From d4c1ab636f541c69066e988a8bf53cda81e87cdc Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Thu, 31 Jul 2025 09:51:59 +0200 Subject: [PATCH 001/281] chore(renovate): ignore `node_modules` --- renovate.json | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/renovate.json b/renovate.json index 6fbdba64..35fe2b42 100644 --- a/renovate.json +++ b/renovate.json @@ -3,16 +3,11 @@ "extends": ["local>forgejo/renovate-config"], "prConcurrentLimit": 1, "packageRules": [ - { - "description": "Disable act test data", - "matchFileNames": ["**/testdata/**"], - "enabled": false - }, { "description": "Separate minor and patch for some packages", "matchDepNames": ["github.com/rhysd/actionlint"], "separateMinorPatch": true } ], - "ignorePaths": [] + "ignorePaths": ["**/node_modules/**"] } From c68ca8195b401d757b66a90fababdf20a41ea5c8 Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Thu, 31 Jul 2025 09:57:36 +0200 Subject: [PATCH 002/281] chore(renovate): ignore act test data --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 35fe2b42..43a1e4f1 100644 --- a/renovate.json +++ b/renovate.json @@ -9,5 +9,5 @@ "separateMinorPatch": true } ], - "ignorePaths": ["**/node_modules/**"] + "ignorePaths": ["act/*/testdata/**", "**/node_modules/**"] } From 2e7b2e9281aeb6d51af843bf66dcaef346075e7c Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Thu, 31 Jul 2025 10:01:23 +0200 Subject: [PATCH 003/281] chore(renovate): ignore all test data --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 43a1e4f1..e654a18d 100644 --- a/renovate.json +++ b/renovate.json @@ -9,5 +9,5 @@ "separateMinorPatch": true } ], - "ignorePaths": ["act/*/testdata/**", "**/node_modules/**"] + "ignorePaths": ["**/testdata/**", "**/node_modules/**"] } From 10d7d8ddedbcf9c8d0166969f47d99dc06516dfb Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 31 Jul 2025 08:02:20 +0000 Subject: [PATCH 004/281] chore: release notes are now published together with the release (#775) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/775): chore: release notes are now published together with the release Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/775 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- RELEASE-NOTES.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md index c3399c89..d6e4e299 100644 --- a/RELEASE-NOTES.md +++ b/RELEASE-NOTES.md @@ -1,8 +1,6 @@ # Release Notes -## 9.0.0 - -* Breaking change: forgejo-runner exec --artifact-server-* options are deprecated. In order to test workflows using the artifact server, a local Forgejo instance can be used. +As of [Forgejo runner v9.0.0](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.0) the release notes are published in the release itself and this file will no longer be updated. ## 8.0.1 From f94fe37f90a4194ada2aa4924db28398b635959c Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 31 Jul 2025 08:38:03 +0000 Subject: [PATCH 005/281] Update module github.com/docker/docker to v28.3.3+incompatible [SECURITY] (#776) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/776 Reviewed-by: Michael Kriese Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 789c25a5..6fabbf3d 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 github.com/docker/cli v28.2.2+incompatible - github.com/docker/docker v28.3.2+incompatible + github.com/docker/docker v28.3.3+incompatible github.com/docker/go-connections v0.5.0 github.com/go-git/go-billy/v5 v5.6.1 github.com/go-git/go-git/v5 v5.13.1 diff --git a/go.sum b/go.sum index 920dee8c..1b8fe3f7 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A= github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/docker v28.3.2+incompatible h1:wn66NJ6pWB1vBZIilP8G3qQPqHy5XymfYn5vsqeA5oA= -github.com/docker/docker v28.3.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI= +github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40= github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c= From ec99579451b7b44cfd2ad01e48a006cd903dedf7 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 31 Jul 2025 10:35:11 +0000 Subject: [PATCH 006/281] chore: to allow the runner to be imported, v9 needs to be in the go module (#777) It will be imported by Forgejo. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/777): chore: to allow the runner to be imported, v9 needs to be in the go module Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/777 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- Makefile | 4 ++-- act/artifactcache/handler.go | 4 ++-- act/artifactcache/mac.go | 2 +- act/artifactcache/mac_test.go | 2 +- act/cacheproxy/handler.go | 2 +- act/common/git/git.go | 2 +- act/common/git/git_test.go | 2 +- act/container/container_types.go | 2 +- act/container/docker_auth.go | 2 +- act/container/docker_build.go | 2 +- act/container/docker_network.go | 2 +- act/container/docker_pull.go | 2 +- act/container/docker_run.go | 4 ++-- act/container/docker_run_test.go | 2 +- act/container/docker_stub.go | 2 +- act/container/docker_volume.go | 2 +- act/container/host_environment.go | 6 +++--- act/container/parse_env_file.go | 2 +- act/exprparser/functions.go | 2 +- act/exprparser/functions_test.go | 2 +- act/exprparser/interpreter.go | 2 +- act/exprparser/interpreter_test.go | 2 +- act/jobparser/evaluator.go | 2 +- act/jobparser/interpeter.go | 4 ++-- act/jobparser/jobparser.go | 2 +- act/jobparser/model.go | 2 +- act/jobparser/model_test.go | 2 +- act/jobparser/testdata_test.go | 2 +- act/model/action.go | 2 +- act/model/github_context.go | 4 ++-- act/model/workflow.go | 4 ++-- act/runner/action.go | 6 +++--- act/runner/action_cache.go | 2 +- act/runner/action_composite.go | 4 ++-- act/runner/action_test.go | 2 +- act/runner/command.go | 2 +- act/runner/command_test.go | 4 ++-- act/runner/container_mock_test.go | 4 ++-- act/runner/expression.go | 8 ++++---- act/runner/expression_test.go | 4 ++-- act/runner/job_executor.go | 6 +++--- act/runner/job_executor_test.go | 6 +++--- act/runner/local_repository_cache.go | 2 +- act/runner/logger.go | 2 +- act/runner/reusable_workflow.go | 6 +++--- act/runner/run_context.go | 8 ++++---- act/runner/run_context_test.go | 8 ++++---- act/runner/runner.go | 4 ++-- act/runner/runner_test.go | 4 ++-- act/runner/step.go | 8 ++++---- act/runner/step_action_local.go | 4 ++-- act/runner/step_action_local_test.go | 4 ++-- act/runner/step_action_remote.go | 6 +++--- act/runner/step_action_remote_test.go | 6 +++--- act/runner/step_docker.go | 6 +++--- act/runner/step_docker_test.go | 4 ++-- act/runner/step_factory.go | 2 +- act/runner/step_factory_test.go | 2 +- act/runner/step_run.go | 8 ++++---- act/runner/step_run_test.go | 4 ++-- act/runner/step_test.go | 4 ++-- go.mod | 2 +- internal/app/cmd/cache-server.go | 4 ++-- internal/app/cmd/cmd.go | 4 ++-- internal/app/cmd/create-runner-file.go | 8 ++++---- internal/app/cmd/create-runner-file_test.go | 6 +++--- internal/app/cmd/daemon.go | 14 +++++++------- internal/app/cmd/exec.go | 8 ++++---- internal/app/cmd/job.go | 14 +++++++------- internal/app/cmd/main_test.go | 2 +- internal/app/cmd/register.go | 8 ++++---- internal/app/cmd/validate.go | 4 ++-- internal/app/job/job.go | 6 +++--- internal/app/job/job_test.go | 2 +- internal/app/poll/poller.go | 6 +++--- internal/app/poll/poller_test.go | 2 +- internal/app/run/runner.go | 20 ++++++++++---------- internal/app/run/runner_test.go | 2 +- internal/app/run/workflow.go | 2 +- internal/app/run/workflow_test.go | 2 +- internal/pkg/report/reporter.go | 2 +- internal/pkg/report/reporter_test.go | 4 ++-- internal/pkg/ver/version.go | 2 +- main.go | 2 +- 84 files changed, 172 insertions(+), 172 deletions(-) diff --git a/Makefile b/Makefile index 50e12958..6b728dad 100644 --- a/Makefile +++ b/Makefile @@ -62,10 +62,10 @@ else endif endif -GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/internal/pkg/client/mocks,$(shell $(GO) list ./...)) +GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/v9/internal/pkg/client/mocks,$(shell $(GO) list ./...)) TAGS ?= -LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/internal/pkg/ver.version=v$(RELEASE_VERSION)" +LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=v$(RELEASE_VERSION)" all: build diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 2d62abaf..b50b6b11 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -20,8 +20,8 @@ import ( "github.com/timshannon/bolthold" "go.etcd.io/bbolt" - "code.forgejo.org/forgejo/runner/act/cacheproxy" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" + "code.forgejo.org/forgejo/runner/v9/act/common" ) const ( diff --git a/act/artifactcache/mac.go b/act/artifactcache/mac.go index 8a1d7a3a..6ed20b01 100644 --- a/act/artifactcache/mac.go +++ b/act/artifactcache/mac.go @@ -11,7 +11,7 @@ import ( "strconv" "time" - "code.forgejo.org/forgejo/runner/act/cacheproxy" + "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" ) var ErrValidation = errors.New("validation error") diff --git a/act/artifactcache/mac_test.go b/act/artifactcache/mac_test.go index 17531ec6..a4b801a9 100644 --- a/act/artifactcache/mac_test.go +++ b/act/artifactcache/mac_test.go @@ -5,7 +5,7 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/act/cacheproxy" + "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" "github.com/stretchr/testify/require" ) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index dddee822..79d3f14b 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -22,7 +22,7 @@ import ( "github.com/julienschmidt/httprouter" "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) const ( diff --git a/act/common/git/git.go b/act/common/git/git.go index e86ca63e..1748e797 100644 --- a/act/common/git/git.go +++ b/act/common/git/git.go @@ -19,7 +19,7 @@ import ( "github.com/mattn/go-isatty" log "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) var ( diff --git a/act/common/git/git_test.go b/act/common/git/git_test.go index 445ee062..f03720e9 100644 --- a/act/common/git/git_test.go +++ b/act/common/git/git_test.go @@ -13,7 +13,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) func TestFindGitSlug(t *testing.T) { diff --git a/act/container/container_types.go b/act/container/container_types.go index e077c45e..3d3a5162 100644 --- a/act/container/container_types.go +++ b/act/container/container_types.go @@ -4,7 +4,7 @@ import ( "context" "io" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/go-connections/nat" ) diff --git a/act/container/docker_auth.go b/act/container/docker_auth.go index e76fd182..01b0c816 100644 --- a/act/container/docker_auth.go +++ b/act/container/docker_auth.go @@ -6,7 +6,7 @@ import ( "context" "strings" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/cli/cli/config" "github.com/docker/cli/cli/config/credentials" "github.com/docker/docker/api/types/registry" diff --git a/act/container/docker_build.go b/act/container/docker_build.go index e88d226b..7b8dd906 100644 --- a/act/container/docker_build.go +++ b/act/container/docker_build.go @@ -14,7 +14,7 @@ import ( "github.com/moby/patternmatcher" "github.com/moby/patternmatcher/ignorefile" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) // NewDockerBuildExecutor function to create a run executor for the container diff --git a/act/container/docker_network.go b/act/container/docker_network.go index 29e936e1..23d884f6 100644 --- a/act/container/docker_network.go +++ b/act/container/docker_network.go @@ -5,7 +5,7 @@ package container import ( "context" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/docker/api/types/network" ) diff --git a/act/container/docker_pull.go b/act/container/docker_pull.go index 53c084a0..3b1ad5c7 100644 --- a/act/container/docker_pull.go +++ b/act/container/docker_pull.go @@ -13,7 +13,7 @@ import ( "github.com/docker/docker/api/types/image" "github.com/docker/docker/api/types/registry" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) // NewDockerPullExecutor function to create a run executor for the container diff --git a/act/container/docker_run.go b/act/container/docker_run.go index a954fc63..73672325 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -37,8 +37,8 @@ import ( "github.com/spf13/pflag" "golang.org/x/term" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/filecollector" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/filecollector" ) // NewContainer creates a reference to a container diff --git a/act/container/docker_run_test.go b/act/container/docker_run_test.go index d5c52656..53a812f6 100644 --- a/act/container/docker_run_test.go +++ b/act/container/docker_run_test.go @@ -11,7 +11,7 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/docker/api/types" "github.com/docker/docker/api/types/container" diff --git a/act/container/docker_stub.go b/act/container/docker_stub.go index 12baf137..2f3624fd 100644 --- a/act/container/docker_stub.go +++ b/act/container/docker_stub.go @@ -6,7 +6,7 @@ import ( "context" "runtime" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/docker/api/types/network" "github.com/docker/docker/api/types/system" "github.com/pkg/errors" diff --git a/act/container/docker_volume.go b/act/container/docker_volume.go index 2e7c54eb..94e4036b 100644 --- a/act/container/docker_volume.go +++ b/act/container/docker_volume.go @@ -5,7 +5,7 @@ package container import ( "context" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/docker/api/types/filters" "github.com/docker/docker/api/types/volume" ) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 5940b434..045d7774 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -20,9 +20,9 @@ import ( "github.com/go-git/go-git/v5/plumbing/format/gitignore" "golang.org/x/term" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/filecollector" - "code.forgejo.org/forgejo/runner/act/lookpath" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/filecollector" + "code.forgejo.org/forgejo/runner/v9/act/lookpath" ) type HostEnvironment struct { diff --git a/act/container/parse_env_file.go b/act/container/parse_env_file.go index 606a33ae..227facb4 100644 --- a/act/container/parse_env_file.go +++ b/act/container/parse_env_file.go @@ -8,7 +8,7 @@ import ( "io" "strings" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Executor { diff --git a/act/exprparser/functions.go b/act/exprparser/functions.go index 49827ecf..297df879 100644 --- a/act/exprparser/functions.go +++ b/act/exprparser/functions.go @@ -15,7 +15,7 @@ import ( "github.com/go-git/go-git/v5/plumbing/format/gitignore" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/rhysd/actionlint" ) diff --git a/act/exprparser/functions_test.go b/act/exprparser/functions_test.go index 3560cf3d..e8525efa 100644 --- a/act/exprparser/functions_test.go +++ b/act/exprparser/functions_test.go @@ -4,7 +4,7 @@ import ( "path/filepath" "testing" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" ) diff --git a/act/exprparser/interpreter.go b/act/exprparser/interpreter.go index 9a5386fe..202ade22 100644 --- a/act/exprparser/interpreter.go +++ b/act/exprparser/interpreter.go @@ -7,7 +7,7 @@ import ( "reflect" "strings" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/rhysd/actionlint" ) diff --git a/act/exprparser/interpreter_test.go b/act/exprparser/interpreter_test.go index d2f27413..4a7741fa 100644 --- a/act/exprparser/interpreter_test.go +++ b/act/exprparser/interpreter_test.go @@ -4,7 +4,7 @@ import ( "math" "testing" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" ) diff --git a/act/jobparser/evaluator.go b/act/jobparser/evaluator.go index 7c5243da..16f520b1 100644 --- a/act/jobparser/evaluator.go +++ b/act/jobparser/evaluator.go @@ -5,7 +5,7 @@ import ( "regexp" "strings" - "code.forgejo.org/forgejo/runner/act/exprparser" + "code.forgejo.org/forgejo/runner/v9/act/exprparser" "gopkg.in/yaml.v3" ) diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go index 6a634ceb..f798121a 100644 --- a/act/jobparser/interpeter.go +++ b/act/jobparser/interpeter.go @@ -1,8 +1,8 @@ package jobparser import ( - "code.forgejo.org/forgejo/runner/act/exprparser" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/exprparser" + "code.forgejo.org/forgejo/runner/v9/act/model" "gopkg.in/yaml.v3" ) diff --git a/act/jobparser/jobparser.go b/act/jobparser/jobparser.go index f958197b..0fd1768e 100644 --- a/act/jobparser/jobparser.go +++ b/act/jobparser/jobparser.go @@ -8,7 +8,7 @@ import ( "gopkg.in/yaml.v3" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" ) func Parse(content []byte, validate bool, options ...ParseOption) ([]*SingleWorkflow, error) { diff --git a/act/jobparser/model.go b/act/jobparser/model.go index 00c4789b..ac1d871d 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -3,7 +3,7 @@ package jobparser import ( "fmt" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "gopkg.in/yaml.v3" ) diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index 78163d18..30dc4890 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -5,7 +5,7 @@ import ( "strings" "testing" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" diff --git a/act/jobparser/testdata_test.go b/act/jobparser/testdata_test.go index 4394a396..dfbf2f76 100644 --- a/act/jobparser/testdata_test.go +++ b/act/jobparser/testdata_test.go @@ -6,7 +6,7 @@ import ( "path/filepath" "testing" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/require" ) diff --git a/act/model/action.go b/act/model/action.go index c0ddb2b1..62b1d025 100644 --- a/act/model/action.go +++ b/act/model/action.go @@ -5,7 +5,7 @@ import ( "io" "strings" - "code.forgejo.org/forgejo/runner/act/schema" + "code.forgejo.org/forgejo/runner/v9/act/schema" "gopkg.in/yaml.v3" ) diff --git a/act/model/github_context.go b/act/model/github_context.go index 931ca928..e7c8809e 100644 --- a/act/model/github_context.go +++ b/act/model/github_context.go @@ -5,8 +5,8 @@ import ( "fmt" "strings" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/common/git" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common/git" ) type GithubContext struct { diff --git a/act/model/workflow.go b/act/model/workflow.go index 826d371d..ab6ad296 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -10,8 +10,8 @@ import ( "strconv" "strings" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/schema" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/schema" log "github.com/sirupsen/logrus" "gopkg.in/yaml.v3" ) diff --git a/act/runner/action.go b/act/runner/action.go index c272d64e..16961cd3 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -16,9 +16,9 @@ import ( "github.com/kballard/go-shellquote" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type actionStep interface { diff --git a/act/runner/action_cache.go b/act/runner/action_cache.go index f531548e..219656cf 100644 --- a/act/runner/action_cache.go +++ b/act/runner/action_cache.go @@ -18,7 +18,7 @@ import ( "github.com/go-git/go-git/v5/plumbing/transport" "github.com/go-git/go-git/v5/plumbing/transport/http" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) type ActionCache interface { diff --git a/act/runner/action_composite.go b/act/runner/action_composite.go index 7882b186..fdee793d 100644 --- a/act/runner/action_composite.go +++ b/act/runner/action_composite.go @@ -6,8 +6,8 @@ import ( "regexp" "strings" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" ) func evaluateCompositeInputAndEnv(ctx context.Context, parent *RunContext, step actionStep) map[string]string { diff --git a/act/runner/action_test.go b/act/runner/action_test.go index 68f38eee..a5d9e1d7 100644 --- a/act/runner/action_test.go +++ b/act/runner/action_test.go @@ -7,7 +7,7 @@ import ( "strings" "testing" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/command.go b/act/runner/command.go index d0b3754c..98942322 100644 --- a/act/runner/command.go +++ b/act/runner/command.go @@ -5,7 +5,7 @@ import ( "regexp" "strings" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" ) var ( diff --git a/act/runner/command_test.go b/act/runner/command_test.go index 0edf9e4a..b2c3824a 100644 --- a/act/runner/command_test.go +++ b/act/runner/command_test.go @@ -10,8 +10,8 @@ import ( "github.com/sirupsen/logrus/hooks/test" "github.com/stretchr/testify/assert" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" ) func TestCommandSetEnv(t *testing.T) { diff --git a/act/runner/container_mock_test.go b/act/runner/container_mock_test.go index 5fc401f6..5d884a21 100644 --- a/act/runner/container_mock_test.go +++ b/act/runner/container_mock_test.go @@ -4,8 +4,8 @@ import ( "context" "io" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/expression.go b/act/runner/expression.go index 34eadf17..a81c7d39 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -12,10 +12,10 @@ import ( _ "embed" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/exprparser" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/exprparser" + "code.forgejo.org/forgejo/runner/v9/act/model" "gopkg.in/yaml.v3" ) diff --git a/act/runner/expression_test.go b/act/runner/expression_test.go index 974d58ff..3bebc301 100644 --- a/act/runner/expression_test.go +++ b/act/runner/expression_test.go @@ -4,8 +4,8 @@ import ( "context" "testing" - "code.forgejo.org/forgejo/runner/act/exprparser" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/exprparser" + "code.forgejo.org/forgejo/runner/v9/act/model" assert "github.com/stretchr/testify/assert" yaml "gopkg.in/yaml.v3" ) diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index cda661e2..c3bcb4b8 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -5,9 +5,9 @@ import ( "fmt" "time" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type jobInfo interface { diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index f0e5a23a..cd940f8d 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -6,9 +6,9 @@ import ( "io" "testing" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/local_repository_cache.go b/act/runner/local_repository_cache.go index e64a8965..984ee2cd 100644 --- a/act/runner/local_repository_cache.go +++ b/act/runner/local_repository_cache.go @@ -12,7 +12,7 @@ import ( "path/filepath" "strings" - "code.forgejo.org/forgejo/runner/act/filecollector" + "code.forgejo.org/forgejo/runner/v9/act/filecollector" ) type LocalRepositoryCache struct { diff --git a/act/runner/logger.go b/act/runner/logger.go index 395de0e1..f8d4f000 100644 --- a/act/runner/logger.go +++ b/act/runner/logger.go @@ -9,7 +9,7 @@ import ( "strings" "sync" - "code.forgejo.org/forgejo/runner/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/sirupsen/logrus" "golang.org/x/term" diff --git a/act/runner/reusable_workflow.go b/act/runner/reusable_workflow.go index 835a111c..3a805b0a 100644 --- a/act/runner/reusable_workflow.go +++ b/act/runner/reusable_workflow.go @@ -12,9 +12,9 @@ import ( "strings" "sync" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/common/git" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common/git" + "code.forgejo.org/forgejo/runner/v9/act/model" ) func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor { diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 67742aaa..52b742b0 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -20,10 +20,10 @@ import ( "text/template" "time" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/exprparser" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/exprparser" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/docker/docker/api/types/network" "github.com/docker/go-connections/nat" "github.com/opencontainers/selinux/go-selinux" diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index df53f93a..24caa4ad 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -10,10 +10,10 @@ import ( "strings" "testing" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/exprparser" - "code.forgejo.org/forgejo/runner/act/model" - "code.forgejo.org/forgejo/runner/testutils" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/exprparser" + "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v9/testutils" "github.com/docker/go-connections/nat" log "github.com/sirupsen/logrus" diff --git a/act/runner/runner.go b/act/runner/runner.go index 516b06a3..19aea849 100644 --- a/act/runner/runner.go +++ b/act/runner/runner.go @@ -11,8 +11,8 @@ import ( docker_container "github.com/docker/docker/api/types/container" log "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" ) // Runner provides capabilities to run GitHub actions diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 796038b8..2d3bed57 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -16,8 +16,8 @@ import ( assert "github.com/stretchr/testify/assert" "gopkg.in/yaml.v3" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" ) var ( diff --git a/act/runner/step.go b/act/runner/step.go index efe63d02..72102e8c 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -8,10 +8,10 @@ import ( "strings" "time" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/exprparser" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/exprparser" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type step interface { diff --git a/act/runner/step_action_local.go b/act/runner/step_action_local.go index 3ef8d07f..79f1a542 100644 --- a/act/runner/step_action_local.go +++ b/act/runner/step_action_local.go @@ -11,8 +11,8 @@ import ( "path" "path/filepath" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type stepActionLocal struct { diff --git a/act/runner/step_action_local_test.go b/act/runner/step_action_local_test.go index d62f118d..c988d3b1 100644 --- a/act/runner/step_action_local_test.go +++ b/act/runner/step_action_local_test.go @@ -8,8 +8,8 @@ import ( "strings" "testing" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" "gopkg.in/yaml.v3" diff --git a/act/runner/step_action_remote.go b/act/runner/step_action_remote.go index 83260c02..920960c5 100644 --- a/act/runner/step_action_remote.go +++ b/act/runner/step_action_remote.go @@ -14,9 +14,9 @@ import ( gogit "github.com/go-git/go-git/v5" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/common/git" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common/git" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type stepActionRemote struct { diff --git a/act/runner/step_action_remote_test.go b/act/runner/step_action_remote_test.go index 52cd88ee..864a580e 100644 --- a/act/runner/step_action_remote_test.go +++ b/act/runner/step_action_remote_test.go @@ -11,9 +11,9 @@ import ( "github.com/stretchr/testify/mock" "gopkg.in/yaml.v3" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/common/git" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/common/git" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type stepActionRemoteMocks struct { diff --git a/act/runner/step_docker.go b/act/runner/step_docker.go index bc2d38ae..5ecddd21 100644 --- a/act/runner/step_docker.go +++ b/act/runner/step_docker.go @@ -5,9 +5,9 @@ import ( "fmt" "strings" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/kballard/go-shellquote" ) diff --git a/act/runner/step_docker_test.go b/act/runner/step_docker_test.go index 9a2a259f..9608978e 100644 --- a/act/runner/step_docker_test.go +++ b/act/runner/step_docker_test.go @@ -6,8 +6,8 @@ import ( "io" "testing" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/step_factory.go b/act/runner/step_factory.go index 1da9ed28..6435d37e 100644 --- a/act/runner/step_factory.go +++ b/act/runner/step_factory.go @@ -3,7 +3,7 @@ package runner import ( "fmt" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type stepFactory interface { diff --git a/act/runner/step_factory_test.go b/act/runner/step_factory_test.go index 2e63f499..af8cf968 100644 --- a/act/runner/step_factory_test.go +++ b/act/runner/step_factory_test.go @@ -3,7 +3,7 @@ package runner import ( "testing" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" ) diff --git a/act/runner/step_run.go b/act/runner/step_run.go index 7cb30a3a..3c84b554 100644 --- a/act/runner/step_run.go +++ b/act/runner/step_run.go @@ -8,10 +8,10 @@ import ( "github.com/kballard/go-shellquote" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/lookpath" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/lookpath" + "code.forgejo.org/forgejo/runner/v9/act/model" ) type stepRun struct { diff --git a/act/runner/step_run_test.go b/act/runner/step_run_test.go index d35704e1..611b1274 100644 --- a/act/runner/step_run_test.go +++ b/act/runner/step_run_test.go @@ -9,8 +9,8 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" - "code.forgejo.org/forgejo/runner/act/container" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v9/act/model" ) func TestStepRun(t *testing.T) { diff --git a/act/runner/step_test.go b/act/runner/step_test.go index d973dce0..b7bb31dd 100644 --- a/act/runner/step_test.go +++ b/act/runner/step_test.go @@ -4,8 +4,8 @@ import ( "context" "testing" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" diff --git a/go.mod b/go.mod index 6fabbf3d..a6ce2c21 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,4 @@ -module code.forgejo.org/forgejo/runner +module code.forgejo.org/forgejo/runner/v9 go 1.23.0 diff --git a/internal/app/cmd/cache-server.go b/internal/app/cmd/cache-server.go index bb4d774c..ff233f19 100644 --- a/internal/app/cmd/cache-server.go +++ b/internal/app/cmd/cache-server.go @@ -9,9 +9,9 @@ import ( "os" "os/signal" - "code.forgejo.org/forgejo/runner/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/act/artifactcache" + "code.forgejo.org/forgejo/runner/v9/act/artifactcache" log "github.com/sirupsen/logrus" "github.com/spf13/cobra" ) diff --git a/internal/app/cmd/cmd.go b/internal/app/cmd/cmd.go index 00b84301..c3a98a88 100644 --- a/internal/app/cmd/cmd.go +++ b/internal/app/cmd/cmd.go @@ -10,8 +10,8 @@ import ( "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/internal/pkg/config" - "code.forgejo.org/forgejo/runner/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" ) func Execute(ctx context.Context) { diff --git a/internal/app/cmd/create-runner-file.go b/internal/app/cmd/create-runner-file.go index fdfc65e9..0eeb713b 100644 --- a/internal/app/cmd/create-runner-file.go +++ b/internal/app/cmd/create-runner-file.go @@ -14,10 +14,10 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/internal/app/run" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" - "code.forgejo.org/forgejo/runner/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v9/internal/app/run" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" ) type createRunnerFileArgs struct { diff --git a/internal/app/cmd/create-runner-file_test.go b/internal/app/cmd/create-runner-file_test.go index 4d786076..d12cc325 100644 --- a/internal/app/cmd/create-runner-file_test.go +++ b/internal/app/cmd/create-runner-file_test.go @@ -8,9 +8,9 @@ import ( "testing" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" - "code.forgejo.org/forgejo/runner/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" "connectrpc.com/connect" "github.com/stretchr/testify/assert" diff --git a/internal/app/cmd/daemon.go b/internal/app/cmd/daemon.go index 592372dc..0a9815ed 100644 --- a/internal/app/cmd/daemon.go +++ b/internal/app/cmd/daemon.go @@ -18,13 +18,13 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/internal/app/poll" - "code.forgejo.org/forgejo/runner/internal/app/run" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" - "code.forgejo.org/forgejo/runner/internal/pkg/envcheck" - "code.forgejo.org/forgejo/runner/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v9/internal/app/poll" + "code.forgejo.org/forgejo/runner/v9/internal/app/run" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/envcheck" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" ) func runDaemon(ctx context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go index d04c2f5d..8c197711 100644 --- a/internal/app/cmd/exec.go +++ b/internal/app/cmd/exec.go @@ -13,10 +13,10 @@ import ( "strings" "time" - "code.forgejo.org/forgejo/runner/act/artifactcache" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" - "code.forgejo.org/forgejo/runner/act/runner" + "code.forgejo.org/forgejo/runner/v9/act/artifactcache" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v9/act/runner" "github.com/docker/docker/api/types/container" "github.com/joho/godotenv" log "github.com/sirupsen/logrus" diff --git a/internal/app/cmd/job.go b/internal/app/cmd/job.go index b195a86a..3be1f635 100644 --- a/internal/app/cmd/job.go +++ b/internal/app/cmd/job.go @@ -13,13 +13,13 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/internal/app/job" - "code.forgejo.org/forgejo/runner/internal/app/run" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" - "code.forgejo.org/forgejo/runner/internal/pkg/envcheck" - "code.forgejo.org/forgejo/runner/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v9/internal/app/job" + "code.forgejo.org/forgejo/runner/v9/internal/app/run" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/envcheck" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" ) func runJob(ctx context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { diff --git a/internal/app/cmd/main_test.go b/internal/app/cmd/main_test.go index 6283b8a4..588490e8 100644 --- a/internal/app/cmd/main_test.go +++ b/internal/app/cmd/main_test.go @@ -10,7 +10,7 @@ import ( "os" "testing" - "code.forgejo.org/forgejo/runner/testutils" + "code.forgejo.org/forgejo/runner/v9/testutils" "github.com/spf13/cobra" "github.com/stretchr/testify/require" diff --git a/internal/app/cmd/register.go b/internal/app/cmd/register.go index 8e66cb89..dd369381 100644 --- a/internal/app/cmd/register.go +++ b/internal/app/cmd/register.go @@ -20,10 +20,10 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" - "code.forgejo.org/forgejo/runner/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" ) // runRegister registers a runner to the server diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index b2a73ebf..3285ff6f 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -13,8 +13,8 @@ import ( "path/filepath" "strings" - "code.forgejo.org/forgejo/runner/act/model" - "code.forgejo.org/forgejo/runner/testutils" + "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v9/testutils" "github.com/spf13/cobra" ) diff --git a/internal/app/job/job.go b/internal/app/job/job.go index 9a7638a1..2dd06852 100644 --- a/internal/app/job/job.go +++ b/internal/app/job/job.go @@ -13,9 +13,9 @@ import ( log "github.com/sirupsen/logrus" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/internal/app/run" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/app/run" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" ) type Job struct { diff --git a/internal/app/job/job_test.go b/internal/app/job/job_test.go index 8d4376b0..9799425b 100644 --- a/internal/app/job/job_test.go +++ b/internal/app/job/job_test.go @@ -11,7 +11,7 @@ import ( "code.forgejo.org/forgejo/actions-proto/ping/v1/pingv1connect" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" "code.forgejo.org/forgejo/actions-proto/runner/v1/runnerv1connect" - "code.forgejo.org/forgejo/runner/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" diff --git a/internal/app/poll/poller.go b/internal/app/poll/poller.go index 61b1c2ff..4ebe4405 100644 --- a/internal/app/poll/poller.go +++ b/internal/app/poll/poller.go @@ -15,9 +15,9 @@ import ( log "github.com/sirupsen/logrus" "golang.org/x/time/rate" - "code.forgejo.org/forgejo/runner/internal/app/run" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/app/run" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" ) const PollerID = "PollerID" diff --git a/internal/app/poll/poller_test.go b/internal/app/poll/poller_test.go index eedc0fee..0c5febfe 100644 --- a/internal/app/poll/poller_test.go +++ b/internal/app/poll/poller_test.go @@ -14,7 +14,7 @@ import ( "code.forgejo.org/forgejo/actions-proto/ping/v1/pingv1connect" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" "code.forgejo.org/forgejo/actions-proto/runner/v1/runnerv1connect" - "code.forgejo.org/forgejo/runner/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index ce3587a8..e8d91822 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -16,20 +16,20 @@ import ( "time" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/act/artifactcache" - "code.forgejo.org/forgejo/runner/act/cacheproxy" - "code.forgejo.org/forgejo/runner/act/common" - "code.forgejo.org/forgejo/runner/act/model" - "code.forgejo.org/forgejo/runner/act/runner" + "code.forgejo.org/forgejo/runner/v9/act/artifactcache" + "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" + "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v9/act/runner" "connectrpc.com/connect" "github.com/docker/docker/api/types/container" log "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/internal/pkg/client" - "code.forgejo.org/forgejo/runner/internal/pkg/config" - "code.forgejo.org/forgejo/runner/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/internal/pkg/report" - "code.forgejo.org/forgejo/runner/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/report" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" ) // Runner runs the pipeline. diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 849b95a4..a9a8445d 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -7,7 +7,7 @@ import ( "testing" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" "github.com/stretchr/testify/assert" ) diff --git a/internal/app/run/workflow.go b/internal/app/run/workflow.go index 4b4007f0..601f36d1 100644 --- a/internal/app/run/workflow.go +++ b/internal/app/run/workflow.go @@ -10,7 +10,7 @@ import ( "strings" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "gopkg.in/yaml.v3" ) diff --git a/internal/app/run/workflow_test.go b/internal/app/run/workflow_test.go index 049edb79..f0ac579c 100644 --- a/internal/app/run/workflow_test.go +++ b/internal/app/run/workflow_test.go @@ -7,7 +7,7 @@ import ( "testing" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/act/model" + "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/require" "gotest.tools/v3/assert" ) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 518fa6ac..6d08269c 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -19,7 +19,7 @@ import ( "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/timestamppb" - "code.forgejo.org/forgejo/runner/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" ) var ( diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index 5a7563c8..2839c847 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -20,8 +20,8 @@ import ( "github.com/stretchr/testify/require" "google.golang.org/protobuf/types/known/structpb" - "code.forgejo.org/forgejo/runner/internal/pkg/client/mocks" - "code.forgejo.org/forgejo/runner/testutils" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/client/mocks" + "code.forgejo.org/forgejo/runner/v9/testutils" ) func rowsToString(rows []*runnerv1.LogRow) string { diff --git a/internal/pkg/ver/version.go b/internal/pkg/ver/version.go index e843ec21..9efc8739 100644 --- a/internal/pkg/ver/version.go +++ b/internal/pkg/ver/version.go @@ -3,7 +3,7 @@ package ver -// go build -ldflags "-X code.forgejo.org/forgejo/runner/internal/pkg/ver.version=1.2.3" +// go build -ldflags "-X code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=1.2.3" var version = "dev" func Version() string { diff --git a/main.go b/main.go index 18eeee6e..498bd129 100644 --- a/main.go +++ b/main.go @@ -8,7 +8,7 @@ import ( "os/signal" "syscall" - "code.forgejo.org/forgejo/runner/internal/app/cmd" + "code.forgejo.org/forgejo/runner/v9/internal/app/cmd" ) func main() { From 194c416f2909a9bd75ac83108a770dc31b5c722d Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 1 Aug 2025 05:18:02 +0000 Subject: [PATCH 007/281] Update dependency forgejo/release-notes-assistant to v1.3.6 (#778) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/778 Reviewed-by: Michael Kriese Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/release-notes-assistant.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 76c18aa7..057c6ec7 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -11,7 +11,7 @@ on: - labeled env: - RNA_VERSION: v1.3.5 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org + RNA_VERSION: v1.3.6 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org jobs: release-notes: From 51fb504a2e2981739547c23d3a588a080aebea39 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 1 Aug 2025 14:04:02 +0000 Subject: [PATCH 008/281] feat: add an LXC based example of docker/build-push-action usage (#781) The motivations for this additional example are: - Using https://github.com/docker/build-push-action/ with the Forgejo runner is a recurring question and there is no example of how to do that - Reproducing https://code.forgejo.org/forgejo/runner/issues/208 will benefit from this example --- - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/781): feat: add an LXC based example of docker/build-push-action usage [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/781 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .../docker-build-push-action-in-lxc.yml | 78 +++++++++++++++++++ examples/README.md | 5 +- examples/docker-build-push-action/Dockerfile | 1 + examples/docker-build-push-action/README.md | 3 + 4 files changed, 85 insertions(+), 2 deletions(-) create mode 100644 .forgejo/workflows/docker-build-push-action-in-lxc.yml create mode 100644 examples/docker-build-push-action/Dockerfile create mode 100644 examples/docker-build-push-action/README.md diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml new file mode 100644 index 00000000..fe6b4eed --- /dev/null +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -0,0 +1,78 @@ +# +# Example that requires a Forgejo runner with an [LXC backend](https://forgejo.org/docs/latest/admin/actions/runner-installation/#setting-up-the-container-environment). +# +# - Start a Forgejo instance to be used as a container registry +# - Build a container image using the [docker/build-push-action](https://code.forgejo.org/docker/build-push-action) action +# - Push the image to the Forgejo instance +# - Retrieve the image +# +# Runs of this workflow can be seen in [the Forgejo runner](https://code.forgejo.org/forgejo/runner/actions?workflow=docker-build-push-action-in-lxc.yml) logs. +# +name: example +on: + push: + branches: + - 'main' + pull_request: + +env: + FORGEJO_VERSION: 11.0.3 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_USER: root + FORGEJO_PASSWORD: admin1234 + +jobs: + docker-build-push-action-in-lxc: + if: forge.repository_owner != 'forgejo-integration' && forge.repository_owner != 'forgejo-experimental' && forge.repository_owner != 'forgejo-release' + runs-on: lxc-bookworm + + steps: + + - name: install Forgejo so it can be used as a container registry + id: registry + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.1 + with: + user: ${{ env.FORGEJO_USER }} + password: ${{ env.FORGEJO_PASSWORD }} + binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v${{ env.FORGEJO_VERSION }}/forgejo-${{ env.FORGEJO_VERSION }}-linux-amd64 + lxc-ip-prefix: 10.0.9 + + - name: enable insecure / http uploads to the Forgejo registry + run: |- + set -x + # the docker daemon was implicitly installed when Forgejo was + # installed in the previous step. But it will refuse to connect + # to an insecure / http registry by default and must be told + # otherwise + cat > /etc/docker/daemon.json < Date: Fri, 1 Aug 2025 14:06:32 +0000 Subject: [PATCH 009/281] chore(ci): autoremove when running a workflow in a test (#780) Otherwise resources linger when tests are checking for conditions that require a workflow to fail. ```sh earl-warren:~/software/runner$ go test -count=1 -run='TestJobExecutorWorkflows/uses-github-short-sha' ./act/runner ok code.forgejo.org/forgejo/runner/v9/act/runner 0.276s earl-warren:~/software/runner$ docker network ls | grep WORKFLOW 2e57caeb514d WORKFLOW-cc93880718786fef12c18e53feecee5c8ef1cc155840bf4c0275a2fca61b99b9_JOB-test-test-network bridge local earl-warren:~/software/runner$ ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/780): chore(ci): autoremove when running a workflow in a test Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/780 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/runner_test.go | 1 + 1 file changed, 1 insertion(+) diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 2d3bed57..9ecb4ff8 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -190,6 +190,7 @@ func (j *TestJobFileInfo) runTest(ctx context.Context, t *testing.T, cfg *Config Matrix: cfg.Matrix, JobLoggerLevel: cfg.JobLoggerLevel, ActionCache: cfg.ActionCache, + AutoRemove: true, } runner, err := New(runnerConfig) From aec904c94ec1bf1ecd73684e8ef1722a8d027c1f Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 1 Aug 2025 17:22:33 +0000 Subject: [PATCH 010/281] chore: the release link to RELEASE-NOTES.md is no longer needed (#782) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/782): chore: the release link to RELEASE-NOTES.md is no longer needed Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/782 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/build-release.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index 11289165..09582cc3 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -63,11 +63,12 @@ jobs: - name: release notes id: release-notes run: | - anchor=${{ steps.tag-version.outputs.value }} - anchor=${anchor//./-} cat >> "$FORGEJO_OUTPUT" < Date: Fri, 1 Aug 2025 17:23:19 +0000 Subject: [PATCH 011/281] feat: use cache-{from,to}: type=gha in the docker/build-push-action example (#783) Resolves forgejo/runner#208 - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/783): feat: use cache-{from,to}: type=gha in the docker/build-push-action example Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/783 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index fe6b4eed..1b913008 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -71,6 +71,8 @@ jobs: context: examples/docker-build-push-action push: true tags: ${{ steps.registry.outputs.host-port }}/root/testimage:latest + cache-from: type=gha,scope=docker-build-push-action-in-lxc + cache-to: type=gha,scope=docker-build-push-action-in-lxc - name: verify the image can be read from the Forgejo registry run: | From 6b031f4780624513fc363de61932d6750ca7acec Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 00:33:14 +0000 Subject: [PATCH 012/281] Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.4.1 (#788) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/forgejo/forgejo-build-publish](https://data.forgejo.org/forgejo/forgejo-build-publish) | action | patch | `v5.4.0` -> `v5.4.1` | --- ### Release Notes
forgejo/forgejo-build-publish (https://data.forgejo.org/forgejo/forgejo-build-publish) ### [`v5.4.1`](https://data.forgejo.org/forgejo/forgejo-build-publish/compare/v5.4.0...v5.4.1) [Compare Source](https://data.forgejo.org/forgejo/forgejo-build-publish/compare/v5.4.0...v5.4.1)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/788 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release.yml | 4 ++-- .forgejo/workflows/publish-release.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index 09582cc3..3224bf7d 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -74,7 +74,7 @@ jobs: - name: build without TOKEN if: ${{ secrets.TOKEN == '' }} - uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.4.0 + uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.4.1 with: forgejo: "${{ env.FORGEJO_SERVER_URL }}" owner: "${{ env.FORGEJO_REPOSITORY_OWNER }}" @@ -91,7 +91,7 @@ jobs: - name: build with TOKEN if: ${{ secrets.TOKEN != '' }} - uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.4.0 + uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.4.1 with: forgejo: "${{ env.FORGEJO_SERVER_URL }}" owner: "${{ env.FORGEJO_REPOSITORY_OWNER }}" diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml index 31b4c58e..085428c6 100644 --- a/.forgejo/workflows/publish-release.yml +++ b/.forgejo/workflows/publish-release.yml @@ -29,7 +29,7 @@ jobs: - uses: https://data.forgejo.org/actions/checkout@v4 - name: copy & sign - uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@v5.4.0 + uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@v5.4.1 with: from-forgejo: ${{ vars.FORGEJO }} to-forgejo: ${{ vars.FORGEJO }} From b26db065d6846391cce10513b381d0740b9c8ad3 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 2 Aug 2025 06:38:42 +0000 Subject: [PATCH 013/281] fix: vars context is allowed in default values of action inputs (#786) Resolves forgejo/runner#785 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/786): fix: vars context is allowed in default values of action inputs Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/786 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/schema/action_schema.json | 1 + act/schema/schema_test.go | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/act/schema/action_schema.json b/act/schema/action_schema.json index 2b2a22f0..c0f7b69a 100644 --- a/act/schema/action_schema.json +++ b/act/schema/action_schema.json @@ -177,6 +177,7 @@ "matrix", "job", "runner", + "vars", "hashFiles(1,255)" ], "string": {} diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index 5941fc40..d7bc383f 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -140,7 +140,7 @@ inputs: default: '${{ env.GITHUB_SERVER_URL }}' repo: description: 'repo description' - default: '${{ github.repository }}' + default: '${{ github.repository }} ${{ vars.VARIABLE }}' runs: using: "composite" steps: From 82f2c1e1f9e6d88b1c5f5df67ac073e29c28c2ae Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 2 Aug 2025 11:37:51 +0000 Subject: [PATCH 014/281] chore: the release link to RELEASE-NOTES.md is no longer needed (take 2) (#789) the previous change updated how the release notes are set when building the release. This only happens in integration and never used see https://code.forgejo.org/forgejo-integration/runner/releases/tag/v9.0.2 for instance what matters is how the release notes are set when publishing the release. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/789): chore: the release link to RELEASE-NOTES.md is no longer needed (take 2) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/789 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/build-release.yml | 14 -------------- .forgejo/workflows/publish-release.yml | 6 +++++- 2 files changed, 5 insertions(+), 15 deletions(-) diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index 3224bf7d..4bfcf411 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -60,18 +60,6 @@ jobs: version=${FORGEJO_REF_NAME##*v} echo "value=$version" >> "$FORGEJO_OUTPUT" - - name: release notes - id: release-notes - run: | - cat >> "$FORGEJO_OUTPUT" < Date: Sat, 2 Aug 2025 17:29:04 +0000 Subject: [PATCH 015/281] Update module github.com/go-git/go-billy/v5 to v5.6.2 (#787) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `v5.6.1` -> `v5.6.2` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-billy%2fv5/v5.6.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-billy%2fv5/v5.6.1/v5.6.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
go-git/go-billy (github.com/go-git/go-billy/v5) ### [`v5.6.2`](https://github.com/go-git/go-billy/releases/tag/v5.6.2) [Compare Source](https://github.com/go-git/go-billy/compare/v5.6.1...v5.6.2) #### What's Changed - Enable the `iofs` adapter to also return other interfaces from `io/fs` by [@​JAORMX](https://github.com/JAORMX) in https://github.com/go-git/go-billy/pull/102 - build: Bump dependencies by [@​pjbgf](https://github.com/pjbgf) in https://github.com/go-git/go-billy/pull/103 #### New Contributors - [@​JAORMX](https://github.com/JAORMX) made their first contribution in https://github.com/go-git/go-billy/pull/102 **Full Changelog**: https://github.com/go-git/go-billy/compare/v5.6.1...v5.6.2
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/787 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index a6ce2c21..2db313f8 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/docker/cli v28.2.2+incompatible github.com/docker/docker v28.3.3+incompatible github.com/docker/go-connections v0.5.0 - github.com/go-git/go-billy/v5 v5.6.1 + github.com/go-git/go-billy/v5 v5.6.2 github.com/go-git/go-git/v5 v5.13.1 github.com/gobwas/glob v0.2.3 github.com/google/uuid v1.6.0 diff --git a/go.sum b/go.sum index 1b8fe3f7..445783ae 100644 --- a/go.sum +++ b/go.sum @@ -63,8 +63,8 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= -github.com/go-git/go-billy/v5 v5.6.1 h1:u+dcrgaguSSkbjzHwelEjc0Yj300NUevrrPphk/SoRA= -github.com/go-git/go-billy/v5 v5.6.1/go.mod h1:0AsLr1z2+Uksi4NlElmMblP5rPcDZNRCD8ujZCRR2BE= +github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM= +github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= github.com/go-git/go-git/v5 v5.13.1 h1:DAQ9APonnlvSWpvolXWIuV6Q6zXy2wHbN4cVlNR5Q+M= From 5285f39e6b4b63d0bc33819455da076a93a72ec1 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 17:56:34 +0000 Subject: [PATCH 016/281] Update module github.com/rhysd/actionlint to v1.7.7 (#791) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.6.27` -> `v1.7.7` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2frhysd%2factionlint/v1.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2frhysd%2factionlint/v1.6.27/v1.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
rhysd/actionlint (github.com/rhysd/actionlint) ### [`v1.7.7`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v177---2025-01-19) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.6...v1.7.7) - Support runner labels for [Linux arm64 hosted runners](https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/). ([#​503](https://github.com/rhysd/actionlint/issues/503), [#​504](https://github.com/rhysd/actionlint/issues/504), thanks [@​martincostello](https://github.com/martincostello)) - `ubuntu-24.04-arm` - `ubuntu-22.04-arm` - Update Go dependencies to the latest. - Update the popular actions data set to the latest. - Add Linux arm64 job to the CI workflow. Now actionlint is tested on the platform. ([#​507](https://github.com/rhysd/actionlint/issues/507), thanks [@​cclauss](https://github.com/cclauss)) \[Changes]\[v1.7.7] ### [`v1.7.6`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v176---2025-01-04) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.5...v1.7.6) - Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. ([#​495](https://github.com/rhysd/actionlint/issues/495), [#​497](https://github.com/rhysd/actionlint/issues/497), [#​498](https://github.com/rhysd/actionlint/issues/498), [#​500](https://github.com/rhysd/actionlint/issues/500)) - `jobs..steps.with.args` - `jobs..steps.with.entrypoint` - `jobs..services..env` - Update Go dependencies to the latest. \[Changes]\[v1.7.6] ### [`v1.7.5`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v175---2024-12-28) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.4...v1.7.5) - Strictly check available contexts in `${{ }}` placeholders following the ['Context availability' table](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#context-availability) in the official document. - For example, `jobs..defaults.run.shell` allows `env` context but `shell` workflow keys in other places allow no context. ```yaml defaults: run: ``` ### ERROR: No context is available here ``` shell: ${{ env.SHELL }} jobs: test: runs-on: ubuntu-latest defaults: run: ``` ### OK: 'env' context is available here ``` shell: ${{ env.SHELL }} steps: - run: echo hello ``` ### ERROR: No context is available here ```` shell: ${{ env.SHELL}} ``` ```` - Check a string literal passed to `fromJSON()` call. This pattern is [popular](https://github.com/search?q=fromJSON%28%27+lang%3Ayaml\&type=code) to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the [document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#contexts-and-built-in-functions) for more details. ([#​464](https://github.com/rhysd/actionlint/issues/464)) ```yaml jobs: test: ``` ### ERROR: Key 'mac' does not exist in the object returned by the fromJSON() ``` runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }} steps: - run: echo This is a special branch! ``` ### ERROR: Broken JSON string passed to fromJSON. ``` if: contains(fromJSON('["main","release","dev"'), github.ref_name) ``` ```` - Allow passing command arguments to `-shellcheck` argument. ([#​483](https://github.com/rhysd/actionlint/issues/483), thanks [@​anuraaga](https://github.com/anuraaga)) - This is useful when you want to use alternative build of shellcheck like [go-shellcheck](https://github.com/wasilibs/go-shellcheck/). ```sh actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest" ``` - Support undocumented `repository_visibility`, `artifact_cache_size_limit`, `step_summary`, `output`, `state` properties in `github` context. ([#​489](https://github.com/rhysd/actionlint/issues/489), thanks [@​rasa](https://github.com/rasa) for adding `repository_visibility` property) - Remove `macos-12` runner label from known labels because it was [dropped](https://github.com/actions/runner-images/issues/10721) from GitHub-hosted runners on Dec. 3 and is no longer available. - Add `windows-2025` runner label to the known labels. The runner is in [public preview](https://github.blog/changelog/2024-12-19-windows-server-2025-is-now-in-public-preview/). ([#​491](https://github.com/rhysd/actionlint/issues/491), thanks [@​ericcornelissen](https://github.com/ericcornelissen)) - Add `black` to the list of colors for `branding.color` action metadata. ([#​485](https://github.com/rhysd/actionlint/issues/485), thanks [@​eifinger](https://github.com/eifinger)) - Add `table` to the list of icons for `branding.icon` action metadata. - Fix parsing escaped `{` in `format()` function call's first argument. - Fix the incorrect `join()` function overload. `join(s1: string, s2: string)` was wrongly accepted. - Update popular actions data set to the latest. - Add `download-artifact/v3-node20` to the data set. ([#​468](https://github.com/rhysd/actionlint/issues/468)) - Fix missing the `reviewdog/action-hadolint@v1` action input. ([#​487](https://github.com/rhysd/actionlint/issues/487), thanks [@​mi-wada](https://github.com/mi-wada)) - Link to the documents of the stable version in actionlint `man` page and `-help` output. - Refactor `LintStdin()` API example and some unit tests. ([#​472](https://github.com/rhysd/actionlint/issues/472), [#​475](https://github.com/rhysd/actionlint/issues/475), thanks [@​alexandear](https://github.com/alexandear)) - Improve the configuration example in `actionlint.yaml` document to explain glob patterns for `paths`. ([#​481](https://github.com/rhysd/actionlint/issues/481)) [Changes][v1.7.5] ```` ### [`v1.7.4`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v174---2024-11-04) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.3...v1.7.4) - Disallow the usage of popular actions that run on `node16` runner. The `node16` runner [will reach the end of life on November 12](https://github.blog/changelog/2024-09-25-end-of-life-for-actions-node16/). - In case of the error, please update your actions to the latest version so that they run on the latest `node20` runner. - If you're using self-hosted runner and you cannot upgrade your runner to `node20` soon, please consider to ignore the error by the `paths` configuration described below. - If you're using `actions/upload-artifact@v3` and `actions/download-artifact@v3` on GHES, please replace them with `actions/upload-artifact@v3-node20` and `actions/download-artifact@v3-node20`. ([#​468](https://github.com/rhysd/actionlint/issues/468)) - Provide the configuration for ignoring errors by regular expressions in `actionlint.yml` (or `actionlint.yaml`). Please see the [document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/config.md) for more details. ([#​217](https://github.com/rhysd/actionlint/issues/217), [#​342](https://github.com/rhysd/actionlint/issues/342)) - The `paths` is a mapping from the file path glob pattern to the corresponding configuration. The `ignore` configuration is a list of regular expressions to match error messages (similar to the `-ignore` command line option). ```yaml paths: ``` ### This pattern matches any YAML file under the '.github/workflows/' directory. ``` .github/workflows/**/*.yaml: ignore: ``` ### Ignore the specific error from shellcheck ``` - 'shellcheck reported issue in this script: SC2086:.+' ``` ### This pattern only matches '.github/workflows/release.yaml' file. ``` .github/workflows/release.yaml: ignore: ``` ### Ignore errors from the old runner check. This may be useful for (outdated) self-hosted runner environment. ```` - 'the runner of ".+" action is too old to run on GitHub Actions' ``` ```` - This configuration was not implemented initially because I wanted to keep the configuration as minimal as possible. However, due to several requests for it, the configuration has now been added. - Untrusted inputs check is safely skipped inside specific function calls. ([#​459](https://github.com/rhysd/actionlint/issues/459), thanks [@​IlyaGulya](https://github.com/IlyaGulya)) - For example, the following step contains the untrusted input `github.head_ref`, but it is safe because it's passed to the `contains()` argument. ```yaml - run: echo "is_release_branch=${{ contains(github.head_ref, 'release') }}" >> "$GITHUB_OUTPUT" ``` - For more details, please read the [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#untrusted-inputs). - Recognize `gcr.io` and `gcr.dev` as the correct container registry hosts. ([#​463](https://github.com/rhysd/actionlint/issues/463), thanks [@​takaidohigasi](https://github.com/takaidohigasi)) - Note that it is recommended explicitly specifying the scheme like `docker://gcr.io/...`. - Remove `macos-x.0` runner labels which are no longer available. ([#​452](https://github.com/rhysd/actionlint/issues/452)) - Disable shellcheck [`SC2043`](https://www.shellcheck.net/wiki/SC2043) rule because it can cause false positives on checking `run:`. ([#​355](https://github.com/rhysd/actionlint/issues/355)) - The [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#check-shellcheck-integ) was updated as well. ([#​466](https://github.com/rhysd/actionlint/issues/466), thanks [@​risu729](https://github.com/risu729)) - Fix the error message was not deterministic when detecting cycles in `needs` dependencies. - Fix the check for `format()` function was not applied when the function name contains upper case like `Format()`. Note that function names in `${{ }}` placeholders are case-insensitive. - Update the popular actions data set to the latest. - This includes the [new `ref` and `commit` outputs](https://github.com/actions/checkout/pull/1180) of `actions/checkout`. - Add [`actions/cache/save`](https://github.com/actions/cache/tree/main/save) and [`actions/cache/restore`](https://github.com/actions/cache/tree/main/restore) to the popular actions data set. - Links in the [README.md](https://github.com/rhysd/actionlint/blob/main/README.md) now point to the document of the latest version tag instead of HEAD of `main` branch. - Add [`Linter.LintStdin`](https://pkg.go.dev/github.com/rhysd/actionlint#Linter.LintStdin) method dedicated to linting STDIN instead of handling STDIN in `Command`. - (Dev) Add new [`check-checks` script](https://github.com/rhysd/actionlint/tree/main/scripts/check-checks) to maintain the ['Checks' document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md). It automatically updates the outputs and playground links for example inputs in the document. It also checks the document is up-to-date on CI. Please read the [document](https://github.com/rhysd/actionlint/blob/main/scripts/check-checks/README.md) for more details. [Documentation](https://github.com/rhysd/actionlint/tree/v1.7.4/docs) \[Changes]\[v1.7.4] ### [`v1.7.3`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v173---2024-09-29) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.2...v1.7.3) - Remove `macos-11` runner labels because [macOS 11 runner was dropped on 6/28/2024](https://github.blog/changelog/2024-05-20-actions-upcoming-changes-to-github-hosted-macos-runners/#macos-11-deprecation-and-removal). ([#​451](https://github.com/rhysd/actionlint/issues/451), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Support `macos-15`, `macos-15-large`, and `macos-15-xlarge` runner labels. The macOS 15 runner is not globally available yet, but [they are available in beta](https://github.com/actions/runner-images?tab=readme-ov-file#available-images). ([#​453](https://github.com/rhysd/actionlint/issues/453), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Release artifact includes checksums for the released binaries. The file name is `actionlint_{version}_checksums.txt`. ([#​449](https://github.com/rhysd/actionlint/issues/449)) - For example, the checksums for v1.7.3 can be found [here](https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_checksums.txt). - Fix `download-path` output is missing in `actions/download-artifact@v3` action. ([#​442](https://github.com/rhysd/actionlint/issues/442)) - Note that the latest version `actions/download-artifact@v4` was not affected by this issue. - Support Go 1.23. [Documentation](https://github.com/rhysd/actionlint/blob/v1.7.3/docs/checks.md) \[Changes]\[v1.7.3] ### [`v1.7.2`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v172---2024-09-23) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.1...v1.7.2) - Fix child processes to run in parallel. - Update the popular actions data set to the latest. ([#​442](https://github.com/rhysd/actionlint/issues/442), [#​445](https://github.com/rhysd/actionlint/issues/445), [#​446](https://github.com/rhysd/actionlint/issues/446), [#​447](https://github.com/rhysd/actionlint/issues/447), thanks [@​maikelvdh](https://github.com/maikelvdh)) - Add support for checking branch filters on [`merge_group` event](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#merge_group). ([#​448](https://github.com/rhysd/actionlint/issues/448), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - [The playground](https://rhysd.github.io/actionlint/) now supports both light and dark modes and automatically applies the system's theme. - Fix releasing a failure on making a new winget package. ([#​438](https://github.com/rhysd/actionlint/issues/438), thanks [@​vedantmgoyal9](https://github.com/vedantmgoyal9)) \[Changes]\[v1.7.2] ### [`v1.7.1`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v171---2024-05-28) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.0...v1.7.1) - Support `ubuntu-24.04` runner label, which was [recently introduced as beta](https://github.blog/changelog/2024-05-14-github-hosted-runners-public-beta-of-ubuntu-24-04-is-now-available/). ([#​425](https://github.com/rhysd/actionlint/issues/425), thanks [@​bitcoin-tools](https://github.com/bitcoin-tools)) - Remove the support for `macos-10` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2022-07-20-github-actions-the-macos-10-15-actions-runner-image-is-being-deprecated-and-will-be-removed-by-8-30-22/). - Remove the support for `windows-2016` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2021-10-19-github-actions-the-windows-2016-runner-image-will-be-removed-from-github-hosted-runners-on-march-15-2022/). - Document URLs used in help output and links in the playground prefer specific version tag rather than `main` branch. For example, - Before: https://github.com/rhysd/actionlint/tree/main/docs - After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs - Fix actionlint wrongly reports an error when using `ghcr.io` or `docker.io` at `image` field of action metadata file of Docker action without `docker://` scheme. ([#​428](https://github.com/rhysd/actionlint/issues/428)) ```yaml runs: using: 'docker' ``` ### This should be OK ``` image: 'ghcr.io/user/repo:latest' ``` ``` - Fix checking `preactjs/compressed-size-action@v2` usage caused a false positive. ([#​422](https://github.com/rhysd/actionlint/issues/422)) - Fix an error message when invalid escaping is found in globs. - The design of the [playground page](https://rhysd.github.io/actionlint/) is overhauled following the upgrade of bulma package to v1. - Current actionlint version is shown in the heading. - The color theme is changed to the official dark theme. - The list of useful links is added to the bottom of the page as 'Resources' section. [Changes][v1.7.1] ``` ### [`v1.7.0`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v170---2024-05-08) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.6.27...v1.7.0) - From this version, actionlint starts to check action metadata file `action.yml` (or `action.yaml`). At this point, only very basic checks are implemented and contents of `steps:` are not checked yet. - It checks properties under `runs:` section (e.g. `main:` can be specified when it is a JavaScript action), `branding:` properties, and so on. ```yaml name: 'My action' author: '...' ``` ### ERROR: 'description' section is missing ``` branding: ``` ### ERROR: Invalid icon name ``` icon: dog runs: ``` ### ERROR: Node.js runtime version is too old ``` using: 'node12' ``` ### ERROR: The source file being run by this action does not exist ``` main: 'this-file-does-not-exist.js' ``` ### ERROR: 'env' configuration is only allowed for Docker actions ```` env: SOME_VAR: SOME_VALUE ``` ```` - actionlint still focuses on checking workflow files. So there is no way to directly specify `action.yml` as an argument of `actionlint` command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead. - Checks for `steps:` contents are planned to be implemented. Since several differences are expected between `steps:` in workflow file and `steps:` in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected. - Add `runner.environment` property. ([#​412](https://github.com/rhysd/actionlint/issues/412)) ```yaml - run: echo 'Run by GitHub-hosted runner' if: runner.environment == 'github-hosted' ``` - Using outdated popular actions is now detected at error. See [the document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions) for more details. - Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as `node12`. ```yaml ``` ### ERROR: actions/checkout@v2 is using the outdated runner 'node12' ```` - uses: actions/checkout@v2 ``` ```` - Support `attestations` permission which was [recently added to GitHub Actions as beta](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds). ([#​418](https://github.com/rhysd/actionlint/issues/418), thanks [@​bdehamer](https://github.com/bdehamer)) ```yaml permissions: id-token: write contents: read attestations: write ``` - Check comparison expressions more strictly. Arbitrary types of operands can be compared as [the official document](https://docs.github.com/en/actions/learn-github-actions/expressions#operators) explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see [the check document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types) for more details. ```yaml on: workflow_call: inputs: timeout: type: boolean jobs: test: runs-on: ubuntu-latest steps: - run: echo 'called!' ``` ### ERROR: Comparing string to object is always evaluated to false ``` if: ${{ github.event == 'workflow_call' }} - run: echo 'timeout is too long' ``` ### ERROR: Comparing boolean value with `>` doesn't make sense ``` if: ${{ inputs.timeout > 60 }} ``` ```` - Follow the update that `macos-latest` is now an alias to `macos-14` runner. - Support a custom python shell by `pyflakes` rule. - Add workaround actionlint reports that `dorny/paths-filter`'s `predicate-quantifier` input is not defined. ([#​416](https://github.com/rhysd/actionlint/issues/416)) - Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. ([#​384](https://github.com/rhysd/actionlint/issues/384)) - For example, the type of following expression should be `number` but it was actually `string | number` and actionlint complained that `timeout-minutes` must take a number value. ```yaml timeout-minutes: ${{ env.FOO && 10 || 60 }} ``` - Fix `${{ }}` placeholder is not available at `jobs..services`. ([#​402](https://github.com/rhysd/actionlint/issues/402)) ```yaml jobs: test: services: ${{ fromJSON('...') }} runs-on: ubuntu-latest steps: - run: ... ```` - Do not check outputs of `google-github-actions/get-secretmanager-secrets` because this action sets outputs dynamically. ([#​404](https://github.com/rhysd/actionlint/issues/404)) - Fix `defaults.run` is ignored on detecting the shell used in `run:`. ([#​409](https://github.com/rhysd/actionlint/issues/409)) ```yaml defaults: run: shell: pwsh jobs: test: runs-on: ubuntu-latest steps: ``` ### This was wrongly detected as bash script ``` - run: $Env:FOO = "FOO" ``` ```` - Fix parsing a syntax error reported from pyflakes when checking a Python script in `run:`. ([#​411](https://github.com/rhysd/actionlint/issues/411)) ```yaml - run: print( shell: python ```` - Skip checking `exclude:` items in `matrix:` when they are constructed from `${{ }}` dynamically. ([#​414](https://github.com/rhysd/actionlint/issues/414)) ```yaml matrix: foo: ['a', 'b'] exclude: ``` ### actionlint complained this value didn't exist in matrix combinations ``` - foo: ${{ env.EXCLUDE_FOO }} ``` ```` - Fix checking `exclude:` items when `${{ }}` is used in nested arrays at matrix items. ```yaml matrix: foo: - ["${{ fromJSON('...') }}"] exclude: ### actionlint complained this value didn't match to any matrix combinations - foo: ['foo'] ```` - Update popular actions data set. New major versions are added and the following actions are newly added. - `peaceiris/actions-hugo` - `actions/attest-build-provenance` - `actions/add-to-project` - `octokit/graphql-action` - Update Go dependencies to the latest. - Reduce the size of `actionlint` executable by removing redundant data from popular actions data set. - x86\_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller). - Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller). - Describe how to [integrate actionlint to Pulsar Edit](https://web.pulsar-edit.dev/packages/linter-github-actions) in [the document](https://github.com/rhysd/actionlint/blob/main/docs/usage.md#pulsar-edit). ([#​408](https://github.com/rhysd/actionlint/issues/408), thanks [@​mschuchard](https://github.com/mschuchard)) - Update outdated action versions in the usage document. ([#​413](https://github.com/rhysd/actionlint/issues/413), thanks [@​naglis](https://github.com/naglis)) \[Changes]\[v1.7.0]
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/791 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 10 ++++++---- go.sum | 22 ++++++++++++---------- 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/go.mod b/go.mod index 2db313f8..4fc97ddd 100644 --- a/go.mod +++ b/go.mod @@ -29,7 +29,7 @@ require ( github.com/opencontainers/image-spec v1.1.0 github.com/opencontainers/selinux v1.11.0 github.com/pkg/errors v0.9.1 - github.com/rhysd/actionlint v1.6.27 + github.com/rhysd/actionlint v1.7.7 github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.6 @@ -48,6 +48,7 @@ require ( github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.3 // indirect + github.com/bmatcuk/doublestar/v4 v4.8.0 // indirect github.com/cloudflare/circl v1.6.1 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect github.com/containerd/log v0.1.0 // indirect @@ -56,7 +57,7 @@ require ( github.com/docker/docker-credential-helpers v0.8.0 // indirect github.com/docker/go-units v0.5.0 // indirect github.com/emirpasic/gods v1.18.1 // indirect - github.com/fatih/color v1.16.0 // indirect + github.com/fatih/color v1.18.0 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-logr/logr v1.4.2 // indirect @@ -70,8 +71,9 @@ require ( github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect github.com/klauspost/compress v1.18.0 // indirect - github.com/mattn/go-colorable v0.1.13 // indirect - github.com/mattn/go-runewidth v0.0.15 // indirect + github.com/mattn/go-colorable v0.1.14 // indirect + github.com/mattn/go-runewidth v0.0.16 // indirect + github.com/mattn/go-shellwords v1.0.12 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/moby/sys/atomicwriter v0.1.0 // indirect github.com/moby/sys/sequential v0.6.0 // indirect diff --git a/go.sum b/go.sum index 445783ae..35e1bc58 100644 --- a/go.sum +++ b/go.sum @@ -21,6 +21,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk= github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA= +github.com/bmatcuk/doublestar/v4 v4.8.0 h1:DSXtrypQddoug1459viM9X9D3dp1Z7993fw36I2kNcQ= +github.com/bmatcuk/doublestar/v4 v4.8.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM= github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0= @@ -55,8 +57,8 @@ github.com/elazarl/goproxy v1.2.3 h1:xwIyKHbaP5yfT6O9KIeYJR5549MXRQkoQMRXGztz8YQ github.com/elazarl/goproxy v1.2.3/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= -github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= -github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= +github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= +github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= @@ -115,13 +117,14 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= -github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= -github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= +github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= +github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= -github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U= -github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= +github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk= +github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ= @@ -154,8 +157,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/rhysd/actionlint v1.6.27 h1:xxwe8YmveBcC8lydW6GoHMGmB6H/MTqUU60F2p10wjw= -github.com/rhysd/actionlint v1.6.27/go.mod h1:m2nFUjAnOrxCMXuOMz9evYBRCLUsMnKY2IJl/N5umbk= +github.com/rhysd/actionlint v1.7.7 h1:0KgkoNTrYY7vmOCs9BW2AHxLvvpoY9nEUzgBHiPUr0k= +github.com/rhysd/actionlint v1.7.7/go.mod h1:AE6I6vJEkNaIfWqC2GNE5spIJNhxf8NCtLEKU4NnUXg= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= @@ -256,7 +259,6 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= From b6cd1c7287896b363d7ab6ff8f04635dd172b201 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 17:58:33 +0000 Subject: [PATCH 017/281] Update module go.etcd.io/bbolt to v1.4.2 (#792) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [go.etcd.io/bbolt](https://github.com/etcd-io/bbolt) | `v1.3.10` -> `v1.4.2` | [![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fbbolt/v1.4.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fbbolt/v1.3.10/v1.4.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
etcd-io/bbolt (go.etcd.io/bbolt) ### [`v1.4.2`](https://github.com/etcd-io/bbolt/releases/tag/v1.4.2) [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.4.1...v1.4.2) See the [CHANGELOG/v1.4.2](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.4.md#v1422025-06-27) for more details. ### [`v1.4.1`](https://github.com/etcd-io/bbolt/releases/tag/v1.4.1) [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.4.0...v1.4.1) See the [CHANGELOG/v1.4.1](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.4.md#v1412025-06-10) for more details. ### [`v1.4.0`](https://github.com/etcd-io/bbolt/releases/tag/v1.4.0) [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.3.11...v1.4.0) See the [CHANGELOG/v1.4.0](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.4.md#v1402025-02-05) for more details. ### [`v1.3.11`](https://github.com/etcd-io/bbolt/releases/tag/v1.3.11) [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.3.10...v1.3.11) See the [CHANGELOG/v1.3.11](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.3.md#v13112024-08-21) for more details.
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/792 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 4fc97ddd..49440c65 100644 --- a/go.mod +++ b/go.mod @@ -35,7 +35,7 @@ require ( github.com/spf13/pflag v1.0.6 github.com/stretchr/testify v1.10.0 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 - go.etcd.io/bbolt v1.3.10 + go.etcd.io/bbolt v1.4.2 golang.org/x/term v0.33.0 golang.org/x/time v0.12.0 google.golang.org/protobuf v1.36.6 diff --git a/go.sum b/go.sum index 35e1bc58..e3402bdf 100644 --- a/go.sum +++ b/go.sum @@ -206,8 +206,8 @@ github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw= -go.etcd.io/bbolt v1.3.10 h1:+BqfJTcCzTItrop8mq/lbzL8wSGtj94UO/3U31shqG0= -go.etcd.io/bbolt v1.3.10/go.mod h1:bK3UQLPJZly7IlNmV7uVHJDxfe5aK9Ll93e/74Y9oEQ= +go.etcd.io/bbolt v1.4.2 h1:IrUHp260R8c+zYx/Tm8QZr04CX+qWS5PGfPdevhdm1I= +go.etcd.io/bbolt v1.4.2/go.mod h1:Is8rSHO/b4f3XigBC0lL0+4FwAQv3HXEEIgFMuKHceM= go.etcd.io/gofail v0.1.0/go.mod h1:VZBCXYGZhHAinaBiiqYvuDynvahNsAyLFwB3kEHKz1M= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= From 41379391b673f76b2eedcf0d298a023141c69aba Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 18:44:09 +0000 Subject: [PATCH 018/281] Update module github.com/opencontainers/image-spec to v1.1.1 (#793) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/opencontainers/image-spec](https://github.com/opencontainers/image-spec) | `v1.1.0` -> `v1.1.1` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fopencontainers%2fimage-spec/v1.1.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fopencontainers%2fimage-spec/v1.1.0/v1.1.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
opencontainers/image-spec (github.com/opencontainers/image-spec) ### [`v1.1.1`](https://github.com/opencontainers/image-spec/releases/tag/v1.1.1) [Compare Source](https://github.com/opencontainers/image-spec/compare/v1.1.0...v1.1.1) Vote Passed `[+5 -0 nv1]` - https://groups.google.com/a/opencontainers.org/g/dev/c/T-olx0jdT18 **Release PR** : https://github.com/opencontainers/image-spec/pull/1247 **Full Changelog**: https://github.com/opencontainers/image-spec/compare/v1.1.0...v1.1.1
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/793 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 49440c65..d6980ea4 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/mattn/go-isatty v0.0.20 github.com/moby/go-archive v0.1.0 github.com/moby/patternmatcher v0.6.0 - github.com/opencontainers/image-spec v1.1.0 + github.com/opencontainers/image-spec v1.1.1 github.com/opencontainers/selinux v1.11.0 github.com/pkg/errors v0.9.1 github.com/rhysd/actionlint v1.7.7 diff --git a/go.sum b/go.sum index e3402bdf..4d62e14e 100644 --- a/go.sum +++ b/go.sum @@ -147,8 +147,8 @@ github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k= github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= -github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug= -github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM= +github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= +github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU= github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec= github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4= From aa470890052837051c340935d000a469bab80ad0 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 18:51:59 +0000 Subject: [PATCH 019/281] Update module github.com/spf13/pflag to v1.0.7 (#794) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/spf13/pflag](https://github.com/spf13/pflag) | `v1.0.6` -> `v1.0.7` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fspf13%2fpflag/v1.0.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fspf13%2fpflag/v1.0.6/v1.0.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
spf13/pflag (github.com/spf13/pflag) ### [`v1.0.7`](https://github.com/spf13/pflag/releases/tag/v1.0.7) [Compare Source](https://github.com/spf13/pflag/compare/v1.0.6...v1.0.7) #### What's Changed - Fix defaultIsZeroValue check for generic Value types by [@​MidnightRocket](https://github.com/MidnightRocket) in https://github.com/spf13/pflag/pull/422 - feat: Use structs for errors returned by pflag. by [@​eth-p](https://github.com/eth-p) in https://github.com/spf13/pflag/pull/425 - Fix typos by [@​co63oc](https://github.com/co63oc) in https://github.com/spf13/pflag/pull/428 - fix [#​423](https://github.com/spf13/pflag/issues/423) : Add helper function and some documentation to parse shorthand go test flags. by [@​valdar](https://github.com/valdar) in https://github.com/spf13/pflag/pull/424 - add support equivalent to golang flag.TextVar(), also fixes the test failure as described in [#​368](https://github.com/spf13/pflag/issues/368) by [@​hujun-open](https://github.com/hujun-open) in https://github.com/spf13/pflag/pull/418 - add support for Func() and BoolFunc() [#​426](https://github.com/spf13/pflag/issues/426) by [@​LeGEC](https://github.com/LeGEC) in https://github.com/spf13/pflag/pull/429 - fix: correct argument length check in FlagSet.Parse by [@​ShawnJeffersonWang](https://github.com/ShawnJeffersonWang) in https://github.com/spf13/pflag/pull/409 - fix usage message for func flags, fix arguments order by [@​LeGEC](https://github.com/LeGEC) in https://github.com/spf13/pflag/pull/431 - Add support for time.Time flags by [@​max-frank](https://github.com/max-frank) in https://github.com/spf13/pflag/pull/348 #### New Contributors - [@​MidnightRocket](https://github.com/MidnightRocket) made their first contribution in https://github.com/spf13/pflag/pull/422 - [@​eth-p](https://github.com/eth-p) made their first contribution in https://github.com/spf13/pflag/pull/425 - [@​co63oc](https://github.com/co63oc) made their first contribution in https://github.com/spf13/pflag/pull/428 - [@​valdar](https://github.com/valdar) made their first contribution in https://github.com/spf13/pflag/pull/424 - [@​hujun-open](https://github.com/hujun-open) made their first contribution in https://github.com/spf13/pflag/pull/418 - [@​LeGEC](https://github.com/LeGEC) made their first contribution in https://github.com/spf13/pflag/pull/429 - [@​ShawnJeffersonWang](https://github.com/ShawnJeffersonWang) made their first contribution in https://github.com/spf13/pflag/pull/409 - [@​max-frank](https://github.com/max-frank) made their first contribution in https://github.com/spf13/pflag/pull/348 **Full Changelog**: https://github.com/spf13/pflag/compare/v1.0.6...v1.0.7
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/794 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index d6980ea4..7e8c08b5 100644 --- a/go.mod +++ b/go.mod @@ -32,7 +32,7 @@ require ( github.com/rhysd/actionlint v1.7.7 github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.9.1 - github.com/spf13/pflag v1.0.6 + github.com/spf13/pflag v1.0.7 github.com/stretchr/testify v1.10.0 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.2 diff --git a/go.sum b/go.sum index 4d62e14e..a04f560f 100644 --- a/go.sum +++ b/go.sum @@ -176,8 +176,9 @@ github.com/skeema/knownhosts v1.3.0 h1:AM+y0rI04VksttfwjkSTNQorvGqmwATnvnAHpSgc0 github.com/skeema/knownhosts v1.3.0/go.mod h1:sPINvnADmT/qYH1kfv+ePMmOBTH6Tbl7b5LvTDjFK7M= github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo= github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0= -github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o= github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M= +github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= From 545cd0ece53d49f99a6e9e40bd6b09f17caf2e05 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 20:13:42 +0000 Subject: [PATCH 020/281] Update dependency forgejo/release-notes-assistant to v1.4.0 (#795) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/release-notes-assistant](https://code.forgejo.org/forgejo/release-notes-assistant) | minor | `v1.3.6` -> `v1.4.0` | --- ### Release Notes
forgejo/release-notes-assistant (forgejo/release-notes-assistant) ### [`v1.4.0`](https://code.forgejo.org/forgejo/release-notes-assistant/releases/tag/v1.4.0) [Compare Source](https://code.forgejo.org/forgejo/release-notes-assistant/compare/v1.3.6...v1.4.0) - features - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/104): feat: support fetching from private repositories - bug fixes - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/102): fix(security): remove user / password from the URL - other - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/93): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.3.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/103): chore(ci): do not run tests on renovate branches - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/101): Update https://data.forgejo.org/actions/forgejo-release action to v2.7.1
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/795 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/release-notes-assistant.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 057c6ec7..bf63f433 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -11,7 +11,7 @@ on: - labeled env: - RNA_VERSION: v1.3.6 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org + RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org jobs: release-notes: From c3c6555558c63d66f65028ff726f53737d7c0426 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 20:25:54 +0000 Subject: [PATCH 021/281] Update module github.com/docker/cli to v28.3.3+incompatible (#796) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v28.2.2+incompatible` -> `v28.3.3+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fcli/v28.3.3+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fcli/v28.2.2+incompatible/v28.3.3+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/cli (github.com/docker/cli) ### [`v28.3.3+incompatible`](https://github.com/docker/cli/compare/v28.3.2...v28.3.3) [Compare Source](https://github.com/docker/cli/compare/v28.3.2...v28.3.3) ### [`v28.3.2+incompatible`](https://github.com/docker/cli/compare/v28.3.1...v28.3.2) [Compare Source](https://github.com/docker/cli/compare/v28.3.1...v28.3.2) ### [`v28.3.1+incompatible`](https://github.com/docker/cli/compare/v28.3.0...v28.3.1) [Compare Source](https://github.com/docker/cli/compare/v28.3.0...v28.3.1) ### [`v28.3.0+incompatible`](https://github.com/docker/cli/compare/v28.2.2...v28.3.0) [Compare Source](https://github.com/docker/cli/compare/v28.2.2...v28.3.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/796 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 7e8c08b5..0be2cd02 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/containerd/errdefs v0.3.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 - github.com/docker/cli v28.2.2+incompatible + github.com/docker/cli v28.3.3+incompatible github.com/docker/docker v28.3.3+incompatible github.com/docker/go-connections v0.5.0 github.com/go-git/go-billy/v5 v5.6.2 diff --git a/go.sum b/go.sum index a04f560f..6a321020 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A= -github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo= +github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI= github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= From 79f6c546752ee2cbc3c08108ba9461975ebc91a0 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 2 Aug 2025 21:55:57 +0000 Subject: [PATCH 022/281] chore: replace docker hub with code.forgejo.org (#799) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/799): chore: replace docker hub with code.forgejo.org Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/799 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/runner_test.go | 2 +- act/runner/testdata/docker-action-custom-path/push.yml | 8 +++----- act/runner/testdata/fail/push.yml | 2 +- act/runner/testdata/issue-104/main.yaml | 2 +- .../testdata/job-container-invalid-credentials/push.yml | 2 +- act/runner/testdata/job-container/push.yml | 4 ++-- .../action/action.yml | 2 +- act/runner/testdata/localdockerimagetest_/Dockerfile | 2 +- act/runner/testdata/parallel/push.yml | 2 +- act/runner/testdata/remote-action-docker/push.yml | 2 +- act/runner/testdata/remote-action-js-node-user/push.yml | 2 +- 11 files changed, 14 insertions(+), 16 deletions(-) diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 9ecb4ff8..34045bd0 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -539,7 +539,7 @@ func TestRunner_RunWithService(t *testing.T) { ctx := context.Background() platforms := map[string]string{ - "ubuntu-latest": "node:12.20.1-buster-slim", + "ubuntu-latest": "code.forgejo.org/oci/node:22", } workflowPath := "services" diff --git a/act/runner/testdata/docker-action-custom-path/push.yml b/act/runner/testdata/docker-action-custom-path/push.yml index 37bbf417..fbe8e45e 100644 --- a/act/runner/testdata/docker-action-custom-path/push.yml +++ b/act/runner/testdata/docker-action-custom-path/push.yml @@ -4,9 +4,7 @@ jobs: runs-on: ubuntu-latest steps: - run: | - FROM ubuntu:latest - ENV PATH="/opt/texlive/texdir/bin/x86_64-linuxmusl:${PATH}" - ENV ORG_PATH="${PATH}" - ENTRYPOINT [ "bash", "-c", "echo \"PATH=$PATH\" && echo \"ORG_PATH=$ORG_PATH\" && [[ \"$PATH\" = \"$ORG_PATH\" ]]" ] + FROM code.forgejo.org/oci/alpine:latest + ENTRYPOINT [ "sh", "-c", "echo OK" ] shell: mv {0} Dockerfile - - uses: ./ \ No newline at end of file + - uses: ./ diff --git a/act/runner/testdata/fail/push.yml b/act/runner/testdata/fail/push.yml index fb425302..17a7203c 100644 --- a/act/runner/testdata/fail/push.yml +++ b/act/runner/testdata/fail/push.yml @@ -5,7 +5,7 @@ jobs: build: runs-on: ubuntu-latest container: - image: node:16-buster-slim + image: code.forgejo.org/oci/node:22 env: TEST_ENV: test-value steps: diff --git a/act/runner/testdata/issue-104/main.yaml b/act/runner/testdata/issue-104/main.yaml index 8b158373..38c3456a 100644 --- a/act/runner/testdata/issue-104/main.yaml +++ b/act/runner/testdata/issue-104/main.yaml @@ -10,6 +10,6 @@ jobs: steps: - name: hello - uses: https://code.forgejo.org/forgejo/hello-world-docker-action@v1 + uses: https://code.forgejo.org/forgejo/hello-world-docker-action@v3 with: who-to-greet: "World" diff --git a/act/runner/testdata/job-container-invalid-credentials/push.yml b/act/runner/testdata/job-container-invalid-credentials/push.yml index 79c397ed..1834c55c 100644 --- a/act/runner/testdata/job-container-invalid-credentials/push.yml +++ b/act/runner/testdata/job-container-invalid-credentials/push.yml @@ -5,7 +5,7 @@ jobs: fail-on-invalid-credentials: runs-on: ubuntu-latest container: - image: node:16-buster-slim + image: code.forgejo.org/oci/node:22 credentials: username: "user" password: "" # Empty password caused a crash in jobexecutor diff --git a/act/runner/testdata/job-container/push.yml b/act/runner/testdata/job-container/push.yml index 4033081b..0afb6f33 100644 --- a/act/runner/testdata/job-container/push.yml +++ b/act/runner/testdata/job-container/push.yml @@ -5,7 +5,7 @@ jobs: test: runs-on: ubuntu-latest container: - image: node:16-buster-slim + image: code.forgejo.org/oci/node:22 env: TEST_ENV: test-value steps: @@ -13,7 +13,7 @@ jobs: test2: runs-on: ubuntu-latest - container: node:16-buster-slim + container: code.forgejo.org/oci/node:22 steps: - run: echo ${TEST_ENV} | grep test-value env: diff --git a/act/runner/testdata/local-action-via-composite-dockerfile/action/action.yml b/act/runner/testdata/local-action-via-composite-dockerfile/action/action.yml index 0f92273b..5af779eb 100644 --- a/act/runner/testdata/local-action-via-composite-dockerfile/action/action.yml +++ b/act/runner/testdata/local-action-via-composite-dockerfile/action/action.yml @@ -32,7 +32,7 @@ runs: shell: bash - uses: ./localdockerimagetest_ # Also test a remote docker action here - - uses: https://code.forgejo.org/forgejo/hello-world-docker-action@v1 + - uses: https://code.forgejo.org/forgejo/hello-world-docker-action@v3 with: who-to-greet: 'Mona the Octocat' # Test if GITHUB_ACTION_PATH is set correctly after all steps diff --git a/act/runner/testdata/localdockerimagetest_/Dockerfile b/act/runner/testdata/localdockerimagetest_/Dockerfile index 94798c1d..89ae9d3e 100644 --- a/act/runner/testdata/localdockerimagetest_/Dockerfile +++ b/act/runner/testdata/localdockerimagetest_/Dockerfile @@ -1,2 +1,2 @@ -FROM ubuntu:latest +FROM code.forgejo.org/oci/alpine:latest CMD echo Hello diff --git a/act/runner/testdata/parallel/push.yml b/act/runner/testdata/parallel/push.yml index a2de0a9d..1af9165e 100644 --- a/act/runner/testdata/parallel/push.yml +++ b/act/runner/testdata/parallel/push.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest needs: [build] steps: - - uses: docker://node:16-buster-slim + - uses: docker://code.forgejo.org/oci/node:22 with: args: echo ${GITHUB_REF} | grep nektos/act - uses: ./actions/docker-url diff --git a/act/runner/testdata/remote-action-docker/push.yml b/act/runner/testdata/remote-action-docker/push.yml index 752ef035..8fb1149c 100644 --- a/act/runner/testdata/remote-action-docker/push.yml +++ b/act/runner/testdata/remote-action-docker/push.yml @@ -5,6 +5,6 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: https://code.forgejo.org/forgejo/hello-world-docker-action@v1 + - uses: https://code.forgejo.org/forgejo/hello-world-docker-action@v3 with: who-to-greet: 'Mona the Octocat' diff --git a/act/runner/testdata/remote-action-js-node-user/push.yml b/act/runner/testdata/remote-action-js-node-user/push.yml index 40d01091..cb8e536b 100644 --- a/act/runner/testdata/remote-action-js-node-user/push.yml +++ b/act/runner/testdata/remote-action-js-node-user/push.yml @@ -5,7 +5,7 @@ jobs: test: runs-on: ubuntu-latest container: - image: node:16-buster-slim + image: code.forgejo.org/oci/node:22 options: --user node steps: - name: check permissions of env files From 805d83e97460d384e3574ac900f3667f8f3a3ef4 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 2 Aug 2025 22:05:15 +0000 Subject: [PATCH 023/281] chore: unify forgejo image names location (#797) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/797): chore: unify forgejo image names location Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/797 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/test.yml | 2 +- examples/docker-compose/compose-forgejo-and-runner.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 49e5eb3f..53182a98 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -26,7 +26,7 @@ jobs: services: forgejo: - image: codeberg.org/forgejo/forgejo:11 + image: code.forgejo.org/forgejo/forgejo:11 env: FORGEJO__security__INSTALL_LOCK: "true" FORGEJO__log__LEVEL: "debug" diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index c9b7b625..ac51a52b 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -30,7 +30,7 @@ services: - docker_certs:/certs forgejo: - image: codeberg.org/forgejo/forgejo:11.0 + image: code.forgejo.org/forgejo/forgejo:11.0 command: >- bash -c ' /usr/bin/s6-svscan /etc/s6 & From 6c0ed713ac30182691b7911117c6f71f01fbba9d Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 23:00:47 +0000 Subject: [PATCH 024/281] Update module github.com/go-git/go-git/v5 to v5.16.2 (#800) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.13.1` -> `v5.16.2` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.16.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.13.1/v5.16.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
go-git/go-git (github.com/go-git/go-git/v5) ### [`v5.16.2`](https://github.com/go-git/go-git/releases/tag/v5.16.2) [Compare Source](https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2) #### What's Changed - utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by [@​kane8n](https://github.com/kane8n) in https://github.com/go-git/go-git/pull/1567 **Full Changelog**: https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2 ### [`v5.16.1`](https://github.com/go-git/go-git/releases/tag/v5.16.1) [Compare Source](https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1) #### What's Changed - utils: merkletrie, Fix diff on sparse-checkout index. Fixes [#​1406](https://github.com/go-git/go-git/issues/1406) to releases/v5.x by [@​kane8n](https://github.com/kane8n) in https://github.com/go-git/go-git/pull/1561 #### New Contributors - [@​kane8n](https://github.com/kane8n) made their first contribution in https://github.com/go-git/go-git/pull/1561 **Full Changelog**: https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1 ### [`v5.16.0`](https://github.com/go-git/go-git/releases/tag/v5.16.0) [Compare Source](https://github.com/go-git/go-git/compare/v5.15.0...v5.16.0) #### What's Changed - \[v5] plumbing: support mTLS for HTTPS protocol by [@​hiddeco](https://github.com/hiddeco) in https://github.com/go-git/go-git/pull/1510 - v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix [#​1514](https://github.com/go-git/go-git/issues/1514) by [@​pjbgf](https://github.com/pjbgf) in https://github.com/go-git/go-git/pull/1515 **Full Changelog**: https://github.com/go-git/go-git/compare/v5.15.0...v5.16.0 ### [`v5.15.0`](https://github.com/go-git/go-git/releases/tag/v5.15.0) [Compare Source](https://github.com/go-git/go-git/compare/v5.14.0...v5.15.0) #### What's Changed - plumbing: add cert auth support to `releases/v5.x` by [@​Javier-varez](https://github.com/Javier-varez) in https://github.com/go-git/go-git/pull/1482 - v5: Bump dependencies by [@​pjbgf](https://github.com/pjbgf) in https://github.com/go-git/go-git/pull/1505 **Full Changelog**: https://github.com/go-git/go-git/compare/v5.14.0...v5.15.0 ### [`v5.14.0`](https://github.com/go-git/go-git/releases/tag/v5.14.0) [Compare Source](https://github.com/go-git/go-git/compare/v5.13.2...v5.14.0) #### What's Changed - v5: Bump Go and dependencies to mitigate [GO-2025-3487](https://pkg.go.dev/vuln/GO-2025-3487) by [@​pjbgf](https://github.com/pjbgf) in https://github.com/go-git/go-git/pull/1436 :warning: Note that this version requires Go 1.23, due to the bump to `golang.org/x/crypto@v0.35.0` which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release. **Full Changelog**: https://github.com/go-git/go-git/compare/v5.13.2...v5.14.0 ### [`v5.13.2`](https://github.com/go-git/go-git/releases/tag/v5.13.2) [Compare Source](https://github.com/go-git/go-git/compare/v5.13.1...v5.13.2) #### What's Changed - plumbing: use the correct user agent string. Fixes [#​883](https://github.com/go-git/go-git/issues/883) by [@​uragirii](https://github.com/uragirii) in https://github.com/go-git/go-git/pull/1364 - build: bump golang.org/x/sys from 0.28.0 to 0.29.0 in the golang-org group by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1365 - build: bump the golang-org group with 2 updates by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1367 - build: bump github.com/ProtonMail/go-crypto from 1.1.3 to 1.1.4 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1368 - build: bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1378 - build: bump github/codeql-action from 3.28.0 to 3.28.1 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1376 - build: bump github.com/elazarl/goproxy from 1.2.3 to 1.4.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1377 - git: worktree, fix restoring dot slash files (backported to v5). Fixes [#​1176](https://github.com/go-git/go-git/issues/1176) by [@​BeChris](https://github.com/BeChris) in https://github.com/go-git/go-git/pull/1361 - build: bump github.com/pjbgf/sha1cd from 0.3.0 to 0.3.2 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1392 - git: worktree\_status, fix adding dot slash files to working tree (backported to v5). Fixes [#​1150](https://github.com/go-git/go-git/issues/1150) by [@​BeChris](https://github.com/BeChris) in https://github.com/go-git/go-git/pull/1359 - build: bump github.com/ProtonMail/go-crypto from 1.1.4 to 1.1.5 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-git/go-git/pull/1383 **Full Changelog**: https://github.com/go-git/go-git/compare/v5.13.1...v5.13.2
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/800 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 16 ++++++++-------- go.sum | 44 ++++++++++++++++++++++---------------------- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/go.mod b/go.mod index 0be2cd02..df53ca79 100644 --- a/go.mod +++ b/go.mod @@ -16,7 +16,7 @@ require ( github.com/docker/docker v28.3.3+incompatible github.com/docker/go-connections v0.5.0 github.com/go-git/go-billy/v5 v5.6.2 - github.com/go-git/go-git/v5 v5.13.1 + github.com/go-git/go-git/v5 v5.16.2 github.com/gobwas/glob v0.2.3 github.com/google/uuid v1.6.0 github.com/imdario/mergo v0.3.16 @@ -47,12 +47,12 @@ require ( dario.cat/mergo v1.0.0 // indirect github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect - github.com/ProtonMail/go-crypto v1.1.3 // indirect + github.com/ProtonMail/go-crypto v1.1.6 // indirect github.com/bmatcuk/doublestar/v4 v4.8.0 // indirect github.com/cloudflare/circl v1.6.1 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect github.com/containerd/log v0.1.0 // indirect - github.com/cyphar/filepath-securejoin v0.3.6 // indirect + github.com/cyphar/filepath-securejoin v0.4.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/docker/docker-credential-helpers v0.8.0 // indirect github.com/docker/go-units v0.5.0 // indirect @@ -64,7 +64,7 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/go-viper/mapstructure/v2 v2.3.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect + github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect @@ -82,12 +82,12 @@ require ( github.com/moby/term v0.5.0 // indirect github.com/morikuni/aec v1.0.0 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect - github.com/pjbgf/sha1cd v0.3.0 // indirect + github.com/pjbgf/sha1cd v0.3.2 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/robfig/cron/v3 v3.0.1 // indirect github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect - github.com/skeema/knownhosts v1.3.0 // indirect + github.com/skeema/knownhosts v1.3.1 // indirect github.com/stretchr/objx v0.5.2 // indirect github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect @@ -100,8 +100,8 @@ require ( go.opentelemetry.io/otel/metric v1.36.0 // indirect go.opentelemetry.io/otel/sdk v1.21.0 // indirect go.opentelemetry.io/otel/trace v1.36.0 // indirect - golang.org/x/crypto v0.36.0 // indirect - golang.org/x/net v0.38.0 // indirect + golang.org/x/crypto v0.37.0 // indirect + golang.org/x/net v0.39.0 // indirect golang.org/x/sync v0.12.0 // indirect golang.org/x/sys v0.34.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect diff --git a/go.sum b/go.sum index 6a321020..0f33765e 100644 --- a/go.sum +++ b/go.sum @@ -13,8 +13,8 @@ github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF0 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= -github.com/ProtonMail/go-crypto v1.1.3 h1:nRBOetoydLeUb4nHajyO2bKqMLfWQ/ZPwkXqXxPxCFk= -github.com/ProtonMail/go-crypto v1.1.3/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE= +github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw= +github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= @@ -36,8 +36,8 @@ github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= -github.com/cyphar/filepath-securejoin v0.3.6 h1:4d9N5ykBnSp5Xn2JkhocYDkOpURL/18CYMpo6xB9uWM= -github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI= +github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s= +github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -53,8 +53,8 @@ github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= -github.com/elazarl/goproxy v1.2.3 h1:xwIyKHbaP5yfT6O9KIeYJR5549MXRQkoQMRXGztz8YQ= -github.com/elazarl/goproxy v1.2.3/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64= +github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o= +github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= @@ -69,8 +69,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.13.1 h1:DAQ9APonnlvSWpvolXWIuV6Q6zXy2wHbN4cVlNR5Q+M= -github.com/go-git/go-git/v5 v5.13.1/go.mod h1:qryJB4cSBoq3FRoBRf5A77joojuBcmPJ0qu3XXXVixc= +github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM= +github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -82,8 +82,8 @@ github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE= -github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= +github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= @@ -151,8 +151,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU= github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec= -github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4= -github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI= +github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4= +github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -164,16 +164,16 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs= github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro= -github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= -github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o= +github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= +github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8= github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/skeema/knownhosts v1.3.0 h1:AM+y0rI04VksttfwjkSTNQorvGqmwATnvnAHpSgc0LY= -github.com/skeema/knownhosts v1.3.0/go.mod h1:sPINvnADmT/qYH1kfv+ePMmOBTH6Tbl7b5LvTDjFK7M= +github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8= +github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY= github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo= github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0= github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= @@ -232,8 +232,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34= -golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc= +golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= +golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= @@ -243,8 +243,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8= -golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= +golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY= +golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -271,8 +271,8 @@ golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= -golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= +golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= +golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= From 6bff61dd7a6d08f6e26ceb974de9fafdba82a418 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 2 Aug 2025 23:47:31 +0000 Subject: [PATCH 025/281] Update module github.com/opencontainers/selinux to v1.12.0 (#801) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.11.0` -> `v1.12.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fopencontainers%2fselinux/v1.12.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fopencontainers%2fselinux/v1.11.0/v1.12.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
opencontainers/selinux (github.com/opencontainers/selinux) ### [`v1.12.0`](https://github.com/opencontainers/selinux/releases/tag/v1.12.0) [Compare Source](https://github.com/opencontainers/selinux/compare/v1.11.1...v1.12.0) This release removes deprecated functions from the `label` package, and improves documentation and error reporting of `SetCreateKey`. #### What's Changed - VERSION: remove by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/217 - CI: add AlmaLinux 8, CentOS Stream 9, and Fedora by [@​AkihiroSuda](https://github.com/AkihiroSuda) in https://github.com/opencontainers/selinux/pull/221 - ci: install git-core by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/224 - CI: add openSUSE Tumbleweed by [@​AkihiroSuda](https://github.com/AkihiroSuda) in https://github.com/opencontainers/selinux/pull/223 - Bump Go version, deps, fix some linter issues... by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/218 - label: remove deprecated stuff by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/228 - Improve SetKeyCreate error reporting, fix test flakes by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/227 **Full Changelog**: https://github.com/opencontainers/selinux/compare/v1.11.1...v1.12.0 ### [`v1.11.1`](https://github.com/opencontainers/selinux/releases/tag/v1.11.1) [Compare Source](https://github.com/opencontainers/selinux/compare/v1.11.0...v1.11.1) #### What's Changed - Bump to v1.11.0 by [@​rhatdan](https://github.com/rhatdan) in https://github.com/opencontainers/selinux/pull/197 - fix some error by [@​ningmingxiao](https://github.com/ningmingxiao) in https://github.com/opencontainers/selinux/pull/200 - ci: update Go 1.21 support by [@​michalbiesek](https://github.com/michalbiesek) in https://github.com/opencontainers/selinux/pull/202 - Extend `build-cross` target with `riscv64` arch by [@​michalbiesek](https://github.com/michalbiesek) in https://github.com/opencontainers/selinux/pull/201 - Remove nolint annotations for unix errno comparisons by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/203 - ci: bump some actions by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/205 - Misc nitpicks by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/206 - pwalk, pwalkdir: fix walk vs remove race by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/204 - Update GitHub Actions CI Go matrix for Go v1.22 by [@​austinvazquez](https://github.com/austinvazquez) in https://github.com/opencontainers/selinux/pull/209 - Update GitHub Actions packages to resolve deprecation warnings. by [@​austinvazquez](https://github.com/austinvazquez) in https://github.com/opencontainers/selinux/pull/208 - Add dependabot config by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/210 - build(deps): bump tim-actions/get-pr-commits from 1.3.0 to 1.3.1 by [@​dependabot](https://github.com/dependabot) in https://github.com/opencontainers/selinux/pull/211 - build(deps): bump golangci/golangci-lint-action from 4 to 6 by [@​dependabot](https://github.com/dependabot) in https://github.com/opencontainers/selinux/pull/213 - Show SELinux label on failure by [@​rhatdan](https://github.com/rhatdan) in https://github.com/opencontainers/selinux/pull/216 #### New Contributors - [@​ningmingxiao](https://github.com/ningmingxiao) made their first contribution in https://github.com/opencontainers/selinux/pull/200 - [@​michalbiesek](https://github.com/michalbiesek) made their first contribution in https://github.com/opencontainers/selinux/pull/202 - [@​dependabot](https://github.com/dependabot) made their first contribution in https://github.com/opencontainers/selinux/pull/211 **Full Changelog**: https://github.com/opencontainers/selinux/compare/v1.11.0...v1.11.1
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/801 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index df53ca79..f720c2b2 100644 --- a/go.mod +++ b/go.mod @@ -27,7 +27,7 @@ require ( github.com/moby/go-archive v0.1.0 github.com/moby/patternmatcher v0.6.0 github.com/opencontainers/image-spec v1.1.1 - github.com/opencontainers/selinux v1.11.0 + github.com/opencontainers/selinux v1.12.0 github.com/pkg/errors v0.9.1 github.com/rhysd/actionlint v1.7.7 github.com/sirupsen/logrus v1.9.3 diff --git a/go.sum b/go.sum index 0f33765e..fd6e8a34 100644 --- a/go.sum +++ b/go.sum @@ -149,8 +149,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= -github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU= -github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec= +github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8= +github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U= github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4= github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= From 65d762d1cc29d9e502cb7114e9bf497ba39b2a15 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 2 Aug 2025 23:51:09 +0000 Subject: [PATCH 026/281] feat: --health-* options are allowed in job..services..options (#784) they override any similar options from the configuration file since it would not make much sense to define a health check that applies to all containers, it is only ever meaningful for services. ```yaml jobs: mysql: runs-on: ubuntu-latest container: mysql:8 services: maindb: image: mysql:8 env: MYSQL_DATABASE: dbname MYSQL_USER: dbuser MYSQL_PASSWORD: dbpass MYSQL_RANDOM_ROOT_PASSWORD: yes options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3 ``` they are also allowed in job..container.options although they are not useful because they are harmless See also the [associated documentation](https://codeberg.org/forgejo/docs/pulls/1366) pull request. --- - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/784): feat: --health-* options are allowed in job..services..options Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/784 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/docker_run.go | 5 +++++ act/container/docker_run_test.go | 23 ++++++++++++++++++++--- 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/act/container/docker_run.go b/act/container/docker_run.go index 73672325..1c790d6a 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -412,6 +412,11 @@ func (cr *containerReference) mergeJobOptions(ctx context.Context, config *conta logger := common.Logger(ctx) + if jobConfig.Config.Healthcheck != nil && len(jobConfig.Config.Healthcheck.Test) > 0 { + logger.Debugf("--health-* options %+v", jobConfig.Config.Healthcheck) + config.Healthcheck = jobConfig.Config.Healthcheck + } + if len(jobConfig.Config.Volumes) > 0 { logger.Debugf("--volume options (except bind) %v", jobConfig.Config.Volumes) err = mergo.Merge(&config.Volumes, jobConfig.Config.Volumes, mergo.WithOverride, mergo.WithAppendSlice) diff --git a/act/container/docker_run_test.go b/act/container/docker_run_test.go index 53a812f6..1069f895 100644 --- a/act/container/docker_run_test.go +++ b/act/container/docker_run_test.go @@ -338,11 +338,18 @@ func TestMergeJobOptions(t *testing.T) { hostConfig *container.HostConfig }{ { - name: "ok", - options: "--volume /frob:/nitz --volume somevolume --tmpfs /tmp:exec,noatime --hostname alternatehost", + name: "Ok", + options: `--volume /frob:/nitz --volume somevolume --tmpfs /tmp:exec,noatime --hostname alternatehost --health-cmd "healthz one" --health-interval 10s --health-timeout 5s --health-retries 3 --health-start-period 30s`, config: &container.Config{ Volumes: map[string]struct{}{"somevolume": {}}, Hostname: "alternatehost", + Healthcheck: &container.HealthConfig{ + Test: []string{"CMD-SHELL", "healthz one"}, + Interval: 10 * time.Second, + Timeout: 5 * time.Second, + StartPeriod: 30 * time.Second, + Retries: 3, + }, }, hostConfig: &container.HostConfig{ Binds: []string{"/frob:/nitz"}, @@ -350,7 +357,17 @@ func TestMergeJobOptions(t *testing.T) { }, }, { - name: "ignore", + name: "DisableHealthCheck", + options: `--no-healthcheck`, + config: &container.Config{ + Healthcheck: &container.HealthConfig{ + Test: []string{"NONE"}, + }, + }, + hostConfig: &container.HostConfig{}, + }, + { + name: "Ignore", options: "--pid=host --device=/dev/sda", config: &container.Config{}, hostConfig: &container.HostConfig{}, From 646a0d761f5d544c109c8a61b4ff95a98bf947d2 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 3 Aug 2025 07:01:46 +0000 Subject: [PATCH 027/281] fix: longer timeouts on job cleanup without waiting (v2) (#798) Probably fixes #431 (see investigation notes: https://code.forgejo.org/forgejo/runner/issues/431#issuecomment-50810) by extending the timeout for all cleanup actions from 1 minute to 30 minutes, and run cleanup after the task status is reported back to Forgejo. Cleanup logging now goes in the runner log rather than the job log, and it was tweaked to be less verbose and contain more useful identifying information on the job in case of error. Manual testing confirms that Forgejo receives the success/failure status of the task before cleanup begins, that no further logging reaches the task at that point, and that the longer cleanup timeout is applied as expected. This is an alternate, simplified version of #779. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/798): fix: longer timeouts on job cleanup without waiting (v2) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/798 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/job_executor.go | 26 ++++++++++++++++---------- act/runner/run_context.go | 4 ++++ 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index c3bcb4b8..f9ab36a0 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -20,6 +20,8 @@ type jobInfo interface { result(result string) } +const cleanupTimeout = 30 * time.Minute + func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executor { steps := make([]common.Executor, 0) preSteps := make([]common.Executor, 0) @@ -109,16 +111,23 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo postExecutor = postExecutor.Finally(func(ctx context.Context) error { jobError := common.JobError(ctx) + + // Fresh context to ensure job result output works even if prev. context was a cancelled job + ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute) + defer cancel() + setJobResult(ctx, info, rc, jobError == nil) + setJobOutputs(ctx, rc) + var err error if rc.Config.AutoRemove || jobError == nil { - // always allow 1 min for stopping and removing the runner, even if we were cancelled - ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute) + // Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job + ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout) defer cancel() logger := common.Logger(ctx) - logger.Infof("Cleaning up container for job %s", rc.JobName) + logger.Debugf("Cleaning up container for job %s", rc.jobContainerName()) if err = info.stopContainer()(ctx); err != nil { - logger.Errorf("Error while stop job container: %v", err) + logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err) } if !rc.IsHostEnv(ctx) && rc.Config.ContainerNetworkMode == "" { @@ -127,15 +136,12 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo // it means that the network to which containers are connecting is created by `act_runner`, // so, we should remove the network at last. networkName, _ := rc.networkName() - logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, networkName) + logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName()) if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil { - logger.Errorf("Error while cleaning network: %v", err) + logger.Errorf("Error while cleaning network %s: %v", networkName, err) } } } - setJobResult(ctx, info, rc, jobError == nil) - setJobOutputs(ctx, rc) - return err }) @@ -149,7 +155,7 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo if ctx.Err() == context.Canceled { // in case of an aborted run, we still should execute the // post steps to allow cleanup. - ctx, cancel = context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), 5*time.Minute) + ctx, cancel = context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), cleanupTimeout) defer cancel() } return postExecutor(ctx) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 52b742b0..d1fc1cd8 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -515,6 +515,10 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { } rc.cleanUpJobContainer = func(ctx context.Context) error { + // reinit logger from ctx since cleanUpJobContainer is be called after the job is complete, and using + // prepareJobContainer's logger could cause logs to continue to append to the finished job + logger := common.Logger(ctx) + reuseJobContainer := func(ctx context.Context) bool { return rc.Config.ReuseContainers } From 7c81802bb6a8386ecf71acffe537a88fb9f13d72 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 3 Aug 2025 07:20:54 +0000 Subject: [PATCH 028/281] Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.3.1 (#802) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/golangci/golangci-lint/v2/cmd/golangci-lint](https://github.com/golangci/golangci-lint) | `v2.3.0` -> `v2.3.1` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.3.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.3.0/v2.3.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
golangci/golangci-lint (github.com/golangci/golangci-lint/v2/cmd/golangci-lint) ### [`v2.3.1`](https://github.com/golangci/golangci-lint/blob/HEAD/CHANGELOG.md#v231) [Compare Source](https://github.com/golangci/golangci-lint/compare/v2.3.0...v2.3.1) 1. Linters bug fixes - `gci`: from 0.13.6 to 0.13.7 - `gosec`: from 2.22.6 to 2.22.7 - `noctx`: from 0.3.5 to 0.4.0 - `wsl`: from 5.1.0 to 5.1.1 - tagliatelle: force upper case for custom initialisms
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/802 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 6b728dad..1995f027 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,7 @@ GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.4 # renovate: datasource=go -GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.3.0 # renovate: datasource=go +GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.3.1 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner DOCKER_TAG ?= nightly From 83e7b4ae1034682756efdd5d9ddded759f5f17ea Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 3 Aug 2025 08:34:09 +0000 Subject: [PATCH 029/281] chore(cleanup): dispatch workflows according to the role of the repository (#790) The `vars.ROLE` in each repository was set as follows: - https://code.forgejo.org/forgejo/runner => forgejo-coding - https://code.forgejo.org/forgejo-integration/runner => forgejo-integration - https://invisible.forgejo.org/forgejo/runner => forgejo-release It reflects how Forgejo roles are dispatched. Update all workflows to use the ROLE to determine if it is relevant for them to run. It is more straightforward than the previous approach based on the name of the owner. There were cases where the logic was wrong and workflows ran needlessly, for instance because the runner release is now published from an organization that is forgejo and not forgejo-release. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/790): chore(cleanup): dispatch workflows according to the role of the repository Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/790 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/act.yml | 2 ++ .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/build-release.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 7 ++++++- .forgejo/workflows/example-docker-compose.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- .forgejo/workflows/publish-release.yml | 3 ++- .forgejo/workflows/test.yml | 4 ++-- 8 files changed, 16 insertions(+), 8 deletions(-) diff --git a/.forgejo/workflows/act.yml b/.forgejo/workflows/act.yml index 206eaae9..46175b3b 100644 --- a/.forgejo/workflows/act.yml +++ b/.forgejo/workflows/act.yml @@ -13,6 +13,7 @@ env: jobs: unit: runs-on: docker + if: vars.ROLE == 'forgejo-coding' container: image: 'code.forgejo.org/oci/node:22-bookworm' steps: @@ -58,6 +59,7 @@ jobs: integration: runs-on: lxc-bookworm + if: vars.ROLE == 'forgejo-coding' needs: [unit] steps: - uses: https://code.forgejo.org/actions/checkout@v4 diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index 748faf59..4adba81c 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -21,7 +21,7 @@ enable-email-notifications: true jobs: release-simulation: runs-on: lxc-bookworm - if: forge.repository_owner != 'forgejo-integration' && forge.repository_owner != 'forgejo-release' + if: vars.ROLE == 'forgejo-coding' steps: - uses: actions/checkout@v4 diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index 4bfcf411..6bb6c4b4 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -21,7 +21,7 @@ jobs: release: runs-on: lxc-bookworm # root is used for testing, allow it - if: secrets.ROLE == 'forgejo-integration' || forge.repository_owner == 'root' + if: vars.ROLE == 'forgejo-integration' || forge.repository_owner == 'root' steps: - uses: actions/checkout@v4 diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index 1b913008..25786011 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -14,6 +14,11 @@ on: branches: - 'main' pull_request: + paths: + - examples/docker-build-push-action/** + - .forgejo/workflows/docker-build-push-action-in-lxc.yml + +enable-email-notifications: true env: FORGEJO_VERSION: 11.0.3 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo @@ -22,7 +27,7 @@ env: jobs: docker-build-push-action-in-lxc: - if: forge.repository_owner != 'forgejo-integration' && forge.repository_owner != 'forgejo-experimental' && forge.repository_owner != 'forgejo-release' + if: vars.ROLE == 'forgejo-coding' runs-on: lxc-bookworm steps: diff --git a/.forgejo/workflows/example-docker-compose.yml b/.forgejo/workflows/example-docker-compose.yml index 64ef8730..dce57a39 100644 --- a/.forgejo/workflows/example-docker-compose.yml +++ b/.forgejo/workflows/example-docker-compose.yml @@ -12,7 +12,7 @@ enable-email-notifications: true jobs: example-docker-compose: - if: forge.repository_owner != 'forgejo-integration' && forge.repository_owner != 'forgejo-experimental' && forge.repository_owner != 'forgejo-release' + if: vars.ROLE == 'forgejo-coding' runs-on: lxc-bookworm steps: - uses: actions/checkout@v4 diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index 377fe78f..cca4f934 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -17,7 +17,7 @@ env: jobs: example-lxc-systemd: - if: forge.repository_owner != 'forgejo-integration' && forge.repository_owner != 'forgejo-experimental' && forge.repository_owner != 'forgejo-release' + if: vars.ROLE == 'forgejo-coding' runs-on: lxc-bookworm steps: - uses: https://data.forgejo.org/actions/checkout@v4 diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml index 5f20df79..247ec929 100644 --- a/.forgejo/workflows/publish-release.yml +++ b/.forgejo/workflows/publish-release.yml @@ -8,6 +8,7 @@ # vars.FROM_OWNER: forgejo-integration # vars.TO_OWNER: forgejo # vars.DOER: release-team +# vars.ROLE: forgejo-release # secrets.TOKEN: # secrets.GPG_PRIVATE_KEY: # secrets.GPG_PASSPHRASE: @@ -24,7 +25,7 @@ enable-email-notifications: true jobs: publish: runs-on: lxc-bookworm - if: vars.DOER != '' && vars.FORGEJO != '' && vars.TO_OWNER != '' && vars.FROM_OWNER != '' && secrets.TOKEN != '' + if: vars.ROLE == 'forgejo-release' steps: - uses: https://data.forgejo.org/actions/checkout@v4 diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 53182a98..9ce07101 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -19,7 +19,7 @@ env: jobs: build-and-tests: name: build and test - if: forge.repository_owner != 'forgejo-integration' && forge.repository_owner != 'forgejo-experimental' && forge.repository_owner != 'forgejo-release' + if: vars.ROLE == 'forgejo-coding' runs-on: docker container: image: 'code.forgejo.org/oci/ci:1' @@ -76,7 +76,7 @@ jobs: runner-exec-tests: needs: [build-and-tests] name: runner exec tests - if: forge.repository_owner != 'forgejo-integration' && forge.repository_owner != 'forgejo-experimental' && forge.repository_owner != 'forgejo-release' + if: vars.ROLE == 'forgejo-coding' runs-on: lxc-bookworm steps: From 2b9617c7f8c6455e611548ff3469accd885f5c8d Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 3 Aug 2025 09:57:24 +0000 Subject: [PATCH 030/281] feat: lxc-systemd defaults to using Forgejo runner 9.0.2 (#804) - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/804): feat: lxc-systemd defaults to using Forgejo runner 9.0.2 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/804 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- examples/lxc-systemd/README.md | 6 +++--- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/examples/lxc-systemd/README.md b/examples/lxc-systemd/README.md index d1d1b1d7..f2b3baf1 100644 --- a/examples/lxc-systemd/README.md +++ b/examples/lxc-systemd/README.md @@ -64,7 +64,7 @@ The creation of a new runner is driven by the following environment variables: - `INPUTS_SERIAL`: unique number in the range `[10-100]` (check `/etc/forgejo-runner`) - `INPUTS_TOKEN`: a runner registration token obtained from the web UI - `INPUTS_FORGEJO`: the Forgejo instance from which `INPUTS_TOKEN` was obtained (e.g. https://code.forgejo.org) -- `INPUTS_RUNNER_VERSION`: the version of the Forgejo runner as found in https://code.forgejo.org/forgejo/runner/releases (e.g. 6.3.0) +- `INPUTS_RUNNER_VERSION`: the version of the Forgejo runner as found in https://code.forgejo.org/forgejo/runner/releases (e.g. 9.0.2) - `INPUTS_LXC_CONFIG`: the value of the `--config` argument of [lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers/#usage) used when creating the LXC container for the runner (e.g. `docker`) - `INPUTS_LIFETIME`: the LXC container is re-created when its lifetime expires (e.g. 7d) @@ -86,5 +86,5 @@ The creation of a new runner is driven by the following environment variables: The goal is that a LXC container uses a version of the Forgejo runner that is different from the default. It needs to be installed and pinned. -- Install: `INPUTS_RUNNER_VERSION=6.3.0 forgejo-runner-service.sh install_runner` -- Pin the version in `/etc/forgejo-runner/N/env` (e.g. `INPUTS_RUNNER_VERSION=6.3.0`) +- Install: `INPUTS_RUNNER_VERSION=9.0.2 forgejo-runner-service.sh install_runner` +- Pin the version in `/etc/forgejo-runner/N/env` (e.g. `INPUTS_RUNNER_VERSION=9.0.2`) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 35085842..2a121503 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -21,7 +21,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} : ${INPUTS_LXC_HELPERS_VERSION:=1.0.3} -: ${INPUTS_RUNNER_VERSION:=7.0.0} +: ${INPUTS_RUNNER_VERSION:=9.0.2} : ${KILL_AFTER:=21600} # 6h == 21600 NODEJS_VERSION=20 From 73797fe7cd4f54f18fc2c5e447db9c123c5d4c3d Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 3 Aug 2025 09:57:41 +0000 Subject: [PATCH 031/281] chore: explain that part of the source is Apache 2 (#803) When ACT was transplanted in the runner, it brought with it Apache 2 licensed code copied from the docker project. Clarify that in the README. It has no impact on the future relicensing to GPLv3+ because Apache 2 is a compatible license. Refs: https://code.forgejo.org/forgejo/runner/pulls/773 Refs: https://www.gnu.org/licenses/license-list.en.html#apache2 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/803): chore: explain that part of the source is Apache 2 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/803 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README.md b/README.md index 6fd0829e..043f6952 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,14 @@ When filing a bug in [the issue tracker](https://code.forgejo.org/forgejo/runner Sensitive security-related issues should be reported to [security@forgejo.org](mailto:security@forgejo.org) using [encryption](https://keyoxide.org/security@forgejo.org). + +## License + +The Forgejo runner source code is distributed under the terms of the following licenses: + +- [MIT](LICENSE) for the most part. +- [Apache 2](act/container/DOCKER_LICENSE) for parts found in the [act/container](act/container) directory. + # Architectures & OS The Forgejo runner is supported and tested on `amd64` and `arm64` ([binaries](https://code.forgejo.org/forgejo/runner/releases) and [containers](https://code.forgejo.org/forgejo/-/packages/container/runner/versions)) on Operating Systems based on the Linux kernel. From 2e9bb84bae475964dadce47ecfff76cf29f1a016 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 3 Aug 2025 15:41:13 +0000 Subject: [PATCH 032/281] Update module github.com/containerd/errdefs to v1 (#807) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/containerd/errdefs](https://github.com/containerd/errdefs) | `v0.3.0` -> `v1.0.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fcontainerd%2ferrdefs/v1.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fcontainerd%2ferrdefs/v0.3.0/v1.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
containerd/errdefs (github.com/containerd/errdefs) ### [`v1.0.0`](https://github.com/containerd/errdefs/releases/tag/v1.0.0) [Compare Source](https://github.com/containerd/errdefs/compare/v0.3.0...v1.0.0) The first major release of errdefs brings a guarantee of stability with the error types and interface. Additional functions for grpc and http error translation and stacktraces can be found in the separate `github.com/containerd/errdefs/pkg` module.
