Merge branch 'main' into renovate/github.com-docker-go-connections-0.x

.gitea/workflows/pull-pr-title.yml

@@ -1,27 +0,0 @@
-name: pr-title
-
-on:
-  pull_request:
-    types:
-    - opened
-    - edited
-    - reopened
-    - synchronize
-    - ready_for_review
-
-permissions:
-  contents: read
-
-jobs:
-  lint-pr-title:
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-      with:
-        node-version: 24
-    - run: make lint-pr-title
-      env:
-        PR_TITLE: ${{ github.event.pull_request.title }}

.gitea/workflows/release-nightly.yml

@@ -17,26 +17,14 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      # Custom publishers (the R2 mirror below) run as the very last
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release --nightly
@@ -47,10 +35,6 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: "gitea"
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -59,33 +43,27 @@ jobs:
     strategy:
       matrix:
         variant:
-          # The basic image is built from source and can target any arch the
-          # toolchain supports. The dind variants are limited to the arches the
-          # docker:dind base image publishes.
           - target: basic
             tag_suffix: ""
-            platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
           - target: dind
             tag_suffix: "-dind"
-            platforms: linux/amd64,linux/arm64
           - target: dind-rootless
             tag_suffix: "-dind-rootless"
-            platforms: linux/amd64,linux/arm64
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -93,20 +71,15 @@ jobs:
       - name: Echo the tag
         run: echo "${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}"
 
-      - name: Get Meta
-        id: meta
-        run: |
-          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT
-
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           target: ${{ matrix.variant.target }}
-          platforms: ${{ matrix.variant.platforms }}
+          platforms: |
+            linux/amd64
+            linux/arm64
           push: true
           tags: |
             ${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}
-          build-args: |
-            VERSION=${{ steps.meta.outputs.REPO_VERSION }}

.gitea/workflows/release-tag.yml

@@ -9,33 +9,21 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
-      # Custom publishers (the R2 mirror below) run as the very last
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
       - name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
+        uses: crazy-max/ghaction-import-gpg@v7
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           args: release
@@ -46,10 +34,6 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: "gitea"
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
@@ -58,18 +42,12 @@ jobs:
     strategy:
       matrix:
         variant:
-          # The basic image is built from source and can target any arch the
-          # toolchain supports. The dind variants are limited to the arches the
-          # docker:dind base image publishes.
           - target: basic
             tag_suffix: ""
-            platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
           - target: dind
             tag_suffix: "-dind"
-            platforms: linux/amd64,linux/arm64
           - target: dind-rootless
             tag_suffix: "-dind-rootless"
-            platforms: linux/amd64,linux/arm64
     container:
       image: catthehacker/ubuntu:act-latest
     env:
@@ -77,25 +55,25 @@ jobs:
       DOCKER_LATEST: latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: "Docker meta"
         id: docker_meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+        uses: https://github.com/docker/metadata-action@v5
         with:
           images: |
             ${{ env.DOCKER_ORG }}/runner
@@ -108,13 +86,13 @@ jobs:
             suffix=${{ matrix.variant.tag_suffix }},onlatest=true
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           target: ${{ matrix.variant.target }}
-          platforms: ${{ matrix.variant.platforms }}
+          platforms: |
+            linux/amd64
+            linux/arm64
           push: true
           tags: ${{ steps.docker_meta.outputs.tags }}
-          build-args: |
-            VERSION=${{ steps.docker_meta.outputs.version }}

.gitea/workflows/test.yml

@@ -9,40 +9,14 @@ jobs:
   lint:
     name: check and test
     runs-on: ubuntu-latest
-    env:
-      # The runner image ships a stale docker.io login; point docker at an empty config so
-      # image pulls go straight to anonymous instead of attempting (and failing) that auth
-      # first. The path must be a literal: the `runner` context is unavailable in job-level
-      # env, so `${{ runner.temp }}` would resolve to empty and config.Dir() would fall back
-      # to ~/.docker with the stale credentials.
-      DOCKER_CONFIG: /tmp/docker-noauth
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
-      - name: prepare anonymous docker config
-        run: mkdir -p "$DOCKER_CONFIG" && echo '{}' > "$DOCKER_CONFIG/config.json"
-      # Pre-pull act/runner's two largest base images so a slow pull can't dominate `make test`;
-      # the rest (alpine/ubuntu) pull on demand, absorbed by the make-test -timeout. The host
-      # daemon retains them between runs, so this is usually a fast manifest re-check.
-      - name: pre-pull test images
-        run: |
-          for img in node:24-bookworm-slim nginx:alpine; do
-            for try in 1 2 3; do docker pull "$img" && break || sleep 5; done
-          done
       - name: lint
         run: make lint
       - name: build
         run: make build
       - name: test
-        run: make test
-      # Build the dind image and run the daemon-facing tests against the docker version it
-      # ships, catching daemon-level regressions (e.g. gitea/runner#981) before release. Runs
-      # after `make test` so the images it needs are already present on the host daemon.
-      - name: test against dind image
-        run: make test-dind
-      - name: coverage report
-        run: |
-          make coverage-report
-          cat .tmp/coverage.md >> "$GITHUB_STEP_SUMMARY"
+        run: make test

.gitignore

@@ -1,9 +1,7 @@
 /gitea-runner
 .env
-!/act/runner/testdata/secrets/.env
 .runner
 coverage.txt
-.tmp/
 /config.yaml
 
 # Jetbrains
@@ -12,5 +10,4 @@ coverage.txt
 .vscode
 __debug_bin
 # gorelease binary folder
-/dist
-.DS_Store
+dist

.goreleaser.yaml

@@ -93,37 +93,6 @@ blobs:
       - glob: ./**.xz
       - glob: ./**.sha256
 
-# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the
-# parallel S3+R2 period (S3 will be removed once migration completes).
-# A second `blobs:` entry is impossible here since the blob pipe
-# authenticates from the global AWS_* env with no per-entry
-# credentials; `publishers:` supports per-entry `env:` instead, so
-# it's used to invoke scripts/upload-r2.sh once per artifact. Custom
-# publishers inherit almost nothing from the environment, hence the
-# explicit R2_* forwarding below.
-#
-# This publisher fires 109 times for 73 distinct keys because
-# goreleaser's release pipe already registers `release.extra_files`
-# as UploadableFile artifacts, and `internal/exec`'s filterArtifacts
-# appends this block's own extra_files with no de-duplication. It
-# can't be globbed away, since gobwas/glob (via goreleaser/fileglob)
-# has no substring-exclusion matcher. It's harmless: PUT is
-# idempotent, and the `./**.xz` glob below is kept deliberately so
-# this publisher declares its own complete file set rather than
-# implicitly depending on the `release:` block's globs.
-publishers:
-  - name: cloudflare-r2
-    checksum: true
-    extra_files:
-      - glob: ./**.xz
-      - glob: ./**.sha256
-    cmd: sh scripts/upload-r2.sh {{ abs .ArtifactPath }} gitea-runner/{{ .Version }}/{{ .ArtifactName }}
-    env:
-      - R2_ENDPOINT={{ index .Env "R2_ENDPOINT" }}
-      - R2_BUCKET={{ index .Env "R2_BUCKET" }}
-      - R2_ACCESS_KEY_ID={{ index .Env "R2_ACCESS_KEY_ID" }}
-      - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }}
-
 archives:
   - format: binary
     name_template: "{{ .Binary }}"

Dockerfile

@@ -1,7 +1,7 @@
 ### BUILDER STAGE
 #
 #
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.26-alpine AS builder
 
 # Do not remove `git` here, it is required for getting runner version when executing `make build`
 RUN apk add --no-cache make git
@@ -17,14 +17,9 @@ RUN make clean && make build
 ### DIND VARIANT
 #
 #
-FROM docker:29.6.2-dind AS dind
+FROM docker:29-dind AS dind
 
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
-RUN apk add --no-cache s6 bash git tzdata nftables
+RUN apk add --no-cache s6 bash git tzdata
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
 COPY scripts/run.sh /usr/local/bin/run.sh
@@ -37,15 +32,10 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### DIND-ROOTLESS VARIANT
 #
 #
-FROM docker:29.6.2-dind-rootless AS dind-rootless
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
+FROM docker:29-dind-rootless AS dind-rootless
 
 USER root
-RUN apk add --no-cache s6 bash git tzdata nftables
+RUN apk add --no-cache s6 bash git tzdata
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
 COPY scripts/run.sh /usr/local/bin/run.sh
@@ -63,13 +53,7 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### BASIC VARIANT
 #
 #
-FROM alpine:3.24 AS basic
-
-ARG VERSION=dev
-
-LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
-LABEL org.opencontainers.image.version="${VERSION}"
-
+FROM alpine AS basic
 RUN apk add --no-cache tini bash git tzdata
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner

Makefile

@@ -18,8 +18,8 @@ DOCKER_TAG ?= nightly
 DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
 DOCKER_ROOTLESS_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)-dind-rootless
 
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.3.0
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
 
 STATIC ?=
 EXTLDFLAGS ?=
@@ -38,15 +38,12 @@ endif
 ifeq ($(OS), Windows_NT)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else ifeq ($(OS), Windows)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= $(EXECUTABLE).exe
-	GO_ENV_WINDOWS := set GOOS=windows&&
 else
 	GOFLAGS := -v
 	EXECUTABLE ?= $(EXECUTABLE)
-	GO_ENV_WINDOWS := GOOS=windows
 endif
 
 STORED_VERSION_FILE := VERSION
@@ -111,25 +108,16 @@ deps-tools: ## install tool dependencies
 	wait
 
 .PHONY: lint
-lint: lint-go lint-go-windows ## lint everything
+lint: lint-go ## lint everything
 
 .PHONY: lint-go
 lint-go: ## lint go files
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run
 
-.PHONY: lint-go-windows
-lint-go-windows: ## lint Windows go files
-	$(GO) install $(GOLANGCI_LINT_PACKAGE)
-	$(GO_ENV_WINDOWS) golangci-lint run
-
 .PHONY: lint-go-fix
 lint-go-fix: ## lint go files and fix issues
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run --fix
 
-.PHONY: lint-pr-title
-lint-pr-title: ## lint PR title against Conventional Commits (set PR_TITLE=...)
-	@node ./tools/lint-pr-title.ts
-
 .PHONY: security-check
 security-check: deps-tools
 	GOEXPERIMENT= $(GO) run $(GOVULNCHECK_PACKAGE) -show color ./... || true
@@ -148,18 +136,8 @@ tidy-check: tidy
 	fi
 
 .PHONY: test
-test: fmt-check security-check ## test everything (integration tests self-skip without docker/network)
-	@$(GO) test -race -timeout 20m -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
-
-.PHONY: coverage-report
-coverage-report: ## turn coverage.txt from `make test` into .tmp/coverage.md
-	@mkdir -p .tmp
-	@node ./tools/coverage-report.ts -i coverage.txt -o .tmp/coverage.md
-	@echo "Wrote .tmp/coverage.md"
-
-.PHONY: test-dind
-test-dind: ## run the daemon-facing tests against the built dind image (TARGET=dind|dind-rootless)
-	@./scripts/test-dind.sh $(TARGET)
+test: fmt-check security-check ## test everything
+	@$(GO) test -race -short -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
 
 .PHONY: install
 install: $(GOFILES) ## install the runner binary via `go install`
@@ -224,7 +202,7 @@ docker: ## build the docker image
 .PHONY: clean
 clean: ## delete binary and coverage files
 	$(GO) clean -x -i ./...
-	rm -rf coverage.txt .tmp $(EXECUTABLE) $(DIST)
+	rm -rf coverage.txt $(EXECUTABLE) $(DIST)
 
 .PHONY: version
 version: ## print the version

README.md

@@ -85,48 +85,6 @@ docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRA
 
 Mount a volume on `/data` if you want the registration file and optional config to survive container recreation (see [scripts/run.sh](scripts/run.sh)).
 
-> **`/data` does not hold the image cache.** It is the runner's working directory and contains only the `.runner` registration file and, optionally, your config file. Images pulled for jobs live in the *Docker daemon's* data root, which for the `dind` flavours is inside the container (`/var/lib/docker`, or `/home/rootless/.local/share/docker` for `dind-rootless`). To keep the image cache across restarts, give that path its own volume as well — otherwise every new container re-pulls the job images. With the `basic` flavour the images live on whichever daemon you point the runner at, so there is nothing extra to persist.
-
-### Image flavours
-
-The image is published in three flavours, all built from the single multi-stage [Dockerfile](Dockerfile) in this repository. They differ only in how a Docker daemon is made available to the jobs the runner executes; the `gitea-runner` binary inside them is identical.
-
-| Tag | Build target | Base image | Docker daemon | Process supervisor | Runs as |
-| --- | --- | --- | --- | --- | --- |
-| `latest` (and `<version>`) | `basic` | `alpine` | none — uses an external daemon you provide | [`tini`](https://github.com/krallin/tini) | `root` |
-| `latest-dind` | `dind` | `docker:dind` | bundled, started inside the container | [`s6`](https://skarnet.org/software/s6/) | `root` (privileged) |
-| `latest-dind-rootless` | `dind-rootless` | `docker:dind-rootless` | bundled, started rootless inside the container | [`s6`](https://skarnet.org/software/s6/) | `rootless` (UID 1000) |
-
-#### `latest` — basic
-
-The default flavour ships only the runner on a minimal Alpine base. It contains **no Docker daemon of its own**: jobs that use `docker://` images need a daemon supplied from outside the container, typically by bind-mounting the host's socket:
-
-```bash
-docker run -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/runner:latest
-```
-
-`tini` is the entrypoint (it reaps zombie processes), and it just runs [`scripts/run.sh`](scripts/run.sh), which registers the runner on first start and then execs `gitea-runner daemon`. This flavour does not need `--privileged`. The trade-off is that jobs share the host's daemon, so they can see other containers and images on that daemon.
-
-#### `latest-dind` — Docker-in-Docker
-
-This flavour is based on the official `docker:dind` image and bundles its own Docker daemon, so it needs no external socket — only the `--privileged` flag that Docker-in-Docker requires:
-
-```bash
-docker run --privileged -e GITEA_INSTANCE_URL=https://your_gitea.com -e GITEA_RUNNER_REGISTRATION_TOKEN=<your_token> \
-  --name my_runner gitea/runner:latest-dind
-```
-
-Two processes have to run side by side here (the Docker daemon and the runner), so the entrypoint is the [`s6`](https://skarnet.org/software/s6/) supervision tree under [`scripts/s6`](scripts/s6) instead of `tini`. `s6` starts `dockerd`, and the runner service waits for the daemon to come up (`s6-svwait`) before launching [`run.sh`](scripts/run.sh). Each container has a private daemon isolated from the host's, at the cost of running privileged.
-
-#### `latest-dind-rootless` — rootless Docker-in-Docker
-
-Same idea as `dind`, but built on `docker:dind-rootless` so the bundled daemon and the runner run as an unprivileged user (`rootless`, UID 1000) rather than `root`. `DOCKER_HOST` is preset to `unix:///run/user/1000/docker.sock` so the runner talks to the rootless daemon. This reduces the blast radius compared to the privileged `dind` flavour, but rootless Docker carries the usual rootless limitations (networking, cgroups, storage drivers, and some operations that need additional host configuration such as `/etc/subuid` / `/etc/subgid` mappings and unprivileged user-namespace support).
-
-> **The UID is fixed at 1000.** It comes from the `rootless` user baked into the upstream `docker:dind-rootless` base image, and the bundled daemon always listens on `/run/user/1000/docker.sock` inside the container, so running this flavour as a different user (`--user 1001`) does not work. If you need the runner to talk to a *host* rootless daemon that runs under some other UID, use the `basic` flavour instead and bind-mount that daemon's socket (see [examples/vm/rootless-docker.md](examples/vm/rootless-docker.md)); pointing `DOCKER_HOST` at a host socket from inside `dind-rootless` will not work. Changing the UID otherwise means rebuilding the image from a base with a different `rootless` user.
-
-> **Note on Podman:** these images target the Docker daemon. The bundled `dind`/`dind-rootless` daemons are `dockerd`, not Podman, and the `basic` flavour expects a Docker-compatible socket. Running them under rootless Podman is not a supported configuration, though pointing the `basic` flavour at a Podman socket that emulates the Docker API may work for some workloads.
-
 ### Configuration
 
 The runner is configured with a YAML file. Generate a starting point (this matches what ships in the tree):
@@ -147,106 +105,26 @@ Every option is described in [config.example.yaml](internal/pkg/config/config.ex
 
 #### Without a config file
 
-If you omit `-c`, built-in defaults apply (same as an empty YAML document).
+If you omit `-c`, built-in defaults apply (same as an empty YAML document). A small set of **deprecated** environment variables can still override parts of that default config, but **only when no `-c` path was given**; they are ignored if you use a config file:
 
-Earlier releases let a small set of environment variables (`GITEA_DEBUG`, `GITEA_TRACE`, `GITEA_RUNNER_CAPACITY`, `GITEA_RUNNER_FILE`, `GITEA_RUNNER_ENVIRON`, `GITEA_RUNNER_ENV_FILE`) override parts of the default config. Those overrides have been removed — use a YAML config file for all settings instead. For the Docker images, the entrypoint still understands a separate set of variables (such as `RUNNER_STATE_FILE`); see [scripts/run.sh](scripts/run.sh) and the container documentation below.
-
-### Labels
-
-Labels decide **which jobs a runner accepts** and **how it runs them**. A job's `runs-on` is matched against the runner's label names; the first match wins and selects the execution environment for that job.
-
-A label is written as:
-
-```text
-<name>[:<schema>[:<args>]]
-```
-
-| Part | Meaning |
+| Variable | Effect |
 | --- | --- |
-| `name` | The name a workflow refers to in `runs-on`, e.g. `ubuntu-latest`. |
-| `schema` | Either `docker` or `host`. Defaults to `host` when omitted. |
-| `args` | Only used by the `docker` schema: the image to run the job in. |
+| `GITEA_DEBUG` | If true, sets log level to `debug` |
+| `GITEA_TRACE` | If true, sets log level to `trace` |
+| `GITEA_RUNNER_CAPACITY` | Concurrent jobs (integer) |
+| `GITEA_RUNNER_FILE` | Registration state file path (default `.runner`) |
+| `GITEA_RUNNER_ENVIRON` | Extra job env vars as comma-separated `KEY:VALUE` pairs |
+| `GITEA_RUNNER_ENV_FILE` | Path to an env file merged into job env (same idea as `runner.env_file` in YAML) |
 
-Two schemas are supported:
-
-- **`docker://<image>`** — the job runs inside a container created from `<image>`:
-
-  ```text
-  ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest
-  ```
-
-- **`host`** — the job's steps run directly on the machine the runner is on, using the tools installed there:
-
-  ```text
-  macos:host
-  ```
-
-So with the labels
-
-```text
-ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest,macos:host
-```
-
-a workflow with `runs-on: ubuntu-latest` is executed in the `runner-images:ubuntu-latest` container, and one with `runs-on: macos` is executed directly on the host.
-
-Names may themselves contain a colon (for example `pool:e57e18d4-10d4-406f-93bf-60f127221bdd`); only `host` and `docker` are treated as schemas.
-
-If a job's `runs-on` matches none of the runner's labels, the job still runs, in the default `docker.gitea.com/runner-images:ubuntu-latest` image. Images maintained for this purpose are listed at [gitea/runner-images](https://gitea.com/gitea/runner-images).
-
-Labels are chosen at registration time (`--labels`, or the interactive prompt) and can be changed afterwards by editing `runner.labels` in the config file, or in the Gitea UI under the runner's settings.
+Prefer a YAML file for all settings.
 
 #### Registration vs config labels
 
 If `runner.labels` is set in the YAML file, those labels are used during `register` and the `--labels` CLI flag is ignored.
 
-The `daemon` command also accepts `--labels` (which defaults to the `GITEA_RUNNER_LABELS` environment variable), so the labels of an already registered runner can be changed without deleting its registration file. The most explicit source wins:
+#### External cache (`actions/cache`)
 
-```
---labels / GITEA_RUNNER_LABELS   >   runner.labels in the config file   >   labels in the .runner file
-```
-
-Whenever the resulting labels differ from the ones in the registration file, they are written back to it and re-declared to the Gitea instance on startup.
-
-> **Note:** A runner that only exposes `host` labels still needs access to a Docker daemon (e.g. a mounted `/var/run/docker.sock`) whenever a job uses a `docker://` action or a service container. `host` labels only change where the job's own steps run; container-based steps and actions are still executed with Docker.
-
-#### Caching (`actions/cache`)
-
-Each runner starts its own cache server automatically. Cache entries are local to that runner — runners do not share a cache by default.
-
-**Shared cache across multiple runners**
-
-Run one dedicated `gitea-runner cache-server` that all runners point at.
-
-1. Create a config file for the cache server host:
-
-   ```yaml
-   cache:
-     dir: /data/actcache
-     port: 8088
-     external_secret: "replace-with-a-strong-random-secret"
-     # external_secret_file: /path/to/secret # secret can also be passed via a file
-   ```
-
-2. Start the server:
-
-   ```bash
-   gitea-runner -c cache-server-config.yaml cache-server
-   ```
-
-3. On every runner:
-
-   ```yaml
-   cache:
-     external_server: "http://<cache-server-host>:8088/"
-     external_secret: "replace-with-a-strong-random-secret"  # must match the server
-     # external_secret_file: /path/to/secret # secret can also be passed via a file
-   ```
-
-Alternatively, mount the same NFS/CIFS share on every runner and point `cache.dir` at it — simpler, but with weaker isolation between repositories.
-
-**S3 / MinIO** — mount object storage as a FUSE filesystem (e.g. [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) or [goofys](https://github.com/kahing/goofys)) and set `cache.dir` to the mount point.
-
-Flags `--dir`, `--host`, and `--port` on `cache-server` override the corresponding `cache.*` YAML keys; all other settings, including `external_secret`, require the config file.
+If `cache.external_server` is set, you must set `cache.external_secret` to the same value on this runner and on the standalone cache server. Run the server with `gitea-runner cache-server` using a config that defines `cache.external_secret` (and matching `cache.dir` / host / port as needed). Flags `--dir`, `--host`, and `--port` on `cache-server` override the file.
 
 #### Official Docker image
 
@@ -260,16 +138,6 @@ When `container.bind_workdir` is enabled, stale task workspace directories can b
 - only purely numeric subdirectories under `container.workdir_parent` are treated as task workspaces and may be removed
 - cleanup assumes `container.workdir_parent` is not shared across multiple runners
 
-#### Post-task script (`runner.post_task_script`)
-
-Optional host script that runs **after** each task's built-in cleanup (post-steps, container teardown, bind-workdir removal). Use it for extra machine housekeeping — Docker pruning, disk cleanup, and similar.
-
-**While the script runs, the runner stops task heartbeats and stays offline from Gitea's perspective until the script exits (or hits `runner.post_task_script_timeout`, default `5m`).** A script that blocks without exiting keeps the runner from taking new work for up to that timeout. Script output goes to the runner log, not the job log; a non-zero exit is warned but does not change the job result.
-
-On Windows, use `.exe`, `.bat`, or `.cmd` paths; **PowerShell (`.ps1`) is not supported yet** as the configured path — wrap commands in a `.cmd` file instead.
-
-See **[docs/post-task-script.md](docs/post-task-script.md)** for lifecycle details, environment variables, timeout interaction, and platform notes.
-
 ### Example Deployments
 
 Check out the [examples](examples) directory for sample deployment types.

act/artifactcache/handler.go

@@ -325,6 +325,10 @@ func (h *Handler) openDB() (*bolthold.Store, error) {
 func (h *Handler) find(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 	cred := credFromContext(r.Context())
 	keys := strings.Split(r.URL.Query().Get("keys"), ",")
+	// cache keys are case insensitive
+	for i, key := range keys {
+		keys[i] = strings.ToLower(key)
+	}
 	version := r.URL.Query().Get("version")
 
 	db, err := h.openDB()
@@ -367,6 +371,8 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, _ httprouter.P
 		h.responseJSON(w, r, 400, err)
 		return
 	}
+	// cache keys are case insensitive
+	api.Key = strings.ToLower(api.Key)
 
 	cache := api.ToCache()
 	cache.Repo = cred.Repo
@@ -431,7 +437,6 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprout
 	}
 	if err := h.storage.Write(cache.ID, start, r.Body); err != nil {
 		h.responseJSON(w, r, 500, err)
-		return
 	}
 	h.useCache(id)
 	h.responseJSON(w, r, 200)

act/artifactcache/handler_test.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -339,54 +338,6 @@ func TestHandler(t *testing.T) {
 		}
 	})
 
-	t.Run("upload write failure returns only error", func(t *testing.T) {
-		key := strings.ToLower(t.Name())
-		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
-		var id uint64
-		{
-			body, err := json.Marshal(&Request{
-				Key:     key,
-				Version: version,
-				Size:    100,
-			})
-			require.NoError(t, err)
-			resp, err := testClient.Post(base+"/caches", "application/json", bytes.NewReader(body))
-			require.NoError(t, err)
-			defer resp.Body.Close()
-			require.Equal(t, 200, resp.StatusCode)
-
-			got := struct {
-				CacheID uint64 `json:"cacheId"`
-			}{}
-			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
-			id = got.CacheID
-		}
-
-		storageFile := filepath.Join(dir, "not-a-directory")
-		require.NoError(t, os.WriteFile(storageFile, []byte("blocked"), 0o600))
-		originalStorage := handler.storage
-		handler.storage = &Storage{rootDir: storageFile}
-		defer func() {
-			handler.storage = originalStorage
-		}()
-
-		req, err := http.NewRequest(http.MethodPatch,
-			fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader(make([]byte, 100)))
-		require.NoError(t, err)
-		req.Header.Set("Content-Type", "application/octet-stream")
-		req.Header.Set("Content-Range", "bytes 0-99/*")
-		resp, err := testClient.Do(req)
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		require.Equal(t, 500, resp.StatusCode)
-
-		body, err := io.ReadAll(resp.Body)
-		require.NoError(t, err)
-		var got map[string]string
-		require.NoError(t, json.Unmarshal(body, &got))
-		assert.NotEmpty(t, got["error"])
-	})
-
 	t.Run("commit early", func(t *testing.T) {
 		key := strings.ToLower(t.Name())
 		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
@@ -508,20 +459,17 @@ func TestHandler(t *testing.T) {
 		assert.Equal(t, contents[except], content)
 	})
 
-	t.Run("case preserved", func(t *testing.T) {
-		// Some actions (e.g. actions/setup-go, actions/setup-node) build cache keys that contain mixed-case fragments such as RUNNER_OS=Linux,
-		// then compare the cacheKey returned by the cache server to their original key with case-sensitive equality to decide whether the
-		// cache was a complete hit. The server must therefore preserve the original key case.
-
+	t.Run("case insensitive", func(t *testing.T) {
 		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
-		key := strings.ToLower(t.Name()) + "_ABC"
+		key := strings.ToLower(t.Name())
 		content := make([]byte, 100)
 		_, err := rand.Read(content)
 		require.NoError(t, err)
-		uploadCacheNormally(t, base, key, version, content)
+		uploadCacheNormally(t, base, key+"_ABC", version, content)
 
 		{
-			resp, err := testClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			reqKey := key + "_aBc"
+			resp, err := testClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, reqKey, version))
 			require.NoError(t, err)
 			defer resp.Body.Close()
 			require.Equal(t, 200, resp.StatusCode)
@@ -532,8 +480,7 @@ func TestHandler(t *testing.T) {
 			}{}
 			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
 			assert.Equal(t, "hit", got.Result)
-			assert.Equal(t, key, got.CacheKey)
-			assert.NotEqual(t, strings.ToLower(key), got.CacheKey)
+			assert.Equal(t, key+"_abc", got.CacheKey)
 		}
 	})
 
@@ -696,7 +643,7 @@ func uploadCacheNormally(t *testing.T, base, key, version string, content []byte
 		}{}
 		require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
 		assert.Equal(t, "hit", got.Result)
-		assert.Equal(t, key, got.CacheKey)
+		assert.Equal(t, strings.ToLower(key), got.CacheKey)
 		archiveLocation = got.ArchiveLocation
 	}
 	{

act/artifactcache/testdata/example/example.yaml

@@ -0,0 +1,30 @@
+# Copied from https://github.com/actions/cache#example-cache-workflow
+name: Caching Primes
+
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - run: env
+
+      - uses: actions/checkout@v3
+
+      - name: Cache Primes
+        id: cache-primes
+        uses: actions/cache@v3
+        with:
+          path: prime-numbers
+          key: ${{ runner.os }}-primes-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-primes
+            ${{ runner.os }}
+
+      - name: Generate Prime Numbers
+        if: steps.cache-primes.outputs.cache-hit != 'true'
+        run: cat /proc/sys/kernel/random/uuid > prime-numbers
+
+      - name: Use Prime Numbers
+        run: cat prime-numbers

act/artifacts/server_test.go

@@ -5,25 +5,24 @@
 package artifacts
 
 import (
-	"bytes"
-	"compress/gzip"
+	"context"
 	"encoding/json"
 	"fmt"
-	"io"
-	"maps"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
 	"testing"
 	"testing/fstest"
-	"time"
+
+	"gitea.com/gitea/runner/act/model"
+	"gitea.com/gitea/runner/act/runner"
 
 	"github.com/julienschmidt/httprouter"
+	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 type writableMapFile struct {
@@ -235,133 +234,89 @@ func TestDownloadArtifactFile(t *testing.T) {
 	assert.Equal("content", string(data))
 }
 
-// TestArtifactFlow drives the real Serve() artifact server over a loopback socket, exercising
-// the same upload -> finalize -> list -> download protocol the upload-artifact/download-artifact
-// actions speak. Running it in-process (rather than from a job container) keeps it network-free
-// and reachable everywhere, including when the CI job is itself a container.
+type TestJobFileInfo struct {
+	workdir               string
+	workflowPath          string
+	eventName             string
+	errorMessage          string
+	platforms             map[string]string
+	containerArchitecture string
+}
+
+var (
+	artifactsPath = path.Join(os.TempDir(), "test-artifacts")
+	artifactsAddr = "127.0.0.1"
+	artifactsPort = "12345"
+)
+
 func TestArtifactFlow(t *testing.T) {
-	artifactPath := t.TempDir()
-
-	// Serve the exact routes Serve() wires up, on a real loopback socket via httptest. httptest
-	// picks a free port and Close() tears the server down synchronously — avoiding both the
-	// port-rebind race and Serve()'s detached ListenAndServe goroutine, which logger.Fatal()s
-	// (process exit) on a bind error and can outlive the test's temp-dir cleanup.
-	router := httprouter.New()
-	fsys := readWriteFSImpl{}
-	uploads(router, artifactPath, fsys)
-	downloads(router, artifactPath, fsys)
-	server := httptest.NewServer(router)
-	defer server.Close()
-
-	baseURL := server.URL
-	client := server.Client()
-	client.Timeout = 5 * time.Second
-
-	// request performs one HTTP call and returns the status and body. The default transport adds
-	// Accept-Encoding: gzip and transparently decompresses, so gzipped downloads come back plain.
-	request := func(t *testing.T, method, rawURL string, body io.Reader, header http.Header) (int, []byte) {
-		t.Helper()
-		req, err := http.NewRequest(method, rawURL, body)
-		require.NoError(t, err)
-		maps.Copy(req.Header, header)
-		resp, err := client.Do(req)
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		data, err := io.ReadAll(resp.Body)
-		require.NoError(t, err)
-		return resp.StatusCode, data
+	if testing.Short() {
+		t.Skip("skipping integration test")
 	}
 
-	t.Run("upload-and-download", func(t *testing.T) {
-		const runID, item, content = "1", "my-artifact/data.txt", "hello artifact\n"
+	ctx := context.Background()
 
-		status, data := request(t, http.MethodPost, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var prep FileContainerResourceURL
-		require.NoError(t, json.Unmarshal(data, &prep))
-		require.Equal(t, baseURL+"/upload/"+runID, prep.FileContainerResourceURL)
+	cancel := Serve(ctx, artifactsPath, artifactsAddr, artifactsPort)
+	defer cancel()
 
-		status, data = request(t, http.MethodPut, prep.FileContainerResourceURL+"?itemPath="+url.QueryEscape(item), strings.NewReader(content), nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var msg ResponseMessage
-		require.NoError(t, json.Unmarshal(data, &msg))
-		require.Equal(t, "success", msg.Message)
+	platforms := map[string]string{
+		"ubuntu-latest": "node:16-buster", // Don't use node:16-buster-slim because it doesn't have curl command, which is used in the tests
+	}
 
-		status, data = request(t, http.MethodPatch, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
+	tables := []TestJobFileInfo{
+		{"testdata", "upload-and-download", "push", "", platforms, ""},
+		{"testdata", "GHSL-2023-004", "push", "", platforms, ""},
+	}
+	log.SetLevel(log.DebugLevel)
 
-		status, data = request(t, http.MethodGet, baseURL+"/_apis/pipelines/workflows/"+runID+"/artifacts", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var list NamedFileContainerResourceURLResponse
-		require.NoError(t, json.Unmarshal(data, &list))
-		require.Equal(t, 1, list.Count)
-		require.Equal(t, "my-artifact", list.Value[0].Name)
+	for _, table := range tables {
+		runTestJobFile(ctx, t, table)
+	}
+}
 
-		status, data = request(t, http.MethodGet, list.Value[0].FileContainerResourceURL+"?itemPath=my-artifact", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var items ContainerItemResponse
-		require.NoError(t, json.Unmarshal(data, &items))
-		require.Len(t, items.Value, 1)
-		require.Equal(t, "file", items.Value[0].ItemType)
-		require.Equal(t, "my-artifact/data.txt", items.Value[0].Path)
+func runTestJobFile(ctx context.Context, t *testing.T, tjfi TestJobFileInfo) {
+	t.Run(tjfi.workflowPath, func(t *testing.T) {
+		fmt.Printf("::group::%s\n", tjfi.workflowPath) //nolint:forbidigo // pre-existing issue from nektos/act
 
-		status, data = request(t, http.MethodGet, items.Value[0].ContentLocation, nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
+		if err := os.RemoveAll(artifactsPath); err != nil {
+			panic(err)
+		}
 
-		stored, err := os.ReadFile(filepath.Join(artifactPath, runID, "my-artifact", "data.txt"))
-		require.NoError(t, err)
-		require.Equal(t, content, string(stored))
-	})
+		workdir, err := filepath.Abs(tjfi.workdir)
+		assert.NoError(t, err, workdir) //nolint:testifylint // pre-existing issue from nektos/act
+		fullWorkflowPath := filepath.Join(workdir, tjfi.workflowPath)
+		runnerConfig := &runner.Config{
+			Workdir:               workdir,
+			BindWorkdir:           false,
+			EventName:             tjfi.eventName,
+			Platforms:             tjfi.platforms,
+			ReuseContainers:       false,
+			ContainerArchitecture: tjfi.containerArchitecture,
+			GitHubInstance:        "github.com",
+			ArtifactServerPath:    artifactsPath,
+			ArtifactServerAddr:    artifactsAddr,
+			ArtifactServerPort:    artifactsPort,
+		}
 
-	t.Run("gzip-roundtrip", func(t *testing.T) {
-		const runID, item, content = "2", "logs/app.log", "compressed payload\n"
+		runner, err := runner.New(runnerConfig)
+		assert.NoError(t, err, tjfi.workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
 
-		var buf bytes.Buffer
-		gz := gzip.NewWriter(&buf)
-		_, err := gz.Write([]byte(content))
-		require.NoError(t, err)
-		require.NoError(t, gz.Close())
+		planner, err := model.NewWorkflowPlanner(fullWorkflowPath, true)
+		assert.NoError(t, err, fullWorkflowPath) //nolint:testifylint // pre-existing issue from nektos/act
 
-		status, data := request(t, http.MethodPut, baseURL+"/upload/"+runID+"?itemPath="+url.QueryEscape(item),
-			&buf, http.Header{"Content-Encoding": []string{"gzip"}})
-		require.Equal(t, http.StatusOK, status, string(data))
+		plan, err := planner.PlanEvent(tjfi.eventName)
+		if err == nil {
+			err = runner.NewPlanExecutor(plan)(ctx)
+			if tjfi.errorMessage == "" {
+				assert.NoError(t, err, fullWorkflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+			} else {
+				assert.Error(t, err, tjfi.errorMessage) //nolint:testifylint // pre-existing issue from nektos/act
+			}
+		} else {
+			assert.Nil(t, plan)
+		}
 
-		// stored compressed, with the server's gzip marker suffix
-		_, err = os.Stat(filepath.Join(artifactPath, runID, "logs", "app.log.gz__"))
-		require.NoError(t, err)
-
-		status, data = request(t, http.MethodGet, baseURL+"/download/"+runID+"?itemPath=logs", nil, nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-		var items ContainerItemResponse
-		require.NoError(t, json.Unmarshal(data, &items))
-		require.Len(t, items.Value, 1)
-		require.Equal(t, "logs/app.log", items.Value[0].Path)
-
-		status, data = request(t, http.MethodGet, items.Value[0].ContentLocation, nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
-	})
-
-	// GHSL-2023-004: an itemPath that climbs out of the run directory must be neutralised so the
-	// blob cannot be written outside the artifact root.
-	t.Run("GHSL-2023-004", func(t *testing.T) {
-		const runID, content = "3", "contained\n"
-
-		status, data := request(t, http.MethodPut, baseURL+"/upload/"+runID+"?itemPath="+url.QueryEscape("../../escape.txt"),
-			strings.NewReader(content), nil)
-		require.Equal(t, http.StatusOK, status, string(data))
-
-		stored, err := os.ReadFile(filepath.Join(artifactPath, runID, "escape.txt"))
-		require.NoError(t, err)
-		require.Equal(t, content, string(stored))
-
-		_, err = os.Stat(filepath.Join(filepath.Dir(artifactPath), "escape.txt"))
-		require.True(t, os.IsNotExist(err), "upload escaped the artifact root")
-
-		status, data = request(t, http.MethodGet, baseURL+"/artifact/"+runID+"/escape.txt", nil, nil)
-		require.Equal(t, http.StatusOK, status)
-		require.Equal(t, content, string(data))
+		fmt.Println("::endgroup::") //nolint:forbidigo // pre-existing issue from nektos/act
 	})
 }
 
@@ -390,43 +345,6 @@ func TestMkdirFsImplSafeResolve(t *testing.T) {
 	}
 }
 
-func TestReadWriteFSWritableAndAppendable(t *testing.T) {
-	fsys := readWriteFSImpl{}
-	name := filepath.Join(t.TempDir(), "nested", "artifact.txt")
-
-	w, err := fsys.OpenWritable(name)
-	require.NoError(t, err)
-	_, err = w.Write([]byte("first"))
-	require.NoError(t, err)
-	require.NoError(t, w.Close())
-
-	w, err = fsys.OpenAppendable(name)
-	require.NoError(t, err)
-	_, err = w.Write([]byte("-second"))
-	require.NoError(t, err)
-	require.NoError(t, w.Close())
-
-	got, err := os.ReadFile(name)
-	require.NoError(t, err)
-	require.Equal(t, "first-second", string(got))
-
-	w, err = fsys.OpenWritable(name)
-	require.NoError(t, err)
-	_, err = w.Write([]byte("replaced"))
-	require.NoError(t, err)
-	require.NoError(t, w.Close())
-
-	got, err = os.ReadFile(name)
-	require.NoError(t, err)
-	require.Equal(t, "replaced", string(got))
-}
-
-func TestServeEmptyArtifactPathReturnsCancelableNoop(t *testing.T) {
-	cancel := Serve(t.Context(), "", "127.0.0.1", "0")
-	require.NotNil(t, cancel)
-	cancel()
-}
-
 func TestDownloadArtifactFileUnsafePath(t *testing.T) {
 	assert := assert.New(t)
 

act/artifacts/testdata/GHSL-2023-004/artifacts.yml

@@ -0,0 +1,39 @@
+
+name: "GHSL-2023-0004"
+on: push
+
+jobs:
+  test-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "hello world" > test.txt
+      - name: curl upload
+        run: curl --silent --show-error --fail ${ACTIONS_RUNTIME_URL}upload/1?itemPath=../../my-artifact/secret.txt --upload-file test.txt
+      - uses: actions/download-artifact@v2
+        with:
+          name: my-artifact
+          path: test-artifacts
+      - name: 'Verify Artifact #1'
+        run: |
+          file="test-artifacts/secret.txt"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if [ "$(cat $file)" != "hello world" ] ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+      - name: Verify download should work by clean extra dots
+        run: curl --silent --show-error --fail --path-as-is -o out.txt ${ACTIONS_RUNTIME_URL}artifact/1/../../../1/my-artifact/secret.txt
+      - name: 'Verify download content'
+        run: |
+          file="out.txt"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if [ "$(cat $file)" != "hello world" ] ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi

act/artifacts/testdata/upload-and-download/artifacts.yml

@@ -0,0 +1,230 @@
+
+name: "Test that artifact uploads and downloads succeed"
+on: push
+
+jobs:
+  test-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - run: mkdir -p path/to/artifact
+      - run: echo hello > path/to/artifact/world.txt
+      - uses: actions/upload-artifact@v2
+        with:
+          name: my-artifact
+          path: path/to/artifact/world.txt
+
+      - run: rm -rf path
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: my-artifact
+      - name: Display structure of downloaded files
+        run: ls -la
+
+      # Test end-to-end by uploading two artifacts and then downloading them
+      - name: Create artifact files
+        run: |
+          mkdir -p path/to/dir-1
+          mkdir -p path/to/dir-2
+          mkdir -p path/to/dir-3
+          mkdir -p path/to/dir-5
+          mkdir -p path/to/dir-6
+          mkdir -p path/to/dir-7
+          echo "Lorem ipsum dolor sit amet" > path/to/dir-1/file1.txt
+          echo "Hello world from file #2" > path/to/dir-2/file2.txt
+          echo "This is a going to be a test for a large enough file that should get compressed with GZip. The @actions/artifact package uses GZip to upload files. This text should have a compression ratio greater than 100% so it should get uploaded using GZip" > path/to/dir-3/gzip.txt
+          dd if=/dev/random of=path/to/dir-5/file5.rnd bs=1024 count=1024
+          dd if=/dev/random of=path/to/dir-6/file6.rnd bs=1024 count=$((10*1024))
+          dd if=/dev/random of=path/to/dir-7/file7.rnd bs=1024 count=$((10*1024))
+
+      # Upload a single file artifact
+      - name: 'Upload artifact #1'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Artifact-A'
+          path: path/to/dir-1/file1.txt
+      
+      # Upload using a wildcard pattern, name should default to 'artifact' if not provided
+      - name: 'Upload artifact #2'
+        uses: actions/upload-artifact@v2
+        with:
+          path: path/**/dir*/
+      
+      # Upload a directory that contains a file that will be uploaded with GZip
+      - name: 'Upload artifact #3'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'GZip-Artifact'
+          path: path/to/dir-3/
+      
+      # Upload a directory that contains a file that will be uploaded with GZip
+      - name: 'Upload artifact #4'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Multi-Path-Artifact'
+          path: |
+            path/to/dir-1/*
+            path/to/dir-[23]/*
+            !path/to/dir-3/*.txt
+      
+      # Upload a mid-size file artifact
+      - name: 'Upload artifact #5'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Mid-Size-Artifact'
+          path: path/to/dir-5/file5.rnd
+      
+      # Upload a big file artifact
+      - name: 'Upload artifact #6'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Big-Artifact'
+          path: path/to/dir-6/file6.rnd
+
+      # Upload a big file artifact twice
+      - name: 'Upload artifact #7 (First)'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Big-Uploaded-Twice'
+          path: path/to/dir-7/file7.rnd
+
+      # Upload a big file artifact twice
+      - name: 'Upload artifact #7 (Second)'
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'Big-Uploaded-Twice'
+          path: path/to/dir-7/file7.rnd
+
+      # Verify artifacts. Switch to download-artifact@v2 once it's out of preview
+      
+      # Download Artifact #1 and verify the correctness of the content
+      - name: 'Download artifact #1'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Artifact-A'
+          path: some/new/path
+      
+      - name: 'Verify Artifact #1'
+        run: |
+          file="some/new/path/file1.txt"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if [ "$(cat $file)" != "Lorem ipsum dolor sit amet" ] ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+      
+      # Download Artifact #2 and verify the correctness of the content
+      - name: 'Download artifact #2'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'artifact'
+          path: some/other/path
+      
+      - name: 'Verify Artifact #2'
+        run: |
+          file1="some/other/path/to/dir-1/file1.txt"
+          file2="some/other/path/to/dir-2/file2.txt"
+          if [ ! -f $file1 -o ! -f $file2 ] ; then
+            echo "Expected files do not exist"
+            exit 1
+          fi
+          if [ "$(cat $file1)" != "Lorem ipsum dolor sit amet" -o "$(cat $file2)" != "Hello world from file #2" ] ; then
+            echo "File contents of downloaded artifacts are incorrect"
+            exit 1
+          fi
+      
+      # Download Artifact #3 and verify the correctness of the content
+      - name: 'Download artifact #3'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'GZip-Artifact'
+          path: gzip/artifact/path
+      
+      # Because a directory was used as input during the upload the parent directories, path/to/dir-3/, should not be included in the uploaded artifact
+      - name: 'Verify Artifact #3'
+        run: |
+          gzipFile="gzip/artifact/path/gzip.txt"
+          if [ ! -f $gzipFile ] ; then
+            echo "Expected file do not exist"
+            exit 1
+          fi
+          if [ "$(cat $gzipFile)" != "This is a going to be a test for a large enough file that should get compressed with GZip. The @actions/artifact package uses GZip to upload files. This text should have a compression ratio greater than 100% so it should get uploaded using GZip" ] ; then
+            echo "File contents of downloaded artifact is incorrect"
+            exit 1
+          fi
+      
+      - name: 'Download artifact #4'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Multi-Path-Artifact'
+          path: multi/artifact
+      
+      - name: 'Verify Artifact #4'
+        run: |
+          file1="multi/artifact/dir-1/file1.txt"
+          file2="multi/artifact/dir-2/file2.txt"
+          if [ ! -f $file1 -o ! -f $file2 ] ; then
+            echo "Expected files do not exist"
+            exit 1
+          fi
+          if [ "$(cat $file1)" != "Lorem ipsum dolor sit amet" -o "$(cat $file2)" != "Hello world from file #2" ] ; then
+            echo "File contents of downloaded artifacts are incorrect"
+            exit 1
+          fi
+      
+      - name: 'Download artifact #5'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Mid-Size-Artifact'
+          path: mid-size/artifact/path
+      
+      - name: 'Verify Artifact #5'
+        run: |
+          file="mid-size/artifact/path/file5.rnd"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if ! diff $file path/to/dir-5/file5.rnd ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+      
+      - name: 'Download artifact #6'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Big-Artifact'
+          path: big/artifact/path
+      
+      - name: 'Verify Artifact #6'
+        run: |
+          file="big/artifact/path/file6.rnd"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if ! diff $file path/to/dir-6/file6.rnd ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi
+
+      - name: 'Download artifact #7'
+        uses: actions/download-artifact@v2
+        with:
+          name: 'Big-Uploaded-Twice'
+          path: big-uploaded-twice/artifact/path
+
+      - name: 'Verify Artifact #7'
+        run: |
+          file="big-uploaded-twice/artifact/path/file7.rnd"
+          if [ ! -f $file ] ; then
+            echo "Expected file does not exist"
+            exit 1
+          fi
+          if ! diff $file path/to/dir-7/file7.rnd ; then
+            echo "File contents of downloaded artifact are incorrect"
+            exit 1
+          fi

act/common/cartesian.go

@@ -4,8 +4,6 @@
 
 package common
 
-import "slices"
-
 // CartesianProduct takes map of lists and returns list of unique tuples
 func CartesianProduct(mapOfLists map[string][]any) []map[string]any {
 	listNames := make([]string, 0)
@@ -48,7 +46,7 @@ func cartN(a ...[]any) [][]any {
 		for j, n := range n {
 			pi[j] = a[j][n]
 		}
-		for j := range slices.Backward(n) {
+		for j := len(n) - 1; j >= 0; j-- {
 			n[j]++
 			if n[j] < len(a[j]) {
 				break

act/common/context_helpers_test.go

@@ -1,73 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-)
-
-func TestDryrunContext(t *testing.T) {
-	ctx := context.Background()
-	if Dryrun(ctx) {
-		t.Fatal("plain context should not be dryrun")
-	}
-	if !Dryrun(WithDryrun(ctx, true)) {
-		t.Fatal("WithDryrun(true) should set dryrun")
-	}
-	if Dryrun(WithDryrun(ctx, false)) {
-		t.Fatal("WithDryrun(false) should clear dryrun")
-	}
-}
-
-func TestJobErrorContainer(t *testing.T) {
-	ctx := context.Background()
-	err := errors.New("job failed")
-
-	SetJobError(ctx, err)
-	if got := JobError(ctx); got != nil {
-		t.Fatalf("JobError without container = %v, want nil", got)
-	}
-
-	ctx = WithJobErrorContainer(ctx)
-	SetJobError(ctx, err)
-	if got := JobError(ctx); !errors.Is(got, err) {
-		t.Fatalf("JobError = %v, want %v", got, err)
-	}
-}
-
-func TestLoggerAndHookContext(t *testing.T) {
-	ctx := context.Background()
-	if Logger(ctx) != logrus.StandardLogger() {
-		t.Fatal("plain context should use standard logger")
-	}
-	if LoggerHook(ctx) != nil {
-		t.Fatal("plain context should not have a logger hook")
-	}
-
-	logger := logrus.New()
-	ctx = WithLogger(ctx, logger)
-	if Logger(ctx) != logger {
-		t.Fatal("WithLogger should set logger")
-	}
-
-	hook := testHook{}
-	ctx = WithLoggerHook(ctx, hook)
-	if LoggerHook(ctx) != hook {
-		t.Fatal("WithLoggerHook should set hook")
-	}
-}
-
-type testHook struct{}
-
-func (testHook) Levels() []logrus.Level {
-	return logrus.AllLevels
-}
-
-func (testHook) Fire(*logrus.Entry) error {
-	return nil
-}

act/common/draw.go

@@ -0,0 +1,146 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package common
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+// Style is a specific style
+type Style int
+
+// Styles
+const (
+	StyleDoubleLine = iota
+	StyleSingleLine
+	StyleDashedLine
+	StyleNoLine
+)
+
+// NewPen creates a new pen
+func NewPen(style Style, color int) *Pen {
+	bgcolor := 49
+	if os.Getenv("CLICOLOR") == "0" {
+		color = 0
+		bgcolor = 0
+	}
+	return &Pen{
+		style:   style,
+		color:   color,
+		bgcolor: bgcolor,
+	}
+}
+
+type styleDef struct {
+	cornerTL string
+	cornerTR string
+	cornerBL string
+	cornerBR string
+	lineH    string
+	lineV    string
+}
+
+var styleDefs = []styleDef{
+	{"\u2554", "\u2557", "\u255a", "\u255d", "\u2550", "\u2551"},
+	{"\u256d", "\u256e", "\u2570", "\u256f", "\u2500", "\u2502"},
+	{"\u250c", "\u2510", "\u2514", "\u2518", "\u254c", "\u254e"},
+	{" ", " ", " ", " ", " ", " "},
+}
+
+// Pen struct
+type Pen struct {
+	style   Style
+	color   int
+	bgcolor int
+}
+
+// Drawing struct
+type Drawing struct {
+	buf   *strings.Builder
+	width int
+}
+
+func (p *Pen) drawTopBars(buf io.Writer, labels ...string) {
+	style := styleDefs[p.style]
+	for _, label := range labels {
+		bar := strings.Repeat(style.lineH, len(label)+2)
+		fmt.Fprintf(buf, " ")
+		fmt.Fprintf(buf, "\x1b[%d;%dm", p.color, p.bgcolor)
+		fmt.Fprintf(buf, "%s%s%s", style.cornerTL, bar, style.cornerTR)
+		fmt.Fprintf(buf, "\x1b[%dm", 0)
+	}
+	fmt.Fprintf(buf, "\n")
+}
+
+func (p *Pen) drawBottomBars(buf io.Writer, labels ...string) {
+	style := styleDefs[p.style]
+	for _, label := range labels {
+		bar := strings.Repeat(style.lineH, len(label)+2)
+		fmt.Fprintf(buf, " ")
+		fmt.Fprintf(buf, "\x1b[%d;%dm", p.color, p.bgcolor)
+		fmt.Fprintf(buf, "%s%s%s", style.cornerBL, bar, style.cornerBR)
+		fmt.Fprintf(buf, "\x1b[%dm", 0)
+	}
+	fmt.Fprintf(buf, "\n")
+}
+
+func (p *Pen) drawLabels(buf io.Writer, labels ...string) {
+	style := styleDefs[p.style]
+	for _, label := range labels {
+		fmt.Fprintf(buf, " ")
+		fmt.Fprintf(buf, "\x1b[%d;%dm", p.color, p.bgcolor)
+		fmt.Fprintf(buf, "%s %s %s", style.lineV, label, style.lineV)
+		fmt.Fprintf(buf, "\x1b[%dm", 0)
+	}
+	fmt.Fprintf(buf, "\n")
+}
+
+// DrawArrow between boxes
+func (p *Pen) DrawArrow() *Drawing {
+	drawing := &Drawing{
+		buf:   new(strings.Builder),
+		width: 1,
+	}
+	fmt.Fprintf(drawing.buf, "\x1b[%dm", p.color)
+	fmt.Fprintf(drawing.buf, "\u2b07")
+	fmt.Fprintf(drawing.buf, "\x1b[%dm", 0)
+	return drawing
+}
+
+// DrawBoxes to draw boxes
+func (p *Pen) DrawBoxes(labels ...string) *Drawing {
+	width := 0
+	for _, l := range labels {
+		width += len(l) + 2 + 2 + 1
+	}
+	drawing := &Drawing{
+		buf:   new(strings.Builder),
+		width: width,
+	}
+	p.drawTopBars(drawing.buf, labels...)
+	p.drawLabels(drawing.buf, labels...)
+	p.drawBottomBars(drawing.buf, labels...)
+
+	return drawing
+}
+
+// Draw to writer
+func (d *Drawing) Draw(writer io.Writer, centerOnWidth int) {
+	padSize := max((centerOnWidth-d.GetWidth())/2, 0)
+	for l := range strings.SplitSeq(d.buf.String(), "\n") {
+		if len(l) > 0 {
+			padding := strings.Repeat(" ", padSize)
+			fmt.Fprintf(writer, "%s%s\n", padding, l)
+		}
+	}
+}
+
+// GetWidth of drawing
+func (d *Drawing) GetWidth() int {
+	return d.width
+}

act/common/executor.go

@@ -12,6 +12,24 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+// Warning that implements `error` but safe to ignore
+type Warning struct {
+	Message string
+}
+
+// Error the contract for error
+func (w Warning) Error() string {
+	return w.Message
+}
+
+// Warningf create a warning
+func Warningf(format string, args ...any) Warning {
+	w := Warning{
+		Message: fmt.Sprintf(format, args...),
+	}
+	return w
+}
+
 // Executor define contract for the steps of a workflow
 type Executor func(ctx context.Context) error
 
@@ -79,12 +97,6 @@ func NewErrorExecutor(err error) Executor {
 
 // NewParallelExecutor creates a new executor from a parallel of other executors
 func NewParallelExecutor(parallel int, executors ...Executor) Executor {
-	if len(executors) == 0 {
-		return func(ctx context.Context) error {
-			return ctx.Err()
-		}
-	}
-
 	return func(ctx context.Context) error {
 		work := make(chan Executor, len(executors))
 		errs := make(chan error, len(executors))
@@ -144,8 +156,14 @@ func NewParallelExecutor(parallel int, executors ...Executor) Executor {
 // Then runs another executor if this executor succeeds
 func (e Executor) Then(then Executor) Executor {
 	return func(ctx context.Context) error {
-		if err := e(ctx); err != nil {
-			return err
+		err := e(ctx)
+		if err != nil {
+			switch err.(type) {
+			case Warning:
+				Logger(ctx).Warning(err.Error())
+			default:
+				return err
+			}
 		}
 		if ctx.Err() != nil {
 			return ctx.Err()

act/common/executor_parallel_advanced_test.go

@@ -170,6 +170,68 @@ func TestMaxParallelWithErrors(t *testing.T) {
 	})
 }
 
+// TestMaxParallelPerformance tests performance characteristics
+func TestMaxParallelPerformance(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping performance test in short mode")
+	}
+
+	t.Run("ParallelFasterThanSequential", func(t *testing.T) {
+		executors := make([]Executor, 10)
+		for i := range 10 {
+			executors[i] = func(ctx context.Context) error {
+				time.Sleep(50 * time.Millisecond)
+				return nil
+			}
+		}
+
+		ctx := context.Background()
+
+		// Sequential (max-parallel=1)
+		start := time.Now()
+		err := NewParallelExecutor(1, executors...)(ctx)
+		sequentialDuration := time.Since(start)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+		// Parallel (max-parallel=5)
+		start = time.Now()
+		err = NewParallelExecutor(5, executors...)(ctx)
+		parallelDuration := time.Since(start)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+		// Parallel should be significantly faster
+		assert.Less(t, parallelDuration, sequentialDuration/2,
+			"Parallel execution should be at least 2x faster")
+	})
+
+	t.Run("OptimalWorkerCount", func(t *testing.T) {
+		executors := make([]Executor, 20)
+		for i := range 20 {
+			executors[i] = func(ctx context.Context) error {
+				time.Sleep(10 * time.Millisecond)
+				return nil
+			}
+		}
+
+		ctx := context.Background()
+
+		// Test with different worker counts
+		workerCounts := []int{1, 2, 5, 10, 20}
+		durations := make(map[int]time.Duration)
+
+		for _, count := range workerCounts {
+			start := time.Now()
+			err := NewParallelExecutor(count, executors...)(ctx)
+			durations[count] = time.Since(start)
+			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+		}
+
+		// More workers should generally be faster (up to a point)
+		assert.Less(t, durations[5], durations[1], "5 workers should be faster than 1")
+		assert.Less(t, durations[10], durations[2], "10 workers should be faster than 2")
+	})
+}
+
 // TestMaxParallelResourceSharing tests resource sharing scenarios
 func TestMaxParallelResourceSharing(t *testing.T) {
 	t.Run("SharedResourceWithMutex", func(t *testing.T) {

act/common/executor_test.go

@@ -7,14 +7,11 @@ package common
 import (
 	"context"
 	"errors"
-	"reflect"
-	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestNewWorkflow(t *testing.T) {
@@ -122,19 +119,6 @@ func TestNewParallelExecutor(t *testing.T) {
 	assert.NoError(errSingle)
 }
 
-func TestNewParallelExecutorEmpty(t *testing.T) {
-	assert := assert.New(t)
-
-	ctx := context.Background()
-	require.NoError(t, NewParallelExecutor(2)(ctx))
-
-	canceledCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	err := NewParallelExecutor(2)(canceledCtx)
-	assert.ErrorIs(err, context.Canceled)
-}
-
 func TestNewParallelExecutorFailed(t *testing.T) {
 	assert := assert.New(t)
 
@@ -172,43 +156,3 @@ func TestNewParallelExecutorCanceled(t *testing.T) {
 	assert.Equal(int32(3), count.Load())
 	assert.Error(errExpected, err) //nolint:testifylint // pre-existing issue from nektos/act
 }
-
-func TestExecutorConditionalsAndFinally(t *testing.T) {
-	ctx := context.Background()
-	var calls []string
-	record := func(name string) Executor {
-		return func(ctx context.Context) error {
-			calls = append(calls, name)
-			return nil
-		}
-	}
-
-	require.NoError(t, record("if-true").If(func(context.Context) bool { return true })(ctx))
-	require.NoError(t, record("if-false").If(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-not").IfNot(func(context.Context) bool { return false })(ctx))
-	require.NoError(t, record("if-bool").IfBool(true)(ctx))
-	require.NoError(t, record("main").Finally(record("finally"))(ctx))
-
-	want := []string{"if-true", "if-not", "if-bool", "main", "finally"}
-	if !reflect.DeepEqual(calls, want) {
-		t.Fatalf("calls = %v, want %v", calls, want)
-	}
-}
-
-func TestExecutorFinallyReturnsFinallyErrorWithOriginal(t *testing.T) {
-	mainErr := errors.New("main failed")
-	finalErr := errors.New("cleanup failed")
-
-	err := NewErrorExecutor(mainErr).Finally(NewErrorExecutor(finalErr))(context.Background())
-	require.Error(t, err)
-	if !strings.Contains(err.Error(), "cleanup failed") || !strings.Contains(err.Error(), "main failed") {
-		t.Fatalf("finally error = %q, want both cleanup and original error", err)
-	}
-}
-
-func TestConditionalNot(t *testing.T) {
-	cond := Conditional(func(context.Context) bool { return false })
-	if !cond.Not()(context.Background()) {
-		t.Fatal("inverted conditional should be true")
-	}
-}

act/common/file.go

@@ -0,0 +1,77 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package common
+
+import (
+	"fmt"
+	"io"
+	"os"
+)
+
+// CopyFile copy file
+func CopyFile(source, dest string) (err error) {
+	sourcefile, err := os.Open(source)
+	if err != nil {
+		return err
+	}
+
+	defer sourcefile.Close()
+
+	destfile, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+
+	defer destfile.Close()
+
+	_, err = io.Copy(destfile, sourcefile)
+	if err == nil {
+		sourceinfo, err := os.Stat(source)
+		if err != nil {
+			_ = os.Chmod(dest, sourceinfo.Mode())
+		}
+	}
+
+	return err
+}
+
+// CopyDir recursive copy of directory
+func CopyDir(source, dest string) (err error) {
+	// get properties of source dir
+	sourceinfo, err := os.Stat(source)
+	if err != nil {
+		return err
+	}
+
+	// create dest dir
+
+	err = os.MkdirAll(dest, sourceinfo.Mode())
+	if err != nil {
+		return err
+	}
+
+	objects, err := os.ReadDir(source)
+
+	for _, obj := range objects {
+		sourcefilepointer := source + "/" + obj.Name()
+
+		destinationfilepointer := dest + "/" + obj.Name()
+
+		if obj.IsDir() {
+			// create sub-directories - recursively
+			err = CopyDir(sourcefilepointer, destinationfilepointer)
+			if err != nil {
+				fmt.Println(err) //nolint:forbidigo // pre-existing issue from nektos/act
+			}
+		} else {
+			// perform copy
+			err = CopyFile(sourcefilepointer, destinationfilepointer)
+			if err != nil {
+				fmt.Println(err) //nolint:forbidigo // pre-existing issue from nektos/act
+			}
+		}
+	}
+	return err
+}

act/common/git/git.go

@@ -38,11 +38,9 @@ var (
 	ErrNoRepo   = errors.New("unable to find git repo")
 )
 
