sarm := &stepActionRemoteMocks{}
-			sar := &stepActionRemote{
-				Step: &model.Step{Uses: "org/repo@v1"},
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance:        tt.gitHubInstance,
-						DefaultActionInstance: tt.defaultActionInstance,
-						ActionCacheDir:        "/tmp/test-cache",
-						// Mirrors the state of a composite RunContext: job secrets are
-						// stripped, but the job token is still reachable via Config.Token.
-						Secrets: nil,
-						Token:   wantToken,
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{"1": {}},
-						},
-					},
-					StepResults: map[string]*model.StepResult{},
-				},
-				readAction: sarm.readAction,
-			}
-			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
-
-			suffixMatcher := func(suffix string) any {
-				return mock.MatchedBy(func(actionDir string) bool {
-					return strings.HasSuffix(actionDir, suffix)
-				})
-			}
-			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-			err := sar.prepareActionExecutor()(ctx)
-			require.NoError(t, err)
-			assert.Equal(t, tt.wantCloneToken, capturedToken)
-
-			sarm.AssertExpectations(t)
-		})
-	}
-}

act/runner/step_docker.go

@@ -85,7 +85,7 @@ func (sd *stepDocker) runUsesContainer() common.Executor {
 			stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
 			stepContainer.Start(true),
 		).Finally(
-			stepContainer.Remove().IfBool(!rc.Config.ReuseContainers && !rc.Config.AutoRemove),
+			stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
 		).Finally(stepContainer.Close())(ctx)
 	}
 }
@@ -125,6 +125,8 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e
 		Entrypoint:   entrypoint,
 		WorkingDir:   rc.JobContainer.ToContainerPath(rc.Config.Workdir),
 		Image:        image,
+		Username:     rc.Config.Secrets["DOCKER_USERNAME"],
+		Password:     rc.Config.Secrets["DOCKER_PASSWORD"],
 		Name:         createContainerName(rc.jobContainerName(), "STEP-"+step.ID),
 		Env:          envList,
 		Mounts:       mounts,
@@ -136,8 +138,7 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e
 		UsernsMode:   rc.Config.UsernsMode,
 		Platform:     rc.Config.ContainerArchitecture,
 		AutoRemove:   rc.Config.AutoRemove,
-		ValidVolumes: rc.validVolumes(),
+		ValidVolumes: rc.Config.ValidVolumes,
-		AllocatePTY:  rc.Config.AllocatePTY,
 	})
 	return stepContainer
 }

act/runner/step_docker_test.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 )
 
 func TestStepDockerMain(t *testing.T) {
@@ -39,12 +38,7 @@ func TestStepDockerMain(t *testing.T) {
 	sd := &stepDocker{
 		RunContext: &RunContext{
 			StepResults: map[string]*model.StepResult{},
-			Config: &Config{
+			Config:      &Config{},
-				Secrets: map[string]string{
-					"DOCKER_USERNAME": "docker-user",
-					"DOCKER_PASSWORD": "docker-password",
-				},
-			},
 			Run: &model.Run{
 				JobID: "1",
 				Workflow: &model.Workflow{
@@ -112,99 +106,9 @@ func TestStepDockerMain(t *testing.T) {
 
 	assert.Equal(t, "node:14", input.Image)
 
-	// DOCKER_USERNAME/DOCKER_PASSWORD secrets should not be used as implicit pull credentials for docker:// action containers.
-	assert.Empty(t, input.Username)
-	assert.Empty(t, input.Password)
-
 	cm.AssertExpectations(t)
 }
 
-// With AutoRemove the daemon reaps the container on exit, so act must not remove it afterwards.
-func TestStepDockerAutoRemove(t *testing.T) {
-	orig := ContainerNewContainer
-	defer func() { ContainerNewContainer = orig }()
-
-	for _, tc := range []struct {
-		autoRemove bool
-		removes    int
-	}{
-		{false, 2}, // stale + post-run
-		{true, 1},  // post-run skipped
-	} {
-		cm := &containerMock{}
-		ContainerNewContainer = func(*container.NewContainerInput) container.ExecutionsEnvironment { return cm }
-
-		sd := &stepDocker{
-			RunContext: &RunContext{
-				Config:       &Config{AutoRemove: tc.autoRemove},
-				Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
-				JobContainer: cm,
-			},
-			Step: &model.Step{ID: "1", Uses: "docker://node:14"},
-		}
-
-		removes := 0
-		cm.On("Pull", false).Return(func(context.Context) error { return nil })
-		cm.On("Remove").Return(func(context.Context) error { removes++; return nil })
-		cm.On("Create", []string(nil), []string(nil)).Return(func(context.Context) error { return nil })
-		cm.On("Start", true).Return(func(context.Context) error { return nil })
-		cm.On("Close").Return(func(context.Context) error { return nil })
-
-		require.NoError(t, sd.runUsesContainer()(context.Background()))
-		cm.AssertExpectations(t)
-		assert.Equal(t, tc.removes, removes)
-	}
-}
-
-func TestStepDockerNewStepContainerAllocatePTY(t *testing.T) {
-	for _, tc := range []struct {
-		name     string
-		allocPTY bool
-	}{
-		{name: "off", allocPTY: false},
-		{name: "on", allocPTY: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cm := &containerMock{}
-
-			var captured *container.NewContainerInput
-			origContainerNewContainer := ContainerNewContainer
-			ContainerNewContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-				captured = input
-				return cm
-			}
-			defer func() {
-				ContainerNewContainer = origContainerNewContainer
-			}()
-
-			ctx := context.Background()
-			sd := &stepDocker{
-				RunContext: &RunContext{
-					StepResults: map[string]*model.StepResult{},
-					Config: &Config{
-						AllocatePTY: tc.allocPTY,
-						PlatformPicker: func(_ []string) string {
-							return "node:14"
-						},
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{"1": {}},
-						},
-					},
-					JobContainer: cm,
-				},
-				Step: &model.Step{ID: "1", Uses: "docker://node:14"},
-			}
-			sd.RunContext.ExprEval = sd.RunContext.NewExpressionEvaluator(ctx)
-
-			_ = sd.newStepContainer(ctx, "node:14", []string{"echo", "hi"}, nil)
-			assert.Equal(t, tc.allocPTY, captured.AllocatePTY)
-		})
-	}
-}
-
 func TestStepDockerPrePost(t *testing.T) {
 	ctx := context.Background()
 	sd := &stepDocker{}