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/807 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f720c2b2..32b0fef1 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ require ( connectrpc.com/connect v1.18.1 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 - github.com/containerd/errdefs v0.3.0 + github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 github.com/docker/cli v28.3.3+incompatible diff --git a/go.sum b/go.sum index fd6e8a34..50aa8317 100644 --- a/go.sum +++ b/go.sum @@ -27,8 +27,8 @@ github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqy github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0= github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs= -github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4= -github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= +github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= +github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE= github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk= github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= From 9ec950289e00a4fd2225b82784d75cacdc4b617f Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 3 Aug 2025 17:45:58 +0000 Subject: [PATCH 033/281] chore: teach renovate about examples/lxc-systemd/forgejo-runner-service.sh (#627) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/627): chore: teach renovate about examples/lxc-systemd/forgejo-runner-service.sh Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/627 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- examples/lxc-systemd/forgejo-runner-service.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 2a121503..24a5d755 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -20,8 +20,10 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_TOKEN:=} : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} -: ${INPUTS_LXC_HELPERS_VERSION:=1.0.3} -: ${INPUTS_RUNNER_VERSION:=9.0.2} +DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers +: ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} +DEFAULT_RUNNER_VERSION=9.0.2 # renovate: datasource=forgejo-releases depName=forgejo/runner +: ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 NODEJS_VERSION=20 From ce0c5b2b788be201cedd53b793a6bd80105f88dd Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Mon, 4 Aug 2025 08:06:31 +0000 Subject: [PATCH 034/281] upgrade lxc-helpers (#806) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/41 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/806): upgrade lxc-helpers Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/806 Reviewed-by: earl-warren Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index 42812d42..2f36541f 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -450,6 +450,7 @@ function lxc_install_docker_inside() { mkdir /etc/docker cat >/etc/docker/daemon.json < Date: Mon, 4 Aug 2025 13:20:22 +0000 Subject: [PATCH 035/281] fix: log the URL of the action when it fails schema validation (#810) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ``` $ go test -v -run='TestRunner_RunEvent$/local-action-fails-schema-validation' ./act/runner ... [fails-schema-validation/test] ❌ Failure - Main ./local-action-fails-schema-validation/action [fails-schema-validation/test] failed to validate action.y*ml from action './local-action-fails-schema-validation/action' with path '': Line: 2 Column 3: Failed to match null: Line: 2 Column 3: Expected a scalar got mapping Line: 2 Column 3: Failed to match inputs-mapping: Line: 3 Column 5: Failed to match null: Line: 3 Column 5: Expected a scalar got mapping Line: 3 Column 5: Failed to match input-mapping: Line: 3 Column 14: Unknown Variable Access secrets ... ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/810): fix: log the URL of the action when it fails schema validation Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/810 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/action.go | 5 ++++- act/runner/job_executor_test.go | 4 ++-- act/runner/runner_test.go | 11 +++++++---- act/runner/step_action_remote.go | 3 +-- .../action/action.yml | 7 +++++++ .../local-action-fails-schema-validation/push.yml | 9 +++++++++ 6 files changed, 30 insertions(+), 9 deletions(-) create mode 100644 act/runner/testdata/local-action-fails-schema-validation/action/action.yml create mode 100644 act/runner/testdata/local-action-fails-schema-validation/push.yml diff --git a/act/runner/action.go b/act/runner/action.go index 16961cd3..c777573d 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -45,7 +45,7 @@ func readActionImpl(ctx context.Context, step *model.Step, actionDir, actionPath allErrors := []error{} addError := func(fileName string, err error) { if err != nil { - allErrors = append(allErrors, fmt.Errorf("failed to read '%s' from action '%s' with path '%s' of step %w", fileName, step.String(), actionPath, err)) + allErrors = append(allErrors, fmt.Errorf("failed to read '%s' from action '%s' with path '%s': %w", fileName, step.String(), actionPath, err)) } else { // One successful read, clear error state allErrors = nil @@ -112,6 +112,9 @@ func readActionImpl(ctx context.Context, step *model.Step, actionDir, actionPath defer closer.Close() action, err := model.ReadAction(reader) + if err != nil { + err = fmt.Errorf("failed to validate action.y*ml from action '%s' with path '%s': %v", step.String(), actionPath, err) + } logger.Debugf("Read action %v from '%s'", action, "Unknown") return action, err } diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index cd940f8d..f5c6e110 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -16,13 +16,13 @@ import ( func TestJobExecutor(t *testing.T) { tables := []TestJobFileInfo{ {workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets}, - {workdir, "uses-github-empty", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets}, + {workdir, "uses-github-empty", "push", "job:test step:empty", platforms, secrets}, {workdir, "uses-github-noref", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets}, {workdir, "uses-github-root", "push", "", platforms, secrets}, {workdir, "uses-github-path", "push", "", platforms, secrets}, {workdir, "uses-docker-url", "push", "", platforms, secrets}, {workdir, "uses-github-full-sha", "push", "", platforms, secrets}, - {workdir, "uses-github-short-sha", "push", "Unable to resolve action `actions/hello-world-docker-action@b136eb8`, the provided ref `b136eb8` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `b136eb8894c5cb1dd5807da824be97ccdf9b5423` instead", platforms, secrets}, + {workdir, "uses-github-short-sha", "push", "Please use the full commit SHA", platforms, secrets}, {workdir, "job-nil-step", "push", "invalid Step 0: missing run or uses key", platforms, secrets}, } // These tests are sufficient to only check syntax. diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 34045bd0..0a11a5ea 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -14,6 +14,7 @@ import ( "github.com/joho/godotenv" log "github.com/sirupsen/logrus" assert "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "gopkg.in/yaml.v3" "code.forgejo.org/forgejo/runner/v9/act/common" @@ -209,7 +210,8 @@ func (j *TestJobFileInfo) runTest(ctx context.Context, t *testing.T, cfg *Config if j.errorMessage == "" { assert.NoError(t, err, fullWorkflowPath) } else { - assert.Error(t, err, j.errorMessage) + require.Error(t, err, j.errorMessage) + assert.ErrorContains(t, err, j.errorMessage) } } } @@ -240,6 +242,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "shells/pwsh", "push", "", platforms, secrets}, // Local action + {workdir, "local-action-fails-schema-validation", "push", "Job 'test' failed", platforms, secrets}, {workdir, "local-action-docker-url", "push", "", platforms, secrets}, {workdir, "local-action-dockerfile", "push", "", platforms, secrets}, {workdir, "local-action-via-composite-dockerfile", "push", "", platforms, secrets}, @@ -265,7 +268,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "evalmatrix-merge-array", "push", "", platforms, secrets}, {workdir, "basic", "push", "", platforms, secrets}, - {workdir, "fail", "push", "exit with `FAILURE`: 1", platforms, secrets}, + {workdir, "fail", "push", "Job 'build' failed", platforms, secrets}, {workdir, "runs-on", "push", "", platforms, secrets}, {workdir, "checkout", "push", "", platforms, secrets}, {workdir, "job-container", "push", "", platforms, secrets}, @@ -294,7 +297,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "networking", "push", "", platforms, secrets}, {workdir, "steps-context/conclusion", "push", "", platforms, secrets}, {workdir, "steps-context/outcome", "push", "", platforms, secrets}, - {workdir, "job-status-check", "push", "job 'fail' failed", platforms, secrets}, + {workdir, "job-status-check", "push", "Job 'fail' failed", platforms, secrets}, {workdir, "if-expressions", "push", "Job 'mytest' failed", platforms, secrets}, {workdir, "actions-environment-and-context-tests", "push", "", platforms, secrets}, {workdir, "uses-action-with-pre-and-post-step", "push", "", platforms, secrets}, @@ -313,7 +316,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets}, {workdir, "set-env-step-env-override", "push", "", platforms, secrets}, {workdir, "set-env-new-env-file-per-step", "push", "", platforms, secrets}, - {workdir, "no-panic-on-invalid-composite-action", "push", "jobs failed due to invalid action", platforms, secrets}, + {workdir, "no-panic-on-invalid-composite-action", "push", "missing steps in composite action", platforms, secrets}, {workdir, "tool-cache", "push", "", platforms, secrets}, // services diff --git a/act/runner/step_action_remote.go b/act/runner/step_action_remote.go index 920960c5..fdbbf794 100644 --- a/act/runner/step_action_remote.go +++ b/act/runner/step_action_remote.go @@ -42,7 +42,6 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor { return nil } - // For gitea: // Since actions can specify the download source via a url prefix. // The prefix may contain some sensitive information that needs to be stored in secrets, // so we need to interpolate the expression value for uses first. @@ -50,7 +49,7 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor { sar.remoteAction = newRemoteAction(sar.Step.Uses) if sar.remoteAction == nil { - return fmt.Errorf("Expected format {org}/{repo}[/path]@ref. Actual '%s' Input string was not in a correct format", sar.Step.Uses) + return fmt.Errorf("Expected format {org}/{repo}[/path]@ref or https://example.com/{org}/{repo}[/path]@ref. Actual '%s' Input string was not in a correct format", sar.Step.Uses) } github := sar.getGithubContext(ctx) diff --git a/act/runner/testdata/local-action-fails-schema-validation/action/action.yml b/act/runner/testdata/local-action-fails-schema-validation/action/action.yml new file mode 100644 index 00000000..75b4bef4 --- /dev/null +++ b/act/runner/testdata/local-action-fails-schema-validation/action/action.yml @@ -0,0 +1,7 @@ +inputs: + leak: + default: '${{ secrets.SOMESECRET }}' +runs: + using: composite + steps: + - run: echo OK diff --git a/act/runner/testdata/local-action-fails-schema-validation/push.yml b/act/runner/testdata/local-action-fails-schema-validation/push.yml new file mode 100644 index 00000000..1675478c --- /dev/null +++ b/act/runner/testdata/local-action-fails-schema-validation/push.yml @@ -0,0 +1,9 @@ +name: fails-schema-validation +on: push + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + - uses: ./local-action-fails-schema-validation/action From 8819e2a195f7a6d985433d2fef30e172ba55db65 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Tue, 5 Aug 2025 14:00:27 +0000 Subject: [PATCH 036/281] chore: links to container images and documentation in the release (#811) The 9.0.3 release was manually updated so it shows how it would look. https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.3 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/811): chore: links to container images and documentation in the release Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/811 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/publish-release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml index 247ec929..5555996a 100644 --- a/.forgejo/workflows/publish-release.yml +++ b/.forgejo/workflows/publish-release.yml @@ -38,6 +38,10 @@ jobs: to-owner: ${{ vars.TO_OWNER }} repo: "runner" release-notes: | + - [User guide](https://forgejo.org/docs/next/user/actions/overview/) + - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) + - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) + Release Notes --- From 386baae8de295f291d385c8502f109bdf903ddd8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 6 Aug 2025 13:07:24 +0000 Subject: [PATCH 037/281] Update dependency forgejo/runner to v9.0.3 (#812) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | patch | `9.0.2` -> `9.0.3` | --- ### Release Notes
forgejo/runner (forgejo/runner) ### [`v9.0.3`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.3) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.2...v9.0.3) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/804): feat: lxc-systemd defaults to using Forgejo runner 9.0.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/784): feat: --health-\* options are allowed in `job..services..options` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/810): fix: log the URL of the action when it fails schema validation - [PR](https://code.forgejo.org/forgejo/runner/pulls/798): fix: lingering services/volumes/networks after jobs if cleanup takes >1min - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/806): chore: upgrade lxc-helpers - [PR](https://code.forgejo.org/forgejo/runner/pulls/627): chore: teach renovate about examples/lxc-systemd/forgejo-runner-service.sh - [PR](https://code.forgejo.org/forgejo/runner/pulls/807): Update module github.com/containerd/errdefs to v1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/803): chore: explain that part of the source is Apache 2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/790): chore(cleanup): dispatch workflows according to the role of the repository - [PR](https://code.forgejo.org/forgejo/runner/pulls/797): chore: unify forgejo image names location - [PR](https://code.forgejo.org/forgejo/runner/pulls/799): chore: replace docker hub with code.forgejo.org - [PR](https://code.forgejo.org/forgejo/runner/pulls/802): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.3.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/801): Update module github.com/opencontainers/selinux to v1.12.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/800): Update module github.com/go-git/go-git/v5 to v5.16.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/796): Update module github.com/docker/cli to v28.3.3+incompatible - [PR](https://code.forgejo.org/forgejo/runner/pulls/795): Update dependency forgejo/release-notes-assistant to v1.4.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/794): Update module github.com/spf13/pflag to v1.0.7 - [PR](https://code.forgejo.org/forgejo/runner/pulls/793): Update module github.com/opencontainers/image-spec to v1.1.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/792): Update module go.etcd.io/bbolt to v1.4.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/791): Update module github.com/rhysd/actionlint to v1.7.7 - [PR](https://code.forgejo.org/forgejo/runner/pulls/787): Update module github.com/go-git/go-billy/v5 to v5.6.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/789): chore: the release link to RELEASE-NOTES.md is no longer needed (take 2)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/812 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 24a5d755..e3adca25 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=9.0.2 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=9.0.3 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 8644cc9e07016a689edd3ffaf4282037dab18093 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 7 Aug 2025 04:18:50 +0000 Subject: [PATCH 038/281] Update dependency go to v1.23.12 (#814) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.23.11` -> `1.23.12` | --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/814 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 32b0fef1..6579859a 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.forgejo.org/forgejo/runner/v9 go 1.23.0 -toolchain go1.23.11 +toolchain go1.23.12 require ( code.forgejo.org/forgejo/actions-proto v0.5.1 From 96891ab314f5ae49cd14210592ccc0a69d678b1b Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 7 Aug 2025 04:36:26 +0000 Subject: [PATCH 039/281] feat: wait for services to be healthy before starting a job (#805) If a --health-cmd is defined for a container, block until its status is healthy or unhealthy. The timeout is defined by the server internal logic based on associated --health-* defined delays. If it blocks indefinitely, the job timeout will eventually cancel it. While waiting, the simplest solution would be to sleep 1 second until the container is healthy or unhealthy. To minimize log verbosity, the sleep interval is instead set to --health-interval and default to one second if it is not defined. This logic does not apply to host containers as they do not support services. They are assumed to always be healthy. If --health-cmd is set for the container running a job, the first step will start to run without waiting for the container to become healthy. There may be valid use cases for that but they are not the focus of this implementation. - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/805): feat: wait for services to be healthy before starting a job Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/805 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/container_types.go | 2 + act/container/docker_run.go | 42 ++++++++++ act/container/docker_run_test.go | 76 +++++++++++++++++++ act/container/host_environment.go | 4 + act/runner/run_context.go | 30 ++++++++ act/runner/run_context_test.go | 44 +++++++++++ act/runner/runner_test.go | 2 + .../push.yml | 21 +++++ .../push.yml | 17 +++++ act/runner/testdata/services/push.yaml | 4 +- 10 files changed, 240 insertions(+), 2 deletions(-) create mode 100644 act/runner/testdata/mysql-service-container-premature-terminate/push.yml create mode 100644 act/runner/testdata/mysql-service-container-with-health-check/push.yml diff --git a/act/container/container_types.go b/act/container/container_types.go index 3d3a5162..8fe651f3 100644 --- a/act/container/container_types.go +++ b/act/container/container_types.go @@ -3,6 +3,7 @@ package container import ( "context" "io" + "time" "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/go-connections/nat" @@ -63,6 +64,7 @@ type Container interface { Remove() common.Executor Close() common.Executor ReplaceLogWriter(io.Writer, io.Writer) (io.Writer, io.Writer) + IsHealthy(ctx context.Context) (time.Duration, error) } // NewDockerBuildExecutorInput the input for the NewDockerBuildExecutor function diff --git a/act/container/docker_run.go b/act/container/docker_run.go index 1c790d6a..34eb3703 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -15,6 +15,7 @@ import ( "runtime" "strconv" "strings" + "time" "github.com/Masterminds/semver" "github.com/docker/cli/cli/compose/loader" @@ -191,6 +192,47 @@ func (cr *containerReference) Remove() common.Executor { ).IfNot(common.Dryrun) } +func (cr *containerReference) inspect(ctx context.Context) (container.InspectResponse, error) { + resp, err := cr.cli.ContainerInspect(ctx, cr.id) + if err != nil { + err = fmt.Errorf("service %v: %s", cr.input.NetworkAliases, err) + } + return resp, err +} + +func (cr *containerReference) IsHealthy(ctx context.Context) (time.Duration, error) { + resp, err := cr.inspect(ctx) + if err != nil { + return 0, err + } + return cr.isHealthy(ctx, resp) +} + +func (cr *containerReference) isHealthy(ctx context.Context, resp container.InspectResponse) (time.Duration, error) { + logger := common.Logger(ctx) + if resp.Config == nil || resp.Config.Healthcheck == nil || resp.State == nil || resp.State.Health == nil || len(resp.Config.Healthcheck.Test) == 1 && strings.EqualFold(resp.Config.Healthcheck.Test[0], "NONE") { + logger.Debugf("no container health check defined, hope for the best") + return 0, nil + } + + switch resp.State.Health.Status { + case container.Starting: + wait := resp.Config.Healthcheck.Interval + if wait <= 0 { + wait = time.Second + } + logger.Infof("service %v: container health check %s (%s) is starting, waiting %v", cr.input.NetworkAliases, cr.id, resp.Config.Image, wait) + return wait, nil + case container.Healthy: + logger.Infof("service %v: container health check %s (%s) is healthy", cr.input.NetworkAliases, cr.id, resp.Config.Image) + return 0, nil + case container.Unhealthy: + return 0, fmt.Errorf("service %v: container health check %s (%s) is not healthy", cr.input.NetworkAliases, cr.id, resp.Config.Image) + default: + return 0, fmt.Errorf("service %v: unexpected health status %s (%s) %v", cr.input.NetworkAliases, cr.id, resp.Config.Image, resp.State.Health.Status) + } +} + func (cr *containerReference) ReplaceLogWriter(stdout, stderr io.Writer) (io.Writer, io.Writer) { out := cr.input.Stdout err := cr.input.Stderr diff --git a/act/container/docker_run_test.go b/act/container/docker_run_test.go index 1069f895..91c579fe 100644 --- a/act/container/docker_run_test.go +++ b/act/container/docker_run_test.go @@ -386,3 +386,79 @@ func TestMergeJobOptions(t *testing.T) { }) } } + +func TestDockerRun_isHealthy(t *testing.T) { + cr := containerReference{ + id: "containerid", + input: &NewContainerInput{ + NetworkAliases: []string{"servicename"}, + }, + } + ctx := context.Background() + makeInspectResponse := func(interval time.Duration, status container.HealthStatus, test []string) container.InspectResponse { + return container.InspectResponse{ + Config: &container.Config{ + Image: "example.com/some/image", + Healthcheck: &container.HealthConfig{ + Interval: interval, + Test: test, + }, + }, + ContainerJSONBase: &container.ContainerJSONBase{ + State: &container.State{ + Health: &container.Health{ + Status: status, + }, + }, + }, + } + } + + t.Run("IncompleteResponseOrNoHealthCheck", func(t *testing.T) { + wait, err := cr.isHealthy(ctx, container.InspectResponse{}) + assert.Zero(t, wait) + assert.NoError(t, err) + + // --no-healthcheck translates into a NONE test command + resp := makeInspectResponse(0, container.NoHealthcheck, []string{"NONE"}) + wait, err = cr.isHealthy(ctx, resp) + assert.Zero(t, wait) + assert.NoError(t, err) + }) + + t.Run("StartingUndefinedIntervalIsNotZero", func(t *testing.T) { + resp := makeInspectResponse(0, container.Starting, nil) + wait, err := cr.isHealthy(ctx, resp) + assert.NotZero(t, wait) + assert.NoError(t, err) + }) + + t.Run("StartingWithInterval", func(t *testing.T) { + expectedWait := time.Duration(42) + resp := makeInspectResponse(expectedWait, container.Starting, nil) + actualWait, err := cr.isHealthy(ctx, resp) + assert.Equal(t, expectedWait, actualWait) + assert.NoError(t, err) + }) + + t.Run("Unhealthy", func(t *testing.T) { + resp := makeInspectResponse(0, container.Unhealthy, nil) + wait, err := cr.isHealthy(ctx, resp) + assert.Zero(t, wait) + assert.ErrorContains(t, err, "is not healthy") + }) + + t.Run("Healthy", func(t *testing.T) { + resp := makeInspectResponse(0, container.Healthy, nil) + wait, err := cr.isHealthy(ctx, resp) + assert.Zero(t, wait) + assert.NoError(t, err) + }) + + t.Run("UnknownStatus", func(t *testing.T) { + resp := makeInspectResponse(0, container.NoHealthcheck, nil) + wait, err := cr.isHealthy(ctx, resp) + assert.Zero(t, wait) + assert.ErrorContains(t, err, "unexpected") + }) +} diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 045d7774..fe1fef6d 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -493,6 +493,10 @@ func (e *HostEnvironment) GetRunnerContext(_ context.Context) map[string]interfa } } +func (e *HostEnvironment) IsHealthy(ctx context.Context) (time.Duration, error) { + return 0, nil +} + func (e *HostEnvironment) ReplaceLogWriter(stdout, _ io.Writer) (io.Writer, io.Writer) { org := e.StdOut e.StdOut = stdout diff --git a/act/runner/run_context.go b/act/runner/run_context.go index d1fc1cd8..213f5dd5 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -610,6 +610,7 @@ func (rc *RunContext) startJobContainer() common.Executor { Mode: 0o666, Body: "", }), + rc.waitForServiceContainers(), )(ctx) } } @@ -744,6 +745,35 @@ func (rc *RunContext) startServiceContainers(_ string) common.Executor { } } +func waitForServiceContainer(ctx context.Context, c container.ExecutionsEnvironment) error { + for { + wait, err := c.IsHealthy(ctx) + if err != nil { + return err + } + if wait == time.Duration(0) { + return nil + } + select { + case <-ctx.Done(): + return nil + case <-time.After(wait): + } + } +} + +func (rc *RunContext) waitForServiceContainers() common.Executor { + return func(ctx context.Context) error { + execs := []common.Executor{} + for _, c := range rc.ServiceContainers { + execs = append(execs, func(ctx context.Context) error { + return waitForServiceContainer(ctx, c) + }) + } + return common.NewParallelExecutor(len(execs), execs...)(ctx) + } +} + func (rc *RunContext) stopServiceContainers() common.Executor { return func(ctx context.Context) error { execs := []common.Executor{} diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 24caa4ad..0fa41307 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -3,12 +3,14 @@ package runner import ( "cmp" "context" + "errors" "fmt" "os" "runtime" "slices" "strings" "testing" + "time" "code.forgejo.org/forgejo/runner/v9/act/container" "code.forgejo.org/forgejo/runner/v9/act/exprparser" @@ -18,6 +20,7 @@ import ( "github.com/docker/go-connections/nat" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/mock" "github.com/stretchr/testify/require" yaml "gopkg.in/yaml.v3" ) @@ -824,3 +827,44 @@ jobs: }) } } + +type waitForServiceContainerMock struct { + mock.Mock + container.Container + container.LinuxContainerEnvironmentExtensions +} + +func (o *waitForServiceContainerMock) IsHealthy(ctx context.Context) (time.Duration, error) { + args := o.Called(ctx) + return args.Get(0).(time.Duration), args.Error(1) +} + +func Test_waitForServiceContainer(t *testing.T) { + t.Run("Wait", func(t *testing.T) { + m := &waitForServiceContainerMock{} + ctx := context.Background() + mock.InOrder( + m.On("IsHealthy", ctx).Return(1*time.Millisecond, nil).Once(), + m.On("IsHealthy", ctx).Return(time.Duration(0), nil).Once(), + ) + require.NoError(t, waitForServiceContainer(ctx, m)) + m.AssertExpectations(t) + }) + + t.Run("Cancel", func(t *testing.T) { + m := &waitForServiceContainerMock{} + ctx, cancel := context.WithCancel(context.Background()) + cancel() + m.On("IsHealthy", ctx).Return(1*time.Millisecond, nil).Once() + require.NoError(t, waitForServiceContainer(ctx, m)) + m.AssertExpectations(t) + }) + + t.Run("Error", func(t *testing.T) { + m := &waitForServiceContainerMock{} + ctx := context.Background() + m.On("IsHealthy", ctx).Return(time.Duration(0), errors.New("ERROR")) + require.ErrorContains(t, waitForServiceContainer(ctx, m), "ERROR") + m.AssertExpectations(t) + }) +} diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 0a11a5ea..d7a5b876 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -322,6 +322,8 @@ func TestRunner_RunEvent(t *testing.T) { // services {workdir, "services", "push", "", platforms, secrets}, {workdir, "services-with-container", "push", "", platforms, secrets}, + {workdir, "mysql-service-container-with-health-check", "push", "", platforms, secrets}, + {workdir, "mysql-service-container-premature-terminate", "push", "service [maindb]", platforms, secrets}, } for _, table := range tables { diff --git a/act/runner/testdata/mysql-service-container-premature-terminate/push.yml b/act/runner/testdata/mysql-service-container-premature-terminate/push.yml new file mode 100644 index 00000000..768e3e3e --- /dev/null +++ b/act/runner/testdata/mysql-service-container-premature-terminate/push.yml @@ -0,0 +1,21 @@ +name: service-container +on: push +jobs: + service-container-test: + runs-on: ubuntu-latest + container: code.forgejo.org/oci/mysql:8.4 + services: + maindb: + image: code.forgejo.org/oci/mysql:8.4 + # This container should immediately exit due to missing env variable for password config. ... [ERROR] + # [Entrypoint]: Database is uninitialized and password option is not specified You need to specify one of the + # following as an environment variable: + # - MYSQL_ROOT_PASSWORD + # - MYSQL_ALLOW_EMPTY_PASSWORD + # - MYSQL_RANDOM_ROOT_PASSWORD + # + # This container should retain the same health check config as the mysql-service-container-with-health-check + # case. + options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3 + steps: + - run: exit 100 # should never be hit since service will never be healthy diff --git a/act/runner/testdata/mysql-service-container-with-health-check/push.yml b/act/runner/testdata/mysql-service-container-with-health-check/push.yml new file mode 100644 index 00000000..efb8b2e5 --- /dev/null +++ b/act/runner/testdata/mysql-service-container-with-health-check/push.yml @@ -0,0 +1,17 @@ +name: service-container +on: push +jobs: + service-container-test: + runs-on: ubuntu-latest + container: code.forgejo.org/oci/mysql:8.4 + services: + maindb: + image: code.forgejo.org/oci/mysql:8.4 + env: + MYSQL_DATABASE: dbname + MYSQL_USER: dbuser + MYSQL_PASSWORD: dbpass + MYSQL_RANDOM_ROOT_PASSWORD: yes + options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3 + steps: + - run: mysql -u dbuser -D dbname -pdbpass -h maindb -e "create table T(id INT NOT NULL AUTO_INCREMENT, val VARCHAR(255), PRIMARY KEY (id))" diff --git a/act/runner/testdata/services/push.yaml b/act/runner/testdata/services/push.yaml index 03ac0855..3884a43f 100644 --- a/act/runner/testdata/services/push.yaml +++ b/act/runner/testdata/services/push.yaml @@ -6,7 +6,7 @@ jobs: runs-on: ubuntu-latest services: postgres: - image: code.forgejo.org/oci/bitnami/postgresql:16 + image: code.forgejo.org/oci/postgres:16 env: POSTGRES_USER: runner POSTGRES_PASSWORD: mysecretdbpass @@ -15,7 +15,7 @@ jobs: --health-cmd pg_isready --health-interval 10s --health-timeout 5s - --health-retries 5 + --health-retries 20 ports: - 5432:5432 steps: From 79285e896bcebc87de24fa5a451d5508a204a0ce Mon Sep 17 00:00:00 2001 From: earl-warren Date: Thu, 7 Aug 2025 08:02:28 +0000 Subject: [PATCH 040/281] chore: run_context: add GITHUB_RUN_ATTEMPT (#2458) (#817) * run_context: add GITHUB_RUN_ATTEMPT Fixes https://github.com/nektos/act/issues/2451 Fixes https://github.com/nektos/act/issues/1615 * fix whitespace * fix githubcontext * fix TestSetupEnv --------- Co-authored-by: ChristopherHX Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> (cherry picked from commit 4178166d289bae351ef6d33414cc569518e62a01) ``` Conflicts: act/runner/run_context.go trivial context conflict act/runner/step_test.go the corresponding test was removed in the Forgejo runner ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/817): chore: run_context: add GITHUB_RUN_ATTEMPT (#2458) Co-authored-by: Ryan Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/817 Reviewed-by: Michael Kriese --- act/model/github_context.go | 1 + act/runner/run_context.go | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/act/model/github_context.go b/act/model/github_context.go index e7c8809e..02d4f779 100644 --- a/act/model/github_context.go +++ b/act/model/github_context.go @@ -13,6 +13,7 @@ type GithubContext struct { Event map[string]interface{} `json:"event"` EventPath string `json:"event_path"` Workflow string `json:"workflow"` + RunAttempt string `json:"run_attempt"` RunID string `json:"run_id"` RunNumber string `json:"run_number"` Actor string `json:"actor"` diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 213f5dd5..97615023 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -1108,6 +1108,7 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext ghc := &model.GithubContext{ Event: make(map[string]interface{}), Workflow: rc.Run.Workflow.Name, + RunAttempt: rc.Config.Env["GITHUB_RUN_ATTEMPT"], RunID: rc.Config.Env["GITHUB_RUN_ID"], RunNumber: rc.Config.Env["GITHUB_RUN_NUMBER"], Actor: rc.Config.Actor, @@ -1136,6 +1137,10 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext ghc.Workspace = rc.JobContainer.ToContainerPath(rc.Config.Workdir) } + if ghc.RunAttempt == "" { + ghc.RunAttempt = "1" + } + if ghc.RunID == "" { ghc.RunID = "1" } @@ -1294,6 +1299,7 @@ func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubCon } env["CI"] = "true" set("WORKFLOW", github.Workflow) + set("RUN_ATTEMPT", github.RunAttempt) set("RUN_ID", github.RunID) set("RUN_NUMBER", github.RunNumber) set("ACTION", github.Action) From 7a02f8e4029c69f63498b932b8fd913a3f2e6dd6 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 7 Aug 2025 08:56:39 +0000 Subject: [PATCH 041/281] chore: restore GitHub windows build workflow (#815) Incorrectly removed in bc716490af23c28a4197ea2973ac5e4150728800 Refs https://code.forgejo.org/forgejo/runner/pulls/767 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/815): chore: restore GitHub windows build workflow Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/815 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .github/workflows/build-release.yml | 151 ++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+) create mode 100644 .github/workflows/build-release.yml diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml new file mode 100644 index 00000000..d179d7bb --- /dev/null +++ b/.github/workflows/build-release.yml @@ -0,0 +1,151 @@ +# This workflow: +# - builds and uploads a binary artifact for each Windows architecture +# - tests the runner on Windows with a Forgejo server container running on Windows Subsystem for Linux (WSL) +# - releases the binary artifact (if triggered on a pushed tag) +# +# This build is currently supported on https://github.com/Crown0815/forgejo-runner-windows + +name: Build Release + +on: + push: + tags: ['v*'] + branches: [ main ] + +jobs: + build: + name: Build ${{matrix.architecture}} + runs-on: ubuntu-latest + strategy: + matrix: + architecture: ['386', amd64, arm, arm64] + steps: + - uses: actions/checkout@v4 + - name: Build for ${{matrix.architecture}} + run: | + env GOOS=windows GOARCH=${{matrix.architecture}} \ + go build \ + -ldflags "-s -w -X code.forgejo.org/forgejo/runner/internal/pkg/ver.version=${{ github.ref_name }}" \ + -o forgejo-runner-windows-${{matrix.architecture}}.exe + + - uses: actions/upload-artifact@v4 + with: + name: forgejo-runner-windows-${{matrix.architecture}} + path: forgejo-runner-windows-${{matrix.architecture}}.exe + + + test: + name: Run Tests on Windows with Linux Forgejo Server + runs-on: windows-latest + env: + FORGEJO_ROOT_URL: 'http://localhost:3000/' + FORGEJO_ADMIN_USER: 'admin_user' + FORGEJO_ADMIN_PASSWORD: 'admin_password' + FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' + MAX_WAIT_ITERATIONS: 30 + + steps: + - name: Windows - Checkout code + uses: actions/checkout@v4 + + - name: Windows - Setup Windows Subsystem for Linux (WSL) + uses: Vampire/setup-wsl@v5 + with: + distribution: Alpine + wsl-shell-user: root + additional-packages: bash + + - name: WSL - Install Docker + shell: wsl-bash {0} + run: | + apk --update add --no-cache docker curl + + rc-update add docker default + openrc default + + # Wait for Docker to be ready + i=0 + until docker info > /dev/null 2>&1 || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do + echo "Waiting for Docker to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})" + sleep 1 + done + [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Docker is ready!" || { echo "Timed out waiting for Docker" ; exit 1; } + + - name: WSL - Start Forgejo Server + shell: wsl-bash {0} + run: | + docker run -d --name forgejo \ + -p 3000:3000 \ + -e USER_UID=1000 \ + -e USER_GID=1000 \ + -e FORGEJO__security__INSTALL_LOCK=true \ + -e FORGEJO__server__DOMAIN=localhost \ + -e FORGEJO__server__ROOT_URL=${{ env.FORGEJO_ROOT_URL }} \ + codeberg.org/forgejo/forgejo:11.0-rootless + + - name: Windows - Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: Windows - Install dependencies + run: go mod download + + - name: WSL - Register Runner on Forgejo Server + # Starting the Forgejo server takes some time. + # That time used to install go. + shell: wsl-bash {0} + run: | + i=0 + until curl -s ${{ env.FORGEJO_ROOT_URL }}/api/v1/version > /dev/null || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do + echo "Waiting for Forgejo to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})" + sleep 1 + done + [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Forgejo is ready!" || { echo "Timed out waiting for Forgejo" ; exit 1; } + + # Create admin user and generate runner token + docker exec forgejo forgejo admin user create --admin --username ${{ env.FORGEJO_ADMIN_USER }} --password ${{ env.FORGEJO_ADMIN_PASSWORD }} --email root@example.com + docker exec forgejo forgejo forgejo-cli actions register --labels docker --name therunner --secret ${{ env.FORGEJO_RUNNER_SECRET }} + + - name: Windows - Connect to Forgejo server + run: | + $configFileContent = @" + log: + level: debug + runner: + labels: + - windows:host + - docker:docker://node:20 + "@ + Set-Content -Path temporaryConfig.yml -Value $configFileContent + + # Register the runner + go run main.go create-runner-file --config temporaryConfig.yml --instance ${{ env.FORGEJO_ROOT_URL }} --secret ${{ env.FORGEJO_RUNNER_SECRET }} --name "windows-test-runner" + + - name: Windows - Run tests + run: go test -v ./... + env: + FORGEJO_URL: ${{ env.FORGEJO_ROOT_URL }} + FORGEJO_RUNNER_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }} + FORGEJO_RUNNER_HEX_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }} + + + release: + runs-on: ubuntu-latest + needs: [build, test] + if: github.event_name == 'push' && github.ref_type == 'tag' + steps: + - uses: actions/download-artifact@v4 + with: + path: . + + - name: Create Release + uses: softprops/action-gh-release@v2 + with: + tag_name: ${{ github.ref_name }} + files: forgejo-runner-windows-*/forgejo-runner-windows-*.exe + draft: false + prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }} + token: ${{ secrets.RELEASE_TOKEN }} + fail_on_unmatched_files: true + body: See [original release notes](https://code.forgejo.org/forgejo/runner/releases/tag/${{ github.ref_name }}). From e22d12ae53ff214252149e39a586050d4632b441 Mon Sep 17 00:00:00 2001 From: earl-warren Date: Thu, 7 Aug 2025 09:50:35 +0000 Subject: [PATCH 042/281] fix: amd64 arch to X64 (#2580) (#819) (cherry picked from commit c671295aab9192b49e4acc981e9c5b2c1d567884) Refs https://github.com/nektos/act/pull/2580/files - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/819): fix: amd64 arch to X64 (#2580) Co-authored-by: derrik <82898438+derrik-fleming@users.noreply.github.com> Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/819 Reviewed-by: Michael Kriese --- act/container/host_environment.go | 1 + 1 file changed, 1 insertion(+) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index fe1fef6d..43cb2974 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -462,6 +462,7 @@ func (*HostEnvironment) JoinPathVariable(paths ...string) string { // https://docs.github.com/en/actions/learn-github-actions/contexts#runner-context func goArchToActionArch(arch string) string { archMapper := map[string]string{ + "amd64": "X64", "x86_64": "X64", "386": "X86", "aarch64": "ARM64", From 5f1224ba5ff5b705f9e7f64d76d0bf184641eab1 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 7 Aug 2025 13:51:55 +0000 Subject: [PATCH 043/281] feat: added info log when container image platform mismatched (#826) Refs https://github.com/nektos/act/pull/3225 --- * added info log when container image platform mismatched * inline image architecture comparison into ImageExistsLocally function as per review request (cherry picked from commit 77d31c96a9486553908fdeb1c3053015238d5a0a) - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/826): feat: added info log when container image platform mismatched Co-authored-by: Ryan Fleet Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/826 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/docker_images.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/act/container/docker_images.go b/act/container/docker_images.go index 484cc834..f1daff94 100644 --- a/act/container/docker_images.go +++ b/act/container/docker_images.go @@ -6,6 +6,7 @@ import ( "context" "fmt" + "code.forgejo.org/forgejo/runner/v9/act/common" cerrdefs "github.com/containerd/errdefs" "github.com/docker/docker/api/types/image" ) @@ -26,10 +27,15 @@ func ImageExistsLocally(ctx context.Context, imageName, platform string) (bool, return false, err } - if platform == "" || platform == "any" || fmt.Sprintf("%s/%s", inspectImage.Os, inspectImage.Architecture) == platform { + imagePlatform := fmt.Sprintf("%s/%s", inspectImage.Os, inspectImage.Architecture) + + if platform == "" || platform == "any" || imagePlatform == platform { return true, nil } + logger := common.Logger(ctx) + logger.Infof("image found but platform does not match: %s (image) != %s (platform)\n", imagePlatform, platform) + return false, nil } From e100e3084c4bb5b0c1851b82d9490d69a94e55a6 Mon Sep 17 00:00:00 2001 From: earl-warren Date: Thu, 7 Aug 2025 21:03:44 +0000 Subject: [PATCH 044/281] feat: log parsed commands and step summary (#824) Refs https://github.com/nektos/act/pull/2761 --- * feat: log parsed command data in json logger * Could be used to upload the GITHUB_STEP_SUMMARY by downstream Projects * You can see the summary and other commands * Access the raw line of most commands * Update step.go * Update step.go * Update push.yml * . --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> (cherry picked from commit bb7db7b1c8a456d46907f3e65a6c4c2c1dcb6286) ``` Conflicts: act/runner/command.go act/runner/runner_test.go trivial context conflicts for both ``` - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/824): feat: log parsed commands and step summary Co-authored-by: ChristopherHX Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/824 Reviewed-by: Gusted --- act/runner/command.go | 29 ++++++------ act/runner/runner_test.go | 1 + act/runner/step.go | 59 +++++++++++++++--------- act/runner/step_action_local_test.go | 2 + act/runner/step_action_remote_test.go | 6 ++- act/runner/step_docker_test.go | 1 + act/runner/step_run_test.go | 1 + act/runner/testdata/stepsummary/push.yml | 27 +++++++++++ 8 files changed, 90 insertions(+), 36 deletions(-) create mode 100644 act/runner/testdata/stepsummary/push.yml diff --git a/act/runner/command.go b/act/runner/command.go index 98942322..654a0e4c 100644 --- a/act/runner/command.go +++ b/act/runner/command.go @@ -6,6 +6,8 @@ import ( "strings" "code.forgejo.org/forgejo/runner/v9/act/common" + + "github.com/sirupsen/logrus" ) var ( @@ -43,11 +45,12 @@ func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler { } if resumeCommand != "" && command != resumeCommand { - logger.Infof(" \U00002699 %s", line) + logger.WithFields(logrus.Fields{"command": "ignored", "raw": line}).Infof(" \U00002699 %s", line) return false } arg = unescapeCommandData(arg) kvPairs = unescapeKvPairs(kvPairs) + defCommandLogger := logger.WithFields(logrus.Fields{"command": command, "kvPairs": kvPairs, "arg": arg, "raw": line}) switch command { case "set-env": rc.setEnv(ctx, kvPairs, arg) @@ -56,27 +59,27 @@ func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler { case "add-path": rc.addPath(ctx, arg) case "debug": - logger.Infof(" \U0001F4AC %s", line) + defCommandLogger.Debugf(" \U0001F4AC %s", line) case "warning": - logger.Infof(" \U0001F6A7 %s", line) + defCommandLogger.Warnf(" \U0001F6A7 %s", line) case "error": - logger.Infof(" \U00002757 %s", line) + defCommandLogger.Errorf(" \U00002757 %s", line) case "add-mask": rc.AddMask(arg) - logger.Infof(" \U00002699 %s", "***") + defCommandLogger.Infof(" \U00002699 %s", "***") case "stop-commands": resumeCommand = arg - logger.Infof(" \U00002699 %s", line) + defCommandLogger.Infof(" \U00002699 %s", line) case resumeCommand: resumeCommand = "" - logger.Infof(" \U00002699 %s", line) + defCommandLogger.Infof(" \U00002699 %s", line) case "save-state": - logger.Infof(" \U0001f4be %s", line) + defCommandLogger.Infof(" \U0001f4be %s", line) rc.saveState(ctx, kvPairs, arg) case "add-matcher": - logger.Infof(" \U00002753 add-matcher %s", arg) + defCommandLogger.Infof(" \U00002753 add-matcher %s", arg) default: - logger.Infof(" \U00002753 %s", line) + defCommandLogger.Infof(" \U00002753 %s", line) } // return true to let gitea's logger handle these special outputs also @@ -86,7 +89,7 @@ func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler { func (rc *RunContext) setEnv(ctx context.Context, kvPairs map[string]string, arg string) { name := kvPairs["name"] - common.Logger(ctx).Infof(" \U00002699 ::set-env:: %s=%s", name, arg) + common.Logger(ctx).WithFields(logrus.Fields{"command": "set-env", "name": name, "arg": arg}).Infof(" \U00002699 ::set-env:: %s=%s", name, arg) if rc.Env == nil { rc.Env = make(map[string]string) } @@ -119,12 +122,12 @@ func (rc *RunContext) setOutput(ctx context.Context, kvPairs map[string]string, return } - logger.Infof(" \U00002699 ::set-output:: %s=%s", outputName, arg) + logger.WithFields(logrus.Fields{"command": "set-output", "name": outputName, "arg": arg}).Infof(" \U00002699 ::set-output:: %s=%s", outputName, arg) result.Outputs[outputName] = arg } func (rc *RunContext) addPath(ctx context.Context, arg string) { - common.Logger(ctx).Infof(" \U00002699 ::add-path:: %s", arg) + common.Logger(ctx).WithFields(logrus.Fields{"command": "add-path", "arg": arg}).Infof(" \U00002699 ::add-path:: %s", arg) extraPath := []string{arg} for _, v := range rc.ExtraPath { if v != arg { diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index d7a5b876..be3dd501 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -317,6 +317,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "set-env-step-env-override", "push", "", platforms, secrets}, {workdir, "set-env-new-env-file-per-step", "push", "", platforms, secrets}, {workdir, "no-panic-on-invalid-composite-action", "push", "missing steps in composite action", platforms, secrets}, + {workdir, "stepsummary", "push", "", platforms, secrets}, {workdir, "tool-cache", "push", "", platforms, secrets}, // services diff --git a/act/runner/step.go b/act/runner/step.go index 72102e8c..0d2de3fd 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -1,8 +1,11 @@ package runner import ( + "archive/tar" "context" + "errors" "fmt" + "io" "path" "strconv" "strings" @@ -12,6 +15,8 @@ import ( "code.forgejo.org/forgejo/runner/v9/act/container" "code.forgejo.org/forgejo/runner/v9/act/exprparser" "code.forgejo.org/forgejo/runner/v9/act/model" + + "github.com/sirupsen/logrus" ) type step interface { @@ -49,6 +54,32 @@ func (s stepStage) String() string { return "Unknown" } +func processRunnerSummaryCommand(ctx context.Context, fileName string, rc *RunContext) error { + if common.Dryrun(ctx) { + return nil + } + pathTar, err := rc.JobContainer.GetContainerArchive(ctx, path.Join(rc.JobContainer.GetActPath(), fileName)) + if err != nil { + return err + } + defer pathTar.Close() + + reader := tar.NewReader(pathTar) + _, err = reader.Next() + if err != nil && err != io.EOF { + return err + } + summary, err := io.ReadAll(reader) + if err != nil { + return err + } + if len(summary) == 0 { + return nil + } + common.Logger(ctx).WithFields(logrus.Fields{"command": "summary", "content": string(summary)}).Infof(" \U00002699 Summary - %s", string(summary)) + return nil +} + func processRunnerEnvFileCommand(ctx context.Context, fileName string, rc *RunContext, setter func(context.Context, map[string]string, string)) error { env := map[string]string{} err := rc.JobContainer.UpdateFromEnv(path.Join(rc.JobContainer.GetActPath(), fileName), &env)(ctx) @@ -171,27 +202,13 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo logger.WithField("stepResult", stepResult.Outcome).Errorf(" \u274C Failure - %s %s", stage, stepString) } // Process Runner File Commands - orgerr := err - err = processRunnerEnvFileCommand(ctx, envFileCommand, rc, rc.setEnv) - if err != nil { - return err - } - err = processRunnerEnvFileCommand(ctx, stateFileCommand, rc, rc.saveState) - if err != nil { - return err - } - err = processRunnerEnvFileCommand(ctx, outputFileCommand, rc, rc.setOutput) - if err != nil { - return err - } - err = rc.UpdateExtraPath(ctx, path.Join(actPath, pathFileCommand)) - if err != nil { - return err - } - if orgerr != nil { - return orgerr - } - return err + ferrors := []error{err} + ferrors = append(ferrors, processRunnerEnvFileCommand(ctx, envFileCommand, rc, rc.setEnv)) + ferrors = append(ferrors, processRunnerEnvFileCommand(ctx, stateFileCommand, rc, rc.saveState)) + ferrors = append(ferrors, processRunnerEnvFileCommand(ctx, outputFileCommand, rc, rc.setOutput)) + ferrors = append(ferrors, processRunnerSummaryCommand(ctx, summaryFileCommand, rc)) + ferrors = append(ferrors, rc.UpdateExtraPath(ctx, path.Join(actPath, pathFileCommand))) + return errors.Join(ferrors...) } } diff --git a/act/runner/step_action_local_test.go b/act/runner/step_action_local_test.go index c988d3b1..3af17d96 100644 --- a/act/runner/step_action_local_test.go +++ b/act/runner/step_action_local_test.go @@ -85,6 +85,7 @@ func TestStepActionLocalTest(t *testing.T) { return nil }) + cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(io.NopCloser(&bytes.Buffer{}), nil) cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil) salm.On("runAction", sal, filepath.Clean("/tmp/path/to/action"), (*remoteAction)(nil)).Return(func(ctx context.Context) error { @@ -280,6 +281,7 @@ func TestStepActionLocalPost(t *testing.T) { return nil }) + cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(io.NopCloser(&bytes.Buffer{}), nil) cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil) } diff --git a/act/runner/step_action_remote_test.go b/act/runner/step_action_remote_test.go index 864a580e..630c84b2 100644 --- a/act/runner/step_action_remote_test.go +++ b/act/runner/step_action_remote_test.go @@ -180,6 +180,7 @@ func TestStepActionRemoteOK(t *testing.T) { return nil }) + cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(io.NopCloser(&bytes.Buffer{}), nil) cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil) } @@ -188,9 +189,9 @@ func TestStepActionRemoteOK(t *testing.T) { err = sar.main()(ctx) } - assert.Equal(t, tt.runError, err) + assert.ErrorIs(t, err, tt.runError) assert.Equal(t, tt.mocks.cloned, clonedAction) - assert.Equal(t, tt.result, sar.RunContext.StepResults["step"]) + assert.Equal(t, sar.RunContext.StepResults["step"], tt.result) sarm.AssertExpectations(t) cm.AssertExpectations(t) @@ -508,6 +509,7 @@ func TestStepActionRemotePost(t *testing.T) { return nil }) + cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(io.NopCloser(&bytes.Buffer{}), nil) cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil) } diff --git a/act/runner/step_docker_test.go b/act/runner/step_docker_test.go index 9608978e..6b6c11db 100644 --- a/act/runner/step_docker_test.go +++ b/act/runner/step_docker_test.go @@ -93,6 +93,7 @@ func TestStepDockerMain(t *testing.T) { return nil }) + cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(io.NopCloser(&bytes.Buffer{}), nil) cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil) err := sd.main()(ctx) diff --git a/act/runner/step_run_test.go b/act/runner/step_run_test.go index 611b1274..10e8bd19 100644 --- a/act/runner/step_run_test.go +++ b/act/runner/step_run_test.go @@ -74,6 +74,7 @@ func TestStepRun(t *testing.T) { ctx := context.Background() + cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(io.NopCloser(&bytes.Buffer{}), nil) cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil) err := sr.main()(ctx) diff --git a/act/runner/testdata/stepsummary/push.yml b/act/runner/testdata/stepsummary/push.yml new file mode 100644 index 00000000..cb6c8e75 --- /dev/null +++ b/act/runner/testdata/stepsummary/push.yml @@ -0,0 +1,27 @@ +name: Step Summary Example + +on: [push] + +jobs: + create_summary: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: https://data.forgejo.org/actions/checkout@v4 + + # GITHUB_STEP_SUMMARY test + - name: Create Step Summary + uses: https://github.com/actions/github-script@v7 + with: + script: | + const summary = ` + ## Workflow Summary + - **Repository**: ${context.repo.owner}/${context.repo.repo} + - **Branch**: ${context.ref} + - **Commit SHA**: ${context.sha} + - **Event**: ${context.eventName} + `; + console.log('Summary:', summary); + await core.summary.addRaw(summary); + await core.summary.write(); + github-token: none From 4f883e97075c26cbf26e568d70e4920757e0ce60 Mon Sep 17 00:00:00 2001 From: earl-warren Date: Thu, 7 Aug 2025 21:04:09 +0000 Subject: [PATCH 045/281] fix: short sha has at least four digits (#820) Refs https://github.com/nektos/act/pull/2540 --- Currently it is not very unlikly to have a false match for tag `0` with sha `0XXXXXXXXXXXXXXXXXXXXXXX`, 1 to 16 Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> (cherry picked from commit 4dc67f6ba28f888328a2568bbcacf49e552650da) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/820): fix: short sha has at least four digits Co-authored-by: ChristopherHX Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/820 Reviewed-by: Gusted --- act/common/git/git.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/common/git/git.go b/act/common/git/git.go index 1748e797..bffe4feb 100644 --- a/act/common/git/git.go +++ b/act/common/git/git.go @@ -340,7 +340,7 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor { logger.Errorf("Unable to resolve %s: %v", input.Ref, err) } - if hash.String() != input.Ref && strings.HasPrefix(hash.String(), input.Ref) { + if hash.String() != input.Ref && len(input.Ref) >= 4 && strings.HasPrefix(hash.String(), input.Ref) { return &Error{ err: ErrShortRef, commit: hash.String(), From 3f468733cbc9fe23190e184bce3fd6a91c5cf8fc Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 7 Aug 2025 21:36:28 +0000 Subject: [PATCH 046/281] fix: valueMasker concurrent map write (#825) * valueMasker create secrets copy Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> (cherry picked from commit 7ed767c23a554eefb0a7563c674e7a406393b60f) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/825): fix: valueMasker concurrent map write Co-authored-by: ChristopherHX Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/825 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/logger.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/act/runner/logger.go b/act/runner/logger.go index f8d4f000..fad30b86 100644 --- a/act/runner/logger.go +++ b/act/runner/logger.go @@ -5,6 +5,7 @@ import ( "context" "fmt" "io" + "maps" "os" "strings" "sync" @@ -158,6 +159,7 @@ func withStepLogger(ctx context.Context, stepNumber int, stepID, stepName, stage type entryProcessor func(entry *logrus.Entry) *logrus.Entry func valueMasker(insecureSecrets bool, secrets map[string]string) entryProcessor { + secrets = maps.Clone(secrets) return func(entry *logrus.Entry) *logrus.Entry { if insecureSecrets { return entry From 7a31b6a55e16ae2ddaf6523e7737ccdaa6d6a316 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Thu, 7 Aug 2025 21:47:01 +0000 Subject: [PATCH 047/281] feat: support evaluation of concurrency clauses in runner (#827) Pre-req for support `concurrency` clauses for Gitea Actions, later added to Gitea in PR: https://github.com/go-gitea/gitea/pull/32751. Unit tests added in this PR relative to upstream. Squashes PRs https://gitea.com/gitea/act/pulls/124 & https://gitea.com/gitea/act/pulls/139, as noted in https://code.forgejo.org/forgejo/runner/issues/678 Reviewed-on: https://gitea.com/gitea/act/pulls/124 Reviewed-by: Lunny Xiao Co-authored-by: Zettat123 Co-committed-by: Zettat123 Reviewed-on: https://gitea.com/gitea/act/pulls/139 Reviewed-by: Zettat123 Reviewed-by: Lunny Xiao Co-authored-by: ChristopherHX Co-committed-by: ChristopherHX - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/827): feat: support evaluation of concurrency clauses in runner Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/827 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/jobparser/interpeter.go | 3 +- act/jobparser/jobparser.go | 2 +- act/jobparser/jobparser_test.go | 10 ++ act/jobparser/model.go | 91 ++++++++++++++ act/jobparser/model_test.go | 115 ++++++++++++++++++ .../testdata/job_concurrency.in.yaml | 9 ++ .../testdata/job_concurrency.out.yaml | 10 ++ .../testdata/job_concurrency_eval.in.yaml | 9 ++ .../testdata/job_concurrency_eval.out.yaml | 10 ++ act/model/workflow.go | 28 ++++- act/model/workflow_test.go | 45 +++++++ act/schema/workflow_schema.json | 2 +- 12 files changed, 330 insertions(+), 4 deletions(-) create mode 100644 act/jobparser/testdata/job_concurrency.in.yaml create mode 100644 act/jobparser/testdata/job_concurrency.out.yaml create mode 100644 act/jobparser/testdata/job_concurrency_eval.in.yaml create mode 100644 act/jobparser/testdata/job_concurrency_eval.out.yaml diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go index f798121a..82963129 100644 --- a/act/jobparser/interpeter.go +++ b/act/jobparser/interpeter.go @@ -16,6 +16,7 @@ func NewInterpeter( gitCtx *model.GithubContext, results map[string]*JobResult, vars map[string]string, + inputs map[string]interface{}, ) exprparser.Interpreter { strategy := make(map[string]interface{}) if job.Strategy != nil { @@ -62,7 +63,7 @@ func NewInterpeter( Strategy: strategy, Matrix: matrix, Needs: using, - Inputs: nil, // not supported yet + Inputs: inputs, Vars: vars, } diff --git a/act/jobparser/jobparser.go b/act/jobparser/jobparser.go index 0fd1768e..c369d30e 100644 --- a/act/jobparser/jobparser.go +++ b/act/jobparser/jobparser.go @@ -48,7 +48,7 @@ func Parse(content []byte, validate bool, options ...ParseOption) ([]*SingleWork } for _, matrix := range matricxes { job := job.Clone() - evaluator := NewExpressionEvaluator(NewInterpeter(id, origin.GetJob(id), matrix, pc.gitContext, results, pc.vars)) + evaluator := NewExpressionEvaluator(NewInterpeter(id, origin.GetJob(id), matrix, pc.gitContext, results, pc.vars, nil)) if job.Name == "" { job.Name = nameWithMatrix(id, matrix) } else { diff --git a/act/jobparser/jobparser_test.go b/act/jobparser/jobparser_test.go index 02b58def..0386bcb9 100644 --- a/act/jobparser/jobparser_test.go +++ b/act/jobparser/jobparser_test.go @@ -42,6 +42,16 @@ func TestParse(t *testing.T) { options: nil, wantErr: false, }, + { + name: "job_concurrency", + options: nil, + wantErr: false, + }, + { + name: "job_concurrency_eval", + options: nil, + wantErr: false, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/act/jobparser/model.go b/act/jobparser/model.go index ac1d871d..16cfc9fc 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -1,6 +1,7 @@ package jobparser import ( + "bytes" "fmt" "code.forgejo.org/forgejo/runner/v9/act/model" @@ -82,6 +83,7 @@ type Job struct { Uses string `yaml:"uses,omitempty"` With map[string]interface{} `yaml:"with,omitempty"` RawSecrets yaml.Node `yaml:"secrets,omitempty"` + RawConcurrency *model.RawConcurrency `yaml:"concurrency,omitempty"` } func (j *Job) Clone() *Job { @@ -104,6 +106,7 @@ func (j *Job) Clone() *Job { Uses: j.Uses, With: j.With, RawSecrets: j.RawSecrets, + RawConcurrency: j.RawConcurrency, } } @@ -190,6 +193,85 @@ func (evt *Event) Schedules() []map[string]string { return evt.schedules } +func ReadWorkflowRawConcurrency(content []byte) (*model.RawConcurrency, error) { + w := new(model.Workflow) + err := yaml.NewDecoder(bytes.NewReader(content)).Decode(w) + return w.RawConcurrency, err +} + +func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (string, bool, error) { + actJob := &model.Job{} + if job != nil { + actJob.Strategy = &model.Strategy{ + FailFastString: job.Strategy.FailFastString, + MaxParallelString: job.Strategy.MaxParallelString, + RawMatrix: job.Strategy.RawMatrix, + } + actJob.Strategy.FailFast = actJob.Strategy.GetFailFast() + actJob.Strategy.MaxParallel = actJob.Strategy.GetMaxParallel() + } + + matrix := make(map[string]any) + matrixes, err := actJob.GetMatrixes() + if err != nil { + return "", false, err + } + if len(matrixes) > 0 { + matrix = matrixes[0] + } + + evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs)) + var node yaml.Node + if err := node.Encode(rc); err != nil { + return "", false, fmt.Errorf("failed to encode concurrency: %w", err) + } + if err := evaluator.EvaluateYamlNode(&node); err != nil { + return "", false, fmt.Errorf("failed to evaluate concurrency: %w", err) + } + var evaluated model.RawConcurrency + if err := node.Decode(&evaluated); err != nil { + return "", false, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err) + } + if evaluated.RawExpression != "" { + return evaluated.RawExpression, false, nil + } + return evaluated.Group, evaluated.CancelInProgress == "true", nil +} + +func toGitContext(input map[string]any) *model.GithubContext { + gitContext := &model.GithubContext{ + EventPath: asString(input["event_path"]), + Workflow: asString(input["workflow"]), + RunID: asString(input["run_id"]), + RunNumber: asString(input["run_number"]), + Actor: asString(input["actor"]), + Repository: asString(input["repository"]), + EventName: asString(input["event_name"]), + Sha: asString(input["sha"]), + Ref: asString(input["ref"]), + RefName: asString(input["ref_name"]), + RefType: asString(input["ref_type"]), + HeadRef: asString(input["head_ref"]), + BaseRef: asString(input["base_ref"]), + Token: asString(input["token"]), + Workspace: asString(input["workspace"]), + Action: asString(input["action"]), + ActionPath: asString(input["action_path"]), + ActionRef: asString(input["action_ref"]), + ActionRepository: asString(input["action_repository"]), + Job: asString(input["job"]), + RepositoryOwner: asString(input["repository_owner"]), + RetentionDays: asString(input["retention_days"]), + } + + event, ok := input["event"].(map[string]any) + if ok { + gitContext.Event = event + } + + return gitContext +} + func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { switch rawOn.Kind { case yaml.ScalarNode: @@ -348,3 +430,12 @@ func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) { return scalars, datas, nil } + +func asString(v interface{}) string { + if v == nil { + return "" + } else if s, ok := v.(string); ok { + return s + } + return "" +} diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index 30dc4890..328d29af 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -339,3 +339,118 @@ func TestParseMappingNode(t *testing.T) { }) } } + +func TestEvaluateConcurrency(t *testing.T) { + tests := []struct { + name string + input model.RawConcurrency + group string + cancelInProgress bool + }{ + { + name: "basic", + input: model.RawConcurrency{ + Group: "group-name", + CancelInProgress: "true", + }, + group: "group-name", + cancelInProgress: true, + }, + { + name: "undefined", + input: model.RawConcurrency{}, + group: "", + cancelInProgress: false, + }, + { + name: "group-evaluation", + input: model.RawConcurrency{ + Group: "${{ github.workflow }}-${{ github.ref }}", + }, + group: "test_workflow-main", + cancelInProgress: false, + }, + { + name: "cancel-evaluation-true", + input: model.RawConcurrency{ + Group: "group-name", + CancelInProgress: "${{ !contains(github.ref, 'release/')}}", + }, + group: "group-name", + cancelInProgress: true, + }, + { + name: "cancel-evaluation-false", + input: model.RawConcurrency{ + Group: "group-name", + CancelInProgress: "${{ contains(github.ref, 'release/')}}", + }, + group: "group-name", + cancelInProgress: false, + }, + { + name: "event-evaluation", + input: model.RawConcurrency{ + Group: "user-${{ github.event.commits[0].author.username }}", + }, + group: "user-someone", + cancelInProgress: false, + }, + { + name: "arbitrary-var", + input: model.RawConcurrency{ + Group: "${{ vars.eval_arbitrary_var }}", + }, + group: "123", + cancelInProgress: false, + }, + { + name: "arbitrary-input", + input: model.RawConcurrency{ + Group: "${{ inputs.eval_arbitrary_input }}", + }, + group: "456", + cancelInProgress: false, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + group, cancelInProgress, err := EvaluateConcurrency( + &test.input, + "job-id", + nil, // job + map[string]any{ + "workflow": "test_workflow", + "ref": "main", + "event": map[string]interface{}{ + "commits": []interface{}{ + map[string]interface{}{ + "author": map[string]interface{}{ + "username": "someone", + }, + }, + map[string]interface{}{ + "author": map[string]interface{}{ + "username": "someone-else", + }, + }, + }, + }, + }, // gitCtx + map[string]*JobResult{ + "job-id": {}, + }, // results + map[string]string{ + "eval_arbitrary_var": "123", + }, // vars + map[string]any{ + "eval_arbitrary_input": "456", + }, // inputs + ) + assert.NoError(t, err) + assert.EqualValues(t, test.group, group) + assert.EqualValues(t, test.cancelInProgress, cancelInProgress) + }) + } +} diff --git a/act/jobparser/testdata/job_concurrency.in.yaml b/act/jobparser/testdata/job_concurrency.in.yaml new file mode 100644 index 00000000..a2e8e1d9 --- /dev/null +++ b/act/jobparser/testdata/job_concurrency.in.yaml @@ -0,0 +1,9 @@ +name: test +jobs: + job1: + runs-on: linux + concurrency: + group: major-tests + cancel-in-progress: true + steps: + - run: uname -a diff --git a/act/jobparser/testdata/job_concurrency.out.yaml b/act/jobparser/testdata/job_concurrency.out.yaml new file mode 100644 index 00000000..a7e1e118 --- /dev/null +++ b/act/jobparser/testdata/job_concurrency.out.yaml @@ -0,0 +1,10 @@ +name: test +jobs: + job1: + name: job1 + runs-on: linux + steps: + - run: uname -a + concurrency: + group: major-tests + cancel-in-progress: "true" diff --git a/act/jobparser/testdata/job_concurrency_eval.in.yaml b/act/jobparser/testdata/job_concurrency_eval.in.yaml new file mode 100644 index 00000000..23d06b53 --- /dev/null +++ b/act/jobparser/testdata/job_concurrency_eval.in.yaml @@ -0,0 +1,9 @@ +name: test +jobs: + job1: + runs-on: linux + concurrency: + group: ${{ github.workflow }} + cancel-in-progress: ${{ !contains(github.ref, 'release/')}} + steps: + - run: uname -a diff --git a/act/jobparser/testdata/job_concurrency_eval.out.yaml b/act/jobparser/testdata/job_concurrency_eval.out.yaml new file mode 100644 index 00000000..40cbb529 --- /dev/null +++ b/act/jobparser/testdata/job_concurrency_eval.out.yaml @@ -0,0 +1,10 @@ +name: test +jobs: + job1: + name: job1 + runs-on: linux + steps: + - run: uname -a + concurrency: + group: ${{ github.workflow }} + cancel-in-progress: ${{ !contains(github.ref, 'release/')}} diff --git a/act/model/workflow.go b/act/model/workflow.go index ab6ad296..99f77a29 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -25,7 +25,8 @@ type Workflow struct { Jobs map[string]*Job `yaml:"jobs"` Defaults Defaults `yaml:"defaults"` - RawNotifications yaml.Node `yaml:"enable-email-notifications"` + RawNotifications yaml.Node `yaml:"enable-email-notifications"` + RawConcurrency *RawConcurrency `yaml:"concurrency"` // For Gitea } // On events for the workflow @@ -806,3 +807,28 @@ func (w *Workflow) Notifications() (bool, error) { return false, fmt.Errorf("enable-email-notifications: unknown type: %v", w.RawNotifications.Kind) } } + +// For Gitea +// RawConcurrency represents a workflow concurrency or a job concurrency with uninterpolated options +type RawConcurrency struct { + Group string `yaml:"group,omitempty"` + CancelInProgress string `yaml:"cancel-in-progress,omitempty"` + RawExpression string `yaml:"-,omitempty"` +} + +type objectConcurrency RawConcurrency + +func (r *RawConcurrency) UnmarshalYAML(n *yaml.Node) error { + if err := n.Decode(&r.RawExpression); err == nil { + return nil + } + return n.Decode((*objectConcurrency)(r)) +} + +func (r *RawConcurrency) MarshalYAML() (interface{}, error) { + if r.RawExpression != "" { + return r.RawExpression, nil + } + + return (*objectConcurrency)(r), nil +} diff --git a/act/model/workflow_test.go b/act/model/workflow_test.go index d3ea7234..96f4e004 100644 --- a/act/model/workflow_test.go +++ b/act/model/workflow_test.go @@ -702,3 +702,48 @@ func TestStepUsesHash(t *testing.T) { }) } } + +func TestReadWorkflow_Concurrency(t *testing.T) { + for _, testCase := range []struct { + expected *RawConcurrency + err string + snippet string + }{ + { + expected: nil, + snippet: "# nothing", + }, + { + expected: &RawConcurrency{Group: "${{ github.workflow }}-${{ github.ref }}", CancelInProgress: ""}, + snippet: "concurrency: { group: \"${{ github.workflow }}-${{ github.ref }}\" }", + }, + { + expected: &RawConcurrency{Group: "example-group", CancelInProgress: "true"}, + snippet: "concurrency: { group: example-group, cancel-in-progress: true }", + }, + } { + t.Run(testCase.snippet, func(t *testing.T) { + yaml := fmt.Sprintf(` +name: name-455 +on: push +%s +jobs: + valid-JOB-Name-455: + runs-on: docker + steps: + - run: echo hi +`, testCase.snippet) + + workflow, err := ReadWorkflow(strings.NewReader(yaml), true) + if testCase.err != "" { + assert.ErrorContains(t, err, testCase.err) + } else { + assert.NoError(t, err, "read workflow should succeed") + + concurrency := workflow.RawConcurrency + // assert.NoError(t, err) + assert.Equal(t, testCase.expected, concurrency) + } + }) + } +} diff --git a/act/schema/workflow_schema.json b/act/schema/workflow_schema.json index 5ec66e17..9c88f5b5 100644 --- a/act/schema/workflow_schema.json +++ b/act/schema/workflow_schema.json @@ -1689,7 +1689,7 @@ "description": "When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be `pending`. Any previously pending job or workflow in the concurrency group will be canceled. To also cancel any currently running job or workflow in the same concurrency group, specify `cancel-in-progress: true`." }, "cancel-in-progress": { - "type": "boolean", + "type": "non-empty-string", "description": "To cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true." } } From a737f197c7ab07e0048934f9221bcc363fa97199 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 10 Aug 2025 12:03:50 +0000 Subject: [PATCH 048/281] test: fix failures caused by node24 usage in hello-world-javascript-action [skip cascade] (#830) node24 support has been added to GitHub Actions runner (https://github.com/actions/runner/releases/tag/v2.327.1), after which hello-world-javascript-action was updated to node24 (https://github.com/actions/hello-world-javascript-action/commit/d5e3943272d5c849e9522f6fbb5465c349895172) causing test failures since forgejo-runner doesn't support `node24`. To unblock test execution, this pins to the `v1` tag which was already done in two other tests anyway. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/830): test: fix failures caused by node24 usage in hello-world-javascript-action [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/830 Reviewed-by: Michael Kriese Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/testdata/issue-597/spelling.yaml | 2 +- act/runner/testdata/issue-598/spelling.yml | 15 +++++++-------- act/runner/testdata/parallel/push.yml | 2 +- 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/act/runner/testdata/issue-597/spelling.yaml b/act/runner/testdata/issue-597/spelling.yaml index 469f1500..120e2c7a 100644 --- a/act/runner/testdata/issue-597/spelling.yaml +++ b/act/runner/testdata/issue-597/spelling.yaml @@ -15,7 +15,7 @@ jobs: fetch-depth: 5 - name: My first true step if: ${{endsWith('Hello world', 'ld')}} - uses: https://github.com/actions/hello-world-javascript-action@main + uses: https://github.com/actions/hello-world-javascript-action@v1 with: who-to-greet: "Renst the Octocat" - name: My second false step diff --git a/act/runner/testdata/issue-598/spelling.yml b/act/runner/testdata/issue-598/spelling.yml index 46dcc77f..ef741b22 100644 --- a/act/runner/testdata/issue-598/spelling.yml +++ b/act/runner/testdata/issue-598/spelling.yml @@ -1,31 +1,30 @@ name: issue-598 on: push - + jobs: my_first_job: - + runs-on: ubuntu-latest steps: - name: My first false step if: "endsWith('Hello world', 'o1')" - uses: https://github.com/actions/hello-world-javascript-action@main + uses: https://github.com/actions/hello-world-javascript-action@v1 with: who-to-greet: 'Mona the Octocat' - name: My first true step if: "!endsWith('Hello world', 'od')" - uses: https://github.com/actions/hello-world-javascript-action@main + uses: https://github.com/actions/hello-world-javascript-action@v1 with: who-to-greet: "Renst the Octocat" - name: My second false step if: "endsWith('Hello world', 'o2')" - uses: https://github.com/actions/hello-world-javascript-action@main + uses: https://github.com/actions/hello-world-javascript-action@v1 with: who-to-greet: 'Act the Octocat' - name: My third false step if: "endsWith('Hello world', 'o2')" - uses: https://github.com/actions/hello-world-javascript-action@main + uses: https://github.com/actions/hello-world-javascript-action@v1 with: who-to-greet: 'Git the Octocat' - - \ No newline at end of file + diff --git a/act/runner/testdata/parallel/push.yml b/act/runner/testdata/parallel/push.yml index 1af9165e..9eb420dc 100644 --- a/act/runner/testdata/parallel/push.yml +++ b/act/runner/testdata/parallel/push.yml @@ -9,7 +9,7 @@ jobs: - uses: ./actions/action1 with: args: echo 'build' - - uses: https://github.com/actions/hello-world-javascript-action@master + - uses: https://github.com/actions/hello-world-javascript-action@v1 with: who-to-greet: 'Mona the Octocat' test1: From e331b4380f31657d9ce90657e720fde50d522705 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 10 Aug 2025 13:43:45 +0000 Subject: [PATCH 049/281] Update module google.golang.org/protobuf to v1.36.7 (#828) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [google.golang.org/protobuf](https://github.com/protocolbuffers/protobuf-go) | `v1.36.6` -> `v1.36.7` | [![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fprotobuf/v1.36.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fprotobuf/v1.36.6/v1.36.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
protocolbuffers/protobuf-go (google.golang.org/protobuf) ### [`v1.36.7`](https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.7) [Compare Source](https://github.com/protocolbuffers/protobuf-go/compare/v1.36.6...v1.36.7) Maintenance / optimizations: [CL/683955](https://go-review.googlesource.com/c/protobuf/+/683955): encoding/protowire: micro-optimize SizeVarint (-20% on Intel) [CL/674055](https://go-review.googlesource.com/c/protobuf/+/674055): internal/impl: remove unnecessary atomic access for non-lazy lists [CL/674015](https://go-review.googlesource.com/c/protobuf/+/674015): impl: remove unnecessary nil check from presence.Present [CL/673495](https://go-review.googlesource.com/c/protobuf/+/673495): types/descriptorpb: regenerate using latest protobuf v31 release [CL/670516](https://go-review.googlesource.com/c/protobuf/+/670516): cmd/protoc-gen-go: centralize presence and lazy logic into filedesc [CL/670515](https://go-review.googlesource.com/c/protobuf/+/670515): internal: move usePresenceForField to internal/filedesc [CL/670275](https://go-review.googlesource.com/c/protobuf/+/670275): internal/impl: clean up usePresenceForField() (no-op)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/828): Update module google.golang.org/protobuf to v1.36.7 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/828 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 6579859a..988b28a9 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( go.etcd.io/bbolt v1.4.2 golang.org/x/term v0.33.0 golang.org/x/time v0.12.0 - google.golang.org/protobuf v1.36.6 + google.golang.org/protobuf v1.36.7 gopkg.in/yaml.v3 v3.0.1 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index 50aa8317..e51b2807 100644 --- a/go.sum +++ b/go.sum @@ -290,8 +290,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU= google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw= google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA= -google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY= -google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= +google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A= +google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From e049c82d9cc4bdcde14ccfca90d162ccca3b4635 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 10 Aug 2025 15:10:30 +0000 Subject: [PATCH 050/281] chore: cancel context used in CI when running workflows (#831) the context obtained from context.Background() may otherwise survive the test instead. It is equivalent to t.Context() which is only available in go >= v1.24 --- It is suspected to be the cause of ``` 2025-08-10T13:01:08.5866723Z [services/Reproduction of failing Services interpolation] [DEBUG] Writing entry to tarball workflow/event.json len:2 2025-08-10T13:01:08.5866772Z [services/Reproduction of failing Services interpolation] [DEBUG] Writing entry to tarball workflow/envs.txt len:0 2025-08-10T13:01:08.5866818Z [services/Reproduction of failing Services interpolation] [DEBUG] Extracting content to '/var/run/act/' 2025-08-10T13:01:08.5866868Z [services/Reproduction of failing Services interpolation] service [postgres]: container health check a6b5d1443dd78f3d3aa244aeccabe72542f1c1ee33200f74a9ea33ae736f01f0 (code.forgejo.org/oci/postgres:16) is starting, waiting 10s 2025-08-10T13:01:08.5866919Z panic: test timed out after 10m0s 2025-08-10T13:01:08.5866984Z running tests: 2025-08-10T13:01:08.5867024Z TestRunner_RunWithService (2s) 2025-08-10T13:01:08.5867081Z 2025-08-10T13:01:08.5867142Z goroutine 55693 [running]: 2025-08-10T13:01:08.5867206Z testing.(*M).startAlarm.func1() 2025-08-10T13:01:08.5867250Z /go_path/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.12.linux-amd64/src/testing/testing.go:2373 +0x385 2025-08-10T13:01:08.5867300Z created by time.goFunc 2025-08-10T13:01:08.5867368Z /go_path/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.12.linux-amd64/src/time/sleep.go:215 +0x2d ... 2025-08-10T13:01:08.5878289Z goroutine 55692 [select]: 2025-08-10T13:01:08.5878350Z code.forgejo.org/forgejo/runner/v9/act/runner.waitForServiceContainer({0xf12e50, 0xc0006bbe30}, {0xf1e120, 0xc0003643c0}) 2025-08-10T13:01:08.5878402Z /home/debian/.cache/act/7ffa26f4231b52fa/hostexecutor/act/runner/run_context.go:757 +0xd7 2025-08-10T13:01:08.5878460Z code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).waitForServiceContainers.func1.1({0xf12e50?, 0xc0006bbe30?}) 2025-08-10T13:01:08.5878524Z /home/debian/.cache/act/7ffa26f4231b52fa/hostexecutor/act/runner/run_context.go:770 +0x25 2025-08-10T13:01:08.5878592Z code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).waitForServiceContainers.func1.NewParallelExecutor.2.1(0xc00015a5b0, 0xc00015a700) 2025-08-10T13:01:08.5878684Z /home/debian/.cache/act/7ffa26f4231b52fa/hostexecutor/act/common/executor.go:107 +0x52 2025-08-10T13:01:08.5878729Z created by code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).waitForServiceContainers.func1.NewParallelExecutor.2 in goroutine 55682 2025-08-10T13:01:08.5878777Z /home/debian/.cache/act/7ffa26f4231b52fa/hostexecutor/act/common/executor.go:105 +0xf4 2025-08-10T13:01:08.5878821Z ... ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/831): chore: cancel context used in CI when running workflows [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/831 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/runner_test.go | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index be3dd501..86f06fcf 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -229,7 +229,8 @@ func TestRunner_RunEvent(t *testing.T) { t.Skip("skipping integration test") } - ctx := context.Background() + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() tables := []TestJobFileInfo{ // Shells @@ -365,7 +366,8 @@ func TestRunner_DryrunEvent(t *testing.T) { t.Skip("skipping integration test") } - ctx := common.WithDryrun(context.Background(), true) + ctx, cancel := context.WithCancel(common.WithDryrun(context.Background(), true)) + defer cancel() tables := []TestJobFileInfo{ // Shells @@ -394,7 +396,8 @@ func TestRunner_DockerActionForcePullForceRebuild(t *testing.T) { t.Skip("skipping integration test") } - ctx := context.Background() + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() config := &Config{ ForcePull: true, @@ -542,7 +545,8 @@ func TestRunner_RunWithService(t *testing.T) { } log.SetLevel(log.DebugLevel) - ctx := context.Background() + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() platforms := map[string]string{ "ubuntu-latest": "code.forgejo.org/oci/node:22", From c7dc688858ac849c62d6b507404a473fc3d93d72 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 10 Aug 2025 15:43:34 +0000 Subject: [PATCH 051/281] fix: prevent space prefix/suffix in runner labels (#829) [Raised on Forgejo](https://codeberg.org/forgejo/forgejo/issues/8803): when a runner is registered with spaces in the comma-separated label list, eg. ` "docker:docker://node:22-bookworm, self-hosted:host, lxc:lxc://debian:bookworm"`, the runner will currently get the labels `"docker"`, `" self-hosted"`, and `" lxc"` which causes unexpected confusion. Forgejo doesn't display the labels usefully, and targeting the runner with `runs-on` in an action would require an unexpected quoting (eg. `runs-on: " lxc"`). As an alternative to fixing this in Forgejo's label display, two changes are present here: - When registering labels via the CLI `--labels` option, or the interactive registering, automatically strip spaces around the commas in the comma-separated list. - **Breaking**: During startup of the runner, label names that start/end with a space will be considered invalid, resulting in a logged error and the label being ignored: ``` WARN[2025-08-08T21:00:13-06:00] ignored invalid label " debian-latest:docker://node:current-bookworm" error="invalid label \" debian-latest\": starting or ending with a space is invalid" ``` This is a breaking change in behavior in the case that someone has registered a runner with spaces and modified their activities to use them after recognizing the problem. But I tend to think it's more likely that this change will *highlight* a misconfiguration and help someone fix it. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/829): fix: prevent space prefix/suffix in runner labels Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/829 Reviewed-by: Gusted Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- internal/app/cmd/register.go | 25 ++++++++++++++++++++++-- internal/app/cmd/register_test.go | 31 ++++++++++++++++++++++++++++++ internal/pkg/labels/labels.go | 4 ++++ internal/pkg/labels/labels_test.go | 12 ++++++++++-- 4 files changed, 68 insertions(+), 4 deletions(-) create mode 100644 internal/app/cmd/register_test.go diff --git a/internal/app/cmd/register.go b/internal/app/cmd/register.go index dd369381..5e2f5d8a 100644 --- a/internal/app/cmd/register.go +++ b/internal/app/cmd/register.go @@ -172,7 +172,7 @@ func (r *registerInputs) assignToNext(stage registerStage, value string, cfg *co case StageInputLabels: r.Labels = defaultLabels if value != "" { - r.Labels = strings.Split(value, ",") + r.Labels = commaSplit(value) } if validateLabels(r.Labels) != nil { @@ -260,7 +260,7 @@ func registerNoInteractive(ctx context.Context, configFile string, regArgs *regi regArgs.Labels = strings.TrimSpace(regArgs.Labels) // command line flag. if regArgs.Labels != "" { - inputs.Labels = strings.Split(regArgs.Labels, ",") + inputs.Labels = commaSplit(regArgs.Labels) } // specify labels in config file. if len(cfg.Runner.Labels) > 0 { @@ -353,3 +353,24 @@ func doRegister(ctx context.Context, cfg *config.Config, inputs *registerInputs) } return nil } + +// Splits a string by commas, but trims whitespace around the commas. Used for label parsing to avoid a rogue whitespace +// like "docker:docker://node:22-bookworm, self-hosted:host, lxc:lxc://debian:bookworm" becoming labeled with +// " self-hosted" and " lxc". +func commaSplit(s string) []string { + if s == "" { + return make([]string, 0) + } + + parts := strings.Split(s, ",") + result := make([]string, 0, len(parts)) + + for _, part := range parts { + trimmed := strings.TrimSpace(part) + if trimmed != "" { + result = append(result, trimmed) + } + } + + return result +} diff --git a/internal/app/cmd/register_test.go b/internal/app/cmd/register_test.go new file mode 100644 index 00000000..a69775a8 --- /dev/null +++ b/internal/app/cmd/register_test.go @@ -0,0 +1,31 @@ +// Copyright 2025 The Forgejo Authors +// SPDX-License-Identifier: MIT + +package cmd + +import ( + "slices" + "testing" +) + +func TestCommaSplit(t *testing.T) { + tests := []struct { + input string + expected []string + }{ + {"", []string{}}, + {"abc", []string{"abc"}}, + {"abc,def", []string{"abc", "def"}}, + {"abc, def", []string{"abc", "def"}}, + {" abc , def ", []string{"abc", "def"}}, + {"abc, ,def", []string{"abc", "def"}}, + {" , , ", []string{}}, + } + + for _, test := range tests { + result := commaSplit(test.input) + if !slices.Equal(result, test.expected) { + t.Errorf("commaSplit(%q) = %v, want %v", test.input, result, test.expected) + } + } +} diff --git a/internal/pkg/labels/labels.go b/internal/pkg/labels/labels.go index 7befaf42..e256964a 100644 --- a/internal/pkg/labels/labels.go +++ b/internal/pkg/labels/labels.go @@ -31,6 +31,10 @@ func Parse(str string) (*Label, error) { Schema: "docker", } + if strings.TrimSpace(label.Name) != label.Name { + return nil, fmt.Errorf("invalid label %q: starting or ending with a space is invalid", label.Name) + } + if len(splits) >= 2 { label.Schema = splits[1] if label.Schema != SchemeHost && label.Schema != SchemeDocker && label.Schema != SchemeLXC { diff --git a/internal/pkg/labels/labels_test.go b/internal/pkg/labels/labels_test.go index db2f0adf..bf798fa2 100644 --- a/internal/pkg/labels/labels_test.go +++ b/internal/pkg/labels/labels_test.go @@ -63,7 +63,6 @@ func TestParse(t *testing.T) { }, wantErr: false, }, - { args: "label1:host", want: &Label{ @@ -78,12 +77,21 @@ func TestParse(t *testing.T) { want: nil, wantErr: true, }, - { args: "label1:invalidscheme", want: nil, wantErr: true, }, + { + args: " label1:lxc://debian:buster", + want: nil, + wantErr: true, + }, + { + args: "label1 :lxc://debian:buster", + want: nil, + wantErr: true, + }, } for _, tt := range tests { t.Run(tt.args, func(t *testing.T) { From 3ef94e3b417f7abe5b03b7ef761718749a917e3a Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 10 Aug 2025 16:14:38 +0000 Subject: [PATCH 052/281] Update dependency go to v1.24 (#832) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | minor | `1.23.12` -> `1.24.6` | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/832 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 988b28a9..ab471b13 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.forgejo.org/forgejo/runner/v9 go 1.23.0 -toolchain go1.23.12 +toolchain go1.24.6 require ( code.forgejo.org/forgejo/actions-proto v0.5.1 From 931c2c0ac324b6246ce59d037d792339772b1667 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 10 Aug 2025 16:24:02 +0000 Subject: [PATCH 053/281] feat: added support for dereferenced map properties (#821) Refs https://github.com/nektos/act/pull/2635 --- * Added support for dereferenced properties * Added negative test * Update pkg/exprparser/functions_test.go Co-authored-by: ChristopherHX * Update pkg/exprparser/functions_test.go Co-authored-by: ChristopherHX * fix lint --------- Co-authored-by: m1r4c Co-authored-by: ChristopherHX (cherry picked from commit 20bb25432dd8db44c689a3bc2d440a648e71b3bb) - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/821): feat: added support for dereferenced map properties Co-authored-by: m1r4c Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/821 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/exprparser/functions_test.go | 27 +++++++++++++++++++++++++++ act/exprparser/interpreter.go | 29 ++++++++++++++++++++++++++++- act/exprparser/interpreter_test.go | 8 ++++++++ 3 files changed, 63 insertions(+), 1 deletion(-) diff --git a/act/exprparser/functions_test.go b/act/exprparser/functions_test.go index e8525efa..8150d488 100644 --- a/act/exprparser/functions_test.go +++ b/act/exprparser/functions_test.go @@ -31,6 +31,13 @@ func TestFunctionContains(t *testing.T) { {`contains(fromJSON('[3.14,"second"]'), 3.14) }}`, true, "contains-item-number-number"}, {`contains(fromJSON('["","second"]'), fromJSON('[]')) }}`, false, "contains-item-str-arr"}, {`contains(fromJSON('["","second"]'), fromJSON('{}')) }}`, false, "contains-item-str-obj"}, + {`contains(fromJSON('[{ "first": { "result": "success" }},{ "second": { "result": "success" }}]').first.result, 'success') }}`, true, "multiple-contains-item"}, + {`contains(fromJSON('[{ "result": "success" },{ "result": "failure" }]').*.result, 'failure') }}`, true, "multiple-contains-dereferenced-failure-item"}, + {`contains(fromJSON('[{ "result": "failure" },{ "result": "success" }]').*.result, 'success') }}`, true, "multiple-contains-dereferenced-success-item"}, + {`contains(fromJSON('[{ "result": "failure" },{ "result": "success" }]').*.result, 'notthere') }}`, false, "multiple-contains-dereferenced-missing-item"}, + {`contains(fromJSON('[{ "result": "failure", "outputs": { "key": "val1" } },{ "result": "success", "outputs": { "key": "val2" } }]').*.outputs.key, 'val1') }}`, true, "multiple-contains-dereferenced-output-item"}, + {`contains(fromJSON('[{ "result": "failure", "outputs": { "key": "val1" } },{ "result": "success", "outputs": { "key": "val2" } }]').*.outputs.key, 'val2') }}`, true, "multiple-contains-dereferenced-output-item-2"}, + {`contains(fromJSON('[{ "result": "failure", "outputs": { "key": "val1" } },{ "result": "success", "outputs": { "key": "val2" } }]').*.outputs.key, 'missing') }}`, false, "multiple-contains-dereferenced-output-misssing-item"}, } env := &EvaluationEnvironment{} @@ -270,3 +277,23 @@ func TestFunctionFormat(t *testing.T) { _, err := NewInterpeter(env, Config{}).Evaluate("format()", DefaultStatusCheckNone) assert.Error(t, err) } + +func TestMapContains(t *testing.T) { + env := &EvaluationEnvironment{ + Needs: map[string]Needs{ + "first-job": { + Outputs: map[string]string{}, + Result: "success", + }, + "second-job": { + Outputs: map[string]string{}, + Result: "failure", + }, + }, + } + + output, err := NewInterpeter(env, Config{}).Evaluate("contains(needs.*.result, 'failure')", DefaultStatusCheckNone) + assert.NoError(t, err) + + assert.Equal(t, true, output) +} diff --git a/act/exprparser/interpreter.go b/act/exprparser/interpreter.go index 202ade22..5e9dd1cd 100644 --- a/act/exprparser/interpreter.go +++ b/act/exprparser/interpreter.go @@ -227,12 +227,16 @@ func (impl *interperterImpl) evaluateIndexAccess(indexAccessNode *actionlint.Ind } } -func (impl *interperterImpl) evaluateObjectDeref(objectDerefNode *actionlint.ObjectDerefNode) (interface{}, error) { +func (impl *interperterImpl) evaluateObjectDeref(objectDerefNode *actionlint.ObjectDerefNode) (any, error) { left, err := impl.evaluateNode(objectDerefNode.Receiver) if err != nil { return nil, err } + _, receiverIsDeref := objectDerefNode.Receiver.(*actionlint.ArrayDerefNode) + if receiverIsDeref { + return impl.getPropertyValueDereferenced(reflect.ValueOf(left), objectDerefNode.Property) + } return impl.getPropertyValue(reflect.ValueOf(left), objectDerefNode.Property) } @@ -316,6 +320,29 @@ func (impl *interperterImpl) getPropertyValue(left reflect.Value, property strin return nil, nil } +func (impl *interperterImpl) getPropertyValueDereferenced(left reflect.Value, property string) (value any, err error) { + switch left.Kind() { + case reflect.Map: + iter := left.MapRange() + + var values []any + for iter.Next() { + value, err := impl.getPropertyValue(iter.Value(), property) + if err != nil { + return nil, err + } + + values = append(values, value) + } + + return values, nil + case reflect.Ptr, reflect.Struct, reflect.Slice: + return impl.getPropertyValue(left, property) + } + + return nil, nil +} + func (impl *interperterImpl) getMapValue(value reflect.Value) (interface{}, error) { if value.Kind() == reflect.Ptr { return impl.getMapValue(value.Elem()) diff --git a/act/exprparser/interpreter_test.go b/act/exprparser/interpreter_test.go index 4a7741fa..6233d907 100644 --- a/act/exprparser/interpreter_test.go +++ b/act/exprparser/interpreter_test.go @@ -562,6 +562,8 @@ func TestContexts(t *testing.T) { {"matrix.os", "Linux", "matrix-context"}, {"needs.job-id.outputs.output-name", "value", "needs-context"}, {"needs.job-id.result", "success", "needs-context"}, + {"contains(needs.*.result, 'success')", true, "needs-wildcard-context-contains-success"}, + {"contains(needs.*.result, 'failure')", false, "needs-wildcard-context-contains-failure"}, {"inputs.name", "value", "inputs-context"}, } @@ -610,6 +612,12 @@ func TestContexts(t *testing.T) { }, Result: "success", }, + "another-job-id": { + Outputs: map[string]string{ + "output-name": "value", + }, + Result: "success", + }, }, Inputs: map[string]interface{}{ "name": "value", From b236cb64f91c7289b6ef7c79eb85db1226a8aa1b Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 10 Aug 2025 16:24:19 +0000 Subject: [PATCH 054/281] fix: composite action input pollution (#818) refuses to use the default for an nodejs input when an composite action has an input with the same name. clean cherry-pick (except for trivial context conflict) of two related pull requests - https://github.com/nektos/act/pull/2348 - https://github.com/nektos/act/pull/2473 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/818): fix: composite action input pollution Co-authored-by: ChristopherHX Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/818 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/action.go | 1 + act/runner/expression.go | 16 +++++-- act/runner/runner_test.go | 3 ++ act/runner/step.go | 12 ++++- .../action-with-pre-and-post/action.yml | 16 +++++++ .../action-with-pre-and-post/main.js | 14 ++++++ .../action-with-pre-and-post/post.js | 14 ++++++ .../action-with-pre-and-post/pre.js | 12 +++++ .../composite_action/action.yml | 16 +++++++ .../push.yml | 10 ++++ .../composite_action/action.yml | 47 +++++++++++++++++++ .../push.yml | 24 ++++++++++ .../action-with-pre-and-post/action.yml | 16 +++++++ .../action-with-pre-and-post/main.js | 14 ++++++ .../action-with-pre-and-post/post.js | 14 ++++++ .../action-with-pre-and-post/pre.js | 12 +++++ .../composite_action/action.yml | 18 +++++++ .../push.yml | 12 +++++ 18 files changed, 267 insertions(+), 4 deletions(-) create mode 100644 act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/action.yml create mode 100644 act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/main.js create mode 100644 act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/post.js create mode 100644 act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/pre.js create mode 100644 act/runner/testdata/uses-composite-check-for-input-collision/composite_action/action.yml create mode 100644 act/runner/testdata/uses-composite-check-for-input-collision/push.yml create mode 100644 act/runner/testdata/uses-composite-check-for-input-in-if-uses/composite_action/action.yml create mode 100644 act/runner/testdata/uses-composite-check-for-input-in-if-uses/push.yml create mode 100644 act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/action.yml create mode 100644 act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/main.js create mode 100644 act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/post.js create mode 100644 act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/pre.js create mode 100644 act/runner/testdata/uses-composite-check-for-input-shadowing/composite_action/action.yml create mode 100644 act/runner/testdata/uses-composite-check-for-input-shadowing/push.yml diff --git a/act/runner/action.go b/act/runner/action.go index c777573d..93016f1d 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -711,6 +711,7 @@ func runPostStep(step actionStep) common.Executor { case model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20: populateEnvsFromSavedState(step.getEnv(), step, rc) + populateEnvsFromInput(ctx, step.getEnv(), step.getActionModel(), rc) containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Post)} logger.Debugf("executing remote job container: %s", containerArgs) diff --git a/act/runner/expression.go b/act/runner/expression.go index a81c7d39..1eade240 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -108,6 +108,19 @@ var hashfiles string // NewStepExpressionEvaluator creates a new evaluator func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step) ExpressionEvaluator { + return rc.NewStepExpressionEvaluatorExt(ctx, step, false) +} + +// NewStepExpressionEvaluatorExt creates a new evaluator +func (rc *RunContext) NewStepExpressionEvaluatorExt(ctx context.Context, step step, rcInputs bool) ExpressionEvaluator { + ghc := rc.getGithubContext(ctx) + if rcInputs { + return rc.newStepExpressionEvaluator(ctx, step, ghc, getEvaluatorInputs(ctx, rc, nil, ghc)) + } + return rc.newStepExpressionEvaluator(ctx, step, ghc, getEvaluatorInputs(ctx, rc, step, ghc)) +} + +func (rc *RunContext) newStepExpressionEvaluator(ctx context.Context, step step, ghc *model.GithubContext, inputs map[string]interface{}) ExpressionEvaluator { // todo: cleanup EvaluationEnvironment creation job := rc.Run.Job() strategy := make(map[string]interface{}) @@ -127,9 +140,6 @@ func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step) } } - ghc := rc.getGithubContext(ctx) - inputs := getEvaluatorInputs(ctx, rc, step, ghc) - ee := &exprparser.EvaluationEnvironment{ Github: step.getGithubContext(ctx), Env: *step.getEnv(), diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 86f06fcf..24d18546 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -252,7 +252,10 @@ func TestRunner_RunEvent(t *testing.T) { // Uses {workdir, "uses-composite", "push", "", platforms, secrets}, {workdir, "uses-composite-with-error", "push", "Job 'failing-composite-action' failed", platforms, secrets}, + {workdir, "uses-composite-check-for-input-collision", "push", "", platforms, secrets}, + {workdir, "uses-composite-check-for-input-shadowing", "push", "", platforms, secrets}, {workdir, "uses-nested-composite", "push", "", platforms, secrets}, + {workdir, "uses-composite-check-for-input-in-if-uses", "push", "", platforms, secrets}, // {workdir, "remote-action-composite-js-pre-with-defaults", "push", "", platforms, secrets}, {workdir, "remote-action-composite-action-ref", "push", "", platforms, secrets}, // reusable workflow not fully implemented yet diff --git a/act/runner/step.go b/act/runner/step.go index 0d2de3fd..56352baa 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -262,6 +262,16 @@ func mergeEnv(ctx context.Context, step step) { } rc.withGithubEnv(ctx, step.getGithubContext(ctx), *env) + + if step.getStepModel().Uses != "" { + // prevent uses action input pollution of unset parameters, skip this for run steps + // due to design flaw + for key := range *env { + if strings.HasPrefix(key, "INPUT_") { + delete(*env, key) + } + } + } } func isStepEnabled(ctx context.Context, expr string, step step, stage stepStage) (bool, error) { @@ -274,7 +284,7 @@ func isStepEnabled(ctx context.Context, expr string, step step, stage stepStage) defaultStatusCheck = exprparser.DefaultStatusCheckSuccess } - runStep, err := EvalBool(ctx, rc.NewStepExpressionEvaluator(ctx, step), expr, defaultStatusCheck) + runStep, err := EvalBool(ctx, rc.NewStepExpressionEvaluatorExt(ctx, step, stage == stepStageMain), expr, defaultStatusCheck) if err != nil { return false, fmt.Errorf(" \u274C Error in if-expression: \"if: %s\" (%s)", expr, err) } diff --git a/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/action.yml b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/action.yml new file mode 100644 index 00000000..1e9a8122 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/action.yml @@ -0,0 +1,16 @@ +name: "Action with pre and post" +description: "Action with pre and post" + +inputs: + step: + description: "step" + required: true + cache: + required: false + default: false + +runs: + using: "node16" + pre: pre.js + main: main.js + post: post.js diff --git a/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/main.js b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/main.js new file mode 100644 index 00000000..5a58515a --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/main.js @@ -0,0 +1,14 @@ +const { appendFileSync } = require('fs'); +const step = process.env['INPUT_STEP']; +appendFileSync(process.env['GITHUB_ENV'], `TEST=${step}`, { encoding:'utf-8' }) + +var cache = process.env['INPUT_CACHE'] +try { + var cache = JSON.parse(cache) +} catch { + +} +if(typeof cache !== 'boolean') { + console.log("Input Polluted boolean true/false expected, got " + cache) + process.exit(1); +} \ No newline at end of file diff --git a/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/post.js b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/post.js new file mode 100644 index 00000000..2f06cfe8 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/post.js @@ -0,0 +1,14 @@ +const { appendFileSync } = require('fs'); +const step = process.env['INPUT_STEP']; +appendFileSync(process.env['GITHUB_ENV'], `TEST=${step}-post`, { encoding:'utf-8' }) + +var cache = process.env['INPUT_CACHE'] +try { + var cache = JSON.parse(cache) +} catch { + +} +if(typeof cache !== 'boolean') { + console.log("Input Polluted boolean true/false expected, got " + cache) + process.exit(1); +} \ No newline at end of file diff --git a/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/pre.js b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/pre.js new file mode 100644 index 00000000..5d545140 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/pre.js @@ -0,0 +1,12 @@ +console.log('pre'); + +var cache = process.env['INPUT_CACHE'] +try { + var cache = JSON.parse(cache) +} catch { + +} +if(typeof cache !== 'boolean') { + console.log("Input Polluted boolean true/false expected, got " + cache) + process.exit(1); +} \ No newline at end of file diff --git a/act/runner/testdata/uses-composite-check-for-input-collision/composite_action/action.yml b/act/runner/testdata/uses-composite-check-for-input-collision/composite_action/action.yml new file mode 100644 index 00000000..d9683b77 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-collision/composite_action/action.yml @@ -0,0 +1,16 @@ +name: "Test Composite Action" +description: "Test action uses composite" + +inputs: + cache: + default: none + +runs: + using: "composite" + steps: + - uses: ./uses-composite-check-for-input-collision/action-with-pre-and-post + with: + step: step1 + - uses: ./uses-composite-check-for-input-collision/action-with-pre-and-post + with: + step: step2 diff --git a/act/runner/testdata/uses-composite-check-for-input-collision/push.yml b/act/runner/testdata/uses-composite-check-for-input-collision/push.yml new file mode 100644 index 00000000..059d8215 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-collision/push.yml @@ -0,0 +1,10 @@ +name: uses-composite-with-pre-and-post-steps +on: push + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + - run: echo -n "STEP_OUTPUT_TEST=empty" >> $GITHUB_ENV + - uses: ./uses-composite-check-for-input-collision/composite_action diff --git a/act/runner/testdata/uses-composite-check-for-input-in-if-uses/composite_action/action.yml b/act/runner/testdata/uses-composite-check-for-input-in-if-uses/composite_action/action.yml new file mode 100644 index 00000000..b743bf85 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-in-if-uses/composite_action/action.yml @@ -0,0 +1,47 @@ +name: "Test Composite Action" +description: "Test action uses composite" + +inputs: + b: + default: true + b2: {} + +runs: + using: "composite" + steps: + - uses: https://github.com/actions/github-script@v7 + if: inputs.b == 'true' + with: + script: | + console.log(${{ tojson(inputs) }}) + if( ${{ tojson(inputs.b) }} != 'true' ) { + process.exit(-1); + } + github-token: noop + - uses: https://github.com/actions/github-script@v7 + if: inputs.b != 'true' + with: + script: | + console.log(${{ tojson(inputs) }}) + if( ${{ tojson(inputs.b) }} == 'true' ) { + process.exit(-1); + } + github-token: noop + - uses: https://github.com/actions/github-script@v7 + if: inputs.b2 == 'false' + with: + script: | + console.log(${{ tojson(inputs) }}) + if( ${{ tojson(inputs.b2) }} != 'false' ) { + process.exit(-1); + } + github-token: noop + - uses: https://github.com/actions/github-script@v7 + if: inputs.b2 != 'false' + with: + script: | + console.log(${{ tojson(inputs) }}) + if( ${{ tojson(inputs.b2) }} == 'false' ) { + process.exit(-1); + } + github-token: noop diff --git a/act/runner/testdata/uses-composite-check-for-input-in-if-uses/push.yml b/act/runner/testdata/uses-composite-check-for-input-in-if-uses/push.yml new file mode 100644 index 00000000..068ba833 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-in-if-uses/push.yml @@ -0,0 +1,24 @@ +name: uses-composite-check-for-input-in-if-uses +on: push + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + - uses: ./uses-composite-check-for-input-in-if-uses/composite_action + with: + b: true + b2: true + - uses: ./uses-composite-check-for-input-in-if-uses/composite_action + with: + b: false + b2: false + - uses: ./uses-composite-check-for-input-in-if-uses/composite_action + with: + b: true + b2: false + - uses: ./uses-composite-check-for-input-in-if-uses/composite_action + with: + b: false + b2: true diff --git a/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/action.yml b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/action.yml new file mode 100644 index 00000000..1e9a8122 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/action.yml @@ -0,0 +1,16 @@ +name: "Action with pre and post" +description: "Action with pre and post" + +inputs: + step: + description: "step" + required: true + cache: + required: false + default: false + +runs: + using: "node16" + pre: pre.js + main: main.js + post: post.js diff --git a/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/main.js b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/main.js new file mode 100644 index 00000000..5a58515a --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/main.js @@ -0,0 +1,14 @@ +const { appendFileSync } = require('fs'); +const step = process.env['INPUT_STEP']; +appendFileSync(process.env['GITHUB_ENV'], `TEST=${step}`, { encoding:'utf-8' }) + +var cache = process.env['INPUT_CACHE'] +try { + var cache = JSON.parse(cache) +} catch { + +} +if(typeof cache !== 'boolean') { + console.log("Input Polluted boolean true/false expected, got " + cache) + process.exit(1); +} \ No newline at end of file diff --git a/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/post.js b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/post.js new file mode 100644 index 00000000..2f06cfe8 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/post.js @@ -0,0 +1,14 @@ +const { appendFileSync } = require('fs'); +const step = process.env['INPUT_STEP']; +appendFileSync(process.env['GITHUB_ENV'], `TEST=${step}-post`, { encoding:'utf-8' }) + +var cache = process.env['INPUT_CACHE'] +try { + var cache = JSON.parse(cache) +} catch { + +} +if(typeof cache !== 'boolean') { + console.log("Input Polluted boolean true/false expected, got " + cache) + process.exit(1); +} \ No newline at end of file diff --git a/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/pre.js b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/pre.js new file mode 100644 index 00000000..5d545140 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-shadowing/action-with-pre-and-post/pre.js @@ -0,0 +1,12 @@ +console.log('pre'); + +var cache = process.env['INPUT_CACHE'] +try { + var cache = JSON.parse(cache) +} catch { + +} +if(typeof cache !== 'boolean') { + console.log("Input Polluted boolean true/false expected, got " + cache) + process.exit(1); +} \ No newline at end of file diff --git a/act/runner/testdata/uses-composite-check-for-input-shadowing/composite_action/action.yml b/act/runner/testdata/uses-composite-check-for-input-shadowing/composite_action/action.yml new file mode 100644 index 00000000..2cb5b4e9 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-shadowing/composite_action/action.yml @@ -0,0 +1,18 @@ +name: "Test Composite Action" +description: "Test action uses composite" + +inputs: + cache: + default: true + +runs: + using: "composite" + steps: + - uses: ./uses-composite-check-for-input-shadowing/action-with-pre-and-post + with: + step: step1 + cache: ${{ inputs.cache || 'none' }} + - uses: ./uses-composite-check-for-input-shadowing/action-with-pre-and-post + with: + step: step2 + cache: ${{ inputs.cache || 'none' }} diff --git a/act/runner/testdata/uses-composite-check-for-input-shadowing/push.yml b/act/runner/testdata/uses-composite-check-for-input-shadowing/push.yml new file mode 100644 index 00000000..0a11a995 --- /dev/null +++ b/act/runner/testdata/uses-composite-check-for-input-shadowing/push.yml @@ -0,0 +1,12 @@ +name: uses-composite-with-pre-and-post-steps +on: push + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + - run: echo -n "STEP_OUTPUT_TEST=empty" >> $GITHUB_ENV + - uses: ./uses-composite-check-for-input-shadowing/composite_action + # with: + # cache: other From 4e5a3025d79ed8a7551d5b391b95e14dfe0722d6 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 10 Aug 2025 16:24:49 +0000 Subject: [PATCH 055/281] chore: "unable to get git repo" is a debug message, not a warning (#822) Refs https://github.com/nektos/act/pull/2495 --- * Disable "unable to get git repo" when none exists. * Restore error back so it's included in bug reports Change from Warningf to Debugf. --------- Co-authored-by: Casey Lee (cherry picked from commit e42a534b2e65d28b41532f9a44d18c0354aecfc2) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/822): chore: "unable to get git repo" is a debug message, not a warning [skip cascade] Co-authored-by: Steven Edwards Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/822 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/model/github_context.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/model/github_context.go b/act/model/github_context.go index 02d4f779..4b1585ae 100644 --- a/act/model/github_context.go +++ b/act/model/github_context.go @@ -171,7 +171,7 @@ func (ghc *GithubContext) SetRepositoryAndOwner(ctx context.Context, githubInsta if ghc.Repository == "" { repo, err := git.FindGithubRepo(ctx, repoPath, githubInstance, remoteName) if err != nil { - common.Logger(ctx).Warningf("unable to get git repo (githubInstance: %v; remoteName: %v, repoPath: %v): %v", githubInstance, remoteName, repoPath, err) + common.Logger(ctx).Debugf("unable to get git repo (githubInstance: %v; remoteName: %v, repoPath: %v): %v", githubInstance, remoteName, repoPath, err) return } ghc.Repository = repo From 2cbe2051868ce66105e9725f822d4ea1b44f1998 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 10 Aug 2025 18:25:59 +0000 Subject: [PATCH 056/281] Update module github.com/docker/go-connections to v0.6.0 (#836) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/go-connections](https://github.com/docker/go-connections) | `v0.5.0` -> `v0.6.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fgo-connections/v0.6.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fgo-connections/v0.5.0/v0.6.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/go-connections (github.com/docker/go-connections) ### [`v0.6.0`](https://github.com/docker/go-connections/compare/v0.5.0...v0.6.0) [Compare Source](https://github.com/docker/go-connections/compare/v0.5.0...v0.6.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/836 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index ab471b13..9aeaee6f 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/distribution/reference v0.6.0 github.com/docker/cli v28.3.3+incompatible github.com/docker/docker v28.3.3+incompatible - github.com/docker/go-connections v0.5.0 + github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 github.com/go-git/go-git/v5 v5.16.2 github.com/gobwas/glob v0.2.3 diff --git a/go.sum b/go.sum index e51b2807..ce5d53a9 100644 --- a/go.sum +++ b/go.sum @@ -49,8 +49,8 @@ github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjY github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40= -github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c= -github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc= +github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94= +github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o= From be5c6152017d033c15f8fbcdc07738acc38164d9 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 10 Aug 2025 19:37:14 +0000 Subject: [PATCH 057/281] fix: prevent unintended input replacement in reusable workflows with workflow_dispatch when using workflow_call (#833) Refs https://github.com/nektos/act/pull/2349 --- See: https://github.com/nektos/act/issues/2464#issuecomment-2430903650 * Add condition to prevent replacing inputs in reusable workflows with workflow_dispatch inputs --------- Co-authored-by: ChristopherHX (cherry picked from commit f4f4265e977a760e0637a65b1554af2cada034cc) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/833): fix: prevent unintended input replacement in reusable workflows with workflow_dispatch when using workflow_call Co-authored-by: S. M. Mahmudul Haque (Yamin) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/833 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/expression.go | 2 +- act/runner/runner_test.go | 1 + .../workflows/local-reusable-and-dispatch.yml | 30 +++++++++++++++++++ .../workflow_dispatch.yml | 21 +++++++++++++ 4 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 act/runner/testdata/.github/workflows/local-reusable-and-dispatch.yml create mode 100644 act/runner/testdata/uses-workflow-defaults/workflow_dispatch.yml diff --git a/act/runner/expression.go b/act/runner/expression.go index 1eade240..cf826bf2 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -497,7 +497,7 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod } } - if ghc.EventName == "workflow_dispatch" { + if rc.caller == nil && ghc.EventName == "workflow_dispatch" { config := rc.Run.Workflow.WorkflowDispatchConfig() if config != nil && config.Inputs != nil { for k, v := range config.Inputs { diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 24d18546..f930d68d 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -314,6 +314,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "workflow_dispatch_no_inputs_mapping", "workflow_dispatch", "", platforms, secrets}, {workdir, "workflow_dispatch-scalar", "workflow_dispatch", "", platforms, secrets}, {workdir, "workflow_dispatch-scalar-composite-action", "workflow_dispatch", "", platforms, secrets}, + {workdir, "uses-workflow-defaults", "workflow_dispatch", "", platforms, secrets}, {workdir, "job-needs-context-contains-result", "push", "", platforms, secrets}, {"../model/testdata", "strategy", "push", "", platforms, secrets}, // TODO: move all testdata into pkg so we can validate it with planner and runner {workdir, "path-handling", "push", "", platforms, secrets}, diff --git a/act/runner/testdata/.github/workflows/local-reusable-and-dispatch.yml b/act/runner/testdata/.github/workflows/local-reusable-and-dispatch.yml new file mode 100644 index 00000000..b43f092b --- /dev/null +++ b/act/runner/testdata/.github/workflows/local-reusable-and-dispatch.yml @@ -0,0 +1,30 @@ +name: reuse + +on: + workflow_dispatch: + inputs: + my-val: + type: string + required: true + default: "default_value_reuse_workflow_dispatch_call" + dispatch-val: + type: string + default: "I am a dispatch var for checking if I am being used in workflow_call" + + workflow_call: + inputs: + my-val: + type: string + required: true + default: "default_value_reuse_workflow_call" + +jobs: + reusable_workflow_job: + runs-on: ubuntu-latest + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + - name: Run a one-line script + run: echo "✅ 🚀 ✅ hello this is from workflow reuse. Value - " ${{ inputs.my-val }} ${{ github.event_name }} ${{ inputs.dispatch-val }} + - name: Assert + run: | + exit ${{ ( inputs.my-val == 'default_value_reuse_workflow_call' || inputs.my-val == 'passed value from main' ) && !inputs.dispatch-val && '0' || '1' }} diff --git a/act/runner/testdata/uses-workflow-defaults/workflow_dispatch.yml b/act/runner/testdata/uses-workflow-defaults/workflow_dispatch.yml new file mode 100644 index 00000000..2ebe0f75 --- /dev/null +++ b/act/runner/testdata/uses-workflow-defaults/workflow_dispatch.yml @@ -0,0 +1,21 @@ +name: CI + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + + workflow_dispatch: + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + - name: Run a one-line script + run: echo "✅ 🚀 ✅ hello this is from workflow main" ${{ github.event_name }} + call-reuse-w-val: + uses: ./testdata/.github/workflows/local-reusable-and-dispatch.yml + with: + my-val: "passed value from main" From 059ef13b99cde69d1417641ecdf8579908bf1870 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 10 Aug 2025 20:16:40 +0000 Subject: [PATCH 058/281] Update module golang.org/x/term to v0.34.0 (#837) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.33.0` -> `v0.34.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.33.0...refs/tags/v0.34.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.34.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.33.0/v0.34.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/837 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 9aeaee6f..9350065b 100644 --- a/go.mod +++ b/go.mod @@ -36,7 +36,7 @@ require ( github.com/stretchr/testify v1.10.0 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.2 - golang.org/x/term v0.33.0 + golang.org/x/term v0.34.0 golang.org/x/time v0.12.0 google.golang.org/protobuf v1.36.7 gopkg.in/yaml.v3 v3.0.1 @@ -103,7 +103,7 @@ require ( golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.39.0 // indirect golang.org/x/sync v0.12.0 // indirect - golang.org/x/sys v0.34.0 // indirect + golang.org/x/sys v0.35.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect ) diff --git a/go.sum b/go.sum index ce5d53a9..0f3082f2 100644 --- a/go.sum +++ b/go.sum @@ -263,11 +263,11 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA= -golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= +golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg= -golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0= +golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4= +golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= From 366e88069e0c9846c1bde5418ebc0093309bef0d Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 10 Aug 2025 20:21:05 +0000 Subject: [PATCH 059/281] chore: remove the alpha quality warning, it is secure enough to be used in production (#774) > **Note** change the repository description once it is merged. - Security issues are to be filed responsibly and will be taken care of by the security team. Refs https://codeberg.org/forgejo/discussions/issues/377 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/774): chore: remove the alpha quality warning, it is secure enough to be used in production Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/774 Reviewed-by: Michael Kriese Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/README.md b/README.md index 043f6952..276c8746 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,5 @@ # Forgejo Runner -**WARNING:** this is [alpha release quality](https://en.wikipedia.org/wiki/Software_release_life_cycle#Alpha) code and should not be considered secure enough to deploy in production. - A daemon that connects to a Forgejo instance and runs jobs for continuous integration. The [installation and usage instructions](https://forgejo.org/docs/next/admin/actions/) are part of the Forgejo documentation. # Reporting bugs From f1423853131b0b10ec28027c15f0fa938dc450b4 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 10 Aug 2025 21:10:03 +0000 Subject: [PATCH 060/281] Update code.forgejo.org/forgejo/runner Docker tag to v9 (#838) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | major | `7.0.0` -> `9.0.3` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v9.0.3`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.3) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.2...v9.0.3) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/804): feat: lxc-systemd defaults to using Forgejo runner 9.0.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/784): feat: --health-\* options are allowed in `job..services..options` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/810): fix: log the URL of the action when it fails schema validation - [PR](https://code.forgejo.org/forgejo/runner/pulls/798): fix: lingering services/volumes/networks after jobs if cleanup takes >1min - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/806): chore: upgrade lxc-helpers - [PR](https://code.forgejo.org/forgejo/runner/pulls/627): chore: teach renovate about examples/lxc-systemd/forgejo-runner-service.sh - [PR](https://code.forgejo.org/forgejo/runner/pulls/807): Update module github.com/containerd/errdefs to v1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/803): chore: explain that part of the source is Apache 2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/790): chore(cleanup): dispatch workflows according to the role of the repository - [PR](https://code.forgejo.org/forgejo/runner/pulls/797): chore: unify forgejo image names location - [PR](https://code.forgejo.org/forgejo/runner/pulls/799): chore: replace docker hub with code.forgejo.org - [PR](https://code.forgejo.org/forgejo/runner/pulls/802): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.3.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/801): Update module github.com/opencontainers/selinux to v1.12.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/800): Update module github.com/go-git/go-git/v5 to v5.16.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/796): Update module github.com/docker/cli to v28.3.3+incompatible - [PR](https://code.forgejo.org/forgejo/runner/pulls/795): Update dependency forgejo/release-notes-assistant to v1.4.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/794): Update module github.com/spf13/pflag to v1.0.7 - [PR](https://code.forgejo.org/forgejo/runner/pulls/793): Update module github.com/opencontainers/image-spec to v1.1.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/792): Update module go.etcd.io/bbolt to v1.4.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/791): Update module github.com/rhysd/actionlint to v1.7.7 - [PR](https://code.forgejo.org/forgejo/runner/pulls/787): Update module github.com/go-git/go-billy/v5 to v5.6.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/789): chore: the release link to RELEASE-NOTES.md is no longer needed (take 2) ### [`v9.0.2`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.2) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.1...v9.0.2) - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/783): feat: use cache-{from,to}: type=gha in the docker/build-push-action example - [PR](https://code.forgejo.org/forgejo/runner/pulls/781): feat: add an LXC based example of docker/build-push-action usage - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/786): fix: vars context is allowed in default values of action inputs - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/788): Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.4.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/782): chore: the release link to RELEASE-NOTES.md is no longer needed - [PR](https://code.forgejo.org/forgejo/runner/pulls/780): chore(ci): autoremove when running a workflow in a test - [PR](https://code.forgejo.org/forgejo/runner/pulls/778): Update dependency forgejo/release-notes-assistant to v1.3.6 ### [`v9.0.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.0...v9.0.1) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/777): chore: to allow the runner to be imported, v9 needs to be in the go module - [PR](https://code.forgejo.org/forgejo/runner/pulls/776): Update module github.com/docker/docker to v28.3.3+incompatible \[SECURITY] - [PR](https://code.forgejo.org/forgejo/runner/pulls/775): chore: release notes are now published together with the release ### [`v9.0.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v8.0.1...v9.0.0) Workflows and actions go through a schema validation and the runner will not start a job if they do not pass. Some existing workflows or actions may have syntax errors that did not prevent them from running with versions 7.0.0 and below but they will no longer work with versions 8.0.0 and above. Existing workflows can be verified and fixed before upgrading by using the new `forgejo-runner validate` command. For instance, the following will try to validate workflows and/or actions found in the Git repository at `https://example.com/my/repo` (a local directory at the root of a Git repository can also be used): ```sh $ forgejo-runner validate --repository https://example.com/my/repo .forgejo/workflows/release.yml workflow schema validation OK .forgejo/workflows/test.yml workflow schema validation OK ``` If the error is not immediately obvious, please file an issue with a copy of the failed workflow and revert to using version 7.0.0 until it is resolved. *** - features including breaking changes - [PR](https://code.forgejo.org/forgejo/runner/pulls/740): feat!: remove support for using an artifact server via CLI - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/757): feat: the new `forgejo-runner validate` command can be used to verify if an action or a workflow is conformant with the expected schema. `forgejo-runner validate --repository https://example.com/my/repository` will validate all the workflows and actions a Git repository contains. Alternatively `forgejo-runner validate --path myaction/action.yml --action` or `forgejo-runner validate --path .forgejo/workflows/test.yml --workflow` can be used to validate a single file. It is recommended to use these commands to verify existing actions and workflows pass before upgrading to [Forgejo runner v8.0.0](https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#8-0-0) or above to not disrupt existing workflows. - [PR](https://code.forgejo.org/forgejo/runner/pulls/768): feat(security): recommend security issues are reported to security@forgejo.org - [PR](https://code.forgejo.org/forgejo/runner/pulls/769): feat(tests): cmd executeCommand captures stderr & stdout - [PR](https://code.forgejo.org/forgejo/runner/pulls/753): feat: merge forgejo/act/pkg in the act directory - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/770): fix: allow expressions in action descriptions and incomplete action inputs - [PR](https://code.forgejo.org/forgejo/runner/pulls/761): fix: the vars context is allowed in an action step env - [PR](https://code.forgejo.org/forgejo/runner/pulls/766): fix: allow expressions in step and job uses: - [PR](https://code.forgejo.org/forgejo/runner/pulls/762): fix(ci): use code.forgejo.org instead of the docker hub - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/772): Restore `contrib/forgejo-runner.service` - [PR](https://code.forgejo.org/forgejo/runner/pulls/767): chore: remove unused/unmaintained files - [PR](https://code.forgejo.org/forgejo/runner/pulls/759): chore: a single testutils for both act and the runner - [PR](https://code.forgejo.org/forgejo/runner/pulls/758): chore: renovate must not look at any testdata subdirectory - [PR](https://code.forgejo.org/forgejo/runner/pulls/756): chore(release-notes): finalize 9.0.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/754): chore: use the act directory instead of https://code.forgejo.org/forgejo/act - [PR](https://code.forgejo.org/forgejo/runner/pulls/752): chore(docs): naked `host` schema in 8.0.0 is a breaking change - [PR](https://code.forgejo.org/forgejo/runner/pulls/750): chore: disable package name checks for revive \[skip cascade] ### [`v8.0.1`](https://code.forgejo.org/forgejo/runner/blob/HEAD/RELEASE-NOTES.md#801) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v8.0.0...v8.0.1) - [tolerate strings for fail-fast, max-parallel, timeout-minutes, cancel-timeout-minutes](https://code.forgejo.org/forgejo/act/pulls/203). ### [`v8.0.0`](https://code.forgejo.org/forgejo/runner/blob/HEAD/RELEASE-NOTES.md#800) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v7.0.0...v8.0.0) - Breaking change: workflows files go through a [schema validation](https://code.forgejo.org/forgejo/act/pulls/170) and will not run if they do not pass. Some existing workflows may have syntax errors that did not prevent them from running with versions 7.0.0 and below but they will no longer work with versions 8.0.0 and above. Existing workflows can be verified and fixed before upgrading by using `forgejo-runner exec --workflows path-to-the-workflow`. For instance in a workflow where `ruins-on` was typed by mistake instead of `runs-on`: ```sh $ forgejo-runner exec --event unknown --workflows ../forgejo/.forgejo/workflows/build-release.yml Error: workflow is not valid. 'build-release.yml': Line: 32 Column 5: Failed to match job-factory: Line: 32 Column 5: Unknown Property ruins-on Line: 32 Column 5: Failed to match workflow-job: Line: 32 Column 5: Unknown Property ruins-on Line: 35 Column 5: Unknown Property steps Forgejo Actions YAML Schema validation error ``` If the error is not immediately obvious, please file an issue with a copy of the failed workflow and revert to using version 7.0.0 until it is resolved. - Breaking change: the logic assigning labels was updated and refactored: - in the absence of a label or a label, [default to `docker://node:22-bookworm` instead of `docker://node:20-bullseye` or `host`](https://code.forgejo.org/forgejo/runner/issues/134). - if the `lxc` scheme is set with no argument, it defaults to `lxc://debian:bookworm` instead of `lxc://debian:bullseye`. - the `host` schema cannot have any argument, it can no longer be `host://-self-hosted` - Breaking change: [bash fallback to sh if it is not available](https://code.forgejo.org/forgejo/runner/issues/150). It will use `bash` instead of `sh` when a container image is explicitly specified in the step. If a workflow depens on that behavior, it will need to be modified to explictly set the shell to `sh`. - Breaking change: [sanitize network aliases to be valid DNS names](https://code.forgejo.org/forgejo/act/pulls/190). It is breaking for workflows with services that rely on host names (derived from the service name or the job name) that do not match `[^A-Z0-9-]+`. They will be sanitized and a message displayed in the logs showing the sanitized name. The service can either be renamed to match the constraint so it can be used as is. Or the sanitized name can be used. For instance of a PostgreSQL service runs as `data.base` it will be sanitized as `data_base`. - [secrets that contain multiple lines are masked from the output](https://code.forgejo.org/forgejo/runner/pulls/661). - [sum256 the container name so derivations do not overflow](https://code.forgejo.org/forgejo/act/pulls/191).