-// AcquireCloneLock returns an unlock function after locking the per-directory mutex for dir.
-// Only concurrent operations targeting the same directory are serialized; clones into different directories run in parallel.
-// Callers reading files inside dir (e.g. tarring a checked-out action into a job container) must hold this lock too,
-// otherwise a concurrent NewGitCloneExecutor on the same dir can mutate the worktree mid-read.
-func AcquireCloneLock(dir string) func() {
+// acquireCloneLock returns an unlock function after locking the per-directory mutex for dir.
+// Only concurrent operations targeting the same directory are erialized; clones into different directories run in parallel.
+func acquireCloneLock(dir string) func() {
 	v, _ := cloneLocks.LoadOrStore(dir, &sync.Mutex{})
 	mu := v.(*sync.Mutex)
 	mu.Lock()
@@ -66,21 +64,8 @@ func (e *Error) Commit() string {
 	return e.commit
 }
 
-// goGitMu serializes go-git repository access across the process. go-git is not safe for
-// concurrent use of the same repository (even read access decodes packfiles into shared
-// state), so parallel jobs inspecting the shared workdir repo race without this. The guarded
-// operations are fast local reads; gitea runs one job per process, so the lock is effectively
-// uncontended in production.
-var goGitMu sync.Mutex
-
 // FindGitRevision get the current git revision
 func FindGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-	return findGitRevision(ctx, file)
-}
-
-func findGitRevision(ctx context.Context, file string) (shortSha, sha string, err error) {
 	logger := common.Logger(ctx)
 
 	gitDir, err := git.PlainOpenWithOptions(
@@ -112,13 +97,10 @@ func findGitRevision(ctx context.Context, file string) (shortSha, sha string, er
 
 // FindGitRef get the current git ref
 func FindGitRef(ctx context.Context, file string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
-
 	logger := common.Logger(ctx)
 
 	logger.Debugf("Loading revision from git directory")
-	_, ref, err := findGitRevision(ctx, file)
+	_, ref, err := FindGitRevision(ctx, file)
 	if err != nil {
 		return "", err
 	}
@@ -190,8 +172,6 @@ func FindGitRef(ctx context.Context, file string) (string, error) {
 
 // FindGithubRepo get the repo
 func FindGithubRepo(ctx context.Context, file, githubInstance, remoteName string) (string, error) {
-	goGitMu.Lock()
-	defer goGitMu.Unlock()
 	if remoteName == "" {
 		remoteName = "origin"
 	}
@@ -257,77 +237,51 @@ type NewGitCloneExecutorInput struct {
 	Token       string
 	OfflineMode bool
 
-	// Depth limits the clone/fetch to the given number of commits from the tip of the requested ref.
-	// 0 for full clone.
-	Depth int
-
-	// Quiet drops the informational clone line to debug level, for callers that log their own
-	// download summary (the setup section's action report).
-	Quiet bool
-
 	// For Gitea
 	InsecureSkipTLS bool
 }
 
-// CloneIfRequired returns the repository and a boolean indicating whether an existing local clone was reused.
-func CloneIfRequired(ctx context.Context, refName plumbing.ReferenceName, input NewGitCloneExecutorInput, logger log.FieldLogger) (*git.Repository, bool, error) {
+// CloneIfRequired ...
+func CloneIfRequired(ctx context.Context, refName plumbing.ReferenceName, input NewGitCloneExecutorInput, logger log.FieldLogger) (*git.Repository, error) {
 	r, err := git.PlainOpen(input.Dir)
-	if err == nil {
-		// Verify the cached clone still points to the resolved URL before reusing it.
-		remote, err := r.Remote("origin")
-		if err == nil && len(remote.Config().URLs) > 0 && remote.Config().URLs[0] == input.URL {
-			// Reuse existing clone
-			return r, true, nil
-		}
-
-		if err != nil {
-			logger.Debugf("Removing cached clone at %s because origin cannot be read: %v", input.Dir, err)
-		} else if len(remote.Config().URLs) == 0 {
-			logger.Debugf("Removing cached clone at %s because origin has no URL", input.Dir)
-		} else {
-			logger.Debugf("Removing cached clone at %s because origin URL changed from %s to %s", input.Dir, remote.Config().URLs[0], input.URL)
-		}
-		if err := os.RemoveAll(input.Dir); err != nil {
-			return nil, false, fmt.Errorf("remove cached clone %s: %w", input.Dir, err)
-		}
-	}
-
-	var progressWriter io.Writer
-	if isatty.IsTerminal(os.Stdout.Fd()) || isatty.IsCygwinTerminal(os.Stdout.Fd()) {
-		if entry, ok := logger.(*log.Entry); ok {
-			progressWriter = entry.WriterLevel(log.DebugLevel)
-		} else if lgr, ok := logger.(*log.Logger); ok {
-			progressWriter = lgr.WriterLevel(log.DebugLevel)
-		} else {
-			log.Errorf("Unable to get writer from logger (type=%T)", logger)
-			progressWriter = os.Stdout
-		}
-	}
-
-	cloneOptions := git.CloneOptions{
-		URL:      input.URL,
-		Progress: progressWriter,
-
-		InsecureSkipTLS: input.InsecureSkipTLS, // For Gitea
-	}
-	if input.Token != "" {
-		cloneOptions.Auth = &http.BasicAuth{
-			Username: "token",
-			Password: input.Token,
-		}
-	}
-
-	r, err = cloneAtDepth(ctx, input, cloneOptions, logger)
 	if err != nil {
-		logger.Errorf("Unable to clone %v %s: %v", input.URL, refName, err)
-		return nil, false, err
+		var progressWriter io.Writer
+		if isatty.IsTerminal(os.Stdout.Fd()) || isatty.IsCygwinTerminal(os.Stdout.Fd()) {
+			if entry, ok := logger.(*log.Entry); ok {
+				progressWriter = entry.WriterLevel(log.DebugLevel)
+			} else if lgr, ok := logger.(*log.Logger); ok {
+				progressWriter = lgr.WriterLevel(log.DebugLevel)
+			} else {
+				log.Errorf("Unable to get writer from logger (type=%T)", logger)
+				progressWriter = os.Stdout
+			}
+		}
+
+		cloneOptions := git.CloneOptions{
+			URL:      input.URL,
+			Progress: progressWriter,
+
+			InsecureSkipTLS: input.InsecureSkipTLS, // For Gitea
+		}
+		if input.Token != "" {
+			cloneOptions.Auth = &http.BasicAuth{
+				Username: "token",
+				Password: input.Token,
+			}
+		}
+
+		r, err = git.PlainCloneContext(ctx, input.Dir, false, &cloneOptions)
+		if err != nil {
+			logger.Errorf("Unable to clone %v %s: %v", input.URL, refName, err)
+			return nil, err
+		}
+
+		if err = os.Chmod(input.Dir, 0o755); err != nil {
+			return nil, err
+		}
 	}
 
-	if err = os.Chmod(input.Dir, 0o755); err != nil {
-		return nil, false, err
-	}
-
-	return r, false, nil
+	return r, nil
 }
 
 func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.PullOptions) {
@@ -351,17 +305,13 @@ func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.Pu
 func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		if input.Quiet {
-			logger.Debugf("git clone '%s' # ref=%s", input.URL, input.Ref)
-		} else {
-			logger.Infof("git clone '%s' # ref=%s", input.URL, input.Ref)
-		}
+		logger.Infof("  \u2601  git clone '%s' # ref=%s", input.URL, input.Ref)
 		logger.Debugf("  cloning %s to %s", input.URL, input.Dir)
 
-		defer AcquireCloneLock(input.Dir)()
+		defer acquireCloneLock(input.Dir)()
 
 		refName := plumbing.ReferenceName("refs/heads/" + input.Ref)
-		r, reused, err := CloneIfRequired(ctx, refName, input, logger)
+		r, err := CloneIfRequired(ctx, refName, input, logger)
 		if err != nil {
 			return err
 		}
@@ -376,16 +326,6 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 			pullOptions.InsecureSkipTLS = true
 		}
 
-		// Action clones only ever need the tip commit, so keep a shallow cache cheap on update at depth 1 regardless of its original depth
-		// Turning action_shallow_clone off does not convert an existing shallow cache; evict it for a full clone.
-		shallow := isShallow(r)
-		if shallow {
-			fetchOptions.Depth = 1
-			if spec, ok := shallowFetchRefSpec(r, input.Ref); ok {
-				fetchOptions.RefSpecs = []config.RefSpec{spec}
-			}
-		}
-
 		if !isOfflineMode {
 			err = r.Fetch(&fetchOptions)
 			if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
@@ -396,10 +336,10 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 		var hash *plumbing.Hash
 		rev := plumbing.Revision(input.Ref)
 		if hash, err = r.ResolveRevision(rev); err != nil {
-			// ResolveRevision returns a nil hash on error, and a branch ref legitimately fails
-			// here (no local refs/heads/<ref>); the duck-typing below resolves it.
 			logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
-		} else if hash.String() != input.Ref && strings.HasPrefix(hash.String(), input.Ref) {
+		}
+
+		if hash.String() != input.Ref && strings.HasPrefix(hash.String(), input.Ref) {
 			return &Error{
 				err:    ErrShortRef,
 				commit: hash.String(),
@@ -450,20 +390,12 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 				return err
 			}
 		}
-
-		reusedMsg := ""
-
-		switch {
-		case !isOfflineMode && !shallow:
-			// In shallow mode the depth-limited fetch above already advanced the ref.
+		if !isOfflineMode {
 			if err = w.Pull(&pullOptions); err != nil && err != git.NoErrAlreadyUpToDate {
 				logger.Debugf("Unable to pull %s: %v", refName, err)
 			}
-		case isOfflineMode && reused:
-			reusedMsg = " (reused in offline mode)"
 		}
-
-		logger.Debugf("Cloned %s to %s%s", input.URL, input.Dir, reusedMsg)
+		logger.Debugf("Cloned %s to %s", input.URL, input.Dir)
 
 		if hash.String() != input.Ref && refType == "branch" {
 			logger.Debugf("Provided ref is not a sha. Updating branch ref after pull")
@@ -492,53 +424,3 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 		return nil
 	}
 }
-
-// cloneAtDepth clones input.URL into input.Dir using opts.
-// With input.Depth > 0 it first tries a shallow, single-branch clone of input.Ref, falling back when error.
-func cloneAtDepth(ctx context.Context, input NewGitCloneExecutorInput, opts git.CloneOptions, logger log.FieldLogger) (*git.Repository, error) {
-	if input.Depth > 0 {
-		for _, refName := range []plumbing.ReferenceName{
-			plumbing.NewBranchReferenceName(input.Ref),
-			plumbing.NewTagReferenceName(input.Ref),
-		} {
-			shallowOpts := opts
-			shallowOpts.Depth = input.Depth
-			shallowOpts.SingleBranch = true
-			shallowOpts.ReferenceName = refName
-			shallowOpts.Tags = git.NoTags
-
-			r, err := git.PlainCloneContext(ctx, input.Dir, false, &shallowOpts)
-			if err == nil {
-				return r, nil
-			}
-			logger.Debugf("Shallow clone of %s as %s failed: %v", input.URL, refName, err)
-			if rmErr := os.RemoveAll(input.Dir); rmErr != nil {
-				return nil, fmt.Errorf("remove partial clone %s: %w", input.Dir, rmErr)
-			}
-		}
-		logger.Debugf("Falling back to a full clone of %s for ref %q", input.URL, input.Ref)
-	}
-
-	return git.PlainCloneContext(ctx, input.Dir, false, &opts)
-}
-
-// isShallow reports whether the local repository was cloned with a limited depth.
-func isShallow(r *git.Repository) bool {
-	shallows, err := r.Storer.Shallow()
-	return err == nil && len(shallows) > 0
-}
-
-// shallowFetchRefSpec returns the single refspec that updates only input.Ref, keeping a shallow clone from re-downloading every branch's history.
-// ok is false when the ref is not present locally as a tag or remote-tracking branch, in which case the broad default refspec is used.
-func shallowFetchRefSpec(r *git.Repository, ref string) (config.RefSpec, bool) {
-	tagRef := plumbing.NewTagReferenceName(ref)
-	if _, err := r.Reference(tagRef, false); err == nil {
-		return config.RefSpec(fmt.Sprintf("+%s:%s", tagRef, tagRef)), true
-	}
-	remoteRef := plumbing.NewRemoteReferenceName("origin", ref)
-	if _, err := r.Reference(remoteRef, false); err == nil {
-		branchRef := plumbing.NewBranchReferenceName(ref)
-		return config.RefSpec(fmt.Sprintf("+%s:%s", branchRef, remoteRef)), true
-	}
-	return "", false
-}

act/common/git/git_test.go

@@ -10,17 +10,13 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"sync"
 	"syscall"
 	"testing"
 	"time"
 
-	"gitea.com/gitea/runner/act/common"
-
 	log "github.com/sirupsen/logrus"
-	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -54,11 +50,8 @@ func TestFindGitSlug(t *testing.T) {
 	}
 }
 
-func TestErrorWrapsCommitAndCause(t *testing.T) {
-	err := &Error{err: ErrShortRef, commit: "abc123"}
-	require.Equal(t, ErrShortRef.Error(), err.Error())
-	require.ErrorIs(t, err, ErrShortRef)
-	require.Equal(t, "abc123", err.Commit())
+func testDir(t *testing.T) string {
+	return t.TempDir()
 }
 
 func cleanGitHooks(dir string) error {
@@ -85,7 +78,8 @@ func cleanGitHooks(dir string) error {
 func TestFindGitRemoteURL(t *testing.T) {
 	assert := assert.New(t)
 
-	basedir := t.TempDir()
+	basedir := testDir(t)
+	gitConfig()
 	err := gitCmd("init", basedir)
 	assert.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
 	err = cleanGitHooks(basedir)
@@ -107,24 +101,9 @@ func TestFindGitRemoteURL(t *testing.T) {
 	assert.Equal(remoteURL, u)
 }
 
-func TestFindGithubRepoUsesOriginAndCustomRemote(t *testing.T) {
-	basedir := t.TempDir()
-	require.NoError(t, gitCmd("init", basedir))
-	require.NoError(t, cleanGitHooks(basedir))
-	require.NoError(t, gitCmd("-C", basedir, "remote", "add", "origin", "https://github.com/owner/repo.git"))
-	require.NoError(t, gitCmd("-C", basedir, "remote", "add", "ghe", "git@git.example.com:team/project.git"))
-
-	slug, err := FindGithubRepo(context.Background(), basedir, "github.com", "")
-	require.NoError(t, err)
-	require.Equal(t, "owner/repo", slug)
-
-	slug, err = FindGithubRepo(context.Background(), basedir, "git.example.com", "ghe")
-	require.NoError(t, err)
-	require.Equal(t, "team/project", slug)
-}
-
 func TestGitFindRef(t *testing.T) {
-	basedir := t.TempDir()
+	basedir := testDir(t)
+	gitConfig()
 
 	for name, tt := range map[string]struct {
 		Prepare func(t *testing.T, dir string)
@@ -201,55 +180,36 @@ func TestGitFindRef(t *testing.T) {
 }
 
 func TestGitCloneExecutor(t *testing.T) {
-	// Build a local bare "remote" so this runs offline and fast. The cases below mirror
-	// the tag/branch/sha/short-sha ref paths the executor handles, formerly exercised by
-	// cloning actions/checkout and anchore/scan-action over the network.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v2"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v2"))
-
-	// A branch with a dash in the name (mirrors the historical scan-action@act-fails case).
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "act-fails"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "branch-commit"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "act-fails"))
-
-	out, err := exec.Command("git", "-C", workDir, "rev-parse", "main").Output()
-	require.NoError(t, err)
-	fullSha := strings.TrimSpace(string(out))
-
 	for name, tt := range map[string]struct {
-		Err error
-		Ref string
+		Err      error
+		URL, Ref string
 	}{
 		"tag": {
 			Err: nil,
+			URL: "https://github.com/actions/checkout",
 			Ref: "v2",
 		},
 		"branch": {
 			Err: nil,
+			URL: "https://github.com/anchore/scan-action",
 			Ref: "act-fails",
 		},
 		"sha": {
 			Err: nil,
-			Ref: fullSha,
+			URL: "https://github.com/actions/checkout",
+			Ref: "5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f", // v2
 		},
 		"short-sha": {
-			Err: &Error{ErrShortRef, fullSha},
-			Ref: fullSha[:7],
+			Err: &Error{ErrShortRef, "5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f"},
+			URL: "https://github.com/actions/checkout",
+			Ref: "5a4ac90", // v2
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			clone := NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL: remoteDir,
+				URL: tt.URL,
 				Ref: tt.Ref,
-				Dir: t.TempDir(),
+				Dir: testDir(t),
 			})
 
 			err := clone(context.Background())
@@ -263,56 +223,13 @@ func TestGitCloneExecutor(t *testing.T) {
 	}
 }
 
-func TestGitCloneExecutorReclonesWhenOriginURLChanges(t *testing.T) {
-	createRemote := func(message string) string {
-		remoteDir := t.TempDir()
-		require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-
-		workDir := t.TempDir()
-		require.NoError(t, gitCmd("clone", remoteDir, workDir))
-		require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", message))
-		require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-		return remoteDir
-	}
-
-	oldRemoteDir := createRemote("old-action")
-	newRemoteDir := createRemote("new-action")
-	cacheDir := t.TempDir()
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: oldRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	markerPath := filepath.Join(cacheDir, "stale-marker")
-	require.NoError(t, os.WriteFile(markerPath, []byte("stale"), 0o644))
-
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: newRemoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(t.Context()))
-
-	originURL, err := findGitRemoteURL(t.Context(), cacheDir, "origin")
-	require.NoError(t, err)
-	assert.Equal(t, newRemoteDir, originURL)
-
-	out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	assert.Equal(t, "new-action", strings.TrimSpace(string(out)))
-
-	_, err = os.Stat(markerPath)
-	require.True(t, os.IsNotExist(err), "stale cached directory should be removed before recloning")
-}
-
 func TestGitCloneExecutorNonFastForwardRef(t *testing.T) {
 	// Simulate the scenario where a remote ref (e.g. a GitHub PR head ref) changes
 	// non-fast-forward between two fetches. Before the fix, the fetch used Force=false,
 	// causing go-git to return ErrForceNeeded and short-circuit the checkout.
 
+	gitConfig()
+
 	// Create a bare "remote" repo with an initial commit on main and a feature branch.
 	remoteDir := t.TempDir()
 	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
@@ -362,195 +279,22 @@ func TestGitCloneExecutorNonFastForwardRef(t *testing.T) {
 	assert.Equal(t, "second", strings.TrimSpace(string(out)), "working tree should be at the latest commit")
 }
 
-func TestGitCloneExecutorOfflineMode(t *testing.T) {
-	// Build a local "remote" with a single commit on main.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Prime the cache with an online clone of main.
-	cacheDir := t.TempDir()
-	require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-		URL: remoteDir,
-		Ref: "main",
-		Dir: cacheDir,
-	})(context.Background()))
-
-	t.Run("cached branch resolves without fetching", func(t *testing.T) {
-		// Offline reuse of a cached branch must succeed even though ResolveRevision(input.Ref)
-		// finds no local refs/heads/<ref>.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "main",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.NoError(t, err)
-
-		out, err := exec.Command("git", "-C", cacheDir, "log", "--oneline", "-1", "--format=%s").Output()
-		require.NoError(t, err)
-		assert.Equal(t, "initial", strings.TrimSpace(string(out)))
-	})
-
-	t.Run("unresolvable cached ref returns error", func(t *testing.T) {
-		// The ref was never cached; offline mode cannot resolve it and must return an error.
-		err := NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL:         remoteDir,
-			Ref:         "never-fetched",
-			Dir:         cacheDir,
-			OfflineMode: true,
-		})(context.Background())
-		require.Error(t, err)
-	})
-}
-
-func TestGitCloneExecutorQuietDemotesCloneLine(t *testing.T) {
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "initial"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-
-	// Quiet callers report the download themselves, so the clone line must not reach the job log.
-	for name, quiet := range map[string]bool{"quiet": true, "not quiet": false} {
-		t.Run(name, func(t *testing.T) {
-			logger, hook := logrustest.NewNullLogger()
-			logger.SetLevel(log.InfoLevel)
-			ctx := common.WithLogger(context.Background(), logger.WithField("job", "j1"))
-
-			require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL:   remoteDir,
-				Ref:   "main",
-				Dir:   t.TempDir(),
-				Quiet: quiet,
-			})(ctx))
-
-			var cloneLines int
-			for _, entry := range hook.AllEntries() {
-				if strings.HasPrefix(entry.Message, "git clone ") {
-					cloneLines++
-				}
-			}
-			if quiet {
-				assert.Zero(t, cloneLines)
-			} else {
-				assert.Equal(t, 1, cloneLines)
-			}
-		})
+func gitConfig() {
+	if os.Getenv("GITHUB_ACTIONS") == "true" {
+		var err error
+		if err = gitCmd("config", "--global", "user.email", "test@test.com"); err != nil {
+			log.Error(err)
+		}
+		if err = gitCmd("config", "--global", "user.name", "Unit Test"); err != nil {
+			log.Error(err)
+		}
 	}
 }
 
-func TestGitCloneExecutorShallow(t *testing.T) {
-	// Build a local "remote" with several commits on main plus a tag, so a full clone would pull noticeably more history than a shallow one.
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	for _, m := range []string{"c1", "c2", "c3"} {
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", m))
-	}
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v1"))
-	sha := gitRevParse(t, workDir, "HEAD~1") // c2, a SHA that go-git cannot shallow-clone
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v1"))
-
-	shallowMarker := func(dir string) string { return filepath.Join(dir, ".git", "shallow") }
-
-	t.Run("branch is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir), "only the tip commit should be present")
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("tag is cloned shallowly", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "v1", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.FileExists(t, shallowMarker(dir), "clone should be shallow")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-		assert.Equal(t, "c3", gitHeadSubject(t, dir))
-	})
-
-	t.Run("SHA falls back to a full clone", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: sha, Dir: dir, Depth: 1,
-		})(t.Context()))
-		// go-git cannot shallow-clone a raw SHA, so it falls back to a full clone; the absence of a shallow marker proves the fallback happened.
-		assert.NoFileExists(t, shallowMarker(dir), "a SHA ref must not produce a shallow clone")
-		assert.Equal(t, sha, gitRevParse(t, dir, "HEAD"))
-	})
-
-	t.Run("moving branch updates while staying shallow", func(t *testing.T) {
-		dir := t.TempDir()
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		require.Equal(t, "c3", gitHeadSubject(t, dir))
-
-		// Advance main on the remote, then reuse the existing shallow clone.
-		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "c4"))
-		require.NoError(t, gitCmd("-C", workDir, "push", "origin", "main"))
-
-		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: remoteDir, Ref: "main", Dir: dir, Depth: 1,
-		})(t.Context()))
-		assert.Equal(t, "c4", gitHeadSubject(t, dir), "reused shallow clone should update to the new tip")
-		assert.FileExists(t, shallowMarker(dir), "repo should remain shallow after update")
-		assert.Equal(t, 1, gitRevCount(t, dir))
-	})
-}
-
-func gitRevParse(t *testing.T, dir, rev string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-parse", rev).Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
-func gitRevCount(t *testing.T, dir string) int {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--count", "HEAD").Output()
-	require.NoError(t, err)
-	n, err := strconv.Atoi(strings.TrimSpace(string(out)))
-	require.NoError(t, err)
-	return n
-}
-
-func gitHeadSubject(t *testing.T, dir string) string {
-	t.Helper()
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%s").Output()
-	require.NoError(t, err)
-	return strings.TrimSpace(string(out))
-}
-
 func gitCmd(args ...string) error {
 	cmd := exec.Command("git", args...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
-	// Inject a deterministic identity and ignore the host's global/system config so commits
-	// succeed regardless of the host having no user.name/user.email (e.g. CI, GITHUB_ACTIONS
-	// unset) or a global commit.gpgsign, and without mutating the developer's ~/.gitconfig.
-	cmd.Env = append(os.Environ(),
-		"GIT_AUTHOR_NAME=Unit Test",
-		"GIT_AUTHOR_EMAIL=test@test.com",
-		"GIT_COMMITTER_NAME=Unit Test",
-		"GIT_COMMITTER_EMAIL=test@test.com",
-		"GIT_CONFIG_GLOBAL=/dev/null",
-		"GIT_CONFIG_SYSTEM=/dev/null",
-	)
 
 	err := cmd.Run()
 	if exitError, ok := err.(*exec.ExitError); ok {
@@ -566,11 +310,11 @@ func TestAcquireCloneLock(t *testing.T) {
 	t.Run("same directory serializes", func(t *testing.T) {
 		dir := t.TempDir()
 
-		unlock1 := AcquireCloneLock(dir)
+		unlock1 := acquireCloneLock(dir)
 
 		secondAcquired := make(chan struct{})
 		go func() {
-			unlock := AcquireCloneLock(dir)
+			unlock := acquireCloneLock(dir)
 			close(secondAcquired)
 			unlock()
 		}()
@@ -594,12 +338,12 @@ func TestAcquireCloneLock(t *testing.T) {
 		dirA := t.TempDir()
 		dirB := t.TempDir()
 
-		unlockA := AcquireCloneLock(dirA)
+		unlockA := acquireCloneLock(dirA)
 		defer unlockA()
 
 		done := make(chan struct{})
 		go func() {
-			unlock := AcquireCloneLock(dirB)
+			unlock := acquireCloneLock(dirB)
 			unlock()
 			close(done)
 		}()

act/common/job_error.go

@@ -24,9 +24,7 @@ func JobError(ctx context.Context) error {
 }
 
 func SetJobError(ctx context.Context, err error) {
-	if container, ok := ctx.Value(jobErrorContextKeyVal).(map[string]error); ok {
-		container["error"] = err
-	}
+	ctx.Value(jobErrorContextKeyVal).(map[string]error)["error"] = err
 }
 
 // WithJobErrorContainer adds a value to the context as a container for an error

act/common/line_writer.go

@@ -12,13 +12,6 @@ import (
 // LineHandler is a callback function for handling a line
 type LineHandler func(line string) bool
 
-// Flusher is implemented by writers that buffer a trailing, not-yet-terminated
-// line. Callers should flush once the underlying stream has reached EOF so the
-// final line (when it is not newline-terminated) is not lost.
-type Flusher interface {
-	Flush()
-}
-
 type lineWriter struct {
 	buffer   bytes.Buffer
 	handlers []LineHandler
@@ -31,14 +24,6 @@ func NewLineWriter(handlers ...LineHandler) io.Writer {
 	return w
 }
 
-// FlushWriter flushes w if it implements Flusher. It is a no-op otherwise, so
-// callers can flush an io.Writer without knowing its concrete type.
-func FlushWriter(w io.Writer) {
-	if f, ok := w.(Flusher); ok {
-		f.Flush()
-	}
-}
-
 func (lw *lineWriter) Write(p []byte) (n int, err error) {
 	pBuf := bytes.NewBuffer(p)
 	written := 0
@@ -59,17 +44,6 @@ func (lw *lineWriter) Write(p []byte) (n int, err error) {
 	return written, nil
 }
 
-// Flush emits any buffered, not-yet-newline-terminated content as a final line.
-// It is safe to call multiple times; subsequent calls with an empty buffer are
-// no-ops.
-func (lw *lineWriter) Flush() {
-	if lw.buffer.Len() == 0 {
-		return
-	}
-	lw.handleLine(lw.buffer.String())
-	lw.buffer.Reset()
-}
-
 func (lw *lineWriter) handleLine(line string) {
 	for _, h := range lw.handlers {
 		ok := h(line)

act/common/line_writer_test.go

@@ -5,7 +5,6 @@
 package common
 
 import (
-	"io"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -40,33 +39,3 @@ func TestLineWriter(t *testing.T) {
 	assert.Equal(" and another\n", lines[2])
 	assert.Equal("last line\n", lines[3])
 }
-
-func TestLineWriterFlush(t *testing.T) {
-	lines := make([]string, 0)
-	lineHandler := func(s string) bool {
-		lines = append(lines, s)
-		return true
-	}
-
-	lineWriter := NewLineWriter(lineHandler)
-
-	assert := assert.New(t)
-	_, err := lineWriter.Write([]byte("complete line\npartial line without newline"))
-	assert.NoError(err) //nolint:testifylint // pre-existing pattern from nektos/act
-
-	// Only the newline-terminated line is emitted before flushing.
-	assert.Equal([]string{"complete line\n"}, lines)
-
-	// Flushing emits the buffered, not-yet-terminated trailing line.
-	FlushWriter(lineWriter)
-	assert.Equal([]string{"complete line\n", "partial line without newline"}, lines)
-
-	// Flushing again is a no-op: nothing is buffered.
-	FlushWriter(lineWriter)
-	assert.Len(lines, 2)
-}
-
-func TestFlushWriterIgnoresNonFlusher(t *testing.T) {
-	// FlushWriter must be a safe no-op for writers that do not buffer lines.
-	assert.NotPanics(t, func() { FlushWriter(io.Discard) })
-}

act/container/container_types.go

@@ -47,7 +47,6 @@ type NewContainerInput struct {
 	// Gitea specific
 	AutoRemove   bool
 	ValidVolumes []string
-	AllocatePTY  bool // allocate a pseudo-TTY for the container's exec processes
 }
 
 // FileEntry is a file to copy to a container
@@ -84,12 +83,6 @@ type NewDockerBuildExecutorInput struct {
 	Platform     string
 }
 
-// NewDockerNetworkCreateExecutorInput the input for the NewDockerNetworkCreateExecutor function
-type NewDockerNetworkCreateExecutorInput struct {
-	EnableIPv4 *bool
-	EnableIPv6 *bool
-}
-
 // NewDockerPullExecutorInput the input for the NewDockerPullExecutor function
 type NewDockerPullExecutorInput struct {
 	Image     string

act/container/docker_auth.go

@@ -8,33 +8,34 @@ package container
 
 import (
 	"context"
+	"strings"
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/distribution/reference"
 	"github.com/docker/cli/cli/config"
-	"github.com/moby/moby/api/types/registry"
+	"github.com/docker/cli/cli/config/credentials"
+	"github.com/docker/docker/api/types/registry"
 )
 
 func LoadDockerAuthConfig(ctx context.Context, image string) (registry.AuthConfig, error) {
 	logger := common.Logger(ctx)
-	// config.LoadDefaultConfigFile panics on nil io.Writer when the config
-	// file is malformed; use config.Load to route errors through the logger.
-	cfg, err := config.Load(config.Dir())
+	config, err := config.Load(config.Dir())
 	if err != nil {
 		logger.Warnf("Could not load docker config: %v", err)
 		return registry.AuthConfig{}, err
 	}
-	registryKey := registryAuthConfigKey("docker.io")
-	if image != "" {
-		if registryRef, refErr := reference.ParseNormalizedNamed(image); refErr != nil {
-			logger.Warnf("Could not normalize image reference: %v", refErr)
-		} else {
-			registryKey = registryAuthConfigKey(reference.Domain(registryRef))
-		}
+
+	if !config.ContainsAuth() {
+		config.CredentialsStore = credentials.DetectDefaultStore(config.CredentialsStore)
 	}
 
-	authConfig, err := cfg.GetAuthConfig(registryKey)
+	hostName := "index.docker.io"
+	index := strings.IndexRune(image, '/')
+	if index > -1 && (strings.ContainsAny(image[:index], ".:") || image[:index] == "localhost") {
+		hostName = image[:index]
+	}
+
+	authConfig, err := config.GetAuthConfig(hostName)
 	if err != nil {
 		logger.Warnf("Could not get auth config from docker config: %v", err)
 		return registry.AuthConfig{}, err
@@ -45,16 +46,17 @@ func LoadDockerAuthConfig(ctx context.Context, image string) (registry.AuthConfi
 
 func LoadDockerAuthConfigs(ctx context.Context) map[string]registry.AuthConfig {
 	logger := common.Logger(ctx)
-	cfg, err := config.Load(config.Dir())
+	config, err := config.Load(config.Dir())
 	if err != nil {
 		logger.Warnf("Could not load docker config: %v", err)
 		return nil
 	}
-	creds, err := cfg.GetAllCredentials()
-	if err != nil {
-		logger.Warnf("Could not get docker auth configs: %v", err)
-		return nil
+
+	if !config.ContainsAuth() {
+		config.CredentialsStore = credentials.DetectDefaultStore(config.CredentialsStore)
 	}
+
+	creds, _ := config.GetAllCredentials()
 	authConfigs := make(map[string]registry.AuthConfig, len(creds))
 	for k, v := range creds {
 		authConfigs[k] = registry.AuthConfig(v)
@@ -62,10 +64,3 @@ func LoadDockerAuthConfigs(ctx context.Context) map[string]registry.AuthConfig {
 
 	return authConfigs
 }
-
-func registryAuthConfigKey(domainName string) string {
-	if domainName == "docker.io" || domainName == "index.docker.io" {
-		return "https://index.docker.io/v1/"
-	}
-	return domainName
-}

act/container/docker_build.go

@@ -14,12 +14,10 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/go-archive"
-	"github.com/moby/go-archive/compression"
-	"github.com/moby/moby/client"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/moby/buildkit/frontend/dockerfile/dockerignore"
 	"github.com/moby/patternmatcher"
-	"github.com/moby/patternmatcher/ignorefile"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // NewDockerBuildExecutor function to create a run executor for the container
@@ -27,9 +25,9 @@ func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		if input.Platform != "" {
-			logger.Infof("docker build -t %s --platform %s %s", input.ImageTag, input.Platform, input.ContextDir)
+			logger.Infof("%sdocker build -t %s --platform %s %s", logPrefix, input.ImageTag, input.Platform, input.ContextDir)
 		} else {
-			logger.Infof("docker build -t %s %s", input.ImageTag, input.ContextDir)
+			logger.Infof("%sdocker build -t %s %s", logPrefix, input.ImageTag, input.ContextDir)
 		}
 		if common.Dryrun(ctx) {
 			return nil
@@ -44,19 +42,13 @@ func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 		logger.Debugf("Building image from '%v'", input.ContextDir)
 
 		tags := []string{input.ImageTag}
-		options := client.ImageBuildOptions{
+		options := types.ImageBuildOptions{
 			Tags:        tags,
 			Remove:      true,
+			Platform:    input.Platform,
 			AuthConfigs: LoadDockerAuthConfigs(ctx),
 			Dockerfile:  input.Dockerfile,
 		}
-		platform, err := parsePlatform(input.Platform)
-		if err != nil {
-			return err
-		}
-		if platform != nil {
-			options.Platforms = []specs.Platform{*platform}
-		}
 		var buildContext io.ReadCloser
 		if input.BuildContext != nil {
 			buildContext = io.NopCloser(input.BuildContext)
@@ -84,7 +76,7 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 	common.Logger(ctx).Debugf("Creating archive for build context dir '%s' with relative dockerfile '%s'", contextDir, relDockerfile)
 
 	// And canonicalize dockerfile name to a platform-independent one
-	relDockerfile = filepath.ToSlash(relDockerfile)
+	relDockerfile = archive.CanonicalTarNameForPath(relDockerfile)
 
 	f, err := os.Open(filepath.Join(contextDir, ".dockerignore"))
 	if err != nil && !os.IsNotExist(err) {
@@ -94,7 +86,7 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 
 	var excludes []string
 	if err == nil {
-		excludes, err = ignorefile.ReadAll(f)
+		excludes, err = dockerignore.ReadAll(f) //nolint:staticcheck // pre-existing issue from nektos/act
 		if err != nil {
 			return nil, err
 		}
@@ -114,8 +106,9 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 		includes = append(includes, ".dockerignore", relDockerfile)
 	}
 
+	compression := archive.Uncompressed
 	buildCtx, err := archive.TarWithOptions(contextDir, &archive.TarOptions{
-		Compression:     compression.None,
+		Compression:     compression,
 		ExcludePatterns: excludes,
 		IncludeFiles:    includes,
 	})

act/container/docker_cli_test.go

@@ -16,18 +16,15 @@ package container
 import (
 	"fmt"
 	"io"
-	"net/netip"
 	"os"
 	"runtime"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/docker/docker/api/types/container"
+	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/go-connections/nat"
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/moby/moby/api/types/container"
-	networktypes "github.com/moby/moby/api/types/network"
 	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
 	"gotest.tools/v3/assert"
@@ -80,21 +77,21 @@ func setupRunFlags() (*pflag.FlagSet, *containerOptions) {
 	return flags, copts
 }
 
-func mustParse(t *testing.T, args string) (*container.Config, *container.HostConfig, *networktypes.NetworkingConfig) {
+func mustParse(t *testing.T, args string) (*container.Config, *container.HostConfig) {
 	t.Helper()
-	config, hostConfig, networkingConfig, err := parseRun(append(strings.Split(args, " "), "ubuntu", "bash"))
+	config, hostConfig, _, err := parseRun(append(strings.Split(args, " "), "ubuntu", "bash"))
 	assert.NilError(t, err)
-	return config, hostConfig, networkingConfig
+	return config, hostConfig
 }
 
 func TestParseRunLinks(t *testing.T) {
-	if _, hostConfig, _ := mustParse(t, "--link a:b"); len(hostConfig.Links) == 0 || hostConfig.Links[0] != "a:b" {
+	if _, hostConfig := mustParse(t, "--link a:b"); len(hostConfig.Links) == 0 || hostConfig.Links[0] != "a:b" {
 		t.Fatalf("Error parsing links. Expected []string{\"a:b\"}, received: %v", hostConfig.Links)
 	}
-	if _, hostConfig, _ := mustParse(t, "--link a:b --link c:d"); len(hostConfig.Links) < 2 || hostConfig.Links[0] != "a:b" || hostConfig.Links[1] != "c:d" {
+	if _, hostConfig := mustParse(t, "--link a:b --link c:d"); len(hostConfig.Links) < 2 || hostConfig.Links[0] != "a:b" || hostConfig.Links[1] != "c:d" {
 		t.Fatalf("Error parsing links. Expected []string{\"a:b\", \"c:d\"}, received: %v", hostConfig.Links)
 	}
-	if _, hostConfig, _ := mustParse(t, ""); len(hostConfig.Links) != 0 {
+	if _, hostConfig := mustParse(t, ""); len(hostConfig.Links) != 0 {
 		t.Fatalf("Error parsing links. No link expected, received: %v", hostConfig.Links)
 	}
 }
@@ -143,7 +140,7 @@ func TestParseRunAttach(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.input, func(t *testing.T) {
-			config, _, _ := mustParse(t, tc.input)
+			config, _ := mustParse(t, tc.input)
 			assert.Equal(t, config.AttachStdin, tc.expected.AttachStdin)
 			assert.Equal(t, config.AttachStdout, tc.expected.AttachStdout)
 			assert.Equal(t, config.AttachStderr, tc.expected.AttachStderr)
@@ -197,10 +194,10 @@ func TestParseRunWithInvalidArgs(t *testing.T) {
 	}
 }
 
-func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from docker/cli tests
+func TestParseWithVolumes(t *testing.T) {
 	// A single volume
 	arr, tryit := setupPlatformVolume([]string{`/tmp`}, []string{`c:\tmp`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds != nil {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds != nil {
 		t.Fatalf("Error parsing volume flags, %q should not mount-bind anything. Received %v", tryit, hostConfig.Binds)
 	} else if _, exists := config.Volumes[arr[0]]; !exists {
 		t.Fatalf("Error parsing volume flags, %q is missing from volumes. Received %v", tryit, config.Volumes)
@@ -208,7 +205,7 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 
 	// Two volumes
 	arr, tryit = setupPlatformVolume([]string{`/tmp`, `/var`}, []string{`c:\tmp`, `c:\var`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds != nil {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds != nil {
 		t.Fatalf("Error parsing volume flags, %q should not mount-bind anything. Received %v", tryit, hostConfig.Binds)
 	} else if _, exists := config.Volumes[arr[0]]; !exists {
 		t.Fatalf("Error parsing volume flags, %s is missing from volumes. Received %v", arr[0], config.Volumes)
@@ -218,13 +215,13 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 
 	// A single bind mount
 	arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp`}, []string{os.Getenv("TEMP") + `:c:\containerTmp`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || hostConfig.Binds[0] != arr[0] {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || hostConfig.Binds[0] != arr[0] {
 		t.Fatalf("Error parsing volume flags, %q should mount-bind the path before the colon into the path after the colon. Received %v %v", arr[0], hostConfig.Binds, config.Volumes)
 	}
 
 	// Two bind mounts.
 	arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp`, `/hostVar:/containerVar`}, []string{os.Getenv("ProgramData") + `:c:\ContainerPD`, os.Getenv("TEMP") + `:c:\containerTmp`})
-	if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+	if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 		t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 	}
 
@@ -233,26 +230,26 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 	arr, tryit = setupPlatformVolume(
 		[]string{`/hostTmp:/containerTmp:ro`, `/hostVar:/containerVar:rw`},
 		[]string{os.Getenv("TEMP") + `:c:\containerTmp:rw`, os.Getenv("ProgramData") + `:c:\ContainerPD:rw`})
-	if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+	if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 		t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 	}
 
 	// Similar to previous test but with alternate modes which are only supported by Linux
 	if runtime.GOOS != "windows" {
 		arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp:ro,Z`, `/hostVar:/containerVar:rw,Z`}, []string{})
-		if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+		if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 			t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 		}
 
 		arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp:Z`, `/hostVar:/containerVar:z`}, []string{})
-		if _, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
+		if _, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || compareRandomizedStrings(hostConfig.Binds[0], hostConfig.Binds[1], arr[0], arr[1]) != nil {
 			t.Fatalf("Error parsing volume flags, `%s and %s` did not mount-bind correctly. Received %v", arr[0], arr[1], hostConfig.Binds)
 		}
 	}
 
 	// One bind mount and one volume
 	arr, tryit = setupPlatformVolume([]string{`/hostTmp:/containerTmp`, `/containerVar`}, []string{os.Getenv("TEMP") + `:c:\containerTmp`, `c:\containerTmp`})
-	if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] {
+	if config, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] {
 		t.Fatalf("Error parsing volume flags, %s and %s should only one and only one bind mount %s. Received %s", arr[0], arr[1], arr[0], hostConfig.Binds)
 	} else if _, exists := config.Volumes[arr[1]]; !exists {
 		t.Fatalf("Error parsing volume flags %s and %s. %s is missing from volumes. Received %v", arr[0], arr[1], arr[1], config.Volumes)
@@ -261,7 +258,7 @@ func TestParseWithVolumes(t *testing.T) { //nolint:gocyclo // verbatim copy from
 	// Root to non-c: drive letter (Windows specific)
 	if runtime.GOOS == "windows" {
 		arr, tryit = setupPlatformVolume([]string{}, []string{os.Getenv("SystemDrive") + `\:d:`})
-		if config, hostConfig, _ := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] || len(config.Volumes) != 0 {
+		if config, hostConfig := mustParse(t, tryit); hostConfig.Binds == nil || len(hostConfig.Binds) > 1 || hostConfig.Binds[0] != arr[0] || len(config.Volumes) != 0 {
 			t.Fatalf("Error parsing %s. Should have a single bind mount and no volumes", arr[0])
 		}
 	}
@@ -297,36 +294,6 @@ func compareRandomizedStrings(a, b, c, d string) error {
 	return errors.Errorf("strings don't match")
 }
 
-func mustNetworkPort(t *testing.T, value string) networktypes.Port {
-	t.Helper()
-
-	port, err := networktypes.ParsePort(value)
-	if err != nil {
-		t.Fatalf("failed to parse network port %q: %v", value, err)
-	}
-	return port
-}
-
-func mustAddr(t *testing.T, value string) netip.Addr {
-	t.Helper()
-
-	addr, err := netip.ParseAddr(value)
-	if err != nil {
-		t.Fatalf("failed to parse address %q: %v", value, err)
-	}
-	return addr
-}
-
-func mustAddrs(t *testing.T, values ...string) []netip.Addr {
-	t.Helper()
-
-	addrs := make([]netip.Addr, 0, len(values))
-	for _, value := range values {
-		addrs = append(addrs, mustAddr(t, value))
-	}
-	return addrs
-}
-
 // Simple parse with MacAddress validation
 func TestParseWithMacAddress(t *testing.T) {
 	invalidMacAddress := "--mac-address=invalidMacAddress"
@@ -334,10 +301,9 @@ func TestParseWithMacAddress(t *testing.T) {
 	if _, _, _, err := parseRun([]string{invalidMacAddress, "img", "cmd"}); err != nil && err.Error() != "invalidMacAddress is not a valid mac address" {
 		t.Fatalf("Expected an error with %v mac-address, got %v", invalidMacAddress, err)
 	}
-	_, hostConfig, networkingConfig := mustParse(t, validMacAddress)
-	endpoint := networkingConfig.EndpointsConfig[string(hostConfig.NetworkMode)]
-	assert.Check(t, endpoint != nil)
-	assert.Equal(t, "92:d0:c6:0a:29:33", endpoint.MacAddress.String())
+	if config, _ := mustParse(t, validMacAddress); config.MacAddress != "92:d0:c6:0a:29:33" { //nolint:staticcheck // pre-existing issue from nektos/act
+		t.Fatalf("Expected the config to have '92:d0:c6:0a:29:33' as MacAddress, got '%v'", config.MacAddress) //nolint:staticcheck // pre-existing issue from nektos/act
+	}
 }
 
 func TestRunFlagsParseWithMemory(t *testing.T) {
@@ -346,7 +312,7 @@ func TestRunFlagsParseWithMemory(t *testing.T) {
 	err := flags.Parse(args)
 	assert.ErrorContains(t, err, `invalid argument "invalid" for "-m, --memory" flag`)
 
-	_, hostconfig, _ := mustParse(t, "--memory=1G")
+	_, hostconfig := mustParse(t, "--memory=1G")
 	assert.Check(t, is.Equal(int64(1073741824), hostconfig.Memory))
 }
 
@@ -356,10 +322,10 @@ func TestParseWithMemorySwap(t *testing.T) {
 	err := flags.Parse(args)
 	assert.ErrorContains(t, err, `invalid argument "invalid" for "--memory-swap" flag`)
 
-	_, hostconfig, _ := mustParse(t, "--memory-swap=1G")
+	_, hostconfig := mustParse(t, "--memory-swap=1G")
 	assert.Check(t, is.Equal(int64(1073741824), hostconfig.MemorySwap))
 
-	_, hostconfig, _ = mustParse(t, "--memory-swap=-1")
+	_, hostconfig = mustParse(t, "--memory-swap=-1")
 	assert.Check(t, is.Equal(int64(-1), hostconfig.MemorySwap))
 }
 
@@ -374,14 +340,14 @@ func TestParseHostname(t *testing.T) {
 	hostnameWithDomain := "--hostname=hostname.domainname"
 	hostnameWithDomainTld := "--hostname=hostname.domainname.tld"
 	for hostname, expectedHostname := range validHostnames {
-		if config, _, _ := mustParse(t, "--hostname="+hostname); config.Hostname != expectedHostname {
+		if config, _ := mustParse(t, "--hostname="+hostname); config.Hostname != expectedHostname {
 			t.Fatalf("Expected the config to have 'hostname' as %q, got %q", expectedHostname, config.Hostname)
 		}
 	}
-	if config, _, _ := mustParse(t, hostnameWithDomain); config.Hostname != "hostname.domainname" || config.Domainname != "" {
+	if config, _ := mustParse(t, hostnameWithDomain); config.Hostname != "hostname.domainname" || config.Domainname != "" {
 		t.Fatalf("Expected the config to have 'hostname' as hostname.domainname, got %q", config.Hostname)
 	}
-	if config, _, _ := mustParse(t, hostnameWithDomainTld); config.Hostname != "hostname.domainname.tld" || config.Domainname != "" {
+	if config, _ := mustParse(t, hostnameWithDomainTld); config.Hostname != "hostname.domainname.tld" || config.Domainname != "" {
 		t.Fatalf("Expected the config to have 'hostname' as hostname.domainname.tld, got %q", config.Hostname)
 	}
 }
@@ -395,28 +361,26 @@ func TestParseHostnameDomainname(t *testing.T) {
 		"domainname-63-bytes-long-should-be-valid-and-without-any-errors": "domainname-63-bytes-long-should-be-valid-and-without-any-errors",
 	}
 	for domainname, expectedDomainname := range validDomainnames {
-		if config, _, _ := mustParse(t, "--domainname="+domainname); config.Domainname != expectedDomainname {
+		if config, _ := mustParse(t, "--domainname="+domainname); config.Domainname != expectedDomainname {
 			t.Fatalf("Expected the config to have 'domainname' as %q, got %q", expectedDomainname, config.Domainname)
 		}
 	}
-	if config, _, _ := mustParse(t, "--hostname=some.prefix --domainname=domainname"); config.Hostname != "some.prefix" || config.Domainname != "domainname" {
+	if config, _ := mustParse(t, "--hostname=some.prefix --domainname=domainname"); config.Hostname != "some.prefix" || config.Domainname != "domainname" {
 		t.Fatalf("Expected the config to have 'hostname' as 'some.prefix' and 'domainname' as 'domainname', got %q and %q", config.Hostname, config.Domainname)
 	}
-	if config, _, _ := mustParse(t, "--hostname=another-prefix --domainname=domainname.tld"); config.Hostname != "another-prefix" || config.Domainname != "domainname.tld" {
+	if config, _ := mustParse(t, "--hostname=another-prefix --domainname=domainname.tld"); config.Hostname != "another-prefix" || config.Domainname != "domainname.tld" {
 		t.Fatalf("Expected the config to have 'hostname' as 'another-prefix' and 'domainname' as 'domainname.tld', got %q and %q", config.Hostname, config.Domainname)
 	}
 }
 
 func TestParseWithExpose(t *testing.T) {
-	invalids := []string{
-		":",
-		"8080:9090",
-		"/tcp",
-		"/udp",
-		"NaN/tcp",
-		"NaN-NaN/tcp",
-		"8080-NaN/tcp",
-		"1234567890-8080/tcp",
+	invalids := map[string]string{
+		":":                   "invalid port format for --expose: :",
+		"8080:9090":           "invalid port format for --expose: 8080:9090",
+		"NaN/tcp":             `invalid range format for --expose: NaN/tcp, error: strconv.ParseUint: parsing "NaN": invalid syntax`,
+		"NaN-NaN/tcp":         `invalid range format for --expose: NaN-NaN/tcp, error: strconv.ParseUint: parsing "NaN": invalid syntax`,
+		"8080-NaN/tcp":        `invalid range format for --expose: 8080-NaN/tcp, error: strconv.ParseUint: parsing "NaN": invalid syntax`,
+		"1234567890-8080/tcp": `invalid range format for --expose: 1234567890-8080/tcp, error: strconv.ParseUint: parsing "1234567890": value out of range`,
 	}
 	valids := map[string][]nat.Port{
 		"8080/tcp":      {"8080/tcp"},
@@ -425,9 +389,9 @@ func TestParseWithExpose(t *testing.T) {
 		"8080-8080/udp": {"8080/udp"},
 		"8080-8082/tcp": {"8080/tcp", "8081/tcp", "8082/tcp"},
 	}
-	for _, expose := range invalids {
-		if _, _, _, err := parseRun([]string{fmt.Sprintf("--expose=%v", expose), "img", "cmd"}); err == nil {
-			t.Fatalf("Expected error with '--expose=%v', got none", expose)
+	for expose, expectedError := range invalids {
+		if _, _, _, err := parseRun([]string{fmt.Sprintf("--expose=%v", expose), "img", "cmd"}); err == nil || err.Error() != expectedError {
+			t.Fatalf("Expected error '%v' with '--expose=%v', got '%v'", expectedError, expose, err)
 		}
 	}
 	for expose, exposedPorts := range valids {
@@ -439,7 +403,7 @@ func TestParseWithExpose(t *testing.T) {
 			t.Fatalf("Expected %v exposed port, got %v", len(exposedPorts), len(config.ExposedPorts))
 		}
 		for _, port := range exposedPorts {
-			if _, ok := config.ExposedPorts[mustNetworkPort(t, string(port))]; !ok {
+			if _, ok := config.ExposedPorts[port]; !ok {
 				t.Fatalf("Expected %v, got %v", exposedPorts, config.ExposedPorts)
 			}
 		}
@@ -454,7 +418,7 @@ func TestParseWithExpose(t *testing.T) {
 	}
 	ports := []nat.Port{"80/tcp", "81/tcp"}
 	for _, port := range ports {
-		if _, ok := config.ExposedPorts[mustNetworkPort(t, string(port))]; !ok {
+		if _, ok := config.ExposedPorts[port]; !ok {
 			t.Fatalf("Expected %v, got %v", ports, config.ExposedPorts)
 		}
 	}
@@ -498,79 +462,6 @@ func TestParseDevice(t *testing.T) {
 	}
 }
 
-func TestParseDeviceByServerOS(t *testing.T) {
-	tests := []struct {
-		name     string
-		device   string
-		serverOS string
-		want     container.DeviceMapping
-		wantErr  string
-	}{
-		{
-			name:     "linux source only",
-			device:   "/dev/snd",
-			serverOS: "linux",
-			want: container.DeviceMapping{
-				PathOnHost:        "/dev/snd",
-				PathInContainer:   "/dev/snd",
-				CgroupPermissions: "rwm",
-			},
-		},
-		{
-			name:     "linux source and mode",
-			device:   "/dev/snd:rw",
-			serverOS: "linux",
-			want: container.DeviceMapping{
-				PathOnHost:        "/dev/snd",
-				PathInContainer:   "/dev/snd",
-				CgroupPermissions: "rw",
-			},
-		},
-		{
-			name:     "linux source target and mode",
-			device:   "/dev/snd:/container/snd:m",
-			serverOS: "linux",
-			want: container.DeviceMapping{
-				PathOnHost:        "/dev/snd",
-				PathInContainer:   "/container/snd",
-				CgroupPermissions: "m",
-			},
-		},
-		{
-			name:     "windows passes value through",
-			device:   `class/GUID`,
-			serverOS: "windows",
-			want: container.DeviceMapping{
-				PathOnHost: `class/GUID`,
-			},
-		},
-		{
-			name:     "invalid server OS",
-			device:   "/dev/snd",
-			serverOS: "plan9",
-			wantErr:  "unknown server OS: plan9",
-		},
-		{
-			name:     "too many linux fields",
-			device:   "/dev/snd:/container/snd:rw:extra",
-			serverOS: "linux",
-			wantErr:  "invalid device specification: /dev/snd:/container/snd:rw:extra",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := parseDevice(tc.device, tc.serverOS)
-			if tc.wantErr != "" {
-				assert.Error(t, err, tc.wantErr)
-				return
-			}
-			assert.NilError(t, err)
-			assert.Equal(t, got, tc.want)
-		})
-	}
-}
-
 func TestParseNetworkConfig(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -607,9 +498,9 @@ func TestParseNetworkConfig(t *testing.T) {
 			expected: map[string]*networktypes.EndpointSettings{
 				"net1": {
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address:  mustAddr(t, "172.20.88.22"),
-						IPv6Address:  mustAddr(t, "2001:db8::8822"),
-						LinkLocalIPs: mustAddrs(t, "169.254.2.2", "fe80::169:254:2:2"),
+						IPv4Address:  "172.20.88.22",
+						IPv6Address:  "2001:db8::8822",
+						LinkLocalIPs: []string{"169.254.2.2", "fe80::169:254:2:2"},
 					},
 					Links:   []string{"foo:bar", "bar:baz"},
 					Aliases: []string{"web1", "web2"},
@@ -636,9 +527,9 @@ func TestParseNetworkConfig(t *testing.T) {
 				"net1": {
 					DriverOpts: map[string]string{"field1": "value1"},
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address:  mustAddr(t, "172.20.88.22"),
-						IPv6Address:  mustAddr(t, "2001:db8::8822"),
-						LinkLocalIPs: mustAddrs(t, "169.254.2.2", "fe80::169:254:2:2"),
+						IPv4Address:  "172.20.88.22",
+						IPv6Address:  "2001:db8::8822",
+						LinkLocalIPs: []string{"169.254.2.2", "fe80::169:254:2:2"},
 					},
 					Links:   []string{"foo:bar", "bar:baz"},
 					Aliases: []string{"web1", "web2"},
@@ -647,8 +538,8 @@ func TestParseNetworkConfig(t *testing.T) {
 				"net3": {
 					DriverOpts: map[string]string{"field3": "value3"},
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address: mustAddr(t, "172.20.88.22"),
-						IPv6Address: mustAddr(t, "2001:db8::8822"),
+						IPv4Address: "172.20.88.22",
+						IPv6Address: "2001:db8::8822",
 					},
 					Aliases: []string{"web3"},
 				},
@@ -665,8 +556,8 @@ func TestParseNetworkConfig(t *testing.T) {
 						"field2": "value2",
 					},
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
-						IPv4Address: mustAddr(t, "172.20.88.22"),
-						IPv6Address: mustAddr(t, "2001:db8::8822"),
+						IPv4Address: "172.20.88.22",
+						IPv6Address: "2001:db8::8822",
 					},
 					Aliases: []string{"web1", "web2"},
 				},
@@ -719,9 +610,7 @@ func TestParseNetworkConfig(t *testing.T) {
 
 			assert.NilError(t, err)
 			assert.DeepEqual(t, hConfig.NetworkMode, tc.expectedCfg.NetworkMode)
-			if diff := cmp.Diff(tc.expected, nwConfig.EndpointsConfig, cmpopts.EquateComparable(netip.Addr{})); diff != "" {
-				t.Fatalf("unexpected endpoints (-want +got):\n%s", diff)
-			}
+			assert.DeepEqual(t, nwConfig.EndpointsConfig, tc.expected)
 		})
 	}
 }
@@ -742,7 +631,7 @@ func TestParseModes(t *testing.T) {
 	}
 
 	// uts ko
-	_, _, _, err = parseRun([]string{"--uts=container:", "img", "cmd"}) //nolint:dogsled // verbatim copy from docker/cli tests
+	_, _, _, err = parseRun([]string{"--uts=container:", "img", "cmd"})
 	assert.ErrorContains(t, err, "--uts: invalid UTS mode")
 
 	// uts ok
@@ -802,9 +691,10 @@ func TestParseRestartPolicy(t *testing.T) {
 }
 
 func TestParseRestartPolicyAutoRemove(t *testing.T) {
-	_, _, _, err := parseRun([]string{"--rm", "--restart=always", "img", "cmd"}) //nolint:dogsled // verbatim copy from docker/cli tests
-	if err == nil {
-		t.Fatal("Expected error for conflicting --restart and --rm, but got none")
+	expected := "Conflicting options: --restart and --rm"
+	_, _, _, err := parseRun([]string{"--rm", "--restart=always", "img", "cmd"})
+	if err == nil || err.Error() != expected {
+		t.Fatalf("Expected error %v, but got none", expected)
 	}
 }
 
@@ -862,7 +752,7 @@ func TestParseLoggingOpts(t *testing.T) {
 	}
 }
 
-func TestParseEnvfileVariables(t *testing.T) { //nolint:dupl // verbatim copy from docker/cli tests
+func TestParseEnvfileVariables(t *testing.T) { //nolint:dupl // pre-existing issue from nektos/act
 	e := "open nonexistent: no such file or directory"
 	if runtime.GOOS == "windows" {
 		e = "open nonexistent: The system cannot find the file specified."
@@ -905,7 +795,7 @@ func TestParseEnvfileVariablesWithBOMUnicode(t *testing.T) {
 	}
 
 	// UTF16 with BOM
-	e := "invalid env file"
+	e := "contains invalid utf8 bytes at line"
 	if _, _, _, err := parseRun([]string{"--env-file=testdata/utf16.env", "img", "cmd"}); err == nil || !strings.Contains(err.Error(), e) {
 		t.Fatalf("Expected an error with message '%s', got %v", e, err)
 	}
@@ -915,7 +805,7 @@ func TestParseEnvfileVariablesWithBOMUnicode(t *testing.T) {
 	}
 }
 
-func TestParseLabelfileVariables(t *testing.T) { //nolint:dupl // verbatim copy from docker/cli tests
+func TestParseLabelfileVariables(t *testing.T) { //nolint:dupl // pre-existing issue from nektos/act
 	e := "open nonexistent: no such file or directory"
 	if runtime.GOOS == "windows" {
 		e = "open nonexistent: The system cannot find the file specified."
@@ -1003,82 +893,6 @@ func TestValidateDevice(t *testing.T) {
 	}
 }
 