act/runner/testdata/.github/workflows/local-reusable-workflow.yml

@@ -1,34 +0,0 @@
-name: local-reusable-workflow
-on:
-  workflow_call:
-    inputs:
-      string_required:
-        required: true
-        type: string
-      bool_required:
-        required: true
-        type: boolean
-      number_required:
-        required: true
-        type: number
-    secrets:
-      secret:
-        required: true
-    outputs:
-      output:
-        value: ${{ jobs.reusable.outputs.output }}
-
-jobs:
-  reusable:
-    runs-on: ubuntu-latest
-    outputs:
-      output: ${{ steps.gen.outputs.output }}
-    steps:
-      - name: check inputs and secret arrived
-        run: |
-          [ "${{ inputs.string_required }}" = "string" ]
-          [ "${{ inputs.bool_required }}" = "true" ]
-          [ "${{ inputs.number_required }}" = "1" ]
-          [ "${{ secrets.secret }}" = "keep_it_private" ]
-      - id: gen
-        run: echo "output=${{ inputs.string_required }}" >> $GITHUB_OUTPUT

act/runner/testdata/GITHUB_ENV-use-in-env-ctx/push.yml

@@ -5,11 +5,10 @@ jobs:
     env:
       MYGLOBALENV3: myglobalval3
     steps:
-    - uses: actions/checkout@v4
     - run: |
         echo MYGLOBALENV1=myglobalval1 > $GITHUB_ENV
         echo "::set-env name=MYGLOBALENV2::myglobalval2"
-    - uses: ./actions/script
+    - uses: nektos/act-test-actions/script@main
       with:
         main: |
           env

act/runner/testdata/GITHUB_STATE/push.yml

@@ -1,31 +1,48 @@
 on: push
 jobs:
-  # State saved in main (via the $GITHUB_STATE file and the ::save-state command) must surface
-  # as $STATE_* in the action's post step.
   _:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: nektos/act-test-actions/script@main
-    - uses: ./actions/script
       with:
+        pre: |
+          env
+          echo mystate0=mystateval > $GITHUB_STATE
+          echo "::save-state name=mystate1::mystateval"
         main: |
+          env
           echo mystate2=mystateval > $GITHUB_STATE
           echo "::save-state name=mystate3::mystateval"
         post: |
+          env
+          [ "$STATE_mystate0" = "mystateval" ]
+          [ "$STATE_mystate1" = "mystateval" ]
           [ "$STATE_mystate2" = "mystateval" ]
           [ "$STATE_mystate3" = "mystateval" ]
-  # State must be isolated per action instance even when two steps use the same action.
   test-id-collision-bug:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: nektos/act-test-actions/script@main
-    - uses: ./actions/script
       id: script
       with:
-        main: echo mystate=val1 > $GITHUB_STATE
+        pre: |
-        post: '[ "$STATE_mystate" = "val1" ]'
+          env
-    - uses: ./actions/script
+          echo mystate0=mystateval > $GITHUB_STATE
+          echo "::save-state name=mystate1::mystateval"
+        main: |
+          env
+          echo mystate2=mystateval > $GITHUB_STATE
+          echo "::save-state name=mystate3::mystateval"
+        post: |
+          env
+          [ "$STATE_mystate0" = "mystateval" ]
+          [ "$STATE_mystate1" = "mystateval" ]
+          [ "$STATE_mystate2" = "mystateval" ]
+          [ "$STATE_mystate3" = "mystateval" ]
+    - uses: nektos/act-test-actions/script@main
       id: pre-script
       with:
-        main: echo mystate=val2 > $GITHUB_STATE
+        main: |
-        post: '[ "$STATE_mystate" = "val2" ]'
+          env
+          echo mystate0=mystateerror > $GITHUB_STATE
+          echo "::save-state name=mystate1::mystateerror"

act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24
+FROM alpine:3
 
 COPY entrypoint.sh /entrypoint.sh
 

act/runner/testdata/actions-environment-and-context-tests/js/action.yml

@@ -1,5 +1,5 @@
 name: 'Test'
 description: 'Test'
 runs:
-  using: 'node24'
+  using: 'node12'
   main: 'index.js'

act/runner/testdata/actions-environment-and-context-tests/push.yml

@@ -9,3 +9,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: './actions-environment-and-context-tests/js'
       - uses: './actions-environment-and-context-tests/docker'
+      - uses: 'nektos/act-test-actions/js@main'
+      - uses: 'nektos/act-test-actions/docker@main'
+      - uses: 'nektos/act-test-actions/docker-file@main'
+      - uses: 'nektos/act-test-actions/docker-relative-context/action@main'

act/runner/testdata/actions/action1/Dockerfile

@@ -1 +1 @@
-FROM ubuntu:24.04
+FROM ubuntu:18.04