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/838 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index ac51a52b..143f9a4f 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:7.0.0 + image: code.forgejo.org/forgejo/runner:9.0.3 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:7.0.0 + image: code.forgejo.org/forgejo/runner:9.0.3 links: - docker-in-docker - forgejo From 92518a9a745f7d9fdc1005ae21678895bd47d6d8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 11 Aug 2025 05:33:56 +0000 Subject: [PATCH 061/281] Update module github.com/vektra/mockery/v2 to v3 (#841) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/vektra/mockery/v2](https://github.com/vektra/mockery) | `v2.53.4` -> `v3.5.2` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fvektra%2fmockery%2fv2/v3.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fvektra%2fmockery%2fv2/v2.53.4/v3.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
vektra/mockery (github.com/vektra/mockery/v2) ### [`v3.5.2`](https://github.com/vektra/mockery/releases/tag/v3.5.2) [Compare Source](https://github.com/vektra/mockery/compare/v3.5.1...v3.5.2) #### What's Changed - Fix bug with replace-type not working with pointers by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1099 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.5.1...v3.5.2 ### [`v3.5.1`](https://github.com/vektra/mockery/releases/tag/v3.5.1) [Compare Source](https://github.com/vektra/mockery/compare/v3.5.0...v3.5.1) #### What's Changed - Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by [@​dependabot](https://github.com/dependabot)\[bot] in https://github.com/vektra/mockery/pull/1081 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.5.0...v3.5.1 ### [`v3.5.0`](https://github.com/vektra/mockery/releases/tag/v3.5.0) [Compare Source](https://github.com/vektra/mockery/compare/v3.4.0...v3.5.0) #### What's Changed - Add `inpackage` flag to override in-package detection logic by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1077 - Add `include-auto-generated` config option by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1079 - Fix issue with rendering multiple templates from same interface by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1080 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.4.0...v3.5.0 ### [`v3.4.0`](https://github.com/vektra/mockery/releases/tag/v3.4.0) [Compare Source](https://github.com/vektra/mockery/compare/v3.3.6...v3.4.0) #### What's Changed - Fix issue with type alias to interface not being generated by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1074 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.3.6...v3.4.0 ### [`v3.3.6`](https://github.com/vektra/mockery/releases/tag/v3.3.6) [Compare Source](https://github.com/vektra/mockery/compare/v3.3.5...v3.3.6) #### What's Changed - Separate release into reusable github action by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1071 - Fix matryer template imports when outputting mock to different package than source by [@​chadwpetersen](https://github.com/chadwpetersen) in https://github.com/vektra/mockery/pull/1061 - Fix issue in koanf v2.2.1 by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1068 #### New Contributors - [@​chadwpetersen](https://github.com/chadwpetersen) made their first contribution in https://github.com/vektra/mockery/pull/1061 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.3.5...v3.3.6 ### [`v3.3.5`](https://github.com/vektra/mockery/compare/v3.3.4...v3.3.5) [Compare Source](https://github.com/vektra/mockery/compare/v3.3.4...v3.3.5) ### [`v3.3.4`](https://github.com/vektra/mockery/releases/tag/v3.3.4) [Compare Source](https://github.com/vektra/mockery/compare/v3.3.3...v3.3.4) #### What's Changed - Ditch pathlib and fix Windows bugs by [@​kgadams](https://github.com/kgadams) in https://github.com/vektra/mockery/pull/1062 #### New Contributors - [@​kgadams](https://github.com/kgadams) made their first contribution in https://github.com/vektra/mockery/pull/1062 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.3.2...v3.3.4 ### [`v3.3.3`](https://github.com/vektra/mockery/compare/v3.3.2...v3.3.3) [Compare Source](https://github.com/vektra/mockery/compare/v3.3.2...v3.3.3) ### [`v3.3.2`](https://github.com/vektra/mockery/releases/tag/v3.3.2) [Compare Source](https://github.com/vektra/mockery/compare/v3.3.1...v3.3.2) #### What's Changed - Fix anchors causing panics by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1058 - Fix issue with relative `dir` values causing invalid in-package calculation by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1059 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.3.1...v3.3.2 ### [`v3.3.1`](https://github.com/vektra/mockery/releases/tag/v3.3.1) [Compare Source](https://github.com/vektra/mockery/compare/v3.3.0...v3.3.1) #### What's Changed - Fix issue when no value specified for variadic arg by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1055 - Bump github.com/spf13/viper from 1.15.0 to 1.20.1 in /tools by [@​peczenyj](https://github.com/peczenyj) in https://github.com/vektra/mockery/pull/1036 #### New Contributors - [@​peczenyj](https://github.com/peczenyj) made their first contribution in https://github.com/vektra/mockery/pull/1036 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.3.0...v3.3.1 ### [`v3.3.0`](https://github.com/vektra/mockery/releases/tag/v3.3.0) [Compare Source](https://github.com/vektra/mockery/compare/v3.2.5...v3.3.0) #### What's Changed - Fix uppercase generic type parameters by [@​fen4o](https://github.com/fen4o) in https://github.com/vektra/mockery/pull/1022 - Add parameter type to EXPECT method doc comments. by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1034 - Fix missing dependency by running go mod tidy by [@​miner46er](https://github.com/miner46er) in https://github.com/vektra/mockery/pull/1045 - Fix issue with nil in `.Run()` causing panic by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1043 - Fix unroll-variadic default in v3 migration by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1054 #### New Contributors - [@​fen4o](https://github.com/fen4o) made their first contribution in https://github.com/vektra/mockery/pull/1022 - [@​miner46er](https://github.com/miner46er) made their first contribution in https://github.com/vektra/mockery/pull/1045 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.2.5...v3.3.0 ### [`v3.2.5`](https://github.com/vektra/mockery/releases/tag/v3.2.5) [Compare Source](https://github.com/vektra/mockery/compare/v3.2.4...v3.2.5) #### What's Changed - Disable `goimports` from messing with imports by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1032 - Fix mockery reading auto-generated files by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1029 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.2.4...v3.2.5 ### [`v3.2.4`](https://github.com/vektra/mockery/releases/tag/v3.2.4) [Compare Source](https://github.com/vektra/mockery/compare/v3.2.3...v3.2.4) #### What's Changed - Recursive package generation regex fix by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1026 - Fix variadic parameter handling in `.EXPECT().Run()` by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1027 - Fix unknown `MOCKERY_` env vars causing panics by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1028 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.2.3...v3.2.4 ### [`v3.2.3`](https://github.com/vektra/mockery/releases/tag/v3.2.3) [Compare Source](https://github.com/vektra/mockery/compare/v3.2.2...v3.2.3) #### What's Changed - Mention PackageName template variable deprecation by [@​thejan2009](https://github.com/thejan2009) in https://github.com/vektra/mockery/pull/1018 #### New Contributors - [@​thejan2009](https://github.com/thejan2009) made their first contribution in https://github.com/vektra/mockery/pull/1018 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.2.2...v3.2.3 ### [`v3.2.2`](https://github.com/vektra/mockery/releases/tag/v3.2.2) [Compare Source](https://github.com/vektra/mockery/compare/v3.2.1...v3.2.2) #### What's Changed - Fix issue with scope lookup returning nil by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1010 - Fix variadic mock generation when `unroll-variadic: false`. by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1011 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.2.1...v3.2.2 ### [`v3.2.1`](https://github.com/vektra/mockery/releases/tag/v3.2.1) [Compare Source](https://github.com/vektra/mockery/compare/v3.2.0...v3.2.1) #### What's Changed - Fix invalid generation when variadic has no return values by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1007 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.2.0...v3.2.1 ### [`v3.2.0`](https://github.com/vektra/mockery/releases/tag/v3.2.0) [Compare Source](https://github.com/vektra/mockery/compare/v3.1.0...v3.2.0) #### What's Changed - Fix `with-expecter` in migrate command by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1002 - Change `force-file-write` default to be `true`. by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1003 - Fix issue with variadic arguments from return function provider by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1004 - Bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 in /tools by [@​dependabot](https://github.com/dependabot) in https://github.com/vektra/mockery/pull/1005 - Bump golang.org/x/net from 0.33.0 to 0.36.0 in /tools by [@​dependabot](https://github.com/dependabot) in https://github.com/vektra/mockery/pull/1006 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.1.0...v3.2.0 ### [`v3.1.0`](https://github.com/vektra/mockery/releases/tag/v3.1.0) [Compare Source](https://github.com/vektra/mockery/compare/v3.0.2...v3.1.0) #### What's Changed - v3: Build release with latest stable Go version by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/998 - v3: Add `*ast.GenDecl` and `*ast.TypeSpec` comments to `template.Interface` by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/999 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.0.2...v3.1.0 ### [`v3.0.2`](https://github.com/vektra/mockery/releases/tag/v3.0.2) [Compare Source](https://github.com/vektra/mockery/compare/v3.0.1...v3.0.2) #### What's Changed - v3: Fix constructor name not respecting exported-ness by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/995 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.0.1...v3.0.2 ### [`v3.0.1`](https://github.com/vektra/mockery/releases/tag/v3.0.1) [Compare Source](https://github.com/vektra/mockery/compare/v3.0.0...v3.0.1) #### What's Changed - Fixing the v3 docs configuration by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/986 - v3: Fix `mockery init` failing by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/994 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.0.0...v3.0.1 ### [`v3.0.0`](https://github.com/vektra/mockery/releases/tag/v3.0.0) [Compare Source](https://github.com/vektra/mockery/compare/v2.53.4...v3.0.0) #### What's Changed - v3: Update docs and release for v3 GA. by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/985 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.0.0-beta.11...v3.0.0
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/841): Update module github.com/vektra/mockery/v2 to v3 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/841 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 1995f027..99dd939b 100644 --- a/Makefile +++ b/Makefile @@ -13,7 +13,7 @@ WINDOWS_ARCHS ?= windows/amd64 GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") -MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.4 # renovate: datasource=go +MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v3.5.2 # renovate: datasource=go GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.3.1 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner From 7953ef9a4fa2230a07dfaa7f209f87217a29e20f Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 11 Aug 2025 07:53:51 +0000 Subject: [PATCH 062/281] Update module github.com/imdario/mergo to v1 (#840) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/imdario/mergo](https://github.com/imdario/mergo) | `v0.3.16` -> `v1.0.2` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fimdario%2fmergo/v1.0.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fimdario%2fmergo/v0.3.16/v1.0.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
imdario/mergo (github.com/imdario/mergo) ### [`v1.0.2`](https://github.com/darccio/mergo/releases/tag/v1.0.2) [Compare Source](https://github.com/imdario/mergo/compare/v1.0.1...v1.0.2) #### What's Changed - Drops `gopkg.in/yaml.v3`, only used for loading fixtures. Thanks [@​trim21](https://github.com/trim21) for bringing to my attention ([#​262](https://github.com/imdario/mergo/issues/262)) that this library is no longer maintained. **Full Changelog**: https://github.com/darccio/mergo/compare/v1.0.1...v1.0.2 ### [`v1.0.1`](https://github.com/darccio/mergo/releases/tag/v1.0.1) [Compare Source](https://github.com/imdario/mergo/compare/v1.0.0...v1.0.1) #### What's Changed - fixes issue [#​187](https://github.com/imdario/mergo/issues/187) by [@​vsemichev](https://github.com/vsemichev) in https://github.com/darccio/mergo/pull/253 - fix: `WithoutDereference` should respect non-nil struct pointers by [@​joshkaplinsky](https://github.com/joshkaplinsky) in https://github.com/darccio/mergo/pull/251 #### New Contributors - [@​vsemichev](https://github.com/vsemichev) made their first contribution in https://github.com/darccio/mergo/pull/253 - [@​joshkaplinsky](https://github.com/joshkaplinsky) made their first contribution in https://github.com/darccio/mergo/pull/251 **Full Changelog**: https://github.com/darccio/mergo/compare/v1.0.0...v1.0.1 ### [`v1.0.0`](https://github.com/darccio/mergo/releases/tag/v1.0.0): 1.0.0 released with new module URL: dario.cat/mergo [Compare Source](https://github.com/imdario/mergo/compare/v0.3.16...v1.0.0) This PR is a release containing [0.3.15](https://github.com/imdario/mergo/releases/tag/v0.3.15) features but changing the module URL to `dario.cat/mergo`. #### What's Changed - feat: v1.0.0 released by [@​imdario](https://github.com/imdario) in https://github.com/imdario/mergo/pull/238 **Full Changelog**: https://github.com/imdario/mergo/compare/v0.3.16...v1.0.0
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/840): Update module github.com/imdario/mergo to v1 Co-authored-by: Earl Warren Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/840 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- act/container/docker_run.go | 2 +- go.mod | 3 +-- go.sum | 6 ++---- 3 files changed, 4 insertions(+), 7 deletions(-) diff --git a/act/container/docker_run.go b/act/container/docker_run.go index 34eb3703..ac52cee5 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -17,6 +17,7 @@ import ( "strings" "time" + "dario.cat/mergo" "github.com/Masterminds/semver" "github.com/docker/cli/cli/compose/loader" "github.com/docker/cli/cli/connhelper" @@ -31,7 +32,6 @@ import ( "github.com/go-git/go-billy/v5/osfs" "github.com/go-git/go-git/v5/plumbing/format/gitignore" "github.com/gobwas/glob" - "github.com/imdario/mergo" "github.com/joho/godotenv" "github.com/kballard/go-shellquote" specs "github.com/opencontainers/image-spec/specs-go/v1" diff --git a/go.mod b/go.mod index 9350065b..c22ab410 100644 --- a/go.mod +++ b/go.mod @@ -7,6 +7,7 @@ toolchain go1.24.6 require ( code.forgejo.org/forgejo/actions-proto v0.5.1 connectrpc.com/connect v1.18.1 + dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 github.com/containerd/errdefs v1.0.0 @@ -19,7 +20,6 @@ require ( github.com/go-git/go-git/v5 v5.16.2 github.com/gobwas/glob v0.2.3 github.com/google/uuid v1.6.0 - github.com/imdario/mergo v0.3.16 github.com/joho/godotenv v1.5.1 github.com/julienschmidt/httprouter v1.3.0 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 @@ -44,7 +44,6 @@ require ( ) require ( - dario.cat/mergo v1.0.0 // indirect github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect diff --git a/go.sum b/go.sum index 0f3082f2..e6ca818e 100644 --- a/go.sum +++ b/go.sum @@ -2,8 +2,8 @@ code.forgejo.org/forgejo/actions-proto v0.5.1 h1:GCJHR/Y/Apk7Yl7CH9qOsKrdf/k0tRV code.forgejo.org/forgejo/actions-proto v0.5.1/go.mod h1:nu8N1HQLsu3c4T/PpYWbqwNBxsZnEOVxqV0mQWtIQvE= connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= -dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= -dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= +dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= +dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8= github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0= @@ -92,8 +92,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms= github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg= -github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= -github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A= From 592226943f4517da1cb91ed24513febf9142c468 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 11 Aug 2025 08:30:33 +0000 Subject: [PATCH 063/281] chore: set the Kind/Chore label on dependencies upgrades (#842) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/842): chore: set the Kind/Chore label on dependencies upgrades Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/842 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- renovate.json | 1 + 1 file changed, 1 insertion(+) diff --git a/renovate.json b/renovate.json index e654a18d..96bdfbdc 100644 --- a/renovate.json +++ b/renovate.json @@ -9,5 +9,6 @@ "separateMinorPatch": true } ], + "labels": ["Kind/Chore"], "ignorePaths": ["**/testdata/**", "**/node_modules/**"] } From 66bb63ea182391a02a81e73a146eebaeb4e0b85f Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 11 Aug 2025 12:49:51 +0000 Subject: [PATCH 064/281] chore: require Go v1.24 (#839) It is not a breaking change for Forgejo because Forgejo v13 already depends on Go v1.24 and Forgejo runner v9 is not compatible with Forgejo versions before v13 from an API point of view. It is however compatible from a protocol point of view and this does not depend on the Go version being used. It would be a breaking change for third party software using the runner as a package but it is not designed or supported for that. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/839): chore: require Go v1.24 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/839 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index c22ab410..cefb75e5 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module code.forgejo.org/forgejo/runner/v9 -go 1.23.0 +go 1.24.0 toolchain go1.24.6 From 0520ff4e05f2c4d21888fbc5afbff347ce096f17 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 11 Aug 2025 13:21:42 +0000 Subject: [PATCH 065/281] chore: use t.Context for tests, activate usetesting for lint + add t.TempDir and t.Chdir (#844) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/844): chore: use t.Context for tests, activate usetesting for lint + add t.TempDir and t.Chdir [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/844 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .golangci.yml | 1 + act/common/executor_test.go | 6 +- act/common/git/git_test.go | 24 +++---- act/container/docker_images_test.go | 5 +- act/container/docker_pull_test.go | 5 +- act/container/docker_run_test.go | 16 ++--- act/container/host_environment_test.go | 17 ++--- ...x_container_environment_extensions_test.go | 9 +-- act/filecollector/file_collector_test.go | 5 +- act/model/github_context_test.go | 6 +- act/runner/action_cache_test.go | 3 +- act/runner/action_test.go | 4 +- act/runner/command_test.go | 17 +++-- act/runner/expression_test.go | 17 +++-- act/runner/job_executor_test.go | 4 +- act/runner/run_context_test.go | 64 +++++++++---------- act/runner/runner_test.go | 26 ++++---- act/runner/step_action_local_test.go | 4 +- act/runner/step_action_remote_test.go | 8 +-- act/runner/step_docker_test.go | 4 +- act/runner/step_run_test.go | 4 +- act/runner/step_test.go | 30 ++++----- 22 files changed, 126 insertions(+), 153 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 2ccb77a5..e3dee875 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -16,6 +16,7 @@ linters: - staticcheck - unconvert - unused + - usetesting - wastedassign settings: depguard: diff --git a/act/common/executor_test.go b/act/common/executor_test.go index e70c638e..75dca49f 100644 --- a/act/common/executor_test.go +++ b/act/common/executor_test.go @@ -12,7 +12,7 @@ import ( func TestNewWorkflow(t *testing.T) { assert := assert.New(t) - ctx := context.Background() + ctx := t.Context() // empty emptyWorkflow := NewPipelineExecutor() @@ -40,7 +40,7 @@ func TestNewWorkflow(t *testing.T) { func TestNewConditionalExecutor(t *testing.T) { assert := assert.New(t) - ctx := context.Background() + ctx := t.Context() trueCount := 0 falseCount := 0 @@ -77,7 +77,7 @@ func TestNewConditionalExecutor(t *testing.T) { func TestNewParallelExecutor(t *testing.T) { assert := assert.New(t) - ctx := context.Background() + ctx := t.Context() count := 0 activeCount := 0 diff --git a/act/common/git/git_test.go b/act/common/git/git_test.go index f03720e9..640c033f 100644 --- a/act/common/git/git_test.go +++ b/act/common/git/git_test.go @@ -1,7 +1,6 @@ package git import ( - "context" "fmt" "os" "os/exec" @@ -54,13 +53,6 @@ func TestFindGitSlug(t *testing.T) { } } -func testDir(t *testing.T) string { - basedir, err := os.MkdirTemp("", "act-test") - require.NoError(t, err) - t.Cleanup(func() { _ = os.RemoveAll(basedir) }) - return basedir -} - func cleanGitHooks(dir string) error { hooksDir := filepath.Join(dir, ".git", "hooks") files, err := os.ReadDir(hooksDir) @@ -85,7 +77,7 @@ func cleanGitHooks(dir string) error { func TestFindGitRemoteURL(t *testing.T) { assert := assert.New(t) - basedir := testDir(t) + basedir := t.TempDir() gitConfig() err := gitCmd("init", basedir) assert.NoError(err) @@ -96,20 +88,20 @@ func TestFindGitRemoteURL(t *testing.T) { err = gitCmd("-C", basedir, "remote", "add", "origin", remoteURL) assert.NoError(err) - u, err := findGitRemoteURL(context.Background(), basedir, "origin") + u, err := findGitRemoteURL(t.Context(), basedir, "origin") assert.NoError(err) assert.Equal(remoteURL, u) remoteURL = "git@github.com/AwesomeOwner/MyAwesomeRepo.git" err = gitCmd("-C", basedir, "remote", "add", "upstream", remoteURL) assert.NoError(err) - u, err = findGitRemoteURL(context.Background(), basedir, "upstream") + u, err = findGitRemoteURL(t.Context(), basedir, "upstream") assert.NoError(err) assert.Equal(remoteURL, u) } func TestGitFindRef(t *testing.T) { - basedir := testDir(t) + basedir := t.TempDir() gitConfig() for name, tt := range map[string]struct { @@ -184,7 +176,7 @@ func TestGitFindRef(t *testing.T) { require.NoError(t, gitCmd("-C", dir, "config", "user.email", "user@example.com")) require.NoError(t, cleanGitHooks(dir)) tt.Prepare(t, dir) - ref, err := FindGitRef(context.Background(), dir) + ref, err := FindGitRef(t.Context(), dir) tt.Assert(t, ref, err) }) } @@ -220,10 +212,10 @@ func TestGitCloneExecutor(t *testing.T) { clone := NewGitCloneExecutor(NewGitCloneExecutorInput{ URL: tt.URL, Ref: tt.Ref, - Dir: testDir(t), + Dir: t.TempDir(), }) - err := clone(context.Background()) + err := clone(t.Context()) if tt.Err != nil { assert.Error(t, err) assert.Equal(t, tt.Err, err) @@ -263,7 +255,7 @@ func gitCmd(args ...string) error { func TestCloneIfRequired(t *testing.T) { tempDir := t.TempDir() - ctx := context.Background() + ctx := t.Context() t.Run("clone", func(t *testing.T) { repo, err := CloneIfRequired(ctx, "refs/heads/main", NewGitCloneExecutorInput{ diff --git a/act/container/docker_images_test.go b/act/container/docker_images_test.go index 3344120d..a7b9babb 100644 --- a/act/container/docker_images_test.go +++ b/act/container/docker_images_test.go @@ -1,7 +1,6 @@ package container import ( - "context" "io" "testing" @@ -19,7 +18,7 @@ func TestImageExistsLocally(t *testing.T) { if testing.Short() { t.Skip("skipping integration test") } - ctx := context.Background() + ctx := t.Context() // to help make this test reliable and not flaky, we need to have // an image that will exist, and onew that won't exist @@ -36,7 +35,7 @@ func TestImageExistsLocally(t *testing.T) { // pull an image cli, err := client.NewClientWithOpts(client.FromEnv) assert.Nil(t, err) - cli.NegotiateAPIVersion(context.Background()) + cli.NegotiateAPIVersion(t.Context()) // Chose alpine latest because it's so small // maybe we should build an image instead so that tests aren't reliable on dockerhub diff --git a/act/container/docker_pull_test.go b/act/container/docker_pull_test.go index bfbe89dd..c0ff1d6f 100644 --- a/act/container/docker_pull_test.go +++ b/act/container/docker_pull_test.go @@ -1,7 +1,6 @@ package container import ( - "context" "testing" "github.com/docker/cli/cli/config" @@ -29,13 +28,13 @@ func TestCleanImage(t *testing.T) { } for _, table := range tables { - imageOut := cleanImage(context.Background(), table.imageIn) + imageOut := cleanImage(t.Context(), table.imageIn) assert.Equal(t, table.imageOut, imageOut) } } func TestGetImagePullOptions(t *testing.T) { - ctx := context.Background() + ctx := t.Context() config.SetDir("/non-existent/docker") diff --git a/act/container/docker_run_test.go b/act/container/docker_run_test.go index 91c579fe..1e93a9f2 100644 --- a/act/container/docker_run_test.go +++ b/act/container/docker_run_test.go @@ -26,7 +26,7 @@ func TestDocker(t *testing.T) { if testing.Short() { t.Skip("skipping integration test") } - ctx := context.Background() + ctx := t.Context() client, err := GetDockerClient(ctx) assert.NoError(t, err) defer client.Close() @@ -152,7 +152,7 @@ func TestDockerExecAbort(t *testing.T) { } func TestDockerExecFailure(t *testing.T) { - ctx := context.Background() + ctx := t.Context() conn := &mockConn{} @@ -183,7 +183,7 @@ func TestDockerExecFailure(t *testing.T) { } func TestDockerCopyTarStream(t *testing.T) { - ctx := context.Background() + ctx := t.Context() conn := &mockConn{} @@ -205,7 +205,7 @@ func TestDockerCopyTarStream(t *testing.T) { } func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) { - ctx := context.Background() + ctx := t.Context() conn := &mockConn{} @@ -230,7 +230,7 @@ func TestDockerCopyTarStreamErrorInCopyFiles(t *testing.T) { } func TestDockerCopyTarStreamErrorInMkdir(t *testing.T) { - ctx := context.Background() + ctx := t.Context() conn := &mockConn{} @@ -318,7 +318,7 @@ func TestCheckVolumes(t *testing.T) { for _, tc := range testCases { t.Run(tc.desc, func(t *testing.T) { logger, _ := test.NewNullLogger() - ctx := common.WithLogger(context.Background(), logger) + ctx := common.WithLogger(t.Context(), logger) cr := &containerReference{ input: &NewContainerInput{ ValidVolumes: tc.validVolumes, @@ -379,7 +379,7 @@ func TestMergeJobOptions(t *testing.T) { JobOptions: testCase.options, }, } - config, hostConfig, err := cr.mergeJobOptions(context.Background(), &container.Config{}, &container.HostConfig{}) + config, hostConfig, err := cr.mergeJobOptions(t.Context(), &container.Config{}, &container.HostConfig{}) require.NoError(t, err) assert.EqualValues(t, testCase.config, config) assert.EqualValues(t, testCase.hostConfig, hostConfig) @@ -394,7 +394,7 @@ func TestDockerRun_isHealthy(t *testing.T) { NetworkAliases: []string{"servicename"}, }, } - ctx := context.Background() + ctx := t.Context() makeInspectResponse := func(interval time.Duration, status container.HealthStatus, test []string) container.InspectResponse { return container.InspectResponse{ Config: &container.Config{ diff --git a/act/container/host_environment_test.go b/act/container/host_environment_test.go index 85456288..6efb8560 100644 --- a/act/container/host_environment_test.go +++ b/act/container/host_environment_test.go @@ -2,7 +2,6 @@ package container import ( "archive/tar" - "context" "io" "os" "path" @@ -16,10 +15,8 @@ import ( var _ ExecutionsEnvironment = &HostEnvironment{} func TestCopyDir(t *testing.T) { - dir, err := os.MkdirTemp("", "test-host-env-*") - assert.NoError(t, err) - defer os.RemoveAll(dir) - ctx := context.Background() + dir := t.TempDir() + ctx := t.Context() e := &HostEnvironment{ Path: filepath.Join(dir, "path"), TmpDir: filepath.Join(dir, "tmp"), @@ -32,15 +29,13 @@ func TestCopyDir(t *testing.T) { _ = os.MkdirAll(e.TmpDir, 0o700) _ = os.MkdirAll(e.ToolCache, 0o700) _ = os.MkdirAll(e.ActPath, 0o700) - err = e.CopyDir(e.Workdir, e.Path, true)(ctx) + err := e.CopyDir(e.Workdir, e.Path, true)(ctx) assert.NoError(t, err) } func TestGetContainerArchive(t *testing.T) { - dir, err := os.MkdirTemp("", "test-host-env-*") - assert.NoError(t, err) - defer os.RemoveAll(dir) - ctx := context.Background() + dir := t.TempDir() + ctx := t.Context() e := &HostEnvironment{ Path: filepath.Join(dir, "path"), TmpDir: filepath.Join(dir, "tmp"), @@ -54,7 +49,7 @@ func TestGetContainerArchive(t *testing.T) { _ = os.MkdirAll(e.ToolCache, 0o700) _ = os.MkdirAll(e.ActPath, 0o700) expectedContent := []byte("sdde/7sh") - err = os.WriteFile(filepath.Join(e.Path, "action.yml"), expectedContent, 0o600) + err := os.WriteFile(filepath.Join(e.Path, "action.yml"), expectedContent, 0o600) assert.NoError(t, err) archive, err := e.GetContainerArchive(ctx, e.Path) assert.NoError(t, err) diff --git a/act/container/linux_container_environment_extensions_test.go b/act/container/linux_container_environment_extensions_test.go index 38111714..32034874 100644 --- a/act/container/linux_container_environment_extensions_test.go +++ b/act/container/linux_container_environment_extensions_test.go @@ -35,18 +35,13 @@ func TestContainerPath(t *testing.T) { {fmt.Sprintf("/mnt/%v/act", rootDriveLetter), "act", fmt.Sprintf("%s\\", rootDrive)}, } { if v.workDir != "" { - if err := os.Chdir(v.workDir); err != nil { - log.Error(err) - t.Fail() - } + t.Chdir(v.workDir) } assert.Equal(t, v.destinationPath, linuxcontainerext.ToContainerPath(v.sourcePath)) } - if err := os.Chdir(cwd); err != nil { - log.Error(err) - } + t.Chdir(cwd) } else { cwd, err := os.Getwd() if err != nil { diff --git a/act/filecollector/file_collector_test.go b/act/filecollector/file_collector_test.go index 45ec6594..ec5871e1 100644 --- a/act/filecollector/file_collector_test.go +++ b/act/filecollector/file_collector_test.go @@ -2,7 +2,6 @@ package filecollector import ( "archive/tar" - "context" "io" "path/filepath" "strings" @@ -104,7 +103,7 @@ func TestIgnoredTrackedfile(t *testing.T) { TarWriter: tw, }, } - err := fc.Fs.Walk("mygitrepo", fc.CollectFiles(context.Background(), []string{})) + err := fc.Fs.Walk("mygitrepo", fc.CollectFiles(t.Context(), []string{})) assert.NoError(t, err, "successfully collect files") tw.Close() _, _ = tmpTar.Seek(0, io.SeekStart) @@ -153,7 +152,7 @@ func TestSymlinks(t *testing.T) { TarWriter: tw, }, } - err = fc.Fs.Walk("mygitrepo", fc.CollectFiles(context.Background(), []string{})) + err = fc.Fs.Walk("mygitrepo", fc.CollectFiles(t.Context(), []string{})) assert.NoError(t, err, "successfully collect files") tw.Close() _, _ = tmpTar.Seek(0, io.SeekStart) diff --git a/act/model/github_context_test.go b/act/model/github_context_test.go index ed08e231..8e7ea487 100644 --- a/act/model/github_context_test.go +++ b/act/model/github_context_test.go @@ -99,7 +99,7 @@ func TestSetRef(t *testing.T) { Event: table.event, } - ghc.SetRef(context.Background(), "main", "/some/dir") + ghc.SetRef(t.Context(), "main", "/some/dir") ghc.SetRefTypeAndName() assert.Equal(t, table.ref, ghc.Ref) @@ -117,7 +117,7 @@ func TestSetRef(t *testing.T) { Event: map[string]interface{}{}, } - ghc.SetRef(context.Background(), "", "/some/dir") + ghc.SetRef(t.Context(), "", "/some/dir") assert.Equal(t, "refs/heads/master", ghc.Ref) }) @@ -204,7 +204,7 @@ func TestSetSha(t *testing.T) { Event: table.event, } - ghc.SetSha(context.Background(), "/some/dir") + ghc.SetSha(t.Context(), "/some/dir") assert.Equal(t, table.sha, ghc.Sha) }) diff --git a/act/runner/action_cache_test.go b/act/runner/action_cache_test.go index 286336e9..765eef0d 100644 --- a/act/runner/action_cache_test.go +++ b/act/runner/action_cache_test.go @@ -3,7 +3,6 @@ package runner import ( "archive/tar" "bytes" - "context" "io" "os" "testing" @@ -17,7 +16,7 @@ func TestActionCache(t *testing.T) { cache := &GoGitActionCache{ Path: os.TempDir(), } - ctx := context.Background() + ctx := t.Context() cacheDir := "nektos/act-test-actions" repo := "https://code.forgejo.org/forgejo/act-test-actions" refs := []struct { diff --git a/act/runner/action_test.go b/act/runner/action_test.go index a5d9e1d7..3e1bc27f 100644 --- a/act/runner/action_test.go +++ b/act/runner/action_test.go @@ -130,7 +130,7 @@ runs: closerMock.On("Close") } - action, err := readActionImpl(context.Background(), tt.step, "actionDir", "actionPath", readFile, writeFile) + action, err := readActionImpl(t.Context(), tt.step, "actionDir", "actionPath", readFile, writeFile) assert.Nil(t, err) assert.Equal(t, tt.expected, action) @@ -222,7 +222,7 @@ func TestActionRunner(t *testing.T) { for _, tt := range table { t.Run(tt.name, func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() cm := &containerMock{} cm.On("CopyDir", "/var/run/act/actions/dir/", "dir/", false).Return(func(ctx context.Context) error { return nil }) diff --git a/act/runner/command_test.go b/act/runner/command_test.go index b2c3824a..75149b11 100644 --- a/act/runner/command_test.go +++ b/act/runner/command_test.go @@ -2,7 +2,6 @@ package runner import ( "bytes" - "context" "io" "os" "testing" @@ -16,7 +15,7 @@ import ( func TestCommandSetEnv(t *testing.T) { a := assert.New(t) - ctx := context.Background() + ctx := t.Context() rc := new(RunContext) handler := rc.commandHandler(ctx) @@ -26,7 +25,7 @@ func TestCommandSetEnv(t *testing.T) { func TestCommandSetOutput(t *testing.T) { a := assert.New(t) - ctx := context.Background() + ctx := t.Context() rc := new(RunContext) rc.StepResults = make(map[string]*model.StepResult) handler := rc.commandHandler(ctx) @@ -56,7 +55,7 @@ func TestCommandSetOutput(t *testing.T) { func TestCommandAddpath(t *testing.T) { a := assert.New(t) - ctx := context.Background() + ctx := t.Context() rc := new(RunContext) handler := rc.commandHandler(ctx) @@ -71,7 +70,7 @@ func TestCommandStopCommands(t *testing.T) { logger, hook := test.NewNullLogger() a := assert.New(t) - ctx := common.WithLogger(context.Background(), logger) + ctx := common.WithLogger(t.Context(), logger) rc := new(RunContext) handler := rc.commandHandler(ctx) @@ -94,7 +93,7 @@ func TestCommandStopCommands(t *testing.T) { func TestCommandAddpathADO(t *testing.T) { a := assert.New(t) - ctx := context.Background() + ctx := t.Context() rc := new(RunContext) handler := rc.commandHandler(ctx) @@ -109,7 +108,7 @@ func TestCommandAddmask(t *testing.T) { logger, hook := test.NewNullLogger() a := assert.New(t) - ctx := context.Background() + ctx := t.Context() loggerCtx := common.WithLogger(ctx, logger) rc := new(RunContext) @@ -163,7 +162,7 @@ func TestCommandAddmaskUsemask(t *testing.T) { } re := captureOutput(t, func() { - ctx := context.Background() + ctx := t.Context() ctx = WithJobLogger(ctx, "0", "testjob", config, &rc.Masks, map[string]interface{}{}) handler := rc.commandHandler(ctx) @@ -180,7 +179,7 @@ func TestCommandSaveState(t *testing.T) { StepResults: map[string]*model.StepResult{}, } - ctx := context.Background() + ctx := t.Context() handler := rc.commandHandler(ctx) handler("::save-state name=state-name::state-value\n") diff --git a/act/runner/expression_test.go b/act/runner/expression_test.go index 3bebc301..8beea50e 100644 --- a/act/runner/expression_test.go +++ b/act/runner/expression_test.go @@ -1,7 +1,6 @@ package runner import ( - "context" "testing" "code.forgejo.org/forgejo/runner/v9/act/exprparser" @@ -76,7 +75,7 @@ func createRunContext(t *testing.T) *RunContext { func TestExpressionEvaluateRunContext(t *testing.T) { rc := createRunContext(t) - ee := rc.NewExpressionEvaluator(context.Background()) + ee := rc.NewExpressionEvaluator(t.Context()) tables := []struct { in string @@ -137,7 +136,7 @@ func TestExpressionEvaluateRunContext(t *testing.T) { table := table t.Run(table.in, func(t *testing.T) { assertObject := assert.New(t) - out, err := ee.evaluate(context.Background(), table.in, exprparser.DefaultStatusCheckNone) + out, err := ee.evaluate(t.Context(), table.in, exprparser.DefaultStatusCheckNone) if table.errMesg == "" { assertObject.NoError(err, table.in) assertObject.Equal(table.out, out, table.in) @@ -155,7 +154,7 @@ func TestExpressionEvaluateStep(t *testing.T) { RunContext: rc, } - ee := rc.NewStepExpressionEvaluator(context.Background(), step) + ee := rc.NewStepExpressionEvaluator(t.Context(), step) tables := []struct { in string @@ -177,7 +176,7 @@ func TestExpressionEvaluateStep(t *testing.T) { table := table t.Run(table.in, func(t *testing.T) { assertObject := assert.New(t) - out, err := ee.evaluate(context.Background(), table.in, exprparser.DefaultStatusCheckNone) + out, err := ee.evaluate(t.Context(), table.in, exprparser.DefaultStatusCheckNone) if table.errMesg == "" { assertObject.NoError(err, table.in) assertObject.Equal(table.out, out, table.in) @@ -217,7 +216,7 @@ func TestExpressionInterpolate(t *testing.T) { }, }, } - ee := rc.NewExpressionEvaluator(context.Background()) + ee := rc.NewExpressionEvaluator(t.Context()) tables := []struct { in string out string @@ -260,7 +259,7 @@ func TestExpressionInterpolate(t *testing.T) { table := table t.Run("interpolate", func(t *testing.T) { assertObject := assert.New(t) - out := ee.Interpolate(context.Background(), table.in) + out := ee.Interpolate(t.Context(), table.in) assertObject.Equal(table.out, out, table.in) }) } @@ -287,7 +286,7 @@ func TestExpressionRewriteSubExpression(t *testing.T) { for _, table := range table { t.Run("TestRewriteSubExpression", func(t *testing.T) { assertObject := assert.New(t) - out, err := rewriteSubExpression(context.Background(), table.in, false) + out, err := rewriteSubExpression(t.Context(), table.in, false) if err != nil { t.Fatal(err) } @@ -311,7 +310,7 @@ func TestExpressionRewriteSubExpressionForceFormat(t *testing.T) { for _, table := range table { t.Run("TestRewriteSubExpressionForceFormat", func(t *testing.T) { assertObject := assert.New(t) - out, err := rewriteSubExpression(context.Background(), table.in, true) + out, err := rewriteSubExpression(t.Context(), table.in, true) if err != nil { t.Fatal(err) } diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index f5c6e110..5e113d83 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -26,7 +26,7 @@ func TestJobExecutor(t *testing.T) { {workdir, "job-nil-step", "push", "invalid Step 0: missing run or uses key", platforms, secrets}, } // These tests are sufficient to only check syntax. - ctx := common.WithDryrun(context.Background(), true) + ctx := common.WithDryrun(t.Context(), true) for _, table := range tables { t.Run(table.workflowPath, func(t *testing.T) { table.runTest(ctx, t, &Config{}) @@ -244,7 +244,7 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { t.Run(tt.name, func(t *testing.T) { fmt.Printf("::group::%s\n", tt.name) - ctx := common.WithJobErrorContainer(context.Background()) + ctx := common.WithJobErrorContainer(t.Context()) jim := &jobInfoMock{} sfm := &stepFactoryMock{} rc := &RunContext{ diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 0fa41307..52dc86f8 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -69,7 +69,7 @@ func TestRunContext_EvalBool(t *testing.T) { }, }, } - rc.ExprEval = rc.NewExpressionEvaluator(context.Background()) + rc.ExprEval = rc.NewExpressionEvaluator(t.Context()) tables := []struct { in string @@ -163,7 +163,7 @@ func TestRunContext_EvalBool(t *testing.T) { table := table t.Run(table.in, func(t *testing.T) { assertObject := assert.New(t) - b, err := EvalBool(context.Background(), rc.ExprEval, table.in, exprparser.DefaultStatusCheckSuccess) + b, err := EvalBool(t.Context(), rc.ExprEval, table.in, exprparser.DefaultStatusCheckSuccess) if table.wantErr { assertObject.Error(err) } @@ -312,7 +312,7 @@ func TestRunContext_GetGitHubContext(t *testing.T) { } rc.Run.JobID = "job1" - ghc := rc.getGithubContext(context.Background()) + ghc := rc.getGithubContext(t.Context()) log.Debugf("%v", ghc) @@ -378,7 +378,7 @@ func TestRunContext_GetGithubContextRef(t *testing.T) { }, } - ghc := rc.getGithubContext(context.Background()) + ghc := rc.getGithubContext(t.Context()) assert.Equal(t, data.ref, ghc.Ref) }) @@ -423,44 +423,44 @@ func TestRunContext_RunsOnPlatformNames(t *testing.T) { rc := createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, ""), }) - assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ${{ 'ubuntu-latest' }}`, ""), }) - assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: [self-hosted, my-runner]`, ""), }) - assertObject.Equal([]string{"self-hosted", "my-runner"}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{"self-hosted", "my-runner"}, rc.runsOnPlatformNames(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: [self-hosted, "${{ 'my-runner' }}"]`, ""), }) - assertObject.Equal([]string{"self-hosted", "my-runner"}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{"self-hosted", "my-runner"}, rc.runsOnPlatformNames(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ${{ fromJSON('["ubuntu-latest"]') }}`, ""), }) - assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(t.Context())) // test missing / invalid runs-on rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `name: something`, ""), }) - assertObject.Equal([]string{}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{}, rc.runsOnPlatformNames(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: mapping: value`, ""), }) - assertObject.Equal([]string{}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{}, rc.runsOnPlatformNames(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ${{ invalid expression }}`, ""), }) - assertObject.Equal([]string{}, rc.runsOnPlatformNames(context.Background())) + assertObject.Equal([]string{}, rc.runsOnPlatformNames(t.Context())) } func TestRunContext_IsEnabled(t *testing.T) { @@ -472,7 +472,7 @@ func TestRunContext_IsEnabled(t *testing.T) { "job1": createJob(t, `runs-on: ubuntu-latest if: success()`, ""), }) - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "failure"), @@ -481,7 +481,7 @@ needs: [job1] if: success()`, ""), }) rc.Run.JobID = "job2" - assertObject.False(rc.isEnabled(context.Background())) + assertObject.False(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "success"), @@ -490,7 +490,7 @@ needs: [job1] if: success()`, ""), }) rc.Run.JobID = "job2" - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "failure"), @@ -498,14 +498,14 @@ if: success()`, ""), if: success()`, ""), }) rc.Run.JobID = "job2" - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) // failure() rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest if: failure()`, ""), }) - assertObject.False(rc.isEnabled(context.Background())) + assertObject.False(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "failure"), @@ -514,7 +514,7 @@ needs: [job1] if: failure()`, ""), }) rc.Run.JobID = "job2" - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "success"), @@ -523,7 +523,7 @@ needs: [job1] if: failure()`, ""), }) rc.Run.JobID = "job2" - assertObject.False(rc.isEnabled(context.Background())) + assertObject.False(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "failure"), @@ -531,14 +531,14 @@ if: failure()`, ""), if: failure()`, ""), }) rc.Run.JobID = "job2" - assertObject.False(rc.isEnabled(context.Background())) + assertObject.False(rc.isEnabled(t.Context())) // always() rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest if: always()`, ""), }) - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "failure"), @@ -547,7 +547,7 @@ needs: [job1] if: always()`, ""), }) rc.Run.JobID = "job2" - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "success"), @@ -556,7 +556,7 @@ needs: [job1] if: always()`, ""), }) rc.Run.JobID = "job2" - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `runs-on: ubuntu-latest`, "success"), @@ -564,18 +564,18 @@ if: always()`, ""), if: always()`, ""), }) rc.Run.JobID = "job2" - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `uses: ./.github/workflows/reusable.yml`, ""), }) - assertObject.True(rc.isEnabled(context.Background())) + assertObject.True(rc.isEnabled(t.Context())) rc = createIfTestRunContext(map[string]*model.Job{ "job1": createJob(t, `uses: ./.github/workflows/reusable.yml if: false`, ""), }) - assertObject.False(rc.isEnabled(context.Background())) + assertObject.False(rc.isEnabled(t.Context())) } func TestRunContext_GetEnv(t *testing.T) { @@ -652,10 +652,10 @@ func TestRunContext_CreateSimpleContainerName(t *testing.T) { func TestRunContext_SanitizeNetworkAlias(t *testing.T) { same := "same" - assert.Equal(t, same, sanitizeNetworkAlias(context.Background(), same)) + assert.Equal(t, same, sanitizeNetworkAlias(t.Context(), same)) original := "or.igin'A-L" sanitized := "or_igin_a-l" - assert.Equal(t, sanitized, sanitizeNetworkAlias(context.Background(), original)) + assert.Equal(t, sanitized, sanitizeNetworkAlias(t.Context(), original)) } func TestRunContext_PrepareJobContainer(t *testing.T) { @@ -815,7 +815,7 @@ jobs: return newContainer(input) })() - ctx := context.Background() + ctx := t.Context() rc := testCase.step.getRunContext() rc.ExprEval = rc.NewExpressionEvaluator(ctx) @@ -842,7 +842,7 @@ func (o *waitForServiceContainerMock) IsHealthy(ctx context.Context) (time.Durat func Test_waitForServiceContainer(t *testing.T) { t.Run("Wait", func(t *testing.T) { m := &waitForServiceContainerMock{} - ctx := context.Background() + ctx := t.Context() mock.InOrder( m.On("IsHealthy", ctx).Return(1*time.Millisecond, nil).Once(), m.On("IsHealthy", ctx).Return(time.Duration(0), nil).Once(), @@ -853,7 +853,7 @@ func Test_waitForServiceContainer(t *testing.T) { t.Run("Cancel", func(t *testing.T) { m := &waitForServiceContainerMock{} - ctx, cancel := context.WithCancel(context.Background()) + ctx, cancel := context.WithCancel(t.Context()) cancel() m.On("IsHealthy", ctx).Return(1*time.Millisecond, nil).Once() require.NoError(t, waitForServiceContainer(ctx, m)) @@ -862,7 +862,7 @@ func Test_waitForServiceContainer(t *testing.T) { t.Run("Error", func(t *testing.T) { m := &waitForServiceContainerMock{} - ctx := context.Background() + ctx := t.Context() m.On("IsHealthy", ctx).Return(time.Duration(0), errors.New("ERROR")) require.ErrorContains(t, waitForServiceContainer(ctx, m), "ERROR") m.AssertExpectations(t) diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index f930d68d..3811811b 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -229,8 +229,7 @@ func TestRunner_RunEvent(t *testing.T) { t.Skip("skipping integration test") } - ctx, cancel := context.WithCancel(context.Background()) - defer cancel() + ctx := t.Context() tables := []TestJobFileInfo{ // Shells @@ -370,8 +369,7 @@ func TestRunner_DryrunEvent(t *testing.T) { t.Skip("skipping integration test") } - ctx, cancel := context.WithCancel(common.WithDryrun(context.Background(), true)) - defer cancel() + ctx := common.WithDryrun(t.Context(), true) tables := []TestJobFileInfo{ // Shells @@ -400,8 +398,7 @@ func TestRunner_DockerActionForcePullForceRebuild(t *testing.T) { t.Skip("skipping integration test") } - ctx, cancel := context.WithCancel(context.Background()) - defer cancel() + ctx := t.Context() config := &Config{ ForcePull: true, @@ -434,7 +431,7 @@ func TestRunner_RunDifferentArchitecture(t *testing.T) { platforms: platforms, } - tjfi.runTest(context.Background(), t, &Config{ContainerArchitecture: "linux/arm64"}) + tjfi.runTest(t.Context(), t, &Config{ContainerArchitecture: "linux/arm64"}) } type runSkippedHook struct { @@ -469,7 +466,7 @@ func TestRunner_RunSkipped(t *testing.T) { } h := &runSkippedHook{resultKey: what + "Result"} - ctx := common.WithLoggerHook(context.Background(), h) + ctx := common.WithLoggerHook(t.Context(), h) jobLoggerLevel := log.InfoLevel tjfi.runTest(ctx, t, &Config{ContainerArchitecture: "linux/arm64", JobLoggerLevel: &jobLoggerLevel}) @@ -514,7 +511,7 @@ func TestRunner_MaskValues(t *testing.T) { } logger := &maskJobLoggerFactory{} - tjfi.runTest(WithJobLoggerFactory(common.WithLogger(context.Background(), logger.WithJobLogger()), logger), t, &Config{}) + tjfi.runTest(WithJobLoggerFactory(common.WithLogger(t.Context(), logger.WithJobLogger()), logger), t, &Config{}) output := logger.Output.String() assertNoSecret(output, "secret value") @@ -540,7 +537,7 @@ func TestRunner_RunEventSecrets(t *testing.T) { secrets, _ := godotenv.Read(filepath.Join(workdir, workflowPath, ".secrets")) assert.NoError(t, err, "Failed to read .secrets") - tjfi.runTest(context.Background(), t, &Config{Secrets: secrets, Env: env}) + tjfi.runTest(t.Context(), t, &Config{Secrets: secrets, Env: env}) } func TestRunner_RunWithService(t *testing.T) { @@ -549,8 +546,7 @@ func TestRunner_RunWithService(t *testing.T) { } log.SetLevel(log.DebugLevel) - ctx, cancel := context.WithCancel(context.Background()) - defer cancel() + ctx := t.Context() platforms := map[string]string{ "ubuntu-latest": "code.forgejo.org/oci/node:22", @@ -599,7 +595,7 @@ func TestRunner_RunActionInputs(t *testing.T) { "SOME_INPUT": "input", } - tjfi.runTest(context.Background(), t, &Config{Inputs: inputs}) + tjfi.runTest(t.Context(), t, &Config{Inputs: inputs}) } func TestRunner_RunEventPullRequest(t *testing.T) { @@ -617,7 +613,7 @@ func TestRunner_RunEventPullRequest(t *testing.T) { platforms: platforms, } - tjfi.runTest(context.Background(), t, &Config{EventPath: filepath.Join(workdir, workflowPath, "event.json")}) + tjfi.runTest(t.Context(), t, &Config{EventPath: filepath.Join(workdir, workflowPath, "event.json")}) } func TestRunner_RunMatrixWithUserDefinedInclusions(t *testing.T) { @@ -644,5 +640,5 @@ func TestRunner_RunMatrixWithUserDefinedInclusions(t *testing.T) { }, } - tjfi.runTest(context.Background(), t, &Config{Matrix: matrix}) + tjfi.runTest(t.Context(), t, &Config{Matrix: matrix}) } diff --git a/act/runner/step_action_local_test.go b/act/runner/step_action_local_test.go index 3af17d96..8bc5d50b 100644 --- a/act/runner/step_action_local_test.go +++ b/act/runner/step_action_local_test.go @@ -30,7 +30,7 @@ func (salm *stepActionLocalMocks) readAction(_ context.Context, step *model.Step } func TestStepActionLocalTest(t *testing.T) { - ctx := context.Background() + ctx := t.Context() cm := &containerMock{} salm := &stepActionLocalMocks{} @@ -231,7 +231,7 @@ func TestStepActionLocalPost(t *testing.T) { for _, tt := range table { t.Run(tt.name, func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() cm := &containerMock{} diff --git a/act/runner/step_action_remote_test.go b/act/runner/step_action_remote_test.go index 630c84b2..5287f380 100644 --- a/act/runner/step_action_remote_test.go +++ b/act/runner/step_action_remote_test.go @@ -118,7 +118,7 @@ func TestStepActionRemoteOK(t *testing.T) { for _, tt := range table { t.Run(tt.name, func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() cm := &containerMock{} sarm := &stepActionRemoteMocks{} @@ -214,7 +214,7 @@ func TestStepActionRemotePre(t *testing.T) { for _, tt := range table { t.Run(tt.name, func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() clonedAction := false sarm := &stepActionRemoteMocks{} @@ -275,7 +275,7 @@ func TestStepActionRemotePreThroughAction(t *testing.T) { for _, tt := range table { t.Run(tt.name, func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() clonedAction := false sarm := &stepActionRemoteMocks{} @@ -463,7 +463,7 @@ func TestStepActionRemotePost(t *testing.T) { for _, tt := range table { t.Run(tt.name, func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() cm := &containerMock{} diff --git a/act/runner/step_docker_test.go b/act/runner/step_docker_test.go index 6b6c11db..c4f2b94f 100644 --- a/act/runner/step_docker_test.go +++ b/act/runner/step_docker_test.go @@ -27,7 +27,7 @@ func TestStepDockerMain(t *testing.T) { ContainerNewContainer = origContainerNewContainer })() - ctx := context.Background() + ctx := t.Context() sd := &stepDocker{ RunContext: &RunContext{ @@ -105,7 +105,7 @@ func TestStepDockerMain(t *testing.T) { } func TestStepDockerPrePost(t *testing.T) { - ctx := context.Background() + ctx := t.Context() sd := &stepDocker{} err := sd.pre()(ctx) diff --git a/act/runner/step_run_test.go b/act/runner/step_run_test.go index 10e8bd19..b49e2405 100644 --- a/act/runner/step_run_test.go +++ b/act/runner/step_run_test.go @@ -72,7 +72,7 @@ func TestStepRun(t *testing.T) { return nil }) - ctx := context.Background() + ctx := t.Context() cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/SUMMARY.md").Return(io.NopCloser(&bytes.Buffer{}), nil) cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil) @@ -84,7 +84,7 @@ func TestStepRun(t *testing.T) { } func TestStepRunPrePost(t *testing.T) { - ctx := context.Background() + ctx := t.Context() sr := &stepRun{} err := sr.pre()(ctx) diff --git a/act/runner/step_test.go b/act/runner/step_test.go index b7bb31dd..b69c08aa 100644 --- a/act/runner/step_test.go +++ b/act/runner/step_test.go @@ -146,51 +146,51 @@ func TestStep_IsStepEnabled(t *testing.T) { // success() step := createTestStep(t, "if: success()") - assertObject.True(isStepEnabled(context.Background(), step.getIfExpression(context.Background(), stepStageMain), step, stepStageMain)) + assertObject.True(isStepEnabled(t.Context(), step.getIfExpression(t.Context(), stepStageMain), step, stepStageMain)) step = createTestStep(t, "if: success()") step.getRunContext().StepResults["a"] = &model.StepResult{ Conclusion: model.StepStatusSuccess, } - assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.True(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) step = createTestStep(t, "if: success()") step.getRunContext().StepResults["a"] = &model.StepResult{ Conclusion: model.StepStatusFailure, } - assertObject.False(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.False(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) // failure() step = createTestStep(t, "if: failure()") - assertObject.False(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.False(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) step = createTestStep(t, "if: failure()") step.getRunContext().StepResults["a"] = &model.StepResult{ Conclusion: model.StepStatusSuccess, } - assertObject.False(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.False(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) step = createTestStep(t, "if: failure()") step.getRunContext().StepResults["a"] = &model.StepResult{ Conclusion: model.StepStatusFailure, } - assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.True(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) // always() step = createTestStep(t, "if: always()") - assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.True(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) step = createTestStep(t, "if: always()") step.getRunContext().StepResults["a"] = &model.StepResult{ Conclusion: model.StepStatusSuccess, } - assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.True(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) step = createTestStep(t, "if: always()") step.getRunContext().StepResults["a"] = &model.StepResult{ Conclusion: model.StepStatusFailure, } - assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain)) + assertObject.True(isStepEnabled(t.Context(), step.getStepModel().If.Value, step, stepStageMain)) } func TestStep_IsContinueOnError(t *testing.T) { @@ -228,37 +228,37 @@ func TestStep_IsContinueOnError(t *testing.T) { // absent step := createTestStep(t, "name: test") - continueOnError, err := isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain) + continueOnError, err := isContinueOnError(t.Context(), step.getStepModel().RawContinueOnError, step, stepStageMain) assertObject.False(continueOnError) assertObject.Nil(err) // explicit true step = createTestStep(t, "continue-on-error: true") - continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain) + continueOnError, err = isContinueOnError(t.Context(), step.getStepModel().RawContinueOnError, step, stepStageMain) assertObject.True(continueOnError) assertObject.Nil(err) // explicit false step = createTestStep(t, "continue-on-error: false") - continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain) + continueOnError, err = isContinueOnError(t.Context(), step.getStepModel().RawContinueOnError, step, stepStageMain) assertObject.False(continueOnError) assertObject.Nil(err) // expression true step = createTestStep(t, "continue-on-error: ${{ 'test' == 'test' }}") - continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain) + continueOnError, err = isContinueOnError(t.Context(), step.getStepModel().RawContinueOnError, step, stepStageMain) assertObject.True(continueOnError) assertObject.Nil(err) // expression false step = createTestStep(t, "continue-on-error: ${{ 'test' != 'test' }}") - continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain) + continueOnError, err = isContinueOnError(t.Context(), step.getStepModel().RawContinueOnError, step, stepStageMain) assertObject.False(continueOnError) assertObject.Nil(err) // expression parse error step = createTestStep(t, "continue-on-error: ${{ 'test' != test }}") - continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain) + continueOnError, err = isContinueOnError(t.Context(), step.getStepModel().RawContinueOnError, step, stepStageMain) assertObject.False(continueOnError) assertObject.NotNil(err) } From e5603fe6d9549176f073aa087b64eefd4de0f1e8 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 11 Aug 2025 13:25:06 +0000 Subject: [PATCH 066/281] chore: integration tests can run for more than 10 minutes (#843) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/843): chore: integration tests can run for more than 10 minutes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/843 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/act.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/act.yml b/.forgejo/workflows/act.yml index 46175b3b..1a1b149b 100644 --- a/.forgejo/workflows/act.yml +++ b/.forgejo/workflows/act.yml @@ -77,4 +77,4 @@ jobs: - name: integration test run: | go test ./act/container - go test ./act/runner/... + go test -timeout 30m ./act/runner/... From e760d04aa6a6e21ae75a116eb0538aa056e1e2a5 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Mon, 11 Aug 2025 18:53:48 +0000 Subject: [PATCH 067/281] feat: support actions with 'using: node24' (#847) It's worth noting for users: the runner does not actually invoke different versions of node depending on the `using` tag -- it just defers to the `node` command in the path regardless of the tagged value. This change allows `node24` to be provided without error, the same level of support as node12...node20. FYI: This allows the use of `github.com/actions/checkout@v5`, which was released today and is marked `using: node24`. Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/847 Reviewed-by: Michael Kriese Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/model/action.go | 5 ++++- act/runner/action.go | 9 ++++++--- act/runner/testdata/actions/node24/action.yml | 5 +++++ act/runner/testdata/actions/node24/index.js | 3 +++ act/runner/testdata/local-action-js/push.yml | 1 + 5 files changed, 19 insertions(+), 4 deletions(-) create mode 100644 act/runner/testdata/actions/node24/action.yml create mode 100644 act/runner/testdata/actions/node24/index.js diff --git a/act/model/action.go b/act/model/action.go index 62b1d025..7616b66b 100644 --- a/act/model/action.go +++ b/act/model/action.go @@ -21,7 +21,7 @@ func (a *ActionRunsUsing) UnmarshalYAML(unmarshal func(interface{}) error) error // Force input to lowercase for case insensitive comparison format := ActionRunsUsing(strings.ToLower(using)) switch format { - case ActionRunsUsingNode20, ActionRunsUsingNode16, ActionRunsUsingNode12, ActionRunsUsingDocker, ActionRunsUsingComposite, ActionRunsUsingGo, ActionRunsUsingSh: + case ActionRunsUsingNode24, ActionRunsUsingNode20, ActionRunsUsingNode16, ActionRunsUsingNode12, ActionRunsUsingDocker, ActionRunsUsingComposite, ActionRunsUsingGo, ActionRunsUsingSh: *a = format default: return fmt.Errorf("The runs.using key in action.yml must be one of: %v, got %s", []string{ @@ -30,6 +30,7 @@ func (a *ActionRunsUsing) UnmarshalYAML(unmarshal func(interface{}) error) error ActionRunsUsingNode12, ActionRunsUsingNode16, ActionRunsUsingNode20, + ActionRunsUsingNode24, ActionRunsUsingGo, ActionRunsUsingSh, }, format) @@ -44,6 +45,8 @@ const ( ActionRunsUsingNode16 = "node16" // ActionRunsUsingNode20 for running with node20 ActionRunsUsingNode20 = "node20" + // ActionRunsUsingNode24 for running with node24 + ActionRunsUsingNode24 = "node24" // ActionRunsUsingDocker for running with docker ActionRunsUsingDocker = "docker" // ActionRunsUsingComposite for running composite diff --git a/act/runner/action.go b/act/runner/action.go index 93016f1d..6b27288e 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -182,7 +182,7 @@ func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction logger.Debugf("type=%v actionDir=%s actionPath=%s workdir=%s actionCacheDir=%s actionName=%s containerActionDir=%s", stepModel.Type(), actionDir, actionPath, rc.Config.Workdir, rc.ActionCacheDir(), actionName, containerActionDir) switch action.Runs.Using { - case model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20: + case model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20, model.ActionRunsUsingNode24: if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil { return err } @@ -237,6 +237,7 @@ func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20, + model.ActionRunsUsingNode24, model.ActionRunsUsingComposite, model.ActionRunsUsingGo, model.ActionRunsUsingSh, @@ -530,6 +531,7 @@ func hasPreStep(step actionStep) common.Conditional { ((action.Runs.Using == model.ActionRunsUsingNode12 || action.Runs.Using == model.ActionRunsUsingNode16 || action.Runs.Using == model.ActionRunsUsingNode20 || + action.Runs.Using == model.ActionRunsUsingNode24 || action.Runs.Using == model.ActionRunsUsingGo || action.Runs.Using == model.ActionRunsUsingSh) && action.Runs.Pre != "") @@ -546,7 +548,7 @@ func runPreStep(step actionStep) common.Executor { action := step.getActionModel() switch action.Runs.Using { - case model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20, model.ActionRunsUsingSh: + case model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20, model.ActionRunsUsingNode24, model.ActionRunsUsingSh: // defaults in pre steps were missing, however provided inputs are available populateEnvsFromInput(ctx, step.getEnv(), action, rc) // todo: refactor into step @@ -672,6 +674,7 @@ func hasPostStep(step actionStep) common.Conditional { ((action.Runs.Using == model.ActionRunsUsingNode12 || action.Runs.Using == model.ActionRunsUsingNode16 || action.Runs.Using == model.ActionRunsUsingNode20 || + action.Runs.Using == model.ActionRunsUsingNode24 || action.Runs.Using == model.ActionRunsUsingGo || action.Runs.Using == model.ActionRunsUsingSh) && action.Runs.Post != "") @@ -708,7 +711,7 @@ func runPostStep(step actionStep) common.Executor { _, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc) switch action.Runs.Using { - case model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20: + case model.ActionRunsUsingNode12, model.ActionRunsUsingNode16, model.ActionRunsUsingNode20, model.ActionRunsUsingNode24: populateEnvsFromSavedState(step.getEnv(), step, rc) populateEnvsFromInput(ctx, step.getEnv(), step.getActionModel(), rc) diff --git a/act/runner/testdata/actions/node24/action.yml b/act/runner/testdata/actions/node24/action.yml new file mode 100644 index 00000000..0f83974a --- /dev/null +++ b/act/runner/testdata/actions/node24/action.yml @@ -0,0 +1,5 @@ +name: 'using node24 action' +description: 'An action that has using:node24' +runs: + using: 'node24' + main: 'index.js' diff --git a/act/runner/testdata/actions/node24/index.js b/act/runner/testdata/actions/node24/index.js new file mode 100644 index 00000000..679a6f70 --- /dev/null +++ b/act/runner/testdata/actions/node24/index.js @@ -0,0 +1,3 @@ +// Note that the runner does not actually invoke different versions of node depending on the `using` tag, so this output +// isn't checked/asserted to ensure that the right version is in-use. It might as well be an empty script. +console.log('Current node.js version:', process.versions.node); diff --git a/act/runner/testdata/local-action-js/push.yml b/act/runner/testdata/local-action-js/push.yml index f97cf2ec..70638568 100644 --- a/act/runner/testdata/local-action-js/push.yml +++ b/act/runner/testdata/local-action-js/push.yml @@ -10,3 +10,4 @@ jobs: - uses: ./actions/node20 with: who-to-greet: 'Mona the Octocat' + - uses: ./actions/node24 From 0f27403e36ec0d5e1ef97b4f35f397d60cde23e9 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 11 Aug 2025 18:54:09 +0000 Subject: [PATCH 068/281] chore(tests): differentiate 'failed to copy content' errors (#846) ``` 2025-08-11T13:02:51.0737198Z --- FAIL: TestRunner_RunEvent (431.14s) 2025-08-11T13:02:51.0737236Z --- FAIL: TestRunner_RunEvent/evalmatrix (2.69s) 2025-08-11T13:02:51.0737270Z runner_test.go:211: 2025-08-11T13:02:51.0737303Z Error Trace: /home/debian/.cache/act/1682da88a8a84081/hostexecutor/act/runner/runner_test.go:211 2025-08-11T13:02:51.0737398Z /home/debian/.cache/act/1682da88a8a84081/hostexecutor/act/runner/runner_test.go:362 2025-08-11T13:02:51.0737436Z Error: Received unexpected error: 2025-08-11T13:02:51.0737470Z failed to copy content to container: Error response from daemon: Could not find the file /var/run/act/ in container ab61dffc6010bc922c0ab2d2c7edb7a7fe066258ce0145d4146771ce6afbc8f9 2025-08-11T13:02:51.0737507Z Test: TestRunner_RunEvent/evalmatrix 2025-08-11T13:02:51.0737551Z Messages: /home/debian/.cache/act/1682da88a8a84081/hostexecutor/act/runner/testdata/evalmatrix ``` ``` 2025-08-11T13:12:06.9179188Z --- FAIL: TestRunner_RunEvent (343.90s) 2025-08-11T13:12:06.9179215Z --- FAIL: TestRunner_RunEvent/strategy (7.71s) 2025-08-11T13:12:06.9179241Z runner_test.go:211: 2025-08-11T13:12:06.9179269Z Error Trace: /home/debian/.cache/act/5a78e5e8c5cb3275/hostexecutor/act/runner/runner_test.go:211 2025-08-11T13:12:06.9179296Z /home/debian/.cache/act/5a78e5e8c5cb3275/hostexecutor/act/runner/runner_test.go:362 2025-08-11T13:12:06.9179325Z Error: Received unexpected error: 2025-08-11T13:12:06.9179352Z failed to copy content to container: Error response from daemon: Could not find the file /var/run/act/ in container 0bee24fbd0b16843147b45915d25aa7bb32c09d68bfdff81cc73bf7278d1c72d 2025-08-11T13:12:06.9179381Z Test: TestRunner_RunEvent/strategy 2025-08-11T13:12:06.9179407Z Messages: /home/debian/.cache/act/5a78e5e8c5cb3275/hostexecutor/act/model/testdata/strategy ``` ``` 2025-08-11T13:34:24.7442134Z --- FAIL: TestRunner_RunEvent (369.80s) 2025-08-11T13:34:24.7442158Z --- FAIL: TestRunner_RunEvent/no-panic-on-invalid-composite-action (3.04s) 2025-08-11T13:34:24.7442185Z runner_test.go:214: 2025-08-11T13:34:24.7442209Z Error Trace: /home/debian/.cache/act/690f62172f9b2595/hostexecutor/act/runner/runner_test.go:214 2025-08-11T13:34:24.7442235Z /home/debian/.cache/act/690f62172f9b2595/hostexecutor/act/runner/runner_test.go:362 2025-08-11T13:34:24.7442262Z Error: Error "failed to copy content to container: Error response from daemon: Could not find the file /var/run/act/ in container 6441c18fec5b0e3a172672a243e599b628f7729ecaeb543fa3bd2cd02af146e1" does not contain "missing steps in composite action" 2025-08-11T13:34:24.7442295Z Test: TestRunner_RunEvent/no-panic-on-invalid-composite-action ``` In the absence of a stack trace, having three different places in the sources where the same error message shows does not help to figure out how it can happen. This is a daily false negative. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/846): chore(tests): differentiate 'failed to copy content' errors Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/846 Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/docker_run.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/act/container/docker_run.go b/act/container/docker_run.go index ac52cee5..b64703c0 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -835,7 +835,7 @@ func (cr *containerReference) CopyTarStream(ctx context.Context, destPath string // Copy Content err = cr.cli.CopyToContainer(ctx, cr.id, destPath, tarStream, container.CopyToContainerOptions{}) if err != nil { - return fmt.Errorf("failed to copy content to container: %w", err) + return fmt.Errorf("copyTarStream: failed to copy content to container: %w", err) } // If this fails, then folders have wrong permissions on non root container if cr.UID != 0 || cr.GID != 0 { @@ -911,7 +911,7 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool } err = cr.cli.CopyToContainer(ctx, cr.id, "/", tarFile, container.CopyToContainerOptions{}) if err != nil { - return fmt.Errorf("failed to copy content to container: %w", err) + return fmt.Errorf("copyDir: failed to copy content to container: %w", err) } return nil } @@ -945,7 +945,7 @@ func (cr *containerReference) copyContent(dstPath string, files ...*FileEntry) c logger.Debugf("Extracting content to '%s'", dstPath) err := cr.cli.CopyToContainer(ctx, cr.id, dstPath, &buf, container.CopyToContainerOptions{}) if err != nil { - return fmt.Errorf("failed to copy content to container: %w", err) + return fmt.Errorf("copyContent: failed to copy content to container: %w", err) } return nil } From 432ea9fdada7b8405c40345110284c3930cc7025 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 11 Aug 2025 18:56:35 +0000 Subject: [PATCH 069/281] fix(security): multline secrets trivially transformed are redacted (#845) A multiline secret transformed into a single line by replacing with \ followed by n is also redacted. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/845): fix(security): multline secrets trivially transformed are redacted Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/845 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/mask.go | 15 +++++++++------ internal/pkg/report/mask_test.go | 13 +++++++++++++ 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/internal/pkg/report/mask.go b/internal/pkg/report/mask.go index 286a3fc5..2ae19b8f 100644 --- a/internal/pkg/report/mask.go +++ b/internal/pkg/report/mask.go @@ -36,13 +36,16 @@ func (o *masker) add(secret string) { slices.SortFunc(o.multiLines, func(a, b []string) int { return cmp.Compare(len(b), len(a)) }) - } else { - o.lines = append(o.lines, lines[0]) - // make sure the longest secret are replaced first - slices.SortFunc(o.lines, func(a, b string) int { - return cmp.Compare(len(b), len(a)) - }) + // a multiline secret transformed into a single line by replacing + // newlines with \ followed by n must also be redacted + secret = strings.Join(lines, "\\n") } + + o.lines = append(o.lines, secret) + // make sure the longest secret are replaced first + slices.SortFunc(o.lines, func(a, b string) int { + return cmp.Compare(len(b), len(a)) + }) } func (o *masker) getReplacer() *strings.Replacer { diff --git a/internal/pkg/report/mask_test.go b/internal/pkg/report/mask_test.go index f6f332e4..8f26e698 100644 --- a/internal/pkg/report/mask_test.go +++ b/internal/pkg/report/mask_test.go @@ -41,6 +41,19 @@ SIX` out: "line before\n***\n***\n***\nline after\n", needMore: false, }, + { + // + // a multiline secret where newlines are represented + // as \ followed by n is masked + // + name: "MultilineTransformedIsMasked", + secrets: []string{ + multiLineOne, + }, + in: fmt.Sprintf("line before\n%[1]s\\nTWO\\nTHREE\nline after", lineOne), + out: "line before\n***\nline after\n", + needMore: false, + }, { // // in a multiline secret \r\n is equivalent to \n and does From 555b322ce5922942e846c04a62925e3c09db89b7 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 11 Aug 2025 21:10:44 +0000 Subject: [PATCH 070/281] fix: update reusable workflow input handling (#834) Refs https://github.com/nektos/act/pull/2349 --- * update reusable workflow input handling * make test stricter --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> (cherry picked from commit 44d7ad54b07530793bbf965598636c8378beb3f9) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/834): fix: update reusable workflow input handling Co-authored-by: ChristopherHX Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/834 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/model/workflow.go | 8 ++++---- act/runner/expression.go | 19 +++++++++++-------- .../workflows/local-reusable-workflow.yml | 16 ++++++++-------- 3 files changed, 23 insertions(+), 20 deletions(-) diff --git a/act/model/workflow.go b/act/model/workflow.go index 99f77a29..a490a8dd 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -160,10 +160,10 @@ func (w *Workflow) WorkflowDispatchConfig() *WorkflowDispatch { } type WorkflowCallInput struct { - Description string `yaml:"description"` - Required bool `yaml:"required"` - Default string `yaml:"default"` - Type string `yaml:"type"` + Description string `yaml:"description"` + Required bool `yaml:"required"` + Default yaml.Node `yaml:"default"` + Type string `yaml:"type"` } type WorkflowCallOutput struct { diff --git a/act/runner/expression.go b/act/runner/expression.go index cf826bf2..153f6ed7 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -520,7 +520,7 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod for k, v := range config.Inputs { value := nestedMapLookup(ghc.Event, "inputs", k) if value == nil { - value = v.Default + _ = v.Default.Decode(&value) } if v.Type == "boolean" { inputs[k] = value == "true" @@ -539,21 +539,24 @@ func setupWorkflowInputs(ctx context.Context, inputs *map[string]interface{}, rc for name, input := range config.Inputs { value := rc.caller.runContext.Run.Job().With[name] + if value != nil { - if str, ok := value.(string); ok { + node := yaml.Node{} + _ = node.Encode(value) + if rc.caller.runContext.ExprEval != nil { // evaluate using the calling RunContext (outside) - value = rc.caller.runContext.ExprEval.Interpolate(ctx, str) + _ = rc.caller.runContext.ExprEval.EvaluateYamlNode(ctx, &node) } + _ = node.Decode(&value) } if value == nil && config != nil && config.Inputs != nil { - value = input.Default + def := input.Default if rc.ExprEval != nil { - if str, ok := value.(string); ok { - // evaluate using the called RunContext (inside) - value = rc.ExprEval.Interpolate(ctx, str) - } + // evaluate using the called RunContext (inside) + _ = rc.ExprEval.EvaluateYamlNode(ctx, &def) } + _ = def.Decode(&value) } (*inputs)[name] = value diff --git a/act/runner/testdata/.github/workflows/local-reusable-workflow.yml b/act/runner/testdata/.github/workflows/local-reusable-workflow.yml index d32dc5b8..2befe5f3 100644 --- a/act/runner/testdata/.github/workflows/local-reusable-workflow.yml +++ b/act/runner/testdata/.github/workflows/local-reusable-workflow.yml @@ -45,23 +45,23 @@ jobs: - name: test required bool run: | - echo inputs.bool_required=${{ inputs.bool_required }} - [[ "${{ inputs.bool_required }}" = "true" ]] || exit 1 + echo inputs.bool_required=${{ tojson(inputs.bool_required) }} + [[ "${{ tojson(inputs.bool_required) }}" = "true" ]] || exit 1 - name: test optional bool run: | - echo inputs.bool_optional=${{ inputs.bool_optional }} - [[ "${{ inputs.bool_optional }}" = "true" ]] || exit 1 + echo inputs.bool_optional=${{ tojson(inputs.bool_optional) }} + [[ "${{ tojson(inputs.bool_optional) }}" = "true" ]] || exit 1 - name: test required number run: | - echo inputs.number_required=${{ inputs.number_required }} - [[ "${{ inputs.number_required == 1 }}" = "true" ]] || exit 1 + echo inputs.number_required=${{ tojson(inputs.number_required) }} + [[ "${{ tojson(inputs.number_required) == '1' }}" = "true" ]] || exit 1 - name: test optional number run: | - echo inputs.number_optional=${{ inputs.number_optional }} - [[ "${{ inputs.number_optional == 1 }}" = "true" ]] || exit 1 + echo inputs.number_optional=${{ tojson(inputs.number_optional) }} + [[ "${{ tojson(inputs.number_optional) == '1' }}" = "true" ]] || exit 1 - name: test secret run: | From 41f8b03b791ecb22e7c4d9679e2618e403e75da6 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Tue, 12 Aug 2025 10:09:42 +0000 Subject: [PATCH 071/281] fix: the configuration must not be used as temporary storage (#849) rc.Config should be treated as read-only and not as a temporary storage for the variable list of valid volumes for containers sharing this configuration. Refs forgejo/runner#848 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/849): fix: the configuration must not be used as temporary storage Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/849 Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/action.go | 4 ++-- act/runner/run_context.go | 20 ++++++++++---------- act/runner/run_context_test.go | 14 ++------------ act/runner/step_docker.go | 4 ++-- 4 files changed, 16 insertions(+), 26 deletions(-) diff --git a/act/runner/action.go b/act/runner/action.go index 6b27288e..3f50bccc 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -428,7 +428,7 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_ARCH", container.RunnerArch(ctx))) envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TEMP", "/tmp")) - binds, mounts := rc.GetBindsAndMounts() + binds, mounts, validVolumes := rc.GetBindsAndMounts() networkMode := fmt.Sprintf("container:%s", rc.jobContainerName()) if rc.IsHostEnv(ctx) { networkMode = "default" @@ -452,7 +452,7 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, AutoRemove: rc.Config.AutoRemove, - ValidVolumes: rc.Config.ValidVolumes, + ValidVolumes: validVolumes, ConfigOptions: rc.Config.ContainerOptions, }) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 97615023..219adea4 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -124,7 +124,7 @@ func getDockerDaemonSocketMountPath(daemonPath string) string { } // Returns the binds and mounts for the container, resolving paths as appopriate -func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) { +func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string, []string) { name := rc.jobContainerName() if rc.Config.ContainerDaemonSocket == "" { @@ -171,13 +171,13 @@ func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string) { mounts[name] = ext.ToContainerPath(rc.Config.Workdir) } - // add some default binds and mounts to ValidVolumes - rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, name) - rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, name+"-env") - // TODO: add a new configuration to control whether the docker daemon can be mounted - rc.Config.ValidVolumes = append(rc.Config.ValidVolumes, getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)) - - return binds, mounts + validVolumes := []string{ + name, + name + "-env", + getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket), + } + validVolumes = append(validVolumes, rc.Config.ValidVolumes...) + return binds, mounts, validVolumes } //go:embed lxc-helpers-lib.sh @@ -446,7 +446,7 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { envList = append(envList, fmt.Sprintf("%s=%s", "LANG", "C.UTF-8")) // Use same locale as GitHub Actions ext := container.LinuxContainerEnvironmentExtensions{} - binds, mounts := rc.GetBindsAndMounts() + binds, mounts, validVolumes := rc.GetBindsAndMounts() networkName, createAndDeleteNetwork := rc.getNetworkName(ctx) // add service containers @@ -570,7 +570,7 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, AutoRemove: rc.Config.AutoRemove, - ValidVolumes: rc.Config.ValidVolumes, + ValidVolumes: validVolumes, JobOptions: rc.options(ctx), ConfigOptions: rc.Config.ContainerOptions, diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 52dc86f8..1a6aa66c 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -219,7 +219,7 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { config := testcase.rc.Config config.Workdir = testcase.name config.BindWorkdir = bindWorkDir - gotbind, gotmount := rctemplate.GetBindsAndMounts() + gotbind, gotmount, _ := rctemplate.GetBindsAndMounts() // Name binds/mounts are either/or if config.BindWorkdir { @@ -271,7 +271,7 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { rc.Run.JobID = "job1" rc.Run.Workflow.Jobs = map[string]*model.Job{"job1": job} - gotbind, gotmount := rc.GetBindsAndMounts() + gotbind, gotmount, _ := rc.GetBindsAndMounts() if len(testcase.wantbind) > 0 { assert.Contains(t, gotbind, testcase.wantbind) @@ -764,11 +764,6 @@ jobs: ConfigOptions: "", JobOptions: "", AutoRemove: false, - ValidVolumes: []string{ - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB", - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-env", - "/var/run/docker.sock", - }, }, { Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca49599-c233cf913e1d0c90cc1404ee09917e625f9cb82156ca3d7cb10b729d563728ea", @@ -792,11 +787,6 @@ jobs: ConfigOptions: "", JobOptions: "", AutoRemove: false, - ValidVolumes: []string{ - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB", - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-env", - "/var/run/docker.sock", - }, }, }, }, diff --git a/act/runner/step_docker.go b/act/runner/step_docker.go index 5ecddd21..db86ad35 100644 --- a/act/runner/step_docker.go +++ b/act/runner/step_docker.go @@ -110,7 +110,7 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_ARCH", container.RunnerArch(ctx))) envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TEMP", "/tmp")) - binds, mounts := rc.GetBindsAndMounts() + binds, mounts, validVolumes := rc.GetBindsAndMounts() stepContainer := ContainerNewContainer(&container.NewContainerInput{ Cmd: cmd, Entrypoint: entrypoint, @@ -130,7 +130,7 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, AutoRemove: rc.Config.AutoRemove, - ValidVolumes: rc.Config.ValidVolumes, + ValidVolumes: validVolumes, }) return stepContainer } From 773bb92aa3f121face65bb1fc909f45410e52a0c Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 07:47:50 +0000 Subject: [PATCH 072/281] fix: container removal is the runner responsibility (#851) If a container is configured for implicit removal in the docker/podman server, it will race against the explicit removal performed by the runner. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/851): fix: container removal is the runner responsibility Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/851 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/container_types.go | 3 --- act/container/docker_run.go | 1 - act/runner/action.go | 1 - act/runner/job_executor.go | 2 +- act/runner/job_executor_test.go | 1 + act/runner/run_context.go | 2 -- act/runner/run_context_test.go | 3 --- act/runner/runner.go | 1 - act/runner/runner_test.go | 1 - act/runner/step_docker.go | 1 - internal/app/cmd/exec.go | 1 - internal/app/run/runner.go | 1 - 12 files changed, 2 insertions(+), 16 deletions(-) diff --git a/act/container/container_types.go b/act/container/container_types.go index 8fe651f3..eb524cef 100644 --- a/act/container/container_types.go +++ b/act/container/container_types.go @@ -35,9 +35,6 @@ type NewContainerInput struct { ConfigOptions string JobOptions string - // Gitea specific - AutoRemove bool - ValidVolumes []string } diff --git a/act/container/docker_run.go b/act/container/docker_run.go index b64703c0..4e218ecf 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -577,7 +577,6 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor { Privileged: input.Privileged, UsernsMode: container.UsernsMode(input.UsernsMode), PortBindings: input.PortBindings, - AutoRemove: input.AutoRemove, } logger.Debugf("Common container.HostConfig ==> %+v", hostConfig) diff --git a/act/runner/action.go b/act/runner/action.go index 3f50bccc..8ca5f510 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -451,7 +451,6 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo Privileged: rc.Config.Privileged, UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, - AutoRemove: rc.Config.AutoRemove, ValidVolumes: validVolumes, ConfigOptions: rc.Config.ContainerOptions, diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index f9ab36a0..848e56f8 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -119,7 +119,7 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo setJobOutputs(ctx, rc) var err error - if rc.Config.AutoRemove || jobError == nil { + { // Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout) defer cancel() diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index 5e113d83..b9c434a1 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -141,6 +141,7 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { executedSteps: []string{ "startContainer", "step1", + "stopContainer", "interpolateOutputs", "closeContainer", }, diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 219adea4..67ceefa4 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -501,7 +501,6 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { Privileged: rc.Config.Privileged, UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, - AutoRemove: rc.Config.AutoRemove, NetworkMode: networkName, NetworkAliases: []string{sanitizeNetworkAlias(ctx, serviceID)}, ExposedPorts: exposedPorts, @@ -569,7 +568,6 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { Privileged: rc.Config.Privileged, UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, - AutoRemove: rc.Config.AutoRemove, ValidVolumes: validVolumes, JobOptions: rc.options(ctx), diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 1a6aa66c..09506d47 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -735,7 +735,6 @@ jobs: PortBindings: nil, ConfigOptions: "", JobOptions: "", - AutoRemove: false, ValidVolumes: []string{ "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB", "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-env", @@ -763,7 +762,6 @@ jobs: PortBindings: nat.PortMap{}, ConfigOptions: "", JobOptions: "", - AutoRemove: false, }, { Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca49599-c233cf913e1d0c90cc1404ee09917e625f9cb82156ca3d7cb10b729d563728ea", @@ -786,7 +784,6 @@ jobs: PortBindings: nat.PortMap{}, ConfigOptions: "", JobOptions: "", - AutoRemove: false, }, }, }, diff --git a/act/runner/runner.go b/act/runner/runner.go index 19aea849..26d30c78 100644 --- a/act/runner/runner.go +++ b/act/runner/runner.go @@ -52,7 +52,6 @@ type Config struct { GitHubInstance string // GitHub instance to use, default "github.com" ContainerCapAdd []string // list of kernel capabilities to add to the containers ContainerCapDrop []string // list of kernel capabilities to remove from the containers - AutoRemove bool // controls if the container is automatically removed upon workflow completion ArtifactServerPath string // the path where the artifact server stores uploads ArtifactServerAddr string // the address the artifact server binds to ArtifactServerPort string // the port the artifact server binds to diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 3811811b..8f2ab0db 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -191,7 +191,6 @@ func (j *TestJobFileInfo) runTest(ctx context.Context, t *testing.T, cfg *Config Matrix: cfg.Matrix, JobLoggerLevel: cfg.JobLoggerLevel, ActionCache: cfg.ActionCache, - AutoRemove: true, } runner, err := New(runnerConfig) diff --git a/act/runner/step_docker.go b/act/runner/step_docker.go index db86ad35..055098a8 100644 --- a/act/runner/step_docker.go +++ b/act/runner/step_docker.go @@ -129,7 +129,6 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e Privileged: rc.Config.Privileged, UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, - AutoRemove: rc.Config.AutoRemove, ValidVolumes: validVolumes, }) return stepContainer diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go index 8c197711..8559b960 100644 --- a/internal/app/cmd/exec.go +++ b/internal/app/cmd/exec.go @@ -394,7 +394,6 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command ContainerCapAdd: execArgs.containerCapAdd, ContainerCapDrop: execArgs.containerCapDrop, ContainerOptions: execArgs.containerOptions, - AutoRemove: true, NoSkipCheckout: execArgs.noSkipCheckout, // PresetGitHubContext: preset, // EventJSON: string(eventJSON), diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index e8d91822..3749ee50 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -314,7 +314,6 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. Env: runEnvs, Secrets: task.Secrets, GitHubInstance: strings.TrimSuffix(r.client.Address(), "/"), - AutoRemove: true, NoSkipCheckout: true, PresetGitHubContext: preset, EventJSON: string(eventJSON), From 987efff021e9de45f6090ebcf880b185596a9101 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 14 Aug 2025 11:16:01 +0000 Subject: [PATCH 073/281] Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.4.0 (#852) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/golangci/golangci-lint/v2/cmd/golangci-lint](https://github.com/golangci/golangci-lint) | `v2.3.1` -> `v2.4.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.3.1/v2.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
golangci/golangci-lint (github.com/golangci/golangci-lint/v2/cmd/golangci-lint) ### [`v2.4.0`](https://github.com/golangci/golangci-lint/blob/HEAD/CHANGELOG.md#v240) [Compare Source](https://github.com/golangci/golangci-lint/compare/v2.3.1...v2.4.0) 1. Enhancements - 🎉 go1.25 support 2. Linters new features or changes - `exhaustruct`: from v3.3.1 to 4.0.0 (new options: `allow-empty`, `allow-empty-rx`, `allow-empty-returns`, `allow-empty-declarations`) 3. Linters bug fixes - `godox`: trim filepath from report messages - `staticcheck`: allow empty options - `tagalign`: from 1.4.2 to 1.4.3 4. Documentation - 🌟 New website (with a search engine)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/852): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.4.0 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/852 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 99dd939b..98d4fa49 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,7 @@ GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v3.5.2 # renovate: datasource=go -GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.3.1 # renovate: datasource=go +GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner DOCKER_TAG ?= nightly From 0ff1ec4c0456ea541fb7ef206b5eff917b6ca26b Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 15:46:01 +0000 Subject: [PATCH 074/281] chore: panic if a random name cannot be created (#853) If that happens so much will go wrong that there is no point in continuing to do anything. It simplifies the requirements of the caller: it may be a function that is assumed to never error. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/853): chore: panic if a random name cannot be created Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/853 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/cacheproxy/handler.go | 6 +----- act/common/randname.go | 11 ++++++++++- act/runner/action_cache.go | 5 +---- act/runner/run_context.go | 10 ++-------- 4 files changed, 14 insertions(+), 18 deletions(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 79d3f14b..5b77c166 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -167,11 +167,7 @@ func (h *Handler) ExternalURL() string { // The function returns the 32-bit random key which the run will use to identify itself. func (h *Handler) AddRun(data RunData) (string, error) { for retries := 0; retries < 3; retries++ { - key, err := common.RandName(4) - if err != nil { - return "", errors.New("Could not generate the run id") - } - + key := common.MustRandName(4) _, loaded := h.runs.LoadOrStore(key, data) if !loaded { // The key was unique and added successfully diff --git a/act/common/randname.go b/act/common/randname.go index a9350106..2010680e 100644 --- a/act/common/randname.go +++ b/act/common/randname.go @@ -5,12 +5,21 @@ package common import ( "crypto/rand" "encoding/hex" + "fmt" ) -func RandName(size int) (string, error) { +func randName(size int) (string, error) { randBytes := make([]byte, size) if _, err := rand.Read(randBytes); err != nil { return "", err } return hex.EncodeToString(randBytes), nil } + +func MustRandName(size int) string { + name, err := randName(size) + if err != nil { + panic(fmt.Errorf("RandName(%d): %v", size, err)) + } + return name +} diff --git a/act/runner/action_cache.go b/act/runner/action_cache.go index 219656cf..c884eb4f 100644 --- a/act/runner/action_cache.go +++ b/act/runner/action_cache.go @@ -39,10 +39,7 @@ func (c GoGitActionCache) Fetch(ctx context.Context, cacheDir, url, ref, token s if err != nil { return "", err } - branchName, err := common.RandName(12) - if err != nil { - return "", err - } + branchName := common.MustRandName(12) var auth transport.AuthMethod if token != "" { diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 67ceefa4..533de691 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -283,10 +283,7 @@ func (rc *RunContext) startHostEnvironment() common.Executor { return true }) cacheDir := rc.ActionCacheDir() - randName, err := common.RandName(8) - if err != nil { - return err - } + randName := common.MustRandName(8) miscpath := filepath.Join(cacheDir, randName) actPath := filepath.Join(miscpath, "act") if err := os.MkdirAll(actPath, 0o777); err != nil { @@ -624,10 +621,7 @@ func (rc *RunContext) sh(ctx context.Context, script string) (stdout, stderr str env[k] = v } - base, err := common.RandName(8) - if err != nil { - return "", "", err - } + base := common.MustRandName(8) name := base + ".sh" oldStdout, oldStderr := rc.JobContainer.ReplaceLogWriter(hout, herr) err = rc.JobContainer.Copy(rc.JobContainer.GetActPath(), &container.FileEntry{ From 159c6af0dd1f16a842fc1570b3964d528b8f98b5 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 15:46:52 +0000 Subject: [PATCH 075/281] chore: refactor NewDockerVolumeRemoveExecutor (#854) - remove the force argument as it is always false - accept more than one volume to be removed - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/854): chore: refactor NewDockerVolumeRemoveExecutor Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/854 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/docker_volume.go | 13 ++++++++----- act/runner/run_context.go | 3 +-- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/act/container/docker_volume.go b/act/container/docker_volume.go index 94e4036b..d6c9a348 100644 --- a/act/container/docker_volume.go +++ b/act/container/docker_volume.go @@ -4,13 +4,14 @@ package container import ( "context" + "slices" "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/docker/api/types/filters" "github.com/docker/docker/api/types/volume" ) -func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executor { +func NewDockerVolumesRemoveExecutor(volumeNames []string) common.Executor { return func(ctx context.Context) error { cli, err := GetDockerClient(ctx) if err != nil { @@ -24,17 +25,18 @@ func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executo } for _, vol := range list.Volumes { - if vol.Name == volumeName { - return removeExecutor(volumeName, force)(ctx) + if slices.Contains(volumeNames, vol.Name) { + if err := removeExecutor(vol.Name)(ctx); err != nil { + return err + } } } - // Volume not found - do nothing return nil } } -func removeExecutor(volume string, force bool) common.Executor { +func removeExecutor(volume string) common.Executor { return func(ctx context.Context) error { logger := common.Logger(ctx) logger.Debugf("%sdocker volume rm %s", logPrefix, volume) @@ -49,6 +51,7 @@ func removeExecutor(volume string, force bool) common.Executor { } defer cli.Close() + force := false return cli.VolumeRemove(ctx, volume, force) } } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 533de691..15efc312 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -521,8 +521,7 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { if rc.JobContainer != nil { return rc.JobContainer.Remove().IfNot(reuseJobContainer). - Then(container.NewDockerVolumeRemoveExecutor(rc.jobContainerName(), false)).IfNot(reuseJobContainer). - Then(container.NewDockerVolumeRemoveExecutor(rc.jobContainerName()+"-env", false)).IfNot(reuseJobContainer). + Then(container.NewDockerVolumesRemoveExecutor([]string{rc.jobContainerName(), rc.jobContainerName() + "-env"})).IfNot(reuseJobContainer). Then(func(ctx context.Context) error { if len(rc.ServiceContainers) > 0 { logger.Infof("Cleaning up services for job %s", rc.JobName) From f392ec4caa14df49faa38bc5113a5160bb5366dc Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 10:08:50 +0200 Subject: [PATCH 076/281] chore: refactor GetBindsAndMounts to have a context.Context arg --- act/runner/action.go | 2 +- act/runner/run_context.go | 4 ++-- act/runner/run_context_test.go | 4 ++-- act/runner/step_docker.go | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/act/runner/action.go b/act/runner/action.go index 8ca5f510..98b880d1 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -428,7 +428,7 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_ARCH", container.RunnerArch(ctx))) envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TEMP", "/tmp")) - binds, mounts, validVolumes := rc.GetBindsAndMounts() + binds, mounts, validVolumes := rc.GetBindsAndMounts(ctx) networkMode := fmt.Sprintf("container:%s", rc.jobContainerName()) if rc.IsHostEnv(ctx) { networkMode = "default" diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 15efc312..a4c6a893 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -124,7 +124,7 @@ func getDockerDaemonSocketMountPath(daemonPath string) string { } // Returns the binds and mounts for the container, resolving paths as appopriate -func (rc *RunContext) GetBindsAndMounts() ([]string, map[string]string, []string) { +func (rc *RunContext) GetBindsAndMounts(ctx context.Context) ([]string, map[string]string, []string) { name := rc.jobContainerName() if rc.Config.ContainerDaemonSocket == "" { @@ -443,7 +443,7 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { envList = append(envList, fmt.Sprintf("%s=%s", "LANG", "C.UTF-8")) // Use same locale as GitHub Actions ext := container.LinuxContainerEnvironmentExtensions{} - binds, mounts, validVolumes := rc.GetBindsAndMounts() + binds, mounts, validVolumes := rc.GetBindsAndMounts(ctx) networkName, createAndDeleteNetwork := rc.getNetworkName(ctx) // add service containers diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 09506d47..0f70e12d 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -219,7 +219,7 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { config := testcase.rc.Config config.Workdir = testcase.name config.BindWorkdir = bindWorkDir - gotbind, gotmount, _ := rctemplate.GetBindsAndMounts() + gotbind, gotmount, _ := rctemplate.GetBindsAndMounts(t.Context()) // Name binds/mounts are either/or if config.BindWorkdir { @@ -271,7 +271,7 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { rc.Run.JobID = "job1" rc.Run.Workflow.Jobs = map[string]*model.Job{"job1": job} - gotbind, gotmount, _ := rc.GetBindsAndMounts() + gotbind, gotmount, _ := rc.GetBindsAndMounts(t.Context()) if len(testcase.wantbind) > 0 { assert.Contains(t, gotbind, testcase.wantbind) diff --git a/act/runner/step_docker.go b/act/runner/step_docker.go index 055098a8..24cb467d 100644 --- a/act/runner/step_docker.go +++ b/act/runner/step_docker.go @@ -110,7 +110,7 @@ func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, e envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_ARCH", container.RunnerArch(ctx))) envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TEMP", "/tmp")) - binds, mounts, validVolumes := rc.GetBindsAndMounts() + binds, mounts, validVolumes := rc.GetBindsAndMounts(ctx) stepContainer := ContainerNewContainer(&container.NewContainerInput{ Cmd: cmd, Entrypoint: entrypoint, From 8a8e01522d249399992a29cd4ecb9594cd69d416 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 10:21:08 +0200 Subject: [PATCH 077/281] chore: refactor network name creation - networkName becomes ensureNetworkName and stores the results in the run context instead of returning it - the getNetworkName and getNetworkCreated accessors are used instead of local variables --- act/runner/job_executor.go | 8 +--- act/runner/run_context.go | 55 +++++++++++------------ act/runner/run_context_test.go | 82 ++++++++++++++++++++++++++++++++++ 3 files changed, 110 insertions(+), 35 deletions(-) diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index 848e56f8..844d2fed 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -130,12 +130,8 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err) } - if !rc.IsHostEnv(ctx) && rc.Config.ContainerNetworkMode == "" { - // clean network in docker mode only - // if the value of `ContainerNetworkMode` is empty string, - // it means that the network to which containers are connecting is created by `act_runner`, - // so, we should remove the network at last. - networkName, _ := rc.networkName() + if !rc.IsHostEnv(ctx) && rc.getNetworkCreated(ctx) { + networkName := rc.getNetworkName(ctx) logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName()) if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil { logger.Errorf("Error while cleaning network %s: %v", networkName, err) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index a4c6a893..f4cacda8 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -52,6 +52,8 @@ type RunContext struct { Masks []string cleanUpJobContainer common.Executor caller *caller // job calling this RunContext (reusable workflows) + networkName string + networkCreated bool } func (rc *RunContext) AddMask(mask string) { @@ -97,14 +99,6 @@ func (rc *RunContext) jobContainerName() string { return createSimpleContainerName(rc.Config.ContainerNamePrefix, "WORKFLOW-"+common.Sha256(rc.Run.Workflow.Name), "JOB-"+rc.Name) } -// networkName return the name of the network which will be created by `act` automatically for job, -func (rc *RunContext) networkName() (string, bool) { - if len(rc.Run.Job().Services) > 0 || rc.Config.ContainerNetworkMode == "" { - return fmt.Sprintf("%s-%s-network", rc.jobContainerName(), rc.Run.JobID), true - } - return string(rc.Config.ContainerNetworkMode), false -} - func getDockerDaemonSocketMountPath(daemonPath string) string { if protoIndex := strings.Index(daemonPath, "://"); protoIndex != -1 { scheme := daemonPath[:protoIndex] @@ -388,15 +382,24 @@ func (rc *RunContext) startHostEnvironment() common.Executor { } } -func (rc *RunContext) getNetworkName(_ context.Context) (networkName string, createAndDeleteNetwork bool) { - // specify the network to which the container will connect when `docker create` stage. (like execute command line: docker create --network ) - networkName = string(rc.Config.ContainerNetworkMode) - if networkName == "" { - // if networkName is empty string, will create a new network for the containers. - // and it will be removed after at last. - networkName, createAndDeleteNetwork = rc.networkName() +func (rc *RunContext) getNetworkCreated(ctx context.Context) bool { + rc.ensureNetworkName(ctx) + return rc.networkCreated +} + +func (rc *RunContext) getNetworkName(ctx context.Context) string { + rc.ensureNetworkName(ctx) + return rc.networkName +} + +func (rc *RunContext) ensureNetworkName(ctx context.Context) { + if rc.networkName == "" { + rc.networkName = string(rc.Config.ContainerNetworkMode) + if len(rc.Run.Job().Services) > 0 || rc.networkName == "" { + rc.networkName = fmt.Sprintf("%s-%s-network", rc.jobContainerName(), rc.Run.JobID) + rc.networkCreated = true + } } - return networkName, createAndDeleteNetwork } var sanitizeNetworkAliasRegex = regexp.MustCompile("[^a-z0-9-]") @@ -445,7 +448,6 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { ext := container.LinuxContainerEnvironmentExtensions{} binds, mounts, validVolumes := rc.GetBindsAndMounts(ctx) - networkName, createAndDeleteNetwork := rc.getNetworkName(ctx) // add service containers for serviceID, spec := range rc.Run.Job().Services { // interpolate env @@ -498,7 +500,7 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { Privileged: rc.Config.Privileged, UsernsMode: rc.Config.UsernsMode, Platform: rc.Config.ContainerArchitecture, - NetworkMode: networkName, + NetworkMode: rc.getNetworkName(ctx), NetworkAliases: []string{sanitizeNetworkAlias(ctx, serviceID)}, ExposedPorts: exposedPorts, PortBindings: portBindings, @@ -529,13 +531,9 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { logger.Errorf("Error while cleaning services: %v", err) } } - if createAndDeleteNetwork { - // clean network if it has been created by act - // if using service containers - // it means that the network to which containers are connecting is created by `act_runner`, - // so, we should remove the network at last. - logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, networkName) - if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil { + if rc.getNetworkCreated(ctx) { + logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, rc.getNetworkName(ctx)) + if err := container.NewDockerNetworkRemoveExecutor(rc.getNetworkName(ctx))(ctx); err != nil { logger.Errorf("Error while cleaning network: %v", err) } } @@ -556,7 +554,7 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { Env: envList, ToolCache: rc.getToolCache(ctx), Mounts: mounts, - NetworkMode: networkName, + NetworkMode: rc.getNetworkName(ctx), NetworkAliases: []string{sanitizeNetworkAlias(ctx, rc.Name)}, Binds: binds, Stdout: logWriter, @@ -581,7 +579,6 @@ func (rc *RunContext) startJobContainer() common.Executor { if err := rc.prepareJobContainer(ctx); err != nil { return err } - networkName, _ := rc.getNetworkName(ctx) networkConfig := network.CreateOptions{ Driver: "bridge", Scope: "local", @@ -591,8 +588,8 @@ func (rc *RunContext) startJobContainer() common.Executor { rc.pullServicesImages(rc.Config.ForcePull), rc.JobContainer.Pull(rc.Config.ForcePull), rc.stopJobContainer(), - container.NewDockerNetworkCreateExecutor(networkName, &networkConfig).IfBool(!rc.IsHostEnv(ctx) && rc.Config.ContainerNetworkMode == ""), // if the value of `ContainerNetworkMode` is empty string, then will create a new network for containers. - rc.startServiceContainers(networkName), + container.NewDockerNetworkCreateExecutor(rc.getNetworkName(ctx), &networkConfig).IfBool(!rc.IsHostEnv(ctx) && rc.Config.ContainerNetworkMode == ""), // if the value of `ContainerNetworkMode` is empty string, then will create a new network for containers. + rc.startServiceContainers(rc.getNetworkName(ctx)), rc.JobContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop), rc.JobContainer.Start(false), rc.JobContainer.Copy(rc.JobContainer.GetActPath()+"/", &container.FileEntry{ diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 0f70e12d..1b92a3a8 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -650,6 +650,88 @@ func TestRunContext_CreateSimpleContainerName(t *testing.T) { } } +func TestRunContext_ensureNetworkName(t *testing.T) { + t.Run("CreateNetworkForServices", func(t *testing.T) { + yaml := ` +on: + push: + +jobs: + job: + runs-on: docker + container: + image: some:image + services: + service1: + image: service1:image + steps: + - run: echo ok +` + workflow, err := model.ReadWorkflow(strings.NewReader(yaml), true) + require.NoError(t, err) + + rc := &RunContext{ + Config: &Config{ + ContainerNetworkMode: "host", + }, + Run: &model.Run{ + JobID: "job", + Workflow: workflow, + }, + } + + rc.ensureNetworkName(t.Context()) + assert.True(t, rc.getNetworkCreated(t.Context())) + assert.True(t, strings.HasPrefix(rc.getNetworkName(t.Context()), "WORKFLOW-"), rc.getNetworkName(t.Context())) + }) + + yaml := ` +on: + push: + +jobs: + job: + runs-on: docker + container: + image: some:image + steps: + - run: echo ok +` + workflow, err := model.ReadWorkflow(strings.NewReader(yaml), true) + require.NoError(t, err) + + run := &model.Run{ + JobID: "job", + Workflow: workflow, + } + + t.Run("CreateNetworkIfEmptyNetworkMode", func(t *testing.T) { + rc := &RunContext{ + Config: &Config{ + ContainerNetworkMode: "", + }, + Run: run, + } + + rc.ensureNetworkName(t.Context()) + assert.True(t, rc.getNetworkCreated(t.Context())) + assert.True(t, strings.HasPrefix(rc.getNetworkName(t.Context()), "WORKFLOW-"), rc.getNetworkName(t.Context())) + }) + + t.Run("FixedNetworkIfSetByNetworkMode", func(t *testing.T) { + rc := &RunContext{ + Config: &Config{ + ContainerNetworkMode: "host", + }, + Run: run, + } + + rc.ensureNetworkName(t.Context()) + assert.False(t, rc.getNetworkCreated(t.Context())) + assert.Equal(t, "host", rc.getNetworkName(t.Context())) + }) +} + func TestRunContext_SanitizeNetworkAlias(t *testing.T) { same := "same" assert.Equal(t, same, sanitizeNetworkAlias(t.Context(), same)) From 023427115f737fe314b874769f003bfb4052c531 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 10:30:46 +0200 Subject: [PATCH 078/281] chore: refactor internal volume names accessors - getInternalVolumeWorkdir is used instead of rc.jobContainerName() - getInternalVolumeEnv is used insted of rc.jobContainerName() + "-env" - getInternalVolumeNames is used when all internal volumes are needed --- act/runner/run_context.go | 29 +++++++++++++++++++---------- act/runner/run_context_test.go | 2 +- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index f4cacda8..c7760de3 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -117,10 +117,23 @@ func getDockerDaemonSocketMountPath(daemonPath string) string { return daemonPath } +func (rc *RunContext) getInternalVolumeNames(ctx context.Context) []string { + return []string{ + rc.getInternalVolumeWorkdir(ctx), + rc.getInternalVolumeEnv(ctx), + } +} + +func (rc *RunContext) getInternalVolumeWorkdir(ctx context.Context) string { + return rc.jobContainerName() +} + +func (rc *RunContext) getInternalVolumeEnv(ctx context.Context) string { + return fmt.Sprintf("%s-env", rc.jobContainerName()) +} + // Returns the binds and mounts for the container, resolving paths as appopriate func (rc *RunContext) GetBindsAndMounts(ctx context.Context) ([]string, map[string]string, []string) { - name := rc.jobContainerName() - if rc.Config.ContainerDaemonSocket == "" { rc.Config.ContainerDaemonSocket = "/var/run/docker.sock" } @@ -134,7 +147,7 @@ func (rc *RunContext) GetBindsAndMounts(ctx context.Context) ([]string, map[stri ext := container.LinuxContainerEnvironmentExtensions{} mounts := map[string]string{ - name + "-env": ext.GetActPath(), + rc.getInternalVolumeEnv(ctx): ext.GetActPath(), } if job := rc.Run.Job(); job != nil { @@ -162,14 +175,10 @@ func (rc *RunContext) GetBindsAndMounts(ctx context.Context) ([]string, map[stri } binds = append(binds, fmt.Sprintf("%s:%s%s", rc.Config.Workdir, ext.ToContainerPath(rc.Config.Workdir), bindModifiers)) } else { - mounts[name] = ext.ToContainerPath(rc.Config.Workdir) + mounts[rc.getInternalVolumeWorkdir(ctx)] = ext.ToContainerPath(rc.Config.Workdir) } - validVolumes := []string{ - name, - name + "-env", - getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket), - } + validVolumes := append(rc.getInternalVolumeNames(ctx), getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)) validVolumes = append(validVolumes, rc.Config.ValidVolumes...) return binds, mounts, validVolumes } @@ -523,7 +532,7 @@ func (rc *RunContext) prepareJobContainer(ctx context.Context) error { if rc.JobContainer != nil { return rc.JobContainer.Remove().IfNot(reuseJobContainer). - Then(container.NewDockerVolumesRemoveExecutor([]string{rc.jobContainerName(), rc.jobContainerName() + "-env"})).IfNot(reuseJobContainer). + Then(container.NewDockerVolumesRemoveExecutor(rc.getInternalVolumeNames(ctx))).IfNot(reuseJobContainer). Then(func(ctx context.Context) error { if len(rc.ServiceContainers) > 0 { logger.Infof("Cleaning up services for job %s", rc.JobName) diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 1b92a3a8..9d167a0f 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -229,7 +229,7 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { } assert.Contains(t, gotbind, fullBind) } else { - mountkey := testcase.rc.jobContainerName() + mountkey := testcase.rc.getInternalVolumeWorkdir(t.Context()) assert.EqualValues(t, testcase.wantmount, gotmount[mountkey]) } }) From a197fea4ba6e14b9582b909c4becbef47041eb35 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 10:46:28 +0200 Subject: [PATCH 079/281] feat: assign a unique random name to each run context If the run context has a parent, both share the same unique random name. A composite action does not have a run context of its own, it re-uses the run context of the job that calls it: this is when a parent is used and needed. There may be any level of parent / child relationship and ensureRandom name recursively look for the first parent with a non empty random. --- act/runner/run_context.go | 20 ++++++++++++++++++++ act/runner/run_context_test.go | 15 +++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index c7760de3..a1db2867 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -52,6 +52,7 @@ type RunContext struct { Masks []string cleanUpJobContainer common.Executor caller *caller // job calling this RunContext (reusable workflows) + randomName string networkName string networkCreated bool } @@ -391,6 +392,25 @@ func (rc *RunContext) startHostEnvironment() common.Executor { } } +func (rc *RunContext) ensureRandomName(ctx context.Context) { + if rc.randomName == "" { + logger := common.Logger(ctx) + if rc.Parent != nil { + // composite actions inherit their run context from the parent job + rootRunContext := rc + for rootRunContext.Parent != nil { + rootRunContext = rootRunContext.Parent + } + rootRunContext.ensureRandomName(ctx) + rc.randomName = rootRunContext.randomName + logger.Debugf("RunContext inherited random name %s from its parent", rc.Name, rc.randomName) + } else { + rc.randomName = common.MustRandName(16) + logger.Debugf("RunContext %s is assigned random name %s", rc.Name, rc.randomName) + } + } +} + func (rc *RunContext) getNetworkCreated(ctx context.Context) bool { rc.ensureNetworkName(ctx) return rc.networkCreated diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 9d167a0f..d03a1b72 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -937,3 +937,18 @@ func Test_waitForServiceContainer(t *testing.T) { m.AssertExpectations(t) }) } + +func TestRunContext_ensureRandomName(t *testing.T) { + parent := &RunContext{ + Name: "parentname", + } + rc := &RunContext{ + Name: "runname", + Parent: parent, + } + + parent.ensureRandomName(t.Context()) + assert.NotEmpty(t, parent.randomName) + rc.ensureRandomName(t.Context()) + assert.Equal(t, parent.randomName, rc.randomName) +} From 10c26c53a3904f58230d1c188546acbf772343d1 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 11:14:20 +0200 Subject: [PATCH 080/281] chore: do not hardcode names in TestRunContext_PrepareJobContainer Replace asserting hard coded names with assertions on how the services and the job container relate. It slightly improves logic coverage and makes the test insensitive to how network and volume names are created. - compare the network names of the services and the job container to be equal, demonstrating they can communicate - verify the mounts and valid volumes of services to be empty - verify the internal mounts of the job container to be valid volumes --- act/runner/run_context_test.go | 51 ++++++++++++++++++---------------- 1 file changed, 27 insertions(+), 24 deletions(-) diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index d03a1b72..296afd1b 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -794,21 +794,16 @@ jobs: }, inputs: []container.NewContainerInput{ { - Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB", - Image: "some:image", - Username: "containerusername", - Password: "containerpassword", - Entrypoint: []string{"tail", "-f", "/dev/null"}, - Cmd: nil, - WorkingDir: "/my/workdir", - Env: []string{}, - ToolCache: "/opt/hostedtoolcache", - Binds: []string{"/var/run/docker.sock:/var/run/docker.sock"}, - Mounts: map[string]string{ - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB": "/my/workdir", - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-env": "/var/run/act", - }, - NetworkMode: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-job-network", + Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB", + Image: "some:image", + Username: "containerusername", + Password: "containerpassword", + Entrypoint: []string{"tail", "-f", "/dev/null"}, + Cmd: nil, + WorkingDir: "/my/workdir", + Env: []string{}, + ToolCache: "/opt/hostedtoolcache", + Binds: []string{"/var/run/docker.sock:/var/run/docker.sock"}, Privileged: false, UsernsMode: "", Platform: "", @@ -817,11 +812,6 @@ jobs: PortBindings: nil, ConfigOptions: "", JobOptions: "", - ValidVolumes: []string{ - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB", - "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-env", - "/var/run/docker.sock", - }, }, { Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca49599-fe7f4c0058dbd2161ebe4aafa71cd83bd96ee19d3ca8043d5e4bc477a664a80c", @@ -834,8 +824,6 @@ jobs: Env: []string{}, ToolCache: "/opt/hostedtoolcache", Binds: []string{"/var/run/docker.sock:/var/run/docker.sock"}, - Mounts: map[string]string{}, - NetworkMode: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-job-network", Privileged: false, UsernsMode: "", Platform: "", @@ -856,8 +844,6 @@ jobs: Env: []string{}, ToolCache: "/opt/hostedtoolcache", Binds: []string{"/var/run/docker.sock:/var/run/docker.sock"}, - Mounts: map[string]string{}, - NetworkMode: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB-job-network", Privileged: false, UsernsMode: "", Platform: "", @@ -890,7 +876,24 @@ jobs: require.NoError(t, rc.prepareJobContainer(ctx)) slices.SortFunc(containerInputs, func(a, b container.NewContainerInput) int { return cmp.Compare(a.Username, b.Username) }) + jobContainerInput := containerInputs[0] + require.Equal(t, "containerusername", jobContainerInput.Username) + require.NotEmpty(t, jobContainerInput.NetworkMode) + for source := range jobContainerInput.Mounts { + assert.Contains(t, jobContainerInput.ValidVolumes, source) + } for i := 0; i < len(containerInputs); i++ { + + assert.Equal(t, jobContainerInput.NetworkMode, containerInputs[i].NetworkMode, containerInputs[i].Username) + containerInputs[i].NetworkMode = "" + + if strings.HasPrefix(containerInputs[i].Username, "service") { + assert.Empty(t, containerInputs[i].Mounts) + assert.Empty(t, containerInputs[i].ValidVolumes) + } + containerInputs[i].Mounts = nil + containerInputs[i].ValidVolumes = nil + assert.EqualValues(t, testCase.inputs[i], containerInputs[i], containerInputs[i].Username) } }) From c85eb0e6477d394da5115b530c9deab9b4ae0247 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 14 Aug 2025 11:21:51 +0200 Subject: [PATCH 081/281] fix: use a unique random name to derive network and volumes for a job When a reusable workflow is called twice in the same workflow in parallel, it may require a dedicated network to run (for instance if it spawns services) and will always require unique volumes to mount the workdir and the env. There really is no way to guarantee a unique name derived from the job name etc. Instead, a random name is set and used as a base for both the internal volumes and the dedicated network (if any). --- act/runner/run_context.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index a1db2867..84c03188 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -126,11 +126,13 @@ func (rc *RunContext) getInternalVolumeNames(ctx context.Context) []string { } func (rc *RunContext) getInternalVolumeWorkdir(ctx context.Context) string { - return rc.jobContainerName() + rc.ensureRandomName(ctx) + return rc.randomName } func (rc *RunContext) getInternalVolumeEnv(ctx context.Context) string { - return fmt.Sprintf("%s-env", rc.jobContainerName()) + rc.ensureRandomName(ctx) + return fmt.Sprintf("%s-env", rc.randomName) } // Returns the binds and mounts for the container, resolving paths as appopriate @@ -423,9 +425,10 @@ func (rc *RunContext) getNetworkName(ctx context.Context) string { func (rc *RunContext) ensureNetworkName(ctx context.Context) { if rc.networkName == "" { + rc.ensureRandomName(ctx) rc.networkName = string(rc.Config.ContainerNetworkMode) if len(rc.Run.Job().Services) > 0 || rc.networkName == "" { - rc.networkName = fmt.Sprintf("%s-%s-network", rc.jobContainerName(), rc.Run.JobID) + rc.networkName = fmt.Sprintf("WORKFLOW-%s", rc.randomName) rc.networkCreated = true } } From 27f425987c0e15078faf839670bfd637d84f1268 Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Fri, 15 Aug 2025 04:54:13 +0000 Subject: [PATCH 082/281] chore: modernize code (#857) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/857 Reviewed-by: earl-warren Reviewed-by: Gusted Co-authored-by: Michael Kriese Co-committed-by: Michael Kriese --- act/cacheproxy/handler.go | 2 +- act/common/cartesian.go | 14 ++-- act/common/cartesian_test.go | 6 +- act/common/draw.go | 7 +- act/common/executor.go | 10 +-- act/common/git/git_test.go | 2 - act/container/docker_logger.go | 2 +- act/container/executions_environment.go | 2 +- act/container/host_environment.go | 4 +- .../linux_container_environment_extensions.go | 4 +- act/exprparser/functions.go | 4 +- act/exprparser/functions_test.go | 20 +++--- act/exprparser/interpreter.go | 42 +++++------ act/exprparser/interpreter_test.go | 32 ++++----- act/filecollector/file_collector_test.go | 2 +- act/jobparser/evaluator.go | 2 +- act/jobparser/interpeter.go | 6 +- act/jobparser/jobparser.go | 12 ++-- act/jobparser/model.go | 18 ++--- act/jobparser/model_test.go | 62 ++++++++-------- act/model/action.go | 2 +- act/model/github_context.go | 72 +++++++++---------- act/model/github_context_test.go | 46 ++++++------ act/model/planner.go | 15 ++-- act/model/workflow.go | 64 ++++++++--------- act/model/workflow_test.go | 24 +++---- act/runner/action.go | 4 +- act/runner/command.go | 4 +- act/runner/command_test.go | 2 +- act/runner/expression.go | 33 ++++----- act/runner/expression_test.go | 11 ++- act/runner/job_executor.go | 3 +- act/runner/job_executor_test.go | 17 ++--- act/runner/logger.go | 2 +- act/runner/run_context.go | 23 +++--- act/runner/run_context_test.go | 12 +--- act/runner/runner.go | 14 ++-- act/runner/step.go | 9 ++- act/runner/step_action_local.go | 2 +- act/runner/step_action_local_test.go | 2 +- act/runner/step_action_remote.go | 6 +- act/runner/step_run.go | 5 +- act/schema/schema.go | 7 +- act/workflowpattern/trace_writer.go | 6 +- internal/app/cmd/exec.go | 5 +- internal/app/run/runner.go | 11 ++- internal/pkg/config/config.go | 5 +- internal/pkg/report/reporter.go | 14 ++-- internal/pkg/report/reporter_test.go | 6 +- 49 files changed, 316 insertions(+), 363 deletions(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 5b77c166..56b083a6 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -166,7 +166,7 @@ func (h *Handler) ExternalURL() string { // The RunData contains the information about the repository. // The function returns the 32-bit random key which the run will use to identify itself. func (h *Handler) AddRun(data RunData) (string, error) { - for retries := 0; retries < 3; retries++ { + for range 3 { key := common.MustRandName(4) _, loaded := h.runs.LoadOrStore(key, data) if !loaded { diff --git a/act/common/cartesian.go b/act/common/cartesian.go index 9cd60655..f7467c90 100644 --- a/act/common/cartesian.go +++ b/act/common/cartesian.go @@ -1,9 +1,9 @@ package common // CartesianProduct takes map of lists and returns list of unique tuples -func CartesianProduct(mapOfLists map[string][]interface{}) []map[string]interface{} { +func CartesianProduct(mapOfLists map[string][]any) []map[string]any { listNames := make([]string, 0) - lists := make([][]interface{}, 0) + lists := make([][]any, 0) for k, v := range mapOfLists { listNames = append(listNames, k) lists = append(lists, v) @@ -11,9 +11,9 @@ func CartesianProduct(mapOfLists map[string][]interface{}) []map[string]interfac listCart := cartN(lists...) - rtn := make([]map[string]interface{}, 0) + rtn := make([]map[string]any, 0) for _, list := range listCart { - vMap := make(map[string]interface{}) + vMap := make(map[string]any) for i, v := range list { vMap[listNames[i]] = v } @@ -22,7 +22,7 @@ func CartesianProduct(mapOfLists map[string][]interface{}) []map[string]interfac return rtn } -func cartN(a ...[]interface{}) [][]interface{} { +func cartN(a ...[]any) [][]any { c := 1 for _, a := range a { c *= len(a) @@ -30,8 +30,8 @@ func cartN(a ...[]interface{}) [][]interface{} { if c == 0 || len(a) == 0 { return nil } - p := make([][]interface{}, c) - b := make([]interface{}, c*len(a)) + p := make([][]any, c) + b := make([]any, c*len(a)) n := make([]int, len(a)) s := 0 for i := range p { diff --git a/act/common/cartesian_test.go b/act/common/cartesian_test.go index c49de06c..a7f4c02e 100644 --- a/act/common/cartesian_test.go +++ b/act/common/cartesian_test.go @@ -8,7 +8,7 @@ import ( func TestCartesianProduct(t *testing.T) { assert := assert.New(t) - input := map[string][]interface{}{ + input := map[string][]any{ "foo": {1, 2, 3, 4}, "bar": {"a", "b", "c"}, "baz": {false, true}, @@ -25,7 +25,7 @@ func TestCartesianProduct(t *testing.T) { assert.Contains(v, "baz") } - input = map[string][]interface{}{ + input = map[string][]any{ "foo": {1, 2, 3, 4}, "bar": {}, "baz": {false, true}, @@ -33,7 +33,7 @@ func TestCartesianProduct(t *testing.T) { output = CartesianProduct(input) assert.Len(output, 0) - input = map[string][]interface{}{} + input = map[string][]any{} output = CartesianProduct(input) assert.Len(output, 0) } diff --git a/act/common/draw.go b/act/common/draw.go index 30bd3dd5..998a539d 100644 --- a/act/common/draw.go +++ b/act/common/draw.go @@ -127,11 +127,8 @@ func (p *Pen) DrawBoxes(labels ...string) *Drawing { // Draw to writer func (d *Drawing) Draw(writer io.Writer, centerOnWidth int) { - padSize := (centerOnWidth - d.GetWidth()) / 2 - if padSize < 0 { - padSize = 0 - } - for _, l := range strings.Split(d.buf.String(), "\n") { + padSize := max((centerOnWidth-d.GetWidth())/2, 0) + for l := range strings.SplitSeq(d.buf.String(), "\n") { if len(l) > 0 { padding := strings.Repeat(" ", padSize) fmt.Fprintf(writer, "%s%s\n", padding, l) diff --git a/act/common/executor.go b/act/common/executor.go index 3033ca09..fb97085a 100644 --- a/act/common/executor.go +++ b/act/common/executor.go @@ -18,7 +18,7 @@ func (w Warning) Error() string { } // Warningf create a warning -func Warningf(format string, args ...interface{}) Warning { +func Warningf(format string, args ...any) Warning { w := Warning{ Message: fmt.Sprintf(format, args...), } @@ -32,7 +32,7 @@ type Executor func(ctx context.Context) error type Conditional func(ctx context.Context) bool // NewInfoExecutor is an executor that logs messages -func NewInfoExecutor(format string, args ...interface{}) Executor { +func NewInfoExecutor(format string, args ...any) Executor { return func(ctx context.Context) error { logger := Logger(ctx) logger.Infof(format, args...) @@ -41,7 +41,7 @@ func NewInfoExecutor(format string, args ...interface{}) Executor { } // NewDebugExecutor is an executor that logs messages -func NewDebugExecutor(format string, args ...interface{}) Executor { +func NewDebugExecutor(format string, args ...any) Executor { return func(ctx context.Context) error { logger := Logger(ctx) logger.Debugf(format, args...) @@ -109,14 +109,14 @@ func NewParallelExecutor(parallel int, executors ...Executor) Executor { }(work, errs) } - for i := 0; i < len(executors); i++ { + for i := range executors { work <- executors[i] } close(work) // Executor waits all executors to cleanup these resources. var firstErr error - for i := 0; i < len(executors); i++ { + for range executors { err := <-errs if firstErr == nil { firstErr = err diff --git a/act/common/git/git_test.go b/act/common/git/git_test.go index 640c033f..738c6afb 100644 --- a/act/common/git/git_test.go +++ b/act/common/git/git_test.go @@ -166,8 +166,6 @@ func TestGitFindRef(t *testing.T) { }, }, } { - tt := tt - name := name t.Run(name, func(t *testing.T) { dir := filepath.Join(basedir, name) require.NoError(t, os.MkdirAll(dir, 0o755)) diff --git a/act/container/docker_logger.go b/act/container/docker_logger.go index b9eb503e..549d8898 100644 --- a/act/container/docker_logger.go +++ b/act/container/docker_logger.go @@ -74,7 +74,7 @@ func logDockerResponse(logger logrus.FieldLogger, dockerResponse io.ReadCloser, return nil } -func writeLog(logger logrus.FieldLogger, isError bool, format string, args ...interface{}) { +func writeLog(logger logrus.FieldLogger, isError bool, format string, args ...any) { if isError { logger.Errorf(format, args...) } else { diff --git a/act/container/executions_environment.go b/act/container/executions_environment.go index e334107d..7808096f 100644 --- a/act/container/executions_environment.go +++ b/act/container/executions_environment.go @@ -12,7 +12,7 @@ type ExecutionsEnvironment interface { GetPathVariableName() string DefaultPathVariable() string JoinPathVariable(...string) string - GetRunnerContext(ctx context.Context) map[string]interface{} + GetRunnerContext(ctx context.Context) map[string]any // On windows PATH and Path are the same key IsEnvironmentCaseInsensitive() bool } diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 43cb2974..8a60970b 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -485,8 +485,8 @@ func goOsToActionOs(os string) string { return os } -func (e *HostEnvironment) GetRunnerContext(_ context.Context) map[string]interface{} { - return map[string]interface{}{ +func (e *HostEnvironment) GetRunnerContext(_ context.Context) map[string]any { + return map[string]any{ "os": goOsToActionOs(runtime.GOOS), "arch": goArchToActionArch(runtime.GOARCH), "temp": e.TmpDir, diff --git a/act/container/linux_container_environment_extensions.go b/act/container/linux_container_environment_extensions.go index 6ba30f1d..6bf4c2b1 100644 --- a/act/container/linux_container_environment_extensions.go +++ b/act/container/linux_container_environment_extensions.go @@ -76,8 +76,8 @@ func (*LinuxContainerEnvironmentExtensions) JoinPathVariable(paths ...string) st return strings.Join(paths, ":") } -func (l *LinuxContainerEnvironmentExtensions) GetRunnerContext(ctx context.Context) map[string]interface{} { - return map[string]interface{}{ +func (l *LinuxContainerEnvironmentExtensions) GetRunnerContext(ctx context.Context) map[string]any { + return map[string]any{ "os": "Linux", "arch": RunnerArch(ctx), "temp": "/tmp", diff --git a/act/exprparser/functions.go b/act/exprparser/functions.go index 297df879..b0d383e5 100644 --- a/act/exprparser/functions.go +++ b/act/exprparser/functions.go @@ -165,12 +165,12 @@ func (impl *interperterImpl) toJSON(value reflect.Value) (string, error) { return string(json), nil } -func (impl *interperterImpl) fromJSON(value reflect.Value) (interface{}, error) { +func (impl *interperterImpl) fromJSON(value reflect.Value) (any, error) { if value.Kind() != reflect.String { return nil, fmt.Errorf("Cannot parse non-string type %v as JSON", value.Kind()) } - var data interface{} + var data any err := json.Unmarshal([]byte(value.String()), &data) if err != nil { diff --git a/act/exprparser/functions_test.go b/act/exprparser/functions_test.go index 8150d488..827eca61 100644 --- a/act/exprparser/functions_test.go +++ b/act/exprparser/functions_test.go @@ -11,7 +11,7 @@ import ( func TestFunctionContains(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"contains('search', 'item') }}", false, "contains-str-str"}, @@ -58,7 +58,7 @@ func TestFunctionContains(t *testing.T) { func TestFunctionStartsWith(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"startsWith('search', 'se') }}", true, "startswith-string"}, @@ -90,7 +90,7 @@ func TestFunctionStartsWith(t *testing.T) { func TestFunctionEndsWith(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"endsWith('search', 'ch') }}", true, "endsWith-string"}, @@ -122,7 +122,7 @@ func TestFunctionEndsWith(t *testing.T) { func TestFunctionJoin(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"join(fromJSON('[\"a\", \"b\"]'), ',')", "a,b", "join-arr"}, @@ -152,7 +152,7 @@ func TestFunctionJoin(t *testing.T) { func TestFunctionToJSON(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"toJSON(env) }}", "{\n \"key\": \"value\"\n}", "toJSON"}, @@ -181,10 +181,10 @@ func TestFunctionToJSON(t *testing.T) { func TestFunctionFromJSON(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ - {"fromJSON('{\"foo\":\"bar\"}') }}", map[string]interface{}{ + {"fromJSON('{\"foo\":\"bar\"}') }}", map[string]any{ "foo": "bar", }, "fromJSON"}, } @@ -207,7 +207,7 @@ func TestFunctionFromJSON(t *testing.T) { func TestFunctionHashFiles(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"hashFiles('**/non-extant-files') }}", "", "hash-non-existing-file"}, @@ -237,8 +237,8 @@ func TestFunctionHashFiles(t *testing.T) { func TestFunctionFormat(t *testing.T) { table := []struct { input string - expected interface{} - error interface{} + expected any + error any name string }{ {"format('text')", "text", nil, "format-plain-string"}, diff --git a/act/exprparser/interpreter.go b/act/exprparser/interpreter.go index 5e9dd1cd..155296da 100644 --- a/act/exprparser/interpreter.go +++ b/act/exprparser/interpreter.go @@ -17,14 +17,14 @@ type EvaluationEnvironment struct { Job *model.JobContext Jobs *map[string]*model.WorkflowCallResult Steps map[string]*model.StepResult - Runner map[string]interface{} + Runner map[string]any Secrets map[string]string Vars map[string]string - Strategy map[string]interface{} - Matrix map[string]interface{} + Strategy map[string]any + Matrix map[string]any Needs map[string]Needs - Inputs map[string]interface{} - HashFiles func([]reflect.Value) (interface{}, error) + Inputs map[string]any + HashFiles func([]reflect.Value) (any, error) } type Needs struct { @@ -63,7 +63,7 @@ func (dsc DefaultStatusCheck) String() string { } type Interpreter interface { - Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (interface{}, error) + Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (any, error) } type interperterImpl struct { @@ -78,7 +78,7 @@ func NewInterpeter(env *EvaluationEnvironment, config Config) Interpreter { } } -func (impl *interperterImpl) Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (interface{}, error) { +func (impl *interperterImpl) Evaluate(input string, defaultStatusCheck DefaultStatusCheck) (any, error) { input = strings.TrimPrefix(input, "${{") if defaultStatusCheck != DefaultStatusCheckNone && input == "" { input = "success()" @@ -117,7 +117,7 @@ func (impl *interperterImpl) Evaluate(input string, defaultStatusCheck DefaultSt return result, err2 } -func (impl *interperterImpl) evaluateNode(exprNode actionlint.ExprNode) (interface{}, error) { +func (impl *interperterImpl) evaluateNode(exprNode actionlint.ExprNode) (any, error) { switch node := exprNode.(type) { case *actionlint.VariableNode: return impl.evaluateVariable(node) @@ -150,7 +150,7 @@ func (impl *interperterImpl) evaluateNode(exprNode actionlint.ExprNode) (interfa } } -func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableNode) (interface{}, error) { +func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableNode) (any, error) { switch strings.ToLower(variableNode.Name) { case "github": return impl.env.Github, nil @@ -192,7 +192,7 @@ func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableN } } -func (impl *interperterImpl) evaluateIndexAccess(indexAccessNode *actionlint.IndexAccessNode) (interface{}, error) { +func (impl *interperterImpl) evaluateIndexAccess(indexAccessNode *actionlint.IndexAccessNode) (any, error) { left, err := impl.evaluateNode(indexAccessNode.Operand) if err != nil { return nil, err @@ -240,7 +240,7 @@ func (impl *interperterImpl) evaluateObjectDeref(objectDerefNode *actionlint.Obj return impl.getPropertyValue(reflect.ValueOf(left), objectDerefNode.Property) } -func (impl *interperterImpl) evaluateArrayDeref(arrayDerefNode *actionlint.ArrayDerefNode) (interface{}, error) { +func (impl *interperterImpl) evaluateArrayDeref(arrayDerefNode *actionlint.ArrayDerefNode) (any, error) { left, err := impl.evaluateNode(arrayDerefNode.Receiver) if err != nil { return nil, err @@ -249,7 +249,7 @@ func (impl *interperterImpl) evaluateArrayDeref(arrayDerefNode *actionlint.Array return impl.getSafeValue(reflect.ValueOf(left)), nil } -func (impl *interperterImpl) getPropertyValue(left reflect.Value, property string) (value interface{}, err error) { +func (impl *interperterImpl) getPropertyValue(left reflect.Value, property string) (value any, err error) { switch left.Kind() { case reflect.Ptr: return impl.getPropertyValue(left.Elem(), property) @@ -303,7 +303,7 @@ func (impl *interperterImpl) getPropertyValue(left reflect.Value, property strin return nil, nil case reflect.Slice: - var values []interface{} + var values []any for i := 0; i < left.Len(); i++ { value, err := impl.getPropertyValue(left.Index(i).Elem(), property) @@ -343,7 +343,7 @@ func (impl *interperterImpl) getPropertyValueDereferenced(left reflect.Value, pr return nil, nil } -func (impl *interperterImpl) getMapValue(value reflect.Value) (interface{}, error) { +func (impl *interperterImpl) getMapValue(value reflect.Value) (any, error) { if value.Kind() == reflect.Ptr { return impl.getMapValue(value.Elem()) } @@ -351,7 +351,7 @@ func (impl *interperterImpl) getMapValue(value reflect.Value) (interface{}, erro return value.Interface(), nil } -func (impl *interperterImpl) evaluateNot(notNode *actionlint.NotOpNode) (interface{}, error) { +func (impl *interperterImpl) evaluateNot(notNode *actionlint.NotOpNode) (any, error) { operand, err := impl.evaluateNode(notNode.Operand) if err != nil { return nil, err @@ -360,7 +360,7 @@ func (impl *interperterImpl) evaluateNot(notNode *actionlint.NotOpNode) (interfa return !IsTruthy(operand), nil } -func (impl *interperterImpl) evaluateCompare(compareNode *actionlint.CompareOpNode) (interface{}, error) { +func (impl *interperterImpl) evaluateCompare(compareNode *actionlint.CompareOpNode) (any, error) { left, err := impl.evaluateNode(compareNode.Left) if err != nil { return nil, err @@ -377,7 +377,7 @@ func (impl *interperterImpl) evaluateCompare(compareNode *actionlint.CompareOpNo return impl.compareValues(leftValue, rightValue, compareNode.Kind) } -func (impl *interperterImpl) compareValues(leftValue, rightValue reflect.Value, kind actionlint.CompareOpNodeKind) (interface{}, error) { +func (impl *interperterImpl) compareValues(leftValue, rightValue reflect.Value, kind actionlint.CompareOpNodeKind) (any, error) { if leftValue.Kind() != rightValue.Kind() { if !impl.isNumber(leftValue) { leftValue = impl.coerceToNumber(leftValue) @@ -527,7 +527,7 @@ func (impl *interperterImpl) compareNumber(left, right float64, kind actionlint. } } -func IsTruthy(input interface{}) bool { +func IsTruthy(input any) bool { value := reflect.ValueOf(input) switch value.Kind() { case reflect.Bool: @@ -563,7 +563,7 @@ func (impl *interperterImpl) isNumber(value reflect.Value) bool { } } -func (impl *interperterImpl) getSafeValue(value reflect.Value) interface{} { +func (impl *interperterImpl) getSafeValue(value reflect.Value) any { switch value.Kind() { case reflect.Invalid: return nil @@ -577,7 +577,7 @@ func (impl *interperterImpl) getSafeValue(value reflect.Value) interface{} { return value.Interface() } -func (impl *interperterImpl) evaluateLogicalCompare(compareNode *actionlint.LogicalOpNode) (interface{}, error) { +func (impl *interperterImpl) evaluateLogicalCompare(compareNode *actionlint.LogicalOpNode) (any, error) { left, err := impl.evaluateNode(compareNode.Left) if err != nil { return nil, err @@ -606,7 +606,7 @@ func (impl *interperterImpl) evaluateLogicalCompare(compareNode *actionlint.Logi return nil, fmt.Errorf("Unable to compare incompatibles types '%s' and '%s'", leftValue.Kind(), rightValue.Kind()) } -func (impl *interperterImpl) evaluateFuncCall(funcCallNode *actionlint.FuncCallNode) (interface{}, error) { +func (impl *interperterImpl) evaluateFuncCall(funcCallNode *actionlint.FuncCallNode) (any, error) { args := make([]reflect.Value, 0) for _, arg := range funcCallNode.Args { diff --git a/act/exprparser/interpreter_test.go b/act/exprparser/interpreter_test.go index 6233d907..248a007c 100644 --- a/act/exprparser/interpreter_test.go +++ b/act/exprparser/interpreter_test.go @@ -11,7 +11,7 @@ import ( func TestLiterals(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"true", true, "true"}, @@ -40,7 +40,7 @@ func TestLiterals(t *testing.T) { func TestOperators(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string error string }{ @@ -68,7 +68,7 @@ func TestOperators(t *testing.T) { {`true && false`, false, "and", ""}, {`true || false`, true, "or", ""}, {`fromJSON('{}') && true`, true, "and-boolean-object", ""}, - {`fromJSON('{}') || false`, make(map[string]interface{}), "or-boolean-object", ""}, + {`fromJSON('{}') || false`, make(map[string]any), "or-boolean-object", ""}, {"github.event.commits[0].author.username != github.event.commits[1].author.username", true, "property-comparison1", ""}, {"github.event.commits[0].author.username1 != github.event.commits[1].author.username", true, "property-comparison2", ""}, {"github.event.commits[0].author.username != github.event.commits[1].author.username1", true, "property-comparison3", ""}, @@ -79,15 +79,15 @@ func TestOperators(t *testing.T) { env := &EvaluationEnvironment{ Github: &model.GithubContext{ Action: "push", - Event: map[string]interface{}{ - "commits": []interface{}{ - map[string]interface{}{ - "author": map[string]interface{}{ + Event: map[string]any{ + "commits": []any{ + map[string]any{ + "author": map[string]any{ "username": "someone", }, }, - map[string]interface{}{ - "author": map[string]interface{}{ + map[string]any{ + "author": map[string]any{ "username": "someone-else", }, }, @@ -114,7 +114,7 @@ func TestOperators(t *testing.T) { func TestOperatorsCompare(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"!null", true, "not-null"}, @@ -162,7 +162,7 @@ func TestOperatorsCompare(t *testing.T) { func TestOperatorsBooleanEvaluation(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ // true && @@ -529,7 +529,7 @@ func TestOperatorsBooleanEvaluation(t *testing.T) { func TestContexts(t *testing.T) { table := []struct { input string - expected interface{} + expected any name string }{ {"github.action", "push", "github-context"}, @@ -588,7 +588,7 @@ func TestContexts(t *testing.T) { Conclusion: model.StepStatusSkipped, }, }, - Runner: map[string]interface{}{ + Runner: map[string]any{ "os": "Linux", "temp": "/tmp", "tool_cache": "/opt/hostedtoolcache", @@ -599,10 +599,10 @@ func TestContexts(t *testing.T) { Vars: map[string]string{ "name": "value", }, - Strategy: map[string]interface{}{ + Strategy: map[string]any{ "fail-fast": true, }, - Matrix: map[string]interface{}{ + Matrix: map[string]any{ "os": "Linux", }, Needs: map[string]Needs{ @@ -619,7 +619,7 @@ func TestContexts(t *testing.T) { Result: "success", }, }, - Inputs: map[string]interface{}{ + Inputs: map[string]any{ "name": "value", }, } diff --git a/act/filecollector/file_collector_test.go b/act/filecollector/file_collector_test.go index ec5871e1..0437c034 100644 --- a/act/filecollector/file_collector_test.go +++ b/act/filecollector/file_collector_test.go @@ -26,7 +26,7 @@ func (mfs *memoryFs) walk(root string, fn filepath.WalkFunc) error { if err != nil { return err } - for i := 0; i < len(dir); i++ { + for i := range dir { filename := filepath.Join(root, dir[i].Name()) err = fn(filename, dir[i], nil) if dir[i].IsDir() { diff --git a/act/jobparser/evaluator.go b/act/jobparser/evaluator.go index 16f520b1..ac05cfe0 100644 --- a/act/jobparser/evaluator.go +++ b/act/jobparser/evaluator.go @@ -19,7 +19,7 @@ func NewExpressionEvaluator(interpreter exprparser.Interpreter) *ExpressionEvalu return &ExpressionEvaluator{interpreter: interpreter} } -func (ee ExpressionEvaluator) evaluate(in string, defaultStatusCheck exprparser.DefaultStatusCheck) (interface{}, error) { +func (ee ExpressionEvaluator) evaluate(in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) { evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck) return evaluated, err diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go index 82963129..d4d92bfb 100644 --- a/act/jobparser/interpeter.go +++ b/act/jobparser/interpeter.go @@ -12,13 +12,13 @@ import ( func NewInterpeter( jobID string, job *model.Job, - matrix map[string]interface{}, + matrix map[string]any, gitCtx *model.GithubContext, results map[string]*JobResult, vars map[string]string, - inputs map[string]interface{}, + inputs map[string]any, ) exprparser.Interpreter { - strategy := make(map[string]interface{}) + strategy := make(map[string]any) if job.Strategy != nil { strategy["fail-fast"] = job.Strategy.FailFast strategy["max-parallel"] = job.Strategy.MaxParallel diff --git a/act/jobparser/jobparser.go b/act/jobparser/jobparser.go index c369d30e..00dec363 100644 --- a/act/jobparser/jobparser.go +++ b/act/jobparser/jobparser.go @@ -103,7 +103,7 @@ type parseContext struct { type ParseOption func(c *parseContext) -func getMatrixes(job *model.Job) ([]map[string]interface{}, error) { +func getMatrixes(job *model.Job) ([]map[string]any, error) { ret, err := job.GetMatrixes() if err != nil { return nil, fmt.Errorf("GetMatrixes: %w", err) @@ -114,13 +114,13 @@ func getMatrixes(job *model.Job) ([]map[string]interface{}, error) { return ret, nil } -func encodeMatrix(matrix map[string]interface{}) yaml.Node { +func encodeMatrix(matrix map[string]any) yaml.Node { if len(matrix) == 0 { return yaml.Node{} } - value := map[string][]interface{}{} + value := map[string][]any{} for k, v := range matrix { - value[k] = []interface{}{v} + value[k] = []any{v} } node := yaml.Node{} _ = node.Encode(value) @@ -137,7 +137,7 @@ func encodeRunsOn(runsOn []string) yaml.Node { return node } -func nameWithMatrix(name string, m map[string]interface{}) string { +func nameWithMatrix(name string, m map[string]any) string { if len(m) == 0 { return name } @@ -145,7 +145,7 @@ func nameWithMatrix(name string, m map[string]interface{}) string { return name + " " + matrixName(m) } -func matrixName(m map[string]interface{}) string { +func matrixName(m map[string]any) string { ks := make([]string, 0, len(m)) for k := range m { ks = append(ks, k) diff --git a/act/jobparser/model.go b/act/jobparser/model.go index 16cfc9fc..dd446596 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -81,7 +81,7 @@ type Job struct { Defaults Defaults `yaml:"defaults,omitempty"` Outputs map[string]string `yaml:"outputs,omitempty"` Uses string `yaml:"uses,omitempty"` - With map[string]interface{} `yaml:"with,omitempty"` + With map[string]any `yaml:"with,omitempty"` RawSecrets yaml.Node `yaml:"secrets,omitempty"` RawConcurrency *model.RawConcurrency `yaml:"concurrency,omitempty"` } @@ -284,7 +284,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { {Name: val}, }, nil case yaml.SequenceNode: - var val []interface{} + var val []any err := rawOn.Decode(&val) if err != nil { return nil, err @@ -300,7 +300,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { } return res, nil case yaml.MappingNode: - events, triggers, err := parseMappingNode[interface{}](rawOn) + events, triggers, err := parseMappingNode[any](rawOn) if err != nil { return nil, err } @@ -325,7 +325,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { Name: k, acts: map[string][]string{}, }) - case map[string]interface{}: + case map[string]any: acts := make(map[string][]string, len(t)) for act, branches := range t { switch b := branches.(type) { @@ -333,7 +333,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { acts[act] = []string{b} case []string: acts[act] = b - case []interface{}: + case []any: acts[act] = make([]string, len(b)) for i, v := range b { var ok bool @@ -341,7 +341,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { return nil, fmt.Errorf("unknown on type: %#v", branches) } } - case map[string]interface{}: + case map[string]any: if isInvalidOnType(k, act) { return nil, fmt.Errorf("unknown on type: %#v", v) } @@ -356,13 +356,13 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { Name: k, acts: acts, }) - case []interface{}: + case []any: if k != "schedule" { return nil, fmt.Errorf("unknown on type: %#v", v) } schedules := make([]map[string]string, len(t)) for i, tt := range t { - vv, ok := tt.(map[string]interface{}) + vv, ok := tt.(map[string]any) if !ok { return nil, fmt.Errorf("unknown on type: %#v", v) } @@ -431,7 +431,7 @@ func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) { return scalars, datas, nil } -func asString(v interface{}) string { +func asString(v any) string { if v == nil { return "" } else if s, ok := v.(string); ok { diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index 328d29af..684701c4 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -261,66 +261,66 @@ func TestParseMappingNode(t *testing.T) { tests := []struct { input string scalars []string - datas []interface{} + datas []any }{ { input: "on:\n push:\n branches:\n - master", scalars: []string{"push"}, - datas: []interface{}{ - map[string]interface{}{ - "branches": []interface{}{"master"}, + datas: []any{ + map[string]any{ + "branches": []any{"master"}, }, }, }, { input: "on:\n branch_protection_rule:\n types: [created, deleted]", scalars: []string{"branch_protection_rule"}, - datas: []interface{}{ - map[string]interface{}{ - "types": []interface{}{"created", "deleted"}, + datas: []any{ + map[string]any{ + "types": []any{"created", "deleted"}, }, }, }, { input: "on:\n project:\n types: [created, deleted]\n milestone:\n types: [opened, deleted]", scalars: []string{"project", "milestone"}, - datas: []interface{}{ - map[string]interface{}{ - "types": []interface{}{"created", "deleted"}, + datas: []any{ + map[string]any{ + "types": []any{"created", "deleted"}, }, - map[string]interface{}{ - "types": []interface{}{"opened", "deleted"}, + map[string]any{ + "types": []any{"opened", "deleted"}, }, }, }, { input: "on:\n pull_request:\n types:\n - opened\n branches:\n - 'releases/**'", scalars: []string{"pull_request"}, - datas: []interface{}{ - map[string]interface{}{ - "types": []interface{}{"opened"}, - "branches": []interface{}{"releases/**"}, + datas: []any{ + map[string]any{ + "types": []any{"opened"}, + "branches": []any{"releases/**"}, }, }, }, { input: "on:\n push:\n branches:\n - main\n pull_request:\n types:\n - opened\n branches:\n - '**'", scalars: []string{"push", "pull_request"}, - datas: []interface{}{ - map[string]interface{}{ - "branches": []interface{}{"main"}, + datas: []any{ + map[string]any{ + "branches": []any{"main"}, }, - map[string]interface{}{ - "types": []interface{}{"opened"}, - "branches": []interface{}{"**"}, + map[string]any{ + "types": []any{"opened"}, + "branches": []any{"**"}, }, }, }, { input: "on:\n schedule:\n - cron: '20 6 * * *'", scalars: []string{"schedule"}, - datas: []interface{}{ - []interface{}{map[string]interface{}{ + datas: []any{ + []any{map[string]any{ "cron": "20 6 * * *", }}, }, @@ -332,7 +332,7 @@ func TestParseMappingNode(t *testing.T) { workflow, err := model.ReadWorkflow(strings.NewReader(test.input), false) assert.NoError(t, err) - scalars, datas, err := parseMappingNode[interface{}](&workflow.RawOn) + scalars, datas, err := parseMappingNode[any](&workflow.RawOn) assert.NoError(t, err) assert.EqualValues(t, test.scalars, scalars, fmt.Sprintf("%#v", scalars)) assert.EqualValues(t, test.datas, datas, fmt.Sprintf("%#v", datas)) @@ -423,15 +423,15 @@ func TestEvaluateConcurrency(t *testing.T) { map[string]any{ "workflow": "test_workflow", "ref": "main", - "event": map[string]interface{}{ - "commits": []interface{}{ - map[string]interface{}{ - "author": map[string]interface{}{ + "event": map[string]any{ + "commits": []any{ + map[string]any{ + "author": map[string]any{ "username": "someone", }, }, - map[string]interface{}{ - "author": map[string]interface{}{ + map[string]any{ + "author": map[string]any{ "username": "someone-else", }, }, diff --git a/act/model/action.go b/act/model/action.go index 7616b66b..b174e955 100644 --- a/act/model/action.go +++ b/act/model/action.go @@ -12,7 +12,7 @@ import ( // ActionRunsUsing is the type of runner for the action type ActionRunsUsing string -func (a *ActionRunsUsing) UnmarshalYAML(unmarshal func(interface{}) error) error { +func (a *ActionRunsUsing) UnmarshalYAML(unmarshal func(any) error) error { var using string if err := unmarshal(&using); err != nil { return err diff --git a/act/model/github_context.go b/act/model/github_context.go index 4b1585ae..d23a6dd8 100644 --- a/act/model/github_context.go +++ b/act/model/github_context.go @@ -10,39 +10,39 @@ import ( ) type GithubContext struct { - Event map[string]interface{} `json:"event"` - EventPath string `json:"event_path"` - Workflow string `json:"workflow"` - RunAttempt string `json:"run_attempt"` - RunID string `json:"run_id"` - RunNumber string `json:"run_number"` - Actor string `json:"actor"` - Repository string `json:"repository"` - EventName string `json:"event_name"` - Sha string `json:"sha"` - Ref string `json:"ref"` - RefName string `json:"ref_name"` - RefType string `json:"ref_type"` - HeadRef string `json:"head_ref"` - BaseRef string `json:"base_ref"` - Token string `json:"token"` - Workspace string `json:"workspace"` - Action string `json:"action"` - ActionPath string `json:"action_path"` - ActionRef string `json:"action_ref"` - ActionRepository string `json:"action_repository"` - Job string `json:"job"` - JobName string `json:"job_name"` - RepositoryOwner string `json:"repository_owner"` - RetentionDays string `json:"retention_days"` - RunnerPerflog string `json:"runner_perflog"` - RunnerTrackingID string `json:"runner_tracking_id"` - ServerURL string `json:"server_url"` - APIURL string `json:"api_url"` - GraphQLURL string `json:"graphql_url"` + Event map[string]any `json:"event"` + EventPath string `json:"event_path"` + Workflow string `json:"workflow"` + RunAttempt string `json:"run_attempt"` + RunID string `json:"run_id"` + RunNumber string `json:"run_number"` + Actor string `json:"actor"` + Repository string `json:"repository"` + EventName string `json:"event_name"` + Sha string `json:"sha"` + Ref string `json:"ref"` + RefName string `json:"ref_name"` + RefType string `json:"ref_type"` + HeadRef string `json:"head_ref"` + BaseRef string `json:"base_ref"` + Token string `json:"token"` + Workspace string `json:"workspace"` + Action string `json:"action"` + ActionPath string `json:"action_path"` + ActionRef string `json:"action_ref"` + ActionRepository string `json:"action_repository"` + Job string `json:"job"` + JobName string `json:"job_name"` + RepositoryOwner string `json:"repository_owner"` + RetentionDays string `json:"retention_days"` + RunnerPerflog string `json:"runner_perflog"` + RunnerTrackingID string `json:"runner_tracking_id"` + ServerURL string `json:"server_url"` + APIURL string `json:"api_url"` + GraphQLURL string `json:"graphql_url"` } -func asString(v interface{}) string { +func asString(v any) string { if v == nil { return "" } else if s, ok := v.(string); ok { @@ -51,7 +51,7 @@ func asString(v interface{}) string { return "" } -func nestedMapLookup(m map[string]interface{}, ks ...string) (rval interface{}) { +func nestedMapLookup(m map[string]any, ks ...string) (rval any) { var ok bool if len(ks) == 0 { // degenerate input @@ -61,20 +61,20 @@ func nestedMapLookup(m map[string]interface{}, ks ...string) (rval interface{}) return nil } else if len(ks) == 1 { // we've reached the final key return rval - } else if m, ok = rval.(map[string]interface{}); !ok { + } else if m, ok = rval.(map[string]any); !ok { return nil } // 1+ more keys return nestedMapLookup(m, ks[1:]...) } -func withDefaultBranch(ctx context.Context, b string, event map[string]interface{}) map[string]interface{} { +func withDefaultBranch(ctx context.Context, b string, event map[string]any) map[string]any { repoI, ok := event["repository"] if !ok { - repoI = make(map[string]interface{}) + repoI = make(map[string]any) } - repo, ok := repoI.(map[string]interface{}) + repo, ok := repoI.(map[string]any) if !ok { common.Logger(ctx).Warnf("unable to set default branch to %v", b) return event diff --git a/act/model/github_context_test.go b/act/model/github_context_test.go index 8e7ea487..bf3ecad9 100644 --- a/act/model/github_context_test.go +++ b/act/model/github_context_test.go @@ -27,19 +27,19 @@ func TestSetRef(t *testing.T) { tables := []struct { eventName string - event map[string]interface{} + event map[string]any ref string refName string }{ { eventName: "pull_request_target", - event: map[string]interface{}{}, + event: map[string]any{}, ref: "refs/heads/master", refName: "master", }, { eventName: "pull_request", - event: map[string]interface{}{ + event: map[string]any{ "number": 1234., }, ref: "refs/pull/1234/merge", @@ -47,8 +47,8 @@ func TestSetRef(t *testing.T) { }, { eventName: "deployment", - event: map[string]interface{}{ - "deployment": map[string]interface{}{ + event: map[string]any{ + "deployment": map[string]any{ "ref": "refs/heads/somebranch", }, }, @@ -57,8 +57,8 @@ func TestSetRef(t *testing.T) { }, { eventName: "release", - event: map[string]interface{}{ - "release": map[string]interface{}{ + event: map[string]any{ + "release": map[string]any{ "tag_name": "v1.0.0", }, }, @@ -67,7 +67,7 @@ func TestSetRef(t *testing.T) { }, { eventName: "push", - event: map[string]interface{}{ + event: map[string]any{ "ref": "refs/heads/somebranch", }, ref: "refs/heads/somebranch", @@ -75,8 +75,8 @@ func TestSetRef(t *testing.T) { }, { eventName: "unknown", - event: map[string]interface{}{ - "repository": map[string]interface{}{ + event: map[string]any{ + "repository": map[string]any{ "default_branch": "main", }, }, @@ -85,7 +85,7 @@ func TestSetRef(t *testing.T) { }, { eventName: "no-event", - event: map[string]interface{}{}, + event: map[string]any{}, ref: "refs/heads/master", refName: "master", }, @@ -114,7 +114,7 @@ func TestSetRef(t *testing.T) { ghc := &GithubContext{ EventName: "no-default-branch", - Event: map[string]interface{}{}, + Event: map[string]any{}, } ghc.SetRef(t.Context(), "", "/some/dir") @@ -141,14 +141,14 @@ func TestSetSha(t *testing.T) { tables := []struct { eventName string - event map[string]interface{} + event map[string]any sha string }{ { eventName: "pull_request_target", - event: map[string]interface{}{ - "pull_request": map[string]interface{}{ - "base": map[string]interface{}{ + event: map[string]any{ + "pull_request": map[string]any{ + "base": map[string]any{ "sha": "pr-base-sha", }, }, @@ -157,15 +157,15 @@ func TestSetSha(t *testing.T) { }, { eventName: "pull_request", - event: map[string]interface{}{ + event: map[string]any{ "number": 1234., }, sha: "1234fakesha", }, { eventName: "deployment", - event: map[string]interface{}{ - "deployment": map[string]interface{}{ + event: map[string]any{ + "deployment": map[string]any{ "sha": "deployment-sha", }, }, @@ -173,12 +173,12 @@ func TestSetSha(t *testing.T) { }, { eventName: "release", - event: map[string]interface{}{}, + event: map[string]any{}, sha: "1234fakesha", }, { eventName: "push", - event: map[string]interface{}{ + event: map[string]any{ "after": "push-sha", "deleted": false, }, @@ -186,12 +186,12 @@ func TestSetSha(t *testing.T) { }, { eventName: "unknown", - event: map[string]interface{}{}, + event: map[string]any{}, sha: "1234fakesha", }, { eventName: "no-event", - event: map[string]interface{}{}, + event: map[string]any{}, sha: "1234fakesha", }, } diff --git a/act/model/planner.go b/act/model/planner.go index 6ea5f753..05f78bbe 100644 --- a/act/model/planner.go +++ b/act/model/planner.go @@ -8,7 +8,7 @@ import ( "os" "path/filepath" "regexp" - "sort" + "slices" log "github.com/sirupsen/logrus" ) @@ -286,11 +286,8 @@ func (wp *workflowPlanner) GetEvents() []string { for _, w := range wp.workflows { found := false for _, e := range events { - for _, we := range w.On() { - if e == we { - found = true - break - } + if slices.Contains(w.On(), e) { + found = true } if found { break @@ -303,9 +300,7 @@ func (wp *workflowPlanner) GetEvents() []string { } // sort the list based on depth of dependencies - sort.Slice(events, func(i, j int) bool { - return events[i] < events[j] - }) + slices.Sort(events) return events } @@ -336,7 +331,7 @@ func (s *Stage) GetJobIDs() []string { // Merge stages with existing stages in plan func (p *Plan) mergeStages(stages []*Stage) { newStages := make([]*Stage, int(math.Max(float64(len(p.Stages)), float64(len(stages))))) - for i := 0; i < len(newStages); i++ { + for i := range newStages { newStages[i] = new(Stage) if i >= len(p.Stages) { newStages[i].Runs = append(newStages[i].Runs, stages[i].Runs...) diff --git a/act/model/workflow.go b/act/model/workflow.go index a490a8dd..82082feb 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -4,9 +4,11 @@ import ( "errors" "fmt" "io" + "maps" "path/filepath" "reflect" "regexp" + "slices" "strconv" "strings" @@ -47,7 +49,7 @@ func (w *Workflow) On() []string { } return val case yaml.MappingNode: - var val map[string]interface{} + var val map[string]any err := w.RawOn.Decode(&val) if err != nil { log.Fatal(err) @@ -61,9 +63,9 @@ func (w *Workflow) On() []string { return nil } -func (w *Workflow) OnEvent(event string) interface{} { +func (w *Workflow) OnEvent(event string) any { if w.RawOn.Kind == yaml.MappingNode { - var val map[string]interface{} + var val map[string]any if !decodeNode(w.RawOn, &val) { return nil } @@ -79,10 +81,10 @@ func (w *Workflow) OnSchedule() []string { } switch val := schedules.(type) { - case []interface{}: + case []any: allSchedules := []string{} for _, v := range val { - for k, cron := range v.(map[string]interface{}) { + for k, cron := range v.(map[string]any) { if k != "cron" { continue } @@ -137,10 +139,8 @@ func (w *Workflow) WorkflowDispatchConfig() *WorkflowDispatch { if !decodeNode(w.RawOn, &val) { return nil } - for _, v := range val { - if v == "workflow_dispatch" { - return &WorkflowDispatch{} - } + if slices.Contains(val, "workflow_dispatch") { + return &WorkflowDispatch{} } case yaml.MappingNode: var val map[string]yaml.Node @@ -215,7 +215,7 @@ type Job struct { Defaults Defaults `yaml:"defaults"` Outputs map[string]string `yaml:"outputs"` Uses string `yaml:"uses"` - With map[string]interface{} `yaml:"with"` + With map[string]any `yaml:"with"` RawSecrets yaml.Node `yaml:"secrets"` Result string } @@ -393,9 +393,9 @@ func (j *Job) Environment() map[string]string { } // Matrix decodes RawMatrix YAML node -func (j *Job) Matrix() map[string][]interface{} { +func (j *Job) Matrix() map[string][]any { if j.Strategy.RawMatrix.Kind == yaml.MappingNode { - var val map[string][]interface{} + var val map[string][]any if !decodeNode(j.Strategy.RawMatrix, &val) { return nil } @@ -406,20 +406,20 @@ func (j *Job) Matrix() map[string][]interface{} { // GetMatrixes returns the matrix cross product // It skips includes and hard fails excludes for non-existing keys -func (j *Job) GetMatrixes() ([]map[string]interface{}, error) { - matrixes := make([]map[string]interface{}, 0) +func (j *Job) GetMatrixes() ([]map[string]any, error) { + matrixes := make([]map[string]any, 0) if j.Strategy != nil { j.Strategy.FailFast = j.Strategy.GetFailFast() j.Strategy.MaxParallel = j.Strategy.GetMaxParallel() if m := j.Matrix(); m != nil { - includes := make([]map[string]interface{}, 0) - extraIncludes := make([]map[string]interface{}, 0) + includes := make([]map[string]any, 0) + extraIncludes := make([]map[string]any, 0) for _, v := range m["include"] { switch t := v.(type) { - case []interface{}: + case []any: for _, i := range t { - i := i.(map[string]interface{}) + i := i.(map[string]any) extraInclude := true for k := range i { if _, ok := m[k]; ok { @@ -432,8 +432,8 @@ func (j *Job) GetMatrixes() ([]map[string]interface{}, error) { extraIncludes = append(extraIncludes, i) } } - case interface{}: - v := v.(map[string]interface{}) + case any: + v := v.(map[string]any) extraInclude := true for k := range v { if _, ok := m[k]; ok { @@ -449,9 +449,9 @@ func (j *Job) GetMatrixes() ([]map[string]interface{}, error) { } delete(m, "include") - excludes := make([]map[string]interface{}, 0) + excludes := make([]map[string]any, 0) for _, e := range m["exclude"] { - e := e.(map[string]interface{}) + e := e.(map[string]any) for k := range e { if _, ok := m[k]; ok { excludes = append(excludes, e) @@ -480,9 +480,7 @@ func (j *Job) GetMatrixes() ([]map[string]interface{}, error) { if commonKeysMatch2(matrix, include, m) { matched = true log.Debugf("Adding include values '%v' to existing entry", include) - for k, v := range include { - matrix[k] = v - } + maps.Copy(matrix, include) } } if !matched { @@ -494,19 +492,19 @@ func (j *Job) GetMatrixes() ([]map[string]interface{}, error) { matrixes = append(matrixes, include) } if len(matrixes) == 0 { - matrixes = append(matrixes, make(map[string]interface{})) + matrixes = append(matrixes, make(map[string]any)) } } else { - matrixes = append(matrixes, make(map[string]interface{})) + matrixes = append(matrixes, make(map[string]any)) } } else { - matrixes = append(matrixes, make(map[string]interface{})) + matrixes = append(matrixes, make(map[string]any)) log.Debugf("Empty Strategy, matrixes=%v", matrixes) } return matrixes, nil } -func commonKeysMatch(a, b map[string]interface{}) bool { +func commonKeysMatch(a, b map[string]any) bool { for aKey, aVal := range a { if bVal, ok := b[aKey]; ok && !reflect.DeepEqual(aVal, bVal) { return false @@ -515,7 +513,7 @@ func commonKeysMatch(a, b map[string]interface{}) bool { return true } -func commonKeysMatch2(a, b map[string]interface{}, m map[string][]interface{}) bool { +func commonKeysMatch2(a, b map[string]any, m map[string][]any) bool { for aKey, aVal := range a { _, useKey := m[aKey] if bVal, ok := b[aKey]; useKey && ok && !reflect.DeepEqual(aVal, bVal) { @@ -778,11 +776,11 @@ func (w *Workflow) GetJobIDs() []string { return ids } -var OnDecodeNodeError = func(node yaml.Node, out interface{}, err error) { +var OnDecodeNodeError = func(node yaml.Node, out any, err error) { log.Errorf("Failed to decode node %v into %T: %v", node, out, err) } -func decodeNode(node yaml.Node, out interface{}) bool { +func decodeNode(node yaml.Node, out any) bool { if err := node.Decode(out); err != nil { if OnDecodeNodeError != nil { OnDecodeNodeError(node, out, err) @@ -825,7 +823,7 @@ func (r *RawConcurrency) UnmarshalYAML(n *yaml.Node) error { return n.Decode((*objectConcurrency)(r)) } -func (r *RawConcurrency) MarshalYAML() (interface{}, error) { +func (r *RawConcurrency) MarshalYAML() (any, error) { if r.RawExpression != "" { return r.RawExpression, nil } diff --git a/act/model/workflow_test.go b/act/model/workflow_test.go index 96f4e004..6859ab8c 100644 --- a/act/model/workflow_test.go +++ b/act/model/workflow_test.go @@ -493,24 +493,24 @@ func TestReadWorkflow_Strategy(t *testing.T) { job := wf.Jobs["strategy-only-max-parallel"] matrixes, err := job.GetMatrixes() assert.NoError(t, err) - assert.Equal(t, matrixes, []map[string]interface{}{{}}) - assert.Equal(t, job.Matrix(), map[string][]interface{}(nil)) + assert.Equal(t, matrixes, []map[string]any{{}}) + assert.Equal(t, job.Matrix(), map[string][]any(nil)) assert.Equal(t, job.Strategy.MaxParallel, 2) assert.Equal(t, job.Strategy.FailFast, true) job = wf.Jobs["strategy-only-fail-fast"] matrixes, err = job.GetMatrixes() assert.NoError(t, err) - assert.Equal(t, matrixes, []map[string]interface{}{{}}) - assert.Equal(t, job.Matrix(), map[string][]interface{}(nil)) + assert.Equal(t, matrixes, []map[string]any{{}}) + assert.Equal(t, job.Matrix(), map[string][]any(nil)) assert.Equal(t, job.Strategy.MaxParallel, 4) assert.Equal(t, job.Strategy.FailFast, false) job = wf.Jobs["strategy-no-matrix"] matrixes, err = job.GetMatrixes() assert.NoError(t, err) - assert.Equal(t, matrixes, []map[string]interface{}{{}}) - assert.Equal(t, job.Matrix(), map[string][]interface{}(nil)) + assert.Equal(t, matrixes, []map[string]any{{}}) + assert.Equal(t, job.Matrix(), map[string][]any(nil)) assert.Equal(t, job.Strategy.MaxParallel, 2) assert.Equal(t, job.Strategy.FailFast, false) @@ -518,7 +518,7 @@ func TestReadWorkflow_Strategy(t *testing.T) { matrixes, err = job.GetMatrixes() assert.NoError(t, err) assert.Equal(t, matrixes, - []map[string]interface{}{ + []map[string]any{ {"datacenter": "site-c", "node-version": "14.x", "site": "staging"}, {"datacenter": "site-c", "node-version": "16.x", "site": "staging"}, {"datacenter": "site-d", "node-version": "16.x", "site": "staging"}, @@ -528,15 +528,15 @@ func TestReadWorkflow_Strategy(t *testing.T) { }, ) assert.Equal(t, job.Matrix(), - map[string][]interface{}{ + map[string][]any{ "datacenter": {"site-c", "site-d"}, "exclude": { - map[string]interface{}{"datacenter": "site-d", "node-version": "14.x", "site": "staging"}, + map[string]any{"datacenter": "site-d", "node-version": "14.x", "site": "staging"}, }, "include": { - map[string]interface{}{"php-version": 5.4}, - map[string]interface{}{"datacenter": "site-a", "node-version": "10.x", "site": "prod"}, - map[string]interface{}{"datacenter": "site-b", "node-version": "12.x", "site": "dev"}, + map[string]any{"php-version": 5.4}, + map[string]any{"datacenter": "site-a", "node-version": "10.x", "site": "prod"}, + map[string]any{"datacenter": "site-b", "node-version": "12.x", "site": "dev"}, }, "node-version": {"14.x", "16.x"}, "site": {"staging"}, diff --git a/act/runner/action.go b/act/runner/action.go index 98b880d1..fdfc6373 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -286,8 +286,8 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, basedir stri var prepImage common.Executor var image string forcePull := false - if strings.HasPrefix(action.Runs.Image, "docker://") { - image = strings.TrimPrefix(action.Runs.Image, "docker://") + if after, ok := strings.CutPrefix(action.Runs.Image, "docker://"); ok { + image = after // Apply forcePull only for prebuild docker images forcePull = rc.Config.ForcePull } else { diff --git a/act/runner/command.go b/act/runner/command.go index 654a0e4c..f936ce15 100644 --- a/act/runner/command.go +++ b/act/runner/command.go @@ -139,8 +139,8 @@ func (rc *RunContext) addPath(ctx context.Context, arg string) { func parseKeyValuePairs(kvPairs, separator string) map[string]string { rtn := make(map[string]string) - kvPairList := strings.Split(kvPairs, separator) - for _, kvPair := range kvPairList { + kvPairList := strings.SplitSeq(kvPairs, separator) + for kvPair := range kvPairList { kv := strings.Split(kvPair, "=") if len(kv) == 2 { rtn[kv[0]] = kv[1] diff --git a/act/runner/command_test.go b/act/runner/command_test.go index 75149b11..51f4198a 100644 --- a/act/runner/command_test.go +++ b/act/runner/command_test.go @@ -163,7 +163,7 @@ func TestCommandAddmaskUsemask(t *testing.T) { re := captureOutput(t, func() { ctx := t.Context() - ctx = WithJobLogger(ctx, "0", "testjob", config, &rc.Masks, map[string]interface{}{}) + ctx = WithJobLogger(ctx, "0", "testjob", config, &rc.Masks, map[string]any{}) handler := rc.commandHandler(ctx) handler("::add-mask::secret\n") diff --git a/act/runner/expression.go b/act/runner/expression.go index 153f6ed7..4fa16e8f 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -4,6 +4,7 @@ import ( "bytes" "context" "fmt" + "maps" "path" "reflect" "regexp" @@ -21,7 +22,7 @@ import ( // ExpressionEvaluator is the interface for evaluating expressions type ExpressionEvaluator interface { - evaluate(context.Context, string, exprparser.DefaultStatusCheck) (interface{}, error) + evaluate(context.Context, string, exprparser.DefaultStatusCheck) (any, error) EvaluateYamlNode(context.Context, *yaml.Node) error Interpolate(context.Context, string) string } @@ -36,7 +37,7 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map // todo: cleanup EvaluationEnvironment creation using := make(map[string]exprparser.Needs) - strategy := make(map[string]interface{}) + strategy := make(map[string]any) if rc.Run != nil { job := rc.Run.Job() if job != nil && job.Strategy != nil { @@ -64,9 +65,7 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map result := model.WorkflowCallResult{ Outputs: map[string]string{}, } - for k, v := range job.Outputs { - result.Outputs[k] = v - } + maps.Copy(result.Outputs, job.Outputs) workflowCallResult[jobName] = &result } } @@ -120,10 +119,10 @@ func (rc *RunContext) NewStepExpressionEvaluatorExt(ctx context.Context, step st return rc.newStepExpressionEvaluator(ctx, step, ghc, getEvaluatorInputs(ctx, rc, step, ghc)) } -func (rc *RunContext) newStepExpressionEvaluator(ctx context.Context, step step, ghc *model.GithubContext, inputs map[string]interface{}) ExpressionEvaluator { +func (rc *RunContext) newStepExpressionEvaluator(ctx context.Context, step step, ghc *model.GithubContext, inputs map[string]any) ExpressionEvaluator { // todo: cleanup EvaluationEnvironment creation job := rc.Run.Job() - strategy := make(map[string]interface{}) + strategy := make(map[string]any) if job.Strategy != nil { strategy["fail-fast"] = job.Strategy.FailFast strategy["max-parallel"] = job.Strategy.MaxParallel @@ -167,8 +166,8 @@ func (rc *RunContext) newStepExpressionEvaluator(ctx context.Context, step step, } } -func getHashFilesFunction(ctx context.Context, rc *RunContext) func(v []reflect.Value) (interface{}, error) { - hashFiles := func(v []reflect.Value) (interface{}, error) { +func getHashFilesFunction(ctx context.Context, rc *RunContext) func(v []reflect.Value) (any, error) { + hashFiles := func(v []reflect.Value) (any, error) { if rc.JobContainer != nil { timeed, cancel := context.WithTimeout(ctx, time.Minute) defer cancel() @@ -192,9 +191,7 @@ func getHashFilesFunction(ctx context.Context, rc *RunContext) func(v []reflect. patterns = append(patterns, s) } env := map[string]string{} - for k, v := range rc.Env { - env[k] = v - } + maps.Copy(env, rc.Env) env["patterns"] = strings.Join(patterns, "\n") if followSymlink { env["followSymbolicLinks"] = "true" @@ -232,7 +229,7 @@ type expressionEvaluator struct { interpreter exprparser.Interpreter } -func (ee expressionEvaluator) evaluate(ctx context.Context, in string, defaultStatusCheck exprparser.DefaultStatusCheck) (interface{}, error) { +func (ee expressionEvaluator) evaluate(ctx context.Context, in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) { logger := common.Logger(ctx) logger.Debugf("evaluating expression '%s'", in) evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck) @@ -479,8 +476,8 @@ func rewriteSubExpression(ctx context.Context, in string, forceFormat bool) (str return out, nil } -func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *model.GithubContext) map[string]interface{} { - inputs := map[string]interface{}{} +func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *model.GithubContext) map[string]any { + inputs := map[string]any{} setupWorkflowInputs(ctx, &inputs, rc) @@ -492,8 +489,8 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod } for k, v := range env { - if strings.HasPrefix(k, "INPUT_") { - inputs[strings.ToLower(strings.TrimPrefix(k, "INPUT_"))] = v + if after, ok := strings.CutPrefix(k, "INPUT_"); ok { + inputs[strings.ToLower(after)] = v } } @@ -533,7 +530,7 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod return inputs } -func setupWorkflowInputs(ctx context.Context, inputs *map[string]interface{}, rc *RunContext) { +func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunContext) { if rc.caller != nil { config := rc.Run.Workflow.WorkflowCallConfig() diff --git a/act/runner/expression_test.go b/act/runner/expression_test.go index 8beea50e..38959288 100644 --- a/act/runner/expression_test.go +++ b/act/runner/expression_test.go @@ -11,7 +11,7 @@ import ( func createRunContext(t *testing.T) *RunContext { var yml yaml.Node - err := yml.Encode(map[string][]interface{}{ + err := yml.Encode(map[string][]any{ "os": {"Linux", "Windows"}, "foo": {"bar", "baz"}, }) @@ -43,7 +43,7 @@ func createRunContext(t *testing.T) *RunContext { }, }, }, - Matrix: map[string]interface{}{ + Matrix: map[string]any{ "os": "Linux", "foo": "bar", }, @@ -79,7 +79,7 @@ func TestExpressionEvaluateRunContext(t *testing.T) { tables := []struct { in string - out interface{} + out any errMesg string }{ {" 1 ", 1, ""}, @@ -133,7 +133,6 @@ func TestExpressionEvaluateRunContext(t *testing.T) { } for _, table := range tables { - table := table t.Run(table.in, func(t *testing.T) { assertObject := assert.New(t) out, err := ee.evaluate(t.Context(), table.in, exprparser.DefaultStatusCheckNone) @@ -158,7 +157,7 @@ func TestExpressionEvaluateStep(t *testing.T) { tables := []struct { in string - out interface{} + out any errMesg string }{ {"steps.idwithnothing.conclusion", model.StepStatusSuccess.String(), ""}, @@ -173,7 +172,6 @@ func TestExpressionEvaluateStep(t *testing.T) { } for _, table := range tables { - table := table t.Run(table.in, func(t *testing.T) { assertObject := assert.New(t) out, err := ee.evaluate(t.Context(), table.in, exprparser.DefaultStatusCheckNone) @@ -256,7 +254,6 @@ func TestExpressionInterpolate(t *testing.T) { } for _, table := range tables { - table := table t.Run("interpolate", func(t *testing.T) { assertObject := assert.New(t) out := ee.Interpolate(t.Context(), table.in) diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index 844d2fed..d407b379 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -11,7 +11,7 @@ import ( ) type jobInfo interface { - matrix() map[string]interface{} + matrix() map[string]any steps() []*model.Step startContainer() common.Executor stopContainer() common.Executor @@ -56,7 +56,6 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo }) for i, stepModel := range infoSteps { - stepModel := stepModel if stepModel == nil { return func(ctx context.Context) error { return fmt.Errorf("invalid Step %v: missing run or uses key", i) diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index b9c434a1..6e8a452e 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -4,6 +4,7 @@ import ( "context" "fmt" "io" + "slices" "testing" "code.forgejo.org/forgejo/runner/v9/act/common" @@ -38,9 +39,9 @@ type jobInfoMock struct { mock.Mock } -func (jim *jobInfoMock) matrix() map[string]interface{} { +func (jim *jobInfoMock) matrix() map[string]any { args := jim.Called() - return args.Get(0).