Merge branch 'main' into fix/659-cleanup-orphan-docker-resources

fix: continue docker cleanup after a failed step
Teardown was built from `Then`, which stops on the previous step's error and on a cancelled context. A volume that is still in use, or a flaky daemon, then orphaned everything downstream: the service containers and the job network. Replace the combinator chain with straight-line best-effort cleanup that runs every step and joins the errors. Service containers are now removed before the volumes, since a service can hold them via `--volumes-from`, and the network stays last. Co-Authored-By: Claude (Opus 4.8) <noreply@anthropic.com>
2026-08-06 17:04:22 +02:00 · 2026-07-24 16:30:23 +00:00 · 2026-07-24 18:26:59 +02:00 · 2026-07-03 21:54:46 +02:00
30 changed files with 203 additions and 864 deletions
--- a/.gitea/workflows/pull-pr-title.yml
+++ b/.gitea/workflows/pull-pr-title.yml
@@ -18,8 +18,8 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+    - uses: actions/checkout@v7
+    - uses: actions/setup-node@v7
      with:
        node-version: 24
    - run: make lint-pr-title
--- a/.gitea/workflows/release-nightly.yml
+++ b/.gitea/workflows/release-nightly.yml
@@ -17,26 +17,14 @@ jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
-      # Custom publishers (the R2 mirror below) run as the very last
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@v7
        with:
          go-version-file: "go.mod"
      - name: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser-pro
          args: release --nightly
@@ -47,10 +35,6 @@ jobs:
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          S3_REGION: ${{ secrets.AWS_REGION }}
          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          GORELEASER_FORCE_TOKEN: "gitea"
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@@ -74,18 +58,18 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0 # all history for all branches and tags

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@v4

      - name: Login to DockerHub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
@@ -99,7 +83,7 @@ jobs:
          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT

      - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
--- a/.gitea/workflows/release-tag.yml
+++ b/.gitea/workflows/release-tag.yml
@@ -9,33 +9,21 @@ jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # all history for all branches and tags
-      # Custom publishers (the R2 mirror below) run as the very last
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/setup-go@v7
        with:
          go-version-file: "go.mod"
      - name: Import GPG key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
+        uses: crazy-max/ghaction-import-gpg@v7
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}
          fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
      - name: goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser-pro
          args: release
@@ -46,10 +34,6 @@ jobs:
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          S3_REGION: ${{ secrets.AWS_REGION }}
          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          GORELEASER_FORCE_TOKEN: "gitea"
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
@@ -77,25 +61,25 @@ jobs:
      DOCKER_LATEST: latest
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0 # all history for all branches and tags

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@v4

      - name: Login to DockerHub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: "Docker meta"
        id: docker_meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.DOCKER_ORG }}/runner
@@ -108,7 +92,7 @@ jobs:
            suffix=${{ matrix.variant.tag_suffix }},onlatest=true

      - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -17,8 +17,8 @@ jobs:
      # to ~/.docker with the stale credentials.
      DOCKER_CONFIG: /tmp/docker-noauth
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
        with:
          go-version-file: 'go.mod'
      - name: prepare anonymous docker config
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -93,37 +93,6 @@ blobs:
      - glob: ./**.xz
      - glob: ./**.sha256

-# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the
-# parallel S3+R2 period (S3 will be removed once migration completes).
-# A second `blobs:` entry is impossible here since the blob pipe
-# authenticates from the global AWS_* env with no per-entry
-# credentials; `publishers:` supports per-entry `env:` instead, so
-# it's used to invoke scripts/upload-r2.sh once per artifact. Custom
-# publishers inherit almost nothing from the environment, hence the
-# explicit R2_* forwarding below.
-#
-# This publisher fires 109 times for 73 distinct keys because
-# goreleaser's release pipe already registers `release.extra_files`
-# as UploadableFile artifacts, and `internal/exec`'s filterArtifacts
-# appends this block's own extra_files with no de-duplication. It
-# can't be globbed away, since gobwas/glob (via goreleaser/fileglob)
-# has no substring-exclusion matcher. It's harmless: PUT is
-# idempotent, and the `./**.xz` glob below is kept deliberately so
-# this publisher declares its own complete file set rather than
-# implicitly depending on the `release:` block's globs.
-publishers:
-  - name: cloudflare-r2
-    checksum: true
-    extra_files:
-      - glob: ./**.xz
-      - glob: ./**.sha256
-    cmd: sh scripts/upload-r2.sh {{ abs .ArtifactPath }} gitea-runner/{{ .Version }}/{{ .ArtifactName }}
-    env:
-      - R2_ENDPOINT={{ index .Env "R2_ENDPOINT" }}
-      - R2_BUCKET={{ index .Env "R2_BUCKET" }}
-      - R2_ACCESS_KEY_ID={{ index .Env "R2_ACCESS_KEY_ID" }}
-      - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }}
-
 archives:
  - format: binary
    name_template: "{{ .Binary }}"
--- a/act/container/docker_create_flags.go
+++ b/act/container/docker_create_flags.go
@@ -1,86 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"slices"
-
-	"github.com/kballard/go-shellquote"
-	"github.com/spf13/pflag"
-)
-
-const (
-	pullPolicyAlways  = "always"
-	pullPolicyMissing = "missing"
-	pullPolicyNever   = "never"
-)
-
-var pullPolicies = []string{pullPolicyAlways, pullPolicyMissing, pullPolicyNever}
-
-// createFlags are the flags docker/cli registers on the `create` and `run` commands
-// instead of in addFlags, so they are not part of containerOptions.
-type createFlags struct {
-	platform     string
-	pull         string
-	name         string
-	useAPISocket bool
-}
-
-func registerCreateFlags(flags *pflag.FlagSet) *createFlags {
-	cf := new(createFlags)
-	flags.StringVar(&cf.platform, "platform", "", "Set platform if server is multi-platform capable")
-	flags.StringVar(&cf.pull, "pull", pullPolicyMissing, `Pull image before creating ("always", "missing", "never")`)
-	flags.StringVar(&cf.name, "name", "", "Assign a name to the container")
-	flags.BoolVar(&cf.useAPISocket, "use-api-socket", false, "Bind mount Docker API socket and required auth")
-	// Accepted without effect: pull progress is only logged at debug level, and docker
-	// no longer implements content trust.
-	flags.BoolP("quiet", "q", false, "Suppress the pull output")
-	flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
-	return cf
-}
-
-// parseContainerOptions parses a container options string. The flags are returned even
-// on error, holding whatever was read before the failure.
-func parseContainerOptions(options string) (*pflag.FlagSet, *containerOptions, *createFlags, error) {
-	flags := pflag.NewFlagSet("container_flags", pflag.ContinueOnError)
-	flags.SetOutput(io.Discard)
-	copts := addFlags(flags)
-	cf := registerCreateFlags(flags)
-
-	args, err := shellquote.Split(options)
-	if err != nil {
-		return flags, copts, cf, fmt.Errorf("Cannot split container options: '%s': '%w'", options, err)
-	}
-
-	if err := flags.Parse(args); err != nil {
-		return flags, copts, cf, fmt.Errorf("Cannot parse container options: '%s': '%w'", options, err)
-	}
-
-	return flags, copts, cf, nil
-}
-
-// createFlagsFromOptions reads the create-level flags that have to be known before the
-// container is created. Malformed options keep the defaults here and are reported by
-// mergeContainerConfigs at create time.
-func createFlagsFromOptions(options string) *createFlags {
-	_, _, cf, _ := parseContainerOptions(options)
-	return cf
-}
-
-func (cf *createFlags) validate() error {
-	if !slices.Contains(pullPolicies, cf.pull) {
-		return fmt.Errorf("invalid --pull option %q: must be one of %q", cf.pull, pullPolicies)
-	}
-
-	if cf.useAPISocket {
-		return errors.New("--use-api-socket is not supported, use the runner's container.docker_host setting to expose a docker socket")
-	}
-
-	return nil
-}
--- a/act/container/docker_create_flags_test.go
+++ b/act/container/docker_create_flags_test.go
@@ -1,61 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package container
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCreateFlagsFromOptions(t *testing.T) {
-	for _, tc := range []struct {
-		options  string
-		platform string
-		pull     string
-	}{
-		{"", "", pullPolicyMissing},
-		{"-v /a:/b --platform=linux/arm64 --pull always", "linux/arm64", pullPolicyAlways},
-		{"--platform linux/arm/v7 --pull never", "linux/arm/v7", pullPolicyNever},
-		{`--platform "linux/amd64`, "", pullPolicyMissing}, // malformed, defaults kept
-	} {
-		t.Run(tc.options, func(t *testing.T) {
-			cf := createFlagsFromOptions(tc.options)
-			assert.Equal(t, tc.platform, cf.platform)
-			assert.Equal(t, tc.pull, cf.pull)
-		})
-	}
-}
-
-func TestCreateFlagsValidate(t *testing.T) {
-	for _, tc := range []struct {
-		options string
-		wantErr string
-	}{
-		{"--quiet --disable-content-trust --name mine", ""},
-		{"--pull sometimes", `invalid --pull option "sometimes"`},
-		{"--use-api-socket", "--use-api-socket is not supported"},
-	} {
-		t.Run(tc.options, func(t *testing.T) {
-			err := createFlagsFromOptions(tc.options).validate()
-			if tc.wantErr == "" {
-				require.NoError(t, err)
-				return
-			}
-			require.ErrorContains(t, err, tc.wantErr)
-		})
-	}
-}
-
-func TestNewContainerAppliesCreateFlags(t *testing.T) {
-	input := &NewContainerInput{Platform: "linux/amd64", Options: "--platform linux/arm64 --pull never"}
-	cr := NewContainer(input).(*containerReference)
-	assert.Equal(t, "linux/arm64", input.Platform)
-	assert.Equal(t, pullPolicyNever, cr.pullPolicy)
-
-	kept := &NewContainerInput{Platform: "linux/amd64", Options: "--privileged"}
-	NewContainer(kept)
-	assert.Equal(t, "linux/amd64", kept.Platform)
-}
--- a/act/container/docker_run.go
+++ b/act/container/docker_run.go
@@ -35,6 +35,7 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
 	"github.com/gobwas/glob"
 	"github.com/joho/godotenv"
+	"github.com/kballard/go-shellquote"
 	"github.com/moby/moby/api/pkg/stdcopy"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/mount"
@@ -42,6 +43,7 @@ import (
 	"github.com/moby/moby/api/types/system"
 	"github.com/moby/moby/client"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/spf13/pflag"
 )

