From 403489591e7f722e789233c7090ee972cbaff542 Mon Sep 17 00:00:00 2001
From: Earl Warren <contact@earl-warren.org>
Date: Mon, 20 Oct 2025 21:05:05 +0000
Subject: [PATCH] Revert "chore(cleanup): lxc-helpers does not need a global
 lock (#1047)" (#1103)

This reverts commit 996ac343ee155a4b47d89a6bf1854feb1c04fdb2.

The lock is still needed to guard against the following scenario.

https://code.forgejo.org/forgejo/runner/src/commit/d92a892ecebb7d5d362f252c487635c1fb9a4c6e/act/runner/run_context.go#L225-L236

- two or more jobs start
- one of them creates the act template (`lxc_build_template $(lxc_template_release) $name`) - lxc-helpers now has transactions and they won't race against each other
- once it is built all jobs will then try to install node in the container that was just built and race against each other

with a global lock only the first one will build and populate the act template. The other will then do nothing because it already exists.

The bug can trivially be reproduced with:

```yaml
on:
  pull_request:

jobs:
  test1:
    runs-on: lxc
    steps:
      - run: echo OK1
  test2:
    runs-on: lxc
    steps:
      - run: echo OK2
  test3:
    runs-on: lxc
    steps:
      - run: echo OK3
```

<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1103): <!--number 1103 --><!--line 0 --><!--description UmV2ZXJ0ICJjaG9yZShjbGVhbnVwKTogbHhjLWhlbHBlcnMgZG9lcyBub3QgbmVlZCBhIGdsb2JhbCBsb2NrICgjMTA0Nyki-->Revert "chore(cleanup): lxc-helpers does not need a global lock (#1047)"<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1103
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: limiting-factor <limiting-factor@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
---
 act/runner/run_context.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/act/runner/run_context.go b/act/runner/run_context.go
index 9e4c2981..dd72ff09 100644
--- a/act/runner/run_context.go
+++ b/act/runner/run_context.go
@@ -193,6 +193,8 @@ var lxcHelpers string
 
 var startTemplate = template.Must(template.New("start").Parse(`#!/bin/bash -e
 
+exec 5<>/tmp/forgejo-runner-lxc.lock ; flock --timeout 21600 5
+
 LXC_CONTAINER_CONFIG="{{.Config}}"
 LXC_CONTAINER_RELEASE="{{.Release}}"