(map[string]interface{}) + return args.Get(0).(map[string]any) } func (jim *jobInfoMock) steps() []*model.Step { @@ -233,12 +234,7 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { } contains := func(needle string, haystack []string) bool { - for _, item := range haystack { - if item == needle { - return true - } - } - return false + return slices.Contains(haystack, needle) } for _, tt := range table { @@ -273,9 +269,6 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { } for i, stepModel := range tt.steps { - i := i - stepModel := stepModel - sm := &stepMock{} sfm.On("newStep", stepModel, rc).Return(sm, nil) @@ -306,7 +299,7 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { } if len(tt.steps) > 0 { - jim.On("matrix").Return(map[string]interface{}{}) + jim.On("matrix").Return(map[string]any{}) jim.On("interpolateOutputs").Return(func(ctx context.Context) error { executorOrder = append(executorOrder, "interpolateOutputs") diff --git a/act/runner/logger.go b/act/runner/logger.go index fad30b86..07261f27 100644 --- a/act/runner/logger.go +++ b/act/runner/logger.go @@ -73,7 +73,7 @@ func WithJobLoggerFactory(ctx context.Context, factory JobLoggerFactory) context } // WithJobLogger attaches a new logger to context that is aware of steps -func WithJobLogger(ctx context.Context, jobID, jobName string, config *Config, masks *[]string, matrix map[string]interface{}) context.Context { +func WithJobLogger(ctx context.Context, jobID, jobName string, config *Config, masks *[]string, matrix map[string]any) context.Context { ctx = WithMasks(ctx, masks) var logger *logrus.Logger diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 84c03188..2d40f56a 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -11,6 +11,7 @@ import ( "errors" "fmt" "io" + "maps" "os" "path" "path/filepath" @@ -33,7 +34,7 @@ import ( type RunContext struct { Name string Config *Config - Matrix map[string]interface{} + Matrix map[string]any Run *model.Run EventJSON string Env map[string]string @@ -645,9 +646,7 @@ func (rc *RunContext) sh(ctx context.Context, script string) (stdout, stderr str herr := &bytes.Buffer{} env := map[string]string{} - for k, v := range rc.Env { - env[k] = v - } + maps.Copy(env, rc.Env) base := common.MustRandName(8) name := base + ".sh" @@ -912,7 +911,7 @@ func (rc *RunContext) closeContainer() common.Executor { } } -func (rc *RunContext) matrix() map[string]interface{} { +func (rc *RunContext) matrix() map[string]any { return rc.Matrix } @@ -1056,12 +1055,10 @@ func (rc *RunContext) isEnabled(ctx context.Context) (bool, error) { return true, nil } -func mergeMaps(maps ...map[string]string) map[string]string { +func mergeMaps(args ...map[string]string) map[string]string { rtnMap := make(map[string]string) - for _, m := range maps { - for k, v := range m { - rtnMap[k] = v - } + for _, m := range args { + maps.Copy(rtnMap, m) } return rtnMap } @@ -1126,7 +1123,7 @@ func (rc *RunContext) getStepsContext() map[string]*model.StepResult { func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext { logger := common.Logger(ctx) ghc := &model.GithubContext{ - Event: make(map[string]interface{}), + Event: make(map[string]any), Workflow: rc.Run.Workflow.Name, RunAttempt: rc.Config.Env["GITHUB_RUN_ATTEMPT"], RunID: rc.Config.Env["GITHUB_RUN_ID"], @@ -1294,7 +1291,7 @@ func isLocalCheckout(ghc *model.GithubContext, step *model.Step) bool { return true } -func nestedMapLookup(m map[string]interface{}, ks ...string) (rval interface{}) { +func nestedMapLookup(m map[string]any, ks ...string) (rval any) { var ok bool if len(ks) == 0 { // degenerate input @@ -1304,7 +1301,7 @@ func nestedMapLookup(m map[string]interface{}, ks ...string) (rval interface{}) return nil } else if len(ks) == 1 { // we've reached the final key return rval - } else if m, ok = rval.(map[string]interface{}); !ok { + } else if m, ok = rval.(map[string]any); !ok { return nil } // 1+ more keys diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 296afd1b..d60b1322 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -27,7 +27,7 @@ import ( func TestRunContext_EvalBool(t *testing.T) { var yml yaml.Node - err := yml.Encode(map[string][]interface{}{ + err := yml.Encode(map[string][]any{ "os": {"Linux", "Windows"}, "foo": {"bar", "baz"}, }) @@ -55,7 +55,7 @@ func TestRunContext_EvalBool(t *testing.T) { }, }, }, - Matrix: map[string]interface{}{ + Matrix: map[string]any{ "os": "Linux", "foo": "bar", }, @@ -160,7 +160,6 @@ func TestRunContext_EvalBool(t *testing.T) { } for _, table := range tables { - table := table t.Run(table.in, func(t *testing.T) { assertObject := assert.New(t) b, err := EvalBool(t.Context(), rc.ExprEval, table.in, exprparser.DefaultStatusCheckSuccess) @@ -203,11 +202,7 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { isWindows := runtime.GOOS == "windows" for _, testcase := range tests { - // pin for scopelint - testcase := testcase for _, bindWorkDir := range []bool{true, false} { - // pin for scopelint - bindWorkDir := bindWorkDir testBindSuffix := "" if bindWorkDir { testBindSuffix = "Bind" @@ -304,7 +299,7 @@ func TestRunContext_GetGitHubContext(t *testing.T) { }, Name: "GitHubContextTest", CurrentStep: "step", - Matrix: map[string]interface{}{}, + Matrix: map[string]any{}, Env: map[string]string{}, ExtraPath: []string{}, StepResults: map[string]*model.StepResult{}, @@ -363,7 +358,6 @@ func TestRunContext_GetGithubContextRef(t *testing.T) { } for _, data := range table { - data := data t.Run(data.event, func(t *testing.T) { rc := &RunContext{ EventJSON: data.json, diff --git a/act/runner/runner.go b/act/runner/runner.go index 26d30c78..0bf95264 100644 --- a/act/runner/runner.go +++ b/act/runner/runner.go @@ -178,7 +178,7 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor { } } - var matrixes []map[string]interface{} + var matrixes []map[string]any if m, err := job.GetMatrixes(); err != nil { log.Errorf("Error while get job's matrix: %v", err) } else { @@ -198,7 +198,6 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor { } for i, matrix := range matrixes { - matrix := matrix rc := runner.newRunContext(ctx, run, matrix) rc.JobName = rc.Name if len(matrixes) > 1 { @@ -219,10 +218,7 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor { } pipeline = append(pipeline, common.NewParallelExecutor(maxParallel, stageExecutor...)) } - ncpu := runtime.NumCPU() - if 1 > ncpu { - ncpu = 1 - } + ncpu := max(1, runtime.NumCPU()) log.Debugf("Detected CPUs: %d", ncpu) return common.NewParallelExecutor(ncpu, pipeline...)(ctx) }) @@ -244,8 +240,8 @@ func handleFailure(plan *model.Plan) common.Executor { } } -func selectMatrixes(originalMatrixes []map[string]interface{}, targetMatrixValues map[string]map[string]bool) []map[string]interface{} { - matrixes := make([]map[string]interface{}, 0) +func selectMatrixes(originalMatrixes []map[string]any, targetMatrixValues map[string]map[string]bool) []map[string]any { + matrixes := make([]map[string]any, 0) for _, original := range originalMatrixes { flag := true for key, val := range original { @@ -263,7 +259,7 @@ func selectMatrixes(originalMatrixes []map[string]interface{}, targetMatrixValue return matrixes } -func (runner *runnerImpl) newRunContext(ctx context.Context, run *model.Run, matrix map[string]interface{}) *RunContext { +func (runner *runnerImpl) newRunContext(ctx context.Context, run *model.Run, matrix map[string]any) *RunContext { rc := &RunContext{ Config: runner.config, Run: run, diff --git a/act/runner/step.go b/act/runner/step.go index 56352baa..57f37f89 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -6,6 +6,7 @@ import ( "errors" "fmt" "io" + "maps" "path" "strconv" "strings" @@ -316,11 +317,9 @@ func mergeIntoMap(step step, target *map[string]string, maps ...map[string]strin } } -func mergeIntoMapCaseSensitive(target map[string]string, maps ...map[string]string) { - for _, m := range maps { - for k, v := range m { - target[k] = v - } +func mergeIntoMapCaseSensitive(target map[string]string, args ...map[string]string) { + for _, m := range args { + maps.Copy(target, m) } } diff --git a/act/runner/step_action_local.go b/act/runner/step_action_local.go index 79f1a542..e6529cc0 100644 --- a/act/runner/step_action_local.go +++ b/act/runner/step_action_local.go @@ -46,7 +46,7 @@ func (sal *stepActionLocal) main() common.Executor { _, cpath := getContainerActionPaths(sal.Step, path.Join(actionDir, ""), sal.RunContext) return func(filename string) (io.Reader, io.Closer, error) { spath := path.Join(cpath, filename) - for i := 0; i < maxSymlinkDepth; i++ { + for range maxSymlinkDepth { tars, err := sal.RunContext.JobContainer.GetContainerArchive(ctx, spath) if errors.Is(err, fs.ErrNotExist) { return nil, nil, err diff --git a/act/runner/step_action_local_test.go b/act/runner/step_action_local_test.go index 8bc5d50b..f6e0a361 100644 --- a/act/runner/step_action_local_test.go +++ b/act/runner/step_action_local_test.go @@ -258,7 +258,7 @@ func TestStepActionLocalPost(t *testing.T) { sal.RunContext.ExprEval = sal.RunContext.NewExpressionEvaluator(ctx) if tt.mocks.exec { - suffixMatcher := func(suffix string) interface{} { + suffixMatcher := func(suffix string) any { return mock.MatchedBy(func(array []string) bool { return strings.HasSuffix(array[1], suffix) }) diff --git a/act/runner/step_action_remote.go b/act/runner/step_action_remote.go index fdbbf794..515320a7 100644 --- a/act/runner/step_action_remote.go +++ b/act/runner/step_action_remote.go @@ -79,7 +79,7 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor { remoteReader := func(ctx context.Context) actionYamlReader { return func(filename string) (io.Reader, io.Closer, error) { spath := path.Join(sar.remoteAction.Path, filename) - for i := 0; i < maxSymlinkDepth; i++ { + for range maxSymlinkDepth { tars, err := cache.GetTarArchive(ctx, sar.cacheDir, sar.resolvedSha, spath) if err != nil { return nil, nil, os.ErrNotExist @@ -305,8 +305,8 @@ func (ra *remoteAction) IsCheckout() bool { func newRemoteAction(action string) *remoteAction { // support http(s)://host/owner/repo@v3 for _, schema := range []string{"https://", "http://"} { - if strings.HasPrefix(action, schema) { - splits := strings.SplitN(strings.TrimPrefix(action, schema), "/", 2) + if after, ok := strings.CutPrefix(action, schema); ok { + splits := strings.SplitN(after, "/", 2) if len(splits) != 2 { return nil } diff --git a/act/runner/step_run.go b/act/runner/step_run.go index 3c84b554..68daa143 100644 --- a/act/runner/step_run.go +++ b/act/runner/step_run.go @@ -3,6 +3,7 @@ package runner import ( "context" "fmt" + "maps" "runtime" "strings" @@ -186,9 +187,7 @@ func (sr *stepRun) setupShell(ctx context.Context) { } step.Shell = shellWithFallback[0] lenv := &localEnv{env: map[string]string{}} - for k, v := range sr.env { - lenv.env[k] = v - } + maps.Copy(lenv.env, sr.env) sr.getRunContext().ApplyExtraPath(ctx, &lenv.env) _, err := lookpath.LookPath2(shellWithFallback[0], lenv) if err != nil { diff --git a/act/schema/schema.go b/act/schema/schema.go index d452f012..c2de3e59 100644 --- a/act/schema/schema.go +++ b/act/schema/schema.go @@ -7,6 +7,7 @@ import ( "fmt" "math" "regexp" + "slices" "strconv" "strings" @@ -270,10 +271,8 @@ func (s *Node) UnmarshalYAML(node *yaml.Node) error { return node.Decode(&b) } else if def.AllowedValues != nil { s := node.Value - for _, v := range *def.AllowedValues { - if s == v { - return nil - } + if slices.Contains(*def.AllowedValues, s) { + return nil } return fmt.Errorf("%sExpected one of %s got %s", formatLocation(node), strings.Join(*def.AllowedValues, ","), s) } else if def.Null != nil { diff --git a/act/workflowpattern/trace_writer.go b/act/workflowpattern/trace_writer.go index d5d990f6..675aa187 100644 --- a/act/workflowpattern/trace_writer.go +++ b/act/workflowpattern/trace_writer.go @@ -3,16 +3,16 @@ package workflowpattern import "fmt" type TraceWriter interface { - Info(string, ...interface{}) + Info(string, ...any) } type EmptyTraceWriter struct{} -func (*EmptyTraceWriter) Info(string, ...interface{}) { +func (*EmptyTraceWriter) Info(string, ...any) { } type StdOutTraceWriter struct{} -func (*StdOutTraceWriter) Info(format string, args ...interface{}) { +func (*StdOutTraceWriter) Info(format string, args ...any) { fmt.Printf(format+"\n", args...) } diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go index 8559b960..371beb24 100644 --- a/internal/app/cmd/exec.go +++ b/internal/app/cmd/exec.go @@ -7,6 +7,7 @@ package cmd import ( "context" "fmt" + "maps" "os" "path/filepath" "strconv" @@ -101,9 +102,7 @@ func readEnvs(path string, envs map[string]string) bool { if err != nil { log.Fatalf("Error loading from %s: %v", path, err) } - for k, v := range env { - envs[k] = v - } + maps.Copy(envs, env) return true } return false diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 3749ee50..25de8caa 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -9,6 +9,7 @@ import ( "encoding/hex" "encoding/json" "fmt" + "maps" "path/filepath" "strconv" "strings" @@ -66,9 +67,7 @@ func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client) cfg.Runner.Envs["GITHUB_SERVER_URL"] = reg.Address envs := make(map[string]string, len(cfg.Runner.Envs)) - for k, v := range cfg.Runner.Envs { - envs[k] = v - } + maps.Copy(envs, cfg.Runner.Envs) var cacheProxy *cacheproxy.Handler if cfg.Cache.Enabled == nil || *cfg.Cache.Enabled { @@ -193,7 +192,7 @@ func explainFailedGenerateWorkflow(task *runnerv1.Task, log func(message string, log("%5d: %s", n+1, line) } log("Errors were found and although they tend to be cryptic the line number they refer to gives a hint as to where the problem might be.") - for _, line := range strings.Split(err.Error(), "\n") { + for line := range strings.SplitSeq(err.Error(), "\n") { log("%s", line) } return fmt.Errorf("the workflow file is not usable") @@ -259,9 +258,7 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. // Clone the runner default envs into a local envs map runEnvs := make(map[string]string) - for id, v := range r.envs { - runEnvs[id] = v - } + maps.Copy(runEnvs, r.envs) runtimeToken := client.BackwardCompatibleContext(task, "runtime_token") if runtimeToken == "" { diff --git a/internal/pkg/config/config.go b/internal/pkg/config/config.go index 170db177..69d9f482 100644 --- a/internal/pkg/config/config.go +++ b/internal/pkg/config/config.go @@ -5,6 +5,7 @@ package config import ( "fmt" + "maps" "os" "path/filepath" "time" @@ -109,9 +110,7 @@ func LoadDefault(file string) (*Config, error) { if cfg.Runner.Envs == nil { cfg.Runner.Envs = map[string]string{} } - for k, v := range envs { - cfg.Runner.Envs[k] = v - } + maps.Copy(cfg.Runner.Envs, envs) } } diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 6d08269c..2545faf3 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -81,7 +81,7 @@ func NewReporter(ctx context.Context, cancel context.CancelFunc, c client.Client func (r *Reporter) ResetSteps(l int) { r.stateMu.Lock() defer r.stateMu.Unlock() - for i := 0; i < l; i++ { + for i := range l { r.state.Steps = append(r.state.Steps, &runnerv1.StepState{ Id: int64(i), }) @@ -189,14 +189,14 @@ func (r *Reporter) RunDaemon() { time.AfterFunc(r.reportInterval, r.RunDaemon) } -func (r *Reporter) Logf(format string, a ...interface{}) { +func (r *Reporter) Logf(format string, a ...any) { r.stateMu.Lock() defer r.stateMu.Unlock() r.logf(format, a...) } -func (r *Reporter) logf(format string, a ...interface{}) { +func (r *Reporter) logf(format string, a ...any) { if !r.duringSteps() { r.logRows = append(r.logRows, &runnerv1.LogRow{ Time: timestamppb.Now(), @@ -210,7 +210,7 @@ func (r *Reporter) SetOutputs(outputs map[string]string) error { defer r.stateMu.Unlock() var errs []error - recordError := func(format string, a ...interface{}) { + recordError := func(format string, a ...any) { r.logf(format, a...) errs = append(errs, fmt.Errorf(format, a...)) } @@ -341,7 +341,7 @@ func (r *Reporter) ReportState() error { r.stateMu.RUnlock() outputs := make(map[string]string) - r.outputs.Range(func(k, v interface{}) bool { + r.outputs.Range(func(k, v any) bool { if val, ok := v.(string); ok { outputs[k.(string)] = val } @@ -365,7 +365,7 @@ func (r *Reporter) ReportState() error { } var noSent []string - r.outputs.Range(func(k, v interface{}) bool { + r.outputs.Range(func(k, v any) bool { if _, ok := v.(string); ok { noSent = append(noSent, k.(string)) } @@ -396,7 +396,7 @@ var stringToResult = map[string]runnerv1.Result{ "cancelled": runnerv1.Result_RESULT_CANCELLED, } -func (r *Reporter) parseResult(result interface{}) (runnerv1.Result, bool) { +func (r *Reporter) parseResult(result any) (runnerv1.Result, bool) { str := "" if v, ok := result.(string); ok { // for jobResult str = v diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index 2839c847..23a95547 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -49,7 +49,7 @@ func mockReporter(t *testing.T) (*Reporter, *mocks.Client, func()) { client := mocks.NewClient(t) ctx, cancel := context.WithCancel(context.Background()) - taskCtx, err := structpb.NewStruct(map[string]interface{}{}) + taskCtx, err := structpb.NewStruct(map[string]any{}) require.NoError(t, err) reporter := NewReporter(ctx, cancel, client, &runnerv1.Task{ Context: taskCtx, @@ -64,7 +64,7 @@ func TestReporterSetOutputs(t *testing.T) { assertEqual := func(t *testing.T, expected map[string]string, actual *sync.Map) { t.Helper() actualMap := map[string]string{} - actual.Range(func(k, v interface{}) bool { + actual.Range(func(k, v any) bool { val, ok := v.(string) require.True(t, ok) actualMap[k.(string)] = val @@ -268,7 +268,7 @@ func TestReporter_Fire(t *testing.T) { return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{}), nil }) - dataStep0 := map[string]interface{}{ + dataStep0 := map[string]any{ "stage": "Main", "stepNumber": 0, "raw_output": true, From 026f1ed16c9bc685155661e3963e74fd6c38f171 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 13 Aug 2025 18:48:38 +0200 Subject: [PATCH 083/281] fix: ensure unique container names for reusable workflows --- act/runner/run_context.go | 2 +- act/runner/run_context_test.go | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 84c03188..9d795d4e 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -97,7 +97,7 @@ func (rc *RunContext) GetEnv() map[string]string { } func (rc *RunContext) jobContainerName() string { - return createSimpleContainerName(rc.Config.ContainerNamePrefix, "WORKFLOW-"+common.Sha256(rc.Run.Workflow.Name), "JOB-"+rc.Name) + return createSimpleContainerName(rc.Config.ContainerNamePrefix, "WORKFLOW-"+common.Sha256(rc.String()), "JOB-"+rc.Name) } func getDockerDaemonSocketMountPath(daemonPath string) string { diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 296afd1b..177e2af7 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -794,7 +794,7 @@ jobs: }, inputs: []container.NewContainerInput{ { - Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855_JOB", + Name: "WORKFLOW-8a5edab282632443219e051e4ade2d1d5bbc671c781051bf1437897cbdfea0f1_JOB", Image: "some:image", Username: "containerusername", Password: "containerpassword", @@ -814,7 +814,7 @@ jobs: JobOptions: "", }, { - Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca49599-fe7f4c0058dbd2161ebe4aafa71cd83bd96ee19d3ca8043d5e4bc477a664a80c", + Name: "WORKFLOW-8a5edab282632443219e051e4ade2d1d5bbc671c781051bf143789-d083efaebdcab24d231fa091b85dbb8768b47136582b340132c197d9cb5e7430", Image: "service1:image", Username: "service1username", Password: "service1password", @@ -834,7 +834,7 @@ jobs: JobOptions: "", }, { - Name: "WORKFLOW-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca49599-c233cf913e1d0c90cc1404ee09917e625f9cb82156ca3d7cb10b729d563728ea", + Name: "WORKFLOW-8a5edab282632443219e051e4ade2d1d5bbc671c781051bf143789-4c44cd5731ec445ebe33780a3e39ed5e20e80f8a697a6e34c7acdd3675e631a8", Image: "service2:image", Username: "service2username", Password: "service2password", From 43c5b23c838228d58485f0ebc567b1241a2ba90d Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 3 Aug 2025 17:02:23 +0200 Subject: [PATCH 084/281] chore: enable test cases for reusable workflows --- act/runner/runner_test.go | 5 ++--- act/runner/testdata/uses-workflow/local-workflow.yml | 8 ++++---- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 8f2ab0db..192ab4a6 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -256,9 +256,8 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "uses-composite-check-for-input-in-if-uses", "push", "", platforms, secrets}, // {workdir, "remote-action-composite-js-pre-with-defaults", "push", "", platforms, secrets}, {workdir, "remote-action-composite-action-ref", "push", "", platforms, secrets}, - // reusable workflow not fully implemented yet - // {workdir, "uses-workflow", "push", "", platforms, map[string]string{"secret": "keep_it_private"}}, - // {workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}}, + {workdir, "uses-workflow", "push", "", platforms, map[string]string{"secret": "keep_it_private"}}, + {workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}}, {workdir, "uses-docker-url", "push", "", platforms, secrets}, {workdir, "act-composite-env-test", "push", "", platforms, secrets}, diff --git a/act/runner/testdata/uses-workflow/local-workflow.yml b/act/runner/testdata/uses-workflow/local-workflow.yml index 2e9a08d7..d571a9fb 100644 --- a/act/runner/testdata/uses-workflow/local-workflow.yml +++ b/act/runner/testdata/uses-workflow/local-workflow.yml @@ -3,7 +3,7 @@ on: pull_request jobs: reusable-workflow: - uses: ./.github/workflows/local-reusable-workflow.yml + uses: ./testdata/.github/workflows/local-reusable-workflow.yml with: string_required: string bool_required: ${{ true }} @@ -12,7 +12,7 @@ jobs: secret: keep_it_private reusable-workflow-with-inherited-secrets: - uses: ./.github/workflows/local-reusable-workflow.yml + uses: ./testdata/.github/workflows/local-reusable-workflow.yml with: string_required: string bool_required: ${{ true }} @@ -20,10 +20,10 @@ jobs: secrets: inherit reusable-workflow-with-on-string-notation: - uses: ./.github/workflows/local-reusable-workflow-no-inputs-string.yml + uses: ./testdata/.github/workflows/local-reusable-workflow-no-inputs-string.yml reusable-workflow-with-on-array-notation: - uses: ./.github/workflows/local-reusable-workflow-no-inputs-array.yml + uses: ./testdata/.github/workflows/local-reusable-workflow-no-inputs-array.yml output-test: runs-on: ubuntu-latest From 2207ff4518153fcfc55bd309d534e2e031bcf9ef Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 15 Aug 2025 08:43:36 +0200 Subject: [PATCH 085/281] fix: a remote reusable workflow may be from any host --- act/runner/reusable_workflow.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/act/runner/reusable_workflow.go b/act/runner/reusable_workflow.go index 3a805b0a..acb4bf4d 100644 --- a/act/runner/reusable_workflow.go +++ b/act/runner/reusable_workflow.go @@ -6,6 +6,7 @@ import ( "errors" "fmt" "io/fs" + "net/url" "os" "path" "regexp" @@ -54,9 +55,14 @@ func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor { func newRemoteReusableWorkflowExecutor(rc *RunContext) common.Executor { uses := rc.Run.Job().Uses - remoteReusableWorkflow := newRemoteReusableWorkflowWithPlat(rc.Config.GitHubInstance, uses) + url, err := url.Parse(uses) + if err != nil { + return common.NewErrorExecutor(fmt.Errorf("'%s' cannot be parsed as a URL: %v", uses, err)) + } + + remoteReusableWorkflow := newRemoteReusableWorkflowWithPlat(url.Host, strings.TrimPrefix(url.Path, "/")) if remoteReusableWorkflow == nil { - return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses)) + return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", url.Path)) } // uses with safe filename makes the target directory look something like this {owner}-{repo}-.github-workflows-{filename}@{ref} From af0ebf6d5106ef14e30f001762daad43e0ce14af Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 15 Aug 2025 09:00:50 +0000 Subject: [PATCH 086/281] test: prevent data race detection in TestActionCache (#858) Data race is being flagged because a goroutine is currently writing tar data into `atar`, and `assert.NotEmpty(atar)` performs internal structure reflection into the returned `io.PipeWriter` and violates its internal synchronization primitives. This assertion doesn't seem to add any value to the test compared to just reading the pipe, so it has been removed. Data race details (abbreviated): ``` ================== WARNING: DATA RACE Write at 0x00c00041fbc0 by goroutine 55: sync/atomic.CompareAndSwapInt32() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/runtime/race_amd64.s:361 +0xb sync/atomic.CompareAndSwapInt32() :1 +0x18 sync.(*Mutex).Lock() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/sync/mutex.go:46 +0x28 io.(*pipe).write() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/io/pipe.go:81 +0x9e io.(*PipeWriter).Write() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/io/pipe.go:161 +0x46 archive/tar.(*Writer).Flush() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/archive/tar/writer.go:59 +0xcc archive/tar.(*Writer).WriteHeader() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/archive/tar/writer.go:71 +0x46 code.forgejo.org/forgejo/runner/v9/act/runner.actionCacheCopyFileOrDir() /home/mfenniak/Dev/forgejo-runner/act/runner/action_cache.go:203 +0xabd code.forgejo.org/forgejo/runner/v9/act/runner.GoGitActionCache.GetTarArchive.func2.1() /home/mfenniak/Dev/forgejo-runner/act/runner/action_cache.go:154 +0xa5 ... Previous read at 0x00c00041fbc0 by goroutine 9: reflect.typedmemmove() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/runtime/mbarrier.go:213 +0x0 reflect.packEface() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:136 +0xc5 reflect.valueInterface() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:1513 +0x179 reflect.Value.Interface() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:1484 +0x106 github.com/stretchr/testify/assert.isEmpty() /home/mfenniak/go/pkg/mod/github.com/stretchr/testify@v1.10.0/assert/assertions.go:735 +0x7f github.com/stretchr/testify/assert.NotEmpty() /home/mfenniak/go/pkg/mod/github.com/stretchr/testify@v1.10.0/assert/assertions.go:769 +0x56 github.com/stretchr/testify/assert.(*Assertions).NotEmpty() /home/mfenniak/go/pkg/mod/github.com/stretchr/testify@v1.10.0/assert/assertion_forward.go:1175 +0xb1 code.forgejo.org/forgejo/runner/v9/act/runner.TestActionCache.func1() /home/mfenniak/Dev/forgejo-runner/act/runner/action_cache_test.go:60 +0x21e ================== ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/858): test: prevent data race detection in TestActionCache [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/858 Reviewed-by: Gusted Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/action_cache_test.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/act/runner/action_cache_test.go b/act/runner/action_cache_test.go index 765eef0d..16518856 100644 --- a/act/runner/action_cache_test.go +++ b/act/runner/action_cache_test.go @@ -57,9 +57,10 @@ func TestActionCache(t *testing.T) { return } atar, err := cache.GetTarArchive(ctx, c.CacheDir, sha, "js") - if !a.NoError(err) || !a.NotEmpty(atar) { + if !a.NoError(err) { return } + defer atar.Close() mytar := tar.NewReader(atar) th, err := mytar.Next() if !a.NoError(err) || !a.NotEqual(0, th.Size) { From 815e7aed0485e12b40e1cb1e474714f32e0fed66 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 15 Aug 2025 09:11:15 +0000 Subject: [PATCH 087/281] chore: prevent "false positive" data race detection w/ ContainerDaemonSocket (#859) `ContainerDaemonSocket` is stored on a shared struct and was mutated to a default value when empty, which trips the data race detector as a mutation of shared state without any synchronization. However as all codepaths would be setting it to the same value in the mutation, here's no functional bug. This commit prevents the "false positive", but it also centralizes the default value for a slightly better programming practice. ``` ================== WARNING: DATA RACE Read at 0x00c00027f9e0 by goroutine 1104: code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).GetBindsAndMounts() /.../forgejo-runner/act/runner/run_context.go:130 +0x87 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).prepareJobContainer() /.../forgejo-runner/act/runner/run_context.go:449 +0xad1 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1.(*RunContext).startJobContainer.2() /.../forgejo-runner/act/runner/run_context.go:587 +0x5e code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1() /.../forgejo-runner/act/runner/run_context.go:836 +0xf3 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.NewPipelineExecutor.Executor.Then.func21() /.../forgejo-runner/act/common/executor.go:136 +0x57 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1() /.../forgejo-runner/act/runner/run_context.go:929 +0x68 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:218 +0x271 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Previous write at 0x00c00027f9e0 by goroutine 1103: code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).GetBindsAndMounts() /.../forgejo-runner/act/runner/run_context.go:131 +0xc7 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).prepareJobContainer() /.../forgejo-runner/act/runner/run_context.go:449 +0xad1 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1.(*RunContext).startJobContainer.2() /.../forgejo-runner/act/runner/run_context.go:587 +0x5e code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1() /.../forgejo-runner/act/runner/run_context.go:836 +0xf3 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.NewPipelineExecutor.Executor.Then.func21() /.../forgejo-runner/act/common/executor.go:136 +0x57 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1() /.../forgejo-runner/act/runner/run_context.go:929 +0x68 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:218 +0x271 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Goroutine 1104 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /.../forgejo-runner/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Goroutine 1103 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /.../forgejo-runner/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f ================== ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/859): chore: prevent "false positive" data race detection w/ ContainerDaemonSocket Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/859 Reviewed-by: Gusted Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/run_context.go | 20 ++++++++------------ act/runner/runner.go | 7 +++++++ 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 2d40f56a..5ed2bb35 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -138,13 +138,11 @@ func (rc *RunContext) getInternalVolumeEnv(ctx context.Context) string { // Returns the binds and mounts for the container, resolving paths as appopriate func (rc *RunContext) GetBindsAndMounts(ctx context.Context) ([]string, map[string]string, []string) { - if rc.Config.ContainerDaemonSocket == "" { - rc.Config.ContainerDaemonSocket = "/var/run/docker.sock" - } - binds := []string{} - if rc.Config.ContainerDaemonSocket != "-" { - daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket) + + containerDaemonSocket := rc.Config.GetContainerDaemonSocket() + if containerDaemonSocket != "-" { + daemonPath := getDockerDaemonSocketMountPath(containerDaemonSocket) binds = append(binds, fmt.Sprintf("%s:%s", daemonPath, "/var/run/docker.sock")) } @@ -182,7 +180,7 @@ func (rc *RunContext) GetBindsAndMounts(ctx context.Context) ([]string, map[stri mounts[rc.getInternalVolumeWorkdir(ctx)] = ext.ToContainerPath(rc.Config.Workdir) } - validVolumes := append(rc.getInternalVolumeNames(ctx), getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)) + validVolumes := append(rc.getInternalVolumeNames(ctx), getDockerDaemonSocketMountPath(containerDaemonSocket)) validVolumes = append(validVolumes, rc.Config.ValidVolumes...) return binds, mounts, validVolumes } @@ -1445,12 +1443,10 @@ func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[st // GetServiceBindsAndMounts returns the binds and mounts for the service container, resolving paths as appopriate func (rc *RunContext) GetServiceBindsAndMounts(svcVolumes []string) ([]string, map[string]string) { - if rc.Config.ContainerDaemonSocket == "" { - rc.Config.ContainerDaemonSocket = "/var/run/docker.sock" - } + containerDaemonSocket := rc.Config.GetContainerDaemonSocket() binds := []string{} - if rc.Config.ContainerDaemonSocket != "-" { - daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket) + if containerDaemonSocket != "-" { + daemonPath := getDockerDaemonSocketMountPath(containerDaemonSocket) binds = append(binds, fmt.Sprintf("%s:%s", daemonPath, "/var/run/docker.sock")) } diff --git a/act/runner/runner.go b/act/runner/runner.go index 0bf95264..7fd5139e 100644 --- a/act/runner/runner.go +++ b/act/runner/runner.go @@ -85,6 +85,13 @@ func (c Config) GetToken() string { return token } +func (c *Config) GetContainerDaemonSocket() string { + if c.ContainerDaemonSocket == "" { + return "/var/run/docker.sock" + } + return c.ContainerDaemonSocket +} + type caller struct { runContext *RunContext } From 13247246fcffbd2cd7b3e3f91e96afdcf7133d5d Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 15 Aug 2025 09:12:32 +0000 Subject: [PATCH 088/281] test: fix data race in TestNewParallelExecutor... tests (#860) Tests were using `count` and similar variables without any concurrency safety and have been updated to use atomic operations. This may have caused rare miscounts in tests as operations like `count++` are not thread-safe, but to my knowledge these have never been observed. Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/860 Reviewed-by: Gusted Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/common/executor_test.go | 58 ++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 23 deletions(-) diff --git a/act/common/executor_test.go b/act/common/executor_test.go index 75dca49f..721d487f 100644 --- a/act/common/executor_test.go +++ b/act/common/executor_test.go @@ -3,6 +3,7 @@ package common import ( "context" "fmt" + "sync/atomic" "testing" "time" @@ -79,37 +80,48 @@ func TestNewParallelExecutor(t *testing.T) { ctx := t.Context() - count := 0 - activeCount := 0 - maxCount := 0 - emptyWorkflow := NewPipelineExecutor(func(ctx context.Context) error { - count++ + var count atomic.Int32 + var activeCount atomic.Int32 + var maxCount atomic.Int32 - activeCount++ - if activeCount > maxCount { - maxCount = activeCount + emptyWorkflow := NewPipelineExecutor(func(ctx context.Context) error { + count.Add(1) + + currentActive := activeCount.Add(1) + + // maxCount = max(maxCount, currentActive) -- but concurrent-safe by using CompareAndSwap. + for { + currentMax := maxCount.Load() + if currentActive <= currentMax { + break + } + if maxCount.CompareAndSwap(currentMax, currentActive) { + break + } + // If CompareAndSwap failed, retry due to concurrent update by another goroutine. } + time.Sleep(2 * time.Second) - activeCount-- + activeCount.Add(-1) return nil }) err := NewParallelExecutor(2, emptyWorkflow, emptyWorkflow, emptyWorkflow)(ctx) - assert.Equal(3, count, "should run all 3 executors") - assert.Equal(2, maxCount, "should run at most 2 executors in parallel") + assert.Equal(int32(3), count.Load(), "should run all 3 executors") + assert.Equal(int32(2), maxCount.Load(), "should run at most 2 executors in parallel") assert.Nil(err) // Reset to test running the executor with 0 parallelism - count = 0 - activeCount = 0 - maxCount = 0 + count.Store(0) + activeCount.Store(0) + maxCount.Store(0) errSingle := NewParallelExecutor(0, emptyWorkflow, emptyWorkflow, emptyWorkflow)(ctx) - assert.Equal(3, count, "should run all 3 executors") - assert.Equal(1, maxCount, "should run at most 1 executors in parallel") + assert.Equal(int32(3), count.Load(), "should run all 3 executors") + assert.Equal(int32(1), maxCount.Load(), "should run at most 1 executors in parallel") assert.Nil(errSingle) } @@ -119,13 +131,13 @@ func TestNewParallelExecutorFailed(t *testing.T) { ctx, cancel := context.WithCancel(context.Background()) cancel() - count := 0 + var count atomic.Int32 errorWorkflow := NewPipelineExecutor(func(ctx context.Context) error { - count++ + count.Add(1) return fmt.Errorf("fake error") }) err := NewParallelExecutor(1, errorWorkflow)(ctx) - assert.Equal(1, count) + assert.Equal(int32(1), count.Load()) assert.ErrorIs(context.Canceled, err) } @@ -137,16 +149,16 @@ func TestNewParallelExecutorCanceled(t *testing.T) { errExpected := fmt.Errorf("fake error") - count := 0 + var count atomic.Int32 successWorkflow := NewPipelineExecutor(func(ctx context.Context) error { - count++ + count.Add(1) return nil }) errorWorkflow := NewPipelineExecutor(func(ctx context.Context) error { - count++ + count.Add(1) return errExpected }) err := NewParallelExecutor(3, errorWorkflow, successWorkflow, successWorkflow)(ctx) - assert.Equal(3, count) + assert.Equal(int32(3), count.Load()) assert.Error(errExpected, err) } From 03fbeab01b69aa0569def05633bd8de0c9c9b1a7 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 15 Aug 2025 09:49:04 +0000 Subject: [PATCH 089/281] Update https://data.forgejo.org/actions/setup-forgejo action to v3.0.2 (#863) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) | action | patch | `v3.0.1` -> `v3.0.2` | --- ### Release Notes
actions/setup-forgejo (https://data.forgejo.org/actions/setup-forgejo) ### [`v3.0.2`](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.1...v3.0.2) [Compare Source](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.1...v3.0.2)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/863): Update https://data.forgejo.org/actions/setup-forgejo action to v3.0.2 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/863 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index 4adba81c..762cb222 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@v4 - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.1 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 with: user: root password: admin1234 diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index 25786011..dcfb7d88 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -34,7 +34,7 @@ jobs: - name: install Forgejo so it can be used as a container registry id: registry - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.1 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 with: user: ${{ env.FORGEJO_USER }} password: ${{ env.FORGEJO_PASSWORD }} diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index cca4f934..5ebdd1a7 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -53,7 +53,7 @@ jobs: done - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.1 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 with: user: root password: admin1234 From 69a3adad2146df6d9ea0dbb81358d2db22770cd9 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 15 Aug 2025 19:11:57 +0000 Subject: [PATCH 090/281] fix: race condition in matrix job result state may result in failed jobs being marked as successful (#862) In `setJobResult` there is no coordination between multiple jobs that are completing, leading to a possible condition where `jobResult` can be read from the matrix job as `"success"` by a job, marked as `"failed"` by another job, and then marked as `"success"` by other jobs. To my knowledge, the race condition has not been observed in a real-world case, but has been reproduced in a unit test. ``` ================== WARNING: DATA RACE Read at 0x00c0006d08a0 by goroutine 29232: code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult() /.../forgejo-runner/act/runner/job_executor.go:173 +0x359 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func6() /.../forgejo-runner/act/runner/job_executor.go:118 +0x15d code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func14() /.../forgejo-runner/act/common/executor.go:183 +0x86 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func7() /.../forgejo-runner/act/runner/job_executor.go:161 +0x191 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func16() /.../forgejo-runner/act/common/executor.go:183 +0x86 ... Previous write at 0x00c0006d08a0 by goroutine 29234: code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).result() /.../forgejo-runner/act/runner/run_context.go:897 +0x271 code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult() /.../forgejo-runner/act/runner/job_executor.go:181 +0x66e code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func6() /.../forgejo-runner/act/runner/job_executor.go:118 +0x15d code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func14() /.../forgejo-runner/act/common/executor.go:183 +0x86 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func7() /.../forgejo-runner/act/runner/job_executor.go:161 +0x191 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func16() /.../forgejo-runner/act/common/executor.go:183 +0x86 ... ================== ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/862): fix: race condition in matrix job result state may result in failed jobs being marked as successful Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/862 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/model/workflow.go | 5 ++- act/runner/job_executor.go | 5 +++ act/runner/job_executor_test.go | 73 +++++++++++++++++++++++++++++++++ 3 files changed, 82 insertions(+), 1 deletion(-) diff --git a/act/model/workflow.go b/act/model/workflow.go index 82082feb..3462d288 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -11,6 +11,7 @@ import ( "slices" "strconv" "strings" + "sync" "code.forgejo.org/forgejo/runner/v9/act/common" "code.forgejo.org/forgejo/runner/v9/act/schema" @@ -217,7 +218,9 @@ type Job struct { Uses string `yaml:"uses"` With map[string]any `yaml:"with"` RawSecrets yaml.Node `yaml:"secrets"` - Result string + + Result string + ResultMutex sync.Mutex } // Strategy for the job diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index d407b379..3cb4f206 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -162,6 +162,11 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success bool) { logger := common.Logger(ctx) + // As we're reading the matrix build's status (`rc.Run.Job().Result`), it's possible for it change in another + // goroutine running `setJobResult` and invoking `.result(...)`. Prevent concurrent execution of `setJobResult`... + rc.Run.Job().ResultMutex.Lock() + defer rc.Run.Job().ResultMutex.Unlock() + jobResult := "success" // we have only one result for a whole matrix build, so we need // to keep an existing result state if we run a matrix diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index 6e8a452e..3915b971 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -5,7 +5,9 @@ import ( "fmt" "io" "slices" + "sync" "testing" + "time" "code.forgejo.org/forgejo/runner/v9/act/common" "code.forgejo.org/forgejo/runner/v9/act/container" @@ -333,3 +335,74 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { }) } } + +func TestSetJobResultConcurrency(t *testing.T) { + jim := &jobInfoMock{} + job := model.Job{ + Result: "success", + } + // Distinct RunContext objects are used to replicate realistic setJobResult in matrix build + rc1 := &RunContext{ + Run: &model.Run{ + JobID: "test", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "test": &job, + }, + }, + }, + } + rc2 := &RunContext{ + Run: &model.Run{ + JobID: "test", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "test": &job, + }, + }, + }, + } + + jim.On("matrix").Return(map[string]interface{}{ + "python": []string{"3.10", "3.11", "3.12"}, + }) + + // Synthesize a race condition in setJobResult where, by reading data from the job matrix earlier and then + // performing unsynchronzied writes to the same shared data structure, it can overwrite a failure status. + // + // Goroutine 1: Start marking job as success + // (artificially suspended + // by result() mock) + // Goroutine 2: Mark job as failure + // Goroutine 1: Finish marking job as success + // + // Correct behavior: Job is marked as a failure + // Bug behavior: Job is marked as a success + + var lastResult string + jim.On("result", mock.Anything).Run(func(args mock.Arguments) { + result := args.String(0) + // Artificially suspend the "success" case so that the failure case races past it. + if result == "success" { + time.Sleep(1 * time.Second) + } + job.Result = result + lastResult = result + }) + + var wg sync.WaitGroup + wg.Add(2) + // Goroutine 1, mark as success: + go func() { + defer wg.Done() + setJobResult(t.Context(), jim, rc1, true) + }() + // Goroutine 2, mark as failure: + go func() { + defer wg.Done() + setJobResult(t.Context(), jim, rc2, false) + }() + wg.Wait() + + assert.Equal(t, "failure", lastResult) +} From d63d70c0805522d5340092f09bcaf4eb2f12f6b4 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 15 Aug 2025 19:19:54 +0000 Subject: [PATCH 091/281] chore: prevent 'false positive' data race detection with Job.If [skip cascade] (#864) Initialization of the default value of the `If` field is functionally safe, but triggers the data race detector. ``` ================== WARNING: DATA RACE Read at 0x00c00037cf78 by goroutine 10: code.forgejo.org/forgejo/runner/v9/act/model.(*Workflow).GetJob() /.../forgejo-runner/act/model/workflow.go:766 +0x2ae code.forgejo.org/forgejo/runner/v9/act/model.(*Run).Job() /.../forgejo-runner/act/model/planner.go:50 +0xab code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult() /.../forgejo-runner/act/runner/job_executor.go:168 +0x7c code.forgejo.org/forgejo/runner/v9/act/runner.TestSetJobResultConcurrency.func3() /.../forgejo-runner/act/runner/job_executor_test.go:410 +0xf8 Previous write at 0x00c00037cf78 by goroutine 9: code.forgejo.org/forgejo/runner/v9/act/model.(*Workflow).GetJob() /.../forgejo-runner/act/model/workflow.go:767 +0x2ce code.forgejo.org/forgejo/runner/v9/act/model.(*Run).Job() /.../forgejo-runner/act/model/planner.go:50 +0xab code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult() /.../forgejo-runner/act/runner/job_executor.go:168 +0x7c code.forgejo.org/forgejo/runner/v9/act/runner.TestSetJobResultConcurrency.func2() /.../forgejo-runner/act/runner/job_executor_test.go:405 +0xfb Goroutine 10 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.TestSetJobResultConcurrency() /.../forgejo-runner/act/runner/job_executor_test.go:408 +0xbac testing.tRunner() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/testing/testing.go:1792 +0x225 testing.(*T).Run.gowrap1() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/testing/testing.go:1851 +0x44 Goroutine 9 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.TestSetJobResultConcurrency() /.../forgejo-runner/act/runner/job_executor_test.go:403 +0xa84 testing.tRunner() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/testing/testing.go:1792 +0x225 testing.(*T).Run.gowrap1() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/testing/testing.go:1851 +0x44 ================== ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/864): chore: prevent 'false positive' data race detection with Job.If [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/864 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/model/workflow.go | 12 ++++++++---- act/runner/run_context.go | 6 +++--- act/runner/runner.go | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/act/model/workflow.go b/act/model/workflow.go index 3462d288..5ca423c3 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -207,7 +207,7 @@ type Job struct { RawNeeds yaml.Node `yaml:"needs"` RawRunsOn yaml.Node `yaml:"runs-on"` Env yaml.Node `yaml:"env"` - If yaml.Node `yaml:"if"` + RawIf yaml.Node `yaml:"if"` Steps []*Step `yaml:"steps"` TimeoutMinutes string `yaml:"timeout-minutes"` Services map[string]*ContainerSpec `yaml:"services"` @@ -362,6 +362,13 @@ func (j *Job) RunsOn() []string { } } +func (j *Job) IfClause() string { + if j.RawIf.Value == "" { + return "success()" + } + return j.RawIf.Value +} + func nodeAsStringSlice(node yaml.Node) []string { switch node.Kind { case yaml.ScalarNode: @@ -761,9 +768,6 @@ func (w *Workflow) GetJob(jobID string) *Job { if j.Name == "" { j.Name = id } - if j.If.Value == "" { - j.If.Value = "success()" - } return j } } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 5ed2bb35..85398e39 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -1022,11 +1022,11 @@ func (rc *RunContext) options(ctx context.Context) string { func (rc *RunContext) isEnabled(ctx context.Context) (bool, error) { job := rc.Run.Job() l := common.Logger(ctx) - runJob, runJobErr := EvalBool(ctx, rc.ExprEval, job.If.Value, exprparser.DefaultStatusCheckSuccess) + runJob, runJobErr := EvalBool(ctx, rc.ExprEval, job.IfClause(), exprparser.DefaultStatusCheckSuccess) jobType, jobTypeErr := job.Type() if runJobErr != nil { - return false, fmt.Errorf(" \u274C Error in if-expression: \"if: %s\" (%s)", job.If.Value, runJobErr) + return false, fmt.Errorf(" \u274C Error in if-expression: \"if: %s\" (%s)", job.IfClause(), runJobErr) } if jobType == model.JobTypeInvalid { @@ -1035,7 +1035,7 @@ func (rc *RunContext) isEnabled(ctx context.Context) (bool, error) { if !runJob { rc.result("skipped") - l.WithField("jobResult", "skipped").Infof("Skipping job '%s' due to '%s'", job.Name, job.If.Value) + l.WithField("jobResult", "skipped").Infof("Skipping job '%s' due to '%s'", job.Name, job.IfClause()) return false, nil } diff --git a/act/runner/runner.go b/act/runner/runner.go index 7fd5139e..29b4cc7a 100644 --- a/act/runner/runner.go +++ b/act/runner/runner.go @@ -154,7 +154,7 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor { log.Debugf("Job.RawNeeds: %v", job.RawNeeds) log.Debugf("Job.RawRunsOn: %v", job.RawRunsOn) log.Debugf("Job.Env: %v", job.Env) - log.Debugf("Job.If: %v", job.If) + log.Debugf("Job.If: %v", job.IfClause()) for step := range job.Steps { if nil != job.Steps[step] { log.Debugf("Job.Steps: %v", job.Steps[step].String()) From d976b1c65adca5c6b043c4141b2836c7ef08a856 Mon Sep 17 00:00:00 2001 From: Shuroii Date: Fri, 15 Aug 2025 19:32:45 +0000 Subject: [PATCH 092/281] docs: clarify actions_cache_url_option (#866) The other setting that asks you for a URL as input does so while specifically stating it should have a trailing slash. This commit adds similar clarification to the other setting. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/866): docs: Clarify actions_cache_url_option [skip cascade] Co-authored-by: Shuroii Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/866 Reviewed-by: earl-warren Co-authored-by: Shuroii Co-committed-by: Shuroii --- internal/pkg/config/config.example.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index a3131b0b..ec12a8a1 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -140,10 +140,10 @@ cache: # proxy_port: 0 # - # Overrides the ACTIONS_CACHE_URL passed to workflow - # containers. This should only be used if the runner host is not - # reachable from the workflow containers, and requires further - # setup. + # Overrides the ACTIONS_CACHE_URL variable passed to workflow + # containers. The URL should generally not end with "/". This should only + # be used if the runner host is not reachable from the workflow containers, + # and requires further setup. # actions_cache_url_override: "" From 76bf87f472ae3dca88dbd970032610bf1ea6f44e Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 15 Aug 2025 21:10:53 +0000 Subject: [PATCH 093/281] fix: data race condition causing incorrect `shell` on a task step if it referenced a matrix variable (#865) The `setupShell` function would update the shell stored on the `Step` object, setting it to either a default value from the job, an expression evaluated in the context of the job, a default from the workflow, or finally falling back to bash or powershell defaults. Typically this would be fine -- although it would trigger the data race detector because the `Step` is a shared object between multiple concurrent matrix evaluations for the job. In the *really quite unlikely* case that the `shell` field on a step or job referenced a matrix variable, this data race would actually trigger the shared step's `Shell` value to end up as "whichever one was evaluated last", causing the wrong shell to be used. The new `matrix-shell` test triggers this behavior, and fails without the associated code fix. As a fix, the `Shell` field in `Step` is never mutated; instead only the value on non-shared `stepRun` instance is updated from `setupShellCommand`. `Shell` was renamed to `RawShell` as part of verifying all references were updated and it seemed to make sense to keep that name since it is a pre-evaluator value. ``` ================== WARNING: DATA RACE Write at 0x00c00013e9b0 by goroutine 1470: code.forgejo.org/forgejo/runner/v9/act/runner.(*stepRun).setupShell() /.../forgejo-runner/act/runner/step_run.go:210 +0x8f2 code.forgejo.org/forgejo/runner/v9/act/common/git.FindGitRevision() /.../forgejo-runner/act/common/git/git.go:58 +0xc4 code.forgejo.org/forgejo/runner/v9/act/model.(*GithubContext).SetSha() /.../forgejo-runner/act/model/github_context.go:161 +0x6b5 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).getGithubContext() /.../forgejo-runner/act/runner/run_context.go:1228 +0x26ca ... Previous write at 0x00c00013e9b0 by goroutine 1469: code.forgejo.org/forgejo/runner/v9/act/runner.(*stepRun).setupShell() /.../forgejo-runner/act/runner/step_run.go:210 +0x8f2 code.forgejo.org/forgejo/runner/v9/act/common/git.FindGitRevision() /.../forgejo-runner/act/common/git/git.go:58 +0xc4 code.forgejo.org/forgejo/runner/v9/act/model.(*GithubContext).SetSha() /.../forgejo-runner/act/model/github_context.go:161 +0x6b5 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).getGithubContext() /.../forgejo-runner/act/runner/run_context.go:1228 +0x26ca ... ================== ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/865): fix: data race condition causing incorrect `shell` on a task step if it referenced a matrix variable Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/865 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/model/workflow.go | 28 +---------- act/model/workflow_test.go | 19 -------- act/runner/runner_test.go | 1 + act/runner/step_run.go | 57 ++++++++++++++++------- act/runner/step_run_test.go | 19 ++++++++ act/runner/testdata/matrix-shell/push.yml | 32 +++++++++++++ 6 files changed, 93 insertions(+), 63 deletions(-) create mode 100644 act/runner/testdata/matrix-shell/push.yml diff --git a/act/model/workflow.go b/act/model/workflow.go index 5ca423c3..0cc337a4 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -613,7 +613,7 @@ type Step struct { Uses string `yaml:"uses"` Run string `yaml:"run"` WorkingDirectory string `yaml:"working-directory"` - Shell string `yaml:"shell"` + RawShell string `yaml:"shell"` Env yaml.Node `yaml:"env"` With map[string]string `yaml:"with"` RawContinueOnError string `yaml:"continue-on-error"` @@ -649,32 +649,6 @@ func (s *Step) GetEnv() map[string]string { return env } -// ShellCommand returns the command for the shell -func (s *Step) ShellCommand() string { - var shellCommand string - - // Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L9-L17 - switch s.Shell { - case "", "bash": - shellCommand = "bash --noprofile --norc -e -o pipefail {0}" - case "pwsh": - shellCommand = "pwsh -command . '{0}'" - case "python": - shellCommand = "python {0}" - case "sh": - shellCommand = "sh -e {0}" - case "cmd": - shellCommand = "cmd /D /E:ON /V:OFF /S /C \"CALL \"{0}\"\"" - case "powershell": - shellCommand = "powershell -command . '{0}'" - case "node": - shellCommand = "node {0}" - default: - shellCommand = s.Shell - } - return shellCommand -} - // StepType describes what type of step we are about to run type StepType int diff --git a/act/model/workflow_test.go b/act/model/workflow_test.go index 6859ab8c..d1a237e4 100644 --- a/act/model/workflow_test.go +++ b/act/model/workflow_test.go @@ -546,25 +546,6 @@ func TestReadWorkflow_Strategy(t *testing.T) { assert.Equal(t, job.Strategy.FailFast, false) } -func TestStep_ShellCommand(t *testing.T) { - tests := []struct { - shell string - want string - }{ - {"pwsh -v '. {0}'", "pwsh -v '. {0}'"}, - {"pwsh", "pwsh -command . '{0}'"}, - {"powershell", "powershell -command . '{0}'"}, - {"node", "node {0}"}, - {"python", "python {0}"}, - } - for _, tt := range tests { - t.Run(tt.shell, func(t *testing.T) { - got := (&Step{Shell: tt.shell}).ShellCommand() - assert.Equal(t, got, tt.want) - }) - } -} - func TestReadWorkflow_WorkflowDispatchConfig(t *testing.T) { yaml := ` name: local-action-docker-url diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 8f2ab0db..074875eb 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -283,6 +283,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "matrix", "push", "", platforms, secrets}, {workdir, "matrix-include-exclude", "push", "", platforms, secrets}, {workdir, "matrix-exitcode", "push", "Job 'test' failed", platforms, secrets}, + {workdir, "matrix-shell", "push", "", platforms, secrets}, {workdir, "commands", "push", "", platforms, secrets}, {workdir, "workdir", "push", "", platforms, secrets}, {workdir, "defaults-run", "push", "", platforms, secrets}, diff --git a/act/runner/step_run.go b/act/runner/step_run.go index 68daa143..23e45a92 100644 --- a/act/runner/step_run.go +++ b/act/runner/step_run.go @@ -94,6 +94,28 @@ func getScriptName(rc *RunContext, step *model.Step) string { return fmt.Sprintf("workflow/%s", scriptName) } +func shellCommand(shell string) string { + // Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L9-L17 + switch shell { + case "", "bash": + return "bash --noprofile --norc -e -o pipefail {0}" + case "pwsh": + return "pwsh -command . '{0}'" + case "python": + return "python {0}" + case "sh": + return "sh -e {0}" + case "cmd": + return "cmd /D /E:ON /V:OFF /S /C \"CALL \"{0}\"\"" + case "powershell": + return "powershell -command . '{0}'" + case "node": + return "node {0}" + default: + return shell + } +} + // TODO: Currently we just ignore top level keys, BUT we should return proper error on them // BUTx2 I leave this for when we rewrite act to use actionlint for workflow validation // so we return proper errors before any execution or spawning containers @@ -101,22 +123,21 @@ func getScriptName(rc *RunContext, step *model.Step) string { // OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: "${{": executable file not found in $PATH: unknown func (sr *stepRun) setupShellCommand(ctx context.Context) (name, script string, err error) { logger := common.Logger(ctx) - sr.setupShell(ctx) + shell := sr.interpretShell(ctx) sr.setupWorkingDirectory(ctx) step := sr.Step script = sr.RunContext.NewStepExpressionEvaluator(ctx, sr).Interpolate(ctx, step.Run) - scCmd := step.ShellCommand() - + shellCommand := shellCommand(shell) name = getScriptName(sr.RunContext, step) // Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L47-L64 // Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L19-L27 runPrepend := "" runAppend := "" - switch step.Shell { + switch shell { case "bash", "sh": name += ".sh" case "pwsh", "powershell": @@ -142,7 +163,7 @@ func (sr *stepRun) setupShellCommand(ctx context.Context) (name, script string, rc := sr.getRunContext() scriptPath := fmt.Sprintf("%s/%s", rc.JobContainer.GetActPath(), name) - sr.cmdline = strings.Replace(scCmd, `{0}`, scriptPath, 1) + sr.cmdline = strings.Replace(shellCommand, `{0}`, scriptPath, 1) sr.cmd, err = shellquote.Split(sr.cmdline) return name, script, err @@ -164,34 +185,34 @@ func (l *localEnv) Getenv(name string) string { return l.env[name] } -func (sr *stepRun) setupShell(ctx context.Context) { +func (sr *stepRun) interpretShell(ctx context.Context) string { rc := sr.RunContext - step := sr.Step + shell := sr.Step.RawShell - if step.Shell == "" { - step.Shell = rc.Run.Job().Defaults.Run.Shell + if shell == "" { + shell = rc.Run.Job().Defaults.Run.Shell } - step.Shell = rc.NewExpressionEvaluator(ctx).Interpolate(ctx, step.Shell) + shell = rc.NewExpressionEvaluator(ctx).Interpolate(ctx, shell) - if step.Shell == "" { - step.Shell = rc.Run.Workflow.Defaults.Run.Shell + if shell == "" { + shell = rc.Run.Workflow.Defaults.Run.Shell } - if step.Shell == "" { + if shell == "" { if _, ok := rc.JobContainer.(*container.HostEnvironment); ok { shellWithFallback := []string{"bash", "sh"} // Don't use bash on windows by default, if not using a docker container if runtime.GOOS == "windows" { shellWithFallback = []string{"pwsh", "powershell"} } - step.Shell = shellWithFallback[0] + shell = shellWithFallback[0] lenv := &localEnv{env: map[string]string{}} maps.Copy(lenv.env, sr.env) sr.getRunContext().ApplyExtraPath(ctx, &lenv.env) _, err := lookpath.LookPath2(shellWithFallback[0], lenv) if err != nil { - step.Shell = shellWithFallback[1] + shell = shellWithFallback[1] } } else { shellFallback := ` @@ -204,11 +225,13 @@ fi stdout, _, err := rc.sh(ctx, shellFallback) if err != nil { common.Logger(ctx).Error("fail to run %q: %v", shellFallback, err) - return + } else { + shell = stdout } - step.Shell = stdout } } + + return shell } func (sr *stepRun) setupWorkingDirectory(ctx context.Context) { diff --git a/act/runner/step_run_test.go b/act/runner/step_run_test.go index b49e2405..1fe376f2 100644 --- a/act/runner/step_run_test.go +++ b/act/runner/step_run_test.go @@ -93,3 +93,22 @@ func TestStepRunPrePost(t *testing.T) { err = sr.post()(ctx) assert.Nil(t, err) } + +func TestStepShellCommand(t *testing.T) { + tests := []struct { + shell string + want string + }{ + {"pwsh -v '. {0}'", "pwsh -v '. {0}'"}, + {"pwsh", "pwsh -command . '{0}'"}, + {"powershell", "powershell -command . '{0}'"}, + {"node", "node {0}"}, + {"python", "python {0}"}, + } + for _, tt := range tests { + t.Run(tt.shell, func(t *testing.T) { + got := shellCommand(tt.shell) + assert.Equal(t, got, tt.want) + }) + } +} diff --git a/act/runner/testdata/matrix-shell/push.yml b/act/runner/testdata/matrix-shell/push.yml new file mode 100644 index 00000000..d7e1e5ef --- /dev/null +++ b/act/runner/testdata/matrix-shell/push.yml @@ -0,0 +1,32 @@ +name: test + +on: push + +jobs: + matrix-shell: + runs-on: ubuntu-latest + strategy: + matrix: + shell-to-use: ["bash", "cat {0}", "sh"] + steps: + - shell: ${{ matrix.shell-to-use }} + run: | + expected=${{ matrix.shell-to-use }} + if [ "$expected" = "bash" ]; then + if [ -z "$BASH_VERSION" ]; then + echo "Expected to execute bash shell, but BASH_VERSION is unset" + exit 1 + else + echo "Successfully running in bash ($BASH_VERSION)" + fi + elif [ "$expected" = "sh" ]; then + if [ -n "$BASH_VERSION" ]; then + echo "Expected to execute in sh shell, but BASH_VERSION is set ($BASH_VERSION)" + exit 1 + else + echo "Probably running in sh" + fi + else + echo "Not sure what's happening; expected shell is $expected ?!" + exit 1 + fi From cf1a723a8892c33462acc67674e0288fe7d90bda Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 16 Aug 2025 05:02:49 +0000 Subject: [PATCH 094/281] Update module github.com/vektra/mockery/v2 to v3.5.3 (#868) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/vektra/mockery/v2](https://github.com/vektra/mockery) | `v3.5.2` -> `v3.5.3` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fvektra%2fmockery%2fv2/v3.5.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fvektra%2fmockery%2fv2/v3.5.2/v3.5.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
vektra/mockery (github.com/vektra/mockery/v2) ### [`v3.5.3`](https://github.com/vektra/mockery/releases/tag/v3.5.3) [Compare Source](https://github.com/vektra/mockery/compare/v3.5.2...v3.5.3) #### What's Changed - Support Go 1.25 by [@​LandonTClipp](https://github.com/LandonTClipp) in https://github.com/vektra/mockery/pull/1104 **Full Changelog**: https://github.com/vektra/mockery/compare/v3.5.2...v3.5.3
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/868): Update module github.com/vektra/mockery/v2 to v3.5.3 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/868 Reviewed-by: Gusted Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 98d4fa49..e32d7759 100644 --- a/Makefile +++ b/Makefile @@ -13,7 +13,7 @@ WINDOWS_ARCHS ?= windows/amd64 GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") -MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v3.5.2 # renovate: datasource=go +MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v3.5.3 # renovate: datasource=go GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner From fccf857bce835fee542263f4bb0fd22ba829c6cb Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sat, 16 Aug 2025 05:15:38 +0000 Subject: [PATCH 095/281] test: fix data race triggered by testing mocks in TestSetJobResultConcurrency (#869) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #862 caused a **new** data race in its mock testing while fixing `setJobResult`'s data race. 🤣 I'm going backwards! ``` ================== WARNING: DATA RACE Read at 0x00c000168d88 by goroutine 943: code.forgejo.org/forgejo/runner/v9/act/model.(*Workflow).GetJob() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/model/workflow.go:742 +0x244 code.forgejo.org/forgejo/runner/v9/act/model.(*Run).Job() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/model/planner.go:50 +0xab code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/runner/job_executor.go:166 +0x7c code.forgejo.org/forgejo/runner/v9/act/runner.TestSetJobResultConcurrency.func2() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/runner/job_executor_test.go:404 +0xfb Previous write at 0x00c000168d88 by goroutine 944: code.forgejo.org/forgejo/runner/v9/act/model.(*Workflow).GetJob() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/model/workflow.go:743 +0x258 code.forgejo.org/forgejo/runner/v9/act/model.(*Run).Job() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/model/planner.go:50 +0xab code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/runner/job_executor.go:166 +0x7c code.forgejo.org/forgejo/runner/v9/act/runner.TestSetJobResultConcurrency.func3() /home/debian/.cache/act/8afb5309fced9ef8/hostexecutor/act/runner/job_executor_test.go:409 +0xf8 ... ================== ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/869): test: fix data race triggered by testing mocks in TestSetJobResultConcurrency Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/869 Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/job_executor_test.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index 3915b971..918ece94 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -362,6 +362,12 @@ func TestSetJobResultConcurrency(t *testing.T) { }, }, } + // Hack: Job() invokes GetJob() which can mutate the job name, this will trip the data race detector if it is + // encountered later when `setJobResult()` is being tested. This is a false-positive caused by this test invoking + // setJobResult outside of the regular RunContext, so it's invoked here before the goroutines are spawned to prevent + // the false positive. + rc1.Run.Job() + rc2.Run.Job() jim.On("matrix").Return(map[string]interface{}{ "python": []string{"3.10", "3.11", "3.12"}, From d114f3646ddf948935f33e50b27f62728f22b7f8 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 16 Aug 2025 19:13:32 +0200 Subject: [PATCH 096/281] feat: insert the daemon context in the poller context The daemon context is needed when the context of a job or the poller is done. Otherwise it is no longer possible to send a conclusion report to Forgejo, short of creating a context.Background() which poses its own set of problems. - WithDaemonContext is used to store the daemon context - The poller uses the daemon context instead of context.Background --- internal/app/cmd/cmd.go | 3 ++- internal/app/cmd/daemon.go | 2 +- internal/app/poll/poller.go | 10 +++++----- internal/app/poll/poller_test.go | 4 +++- internal/pkg/common/daemon_context.go | 26 ++++++++++++++++++++++++++ 5 files changed, 37 insertions(+), 8 deletions(-) create mode 100644 internal/pkg/common/daemon_context.go diff --git a/internal/app/cmd/cmd.go b/internal/app/cmd/cmd.go index c3a98a88..2f9bd3e4 100644 --- a/internal/app/cmd/cmd.go +++ b/internal/app/cmd/cmd.go @@ -10,6 +10,7 @@ import ( "github.com/spf13/cobra" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/common" "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" ) @@ -45,7 +46,7 @@ func Execute(ctx context.Context) { Use: "daemon", Short: "Run as a runner daemon", Args: cobra.MaximumNArgs(1), - RunE: runDaemon(ctx, &configFile), + RunE: runDaemon(common.WithDaemonContext(ctx, ctx), &configFile), } rootCmd.AddCommand(daemonCmd) diff --git a/internal/app/cmd/daemon.go b/internal/app/cmd/daemon.go index 0a9815ed..22fd8c26 100644 --- a/internal/app/cmd/daemon.go +++ b/internal/app/cmd/daemon.go @@ -114,7 +114,7 @@ func runDaemon(ctx context.Context, configFile *string) func(cmd *cobra.Command, } } - poller := poll.New(cfg, cli, runner) + poller := poll.New(ctx, cfg, cli, runner) go poller.Poll() diff --git a/internal/app/poll/poller.go b/internal/app/poll/poller.go index 4ebe4405..5a4061f8 100644 --- a/internal/app/poll/poller.go +++ b/internal/app/poll/poller.go @@ -42,14 +42,14 @@ type poller struct { done chan any } -func New(cfg *config.Config, client client.Client, runner run.RunnerInterface) Poller { - return (&poller{}).init(cfg, client, runner) +func New(ctx context.Context, cfg *config.Config, client client.Client, runner run.RunnerInterface) Poller { + return (&poller{}).init(ctx, cfg, client, runner) } -func (p *poller) init(cfg *config.Config, client client.Client, runner run.RunnerInterface) Poller { - pollingCtx, shutdownPolling := context.WithCancel(context.Background()) +func (p *poller) init(ctx context.Context, cfg *config.Config, client client.Client, runner run.RunnerInterface) Poller { + pollingCtx, shutdownPolling := context.WithCancel(ctx) - jobsCtx, shutdownJobs := context.WithCancel(context.Background()) + jobsCtx, shutdownJobs := context.WithCancel(ctx) done := make(chan any) diff --git a/internal/app/poll/poller_test.go b/internal/app/poll/poller_test.go index 0c5febfe..7c8b7633 100644 --- a/internal/app/poll/poller_test.go +++ b/internal/app/poll/poller_test.go @@ -118,7 +118,7 @@ func setTrace(t *testing.T) { } func TestPoller_New(t *testing.T) { - p := New(&config.Config{}, &mockClient{}, &mockRunner{}) + p := New(t.Context(), &config.Config{}, &mockClient{}, &mockRunner{}) assert.NotNil(t, p) } @@ -172,6 +172,7 @@ func TestPoller_Runner(t *testing.T) { } p := &mockPoller{} p.init( + t.Context(), &config.Config{ Runner: configRunner, }, @@ -239,6 +240,7 @@ func TestPoller_Fetch(t *testing.T) { } p := &mockPoller{} p.init( + t.Context(), &config.Config{ Runner: configRunner, }, diff --git a/internal/pkg/common/daemon_context.go b/internal/pkg/common/daemon_context.go new file mode 100644 index 00000000..8cb2f70a --- /dev/null +++ b/internal/pkg/common/daemon_context.go @@ -0,0 +1,26 @@ +// Copyright 2025 The Forgejo Authors +// SPDX-License-Identifier: MIT + +package common + +import ( + "context" +) + +type daemonContextKey string + +const daemonContextKeyVal = daemonContextKey("daemon") + +func DaemonContext(ctx context.Context) context.Context { + val := ctx.Value(daemonContextKeyVal) + if val != nil { + if daemon, ok := val.(context.Context); ok { + return daemon + } + } + return context.Background() +} + +func WithDaemonContext(ctx, daemon context.Context) context.Context { + return context.WithValue(ctx, daemonContextKeyVal, daemon) +} From bd2b7d2b32beba4e9cef6f16fa3fae323686fea4 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 16 Aug 2025 19:25:50 +0200 Subject: [PATCH 097/281] fix: after canceling the context, the reporter cannot communicate ctx & cancel are related and when cancel is called, the context is no longer usable. Use the daemon context context to allow the reporter to continue to operate and conclude the converation with the Forgejo instance. --- internal/pkg/report/reporter.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 2545faf3..ed7e81a4 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -20,6 +20,7 @@ import ( "google.golang.org/protobuf/types/known/timestamppb" "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/common" ) var ( @@ -61,7 +62,10 @@ func NewReporter(ctx context.Context, cancel context.CancelFunc, c client.Client } rv := &Reporter{ - ctx: ctx, + // ctx & cancel are related: the daemon context allows the reporter + // to continue to operate even after the context is canceled, to + // conclude the converation + ctx: common.DaemonContext(ctx), cancel: cancel, client: c, masker: masker, From 776f0641fd227e52a2cd14e08acbb2b9e1ebab75 Mon Sep 17 00:00:00 2001 From: earl-warren Date: Sat, 16 Aug 2025 17:59:20 +0000 Subject: [PATCH 098/281] feat: fail when using an invalid label during non interactive registration (#647) * add test * return validation error not nil from function Reviewed-on: https://gitea.com/gitea/act_runner/pulls/683 Reviewed-by: techknowlogick Co-authored-by: Christopher Homberger Co-committed-by: Christopher Homberger (cherry picked from commit f0b5aff3bbeda469a682fe21144c16485ea2189a) - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/647): feat: fail when using an invalid label during non interactive registration Co-authored-by: Christopher Homberger Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/647 Reviewed-by: Gusted Reviewed-by: Mathieu Fenniak --- internal/app/cmd/register.go | 2 +- internal/app/cmd/register_test.go | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/internal/app/cmd/register.go b/internal/app/cmd/register.go index 5e2f5d8a..a6a3d2cf 100644 --- a/internal/app/cmd/register.go +++ b/internal/app/cmd/register.go @@ -276,7 +276,7 @@ func registerNoInteractive(ctx context.Context, configFile string, regArgs *regi } if err := inputs.validate(); err != nil { log.WithError(err).Errorf("Invalid input, please re-run act command.") - return nil + return err } if err := doRegister(ctx, cfg, inputs); err != nil { return fmt.Errorf("Failed to register runner: %w", err) diff --git a/internal/app/cmd/register_test.go b/internal/app/cmd/register_test.go index a69775a8..1283db97 100644 --- a/internal/app/cmd/register_test.go +++ b/internal/app/cmd/register_test.go @@ -6,6 +6,8 @@ package cmd import ( "slices" "testing" + + "github.com/stretchr/testify/assert" ) func TestCommaSplit(t *testing.T) { @@ -29,3 +31,12 @@ func TestCommaSplit(t *testing.T) { } } } + +func TestRegisterNonInteractiveReturnsLabelValidationError(t *testing.T) { + err := registerNoInteractive(t.Context(), "", ®isterArgs{ + Labels: "label:invalid", + Token: "token", + InstanceAddr: "http://localhost:3000", + }) + assert.Error(t, err, "unsupported schema: invalid") +} From 25879b92f4e4666c696e2da0a10c17fe3c349590 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 16 Aug 2025 19:27:17 +0200 Subject: [PATCH 099/281] feat: log a descriptive message when a job exceeds the config timeout - change the argument from string to error to differentiate a timeout error - when there is a timeout, display a message more descriptive than "context deadline" - always set the StoppedAt state value instead of only if the result was unspecified: it is the last state update. --- internal/app/run/runner.go | 6 +- internal/pkg/report/reporter.go | 32 +++++++--- internal/pkg/report/reporter_test.go | 94 +++++++++++++++++++++++++++- 3 files changed, 115 insertions(+), 17 deletions(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 25de8caa..b2fcf4fc 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -170,11 +170,7 @@ func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) error { reporter := report.NewReporter(ctx, cancel, r.client, task, r.cfg.Runner.ReportInterval) var runErr error defer func() { - lastWords := "" - if runErr != nil { - lastWords = runErr.Error() - } - _ = reporter.Close(lastWords) + _ = reporter.Close(runErr) }() reporter.RunDaemon() runErr = r.run(ctx, task, reporter) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index ed7e81a4..a02f0e72 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -236,13 +236,24 @@ func (r *Reporter) SetOutputs(outputs map[string]string) error { return errors.Join(errs...) } -func (r *Reporter) Close(lastWords string) error { +const ( + closeTimeoutMessage = "The runner cancelled the job because it exceeds the maximum run time" + closeCancelledMessage = "Cancelled" +) + +func (r *Reporter) Close(runErr error) error { r.closed = true r.stateMu.Lock() - if r.state.Result == runnerv1.Result_RESULT_UNSPECIFIED { - if lastWords == "" { - lastWords = "Early termination" + var lastWords string + if errors.Is(runErr, context.DeadlineExceeded) { + lastWords = closeTimeoutMessage + r.state.Result = runnerv1.Result_RESULT_CANCELLED + } else if r.state.Result == runnerv1.Result_RESULT_UNSPECIFIED { + if runErr == nil { + lastWords = closeCancelledMessage + } else { + lastWords = runErr.Error() } for _, v := range r.state.Steps { if v.Result == runnerv1.Result_RESULT_UNSPECIFIED { @@ -250,17 +261,18 @@ func (r *Reporter) Close(lastWords string) error { } } r.state.Result = runnerv1.Result_RESULT_FAILURE - r.logRows = append(r.logRows, &runnerv1.LogRow{ - Time: timestamppb.Now(), - Content: lastWords, - }) - r.state.StoppedAt = timestamppb.Now() - } else if lastWords != "" { + } else if runErr != nil { + lastWords = runErr.Error() + r.state.Result = runnerv1.Result_RESULT_FAILURE + } + + if lastWords != "" { r.logRows = append(r.logRows, &runnerv1.LogRow{ Time: timestamppb.Now(), Content: lastWords, }) } + r.state.StoppedAt = timestamppb.Now() r.stateMu.Unlock() return retry.Do(func() error { diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index 23a95547..40af3e30 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -21,6 +21,7 @@ import ( "google.golang.org/protobuf/types/known/structpb" "code.forgejo.org/forgejo/runner/v9/internal/pkg/client/mocks" + "code.forgejo.org/forgejo/runner/v9/internal/pkg/common" "code.forgejo.org/forgejo/runner/v9/testutils" ) @@ -51,11 +52,11 @@ func mockReporter(t *testing.T) (*Reporter, *mocks.Client, func()) { ctx, cancel := context.WithCancel(context.Background()) taskCtx, err := structpb.NewStruct(map[string]any{}) require.NoError(t, err) - reporter := NewReporter(ctx, cancel, client, &runnerv1.Task{ + reporter := NewReporter(common.WithDaemonContext(ctx, t.Context()), cancel, client, &runnerv1.Task{ Context: taskCtx, }, time.Second) close := func() { - assert.NoError(t, reporter.Close("")) + assert.NoError(t, reporter.Close(nil)) } return reporter, client, close } @@ -407,3 +408,92 @@ func TestReporterReportLog(t *testing.T) { }) } } + +func TestReporterClose(t *testing.T) { + mockReporterCloser := func(message *string, result *runnerv1.Result) *Reporter { + reporter, client, _ := mockReporter(t) + if message != nil { + client.On("UpdateLog", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateLogRequest]) (*connect_go.Response[runnerv1.UpdateLogResponse], error) { + t.Logf("UpdateLogRequest: %s", req.Msg.String()) + assert.Equal(t, (*message)+"\n", rowsToString(req.Msg.Rows)) + resp := &runnerv1.UpdateLogResponse{ + AckIndex: req.Msg.Index + 1, + } + t.Logf("UpdateLogResponse: %s", resp.String()) + return connect_go.NewResponse(resp), nil + }) + } + + if result != nil { + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + assert.Equal(t, result.String(), req.Msg.State.Result.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{}), nil + }) + } + return reporter + } + + for _, testCase := range []struct { + name string + err error + expectedMessage string + result runnerv1.Result + expectedResult runnerv1.Result + }{ + { + name: "ResultSuccessAndNilErrorIsResultSuccess", + err: nil, + expectedMessage: "", + result: runnerv1.Result_RESULT_SUCCESS, + expectedResult: runnerv1.Result_RESULT_SUCCESS, + }, + { + name: "ResultUnspecifiedAndErrorIsResultFailure", + err: errors.New("ERROR_MESSAGE"), + expectedMessage: "ERROR_MESSAGE", + result: runnerv1.Result_RESULT_UNSPECIFIED, + expectedResult: runnerv1.Result_RESULT_FAILURE, + }, + { + name: "ResultUnspecifiedAndNilErrorIsResultFailure", + err: nil, + expectedMessage: closeCancelledMessage, + result: runnerv1.Result_RESULT_UNSPECIFIED, + expectedResult: runnerv1.Result_RESULT_FAILURE, + }, + { + name: "ResultSuccessAndErrorIsResultFailure", + err: errors.New("ERROR_MESSAGE"), + expectedMessage: "ERROR_MESSAGE", + result: runnerv1.Result_RESULT_SUCCESS, + expectedResult: runnerv1.Result_RESULT_FAILURE, + }, + { + name: "Timeout", + err: context.DeadlineExceeded, + expectedMessage: closeTimeoutMessage, + result: runnerv1.Result_RESULT_UNSPECIFIED, + expectedResult: runnerv1.Result_RESULT_CANCELLED, + }, + } { + t.Run(testCase.name, func(t *testing.T) { + var message *string + if testCase.expectedMessage != "" { + message = &testCase.expectedMessage + } + reporter := mockReporterCloser(message, &testCase.expectedResult) + + // cancel() verifies Close can operate after the context is cancelled + // because it uses the daemon context instead + reporter.cancel() + reporter.state.Result = testCase.result + reporter.state.Steps = []*runnerv1.StepState{ + { + Result: runnerv1.Result_RESULT_UNSPECIFIED, + }, + } + require.NoError(t, reporter.Close(testCase.err)) + }) + } +} From 165b44deec82dbf9ff915100a23f8f857e3ff49f Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sat, 16 Aug 2025 20:44:40 +0000 Subject: [PATCH 100/281] fix: data race in 'runs-on' expressions causes incorrect job labels during execution (#871) A job with a `runs-on` that references matrix variables will not run with the expected labels. eg. ``` jobs: matrix-runs-on: strategy: matrix: os: [ubuntu-latest, ubuntu-20.04] runs-on: ${{ matrix.os }} steps: ... ``` Due to shared mutated state, both jobs that this generates will (w/ a race condition) either run with the `ubuntu-latest` or `ubuntu-20.04`, but rarely (never observed) with the expected outcome of running on both labels. `EvaluateYamlNode` is used to evaluate expressions in the `runs-on` field in the context of the current running job, but mutating an object shared between multiple concurrent jobs (in matrix evaluation). This results in the evaluation results from one job spilling into another and corrupting their `runs-on` labels. ``` ================== WARNING: DATA RACE Write at 0x00c00047e0b0 by goroutine 1739: reflect.typedmemmove() /.../go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/runtime/mbarrier.go:213 +0x0 reflect.Value.Set() /.../go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:2062 +0x184 gopkg.in/yaml%2ev3.(*decoder).unmarshal() /.../go/pkg/mod/gopkg.in/yaml.v3@v3.0.1/decode.go:493 +0x7b4 gopkg.in/yaml%2ev3.(*Node).Decode() /.../go/pkg/mod/gopkg.in/yaml.v3@v3.0.1/yaml.go:149 +0x355 code.forgejo.org/forgejo/runner/v9/act/runner.expressionEvaluator.EvaluateYamlNode() /.../forgejo-runner/act/runner/expression.go:372 +0x7a code.forgejo.org/forgejo/runner/v9/act/runner.(*expressionEvaluator).EvaluateYamlNode() :1 +0x6b code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).runsOnPlatformNames() /.../forgejo-runner/act/runner/run_context.go:1019 +0x2af code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).runsOnImage() /.../forgejo-runner/act/runner/run_context.go:1002 +0x772 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).platformImage() /.../forgejo-runner/act/runner/run_context.go:1032 +0x77 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).isEnabled() /.../forgejo-runner/act/runner/run_context.go:1069 +0x3c7 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1() /.../forgejo-runner/act/runner/run_context.go:964 +0x4b code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:223 +0x271 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Previous read at 0x00c00047e0b0 by goroutine 1742: code.forgejo.org/forgejo/runner/v9/act/model.(*Job).RunsOn() /.../forgejo-runner/act/model/workflow.go:361 +0x3c4 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).runsOnImage() /.../forgejo-runner/act/runner/run_context.go:991 +0x57a code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).platformImage() /.../forgejo-runner/act/runner/run_context.go:1032 +0x77 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).isEnabled() /.../forgejo-runner/act/runner/run_context.go:1069 +0x3c7 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1() /.../forgejo-runner/act/runner/run_context.go:964 +0x4b code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:223 +0x271 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f ... ================== ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/871): fix: data race in 'runs-on' expressions causes incorrect job labels during execution Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/871 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/jobparser/model.go | 4 -- act/model/workflow.go | 13 ++++-- act/runner/run_context.go | 9 +++- act/runner/runner_test.go | 48 ++++++++++++++++++++- act/runner/testdata/matrix-runs-on/push.yml | 14 ++++++ 5 files changed, 78 insertions(+), 10 deletions(-) create mode 100644 act/runner/testdata/matrix-runs-on/push.yml diff --git a/act/jobparser/model.go b/act/jobparser/model.go index dd446596..9de9eab7 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -119,10 +119,6 @@ func (j *Job) EraseNeeds() *Job { return j } -func (j *Job) RunsOn() []string { - return (&model.Job{RawRunsOn: j.RawRunsOn}).RunsOn() -} - type Step struct { ID string `yaml:"id,omitempty"` If yaml.Node `yaml:"if,omitempty"` diff --git a/act/model/workflow.go b/act/model/workflow.go index 0cc337a4..c9acd375 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -339,14 +339,21 @@ func (j *Job) Needs() []string { // RunsOn list for Job func (j *Job) RunsOn() []string { - switch j.RawRunsOn.Kind { + return FlattenRunsOnNode(j.RawRunsOn) +} + +// Given an already expression-evaluated `runs-on` yaml node from a job, compute all the labels that will be run for a +// job. Can be a single string label, an array of labels, or an object { group: "...", labels: [...] }; +// FlattenRunsOnNode will flatten all the options down to a []string. +func FlattenRunsOnNode(runsOn yaml.Node) []string { + switch runsOn.Kind { case yaml.MappingNode: var val struct { Group string Labels yaml.Node } - if !decodeNode(j.RawRunsOn, &val) { + if !decodeNode(runsOn, &val) { return nil } @@ -358,7 +365,7 @@ func (j *Job) RunsOn() []string { return labels default: - return nodeAsStringSlice(j.RawRunsOn) + return nodeAsStringSlice(runsOn) } } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 9a8bd3e5..86500854 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -993,12 +993,17 @@ func (rc *RunContext) runsOnPlatformNames(ctx context.Context) []string { return []string{} } - if err := rc.ExprEval.EvaluateYamlNode(ctx, &job.RawRunsOn); err != nil { + // Copy rawRunsOn from the job. `EvaluateYamlNode` later will mutate the yaml node in-place applying expression + // evaluation to it from the RunContext -- but the job object is shared in matrix executions between multiple + // running matrix jobs and `rc.EvalExpr` is specific to one matrix job. By copying the object we avoid mutating the + // shared field as it is accessed by multiple goroutines. + rawRunsOn := job.RawRunsOn + if err := rc.ExprEval.EvaluateYamlNode(ctx, &rawRunsOn); err != nil { common.Logger(ctx).Errorf("Error while evaluating runs-on: %v", err) return []string{} } - return job.RunsOn() + return model.FlattenRunsOnNode(rawRunsOn) } func (rc *RunContext) platformImage(ctx context.Context) string { diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 10634673..cee533e3 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -9,6 +9,7 @@ import ( "path" "path/filepath" "strings" + "sync" "testing" "github.com/joho/godotenv" @@ -476,7 +477,24 @@ func TestRunner_RunSkipped(t *testing.T) { } type maskJobLoggerFactory struct { - Output bytes.Buffer + Output syncBuffer +} + +type syncBuffer struct { + buffer bytes.Buffer + mutex sync.Mutex +} + +func (sb *syncBuffer) Write(p []byte) (n int, err error) { + sb.mutex.Lock() + defer sb.mutex.Unlock() + return sb.buffer.Write(p) +} + +func (sb *syncBuffer) String() string { + sb.mutex.Lock() + defer sb.mutex.Unlock() + return sb.buffer.String() } func (f *maskJobLoggerFactory) WithJobLogger() *log.Logger { @@ -641,3 +659,31 @@ func TestRunner_RunMatrixWithUserDefinedInclusions(t *testing.T) { tjfi.runTest(t.Context(), t, &Config{Matrix: matrix}) } + +// Regression test against `runs-on` in a matrix run, which references the matrix values, being corrupted by multiple +// concurrent goroutines. +func TestRunner_RunsOnMatrix(t *testing.T) { + if testing.Short() { + t.Skip("skipping integration test") + } + + log.SetLevel(log.DebugLevel) + + tjfi := TestJobFileInfo{ + workdir: workdir, + workflowPath: "matrix-runs-on", + eventName: "push", + errorMessage: "", + platforms: platforms, + } + + logger := &maskJobLoggerFactory{} + tjfi.runTest(WithJobLoggerFactory(common.WithLogger(t.Context(), logger.WithJobLogger()), logger), t, &Config{}) + output := logger.Output.String() + + // job 1 should succeed because `ubuntu-latest` is a valid runs-on target... + assert.Contains(t, output, "msg=\"🏁 Job succeeded\" dryrun=false job=test/matrix-runs-on-1", "expected job 1 to succeed, but did not find success message") + + // job 2 should be skipped because `ubuntu-20.04` is not a valid runs-on target in `platforms`. + assert.Contains(t, output, "msg=\"🚧 Skipping unsupported platform -- Try running with `-P ubuntu-20.04=...`\" dryrun=false job=test/matrix-runs-on-2", "expected job 2 to be skipped, but it was not") +} diff --git a/act/runner/testdata/matrix-runs-on/push.yml b/act/runner/testdata/matrix-runs-on/push.yml new file mode 100644 index 00000000..8863b17f --- /dev/null +++ b/act/runner/testdata/matrix-runs-on/push.yml @@ -0,0 +1,14 @@ +name: test + +on: push + +jobs: + matrix-runs-on: + strategy: + matrix: + os: [ubuntu-latest, ubuntu-20.04] + runs-on: ${{ matrix.os }} + steps: + - run: | + echo TESTOUTPUT: matrix.os == ${{ matrix.os }} + echo TESTOUTPUT: runs-on == ${{ jobs.matrix-runs-on.runs-on }} From ac726862f29b13cda14fb8e66be83a62a7e5aa77 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 18 Aug 2025 04:55:39 +0000 Subject: [PATCH 101/281] Update code.forgejo.org/forgejo/runner Docker tag to v9.1.0 (#877) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | minor | `9.0.3` -> `9.1.0` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v9.1.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.1.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.3...v9.1.0) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes ***
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/877): Update code.forgejo.org/forgejo/runner Docker tag to v9.1.0 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/877 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index 143f9a4f..3f8e646f 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:9.0.3 + image: code.forgejo.org/forgejo/runner:9.1.0 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:9.0.3 + image: code.forgejo.org/forgejo/runner:9.1.0 links: - docker-in-docker - forgejo From 86c8e646fa89580c70e1c8929e016b64cb05a96a Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 05:31:36 +0000 Subject: [PATCH 102/281] chore: go.mod should use the minor version only (#880) Refs https://codeberg.org/forgejo/forgejo/pulls/8926 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/880): chore: go.mod should use the minor version only [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/880 Reviewed-by: Michael Kriese Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index cefb75e5..a25bc8b9 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module code.forgejo.org/forgejo/runner/v9 -go 1.24.0 +go 1.24 toolchain go1.24.6 From b73cf0d017d1d3fe5ca09df607a471595243a93e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 18 Aug 2025 05:45:50 +0000 Subject: [PATCH 103/281] Update dependency forgejo/runner to v9.1.0 (#879) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | minor | `9.0.3` -> `9.1.0` | --- ### Release Notes
forgejo/runner (forgejo/runner) ### [`v9.1.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.1.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.3...v9.1.0) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes ***
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/879): Update dependency forgejo/runner to v9.1.0 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/879 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index e3adca25..8b357645 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=9.0.3 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=9.1.0 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 34731a41be456d5b6328d8c118ba8e0b6c6a226b Mon Sep 17 00:00:00 2001 From: Daniel Morante Date: Mon, 18 Aug 2025 06:01:33 +0000 Subject: [PATCH 104/281] fix: fixes the build on FreeBSD (#882) Just fixes the build, not sure if this actually enables any functionality (yet) on FreeBSD. However, it does seem to at least start: ``` time="2025-08-18T01:02:58-04:00" level=info msg="Starting runner daemon" ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/882): fix: fixes the build on FreeBSD [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/882 Reviewed-by: earl-warren Co-authored-by: Daniel Morante Co-committed-by: Daniel Morante --- act/container/docker_auth.go | 2 +- act/container/docker_build.go | 2 +- act/container/docker_cli.go | 2 +- act/container/docker_images.go | 2 +- act/container/docker_logger.go | 2 +- act/container/docker_network.go | 2 +- act/container/docker_pull.go | 2 +- act/container/docker_run.go | 2 +- act/container/docker_stub.go | 2 +- act/container/docker_volume.go | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/act/container/docker_auth.go b/act/container/docker_auth.go index 01b0c816..555832cb 100644 --- a/act/container/docker_auth.go +++ b/act/container/docker_auth.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container diff --git a/act/container/docker_build.go b/act/container/docker_build.go index 7b8dd906..0400ac63 100644 --- a/act/container/docker_build.go +++ b/act/container/docker_build.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container diff --git a/act/container/docker_cli.go b/act/container/docker_cli.go index 1a1ffe6b..e62af5d8 100644 --- a/act/container/docker_cli.go +++ b/act/container/docker_cli.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) // This file is exact copy of https://github.com/docker/cli/blob/9ac8584acfd501c3f4da0e845e3a40ed15c85041/cli/command/container/opts.go // appended with license information. diff --git a/act/container/docker_images.go b/act/container/docker_images.go index f1daff94..59fad154 100644 --- a/act/container/docker_images.go +++ b/act/container/docker_images.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container diff --git a/act/container/docker_logger.go b/act/container/docker_logger.go index 549d8898..615801c4 100644 --- a/act/container/docker_logger.go +++ b/act/container/docker_logger.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container diff --git a/act/container/docker_network.go b/act/container/docker_network.go index 23d884f6..d58cf1a7 100644 --- a/act/container/docker_network.go +++ b/act/container/docker_network.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container diff --git a/act/container/docker_pull.go b/act/container/docker_pull.go index 3b1ad5c7..94cef06b 100644 --- a/act/container/docker_pull.go +++ b/act/container/docker_pull.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container diff --git a/act/container/docker_run.go b/act/container/docker_run.go index 4e218ecf..7a17d74d 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container diff --git a/act/container/docker_stub.go b/act/container/docker_stub.go index 2f3624fd..ebb4e313 100644 --- a/act/container/docker_stub.go +++ b/act/container/docker_stub.go @@ -1,4 +1,4 @@ -//go:build WITHOUT_DOCKER || !(linux || darwin || windows || netbsd) +//go:build WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd) package container diff --git a/act/container/docker_volume.go b/act/container/docker_volume.go index d6c9a348..207f10da 100644 --- a/act/container/docker_volume.go +++ b/act/container/docker_volume.go @@ -1,4 +1,4 @@ -//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd)) +//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd || freebsd)) package container From 07fadb34618e41ef5d73c0c0cbda34519ae7faac Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 09:26:58 +0000 Subject: [PATCH 105/281] chore: cascade forgejo pull request out of the runner branch or PR (#883) Refs forgejo/runner#881 --- This was tested manually to work but cannot be tested automatically. It is archived in this pull request for the record rather than for review. Testing will continue after it is merged, to verify it does what it should for pull requests and not just for branches. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/883): chore: cascade forgejo pull request out of the runner branch or PR Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/883 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/cascading-forgejo | 37 +++++++++++ .forgejo/workflows/cascade-forgejo.yml | 88 ++++++++++++++++++++++++++ 2 files changed, 125 insertions(+) create mode 100755 .forgejo/cascading-forgejo create mode 100644 .forgejo/workflows/cascade-forgejo.yml diff --git a/.forgejo/cascading-forgejo b/.forgejo/cascading-forgejo new file mode 100755 index 00000000..a85a53b0 --- /dev/null +++ b/.forgejo/cascading-forgejo @@ -0,0 +1,37 @@ +#!/bin/bash + +set -ex + +forgejo=$1 +forgejo_pr=$2 +runner=$3 +runner_pr_or_ref=$4 + +# +# Get information from the runner +# +cd $runner +# +# code.forgejo.org/forgejo/runner/vN may be +# upgraded to code.forgejo.org/forgejo/runner/vN+1 +# +module=$(cat go.mod | head -1 | cut -d' ' -f2) +test "$module" +sha=$(git -C $runner show --no-patch --format=%H) +test "$sha" + +# +# Update Forgejo to use the runner at $runner_pr_or_ref +# +cd $forgejo +# +# Update the runner major version if needed +# +find * -name '*.go' -o -name 'go.mod' | xargs sed -i -E -e "s|code.forgejo.org/forgejo/runner/v[0-9]+|$module|" +# +# add a "replace code.forgejo.org/forgejo/runner/v?? $sha" line to the forgejo go.mod +# so that it uses the branch or pull request from which the cascade is run. +# +sed -i -e "\|replace $module|d" go.mod +echo "replace $module => $module $sha" >>go.mod +go mod tidy diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml new file mode 100644 index 00000000..350af17b --- /dev/null +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -0,0 +1,88 @@ +# Copyright 2025 The Forgejo Authors +# SPDX-License-Identifier: MIT +# +# FORGEJO_CASCADING_PR_ORIGIN_TOKEN is a token from the https://code.forgejo.org/cascading-pr user +# with scope write:issue read:repository read:user +# FORGEJO_CASCADING_PR_DESTINATION_TOKEN is a token from the https://codeberg.org/forgejo-cascading-pr user +# with scope write:issue write:repository read:user +# +# To modify this workflow: +# +# - push it to the wip-cascade branch on the repository +# otherwise it will not have access to the secrets required to push +# the cascading PR +# +# - once it works, open a pull request for the sake of keeping track +# of the change even if the PR won't run it because it will use +# whatever is in the default branch instead +# +# - after it is merged, double check it works by setting the +# label on a pull request (any pull request will do) +# +name: cascade + +on: + push: + branches: + - 'main' + - 'wip-cascade' + pull_request_target: + types: + - synchronize + - labeled + +enable-email-notifications: true + +jobs: + debug: + if: > + vars.DEBUG == 'yes' + runs-on: docker + container: + image: data.forgejo.org/oci/node:22-bookworm + steps: + - name: event + run: | + cat <<'EOF' + ${{ toJSON(forge.event.pull_request.labels.*.name) }} + EOF + cat <<'EOF' + ${{ toJSON(forge.event) }} + EOF + + forgejo: + if: > + vars.ROLE == 'forgejo-coding' && ( + forge.ref_name == 'main' || + forge.ref_name == 'wip-cascade' || + contains(github.event.pull_request.labels.*.name, 'run-forgejo-tests') + ) + + runs-on: docker + container: + image: data.forgejo.org/oci/node:22-bookworm + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + with: + fetch-depth: '0' + show-progress: 'false' + - uses: actions/setup-go@v5 + with: + go-version-file: go.mod + - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1 + with: + origin-url: ${{ forge.server_url }} + origin-repo: ${{ forge.repository }} + origin-token: ${{ secrets.FORGEJO_CASCADING_PR_ORIGIN_TOKEN }} + origin-pr: ${{ forge.event.pull_request.number }} + origin-ref: ${{ forge.event_name == 'push' && forge.event.ref || '' }} + destination-url: https://codeberg.org + destination-fork-repo: forgejo-cascading-pr/forgejo + destination-repo: forgejo/forgejo + destination-branch: forgejo + destination-token: ${{ secrets.FORGEJO_CASCADING_PR_DESTINATION_TOKEN }} + prefix: runner + close-merge: true + verbose: ${{ vars.VERBOSE == 'yes' }} + debug: ${{ vars.DEBUG == 'yes' }} + update: .forgejo/cascading-forgejo From 059a528adfa457695432ba9bcca12e5f4f4bf3fd Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 11:47:27 +0200 Subject: [PATCH 106/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) --- .forgejo/workflows/cascade-forgejo.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 350af17b..3d416f42 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -47,7 +47,11 @@ jobs: ${{ toJSON(forge.event.pull_request.labels.*.name) }} EOF cat <<'EOF' - ${{ toJSON(forge.event) }} + contains => ${{ contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') }} + contains boolean => ${{ contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') == true }} + EOF + cat <<'EOF' + ${{ toJSON(forge) }} EOF forgejo: @@ -55,7 +59,7 @@ jobs: vars.ROLE == 'forgejo-coding' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade' || - contains(github.event.pull_request.labels.*.name, 'run-forgejo-tests') + contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) runs-on: docker From 096d57953c27c149e54e697a9718621c8034c7a3 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 11:56:54 +0200 Subject: [PATCH 107/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) Because it is a pull_request_target, the ref_name will always be main. Differentiate based on the event name. --- .forgejo/workflows/cascade-forgejo.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 3d416f42..7a9a48c0 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -57,9 +57,8 @@ jobs: forgejo: if: > vars.ROLE == 'forgejo-coding' && ( - forge.ref_name == 'main' || - forge.ref_name == 'wip-cascade' || - contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') + ( forge.event_name == 'push' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade') ) || + ( forge.event_name == 'pull_request_target' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) ) runs-on: docker From 2286f71dd5ad8bffe24168b06ddd92f84209958c Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 12:28:56 +0200 Subject: [PATCH 108/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) The SHA must be reachable from a branch or tags to be discovered by go mod tidy. --- .forgejo/cascading-forgejo | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.forgejo/cascading-forgejo b/.forgejo/cascading-forgejo index a85a53b0..7c305127 100755 --- a/.forgejo/cascading-forgejo +++ b/.forgejo/cascading-forgejo @@ -29,6 +29,15 @@ cd $forgejo # find * -name '*.go' -o -name 'go.mod' | xargs sed -i -E -e "s|code.forgejo.org/forgejo/runner/v[0-9]+|$module|" # +# If it is a pull request, change the module to reference the forked repository so +# go mod tidy can find the SHA from a known branch or tag +# +if test -f "$runner_pr_or_ref"; then + repository=$(jq --raw-output .head.repo.full_name <$runner_pr_or_ref) + test "$repository" + module=$(echo $module | sed -e "s|code.forgejo.org/forgejo/runner|code.forgejo.org/$repository|") +fi +# # add a "replace code.forgejo.org/forgejo/runner/v?? $sha" line to the forgejo go.mod # so that it uses the branch or pull request from which the cascade is run. # From 54130f2380bd55a8b66303fa5268d07eaf8f0a04 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 13:22:15 +0200 Subject: [PATCH 109/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) Also run when the `run-forgejo-tests` is set so that it is not necessary to push a commit to the pull request in addition. --- .forgejo/workflows/cascade-forgejo.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 7a9a48c0..5c61c5b8 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -55,10 +55,22 @@ jobs: EOF forgejo: + # + # Always run when a commit is pushed to the main or wip-cascade branch + # If this is a pull request, run + # - when the 'run-forgejo-tests' label is set (label_updated) (but not if another label is set or if a label is removed) + # - when a new commit is pushed to the pull request (synchronized) if the `run-forgejo-tests` is already present + # if: > vars.ROLE == 'forgejo-coding' && ( - ( forge.event_name == 'push' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade') ) || - ( forge.event_name == 'pull_request_target' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) + ( + forge.event_name == 'push' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade') + ) || ( + forge.event_name == 'pull_request_target' && ( + ( github.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || + ( github.event.action == 'label_updated' && github.event.label == 'run-forgejo-tests' ) + ) + ) ) runs-on: docker From ebbe6ad2b11ef76fb093b9dd076b9605f52fc874 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 13:36:18 +0200 Subject: [PATCH 110/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) debug information to figure out why it does not work --- .forgejo/workflows/cascade-forgejo.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 5c61c5b8..d69a3c8c 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -47,6 +47,9 @@ jobs: ${{ toJSON(forge.event.pull_request.labels.*.name) }} EOF cat <<'EOF' + push => ${{ forge.event_name == 'push' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade') }} + pull_request_target synchornized => ${{ ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) }} + pull_request_target label_updated => ${{ ( forge.event.action == 'label_updated' && forge.event.label == 'run-forgejo-tests' ) }} contains => ${{ contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') }} contains boolean => ${{ contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') == true }} EOF @@ -58,7 +61,7 @@ jobs: # # Always run when a commit is pushed to the main or wip-cascade branch # If this is a pull request, run - # - when the 'run-forgejo-tests' label is set (label_updated) (but not if another label is set or if a label is removed) + # - when the `run-forgejo-tests` label is set (label_updated) (but not if another label is set or if a label is removed) # - when a new commit is pushed to the pull request (synchronized) if the `run-forgejo-tests` is already present # if: > @@ -67,8 +70,8 @@ jobs: forge.event_name == 'push' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade') ) || ( forge.event_name == 'pull_request_target' && ( - ( github.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || - ( github.event.action == 'label_updated' && github.event.label == 'run-forgejo-tests' ) + ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || + ( forge.event.action == 'label_updated' && forge.event.label == 'run-forgejo-tests' ) ) ) ) From d78c75f7c08aebad764ee1873dafd41f82670d24 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 13:39:31 +0200 Subject: [PATCH 111/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) Add missing .name --- .forgejo/workflows/cascade-forgejo.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index d69a3c8c..1f371dfd 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -49,7 +49,7 @@ jobs: cat <<'EOF' push => ${{ forge.event_name == 'push' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade') }} pull_request_target synchornized => ${{ ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) }} - pull_request_target label_updated => ${{ ( forge.event.action == 'label_updated' && forge.event.label == 'run-forgejo-tests' ) }} + pull_request_target label_updated => ${{ ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-forgejo-tests' ) }} contains => ${{ contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') }} contains boolean => ${{ contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') == true }} EOF @@ -71,7 +71,7 @@ jobs: ) || ( forge.event_name == 'pull_request_target' && ( ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || - ( forge.event.action == 'label_updated' && forge.event.label == 'run-forgejo-tests' ) + ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-forgejo-tests' ) ) ) ) From f793c00981fc96cd9e2fea6294587d2d29b944e1 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 14:07:20 +0200 Subject: [PATCH 112/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) Also run the workflow when the pull request is closed so that it closes the forgejo pull request. It would otherwise clutter the pull request list and require manual intervention. --- .forgejo/workflows/cascade-forgejo.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 1f371dfd..15063e7a 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -30,6 +30,7 @@ on: types: - synchronize - labeled + - closed enable-email-notifications: true @@ -63,6 +64,7 @@ jobs: # If this is a pull request, run # - when the `run-forgejo-tests` label is set (label_updated) (but not if another label is set or if a label is removed) # - when a new commit is pushed to the pull request (synchronized) if the `run-forgejo-tests` is already present + # - when the pull request is closed, which also happens when it is merged, so that the Forgejo pull request is closed # if: > vars.ROLE == 'forgejo-coding' && ( @@ -70,6 +72,7 @@ jobs: forge.event_name == 'push' && ( forge.ref_name == 'main' || forge.ref_name == 'wip-cascade') ) || ( forge.event_name == 'pull_request_target' && ( + forge.event.action == 'closed' || ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-forgejo-tests' ) ) From b91e041a1346689a030b3b994ae1aa5be1a15bd8 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 12:16:44 +0000 Subject: [PATCH 113/281] fix: RunsOn in jobparser is not used by the runner but it is used by Forgejo [skip cascade] (#884) Refs forgejo/runner#881 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/884): fix: RunsOn in jobparser is not used by the runner but it is used by Forgejo [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/884 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/jobparser/model.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/act/jobparser/model.go b/act/jobparser/model.go index 9de9eab7..dd446596 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -119,6 +119,10 @@ func (j *Job) EraseNeeds() *Job { return j } +func (j *Job) RunsOn() []string { + return (&model.Job{RawRunsOn: j.RawRunsOn}).RunsOn() +} + type Step struct { ID string `yaml:"id,omitempty"` If yaml.Node `yaml:"if,omitempty"` From 24360de912aadb8d4adb77e40638c2487ba0deb7 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 18 Aug 2025 14:23:26 +0200 Subject: [PATCH 114/281] chore: cascade forgejo pull request out of the runner branch or PR (followup) close-merge is not an input, close is --- .forgejo/workflows/cascade-forgejo.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 15063e7a..c1c09565 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -103,7 +103,7 @@ jobs: destination-branch: forgejo destination-token: ${{ secrets.FORGEJO_CASCADING_PR_DESTINATION_TOKEN }} prefix: runner - close-merge: true + close: true verbose: ${{ vars.VERBOSE == 'yes' }} debug: ${{ vars.DEBUG == 'yes' }} update: .forgejo/cascading-forgejo From 6d2cc80aa1498e3db3757c23511d08c92b158662 Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Mon, 18 Aug 2025 14:22:48 +0000 Subject: [PATCH 115/281] chore: revert mockery v3 update and validate mockery updates (#886) - reverts #841 and #868 - add ci to validate mock changes - https://code.forgejo.org/forgejo/runner/pulls/841#issuecomment-53111 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/886): chore: revert mockery v3 update and validate mockery updates Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/886 Reviewed-by: earl-warren Co-authored-by: Michael Kriese Co-committed-by: Michael Kriese --- .forgejo/workflows/test.yml | 32 ++++++++++++++++++++++++++++++++ Makefile | 2 +- 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 9ce07101..69771e48 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -127,3 +127,35 @@ jobs: set -x ./forgejo-runner exec --var MY_VAR=testvariable --workflows .forgejo/testdata/var.yml |& tee /tmp/var.out grep --quiet 'Success - Main echo "VAR -> testvariable"' /tmp/var.out + + validate-mocks: + needs: + - build-and-tests + name: validate mocks + if: vars.ROLE == 'forgejo-coding' + runs-on: docker + container: + image: 'code.forgejo.org/oci/ci:1' + + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + + - name: generate mocks + run: | + set -ex + make deps-tools + make generate + make fmt + + - name: validate mocks + run: | + git diff --quiet || { + echo "[ERROR] Please apply the changes mockery suggests:" + git diff --color=always + exit 1 + } diff --git a/Makefile b/Makefile index e32d7759..3d751aa1 100644 --- a/Makefile +++ b/Makefile @@ -13,7 +13,7 @@ WINDOWS_ARCHS ?= windows/amd64 GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") -MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v3.5.3 # renovate: datasource=go +MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.4 # renovate: datasource=go GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner From 022d5ad3e7da85e436da5097555739f1f73a4024 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 19 Aug 2025 20:19:23 +0000 Subject: [PATCH 116/281] fix: artifact cache DB not using indexes for searching (#878) Uses the `Repo` field as an index during searches of the cache database. Removes unused indexes. To measure the performance of this change, I created a synthetic test which wrote 10,000 records into the artifact cache DB. Of course, all benchmarks are lies that can't be generalized to real-world usage, but it seems clear from the magnitude of improvement that this fixes a flawed implementation, even if it's not perfect. - Unmodified performance: - Write: 196 records/second - Read: 1 record/second - With `Repo` index being used for reads, and other indexes being removed: - Write: 347 records/second - Read: 22,398 records/second `Repo` is, I think, the only index that made sense to remain, with an eye on workflow run performance: - `Key` -- can't be used for index because `findCache` searches for key *prefixes*, not equal values. - `Version` -- isn't very distinct for different workflow runs (https://code.forgejo.org/actions/cache#cache-version) - `Complete` - significant portion of the cache DB will be complete, making it the least selective possible index - `UsedAt` & `CreatedAt` - only used in GC operation, so could remain, but this isn't a performance-sensitive codepath Closes #874. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/878): fix: artifact cache DB not using indexes for searching Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/878 Reviewed-by: Michael Kriese Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/artifactcache/handler.go | 4 ++-- act/artifactcache/model.go | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index b50b6b11..0f78be85 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -422,7 +422,7 @@ func findCache(db *bolthold.Store, repo string, keys []string, version string) ( for _, prefix := range keys { // if a key in the list matches exactly, don't return partial matches if err := db.FindOne(cache, - bolthold.Where("Repo").Eq(repo). + bolthold.Where("Repo").Eq(repo).Index("Repo"). And("Key").Eq(prefix). And("Version").Eq(version). And("Complete").Eq(true). @@ -438,7 +438,7 @@ func findCache(db *bolthold.Store, repo string, keys []string, version string) ( continue } if err := db.FindOne(cache, - bolthold.Where("Repo").Eq(repo). + bolthold.Where("Repo").Eq(repo).Index("Repo"). And("Key").RegExp(re). And("Version").Eq(version). And("Complete").Eq(true). diff --git a/act/artifactcache/model.go b/act/artifactcache/model.go index 1c0f855d..b27fd8ed 100644 --- a/act/artifactcache/model.go +++ b/act/artifactcache/model.go @@ -26,10 +26,10 @@ func (c *Request) ToCache() *Cache { type Cache struct { ID uint64 `json:"id" boltholdKey:"ID"` Repo string `json:"repo" boltholdIndex:"Repo"` - Key string `json:"key" boltholdIndex:"Key"` - Version string `json:"version" boltholdIndex:"Version"` + Key string `json:"key"` + Version string `json:"version"` Size int64 `json:"cacheSize"` - Complete bool `json:"complete" boltholdIndex:"Complete"` - UsedAt int64 `json:"usedAt" boltholdIndex:"UsedAt"` - CreatedAt int64 `json:"createdAt" boltholdIndex:"CreatedAt"` + Complete bool `json:"complete"` + UsedAt int64 `json:"usedAt"` + CreatedAt int64 `json:"createdAt"` } From fa42b8394ee4afb1059f961b2ed23720a567fa92 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Wed, 20 Aug 2025 13:34:57 +0000 Subject: [PATCH 117/281] chore: fix data race in reusable workflows with inherited secrets (#875) Data race detection identified that `getWorkflowSecrets` is mutating `rc.caller.runContext.Config.Secrets` while interpolating values, in the case where secrets are inherited by a reusable workflow. This map is also mutated earlier in evaluation by `(*RunContext).handleCredentials`. It's possible that multiple goroutines performing mutation to this shared map could cause runtime panics (not observed). The issue is addressed creating a separate map to store interpolated secrets in `getWorkflowSecrets`, which was already the behavior in the non-inherited secret case. Automated testing for this issue will be provided by #861 when all data races are resolved. ``` ================== WARNING: DATA RACE Read at 0x00c0003a9620 by goroutine 2546: runtime.mapaccess1_faststr() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/internal/runtime/maps/runtime_faststr_swiss.go:103 +0x0 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).handleCredentials() /.../forgejo-runner/act/runner/run_context.go:1395 +0xab code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).prepareJobContainer() /.../forgejo-runner/act/runner/run_context.go:460 +0x2de code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1.(*RunContext).startJobContainer.2() /.../forgejo-runner/act/runner/run_context.go:610 +0x5e code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1() /.../forgejo-runner/act/runner/run_context.go:853 +0xf3 code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.NewPipelineExecutor.Executor.Then.func22() /.../forgejo-runner/act/common/executor.go:136 +0x57 ...snip... Previous write at 0x00c0003a9620 by goroutine 2440: runtime.mapassign_faststr() /home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/internal/runtime/maps/runtime_faststr_swiss.go:263 +0x0 code.forgejo.org/forgejo/runner/v9/act/runner.getWorkflowSecrets() /.../forgejo-runner/act/runner/expression.go:578 +0x547 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).NewExpressionEvaluatorWithEnv() /.../forgejo-runner/act/runner/expression.go:85 +0x3fc code.forgejo.org/forgejo/runner/v9/act/common/git.FindGitRevision() /.../forgejo-runner/act/common/git/git.go:70 +0xe4 github.com/go-git/go-git/v5.PlainOpenWithOptions() /home/mfenniak/go/pkg/mod/github.com/go-git/go-git/v5@v5.16.2/repository.go:332 +0x7a6 code.forgejo.org/forgejo/runner/v9/act/common/git.FindGitRevision() /.../forgejo-runner/act/common/git/git.go:58 +0xc4 ...snip... ================== ``` Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/875 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/expression.go | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/act/runner/expression.go b/act/runner/expression.go index 4fa16e8f..1c52a424 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -564,21 +564,21 @@ func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunCon func getWorkflowSecrets(ctx context.Context, rc *RunContext) map[string]string { if rc.caller != nil { job := rc.caller.runContext.Run.Job() - secrets := job.Secrets() + rawSecrets := job.Secrets() - if secrets == nil && job.InheritSecrets() { - secrets = rc.caller.runContext.Config.Secrets + if rawSecrets == nil && job.InheritSecrets() { + rawSecrets = rc.caller.runContext.Config.Secrets } - if secrets == nil { - secrets = map[string]string{} + if rawSecrets == nil { + return map[string]string{} } - for k, v := range secrets { - secrets[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v) + interpolatedSecrets := make(map[string]string, len(rawSecrets)) + for k, v := range rawSecrets { + interpolatedSecrets[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v) } - - return secrets + return interpolatedSecrets } return rc.Config.Secrets From 8ce7965030b320e479842213100d6b06470ba5ea Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 20 Aug 2025 14:36:44 +0000 Subject: [PATCH 118/281] chore: when comparing mockery generated files, ignore the version (#891) Refs https://code.forgejo.org/forgejo/runner/actions/runs/7645/jobs/2#jobstep-4-8 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/891): chore: when comparing mockery generated files, ignore the version Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/891 Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 69771e48..06132260 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -154,7 +154,7 @@ jobs: - name: validate mocks run: | - git diff --quiet || { + git diff --ignore-matching-lines='Code generated by mockery.*DO NOT EDIT' --quiet || { echo "[ERROR] Please apply the changes mockery suggests:" git diff --color=always exit 1 From 22762480d887632134b37168cdfd52b368906704 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 20 Aug 2025 17:09:04 +0000 Subject: [PATCH 119/281] chore: merge ACT and runner unit & integration tests together (#894) When run in parallel they will race to populate the Go cache in a different way (GOPROXY is not configured the same) and that will lead to transient errors when one job tries to use the cache that is populated differently by the other job. The chain of `needs` is adjusted accordingly and the required checks too. ![image](/attachments/4b83fc9d-d5f8-497e-9e94-976fcf52f088) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/894): chore: merge ACT and runner unit & integration tests together Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/894 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/act.yml | 80 ------------------------------------- .forgejo/workflows/test.yml | 36 ++++++++++++----- Makefile | 4 +- 3 files changed, 30 insertions(+), 90 deletions(-) delete mode 100644 .forgejo/workflows/act.yml diff --git a/.forgejo/workflows/act.yml b/.forgejo/workflows/act.yml deleted file mode 100644 index 1a1b149b..00000000 --- a/.forgejo/workflows/act.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: act -on: - push: - branches: - - 'main' - pull_request: - -env: - GOPROXY: https://goproxy.io,direct - GOPATH: /go_path - GOCACHE: /go_cache - -jobs: - unit: - runs-on: docker - if: vars.ROLE == 'forgejo-coding' - container: - image: 'code.forgejo.org/oci/node:22-bookworm' - steps: - - name: cache go path - id: cache-go-path - uses: https://code.forgejo.org/actions/cache@v4 - with: - path: /go_path - key: go_path-${{ forge.repository }}-${{ forge.ref_name }} - restore-keys: | - go_path-${{ forge.repository }}- - go_path- - - name: cache go cache - id: cache-go-cache - uses: https://code.forgejo.org/actions/cache@v4 - with: - path: /go_cache - key: go_cache-${{ forge.repository }}-${{ forge.ref_name }} - restore-keys: | - go_cache-${{ forge.repository }}- - go_cache- - - - uses: https://code.forgejo.org/actions/checkout@v4 - - - uses: https://code.forgejo.org/actions/setup-go@v5 - with: - go-version-file: go.mod - - - name: validate go version - run: | - set -ex - toolchain=$(grep -oP '(?<=toolchain ).+' go.mod) - version=$(go version | cut -d' ' -f3) - if dpkg --compare-versions ${version#go} lt ${toolchain#go}; then - echo "go version too low: $toolchain >= $version" - exit 1 - fi - - - name: unit test - run: | - go test -short ./act/container - go test ./act/artifactcache/... ./act/workflowpattern/... ./act/filecollector/... ./act/common/... ./act/jobparser ./act/model ./act/exprparser ./act/schema - - integration: - runs-on: lxc-bookworm - if: vars.ROLE == 'forgejo-coding' - needs: [unit] - steps: - - uses: https://code.forgejo.org/actions/checkout@v4 - - - uses: https://code.forgejo.org/actions/setup-go@v5 - with: - go-version-file: go.mod - - - name: apt install docker.io - run: | - export DEBIAN_FRONTEND=noninteractive - apt-get update -qq - apt-get -q install -qq -y docker.io - - - name: integration test - run: | - go test ./act/container - go test -timeout 30m ./act/runner/... diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 06132260..3e1466bf 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -40,9 +40,9 @@ jobs: - '/usr/bin/s6-svscan /etc/s6 & sleep 10 ; su -c "forgejo admin user create --admin --username $FORGEJO_ADMIN_USER --password $FORGEJO_ADMIN_PASSWORD --email root@example.com" git && su -c "forgejo forgejo-cli actions register --labels docker --name therunner --secret $FORGEJO_RUNNER_SECRET" git && sleep infinity' steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: https://data.forgejo.org/actions/setup-go@v5 with: go-version-file: go.mod @@ -74,11 +74,10 @@ jobs: - run: make FORGEJO_URL=http://$FORGEJO_HOST_PORT test runner-exec-tests: - needs: [build-and-tests] name: runner exec tests if: vars.ROLE == 'forgejo-coding' runs-on: lxc-bookworm - + needs: [build-and-tests] steps: - uses: actions/checkout@v4 @@ -128,9 +127,29 @@ jobs: ./forgejo-runner exec --var MY_VAR=testvariable --workflows .forgejo/testdata/var.yml |& tee /tmp/var.out grep --quiet 'Success - Main echo "VAR -> testvariable"' /tmp/var.out + integration-tests: + name: integration tests + if: vars.ROLE == 'forgejo-coding' + runs-on: lxc-bookworm + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + + - uses: https://data.forgejo.org/actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: apt install docker.io + run: | + export DEBIAN_FRONTEND=noninteractive + apt-get update -qq + apt-get -q install -qq -y docker.io + + - name: integration test + run: | + go test ./act/container + go test -timeout 30m ./act/runner/... + validate-mocks: - needs: - - build-and-tests name: validate mocks if: vars.ROLE == 'forgejo-coding' runs-on: docker @@ -138,13 +157,12 @@ jobs: image: 'code.forgejo.org/oci/ci:1' steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: https://data.forgejo.org/actions/setup-go@v5 with: go-version-file: go.mod - - name: generate mocks run: | set -ex diff --git a/Makefile b/Makefile index 3d751aa1..1d2c8565 100644 --- a/Makefile +++ b/Makefile @@ -106,7 +106,9 @@ fmt-check: fi; test: lint-check fmt-check - @$(GO) test -v -cover -coverprofile coverage.txt ./internal/... && echo "\n==>\033[32m Ok\033[m\n" || exit 1 + $(GO) test -v -cover -coverprofile coverage.txt ./internal/... + $(GO) test -short ./act/container + $(GO) test ./act/artifactcache/... ./act/workflowpattern/... ./act/filecollector/... ./act/common/... ./act/jobparser ./act/model ./act/exprparser ./act/schema .PHONY: vet vet: From 91e7940947e15b5dc768c0a0a28ffb58efe7b640 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Wed, 20 Aug 2025 19:46:03 +0000 Subject: [PATCH 120/281] test: add an integration test for embedded runner cache (#889) Adds a limited integration test in the runner which verifies that the embedded cache server starts up, can be written to by an action, and can be read by a subsequent action. This is a solid base foundation for future nearly-end-to-end tests. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/889): test: add an integration test for embedded runner cache Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/889 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- .forgejo/workflows/test.yml | 38 +++++++ Makefile | 5 +- internal/app/run/runner_test.go | 181 ++++++++++++++++++++++++++++++++ 3 files changed, 223 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 3e1466bf..3a1d5abe 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -149,6 +149,44 @@ jobs: go test ./act/container go test -timeout 30m ./act/runner/... + runner-integration-tests: + name: runner integration tests + if: vars.ROLE == 'forgejo-coding' + runs-on: lxc-bookworm + needs: [build-and-tests] + + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: install docker + run: | + mkdir /etc/docker + cat > /etc/docker/daemon.json < cache_path_1/cache_content_1 +` + runWorkflow(populateYaml, "push", "refs/heads/main", "step 1: push cache populate expected to succeed") + + // Step 2: Validate that cache is accessible; mostly a sanity check that the test environment and mock context + // provides everything needed for the cache setup. + checkYaml := ` +name: Cache Testing Action +on: + push: +jobs: + job-cache-check-2: + runs-on: ubuntu-latest + steps: + - uses: actions/cache@v4 + with: + path: cache_path_1 + key: cache-key-1 + - run: | + [[ -f cache_path_1/cache_content_1 ]] && echo "Step 2: cache file found." || echo "Step 2: cache file missing!" + [[ -f cache_path_1/cache_content_1 ]] || exit 1 +` + runWorkflow(checkYaml, "push", "refs/heads/main", "step 2: push cache check expected to succeed") +} From ce6502e7b6a524c5058b1c3836fc6d6f55f3366d Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Wed, 20 Aug 2025 19:56:03 +0000 Subject: [PATCH 121/281] chore: fix 'false positive' data race detection in Id/Number default init (#867) A step's `Id` & `Number` are potentially initialized in different goroutines on matrix evaluations; this change ensures they're initialized before execution fans out to multiple goroutines. There doesn't seem to be any functional impact of this data race for end-users. Where `Number` was previously initialized, a runtime error was added to ensure that the behavior is the same. `ID` data race: ``` ================== WARNING: DATA RACE Read at 0x00c0001ff348 by goroutine 77: code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor() /.../forgejo-runner/act/runner/job_executor.go:64 +0x424 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor() /.../forgejo-runner/act/runner/run_context.go:931 +0x2c6 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:218 +0x150 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Previous write at 0x00c0001ff348 by goroutine 76: code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor() /.../forgejo-runner/act/runner/job_executor.go:65 +0x4cc code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor() /.../forgejo-runner/act/runner/run_context.go:931 +0x2c6 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:218 +0x150 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Goroutine 77 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /.../forgejo-runner/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Goroutine 76 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /.../forgejo-runner/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f ================== ``` `Number` data race: ``` ================== WARNING: DATA RACE Write at 0x00c0001ff340 by goroutine 77: code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor() /.../forgejo-runner/act/runner/job_executor.go:67 +0x536 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor() /.../forgejo-runner/act/runner/run_context.go:931 +0x2c6 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:218 +0x150 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Previous write at 0x00c0001ff340 by goroutine 76: code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor() /.../forgejo-runner/act/runner/job_executor.go:67 +0x536 code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor() /.../forgejo-runner/act/runner/run_context.go:931 +0x2c6 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1() /.../forgejo-runner/act/runner/runner.go:218 +0x150 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Goroutine 77 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /.../forgejo-runner/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f Goroutine 76 (running) created at: code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /.../forgejo-runner/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /.../forgejo-runner/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /.../forgejo-runner/act/common/executor.go:109 +0x4f ================== ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/867): chore: fix 'false positive' data race detection in Id/Number default init Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/867 Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/model/action.go | 16 ++++++++++++++++ act/model/workflow.go | 18 ++++++++++++++++++ act/runner/action_composite.go | 17 ++++++++--------- act/runner/job_executor.go | 10 +++------- act/runner/job_executor_test.go | 9 ++++++--- 5 files changed, 51 insertions(+), 19 deletions(-) diff --git a/act/model/action.go b/act/model/action.go index b174e955..50bbc905 100644 --- a/act/model/action.go +++ b/act/model/action.go @@ -72,6 +72,22 @@ type ActionRuns struct { Steps []Step `yaml:"steps"` } +func (actionRuns *ActionRuns) UnmarshalYAML(value *yaml.Node) error { + type ActionRunsDefault ActionRuns + if err := value.Decode((*ActionRunsDefault)(actionRuns)); err != nil { + return err + } + for i := range actionRuns.Steps { + step := &actionRuns.Steps[i] + // Set `Number` and `ID` on each step based upon their position in the steps array: + if step.ID == "" { + step.ID = fmt.Sprintf("%d", i) + } + step.Number = i + } + return nil +} + // Action describes a metadata file for GitHub actions. The metadata filename must be either action.yml or action.yaml. The data in the metadata file defines the inputs, outputs and main entrypoint for your action. type Action struct { Name string `yaml:"name"` diff --git a/act/model/workflow.go b/act/model/workflow.go index c9acd375..a9a2d32b 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -594,6 +594,24 @@ func (j *Job) Type() (JobType, error) { return JobTypeDefault, nil } +func (j *Job) UnmarshalYAML(value *yaml.Node) error { + type JobDefault Job + if err := value.Decode((*JobDefault)(j)); err != nil { + return err + } + for i, step := range j.Steps { + if step == nil { + continue + } + // Set `Number` and `ID` on each step based upon their position in the steps array: + if step.ID == "" { + step.ID = fmt.Sprintf("%d", i) + } + step.Number = i + } + return nil +} + // ContainerSpec is the specification of the container to use for the job type ContainerSpec struct { Image string `yaml:"image"` diff --git a/act/runner/action_composite.go b/act/runner/action_composite.go index fdee793d..45481cd4 100644 --- a/act/runner/action_composite.go +++ b/act/runner/action_composite.go @@ -136,17 +136,16 @@ func (rc *RunContext) compositeExecutor(action *model.Action) *compositeSteps { sf := &stepFactoryImpl{} - for i, step := range action.Runs.Steps { - if step.ID == "" { - step.ID = fmt.Sprintf("%d", i) + for i, stepModel := range action.Runs.Steps { + if stepModel.Number != i { + return &compositeSteps{ + pre: func(ctx context.Context) error { return nil }, + main: common.NewErrorExecutor(fmt.Errorf("internal error: invalid Step: Number expected %v, was actually %v", i, stepModel.Number)), + post: func(ctx context.Context) error { return nil }, + } } - step.Number = i - // create a copy of the step, since this composite action could - // run multiple times and we might modify the instance - stepcopy := step - - step, err := sf.newStep(&stepcopy, rc) + step, err := sf.newStep(&stepModel, rc) if err != nil { return &compositeSteps{ main: common.NewErrorExecutor(err), diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index 3cb4f206..ebecf31c 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -57,14 +57,10 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo for i, stepModel := range infoSteps { if stepModel == nil { - return func(ctx context.Context) error { - return fmt.Errorf("invalid Step %v: missing run or uses key", i) - } + return common.NewErrorExecutor(fmt.Errorf("invalid Step %v: missing run or uses key", i)) + } else if stepModel.Number != i { + return common.NewErrorExecutor(fmt.Errorf("internal error: invalid Step: Number expected %v, was actually %v", i, stepModel.Number)) } - if stepModel.ID == "" { - stepModel.ID = fmt.Sprintf("%d", i) - } - stepModel.Number = i step, err := sf.newStep(stepModel, rc) if err != nil { diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index 918ece94..efe35e65 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -209,11 +209,14 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { { name: "stepsWithPreAndPost", steps: []*model.Step{{ - ID: "1", + ID: "1", + Number: 0, }, { - ID: "2", + ID: "2", + Number: 1, }, { - ID: "3", + ID: "3", + Number: 2, }}, preSteps: []bool{true, false, true}, postSteps: []bool{false, true, true}, From 8f5470ad37625f6b4cf5a088c964036670671859 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 20 Aug 2025 20:49:49 +0000 Subject: [PATCH 122/281] chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) - gopkg.in/yaml.v3 is archived and unmaintained - go.yaml.in/yaml/v3 is a compatible fork under the umbrella of https://yaml.org/ Refs https://code.forgejo.org/forgejo/runner/issues/887 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/888): WIP: chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/888 Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/jobparser/evaluator.go | 2 +- act/jobparser/interpeter.go | 2 +- act/jobparser/jobparser.go | 2 +- act/jobparser/jobparser_test.go | 2 +- act/jobparser/model.go | 2 +- act/jobparser/model_test.go | 2 +- act/model/action.go | 2 +- act/model/workflow.go | 2 +- act/runner/expression.go | 2 +- act/runner/expression_test.go | 2 +- act/runner/run_context_test.go | 2 +- act/runner/runner_test.go | 2 +- act/runner/step_action_local_test.go | 2 +- act/runner/step_action_remote_test.go | 2 +- act/runner/step_test.go | 2 +- act/schema/schema.go | 2 +- act/schema/schema_test.go | 2 +- go.mod | 3 ++- go.sum | 2 ++ internal/app/cmd/create-runner-file_test.go | 2 +- internal/app/run/workflow.go | 2 +- internal/pkg/config/config.go | 2 +- 22 files changed, 24 insertions(+), 21 deletions(-) diff --git a/act/jobparser/evaluator.go b/act/jobparser/evaluator.go index ac05cfe0..a452dd2a 100644 --- a/act/jobparser/evaluator.go +++ b/act/jobparser/evaluator.go @@ -6,7 +6,7 @@ import ( "strings" "code.forgejo.org/forgejo/runner/v9/act/exprparser" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) // ExpressionEvaluator is copied from runner.expressionEvaluator, diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go index d4d92bfb..4de4cd64 100644 --- a/act/jobparser/interpeter.go +++ b/act/jobparser/interpeter.go @@ -3,7 +3,7 @@ package jobparser import ( "code.forgejo.org/forgejo/runner/v9/act/exprparser" "code.forgejo.org/forgejo/runner/v9/act/model" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) // NewInterpeter returns an interpeter used in the server, diff --git a/act/jobparser/jobparser.go b/act/jobparser/jobparser.go index 00dec363..1329a818 100644 --- a/act/jobparser/jobparser.go +++ b/act/jobparser/jobparser.go @@ -6,7 +6,7 @@ import ( "sort" "strings" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" "code.forgejo.org/forgejo/runner/v9/act/model" ) diff --git a/act/jobparser/jobparser_test.go b/act/jobparser/jobparser_test.go index 0386bcb9..4ae0a190 100644 --- a/act/jobparser/jobparser_test.go +++ b/act/jobparser/jobparser_test.go @@ -8,7 +8,7 @@ import ( "github.com/stretchr/testify/require" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) func TestParse(t *testing.T) { diff --git a/act/jobparser/model.go b/act/jobparser/model.go index dd446596..4d3f8d42 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -5,7 +5,7 @@ import ( "fmt" "code.forgejo.org/forgejo/runner/v9/act/model" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) // SingleWorkflow is a workflow with single job and single matrix diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index 684701c4..1edaf4a5 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -9,7 +9,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) func TestParseRawOn(t *testing.T) { diff --git a/act/model/action.go b/act/model/action.go index 50bbc905..6f2354f6 100644 --- a/act/model/action.go +++ b/act/model/action.go @@ -6,7 +6,7 @@ import ( "strings" "code.forgejo.org/forgejo/runner/v9/act/schema" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) // ActionRunsUsing is the type of runner for the action diff --git a/act/model/workflow.go b/act/model/workflow.go index a9a2d32b..12bba60b 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -16,7 +16,7 @@ import ( "code.forgejo.org/forgejo/runner/v9/act/common" "code.forgejo.org/forgejo/runner/v9/act/schema" log "github.com/sirupsen/logrus" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) // Workflow is the structure of the files in .github/workflows diff --git a/act/runner/expression.go b/act/runner/expression.go index 1c52a424..11791ef4 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -17,7 +17,7 @@ import ( "code.forgejo.org/forgejo/runner/v9/act/container" "code.forgejo.org/forgejo/runner/v9/act/exprparser" "code.forgejo.org/forgejo/runner/v9/act/model" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) // ExpressionEvaluator is the interface for evaluating expressions diff --git a/act/runner/expression_test.go b/act/runner/expression_test.go index 38959288..00cbc603 100644 --- a/act/runner/expression_test.go +++ b/act/runner/expression_test.go @@ -6,7 +6,7 @@ import ( "code.forgejo.org/forgejo/runner/v9/act/exprparser" "code.forgejo.org/forgejo/runner/v9/act/model" assert "github.com/stretchr/testify/assert" - yaml "gopkg.in/yaml.v3" + yaml "go.yaml.in/yaml/v3" ) func createRunContext(t *testing.T) *RunContext { diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index c8e030d6..7d865777 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -22,7 +22,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" "github.com/stretchr/testify/require" - yaml "gopkg.in/yaml.v3" + yaml "go.yaml.in/yaml/v3" ) func TestRunContext_EvalBool(t *testing.T) { diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index cee533e3..83523c1e 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -16,7 +16,7 @@ import ( log "github.com/sirupsen/logrus" assert "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" "code.forgejo.org/forgejo/runner/v9/act/common" "code.forgejo.org/forgejo/runner/v9/act/model" diff --git a/act/runner/step_action_local_test.go b/act/runner/step_action_local_test.go index f6e0a361..d9bfdd3f 100644 --- a/act/runner/step_action_local_test.go +++ b/act/runner/step_action_local_test.go @@ -12,7 +12,7 @@ import ( "code.forgejo.org/forgejo/runner/v9/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) type stepActionLocalMocks struct { diff --git a/act/runner/step_action_remote_test.go b/act/runner/step_action_remote_test.go index 5287f380..6c1a4db7 100644 --- a/act/runner/step_action_remote_test.go +++ b/act/runner/step_action_remote_test.go @@ -9,7 +9,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" "code.forgejo.org/forgejo/runner/v9/act/common" "code.forgejo.org/forgejo/runner/v9/act/common/git" diff --git a/act/runner/step_test.go b/act/runner/step_test.go index b69c08aa..74b83c6c 100644 --- a/act/runner/step_test.go +++ b/act/runner/step_test.go @@ -9,7 +9,7 @@ import ( log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" - yaml "gopkg.in/yaml.v3" + yaml "go.yaml.in/yaml/v3" ) func TestStep_MergeIntoMap(t *testing.T) { diff --git a/act/schema/schema.go b/act/schema/schema.go index c2de3e59..cbb51283 100644 --- a/act/schema/schema.go +++ b/act/schema/schema.go @@ -12,7 +12,7 @@ import ( "strings" "github.com/rhysd/actionlint" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) //go:embed workflow_schema.json diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index d7bc383f..fe2598f2 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -5,7 +5,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) func TestAdditionalFunctions(t *testing.T) { diff --git a/go.mod b/go.mod index a25bc8b9..92bb4f1b 100644 --- a/go.mod +++ b/go.mod @@ -36,10 +36,10 @@ require ( github.com/stretchr/testify v1.10.0 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.2 + go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.34.0 golang.org/x/time v0.12.0 google.golang.org/protobuf v1.36.7 - gopkg.in/yaml.v3 v3.0.1 gotest.tools/v3 v3.5.2 ) @@ -105,4 +105,5 @@ require ( golang.org/x/sys v0.35.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index e6ca818e..2ac739de 100644 --- a/go.sum +++ b/go.sum @@ -226,6 +226,8 @@ go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKr go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA= go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I= go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM= +go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= diff --git a/internal/app/cmd/create-runner-file_test.go b/internal/app/cmd/create-runner-file_test.go index d12cc325..cd0a720e 100644 --- a/internal/app/cmd/create-runner-file_test.go +++ b/internal/app/cmd/create-runner-file_test.go @@ -14,7 +14,7 @@ import ( "connectrpc.com/connect" "github.com/stretchr/testify/assert" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) func Test_createRunnerFileCmd(t *testing.T) { diff --git a/internal/app/run/workflow.go b/internal/app/run/workflow.go index 601f36d1..2a0b3a0c 100644 --- a/internal/app/run/workflow.go +++ b/internal/app/run/workflow.go @@ -11,7 +11,7 @@ import ( runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" "code.forgejo.org/forgejo/runner/v9/act/model" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) func generateWorkflow(task *runnerv1.Task) (*model.Workflow, string, error) { diff --git a/internal/pkg/config/config.go b/internal/pkg/config/config.go index 69d9f482..3390e91c 100644 --- a/internal/pkg/config/config.go +++ b/internal/pkg/config/config.go @@ -12,7 +12,7 @@ import ( "github.com/joho/godotenv" log "github.com/sirupsen/logrus" - "gopkg.in/yaml.v3" + "go.yaml.in/yaml/v3" ) // Log represents the configuration for logging. From 528bb594af2dae51946c98a9c78293f58aa356f0 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 12 Aug 2025 10:46:18 -0600 Subject: [PATCH 123/281] test: enable data race detector in CI-executed tests --- .forgejo/workflows/test.yml | 4 ++-- Makefile | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 3a1d5abe..0a2e234f 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -146,8 +146,8 @@ jobs: - name: integration test run: | - go test ./act/container - go test -timeout 30m ./act/runner/... + go test -race ./act/container + go test -race -timeout 30m ./act/runner/... runner-integration-tests: name: runner integration tests diff --git a/Makefile b/Makefile index 19e80b70..a16b82ea 100644 --- a/Makefile +++ b/Makefile @@ -106,12 +106,12 @@ fmt-check: fi; test: lint-check fmt-check - $(GO) test -v -short -cover -coverprofile coverage.txt ./internal/... - $(GO) test -short ./act/container - $(GO) test ./act/artifactcache/... ./act/workflowpattern/... ./act/filecollector/... ./act/common/... ./act/jobparser ./act/model ./act/exprparser ./act/schema + $(GO) test -v -race -short -cover -coverprofile coverage.txt ./internal/... + $(GO) test -race -short ./act/container + $(GO) test -race ./act/artifactcache/... ./act/workflowpattern/... ./act/filecollector/... ./act/common/... ./act/jobparser ./act/model ./act/exprparser ./act/schema integration-test: - @$(GO) test -v ./internal/app/run/... + @$(GO) test -race -v ./internal/app/run/... .PHONY: vet vet: From 55c873f3604b6f53fe32157965c1232492c4b19c Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Wed, 20 Aug 2025 15:06:59 -0600 Subject: [PATCH 124/281] add gcc package for cgo/-race --- .forgejo/workflows/test.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 0a2e234f..caa70090 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -144,6 +144,7 @@ jobs: apt-get update -qq apt-get -q install -qq -y docker.io + - run: apt-get -q install -qq -y gcc # required for `-race` - name: integration test run: | go test -race ./act/container @@ -185,6 +186,8 @@ jobs: EOF apt --quiet install --yes -qq docker.io make + - run: apt-get -q install -qq -y gcc # required for `-race` + - run: make integration-test validate-mocks: From b8f8b0f6744016331cdae79079e4365a0fca8b5e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 20 Aug 2025 22:02:43 +0000 Subject: [PATCH 125/281] fix: an error from a SKIPPED job does not transform it into a FAILURE (#896) The result of a job can only be changed to FAILURE by the Close() function of the reporter under two conditions: - If it is UNSPECIFIED - If the context timeout In all other cases it must be preserved. It is possible, for instance, for a job to be SKIPPED and be associated with an error message, e.g. ``` time="2025-08-20T21:02:07+02:00" level=trace msg="evaluating expression 'success()'" dryrun=false job="Test Action/job-1" jobID=job-1 matrix="map[]" [Test Action/job-1] [DEBUG] evaluating expression 'success()' time="2025-08-20T21:02:07+02:00" level=trace msg="expression 'success()' evaluated to 'true'" dryrun=false job="Test Action/job-1" jobID=job-1 matrix="map[]" [Test Action/job-1] [DEBUG] expression 'success()' evaluated to 'true' time="2025-08-20T21:02:07+02:00" level=trace msg="'runs-on' key not defined in Test Action/job-1" dryrun=false job="Test Action/job-1" jobID=job-1 matrix="map[]" [Test Action/job-1] 'runs-on' key not defined in Test Action/job-1 [Test Action/job-1] [DEBUG] No steps found ``` Those errors show in the logs when a job is skipped, because the worflow is empty. But they are expected and to be ignored. Refs forgejo/runner#895 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/896): fix: an error from a SKIPPED job does not transform it into a FAILURE Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/896 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/reporter.go | 16 ++++--- internal/pkg/report/reporter_test.go | 70 +++++++++++++++------------- 2 files changed, 48 insertions(+), 38 deletions(-) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index a02f0e72..42afe8e0 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -244,26 +244,30 @@ const ( func (r *Reporter) Close(runErr error) error { r.closed = true + setStepCancel := func() { + for _, v := range r.state.Steps { + if v.Result == runnerv1.Result_RESULT_UNSPECIFIED { + v.Result = runnerv1.Result_RESULT_CANCELLED + } + } + } + r.stateMu.Lock() var lastWords string if errors.Is(runErr, context.DeadlineExceeded) { lastWords = closeTimeoutMessage r.state.Result = runnerv1.Result_RESULT_CANCELLED + setStepCancel() } else if r.state.Result == runnerv1.Result_RESULT_UNSPECIFIED { if runErr == nil { lastWords = closeCancelledMessage } else { lastWords = runErr.Error() } - for _, v := range r.state.Steps { - if v.Result == runnerv1.Result_RESULT_UNSPECIFIED { - v.Result = runnerv1.Result_RESULT_CANCELLED - } - } r.state.Result = runnerv1.Result_RESULT_FAILURE + setStepCancel() } else if runErr != nil { lastWords = runErr.Error() - r.state.Result = runnerv1.Result_RESULT_FAILURE } if lastWords != "" { diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index 40af3e30..246d1699 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -410,7 +410,8 @@ func TestReporterReportLog(t *testing.T) { } func TestReporterClose(t *testing.T) { - mockReporterCloser := func(message *string, result *runnerv1.Result) *Reporter { + mockReporterCloser := func(t *testing.T, message *string, result *runnerv1.Result) *Reporter { + t.Helper() reporter, client, _ := mockReporter(t) if message != nil { client.On("UpdateLog", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateLogRequest]) (*connect_go.Response[runnerv1.UpdateLogResponse], error) { @@ -435,46 +436,50 @@ func TestReporterClose(t *testing.T) { } for _, testCase := range []struct { - name string - err error - expectedMessage string - result runnerv1.Result - expectedResult runnerv1.Result + name string + err error + expectedMessage string + result runnerv1.Result + expectedStateResult runnerv1.Result + expectedStepStateResult runnerv1.Result }{ { - name: "ResultSuccessAndNilErrorIsResultSuccess", - err: nil, - expectedMessage: "", - result: runnerv1.Result_RESULT_SUCCESS, - expectedResult: runnerv1.Result_RESULT_SUCCESS, + name: "ResultSuccessAndNilErrorIsResultSuccess", + err: nil, + expectedMessage: "", + result: runnerv1.Result_RESULT_SUCCESS, + expectedStateResult: runnerv1.Result_RESULT_SUCCESS, }, { - name: "ResultUnspecifiedAndErrorIsResultFailure", - err: errors.New("ERROR_MESSAGE"), - expectedMessage: "ERROR_MESSAGE", - result: runnerv1.Result_RESULT_UNSPECIFIED, - expectedResult: runnerv1.Result_RESULT_FAILURE, + name: "ResultUnspecifiedAndErrorIsResultFailure", + err: errors.New("ERROR_MESSAGE"), + expectedMessage: "ERROR_MESSAGE", + result: runnerv1.Result_RESULT_UNSPECIFIED, + expectedStateResult: runnerv1.Result_RESULT_FAILURE, + expectedStepStateResult: runnerv1.Result_RESULT_CANCELLED, }, { - name: "ResultUnspecifiedAndNilErrorIsResultFailure", - err: nil, - expectedMessage: closeCancelledMessage, - result: runnerv1.Result_RESULT_UNSPECIFIED, - expectedResult: runnerv1.Result_RESULT_FAILURE, + name: "ResultUnspecifiedAndNilErrorIsResultFailure", + err: nil, + expectedMessage: closeCancelledMessage, + result: runnerv1.Result_RESULT_UNSPECIFIED, + expectedStateResult: runnerv1.Result_RESULT_FAILURE, + expectedStepStateResult: runnerv1.Result_RESULT_CANCELLED, }, { - name: "ResultSuccessAndErrorIsResultFailure", - err: errors.New("ERROR_MESSAGE"), - expectedMessage: "ERROR_MESSAGE", - result: runnerv1.Result_RESULT_SUCCESS, - expectedResult: runnerv1.Result_RESULT_FAILURE, + name: "ResultSkippedAndErrorIsResultSkipped", + err: errors.New("ERROR_MESSAGE"), + expectedMessage: "ERROR_MESSAGE", + result: runnerv1.Result_RESULT_SKIPPED, + expectedStateResult: runnerv1.Result_RESULT_SKIPPED, }, { - name: "Timeout", - err: context.DeadlineExceeded, - expectedMessage: closeTimeoutMessage, - result: runnerv1.Result_RESULT_UNSPECIFIED, - expectedResult: runnerv1.Result_RESULT_CANCELLED, + name: "Timeout", + err: context.DeadlineExceeded, + expectedMessage: closeTimeoutMessage, + result: runnerv1.Result_RESULT_UNSPECIFIED, + expectedStateResult: runnerv1.Result_RESULT_CANCELLED, + expectedStepStateResult: runnerv1.Result_RESULT_CANCELLED, }, } { t.Run(testCase.name, func(t *testing.T) { @@ -482,7 +487,7 @@ func TestReporterClose(t *testing.T) { if testCase.expectedMessage != "" { message = &testCase.expectedMessage } - reporter := mockReporterCloser(message, &testCase.expectedResult) + reporter := mockReporterCloser(t, message, &testCase.expectedStateResult) // cancel() verifies Close can operate after the context is cancelled // because it uses the daemon context instead @@ -494,6 +499,7 @@ func TestReporterClose(t *testing.T) { }, } require.NoError(t, reporter.Close(testCase.err)) + assert.Equal(t, testCase.expectedStepStateResult, reporter.state.Steps[0].Result) }) } } From 7512133cb7adf70896a79105d6d503fb348bfda7 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 21 Aug 2025 06:30:27 +0000 Subject: [PATCH 126/281] Update module github.com/vektra/mockery/v2 to v2.53.5 (#890) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/vektra/mockery/v2](https://github.com/vektra/mockery) | `v2.53.4` -> `v2.53.5` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fvektra%2fmockery%2fv2/v2.53.5?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fvektra%2fmockery%2fv2/v2.53.4/v2.53.5?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
vektra/mockery (github.com/vektra/mockery/v2) ### [`v2.53.5`](https://github.com/vektra/mockery/compare/v2.53.4...v2.53.5) [Compare Source](https://github.com/vektra/mockery/compare/v2.53.4...v2.53.5)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/890): Update module github.com/vektra/mockery/v2 to v2.53.5 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/890 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index a16b82ea..5c80ea78 100644 --- a/Makefile +++ b/Makefile @@ -13,7 +13,7 @@ WINDOWS_ARCHS ?= windows/amd64 GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") -MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.4 # renovate: datasource=go +MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.5 # renovate: datasource=go GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner From 914808bea0e862ad050a5bd2744a4a4c5f42706f Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 21 Aug 2025 06:59:15 +0000 Subject: [PATCH 127/281] Update code.forgejo.org/forgejo/runner Docker tag to v9.1.1 (#897) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | patch | `9.1.0` -> `9.1.1` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v9.1.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.1.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.1.0...v9.1.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes ***
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/897): Update code.forgejo.org/forgejo/runner Docker tag to v9.1.1 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/897 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index 3f8e646f..a0a90c77 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:9.1.0 + image: code.forgejo.org/forgejo/runner:9.1.1 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:9.1.0 + image: code.forgejo.org/forgejo/runner:9.1.1 links: - docker-in-docker - forgejo From e0dd374a3be90270a77b114c6e17d600f6cd5e15 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 21 Aug 2025 07:16:34 +0000 Subject: [PATCH 128/281] Update dependency forgejo/runner to v9.1.1 (#898) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | patch | `9.1.0` -> `9.1.1` | --- ### Release Notes
forgejo/runner (forgejo/runner) ### [`v9.1.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.1.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.1.0...v9.1.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes ***
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/898): Update dependency forgejo/runner to v9.1.1 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/898 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 8b357645..7e549b7d 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=9.1.0 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=9.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From ea0a3f1f125708b66ce42b7e2ff79b0aaf63dc78 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 21 Aug 2025 11:24:11 +0000 Subject: [PATCH 129/281] chore: fix .PHONY lint targets (#893) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/893): chore: fix .PHONY lint targets Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/893 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 5c80ea78..13e4f774 100644 --- a/Makefile +++ b/Makefile @@ -69,11 +69,11 @@ LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=v$(RE all: build -.PHONY: lint +.PHONY: lint-check lint-check: $(GO) run $(GOLANGCI_LINT_PACKAGE) run $(GOLANGCI_LINT_ARGS) -.PHONY: lint-fix +.PHONY: lint lint: $(GO) run $(GOLANGCI_LINT_PACKAGE) run $(GOLANGCI_LINT_ARGS) --fix From 8a44eb421f3d2a8c2271d4bfbd64138a5a463fba Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 21 Aug 2025 11:53:48 +0000 Subject: [PATCH 130/281] chore: do not force GOPROXY (#899) let `setup-go` figure it out - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/899): chore: do not force GOPROXY Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/899 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/test.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index caa70090..d817ae3b 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -14,7 +14,6 @@ env: FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' FORGEJO_SCRIPT: | /usr/bin/s6-svscan /etc/s6 & sleep 10 ; su -c "forgejo admin user create --admin --username $FORGEJO_ADMIN_USER --password $FORGEJO_ADMIN_PASSWORD --email root@example.com" git && su -c "forgejo forgejo-cli actions register --labels docker --name therunner --secret $FORGEJO_RUNNER_SECRET" git && sleep infinity - GOPROXY: https://goproxy.io,direct jobs: build-and-tests: From 579c5e24fc832de24029efa13960a5a131d01070 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 21 Aug 2025 11:54:04 +0000 Subject: [PATCH 131/281] chore: remove TestRunContext_GetGitHubContext (#900) It does not assert anything useful and te associated function is otherwise heavily used in many tests. It may benefit from unit testing but this test would need to be done very differently to achieve that. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/900): chore: remove TestRunContext_GetGitHubContext Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/900 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/run_context_test.go | 58 ---------------------------------- 1 file changed, 58 deletions(-) diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 7d865777..33f77466 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -5,7 +5,6 @@ import ( "context" "errors" "fmt" - "os" "runtime" "slices" "strings" @@ -281,63 +280,6 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { }) } -func TestRunContext_GetGitHubContext(t *testing.T) { - log.SetLevel(log.DebugLevel) - - cwd, err := os.Getwd() - assert.Nil(t, err) - - rc := &RunContext{ - Config: &Config{ - EventName: "push", - Workdir: cwd, - }, - Run: &model.Run{ - Workflow: &model.Workflow{ - Name: "GitHubContextTest", - }, - }, - Name: "GitHubContextTest", - CurrentStep: "step", - Matrix: map[string]any{}, - Env: map[string]string{}, - ExtraPath: []string{}, - StepResults: map[string]*model.StepResult{}, - OutputMappings: map[MappableOutput]MappableOutput{}, - } - rc.Run.JobID = "job1" - - ghc := rc.getGithubContext(t.Context()) - - log.Debugf("%v", ghc) - - actor := "nektos/act" - if a := os.Getenv("ACT_ACTOR"); a != "" { - actor = a - } - - repo := "forgejo/runner" - if r := os.Getenv("ACT_REPOSITORY"); r != "" { - repo = r - } - - owner := "code.forgejo.org" - if o := os.Getenv("ACT_OWNER"); o != "" { - owner = o - } - - assert.Equal(t, ghc.RunID, "1") - assert.Equal(t, ghc.RunNumber, "1") - assert.Equal(t, ghc.RetentionDays, "0") - assert.Equal(t, ghc.Actor, actor) - assert.True(t, strings.HasSuffix(ghc.Repository, repo)) - assert.Equal(t, ghc.RepositoryOwner, owner) - assert.Equal(t, ghc.RunnerPerflog, "/dev/null") - assert.Equal(t, ghc.Token, rc.Config.Secrets["GITHUB_TOKEN"]) - assert.Equal(t, ghc.Token, rc.Config.Secrets["FORGEJO_TOKEN"]) - assert.Equal(t, ghc.Job, "job1") -} - func TestRunContext_GetGithubContextRef(t *testing.T) { table := []struct { event string From d2b39167a81bf0803772dd510cc5c2ec610596ba Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 21 Aug 2025 19:44:03 +0000 Subject: [PATCH 132/281] Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 [SECURITY] (#904) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | `v2.3.0` -> `v2.4.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-viper%2fmapstructure%2fv2/v2.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-viper%2fmapstructure%2fv2/v2.3.0/v2.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data [GHSA-2464-8j7c-4cjm](https://github.com/advisories/GHSA-2464-8j7c-4cjm)
More information #### Details ##### Summary Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. ##### Details OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50 ```go _, _, err := d.getPrimitive(field, schema) if err != nil { return fmt.Errorf("error converting input for field %q: %w", field, err) } ``` where this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193 ```go func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) { raw, ok := d.Raw[k] if !ok { return nil, false, nil } switch t := schema.Type; t { case TypeBool: var result bool if err := mapstructure.WeakDecode(raw, &result); err != nil { return nil, false, err } return result, true, nil ``` Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers: https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727 https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798 https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180 & more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h. ##### PoC To reproduce with OpenBao: ``` $ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300 ``` and in a new tab: ``` $ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass Success! Enabled userpass auth method at: userpass/ $ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf" --> server logs: 2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\"" ``` ##### Impact This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided). This was rated 4.5 Medium by HashiCorp in the past iteration. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N` #### References - [https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm) - [https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c](https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c) - [https://github.com/go-viper/mapstructure](https://github.com/go-viper/mapstructure) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2464-8j7c-4cjm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
--- ### Release Notes
go-viper/mapstructure (github.com/go-viper/mapstructure/v2) ### [`v2.4.0`](https://github.com/go-viper/mapstructure/releases/tag/v2.4.0) [Compare Source](https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0) #### What's Changed - refactor: replace interface{} with any by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/115 - build(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by [@​dependabot](https://github.com/dependabot)\[bot] in https://github.com/go-viper/mapstructure/pull/114 - Generic tests by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/118 - Fix godoc reference link in README.md by [@​peczenyj](https://github.com/peczenyj) in https://github.com/go-viper/mapstructure/pull/107 - feat: add StringToTimeLocationHookFunc to convert strings to \*time.Location by [@​ErfanMomeniii](https://github.com/ErfanMomeniii) in https://github.com/go-viper/mapstructure/pull/117 - feat: add back previous StringToSlice as a weak function by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/119 #### New Contributors - [@​ErfanMomeniii](https://github.com/ErfanMomeniii) made their first contribution in https://github.com/go-viper/mapstructure/pull/117 **Full Changelog**: https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0
--- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/904): Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 [SECURITY] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/904 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 92bb4f1b..fb8d6f46 100644 --- a/go.mod +++ b/go.mod @@ -61,7 +61,7 @@ require ( github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-logr/logr v1.4.2 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-viper/mapstructure/v2 v2.3.0 // indirect + github.com/go-viper/mapstructure/v2 v2.4.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/go-cmp v0.7.0 // indirect diff --git a/go.sum b/go.sum index 2ac739de..f0981b4b 100644 --- a/go.sum +++ b/go.sum @@ -76,8 +76,8 @@ github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk= -github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= +github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs= +github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= From 8eda2e40a40391cb49d34cbbb133e68c0baf25a2 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 21 Aug 2025 19:48:28 +0000 Subject: [PATCH 133/281] chore: rework the README (#903) - Explain how to run tests locally instead of pointing to the workflow. - Explain how to run lint checks & fix locally - Replace the `forgejo-setup` based instructions with shorter and more actionable instructions based out of the end-to-end tests. - Remove the reporting bug section, the issue template has all the information it needs. It is unlikely that someone reporting a bug will read that section in the README before filing the bug. It removes the suggestion to file a bug in the end-to-end repository but I don't think it was actually beneficial to anyone in the past two years. - Remove the mock generation part as it is now self documented in the job that takes care of it. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/903): chore: rework the README [skip cascade] Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/903 Reviewed-by: Gusted Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- README.md | 93 +++++++++++++++---------------------------------------- 1 file changed, 25 insertions(+), 68 deletions(-) diff --git a/README.md b/README.md index 276c8746..f21e6a7d 100644 --- a/README.md +++ b/README.md @@ -2,13 +2,10 @@ A daemon that connects to a Forgejo instance and runs jobs for continuous integration. The [installation and usage instructions](https://forgejo.org/docs/next/admin/actions/) are part of the Forgejo documentation. -# Reporting bugs - -When filing a bug in [the issue tracker](https://code.forgejo.org/forgejo/runner/issues), it is very helpful to propose a pull request [in the end-to-end tests](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions) repository that adds a reproducer. It will fail the CI and unambiguously demonstrate that the problem exists. In most cases it is enough to add a workflow ([see the echo example](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions/example-echo)). For more complicated cases it is also possible to add a runner config file as well as shell scripts to setup and teardown the test case ([see the service example](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions/example-service)). +# Reporting security-related issues Sensitive security-related issues should be reported to [security@forgejo.org](mailto:security@forgejo.org) using [encryption](https://keyoxide.org/security@forgejo.org). - ## License The Forgejo runner source code is distributed under the terms of the following licenses: @@ -36,77 +33,37 @@ The Forgejo runner is a dependency of the [setup-forgejo action](https://code.fo - Install [Go](https://go.dev/doc/install) and `make(1)` - `make build` -The [test workflow](.forgejo/workflows/test.yml) is a full example that builds the binary, runs the tests and launches the runner binary against a live Forgejo instance. +## Linting -## Generate mocks +- `make lint-check` +- `make lint` # will fix some lint errors -- `make deps-tools` -- `make generate` +## Testing -If there are changes, commit them to the repository. +The [workflow](.forgejo/workflows/test.yml) that runs in the CI uses similar commands. -## Local debug +### Without a Forgejo instance -The repositories are checked out in the same directory: +- Install [Docker](https://docs.docker.com/engine/install/) +- `make test integration-test` -- **runner**: [Forgejo runner](https://code.forgejo.org/forgejo/runner) -- **setup-forgejo**: [setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) +### With a Forgejo instance -### Install dependencies - -The dependencies are installed manually or with: - -```shell -setup-forgejo/forgejo-dependencies.sh +- Run a Forgejo instance locally (for instance at http://0.0.0.0:8080) and create as shared secret +```sh +export FORGEJO_RUNNER_SECRET='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +export FORGEJO_URL=http://0.0.0.0:8080 +forgejo forgejo-cli actions register --labels docker --name therunner --secret $FORGEJO_RUNNER_SECRET ``` +- `make test integration-test` # which will run addional tests because FORGEJO_URL is set -### Build the Forgejo runner +### end-to-end -```shell -cd runner ; rm -f forgejo-runner ; make forgejo-runner -``` - -### Launch Forgejo and the runner - -A Forgejo instance is launched with: - -```shell -cd setup-forgejo -./forgejo.sh setup -firefox $(cat forgejo-url) -``` - -The user is `root` with password `admin1234`. The runner is registered with: - -``` -cd setup-forgejo -docker exec --user 1000 forgejo forgejo actions generate-runner-token > forgejo-runner-token -../runner/forgejo-runner register --no-interactive --instance "$(cat forgejo-url)" --name runner --token $(cat forgejo-runner-token) --labels docker:docker://node:22-bookworm,self-hosted:host,lxc:lxc://debian:bookworm -``` - -And launched with: - -```shell -cd setup-forgejo ; ../runner/forgejo-runner --config runner-config.yml daemon -``` - -Note that the `runner-config.yml` is required in that particular case -to configure the network in `bridge` mode, otherwise the runner will -create a network that cannot reach the forgejo instance. - -### Try a sample workflow - -From the Forgejo web interface, create a repository and add the -following to `.forgejo/workflows/try.yaml`. It will launch the job and -the result can be observed from the `actions` tab. - -```yaml -on: [push] -jobs: - ls: - runs-on: docker - steps: - - uses: actions/checkout@v4 - - run: | - ls ${{ github.workspace }} -``` +- Follow the instructions from the end-to-end tests to [run actions tests locally](https://code.forgejo.org/forgejo/end-to-end#running-from-locally-built-binary). +- `./end-to-end.sh actions_teardown` # stop the Forgejo and runner daemons running in the end-to-end environment +- `( cd ~/clone-of-the-runner-repo ; make build ; cp forgejo-runner /tmp/forgejo-end-to-end/forgejo-runner )` # install the runner built from sources +- `./end-to-end.sh actions_setup 13.0` # start Forgejo v13.0 and the runner daemon in the end-to-end environment +- `./end-to-end.sh actions_verify_example echo` # run the [echo workflow](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions/example-echo/.forgejo/workflows/test.yml) +- `xdg-open http://127.0.0.1:3000/root/example-echo/actions/runs/1` # see the logs workflow +- `less /tmp/forgejo-end-to-end/forgejo-runner.log` # analyze the runner logs +- `less /tmp/forgejo-end-to-end/forgejo-work-path/log/forgejo.log` # analyze the Forgejo logs From fac8be3c565869f5775ba48cbe10f0d3775a81e2 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 21 Aug 2025 19:50:05 +0000 Subject: [PATCH 134/281] chore: skip tests that require Forgejo if it is not available (#902) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/902): chore: skip tests that require Forgejo if it is not available Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/902 Reviewed-by: Gusted Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/cmd/create-runner-file_test.go | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/internal/app/cmd/create-runner-file_test.go b/internal/app/cmd/create-runner-file_test.go index cd0a720e..9da01ae1 100644 --- a/internal/app/cmd/create-runner-file_test.go +++ b/internal/app/cmd/create-runner-file_test.go @@ -37,12 +37,18 @@ func Test_uuidFromSecret(t *testing.T) { assert.EqualValues(t, uuid, "41414141-4141-4141-4141-414141414141") } -func Test_ping(t *testing.T) { - cfg := &config.Config{} +func getForgejoFromEnv(t *testing.T) string { + t.Helper() address := os.Getenv("FORGEJO_URL") if address == "" { - address = "https://code.forgejo.org" + t.Skip("skipping because FORGEJO_URL is not set") } + return address +} + +func Test_ping(t *testing.T) { + cfg := &config.Config{} + address := getForgejoFromEnv(t) reg := &config.Registration{ Address: address, UUID: "create-runner-file_test.go", @@ -51,6 +57,8 @@ func Test_ping(t *testing.T) { } func Test_runCreateRunnerFile(t *testing.T) { + instance := getForgejoFromEnv(t) + // // Set the .runner file to be in a temporary directory // @@ -63,10 +71,6 @@ func Test_runCreateRunnerFile(t *testing.T) { assert.NoError(t, err) assert.NoError(t, os.WriteFile(configFile, yamlData, 0o666)) - instance, has := os.LookupEnv("FORGEJO_URL") - if !has { - instance = "https://code.forgejo.org" - } secret, has := os.LookupEnv("FORGEJO_RUNNER_SECRET") assert.True(t, has) name := "testrunner" From 086a8f9847b2eb326dfb8b07507326225a7a384c Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 22 Aug 2025 05:09:36 +0000 Subject: [PATCH 135/281] test: remove internal timeout in TestRunnerCacheConfiguration (#906) Performance has been in the range of 2.5 - 3 minutes for the "runner integration tests" step, causing this arbitrary timeout to be hit. The timeout was useful for early test development when nothing was running successfully, but meaningful now. Fixes #905. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/906): test: remove internal timeout in TestRunnerCacheConfiguration Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/906 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- internal/app/run/runner_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 3c983a32..94e476f4 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -171,7 +171,7 @@ func TestRunnerCacheConfiguration(t *testing.T) { // Must set up cache for our test require.NotNil(t, runner.cacheProxy) - ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute) + ctx, cancel := context.WithCancel(t.Context()) defer cancel() // Run a given workflow w/ event... From 612bd1e0ce59266b229078ad0f6124476c5ad215 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 25 Aug 2025 06:05:53 +0000 Subject: [PATCH 136/281] Update module go.etcd.io/bbolt to v1.4.3 (#907) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [go.etcd.io/bbolt](https://github.com/etcd-io/bbolt) | `v1.4.2` -> `v1.4.3` | [![age](https://developer.mend.io/api/mc/badges/age/go/go.etcd.io%2fbbolt/v1.4.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.etcd.io%2fbbolt/v1.4.2/v1.4.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
etcd-io/bbolt (go.etcd.io/bbolt) ### [`v1.4.3`](https://github.com/etcd-io/bbolt/releases/tag/v1.4.3) [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.4.2...v1.4.3) See the [CHANGELOG/v1.4.3](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.4.md#v1432025-08-19) for more details.