 // drainGracePeriod bounds how long we wait for an output-copy goroutine to
@@ -55,12 +57,6 @@ const drainGracePeriod = 2 * time.Second
 func NewContainer(input *NewContainerInput) ExecutionsEnvironment {
 	cr := new(containerReference)
 	cr.input = input
-	// Resolved up front because the image pull runs before the container is created.
-	cf := createFlagsFromOptions(input.Options)
-	if cf.platform != "" {
-		cr.input.Platform = cf.platform
-	}
-	cr.pullPolicy = cf.pull
 	return cr
 }

@@ -141,11 +137,6 @@ func (cr *containerReference) Start(attach bool) common.Executor {
 }

 func (cr *containerReference) Pull(forcePull bool) common.Executor {
-	if cr.pullPolicy == pullPolicyNever {
-		return common.NewInfoExecutor("docker pull skipped image=%s, --pull=never in the options", cr.input.Image)
-	}
-	forcePull = forcePull || cr.pullPolicy == pullPolicyAlways
-
 	return common.
 		NewInfoExecutor("docker pull image=%s platform=%s username=%s forcePull=%t", cr.input.Image, cr.input.Platform, cr.input.Username, forcePull).
 		Then(
@@ -241,12 +232,11 @@ func (cr *containerReference) ReplaceLogWriter(stdout, stderr io.Writer) (io.Wri
 }

 type containerReference struct {
-	cli        client.APIClient
-	id         string
-	input      *NewContainerInput
-	pullPolicy string
-	UID        int
-	GID        int
+	cli   client.APIClient
+	id    string
+	input *NewContainerInput
+	UID   int
+	GID   int
 	// attachDone is closed by the attach() streaming goroutine once it has
 	// drained and flushed the container's output. wait() blocks on it so the
 	// tail of the log lands before the step proceeds.
@@ -421,13 +411,17 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 	}

 	// parse configuration from CLI container.options
-	flags, copts, cf, err := parseContainerOptions(input.Options)
+	flags := pflag.NewFlagSet("container_flags", pflag.ContinueOnError)
+	copts := addFlags(flags)
+
+	optionsArgs, err := shellquote.Split(input.Options)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, fmt.Errorf("Cannot split container options: '%s': '%w'", input.Options, err)
 	}

-	if err := cf.validate(); err != nil {
-		return nil, nil, fmt.Errorf("Cannot process container options: '%s': '%w'", input.Options, err)
+	err = flags.Parse(optionsArgs)
+	if err != nil {
+		return nil, nil, fmt.Errorf("Cannot parse container options: '%s': '%w'", input.Options, err)
 	}

 	// FIXME: If everything is fine after gitea/act v0.260.0, remove the following comment.
@@ -482,9 +476,6 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 	}
 	hostConfig.Binds = binds
 	hostConfig.Mounts = mounts
-	if cf.name != "" {
-		logger.Warn("--name in the options will be ignored.")
-	}
 	if len(copts.netMode.Value()) > 0 {
 		logger.Warn("--network and --net in the options will be ignored.")
 	}
--- a/act/model/action.go
+++ b/act/model/action.go
@@ -76,19 +76,17 @@ func (a ActionRunsUsing) IsComposite() bool {