-func TestValidateDeviceByServerOS(t *testing.T) {
-	tests := []struct {
-		name      string
-		value     string
-		serverOS  string
-		want      string
-		wantError string
-	}{
-		{
-			name:     "linux preserves three-field container path",
-			value:    "/host:/container/../device:rw",
-			serverOS: "linux",
-			want:     "/host:/container/../device:rw",
-		},
-		{
-			name:     "linux source path can be relative when target is absolute",
-			value:    "relative-host:/container/device",
-			serverOS: "linux",
-			want:     "relative-host:/container/device",
-		},
-		{
-			name:     "windows defers validation",
-			value:    `class/GUID`,
-			serverOS: "windows",
-			want:     `class/GUID`,
-		},
-		{
-			name:      "linux rejects bad mode",
-			value:     "/host:/container:ro",
-			serverOS:  "linux",
-			wantError: "bad mode specified: ro",
-		},
-		{
-			name:      "linux target must be absolute",
-			value:     "/host:relative",
-			serverOS:  "linux",
-			wantError: "relative is not an absolute path",
-		},
-		{
-			name:      "unknown server OS",
-			value:     "/dev/snd",
-			serverOS:  "plan9",
-			wantError: "unknown server OS: plan9",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := validateDevice(tc.value, tc.serverOS)
-			if tc.wantError != "" {
-				assert.Error(t, err, tc.wantError)
-				return
-			}
-			assert.NilError(t, err)
-			assert.Equal(t, got, tc.want)
-		})
-	}
-}
-
-func TestDeviceCgroupRulesAndInvalidParameter(t *testing.T) {
-	got, err := validateDeviceCgroupRule("c 1:3 rwm")
-	assert.NilError(t, err)
-	assert.Equal(t, got, "c 1:3 rwm")
-
-	_, err = validateDeviceCgroupRule("invalid")
-	assert.Error(t, err, "invalid device cgroup format 'invalid'")
-
-	if invalidParameter(nil) != nil {
-		t.Fatal("invalidParameter(nil) should be nil")
-	}
-	err = invalidParameter(errors.New("bad input"))
-	assert.Assert(t, err != nil)
-	var invalid interface{ InvalidParameter() }
-	assert.Assert(t, errors.As(err, &invalid))
-}
-
 func TestParseSystemPaths(t *testing.T) {
 	tests := []struct {
 		doc                       string

act/container/docker_create_flags.go

@@ -1,86 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"slices"
-
-	"github.com/kballard/go-shellquote"
-	"github.com/spf13/pflag"
-)
-
-const (
-	pullPolicyAlways  = "always"
-	pullPolicyMissing = "missing"
-	pullPolicyNever   = "never"
-)
-
-var pullPolicies = []string{pullPolicyAlways, pullPolicyMissing, pullPolicyNever}
-
-// createFlags are the flags docker/cli registers on the `create` and `run` commands
-// instead of in addFlags, so they are not part of containerOptions.
-type createFlags struct {
-	platform     string
-	pull         string
-	name         string
-	useAPISocket bool
-}
-
-func registerCreateFlags(flags *pflag.FlagSet) *createFlags {
-	cf := new(createFlags)
-	flags.StringVar(&cf.platform, "platform", "", "Set platform if server is multi-platform capable")
-	flags.StringVar(&cf.pull, "pull", pullPolicyMissing, `Pull image before creating ("always", "missing", "never")`)
-	flags.StringVar(&cf.name, "name", "", "Assign a name to the container")
-	flags.BoolVar(&cf.useAPISocket, "use-api-socket", false, "Bind mount Docker API socket and required auth")
-	// Accepted without effect: pull progress is only logged at debug level, and docker
-	// no longer implements content trust.
-	flags.BoolP("quiet", "q", false, "Suppress the pull output")
-	flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
-	return cf
-}
-
-// parseContainerOptions parses a container options string. The flags are returned even
-// on error, holding whatever was read before the failure.
-func parseContainerOptions(options string) (*pflag.FlagSet, *containerOptions, *createFlags, error) {
-	flags := pflag.NewFlagSet("container_flags", pflag.ContinueOnError)
-	flags.SetOutput(io.Discard)
-	copts := addFlags(flags)
-	cf := registerCreateFlags(flags)
-
-	args, err := shellquote.Split(options)
-	if err != nil {
-		return flags, copts, cf, fmt.Errorf("Cannot split container options: '%s': '%w'", options, err)
-	}
-
-	if err := flags.Parse(args); err != nil {
-		return flags, copts, cf, fmt.Errorf("Cannot parse container options: '%s': '%w'", options, err)
-	}
-
-	return flags, copts, cf, nil
-}
-
-// createFlagsFromOptions reads the create-level flags that have to be known before the
-// container is created. Malformed options keep the defaults here and are reported by
-// mergeContainerConfigs at create time.
-func createFlagsFromOptions(options string) *createFlags {
-	_, _, cf, _ := parseContainerOptions(options)
-	return cf
-}
-
-func (cf *createFlags) validate() error {
-	if !slices.Contains(pullPolicies, cf.pull) {
-		return fmt.Errorf("invalid --pull option %q: must be one of %q", cf.pull, pullPolicies)
-	}
-
-	if cf.useAPISocket {
-		return errors.New("--use-api-socket is not supported, use the runner's container.docker_host setting to expose a docker socket")
-	}
-
-	return nil
-}

act/container/docker_create_flags_test.go

@@ -1,61 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCreateFlagsFromOptions(t *testing.T) {
-	for _, tc := range []struct {
-		options  string
-		platform string
-		pull     string
-	}{
-		{"", "", pullPolicyMissing},
-		{"-v /a:/b --platform=linux/arm64 --pull always", "linux/arm64", pullPolicyAlways},
-		{"--platform linux/arm/v7 --pull never", "linux/arm/v7", pullPolicyNever},
-		{`--platform "linux/amd64`, "", pullPolicyMissing}, // malformed, defaults kept
-	} {
-		t.Run(tc.options, func(t *testing.T) {
-			cf := createFlagsFromOptions(tc.options)
-			assert.Equal(t, tc.platform, cf.platform)
-			assert.Equal(t, tc.pull, cf.pull)
-		})
-	}
-}
-
-func TestCreateFlagsValidate(t *testing.T) {
-	for _, tc := range []struct {
-		options string
-		wantErr string
-	}{
-		{"--quiet --disable-content-trust --name mine", ""},
-		{"--pull sometimes", `invalid --pull option "sometimes"`},
-		{"--use-api-socket", "--use-api-socket is not supported"},
-	} {
-		t.Run(tc.options, func(t *testing.T) {
-			err := createFlagsFromOptions(tc.options).validate()
-			if tc.wantErr == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tc.wantErr)
-		})
-	}
-}
-
-func TestNewContainerAppliesCreateFlags(t *testing.T) {
-	input := &NewContainerInput{Platform: "linux/amd64", Options: "--platform linux/arm64 --pull never"}
-	cr := NewContainer(input).(*containerReference)
-	assert.Equal(t, "linux/arm64", input.Platform)
-	assert.Equal(t, pullPolicyNever, cr.pullPolicy)
-
-	kept := &NewContainerInput{Platform: "linux/amd64", Options: "--privileged"}
-	NewContainer(kept)
-	assert.Equal(t, "linux/amd64", kept.Platform)
-}

act/container/docker_images.go

@@ -10,8 +10,8 @@ import (
 	"context"
 	"fmt"
 
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/client"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/client"
 )
 
 // ImageExistsLocally returns a boolean indicating if an image with the
@@ -23,8 +23,8 @@ func ImageExistsLocally(ctx context.Context, imageName, platform string) (bool,
 	}
 	defer cli.Close()
 
-	inspectImage, err := cli.ImageInspect(ctx, imageName)
-	if cerrdefs.IsNotFound(err) {
+	inspectImage, _, err := cli.ImageInspectWithRaw(ctx, imageName)
+	if client.IsErrNotFound(err) {
 		return false, nil
 	} else if err != nil {
 		return false, err
@@ -46,14 +46,14 @@ func RemoveImage(ctx context.Context, imageName string, force, pruneChildren boo
 	}
 	defer cli.Close()
 
-	inspectImage, err := cli.ImageInspect(ctx, imageName)
-	if cerrdefs.IsNotFound(err) {
+	inspectImage, _, err := cli.ImageInspectWithRaw(ctx, imageName)
+	if client.IsErrNotFound(err) {
 		return false, nil
 	} else if err != nil {
 		return false, err
 	}
 
-	if _, err = cli.ImageRemove(ctx, inspectImage.ID, client.ImageRemoveOptions{
+	if _, err = cli.ImageRemove(ctx, inspectImage.ID, types.ImageRemoveOptions{
 		Force:         force,
 		PruneChildren: pruneChildren,
 	}); err != nil {

act/container/docker_images_test.go

@@ -6,64 +6,66 @@ package container
 
 import (
 	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
+	"io"
 	"testing"
 
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/client"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func init() {
 	log.SetLevel(log.DebugLevel)
 }
 
-// buildScratchImage builds a tiny empty image for the given platform locally (FROM scratch, no
-// network or emulation since there is nothing to run) and returns its tag, removing it after
-// the test.
-func buildScratchImage(t *testing.T, platform string) string {
-	t.Helper()
-	tag := fmt.Sprintf("act-test-exists-%s:latest", strings.TrimPrefix(platform, "linux/"))
-	cmd := exec.Command("docker", "build", "--platform", platform, "-t", tag, "-")
-	cmd.Stdin = strings.NewReader("FROM scratch\nLABEL act-test=1\n")
-	// Force BuildKit: it records the requested architecture in the image config for a
-	// FROM-scratch build, whereas the classic builder ignores --platform and tags it with the
-	// host arch, which would break the per-platform existence assertions below.
-	cmd.Env = append(os.Environ(), "DOCKER_BUILDKIT=1")
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
-	t.Cleanup(func() { _ = exec.Command("docker", "rmi", "-f", tag).Run() })
-	return tag
-}
-
 func TestImageExistsLocally(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	ctx := context.Background()
+	// to help make this test reliable and not flaky, we need to have
+	// an image that will exist, and onew that won't exist
 
-	// a non-existent image is reported absent
-	missing, err := ImageExistsLocally(ctx, "library/alpine:this-random-tag-will-never-exist", "linux/amd64")
+	// Test if image exists with specific tag
+	invalidImageTag, err := ImageExistsLocally(ctx, "library/alpine:this-random-tag-will-never-exist", "linux/amd64")
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, missing)
+	assert.False(t, invalidImageTag)
 
-	// Build tiny images for two architectures locally so per-platform existence can be checked
-	// offline (formerly pulled node:24-bookworm-slim for amd64 and arm64 over the network).
-	amd64Ref := buildScratchImage(t, "linux/amd64")
-	arm64Ref := buildScratchImage(t, "linux/arm64")
-
-	amd64Exists, err := ImageExistsLocally(ctx, amd64Ref, "linux/amd64")
+	// Test if image exists with specific architecture (image platform)
+	invalidImagePlatform, err := ImageExistsLocally(ctx, "alpine:latest", "windows/amd64")
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, amd64Exists)
+	assert.False(t, invalidImagePlatform)
 
-	// a non-host architecture image is detected for its own architecture
-	arm64Exists, err := ImageExistsLocally(ctx, arm64Ref, "linux/arm64")
+	// pull an image
+	cli, err := client.NewClientWithOpts(client.FromEnv)
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.True(t, arm64Exists)
+	cli.NegotiateAPIVersion(context.Background())
 
-	// a present image is reported absent for a different platform
-	wrongPlatform, err := ImageExistsLocally(ctx, amd64Ref, "linux/arm64")
+	// Chose alpine latest because it's so small
+	// maybe we should build an image instead so that tests aren't reliable on dockerhub
+	readerDefault, err := cli.ImagePull(ctx, "node:16-buster-slim", types.ImagePullOptions{
+		Platform: "linux/amd64",
+	})
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-	assert.False(t, wrongPlatform)
+	defer readerDefault.Close()
+	_, err = io.ReadAll(readerDefault)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	imageDefaultArchExists, err := ImageExistsLocally(ctx, "node:16-buster-slim", "linux/amd64")
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.True(t, imageDefaultArchExists)
+
+	// Validate if another architecture platform can be pulled
+	readerArm64, err := cli.ImagePull(ctx, "node:16-buster-slim", types.ImagePullOptions{
+		Platform: "linux/arm64",
+	})
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	defer readerArm64.Close()
+	_, err = io.ReadAll(readerArm64)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	imageArm64Exists, err := ImageExistsLocally(ctx, "node:16-buster-slim", "linux/arm64")
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.True(t, imageArm64Exists)
 }

act/container/docker_logger.go

@@ -26,6 +26,8 @@ type dockerMessage struct {
 	Progress string `json:"progress"`
 }
 
+const logPrefix = "  \U0001F433  "
+
 func logDockerResponse(logger logrus.FieldLogger, dockerResponse io.ReadCloser, isError bool) error {
 	if dockerResponse == nil {
 		return nil

act/container/docker_network.go

@@ -11,10 +11,10 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/moby/client"
+	"github.com/docker/docker/api/types"
 )
 
-func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExecutorInput) common.Executor {
+func NewDockerNetworkCreateExecutor(name string) common.Executor {
 	return func(ctx context.Context) error {
 		cli, err := GetDockerClient(ctx)
 		if err != nil {
@@ -23,24 +23,22 @@ func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExec
 		defer cli.Close()
 
 		// Only create the network if it doesn't exist
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
+		networks, err := cli.NetworkList(ctx, types.NetworkListOptions{})
 		if err != nil {
 			return err
 		}
 		// For Gitea, reduce log noise
 		// common.Logger(ctx).Debugf("%v", networks)
-		for _, n := range networks.Items {
-			if n.Name == name {
+		for _, network := range networks {
+			if network.Name == name {
 				common.Logger(ctx).Debugf("Network %v exists", name)
 				return nil
 			}
 		}
 
-		_, err = cli.NetworkCreate(ctx, name, client.NetworkCreateOptions{
-			Driver:     "bridge",
-			Scope:      "local",
-			EnableIPv4: opts.EnableIPv4,
-			EnableIPv6: opts.EnableIPv6,
+		_, err = cli.NetworkCreate(ctx, name, types.NetworkCreate{
+			Driver: "bridge",
+			Scope:  "local",
 		})
 		if err != nil {
 			return err
@@ -58,23 +56,23 @@ func NewDockerNetworkRemoveExecutor(name string) common.Executor {
 		}
 		defer cli.Close()
 
-		// Make sure that all network of the specified name are removed
+		// Make shure that all network of the specified name are removed
 		// cli.NetworkRemove refuses to remove a network if there are duplicates
-		networks, err := cli.NetworkList(ctx, client.NetworkListOptions{})
+		networks, err := cli.NetworkList(ctx, types.NetworkListOptions{})
 		if err != nil {
 			return err
 		}
 		// For Gitea, reduce log noise
 		// common.Logger(ctx).Debugf("%v", networks)
-		for _, n := range networks.Items {
-			if n.Name == name {
-				result, err := cli.NetworkInspect(ctx, n.ID, client.NetworkInspectOptions{})
+		for _, network := range networks {
+			if network.Name == name {
+				result, err := cli.NetworkInspect(ctx, network.ID, types.NetworkInspectOptions{})
 				if err != nil {
 					return err
 				}
 
-				if len(result.Network.Containers) == 0 {
-					if _, err = cli.NetworkRemove(ctx, n.ID, client.NetworkRemoveOptions{}); err != nil {
+				if len(result.Containers) == 0 {
+					if err = cli.NetworkRemove(ctx, network.ID); err != nil {
 						common.Logger(ctx).Debugf("%v", err)
 					}
 				} else {

act/container/docker_platform.go

@@ -1,39 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// Copyright 2025 The nektos/act Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"fmt"
-	"strings"
-
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// parsePlatform parses an "os/arch[/variant]" string into a Platform. An empty input
-// returns (nil, nil), meaning "no platform constraint". A non-empty but malformed
-// string is rejected explicitly so it cannot silently fall through to the daemon's
-// default architecture.
-func parsePlatform(platform string) (*specs.Platform, error) {
-	if platform == "" {
-		return nil, nil //nolint:nilnil // no platform constraint requested
-	}
-
-	parts := strings.Split(platform, "/")
-	if len(parts) < 2 || len(parts) > 3 || parts[0] == "" || parts[1] == "" || (len(parts) == 3 && parts[2] == "") {
-		return nil, fmt.Errorf("invalid platform %q: expected os/arch[/variant]", platform)
-	}
-
-	spec := &specs.Platform{
-		OS:           strings.ToLower(parts[0]),
-		Architecture: strings.ToLower(parts[1]),
-	}
-	if len(parts) == 3 {
-		spec.Variant = strings.ToLower(parts[2])
-	}
-
-	return spec, nil
-}

act/container/docker_platform_test.go

@@ -1,63 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParsePlatform(t *testing.T) {
-	t.Run("empty input returns nil platform without error", func(t *testing.T) {
-		got, err := parsePlatform("")
-		require.NoError(t, err)
-		assert.Nil(t, got)
-	})
-
-	t.Run("os/arch", func(t *testing.T) {
-		got, err := parsePlatform("linux/amd64")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Empty(t, got.Variant)
-	})
-
-	t.Run("os/arch/variant", func(t *testing.T) {
-		got, err := parsePlatform("linux/arm/v7")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "arm", got.Architecture)
-		assert.Equal(t, "v7", got.Variant)
-	})
-
-	t.Run("input is lowercased", func(t *testing.T) {
-		got, err := parsePlatform("Linux/AMD64/V8")
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "linux", got.OS)
-		assert.Equal(t, "amd64", got.Architecture)
-		assert.Equal(t, "v8", got.Variant)
-	})
-
-	for _, bad := range []string{
-		"amd64",
-		"linux",
-		"linux/",
-		"/amd64",
-		"/",
-		"//",
-		"linux/arm/",
-		"linux/arm/v7/extra",
-	} {
-		t.Run("rejects "+bad, func(t *testing.T) {
-			got, err := parsePlatform(bad)
-			require.Error(t, err)
-			assert.Nil(t, got)
-		})
-	}
-}

act/container/docker_pull.go

@@ -8,23 +8,23 @@ package container
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
 
 	"github.com/distribution/reference"
-	"github.com/moby/moby/api/pkg/authconfig"
-	"github.com/moby/moby/api/types/registry"
-	"github.com/moby/moby/client"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/registry"
 )
 
 // NewDockerPullExecutor function to create a run executor for the container
 func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		logger.Debugf("docker pull %v", input.Image)
+		logger.Debugf("%sdocker pull %v", logPrefix, input.Image)
 
 		if common.Dryrun(ctx) {
 			return nil
@@ -72,37 +72,32 @@ func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
 
 				_ = logDockerResponse(logger, reader, err != nil)
 			}
-			if err != nil {
-				return fmt.Errorf("failed to pull image '%s' (%s): %w", imageRef, input.Platform, err)
-			}
+			return err
 		}
 		return nil
 	}
 }
 
-func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput) (client.ImagePullOptions, error) {
-	imagePullOptions := client.ImagePullOptions{}
-	platform, err := parsePlatform(input.Platform)
-	if err != nil {
-		return imagePullOptions, err
-	}
-	if platform != nil {
-		imagePullOptions.Platforms = []specs.Platform{*platform}
+func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput) (types.ImagePullOptions, error) {
+	imagePullOptions := types.ImagePullOptions{
+		Platform: input.Platform,
 	}
 	logger := common.Logger(ctx)
 
 	if input.Username != "" && input.Password != "" {
 		logger.Debugf("using authentication for docker pull")
 
-		encodedAuth, err := authconfig.Encode(registry.AuthConfig{
+		authConfig := registry.AuthConfig{
 			Username: input.Username,
 			Password: input.Password,
-		})
+		}
+
+		encodedJSON, err := json.Marshal(authConfig)
 		if err != nil {
 			return imagePullOptions, err
 		}
 
-		imagePullOptions.RegistryAuth = encodedAuth
+		imagePullOptions.RegistryAuth = base64.URLEncoding.EncodeToString(encodedJSON)
 	} else {
 		authConfig, err := LoadDockerAuthConfig(ctx, input.Image)
 		if err != nil {
@@ -113,17 +108,19 @@ func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput)
 		}
 		logger.Info("using DockerAuthConfig authentication for docker pull")
 
-		imagePullOptions.RegistryAuth, err = authconfig.Encode(authConfig)
+		encodedJSON, err := json.Marshal(authConfig)
 		if err != nil {
 			return imagePullOptions, err
 		}
+
+		imagePullOptions.RegistryAuth = base64.URLEncoding.EncodeToString(encodedJSON)
 	}
 
 	return imagePullOptions, nil
 }
 
-func cleanImage(ctx context.Context, imageName string) string {
-	ref, err := reference.ParseAnyReference(imageName)
+func cleanImage(ctx context.Context, image string) string {
+	ref, err := reference.ParseAnyReference(image)
 	if err != nil {
 		common.Logger(ctx).Error(err)
 		return ""

act/container/docker_pull_test.go

@@ -40,9 +40,6 @@ func TestCleanImage(t *testing.T) {
 func TestGetImagePullOptions(t *testing.T) {
 	ctx := context.Background()
 
-	orig := config.Dir()
-	t.Cleanup(func() { config.SetDir(orig) })
-
 	config.SetDir("/non-existent/docker")
 
 	options, err := getImagePullOptions(ctx, NewDockerPullExecutorInput{})

act/container/docker_run.go

@@ -17,56 +17,43 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
-	"slices"
 	"strconv"
 	"strings"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/filecollector"
 
-	"dario.cat/mergo"
 	"github.com/Masterminds/semver"
-	cerrdefs "github.com/containerd/errdefs"
 	"github.com/docker/cli/cli/compose/loader"
 	"github.com/docker/cli/cli/connhelper"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
 	"github.com/go-git/go-billy/v5/helper/polyfill"
 	"github.com/go-git/go-billy/v5/osfs"
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
 	"github.com/gobwas/glob"
+	"github.com/imdario/mergo"
 	"github.com/joho/godotenv"
-	"github.com/moby/moby/api/pkg/stdcopy"
-	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/mount"
-	"github.com/moby/moby/api/types/network"
-	"github.com/moby/moby/api/types/system"
-	"github.com/moby/moby/client"
+	"github.com/kballard/go-shellquote"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/spf13/pflag"
+	"golang.org/x/term"
 )
 
-// drainGracePeriod bounds how long we wait for an output-copy goroutine to
-// finish draining a container's output before returning, so that neither a
-// cancellation (waitForCommand) nor a normal container exit (wait) truncates
-// the tail of the log. It is a safety bound: in the common case the stream
-// reaches EOF and the goroutine returns well before this elapses.
-const drainGracePeriod = 2 * time.Second
-
 // NewContainer creates a reference to a container
 func NewContainer(input *NewContainerInput) ExecutionsEnvironment {
 	cr := new(containerReference)
 	cr.input = input
-	// Resolved up front because the image pull runs before the container is created.
-	cf := createFlagsFromOptions(input.Options)
-	if cf.platform != "" {
-		cr.input.Platform = cf.platform
-	}
-	cr.pullPolicy = cf.pull
 	return cr
 }
 
 func (cr *containerReference) ConnectToNetwork(name string) common.Executor {
 	return common.
-		NewDebugExecutor("docker network connect %s %s", name, cr.input.Name).
+		NewDebugExecutor("%sdocker network connect %s %s", logPrefix, name, cr.input.Name).
 		Then(
 			common.NewPipelineExecutor(
 				cr.connect(),
@@ -77,13 +64,9 @@ func (cr *containerReference) ConnectToNetwork(name string) common.Executor {
 
 func (cr *containerReference) connectToNetwork(name string, aliases []string) common.Executor {
 	return func(ctx context.Context) error {
-		_, err := cr.cli.NetworkConnect(ctx, name, client.NetworkConnectOptions{
-			Container: cr.input.Name,
-			EndpointConfig: &network.EndpointSettings{
-				Aliases: aliases,
-			},
+		return cr.cli.NetworkConnect(ctx, name, cr.input.Name, &network.EndpointSettings{
+			Aliases: aliases,
 		})
-		return err
 	}
 }
 
@@ -91,7 +74,7 @@ func (cr *containerReference) connectToNetwork(name string, aliases []string) co
 // API version is 1.41 and beyond
 func supportsContainerImagePlatform(ctx context.Context, cli client.APIClient) bool {
 	logger := common.Logger(ctx)
-	ver, err := cli.ServerVersion(ctx, client.ServerVersionOptions{})
+	ver, err := cli.ServerVersion(ctx)
 	if err != nil {
 		logger.Panicf("Failed to get Docker API Version: %s", err)
 		return false
@@ -107,7 +90,7 @@ func supportsContainerImagePlatform(ctx context.Context, cli client.APIClient) b
 
 func (cr *containerReference) Create(capAdd, capDrop []string) common.Executor {
 	return common.
-		NewInfoExecutor("docker create image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
+		NewInfoExecutor("%sdocker create image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", logPrefix, cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
 		Then(
 			common.NewPipelineExecutor(
 				cr.connect(),
@@ -119,7 +102,7 @@ func (cr *containerReference) Create(capAdd, capDrop []string) common.Executor {
 
 func (cr *containerReference) Start(attach bool) common.Executor {
 	return common.
-		NewInfoExecutor("docker run image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
+		NewInfoExecutor("%sdocker run image=%s platform=%s entrypoint=%+q cmd=%+q network=%+q", logPrefix, cr.input.Image, cr.input.Platform, cr.input.Entrypoint, cr.input.Cmd, cr.input.NetworkMode).
 		Then(
 			common.NewPipelineExecutor(
 				cr.connect(),
@@ -141,13 +124,8 @@ func (cr *containerReference) Start(attach bool) common.Executor {
 }
 
 func (cr *containerReference) Pull(forcePull bool) common.Executor {
-	if cr.pullPolicy == pullPolicyNever {
-		return common.NewInfoExecutor("docker pull skipped image=%s, --pull=never in the options", cr.input.Image)
-	}
-	forcePull = forcePull || cr.pullPolicy == pullPolicyAlways
-
 	return common.
-		NewInfoExecutor("docker pull image=%s platform=%s username=%s forcePull=%t", cr.input.Image, cr.input.Platform, cr.input.Username, forcePull).
+		NewInfoExecutor("%sdocker pull image=%s platform=%s username=%s forcePull=%t", logPrefix, cr.input.Image, cr.input.Platform, cr.input.Username, forcePull).
 		Then(
 			NewDockerPullExecutor(NewDockerPullExecutorInput{
 				Image:     cr.input.Image,
@@ -169,9 +147,7 @@ func (cr *containerReference) Copy(destPath string, files ...*FileEntry) common.
 
 func (cr *containerReference) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
 	return common.NewPipelineExecutor(
-		common.NewInfoExecutor("docker cp src=%s dst=%s", srcPath, destPath),
-		cr.connect(),
-		cr.find(),
+		common.NewInfoExecutor("%sdocker cp src=%s dst=%s", logPrefix, srcPath, destPath),
 		cr.copyDir(destPath, srcPath, useGitIgnore),
 		func(ctx context.Context) error {
 			// If this fails, then folders have wrong permissions on non root container
@@ -187,21 +163,8 @@ func (cr *containerReference) GetContainerArchive(ctx context.Context, srcPath s
 	if common.Dryrun(ctx) {
 		return nil, errors.New("DRYRUN is not supported in GetContainerArchive")
 	}
-	// Direct entry point (no pipeline) — revalidate cr.id ourselves.
-	if err := cr.connect()(ctx); err != nil {
-		return nil, err
-	}
-	if err := cr.find()(ctx); err != nil {
-		return nil, err
-	}
-	if cr.id == "" {
-		return nil, cr.missingContainerError("get archive %s", srcPath)
-	}
-	result, err := cr.cli.CopyFromContainer(ctx, cr.id, client.CopyFromContainerOptions{SourcePath: srcPath})
-	if err != nil {
-		return nil, err
-	}
-	return result.Content, nil
+	a, _, err := cr.cli.CopyFromContainer(ctx, cr.id, srcPath)
+	return a, err
 }
 
 func (cr *containerReference) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
@@ -214,7 +177,7 @@ func (cr *containerReference) UpdateFromImageEnv(env *map[string]string) common.
 
 func (cr *containerReference) Exec(command []string, env map[string]string, user, workdir string) common.Executor {
 	return common.NewPipelineExecutor(
-		common.NewInfoExecutor("docker exec cmd=[%s] user=%s workdir=%s", strings.Join(command, " "), user, workdir),
+		common.NewInfoExecutor("%sdocker exec cmd=[%s] user=%s workdir=%s", logPrefix, strings.Join(command, " "), user, workdir),
 		cr.connect(),
 		cr.find(),
 		cr.exec(command, env, user, workdir),
@@ -241,16 +204,11 @@ func (cr *containerReference) ReplaceLogWriter(stdout, stderr io.Writer) (io.Wri
 }
 
 type containerReference struct {
-	cli        client.APIClient
-	id         string
-	input      *NewContainerInput
-	pullPolicy string
-	UID        int
-	GID        int
-	// attachDone is closed by the attach() streaming goroutine once it has
-	// drained and flushed the container's output. wait() blocks on it so the
-	// tail of the log lands before the step proceeds.
-	attachDone chan struct{}
+	cli   client.APIClient
+	id    string
+	input *NewContainerInput
+	UID   int
+	GID   int
 	LinuxContainerEnvironmentExtensions
 }
 
@@ -264,27 +222,22 @@ func GetDockerClient(ctx context.Context) (cli client.APIClient, err error) {
 		if err != nil {
 			return nil, err
 		}
-		cli, err = client.New(
+		cli, err = client.NewClientWithOpts(
 			client.WithHost(helper.Host),
 			client.WithDialContext(helper.Dialer),
 		)
 	} else {
-		cli, err = client.New(client.FromEnv)
+		cli, err = client.NewClientWithOpts(client.FromEnv)
 	}
 	if err != nil {
 		return nil, fmt.Errorf("failed to connect to docker daemon: %w", err)
 	}
-	// Best-effort API version negotiation, matching the old client.NegotiateAPIVersion
-	// behaviour. Ping failures here are non-fatal: the connection is exercised again on
-	// the first real call, and the client falls back to the daemon's default API version.
-	if _, err := cli.Ping(ctx, client.PingOptions{NegotiateAPIVersion: true}); err != nil {
-		common.Logger(ctx).Warnf("docker daemon ping during version negotiation failed, continuing: %v", err)
-	}
+	cli.NegotiateAPIVersion(ctx)
 
 	return cli, nil
 }
 
-func GetHostInfo(ctx context.Context) (info system.Info, err error) {
+func GetHostInfo(ctx context.Context) (info types.Info, err error) { //nolint:staticcheck // pre-existing issue from nektos/act
 	var cli client.APIClient
 	cli, err = GetDockerClient(ctx)
 	if err != nil {
@@ -292,12 +245,12 @@ func GetHostInfo(ctx context.Context) (info system.Info, err error) {
 	}
 	defer cli.Close()
 
-	result, err := cli.Info(ctx, client.InfoOptions{})
+	info, err = cli.Info(ctx)
 	if err != nil {
 		return info, err
 	}
 
-	return result.Info, nil
+	return info, nil
 }
 
 // Arch fetches values from docker info and translates architecture to
@@ -349,31 +302,19 @@ func (cr *containerReference) Close() common.Executor {
 	}
 }
 
-// missingContainerError is the shared "container X does not exist" error
-// used by ops that need a live cr.id.
-func (cr *containerReference) missingContainerError(format string, args ...any) error {
-	return fmt.Errorf("container %q does not exist; cannot "+format, append([]any{cr.input.Name}, args...)...)
-}
-
 func (cr *containerReference) find() common.Executor {
 	return func(ctx context.Context) error {
 		if cr.id != "" {
-			// Validate cached id; clear only on definitive NotFound so a
-			// transient daemon error doesn't abort cleanup pipelines.
-			_, err := cr.cli.ContainerInspect(ctx, cr.id, client.ContainerInspectOptions{})
-			if !cerrdefs.IsNotFound(err) {
-				return nil
-			}
-			cr.id = ""
+			return nil
 		}
-		containers, err := cr.cli.ContainerList(ctx, client.ContainerListOptions{
+		containers, err := cr.cli.ContainerList(ctx, types.ContainerListOptions{ //nolint:staticcheck // pre-existing issue from nektos/act
 			All: true,
 		})
 		if err != nil {
 			return fmt.Errorf("failed to list containers: %w", err)
 		}
 
-		for _, c := range containers.Items {
+		for _, c := range containers {
 			for _, name := range c.Names {
 				if name[1:] == cr.input.Name {
 					cr.id = c.ID
@@ -382,15 +323,11 @@ func (cr *containerReference) find() common.Executor {
 			}
 		}
 
+		cr.id = ""
 		return nil
 	}
 }
 
-// isContainerGone reports whether a failed remove still left the container gone (NotFound or Conflict).
-func isContainerGone(err error) bool {
-	return cerrdefs.IsNotFound(err) || cerrdefs.IsConflict(err)
-}
-
 func (cr *containerReference) remove() common.Executor {
 	return func(ctx context.Context) error {
 		if cr.id == "" {
@@ -398,11 +335,11 @@ func (cr *containerReference) remove() common.Executor {
 		}
 
 		logger := common.Logger(ctx)
-		_, err := cr.cli.ContainerRemove(ctx, cr.id, client.ContainerRemoveOptions{
+		err := cr.cli.ContainerRemove(ctx, cr.id, types.ContainerRemoveOptions{ //nolint:staticcheck // pre-existing issue from nektos/act
 			RemoveVolumes: true,
 			Force:         true,
 		})
-		if err != nil && !isContainerGone(err) {
+		if err != nil {
 			logger.Error(fmt.Errorf("failed to remove container: %w", err))
 		}
 
@@ -421,13 +358,17 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 	}
 
 	// parse configuration from CLI container.options
-	flags, copts, cf, err := parseContainerOptions(input.Options)
+	flags := pflag.NewFlagSet("container_flags", pflag.ContinueOnError)
+	copts := addFlags(flags)
+
+	optionsArgs, err := shellquote.Split(input.Options)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, fmt.Errorf("Cannot split container options: '%s': '%w'", input.Options, err)
 	}
 
-	if err := cf.validate(); err != nil {
-		return nil, nil, fmt.Errorf("Cannot process container options: '%s': '%w'", input.Options, err)
+	err = flags.Parse(optionsArgs)
+	if err != nil {
+		return nil, nil, fmt.Errorf("Cannot parse container options: '%s': '%w'", input.Options, err)
 	}
 
 	// FIXME: If everything is fine after gitea/act v0.260.0, remove the following comment.
@@ -482,9 +423,6 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 	}
 	hostConfig.Binds = binds
 	hostConfig.Mounts = mounts
-	if cf.name != "" {
-		logger.Warn("--name in the options will be ignored.")
-	}
 	if len(copts.netMode.Value()) > 0 {
 		logger.Warn("--network and --net in the options will be ignored.")
 	}
@@ -500,22 +438,15 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 			return nil
 		}
 		logger := common.Logger(ctx)
+		isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
 		input := cr.input
-		exposedPorts, err := convertPortSet(input.ExposedPorts)
-		if err != nil {
-			return err
-		}
-		portBindings, err := convertPortMap(input.PortBindings)
-		if err != nil {
-			return err
-		}
 
 		config := &container.Config{
 			Image:        input.Image,
 			WorkingDir:   input.WorkingDir,
 			Env:          input.Env,
-			ExposedPorts: exposedPorts,
-			Tty:          input.AllocatePTY,
+			ExposedPorts: input.ExposedPorts,
+			Tty:          isTerminal,
 		}
 		// For Gitea, reduce log noise
 		// logger.Debugf("Common container.Config ==> %+v", config)
@@ -539,9 +470,15 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 
 		var platSpecs *specs.Platform
 		if supportsContainerImagePlatform(ctx, cr.cli) && cr.input.Platform != "" {
-			platSpecs, err = parsePlatform(cr.input.Platform)
-			if err != nil {
-				return err
+			desiredPlatform := strings.SplitN(cr.input.Platform, `/`, 2)
+
+			if len(desiredPlatform) != 2 {
+				return fmt.Errorf("incorrect container platform option '%s'", cr.input.Platform)
+			}
+
+			platSpecs = &specs.Platform{
+				Architecture: desiredPlatform[1],
+				OS:           desiredPlatform[0],
 			}
 		}
 
@@ -553,13 +490,13 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 			NetworkMode:  container.NetworkMode(input.NetworkMode),
 			Privileged:   input.Privileged,
 			UsernsMode:   container.UsernsMode(input.UsernsMode),
-			PortBindings: portBindings,
+			PortBindings: input.PortBindings,
 			AutoRemove:   input.AutoRemove,
 		}
 		// For Gitea, reduce log noise
 		// logger.Debugf("Common container.HostConfig ==> %+v", hostConfig)
 
-		config, hostConfig, err = cr.mergeContainerConfigs(ctx, config, hostConfig)
+		config, hostConfig, err := cr.mergeContainerConfigs(ctx, config, hostConfig)
 		if err != nil {
 			return err
 		}
@@ -583,13 +520,7 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 			}
 		}
 
-		resp, err := cr.cli.ContainerCreate(ctx, client.ContainerCreateOptions{
-			Config:           config,
-			HostConfig:       hostConfig,
-			NetworkingConfig: networkingConfig,
-			Platform:         platSpecs,
-			Name:             input.Name,
-		})
+		resp, err := cr.cli.ContainerCreate(ctx, config, hostConfig, networkingConfig, platSpecs, input.Name)
 		if err != nil {
 			return fmt.Errorf("failed to create container: '%w'", err)
 		}
@@ -607,7 +538,7 @@ func (cr *containerReference) extractFromImageEnv(env *map[string]string) common
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 
-		inspect, err := cr.cli.ImageInspect(ctx, cr.input.Image)
+		inspect, _, err := cr.cli.ImageInspectWithRaw(ctx, cr.input.Image)
 		if err != nil {
 			logger.Error(err)
 			return fmt.Errorf("inspect image: %w", err)
@@ -642,9 +573,6 @@ func (cr *containerReference) extractFromImageEnv(env *map[string]string) common
 
 func (cr *containerReference) exec(cmd []string, env map[string]string, user, workdir string) common.Executor {
 	return func(ctx context.Context) error {
-		if cr.id == "" {
-			return cr.missingContainerError("exec %v", cmd)
-		}
 		logger := common.Logger(ctx)
 		// Fix slashes when running on Windows
 		if runtime.GOOS == "windows" {
@@ -656,7 +584,7 @@ func (cr *containerReference) exec(cmd []string, env map[string]string, user, wo
 		}
 
 		logger.Debugf("Exec command '%s'", cmd)
-		isTerminal := cr.input.AllocatePTY
+		isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
 		envList := make([]string, 0)
 		for k, v := range env {
 			envList = append(envList, fmt.Sprintf("%s=%s", k, v))
@@ -674,12 +602,12 @@ func (cr *containerReference) exec(cmd []string, env map[string]string, user, wo
 		}
 		logger.Debugf("Working directory '%s'", wd)
 
-		idResp, err := cr.cli.ExecCreate(ctx, cr.id, client.ExecCreateOptions{
+		idResp, err := cr.cli.ContainerExecCreate(ctx, cr.id, types.ExecConfig{
 			User:         user,
 			Cmd:          cmd,
 			WorkingDir:   wd,
 			Env:          envList,
-			TTY:          isTerminal,
+			Tty:          isTerminal,
 			AttachStderr: true,
 			AttachStdout: true,
 		})
@@ -687,20 +615,20 @@ func (cr *containerReference) exec(cmd []string, env map[string]string, user, wo
 			return fmt.Errorf("failed to create exec: %w", err)
 		}
 
-		resp, err := cr.cli.ExecAttach(ctx, idResp.ID, client.ExecAttachOptions{
-			TTY: isTerminal,
+		resp, err := cr.cli.ContainerExecAttach(ctx, idResp.ID, types.ExecStartCheck{
+			Tty: isTerminal,
 		})
 		if err != nil {
 			return fmt.Errorf("failed to attach to exec: %w", err)
 		}
 		defer resp.Close()
 
-		err = cr.waitForCommand(ctx, isTerminal, resp.HijackedResponse, idResp, user, workdir)
+		err = cr.waitForCommand(ctx, isTerminal, resp, idResp, user, workdir)
 		if err != nil {
 			return err
 		}
 
-		inspectResp, err := cr.cli.ExecInspect(ctx, idResp.ID, client.ExecInspectOptions{})
+		inspectResp, err := cr.cli.ContainerExecInspect(ctx, idResp.ID)
 		if err != nil {
 			return fmt.Errorf("failed to inspect exec: %w", err)
 		}
@@ -714,7 +642,7 @@ func (cr *containerReference) exec(cmd []string, env map[string]string, user, wo
 
 func (cr *containerReference) tryReadID(opt string, cbk func(id int)) common.Executor {
 	return func(ctx context.Context) error {
-		idResp, err := cr.cli.ExecCreate(ctx, cr.id, client.ExecCreateOptions{
+		idResp, err := cr.cli.ContainerExecCreate(ctx, cr.id, types.ExecConfig{
 			Cmd:          []string{"id", opt},
 			AttachStdout: true,
 			AttachStderr: true,
@@ -723,7 +651,7 @@ func (cr *containerReference) tryReadID(opt string, cbk func(id int)) common.Exe
 			return nil
 		}
 
-		resp, err := cr.cli.ExecAttach(ctx, idResp.ID, client.ExecAttachOptions{})
+		resp, err := cr.cli.ContainerExecAttach(ctx, idResp.ID, types.ExecStartCheck{})
 		if err != nil {
 			return nil
 		}
@@ -753,12 +681,10 @@ func (cr *containerReference) tryReadGID() common.Executor {
 	return cr.tryReadID("-g", func(id int) { cr.GID = id })
 }
 
-func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal bool, resp client.HijackedResponse, _ client.ExecCreateResult, _, _ string) error {
+func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal bool, resp types.HijackedResponse, _ types.IDResponse, _, _ string) error {
 	logger := common.Logger(ctx)
 
-	// Buffered so the copy goroutine never blocks on send if the grace-period
-	// drain below times out and no one is left to receive.
-	cmdResponse := make(chan error, 1)
+	cmdResponse := make(chan error)
 
 	go func() {
 		var outWriter io.Writer
@@ -777,11 +703,6 @@ func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal boo
 		} else {
 			_, err = io.Copy(outWriter, resp.Reader)
 		}
-		// Flush any buffered, not-yet-newline-terminated trailing line so the
-		// final line of a command's output is not lost (e.g. an error message
-		// printed without a trailing newline before the process exits).
-		common.FlushWriter(outWriter)
-		common.FlushWriter(errWriter)
 		cmdResponse <- err
 	}()
 
@@ -793,16 +714,6 @@ func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal boo
 			logger.Warnf("Failed to send CTRL+C: %+s", err)
 		}
 
-		// Give the copy goroutine a brief grace period to drain output already
-		// produced by the command before we return, so cancellation does not
-		// truncate the tail of the log. The goroutine exits once the hijacked
-		// stream is closed by resp.Close() in the caller's defer.
-		select {
-		case <-cmdResponse:
-		case <-time.After(drainGracePeriod):
-			logger.Warn("Timed out draining command output after cancellation")
-		}
-
 		// we return the context canceled error to prevent other steps
 		// from executing
 		return ctx.Err()
@@ -816,9 +727,6 @@ func (cr *containerReference) waitForCommand(ctx context.Context, isTerminal boo
 }
 
 func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string, tarStream io.Reader) error {
-	if cr.id == "" {
-		return cr.missingContainerError("copy to %s", destPath)
-	}
 	// Mkdir
 	buf := &bytes.Buffer{}
 	tw := tar.NewWriter(buf)
@@ -828,18 +736,12 @@ func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string
 		Typeflag: tar.TypeDir,
 	})
 	tw.Close()
-	_, err := cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
-		DestinationPath: "/",
-		Content:         buf,
-	})
+	err := cr.cli.CopyToContainer(ctx, cr.id, "/", buf, types.CopyToContainerOptions{})
 	if err != nil {
 		return fmt.Errorf("failed to mkdir to copy content to container: %w", err)
 	}
 	// Copy Content
-	_, err = cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
-		DestinationPath: destPath,
-		Content:         tarStream,
-	})
+	err = cr.cli.CopyToContainer(ctx, cr.id, destPath, tarStream, types.CopyToContainerOptions{})
 	if err != nil {
 		return fmt.Errorf("failed to copy content to container: %w", err)
 	}
@@ -852,9 +754,6 @@ func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string
 
 func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool) common.Executor {
 	return func(ctx context.Context) error {
-		if cr.id == "" {
-			return cr.missingContainerError("copy directory to %s", dstPath)
-		}
 		logger := common.Logger(ctx)
 		tarFile, err := os.CreateTemp("", "act")
 		if err != nil {
@@ -916,10 +815,7 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool
 		if err != nil {
 			return fmt.Errorf("failed to seek tar archive: %w", err)
 		}
-		_, err = cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
-			DestinationPath: "/",
-			Content:         tarFile,
-		})
+		err = cr.cli.CopyToContainer(ctx, cr.id, "/", tarFile, types.CopyToContainerOptions{})
 		if err != nil {
 			return fmt.Errorf("failed to copy content to container: %w", err)
 		}
@@ -929,9 +825,6 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool
 
 func (cr *containerReference) copyContent(dstPath string, files ...*FileEntry) common.Executor {
 	return func(ctx context.Context) error {
-		if cr.id == "" {
-			return cr.missingContainerError("copy to %s", dstPath)
-		}
 		logger := common.Logger(ctx)
 		var buf bytes.Buffer
 		tw := tar.NewWriter(&buf)
@@ -956,10 +849,7 @@ func (cr *containerReference) copyContent(dstPath string, files ...*FileEntry) c
 		}
 
 		logger.Debugf("Extracting content to '%s'", dstPath)
-		_, err := cr.cli.CopyToContainer(ctx, cr.id, client.CopyToContainerOptions{
-			DestinationPath: dstPath,
-			Content:         &buf,
-		})
+		err := cr.cli.CopyToContainer(ctx, cr.id, dstPath, &buf, types.CopyToContainerOptions{})
 		if err != nil {
 			return fmt.Errorf("failed to copy content to container: %w", err)
 		}
@@ -969,7 +859,7 @@ func (cr *containerReference) copyContent(dstPath string, files ...*FileEntry) c
 
 func (cr *containerReference) attach() common.Executor {
 	return func(ctx context.Context) error {
-		out, err := cr.cli.ContainerAttach(ctx, cr.id, client.ContainerAttachOptions{
+		out, err := cr.cli.ContainerAttach(ctx, cr.id, types.ContainerAttachOptions{ //nolint:staticcheck // pre-existing issue from nektos/act
 			Stream: true,
 			Stdout: true,
 			Stderr: true,
@@ -977,7 +867,7 @@ func (cr *containerReference) attach() common.Executor {
 		if err != nil {
 			return fmt.Errorf("failed to attach to container: %w", err)
 		}
-		isTerminal := cr.input.AllocatePTY
+		isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
 
 		var outWriter io.Writer
 		outWriter = cr.input.Stdout
@@ -988,23 +878,14 @@ func (cr *containerReference) attach() common.Executor {
 		if errWriter == nil {
 			errWriter = os.Stderr
 		}
-		done := make(chan struct{})
-		cr.attachDone = done
 		go func() {
-			defer close(done)
-			var copyErr error
 			if !isTerminal || os.Getenv("NORAW") != "" {
-				_, copyErr = stdcopy.StdCopy(outWriter, errWriter, out.Reader)
+				_, err = stdcopy.StdCopy(outWriter, errWriter, out.Reader)
 			} else {
-				_, copyErr = io.Copy(outWriter, out.Reader)
+				_, err = io.Copy(outWriter, out.Reader)
 			}
-			// Flush any buffered, not-yet-newline-terminated trailing line once
-			// the stream reaches EOF, so the final line of the container's
-			// output is not lost when it is not newline-terminated.
-			common.FlushWriter(outWriter)
-			common.FlushWriter(errWriter)
-			if copyErr != nil {
-				common.Logger(ctx).Error(copyErr)
+			if err != nil {
+				common.Logger(ctx).Error(err)
 			}
 		}()
 		return nil
@@ -1016,7 +897,7 @@ func (cr *containerReference) start() common.Executor {
 		logger := common.Logger(ctx)
 		logger.Debugf("Starting container: %v", cr.id)
 
-		if _, err := cr.cli.ContainerStart(ctx, cr.id, client.ContainerStartOptions{}); err != nil {
+		if err := cr.cli.ContainerStart(ctx, cr.id, types.ContainerStartOptions{}); err != nil { //nolint:staticcheck // pre-existing issue from nektos/act
 			return fmt.Errorf("failed to start container: %w", err)
 		}
 
@@ -1028,33 +909,19 @@ func (cr *containerReference) start() common.Executor {
 func (cr *containerReference) wait() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		waitResult := cr.cli.ContainerWait(ctx, cr.id, client.ContainerWaitOptions{
-			Condition: container.WaitConditionNotRunning,
-		})
+		statusCh, errCh := cr.cli.ContainerWait(ctx, cr.id, container.WaitConditionNotRunning)
 		var statusCode int64
 		select {
-		case err := <-waitResult.Error:
+		case err := <-errCh:
 			if err != nil {
 				return fmt.Errorf("failed to wait for container: %w", err)
 			}
-		case status := <-waitResult.Result:
+		case status := <-statusCh:
 			statusCode = status.StatusCode
 		}
 
 		logger.Debugf("Return status: %v", statusCode)
 
-		// The container has exited; wait for the attach() streaming goroutine to
-		// finish draining and flushing its output before returning, so the tail
-		// of the log is not lost. Bounded so a stuck stream cannot hang the step.
-		if cr.attachDone != nil {
-			select {
-			case <-cr.attachDone:
-			case <-time.After(drainGracePeriod):
-				logger.Warn("Timed out draining container output")
-			}
-			cr.attachDone = nil
-		}
-
 		if statusCode == 0 {
 			return nil
 		}
@@ -1069,7 +936,22 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 	logger := common.Logger(ctx)
 
 	if len(cr.input.ValidVolumes) > 0 {
-		matcher := newValidVolumeMatcher(ctx, cr.input.ValidVolumes)
+		globs := make([]glob.Glob, 0, len(cr.input.ValidVolumes))
+		for _, v := range cr.input.ValidVolumes {
+			if g, err := glob.Compile(v); err != nil {
+				logger.Errorf("create glob from %s error: %v", v, err)
+			} else {
+				globs = append(globs, g)
+			}
+		}
+		isValid := func(v string) bool {
+			for _, g := range globs {
+				if g.Match(v) {
+					return true
+				}
+			}
+			return false
+		}
 		// sanitize binds
 		sanitizedBinds := make([]string, 0, len(hostConfig.Binds))
 		for _, bind := range hostConfig.Binds {
@@ -1083,7 +965,7 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 				sanitizedBinds = append(sanitizedBinds, bind)
 				continue
 			}
-			if matcher.isValid(parsed.Source, mount.Type(parsed.Type)) {
+			if isValid(parsed.Source) {
 				sanitizedBinds = append(sanitizedBinds, bind)
 			} else {
 				logger.Warnf("[%s] is not a valid volume, will be ignored", parsed.Source)
@@ -1093,7 +975,7 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 		// sanitize mounts
 		sanitizedMounts := make([]mount.Mount, 0, len(hostConfig.Mounts))
 		for _, mt := range hostConfig.Mounts {
-			if matcher.isValid(mt.Source, mt.Type) {
+			if isValid(mt.Source) {
 				sanitizedMounts = append(sanitizedMounts, mt)
 			} else {
 				logger.Warnf("[%s] is not a valid volume, will be ignored", mt.Source)
@@ -1107,129 +989,3 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 
 	return config, hostConfig
 }
-
-type validVolumeMatcher struct {
-	allowAll bool
-	named    []glob.Glob
-	host     []glob.Glob
-}
-
-func newValidVolumeMatcher(ctx context.Context, validVolumes []string) validVolumeMatcher {
-	logger := common.Logger(ctx)
-	ret := validVolumeMatcher{
-		named: make([]glob.Glob, 0, len(validVolumes)),
-		host:  make([]glob.Glob, 0, len(validVolumes)),
-	}
-
-	for _, v := range validVolumes {
-		if v == "**" {
-			ret.allowAll = true
-			continue
-		}
-		if !isHostVolumePattern(v) {
-			if g, err := glob.Compile(v); err != nil {
-				logger.Errorf("create glob from %s error: %v", v, err)
-			} else {
-				ret.named = append(ret.named, g)
-			}
-			continue
-		}
-		normalized, err := normalizeHostVolumePath(v)
-		if err != nil {
-			logger.Errorf("normalize volume pattern %s error: %v", v, err)
-			continue
-		}
-		if g, err := glob.Compile(normalized); err != nil {
-			logger.Errorf("create glob from %s error: %v", normalized, err)
-		} else {
-			ret.host = append(ret.host, g)
-		}
-	}
-
-	return ret
-}
-
-func (m validVolumeMatcher) isValid(source string, sourceType mount.Type) bool {
-	if m.allowAll {
-		return true
-	}
-	if isHostVolumeSource(source, sourceType) {
-		normalized, err := normalizeHostVolumePath(source)
-		if err != nil {
-			return false
-		}
-		for _, g := range m.host {
-			if g.Match(normalized) {
-				return true
-			}
-		}
-		return false
-	}
-	for _, g := range m.named {
-		if g.Match(source) {
-			return true
-		}
-	}
-	return false
-}
-
-func isHostVolumePattern(pattern string) bool {
-	return filepath.IsAbs(pattern) ||
-		strings.HasPrefix(pattern, "."+string(filepath.Separator)) ||
-		strings.HasPrefix(pattern, ".."+string(filepath.Separator)) ||
-		strings.Contains(pattern, "/") ||
-		strings.Contains(pattern, `\`)
-}
-
-func isHostVolumeSource(source string, sourceType mount.Type) bool {
-	if sourceType == mount.TypeBind {
-		return true
-	}
-	if sourceType == mount.TypeVolume {
-		return false
-	}
-	return isHostVolumePattern(source)
-}
-
-func normalizeHostVolumePath(path string) (string, error) {
-	abs, err := filepath.Abs(path)
-	if err != nil {
-		return "", err
-	}
-	return evalSymlinksExistingPrefix(abs)
-}
-
-func evalSymlinksExistingPrefix(path string) (string, error) {
-	resolved, err := filepath.EvalSymlinks(path)
-	if err == nil {
-		return filepath.Clean(resolved), nil
-	}
-	if !errors.Is(err, os.ErrNotExist) {
-		return "", err
-	}
-
-	current := path
-	var missing []string
-	for {
-		_, err := os.Lstat(current)
-		if err == nil {
-			resolved, err := filepath.EvalSymlinks(current)
-			if err != nil {
-				return "", err
-			}
-			for _, name := range slices.Backward(missing) {
-				resolved = filepath.Join(resolved, name)
-			}
-			return filepath.Clean(resolved), nil
-		}
-		if !errors.Is(err, os.ErrNotExist) {
-			return "", err
-		}
-		parent := filepath.Dir(current)
-		if parent == current {
-			return filepath.Clean(path), nil
-		}
-		missing = append(missing, filepath.Base(current))
-		current = parent
-	}
-}

act/container/docker_run_test.go

@@ -8,22 +8,18 @@ import (
 	"bufio"
 	"bytes"
 	"context"
-	"encoding/binary"
 	"errors"
 	"io"
 	"net"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/pkg/stdcopy"
-	"github.com/moby/moby/api/types/container"
-	mobyclient "github.com/moby/moby/client"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
@@ -31,10 +27,9 @@ import (
 )
 
 func TestDocker(t *testing.T) {
-	requireDocker(t)
 	ctx := context.Background()
 	client, err := GetDockerClient(ctx)
-	require.NoError(t, err)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
 	defer client.Close()
 
 	dockerBuild := NewDockerBuildExecutor(NewDockerBuildExecutorInput{
@@ -72,53 +67,33 @@ func TestDocker(t *testing.T) {
 }
 
 type mockDockerClient struct {
-	mobyclient.APIClient
+	client.APIClient
 	mock.Mock
 }
 
-func (m *mockDockerClient) ExecCreate(ctx context.Context, id string, opts mobyclient.ExecCreateOptions) (mobyclient.ExecCreateResult, error) {
+func (m *mockDockerClient) ContainerExecCreate(ctx context.Context, id string, opts types.ExecConfig) (types.IDResponse, error) {
 	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecCreateResult), args.Error(1)
+	return args.Get(0).(types.IDResponse), args.Error(1)
 }
 
-func (m *mockDockerClient) ExecAttach(ctx context.Context, id string, opts mobyclient.ExecAttachOptions) (mobyclient.ExecAttachResult, error) {
+func (m *mockDockerClient) ContainerExecAttach(ctx context.Context, id string, opts types.ExecStartCheck) (types.HijackedResponse, error) {
 	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ExecAttachResult), args.Error(1)
+	return args.Get(0).(types.HijackedResponse), args.Error(1)
 }
 
-func (m *mockDockerClient) ExecInspect(ctx context.Context, execID string, opts mobyclient.ExecInspectOptions) (mobyclient.ExecInspectResult, error) {
-	args := m.Called(ctx, execID, opts)
-	return args.Get(0).(mobyclient.ExecInspectResult), args.Error(1)
+func (m *mockDockerClient) ContainerExecInspect(ctx context.Context, execID string) (types.ContainerExecInspect, error) {
+	args := m.Called(ctx, execID)
+	return args.Get(0).(types.ContainerExecInspect), args.Error(1)
 }
 
-func (m *mockDockerClient) ContainerAttach(ctx context.Context, containerID string, opts mobyclient.ContainerAttachOptions) (mobyclient.ContainerAttachResult, error) {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerAttachResult), args.Error(1)
+func (m *mockDockerClient) ContainerWait(ctx context.Context, containerID string, condition container.WaitCondition) (<-chan container.WaitResponse, <-chan error) {
+	args := m.Called(ctx, containerID, condition)
+	return args.Get(0).(<-chan container.WaitResponse), args.Get(1).(<-chan error)
 }
 
-func (m *mockDockerClient) ContainerWait(ctx context.Context, containerID string, opts mobyclient.ContainerWaitOptions) mobyclient.ContainerWaitResult {
-	args := m.Called(ctx, containerID, opts)
-	return args.Get(0).(mobyclient.ContainerWaitResult)
-}
-
-func (m *mockDockerClient) CopyToContainer(ctx context.Context, id string, options mobyclient.CopyToContainerOptions) (mobyclient.CopyToContainerResult, error) {
-	args := m.Called(ctx, id, options)
-	return args.Get(0).(mobyclient.CopyToContainerResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerInspect(ctx context.Context, id string, opts mobyclient.ContainerInspectOptions) (mobyclient.ContainerInspectResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerInspectResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerList(ctx context.Context, opts mobyclient.ContainerListOptions) (mobyclient.ContainerListResult, error) {
-	args := m.Called(ctx, opts)
-	return args.Get(0).(mobyclient.ContainerListResult), args.Error(1)
-}
-
-func (m *mockDockerClient) ContainerRemove(ctx context.Context, id string, opts mobyclient.ContainerRemoveOptions) (mobyclient.ContainerRemoveResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.ContainerRemoveResult), args.Error(1)
+func (m *mockDockerClient) CopyToContainer(ctx context.Context, id, path string, content io.Reader, options types.CopyToContainerOptions) error {
+	args := m.Called(ctx, id, path, content, options)
+	return args.Error(0)
 }
 
 type endlessReader struct {
@@ -150,12 +125,10 @@ func TestDockerExecAbort(t *testing.T) {
 	conn.On("Write", mock.AnythingOfType("[]uint8")).Return(1, nil)
 
 	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
-		HijackedResponse: mobyclient.HijackedResponse{
-			Conn:   conn,
-			Reader: bufio.NewReader(endlessReader{}),
-		},
+	client.On("ContainerExecCreate", ctx, "123", mock.AnythingOfType("types.ExecConfig")).Return(types.IDResponse{ID: "id"}, nil)
+	client.On("ContainerExecAttach", ctx, "id", mock.AnythingOfType("types.ExecStartCheck")).Return(types.HijackedResponse{
+		Conn:   conn,
+		Reader: bufio.NewReader(endlessReader{}),
 	}, nil)
 
 	cr := &containerReference{
@@ -189,14 +162,12 @@ func TestDockerExecFailure(t *testing.T) {
 	conn := &mockConn{}
 
 	client := &mockDockerClient{}
-	client.On("ExecCreate", ctx, "123", mock.AnythingOfType("client.ExecCreateOptions")).Return(mobyclient.ExecCreateResult{ID: "id"}, nil)
-	client.On("ExecAttach", ctx, "id", mock.AnythingOfType("client.ExecAttachOptions")).Return(mobyclient.ExecAttachResult{
-		HijackedResponse: mobyclient.HijackedResponse{
-			Conn:   conn,
-			Reader: bufio.NewReader(strings.NewReader("output")),
-		},
+	client.On("ContainerExecCreate", ctx, "123", mock.AnythingOfType("types.ExecConfig")).Return(types.IDResponse{ID: "id"}, nil)
+	client.On("ContainerExecAttach", ctx, "id", mock.AnythingOfType("types.ExecStartCheck")).Return(types.HijackedResponse{
+		Conn:   conn,
+		Reader: bufio.NewReader(strings.NewReader("output")),
 	}, nil)
-	client.On("ExecInspect", ctx, "id", mobyclient.ExecInspectOptions{}).Return(mobyclient.ExecInspectResult{
+	client.On("ContainerExecInspect", ctx, "id").Return(types.ContainerExecInspect{
 		ExitCode: 1,
 	}, nil)
 
@@ -218,71 +189,6 @@ func TestDockerExecFailure(t *testing.T) {
 	client.AssertExpectations(t)
 }
 
-// stdcopyFrame wraps payload in a single Docker multiplexed-stream frame, the
-// format StdCopy expects: an 8-byte header (stream type + 4-byte big-endian
-// length) followed by the payload.
-func stdcopyFrame(stream stdcopy.StdType, payload string) []byte {
-	b := make([]byte, 8+len(payload))
-	b[0] = byte(stream)
-	binary.BigEndian.PutUint32(b[4:8], uint32(len(payload)))
-	copy(b[8:], payload)
-	return b
-}
-
-// TestDockerAttachFlushesTrailingLine verifies that wait() blocks until the
-// attach() streaming goroutine has drained and flushed the container's output,
-// so a final line without a trailing newline is not lost.
-func TestDockerAttachFlushesTrailingLine(t *testing.T) {
-	ctx := context.Background()
-
-	framed := bytes.NewBuffer(stdcopyFrame(stdcopy.Stdout, "line one\nlast line without newline"))
-
-	var lines []string
-	logWriter := common.NewLineWriter(func(s string) bool {
-		lines = append(lines, s)
-		return true
-	})
-
-	client := &mockDockerClient{}
-	client.On("ContainerAttach", ctx, "123", mock.AnythingOfType("client.ContainerAttachOptions")).
-		Return(mobyclient.ContainerAttachResult{
-			HijackedResponse: mobyclient.HijackedResponse{
-				Conn:   &mockConn{},
-				Reader: bufio.NewReader(framed),
-			},
-		}, nil)
-
-	statusCh := make(chan container.WaitResponse, 1)
-	statusCh <- container.WaitResponse{StatusCode: 0}
-	errCh := make(chan error, 1)
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
-
-	cr := &containerReference{
-		id:  "123",
-		cli: client,
-		input: &NewContainerInput{
-			Image:  "image",
-			Stdout: logWriter,
-			Stderr: logWriter,
-		},
-	}
-
-	require.NoError(t, cr.attach()(ctx))
-	require.NoError(t, cr.wait()(ctx))
-
-	// wait() must have blocked until the goroutine drained AND flushed; the
-	// trailing, non-newline-terminated line must therefore be present. Reading
-	// lines here is race-free because wait() synchronizes on attachDone, which
-	// the goroutine closes after the final append.
-	assert.Equal(t, []string{"line one\n", "last line without newline"}, lines)
-
-	client.AssertExpectations(t)
-}
-
 func TestDockerWaitFailure(t *testing.T) {
 	ctx := context.Background()
 
@@ -291,11 +197,8 @@ func TestDockerWaitFailure(t *testing.T) {
 	errCh := make(chan error, 1)
 
 	client := &mockDockerClient{}
-	client.On("ContainerWait", ctx, "123", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionNotRunning}).
-		Return(mobyclient.ContainerWaitResult{
-			Result: (<-chan container.WaitResponse)(statusCh),
-			Error:  (<-chan error)(errCh),
-		})
+	client.On("ContainerWait", ctx, "123", container.WaitConditionNotRunning).
+		Return((<-chan container.WaitResponse)(statusCh), (<-chan error)(errCh))
 
 	cr := &containerReference{
 		id:  "123",
@@ -317,13 +220,11 @@ func TestDockerWaitFailure(t *testing.T) {
 func TestDockerCopyTarStream(t *testing.T) {
 	ctx := context.Background()
 