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/907): Update module go.etcd.io/bbolt to v1.4.3 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/907 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index fb8d6f46..2be4df88 100644 --- a/go.mod +++ b/go.mod @@ -35,7 +35,7 @@ require ( github.com/spf13/pflag v1.0.7 github.com/stretchr/testify v1.10.0 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 - go.etcd.io/bbolt v1.4.2 + go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.34.0 golang.org/x/time v0.12.0 diff --git a/go.sum b/go.sum index f0981b4b..fea4a9a9 100644 --- a/go.sum +++ b/go.sum @@ -205,8 +205,8 @@ github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw= -go.etcd.io/bbolt v1.4.2 h1:IrUHp260R8c+zYx/Tm8QZr04CX+qWS5PGfPdevhdm1I= -go.etcd.io/bbolt v1.4.2/go.mod h1:Is8rSHO/b4f3XigBC0lL0+4FwAQv3HXEEIgFMuKHceM= +go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo= +go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E= go.etcd.io/gofail v0.1.0/go.mod h1:VZBCXYGZhHAinaBiiqYvuDynvahNsAyLFwB3kEHKz1M= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= From fa365952f6ffc245b74367ece4ed0d55880adf3b Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 26 Aug 2025 06:51:01 +0000 Subject: [PATCH 137/281] Update module google.golang.org/protobuf to v1.36.8 (#914) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [google.golang.org/protobuf](https://github.com/protocolbuffers/protobuf-go) | `v1.36.7` -> `v1.36.8` | [![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fprotobuf/v1.36.8?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fprotobuf/v1.36.7/v1.36.8?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
protocolbuffers/protobuf-go (google.golang.org/protobuf) ### [`v1.36.8`](https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.8) [Compare Source](https://github.com/protocolbuffers/protobuf-go/compare/v1.36.7...v1.36.8) Maintenance: [CL/696316](https://go-review.googlesource.com/c/protobuf/+/696316): all: set Go language version to Go 1.23 [CL/696315](https://go-review.googlesource.com/c/protobuf/+/696315): types: regenerate using latest protobuf v32 release
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/914): Update module google.golang.org/protobuf to v1.36.8 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/914 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2be4df88..e2f1dde4 100644 --- a/go.mod +++ b/go.mod @@ -39,7 +39,7 @@ require ( go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.34.0 golang.org/x/time v0.12.0 - google.golang.org/protobuf v1.36.7 + google.golang.org/protobuf v1.36.8 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index fea4a9a9..78bc6fb4 100644 --- a/go.sum +++ b/go.sum @@ -290,8 +290,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU= google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw= google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA= -google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A= -google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= +google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= +google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From 0e780482ebd0a8ec051ff54a9ce81649b4f2e183 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 28 Aug 2025 09:31:53 +0000 Subject: [PATCH 138/281] Update module github.com/stretchr/testify to v1.11.1 (#915) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/stretchr/testify](https://github.com/stretchr/testify) | `v1.10.0` -> `v1.11.1` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fstretchr%2ftestify/v1.11.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fstretchr%2ftestify/v1.10.0/v1.11.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
stretchr/testify (github.com/stretchr/testify) ### [`v1.11.1`](https://github.com/stretchr/testify/releases/tag/v1.11.1) [Compare Source](https://github.com/stretchr/testify/compare/v1.11.0...v1.11.1) This release fixes [#​1785](https://github.com/stretchr/testify/issues/1785) introduced in v1.11.0 where expected argument values implementing the stringer interface (`String() string`) with a method which mutates their value, when passed to mock.Mock.On (`m.On("Method", ).Return()`) or actual argument values passed to mock.Mock.Called may no longer match one another where they previously did match. The behaviour prior to v1.11.0 where the stringer is always called is restored. Future testify releases may not call the stringer method at all in this case. #### What's Changed - Backport [#​1786](https://github.com/stretchr/testify/issues/1786) to release/1.11: mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by [@​brackendawson](https://github.com/brackendawson) in [#​1788](https://github.com/stretchr/testify/pull/1788) **Full Changelog**: ### [`v1.11.0`](https://github.com/stretchr/testify/releases/tag/v1.11.0) [Compare Source](https://github.com/stretchr/testify/compare/v1.10.0...v1.11.0) #### What's Changed ##### Functional Changes v1.11.0 Includes a number of performance improvements. - Call stack perf change for CallerInfo by [@​mikeauclair](https://github.com/mikeauclair) in [#​1614](https://github.com/stretchr/testify/pull/1614) - Lazily render mock diff output on successful match by [@​mikeauclair](https://github.com/mikeauclair) in [#​1615](https://github.com/stretchr/testify/pull/1615) - assert: check early in Eventually, EventuallyWithT, and Never by [@​cszczepaniak](https://github.com/cszczepaniak) in [#​1427](https://github.com/stretchr/testify/pull/1427) - assert: add IsNotType by [@​bartventer](https://github.com/bartventer) in [#​1730](https://github.com/stretchr/testify/pull/1730) - assert.JSONEq: shortcut if same strings by [@​dolmen](https://github.com/dolmen) in [#​1754](https://github.com/stretchr/testify/pull/1754) - assert.YAMLEq: shortcut if same strings by [@​dolmen](https://github.com/dolmen) in [#​1755](https://github.com/stretchr/testify/pull/1755) - assert: faster and simpler isEmpty using reflect.Value.IsZero by [@​dolmen](https://github.com/dolmen) in [#​1761](https://github.com/stretchr/testify/pull/1761) - suite: faster methods filtering (internal refactor) by [@​dolmen](https://github.com/dolmen) in [#​1758](https://github.com/stretchr/testify/pull/1758) ##### Fixes - assert.ErrorAs: log target type by [@​craig65535](https://github.com/craig65535) in [#​1345](https://github.com/stretchr/testify/pull/1345) - Fix failure message formatting for Positive and Negative asserts in [#​1062](https://github.com/stretchr/testify/pull/1062) - Improve ErrorIs message when error is nil but an error was expected by [@​tsioftas](https://github.com/tsioftas) in [#​1681](https://github.com/stretchr/testify/pull/1681) - fix Subset/NotSubset when calling with mixed input types by [@​siliconbrain](https://github.com/siliconbrain) in [#​1729](https://github.com/stretchr/testify/pull/1729) - Improve ErrorAs failure message when error is nil by [@​ccoVeille](https://github.com/ccoVeille) in [#​1734](https://github.com/stretchr/testify/pull/1734) - mock.AssertNumberOfCalls: improve error msg by [@​3scalation](https://github.com/3scalation) in [#​1743](https://github.com/stretchr/testify/pull/1743) ##### Documentation, Build & CI - docs: Fix typo in README by [@​alexandear](https://github.com/alexandear) in [#​1688](https://github.com/stretchr/testify/pull/1688) - Replace deprecated io/ioutil with io and os by [@​alexandear](https://github.com/alexandear) in [#​1684](https://github.com/stretchr/testify/pull/1684) - Document consequences of calling t.FailNow() by [@​greg0ire](https://github.com/greg0ire) in [#​1710](https://github.com/stretchr/testify/pull/1710) - chore: update docs for Unset [#​1621](https://github.com/stretchr/testify/issues/1621) by [@​techfg](https://github.com/techfg) in [#​1709](https://github.com/stretchr/testify/pull/1709) - README: apply gofmt to examples by [@​alexandear](https://github.com/alexandear) in [#​1687](https://github.com/stretchr/testify/pull/1687) - refactor: use %q and %T to simplify fmt.Sprintf by [@​alexandear](https://github.com/alexandear) in [#​1674](https://github.com/stretchr/testify/pull/1674) - Propose Christophe Colombier (ccoVeille) as approver by [@​brackendawson](https://github.com/brackendawson) in [#​1716](https://github.com/stretchr/testify/pull/1716) - Update documentation for the Error function in assert or require package by [@​architagr](https://github.com/architagr) in [#​1675](https://github.com/stretchr/testify/pull/1675) - assert: remove deprecated build constraints by [@​alexandear](https://github.com/alexandear) in [#​1671](https://github.com/stretchr/testify/pull/1671) - assert: apply gofumpt to internal test suite by [@​ccoVeille](https://github.com/ccoVeille) in [#​1739](https://github.com/stretchr/testify/pull/1739) - CI: fix shebang in .ci.\*.sh scripts by [@​dolmen](https://github.com/dolmen) in [#​1746](https://github.com/stretchr/testify/pull/1746) - assert,require: enable parallel testing on (almost) all top tests by [@​dolmen](https://github.com/dolmen) in [#​1747](https://github.com/stretchr/testify/pull/1747) - suite.Passed: add one more status test report by [@​Ararsa-Derese](https://github.com/Ararsa-Derese) in [#​1706](https://github.com/stretchr/testify/pull/1706) - Add Helper() method in internal mocks and assert.CollectT by [@​dolmen](https://github.com/dolmen) in [#​1423](https://github.com/stretchr/testify/pull/1423) - assert.Same/NotSame: improve usage of Sprintf by [@​ccoVeille](https://github.com/ccoVeille) in [#​1742](https://github.com/stretchr/testify/pull/1742) - mock: enable parallel testing on internal testsuite by [@​dolmen](https://github.com/dolmen) in [#​1756](https://github.com/stretchr/testify/pull/1756) - suite: cleanup use of 'testing' internals at runtime by [@​dolmen](https://github.com/dolmen) in [#​1751](https://github.com/stretchr/testify/pull/1751) - assert: check test failure message for Empty and NotEmpty by [@​ccoVeille](https://github.com/ccoVeille) in [#​1745](https://github.com/stretchr/testify/pull/1745) - deps: fix dependency cycle with objx (again) by [@​dolmen](https://github.com/dolmen) in [#​1567](https://github.com/stretchr/testify/pull/1567) - assert.Empty: comprehensive doc of "Empty"-ness rules by [@​dolmen](https://github.com/dolmen) in [#​1753](https://github.com/stretchr/testify/pull/1753) - doc: improve godoc of top level 'testify' package by [@​dolmen](https://github.com/dolmen) in [#​1760](https://github.com/stretchr/testify/pull/1760) - assert.ErrorAs: simplify retrieving the type name by [@​ccoVeille](https://github.com/ccoVeille) in [#​1740](https://github.com/stretchr/testify/pull/1740) - assert.EqualValues: improve test coverage to 100% by [@​dolmen](https://github.com/dolmen) in [#​1763](https://github.com/stretchr/testify/pull/1763) - suite.Run: simplify running of Setup/TeardownSuite by [@​renzoarreaza](https://github.com/renzoarreaza) in [#​1769](https://github.com/stretchr/testify/pull/1769) - assert.CallerInfo: micro optimization by using LastIndexByte by [@​dolmen](https://github.com/dolmen) in [#​1767](https://github.com/stretchr/testify/pull/1767) - assert.CallerInfo: micro cleanup by [@​dolmen](https://github.com/dolmen) in [#​1768](https://github.com/stretchr/testify/pull/1768) - assert: refactor Test*FileExists and Test*DirExists tests to enable parallel testing by [@​dolmen](https://github.com/dolmen) in [#​1766](https://github.com/stretchr/testify/pull/1766) - suite.Run: refactor handling of stats for improved readability by [@​dolmen](https://github.com/dolmen) in [#​1764](https://github.com/stretchr/testify/pull/1764) - tests: improve captureTestingT helper by [@​ccoVeille](https://github.com/ccoVeille) in [#​1741](https://github.com/stretchr/testify/pull/1741) - build(deps): bump actions/checkout from 4 to 5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1778](https://github.com/stretchr/testify/pull/1778) #### New Contributors - [@​greg0ire](https://github.com/greg0ire) made their first contribution in [#​1710](https://github.com/stretchr/testify/pull/1710) - [@​techfg](https://github.com/techfg) made their first contribution in [#​1709](https://github.com/stretchr/testify/pull/1709) - [@​mikeauclair](https://github.com/mikeauclair) made their first contribution in [#​1614](https://github.com/stretchr/testify/pull/1614) - [@​cszczepaniak](https://github.com/cszczepaniak) made their first contribution in [#​1427](https://github.com/stretchr/testify/pull/1427) - [@​architagr](https://github.com/architagr) made their first contribution in [#​1675](https://github.com/stretchr/testify/pull/1675) - [@​tsioftas](https://github.com/tsioftas) made their first contribution in [#​1681](https://github.com/stretchr/testify/pull/1681) - [@​siliconbrain](https://github.com/siliconbrain) made their first contribution in [#​1729](https://github.com/stretchr/testify/pull/1729) - [@​bartventer](https://github.com/bartventer) made their first contribution in [#​1730](https://github.com/stretchr/testify/pull/1730) - [@​Ararsa-Derese](https://github.com/Ararsa-Derese) made their first contribution in [#​1706](https://github.com/stretchr/testify/pull/1706) - [@​renzoarreaza](https://github.com/renzoarreaza) made their first contribution in [#​1769](https://github.com/stretchr/testify/pull/1769) - [@​3scalation](https://github.com/3scalation) made their first contribution in [#​1743](https://github.com/stretchr/testify/pull/1743) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/915): Update module github.com/stretchr/testify to v1.11.1 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/915 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e2f1dde4..4c38b1b4 100644 --- a/go.mod +++ b/go.mod @@ -33,7 +33,7 @@ require ( github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.7 - github.com/stretchr/testify v1.10.0 + github.com/stretchr/testify v1.11.1 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 diff --git a/go.sum b/go.sum index 78bc6fb4..866d9f74 100644 --- a/go.sum +++ b/go.sum @@ -189,8 +189,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= -github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 h1:zjNCuOOhh1TKRU0Ru3PPPJt80z7eReswCao91gBLk00= github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928/go.mod h1:PCFYfAEfKT+Nd6zWvUpsXduMR1bXFLf0uGSlEF05MCI= github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM= From bbb2cdd9f75c2e0a88c9f0b26c406895482f7a8e Mon Sep 17 00:00:00 2001 From: Gusted Date: Thu, 28 Aug 2025 09:33:52 +0000 Subject: [PATCH 139/281] chore: remove `github.com/pkg/errors` (#873) The functionality provided by this package is also provided by the standard library. `fmt.Errorf` for dynamically generated errors. `errors.new` for static errors. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/873): chore: remove `github.com/pkg/errors` Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/873 Reviewed-by: Michael Kriese Reviewed-by: earl-warren Co-authored-by: Gusted Co-committed-by: Gusted --- act/container/docker_cli.go | 64 ++++++++++++++++---------------- act/container/docker_cli_test.go | 4 +- act/container/docker_stub.go | 2 +- go.mod | 2 +- 4 files changed, 36 insertions(+), 36 deletions(-) diff --git a/act/container/docker_cli.go b/act/container/docker_cli.go index e62af5d8..adf0bb0e 100644 --- a/act/container/docker_cli.go +++ b/act/container/docker_cli.go @@ -13,6 +13,7 @@ package container import ( "bytes" "encoding/json" + "errors" "fmt" "os" "path" @@ -32,7 +33,6 @@ import ( "github.com/docker/docker/api/types/versions" "github.com/docker/docker/errdefs" "github.com/docker/go-connections/nat" - "github.com/pkg/errors" "github.com/sirupsen/logrus" "github.com/spf13/pflag" ) @@ -331,7 +331,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con // Validate the input mac address if copts.macAddress != "" { if _, err := opts.ValidateMACAddress(copts.macAddress); err != nil { - return nil, errors.Errorf("%s is not a valid mac address", copts.macAddress) + return nil, fmt.Errorf("%s is not a valid mac address", copts.macAddress) } } if copts.stdin { @@ -347,7 +347,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con swappiness := copts.swappiness if swappiness != -1 && (swappiness < 0 || swappiness > 100) { - return nil, errors.Errorf("invalid value: %d. Valid memory swappiness range is 0-100", swappiness) + return nil, fmt.Errorf("invalid value: %d. Valid memory swappiness range is 0-100", swappiness) } mounts := copts.mounts.Value() @@ -430,7 +430,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con // Merge in exposed ports to the map of published ports for _, e := range copts.expose.GetSlice() { if strings.Contains(e, ":") { - return nil, errors.Errorf("invalid port format for --expose: %s", e) + return nil, fmt.Errorf("invalid port format for --expose: %s", e) } // support two formats for expose, original format /[] // or /[] @@ -439,7 +439,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con // if expose a port, the start and end port are the same start, end, err := nat.ParsePortRange(port) if err != nil { - return nil, errors.Errorf("invalid range format for --expose: %s, error: %s", e, err) + return nil, fmt.Errorf("invalid range format for --expose: %s, error: %s", e, err) } for i := start; i <= end; i++ { p, err := nat.NewPort(proto, strconv.FormatUint(i, 10)) @@ -488,22 +488,22 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con pidMode := container.PidMode(copts.pidMode) if !pidMode.Valid() { - return nil, errors.Errorf("--pid: invalid PID mode") + return nil, errors.New("--pid: invalid PID mode") } utsMode := container.UTSMode(copts.utsMode) if !utsMode.Valid() { - return nil, errors.Errorf("--uts: invalid UTS mode") + return nil, errors.New("--uts: invalid UTS mode") } usernsMode := container.UsernsMode(copts.usernsMode) if !usernsMode.Valid() { - return nil, errors.Errorf("--userns: invalid USER mode") + return nil, errors.New("--userns: invalid USER mode") } cgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode) if !cgroupnsMode.Valid() { - return nil, errors.Errorf("--cgroupns: invalid CGROUP mode") + return nil, errors.New("--cgroupns: invalid CGROUP mode") } restartPolicy, err := opts.ParseRestartPolicy(copts.restartPolicy) @@ -537,7 +537,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con copts.healthRetries != 0 if copts.noHealthcheck { if haveHealthSettings { - return nil, errors.Errorf("--no-healthcheck conflicts with --health-* options") + return nil, errors.New("--no-healthcheck conflicts with --health-* options") } test := strslice.StrSlice{"NONE"} healthConfig = &container.HealthConfig{Test: test} @@ -548,16 +548,16 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con probe = strslice.StrSlice(args) } if copts.healthInterval < 0 { - return nil, errors.Errorf("--health-interval cannot be negative") + return nil, errors.New("--health-interval cannot be negative") } if copts.healthTimeout < 0 { - return nil, errors.Errorf("--health-timeout cannot be negative") + return nil, errors.New("--health-timeout cannot be negative") } if copts.healthRetries < 0 { - return nil, errors.Errorf("--health-retries cannot be negative") + return nil, errors.New("--health-retries cannot be negative") } if copts.healthStartPeriod < 0 { - return nil, fmt.Errorf("--health-start-period cannot be negative") + return nil, errors.New("--health-start-period cannot be negative") } healthConfig = &container.HealthConfig{ @@ -677,7 +677,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con } if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() { - return nil, errors.Errorf("Conflicting options: --restart and --rm") + return nil, errors.New("Conflicting options: --restart and --rm") } // only set this value if the user provided the flag, else it should default to nil @@ -741,7 +741,7 @@ func parseNetworkOpts(copts *containerOptions) (map[string]*networktypes.Endpoin return nil, err } if _, ok := endpoints[n.Target]; ok { - return nil, errdefs.InvalidParameter(errors.Errorf("network %q is specified multiple times", n.Target)) + return nil, errdefs.InvalidParameter(fmt.Errorf("network %q is specified multiple times", n.Target)) } // For backward compatibility: if no custom options are provided for the network, @@ -838,7 +838,7 @@ func convertToStandardNotation(ports []string) ([]string, error) { for _, param := range strings.Split(publish, ",") { opt := strings.Split(param, "=") if len(opt) < 2 { - return optsList, errors.Errorf("invalid publish opts format (should be name=value but got '%s')", param) + return optsList, fmt.Errorf("invalid publish opts format (should be name=value but got '%s')", param) } params[opt[0]] = opt[1] @@ -854,7 +854,7 @@ func convertToStandardNotation(ports []string) ([]string, error) { func parseLoggingOpts(loggingDriver string, loggingOpts []string) (map[string]string, error) { loggingOptsMap := opts.ConvertKVStringsToMap(loggingOpts) if loggingDriver == "none" && len(loggingOpts) > 0 { - return map[string]string{}, errors.Errorf("invalid logging opts for driver %s", loggingDriver) + return map[string]string{}, fmt.Errorf("invalid logging opts for driver %s", loggingDriver) } return loggingOptsMap, nil } @@ -867,17 +867,17 @@ func parseSecurityOpts(securityOpts []string) ([]string, error) { if strings.Contains(opt, ":") { con = strings.SplitN(opt, ":", 2) } else { - return securityOpts, errors.Errorf("Invalid --security-opt: %q", opt) + return securityOpts, fmt.Errorf("Invalid --security-opt: %q", opt) } } if con[0] == "seccomp" && con[1] != "unconfined" { f, err := os.ReadFile(con[1]) if err != nil { - return securityOpts, errors.Errorf("opening seccomp profile (%s) failed: %v", con[1], err) + return securityOpts, fmt.Errorf("opening seccomp profile (%s) failed: %v", con[1], err) } b := bytes.NewBuffer(nil) if err := json.Compact(b, f); err != nil { - return securityOpts, errors.Errorf("compacting json for seccomp profile (%s) failed: %v", con[1], err) + return securityOpts, fmt.Errorf("compacting json for seccomp profile (%s) failed: %v", con[1], err) } securityOpts[key] = fmt.Sprintf("seccomp=%s", b.Bytes()) } @@ -913,7 +913,7 @@ func parseStorageOpts(storageOpts []string) (map[string]string, error) { opt := strings.SplitN(option, "=", 2) m[opt[0]] = opt[1] } else { - return nil, errors.Errorf("invalid storage option") + return nil, errors.New("invalid storage option") } } return m, nil @@ -927,7 +927,7 @@ func parseDevice(device, serverOS string) (container.DeviceMapping, error) { case "windows": return parseWindowsDevice(device) } - return container.DeviceMapping{}, errors.Errorf("unknown server OS: %s", serverOS) + return container.DeviceMapping{}, fmt.Errorf("unknown server OS: %s", serverOS) } // parseLinuxDevice parses a device mapping string to a container.DeviceMapping struct @@ -950,7 +950,7 @@ func parseLinuxDevice(device string) (container.DeviceMapping, error) { case 1: src = arr[0] default: - return container.DeviceMapping{}, errors.Errorf("invalid device specification: %s", device) + return container.DeviceMapping{}, fmt.Errorf("invalid device specification: %s", device) } if dst == "" { @@ -980,7 +980,7 @@ func validateDeviceCgroupRule(val string) (string, error) { return val, nil } - return val, errors.Errorf("invalid device cgroup format '%s'", val) + return val, fmt.Errorf("invalid device cgroup format '%s'", val) } // validDeviceMode checks if the mode for device is valid or not. @@ -1012,7 +1012,7 @@ func validateDevice(val, serverOS string) (string, error) { // Windows does validation entirely server-side return val, nil } - return "", errors.Errorf("unknown server OS: %s", serverOS) + return "", fmt.Errorf("unknown server OS: %s", serverOS) } // validateLinuxPath is the implementation of validateDevice knowing that the @@ -1027,12 +1027,12 @@ func validateLinuxPath(val string, validator func(string) bool) (string, error) var mode string if strings.Count(val, ":") > 2 { - return val, errors.Errorf("bad format for path: %s", val) + return val, fmt.Errorf("bad format for path: %s", val) } split := strings.SplitN(val, ":", 3) if split[0] == "" { - return val, errors.Errorf("bad format for path: %s", val) + return val, fmt.Errorf("bad format for path: %s", val) } switch len(split) { case 1: @@ -1051,13 +1051,13 @@ func validateLinuxPath(val string, validator func(string) bool) (string, error) containerPath = split[1] mode = split[2] if isValid := validator(split[2]); !isValid { - return val, errors.Errorf("bad mode specified: %s", mode) + return val, fmt.Errorf("bad mode specified: %s", mode) } val = fmt.Sprintf("%s:%s:%s", split[0], containerPath, mode) } if !path.IsAbs(containerPath) { - return val, errors.Errorf("%s is not an absolute path", containerPath) + return val, fmt.Errorf("%s is not an absolute path", containerPath) } return val, nil } @@ -1070,13 +1070,13 @@ func validateAttach(val string) (string, error) { return s, nil } } - return val, errors.Errorf("valid streams are STDIN, STDOUT and STDERR") + return val, errors.New("valid streams are STDIN, STDOUT and STDERR") } func validateAPIVersion(c *containerConfig, serverAPIVersion string) error { for _, m := range c.HostConfig.Mounts { if m.BindOptions != nil && m.BindOptions.NonRecursive && versions.LessThan(serverAPIVersion, "1.40") { - return errors.Errorf("bind-nonrecursive requires API v1.40 or later") + return errors.New("bind-nonrecursive requires API v1.40 or later") } } return nil diff --git a/act/container/docker_cli_test.go b/act/container/docker_cli_test.go index 7d41ed15..f885bfb6 100644 --- a/act/container/docker_cli_test.go +++ b/act/container/docker_cli_test.go @@ -10,6 +10,7 @@ package container import ( + "errors" "fmt" "io" "os" @@ -21,7 +22,6 @@ import ( "github.com/docker/docker/api/types/container" networktypes "github.com/docker/docker/api/types/network" "github.com/docker/go-connections/nat" - "github.com/pkg/errors" "github.com/spf13/pflag" "gotest.tools/v3/assert" is "gotest.tools/v3/assert/cmp" @@ -288,7 +288,7 @@ func compareRandomizedStrings(a, b, c, d string) error { if a == d && b == c { return nil } - return errors.Errorf("strings don't match") + return errors.New("strings don't match") } // Simple parse with MacAddress validation diff --git a/act/container/docker_stub.go b/act/container/docker_stub.go index ebb4e313..1ed58c19 100644 --- a/act/container/docker_stub.go +++ b/act/container/docker_stub.go @@ -4,12 +4,12 @@ package container import ( "context" + "errors" "runtime" "code.forgejo.org/forgejo/runner/v9/act/common" "github.com/docker/docker/api/types/network" "github.com/docker/docker/api/types/system" - "github.com/pkg/errors" ) // ImageExistsLocally returns a boolean indicating if an image with the diff --git a/go.mod b/go.mod index 4c38b1b4..68a42e36 100644 --- a/go.mod +++ b/go.mod @@ -28,7 +28,6 @@ require ( github.com/moby/patternmatcher v0.6.0 github.com/opencontainers/image-spec v1.1.1 github.com/opencontainers/selinux v1.12.0 - github.com/pkg/errors v0.9.1 github.com/rhysd/actionlint v1.7.7 github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.9.1 @@ -82,6 +81,7 @@ require ( github.com/morikuni/aec v1.0.0 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/pjbgf/sha1cd v0.3.2 // indirect + github.com/pkg/errors v0.9.1 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/robfig/cron/v3 v3.0.1 // indirect From 04801dedd597e296340a51425f084d1a35a92454 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 29 Aug 2025 08:45:53 +0000 Subject: [PATCH 140/281] chore: unify cascade-setup-forgejo with cascade-forgejo (#919) Tested out of the wip-cascade branch: - https://code.forgejo.org/forgejo/runner/actions/runs/8746 - https://code.forgejo.org/actions/setup-forgejo/pulls/646 - https://code.forgejo.org/forgejo/end-to-end/pulls/984 ---- Instead of always running end-to-end tests, only run them when the run-end-to-end-tests label is set. They are heavy duty and should not be run when a new contributor sends their first pull request. - fix bug: close-merge is close - add instructions for debug - identify the origin of the tokens - do not needlessly run setup-forgejo integration tests - copy/paste from cascade-forgejo.yml with the following exceptions: - do not trigger on main - use run-end-to-end-test instead of run-forgejo-test - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/919): chore: unify cascade-setup-forgejo with cascade-forgejo Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/919 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/cascading-pr-setup-forgejo | 16 ---- .forgejo/cascading-setup-forgejo | 24 ++++++ .forgejo/workflows/cascade-setup-forgejo.yml | 86 ++++++++++++++++++-- renovate.json | 2 +- 4 files changed, 102 insertions(+), 26 deletions(-) delete mode 100755 .forgejo/cascading-pr-setup-forgejo create mode 100755 .forgejo/cascading-setup-forgejo diff --git a/.forgejo/cascading-pr-setup-forgejo b/.forgejo/cascading-pr-setup-forgejo deleted file mode 100755 index 06472a7b..00000000 --- a/.forgejo/cascading-pr-setup-forgejo +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash - -set -ex - -setup_forgejo=$1 -setup_forgejo_pr=$2 -runner=$3 -runner_pr=$4 - -url=$(jq --raw-output .head.repo.html_url < $runner_pr) -test "$url" != null -branch=$(jq --raw-output .head.ref < $runner_pr) -test "$branch" != null -cd $setup_forgejo -./utils/upgrade-runner.sh $url @$branch -date > last-upgrade diff --git a/.forgejo/cascading-setup-forgejo b/.forgejo/cascading-setup-forgejo new file mode 100755 index 00000000..4f386639 --- /dev/null +++ b/.forgejo/cascading-setup-forgejo @@ -0,0 +1,24 @@ +#!/bin/bash + +set -ex + +setup_forgejo=$1 +setup_forgejo_pr=$2 +runner=$3 +runner_pr_or_ref=$4 + +if test -f "$runner_pr_or_ref"; then + url=$(jq --raw-output .head.repo.html_url <$runner_pr) + test "$url" != null + branch=$(jq --raw-output .head.ref <$runner_pr) +else + url=https://code.forgejo.org/forgejo/runner + branch=${runner_pr_or_ref#refs/heads/} +fi +test "$url" +test "$branch" +test "$branch" != null +cd $setup_forgejo +./utils/upgrade-runner.sh $url @$branch +rm -f .forgejo/workflows/integration*.yml +date >last-upgrade diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml index bd3684ba..fff2309f 100644 --- a/.forgejo/workflows/cascade-setup-forgejo.yml +++ b/.forgejo/workflows/cascade-setup-forgejo.yml @@ -1,31 +1,99 @@ +# Copyright 2025 The Forgejo Authors # SPDX-License-Identifier: MIT +# +# CASCADING_PR_ORIGIN is a token from the https://code.forgejo.org/cascading-pr user +# with scope write:issue read:repository read:user +# CASCADING_PR_DESTINATION is a token from the https://code.forgejo.org/cascading-pr user +# with scope write:issue write:repository read:user +# +# To modify this workflow: +# +# - push it to the wip-cascade branch on the repository +# otherwise it will not have access to the secrets required to push +# the cascading PR +# +# - once it works, open a pull request for the sake of keeping track +# of the change even if the PR won't run it because it will use +# whatever is in the default branch instead +# +# - after it is merged, double check it works by setting the +# label on a pull request (any pull request will do) +# +name: cascade + on: + push: + branches: + - 'wip-cascade' pull_request_target: types: - - opened - synchronize + - labeled - closed enable-email-notifications: true jobs: - cascade: + debug: + if: > + vars.DEBUG == 'yes' + runs-on: docker + container: + image: data.forgejo.org/oci/node:22-bookworm + steps: + - name: event + run: | + cat <<'EOF' + ${{ toJSON(forge.event.pull_request.labels.*.name) }} + EOF + cat <<'EOF' + push => ${{ forge.event_name == 'push' && ( forge.ref_name == 'wip-cascade') }} + pull_request_target synchornized => ${{ ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) }} + pull_request_target label_updated => ${{ ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-end-to-end-tests' ) }} + contains => ${{ contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') }} + contains boolean => ${{ contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') == true }} + EOF + cat <<'EOF' + ${{ toJSON(forge) }} + EOF + + end-to-end: + # + # Always run when a commit is pushed to the wip-cascade branch + # If this is a pull request, run + # - when the `run-end-to-end-tests` label is set (label_updated) (but not if another label is set or if a label is removed) + # - when a new commit is pushed to the pull request (synchronized) if the `run-end-to-end-tests` is already present + # - when the pull request is closed, which also happens when it is merged, so that the setup-forgejo & end-to-end pull requests are closed + # + if: > + vars.ROLE == 'forgejo-coding' && ( + ( + forge.event_name == 'push' && ( forge.ref_name == 'wip-cascade' ) + ) || ( + forge.event_name == 'pull_request_target' && ( + forge.event.action == 'closed' || + ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) || + ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-end-to-end-tests' ) + ) + ) + ) runs-on: docker container: image: 'code.forgejo.org/oci/node:22-bookworm' - if: > - ! contains(forge.event.pull_request.title, '[skip cascade]') steps: - uses: https://code.forgejo.org/actions/cascading-pr@v2.2.1 with: - origin-url: ${{ env.FORGEJO_SERVER_URL }} - origin-repo: forgejo/runner + origin-url: ${{ forge.server_url }} + origin-repo: ${{ forge.repository }} origin-token: ${{ secrets.CASCADING_PR_ORIGIN }} origin-pr: ${{ forge.event.pull_request.number }} - destination-url: ${{ env.FORGEJO_SERVER_URL }} + origin-ref: ${{ forge.event_name == 'push' && forge.event.ref || '' }} + destination-url: ${{ forge.server_url }} destination-repo: actions/setup-forgejo destination-fork-repo: cascading-pr/setup-forgejo destination-branch: main destination-token: ${{ secrets.CASCADING_PR_DESTINATION }} - close-merge: true - update: .forgejo/cascading-pr-setup-forgejo + close: true + verbose: ${{ vars.VERBOSE == 'yes' }} + debug: ${{ vars.DEBUG == 'yes' }} + update: .forgejo/cascading-setup-forgejo diff --git a/renovate.json b/renovate.json index 96bdfbdc..60cdc25f 100644 --- a/renovate.json +++ b/renovate.json @@ -9,6 +9,6 @@ "separateMinorPatch": true } ], - "labels": ["Kind/Chore"], + "labels": ["Kind/Chore", "run-end-to-end-tests"], "ignorePaths": ["**/testdata/**", "**/node_modules/**"] } From 4bb2daca9d8b2fbe4a57f754fcf353585ca78d99 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 29 Aug 2025 11:17:40 +0200 Subject: [PATCH 141/281] chore: unify cascade-setup-forgejo with cascade-forgejo (take 2) --- .forgejo/cascading-setup-forgejo | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/cascading-setup-forgejo b/.forgejo/cascading-setup-forgejo index 4f386639..1fc70ed9 100755 --- a/.forgejo/cascading-setup-forgejo +++ b/.forgejo/cascading-setup-forgejo @@ -8,9 +8,9 @@ runner=$3 runner_pr_or_ref=$4 if test -f "$runner_pr_or_ref"; then - url=$(jq --raw-output .head.repo.html_url <$runner_pr) + url=$(jq --raw-output .head.repo.html_url <$runner_pr_or_ref) test "$url" != null - branch=$(jq --raw-output .head.ref <$runner_pr) + branch=$(jq --raw-output .head.ref <$runner_pr_or_ref) else url=https://code.forgejo.org/forgejo/runner branch=${runner_pr_or_ref#refs/heads/} From 583adee7804faf9f38bec338299226facb72e376 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 29 Aug 2025 12:38:25 +0000 Subject: [PATCH 142/281] chore: add reminder of how to run a local test (#917) So that it can be copy/pasted. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/917): chore: add reminder of how to run a local test Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/917 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index f21e6a7d..d01f6e11 100644 --- a/README.md +++ b/README.md @@ -47,6 +47,13 @@ The [workflow](.forgejo/workflows/test.yml) that runs in the CI uses similar com - Install [Docker](https://docs.docker.com/engine/install/) - `make test integration-test` +The `TestRunner_RunEvent` test suite contains most integration tests +with real-world workflows and is time-consuming to run. During +development, it is helpful to run a specific test through a targeted +command such as this: + +- `go test -count=1 -run='TestRunner_RunEvent$/local-action-dockerfile$' ./act/runner` + ### With a Forgejo instance - Run a Forgejo instance locally (for instance at http://0.0.0.0:8080) and create as shared secret From d29cba2946b1d81090856ece27667cec3be6a270 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 1 Sep 2025 11:32:19 +0000 Subject: [PATCH 143/281] chore: explain the difference between `job_level` and `level` (#922) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/922): chore: explain the difference between `job_level` and `level` Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/922 Reviewed-by: msrd0 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/config/config.example.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index ec12a8a1..14decb32 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -3,10 +3,19 @@ # You don't have to copy this file to your instance, # just run `forgejo-runner generate-config > config.yaml` to generate a config file. +# +# The value of level or job_level can be trace, debug, info, warn, error or fatal +# log: - # The level of logging, can be trace, debug, info, warn, error, fatal + # + # What is displayed in the output of the runner process but not sent + # to the Forgejo instance. + # level: info - # The level of logging for jobs, can be trace, debug, info, earn, error, fatal + # + # What is sent to the Forgejo instance and therefore + # visible in the web UI for a given job. + # job_level: info runner: From 7efe25f13de216f68e6e94c40dbec3e55373d7d5 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 28 Aug 2025 16:58:49 +0200 Subject: [PATCH 144/281] chore: local action name collision regression tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If the tag name collide (e.g. v9.1.1), it will fail with: ``` [push.yml/test] [DEBUG] Working directory '/home/earl-warren/software/runner/act/runner/testdata/local-action-dockerfile-tag/example2' [push.yml/test] ❌ Failure - Main [[ "example1 SOMEONE" == "example2 SOMEONE" ]] ``` --- act/runner/runner_test.go | 2 ++ .../testdata/local-action-dockerfile-tag/README.txt | 4 ++++ .../example1/actions/docker-local/Dockerfile | 8 ++++++++ .../example1/actions/docker-local/action.yml | 12 ++++++++++++ .../example1/actions/docker-local/entrypoint.sh | 3 +++ .../local-action-dockerfile-example1/push.yml | 11 +++++++++++ .../example2/actions/docker-local/Dockerfile | 8 ++++++++ .../example2/actions/docker-local/action.yml | 12 ++++++++++++ .../example2/actions/docker-local/entrypoint.sh | 3 +++ .../local-action-dockerfile-example2/push.yml | 11 +++++++++++ 10 files changed, 74 insertions(+) create mode 100644 act/runner/testdata/local-action-dockerfile-tag/README.txt create mode 100644 act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/Dockerfile create mode 100644 act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/action.yml create mode 100755 act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/entrypoint.sh create mode 100644 act/runner/testdata/local-action-dockerfile-tag/example1/local-action-dockerfile-example1/push.yml create mode 100644 act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/Dockerfile create mode 100644 act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/action.yml create mode 100755 act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/entrypoint.sh create mode 100644 act/runner/testdata/local-action-dockerfile-tag/example2/local-action-dockerfile-example2/push.yml diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 83523c1e..7f3b46e9 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -245,6 +245,8 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "local-action-fails-schema-validation", "push", "Job 'test' failed", platforms, secrets}, {workdir, "local-action-docker-url", "push", "", platforms, secrets}, {workdir, "local-action-dockerfile", "push", "", platforms, secrets}, + {workdir + "/local-action-dockerfile-tag/example1", "local-action-dockerfile-example1", "push", "", platforms, secrets}, + {workdir + "/local-action-dockerfile-tag/example2", "local-action-dockerfile-example2", "push", "", platforms, secrets}, {workdir, "local-action-via-composite-dockerfile", "push", "", platforms, secrets}, {workdir, "local-action-js", "push", "", platforms, secrets}, diff --git a/act/runner/testdata/local-action-dockerfile-tag/README.txt b/act/runner/testdata/local-action-dockerfile-tag/README.txt new file mode 100644 index 00000000..aba97f3b --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/README.txt @@ -0,0 +1,4 @@ +example1 and example2 eacho use a local actions that have the same +path (actions/docker-local) but do not behave the same. This verifies +that the locally built images have different names and do not collide +despite both being called with `uses: ./actions/docker-local. diff --git a/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/Dockerfile b/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/Dockerfile new file mode 100644 index 00000000..b8054873 --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/Dockerfile @@ -0,0 +1,8 @@ +# Container image that runs your code +FROM code.forgejo.org/oci/alpine:latest + +# Copies your code file from your action repository to the filesystem path `/` of the container +COPY entrypoint.sh /entrypoint.sh + +# Code file to execute when the docker container starts up (`entrypoint.sh`) +ENTRYPOINT ["/entrypoint.sh"] diff --git a/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/action.yml b/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/action.yml new file mode 100644 index 00000000..a6b97460 --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/action.yml @@ -0,0 +1,12 @@ +inputs: + who-to-greet: +outputs: + whoami: + description: 'The time we greeted you' +runs: + using: 'docker' + image: 'Dockerfile' + env: + WHOAMI: ${{ inputs.who-to-greet }} + args: + - ${{ inputs.who-to-greet }} diff --git a/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/entrypoint.sh b/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/entrypoint.sh new file mode 100755 index 00000000..7047838a --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/entrypoint.sh @@ -0,0 +1,3 @@ +#!/bin/sh + +echo ::set-output "name=whoami::example1 $WHOAMI" diff --git a/act/runner/testdata/local-action-dockerfile-tag/example1/local-action-dockerfile-example1/push.yml b/act/runner/testdata/local-action-dockerfile-tag/example1/local-action-dockerfile-example1/push.yml new file mode 100644 index 00000000..fd24e76e --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example1/local-action-dockerfile-example1/push.yml @@ -0,0 +1,11 @@ +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: ./actions/docker-local + id: dockerlocal + with: + who-to-greet: 'SOMEONE' + - run: '[[ "${{ steps.dockerlocal.outputs.whoami }}" == "example1 SOMEONE" ]]' diff --git a/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/Dockerfile b/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/Dockerfile new file mode 100644 index 00000000..b8054873 --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/Dockerfile @@ -0,0 +1,8 @@ +# Container image that runs your code +FROM code.forgejo.org/oci/alpine:latest + +# Copies your code file from your action repository to the filesystem path `/` of the container +COPY entrypoint.sh /entrypoint.sh + +# Code file to execute when the docker container starts up (`entrypoint.sh`) +ENTRYPOINT ["/entrypoint.sh"] diff --git a/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/action.yml b/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/action.yml new file mode 100644 index 00000000..a6b97460 --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/action.yml @@ -0,0 +1,12 @@ +inputs: + who-to-greet: +outputs: + whoami: + description: 'The time we greeted you' +runs: + using: 'docker' + image: 'Dockerfile' + env: + WHOAMI: ${{ inputs.who-to-greet }} + args: + - ${{ inputs.who-to-greet }} diff --git a/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/entrypoint.sh b/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/entrypoint.sh new file mode 100755 index 00000000..c6750948 --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example2/actions/docker-local/entrypoint.sh @@ -0,0 +1,3 @@ +#!/bin/sh + +echo ::set-output "name=whoami::example2 $WHOAMI" diff --git a/act/runner/testdata/local-action-dockerfile-tag/example2/local-action-dockerfile-example2/push.yml b/act/runner/testdata/local-action-dockerfile-tag/example2/local-action-dockerfile-example2/push.yml new file mode 100644 index 00000000..b6f39f47 --- /dev/null +++ b/act/runner/testdata/local-action-dockerfile-tag/example2/local-action-dockerfile-example2/push.yml @@ -0,0 +1,11 @@ +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: ./actions/docker-local + id: dockerlocal + with: + who-to-greet: 'SOMEONE' + - run: '[[ "${{ steps.dockerlocal.outputs.whoami }}" == "example2 SOMEONE" ]]' From 11a96bb46274b2cadda71f5d4c901e6e111e1dbf Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 28 Aug 2025 10:17:00 +0200 Subject: [PATCH 145/281] fix(security): ensure unique names for container images created by actions Container images built by the runner are tagged with a unique name: - based on the specified `uses` URL for remote actions. - random for local actions. In the case of local actions, this will create new tags for each run but the images (and their layers) will be shared and not be duplicated. The least recently used tags can be garbage collected by tools such as https://github.com/stepchowfun/docuum. Using a different method for creating the tag name for the remote actions is to help with maintenance by establishing a direct relation with the `uses` field. It was instead relying on a name transformed multiple times which makes it more difficult to verify name collision are not accidentally made possible by one of those transformations. Without this fix, when a workflow ran a local [docker action](https://forgejo.org/docs/next/user/actions/actions/#docker-actions) (e.g. the [example in the end-to-end tests](https://code.forgejo.org/forgejo/end-to-end/src/commit/8f920b4b7adcb920e435db1acd02407b2312ab74/actions/example-force-rebuild/.forgejo/workflows/test.yml)), it used an image tag that could collide with other workflows that happen to use the same name. The workaround for older runner versions is to set [`[container].force_rebuild: true`](https://forgejo.org/docs/next/admin/actions/runner-installation/#configuration) in the runner configuration file. --- act/runner/action.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/act/runner/action.go b/act/runner/action.go index fdfc6373..d27f0a84 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -277,7 +277,6 @@ func removeGitIgnore(ctx context.Context, directory string) error { return nil } -// TODO: break out parts of function to reduce complexicity func execAsDocker(ctx context.Context, step actionStep, actionName, basedir string, localAction bool) error { logger := common.Logger(ctx) rc := step.getRunContext() @@ -291,10 +290,11 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, basedir stri // Apply forcePull only for prebuild docker images forcePull = rc.Config.ForcePull } else { - // "-dockeraction" enshures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names - image = fmt.Sprintf("%s-dockeraction:%s", regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(actionName, "-"), "latest") - image = fmt.Sprintf("act-%s", strings.TrimLeft(image, "-")) - image = strings.ToLower(image) + if localAction { + image = fmt.Sprintf("runner-local-docker-action-%s:latest", common.MustRandName(16)) + } else { + image = fmt.Sprintf("runner-remote-docker-action-%s:latest", common.Sha256(step.getStepModel().Uses)) + } contextDir, fileName := filepath.Split(filepath.Join(basedir, action.Runs.Image)) anyArchExists, err := container.ImageExistsLocally(ctx, image, "any") From da7ef7c2a19cb4e94a9323eefe54c7a723a0aaaa Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 15 Aug 2025 20:26:35 -0600 Subject: [PATCH 146/281] fix: PRs cache artifacts separate from other runs --- act/artifactcache/handler.go | 29 +++++++++++++++++++++++++++-- act/artifactcache/model.go | 17 +++++++++-------- act/cacheproxy/handler.go | 7 ++++++- internal/app/run/runner.go | 17 ++++++++++++++++- 4 files changed, 58 insertions(+), 12 deletions(-) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 0f78be85..8b8572ee 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -181,11 +181,19 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request, params httprouter } defer db.Close() - cache, err := findCache(db, repo, keys, version) + cache, err := findCache(db, repo, keys, version, rundata.WriteIsolationKey) if err != nil { h.responseJSON(w, r, 500, err) return } + // If read was scoped to WriteIsolationKey and didn't find anything, we can fallback to the non-isolated cache read + if cache == nil && rundata.WriteIsolationKey != "" { + cache, err = findCache(db, repo, keys, version, "") + if err != nil { + h.responseJSON(w, r, 500, err) + return + } + } if cache == nil { h.responseJSON(w, r, 204) return @@ -236,6 +244,7 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, params httprou cache.CreatedAt = now cache.UsedAt = now cache.Repo = repo + cache.WriteIsolationKey = rundata.WriteIsolationKey if err := insertCache(db, cache); err != nil { h.responseJSON(w, r, 500, err) return @@ -275,6 +284,10 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprout h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) return } + if cache.WriteIsolationKey != rundata.WriteIsolationKey { + h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey)) + return + } if cache.Complete { h.responseJSON(w, r, 400, fmt.Errorf("cache %v %q: already complete", cache.ID, cache.Key)) @@ -326,6 +339,10 @@ func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprout h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) return } + if cache.WriteIsolationKey != rundata.WriteIsolationKey { + h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey)) + return + } if cache.Complete { h.responseJSON(w, r, 400, fmt.Errorf("cache %v %q: already complete", cache.ID, cache.Key)) @@ -386,6 +403,11 @@ func (h *Handler) get(w http.ResponseWriter, r *http.Request, params httprouter. h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) return } + // reads permitted against caches w/ the same isolation key, or no isolation key + if cache.WriteIsolationKey != rundata.WriteIsolationKey && cache.WriteIsolationKey != "" { + h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey)) + return + } if err := h.useCache(id); err != nil { h.responseJSON(w, r, 500, fmt.Errorf("cache useCache: %w", err)) @@ -417,7 +439,7 @@ func (h *Handler) middleware(handler httprouter.Handle) httprouter.Handle { } // if not found, return (nil, nil) instead of an error. -func findCache(db *bolthold.Store, repo string, keys []string, version string) (*Cache, error) { +func findCache(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { cache := &Cache{} for _, prefix := range keys { // if a key in the list matches exactly, don't return partial matches @@ -425,6 +447,7 @@ func findCache(db *bolthold.Store, repo string, keys []string, version string) ( bolthold.Where("Repo").Eq(repo).Index("Repo"). And("Key").Eq(prefix). And("Version").Eq(version). + And("WriteIsolationKey").Eq(writeIsolationKey). And("Complete").Eq(true). SortBy("CreatedAt").Reverse()); err == nil || !errors.Is(err, bolthold.ErrNotFound) { if err != nil { @@ -441,6 +464,7 @@ func findCache(db *bolthold.Store, repo string, keys []string, version string) ( bolthold.Where("Repo").Eq(repo).Index("Repo"). And("Key").RegExp(re). And("Version").Eq(version). + And("WriteIsolationKey").Eq(writeIsolationKey). And("Complete").Eq(true). SortBy("CreatedAt").Reverse()); err != nil { if errors.Is(err, bolthold.ErrNotFound) { @@ -644,5 +668,6 @@ func runDataFromHeaders(r *http.Request) cacheproxy.RunData { RunNumber: r.Header.Get("Forgejo-Cache-RunNumber"), Timestamp: r.Header.Get("Forgejo-Cache-Timestamp"), RepositoryMAC: r.Header.Get("Forgejo-Cache-MAC"), + WriteIsolationKey: r.Header.Get("Forgejo-Cache-WriteIsolationKey"), } } diff --git a/act/artifactcache/model.go b/act/artifactcache/model.go index b27fd8ed..cb1af860 100644 --- a/act/artifactcache/model.go +++ b/act/artifactcache/model.go @@ -24,12 +24,13 @@ func (c *Request) ToCache() *Cache { } type Cache struct { - ID uint64 `json:"id" boltholdKey:"ID"` - Repo string `json:"repo" boltholdIndex:"Repo"` - Key string `json:"key"` - Version string `json:"version"` - Size int64 `json:"cacheSize"` - Complete bool `json:"complete"` - UsedAt int64 `json:"usedAt"` - CreatedAt int64 `json:"createdAt"` + ID uint64 `json:"id" boltholdKey:"ID"` + Repo string `json:"repo" boltholdIndex:"Repo"` + Key string `json:"key"` + Version string `json:"version"` + Size int64 `json:"cacheSize"` + Complete bool `json:"complete"` + UsedAt int64 `json:"usedAt"` + CreatedAt int64 `json:"createdAt"` + WriteIsolationKey string `json:"writeIsolationKey"` } diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 56b083a6..a2d76527 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -51,15 +51,17 @@ type RunData struct { RunNumber string Timestamp string RepositoryMAC string + WriteIsolationKey string } -func (h *Handler) CreateRunData(fullName, runNumber, timestamp string) RunData { +func (h *Handler) CreateRunData(fullName, runNumber, timestamp, writeIsolationKey string) RunData { mac := computeMac(h.cacheSecret, fullName, runNumber, timestamp) return RunData{ RepositoryFullName: fullName, RunNumber: runNumber, Timestamp: timestamp, RepositoryMAC: mac, + WriteIsolationKey: writeIsolationKey, } } @@ -152,6 +154,9 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er r.Out.Header.Set("Forgejo-Cache-Timestamp", runData.Timestamp) r.Out.Header.Set("Forgejo-Cache-MAC", runData.RepositoryMAC) r.Out.Header.Set("Forgejo-Cache-Host", h.ExternalURL()) + if runData.WriteIsolationKey != "" { + r.Out.Header.Set("Forgejo-Cache-WriteIsolationKey", runData.WriteIsolationKey) + } }, } return proxy, nil diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index b2fcf4fc..86cddd1a 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -265,8 +265,23 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. // Register the run with the cacheproxy and modify the CACHE_URL if r.cacheProxy != nil { + writeIsolationKey := "" + + // When performing an action on an event from a PR, provide a "write isolation key" to the cache. The generated + // ACTIONS_CACHE_URL will be able to read the cache, and write to a cache, but its writes will be isolated to + // future runs of the PR's workflows and won't be shared with other pull requests or actions. This is a security + // measure to prevent a malicious pull request from poisoning the cache with secret-stealing code which would + // later be executed on another action. + if taskContext["event_name"].GetStringValue() == "pull_request" || taskContext["event_name"].GetStringValue() == "pull_request_target" { + // Ensure that `Ref` has the expected format so that we don't end up with a useless write isolation key + if !strings.HasPrefix(preset.Ref, "refs/pull/") { + return fmt.Errorf("write isolation key: expected preset.Ref to be refs/pull/..., but was %q", preset.Ref) + } + writeIsolationKey = preset.Ref + } + timestamp := strconv.FormatInt(time.Now().Unix(), 10) - cacheRunData := r.cacheProxy.CreateRunData(preset.Repository, preset.RunID, timestamp) + cacheRunData := r.cacheProxy.CreateRunData(preset.Repository, preset.RunID, timestamp, writeIsolationKey) cacheRunID, err := r.cacheProxy.AddRun(cacheRunData) if err == nil { defer func() { _ = r.cacheProxy.RemoveRun(cacheRunID) }() From 6c35ea4fd92288e142158e5955c66ac444f6e679 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sat, 16 Aug 2025 19:26:30 -0600 Subject: [PATCH 147/281] add unit tests for all changes in artifactcache --- act/artifactcache/handler_test.go | 236 ++++++++++++++++++++++++++++-- 1 file changed, 227 insertions(+), 9 deletions(-) diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index b8ff6769..d078b90e 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -12,6 +12,7 @@ import ( "testing" "time" + "code.forgejo.org/forgejo/runner/v9/testutils" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/timshannon/bolthold" @@ -28,7 +29,8 @@ const ( var handlerExternalURL string type AuthHeaderTransport struct { - T http.RoundTripper + T http.RoundTripper + WriteIsolationKey string } func (t *AuthHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) { @@ -37,11 +39,14 @@ func (t *AuthHeaderTransport) RoundTrip(req *http.Request) (*http.Response, erro req.Header.Set("Forgejo-Cache-Timestamp", cacheTimestamp) req.Header.Set("Forgejo-Cache-MAC", cacheMac) req.Header.Set("Forgejo-Cache-Host", handlerExternalURL) + if t.WriteIsolationKey != "" { + req.Header.Set("Forgejo-Cache-WriteIsolationKey", t.WriteIsolationKey) + } return t.T.RoundTrip(req) } var ( - httpClientTransport = AuthHeaderTransport{http.DefaultTransport} + httpClientTransport = AuthHeaderTransport{T: http.DefaultTransport} httpClient = http.Client{Transport: &httpClientTransport} ) @@ -88,7 +93,7 @@ func TestHandler(t *testing.T) { content := make([]byte, 100) _, err := rand.Read(content) require.NoError(t, err) - uploadCacheNormally(t, base, key, version, content) + uploadCacheNormally(t, base, key, version, "", content) }) t.Run("clean", func(t *testing.T) { @@ -380,7 +385,7 @@ func TestHandler(t *testing.T) { _, err := rand.Read(content) require.NoError(t, err) - uploadCacheNormally(t, base, key, version, content) + uploadCacheNormally(t, base, key, version, "", content) // Perform the request with the custom `httpClient` which will send correct MAC data resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) @@ -416,7 +421,7 @@ func TestHandler(t *testing.T) { for i := range contents { _, err := rand.Read(contents[i]) require.NoError(t, err) - uploadCacheNormally(t, base, keys[i], version, contents[i]) + uploadCacheNormally(t, base, keys[i], version, "", contents[i]) time.Sleep(time.Second) // ensure CreatedAt of caches are different } @@ -454,13 +459,91 @@ func TestHandler(t *testing.T) { assert.Equal(t, contents[except], content) }) + t.Run("find can't match without WriteIsolationKey match", func(t *testing.T) { + defer func() { httpClientTransport.WriteIsolationKey = "" }() + + version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20" + key := strings.ToLower(t.Name()) + + uploadCacheNormally(t, base, key, version, "TestWriteKey", make([]byte, 64)) + + httpClientTransport.WriteIsolationKey = "AnotherTestWriteKey" + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 204, resp.StatusCode) + + httpClientTransport.WriteIsolationKey = "" + resp, err = httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 204, resp.StatusCode) + + httpClientTransport.WriteIsolationKey = "TestWriteKey" + resp, err = httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + }) + + t.Run("find prefers WriteIsolationKey match", func(t *testing.T) { + defer func() { httpClientTransport.WriteIsolationKey = "" }() + + version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21" + key := strings.ToLower(t.Name()) + + // Between two values with the same `key`... + uploadCacheNormally(t, base, key, version, "TestWriteKey", make([]byte, 64)) + uploadCacheNormally(t, base, key, version, "", make([]byte, 128)) + + // We should read the value with the matching WriteIsolationKey from the cache... + httpClientTransport.WriteIsolationKey = "TestWriteKey" + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + + got := struct { + ArchiveLocation string `json:"archiveLocation"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + contentResp, err := httpClient.Get(got.ArchiveLocation) + require.NoError(t, err) + require.Equal(t, 200, contentResp.StatusCode) + content, err := io.ReadAll(contentResp.Body) + require.NoError(t, err) + // Which we finally check matches the correct WriteIsolationKey's content here. + assert.Equal(t, make([]byte, 64), content) + }) + + t.Run("find falls back if matching WriteIsolationKey not available", func(t *testing.T) { + defer func() { httpClientTransport.WriteIsolationKey = "" }() + + version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21" + key := strings.ToLower(t.Name()) + + uploadCacheNormally(t, base, key, version, "", make([]byte, 128)) + + httpClientTransport.WriteIsolationKey = "TestWriteKey" + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + + got := struct { + ArchiveLocation string `json:"archiveLocation"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + contentResp, err := httpClient.Get(got.ArchiveLocation) + require.NoError(t, err) + require.Equal(t, 200, contentResp.StatusCode) + content, err := io.ReadAll(contentResp.Body) + require.NoError(t, err) + assert.Equal(t, make([]byte, 128), content) + }) + t.Run("case insensitive", func(t *testing.T) { version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20" key := strings.ToLower(t.Name()) content := make([]byte, 100) _, err := rand.Read(content) require.NoError(t, err) - uploadCacheNormally(t, base, key+"_ABC", version, content) + uploadCacheNormally(t, base, key+"_ABC", version, "", content) { reqKey := key + "_aBc" @@ -494,7 +577,7 @@ func TestHandler(t *testing.T) { for i := range contents { _, err := rand.Read(contents[i]) require.NoError(t, err) - uploadCacheNormally(t, base, keys[i], version, contents[i]) + uploadCacheNormally(t, base, keys[i], version, "", contents[i]) time.Sleep(time.Second) // ensure CreatedAt of caches are different } @@ -545,7 +628,7 @@ func TestHandler(t *testing.T) { for i := range contents { _, err := rand.Read(contents[i]) require.NoError(t, err) - uploadCacheNormally(t, base, keys[i], version, contents[i]) + uploadCacheNormally(t, base, keys[i], version, "", contents[i]) time.Sleep(time.Second) // ensure CreatedAt of caches are different } @@ -581,9 +664,144 @@ func TestHandler(t *testing.T) { require.NoError(t, err) assert.Equal(t, contents[expect], content) }) + + t.Run("upload across WriteIsolationKey", func(t *testing.T) { + defer testutils.MockVariable(&httpClientTransport.WriteIsolationKey, "CorrectKey")() + + key := strings.ToLower(t.Name()) + version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20" + content := make([]byte, 256) + + var id uint64 + // reserve + { + body, err := json.Marshal(&Request{ + Key: key, + Version: version, + Size: int64(len(content)), + }) + require.NoError(t, err) + resp, err := httpClient.Post(fmt.Sprintf("%s/caches", base), "application/json", bytes.NewReader(body)) + require.NoError(t, err) + assert.Equal(t, 200, resp.StatusCode) + + got := struct { + CacheID uint64 `json:"cacheId"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + id = got.CacheID + } + // upload, but with the incorrect write isolation key relative to the cache obj created + { + httpClientTransport.WriteIsolationKey = "WrongKey" + req, err := http.NewRequest(http.MethodPatch, + fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader(content)) + require.NoError(t, err) + req.Header.Set("Content-Type", "application/octet-stream") + req.Header.Set("Content-Range", "bytes 0-99/*") + resp, err := httpClient.Do(req) + require.NoError(t, err) + assert.Equal(t, 403, resp.StatusCode) + } + }) + + t.Run("commit across WriteIsolationKey", func(t *testing.T) { + defer testutils.MockVariable(&httpClientTransport.WriteIsolationKey, "CorrectKey")() + + key := strings.ToLower(t.Name()) + version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20" + content := make([]byte, 256) + + var id uint64 + // reserve + { + body, err := json.Marshal(&Request{ + Key: key, + Version: version, + Size: int64(len(content)), + }) + require.NoError(t, err) + resp, err := httpClient.Post(fmt.Sprintf("%s/caches", base), "application/json", bytes.NewReader(body)) + require.NoError(t, err) + assert.Equal(t, 200, resp.StatusCode) + + got := struct { + CacheID uint64 `json:"cacheId"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + id = got.CacheID + } + // upload + { + req, err := http.NewRequest(http.MethodPatch, + fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader(content)) + require.NoError(t, err) + req.Header.Set("Content-Type", "application/octet-stream") + req.Header.Set("Content-Range", "bytes 0-99/*") + resp, err := httpClient.Do(req) + require.NoError(t, err) + assert.Equal(t, 200, resp.StatusCode) + } + // commit, but with the incorrect write isolation key relative to the cache obj created + { + httpClientTransport.WriteIsolationKey = "WrongKey" + resp, err := httpClient.Post(fmt.Sprintf("%s/caches/%d", base, id), "", nil) + require.NoError(t, err) + assert.Equal(t, 403, resp.StatusCode) + } + }) + + t.Run("get across WriteIsolationKey", func(t *testing.T) { + defer func() { httpClientTransport.WriteIsolationKey = "" }() + + version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21" + key := strings.ToLower(t.Name()) + uploadCacheNormally(t, base, key, version, "", make([]byte, 128)) + keyIsolated := strings.ToLower(t.Name()) + "_isolated" + uploadCacheNormally(t, base, keyIsolated, version, "CorrectKey", make([]byte, 128)) + + // Perform the 'get' without the right WriteIsolationKey for the cache entry... should be OK for `key` since it + // was written with WriteIsolationKey "" meaning it is available for non-isolated access + { + httpClientTransport.WriteIsolationKey = "WhoopsWrongKey" + + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + got := struct { + ArchiveLocation string `json:"archiveLocation"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + + contentResp, err := httpClient.Get(got.ArchiveLocation) + require.NoError(t, err) + require.Equal(t, 200, contentResp.StatusCode) + httpClientTransport.WriteIsolationKey = "CorrectKey" // reset for next find + } + + // Perform the 'get' without the right WriteIsolationKey for the cache entry... should be 403 for `keyIsolated` + // because it was written with a different WriteIsolationKey. + { + httpClientTransport.WriteIsolationKey = "CorrectKey" // for test purposes make the `find` successful... + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, keyIsolated, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + got := struct { + ArchiveLocation string `json:"archiveLocation"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + + httpClientTransport.WriteIsolationKey = "WhoopsWrongKey" // but then access w/ the wrong key for `get` + contentResp, err := httpClient.Get(got.ArchiveLocation) + require.NoError(t, err) + require.Equal(t, 403, contentResp.StatusCode) + } + }) } -func uploadCacheNormally(t *testing.T, base, key, version string, content []byte) { +func uploadCacheNormally(t *testing.T, base, key, version, writeIsolationKey string, content []byte) { + defer testutils.MockVariable(&httpClientTransport.WriteIsolationKey, writeIsolationKey)() + var id uint64 { body, err := json.Marshal(&Request{ From 4bd93294d4fea8102ccf2b9e4e0c3a84fdabff7f Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 19 Aug 2025 11:18:32 -0600 Subject: [PATCH 148/281] add WriteIsolationKey to MAC --- act/artifactcache/handler_test.go | 179 ++++++++++++++++++------------ act/artifactcache/mac.go | 6 +- act/artifactcache/mac_test.go | 13 ++- act/cacheproxy/handler.go | 6 +- 4 files changed, 122 insertions(+), 82 deletions(-) diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index d078b90e..1d813d56 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -12,7 +12,6 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/v9/testutils" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/timshannon/bolthold" @@ -23,21 +22,26 @@ const ( cacheRepo = "testuser/repo" cacheRunnum = "1" cacheTimestamp = "0" - cacheMac = "c13854dd1ac599d1d61680cd93c26b77ba0ee10f374a3408bcaea82f38ca1865" + cacheMac = "bc2e9167f9e310baebcead390937264e4c0b21d2fdd49f5b9470d54406099360" ) var handlerExternalURL string type AuthHeaderTransport struct { - T http.RoundTripper - WriteIsolationKey string + T http.RoundTripper + WriteIsolationKey string + OverrideDefaultMac string } func (t *AuthHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) { req.Header.Set("Forgejo-Cache-Repo", cacheRepo) req.Header.Set("Forgejo-Cache-RunNumber", cacheRunnum) req.Header.Set("Forgejo-Cache-Timestamp", cacheTimestamp) - req.Header.Set("Forgejo-Cache-MAC", cacheMac) + if t.OverrideDefaultMac != "" { + req.Header.Set("Forgejo-Cache-MAC", t.OverrideDefaultMac) + } else { + req.Header.Set("Forgejo-Cache-MAC", cacheMac) + } req.Header.Set("Forgejo-Cache-Host", handlerExternalURL) if t.WriteIsolationKey != "" { req.Header.Set("Forgejo-Cache-WriteIsolationKey", t.WriteIsolationKey) @@ -467,25 +471,28 @@ func TestHandler(t *testing.T) { uploadCacheNormally(t, base, key, version, "TestWriteKey", make([]byte, 64)) - httpClientTransport.WriteIsolationKey = "AnotherTestWriteKey" - resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) - require.NoError(t, err) - require.Equal(t, 204, resp.StatusCode) + func() { + defer overrideWriteIsolationKey("AnotherTestWriteKey")() + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 204, resp.StatusCode) + }() - httpClientTransport.WriteIsolationKey = "" - resp, err = httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) - require.NoError(t, err) - require.Equal(t, 204, resp.StatusCode) + { + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 204, resp.StatusCode) + } - httpClientTransport.WriteIsolationKey = "TestWriteKey" - resp, err = httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) - require.NoError(t, err) - require.Equal(t, 200, resp.StatusCode) + func() { + defer overrideWriteIsolationKey("TestWriteKey")() + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + }() }) t.Run("find prefers WriteIsolationKey match", func(t *testing.T) { - defer func() { httpClientTransport.WriteIsolationKey = "" }() - version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21" key := strings.ToLower(t.Name()) @@ -494,47 +501,51 @@ func TestHandler(t *testing.T) { uploadCacheNormally(t, base, key, version, "", make([]byte, 128)) // We should read the value with the matching WriteIsolationKey from the cache... - httpClientTransport.WriteIsolationKey = "TestWriteKey" - resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) - require.NoError(t, err) - require.Equal(t, 200, resp.StatusCode) + func() { + defer overrideWriteIsolationKey("TestWriteKey")() - got := struct { - ArchiveLocation string `json:"archiveLocation"` - }{} - require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) - contentResp, err := httpClient.Get(got.ArchiveLocation) - require.NoError(t, err) - require.Equal(t, 200, contentResp.StatusCode) - content, err := io.ReadAll(contentResp.Body) - require.NoError(t, err) - // Which we finally check matches the correct WriteIsolationKey's content here. - assert.Equal(t, make([]byte, 64), content) + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + + got := struct { + ArchiveLocation string `json:"archiveLocation"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + contentResp, err := httpClient.Get(got.ArchiveLocation) + require.NoError(t, err) + require.Equal(t, 200, contentResp.StatusCode) + content, err := io.ReadAll(contentResp.Body) + require.NoError(t, err) + // Which we finally check matches the correct WriteIsolationKey's content here. + assert.Equal(t, make([]byte, 64), content) + }() }) t.Run("find falls back if matching WriteIsolationKey not available", func(t *testing.T) { - defer func() { httpClientTransport.WriteIsolationKey = "" }() - version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21" key := strings.ToLower(t.Name()) uploadCacheNormally(t, base, key, version, "", make([]byte, 128)) - httpClientTransport.WriteIsolationKey = "TestWriteKey" - resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) - require.NoError(t, err) - require.Equal(t, 200, resp.StatusCode) + func() { + defer overrideWriteIsolationKey("TestWriteKey")() - got := struct { - ArchiveLocation string `json:"archiveLocation"` - }{} - require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) - contentResp, err := httpClient.Get(got.ArchiveLocation) - require.NoError(t, err) - require.Equal(t, 200, contentResp.StatusCode) - content, err := io.ReadAll(contentResp.Body) - require.NoError(t, err) - assert.Equal(t, make([]byte, 128), content) + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + + got := struct { + ArchiveLocation string `json:"archiveLocation"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + contentResp, err := httpClient.Get(got.ArchiveLocation) + require.NoError(t, err) + require.Equal(t, 200, contentResp.StatusCode) + content, err := io.ReadAll(contentResp.Body) + require.NoError(t, err) + assert.Equal(t, make([]byte, 128), content) + }() }) t.Run("case insensitive", func(t *testing.T) { @@ -666,7 +677,7 @@ func TestHandler(t *testing.T) { }) t.Run("upload across WriteIsolationKey", func(t *testing.T) { - defer testutils.MockVariable(&httpClientTransport.WriteIsolationKey, "CorrectKey")() + defer overrideWriteIsolationKey("CorrectKey")() key := strings.ToLower(t.Name()) version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20" @@ -692,8 +703,8 @@ func TestHandler(t *testing.T) { id = got.CacheID } // upload, but with the incorrect write isolation key relative to the cache obj created - { - httpClientTransport.WriteIsolationKey = "WrongKey" + func() { + defer overrideWriteIsolationKey("WrongKey")() req, err := http.NewRequest(http.MethodPatch, fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader(content)) require.NoError(t, err) @@ -702,11 +713,11 @@ func TestHandler(t *testing.T) { resp, err := httpClient.Do(req) require.NoError(t, err) assert.Equal(t, 403, resp.StatusCode) - } + }() }) t.Run("commit across WriteIsolationKey", func(t *testing.T) { - defer testutils.MockVariable(&httpClientTransport.WriteIsolationKey, "CorrectKey")() + defer overrideWriteIsolationKey("CorrectKey")() key := strings.ToLower(t.Name()) version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20" @@ -743,12 +754,12 @@ func TestHandler(t *testing.T) { assert.Equal(t, 200, resp.StatusCode) } // commit, but with the incorrect write isolation key relative to the cache obj created - { - httpClientTransport.WriteIsolationKey = "WrongKey" + func() { + defer overrideWriteIsolationKey("WrongKey")() resp, err := httpClient.Post(fmt.Sprintf("%s/caches/%d", base, id), "", nil) require.NoError(t, err) assert.Equal(t, 403, resp.StatusCode) - } + }() }) t.Run("get across WriteIsolationKey", func(t *testing.T) { @@ -762,8 +773,8 @@ func TestHandler(t *testing.T) { // Perform the 'get' without the right WriteIsolationKey for the cache entry... should be OK for `key` since it // was written with WriteIsolationKey "" meaning it is available for non-isolated access - { - httpClientTransport.WriteIsolationKey = "WhoopsWrongKey" + func() { + defer overrideWriteIsolationKey("WhoopsWrongKey")() resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version)) require.NoError(t, err) @@ -777,30 +788,52 @@ func TestHandler(t *testing.T) { require.NoError(t, err) require.Equal(t, 200, contentResp.StatusCode) httpClientTransport.WriteIsolationKey = "CorrectKey" // reset for next find - } + }() // Perform the 'get' without the right WriteIsolationKey for the cache entry... should be 403 for `keyIsolated` // because it was written with a different WriteIsolationKey. { - httpClientTransport.WriteIsolationKey = "CorrectKey" // for test purposes make the `find` successful... - resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, keyIsolated, version)) - require.NoError(t, err) - require.Equal(t, 200, resp.StatusCode) - got := struct { + got := func() struct { ArchiveLocation string `json:"archiveLocation"` - }{} - require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + } { + defer overrideWriteIsolationKey("CorrectKey")() // for test purposes make the `find` successful... + resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, keyIsolated, version)) + require.NoError(t, err) + require.Equal(t, 200, resp.StatusCode) + got := struct { + ArchiveLocation string `json:"archiveLocation"` + }{} + require.NoError(t, json.NewDecoder(resp.Body).Decode(&got)) + return got + }() - httpClientTransport.WriteIsolationKey = "WhoopsWrongKey" // but then access w/ the wrong key for `get` - contentResp, err := httpClient.Get(got.ArchiveLocation) - require.NoError(t, err) - require.Equal(t, 403, contentResp.StatusCode) + func() { + defer overrideWriteIsolationKey("WhoopsWrongKey")() // but then access w/ the wrong key for `get` + contentResp, err := httpClient.Get(got.ArchiveLocation) + require.NoError(t, err) + require.Equal(t, 403, contentResp.StatusCode) + }() } }) } +func overrideWriteIsolationKey(writeIsolationKey string) func() { + originalWriteIsolationKey := httpClientTransport.WriteIsolationKey + originalMac := httpClientTransport.OverrideDefaultMac + + httpClientTransport.WriteIsolationKey = writeIsolationKey + httpClientTransport.OverrideDefaultMac = computeMac("secret", cacheRepo, cacheRunnum, cacheTimestamp, httpClientTransport.WriteIsolationKey) + + return func() { + httpClientTransport.WriteIsolationKey = originalWriteIsolationKey + httpClientTransport.OverrideDefaultMac = originalMac + } +} + func uploadCacheNormally(t *testing.T, base, key, version, writeIsolationKey string, content []byte) { - defer testutils.MockVariable(&httpClientTransport.WriteIsolationKey, writeIsolationKey)() + if writeIsolationKey != "" { + defer overrideWriteIsolationKey(writeIsolationKey)() + } var id uint64 { diff --git a/act/artifactcache/mac.go b/act/artifactcache/mac.go index 6ed20b01..72e5fa2e 100644 --- a/act/artifactcache/mac.go +++ b/act/artifactcache/mac.go @@ -22,7 +22,7 @@ func (h *Handler) validateMac(rundata cacheproxy.RunData) (string, error) { return "", ErrValidation } - expectedMAC := computeMac(h.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp) + expectedMAC := computeMac(h.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp, rundata.WriteIsolationKey) if hmac.Equal([]byte(expectedMAC), []byte(rundata.RepositoryMAC)) { return rundata.RepositoryFullName, nil } @@ -40,12 +40,14 @@ func validateAge(ts string) bool { return true } -func computeMac(secret, repo, run, ts string) string { +func computeMac(secret, repo, run, ts, writeIsolationKey string) string { mac := hmac.New(sha256.New, []byte(secret)) mac.Write([]byte(repo)) mac.Write([]byte(">")) mac.Write([]byte(run)) mac.Write([]byte(">")) mac.Write([]byte(ts)) + mac.Write([]byte(">")) + mac.Write([]byte(writeIsolationKey)) return hex.EncodeToString(mac.Sum(nil)) } diff --git a/act/artifactcache/mac_test.go b/act/artifactcache/mac_test.go index a4b801a9..0e1f3be6 100644 --- a/act/artifactcache/mac_test.go +++ b/act/artifactcache/mac_test.go @@ -19,7 +19,7 @@ func TestMac(t *testing.T) { run := "1" ts := strconv.FormatInt(time.Now().Unix(), 10) - mac := computeMac(handler.secret, name, run, ts) + mac := computeMac(handler.secret, name, run, ts, "") rundata := cacheproxy.RunData{ RepositoryFullName: name, RunNumber: run, @@ -37,7 +37,7 @@ func TestMac(t *testing.T) { run := "1" ts := "9223372036854775807" // This should last us for a while... - mac := computeMac(handler.secret, name, run, ts) + mac := computeMac(handler.secret, name, run, ts, "") rundata := cacheproxy.RunData{ RepositoryFullName: name, RunNumber: run, @@ -72,9 +72,12 @@ func TestMac(t *testing.T) { run := "42" ts := "1337" - mac := computeMac(secret, name, run, ts) - expectedMac := "f666f06f917acb7186e152195b2a8c8d36d068ce683454be0878806e08e04f2b" // * Precomputed, anytime the computeMac function changes this needs to be recalculated + mac := computeMac(secret, name, run, ts, "") + expectedMac := "4754474b21329e8beadd2b4054aa4be803965d66e710fa1fee091334ed804f29" // * Precomputed, anytime the computeMac function changes this needs to be recalculated + require.Equal(t, expectedMac, mac) - require.Equal(t, mac, expectedMac) + mac = computeMac(secret, name, run, ts, "refs/pull/12/head") + expectedMac = "9ca8f4cb5e1b083ee8cd215215bc00f379b28511d3ef7930bf054767de34766d" // * Precomputed, anytime the computeMac function changes this needs to be recalculated + require.Equal(t, expectedMac, mac) }) } diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index a2d76527..2b2b3707 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -55,7 +55,7 @@ type RunData struct { } func (h *Handler) CreateRunData(fullName, runNumber, timestamp, writeIsolationKey string) RunData { - mac := computeMac(h.cacheSecret, fullName, runNumber, timestamp) + mac := computeMac(h.cacheSecret, fullName, runNumber, timestamp, writeIsolationKey) return RunData{ RepositoryFullName: fullName, RunNumber: runNumber, @@ -212,12 +212,14 @@ func (h *Handler) Close() error { return retErr } -func computeMac(secret, repo, run, ts string) string { +func computeMac(secret, repo, run, ts, writeIsolationKey string) string { mac := hmac.New(sha256.New, []byte(secret)) mac.Write([]byte(repo)) mac.Write([]byte(">")) mac.Write([]byte(run)) mac.Write([]byte(">")) mac.Write([]byte(ts)) + mac.Write([]byte(">")) + mac.Write([]byte(writeIsolationKey)) return hex.EncodeToString(mac.Sum(nil)) } From dded18c94d6e2732c53abf2ca57540284bb9a161 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 17 Aug 2025 16:36:14 -0600 Subject: [PATCH 149/281] add an integration test for PR cache pollution --- internal/app/run/runner_test.go | 127 +++++++++++++++++++++++++++++--- 1 file changed, 115 insertions(+), 12 deletions(-) diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 94e476f4..9db43b4e 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -171,11 +171,7 @@ func TestRunnerCacheConfiguration(t *testing.T) { // Must set up cache for our test require.NotNil(t, runner.cacheProxy) - ctx, cancel := context.WithCancel(t.Context()) - defer cancel() - - // Run a given workflow w/ event... - runWorkflow := func(yamlContent, eventName, ref, description string) { + runWorkflow := func(ctx context.Context, cancel context.CancelFunc, yamlContent, eventName, ref, description string) { task := &runnerv1.Task{ WorkflowPayload: []byte(yamlContent), Context: &structpb.Struct{ @@ -195,8 +191,12 @@ func TestRunnerCacheConfiguration(t *testing.T) { require.NoError(t, err, description) } - // Step 1: Populate shared cache with push workflow - populateYaml := ` + t.Run("Cache accessible", func(t *testing.T) { + ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute) + defer cancel() + + // Step 1: Populate shared cache with push workflow + populateYaml := ` name: Cache Testing Action on: push: @@ -212,11 +212,11 @@ jobs: mkdir -p cache_path_1 echo "Hello from push workflow!" > cache_path_1/cache_content_1 ` - runWorkflow(populateYaml, "push", "refs/heads/main", "step 1: push cache populate expected to succeed") + runWorkflow(ctx, cancel, populateYaml, "push", "refs/heads/main", "step 1: push cache populate expected to succeed") - // Step 2: Validate that cache is accessible; mostly a sanity check that the test environment and mock context - // provides everything needed for the cache setup. - checkYaml := ` + // Step 2: Validate that cache is accessible; mostly a sanity check that the test environment and mock context + // provides everything needed for the cache setup. + checkYaml := ` name: Cache Testing Action on: push: @@ -232,5 +232,108 @@ jobs: [[ -f cache_path_1/cache_content_1 ]] && echo "Step 2: cache file found." || echo "Step 2: cache file missing!" [[ -f cache_path_1/cache_content_1 ]] || exit 1 ` - runWorkflow(checkYaml, "push", "refs/heads/main", "step 2: push cache check expected to succeed") + runWorkflow(ctx, cancel, checkYaml, "push", "refs/heads/main", "step 2: push cache check expected to succeed") + }) + + t.Run("PR cache pollution prevented", func(t *testing.T) { + ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute) + defer cancel() + + // Step 1: Populate shared cache with push workflow + populateYaml := ` +name: Cache Testing Action +on: + push: +jobs: + job-cache-check-1: + runs-on: ubuntu-latest + steps: + - uses: actions/cache@v4 + with: + path: cache_path_1 + key: cache-key-1 + - run: | + mkdir -p cache_path_1 + echo "Hello from push workflow!" > cache_path_1/cache_content_1 +` + runWorkflow(ctx, cancel, populateYaml, "push", "refs/heads/main", "step 1: push cache populate expected to succeed") + + // Step 2: Check if pull_request can read push cache, should be available as it's a trusted cache. + checkPRYaml := ` +name: Cache Testing Action +on: + pull_request: +jobs: + job-cache-check-2: + runs-on: ubuntu-latest + steps: + - uses: actions/cache@v4 + with: + path: cache_path_1 + key: cache-key-1 + - run: | + [[ -f cache_path_1/cache_content_1 ]] && echo "Step 2: cache file found." || echo "Step 2: cache file missing!" + [[ -f cache_path_1/cache_content_1 ]] || exit 1 +` + runWorkflow(ctx, cancel, checkPRYaml, "pull_request", "refs/pull/1234/head", "step 2: PR should read push cache") + + // Step 3: Pull request writes to cache; here we need to use a new cache key because we'll get a cache-hit like we + // did in step #2 if we keep the same key, and then the cache contents won't be updated. + populatePRYaml := ` +name: Cache Testing Action +on: + pull_request: +jobs: + job-cache-check-3: + runs-on: ubuntu-latest + steps: + - uses: actions/cache@v4 + with: + path: cache_path_1 + key: cache-key-2 + - run: | + mkdir -p cache_path_1 + echo "Hello from PR workflow!" > cache_path_1/cache_content_2 +` + runWorkflow(ctx, cancel, populatePRYaml, "pull_request", "refs/pull/1234/head", "step 3: PR cache populate expected to succeed") + + // Step 4: Check if pull_request can read its own cache written by step #3. + checkPRKey2Yaml := ` +name: Cache Testing Action +on: + pull_request: +jobs: + job-cache-check-4: + runs-on: ubuntu-latest + steps: + - uses: actions/cache@v4 + with: + path: cache_path_1 + key: cache-key-2 + - run: | + [[ -f cache_path_1/cache_content_2 ]] && echo "Step 4 cache file found." || echo "Step 4 cache file missing!" + [[ -f cache_path_1/cache_content_2 ]] || exit 1 +` + runWorkflow(ctx, cancel, checkPRKey2Yaml, "pull_request", "refs/pull/1234/head", "step 4: PR should read its own cache") + + // Step 5: Check that the push workflow cannot access the isolated cache that was written by the pull_request in + // step #3, ensuring that it's not possible to pollute the cache by predicting cache keys. + checkKey2Yaml := ` +name: Cache Testing Action +on: + push: +jobs: + job-cache-check-6: + runs-on: ubuntu-latest + steps: + - uses: actions/cache@v4 + with: + path: cache_path_1 + key: cache-key-2 + - run: | + [[ -f cache_path_1/cache_content_2 ]] && echo "Step 5 cache file found, oh no!" || echo "Step 5: cache file missing as expected." + [[ -f cache_path_1/cache_content_2 ]] && exit 1 || exit 0 +` + runWorkflow(ctx, cancel, checkKey2Yaml, "push", "refs/heads/main", "step 5: push cache should not be polluted by PR") + }) } From 5a569d4ed1cecd6cee41fce9c954c0ab79486fce Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Thu, 21 Aug 2025 09:21:20 -0600 Subject: [PATCH 150/281] adopt t.Context() now that we're on go1.24; remove per-test explicit timeout --- internal/app/run/runner_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 9db43b4e..92e96452 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -192,7 +192,7 @@ func TestRunnerCacheConfiguration(t *testing.T) { } t.Run("Cache accessible", func(t *testing.T) { - ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute) + ctx, cancel := context.WithCancel(t.Context()) defer cancel() // Step 1: Populate shared cache with push workflow @@ -236,7 +236,7 @@ jobs: }) t.Run("PR cache pollution prevented", func(t *testing.T) { - ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute) + ctx, cancel := context.WithCancel(t.Context()) defer cancel() // Step 1: Populate shared cache with push workflow From a334431107da7ddb9bf76535ca1b8fcdf2bae159 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 1 Sep 2025 11:51:24 +0000 Subject: [PATCH 151/281] Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.4 (#921) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/forgejo](https://forgejo.org) ([source](https://codeberg.org/forgejo/forgejo)) | patch | `11.0.3` -> `11.0.4` | --- ### Release Notes
forgejo/forgejo (code.forgejo.org/forgejo/forgejo) ### [`v11.0.4`](https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.4) [Compare Source](https://codeberg.org/forgejo/forgejo/compare/v11.0.3...v11.0.4) See
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/921): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.4 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/921 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index dcfb7d88..2320ecdf 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -21,7 +21,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.3 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.4 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo FORGEJO_USER: root FORGEJO_PASSWORD: admin1234 From dce6af9d24ac5a40cd1aa8feb165e6281780cc08 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 1 Sep 2025 13:39:30 +0000 Subject: [PATCH 152/281] fix: pull_request_target events can share the cache of the repository (#927) This is a regression introduced in v10.0.0 by which a pull_request_target event would fail because it attemps to set an isolation key, as if it was a pull request originating from a fork. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/927): fix: pull_request_target events can share the cache of the repository Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/927 Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/run/runner.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 86cddd1a..08682d1f 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -272,7 +272,7 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. // future runs of the PR's workflows and won't be shared with other pull requests or actions. This is a security // measure to prevent a malicious pull request from poisoning the cache with secret-stealing code which would // later be executed on another action. - if taskContext["event_name"].GetStringValue() == "pull_request" || taskContext["event_name"].GetStringValue() == "pull_request_target" { + if taskContext["event_name"].GetStringValue() == "pull_request" { // Ensure that `Ref` has the expected format so that we don't end up with a useless write isolation key if !strings.HasPrefix(preset.Ref, "refs/pull/") { return fmt.Errorf("write isolation key: expected preset.Ref to be refs/pull/..., but was %q", preset.Ref) From 877749a730db2284eb062016b1d92de94a8d0476 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 1 Sep 2025 14:24:38 +0000 Subject: [PATCH 153/281] Update dependency forgejo/runner to v10 (#928) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | major | `9.1.1` -> `10.0.1` | --- ### Release Notes
forgejo/runner (forgejo/runner) ### [`v10.0.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v10.0.0...v10.0.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** ### [`v10.0.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.1.1...v10.0.0) > **Warning** Upgrade to v10.0.1 instead. A regression was found on `pull_request_target` events and is fixed in the [v10.0.1 release](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.1). - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes - [PR](https://code.forgejo.org/forgejo/runner/pulls/925): fix(security): prevent on: pull\_request actions from mutating caches of other workflow events forgej-runner currently creates a safer execution environment for workflows triggered by pull requests by denying those workflows access to the repository's secrets, preventing pull requests from compromising the confidentiality of the secrets. Workflows do have access to write to the action cache, which is shared with future workflow executions, including executions that may have access to repository secrets. This was assumed safe as the cache is a "write-once" operation based upon the cache key; if an execution writes to that cache, it will be read by other workflows only if a matching key parameter is provided, and it can not be modified again. These assumptions were identified as weak security practices with known workarounds. It is possible for a malicious pull request to mutate the shared cache and embed untrusted artifacts, which may later be executed in workflow executions with access to secrets, risking the confidentiality of those secrets. In order to eliminate this risk, workflows executing with the `pull_request` and `pull_request_target` events have their write operations to the cache isolated to future workflow executions from the same pull request. They can continue to read from the shared cache if applicable. If using an external cache server configuration, both the cache server and other instances of the runner must be running the same software version. The recommended upgrade procedure in this configuration is to bring all runners offline, upgrade the cache server to the latest release and bring it online, and then bring all other runners online. - [PR](https://code.forgejo.org/forgejo/runner/pulls/924): fix(security): ensure unique names for container images created by actions Without this fix, when a workflow ran a local [docker action](https://forgejo.org/docs/next/user/actions/actions/#docker-actions) (e.g. the [example in the end-to-end tests](https://code.forgejo.org/forgejo/end-to-end/src/commit/8f920b4b7adcb920e435db1acd02407b2312ab74/actions/example-force-rebuild/.forgejo/workflows/test.yml)), it used an image tag that could collide with other workflows that happen to use the same name. The workaround for older runner versions is to set [`[container].force_rebuild: true`](https://forgejo.org/docs/next/admin/actions/runner-installation/#configuration) in the runner configuration file. *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/925): fix(security): prevent on: pull\_request actions from mutating caches of other workflow events - [PR](https://code.forgejo.org/forgejo/runner/pulls/924): fix(security): ensure unique names for container images created by actions - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/921): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.4 - [PR](https://code.forgejo.org/forgejo/runner/pulls/922): chore: explain the difference between `job_level` and `level` - [PR](https://code.forgejo.org/forgejo/runner/pulls/917): chore: add reminder of how to run a local test - [PR](https://code.forgejo.org/forgejo/runner/pulls/919): chore: unify cascade-setup-forgejo with cascade-forgejo - [PR](https://code.forgejo.org/forgejo/runner/pulls/873): chore: remove `github.com/pkg/errors` - [PR](https://code.forgejo.org/forgejo/runner/pulls/915): Update module github.com/stretchr/testify to v1.11.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/914): Update module google.golang.org/protobuf to v1.36.8 - [PR](https://code.forgejo.org/forgejo/runner/pulls/907): Update module go.etcd.io/bbolt to v1.4.3 - [PR](https://code.forgejo.org/forgejo/runner/pulls/906): test: remove internal timeout in TestRunnerCacheConfiguration - [PR](https://code.forgejo.org/forgejo/runner/pulls/902): chore: skip tests that require Forgejo if it is not available - [PR](https://code.forgejo.org/forgejo/runner/pulls/903): chore: rework the README - [PR](https://code.forgejo.org/forgejo/runner/pulls/904): Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 \[SECURITY] - [PR](https://code.forgejo.org/forgejo/runner/pulls/900): chore: remove TestRunContext\_GetGitHubContext - [PR](https://code.forgejo.org/forgejo/runner/pulls/899): chore: do not force GOPROXY - [PR](https://code.forgejo.org/forgejo/runner/pulls/890): Update module github.com/vektra/mockery/v2 to v2.53.5 - [PR](https://code.forgejo.org/forgejo/runner/pulls/893): chore: fix .PHONY lint targets - [PR](https://code.forgejo.org/forgejo/runner/pulls/898): Update dependency forgejo/runner to v9.1.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/897): Update code.forgejo.org/forgejo/runner Docker tag to v9.1.1
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/928): Update dependency forgejo/runner to v10 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/928 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 7e549b7d..235c6e30 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=9.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=10.0.1 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 323554256c4c25f723d6ba6d2383bcf86e1d3528 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 1 Sep 2025 19:42:17 +0000 Subject: [PATCH 154/281] Update module github.com/spf13/cobra to v1.10.1 (#930) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/spf13/cobra](https://github.com/spf13/cobra) | `v1.9.1` -> `v1.10.1` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fspf13%2fcobra/v1.10.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fspf13%2fcobra/v1.9.1/v1.10.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
spf13/cobra (github.com/spf13/cobra) ### [`v1.10.1`](https://github.com/spf13/cobra/releases/tag/v1.10.1) [Compare Source](https://github.com/spf13/cobra/compare/v1.10.0...v1.10.1) ##### 🐛 Fix - chore: upgrade pflags v1.0.9 by [@​jpmcb](https://github.com/jpmcb) in [#​2305](https://github.com/spf13/cobra/pull/2305) v1.0.9 of pflags brought back `ParseErrorsWhitelist` and marked it as deprecated **Full Changelog**: ### [`v1.10.0`](https://github.com/spf13/cobra/releases/tag/v1.10.0) [Compare Source](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.0) #### What's Changed ##### 🚨 Attention! - Bump pflag to 1.0.8 by [@​tomasaschan](https://github.com/tomasaschan) in [#​2303](https://github.com/spf13/cobra/pull/2303) This version of `pflag` carried a breaking change: it renamed `ParseErrorsWhitelist` to `ParseErrorsAllowlist` which can break builds if both `pflag` and `cobra` are dependencies in your project. - If you use both `pflag and `cobra`, upgrade `pflag`to 1.0.8 and`cobra`to`1.10.0\` - ***or*** use the newer, fixed version of `pflag` v1.0.9 which keeps the deprecated `ParseErrorsWhitelist` More details can be found here: [#​2303 (comment)](https://github.com/spf13/cobra/pull/2303#issuecomment-3242333515) ##### ✨ Features - Flow context to command in SetHelpFunc by [@​Frassle](https://github.com/Frassle) in [#​2241](https://github.com/spf13/cobra/pull/2241) - The default ShellCompDirective can be customized for a command and its subcommands by [@​albers](https://github.com/albers) in [#​2238](https://github.com/spf13/cobra/pull/2238) ##### 🐛 Fix - Upgrade golangci-lint to v2, address findings by [@​scop](https://github.com/scop) in [#​2279](https://github.com/spf13/cobra/pull/2279) ##### 🪠 Testing - Test with Go 1.24 by [@​harryzcy](https://github.com/harryzcy) in [#​2236](https://github.com/spf13/cobra/pull/2236) - chore: Rm GitHub Action PR size labeler by [@​jpmcb](https://github.com/jpmcb) in [#​2256](https://github.com/spf13/cobra/pull/2256) ##### 📝 Docs - Remove traling curlybrace by [@​yedayak](https://github.com/yedayak) in [#​2237](https://github.com/spf13/cobra/pull/2237) - Update command.go by [@​styee](https://github.com/styee) in [#​2248](https://github.com/spf13/cobra/pull/2248) - feat: Add security policy by [@​jpmcb](https://github.com/jpmcb) in [#​2253](https://github.com/spf13/cobra/pull/2253) - Update Readme (Warp) by [@​ericdachen](https://github.com/ericdachen) in [#​2267](https://github.com/spf13/cobra/pull/2267) - Add Periscope to the list of projects using Cobra by [@​anishathalye](https://github.com/anishathalye) in [#​2299](https://github.com/spf13/cobra/pull/2299) #### New Contributors - [@​harryzcy](https://github.com/harryzcy) made their first contribution in [#​2236](https://github.com/spf13/cobra/pull/2236) - [@​yedayak](https://github.com/yedayak) made their first contribution in [#​2237](https://github.com/spf13/cobra/pull/2237) - [@​Frassle](https://github.com/Frassle) made their first contribution in [#​2241](https://github.com/spf13/cobra/pull/2241) - [@​styee](https://github.com/styee) made their first contribution in [#​2248](https://github.com/spf13/cobra/pull/2248) - [@​ericdachen](https://github.com/ericdachen) made their first contribution in [#​2267](https://github.com/spf13/cobra/pull/2267) - [@​albers](https://github.com/albers) made their first contribution in [#​2238](https://github.com/spf13/cobra/pull/2238) - [@​anishathalye](https://github.com/anishathalye) made their first contribution in [#​2299](https://github.com/spf13/cobra/pull/2299) - [@​tomasaschan](https://github.com/tomasaschan) made their first contribution in [#​2303](https://github.com/spf13/cobra/pull/2303) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/930): Update module github.com/spf13/cobra to v1.10.1 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/930 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 9 ++++----- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index 68a42e36..97a7fc78 100644 --- a/go.mod +++ b/go.mod @@ -30,8 +30,8 @@ require ( github.com/opencontainers/selinux v1.12.0 github.com/rhysd/actionlint v1.7.7 github.com/sirupsen/logrus v1.9.3 - github.com/spf13/cobra v1.9.1 - github.com/spf13/pflag v1.0.7 + github.com/spf13/cobra v1.10.1 + github.com/spf13/pflag v1.0.9 github.com/stretchr/testify v1.11.1 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.3 diff --git a/go.sum b/go.sum index 866d9f74..9fa9eb65 100644 --- a/go.sum +++ b/go.sum @@ -172,11 +172,10 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8= github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY= -github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo= -github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0= -github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M= -github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= +github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= +github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= From aa428e375c46d6e17c68d750263c7fb4c2624b18 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 1 Sep 2025 22:09:43 +0000 Subject: [PATCH 155/281] fix: an expression in with: for a reusable workflow call can use env (#931) Resolves forgejo/runner#929 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/931): fix: an expression in with: for a reusable workflow call can use env Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/931 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/schema/schema_test.go | 57 +++++++++++++++++++++++++++++++++ act/schema/workflow_schema.json | 2 +- 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index fe2598f2..45109b1d 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -1,6 +1,7 @@ package schema import ( + "fmt" "testing" "github.com/stretchr/testify/assert" @@ -29,6 +30,62 @@ jobs: assert.NoError(t, err) } +func TestReusableWorkflow(t *testing.T) { + t.Run("KnownContexts", func(t *testing.T) { + var node yaml.Node + err := yaml.Unmarshal([]byte(` +on: push + +jobs: + job: + uses: ./.forgejo/workflow/test.yaml + with: + input1: | + ${{ forge.KEY }} + ${{ github.KEY }} + ${{ inputs.KEY }} + ${{ vars.KEY }} + ${{ env.KEY }} + ${{ needs.KEY }} + ${{ strategy.KEY }} + ${{ matrix.KEY }} +`), &node) + if !assert.NoError(t, err) { + return + } + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.NoError(t, err) + }) + + t.Run("UnknownContext", func(t *testing.T) { + for _, context := range []string{"secrets", "job", "steps", "runner"} { + t.Run(context, func(t *testing.T) { + var node yaml.Node + err := yaml.Unmarshal([]byte(fmt.Sprintf(` +on: push + +jobs: + job: + uses: ./.forgejo/workflow/test.yaml + with: + input1: ${{ %[1]s.KEY }} +`, context)), &node) + if !assert.NoError(t, err) { + return + } + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.ErrorContains(t, err, "Unknown Variable Access "+context) + }) + } + }) +} + func TestAdditionalFunctionsFailure(t *testing.T) { var node yaml.Node err := yaml.Unmarshal([]byte(` diff --git a/act/schema/workflow_schema.json b/act/schema/workflow_schema.json index 9c88f5b5..826269a8 100644 --- a/act/schema/workflow_schema.json +++ b/act/schema/workflow_schema.json @@ -2076,7 +2076,7 @@ "string": {} }, "scalar-needs-context": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "github", "inputs", "vars", "env", "needs", "strategy", "matrix"], "one-of": ["string", "boolean", "number"] }, "scalar-needs-context-with-secrets": { From d09e6887383bd12ca5ad24554be78d8ae0ee7d75 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 3 Sep 2025 05:52:27 +0000 Subject: [PATCH 156/281] Update module github.com/spf13/pflag to v1.0.10 (#932) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/spf13/pflag](https://github.com/spf13/pflag) | `v1.0.9` -> `v1.0.10` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fspf13%2fpflag/v1.0.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fspf13%2fpflag/v1.0.9/v1.0.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
spf13/pflag (github.com/spf13/pflag) ### [`v1.0.10`](https://github.com/spf13/pflag/releases/tag/v1.0.10) [Compare Source](https://github.com/spf13/pflag/compare/v1.0.9...v1.0.10) #### What's Changed - fix deprecation comment for (FlagSet.)ParseErrorsWhitelist by [@​thaJeztah](https://github.com/thaJeztah) in [#​447](https://github.com/spf13/pflag/pull/447) - remove uses of errors.Is, which requires go1.13, move go1.16/go1.21 tests to separate file by [@​thaJeztah](https://github.com/thaJeztah) in [#​448](https://github.com/spf13/pflag/pull/448) #### New Contributors - [@​thaJeztah](https://github.com/thaJeztah) made their first contribution in [#​447](https://github.com/spf13/pflag/pull/447) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/932): Update module github.com/spf13/pflag to v1.0.10 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/932 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 97a7fc78..102d1013 100644 --- a/go.mod +++ b/go.mod @@ -31,7 +31,7 @@ require ( github.com/rhysd/actionlint v1.7.7 github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.10.1 - github.com/spf13/pflag v1.0.9 + github.com/spf13/pflag v1.0.10 github.com/stretchr/testify v1.11.1 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.3 diff --git a/go.sum b/go.sum index 9fa9eb65..f0a9c562 100644 --- a/go.sum +++ b/go.sum @@ -174,8 +174,9 @@ github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnB github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY= github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= -github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= +github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= From 54591f946a5140de932d11a7691e250bacfdf11d Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 4 Sep 2025 06:16:31 +0000 Subject: [PATCH 157/281] Update dependency go to v1.24.7 (#933) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.24.6` -> `1.24.7` | --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/933): Update dependency go to v1.24.7 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/933 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 102d1013..7fd35dfe 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.forgejo.org/forgejo/runner/v9 go 1.24 -toolchain go1.24.6 +toolchain go1.24.7 require ( code.forgejo.org/forgejo/actions-proto v0.5.1 From bfc5516467efa8d95a5d7edbeb11ed6e9c6c42d2 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 4 Sep 2025 09:26:12 +0000 Subject: [PATCH 158/281] chore: change the license to GPLv3-or-later (#773) The Forgejo runner is part of the Forgejo project. The licensing agreement in the governance repository reads like this: > Forgejo accepts contributions compatible with the GPLv3-or-later license. > The license under which Forgejo is distributed will be changed upon the acceptance of such contributions. The first step is to update the LICENSE file to reflect that decision. The individual copyright notice of each source file will be updated when and if relevant. If a change is made that is eligible for copyright, the author may decide change the copyright notice from MIT or Apache 2 to GPLv3-or-later. Refs licensing agreement https://codeberg.org/forgejo/governance/src/commit/6eb522282f606f65c77b83b662b008aaf444dcfb/AGREEMENTS.md#licensing Refs blog post about the licensing agreement https://forgejo.org/2024-08-gpl/ - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/773): chore: change the license to GPLv3-or-later Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/773 Reviewed-by: Michael Kriese Reviewed-by: Gusted Reviewed-by: Beowulf Reviewed-by: pat-s Reviewed-by: fnetX Reviewed-by: 0ko <0ko@noreply.code.forgejo.org> Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/labelscompare.py | 2 +- Dockerfile | 2 +- LICENSE | 688 +++++++++++++++++++++++++++++++++++++- README.md | 5 +- 4 files changed, 674 insertions(+), 23 deletions(-) diff --git a/.forgejo/labelscompare.py b/.forgejo/labelscompare.py index 2274d384..9580b747 100644 --- a/.forgejo/labelscompare.py +++ b/.forgejo/labelscompare.py @@ -8,7 +8,7 @@ expectedLabels = { "org.opencontainers.image.source": "https://code.forgejo.org/forgejo/runner", "org.opencontainers.image.version": "1.2.3", "org.opencontainers.image.vendor": "Forgejo", - "org.opencontainers.image.licenses": "MIT", + "org.opencontainers.image.licenses": "GPL-3.0-or-later", "org.opencontainers.image.title": "Forgejo Runner", "org.opencontainers.image.description": "A runner for Forgejo Actions.", } diff --git a/Dockerfile b/Dockerfile index d1ab9e93..bcfe98f5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -32,7 +32,7 @@ LABEL maintainer="contact@forgejo.org" \ org.opencontainers.image.source="https://code.forgejo.org/forgejo/runner" \ org.opencontainers.image.version="${RELEASE_VERSION}" \ org.opencontainers.image.vendor="Forgejo" \ - org.opencontainers.image.licenses="MIT" \ + org.opencontainers.image.licenses="GPL-3.0-or-later" \ org.opencontainers.image.title="Forgejo Runner" \ org.opencontainers.image.description="A runner for Forgejo Actions." diff --git a/LICENSE b/LICENSE index 76462726..f288702d 100644 --- a/LICENSE +++ b/LICENSE @@ -1,20 +1,674 @@ -Copyright (c) 2023-2025 The Forgejo Authors -Copyright (c) 2022 The Gitea Authors + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. + Preamble -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. diff --git a/README.md b/README.md index d01f6e11..36a67a8a 100644 --- a/README.md +++ b/README.md @@ -8,10 +8,7 @@ Sensitive security-related issues should be reported to [security@forgejo.org](m ## License -The Forgejo runner source code is distributed under the terms of the following licenses: - -- [MIT](LICENSE) for the most part. -- [Apache 2](act/container/DOCKER_LICENSE) for parts found in the [act/container](act/container) directory. +The Forgejo runner is distributed under the terms of the [GPL version 3.0](LICENSE) or any later version. # Architectures & OS From 69c6c70845d44ff833fa1c8efa4e1701239aca91 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 4 Sep 2025 14:38:50 +0000 Subject: [PATCH 159/281] chore: refactor act/artifactcache Handler to an interface (#934) - the Handler struct becomes handler (lowercase) - the Handler interface is defined to be the existing methods - isClosed() is added and used only in tests - setgcAt() is added and used only in tests --- This is to allow mocking the Handler interface for testing. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/934): chore: refactor act/artifactcache Handler to an interface Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/934 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/artifactcache/handler.go | 61 ++++++++++++++++++++++--------- act/artifactcache/handler_test.go | 14 +++---- act/artifactcache/mac.go | 2 +- act/artifactcache/mac_test.go | 2 +- internal/app/cmd/exec.go | 2 +- 5 files changed, 52 insertions(+), 29 deletions(-) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 8b8572ee..801cd93d 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -28,7 +28,26 @@ const ( urlBase = "/_apis/artifactcache" ) -type Handler struct { +type Handler interface { + ExternalURL() string + Close() error + isClosed() bool + openDB() (*bolthold.Store, error) + find(w http.ResponseWriter, r *http.Request, params httprouter.Params) + reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params) + upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) + commit(w http.ResponseWriter, r *http.Request, params httprouter.Params) + get(w http.ResponseWriter, r *http.Request, params httprouter.Params) + clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) + middleware(handler httprouter.Handle) httprouter.Handle + readCache(id uint64) (*Cache, error) + useCache(id uint64) error + setgcAt(at time.Time) + gcCache() + responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) +} + +type handler struct { dir string storage *Storage router *httprouter.Router @@ -43,8 +62,8 @@ type Handler struct { outboundIP string } -func StartHandler(dir, outboundIP string, port uint16, secret string, logger logrus.FieldLogger) (*Handler, error) { - h := &Handler{ +func StartHandler(dir, outboundIP string, port uint16, secret string, logger logrus.FieldLogger) (Handler, error) { + h := &handler{ secret: secret, } @@ -114,14 +133,14 @@ func StartHandler(dir, outboundIP string, port uint16, secret string, logger log return h, nil } -func (h *Handler) ExternalURL() string { +func (h *handler) ExternalURL() string { port := strconv.Itoa(h.listener.Addr().(*net.TCPAddr).Port) // TODO: make the external url configurable if necessary return fmt.Sprintf("http://%s", net.JoinHostPort(h.outboundIP, port)) } -func (h *Handler) Close() error { +func (h *handler) Close() error { if h == nil { return nil } @@ -146,7 +165,11 @@ func (h *Handler) Close() error { return retErr } -func (h *Handler) openDB() (*bolthold.Store, error) { +func (h *handler) isClosed() bool { + return h.listener == nil && h.server == nil +} + +func (h *handler) openDB() (*bolthold.Store, error) { return bolthold.Open(filepath.Join(h.dir, "bolt.db"), 0o644, &bolthold.Options{ Encoder: json.Marshal, Decoder: json.Unmarshal, @@ -159,7 +182,7 @@ func (h *Handler) openDB() (*bolthold.Store, error) { } // GET /_apis/artifactcache/cache -func (h *Handler) find(w http.ResponseWriter, r *http.Request, params httprouter.Params) { +func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) repo, err := h.validateMac(rundata) if err != nil { @@ -216,7 +239,7 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request, params httprouter } // POST /_apis/artifactcache/caches -func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params) { +func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) repo, err := h.validateMac(rundata) if err != nil { @@ -255,7 +278,7 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, params httprou } // PATCH /_apis/artifactcache/caches/:id -func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) { +func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) repo, err := h.validateMac(rundata) if err != nil { @@ -310,7 +333,7 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprout } // POST /_apis/artifactcache/caches/:id -func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprouter.Params) { +func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) repo, err := h.validateMac(rundata) if err != nil { @@ -374,7 +397,7 @@ func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprout } // GET /_apis/artifactcache/artifacts/:id -func (h *Handler) get(w http.ResponseWriter, r *http.Request, params httprouter.Params) { +func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) repo, err := h.validateMac(rundata) if err != nil { @@ -417,7 +440,7 @@ func (h *Handler) get(w http.ResponseWriter, r *http.Request, params httprouter. } // POST /_apis/artifactcache/clean -func (h *Handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) { +func (h *handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) { rundata := runDataFromHeaders(r) _, err := h.validateMac(rundata) if err != nil { @@ -430,7 +453,7 @@ func (h *Handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Par h.responseJSON(w, r, 200) } -func (h *Handler) middleware(handler httprouter.Handle) httprouter.Handle { +func (h *handler) middleware(handler httprouter.Handle) httprouter.Handle { return func(w http.ResponseWriter, r *http.Request, params httprouter.Params) { h.logger.Debugf("%s %s", r.Method, r.RequestURI) handler(w, r, params) @@ -488,7 +511,7 @@ func insertCache(db *bolthold.Store, cache *Cache) error { return nil } -func (h *Handler) readCache(id uint64) (*Cache, error) { +func (h *handler) readCache(id uint64) (*Cache, error) { db, err := h.openDB() if err != nil { return nil, err @@ -501,7 +524,7 @@ func (h *Handler) readCache(id uint64) (*Cache, error) { return cache, nil } -func (h *Handler) useCache(id uint64) error { +func (h *handler) useCache(id uint64) error { db, err := h.openDB() if err != nil { return err @@ -522,7 +545,11 @@ const ( keepOld = 5 * time.Minute ) -func (h *Handler) gcCache() { +func (h *handler) setgcAt(at time.Time) { + h.gcAt = at +} + +func (h *handler) gcCache() { if h.gcing.Load() { return } @@ -629,7 +656,7 @@ func (h *Handler) gcCache() { } } -func (h *Handler) responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) { +func (h *handler) responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) { w.Header().Set("Content-Type", "application/json; charset=utf-8") var data []byte if len(v) == 0 || v[0] == nil { diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index 1d813d56..c9e01ba3 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -76,8 +76,7 @@ func TestHandler(t *testing.T) { }) t.Run("close", func(t *testing.T) { require.NoError(t, handler.Close()) - assert.Nil(t, handler.server) - assert.Nil(t, handler.listener) + assert.True(t, handler.isClosed()) _, err := httpClient.Post(fmt.Sprintf("%s/caches/%d", base, 1), "", nil) assert.Error(t, err) }) @@ -983,7 +982,7 @@ func TestHandler_gcCache(t *testing.T) { } require.NoError(t, db.Close()) - handler.gcAt = time.Time{} // ensure gcCache will not skip + handler.setgcAt(time.Time{}) // ensure gcCache will not skip handler.gcCache() db, err = handler.openDB() @@ -1010,8 +1009,7 @@ func TestHandler_ExternalURL(t *testing.T) { assert.Equal(t, handler.ExternalURL(), "http://127.0.0.1:34567") require.NoError(t, handler.Close()) - assert.Nil(t, handler.server) - assert.Nil(t, handler.listener) + assert.True(t, handler.isClosed()) }) t.Run("reports correct URL on IPv6 zero host", func(t *testing.T) { @@ -1021,8 +1019,7 @@ func TestHandler_ExternalURL(t *testing.T) { assert.Equal(t, handler.ExternalURL(), "http://[2001:db8::]:34567") require.NoError(t, handler.Close()) - assert.Nil(t, handler.server) - assert.Nil(t, handler.listener) + assert.True(t, handler.isClosed()) }) t.Run("reports correct URL on IPv6", func(t *testing.T) { @@ -1032,7 +1029,6 @@ func TestHandler_ExternalURL(t *testing.T) { assert.Equal(t, handler.ExternalURL(), "http://[2001:db8::1:2:3:4]:34567") require.NoError(t, handler.Close()) - assert.Nil(t, handler.server) - assert.Nil(t, handler.listener) + assert.True(t, handler.isClosed()) }) } diff --git a/act/artifactcache/mac.go b/act/artifactcache/mac.go index 72e5fa2e..faefe2d7 100644 --- a/act/artifactcache/mac.go +++ b/act/artifactcache/mac.go @@ -16,7 +16,7 @@ import ( var ErrValidation = errors.New("validation error") -func (h *Handler) validateMac(rundata cacheproxy.RunData) (string, error) { +func (h *handler) validateMac(rundata cacheproxy.RunData) (string, error) { // TODO: allow configurable max age if !validateAge(rundata.Timestamp) { return "", ErrValidation diff --git a/act/artifactcache/mac_test.go b/act/artifactcache/mac_test.go index 0e1f3be6..a790bc1d 100644 --- a/act/artifactcache/mac_test.go +++ b/act/artifactcache/mac_test.go @@ -10,7 +10,7 @@ import ( ) func TestMac(t *testing.T) { - handler := &Handler{ + handler := &handler{ secret: "secret for testing", } diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go index 371beb24..a0694805 100644 --- a/internal/app/cmd/exec.go +++ b/internal/app/cmd/exec.go @@ -54,7 +54,7 @@ type executeArgs struct { debug bool dryrun bool image string - cacheHandler *artifactcache.Handler + cacheHandler artifactcache.Handler network string enableIPv6 bool githubInstance string From 35f93b6b118b3f1d7ee41b384478f47cf2a1dc72 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 5 Sep 2025 05:09:07 +0000 Subject: [PATCH 160/281] Update module github.com/docker/cli to v28.4.0+incompatible (#938) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v28.3.3+incompatible` -> `v28.4.0+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fcli/v28.4.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fcli/v28.3.3+incompatible/v28.4.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/cli (github.com/docker/cli) ### [`v28.4.0+incompatible`](https://github.com/docker/cli/compare/v28.3.3...v28.4.0) [Compare Source](https://github.com/docker/cli/compare/v28.3.3...v28.4.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/938): Update module github.com/docker/cli to v28.4.0+incompatible Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/938 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 7fd35dfe..12161f42 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 - github.com/docker/cli v28.3.3+incompatible + github.com/docker/cli v28.4.0+incompatible github.com/docker/docker v28.3.3+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 diff --git a/go.sum b/go.sum index f0a9c562..62d580b2 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo= -github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY0UUU4C9kY= +github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI= github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= From a3aedba3f16c12072073cd5b26b9472d7efb2024 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 5 Sep 2025 06:01:49 +0000 Subject: [PATCH 161/281] refactor: remove duplicate computeMac function (#936) It was raised during embargo review of #925 that there are two implementations of `computeMac`; this PR fixes that. As all the tests for `computeMac` were in the `artifactcache` package, it made more sense to keep the method there. That required reversing the dependency `artifactcache->cacheproxy` package dependency -- it makes more sense to me for the proxy to depend on the cache, rather than vice-versa. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/936): refactor: remove duplicate computeMac function Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/936 Reviewed-by: Michael Kriese Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/artifactcache/handler.go | 13 +++++++++--- act/artifactcache/handler_test.go | 2 +- act/artifactcache/mac.go | 8 +++----- act/artifactcache/mac_test.go | 19 ++++++++--------- act/cacheproxy/handler.go | 34 ++++++------------------------- 5 files changed, 29 insertions(+), 47 deletions(-) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 801cd93d..54087746 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -20,7 +20,6 @@ import ( "github.com/timshannon/bolthold" "go.etcd.io/bbolt" - "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" "code.forgejo.org/forgejo/runner/v9/act/common" ) @@ -689,8 +688,16 @@ func parseContentRange(s string) (uint64, uint64, error) { return start, stop, nil } -func runDataFromHeaders(r *http.Request) cacheproxy.RunData { - return cacheproxy.RunData{ +type RunData struct { + RepositoryFullName string + RunNumber string + Timestamp string + RepositoryMAC string + WriteIsolationKey string +} + +func runDataFromHeaders(r *http.Request) RunData { + return RunData{ RepositoryFullName: r.Header.Get("Forgejo-Cache-Repo"), RunNumber: r.Header.Get("Forgejo-Cache-RunNumber"), Timestamp: r.Header.Get("Forgejo-Cache-Timestamp"), diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index c9e01ba3..cc0b443c 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -821,7 +821,7 @@ func overrideWriteIsolationKey(writeIsolationKey string) func() { originalMac := httpClientTransport.OverrideDefaultMac httpClientTransport.WriteIsolationKey = writeIsolationKey - httpClientTransport.OverrideDefaultMac = computeMac("secret", cacheRepo, cacheRunnum, cacheTimestamp, httpClientTransport.WriteIsolationKey) + httpClientTransport.OverrideDefaultMac = ComputeMac("secret", cacheRepo, cacheRunnum, cacheTimestamp, httpClientTransport.WriteIsolationKey) return func() { httpClientTransport.WriteIsolationKey = originalWriteIsolationKey diff --git a/act/artifactcache/mac.go b/act/artifactcache/mac.go index faefe2d7..5b8ca3fb 100644 --- a/act/artifactcache/mac.go +++ b/act/artifactcache/mac.go @@ -10,19 +10,17 @@ import ( "errors" "strconv" "time" - - "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" ) var ErrValidation = errors.New("validation error") -func (h *handler) validateMac(rundata cacheproxy.RunData) (string, error) { +func (h *handler) validateMac(rundata RunData) (string, error) { // TODO: allow configurable max age if !validateAge(rundata.Timestamp) { return "", ErrValidation } - expectedMAC := computeMac(h.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp, rundata.WriteIsolationKey) + expectedMAC := ComputeMac(h.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp, rundata.WriteIsolationKey) if hmac.Equal([]byte(expectedMAC), []byte(rundata.RepositoryMAC)) { return rundata.RepositoryFullName, nil } @@ -40,7 +38,7 @@ func validateAge(ts string) bool { return true } -func computeMac(secret, repo, run, ts, writeIsolationKey string) string { +func ComputeMac(secret, repo, run, ts, writeIsolationKey string) string { mac := hmac.New(sha256.New, []byte(secret)) mac.Write([]byte(repo)) mac.Write([]byte(">")) diff --git a/act/artifactcache/mac_test.go b/act/artifactcache/mac_test.go index a790bc1d..f51461e3 100644 --- a/act/artifactcache/mac_test.go +++ b/act/artifactcache/mac_test.go @@ -5,7 +5,6 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" "github.com/stretchr/testify/require" ) @@ -19,8 +18,8 @@ func TestMac(t *testing.T) { run := "1" ts := strconv.FormatInt(time.Now().Unix(), 10) - mac := computeMac(handler.secret, name, run, ts, "") - rundata := cacheproxy.RunData{ + mac := ComputeMac(handler.secret, name, run, ts, "") + rundata := RunData{ RepositoryFullName: name, RunNumber: run, Timestamp: ts, @@ -37,8 +36,8 @@ func TestMac(t *testing.T) { run := "1" ts := "9223372036854775807" // This should last us for a while... - mac := computeMac(handler.secret, name, run, ts, "") - rundata := cacheproxy.RunData{ + mac := ComputeMac(handler.secret, name, run, ts, "") + rundata := RunData{ RepositoryFullName: name, RunNumber: run, Timestamp: ts, @@ -54,7 +53,7 @@ func TestMac(t *testing.T) { run := "1" ts := strconv.FormatInt(time.Now().Unix(), 10) - rundata := cacheproxy.RunData{ + rundata := RunData{ RepositoryFullName: name, RunNumber: run, Timestamp: ts, @@ -72,12 +71,12 @@ func TestMac(t *testing.T) { run := "42" ts := "1337" - mac := computeMac(secret, name, run, ts, "") - expectedMac := "4754474b21329e8beadd2b4054aa4be803965d66e710fa1fee091334ed804f29" // * Precomputed, anytime the computeMac function changes this needs to be recalculated + mac := ComputeMac(secret, name, run, ts, "") + expectedMac := "4754474b21329e8beadd2b4054aa4be803965d66e710fa1fee091334ed804f29" // * Precomputed, anytime the ComputeMac function changes this needs to be recalculated require.Equal(t, expectedMac, mac) - mac = computeMac(secret, name, run, ts, "refs/pull/12/head") - expectedMac = "9ca8f4cb5e1b083ee8cd215215bc00f379b28511d3ef7930bf054767de34766d" // * Precomputed, anytime the computeMac function changes this needs to be recalculated + mac = ComputeMac(secret, name, run, ts, "refs/pull/12/head") + expectedMac = "9ca8f4cb5e1b083ee8cd215215bc00f379b28511d3ef7930bf054767de34766d" // * Precomputed, anytime the ComputeMac function changes this needs to be recalculated require.Equal(t, expectedMac, mac) }) } diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 2b2b3707..a9610a02 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -4,9 +4,6 @@ package cacheproxy import ( - "crypto/hmac" - "crypto/sha256" - "encoding/hex" "errors" "fmt" "io" @@ -22,6 +19,7 @@ import ( "github.com/julienschmidt/httprouter" "github.com/sirupsen/logrus" + "code.forgejo.org/forgejo/runner/v9/act/artifactcache" "code.forgejo.org/forgejo/runner/v9/act/common" ) @@ -46,17 +44,9 @@ type Handler struct { runs sync.Map } -type RunData struct { - RepositoryFullName string - RunNumber string - Timestamp string - RepositoryMAC string - WriteIsolationKey string -} - -func (h *Handler) CreateRunData(fullName, runNumber, timestamp, writeIsolationKey string) RunData { - mac := computeMac(h.cacheSecret, fullName, runNumber, timestamp, writeIsolationKey) - return RunData{ +func (h *Handler) CreateRunData(fullName, runNumber, timestamp, writeIsolationKey string) artifactcache.RunData { + mac := artifactcache.ComputeMac(h.cacheSecret, fullName, runNumber, timestamp, writeIsolationKey) + return artifactcache.RunData{ RepositoryFullName: fullName, RunNumber: runNumber, Timestamp: timestamp, @@ -142,7 +132,7 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er h.logger.Warn(fmt.Sprintf("Tried starting a cache proxy with id %s, which does not exist.", id)) return } - runData := data.(RunData) + runData := data.(artifactcache.RunData) uri := matches[2] r.SetURL(targetURL) @@ -170,7 +160,7 @@ func (h *Handler) ExternalURL() string { // Informs the proxy of a workflow run that can make cache requests. // The RunData contains the information about the repository. // The function returns the 32-bit random key which the run will use to identify itself. -func (h *Handler) AddRun(data RunData) (string, error) { +func (h *Handler) AddRun(data artifactcache.RunData) (string, error) { for range 3 { key := common.MustRandName(4) _, loaded := h.runs.LoadOrStore(key, data) @@ -211,15 +201,3 @@ func (h *Handler) Close() error { } return retErr } - -func computeMac(secret, repo, run, ts, writeIsolationKey string) string { - mac := hmac.New(sha256.New, []byte(secret)) - mac.Write([]byte(repo)) - mac.Write([]byte(">")) - mac.Write([]byte(run)) - mac.Write([]byte(">")) - mac.Write([]byte(ts)) - mac.Write([]byte(">")) - mac.Write([]byte(writeIsolationKey)) - return hex.EncodeToString(mac.Sum(nil)) -} From 8a7f760d3c62102852e852fca8b1c1e99c59e53f Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 5 Sep 2025 07:29:38 +0000 Subject: [PATCH 162/281] chore: bump version to v11 (#940) the license change from MIT to GPLv3+ is a breaking change Refs forgejo/runner#773 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/940): chore: bump version to v11 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/940 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- Makefile | 4 ++-- act/artifactcache/handler.go | 2 +- act/cacheproxy/handler.go | 4 ++-- act/common/git/git.go | 2 +- act/common/git/git_test.go | 2 +- act/container/container_types.go | 2 +- act/container/docker_auth.go | 2 +- act/container/docker_build.go | 2 +- act/container/docker_images.go | 2 +- act/container/docker_network.go | 2 +- act/container/docker_pull.go | 2 +- act/container/docker_run.go | 4 ++-- act/container/docker_run_test.go | 2 +- act/container/docker_stub.go | 2 +- act/container/docker_volume.go | 2 +- act/container/host_environment.go | 6 +++--- act/container/parse_env_file.go | 2 +- act/exprparser/functions.go | 2 +- act/exprparser/functions_test.go | 2 +- act/exprparser/interpreter.go | 2 +- act/exprparser/interpreter_test.go | 2 +- act/jobparser/evaluator.go | 2 +- act/jobparser/interpeter.go | 4 ++-- act/jobparser/jobparser.go | 2 +- act/jobparser/model.go | 2 +- act/jobparser/model_test.go | 2 +- act/jobparser/testdata_test.go | 2 +- act/model/action.go | 2 +- act/model/github_context.go | 4 ++-- act/model/workflow.go | 4 ++-- act/runner/action.go | 6 +++--- act/runner/action_cache.go | 2 +- act/runner/action_composite.go | 4 ++-- act/runner/action_test.go | 2 +- act/runner/command.go | 2 +- act/runner/command_test.go | 4 ++-- act/runner/container_mock_test.go | 4 ++-- act/runner/expression.go | 8 ++++---- act/runner/expression_test.go | 4 ++-- act/runner/job_executor.go | 6 +++--- act/runner/job_executor_test.go | 6 +++--- act/runner/local_repository_cache.go | 2 +- act/runner/logger.go | 2 +- act/runner/reusable_workflow.go | 6 +++--- act/runner/run_context.go | 8 ++++---- act/runner/run_context_test.go | 8 ++++---- act/runner/runner.go | 4 ++-- act/runner/runner_test.go | 4 ++-- act/runner/step.go | 8 ++++---- act/runner/step_action_local.go | 4 ++-- act/runner/step_action_local_test.go | 4 ++-- act/runner/step_action_remote.go | 6 +++--- act/runner/step_action_remote_test.go | 6 +++--- act/runner/step_docker.go | 6 +++--- act/runner/step_docker_test.go | 4 ++-- act/runner/step_factory.go | 2 +- act/runner/step_factory_test.go | 2 +- act/runner/step_run.go | 8 ++++---- act/runner/step_run_test.go | 4 ++-- act/runner/step_test.go | 4 ++-- go.mod | 2 +- internal/app/cmd/cache-server.go | 4 ++-- internal/app/cmd/cmd.go | 6 +++--- internal/app/cmd/create-runner-file.go | 8 ++++---- internal/app/cmd/create-runner-file_test.go | 6 +++--- internal/app/cmd/daemon.go | 14 +++++++------- internal/app/cmd/exec.go | 8 ++++---- internal/app/cmd/job.go | 14 +++++++------- internal/app/cmd/main_test.go | 2 +- internal/app/cmd/register.go | 8 ++++---- internal/app/cmd/validate.go | 4 ++-- internal/app/job/job.go | 6 +++--- internal/app/job/job_test.go | 2 +- internal/app/poll/poller.go | 6 +++--- internal/app/poll/poller_test.go | 2 +- internal/app/run/runner.go | 20 ++++++++++---------- internal/app/run/runner_test.go | 6 +++--- internal/app/run/workflow.go | 2 +- internal/app/run/workflow_test.go | 2 +- internal/pkg/report/reporter.go | 4 ++-- internal/pkg/report/reporter_test.go | 6 +++--- internal/pkg/ver/version.go | 2 +- main.go | 2 +- 83 files changed, 176 insertions(+), 176 deletions(-) diff --git a/Makefile b/Makefile index 13e4f774..1b4890ec 100644 --- a/Makefile +++ b/Makefile @@ -62,10 +62,10 @@ else endif endif -GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/v9/internal/pkg/client/mocks,$(shell $(GO) list ./...)) +GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/v11/internal/pkg/client/mocks,$(shell $(GO) list ./...)) TAGS ?