 // ActionRuns are a field in Action
 type ActionRuns struct {
-	Using          ActionRunsUsing   `yaml:"using"`
-	Env            map[string]string `yaml:"env"`
-	Main           string            `yaml:"main"`
-	Pre            string            `yaml:"pre"`
-	PreIf          string            `yaml:"pre-if"`
-	Post           string            `yaml:"post"`
-	PostIf         string            `yaml:"post-if"`
-	Image          string            `yaml:"image"`
-	PreEntrypoint  string            `yaml:"pre-entrypoint"`
-	Entrypoint     string            `yaml:"entrypoint"`
-	PostEntrypoint string            `yaml:"post-entrypoint"`
-	Args           []string          `yaml:"args"`
-	Steps          []Step            `yaml:"steps"`
+	Using      ActionRunsUsing   `yaml:"using"`
+	Env        map[string]string `yaml:"env"`
+	Main       string            `yaml:"main"`
+	Pre        string            `yaml:"pre"`
+	PreIf      string            `yaml:"pre-if"`
+	Post       string            `yaml:"post"`
+	PostIf     string            `yaml:"post-if"`
+	Image      string            `yaml:"image"`
+	Entrypoint string            `yaml:"entrypoint"`
+	Args       []string          `yaml:"args"`
+	Steps      []Step            `yaml:"steps"`
 }

 // Action describes a metadata file for GitHub actions. The metadata filename must be either action.yml or action.yaml. The data in the metadata file defines the inputs, outputs and main entrypoint for your action.
--- a/act/model/action_test.go
+++ b/act/model/action_test.go
@@ -61,22 +61,3 @@ runs:
 		t.Fatalf("error = %q, want invalid value", err)
 	}
 }
-
-func TestReadActionDockerEntrypoints(t *testing.T) {
-	action, err := ReadAction(strings.NewReader(`
-runs:
-  using: docker
-  image: Dockerfile
-  pre-entrypoint: pre.sh
-  post-entrypoint: post.sh
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if action.Runs.PreEntrypoint != "pre.sh" {
-		t.Fatalf("pre-entrypoint = %q, want pre.sh", action.Runs.PreEntrypoint)
-	}
-	if action.Runs.PostEntrypoint != "post.sh" {
-		t.Fatalf("post-entrypoint = %q, want post.sh", action.Runs.PostEntrypoint)
-	}
-}
--- a/act/runner/action.go
+++ b/act/runner/action.go
@@ -207,7 +207,7 @@ func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction
 			if remoteAction == nil {
 				location = containerActionDir
 			}
-			return execAsDocker(ctx, step, actionName, actionDir, location, remoteAction == nil, stepStageMain)
+			return execAsDocker(ctx, step, actionName, actionDir, location, remoteAction == nil)
 		case x.IsComposite():
 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
@@ -305,7 +305,7 @@ func dockerActionImageTag(repository, actionName string, localAction bool) strin
 }

 // TODO: break out parts of function to reduce complexicity
-func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, basedir string, localAction bool, stage stepStage) error {
+func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, basedir string, localAction bool) error {
 	logger := common.Logger(ctx)
 	rc := step.getRunContext()
 	action := step.getActionModel()
@@ -386,9 +386,16 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 		cmd = action.Runs.Args
 		evalDockerArgs(ctx, step, action, &cmd)
 	}
-	entrypoint, err := dockerEntrypoint(ctx, step, eval, stage)
-	if err != nil {
-		return err
+	entrypoint := strings.Fields(eval.Interpolate(ctx, step.getStepModel().With["entrypoint"]))
+	if len(entrypoint) == 0 {
+		if action.Runs.Entrypoint != "" {
+			entrypoint, err = shellquote.Split(action.Runs.Entrypoint)
+			if err != nil {
+				return err
+			}
+		} else {
+			entrypoint = nil
+		}
 	}
 	stepContainer := newStepContainer(ctx, step, image, cmd, entrypoint)
 	return common.NewPipelineExecutor(
@@ -402,30 +409,6 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 	).Finally(stepContainer.Close())(ctx)
 }

-// dockerEntrypoint returns the entrypoint the action's image runs with for the given
-// stage. Only the main stage honours the `entrypoint` input.
-func dockerEntrypoint(ctx context.Context, step actionStep, eval ExpressionEvaluator, stage stepStage) ([]string, error) {
-	runs := step.getActionModel().Runs
-
-	var entrypoint string
-	switch stage {
-	case stepStagePre:
-		entrypoint = runs.PreEntrypoint
-	case stepStagePost:
-		entrypoint = runs.PostEntrypoint
-	default:
-		if fields := strings.Fields(eval.Interpolate(ctx, step.getStepModel().With["entrypoint"])); len(fields) > 0 {
-			return fields, nil
-		}
-		entrypoint = runs.Entrypoint
-	}
-
-	if entrypoint == "" {
-		return nil, nil
-	}
-	return shellquote.Split(entrypoint)
-}
-
 func evalDockerArgs(ctx context.Context, step step, action *model.Action, cmd *[]string) {
 	rc := step.getRunContext()
 	stepModel := step.getStepModel()
@@ -576,57 +559,44 @@ func hasPreStep(step actionStep) common.Conditional {
 		return action.Runs.Using.IsComposite() ||
 			(action.Runs.Using.IsNode() &&
 				action.Runs.Pre != "") ||
-			(action.Runs.Using.IsDocker() &&
-				action.Runs.PreEntrypoint != "") ||
 			(action.Runs.Using == model.ActionRunsUsingGo &&
 				action.Runs.Pre != "")
 	}
 }

-// actionStagePaths resolves where a step's action lives and where the job container sees
-// it, for the pre and post stage.
-func actionStagePaths(step actionStep) (actionDir, actionPath, actionName, containerActionDir string) {
-	rc := step.getRunContext()
-	stepModel := step.getStepModel()
-
-	if _, ok := step.(*stepActionRemote); ok {
-		actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
-		actionPath = newRemoteAction(stepModel.Uses).Path
-	} else {
-		actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
-	}
-
-	actionName, containerActionDir = getContainerActionPaths(stepModel, path.Join(actionDir, actionPath), rc)
-	return actionDir, actionPath, actionName, containerActionDir
-}
-
-// execDockerActionStage runs a docker action's image for its pre or post stage.
-func execDockerActionStage(ctx context.Context, step actionStep, stage stepStage) error {
-	actionDir, actionPath, actionName, containerActionDir := actionStagePaths(step)
-
-	_, remote := step.(*stepActionRemote)
-	location := containerActionDir
-	if remote {
-		location = path.Join(actionDir, actionPath)
-	}
-	return execAsDocker(ctx, step, actionName, actionDir, location, !remote, stage)
-}
-
 func runPreStep(step actionStep) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		logger.Debugf("run pre step for '%s'", step.getStepModel())

 		rc := step.getRunContext()
+		stepModel := step.getStepModel()
 		action := step.getActionModel()

-		actionDir, actionPath, _, containerActionDir := actionStagePaths(step)
-
 		x := action.Runs.Using
 		switch {
 		case x.IsNode():
 			// defaults in pre steps were missing, however provided inputs are available
 			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
+			// todo: refactor into step
+			var actionDir string
+			var actionPath string
+			if _, ok := step.(*stepActionRemote); ok {
+				actionPath = newRemoteAction(stepModel.Uses).Path
+				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+			} else {
+				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+				actionPath = ""
+			}
+
+			var actionLocation string
+			if actionPath != "" {
+				actionLocation = path.Join(actionDir, actionPath)
+			} else {
+				actionLocation = actionDir
+			}
+
+			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)

 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
@@ -639,12 +609,6 @@ func runPreStep(step actionStep) common.Executor {

 			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)