+	conn := &mockConn{}
+
 	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(nil)
+	client.On("CopyToContainer", ctx, "123", "/var/run/act", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(nil)
 	cr := &containerReference{
 		id:  "123",
 		cli: client,
@@ -334,18 +235,20 @@ func TestDockerCopyTarStream(t *testing.T) {
 
 	_ = cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
 
+	conn.AssertExpectations(t)
 	client.AssertExpectations(t)
 }
 
 func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) {
 	ctx := context.Background()
 
+	conn := &mockConn{}
+
 	merr := errors.New("Failure")
 
 	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, merr)
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(merr)
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(merr)
 	cr := &containerReference{
 		id:  "123",
 		cli: client,
@@ -357,21 +260,20 @@ func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) {
 	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
 	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
 
+	conn.AssertExpectations(t)
 	client.AssertExpectations(t)
 }
 
 func TestDockerCopyTarStreamErrorInMkdir(t *testing.T) {
 	ctx := context.Background()
 
+	conn := &mockConn{}
+
 	merr := errors.New("Failure")
 
 	client := &mockDockerClient{}
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-	client.On("CopyToContainer", ctx, "123", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act" && opts.Content != nil
-	})).Return(mobyclient.CopyToContainerResult{}, merr)
+	client.On("CopyToContainer", ctx, "123", "/", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(nil)
+	client.On("CopyToContainer", ctx, "123", "/var/run/act", mock.Anything, mock.AnythingOfType("types.CopyToContainerOptions")).Return(merr)
 	cr := &containerReference{
 		id:  "123",
 		cli: client,
@@ -383,171 +285,10 @@ func TestDockerCopyTarStreamErrorInMkdir(t *testing.T) {
 	err := cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
 	assert.ErrorIs(t, err, merr) //nolint:testifylint // pre-existing issue from nektos/act
 
+	conn.AssertExpectations(t)
 	client.AssertExpectations(t)
 }
 
-// A remove that raced the daemon's AutoRemove teardown is not a failure and must not
-// be logged as one.
-func TestRemoveIgnoresAutoRemoveRace(t *testing.T) {
-	removeOpts := mobyclient.ContainerRemoveOptions{RemoveVolumes: true, Force: true}
-	for _, tc := range []struct {
-		name     string
-		err      error
-		wantLogs bool
-	}{
-		{name: "removal in progress", err: cerrdefs.ErrConflict.WithMessage("removal of container abc is already in progress")},
-		{name: "already removed", err: cerrdefs.ErrNotFound.WithMessage("No such container: abc")},
-		{name: "removed cleanly", err: nil},
-		{name: "real failure", err: errors.New("driver failed to remove root filesystem"), wantLogs: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			logger, hook := test.NewNullLogger()
-			ctx := common.WithLogger(context.Background(), logger)
-			client := &mockDockerClient{}
-			client.On("ContainerRemove", ctx, "abc", removeOpts).Return(mobyclient.ContainerRemoveResult{}, tc.err)
-			cr := &containerReference{id: "abc", cli: client}
-
-			require.NoError(t, cr.remove()(ctx))
-			assert.Empty(t, cr.id)
-
-			if tc.wantLogs {
-				assert.Len(t, hook.AllEntries(), 1)
-			} else {
-				assert.Empty(t, hook.AllEntries())
-			}
-			client.AssertExpectations(t)
-		})
-	}
-}
-
-// find() must drop a stale cached id so later Copy/Exec don't hit the
-// daemon with a torn-down container.
-func TestFindRevalidatesStaleID(t *testing.T) {
-	ctx := context.Background()
-	notFound := cerrdefs.ErrNotFound.WithMessage("No such container")
-	boom := errors.New("daemon unreachable")
-	newCR := func(id string) (*containerReference, *mockDockerClient) {
-		client := &mockDockerClient{}
-		return &containerReference{id: id, cli: client, input: &NewContainerInput{Name: "job-1"}}, client
-	}
-	listOpts := mobyclient.ContainerListOptions{All: true}
-	inspectOpts := mobyclient.ContainerInspectOptions{}
-
-	t.Run("stale id cleared, name lookup empty", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Empty(t, cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("stale id cleared, name lookup repopulates", func(t *testing.T) {
-		cr, client := newCR("stale")
-		client.On("ContainerInspect", ctx, "stale", inspectOpts).Return(mobyclient.ContainerInspectResult{}, notFound)
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "other", Names: []string{"/somebody-else"}},
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "fresh", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("live id kept", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, nil)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("transient inspect error trusts cache", func(t *testing.T) {
-		cr, client := newCR("live")
-		client.On("ContainerInspect", ctx, "live", inspectOpts).Return(mobyclient.ContainerInspectResult{}, boom)
-		require.NoError(t, cr.find()(ctx))
-		assert.Equal(t, "live", cr.id)
-		client.AssertExpectations(t)
-	})
-
-	t.Run("list error propagates", func(t *testing.T) {
-		cr, client := newCR("")
-		client.On("ContainerList", ctx, listOpts).Return(mobyclient.ContainerListResult{}, boom)
-		require.ErrorIs(t, cr.find()(ctx), boom)
-		client.AssertExpectations(t)
-	})
-}
-
-// Every daemon entry point fails fast with a clear, container-named
-// error when no live cr.id is known.
-func TestRejectsMissingContainer(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).Return(mobyclient.ContainerListResult{}, nil)
-	cr := &containerReference{cli: client, input: &NewContainerInput{Name: "job-1"}}
-	check := func(op string, err error) {
-		t.Helper()
-		require.Error(t, err, op)
-		assert.Contains(t, err.Error(), `container "job-1" does not exist`, op)
-	}
-	check("copyContent", cr.copyContent("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	check("copyDir", cr.copyDir("/var/run/act", "/src", false)(ctx))
-	check("CopyTarStream", cr.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{}))
-	check("exec", cr.exec([]string{"echo"}, nil, "", "")(ctx))
-	_, err := cr.GetContainerArchive(ctx, "/var/run/act/x")
-	check("GetContainerArchive", err)
-}
-
-// End-to-end: a stale cr.id is cleared, repopulated from name lookup,
-// and the Copy completes against the fresh id.
-func TestPublicCopyPipelineHandlesStaleID(t *testing.T) {
-	ctx := context.Background()
-	client := &mockDockerClient{}
-	client.On("ContainerInspect", ctx, "stale", mobyclient.ContainerInspectOptions{}).
-		Return(mobyclient.ContainerInspectResult{}, cerrdefs.ErrNotFound.WithMessage("gone"))
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true}).
-		Return(mobyclient.ContainerListResult{Items: []container.Summary{
-			{ID: "fresh", Names: []string{"/job-1"}},
-		}}, nil)
-	client.On("CopyToContainer", ctx, "fresh", mock.MatchedBy(func(opts mobyclient.CopyToContainerOptions) bool {
-		return opts.DestinationPath == "/var/run/act"
-	})).Return(mobyclient.CopyToContainerResult{}, nil)
-
-	cr := &containerReference{id: "stale", cli: client, input: &NewContainerInput{Name: "job-1"}}
-	require.NoError(t, cr.Copy("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	assert.Equal(t, "fresh", cr.id)
-	client.AssertExpectations(t)
-}
-
-// TestDockerCopyToSymlinkPath is a regression test for gitea/runner#981. Most base images
-// symlink /var/run to /run, so copying into /var/run/act traverses that symlink. The broken
-// docker 29.5.1 daemon fails the extraction with "mkdirat var/run: file exists" (fixed in
-// 29.5.2). Running against the daemon shipped in the dind image, this catches a bad bump.
-func TestDockerCopyToSymlinkPath(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-
-	rc := NewContainer(&NewContainerInput{
-		Image:      "alpine:latest",
-		Entrypoint: []string{"sleep", "30"},
-		Name:       "act-test-symlink-" + time.Now().Format("20060102150405.000000"),
-		AutoRemove: true,
-	})
-	require.NoError(t, rc.Pull(false)(ctx))
-	require.NoError(t, rc.Create(nil, nil)(ctx))
-	require.NoError(t, rc.Start(false)(ctx))
-	t.Cleanup(func() {
-		_ = rc.Remove()(ctx)
-		_ = rc.Close()(ctx)
-	})
-
-	// CopyTarStream first creates the destination directory by extracting a tar at "/",
-	// which makes the daemon mkdir var, then var/run (the symlink), then act — the exact
-	// step that fails on the broken daemon.
-	err := rc.CopyTarStream(ctx, "/var/run/act", &bytes.Buffer{})
-	require.NoError(t, err)
-}
-
 // Type assert containerReference implements ExecutionsEnvironment
 var _ ExecutionsEnvironment = &containerReference{}
 
@@ -623,40 +364,3 @@ func TestCheckVolumes(t *testing.T) {
 		})
 	}
 }
-
-func TestCheckVolumesRejectsEscapingHostPaths(t *testing.T) {
-	logger, _ := test.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-
-	base := t.TempDir()
-	allowed := filepath.Join(base, "allowed")
-	denied := filepath.Join(base, "denied")
-	require.NoError(t, os.MkdirAll(allowed, 0o700))
-	require.NoError(t, os.MkdirAll(denied, 0o700))
-
-	cr := &containerReference{
-		input: &NewContainerInput{
-			ValidVolumes: []string{filepath.Join(allowed, "**")},
-		},
-	}
-
-	escapingPath := allowed + string(filepath.Separator) + ".." + string(filepath.Separator) + "denied"
-	_, hostConf := cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{escapingPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	linkPath := filepath.Join(allowed, "link")
-	if err := os.Symlink(denied, linkPath); err != nil {
-		t.Skipf("cannot create symlink: %v", err)
-	}
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{linkPath + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-
-	_, hostConf = cr.sanitizeConfig(ctx, &container.Config{}, &container.HostConfig{
-		Binds: []string{filepath.Join(linkPath, "missing") + ":/mnt"},
-	})
-	assert.Empty(t, hostConf.Binds)
-}

act/container/docker_socket_test.go

@@ -18,19 +18,9 @@ func init() {
 
 var originalCommonSocketLocations = CommonSocketLocations
 
-func isolateSocketEnv(t *testing.T) {
-	t.Helper()
-	t.Cleanup(func() { CommonSocketLocations = originalCommonSocketLocations })
-	if host, ok := os.LookupEnv("DOCKER_HOST"); ok {
-		t.Setenv("DOCKER_HOST", host)
-	} else {
-		t.Cleanup(func() { os.Unsetenv("DOCKER_HOST") })
-	}
-}
-
 func TestGetSocketAndHostWithSocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
+	CommonSocketLocations = originalCommonSocketLocations
 	dockerHost := "unix:///my/docker/host.sock"
 	socketURI := "/path/to/my.socket"
 	t.Setenv("DOCKER_HOST", dockerHost)
@@ -58,9 +48,9 @@ func TestGetSocketAndHostNoSocket(t *testing.T) {
 
 func TestGetSocketAndHostOnlySocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	socketURI := "/path/to/my.socket"
 	os.Unsetenv("DOCKER_HOST")
+	CommonSocketLocations = originalCommonSocketLocations
 	defaultSocket, defaultSocketFound := socketLocation()
 
 	// Act
@@ -75,7 +65,7 @@ func TestGetSocketAndHostOnlySocket(t *testing.T) {
 
 func TestGetSocketAndHostDontMount(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
+	CommonSocketLocations = originalCommonSocketLocations
 	dockerHost := "unix:///my/docker/host.sock"
 	t.Setenv("DOCKER_HOST", dockerHost)
 
@@ -89,7 +79,7 @@ func TestGetSocketAndHostDontMount(t *testing.T) {
 
 func TestGetSocketAndHostNoHostNoSocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
+	CommonSocketLocations = originalCommonSocketLocations
 	os.Unsetenv("DOCKER_HOST")
 	defaultSocket, found := socketLocation()
 
@@ -107,7 +97,6 @@ func TestGetSocketAndHostNoHostNoSocket(t *testing.T) {
 // > This happens if neither DOCKER_HOST nor --container-daemon-socket has a value, but socketLocation() returns a URI
 func TestGetSocketAndHostNoHostNoSocketDefaultLocation(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	mySocketFile, tmpErr := os.CreateTemp(t.TempDir(), "act-*.sock")
 	mySocket := mySocketFile.Name()
 	unixSocket := "unix://" + mySocket
@@ -130,7 +119,6 @@ func TestGetSocketAndHostNoHostNoSocketDefaultLocation(t *testing.T) {
 
 func TestGetSocketAndHostNoHostInvalidSocket(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	os.Unsetenv("DOCKER_HOST")
 	mySocket := "/my/socket/path.sock"
 	CommonSocketLocations = []string{"/unusual", "/socket", "/location"}
@@ -148,7 +136,6 @@ func TestGetSocketAndHostNoHostInvalidSocket(t *testing.T) {
 
 func TestGetSocketAndHostOnlySocketValidButUnusualLocation(t *testing.T) {
 	// Arrange
-	isolateSocketEnv(t)
 	socketURI := "unix:///path/to/my.socket"
 	CommonSocketLocations = []string{"/unusual", "/location"}
 	os.Unsetenv("DOCKER_HOST")

act/container/docker_stub.go

@@ -12,7 +12,7 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/moby/api/types/system"
+	"github.com/docker/docker/api/types"
 	"github.com/pkg/errors"
 )
 
@@ -51,8 +51,8 @@ func RunnerArch(ctx context.Context) string {
 	return runtime.GOOS
 }
 
-func GetHostInfo(ctx context.Context) (info system.Info, err error) {
-	return system.Info{}, nil
+func GetHostInfo(ctx context.Context) (info types.Info, err error) {
+	return types.Info{}, nil
 }
 
 func NewDockerVolumeRemoveExecutor(volume string, force bool) common.Executor {
@@ -61,7 +61,7 @@ func NewDockerVolumeRemoveExecutor(volume string, force bool) common.Executor {
 	}
 }
 
-func NewDockerNetworkCreateExecutor(name string, opts NewDockerNetworkCreateExecutorInput) common.Executor {
+func NewDockerNetworkCreateExecutor(name string) common.Executor {
 	return func(ctx context.Context) error {
 		return nil
 	}

act/container/docker_volume.go

@@ -11,7 +11,8 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/moby/client"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/volume"
 )
 
 func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executor {
@@ -22,12 +23,12 @@ func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executo
 		}
 		defer cli.Close()
 
-		list, err := cli.VolumeList(ctx, client.VolumeListOptions{})
+		list, err := cli.VolumeList(ctx, volume.ListOptions{Filters: filters.NewArgs()})
 		if err != nil {
 			return err
 		}
 
-		for _, vol := range list.Items {
+		for _, vol := range list.Volumes {
 			if vol.Name == volumeName {
 				return removeExecutor(volumeName, force)(ctx)
 			}
@@ -41,7 +42,7 @@ func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executo
 func removeExecutor(volume string, force bool) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		logger.Debugf("docker volume rm %s", volume)
+		logger.Debugf("%sdocker volume rm %s", logPrefix, volume)
 
 		if common.Dryrun(ctx) {
 			return nil
@@ -53,7 +54,6 @@ func removeExecutor(volume string, force bool) common.Executor {
 		}
 		defer cli.Close()
 
-		_, err = cli.VolumeRemove(ctx, volume, client.VolumeRemoveOptions{Force: force})
-		return err
+		return cli.VolumeRemove(ctx, volume, force)
 	}
 }

act/container/helpers_test.go

@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"context"
-	"testing"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}

act/container/host_environment.go

@@ -16,15 +16,14 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"strconv"
 	"strings"
 	"sync"
-	"sync/atomic"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/filecollector"
 	"gitea.com/gitea/runner/act/lookpath"
-	"gitea.com/gitea/runner/internal/pkg/process"
 
 	"github.com/go-git/go-billy/v5/helper/polyfill"
 	"github.com/go-git/go-billy/v5/osfs"
@@ -37,32 +36,15 @@ type HostEnvironment struct {
 	TmpDir    string
 	ToolCache string
 	Workdir   string
-	// CleanWorkdir means teardown owns Workdir and may delete it. Leave false
-	// when Workdir points at a caller-owned checkout (e.g. `act` local mode).
-	CleanWorkdir bool
-	ActPath      string
-	CleanUp      func()
-	StdOut       io.Writer
-	AllocatePTY  bool // allocate a pseudo-TTY for each step's process
+	// BindWorkdir is true when the app runner mounts the workspace on the host and
+	// deletes the task directory after the job; host teardown must not remove Workdir.
+	BindWorkdir bool
+	ActPath     string
+	CleanUp     func()
+	StdOut      io.Writer
 
-	// procGroup owns every process the job's steps start. Atomic: Remove may read
-	// it while a step is still starting.
-	procGroupOnce sync.Once
-	procGroup     atomic.Pointer[process.Group]
-}
-
-// processGroup returns the job-scoped process group, creating it on first use.
-// Returns nil if the job object could not be created; Group is nil-safe.
-func (e *HostEnvironment) processGroup(ctx context.Context) *process.Group {
-	e.procGroupOnce.Do(func() {
-		group, err := process.NewGroup()
-		if err != nil {
-			common.Logger(ctx).Warnf("could not create the job's process group; processes a step leaves behind can only be reclaimed by the workspace scan: %v", err)
-			return
-		}
-		e.procGroup.Store(group)
-	})
-	return e.procGroup.Load()
+	mu          sync.Mutex
+	runningPIDs map[int]struct{}
 }
 
 func (e *HostEnvironment) Create(_, _ []string) common.Executor {
@@ -218,12 +200,12 @@ func (e *HostEnvironment) Start(_ bool) common.Executor {
 
 type ptyWriter struct {
 	Out       io.Writer
-	AutoStop  atomic.Bool
+	AutoStop  bool
 	dirtyLine bool
 }
 
 func (w *ptyWriter) Write(buf []byte) (int, error) {
-	if w.AutoStop.Load() && len(buf) > 0 && buf[len(buf)-1] == 4 {
+	if w.AutoStop && len(buf) > 0 && buf[len(buf)-1] == 4 {
 		n, err := w.Out.Write(buf[:len(buf)-1])
 		if err != nil {
 			return n, err
@@ -282,7 +264,7 @@ func setupPty(cmd *exec.Cmd, cmdline string) (*os.File, *os.File, error) {
 	cmd.Stdin = tty
 	cmd.Stdout = tty
 	cmd.Stderr = tty
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, true)
+	cmd.SysProcAttr = getSysProcAttr(cmdline, true)
 	return ppty, tty, nil
 }
 
@@ -342,12 +324,7 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 	cmd.Env = envList
 	cmd.Stderr = e.StdOut
 	cmd.Dir = wd
-	cmd.SysProcAttr = process.SysProcAttr(cmdline, false)
-
-	// Kills the step's whole tree on cancellation and bounds the post-exit I/O
-	// wait, so an orphan holding cmd's stdout pipe cannot hang cmd.Wait().
-	treeKill := process.NewTreeKill(cmd)
-
+	cmd.SysProcAttr = getSysProcAttr(cmdline, false)
 	var ppty *os.File
 	var tty *os.File
 	defer func() {
@@ -358,34 +335,40 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 			tty.Close()
 		}
 	}()
-	if e.AllocatePTY {
+	if true /* allocate Terminal */ {
 		var err error
 		ppty, tty, err = setupPty(cmd, cmdline)
 		if err != nil {
 			common.Logger(ctx).Debugf("Failed to setup Pty %v\n", err.Error())
 		}
 	}
-	var writer *ptyWriter
-	var logctx context.Context
+	writer := &ptyWriter{Out: e.StdOut}
+	logctx, finishLog := context.WithCancel(context.Background())
 	if ppty != nil {
-		writer = &ptyWriter{Out: e.StdOut}
-		var finishLog context.CancelFunc
-		logctx, finishLog = context.WithCancel(context.Background())
 		go copyPtyOutput(writer, ppty, finishLog)
+	} else {
+		finishLog()
+	}
+	if ppty != nil {
 		go writeKeepAlive(ppty)
 	}
+	// Split Start/Wait so the PID can be registered before the process can exit;
+	// cmd.Run() would block until exit, by which time the PID may have been reused.
 	if err := cmd.Start(); err != nil {
 		return err
 	}
-	// Assign before the step's Killer so the step's job nests inside the group's;
-	// cancellation still scopes to this step's tree.
-	if err := e.processGroup(ctx).Assign(cmd.Process); err != nil {
-		common.Logger(ctx).Warnf("could not assign the step's process to the job's process group; a process it leaves behind may outlive the job: %v", err)
-	}
-	if k, kerr := treeKill.Capture(cmd.Process); kerr != nil {
-		common.Logger(ctx).Warnf("process tree kill setup failed, falling back to single-process kill: %v", kerr)
-	} else {
-		defer k.Close()
+	if cmd.Process != nil {
+		e.mu.Lock()
+		if e.runningPIDs == nil {
+			e.runningPIDs = map[int]struct{}{}
+		}
+		e.runningPIDs[cmd.Process.Pid] = struct{}{}
+		e.mu.Unlock()
+		defer func(pid int) {
+			e.mu.Lock()
+			delete(e.runningPIDs, pid)
+			e.mu.Unlock()
+		}(cmd.Process.Pid)
 	}
 	err = cmd.Wait()
 	if err != nil {
@@ -396,11 +379,14 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 		return err
 	}
 	if tty != nil {
-		writer.AutoStop.Store(true)
+		writer.AutoStop = true
 		if _, err := tty.WriteString("\x04"); err != nil {
 			common.Logger(ctx).Debug("Failed to write EOT")
 		}
-		<-logctx.Done()
+	}
+	<-logctx.Done()
+
+	if ppty != nil {
 		ppty.Close()
 		ppty = nil
 	}
@@ -429,23 +415,6 @@ func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string)
 	return parseEnvFile(e, srcPath, env)
 }
 
-// removeAll is a var so tests can substitute a blocking stub.
-var removeAll = os.RemoveAll
-
-// removeAllWithContext returns once the delete finishes or ctx is cancelled. On
-// cancellation the goroutine leaks: a delete inside a syscall cannot be
-// interrupted (see runWithTimeout).
-func removeAllWithContext(ctx context.Context, path string) error {
-	done := make(chan error, 1)
-	go func() { done <- removeAll(path) }()
-	select {
-	case err := <-done:
-		return err
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
 func removePathWithRetry(ctx context.Context, path string) error {
 	if path == "" {
 		return nil
@@ -465,165 +434,64 @@ func removePathWithRetry(ctx context.Context, path string) error {
 			case <-time.After(delay):
 			}
 		}
-		lastErr = removeAllWithContext(ctx, path)
+		lastErr = os.RemoveAll(path)
 		if lastErr == nil {
 			return nil
 		}
-		if errors.Is(lastErr, context.DeadlineExceeded) {
-			return lastErr
-		}
 	}
 	return lastErr
 }
 
-// buildWindowsWorkspaceKillScript builds a PowerShell command that taskkills
-// every process tree whose ExecutablePath or CommandLine references one of the
-// given workspace dirs, releasing file handles for cleanup. Win32_Process
-// exposes both fields (Get-Process doesn't, wmic is deprecated); matching is on
-// the dir+separator prefix via ordinal String methods, so a name-prefix sibling
-// (job1 vs job10) is spared and path metacharacters stay literal.
-func buildWindowsWorkspaceKillScript(dirs []string) string {
-	quoted := make([]string, len(dirs))
-	for i, d := range dirs {
-		// Single-quoted PowerShell literal; escape ' by doubling it.
-		quoted[i] = "'" + strings.ReplaceAll(d, "'", "''") + "'"
-	}
-
-	return `$paths = @(` + strings.Join(quoted, ",") + `)
-$selfPid = $PID
-Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
-    if ($_.ProcessId -eq $selfPid) { return $false }
-    foreach ($p in $paths) {
-        $prefix = $p + '\'
-        if ($_.ExecutablePath -and $_.ExecutablePath.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)) { return $true }
-        if ($_.CommandLine -and $_.CommandLine.IndexOf($prefix, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) { return $true }
-    }
-    return $false
-} | ForEach-Object {
-    & taskkill.exe /PID $_.ProcessId /T /F 2>$null | Out-Null
-}
-`
-}
-
 func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
 	if runtime.GOOS != "windows" {
 		return
 	}
-
-	// Detached: exec.CommandContext won't start on a cancelled ctx, and a
-	// server cancel has already cancelled the parent ctx.
-	killCtx, killCancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer killCancel()
-
-	logger := common.Logger(ctx)
-
-	// Dirs we own; a process referencing one is a leftover. ToolCache is shared
-	// across jobs, and Workdir may be a caller-owned checkout.
-	owned := []string{e.Path, e.TmpDir}
-	if e.CleanWorkdir {
-		owned = append(owned, e.Workdir)
+	e.mu.Lock()
+	pids := make([]int, 0, len(e.runningPIDs))
+	for pid := range e.runningPIDs {
+		pids = append(pids, pid)
 	}
-	dirs := make([]string, 0, len(owned))
-	for _, d := range owned {
-		if d == "" {
-			continue
-		}
-		abs, err := filepath.Abs(d)
-		if err != nil {
-			continue
-		}
-		dirs = append(dirs, abs)
-	}
-	if len(dirs) == 0 {
+	e.mu.Unlock()
+
+	if len(pids) == 0 {
 		return
 	}
 
-	script := buildWindowsWorkspaceKillScript(dirs)
-
-	cmd := exec.CommandContext(killCtx, "powershell.exe", "-NoProfile", "-NonInteractive", "-Command", script)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		logger.Debugf("workspace process-tree kill via PowerShell failed: %v output=%s", err, strings.TrimSpace(string(out)))
-	}
-
-	// Win32_Process exposes no working directory, so the scan above misses a
-	// process that merely runs in a workspace dir while pinning a handle on it.
-	if killed, err := process.KillProcessesWithCWDUnder(killCtx, dirs); err != nil {
-		logger.Debugf("workspace process kill by working directory reported errors: %v", err)
-	} else if killed > 0 {
-		logger.Debugf("terminated %d leftover process(es) by workspace working directory", killed)
-	}
-}
-
-// hostCleanupTimeout bounds each teardown phase so one stalled delete cannot
-// wedge the runner slot. A var so tests can shrink it.
-var hostCleanupTimeout = 30 * time.Second
-
-// runWithTimeout returns context.DeadlineExceeded once timeout elapses, leaking
-// the goroutine: a delete blocked in a syscall (AV filter driver, dead network
-// mount) cannot be interrupted, and leaking scratch state beats losing the
-// runner's capacity slot forever. The idle stale-dir sweep reclaims it later.
-func runWithTimeout(fn func(), timeout time.Duration) error {
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		fn()
-	}()
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-	select {
-	case <-done:
-		return nil
-	case <-timer.C:
-		return context.DeadlineExceeded
+	logger := common.Logger(ctx)
+	for _, pid := range pids {
+		// Best-effort: forcibly terminate process tree to release file handles
+		// so that workspace cleanup can succeed on Windows.
+		cmd := exec.CommandContext(ctx, "taskkill", "/PID", strconv.Itoa(pid), "/T", "/F")
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			logger.Debugf("taskkill failed for pid=%d: %v output=%s", pid, err, strings.TrimSpace(string(out)))
+		}
 	}
 }
 
 func (e *HostEnvironment) Remove() common.Executor {
 	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-
-		// End lingering processes before removing the workspace; on Windows their
-		// file locks block cleanup. Closing the group is deterministic, the scan a net.
-		if err := e.procGroup.Load().Close(); err != nil {
-			logger.Debugf("closing the job's process group failed: %v", err)
-		}
+		// Ensure any lingering child processes are ended before attempting
+		// to remove the workspace (Windows file locks otherwise prevent cleanup).
 		e.terminateRunningProcesses(ctx)
 
-		// Removes per-job misc state only, never the toolcache root. Bounded because
-		// CleanUp is a caller-supplied, typically unbounded os.RemoveAll.
+		// Only removes per-job misc state. Must not remove the cache/toolcache root.
 		if e.CleanUp != nil {
-			logger.Debugf("running host environment cleanup callback")
-			if err := runWithTimeout(e.CleanUp, hostCleanupTimeout); err != nil {
-				logger.Warnf("host environment cleanup did not finish within %s; continuing job completion, scratch state may be leaked and is reclaimed by the idle stale-dir sweep", hostCleanupTimeout)
-			} else {
-				logger.Debugf("host environment cleanup callback finished")
-			}
+			e.CleanUp()
 		}
-
-		// Detach: a cancelled ctx would skip removePathWithRetry's retries,
-		// which absorb Windows file-handle release lag after the kill above.
-		rmCtx, rmCancel := context.WithTimeout(context.Background(), hostCleanupTimeout)
-		defer rmCancel()
-
+		logger := common.Logger(ctx)
 		var errs []error
-		if err := removePathWithRetry(rmCtx, e.Path); err != nil {
+		if err := removePathWithRetry(ctx, e.Path); err != nil {
 			logger.Warnf("failed to remove host misc state %s: %v", e.Path, err)
 			errs = append(errs, err)
 		}
-		if e.CleanWorkdir {
-			if err := removePathWithRetry(rmCtx, e.Workdir); err != nil {
+		if !e.BindWorkdir && e.Workdir != "" {
+			if err := removePathWithRetry(ctx, e.Workdir); err != nil {
 				logger.Warnf("failed to remove host workspace %s: %v", e.Workdir, err)
 				errs = append(errs, err)
 			}
 		}
-		for _, err := range errs {
-			if !errors.Is(err, context.DeadlineExceeded) {
-				return errors.Join(errs...)
-			}
-		}
-		// Teardown timed out; warned above. Do not fail job completion over it.
-		return nil
+		return errors.Join(errs...)
 	}
 }
 

act/container/host_environment_test.go

@@ -6,16 +6,13 @@ package container
 
 import (
 	"archive/tar"
-	"bytes"
 	"context"
 	"io"
 	"os"
 	"path"
 	"path/filepath"
 	"runtime"
-	"strings"
 	"testing"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 
@@ -103,46 +100,7 @@ func TestHostEnvironmentExecExitCode(t *testing.T) {
 	assert.Equal(t, "Process completed with exit code 3.", err.Error())
 }
 
-func TestHostEnvironmentAllocatePTY(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses POSIX shell")
-	}
-	for _, tc := range []struct {
-		name     string
-		allocPTY bool
-		expect   string
-	}{
-		{name: "off", allocPTY: false, expect: "NOTTY"},
-		{name: "on", allocPTY: true, expect: "TTY"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			buf := &bytes.Buffer{}
-			e := &HostEnvironment{
-				Path:        filepath.Join(dir, "path"),
-				TmpDir:      filepath.Join(dir, "tmp"),
-				ToolCache:   filepath.Join(dir, "tool_cache"),
-				ActPath:     filepath.Join(dir, "act_path"),
-				StdOut:      buf,
-				Workdir:     filepath.Join(dir, "path"),
-				AllocatePTY: tc.allocPTY,
-			}
-			for _, p := range []string{e.Path, e.TmpDir, e.ToolCache, e.ActPath} {
-				require.NoError(t, os.MkdirAll(p, 0o700))
-			}
-
-			err := e.Exec(
-				[]string{"sh", "-c", "[ -t 1 ] && printf TTY || printf NOTTY"},
-				map[string]string{"PATH": os.Getenv("PATH")}, "", "",
-			)(context.Background())
-			require.NoError(t, err)
-			got := strings.TrimSpace(strings.ReplaceAll(buf.String(), "\r", ""))
-			assert.Equal(t, tc.expect, got)
-		})
-	}
-}
-
-func TestHostEnvironmentRemovePreservesWorkdirByDefault(t *testing.T) {
+func TestHostEnvironmentRemoveCleansWorkdir(t *testing.T) {
 	logger := logrus.New()
 	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
 	base := t.TempDir()
@@ -153,32 +111,9 @@ func TestHostEnvironmentRemovePreservesWorkdirByDefault(t *testing.T) {
 	require.NoError(t, os.MkdirAll(workdir, 0o700))
 
 	e := &HostEnvironment{
-		Path:    path,
-		Workdir: workdir,
-		CleanUp: func() {
-			_ = os.RemoveAll(miscRoot)
-		},
-		StdOut: os.Stdout,
-	}
-	require.NoError(t, e.Remove()(ctx))
-	_, err := os.Stat(workdir)
-	require.NoError(t, err)
-}
-
-func TestHostEnvironmentRemoveCleansWorkdirWhenOwned(t *testing.T) {
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	miscRoot := filepath.Join(base, "misc")
-	path := filepath.Join(miscRoot, "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	workdir := filepath.Join(base, "workspace", "123", "owner", "repo")
-	require.NoError(t, os.MkdirAll(workdir, 0o700))
-
-	e := &HostEnvironment{
-		Path:         path,
-		Workdir:      workdir,
-		CleanWorkdir: true,
+		Path:        path,
+		Workdir:     workdir,
+		BindWorkdir: false,
 		CleanUp: func() {
 			_ = os.RemoveAll(miscRoot)
 		},
@@ -189,175 +124,26 @@ func TestHostEnvironmentRemoveCleansWorkdirWhenOwned(t *testing.T) {
 	assert.ErrorIs(t, err, os.ErrNotExist)
 }
 
-func TestRemoveAllWithContextDoesNotHangOnStuckDelete(t *testing.T) {
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	orig := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// removeAllWithContext intentionally leaks the delete goroutine on timeout,
-	// and that goroutine still references removeAll. Unblock it and wait for it
-	// to return before restoring the var, so the restore can't race the read.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = orig
-	})
-
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-
-	err := removeAllWithContext(ctx, t.TempDir())
-	require.ErrorIs(t, err, context.DeadlineExceeded)
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp guards against a stalled
-// CleanUp callback (e.g. an os.RemoveAll blocked by an AV/EDR filter driver or
-// an unresponsive mount) wedging the runner slot forever at "Cleaning up
-// container". Remove must time out the callback and complete job teardown.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckCleanUp(t *testing.T) {
-	// Keep the suite fast: shrink the per-phase teardown timeout for this test.
-	orig := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = orig })
-
+func TestHostEnvironmentRemoveSkipsWorkdirWhenBindWorkdir(t *testing.T) {
 	logger := logrus.New()
 	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
 	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
+	miscRoot := filepath.Join(base, "misc")
+	path := filepath.Join(miscRoot, "hostexecutor")
 	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	release := make(chan struct{})
-	t.Cleanup(func() { close(release) }) // unblock the leaked goroutine at test end
+	workdir := filepath.Join(base, "workspace", "123", "owner", "repo")
+	require.NoError(t, os.MkdirAll(workdir, 0o700))
 
 	e := &HostEnvironment{
-		Path: path,
+		Path:        path,
+		Workdir:     workdir,
+		BindWorkdir: true,
 		CleanUp: func() {
-			<-release // simulate a delete syscall stuck indefinitely
+			_ = os.RemoveAll(miscRoot)
 		},
 		StdOut: os.Stdout,
 	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck CleanUp callback")
-	}
-}
-
-// TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval guards against a
-// stalled os.RemoveAll on the misc/workspace paths (same AV/EDR wedge as
-// #1023) wedging job completion after the CleanUp callback has already timed
-// out or finished.
-func TestHostEnvironmentRemoveDoesNotHangOnStuckPathRemoval(t *testing.T) {
-	origTimeout := hostCleanupTimeout
-	hostCleanupTimeout = 100 * time.Millisecond
-	t.Cleanup(func() { hostCleanupTimeout = origTimeout })
-
-	release := make(chan struct{})
-	stubDone := make(chan struct{})
-
-	origRemoveAll := removeAll
-	removeAll = func(string) error {
-		defer close(stubDone)
-		<-release
-		return nil
-	}
-	// The stuck delete goroutine outlives the timed-out Remove and still reads
-	// removeAll; unblock it and wait before restoring to avoid a restore/read race.
-	t.Cleanup(func() {
-		close(release)
-		<-stubDone
-		removeAll = origRemoveAll
-	})
-
-	logger := logrus.New()
-	ctx := common.WithLogger(context.Background(), logrus.NewEntry(logger))
-	base := t.TempDir()
-	path := filepath.Join(base, "misc", "hostexecutor")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-
-	e := &HostEnvironment{
-		Path:   path,
-		StdOut: os.Stdout,
-	}
-
-	done := make(chan error, 1)
-	go func() { done <- e.Remove()(ctx) }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(10 * time.Second):
-		t.Fatal("Remove() hung on a stuck path removal")
-	}
-}
-
-func TestBuildWindowsWorkspaceKillScript(t *testing.T) {
-	t.Run("single dir", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{`C:\workspace\job1`})
-		assert.Contains(t, s, `$paths = @('C:\workspace\job1')`)
-		// Self-PID guard is essential — without it the script could taskkill
-		// the PowerShell process running it.
-		assert.Contains(t, s, "$selfPid = $PID")
-		assert.Contains(t, s, "$_.ProcessId -eq $selfPid")
-		// Must match both ExecutablePath (binaries from the workspace) and
-		// CommandLine (system binaries invoked with workspace paths in args),
-		// both bounded by dir+separator so a name-prefix sibling is spared.
-		assert.Contains(t, s, `$prefix = $p + '\'`)
-		assert.Contains(t, s, "$_.ExecutablePath.StartsWith($prefix")
-		assert.Contains(t, s, "$_.CommandLine.IndexOf($prefix")
-		// Each matched PID must be tree-killed, not just stopped.
-		assert.Contains(t, s, "taskkill.exe /PID $_.ProcessId /T /F")
-	})
-
-	t.Run("multiple dirs comma-separated", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{
-			`C:\work\path`,
-			`C:\work\workdir`,
-			`C:\Users\runner\AppData\Local\Temp\job-42`,
-		})
-		assert.Contains(t, s, `'C:\work\path'`)
-		assert.Contains(t, s, `'C:\work\workdir'`)
-		assert.Contains(t, s, `'C:\Users\runner\AppData\Local\Temp\job-42'`)
-		// Commas between entries — no trailing comma, no leading comma.
-		assert.Contains(t, s, `'C:\work\path','C:\work\workdir',`)
-	})
-
-	t.Run("path with single quote is escaped", func(t *testing.T) {
-		// In PowerShell single-quoted strings the only special char is the
-		// quote itself, escaped by doubling. A workspace path that ever
-		// contained `'` would inject a command into the script otherwise.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\it's\path`})
-		assert.Contains(t, s, `'C:\work\it''s\path'`)
-		// And it must NOT appear unescaped — otherwise the quote would
-		// terminate the literal early.
-		assert.NotContains(t, s, `'C:\work\it's\path'`)
-	})
-
-	t.Run("path with wildcard metacharacters is matched literally", func(t *testing.T) {
-		// A path containing [ ] ? * must be embedded verbatim and matched with
-		// ordinal String methods, not -like, otherwise the metacharacters would
-		// be interpreted as wildcards and the leftover process could escape.
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\[job]?1`})
-		assert.Contains(t, s, `'C:\work\[job]?1'`)
-		assert.NotContains(t, s, "-like")
-		assert.Contains(t, s, "StartsWith")
-		assert.Contains(t, s, "IndexOf")
-	})
-
-	t.Run("empty dir list still produces a valid script", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript(nil)
-		// Empty array literal — script runs, matches nothing, is a no-op.
-		assert.Contains(t, s, "$paths = @()")
-		assert.Contains(t, s, "Get-CimInstance Win32_Process")
-	})
+	require.NoError(t, e.Remove()(ctx))
+	_, err := os.Stat(workdir)
+	require.NoError(t, err)
 }

act/container/parse_env_file.go

@@ -13,9 +13,6 @@ import (
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
-
-	"golang.org/x/text/encoding/unicode"
-	"golang.org/x/text/transform"
 )
 
 func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Executor {
@@ -31,19 +28,9 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Ex
 		if err != nil && err != io.EOF {
 			return err
 		}
-		// Decode by BOM: Windows PowerShell 5.1 redirection writes UTF-16, and some
-		// tools emit a UTF-8 BOM. Without a BOM the file is read as UTF-8, as before.
-		decoded := transform.NewReader(reader, unicode.BOMOverride(unicode.UTF8.NewDecoder()))
-
-		s := bufio.NewScanner(decoded)
-		// Default 64 KiB max token size is too small for realistic env-file lines; allow up to 16 MiB.
-		s.Buffer(make([]byte, 0, 64*1024), 16*1024*1024)
+		s := bufio.NewScanner(reader)
 		for s.Scan() {
 			line := s.Text()
-			// GitHub's runner ignores blank lines
-			if strings.TrimSpace(line) == "" {
-				continue
-			}
 			singleLineEnv := strings.Index(line, "=")
 			multiLineEnv := strings.Index(line, "<<")
 			if singleLineEnv != -1 && (multiLineEnv == -1 || singleLineEnv < multiLineEnv) {
@@ -63,9 +50,6 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Ex
 					}
 					multiLineEnvContent += content
 				}
-				if err := s.Err(); err != nil {
-					return fmt.Errorf("reading env file: %w", err)
-				}
 				if !delimiterFound {
 					return fmt.Errorf("invalid format delimiter '%v' not found before end of file", multiLineEnvDelimiter)
 				}
@@ -74,9 +58,6 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Ex
 				return fmt.Errorf("invalid format '%v', expected a line with '=' or '<<'", line)
 			}
 		}
-		if err := s.Err(); err != nil {
-			return fmt.Errorf("reading env file: %w", err)
-		}
 		env = &localEnv
 		return nil
 	}

act/container/parse_env_file_test.go

@@ -1,134 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"bufio"
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/text/encoding"
-	"golang.org/x/text/encoding/unicode"
-)
-
-func newTestHostEnv(t *testing.T) (*HostEnvironment, string) {
-	t.Helper()
-	e := &HostEnvironment{Path: t.TempDir()}
-	return e, filepath.Join(e.Path, "envfile")
-}
-
-func TestParseEnvFileSingleLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO=bar\nBAZ=qux\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-	assert.Equal(t, "qux", env["BAZ"])
-}
-
-func TestParseEnvFileMultiLine(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	content := "FOO<<EOF\nline1\nline2\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "line1\nline2", env["FOO"])
-}
-
-func TestParseEnvFileLargeValueWithinLimit(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	big := strings.Repeat("x", 2*1024*1024)
-	content := "FOO<<EOF\n" + big + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, big, env["FOO"])
-}
-
-func TestParseEnvFileLineExceedsBufferReportsScannerError(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	tooBig := strings.Repeat("x", 17*1024*1024) // over the 16 MiB cap
-	content := "FOO<<EOF\n" + tooBig + "\nEOF\n"
-	require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.ErrorIs(t, err, bufio.ErrTooLong)
-	assert.Contains(t, err.Error(), "reading env file")
-}
-
-// Regression test: a blank line used to fail the job at "Complete Job", after
-// every step had already been recorded as successful.
-func TestParseEnvFileBlankLines(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("\nFOO=bar\n\n   \nBAZ=qux\n\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-	assert.Equal(t, "qux", env["BAZ"])
-}
-
-// blank lines inside a heredoc value are content, not separators
-func TestParseEnvFileMultiLineKeepsBlankLines(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\n\nline2\nEOF\n"), 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "line1\n\nline2", env["FOO"])
-}
-
-func TestParseEnvFileUTF8BOM(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	content := append([]byte{0xEF, 0xBB, 0xBF}, []byte("FOO=bar\n")...)
-	require.NoError(t, os.WriteFile(envPath, content, 0o600))
-
-	env := map[string]string{}
-	require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-	assert.Equal(t, "bar", env["FOO"])
-}
-
-// Windows host mode: PowerShell 5.1 redirection writes UTF-16, which used to be
-// unrecognisable as KEY=VALUE, so the writes were silently ignored.
-func TestParseEnvFileUTF16(t *testing.T) {
-	tests := []struct {
-		name    string
-		encoder *encoding.Encoder
-	}{
-		{"little endian", unicode.UTF16(unicode.LittleEndian, unicode.UseBOM).NewEncoder()},
-		{"big endian", unicode.UTF16(unicode.BigEndian, unicode.UseBOM).NewEncoder()},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			e, envPath := newTestHostEnv(t)
-			content, err := tt.encoder.Bytes([]byte("FOO=bar\r\nMULTI<<EOF\r\nline1\r\nEOF\r\n"))
-			require.NoError(t, err)
-			require.NoError(t, os.WriteFile(envPath, content, 0o600))
-
-			env := map[string]string{}
-			require.NoError(t, parseEnvFile(e, envPath, &env)(context.Background()))
-			assert.Equal(t, "bar", env["FOO"])
-			assert.Equal(t, "line1", env["MULTI"])
-		})
-	}
-}
-
-func TestParseEnvFileMissingDelimiter(t *testing.T) {
-	e, envPath := newTestHostEnv(t)
-	require.NoError(t, os.WriteFile(envPath, []byte("FOO<<EOF\nline1\nline2\n"), 0o600))
-
-	env := map[string]string{}
-	err := parseEnvFile(e, envPath, &env)(context.Background())
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "delimiter")
-}

act/container/util.go

@@ -8,10 +8,23 @@ package container
 
 import (
 	"os"
+	"syscall"
 
 	"github.com/creack/pty"
 )
 
+func getSysProcAttr(_ string, tty bool) *syscall.SysProcAttr {
+	if tty {
+		return &syscall.SysProcAttr{
+			Setsid:  true,
+			Setctty: true,
+		}
+	}
+	return &syscall.SysProcAttr{
+		Setpgid: true,
+	}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return pty.Open()
 }

act/container/util_openbsd_mips64.go

@@ -7,8 +7,15 @@ package container
 import (
 	"errors"
 	"os"
+	"syscall"
 )
 
+func getSysProcAttr(cmdLine string, tty bool) *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{
+		Setpgid: true,
+	}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return nil, nil, errors.New("Unsupported")
 }

act/container/util_plan9.go

@@ -7,8 +7,15 @@ package container
 import (
 	"errors"
 	"os"
+	"syscall"
 )
 
+func getSysProcAttr(cmdLine string, tty bool) *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{
+		Rfork: syscall.RFNOTEG,
+	}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return nil, nil, errors.New("Unsupported")
 }

act/container/util_windows.go

@@ -7,8 +7,13 @@ package container
 import (
 	"errors"
 	"os"
+	"syscall"
 )
 
+func getSysProcAttr(cmdLine string, tty bool) *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{CmdLine: cmdLine, CreationFlags: syscall.CREATE_NEW_PROCESS_GROUP}
+}
+
 func openPty() (*os.File, *os.File, error) {
 	return nil, nil, errors.New("Unsupported")
 }

act/exprparser/functions.go

@@ -266,7 +266,7 @@ func (impl *interperterImpl) jobSuccess() (bool, error) { //nolint:unparam // pr
 	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
 
 	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() != "success" {
+		if jobs[needs].Result != "success" {
 			return false, nil
 		}
 	}
@@ -274,17 +274,8 @@ func (impl *interperterImpl) jobSuccess() (bool, error) { //nolint:unparam // pr
 	return true, nil
 }
 
-// jobStatus returns the current job status, treating a nil Job context as an
-// empty status so status-check functions never panic on a nil dereference.
-func (impl *interperterImpl) jobStatus() string {
-	if impl.env.Job == nil {
-		return ""
-	}
-	return impl.env.Job.Status
-}
-
 func (impl *interperterImpl) stepSuccess() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "success", nil
+	return impl.env.Job.Status == "success", nil
 }
 
 func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
@@ -292,7 +283,7 @@ func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pr
 	jobNeeds := impl.getNeedsTransitive(impl.config.Run.Job())
 
 	for _, needs := range jobNeeds {
-		if jobs[needs].NeedsResult() == "failure" {
+		if jobs[needs].Result == "failure" {
 			return true, nil
 		}
 	}
@@ -301,9 +292,9 @@ func (impl *interperterImpl) jobFailure() (bool, error) { //nolint:unparam // pr
 }
 
 func (impl *interperterImpl) stepFailure() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "failure", nil
+	return impl.env.Job.Status == "failure", nil
 }
 
 func (impl *interperterImpl) cancelled() (bool, error) { //nolint:unparam // pre-existing issue from nektos/act
-	return impl.jobStatus() == "cancelled", nil
+	return impl.env.Job.Status == "cancelled", nil
 }

act/exprparser/functions_test.go

@@ -254,27 +254,3 @@ func TestFunctionFormat(t *testing.T) {
 		})
 	}
 }
-
-func TestStatusFunctionsNilJob(t *testing.T) {
-	// A nil Job context must not panic: the status-check functions should treat
-	// it as an empty status and return false rather than dereferencing nil.
-	env := &EvaluationEnvironment{}
-
-	table := []struct {
-		input   string
-		context string
-		name    string
-	}{
-		{"cancelled()", "job", "cancelled-nil-job"},
-		{"success()", "step", "step-success-nil-job"},
-		{"failure()", "step", "step-failure-nil-job"},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			output, err := NewInterpeter(env, Config{Context: tt.context}).Evaluate(tt.input, DefaultStatusCheckNone)
-			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
-			assert.Equal(t, false, output)
-		})
-	}
-}

act/exprparser/interpreter.go

@@ -251,7 +251,7 @@ func (impl *interperterImpl) evaluateArrayDeref(arrayDerefNode *actionlint.Array
 
 func (impl *interperterImpl) getPropertyValue(left reflect.Value, property string) (value any, err error) {
 	switch left.Kind() {
-	case reflect.Pointer:
+	case reflect.Ptr:
 		return impl.getPropertyValue(left.Elem(), property)
 
 	case reflect.Struct:
@@ -321,7 +321,7 @@ func (impl *interperterImpl) getPropertyValue(left reflect.Value, property strin
 }
 
 func (impl *interperterImpl) getMapValue(value reflect.Value) (any, error) {
-	if value.Kind() == reflect.Pointer {
+	if value.Kind() == reflect.Ptr {
 		return impl.getMapValue(value.Elem())
 	}
 

act/filecollector/file_collector.go

@@ -73,16 +73,10 @@ func (cc *CopyCollector) WriteFile(fpath string, fi fs.FileInfo, linkName string
 	if err := os.MkdirAll(filepath.Dir(fdestpath), 0o777); err != nil {
 		return err
 	}
-	// Remove any existing destination so we can overwrite read-only files
-	// (e.g. git pack files at mode 0444 trip EACCES on macOS and "Access is
-	// denied" on Windows when reopened with O_WRONLY) and so os.Symlink does
-	// not fail with EEXIST. os.Remove clears the Windows read-only attribute
-	// internally; on Unix unlink only needs write permission on the parent.
-	_ = os.Remove(fdestpath)
 	if f == nil {
 		return os.Symlink(linkName, fdestpath)
 	}
-	df, err := os.OpenFile(fdestpath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fi.Mode())
+	df, err := os.OpenFile(fdestpath, os.O_CREATE|os.O_WRONLY, fi.Mode())
 	if err != nil {
 		return err
 	}

act/filecollector/file_collector_test.go

@@ -8,12 +8,9 @@ import (
 	"archive/tar"
 	"context"
 	"io"
-	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-billy/v5/memfs"
@@ -23,7 +20,6 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/format/index"
 	"github.com/go-git/go-git/v5/storage/filesystem"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 type memoryFs struct {
@@ -178,107 +174,3 @@ func TestSymlinks(t *testing.T) {
 	assert.Equal(t, ".env", files["test.env"].Linkname)
 	assert.ErrorIs(t, err, io.EOF, "tar must be read cleanly to EOF")
 }
-
-// Regression for https://gitea.com/gitea/runner/issues/876 and /941:
-// re-copying an action directory must overwrite a pre-existing read-only
-// file (e.g. a git pack .idx at mode 0444) instead of failing with EACCES
-// on macOS or "Access is denied" on Windows.
-func TestCopyCollectorWriteFileOverwritesReadOnlyFile(t *testing.T) {
-	dst := t.TempDir()
-	target := filepath.Join(dst, "sub", "pack.idx")
-	require.NoError(t, os.MkdirAll(filepath.Dir(target), 0o755))
-	require.NoError(t, os.WriteFile(target, []byte("old"), 0o444))
-
-	src := filepath.Join(t.TempDir(), "pack.idx")
-	require.NoError(t, os.WriteFile(src, []byte("new"), 0o444))
-	fi, err := os.Stat(src)
-	require.NoError(t, err)
-
-	cc := &CopyCollector{DstDir: dst}
-	require.NoError(t, cc.WriteFile("sub/pack.idx", fi, "", strings.NewReader("new")))
-
-	got, err := os.ReadFile(target)
-	require.NoError(t, err)
-	assert.Equal(t, "new", string(got))
-}
-
-// Without the destination removal, os.Symlink fails with EEXIST when the
-// path already holds a regular file from an earlier copy of the action.
-func TestCopyCollectorWriteFileOverwritesFileWithSymlink(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating symlinks requires elevated privileges on Windows")
-	}
-	dst := t.TempDir()
-	target := filepath.Join(dst, "link")
-	require.NoError(t, os.WriteFile(target, []byte("stale"), 0o644))
-
-	fi, err := os.Lstat(target)
-	require.NoError(t, err)
-
-	cc := &CopyCollector{DstDir: dst}
-	require.NoError(t, cc.WriteFile("link", fi, "target", nil))
-
-	resolved, err := os.Readlink(target)
-	require.NoError(t, err)
-	assert.Equal(t, "target", resolved)
-}
-
-func TestDefaultFsOpenReadlinkAndWalk(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating symlinks requires elevated privileges on Windows")
-	}
-
-	root := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(root, "file.txt"), []byte("content"), 0o644))
-	require.NoError(t, os.Symlink("file.txt", filepath.Join(root, "link.txt")))
-
-	fsys := &DefaultFs{}
-	var walked []string
-	require.NoError(t, fsys.Walk(root, func(path string, info os.FileInfo, err error) error {
-		require.NoError(t, err)
-		walked = append(walked, info.Name())
-		return nil
-	}))
-	require.Contains(t, walked, "file.txt")
-	require.Contains(t, walked, "link.txt")
-
-	file, err := fsys.Open(filepath.Join(root, "file.txt"))
-	require.NoError(t, err)
-	data, err := io.ReadAll(file)
-	require.NoError(t, err)
-	require.NoError(t, file.Close())
-	require.Equal(t, "content", string(data))
-
-	link, err := fsys.Readlink(filepath.Join(root, "link.txt"))
-	require.NoError(t, err)
-	require.Equal(t, "file.txt", link)
-}
-
-func TestFileCollectorCancellationAndWalkError(t *testing.T) {
-	fc := &FileCollector{Fs: &memoryFs{Filesystem: memfs.New()}}
-	walk := fc.CollectFiles(cancelledContext(t), nil)
-
-	err := walk("file", fakeFileInfo{name: "file"}, nil)
-	require.EqualError(t, err, "copy cancelled")
-
-	err = walk("file", fakeFileInfo{name: "file"}, os.ErrPermission)
-	require.ErrorIs(t, err, os.ErrPermission)
-}
-
-func cancelledContext(t *testing.T) context.Context {
-	t.Helper()
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	return ctx
-}
-
-type fakeFileInfo struct {
-	name string
-}
-
-func (f fakeFileInfo) Name() string       { return f.name }
-func (f fakeFileInfo) Size() int64        { return 0 }
-func (f fakeFileInfo) Mode() os.FileMode  { return 0o644 }
-func (f fakeFileInfo) ModTime() time.Time { return time.Time{} }
-func (f fakeFileInfo) IsDir() bool        { return false }
-func (f fakeFileInfo) Sys() any           { return nil }

act/lookpath/env.go

@@ -4,6 +4,18 @@
 
 package lookpath
 
+import "os"
+
 type Env interface {
 	Getenv(name string) string
 }
+
+type defaultEnv struct{}
+
+func (*defaultEnv) Getenv(name string) string {
+	return os.Getenv(name)
+}
+
+func LookPath(file string) (string, error) {
+	return LookPath2(file, &defaultEnv{})
+}

act/lookpath/lp_unix_test.go

@@ -1,74 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-
-package lookpath
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-type testEnv map[string]string
-
-func (e testEnv) Getenv(name string) string {
-	return e[name]
-}
-
-func TestLookPath2SearchesPathAndEmptyElement(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2("tool", testEnv{"PATH": string(filepath.ListSeparator) + dir})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2DirectPathDoesNotSearchPath(t *testing.T) {
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "tool")
-	if err := os.WriteFile(exe, []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := LookPath2(exe, testEnv{"PATH": ""})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != exe {
-		t.Fatalf("LookPath2() = %q, want %q", got, exe)
-	}
-}
-
-func TestLookPath2ReportsPermissionAndNotFound(t *testing.T) {
-	dir := t.TempDir()
-	file := filepath.Join(dir, "not-executable")
-	if err := os.WriteFile(file, []byte("plain text"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := LookPath2(file, testEnv{"PATH": dir})
-	var pathErr *Error
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, fs.ErrPermission) {
-		t.Fatalf("LookPath2(non-executable) error = %v, want fs.ErrPermission wrapped in *Error", err)
-	}
-	if pathErr.Error() != fs.ErrPermission.Error() {
-		t.Fatalf("Error() = %q, want %q", pathErr.Error(), fs.ErrPermission.Error())
-	}
-
-	_, err = LookPath2("missing", testEnv{"PATH": dir})
-	if !errors.As(err, &pathErr) || !errors.Is(pathErr.Err, ErrNotFound) {
-		t.Fatalf("LookPath2(missing) error = %v, want ErrNotFound wrapped in *Error", err)
-	}
-}

act/lookpath/lp_windows.go

@@ -62,7 +62,7 @@ func LookPath2(file string, lenv Env) (string, error) {
 	var exts []string
 	x := lenv.Getenv(`PATHEXT`)
 	if x != "" {
-		for e := range strings.SplitSeq(strings.ToLower(x), `;`) {
+		for _, e := range strings.Split(strings.ToLower(x), `;`) {
 			if e == "" {
 				continue
 			}

act/model/action.go

@@ -76,19 +76,17 @@ func (a ActionRunsUsing) IsComposite() bool {
 
 // ActionRuns are a field in Action
 type ActionRuns struct {
-	Using          ActionRunsUsing   `yaml:"using"`
-	Env            map[string]string `yaml:"env"`
-	Main           string            `yaml:"main"`
-	Pre            string            `yaml:"pre"`
-	PreIf          string            `yaml:"pre-if"`
-	Post           string            `yaml:"post"`
-	PostIf         string            `yaml:"post-if"`
-	Image          string            `yaml:"image"`
-	PreEntrypoint  string            `yaml:"pre-entrypoint"`
-	Entrypoint     string            `yaml:"entrypoint"`
-	PostEntrypoint string            `yaml:"post-entrypoint"`
-	Args           []string          `yaml:"args"`
-	Steps          []Step            `yaml:"steps"`
+	Using      ActionRunsUsing   `yaml:"using"`
+	Env        map[string]string `yaml:"env"`
+	Main       string            `yaml:"main"`
+	Pre        string            `yaml:"pre"`
+	PreIf      string            `yaml:"pre-if"`
+	Post       string            `yaml:"post"`
+	PostIf     string            `yaml:"post-if"`
+	Image      string            `yaml:"image"`
+	Entrypoint string            `yaml:"entrypoint"`
+	Args       []string          `yaml:"args"`
+	Steps      []Step            `yaml:"steps"`
 }
 
 // Action describes a metadata file for GitHub actions. The metadata filename must be either action.yml or action.yaml. The data in the metadata file defines the inputs, outputs and main entrypoint for your action.