= -LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=v$(RELEASE_VERSION)" +LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver.version=v$(RELEASE_VERSION)" all: build diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 54087746..ac7355d0 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -20,7 +20,7 @@ import ( "github.com/timshannon/bolthold" "go.etcd.io/bbolt" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" ) const ( diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index a9610a02..17adf3b5 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -19,8 +19,8 @@ import ( "github.com/julienschmidt/httprouter" "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/v9/act/artifactcache" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/artifactcache" + "code.forgejo.org/forgejo/runner/v11/act/common" ) const ( diff --git a/act/common/git/git.go b/act/common/git/git.go index bffe4feb..2d3f1249 100644 --- a/act/common/git/git.go +++ b/act/common/git/git.go @@ -19,7 +19,7 @@ import ( "github.com/mattn/go-isatty" log "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" ) var ( diff --git a/act/common/git/git_test.go b/act/common/git/git_test.go index 738c6afb..8bb5ec64 100644 --- a/act/common/git/git_test.go +++ b/act/common/git/git_test.go @@ -12,7 +12,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" ) func TestFindGitSlug(t *testing.T) { diff --git a/act/container/container_types.go b/act/container/container_types.go index eb524cef..aade7799 100644 --- a/act/container/container_types.go +++ b/act/container/container_types.go @@ -5,7 +5,7 @@ import ( "io" "time" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/docker/go-connections/nat" ) diff --git a/act/container/docker_auth.go b/act/container/docker_auth.go index 555832cb..003a0f14 100644 --- a/act/container/docker_auth.go +++ b/act/container/docker_auth.go @@ -6,7 +6,7 @@ import ( "context" "strings" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/docker/cli/cli/config" "github.com/docker/cli/cli/config/credentials" "github.com/docker/docker/api/types/registry" diff --git a/act/container/docker_build.go b/act/container/docker_build.go index 0400ac63..258a9363 100644 --- a/act/container/docker_build.go +++ b/act/container/docker_build.go @@ -14,7 +14,7 @@ import ( "github.com/moby/patternmatcher" "github.com/moby/patternmatcher/ignorefile" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" ) // NewDockerBuildExecutor function to create a run executor for the container diff --git a/act/container/docker_images.go b/act/container/docker_images.go index 59fad154..70b99b51 100644 --- a/act/container/docker_images.go +++ b/act/container/docker_images.go @@ -6,7 +6,7 @@ import ( "context" "fmt" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" cerrdefs "github.com/containerd/errdefs" "github.com/docker/docker/api/types/image" ) diff --git a/act/container/docker_network.go b/act/container/docker_network.go index d58cf1a7..100d1b0f 100644 --- a/act/container/docker_network.go +++ b/act/container/docker_network.go @@ -5,7 +5,7 @@ package container import ( "context" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/docker/docker/api/types/network" ) diff --git a/act/container/docker_pull.go b/act/container/docker_pull.go index 94cef06b..f0fb1485 100644 --- a/act/container/docker_pull.go +++ b/act/container/docker_pull.go @@ -13,7 +13,7 @@ import ( "github.com/docker/docker/api/types/image" "github.com/docker/docker/api/types/registry" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" ) // NewDockerPullExecutor function to create a run executor for the container diff --git a/act/container/docker_run.go b/act/container/docker_run.go index 7a17d74d..b1247528 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -38,8 +38,8 @@ import ( "github.com/spf13/pflag" "golang.org/x/term" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/filecollector" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/filecollector" ) // NewContainer creates a reference to a container diff --git a/act/container/docker_run_test.go b/act/container/docker_run_test.go index 1e93a9f2..b70350b4 100644 --- a/act/container/docker_run_test.go +++ b/act/container/docker_run_test.go @@ -11,7 +11,7 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/docker/docker/api/types" "github.com/docker/docker/api/types/container" diff --git a/act/container/docker_stub.go b/act/container/docker_stub.go index 1ed58c19..34cc094b 100644 --- a/act/container/docker_stub.go +++ b/act/container/docker_stub.go @@ -7,7 +7,7 @@ import ( "errors" "runtime" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/docker/docker/api/types/network" "github.com/docker/docker/api/types/system" ) diff --git a/act/container/docker_volume.go b/act/container/docker_volume.go index 207f10da..e15262c4 100644 --- a/act/container/docker_volume.go +++ b/act/container/docker_volume.go @@ -6,7 +6,7 @@ import ( "context" "slices" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/docker/docker/api/types/filters" "github.com/docker/docker/api/types/volume" ) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 8a60970b..0e12fa3a 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -20,9 +20,9 @@ import ( "github.com/go-git/go-git/v5/plumbing/format/gitignore" "golang.org/x/term" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/filecollector" - "code.forgejo.org/forgejo/runner/v9/act/lookpath" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/filecollector" + "code.forgejo.org/forgejo/runner/v11/act/lookpath" ) type HostEnvironment struct { diff --git a/act/container/parse_env_file.go b/act/container/parse_env_file.go index 227facb4..e65ae54a 100644 --- a/act/container/parse_env_file.go +++ b/act/container/parse_env_file.go @@ -8,7 +8,7 @@ import ( "io" "strings" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" ) func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Executor { diff --git a/act/exprparser/functions.go b/act/exprparser/functions.go index b0d383e5..03bde85e 100644 --- a/act/exprparser/functions.go +++ b/act/exprparser/functions.go @@ -15,7 +15,7 @@ import ( "github.com/go-git/go-git/v5/plumbing/format/gitignore" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/rhysd/actionlint" ) diff --git a/act/exprparser/functions_test.go b/act/exprparser/functions_test.go index 827eca61..6073ac3b 100644 --- a/act/exprparser/functions_test.go +++ b/act/exprparser/functions_test.go @@ -4,7 +4,7 @@ import ( "path/filepath" "testing" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" ) diff --git a/act/exprparser/interpreter.go b/act/exprparser/interpreter.go index 155296da..8ec3f7b4 100644 --- a/act/exprparser/interpreter.go +++ b/act/exprparser/interpreter.go @@ -7,7 +7,7 @@ import ( "reflect" "strings" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/rhysd/actionlint" ) diff --git a/act/exprparser/interpreter_test.go b/act/exprparser/interpreter_test.go index 248a007c..883ef84a 100644 --- a/act/exprparser/interpreter_test.go +++ b/act/exprparser/interpreter_test.go @@ -4,7 +4,7 @@ import ( "math" "testing" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" ) diff --git a/act/jobparser/evaluator.go b/act/jobparser/evaluator.go index a452dd2a..99230256 100644 --- a/act/jobparser/evaluator.go +++ b/act/jobparser/evaluator.go @@ -5,7 +5,7 @@ import ( "regexp" "strings" - "code.forgejo.org/forgejo/runner/v9/act/exprparser" + "code.forgejo.org/forgejo/runner/v11/act/exprparser" "go.yaml.in/yaml/v3" ) diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go index 4de4cd64..e82444e4 100644 --- a/act/jobparser/interpeter.go +++ b/act/jobparser/interpeter.go @@ -1,8 +1,8 @@ package jobparser import ( - "code.forgejo.org/forgejo/runner/v9/act/exprparser" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/exprparser" + "code.forgejo.org/forgejo/runner/v11/act/model" "go.yaml.in/yaml/v3" ) diff --git a/act/jobparser/jobparser.go b/act/jobparser/jobparser.go index 1329a818..3542236f 100644 --- a/act/jobparser/jobparser.go +++ b/act/jobparser/jobparser.go @@ -8,7 +8,7 @@ import ( "go.yaml.in/yaml/v3" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" ) func Parse(content []byte, validate bool, options ...ParseOption) ([]*SingleWorkflow, error) { diff --git a/act/jobparser/model.go b/act/jobparser/model.go index 4d3f8d42..ed6e5ece 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -4,7 +4,7 @@ import ( "bytes" "fmt" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "go.yaml.in/yaml/v3" ) diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index 1edaf4a5..fd62ef65 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -5,7 +5,7 @@ import ( "strings" "testing" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" diff --git a/act/jobparser/testdata_test.go b/act/jobparser/testdata_test.go index dfbf2f76..a918f353 100644 --- a/act/jobparser/testdata_test.go +++ b/act/jobparser/testdata_test.go @@ -6,7 +6,7 @@ import ( "path/filepath" "testing" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/require" ) diff --git a/act/model/action.go b/act/model/action.go index 6f2354f6..72b986f0 100644 --- a/act/model/action.go +++ b/act/model/action.go @@ -5,7 +5,7 @@ import ( "io" "strings" - "code.forgejo.org/forgejo/runner/v9/act/schema" + "code.forgejo.org/forgejo/runner/v11/act/schema" "go.yaml.in/yaml/v3" ) diff --git a/act/model/github_context.go b/act/model/github_context.go index d23a6dd8..4a3d0bd9 100644 --- a/act/model/github_context.go +++ b/act/model/github_context.go @@ -5,8 +5,8 @@ import ( "fmt" "strings" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/common/git" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common/git" ) type GithubContext struct { diff --git a/act/model/workflow.go b/act/model/workflow.go index 12bba60b..c1bc4097 100644 --- a/act/model/workflow.go +++ b/act/model/workflow.go @@ -13,8 +13,8 @@ import ( "strings" "sync" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/schema" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/schema" log "github.com/sirupsen/logrus" "go.yaml.in/yaml/v3" ) diff --git a/act/runner/action.go b/act/runner/action.go index d27f0a84..1ecd51c1 100644 --- a/act/runner/action.go +++ b/act/runner/action.go @@ -16,9 +16,9 @@ import ( "github.com/kballard/go-shellquote" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/model" ) type actionStep interface { diff --git a/act/runner/action_cache.go b/act/runner/action_cache.go index c884eb4f..2650c700 100644 --- a/act/runner/action_cache.go +++ b/act/runner/action_cache.go @@ -18,7 +18,7 @@ import ( "github.com/go-git/go-git/v5/plumbing/transport" "github.com/go-git/go-git/v5/plumbing/transport/http" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" ) type ActionCache interface { diff --git a/act/runner/action_composite.go b/act/runner/action_composite.go index 45481cd4..8992f5bc 100644 --- a/act/runner/action_composite.go +++ b/act/runner/action_composite.go @@ -6,8 +6,8 @@ import ( "regexp" "strings" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" ) func evaluateCompositeInputAndEnv(ctx context.Context, parent *RunContext, step actionStep) map[string]string { diff --git a/act/runner/action_test.go b/act/runner/action_test.go index 3e1bc27f..f549f7e9 100644 --- a/act/runner/action_test.go +++ b/act/runner/action_test.go @@ -7,7 +7,7 @@ import ( "strings" "testing" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/command.go b/act/runner/command.go index f936ce15..3250a3f2 100644 --- a/act/runner/command.go +++ b/act/runner/command.go @@ -5,7 +5,7 @@ import ( "regexp" "strings" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/sirupsen/logrus" ) diff --git a/act/runner/command_test.go b/act/runner/command_test.go index 51f4198a..4db11089 100644 --- a/act/runner/command_test.go +++ b/act/runner/command_test.go @@ -9,8 +9,8 @@ import ( "github.com/sirupsen/logrus/hooks/test" "github.com/stretchr/testify/assert" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" ) func TestCommandSetEnv(t *testing.T) { diff --git a/act/runner/container_mock_test.go b/act/runner/container_mock_test.go index 5d884a21..ce5603f7 100644 --- a/act/runner/container_mock_test.go +++ b/act/runner/container_mock_test.go @@ -4,8 +4,8 @@ import ( "context" "io" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/expression.go b/act/runner/expression.go index 11791ef4..e17af233 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -13,10 +13,10 @@ import ( _ "embed" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/exprparser" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/exprparser" + "code.forgejo.org/forgejo/runner/v11/act/model" "go.yaml.in/yaml/v3" ) diff --git a/act/runner/expression_test.go b/act/runner/expression_test.go index 00cbc603..12eecd9f 100644 --- a/act/runner/expression_test.go +++ b/act/runner/expression_test.go @@ -3,8 +3,8 @@ package runner import ( "testing" - "code.forgejo.org/forgejo/runner/v9/act/exprparser" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/exprparser" + "code.forgejo.org/forgejo/runner/v11/act/model" assert "github.com/stretchr/testify/assert" yaml "go.yaml.in/yaml/v3" ) diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index ebecf31c..cb50c84c 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -5,9 +5,9 @@ import ( "fmt" "time" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/model" ) type jobInfo interface { diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index efe35e65..e42bf610 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -9,9 +9,9 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/local_repository_cache.go b/act/runner/local_repository_cache.go index 984ee2cd..17b60c92 100644 --- a/act/runner/local_repository_cache.go +++ b/act/runner/local_repository_cache.go @@ -12,7 +12,7 @@ import ( "path/filepath" "strings" - "code.forgejo.org/forgejo/runner/v9/act/filecollector" + "code.forgejo.org/forgejo/runner/v11/act/filecollector" ) type LocalRepositoryCache struct { diff --git a/act/runner/logger.go b/act/runner/logger.go index 07261f27..f97292bf 100644 --- a/act/runner/logger.go +++ b/act/runner/logger.go @@ -10,7 +10,7 @@ import ( "strings" "sync" - "code.forgejo.org/forgejo/runner/v9/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common" "github.com/sirupsen/logrus" "golang.org/x/term" diff --git a/act/runner/reusable_workflow.go b/act/runner/reusable_workflow.go index acb4bf4d..5e92ee88 100644 --- a/act/runner/reusable_workflow.go +++ b/act/runner/reusable_workflow.go @@ -13,9 +13,9 @@ import ( "strings" "sync" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/common/git" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common/git" + "code.forgejo.org/forgejo/runner/v11/act/model" ) func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor { diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 86500854..f6978b64 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -21,10 +21,10 @@ import ( "text/template" "time" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/exprparser" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/exprparser" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/docker/docker/api/types/network" "github.com/docker/go-connections/nat" "github.com/opencontainers/selinux/go-selinux" diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 33f77466..110afb45 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -11,10 +11,10 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/exprparser" - "code.forgejo.org/forgejo/runner/v9/act/model" - "code.forgejo.org/forgejo/runner/v9/testutils" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/exprparser" + "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/testutils" "github.com/docker/go-connections/nat" log "github.com/sirupsen/logrus" diff --git a/act/runner/runner.go b/act/runner/runner.go index 29b4cc7a..8e8fba3a 100644 --- a/act/runner/runner.go +++ b/act/runner/runner.go @@ -11,8 +11,8 @@ import ( docker_container "github.com/docker/docker/api/types/container" log "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" ) // Runner provides capabilities to run GitHub actions diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 7f3b46e9..86c0ad6e 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -18,8 +18,8 @@ import ( "github.com/stretchr/testify/require" "go.yaml.in/yaml/v3" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" ) var ( diff --git a/act/runner/step.go b/act/runner/step.go index 57f37f89..25c67cfd 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -12,10 +12,10 @@ import ( "strings" "time" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/exprparser" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/exprparser" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/sirupsen/logrus" ) diff --git a/act/runner/step_action_local.go b/act/runner/step_action_local.go index e6529cc0..ef44e1c2 100644 --- a/act/runner/step_action_local.go +++ b/act/runner/step_action_local.go @@ -11,8 +11,8 @@ import ( "path" "path/filepath" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" ) type stepActionLocal struct { diff --git a/act/runner/step_action_local_test.go b/act/runner/step_action_local_test.go index d9bfdd3f..6286305a 100644 --- a/act/runner/step_action_local_test.go +++ b/act/runner/step_action_local_test.go @@ -8,8 +8,8 @@ import ( "strings" "testing" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" "go.yaml.in/yaml/v3" diff --git a/act/runner/step_action_remote.go b/act/runner/step_action_remote.go index 515320a7..9051c812 100644 --- a/act/runner/step_action_remote.go +++ b/act/runner/step_action_remote.go @@ -14,9 +14,9 @@ import ( gogit "github.com/go-git/go-git/v5" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/common/git" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common/git" + "code.forgejo.org/forgejo/runner/v11/act/model" ) type stepActionRemote struct { diff --git a/act/runner/step_action_remote_test.go b/act/runner/step_action_remote_test.go index 6c1a4db7..fb302da5 100644 --- a/act/runner/step_action_remote_test.go +++ b/act/runner/step_action_remote_test.go @@ -11,9 +11,9 @@ import ( "github.com/stretchr/testify/mock" "go.yaml.in/yaml/v3" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/common/git" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/common/git" + "code.forgejo.org/forgejo/runner/v11/act/model" ) type stepActionRemoteMocks struct { diff --git a/act/runner/step_docker.go b/act/runner/step_docker.go index 24cb467d..6f652674 100644 --- a/act/runner/step_docker.go +++ b/act/runner/step_docker.go @@ -5,9 +5,9 @@ import ( "fmt" "strings" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/kballard/go-shellquote" ) diff --git a/act/runner/step_docker_test.go b/act/runner/step_docker_test.go index c4f2b94f..1ba08858 100644 --- a/act/runner/step_docker_test.go +++ b/act/runner/step_docker_test.go @@ -6,8 +6,8 @@ import ( "io" "testing" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) diff --git a/act/runner/step_factory.go b/act/runner/step_factory.go index 6435d37e..e791c99b 100644 --- a/act/runner/step_factory.go +++ b/act/runner/step_factory.go @@ -3,7 +3,7 @@ package runner import ( "fmt" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" ) type stepFactory interface { diff --git a/act/runner/step_factory_test.go b/act/runner/step_factory_test.go index af8cf968..3a434bf9 100644 --- a/act/runner/step_factory_test.go +++ b/act/runner/step_factory_test.go @@ -3,7 +3,7 @@ package runner import ( "testing" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/assert" ) diff --git a/act/runner/step_run.go b/act/runner/step_run.go index 23e45a92..524314ca 100644 --- a/act/runner/step_run.go +++ b/act/runner/step_run.go @@ -9,10 +9,10 @@ import ( "github.com/kballard/go-shellquote" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/lookpath" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/lookpath" + "code.forgejo.org/forgejo/runner/v11/act/model" ) type stepRun struct { diff --git a/act/runner/step_run_test.go b/act/runner/step_run_test.go index 1fe376f2..3246c433 100644 --- a/act/runner/step_run_test.go +++ b/act/runner/step_run_test.go @@ -9,8 +9,8 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" - "code.forgejo.org/forgejo/runner/v9/act/container" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/container" + "code.forgejo.org/forgejo/runner/v11/act/model" ) func TestStepRun(t *testing.T) { diff --git a/act/runner/step_test.go b/act/runner/step_test.go index 74b83c6c..779e9966 100644 --- a/act/runner/step_test.go +++ b/act/runner/step_test.go @@ -4,8 +4,8 @@ import ( "context" "testing" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" diff --git a/go.mod b/go.mod index 12161f42..d5659438 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,4 @@ -module code.forgejo.org/forgejo/runner/v9 +module code.forgejo.org/forgejo/runner/v11 go 1.24 diff --git a/internal/app/cmd/cache-server.go b/internal/app/cmd/cache-server.go index ff233f19..36346d6e 100644 --- a/internal/app/cmd/cache-server.go +++ b/internal/app/cmd/cache-server.go @@ -9,9 +9,9 @@ import ( "os" "os/signal" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/act/artifactcache" + "code.forgejo.org/forgejo/runner/v11/act/artifactcache" log "github.com/sirupsen/logrus" "github.com/spf13/cobra" ) diff --git a/internal/app/cmd/cmd.go b/internal/app/cmd/cmd.go index 2f9bd3e4..e8db01de 100644 --- a/internal/app/cmd/cmd.go +++ b/internal/app/cmd/cmd.go @@ -10,9 +10,9 @@ import ( "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/common" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/common" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) func Execute(ctx context.Context) { diff --git a/internal/app/cmd/create-runner-file.go b/internal/app/cmd/create-runner-file.go index 0eeb713b..2a811b0a 100644 --- a/internal/app/cmd/create-runner-file.go +++ b/internal/app/cmd/create-runner-file.go @@ -14,10 +14,10 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/v9/internal/app/run" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v11/internal/app/run" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) type createRunnerFileArgs struct { diff --git a/internal/app/cmd/create-runner-file_test.go b/internal/app/cmd/create-runner-file_test.go index 9da01ae1..546a5d87 100644 --- a/internal/app/cmd/create-runner-file_test.go +++ b/internal/app/cmd/create-runner-file_test.go @@ -8,9 +8,9 @@ import ( "testing" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" "connectrpc.com/connect" "github.com/stretchr/testify/assert" diff --git a/internal/app/cmd/daemon.go b/internal/app/cmd/daemon.go index 22fd8c26..cb3d278a 100644 --- a/internal/app/cmd/daemon.go +++ b/internal/app/cmd/daemon.go @@ -18,13 +18,13 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/v9/internal/app/poll" - "code.forgejo.org/forgejo/runner/v9/internal/app/run" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/envcheck" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v11/internal/app/poll" + "code.forgejo.org/forgejo/runner/v11/internal/app/run" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/envcheck" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) func runDaemon(ctx context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go index a0694805..440387cf 100644 --- a/internal/app/cmd/exec.go +++ b/internal/app/cmd/exec.go @@ -14,10 +14,10 @@ import ( "strings" "time" - "code.forgejo.org/forgejo/runner/v9/act/artifactcache" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" - "code.forgejo.org/forgejo/runner/v9/act/runner" + "code.forgejo.org/forgejo/runner/v11/act/artifactcache" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/act/runner" "github.com/docker/docker/api/types/container" "github.com/joho/godotenv" log "github.com/sirupsen/logrus" diff --git a/internal/app/cmd/job.go b/internal/app/cmd/job.go index 3be1f635..d2e2c103 100644 --- a/internal/app/cmd/job.go +++ b/internal/app/cmd/job.go @@ -13,13 +13,13 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/v9/internal/app/job" - "code.forgejo.org/forgejo/runner/v9/internal/app/run" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/envcheck" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v11/internal/app/job" + "code.forgejo.org/forgejo/runner/v11/internal/app/run" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/envcheck" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) func runJob(ctx context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { diff --git a/internal/app/cmd/main_test.go b/internal/app/cmd/main_test.go index 588490e8..c83b122c 100644 --- a/internal/app/cmd/main_test.go +++ b/internal/app/cmd/main_test.go @@ -10,7 +10,7 @@ import ( "os" "testing" - "code.forgejo.org/forgejo/runner/v9/testutils" + "code.forgejo.org/forgejo/runner/v11/testutils" "github.com/spf13/cobra" "github.com/stretchr/testify/require" diff --git a/internal/app/cmd/register.go b/internal/app/cmd/register.go index a6a3d2cf..03831822 100644 --- a/internal/app/cmd/register.go +++ b/internal/app/cmd/register.go @@ -20,10 +20,10 @@ import ( log "github.com/sirupsen/logrus" "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) // runRegister registers a runner to the server diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index 3285ff6f..ca5ab732 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -13,8 +13,8 @@ import ( "path/filepath" "strings" - "code.forgejo.org/forgejo/runner/v9/act/model" - "code.forgejo.org/forgejo/runner/v9/testutils" + "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/testutils" "github.com/spf13/cobra" ) diff --git a/internal/app/job/job.go b/internal/app/job/job.go index 2dd06852..6babd498 100644 --- a/internal/app/job/job.go +++ b/internal/app/job/job.go @@ -13,9 +13,9 @@ import ( log "github.com/sirupsen/logrus" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/v9/internal/app/run" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/app/run" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" ) type Job struct { diff --git a/internal/app/job/job_test.go b/internal/app/job/job_test.go index 9799425b..225d744c 100644 --- a/internal/app/job/job_test.go +++ b/internal/app/job/job_test.go @@ -11,7 +11,7 @@ import ( "code.forgejo.org/forgejo/actions-proto/ping/v1/pingv1connect" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" "code.forgejo.org/forgejo/actions-proto/runner/v1/runnerv1connect" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" diff --git a/internal/app/poll/poller.go b/internal/app/poll/poller.go index 5a4061f8..452f356d 100644 --- a/internal/app/poll/poller.go +++ b/internal/app/poll/poller.go @@ -15,9 +15,9 @@ import ( log "github.com/sirupsen/logrus" "golang.org/x/time/rate" - "code.forgejo.org/forgejo/runner/v9/internal/app/run" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/app/run" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" ) const PollerID = "PollerID" diff --git a/internal/app/poll/poller_test.go b/internal/app/poll/poller_test.go index 7c8b7633..e3b23eb3 100644 --- a/internal/app/poll/poller_test.go +++ b/internal/app/poll/poller_test.go @@ -14,7 +14,7 @@ import ( "code.forgejo.org/forgejo/actions-proto/ping/v1/pingv1connect" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" "code.forgejo.org/forgejo/actions-proto/runner/v1/runnerv1connect" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" log "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 08682d1f..98e1c524 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -17,20 +17,20 @@ import ( "time" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/v9/act/artifactcache" - "code.forgejo.org/forgejo/runner/v9/act/cacheproxy" - "code.forgejo.org/forgejo/runner/v9/act/common" - "code.forgejo.org/forgejo/runner/v9/act/model" - "code.forgejo.org/forgejo/runner/v9/act/runner" + "code.forgejo.org/forgejo/runner/v11/act/artifactcache" + "code.forgejo.org/forgejo/runner/v11/act/cacheproxy" + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/act/runner" "connectrpc.com/connect" "github.com/docker/docker/api/types/container" log "github.com/sirupsen/logrus" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/report" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/report" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) // Runner runs the pipeline. diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 92e96452..b324b0f5 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -9,9 +9,9 @@ import ( pingv1 "code.forgejo.org/forgejo/actions-proto/ping/v1" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/config" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/labels" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/report" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/report" "connectrpc.com/connect" "google.golang.org/protobuf/types/known/structpb" diff --git a/internal/app/run/workflow.go b/internal/app/run/workflow.go index 2a0b3a0c..155eddb4 100644 --- a/internal/app/run/workflow.go +++ b/internal/app/run/workflow.go @@ -10,7 +10,7 @@ import ( "strings" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "go.yaml.in/yaml/v3" ) diff --git a/internal/app/run/workflow_test.go b/internal/app/run/workflow_test.go index f0ac579c..c98d85f6 100644 --- a/internal/app/run/workflow_test.go +++ b/internal/app/run/workflow_test.go @@ -7,7 +7,7 @@ import ( "testing" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" - "code.forgejo.org/forgejo/runner/v9/act/model" + "code.forgejo.org/forgejo/runner/v11/act/model" "github.com/stretchr/testify/require" "gotest.tools/v3/assert" ) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 42afe8e0..68fa3db4 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -19,8 +19,8 @@ import ( "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/timestamppb" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/common" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/common" ) var ( diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index 246d1699..bbb084b1 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -20,9 +20,9 @@ import ( "github.com/stretchr/testify/require" "google.golang.org/protobuf/types/known/structpb" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/client/mocks" - "code.forgejo.org/forgejo/runner/v9/internal/pkg/common" - "code.forgejo.org/forgejo/runner/v9/testutils" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client/mocks" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/common" + "code.forgejo.org/forgejo/runner/v11/testutils" ) func rowsToString(rows []*runnerv1.LogRow) string { diff --git a/internal/pkg/ver/version.go b/internal/pkg/ver/version.go index 9efc8739..7be5cca1 100644 --- a/internal/pkg/ver/version.go +++ b/internal/pkg/ver/version.go @@ -3,7 +3,7 @@ package ver -// go build -ldflags "-X code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=1.2.3" +// go build -ldflags "-X code.forgejo.org/forgejo/runner/v11/internal/pkg/ver.version=1.2.3" var version = "dev" func Version() string { diff --git a/main.go b/main.go index 498bd129..1356572f 100644 --- a/main.go +++ b/main.go @@ -8,7 +8,7 @@ import ( "os/signal" "syscall" - "code.forgejo.org/forgejo/runner/v9/internal/app/cmd" + "code.forgejo.org/forgejo/runner/v11/internal/app/cmd" ) func main() { From 39dd708768f1309971aa4c7c6145a6fc8bee5afc Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 4 Sep 2025 18:58:14 +0200 Subject: [PATCH 163/281] chore: cosmetic fixes --- act/artifactcache/handler_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index cc0b443c..8fc317b8 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -63,7 +63,7 @@ func TestHandler(t *testing.T) { base := fmt.Sprintf("%s%s", handler.ExternalURL(), urlBase) defer func() { - t.Run("inpect db", func(t *testing.T) { + t.Run("inspect db", func(t *testing.T) { db, err := handler.openDB() require.NoError(t, err) defer db.Close() From 98552f9b9961d6457b0024d0aa88e4fb60d8b12e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 4 Sep 2025 16:58:24 +0200 Subject: [PATCH 164/281] feat: cache-server: shutdown on TERM in the same way the daemon can be shutdown by either INT or TERM the cache server could only be shutdown with INT --- internal/app/cmd/cache-server.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/internal/app/cmd/cache-server.go b/internal/app/cmd/cache-server.go index 36346d6e..37bee855 100644 --- a/internal/app/cmd/cache-server.go +++ b/internal/app/cmd/cache-server.go @@ -8,6 +8,7 @@ import ( "fmt" "os" "os/signal" + "syscall" "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" @@ -73,7 +74,7 @@ func runCacheServer(ctx context.Context, configFile *string, cacheArgs *cacheSer log.Infof("cache server is listening on %v", cacheHandler.ExternalURL()) c := make(chan os.Signal, 1) - signal.Notify(c, os.Interrupt) + signal.Notify(c, syscall.SIGINT, syscall.SIGTERM) <-c return nil From 36ca627f2e0a415a7d47170830d9d8e14034f1e3 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 4 Sep 2025 16:55:26 +0200 Subject: [PATCH 165/281] feat: cache: fatal() helper to gracefully terminate the runner in case of an error that is not recoverable (e.g. failing to open the bolthold database), the cache can call fatal() to log the error and send a TERM signal that will gracefully shutdown the daemon. --- act/artifactcache/handler.go | 8 ++++++ act/artifactcache/handler_test.go | 43 +++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index ac7355d0..429b661c 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -13,6 +13,7 @@ import ( "strconv" "strings" "sync/atomic" + "syscall" "time" "github.com/julienschmidt/httprouter" @@ -27,6 +28,13 @@ const ( urlBase = "/_apis/artifactcache" ) +var fatal = func(logger logrus.FieldLogger, err error) { + logger.Errorf("unrecoverable error in the cache: %v", err) + if err := syscall.Kill(syscall.Getpid(), syscall.SIGTERM); err != nil { + logger.Errorf("unrecoverable error in the cache: failed to send the TERM signal to shutdown the daemon %v", err) + } +} + type Handler interface { ExternalURL() string Close() error diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index 8fc317b8..5970ea1a 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -4,11 +4,15 @@ import ( "bytes" "crypto/rand" "encoding/json" + "errors" "fmt" "io" "net/http" + "os" + "os/signal" "path/filepath" "strings" + "syscall" "testing" "time" @@ -1032,3 +1036,42 @@ func TestHandler_ExternalURL(t *testing.T) { assert.True(t, handler.isClosed()) }) } + +var ( + settleTime = 100 * time.Millisecond + fatalWaitingTime = 30 * time.Second +) + +func waitSig(t *testing.T, c <-chan os.Signal, sig os.Signal) { + t.Helper() + + // Sleep multiple times to give the kernel more tries to + // deliver the signal. + start := time.Now() + timer := time.NewTimer(settleTime / 10) + defer timer.Stop() + for time.Since(start) < fatalWaitingTime { + select { + case s := <-c: + if s == sig { + return + } + t.Fatalf("signal was %v, want %v", s, sig) + case <-timer.C: + timer.Reset(settleTime / 10) + } + } + t.Fatalf("timeout after %v waiting for %v", fatalWaitingTime, sig) +} + +func TestHandler_fatal(t *testing.T) { + c := make(chan os.Signal, 1) + signal.Notify(c, syscall.SIGTERM) + defer signal.Stop(c) + + discard := logrus.New() + discard.Out = io.Discard + fatal(discard, errors.New("fatal error")) + + waitSig(t, c, syscall.SIGTERM) +} From 37f634fd31a00534d0ee438bc640f07589afe98c Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 1 Sep 2025 13:37:57 +0200 Subject: [PATCH 166/281] fix: cache: call fatal() on errors that are not recoverable - responseFatalJSON(w, r, err) replaces responseJSON(w, r, 500, err) and calls fatal() when the following fail because they are not recoverable. There may be other non-recoverable errors but it is difficult to be 100% sure they cannot be engineered by the caller of the API for DoS purposes. - openDB - findCache - cache.Repo != repo - wrap errors in - openDB() - it was missing - readCache() - it was missing - useCache() - it was missing - findCache() - some had identical messages - in gc - replace logger.Warnf with h.fatal - differentiate errors that have identical messages - call fatal if openDB fails instead of returning --- act/artifactcache/handler.go | 66 +++++++++++++++++++------------ act/artifactcache/handler_test.go | 11 +++++- 2 files changed, 49 insertions(+), 28 deletions(-) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 429b661c..a325d68b 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -177,7 +177,8 @@ func (h *handler) isClosed() bool { } func (h *handler) openDB() (*bolthold.Store, error) { - return bolthold.Open(filepath.Join(h.dir, "bolt.db"), 0o644, &bolthold.Options{ + file := filepath.Join(h.dir, "bolt.db") + db, err := bolthold.Open(file, 0o644, &bolthold.Options{ Encoder: json.Marshal, Decoder: json.Unmarshal, Options: &bbolt.Options{ @@ -186,6 +187,10 @@ func (h *handler) openDB() (*bolthold.Store, error) { FreelistType: bbolt.DefaultOptions.FreelistType, }, }) + if err != nil { + return nil, fmt.Errorf("Open(%s): %v", file, err) + } + return db, nil } // GET /_apis/artifactcache/cache @@ -206,21 +211,21 @@ func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter db, err := h.openDB() if err != nil { - h.responseJSON(w, r, 500, err) + h.responseFatalJSON(w, r, err) return } defer db.Close() cache, err := findCache(db, repo, keys, version, rundata.WriteIsolationKey) if err != nil { - h.responseJSON(w, r, 500, err) + h.responseFatalJSON(w, r, err) return } // If read was scoped to WriteIsolationKey and didn't find anything, we can fallback to the non-isolated cache read if cache == nil && rundata.WriteIsolationKey != "" { cache, err = findCache(db, repo, keys, version, "") if err != nil { - h.responseJSON(w, r, 500, err) + h.responseFatalJSON(w, r, err) return } } @@ -265,7 +270,7 @@ func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprou cache := api.ToCache() db, err := h.openDB() if err != nil { - h.responseJSON(w, r, 500, err) + h.responseFatalJSON(w, r, err) return } defer db.Close() @@ -305,13 +310,13 @@ func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprout h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) return } - h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err)) + h.responseFatalJSON(w, r, fmt.Errorf("cache Get: %w", err)) return } - // Should not happen if cache.Repo != repo { - h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) + // can only happen if the cache is corrupted + h.responseFatalJSON(w, r, fmt.Errorf("cache repo is not valid")) return } if cache.WriteIsolationKey != rundata.WriteIsolationKey { @@ -360,13 +365,13 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) return } - h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err)) + h.responseFatalJSON(w, r, fmt.Errorf("cache Get: %w", err)) return } - // Should not happen if cache.Repo != repo { - h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) + // can only happen if the cache is corrupted + h.responseFatalJSON(w, r, fmt.Errorf("cache repo is not valid")) return } if cache.WriteIsolationKey != rundata.WriteIsolationKey { @@ -381,7 +386,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout size, err := h.storage.Commit(cache.ID, cache.Size) if err != nil { - h.responseJSON(w, r, 500, err) + h.responseJSON(w, r, 500, fmt.Errorf("commit(%v): %w", cache.ID, err)) return } // write real size back to cache, it may be different from the current value when the request doesn't specify it. @@ -389,7 +394,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout db, err := h.openDB() if err != nil { - h.responseJSON(w, r, 500, err) + h.responseFatalJSON(w, r, err) return } defer db.Close() @@ -424,13 +429,13 @@ func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter. h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) return } - h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err)) + h.responseFatalJSON(w, r, fmt.Errorf("cache Get: %w", err)) return } - // Should not happen if cache.Repo != repo { - h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) + // can only happen if the cache is corrupted + h.responseFatalJSON(w, r, fmt.Errorf("cache repo is not valid")) return } // reads permitted against caches w/ the same isolation key, or no isolation key @@ -481,7 +486,7 @@ func findCache(db *bolthold.Store, repo string, keys []string, version, writeIso And("Complete").Eq(true). SortBy("CreatedAt").Reverse()); err == nil || !errors.Is(err, bolthold.ErrNotFound) { if err != nil { - return nil, fmt.Errorf("find cache: %w", err) + return nil, fmt.Errorf("find cache entry equal to %s: %w", prefix, err) } return cache, nil } @@ -500,7 +505,7 @@ func findCache(db *bolthold.Store, repo string, keys []string, version, writeIso if errors.Is(err, bolthold.ErrNotFound) { continue } - return nil, fmt.Errorf("find cache: %w", err) + return nil, fmt.Errorf("find cache entry starting with %s: %w", prefix, err) } return cache, nil } @@ -526,7 +531,7 @@ func (h *handler) readCache(id uint64) (*Cache, error) { defer db.Close() cache := &Cache{} if err := db.Get(id, cache); err != nil { - return nil, err + return nil, fmt.Errorf("readCache: Get(%v): %w", id, err) } return cache, nil } @@ -539,10 +544,13 @@ func (h *handler) useCache(id uint64) error { defer db.Close() cache := &Cache{} if err := db.Get(id, cache); err != nil { - return err + return fmt.Errorf("useCache: Get(%v): %w", id, err) } cache.UsedAt = time.Now().Unix() - return db.Update(cache.ID, cache) + if err := db.Update(cache.ID, cache); err != nil { + return fmt.Errorf("useCache: Update(%v): %v", cache.ID, err) + } + return nil } const ( @@ -574,6 +582,7 @@ func (h *handler) gcCache() { db, err := h.openDB() if err != nil { + fatal(h.logger, err) return } defer db.Close() @@ -584,12 +593,12 @@ func (h *handler) gcCache() { Where("UsedAt").Lt(time.Now().Add(-keepTemp).Unix()). And("Complete").Eq(false), ); err != nil { - h.logger.Warnf("find caches: %v", err) + fatal(h.logger, fmt.Errorf("gc caches not completed: %v", err)) } else { for _, cache := range caches { h.storage.Remove(cache.ID) if err := db.Delete(cache.ID, cache); err != nil { - h.logger.Warnf("delete cache: %v", err) + h.logger.Errorf("delete cache: %v", err) continue } h.logger.Infof("deleted cache: %+v", cache) @@ -601,7 +610,7 @@ func (h *handler) gcCache() { if err := db.Find(&caches, bolthold. Where("UsedAt").Lt(time.Now().Add(-keepUnused).Unix()), ); err != nil { - h.logger.Warnf("find caches: %v", err) + fatal(h.logger, fmt.Errorf("gc caches old not used: %v", err)) } else { for _, cache := range caches { h.storage.Remove(cache.ID) @@ -618,7 +627,7 @@ func (h *handler) gcCache() { if err := db.Find(&caches, bolthold. Where("CreatedAt").Lt(time.Now().Add(-keepUsed).Unix()), ); err != nil { - h.logger.Warnf("find caches: %v", err) + fatal(h.logger, fmt.Errorf("gc caches too old: %v", err)) } else { for _, cache := range caches { h.storage.Remove(cache.ID) @@ -637,7 +646,7 @@ func (h *handler) gcCache() { bolthold.Where("Complete").Eq(true), "Key", "Version", ); err != nil { - h.logger.Warnf("find aggregate caches: %v", err) + fatal(h.logger, fmt.Errorf("gc aggregate caches: %v", err)) } else { for _, result := range results { if result.Count() <= 1 { @@ -663,6 +672,11 @@ func (h *handler) gcCache() { } } +func (h *handler) responseFatalJSON(w http.ResponseWriter, r *http.Request, err error) { + h.responseJSON(w, r, 500, err) + fatal(h.logger, err) +} + func (h *handler) responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) { w.Header().Set("Content-Type", "application/json; charset=utf-8") var data []byte diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index 5970ea1a..0c7160d6 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -16,10 +16,13 @@ import ( "testing" "time" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" + "code.forgejo.org/forgejo/runner/v9/testutils" + "github.com/sirupsen/logrus" "github.com/timshannon/bolthold" "go.etcd.io/bbolt" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" ) const ( @@ -59,6 +62,10 @@ var ( ) func TestHandler(t *testing.T) { + defer testutils.MockVariable(&fatal, func(_ logrus.FieldLogger, err error) { + t.Fatalf("unexpected call to fatal(%v)", err) + })() + dir := filepath.Join(t.TempDir(), "artifactcache") handler, err := StartHandler(dir, "", 0, "secret", nil) require.NoError(t, err) From 6c4e705f97d9bcbd277e0bb3b230f0287b934925 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 5 Sep 2025 11:17:57 +0200 Subject: [PATCH 167/281] chore: cache: split caches implementation out of handler - create the caches interface and matching cachesImpl - move the cache logic out of handler - openDB - readCache - useCache - gcCache - access to the storage struct - serve - commit - exist - write - add getCaches / setCaches to the handler interface so it can be used by tests. The caches test should be implemented independently in the future but this is a different kind of cleanup. - no functional change, minimal refactor --- act/artifactcache/caches.go | 305 ++++++++++++++++++++++++++++++ act/artifactcache/handler.go | 300 +++-------------------------- act/artifactcache/handler_test.go | 10 +- act/artifactcache/mac.go | 4 +- act/artifactcache/mac_test.go | 12 +- 5 files changed, 349 insertions(+), 282 deletions(-) create mode 100644 act/artifactcache/caches.go diff --git a/act/artifactcache/caches.go b/act/artifactcache/caches.go new file mode 100644 index 00000000..2f5fc0cf --- /dev/null +++ b/act/artifactcache/caches.go @@ -0,0 +1,305 @@ +package artifactcache + +import ( + "encoding/json" + "errors" + "fmt" + "io" + "net/http" + "os" + "path/filepath" + "regexp" + "sync/atomic" + "time" + + "github.com/sirupsen/logrus" + "github.com/timshannon/bolthold" + "go.etcd.io/bbolt" +) + +type caches interface { + openDB() (*bolthold.Store, error) + validateMac(rundata RunData) (string, error) + readCache(id uint64) (*Cache, error) + useCache(id uint64) error + setgcAt(at time.Time) + gcCache() + + serve(w http.ResponseWriter, r *http.Request, id uint64) + commit(id uint64, size int64) (int64, error) + exist(id uint64) (bool, error) + write(id, offset uint64, reader io.Reader) error +} + +type cachesImpl struct { + dir string + storage *Storage + logger logrus.FieldLogger + secret string + + gcing atomic.Bool + gcAt time.Time +} + +func newCaches(dir, secret string, logger logrus.FieldLogger) (caches, error) { + c := &cachesImpl{ + secret: secret, + } + + c.logger = logger + + if dir == "" { + home, err := os.UserHomeDir() + if err != nil { + return nil, err + } + dir = filepath.Join(home, ".cache", "actcache") + } + if err := os.MkdirAll(dir, 0o755); err != nil { + return nil, err + } + + c.dir = dir + + storage, err := NewStorage(filepath.Join(dir, "cache")) + if err != nil { + return nil, err + } + c.storage = storage + + c.gcCache() + + return c, nil +} + +func (c *cachesImpl) openDB() (*bolthold.Store, error) { + file := filepath.Join(c.dir, "bolt.db") + db, err := bolthold.Open(file, 0o644, &bolthold.Options{ + Encoder: json.Marshal, + Decoder: json.Unmarshal, + Options: &bbolt.Options{ + Timeout: 5 * time.Second, + NoGrowSync: bbolt.DefaultOptions.NoGrowSync, + FreelistType: bbolt.DefaultOptions.FreelistType, + }, + }) + if err != nil { + return nil, fmt.Errorf("Open(%s): %w", file, err) + } + return db, nil +} + +// if not found, return (nil, nil) instead of an error. +func findCache(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { + cache := &Cache{} + for _, prefix := range keys { + // if a key in the list matches exactly, don't return partial matches + if err := db.FindOne(cache, + bolthold.Where("Repo").Eq(repo).Index("Repo"). + And("Key").Eq(prefix). + And("Version").Eq(version). + And("WriteIsolationKey").Eq(writeIsolationKey). + And("Complete").Eq(true). + SortBy("CreatedAt").Reverse()); err == nil || !errors.Is(err, bolthold.ErrNotFound) { + if err != nil { + return nil, fmt.Errorf("find cache entry equal to %s: %w", prefix, err) + } + return cache, nil + } + prefixPattern := fmt.Sprintf("^%s", regexp.QuoteMeta(prefix)) + re, err := regexp.Compile(prefixPattern) + if err != nil { + continue + } + if err := db.FindOne(cache, + bolthold.Where("Repo").Eq(repo).Index("Repo"). + And("Key").RegExp(re). + And("Version").Eq(version). + And("WriteIsolationKey").Eq(writeIsolationKey). + And("Complete").Eq(true). + SortBy("CreatedAt").Reverse()); err != nil { + if errors.Is(err, bolthold.ErrNotFound) { + continue + } + return nil, fmt.Errorf("find cache entry starting with %s: %w", prefix, err) + } + return cache, nil + } + return nil, nil +} + +func insertCache(db *bolthold.Store, cache *Cache) error { + if err := db.Insert(bolthold.NextSequence(), cache); err != nil { + return fmt.Errorf("insert cache: %w", err) + } + // write back id to db + if err := db.Update(cache.ID, cache); err != nil { + return fmt.Errorf("write back id to db: %w", err) + } + return nil +} + +func (c *cachesImpl) readCache(id uint64) (*Cache, error) { + db, err := c.openDB() + if err != nil { + return nil, err + } + defer db.Close() + cache := &Cache{} + if err := db.Get(id, cache); err != nil { + return nil, fmt.Errorf("readCache: Get(%v): %w", id, err) + } + return cache, nil +} + +func (c *cachesImpl) useCache(id uint64) error { + db, err := c.openDB() + if err != nil { + return err + } + defer db.Close() + cache := &Cache{} + if err := db.Get(id, cache); err != nil { + return fmt.Errorf("useCache: Get(%v): %w", id, err) + } + cache.UsedAt = time.Now().Unix() + if err := db.Update(cache.ID, cache); err != nil { + return fmt.Errorf("useCache: Update(%v): %v", cache.ID, err) + } + return nil +} + +func (c *cachesImpl) serve(w http.ResponseWriter, r *http.Request, id uint64) { + c.storage.Serve(w, r, id) +} + +func (c *cachesImpl) commit(id uint64, size int64) (int64, error) { + return c.storage.Commit(id, size) +} + +func (c *cachesImpl) exist(id uint64) (bool, error) { + return c.storage.Exist(id) +} + +func (c *cachesImpl) write(id, offset uint64, reader io.Reader) error { + return c.storage.Write(id, offset, reader) +} + +const ( + keepUsed = 30 * 24 * time.Hour + keepUnused = 7 * 24 * time.Hour + keepTemp = 5 * time.Minute + keepOld = 5 * time.Minute +) + +func (c *cachesImpl) setgcAt(at time.Time) { + c.gcAt = at +} + +func (c *cachesImpl) gcCache() { + if c.gcing.Load() { + return + } + if !c.gcing.CompareAndSwap(false, true) { + return + } + defer c.gcing.Store(false) + + if time.Since(c.gcAt) < time.Hour { + c.logger.Debugf("skip gc: %v", c.gcAt.String()) + return + } + c.gcAt = time.Now() + c.logger.Debugf("gc: %v", c.gcAt.String()) + + db, err := c.openDB() + if err != nil { + fatal(c.logger, err) + return + } + defer db.Close() + + // Remove the caches which are not completed for a while, they are most likely to be broken. + var caches []*Cache + if err := db.Find(&caches, bolthold. + Where("UsedAt").Lt(time.Now().Add(-keepTemp).Unix()). + And("Complete").Eq(false), + ); err != nil { + fatal(c.logger, fmt.Errorf("gc caches not completed: %v", err)) + } else { + for _, cache := range caches { + c.storage.Remove(cache.ID) + if err := db.Delete(cache.ID, cache); err != nil { + c.logger.Errorf("delete cache: %v", err) + continue + } + c.logger.Infof("deleted cache: %+v", cache) + } + } + + // Remove the old caches which have not been used recently. + caches = caches[:0] + if err := db.Find(&caches, bolthold. + Where("UsedAt").Lt(time.Now().Add(-keepUnused).Unix()), + ); err != nil { + fatal(c.logger, fmt.Errorf("gc caches old not used: %v", err)) + } else { + for _, cache := range caches { + c.storage.Remove(cache.ID) + if err := db.Delete(cache.ID, cache); err != nil { + c.logger.Warnf("delete cache: %v", err) + continue + } + c.logger.Infof("deleted cache: %+v", cache) + } + } + + // Remove the old caches which are too old. + caches = caches[:0] + if err := db.Find(&caches, bolthold. + Where("CreatedAt").Lt(time.Now().Add(-keepUsed).Unix()), + ); err != nil { + fatal(c.logger, fmt.Errorf("gc caches too old: %v", err)) + } else { + for _, cache := range caches { + c.storage.Remove(cache.ID) + if err := db.Delete(cache.ID, cache); err != nil { + c.logger.Warnf("delete cache: %v", err) + continue + } + c.logger.Infof("deleted cache: %+v", cache) + } + } + + // Remove the old caches with the same key and version, keep the latest one. + // Also keep the olds which have been used recently for a while in case of the cache is still in use. + if results, err := db.FindAggregate( + &Cache{}, + bolthold.Where("Complete").Eq(true), + "Key", "Version", + ); err != nil { + fatal(c.logger, fmt.Errorf("gc aggregate caches: %v", err)) + } else { + for _, result := range results { + if result.Count() <= 1 { + continue + } + result.Sort("CreatedAt") + caches = caches[:0] + result.Reduction(&caches) + for _, cache := range caches[:len(caches)-1] { + if time.Since(time.Unix(cache.UsedAt, 0)) < keepOld { + // Keep it since it has been used recently, even if it's old. + // Or it could break downloading in process. + continue + } + c.storage.Remove(cache.ID) + if err := db.Delete(cache.ID, cache); err != nil { + c.logger.Warnf("delete cache: %v", err) + continue + } + c.logger.Infof("deleted cache: %+v", cache) + } + } + } +} diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index a325d68b..a4985ea3 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -7,19 +7,14 @@ import ( "io" "net" "net/http" - "os" - "path/filepath" - "regexp" "strconv" "strings" - "sync/atomic" "syscall" "time" "github.com/julienschmidt/httprouter" "github.com/sirupsen/logrus" "github.com/timshannon/bolthold" - "go.etcd.io/bbolt" "code.forgejo.org/forgejo/runner/v11/act/common" ) @@ -39,7 +34,8 @@ type Handler interface { ExternalURL() string Close() error isClosed() bool - openDB() (*bolthold.Store, error) + getCaches() caches + setCaches(caches caches) find(w http.ResponseWriter, r *http.Request, params httprouter.Params) reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params) upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) @@ -47,32 +43,21 @@ type Handler interface { get(w http.ResponseWriter, r *http.Request, params httprouter.Params) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) middleware(handler httprouter.Handle) httprouter.Handle - readCache(id uint64) (*Cache, error) - useCache(id uint64) error - setgcAt(at time.Time) - gcCache() responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) } type handler struct { - dir string - storage *Storage + caches caches router *httprouter.Router listener net.Listener server *http.Server logger logrus.FieldLogger - secret string - - gcing atomic.Bool - gcAt time.Time outboundIP string } func StartHandler(dir, outboundIP string, port uint16, secret string, logger logrus.FieldLogger) (Handler, error) { - h := &handler{ - secret: secret, - } + h := &handler{} if logger == nil { discard := logrus.New() @@ -82,24 +67,11 @@ func StartHandler(dir, outboundIP string, port uint16, secret string, logger log logger = logger.WithField("module", "artifactcache") h.logger = logger - if dir == "" { - home, err := os.UserHomeDir() - if err != nil { - return nil, err - } - dir = filepath.Join(home, ".cache", "actcache") - } - if err := os.MkdirAll(dir, 0o755); err != nil { - return nil, err - } - - h.dir = dir - - storage, err := NewStorage(filepath.Join(dir, "cache")) + caches, err := newCaches(dir, secret, logger) if err != nil { return nil, err } - h.storage = storage + h.caches = caches if outboundIP != "" { h.outboundIP = outboundIP @@ -119,8 +91,6 @@ func StartHandler(dir, outboundIP string, port uint16, secret string, logger log h.router = router - h.gcCache() - listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port)) // listen on all interfaces if err != nil { return nil, err @@ -176,27 +146,18 @@ func (h *handler) isClosed() bool { return h.listener == nil && h.server == nil } -func (h *handler) openDB() (*bolthold.Store, error) { - file := filepath.Join(h.dir, "bolt.db") - db, err := bolthold.Open(file, 0o644, &bolthold.Options{ - Encoder: json.Marshal, - Decoder: json.Unmarshal, - Options: &bbolt.Options{ - Timeout: 5 * time.Second, - NoGrowSync: bbolt.DefaultOptions.NoGrowSync, - FreelistType: bbolt.DefaultOptions.FreelistType, - }, - }) - if err != nil { - return nil, fmt.Errorf("Open(%s): %v", file, err) - } - return db, nil +func (h *handler) getCaches() caches { + return h.caches +} + +func (h *handler) setCaches(caches caches) { + h.caches = caches } // GET /_apis/artifactcache/cache func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) - repo, err := h.validateMac(rundata) + repo, err := h.caches.validateMac(rundata) if err != nil { h.responseJSON(w, r, 403, err) return @@ -209,7 +170,7 @@ func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter } version := r.URL.Query().Get("version") - db, err := h.openDB() + db, err := h.caches.openDB() if err != nil { h.responseFatalJSON(w, r, err) return @@ -234,7 +195,7 @@ func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter return } - if ok, err := h.storage.Exist(cache.ID); err != nil { + if ok, err := h.caches.exist(cache.ID); err != nil { h.responseJSON(w, r, 500, err) return } else if !ok { @@ -253,7 +214,7 @@ func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter // POST /_apis/artifactcache/caches func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) - repo, err := h.validateMac(rundata) + repo, err := h.caches.validateMac(rundata) if err != nil { h.responseJSON(w, r, 403, err) return @@ -268,7 +229,7 @@ func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprou api.Key = strings.ToLower(api.Key) cache := api.ToCache() - db, err := h.openDB() + db, err := h.caches.openDB() if err != nil { h.responseFatalJSON(w, r, err) return @@ -292,7 +253,7 @@ func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprou // PATCH /_apis/artifactcache/caches/:id func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) - repo, err := h.validateMac(rundata) + repo, err := h.caches.validateMac(rundata) if err != nil { h.responseJSON(w, r, 403, err) return @@ -304,7 +265,7 @@ func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprout return } - cache, err := h.readCache(id) + cache, err := h.caches.readCache(id) if err != nil { if errors.Is(err, bolthold.ErrNotFound) { h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) @@ -333,11 +294,11 @@ func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprout h.responseJSON(w, r, 400, fmt.Errorf("cache parseContentRange(%s): %w", r.Header.Get("Content-Range"), err)) return } - if err := h.storage.Write(cache.ID, start, r.Body); err != nil { + if err := h.caches.write(cache.ID, start, r.Body); err != nil { h.responseJSON(w, r, 500, fmt.Errorf("cache storage.Write: %w", err)) return } - if err := h.useCache(id); err != nil { + if err := h.caches.useCache(id); err != nil { h.responseJSON(w, r, 500, fmt.Errorf("cache useCache: %w", err)) return } @@ -347,7 +308,7 @@ func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprout // POST /_apis/artifactcache/caches/:id func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) - repo, err := h.validateMac(rundata) + repo, err := h.caches.validateMac(rundata) if err != nil { h.responseJSON(w, r, 403, err) return @@ -359,7 +320,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout return } - cache, err := h.readCache(id) + cache, err := h.caches.readCache(id) if err != nil { if errors.Is(err, bolthold.ErrNotFound) { h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) @@ -384,7 +345,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout return } - size, err := h.storage.Commit(cache.ID, cache.Size) + size, err := h.caches.commit(cache.ID, cache.Size) if err != nil { h.responseJSON(w, r, 500, fmt.Errorf("commit(%v): %w", cache.ID, err)) return @@ -392,7 +353,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout // write real size back to cache, it may be different from the current value when the request doesn't specify it. cache.Size = size - db, err := h.openDB() + db, err := h.caches.openDB() if err != nil { h.responseFatalJSON(w, r, err) return @@ -411,7 +372,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout // GET /_apis/artifactcache/artifacts/:id func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter.Params) { rundata := runDataFromHeaders(r) - repo, err := h.validateMac(rundata) + repo, err := h.caches.validateMac(rundata) if err != nil { h.responseJSON(w, r, 403, err) return @@ -423,7 +384,7 @@ func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter. return } - cache, err := h.readCache(id) + cache, err := h.caches.readCache(id) if err != nil { if errors.Is(err, bolthold.ErrNotFound) { h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) @@ -444,17 +405,17 @@ func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter. return } - if err := h.useCache(id); err != nil { + if err := h.caches.useCache(id); err != nil { h.responseJSON(w, r, 500, fmt.Errorf("cache useCache: %w", err)) return } - h.storage.Serve(w, r, id) + h.caches.serve(w, r, id) } // POST /_apis/artifactcache/clean func (h *handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) { rundata := runDataFromHeaders(r) - _, err := h.validateMac(rundata) + _, err := h.caches.validateMac(rundata) if err != nil { h.responseJSON(w, r, 403, err) return @@ -469,206 +430,7 @@ func (h *handler) middleware(handler httprouter.Handle) httprouter.Handle { return func(w http.ResponseWriter, r *http.Request, params httprouter.Params) { h.logger.Debugf("%s %s", r.Method, r.RequestURI) handler(w, r, params) - go h.gcCache() - } -} - -// if not found, return (nil, nil) instead of an error. -func findCache(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { - cache := &Cache{} - for _, prefix := range keys { - // if a key in the list matches exactly, don't return partial matches - if err := db.FindOne(cache, - bolthold.Where("Repo").Eq(repo).Index("Repo"). - And("Key").Eq(prefix). - And("Version").Eq(version). - And("WriteIsolationKey").Eq(writeIsolationKey). - And("Complete").Eq(true). - SortBy("CreatedAt").Reverse()); err == nil || !errors.Is(err, bolthold.ErrNotFound) { - if err != nil { - return nil, fmt.Errorf("find cache entry equal to %s: %w", prefix, err) - } - return cache, nil - } - prefixPattern := fmt.Sprintf("^%s", regexp.QuoteMeta(prefix)) - re, err := regexp.Compile(prefixPattern) - if err != nil { - continue - } - if err := db.FindOne(cache, - bolthold.Where("Repo").Eq(repo).Index("Repo"). - And("Key").RegExp(re). - And("Version").Eq(version). - And("WriteIsolationKey").Eq(writeIsolationKey). - And("Complete").Eq(true). - SortBy("CreatedAt").Reverse()); err != nil { - if errors.Is(err, bolthold.ErrNotFound) { - continue - } - return nil, fmt.Errorf("find cache entry starting with %s: %w", prefix, err) - } - return cache, nil - } - return nil, nil -} - -func insertCache(db *bolthold.Store, cache *Cache) error { - if err := db.Insert(bolthold.NextSequence(), cache); err != nil { - return fmt.Errorf("insert cache: %w", err) - } - // write back id to db - if err := db.Update(cache.ID, cache); err != nil { - return fmt.Errorf("write back id to db: %w", err) - } - return nil -} - -func (h *handler) readCache(id uint64) (*Cache, error) { - db, err := h.openDB() - if err != nil { - return nil, err - } - defer db.Close() - cache := &Cache{} - if err := db.Get(id, cache); err != nil { - return nil, fmt.Errorf("readCache: Get(%v): %w", id, err) - } - return cache, nil -} - -func (h *handler) useCache(id uint64) error { - db, err := h.openDB() - if err != nil { - return err - } - defer db.Close() - cache := &Cache{} - if err := db.Get(id, cache); err != nil { - return fmt.Errorf("useCache: Get(%v): %w", id, err) - } - cache.UsedAt = time.Now().Unix() - if err := db.Update(cache.ID, cache); err != nil { - return fmt.Errorf("useCache: Update(%v): %v", cache.ID, err) - } - return nil -} - -const ( - keepUsed = 30 * 24 * time.Hour - keepUnused = 7 * 24 * time.Hour - keepTemp = 5 * time.Minute - keepOld = 5 * time.Minute -) - -func (h *handler) setgcAt(at time.Time) { - h.gcAt = at -} - -func (h *handler) gcCache() { - if h.gcing.Load() { - return - } - if !h.gcing.CompareAndSwap(false, true) { - return - } - defer h.gcing.Store(false) - - if time.Since(h.gcAt) < time.Hour { - h.logger.Debugf("skip gc: %v", h.gcAt.String()) - return - } - h.gcAt = time.Now() - h.logger.Debugf("gc: %v", h.gcAt.String()) - - db, err := h.openDB() - if err != nil { - fatal(h.logger, err) - return - } - defer db.Close() - - // Remove the caches which are not completed for a while, they are most likely to be broken. - var caches []*Cache - if err := db.Find(&caches, bolthold. - Where("UsedAt").Lt(time.Now().Add(-keepTemp).Unix()). - And("Complete").Eq(false), - ); err != nil { - fatal(h.logger, fmt.Errorf("gc caches not completed: %v", err)) - } else { - for _, cache := range caches { - h.storage.Remove(cache.ID) - if err := db.Delete(cache.ID, cache); err != nil { - h.logger.Errorf("delete cache: %v", err) - continue - } - h.logger.Infof("deleted cache: %+v", cache) - } - } - - // Remove the old caches which have not been used recently. - caches = caches[:0] - if err := db.Find(&caches, bolthold. - Where("UsedAt").Lt(time.Now().Add(-keepUnused).Unix()), - ); err != nil { - fatal(h.logger, fmt.Errorf("gc caches old not used: %v", err)) - } else { - for _, cache := range caches { - h.storage.Remove(cache.ID) - if err := db.Delete(cache.ID, cache); err != nil { - h.logger.Warnf("delete cache: %v", err) - continue - } - h.logger.Infof("deleted cache: %+v", cache) - } - } - - // Remove the old caches which are too old. - caches = caches[:0] - if err := db.Find(&caches, bolthold. - Where("CreatedAt").Lt(time.Now().Add(-keepUsed).Unix()), - ); err != nil { - fatal(h.logger, fmt.Errorf("gc caches too old: %v", err)) - } else { - for _, cache := range caches { - h.storage.Remove(cache.ID) - if err := db.Delete(cache.ID, cache); err != nil { - h.logger.Warnf("delete cache: %v", err) - continue - } - h.logger.Infof("deleted cache: %+v", cache) - } - } - - // Remove the old caches with the same key and version, keep the latest one. - // Also keep the olds which have been used recently for a while in case of the cache is still in use. - if results, err := db.FindAggregate( - &Cache{}, - bolthold.Where("Complete").Eq(true), - "Key", "Version", - ); err != nil { - fatal(h.logger, fmt.Errorf("gc aggregate caches: %v", err)) - } else { - for _, result := range results { - if result.Count() <= 1 { - continue - } - result.Sort("CreatedAt") - caches = caches[:0] - result.Reduction(&caches) - for _, cache := range caches[:len(caches)-1] { - if time.Since(time.Unix(cache.UsedAt, 0)) < keepOld { - // Keep it since it has been used recently, even if it's old. - // Or it could break downloading in process. - continue - } - h.storage.Remove(cache.ID) - if err := db.Delete(cache.ID, cache); err != nil { - h.logger.Warnf("delete cache: %v", err) - continue - } - h.logger.Infof("deleted cache: %+v", cache) - } - } + go h.caches.gcCache() } } diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index 0c7160d6..a1495015 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -75,7 +75,7 @@ func TestHandler(t *testing.T) { defer func() { t.Run("inspect db", func(t *testing.T) { - db, err := handler.openDB() + db, err := handler.getCaches().openDB() require.NoError(t, err) defer db.Close() require.NoError(t, db.Bolt().View(func(tx *bbolt.Tx) error { @@ -986,17 +986,17 @@ func TestHandler_gcCache(t *testing.T) { }, } - db, err := handler.openDB() + db, err := handler.getCaches().openDB() require.NoError(t, err) for _, c := range cases { require.NoError(t, insertCache(db, c.Cache)) } require.NoError(t, db.Close()) - handler.setgcAt(time.Time{}) // ensure gcCache will not skip - handler.gcCache() + handler.getCaches().setgcAt(time.Time{}) // ensure gcCache will not skip + handler.getCaches().gcCache() - db, err = handler.openDB() + db, err = handler.getCaches().openDB() require.NoError(t, err) for i, v := range cases { t.Run(fmt.Sprintf("%d_%s", i, v.Cache.Key), func(t *testing.T) { diff --git a/act/artifactcache/mac.go b/act/artifactcache/mac.go index 5b8ca3fb..aa9a7c54 100644 --- a/act/artifactcache/mac.go +++ b/act/artifactcache/mac.go @@ -14,13 +14,13 @@ import ( var ErrValidation = errors.New("validation error") -func (h *handler) validateMac(rundata RunData) (string, error) { +func (c *cachesImpl) validateMac(rundata RunData) (string, error) { // TODO: allow configurable max age if !validateAge(rundata.Timestamp) { return "", ErrValidation } - expectedMAC := ComputeMac(h.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp, rundata.WriteIsolationKey) + expectedMAC := ComputeMac(c.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp, rundata.WriteIsolationKey) if hmac.Equal([]byte(expectedMAC), []byte(rundata.RepositoryMAC)) { return rundata.RepositoryFullName, nil } diff --git a/act/artifactcache/mac_test.go b/act/artifactcache/mac_test.go index f51461e3..91607386 100644 --- a/act/artifactcache/mac_test.go +++ b/act/artifactcache/mac_test.go @@ -9,7 +9,7 @@ import ( ) func TestMac(t *testing.T) { - handler := &handler{ + cache := &cachesImpl{ secret: "secret for testing", } @@ -18,7 +18,7 @@ func TestMac(t *testing.T) { run := "1" ts := strconv.FormatInt(time.Now().Unix(), 10) - mac := ComputeMac(handler.secret, name, run, ts, "") + mac := ComputeMac(cache.secret, name, run, ts, "") rundata := RunData{ RepositoryFullName: name, RunNumber: run, @@ -26,7 +26,7 @@ func TestMac(t *testing.T) { RepositoryMAC: mac, } - repoName, err := handler.validateMac(rundata) + repoName, err := cache.validateMac(rundata) require.NoError(t, err) require.Equal(t, name, repoName) }) @@ -36,7 +36,7 @@ func TestMac(t *testing.T) { run := "1" ts := "9223372036854775807" // This should last us for a while... - mac := ComputeMac(handler.secret, name, run, ts, "") + mac := ComputeMac(cache.secret, name, run, ts, "") rundata := RunData{ RepositoryFullName: name, RunNumber: run, @@ -44,7 +44,7 @@ func TestMac(t *testing.T) { RepositoryMAC: mac, } - _, err := handler.validateMac(rundata) + _, err := cache.validateMac(rundata) require.Error(t, err) }) @@ -60,7 +60,7 @@ func TestMac(t *testing.T) { RepositoryMAC: "this is not the right mac :D", } - repoName, err := handler.validateMac(rundata) + repoName, err := cache.validateMac(rundata) require.Error(t, err) require.Equal(t, "", repoName) }) From c28a98082b6162ce3338696adbcc56680bc18248 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 5 Sep 2025 15:00:38 +0200 Subject: [PATCH 168/281] chore: cache: move repo != cache.Repo in readCache - it only is used after calling readCache - add unit test it reduces the number of testcase to be considered in handler --- act/artifactcache/caches.go | 8 +++-- act/artifactcache/caches_test.go | 54 ++++++++++++++++++++++++++++++++ act/artifactcache/handler.go | 21 ++----------- 3 files changed, 63 insertions(+), 20 deletions(-) create mode 100644 act/artifactcache/caches_test.go diff --git a/act/artifactcache/caches.go b/act/artifactcache/caches.go index 2f5fc0cf..014a6011 100644 --- a/act/artifactcache/caches.go +++ b/act/artifactcache/caches.go @@ -20,7 +20,7 @@ import ( type caches interface { openDB() (*bolthold.Store, error) validateMac(rundata RunData) (string, error) - readCache(id uint64) (*Cache, error) + readCache(id uint64, repo string) (*Cache, error) useCache(id uint64) error setgcAt(at time.Time) gcCache() @@ -139,7 +139,7 @@ func insertCache(db *bolthold.Store, cache *Cache) error { return nil } -func (c *cachesImpl) readCache(id uint64) (*Cache, error) { +func (c *cachesImpl) readCache(id uint64, repo string) (*Cache, error) { db, err := c.openDB() if err != nil { return nil, err @@ -149,6 +149,10 @@ func (c *cachesImpl) readCache(id uint64) (*Cache, error) { if err := db.Get(id, cache); err != nil { return nil, fmt.Errorf("readCache: Get(%v): %w", id, err) } + if cache.Repo != repo { + return nil, fmt.Errorf("readCache: Get(%v): cache.Repo %s != repo %s", id, cache.Repo, repo) + } + return cache, nil } diff --git a/act/artifactcache/caches_test.go b/act/artifactcache/caches_test.go new file mode 100644 index 00000000..a08a9af7 --- /dev/null +++ b/act/artifactcache/caches_test.go @@ -0,0 +1,54 @@ +package artifactcache + +import ( + "testing" + "time" + + "github.com/sirupsen/logrus" + "github.com/timshannon/bolthold" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestCacheReadWrite(t *testing.T) { + caches, err := newCaches(t.TempDir(), "secret", logrus.New()) + require.NoError(t, err) + t.Run("NotFound", func(t *testing.T) { + found, err := caches.readCache(456, "repo") + assert.Nil(t, found) + assert.ErrorIs(t, err, bolthold.ErrNotFound) + }) + + repo := "repository" + cache := &Cache{ + Repo: repo, + Key: "key", + Version: "version", + Size: 444, + } + now := time.Now().Unix() + cache.CreatedAt = now + cache.UsedAt = now + cache.Repo = repo + + t.Run("Insert", func(t *testing.T) { + db, err := caches.openDB() + require.NoError(t, err) + defer db.Close() + assert.NoError(t, insertCache(db, cache)) + }) + + t.Run("Found", func(t *testing.T) { + found, err := caches.readCache(cache.ID, cache.Repo) + require.NoError(t, err) + assert.Equal(t, cache.ID, found.ID) + }) + + t.Run("InvalidRepo", func(t *testing.T) { + invalidRepo := "INVALID REPO" + found, err := caches.readCache(cache.ID, invalidRepo) + assert.Nil(t, found) + assert.ErrorContains(t, err, invalidRepo) + }) +} diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index a4985ea3..d8a56e19 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -265,7 +265,7 @@ func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprout return } - cache, err := h.caches.readCache(id) + cache, err := h.caches.readCache(id, repo) if err != nil { if errors.Is(err, bolthold.ErrNotFound) { h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) @@ -275,11 +275,6 @@ func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprout return } - if cache.Repo != repo { - // can only happen if the cache is corrupted - h.responseFatalJSON(w, r, fmt.Errorf("cache repo is not valid")) - return - } if cache.WriteIsolationKey != rundata.WriteIsolationKey { h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey)) return @@ -320,7 +315,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout return } - cache, err := h.caches.readCache(id) + cache, err := h.caches.readCache(id, repo) if err != nil { if errors.Is(err, bolthold.ErrNotFound) { h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) @@ -330,11 +325,6 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout return } - if cache.Repo != repo { - // can only happen if the cache is corrupted - h.responseFatalJSON(w, r, fmt.Errorf("cache repo is not valid")) - return - } if cache.WriteIsolationKey != rundata.WriteIsolationKey { h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey)) return @@ -384,7 +374,7 @@ func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter. return } - cache, err := h.caches.readCache(id) + cache, err := h.caches.readCache(id, repo) if err != nil { if errors.Is(err, bolthold.ErrNotFound) { h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) @@ -394,11 +384,6 @@ func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter. return } - if cache.Repo != repo { - // can only happen if the cache is corrupted - h.responseFatalJSON(w, r, fmt.Errorf("cache repo is not valid")) - return - } // reads permitted against caches w/ the same isolation key, or no isolation key if cache.WriteIsolationKey != rundata.WriteIsolationKey && cache.WriteIsolationKey != "" { h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey)) From c48accfb518dab0305dd935d9663724399b9c1d6 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 5 Sep 2025 15:03:52 +0200 Subject: [PATCH 169/281] chore: cache: generate mocks for act/artifactcache/caches.go --- Makefile | 4 +- act/artifactcache/caches.go | 1 + act/artifactcache/mock_caches.go | 230 ++++++++++++++++++++++++++++ internal/pkg/client/mocks/Client.go | 2 +- 4 files changed, 234 insertions(+), 3 deletions(-) create mode 100644 act/artifactcache/mock_caches.go diff --git a/Makefile b/Makefile index 1b4890ec..06029b7f 100644 --- a/Makefile +++ b/Makefile @@ -62,7 +62,7 @@ else endif endif -GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/v11/internal/pkg/client/mocks,$(shell $(GO) list ./...)) +GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/v11/internal/pkg/client/mocks code.forgejo.org/forgejo/runner/v11/act/artifactcache/mock_caches.go,$(shell $(GO) list ./...)) TAGS ?= LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver.version=v$(RELEASE_VERSION)" @@ -120,7 +120,7 @@ vet: .PHONY: generate generate: - $(GO) generate ./internal/... + $(GO) generate ./... install: $(GOFILES) $(GO) install -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)' diff --git a/act/artifactcache/caches.go b/act/artifactcache/caches.go index 014a6011..16b3204d 100644 --- a/act/artifactcache/caches.go +++ b/act/artifactcache/caches.go @@ -17,6 +17,7 @@ import ( "go.etcd.io/bbolt" ) +//go:generate mockery --inpackage --name caches type caches interface { openDB() (*bolthold.Store, error) validateMac(rundata RunData) (string, error) diff --git a/act/artifactcache/mock_caches.go b/act/artifactcache/mock_caches.go new file mode 100644 index 00000000..9d484f80 --- /dev/null +++ b/act/artifactcache/mock_caches.go @@ -0,0 +1,230 @@ +// Code generated by mockery v2.53.5. DO NOT EDIT. + +package artifactcache + +import ( + http "net/http" + + bolthold "github.com/timshannon/bolthold" + + io "io" + + mock "github.com/stretchr/testify/mock" + + time "time" +) + +// mockCaches is an autogenerated mock type for the caches type +type mockCaches struct { + mock.Mock +} + +// commit provides a mock function with given fields: id, size +func (_m *mockCaches) commit(id uint64, size int64) (int64, error) { + ret := _m.Called(id, size) + + if len(ret) == 0 { + panic("no return value specified for commit") + } + + var r0 int64 + var r1 error + if rf, ok := ret.Get(0).(func(uint64, int64) (int64, error)); ok { + return rf(id, size) + } + if rf, ok := ret.Get(0).(func(uint64, int64) int64); ok { + r0 = rf(id, size) + } else { + r0 = ret.Get(0).(int64) + } + + if rf, ok := ret.Get(1).(func(uint64, int64) error); ok { + r1 = rf(id, size) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// exist provides a mock function with given fields: id +func (_m *mockCaches) exist(id uint64) (bool, error) { + ret := _m.Called(id) + + if len(ret) == 0 { + panic("no return value specified for exist") + } + + var r0 bool + var r1 error + if rf, ok := ret.Get(0).(func(uint64) (bool, error)); ok { + return rf(id) + } + if rf, ok := ret.Get(0).(func(uint64) bool); ok { + r0 = rf(id) + } else { + r0 = ret.Get(0).(bool) + } + + if rf, ok := ret.Get(1).(func(uint64) error); ok { + r1 = rf(id) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// gcCache provides a mock function with no fields +func (_m *mockCaches) gcCache() { + _m.Called() +} + +// openDB provides a mock function with no fields +func (_m *mockCaches) openDB() (*bolthold.Store, error) { + ret := _m.Called() + + if len(ret) == 0 { + panic("no return value specified for openDB") + } + + var r0 *bolthold.Store + var r1 error + if rf, ok := ret.Get(0).(func() (*bolthold.Store, error)); ok { + return rf() + } + if rf, ok := ret.Get(0).(func() *bolthold.Store); ok { + r0 = rf() + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*bolthold.Store) + } + } + + if rf, ok := ret.Get(1).(func() error); ok { + r1 = rf() + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// readCache provides a mock function with given fields: id, repo +func (_m *mockCaches) readCache(id uint64, repo string) (*Cache, error) { + ret := _m.Called(id, repo) + + if len(ret) == 0 { + panic("no return value specified for readCache") + } + + var r0 *Cache + var r1 error + if rf, ok := ret.Get(0).(func(uint64, string) (*Cache, error)); ok { + return rf(id, repo) + } + if rf, ok := ret.Get(0).(func(uint64, string) *Cache); ok { + r0 = rf(id, repo) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*Cache) + } + } + + if rf, ok := ret.Get(1).(func(uint64, string) error); ok { + r1 = rf(id, repo) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// serve provides a mock function with given fields: w, r, id +func (_m *mockCaches) serve(w http.ResponseWriter, r *http.Request, id uint64) { + _m.Called(w, r, id) +} + +// setgcAt provides a mock function with given fields: at +func (_m *mockCaches) setgcAt(at time.Time) { + _m.Called(at) +} + +// useCache provides a mock function with given fields: id +func (_m *mockCaches) useCache(id uint64) error { + ret := _m.Called(id) + + if len(ret) == 0 { + panic("no return value specified for useCache") + } + + var r0 error + if rf, ok := ret.Get(0).(func(uint64) error); ok { + r0 = rf(id) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// validateMac provides a mock function with given fields: rundata +func (_m *mockCaches) validateMac(rundata RunData) (string, error) { + ret := _m.Called(rundata) + + if len(ret) == 0 { + panic("no return value specified for validateMac") + } + + var r0 string + var r1 error + if rf, ok := ret.Get(0).(func(RunData) (string, error)); ok { + return rf(rundata) + } + if rf, ok := ret.Get(0).(func(RunData) string); ok { + r0 = rf(rundata) + } else { + r0 = ret.Get(0).(string) + } + + if rf, ok := ret.Get(1).(func(RunData) error); ok { + r1 = rf(rundata) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// write provides a mock function with given fields: id, offset, reader +func (_m *mockCaches) write(id uint64, offset uint64, reader io.Reader) error { + ret := _m.Called(id, offset, reader) + + if len(ret) == 0 { + panic("no return value specified for write") + } + + var r0 error + if rf, ok := ret.Get(0).(func(uint64, uint64, io.Reader) error); ok { + r0 = rf(id, offset, reader) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// newMockCaches creates a new instance of mockCaches. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. +// The first argument is typically a *testing.T value. +func newMockCaches(t interface { + mock.TestingT + Cleanup(func()) +}, +) *mockCaches { + mock := &mockCaches{} + mock.Mock.Test(t) + + t.Cleanup(func() { mock.AssertExpectations(t) }) + + return mock +} diff --git a/internal/pkg/client/mocks/Client.go b/internal/pkg/client/mocks/Client.go index f2ea5fe2..3b3ab6cb 100644 --- a/internal/pkg/client/mocks/Client.go +++ b/internal/pkg/client/mocks/Client.go @@ -1,4 +1,4 @@ -// Code generated by mockery v2.53.4. DO NOT EDIT. +// Code generated by mockery v2.53.5. DO NOT EDIT. package mocks From 5f0b036e34966fc3eafa46e2df94cbf1ef58e2fc Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 5 Sep 2025 17:21:53 +0200 Subject: [PATCH 170/281] chore: cache: move findCacheWithIsolationKeyFallback out of handler.find --- act/artifactcache/caches.go | 15 +++++++++++++++ act/artifactcache/handler.go | 10 +--------- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/act/artifactcache/caches.go b/act/artifactcache/caches.go index 16b3204d..6d499c8a 100644 --- a/act/artifactcache/caches.go +++ b/act/artifactcache/caches.go @@ -90,6 +90,21 @@ func (c *cachesImpl) openDB() (*bolthold.Store, error) { return db, nil } +var findCacheWithIsolationKeyFallback = func(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { + cache, err := findCache(db, repo, keys, version, writeIsolationKey) + if err != nil { + return nil, err + } + // If read was scoped to WriteIsolationKey and didn't find anything, we can fallback to the non-isolated cache read + if cache == nil && writeIsolationKey != "" { + cache, err = findCache(db, repo, keys, version, "") + if err != nil { + return nil, err + } + } + return cache, nil +} + // if not found, return (nil, nil) instead of an error. func findCache(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { cache := &Cache{} diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index d8a56e19..0b574397 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -177,19 +177,11 @@ func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter } defer db.Close() - cache, err := findCache(db, repo, keys, version, rundata.WriteIsolationKey) + cache, err := findCacheWithIsolationKeyFallback(db, repo, keys, version, rundata.WriteIsolationKey) if err != nil { h.responseFatalJSON(w, r, err) return } - // If read was scoped to WriteIsolationKey and didn't find anything, we can fallback to the non-isolated cache read - if cache == nil && rundata.WriteIsolationKey != "" { - cache, err = findCache(db, repo, keys, version, "") - if err != nil { - h.responseFatalJSON(w, r, err) - return - } - } if cache == nil { h.responseJSON(w, r, 204) return From c7e2db2559271722ea1976ea5a5dea9b4f5c1b4f Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 5 Sep 2025 17:24:36 +0200 Subject: [PATCH 171/281] chore: cache: handler: test coverage for fatal errors --- act/artifactcache/handler_test.go | 154 +++++++++++++++++++++++++++++- 1 file changed, 153 insertions(+), 1 deletion(-) diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index a1495015..136f1a87 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -8,6 +8,7 @@ import ( "fmt" "io" "net/http" + "net/http/httptest" "os" "os/signal" "path/filepath" @@ -16,8 +17,10 @@ import ( "testing" "time" - "code.forgejo.org/forgejo/runner/v9/testutils" + "code.forgejo.org/forgejo/runner/v11/testutils" + "github.com/julienschmidt/httprouter" "github.com/sirupsen/logrus" + "github.com/stretchr/testify/mock" "github.com/timshannon/bolthold" "go.etcd.io/bbolt" @@ -903,6 +906,155 @@ func uploadCacheNormally(t *testing.T, base, key, version, writeIsolationKey str } } +func TestHandlerAPIFatalErrors(t *testing.T) { + for _, testCase := range []struct { + name string + prepare func(message string) func() + caches func(t *testing.T, message string) caches + call func(t *testing.T, handler Handler, w http.ResponseWriter) + }{ + { + name: "find", + prepare: func(message string) func() { + return testutils.MockVariable(&findCacheWithIsolationKeyFallback, func(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { + return nil, errors.New(message) + }) + }, + caches: func(t *testing.T, message string) caches { + caches, err := newCaches(t.TempDir(), "secret", logrus.New()) + require.NoError(t, err) + return caches + }, + call: func(t *testing.T, handler Handler, w http.ResponseWriter) { + keyOne := "ONE" + req, err := http.NewRequest("GET", fmt.Sprintf("http://example.com/cache?keys=%s", keyOne), nil) + require.NoError(t, err) + req.Header.Set("Forgejo-Cache-Repo", cacheRepo) + req.Header.Set("Forgejo-Cache-RunNumber", cacheRunnum) + req.Header.Set("Forgejo-Cache-Timestamp", cacheTimestamp) + req.Header.Set("Forgejo-Cache-MAC", cacheMac) + req.Header.Set("Forgejo-Cache-Host", "http://example.com") + handler.find(w, req, nil) + }, + }, + { + name: "find open", + caches: func(t *testing.T, message string) caches { + caches := newMockCaches(t) + caches.On("validateMac", RunData{}).Return(cacheRepo, nil) + caches.On("openDB", mock.Anything, mock.Anything).Return(nil, errors.New(message)) + return caches + }, + call: func(t *testing.T, handler Handler, w http.ResponseWriter) { + req, err := http.NewRequest("GET", "example.com/cache", nil) + require.NoError(t, err) + handler.find(w, req, nil) + }, + }, + { + name: "reserve", + caches: func(t *testing.T, message string) caches { + caches := newMockCaches(t) + caches.On("validateMac", RunData{}).Return(cacheRepo, nil) + caches.On("openDB", mock.Anything, mock.Anything).Return(nil, errors.New(message)) + return caches + }, + call: func(t *testing.T, handler Handler, w http.ResponseWriter) { + body, err := json.Marshal(&Request{}) + require.NoError(t, err) + req, err := http.NewRequest("POST", "example.com/caches", bytes.NewReader(body)) + require.NoError(t, err) + handler.reserve(w, req, nil) + }, + }, + { + name: "upload", + caches: func(t *testing.T, message string) caches { + caches := newMockCaches(t) + caches.On("validateMac", RunData{}).Return(cacheRepo, nil) + caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) + return caches + }, + call: func(t *testing.T, handler Handler, w http.ResponseWriter) { + id := 1234 + req, err := http.NewRequest("PATCH", fmt.Sprintf("http://example.com/caches/%d", id), nil) + require.NoError(t, err) + handler.upload(w, req, httprouter.Params{ + httprouter.Param{Key: "id", Value: fmt.Sprintf("%d", id)}, + }) + }, + }, + { + name: "commit", + caches: func(t *testing.T, message string) caches { + caches := newMockCaches(t) + caches.On("validateMac", RunData{}).Return(cacheRepo, nil) + caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) + return caches + }, + call: func(t *testing.T, handler Handler, w http.ResponseWriter) { + id := 1234 + req, err := http.NewRequest("POST", fmt.Sprintf("http://example.com/caches/%d", id), nil) + require.NoError(t, err) + handler.commit(w, req, httprouter.Params{ + httprouter.Param{Key: "id", Value: fmt.Sprintf("%d", id)}, + }) + }, + }, + { + name: "get", + caches: func(t *testing.T, message string) caches { + caches := newMockCaches(t) + caches.On("validateMac", RunData{}).Return(cacheRepo, nil) + caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) + return caches + }, + call: func(t *testing.T, handler Handler, w http.ResponseWriter) { + id := 1234 + req, err := http.NewRequest("GET", fmt.Sprintf("http://example.com/artifacts/%d", id), nil) + require.NoError(t, err) + handler.get(w, req, httprouter.Params{ + httprouter.Param{Key: "id", Value: fmt.Sprintf("%d", id)}, + }) + }, + }, + // it currently is a noop + //{ + //name: "clean", + //} + } { + t.Run(testCase.name, func(t *testing.T) { + message := "ERROR MESSAGE" + if testCase.prepare != nil { + defer testCase.prepare(message)() + } + + fatalMessage := "" + defer testutils.MockVariable(&fatal, func(_ logrus.FieldLogger, err error) { + fatalMessage = err.Error() + })() + + assertFatalMessage := func(t *testing.T, expected string) { + t.Helper() + assert.Contains(t, fatalMessage, expected) + } + + dir := filepath.Join(t.TempDir(), "artifactcache") + handler, err := StartHandler(dir, "", 0, "secret", nil) + require.NoError(t, err) + + fatalMessage = "" + + handler.setCaches(testCase.caches(t, message)) + + w := httptest.NewRecorder() + testCase.call(t, handler, w) + require.Equal(t, 500, w.Code) + assertFatalMessage(t, message) + }) + } +} + func TestHandler_gcCache(t *testing.T) { dir := filepath.Join(t.TempDir(), "artifactcache") handler, err := StartHandler(dir, "", 0, "", nil) From 4beb514232dacc245faf46457db41ada71c390db Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 5 Sep 2025 22:14:52 +0000 Subject: [PATCH 172/281] fix: allow inputs context in action defaults (#941) Resolves forgejo/runner#939 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/941): fix: allow inputs context in action defaults Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/941 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/schema/action_schema.json | 1 + act/schema/schema_test.go | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/act/schema/action_schema.json b/act/schema/action_schema.json index c0f7b69a..6a0eabb0 100644 --- a/act/schema/action_schema.json +++ b/act/schema/action_schema.json @@ -172,6 +172,7 @@ "context": [ "forge", "github", + "inputs", "env", "strategy", "matrix", diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index 45109b1d..dc54834e 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -197,7 +197,7 @@ inputs: default: '${{ env.GITHUB_SERVER_URL }}' repo: description: 'repo description' - default: '${{ github.repository }} ${{ vars.VARIABLE }}' + default: '${{ github.repository }} ${{ vars.VARIABLE }} ${{ inputs.VARIABLE }}' runs: using: "composite" steps: From 26fda6e0843a7c723b33b64ba1be404bb92d9cab Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 6 Sep 2025 05:52:41 +0000 Subject: [PATCH 173/281] Update module github.com/docker/docker to v28.4.0+incompatible (#942) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | `v28.3.3+incompatible` -> `v28.4.0+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fdocker/v28.4.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fdocker/v28.3.3+incompatible/v28.4.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/docker (github.com/docker/docker) ### [`v28.4.0+incompatible`](https://github.com/docker/docker/compare/v28.3.3...v28.4.0) [Compare Source](https://github.com/docker/docker/compare/v28.3.3...v28.4.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/942): Update module github.com/docker/docker to v28.4.0+incompatible Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/942 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 3 +-- go.sum | 34 ++-------------------------------- 2 files changed, 3 insertions(+), 34 deletions(-) diff --git a/go.mod b/go.mod index d5659438..3c4c5158 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 github.com/docker/cli v28.4.0+incompatible - github.com/docker/docker v28.3.3+incompatible + github.com/docker/docker v28.4.0+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 github.com/go-git/go-git/v5 v5.16.2 @@ -61,7 +61,6 @@ require ( github.com/go-logr/logr v1.4.2 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-viper/mapstructure/v2 v2.4.0 // indirect - github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect diff --git a/go.sum b/go.sum index 62d580b2..f18c419d 100644 --- a/go.sum +++ b/go.sum @@ -45,8 +45,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY0UUU4C9kY= github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI= -github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk= +github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40= github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94= @@ -80,8 +80,6 @@ github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9L github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= -github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= -github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= @@ -104,8 +102,6 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8= github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4= github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM= -github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= -github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= @@ -202,8 +198,6 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHo github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ= github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74= github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y= -github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw= go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo= go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E= @@ -228,32 +222,17 @@ go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lI go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= -golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY= golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= -golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -268,21 +247,12 @@ golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4= golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= -golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ= google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f h1:2yNACc1O40tTnrsbk9Cv6oxiW8pxI/pXj0wRtdlYmgY= google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f/go.mod h1:Uy9bTZJqmfrw2rIBxgGLnamc78euZULUBrLZ9XTITKI= From e6a61d940dbae47d4d14e0dfaf15c3665c8ad934 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 6 Sep 2025 17:19:13 +0000 Subject: [PATCH 174/281] fix: lxc-systemd example: export INPUTS_SERIAL (#943) otherwise it will not be set when copy/pasting the following commands - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/943): fix: lxc-systemd example: export INPUTS_SERIAL Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/943 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- examples/lxc-systemd/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/README.md b/examples/lxc-systemd/README.md index f2b3baf1..5449c6cc 100644 --- a/examples/lxc-systemd/README.md +++ b/examples/lxc-systemd/README.md @@ -5,7 +5,7 @@ forgejo-runner-service.sh installs a [Forgejo runner](https://forgejo.org/docs/n - Install: `sudo wget -O /usr/local/bin/forgejo-runner-service.sh https://code.forgejo.org/forgejo/runner/raw/branch/main/examples/lxc-systemd/forgejo-runner-service.sh && sudo chmod +x /usr/local/bin/forgejo-runner-service.sh` - Obtain a runner registration token ($TOKEN) - Choose a serial number that is not already in use in `/etc/forgejo-runner` -- Create a runner `INPUTS_SERIAL=30 INPUTS_TOKEN=$TOKEN INPUTS_FORGEJO=https://code.forgejo.org forgejo-runner-service.sh` +- Create a runner `export INPUTS_SERIAL=30 ; INPUTS_TOKEN=$TOKEN INPUTS_FORGEJO=https://code.forgejo.org forgejo-runner-service.sh` - Start `systemctl enable --now forgejo-runner@$INPUTS_SERIAL` - Monitor with: - `systemctl status forgejo-runner@$INPUTS_SERIAL` From b2865e5a2d08310b6ccb60ca7b4b969b66c8bdf5 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sat, 6 Sep 2025 18:44:56 -0600 Subject: [PATCH 175/281] fix: graceful shutdown of tasks being interrupted by signal --- internal/app/cmd/cmd.go | 3 +-- internal/app/cmd/daemon.go | 16 ++++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/internal/app/cmd/cmd.go b/internal/app/cmd/cmd.go index e8db01de..414f9ce8 100644 --- a/internal/app/cmd/cmd.go +++ b/internal/app/cmd/cmd.go @@ -10,7 +10,6 @@ import ( "github.com/spf13/cobra" - "code.forgejo.org/forgejo/runner/v11/internal/pkg/common" "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) @@ -46,7 +45,7 @@ func Execute(ctx context.Context) { Use: "daemon", Short: "Run as a runner daemon", Args: cobra.MaximumNArgs(1), - RunE: runDaemon(common.WithDaemonContext(ctx, ctx), &configFile), + RunE: runDaemon(ctx, &configFile), } rootCmd.AddCommand(daemonCmd) diff --git a/internal/app/cmd/daemon.go b/internal/app/cmd/daemon.go index cb3d278a..fffff195 100644 --- a/internal/app/cmd/daemon.go +++ b/internal/app/cmd/daemon.go @@ -21,14 +21,22 @@ import ( "code.forgejo.org/forgejo/runner/v11/internal/app/poll" "code.forgejo.org/forgejo/runner/v11/internal/app/run" "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/common" "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" "code.forgejo.org/forgejo/runner/v11/internal/pkg/envcheck" "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) -func runDaemon(ctx context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { +func runDaemon(signalContext context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { return func(cmd *cobra.Command, args []string) error { + // signalContext will be 'done' when we receive a graceful shutdown signal; daemonContext is not a derived + // context because we want it to 'outlive' the signalContext in order to perform graceful cleanup. + daemonContext, cancel := context.WithCancel(context.Background()) + defer cancel() + + ctx := common.WithDaemonContext(daemonContext, daemonContext) + cfg, err := config.LoadDefault(*configFile) if err != nil { return fmt.Errorf("invalid configuration: %w", err) @@ -118,13 +126,13 @@ func runDaemon(ctx context.Context, configFile *string) func(cmd *cobra.Command, go poller.Poll() - <-ctx.Done() + <-signalContext.Done() log.Infof("runner: %s shutdown initiated, waiting [runner].shutdown_timeout=%s for running jobs to complete before shutting down", resp.Msg.GetRunner().GetName(), cfg.Runner.ShutdownTimeout) - ctx, cancel := context.WithTimeout(context.Background(), cfg.Runner.ShutdownTimeout) + shutdownCtx, cancel := context.WithTimeout(daemonContext, cfg.Runner.ShutdownTimeout) defer cancel() - err = poller.Shutdown(ctx) + err = poller.Shutdown(shutdownCtx) if err != nil { log.Warnf("runner: %s cancelled in progress jobs during shutdown", resp.Msg.GetRunner().GetName()) } From 441f1420897cd2751d3255142008310aae4571f8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 7 Sep 2025 07:48:49 +0000 Subject: [PATCH 176/281] Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.5 (#945) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/forgejo](https://forgejo.org) ([source](https://codeberg.org/forgejo/forgejo)) | patch | `11.0.4` -> `11.0.5` | --- ### Release Notes
forgejo/forgejo (code.forgejo.org/forgejo/forgejo) ### [`v11.0.5`](https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.5) [Compare Source](https://codeberg.org/forgejo/forgejo/compare/v11.0.4...v11.0.5) See
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/945): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.5 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/945 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index 2320ecdf..da628a38 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -21,7 +21,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.4 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.5 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo FORGEJO_USER: root FORGEJO_PASSWORD: admin1234 From 82cbe791dc54babab403c2b3a4fce7aba507e5c8 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 7 Sep 2025 12:47:23 -0600 Subject: [PATCH 177/281] refactor: split runDaemon into testable lambdas --- internal/app/cmd/cmd.go | 2 +- internal/app/cmd/daemon.go | 265 ++++++++++++++++++++++--------------- 2 files changed, 157 insertions(+), 110 deletions(-) diff --git a/internal/app/cmd/cmd.go b/internal/app/cmd/cmd.go index 414f9ce8..aada3bbe 100644 --- a/internal/app/cmd/cmd.go +++ b/internal/app/cmd/cmd.go @@ -45,7 +45,7 @@ func Execute(ctx context.Context) { Use: "daemon", Short: "Run as a runner daemon", Args: cobra.MaximumNArgs(1), - RunE: runDaemon(ctx, &configFile), + RunE: getRunDaemonCommandProcessor(ctx, &configFile), } rootCmd.AddCommand(daemonCmd) diff --git a/internal/app/cmd/daemon.go b/internal/app/cmd/daemon.go index fffff195..d864af82 100644 --- a/internal/app/cmd/daemon.go +++ b/internal/app/cmd/daemon.go @@ -28,120 +28,75 @@ import ( "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver" ) -func runDaemon(signalContext context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { +func getRunDaemonCommandProcessor(signalContext context.Context, configFile *string) func(cmd *cobra.Command, args []string) error { return func(cmd *cobra.Command, args []string) error { - // signalContext will be 'done' when we receive a graceful shutdown signal; daemonContext is not a derived - // context because we want it to 'outlive' the signalContext in order to perform graceful cleanup. - daemonContext, cancel := context.WithCancel(context.Background()) - defer cancel() - - ctx := common.WithDaemonContext(daemonContext, daemonContext) - - cfg, err := config.LoadDefault(*configFile) - if err != nil { - return fmt.Errorf("invalid configuration: %w", err) - } - - initLogging(cfg) - log.Infoln("Starting runner daemon") - - reg, err := config.LoadRegistration(cfg.Runner.File) - if os.IsNotExist(err) { - log.Error("registration file not found, please register the runner first") - return err - } else if err != nil { - return fmt.Errorf("failed to load registration file: %w", err) - } - - cfg.Tune(reg.Address) - - lbls := reg.Labels - if len(cfg.Runner.Labels) > 0 { - lbls = cfg.Runner.Labels - } - - ls := labels.Labels{} - for _, l := range lbls { - label, err := labels.Parse(l) - if err != nil { - log.WithError(err).Warnf("ignored invalid label %q", l) - continue - } - ls = append(ls, label) - } - if len(ls) == 0 { - log.Warn("no labels configured, runner may not be able to pick up jobs") - } - - if ls.RequireDocker() { - dockerSocketPath, err := getDockerSocketPath(cfg.Container.DockerHost) - if err != nil { - return err - } - if err := envcheck.CheckIfDockerRunning(ctx, dockerSocketPath); err != nil { - return err - } - os.Setenv("DOCKER_HOST", dockerSocketPath) - if cfg.Container.DockerHost == "automount" { - cfg.Container.DockerHost = dockerSocketPath - } - // check the scheme, if the scheme is not npipe or unix - // set cfg.Container.DockerHost to "-" because it can't be mounted to the job container - if protoIndex := strings.Index(cfg.Container.DockerHost, "://"); protoIndex != -1 { - scheme := cfg.Container.DockerHost[:protoIndex] - if !strings.EqualFold(scheme, "npipe") && !strings.EqualFold(scheme, "unix") { - cfg.Container.DockerHost = "-" - } - } - } - - cli := client.New( - reg.Address, - cfg.Runner.Insecure, - reg.UUID, - reg.Token, - ver.Version(), - ) - - runner := run.NewRunner(cfg, reg, cli) - // declare the labels of the runner before fetching tasks - resp, err := runner.Declare(ctx, ls.Names()) - if err != nil && connect.CodeOf(err) == connect.CodeUnimplemented { - log.Warn("Because the Forgejo instance is an old version, skipping declaring the labels and version.") - } else if err != nil { - log.WithError(err).Error("fail to invoke Declare") - return err - } else { - log.Infof("runner: %s, with version: %s, with labels: %v, declared successfully", - resp.Msg.GetRunner().GetName(), resp.Msg.GetRunner().GetVersion(), resp.Msg.GetRunner().GetLabels()) - // if declared successfully, override the labels in the.runner file with valid labels in the config file (if specified) - runner.Update(ctx, ls) - reg.Labels = ls.ToStrings() - if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil { - return fmt.Errorf("failed to save runner config: %w", err) - } - } - - poller := poll.New(ctx, cfg, cli, runner) - - go poller.Poll() - - <-signalContext.Done() - log.Infof("runner: %s shutdown initiated, waiting [runner].shutdown_timeout=%s for running jobs to complete before shutting down", resp.Msg.GetRunner().GetName(), cfg.Runner.ShutdownTimeout) - - shutdownCtx, cancel := context.WithTimeout(daemonContext, cfg.Runner.ShutdownTimeout) - defer cancel() - - err = poller.Shutdown(shutdownCtx) - if err != nil { - log.Warnf("runner: %s cancelled in progress jobs during shutdown", resp.Msg.GetRunner().GetName()) - } - return nil + return runDaemon(signalContext, configFile) } } +func runDaemon(signalContext context.Context, configFile *string) error { + // signalContext will be 'done' when we receive a graceful shutdown signal; daemonContext is not a derived context + // because we want it to 'outlive' the signalContext in order to perform graceful cleanup. + daemonContext, cancel := context.WithCancel(context.Background()) + defer cancel() + + ctx := common.WithDaemonContext(daemonContext, daemonContext) + + cfg, err := initializeConfig(configFile) + if err != nil { + return err + } + + initLogging(cfg) + log.Infoln("Starting runner daemon") + + reg, err := loadRegistration(cfg) + if err != nil { + return err + } + + cfg.Tune(reg.Address) + ls := extractLabels(cfg, reg) + + err = configCheck(ctx, cfg, ls) + if err != nil { + return err + } + + cli := createClient(cfg, reg) + + runner, runnerName, err := createRunner(ctx, cfg, reg, cli, ls) + if err != nil { + return err + } + + poller := createPoller(ctx, cfg, cli, runner) + + go poller.Poll() + + <-signalContext.Done() + log.Infof("runner: %s shutdown initiated, waiting [runner].shutdown_timeout=%s for running jobs to complete before shutting down", runnerName, cfg.Runner.ShutdownTimeout) + + shutdownCtx, cancel := context.WithTimeout(daemonContext, cfg.Runner.ShutdownTimeout) + defer cancel() + + err = poller.Shutdown(shutdownCtx) + if err != nil { + log.Warnf("runner: %s cancelled in progress jobs during shutdown", runnerName) + } + return nil +} + +var initializeConfig = func(configFile *string) (*config.Config, error) { + cfg, err := config.LoadDefault(*configFile) + if err != nil { + return nil, fmt.Errorf("invalid configuration: %w", err) + } + return cfg, nil +} + // initLogging setup the global logrus logger. -func initLogging(cfg *config.Config) { +var initLogging = func(cfg *config.Config) { isTerm := isatty.IsTerminal(os.Stdout.Fd()) format := &log.TextFormatter{ DisableColors: !isTerm, @@ -178,6 +133,98 @@ func initLogging(cfg *config.Config) { } } +var loadRegistration = func(cfg *config.Config) (*config.Registration, error) { + reg, err := config.LoadRegistration(cfg.Runner.File) + if os.IsNotExist(err) { + log.Error("registration file not found, please register the runner first") + return nil, err + } else if err != nil { + return nil, fmt.Errorf("failed to load registration file: %w", err) + } + return reg, nil +} + +var extractLabels = func(cfg *config.Config, reg *config.Registration) labels.Labels { + lbls := reg.Labels + if len(cfg.Runner.Labels) > 0 { + lbls = cfg.Runner.Labels + } + + ls := labels.Labels{} + for _, l := range lbls { + label, err := labels.Parse(l) + if err != nil { + log.WithError(err).Warnf("ignored invalid label %q", l) + continue + } + ls = append(ls, label) + } + if len(ls) == 0 { + log.Warn("no labels configured, runner may not be able to pick up jobs") + } + return ls +} + +var configCheck = func(ctx context.Context, cfg *config.Config, ls labels.Labels) error { + if ls.RequireDocker() { + dockerSocketPath, err := getDockerSocketPath(cfg.Container.DockerHost) + if err != nil { + return err + } + if err := envcheck.CheckIfDockerRunning(ctx, dockerSocketPath); err != nil { + return err + } + os.Setenv("DOCKER_HOST", dockerSocketPath) + if cfg.Container.DockerHost == "automount" { + cfg.Container.DockerHost = dockerSocketPath + } + // check the scheme, if the scheme is not npipe or unix + // set cfg.Container.DockerHost to "-" because it can't be mounted to the job container + if protoIndex := strings.Index(cfg.Container.DockerHost, "://"); protoIndex != -1 { + scheme := cfg.Container.DockerHost[:protoIndex] + if !strings.EqualFold(scheme, "npipe") && !strings.EqualFold(scheme, "unix") { + cfg.Container.DockerHost = "-" + } + } + } + return nil +} + +var createClient = func(cfg *config.Config, reg *config.Registration) client.Client { + return client.New( + reg.Address, + cfg.Runner.Insecure, + reg.UUID, + reg.Token, + ver.Version(), + ) +} + +var createRunner = func(ctx context.Context, cfg *config.Config, reg *config.Registration, cli client.Client, ls labels.Labels) (run.RunnerInterface, string, error) { + runner := run.NewRunner(cfg, reg, cli) + // declare the labels of the runner before fetching tasks + resp, err := runner.Declare(ctx, ls.Names()) + if err != nil && connect.CodeOf(err) == connect.CodeUnimplemented { + log.Warn("Because the Forgejo instance is an old version, skipping declaring the labels and version.") + } else if err != nil { + log.WithError(err).Error("fail to invoke Declare") + return nil, "", err + } else { + log.Infof("runner: %s, with version: %s, with labels: %v, declared successfully", + resp.Msg.GetRunner().GetName(), resp.Msg.GetRunner().GetVersion(), resp.Msg.GetRunner().GetLabels()) + // if declared successfully, override the labels in the.runner file with valid labels in the config file (if specified) + runner.Update(ctx, ls) + reg.Labels = ls.ToStrings() + if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil { + return nil, "", fmt.Errorf("failed to save runner config: %w", err) + } + } + return runner, resp.Msg.GetRunner().GetName(), nil +} + +// func(ctx context.Context, cfg *config.Config, cli client.Client, runner run.RunnerInterface) poll.Poller +var createPoller = poll.New + var commonSocketPaths = []string{ "/var/run/docker.sock", "/run/podman/podman.sock", From bfa86327cea433ea74012992c3f349816e2eb907 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 7 Sep 2025 13:52:31 -0600 Subject: [PATCH 178/281] test: add mocks for RunnerInterface & Poller --- internal/app/poll/mocks/Poller.go | 52 +++++++++++++++++++++++ internal/app/poll/poller.go | 1 + internal/app/run/mocks/RunnerInterface.go | 49 +++++++++++++++++++++ internal/app/run/runner.go | 1 + internal/pkg/client/mocks/Client.go | 2 +- 5 files changed, 104 insertions(+), 1 deletion(-) create mode 100644 internal/app/poll/mocks/Poller.go create mode 100644 internal/app/run/mocks/RunnerInterface.go diff --git a/internal/app/poll/mocks/Poller.go b/internal/app/poll/mocks/Poller.go new file mode 100644 index 00000000..9d2b1e4d --- /dev/null +++ b/internal/app/poll/mocks/Poller.go @@ -0,0 +1,52 @@ +// Code generated by mockery v2.53.5. DO NOT EDIT. + +package mocks + +import ( + context "context" + + mock "github.com/stretchr/testify/mock" +) + +// Poller is an autogenerated mock type for the Poller type +type Poller struct { + mock.Mock +} + +// Poll provides a mock function with no fields +func (_m *Poller) Poll() { + _m.Called() +} + +// Shutdown provides a mock function with given fields: ctx +func (_m *Poller) Shutdown(ctx context.Context) error { + ret := _m.Called(ctx) + + if len(ret) == 0 { + panic("no return value specified for Shutdown") + } + + var r0 error + if rf, ok := ret.Get(0).(func(context.Context) error); ok { + r0 = rf(ctx) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// NewPoller creates a new instance of Poller. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. +// The first argument is typically a *testing.T value. +func NewPoller(t interface { + mock.TestingT + Cleanup(func()) +}, +) *Poller { + mock := &Poller{} + mock.Mock.Test(t) + + t.Cleanup(func() { mock.AssertExpectations(t) }) + + return mock +} diff --git a/internal/app/poll/poller.go b/internal/app/poll/poller.go index 452f356d..7b954cb7 100644 --- a/internal/app/poll/poller.go +++ b/internal/app/poll/poller.go @@ -22,6 +22,7 @@ import ( const PollerID = "PollerID" +//go:generate mockery --name Poller type Poller interface { Poll() Shutdown(ctx context.Context) error diff --git a/internal/app/run/mocks/RunnerInterface.go b/internal/app/run/mocks/RunnerInterface.go new file mode 100644 index 00000000..16dbfecb --- /dev/null +++ b/internal/app/run/mocks/RunnerInterface.go @@ -0,0 +1,49 @@ +// Code generated by mockery v2.53.5. DO NOT EDIT. + +package mocks + +import ( + context "context" + + mock "github.com/stretchr/testify/mock" + + runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" +) + +// RunnerInterface is an autogenerated mock type for the RunnerInterface type +type RunnerInterface struct { + mock.Mock +} + +// Run provides a mock function with given fields: ctx, task +func (_m *RunnerInterface) Run(ctx context.Context, task *runnerv1.Task) error { + ret := _m.Called(ctx, task) + + if len(ret) == 0 { + panic("no return value specified for Run") + } + + var r0 error + if rf, ok := ret.Get(0).(func(context.Context, *runnerv1.Task) error); ok { + r0 = rf(ctx, task) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// NewRunnerInterface creates a new instance of RunnerInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. +// The first argument is typically a *testing.T value. +func NewRunnerInterface(t interface { + mock.TestingT + Cleanup(func()) +}, +) *RunnerInterface { + mock := &RunnerInterface{} + mock.Mock.Test(t) + + t.Cleanup(func() { mock.AssertExpectations(t) }) + + return mock +} diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 98e1c524..3f2b0127 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -48,6 +48,7 @@ type Runner struct { runningTasks sync.Map } +//go:generate mockery --name RunnerInterface type RunnerInterface interface { Run(ctx context.Context, task *runnerv1.Task) error } diff --git a/internal/pkg/client/mocks/Client.go b/internal/pkg/client/mocks/Client.go index f2ea5fe2..3b3ab6cb 100644 --- a/internal/pkg/client/mocks/Client.go +++ b/internal/pkg/client/mocks/Client.go @@ -1,4 +1,4 @@ -// Code generated by mockery v2.53.4. DO NOT EDIT. +// Code generated by mockery v2.53.5. DO NOT EDIT. package mocks From 458ca52101773195800506bf695880c3dfeb0a82 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 7 Sep 2025 13:51:02 -0600 Subject: [PATCH 179/281] test: add TestRunDaemonGracefulShutdown --- internal/app/cmd/daemon_test.go | 117 ++++++++++++++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 internal/app/cmd/daemon_test.go diff --git a/internal/app/cmd/daemon_test.go b/internal/app/cmd/daemon_test.go new file mode 100644 index 00000000..16ce8e50 --- /dev/null +++ b/internal/app/cmd/daemon_test.go @@ -0,0 +1,117 @@ +// Copyright 2025 The Forgejo Authors +// SPDX-License-Identifier: MIT + +package cmd + +import ( + "context" + "testing" + "time" + + "code.forgejo.org/forgejo/runner/v11/internal/app/poll" + mock_poller "code.forgejo.org/forgejo/runner/v11/internal/app/poll/mocks" + "code.forgejo.org/forgejo/runner/v11/internal/app/run" + mock_runner "code.forgejo.org/forgejo/runner/v11/internal/app/run/mocks" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/client" + mock_client "code.forgejo.org/forgejo/runner/v11/internal/pkg/client/mocks" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/config" + "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" + "code.forgejo.org/forgejo/runner/v11/testutils" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/mock" + "github.com/stretchr/testify/require" +) + +func TestRunDaemonGracefulShutdown(t *testing.T) { + // Key assertions for graceful shutdown test: + // + // - ctx passed to createRunner, createPoller, and Shutdown must outlive signalContext passed to runDaemon, allowing + // the poller to operate without errors after termination signal is received: #1 + // + // - When shutting down, the order of operations should be: close signalContext, which causes Shutdown mock to be + // invoked, and Shutdown mock causes the Poll method to be stopped: #2 + + mockClient := mock_client.NewClient(t) + mockRunner := mock_runner.NewRunnerInterface(t) + mockPoller := mock_poller.NewPoller(t) + + defer testutils.MockVariable(&initializeConfig, func(configFile *string) (*config.Config, error) { + return &config.Config{ + Runner: config.Runner{ + // Default ShutdownTimeout of 0s won't work for the graceful shutdown test. + ShutdownTimeout: 30 * time.Second, + }, + }, nil + })() + defer testutils.MockVariable(&initLogging, func(cfg *config.Config) {})() + defer testutils.MockVariable(&loadRegistration, func(cfg *config.Config) (*config.Registration, error) { + return &config.Registration{}, nil + })() + defer testutils.MockVariable(&extractLabels, func(cfg *config.Config, reg *config.Registration) labels.Labels { + return labels.Labels{} + })() + defer testutils.MockVariable(&configCheck, func(ctx context.Context, cfg *config.Config, ls labels.Labels) error { + return nil + })() + defer testutils.MockVariable(&createClient, func(cfg *config.Config, reg *config.Registration) client.Client { + return mockClient + })() + var runnerContext context.Context + defer testutils.MockVariable(&createRunner, func(ctx context.Context, cfg *config.Config, reg *config.Registration, cli client.Client, ls labels.Labels) (run.RunnerInterface, string, error) { + runnerContext = ctx + return mockRunner, "runner", nil + })() + var pollerContext context.Context + defer testutils.MockVariable(&createPoller, func(ctx context.Context, cfg *config.Config, cli client.Client, runner run.RunnerInterface) poll.Poller { + pollerContext = ctx + return mockPoller + })() + + pollBegunChannel := make(chan interface{}) + shutdownChannel := make(chan interface{}) + mockPoller.On("Poll").Run(func(args mock.Arguments) { + close(pollBegunChannel) + // Simulate running the poll by waiting and doing nothing until shutdownChannel says Shutdown was invoked + require.NotNil(t, pollerContext) + select { + case <-pollerContext.Done(): + assert.Fail(t, "pollerContext was closed before shutdownChannel") // #1 + return + case <-shutdownChannel: + return + } + }) + mockPoller.On("Shutdown", mock.Anything).Run(func(args mock.Arguments) { + shutdownContext := args.Get(0).(context.Context) + select { + case <-shutdownContext.Done(): + assert.Fail(t, "shutdownContext was closed, but was expected to be open") // #1 + return + case <-runnerContext.Done(): + assert.Fail(t, "runnerContext was closed, but was expected to be open") // #1 + return + case <-time.After(time.Microsecond): + close(shutdownChannel) + return + } + }).Return(nil) + + // When runDaemon is begun, it will run "forever" until the passed-in context is done. So, let's start that in a goroutine... + mockSignalContext, cancelSignal := context.WithCancel(t.Context()) + runDaemonComplete := make(chan interface{}) + go func() { + configFile := "config.yaml" + err := runDaemon(mockSignalContext, &configFile) + close(runDaemonComplete) + require.NoError(t, err) + }() + + // Wait until runDaemon reaches poller.Poll(), where we expect graceful shutdown to trigger + <-pollBegunChannel + + // Now we'll signal to the daemon to begin graceful shutdown; this begins the events described in #2 + cancelSignal() + + // Wait for the daemon goroutine to stop + <-runDaemonComplete +} From 1178cf6d247afe88d47fe63d0e776893ae610dda Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 7 Sep 2025 21:25:13 +0000 Subject: [PATCH 180/281] fix: also cascade if run-*-test is set when the PR is open (#948) Testing - after merge - open a pull request with the tags run-end-to-end-test and run-forgejo-test set - verify both workflow run instead of being skipped - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/948): fix: also cascade if run-*-test is set when the PR is open Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/948 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/cascade-forgejo.yml | 5 +++-- .forgejo/workflows/cascade-setup-forgejo.yml | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index c1c09565..ad422aa7 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -28,6 +28,7 @@ on: - 'wip-cascade' pull_request_target: types: + - opened - synchronize - labeled - closed @@ -63,7 +64,7 @@ jobs: # Always run when a commit is pushed to the main or wip-cascade branch # If this is a pull request, run # - when the `run-forgejo-tests` label is set (label_updated) (but not if another label is set or if a label is removed) - # - when a new commit is pushed to the pull request (synchronized) if the `run-forgejo-tests` is already present + # - when a new commit is pushed to the pull request (synchronized or opened) if the `run-forgejo-tests` is already present # - when the pull request is closed, which also happens when it is merged, so that the Forgejo pull request is closed # if: > @@ -73,7 +74,7 @@ jobs: ) || ( forge.event_name == 'pull_request_target' && ( forge.event.action == 'closed' || - ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || + ( ( forge.event.action == 'synchronized' || forge.event.action == 'opened' ) && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-forgejo-tests' ) ) ) diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml index fff2309f..968ecffc 100644 --- a/.forgejo/workflows/cascade-setup-forgejo.yml +++ b/.forgejo/workflows/cascade-setup-forgejo.yml @@ -27,6 +27,7 @@ on: - 'wip-cascade' pull_request_target: types: + - opened - synchronize - labeled - closed @@ -62,7 +63,7 @@ jobs: # Always run when a commit is pushed to the wip-cascade branch # If this is a pull request, run # - when the `run-end-to-end-tests` label is set (label_updated) (but not if another label is set or if a label is removed) - # - when a new commit is pushed to the pull request (synchronized) if the `run-end-to-end-tests` is already present + # - when a new commit is pushed to the pull request (synchronized or opened) if the `run-end-to-end-tests` is already present # - when the pull request is closed, which also happens when it is merged, so that the setup-forgejo & end-to-end pull requests are closed # if: > @@ -72,7 +73,7 @@ jobs: ) || ( forge.event_name == 'pull_request_target' && ( forge.event.action == 'closed' || - ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) || + ( ( forge.event.action == 'synchronized' || forge.event.action == 'opened' ) && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) || ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-end-to-end-tests' ) ) ) From ad90bb4b68c062afeb62089c79b3d3c4b3e3d9f6 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 8 Sep 2025 00:14:44 +0000 Subject: [PATCH 181/281] Revert "fix: also cascade if run-*-test is set when the PR is open (#948)" (#950) This reverts commit 1178cf6d247afe88d47fe63d0e776893ae610dda. This was an incorrect fix to a different problem. The `labeled` event is run when a pull request is opened. Adding an `opened` event will just needlessly duplicate the runs. The actual problem was me assuming too quickly that a short runtime (15s) indicated that the cascade was not run. This is what happened at https://code.forgejo.org/forgejo/runner/pulls/935 - the cascade is run https://code.forgejo.org/forgejo/runner/pulls/935#issuecomment-57986 - the duration is very short because the commit status is set [by the last event (closed)](https://code.forgejo.org/forgejo/runner/actions/runs/9344/jobs/0#jobstep-1-12) ![image](/attachments/2aecc2f6-8fc0-4778-91c3-de689808a30e) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/950): Revert "fix: also cascade if run-*-test is set when the PR is open (#948)" Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/950 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/cascade-forgejo.yml | 5 ++--- .forgejo/workflows/cascade-setup-forgejo.yml | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index ad422aa7..c1c09565 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -28,7 +28,6 @@ on: - 'wip-cascade' pull_request_target: types: - - opened - synchronize - labeled - closed @@ -64,7 +63,7 @@ jobs: # Always run when a commit is pushed to the main or wip-cascade branch # If this is a pull request, run # - when the `run-forgejo-tests` label is set (label_updated) (but not if another label is set or if a label is removed) - # - when a new commit is pushed to the pull request (synchronized or opened) if the `run-forgejo-tests` is already present + # - when a new commit is pushed to the pull request (synchronized) if the `run-forgejo-tests` is already present # - when the pull request is closed, which also happens when it is merged, so that the Forgejo pull request is closed # if: > @@ -74,7 +73,7 @@ jobs: ) || ( forge.event_name == 'pull_request_target' && ( forge.event.action == 'closed' || - ( ( forge.event.action == 'synchronized' || forge.event.action == 'opened' ) && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || + ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-forgejo-tests') ) || ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-forgejo-tests' ) ) ) diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml index 968ecffc..fff2309f 100644 --- a/.forgejo/workflows/cascade-setup-forgejo.yml +++ b/.forgejo/workflows/cascade-setup-forgejo.yml @@ -27,7 +27,6 @@ on: - 'wip-cascade' pull_request_target: types: - - opened - synchronize - labeled - closed @@ -63,7 +62,7 @@ jobs: # Always run when a commit is pushed to the wip-cascade branch # If this is a pull request, run # - when the `run-end-to-end-tests` label is set (label_updated) (but not if another label is set or if a label is removed) - # - when a new commit is pushed to the pull request (synchronized or opened) if the `run-end-to-end-tests` is already present + # - when a new commit is pushed to the pull request (synchronized) if the `run-end-to-end-tests` is already present # - when the pull request is closed, which also happens when it is merged, so that the setup-forgejo & end-to-end pull requests are closed # if: > @@ -73,7 +72,7 @@ jobs: ) || ( forge.event_name == 'pull_request_target' && ( forge.event.action == 'closed' || - ( ( forge.event.action == 'synchronized' || forge.event.action == 'opened' ) && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) || + ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) || ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-end-to-end-tests' ) ) ) From a2622dbe3da3f72cd14d047ff70a5f69a271d360 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 8 Sep 2025 05:00:28 +0000 Subject: [PATCH 182/281] Update module golang.org/x/time to v0.13.0 (#951) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/time](https://pkg.go.dev/golang.org/x/time) | [`v0.12.0` -> `v0.13.0`](https://cs.opensource.google/go/x/time/+/refs/tags/v0.12.0...refs/tags/v0.13.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2ftime/v0.13.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2ftime/v0.12.0/v0.13.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/951): Update module golang.org/x/time to v0.13.0 Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/951 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index 3c4c5158..137e7f39 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module code.forgejo.org/forgejo/runner/v11 -go 1.24 +go 1.24.0 toolchain go1.24.7 @@ -37,7 +37,7 @@ require ( go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.34.0 - golang.org/x/time v0.12.0 + golang.org/x/time v0.13.0 google.golang.org/protobuf v1.36.8 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index f18c419d..b42750cc 100644 --- a/go.sum +++ b/go.sum @@ -250,8 +250,8 @@ golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= -golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= -golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= +golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI= +golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ= google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f h1:2yNACc1O40tTnrsbk9Cv6oxiW8pxI/pXj0wRtdlYmgY= From 149a9e3cf5d7fa9bbbce00b6f9543c64e5388b4e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 8 Sep 2025 08:41:21 +0000 Subject: [PATCH 183/281] chore: skip release-notes-assistant for dependency updates (#954) Resolves forgejo/runner#953 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/954): chore: skip release-notes-assistant for dependency updates Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/954 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/release-notes-assistant.yml | 2 +- renovate.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index bf63f433..790227a2 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -15,7 +15,7 @@ env: jobs: release-notes: - if: vars.ROLE == 'forgejo-coding' + if: vars.ROLE == 'forgejo-coding' && !contains(forge.event.pull_request.labels.*.name, 'Kind/DependencyUpdate') runs-on: docker container: image: 'data.forgejo.org/oci/ci:1' diff --git a/renovate.json b/renovate.json index 60cdc25f..a9a1a6af 100644 --- a/renovate.json +++ b/renovate.json @@ -9,6 +9,6 @@ "separateMinorPatch": true } ], - "labels": ["Kind/Chore", "run-end-to-end-tests"], + "labels": ["Kind/DependencyUpdate", "run-end-to-end-tests"], "ignorePaths": ["**/testdata/**", "**/node_modules/**"] } From 864fce89d22fd414286d171bf79dfd1bbed23047 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 8 Sep 2025 11:14:42 +0200 Subject: [PATCH 184/281] chore: debug release-notes-assistant workflow --- .forgejo/workflows/release-notes-assistant.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 790227a2..48313fde 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -14,6 +14,14 @@ env: RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org jobs: + debug: + runs-on: docker + steps: + - name: event + run: | + cat <<'EOF' + ${{ toJSON(forge) }} + EOF release-notes: if: vars.ROLE == 'forgejo-coding' && !contains(forge.event.pull_request.labels.*.name, 'Kind/DependencyUpdate') runs-on: docker From 02df78a9ecf32ca6233efec9c4baf20db4cc761d Mon Sep 17 00:00:00 2001 From: jankatins Date: Mon, 8 Sep 2025 21:27:43 +0000 Subject: [PATCH 185/281] fix: Allow the runner to keep it's labels (#965) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I had the case that an already registered runner was losing it's labels due to a race condition (I think): the compose file was restarted, the runner came up but 10 seconds later, the labels were reset: >If the command is run without --labels, they will be reset, and the runner won’t set them back until it is restarted. The --keep-labels option can be used to preserve the existing labels. I always started all services in the compose file at once, so I never got the idea to restart the runner alone and the runner logs actually always said that the labels where there: > ... with labels: [docker-cli node-bookworm], declared successfully Signed-off-by: jankatins - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/965): fix: Allow the runner to keep it's labels Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/965 Reviewed-by: earl-warren Co-authored-by: jankatins Co-committed-by: jankatins --- examples/docker-compose/compose-forgejo-and-runner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index a0a90c77..c71cbc4e 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -35,7 +35,7 @@ services: bash -c ' /usr/bin/s6-svscan /etc/s6 & sleep 10 ; - su -c "forgejo forgejo-cli actions register --secret {SHARED_SECRET}" git ; + su -c "forgejo forgejo-cli actions register --keep-labels --secret {SHARED_SECRET}" git ; su -c "forgejo admin user create --admin --username root --password {ROOT_PASSWORD} --email root@example.com" git ; sleep infinity ' From 151c90b2a9a7a82e47021db19791eb07a23ffe16 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Tue, 9 Sep 2025 05:23:55 +0000 Subject: [PATCH 186/281] chore: call the release notes assistant when opening a new pull request (#964) When a new pull request is opened and has no labels, the release notes assistant will not be called and it will look like the event was missed. Most of the time the label will be set when the pull request is open and that will fire two runs. However, the release notes assistant is idempotent and that will just make one extra run in the CI that is a noop. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/964): chore: call the release notes assistant when opening a new pull request Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/964 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/release-notes-assistant.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 48313fde..27112b2e 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -6,6 +6,7 @@ name: issue-labels on: pull_request_target: types: + - opened - edited - synchronize - labeled @@ -14,14 +15,6 @@ env: RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org jobs: - debug: - runs-on: docker - steps: - - name: event - run: | - cat <<'EOF' - ${{ toJSON(forge) }} - EOF release-notes: if: vars.ROLE == 'forgejo-coding' && !contains(forge.event.pull_request.labels.*.name, 'Kind/DependencyUpdate') runs-on: docker From 6a6a41bf05c8c453b89d8864145d0c1180771beb Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 9 Sep 2025 08:52:15 +0000 Subject: [PATCH 187/281] Update module golang.org/x/term to v0.35.0 (#966) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.34.0` -> `v0.35.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.34.0...refs/tags/v0.35.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.35.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.34.0/v0.35.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/966 Reviewed-by: Gusted Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 137e7f39..63e8d0ff 100644 --- a/go.mod +++ b/go.mod @@ -36,7 +36,7 @@ require ( github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 - golang.org/x/term v0.34.0 + golang.org/x/term v0.35.0 golang.org/x/time v0.13.0 google.golang.org/protobuf v1.36.8 gotest.tools/v3 v3.5.2 @@ -101,7 +101,7 @@ require ( golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.39.0 // indirect golang.org/x/sync v0.12.0 // indirect - golang.org/x/sys v0.35.0 // indirect + golang.org/x/sys v0.36.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index b42750cc..9a748ef9 100644 --- a/go.sum +++ b/go.sum @@ -242,11 +242,11 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= -golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= +golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4= -golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= +golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ= +golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= From 9a620466074d61a820596147ae338d55feda3684 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 10 Sep 2025 07:18:40 +0000 Subject: [PATCH 188/281] chore: lxc-systemd may need more time to start on slow machines (#970) This false negative happened in the past 24h at https://code.forgejo.org/forgejo/runner/actions/runs/9581/jobs/0 and was resolved by just running it again. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/970): chore: lxc-systemd may need more time to start on slow machines Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/970 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/example-lxc-systemd.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index 5ebdd1a7..66c991cd 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -123,8 +123,8 @@ jobs: started_running=/etc/forgejo-runner/$serial/started-running killed_gracefully=/etc/forgejo-runner/$serial/killed-gracefully stopped_gracefully=/etc/forgejo-runner/$serial/stopped-gracefully - retry --delay 5 --times 20 cp -a $started_running /tmp/first-run - retry --delay 1 --times 30 grep --quiet 'Starting runner daemon' /var/log/forgejo-runner/$serial.log + retry --delay 10 --times 20 cp -a $started_running /tmp/first-run + retry --delay 2 --times 30 grep --quiet 'Starting runner daemon' /var/log/forgejo-runner/$serial.log systemctl stop forgejo-runner@$serial ! systemctl $all status forgejo-runner@$serial ls -l /etc/forgejo-runner/$serial @@ -136,7 +136,7 @@ jobs: ! test -f $killed_gracefully ! test -f $stopped_gracefully lifetime=${{ env.LIFETIME }} - # give it time to restart at least once + : give it time to restart at least once ls -l /etc/forgejo-runner/$serial sleep $lifetime ; sleep $lifetime ls -l /etc/forgejo-runner/$serial From 86653c237d427356350b2812b19046f3bbb640fb Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Wed, 10 Sep 2025 07:22:16 +0000 Subject: [PATCH 189/281] ci: update forgejo version for release integration (#973) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/973): ci: update forgejo version for release integration Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/973 Reviewed-by: earl-warren Co-authored-by: Michael Kriese Co-committed-by: Michael Kriese --- .forgejo/workflows/build-release-integration.yml | 5 ++++- .forgejo/workflows/release-notes-assistant.yml | 2 +- renovate.json | 6 ++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index 762cb222..ce62de12 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -18,6 +18,9 @@ on: enable-email-notifications: true +env: + FORGEJO_VERSION: 11.0.5 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + jobs: release-simulation: runs-on: lxc-bookworm @@ -30,7 +33,7 @@ jobs: with: user: root password: admin1234 - image-version: 1.20 + image-version: ${{ env.FORGEJO_VERSION }} lxc-ip-prefix: 10.0.9 - name: publish diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 27112b2e..92fcccd4 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -12,7 +12,7 @@ on: - labeled env: - RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org + RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant jobs: release-notes: diff --git a/renovate.json b/renovate.json index a9a1a6af..9cd17416 100644 --- a/renovate.json +++ b/renovate.json @@ -7,6 +7,12 @@ "description": "Separate minor and patch for some packages", "matchDepNames": ["github.com/rhysd/actionlint"], "separateMinorPatch": true + }, + { + "description": "separate multiple major and minor for forgejo", + "matchDepNames": ["code.forgejo.org/forgejo/forgejo"], + "separateMultipleMajor": true, + "separateMultipleMinor": true } ], "labels": ["Kind/DependencyUpdate", "run-end-to-end-tests"], From 106c50a51d1741961b7048c953de3ca638bfc39b Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Wed, 10 Sep 2025 09:51:22 +0200 Subject: [PATCH 190/281] chore(renovate): group runner updates --- renovate.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 9cd17416..b421427f 100644 --- a/renovate.json +++ b/renovate.json @@ -4,7 +4,7 @@ "prConcurrentLimit": 1, "packageRules": [ { - "description": "Separate minor and patch for some packages", + "description": "separate minor and patch for some packages", "matchDepNames": ["github.com/rhysd/actionlint"], "separateMinorPatch": true }, @@ -13,6 +13,11 @@ "matchDepNames": ["code.forgejo.org/forgejo/forgejo"], "separateMultipleMajor": true, "separateMultipleMinor": true + }, + { + "description": "group runner updates", + "matchDepNames": ["code.forgejo.org/forgejo/runner", "forgejo/runner"], + "groupName": "forgejo-runner" } ], "labels": ["Kind/DependencyUpdate", "run-end-to-end-tests"], From 7f75f52aaf77a3ff91936bb792414b00807970e7 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 10 Sep 2025 09:18:50 +0000 Subject: [PATCH 191/281] Update forgejo-runner to v11 (major) (#975) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | major | `9.1.1` -> `11.0.0` | | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | major | `10.0.1` -> `11.0.0` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v11.0.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.0.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v10.0.1...v11.0.0) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes The breaking change in this release is not technical, it is the change of the license which is now GPLv3-or-later. - [PR](https://code.forgejo.org/forgejo/runner/pulls/773): chore: change the license to GPLv3-or-later *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/935): fix: shutdown the runner when the cache fails with a non recoverable error - [PR](https://code.forgejo.org/forgejo/runner/pulls/948): fix: also cascade if run-\*-test is set when the PR is open - [PR](https://code.forgejo.org/forgejo/runner/pulls/946): fix: graceful shutdown of tasks being interrupted by signal - [PR](https://code.forgejo.org/forgejo/runner/pulls/943): fix: lxc-systemd example: export INPUTS\_SERIAL - [PR](https://code.forgejo.org/forgejo/runner/pulls/941): fix: allow inputs context in action defaults - [PR](https://code.forgejo.org/forgejo/runner/pulls/931): fix: an expression in with: for a reusable workflow call can use env - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/951): Update module golang.org/x/time to v0.13.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/950): Revert "fix: also cascade if run-\*-test is set when the PR is open ([#​948](https://github.com/forgejo/runner/issues/948))" - [PR](https://code.forgejo.org/forgejo/runner/pulls/945): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.5 - [PR](https://code.forgejo.org/forgejo/runner/pulls/942): Update module github.com/docker/docker to v28.4.0+incompatible - [PR](https://code.forgejo.org/forgejo/runner/pulls/773): chore: change the license to GPLv3-or-later - [PR](https://code.forgejo.org/forgejo/runner/pulls/940): chore: bump version to v11 - [PR](https://code.forgejo.org/forgejo/runner/pulls/936): refactor: remove duplicate computeMac function - [PR](https://code.forgejo.org/forgejo/runner/pulls/938): Update module github.com/docker/cli to v28.4.0+incompatible - [PR](https://code.forgejo.org/forgejo/runner/pulls/934): chore: refactor act/artifactcache Handler to an interface - [PR](https://code.forgejo.org/forgejo/runner/pulls/933): Update dependency go to v1.24.7 - [PR](https://code.forgejo.org/forgejo/runner/pulls/932): Update module github.com/spf13/pflag to v1.0.10 - [PR](https://code.forgejo.org/forgejo/runner/pulls/930): Update module github.com/spf13/cobra to v1.10.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/928): Update dependency forgejo/runner to v10 ### [`v10.0.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v10.0.0...v10.0.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/927): fix: pull\_request\_target events can share the cache of the repository ### [`v10.0.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.1.1...v10.0.0) > **Warning** Upgrade to v10.0.1 instead. A regression was found on `pull_request_target` events and is fixed in the [v10.0.1 release](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.1). - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes - [PR](https://code.forgejo.org/forgejo/runner/pulls/925): fix(security): prevent on: pull\_request actions from mutating caches of other workflow events forgej-runner currently creates a safer execution environment for workflows triggered by pull requests by denying those workflows access to the repository's secrets, preventing pull requests from compromising the confidentiality of the secrets. Workflows do have access to write to the action cache, which is shared with future workflow executions, including executions that may have access to repository secrets. This was assumed safe as the cache is a "write-once" operation based upon the cache key; if an execution writes to that cache, it will be read by other workflows only if a matching key parameter is provided, and it can not be modified again. These assumptions were identified as weak security practices with known workarounds. It is possible for a malicious pull request to mutate the shared cache and embed untrusted artifacts, which may later be executed in workflow executions with access to secrets, risking the confidentiality of those secrets. In order to eliminate this risk, workflows executing with the `pull_request` and `pull_request_target` events have their write operations to the cache isolated to future workflow executions from the same pull request. They can continue to read from the shared cache if applicable. If using an external cache server configuration, both the cache server and other instances of the runner must be running the same software version. The recommended upgrade procedure in this configuration is to bring all runners offline, upgrade the cache server to the latest release and bring it online, and then bring all other runners online. - [PR](https://code.forgejo.org/forgejo/runner/pulls/924): fix(security): ensure unique names for container images created by actions Without this fix, when a workflow ran a local [docker action](https://forgejo.org/docs/next/user/actions/actions/#docker-actions) (e.g. the [example in the end-to-end tests](https://code.forgejo.org/forgejo/end-to-end/src/commit/8f920b4b7adcb920e435db1acd02407b2312ab74/actions/example-force-rebuild/.forgejo/workflows/test.yml)), it used an image tag that could collide with other workflows that happen to use the same name. The workaround for older runner versions is to set [`[container].force_rebuild: true`](https://forgejo.org/docs/next/admin/actions/runner-installation/#configuration) in the runner configuration file. *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/925): fix(security): prevent on: pull\_request actions from mutating caches of other workflow events - [PR](https://code.forgejo.org/forgejo/runner/pulls/924): fix(security): ensure unique names for container images created by actions - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/921): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.4 - [PR](https://code.forgejo.org/forgejo/runner/pulls/922): chore: explain the difference between `job_level` and `level` - [PR](https://code.forgejo.org/forgejo/runner/pulls/917): chore: add reminder of how to run a local test - [PR](https://code.forgejo.org/forgejo/runner/pulls/919): chore: unify cascade-setup-forgejo with cascade-forgejo - [PR](https://code.forgejo.org/forgejo/runner/pulls/873): chore: remove `github.com/pkg/errors` - [PR](https://code.forgejo.org/forgejo/runner/pulls/915): Update module github.com/stretchr/testify to v1.11.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/914): Update module google.golang.org/protobuf to v1.36.8 - [PR](https://code.forgejo.org/forgejo/runner/pulls/907): Update module go.etcd.io/bbolt to v1.4.3 - [PR](https://code.forgejo.org/forgejo/runner/pulls/906): test: remove internal timeout in TestRunnerCacheConfiguration - [PR](https://code.forgejo.org/forgejo/runner/pulls/902): chore: skip tests that require Forgejo if it is not available - [PR](https://code.forgejo.org/forgejo/runner/pulls/903): chore: rework the README - [PR](https://code.forgejo.org/forgejo/runner/pulls/904): Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 \[SECURITY] - [PR](https://code.forgejo.org/forgejo/runner/pulls/900): chore: remove TestRunContext\_GetGitHubContext - [PR](https://code.forgejo.org/forgejo/runner/pulls/899): chore: do not force GOPROXY - [PR](https://code.forgejo.org/forgejo/runner/pulls/890): Update module github.com/vektra/mockery/v2 to v2.53.5 - [PR](https://code.forgejo.org/forgejo/runner/pulls/893): chore: fix .PHONY lint targets - [PR](https://code.forgejo.org/forgejo/runner/pulls/898): Update dependency forgejo/runner to v9.1.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/897): Update code.forgejo.org/forgejo/runner Docker tag to v9.1.1
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/975 Reviewed-by: Michael Kriese Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index c71cbc4e..a2597d54 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:9.1.1 + image: code.forgejo.org/forgejo/runner:11.0.0 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:9.1.1 + image: code.forgejo.org/forgejo/runner:11.0.0 links: - docker-in-docker - forgejo diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 235c6e30..ac7ae172 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=10.0.1 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=11.0.0 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 4d98bda28221615d82d8f40174681a21cefbba9f Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 10 Sep 2025 09:18:53 +0000 Subject: [PATCH 192/281] Update https://data.forgejo.org/actions/setup-forgejo action to v3.0.3 (#969) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) | action | patch | `v3.0.2` -> `v3.0.3` | --- ### Release Notes