-		case x.IsDocker():
-			// defaults in pre steps were missing, however provided inputs are available
-			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
-
-			return execDockerActionStage(ctx, step, stepStagePre)
-
 		case x.IsComposite():
 			if step.getCompositeSteps() == nil {
 				step.getCompositeRunContext(ctx)
@@ -658,6 +622,25 @@ func runPreStep(step actionStep) common.Executor {
 		case x == model.ActionRunsUsingGo:
 			// defaults in pre steps were missing, however provided inputs are available
 			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
+			// todo: refactor into step
+			var actionDir string
+			var actionPath string
+			if _, ok := step.(*stepActionRemote); ok {
+				actionPath = newRemoteAction(stepModel.Uses).Path
+				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+			} else {
+				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+				actionPath = ""
+			}
+
+			var actionLocation string
+			if actionPath != "" {
+				actionLocation = path.Join(actionDir, actionPath)
+			} else {
+				actionLocation = actionDir
+			}
+
+			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)

 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
@@ -710,8 +693,6 @@ func hasPostStep(step actionStep) common.Conditional {
 		return action.Runs.Using.IsComposite() ||
 			(action.Runs.Using.IsNode() &&
 				action.Runs.Post != "") ||
-			(action.Runs.Using.IsDocker() &&
-				action.Runs.PostEntrypoint != "") ||
 			(action.Runs.Using == model.ActionRunsUsingGo &&
 				action.Runs.Post != "")
 	}
@@ -723,9 +704,28 @@ func runPostStep(step actionStep) common.Executor {
 		logger.Debugf("run post step for '%s'", step.getStepModel())

 		rc := step.getRunContext()
+		stepModel := step.getStepModel()
 		action := step.getActionModel()

-		actionDir, actionPath, _, containerActionDir := actionStagePaths(step)
+		// todo: refactor into step
+		var actionDir string
+		var actionPath string
+		if _, ok := step.(*stepActionRemote); ok {
+			actionPath = newRemoteAction(stepModel.Uses).Path
+			actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+		} else {
+			actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+			actionPath = ""
+		}
+
+		var actionLocation string
+		if actionPath != "" {
+			actionLocation = path.Join(actionDir, actionPath)
+		} else {
+			actionLocation = actionDir
+		}
+
+		_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)

 		x := action.Runs.Using
 		switch {
@@ -740,11 +740,6 @@ func runPostStep(step actionStep) common.Executor {

 			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)

-		case x.IsDocker():
-			populateEnvsFromSavedState(step.getEnv(), step, rc)
-
-			return execDockerActionStage(ctx, step, stepStagePost)
-
 		case x.IsComposite():
 			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
 				return err
--- a/act/runner/action_test.go
+++ b/act/runner/action_test.go
@@ -183,7 +183,7 @@ func TestExecAsDockerAutoRemove(t *testing.T) {
 		cm.On("Start", true).Return(func(context.Context) error { return nil })
 		cm.On("Close").Return(func(context.Context) error { return nil })

-		require.NoError(t, execAsDocker(context.Background(), step, "action", t.TempDir(), t.TempDir(), false, stepStageMain))
+		require.NoError(t, execAsDocker(context.Background(), step, "action", t.TempDir(), t.TempDir(), false))
 		cm.AssertExpectations(t)
 		assert.Equal(t, tc.removes, removes)
 	}
@@ -465,7 +465,7 @@ func TestExecAsDockerHoldsCloneLockForRemoteUncached(t *testing.T) {
 	defer cancel()

 	done := make(chan error, 1)
-	go func() { done <- execAsDocker(ctx, step, "test-action", actionDir, actionDir, false, stepStageMain) }()
+	go func() { done <- execAsDocker(ctx, step, "test-action", actionDir, actionDir, false) }()

 	select {
 	case <-innerEntered:
@@ -541,86 +541,3 @@ func TestDockerActionImageTag(t *testing.T) {
 		dockerActionImageTag("owner/repo", "./sub", true),
 	)
 }
-
-// Only the entrypoint is stage specific: every stage of a docker action receives runs.args
-// and runs.env, and the `entrypoint` input applies to the main stage alone.
-func TestExecAsDockerStageEntrypoint(t *testing.T) {
-	orig := ContainerNewContainer
-	defer func() { ContainerNewContainer = orig }()
-
-	for _, tc := range []struct {
-		name           string
-		stage          stepStage
-		wantEntrypoint []string
-	}{
-		{
-			name:           "main stage prefers the entrypoint input",
-			stage:          stepStageMain,
-			wantEntrypoint: []string{"input.sh"},
-		},
-		{
-			name:           "pre stage uses runs.pre-entrypoint",
-			stage:          stepStagePre,
-			wantEntrypoint: []string{"pre.sh", "--verbose"},
-		},
-		{
-			name:           "post stage uses runs.post-entrypoint",
-			stage:          stepStagePost,
-			wantEntrypoint: []string{"post.sh"},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cm := &containerMock{}
-			var input *container.NewContainerInput
-			ContainerNewContainer = func(in *container.NewContainerInput) container.ExecutionsEnvironment {
-				input = in
-				return cm
-			}
-
-			step := &stepActionRemote{
-				Step: &model.Step{ID: "1", Uses: "org/action@v1", With: map[string]string{"entrypoint": "input.sh"}},
-				RunContext: &RunContext{
-					Config:       &Config{},
-					Run:          &model.Run{JobID: "1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"1": {}}}},
-					JobContainer: cm,
-				},
-				action: &model.Action{Runs: model.ActionRuns{
-					Using:          "docker",
-					Image:          "docker://node:14",
-					PreEntrypoint:  "pre.sh --verbose",
-					Entrypoint:     "main.sh",
-					PostEntrypoint: "post.sh",
-					Args:           []string{"hello"},
-					Env:            map[string]string{"MY_VAR": "world"},
-				}},
-				env: map[string]string{},
-			}
-
-			cm.On("Pull", false).Return(func(context.Context) error { return nil })
-			cm.On("Remove").Return(func(context.Context) error { return nil })
-			cm.On("Create", []string(nil), []string(nil)).Return(func(context.Context) error { return nil })
-			cm.On("Start", true).Return(func(context.Context) error { return nil })
-			cm.On("Close").Return(func(context.Context) error { return nil })
-
-			require.NoError(t, execAsDocker(context.Background(), step, "action", t.TempDir(), t.TempDir(), false, tc.stage))
-			require.NotNil(t, input)
-			assert.Equal(t, tc.wantEntrypoint, input.Entrypoint)
-			assert.Equal(t, []string{"hello"}, input.Cmd)
-			assert.Contains(t, input.Env, "MY_VAR=world")
-		})
-	}
-}
-
-func TestDockerActionHasPreAndPostStep(t *testing.T) {
-	newStep := func(runs model.ActionRuns) actionStep {
-		return &stepActionRemote{action: &model.Action{Runs: runs}}
-	}
-	ctx := context.Background()
-
-	assert.False(t, hasPreStep(newStep(model.ActionRuns{Using: "docker", Image: "Dockerfile"}))(ctx))
-	assert.False(t, hasPostStep(newStep(model.ActionRuns{Using: "docker", Image: "Dockerfile"}))(ctx))
-
-	withStages := model.ActionRuns{Using: "docker", Image: "Dockerfile", PreEntrypoint: "pre.sh", PostEntrypoint: "post.sh"}
-	assert.True(t, hasPreStep(newStep(withStages))(ctx))
-	assert.True(t, hasPostStep(newStep(withStages))(ctx))
-}
--- a/act/runner/command.go
+++ b/act/runner/command.go
@@ -154,25 +154,30 @@ func parseKeyValuePairs(kvPairs, separator string) map[string]string {
 	return rtn
 }