act/model/action_test.go

@@ -1,82 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package model
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestReadActionDefaultsAndCaseInsensitiveUsing(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-name: example
-runs:
-  using: NoDe24
-  main: dist/index.js
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.Using != ActionRunsUsingNode24 {
-		t.Fatalf("using = %q, want %q", action.Runs.Using, ActionRunsUsingNode24)
-	}
-	if action.Runs.PreIf != "always()" {
-		t.Fatalf("pre-if = %q, want always()", action.Runs.PreIf)
-	}
-	if action.Runs.PostIf != "always()" {
-		t.Fatalf("post-if = %q, want always()", action.Runs.PostIf)
-	}
-}
-
-func TestReadActionPreservesExplicitConditions(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-runs:
-  using: composite
-  pre-if: success()
-  post-if: failure()
-  steps:
-    - run: echo hello
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.PreIf != "success()" || action.Runs.PostIf != "failure()" {
-		t.Fatalf("conditions = %q/%q, want explicit values", action.Runs.PreIf, action.Runs.PostIf)
-	}
-	if !action.Runs.Using.IsComposite() || action.Runs.Using.IsDocker() || action.Runs.Using.IsNode() {
-		t.Fatalf("unexpected using predicates for %q", action.Runs.Using)
-	}
-}
-
-func TestReadActionRejectsUnknownUsing(t *testing.T) {
-	_, err := ReadAction(strings.NewReader(`
-runs:
-  using: node99
-`))
-	if err == nil {
-		t.Fatal("expected unknown runs.using to fail")
-	}
-	if !strings.Contains(err.Error(), "node99") {
-		t.Fatalf("error = %q, want invalid value", err)
-	}
-}
-
-func TestReadActionDockerEntrypoints(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-runs:
-  using: docker
-  image: Dockerfile
-  pre-entrypoint: pre.sh
-  post-entrypoint: post.sh
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.PreEntrypoint != "pre.sh" {
-		t.Fatalf("pre-entrypoint = %q, want pre.sh", action.Runs.PreEntrypoint)
-	}
-	if action.Runs.PostEntrypoint != "post.sh" {
-		t.Fatalf("post-entrypoint = %q, want post.sh", action.Runs.PostEntrypoint)
-	}
-}

act/model/planner_test.go

@@ -6,12 +6,10 @@ package model
 
 import (
 	"path/filepath"
-	"strings"
 	"testing"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 type WorkflowPlanTest struct {
@@ -67,133 +65,3 @@ func TestWorkflow(t *testing.T) {
 	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
 	assert.NotNil(t, result)
 }
-
-func TestNewSingleWorkflowPlannerAndPlanMethods(t *testing.T) {
-	planner, err := NewSingleWorkflowPlanner("ci.yml", strings.NewReader(`
-name: CI
-on: [push, pull_request]
-jobs:
-  build:
-    name: Build project
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-  test:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`))
-	require.NoError(t, err)
-
-	assert.Equal(t, []string{"pull_request", "push"}, planner.GetEvents())
-
-	eventPlan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, eventPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, eventPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, eventPlan.Stages[1].GetJobIDs())
-	assert.Equal(t, len("Build project"), eventPlan.MaxRunNameLen())
-	assert.Equal(t, "Build project", eventPlan.Stages[0].Runs[0].String())
-	assert.Equal(t, "build", eventPlan.Stages[0].Runs[0].JobID)
-	assert.NotNil(t, eventPlan.Stages[0].Runs[0].Job())
-
-	jobPlan, err := planner.PlanJob("test")
-	require.NoError(t, err)
-	require.Len(t, jobPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, jobPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, jobPlan.Stages[1].GetJobIDs())
-
-	allPlan, err := planner.PlanAll()
-	require.NoError(t, err)
-	require.Len(t, allPlan.Stages, 2)
-	assert.Equal(t, []string{"build"}, allPlan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, allPlan.Stages[1].GetJobIDs())
-}
-
-func TestCombineWorkflowPlannerMergesWorkflowStages(t *testing.T) {
-	first := mustReadWorkflow(t, `
-name: First
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make build
-`)
-	second := mustReadWorkflow(t, `
-name: Second
-on: push
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - run: make lint
-  test:
-    needs: lint
-    runs-on: ubuntu-latest
-    steps:
-      - run: make test
-`)
-
-	planner := CombineWorkflowPlanner(first, second)
-	plan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-	require.Len(t, plan.Stages, 2)
-	assert.ElementsMatch(t, []string{"build", "lint"}, plan.Stages[0].GetJobIDs())
-	assert.Equal(t, []string{"test"}, plan.Stages[1].GetJobIDs())
-
-	empty, err := planner.PlanEvent("schedule")
-	require.NoError(t, err)
-	assert.Empty(t, empty.Stages)
-}
-
-func TestPlannerErrorsForMissingAndCyclicJobs(t *testing.T) {
-	workflow := mustReadWorkflow(t, `
-name: Cyclic
-on: push
-jobs:
-  a:
-    needs: b
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo a
-  b:
-    needs: a
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo b
-`)
-	planner := CombineWorkflowPlanner(workflow)
-
-	plan, err := planner.PlanJob("missing")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "Could not find any stages")
-
-	plan, err = planner.PlanEvent("push")
-	require.Error(t, err)
-	assert.Empty(t, plan.Stages)
-	assert.Contains(t, err.Error(), "unable to build dependency graph")
-}
-
-func TestNewSingleWorkflowPlannerErrors(t *testing.T) {
-	_, err := NewSingleWorkflowPlanner("empty.yml", strings.NewReader(""))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "file is empty")
-
-	_, err = NewSingleWorkflowPlanner("invalid.yml", strings.NewReader("jobs: ["))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "workflow is not valid")
-}
-
-func mustReadWorkflow(t *testing.T, content string) *Workflow {
-	t.Helper()
-
-	workflow, err := ReadWorkflow(strings.NewReader(content))
-	require.NoError(t, err)
-	if workflow.Name == "" {
-		workflow.Name = "workflow"
-	}
-	return workflow
-}

act/model/testdata/container-volumes/push.yml

@@ -5,7 +5,7 @@ jobs:
   with-volumes:
     runs-on: ubuntu-latest
     container:
-      image: node:24-bookworm-slim
+      image: node:16-buster-slim
       volumes:
         - my_docker_volume:/path/to/volume
         - /path/to/nonexist/directory

act/model/workflow.go

@@ -190,52 +190,23 @@ func (w *Workflow) WorkflowCallConfig() *WorkflowCall {
 
 // Job is the structure of one job in a workflow
 type Job struct {
-	Name               string                    `yaml:"name"`
-	RawNeeds           yaml.Node                 `yaml:"needs"`
-	RawRunsOn          yaml.Node                 `yaml:"runs-on"`
-	Env                yaml.Node                 `yaml:"env"`
-	If                 yaml.Node                 `yaml:"if"`
-	Steps              []*Step                   `yaml:"steps"`
-	TimeoutMinutes     string                    `yaml:"timeout-minutes"`
-	RawContinueOnError string                    `yaml:"continue-on-error"`
-	Services           map[string]*ContainerSpec `yaml:"services"`
-	Strategy           *Strategy                 `yaml:"strategy"`
-	RawContainer       yaml.Node                 `yaml:"container"`
-	Defaults           Defaults                  `yaml:"defaults"`
-	Outputs            map[string]string         `yaml:"outputs"`
-	Uses               string                    `yaml:"uses"`
-	With               map[string]any            `yaml:"with"`
-	RawSecrets         yaml.Node                 `yaml:"secrets"`
-	RawPermissions     yaml.Node                 `yaml:"permissions"`
-	Result             string
-	// Runtime fields set during execution (not from YAML):
-	ContinueOnError bool // true when all failing matrix combinations had continue-on-error=true
-	hasFirmFailure  bool // true once any combination failed without continue-on-error
-}
-
-// SetContinueOnError records whether this combination's failure should not fail the workflow.
-// Must be called under the job lock. Safe across parallel matrix combinations.
-func (j *Job) SetContinueOnError(continueOnErr bool) {
-	if continueOnErr {
-		if !j.hasFirmFailure {
-			j.ContinueOnError = true
-		}
-	} else {
-		j.hasFirmFailure = true
-		j.ContinueOnError = false
-	}
-}
-
-// NeedsResult returns the job result as seen by dependent jobs through the
-// `needs` context. A job that failed but was tolerated via continue-on-error
-// reports "success" to its dependents, matching GitHub: such a failure must not
-// block jobs gated on the default `if: success()`, even though the overall
-// workflow run is still marked as failed.
-func (j *Job) NeedsResult() string {
-	if j.Result == "failure" && j.ContinueOnError {
-		return "success"
-	}
-	return j.Result
+	Name           string                    `yaml:"name"`
+	RawNeeds       yaml.Node                 `yaml:"needs"`
+	RawRunsOn      yaml.Node                 `yaml:"runs-on"`
+	Env            yaml.Node                 `yaml:"env"`
+	If             yaml.Node                 `yaml:"if"`
+	Steps          []*Step                   `yaml:"steps"`
+	TimeoutMinutes string                    `yaml:"timeout-minutes"`
+	Services       map[string]*ContainerSpec `yaml:"services"`
+	Strategy       *Strategy                 `yaml:"strategy"`
+	RawContainer   yaml.Node                 `yaml:"container"`
+	Defaults       Defaults                  `yaml:"defaults"`
+	Outputs        map[string]string         `yaml:"outputs"`
+	Uses           string                    `yaml:"uses"`
+	With           map[string]any            `yaml:"with"`
+	RawSecrets     yaml.Node                 `yaml:"secrets"`
+	RawPermissions yaml.Node                 `yaml:"permissions"`
+	Result         string
 }
 
 // Strategy for the job
@@ -354,20 +325,14 @@ func (j *Job) Needs() []string {
 
 // RunsOn list for Job
 func (j *Job) RunsOn() []string {
-	return RunsOnFromNode(j.RawRunsOn)
-}
-
-// RunsOnFromNode parses the runs-on labels from a raw runs-on node, so callers can evaluate a
-// copy of the node (avoiding mutation of the shared Job) before reading the labels.
-func RunsOnFromNode(rawRunsOn yaml.Node) []string {
-	switch rawRunsOn.Kind {
+	switch j.RawRunsOn.Kind {
 	case yaml.MappingNode:
 		var val struct {
 			Group  string
 			Labels yaml.Node
 		}
 
-		if !decodeNode(rawRunsOn, &val) {
+		if !decodeNode(j.RawRunsOn, &val) {
 			return nil
 		}
 
@@ -379,7 +344,7 @@ func RunsOnFromNode(rawRunsOn yaml.Node) []string {
 
 		return labels
 	default:
-		return nodeAsStringSlice(rawRunsOn)
+		return nodeAsStringSlice(j.RawRunsOn)
 	}
 }
 
@@ -680,33 +645,6 @@ type Step struct {
 	TimeoutMinutes     string            `yaml:"timeout-minutes"`
 }
 
-// Clone returns a deep copy safe to mutate independently of s. Job steps are shared across
-// parallel matrix runs, which mutate per-job fields (ID, Number, Shell) and evaluate the If/Env
-// yaml.Nodes in place, so each job must own its copy.
-func (s *Step) Clone() *Step {
-	clone := *s
-	clone.If = CloneYamlNode(s.If)
-	clone.Env = CloneYamlNode(s.Env)
-	clone.With = maps.Clone(s.With)
-	return &clone
-}
-
-// CloneYamlNode returns a deep copy of a yaml.Node so callers can evaluate it in place without
-// mutating a node shared across parallel jobs.
-func CloneYamlNode(n yaml.Node) yaml.Node {
-	clone := n
-	if n.Content != nil {
-		clone.Content = make([]*yaml.Node, len(n.Content))
-		for i, child := range n.Content {
-			if child != nil {
-				childClone := CloneYamlNode(*child)
-				clone.Content[i] = &childClone
-			}
-		}
-	}
-	return clone
-}
-
 // String gets the name of step
 func (s *Step) String() string {
 	if s.Name != "" {

act/model/workflow_test.go

@@ -5,244 +5,13 @@
 package model
 
 import (
-	"fmt"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
 )
 
-// TestStepCloneIsolatesMutableFields guards the parallel-matrix race fix: combinations share the
-// job's *Step, and Clone() must hand each a copy whose If/Env nodes and With map can be mutated
-// independently. A shallow copy would share Env.Content's backing array (and the With map) and
-// leak writes across combinations.
-func TestStepCloneIsolatesMutableFields(t *testing.T) {
-	var orig Step
-	require.NoError(t, yaml.Unmarshal([]byte("if: ${{ env.X == 'a' }}\nenv:\n  KEY: original\nwith:\n  arg: original\n"), &orig))
-	require.Len(t, orig.Env.Content, 2) // [key, value]
-
-	clone := orig.Clone()
-	clone.If.Value = "changed"
-	clone.Env.Content[1].Value = "changed"
-	clone.With["arg"] = "changed"
-
-	assert.Equal(t, "${{ env.X == 'a' }}", orig.If.Value, "If must not be shared with the clone")
-	assert.Equal(t, "original", orig.Env.Content[1].Value, "Env nodes must not be shared with the clone")
-	assert.Equal(t, "original", orig.With["arg"], "With map must not be shared with the clone")
-}
-
-// TestJobNeedsResult guards the continue-on-error semantics exposed to dependent
-// jobs through the `needs` context: a failed-but-tolerated job reports "success"
-// so it does not block dependents gated on the default `if: success()`, matching
-// GitHub. A firm failure and any non-failure result are reported verbatim.
-func TestJobNeedsResult(t *testing.T) {
-	cases := []struct {
-		name            string
-		result          string
-		continueOnError bool
-		want            string
-	}{
-		{"tolerated failure reports success", "failure", true, "success"},
-		{"firm failure reports failure", "failure", false, "failure"},
-		{"success is unchanged", "success", false, "success"},
-		{"success with continue-on-error is unchanged", "success", true, "success"},
-		{"empty result is unchanged", "", true, ""},
-		{"skipped is unchanged", "skipped", true, "skipped"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			j := &Job{Result: tc.result, ContinueOnError: tc.continueOnError}
-			assert.Equal(t, tc.want, j.NeedsResult())
-		})
-	}
-}
-
-func TestJobSetContinueOnErrorFirmFailureWins(t *testing.T) {
-	job := &Job{}
-	job.SetContinueOnError(true)
-	assert.True(t, job.ContinueOnError)
-
-	job.SetContinueOnError(false)
-	assert.False(t, job.ContinueOnError)
-
-	job.SetContinueOnError(true)
-	assert.False(t, job.ContinueOnError, "a later tolerated failure must not hide an earlier firm failure")
-}
-
-func TestStepStatusText(t *testing.T) {
-	for _, tc := range []struct {
-		status stepStatus
-		text   string
-	}{
-		{StepStatusSuccess, "success"},
-		{StepStatusFailure, "failure"},
-		{StepStatusSkipped, "skipped"},
-	} {
-		t.Run(tc.text, func(t *testing.T) {
-			got, err := tc.status.MarshalText()
-			require.NoError(t, err)
-			assert.Equal(t, tc.text, string(got))
-
-			var parsed stepStatus
-			require.NoError(t, parsed.UnmarshalText(got))
-			assert.Equal(t, tc.status, parsed)
-			assert.Equal(t, tc.text, parsed.String())
-		})
-	}
-
-	var parsed stepStatus
-	require.Error(t, parsed.UnmarshalText([]byte("cancelled")))
-	assert.Empty(t, stepStatus(99).String())
-}
-
-func TestWorkflowCallConfig(t *testing.T) {
-	workflow, err := ReadWorkflow(strings.NewReader(`
-on:
-  workflow_call:
-    inputs:
-      name:
-        required: true
-        type: string
-    outputs:
-      digest:
-        value: ${{ jobs.build.outputs.digest }}
-jobs: {}
-`))
-	require.NoError(t, err)
-
-	config := workflow.WorkflowCallConfig()
-	require.NotNil(t, config)
-	require.Contains(t, config.Inputs, "name")
-	assert.True(t, config.Inputs["name"].Required)
-	assert.Equal(t, "string", config.Inputs["name"].Type)
-	assert.Equal(t, "${{ jobs.build.outputs.digest }}", config.Outputs["digest"].Value)
-
-	listWorkflow, err := ReadWorkflow(strings.NewReader("on: [workflow_call]\njobs: {}\n"))
-	require.NoError(t, err)
-	assert.NotNil(t, listWorkflow.WorkflowCallConfig())
-	assert.Empty(t, listWorkflow.WorkflowCallConfig().Inputs)
-}
-
-func TestJobSecretsAndEnvironment(t *testing.T) {
-	inheritJob := readJob(t, `
-secrets: inherit
-env:
-  A: one
-  B: two
-`)
-	assert.True(t, inheritJob.InheritSecrets())
-	assert.Nil(t, inheritJob.Secrets())
-	assert.Equal(t, map[string]string{"A": "one", "B": "two"}, inheritJob.Environment())
-
-	mappingJob := readJob(t, `
-secrets:
-  TOKEN: ${{ secrets.TOKEN }}
-`)
-	assert.False(t, mappingJob.InheritSecrets())
-	assert.Equal(t, map[string]string{"TOKEN": "${{ secrets.TOKEN }}"}, mappingJob.Secrets())
-}
-
-func TestJobTypeAndString(t *testing.T) {
-	tests := []struct {
-		job     Job
-		want    JobType
-		wantErr bool
-	}{
-		{job: Job{}, want: JobTypeDefault},
-		{job: Job{Uses: "./.github/workflows/reuse.yml"}, want: JobTypeReusableWorkflowLocal},
-		{job: Job{Uses: "owner/repo/.github/workflows/reuse.yaml@v1"}, want: JobTypeReusableWorkflowRemote},
-		{job: Job{Uses: "owner/repo/.github/workflows/reuse.yaml"}, want: JobTypeInvalid, wantErr: true},
-	}
-
-	for _, tc := range tests {
-		t.Run(fmt.Sprintf("%s/%s", tc.job.Uses, tc.want), func(t *testing.T) {
-			got, err := tc.job.Type()
-			if tc.wantErr {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
-			assert.Equal(t, tc.want, got)
-		})
-	}
-
-	assert.Equal(t, "default", JobTypeDefault.String())
-	assert.Equal(t, "local-reusable-workflow", JobTypeReusableWorkflowLocal.String())
-	assert.Equal(t, "remote-reusable-workflow", JobTypeReusableWorkflowRemote.String())
-	assert.Equal(t, "unknown", JobType(99).String())
-}
-
-func TestStepStringEnvironmentEnvAndType(t *testing.T) {
-	step := readStep(t, `
-id: example
-env:
-  DIRECT: value
-with:
-  mixed-key: input
-`)
-	assert.Equal(t, "example", step.String())
-	assert.Equal(t, map[string]string{"DIRECT": "value"}, step.Environment())
-	assert.Equal(t, map[string]string{"DIRECT": "value", "INPUT_MIXED-KEY": "input"}, step.GetEnv())
-
-	for _, tc := range []struct {
-		step Step
-		want StepType
-	}{
-		{step: Step{}, want: StepTypeInvalid},
-		{step: Step{Run: "echo hi"}, want: StepTypeRun},
-		{step: Step{Run: "echo hi", Uses: "actions/checkout@v4"}, want: StepTypeInvalid},
-		{step: Step{Uses: "docker://alpine:latest"}, want: StepTypeUsesDockerURL},
-		{step: Step{Uses: "./.github/workflows/reuse.yml"}, want: StepTypeReusableWorkflowLocal},
-		{step: Step{Uses: "owner/repo/.github/workflows/reuse.yml@v1"}, want: StepTypeReusableWorkflowRemote},
-		{step: Step{Uses: "./actions/local"}, want: StepTypeUsesActionLocal},
-		{step: Step{Uses: "actions/checkout@v4"}, want: StepTypeUsesActionRemote},
-	} {
-		t.Run(tc.want.String(), func(t *testing.T) {
-			assert.Equal(t, tc.want, tc.step.Type())
-		})
-	}
-
-	assert.Equal(t, "invalid", StepTypeInvalid.String())
-	assert.Equal(t, "run", StepTypeRun.String())
-	assert.Equal(t, "local-action", StepTypeUsesActionLocal.String())
-	assert.Equal(t, "remote-action", StepTypeUsesActionRemote.String())
-	assert.Equal(t, "docker", StepTypeUsesDockerURL.String())
-	assert.Equal(t, "local-reusable-workflow", StepTypeReusableWorkflowLocal.String())
-	assert.Equal(t, "remote-reusable-workflow", StepTypeReusableWorkflowRemote.String())
-	assert.Equal(t, "unknown", StepType(99).String())
-	assert.NotEmpty(t, (&Step{Uses: "actions/checkout@v4"}).UsesHash())
-}
-
-func TestWorkflowGetJobAndIDs(t *testing.T) {
-	workflow := &Workflow{Jobs: map[string]*Job{"build": {}}}
-	assert.Equal(t, []string{"build"}, workflow.GetJobIDs())
-
-	job := workflow.GetJob("build")
-	require.NotNil(t, job)
-	assert.Equal(t, "build", job.Name)
-	assert.Equal(t, "success()", job.If.Value)
-	assert.Nil(t, workflow.GetJob("missing"))
-}
-
-func TestRawConcurrencyYaml(t *testing.T) {
-	var expr RawConcurrency
-	require.NoError(t, yaml.Unmarshal([]byte("group-${{ github.ref }}"), &expr))
-	assert.Equal(t, "group-${{ github.ref }}", expr.RawExpression)
-	marshaled, err := expr.MarshalYAML()
-	require.NoError(t, err)
-	assert.Equal(t, "group-${{ github.ref }}", marshaled)
-
-	var object RawConcurrency
-	require.NoError(t, yaml.Unmarshal([]byte("group: ci\ncancel-in-progress: true\n"), &object))
-	assert.Equal(t, "ci", object.Group)
-	assert.Equal(t, "true", object.CancelInProgress)
-	marshaled, err = object.MarshalYAML()
-	require.NoError(t, err)
-	assert.Equal(t, (*objectConcurrency)(&object), marshaled)
-}
-
 func TestReadWorkflow_ScheduleEvent(t *testing.T) {
 	yaml := `
 name: local-action-docker-url
@@ -1137,19 +906,3 @@ func TestJobMatrixValidation(t *testing.T) {
 		assert.Nil(t, matrix, "matrix with nested map should return nil")
 	})
 }
-
-func readJob(t *testing.T, content string) *Job {
-	t.Helper()
-
-	var job Job
-	require.NoError(t, yaml.Unmarshal([]byte(content), &job))
-	return &job
-}
-
-func readStep(t *testing.T, content string) *Step {
-	t.Helper()
-
-	var step Step
-	require.NoError(t, yaml.Unmarshal([]byte(content), &step))
-	return &step
-}

act/runner/action.go

@@ -6,9 +6,7 @@ package runner
 
 import (
 	"context"
-	"crypto/sha256"
 	"embed"
-	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -21,7 +19,6 @@ import (
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
 	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
@@ -47,11 +44,6 @@ type runAction func(step actionStep, actionDir string, remoteAction *remoteActio
 //go:embed res/trampoline.js
 var trampoline embed.FS
 
-var (
-	ContainerImageExistsLocally     = container.ImageExistsLocally
-	ContainerNewDockerBuildExecutor = container.NewDockerBuildExecutor
-)
-
 func readActionImpl(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
 	logger := common.Logger(ctx)
 	allErrors := []error{}
@@ -156,8 +148,6 @@ func maybeCopyToActionDir(ctx context.Context, step actionStep, actionDir, actio
 		return rc.JobContainer.CopyTarStream(ctx, containerActionDirCopy, ta)
 	}
 
-	defer git.AcquireCloneLock(actionDir)()
-
 	if err := removeGitIgnore(ctx, actionDir); err != nil {
 		return err
 	}
@@ -207,7 +197,7 @@ func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction
 			if remoteAction == nil {
 				location = containerActionDir
 			}
-			return execAsDocker(ctx, step, actionName, actionDir, location, remoteAction == nil, stepStageMain)
+			return execAsDocker(ctx, step, actionName, location, remoteAction == nil)
 		case x.IsComposite():
 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
@@ -274,38 +264,8 @@ func removeGitIgnore(ctx context.Context, directory string) error {
 	return nil
 }
 
-// dockerActionImageTag derives the local docker image tag used when an action
-// is built from a Dockerfile.
-//
-// For Gitea: a local action (`uses: ./` or `uses: ./path`) has an actionName
-// that is the workspace-relative path of the action. That path is identical
-// across repositories (e.g. "./" for a self-referencing action), so without
-// namespacing, every repository's local docker action would build and reuse the
-// same `act-dockeraction:latest` image on a shared docker daemon. A subsequent
-// repository would then silently run the image built for an earlier one.
-// Including the repository keeps the tag stable for caching within a repository
-// while preventing cross-repository collisions.
-// See https://gitea.com/gitea/runner/issues/1039.
-func dockerActionImageTag(repository, actionName string, localAction bool) string {
-	name := actionName
-	if localAction {
-		name = path.Join(repository, actionName)
-	}
-	// The human-readable name is sanitized by collapsing every non-alphanumeric character to "-".
-	sanitized := regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(name, "-")
-	if localAction {
-		// For local actions a short hash of the raw repository and action path is appended so the tag stays unique per repository.
-		sum := sha256.Sum256([]byte(repository + "\x00" + actionName))
-		sanitized += "-" + hex.EncodeToString(sum[:])[:12]
-	}
-	// "-dockeraction" ensures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
-	image := fmt.Sprintf("%s-dockeraction:%s", sanitized, "latest")
-	image = "act-" + strings.TrimLeft(image, "-")
-	return strings.ToLower(image)
-}
-
 // TODO: break out parts of function to reduce complexicity
-func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, basedir string, localAction bool, stage stepStage) error {
+func execAsDocker(ctx context.Context, step actionStep, actionName, basedir string, localAction bool) error {
 	logger := common.Logger(ctx)
 	rc := step.getRunContext()
 	action := step.getActionModel()
@@ -318,15 +278,18 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 		// Apply forcePull only for prebuild docker images
 		forcePull = rc.Config.ForcePull
 	} else {
-		image = dockerActionImageTag(step.getGithubContext(ctx).Repository, actionName, localAction)
+		// "-dockeraction" enshures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
+		image = fmt.Sprintf("%s-dockeraction:%s", regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(actionName, "-"), "latest")
+		image = "act-" + strings.TrimLeft(image, "-")
+		image = strings.ToLower(image)
 		contextDir, fileName := filepath.Split(filepath.Join(basedir, action.Runs.Image))
 
-		anyArchExists, err := ContainerImageExistsLocally(ctx, image, "any")
+		anyArchExists, err := container.ImageExistsLocally(ctx, image, "any")
 		if err != nil {
 			return err
 		}
 
-		correctArchExists, err := ContainerImageExistsLocally(ctx, image, rc.Config.ContainerArchitecture)
+		correctArchExists, err := container.ImageExistsLocally(ctx, image, rc.Config.ContainerArchitecture)
 		if err != nil {
 			return err
 		}
@@ -358,21 +321,13 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 				}
 				defer buildContext.Close()
 			}
-			prepImage = ContainerNewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
+			prepImage = container.NewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
 				ContextDir:   contextDir,
 				Dockerfile:   fileName,
 				ImageTag:     image,
 				BuildContext: buildContext,
 				Platform:     rc.Config.ContainerArchitecture,
 			})
-			if buildContext == nil {
-				// Held across the whole build: the daemon drains contextDir lazily.
-				inner := prepImage
-				prepImage = func(ctx context.Context) error {
-					defer git.AcquireCloneLock(actionDir)()
-					return inner(ctx)
-				}
-			}
 		} else {
 			logger.Debugf("image '%s' for architecture '%s' already exists", image, rc.Config.ContainerArchitecture)
 		}
@@ -386,9 +341,16 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 		cmd = action.Runs.Args
 		evalDockerArgs(ctx, step, action, &cmd)
 	}
-	entrypoint, err := dockerEntrypoint(ctx, step, eval, stage)
-	if err != nil {
-		return err
+	entrypoint := strings.Fields(eval.Interpolate(ctx, step.getStepModel().With["entrypoint"]))
+	if len(entrypoint) == 0 {
+		if action.Runs.Entrypoint != "" {
+			entrypoint, err = shellquote.Split(action.Runs.Entrypoint)
+			if err != nil {
+				return err
+			}
+		} else {
+			entrypoint = nil
+		}
 	}
 	stepContainer := newStepContainer(ctx, step, image, cmd, entrypoint)
 	return common.NewPipelineExecutor(
@@ -398,34 +360,10 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 		stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
 		stepContainer.Start(true),
 	).Finally(
-		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers && !rc.Config.AutoRemove),
+		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
 	).Finally(stepContainer.Close())(ctx)
 }
 
-// dockerEntrypoint returns the entrypoint the action's image runs with for the given
-// stage. Only the main stage honours the `entrypoint` input.
-func dockerEntrypoint(ctx context.Context, step actionStep, eval ExpressionEvaluator, stage stepStage) ([]string, error) {
-	runs := step.getActionModel().Runs
-
-	var entrypoint string
-	switch stage {
-	case stepStagePre:
-		entrypoint = runs.PreEntrypoint
-	case stepStagePost:
-		entrypoint = runs.PostEntrypoint
-	default:
-		if fields := strings.Fields(eval.Interpolate(ctx, step.getStepModel().With["entrypoint"])); len(fields) > 0 {
-			return fields, nil
-		}
-		entrypoint = runs.Entrypoint
-	}
-
-	if entrypoint == "" {
-		return nil, nil
-	}
-	return shellquote.Split(entrypoint)
-}
-
 func evalDockerArgs(ctx context.Context, step step, action *model.Action, cmd *[]string) {
 	rc := step.getRunContext()
 	stepModel := step.getStepModel()
@@ -482,11 +420,13 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo
 	if rc.IsHostEnv(ctx) {
 		networkMode = "default"
 	}
-	stepContainer := ContainerNewContainer(&container.NewContainerInput{
+	stepContainer := container.NewContainer(&container.NewContainerInput{
 		Cmd:          cmd,
 		Entrypoint:   entrypoint,
 		WorkingDir:   rc.JobContainer.ToContainerPath(rc.Config.Workdir),
 		Image:        image,
+		Username:     rc.Config.Secrets["DOCKER_USERNAME"],
+		Password:     rc.Config.Secrets["DOCKER_PASSWORD"],
 		Name:         createContainerName(rc.jobContainerName(), "STEP-"+stepModel.ID),
 		Env:          envList,
 		Mounts:       mounts,
@@ -499,8 +439,7 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo
 		Platform:     rc.Config.ContainerArchitecture,
 		Options:      rc.Config.ContainerOptions,
 		AutoRemove:   rc.Config.AutoRemove,
-		ValidVolumes: rc.validVolumes(),
-		AllocatePTY:  rc.Config.AllocatePTY,
+		ValidVolumes: rc.Config.ValidVolumes,
 	})
 	return stepContainer
 }
@@ -576,57 +515,44 @@ func hasPreStep(step actionStep) common.Conditional {
 		return action.Runs.Using.IsComposite() ||
 			(action.Runs.Using.IsNode() &&
 				action.Runs.Pre != "") ||
-			(action.Runs.Using.IsDocker() &&
-				action.Runs.PreEntrypoint != "") ||
 			(action.Runs.Using == model.ActionRunsUsingGo &&
 				action.Runs.Pre != "")
 	}
 }
 
-// actionStagePaths resolves where a step's action lives and where the job container sees
-// it, for the pre and post stage.
-func actionStagePaths(step actionStep) (actionDir, actionPath, actionName, containerActionDir string) {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	if _, ok := step.(*stepActionRemote); ok {
-		actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
-		actionPath = newRemoteAction(stepModel.Uses).Path
-	} else {
-		actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
-	}
-
-	actionName, containerActionDir = getContainerActionPaths(stepModel, path.Join(actionDir, actionPath), rc)
-	return actionDir, actionPath, actionName, containerActionDir
-}
-
-// execDockerActionStage runs a docker action's image for its pre or post stage.
-func execDockerActionStage(ctx context.Context, step actionStep, stage stepStage) error {
-	actionDir, actionPath, actionName, containerActionDir := actionStagePaths(step)
-
-	_, remote := step.(*stepActionRemote)
-	location := containerActionDir
-	if remote {
-		location = path.Join(actionDir, actionPath)
-	}
-	return execAsDocker(ctx, step, actionName, actionDir, location, !remote, stage)
-}
-
 func runPreStep(step actionStep) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		logger.Debugf("run pre step for '%s'", step.getStepModel())
 
 		rc := step.getRunContext()
+		stepModel := step.getStepModel()
 		action := step.getActionModel()
 
-		actionDir, actionPath, _, containerActionDir := actionStagePaths(step)
-
 		x := action.Runs.Using
 		switch {
 		case x.IsNode():
 			// defaults in pre steps were missing, however provided inputs are available
 			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
+			// todo: refactor into step
+			var actionDir string
+			var actionPath string
+			if _, ok := step.(*stepActionRemote); ok {
+				actionPath = newRemoteAction(stepModel.Uses).Path
+				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+			} else {
+				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+				actionPath = ""
+			}
+
+			var actionLocation string
+			if actionPath != "" {
+				actionLocation = path.Join(actionDir, actionPath)
+			} else {
+				actionLocation = actionDir
+			}
+
+			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
 
 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
@@ -639,12 +565,6 @@ func runPreStep(step actionStep) common.Executor {
 
 			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
 
-		case x.IsDocker():
-			// defaults in pre steps were missing, however provided inputs are available
-			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-
-			return execDockerActionStage(ctx, step, stepStagePre)
-
 		case x.IsComposite():
 			if step.getCompositeSteps() == nil {
 				step.getCompositeRunContext(ctx)
@@ -658,6 +578,25 @@ func runPreStep(step actionStep) common.Executor {
 		case x == model.ActionRunsUsingGo:
 			// defaults in pre steps were missing, however provided inputs are available
 			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
+			// todo: refactor into step
+			var actionDir string
+			var actionPath string
+			if _, ok := step.(*stepActionRemote); ok {
+				actionPath = newRemoteAction(stepModel.Uses).Path
+				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+			} else {
+				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+				actionPath = ""
+			}
+
+			var actionLocation string
+			if actionPath != "" {
+				actionLocation = path.Join(actionDir, actionPath)
+			} else {
+				actionLocation = actionDir
+			}
+
+			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
 
 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
@@ -710,8 +649,6 @@ func hasPostStep(step actionStep) common.Conditional {
 		return action.Runs.Using.IsComposite() ||
 			(action.Runs.Using.IsNode() &&
 				action.Runs.Post != "") ||
-			(action.Runs.Using.IsDocker() &&
-				action.Runs.PostEntrypoint != "") ||
 			(action.Runs.Using == model.ActionRunsUsingGo &&
 				action.Runs.Post != "")
 	}
@@ -723,9 +660,28 @@ func runPostStep(step actionStep) common.Executor {
 		logger.Debugf("run post step for '%s'", step.getStepModel())
 
 		rc := step.getRunContext()
+		stepModel := step.getStepModel()
 		action := step.getActionModel()
 
-		actionDir, actionPath, _, containerActionDir := actionStagePaths(step)
+		// todo: refactor into step
+		var actionDir string
+		var actionPath string
+		if _, ok := step.(*stepActionRemote); ok {
+			actionPath = newRemoteAction(stepModel.Uses).Path
+			actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+		} else {
+			actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+			actionPath = ""
+		}
+
+		var actionLocation string
+		if actionPath != "" {
+			actionLocation = path.Join(actionDir, actionPath)
+		} else {
+			actionLocation = actionDir
+		}
+
+		_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
 
 		x := action.Runs.Using
 		switch {
@@ -740,11 +696,6 @@ func runPostStep(step actionStep) common.Executor {
 
 			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
 
-		case x.IsDocker():
-			populateEnvsFromSavedState(step.getEnv(), step, rc)
-
-			return execDockerActionStage(ctx, step, stepStagePost)
-
 		case x.IsComposite():
 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err

act/runner/action_cache_offline_mode.go

@@ -0,0 +1,45 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// Copyright 2024 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"io"
+	"path"
+
+	git "github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+type GoGitActionCacheOfflineMode struct {
+	Parent GoGitActionCache
+}
+
+func (c GoGitActionCacheOfflineMode) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {
+	sha, fetchErr := c.Parent.Fetch(ctx, cacheDir, url, ref, token)
+	gitPath := path.Join(c.Parent.Path, safeFilename(cacheDir)+".git")
+	gogitrepo, err := git.PlainOpen(gitPath)
+	if err != nil {
+		return "", fetchErr
+	}
+	refName := plumbing.ReferenceName("refs/action-cache-offline/" + ref)
+	r, err := gogitrepo.Reference(refName, true)
+	if fetchErr == nil {
+		if err != nil || sha != r.Hash().String() {
+			if err == nil {
+				refName = r.Name()
+			}
+			ref := plumbing.NewHashReference(refName, plumbing.NewHash(sha))
+			_ = gogitrepo.Storer.SetReference(ref)
+		}
+	} else if err == nil {
+		return r.Hash().String(), nil
+	}
+	return sha, fetchErr
+}
+
+func (c GoGitActionCacheOfflineMode) GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error) {
+	return c.Parent.GetTarArchive(ctx, cacheDir, sha, includePrefix)
+}

act/runner/action_cache_test.go

@@ -8,139 +8,64 @@ import (
 	"archive/tar"
 	"bytes"
 	"context"
-	"fmt"
 	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
 	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/model"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
-func runGit(t *testing.T, dir string, args ...string) {
-	t.Helper()
-	if dir != "" {
-		args = append([]string{"-C", dir}, args...)
-	}
-	cmd := exec.Command("git", args...)
-	// Fixed identity and host-config isolation so commits succeed offline regardless of the
-	// host's git config (mirrors gitCmd in act/common/git).
-	cmd.Env = append(os.Environ(),
-		"GIT_AUTHOR_NAME=test", "GIT_AUTHOR_EMAIL=test@example.com",
-		"GIT_COMMITTER_NAME=test", "GIT_COMMITTER_EMAIL=test@example.com",
-		"GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null",
-	)
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
-}
-
-// TestShortShaActionRejected verifies a `uses` ref that is a shortened commit SHA is rejected
-// with a clear error. The action is resolved from a local repo (via DefaultActionInstance) so
-// this runs offline.
-func TestShortShaActionRejected(t *testing.T) {
-	// a local "remote" action repo at <root>/actions/hello-world-docker-action
-	actionRoot := t.TempDir()
-	repo := filepath.Join(actionRoot, "actions", "hello-world-docker-action")
-	require.NoError(t, os.MkdirAll(repo, 0o755))
-	runGit(t, "", "init", "--initial-branch=main", repo)
-	require.NoError(t, os.WriteFile(filepath.Join(repo, "action.yml"),
-		[]byte("name: hello\nruns:\n  using: node24\n  main: index.js\n"), 0o644))
-	runGit(t, repo, "add", ".")
-	runGit(t, repo, "commit", "-m", "initial")
-	out, err := exec.Command("git", "-C", repo, "rev-parse", "HEAD").Output()
-	require.NoError(t, err)
-	shortSha := strings.TrimSpace(string(out))[:7]
-
-	// a workflow that uses the action at the short SHA
-	wfDir := filepath.Join(t.TempDir(), "wf")
-	require.NoError(t, os.MkdirAll(wfDir, 0o755))
-	wf := fmt.Sprintf("on: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/hello-world-docker-action@%s\n", shortSha)
-	require.NoError(t, os.WriteFile(filepath.Join(wfDir, "push.yml"), []byte(wf), 0o644))
-
-	runner, err := New(&Config{
-		Workdir:               wfDir,
-		EventName:             "push",
-		Platforms:             map[string]string{"ubuntu-latest": baseImage},
-		GitHubInstance:        "github.com",
-		DefaultActionInstance: actionRoot,
-		ContainerMaxLifetime:  time.Hour,
-	})
-	require.NoError(t, err)
-	planner, err := model.NewWorkflowPlanner(wfDir, true)
-	require.NoError(t, err)
-	plan, err := planner.PlanEvent("push")
-	require.NoError(t, err)
-
-	err = runner.NewPlanExecutor(plan)(common.WithDryrun(context.Background(), true))
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "shortened version of a commit SHA")
-}
-
 func TestActionCache(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	a := assert.New(t)
-	ctx := context.Background()
-
-	// Build a local bare repo with a `js` action dir so this runs offline (formerly cloned
-	// github.com/nektos/act-test-actions over the network). allowAnySHA1InWant lets the
-	// "Fetch Sha" case fetch a commit hash directly.
-	remoteDir := t.TempDir()
-	runGit(t, "", "init", "--bare", "--initial-branch=main", remoteDir)
-	runGit(t, remoteDir, "config", "uploadpack.allowAnySHA1InWant", "true")
-
-	workDir := t.TempDir()
-	runGit(t, "", "clone", remoteDir, workDir)
-	require.NoError(t, os.MkdirAll(filepath.Join(workDir, "js"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, "js", "action.yml"),
-		[]byte("name: js\nruns:\n  using: node24\n  main: index.js\n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, "js", "index.js"),
-		[]byte("console.log('hello');\n"), 0o644))
-	runGit(t, workDir, "add", ".")
-	runGit(t, workDir, "commit", "-m", "initial")
-	runGit(t, workDir, "push", "-u", "origin", "main")
-
-	out, err := exec.Command("git", "-C", workDir, "rev-parse", "main").Output()
-	require.NoError(t, err)
-	fullSha := strings.TrimSpace(string(out))
-
 	cache := &GoGitActionCache{
 		Path: t.TempDir(),
 	}
-	cacheDir := "local/act-test-actions"
+	ctx := context.Background()
+	cacheDir := "nektos/act-test-actions"
+	repo := "https://github.com/nektos/act-test-actions"
 	refs := []struct {
-		Name string
-		Ref  string
+		Name     string
+		CacheDir string
+		Repo     string
+		Ref      string
 	}{
-		{Name: "Fetch Branch Name", Ref: "main"},
-		{Name: "Fetch Branch Name Absolutely", Ref: "refs/heads/main"},
-		{Name: "Fetch HEAD", Ref: "HEAD"},
-		{Name: "Fetch Sha", Ref: fullSha},
+		{
+			Name:     "Fetch Branch Name",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "main",
+		},
+		{
+			Name:     "Fetch Branch Name Absolutely",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "refs/heads/main",
+		},
+		{
+			Name:     "Fetch HEAD",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "HEAD",
+		},
+		{
+			Name:     "Fetch Sha",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "de984ca37e4df4cb9fd9256435a3b82c4a2662b1",
+		},
 	}
 	for _, c := range refs {
 		t.Run(c.Name, func(t *testing.T) {
-			sha, err := cache.Fetch(ctx, cacheDir, remoteDir, c.Ref, "")
+			sha, err := cache.Fetch(ctx, c.CacheDir, c.Repo, c.Ref, "")
 			if !a.NoError(err) || !a.NotEmpty(sha) { //nolint:testifylint // pre-existing issue from nektos/act
 				return
 			}
-			atar, err := cache.GetTarArchive(ctx, cacheDir, sha, "js")
-			// NotNil, not NotEmpty: atar is a live io.PipeReader whose producer goroutine is
-			// writing concurrently; NotEmpty deep-reflects over its internals and races.
-			if !a.NoError(err) || !a.NotNil(atar) { //nolint:testifylint // pre-existing issue from nektos/act
+			atar, err := cache.GetTarArchive(ctx, c.CacheDir, sha, "js")
+			if !a.NoError(err) || !a.NotEmpty(atar) { //nolint:testifylint // pre-existing issue from nektos/act
 				return
 			}
-			// GetTarArchive streams from a background goroutine walking the shared repo.
-			// Drain and close so it finishes before the next subtest fetches into the same
-			// repo; otherwise the lingering walk races with that fetch.
-			defer func() {
-				_, _ = io.Copy(io.Discard, atar)
-				_ = atar.Close()
-			}()
 			mytar := tar.NewReader(atar)
 			th, err := mytar.Next()
 			if !a.NoError(err) || !a.NotEqual(0, th.Size) { //nolint:testifylint // pre-existing issue from nektos/act

act/runner/action_composite.go

@@ -8,7 +8,6 @@ import (
 	"context"
 	"errors"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -86,19 +85,6 @@ func newCompositeRunContext(ctx context.Context, parent *RunContext, step action
 	return compositerc
 }
 
-// appendUniqueMasks appends the masks from src to dst, skipping any mask that
-// is already present in dst. This prevents the parent RunContext's Masks slice
-// from growing exponentially when composite actions are nested or repeated,
-// since each composite RunContext is seeded with its parent's masks.
-func appendUniqueMasks(dst, src []string) []string {
-	for _, m := range src {
-		if !slices.Contains(dst, m) {
-			dst = append(dst, m)
-		}
-	}
-	return dst
-}
-
 func execAsComposite(step actionStep) common.Executor {
 	rc := step.getRunContext()
 	action := step.getActionModel()
@@ -124,11 +110,7 @@ func execAsComposite(step actionStep) common.Executor {
 			}, eval.Interpolate(ctx, output.Value))
 		}
 
-		// compositeRC.Masks is seeded with rc.Masks (see newCompositeRunContext)
-		// and may have additional masks appended while the composite action runs.
-		// Only append masks that are not already present, otherwise nested or
-		// repeated composite actions grow rc.Masks exponentially.
-		rc.Masks = appendUniqueMasks(rc.Masks, compositeRC.Masks)
+		rc.Masks = append(rc.Masks, compositeRC.Masks...)
 		rc.ExtraPath = compositeRC.ExtraPath
 		// compositeRC.Env is dirty, contains INPUT_ and merged step env, only rely on compositeRC.GlobalEnv
 		mergeIntoMap := mergeIntoMapCaseSensitive

act/runner/action_composite_test.go

@@ -1,70 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestAppendUniqueMasks(t *testing.T) {
-	tests := []struct {
-		name string
-		dst  []string
-		src  []string
-		want []string
-	}{
-		{
-			name: "appends new masks",
-			dst:  []string{"a"},
-			src:  []string{"b", "c"},
-			want: []string{"a", "b", "c"},
-		},
-		{
-			name: "skips masks already present",
-			dst:  []string{"a", "b"},
-			src:  []string{"a", "b"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "deduplicates within src",
-			dst:  []string{"a"},
-			src:  []string{"b", "b", "a"},
-			want: []string{"a", "b"},
-		},
-		{
-			name: "empty src leaves dst unchanged",
-			dst:  []string{"a"},
-			src:  nil,
-			want: []string{"a"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, appendUniqueMasks(tt.dst, tt.src))
-		})
-	}
-}
-
-// TestAppendUniqueMasksNoExponentialGrowth reproduces the exponential growth of
-// the parent's Masks slice observed with nested/repeated composite actions. A
-// composite RunContext is seeded with its parent's masks and the whole seeded
-// slice was previously appended back into the parent, doubling its length on
-// every composite action.
-func TestAppendUniqueMasksNoExponentialGrowth(t *testing.T) {
-	parentMasks := []string{"secret"}
-
-	for range 20 {
-		// compositeRC.Masks starts as a copy of the parent's masks (it is
-		// seeded with parent.Masks in newCompositeRunContext).
-		compositeMasks := make([]string, len(parentMasks))
-		copy(compositeMasks, parentMasks)
-
-		parentMasks = appendUniqueMasks(parentMasks, compositeMasks)
-	}
-
-	assert.Equal(t, []string{"secret"}, parentMasks)
-}

act/runner/action_test.go

@@ -9,18 +9,12 @@ import (
 	"io"
 	"io/fs"
 	"strings"
-	"sync"
 	"testing"
-	"time"
 
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 )
 
 type closerMock struct {
@@ -151,44 +145,6 @@ runs:
 	}
 }
 
-// With AutoRemove the daemon reaps the container on exit, so act must not remove it afterwards.
-func TestExecAsDockerAutoRemove(t *testing.T) {
-	orig := ContainerNewContainer
-	defer func() { ContainerNewContainer = orig }()
-
-	for _, tc := range []struct {
-		autoRemove bool
-		removes    int
-	}{
-		{false, 2}, // stale + post-run
-		{true, 1},  // post-run skipped
-	} {
-		cm := &containerMock{}
-		ContainerNewContainer = func(*container.NewContainerInput) container.ExecutionsEnvironment { return cm }
-
-		step := &stepActionRemote{
-			Step: &model.Step{ID: "1", Uses: "org/action@v1"},
-			RunContext: &RunContext{
-				Config:       &Config{AutoRemove: tc.autoRemove},
-				Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
-				JobContainer: cm,
-			},
-			action: &model.Action{Runs: model.ActionRuns{Using: "docker", Image: "docker://node:14"}},
-		}
-
-		removes := 0
-		cm.On("Pull", false).Return(func(context.Context) error { return nil })
-		cm.On("Remove").Return(func(context.Context) error { removes++; return nil })
-		cm.On("Create", []string(nil), []string(nil)).Return(func(context.Context) error { return nil })
-		cm.On("Start", true).Return(func(context.Context) error { return nil })
-		cm.On("Close").Return(func(context.Context) error { return nil })
-
-		require.NoError(t, execAsDocker(context.Background(), step, "action", t.TempDir(), t.TempDir(), false, stepStageMain))
-		cm.AssertExpectations(t)
-		assert.Equal(t, tc.removes, removes)
-	}
-}
-
 func TestActionRunner(t *testing.T) {
 	table := []struct {
 		name        string
@@ -296,331 +252,3 @@ func TestActionRunner(t *testing.T) {
 		})
 	}
 }
-
-func TestNewStepContainerDoesNotUseDockerSecrets(t *testing.T) {
-	cm := &containerMock{}
-
-	var captured *container.NewContainerInput
-	origContainerNewContainer := ContainerNewContainer
-	ContainerNewContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-		captured = input
-		return cm
-	}
-	defer func() {
-		ContainerNewContainer = origContainerNewContainer
-	}()
-
-	ctx := context.Background()
-	rc := &RunContext{
-		Name: "job",
-		Config: &Config{
-			Secrets: map[string]string{
-				"DOCKER_USERNAME": "docker-user",
-				"DOCKER_PASSWORD": "docker-password",
-			},
-		},
-		Run: &model.Run{
-			JobID: "job",
-			Workflow: &model.Workflow{
-				Name: "test",
-				Jobs: map[string]*model.Job{
-					"job": {},
-				},
-			},
-		},
-		JobContainer: cm,
-		StepResults:  map[string]*model.StepResult{},
-	}
-	env := map[string]string{}
-	step := &stepMock{}
-	step.On("getRunContext").Return(rc)
-	step.On("getStepModel").Return(&model.Step{ID: "action"})
-	step.On("getEnv").Return(&env)
-
-	_ = newStepContainer(ctx, step, "registry.example.com/action:tag", nil, nil)
-
-	// DOCKER_USERNAME/DOCKER_PASSWORD should not be injected as pull credentials for docker action containers.
-	assert.Empty(t, captured.Username)
-	assert.Empty(t, captured.Password)
-	step.AssertExpectations(t)
-}
-
-func TestMaybeCopyToActionDirHoldsCloneLock(t *testing.T) {
-	ctx := context.Background()
-
-	actionDir := t.TempDir()
-
-	releaseCopy := make(chan struct{})
-	release := sync.OnceFunc(func() { close(releaseCopy) })
-	defer release()
-
-	copyEntered := make(chan struct{})
-
-	cm := &containerMock{}
-	cm.On("CopyDir", "/var/run/act/actions/", actionDir+"/", false).Return(func(ctx context.Context) error {
-		close(copyEntered)
-		<-releaseCopy
-		return nil
-	})
-
-	step := &stepActionRemote{
-		Step: &model.Step{Uses: "remote/action@v1"},
-		RunContext: &RunContext{
-			Config:       &Config{},
-			JobContainer: cm,
-		},
-	}
-
-	copyDone := make(chan error, 1)
-	go func() {
-		copyDone <- maybeCopyToActionDir(ctx, step, actionDir, "", "/var/run/act/actions/")
-	}()
-
-	select {
-	case <-copyEntered:
-	case err := <-copyDone:
-		t.Fatalf("maybeCopyToActionDir returned before CopyDir was entered: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("CopyDir was not entered within 1 second")
-	}
-
-	peerAcquired := make(chan struct{})
-	go func() {
-		unlock := git.AcquireCloneLock(actionDir)
-		close(peerAcquired)
-		unlock()
-	}()
-
-	select {
-	case <-peerAcquired:
-		t.Fatal("peer AcquireCloneLock returned while CopyDir was running")
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	release()
-
-	select {
-	case err := <-copyDone:
-		if err != nil {
-			t.Fatalf("maybeCopyToActionDir returned error: %v", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("maybeCopyToActionDir did not return after CopyDir was unblocked")
-	}
-
-	select {
-	case <-peerAcquired:
-	case <-time.After(time.Second):
-		t.Fatal("peer AcquireCloneLock did not proceed after lock released")
-	}
-
-	cm.AssertExpectations(t)
-}
-
-func TestExecAsDockerHoldsCloneLockForRemoteUncached(t *testing.T) {
-	actionDir := t.TempDir()
-
-	unlockOnce := sync.OnceFunc(git.AcquireCloneLock(actionDir))
-	defer unlockOnce()
-
-	innerEntered := make(chan struct{})
-	releaseInner := make(chan struct{})
-	releaseOnce := sync.OnceFunc(func() { close(releaseInner) })
-	defer releaseOnce()
-
-	origImageExists := ContainerImageExistsLocally
-	ContainerImageExistsLocally = func(_ context.Context, _, _ string) (bool, error) {
-		return false, nil
-	}
-	defer func() { ContainerImageExistsLocally = origImageExists }()
-
-	origBuildExec := ContainerNewDockerBuildExecutor
-	ContainerNewDockerBuildExecutor = func(_ container.NewDockerBuildExecutorInput) common.Executor {
-		return func(_ context.Context) error {
-			close(innerEntered)
-			<-releaseInner
-			return nil
-		}
-	}
-	defer func() { ContainerNewDockerBuildExecutor = origBuildExec }()
-
-	step := &stepActionRemote{
-		Step: &model.Step{ID: "1", Uses: "remote/action@v1", With: map[string]string{}},
-		RunContext: &RunContext{
-			Config: &Config{},
-			Run: &model.Run{
-				JobID: "1",
-				Workflow: &model.Workflow{
-					Name: "wf",
-					Jobs: map[string]*model.Job{"1": {}},
-				},
-			},
-			JobContainer: &containerMock{},
-		},
-		action: &model.Action{Runs: model.ActionRuns{Using: "docker", Image: "Dockerfile"}},
-		env:    map[string]string{},
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	done := make(chan error, 1)
-	go func() { done <- execAsDocker(ctx, step, "test-action", actionDir, actionDir, false, stepStageMain) }()
-
-	select {
-	case <-innerEntered:
-		t.Fatal("inner build executor ran before clone lock was released")
-	case err := <-done:
-		t.Fatalf("execAsDocker returned before inner was entered: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	unlockOnce()
-
-	select {
-	case <-innerEntered:
-	case err := <-done:
-		t.Fatalf("execAsDocker returned without entering inner: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("inner build executor not entered after lock released")
-	}
-
-	cancel()
-	releaseOnce()
-
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("execAsDocker did not return after inner was released and ctx was canceled")
-	}
-}
-
-func TestDockerActionImageTag(t *testing.T) {
-	// Remote actions already carry a unique, ref-scoped actionName (the uses
-	// hash), so the tag must be left untouched for backwards compatibility.
-	assert.Equal(t,
-		"act-abc123-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "abc123", false),
-	)
-
-	// Local actions keep a human-readable, repository-namespaced prefix and gain a short hash suffix that makes the tag unique per (repository, actionName).
-	// See https://gitea.com/gitea/runner/issues/1039.
-	assert.Equal(t,
-		"act-owner-repo-baca2daaa2fe-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./", true),
-	)
-	assert.Equal(t,
-		"act-owner-repo-sub-e847b61255a8-dockeraction:latest",
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-
-	// Sanitizing every non-alphanumeric character to "-" is lossy, so distinct inputs can collapse to the same readable prefix.
-	// The hash suffix must keep such cases apart, otherwise an image built for one repository is reused for another.
-	collisions := [][2]struct {
-		repoName   string
-		actionName string
-	}{
-		// Two different repositories, both `uses: ./`: "a/b-c" and "a-b/c" both sanitize to "a-b-c".
-		{{"a/b-c", "./"}, {"a-b/c", "./"}},
-		// A repository's root action vs another repository's sub-path action:
-		// "owner/repo-a" + "./" and "owner/repo" + "./a" both sanitize to "owner-repo-a".
-		{{"owner/repo-a", "./"}, {"owner/repo", "./a"}},
-	}
-	for _, c := range collisions {
-		assert.NotEqual(t,
-			dockerActionImageTag(c[0].repoName, c[0].actionName, true),
-			dockerActionImageTag(c[1].repoName, c[1].actionName, true),
-			"local docker action tags must differ for %q/%q vs %q/%q",
-			c[0].repoName, c[0].actionName, c[1].repoName, c[1].actionName,
-		)
-	}
-
-	// Distinct local actions within the same repository keep distinct tags.
-	assert.NotEqual(t,
-		dockerActionImageTag("owner/repo", "./", true),
-		dockerActionImageTag("owner/repo", "./sub", true),
-	)
-}
-
-// Only the entrypoint is stage specific: every stage of a docker action receives runs.args
-// and runs.env, and the `entrypoint` input applies to the main stage alone.
-func TestExecAsDockerStageEntrypoint(t *testing.T) {
-	orig := ContainerNewContainer
-	defer func() { ContainerNewContainer = orig }()
-
-	for _, tc := range []struct {
-		name           string
-		stage          stepStage
-		wantEntrypoint []string
-	}{
-		{
-			name:           "main stage prefers the entrypoint input",
-			stage:          stepStageMain,
-			wantEntrypoint: []string{"input.sh"},
-		},
-		{
-			name:           "pre stage uses runs.pre-entrypoint",
-			stage:          stepStagePre,
-			wantEntrypoint: []string{"pre.sh", "--verbose"},
-		},
-		{
-			name:           "post stage uses runs.post-entrypoint",
-			stage:          stepStagePost,
-			wantEntrypoint: []string{"post.sh"},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cm := &containerMock{}
-			var input *container.NewContainerInput
-			ContainerNewContainer = func(in *container.NewContainerInput) container.ExecutionsEnvironment {
-				input = in
-				return cm
-			}
-
-			step := &stepActionRemote{
-				Step: &model.Step{ID: "1", Uses: "org/action@v1", With: map[string]string{"entrypoint": "input.sh"}},
-				RunContext: &RunContext{
-					Config:       &Config{},
-					Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
-					JobContainer: cm,
-				},
-				action: &model.Action{Runs: model.ActionRuns{
-					Using:          "docker",
-					Image:          "docker://node:14",
-					PreEntrypoint:  "pre.sh --verbose",
-					Entrypoint:     "main.sh",
-					PostEntrypoint: "post.sh",
-					Args:           []string{"hello"},
-					Env:            map[string]string{"MY_VAR": "world"},
-				}},
-				env: map[string]string{},
-			}
-
-			cm.On("Pull", false).Return(func(context.Context) error { return nil })
-			cm.On("Remove").Return(func(context.Context) error { return nil })
-			cm.On("Create", []string(nil), []string(nil)).Return(func(context.Context) error { return nil })
-			cm.On("Start", true).Return(func(context.Context) error { return nil })
-			cm.On("Close").Return(func(context.Context) error { return nil })
-
-			require.NoError(t, execAsDocker(context.Background(), step, "action", t.TempDir(), t.TempDir(), false, tc.stage))
-			require.NotNil(t, input)
-			assert.Equal(t, tc.wantEntrypoint, input.Entrypoint)
-			assert.Equal(t, []string{"hello"}, input.Cmd)
-			assert.Contains(t, input.Env, "MY_VAR=world")
-		})
-	}
-}
-
-func TestDockerActionHasPreAndPostStep(t *testing.T) {
-	newStep := func(runs model.ActionRuns) actionStep {
-		return &stepActionRemote{action: &model.Action{Runs: runs}}
-	}
-	ctx := context.Background()
-
-	assert.False(t, hasPreStep(newStep(model.ActionRuns{Using: "docker", Image: "Dockerfile"}))(ctx))
-	assert.False(t, hasPostStep(newStep(model.ActionRuns{Using: "docker", Image: "Dockerfile"}))(ctx))
-
-	withStages := model.ActionRuns{Using: "docker", Image: "Dockerfile", PreEntrypoint: "pre.sh", PostEntrypoint: "post.sh"}
-	assert.True(t, hasPreStep(newStep(withStages))(ctx))
-	assert.True(t, hasPostStep(newStep(withStages))(ctx))
-}

act/runner/cancellation_test.go

@@ -1,312 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/exprparser"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v4"
-)
-
-// TestCancelledJobStatusEnablesAlwaysAndCancelledSteps verifies that once a job is
-// cancelled, getJobContext reports the "cancelled" status so the step `if` functions
-// evaluate the way GitHub Actions does: cancelled()/always() are true, success()/failure()
-// are false. A step that defaults to success() is therefore skipped while an always() step
-// still runs. Before the fix the status could only ever be success/failure, so cancelled()
-// was structurally impossible and cancel-only cleanup steps never ran.
-func TestCancelledJobStatusEnablesAlwaysAndCancelledSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	rc.markCancelled()
-
-	// The core fix: the job status context now reports "cancelled" instead of being
-	// pinned to success/failure.
-	jobCtx := rc.getJobContext()
-	require.Equal(t, "cancelled", jobCtx.Status)
-
-	// Feed that status through the step-context expression functions, which is what a
-	// step `if` evaluates. On a cancelled job only always()/cancelled() are true.
-	interp := exprparser.NewInterpeter(
-		&exprparser.EvaluationEnvironment{Job: jobCtx},
-		exprparser.Config{Context: "step"},
-	)
-	for expr, want := range map[string]bool{
-		"cancelled()":  true,
-		"always()":     true,
-		"success()":    false,
-		"failure()":    false,
-		"!cancelled()": false,
-	} {
-		got, err := interp.Evaluate(expr, exprparser.DefaultStatusCheckNone)
-		require.NoErrorf(t, err, "Evaluate(%q)", expr)
-		assert.Equalf(t, want, got, "Evaluate(%q) on a cancelled job", expr)
-	}
-
-	// A step without an `if` defaults to success() and must be skipped on cancel,
-	// while an `if: always()` step must still run.
-	disabled, err := interp.Evaluate("", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, false, disabled, "default-success step must be skipped on a cancelled job")
-
-	enabled, err := interp.Evaluate("always()", exprparser.DefaultStatusCheckSuccess)
-	require.NoError(t, err)
-	assert.Equal(t, true, enabled, "`if: always()` step must run on a cancelled job")
-}
-
-// TestMainStepsExecutorRunsAlwaysStepsAfterCancel verifies that newMainStepsExecutor does
-// not abandon the remaining steps when the run is cancelled mid-pipeline. The later step
-// still runs (so a main-stage always() step is reached), it runs under a fresh,
-// non-cancelled context, and the job is marked cancelled. The interrupt error is still
-// propagated so callers up the chain see the cancellation.
-func TestMainStepsExecutorRunsAlwaysStepsAfterCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "step1")
-			cancel() // server cancellation lands while step1 runs
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "interrupt error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after cancel")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps guards the timeout path's symmetry with the cancel path.
-// When the job deadline (timeout-minutes) lands in the gap between two steps, the job must be marked as failed (not cancelled),
-// so always()/failure() cleanup steps run while default success() steps skip, and so the timed-out job is not reported as success.
-func TestMainStepsExecutorMarksFailedOnTimeoutBetweenSteps(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	// A short deadline that we let elapse between steps, so no step records the error itself.
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
-	defer cancel()
-
-	var ran []string
-	var laterStepCtxErr error
-	steps := []common.Executor{
-		func(c context.Context) error {
-			ran = append(ran, "step1")
-			// Block until the job deadline elapses, then return cleanly: the interrupt lands in the loop's between-steps check, not inside a step.
-			<-c.Done()
-			return nil
-		},
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			laterStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newMainStepsExecutor(rc, steps)(ctx)
-
-	require.ErrorIs(t, err, context.DeadlineExceeded, "the timeout error is propagated")
-	assert.Equal(t, []string{"step1", "always-step"}, ran, "the always() step still runs after a timeout")
-	require.NoError(t, laterStepCtxErr, "remaining steps run under a fresh, non-expired context")
-	assert.True(t, rc.jobFailed, "a job timeout marks the job failed")
-	assert.False(t, rc.jobCancelled, "a timeout is not a cancellation")
-
-	// The status the real main-step `if` evaluation sees: "failure", so default success() steps skip while always()/failure() steps run.
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreCancel verifies that a cancellation landing during the
-// pre phase does not abandon the main steps: newStepsExecutor still runs the main-steps executor,
-// so a main-stage always()/cancelled() step is reached (under a fresh, non-cancelled context),
-// the job is marked cancelled, and the cancellation is propagated. Before the fix the `.Then(...)`
-// short-circuit skipped the main steps entirely when a pre step was cancelled.
-func TestStepsExecutorRunsMainStepsAfterPreCancel(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	var ran []string
-	var mainStepCtxErr error
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			cancel() // server cancellation lands during the pre phase
-			return nil
-		},
-	}
-	steps := []common.Executor{
-		func(c context.Context) error {
-			ran = append(ran, "always-step")
-			mainStepCtxErr = c.Err()
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(ctx)
-
-	require.ErrorIs(t, err, context.Canceled, "the cancellation is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-phase cancel")
-	require.NoError(t, mainStepCtxErr, "the main step runs under a fresh, non-cancelled context")
-	assert.True(t, rc.jobCancelled, "the job is marked cancelled")
-}
-
-// TestStepsExecutorRunsMainStepsAfterPreFailure verifies that a failing pre step does not abandon
-// the main steps: they still run (so a main-stage always()/failure() step is reached), and the
-// pre-step error is propagated so the job is reported as failed. The main steps' own `if`
-// evaluation is what skips success()-default steps, so running them here is safe.
-func TestStepsExecutorRunsMainStepsAfterPreFailure(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-
-	var ran []string
-	preSteps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "pre1")
-			return assert.AnError
-		},
-	}
-	steps := []common.Executor{
-		func(_ context.Context) error {
-			ran = append(ran, "always-step")
-			return nil
-		},
-	}
-
-	err := newStepsExecutor(rc, preSteps, steps)(context.Background())
-
-	require.ErrorIs(t, err, assert.AnError, "the pre-step error is propagated")
-	assert.Equal(t, []string{"pre1", "always-step"}, ran, "the main always() step runs after a pre-step failure")
-	assert.False(t, rc.jobCancelled, "a pre-step failure is not a cancellation")
-}
-
-// TestPreStepFailureAffectsMainStepIfStatus verifies the status path used by real
-// main-step `if` evaluation. A pre-step failure is not present in StepResults, so
-// recording only the context job error is not enough: getJobContext must also report
-// failure so success()-default main steps skip and failure() steps run.
-func TestPreStepFailureAffectsMainStepIfStatus(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
-	})
-	ctx := common.WithJobErrorContainer(context.Background())
-
-	reportStepError(ctx, rc, assert.AnError)
-
-	assert.Equal(t, "failure", rc.getJobContext().Status)
-	require.ErrorIs(t, common.JobError(ctx), assert.AnError)
-
-	defaultStep := &stepRun{
-		RunContext: rc,
-		Step:       &model.Step{ID: "default-step"},
-		env:        map[string]string{},
-	}
-	defaultEnabled, err := isStepEnabled(ctx, defaultStep.getIfExpression(ctx, stepStageMain), defaultStep, stepStageMain)
-	require.NoError(t, err)
-	assert.False(t, defaultEnabled, "default success() main step must skip after a pre-step failure")
-
-	failureStep := &stepRun{
-		RunContext: rc,
-		Step: &model.Step{
-			ID: "failure-step",
-			If: yaml.Node{Value: "failure()"},
-		},
-		env: map[string]string{},
-	}
-	failureEnabled, err := isStepEnabled(ctx, failureStep.getIfExpression(ctx, stepStageMain), failureStep, stepStageMain)
-	require.NoError(t, err)
-	assert.True(t, failureEnabled, "failure() main step must run after a pre-step failure")
-}
-
-// TestPostStepsContextCancelledIsUsableForFailingStep guards against a panic: post/cleanup
-// steps run on a context derived from the cancelled job context, and a failing post step
-// records its error via common.SetJobError. If that derived context lacks a job-error container,
-// SetJobError dereferences a nil map and panics. The post context must therefore be detached
-// from cancellation (so the steps run) yet still carry a usable error container.
-func TestPostStepsContextCancelledIsUsableForFailingStep(t *testing.T) {
-	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-	cancel()
-	require.ErrorIs(t, cancelled.Err(), context.Canceled)
-
-	postCtx, done := postStepsContext(cancelled)
-	defer done()
-
-	// Detached from cancellation, so the post steps actually run.
-	require.NoError(t, postCtx.Err(), "post context must not be cancelled")
-
-	// A failing post step records its error instead of panicking.
-	require.NotPanics(t, func() {
-		common.SetJobError(postCtx, assert.AnError)
-	}, "a failing post step must not panic on the cancel path")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError)
-}
-
-// TestPostStepsContextDeadlinePreservesJobError verifies the job-timeout path keeps the original
-// job-error container (via context.WithoutCancel), so the timeout failure and any post-step error
-// survive into the post phase and the job is still reported as failed.
-func TestPostStepsContextDeadlinePreservesJobError(t *testing.T) {
-	base := common.WithJobErrorContainer(context.Background())
-	common.SetJobError(base, assert.AnError)
-	expired, cancel := context.WithDeadline(base, time.Now().Add(-time.Hour))
-	defer cancel()
-	require.ErrorIs(t, expired.Err(), context.DeadlineExceeded)
-
-	postCtx, done := postStepsContext(expired)
-	defer done()
-
-	require.NoError(t, postCtx.Err(), "post context must not carry the expired deadline")
-	assert.ErrorIs(t, common.JobError(postCtx), assert.AnError, "the timeout job error must be preserved")
-}
-
-// reportStepError must treat a context.Canceled (e.g. a teardown-cancelled read) as an
-// interruption, never a job failure.
-func TestReportStepErrorTreatsCancelAsInterruption(t *testing.T) {
-	rc := &RunContext{}
-
-	// stray read cancellation while the job context is live: ignored, not a failure
-	live := common.WithJobErrorContainer(context.Background())
-	reportStepError(live, rc, context.Canceled)
-	require.NoError(t, common.JobError(live))
-	assert.False(t, rc.jobFailed)
-	assert.False(t, rc.jobCancelled)
-
-	// genuine job cancellation: recorded as cancelled, still not a failure
-	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-	cancel()
-	reportStepError(cancelled, rc, context.Canceled)
-	require.NoError(t, common.JobError(cancelled))
-	assert.False(t, rc.jobFailed)
-	assert.True(t, rc.jobCancelled)
-
-	// a real error still fails the job
-	failed := common.WithJobErrorContainer(context.Background())
-	reportStepError(failed, rc, assert.AnError)
-	require.ErrorIs(t, common.JobError(failed), assert.AnError)
-	assert.True(t, rc.jobFailed)
-}

act/runner/command.go

@@ -48,13 +48,10 @@ func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler {
 		if resumeCommand != "" && command != resumeCommand {
 			// There should not be any emojis in the log output for Gitea.
 			// The code in the switch statement is the same.
-			// Return true (not false) so the line still reaches the raw_output
-			// log handler; otherwise everything between ::stop-commands:: and
-			// its end token is silently dropped from the step log.
 			logger.Infof("%s", line)
-			return true
+			return false
 		}
-		arg = UnescapeCommandData(arg)
+		arg = unescapeCommandData(arg)
 		kvPairs = unescapeKvPairs(kvPairs)
 		switch command {
 		case "set-env":
@@ -123,7 +120,7 @@ func (rc *RunContext) setOutput(ctx context.Context, kvPairs map[string]string,
 
 	result, ok := rc.StepResults[stepID]
 	if !ok {
-		logger.Infof("No outputs registered for step '%s'", stepID)
+		logger.Infof("  \U00002757  no outputs used step '%s'", stepID)
 		return
 	}
 