actions/setup-forgejo (https://data.forgejo.org/actions/setup-forgejo) ### [`v3.0.3`](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.2...v3.0.3) [Compare Source](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.2...v3.0.3)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/969 Reviewed-by: earl-warren Reviewed-by: Michael Kriese Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index ce62de12..edeb907c 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -29,7 +29,7 @@ jobs: - uses: actions/checkout@v4 - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 with: user: root password: admin1234 diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index da628a38..04ac8f54 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -34,7 +34,7 @@ jobs: - name: install Forgejo so it can be used as a container registry id: registry - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 with: user: ${{ env.FORGEJO_USER }} password: ${{ env.FORGEJO_PASSWORD }} diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index 66c991cd..e2d1a54b 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -53,7 +53,7 @@ jobs: done - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 with: user: root password: admin1234 From 16276cc0d6f8c345d25fe2ef2222cf9dfe44abec Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 10 Sep 2025 16:06:48 +0000 Subject: [PATCH 193/281] fix: use a fixed runner name for old (<= v1.20) Forgejo instances (#972) The bug was already there before the recent refactor. Only it manifested itself when shutting down the runner because `resp.Msg.GetRunner().GetName()` was only called then. It was correctly refactored in the createRunner function and therefore surfaced because `resp.Msg.GetRunner().GetName()` was called during initialization instead of during shutdown. ``` time="2025-09-10T05:41:10Z" level=info msg="log level changed to debug" func="[func2]" file="[daemon.go:130]" time="2025-09-10T05:41:10Z" level=info msg="Starting runner daemon" func="[runDaemon]" file="[daemon.go:51]" time="2025-09-10T05:41:10Z" level=warning msg="Because the Forgejo instance is an old version, skipping declaring the labels and version." func="[func6]" file="[daemon.go:208]" panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xcc1a23] goroutine 1 [running]: code.forgejo.org/forgejo/runner/v11/internal/app/cmd.init.func6({0x111f428, 0xc0000e8ab0}, 0xc0003b4000, 0xc0003b8230, {0x1125eb8?, 0xc000424040?}, {0xc000032840, 0x6, 0x8}) /srv/internal/app/cmd/daemon.go:222 +0x4a3 code.forgejo.org/forgejo/runner/v11/internal/app/cmd.runDaemon({0x111f578, 0xc00025fa00}, 0xc0000380b0) /srv/internal/app/cmd/daemon.go:68 +0x23f code.forgejo.org/forgejo/runner/v11/internal/app/cmd.Execute.getRunDaemonCommandProcessor.func6(0xc000044d00?, {0xc0000c4360?, 0x4?, 0xf63e10?}) /srv/internal/app/cmd/daemon.go:33 +0x1f github.com/spf13/cobra.(*Command).execute(0xc0000fe908, {0xc0000c4340, 0x2, 0x2}) /go/pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1015 +0xaaa github.com/spf13/cobra.(*Command).ExecuteC(0xc0000fe008) /go/pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1148 +0x46f github.com/spf13/cobra.(*Command).Execute(...) /go/pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1071 code.forgejo.org/forgejo/runner/v11/internal/app/cmd.Execute({0x111f578, 0xc00025fa00}) /srv/internal/app/cmd/cmd.go:89 +0xa05 main.main() /srv/main.go:18 +0x7b 20250910 05:41:10 daemon: client (pid 4264) exited with 2 status, exiting ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/972): fix: use a fixed runner name for old (<= v1.20) Forgejo instances Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/972 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/cmd/daemon.go | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/internal/app/cmd/daemon.go b/internal/app/cmd/daemon.go index d864af82..4edf2dbe 100644 --- a/internal/app/cmd/daemon.go +++ b/internal/app/cmd/daemon.go @@ -206,18 +206,19 @@ var createRunner = func(ctx context.Context, cfg *config.Config, reg *config.Reg resp, err := runner.Declare(ctx, ls.Names()) if err != nil && connect.CodeOf(err) == connect.CodeUnimplemented { log.Warn("Because the Forgejo instance is an old version, skipping declaring the labels and version.") + return runner, "runner", nil } else if err != nil { log.WithError(err).Error("fail to invoke Declare") return nil, "", err - } else { - log.Infof("runner: %s, with version: %s, with labels: %v, declared successfully", - resp.Msg.GetRunner().GetName(), resp.Msg.GetRunner().GetVersion(), resp.Msg.GetRunner().GetLabels()) - // if declared successfully, override the labels in the.runner file with valid labels in the config file (if specified) - runner.Update(ctx, ls) - reg.Labels = ls.ToStrings() - if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil { - return nil, "", fmt.Errorf("failed to save runner config: %w", err) - } + } + + log.Infof("runner: %s, with version: %s, with labels: %v, declared successfully", + resp.Msg.GetRunner().GetName(), resp.Msg.GetRunner().GetVersion(), resp.Msg.GetRunner().GetLabels()) + // if declared successfully, override the labels in the.runner file with valid labels in the config file (if specified) + runner.Update(ctx, ls) + reg.Labels = ls.ToStrings() + if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil { + return nil, "", fmt.Errorf("failed to save runner config: %w", err) } return runner, resp.Msg.GetRunner().GetName(), nil } From 3dd167d7701bebf86fb694dbeeeda8f92454554e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 11 Sep 2025 04:50:00 +0000 Subject: [PATCH 194/281] Update module code.forgejo.org/forgejo/actions-proto to v0.5.2 (#981) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | code.forgejo.org/forgejo/actions-proto | `v0.5.1` -> `v0.5.2` | [![age](https://developer.mend.io/api/mc/badges/age/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.1/v0.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/981 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 63e8d0ff..60ac1f9b 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.24.0 toolchain go1.24.7 require ( - code.forgejo.org/forgejo/actions-proto v0.5.1 + code.forgejo.org/forgejo/actions-proto v0.5.2 connectrpc.com/connect v1.18.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 @@ -38,7 +38,7 @@ require ( go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.35.0 golang.org/x/time v0.13.0 - google.golang.org/protobuf v1.36.8 + google.golang.org/protobuf v1.36.9 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index 9a748ef9..d5b9a302 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -code.forgejo.org/forgejo/actions-proto v0.5.1 h1:GCJHR/Y/Apk7Yl7CH9qOsKrdf/k0tRVFeVhz1EIZvb4= -code.forgejo.org/forgejo/actions-proto v0.5.1/go.mod h1:nu8N1HQLsu3c4T/PpYWbqwNBxsZnEOVxqV0mQWtIQvE= +code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= +code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= @@ -260,8 +260,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU= google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw= google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA= -google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= -google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= +google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw= +google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From 933667bdf159065e6e9acaa0b82bb44e6f4b7bfb Mon Sep 17 00:00:00 2001 From: Crown0815 Date: Thu, 11 Sep 2025 11:25:52 +0000 Subject: [PATCH 195/281] Remove windows build/test pipeline for GitHub (#985) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Windows builds have move to an [independent repository](https://github.com/Crown0815/Forgejo-runner-windows-builder). Same changes as in #983 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/985): Remove windows build/test pipeline for GitHub Co-authored-by: Felix Kröner Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/985 Reviewed-by: earl-warren Co-authored-by: Crown0815 Co-committed-by: Crown0815 --- .github/workflows/build-release.yml | 151 ---------------------------- 1 file changed, 151 deletions(-) delete mode 100644 .github/workflows/build-release.yml diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml deleted file mode 100644 index d179d7bb..00000000 --- a/.github/workflows/build-release.yml +++ /dev/null @@ -1,151 +0,0 @@ -# This workflow: -# - builds and uploads a binary artifact for each Windows architecture -# - tests the runner on Windows with a Forgejo server container running on Windows Subsystem for Linux (WSL) -# - releases the binary artifact (if triggered on a pushed tag) -# -# This build is currently supported on https://github.com/Crown0815/forgejo-runner-windows - -name: Build Release - -on: - push: - tags: ['v*'] - branches: [ main ] - -jobs: - build: - name: Build ${{matrix.architecture}} - runs-on: ubuntu-latest - strategy: - matrix: - architecture: ['386', amd64, arm, arm64] - steps: - - uses: actions/checkout@v4 - - name: Build for ${{matrix.architecture}} - run: | - env GOOS=windows GOARCH=${{matrix.architecture}} \ - go build \ - -ldflags "-s -w -X code.forgejo.org/forgejo/runner/internal/pkg/ver.version=${{ github.ref_name }}" \ - -o forgejo-runner-windows-${{matrix.architecture}}.exe - - - uses: actions/upload-artifact@v4 - with: - name: forgejo-runner-windows-${{matrix.architecture}} - path: forgejo-runner-windows-${{matrix.architecture}}.exe - - - test: - name: Run Tests on Windows with Linux Forgejo Server - runs-on: windows-latest - env: - FORGEJO_ROOT_URL: 'http://localhost:3000/' - FORGEJO_ADMIN_USER: 'admin_user' - FORGEJO_ADMIN_PASSWORD: 'admin_password' - FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' - MAX_WAIT_ITERATIONS: 30 - - steps: - - name: Windows - Checkout code - uses: actions/checkout@v4 - - - name: Windows - Setup Windows Subsystem for Linux (WSL) - uses: Vampire/setup-wsl@v5 - with: - distribution: Alpine - wsl-shell-user: root - additional-packages: bash - - - name: WSL - Install Docker - shell: wsl-bash {0} - run: | - apk --update add --no-cache docker curl - - rc-update add docker default - openrc default - - # Wait for Docker to be ready - i=0 - until docker info > /dev/null 2>&1 || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do - echo "Waiting for Docker to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})" - sleep 1 - done - [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Docker is ready!" || { echo "Timed out waiting for Docker" ; exit 1; } - - - name: WSL - Start Forgejo Server - shell: wsl-bash {0} - run: | - docker run -d --name forgejo \ - -p 3000:3000 \ - -e USER_UID=1000 \ - -e USER_GID=1000 \ - -e FORGEJO__security__INSTALL_LOCK=true \ - -e FORGEJO__server__DOMAIN=localhost \ - -e FORGEJO__server__ROOT_URL=${{ env.FORGEJO_ROOT_URL }} \ - codeberg.org/forgejo/forgejo:11.0-rootless - - - name: Windows - Set up Go - uses: actions/setup-go@v5 - with: - go-version-file: go.mod - - - name: Windows - Install dependencies - run: go mod download - - - name: WSL - Register Runner on Forgejo Server - # Starting the Forgejo server takes some time. - # That time used to install go. - shell: wsl-bash {0} - run: | - i=0 - until curl -s ${{ env.FORGEJO_ROOT_URL }}/api/v1/version > /dev/null || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do - echo "Waiting for Forgejo to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})" - sleep 1 - done - [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Forgejo is ready!" || { echo "Timed out waiting for Forgejo" ; exit 1; } - - # Create admin user and generate runner token - docker exec forgejo forgejo admin user create --admin --username ${{ env.FORGEJO_ADMIN_USER }} --password ${{ env.FORGEJO_ADMIN_PASSWORD }} --email root@example.com - docker exec forgejo forgejo forgejo-cli actions register --labels docker --name therunner --secret ${{ env.FORGEJO_RUNNER_SECRET }} - - - name: Windows - Connect to Forgejo server - run: | - $configFileContent = @" - log: - level: debug - runner: - labels: - - windows:host - - docker:docker://node:20 - "@ - Set-Content -Path temporaryConfig.yml -Value $configFileContent - - # Register the runner - go run main.go create-runner-file --config temporaryConfig.yml --instance ${{ env.FORGEJO_ROOT_URL }} --secret ${{ env.FORGEJO_RUNNER_SECRET }} --name "windows-test-runner" - - - name: Windows - Run tests - run: go test -v ./... - env: - FORGEJO_URL: ${{ env.FORGEJO_ROOT_URL }} - FORGEJO_RUNNER_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }} - FORGEJO_RUNNER_HEX_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }} - - - release: - runs-on: ubuntu-latest - needs: [build, test] - if: github.event_name == 'push' && github.ref_type == 'tag' - steps: - - uses: actions/download-artifact@v4 - with: - path: . - - - name: Create Release - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ github.ref_name }} - files: forgejo-runner-windows-*/forgejo-runner-windows-*.exe - draft: false - prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }} - token: ${{ secrets.RELEASE_TOKEN }} - fail_on_unmatched_files: true - body: See [original release notes](https://code.forgejo.org/forgejo/runner/releases/tag/${{ github.ref_name }}). From 02a51c0a218061df978e88231d7507625afacd8e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 11 Sep 2025 14:43:26 +0000 Subject: [PATCH 196/281] fix: enforce job..timeout-minutes (#982) - enforce timeout-minutes timeout for jobs in a way similar to how it is done for steps - minimal refactor of evaluateStepTimeout evaluateTimeout so it can be used by jobs as well, with additional debug information and error logging if parsing fails - add integration tests for both step and job timeout-minutes, verifying expressions are allowed and evaluated Resolves forgejo/runner#979 --- Manually verified to work as expected https://v13.next.forgejo.org/earl-warren/testtimeout-minutes/actions/runs/3/jobs/0/attempt/1 ```yaml on: [push] jobs: test: runs-on: docker timeout-minutes: 1 steps: - run: | set -x while : ; do sleep 30 done ``` ![image](/attachments/047ddd15-7109-4931-a6ed-43073e4d31f9) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/982): fix: enforce job..timeout-minutes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/982 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/run_context.go | 5 ++++- act/runner/runner_test.go | 2 ++ act/runner/step.go | 11 +++++++---- act/runner/testdata/basic/push.yml | 3 ++- act/runner/testdata/timeout-minutes-job/push.yml | 12 ++++++++++++ act/runner/testdata/timeout-minutes-step/push.yml | 12 ++++++++++++ 6 files changed, 39 insertions(+), 6 deletions(-) create mode 100644 act/runner/testdata/timeout-minutes-job/push.yml create mode 100644 act/runner/testdata/timeout-minutes-step/push.yml diff --git a/act/runner/run_context.go b/act/runner/run_context.go index f6978b64..698fa0b4 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -943,7 +943,10 @@ func (rc *RunContext) Executor() (common.Executor, error) { return err } if res { - return executor(ctx) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, rc.Run.Job().TimeoutMinutes) + defer cancelTimeOut() + + return executor(timeoutctx) } return nil }, nil diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 86c0ad6e..0d29eca8 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -272,6 +272,8 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "evalmatrix-merge-array", "push", "", platforms, secrets}, {workdir, "basic", "push", "", platforms, secrets}, + {workdir, "timeout-minutes-stop", "push", "Job 'check' failed", platforms, secrets}, + {workdir, "timeout-minutes-job", "push", "context deadline exceeded", platforms, secrets}, {workdir, "fail", "push", "Job 'build' failed", platforms, secrets}, {workdir, "runs-on", "push", "", platforms, secrets}, {workdir, "checkout", "push", "", platforms, secrets}, diff --git a/act/runner/step.go b/act/runner/step.go index 25c67cfd..322b6f7e 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -177,7 +177,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo Mode: 0o666, })(ctx) - timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, rc.ExprEval, stepModel) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, stepModel.TimeoutMinutes) defer cancelTimeOut() err = executor(timeoutctx) @@ -213,12 +213,15 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo } } -func evaluateStepTimeout(ctx context.Context, exprEval ExpressionEvaluator, stepModel *model.Step) (context.Context, context.CancelFunc) { - timeout := exprEval.Interpolate(ctx, stepModel.TimeoutMinutes) +func evaluateTimeout(ctx context.Context, exprEval ExpressionEvaluator, timeoutMinutes string) (context.Context, context.CancelFunc) { + timeout := exprEval.Interpolate(ctx, timeoutMinutes) if timeout != "" { - if timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil { + timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64) + if err == nil { + common.Logger(ctx).Debugf("the step will stop in timeout-minutes %s", timeout) return context.WithTimeout(ctx, time.Duration(timeOutMinutes)*time.Minute) } + common.Logger(ctx).Errorf("timeout-minutes %s cannot be parsed and will be ignored: %w", timeout, err) } return ctx, func() {} } diff --git a/act/runner/testdata/basic/push.yml b/act/runner/testdata/basic/push.yml index 8cb1836f..8b40283e 100644 --- a/act/runner/testdata/basic/push.yml +++ b/act/runner/testdata/basic/push.yml @@ -18,7 +18,8 @@ jobs: - run: ls - run: echo 'hello world' - run: echo ${GITHUB_SHA} >> $(dirname "${GITHUB_WORKSPACE}")/sha.txt - - run: cat $(dirname "${GITHUB_WORKSPACE}")/sha.txt | grep ${GITHUB_SHA} + - timeout-minutes: 30 + run: cat $(dirname "${GITHUB_WORKSPACE}")/sha.txt | grep ${GITHUB_SHA} build: runs-on: ubuntu-latest needs: [check] diff --git a/act/runner/testdata/timeout-minutes-job/push.yml b/act/runner/testdata/timeout-minutes-job/push.yml new file mode 100644 index 00000000..be5f6c2d --- /dev/null +++ b/act/runner/testdata/timeout-minutes-job/push.yml @@ -0,0 +1,12 @@ +name: timeout-minutes +on: push + +env: + TIMEOUT_MINUTES: 0 + +jobs: + check: + runs-on: ubuntu-latest + timeout-minutes: ${{ env.TIMEOUT_MINUTES }} + steps: + - run: sleep 10 diff --git a/act/runner/testdata/timeout-minutes-step/push.yml b/act/runner/testdata/timeout-minutes-step/push.yml new file mode 100644 index 00000000..a79bb63a --- /dev/null +++ b/act/runner/testdata/timeout-minutes-step/push.yml @@ -0,0 +1,12 @@ +name: timeout-minutes +on: push + +env: + TIMEOUT_MINUTES: 0 + +jobs: + check: + runs-on: ubuntu-latest + steps: + - timeout-minutes: ${{ env.TIMEOUT_MINUTES }} + run: sleep 10 From 6f212fbb5a1dfb3d072bc1aa537093bb574a8e5b Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 11 Sep 2025 17:11:06 +0000 Subject: [PATCH 197/281] chore: wait 4 times longer for the forgejo cascade pull request to complete (#988) If the CI is busy, it may take more than one hour, for instance because the workflow is waiting while others are running. --- Note to reviewers: this input is not yet implemented, the next version of the cascading-pr action will have it (see [the pr](https://code.forgejo.org/actions/cascading-pr/pulls/40)). In the meantime it will be ignored. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/988): chore: wait 4 times longer for the forgejo cascade pull request to complete Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/988 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/cascade-forgejo.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index c1c09565..992fe215 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -106,4 +106,5 @@ jobs: close: true verbose: ${{ vars.VERBOSE == 'yes' }} debug: ${{ vars.DEBUG == 'yes' }} + wait-iteration: 120 update: .forgejo/cascading-forgejo From f728f8a923be4d7cd0096a4ccf62af577f34f4e6 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 11 Sep 2025 20:03:17 +0000 Subject: [PATCH 198/281] fix: if the Forgejo instance failed a job, cancel it (#986) - when the Forgejo instance stops a job because it runs for too long, it will be reported back as failed and it must be stopped, exactly as if it was canceled from the web UI by the user. - add test coverage for Reporter.ReportState - extract Reporter.Outputs output of Reporter.ReportState Resolves https://code.forgejo.org/forgejo/runner/issues/980 --- Manual testing with a locally built Forgejo instance built to check every minute instead of every 30 minutes, with ```ini [actions] ENABLED = true ENDLESS_TASK_TIMEOUT = 1m ``` and the following workflow: ```yaml on: [push] jobs: test: runs-on: docker steps: - run: sleep 60 - run: sleep 61 - run: sleep 62 ``` waiting in front of the screen and watching the logs of the runner, I see it stops before `sleep 62` is complete. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/986): fix: if the Forgejo instance failed a job, cancel it Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/986 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/reporter.go | 22 ++++-- internal/pkg/report/reporter_test.go | 106 +++++++++++++++++++++++++++ 2 files changed, 120 insertions(+), 8 deletions(-) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 68fa3db4..3233cb2a 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -209,6 +209,17 @@ func (r *Reporter) logf(format string, a ...any) { } } +func (r *Reporter) GetOutputs() map[string]string { + outputs := make(map[string]string) + r.outputs.Range(func(k, v any) bool { + if val, ok := v.(string); ok { + outputs[k.(string)] = val + } + return true + }) + return outputs +} + func (r *Reporter) SetOutputs(outputs map[string]string) error { r.stateMu.Lock() defer r.stateMu.Unlock() @@ -360,13 +371,7 @@ func (r *Reporter) ReportState() error { state := proto.Clone(r.state).(*runnerv1.TaskState) r.stateMu.RUnlock() - outputs := make(map[string]string) - r.outputs.Range(func(k, v any) bool { - if val, ok := v.(string); ok { - outputs[k.(string)] = val - } - return true - }) + outputs := r.GetOutputs() resp, err := r.client.UpdateTask(r.ctx, connect.NewRequest(&runnerv1.UpdateTaskRequest{ State: state, @@ -380,7 +385,8 @@ func (r *Reporter) ReportState() error { r.outputs.Store(k, struct{}{}) } - if resp.Msg.GetState().GetResult() == runnerv1.Result_RESULT_CANCELLED { + switch resp.Msg.GetState().GetResult() { + case runnerv1.Result_RESULT_CANCELLED, runnerv1.Result_RESULT_FAILURE: r.cancel() } diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index bbb084b1..65fcbfbe 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -286,6 +286,112 @@ func TestReporter_Fire(t *testing.T) { }) } +func TestReporterReportState(t *testing.T) { + for _, testCase := range []struct { + name string + fixture func(t *testing.T, reporter *Reporter, client *mocks.Client) + assert func(t *testing.T, reporter *Reporter, ctx context.Context, err error) + }{ + { + name: "PartialOutputs", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + outputKey1 := "KEY1" + outputValue1 := "VALUE1" + outputKey2 := "KEY2" + outputValue2 := "VALUE2" + reporter.SetOutputs(map[string]string{ + outputKey1: outputValue1, + outputKey2: outputValue2, + }) + + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{ + SentOutputs: []string{outputKey1}, + }), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.ErrorContains(t, err, "not all logs are submitted 1 remain") + outputs := reporter.GetOutputs() + assert.Equal(t, map[string]string{ + "KEY2": "VALUE2", + }, outputs) + assert.NoError(t, ctx.Err()) + }, + }, + { + name: "AllDone", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{}), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.NoError(t, err) + assert.NoError(t, ctx.Err()) + }, + }, + { + name: "Canceled", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{ + State: &runnerv1.TaskState{ + Result: runnerv1.Result_RESULT_CANCELLED, + }, + }), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.NoError(t, err) + assert.ErrorIs(t, ctx.Err(), context.Canceled) + }, + }, + { + name: "Failed", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{ + State: &runnerv1.TaskState{ + Result: runnerv1.Result_RESULT_FAILURE, + }, + }), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.NoError(t, err) + assert.ErrorIs(t, ctx.Err(), context.Canceled) + }, + }, + } { + t.Run(testCase.name, func(t *testing.T) { + client := mocks.NewClient(t) + ctx, cancel := context.WithCancel(context.Background()) + taskCtx, err := structpb.NewStruct(map[string]any{}) + require.NoError(t, err) + reporter := NewReporter(common.WithDaemonContext(ctx, t.Context()), cancel, client, &runnerv1.Task{ + Context: taskCtx, + }, time.Second) + + testCase.fixture(t, reporter, client) + err = reporter.ReportState() + testCase.assert(t, reporter, ctx, err) + }) + } +} + func TestReporterReportLogLost(t *testing.T) { reporter, client, _ := mockReporter(t) reporter.logRows = stringToRows("A") From b6c9da470edcb470b8292e5dce1f30fa935e5e70 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 12 Sep 2025 05:31:59 +0000 Subject: [PATCH 199/281] Update dependency forgejo/release-notes-assistant to v1.4.1 (#989) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/release-notes-assistant](https://code.forgejo.org/forgejo/release-notes-assistant) | patch | `v1.4.0` -> `v1.4.1` | --- ### Release Notes
forgejo/release-notes-assistant (forgejo/release-notes-assistant) ### [`v1.4.1`](https://code.forgejo.org/forgejo/release-notes-assistant/releases/tag/v1.4.1) [Compare Source](https://code.forgejo.org/forgejo/release-notes-assistant/compare/v1.4.0...v1.4.1) - other - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/115): Update action to v2.7.3 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/114): Update module mvdan.cc/gofumpt to v0.9.1 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/113): Update dependency go to v1.24.7 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/112): Update module mvdan.cc/gofumpt to v0.9.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/110): Update module github.com/stretchr/testify to v1.11.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/109): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.4.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/108): Update module golang.org/x/tools/cmd/deadcode to v0.36.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/107): Update dependency go to v1.24.6 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/106): Update action to v2.7.2 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/105): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.3.1
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/989 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/release-notes-assistant.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 92fcccd4..9dc12abe 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -12,7 +12,7 @@ on: - labeled env: - RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant + RNA_VERSION: v1.4.1 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant jobs: release-notes: From 19f4dbeb4b1f04cb3eb01e15c459f39327f9a819 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 12 Sep 2025 06:49:16 +0000 Subject: [PATCH 200/281] chore: data.forgejo.org/actions/cascading-pr is the canonical location (#990) ![image](/attachments/28a98026-29ec-41c2-b3c6-c539098e8df6) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/990): chore: data.forgejo.org/actions/cascading-pr is the canonical location Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/990 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/cascade-setup-forgejo.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml index fff2309f..07de78a7 100644 --- a/.forgejo/workflows/cascade-setup-forgejo.yml +++ b/.forgejo/workflows/cascade-setup-forgejo.yml @@ -81,7 +81,7 @@ jobs: container: image: 'code.forgejo.org/oci/node:22-bookworm' steps: - - uses: https://code.forgejo.org/actions/cascading-pr@v2.2.1 + - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1 with: origin-url: ${{ forge.server_url }} origin-repo: ${{ forge.repository }} From 458dae9827f5c2f9f0da45b478e5125d9f915924 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 12 Sep 2025 11:04:10 +0000 Subject: [PATCH 201/281] Update https://data.forgejo.org/actions/cascading-pr action to v2.3.0 (#992) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/cascading-pr](https://code.forgejo.org/actions/cascading-pr) | action | minor | `v2.2.1` -> `v2.3.0` | --- ### Release Notes
actions/cascading-pr (https://data.forgejo.org/actions/cascading-pr) ### [`v2.3.0`](https://code.forgejo.org/actions/cascading-pr/compare/v2.2.1...v2.3.0) [Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.2.1...v2.3.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/992 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/cascade-forgejo.yml | 2 +- .forgejo/workflows/cascade-setup-forgejo.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 992fe215..e88370cc 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -90,7 +90,7 @@ jobs: - uses: actions/setup-go@v5 with: go-version-file: go.mod - - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1 + - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0 with: origin-url: ${{ forge.server_url }} origin-repo: ${{ forge.repository }} diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml index 07de78a7..9292d936 100644 --- a/.forgejo/workflows/cascade-setup-forgejo.yml +++ b/.forgejo/workflows/cascade-setup-forgejo.yml @@ -81,7 +81,7 @@ jobs: container: image: 'code.forgejo.org/oci/node:22-bookworm' steps: - - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1 + - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0 with: origin-url: ${{ forge.server_url }} origin-repo: ${{ forge.repository }} From 3585d6774326fe59607bc8932f1e1e622e99d6bf Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 13 Sep 2025 17:35:56 +0000 Subject: [PATCH 202/281] chore: unify actions URLs in .forgejo/workflows (#993) - make them all absolute - use data.forgejo.org instead of code.forgejo.org This allows renovate to propose more consistent updates. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/993): chore: unify actions URLs in .forgejo/workflows Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/993 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/build-release.yml | 2 +- .forgejo/workflows/cascade-forgejo.yml | 2 +- .forgejo/workflows/example-docker-compose.yml | 2 +- .forgejo/workflows/test.yml | 10 +++++----- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index edeb907c..e57ec989 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -26,7 +26,7 @@ jobs: runs-on: lxc-bookworm if: vars.ROLE == 'forgejo-coding' steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - id: forgejo uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index 6bb6c4b4..12d790ab 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -23,7 +23,7 @@ jobs: # root is used for testing, allow it if: vars.ROLE == 'forgejo-integration' || forge.repository_owner == 'root' steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - name: Increase the verbosity when there are no secrets id: verbose diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index e88370cc..36bc899d 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -87,7 +87,7 @@ jobs: with: fetch-depth: '0' show-progress: 'false' - - uses: actions/setup-go@v5 + - uses: https://data.forgejo.org/actions/setup-go@v5 with: go-version-file: go.mod - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0 diff --git a/.forgejo/workflows/example-docker-compose.yml b/.forgejo/workflows/example-docker-compose.yml index dce57a39..c39802ad 100644 --- a/.forgejo/workflows/example-docker-compose.yml +++ b/.forgejo/workflows/example-docker-compose.yml @@ -15,7 +15,7 @@ jobs: if: vars.ROLE == 'forgejo-coding' runs-on: lxc-bookworm steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - name: Install docker run: | diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index d817ae3b..5a1dd4d5 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -59,7 +59,7 @@ jobs: - run: make build - - uses: https://code.forgejo.org/actions/upload-artifact@v3 + - uses: https://data.forgejo.org/actions/upload-artifact@v3 with: name: forgejo-runner path: forgejo-runner @@ -79,9 +79,9 @@ jobs: needs: [build-and-tests] steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - - uses: https://code.forgejo.org/actions/download-artifact@v3 + - uses: https://data.forgejo.org/actions/download-artifact@v3 with: name: forgejo-runner @@ -156,9 +156,9 @@ jobs: needs: [build-and-tests] steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: https://data.forgejo.org/actions/setup-go@v5 with: go-version-file: go.mod From 2573ccaf19b25bc4420203ecae124e995d387292 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 14 Sep 2025 20:02:43 +0000 Subject: [PATCH 203/281] fix: send job outputs & job result to Forgejo in sync with each other (#995) Fixes #994. First commit ensures that the interpolateResults method is invoked before data is sent to the reporter. Second commit changes how data is sent to the reporter to include both the result and the job outputs. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/995): fix: send job outputs & job result to Forgejo in sync with each other Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/995 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/job_executor.go | 69 ++++--- act/runner/job_executor_test.go | 45 ++++- act/runner/mocks/FieldLogger.go | 264 +++++++++++++++++++++++++++ internal/app/run/runner.go | 1 - internal/pkg/report/reporter.go | 17 +- internal/pkg/report/reporter_test.go | 29 ++- 6 files changed, 374 insertions(+), 51 deletions(-) create mode 100644 act/runner/mocks/FieldLogger.go diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index cb50c84c..7a939930 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -8,6 +8,7 @@ import ( "code.forgejo.org/forgejo/runner/v11/act/common" "code.forgejo.org/forgejo/runner/v11/act/container" "code.forgejo.org/forgejo/runner/v11/act/model" + "github.com/sirupsen/logrus" ) type jobInfo interface { @@ -104,37 +105,40 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo } } - postExecutor = postExecutor.Finally(func(ctx context.Context) error { + setJobResults := func(ctx context.Context) error { jobError := common.JobError(ctx) // Fresh context to ensure job result output works even if prev. context was a cancelled job ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute) defer cancel() setJobResult(ctx, info, rc, jobError == nil) - setJobOutputs(ctx, rc) + return nil + } + + cleanupJob := func(_ context.Context) error { var err error - { - // Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job - ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout) - defer cancel() - logger := common.Logger(ctx) - logger.Debugf("Cleaning up container for job %s", rc.jobContainerName()) - if err = info.stopContainer()(ctx); err != nil { - logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err) - } + // Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job + ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout) + defer cancel() - if !rc.IsHostEnv(ctx) && rc.getNetworkCreated(ctx) { - networkName := rc.getNetworkName(ctx) - logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName()) - if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil { - logger.Errorf("Error while cleaning network %s: %v", networkName, err) - } + logger := common.Logger(ctx) + logger.Debugf("Cleaning up container for job %s", rc.jobContainerName()) + if err = info.stopContainer()(ctx); err != nil { + logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err) + } + + if !rc.IsHostEnv(ctx) && rc.getNetworkCreated(ctx) { + networkName := rc.getNetworkName(ctx) + logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName()) + if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil { + logger.Errorf("Error while cleaning network %s: %v", networkName, err) } } + return err - }) + } pipeline := make([]common.Executor, 0) pipeline = append(pipeline, preSteps...) @@ -152,6 +156,8 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo return postExecutor(ctx) }). Finally(info.interpolateOutputs()). + Finally(setJobResults). + Finally(cleanupJob). Finally(info.closeContainer())) } @@ -185,22 +191,27 @@ func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success boo jobResultMessage = "failed" } - logger.WithField("jobResult", jobResult).Infof("\U0001F3C1 Job %s", jobResultMessage) -} - -func setJobOutputs(ctx context.Context, rc *RunContext) { + jobOutputs := rc.Run.Job().Outputs if rc.caller != nil { - // map outputs for reusable workflows - callerOutputs := make(map[string]string) - + // Rewrite the job's outputs into the workflow_call outputs... + jobOutputs = make(map[string]string) ee := rc.NewExpressionEvaluator(ctx) - for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs { - callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) + jobOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) } - - rc.caller.runContext.Run.Job().Outputs = callerOutputs + // When running as a daemon and receiving jobs from Forgejo, the next job (and any of it's `needs` outputs) will + // be provided by Forgejo based upon the data sent to the logger below. However, when running `forgejo-runner + // exec` with a reusable workflow, the next job will only be able to read outputs if those outputs are stored on + // the workflow -- that's what is accomplished here: + rc.caller.runContext.Run.Job().Outputs = jobOutputs } + + logger. + WithFields(logrus.Fields{ + "jobResult": jobResult, + "jobOutputs": jobOutputs, + }). + Infof("\U0001F3C1 Job %s", jobResultMessage) } func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor { diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index e42bf610..fe40df0f 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -12,10 +12,14 @@ import ( "code.forgejo.org/forgejo/runner/v11/act/common" "code.forgejo.org/forgejo/runner/v11/act/container" "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/act/runner/mocks" + "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) +//go:generate mockery --srcpkg=github.com/sirupsen/logrus --name=FieldLogger + func TestJobExecutor(t *testing.T) { tables := []TestJobFileInfo{ {workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets}, @@ -127,8 +131,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { executedSteps: []string{ "startContainer", "step1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -144,8 +149,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { executedSteps: []string{ "startContainer", "step1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "failure", @@ -162,8 +168,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "startContainer", "pre1", "step1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -180,8 +187,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "startContainer", "step1", "post1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -199,8 +207,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "pre1", "step1", "post1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -229,8 +238,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "step3", "post3", "post2", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -246,7 +256,27 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { t.Run(tt.name, func(t *testing.T) { fmt.Printf("::group::%s\n", tt.name) - ctx := common.WithJobErrorContainer(t.Context()) + executorOrder := make([]string, 0) + + mockLogger := mocks.NewFieldLogger(t) + mockLogger.On("Debugf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("Warningf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("WithField", mock.Anything, mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + // When `WithFields()` is called with jobResult & jobOutputs field, add `setJobResults` to executorOrder. + mockLogger.On("WithFields", + mock.MatchedBy(func(fields logrus.Fields) bool { + _, okJobResult := fields["jobResult"] + _, okJobOutput := fields["jobOutputs"] + return okJobOutput && okJobResult + })). + Run(func(args mock.Arguments) { + executorOrder = append(executorOrder, "setJobResults") + }). + Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + + mockLogger.On("WithFields", mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + + ctx := common.WithLogger(common.WithJobErrorContainer(t.Context()), mockLogger) jim := &jobInfoMock{} sfm := &stepFactoryMock{} rc := &RunContext{ @@ -262,7 +292,6 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { Config: &Config{}, } rc.ExprEval = rc.NewExpressionEvaluator(ctx) - executorOrder := make([]string, 0) jim.On("steps").Return(tt.steps) diff --git a/act/runner/mocks/FieldLogger.go b/act/runner/mocks/FieldLogger.go new file mode 100644 index 00000000..5cfa5ad2 --- /dev/null +++ b/act/runner/mocks/FieldLogger.go @@ -0,0 +1,264 @@ +// Code generated by mockery v2.53.5. DO NOT EDIT. + +package mocks + +import ( + logrus "github.com/sirupsen/logrus" + mock "github.com/stretchr/testify/mock" +) + +// FieldLogger is an autogenerated mock type for the FieldLogger type +type FieldLogger struct { + mock.Mock +} + +// Debug provides a mock function with given fields: args +func (_m *FieldLogger) Debug(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Debugf provides a mock function with given fields: format, args +func (_m *FieldLogger) Debugf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Debugln provides a mock function with given fields: args +func (_m *FieldLogger) Debugln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Error provides a mock function with given fields: args +func (_m *FieldLogger) Error(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Errorf provides a mock function with given fields: format, args +func (_m *FieldLogger) Errorf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Errorln provides a mock function with given fields: args +func (_m *FieldLogger) Errorln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Fatal provides a mock function with given fields: args +func (_m *FieldLogger) Fatal(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Fatalf provides a mock function with given fields: format, args +func (_m *FieldLogger) Fatalf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Fatalln provides a mock function with given fields: args +func (_m *FieldLogger) Fatalln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Info provides a mock function with given fields: args +func (_m *FieldLogger) Info(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Infof provides a mock function with given fields: format, args +func (_m *FieldLogger) Infof(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Infoln provides a mock function with given fields: args +func (_m *FieldLogger) Infoln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Panic provides a mock function with given fields: args +func (_m *FieldLogger) Panic(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Panicf provides a mock function with given fields: format, args +func (_m *FieldLogger) Panicf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Panicln provides a mock function with given fields: args +func (_m *FieldLogger) Panicln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Print provides a mock function with given fields: args +func (_m *FieldLogger) Print(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Printf provides a mock function with given fields: format, args +func (_m *FieldLogger) Printf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Println provides a mock function with given fields: args +func (_m *FieldLogger) Println(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warn provides a mock function with given fields: args +func (_m *FieldLogger) Warn(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warnf provides a mock function with given fields: format, args +func (_m *FieldLogger) Warnf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warning provides a mock function with given fields: args +func (_m *FieldLogger) Warning(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warningf provides a mock function with given fields: format, args +func (_m *FieldLogger) Warningf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warningln provides a mock function with given fields: args +func (_m *FieldLogger) Warningln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warnln provides a mock function with given fields: args +func (_m *FieldLogger) Warnln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// WithError provides a mock function with given fields: err +func (_m *FieldLogger) WithError(err error) *logrus.Entry { + ret := _m.Called(err) + + if len(ret) == 0 { + panic("no return value specified for WithError") + } + + var r0 *logrus.Entry + if rf, ok := ret.Get(0).(func(error) *logrus.Entry); ok { + r0 = rf(err) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*logrus.Entry) + } + } + + return r0 +} + +// WithField provides a mock function with given fields: key, value +func (_m *FieldLogger) WithField(key string, value interface{}) *logrus.Entry { + ret := _m.Called(key, value) + + if len(ret) == 0 { + panic("no return value specified for WithField") + } + + var r0 *logrus.Entry + if rf, ok := ret.Get(0).(func(string, interface{}) *logrus.Entry); ok { + r0 = rf(key, value) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*logrus.Entry) + } + } + + return r0 +} + +// WithFields provides a mock function with given fields: fields +func (_m *FieldLogger) WithFields(fields logrus.Fields) *logrus.Entry { + ret := _m.Called(fields) + + if len(ret) == 0 { + panic("no return value specified for WithFields") + } + + var r0 *logrus.Entry + if rf, ok := ret.Get(0).(func(logrus.Fields) *logrus.Entry); ok { + r0 = rf(fields) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*logrus.Entry) + } + } + + return r0 +} + +// NewFieldLogger creates a new instance of FieldLogger. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. +// The first argument is typically a *testing.T value. +func NewFieldLogger(t interface { + mock.TestingT + Cleanup(func()) +}, +) *FieldLogger { + mock := &FieldLogger{} + mock.Mock.Test(t) + + t.Cleanup(func() { mock.AssertExpectations(t) }) + + return mock +} diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 3f2b0127..a1283d61 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -366,7 +366,6 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. } execErr := executor(ctx) - _ = reporter.SetOutputs(job.Outputs) return execErr } diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 3233cb2a..0d1ebadb 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -130,6 +130,11 @@ func (r *Reporter) Fire(entry *log.Entry) error { } } } + if v, ok := entry.Data["jobOutputs"]; ok { + _ = r.setOutputs(v.(map[string]string)) + } else { + log.Panicf("received log entry with jobResult, but without jobOutputs -- outputs will be corrupted for this job") + } } if !r.duringSteps() { r.logRows = appendIfNotNil(r.logRows, r.parseLogRow(entry)) @@ -209,7 +214,7 @@ func (r *Reporter) logf(format string, a ...any) { } } -func (r *Reporter) GetOutputs() map[string]string { +func (r *Reporter) cloneOutputs() map[string]string { outputs := make(map[string]string) r.outputs.Range(func(k, v any) bool { if val, ok := v.(string); ok { @@ -220,10 +225,9 @@ func (r *Reporter) GetOutputs() map[string]string { return outputs } -func (r *Reporter) SetOutputs(outputs map[string]string) error { - r.stateMu.Lock() - defer r.stateMu.Unlock() - +// Errors from setOutputs are logged into the reporter automatically; the `errors` return value is only used for unit +// tests. +func (r *Reporter) setOutputs(outputs map[string]string) error { var errs []error recordError := func(format string, a ...any) { r.logf(format, a...) @@ -369,10 +373,9 @@ func (r *Reporter) ReportState() error { r.stateMu.RLock() state := proto.Clone(r.state).(*runnerv1.TaskState) + outputs := r.cloneOutputs() r.stateMu.RUnlock() - outputs := r.GetOutputs() - resp, err := r.client.UpdateTask(r.ctx, connect.NewRequest(&runnerv1.UpdateTaskRequest{ State: state, Outputs: outputs, diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index 65fcbfbe..a949c01b 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -78,7 +78,7 @@ func TestReporterSetOutputs(t *testing.T) { reporter, _, _ := mockReporter(t) expected := map[string]string{"a": "b", "c": "d"} - assert.NoError(t, reporter.SetOutputs(expected)) + assert.NoError(t, reporter.setOutputs(expected)) assertEqual(t, expected, &reporter.outputs) }) @@ -93,7 +93,7 @@ func TestReporterSetOutputs(t *testing.T) { "c": "ABCDEFG", // value too big "d": "e", } - err := reporter.SetOutputs(in) + err := reporter.setOutputs(in) assert.ErrorContains(t, err, "ignore output because the length of the value for \"c\" is 7 (the maximum is 5)") assert.ErrorContains(t, err, "ignore output because the key is longer than 5: \"0123456\"") expected := map[string]string{"d": "e"} @@ -104,11 +104,11 @@ func TestReporterSetOutputs(t *testing.T) { reporter, _, _ := mockReporter(t) first := map[string]string{"a": "b", "c": "d"} - assert.NoError(t, reporter.SetOutputs(first)) + assert.NoError(t, reporter.setOutputs(first)) assertEqual(t, first, &reporter.outputs) second := map[string]string{"c": "d", "e": "f"} - assert.ErrorContains(t, reporter.SetOutputs(second), "ignore output because a value already exists for the key \"c\"") + assert.ErrorContains(t, reporter.setOutputs(second), "ignore output because a value already exists for the key \"c\"") expected := map[string]string{"a": "b", "c": "d", "e": "f"} assertEqual(t, expected, &reporter.outputs) @@ -284,6 +284,23 @@ func TestReporter_Fire(t *testing.T) { assert.Equal(t, int64(3), reporter.state.Steps[0].LogLength) }) + + t.Run("jobResult jobOutputs extracted from log entry", func(t *testing.T) { + reporter, _, _ := mockReporter(t) + + dataStep0 := map[string]any{ + "stage": "Post", + "stepNumber": 0, + "raw_output": true, + "jobResult": "success", + "jobOutputs": map[string]string{"key1": "value1"}, + } + assert.NoError(t, reporter.Fire(&log.Entry{Message: "success!", Data: dataStep0})) + + assert.EqualValues(t, runnerv1.Result_RESULT_SUCCESS, reporter.state.Result) + value, _ := reporter.outputs.Load("key1") + assert.EqualValues(t, "value1", value) + }) } func TestReporterReportState(t *testing.T) { @@ -300,7 +317,7 @@ func TestReporterReportState(t *testing.T) { outputValue1 := "VALUE1" outputKey2 := "KEY2" outputValue2 := "VALUE2" - reporter.SetOutputs(map[string]string{ + reporter.setOutputs(map[string]string{ outputKey1: outputValue1, outputKey2: outputValue2, }) @@ -315,7 +332,7 @@ func TestReporterReportState(t *testing.T) { assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { t.Helper() require.ErrorContains(t, err, "not all logs are submitted 1 remain") - outputs := reporter.GetOutputs() + outputs := reporter.cloneOutputs() assert.Equal(t, map[string]string{ "KEY2": "VALUE2", }, outputs) From 543f3fd495bec5bf07604c74a9efcc2ba7591c65 Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Mon, 15 Sep 2025 07:26:56 +0000 Subject: [PATCH 204/281] feat: add support for a trixie based Debian GNU/Linux backend (e.g. trixie-lxc:lxc://debian:trixie) (#997) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/35 - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/997): feat: add support for a trixie based Debian GNU/Linux backend (e.g. trixie-lxc:lxc://debian:trixie) Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/997 Reviewed-by: earl-warren Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 2 +- act/runner/lxc-helpers.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index 2f36541f..78d70113 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -413,7 +413,7 @@ function lxc_install_lxc_inside() { local prefixv6="${2:-$LXC_IPV6_PREFIX_DEFAULT}" local packages="make git libvirt0 libpam-cgfs bridge-utils uidmap dnsmasq-base dnsmasq dnsmasq-utils qemu-user-static lxc-templates debootstrap" - if test "$(lxc_release)" = bookworm; then + if test "$(lxc_release)" != bullseye; then packages="$packages distro-info" fi diff --git a/act/runner/lxc-helpers.sh b/act/runner/lxc-helpers.sh index 705c5aab..769e238a 100755 --- a/act/runner/lxc-helpers.sh +++ b/act/runner/lxc-helpers.sh @@ -18,11 +18,11 @@ lxc-helpers.sh - LXC container management helpers SYNOPSIS lxc-helpers.sh [-v|--verbose] [-h|--help] - [-o|--os {bookworm|bullseye} (default bookworm)] + [-o|--os {trixie|bookworm|bullseye} (default bookworm)] command [arguments] lxc-helpers.sh [-v|--verbose] [-h|--help] - [-o|--os {bookworm|bullseye} (default bookworm)] + [-o|--os {trixie|bookworm|bullseye} (default bookworm)] [-c|--config {unprivileged lxc libvirt docker k8s} (default "lxc libvirt docker")] lxc_container_create [arguments] From 5c93da6fc74afb667c8d91854176f9b114e754a8 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 09:14:11 +0000 Subject: [PATCH 205/281] feat: the forgejo context is equivalent to the github context (#999) Resolves forgejo/runner#729 - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/999): feat: the forgejo context is equivalent to the github context Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/999 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/exprparser/interpreter.go | 2 + act/schema/action_schema.json | 7 ++++ act/schema/workflow_schema.json | 65 ++++++++++++++++++++++----------- 3 files changed, 52 insertions(+), 22 deletions(-) diff --git a/act/exprparser/interpreter.go b/act/exprparser/interpreter.go index 8ec3f7b4..26ad9d0e 100644 --- a/act/exprparser/interpreter.go +++ b/act/exprparser/interpreter.go @@ -158,6 +158,8 @@ func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableN return impl.env.Github, nil case "forge": return impl.env.Github, nil + case "forgejo": + return impl.env.Github, nil case "env": return impl.env.Env, nil case "job": diff --git a/act/schema/action_schema.json b/act/schema/action_schema.json index 6a0eabb0..f5252c9c 100644 --- a/act/schema/action_schema.json +++ b/act/schema/action_schema.json @@ -157,6 +157,7 @@ "output-value": { "context": [ "forge", + "forgejo", "github", "strategy", "matrix", @@ -171,6 +172,7 @@ "input-default-context": { "context": [ "forge", + "forgejo", "github", "inputs", "env", @@ -191,6 +193,7 @@ "string-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -207,6 +210,7 @@ "boolean-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -223,6 +227,7 @@ "step-env": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -242,6 +247,7 @@ "step-if": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -262,6 +268,7 @@ "step-with": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", diff --git a/act/schema/workflow_schema.json b/act/schema/workflow_schema.json index 826269a8..56e7d5d4 100644 --- a/act/schema/workflow_schema.json +++ b/act/schema/workflow_schema.json @@ -52,7 +52,7 @@ "boolean": {} }, "run-name": { - "context": ["forge", "github", "inputs", "vars"], + "context": ["forge", "forgejo", "github", "inputs", "vars"], "string": {}, "description": "The name for workflow runs generated from the workflow. GitHub displays the workflow run name in the list of workflow runs on your repository's 'Actions' tab.\n\n[Documentation](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#run-name)" }, @@ -1139,7 +1139,7 @@ }, "workflow-call-input-default": { "description": "If a `default` parameter is not set, the default value of the input is `false` for boolean, `0` for a number, and `\"\"` for a string.", - "context": ["forge", "github", "inputs", "vars"], + "context": ["forge", "forgejo", "github", "inputs", "vars"], "one-of": ["string", "boolean", "number"] }, "workflow-call-secrets": { @@ -1201,7 +1201,7 @@ }, "workflow-output-context": { "description": "The value to assign to the output parameter.", - "context": ["forge", "github", "inputs", "vars", "jobs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "jobs"], "string": {} }, "workflow-dispatch-string": { @@ -1402,7 +1402,7 @@ }, "workflow-env": { "description": "A map of environment variables that are available to the steps of all jobs in the workflow. You can also set environment variables that are only available to the steps of a single job or to a single step.\n\n[Documentation](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#env)", - "context": ["forge", "github", "inputs", "vars", "secrets", "env"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "secrets", "env"], "mapping": { "loose-key-type": "non-empty-string", "loose-value-type": "string" @@ -1517,6 +1517,7 @@ "description": "You can use the `if` conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1534,6 +1535,7 @@ "job-if-result": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1548,7 +1550,7 @@ }, "strategy": { "description": "Use `strategy` to use a matrix strategy for your jobs. A matrix strategy lets you use variables in a single job definition to automatically create multiple job runs that are based on the combinations of the variables. ", - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "mapping": { "properties": { "fail-fast": { @@ -1566,6 +1568,7 @@ "fail-fast": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1584,6 +1587,7 @@ "max-parallel": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1630,7 +1634,7 @@ "runs-on": { "description": "Use `runs-on` to define the type of machine to run the job on.\n* The destination machine can be either a GitHub-hosted runner, larger runner, or a self-hosted runner.\n* You can target runners based on the labels assigned to them, or their group membership, or a combination of these.\n* You can provide `runs-on` as a single string or as an array of strings.\n* If you specify an array of strings, your workflow will execute on any runner that matches all of the specified `runs-on` values.\n* If you would like to run your workflow on multiple machines, use `jobs..strategy`.", "required": true, - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": [ "non-empty-string", "sequence-of-non-empty-string", @@ -1656,6 +1660,7 @@ "description": "A map of variables that are available to all steps in the job.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1671,12 +1676,12 @@ }, "workflow-concurrency": { "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression.\n\nYou can also specify `concurrency` at the job level.\n\n[Documentation](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#concurrency)", - "context": ["forge", "github", "inputs", "vars"], + "context": ["forge", "forgejo", "github", "inputs", "vars"], "one-of": ["string", "concurrency-mapping"] }, "job-concurrency": { "description": "Concurrency ensures that only a single job using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the `secrets` context.\n\nYou can also specify `concurrency` at the workflow level.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["non-empty-string", "concurrency-mapping"] }, "concurrency-mapping": { @@ -1697,7 +1702,7 @@ }, "job-environment": { "description": "The environment that the job references. All environment protection rules must pass before a job referencing the environment is sent to a runner.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["string", "job-environment-mapping"] }, "job-environment-mapping": { @@ -1716,7 +1721,7 @@ }, "job-environment-name": { "description": "The name of the environment used by the job.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "string": {} }, "job-defaults": { @@ -1730,6 +1735,7 @@ "job-defaults-run": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1800,6 +1806,7 @@ "step-uses": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1821,6 +1828,7 @@ "job-uses": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1841,6 +1849,7 @@ "step-continue-on-error": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1866,6 +1875,7 @@ "step-if": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1891,6 +1901,7 @@ "step-if-result": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1913,6 +1924,7 @@ "description": "Sets variables for steps to use in the runner environment. You can also set variables for the entire workflow or a job.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1934,6 +1946,7 @@ "step-name": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1953,6 +1966,7 @@ "step-timeout-minutes": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1973,6 +1987,7 @@ "description": "A map of the input parameters defined by the action. Each input parameter is a key/value pair. Input parameters are set as variables. When you specify an input in a workflow file or use a default input value, GitHub creates a variable for the input with the name `INPUT_`. The variable created converts input names to uppercase letters and replaces spaces with `_`.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1993,7 +2008,7 @@ }, "container": { "description": "A container to run any steps in a job that don't already specify a container. If you have steps that use both script and container actions, the container actions will run as sibling containers on the same network with the same volume mounts.\n\nIf you do not set a container, all steps will run directly on the host specified by runs-on unless a step refers to an action configured to run in a container.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["string", "container-mapping"] }, "container-mapping": { @@ -2026,19 +2041,19 @@ }, "services": { "description": "Additional containers to host services for a job in a workflow. These are useful for creating databases or cache services like redis. The runner on the virtual machine will automatically create a network and manage the life cycle of the service containers. When you use a service container for a job or your step uses container actions, you don't need to set port information to access the service. Docker automatically exposes all ports between containers on the same network. When both the job and the action run in a container, you can directly reference the container by its hostname. The hostname is automatically mapped to the service name. When a step does not use a container action, you must access the service using localhost and bind the ports.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "mapping": { "loose-key-type": "non-empty-string", "loose-value-type": "services-container" } }, "services-container": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["non-empty-string", "container-mapping"] }, "container-registry-credentials": { "description": "If the image's container registry requires authentication to pull the image, you can use `jobs..container.credentials` to set a map of the username and password. The credentials are the same values that you would provide to the `docker login` command.", - "context": ["forge", "github", "inputs", "vars", "secrets", "env"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "secrets", "env"], "mapping": { "properties": { "username": "non-empty-string", @@ -2064,24 +2079,25 @@ } }, "boolean-needs-context": { - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "boolean": {} }, "number-needs-context": { - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "number": {} }, "string-needs-context": { - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "string": {} }, "scalar-needs-context": { - "context": ["forge", "github", "inputs", "vars", "env", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "env", "needs", "strategy", "matrix"], "one-of": ["string", "boolean", "number"] }, "scalar-needs-context-with-secrets": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2093,24 +2109,25 @@ "one-of": ["string", "boolean", "number"] }, "boolean-strategy-context": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "boolean": {} }, "number-strategy-context": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "number": {} }, "string-strategy-context": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "string": {} }, "job-timeout-minutes": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["number", "string"] }, "boolean-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2129,6 +2146,7 @@ "number-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2147,6 +2165,7 @@ "string-runner-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2164,6 +2183,7 @@ "string-runner-context-no-secrets": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2180,6 +2200,7 @@ "string-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", From b3c603644a29f06d5f2ad5a666da3feea512af61 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 15:26:16 +0200 Subject: [PATCH 206/281] chore: set log level to trace for runner tests --- internal/app/run/runner_test.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index b324b0f5..8e3b9707 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -20,6 +20,10 @@ import ( "github.com/stretchr/testify/require" ) +func init() { + log.SetLevel(log.TraceLevel) +} + func TestExplainFailedGenerateWorkflow(t *testing.T) { logged := "" log := func(message string, args ...any) { From 6877142ba4e3feeccc9e6bfb51900d13202e4de5 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 15:20:53 +0200 Subject: [PATCH 207/281] chore: minimal integration test for the LXC backend --- .forgejo/workflows/test.yml | 5 +++ internal/app/run/runner_test.go | 65 +++++++++++++++++++++++++++++++++ 2 files changed, 70 insertions(+) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 5a1dd4d5..28ab84b9 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -185,6 +185,11 @@ jobs: EOF apt --quiet install --yes -qq docker.io make + - name: install LXC + run: | + act/runner/lxc-helpers.sh lxc_prepare_environment + act/runner/lxc-helpers.sh lxc_install_lxc_inside 10.39.28 fdb1 + - run: apt-get -q install -qq -y gcc # required for `-race` - run: make integration-test diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 8e3b9707..634fae96 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -13,6 +13,7 @@ import ( "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" "code.forgejo.org/forgejo/runner/v11/internal/pkg/report" "connectrpc.com/connect" + log "github.com/sirupsen/logrus" "google.golang.org/protobuf/types/known/structpb" "github.com/stretchr/testify/assert" @@ -341,3 +342,67 @@ jobs: runWorkflow(ctx, cancel, checkKey2Yaml, "push", "refs/heads/main", "step 5: push cache should not be polluted by PR") }) } + +func TestRunnerLXC(t *testing.T) { + if testing.Short() { + t.Skip("skipping integration test") + } + + forgejoClient := &forgejoClientMock{} + + forgejoClient.On("Address").Return("https://127.0.0.1:8080") // not expected to be used in this test + forgejoClient.On("UpdateLog", mock.Anything, mock.Anything).Return(nil, nil) + forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). + Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + + runner := NewRunner( + &config.Config{ + Log: config.Log{ + JobLevel: "trace", + }, + Host: config.Host{ + WorkdirParent: t.TempDir(), + }, + }, + &config.Registration{ + Labels: []string{"lxc:lxc://debian:bookworm"}, + }, + forgejoClient) + require.NotNil(t, runner) + + runWorkflow := func(ctx context.Context, cancel context.CancelFunc, yamlContent, eventName, ref, description string) { + task := &runnerv1.Task{ + WorkflowPayload: []byte(yamlContent), + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "token": structpb.NewStringValue("some token here"), + "forgejo_default_actions_url": structpb.NewStringValue("https://data.forgejo.org"), + "repository": structpb.NewStringValue("runner"), + "event_name": structpb.NewStringValue(eventName), + "ref": structpb.NewStringValue(ref), + }, + }, + } + + reporter := report.NewReporter(ctx, cancel, forgejoClient, task, time.Second) + err := runner.run(ctx, task, reporter) + reporter.Close(nil) + require.NoError(t, err, description) + } + + t.Run("OK", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: lxc + steps: + - run: echo OK +` + runWorkflow(ctx, cancel, workflow, "push", "refs/heads/main", "OK") + }) +} From 69df253e4180ca065ea99bf30555e6939cd85d31 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 17:17:44 +0200 Subject: [PATCH 208/281] fix: ptyWriter.AutoStop is used by multiple goroutines ``` WARNING: DATA RACE Write at 0x00c0008541d8 by goroutine 9324: code.forgejo.org/forgejo/runner/v11/act/container.(*HostEnvironment).exec() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:368 +0x12dd code.forgejo.org/forgejo/runner/v11/act/runner.(*stepRun).main.func1.(*HostEnvironment).ExecWithCmdLine.1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:388 +0x354 Previous read at 0x00c0008541d8 by goroutine 9328: code.forgejo.org/forgejo/runner/v11/act/container.(*ptyWriter).Write() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:199 +0x57 io.copyBuffer() /home/debian/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.7.linux-amd64/src/io/io.go:431 +0x2ce Goroutine 9324 (running) created at: code.forgejo.org/forgejo/runner/v11/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v11/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v11/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/common/executor.go:109 +0x4f Goroutine 9328 (running) created at: code.forgejo.org/forgejo/runner/v11/act/container.(*HostEnvironment).exec() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:356 +0x112a code.forgejo.org/forgejo/runner/v11/act/runner.(*stepRun).main.func1.(*HostEnvironment).ExecWithCmdLine.1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:388 +0x354 code.forgejo.org/forgejo/runner/v11/act/runner.(*stepRun).main.func1() ``` --- act/container/host_environment.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 0e12fa3a..2a8ee318 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -13,6 +13,7 @@ import ( "path/filepath" "runtime" "strings" + "sync/atomic" "time" "github.com/go-git/go-billy/v5/helper/polyfill" @@ -191,12 +192,12 @@ func (e *HostEnvironment) Start(_ bool) common.Executor { type ptyWriter struct { Out io.Writer - AutoStop bool + AutoStop atomic.Bool dirtyLine bool } func (w *ptyWriter) Write(buf []byte) (int, error) { - if w.AutoStop && len(buf) > 0 && buf[len(buf)-1] == 4 { + if w.AutoStop.Load() && len(buf) > 0 && buf[len(buf)-1] == 4 { n, err := w.Out.Write(buf[:len(buf)-1]) if err != nil { return n, err @@ -365,7 +366,7 @@ func (e *HostEnvironment) exec(ctx context.Context, commandparam []string, cmdli return fmt.Errorf("RUN %w", err) } if tty != nil { - writer.AutoStop = true + writer.AutoStop.Store(true) if _, err := tty.Write([]byte("\x04")); err != nil { common.Logger(ctx).Debug("Failed to write EOT") } From d98522a2b6bc321ece729695d49223b73540d451 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 16 Sep 2025 13:20:43 +0000 Subject: [PATCH 209/281] Update dependency forgejo/lxc-helpers to v1.1.0 (#1001) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers) | minor | `1.0.3` -> `1.1.0` | --- ### Release Notes
forgejo/lxc-helpers (forgejo/lxc-helpers) ### [`v1.1.0`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.0.3...v1.1.0) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.0.3...v1.1.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1001 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index ac7ae172..d49940a0 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -20,7 +20,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_TOKEN:=} : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} -DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers +DEFAULT_LXC_HELPERS_VERSION=1.1.0 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} DEFAULT_RUNNER_VERSION=11.0.0 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} From e1e7d0e85aac1fc4cc451f6f4205ffa635edc3be Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Tue, 16 Sep 2025 19:42:04 +0000 Subject: [PATCH 210/281] fix: remove LXC working directory when it completes (#1003) The working directory was not cleaned up upon completion of a LXC job because rc.stopJobContainer() -> rc.cleanUpJobContainer() -> rc.JobContainer.Remove() was never called for LXC containers. - stopContainer() and closeContainer() must not call rc.stopHostEnvironment(ctx) for LXC containers because - it will needlessly be called twice - it intercepts the call to - rc.stopJobContainer() - rc.JobContainer.Close() - rc.stopHostEnvironment(ctx) must be called in rc.cleanUpJobContainer which is indirectly called by rc.stopJobContainer() - since rc.JobContainer.Close() is a noop, not calling it for LXC containers had no consequence Resolves forgejo/runner#442 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1003): fix: remove LXC working directory when it completes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1003 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/host_environment.go | 1 + act/runner/run_context.go | 16 +++++++++------- internal/app/run/runner_test.go | 15 ++++++++++++++- 3 files changed, 24 insertions(+), 8 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 2a8ee318..405862a9 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -407,6 +407,7 @@ func (e *HostEnvironment) Remove() common.Executor { if e.CleanUp != nil { e.CleanUp() } + common.Logger(ctx).Debugf("HostEnvironment.Remove %s", e.Path) return os.RemoveAll(e.Path) } } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 698fa0b4..bf74a92f 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -316,7 +316,15 @@ func (rc *RunContext) startHostEnvironment() common.Executor { StdOut: logWriter, LXC: rc.IsLXCHostEnv(ctx), } - rc.cleanUpJobContainer = rc.JobContainer.Remove() + rc.cleanUpJobContainer = func(ctx context.Context) error { + if err := rc.stopHostEnvironment(ctx); err != nil { + return err + } + if rc.JobContainer == nil { + return nil + } + return rc.JobContainer.Remove()(ctx) + } for k, v := range rc.JobContainer.GetRunnerContext(ctx) { if v, ok := v.(string); ok { rc.Env[fmt.Sprintf("RUNNER_%s", strings.ToUpper(k))] = v @@ -890,9 +898,6 @@ func (rc *RunContext) IsHostEnv(ctx context.Context) bool { func (rc *RunContext) stopContainer() common.Executor { return func(ctx context.Context) error { - if rc.IsLXCHostEnv(ctx) { - return rc.stopHostEnvironment(ctx) - } return rc.stopJobContainer()(ctx) } } @@ -900,9 +905,6 @@ func (rc *RunContext) stopContainer() common.Executor { func (rc *RunContext) closeContainer() common.Executor { return func(ctx context.Context) error { if rc.JobContainer != nil { - if rc.IsLXCHostEnv(ctx) { - return rc.stopHostEnvironment(ctx) - } return rc.JobContainer.Close()(ctx) } return nil diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 634fae96..65690832 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "os" "testing" "time" @@ -355,13 +356,14 @@ func TestRunnerLXC(t *testing.T) { forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + workdirParent := t.TempDir() runner := NewRunner( &config.Config{ Log: config.Log{ JobLevel: "trace", }, Host: config.Host{ - WorkdirParent: t.TempDir(), + WorkdirParent: workdirParent, }, }, &config.Registration{ @@ -388,6 +390,17 @@ func TestRunnerLXC(t *testing.T) { err := runner.run(ctx, task, reporter) reporter.Close(nil) require.NoError(t, err, description) + // verify there are no leftovers + assertDirectoryEmpty := func(t *testing.T, dir string) { + f, err := os.Open(dir) + require.NoError(t, err) + defer f.Close() + + names, err := f.Readdirnames(-1) + require.NoError(t, err) + assert.Empty(t, names) + } + assertDirectoryEmpty(t, workdirParent) } t.Run("OK", func(t *testing.T) { From aaf9dea44afa042f5093538cb8bcdf3c53b5ef9e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 12:48:52 +0000 Subject: [PATCH 211/281] fix: do not save .runner unless it is modified (#1006) Resolves forgejo/runner#548 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1006): fix: do not save .runner unless it is modified Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1006 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- go.mod | 2 +- internal/pkg/config/registration.go | 23 ++++++++- internal/pkg/config/registration_test.go | 63 ++++++++++++++++++++++++ 3 files changed, 85 insertions(+), 3 deletions(-) create mode 100644 internal/pkg/config/registration_test.go diff --git a/go.mod b/go.mod index 60ac1f9b..d1763deb 100644 --- a/go.mod +++ b/go.mod @@ -19,6 +19,7 @@ require ( github.com/go-git/go-billy/v5 v5.6.2 github.com/go-git/go-git/v5 v5.16.2 github.com/gobwas/glob v0.2.3 + github.com/google/go-cmp v0.7.0 github.com/google/uuid v1.6.0 github.com/joho/godotenv v1.5.1 github.com/julienschmidt/httprouter v1.3.0 @@ -62,7 +63,6 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/go-viper/mapstructure/v2 v2.4.0 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect - github.com/google/go-cmp v0.7.0 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect diff --git a/internal/pkg/config/registration.go b/internal/pkg/config/registration.go index be66b4fb..14d592bd 100644 --- a/internal/pkg/config/registration.go +++ b/internal/pkg/config/registration.go @@ -1,3 +1,4 @@ +// Copyright 2025 The Forgejo Authors. All rights reserved. // Copyright 2023 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT @@ -6,6 +7,8 @@ package config import ( "encoding/json" "os" + + "github.com/google/go-cmp/cmp" ) const registrationWarning = "This file is automatically generated by act-runner. Do not edit it manually unless you know what you are doing. Removing this file will cause act runner to re-register as a new runner." @@ -34,12 +37,28 @@ func LoadRegistration(file string) (*Registration, error) { return nil, err } - reg.Warning = "" - return ®, nil } +func isEqualRegistration(file string, reg *Registration) (bool, error) { + existing, err := LoadRegistration(file) + if err != nil { + if os.IsNotExist(err) { + return false, nil + } + return false, err + } + return cmp.Equal(*reg, *existing), nil +} + func SaveRegistration(file string, reg *Registration) error { + equal, err := isEqualRegistration(file, reg) + if err != nil { + return err + } + if equal { + return nil + } f, err := os.Create(file) if err != nil { return err diff --git a/internal/pkg/config/registration_test.go b/internal/pkg/config/registration_test.go new file mode 100644 index 00000000..fe89410b --- /dev/null +++ b/internal/pkg/config/registration_test.go @@ -0,0 +1,63 @@ +// Copyright 2025 The Forgejo Authors. All rights reserved. +// SPDX-License-Identifier: GPL-3.0-or-later + +package config + +import ( + "os" + "path/filepath" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestConfig_Registration(t *testing.T) { + reg := Registration{ + Warning: registrationWarning, + ID: 1234, + UUID: "UUID", + Name: "NAME", + Token: "TOKEN", + Address: "ADDRESS", + Labels: []string{"LABEL1", "LABEL2"}, + } + + file := filepath.Join(t.TempDir(), ".runner") + + // when the file does not exist, it is never equal + equal, err := isEqualRegistration(file, ®) + require.NoError(t, err) + assert.False(t, equal) + + require.NoError(t, SaveRegistration(file, ®)) + + regReloaded, err := LoadRegistration(file) + require.NoError(t, err) + assert.Equal(t, reg, *regReloaded) + + equal, err = isEqualRegistration(file, ®) + require.NoError(t, err) + assert.True(t, equal) + + // if the registration is not modified, it is not saved + time.Sleep(2 * time.Second) // file system precision on modification time is one second + before, err := os.Stat(file) + require.NoError(t, err) + require.NoError(t, SaveRegistration(file, ®)) + after, err := os.Stat(file) + require.NoError(t, err) + assert.Equal(t, before.ModTime(), after.ModTime()) + + reg.Labels = []string{"LABEL3"} + equal, err = isEqualRegistration(file, ®) + require.NoError(t, err) + assert.False(t, equal) + + // if the registration is modified, it is saved + require.NoError(t, SaveRegistration(file, ®)) + after, err = os.Stat(file) + require.NoError(t, err) + assert.NotEqual(t, before.ModTime(), after.ModTime()) +} From 89f37985bdd8d56601ac837d253e061380666987 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 16:40:31 +0000 Subject: [PATCH 212/281] feat: validate --directory alternative to --repository to not clone (#1008) Resolves forgejo/forgejo-actions-feature-requests#51 --- Note to reviewers: while working on fixing the exit status of the validate command, a border case was discovered when using `--clonedir . --repository .` by which it will not find an `action.yml` file at the root of the directory. It will be easier to fix and test using a `--directory` option designed to use a pre-existing directory instead because it is not a border case but the most common case really. - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1008): feat: validate --directory alternative to --repository to not clone Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1008 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .../.forgejo/workflows/workflow1.yml | 6 ++ .../validate/bad-directory/action.yml | 67 +++++++++++++++++++ .../.forgejo/workflows/action.yml | 6 ++ .../.forgejo/workflows/workflow1.yml | 6 ++ .../.forgejo/workflows/workflow2.yaml | 6 ++ .../good-directory/.gitea/workflows/bad.yml | 6 ++ .../good-directory/.github/workflows/bad.yml | 6 ++ .../validate/good-directory/action.yml | 67 +++++++++++++++++++ .../good-directory/subaction/action.yaml | 67 +++++++++++++++++++ .../testdata/validate/make-repositories.sh | 8 +++ internal/app/cmd/validate.go | 27 ++++++-- internal/app/cmd/validate_test.go | 27 +++++++- 12 files changed, 293 insertions(+), 6 deletions(-) create mode 100644 internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml create mode 100644 internal/app/cmd/testdata/validate/bad-directory/action.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/action.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml diff --git a/internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml b/internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml new file mode 100644 index 00000000..802c1a24 --- /dev/null +++ b/internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + ruins-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/bad-directory/action.yml b/internal/app/cmd/testdata/validate/bad-directory/action.yml new file mode 100644 index 00000000..6f70f275 --- /dev/null +++ b/internal/app/cmd/testdata/validate/bad-directory/action.yml @@ -0,0 +1,67 @@ +name: 'Forgejo release download and upload' +author: 'Forgejo authors' +description: | + Upload or download the assets of a release to a Forgejo instance. +inputs: + badinput: scalarinsteadofmap + url: + description: 'URL of the Forgejo instance' + default: '${{ env.FORGEJO_SERVER_URL }}' + repo: + description: 'owner/project relative to the URL' + default: '${{ forge.repository }}' + tag: + description: 'Tag of the release' + default: '${{ forge.ref_name }}' + title: + description: 'Title of the release (defaults to tag)' + sha: + description: 'SHA of the release' + default: '${{ forge.sha }}' + token: + description: 'Forgejo application token' + default: '${{ forge.token }}' + release-dir: + description: 'Directory in whichs release assets are uploaded or downloaded' + required: true + release-notes: + description: 'Release notes' + direction: + description: 'Can either be `download` or `upload`' + required: true + gpg-private-key: + description: 'GPG Private Key to sign the release artifacts' + gpg-passphrase: + description: 'Passphrase of the GPG Private Key' + download-retry: + description: 'Number of times to retry if the release is not ready (default 1)' + download-latest: + description: 'Download the latest release' + default: false + verbose: + description: 'Increase the verbosity level' + default: false + override: + description: 'Override an existing release by the same `{tag}`' + default: false + prerelease: + description: 'Mark Release as Pre-Release' + default: false + release-notes-assistant: + description: 'Generate release notes with Release Notes Assistant' + default: false + hide-archive-link: + description: 'Hide the archive links' + default: false + +runs: + using: "composite" + steps: + - if: ${{ inputs.release-notes-assistant }} + uses: https://data.forgejo.org/actions/cache@v4 + with: + key: rna-${{ inputs.repo }} + path: ${{ forge.action_path }}/rna + + - run: echo "${{ forge.action_path }}" >> $FORGEJO_PATH + shell: bash diff --git a/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml new file mode 100644 index 00000000..efdc13fc --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + runs-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml new file mode 100644 index 00000000..efdc13fc --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + runs-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml new file mode 100644 index 00000000..efdc13fc --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + runs-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml b/internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml new file mode 100644 index 00000000..802c1a24 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + ruins-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml b/internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml new file mode 100644 index 00000000..802c1a24 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + ruins-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/action.yml b/internal/app/cmd/testdata/validate/good-directory/action.yml new file mode 100644 index 00000000..cb66d230 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/action.yml @@ -0,0 +1,67 @@ +# SPDX-License-Identifier: MIT +name: 'Forgejo release download and upload' +author: 'Forgejo authors' +description: | + Upload or download the assets of a release to a Forgejo instance. +inputs: + url: + description: 'URL of the Forgejo instance' + default: '${{ env.FORGEJO_SERVER_URL }}' + repo: + description: 'owner/project relative to the URL' + default: '${{ forge.repository }}' + tag: + description: 'Tag of the release' + default: '${{ forge.ref_name }}' + title: + description: 'Title of the release (defaults to tag)' + sha: + description: 'SHA of the release' + default: '${{ forge.sha }}' + token: + description: 'Forgejo application token' + default: '${{ forge.token }}' + release-dir: + description: 'Directory in whichs release assets are uploaded or downloaded' + required: true + release-notes: + description: 'Release notes' + direction: + description: 'Can either be `download` or `upload`' + required: true + gpg-private-key: + description: 'GPG Private Key to sign the release artifacts' + gpg-passphrase: + description: 'Passphrase of the GPG Private Key' + download-retry: + description: 'Number of times to retry if the release is not ready (default 1)' + download-latest: + description: 'Download the latest release' + default: false + verbose: + description: 'Increase the verbosity level' + default: false + override: + description: 'Override an existing release by the same `{tag}`' + default: false + prerelease: + description: 'Mark Release as Pre-Release' + default: false + release-notes-assistant: + description: 'Generate release notes with Release Notes Assistant' + default: false + hide-archive-link: + description: 'Hide the archive links' + default: false + +runs: + using: "composite" + steps: + - if: ${{ inputs.release-notes-assistant }} + uses: https://data.forgejo.org/actions/cache@v4 + with: + key: rna-${{ inputs.repo }} + path: ${{ forge.action_path }}/rna + + - run: echo "${{ forge.action_path }}" >> $FORGEJO_PATH + shell: bash diff --git a/internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml b/internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml new file mode 100644 index 00000000..cb66d230 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml @@ -0,0 +1,67 @@ +# SPDX-License-Identifier: MIT +name: 'Forgejo release download and upload' +author: 'Forgejo authors' +description: | + Upload or download the assets of a release to a Forgejo instance. +inputs: + url: + description: 'URL of the Forgejo instance' + default: '${{ env.FORGEJO_SERVER_URL }}' + repo: + description: 'owner/project relative to the URL' + default: '${{ forge.repository }}' + tag: + description: 'Tag of the release' + default: '${{ forge.ref_name }}' + title: + description: 'Title of the release (defaults to tag)' + sha: + description: 'SHA of the release' + default: '${{ forge.sha }}' + token: + description: 'Forgejo application token' + default: '${{ forge.token }}' + release-dir: + description: 'Directory in whichs release assets are uploaded or downloaded' + required: true + release-notes: + description: 'Release notes' + direction: + description: 'Can either be `download` or `upload`' + required: true + gpg-private-key: + description: 'GPG Private Key to sign the release artifacts' + gpg-passphrase: + description: 'Passphrase of the GPG Private Key' + download-retry: + description: 'Number of times to retry if the release is not ready (default 1)' + download-latest: + description: 'Download the latest release' + default: false + verbose: + description: 'Increase the verbosity level' + default: false + override: + description: 'Override an existing release by the same `{tag}`' + default: false + prerelease: + description: 'Mark Release as Pre-Release' + default: false + release-notes-assistant: + description: 'Generate release notes with Release Notes Assistant' + default: false + hide-archive-link: + description: 'Hide the archive links' + default: false + +runs: + using: "composite" + steps: + - if: ${{ inputs.release-notes-assistant }} + uses: https://data.forgejo.org/actions/cache@v4 + with: + key: rna-${{ inputs.repo }} + path: ${{ forge.action_path }}/rna + + - run: echo "${{ forge.action_path }}" >> $FORGEJO_PATH + shell: bash diff --git a/internal/app/cmd/testdata/validate/make-repositories.sh b/internal/app/cmd/testdata/validate/make-repositories.sh index 6f3918ee..0047cb4c 100755 --- a/internal/app/cmd/testdata/validate/make-repositories.sh +++ b/internal/app/cmd/testdata/validate/make-repositories.sh @@ -35,6 +35,10 @@ git clone --bare $tmpdir/good good-repository rm -fr good-repository/hooks touch good-repository/refs/placeholder +rm -fr good-directory +git clone $tmpdir/good good-directory +rm -fr good-directory/.git + # bad mkdir $tmpdir/bad @@ -54,3 +58,7 @@ rm -fr bad-repository git clone --bare $tmpdir/bad bad-repository rm -fr bad-repository/hooks touch bad-repository/refs/placeholder + +rm -fr bad-directory +git clone $tmpdir/bad bad-directory +rm -fr bad-directory/.git diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index ca5ab732..474ff56f 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -23,6 +23,7 @@ type validateArgs struct { path string repository string clonedir string + directory string workflow bool action bool } @@ -145,8 +146,16 @@ func validateRepository(validateArgs *validateArgs) error { return nil } +func processDirectory(validateArgs *validateArgs) { + if len(validateArgs.directory) > 0 { + validateArgs.repository = validateArgs.directory + validateArgs.clonedir = validateArgs.directory + } +} + func runValidate(_ context.Context, validateArgs *validateArgs) func(cmd *cobra.Command, args []string) error { return func(cmd *cobra.Command, args []string) error { + processDirectory(validateArgs) if len(validateArgs.path) > 0 { return validatePath(validateArgs) } else if len(validateArgs.repository) > 0 { @@ -168,9 +177,15 @@ Validate workflows or actions with a schema verifying they are conformant. The --path argument is a filename that will be validated as a workflow (if the --workflow flag is set) or as an action (if the --action flag is set). -The --repository argument is a URL to a Git repository. It will be -cloned (in the --clonedir directory or a temporary location removed -when the validation completes). The following files will be validated: +The --repository argument is a URL to a Git repository that contains +workflows or actions. It will be cloned (in the --clonedir directory +or a temporary location removed when the validation completes). + +The --directory argument is the path a repository to be explored for +files to validate. + +The following files will be validated when exploring the clone of a repository +(--repository) or a directory (--directory): - All .forgejo/workflows/*.{yml,yaml} files as workflows - All **/action.{yml,yaml} files as actions @@ -185,9 +200,11 @@ when the validation completes). The following files will be validated: validateCmd.Flags().StringVar(&validateArgs.clonedir, "clonedir", "", "directory in which the repository will be cloned") validateCmd.Flags().StringVar(&validateArgs.repository, "repository", "", "URL to a repository to validate") + validateCmd.Flags().StringVar(&validateArgs.directory, "directory", "", "directory to a repository to validate") validateCmd.Flags().StringVar(&validateArgs.path, "path", "", "path to the file") - validateCmd.MarkFlagsOneRequired("repository", "path") - validateCmd.MarkFlagsMutuallyExclusive("repository", "path") + validateCmd.MarkFlagsOneRequired("repository", "path", "directory") + validateCmd.MarkFlagsMutuallyExclusive("repository", "path", "directory") + validateCmd.MarkFlagsMutuallyExclusive("directory", "clonedir") return validateCmd } diff --git a/internal/app/cmd/validate_test.go b/internal/app/cmd/validate_test.go index 7442d1d2..8a7c6c71 100644 --- a/internal/app/cmd/validate_test.go +++ b/internal/app/cmd/validate_test.go @@ -27,10 +27,20 @@ func Test_validateCmd(t *testing.T) { message: "one of --workflow or --action must be set", }, { - name: "MutuallyExclusive", + name: "MutuallyExclusiveActionWorkflow", args: []string{"--action", "--workflow", "--path", "/tmp"}, message: "[action workflow] were all set", }, + { + name: "MutuallyExclusiveRepositoryDirectory", + args: []string{"--repository", "example.com", "--directory", "."}, + message: "[directory repository] were all set", + }, + { + name: "MutuallyExclusiveClonedirDirectory", + args: []string{"--clonedir", ".", "--directory", "."}, + message: "[clonedir directory] were all set", + }, { name: "PathActionOK", args: []string{"--action", "--path", "testdata/validate/good-action.yml"}, @@ -51,6 +61,21 @@ func Test_validateCmd(t *testing.T) { args: []string{"--workflow", "--path", "testdata/validate/bad-workflow.yml"}, stdOut: "Unknown Property ruins-on", }, + { + name: "DirectoryOK", + args: []string{"--directory", "testdata/validate/good-directory"}, + stdOut: "action.yml action schema validation OK\nsubaction/action.yaml action schema validation OK\n.forgejo/workflows/action.yml workflow schema validation OK\n.forgejo/workflows/workflow1.yml workflow schema validation OK\n.forgejo/workflows/workflow2.yaml workflow schema validation OK", + }, + { + name: "DirectoryActionNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: "action.yml action schema validation failed", + }, + { + name: "DirectoryWorkflowNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + }, { name: "RepositoryOK", args: []string{"--repository", "testdata/validate/good-repository"}, From bcf2bfbf2054052e2f48a6dae6c3710bec4abd04 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 15:37:07 +0200 Subject: [PATCH 213/281] fix: find action.y*ml at the root of the directory The lookup of action.y*ml files failed at the root of the directory when specified with . because it does not start with a / when walking the directory. --- internal/app/cmd/validate.go | 17 +++++++++++++---- internal/app/cmd/validate_test.go | 9 +++++++++ 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index 474ff56f..49395000 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -65,8 +65,17 @@ func validatePath(validateArgs *validateArgs) error { return validate("", validateArgs.path, validateArgs.workflow, validateArgs.action) } -func validateHasYamlSuffix(s, suffix string) bool { - return strings.HasSuffix(s, suffix+".yml") || strings.HasSuffix(s, suffix+".yaml") +func validatePathMatch(existing, search string) bool { + if !validateHasYamlSuffix(existing) { + return false + } + existing = strings.TrimSuffix(existing, ".yml") + existing = strings.TrimSuffix(existing, ".yaml") + return existing == search || strings.HasSuffix(existing, "/"+search) +} + +func validateHasYamlSuffix(s string) bool { + return strings.HasSuffix(s, ".yml") || strings.HasSuffix(s, ".yaml") } func validateRepository(validateArgs *validateArgs) error { @@ -107,12 +116,12 @@ func validateRepository(validateArgs *validateArgs) error { } if err := filepath.Walk(clonedir, func(path string, fi fs.FileInfo, err error) error { - if validateHasYamlSuffix(path, "/.forgejo/workflows/action") { + if validatePathMatch(path, ".forgejo/workflows/action") { return nil } isWorkflow := false isAction := true - if validateHasYamlSuffix(path, "/action") { + if validatePathMatch(path, "action") { if err := validate(clonedir, path, isWorkflow, isAction); err != nil { return err } diff --git a/internal/app/cmd/validate_test.go b/internal/app/cmd/validate_test.go index 8a7c6c71..d620128b 100644 --- a/internal/app/cmd/validate_test.go +++ b/internal/app/cmd/validate_test.go @@ -10,6 +10,15 @@ import ( "github.com/stretchr/testify/assert" ) +func Test_validatePathMatch(t *testing.T) { + assert.False(t, validatePathMatch("nosuffix", "nosuffix")) + assert.True(t, validatePathMatch("something.yml", "something")) + assert.True(t, validatePathMatch("something.yaml", "something")) + assert.False(t, validatePathMatch("entire_something.yaml", "something")) + assert.True(t, validatePathMatch("nested/in/directory/something.yaml", "something")) + assert.False(t, validatePathMatch("nested/in/directory/entire_something.yaml", "something")) +} + func Test_validateCmd(t *testing.T) { ctx := context.Background() for _, testCase := range []struct { From 8c6c089a656dc9c720054c0188605f37e8300746 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 15:41:55 +0200 Subject: [PATCH 214/281] fix: forgejo-runner validate exit with error when validation fails Refs forgejo/runner#1002 --- internal/app/cmd/validate.go | 15 ++++++----- internal/app/cmd/validate_test.go | 42 ++++++++++++++++++------------- 2 files changed, 33 insertions(+), 24 deletions(-) diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index 49395000..564922cc 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -50,12 +50,13 @@ func validate(dir, path string, isWorkflow, isAction bool) error { kind = "action" } if err != nil { - fmt.Printf("%s %s schema validation failed:\n%s\n", shortPath, kind, err.Error()) + err = fmt.Errorf("%s %s schema validation failed:\n%s", shortPath, kind, err.Error()) + fmt.Printf("%s\n", err.Error()) } else { fmt.Printf("%s %s schema validation OK\n", shortPath, kind) } - return nil + return err } func validatePath(validateArgs *validateArgs) error { @@ -115,6 +116,8 @@ func validateRepository(validateArgs *validateArgs) error { } } + var validationErrors error + if err := filepath.Walk(clonedir, func(path string, fi fs.FileInfo, err error) error { if validatePathMatch(path, ".forgejo/workflows/action") { return nil @@ -123,7 +126,7 @@ func validateRepository(validateArgs *validateArgs) error { isAction := true if validatePathMatch(path, "action") { if err := validate(clonedir, path, isWorkflow, isAction); err != nil { - return err + validationErrors = errors.Join(validationErrors, err) } } return nil @@ -141,9 +144,9 @@ func validateRepository(validateArgs *validateArgs) error { if err := filepath.Walk(workflowdir, func(path string, fi fs.FileInfo, err error) error { isWorkflow := true isAction := false - if validateHasYamlSuffix(path, "") { + if validateHasYamlSuffix(path) { if err := validate(clonedir, path, isWorkflow, isAction); err != nil { - return err + validationErrors = errors.Join(validationErrors, err) } } return nil @@ -152,7 +155,7 @@ func validateRepository(validateArgs *validateArgs) error { } } - return nil + return validationErrors } func processDirectory(validateArgs *validateArgs) { diff --git a/internal/app/cmd/validate_test.go b/internal/app/cmd/validate_test.go index d620128b..9b132d9f 100644 --- a/internal/app/cmd/validate_test.go +++ b/internal/app/cmd/validate_test.go @@ -56,9 +56,10 @@ func Test_validateCmd(t *testing.T) { stdOut: "schema validation OK", }, { - name: "PathActionNOK", - args: []string{"--action", "--path", "testdata/validate/bad-action.yml"}, - stdOut: "Expected a mapping got scalar", + name: "PathActionNOK", + args: []string{"--action", "--path", "testdata/validate/bad-action.yml"}, + stdOut: "Expected a mapping got scalar", + message: "testdata/validate/bad-action.yml action schema validation failed", }, { name: "PathWorkflowOK", @@ -66,9 +67,10 @@ func Test_validateCmd(t *testing.T) { stdOut: "schema validation OK", }, { - name: "PathWorkflowNOK", - args: []string{"--workflow", "--path", "testdata/validate/bad-workflow.yml"}, - stdOut: "Unknown Property ruins-on", + name: "PathWorkflowNOK", + args: []string{"--workflow", "--path", "testdata/validate/bad-workflow.yml"}, + stdOut: "Unknown Property ruins-on", + message: "testdata/validate/bad-workflow.yml workflow schema validation failed", }, { name: "DirectoryOK", @@ -76,14 +78,16 @@ func Test_validateCmd(t *testing.T) { stdOut: "action.yml action schema validation OK\nsubaction/action.yaml action schema validation OK\n.forgejo/workflows/action.yml workflow schema validation OK\n.forgejo/workflows/workflow1.yml workflow schema validation OK\n.forgejo/workflows/workflow2.yaml workflow schema validation OK", }, { - name: "DirectoryActionNOK", - args: []string{"--directory", "testdata/validate/bad-directory"}, - stdOut: "action.yml action schema validation failed", + name: "DirectoryActionNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: "action.yml action schema validation failed", + message: "action.yml action schema validation failed", }, { - name: "DirectoryWorkflowNOK", - args: []string{"--directory", "testdata/validate/bad-directory"}, - stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + name: "DirectoryWorkflowNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + message: ".forgejo/workflows/workflow1.yml workflow schema validation failed", }, { name: "RepositoryOK", @@ -91,14 +95,16 @@ func Test_validateCmd(t *testing.T) { stdOut: "action.yml action schema validation OK\nsubaction/action.yaml action schema validation OK\n.forgejo/workflows/action.yml workflow schema validation OK\n.forgejo/workflows/workflow1.yml workflow schema validation OK\n.forgejo/workflows/workflow2.yaml workflow schema validation OK", }, { - name: "RepositoryActionNOK", - args: []string{"--repository", "testdata/validate/bad-repository"}, - stdOut: "action.yml action schema validation failed", + name: "RepositoryActionNOK", + args: []string{"--repository", "testdata/validate/bad-repository"}, + stdOut: "action.yml action schema validation failed", + message: "action.yml action schema validation failed", }, { - name: "RepositoryWorkflowNOK", - args: []string{"--repository", "testdata/validate/bad-repository"}, - stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + name: "RepositoryWorkflowNOK", + args: []string{"--repository", "testdata/validate/bad-repository"}, + stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + message: ".forgejo/workflows/workflow1.yml workflow schema validation failed", }, } { t.Run(testCase.name, func(t *testing.T) { From b8ab05e36702c5af27fc3cf585bd557699fed4b3 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 18 Sep 2025 07:19:44 +0000 Subject: [PATCH 215/281] fix: schema validation must accept aliases and merges (#1012) - aliases are an indirection to follow https://yaml.org/spec/1.2.1/#id2785586 - merges cannot be conveniently validated and are skipped https://yaml.org/type/merge.html Resolves forgejo/runner#1011 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1012): fix: schema validation must accept aliases and merges Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1012 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/schema/schema.go | 12 ++++++++++++ act/schema/schema_test.go | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/act/schema/schema.go b/act/schema/schema.go index cbb51283..e1d41e96 100644 --- a/act/schema/schema.go +++ b/act/schema/schema.go @@ -237,6 +237,9 @@ func (s *Node) UnmarshalYAML(node *yaml.Node) error { if node != nil && node.Kind == yaml.DocumentNode { return s.UnmarshalYAML(node.Content[0]) } + if node != nil && node.Kind == yaml.AliasNode { + return s.UnmarshalYAML(node.Alias) + } def := s.Schema.GetDefinition(s.Definition) if s.Context == nil { s.Context = def.Context @@ -360,6 +363,15 @@ func (s *Node) checkMapping(node *yaml.Node, def Definition) error { if node.Kind != yaml.MappingNode { return fmt.Errorf("%sExpected a mapping got %v", formatLocation(node), getStringKind(node.Kind)) } + // merges cannot be conveniently validated and are skipped + // https://yaml.org/type/merge.html + for i, n := range node.Content { + if i%2 == 0 { + if n.Kind == yaml.ScalarNode && n.Value == "<<" && (n.Tag == "" || n.ShortTag() == "!!merge") { + return nil + } + } + } insertDirective := regexp.MustCompile(`\${{\s*insert\s*}}`) var allErrors error for i, k := range node.Content { diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index dc54834e..2e77f3b7 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -243,3 +243,39 @@ runs: }) } } + +// https://yaml.org/spec/1.2.1/#id2785586 +// An anchor is denoted by the “&” indicator. It marks a node for future reference. +// https://yaml.org/type/merge.html +// Specify one or more mappings to be merged with the current one. +func TestSchema_AnchorAndReference(t *testing.T) { + var node yaml.Node + err := yaml.Unmarshal([]byte(` +on: [push] +jobs: + test1: + runs-on: docker + steps: + - &step + run: echo All good! + - *step + test2: + runs-on: docker + steps: + - << : *step + name: other name + test3: + runs-on: docker + steps: + - !!merge << : *step + name: other name +`), &node) + if !assert.NoError(t, err) { + return + } + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.NoError(t, err) +} From f4eb8e57fb0bef1ed0248ff79e17a360b6dc2154 Mon Sep 17 00:00:00 2001 From: Freso Date: Thu, 18 Sep 2025 08:08:57 +0000 Subject: [PATCH 216/281] feat: add pre-commit hook for validator (#1002) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This will allow users to validate their Forgejo Actions files (both actions and workflows) prior to committing them to their repositories, using a `pre-commit` configuration similar to ```yaml - repo: https://code.forgejo.org/forgejo/runner rev: v11.1.0 hooks: - id: forgejo-runner-validate ``` - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1002): feat: add pre-commit hook for validator Co-authored-by: Frederik “Freso” S. Olesen Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1002 Reviewed-by: earl-warren Co-authored-by: Freso Co-committed-by: Freso --- .forgejo/workflows/test.yml | 50 +++++++++++++++++++++++++++++++++++++ .pre-commit-hooks.yaml | 16 ++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 .pre-commit-hooks.yaml diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 28ab84b9..773e0ae2 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -222,3 +222,53 @@ jobs: git diff --color=always exit 1 } + + validate-pre-commit: + name: validate pre-commit-hooks file + if: vars.ROLE == 'forgejo-coding' + runs-on: docker + container: + image: 'code.forgejo.org/oci/ci:1' + + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + + - name: install pre-commit + env: + DEBIAN_FRONTEND: noninteractive + PIP_ROOT_USER_ACTION: ignore + PIP_BREAK_SYSTEM_PACKAGES: 1 + PIP_PROGRESS_BAR: off + run: | + apt-get update -qq + apt-get -q install -qq -y python3-pip + python3 -m pip install 'pre-commit>=3.2.0' + + - name: validate .pre-commit-hooks.yaml + run: pre-commit validate-manifest .pre-commit-hooks.yaml + + # Will fail due to `act/runner/testdata/local-action-fails-schema-validation/action/action.yml` + - name: check pre-commit hook against local action files (should fail) + continue-on-error: true + run: | + pre-commit try-repo --all-files --verbose . forgejo-runner-validate + + - name: check that a bad workflow file doesn’t validate (should fail) + continue-on-error: true + run: | + mkdir -p test-repo + cd test-repo + git config set advice.defaultBranchName false + git init --quiet + mkdir -p .forgejo/workflows + cp ../act/runner/testdata/local-action-fails-schema-validation/action/action.yml ./ + touch .forgejo/workflows/bad-workflow.yml + cat > .pre-commit-config.yaml < Date: Thu, 18 Sep 2025 11:51:33 +0000 Subject: [PATCH 217/281] chore: document that DOCKER_HOST should be used instead of --container-daemon-socket (#1013) Resolves forgejo/runner#577 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1013): chore: document that DOCKER_HOST should be used instead of --container-daemon-socket Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1013 Reviewed-by: sclu1034 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/cmd/exec.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go index 440387cf..f88fe327 100644 --- a/internal/app/cmd/exec.go +++ b/internal/app/cmd/exec.go @@ -371,6 +371,10 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command log.Infof("cache handler listens on: %v", handler.ExternalURL()) execArgs.cacheHandler = handler + if execArgs.containerDaemonSocket != "/var/run/docker.sock" { + log.Warnf("--container-daemon-socket %s: please use the DOCKER_HOST environment variable as documented at https://forgejo.org/docs/next/admin/actions/runner-installation/#setting-up-the-container-environment instead. See https://code.forgejo.org/forgejo/runner/issues/577 for more information.", execArgs.containerDaemonSocket) + } + // run the plan config := &runner.Config{ Workdir: execArgs.Workdir(), @@ -462,7 +466,7 @@ func loadExecCmd(ctx context.Context) *cobra.Command { execCmd.Flags().BoolVar(&execArg.privileged, "privileged", false, "use privileged mode") execCmd.Flags().StringVar(&execArg.usernsMode, "userns", "", "user namespace to use") execCmd.PersistentFlags().StringVarP(&execArg.containerArchitecture, "container-architecture", "", "", "Architecture which should be used to run containers, e.g.: linux/amd64. If not specified, will use host default architecture. Requires Docker server API Version 1.41+. Ignored on earlier Docker server platforms.") - execCmd.PersistentFlags().StringVarP(&execArg.containerDaemonSocket, "container-daemon-socket", "", "/var/run/docker.sock", "Path to Docker daemon socket which will be mounted to containers") + execCmd.PersistentFlags().StringVarP(&execArg.containerDaemonSocket, "container-daemon-socket", "", "/var/run/docker.sock", "Please use the DOCKER_HOST environment variable as documented at https://forgejo.org/docs/next/admin/actions/runner-installation/#setting-up-the-container-environment instead.") execCmd.Flags().BoolVar(&execArg.useGitIgnore, "use-gitignore", true, "Controls whether paths specified in .gitignore should be copied into container") execCmd.Flags().StringArrayVarP(&execArg.containerCapAdd, "container-cap-add", "", []string{}, "kernel capabilities to add to the workflow containers (e.g. --container-cap-add SYS_PTRACE)") execCmd.Flags().StringArrayVarP(&execArg.containerCapDrop, "container-cap-drop", "", []string{}, "kernel capabilities to remove from the workflow containers (e.g. --container-cap-drop SYS_PTRACE)") From c25bd51857c6ece05ab0fe390de8d6b1db51f797 Mon Sep 17 00:00:00 2001 From: Freso Date: Thu, 18 Sep 2025 12:02:07 +0000 Subject: [PATCH 218/281] =?UTF-8?q?fix(pre-commit):=20don=E2=80=99t=20defa?= =?UTF-8?q?ult=20`verbose`=20to=20on=20(#1015)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `verbose` was only set here as a work-around to make sure users saw the output of `validate` since there was no fail signal from the executable. As of https://code.forgejo.org/forgejo/runner/pulls/1009 there now is a signal that the validation failed which pre-commit can pick up on, so we no longer need to default `verbose` to be on. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1015): fix(pre-commit): don’t default `verbose` to on Co-authored-by: Frederik “Freso” S. Olesen Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1015 Reviewed-by: earl-warren Co-authored-by: Freso Co-committed-by: Freso --- .pre-commit-hooks.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml index 0c195cb0..315c03e1 100644 --- a/.pre-commit-hooks.yaml +++ b/.pre-commit-hooks.yaml @@ -11,6 +11,3 @@ # Old names (without the pre- prefix) are deprecated since 4.0.0. minimum_pre_commit_version: '3.2.0' stages: [pre-commit, pre-merge-commit, pre-push, manual] - # validate doesn’t currently provide non-success exit codes, - # so falling back to always printing verbose output for now. - verbose: true From 331979b887df761c14be6d59d4784727b1627a70 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 18 Sep 2025 16:17:56 +0000 Subject: [PATCH 219/281] fix: outputs are only set when the job is successful (#1017) Resolves forgejo/runner#1016 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1017): fix: outputs are only set when the job is successful Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1017 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/reporter.go | 10 ++++++---- internal/pkg/report/reporter_test.go | 14 ++++++++++++++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 0d1ebadb..e6322128 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -130,10 +130,12 @@ func (r *Reporter) Fire(entry *log.Entry) error { } } } - if v, ok := entry.Data["jobOutputs"]; ok { - _ = r.setOutputs(v.(map[string]string)) - } else { - log.Panicf("received log entry with jobResult, but without jobOutputs -- outputs will be corrupted for this job") + if r.state.Result == runnerv1.Result_RESULT_SUCCESS { + if v, ok := entry.Data["jobOutputs"]; ok { + _ = r.setOutputs(v.(map[string]string)) + } else { + log.Panicf("received log entry with successful jobResult, but without jobOutputs -- outputs will be corrupted for this job") + } } } if !r.duringSteps() { diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index a949c01b..f41282cb 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -301,6 +301,20 @@ func TestReporter_Fire(t *testing.T) { value, _ := reporter.outputs.Load("key1") assert.EqualValues(t, "value1", value) }) + + t.Run("jobResult jobOutputs is absent if not success", func(t *testing.T) { + reporter, _, _ := mockReporter(t) + + dataStep0 := map[string]any{ + "stage": "Post", + "stepNumber": 0, + "raw_output": true, + "jobResult": "skipped", + } + assert.NoError(t, reporter.Fire(&log.Entry{Message: "skipped!", Data: dataStep0})) + + assert.EqualValues(t, runnerv1.Result_RESULT_SKIPPED, reporter.state.Result) + }) } func TestReporterReportState(t *testing.T) { From aed4dd8766c6be76c7e60e42349ad1275a05f568 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 19 Sep 2025 04:31:14 +0000 Subject: [PATCH 220/281] Update forgejo-runner to v11.1.1 (#1018) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | minor | `11.0.0` -> `11.1.1` | | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | minor | `11.0.0` -> `11.1.1` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v11.1.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.1.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v11.1.0...v11.1.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1017): fix: outputs are only set when the job is successful - [PR](https://code.forgejo.org/forgejo/runner/pulls/1015): fix(pre-commit): don’t default `verbose` to on - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1013): chore: document that DOCKER\_HOST should be used instead of --container-daemon-socket ### [`v11.1.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.1.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v11.0.0...v11.1.0) > **Warning** Upgrade to v11.1.1 instead. A [regression was found](https://code.forgejo.org/forgejo/runner/issues/1016) that crashed the runner on skipped or failed jobs. - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1002): feat: add pre-commit hook for validator - [PR](https://code.forgejo.org/forgejo/runner/pulls/1008): feat: validate --directory alternative to --repository to not clone - [PR](https://code.forgejo.org/forgejo/runner/pulls/999): feat: the forgejo context is equivalent to the github context - [PR](https://code.forgejo.org/forgejo/runner/pulls/997): feat: add support for a Debian GNU/Linux LXC backend based on trixie (e.g. trixie-lxc:lxc://debian:trixie) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1012): fix: schema validation must accept aliases and merges - [PR](https://code.forgejo.org/forgejo/runner/pulls/1009): fix: forgejo-runner validate exit with error when validation fails - [PR](https://code.forgejo.org/forgejo/runner/pulls/1006): fix: do not save .runner unless it is modified - [PR](https://code.forgejo.org/forgejo/runner/pulls/1003): fix: remove LXC working directory when it completes - [PR](https://code.forgejo.org/forgejo/runner/pulls/995): fix: send job outputs & job result to Forgejo in sync with each other - [PR](https://code.forgejo.org/forgejo/runner/pulls/986): fix: if the Forgejo instance failed a job, cancel it - [PR](https://code.forgejo.org/forgejo/runner/pulls/982): fix: enforce job..timeout-minutes - [PR](https://code.forgejo.org/forgejo/runner/pulls/972): fix: use a fixed runner name for old (<= v1.20) Forgejo instances - [PR](https://code.forgejo.org/forgejo/runner/pulls/965): fix: docker-compose example: allow the runner to keep its labels - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1001): Update dependency forgejo/lxc-helpers to v1.1.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1000): chore: minimal integration test for the LXC backend - [PR](https://code.forgejo.org/forgejo/runner/pulls/993): chore: unify actions URLs in .forgejo/workflows - [PR](https://code.forgejo.org/forgejo/runner/pulls/992): Update action to v2.3.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/990): chore: data.forgejo.org/actions/cascading-pr is the canonical location - [PR](https://code.forgejo.org/forgejo/runner/pulls/989): Update dependency forgejo/release-notes-assistant to v1.4.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/988): chore: wait 4 times longer for the forgejo cascade pull request to complete - [PR](https://code.forgejo.org/forgejo/runner/pulls/985): Remove windows build/test pipeline for GitHub - [PR](https://code.forgejo.org/forgejo/runner/pulls/981): Update module code.forgejo.org/forgejo/actions-proto to v0.5.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/969): Update action to v3.0.3 - [PR](https://code.forgejo.org/forgejo/runner/pulls/975): Update forgejo-runner to v11 (major) - [PR](https://code.forgejo.org/forgejo/runner/pulls/973): ci: update forgejo version for release integration - [PR](https://code.forgejo.org/forgejo/runner/pulls/970): chore: lxc-systemd may need more time to start on slow machines - [PR](https://code.forgejo.org/forgejo/runner/pulls/966): Update module golang.org/x/term to v0.35.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/964): chore: call the release notes assistant when opening a new pull request - [PR](https://code.forgejo.org/forgejo/runner/pulls/954): chore: skip release-notes-assistant for dependency updates
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1018 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index a2597d54..7aeae3ec 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:11.0.0 + image: code.forgejo.org/forgejo/runner:11.1.1 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:11.0.0 + image: code.forgejo.org/forgejo/runner:11.1.1 links: - docker-in-docker - forgejo diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index d49940a0..8e689f00 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.1.0 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=11.0.0 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 71bd44f9a0dcb3f4ea2bef61ab2f4ba047fef8d6 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 20 Sep 2025 16:26:21 +0000 Subject: [PATCH 221/281] Update https://data.forgejo.org/actions/setup-forgejo action to v3.0.4 (#1021) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) | action | patch | `v3.0.3` -> `v3.0.4` | --- ### Release Notes
actions/setup-forgejo (https://data.forgejo.org/actions/setup-forgejo) ### [`v3.0.4`](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.3...v3.0.4) [Compare Source](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.3...v3.0.4)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1021 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index e57ec989..ace95632 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -29,7 +29,7 @@ jobs: - uses: https://data.forgejo.org/actions/checkout@v4 - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4 with: user: root password: admin1234 diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index 04ac8f54..ddad6563 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -34,7 +34,7 @@ jobs: - name: install Forgejo so it can be used as a container registry id: registry - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4 with: user: ${{ env.FORGEJO_USER }} password: ${{ env.FORGEJO_PASSWORD }} diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index e2d1a54b..1a6bec4e 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -53,7 +53,7 @@ jobs: done - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4 with: user: root password: admin1234 From ed7dcb008135c7305520a4cc8c5932e76306eaf3 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 20 Sep 2025 16:30:19 +0000 Subject: [PATCH 222/281] fix: a composite action must not change the result of the calling step before it completes (#1019) Resolves forgejo/runner#1014 --- Manual testing can also be done using the [reproducer from the issue](https://code.forgejo.org/forgejo/runner/issues/1014#issuecomment-60694). ## Before The first step of the local composite action sets the step result of the job to success which confuses Forgejo display. ![image](/attachments/4f5c9477-47b8-4450-a858-c86312ced946) ## After Forgejo displays the progress of the composite action in the step calling it. ![image](/attachments/eed08b5d-b590-472f-9140-eced739dd47b) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1019): fix: a composite action must not change the result of the calling step before it completes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1019 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/logger.go | 20 +++++++++++ act/runner/logger_test.go | 63 +++++++++++++++++++++++++++++++++ internal/pkg/report/reporter.go | 3 +- 3 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 act/runner/logger_test.go diff --git a/act/runner/logger.go b/act/runner/logger.go index f97292bf..5f4dae1d 100644 --- a/act/runner/logger.go +++ b/act/runner/logger.go @@ -146,6 +146,26 @@ func WithCompositeStepLogger(ctx context.Context, stepID string) context.Context }).WithContext(ctx)) } +func GetOuterStepResult(entry *logrus.Entry) any { + r, ok := entry.Data["stepResult"] + if !ok { + return nil + } + + // composite actions steps log with a list of stepID + if s, ok := entry.Data["stepID"]; ok { + if stepIDs, ok := s.([]string); ok { + if len(stepIDs) > 1 { + return nil + } + } + } else { + return nil + } + + return r +} + func withStepLogger(ctx context.Context, stepNumber int, stepID, stepName, stageName string) context.Context { rtn := common.Logger(ctx).WithFields(logrus.Fields{ "stepNumber": stepNumber, diff --git a/act/runner/logger_test.go b/act/runner/logger_test.go new file mode 100644 index 00000000..4df2db12 --- /dev/null +++ b/act/runner/logger_test.go @@ -0,0 +1,63 @@ +package runner + +import ( + "testing" + + "code.forgejo.org/forgejo/runner/v11/act/common" + + "github.com/sirupsen/logrus/hooks/test" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestRunner_GetOuterStepResult(t *testing.T) { + nullLogger, hook := test.NewNullLogger() + ctx := common.WithLogger(t.Context(), nullLogger) + + t.Run("no stepResult", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).Info("✅ Success") + entry := hook.LastEntry() + require.NotNil(t, entry) + assert.Nil(t, GetOuterStepResult(entry)) + }) + + t.Run("stepResult and no stepID", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).WithField("stepResult", "success").Info("✅ Success") + entry := hook.LastEntry() + require.NotNil(t, entry) + assert.Nil(t, GetOuterStepResult(entry)) + }) + + stepNumber := 123 + stepID := "step id" + stepName := "readable name" + stageName := "Main" + ctx = withStepLogger(ctx, stepNumber, stepID, stepName, stageName) + + t.Run("stepResult and stepID", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).WithField("stepResult", "success").Info("✅ Success") + entry := hook.LastEntry() + actualStepIDs, ok := entry.Data["stepID"] + require.True(t, ok) + require.Equal(t, []string{stepID}, actualStepIDs) + require.NotNil(t, entry) + assert.Equal(t, "success", GetOuterStepResult(entry)) + }) + + compositeStepID := "composite step id" + ctx = WithCompositeStepLogger(ctx, compositeStepID) + + t.Run("stepResult and composite stepID", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).WithField("stepResult", "success").Info("✅ Success") + entry := hook.LastEntry() + actualStepIDs, ok := entry.Data["stepID"] + require.True(t, ok) + require.Equal(t, []string{stepID, compositeStepID}, actualStepIDs) + require.NotNil(t, entry) + assert.Nil(t, GetOuterStepResult(entry)) + }) +} diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index e6322128..7e46b8bb 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -13,6 +13,7 @@ import ( "time" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" + "code.forgejo.org/forgejo/runner/v11/act/runner" "connectrpc.com/connect" retry "github.com/avast/retry-go/v4" log "github.com/sirupsen/logrus" @@ -173,7 +174,7 @@ func (r *Reporter) Fire(entry *log.Entry) error { } else if !r.duringSteps() { r.logRows = appendIfNotNil(r.logRows, r.parseLogRow(entry)) } - if v, ok := entry.Data["stepResult"]; ok { + if v := runner.GetOuterStepResult(entry); v != nil { if stepResult, ok := r.parseResult(v); ok { if step.LogLength == 0 { step.LogIndex = int64(r.logOffset + len(r.logRows)) From 8512d76ce7f924163de123b1e96d8fd7b6d442e2 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 20 Sep 2025 20:57:17 +0000 Subject: [PATCH 223/281] chore: upgrade LXC example to Debian GNU/Linux trixie (#1020) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1020): chore: upgrade LXC example to Debian GNU/Linux trixie Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1020 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/example-lxc-systemd.yml | 2 +- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index 1a6bec4e..e333092b 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -18,7 +18,7 @@ env: jobs: example-lxc-systemd: if: vars.ROLE == 'forgejo-coding' - runs-on: lxc-bookworm + runs-on: lxc-trixie steps: - uses: https://data.forgejo.org/actions/checkout@v4 diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 8e689f00..c0334bea 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -27,7 +27,7 @@ DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=fo : ${KILL_AFTER:=21600} # 6h == 21600 NODEJS_VERSION=20 -DEBIAN_RELEASE=bookworm +DEBIAN_RELEASE=trixie YQ_VERSION=v4.45.1 SELF=${BASH_SOURCE[0]} SELF_FILENAME=$(basename "$SELF") From 225a05e1a5dcc7fdedb79b7bf2d436368be30e98 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 21 Sep 2025 06:51:38 +0000 Subject: [PATCH 224/281] Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.6 (#1022) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/forgejo](https://forgejo.org) ([source](https://codeberg.org/forgejo/forgejo)) | patch | `11.0.5` -> `11.0.6` | --- ### Release Notes
forgejo/forgejo (code.forgejo.org/forgejo/forgejo) ### [`v11.0.6`](https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.6) [Compare Source](https://codeberg.org/forgejo/forgejo/compare/v11.0.5...v11.0.6) See
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1022 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index ace95632..0a1c216b 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -19,7 +19,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.5 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: release-simulation: diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index ddad6563..ec8469ca 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -21,7 +21,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.5 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo FORGEJO_USER: root FORGEJO_PASSWORD: admin1234 From fb1a38b840014686a87d953948b7357cfb3ef5d8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 22 Sep 2025 10:10:07 +0000 Subject: [PATCH 225/281] Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.5.0 (#1023) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/golangci/golangci-lint/v2/cmd/golangci-lint](https://github.com/golangci/golangci-lint) | `v2.4.0` -> `v2.5.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.5.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.4.0/v2.5.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
golangci/golangci-lint (github.com/golangci/golangci-lint/v2/cmd/golangci-lint) ### [`v2.5.0`](https://github.com/golangci/golangci-lint/blob/HEAD/CHANGELOG.md#v250) [Compare Source](https://github.com/golangci/golangci-lint/compare/v2.4.0...v2.5.0) 1. New linters - Add `godoclint` linter - Add `unqueryvet` linter - Add `iotamixing` linter 2. Linters new features or changes - `embeddedstructfieldcheck`: from 0.3.0 to 0.4.0 (new option: `empty-line`) - `err113`: from [`aea10b5`](https://github.com/golangci/golangci-lint/commit/aea10b59be24) to 0.1.1 (skip internals of `Is` methods for `error` type) - `ginkgolinter`: from 0.20.0 to 0.21.0 (new option: `force-tonot`) - `gofumpt`: from 0.8.0 to 0.9.1 (new rule is to "clothe" naked returns for the sake of clarity) - `ineffassign`: from 0.1.0 to 0.2.0 (new option: `check-escaping-errors`) - `musttag`: from 0.13.1 to 0.14.0 (support interface methods) - `revive`: from 1.11.0 to 1.12.0 (new options: `identical-ifelseif-branches`, `identical-ifelseif-conditions`, `identical-switch-branches`, `identical-switch-conditions`, `package-directory-mismatch`, `unsecure-url-scheme`, `use-waitgroup-go`, `useless-fallthrough`) - `thelper`: from 0.6.3 to 0.7.1 (skip `t.Helper` in functions passed to `synctest.Test`) - `wsl`: from 5.1.1 to 5.2.0 (improvements related to subexpressions) 3. Linters bug fixes - `asciicheck`: from 0.4.1 to 0.5.0 - `errname`: from 1.1.0 to 1.1.1 - `fatcontext`: from 0.8.0 to 0.8.1 - `go-printf-func-name`: from 0.1.0 to 0.1.1 - `godot`: from 1.5.1 to 1.5.4 - `gosec`: from 2.22.7 to 2.22.8 - `nilerr`: from 0.1.1 to a temporary fork - `nilnil`: from 1.1.0 to 1.1.1 - `protogetter`: from 0.3.15 to 0.3.16 - `tagliatelle`: from 0.7.1 to 0.7.2 - `testifylint`: from 1.6.1 to 1.6.4 4. Misc. - fix: "no export data" errors are now handled as a standard typecheck error 5. Documentation - Improve nolint section about syntax
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1023 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 06029b7f..07ab0134 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,7 @@ GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.5 # renovate: datasource=go -GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 # renovate: datasource=go +GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner DOCKER_TAG ?= nightly From 8debbe699ed69cd7a224694fd9417e82a7d3ec22 Mon Sep 17 00:00:00 2001 From: Gusted Date: Tue, 23 Sep 2025 06:41:07 +0000 Subject: [PATCH 226/281] chore: fix typo in the documentation (#1025) Ref: forgejo/docs#1506 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1025): Fix typo Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1025 Reviewed-by: Beowulf Co-authored-by: Gusted Co-committed-by: Gusted --- internal/pkg/config/config.example.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index 14decb32..4e447e9d 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -138,7 +138,7 @@ cache: # different network than the Forgejo runner (for instance when the # docker server used to create containers is not running on the same # host as the Forgejo runner), it may be impossible to figure that - # out automatically. In that case you can specifify which IP or + # out automatically. In that case you can specify which IP or # hostname to use to reach the internal cache server created by the # Forgejo runner. # From 6bdb7ed9c793b3cf93341c95a0b6629bd1381b34 Mon Sep 17 00:00:00 2001 From: Kwonunn Date: Fri, 26 Sep 2025 07:02:45 +0000 Subject: [PATCH 227/281] fix: Correctly override the value of `Forgejo-Cache-Host` when ACTIONS_CACHE_URL is overridden. (#1027) This fixes a bug currently preventing use of an external cache server in the Codeberg runner setup. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1027): fix: Correctly override the value of `Forgejo-Cache-Host` when ACTIONS_CACHE_URL is overridden. Co-authored-by: Vivian Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1027 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Kwonunn Co-committed-by: Kwonunn --- act/cacheproxy/handler.go | 10 +++++++--- internal/app/run/runner.go | 4 +--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 17adf3b5..e494b9c5 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -37,7 +37,8 @@ type Handler struct { outboundIP string - cacheServerHost string + cacheServerHost string + cacheProxyHostOverride string cacheSecret string @@ -55,7 +56,7 @@ func (h *Handler) CreateRunData(fullName, runNumber, timestamp, writeIsolationKe } } -func StartHandler(targetHost, outboundIP string, port uint16, cacheSecret string, logger logrus.FieldLogger) (*Handler, error) { +func StartHandler(targetHost, outboundIP string, port uint16, cacheProxyHostOverride, cacheSecret string, logger logrus.FieldLogger) (*Handler, error) { h := &Handler{} if logger == nil { @@ -77,6 +78,7 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheSecret string } h.cacheServerHost = targetHost + h.cacheProxyHostOverride = cacheProxyHostOverride proxy, err := h.newReverseProxy(targetHost) if err != nil { @@ -153,7 +155,9 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er } func (h *Handler) ExternalURL() string { - // TODO: make the external url configurable if necessary + if h.cacheProxyHostOverride != "" { + return h.cacheProxyHostOverride + } return fmt.Sprintf("http://%s", net.JoinHostPort(h.outboundIP, strconv.Itoa(h.listener.Addr().(*net.TCPAddr).Port))) } diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index a1283d61..98a39f92 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -144,6 +144,7 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler cacheURL, cfg.Cache.Host, cfg.Cache.ProxyPort, + cfg.Cache.ActionsCacheURLOverride, cacheSecret, log.StandardLogger().WithField("module", "cache_proxy"), ) @@ -152,9 +153,6 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler } envs["ACTIONS_CACHE_URL"] = cacheProxy.ExternalURL() - if cfg.Cache.ActionsCacheURLOverride != "" { - envs["ACTIONS_CACHE_URL"] = cfg.Cache.ActionsCacheURLOverride - } return cacheProxy } From 9c09ca3f565af655d415c4a92a1fcda46677cdad Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 26 Sep 2025 07:10:58 +0000 Subject: [PATCH 228/281] Update module connectrpc.com/connect to v1.19.0 (#1029) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.18.1` -> `v1.19.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/connectrpc.com%2fconnect/v1.19.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/connectrpc.com%2fconnect/v1.18.1/v1.19.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