-// A Replacer never rescans what it wrote, so "%250A" stays a literal "%0A".
-var (
-	commandDataEscaper       = strings.NewReplacer("%", "%25", "\r", "%0D", "\n", "%0A")
-	commandDataUnescaper     = strings.NewReplacer("%25", "%", "%0D", "\r", "%0A", "\n")
-	commandPropertyUnescaper = strings.NewReplacer("%25", "%", "%0D", "\r", "%0A", "\n", "%3A", ":", "%2C", ",")
-)
-
-// escapeCommandData encodes the data part of a "::cmd::" or "##[cmd]" line the runner writes itself,
-// so the log renderer decodes it back. Lines forwarded from step output are already escaped.
-func escapeCommandData(arg string) string {
-	return commandDataEscaper.Replace(arg)
-}
-
 func UnescapeCommandData(arg string) string {
-	return commandDataUnescaper.Replace(arg)
+	escapeMap := map[string]string{
+		"%25": "%",
+		"%0D": "\r",
+		"%0A": "\n",
+	}
+	for k, v := range escapeMap {
+		arg = strings.ReplaceAll(arg, k, v)
+	}
+	return arg
 }

 func unescapeCommandProperty(arg string) string {
-	return commandPropertyUnescaper.Replace(arg)
+	escapeMap := map[string]string{
+		"%25": "%",
+		"%0D": "\r",
+		"%0A": "\n",
+		"%3A": ":",
+		"%2C": ",",
+	}
+	for k, v := range escapeMap {
+		arg = strings.ReplaceAll(arg, k, v)
+	}
+	return arg
 }

 func unescapeKvPairs(kvPairs map[string]string) map[string]string {
--- a/act/runner/command_test.go
+++ b/act/runner/command_test.go
@@ -214,10 +214,3 @@ func TestSaveState(t *testing.T) {

 	assert.Equal(t, "state-value", rc.IntraActionState["step"]["state-name"])
 }
-
-func TestEscapeCommandData(t *testing.T) {
-	a := assert.New(t)
-
-	a.Equal("a%25b%0Dc%0Ad%250A", escapeCommandData("a%b\rc\nd%0A"))
-	a.Equal("a%b\rc\nd%0A", UnescapeCommandData("a%25b%0Dc%0Ad%250A"))
-}
--- a/act/runner/expression.go
+++ b/act/runner/expression.go
@@ -95,7 +95,9 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map
 		Inputs:    inputs,
 		HashFiles: getHashFilesFunction(ctx, rc),
 	}
-	ee.Runner = rc.getRunnerContext(ctx)
+	if rc.JobContainer != nil {
+		ee.Runner = rc.JobContainer.GetRunnerContext(ctx)
+	}
 	return expressionEvaluator{
 		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
 			Run:        rc.Run,
@@ -147,7 +149,9 @@ func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step)
 		Inputs:    inputs,
 		HashFiles: getHashFilesFunction(ctx, rc),
 	}
-	ee.Runner = rc.getRunnerContext(ctx)
+	if rc.JobContainer != nil {
+		ee.Runner = rc.JobContainer.GetRunnerContext(ctx)
+	}
 	return expressionEvaluator{
 		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
 			Run:        rc.Run,
--- a/act/runner/job_executor.go
+++ b/act/runner/job_executor.go
@@ -66,7 +66,7 @@ func reportStepError(ctx context.Context, rc *RunContext, err error) {
 		rc.markInterrupted(ctx.Err())
 		return
 	}
-	common.Logger(ctx).Errorf("##[error]%s", escapeCommandData(err.Error()))
+	common.Logger(ctx).Errorf("##[error]%v", err)
 	common.SetJobError(ctx, err)
 	rc.markFailed()
 }
--- a/act/runner/logger.go
+++ b/act/runner/logger.go
@@ -175,10 +175,6 @@ func AppendSecretMasker(oldnew []string, v string) []string {
 		// formatted JSON secrets could otherwise mask {,[,],} everywhere
 		if len(tm) > 1 {
 			ret = append(ret, tm, "***")
-			// command data reaches the log escaped, so "pass%word" also arrives as "pass%25word"
-			if strings.ContainsAny(tm, "%\r\n") {
-				ret = append(ret, escapeCommandData(tm), "***")
-			}
 		}
 	}

@@ -234,11 +230,6 @@ type jobLogFormatter struct {
 func (f *jobLogFormatter) Format(entry *logrus.Entry) ([]byte, error) {
 	b := &bytes.Buffer{}

-	// the web renderer decodes command data, so this local view has to as well
-	if _, _, _, ok := tryParseRawActionCommand(entry.Message + "\n"); ok {
-		entry.Message = UnescapeCommandData(entry.Message)
-	}
-
 	if f.isColored(entry) {
 		f.printColored(b, entry)
 	} else {
--- a/act/runner/logger_test.go
+++ b/act/runner/logger_test.go
@@ -4,13 +4,11 @@
 package runner

 import (
-	"io"
 	"strings"
 	"testing"

 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestValueMasker(t *testing.T) {
@@ -35,12 +33,6 @@ func TestValueMasker(t *testing.T) {
 			masks:      []string{"PRIVATE_KEY_BEGIN\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\ndsdfseffefsefes\nPRIVATE_KEY_END"},
 			disallowed: []string{"KEY", "dsdfseffefsefes", "PRIVATE_KEY_END"},
 		},
-		{
-			name:       "Secret containing a percent sign",
-			lines:      "##[error]login failed for pass%25word",
-			secrets:    map[string]string{"TOKEN": "pass%word"},
-			disallowed: []string{"pass%25word"},
-		},
 	}
 	for _, entry := range table {
 		t.Run(entry.name, func(t *testing.T) {
@@ -58,17 +50,3 @@ func TestValueMasker(t *testing.T) {
 		})
 	}
 }
-
-func TestJobLogFormatterDecodesCommandData(t *testing.T) {
-	logger := logrus.New()
-	logger.Out = io.Discard
-	format := func(message string) string {
-		out, err := (&jobLogFormatter{}).Format(&logrus.Entry{Logger: logger, Message: message, Data: logrus.Fields{rawOutputField: true}})
-		require.NoError(t, err)
-		return string(out)
-	}
-
-	assert.Contains(t, format("##[error]deploy 50%25 traffic"), "##[error]deploy 50% traffic")
-	// a plain line is not command data and keeps its literal escapes
-	assert.Contains(t, format("progress 50%25 done"), "progress 50%25 done")
-}
--- a/act/runner/run_context.go
+++ b/act/runner/run_context.go
@@ -298,7 +298,7 @@ func (rc *RunContext) startHostEnvironment() common.Executor {
 			AllocatePTY: rc.Config.AllocatePTY,
 		}
 		rc.cleanUpJobContainer = rc.JobContainer.Remove()
-		for k, v := range rc.getRunnerContext(ctx) {
+		for k, v := range rc.JobContainer.GetRunnerContext(ctx) {
 			if v, ok := v.(string); ok {
 				rc.Env["RUNNER_"+strings.ToUpper(k)] = v
 			}
@@ -986,21 +986,6 @@ func (rc *RunContext) getStepsContext() map[string]*model.StepResult {
 	return rc.StepResults
 }

-// getRunnerContext returns the `runner` context: what the execution environment knows
-// (os, arch, temp, tool_cache) plus what only the runner process knows.
-func (rc *RunContext) getRunnerContext(ctx context.Context) map[string]any {
-	runnerContext := map[string]any{}
-	if rc.JobContainer != nil {
-		maps0.Copy(runnerContext, rc.JobContainer.GetRunnerContext(ctx))
-	}
-	runnerContext["name"] = rc.Config.RunnerName
-	runnerContext["environment"] = "self-hosted"
-	if rc.Config.RunnerDebug() {
-		runnerContext["debug"] = "1"
-	}
-	return runnerContext
-}
-
 func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext {
 	logger := common.Logger(ctx)
 	ghc := &model.GithubContext{
@@ -1185,7 +1170,7 @@ func nestedMapLookup(m map[string]any, ks ...string) (rval any) {
 	}
 }

-func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubContext, env map[string]string) {
+func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubContext, env map[string]string) map[string]string { //nolint:unparam // pre-existing issue from nektos/act
 	env["CI"] = "true"
 	env["GITHUB_WORKFLOW"] = github.Workflow
 	env["GITHUB_RUN_ID"] = github.RunID
@@ -1227,71 +1212,23 @@ func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubCon
 		env["GITHUB_RUN_ATTEMPT"] = github.RunAttempt
 	}

-	env["RUNNER_NAME"] = rc.Config.RunnerName
-	env["RUNNER_ENVIRONMENT"] = "self-hosted"
-	if workspace := parentDir(github.Workspace); workspace != "" {
-		env["RUNNER_WORKSPACE"] = workspace
-	}
-	if rc.Config.RunnerDebug() {
-		env["RUNNER_DEBUG"] = "1"
-	}
-
 	if rc.Config.ArtifactServerPath != "" {
 		setActionRuntimeVars(rc, env)
 	}

-	if imageOS := rc.imageOS(ctx); imageOS != "" {
-		env["ImageOS"] = imageOS
-	}
-}
-
-// parentDir returns the directory containing p, or "" when p names no parent. Both
-// separators are accepted rather than filepath's, as p may describe a container while
-// the runner itself runs on Windows, or the other way round.
-func parentDir(p string) string {
-	if slash := strings.LastIndexAny(p, `/\`); slash > 0 {
-		return p[:slash]
-	}
-	return ""
-}
-
-// imageOS returns ImageOS, which setup-* actions use to tell one runner image release
-// from another. The resolved image tag is preferred over the runs-on label because it
-// still names a release when the label is a rolling one such as ubuntu-latest.
-func (rc *RunContext) imageOS(ctx context.Context) string {
-	if rc.Run.Job().RunsOn() == nil {
-		// A composite action runs on a synthetic job, and resolving its image would only
-		// log that runs-on is missing.
-		return ""
-	}
-	if imageOS := imageOSFromImage(rc.platformImage(ctx)); imageOS != "" {
-		return imageOS
-	}
-
-	for _, platformName := range slices.Backward(rc.runsOnPlatformNames(ctx)) {
-		if platformName == "ubuntu-latest" {
-			// Rolling label whose image names no release either, so keep the historical value.
-			return "ubuntu20"
-		} else if platformName != "" {
-			return strings.SplitN(strings.Replace(platformName, `-`, ``, 1), `.`, 2)[0]
+	for _, platformName := range rc.runsOnPlatformNames(ctx) {
+		if platformName != "" {
+			if platformName == "ubuntu-latest" {
+				// hardcode current ubuntu-latest since we have no way to check that 'on the fly'
+				env["ImageOS"] = "ubuntu20"
+			} else {
+				platformName = strings.SplitN(strings.Replace(platformName, `-`, ``, 1), `.`, 2)[0]
+				env["ImageOS"] = platformName
+			}
 		}
 	}
-	return ""
-}

-// imageOSTag matches an image reference tagged with an OS family ImageOS can report plus
-// its release, such as "docker.gitea.com/runner-images:ubuntu-24.04". Anything else
-// ("ubuntu-latest", "app:22.04", "catthehacker/ubuntu:act-22.04", or a registry port) is
-// left to the runs-on label rather than turned into a bogus OS.
-var imageOSTag = regexp.MustCompile(`:(ubuntu|win|macos)-?([0-9]+)[^/]*$`)
-
-// imageOSFromImage derives ImageOS from an image reference, e.g.
-// "docker.gitea.com/runner-images:ubuntu-24.04" yields "ubuntu24".
-func imageOSFromImage(image string) string {
-	if match := imageOSTag.FindStringSubmatch(image); match != nil {
-		return match[1] + match[2]
-	}
-	return ""
+	return env
 }

 func setActionRuntimeVars(rc *RunContext, env map[string]string) {
--- a/act/runner/run_context_test.go
+++ b/act/runner/run_context_test.go
@@ -940,117 +940,3 @@ func TestRunContext_cleanupFailedStart(t *testing.T) {
 		assert.NotPanics(t, func() { (&RunContext{}).cleanupFailedStart(context.Background()) })
 	})
 }
-
-func TestImageOSFromImage(t *testing.T) {
-	for _, tc := range []struct {
-		image string
-		want  string
-	}{
-		{"", ""},
-		{"docker.gitea.com/runner-images:ubuntu-24.04", "ubuntu24"},
-		{"docker.gitea.com/runner-images:ubuntu-latest", ""},
-		{"runner-images:ubuntu22.04", "ubuntu22"},
-		{"node:20", ""},
-		{"ubuntu:22.04", ""},
-		{"ubuntu", ""},
-		{"catthehacker/ubuntu:act-22.04", ""},
-		{"myco/ubuntu:v2.1", ""},
-		{"myco/ubuntu:v22.04", ""},
-		{"app:release-1", ""},
-		{"app:1.2.3", ""},
-		{"app:build-2.1", ""},
-		{"registry.example.com:5000/runner-images", ""},
-		{"registry.example.com:5000/runner-images:ubuntu-24.04", "ubuntu24"},
-	} {
-		t.Run(tc.image, func(t *testing.T) {
-			assert.Equal(t, tc.want, imageOSFromImage(tc.image))
-		})
-	}
-}
-
-func createRunsOnRunContext(t *testing.T, runsOn string) *RunContext {
-	return createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, "runs-on: "+runsOn, ""),
-	})
-}
-
-func TestRunContextImageOS(t *testing.T) {
-	ctx := context.Background()
-
-	t.Run("prefers the release in the resolved image tag", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.Config.Platforms = map[string]string{
-			"ubuntu-latest": "docker.gitea.com/runner-images:ubuntu-24.04",
-		}
-		assert.Equal(t, "ubuntu24", rc.imageOS(ctx))
-	})
-
-	t.Run("falls back to the runs-on label", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-22.04")
-		rc.Config.Platforms = map[string]string{"ubuntu-22.04": "some-image"}
-		assert.Equal(t, "ubuntu22", rc.imageOS(ctx))
-	})
-
-	t.Run("keeps the historical value for a rolling label with no release", func(t *testing.T) {
-		assert.Equal(t, "ubuntu20", createRunsOnRunContext(t, "ubuntu-latest").imageOS(ctx))
-	})
-
-	t.Run("is empty for the synthetic job of a composite action", func(t *testing.T) {
-		rc := createIfTestRunContext(map[string]*model.Job{"job1": {}})
-		assert.Empty(t, rc.imageOS(ctx))
-	})
-}
-
-func TestRunContextGetRunnerContext(t *testing.T) {
-	ctx := context.Background()
-
-	t.Run("adds the runner values the container cannot know", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.Config.RunnerName = "runner-1"
-
-		runnerContext := rc.getRunnerContext(ctx)
-		assert.Equal(t, "runner-1", runnerContext["name"])
-		assert.Equal(t, "self-hosted", runnerContext["environment"])
-		assert.NotContains(t, runnerContext, "debug")
-	})
-
-	t.Run("reports debug when step debugging is on", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.Config.Secrets = map[string]string{"ACTIONS_STEP_DEBUG": "true"}
-
-		assert.Equal(t, "1", rc.getRunnerContext(ctx)["debug"])
-	})
-
-	t.Run("keeps the execution environment values", func(t *testing.T) {
-		rc := createRunsOnRunContext(t, "ubuntu-latest")
-		rc.JobContainer = &container.HostEnvironment{TmpDir: "/tmp/act", ToolCache: "/tmp/tool_cache"}
-
-		runnerContext := rc.getRunnerContext(ctx)
-		assert.Equal(t, "/tmp/act", runnerContext["temp"])
-		assert.Equal(t, "/tmp/tool_cache", runnerContext["tool_cache"])
-		assert.NotEmpty(t, runnerContext["os"])
-	})
-}
-
-func TestParentDir(t *testing.T) {
-	assert.Empty(t, parentDir(""))
-	assert.Empty(t, parentDir("repo"))
-	assert.Empty(t, parentDir("/repo"))
-	assert.Equal(t, "/workspace/owner", parentDir("/workspace/owner/repo"))
-	assert.Equal(t, `C:\workspace\owner`, parentDir(`C:\workspace\owner\repo`))
-}
-
-func TestRunContextWithGithubEnvRunnerValues(t *testing.T) {
-	ctx := context.Background()
-	rc := createRunsOnRunContext(t, "ubuntu-latest")
-	rc.Config.RunnerName = "runner-1"
-	rc.Config.Secrets = map[string]string{"ACTIONS_STEP_DEBUG": "true"}
-
-	env := map[string]string{}
-	rc.withGithubEnv(ctx, &model.GithubContext{Workspace: "/workspace/owner/repo"}, env)
-
-	assert.Equal(t, "runner-1", env["RUNNER_NAME"])
-	assert.Equal(t, "self-hosted", env["RUNNER_ENVIRONMENT"])
-	assert.Equal(t, "/workspace/owner", env["RUNNER_WORKSPACE"])
-	assert.Equal(t, "1", env["RUNNER_DEBUG"])
-}
--- a/act/runner/runner.go
+++ b/act/runner/runner.go
@@ -92,14 +92,6 @@ type Config struct {
 	InsecureSkipTLS                   bool                         // whether to skip verifying TLS certificate of the Gitea instance
 	MaxParallel                       int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
 	AllocatePTY                       bool                         // allocate a pseudo-TTY for each step's process
-	RunnerName                        string                       // name this runner registered with, reported as `runner.name`, defaults to the hostname
-}
-
-// RunnerDebug reports whether debug logging is on, exposed as `runner.debug` and
-// RUNNER_DEBUG. Only the secret also makes the reporter keep ::debug:: output, the env
-// is accepted for `exec` and for runners configured with it.
-func (c Config) RunnerDebug() bool {
-	return c.Secrets["ACTIONS_STEP_DEBUG"] == "true" || c.Env["ACTIONS_STEP_DEBUG"] == "true"
 }

 // GetToken: Adapt to Gitea
@@ -145,11 +137,6 @@ func New(runnerConfig *Config) (Runner, error) {
 }

 func (runner *runnerImpl) configure() (Runner, error) {
-	if runner.config.RunnerName == "" {
-		// Callers that do not register, such as `exec`, still get a `runner.name`.
-		runner.config.RunnerName, _ = os.Hostname()
-	}
-
 	runner.eventJSON = "{}"
 	if runner.config.EventJSON != "" {
 		runner.eventJSON = runner.config.EventJSON
--- a/act/runner/step.go
+++ b/act/runner/step.go
@@ -181,7 +181,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			}

 			if continueOnError {
-				logger.Errorf("##[error]%s", escapeCommandData(err.Error()))
+				logger.Errorf("##[error]%v", err)
 				logger.Infof("Failed but continue next step")
 				err = nil
 				stepResult.Conclusion = model.StepStatusSuccess
--- a/act/runner/step_run.go
+++ b/act/runner/step_run.go
@@ -63,7 +63,7 @@ func (sr *stepRun) printRunScriptActionDetails(ctx context.Context) {

 	normalized := strings.TrimRight(strings.ReplaceAll(sr.interpolatedScript, "\r\n", "\n"), "\n")

-	rawLogger.Infof("::group::Run %s", escapeCommandData(sr.runScriptGroupTitle(normalized)))
+	rawLogger.Infof("::group::Run %s", sr.runScriptGroupTitle(normalized))

 	if normalized != "" {
 		for line := range strings.SplitSeq(normalized, "\n") {
@@ -90,7 +90,7 @@ func printRunActionHeader(ctx context.Context, step *model.Step, env map[string]
 	if step.Name != "" {
 		title = step.Name
 	}
-	rawLogger.Infof("::group::Run %s", escapeCommandData(title))
+	rawLogger.Infof("::group::Run %s", title)

 	if len(step.With) > 0 {
 		rawLogger.Infof("with:")
--- a/act/runner/step_test.go
+++ b/act/runner/step_test.go
@@ -167,9 +167,6 @@ func TestSetupEnv(t *testing.T) {
 	delete((env), "GITHUB_REPOSITORY")
 	delete((env), "GITHUB_REPOSITORY_OWNER")
 	delete((env), "GITHUB_ACTOR")
-	// Host-dependent, asserted in TestRunContextWithGithubEnvRunnerValues instead.
-	delete((env), "RUNNER_NAME")
-	delete((env), "RUNNER_WORKSPACE")

 	assert.Equal(t, map[string]string{
 		"ACT":                      "true",
@@ -195,7 +192,6 @@ func TestSetupEnv(t *testing.T) {
 		"GITHUB_WORKFLOW":          "",
 		"INPUT_STEP_WITH":          "with-value",
 		"RC_KEY":                   "rcvalue",
-		"RUNNER_ENVIRONMENT":       "self-hosted",
 		"RUNNER_PERFLOG":           "/dev/null",
 		"RUNNER_TRACKING_ID":       "",
 	}, env)
--- a/act/runner/testdata/actions/action1/Dockerfile
+++ b/act/runner/testdata/actions/action1/Dockerfile
@@ -1 +1 @@
-FROM ubuntu:26.04
+FROM ubuntu:24.04
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/selinux v1.15.1
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.24.0
+	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2
 	github.com/rhysd/actionlint v1.7.12
 	github.com/sirupsen/logrus v1.9.4
@@ -73,7 +73,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/compress v1.19.0 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-runewidth v0.0.21 // indirect
@@ -86,8 +86,8 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/common v0.70.0 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
@@ -98,14 +98,15 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
--- a/go.sum
+++ b/go.sum
@@ -47,6 +47,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v29.6.1+incompatible h1:oO7F4nn3Ovr/5TlfTUWFbMwBSS/B7Xs6Epv26gBrUP8=
+github.com/docker/cli v29.6.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw=
 github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.6 h1:cT2PbRPSlnMmNTfT2TDMXRyQ1KMWHG7xoTLBcn1ZNv0=
@@ -102,8 +104,8 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
-github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
-github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -117,6 +119,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-isatty v0.0.23 h1:cYwCQTQf3HB6xUC+BtyCLZNr7IzbOmoZbmssVNzSyiQ=
 github.com/mattn/go-isatty v0.0.23/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
@@ -155,14 +159,14 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
-github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
-github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
 github.com/rhysd/actionlint v1.7.12 h1:vQ4GeJN86C0QH+gTUQcs8McmK62OLT3kmakPMtEWYnY=
 github.com/rhysd/actionlint v1.7.12/go.mod h1:krOUhujIsJusovkaYzQ/VNH8PFexjNKqU0q5XI/4w+g=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
@@ -214,32 +218,34 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
 go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
 go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
 go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
 go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
 go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -256,6 +262,8 @@ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9sn
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
--- a/internal/app/run/runner.go
+++ b/internal/app/run/runner.go
@@ -474,7 +474,6 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		Vars:                              task.Vars,
 		ValidVolumes:                      r.cfg.Container.ValidVolumes,
 		InsecureSkipTLS:                   r.cfg.Runner.Insecure,
-		RunnerName:                        r.name,
 	}

 	rr, err := runner.New(runnerConfig)
--- a/renovate.json5
+++ b/renovate.json5
@@ -2,11 +2,5 @@
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>gitea/renovate-config"
-  ],
-  "packageRules": [
-    {
-      "matchPackageNames": ["go.yaml.in/yaml/v4"],
-      "allowedVersions": "<4.0.0-rc.4", // rc.4 removes the error types actionlint builds against
-    },
-  ],
+  ]
 }
--- a/scripts/upload-r2.sh
+++ b/scripts/upload-r2.sh
@@ -1,112 +0,0 @@
-#!/bin/sh
-# Copyright 2026 The Gitea Authors. All rights reserved.
-# SPDX-License-Identifier: MIT
-#
-# upload-r2.sh uploads a single local file to a single object key in a
-# Cloudflare R2 bucket, using curl's built-in AWS SigV4 signer (R2 is
-# S3-API compatible).
-#
-# This is the R2 half of the release process's parallel S3+R2 upload
-# period: goreleaser's `blobs:` pipe still uploads every release
-# artifact to AWS S3, and this script is invoked once per artifact
-# (via a goreleaser `publishers:` entry) to mirror the same artifact
-# into R2. Once the migration away from S3 is complete, the `blobs:`
-# block and the AWS_* secrets can be dropped without touching this
-# script.
-#
-# Usage:
-#   upload-r2.sh <local-file> <remote-key>
-#   upload-r2.sh --check-config
-#
-# The second form only validates that the required environment
-# variables below are set (it does not touch the network or the
-# filesystem beyond that), and is meant to be run as an early
-# preflight step in CI: goreleaser custom publishers run as the very
-# last step of the publish pipeline, so without a preflight check a
-# missing R2_* secret would only be discovered after the Gitea release
-# has already been created and every artifact already uploaded to S3.
-#
-# Required environment variables:
-#   R2_ENDPOINT          Base URL of the R2 endpoint, e.g.
-#                        https://<account>.r2.cloudflarestorage.com
-#   R2_BUCKET            Destination bucket name.
-#   R2_ACCESS_KEY_ID     R2 access key id.
-#   R2_SECRET_ACCESS_KEY R2 secret access key.
-
-set -eu
-
-# check_env validates that all required R2_* environment variables are
-# set and non-empty, printing a single "missing required environment
-# variable(s): ..." message and exiting non-zero otherwise. Used by
-# both the normal upload mode and --check-config, so the validation
-# logic only exists in one place.
-check_env() {
-  missing=""
-
-  if [ -z "${R2_ENDPOINT:-}" ]; then
-    missing="$missing R2_ENDPOINT"
-  fi
-  if [ -z "${R2_BUCKET:-}" ]; then
-    missing="$missing R2_BUCKET"
-  fi
-  if [ -z "${R2_ACCESS_KEY_ID:-}" ]; then
-    missing="$missing R2_ACCESS_KEY_ID"
-  fi
-  if [ -z "${R2_SECRET_ACCESS_KEY:-}" ]; then
-    missing="$missing R2_SECRET_ACCESS_KEY"
-  fi
-
-  if [ -n "$missing" ]; then
-    echo "upload-r2.sh: missing required environment variable(s):$missing" >&2
-    exit 1
-  fi
-}
-
-if [ "$#" -eq 1 ] && [ "$1" = "--check-config" ]; then
-  check_env
-  echo "upload-r2.sh: R2 configuration OK"
-  exit 0
-fi
-
-if [ "$#" -ne 2 ]; then
-  echo "usage: upload-r2.sh <local-file> <remote-key>" >&2
-  echo "       upload-r2.sh --check-config" >&2
-  exit 1
-fi
-
-local_file="$1"
-remote_key="$2"
-
-if [ ! -f "$local_file" ]; then
-  echo "upload-r2.sh: local file not found: $local_file" >&2
-  exit 1
-fi
-
-check_env
-
-# Strip a single trailing slash from the endpoint, if present, so that
-# building the path-style URL below never produces a double slash.
-endpoint="${R2_ENDPOINT%/}"
-url="$endpoint/$R2_BUCKET/$remote_key"
-
-# Credentials are passed to curl through a config file read from
-# stdin rather than as a command-line argument, so they never show up
-# in `ps` output.
-#
-# --fail-with-body (instead of plain --fail) still exits non-zero on
-# HTTP errors, but also prints R2's XML error body, which is where the
-# actual error code lives (SignatureDoesNotMatch, NoSuchBucket,
-# AccessDenied, ...); with plain --fail that body is discarded and the
-# failure is silent. --retry 3 (without --retry-all-errors) still
-# retries the transient cases (5xx, 408, 429, connection failures);
-# --retry-all-errors would additionally retry permanent 4xx responses
-# three times with backoff, which only delays an inevitable failure.
-printf 'user = "%s:%s"\n' "$R2_ACCESS_KEY_ID" "$R2_SECRET_ACCESS_KEY" | curl \
-  --config - \
-  --fail-with-body \
-  --silent \
-  --show-error \
-  --retry 3 \
-  --aws-sigv4 "aws:amz:auto:s3" \
-  --upload-file "$local_file" \
-  "$url"