@@ -154,25 +151,30 @@ func parseKeyValuePairs(kvPairs, separator string) map[string]string {
 	return rtn
 }
 
-// A Replacer never rescans what it wrote, so "%250A" stays a literal "%0A".
-var (
-	commandDataEscaper       = strings.NewReplacer("%", "%25", "\r", "%0D", "\n", "%0A")
-	commandDataUnescaper     = strings.NewReplacer("%25", "%", "%0D", "\r", "%0A", "\n")
-	commandPropertyUnescaper = strings.NewReplacer("%25", "%", "%0D", "\r", "%0A", "\n", "%3A", ":", "%2C", ",")
-)
-
-// escapeCommandData encodes the data part of a "::cmd::" or "##[cmd]" line the runner writes itself,
-// so the log renderer decodes it back. Lines forwarded from step output are already escaped.
-func escapeCommandData(arg string) string {
-	return commandDataEscaper.Replace(arg)
-}
-
-func UnescapeCommandData(arg string) string {
-	return commandDataUnescaper.Replace(arg)
+func unescapeCommandData(arg string) string {
+	escapeMap := map[string]string{
+		"%25": "%",
+		"%0D": "\r",
+		"%0A": "\n",
+	}
+	for k, v := range escapeMap {
+		arg = strings.ReplaceAll(arg, k, v)
+	}
+	return arg
 }
 
 func unescapeCommandProperty(arg string) string {
-	return commandPropertyUnescaper.Replace(arg)
+	escapeMap := map[string]string{
+		"%25": "%",
+		"%0D": "\r",
+		"%0A": "\n",
+		"%3A": ":",
+		"%2C": ",",
+	}
+	for k, v := range escapeMap {
+		arg = strings.ReplaceAll(arg, k, v)
+	}
+	return arg
 }
 
 func unescapeKvPairs(kvPairs map[string]string) map[string]string {

act/runner/command_test.go

@@ -28,29 +28,6 @@ func TestSetEnv(t *testing.T) {
 	a.Equal("valz", rc.Env["x"])
 }
 
-func TestStopCommandsKeepsSuppressedLinesInLog(t *testing.T) {
-	a := assert.New(t)
-	ctx := context.Background()
-	rc := new(RunContext)
-	handler := rc.commandHandler(ctx)
-
-	// Stop command processing until the matching end token is seen.
-	a.True(handler("::stop-commands::my-end-token\n"))
-
-	// A command-shaped line while stopped must not be executed (env unchanged),
-	// but must still return true so it reaches the raw_output log handler and is
-	// not dropped from the step log.
-	a.True(handler("::set-env name=x::valz\n"))
-	a.NotContains(rc.Env, "x")
-
-	// The matching end token resumes command processing.
-	a.True(handler("::my-end-token::\n"))
-
-	// Commands are processed again after resuming.
-	a.True(handler("::set-env name=y::valy\n"))
-	a.Equal("valy", rc.Env["y"])
-}
-
 func TestSetOutput(t *testing.T) {
 	a := assert.New(t)
 	ctx := context.Background()
@@ -214,10 +191,3 @@ func TestSaveState(t *testing.T) {
 
 	assert.Equal(t, "state-value", rc.IntraActionState["step"]["state-name"])
 }
-
-func TestEscapeCommandData(t *testing.T) {
-	a := assert.New(t)
-
-	a.Equal("a%25b%0Dc%0Ad%250A", escapeCommandData("a%b\rc\nd%0A"))
-	a.Equal("a%b\rc\nd%0A", UnescapeCommandData("a%25b%0Dc%0Ad%250A"))
-}

act/runner/expression.go

@@ -56,7 +56,7 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map
 		for _, needs := range jobNeeds {
 			using[needs] = exprparser.Needs{
 				Outputs: jobs[needs].Outputs,
-				Result:  jobs[needs].NeedsResult(),
+				Result:  jobs[needs].Result,
 			}
 		}
 
@@ -95,7 +95,9 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map
 		Inputs:    inputs,
 		HashFiles: getHashFilesFunction(ctx, rc),
 	}
-	ee.Runner = rc.getRunnerContext(ctx)
+	if rc.JobContainer != nil {
+		ee.Runner = rc.JobContainer.GetRunnerContext(ctx)
+	}
 	return expressionEvaluator{
 		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
 			Run:        rc.Run,
@@ -125,7 +127,7 @@ func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step)
 	for _, needs := range jobNeeds {
 		using[needs] = exprparser.Needs{
 			Outputs: jobs[needs].Outputs,
-			Result:  jobs[needs].NeedsResult(),
+			Result:  jobs[needs].Result,
 		}
 	}
 
@@ -147,7 +149,9 @@ func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step)
 		Inputs:    inputs,
 		HashFiles: getHashFilesFunction(ctx, rc),
 	}
-	ee.Runner = rc.getRunnerContext(ctx)
+	if rc.JobContainer != nil {
+		ee.Runner = rc.JobContainer.GetRunnerContext(ctx)
+	}
 	return expressionEvaluator{
 		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
 			Run:        rc.Run,
@@ -225,8 +229,7 @@ func (ee expressionEvaluator) evaluate(ctx context.Context, in string, defaultSt
 	logger.Debugf("evaluating expression '%s'", in)
 	evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck)
 
-	// evaluated is an any: %t renders everything but a bool as "%!t(string=...)"
-	printable := regexp.MustCompile(`::add-mask::.*`).ReplaceAllString(fmt.Sprintf("%v", evaluated), "::add-mask::***)")
+	printable := regexp.MustCompile(`::add-mask::.*`).ReplaceAllString(fmt.Sprintf("%t", evaluated), "::add-mask::***)")
 	logger.Debugf("expression '%s' evaluated to '%s'", in, printable)
 
 	return evaluated, err
@@ -494,7 +497,11 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod
 				if value == nil {
 					value = v.Default
 				}
-				inputs[k] = coerceInputValue(value, v.Type)
+				if v.Type == "boolean" {
+					inputs[k] = value == "true"
+				} else {
+					inputs[k] = value
+				}
 			}
 		}
 	}
@@ -507,26 +514,17 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod
 				if value == nil {
 					value = v.Default
 				}
-				inputs[k] = coerceInputValue(value, v.Type)
+				if v.Type == "boolean" {
+					inputs[k] = value == "true"
+				} else {
+					inputs[k] = value
+				}
 			}
 		}
 	}
 	return inputs
 }
 
-// coerceInputValue converts an input value to the type declared by the workflow.
-// The event payload carries natively typed JSON values on newer Gitea versions,
-// while defaults and older servers provide strings.
-func coerceInputValue(value any, inputType string) any {
-	if inputType != "boolean" {
-		return value
-	}
-	if b, ok := value.(bool); ok {
-		return b
-	}
-	return value == "true"
-}
-
 func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunContext) {
 	if rc.caller != nil {
 		config := rc.Run.Workflow.WorkflowCallConfig()
@@ -550,7 +548,7 @@ func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunCon
 				}
 			}
 
-			(*inputs)[name] = coerceInputValue(value, input.Type)
+			(*inputs)[name] = value
 		}
 	}
 }
@@ -564,15 +562,15 @@ func getWorkflowSecrets(ctx context.Context, rc *RunContext) map[string]string {
 			secrets = rc.caller.runContext.Config.Secrets
 		}
 
-		// Interpolate into a new map. secrets may be the shared Config.Secrets (or the job's
-		// map), which other parallel jobs read concurrently (e.g. log masking), so mutating it
-		// in place is a data race.
-		interpolated := make(map[string]string, len(secrets))
-		for k, v := range secrets {
-			interpolated[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v)
+		if secrets == nil {
+			secrets = map[string]string{}
 		}
 
-		return interpolated
+		for k, v := range secrets {
+			secrets[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v)
+		}
+
+		return secrets
 	}
 
 	return rc.Config.Secrets

act/runner/expression_test.go

@@ -6,14 +6,12 @@ package runner
 
 import (
 	"context"
-	"strings"
 	"testing"
 
 	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
 
 	assert "github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	yaml "go.yaml.in/yaml/v4"
 )
 
@@ -323,82 +321,3 @@ func TestRewriteSubExpressionForceFormat(t *testing.T) {
 		})
 	}
 }
-
-func TestGetEvaluatorInputsBoolean(t *testing.T) {
-	workflows := map[string]string{
-		"workflow_call": `
-on:
-  workflow_call:
-    inputs:
-      flag:
-        type: boolean
-        default: true
-      name:
-        type: string
-        default: gitea
-`,
-		"workflow_dispatch": `
-on:
-  workflow_dispatch:
-    inputs:
-      flag:
-        type: boolean
-        default: true
-      name:
-        type: string
-        default: gitea
-`,
-	}
-
-	tables := []struct {
-		name  string
-		event map[string]any
-		flag  any
-	}{
-		{
-			// Gitea >= 1.27 resolves the inputs server-side and sends native JSON types
-			name:  "native bool true",
-			event: map[string]any{"inputs": map[string]any{"flag": true}},
-			flag:  true,
-		},
-		{
-			name:  "native bool false",
-			event: map[string]any{"inputs": map[string]any{"flag": false}},
-			flag:  false,
-		},
-		{
-			name:  "string true",
-			event: map[string]any{"inputs": map[string]any{"flag": "true"}},
-			flag:  true,
-		},
-		{
-			name:  "string false",
-			event: map[string]any{"inputs": map[string]any{"flag": "false"}},
-			flag:  false,
-		},
-		{
-			name:  "default is used when the event carries no inputs",
-			event: map[string]any{},
-			flag:  true,
-		},
-	}
-
-	for eventName, workflow := range workflows {
-		for _, table := range tables {
-			t.Run(eventName+"/"+table.name, func(t *testing.T) {
-				wf, err := model.ReadWorkflow(strings.NewReader(workflow))
-				require.NoError(t, err)
-
-				rc := &RunContext{
-					Config: &Config{Workdir: "."},
-					Run:    &model.Run{JobID: "job1", Workflow: wf},
-				}
-				ghc := &model.GithubContext{EventName: eventName, Event: table.event}
-
-				inputs := getEvaluatorInputs(context.Background(), rc, nil, ghc)
-				assert.Equal(t, table.flag, inputs["flag"])
-				assert.Equal(t, "gitea", inputs["name"])
-			})
-		}
-	}
-}

act/runner/helpers_test.go

@@ -1,66 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"net"
-	"os/exec"
-	"runtime"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/container"
-
-	mobyclient "github.com/moby/moby/client"
-)
-
-// requireLinuxDocker skips on non-Linux hosts. Some integration workflows need Docker features
-// that only a Linux daemon provides (host networking, host /proc bind mounts); Docker Desktop
-// on macOS/Windows does not, so those tests can only run on Linux.
-func requireLinuxDocker(t *testing.T) {
-	t.Helper()
-	if runtime.GOOS != "linux" {
-		t.Skip("skipping: requires a Linux Docker host")
-	}
-}
-
-// requireDocker skips the test unless a reachable docker daemon is available.
-// GetDockerClient succeeds even without a running daemon (its ping is best-effort),
-// so the daemon has to be pinged explicitly here to decide whether to skip.
-func requireDocker(t *testing.T) {
-	t.Helper()
-	ctx := context.Background()
-	cli, err := container.GetDockerClient(ctx)
-	if err != nil {
-		t.Skipf("skipping: docker client unavailable: %v", err)
-	}
-	defer cli.Close()
-	if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		t.Skipf("skipping: docker daemon unreachable: %v", err)
-	}
-}
-
-// requireNetwork skips the test unless github.com is reachable. A few tests exercise behaviour
-// that inherently needs the network (force-pulling an image, resolving a remote short-sha ref);
-// gating lets the rest of the suite run offline without these failing.
-func requireNetwork(t *testing.T) {
-	t.Helper()
-	conn, err := net.DialTimeout("tcp", "github.com:443", 3*time.Second)
-	if err != nil {
-		t.Skipf("skipping: network unavailable: %v", err)
-	}
-	_ = conn.Close()
-}
-
-// requireHostTools skips the test unless every named executable is on PATH. Used by the
-// self-hosted (host environment) suite, which runs steps directly on the host.
-func requireHostTools(t *testing.T, tools ...string) {
-	t.Helper()
-	for _, tool := range tools {
-		if _, err := exec.LookPath(tool); err != nil {
-			t.Skipf("skipping: required host tool %q not found: %v", tool, err)
-		}
-	}
-}

act/runner/job_executor.go

@@ -5,48 +5,15 @@
 package runner
 
 import (
-	"archive/tar"
-	"bytes"
 	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
 	"fmt"
-	"io"
-	"net/http"
-	"path"
-	"slices"
 	"strconv"
-	"strings"
 	"time"
-	"unicode"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
 )
 
-const maxJobSummaryBytes = 1024 * 1024
-
-// jobSummaryTruncationMarker is appended to a summary that exceeded the size limit
-// so the rendered output makes the truncation visible instead of silently cutting off.
-const jobSummaryTruncationMarker = "\n\n---\n\n*Job summary truncated: it exceeded the maximum allowed size.*\n"
-
-var (
-	jobSummaryUploadRetryDelay = time.Second
-	// jobSummaryUploadRequestTimeout bounds a single step upload request. It is kept
-	// below jobSummaryUploadPhaseTimeout so one slow or unreachable request times out
-	// and lets the remaining steps still upload within the phase budget, instead of a
-	// single stuck request consuming the whole phase.
-	jobSummaryUploadRequestTimeout = 5 * time.Second
-	// jobSummaryUploadPhaseTimeout bounds the total time spent uploading all step
-	// summaries. The uploads run inside the job cleanup budget that is also used to
-	// stop and remove the container, so a slow or unreachable endpoint must not be
-	// allowed to consume it; this keeps the remaining budget available for teardown.
-	jobSummaryUploadPhaseTimeout = 15 * time.Second
-)
-
 type jobInfo interface {
 	matrix() map[string]any
 	steps() []*model.Step
@@ -57,81 +24,16 @@ type jobInfo interface {
 	result(result string)
 }
 
-// reportStepError records a step error so the job is reported failed — except a
-// cancellation, which is an interruption, not a failure.
-func reportStepError(ctx context.Context, rc *RunContext, err error) {
-	if errors.Is(err, context.Canceled) {
-		// Defer to the job context: a genuine cancel reports cancelled, a stray teardown
-		// cancellation on a live ctx is ignored — never a step FAILURE.
-		rc.markInterrupted(ctx.Err())
-		return
-	}
-	common.Logger(ctx).Errorf("##[error]%s", escapeCommandData(err.Error()))
+// reportStepError emits the GitHub Actions ##[error] annotation and records
+// the error against the job so the job is reported as failed.
+func reportStepError(ctx context.Context, err error) {
+	common.Logger(ctx).Errorf("##[error]%v", err)
 	common.SetJobError(ctx, err)
-	rc.markFailed()
-}
-
-// actionPreparer is implemented by steps that download an action before they run, so the job
-// executor can fetch all of them up front.
-type actionPreparer interface {
-	prepareActionExecutor() common.Executor
-	actionDownloadInfo() (reference, sha string, ok bool)
-}
-
-// printPrepareActions downloads every action the job uses before its first step runs and reports
-// them as actions/runner's "Prepare all required actions" section does. The steps still call
-// prepareActionExecutor themselves; it is a no-op once the action is resolved here.
-func printPrepareActions(rc *RunContext, preparers []actionPreparer) common.Executor {
-	return func(ctx context.Context) error {
-		if len(preparers) == 0 {
-			return nil
-		}
-
-		rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
-		rawLogger.Infof("Prepare all required actions")
-
-		for _, preparer := range preparers {
-			if err := preparer.prepareActionExecutor()(ctx); err != nil {
-				// No step has run yet, so the failure belongs to the job.
-				reportStepError(ctx, rc, err)
-				return err
-			}
-			reference, sha, ok := preparer.actionDownloadInfo()
-			if !ok {
-				continue
-			}
-			if sha == "" {
-				rawLogger.Infof("Download action repository '%s'", reference)
-			} else {
-				rawLogger.Infof("Download action repository '%s' (SHA:%s)", reference, sha)
-			}
-		}
-		return nil
-	}
-}
-
-// printCompleteJobName closes the setup section the way actions/runner ends its "Set up job" step.
-func printCompleteJobName(rc *RunContext) common.Executor {
-	return func(ctx context.Context) error {
-		// Name holds a matrix combination; JobName is the shared name GitHub reports.
-		name := rc.JobName
-		if name == "" {
-			name = rc.Name
-		}
-		if name == "" && rc.Run != nil {
-			name = rc.Run.JobID
-		}
-		common.Logger(ctx).WithField(rawOutputField, true).Infof("Complete job name: %s", name)
-		return nil
-	}
 }
 
 func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executor {
 	steps := make([]common.Executor, 0)
 	preSteps := make([]common.Executor, 0)
-	// Collected separately: every action is downloaded before the first pre step runs.
-	stepPreSteps := make([]common.Executor, 0)
-	preparers := make([]actionPreparer, 0)
 	var postExecutor common.Executor
 
 	steps = append(steps, func(ctx context.Context) error {
@@ -178,43 +80,35 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 			return common.NewErrorExecutor(err)
 		}
 
-		if preparer, ok := step.(actionPreparer); ok {
-			preparers = append(preparers, preparer)
-		}
-
-		stepIdx := stepModel.Number
 		preExec := step.pre()
-		stepPreSteps = append(stepPreSteps, useStepLogger(rc, stepModel, stepStagePre, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
+		preSteps = append(preSteps, useStepLogger(rc, stepModel, stepStagePre, func(ctx context.Context) error {
 			preErr := preExec(ctx)
 			if preErr != nil {
-				reportStepError(ctx, rc, preErr)
+				reportStepError(ctx, preErr)
 			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
+				reportStepError(ctx, ctx.Err())
 			}
 			return preErr
 		}))
 
 		stepExec := step.main()
 		steps = append(steps, useStepLogger(rc, stepModel, stepStageMain, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
 			err := stepExec(ctx)
 			if err != nil {
-				reportStepError(ctx, rc, err)
+				reportStepError(ctx, err)
 			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
+				reportStepError(ctx, ctx.Err())
 			}
 			return nil
 		}))
 
 		postFn := step.post()
 		postExec := useStepLogger(rc, stepModel, stepStagePost, func(ctx context.Context) error {
-			rc.CurrentStepIndex = stepIdx
 			err := postFn(ctx)
 			if err != nil {
-				reportStepError(ctx, rc, err)
+				reportStepError(ctx, err)
 			} else if ctx.Err() != nil {
-				reportStepError(ctx, rc, ctx.Err())
+				reportStepError(ctx, ctx.Err())
 			}
 			return err
 		})
@@ -226,26 +120,15 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 		}
 	}
 
-	// The setup section of the job log: download the actions, run the pre steps, then name the job.
-	preSteps = append(preSteps, printPrepareActions(rc, preparers))
-	preSteps = append(preSteps, stepPreSteps...)
-	preSteps = append(preSteps, printCompleteJobName(rc))
-
 	postExecutor = postExecutor.Finally(func(ctx context.Context) error {
 		jobError := common.JobError(ctx)
 		var err error
-		// jobError == nil keeps a failed job's container alive for post-mortem debugging when
-		// AutoRemove is off (the act-CLI --rm behavior; the shipped runner always sets
-		// AutoRemove). A cancelled run is not a failure to inspect, and the cancel-path post
-		// context now carries its own error container so a failing post step makes jobError
-		// non-nil — OR in rc.jobCancelled so cancellation still always tears the container down.
-		if rc.Config.AutoRemove || jobError == nil || rc.jobCancelled {
+		if rc.Config.AutoRemove || jobError == nil {
 			// always allow 1 min for stopping and removing the runner, even if we were cancelled
 			ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
 			defer cancel()
 
 			logger := common.Logger(ctx)
-			tryUploadJobSummary(ctx, rc)
 			// For Gitea
 			// We don't need to call `stopServiceContainers` here since it will be called by following `info.stopContainer`
 			// logger.Infof("Cleaning up services for job %s", rc.JobName)
@@ -278,136 +161,40 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 		return err
 	})
 
-	stepsExecutor := newStepsExecutor(rc, preSteps, steps)
+	pipeline := make([]common.Executor, 0)
+	pipeline = append(pipeline, preSteps...)
+	pipeline = append(pipeline, steps...)
 
-	return common.NewPipelineExecutor(info.startContainer(), stepsExecutor.
+	return common.NewPipelineExecutor(info.startContainer(), common.NewPipelineExecutor(pipeline...).
 		Finally(func(ctx context.Context) error {
-			// Record an interrupt (backstop for interrupts that land outside the main
-			// step loop) so the post steps observe the cancelled/failed job status.
-			rc.markInterrupted(ctx.Err())
-			postCtx, cancel := postStepsContext(ctx)
-			defer cancel()
-			return postExecutor(postCtx)
+			var cancel context.CancelFunc
+			if ctx.Err() == context.Canceled {
+				// in case of an aborted run, we still should execute the
+				// post steps to allow cleanup.
+				ctx, cancel = context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), 5*time.Minute)
+				defer cancel()
+			}
+			return postExecutor(ctx)
 		}).
 		Finally(info.interpolateOutputs()).
 		Finally(info.closeContainer()))
 }
 
-// postStepsContext derives the context used to run the job's post/cleanup steps from the
-// finished main-pipeline context. Cleanup has to run even when the run was interrupted, so the
-// returned context always carries a fresh bounded deadline and is never itself cancelled.
-//
-//   - context.Canceled (server cancel): detach from the cancelled context via a fresh root so
-//     the post steps can run.
-//   - context.DeadlineExceeded (job timeout): detach the deadline with WithoutCancel, which
-//     keeps the original values — including the job-error container — so the timeout failure and
-//     any post-step error are preserved and the job is still reported as failed.
-//   - otherwise: run on the live context unchanged.
-func postStepsContext(ctx context.Context) (context.Context, context.CancelFunc) {
-	switch ctx.Err() {
-	case context.Canceled:
-		// The cancelled context is abandoned for a fresh root, which drops the job-error
-		// container installed at the job root. Re-attach a fresh one so a failing post step
-		// records its error via SetJobError instead of panicking on a nil container.
-		return context.WithTimeout(common.WithJobErrorContainer(common.WithLogger(context.Background(), common.Logger(ctx))), 5*time.Minute)
-	case context.DeadlineExceeded:
-		return context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	default:
-		return ctx, func() {}
-	}
-}
-
-// newStepsExecutor sequences the job's pre steps and main steps.
-//
-// The pre steps run as a normal pipeline that short-circuits on the first failure or
-// cancellation. The main-steps executor then runs unconditionally — even if a pre step failed
-// or the job was interrupted — so always()/cancelled()/failure() main steps still run, mirroring
-// GitHub Actions. This is safe because each main step re-evaluates its own `if` (a pre-step
-// failure flips the expression job status to failure, so success()-default steps skip) and
-// newMainStepsExecutor detaches from an interrupted context before running the remaining steps.
-//
-// A pre-step failure or interrupt is still propagated so the job is reported with the correct
-// conclusion; the pre error takes precedence since it happened first.
-func newStepsExecutor(rc *RunContext, preSteps, steps []common.Executor) common.Executor {
-	preExecutor := common.NewPipelineExecutor(preSteps...)
-	mainExecutor := newMainStepsExecutor(rc, steps)
-	return func(ctx context.Context) error {
-		preErr := preExecutor(ctx)
-		mainErr := mainExecutor(ctx)
-		if preErr != nil {
-			return preErr
-		}
-		return mainErr
-	}
-}
-
-// newMainStepsExecutor runs the job's main-stage step executors in order. Unlike a plain
-// pipeline, an interruption (context.Canceled from a server cancel, or context.DeadlineExceeded
-// from the job timeout) does not abandon the remaining steps: it marks the job cancelled when
-// appropriate and keeps iterating under a fresh, bounded context so steps whose `if` still
-// evaluates true — always() and cancelled() — run for cleanup, mirroring GitHub Actions. Steps
-// that default to success() skip themselves because success() is false once the job is no longer
-// successful. The main-step wrappers report their own errors and return nil, so the loop drives
-// step ordering off the context, not return values.
-func newMainStepsExecutor(rc *RunContext, steps []common.Executor) common.Executor {
-	return func(ctx context.Context) error {
-		for i, step := range steps {
-			if ctx.Err() != nil {
-				return runMainStepsAfterInterrupt(ctx, rc, steps[i:])
-			}
-			_ = step(ctx)
-		}
-		// An interrupt can land during the final step, after the loop's last context
-		// check; record it so the post steps still observe the cancelled/failed status.
-		rc.markInterrupted(ctx.Err())
-		return nil
-	}
-}
-
-// runMainStepsAfterInterrupt runs the remaining main steps after the job context was cancelled or
-// timed out. It detaches from the interrupted context (keeping its values: logger and job error)
-// and applies a fresh deadline so always()/cancelled() steps run to completion. The original
-// interrupt error is returned so callers up the chain still see the job as cancelled/timed out.
-func runMainStepsAfterInterrupt(ctx context.Context, rc *RunContext, steps []common.Executor) error {
-	interruptErr := ctx.Err()
-	rc.markInterrupted(interruptErr)
-	freshCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
-	defer cancel()
-	for _, step := range steps {
-		_ = step(freshCtx)
-	}
-	return interruptErr
-}
-
 func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success bool) {
 	logger := common.Logger(ctx)
 
-	// Matrix combinations share one *model.Job and run in parallel; serialize the
-	// read-modify-write of the job result so a failing combination is not lost-updated by a
-	// concurrent succeeding one.
-	job := rc.Run.Job()
-	var continueOnError bool
-	if !success {
-		// Use a fresh context so an expired job timeout cannot block expression evaluation.
-		evalCtx := common.WithLogger(context.Background(), common.Logger(ctx))
-		continueOnError = evaluateJobContinueOnError(evalCtx, rc, job)
+	jobResult := "success"
+	// we have only one result for a whole matrix build, so we need
+	// to keep an existing result state if we run a matrix
+	if len(info.matrix()) > 0 && rc.Run.Job().Result != "" {
+		jobResult = rc.Run.Job().Result
 	}
-	jobResult := func() string {
-		defer lockJob(job)()
-		result := "success"
-		// we have only one result for a whole matrix build, so we need
-		// to keep an existing result state if we run a matrix
-		if len(info.matrix()) > 0 && job.Result != "" {
-			result = job.Result
-		}
-		if !success {
-			result = "failure"
-			job.SetContinueOnError(continueOnError)
-		}
-		info.result(result)
-		return result
-	}()
 
+	if !success {
+		jobResult = "failure"
+	}
+
+	info.result(jobResult)
 	if rc.caller != nil {
 		// set reusable workflow job result
 		rc.caller.setReusedWorkflowJobResult(rc.JobName, jobResult) // For Gitea
@@ -433,214 +220,10 @@ func setJobOutputs(ctx context.Context, rc *RunContext) {
 			callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value))
 		}
 
-		// Matrix combinations of a reusable-workflow caller share the caller's *model.Job;
-		// serialize the write so parallel combos don't race on its Outputs field.
-		callerJob := rc.caller.runContext.Run.Job()
-		defer lockJob(callerJob)()
-		callerJob.Outputs = callerOutputs
+		rc.caller.runContext.Run.Job().Outputs = callerOutputs
 	}
 }
 
-// applyJobTimeout applies the job-level timeout-minutes to ctx, mirroring the
-// step-level evaluateStepTimeout in step.go.
-func applyJobTimeout(ctx context.Context, rc *RunContext, job *model.Job) (context.Context, context.CancelFunc) {
-	timeout := rc.ExprEval.Interpolate(ctx, job.TimeoutMinutes)
-	if timeout != "" {
-		if timeoutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil {
-			return context.WithTimeout(ctx, time.Duration(timeoutMinutes)*time.Minute)
-		}
-	}
-	return ctx, func() {}
-}
-
-// evaluateJobContinueOnError evaluates the job-level continue-on-error expression.
-func evaluateJobContinueOnError(ctx context.Context, rc *RunContext, job *model.Job) bool {
-	expr := strings.TrimSpace(job.RawContinueOnError)
-	if expr == "" {
-		return false
-	}
-	continueOnError, err := EvalBool(ctx, rc.NewExpressionEvaluator(ctx), expr, exprparser.DefaultStatusCheckNone)
-	if err != nil {
-		common.Logger(ctx).Warnf("continue-on-error expression %q evaluation failed: %v", expr, err)
-		return false
-	}
-	return continueOnError
-}
-
-func tryUploadJobSummary(ctx context.Context, rc *RunContext) {
-	if rc == nil || rc.JobContainer == nil || rc.Config == nil {
-		return
-	}
-	// Bound the whole upload phase so a slow or unreachable endpoint cannot consume
-	// the job cleanup budget reserved for stopping and removing the container.
-	ctx, cancel := context.WithTimeout(ctx, jobSummaryUploadPhaseTimeout)
-	defer cancel()
-	env := rc.GetEnv()
-	caps := strings.TrimSpace(env["GITEA_ACTIONS_CAPABILITIES"])
-	if !hasJobSummaryCapability(caps) {
-		// Server did not advertise support. Do not attempt upload.
-		return
-	}
-	runtimeURL := strings.TrimSpace(env["ACTIONS_RUNTIME_URL"])
-	runtimeToken := strings.TrimSpace(env["ACTIONS_RUNTIME_TOKEN"])
-	runID := strings.TrimSpace(env["GITEA_RUN_ID"])
-	if runtimeURL == "" || runtimeToken == "" || runID == "" {
-		return
-	}
-	if rc.Run == nil || rc.Run.Job() == nil {
-		return
-	}
-	// The numeric ActionRunJob ID is not exposed in the proto Task message or task context,
-	// but the server signs it into the ACTIONS_RUNTIME_TOKEN JWT claims. We decode the
-	// unverified claims to retrieve it; the server re-verifies the token on the request.
-	jobID := extractJobIDFromRuntimeToken(runtimeToken)
-	if jobID <= 0 {
-		return
-	}
-
-	base := strings.TrimRight(runtimeURL, "/") + "/_apis/pipelines/workflows/" + runID +
-		"/jobs/" + strconv.FormatInt(jobID, 10) + "/steps/"
-	actPath := rc.JobContainer.GetActPath()
-	// Reuse a single client across all step uploads so connections can be pooled.
-	client := &http.Client{Timeout: jobSummaryUploadRequestTimeout}
-	for i := range rc.Run.Job().Steps {
-		summaryPath := path.Join(actPath, "workflow", "step-summary-"+strconv.Itoa(i)+".md")
-		body, ok := readSingleFileFromContainerArchive(ctx, rc.JobContainer, summaryPath, maxJobSummaryBytes)
-		if !ok || len(body) == 0 {
-			continue
-		}
-		uploadJobSummary(ctx, client, base+strconv.Itoa(i)+"/summary", runtimeToken, body)
-	}
-}
-
-// extractJobIDFromRuntimeToken returns the JobID claim from an ACTIONS_RUNTIME_TOKEN JWT
-// without verifying its signature. Returns 0 if the token is unparseable or has no JobID.
-func extractJobIDFromRuntimeToken(token string) int64 {
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return 0
-	}
-	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
-	if err != nil {
-		return 0
-	}
-	var claims struct {
-		JobID int64 `json:"JobID"`
-	}
-	if err := json.Unmarshal(payload, &claims); err != nil {
-		return 0
-	}
-	return claims.JobID
-}
-
-func hasJobSummaryCapability(caps string) bool {
-	return slices.Contains(strings.FieldsFunc(caps, func(r rune) bool {
-		return r == ',' || unicode.IsSpace(r)
-	}), "job-summary")
-}
-
-func uploadJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) {
-	logger := common.Logger(ctx)
-
-	var lastStatus int
-	var lastErr error
-	for attempt := 0; attempt < 2; attempt++ {
-		status, err := putJobSummary(ctx, client, url, runtimeToken, body)
-		if err == nil && status/100 == 2 {
-			return
-		}
-		lastStatus = status
-		lastErr = err
-		if attempt == 1 || !isTransientJobSummaryUploadFailure(status, err) {
-			break
-		}
-		timer := time.NewTimer(jobSummaryUploadRetryDelay)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			lastErr = ctx.Err()
-			attempt = 1
-		case <-timer.C:
-		}
-	}
-
-	// Best-effort only; do not fail job, but log because capability was advertised.
-	if lastErr != nil {
-		logger.WithError(lastErr).Warn("job summary upload failed")
-		return
-	}
-	logger.Warnf("job summary upload failed: status=%d", lastStatus)
-}
-
-func putJobSummary(ctx context.Context, client *http.Client, url, runtimeToken string, body []byte) (int, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(body))
-	if err != nil {
-		return 0, err
-	}
-	req.Header.Set("Authorization", "Bearer "+runtimeToken)
-	req.Header.Set("Content-Type", "text/markdown; charset=utf-8")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return 0, err
-	}
-	defer resp.Body.Close()
-	_, _ = io.Copy(io.Discard, resp.Body)
-	return resp.StatusCode, nil
-}
-
-func isTransientJobSummaryUploadFailure(status int, err error) bool {
-	return err != nil || status == http.StatusRequestTimeout || status == http.StatusTooManyRequests || status/100 == 5
-}
-
-func readSingleFileFromContainerArchive(ctx context.Context, env container.ExecutionsEnvironment, p string, maxBytes int64) ([]byte, bool) {
-	rc, err := env.GetContainerArchive(ctx, p)
-	if err != nil {
-		return nil, false
-	}
-	defer rc.Close()
-
-	tr := tar.NewReader(rc)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			return nil, false
-		}
-		if err != nil {
-			return nil, false
-		}
-		if header.Typeflag != tar.TypeReg {
-			continue
-		}
-		if !archiveEntryMatchesPath(header.Name, p) {
-			continue
-		}
-		// Summaries larger than the limit are truncated rather than dropped, so the
-		// user still gets the leading content (mirroring how GitHub caps oversized
-		// step summaries instead of discarding them). Read one extra byte so an
-		// over-limit file is detected from the actual stream rather than trusting
-		// header.Size, then cap the returned content at maxBytes.
-		b, err := io.ReadAll(io.LimitReader(tr, maxBytes+1))
-		if err != nil {
-			return nil, false
-		}
-		if int64(len(b)) > maxBytes {
-			// Reserve room for the marker so the marked-up result still fits in maxBytes.
-			marker := []byte(jobSummaryTruncationMarker)
-			keep := max(maxBytes-int64(len(marker)), 0)
-			b = append(b[:keep], marker...)
-			common.Logger(ctx).Warnf("job summary truncated: path=%s max=%d", p, maxBytes)
-		}
-		return b, true
-	}
-}
-
-func archiveEntryMatchesPath(entryName, requestedPath string) bool {
-	entryName = path.Clean(strings.TrimPrefix(entryName, "/"))
-	requestedPath = path.Clean(strings.TrimPrefix(requestedPath, "/"))
-	return entryName == requestedPath || entryName == path.Base(requestedPath)
-}
-
 func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor {
 	return func(ctx context.Context) error {
 		ctx = withStepLogger(ctx, stepModel.Number, stepModel.ID, rc.ExprEval.Interpolate(ctx, stepModel.String()), stage.String())
@@ -658,11 +241,6 @@ func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, execu
 		oldout, olderr := rc.JobContainer.ReplaceLogWriter(logWriter, logWriter)
 		defer rc.JobContainer.ReplaceLogWriter(oldout, olderr)
 
-		// Flush any buffered, not-yet-newline-terminated trailing line once the
-		// step has finished, so the final line of the step's output is not lost
-		// when it is not newline-terminated.
-		defer common.FlushWriter(logWriter)
-
 		return executor(ctx)
 	}
 }

act/runner/job_executor_test.go

@@ -5,41 +5,34 @@
 package runner
 
 import (
-	"archive/tar"
-	"bytes"
 	"context"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
-	"net/http/httptest"
 	"slices"
-	"strconv"
-	"strings"
 	"testing"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
-	log "github.com/sirupsen/logrus"
-	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-	yaml "go.yaml.in/yaml/v4"
 )
 
 func TestJobExecutor(t *testing.T) {
-	// Dryrun only checks syntax/planning; all cases resolve locally, so this runs offline.
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	tables := []TestJobFileInfo{
 		{workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets},
 		{workdir, "uses-github-empty", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
 		{workdir, "uses-github-noref", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
 		{workdir, "uses-github-root", "push", "", platforms, secrets},
+		{workdir, "uses-github-path", "push", "", platforms, secrets},
 		{workdir, "uses-docker-url", "push", "", platforms, secrets},
+		{workdir, "uses-github-full-sha", "push", "", platforms, secrets},
+		{workdir, "uses-github-short-sha", "push", "Unable to resolve action `actions/hello-world-docker-action@b136eb8`, the provided ref `b136eb8` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `b136eb8894c5cb1dd5807da824be97ccdf9b5423` instead", platforms, secrets},
 		{workdir, "job-nil-step", "push", "invalid Step 0: missing run or uses key", platforms, secrets},
 	}
 	// These tests are sufficient to only check syntax.
@@ -112,182 +105,6 @@ func (sfm *stepFactoryMock) newStep(model *model.Step, rc *RunContext) (step, er
 	return args.Get(0).(step), args.Error(1)
 }
 
-// actionPreparerMock stands in for a step whose action is downloaded before the job's first step.
-type actionPreparerMock struct {
-	reference string
-	sha       string
-	ok        bool
-	err       error
-	prepared  int
-}
-
-func (apm *actionPreparerMock) prepareActionExecutor() common.Executor {
-	return func(context.Context) error {
-		apm.prepared++
-		return apm.err
-	}
-}
-
-func (apm *actionPreparerMock) actionDownloadInfo() (string, string, bool) {
-	return apm.reference, apm.sha, apm.ok
-}
-
-func TestPrintPrepareActionsGolden(t *testing.T) {
-	buf := &bytes.Buffer{}
-	logger := log.New()
-	logger.SetOutput(buf)
-	logger.SetLevel(log.InfoLevel)
-	logger.SetFormatter(&jobLogFormatter{color: cyan})
-	ctx := common.WithLogger(context.Background(), logger.WithFields(log.Fields{"job": "j1"}))
-
-	preparers := []actionPreparer{
-		&actionPreparerMock{reference: "actions/checkout@v7", sha: "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", ok: true},
-		// A resolved commit is best effort; the ref alone is reported when it is unknown.
-		&actionPreparerMock{reference: "actions/setup-go@v6", ok: true},
-		// A step that downloads nothing, such as the checkout of the workflow's own repository.
-		&actionPreparerMock{ok: false},
-	}
-	require.NoError(t, printPrepareActions(&RunContext{}, preparers)(ctx))
-
-	want := strings.Join([]string{
-		"[j1]   | Prepare all required actions",
-		"[j1]   | Download action repository 'actions/checkout@v7' (SHA:9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)",
-		"[j1]   | Download action repository 'actions/setup-go@v6'",
-		"",
-	}, "\n")
-	assert.Equal(t, want, buf.String())
-}
-
-func TestPrintPrepareActionsSkipsWithoutActions(t *testing.T) {
-	buf := &bytes.Buffer{}
-	logger := log.New()
-	logger.SetOutput(buf)
-	logger.SetFormatter(&jobLogFormatter{color: cyan})
-	ctx := common.WithLogger(context.Background(), logger.WithFields(log.Fields{"job": "j1"}))
-
-	require.NoError(t, printPrepareActions(&RunContext{}, nil)(ctx))
-
-	assert.Empty(t, buf.String())
-}
-
-func TestPrintPrepareActionsFailsJobOnDownloadError(t *testing.T) {
-	logger, _ := logrustest.NewNullLogger()
-	ctx := common.WithJobErrorContainer(common.WithLogger(context.Background(), logger.WithField("job", "j1")))
-
-	downloadErr := errors.New("failed to fetch \"actions/checkout\"")
-	rc := &RunContext{}
-	remaining := &actionPreparerMock{reference: "actions/setup-go@v6", ok: true}
-
-	err := printPrepareActions(rc, []actionPreparer{
-		&actionPreparerMock{err: downloadErr},
-		remaining,
-	})(ctx)
-
-	require.ErrorIs(t, err, downloadErr)
-	// No step has run yet, so the failure has to be recorded against the job itself.
-	assert.Equal(t, downloadErr, common.JobError(ctx))
-	assert.True(t, rc.jobFailed)
-	assert.Zero(t, remaining.prepared)
-}
-
-func TestPrintCompleteJobName(t *testing.T) {
-	for name, tt := range map[string]struct {
-		rc   *RunContext
-		want string
-	}{
-		"job name":            {rc: &RunContext{JobName: "lint", Name: "lint-1"}, want: "lint"},
-		"falls back to name":  {rc: &RunContext{Name: "lint-1"}, want: "lint-1"},
-		"falls back to jobID": {rc: &RunContext{Run: &model.Run{JobID: "lint"}}, want: "lint"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			buf := &bytes.Buffer{}
-			logger := log.New()
-			logger.SetOutput(buf)
-			logger.SetFormatter(&jobLogFormatter{color: cyan})
-			ctx := common.WithLogger(context.Background(), logger.WithFields(log.Fields{"job": "j1"}))
-
-			require.NoError(t, printCompleteJobName(tt.rc)(ctx))
-
-			assert.Equal(t, "[j1]   | Complete job name: "+tt.want+"\n", buf.String())
-		})
-	}
-}
-
-// actionStepMock is a step whose action has to be downloaded before it can run.
-type actionStepMock struct {
-	*stepMock
-	*actionPreparerMock
-}
-
-// TestNewJobExecutorDownloadsAllActionsBeforeTheFirstStep pins the shape of the setup section:
-// every action is downloaded before any step runs, and the job name closes the section. A pre
-// step that downloaded its own action would leave the log interleaved with the downloads.
-func TestNewJobExecutorDownloadsAllActionsBeforeTheFirstStep(t *testing.T) {
-	ctx := common.WithJobErrorContainer(context.Background())
-	jim := &jobInfoMock{}
-	sfm := &stepFactoryMock{}
-	rc := &RunContext{
-		JobContainer: &jobContainerMock{},
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{"test": {}},
-			},
-		},
-		Config: &Config{},
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-
-	steps := []*model.Step{{ID: "1"}, {ID: "2"}}
-	executorOrder := make([]string, 0)
-
-	jim.On("steps").Return(steps)
-	jim.On("matrix").Return(map[string]any{})
-	jim.On("startContainer").Return(func(context.Context) error { return nil })
-	jim.On("stopContainer").Return(func(context.Context) error { return nil })
-	jim.On("closeContainer").Return(func(context.Context) error { return nil })
-	jim.On("interpolateOutputs").Return(func(context.Context) error { return nil })
-	jim.On("result", "success")
-
-	for _, stepModel := range steps {
-		sm := &stepMock{}
-		apm := &actionPreparerMock{reference: "actions/checkout@v" + stepModel.ID, ok: true}
-		sfm.On("newStep", stepModel, rc).Return(&actionStepMock{stepMock: sm, actionPreparerMock: apm}, nil)
-
-		sm.On("pre").Return(func(context.Context) error {
-			executorOrder = append(executorOrder, "pre"+stepModel.ID)
-			return nil
-		})
-		sm.On("main").Return(func(context.Context) error {
-			executorOrder = append(executorOrder, "step"+stepModel.ID)
-			return nil
-		})
-		sm.On("post").Return(func(context.Context) error { return nil })
-
-		defer sm.AssertExpectations(t)
-	}
-
-	logger, hook := logrustest.NewNullLogger()
-	err := newJobExecutor(jim, sfm, rc)(common.WithLogger(ctx, logger.WithField("job", "test")))
-	require.NoError(t, err)
-
-	assert.Equal(t, []string{"pre1", "pre2", "step1", "step2"}, executorOrder)
-
-	setup := make([]string, 0)
-	for _, entry := range hook.AllEntries() {
-		if strings.HasPrefix(entry.Message, "Prepare all required actions") || strings.HasPrefix(entry.Message, "Download action") ||
-			strings.HasPrefix(entry.Message, "Complete job name") {
-			setup = append(setup, entry.Message)
-		}
-	}
-	assert.Equal(t, []string{
-		"Prepare all required actions",
-		"Download action repository 'actions/checkout@v1'",
-		"Download action repository 'actions/checkout@v2'",
-		"Complete job name: test",
-	}, setup)
-}
-
 func TestNewJobExecutor(t *testing.T) {
 	table := []struct {
 		name          string
@@ -524,559 +341,3 @@ func TestNewJobExecutor(t *testing.T) {
 		})
 	}
 }
-
-// TestNewJobExecutorRunsPostStepsAfterTimeout guards the timeout-minutes cleanup
-// path: when a job exceeds its timeout the job context is DeadlineExceeded, but
-// the post steps (cleanup hooks like actions/checkout post and cache save) must
-// still run against a fresh, non-expired context, and the job must still be
-// reported as failed.
-func TestNewJobExecutorRunsPostStepsAfterTimeout(t *testing.T) {
-	ctx := common.WithJobErrorContainer(context.Background())
-	// The timeout is generous so the main step (which blocks on ctx.Done below) is
-	// always reached before the deadline fires; otherwise the pipeline would
-	// short-circuit before the step runs and the job error would never be set.
-	ctx, cancel := context.WithTimeout(ctx, 200*time.Millisecond)
-	defer cancel()
-
-	jim := &jobInfoMock{}
-	sfm := &stepFactoryMock{}
-	rc := &RunContext{
-		JobContainer: &jobContainerMock{},
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{
-					"test": {},
-				},
-			},
-		},
-		Config: &Config{},
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-
-	stepModel := &model.Step{ID: "1"}
-	jim.On("steps").Return([]*model.Step{stepModel})
-	jim.On("matrix").Return(map[string]any{})
-	jim.On("startContainer").Return(func(ctx context.Context) error { return nil })
-	jim.On("interpolateOutputs").Return(func(ctx context.Context) error { return nil })
-	jim.On("closeContainer").Return(func(ctx context.Context) error { return nil })
-	// The job timed out, so it must be reported as failed. stopContainer is left
-	// unexpected on purpose: a timed-out (failed) job preserves its error state, so
-	// the graceful stop is skipped exactly like any other failure without AutoRemove.
-	jim.On("result", "failure")
-
-	sm := &stepMock{}
-	sfm.On("newStep", stepModel, rc).Return(sm, nil)
-	sm.On("pre").Return(func(ctx context.Context) error { return nil })
-	// The main step runs past the job timeout: it blocks until the job context is
-	// done, mirroring a step that overruns timeout-minutes.
-	sm.On("main").Return(func(ctx context.Context) error {
-		<-ctx.Done()
-		return ctx.Err()
-	})
-
-	var postRan bool
-	var postCtxErr error
-	sm.On("post").Return(func(ctx context.Context) error {
-		postRan = true
-		postCtxErr = ctx.Err()
-		return nil
-	})
-
-	executor := newJobExecutor(jim, sfm, rc)
-	// The executor itself returns nil on timeout: the failure is surfaced through
-	// the job result ("failure", asserted via the result mock below), not the
-	// return value.
-	require.NoError(t, executor(ctx))
-
-	assert.True(t, postRan, "post step must run after a job timeout")
-	require.NoError(t, postCtxErr, "post step must run against a fresh, non-expired context")
-
-	jim.AssertExpectations(t)
-	sfm.AssertExpectations(t)
-	sm.AssertExpectations(t)
-}
-
-// TestSetJobResultMatrixContinueOnError exercises the parallel-matrix path
-// end-to-end: two combinations share one *model.Job and continue-on-error is
-// keyed on matrix.experimental, so one combination tolerates its failure and the
-// other does not. The job is reported as continue-on-error only when EVERY failing
-// combination was tolerated; a single firm failure makes the whole job firm, and
-// handleFailure then fails the run.
-func TestSetJobResultMatrixContinueOnError(t *testing.T) {
-	const jobYAML = "continue-on-error: ${{ matrix.experimental }}\nruns-on: ubuntu-latest"
-
-	newSharedJob := func(t *testing.T) (*model.Job, *model.Workflow) {
-		t.Helper()
-		var job *model.Job
-		require.NoError(t, yaml.Unmarshal([]byte(jobYAML), &job))
-		return job, &model.Workflow{
-			Name: "workflow1",
-			Jobs: map[string]*model.Job{"job1": job},
-		}
-	}
-
-	planFor := func(wf *model.Workflow) *model.Plan {
-		return &model.Plan{Stages: []*model.Stage{{Runs: []*model.Run{{Workflow: wf, JobID: "job1"}}}}}
-	}
-
-	ctx := context.Background()
-
-	// fail drives a single matrix combination through the failure path; each
-	// RunContext is its own jobInfo (rc implements jobInfo) and shares the job.
-	fail := func(wf *model.Workflow, experimental bool) {
-		rc := newTestRC(wf, map[string]any{"experimental": experimental})
-		setJobResult(ctx, rc, rc, false)
-	}
-
-	t.Run("one tolerated and one firm failure fails the run", func(t *testing.T) {
-		job, wf := newSharedJob(t)
-		// Order is intentional: the tolerated combination finishes first, then the
-		// firm one. The firm-failure latch must still win regardless of order.
-		fail(wf, true)
-		fail(wf, false)
-
-		assert.Equal(t, "failure", job.Result)
-		assert.False(t, job.ContinueOnError, "a single firm failure must make the whole job firm")
-		assert.Error(t, handleFailure(planFor(wf))(ctx))
-	})
-
-	t.Run("all tolerated failures do not fail the run", func(t *testing.T) {
-		job, wf := newSharedJob(t)
-		fail(wf, true)
-		fail(wf, true)
-
-		assert.Equal(t, "failure", job.Result)
-		assert.True(t, job.ContinueOnError, "every failing combination was tolerated")
-		assert.NoError(t, handleFailure(planFor(wf))(ctx))
-	})
-}
-
-func TestHasJobSummaryCapability(t *testing.T) {
-	assert.True(t, hasJobSummaryCapability("cache,job-summary artifacts"))
-	assert.True(t, hasJobSummaryCapability("cache,\njob-summary\tartifacts"))
-	assert.False(t, hasJobSummaryCapability("not-job-summary,job-summary-v2"))
-}
-
-// fakeRuntimeToken builds a JWT-shaped string whose middle (claims) segment encodes
-// the given JobID. The header and signature segments are filler — the runner does not
-// verify the signature; the server does.
-func fakeRuntimeToken(jobID int64) string {
-	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"HS256","typ":"JWT"}`))
-	claims := base64.RawURLEncoding.EncodeToString(fmt.Appendf(nil, `{"JobID":%d}`, jobID))
-	sig := base64.RawURLEncoding.EncodeToString([]byte("sig"))
-	return header + "." + claims + "." + sig
-}
-
-func newJobSummaryRC(env map[string]string, jobContainer container.ExecutionsEnvironment, stepCount int) *RunContext {
-	steps := make([]*model.Step, stepCount)
-	for i := range steps {
-		steps[i] = &model.Step{ID: strconv.Itoa(i)}
-	}
-	return &RunContext{
-		Config:       &Config{},
-		JobContainer: jobContainer,
-		Env:          env,
-		Run: &model.Run{
-			JobID: "test",
-			Workflow: &model.Workflow{
-				Jobs: map[string]*model.Job{
-					"test": {Steps: steps},
-				},
-			},
-		},
-	}
-}
-
-func TestTryUploadJobSummaryRetriesTransientFailure(t *testing.T) {
-	oldDelay := jobSummaryUploadRetryDelay
-	jobSummaryUploadRetryDelay = 0
-	defer func() {
-		jobSummaryUploadRetryDelay = oldDelay
-	}()
-
-	runtimeToken := fakeRuntimeToken(34)
-
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		assert.Equal(t, http.MethodPut, r.Method)
-		assert.Equal(t, "/_apis/pipelines/workflows/12/jobs/34/steps/0/summary", r.URL.Path)
-		assert.Equal(t, "Bearer "+runtimeToken, r.Header.Get("Authorization"))
-		assert.Equal(t, "text/markdown; charset=utf-8", r.Header.Get("Content-Type"))
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		assert.Equal(t, []byte("# summary"), body)
-		if requests == 1 {
-			w.WriteHeader(http.StatusInternalServerError)
-			return
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "# summary"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "cache, job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 1)
-
-	tryUploadJobSummary(ctx, rc)
-
-	assert.Equal(t, 2, requests)
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryStopsAtPhaseTimeout(t *testing.T) {
-	oldPhase := jobSummaryUploadPhaseTimeout
-	jobSummaryUploadPhaseTimeout = 100 * time.Millisecond
-	defer func() {
-		jobSummaryUploadPhaseTimeout = oldPhase
-	}()
-
-	runtimeToken := fakeRuntimeToken(34)
-
-	// The server blocks until either the request context is cancelled (the behaviour
-	// under test: the phase timeout aborts the in-flight upload) or the test tears it
-	// down. Without the phase timeout the upload would hang until the 30s client
-	// timeout instead of releasing the cleanup budget. The release channel guarantees
-	// the handler always returns so server.Close() cannot itself hang.
-	release := make(chan struct{})
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		select {
-		case <-r.Context().Done():
-		case <-release:
-		}
-	}))
-	defer server.Close()
-	defer close(release)
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "# summary"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 1)
-
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		tryUploadJobSummary(ctx, rc)
-	}()
-
-	select {
-	case <-done:
-	case <-time.After(5 * time.Second):
-		t.Fatal("tryUploadJobSummary did not honour the phase timeout")
-	}
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryUploadsEachStepIndependently(t *testing.T) {
-	runtimeToken := fakeRuntimeToken(34)
-
-	type upload struct {
-		path string
-		body string
-	}
-	var got []upload
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		got = append(got, upload{r.URL.Path, string(body)})
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	ctx := context.Background()
-	cm := &containerMock{}
-	// Three steps: 0 has content, 1 has empty content (skipped), 2 has content.
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-0.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-0.md", body: "first"}))),
-		nil,
-	).Once()
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-1.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-1.md", body: ""}))),
-		nil,
-	).Once()
-	cm.On("GetContainerArchive", mock.Anything, "/var/run/act/workflow/step-summary-2.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "step-summary-2.md", body: "third"}))),
-		nil,
-	).Once()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      runtimeToken,
-		"GITEA_RUN_ID":               "12",
-	}, cm, 3)
-
-	tryUploadJobSummary(ctx, rc)
-
-	assert.Equal(t, []upload{
-		{"/_apis/pipelines/workflows/12/jobs/34/steps/0/summary", "first"},
-		{"/_apis/pipelines/workflows/12/jobs/34/steps/2/summary", "third"},
-	}, got)
-	cm.AssertExpectations(t)
-}
-
-func TestTryUploadJobSummaryRequiresExactCapability(t *testing.T) {
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "not-job-summary,job-summary-v2",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      fakeRuntimeToken(34),
-		"GITEA_RUN_ID":               "12",
-	}, &containerMock{}, 1)
-
-	tryUploadJobSummary(context.Background(), rc)
-
-	assert.Equal(t, 0, requests)
-}
-
-func TestTryUploadJobSummarySkipsWhenJobIDMissingFromToken(t *testing.T) {
-	requests := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests++
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	rc := newJobSummaryRC(map[string]string{
-		"GITEA_ACTIONS_CAPABILITIES": "job-summary",
-		"ACTIONS_RUNTIME_URL":        server.URL,
-		"ACTIONS_RUNTIME_TOKEN":      "not-a-jwt",
-		"GITEA_RUN_ID":               "12",
-	}, &containerMock{}, 1)
-
-	tryUploadJobSummary(context.Background(), rc)
-
-	assert.Equal(t, 0, requests)
-}
-
-func TestExtractJobIDFromRuntimeToken(t *testing.T) {
-	assert.Equal(t, int64(42), extractJobIDFromRuntimeToken(fakeRuntimeToken(42)))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken("not-a-jwt"))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken("a.b.c"))
-	assert.Equal(t, int64(0), extractJobIDFromRuntimeToken(""))
-}
-
-func TestReadSingleFileFromContainerArchiveFindsMatchingRegularFile(t *testing.T) {
-	ctx := context.Background()
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t,
-			tarEntry{name: "workflow", typeflag: tar.TypeDir},
-			tarEntry{name: "other.md", body: "wrong"},
-			tarEntry{name: "SUMMARY.md", body: "right"},
-		))),
-		nil,
-	).Once()
-
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", 1024)
-
-	assert.True(t, ok)
-	assert.Equal(t, []byte("right"), body)
-	cm.AssertExpectations(t)
-}
-
-func TestReadSingleFileFromContainerArchiveTruncatesWhenTooLarge(t *testing.T) {
-	logger, hook := logrustest.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	cm := &containerMock{}
-	content := strings.Repeat("a", 300)
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "SUMMARY.md", body: content}))),
-		nil,
-	).Once()
-
-	const maxBytes = 200
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", maxBytes)
-
-	// Oversized summaries are truncated to the limit (reserving room for the marker)
-	// rather than dropped entirely, and the truncation marker is appended.
-	assert.True(t, ok)
-	assert.LessOrEqual(t, len(body), maxBytes)
-	keep := maxBytes - len(jobSummaryTruncationMarker)
-	assert.Equal(t, []byte(content[:keep]+jobSummaryTruncationMarker), body)
-	if assert.Len(t, hook.Entries, 1) {
-		assert.Contains(t, hook.Entries[0].Message, "job summary truncated")
-	}
-	cm.AssertExpectations(t)
-}
-
-func TestReadSingleFileFromContainerArchiveKeepsExactLimitWithoutWarning(t *testing.T) {
-	logger, hook := logrustest.NewNullLogger()
-	ctx := common.WithLogger(context.Background(), logger)
-	cm := &containerMock{}
-	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(
-		io.NopCloser(bytes.NewReader(tarArchive(t, tarEntry{name: "SUMMARY.md", body: "abc"}))),
-		nil,
-	).Once()
-
-	body, ok := readSingleFileFromContainerArchive(ctx, cm, "/var/run/act/workflow/SUMMARY.md", 3)
-
-	// A summary that is exactly at the limit is kept whole and not flagged as truncated.
-	assert.True(t, ok)
-	assert.Equal(t, []byte("abc"), body)
-	assert.Empty(t, hook.Entries)
-	cm.AssertExpectations(t)
-}
-
-type tarEntry struct {
-	name     string
-	body     string
-	typeflag byte
-}
-
-func tarArchive(t *testing.T, entries ...tarEntry) []byte {
-	t.Helper()
-
-	buf := &bytes.Buffer{}
-	tw := tar.NewWriter(buf)
-	for _, entry := range entries {
-		typeflag := entry.typeflag
-		if typeflag == 0 {
-			typeflag = tar.TypeReg
-		}
-		header := &tar.Header{
-			Name:     entry.name,
-			Typeflag: typeflag,
-			Mode:     0o644,
-			Size:     int64(len(entry.body)),
-		}
-		if typeflag == tar.TypeDir {
-			header.Mode = 0o755
-			header.Size = 0
-		}
-		require.NoError(t, tw.WriteHeader(header))
-		if typeflag == tar.TypeReg {
-			_, err := tw.Write([]byte(entry.body))
-			require.NoError(t, err)
-		}
-	}
-	require.NoError(t, tw.Close())
-	return buf.Bytes()
-}
-
-func newTestRC(wf *model.Workflow, matrix map[string]any) *RunContext {
-	return &RunContext{
-		Config: &Config{
-			Workdir: ".",
-			Platforms: map[string]string{
-				"ubuntu-latest": "ubuntu-latest",
-			},
-		},
-		StepResults: map[string]*model.StepResult{},
-		Env:         map[string]string{},
-		Matrix:      matrix,
-		Run:         &model.Run{JobID: "job1", Workflow: wf},
-	}
-}
-
-func makeTestRC(t *testing.T, jobYAML string) *RunContext {
-	t.Helper()
-	var job *model.Job
-	require.NoError(t, yaml.Unmarshal([]byte(jobYAML), &job))
-	rc := newTestRC(&model.Workflow{
-		Name: "workflow1",
-		Jobs: map[string]*model.Job{"job1": job},
-	}, nil)
-	rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
-	return rc
-}
-
-func TestApplyJobTimeout(t *testing.T) {
-	cases := []struct {
-		name        string
-		yaml        string
-		wantTimeout bool
-	}{
-		{"empty", "runs-on: ubuntu-latest", false},
-		{"integer", "timeout-minutes: 5\nruns-on: ubuntu-latest", true},
-		{"non-numeric ignored", "timeout-minutes: abc\nruns-on: ubuntu-latest", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rc := makeTestRC(t, tc.yaml)
-			ctx := context.Background()
-			newCtx, cancel := applyJobTimeout(ctx, rc, rc.Run.Job())
-			defer cancel()
-			_, hasDeadline := newCtx.Deadline()
-			assert.Equal(t, tc.wantTimeout, hasDeadline)
-		})
-	}
-}
-
-func TestEvaluateJobContinueOnError(t *testing.T) {
-	cases := []struct {
-		name string
-		yaml string
-		want bool
-	}{
-		{"absent", "runs-on: ubuntu-latest", false},
-		{"true", "continue-on-error: true\nruns-on: ubuntu-latest", true},
-		{"false", "continue-on-error: false\nruns-on: ubuntu-latest", false},
-		{"expression true", "continue-on-error: ${{ 'x' == 'x' }}\nruns-on: ubuntu-latest", true},
-		{"expression false", "continue-on-error: ${{ 'x' != 'x' }}\nruns-on: ubuntu-latest", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rc := makeTestRC(t, tc.yaml)
-			got := evaluateJobContinueOnError(context.Background(), rc, rc.Run.Job())
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}
-
-func TestJobSetContinueOnError(t *testing.T) {
-	t.Run("first call true", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		assert.True(t, j.ContinueOnError)
-	})
-	t.Run("first call false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(false)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("true then false locks to false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		j.SetContinueOnError(false)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("false then true stays false", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(false)
-		j.SetContinueOnError(true)
-		assert.False(t, j.ContinueOnError)
-	})
-	t.Run("true then true stays true", func(t *testing.T) {
-		j := &model.Job{}
-		j.SetContinueOnError(true)
-		j.SetContinueOnError(true)
-		assert.True(t, j.ContinueOnError)
-	})
-}

act/runner/logger.go

@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"slices"
 	"strings"
 	"sync"
 
@@ -167,33 +166,9 @@ func withStepLogger(ctx context.Context, stepNumber int, stepID, stepName, stage
 
 type entryProcessor func(entry *logrus.Entry) *logrus.Entry
 
-func AppendSecretMasker(oldnew []string, v string) []string {
-	ret := oldnew
-
-	for l := range strings.SplitSeq(v, "\n") {
-		tm := strings.TrimSpace(l)
-		// formatted JSON secrets could otherwise mask {,[,],} everywhere
-		if len(tm) > 1 {
-			ret = append(ret, tm, "***")
-			// command data reaches the log escaped, so "pass%word" also arrives as "pass%25word"
-			if strings.ContainsAny(tm, "%\r\n") {
-				ret = append(ret, escapeCommandData(tm), "***")
-			}
-		}
-	}
-
-	return ret
-}
-
 // valueMasker applies secrets and ::add-mask:: patterns to every log entry, including
 // raw_output (command/stream) lines; there is no bypass by field.
 func valueMasker(insecureSecrets bool, secrets map[string]string) entryProcessor {
-	var oldnew []string
-	for _, v := range secrets {
-		oldnew = AppendSecretMasker(oldnew, v)
-	}
-	oldnew = slices.Clip(oldnew)
-	defReplacer := strings.NewReplacer(oldnew...)
 	return func(entry *logrus.Entry) *logrus.Entry {
 		if insecureSecrets {
 			return entry
@@ -201,16 +176,16 @@ func valueMasker(insecureSecrets bool, secrets map[string]string) entryProcessor
 
 		masks := Masks(entry.Context)
 
-		if len(*masks) == 0 {
-			entry.Message = defReplacer.Replace(entry.Message)
-		} else {
-			cmasker := oldnew
-
-			for _, v := range *masks {
-				cmasker = AppendSecretMasker(cmasker, v)
+		for _, v := range secrets {
+			if v != "" {
+				entry.Message = strings.ReplaceAll(entry.Message, v, "***")
 			}
+		}
 
-			entry.Message = strings.NewReplacer(cmasker...).Replace(entry.Message)
+		for _, v := range *masks {
+			if v != "" {
+				entry.Message = strings.ReplaceAll(entry.Message, v, "***")
+			}
 		}
 
 		return entry
@@ -234,11 +209,6 @@ type jobLogFormatter struct {
 func (f *jobLogFormatter) Format(entry *logrus.Entry) ([]byte, error) {
 	b := &bytes.Buffer{}
 
-	// the web renderer decodes command data, so this local view has to as well
-	if _, _, _, ok := tryParseRawActionCommand(entry.Message + "\n"); ok {
-		entry.Message = UnescapeCommandData(entry.Message)
-	}
-
 	if f.isColored(entry) {
 		f.printColored(b, entry)
 	} else {

act/runner/logger_test.go

@@ -1,74 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestValueMasker(t *testing.T) {
-	table := []struct {
-		name       string
-		lines      string
-		secrets    map[string]string
-		masks      []string
-		disallowed []string
-	}{
-		{
-			name:  "Multiline Private Key",
-			lines: "cat << EOF > private.key\nPRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END\nEOF",
-			secrets: map[string]string{
-				"PRIVATE_KEY": "PRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END",
-			},
-			disallowed: []string{"KEY", "dsdfseffefsefes", "PRIVATE_KEY_END"},
-		},
-		{
-			name:       "Multiline Private Key in masks",
-			lines:      "cat << EOF > private.key\nPRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END\nEOF",
-			masks:      []string{"PRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END"},
-			disallowed: []string{"KEY", "dsdfseffefsefes", "PRIVATE_KEY_END"},
-		},
-		{
-			name:       "Secret containing a percent sign",
-			lines:      "##[error]login failed for pass%25word",
-			secrets:    map[string]string{"TOKEN": "pass%word"},
-			disallowed: []string{"pass%25word"},
-		},
-	}
-	for _, entry := range table {
-		t.Run(entry.name, func(t *testing.T) {
-			ctx := WithMasks(t.Context(), &entry.masks)
-			masker := valueMasker(false, entry.secrets)
-			for line := range strings.SplitSeq(entry.lines, "\n") {
-				lentry := masker(&logrus.Entry{
-					Context: ctx,
-					Message: line,
-				})
-				for _, line := range entry.disallowed {
-					assert.NotContains(t, lentry.Message, line)
-				}
-			}
-		})
-	}
-}
-
-func TestJobLogFormatterDecodesCommandData(t *testing.T) {
-	logger := logrus.New()
-	logger.Out = io.Discard
-	format := func(message string) string {
-		out, err := (&jobLogFormatter{}).Format(&logrus.Entry{Logger: logger, Message: message, Data: logrus.Fields{rawOutputField: true}})
-		require.NoError(t, err)
-		return string(out)
-	}
-
-	assert.Contains(t, format("##[error]deploy 50%25 traffic"), "##[error]deploy 50% traffic")
-	// a plain line is not command data and keeps its literal escapes
-	assert.Contains(t, format("progress 50%25 done"), "progress 50%25 done")
-}

act/runner/reusable_workflow.go

@@ -7,12 +7,15 @@ package runner
 import (
 	"archive/tar"
 	"context"
+	"errors"
 	"fmt"
+	"io/fs"
 	"net/url"
+	"os"
 	"path"
-	"path/filepath"
 	"regexp"
 	"strings"
+	"sync"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
@@ -28,9 +31,7 @@ func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
 		workflowDir = strings.TrimPrefix(workflowDir, "./")
 
 		return common.NewPipelineExecutor(
-			// resolve the local workflow against the workspace root, not the process
-			// working directory, so it is found regardless of where the runner is invoked
-			newReusableWorkflowExecutor(rc, filepath.Join(rc.Config.Workdir, workflowDir), fileName),
+			newReusableWorkflowExecutor(rc, workflowDir, fileName),
 		)
 	}
 
@@ -50,7 +51,7 @@ func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
 	token := rc.Config.GetToken()
 
 	return common.NewPipelineExecutor(
-		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
+		newMutexExecutor(cloneIfRequired(rc, *remoteReusableWorkflow, workflowDir, token)),
 		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
 	)
 }
@@ -84,7 +85,7 @@ func newRemoteReusableWorkflowExecutor(rc *RunContext) common.Executor {
 	token := getGitCloneToken(rc.Config, remoteReusableWorkflow.CloneURL())
 
 	return common.NewPipelineExecutor(
-		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
+		newMutexExecutor(cloneIfRequired(rc, *remoteReusableWorkflow, workflowDir, token)),
 		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
 	)
 }
@@ -124,38 +125,46 @@ func newActionCacheReusableWorkflowExecutor(rc *RunContext, filename string, rem
 	}
 }
 
-// cloneRemoteReusableWorkflow always invokes the clone executor — moving refs
-// (branches, tags) must be re-resolved each run, matching GitHub Actions.
-//
-// Callers must not change remoteReusableWorkflow.URL, because:
-//  1. Gitea doesn't support specifying GithubContext.ServerURL by the GITHUB_SERVER_URL env
-//  2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflowWithPlat
-//
-// remoteReusableWorkflow.URL = rc.getGithubContext(ctx).ServerURL
-func cloneRemoteReusableWorkflow(rc *RunContext, cloneURL, ref, targetDirectory, token string) common.Executor {
+var executorLock sync.Mutex
+
+func newMutexExecutor(executor common.Executor) common.Executor {
 	return func(ctx context.Context) error {
-		cloneURL = rc.NewExpressionEvaluator(ctx).Interpolate(ctx, cloneURL)
-		return git.NewGitCloneExecutor(git.NewGitCloneExecutorInput{
-			URL:         cloneURL,
-			Ref:         ref,
-			Dir:         targetDirectory,
-			Token:       token,
-			OfflineMode: rc.Config.ActionOfflineMode,
-			Depth:       rc.Config.ActionCloneDepth,
-		})(ctx)
+		executorLock.Lock()
+		defer executorLock.Unlock()
+
+		return executor(ctx)
 	}
 }
 
-var modelNewWorkflowPlanner = model.NewWorkflowPlanner
+func cloneIfRequired(rc *RunContext, remoteReusableWorkflow remoteReusableWorkflow, targetDirectory, token string) common.Executor {
+	return common.NewConditionalExecutor(
+		func(ctx context.Context) bool {
+			_, err := os.Stat(targetDirectory)
+			notExists := errors.Is(err, fs.ErrNotExist)
+			return notExists
+		},
+		func(ctx context.Context) error {
+			// interpolate the cloneURL
+			cloneURL := rc.NewExpressionEvaluator(ctx).Interpolate(ctx, remoteReusableWorkflow.CloneURL())
+			// Do not change the remoteReusableWorkflow.URL, because:
+			// 	1. Gitea doesn't support specifying GithubContext.ServerURL by the GITHUB_SERVER_URL env
+			//	2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflowWithPlat
+			// remoteReusableWorkflow.URL = rc.getGithubContext(ctx).ServerURL
+			return git.NewGitCloneExecutor(git.NewGitCloneExecutorInput{
+				URL:         cloneURL,
+				Ref:         remoteReusableWorkflow.Ref,
+				Dir:         targetDirectory,
+				Token:       token,
+				OfflineMode: rc.Config.ActionOfflineMode,
+			})(ctx)
+		},
+		nil,
+	)
+}
 
 func newReusableWorkflowExecutor(rc *RunContext, directory, workflow string) common.Executor {
 	return func(ctx context.Context) error {
-		// Scoped to the yaml read so concurrent invocations don't serialize
-		// on the whole job run.
-		planner, err := func() (model.WorkflowPlanner, error) {
-			defer git.AcquireCloneLock(directory)()
-			return modelNewWorkflowPlanner(path.Join(directory, workflow), true)
-		}()
+		planner, err := model.NewWorkflowPlanner(path.Join(directory, workflow), true)
 		if err != nil {
 			return err
 		}
@@ -288,12 +297,8 @@ func setReusedWorkflowCallerResult(rc *RunContext, runner Runner) common.Executo
 			if rc.caller != nil {
 				rc.caller.setReusedWorkflowJobResult(rc.JobName, reusedWorkflowJobResult)
 			} else {
-				// Serialize this shared Job.Result write against the other matrix combos
-				// and setJobResult (same lockJob key).
-				unlock := lockJob(rc.Run.Job())
 				rc.result(reusedWorkflowJobResult)
-				unlock()
-				logger.WithField("jobResult", reusedWorkflowJobResult).Infof("Job %s", reusedWorkflowJobResultMessage)
+				logger.WithField("jobResult", reusedWorkflowJobResult).Infof("\U0001F3C1  Job %s", reusedWorkflowJobResultMessage)
 			}
 		}
 
@@ -305,45 +310,25 @@ func setReusedWorkflowCallerResult(rc *RunContext, runner Runner) common.Executo
 // getGitCloneToken returns GITEA_TOKEN when shouldCloneURLUseToken returns true,
 // otherwise returns an empty string
 func getGitCloneToken(conf *Config, cloneURL string) string {
-	if !shouldCloneURLUseToken(conf.GitHubInstance, conf.trustedActionInstance(), cloneURL) {
+	if !shouldCloneURLUseToken(conf.GitHubInstance, cloneURL) {
 		return ""
 	}
 	return conf.GetToken()
 }
 
-// For Gitea
-// trustedActionInstance returns the self-hosted DEFAULT_ACTIONS_URL host that may carry the
-// task token, or "" when actions resolve to github.com / a GithubMirror (never trusted).
-func (c Config) trustedActionInstance() string {
-	if c.DefaultActionInstanceIsSelfHosted {
-		return c.DefaultActionInstance
-	}
-	return ""
-}
-
 // For Gitea
 // shouldCloneURLUseToken returns true when the following conditions are met:
-//  1. cloneURL's host matches this Gitea instance: either the registered instance
-//     (instanceURL) or, for DEFAULT_ACTIONS_URL=self on a different hostname, the
-//     self-hosted action instance (trustedActionInstance, "" when not trusted)
-//  2. the cloneURL does not have basic auth embedded
-func shouldCloneURLUseToken(instanceURL, trustedActionInstance, cloneURL string) bool {
-	u2, err := url.Parse(cloneURL)
-	if err != nil || u2.User != nil {
+// 1. cloneURL is from the same Gitea instance that the runner is registered to
+// 2. the cloneURL does not have basic auth embedded
+func shouldCloneURLUseToken(instanceURL, cloneURL string) bool {
+	u1, err1 := url.Parse(instanceURL)
+	u2, err2 := url.Parse(cloneURL)
+	if err1 != nil || err2 != nil {
+		return false
+	}
+	if u2.User != nil {
 		return false
 	}
 
-	for _, candidate := range []string{instanceURL, trustedActionInstance} {
-		if candidate == "" {
-			continue
-		}
-		if !strings.HasPrefix(candidate, "http://") &&
-			!strings.HasPrefix(candidate, "https://") {
-			candidate = "https://" + candidate
-		}
-		if u1, err := url.Parse(candidate); err == nil && u1.Host == u2.Host {
-			return true
-		}
-	}
-	return false
+	return u1.Host == u2.Host
 }

act/runner/reusable_workflow_test.go

@@ -1,237 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common/git"
-	"gitea.com/gitea/runner/act/model"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Regression test for go-gitea/gitea#37483: a remote reusable workflow at a moving
-// ref (branch/tag) must reflect the new tip on every invocation, not stay pinned
-// to the cache populated on the first run.
-func TestReusableWorkflowCachedBranchRefRefreshes(t *testing.T) {
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("git not available in PATH")
-	}
-
-	remoteDir := t.TempDir()
-	gitMust(t, "", "init", "--bare", "--initial-branch=master", remoteDir)
-
-	workDir := t.TempDir()
-	gitMust(t, "", "clone", remoteDir, workDir)
-	gitMust(t, workDir, "config", "user.email", "test@test")
-	gitMust(t, workDir, "config", "user.name", "test")
-	gitMust(t, workDir, "checkout", "-b", "master")
-
-	const workflowPath = ".gitea/workflows/reusable.yml"
-	tmpl := func(tag string) string {
-		return "name: reusable\non:\n  workflow_call:\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo " + tag + "\n"
-	}
-
-	require.NoError(t, os.MkdirAll(filepath.Join(workDir, ".gitea/workflows"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, workflowPath), []byte(tmpl("v1")), 0o644))
-	gitMust(t, workDir, "add", workflowPath)
-	gitMust(t, workDir, "commit", "-m", "v1")
-	gitMust(t, workDir, "push", "-u", "origin", "master")
-
-	rc := &RunContext{
-		Config: &Config{},
-		Run: &model.Run{
-			JobID: "j1",
-			Workflow: &model.Workflow{
-				Name: "wf",
-				Jobs: map[string]*model.Job{"j1": {}},
-			},
-		},
-	}
-	cacheDir := t.TempDir()
-
-	require.NoError(t, cloneRemoteReusableWorkflow(rc, remoteDir, "master", cacheDir, "")(context.Background()))
-	got, err := os.ReadFile(filepath.Join(cacheDir, workflowPath))
-	require.NoError(t, err)
-	require.Equal(t, tmpl("v1"), string(got))
-
-	// Branch tip moves; cache key (cacheDir) does not.
-	require.NoError(t, os.WriteFile(filepath.Join(workDir, workflowPath), []byte(tmpl("v2")), 0o644))
-	gitMust(t, workDir, "commit", "-am", "v2")
-	gitMust(t, workDir, "push", "origin", "master")
-
-	require.NoError(t, cloneRemoteReusableWorkflow(rc, remoteDir, "master", cacheDir, "")(context.Background()))
-	got, err = os.ReadFile(filepath.Join(cacheDir, workflowPath))
-	require.NoError(t, err)
-	require.Equal(t, tmpl("v2"), string(got), "cached workflow file must reflect the updated branch tip")
-}
-
-func TestNewReusableWorkflowExecutorHoldsCloneLock(t *testing.T) {
-	workflowDir := t.TempDir()
-
-	unlockOnce := sync.OnceFunc(git.AcquireCloneLock(workflowDir))
-	defer unlockOnce()
-
-	plannerCalled := make(chan struct{})
-
-	origPlanner := modelNewWorkflowPlanner
-	modelNewWorkflowPlanner = func(string, bool) (model.WorkflowPlanner, error) {
-		close(plannerCalled)
-		return nil, errors.New("stop")
-	}
-	defer func() { modelNewWorkflowPlanner = origPlanner }()
-
-	rc := &RunContext{
-		Config: &Config{},
-		Run:    &model.Run{Workflow: &model.Workflow{Jobs: map[string]*model.Job{}}},
-	}
-	exec := newReusableWorkflowExecutor(rc, workflowDir, "reusable.yml")
-
-	done := make(chan error, 1)
-	go func() { done <- exec(context.Background()) }()
-
-	select {
-	case <-plannerCalled:
-		t.Fatal("planner ran while clone lock was held")
-	case err := <-done:
-		t.Fatalf("executor returned before planner was reached: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	unlockOnce()
-
-	select {
-	case <-plannerCalled:
-	case <-time.After(time.Second):
-		t.Fatal("planner not called after lock was released")
-	}
-
-	select {
-	case err := <-done:
-		require.Error(t, err)
-	case <-time.After(time.Second):
-		t.Fatal("executor did not return after planner ran")
-	}
-}
-
-func TestGetGitCloneTokenWithSchemalessGiteaInstance(t *testing.T) {
-	conf := &Config{
-		GitHubInstance: "gitea.example.net",
-		Secrets: map[string]string{
-			"GITEA_TOKEN": "token-value",
-		},
-	}
-
-	token := getGitCloneToken(conf, "https://gitea.example.net/actions/tools")
-
-	require.Equal(t, "token-value", token)
-}
-
-func TestGetGitCloneTokenSelfHostedActionsDifferentHost(t *testing.T) {
-	// The runner registered with one hostname while DEFAULT_ACTIONS_URL=self resolves
-	// actions against AppURL on a different hostname for the same instance.
-	conf := &Config{
-		GitHubInstance:                    "gitea.local",
-		DefaultActionInstance:             "https://gitea.my-nas.lan",
-		DefaultActionInstanceIsSelfHosted: true,
-		Secrets: map[string]string{
-			"GITEA_TOKEN": "token-value",
-		},
-	}
-
-	token := getGitCloneToken(conf, "https://gitea.my-nas.lan/owner/action")
-
-	require.Equal(t, "token-value", token)
-}
-
-func TestShouldCloneURLUseToken(t *testing.T) {
-	tests := []struct {
-		name                  string
-		instanceURL           string
-		trustedActionInstance string
-		cloneURL              string
-		want                  bool
-	}{
-		{
-			name:        "same host with schemaless instance",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://gitea.example.net/actions/tools",
-			want:        true,
-		},
-		{
-			name:        "same host with schemaless instance and port",
-			instanceURL: "gitea.example.net:3000",
-			cloneURL:    "https://gitea.example.net:3000/actions/tools",
-			want:        true,
-		},
-		{
-			name:        "different host",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://github.com/actions/tools",
-			want:        false,
-		},
-		{
-			name:        "embedded basic auth",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "https://user:pass@gitea.example.net/actions/tools",
-			want:        false,
-		},
-		{
-			name:        "invalid clone URL",
-			instanceURL: "gitea.example.net",
-			cloneURL:    "://gitea.example.net/actions/tools",
-			want:        false,
-		},
-		{
-			// self-hosted DEFAULT_ACTIONS_URL on a different hostname than the
-			// registered instance: the token must still be attached.
-			name:                  "self-hosted action instance on different host",
-			instanceURL:           "gitea.local",
-			trustedActionInstance: "https://gitea.my-nas.lan",
-			cloneURL:              "https://gitea.my-nas.lan/owner/action",
-			want:                  true,
-		},
-		{
-			// embedded basic auth must still be rejected even when the host matches
-			// the trusted action instance.
-			name:                  "self-hosted action instance with embedded basic auth",
-			instanceURL:           "gitea.local",
-			trustedActionInstance: "https://gitea.my-nas.lan",
-			cloneURL:              "https://user:pass@gitea.my-nas.lan/owner/action",
-			want:                  false,
-		},
-		{
-			// github.com / mirror hosts are never trusted: trustedActionInstance is
-			// empty in github mode, so an off-instance clone URL gets no token.
-			name:        "github mode does not trust mirror host",
-			instanceURL: "gitea.local",
-			cloneURL:    "https://mirror.example.com/owner/action",
-			want:        false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require.Equal(t, tt.want, shouldCloneURLUseToken(tt.instanceURL, tt.trustedActionInstance, tt.cloneURL))
-		})
-	}
-}
-
-func gitMust(t *testing.T, dir string, args ...string) {
-	t.Helper()
-	cmd := exec.Command("git", args...)
-	if dir != "" {
-		cmd.Dir = dir
-	}
-	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "git %v: %s", args, string(out))
-}

act/runner/run_context.go

@@ -20,9 +20,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
-	"slices"
 	"strings"
-	"sync"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
@@ -36,19 +34,15 @@ import (
 
 // RunContext contains info about current job
 type RunContext struct {
-	Name        string
-	Config      *Config
-	Matrix      map[string]any
-	Run         *model.Run
-	EventJSON   string
-	Env         map[string]string
-	GlobalEnv   map[string]string // to pass env changes of GITHUB_ENV and set-env correctly, due to dirty Env field
-	ExtraPath   []string
-	CurrentStep string
-	// CurrentStepIndex is the index of the top-level job step currently executing
-	// (model.Step.Number). Composite sub-steps inherit the outer step's index by
-	// walking the Parent chain; see topLevelRunContext.
-	CurrentStepIndex    int
+	Name                string
+	Config              *Config
+	Matrix              map[string]any
+	Run                 *model.Run
+	EventJSON           string
+	Env                 map[string]string
+	GlobalEnv           map[string]string // to pass env changes of GITHUB_ENV and set-env correctly, due to dirty Env field
+	ExtraPath           []string
+	CurrentStep         string
 	StepResults         map[string]*model.StepResult
 	IntraActionState    map[string]map[string]string
 	ExprEval            ExpressionEvaluator
@@ -61,51 +55,6 @@ type RunContext struct {
 	Masks               []string
 	cleanUpJobContainer common.Executor
 	caller              *caller // job calling this RunContext (reusable workflows)
-	// summaryFileInitialized tracks which per-step summary files (workflow/step-summary-N.md)
-	// have already been created on the JobContainer. The runner sets up file-command files
-	// via JobContainer.Copy at the start of every phase, which truncates them — fine for
-	// GITHUB_ENV/OUTPUT/STATE/PATH (consumed per phase) but wrong for GITHUB_STEP_SUMMARY,
-	// which has accumulating semantics. We initialize each step's summary file exactly once
-	// so writes from later phases and from composite sub-steps append to the same file.
-	// Only populated on the top-level RunContext; child RCs walk Parent via topLevelRunContext.
-	summaryFileInitialized map[int]bool
-	// outputTemplate is this combination's pristine snapshot of the job's output expressions,
-	// captured before execution so each matrix combo interpolates from the originals rather
-	// than from a sibling's already-resolved values written into the shared Job.Outputs.
-	outputTemplate map[string]string
-	// jobCancelled records that this job's run was cancelled (context.Canceled). It makes
-	// getJobContext report the "cancelled" status so cancelled()/always() evaluate the way
-	// GitHub Actions does, letting cleanup and always() steps run while normal steps skip.
-	jobCancelled bool
-	// jobFailed records failures outside normal main-step results, such as action pre-step
-	// failures. Those failures must still make success() false and failure() true for later
-	// main-step if evaluation.
-	jobFailed bool
-}
-
-// markCancelled flags the job as cancelled so subsequent step `if` evaluations and the
-// job status context observe the "cancelled" state.
-func (rc *RunContext) markCancelled() {
-	rc.jobCancelled = true
-}
-
-// markFailed flags the job as failed so subsequent step `if` evaluations observe
-// failure even when the error happened outside a main step result.
-func (rc *RunContext) markFailed() {
-	rc.jobFailed = true
-}
-
-// markInterrupted records the job's interruption status from a context error so later step `if` evaluations and the job result observe it,
-// keeping the timeout path symmetric with the cancel path:
-//   - context.Canceled (server cancel) marks the job cancelled, matching GitHub's "only always()/cancelled() run on cancel".
-//   - context.DeadlineExceeded (job timeout-minutes) marks the job failed, matching the "Timeout -> FAILURE" reporting semantics.
-func (rc *RunContext) markInterrupted(err error) {
-	switch {
-	case errors.Is(err, context.Canceled):
-		rc.markCancelled()
-	case errors.Is(err, context.DeadlineExceeded):
-		rc.markFailed()
-	}
 }
 
 func (rc *RunContext) AddMask(mask string) {
@@ -138,9 +87,7 @@ func (rc *RunContext) GetEnv() map[string]string {
 			}
 		}
 	}
-	if !rc.Config.DisableActEnv {
-		rc.Env["ACT"] = "true"
-	}
+	rc.Env["ACT"] = "true"
 
 	if !rc.Config.NoSkipCheckout {
 		rc.Env["ACT_SKIP_CHECKOUT"] = "true"
@@ -183,34 +130,17 @@ func getDockerDaemonSocketMountPath(daemonPath string) string {
 	return daemonPath
 }
 
-// containerDaemonSocket returns the configured Docker daemon socket, applying the default
-// without mutating the shared Config. Parallel jobs in a plan share one *Config, so a job
-// must never write to it.
-func (rc *RunContext) containerDaemonSocket() string {
-	if rc.Config.ContainerDaemonSocket == "" {
-		return "/var/run/docker.sock"
-	}
-	return rc.Config.ContainerDaemonSocket
-}
-
-// validVolumes returns the volumes allowed on this job's containers: the configured base
-// plus the volumes the runner mounts automatically. It derives a fresh slice every call and
-// never mutates the shared Config (see containerDaemonSocket).
-func (rc *RunContext) validVolumes() []string {
-	name := rc.jobContainerName()
-	volumes := slices.Clone(rc.Config.ValidVolumes)
-	// TODO: add a new configuration to control whether the docker daemon can be mounted
-	return append(volumes, "act-toolcache", name, name+"-env",
-		getDockerDaemonSocketMountPath(rc.containerDaemonSocket()))
-}
-
 // Returns the binds and mounts for the container, resolving paths as appopriate
 func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) {
 	name := rc.jobContainerName()
 
+	if rc.Config.ContainerDaemonSocket == "" {
+		rc.Config.ContainerDaemonSocket = "/var/run/docker.sock"
+	}
+
 	binds := []string{}
-	if daemonSocket := rc.containerDaemonSocket(); daemonSocket != "-" {
-		daemonPath := getDockerDaemonSocketMountPath(daemonSocket)
+	if rc.Config.ContainerDaemonSocket != "-" {
+		daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)
 		binds = append(binds, fmt.Sprintf("%s:%s", daemonPath, "/var/run/docker.sock"))
 	}
 
@@ -224,9 +154,6 @@ func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) {
 	if job := rc.Run.Job(); job != nil {
 		if container := job.Container(); container != nil {
 			for _, v := range container.Volumes {
-				if rc.ExprEval != nil {
-					v = rc.ExprEval.Interpolate(context.Background(), v)
-				}
 				if !strings.Contains(v, ":") || filepath.IsAbs(v) {
 					// Bind anonymous volume or host file.
 					binds = append(binds, v)
@@ -252,13 +179,21 @@ func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) {
 		mounts[name] = ext.ToContainerPath(rc.Config.Workdir)
 	}
 
+	// For Gitea
+	// add some default binds and mounts to ValidVolumes
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, "act-toolcache")
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, name)
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, name+"-env")
+	// TODO: add a new configuration to control whether the docker daemon can be mounted
+	rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket))
+
 	return binds, mounts
 }
 
 func (rc *RunContext) startHostEnvironment() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		rawLogger := logger.WithField(rawOutputField, true)
+		rawLogger := logger.WithField("raw_output", true)
 		logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
 			if rc.Config.LogOutput {
 				rawLogger.Infof("%s", s)
@@ -285,20 +220,19 @@ func (rc *RunContext) startHostEnvironment() common.Executor {
 		}
 		toolCache := filepath.Join(cacheDir, "tool_cache")
 		rc.JobContainer = &container.HostEnvironment{
-			Path:         path,
-			TmpDir:       runnerTmp,
-			ToolCache:    toolCache,
-			Workdir:      rc.Config.Workdir,
-			CleanWorkdir: rc.Config.CleanWorkdir,
-			ActPath:      actPath,
+			Path:        path,
+			TmpDir:      runnerTmp,
+			ToolCache:   toolCache,
+			Workdir:     rc.Config.Workdir,
+			BindWorkdir: rc.Config.BindWorkdir,
+			ActPath:     actPath,
 			CleanUp: func() {
 				os.RemoveAll(miscpath)
 			},
-			StdOut:      logWriter,
-			AllocatePTY: rc.Config.AllocatePTY,
+			StdOut: logWriter,
 		}
 		rc.cleanUpJobContainer = rc.JobContainer.Remove()
-		for k, v := range rc.getRunnerContext(ctx) {
+		for k, v := range rc.JobContainer.GetRunnerContext(ctx) {
 			if v, ok := v.(string); ok {
 				rc.Env["RUNNER_"+strings.ToUpper(k)] = v
 			}
@@ -326,27 +260,11 @@ func (rc *RunContext) startHostEnvironment() common.Executor {
 	}
 }
 
-// printStartJobContainerGroup mirrors actions/runner's "Starting job container"
-// section: emit the group header and summary, return a closer for ::endgroup::.
-func printStartJobContainerGroup(ctx context.Context, image, name, network string) func() {
-	rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
-	rawLogger.Infof("::group::Starting job container")
-	rawLogger.Infof("image: %s", image)
-	rawLogger.Infof("name: %s", name)
-	rawLogger.Infof("network: %s", network)
-	return func() {
-		rawLogger.Infof("::endgroup::")
-	}
-}
-
-// newContainer is a variable so tests can substitute a container that needs no Docker daemon.
-var newContainer = container.NewContainer
-
 func (rc *RunContext) startJobContainer() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		image := rc.platformImage(ctx)
-		rawLogger := logger.WithField(rawOutputField, true)
+		rawLogger := logger.WithField("raw_output", true)
 		logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
 			if rc.Config.LogOutput {
 				rawLogger.Infof("%s", s)
@@ -361,6 +279,7 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			return fmt.Errorf("failed to handle credentials: %s", err)
 		}
 
+		logger.Infof("\U0001f680  Start image=%s", image)
 		name := rc.jobContainerName()
 		// For gitea, to support --volumes-from <container_name_or_id> in options.
 		// We need to set the container name to the environment variable.
@@ -384,13 +303,6 @@ func (rc *RunContext) startJobContainer() common.Executor {
 
 		// add service containers
 		for serviceID, spec := range rc.Run.Job().Services {
-			// GitHub compatibility: skip services whose image evaluates to an
-			// empty string, enabling conditional services via expressions
-			serviceImage := rc.ExprEval.Interpolate(ctx, spec.Image)
-			if serviceImage == "" {
-				logger.Infof("The service '%s' will not be started because the container definition has an empty image.", serviceID)
-				continue
-			}
 			// interpolate env
 			interpolatedEnvs := make(map[string]string, len(spec.Env))
 			for k, v := range spec.Env {
@@ -405,9 +317,7 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			for _, v := range spec.Cmd {
 				interpolatedCmd = append(interpolatedCmd, rc.ExprEval.Interpolate(ctx, v))
 			}
-			// keep these local: reusing username/password would overwrite the
-			// credentials the job container is pulled with further down
-			serviceUsername, servicePassword, err := rc.handleServiceCredentials(ctx, spec.Credentials)
+			username, password, err = rc.handleServiceCredentials(ctx, spec.Credentials)
 			if err != nil {
 				return fmt.Errorf("failed to handle service %s credentials: %w", serviceID, err)
 			}
@@ -428,12 +338,12 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			}
 
 			serviceContainerName := createContainerName(rc.jobContainerName(), serviceID)
-			c := newContainer(&container.NewContainerInput{
+			c := container.NewContainer(&container.NewContainerInput{
 				Name:           serviceContainerName,
 				WorkingDir:     ext.ToContainerPath(rc.Config.Workdir),
-				Image:          serviceImage,
-				Username:       serviceUsername,
-				Password:       servicePassword,
+				Image:          rc.ExprEval.Interpolate(ctx, spec.Image),
+				Username:       username,
+				Password:       password,
 				Cmd:            interpolatedCmd,
 				Env:            envs,
 				Mounts:         serviceMounts,
@@ -449,17 +359,46 @@ func (rc *RunContext) startJobContainer() common.Executor {
 				NetworkAliases: []string{serviceID},
 				ExposedPorts:   exposedPorts,
 				PortBindings:   portBindings,
-				AllocatePTY:    rc.Config.AllocatePTY,
 			})
 			rc.ServiceContainers = append(rc.ServiceContainers, c)
 		}
 
-		rc.cleanUpJobContainer = rc.cleanupJobResources(networkName, createAndDeleteNetwork)
+		rc.cleanUpJobContainer = func(ctx context.Context) error {
+			reuseJobContainer := func(ctx context.Context) bool {
+				return rc.Config.ReuseContainers
+			}
+
+			if rc.JobContainer != nil {
+				return rc.JobContainer.Remove().IfNot(reuseJobContainer).
+					Then(container.NewDockerVolumeRemoveExecutor(rc.jobContainerName(), false)).IfNot(reuseJobContainer).
+					Then(container.NewDockerVolumeRemoveExecutor(rc.jobContainerName()+"-env", false)).IfNot(reuseJobContainer).
+					Then(func(ctx context.Context) error {
+						if len(rc.ServiceContainers) > 0 {
+							logger.Infof("Cleaning up services for job %s", rc.JobName)
+							if err := rc.stopServiceContainers()(ctx); err != nil {
+								logger.Errorf("Error while cleaning services: %v", err)
+							}
+						}
+						if createAndDeleteNetwork {
+							// clean network if it has been created by act
+							// if using service containers
+							// it means that the network to which containers are connecting is created by `runner`,
+							// so, we should remove the network at last.
+							logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, networkName)
+							if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil {
+								logger.Errorf("Error while cleaning network: %v", err)
+							}
+						}
+						return nil
+					})(ctx)
+			}
+			return nil
+		}
 
 		// For Gitea, `jobContainerNetwork` should be the same as `networkName`
 		jobContainerNetwork := networkName
 
-		rc.JobContainer = newContainer(&container.NewContainerInput{
+		rc.JobContainer = container.NewContainer(&container.NewContainerInput{
 			Cmd:            nil,
 			Entrypoint:     []string{"/bin/sleep", fmt.Sprint(rc.Config.ContainerMaxLifetime.Round(time.Second).Seconds())},
 			WorkingDir:     ext.ToContainerPath(rc.Config.Workdir),
@@ -479,20 +418,17 @@ func (rc *RunContext) startJobContainer() common.Executor {
 			Platform:       rc.Config.ContainerArchitecture,
 			Options:        rc.options(ctx),
 			AutoRemove:     rc.Config.AutoRemove,
-			ValidVolumes:   rc.validVolumes(),
-			AllocatePTY:    rc.Config.AllocatePTY,
+			ValidVolumes:   rc.Config.ValidVolumes,
 		})
 		if rc.JobContainer == nil {
 			return errors.New("Failed to create job container")
 		}
 
-		defer printStartJobContainerGroup(ctx, image, name, networkName)()
 		return common.NewPipelineExecutor(
 			rc.pullServicesImages(rc.Config.ForcePull),
 			rc.JobContainer.Pull(rc.Config.ForcePull),
 			rc.stopJobContainer(),
-			container.NewDockerNetworkCreateExecutor(networkName, rc.Config.ContainerNetworkCreateOptions).
-				IfBool(createAndDeleteNetwork),
+			container.NewDockerNetworkCreateExecutor(networkName).IfBool(createAndDeleteNetwork),
 			rc.startServiceContainers(networkName),
 			rc.JobContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
 			rc.JobContainer.Start(false),
@@ -509,41 +445,6 @@ func (rc *RunContext) startJobContainer() common.Executor {
 	}
 }
 
-// cleanupJobResources removes everything the job created, continuing past failures.
-// Only job container and volume errors are returned, the rest are logged.
-func (rc *RunContext) cleanupJobResources(networkName string, createAndDeleteNetwork bool) common.Executor {
-	return func(ctx context.Context) error {
-		logger := common.Logger(ctx)
-		removeJobContainer := rc.JobContainer != nil && !rc.Config.ReuseContainers
-
-		var errs []error
-		if removeJobContainer {
-			errs = append(errs, rc.JobContainer.Remove()(ctx))
-		}
-		if len(rc.ServiceContainers) > 0 {
-			logger.Infof("Cleaning up services for job %s", rc.JobName)
-			if err := rc.stopServiceContainers()(ctx); err != nil {
-				logger.Errorf("Error while cleaning services: %v", err)
-			}
-		}
-		if removeJobContainer {
-			// after the containers using them, services can hold these via `--volumes-from`
-			name := rc.jobContainerName()
-			errs = append(errs,
-				container.NewDockerVolumeRemoveExecutor(name, false)(ctx),
-				container.NewDockerVolumeRemoveExecutor(name+"-env", false)(ctx))
-		}
-		if createAndDeleteNetwork {
-			// last, once every container has detached
-			logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, networkName)
-			if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil {
-				logger.Errorf("Error while cleaning network: %v", err)
-			}
-		}
-		return errors.Join(errs...)
-	}
-}
-
 func (rc *RunContext) execJobContainer(cmd []string, env map[string]string, user, workdir string) common.Executor { //nolint:unparam // pre-existing issue from nektos/act
 	return func(ctx context.Context) error {
 		return rc.JobContainer.Exec(cmd, env, user, workdir)(ctx)
@@ -669,29 +570,14 @@ func (rc *RunContext) ActionCacheDir() string {
 }
 
 // Interpolate outputs after a job is done
-// jobMutexes serializes per-job result/output aggregation across the matrix combinations that
-// share one *model.Job and run in parallel. Keyed by the shared *model.Job (mirrors the
-// per-directory AcquireCloneLock pattern).
-var jobMutexes sync.Map // key: *model.Job; value: *sync.Mutex
-
-func lockJob(job *model.Job) func() {
-	v, _ := jobMutexes.LoadOrStore(job, &sync.Mutex{})
-	mu := v.(*sync.Mutex)
-	mu.Lock()
-	return mu.Unlock
-}
-
 func (rc *RunContext) interpolateOutputs() common.Executor {
 	return func(ctx context.Context) error {
 		ee := rc.NewExpressionEvaluator(ctx)
-		job := rc.Run.Job()
-		// Matrix combinations share this Job and its Outputs map. Interpolate from this combo's
-		// pristine snapshot (outputTemplate) and write under the lock, so each combo overwrites
-		// with its own resolved values (last wins, as on GitHub) instead of the first combo's
-		// resolved values freezing the shared template against later combos.
-		defer lockJob(job)()
-		for k, v := range rc.outputTemplate {
-			job.Outputs[k] = ee.Interpolate(ctx, v)
+		for k, v := range rc.Run.Job().Outputs {
+			interpolated := ee.Interpolate(ctx, v)
+			if v != interpolated {
+				rc.Run.Job().Outputs[k] = interpolated
+			}
 		}
 		return nil
 	}
@@ -699,34 +585,10 @@ func (rc *RunContext) interpolateOutputs() common.Executor {
 
 func (rc *RunContext) startContainer() common.Executor {
 	return func(ctx context.Context) error {
-		var err error
 		if rc.IsHostEnv(ctx) {
-			err = rc.startHostEnvironment()(ctx)
-		} else {
-			err = rc.startJobContainer()(ctx)
+			return rc.startHostEnvironment()(ctx)
 		}
-		if err != nil {
-			// The job executor's teardown only runs after a successful start, so a failed
-			// start would otherwise leak the per-job network and container.
-			rc.cleanupFailedStart(ctx)
-		}
-		return err
-	}
-}
-
-func (rc *RunContext) cleanupFailedStart(ctx context.Context) {
-	if rc.cleanUpJobContainer == nil {
-		return
-	}
-	cleanCtx := ctx
-	if ctx.Err() != nil {
-		// the start likely failed because ctx was cancelled, detach so teardown still runs
-		var cancel context.CancelFunc
-		cleanCtx, cancel = context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
-		defer cancel()
-	}
-	if err := rc.cleanUpJobContainer(cleanCtx); err != nil {
-		common.Logger(ctx).Errorf("Error while cleaning up after failed container start for job %s: %v", rc.JobName, err)
+		return rc.startJobContainer()(ctx)
 	}
 }
 
@@ -758,29 +620,7 @@ func (rc *RunContext) result(result string) {
 }
 
 func (rc *RunContext) steps() []*model.Step {
-	// Return per-job copies of the steps. Matrix combinations run in parallel and share the
-	// workflow model, but step execution mutates per-job fields and evaluates the If/Env nodes
-	// in place, so the *model.Step instances must not be shared across jobs (see Step.Clone).
-	shared := rc.Run.Job().Steps
-	steps := make([]*model.Step, len(shared))
-	for i, step := range shared {
-		if step == nil {
-			continue
-		}
-		steps[i] = step.Clone()
-	}
-	return steps
-}
-
-// topLevelRunContext walks the Parent chain to the outermost RunContext. Composite
-// actions create child RunContexts whose sub-steps need to share the outer job step's
-// summary file path so that nested writes accumulate under the right step_index.
-func (rc *RunContext) topLevelRunContext() *RunContext {
-	top := rc
-	for top.Parent != nil {
-		top = top.Parent
-	}
-	return top
+	return rc.Run.Job().Steps
 }
 
 // Executor returns a pipeline executor for all the steps in the job
@@ -802,13 +642,7 @@ func (rc *RunContext) Executor() (common.Executor, error) {
 	return func(ctx context.Context) error {
 		res, err := rc.isEnabled(ctx)
 		if err != nil {
-			// Record the failure so a job whose if-expression fails to evaluate
-			// gets a result (and therefore a stop time) instead of being left
-			// unfinished. rc.caller is only set for reusable workflows.
-			rc.result("failure")
-			if rc.caller != nil { // For Gitea
-				rc.caller.setReusedWorkflowJobResult(rc.JobName, "failure")
-			}
+			rc.caller.setReusedWorkflowJobResult(rc.JobName, "failure") // For Gitea
 			return err
 		}
 		if res {
@@ -863,15 +697,12 @@ func (rc *RunContext) runsOnPlatformNames(ctx context.Context) []string {
 		return []string{}
 	}
 
-	// Evaluate a copy: RawRunsOn is shared across parallel matrix jobs, so interpolating it in
-	// place would race and leak one matrix combination's runs-on into the others.
-	rawRunsOn := model.CloneYamlNode(job.RawRunsOn)
-	if err := rc.ExprEval.EvaluateYamlNode(ctx, &rawRunsOn); err != nil {
+	if err := rc.ExprEval.EvaluateYamlNode(ctx, &job.RawRunsOn); err != nil {
 		common.Logger(ctx).Errorf("Error while evaluating runs-on: %v", err)
 		return []string{}
 	}
 
-	return model.RunsOnFromNode(rawRunsOn)
+	return job.RunsOn()
 }
 
 func (rc *RunContext) platformImage(ctx context.Context) string {
@@ -922,7 +753,7 @@ func (rc *RunContext) isEnabled(ctx context.Context) (bool, error) {
 	img := rc.platformImage(ctx)
 	if img == "" {
 		for _, platformName := range rc.runsOnPlatformNames(ctx) {
-			l.Infof("Skipping unsupported platform -- Try running with `-P %+v=...`", platformName)
+			l.Infof("\U0001F6A7  Skipping unsupported platform -- Try running with `-P %+v=...`", platformName)
 		}
 		return false, nil
 	}
@@ -962,21 +793,12 @@ func trimToLen(s string, l int) string {
 
 func (rc *RunContext) getJobContext() *model.JobContext {
 	jobStatus := "success"
-	if rc.jobFailed {
-		jobStatus = "failure"
-	}
 	for _, stepStatus := range rc.StepResults {
 		if stepStatus.Conclusion == model.StepStatusFailure {
 			jobStatus = "failure"
 			break
 		}
 	}
-	// A cancelled run takes precedence over success/failure so cancelled() is true and
-	// success()/failure() are false, matching GitHub Actions: on cancellation only
-	// always() and cancelled() steps run.
-	if rc.jobCancelled {
-		jobStatus = "cancelled"
-	}
 	return &model.JobContext{
 		Status: jobStatus,
 	}
@@ -986,21 +808,6 @@ func (rc *RunContext) getStepsContext() map[string]*model.StepResult {
 	return rc.StepResults
 }
 
-// getRunnerContext returns the `runner` context: what the execution environment knows
-// (os, arch, temp, tool_cache) plus what only the runner process knows.
-func (rc *RunContext) getRunnerContext(ctx context.Context) map[string]any {
-	runnerContext := map[string]any{}
-	if rc.JobContainer != nil {
-		maps0.Copy(runnerContext, rc.JobContainer.GetRunnerContext(ctx))
-	}
-	runnerContext["name"] = rc.Config.RunnerName
-	runnerContext["environment"] = "self-hosted"
-	if rc.Config.RunnerDebug() {
-		runnerContext["debug"] = "1"
-	}
-	return runnerContext
-}
-
 func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext {
 	logger := common.Logger(ctx)
 	ghc := &model.GithubContext{
@@ -1185,7 +992,7 @@ func nestedMapLookup(m map[string]any, ks ...string) (rval any) {
 	}
 }
 
-func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubContext, env map[string]string) {
+func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubContext, env map[string]string) map[string]string { //nolint:unparam // pre-existing issue from nektos/act
 	env["CI"] = "true"
 	env["GITHUB_WORKFLOW"] = github.Workflow
 	env["GITHUB_RUN_ID"] = github.RunID
@@ -1227,71 +1034,23 @@ func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubCon
 		env["GITHUB_RUN_ATTEMPT"] = github.RunAttempt
 	}
 
-	env["RUNNER_NAME"] = rc.Config.RunnerName
-	env["RUNNER_ENVIRONMENT"] = "self-hosted"
-	if workspace := parentDir(github.Workspace); workspace != "" {
-		env["RUNNER_WORKSPACE"] = workspace
-	}
-	if rc.Config.RunnerDebug() {
-		env["RUNNER_DEBUG"] = "1"
-	}
-
 	if rc.Config.ArtifactServerPath != "" {
 		setActionRuntimeVars(rc, env)
 	}
 
-	if imageOS := rc.imageOS(ctx); imageOS != "" {
-		env["ImageOS"] = imageOS
-	}
-}
-
-// parentDir returns the directory containing p, or "" when p names no parent. Both
-// separators are accepted rather than filepath's, as p may describe a container while
-// the runner itself runs on Windows, or the other way round.
-func parentDir(p string) string {
-	if slash := strings.LastIndexAny(p, `/\`); slash > 0 {
-		return p[:slash]
-	}
-	return ""
-}
-
-// imageOS returns ImageOS, which setup-* actions use to tell one runner image release
-// from another. The resolved image tag is preferred over the runs-on label because it
-// still names a release when the label is a rolling one such as ubuntu-latest.
-func (rc *RunContext) imageOS(ctx context.Context) string {
-	if rc.Run.Job().RunsOn() == nil {
-		// A composite action runs on a synthetic job, and resolving its image would only
-		// log that runs-on is missing.
-		return ""
-	}
-	if imageOS := imageOSFromImage(rc.platformImage(ctx)); imageOS != "" {
-		return imageOS
-	}
-
-	for _, platformName := range slices.Backward(rc.runsOnPlatformNames(ctx)) {
-		if platformName == "ubuntu-latest" {
-			// Rolling label whose image names no release either, so keep the historical value.
-			return "ubuntu20"
-		} else if platformName != "" {
-			return strings.SplitN(strings.Replace(platformName, `-`, ``, 1), `.`, 2)[0]
+	for _, platformName := range rc.runsOnPlatformNames(ctx) {
+		if platformName != "" {
+			if platformName == "ubuntu-latest" {
+				// hardcode current ubuntu-latest since we have no way to check that 'on the fly'
+				env["ImageOS"] = "ubuntu20"
+			} else {
+				platformName = strings.SplitN(strings.Replace(platformName, `-`, ``, 1), `.`, 2)[0]
+				env["ImageOS"] = platformName
+			}
 		}
 	}
-	return ""
-}
 
-// imageOSTag matches an image reference tagged with an OS family ImageOS can report plus
-// its release, such as "docker.gitea.com/runner-images:ubuntu-24.04". Anything else
-// ("ubuntu-latest", "app:22.04", "catthehacker/ubuntu:act-22.04", or a registry port) is
-// left to the runs-on label rather than turned into a bogus OS.
-var imageOSTag = regexp.MustCompile(`:(ubuntu|win|macos)-?([0-9]+)[^/]*$`)
-
-// imageOSFromImage derives ImageOS from an image reference, e.g.
-// "docker.gitea.com/runner-images:ubuntu-24.04" yields "ubuntu24".
-func imageOSFromImage(image string) string {
-	if match := imageOSTag.FindStringSubmatch(image); match != nil {
-		return match[1] + match[2]
-	}
-	return ""
+	return env
 }
 
 func setActionRuntimeVars(rc *RunContext, env map[string]string) {
@@ -1309,18 +1068,21 @@ func setActionRuntimeVars(rc *RunContext, env map[string]string) {
 }
 
 func (rc *RunContext) handleCredentials(ctx context.Context) (string, string, error) {
+	// TODO: remove below 2 lines when we can release act with breaking changes
+	username := rc.Config.Secrets["DOCKER_USERNAME"]
+	password := rc.Config.Secrets["DOCKER_PASSWORD"]
+
 	container := rc.Run.Job().Container()
 	if container == nil || container.Credentials == nil {
-		return "", "", nil
+		return username, password, nil
 	}
 
-	if len(container.Credentials) != 2 {
+	if container.Credentials != nil && len(container.Credentials) != 2 {
 		err := errors.New("invalid property count for key 'credentials:'")
 		return "", "", err
 	}
 
 	ee := rc.NewExpressionEvaluator(ctx)
-	var username, password string
 	if username = ee.Interpolate(ctx, container.Credentials["username"]); username == "" {
 		err := errors.New("failed to interpolate container.credentials.username")
 		return "", "", err
@@ -1363,9 +1125,12 @@ func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[st
 
 // GetServiceBindsAndMounts returns the binds and mounts for the service container, resolving paths as appopriate
 func (rc *RunContext) GetServiceBindsAndMounts(svcVolumes []string) ([]string, map[string]string) {
+	if rc.Config.ContainerDaemonSocket == "" {
+		rc.Config.ContainerDaemonSocket = "/var/run/docker.sock"
+	}
 	binds := []string{}
-	if daemonSocket := rc.containerDaemonSocket(); daemonSocket != "-" {
-		daemonPath := getDockerDaemonSocketMountPath(daemonSocket)
+	if rc.Config.ContainerDaemonSocket != "-" {
+		daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)
 		binds = append(binds, fmt.Sprintf("%s:%s", daemonPath, "/var/run/docker.sock"))
 	}
 

act/runner/run_context_test.go

@@ -5,23 +5,18 @@
 package runner
 
 import (
-	"bytes"
 	"context"
-	"errors"
 	"fmt"
 	"os"
 	"runtime"
 	"strings"
 	"testing"
 
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
 
 	log "github.com/sirupsen/logrus"
 	assert "github.com/stretchr/testify/assert"
-	require "github.com/stretchr/testify/require"
 	yaml "go.yaml.in/yaml/v4"
 )
 
@@ -172,125 +167,6 @@ func TestRunContext_EvalBool(t *testing.T) {
 	}
 }
 
-func TestRunContextHandleCredentialsDoesNotUseDockerSecrets(t *testing.T) {
-	workflow, err := model.ReadWorkflow(strings.NewReader(`
-name: test
-on: push
-jobs:
-  job:
-    runs-on: ubuntu-latest
-    steps: []
-`))
-	require.NoError(t, err)
-
-	rc := &RunContext{
-		Config: &Config{
-			Secrets: map[string]string{
-				"DOCKER_USERNAME": "docker-user",
-				"DOCKER_PASSWORD": "docker-password",
-			},
-			Env: map[string]string{},
-		},
-		Run: &model.Run{
-			JobID:    "job",
-			Workflow: workflow,
-		},
-	}
-
-	// DOCKER_USERNAME/DOCKER_PASSWORD secrets should not be used as implicit job container pull credentials.
-	username, password, err := rc.handleCredentials(t.Context())
-	require.NoError(t, err)
-	assert.Empty(t, username)
-	assert.Empty(t, password)
-}
-
-// fakeContainer turns every container operation into a no-op, so startJobContainer
-// runs without a Docker daemon. The embedded interface is nil, so any method the
-// test does not exercise panics rather than silently doing the wrong thing.
-type fakeContainer struct {
-	container.ExecutionsEnvironment
-}
-
-func (fakeContainer) Pull(bool) common.Executor  { return func(context.Context) error { return nil } }
-func (fakeContainer) Start(bool) common.Executor { return func(context.Context) error { return nil } }
-func (fakeContainer) Remove() common.Executor    { return func(context.Context) error { return nil } }
-func (fakeContainer) Close() common.Executor     { return func(context.Context) error { return nil } }
-func (fakeContainer) GetActPath() string         { return "/var/run/act" }
-func (fakeContainer) Create([]string, []string) common.Executor {
-	return func(context.Context) error { return nil }
-}
-
-func (fakeContainer) Copy(string, ...*container.FileEntry) common.Executor {
-	return func(context.Context) error { return nil }
-}
-
-// Regression test: a service without a `credentials:` block resolves to empty
-// credentials, which used to overwrite the job container's own credentials.
-func TestStartJobContainerKeepsJobCredentialsWithServices(t *testing.T) {
-	workflow, err := model.ReadWorkflow(strings.NewReader(`
-name: test
-on: push
-jobs:
-  job:
-    runs-on: ubuntu-latest
-    container:
-      image: registry.example/private:latest
-      credentials:
-        username: job-user
-        password: job-password
-    services:
-      redis:
-        image: redis:latest
-      db:
-        image: postgres:latest
-        credentials:
-          username: db-user
-          password: db-password
-    steps: []
-`))
-	require.NoError(t, err)
-
-	var inputs []*container.NewContainerInput
-	origNewContainer := newContainer
-	newContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-		inputs = append(inputs, input)
-		return fakeContainer{}
-	}
-	t.Cleanup(func() { newContainer = origNewContainer })
-
-	rc := &RunContext{
-		Name: "test",
-		Config: &Config{
-			Workdir: "/tmp",
-			// no daemon: an explicit network mode creates no network, and
-			// reusing containers short-circuits the volume cleanup executors
-			ContainerNetworkMode: "host",
-			ReuseContainers:      true,
-			Env:                  map[string]string{},
-			Secrets:              map[string]string{},
-		},
-		Env: map[string]string{},
-		Run: &model.Run{
-			JobID:    "job",
-			Workflow: workflow,
-		},
-	}
-	rc.ExprEval = rc.NewExpressionEvaluator(t.Context())
-
-	require.NoError(t, rc.startJobContainer()(t.Context()))
-
-	credentials := map[string][2]string{}
-	for _, in := range inputs {
-		credentials[in.Image] = [2]string{in.Username, in.Password}
-	}
-
-	// the job container keeps its own credentials, whichever services exist
-	require.Equal(t, [2]string{"job-user", "job-password"}, credentials["registry.example/private:latest"])
-	// each service keeps its own, and a service without credentials gets none
-	require.Equal(t, [2]string{"db-user", "db-password"}, credentials["postgres:latest"])
-	require.Equal(t, [2]string{"", ""}, credentials["redis:latest"])
-}
-
 func TestRunContext_GetBindsAndMounts(t *testing.T) {
 	rctemplate := &RunContext{
 		Name: "TestRCName",
@@ -365,37 +241,6 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 			{"MountExistingVolume", []string{"volume-id:/volume"}, "", map[string]string{"volume-id": "/volume"}},
 		}
 
-		t.Run("InterpolatedContainerVolumes", func(t *testing.T) {
-			job := &model.Job{}
-			err := job.RawContainer.Encode(map[string][]string{
-				"volumes": {"${{ secrets.MAME }}:/root/.mame/roms:ro"},
-			})
-			require.NoError(t, err)
-
-			rc := &RunContext{
-				Name: "TestRCName",
-				Run: &model.Run{
-					Workflow: &model.Workflow{
-						Name: "TestWorkflowName",
-					},
-				},
-				Config: &Config{
-					BindWorkdir: false,
-					Secrets: map[string]string{
-						"MAME": "/host/mame/roms",
-					},
-				},
-			}
-			rc.Run.JobID = "job1"
-			rc.Run.Workflow.Jobs = map[string]*model.Job{"job1": job}
-			rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
-
-			gotbind, gotmount := rc.GetBindsAndMounts()
-			assert.Contains(t, gotbind, "/host/mame/roms:/root/.mame/roms:ro")
-			assert.NotContains(t, gotbind, "${{ secrets.MAME }}")
-			assert.NotContains(t, gotmount, "${{ secrets.MAME }}")
-		})
-
 		for _, testcase := range tests {
 			t.Run(testcase.name, func(t *testing.T) {
 				job := &model.Job{}
@@ -433,84 +278,6 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 	})
 }
 
-func TestRunContextValidVolumes(t *testing.T) {
-	rc := &RunContext{
-		Name:   "job",
-		Run:    &model.Run{Workflow: &model.Workflow{Name: "wf"}},
-		Config: &Config{ValidVolumes: []string{"my-vol", "/host/path"}},
-	}
-	name := rc.jobContainerName()
-
-	got := rc.validVolumes()
-
-	// the configured volumes plus the four the runner mounts automatically
-	assert.Subset(t, got, []string{"my-vol", "/host/path", "act-toolcache", name, name + "-env", "/var/run/docker.sock"})
-
-	// deriving the list must never mutate or grow the shared Config slice: parallel matrix
-	// combinations share one *Config, and the previous in-place append was a data race.
-	assert.Equal(t, []string{"my-vol", "/host/path"}, rc.Config.ValidVolumes)
-	assert.Len(t, rc.validVolumes(), len(got), "repeated calls must be stable, not accumulate")
-}
-
-func TestCleanupJobResourcesCleansServicesWithoutJobContainer(t *testing.T) {
-	service := &containerMock{}
-	service.On("Remove").Return(func(context.Context) error { return nil }).Once()
-	service.On("Close").Return(func(context.Context) error { return nil }).Once()
-
-	rc := &RunContext{
-		Config:            &Config{},
-		ServiceContainers: []container.ExecutionsEnvironment{service},
-	}
-
-	err := rc.cleanupJobResources("external-network", false)(context.Background())
-	require.NoError(t, err)
-	service.AssertExpectations(t)
-}
-
-// cleanup used to bail out on a previous step's error and on a cancelled context
-func TestCleanupJobResourcesContinuesAfterFailure(t *testing.T) {
-	t.Setenv("DOCKER_HOST", "unix:///nonexistent.sock")
-
-	jobContainer := &containerMock{}
-	jobContainer.On("Remove").Return(func(context.Context) error { return errors.New("removal failed") }).Once()
-	service := &containerMock{}
-	service.On("Remove").Return(func(context.Context) error { return nil }).Once()
-	service.On("Close").Return(func(context.Context) error { return nil }).Once()
-
-	rc := &RunContext{
-		Name:              "job",
-		Config:            &Config{},
-		Run:               &model.Run{Workflow: &model.Workflow{Name: "wf"}, JobID: "job"},
-		JobContainer:      jobContainer,
-		ServiceContainers: []container.ExecutionsEnvironment{service},
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	require.Error(t, rc.cleanupJobResources("job-network", true)(ctx))
-	jobContainer.AssertExpectations(t)
-	service.AssertExpectations(t)
-}
-
-// TestInterpolateOutputsIsPerMatrixCombo guards the matrix-output fix: combinations share one
-// *model.Job, so each must interpolate from its own pristine snapshot. Otherwise the first
-// combo's resolved value freezes the shared template and later combos can't resolve their own.
-func TestInterpolateOutputsIsPerMatrixCombo(t *testing.T) {
-	job := &model.Job{Outputs: map[string]string{"o": "${{ matrix.v }}"}}
-	run := &model.Run{JobID: "j", Workflow: &model.Workflow{Name: "w", Jobs: map[string]*model.Job{"j": job}}}
-	r := &runnerImpl{config: &Config{}}
-	ctx := context.Background()
-
-	rcA := r.newRunContext(ctx, run, map[string]any{"v": "a"})
-	rcB := r.newRunContext(ctx, run, map[string]any{"v": "b"})
-
-	require.NoError(t, rcA.interpolateOutputs()(ctx))
-	require.NoError(t, rcB.interpolateOutputs()(ctx))
-
-	// Last combo wins (matching GitHub) instead of being frozen to combo A's "a".
-	require.Equal(t, "b", job.Outputs["o"])
-}
-
 func TestGetGitHubContext(t *testing.T) {
 	log.SetLevel(log.DebugLevel)
 
@@ -868,189 +635,3 @@ func TestCreateContainerNameBoundedForLongMatrixInput(t *testing.T) {
 	assert.LessOrEqual(t, len(name+"-network"), 255)
 	assert.LessOrEqual(t, len(name+"-job1234567890"), 255)
 }
-
-func TestPrintStartJobContainerGroupGolden(t *testing.T) {
-	buf := &bytes.Buffer{}
-	logger := log.New()
-	logger.SetOutput(buf)
-	logger.SetLevel(log.InfoLevel)
-	logger.SetFormatter(&jobLogFormatter{color: cyan})
-	entry := logger.WithFields(log.Fields{"job": "j1"})
-	ctx := common.WithLogger(context.Background(), entry)
-
-	printStartJobContainerGroup(ctx, "node:20", "GITEA-WORKFLOW-build-JOB-test", "gitea-runner-network")()
-
-	want := strings.Join([]string{
-		"[j1]   | ::group::Starting job container",
-		"[j1]   | image: node:20",
-		"[j1]   | name: GITEA-WORKFLOW-build-JOB-test",
-		"[j1]   | network: gitea-runner-network",
-		"[j1]   | ::endgroup::",
-		"",
-	}, "\n")
-	assert.Equal(t, want, buf.String())
-}
-
-func TestRunContext_cleanupFailedStart(t *testing.T) {
-	type ctxKey string
-	const sentinel = ctxKey("sentinel")
-
-	// the fresh context is cancelled via defer on return, so capture state inside the stub
-	type capture struct {
-		calls    int
-		err      error
-		sentinel any
-	}
-	newRC := func(c *capture) *RunContext {
-		return &RunContext{
-			JobName: "job",
-			cleanUpJobContainer: func(ctx context.Context) error {
-				c.calls++
-				c.err = ctx.Err()
-				c.sentinel = ctx.Value(sentinel)
-				return nil
-			},
-		}
-	}
-
-	t.Run("runs teardown on the live context", func(t *testing.T) {
-		var c capture
-		ctx := context.WithValue(context.Background(), sentinel, "v")
-
-		newRC(&c).cleanupFailedStart(ctx)
-
-		assert.Equal(t, 1, c.calls)
-		require.NoError(t, c.err)
-		assert.Equal(t, "v", c.sentinel)
-	})
-
-	t.Run("falls back to a fresh context when the input is done", func(t *testing.T) {
-		var c capture
-		ctx, cancel := context.WithCancel(context.WithValue(context.Background(), sentinel, "v"))
-		cancel()
-
-		newRC(&c).cleanupFailedStart(ctx)
-
-		assert.Equal(t, 1, c.calls)
-		require.NoError(t, c.err)
-		assert.Nil(t, c.sentinel)
-	})
-
-	t.Run("no-op when there is nothing to clean up", func(t *testing.T) {
-		assert.NotPanics(t, func() { (&RunContext{}).cleanupFailedStart(context.Background()) })
-	})
-}
-
-func TestImageOSFromImage(t *testing.T) {
-	for _, tc := range []struct {
-		image string
-		want  string
-	}{
-		{"", ""},
-		{"docker.gitea.com/runner-images:ubuntu-24.04", "ubuntu24"},
-		{"docker.gitea.com/runner-images:ubuntu-latest", ""},
-		{"runner-images:ubuntu22.04", "ubuntu22"},
-		{"node:20", ""},
-		{"ubuntu:22.04", ""},
-		{"ubuntu", ""},
-		{"catthehacker/ubuntu:act-22.04", ""},
-		{"myco/ubuntu:v2.1", ""},
-		{"myco/ubuntu:v22.04", ""},
-		{"app:release-1", ""},
-		{"app:1.2.3", ""},
-		{"app:build-2.1", ""},
-		{"registry.example.com:5000/runner-images", ""},
-		{"registry.example.com:5000/runner-images:ubuntu-24.04", "ubuntu24"},
-	} {
-		t.Run(tc.image, func(t *testing.T) {
-			assert.Equal(t, tc.want, imageOSFromImage(tc.image))
-		})
-	}
-}
-
-func createRunsOnRunContext(t *testing.T, runsOn string) *RunContext {
-	return createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, "runs-on: "+runsOn, ""),
-	})
-}
-
-func TestRunContextImageOS(t *testing.T) {
-	ctx := context.Background()
-
-	t.Run("prefers the release in the resolved image tag", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.Config.Platforms = map[string]string{
-			"ubuntu-latest": "docker.gitea.com/runner-images:ubuntu-24.04",
-		}
-		assert.Equal(t, "ubuntu24", rc.imageOS(ctx))
-	})
-
-	t.Run("falls back to the runs-on label", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-22.04")
-		rc.Config.Platforms = map[string]string{"ubuntu-22.04": "some-image"}
-		assert.Equal(t, "ubuntu22", rc.imageOS(ctx))
-	})
-
-	t.Run("keeps the historical value for a rolling label with no release", func(t *testing.T) {
-		assert.Equal(t, "ubuntu20", createRunsOnRunContext(t, "ubuntu-latest").imageOS(ctx))
-	})
-
-	t.Run("is empty for the synthetic job of a composite action", func(t *testing.T) {
-		rc := createIfTestRunContext(map[string]*model.Job{"job1": {}})
-		assert.Empty(t, rc.imageOS(ctx))
-	})
-}
-
-func TestRunContextGetRunnerContext(t *testing.T) {
-	ctx := context.Background()
-
-	t.Run("adds the runner values the container cannot know", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.Config.RunnerName = "runner-1"
-
-		runnerContext := rc.getRunnerContext(ctx)
-		assert.Equal(t, "runner-1", runnerContext["name"])
-		assert.Equal(t, "self-hosted", runnerContext["environment"])
-		assert.NotContains(t, runnerContext, "debug")
-	})
-
-	t.Run("reports debug when step debugging is on", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.Config.Secrets = map[string]string{"ACTIONS_STEP_DEBUG": "true"}
-
-		assert.Equal(t, "1", rc.getRunnerContext(ctx)["debug"])
-	})
-
-	t.Run("keeps the execution environment values", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.JobContainer = &container.HostEnvironment{TmpDir: "/tmp/act", ToolCache: "/tmp/tool_cache"}
-
-		runnerContext := rc.getRunnerContext(ctx)
-		assert.Equal(t, "/tmp/act", runnerContext["temp"])
-		assert.Equal(t, "/tmp/tool_cache", runnerContext["tool_cache"])
-		assert.NotEmpty(t, runnerContext["os"])
-	})
-}
-
-func TestParentDir(t *testing.T) {
-	assert.Empty(t, parentDir(""))
-	assert.Empty(t, parentDir("repo"))
-	assert.Empty(t, parentDir("/repo"))
-	assert.Equal(t, "/workspace/owner", parentDir("/workspace/owner/repo"))
-	assert.Equal(t, `C:\workspace\owner`, parentDir(`C:\workspace\owner\repo`))
-}
-
-func TestRunContextWithGithubEnvRunnerValues(t *testing.T) {
-	ctx := context.Background()
-	rc := createRunsOnRunContext(t, "ubuntu-latest")
-	rc.Config.RunnerName = "runner-1"
-	rc.Config.Secrets = map[string]string{"ACTIONS_STEP_DEBUG": "true"}
-
-	env := map[string]string{}
-	rc.withGithubEnv(ctx, &model.GithubContext{Workspace: "/workspace/owner/repo"}, env)
-
-	assert.Equal(t, "runner-1", env["RUNNER_NAME"])
-	assert.Equal(t, "self-hosted", env["RUNNER_ENVIRONMENT"])
-	assert.Equal(t, "/workspace/owner", env["RUNNER_WORKSPACE"])
-	assert.Equal(t, "1", env["RUNNER_DEBUG"])
-}

act/runner/runner.go

@@ -8,17 +8,15 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"os"
 	"runtime"
 	"sync"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
 	"gitea.com/gitea/runner/act/model"
 
-	docker_container "github.com/moby/moby/api/types/container"
+	docker_container "github.com/docker/docker/api/types/container"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -29,77 +27,58 @@ type Runner interface {
 
 // Config contains the config for a new runner
 type Config struct {
-	Actor                              string                                        // the user that triggered the event
-	Workdir                            string                                        // path to working directory
-	ActionCacheDir                     string                                        // path used for caching action contents
-	ActionOfflineMode                  bool                                          // when offline, use cached action contents
-	ActionCloneDepth                   int                                           // limit history when cloning an action repo; 0 clones every branch in full
-	BindWorkdir                        bool                                          // bind the workdir to the job container
-	EventName                          string                                        // name of event to run
-	EventPath                          string                                        // path to JSON file to use for event.json in containers
-	DefaultBranch                      string                                        // name of the main branch for this repository
-	ReuseContainers                    bool                                          // reuse containers to maintain state
-	ForcePull                          bool                                          // force pulling of the image, even if already present
-	ForceRebuild                       bool                                          // force rebuilding local docker image action
-	LogOutput                          bool                                          // log the output from docker run
-	JSONLogger                         bool                                          // use json or text logger
-	LogPrefixJobID                     bool                                          // switches from the full job name to the job id
-	Env                                map[string]string                             // env for containers
-	Inputs                             map[string]string                             // manually passed action inputs
-	Secrets                            map[string]string                             // list of secrets
-	Vars                               map[string]string                             // list of vars
-	Token                              string                                        // GitHub token
-	InsecureSecrets                    bool                                          // switch hiding output when printing to terminal
-	Platforms                          map[string]string                             // list of platforms
-	Privileged                         bool                                          // use privileged mode
-	UsernsMode                         string                                        // user namespace to use
-	ContainerArchitecture              string                                        // Desired OS/architecture platform for running containers
-	ContainerDaemonSocket              string                                        // Path to Docker daemon socket
-	ContainerOptions                   string                                        // Options for the job container
-	UseGitIgnore                       bool                                          // controls if paths in .gitignore should not be copied into container, default true
-	GitHubInstance                     string                                        // GitHub instance to use, default "github.com"
-	ContainerCapAdd                    []string                                      // list of kernel capabilities to add to the containers
-	ContainerCapDrop                   []string                                      // list of kernel capabilities to remove from the containers
-	AutoRemove                         bool                                          // controls if the container is automatically removed upon workflow completion
-	ArtifactServerPath                 string                                        // the path where the artifact server stores uploads
-	ArtifactServerAddr                 string                                        // the address the artifact server binds to
-	ArtifactServerPort                 string                                        // the port the artifact server binds to
-	NoSkipCheckout                     bool                                          // do not skip actions/checkout
-	DisableActEnv                      bool                                          // do not inject the ACT=true environment variable into jobs
-	RemoteName                         string                                        // remote name in local git repo config
-	ReplaceGheActionWithGithubCom      []string                                      // Use actions from GitHub Enterprise instance to GitHub
-	ReplaceGheActionTokenWithGithubCom string                                        // Token of private action repo on GitHub.
-	Matrix                             map[string]map[string]bool                    // Matrix config to run
-	ContainerNetworkMode               docker_container.NetworkMode                  // the network mode of job containers (the value of --network)
-	ContainerNetworkCreateOptions      container.NewDockerNetworkCreateExecutorInput // the default network create options
-	ActionCache                        ActionCache                                   // Use a custom ActionCache Implementation
+	Actor                              string                       // the user that triggered the event
+	Workdir                            string                       // path to working directory
+	ActionCacheDir                     string                       // path used for caching action contents
+	ActionOfflineMode                  bool                         // when offline, use caching action contents
+	BindWorkdir                        bool                         // bind the workdir to the job container
+	EventName                          string                       // name of event to run
+	EventPath                          string                       // path to JSON file to use for event.json in containers
+	DefaultBranch                      string                       // name of the main branch for this repository
+	ReuseContainers                    bool                         // reuse containers to maintain state
+	ForcePull                          bool                         // force pulling of the image, even if already present
+	ForceRebuild                       bool                         // force rebuilding local docker image action
+	LogOutput                          bool                         // log the output from docker run
+	JSONLogger                         bool                         // use json or text logger
+	LogPrefixJobID                     bool                         // switches from the full job name to the job id
+	Env                                map[string]string            // env for containers
+	Inputs                             map[string]string            // manually passed action inputs
+	Secrets                            map[string]string            // list of secrets
+	Vars                               map[string]string            // list of vars
+	Token                              string                       // GitHub token
+	InsecureSecrets                    bool                         // switch hiding output when printing to terminal
+	Platforms                          map[string]string            // list of platforms
+	Privileged                         bool                         // use privileged mode
+	UsernsMode                         string                       // user namespace to use
+	ContainerArchitecture              string                       // Desired OS/architecture platform for running containers
+	ContainerDaemonSocket              string                       // Path to Docker daemon socket
+	ContainerOptions                   string                       // Options for the job container
+	UseGitIgnore                       bool                         // controls if paths in .gitignore should not be copied into container, default true
+	GitHubInstance                     string                       // GitHub instance to use, default "github.com"
+	ContainerCapAdd                    []string                     // list of kernel capabilities to add to the containers
+	ContainerCapDrop                   []string                     // list of kernel capabilities to remove from the containers
+	AutoRemove                         bool                         // controls if the container is automatically removed upon workflow completion
+	ArtifactServerPath                 string                       // the path where the artifact server stores uploads
+	ArtifactServerAddr                 string                       // the address the artifact server binds to
+	ArtifactServerPort                 string                       // the port the artifact server binds to
+	NoSkipCheckout                     bool                         // do not skip actions/checkout
+	RemoteName                         string                       // remote name in local git repo config
+	ReplaceGheActionWithGithubCom      []string                     // Use actions from GitHub Enterprise instance to GitHub
+	ReplaceGheActionTokenWithGithubCom string                       // Token of private action repo on GitHub.
+	Matrix                             map[string]map[string]bool   // Matrix config to run
+	ContainerNetworkMode               docker_container.NetworkMode // the network mode of job containers (the value of --network)
+	ActionCache                        ActionCache                  // Use a custom ActionCache Implementation
 
-	PresetGitHubContext   *model.GithubContext // the preset github context, overrides some fields like DefaultBranch, Env, Secrets etc.
-	EventJSON             string               // the content of JSON file to use for event.json in containers, overrides EventPath
-	ContainerNamePrefix   string               // the prefix of container name
-	ContainerMaxLifetime  time.Duration        // the max lifetime of job containers
-	CleanWorkdir          bool                 // remove host executor workdir on teardown
-	DefaultActionInstance string               // the default actions web site
-	// DefaultActionInstanceIsSelfHosted reports whether DefaultActionInstance is this
-	// self-hosted Gitea (DEFAULT_ACTIONS_URL=self). It gates token trust: only then may the
-	// task token be attached to action clone URLs on DefaultActionInstance's host, which can
-	// differ from GitHubInstance when the runner registered with a different hostname than
-	// AppURL. It is never set for github.com or a GithubMirror, so the token stays on-instance.
-	DefaultActionInstanceIsSelfHosted bool
-	PlatformPicker                    func(labels []string) string // platform picker, it will take precedence over Platforms if isn't nil
-	JobLoggerLevel                    *log.Level                   // the level of job logger
-	ValidVolumes                      []string                     // only volumes (and bind mounts) in this slice can be mounted on the job container or service containers
-	InsecureSkipTLS                   bool                         // whether to skip verifying TLS certificate of the Gitea instance
-	MaxParallel                       int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
-	AllocatePTY                       bool                         // allocate a pseudo-TTY for each step's process
-	RunnerName                        string                       // name this runner registered with, reported as `runner.name`, defaults to the hostname
-}
-
-// RunnerDebug reports whether debug logging is on, exposed as `runner.debug` and
-// RUNNER_DEBUG. Only the secret also makes the reporter keep ::debug:: output, the env
-// is accepted for `exec` and for runners configured with it.
-func (c Config) RunnerDebug() bool {
-	return c.Secrets["ACTIONS_STEP_DEBUG"] == "true" || c.Env["ACTIONS_STEP_DEBUG"] == "true"
+	PresetGitHubContext   *model.GithubContext         // the preset github context, overrides some fields like DefaultBranch, Env, Secrets etc.
+	EventJSON             string                       // the content of JSON file to use for event.json in containers, overrides EventPath
+	ContainerNamePrefix   string                       // the prefix of container name
+	ContainerMaxLifetime  time.Duration                // the max lifetime of job containers
+	DefaultActionInstance string                       // the default actions web site
+	PlatformPicker        func(labels []string) string // platform picker, it will take precedence over Platforms if isn't nil
+	JobLoggerLevel        *log.Level                   // the level of job logger
+	ValidVolumes          []string                     // only volumes (and bind mounts) in this slice can be mounted on the job container or service containers
+	InsecureSkipTLS       bool                         // whether to skip verifying TLS certificate of the Gitea instance
+	MaxParallel           int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
 }
 
 // GetToken: Adapt to Gitea
@@ -111,17 +90,6 @@ func (c Config) GetToken() string {
 	return token
 }
 
-// DefaultActionURL returns the host used for implicit remote actions.
-func (c Config) DefaultActionURL() string {
-	if c.DefaultActionInstance != "" {
-		return c.DefaultActionInstance
-	}
-	if c.GitHubInstance != "" {
-		return c.GitHubInstance
-	}
-	return "github.com"
-}
-
 type caller struct {
 	runContext *RunContext
 
@@ -145,11 +113,6 @@ func New(runnerConfig *Config) (Runner, error) {
 }
 
 func (runner *runnerImpl) configure() (Runner, error) {
-	if runner.config.RunnerName == "" {
-		// Callers that do not register, such as `exec`, still get a `runner.name`.
-		runner.config.RunnerName, _ = os.Hostname()
-	}
-
 	runner.eventJSON = "{}"
 	if runner.config.EventJSON != "" {
 		runner.eventJSON = runner.config.EventJSON
@@ -271,20 +234,10 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
 							return err
 						}
 
-						jobCtx := common.WithJobErrorContainer(WithJobLogger(ctx, rc.Run.JobID, jobName, rc.Config, &rc.Masks, matrix))
-						jobCtx, cancelTimeout := applyJobTimeout(jobCtx, rc, job)
-						defer cancelTimeout()
-						return executor(jobCtx)
+						return executor(common.WithJobErrorContainer(WithJobLogger(ctx, rc.Run.JobID, jobName, rc.Config, &rc.Masks, matrix)))
 					})
 				}
-				// Run all matrix combinations of this job, then drop its aggregation mutex: the
-				// combos are the only users of it, so once they finish the jobMutexes entry can be
-				// released, keeping the map from growing unbounded over a long-lived runner.
-				stageParallel := common.NewParallelExecutor(maxParallel, stageExecutor...)
-				pipeline = append(pipeline, func(ctx context.Context) error {
-					defer jobMutexes.Delete(job)
-					return stageParallel(ctx)
-				})
+				pipeline = append(pipeline, common.NewParallelExecutor(maxParallel, stageExecutor...))
 			}
 
 			// For pipeline execution:
@@ -329,7 +282,7 @@ func handleFailure(plan *model.Plan) common.Executor {
 	return func(ctx context.Context) error {
 		for _, stage := range plan.Stages {
 			for _, run := range stage.Runs {
-				if run.Job().Result == "failure" && !run.Job().ContinueOnError {
+				if run.Job().Result == "failure" {
 					return fmt.Errorf("Job '%s' failed", run.String())
 				}
 			}
@@ -368,11 +321,6 @@ func (runner *runnerImpl) newRunContext(ctx context.Context, run *model.Run, mat
 	}
 	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
 	rc.Name = rc.ExprEval.Interpolate(ctx, run.String())
-	// Snapshot the job's pristine output expressions now, before any matrix combo runs and
-	// rewrites the shared Job.Outputs (see interpolateOutputs).
-	if job := run.Job(); job != nil {
-		rc.outputTemplate = maps.Clone(job.Outputs)
-	}
 
 	return rc
 }

act/runner/runner_test.go

@@ -15,7 +15,6 @@ import (
 	"runtime"
 	"strings"
 	"testing"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/model"
@@ -27,7 +26,7 @@ import (
 )
 
 var (
-	baseImage = "node:24-bookworm-slim"
+	baseImage = "node:16-buster-slim"
 	platforms map[string]string
 	logLevel  = log.DebugLevel
 	workdir   = "testdata"
@@ -188,17 +187,13 @@ func (j *TestJobFileInfo) runTest(ctx context.Context, t *testing.T, cfg *Config
 		EventPath:             cfg.EventPath,
 		Platforms:             j.platforms,
 		ReuseContainers:       false,
-		ForceRebuild:          true,
 		Env:                   cfg.Env,
 		Secrets:               cfg.Secrets,
 		Inputs:                cfg.Inputs,
 		GitHubInstance:        "github.com",
-		DefaultActionInstance: cfg.DefaultActionInstance,
 		ContainerArchitecture: cfg.ContainerArchitecture,
-		ContainerMaxLifetime:  time.Hour,
 		Matrix:                cfg.Matrix,
 		ActionCache:           cfg.ActionCache,
-		ValidVolumes:          []string{"**"}, // allow workflow-declared volumes (e.g. container-volumes)
 	}
 
 	runner, err := New(runnerConfig)
@@ -226,14 +221,20 @@ type TestConfig struct {
 }
 
 func TestRunEvent(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	ctx := context.Background()
 
 	tables := []TestJobFileInfo{
 		// Shells
 		{workdir, "shells/defaults", "push", "", platforms, secrets},
+		// TODO: figure out why it fails
+		// {workdir, "shells/custom", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, }, // custom image with pwsh
+		{workdir, "shells/pwsh", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, secrets}, // custom image with pwsh
 		{workdir, "shells/bash", "push", "", platforms, secrets},
+		{workdir, "shells/python", "push", "", map[string]string{"ubuntu-latest": "node:16-buster"}, secrets}, // slim doesn't have python
 		{workdir, "shells/sh", "push", "", platforms, secrets},
 
 		// Local action
@@ -245,6 +246,11 @@ func TestRunEvent(t *testing.T) {
 		// Uses
 		{workdir, "uses-composite", "push", "", platforms, secrets},
 		{workdir, "uses-composite-with-error", "push", "Job 'failing-composite-action' failed", platforms, secrets},
+		{workdir, "uses-nested-composite", "push", "", platforms, secrets},
+		{workdir, "remote-action-composite-js-pre-with-defaults", "push", "", platforms, secrets},
+		{workdir, "remote-action-composite-action-ref", "push", "", platforms, secrets},
+		{workdir, "uses-workflow", "push", "", platforms, map[string]string{"secret": "keep_it_private"}},
+		{workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}},
 		{workdir, "uses-docker-url", "push", "", platforms, secrets},
 		{workdir, "act-composite-env-test", "push", "", platforms, secrets},
 
@@ -254,15 +260,21 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "evalmatrixneeds2", "push", "", platforms, secrets},
 		{workdir, "evalmatrix-merge-map", "push", "", platforms, secrets},
 		{workdir, "evalmatrix-merge-array", "push", "", platforms, secrets},
+		{workdir, "issue-1195", "push", "", platforms, secrets},
 
 		{workdir, "basic", "push", "", platforms, secrets},
 		{workdir, "fail", "push", "exit with `FAILURE`: 1", platforms, secrets},
+		{workdir, "runs-on", "push", "", platforms, secrets},
 		{workdir, "checkout", "push", "", platforms, secrets},
 		{workdir, "job-container", "push", "", platforms, secrets},
 		{workdir, "job-container-non-root", "push", "", platforms, secrets},
 		{workdir, "job-container-invalid-credentials", "push", "failed to handle credentials: failed to interpolate container.credentials.password", platforms, secrets},
 		{workdir, "container-hostname", "push", "", platforms, secrets},
+		{workdir, "remote-action-docker", "push", "", platforms, secrets},
+		{workdir, "remote-action-js", "push", "", platforms, secrets},
+		{workdir, "remote-action-js-node-user", "push", "", platforms, secrets}, // Test if this works with non root container
 		{workdir, "matrix", "push", "", platforms, secrets},
+		{workdir, "matrix-include-exclude", "push", "", platforms, secrets},
 		{workdir, "matrix-exitcode", "push", "Job 'test' failed", platforms, secrets},
 		{workdir, "commands", "push", "", platforms, secrets},
 		{workdir, "workdir", "push", "", platforms, secrets},
@@ -283,6 +295,7 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "job-status-check", "push", "job 'fail' failed", platforms, secrets},
 		{workdir, "if-expressions", "push", "Job 'mytest' failed", platforms, secrets},
 		{workdir, "actions-environment-and-context-tests", "push", "", platforms, secrets},
+		{workdir, "uses-action-with-pre-and-post-step", "push", "", platforms, secrets},
 		{workdir, "evalenv", "push", "", platforms, secrets},
 		{workdir, "docker-action-custom-path", "push", "", platforms, secrets},
 		{workdir, "GITHUB_ENV-use-in-env-ctx", "push", "", platforms, secrets},
@@ -293,6 +306,7 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "workflow_dispatch-scalar", "workflow_dispatch", "", platforms, secrets},
 		{workdir, "workflow_dispatch-scalar-composite-action", "workflow_dispatch", "", platforms, secrets},
 		{workdir, "job-needs-context-contains-result", "push", "", platforms, secrets},
+		{"../model/testdata", "strategy", "push", "", platforms, secrets}, // TODO: move all testdata into pkg so we can validate it with planner and runner
 		{"../model/testdata", "container-volumes", "push", "", platforms, secrets},
 		{workdir, "path-handling", "push", "", platforms, secrets},
 		{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
@@ -302,8 +316,8 @@ func TestRunEvent(t *testing.T) {
 
 		// services
 		{workdir, "services", "push", "", platforms, secrets},
+		{workdir, "services-host-network", "push", "", platforms, secrets},
 		{workdir, "services-with-container", "push", "", platforms, secrets},
-		{workdir, "services-empty-image", "push", "", platforms, secrets},
 
 		// local remote action overrides
 		{workdir, "local-remote-action-overrides", "push", "", platforms, secrets},
@@ -311,11 +325,6 @@ func TestRunEvent(t *testing.T) {
 
 	for _, table := range tables {
 		t.Run(table.workflowPath, func(t *testing.T) {
-			if table.workflowPath == "container-volumes" {
-				// host /proc bind mounts are Linux-Docker-only
-				requireLinuxDocker(t)
-			}
-
 			config := &Config{
 				Secrets: table.secrets,
 			}
@@ -347,12 +356,9 @@ func TestRunEvent(t *testing.T) {
 }
 
 func TestRunEventHostEnvironment(t *testing.T) {
-	// Runs steps directly on the host (the "-self-hosted" platform), so it needs the shells
-	// and tools the workflows invoke. No network gate: every action these workflows reference
-	// is a local `./` fixture or the skipped actions/checkout, so the suite runs offline (same
-	// as TestRunEvent). Only the broadly-used interpreters are required up front; the pwsh- and
-	// nix-specific cases gate on their own tool below so a missing pwsh/nix skips just those.
-	requireHostTools(t, "bash", "node")
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	ctx := context.Background()
 
@@ -368,6 +374,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			{workdir, "shells/defaults", "push", "", platforms, secrets},
 			{workdir, "shells/pwsh", "push", "", platforms, secrets},
 			{workdir, "shells/bash", "push", "", platforms, secrets},
+			{workdir, "shells/python", "push", "", platforms, secrets},
 			{workdir, "shells/sh", "push", "", platforms, secrets},
 
 			// Local action
@@ -376,6 +383,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			// Uses
 			{workdir, "uses-composite", "push", "", platforms, secrets},
 			{workdir, "uses-composite-with-error", "push", "Job 'failing-composite-action' failed", platforms, secrets},
+			{workdir, "uses-nested-composite", "push", "", platforms, secrets},
 			{workdir, "act-composite-env-test", "push", "", platforms, secrets},
 
 			// Eval
@@ -384,10 +392,14 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			{workdir, "evalmatrixneeds2", "push", "", platforms, secrets},
 			{workdir, "evalmatrix-merge-map", "push", "", platforms, secrets},
 			{workdir, "evalmatrix-merge-array", "push", "", platforms, secrets},
+			{workdir, "issue-1195", "push", "", platforms, secrets},
 
 			{workdir, "fail", "push", "exit with `FAILURE`: 1", platforms, secrets},
+			{workdir, "runs-on", "push", "", platforms, secrets},
 			{workdir, "checkout", "push", "", platforms, secrets},
+			{workdir, "remote-action-js", "push", "", platforms, secrets},
 			{workdir, "matrix", "push", "", platforms, secrets},
+			{workdir, "matrix-include-exclude", "push", "", platforms, secrets},
 			{workdir, "commands", "push", "", platforms, secrets},
 			{workdir, "defaults-run", "push", "", platforms, secrets},
 			{workdir, "composite-fail-with-output", "push", "", platforms, secrets},
@@ -401,6 +413,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			{workdir, "steps-context/outcome", "push", "", platforms, secrets},
 			{workdir, "job-status-check", "push", "job 'fail' failed", platforms, secrets},
 			{workdir, "if-expressions", "push", "Job 'mytest' failed", platforms, secrets},
+			{workdir, "uses-action-with-pre-and-post-step", "push", "", platforms, secrets},
 			{workdir, "evalenv", "push", "", platforms, secrets},
 			{workdir, "ensure-post-steps", "push", "Job 'second-post-step-should-fail' failed", platforms, secrets},
 		}...)
@@ -433,26 +446,24 @@ func TestRunEventHostEnvironment(t *testing.T) {
 
 	for _, table := range tables {
 		t.Run(table.workflowPath, func(t *testing.T) {
-			switch table.workflowPath {
-			case "shells/pwsh":
-				requireHostTools(t, "pwsh")
-			case "nix-prepend-path":
-				requireHostTools(t, "nix")
-			}
 			table.runTest(ctx, t, &Config{})
 		})
 	}
 }
 
 func TestDryrunEvent(t *testing.T) {
-	// Dryrun plans without containers or network (shells and local actions only).
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
 	ctx := common.WithDryrun(context.Background(), true)
 
 	tables := []TestJobFileInfo{
 		// Shells
 		{workdir, "shells/defaults", "push", "", platforms, secrets},
-		{workdir, "shells/pwsh", "push", "", platforms, secrets},
+		{workdir, "shells/pwsh", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, secrets}, // custom image with pwsh
 		{workdir, "shells/bash", "push", "", platforms, secrets},
+		{workdir, "shells/python", "push", "", map[string]string{"ubuntu-latest": "node:16-buster"}, secrets}, // slim doesn't have python
 		{workdir, "shells/sh", "push", "", platforms, secrets},
 
 		// Local action
@@ -469,18 +480,10 @@ func TestDryrunEvent(t *testing.T) {
 	}
 }
 
-// TestReusableWorkflowCaller exercises the reusable-workflow caller path against a local
-// reusable workflow (typed inputs, secrets as both a map and `inherit`, and reading the called
-// workflow's outputs via `needs`).
-func TestReusableWorkflowCaller(t *testing.T) {
-	requireDocker(t)
-	table := TestJobFileInfo{workdir, "uses-workflow", "push", "", platforms, map[string]string{"secret": "keep_it_private"}}
-	table.runTest(context.Background(), t, &Config{Secrets: table.secrets})
-}
-
 func TestDockerActionForcePullForceRebuild(t *testing.T) {
-	requireDocker(t)
-	requireNetwork(t) // force-pulls a docker action image
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	ctx := context.Background()
 
@@ -501,6 +504,22 @@ func TestDockerActionForcePullForceRebuild(t *testing.T) {
 	}
 }
 
+func TestRunDifferentArchitecture(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: "basic",
+		eventName:    "push",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	tjfi.runTest(context.Background(), t, &Config{ContainerArchitecture: "linux/arm64"})
+}
+
 type maskJobLoggerFactory struct {
 	Output bytes.Buffer
 }
@@ -521,7 +540,9 @@ func TestMaskValues(t *testing.T) {
 		assert.False(t, strings.Contains(text, "composite secret")) //nolint:testifylint // pre-existing issue from nektos/act
 	}
 
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	log.SetLevel(log.DebugLevel)
 
@@ -542,7 +563,9 @@ func TestMaskValues(t *testing.T) {
 }
 
 func TestRunEventSecrets(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	workflowPath := "secrets"
 
 	tjfi := TestJobFileInfo{
@@ -562,13 +585,15 @@ func TestRunEventSecrets(t *testing.T) {
 }
 
 func TestRunWithService(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	log.SetLevel(log.DebugLevel)
 	ctx := context.Background()
 
 	platforms := map[string]string{
-		"ubuntu-latest": "node:24-bookworm-slim",
+		"ubuntu-latest": "node:12.20.1-buster-slim",
 	}
 
 	workflowPath := "services"
@@ -578,11 +603,10 @@ func TestRunWithService(t *testing.T) {
 	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
 
 	runnerConfig := &Config{
-		Workdir:              workdir,
-		EventName:            eventName,
-		Platforms:            platforms,
-		ReuseContainers:      false,
-		ContainerMaxLifetime: time.Hour, // otherwise the job container is `sleep 0` and exits at once
+		Workdir:         workdir,
+		EventName:       eventName,
+		Platforms:       platforms,
+		ReuseContainers: false,
 	}
 	runner, err := New(runnerConfig)
 	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
@@ -598,7 +622,9 @@ func TestRunWithService(t *testing.T) {
 }
 
 func TestRunActionInputs(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	workflowPath := "input-from-cli"
 
 	tjfi := TestJobFileInfo{
@@ -617,7 +643,9 @@ func TestRunActionInputs(t *testing.T) {
 }
 
 func TestRunEventPullRequest(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 
 	workflowPath := "pull-request"
 
@@ -633,7 +661,9 @@ func TestRunEventPullRequest(t *testing.T) {
 }
 
 func TestRunMatrixWithUserDefinedInclusions(t *testing.T) {
-	requireDocker(t)
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
 	workflowPath := "matrix-with-user-inclusions"
 
 	tjfi := TestJobFileInfo{

act/runner/step.go

@@ -107,13 +107,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 		if strings.Contains(stepString, "::add-mask::") {
 			stepString = "add-mask command"
 		}
-		if stage == stepStageMain {
-			// Main steps print their own raw "Run <title>" header, so this line is redundant and
-			// only leaks into the "Set up job" section for the first step; keep it as a debug trace.
-			logger.Debugf("Run %s %s", stage, stepString)
-		} else {
-			logger.Infof("Run %s %s", stage, stepString)
-		}
+		logger.Infof("Run %s %s", stage, stepString)
 
 		// Prepare and clean Runner File Commands
 		actPath := rc.JobContainer.GetActPath()
@@ -130,12 +124,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 		envFileCommand := path.Join("workflow", "envs.txt")
 		(*step.getEnv())["GITHUB_ENV"] = path.Join(actPath, envFileCommand)
 
-		// Per-step summary file. Composite sub-steps share the outer job step's index
-		// via the Parent chain so all writes from within a composite action accumulate
-		// in the same file and upload under the outer step_index.
-		topRC := rc.topLevelRunContext()
-		stepSummaryIndex := topRC.CurrentStepIndex
-		summaryFileCommand := path.Join("workflow", "step-summary-"+strconv.Itoa(stepSummaryIndex)+".md")
+		summaryFileCommand := path.Join("workflow", "SUMMARY.md")
 		(*step.getEnv())["GITHUB_STEP_SUMMARY"] = path.Join(actPath, summaryFileCommand)
 
 		{
@@ -147,23 +136,22 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			(*step.getEnv())["GITEA_STEP_SUMMARY"] = (*step.getEnv())["GITHUB_STEP_SUMMARY"]
 		}
 
-		// Reset the per-phase file-command files. GITHUB_STEP_SUMMARY is intentionally
-		// excluded here and initialized below at most once per step so writes from later
-		// phases and from composite sub-steps accumulate instead of being truncated.
-		files := []*container.FileEntry{
-			{Name: outputFileCommand, Mode: 0o666},
-			{Name: stateFileCommand, Mode: 0o666},
-			{Name: pathFileCommand, Mode: 0o666},
-			{Name: envFileCommand, Mode: 0o666},
-		}
-		if topRC.summaryFileInitialized == nil {
-			topRC.summaryFileInitialized = map[int]bool{}
-		}
-		if !topRC.summaryFileInitialized[stepSummaryIndex] {
-			files = append(files, &container.FileEntry{Name: summaryFileCommand, Mode: 0o666})
-			topRC.summaryFileInitialized[stepSummaryIndex] = true
-		}
-		_ = rc.JobContainer.Copy(actPath, files...)(ctx)
+		_ = rc.JobContainer.Copy(actPath, &container.FileEntry{
+			Name: outputFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: stateFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: pathFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: envFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: summaryFileCommand,
+			Mode: 0o666,
+		})(ctx)
 
 		timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, rc.ExprEval, stepModel)
 		defer cancelTimeOut()
@@ -181,7 +169,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			}
 
 			if continueOnError {
-				logger.Errorf("##[error]%s", escapeCommandData(err.Error()))
+				logger.Errorf("##[error]%v", err)
 				logger.Infof("Failed but continue next step")
 				err = nil
 				stepResult.Conclusion = model.StepStatusSuccess

act/runner/step_action_remote.go

@@ -113,26 +113,13 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 		}
 
 		actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
-		defaultActionURL := sar.RunContext.Config.DefaultActionURL()
-		// For Gitea
-		// A composite RunContext nils Config.Secrets, so getGitCloneToken would yield an
-		// empty token and clone the action anonymously (401 against the authenticated
-		// instance). github.Token survives the composite config copy and matches the
-		// top-level token; keep the shouldCloneURLUseToken host gate to avoid leaking it.
-		cloneURL := sar.remoteAction.CloneURL(defaultActionURL)
-		token := ""
-		if shouldCloneURLUseToken(sar.RunContext.Config.GitHubInstance, sar.RunContext.Config.trustedActionInstance(), cloneURL) {
-			token = github.Token
-		}
+		token := getGitCloneToken(sar.getRunContext().Config, sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance))
 		gitClone := stepActionRemoteNewCloneExecutor(git.NewGitCloneExecutorInput{
-			URL:         cloneURL,
+			URL:         sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance),
 			Ref:         sar.remoteAction.Ref,
 			Dir:         actionDir,
 			Token:       token,
 			OfflineMode: sar.RunContext.Config.ActionOfflineMode,
-			Depth:       sar.RunContext.Config.ActionCloneDepth,
-			// printPrepareActions reports the download with its resolved commit.
-			Quiet: true,
 
 			InsecureSkipTLS: sar.cloneSkipTLS(), // For Gitea
 		})
@@ -148,13 +135,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 			}
 		}
 
-		// Best effort: the download report falls back to the ref alone when the commit is unknown.
-		if _, sha, err := git.FindGitRevision(ctx, actionDir); err != nil {
-			common.Logger(ctx).Debugf("unable to resolve the commit of %s: %v", sar.remoteAction.Reference(), err)
-		} else {
-			sar.resolvedSha = sha
-		}
-
 		remoteReader := func(ctx context.Context) actionYamlReader { //nolint:unparam // pre-existing issue from nektos/act
 			return func(filename string) (io.Reader, io.Closer, error) {
 				f, err := os.Open(filepath.Join(actionDir, sar.remoteAction.Path, filename))
@@ -165,7 +145,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 		return common.NewPipelineExecutor(
 			ntErr,
 			func(ctx context.Context) error {
-				defer git.AcquireCloneLock(actionDir)()
 				actionModel, err := sar.readAction(ctx, sar.Step, actionDir, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)
 				sar.action = actionModel
 				return err
@@ -174,15 +153,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 	}
 }
 
-// actionDownloadInfo reports the action this step downloaded and the commit it resolved to. ok is
-// false when nothing was fetched, as for the local checkout of the workflow's own repository.
-func (sar *stepActionRemote) actionDownloadInfo() (reference, sha string, ok bool) {
-	if sar.remoteAction == nil || sar.action == nil {
-		return "", "", false
-	}
-	return sar.remoteAction.Reference(), sar.resolvedSha, true
-}
-
 func (sar *stepActionRemote) pre() common.Executor {
 	sar.env = map[string]string{}
 
@@ -303,7 +273,7 @@ func (sar *stepActionRemote) cloneSkipTLS() bool {
 	if sar.remoteAction.URL == "" {
 		// Empty URL means the default action instance should be used
 		// Return true if the URL of the Gitea instance is the same as the URL of the default action instance
-		return sar.RunContext.Config.DefaultActionURL() == sar.RunContext.Config.GitHubInstance
+		return sar.RunContext.Config.DefaultActionInstance == sar.RunContext.Config.GitHubInstance
 	}
 	// Return true if the URL of the remote action is the same as the URL of the Gitea instance
 	return sar.remoteAction.URL == sar.RunContext.Config.GitHubInstance
@@ -319,9 +289,7 @@ type remoteAction struct {
 
 func (ra *remoteAction) CloneURL(u string) string {
 	if ra.URL == "" {
-		// keep an absolute local path as-is (used by tests to resolve actions from a local
-		// repo); only bare host names get the https:// scheme prepended
-		if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") && !filepath.IsAbs(u) {
+		if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") {
 			u = "https://" + u
 		}
 	} else {
@@ -331,16 +299,6 @@ func (ra *remoteAction) CloneURL(u string) string {
 	return fmt.Sprintf("%s/%s/%s", u, ra.Org, ra.Repo)
 }
 
-// Reference renders the action as {org}/{repo}[/path]@{ref}, omitting the download source, which
-// can be interpolated from a secret.
-func (ra *remoteAction) Reference() string {
-	repo := fmt.Sprintf("%s/%s", ra.Org, ra.Repo)
-	if ra.Path != "" {
-		repo = fmt.Sprintf("%s/%s", repo, ra.Path)
-	}
-	return fmt.Sprintf("%s@%s", repo, ra.Ref)
-}
-
 func (ra *remoteAction) IsCheckout() bool {
 	if ra.Org == "actions" && ra.Repo == "checkout" {
 		return true
@@ -350,7 +308,7 @@ func (ra *remoteAction) IsCheckout() bool {
 
 func newRemoteAction(action string) *remoteAction {
 	// support http(s)://host/owner/repo@v3
-	for _, schema := range []string{"https://", "http://", "ssh://"} {
+	for _, schema := range []string{"https://", "http://"} {
 		if after, ok := strings.CutPrefix(action, schema); ok {
 			splits := strings.SplitN(after, "/", 2)
 			if len(splits) != 2 {

act/runner/step_action_remote_test.go

@@ -10,9 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -23,7 +20,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -438,57 +434,6 @@ func TestStepActionRemotePreThroughActionToken(t *testing.T) {
 	}
 }
 
-func TestStepActionRemoteUsesGitHubInstanceWhenDefaultActionInstanceEmpty(t *testing.T) {
-	ctx := context.Background()
-
-	var actualURL string
-	sarm := &stepActionRemoteMocks{}
-
-	origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-	stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-		return func(ctx context.Context) error {
-			actualURL = input.URL
-			return nil
-		}
-	}
-	defer func() {
-		stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-	}()
-
-	sar := &stepActionRemote{
-		Step: &model.Step{
-			Uses: "actions/setup-go@v4",
-		},
-		RunContext: &RunContext{
-			Config: &Config{
-				GitHubInstance:        "gitea.example",
-				DefaultActionInstance: "",
-				ActionCacheDir:        t.TempDir(),
-			},
-			Run: &model.Run{
-				JobID: "1",
-				Workflow: &model.Workflow{
-					Jobs: map[string]*model.Job{
-						"1": {},
-					},
-				},
-			},
-		},
-		readAction: sarm.readAction,
-	}
-
-	suffixMatcher := func(suffix string) any {
-		return mock.MatchedBy(func(actionDir string) bool {
-			return strings.HasSuffix(actionDir, suffix)
-		})
-	}
-	sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-	require.NoError(t, sar.prepareActionExecutor()(ctx))
-	assert.Equal(t, "https://gitea.example/actions/setup-go", actualURL)
-	sarm.AssertExpectations(t)
-}
-
 func TestStepActionRemotePost(t *testing.T) {
 	table := []struct {
 		name               string
@@ -781,32 +726,6 @@ func Test_newRemoteAction(t *testing.T) {
 			},
 			wantCloneURL: "http://gitea.com/actions/aws",
 		},
-		{
-			action: "ssh://git@gitea.com/actions/heroku@main", // it's invalid for GitHub, but gitea supports it
-			want: &remoteAction{
-				URL:  "ssh://git@gitea.com",
-				Org:  "actions",
-				Repo: "heroku",
-				Path: "",
-				Ref:  "main",
-			},
-			wantCloneURL: "ssh://git@gitea.com/actions/heroku",
-		},
-		{
-			action: "ssh://git@gitea.com/actions/aws/ec2@main", // the ssh user is kept as part of the host segment
-			want: &remoteAction{
-				URL:  "ssh://git@gitea.com",
-				Org:  "actions",
-				Repo: "aws",
-				Path: "ec2",
-				Ref:  "main",
-			},
-			wantCloneURL: "ssh://git@gitea.com/actions/aws",
-		},
-		{
-			action: "ssh://gitea.com/onlyonesegment@main", // missing org/repo after the host
-			want:   nil,
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.action, func(t *testing.T) {
@@ -821,97 +740,6 @@ func Test_newRemoteAction(t *testing.T) {
 	}
 }
 
-func Test_remoteActionReference(t *testing.T) {
-	tests := []struct {
-		uses string
-		want string
-	}{
-		{uses: "actions/checkout@v7", want: "actions/checkout@v7"},
-		{uses: "actions/aws/ec2@main", want: "actions/aws/ec2@main"},
-		// The download source can be interpolated from a secret and must stay out of the log.
-		{uses: "https://gitea.example.com/actions/checkout@v7", want: "actions/checkout@v7"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.uses, func(t *testing.T) {
-			assert.Equal(t, tt.want, newRemoteAction(tt.uses).Reference())
-		})
-	}
-}
-
-// TestStepActionRemotePreResolvesDownloadedCommit runs the real download path against a local
-// git repository standing in for the actions instance, so the reported commit is the one the
-// clone actually checked out.
-func TestStepActionRemotePreResolvesDownloadedCommit(t *testing.T) {
-	instance := t.TempDir()
-	actionDir := filepath.Join(instance, "actions", "setup-go")
-	require.NoError(t, os.MkdirAll(actionDir, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(actionDir, "action.yml"),
-		[]byte("name: setup-go\nruns:\n  using: node20\n  main: index.js\n"), 0o600))
-
-	// Supply an identity on the commit so the test does not depend on a
-	// git identity being configured in the environment; a CI runner without
-	// user.name/user.email would otherwise fail "commit" with exit code 128.
-	for _, args := range [][]string{
-		{"init", "--initial-branch=main", actionDir},
-		{"-C", actionDir, "add", "action.yml"},
-		{"-C", actionDir, "-c", "user.name=runner", "-c", "user.email=runner@example.com", "-c", "commit.gpgsign=false", "commit", "-m", "action"},
-	} {
-		cmd := exec.Command("git", args...)
-		require.NoError(t, cmd.Run(), "git %v", args)
-	}
-	out, err := exec.Command("git", "-C", actionDir, "rev-parse", "HEAD").Output()
-	require.NoError(t, err)
-	wantSha := strings.TrimSpace(string(out))
-
-	sar := &stepActionRemote{
-		Step: &model.Step{Uses: "actions/setup-go@main"},
-		RunContext: &RunContext{
-			Config: &Config{
-				GitHubInstance:        "https://gitea.example.com",
-				DefaultActionInstance: instance,
-				ActionCacheDir:        t.TempDir(),
-			},
-			Run: &model.Run{
-				JobID:    "1",
-				Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}},
-			},
-		},
-		readAction: readActionImpl,
-	}
-
-	require.NoError(t, sar.prepareActionExecutor()(context.Background()))
-
-	reference, sha, ok := sar.actionDownloadInfo()
-	assert.True(t, ok)
-	assert.Equal(t, "actions/setup-go@main", reference)
-	assert.Equal(t, wantSha, sha)
-}
-
-func TestStepActionRemoteActionDownloadInfo(t *testing.T) {
-	t.Run("reports the action and its resolved commit", func(t *testing.T) {
-		sar := &stepActionRemote{
-			remoteAction: newRemoteAction("actions/checkout@v7"),
-			action:       &model.Action{},
-			resolvedSha:  "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
-		}
-
-		reference, sha, ok := sar.actionDownloadInfo()
-
-		assert.True(t, ok)
-		assert.Equal(t, "actions/checkout@v7", reference)
-		assert.Equal(t, "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", sha)
-	})
-
-	t.Run("reports nothing when no action was downloaded", func(t *testing.T) {
-		// The local checkout of the workflow's own repository resolves no action.
-		sar := &stepActionRemote{remoteAction: newRemoteAction("actions/checkout@v7")}
-
-		_, _, ok := sar.actionDownloadInfo()
-
-		assert.False(t, ok)
-	})
-}
-
 func Test_safeFilename(t *testing.T) {
 	tests := []struct {
 		s    string
@@ -932,83 +760,3 @@ func Test_safeFilename(t *testing.T) {
 		})
 	}
 }
-
-// Regression: a nested action in a composite cloned anonymously (401) because the
-// composite RunContext nils Config.Secrets. The token must come from github.Token,
-// which survives the config copy; the host gate must still withhold it cross-host.
-func TestStepActionRemoteCloneTokenSurvivesNilSecrets(t *testing.T) {
-	const wantToken = "job-token"
-
-	table := []struct {
-		name                  string
-		gitHubInstance        string
-		defaultActionInstance string
-		wantCloneToken        string
-	}{
-		{
-			name:           "same host forwards token despite nil secrets",
-			gitHubInstance: "gitea.example.com",
-			wantCloneToken: wantToken,
-		},
-		{
-			name:                  "foreign host is not given the token",
-			gitHubInstance:        "gitea.example.com",
-			defaultActionInstance: "github.com",
-			wantCloneToken:        "",
-		},
-	}
-
-	for _, tt := range table {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-
-			var capturedToken string
-			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
-			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
-				capturedToken = input.Token
-				return func(ctx context.Context) error { return nil }
-			}
-			defer (func() {
-				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
-			})()
-
-			sarm := &stepActionRemoteMocks{}
-			sar := &stepActionRemote{
-				Step: &model.Step{Uses: "org/repo@v1"},
-				RunContext: &RunContext{
-					Config: &Config{
-						GitHubInstance:        tt.gitHubInstance,
-						DefaultActionInstance: tt.defaultActionInstance,
-						ActionCacheDir:        "/tmp/test-cache",
-						// Mirrors the state of a composite RunContext: job secrets are
-						// stripped, but the job token is still reachable via Config.Token.
-						Secrets: nil,
-						Token:   wantToken,
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{"1": {}},
-						},
-					},
-					StepResults: map[string]*model.StepResult{},
-				},
-				readAction: sarm.readAction,
-			}
-			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
-
-			suffixMatcher := func(suffix string) any {
-				return mock.MatchedBy(func(actionDir string) bool {
-					return strings.HasSuffix(actionDir, suffix)
-				})
-			}
-			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
-
-			err := sar.prepareActionExecutor()(ctx)
-			require.NoError(t, err)
-			assert.Equal(t, tt.wantCloneToken, capturedToken)
-
-			sarm.AssertExpectations(t)
-		})
-	}
-}

act/runner/step_docker.go

@@ -85,7 +85,7 @@ func (sd *stepDocker) runUsesContainer() common.Executor {
 			stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
 			stepContainer.Start(true),
 		).Finally(
-			stepContainer.Remove().IfBool(!rc.Config.ReuseContainers && !rc.Config.AutoRemove),
+			stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
 		).Finally(stepContainer.Close())(ctx)
 	}
 }
@@ -125,6 +125,8 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e
 		Entrypoint:   entrypoint,
 		WorkingDir:   rc.JobContainer.ToContainerPath(rc.Config.Workdir),
 		Image:        image,
+		Username:     rc.Config.Secrets["DOCKER_USERNAME"],
+		Password:     rc.Config.Secrets["DOCKER_PASSWORD"],
 		Name:         createContainerName(rc.jobContainerName(), "STEP-"+step.ID),
 		Env:          envList,
 		Mounts:       mounts,
@@ -136,8 +138,7 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e
 		UsernsMode:   rc.Config.UsernsMode,
 		Platform:     rc.Config.ContainerArchitecture,
 		AutoRemove:   rc.Config.AutoRemove,
-		ValidVolumes: rc.validVolumes(),
-		AllocatePTY:  rc.Config.AllocatePTY,
+		ValidVolumes: rc.Config.ValidVolumes,
 	})
 	return stepContainer
 }

act/runner/step_docker_test.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 )
 
 func TestStepDockerMain(t *testing.T) {
@@ -39,12 +38,7 @@ func TestStepDockerMain(t *testing.T) {
 	sd := &stepDocker{
 		RunContext: &RunContext{
 			StepResults: map[string]*model.StepResult{},
-			Config: &Config{
-				Secrets: map[string]string{
-					"DOCKER_USERNAME": "docker-user",
-					"DOCKER_PASSWORD": "docker-password",
-				},
-			},
+			Config:      &Config{},
 			Run: &model.Run{
 				JobID: "1",
 				Workflow: &model.Workflow{
@@ -112,99 +106,9 @@ func TestStepDockerMain(t *testing.T) {
 
 	assert.Equal(t, "node:14", input.Image)
 
-	// DOCKER_USERNAME/DOCKER_PASSWORD secrets should not be used as implicit pull credentials for docker:// action containers.
-	assert.Empty(t, input.Username)
-	assert.Empty(t, input.Password)
-
 	cm.AssertExpectations(t)
 }
 
-// With AutoRemove the daemon reaps the container on exit, so act must not remove it afterwards.
-func TestStepDockerAutoRemove(t *testing.T) {
-	orig := ContainerNewContainer
-	defer func() { ContainerNewContainer = orig }()
-
-	for _, tc := range []struct {
-		autoRemove bool
-		removes    int
-	}{
-		{false, 2}, // stale + post-run
-		{true, 1},  // post-run skipped
-	} {
-		cm := &containerMock{}
-		ContainerNewContainer = func(*container.NewContainerInput) container.ExecutionsEnvironment { return cm }
-
-		sd := &stepDocker{
-			RunContext: &RunContext{
-				Config:       &Config{AutoRemove: tc.autoRemove},
-				Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
-				JobContainer: cm,
-			},
-			Step: &model.Step{ID: "1", Uses: "docker://node:14"},
-		}
-
-		removes := 0
-		cm.On("Pull", false).Return(func(context.Context) error { return nil })
-		cm.On("Remove").Return(func(context.Context) error { removes++; return nil })
-		cm.On("Create", []string(nil), []string(nil)).Return(func(context.Context) error { return nil })
-		cm.On("Start", true).Return(func(context.Context) error { return nil })
-		cm.On("Close").Return(func(context.Context) error { return nil })
-
-		require.NoError(t, sd.runUsesContainer()(context.Background()))
-		cm.AssertExpectations(t)
-		assert.Equal(t, tc.removes, removes)
-	}
-}
-
-func TestStepDockerNewStepContainerAllocatePTY(t *testing.T) {
-	for _, tc := range []struct {
-		name     string
-		allocPTY bool
-	}{
-		{name: "off", allocPTY: false},
-		{name: "on", allocPTY: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cm := &containerMock{}
-
-			var captured *container.NewContainerInput
-			origContainerNewContainer := ContainerNewContainer
-			ContainerNewContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-				captured = input
-				return cm
-			}
-			defer func() {
-				ContainerNewContainer = origContainerNewContainer
-			}()
-
-			ctx := context.Background()
-			sd := &stepDocker{
-				RunContext: &RunContext{
-					StepResults: map[string]*model.StepResult{},
-					Config: &Config{
-						AllocatePTY: tc.allocPTY,
-						PlatformPicker: func(_ []string) string {
-							return "node:14"
-						},
-					},
-					Run: &model.Run{
-						JobID: "1",
-						Workflow: &model.Workflow{
-							Jobs: map[string]*model.Job{"1": {}},
-						},
-					},
-					JobContainer: cm,
-				},
-				Step: &model.Step{ID: "1", Uses: "docker://node:14"},
-			}
-			sd.RunContext.ExprEval = sd.RunContext.NewExpressionEvaluator(ctx)
-
-			_ = sd.newStepContainer(ctx, "node:14", []string{"echo", "hi"}, nil)
-			assert.Equal(t, tc.allocPTY, captured.AllocatePTY)
-		})
-	}
-}
-
 func TestStepDockerPrePost(t *testing.T) {
 	ctx := context.Background()
 	sd := &stepDocker{}

act/runner/step_run.go

@@ -63,7 +63,7 @@ func (sr *stepRun) printRunScriptActionDetails(ctx context.Context) {
 
 	normalized := strings.TrimRight(strings.ReplaceAll(sr.interpolatedScript, "\r\n", "\n"), "\n")
 
-	rawLogger.Infof("::group::Run %s", escapeCommandData(sr.runScriptGroupTitle(normalized)))
+	rawLogger.Infof("::group::Run %s", sr.runScriptGroupTitle(normalized))
 
 	if normalized != "" {
 		for line := range strings.SplitSeq(normalized, "\n") {
@@ -90,7 +90,7 @@ func printRunActionHeader(ctx context.Context, step *model.Step, env map[string]
 	if step.Name != "" {
 		title = step.Name
 	}
-	rawLogger.Infof("::group::Run %s", escapeCommandData(title))
+	rawLogger.Infof("::group::Run %s", title)
 
 	if len(step.With) > 0 {
 		rawLogger.Infof("with:")

act/runner/step_test.go

@@ -167,9 +167,6 @@ func TestSetupEnv(t *testing.T) {
 	delete((env), "GITHUB_REPOSITORY")
 	delete((env), "GITHUB_REPOSITORY_OWNER")
 	delete((env), "GITHUB_ACTOR")
-	// Host-dependent, asserted in TestRunContextWithGithubEnvRunnerValues instead.
-	delete((env), "RUNNER_NAME")
-	delete((env), "RUNNER_WORKSPACE")
 
 	assert.Equal(t, map[string]string{
 		"ACT":                      "true",
@@ -195,7 +192,6 @@ func TestSetupEnv(t *testing.T) {
 		"GITHUB_WORKFLOW":          "",
 		"INPUT_STEP_WITH":          "with-value",
 		"RC_KEY":                   "rcvalue",
-		"RUNNER_ENVIRONMENT":       "self-hosted",
 		"RUNNER_PERFLOG":           "/dev/null",
 		"RUNNER_TRACKING_ID":       "",
 	}, env)

act/runner/testdata/.github/workflows/local-reusable-workflow.yml

@@ -1,34 +0,0 @@
-name: local-reusable-workflow
-on:
-  workflow_call:
-    inputs:
-      string_required:
-        required: true
-        type: string
-      bool_required:
-        required: true
-        type: boolean
-      number_required:
-        required: true
-        type: number
-    secrets:
-      secret:
-        required: true
-    outputs:
-      output:
-        value: ${{ jobs.reusable.outputs.output }}
-
-jobs:
-  reusable:
-    runs-on: ubuntu-latest
-    outputs:
-      output: ${{ steps.gen.outputs.output }}
-    steps:
-      - name: check inputs and secret arrived
-        run: |
-          [ "${{ inputs.string_required }}" = "string" ]
-          [ "${{ inputs.bool_required }}" = "true" ]
-          [ "${{ inputs.number_required }}" = "1" ]
-          [ "${{ secrets.secret }}" = "keep_it_private" ]
-      - id: gen
-        run: echo "output=${{ inputs.string_required }}" >> $GITHUB_OUTPUT