connectrpc/connect-go (connectrpc.com/connect) ### [`v1.19.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.18.1...v1.19.0) This release introduces the highly requested "simple" flag for code generation, making Connect significantly more ergonomic for everyday RPC development. The new simple flag in protoc-gen-connect-go generates cleaner, more intuitive client and handler interfaces that eliminate request/response wrappers for most use cases. This addresses community feedback about verbosity and provides a more straightforward API. When enabled, metadata (headers/trailers) can be passed through context instead of explicit wrapper objects, optimizing for the common case where developers don't need direct access to HTTP headers. #### What's Changed ##### Enhancements - Add simple flag for more ergonomic generated code by [@​bufdev](https://github.com/bufdev) and [@​smaye81](https://github.com/smaye81) in [#​851](https://github.com/connectrpc/connect-go/pull/851) - Update Go to v1.24 and document http.Protocol use removing the dependency on `golang.org/x/net/http2` by [@​maxbrunet](https://github.com/maxbrunet) in [#​873](https://github.com/connectrpc/connect-go/pull/873), [#​877](https://github.com/connectrpc/connect-go/pull/877) - Add support for Edition 2024 by [@​emcfarlane](https://github.com/emcfarlane) in [#​878](https://github.com/connectrpc/connect-go/pull/878) ##### Bugfixes - Include valid spec and headers when calling recover handler for streaming RPCs by [@​jhump](https://github.com/jhump) in [#​817](https://github.com/connectrpc/connect-go/pull/817) ##### Other changes - Go version support updated to latest two instead of three by [@​jhump](https://github.com/jhump) in [#​837](https://github.com/connectrpc/connect-go/pull/837) - CI testing improvements by [@​pkwarren](https://github.com/pkwarren) and [@​jhump](https://github.com/jhump) in [#​838](https://github.com/connectrpc/connect-go/pull/838), [#​839](https://github.com/connectrpc/connect-go/pull/839) - Code quality improvements by [@​mattrobenolt](https://github.com/mattrobenolt) and [@​bufdev](https://github.com/bufdev) in [#​841](https://github.com/connectrpc/connect-go/pull/841), [#​867](https://github.com/connectrpc/connect-go/pull/867) - Documentation improvements by [@​adlion](https://github.com/adlion) and [@​stefanvanburen](https://github.com/stefanvanburen) in [#​821](https://github.com/connectrpc/connect-go/pull/821), [#​880](https://github.com/connectrpc/connect-go/pull/880) #### New Contributors - [@​adlion](https://github.com/adlion) made their first contribution in [#​821](https://github.com/connectrpc/connect-go/pull/821) - [@​maxbrunet](https://github.com/maxbrunet) made their first contribution in [#​873](https://github.com/connectrpc/connect-go/pull/873) - [@​stefanvanburen](https://github.com/stefanvanburen) made their first contribution in [#​880](https://github.com/connectrpc/connect-go/pull/880) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1029 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index d1763deb..93e4f33b 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.7 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 - connectrpc.com/connect v1.18.1 + connectrpc.com/connect v1.19.0 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 diff --git a/go.sum b/go.sum index d5b9a302..fea04a05 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= -connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= -connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= +connectrpc.com/connect v1.19.0 h1:LuqUbq01PqbtL0o7vn0WMRXzR2nNsiINe5zfcJ24pJM= +connectrpc.com/connect v1.19.0/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= From 014b4ba5f652f7b22adf9162c8b97f54884f1247 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 26 Sep 2025 20:01:46 +0000 Subject: [PATCH 229/281] fix: event.pull_request.action == closed can use the cache of the base repository (#1031) It was tested locally with https://code.forgejo.org/forgejo/end-to-end/pulls/1062/files. ## Before ![image](/attachments/26890572-08ba-4904-b6a5-f01762141a51) ## After ![image](/attachments/56352930-99a3-4011-b921-b12217c5fa54) --- When the "closed" action of a pull request event was triggered by a merge, it effectively runs in the context of the base repository. It was merged by a user with write access to the base repository. It is authorized to write the base repository cache. Resolves forgejo/runner#1030 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1031): fix: event.pull_request.action == closed can use the cache of the base repository Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1031 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/run/runner.go | 63 ++++++++++++++++++++------- internal/app/run/runner_test.go | 77 +++++++++++++++++++++++++++++++++ 2 files changed, 124 insertions(+), 16 deletions(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 98a39f92..1bf32c78 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -193,6 +193,44 @@ func explainFailedGenerateWorkflow(task *runnerv1.Task, log func(message string, return fmt.Errorf("the workflow file is not usable") } +func getWriteIsolationKey(ctx context.Context, eventName, ref string, event map[string]any) (string, error) { + if eventName == "pull_request" { + // The "closed" action of a pull request event runs in the context of the base repository + // and was merged by a user with write access to the base repository. It is authorized to + // write the repository cache. + if event["action"] == "closed" { + pullRequest, ok := event["pull_request"].(map[string]any) + if !ok { + return "", fmt.Errorf("getWriteIsolationKey: event.pull_request is not a map[string]any but %T", event["pull_request"]) + } + merged, ok := pullRequest["merged"].(bool) + if !ok { + return "", fmt.Errorf("getWriteIsolationKey: event.pull_request.merged is not a bool but %T", pullRequest["merged"]) + } + if merged { + return "", nil + } + // a pull request that is closed but not merged falls thru and is expected to obey the same + // constraints as an opened pull request, it may be closed by a user with no write permissions to the + // base repository + } + // When performing an action on an event from an opened PR, provide a "write isolation key" to the cache. The generated + // ACTIONS_CACHE_URL will be able to read the cache, and write to a cache, but its writes will be isolated to + // future runs of the PR's workflows and won't be shared with other pull requests or actions. This is a security + // measure to prevent a malicious pull request from poisoning the cache with secret-stealing code which would + // later be executed on another action. + // Ensure that `ref` has the expected format so that we don't end up with a useless write isolation key + if !strings.HasPrefix(ref, "refs/pull/") { + return "", fmt.Errorf("getWriteIsolationKey: expected ref to be refs/pull/..., but was %q", ref) + } + return ref, nil + } + + // Other events do not allow the trigger user to modify the content of the repository and + // are allowed to write the cache without an isolation key + return "", nil +} + func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.Reporter) (err error) { defer func() { if r := recover(); r != nil { @@ -226,15 +264,18 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. defaultActionURL, r.client.Address()) + eventName := taskContext["event_name"].GetStringValue() + ref := taskContext["ref"].GetStringValue() + event := taskContext["event"].GetStructValue().AsMap() preset := &model.GithubContext{ - Event: taskContext["event"].GetStructValue().AsMap(), + Event: event, RunID: taskContext["run_id"].GetStringValue(), RunNumber: taskContext["run_number"].GetStringValue(), Actor: taskContext["actor"].GetStringValue(), Repository: taskContext["repository"].GetStringValue(), - EventName: taskContext["event_name"].GetStringValue(), + EventName: eventName, Sha: taskContext["sha"].GetStringValue(), - Ref: taskContext["ref"].GetStringValue(), + Ref: ref, RefName: taskContext["ref_name"].GetStringValue(), RefType: taskContext["ref_type"].GetStringValue(), HeadRef: taskContext["head_ref"].GetStringValue(), @@ -264,19 +305,9 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. // Register the run with the cacheproxy and modify the CACHE_URL if r.cacheProxy != nil { - writeIsolationKey := "" - - // When performing an action on an event from a PR, provide a "write isolation key" to the cache. The generated - // ACTIONS_CACHE_URL will be able to read the cache, and write to a cache, but its writes will be isolated to - // future runs of the PR's workflows and won't be shared with other pull requests or actions. This is a security - // measure to prevent a malicious pull request from poisoning the cache with secret-stealing code which would - // later be executed on another action. - if taskContext["event_name"].GetStringValue() == "pull_request" { - // Ensure that `Ref` has the expected format so that we don't end up with a useless write isolation key - if !strings.HasPrefix(preset.Ref, "refs/pull/") { - return fmt.Errorf("write isolation key: expected preset.Ref to be refs/pull/..., but was %q", preset.Ref) - } - writeIsolationKey = preset.Ref + writeIsolationKey, err := getWriteIsolationKey(ctx, eventName, ref, event) + if err != nil { + return err } timestamp := strconv.FormatInt(time.Now().Unix(), 10) diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 65690832..eda5de9e 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -141,6 +141,83 @@ func (m *forgejoClientMock) UpdateLog(ctx context.Context, request *connect.Requ }), nil } +func TestRunner_getWriteIsolationKey(t *testing.T) { + t.Run("push", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "push", "whatever", nil) + require.NoError(t, err) + assert.Empty(t, key) + }) + + t.Run("pull_request synchronized key is ref", func(t *testing.T) { + expectedKey := "refs/pull/1/head" + actualKey, err := getWriteIsolationKey(t.Context(), "pull_request", expectedKey, map[string]any{ + "action": "synchronized", + }) + require.NoError(t, err) + assert.Equal(t, expectedKey, actualKey) + }) + + t.Run("pull_request synchronized ref is invalid", func(t *testing.T) { + invalidKey := "refs/is/invalid" + key, err := getWriteIsolationKey(t.Context(), "pull_request", invalidKey, map[string]any{ + "action": "synchronized", + }) + require.Empty(t, key) + assert.ErrorContains(t, err, invalidKey) + }) + + t.Run("pull_request closed and not merged key is ref", func(t *testing.T) { + expectedKey := "refs/pull/1/head" + actualKey, err := getWriteIsolationKey(t.Context(), "pull_request", expectedKey, map[string]any{ + "action": "closed", + "pull_request": map[string]any{ + "merged": false, + }, + }) + require.NoError(t, err) + assert.Equal(t, expectedKey, actualKey) + }) + + t.Run("pull_request closed and merged key is empty", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + "pull_request": map[string]any{ + "merged": true, + }, + }) + require.NoError(t, err) + assert.Empty(t, key) + }) + + t.Run("pull_request missing event.pull_request", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + }) + require.Empty(t, key) + assert.ErrorContains(t, err, "event.pull_request is not a map") + }) + + t.Run("pull_request missing event.pull_request.merge", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + "pull_request": map[string]any{}, + }) + require.Empty(t, key) + assert.ErrorContains(t, err, "event.pull_request.merged is not a bool") + }) + + t.Run("pull_request with event.pull_request.merge of an unexpected type", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + "pull_request": map[string]any{ + "merged": "string instead of bool", + }, + }) + require.Empty(t, key) + assert.ErrorContains(t, err, "not a bool but string") + }) +} + func TestRunnerCacheConfiguration(t *testing.T) { if testing.Short() { t.Skip("skipping integration test") From 56ef60060b1c83d7942c5f413f98fc48e03689fc Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sat, 27 Sep 2025 04:37:36 +0000 Subject: [PATCH 230/281] feat: support evaluating workflow-level concurrency blocks in jobparser (#1026) - Changes `EvaluateConcurrency` to `EvaluateWorkflowConcurrency`, which has no job-related arguments - Changes gitContext to be sent as an object rather than a map - Allows `nil` to be returned for `cancelInProgress`, which indicates that the value wasn't specified in the input yaml -- required for distinguishing the `cancel-in-progress: false` case from not being specified at all. ReadWorkflowRawConcurrency & EvaluateWorkflowConcurrency were never used in forgejo yet, so this shouldn't break the forgejo build. Prerequisite for https://codeberg.org/forgejo/forgejo/pulls/9434. - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1026): feat: support evaluating workflow-level concurrency blocks in jobparser Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1026 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/jobparser/interpeter.go | 30 ++++++++++++ act/jobparser/model.go | 91 ++++++------------------------------- act/jobparser/model_test.go | 72 +++++++++++++++++------------ 3 files changed, 87 insertions(+), 106 deletions(-) diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go index e82444e4..362e18cc 100644 --- a/act/jobparser/interpeter.go +++ b/act/jobparser/interpeter.go @@ -76,6 +76,36 @@ func NewInterpeter( return exprparser.NewInterpeter(ee, config) } +// Returns an interpeter used in the server in the context of workflow-level templates. Needs github, inputs, and vars +// context only. +func NewWorkflowInterpeter( + gitCtx *model.GithubContext, + vars map[string]string, + inputs map[string]any, +) exprparser.Interpreter { + ee := &exprparser.EvaluationEnvironment{ + Github: gitCtx, + Env: nil, // no need + Job: nil, // no need + Steps: nil, // no need + Runner: nil, // no need + Secrets: nil, // no need + Strategy: nil, // no need + Matrix: nil, // no need + Needs: nil, // no need + Inputs: inputs, + Vars: vars, + } + + config := exprparser.Config{ + Run: nil, + WorkingDir: "", // WorkingDir is used for the function hashFiles, but it's not needed in the server + Context: "workflow", + } + + return exprparser.NewInterpeter(ee, config) +} + // JobResult is the minimum requirement of job results for Interpeter type JobResult struct { Needs []string diff --git a/act/jobparser/model.go b/act/jobparser/model.go index ed6e5ece..e94123e3 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -1,7 +1,6 @@ package jobparser import ( - "bytes" "fmt" "code.forgejo.org/forgejo/runner/v11/act/model" @@ -193,83 +192,32 @@ func (evt *Event) Schedules() []map[string]string { return evt.schedules } -func ReadWorkflowRawConcurrency(content []byte) (*model.RawConcurrency, error) { - w := new(model.Workflow) - err := yaml.NewDecoder(bytes.NewReader(content)).Decode(w) - return w.RawConcurrency, err -} - -func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (string, bool, error) { - actJob := &model.Job{} - if job != nil { - actJob.Strategy = &model.Strategy{ - FailFastString: job.Strategy.FailFastString, - MaxParallelString: job.Strategy.MaxParallelString, - RawMatrix: job.Strategy.RawMatrix, - } - actJob.Strategy.FailFast = actJob.Strategy.GetFailFast() - actJob.Strategy.MaxParallel = actJob.Strategy.GetMaxParallel() - } - - matrix := make(map[string]any) - matrixes, err := actJob.GetMatrixes() - if err != nil { - return "", false, err - } - if len(matrixes) > 0 { - matrix = matrixes[0] - } - - evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs)) +// Convert the raw YAML from the `concurrency` block on a workflow into the evaluated concurrency group and +// cancel-in-progress value. This implementation only supports workflow-level concurrency definition, where we expect +// expressions to be able to access only the github, inputs and vars contexts. If RawConcurrency is empty, then the +// returned concurrency group will be "" and cancel-in-progress will be nil -- this can be used to distinguish from an +// explicit cancel-in-progress choice even if a group isn't specified. +func EvaluateWorkflowConcurrency(rc *model.RawConcurrency, gitCtx *model.GithubContext, vars map[string]string, inputs map[string]any) (string, *bool, error) { + evaluator := NewExpressionEvaluator(NewWorkflowInterpeter(gitCtx, vars, inputs)) var node yaml.Node if err := node.Encode(rc); err != nil { - return "", false, fmt.Errorf("failed to encode concurrency: %w", err) + return "", nil, fmt.Errorf("failed to encode concurrency: %w", err) } if err := evaluator.EvaluateYamlNode(&node); err != nil { - return "", false, fmt.Errorf("failed to evaluate concurrency: %w", err) + return "", nil, fmt.Errorf("failed to evaluate concurrency: %w", err) } var evaluated model.RawConcurrency if err := node.Decode(&evaluated); err != nil { - return "", false, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err) + return "", nil, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err) } if evaluated.RawExpression != "" { - return evaluated.RawExpression, false, nil + return evaluated.RawExpression, nil, nil } - return evaluated.Group, evaluated.CancelInProgress == "true", nil -} - -func toGitContext(input map[string]any) *model.GithubContext { - gitContext := &model.GithubContext{ - EventPath: asString(input["event_path"]), - Workflow: asString(input["workflow"]), - RunID: asString(input["run_id"]), - RunNumber: asString(input["run_number"]), - Actor: asString(input["actor"]), - Repository: asString(input["repository"]), - EventName: asString(input["event_name"]), - Sha: asString(input["sha"]), - Ref: asString(input["ref"]), - RefName: asString(input["ref_name"]), - RefType: asString(input["ref_type"]), - HeadRef: asString(input["head_ref"]), - BaseRef: asString(input["base_ref"]), - Token: asString(input["token"]), - Workspace: asString(input["workspace"]), - Action: asString(input["action"]), - ActionPath: asString(input["action_path"]), - ActionRef: asString(input["action_ref"]), - ActionRepository: asString(input["action_repository"]), - Job: asString(input["job"]), - RepositoryOwner: asString(input["repository_owner"]), - RetentionDays: asString(input["retention_days"]), + if evaluated.CancelInProgress == "" { + return evaluated.Group, nil, nil } - - event, ok := input["event"].(map[string]any) - if ok { - gitContext.Event = event - } - - return gitContext + cancelInProgress := evaluated.CancelInProgress == "true" + return evaluated.Group, &cancelInProgress, nil } func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { @@ -430,12 +378,3 @@ func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) { return scalars, datas, nil } - -func asString(v any) string { - if v == nil { - return "" - } else if s, ok := v.(string); ok { - return s - } - return "" -} diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index fd62ef65..45d77428 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -342,10 +342,11 @@ func TestParseMappingNode(t *testing.T) { func TestEvaluateConcurrency(t *testing.T) { tests := []struct { - name string - input model.RawConcurrency - group string - cancelInProgress bool + name string + input model.RawConcurrency + group string + cancelInProgressNil bool + cancelInProgress bool }{ { name: "basic", @@ -357,18 +358,18 @@ func TestEvaluateConcurrency(t *testing.T) { cancelInProgress: true, }, { - name: "undefined", - input: model.RawConcurrency{}, - group: "", - cancelInProgress: false, + name: "undefined", + input: model.RawConcurrency{}, + group: "", + cancelInProgressNil: true, }, { name: "group-evaluation", input: model.RawConcurrency{ Group: "${{ github.workflow }}-${{ github.ref }}", }, - group: "test_workflow-main", - cancelInProgress: false, + group: "test_workflow-main", + cancelInProgressNil: true, }, { name: "cancel-evaluation-true", @@ -393,37 +394,44 @@ func TestEvaluateConcurrency(t *testing.T) { input: model.RawConcurrency{ Group: "user-${{ github.event.commits[0].author.username }}", }, - group: "user-someone", - cancelInProgress: false, + group: "user-someone", + cancelInProgressNil: true, }, { name: "arbitrary-var", input: model.RawConcurrency{ Group: "${{ vars.eval_arbitrary_var }}", }, - group: "123", - cancelInProgress: false, + group: "123", + cancelInProgressNil: true, }, { name: "arbitrary-input", input: model.RawConcurrency{ Group: "${{ inputs.eval_arbitrary_input }}", }, - group: "456", - cancelInProgress: false, + group: "456", + cancelInProgressNil: true, + }, + { + name: "cancel-in-progress-only", + input: model.RawConcurrency{ + CancelInProgress: "true", + }, + group: "", + cancelInProgress: true, }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { - group, cancelInProgress, err := EvaluateConcurrency( + group, cancelInProgress, err := EvaluateWorkflowConcurrency( &test.input, - "job-id", - nil, // job - map[string]any{ - "workflow": "test_workflow", - "ref": "main", - "event": map[string]any{ + // gitCtx + &model.GithubContext{ + Workflow: "test_workflow", + Ref: "main", + Event: map[string]any{ "commits": []any{ map[string]any{ "author": map[string]any{ @@ -437,20 +445,24 @@ func TestEvaluateConcurrency(t *testing.T) { }, }, }, - }, // gitCtx - map[string]*JobResult{ - "job-id": {}, - }, // results + }, + // vars map[string]string{ "eval_arbitrary_var": "123", - }, // vars + }, + // inputs map[string]any{ "eval_arbitrary_input": "456", - }, // inputs + }, ) assert.NoError(t, err) assert.EqualValues(t, test.group, group) - assert.EqualValues(t, test.cancelInProgress, cancelInProgress) + if test.cancelInProgressNil { + assert.Nil(t, cancelInProgress) + } else { + require.NotNil(t, cancelInProgress) + assert.EqualValues(t, test.cancelInProgress, *cancelInProgress) + } }) } } From 46a955d1ffecdb44bfbb38af95b6dc3b81db2402 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 27 Sep 2025 07:55:28 +0200 Subject: [PATCH 231/281] Revert "Update module connectrpc.com/connect to v1.19.0 (#1029)" This reverts commit 9c09ca3f565af655d415c4a92a1fcda46677cdad. --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 93e4f33b..d1763deb 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.7 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 - connectrpc.com/connect v1.19.0 + connectrpc.com/connect v1.18.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 diff --git a/go.sum b/go.sum index fea04a05..d5b9a302 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= -connectrpc.com/connect v1.19.0 h1:LuqUbq01PqbtL0o7vn0WMRXzR2nNsiINe5zfcJ24pJM= -connectrpc.com/connect v1.19.0/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= +connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= +connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= From ea824bde1ca7392705ffba72086197c232a02ad4 Mon Sep 17 00:00:00 2001 From: 2franix <2franix@noreply.code.forgejo.org> Date: Sun, 28 Sep 2025 07:15:51 +0000 Subject: [PATCH 232/281] chore: test: exercise contexts in matrix when validating workflows (#1033) After realizing my mistake on my proposed fixes in #1028, I figured I could at least propose another test covering the use of contexts in `jobs..strategy.matrix`. The specification for available contexts is [here](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#context-availability): | Workflow key | Context | | -------------------- | ----------- | | `jobs..strategy` | `github`, `needs`, `vars`, `inputs` | In Forgejo, the `forge` and `forgejo` contexts are supported in addition to `github`. The new test covers a matrix with [`include`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstrategymatrixinclude), [`exclude`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstrategymatrixexclude) and custom properties. Both available and unavailable contexts are tested. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1033): chore: test: exercise contexts in matrix when validating workflows Co-authored-by: 2franix Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1033 Reviewed-by: earl-warren Co-authored-by: 2franix <2franix@noreply.code.forgejo.org> Co-committed-by: 2franix <2franix@noreply.code.forgejo.org> --- act/schema/schema_test.go | 78 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index 2e77f3b7..9661b930 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -30,6 +30,84 @@ jobs: assert.NoError(t, err) } +func TestContextsInWorkflowMatrix(t *testing.T) { + t.Run("KnownContexts", func(t *testing.T) { + // Parse raw YAML snippet. + var node yaml.Node + err := yaml.Unmarshal([]byte(` +on: push + +jobs: + job: + uses: ./.forgejo/workflow/test.yaml + strategy: + matrix: + input1: + - ${{ forge.KEY }} + - ${{ forgejo.KEY }} + - ${{ github.KEY }} + - ${{ inputs.KEY }} + - ${{ vars.KEY }} + - ${{ needs.KEY }} + include: + - forge: ${{ forge.KEY }} + - forgejo: ${{ forgejo.KEY }} + - github: ${{ github.KEY }} + - inputs: ${{ inputs.KEY }} + - vars: ${{ vars.KEY }} + - needs: ${{ needs.KEY }} + exclude: + - forge: ${{ forge.KEY }} + - forgejo: ${{ forgejo.KEY }} + - github: ${{ github.KEY }} + - inputs: ${{ inputs.KEY }} + - vars: ${{ vars.KEY }} + - needs: ${{ needs.KEY }} +`), &node) + if !assert.NoError(t, err) { + return + } + + // Parse YAML node as a validated workflow. + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.NoError(t, err) + }) + + t.Run("UnknownContext", func(t *testing.T) { + for _, property := range []string{"include", "exclude", "input1"} { + t.Run(property, func(t *testing.T) { + for _, context := range []string{"secrets", "job", "steps", "runner", "matrix", "strategy"} { + t.Run(context, func(t *testing.T) { + var node yaml.Node + err := yaml.Unmarshal([]byte(fmt.Sprintf(` +on: push + +jobs: + job: + uses: ./.forgejo/workflow/test.yaml + strategy: + matrix: + %[1]s: + - input1: ${{ %[2]s.KEY }} +`, property, context)), &node) + if !assert.NoError(t, err) { + return + } + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.ErrorContains(t, err, "Unknown Variable Access "+context) + }) + } + }) + } + }) +} + func TestReusableWorkflow(t *testing.T) { t.Run("KnownContexts", func(t *testing.T) { var node yaml.Node From 7f90c8acb252825d2b4098df06edb75f02010c90 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 28 Sep 2025 14:49:45 +0000 Subject: [PATCH 233/281] fix: do not attempt to run the LXC stop script with self-hosted (#1037) The test is covered by TestRunnerLXC which verifies the script actually runs on LXC. Resolves forgejo/runner#1035 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1037): fix: do not attempt to run the LXC stop script with self-hosted Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1037 Reviewed-by: fnetX Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/run_context.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index bf74a92f..f344a046 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -254,6 +254,10 @@ func (rc *RunContext) stopHostEnvironment(ctx context.Context) error { logger := common.Logger(ctx) logger.Debugf("stopHostEnvironment") + if !rc.IsLXCHostEnv(ctx) { + return nil + } + var stopScript bytes.Buffer if err := stopTemplate.Execute(&stopScript, struct { Name string From d79d043696008be003e734ce8001c5e466c57b38 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 30 Sep 2025 19:12:45 +0000 Subject: [PATCH 234/281] fix: allow GC & cache operations to operate concurrently (#1040) Fixes #1039. Rather than opening and closing the Bolt DB instance constantly, the cache now maintains one open `*bolthold.Store` for its lifetime, allowing GC, cache read, and cache write operations to occur concurrently. The major risk is this change is, "is it safe to use one Bolt instance across goroutines concurrently?" [Bolt does document its concurrency requirements](https://github.com/boltdb/bolt?tab=readme-ov-file#transactions), and an analysis of our DB interactions looks to me like it introduces very little risk. Most of the cache operations perform multiple touches to the database; for example `useCache` performs a read to fetch a cache object, and then an update to set its `UsedAt` timestamp. If we wanted to ensure consistency in these operations, they should use a Bolt ReadWrite transaction -- but concurrent access would just be setting the field to the same value anyway. The `gcCache` is the complex operation where a transaction might be warranted -- but doing so would also cause the same bug that #1039 indicates. I believe it is safe to run without a transaction because it is protected by an application-level mutex (to prevent multiple concurrent GCs), it is the only code that performs deletes from the database -- these should guarantee that all its delete attempts are successful. In the event of unexpected failure to do the DB write, `gcCache` deletes from the storage before deleting from the DB, so it should just attempt to cleanup again next run. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1040): fix: allow GC & cache operations to operate concurrently Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1040 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/artifactcache/caches.go | 47 +++++++++++++++-------------- act/artifactcache/caches_test.go | 5 ++-- act/artifactcache/handler.go | 28 +++++++----------- act/artifactcache/handler_test.go | 49 ++++++------------------------- act/artifactcache/mock_caches.go | 23 ++++++--------- 5 files changed, 53 insertions(+), 99 deletions(-) diff --git a/act/artifactcache/caches.go b/act/artifactcache/caches.go index 6d499c8a..b4d9bd17 100644 --- a/act/artifactcache/caches.go +++ b/act/artifactcache/caches.go @@ -19,12 +19,13 @@ import ( //go:generate mockery --inpackage --name caches type caches interface { - openDB() (*bolthold.Store, error) + getDB() *bolthold.Store validateMac(rundata RunData) (string, error) readCache(id uint64, repo string) (*Cache, error) useCache(id uint64) error setgcAt(at time.Time) gcCache() + close() serve(w http.ResponseWriter, r *http.Request, id uint64) commit(id uint64, size int64) (int64, error) @@ -38,6 +39,8 @@ type cachesImpl struct { logger logrus.FieldLogger secret string + db *bolthold.Store + gcing atomic.Bool gcAt time.Time } @@ -68,12 +71,6 @@ func newCaches(dir, secret string, logger logrus.FieldLogger) (caches, error) { } c.storage = storage - c.gcCache() - - return c, nil -} - -func (c *cachesImpl) openDB() (*bolthold.Store, error) { file := filepath.Join(c.dir, "bolt.db") db, err := bolthold.Open(file, 0o644, &bolthold.Options{ Encoder: json.Marshal, @@ -87,7 +84,22 @@ func (c *cachesImpl) openDB() (*bolthold.Store, error) { if err != nil { return nil, fmt.Errorf("Open(%s): %w", file, err) } - return db, nil + c.db = db + + c.gcCache() + + return c, nil +} + +func (c *cachesImpl) close() { + if c.db != nil { + c.db.Close() + c.db = nil + } +} + +func (c *cachesImpl) getDB() *bolthold.Store { + return c.db } var findCacheWithIsolationKeyFallback = func(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { @@ -156,11 +168,7 @@ func insertCache(db *bolthold.Store, cache *Cache) error { } func (c *cachesImpl) readCache(id uint64, repo string) (*Cache, error) { - db, err := c.openDB() - if err != nil { - return nil, err - } - defer db.Close() + db := c.getDB() cache := &Cache{} if err := db.Get(id, cache); err != nil { return nil, fmt.Errorf("readCache: Get(%v): %w", id, err) @@ -173,11 +181,7 @@ func (c *cachesImpl) readCache(id uint64, repo string) (*Cache, error) { } func (c *cachesImpl) useCache(id uint64) error { - db, err := c.openDB() - if err != nil { - return err - } - defer db.Close() + db := c.getDB() cache := &Cache{} if err := db.Get(id, cache); err != nil { return fmt.Errorf("useCache: Get(%v): %w", id, err) @@ -232,12 +236,7 @@ func (c *cachesImpl) gcCache() { c.gcAt = time.Now() c.logger.Debugf("gc: %v", c.gcAt.String()) - db, err := c.openDB() - if err != nil { - fatal(c.logger, err) - return - } - defer db.Close() + db := c.getDB() // Remove the caches which are not completed for a while, they are most likely to be broken. var caches []*Cache diff --git a/act/artifactcache/caches_test.go b/act/artifactcache/caches_test.go index a08a9af7..34eab331 100644 --- a/act/artifactcache/caches_test.go +++ b/act/artifactcache/caches_test.go @@ -14,6 +14,7 @@ import ( func TestCacheReadWrite(t *testing.T) { caches, err := newCaches(t.TempDir(), "secret", logrus.New()) require.NoError(t, err) + defer caches.close() t.Run("NotFound", func(t *testing.T) { found, err := caches.readCache(456, "repo") assert.Nil(t, found) @@ -33,9 +34,7 @@ func TestCacheReadWrite(t *testing.T) { cache.Repo = repo t.Run("Insert", func(t *testing.T) { - db, err := caches.openDB() - require.NoError(t, err) - defer db.Close() + db := caches.getDB() assert.NoError(t, insertCache(db, cache)) }) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 0b574397..29ff61e3 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -122,6 +122,10 @@ func (h *handler) Close() error { return nil } var retErr error + if h.caches != nil { + h.caches.close() + h.caches = nil + } if h.server != nil { err := h.server.Close() if err != nil { @@ -151,6 +155,9 @@ func (h *handler) getCaches() caches { } func (h *handler) setCaches(caches caches) { + if h.caches != nil { + h.caches.close() + } h.caches = caches } @@ -170,12 +177,7 @@ func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter } version := r.URL.Query().Get("version") - db, err := h.caches.openDB() - if err != nil { - h.responseFatalJSON(w, r, err) - return - } - defer db.Close() + db := h.caches.getDB() cache, err := findCacheWithIsolationKeyFallback(db, repo, keys, version, rundata.WriteIsolationKey) if err != nil { @@ -221,12 +223,7 @@ func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprou api.Key = strings.ToLower(api.Key) cache := api.ToCache() - db, err := h.caches.openDB() - if err != nil { - h.responseFatalJSON(w, r, err) - return - } - defer db.Close() + db := h.caches.getDB() now := time.Now().Unix() cache.CreatedAt = now @@ -335,12 +332,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout // write real size back to cache, it may be different from the current value when the request doesn't specify it. cache.Size = size - db, err := h.caches.openDB() - if err != nil { - h.responseFatalJSON(w, r, err) - return - } - defer db.Close() + db := h.caches.getDB() cache.Complete = true if err := db.Update(cache.ID, cache); err != nil { diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index 136f1a87..91754f77 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -78,9 +78,7 @@ func TestHandler(t *testing.T) { defer func() { t.Run("inspect db", func(t *testing.T) { - db, err := handler.getCaches().openDB() - require.NoError(t, err) - defer db.Close() + db := handler.getCaches().getDB() require.NoError(t, db.Bolt().View(func(tx *bbolt.Tx) error { return tx.Bucket([]byte("Cache")).ForEach(func(k, v []byte) error { t.Logf("%s: %s", k, v) @@ -937,40 +935,11 @@ func TestHandlerAPIFatalErrors(t *testing.T) { handler.find(w, req, nil) }, }, - { - name: "find open", - caches: func(t *testing.T, message string) caches { - caches := newMockCaches(t) - caches.On("validateMac", RunData{}).Return(cacheRepo, nil) - caches.On("openDB", mock.Anything, mock.Anything).Return(nil, errors.New(message)) - return caches - }, - call: func(t *testing.T, handler Handler, w http.ResponseWriter) { - req, err := http.NewRequest("GET", "example.com/cache", nil) - require.NoError(t, err) - handler.find(w, req, nil) - }, - }, - { - name: "reserve", - caches: func(t *testing.T, message string) caches { - caches := newMockCaches(t) - caches.On("validateMac", RunData{}).Return(cacheRepo, nil) - caches.On("openDB", mock.Anything, mock.Anything).Return(nil, errors.New(message)) - return caches - }, - call: func(t *testing.T, handler Handler, w http.ResponseWriter) { - body, err := json.Marshal(&Request{}) - require.NoError(t, err) - req, err := http.NewRequest("POST", "example.com/caches", bytes.NewReader(body)) - require.NoError(t, err) - handler.reserve(w, req, nil) - }, - }, { name: "upload", caches: func(t *testing.T, message string) caches { caches := newMockCaches(t) + caches.On("close").Return() caches.On("validateMac", RunData{}).Return(cacheRepo, nil) caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) return caches @@ -988,6 +957,7 @@ func TestHandlerAPIFatalErrors(t *testing.T) { name: "commit", caches: func(t *testing.T, message string) caches { caches := newMockCaches(t) + caches.On("close").Return() caches.On("validateMac", RunData{}).Return(cacheRepo, nil) caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) return caches @@ -1005,6 +975,7 @@ func TestHandlerAPIFatalErrors(t *testing.T) { name: "get", caches: func(t *testing.T, message string) caches { caches := newMockCaches(t) + caches.On("close").Return() caches.On("validateMac", RunData{}).Return(cacheRepo, nil) caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) return caches @@ -1042,10 +1013,12 @@ func TestHandlerAPIFatalErrors(t *testing.T) { dir := filepath.Join(t.TempDir(), "artifactcache") handler, err := StartHandler(dir, "", 0, "secret", nil) require.NoError(t, err) + defer handler.Close() fatalMessage = "" - handler.setCaches(testCase.caches(t, message)) + caches := testCase.caches(t, message) // doesn't need to be closed because it will be given to handler + handler.setCaches(caches) w := httptest.NewRecorder() testCase.call(t, handler, w) @@ -1138,18 +1111,15 @@ func TestHandler_gcCache(t *testing.T) { }, } - db, err := handler.getCaches().openDB() - require.NoError(t, err) + db := handler.getCaches().getDB() for _, c := range cases { require.NoError(t, insertCache(db, c.Cache)) } - require.NoError(t, db.Close()) handler.getCaches().setgcAt(time.Time{}) // ensure gcCache will not skip handler.getCaches().gcCache() - db, err = handler.getCaches().openDB() - require.NoError(t, err) + db = handler.getCaches().getDB() for i, v := range cases { t.Run(fmt.Sprintf("%d_%s", i, v.Cache.Key), func(t *testing.T) { cache := &Cache{} @@ -1161,7 +1131,6 @@ func TestHandler_gcCache(t *testing.T) { } }) } - require.NoError(t, db.Close()) } func TestHandler_ExternalURL(t *testing.T) { diff --git a/act/artifactcache/mock_caches.go b/act/artifactcache/mock_caches.go index 9d484f80..cadf0b95 100644 --- a/act/artifactcache/mock_caches.go +++ b/act/artifactcache/mock_caches.go @@ -19,6 +19,11 @@ type mockCaches struct { mock.Mock } +// close provides a mock function with no fields +func (_m *mockCaches) close() { + _m.Called() +} + // commit provides a mock function with given fields: id, size func (_m *mockCaches) commit(id uint64, size int64) (int64, error) { ret := _m.Called(id, size) @@ -80,19 +85,15 @@ func (_m *mockCaches) gcCache() { _m.Called() } -// openDB provides a mock function with no fields -func (_m *mockCaches) openDB() (*bolthold.Store, error) { +// getDB provides a mock function with no fields +func (_m *mockCaches) getDB() *bolthold.Store { ret := _m.Called() if len(ret) == 0 { - panic("no return value specified for openDB") + panic("no return value specified for getDB") } var r0 *bolthold.Store - var r1 error - if rf, ok := ret.Get(0).(func() (*bolthold.Store, error)); ok { - return rf() - } if rf, ok := ret.Get(0).(func() *bolthold.Store); ok { r0 = rf() } else { @@ -101,13 +102,7 @@ func (_m *mockCaches) openDB() (*bolthold.Store, error) { } } - if rf, ok := ret.Get(1).(func() error); ok { - r1 = rf() - } else { - r1 = ret.Error(1) - } - - return r0, r1 + return r0 } // readCache provides a mock function with given fields: id, repo From 01766ff4e2f0b9e2fd3b012bc91b4dfa1d4abb05 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 1 Oct 2025 16:38:38 +0000 Subject: [PATCH 235/281] fix: modifying a cache secret does not invalidate cached entries (#1043) Resolves forgejo/runner#1041 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1043): fix: modifying a cache secret does not invalidate cached entries Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1043 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/config/config.example.yaml | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index 4e447e9d..c32526e1 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -110,25 +110,20 @@ cache: # external_server: "" # - ####################################################################### - # - # Common to the internal and external cache server - # - ####################################################################### - # # The shared cache secret used to secure the communications between # the cache proxy and the cache server. # # If empty, it will be generated to a new secret automatically when # the server starts and it will stay the same until it restarts. # - # Every time the secret is modified, all cache entries that were - # created with it are invalidated. In order to ensure that the cache - # content is reused when the runner restarts, this secret must be - # set, for instance with the output of openssl rand -hex 40. - # secret: "" # + ####################################################################### + # + # Common to the internal and external cache server + # + ####################################################################### + # # The IP or hostname (195.84.20.30 or example.com) to use when constructing # ACTIONS_CACHE_URL which is the URL of the cache proxy. # From 63351343ba07fa11763a03768e615ab6e1c9b39f Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Thu, 2 Oct 2025 22:43:50 +0000 Subject: [PATCH 236/281] fix: improve logging to diagnose mystery job terminations (#1048) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Additional logging to support #1044. Manual testing only. Cases tested: Cancel a job from Forgejo UI; this seems like the most likely missing piece in #1044 as two jobs were simultaneously marked as "Failed". There are codepaths in Forgejo that can set this state to both cancelled and failed, but the runner didn't provide log output indicating that's why a job was stopping: ``` time="2025-10-02T13:22:53-06:00" level=info msg="UpdateTask returned task result RESULT_CANCELLED for a task that was in local state RESULT_UNSPECIFIED - beginning local task termination" func="[ReportState]" file="[reporter.go:410]" ``` Host-based executor hits step timeout in exec, or, is cancelled. This occurred but only logged the `err` from `exec`, not the context error indicating whether it was a timeout or a cancellation: ``` [Test Action/job1] this step has been cancelled: ctx: context deadline exceeded, exec: RUN signal: killed [Test Action/job1] this step has been cancelled: ctx: context canceled, exec: RUN signal: killed ``` Unable to `ReportState` due to Forgejo inaccessible. If the runner isn't able to update state to Forgejo a job could be considered a zombie; this would trigger one of the codepaths where the job would be marked as failed. If connectivity was later restored, then the runner could identify it was marked as failed and cancel the job context. (This combination doesn't seem likely, but, I think it's reasonable to consider these failures as warnings because there may be unexpected errors here that we're not aware of). ``` time="2025-10-02T13:27:19-06:00" level=warning msg="ReportState error: unavailable: 502 Bad Gateway" func="[RunDaemon]" file="[reporter.go:207]" ``` Runner shutdown logging; just changed up to `Info` level: ``` time="2025-10-02T13:31:36-06:00" level=info msg="forcing the jobs to shutdown" func="[Shutdown]" file="[poller.go:93]" [Test Action/job1] ❌ Failure - Main sleep 120 [Test Action/job1] this step has been cancelled: ctx: context canceled, exec: RUN signal: killed ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1048): fix: improve logging to diagnose mystery job terminations Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1048 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/container/host_environment.go | 2 +- act/runner/run_context.go | 2 +- act/runner/step.go | 6 +++--- internal/app/poll/poller.go | 4 ++-- internal/pkg/report/reporter.go | 24 +++++++++++++++++++++--- 5 files changed, 28 insertions(+), 10 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 405862a9..c8742008 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -389,7 +389,7 @@ func (e *HostEnvironment) ExecWithCmdLine(command []string, cmdline string, env if err := e.exec(ctx, command, cmdline, env, user, workdir); err != nil { select { case <-ctx.Done(): - return fmt.Errorf("this step has been cancelled: %w", err) + return fmt.Errorf("this step has been cancelled: ctx: %w, exec: %w", ctx.Err(), err) default: return err } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index f344a046..bb79ad3a 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -949,7 +949,7 @@ func (rc *RunContext) Executor() (common.Executor, error) { return err } if res { - timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, rc.Run.Job().TimeoutMinutes) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, "job", rc.ExprEval, rc.Run.Job().TimeoutMinutes) defer cancelTimeOut() return executor(timeoutctx) diff --git a/act/runner/step.go b/act/runner/step.go index 322b6f7e..c93291c4 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -177,7 +177,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo Mode: 0o666, })(ctx) - timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, stepModel.TimeoutMinutes) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, "step", rc.ExprEval, stepModel.TimeoutMinutes) defer cancelTimeOut() err = executor(timeoutctx) @@ -213,12 +213,12 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo } } -func evaluateTimeout(ctx context.Context, exprEval ExpressionEvaluator, timeoutMinutes string) (context.Context, context.CancelFunc) { +func evaluateTimeout(ctx context.Context, contextType string, exprEval ExpressionEvaluator, timeoutMinutes string) (context.Context, context.CancelFunc) { timeout := exprEval.Interpolate(ctx, timeoutMinutes) if timeout != "" { timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64) if err == nil { - common.Logger(ctx).Debugf("the step will stop in timeout-minutes %s", timeout) + common.Logger(ctx).Debugf("the %s will stop in timeout-minutes %s", contextType, timeout) return context.WithTimeout(ctx, time.Duration(timeOutMinutes)*time.Minute) } common.Logger(ctx).Errorf("timeout-minutes %s cannot be parsed and will be ignored: %w", timeout, err) diff --git a/internal/app/poll/poller.go b/internal/app/poll/poller.go index 7b954cb7..c880bc67 100644 --- a/internal/app/poll/poller.go +++ b/internal/app/poll/poller.go @@ -90,10 +90,10 @@ func (p *poller) Shutdown(ctx context.Context) error { return nil case <-ctx.Done(): - log.Trace("forcing the jobs to shutdown") + log.Info("forcing the jobs to shutdown") p.shutdownJobs() <-p.done - log.Trace("all jobs have been shutdown") + log.Info("all jobs have been shutdown") return ctx.Err() } } diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 7e46b8bb..804744cc 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -48,6 +48,7 @@ type Reporter struct { debugOutputEnabled bool stopCommandEndToken string + issuedLocalCancel bool } func NewReporter(ctx context.Context, cancel context.CancelFunc, c client.Client, task *runnerv1.Task, reportInterval time.Duration) *Reporter { @@ -192,11 +193,19 @@ func (r *Reporter) RunDaemon() { return } if r.ctx.Err() != nil { + // This shouldn't happen because DaemonContext is used for `r.ctx` which should outlive any running job. + log.Warnf("Terminating RunDaemon on an active job due to error: %v", r.ctx.Err()) return } - _ = r.ReportLog(false) - _ = r.ReportState() + err := r.ReportLog(false) + if err != nil { + log.Warnf("ReportLog error: %v", err) + } + err = r.ReportState() + if err != nil { + log.Warnf("ReportState error: %v", err) + } time.AfterFunc(r.reportInterval, r.RunDaemon) } @@ -391,8 +400,17 @@ func (r *Reporter) ReportState() error { r.outputs.Store(k, struct{}{}) } - switch resp.Msg.GetState().GetResult() { + localResultState := state.GetResult() + remoteResultState := resp.Msg.GetState().GetResult() + switch remoteResultState { case runnerv1.Result_RESULT_CANCELLED, runnerv1.Result_RESULT_FAILURE: + // issuedLocalCancel is just used to deduplicate this log message if our local state doesn't catch up with our + // remote state as quickly as the report-interval, which would cause this message to repeat in the logs. + if !r.issuedLocalCancel && remoteResultState != localResultState { + log.Infof("UpdateTask returned task result %v for a task that was in local state %v - beginning local task termination", + remoteResultState, localResultState) + r.issuedLocalCancel = true + } r.cancel() } From b772be7131102d2c19a745811a569cd4ff1cbced Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 3 Oct 2025 08:22:06 +0000 Subject: [PATCH 237/281] fix(security): a multiline secret may be found in a single log entry (#1051) With secrets.MULTILINE set to ``` ABC DEF GHI ``` the following is logged in debug mode: ``` 2025-09-18T10:54:04.4656189Z expression '${{ secrets.MULTILINE }}' rewritten to 'format('{0}', secrets.MULTILINE)' 2025-09-18T10:54:04.4656426Z evaluating expression 'format('{0}', secrets.MULTILINE)' 2025-09-18T10:54:04.4656797Z expression 'format('{0}', secrets.MULTILINE)' evaluated to '%!t(string=ABC\nDEF\nGHI)' ``` Although it is displayed with \ followed by n, it is a single line entry displayed with the secret verbatim and must also be redacted. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1051): fix(security): a multiline secret may be found in a single log entry Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1051 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/mask.go | 2 +- internal/pkg/report/mask_test.go | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/internal/pkg/report/mask.go b/internal/pkg/report/mask.go index 2ae19b8f..3dbb6f42 100644 --- a/internal/pkg/report/mask.go +++ b/internal/pkg/report/mask.go @@ -38,7 +38,7 @@ func (o *masker) add(secret string) { }) // a multiline secret transformed into a single line by replacing // newlines with \ followed by n must also be redacted - secret = strings.Join(lines, "\\n") + o.lines = append(o.lines, strings.Join(lines, "\\n")) } o.lines = append(o.lines, secret) diff --git a/internal/pkg/report/mask_test.go b/internal/pkg/report/mask_test.go index 8f26e698..b785c4dc 100644 --- a/internal/pkg/report/mask_test.go +++ b/internal/pkg/report/mask_test.go @@ -7,6 +7,8 @@ import ( "fmt" "testing" + runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" + "github.com/stretchr/testify/assert" ) @@ -267,4 +269,17 @@ SIX` assert.Equal(t, testCase.out, rowsToString(rows)) }) } + + t.Run("MultilineSecretInSingleRow", func(t *testing.T) { + secret := "ABC\nDEF\nGHI" + m := newMasker() + m.add(secret) + rows := []*runnerv1.LogRow{ + {Content: fmt.Sprintf("BEFORE%sAFTER", secret)}, + } + noMore := false + needMore := m.replace(rows, noMore) + assert.False(t, needMore) + assert.Equal(t, "BEFORE***AFTER\n", rowsToString(rows)) + }) } From 1fa156c7e40c908a742742961e0f1c165ab42699 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 3 Oct 2025 09:03:32 +0000 Subject: [PATCH 238/281] Update dependency forgejo/lxc-helpers to v1.1.1 (#1050) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers) | patch | `1.1.0` -> `1.1.1` | --- ### Release Notes
forgejo/lxc-helpers (forgejo/lxc-helpers) ### [`v1.1.1`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.0...v1.1.1) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.0...v1.1.1)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1050 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index c0334bea..0c1e2204 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -20,7 +20,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_TOKEN:=} : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} -DEFAULT_LXC_HELPERS_VERSION=1.1.0 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers +DEFAULT_LXC_HELPERS_VERSION=1.1.1 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} From a980acd9369da246bfc8f72a6aa8992c3ab71feb Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Fri, 3 Oct 2025 09:09:29 +0000 Subject: [PATCH 239/281] fix: make the creation of LXC templates atomic so they cannot be interrupted while building (#1049) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/49 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1049): cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers refs/pull/49/head to forgejo/lxc-helpers-49 Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1049 Reviewed-by: earl-warren Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 78 ++++++++++++++++++++++++++++------- 1 file changed, 63 insertions(+), 15 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index 78d70113..cd855a89 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -11,6 +11,8 @@ LXC_IPV6_PREFIX_DEFAULT="fd15" LXC_DOCKER_PREFIX_DEFAULT="172.17" LXC_IPV6_DOCKER_PREFIX_DEFAULT="fd00:d0ca" LXC_APT_TOO_OLD='1 week ago' +: ${LXC_TRANSACTION_TIMEOUT:=600} +LXC_TRANSACTION_LOCK_FILE=/tmp/lxc-helper.lock : ${LXC_SUDO:=} : ${LXC_CONTAINER_RELEASE:=bookworm} @@ -28,16 +30,22 @@ function lxc_template_release() { echo lxc-helpers-$LXC_CONTAINER_RELEASE } +function lxc_directory() { + local name="$1" + + echo /var/lib/lxc/$name +} + function lxc_root() { local name="$1" - echo /var/lib/lxc/$name/rootfs + echo $(lxc_directory $name)/rootfs } function lxc_config() { local name="$1" - echo /var/lib/lxc/$name/config + echo $(lxc_directory $name)/config } function lxc_container_run() { @@ -47,6 +55,44 @@ function lxc_container_run() { $LXC_SUDO lxc-attach --clear-env --name $name -- "$@" } +function lxc_transaction_lock() { + exec 7>$LXC_TRANSACTION_LOCK_FILE + flock --timeout $LXC_TRANSACTION_TIMEOUT 7 +} + +function lxc_transaction_unlock() { + exec 7>&- +} + +function lxc_transaction_draft_name() { + echo "lxc-helper-draft" +} + +function lxc_transaction_begin() { + local name=$1 # not actually used but it helps when reading in the caller + local draft=$(lxc_transaction_draft_name) + + lxc_transaction_lock + lxc_container_destroy $draft + + echo $draft +} + +function lxc_transaction_commit() { + local name=$1 + local draft=$(lxc_transaction_draft_name) + + # do not use lxc-copy because it is not atomic if lxc-copy is + # interrupted it may leave the $name container half populated + $LXC_SUDO sed -i -e "s/$draft/$name/g" \ + $(lxc_config $draft) \ + $(lxc_root $draft)/etc/hosts \ + $(lxc_root $draft)/etc/hostname + $LXC_SUDO rm -f $(lxc_root $draft)/var/lib/dhcp/dhclient.* + $LXC_SUDO mv $(lxc_directory $draft) $(lxc_directory $name) + lxc_transaction_unlock +} + function lxc_container_run_script_as() { local name="$1" local user="$2" @@ -242,7 +288,7 @@ function lxc_container_configure() { function lxc_container_install_lxc_helpers() { local name="$1" - $LXC_SUDO cp -a $LXC_SELF_DIR/lxc-helpers*.sh $root/$LXC_BIN + $LXC_SUDO cp -a $LXC_SELF_DIR/lxc-helpers*.sh $(lxc_root $name)/$LXC_BIN # # Wait for the network to come up # @@ -304,10 +350,9 @@ function lxc_container_stop() { function lxc_container_destroy() { local name="$1" - local root="$2" if lxc_exists "$name"; then - lxc_container_stop $name $root + lxc_container_stop $name $LXC_SUDO lxc-destroy --force --name="$name" fi } @@ -346,14 +391,15 @@ function lxc_build_template_release() { return fi - local root=$(lxc_root $name) - $LXC_SUDO lxc-create --name $name --template debian -- --release=$LXC_CONTAINER_RELEASE - echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $name) - lxc_container_install_lxc_helpers $name - lxc_container_start $name - lxc_container_run $name apt-get update -qq - lxc_apt_install $name sudo git python3 - lxc_container_stop $name + local draft=$(lxc_transaction_begin $name) + $LXC_SUDO lxc-create --name $draft --template debian -- --release=$LXC_CONTAINER_RELEASE + echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $draft) + lxc_container_install_lxc_helpers $draft + lxc_container_start $draft + lxc_container_run $draft apt-get update -qq + lxc_apt_install $draft sudo git python3 + lxc_container_stop $draft + lxc_transaction_commit $name } function lxc_build_template() { @@ -368,10 +414,12 @@ function lxc_build_template() { lxc_build_template_release fi - if ! $LXC_SUDO lxc-copy --name=$name --newname=$newname; then - echo lxc-copy --name=$name --newname=$newname failed + local draft=$(lxc_transaction_begin $newname) + if ! $LXC_SUDO lxc-copy --name=$name --newname=$draft; then + echo lxc-copy --name=$name --newname=$draft failed return 1 fi + lxc_transaction_commit $newname lxc_container_configure $newname } From 413a52605df9d06dc4d6f375164f80eb2a6649bd Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 3 Oct 2025 16:14:08 +0000 Subject: [PATCH 240/281] fix: remove LXC backend leftovers when the job completes (#1054) - remove the root of the LXC container after destroying it, with sudo as it may contain files owned by root while the runner id is not root - os.RemoveAll only for native host runs, it is no longer needed for the LXC backend - remove the CleanUp function that is an indirection with no use Resolves forgejo/runner#442 When running the test from a non-root user and without this fix, it fails as follow: ``` go test -v -count=1 -run='TestRunnerLXC' ./internal/app/run === RUN TestRunnerLXC ... time="2025-10-03T15:05:12+02:00" level=debug msg=stopHostEnvironment time="2025-10-03T15:05:13+02:00" level=debug msg="HostEnvironment.Remove /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor" time="2025-10-03T15:05:13+02:00" level=error msg="Error while stop job container FORGEJO-ACTIONS-TASK-0_WORKFLOW-3ede81fbc69d42e6db70bef5820490fc3e7dc4d9dcbfb64981f2d00f08a30d6e_JOB-job: unlinkat /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor/some/directory/owned/by/root: permission denied" === NAME TestRunnerLXC runner_test.go:469: Error Trace: /home/earl-warren/software/runner/internal/app/run/runner_test.go:469 /home/earl-warren/software/runner/internal/app/run/runner_test.go:496 Error: Received unexpected error: Error occurred running finally: unlinkat /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor/some/directory/owned/by/root: permission denied (original error: ) Test: TestRunnerLXC Messages: OK === NAME TestRunnerLXC/OK testing.go:1679: test executed panic(nil) or runtime.Goexit: subtest may have called FailNow on a parent test === NAME TestRunnerLXC testing.go:1267: TempDir RemoveAll cleanup: unlinkat /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor/some/directory/owned/by/root: permission denied --- FAIL: TestRunnerLXC (6.84s) --- FAIL: TestRunnerLXC/OK (6.84s) FAIL FAIL code.forgejo.org/forgejo/runner/v11/internal/app/run 6.847s FAIL ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1054): fix: remove LXC backend leftovers when the job completes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1054 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/host_environment.go | 10 +++++----- act/runner/run_context.go | 9 ++++----- internal/app/run/runner_test.go | 2 +- 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index c8742008..34d24b9b 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -34,7 +34,6 @@ type HostEnvironment struct { Workdir string ActPath string Root string - CleanUp func() StdOut io.Writer LXC bool } @@ -404,11 +403,12 @@ func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string) func (e *HostEnvironment) Remove() common.Executor { return func(ctx context.Context) error { - if e.CleanUp != nil { - e.CleanUp() + if e.GetLXC() { + // there may be files owned by root: removal + // is the responsibility of the LXC backend + return nil } - common.Logger(ctx).Debugf("HostEnvironment.Remove %s", e.Path) - return os.RemoveAll(e.Path) + return os.RemoveAll(e.Root) } } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index bb79ad3a..59fcf6f8 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -248,6 +248,8 @@ var stopTemplate = template.Must(template.New("stop").Parse(`#!/bin/bash source $(dirname $0)/lxc-helpers-lib.sh lxc_container_destroy "{{.Name}}" +lxc_maybe_sudo +$LXC_SUDO rm -fr "{{ .Root }}" `)) func (rc *RunContext) stopHostEnvironment(ctx context.Context) error { @@ -314,11 +316,8 @@ func (rc *RunContext) startHostEnvironment() common.Executor { ToolCache: rc.getToolCache(ctx), Workdir: rc.Config.Workdir, ActPath: actPath, - CleanUp: func() { - os.RemoveAll(miscpath) - }, - StdOut: logWriter, - LXC: rc.IsLXCHostEnv(ctx), + StdOut: logWriter, + LXC: rc.IsLXCHostEnv(ctx), } rc.cleanUpJobContainer = func(ctx context.Context) error { if err := rc.stopHostEnvironment(ctx); err != nil { diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index eda5de9e..bbd6c235 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -491,7 +491,7 @@ jobs: job: runs-on: lxc steps: - - run: echo OK + - run: mkdir -p some/directory/owned/by/root ` runWorkflow(ctx, cancel, workflow, "push", "refs/heads/main", "OK") }) From 996ac343ee155a4b47d89a6bf1854feb1c04fdb2 Mon Sep 17 00:00:00 2001 From: limiting-factor Date: Fri, 3 Oct 2025 16:15:43 +0000 Subject: [PATCH 241/281] chore(cleanup): lxc-helpers does not need a global lock (#1047) - https://code.forgejo.org/forgejo/lxc-helpers/src/tag/v1.1.1 has locking and atomicity - this lock was only good for when two release templates are populated simultaneously and not when it was interrupted Refs forgejo/lxc-helpers#8 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1047): WIP: chore(cleanup): lxc-helpers does not need a global lock Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1047 Reviewed-by: earl-warren Co-authored-by: limiting-factor Co-committed-by: limiting-factor --- act/runner/run_context.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 59fcf6f8..ff551322 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -193,8 +193,6 @@ var lxcHelpers string var startTemplate = template.Must(template.New("start").Parse(`#!/bin/bash -e -exec 5<>/tmp/forgejo-runner-lxc.lock ; flock --timeout 21600 5 - LXC_CONTAINER_CONFIG="{{.Config}}" LXC_CONTAINER_RELEASE="{{.Release}}" From 2bccbec3aec926d28894e73dc42690d7b64b4367 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 4 Oct 2025 11:15:31 +0000 Subject: [PATCH 242/281] Update forgejo-runner to v11.1.2 (#1055) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | patch | `11.1.1` -> `11.1.2` | | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | patch | `11.1.1` -> `11.1.2` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v11.1.2`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.1.2) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v11.1.1...v11.1.2) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1026): feat: support evaluating workflow-level concurrency blocks in jobparser - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1051): fix(security): a multiline secret may be found in a single log entry - [PR](https://code.forgejo.org/forgejo/runner/pulls/1048): fix: improve logging to diagnose mystery job terminations - [PR](https://code.forgejo.org/forgejo/runner/pulls/1043): fix: modifying a cache secret does not invalidate cached entries - [PR](https://code.forgejo.org/forgejo/runner/pulls/1040): fix: allow GC & cache operations to operate concurrently - [PR](https://code.forgejo.org/forgejo/runner/pulls/1037): fix: do not attempt to run the LXC stop script with self-hosted - [PR](https://code.forgejo.org/forgejo/runner/pulls/1031): fix: event.pull\_request.action == closed can use the cache of the base repository - [PR](https://code.forgejo.org/forgejo/runner/pulls/1027): fix: Correctly override the value of `Forgejo-Cache-Host` when ACTIONS\_CACHE\_URL is overridden. - [PR](https://code.forgejo.org/forgejo/runner/pulls/1019): fix: a composite action must not change the result of the calling step before it completes - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1033): chore: test: exercise contexts in matrix when validating workflows - [PR](https://code.forgejo.org/forgejo/runner/pulls/1029): Update module connectrpc.com/connect to v1.19.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1025): chore: fix typo in the documentation - [PR](https://code.forgejo.org/forgejo/runner/pulls/1023): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.5.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1022): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.6 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1020): chore: upgrade LXC example to Debian GNU/Linux trixie - [PR](https://code.forgejo.org/forgejo/runner/pulls/1021): Update action to v3.0.4 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1018): Update forgejo-runner to v11.1.1
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1055 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index 7aeae3ec..201650ae 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:11.1.1 + image: code.forgejo.org/forgejo/runner:11.1.2 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:11.1.1 + image: code.forgejo.org/forgejo/runner:11.1.2 links: - docker-in-docker - forgejo diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 0c1e2204..e949f3de 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.1.1 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=11.1.2 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 5f3ff3d2e2020b0ca16dfae69baa5adbfff62160 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 4 Oct 2025 11:16:16 +0000 Subject: [PATCH 243/281] chore: teach renovate about example-lxc-systemd.yml (#1053) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1053 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/example-lxc-systemd.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index e333092b..c8907609 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -14,6 +14,7 @@ env: SERIAL: "30" LIFETIME: "60" SYSTEMD_OPTIONS: "--no-pager --full" + USE_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: example-lxc-systemd: @@ -57,7 +58,7 @@ jobs: with: user: root password: admin1234 - binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v7.0.12/forgejo-7.0.12-linux-amd64 + binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v${{ env.USE_VERSION }}/forgejo-${{ env.USE_VERSION }}-linux-amd64 # must be the same as LXC_IPV4_PREFIX in examples/lxc-systemd/forgejo-runner-service.sh lxc-ip-prefix: 10.105.7 From 4010e6116501bae290629330aa54b46d98304a4b Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 5 Oct 2025 07:39:29 +0000 Subject: [PATCH 244/281] Update module google.golang.org/protobuf to v1.36.10 (#1058) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [google.golang.org/protobuf](https://github.com/protocolbuffers/protobuf-go) | `v1.36.9` -> `v1.36.10` | [![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fprotobuf/v1.36.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fprotobuf/v1.36.9/v1.36.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
protocolbuffers/protobuf-go (google.golang.org/protobuf) ### [`v1.36.10`](https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.10) [Compare Source](https://github.com/protocolbuffers/protobuf-go/compare/v1.36.9...v1.36.10) **Full Changelog**: Bug fixes: [CL/704415](https://go-review.googlesource.com/c/protobuf/+/704415): reflect/protodesc: edition-2024-specific properties should not be lost when converting FileDescriptorProto to protoreflect.FileDescriptor Maintenance: [CL/708555](https://go-review.googlesource.com/c/protobuf/+/708555): internal/race\_test: add missing impl.LazyEnabled() t.Skip [CL/703295](https://go-review.googlesource.com/c/protobuf/+/703295): proto: add more invalid group encoding test cases [CL/703276](https://go-review.googlesource.com/c/protobuf/+/703276): internal/impl: verify lazy unmarshal on Deterministic encoding [CL/703275](https://go-review.googlesource.com/c/protobuf/+/703275): internal/impl: stop using deprecated .Field in lazy\_test.go [CL/702795](https://go-review.googlesource.com/c/protobuf/+/702795): all: update to latest github.com/google/go-cmp
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1058 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index d1763deb..0ebcf50e 100644 --- a/go.mod +++ b/go.mod @@ -39,7 +39,7 @@ require ( go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.35.0 golang.org/x/time v0.13.0 - google.golang.org/protobuf v1.36.9 + google.golang.org/protobuf v1.36.10 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index d5b9a302..5231c673 100644 --- a/go.sum +++ b/go.sum @@ -260,8 +260,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU= google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw= google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA= -google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw= -google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= +google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= +google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From ba1beb08f4c774df55f3b431bf6c516384956949 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 5 Oct 2025 07:40:06 +0000 Subject: [PATCH 245/281] fix: log error for why cache couldn't be started (#1057) Example, `cache.port` set to `22`: ``` time="2025-10-04T09:27:42-06:00" level=error msg="Could not start the cache server, cache will be disabled: listen tcp :22: bind: permission denied" func="[setupCache]" file="[runner.go:126]" ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1057): fix: log error for why cache couldn't be started Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1057 Reviewed-by: limiting-factor Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- internal/app/run/runner.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 1bf32c78..82deea2b 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -123,7 +123,7 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler log.StandardLogger().WithField("module", "cache_request"), ) if err != nil { - log.Error("Could not start the cache server, cache will be disabled") + log.Errorf("Could not start the cache server, cache will be disabled: %v", err) return nil } From e68940619c1194f86f527125f2be1af9aefc5b20 Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Mon, 6 Oct 2025 03:51:19 +0000 Subject: [PATCH 246/281] chore(docs): clarify the behavior of `[container].docker_host` (#1059) The description of `container.docker_host` was misleading (and IMO the setting itself does too many things, see forgejo/forgejo-actions-feature-requests#58). I clarified the comments in the example config to clearly explain that it will mount the specified socket inside the job container, and give some example values - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1059): Clarify the behavior of `container.docker_host` Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1059 Reviewed-by: earl-warren Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- internal/pkg/config/config.example.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index c32526e1..5addac41 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -176,10 +176,12 @@ container: # valid_volumes: # - '**' valid_volumes: [] - # overrides the docker client host with the specified one. - # If "-" or "", an available docker host will automatically be found. + # Overrides the docker host set by the DOCKER_HOST environment variable, and mounts on the job container. + # If "-" or "", no docker host will be mounted in the job container # If "automount", an available docker host will automatically be found and mounted in the job container (e.g. /var/run/docker.sock). - # Otherwise the specified docker host will be used and an error will be returned if it doesn't work. + # If it's a url, the specified docker host will be mounted in the job container + # Example urls: unix:///run/docker.socket or ssh://user@host + # The specified socket is mounted within the job container at /var/run/docker.sock docker_host: "-" # Pull docker image(s) even if already present force_pull: false From a22c5a2e659ef1cc296681940f4db24e078ac446 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 6 Oct 2025 04:22:26 +0000 Subject: [PATCH 247/281] Update module github.com/go-git/go-git/v5 to v5.16.3 (#1062) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.16.2` -> `v5.16.3` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.16.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.16.2/v5.16.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
go-git/go-git (github.com/go-git/go-git/v5) ### [`v5.16.3`](https://github.com/go-git/go-git/releases/tag/v5.16.3) [Compare Source](https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3) #### What's Changed - internal: Expand regex to fix build \[5.x] by [@​baloo](https://github.com/baloo) in [#​1644](https://github.com/go-git/go-git/pull/1644) - build: raise timeouts for windows CI tests and disable CIFuzz \[5.x] by [@​baloo](https://github.com/baloo) in [#​1646](https://github.com/go-git/go-git/pull/1646) - plumbing: support commits extra headers, support jujutsu signed commit \[5.x] by [@​baloo](https://github.com/baloo) in [#​1633](https://github.com/go-git/go-git/pull/1633) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1062 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 0ebcf50e..ec37b2c5 100644 --- a/go.mod +++ b/go.mod @@ -17,7 +17,7 @@ require ( github.com/docker/docker v28.4.0+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 - github.com/go-git/go-git/v5 v5.16.2 + github.com/go-git/go-git/v5 v5.16.3 github.com/gobwas/glob v0.2.3 github.com/google/go-cmp v0.7.0 github.com/google/uuid v1.6.0 diff --git a/go.sum b/go.sum index 5231c673..59f8c95c 100644 --- a/go.sum +++ b/go.sum @@ -69,8 +69,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM= -github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8= +github.com/go-git/go-git/v5 v5.16.3 h1:Z8BtvxZ09bYm/yYNgPKCzgWtaRqDTgIKRgIRHBfU6Z8= +github.com/go-git/go-git/v5 v5.16.3/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From 0a0b25d88609b47c4ebd2068b4edc19df6f71d98 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 7 Oct 2025 08:09:14 +0000 Subject: [PATCH 248/281] fix: don't panic on cacheproxy startup failure (#1067) In #1064 I theorized that a failure to start up the cache proxy server might cause it to still be registered as `ACTIONS_CACHE_URL`. It turns out to not be the case as it will just panic, since `cacheProxy` is `nil`. But regardless, it seems better to not panic and crash if the intent here is "cache will be disabled" as documented in the log message. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1067): fix: don't panic on cacheproxy startup failure Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1067 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- internal/app/run/runner.go | 4 +- internal/app/run/runner_test.go | 93 +++++++++++++++++++++++++++++++++ 2 files changed, 95 insertions(+), 2 deletions(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 82deea2b..31a1b320 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -150,10 +150,10 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler ) if err != nil { log.Errorf("cannot init cache proxy, cache will be disabled: %v", err) + } else { + envs["ACTIONS_CACHE_URL"] = cacheProxy.ExternalURL() } - envs["ACTIONS_CACHE_URL"] = cacheProxy.ExternalURL() - return cacheProxy } diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index bbd6c235..5de1b58c 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "net" "os" "testing" "time" @@ -421,6 +422,98 @@ jobs: }) } +func TestRunnerCacheStartupFailure(t *testing.T) { + if testing.Short() { + t.Skip("skipping integration test") + } + + testCases := []struct { + desc string + listen string + }{ + { + desc: "disable cache server", + listen: "127.0.0.1:40715", + }, + { + desc: "disable cache proxy server", + listen: "127.0.0.1:40716", + }, + } + + for _, tc := range testCases { + t.Run(tc.desc, func(t *testing.T) { + forgejoClient := &forgejoClientMock{} + + forgejoClient.On("Address").Return("https://127.0.0.1:8080") // not expected to be used in this test + forgejoClient.On("UpdateLog", mock.Anything, mock.Anything).Return(nil, nil) + forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). + Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + + // We'll be listening on some network port in this test that will conflict with the cache configuration... + l, err := net.Listen("tcp4", tc.listen) + require.NoError(t, err) + defer l.Close() + + runner := NewRunner( + &config.Config{ + Cache: config.Cache{ + Port: 40715, + ProxyPort: 40716, + Dir: t.TempDir(), + }, + Host: config.Host{ + WorkdirParent: t.TempDir(), + }, + }, + &config.Registration{ + Labels: []string{"ubuntu-latest:docker://code.forgejo.org/oci/node:20-bookworm"}, + }, + forgejoClient) + require.NotNil(t, runner) + + // Ensure that cacheProxy failed to start + assert.Nil(t, runner.cacheProxy) + + runWorkflow := func(ctx context.Context, cancel context.CancelFunc, yamlContent string) { + task := &runnerv1.Task{ + WorkflowPayload: []byte(yamlContent), + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "token": structpb.NewStringValue("some token here"), + "forgejo_default_actions_url": structpb.NewStringValue("https://data.forgejo.org"), + "repository": structpb.NewStringValue("runner"), + "event_name": structpb.NewStringValue("push"), + "ref": structpb.NewStringValue("refs/heads/main"), + }, + }, + } + + reporter := report.NewReporter(ctx, cancel, forgejoClient, task, time.Second) + err := runner.run(ctx, task, reporter) + reporter.Close(nil) + require.NoError(t, err) + } + + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + checkCacheYaml := ` +name: Verify No ACTIONS_CACHE_URL +on: + push: +jobs: + job-cache-check-1: + runs-on: ubuntu-latest + steps: + - run: echo $ACTIONS_CACHE_URL + - run: '[[ "$ACTIONS_CACHE_URL" = "" ]] || exit 1' +` + runWorkflow(ctx, cancel, checkCacheYaml) + }) + } +} + func TestRunnerLXC(t *testing.T) { if testing.Short() { t.Skip("skipping integration test") From a3d46d7597e31d491ea70e2a76152177613507ec Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 7 Oct 2025 08:12:16 +0000 Subject: [PATCH 249/281] chore: add additional logging to cacheproxy (#1065) In support of diagnosing #1064, I hope. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1065): chore: add additional logging to cacheproxy Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1065 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/cacheproxy/handler.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index e494b9c5..499c5167 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -64,7 +64,7 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheProxyHostOver discard.Out = io.Discard logger = discard } - logger = logger.WithField("module", "artifactcache") + logger = logger.WithField("module", "cacheproxy") h.logger = logger h.cacheSecret = cacheSecret @@ -139,6 +139,7 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er r.SetURL(targetURL) r.Out.URL.Path = uri + h.logger.Debugf("proxy req %s %q to %q", r.In.Method, r.In.URL, r.Out.URL) r.Out.Header.Set("Forgejo-Cache-Repo", runData.RepositoryFullName) r.Out.Header.Set("Forgejo-Cache-RunNumber", runData.RunNumber) @@ -150,6 +151,10 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er r.Out.Header.Set("Forgejo-Cache-WriteIsolationKey", runData.WriteIsolationKey) } }, + ModifyResponse: func(r *http.Response) error { + h.logger.Debugf("proxy resp %s w/ %d bytes", r.Status, r.ContentLength) + return nil + }, } return proxy, nil } From 041524d663fa205ec5e72a9dc22b9b01ffa2c481 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 7 Oct 2025 08:13:23 +0000 Subject: [PATCH 250/281] Update module github.com/docker/cli to v28.5.0+incompatible (#1066) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v28.4.0+incompatible` -> `v28.5.0+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fcli/v28.5.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fcli/v28.4.0+incompatible/v28.5.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/cli (github.com/docker/cli) ### [`v28.5.0+incompatible`](https://github.com/docker/cli/compare/v28.4.0...v28.5.0) [Compare Source](https://github.com/docker/cli/compare/v28.4.0...v28.5.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1066 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index ec37b2c5..4e85c9b6 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 - github.com/docker/cli v28.4.0+incompatible + github.com/docker/cli v28.5.0+incompatible github.com/docker/docker v28.4.0+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 diff --git a/go.sum b/go.sum index 59f8c95c..0cc56d8b 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY0UUU4C9kY= -github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v28.5.0+incompatible h1:crVqLrtKsrhC9c00ythRx435H8LiQnUKRtJLRR+Auxk= +github.com/docker/cli v28.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk= github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= From 3f52c56d1e24c31297290eacfd035fb703e6b810 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 7 Oct 2025 14:41:55 +0000 Subject: [PATCH 251/281] feat: improve readability of error messages from ParseRawOn (#1063) With https://codeberg.org/forgejo/forgejo/pulls/9530, the error messages from `ParseRawOn` are user-facing and need a pass to improve their meaning. - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1063): feat: improve readability of error messages from ParseRawOn Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1063 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/jobparser/model.go | 60 ++++++++++++++++----------------- act/jobparser/model_test.go | 67 ++++++++++++++++++++++++++++++++++--- 2 files changed, 93 insertions(+), 34 deletions(-) diff --git a/act/jobparser/model.go b/act/jobparser/model.go index e94123e3..74de0450 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -2,6 +2,7 @@ package jobparser import ( "fmt" + "strings" "code.forgejo.org/forgejo/runner/v11/act/model" "go.yaml.in/yaml/v3" @@ -226,7 +227,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { var val string err := rawOn.Decode(&val) if err != nil { - return nil, err + return nil, fmt.Errorf("unable to interpret scalar value into a string: %w", err) } return []*Event{ {Name: val}, @@ -238,12 +239,12 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { return nil, err } res := make([]*Event, 0, len(val)) - for _, v := range val { + for i, v := range val { switch t := v.(type) { case string: res = append(res, &Event{Name: t}) default: - return nil, fmt.Errorf("invalid type %T", t) + return nil, fmt.Errorf("value at index %d was unexpected type %[2]T; must be a string but was %#[2]v", i, v) } } return res, nil @@ -263,16 +264,6 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { continue } switch t := v.(type) { - case string: - res = append(res, &Event{ - Name: k, - acts: map[string][]string{}, - }) - case []string: - res = append(res, &Event{ - Name: k, - acts: map[string][]string{}, - }) case map[string]any: acts := make(map[string][]string, len(t)) for act, branches := range t { @@ -286,15 +277,15 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { for i, v := range b { var ok bool if acts[act][i], ok = v.(string); !ok { - return nil, fmt.Errorf("unknown on type: %#v", branches) + return nil, fmt.Errorf("key %q.%q index %d had unexpected type %[4]T; a string was expected but was %#[4]v", k, act, i, v) } } case map[string]any: - if isInvalidOnType(k, act) { - return nil, fmt.Errorf("unknown on type: %#v", v) + if err := isInvalidOnType(k, act); err != nil { + return nil, fmt.Errorf("invalid value on key %q: %w", k, err) } default: - return nil, fmt.Errorf("unknown on type: %#v", branches) + return nil, fmt.Errorf("key %q.%q had unexpected type %T; was %#v", k, act, branches, branches) } } if k == "workflow_dispatch" || k == "workflow_call" { @@ -306,19 +297,22 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { }) case []any: if k != "schedule" { - return nil, fmt.Errorf("unknown on type: %#v", v) + return nil, fmt.Errorf("key %q had an type %T; only the 'schedule' key is expected with this type", k, v) } schedules := make([]map[string]string, len(t)) for i, tt := range t { vv, ok := tt.(map[string]any) if !ok { - return nil, fmt.Errorf("unknown on type: %#v", v) + return nil, fmt.Errorf("key %q[%d] had unexpected type %[3]T; a map with a key \"cron\" was expected, but value was %#[3]v", k, i, tt) } schedules[i] = make(map[string]string, len(vv)) - for k, vvv := range vv { + for kk, vvv := range vv { + if strings.ToLower(kk) != "cron" { + return nil, fmt.Errorf("key %q[%d] had unexpected key %q; \"cron\" was expected", k, i, kk) + } var ok bool - if schedules[i][k], ok = vvv.(string); !ok { - return nil, fmt.Errorf("unknown on type: %#v", v) + if schedules[i][kk], ok = vvv.(string); !ok { + return nil, fmt.Errorf("key %q[%d].%q had unexpected type %[4]T; a string was expected by was %#[4]v", k, i, kk, vvv) } } } @@ -327,23 +321,29 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { schedules: schedules, }) default: - return nil, fmt.Errorf("unknown on type: %#v", v) + return nil, fmt.Errorf("key %q had unexpected type %[2]T; expected a map or array but was %#[2]v", k, v) } } return res, nil default: - return nil, fmt.Errorf("unknown on type: %v", rawOn.Kind) + return nil, fmt.Errorf("unexpected yaml node in `on`: %v", rawOn.Kind) } } -func isInvalidOnType(onType, subKey string) bool { - if onType == "workflow_dispatch" && subKey == "inputs" { - return false +func isInvalidOnType(onType, subKey string) error { + if onType == "workflow_dispatch" { + if subKey == "inputs" { + return nil + } + return fmt.Errorf("workflow_dispatch only supports key \"inputs\", but key %q was found", subKey) } - if onType == "workflow_call" && (subKey == "inputs" || subKey == "outputs") { - return false + if onType == "workflow_call" { + if subKey == "inputs" || subKey == "outputs" { + return nil + } + return fmt.Errorf("workflow_call only supports keys \"inputs\" and \"outputs\", but key %q was found", subKey) } - return true + return fmt.Errorf("unexpected key %q.%q", onType, subKey) } // parseMappingNode parse a mapping node and preserve order. diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index 45d77428..454de71c 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -16,6 +16,7 @@ func TestParseRawOn(t *testing.T) { kases := []struct { input string result []*Event + err string }{ { input: "on: issue_comment", @@ -33,7 +34,10 @@ func TestParseRawOn(t *testing.T) { }, }, }, - + { + input: "on: [123]", + err: "value at index 0 was unexpected type int; must be a string but was 123", + }, { input: "on:\n - push\n - pull_request", result: []*Event{ @@ -45,6 +49,19 @@ func TestParseRawOn(t *testing.T) { }, }, }, + { + input: "on: { push: null }", + result: []*Event{ + { + Name: "push", + acts: map[string][]string{}, + }, + }, + }, + { + input: "on: { push: 'abc' }", + err: "key \"push\" had unexpected type string; expected a map or array but was \"abc\"", + }, { input: "on:\n push:\n branches:\n - master", result: []*Event{ @@ -72,6 +89,10 @@ func TestParseRawOn(t *testing.T) { }, }, }, + { + input: "on:\n branch_protection_rule:\n types: [123, deleted]", + err: "key \"branch_protection_rule\".\"types\" index 0 had unexpected type int; a string was expected but was 123", + }, { input: "on:\n project:\n types: [created, deleted]\n milestone:\n types: [opened, deleted]", result: []*Event{ @@ -189,6 +210,22 @@ func TestParseRawOn(t *testing.T) { }, }, }, + { + input: "on:\n schedule2:\n - cron: '20 6 * * *'", + err: "key \"schedule2\" had an type []interface {}; only the 'schedule' key is expected with this type", + }, + { + input: "on:\n schedule:\n - 123", + err: "key \"schedule\"[0] had unexpected type int; a map with a key \"cron\" was expected, but value was 123", + }, + { + input: "on:\n schedule:\n - corn: '20 6 * * *'", + err: "key \"schedule\"[0] had unexpected key \"corn\"; \"cron\" was expected", + }, + { + input: "on:\n schedule:\n - cron: 123", + err: "key \"schedule\"[0].\"cron\" had unexpected type int; a string was expected by was 123", + }, { input: ` on: @@ -222,15 +259,37 @@ on: }, }, }, + { + input: ` +on: + workflow_call: + mistake: + access-token: + description: 'A token passed from the caller workflow' + required: false +`, + err: "invalid value on key \"workflow_call\": workflow_call only supports keys \"inputs\" and \"outputs\", but key \"mistake\" was found", + }, + { + input: ` +on: + workflow_call: { map: 123 } +`, + err: "key \"workflow_call\".\"map\" had unexpected type int; was 123", + }, } for _, kase := range kases { t.Run(kase.input, func(t *testing.T) { origin, err := model.ReadWorkflow(strings.NewReader(kase.input), false) - assert.NoError(t, err) + require.NoError(t, err) events, err := ParseRawOn(&origin.RawOn) - assert.NoError(t, err) - assert.EqualValues(t, kase.result, events, fmt.Sprintf("%#v", events)) + if kase.err != "" { + assert.ErrorContains(t, err, kase.err) + } else { + assert.NoError(t, err) + assert.EqualValues(t, kase.result, events, fmt.Sprintf("%#v", events)) + } }) } } From b17b1f00b318535684897c5c9e49a2e10252b572 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 8 Oct 2025 09:42:15 +0000 Subject: [PATCH 252/281] Update dependency go to v1.24.8 (#1069) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.24.7` -> `1.24.8` | --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1069 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 4e85c9b6..c10be44a 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.forgejo.org/forgejo/runner/v11 go 1.24.0 -toolchain go1.24.7 +toolchain go1.24.8 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 From bda2295f7176879a1849e0d1e2d00b86d3e15f25 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 9 Oct 2025 08:55:16 +0000 Subject: [PATCH 253/281] Update module github.com/docker/cli to v28.5.1+incompatible (#1072) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v28.5.0+incompatible` -> `v28.5.1+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fcli/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fcli/v28.5.0+incompatible/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/cli (github.com/docker/cli) ### [`v28.5.1+incompatible`](https://github.com/docker/cli/compare/v28.5.0...v28.5.1) [Compare Source](https://github.com/docker/cli/compare/v28.5.0...v28.5.1)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1072 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c10be44a..8da4b204 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 - github.com/docker/cli v28.5.0+incompatible + github.com/docker/cli v28.5.1+incompatible github.com/docker/docker v28.4.0+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 diff --git a/go.sum b/go.sum index 0cc56d8b..3f4fb106 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/cli v28.5.0+incompatible h1:crVqLrtKsrhC9c00ythRx435H8LiQnUKRtJLRR+Auxk= -github.com/docker/cli v28.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v28.5.1+incompatible h1:ESutzBALAD6qyCLqbQSEf1a/U8Ybms5agw59yGVc+yY= +github.com/docker/cli v28.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk= github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= From 44b8b91540266b9208c047eba014a7b9c8629a44 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 10 Oct 2025 13:39:56 +0000 Subject: [PATCH 254/281] Update module connectrpc.com/connect to v1.19.1 (#1078) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.18.1` -> `v1.19.1` | [![age](https://developer.mend.io/api/mc/badges/age/go/connectrpc.com%2fconnect/v1.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/connectrpc.com%2fconnect/v1.18.1/v1.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
connectrpc/connect-go (connectrpc.com/connect) ### [`v1.19.1`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.1) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.0...v1.19.1) #### What's Changed ##### Bugfixes - Fix bounds check on envelope for 32-bit archs by [@​emcfarlane](https://github.com/emcfarlane) in [#​887](https://github.com/connectrpc/connect-go/issues/887) - Fix CallInfo header/trailer propagation on error responses by [@​emcfarlane](https://github.com/emcfarlane) in [#​892](https://github.com/connectrpc/connect-go/issues/892) **Full Changelog**: ### [`v1.19.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.18.1...v1.19.0) This release introduces the highly requested "simple" flag for code generation, making Connect significantly more ergonomic for everyday RPC development. The new simple flag in protoc-gen-connect-go generates cleaner, more intuitive client and handler interfaces that eliminate request/response wrappers for most use cases. This addresses community feedback about verbosity and provides a more straightforward API. When enabled, metadata (headers/trailers) can be passed through context instead of explicit wrapper objects, optimizing for the common case where developers don't need direct access to HTTP headers. #### What's Changed ##### Enhancements - Add simple flag for more ergonomic generated code by [@​bufdev](https://github.com/bufdev) and [@​smaye81](https://github.com/smaye81) in [#​851](https://github.com/connectrpc/connect-go/pull/851) - Update Go to v1.24 and document http.Protocol use removing the dependency on `golang.org/x/net/http2` by [@​maxbrunet](https://github.com/maxbrunet) in [#​873](https://github.com/connectrpc/connect-go/pull/873), [#​877](https://github.com/connectrpc/connect-go/pull/877) - Add support for Edition 2024 by [@​emcfarlane](https://github.com/emcfarlane) in [#​878](https://github.com/connectrpc/connect-go/pull/878) ##### Bugfixes - Include valid spec and headers when calling recover handler for streaming RPCs by [@​jhump](https://github.com/jhump) in [#​817](https://github.com/connectrpc/connect-go/pull/817) ##### Other changes - Go version support updated to latest two instead of three by [@​jhump](https://github.com/jhump) in [#​837](https://github.com/connectrpc/connect-go/pull/837) - CI testing improvements by [@​pkwarren](https://github.com/pkwarren) and [@​jhump](https://github.com/jhump) in [#​838](https://github.com/connectrpc/connect-go/pull/838), [#​839](https://github.com/connectrpc/connect-go/pull/839) - Code quality improvements by [@​mattrobenolt](https://github.com/mattrobenolt) and [@​bufdev](https://github.com/bufdev) in [#​841](https://github.com/connectrpc/connect-go/pull/841), [#​867](https://github.com/connectrpc/connect-go/pull/867) - Documentation improvements by [@​adlion](https://github.com/adlion) and [@​stefanvanburen](https://github.com/stefanvanburen) in [#​821](https://github.com/connectrpc/connect-go/pull/821), [#​880](https://github.com/connectrpc/connect-go/pull/880) #### New Contributors - [@​adlion](https://github.com/adlion) made their first contribution in [#​821](https://github.com/connectrpc/connect-go/pull/821) - [@​maxbrunet](https://github.com/maxbrunet) made their first contribution in [#​873](https://github.com/connectrpc/connect-go/pull/873) - [@​stefanvanburen](https://github.com/stefanvanburen) made their first contribution in [#​880](https://github.com/connectrpc/connect-go/pull/880) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1078 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 8da4b204..0f88eac9 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.8 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 - connectrpc.com/connect v1.18.1 + connectrpc.com/connect v1.19.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 diff --git a/go.sum b/go.sum index 3f4fb106..3ac63d38 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= -connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= -connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= +connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14= +connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= From 66a7e82c43ef0831297b5d2145cc03499e152208 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 10 Oct 2025 14:33:07 +0000 Subject: [PATCH 255/281] feat: allow --memory in workflow container options (#1079) First hand experience to implement this feature can be found at https://codeberg.org/forgejo/forgejo/issues/9406. In a nutshell it is a service container in the CI that randomly uses massive amounts of memory (>50GB RSS) but normally less than 100MB. --- See also the [matching documentation pull request](https://codeberg.org/forgejo/docs/pulls/1539). --- It is already possible to limit the memory used by all containers in the config file: ```yaml container: options: --memory 200M ``` This limit can be further reduced (but not increased) by the same option in a job: ```yaml jobs: job: runs-on: docker container: image: code.forgejo.org/oci/node:20-bookworm options: --memory 200M steps: - run: echo OK ``` or a service container: ```yaml job: my-job: runs-on: docker services: pgsql: image: postgres:15 options: --memory 1G ``` Refs https://docs.docker.com/engine/containers/resource_constraints/#limit-a-containers-access-to-memory - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1079): feat: allow --memory in workflow container options Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1079 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/docker_run.go | 8 ++ internal/app/run/runner_test.go | 166 ++++++++++++++++++++++++++++++++ 2 files changed, 174 insertions(+) diff --git a/act/container/docker_run.go b/act/container/docker_run.go index b1247528..cf15887c 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -483,6 +483,14 @@ func (cr *containerReference) mergeJobOptions(ctx context.Context, config *conta } } + if jobConfig.HostConfig.Memory > 0 { + logger.Debugf("--memory %v", jobConfig.HostConfig.Memory) + if hostConfig.Memory > 0 && jobConfig.HostConfig.Memory > hostConfig.Memory { + return nil, nil, fmt.Errorf("the --memory %v option found in the workflow cannot be greater than the --memory %v option from the runner configuration file", jobConfig.HostConfig.Memory, hostConfig.Memory) + } + hostConfig.Memory = jobConfig.HostConfig.Memory + } + if len(jobConfig.Config.Hostname) > 0 { logger.Debugf("--hostname %v", jobConfig.Config.Hostname) config.Hostname = jobConfig.Config.Hostname diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 5de1b58c..c46fefb4 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -71,6 +71,7 @@ func TestLabelUpdate(t *testing.T) { type forgejoClientMock struct { mock.Mock + sent string } func (m *forgejoClientMock) Address() string { @@ -123,11 +124,20 @@ func (m *forgejoClientMock) UpdateTask(ctx context.Context, request *connect.Req return args.Get(0).(*connect.Response[runnerv1.UpdateTaskResponse]), args.Error(1) } +func rowsToString(rows []*runnerv1.LogRow) string { + s := "" + for _, row := range rows { + s += row.Content + "\n" + } + return s +} + func (m *forgejoClientMock) UpdateLog(ctx context.Context, request *connect.Request[runnerv1.UpdateLogRequest]) (*connect.Response[runnerv1.UpdateLogResponse], error) { // Enable for log output from runs if needed. // for _, row := range request.Msg.Rows { // println(fmt.Sprintf("UpdateLog: %q", row.Content)) // } + m.sent += rowsToString(request.Msg.Rows) args := m.Called(ctx, request) mockRetval := args.Get(0) mockError := args.Error(1) @@ -589,3 +599,159 @@ jobs: runWorkflow(ctx, cancel, workflow, "push", "refs/heads/main", "OK") }) } + +func TestRunnerResources(t *testing.T) { + if testing.Short() { + t.Skip("skipping integration test") + } + + forgejoClient := &forgejoClientMock{} + + forgejoClient.On("Address").Return("https://127.0.0.1:8080") // not expected to be used in this test + forgejoClient.On("UpdateLog", mock.Anything, mock.Anything).Return(nil, nil) + forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). + Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + + workdirParent := t.TempDir() + + runWorkflow := func(ctx context.Context, cancel context.CancelFunc, yamlContent, options, errorMessage, logMessage string) { + task := &runnerv1.Task{ + WorkflowPayload: []byte(yamlContent), + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "token": structpb.NewStringValue("some token here"), + "forgejo_default_actions_url": structpb.NewStringValue("https://data.forgejo.org"), + "repository": structpb.NewStringValue("runner"), + "event_name": structpb.NewStringValue("push"), + "ref": structpb.NewStringValue("refs/heads/main"), + }, + }, + } + + runner := NewRunner( + &config.Config{ + Log: config.Log{ + JobLevel: "trace", + }, + Host: config.Host{ + WorkdirParent: workdirParent, + }, + Container: config.Container{ + Options: options, + }, + }, + &config.Registration{ + Labels: []string{"docker:docker://code.forgejo.org/oci/node:20-bookworm"}, + }, + forgejoClient) + require.NotNil(t, runner) + + reporter := report.NewReporter(ctx, cancel, forgejoClient, task, time.Second) + err := runner.run(ctx, task, reporter) + reporter.Close(nil) + if len(errorMessage) > 0 { + require.Error(t, err) + assert.ErrorContains(t, err, errorMessage) + } else { + require.NoError(t, err) + } + if len(logMessage) > 0 { + assert.Contains(t, forgejoClient.sent, logMessage) + } + } + + t.Run("config.yaml --memory set and enforced", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + steps: + - run: | + # more than 300MB + perl -e '$a = "a" x (300 * 1024 * 1024)' +` + runWorkflow(ctx, cancel, workflow, "--memory 200M", "Job 'job' failed", "Killed") + }) + + t.Run("config.yaml --memory set and within limits", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + steps: + - run: echo OK +` + runWorkflow(ctx, cancel, workflow, "--memory 200M", "", "") + }) + + t.Run("config.yaml --memory set and container fails to increase it", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + container: + image: code.forgejo.org/oci/node:20-bookworm + options: --memory 4G + steps: + - run: | + # more than 300MB + perl -e '$a = "a" x (300 * 1024 * 1024)' +` + runWorkflow(ctx, cancel, workflow, "--memory 200M", "option found in the workflow cannot be greater than", "") + }) + + t.Run("container --memory set and enforced", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + container: + image: code.forgejo.org/oci/node:20-bookworm + options: --memory 200M + steps: + - run: | + # more than 300MB + perl -e '$a = "a" x (300 * 1024 * 1024)' +` + runWorkflow(ctx, cancel, workflow, "", "Job 'job' failed", "Killed") + }) + + t.Run("container --memory set and within limits", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + container: + image: code.forgejo.org/oci/node:20-bookworm + options: --memory 200M + steps: + - run: echo OK +` + runWorkflow(ctx, cancel, workflow, "", "", "") + }) +} From 02247b852aab7bc47027bbfbabe66cc36c81b78f Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 10 Oct 2025 21:55:08 +0000 Subject: [PATCH 256/281] fix: allow mapping into env variable INPUT_N from ${{ inputs.n }} (#1080) When using a reusable workflow such as: ```yaml name: "use-inputs-impl" on: workflow_call: inputs: image: description: "Image to be used in job" type: string required: false default: "docker.io/alpine:3.22" condition: description: "Only run a job if this is true" type: string required: false default: false jobs: works: runs-on: docker container: image: alpine:3.22 env: INPUT_IMAGE: ${{ inputs.image }} INPUT_CONDITION: ${{ inputs.condition }} steps: - run: echo "Hello world from Alpine" - run: cat /etc/alpine-release - run: echo "INPUT_IMAGE=$INPUT_IMAGE" - run: echo "INPUT_CONDITION=$INPUT_CONDITION" ``` The runner will currently output un-evaluated expressions: ``` INPUT_IMAGE=${{ inputs.image }} INPUT_CONDITION=${{ inputs.condition }} ``` Internally, the workflow is using `INPUT_...` environment variables to transfer data into local reusable workflows, and the order of evaluation in `getEvaluatorInputs` was preferring to use the un-evaluated value, over the evaluated value. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1080): fix: allow mapping into env variable INPUT_N from ${{ inputs.n }} Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1080 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/expression.go | 4 ++-- act/runner/runner_test.go | 1 + .../workflows/local-reusable-env-input.yml | 21 +++++++++++++++++++ .../testdata/uses-workflow-env-input/push.yml | 8 +++++++ 4 files changed, 32 insertions(+), 2 deletions(-) create mode 100644 act/runner/testdata/.github/workflows/local-reusable-env-input.yml create mode 100644 act/runner/testdata/uses-workflow-env-input/push.yml diff --git a/act/runner/expression.go b/act/runner/expression.go index e17af233..152a2f8e 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -479,8 +479,6 @@ func rewriteSubExpression(ctx context.Context, in string, forceFormat bool) (str func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *model.GithubContext) map[string]any { inputs := map[string]any{} - setupWorkflowInputs(ctx, &inputs, rc) - var env map[string]string if step != nil { env = *step.getEnv() @@ -494,6 +492,8 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod } } + setupWorkflowInputs(ctx, &inputs, rc) + if rc.caller == nil && ghc.EventName == "workflow_dispatch" { config := rc.Run.Workflow.WorkflowDispatchConfig() if config != nil && config.Inputs != nil { diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 0d29eca8..f8b3918c 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -263,6 +263,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}}, {workdir, "uses-docker-url", "push", "", platforms, secrets}, {workdir, "act-composite-env-test", "push", "", platforms, secrets}, + {workdir, "uses-workflow-env-input", "push", "", platforms, secrets}, // Eval {workdir, "evalmatrix", "push", "", platforms, secrets}, diff --git a/act/runner/testdata/.github/workflows/local-reusable-env-input.yml b/act/runner/testdata/.github/workflows/local-reusable-env-input.yml new file mode 100644 index 00000000..eb1d9092 --- /dev/null +++ b/act/runner/testdata/.github/workflows/local-reusable-env-input.yml @@ -0,0 +1,21 @@ +name: "use-inputs-impl" + +on: + workflow_call: + inputs: + greet_target: + type: string + required: false + default: "Some Default Value" + +jobs: + works: + runs-on: ubuntu-latest + env: + MY_INPUT_TEST: ${{ inputs.greet_target }} + INPUT_TEST: ${{ inputs.greet_target }} + INPUT_GREET_TARGET: ${{ inputs.greet_target }} + steps: + - run: '[ "$MY_INPUT_TEST" = "Mona the Octocat" ] || exit 1' + - run: '[ "$INPUT_TEST" = "Mona the Octocat" ] || exit 1' + - run: '[ "$INPUT_GREET_TARGET" = "Mona the Octocat" ] || exit 1' diff --git a/act/runner/testdata/uses-workflow-env-input/push.yml b/act/runner/testdata/uses-workflow-env-input/push.yml new file mode 100644 index 00000000..d702c4bb --- /dev/null +++ b/act/runner/testdata/uses-workflow-env-input/push.yml @@ -0,0 +1,8 @@ +name: local-action-env-input +on: push +jobs: + test: + runs-on: docker + uses: ./testdata/.github/workflows/local-reusable-env-input.yml + with: + greet_target: 'Mona the Octocat' From 21d451085f7a8651be931a6a8d62870aadbfe1d7 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Oct 2025 09:02:22 +0000 Subject: [PATCH 257/281] Update module code.forgejo.org/forgejo/actions-proto to v0.5.3 (#1082) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [code.forgejo.org/forgejo/actions-proto](https://code.forgejo.org/forgejo/actions-proto) | `v0.5.2` -> `v0.5.3` | [![age](https://developer.mend.io/api/mc/badges/age/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.2/v0.5.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
forgejo/actions-proto (code.forgejo.org/forgejo/actions-proto) ### [`v0.5.3`](https://code.forgejo.org/forgejo/actions-proto/compare/v0.5.2...v0.5.3) [Compare Source](https://code.forgejo.org/forgejo/actions-proto/compare/v0.5.2...v0.5.3)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1082 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 0f88eac9..0a87ec30 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.24.0 toolchain go1.24.8 require ( - code.forgejo.org/forgejo/actions-proto v0.5.2 + code.forgejo.org/forgejo/actions-proto v0.5.3 connectrpc.com/connect v1.19.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 diff --git a/go.sum b/go.sum index 3ac63d38..da01e521 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= -code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= +code.forgejo.org/forgejo/actions-proto v0.5.3 h1:dDProRNB4CDvEl9gfo8jkiVfGdiW7fXAt5TM9Irka28= +code.forgejo.org/forgejo/actions-proto v0.5.3/go.mod h1:33iTdur/jVa/wAQP+BuciRTK9WZcVaxy0BNEnSWWFDM= connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14= connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= From c80a40023c53628396f782a35fcbc8f1a939d314 Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Sat, 11 Oct 2025 09:23:28 +0000 Subject: [PATCH 258/281] feat: disambiguate cloud emoji (#1076) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Many emoji technically have two forms, the colorful form and the monochrome text form. For some reason, on macOS, ☁️ defaults to the latter, which is also really tiny for some reason?. Adding the invisible emoji variant selector (U+FE0F) causes it to always render as the colorful full-width graphic Before: ![Screenshot 2025-10-08 at 22.53.36](/attachments/beaeea4a-d355-4db6-9cca-2425a62b6ea9) After: ![Screenshot 2025-10-08 at 22.53.14](/attachments/dd670d38-fed6-41dc-a0c2-421846bc26bd) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1076): disambiguate cloud emoji Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1076 Reviewed-by: Michael Kriese Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- act/common/git/git.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/common/git/git.go b/act/common/git/git.go index 2d3f1249..2c47b5d2 100644 --- a/act/common/git/git.go +++ b/act/common/git/git.go @@ -305,7 +305,7 @@ func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.Pu func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor { return func(ctx context.Context) error { logger := common.Logger(ctx) - logger.Infof(" \u2601 git clone '%s' # ref=%s", input.URL, input.Ref) + logger.Infof(" \u2601\ufe0f git clone '%s' # ref=%s", input.URL, input.Ref) logger.Debugf(" cloning %s to %s", input.URL, input.Dir) cloneLock.Lock() From 08723cf6238dac006c54c352e39496b7a0feb947 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 12 Oct 2025 01:47:52 +0000 Subject: [PATCH 259/281] Update module github.com/rhysd/actionlint to v1.7.8 (#1084) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.7.7` -> `v1.7.8` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2frhysd%2factionlint/v1.7.8?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2frhysd%2factionlint/v1.7.7/v1.7.8?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
rhysd/actionlint (github.com/rhysd/actionlint) ### [`v1.7.8`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v178---2025-10-11) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.7...v1.7.8) - Support `models` permission in `permissions` section. ([#​531](https://github.com/rhysd/actionlint/issues/531), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Support `job.check_run_id` property. ([#​576](https://github.com/rhysd/actionlint/issues/576), thanks [@​muzimuzhi](https://github.com/muzimuzhi) for fixing the type at [#​577](https://github.com/rhysd/actionlint/issues/577)) - Support `node24` runtime at `using` section in action metadata. ([#​561](https://github.com/rhysd/actionlint/issues/561), thanks [@​salmanmkc](https://github.com/salmanmkc)) - Add support for the following runner labels - [`macos-26` and `macos-26-large`](https://github.blog/changelog/2025-09-11-actions-macos-26-image-now-in-public-preview/) ([#​572](https://github.com/rhysd/actionlint/issues/572), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - [`macos-15`](https://github.blog/changelog/2025-09-19-github-actions-macos-13-runner-image-is-closing-down/#what-you-need-to-do) ([#​572](https://github.com/rhysd/actionlint/issues/572), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Drop support for the following runner labels. - [`ubuntu-20.04`](https://github.com/actions/runner-images/issues/11101) ([#​534](https://github.com/rhysd/actionlint/issues/534), thanks [@​shogo82148](https://github.com/shogo82148)) - [`windows-2019`](https://github.blog/changelog/2025-04-15-upcoming-breaking-changes-and-releases-for-github-actions/#windows-server-2019-is-closing-down) ([#​572](https://github.com/rhysd/actionlint/issues/572), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Support [`deprecationMessage`](https://docs.github.com/en/actions/reference/workflows-and-actions/metadata-syntax#inputsinput_iddeprecationmessage) in action inputs. ([#​540](https://github.com/rhysd/actionlint/issues/540), thanks [@​saansh45](https://github.com/saansh45)) - Support [`windows-11-arm` runner](https://github.blog/changelog/2025-04-14-windows-arm64-hosted-runners-now-available-in-public-preview/). ([#​542](https://github.com/rhysd/actionlint/issues/542), thanks [@​trim21](https://github.com/trim21)) - Handle `ubuntu-latest` runner label as `ubuntu-24.04` and `macos-latest` runner label as `macos-15`. - Report mixing Intel Mac labels and Arm Mac labels as error. - Add new types to `issues` and `pull_request_target` webhooks. - Update the popular actions data set to the latest and add more actions to it (thanks [@​sethvargo](https://github.com/sethvargo) for fixing the `go generate` scripts) - `actions/create-github-app-token` - `actions/attest-sbom` - `actions/ai-inference` - `peter-evans/create-or-update-comment` - `release-drafter/release-drafter` - `SamKirkland/FTP-Deploy-Action` - Fix the version value in `actionlint -version` can be empty. - Fix outdated URL links in some error messages and documents. - [Homebrew formula in this repository](https://github.com/rhysd/actionlint/blob/main/HomebrewFormula/actionlint.rb) is deprecated and [Homebrew cask](https://github.com/rhysd/actionlint/blob/main/Casks/actionlint.rb) is newly added instead because [GoReleaser no longer supports Homebrew formula update](https://goreleaser.com/deprecations/#brews). Note that Homebrew's official `actionlint` formula is still maintained. Please read the [documentation](https://github.com/rhysd/actionlint/blob/main/docs/install.md#homebrew) for more details. - Drop support for Go 1.23 and earlier because they are no longer maintained officially. Go 1.24 and later are supported to build actionlint. - Replace [`go-yaml/yaml@v3`](https://github.com/go-yaml/yaml) package with [`yaml/go-yaml@v4`](https://github.com/yaml/go-yaml) package. `go-yaml/yaml` was used for parsing workflow files however it was unmaintained. `yaml/go-yaml` is a successor of the library officially maintained by YAML organization. ([#​575](https://github.com/rhysd/actionlint/issues/575)) - Improve error messages on parsing workflow and action metadata files. \[Changes]\[v1.7.8]
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1084 Reviewed-by: Mathieu Fenniak Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 9 +++++---- go.sum | 18 ++++++++++-------- 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 0a87ec30..89f68e37 100644 --- a/go.mod +++ b/go.mod @@ -29,7 +29,7 @@ require ( github.com/moby/patternmatcher v0.6.0 github.com/opencontainers/image-spec v1.1.1 github.com/opencontainers/selinux v1.12.0 - github.com/rhysd/actionlint v1.7.7 + github.com/rhysd/actionlint v1.7.8 github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.10.1 github.com/spf13/pflag v1.0.10 @@ -47,7 +47,7 @@ require ( github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect - github.com/bmatcuk/doublestar/v4 v4.8.0 // indirect + github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect github.com/cloudflare/circl v1.6.1 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect github.com/containerd/log v0.1.0 // indirect @@ -69,7 +69,7 @@ require ( github.com/kevinburke/ssh_config v1.2.0 // indirect github.com/klauspost/compress v1.18.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-runewidth v0.0.16 // indirect + github.com/mattn/go-runewidth v0.0.17 // indirect github.com/mattn/go-shellwords v1.0.12 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/moby/sys/atomicwriter v0.1.0 // indirect @@ -98,9 +98,10 @@ require ( go.opentelemetry.io/otel/metric v1.36.0 // indirect go.opentelemetry.io/otel/sdk v1.21.0 // indirect go.opentelemetry.io/otel/trace v1.36.0 // indirect + go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.39.0 // indirect - golang.org/x/sync v0.12.0 // indirect + golang.org/x/sync v0.17.0 // indirect golang.org/x/sys v0.36.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect diff --git a/go.sum b/go.sum index da01e521..98899777 100644 --- a/go.sum +++ b/go.sum @@ -21,8 +21,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk= github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA= -github.com/bmatcuk/doublestar/v4 v4.8.0 h1:DSXtrypQddoug1459viM9X9D3dp1Z7993fw36I2kNcQ= -github.com/bmatcuk/doublestar/v4 v4.8.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= +github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE= +github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM= github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0= @@ -115,8 +115,8 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= -github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= -github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mattn/go-runewidth v0.0.17 h1:78v8ZlW0bP43XfmAfPsdXcoNCelfMHsDmd/pkENfrjQ= +github.com/mattn/go-runewidth v0.0.17/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk= github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= @@ -151,8 +151,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/rhysd/actionlint v1.7.7 h1:0KgkoNTrYY7vmOCs9BW2AHxLvvpoY9nEUzgBHiPUr0k= -github.com/rhysd/actionlint v1.7.7/go.mod h1:AE6I6vJEkNaIfWqC2GNE5spIJNhxf8NCtLEKU4NnUXg= +github.com/rhysd/actionlint v1.7.8 h1:3d+N9ourgAxVYG4z2IFxFIk/YiT6V+VnKASfXGwT60E= +github.com/rhysd/actionlint v1.7.8/go.mod h1:3kiS6egcbXG+vQsJIhFxTz+UKaF1JprsE0SKrpCZKvU= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= @@ -222,6 +222,8 @@ go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lI go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s= +go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= @@ -230,8 +232,8 @@ golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbR golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY= golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E= -golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= -golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= +golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= From e25d6b3c911d64c78791385a9410d00b10596ebc Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 12 Oct 2025 06:53:05 +0000 Subject: [PATCH 260/281] Update module github.com/docker/docker to v28.5.1+incompatible (#1085) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | `v28.4.0+incompatible` -> `v28.5.1+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fdocker/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fdocker/v28.4.0+incompatible/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/docker (github.com/docker/docker) ### [`v28.5.1+incompatible`](https://github.com/docker/docker/compare/v28.5.0...v28.5.1) [Compare Source](https://github.com/docker/docker/compare/v28.5.0...v28.5.1) ### [`v28.5.0+incompatible`](https://github.com/docker/docker/compare/v28.4.0...v28.5.0) [Compare Source](https://github.com/docker/docker/compare/v28.4.0...v28.5.0)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1085 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 89f68e37..71005dc0 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 github.com/docker/cli v28.5.1+incompatible - github.com/docker/docker v28.4.0+incompatible + github.com/docker/docker v28.5.1+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 github.com/go-git/go-git/v5 v5.16.3 diff --git a/go.sum b/go.sum index 98899777..ee15c6c1 100644 --- a/go.sum +++ b/go.sum @@ -45,8 +45,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/docker/cli v28.5.1+incompatible h1:ESutzBALAD6qyCLqbQSEf1a/U8Ybms5agw59yGVc+yY= github.com/docker/cli v28.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk= -github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v28.5.1+incompatible h1:Bm8DchhSD2J6PsFzxC35TZo4TLGR2PdW/E69rU45NhM= +github.com/docker/docker v28.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40= github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94= From 2d359067f617b9f8af389dc79eecea10200428bd Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Sun, 12 Oct 2025 08:53:45 +0000 Subject: [PATCH 261/281] fix: don't prepend server URL with https:// if it's an empty string (#1083) An attempt to address #1074 in a way that makes everyone happy Right now, any server URL that doesnt start with `http://` or `https://` automatically gets `https://` prepended to it. When no instance is set while running `forgejo-runner exec` this results in the `{FORGEJO,GITHUB}_SERVER_URL` environment variables being set to simply "https://". Any action using the GitHub actions toolkit chokes on this as an invalid URL and fails the run with a nondescript error. This PR instead leaves empty strings alone, which the actions toolkit seems much happier with Alternate fixes: * default the `--forgejo-instance` flag to a valid but unresolved url like 'http://example.com' so the actions don't crash * don't set the environment variables at all when the server URL is an empty string. This causes the actions toolkit to assume GitHub.com as a fallback - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1083): fix: don't prepend server URL with https:// if it's an empty string Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1083 Reviewed-by: earl-warren Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- act/runner/run_context.go | 14 ++------------ act/runner/run_context_test.go | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 12 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index ff551322..9e4c2981 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -1208,7 +1208,7 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext ghc.RetentionDays = preset.RetentionDays instance := rc.Config.GitHubInstance - if !strings.HasPrefix(instance, "http://") && + if instance != "" && !strings.HasPrefix(instance, "http://") && !strings.HasPrefix(instance, "https://") { instance = "https://" + instance } @@ -1251,7 +1251,7 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext { // Adapt to Gitea instance := rc.Config.GitHubInstance - if !strings.HasPrefix(instance, "http://") && + if instance != "" && !strings.HasPrefix(instance, "http://") && !strings.HasPrefix(instance, "https://") { instance = "https://" + instance } @@ -1353,16 +1353,6 @@ func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubCon set("SERVER_URL", github.ServerURL) set("API_URL", github.APIURL) - { // Adapt to Forgejo - instance := rc.Config.GitHubInstance - if !strings.HasPrefix(instance, "http://") && - !strings.HasPrefix(instance, "https://") { - instance = "https://" + instance - } - set("SERVER_URL", instance) - set("API_URL", instance+"/api/v1") - } - if rc.Config.ArtifactServerPath != "" { setActionRuntimeVars(rc, env) } diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 110afb45..4e11ba62 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -280,6 +280,39 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { }) } +func TestRunContext_GetGithubContextURL(t *testing.T) { + table := []struct { + instance string + serverURL string + APIURL string + }{ + {instance: "", serverURL: "", APIURL: "/api/v1"}, + {instance: "example.com", serverURL: "https://example.com", APIURL: "https://example.com/api/v1"}, + {instance: "http://example.com", serverURL: "http://example.com", APIURL: "http://example.com/api/v1"}, + {instance: "https://example.com", serverURL: "https://example.com", APIURL: "https://example.com/api/v1"}, + } + for _, data := range table { + t.Run(data.instance, func(t *testing.T) { + rc := &RunContext{ + EventJSON: "{}", + Config: &Config{ + GitHubInstance: data.instance, + }, + Run: &model.Run{ + Workflow: &model.Workflow{ + Name: "GitHubContextTest", + }, + }, + } + + ghc := rc.getGithubContext(t.Context()) + + assert.Equal(t, data.serverURL, ghc.ServerURL) + assert.Equal(t, data.APIURL, ghc.APIURL) + }) + } +} + func TestRunContext_GetGithubContextRef(t *testing.T) { table := []struct { event string From 4d685c129c26d784f27a20f351e30b95c07b1c91 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 13 Oct 2025 15:43:53 +0000 Subject: [PATCH 262/281] Update module golang.org/x/term to v0.36.0 (#1086) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.35.0` -> `v0.36.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.35.0...refs/tags/v0.36.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.36.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.35.0/v0.36.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1086 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 71005dc0..d2977e28 100644 --- a/go.mod +++ b/go.mod @@ -37,7 +37,7 @@ require ( github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 - golang.org/x/term v0.35.0 + golang.org/x/term v0.36.0 golang.org/x/time v0.13.0 google.golang.org/protobuf v1.36.10 gotest.tools/v3 v3.5.2 @@ -102,7 +102,7 @@ require ( golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.39.0 // indirect golang.org/x/sync v0.17.0 // indirect - golang.org/x/sys v0.36.0 // indirect + golang.org/x/sys v0.37.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index ee15c6c1..abcbc98b 100644 --- a/go.sum +++ b/go.sum @@ -244,11 +244,11 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= -golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= +golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ= -golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA= +golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q= +golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= From f48e9b3ba62bdd641b0af687dd25b73531442fb9 Mon Sep 17 00:00:00 2001 From: "Roman K." Date: Tue, 14 Oct 2025 01:45:54 +0000 Subject: [PATCH 263/281] fix: prevent premature token revocation in reusable workflows (#1081) ## Problem When using reusable workflows, the Forgejo runner prematurely revokes `GITHUB_TOKEN` after the first step completes, causing subsequent steps to fail with authentication errors. ### Reproduction When the reusable workflow contains multiple steps that require authentication: 1. First step (e.g., checkout) completes successfully 2. Reporter receives completion banner from child workflow 3. Token is revoked prematurely 4. Second step fails with authentication error - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1081): fix: prevent premature token revocation in reusable workflows Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1081 Reviewed-by: Mathieu Fenniak Co-authored-by: Roman K. Co-committed-by: Roman K. --- act/runner/job_executor.go | 34 ++-- act/runner/job_executor_test.go | 73 ++++++++ act/runner/reusable_workflow.go | 37 +++- act/runner/reusable_workflow_test.go | 247 +++++++++++++++++++++++++++ 4 files changed, 374 insertions(+), 17 deletions(-) create mode 100644 act/runner/reusable_workflow_test.go diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index 7a939930..f1ef21c5 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -180,31 +180,35 @@ func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success boo jobResult = "failure" } + // Set local result on current job (child or parent) info.result(jobResult) + if rc.caller != nil { - // set reusable workflow job result + // Child reusable workflow: + // 1) propagate result to parent job state rc.caller.runContext.result(jobResult) + + // 2) copy workflow_call outputs from child to parent (as in upstream) + jobOutputs := make(map[string]string) + ee := rc.NewExpressionEvaluator(ctx) + if wfcc := rc.Run.Workflow.WorkflowCallConfig(); wfcc != nil { + for k, v := range wfcc.Outputs { + jobOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) + } + } + rc.caller.runContext.Run.Job().Outputs = jobOutputs + + // 3) DO NOT print banner in child job (prevents premature token revocation) + logger.Debugf("Reusable job result=%s (parent will finalize, no banner)", jobResult) + return } + // Parent job: print the final banner ONCE (job-level) jobResultMessage := "succeeded" if jobResult != "success" { jobResultMessage = "failed" } - jobOutputs := rc.Run.Job().Outputs - if rc.caller != nil { - // Rewrite the job's outputs into the workflow_call outputs... - jobOutputs = make(map[string]string) - ee := rc.NewExpressionEvaluator(ctx) - for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs { - jobOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) - } - // When running as a daemon and receiving jobs from Forgejo, the next job (and any of it's `needs` outputs) will - // be provided by Forgejo based upon the data sent to the logger below. However, when running `forgejo-runner - // exec` with a reusable workflow, the next job will only be able to read outputs if those outputs are stored on - // the workflow -- that's what is accomplished here: - rc.caller.runContext.Run.Job().Outputs = jobOutputs - } logger. WithFields(logrus.Fields{ diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index fe40df0f..96ace803 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -444,3 +444,76 @@ func TestSetJobResultConcurrency(t *testing.T) { assert.Equal(t, "failure", lastResult) } + +func TestSetJobResult_SkipsBannerInChildReusableWorkflow(t *testing.T) { + // Test that child reusable workflow does not print final banner + // to prevent premature token revocation + + mockLogger := mocks.NewFieldLogger(t) + // Allow all variants of Debugf (git operations can call with 1-3 args) + mockLogger.On("Debugf", mock.Anything).Return(0).Maybe() + mockLogger.On("Debugf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("Debugf", mock.Anything, mock.Anything, mock.Anything).Return(0).Maybe() + // CRITICAL: In CI, git ref detection may fail and call Warningf + mockLogger.On("Warningf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("WithField", mock.Anything, mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + mockLogger.On("WithFields", mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + + ctx := common.WithLogger(common.WithJobErrorContainer(t.Context()), mockLogger) + + // Setup parent job + parentJob := &model.Job{ + Result: "success", + } + parentRC := &RunContext{ + Config: &Config{Env: map[string]string{}}, // Must have Config + Run: &model.Run{ + JobID: "parent", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "parent": parentJob, + }, + }, + }, + } + + // Setup child job with caller reference + childJob := &model.Job{ + Result: "success", + } + childRC := &RunContext{ + Config: &Config{Env: map[string]string{}}, // Must have Config + Run: &model.Run{ + JobID: "child", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "child": childJob, + }, + }, + }, + caller: &caller{ + runContext: parentRC, + }, + } + + jim := &jobInfoMock{} + jim.On("matrix").Return(map[string]any{}) // REQUIRED: setJobResult always calls matrix() + jim.On("result", "success") + + // Call setJobResult for child workflow + setJobResult(ctx, jim, childRC, true) + + // Verify: + // 1. Child result is set + jim.AssertCalled(t, "result", "success") + + // 2. Parent result is propagated + assert.Equal(t, "success", parentJob.Result) + + // 3. Final banner was NOT printed by child (critical for token security) + mockLogger.AssertNotCalled(t, "WithFields", mock.MatchedBy(func(fields logrus.Fields) bool { + _, okJobResult := fields["jobResult"] + _, okJobOutput := fields["jobOutputs"] + return okJobOutput && okJobResult + })) +} diff --git a/act/runner/reusable_workflow.go b/act/runner/reusable_workflow.go index 5e92ee88..c117c4a7 100644 --- a/act/runner/reusable_workflow.go +++ b/act/runner/reusable_workflow.go @@ -16,6 +16,7 @@ import ( "code.forgejo.org/forgejo/runner/v11/act/common" "code.forgejo.org/forgejo/runner/v11/act/common/git" "code.forgejo.org/forgejo/runner/v11/act/model" + "github.com/sirupsen/logrus" ) func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor { @@ -115,7 +116,10 @@ func newActionCacheReusableWorkflowExecutor(rc *RunContext, filename string, rem return err } - return runner.NewPlanExecutor(plan)(ctx) + planErr := runner.NewPlanExecutor(plan)(ctx) + + // Finalize from parent context: one job-level banner + return finalizeReusableWorkflow(ctx, rc, planErr) } } @@ -171,7 +175,10 @@ func newReusableWorkflowExecutor(rc *RunContext, directory, workflow string) com return err } - return runner.NewPlanExecutor(plan)(ctx) + planErr := runner.NewPlanExecutor(plan)(ctx) + + // Finalize from parent context: one job-level banner + return finalizeReusableWorkflow(ctx, rc, planErr) } } @@ -229,3 +236,29 @@ func newRemoteReusableWorkflowWithPlat(url, uses string) *remoteReusableWorkflow URL: url, } } + +// finalizeReusableWorkflow prints the final job banner from the parent job context. +// +// The Forgejo reporter waits for this banner (log entry with "jobResult" +// field and without stage="Main") before marking the job as complete and revoking +// tokens. Printing this banner from the child reusable workflow would cause +// premature token revocation, breaking subsequent steps in the parent workflow. +func finalizeReusableWorkflow(ctx context.Context, rc *RunContext, planErr error) error { + jobResult := "success" + jobResultMessage := "succeeded" + if planErr != nil { + jobResult = "failure" + jobResultMessage = "failed" + } + + // Outputs should already be present in the parent context: + // - copied by child's setJobResult branch (rc.caller != nil) + jobOutputs := rc.Run.Job().Outputs + + common.Logger(ctx).WithFields(logrus.Fields{ + "jobResult": jobResult, + "jobOutputs": jobOutputs, + }).Infof("\U0001F3C1 Job %s", jobResultMessage) + + return planErr +} diff --git a/act/runner/reusable_workflow_test.go b/act/runner/reusable_workflow_test.go new file mode 100644 index 00000000..f4aab893 --- /dev/null +++ b/act/runner/reusable_workflow_test.go @@ -0,0 +1,247 @@ +package runner + +import ( + "errors" + "testing" + + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/act/runner/mocks" + "github.com/sirupsen/logrus" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/mock" +) + +func TestConfig_GetToken(t *testing.T) { + t.Run("returns GITEA_TOKEN when both GITEA_TOKEN and GITHUB_TOKEN present", func(t *testing.T) { + c := &Config{ + Secrets: map[string]string{ + "GITHUB_TOKEN": "github-token", + "GITEA_TOKEN": "gitea-token", + }, + } + assert.Equal(t, "gitea-token", c.GetToken()) + }) + + t.Run("returns GITHUB_TOKEN when only GITHUB_TOKEN present", func(t *testing.T) { + c := &Config{ + Secrets: map[string]string{ + "GITHUB_TOKEN": "github-token", + }, + } + assert.Equal(t, "github-token", c.GetToken()) + }) + + t.Run("returns empty string when no tokens present", func(t *testing.T) { + c := &Config{ + Secrets: map[string]string{}, + } + assert.Equal(t, "", c.GetToken()) + }) + + t.Run("returns empty string when Secrets is nil", func(t *testing.T) { + c := &Config{} + assert.Equal(t, "", c.GetToken()) + }) +} + +func TestRemoteReusableWorkflow_CloneURL(t *testing.T) { + t.Run("adds https prefix when missing", func(t *testing.T) { + rw := &remoteReusableWorkflow{ + URL: "code.forgejo.org", + Org: "owner", + Repo: "repo", + } + assert.Equal(t, "https://code.forgejo.org/owner/repo", rw.CloneURL()) + }) + + t.Run("preserves https prefix", func(t *testing.T) { + rw := &remoteReusableWorkflow{ + URL: "https://code.forgejo.org", + Org: "owner", + Repo: "repo", + } + assert.Equal(t, "https://code.forgejo.org/owner/repo", rw.CloneURL()) + }) + + t.Run("preserves http prefix", func(t *testing.T) { + rw := &remoteReusableWorkflow{ + URL: "http://localhost:3000", + Org: "owner", + Repo: "repo", + } + assert.Equal(t, "http://localhost:3000/owner/repo", rw.CloneURL()) + }) +} + +func TestRemoteReusableWorkflow_FilePath(t *testing.T) { + tests := []struct { + name string + gitPlatform string + filename string + expectedPath string + }{ + { + name: "github platform", + gitPlatform: "github", + filename: "test.yml", + expectedPath: "./.github/workflows/test.yml", + }, + { + name: "gitea platform", + gitPlatform: "gitea", + filename: "build.yaml", + expectedPath: "./.gitea/workflows/build.yaml", + }, + { + name: "forgejo platform", + gitPlatform: "forgejo", + filename: "deploy.yml", + expectedPath: "./.forgejo/workflows/deploy.yml", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + rw := &remoteReusableWorkflow{ + GitPlatform: tt.gitPlatform, + Filename: tt.filename, + } + assert.Equal(t, tt.expectedPath, rw.FilePath()) + }) + } +} + +func TestNewRemoteReusableWorkflowWithPlat(t *testing.T) { + tests := []struct { + name string + url string + uses string + expectedOrg string + expectedRepo string + expectedPlatform string + expectedFilename string + expectedRef string + shouldFail bool + }{ + { + name: "valid github workflow", + url: "github.com", + uses: "owner/repo/.github/workflows/test.yml@main", + expectedOrg: "owner", + expectedRepo: "repo", + expectedPlatform: "github", + expectedFilename: "test.yml", + expectedRef: "main", + shouldFail: false, + }, + { + name: "valid gitea workflow", + url: "code.forgejo.org", + uses: "forgejo/runner/.gitea/workflows/build.yaml@v1.0.0", + expectedOrg: "forgejo", + expectedRepo: "runner", + expectedPlatform: "gitea", + expectedFilename: "build.yaml", + expectedRef: "v1.0.0", + shouldFail: false, + }, + { + name: "invalid format - missing platform", + url: "github.com", + uses: "owner/repo/workflows/test.yml@main", + shouldFail: true, + }, + { + name: "invalid format - no ref", + url: "github.com", + uses: "owner/repo/.github/workflows/test.yml", + shouldFail: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + result := newRemoteReusableWorkflowWithPlat(tt.url, tt.uses) + + if tt.shouldFail { + assert.Nil(t, result) + } else { + assert.NotNil(t, result) + assert.Equal(t, tt.expectedOrg, result.Org) + assert.Equal(t, tt.expectedRepo, result.Repo) + assert.Equal(t, tt.expectedPlatform, result.GitPlatform) + assert.Equal(t, tt.expectedFilename, result.Filename) + assert.Equal(t, tt.expectedRef, result.Ref) + assert.Equal(t, tt.url, result.URL) + } + }) + } +} + +func TestFinalizeReusableWorkflow_PrintsBannerSuccess(t *testing.T) { + mockLogger := mocks.NewFieldLogger(t) + + bannerCalled := false + mockLogger.On("WithFields", + mock.MatchedBy(func(fields logrus.Fields) bool { + result, ok := fields["jobResult"].(string) + if !ok || result != "success" { + return false + } + outs, ok := fields["jobOutputs"].(map[string]string) + return ok && outs["foo"] == "bar" + }), + ).Run(func(args mock.Arguments) { + bannerCalled = true + }).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Once() + + ctx := common.WithLogger(t.Context(), mockLogger) + rc := &RunContext{ + Run: &model.Run{ + JobID: "parent", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "parent": { + Outputs: map[string]string{"foo": "bar"}, + }, + }, + }, + }, + } + + err := finalizeReusableWorkflow(ctx, rc, nil) + assert.NoError(t, err) + assert.True(t, bannerCalled, "final banner should be printed from parent") +} + +func TestFinalizeReusableWorkflow_PrintsBannerFailure(t *testing.T) { + mockLogger := mocks.NewFieldLogger(t) + + bannerCalled := false + mockLogger.On("WithFields", + mock.MatchedBy(func(fields logrus.Fields) bool { + result, ok := fields["jobResult"].(string) + return ok && result == "failure" + }), + ).Run(func(args mock.Arguments) { + bannerCalled = true + }).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Once() + + ctx := common.WithLogger(t.Context(), mockLogger) + rc := &RunContext{ + Run: &model.Run{ + JobID: "parent", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "parent": {}, + }, + }, + }, + } + + planErr := errors.New("workflow failed") + err := finalizeReusableWorkflow(ctx, rc, planErr) + assert.EqualError(t, err, "workflow failed") + assert.True(t, bannerCalled, "banner should be printed even on failure") +} From 05795ee286cf884eba70947b89709b9d1e281c0b Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 14 Oct 2025 08:07:05 +0000 Subject: [PATCH 264/281] Update dependency go to v1.24.9 (#1087) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.24.8` -> `1.24.9` | --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1087 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index d2977e28..2e114e84 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.forgejo.org/forgejo/runner/v11 go 1.24.0 -toolchain go1.24.8 +toolchain go1.24.9 require ( code.forgejo.org/forgejo/actions-proto v0.5.3 From 2de7e57e0834b56281c61a67f1a1b8b792c976de Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Tue, 14 Oct 2025 08:08:03 +0000 Subject: [PATCH 265/281] chore: log reason reverse proxy can't be started (#1089) Following on to #1065, the reason that the reverse proxy cannot be started (such as an invalid cache server URL) wasn't being logged. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1089): chore: log reason reverse proxy can't be started Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1089 Reviewed-by: Mathieu Fenniak Reviewed-by: earl-warren Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- act/cacheproxy/handler.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 499c5167..ebaf65e2 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -82,7 +82,7 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheProxyHostOver proxy, err := h.newReverseProxy(targetHost) if err != nil { - return nil, fmt.Errorf("unable to set up proxy to target host") + return nil, fmt.Errorf("unable to set up proxy to target host: %v", err) } router := httprouter.New() From f31a1b031ee21ff37980474a99029563eb04c969 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 15 Oct 2025 06:54:17 +0000 Subject: [PATCH 266/281] Update module github.com/avast/retry-go/v4 to v4.7.0 (#1092) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/avast/retry-go/v4](https://github.com/avast/retry-go) | `v4.6.1` -> `v4.7.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2favast%2fretry-go%2fv4/v4.7.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2favast%2fretry-go%2fv4/v4.6.1/v4.7.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
avast/retry-go (github.com/avast/retry-go/v4) ### [`v4.7.0`](https://github.com/avast/retry-go/releases/tag/v4.7.0) [Compare Source](https://github.com/avast/retry-go/compare/4.6.1...4.7.0) #### What's Changed - support context cancel cause by [@​NivKeidan](https://github.com/NivKeidan) in [#​117](https://github.com/avast/retry-go/pull/117) - Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​136](https://github.com/avast/retry-go/pull/136) - Add FullJitterBackoffDelay by [@​amirrezafahimi](https://github.com/amirrezafahimi) in [#​128](https://github.com/avast/retry-go/pull/128) - No delay after final retry on max attempts by [@​StounhandJ](https://github.com/StounhandJ) in [#​129](https://github.com/avast/retry-go/pull/129) - BackOffDelay multiplies attempts from zero by [@​StounhandJ](https://github.com/StounhandJ) in [#​130](https://github.com/avast/retry-go/pull/130) - add Go version 1.25 to test matrix for expanded compatibility testing by [@​JaSei](https://github.com/JaSei) in [#​142](https://github.com/avast/retry-go/pull/142) #### New Contributors - [@​NivKeidan](https://github.com/NivKeidan) made their first contribution in [#​117](https://github.com/avast/retry-go/pull/117) - [@​amirrezafahimi](https://github.com/amirrezafahimi) made their first contribution in [#​128](https://github.com/avast/retry-go/pull/128) - [@​StounhandJ](https://github.com/StounhandJ) made their first contribution in [#​129](https://github.com/avast/retry-go/pull/129) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1092 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2e114e84..a7cdb84c 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ require ( connectrpc.com/connect v1.19.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 - github.com/avast/retry-go/v4 v4.6.1 + github.com/avast/retry-go/v4 v4.7.0 github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 diff --git a/go.sum b/go.sum index abcbc98b..d14882d1 100644 --- a/go.sum +++ b/go.sum @@ -19,8 +19,8 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk= -github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA= +github.com/avast/retry-go/v4 v4.7.0 h1:yjDs35SlGvKwRNSykujfjdMxMhMQQM0TnIjJaHB+Zio= +github.com/avast/retry-go/v4 v4.7.0/go.mod h1:ZMPDa3sY2bKgpLtap9JRUgk2yTAba7cgiFhqxY2Sg6Q= github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE= github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM= From aa6eef94fd6eb6e8384d3070d4eb3bb347f2f3fe Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 16 Oct 2025 07:40:55 +0000 Subject: [PATCH 267/281] Update module golang.org/x/time to v0.14.0 (#1094) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/time](https://pkg.go.dev/golang.org/x/time) | [`v0.13.0` -> `v0.14.0`](https://cs.opensource.google/go/x/time/+/refs/tags/v0.13.0...refs/tags/v0.14.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2ftime/v0.14.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2ftime/v0.13.0/v0.14.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1094 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index a7cdb84c..009ac5f9 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.36.0 - golang.org/x/time v0.13.0 + golang.org/x/time v0.14.0 google.golang.org/protobuf v1.36.10 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index d14882d1..76b55827 100644 --- a/go.sum +++ b/go.sum @@ -252,8 +252,8 @@ golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= -golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI= -golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= +golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ= google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f h1:2yNACc1O40tTnrsbk9Cv6oxiW8pxI/pXj0wRtdlYmgY= From a7487dadd7b5da794d0f5858ebde66fb76e5fbd4 Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Thu, 16 Oct 2025 07:42:36 +0000 Subject: [PATCH 268/281] fix: use automatic IP detection instead of cache proxy host config value for internal cache server (#1088) The description for the `cache.host` config value is ``` # The IP or hostname (195.84.20.30 or example.com) to use when constructing # ACTIONS_CACHE_URL which is the URL of the cache proxy. ``` however the internal cache *server* was being started using that value, despite it clearly stating its for the *proxy*. While the address used to contact the cache proxy from the job is *usually* the same as the address for the cache proxy to contact the server, that is not the case with custom /etc/hosts entries, like what is used for the `host.containers.internal` address, which is needed for contacting the cache proxy on rootless podman (see #1075). Since the cache proxy and internal cache server are always running on the same host (or container), it's safe to use localhost for the server address instead. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1088): fix: use automatic IP detection instead of cache proxy host config value for internal cache server Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1088 Reviewed-by: Mathieu Fenniak Reviewed-by: Kwonunn Reviewed-by: Michael Kriese Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- internal/app/run/runner.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 31a1b320..c709b462 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -117,7 +117,7 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler cacheServer, err := artifactcache.StartHandler( cfg.Cache.Dir, - cfg.Cache.Host, + "", // automatically detect cfg.Cache.Port, cacheSecret, log.StandardLogger().WithField("module", "cache_request"), From d92a892ecebb7d5d362f252c487635c1fb9a4c6e Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Mon, 20 Oct 2025 11:55:59 +0000 Subject: [PATCH 269/281] fix: enforce LXC bootstrap locks (#1098) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/51 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1098): fix: enforce LXC bootstrap locks Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1098 Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index cd855a89..3f1d997a 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -74,8 +74,6 @@ function lxc_transaction_begin() { lxc_transaction_lock lxc_container_destroy $draft - - echo $draft } function lxc_transaction_commit() { @@ -391,7 +389,8 @@ function lxc_build_template_release() { return fi - local draft=$(lxc_transaction_begin $name) + lxc_transaction_begin $name + local draft=$(lxc_transaction_draft_name) $LXC_SUDO lxc-create --name $draft --template debian -- --release=$LXC_CONTAINER_RELEASE echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $draft) lxc_container_install_lxc_helpers $draft @@ -414,7 +413,8 @@ function lxc_build_template() { lxc_build_template_release fi - local draft=$(lxc_transaction_begin $newname) + lxc_transaction_begin $name + local draft=$(lxc_transaction_draft_name) if ! $LXC_SUDO lxc-copy --name=$name --newname=$draft; then echo lxc-copy --name=$name --newname=$draft failed return 1 From 44f45570059b8ea3096d78943a67fc220848f74b Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 20 Oct 2025 15:18:52 +0000 Subject: [PATCH 270/281] chore(ci): use code.forgejo.org/oci/alpine:latest (#1100) The current AWS outage revealed one location still using docker.io instead of the code.forgejo.org mirror: ``` 2025-10-20T09:22:44.6442259Z [actions-with-environment-and-context-tests/check] [DEBUG] Head "https://registry-1.docker.io/v2/library/alpine/manifests/3": received unexpected HTTP status: 503 Service Unavailable ``` https://code.forgejo.org/forgejo/runner/actions/runs/11442/jobs/2/attempt/3#jobstep-5-56398 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1100): chore(ci): use code.forgejo.org/oci/alpine:latest Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1100 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .../actions-environment-and-context-tests/docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile b/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile index bd8fcb22..f50a50da 100644 --- a/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile +++ b/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3 +FROM code.forgejo.org/oci/alpine:latest COPY entrypoint.sh /entrypoint.sh From 8034eaaabbe44cbd79a3b04e75d05b2db06c4a4e Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Mon, 20 Oct 2025 21:03:14 +0000 Subject: [PATCH 271/281] fix: lxc_exists_and_apt_not_old must be in a transaction (#1104) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/52 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1104): fix: lxc_exists_and_apt_not_old must be in a transaction Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1104 Reviewed-by: limiting-factor Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index 3f1d997a..4d3b959a 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -385,11 +385,13 @@ function lxc_running() { function lxc_build_template_release() { local name="$(lxc_template_release)" + lxc_transaction_begin $name + if lxc_exists_and_apt_not_old $name; then + lxc_transaction_unlock return fi - lxc_transaction_begin $name local draft=$(lxc_transaction_draft_name) $LXC_SUDO lxc-create --name $draft --template debian -- --release=$LXC_CONTAINER_RELEASE echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $draft) @@ -405,15 +407,16 @@ function lxc_build_template() { local name="$1" local newname="$2" - if lxc_exists_and_apt_not_old $newname; then - return - fi - if test "$name" = "$(lxc_template_release)"; then lxc_build_template_release fi lxc_transaction_begin $name + if lxc_exists_and_apt_not_old $newname; then + lxc_transaction_unlock + return + fi + local draft=$(lxc_transaction_draft_name) if ! $LXC_SUDO lxc-copy --name=$name --newname=$draft; then echo lxc-copy --name=$name --newname=$draft failed From 403489591e7f722e789233c7090ee972cbaff542 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 20 Oct 2025 21:05:05 +0000 Subject: [PATCH 272/281] Revert "chore(cleanup): lxc-helpers does not need a global lock (#1047)" (#1103) This reverts commit 996ac343ee155a4b47d89a6bf1854feb1c04fdb2. The lock is still needed to guard against the following scenario. https://code.forgejo.org/forgejo/runner/src/commit/d92a892ecebb7d5d362f252c487635c1fb9a4c6e/act/runner/run_context.go#L225-L236 - two or more jobs start - one of them creates the act template (`lxc_build_template $(lxc_template_release) $name`) - lxc-helpers now has transactions and they won't race against each other - once it is built all jobs will then try to install node in the container that was just built and race against each other with a global lock only the first one will build and populate the act template. The other will then do nothing because it already exists. The bug can trivially be reproduced with: ```yaml on: pull_request: jobs: test1: runs-on: lxc steps: - run: echo OK1 test2: runs-on: lxc steps: - run: echo OK2 test3: runs-on: lxc steps: - run: echo OK3 ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1103): Revert "chore(cleanup): lxc-helpers does not need a global lock (#1047)" Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1103 Reviewed-by: Michael Kriese Reviewed-by: limiting-factor Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/run_context.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 9e4c2981..dd72ff09 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -193,6 +193,8 @@ var lxcHelpers string var startTemplate = template.Must(template.New("start").Parse(`#!/bin/bash -e +exec 5<>/tmp/forgejo-runner-lxc.lock ; flock --timeout 21600 5 + LXC_CONTAINER_CONFIG="{{.Config}}" LXC_CONTAINER_RELEASE="{{.Release}}" From aab9e2281972615c7301dc3dc87fa9c085f91302 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 21 Oct 2025 03:21:33 +0000 Subject: [PATCH 273/281] Update dependency forgejo/lxc-helpers to v1.1.3 (#1106) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers) | patch | `1.1.1` -> `1.1.3` | --- ### Release Notes
forgejo/lxc-helpers (forgejo/lxc-helpers) ### [`v1.1.3`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.2...v1.1.3) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.2...v1.1.3) ### [`v1.1.2`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.1...v1.1.2) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.1...v1.1.2)
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1106 Reviewed-by: Mathieu Fenniak Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index e949f3de..370d5fff 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -20,7 +20,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_TOKEN:=} : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} -DEFAULT_LXC_HELPERS_VERSION=1.1.1 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers +DEFAULT_LXC_HELPERS_VERSION=1.1.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} DEFAULT_RUNNER_VERSION=11.1.2 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} From 2301db6f85b7d54f3e7d743cdbac0370ff5f5f20 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 22 Oct 2025 06:31:45 +0000 Subject: [PATCH 274/281] fix: ${{ env.VAR }} is allowed in container (#1108) Resolves forgejo/forgejo-actions-feature-requests#62 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1108): fix: ${{ env.VAR }} is allowed in container Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1108 Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/schema/schema_test.go | 2 +- act/schema/workflow_schema.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index 9661b930..beb1c185 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -242,7 +242,7 @@ jobs: name: Build Silo Frontend DEV runs-on: ubuntu-latest container: - image: code.forgejo.org/oci/node:22-bookworm + image: code.forgejo.org/oci/${{ env.IMAGE }} uses: ./.forgejo/workflows/${{ vars.PATHNAME }} with: STAGE: dev diff --git a/act/schema/workflow_schema.json b/act/schema/workflow_schema.json index 56e7d5d4..99633cac 100644 --- a/act/schema/workflow_schema.json +++ b/act/schema/workflow_schema.json @@ -2008,7 +2008,7 @@ }, "container": { "description": "A container to run any steps in a job that don't already specify a container. If you have steps that use both script and container actions, the container actions will run as sibling containers on the same network with the same volume mounts.\n\nIf you do not set a container, all steps will run directly on the host specified by runs-on unless a step refers to an action configured to run in a container.", - "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix", "env"], "one-of": ["string", "container-mapping"] }, "container-mapping": { From 8a98a8a5128ddb1d7e142dd5103fc648e6dd8053 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 24 Oct 2025 06:37:56 +0000 Subject: [PATCH 275/281] Update data.forgejo.org/oci/golang Docker tag to v1.25 (#1110) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [data.forgejo.org/oci/golang](https://hub.docker.com/_/golang) ([source](https://github.com/docker-library/golang)) | stage | minor | `1.24-alpine3.22` -> `1.25-alpine3.22` | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1110 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index bcfe98f5..2c654211 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/xx AS xx -FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.24-alpine3.22 AS build-env +FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.25-alpine3.22 AS build-env # # Transparently cross compile for the target platform From ea961a70c3729da474d7069f065f2967840a291c Mon Sep 17 00:00:00 2001 From: volkmnv Date: Fri, 24 Oct 2025 07:00:43 +0000 Subject: [PATCH 276/281] fix: windows compilation (#1101) Original pull request: https://code.forgejo.org/forgejo/runner/pulls/987 Fixes https://code.forgejo.org/forgejo/runner/issues/1032 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1101): fix: windows compilation Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1101 Reviewed-by: earl-warren Co-authored-by: volkmnv Co-committed-by: volkmnv --- act/artifactcache/handler.go | 3 +-- act/artifactcache/utils.go | 9 +++++++++ act/artifactcache/utils_windows.go | 14 ++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) create mode 100644 act/artifactcache/utils.go create mode 100644 act/artifactcache/utils_windows.go diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 29ff61e3..cbc58d8f 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -9,7 +9,6 @@ import ( "net/http" "strconv" "strings" - "syscall" "time" "github.com/julienschmidt/httprouter" @@ -25,7 +24,7 @@ const ( var fatal = func(logger logrus.FieldLogger, err error) { logger.Errorf("unrecoverable error in the cache: %v", err) - if err := syscall.Kill(syscall.Getpid(), syscall.SIGTERM); err != nil { + if err := suicide(); err != nil { logger.Errorf("unrecoverable error in the cache: failed to send the TERM signal to shutdown the daemon %v", err) } } diff --git a/act/artifactcache/utils.go b/act/artifactcache/utils.go new file mode 100644 index 00000000..37274a4e --- /dev/null +++ b/act/artifactcache/utils.go @@ -0,0 +1,9 @@ +//go:build !windows + +package artifactcache + +import "syscall" + +func suicide() error { + return syscall.Kill(syscall.Getpid(), syscall.SIGTERM) +} diff --git a/act/artifactcache/utils_windows.go b/act/artifactcache/utils_windows.go new file mode 100644 index 00000000..90b0f112 --- /dev/null +++ b/act/artifactcache/utils_windows.go @@ -0,0 +1,14 @@ +//go:build windows + +package artifactcache + +import "syscall" + +func suicide() error { + handle, err := syscall.GetCurrentProcess() + if err != nil { + return err + } + + return syscall.TerminateProcess(handle, uint32(syscall.SIGTERM)) +} From 10a9ab9001b10f13f16d2b41be0b1b51067cd8a1 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 27 Oct 2025 07:33:24 +0000 Subject: [PATCH 277/281] Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.7 (#1113) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/forgejo](https://forgejo.org) ([source](https://codeberg.org/forgejo/forgejo)) | patch | `11.0.6` -> `11.0.7` | --- ### Release Notes
forgejo/forgejo (code.forgejo.org/forgejo/forgejo) ### [`v11.0.7`](https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.7) [Compare Source](https://codeberg.org/forgejo/forgejo/compare/v11.0.6...v11.0.7) See
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1113 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index 0a1c216b..4f387998 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -19,7 +19,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: release-simulation: diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index ec8469ca..dc1fe14b 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -21,7 +21,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo FORGEJO_USER: root FORGEJO_PASSWORD: admin1234 diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index c8907609..ba3c6a5d 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -14,7 +14,7 @@ env: SERIAL: "30" LIFETIME: "60" SYSTEMD_OPTIONS: "--no-pager --full" - USE_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + USE_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: example-lxc-systemd: From 88e6654a6c29db2bfd700523dd771e6b5d38fb93 Mon Sep 17 00:00:00 2001 From: Richard Robert Reitz Date: Wed, 29 Oct 2025 11:12:12 +0100 Subject: [PATCH 278/281] feat(runner): Added waiting for a job arrival in the one-job command. --- internal/app/job/job.go | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/internal/app/job/job.go b/internal/app/job/job.go index 6babd498..654bc154 100644 --- a/internal/app/job/job.go +++ b/internal/app/job/job.go @@ -36,11 +36,20 @@ func NewJob(cfg *config.Config, client client.Client, runner run.RunnerInterface } func (j *Job) Run(ctx context.Context) error { - task, ok := j.fetchTask(ctx) - if !ok { - return fmt.Errorf("could not fetch task") + log.Info("Polling for a job...") + for { + task, ok := j.fetchTask(ctx) + if ok { + return j.runTaskWithRecover(ctx, task) + } + // No task available, continue polling + select { + case <-ctx.Done(): + return ctx.Err() + default: + // Continue to next iteration + } } - return j.runTaskWithRecover(ctx, task) } func (j *Job) runTaskWithRecover(ctx context.Context, task *runnerv1.Task) error { From cd83c525c894af84ea9fa5caa251b3c3bd5c66f9 Mon Sep 17 00:00:00 2001 From: Martin McCaffery Date: Thu, 30 Oct 2025 08:48:02 +0000 Subject: [PATCH 279/281] chore(workflow): set up simpler build pipeline --- .forgejo/workflows/build-ipcei.yml | 27 +++++++++++++ .goreleaser.yaml | 61 ++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+) create mode 100644 .forgejo/workflows/build-ipcei.yml create mode 100644 .goreleaser.yaml diff --git a/.forgejo/workflows/build-ipcei.yml b/.forgejo/workflows/build-ipcei.yml new file mode 100644 index 00000000..d2a754ba --- /dev/null +++ b/.forgejo/workflows/build-ipcei.yml @@ -0,0 +1,27 @@ +name: ci + +on: + push: + tags: + - v* + +jobs: + goreleaser: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Set up Go + uses: actions/setup-go@v6 + with: + go-version: ">=1.25.1" + - name: Test code + run: make test + - name: Run GoReleaser + uses: https://github.com/goreleaser/goreleaser-action@v6 + env: + GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }} + with: + args: release --clean diff --git a/.goreleaser.yaml b/.goreleaser.yaml new file mode 100644 index 00000000..1871ce88 --- /dev/null +++ b/.goreleaser.yaml @@ -0,0 +1,61 @@ +version: 2 + +before: + hooks: + - go mod download + - go generate ./... + +builds: + - env: + - CGO_ENABLED=0 + goos: + - linux + - darwin + - windows + goarch: + - amd64 + - arm64 + +archives: + - formats: [binary] + # this name template makes the OS and Arch compatible with the results of `uname`. + name_template: >- + {{ .ProjectName }}_ + {{- title .Os }}_ + {{- if eq .Arch "amd64" }}x86_64 + {{- else if eq .Arch "386" }}i386 + {{- else }}{{ .Arch }}{{ end }} + {{- if .Arm }}v{{ .Arm }}{{ end }} + +changelog: + abbrev: 10 + filters: + exclude: + - "^docs:" + - "^test:" + format: "{{.SHA}}: {{.Message}}" + groups: + - title: Features + regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$' + order: 0 + - title: "Bug fixes" + regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$' + order: 1 + - title: "Chores" + regexp: '^.*?chore(\([[:word:]]+\))??!?:.+$' + order: 2 + - title: Others + order: 999 + sort: asc + +release: + gitea: + owner: DevFW-CICD + name: edge-connect-client + +force_token: gitea +gitea_urls: + api: https://edp.buildth.ing/api/v1 + download: https://edp.buildth.ing + # set to true if you use a self-signed certificate + skip_tls_verify: false From 1f8217d99b404b1a5f14c8b4f6d79cc95ace886d Mon Sep 17 00:00:00 2001 From: Martin McCaffery Date: Thu, 30 Oct 2025 08:57:37 +0000 Subject: [PATCH 280/281] fix(workflow): remove go generate from goreleaser --- .goreleaser.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 1871ce88..4c299275 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -3,7 +3,6 @@ version: 2 before: hooks: - go mod download - - go generate ./... builds: - env: From d97839cd90f2527c6e6f1cb73f521c389b05bfb1 Mon Sep 17 00:00:00 2001 From: Martin McCaffery Date: Thu, 30 Oct 2025 09:09:10 +0000 Subject: [PATCH 281/281] fix(workflow): point to correct repo --- .goreleaser.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 4c299275..b7116d9b 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -50,7 +50,7 @@ changelog: release: gitea: owner: DevFW-CICD - name: edge-connect-client + name: runner force_token: gitea gitea_urls: