From 149a9e3cf5d7fa9bbbce00b6f9543c64e5388b4e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 8 Sep 2025 08:41:21 +0000 Subject: [PATCH 01/99] chore: skip release-notes-assistant for dependency updates (#954) Resolves forgejo/runner#953 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/954): chore: skip release-notes-assistant for dependency updates Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/954 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/release-notes-assistant.yml | 2 +- renovate.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index bf63f433..790227a2 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -15,7 +15,7 @@ env: jobs: release-notes: - if: vars.ROLE == 'forgejo-coding' + if: vars.ROLE == 'forgejo-coding' && !contains(forge.event.pull_request.labels.*.name, 'Kind/DependencyUpdate') runs-on: docker container: image: 'data.forgejo.org/oci/ci:1' diff --git a/renovate.json b/renovate.json index 60cdc25f..a9a1a6af 100644 --- a/renovate.json +++ b/renovate.json @@ -9,6 +9,6 @@ "separateMinorPatch": true } ], - "labels": ["Kind/Chore", "run-end-to-end-tests"], + "labels": ["Kind/DependencyUpdate", "run-end-to-end-tests"], "ignorePaths": ["**/testdata/**", "**/node_modules/**"] } From 864fce89d22fd414286d171bf79dfd1bbed23047 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 8 Sep 2025 11:14:42 +0200 Subject: [PATCH 02/99] chore: debug release-notes-assistant workflow --- .forgejo/workflows/release-notes-assistant.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 790227a2..48313fde 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -14,6 +14,14 @@ env: RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org jobs: + debug: + runs-on: docker + steps: + - name: event + run: | + cat <<'EOF' + ${{ toJSON(forge) }} + EOF release-notes: if: vars.ROLE == 'forgejo-coding' && !contains(forge.event.pull_request.labels.*.name, 'Kind/DependencyUpdate') runs-on: docker From 02df78a9ecf32ca6233efec9c4baf20db4cc761d Mon Sep 17 00:00:00 2001 From: jankatins Date: Mon, 8 Sep 2025 21:27:43 +0000 Subject: [PATCH 03/99] fix: Allow the runner to keep it's labels (#965) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I had the case that an already registered runner was losing it's labels due to a race condition (I think): the compose file was restarted, the runner came up but 10 seconds later, the labels were reset: >If the command is run without --labels, they will be reset, and the runner won’t set them back until it is restarted. The --keep-labels option can be used to preserve the existing labels. I always started all services in the compose file at once, so I never got the idea to restart the runner alone and the runner logs actually always said that the labels where there: > ... with labels: [docker-cli node-bookworm], declared successfully Signed-off-by: jankatins - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/965): fix: Allow the runner to keep it's labels Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/965 Reviewed-by: earl-warren Co-authored-by: jankatins Co-committed-by: jankatins --- examples/docker-compose/compose-forgejo-and-runner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index a0a90c77..c71cbc4e 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -35,7 +35,7 @@ services: bash -c ' /usr/bin/s6-svscan /etc/s6 & sleep 10 ; - su -c "forgejo forgejo-cli actions register --secret {SHARED_SECRET}" git ; + su -c "forgejo forgejo-cli actions register --keep-labels --secret {SHARED_SECRET}" git ; su -c "forgejo admin user create --admin --username root --password {ROOT_PASSWORD} --email root@example.com" git ; sleep infinity ' From 151c90b2a9a7a82e47021db19791eb07a23ffe16 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Tue, 9 Sep 2025 05:23:55 +0000 Subject: [PATCH 04/99] chore: call the release notes assistant when opening a new pull request (#964) When a new pull request is opened and has no labels, the release notes assistant will not be called and it will look like the event was missed. Most of the time the label will be set when the pull request is open and that will fire two runs. However, the release notes assistant is idempotent and that will just make one extra run in the CI that is a noop. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/964): chore: call the release notes assistant when opening a new pull request Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/964 Reviewed-by: Gusted Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/release-notes-assistant.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 48313fde..27112b2e 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -6,6 +6,7 @@ name: issue-labels on: pull_request_target: types: + - opened - edited - synchronize - labeled @@ -14,14 +15,6 @@ env: RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org jobs: - debug: - runs-on: docker - steps: - - name: event - run: | - cat <<'EOF' - ${{ toJSON(forge) }} - EOF release-notes: if: vars.ROLE == 'forgejo-coding' && !contains(forge.event.pull_request.labels.*.name, 'Kind/DependencyUpdate') runs-on: docker From 6a6a41bf05c8c453b89d8864145d0c1180771beb Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 9 Sep 2025 08:52:15 +0000 Subject: [PATCH 05/99] Update module golang.org/x/term to v0.35.0 (#966) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.34.0` -> `v0.35.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.34.0...refs/tags/v0.35.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.35.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.34.0/v0.35.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/966 Reviewed-by: Gusted Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 137e7f39..63e8d0ff 100644 --- a/go.mod +++ b/go.mod @@ -36,7 +36,7 @@ require ( github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 - golang.org/x/term v0.34.0 + golang.org/x/term v0.35.0 golang.org/x/time v0.13.0 google.golang.org/protobuf v1.36.8 gotest.tools/v3 v3.5.2 @@ -101,7 +101,7 @@ require ( golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.39.0 // indirect golang.org/x/sync v0.12.0 // indirect - golang.org/x/sys v0.35.0 // indirect + golang.org/x/sys v0.36.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index b42750cc..9a748ef9 100644 --- a/go.sum +++ b/go.sum @@ -242,11 +242,11 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= -golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= +golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4= -golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= +golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ= +golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= From 9a620466074d61a820596147ae338d55feda3684 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 10 Sep 2025 07:18:40 +0000 Subject: [PATCH 06/99] chore: lxc-systemd may need more time to start on slow machines (#970) This false negative happened in the past 24h at https://code.forgejo.org/forgejo/runner/actions/runs/9581/jobs/0 and was resolved by just running it again. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/970): chore: lxc-systemd may need more time to start on slow machines Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/970 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/example-lxc-systemd.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index 5ebdd1a7..66c991cd 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -123,8 +123,8 @@ jobs: started_running=/etc/forgejo-runner/$serial/started-running killed_gracefully=/etc/forgejo-runner/$serial/killed-gracefully stopped_gracefully=/etc/forgejo-runner/$serial/stopped-gracefully - retry --delay 5 --times 20 cp -a $started_running /tmp/first-run - retry --delay 1 --times 30 grep --quiet 'Starting runner daemon' /var/log/forgejo-runner/$serial.log + retry --delay 10 --times 20 cp -a $started_running /tmp/first-run + retry --delay 2 --times 30 grep --quiet 'Starting runner daemon' /var/log/forgejo-runner/$serial.log systemctl stop forgejo-runner@$serial ! systemctl $all status forgejo-runner@$serial ls -l /etc/forgejo-runner/$serial @@ -136,7 +136,7 @@ jobs: ! test -f $killed_gracefully ! test -f $stopped_gracefully lifetime=${{ env.LIFETIME }} - # give it time to restart at least once + : give it time to restart at least once ls -l /etc/forgejo-runner/$serial sleep $lifetime ; sleep $lifetime ls -l /etc/forgejo-runner/$serial From 86653c237d427356350b2812b19046f3bbb640fb Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Wed, 10 Sep 2025 07:22:16 +0000 Subject: [PATCH 07/99] ci: update forgejo version for release integration (#973) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/973): ci: update forgejo version for release integration Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/973 Reviewed-by: earl-warren Co-authored-by: Michael Kriese Co-committed-by: Michael Kriese --- .forgejo/workflows/build-release-integration.yml | 5 ++++- .forgejo/workflows/release-notes-assistant.yml | 2 +- renovate.json | 6 ++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index 762cb222..ce62de12 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -18,6 +18,9 @@ on: enable-email-notifications: true +env: + FORGEJO_VERSION: 11.0.5 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + jobs: release-simulation: runs-on: lxc-bookworm @@ -30,7 +33,7 @@ jobs: with: user: root password: admin1234 - image-version: 1.20 + image-version: ${{ env.FORGEJO_VERSION }} lxc-ip-prefix: 10.0.9 - name: publish diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 27112b2e..92fcccd4 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -12,7 +12,7 @@ on: - labeled env: - RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org + RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant jobs: release-notes: diff --git a/renovate.json b/renovate.json index a9a1a6af..9cd17416 100644 --- a/renovate.json +++ b/renovate.json @@ -7,6 +7,12 @@ "description": "Separate minor and patch for some packages", "matchDepNames": ["github.com/rhysd/actionlint"], "separateMinorPatch": true + }, + { + "description": "separate multiple major and minor for forgejo", + "matchDepNames": ["code.forgejo.org/forgejo/forgejo"], + "separateMultipleMajor": true, + "separateMultipleMinor": true } ], "labels": ["Kind/DependencyUpdate", "run-end-to-end-tests"], From 106c50a51d1741961b7048c953de3ca638bfc39b Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Wed, 10 Sep 2025 09:51:22 +0200 Subject: [PATCH 08/99] chore(renovate): group runner updates --- renovate.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 9cd17416..b421427f 100644 --- a/renovate.json +++ b/renovate.json @@ -4,7 +4,7 @@ "prConcurrentLimit": 1, "packageRules": [ { - "description": "Separate minor and patch for some packages", + "description": "separate minor and patch for some packages", "matchDepNames": ["github.com/rhysd/actionlint"], "separateMinorPatch": true }, @@ -13,6 +13,11 @@ "matchDepNames": ["code.forgejo.org/forgejo/forgejo"], "separateMultipleMajor": true, "separateMultipleMinor": true + }, + { + "description": "group runner updates", + "matchDepNames": ["code.forgejo.org/forgejo/runner", "forgejo/runner"], + "groupName": "forgejo-runner" } ], "labels": ["Kind/DependencyUpdate", "run-end-to-end-tests"], From 7f75f52aaf77a3ff91936bb792414b00807970e7 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 10 Sep 2025 09:18:50 +0000 Subject: [PATCH 09/99] Update forgejo-runner to v11 (major) (#975) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | major | `9.1.1` -> `11.0.0` | | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | major | `10.0.1` -> `11.0.0` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v11.0.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.0.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v10.0.1...v11.0.0) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes The breaking change in this release is not technical, it is the change of the license which is now GPLv3-or-later. - [PR](https://code.forgejo.org/forgejo/runner/pulls/773): chore: change the license to GPLv3-or-later *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/935): fix: shutdown the runner when the cache fails with a non recoverable error - [PR](https://code.forgejo.org/forgejo/runner/pulls/948): fix: also cascade if run-\*-test is set when the PR is open - [PR](https://code.forgejo.org/forgejo/runner/pulls/946): fix: graceful shutdown of tasks being interrupted by signal - [PR](https://code.forgejo.org/forgejo/runner/pulls/943): fix: lxc-systemd example: export INPUTS\_SERIAL - [PR](https://code.forgejo.org/forgejo/runner/pulls/941): fix: allow inputs context in action defaults - [PR](https://code.forgejo.org/forgejo/runner/pulls/931): fix: an expression in with: for a reusable workflow call can use env - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/951): Update module golang.org/x/time to v0.13.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/950): Revert "fix: also cascade if run-\*-test is set when the PR is open ([#​948](https://github.com/forgejo/runner/issues/948))" - [PR](https://code.forgejo.org/forgejo/runner/pulls/945): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.5 - [PR](https://code.forgejo.org/forgejo/runner/pulls/942): Update module github.com/docker/docker to v28.4.0+incompatible - [PR](https://code.forgejo.org/forgejo/runner/pulls/773): chore: change the license to GPLv3-or-later - [PR](https://code.forgejo.org/forgejo/runner/pulls/940): chore: bump version to v11 - [PR](https://code.forgejo.org/forgejo/runner/pulls/936): refactor: remove duplicate computeMac function - [PR](https://code.forgejo.org/forgejo/runner/pulls/938): Update module github.com/docker/cli to v28.4.0+incompatible - [PR](https://code.forgejo.org/forgejo/runner/pulls/934): chore: refactor act/artifactcache Handler to an interface - [PR](https://code.forgejo.org/forgejo/runner/pulls/933): Update dependency go to v1.24.7 - [PR](https://code.forgejo.org/forgejo/runner/pulls/932): Update module github.com/spf13/pflag to v1.0.10 - [PR](https://code.forgejo.org/forgejo/runner/pulls/930): Update module github.com/spf13/cobra to v1.10.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/928): Update dependency forgejo/runner to v10 ### [`v10.0.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v10.0.0...v10.0.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/927): fix: pull\_request\_target events can share the cache of the repository ### [`v10.0.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.1.1...v10.0.0) > **Warning** Upgrade to v10.0.1 instead. A regression was found on `pull_request_target` events and is fixed in the [v10.0.1 release](https://code.forgejo.org/forgejo/runner/releases/tag/v10.0.1). - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes - [PR](https://code.forgejo.org/forgejo/runner/pulls/925): fix(security): prevent on: pull\_request actions from mutating caches of other workflow events forgej-runner currently creates a safer execution environment for workflows triggered by pull requests by denying those workflows access to the repository's secrets, preventing pull requests from compromising the confidentiality of the secrets. Workflows do have access to write to the action cache, which is shared with future workflow executions, including executions that may have access to repository secrets. This was assumed safe as the cache is a "write-once" operation based upon the cache key; if an execution writes to that cache, it will be read by other workflows only if a matching key parameter is provided, and it can not be modified again. These assumptions were identified as weak security practices with known workarounds. It is possible for a malicious pull request to mutate the shared cache and embed untrusted artifacts, which may later be executed in workflow executions with access to secrets, risking the confidentiality of those secrets. In order to eliminate this risk, workflows executing with the `pull_request` and `pull_request_target` events have their write operations to the cache isolated to future workflow executions from the same pull request. They can continue to read from the shared cache if applicable. If using an external cache server configuration, both the cache server and other instances of the runner must be running the same software version. The recommended upgrade procedure in this configuration is to bring all runners offline, upgrade the cache server to the latest release and bring it online, and then bring all other runners online. - [PR](https://code.forgejo.org/forgejo/runner/pulls/924): fix(security): ensure unique names for container images created by actions Without this fix, when a workflow ran a local [docker action](https://forgejo.org/docs/next/user/actions/actions/#docker-actions) (e.g. the [example in the end-to-end tests](https://code.forgejo.org/forgejo/end-to-end/src/commit/8f920b4b7adcb920e435db1acd02407b2312ab74/actions/example-force-rebuild/.forgejo/workflows/test.yml)), it used an image tag that could collide with other workflows that happen to use the same name. The workaround for older runner versions is to set [`[container].force_rebuild: true`](https://forgejo.org/docs/next/admin/actions/runner-installation/#configuration) in the runner configuration file. *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/925): fix(security): prevent on: pull\_request actions from mutating caches of other workflow events - [PR](https://code.forgejo.org/forgejo/runner/pulls/924): fix(security): ensure unique names for container images created by actions - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/921): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.4 - [PR](https://code.forgejo.org/forgejo/runner/pulls/922): chore: explain the difference between `job_level` and `level` - [PR](https://code.forgejo.org/forgejo/runner/pulls/917): chore: add reminder of how to run a local test - [PR](https://code.forgejo.org/forgejo/runner/pulls/919): chore: unify cascade-setup-forgejo with cascade-forgejo - [PR](https://code.forgejo.org/forgejo/runner/pulls/873): chore: remove `github.com/pkg/errors` - [PR](https://code.forgejo.org/forgejo/runner/pulls/915): Update module github.com/stretchr/testify to v1.11.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/914): Update module google.golang.org/protobuf to v1.36.8 - [PR](https://code.forgejo.org/forgejo/runner/pulls/907): Update module go.etcd.io/bbolt to v1.4.3 - [PR](https://code.forgejo.org/forgejo/runner/pulls/906): test: remove internal timeout in TestRunnerCacheConfiguration - [PR](https://code.forgejo.org/forgejo/runner/pulls/902): chore: skip tests that require Forgejo if it is not available - [PR](https://code.forgejo.org/forgejo/runner/pulls/903): chore: rework the README - [PR](https://code.forgejo.org/forgejo/runner/pulls/904): Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 \[SECURITY] - [PR](https://code.forgejo.org/forgejo/runner/pulls/900): chore: remove TestRunContext\_GetGitHubContext - [PR](https://code.forgejo.org/forgejo/runner/pulls/899): chore: do not force GOPROXY - [PR](https://code.forgejo.org/forgejo/runner/pulls/890): Update module github.com/vektra/mockery/v2 to v2.53.5 - [PR](https://code.forgejo.org/forgejo/runner/pulls/893): chore: fix .PHONY lint targets - [PR](https://code.forgejo.org/forgejo/runner/pulls/898): Update dependency forgejo/runner to v9.1.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/897): Update code.forgejo.org/forgejo/runner Docker tag to v9.1.1
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/975 Reviewed-by: Michael Kriese Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index c71cbc4e..a2597d54 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:9.1.1 + image: code.forgejo.org/forgejo/runner:11.0.0 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:9.1.1 + image: code.forgejo.org/forgejo/runner:11.0.0 links: - docker-in-docker - forgejo diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 235c6e30..ac7ae172 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=10.0.1 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=11.0.0 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 4d98bda28221615d82d8f40174681a21cefbba9f Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 10 Sep 2025 09:18:53 +0000 Subject: [PATCH 10/99] Update https://data.forgejo.org/actions/setup-forgejo action to v3.0.3 (#969) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) | action | patch | `v3.0.2` -> `v3.0.3` | --- ### Release Notes
actions/setup-forgejo (https://data.forgejo.org/actions/setup-forgejo) ### [`v3.0.3`](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.2...v3.0.3) [Compare Source](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.2...v3.0.3)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/969 Reviewed-by: earl-warren Reviewed-by: Michael Kriese Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index ce62de12..edeb907c 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -29,7 +29,7 @@ jobs: - uses: actions/checkout@v4 - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 with: user: root password: admin1234 diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index da628a38..04ac8f54 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -34,7 +34,7 @@ jobs: - name: install Forgejo so it can be used as a container registry id: registry - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 with: user: ${{ env.FORGEJO_USER }} password: ${{ env.FORGEJO_PASSWORD }} diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index 66c991cd..e2d1a54b 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -53,7 +53,7 @@ jobs: done - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 with: user: root password: admin1234 From 16276cc0d6f8c345d25fe2ef2222cf9dfe44abec Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 10 Sep 2025 16:06:48 +0000 Subject: [PATCH 11/99] fix: use a fixed runner name for old (<= v1.20) Forgejo instances (#972) The bug was already there before the recent refactor. Only it manifested itself when shutting down the runner because `resp.Msg.GetRunner().GetName()` was only called then. It was correctly refactored in the createRunner function and therefore surfaced because `resp.Msg.GetRunner().GetName()` was called during initialization instead of during shutdown. ``` time="2025-09-10T05:41:10Z" level=info msg="log level changed to debug" func="[func2]" file="[daemon.go:130]" time="2025-09-10T05:41:10Z" level=info msg="Starting runner daemon" func="[runDaemon]" file="[daemon.go:51]" time="2025-09-10T05:41:10Z" level=warning msg="Because the Forgejo instance is an old version, skipping declaring the labels and version." func="[func6]" file="[daemon.go:208]" panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xcc1a23] goroutine 1 [running]: code.forgejo.org/forgejo/runner/v11/internal/app/cmd.init.func6({0x111f428, 0xc0000e8ab0}, 0xc0003b4000, 0xc0003b8230, {0x1125eb8?, 0xc000424040?}, {0xc000032840, 0x6, 0x8}) /srv/internal/app/cmd/daemon.go:222 +0x4a3 code.forgejo.org/forgejo/runner/v11/internal/app/cmd.runDaemon({0x111f578, 0xc00025fa00}, 0xc0000380b0) /srv/internal/app/cmd/daemon.go:68 +0x23f code.forgejo.org/forgejo/runner/v11/internal/app/cmd.Execute.getRunDaemonCommandProcessor.func6(0xc000044d00?, {0xc0000c4360?, 0x4?, 0xf63e10?}) /srv/internal/app/cmd/daemon.go:33 +0x1f github.com/spf13/cobra.(*Command).execute(0xc0000fe908, {0xc0000c4340, 0x2, 0x2}) /go/pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1015 +0xaaa github.com/spf13/cobra.(*Command).ExecuteC(0xc0000fe008) /go/pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1148 +0x46f github.com/spf13/cobra.(*Command).Execute(...) /go/pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1071 code.forgejo.org/forgejo/runner/v11/internal/app/cmd.Execute({0x111f578, 0xc00025fa00}) /srv/internal/app/cmd/cmd.go:89 +0xa05 main.main() /srv/main.go:18 +0x7b 20250910 05:41:10 daemon: client (pid 4264) exited with 2 status, exiting ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/972): fix: use a fixed runner name for old (<= v1.20) Forgejo instances Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/972 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/cmd/daemon.go | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/internal/app/cmd/daemon.go b/internal/app/cmd/daemon.go index d864af82..4edf2dbe 100644 --- a/internal/app/cmd/daemon.go +++ b/internal/app/cmd/daemon.go @@ -206,18 +206,19 @@ var createRunner = func(ctx context.Context, cfg *config.Config, reg *config.Reg resp, err := runner.Declare(ctx, ls.Names()) if err != nil && connect.CodeOf(err) == connect.CodeUnimplemented { log.Warn("Because the Forgejo instance is an old version, skipping declaring the labels and version.") + return runner, "runner", nil } else if err != nil { log.WithError(err).Error("fail to invoke Declare") return nil, "", err - } else { - log.Infof("runner: %s, with version: %s, with labels: %v, declared successfully", - resp.Msg.GetRunner().GetName(), resp.Msg.GetRunner().GetVersion(), resp.Msg.GetRunner().GetLabels()) - // if declared successfully, override the labels in the.runner file with valid labels in the config file (if specified) - runner.Update(ctx, ls) - reg.Labels = ls.ToStrings() - if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil { - return nil, "", fmt.Errorf("failed to save runner config: %w", err) - } + } + + log.Infof("runner: %s, with version: %s, with labels: %v, declared successfully", + resp.Msg.GetRunner().GetName(), resp.Msg.GetRunner().GetVersion(), resp.Msg.GetRunner().GetLabels()) + // if declared successfully, override the labels in the.runner file with valid labels in the config file (if specified) + runner.Update(ctx, ls) + reg.Labels = ls.ToStrings() + if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil { + return nil, "", fmt.Errorf("failed to save runner config: %w", err) } return runner, resp.Msg.GetRunner().GetName(), nil } From 3dd167d7701bebf86fb694dbeeeda8f92454554e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 11 Sep 2025 04:50:00 +0000 Subject: [PATCH 12/99] Update module code.forgejo.org/forgejo/actions-proto to v0.5.2 (#981) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | code.forgejo.org/forgejo/actions-proto | `v0.5.1` -> `v0.5.2` | [![age](https://developer.mend.io/api/mc/badges/age/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.1/v0.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/981 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 63e8d0ff..60ac1f9b 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.24.0 toolchain go1.24.7 require ( - code.forgejo.org/forgejo/actions-proto v0.5.1 + code.forgejo.org/forgejo/actions-proto v0.5.2 connectrpc.com/connect v1.18.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 @@ -38,7 +38,7 @@ require ( go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.35.0 golang.org/x/time v0.13.0 - google.golang.org/protobuf v1.36.8 + google.golang.org/protobuf v1.36.9 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index 9a748ef9..d5b9a302 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -code.forgejo.org/forgejo/actions-proto v0.5.1 h1:GCJHR/Y/Apk7Yl7CH9qOsKrdf/k0tRVFeVhz1EIZvb4= -code.forgejo.org/forgejo/actions-proto v0.5.1/go.mod h1:nu8N1HQLsu3c4T/PpYWbqwNBxsZnEOVxqV0mQWtIQvE= +code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= +code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= @@ -260,8 +260,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU= google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw= google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA= -google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= -google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= +google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw= +google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From 933667bdf159065e6e9acaa0b82bb44e6f4b7bfb Mon Sep 17 00:00:00 2001 From: Crown0815 Date: Thu, 11 Sep 2025 11:25:52 +0000 Subject: [PATCH 13/99] Remove windows build/test pipeline for GitHub (#985) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Windows builds have move to an [independent repository](https://github.com/Crown0815/Forgejo-runner-windows-builder). Same changes as in #983 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/985): Remove windows build/test pipeline for GitHub Co-authored-by: Felix KrΓΆner Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/985 Reviewed-by: earl-warren Co-authored-by: Crown0815 Co-committed-by: Crown0815 --- .github/workflows/build-release.yml | 151 ---------------------------- 1 file changed, 151 deletions(-) delete mode 100644 .github/workflows/build-release.yml diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml deleted file mode 100644 index d179d7bb..00000000 --- a/.github/workflows/build-release.yml +++ /dev/null @@ -1,151 +0,0 @@ -# This workflow: -# - builds and uploads a binary artifact for each Windows architecture -# - tests the runner on Windows with a Forgejo server container running on Windows Subsystem for Linux (WSL) -# - releases the binary artifact (if triggered on a pushed tag) -# -# This build is currently supported on https://github.com/Crown0815/forgejo-runner-windows - -name: Build Release - -on: - push: - tags: ['v*'] - branches: [ main ] - -jobs: - build: - name: Build ${{matrix.architecture}} - runs-on: ubuntu-latest - strategy: - matrix: - architecture: ['386', amd64, arm, arm64] - steps: - - uses: actions/checkout@v4 - - name: Build for ${{matrix.architecture}} - run: | - env GOOS=windows GOARCH=${{matrix.architecture}} \ - go build \ - -ldflags "-s -w -X code.forgejo.org/forgejo/runner/internal/pkg/ver.version=${{ github.ref_name }}" \ - -o forgejo-runner-windows-${{matrix.architecture}}.exe - - - uses: actions/upload-artifact@v4 - with: - name: forgejo-runner-windows-${{matrix.architecture}} - path: forgejo-runner-windows-${{matrix.architecture}}.exe - - - test: - name: Run Tests on Windows with Linux Forgejo Server - runs-on: windows-latest - env: - FORGEJO_ROOT_URL: 'http://localhost:3000/' - FORGEJO_ADMIN_USER: 'admin_user' - FORGEJO_ADMIN_PASSWORD: 'admin_password' - FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' - MAX_WAIT_ITERATIONS: 30 - - steps: - - name: Windows - Checkout code - uses: actions/checkout@v4 - - - name: Windows - Setup Windows Subsystem for Linux (WSL) - uses: Vampire/setup-wsl@v5 - with: - distribution: Alpine - wsl-shell-user: root - additional-packages: bash - - - name: WSL - Install Docker - shell: wsl-bash {0} - run: | - apk --update add --no-cache docker curl - - rc-update add docker default - openrc default - - # Wait for Docker to be ready - i=0 - until docker info > /dev/null 2>&1 || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do - echo "Waiting for Docker to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})" - sleep 1 - done - [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Docker is ready!" || { echo "Timed out waiting for Docker" ; exit 1; } - - - name: WSL - Start Forgejo Server - shell: wsl-bash {0} - run: | - docker run -d --name forgejo \ - -p 3000:3000 \ - -e USER_UID=1000 \ - -e USER_GID=1000 \ - -e FORGEJO__security__INSTALL_LOCK=true \ - -e FORGEJO__server__DOMAIN=localhost \ - -e FORGEJO__server__ROOT_URL=${{ env.FORGEJO_ROOT_URL }} \ - codeberg.org/forgejo/forgejo:11.0-rootless - - - name: Windows - Set up Go - uses: actions/setup-go@v5 - with: - go-version-file: go.mod - - - name: Windows - Install dependencies - run: go mod download - - - name: WSL - Register Runner on Forgejo Server - # Starting the Forgejo server takes some time. - # That time used to install go. - shell: wsl-bash {0} - run: | - i=0 - until curl -s ${{ env.FORGEJO_ROOT_URL }}/api/v1/version > /dev/null || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do - echo "Waiting for Forgejo to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})" - sleep 1 - done - [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Forgejo is ready!" || { echo "Timed out waiting for Forgejo" ; exit 1; } - - # Create admin user and generate runner token - docker exec forgejo forgejo admin user create --admin --username ${{ env.FORGEJO_ADMIN_USER }} --password ${{ env.FORGEJO_ADMIN_PASSWORD }} --email root@example.com - docker exec forgejo forgejo forgejo-cli actions register --labels docker --name therunner --secret ${{ env.FORGEJO_RUNNER_SECRET }} - - - name: Windows - Connect to Forgejo server - run: | - $configFileContent = @" - log: - level: debug - runner: - labels: - - windows:host - - docker:docker://node:20 - "@ - Set-Content -Path temporaryConfig.yml -Value $configFileContent - - # Register the runner - go run main.go create-runner-file --config temporaryConfig.yml --instance ${{ env.FORGEJO_ROOT_URL }} --secret ${{ env.FORGEJO_RUNNER_SECRET }} --name "windows-test-runner" - - - name: Windows - Run tests - run: go test -v ./... - env: - FORGEJO_URL: ${{ env.FORGEJO_ROOT_URL }} - FORGEJO_RUNNER_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }} - FORGEJO_RUNNER_HEX_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }} - - - release: - runs-on: ubuntu-latest - needs: [build, test] - if: github.event_name == 'push' && github.ref_type == 'tag' - steps: - - uses: actions/download-artifact@v4 - with: - path: . - - - name: Create Release - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ github.ref_name }} - files: forgejo-runner-windows-*/forgejo-runner-windows-*.exe - draft: false - prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }} - token: ${{ secrets.RELEASE_TOKEN }} - fail_on_unmatched_files: true - body: See [original release notes](https://code.forgejo.org/forgejo/runner/releases/tag/${{ github.ref_name }}). From 02a51c0a218061df978e88231d7507625afacd8e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 11 Sep 2025 14:43:26 +0000 Subject: [PATCH 14/99] fix: enforce job..timeout-minutes (#982) - enforce timeout-minutes timeout for jobs in a way similar to how it is done for steps - minimal refactor of evaluateStepTimeout evaluateTimeout so it can be used by jobs as well, with additional debug information and error logging if parsing fails - add integration tests for both step and job timeout-minutes, verifying expressions are allowed and evaluated Resolves forgejo/runner#979 --- Manually verified to work as expected https://v13.next.forgejo.org/earl-warren/testtimeout-minutes/actions/runs/3/jobs/0/attempt/1 ```yaml on: [push] jobs: test: runs-on: docker timeout-minutes: 1 steps: - run: | set -x while : ; do sleep 30 done ``` ![image](/attachments/047ddd15-7109-4931-a6ed-43073e4d31f9) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/982): fix: enforce job..timeout-minutes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/982 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/run_context.go | 5 ++++- act/runner/runner_test.go | 2 ++ act/runner/step.go | 11 +++++++---- act/runner/testdata/basic/push.yml | 3 ++- act/runner/testdata/timeout-minutes-job/push.yml | 12 ++++++++++++ act/runner/testdata/timeout-minutes-step/push.yml | 12 ++++++++++++ 6 files changed, 39 insertions(+), 6 deletions(-) create mode 100644 act/runner/testdata/timeout-minutes-job/push.yml create mode 100644 act/runner/testdata/timeout-minutes-step/push.yml diff --git a/act/runner/run_context.go b/act/runner/run_context.go index f6978b64..698fa0b4 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -943,7 +943,10 @@ func (rc *RunContext) Executor() (common.Executor, error) { return err } if res { - return executor(ctx) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, rc.Run.Job().TimeoutMinutes) + defer cancelTimeOut() + + return executor(timeoutctx) } return nil }, nil diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 86c0ad6e..0d29eca8 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -272,6 +272,8 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "evalmatrix-merge-array", "push", "", platforms, secrets}, {workdir, "basic", "push", "", platforms, secrets}, + {workdir, "timeout-minutes-stop", "push", "Job 'check' failed", platforms, secrets}, + {workdir, "timeout-minutes-job", "push", "context deadline exceeded", platforms, secrets}, {workdir, "fail", "push", "Job 'build' failed", platforms, secrets}, {workdir, "runs-on", "push", "", platforms, secrets}, {workdir, "checkout", "push", "", platforms, secrets}, diff --git a/act/runner/step.go b/act/runner/step.go index 25c67cfd..322b6f7e 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -177,7 +177,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo Mode: 0o666, })(ctx) - timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, rc.ExprEval, stepModel) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, stepModel.TimeoutMinutes) defer cancelTimeOut() err = executor(timeoutctx) @@ -213,12 +213,15 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo } } -func evaluateStepTimeout(ctx context.Context, exprEval ExpressionEvaluator, stepModel *model.Step) (context.Context, context.CancelFunc) { - timeout := exprEval.Interpolate(ctx, stepModel.TimeoutMinutes) +func evaluateTimeout(ctx context.Context, exprEval ExpressionEvaluator, timeoutMinutes string) (context.Context, context.CancelFunc) { + timeout := exprEval.Interpolate(ctx, timeoutMinutes) if timeout != "" { - if timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil { + timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64) + if err == nil { + common.Logger(ctx).Debugf("the step will stop in timeout-minutes %s", timeout) return context.WithTimeout(ctx, time.Duration(timeOutMinutes)*time.Minute) } + common.Logger(ctx).Errorf("timeout-minutes %s cannot be parsed and will be ignored: %w", timeout, err) } return ctx, func() {} } diff --git a/act/runner/testdata/basic/push.yml b/act/runner/testdata/basic/push.yml index 8cb1836f..8b40283e 100644 --- a/act/runner/testdata/basic/push.yml +++ b/act/runner/testdata/basic/push.yml @@ -18,7 +18,8 @@ jobs: - run: ls - run: echo 'hello world' - run: echo ${GITHUB_SHA} >> $(dirname "${GITHUB_WORKSPACE}")/sha.txt - - run: cat $(dirname "${GITHUB_WORKSPACE}")/sha.txt | grep ${GITHUB_SHA} + - timeout-minutes: 30 + run: cat $(dirname "${GITHUB_WORKSPACE}")/sha.txt | grep ${GITHUB_SHA} build: runs-on: ubuntu-latest needs: [check] diff --git a/act/runner/testdata/timeout-minutes-job/push.yml b/act/runner/testdata/timeout-minutes-job/push.yml new file mode 100644 index 00000000..be5f6c2d --- /dev/null +++ b/act/runner/testdata/timeout-minutes-job/push.yml @@ -0,0 +1,12 @@ +name: timeout-minutes +on: push + +env: + TIMEOUT_MINUTES: 0 + +jobs: + check: + runs-on: ubuntu-latest + timeout-minutes: ${{ env.TIMEOUT_MINUTES }} + steps: + - run: sleep 10 diff --git a/act/runner/testdata/timeout-minutes-step/push.yml b/act/runner/testdata/timeout-minutes-step/push.yml new file mode 100644 index 00000000..a79bb63a --- /dev/null +++ b/act/runner/testdata/timeout-minutes-step/push.yml @@ -0,0 +1,12 @@ +name: timeout-minutes +on: push + +env: + TIMEOUT_MINUTES: 0 + +jobs: + check: + runs-on: ubuntu-latest + steps: + - timeout-minutes: ${{ env.TIMEOUT_MINUTES }} + run: sleep 10 From 6f212fbb5a1dfb3d072bc1aa537093bb574a8e5b Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 11 Sep 2025 17:11:06 +0000 Subject: [PATCH 15/99] chore: wait 4 times longer for the forgejo cascade pull request to complete (#988) If the CI is busy, it may take more than one hour, for instance because the workflow is waiting while others are running. --- Note to reviewers: this input is not yet implemented, the next version of the cascading-pr action will have it (see [the pr](https://code.forgejo.org/actions/cascading-pr/pulls/40)). In the meantime it will be ignored. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/988): chore: wait 4 times longer for the forgejo cascade pull request to complete Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/988 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/cascade-forgejo.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index c1c09565..992fe215 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -106,4 +106,5 @@ jobs: close: true verbose: ${{ vars.VERBOSE == 'yes' }} debug: ${{ vars.DEBUG == 'yes' }} + wait-iteration: 120 update: .forgejo/cascading-forgejo From f728f8a923be4d7cd0096a4ccf62af577f34f4e6 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 11 Sep 2025 20:03:17 +0000 Subject: [PATCH 16/99] fix: if the Forgejo instance failed a job, cancel it (#986) - when the Forgejo instance stops a job because it runs for too long, it will be reported back as failed and it must be stopped, exactly as if it was canceled from the web UI by the user. - add test coverage for Reporter.ReportState - extract Reporter.Outputs output of Reporter.ReportState Resolves https://code.forgejo.org/forgejo/runner/issues/980 --- Manual testing with a locally built Forgejo instance built to check every minute instead of every 30 minutes, with ```ini [actions] ENABLED = true ENDLESS_TASK_TIMEOUT = 1m ``` and the following workflow: ```yaml on: [push] jobs: test: runs-on: docker steps: - run: sleep 60 - run: sleep 61 - run: sleep 62 ``` waiting in front of the screen and watching the logs of the runner, I see it stops before `sleep 62` is complete. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/986): fix: if the Forgejo instance failed a job, cancel it Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/986 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/reporter.go | 22 ++++-- internal/pkg/report/reporter_test.go | 106 +++++++++++++++++++++++++++ 2 files changed, 120 insertions(+), 8 deletions(-) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 68fa3db4..3233cb2a 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -209,6 +209,17 @@ func (r *Reporter) logf(format string, a ...any) { } } +func (r *Reporter) GetOutputs() map[string]string { + outputs := make(map[string]string) + r.outputs.Range(func(k, v any) bool { + if val, ok := v.(string); ok { + outputs[k.(string)] = val + } + return true + }) + return outputs +} + func (r *Reporter) SetOutputs(outputs map[string]string) error { r.stateMu.Lock() defer r.stateMu.Unlock() @@ -360,13 +371,7 @@ func (r *Reporter) ReportState() error { state := proto.Clone(r.state).(*runnerv1.TaskState) r.stateMu.RUnlock() - outputs := make(map[string]string) - r.outputs.Range(func(k, v any) bool { - if val, ok := v.(string); ok { - outputs[k.(string)] = val - } - return true - }) + outputs := r.GetOutputs() resp, err := r.client.UpdateTask(r.ctx, connect.NewRequest(&runnerv1.UpdateTaskRequest{ State: state, @@ -380,7 +385,8 @@ func (r *Reporter) ReportState() error { r.outputs.Store(k, struct{}{}) } - if resp.Msg.GetState().GetResult() == runnerv1.Result_RESULT_CANCELLED { + switch resp.Msg.GetState().GetResult() { + case runnerv1.Result_RESULT_CANCELLED, runnerv1.Result_RESULT_FAILURE: r.cancel() } diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index bbb084b1..65fcbfbe 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -286,6 +286,112 @@ func TestReporter_Fire(t *testing.T) { }) } +func TestReporterReportState(t *testing.T) { + for _, testCase := range []struct { + name string + fixture func(t *testing.T, reporter *Reporter, client *mocks.Client) + assert func(t *testing.T, reporter *Reporter, ctx context.Context, err error) + }{ + { + name: "PartialOutputs", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + outputKey1 := "KEY1" + outputValue1 := "VALUE1" + outputKey2 := "KEY2" + outputValue2 := "VALUE2" + reporter.SetOutputs(map[string]string{ + outputKey1: outputValue1, + outputKey2: outputValue2, + }) + + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{ + SentOutputs: []string{outputKey1}, + }), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.ErrorContains(t, err, "not all logs are submitted 1 remain") + outputs := reporter.GetOutputs() + assert.Equal(t, map[string]string{ + "KEY2": "VALUE2", + }, outputs) + assert.NoError(t, ctx.Err()) + }, + }, + { + name: "AllDone", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{}), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.NoError(t, err) + assert.NoError(t, ctx.Err()) + }, + }, + { + name: "Canceled", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{ + State: &runnerv1.TaskState{ + Result: runnerv1.Result_RESULT_CANCELLED, + }, + }), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.NoError(t, err) + assert.ErrorIs(t, ctx.Err(), context.Canceled) + }, + }, + { + name: "Failed", + fixture: func(t *testing.T, reporter *Reporter, client *mocks.Client) { + t.Helper() + client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) { + t.Logf("Received UpdateTask: %s", req.Msg.String()) + return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{ + State: &runnerv1.TaskState{ + Result: runnerv1.Result_RESULT_FAILURE, + }, + }), nil + }) + }, + assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { + t.Helper() + require.NoError(t, err) + assert.ErrorIs(t, ctx.Err(), context.Canceled) + }, + }, + } { + t.Run(testCase.name, func(t *testing.T) { + client := mocks.NewClient(t) + ctx, cancel := context.WithCancel(context.Background()) + taskCtx, err := structpb.NewStruct(map[string]any{}) + require.NoError(t, err) + reporter := NewReporter(common.WithDaemonContext(ctx, t.Context()), cancel, client, &runnerv1.Task{ + Context: taskCtx, + }, time.Second) + + testCase.fixture(t, reporter, client) + err = reporter.ReportState() + testCase.assert(t, reporter, ctx, err) + }) + } +} + func TestReporterReportLogLost(t *testing.T) { reporter, client, _ := mockReporter(t) reporter.logRows = stringToRows("A") From b6c9da470edcb470b8292e5dce1f30fa935e5e70 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 12 Sep 2025 05:31:59 +0000 Subject: [PATCH 17/99] Update dependency forgejo/release-notes-assistant to v1.4.1 (#989) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/release-notes-assistant](https://code.forgejo.org/forgejo/release-notes-assistant) | patch | `v1.4.0` -> `v1.4.1` | --- ### Release Notes
forgejo/release-notes-assistant (forgejo/release-notes-assistant) ### [`v1.4.1`](https://code.forgejo.org/forgejo/release-notes-assistant/releases/tag/v1.4.1) [Compare Source](https://code.forgejo.org/forgejo/release-notes-assistant/compare/v1.4.0...v1.4.1) - other - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/115): Update action to v2.7.3 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/114): Update module mvdan.cc/gofumpt to v0.9.1 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/113): Update dependency go to v1.24.7 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/112): Update module mvdan.cc/gofumpt to v0.9.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/110): Update module github.com/stretchr/testify to v1.11.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/109): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.4.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/108): Update module golang.org/x/tools/cmd/deadcode to v0.36.0 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/107): Update dependency go to v1.24.6 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/106): Update action to v2.7.2 - [PR](https://code.forgejo.org/forgejo/release-notes-assistant/pulls/105): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.3.1
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/989 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/release-notes-assistant.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml index 92fcccd4..9dc12abe 100644 --- a/.forgejo/workflows/release-notes-assistant.yml +++ b/.forgejo/workflows/release-notes-assistant.yml @@ -12,7 +12,7 @@ on: - labeled env: - RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant + RNA_VERSION: v1.4.1 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant jobs: release-notes: From 19f4dbeb4b1f04cb3eb01e15c459f39327f9a819 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 12 Sep 2025 06:49:16 +0000 Subject: [PATCH 18/99] chore: data.forgejo.org/actions/cascading-pr is the canonical location (#990) ![image](/attachments/28a98026-29ec-41c2-b3c6-c539098e8df6) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/990): chore: data.forgejo.org/actions/cascading-pr is the canonical location Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/990 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/cascade-setup-forgejo.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml index fff2309f..07de78a7 100644 --- a/.forgejo/workflows/cascade-setup-forgejo.yml +++ b/.forgejo/workflows/cascade-setup-forgejo.yml @@ -81,7 +81,7 @@ jobs: container: image: 'code.forgejo.org/oci/node:22-bookworm' steps: - - uses: https://code.forgejo.org/actions/cascading-pr@v2.2.1 + - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1 with: origin-url: ${{ forge.server_url }} origin-repo: ${{ forge.repository }} From 458dae9827f5c2f9f0da45b478e5125d9f915924 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 12 Sep 2025 11:04:10 +0000 Subject: [PATCH 19/99] Update https://data.forgejo.org/actions/cascading-pr action to v2.3.0 (#992) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/cascading-pr](https://code.forgejo.org/actions/cascading-pr) | action | minor | `v2.2.1` -> `v2.3.0` | --- ### Release Notes
actions/cascading-pr (https://data.forgejo.org/actions/cascading-pr) ### [`v2.3.0`](https://code.forgejo.org/actions/cascading-pr/compare/v2.2.1...v2.3.0) [Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.2.1...v2.3.0)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/992 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/cascade-forgejo.yml | 2 +- .forgejo/workflows/cascade-setup-forgejo.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index 992fe215..e88370cc 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -90,7 +90,7 @@ jobs: - uses: actions/setup-go@v5 with: go-version-file: go.mod - - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1 + - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0 with: origin-url: ${{ forge.server_url }} origin-repo: ${{ forge.repository }} diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml index 07de78a7..9292d936 100644 --- a/.forgejo/workflows/cascade-setup-forgejo.yml +++ b/.forgejo/workflows/cascade-setup-forgejo.yml @@ -81,7 +81,7 @@ jobs: container: image: 'code.forgejo.org/oci/node:22-bookworm' steps: - - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1 + - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0 with: origin-url: ${{ forge.server_url }} origin-repo: ${{ forge.repository }} From 3585d6774326fe59607bc8932f1e1e622e99d6bf Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 13 Sep 2025 17:35:56 +0000 Subject: [PATCH 20/99] chore: unify actions URLs in .forgejo/workflows (#993) - make them all absolute - use data.forgejo.org instead of code.forgejo.org This allows renovate to propose more consistent updates. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/993): chore: unify actions URLs in .forgejo/workflows Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/993 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/build-release.yml | 2 +- .forgejo/workflows/cascade-forgejo.yml | 2 +- .forgejo/workflows/example-docker-compose.yml | 2 +- .forgejo/workflows/test.yml | 10 +++++----- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index edeb907c..e57ec989 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -26,7 +26,7 @@ jobs: runs-on: lxc-bookworm if: vars.ROLE == 'forgejo-coding' steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - id: forgejo uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index 6bb6c4b4..12d790ab 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -23,7 +23,7 @@ jobs: # root is used for testing, allow it if: vars.ROLE == 'forgejo-integration' || forge.repository_owner == 'root' steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - name: Increase the verbosity when there are no secrets id: verbose diff --git a/.forgejo/workflows/cascade-forgejo.yml b/.forgejo/workflows/cascade-forgejo.yml index e88370cc..36bc899d 100644 --- a/.forgejo/workflows/cascade-forgejo.yml +++ b/.forgejo/workflows/cascade-forgejo.yml @@ -87,7 +87,7 @@ jobs: with: fetch-depth: '0' show-progress: 'false' - - uses: actions/setup-go@v5 + - uses: https://data.forgejo.org/actions/setup-go@v5 with: go-version-file: go.mod - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0 diff --git a/.forgejo/workflows/example-docker-compose.yml b/.forgejo/workflows/example-docker-compose.yml index dce57a39..c39802ad 100644 --- a/.forgejo/workflows/example-docker-compose.yml +++ b/.forgejo/workflows/example-docker-compose.yml @@ -15,7 +15,7 @@ jobs: if: vars.ROLE == 'forgejo-coding' runs-on: lxc-bookworm steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - name: Install docker run: | diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index d817ae3b..5a1dd4d5 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -59,7 +59,7 @@ jobs: - run: make build - - uses: https://code.forgejo.org/actions/upload-artifact@v3 + - uses: https://data.forgejo.org/actions/upload-artifact@v3 with: name: forgejo-runner path: forgejo-runner @@ -79,9 +79,9 @@ jobs: needs: [build-and-tests] steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - - uses: https://code.forgejo.org/actions/download-artifact@v3 + - uses: https://data.forgejo.org/actions/download-artifact@v3 with: name: forgejo-runner @@ -156,9 +156,9 @@ jobs: needs: [build-and-tests] steps: - - uses: actions/checkout@v4 + - uses: https://data.forgejo.org/actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: https://data.forgejo.org/actions/setup-go@v5 with: go-version-file: go.mod From 2573ccaf19b25bc4420203ecae124e995d387292 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 14 Sep 2025 20:02:43 +0000 Subject: [PATCH 21/99] fix: send job outputs & job result to Forgejo in sync with each other (#995) Fixes #994. First commit ensures that the interpolateResults method is invoked before data is sent to the reporter. Second commit changes how data is sent to the reporter to include both the result and the job outputs. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/995): fix: send job outputs & job result to Forgejo in sync with each other Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/995 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/job_executor.go | 69 ++++--- act/runner/job_executor_test.go | 45 ++++- act/runner/mocks/FieldLogger.go | 264 +++++++++++++++++++++++++++ internal/app/run/runner.go | 1 - internal/pkg/report/reporter.go | 17 +- internal/pkg/report/reporter_test.go | 29 ++- 6 files changed, 374 insertions(+), 51 deletions(-) create mode 100644 act/runner/mocks/FieldLogger.go diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index cb50c84c..7a939930 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -8,6 +8,7 @@ import ( "code.forgejo.org/forgejo/runner/v11/act/common" "code.forgejo.org/forgejo/runner/v11/act/container" "code.forgejo.org/forgejo/runner/v11/act/model" + "github.com/sirupsen/logrus" ) type jobInfo interface { @@ -104,37 +105,40 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo } } - postExecutor = postExecutor.Finally(func(ctx context.Context) error { + setJobResults := func(ctx context.Context) error { jobError := common.JobError(ctx) // Fresh context to ensure job result output works even if prev. context was a cancelled job ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute) defer cancel() setJobResult(ctx, info, rc, jobError == nil) - setJobOutputs(ctx, rc) + return nil + } + + cleanupJob := func(_ context.Context) error { var err error - { - // Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job - ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout) - defer cancel() - logger := common.Logger(ctx) - logger.Debugf("Cleaning up container for job %s", rc.jobContainerName()) - if err = info.stopContainer()(ctx); err != nil { - logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err) - } + // Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job + ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout) + defer cancel() - if !rc.IsHostEnv(ctx) && rc.getNetworkCreated(ctx) { - networkName := rc.getNetworkName(ctx) - logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName()) - if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil { - logger.Errorf("Error while cleaning network %s: %v", networkName, err) - } + logger := common.Logger(ctx) + logger.Debugf("Cleaning up container for job %s", rc.jobContainerName()) + if err = info.stopContainer()(ctx); err != nil { + logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err) + } + + if !rc.IsHostEnv(ctx) && rc.getNetworkCreated(ctx) { + networkName := rc.getNetworkName(ctx) + logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName()) + if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil { + logger.Errorf("Error while cleaning network %s: %v", networkName, err) } } + return err - }) + } pipeline := make([]common.Executor, 0) pipeline = append(pipeline, preSteps...) @@ -152,6 +156,8 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo return postExecutor(ctx) }). Finally(info.interpolateOutputs()). + Finally(setJobResults). + Finally(cleanupJob). Finally(info.closeContainer())) } @@ -185,22 +191,27 @@ func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success boo jobResultMessage = "failed" } - logger.WithField("jobResult", jobResult).Infof("\U0001F3C1 Job %s", jobResultMessage) -} - -func setJobOutputs(ctx context.Context, rc *RunContext) { + jobOutputs := rc.Run.Job().Outputs if rc.caller != nil { - // map outputs for reusable workflows - callerOutputs := make(map[string]string) - + // Rewrite the job's outputs into the workflow_call outputs... + jobOutputs = make(map[string]string) ee := rc.NewExpressionEvaluator(ctx) - for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs { - callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) + jobOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) } - - rc.caller.runContext.Run.Job().Outputs = callerOutputs + // When running as a daemon and receiving jobs from Forgejo, the next job (and any of it's `needs` outputs) will + // be provided by Forgejo based upon the data sent to the logger below. However, when running `forgejo-runner + // exec` with a reusable workflow, the next job will only be able to read outputs if those outputs are stored on + // the workflow -- that's what is accomplished here: + rc.caller.runContext.Run.Job().Outputs = jobOutputs } + + logger. + WithFields(logrus.Fields{ + "jobResult": jobResult, + "jobOutputs": jobOutputs, + }). + Infof("\U0001F3C1 Job %s", jobResultMessage) } func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor { diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index e42bf610..fe40df0f 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -12,10 +12,14 @@ import ( "code.forgejo.org/forgejo/runner/v11/act/common" "code.forgejo.org/forgejo/runner/v11/act/container" "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/act/runner/mocks" + "github.com/sirupsen/logrus" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" ) +//go:generate mockery --srcpkg=github.com/sirupsen/logrus --name=FieldLogger + func TestJobExecutor(t *testing.T) { tables := []TestJobFileInfo{ {workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets}, @@ -127,8 +131,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { executedSteps: []string{ "startContainer", "step1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -144,8 +149,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { executedSteps: []string{ "startContainer", "step1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "failure", @@ -162,8 +168,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "startContainer", "pre1", "step1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -180,8 +187,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "startContainer", "step1", "post1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -199,8 +207,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "pre1", "step1", "post1", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -229,8 +238,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { "step3", "post3", "post2", - "stopContainer", "interpolateOutputs", + "setJobResults", + "stopContainer", "closeContainer", }, result: "success", @@ -246,7 +256,27 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { t.Run(tt.name, func(t *testing.T) { fmt.Printf("::group::%s\n", tt.name) - ctx := common.WithJobErrorContainer(t.Context()) + executorOrder := make([]string, 0) + + mockLogger := mocks.NewFieldLogger(t) + mockLogger.On("Debugf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("Warningf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("WithField", mock.Anything, mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + // When `WithFields()` is called with jobResult & jobOutputs field, add `setJobResults` to executorOrder. + mockLogger.On("WithFields", + mock.MatchedBy(func(fields logrus.Fields) bool { + _, okJobResult := fields["jobResult"] + _, okJobOutput := fields["jobOutputs"] + return okJobOutput && okJobResult + })). + Run(func(args mock.Arguments) { + executorOrder = append(executorOrder, "setJobResults") + }). + Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + + mockLogger.On("WithFields", mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + + ctx := common.WithLogger(common.WithJobErrorContainer(t.Context()), mockLogger) jim := &jobInfoMock{} sfm := &stepFactoryMock{} rc := &RunContext{ @@ -262,7 +292,6 @@ func TestJobExecutorNewJobExecutor(t *testing.T) { Config: &Config{}, } rc.ExprEval = rc.NewExpressionEvaluator(ctx) - executorOrder := make([]string, 0) jim.On("steps").Return(tt.steps) diff --git a/act/runner/mocks/FieldLogger.go b/act/runner/mocks/FieldLogger.go new file mode 100644 index 00000000..5cfa5ad2 --- /dev/null +++ b/act/runner/mocks/FieldLogger.go @@ -0,0 +1,264 @@ +// Code generated by mockery v2.53.5. DO NOT EDIT. + +package mocks + +import ( + logrus "github.com/sirupsen/logrus" + mock "github.com/stretchr/testify/mock" +) + +// FieldLogger is an autogenerated mock type for the FieldLogger type +type FieldLogger struct { + mock.Mock +} + +// Debug provides a mock function with given fields: args +func (_m *FieldLogger) Debug(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Debugf provides a mock function with given fields: format, args +func (_m *FieldLogger) Debugf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Debugln provides a mock function with given fields: args +func (_m *FieldLogger) Debugln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Error provides a mock function with given fields: args +func (_m *FieldLogger) Error(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Errorf provides a mock function with given fields: format, args +func (_m *FieldLogger) Errorf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Errorln provides a mock function with given fields: args +func (_m *FieldLogger) Errorln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Fatal provides a mock function with given fields: args +func (_m *FieldLogger) Fatal(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Fatalf provides a mock function with given fields: format, args +func (_m *FieldLogger) Fatalf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Fatalln provides a mock function with given fields: args +func (_m *FieldLogger) Fatalln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Info provides a mock function with given fields: args +func (_m *FieldLogger) Info(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Infof provides a mock function with given fields: format, args +func (_m *FieldLogger) Infof(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Infoln provides a mock function with given fields: args +func (_m *FieldLogger) Infoln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Panic provides a mock function with given fields: args +func (_m *FieldLogger) Panic(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Panicf provides a mock function with given fields: format, args +func (_m *FieldLogger) Panicf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Panicln provides a mock function with given fields: args +func (_m *FieldLogger) Panicln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Print provides a mock function with given fields: args +func (_m *FieldLogger) Print(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Printf provides a mock function with given fields: format, args +func (_m *FieldLogger) Printf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Println provides a mock function with given fields: args +func (_m *FieldLogger) Println(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warn provides a mock function with given fields: args +func (_m *FieldLogger) Warn(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warnf provides a mock function with given fields: format, args +func (_m *FieldLogger) Warnf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warning provides a mock function with given fields: args +func (_m *FieldLogger) Warning(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warningf provides a mock function with given fields: format, args +func (_m *FieldLogger) Warningf(format string, args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, format) + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warningln provides a mock function with given fields: args +func (_m *FieldLogger) Warningln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// Warnln provides a mock function with given fields: args +func (_m *FieldLogger) Warnln(args ...interface{}) { + var _ca []interface{} + _ca = append(_ca, args...) + _m.Called(_ca...) +} + +// WithError provides a mock function with given fields: err +func (_m *FieldLogger) WithError(err error) *logrus.Entry { + ret := _m.Called(err) + + if len(ret) == 0 { + panic("no return value specified for WithError") + } + + var r0 *logrus.Entry + if rf, ok := ret.Get(0).(func(error) *logrus.Entry); ok { + r0 = rf(err) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*logrus.Entry) + } + } + + return r0 +} + +// WithField provides a mock function with given fields: key, value +func (_m *FieldLogger) WithField(key string, value interface{}) *logrus.Entry { + ret := _m.Called(key, value) + + if len(ret) == 0 { + panic("no return value specified for WithField") + } + + var r0 *logrus.Entry + if rf, ok := ret.Get(0).(func(string, interface{}) *logrus.Entry); ok { + r0 = rf(key, value) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*logrus.Entry) + } + } + + return r0 +} + +// WithFields provides a mock function with given fields: fields +func (_m *FieldLogger) WithFields(fields logrus.Fields) *logrus.Entry { + ret := _m.Called(fields) + + if len(ret) == 0 { + panic("no return value specified for WithFields") + } + + var r0 *logrus.Entry + if rf, ok := ret.Get(0).(func(logrus.Fields) *logrus.Entry); ok { + r0 = rf(fields) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*logrus.Entry) + } + } + + return r0 +} + +// NewFieldLogger creates a new instance of FieldLogger. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. +// The first argument is typically a *testing.T value. +func NewFieldLogger(t interface { + mock.TestingT + Cleanup(func()) +}, +) *FieldLogger { + mock := &FieldLogger{} + mock.Mock.Test(t) + + t.Cleanup(func() { mock.AssertExpectations(t) }) + + return mock +} diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 3f2b0127..a1283d61 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -366,7 +366,6 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. } execErr := executor(ctx) - _ = reporter.SetOutputs(job.Outputs) return execErr } diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 3233cb2a..0d1ebadb 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -130,6 +130,11 @@ func (r *Reporter) Fire(entry *log.Entry) error { } } } + if v, ok := entry.Data["jobOutputs"]; ok { + _ = r.setOutputs(v.(map[string]string)) + } else { + log.Panicf("received log entry with jobResult, but without jobOutputs -- outputs will be corrupted for this job") + } } if !r.duringSteps() { r.logRows = appendIfNotNil(r.logRows, r.parseLogRow(entry)) @@ -209,7 +214,7 @@ func (r *Reporter) logf(format string, a ...any) { } } -func (r *Reporter) GetOutputs() map[string]string { +func (r *Reporter) cloneOutputs() map[string]string { outputs := make(map[string]string) r.outputs.Range(func(k, v any) bool { if val, ok := v.(string); ok { @@ -220,10 +225,9 @@ func (r *Reporter) GetOutputs() map[string]string { return outputs } -func (r *Reporter) SetOutputs(outputs map[string]string) error { - r.stateMu.Lock() - defer r.stateMu.Unlock() - +// Errors from setOutputs are logged into the reporter automatically; the `errors` return value is only used for unit +// tests. +func (r *Reporter) setOutputs(outputs map[string]string) error { var errs []error recordError := func(format string, a ...any) { r.logf(format, a...) @@ -369,10 +373,9 @@ func (r *Reporter) ReportState() error { r.stateMu.RLock() state := proto.Clone(r.state).(*runnerv1.TaskState) + outputs := r.cloneOutputs() r.stateMu.RUnlock() - outputs := r.GetOutputs() - resp, err := r.client.UpdateTask(r.ctx, connect.NewRequest(&runnerv1.UpdateTaskRequest{ State: state, Outputs: outputs, diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index 65fcbfbe..a949c01b 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -78,7 +78,7 @@ func TestReporterSetOutputs(t *testing.T) { reporter, _, _ := mockReporter(t) expected := map[string]string{"a": "b", "c": "d"} - assert.NoError(t, reporter.SetOutputs(expected)) + assert.NoError(t, reporter.setOutputs(expected)) assertEqual(t, expected, &reporter.outputs) }) @@ -93,7 +93,7 @@ func TestReporterSetOutputs(t *testing.T) { "c": "ABCDEFG", // value too big "d": "e", } - err := reporter.SetOutputs(in) + err := reporter.setOutputs(in) assert.ErrorContains(t, err, "ignore output because the length of the value for \"c\" is 7 (the maximum is 5)") assert.ErrorContains(t, err, "ignore output because the key is longer than 5: \"0123456\"") expected := map[string]string{"d": "e"} @@ -104,11 +104,11 @@ func TestReporterSetOutputs(t *testing.T) { reporter, _, _ := mockReporter(t) first := map[string]string{"a": "b", "c": "d"} - assert.NoError(t, reporter.SetOutputs(first)) + assert.NoError(t, reporter.setOutputs(first)) assertEqual(t, first, &reporter.outputs) second := map[string]string{"c": "d", "e": "f"} - assert.ErrorContains(t, reporter.SetOutputs(second), "ignore output because a value already exists for the key \"c\"") + assert.ErrorContains(t, reporter.setOutputs(second), "ignore output because a value already exists for the key \"c\"") expected := map[string]string{"a": "b", "c": "d", "e": "f"} assertEqual(t, expected, &reporter.outputs) @@ -284,6 +284,23 @@ func TestReporter_Fire(t *testing.T) { assert.Equal(t, int64(3), reporter.state.Steps[0].LogLength) }) + + t.Run("jobResult jobOutputs extracted from log entry", func(t *testing.T) { + reporter, _, _ := mockReporter(t) + + dataStep0 := map[string]any{ + "stage": "Post", + "stepNumber": 0, + "raw_output": true, + "jobResult": "success", + "jobOutputs": map[string]string{"key1": "value1"}, + } + assert.NoError(t, reporter.Fire(&log.Entry{Message: "success!", Data: dataStep0})) + + assert.EqualValues(t, runnerv1.Result_RESULT_SUCCESS, reporter.state.Result) + value, _ := reporter.outputs.Load("key1") + assert.EqualValues(t, "value1", value) + }) } func TestReporterReportState(t *testing.T) { @@ -300,7 +317,7 @@ func TestReporterReportState(t *testing.T) { outputValue1 := "VALUE1" outputKey2 := "KEY2" outputValue2 := "VALUE2" - reporter.SetOutputs(map[string]string{ + reporter.setOutputs(map[string]string{ outputKey1: outputValue1, outputKey2: outputValue2, }) @@ -315,7 +332,7 @@ func TestReporterReportState(t *testing.T) { assert: func(t *testing.T, reporter *Reporter, ctx context.Context, err error) { t.Helper() require.ErrorContains(t, err, "not all logs are submitted 1 remain") - outputs := reporter.GetOutputs() + outputs := reporter.cloneOutputs() assert.Equal(t, map[string]string{ "KEY2": "VALUE2", }, outputs) From 543f3fd495bec5bf07604c74a9efcc2ba7591c65 Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Mon, 15 Sep 2025 07:26:56 +0000 Subject: [PATCH 22/99] feat: add support for a trixie based Debian GNU/Linux backend (e.g. trixie-lxc:lxc://debian:trixie) (#997) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/35 - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/997): feat: add support for a trixie based Debian GNU/Linux backend (e.g. trixie-lxc:lxc://debian:trixie) Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/997 Reviewed-by: earl-warren Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 2 +- act/runner/lxc-helpers.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index 2f36541f..78d70113 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -413,7 +413,7 @@ function lxc_install_lxc_inside() { local prefixv6="${2:-$LXC_IPV6_PREFIX_DEFAULT}" local packages="make git libvirt0 libpam-cgfs bridge-utils uidmap dnsmasq-base dnsmasq dnsmasq-utils qemu-user-static lxc-templates debootstrap" - if test "$(lxc_release)" = bookworm; then + if test "$(lxc_release)" != bullseye; then packages="$packages distro-info" fi diff --git a/act/runner/lxc-helpers.sh b/act/runner/lxc-helpers.sh index 705c5aab..769e238a 100755 --- a/act/runner/lxc-helpers.sh +++ b/act/runner/lxc-helpers.sh @@ -18,11 +18,11 @@ lxc-helpers.sh - LXC container management helpers SYNOPSIS lxc-helpers.sh [-v|--verbose] [-h|--help] - [-o|--os {bookworm|bullseye} (default bookworm)] + [-o|--os {trixie|bookworm|bullseye} (default bookworm)] command [arguments] lxc-helpers.sh [-v|--verbose] [-h|--help] - [-o|--os {bookworm|bullseye} (default bookworm)] + [-o|--os {trixie|bookworm|bullseye} (default bookworm)] [-c|--config {unprivileged lxc libvirt docker k8s} (default "lxc libvirt docker")] lxc_container_create [arguments] From 5c93da6fc74afb667c8d91854176f9b114e754a8 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 09:14:11 +0000 Subject: [PATCH 23/99] feat: the forgejo context is equivalent to the github context (#999) Resolves forgejo/runner#729 - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/999): feat: the forgejo context is equivalent to the github context Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/999 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/exprparser/interpreter.go | 2 + act/schema/action_schema.json | 7 ++++ act/schema/workflow_schema.json | 65 ++++++++++++++++++++++----------- 3 files changed, 52 insertions(+), 22 deletions(-) diff --git a/act/exprparser/interpreter.go b/act/exprparser/interpreter.go index 8ec3f7b4..26ad9d0e 100644 --- a/act/exprparser/interpreter.go +++ b/act/exprparser/interpreter.go @@ -158,6 +158,8 @@ func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableN return impl.env.Github, nil case "forge": return impl.env.Github, nil + case "forgejo": + return impl.env.Github, nil case "env": return impl.env.Env, nil case "job": diff --git a/act/schema/action_schema.json b/act/schema/action_schema.json index 6a0eabb0..f5252c9c 100644 --- a/act/schema/action_schema.json +++ b/act/schema/action_schema.json @@ -157,6 +157,7 @@ "output-value": { "context": [ "forge", + "forgejo", "github", "strategy", "matrix", @@ -171,6 +172,7 @@ "input-default-context": { "context": [ "forge", + "forgejo", "github", "inputs", "env", @@ -191,6 +193,7 @@ "string-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -207,6 +210,7 @@ "boolean-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -223,6 +227,7 @@ "step-env": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -242,6 +247,7 @@ "step-if": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", @@ -262,6 +268,7 @@ "step-with": { "context": [ "forge", + "forgejo", "github", "inputs", "strategy", diff --git a/act/schema/workflow_schema.json b/act/schema/workflow_schema.json index 826269a8..56e7d5d4 100644 --- a/act/schema/workflow_schema.json +++ b/act/schema/workflow_schema.json @@ -52,7 +52,7 @@ "boolean": {} }, "run-name": { - "context": ["forge", "github", "inputs", "vars"], + "context": ["forge", "forgejo", "github", "inputs", "vars"], "string": {}, "description": "The name for workflow runs generated from the workflow. GitHub displays the workflow run name in the list of workflow runs on your repository's 'Actions' tab.\n\n[Documentation](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#run-name)" }, @@ -1139,7 +1139,7 @@ }, "workflow-call-input-default": { "description": "If a `default` parameter is not set, the default value of the input is `false` for boolean, `0` for a number, and `\"\"` for a string.", - "context": ["forge", "github", "inputs", "vars"], + "context": ["forge", "forgejo", "github", "inputs", "vars"], "one-of": ["string", "boolean", "number"] }, "workflow-call-secrets": { @@ -1201,7 +1201,7 @@ }, "workflow-output-context": { "description": "The value to assign to the output parameter.", - "context": ["forge", "github", "inputs", "vars", "jobs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "jobs"], "string": {} }, "workflow-dispatch-string": { @@ -1402,7 +1402,7 @@ }, "workflow-env": { "description": "A map of environment variables that are available to the steps of all jobs in the workflow. You can also set environment variables that are only available to the steps of a single job or to a single step.\n\n[Documentation](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#env)", - "context": ["forge", "github", "inputs", "vars", "secrets", "env"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "secrets", "env"], "mapping": { "loose-key-type": "non-empty-string", "loose-value-type": "string" @@ -1517,6 +1517,7 @@ "description": "You can use the `if` conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1534,6 +1535,7 @@ "job-if-result": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1548,7 +1550,7 @@ }, "strategy": { "description": "Use `strategy` to use a matrix strategy for your jobs. A matrix strategy lets you use variables in a single job definition to automatically create multiple job runs that are based on the combinations of the variables. ", - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "mapping": { "properties": { "fail-fast": { @@ -1566,6 +1568,7 @@ "fail-fast": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1584,6 +1587,7 @@ "max-parallel": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1630,7 +1634,7 @@ "runs-on": { "description": "Use `runs-on` to define the type of machine to run the job on.\n* The destination machine can be either a GitHub-hosted runner, larger runner, or a self-hosted runner.\n* You can target runners based on the labels assigned to them, or their group membership, or a combination of these.\n* You can provide `runs-on` as a single string or as an array of strings.\n* If you specify an array of strings, your workflow will execute on any runner that matches all of the specified `runs-on` values.\n* If you would like to run your workflow on multiple machines, use `jobs..strategy`.", "required": true, - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": [ "non-empty-string", "sequence-of-non-empty-string", @@ -1656,6 +1660,7 @@ "description": "A map of variables that are available to all steps in the job.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1671,12 +1676,12 @@ }, "workflow-concurrency": { "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression.\n\nYou can also specify `concurrency` at the job level.\n\n[Documentation](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#concurrency)", - "context": ["forge", "github", "inputs", "vars"], + "context": ["forge", "forgejo", "github", "inputs", "vars"], "one-of": ["string", "concurrency-mapping"] }, "job-concurrency": { "description": "Concurrency ensures that only a single job using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the `secrets` context.\n\nYou can also specify `concurrency` at the workflow level.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["non-empty-string", "concurrency-mapping"] }, "concurrency-mapping": { @@ -1697,7 +1702,7 @@ }, "job-environment": { "description": "The environment that the job references. All environment protection rules must pass before a job referencing the environment is sent to a runner.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["string", "job-environment-mapping"] }, "job-environment-mapping": { @@ -1716,7 +1721,7 @@ }, "job-environment-name": { "description": "The name of the environment used by the job.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "string": {} }, "job-defaults": { @@ -1730,6 +1735,7 @@ "job-defaults-run": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1800,6 +1806,7 @@ "step-uses": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1821,6 +1828,7 @@ "job-uses": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1841,6 +1849,7 @@ "step-continue-on-error": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1866,6 +1875,7 @@ "step-if": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1891,6 +1901,7 @@ "step-if-result": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1913,6 +1924,7 @@ "description": "Sets variables for steps to use in the runner environment. You can also set variables for the entire workflow or a job.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1934,6 +1946,7 @@ "step-name": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1953,6 +1966,7 @@ "step-timeout-minutes": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1973,6 +1987,7 @@ "description": "A map of the input parameters defined by the action. Each input parameter is a key/value pair. Input parameters are set as variables. When you specify an input in a workflow file or use a default input value, GitHub creates a variable for the input with the name `INPUT_`. The variable created converts input names to uppercase letters and replaces spaces with `_`.", "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -1993,7 +2008,7 @@ }, "container": { "description": "A container to run any steps in a job that don't already specify a container. If you have steps that use both script and container actions, the container actions will run as sibling containers on the same network with the same volume mounts.\n\nIf you do not set a container, all steps will run directly on the host specified by runs-on unless a step refers to an action configured to run in a container.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["string", "container-mapping"] }, "container-mapping": { @@ -2026,19 +2041,19 @@ }, "services": { "description": "Additional containers to host services for a job in a workflow. These are useful for creating databases or cache services like redis. The runner on the virtual machine will automatically create a network and manage the life cycle of the service containers. When you use a service container for a job or your step uses container actions, you don't need to set port information to access the service. Docker automatically exposes all ports between containers on the same network. When both the job and the action run in a container, you can directly reference the container by its hostname. The hostname is automatically mapped to the service name. When a step does not use a container action, you must access the service using localhost and bind the ports.", - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "mapping": { "loose-key-type": "non-empty-string", "loose-value-type": "services-container" } }, "services-container": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["non-empty-string", "container-mapping"] }, "container-registry-credentials": { "description": "If the image's container registry requires authentication to pull the image, you can use `jobs..container.credentials` to set a map of the username and password. The credentials are the same values that you would provide to the `docker login` command.", - "context": ["forge", "github", "inputs", "vars", "secrets", "env"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "secrets", "env"], "mapping": { "properties": { "username": "non-empty-string", @@ -2064,24 +2079,25 @@ } }, "boolean-needs-context": { - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "boolean": {} }, "number-needs-context": { - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "number": {} }, "string-needs-context": { - "context": ["forge", "github", "inputs", "vars", "needs"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs"], "string": {} }, "scalar-needs-context": { - "context": ["forge", "github", "inputs", "vars", "env", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "env", "needs", "strategy", "matrix"], "one-of": ["string", "boolean", "number"] }, "scalar-needs-context-with-secrets": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2093,24 +2109,25 @@ "one-of": ["string", "boolean", "number"] }, "boolean-strategy-context": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "boolean": {} }, "number-strategy-context": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "number": {} }, "string-strategy-context": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "string": {} }, "job-timeout-minutes": { - "context": ["forge", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], "one-of": ["number", "string"] }, "boolean-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2129,6 +2146,7 @@ "number-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2147,6 +2165,7 @@ "string-runner-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2164,6 +2183,7 @@ "string-runner-context-no-secrets": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", @@ -2180,6 +2200,7 @@ "string-steps-context": { "context": [ "forge", + "forgejo", "github", "inputs", "vars", From b3c603644a29f06d5f2ad5a666da3feea512af61 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 15:26:16 +0200 Subject: [PATCH 24/99] chore: set log level to trace for runner tests --- internal/app/run/runner_test.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index b324b0f5..8e3b9707 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -20,6 +20,10 @@ import ( "github.com/stretchr/testify/require" ) +func init() { + log.SetLevel(log.TraceLevel) +} + func TestExplainFailedGenerateWorkflow(t *testing.T) { logged := "" log := func(message string, args ...any) { From 6877142ba4e3feeccc9e6bfb51900d13202e4de5 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 15:20:53 +0200 Subject: [PATCH 25/99] chore: minimal integration test for the LXC backend --- .forgejo/workflows/test.yml | 5 +++ internal/app/run/runner_test.go | 65 +++++++++++++++++++++++++++++++++ 2 files changed, 70 insertions(+) diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 5a1dd4d5..28ab84b9 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -185,6 +185,11 @@ jobs: EOF apt --quiet install --yes -qq docker.io make + - name: install LXC + run: | + act/runner/lxc-helpers.sh lxc_prepare_environment + act/runner/lxc-helpers.sh lxc_install_lxc_inside 10.39.28 fdb1 + - run: apt-get -q install -qq -y gcc # required for `-race` - run: make integration-test diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 8e3b9707..634fae96 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -13,6 +13,7 @@ import ( "code.forgejo.org/forgejo/runner/v11/internal/pkg/labels" "code.forgejo.org/forgejo/runner/v11/internal/pkg/report" "connectrpc.com/connect" + log "github.com/sirupsen/logrus" "google.golang.org/protobuf/types/known/structpb" "github.com/stretchr/testify/assert" @@ -341,3 +342,67 @@ jobs: runWorkflow(ctx, cancel, checkKey2Yaml, "push", "refs/heads/main", "step 5: push cache should not be polluted by PR") }) } + +func TestRunnerLXC(t *testing.T) { + if testing.Short() { + t.Skip("skipping integration test") + } + + forgejoClient := &forgejoClientMock{} + + forgejoClient.On("Address").Return("https://127.0.0.1:8080") // not expected to be used in this test + forgejoClient.On("UpdateLog", mock.Anything, mock.Anything).Return(nil, nil) + forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). + Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + + runner := NewRunner( + &config.Config{ + Log: config.Log{ + JobLevel: "trace", + }, + Host: config.Host{ + WorkdirParent: t.TempDir(), + }, + }, + &config.Registration{ + Labels: []string{"lxc:lxc://debian:bookworm"}, + }, + forgejoClient) + require.NotNil(t, runner) + + runWorkflow := func(ctx context.Context, cancel context.CancelFunc, yamlContent, eventName, ref, description string) { + task := &runnerv1.Task{ + WorkflowPayload: []byte(yamlContent), + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "token": structpb.NewStringValue("some token here"), + "forgejo_default_actions_url": structpb.NewStringValue("https://data.forgejo.org"), + "repository": structpb.NewStringValue("runner"), + "event_name": structpb.NewStringValue(eventName), + "ref": structpb.NewStringValue(ref), + }, + }, + } + + reporter := report.NewReporter(ctx, cancel, forgejoClient, task, time.Second) + err := runner.run(ctx, task, reporter) + reporter.Close(nil) + require.NoError(t, err, description) + } + + t.Run("OK", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: lxc + steps: + - run: echo OK +` + runWorkflow(ctx, cancel, workflow, "push", "refs/heads/main", "OK") + }) +} From 69df253e4180ca065ea99bf30555e6939cd85d31 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 15 Sep 2025 17:17:44 +0200 Subject: [PATCH 26/99] fix: ptyWriter.AutoStop is used by multiple goroutines ``` WARNING: DATA RACE Write at 0x00c0008541d8 by goroutine 9324: code.forgejo.org/forgejo/runner/v11/act/container.(*HostEnvironment).exec() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:368 +0x12dd code.forgejo.org/forgejo/runner/v11/act/runner.(*stepRun).main.func1.(*HostEnvironment).ExecWithCmdLine.1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:388 +0x354 Previous read at 0x00c0008541d8 by goroutine 9328: code.forgejo.org/forgejo/runner/v11/act/container.(*ptyWriter).Write() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:199 +0x57 io.copyBuffer() /home/debian/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.7.linux-amd64/src/io/io.go:431 +0x2ce Goroutine 9324 (running) created at: code.forgejo.org/forgejo/runner/v11/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/common/executor.go:105 +0x144 code.forgejo.org/forgejo/runner/v11/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/common/executor.go:107 +0x61 code.forgejo.org/forgejo/runner/v11/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/common/executor.go:109 +0x4f Goroutine 9328 (running) created at: code.forgejo.org/forgejo/runner/v11/act/container.(*HostEnvironment).exec() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:356 +0x112a code.forgejo.org/forgejo/runner/v11/act/runner.(*stepRun).main.func1.(*HostEnvironment).ExecWithCmdLine.1() /home/debian/.cache/act/37b13738279f9342/hostexecutor/act/container/host_environment.go:388 +0x354 code.forgejo.org/forgejo/runner/v11/act/runner.(*stepRun).main.func1() ``` --- act/container/host_environment.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 0e12fa3a..2a8ee318 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -13,6 +13,7 @@ import ( "path/filepath" "runtime" "strings" + "sync/atomic" "time" "github.com/go-git/go-billy/v5/helper/polyfill" @@ -191,12 +192,12 @@ func (e *HostEnvironment) Start(_ bool) common.Executor { type ptyWriter struct { Out io.Writer - AutoStop bool + AutoStop atomic.Bool dirtyLine bool } func (w *ptyWriter) Write(buf []byte) (int, error) { - if w.AutoStop && len(buf) > 0 && buf[len(buf)-1] == 4 { + if w.AutoStop.Load() && len(buf) > 0 && buf[len(buf)-1] == 4 { n, err := w.Out.Write(buf[:len(buf)-1]) if err != nil { return n, err @@ -365,7 +366,7 @@ func (e *HostEnvironment) exec(ctx context.Context, commandparam []string, cmdli return fmt.Errorf("RUN %w", err) } if tty != nil { - writer.AutoStop = true + writer.AutoStop.Store(true) if _, err := tty.Write([]byte("\x04")); err != nil { common.Logger(ctx).Debug("Failed to write EOT") } From d98522a2b6bc321ece729695d49223b73540d451 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 16 Sep 2025 13:20:43 +0000 Subject: [PATCH 27/99] Update dependency forgejo/lxc-helpers to v1.1.0 (#1001) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers) | minor | `1.0.3` -> `1.1.0` | --- ### Release Notes
forgejo/lxc-helpers (forgejo/lxc-helpers) ### [`v1.1.0`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.0.3...v1.1.0) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.0.3...v1.1.0)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1001 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index ac7ae172..d49940a0 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -20,7 +20,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_TOKEN:=} : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} -DEFAULT_LXC_HELPERS_VERSION=1.0.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers +DEFAULT_LXC_HELPERS_VERSION=1.1.0 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} DEFAULT_RUNNER_VERSION=11.0.0 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} From e1e7d0e85aac1fc4cc451f6f4205ffa635edc3be Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Tue, 16 Sep 2025 19:42:04 +0000 Subject: [PATCH 28/99] fix: remove LXC working directory when it completes (#1003) The working directory was not cleaned up upon completion of a LXC job because rc.stopJobContainer() -> rc.cleanUpJobContainer() -> rc.JobContainer.Remove() was never called for LXC containers. - stopContainer() and closeContainer() must not call rc.stopHostEnvironment(ctx) for LXC containers because - it will needlessly be called twice - it intercepts the call to - rc.stopJobContainer() - rc.JobContainer.Close() - rc.stopHostEnvironment(ctx) must be called in rc.cleanUpJobContainer which is indirectly called by rc.stopJobContainer() - since rc.JobContainer.Close() is a noop, not calling it for LXC containers had no consequence Resolves forgejo/runner#442 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1003): fix: remove LXC working directory when it completes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1003 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/host_environment.go | 1 + act/runner/run_context.go | 16 +++++++++------- internal/app/run/runner_test.go | 15 ++++++++++++++- 3 files changed, 24 insertions(+), 8 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 2a8ee318..405862a9 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -407,6 +407,7 @@ func (e *HostEnvironment) Remove() common.Executor { if e.CleanUp != nil { e.CleanUp() } + common.Logger(ctx).Debugf("HostEnvironment.Remove %s", e.Path) return os.RemoveAll(e.Path) } } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 698fa0b4..bf74a92f 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -316,7 +316,15 @@ func (rc *RunContext) startHostEnvironment() common.Executor { StdOut: logWriter, LXC: rc.IsLXCHostEnv(ctx), } - rc.cleanUpJobContainer = rc.JobContainer.Remove() + rc.cleanUpJobContainer = func(ctx context.Context) error { + if err := rc.stopHostEnvironment(ctx); err != nil { + return err + } + if rc.JobContainer == nil { + return nil + } + return rc.JobContainer.Remove()(ctx) + } for k, v := range rc.JobContainer.GetRunnerContext(ctx) { if v, ok := v.(string); ok { rc.Env[fmt.Sprintf("RUNNER_%s", strings.ToUpper(k))] = v @@ -890,9 +898,6 @@ func (rc *RunContext) IsHostEnv(ctx context.Context) bool { func (rc *RunContext) stopContainer() common.Executor { return func(ctx context.Context) error { - if rc.IsLXCHostEnv(ctx) { - return rc.stopHostEnvironment(ctx) - } return rc.stopJobContainer()(ctx) } } @@ -900,9 +905,6 @@ func (rc *RunContext) stopContainer() common.Executor { func (rc *RunContext) closeContainer() common.Executor { return func(ctx context.Context) error { if rc.JobContainer != nil { - if rc.IsLXCHostEnv(ctx) { - return rc.stopHostEnvironment(ctx) - } return rc.JobContainer.Close()(ctx) } return nil diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 634fae96..65690832 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "os" "testing" "time" @@ -355,13 +356,14 @@ func TestRunnerLXC(t *testing.T) { forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + workdirParent := t.TempDir() runner := NewRunner( &config.Config{ Log: config.Log{ JobLevel: "trace", }, Host: config.Host{ - WorkdirParent: t.TempDir(), + WorkdirParent: workdirParent, }, }, &config.Registration{ @@ -388,6 +390,17 @@ func TestRunnerLXC(t *testing.T) { err := runner.run(ctx, task, reporter) reporter.Close(nil) require.NoError(t, err, description) + // verify there are no leftovers + assertDirectoryEmpty := func(t *testing.T, dir string) { + f, err := os.Open(dir) + require.NoError(t, err) + defer f.Close() + + names, err := f.Readdirnames(-1) + require.NoError(t, err) + assert.Empty(t, names) + } + assertDirectoryEmpty(t, workdirParent) } t.Run("OK", func(t *testing.T) { From aaf9dea44afa042f5093538cb8bcdf3c53b5ef9e Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 12:48:52 +0000 Subject: [PATCH 29/99] fix: do not save .runner unless it is modified (#1006) Resolves forgejo/runner#548 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1006): fix: do not save .runner unless it is modified Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1006 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- go.mod | 2 +- internal/pkg/config/registration.go | 23 ++++++++- internal/pkg/config/registration_test.go | 63 ++++++++++++++++++++++++ 3 files changed, 85 insertions(+), 3 deletions(-) create mode 100644 internal/pkg/config/registration_test.go diff --git a/go.mod b/go.mod index 60ac1f9b..d1763deb 100644 --- a/go.mod +++ b/go.mod @@ -19,6 +19,7 @@ require ( github.com/go-git/go-billy/v5 v5.6.2 github.com/go-git/go-git/v5 v5.16.2 github.com/gobwas/glob v0.2.3 + github.com/google/go-cmp v0.7.0 github.com/google/uuid v1.6.0 github.com/joho/godotenv v1.5.1 github.com/julienschmidt/httprouter v1.3.0 @@ -62,7 +63,6 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/go-viper/mapstructure/v2 v2.4.0 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect - github.com/google/go-cmp v0.7.0 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect diff --git a/internal/pkg/config/registration.go b/internal/pkg/config/registration.go index be66b4fb..14d592bd 100644 --- a/internal/pkg/config/registration.go +++ b/internal/pkg/config/registration.go @@ -1,3 +1,4 @@ +// Copyright 2025 The Forgejo Authors. All rights reserved. // Copyright 2023 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT @@ -6,6 +7,8 @@ package config import ( "encoding/json" "os" + + "github.com/google/go-cmp/cmp" ) const registrationWarning = "This file is automatically generated by act-runner. Do not edit it manually unless you know what you are doing. Removing this file will cause act runner to re-register as a new runner." @@ -34,12 +37,28 @@ func LoadRegistration(file string) (*Registration, error) { return nil, err } - reg.Warning = "" - return ®, nil } +func isEqualRegistration(file string, reg *Registration) (bool, error) { + existing, err := LoadRegistration(file) + if err != nil { + if os.IsNotExist(err) { + return false, nil + } + return false, err + } + return cmp.Equal(*reg, *existing), nil +} + func SaveRegistration(file string, reg *Registration) error { + equal, err := isEqualRegistration(file, reg) + if err != nil { + return err + } + if equal { + return nil + } f, err := os.Create(file) if err != nil { return err diff --git a/internal/pkg/config/registration_test.go b/internal/pkg/config/registration_test.go new file mode 100644 index 00000000..fe89410b --- /dev/null +++ b/internal/pkg/config/registration_test.go @@ -0,0 +1,63 @@ +// Copyright 2025 The Forgejo Authors. All rights reserved. +// SPDX-License-Identifier: GPL-3.0-or-later + +package config + +import ( + "os" + "path/filepath" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestConfig_Registration(t *testing.T) { + reg := Registration{ + Warning: registrationWarning, + ID: 1234, + UUID: "UUID", + Name: "NAME", + Token: "TOKEN", + Address: "ADDRESS", + Labels: []string{"LABEL1", "LABEL2"}, + } + + file := filepath.Join(t.TempDir(), ".runner") + + // when the file does not exist, it is never equal + equal, err := isEqualRegistration(file, ®) + require.NoError(t, err) + assert.False(t, equal) + + require.NoError(t, SaveRegistration(file, ®)) + + regReloaded, err := LoadRegistration(file) + require.NoError(t, err) + assert.Equal(t, reg, *regReloaded) + + equal, err = isEqualRegistration(file, ®) + require.NoError(t, err) + assert.True(t, equal) + + // if the registration is not modified, it is not saved + time.Sleep(2 * time.Second) // file system precision on modification time is one second + before, err := os.Stat(file) + require.NoError(t, err) + require.NoError(t, SaveRegistration(file, ®)) + after, err := os.Stat(file) + require.NoError(t, err) + assert.Equal(t, before.ModTime(), after.ModTime()) + + reg.Labels = []string{"LABEL3"} + equal, err = isEqualRegistration(file, ®) + require.NoError(t, err) + assert.False(t, equal) + + // if the registration is modified, it is saved + require.NoError(t, SaveRegistration(file, ®)) + after, err = os.Stat(file) + require.NoError(t, err) + assert.NotEqual(t, before.ModTime(), after.ModTime()) +} From 89f37985bdd8d56601ac837d253e061380666987 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 16:40:31 +0000 Subject: [PATCH 30/99] feat: validate --directory alternative to --repository to not clone (#1008) Resolves forgejo/forgejo-actions-feature-requests#51 --- Note to reviewers: while working on fixing the exit status of the validate command, a border case was discovered when using `--clonedir . --repository .` by which it will not find an `action.yml` file at the root of the directory. It will be easier to fix and test using a `--directory` option designed to use a pre-existing directory instead because it is not a border case but the most common case really. - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1008): feat: validate --directory alternative to --repository to not clone Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1008 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .../.forgejo/workflows/workflow1.yml | 6 ++ .../validate/bad-directory/action.yml | 67 +++++++++++++++++++ .../.forgejo/workflows/action.yml | 6 ++ .../.forgejo/workflows/workflow1.yml | 6 ++ .../.forgejo/workflows/workflow2.yaml | 6 ++ .../good-directory/.gitea/workflows/bad.yml | 6 ++ .../good-directory/.github/workflows/bad.yml | 6 ++ .../validate/good-directory/action.yml | 67 +++++++++++++++++++ .../good-directory/subaction/action.yaml | 67 +++++++++++++++++++ .../testdata/validate/make-repositories.sh | 8 +++ internal/app/cmd/validate.go | 27 ++++++-- internal/app/cmd/validate_test.go | 27 +++++++- 12 files changed, 293 insertions(+), 6 deletions(-) create mode 100644 internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml create mode 100644 internal/app/cmd/testdata/validate/bad-directory/action.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/action.yml create mode 100644 internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml diff --git a/internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml b/internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml new file mode 100644 index 00000000..802c1a24 --- /dev/null +++ b/internal/app/cmd/testdata/validate/bad-directory/.forgejo/workflows/workflow1.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + ruins-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/bad-directory/action.yml b/internal/app/cmd/testdata/validate/bad-directory/action.yml new file mode 100644 index 00000000..6f70f275 --- /dev/null +++ b/internal/app/cmd/testdata/validate/bad-directory/action.yml @@ -0,0 +1,67 @@ +name: 'Forgejo release download and upload' +author: 'Forgejo authors' +description: | + Upload or download the assets of a release to a Forgejo instance. +inputs: + badinput: scalarinsteadofmap + url: + description: 'URL of the Forgejo instance' + default: '${{ env.FORGEJO_SERVER_URL }}' + repo: + description: 'owner/project relative to the URL' + default: '${{ forge.repository }}' + tag: + description: 'Tag of the release' + default: '${{ forge.ref_name }}' + title: + description: 'Title of the release (defaults to tag)' + sha: + description: 'SHA of the release' + default: '${{ forge.sha }}' + token: + description: 'Forgejo application token' + default: '${{ forge.token }}' + release-dir: + description: 'Directory in whichs release assets are uploaded or downloaded' + required: true + release-notes: + description: 'Release notes' + direction: + description: 'Can either be `download` or `upload`' + required: true + gpg-private-key: + description: 'GPG Private Key to sign the release artifacts' + gpg-passphrase: + description: 'Passphrase of the GPG Private Key' + download-retry: + description: 'Number of times to retry if the release is not ready (default 1)' + download-latest: + description: 'Download the latest release' + default: false + verbose: + description: 'Increase the verbosity level' + default: false + override: + description: 'Override an existing release by the same `{tag}`' + default: false + prerelease: + description: 'Mark Release as Pre-Release' + default: false + release-notes-assistant: + description: 'Generate release notes with Release Notes Assistant' + default: false + hide-archive-link: + description: 'Hide the archive links' + default: false + +runs: + using: "composite" + steps: + - if: ${{ inputs.release-notes-assistant }} + uses: https://data.forgejo.org/actions/cache@v4 + with: + key: rna-${{ inputs.repo }} + path: ${{ forge.action_path }}/rna + + - run: echo "${{ forge.action_path }}" >> $FORGEJO_PATH + shell: bash diff --git a/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml new file mode 100644 index 00000000..efdc13fc --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/action.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + runs-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml new file mode 100644 index 00000000..efdc13fc --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow1.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + runs-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml new file mode 100644 index 00000000..efdc13fc --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.forgejo/workflows/workflow2.yaml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + runs-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml b/internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml new file mode 100644 index 00000000..802c1a24 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.gitea/workflows/bad.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + ruins-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml b/internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml new file mode 100644 index 00000000..802c1a24 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/.github/workflows/bad.yml @@ -0,0 +1,6 @@ +on: [push] +jobs: + test: + ruins-on: docker + steps: + - run: echo All good! diff --git a/internal/app/cmd/testdata/validate/good-directory/action.yml b/internal/app/cmd/testdata/validate/good-directory/action.yml new file mode 100644 index 00000000..cb66d230 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/action.yml @@ -0,0 +1,67 @@ +# SPDX-License-Identifier: MIT +name: 'Forgejo release download and upload' +author: 'Forgejo authors' +description: | + Upload or download the assets of a release to a Forgejo instance. +inputs: + url: + description: 'URL of the Forgejo instance' + default: '${{ env.FORGEJO_SERVER_URL }}' + repo: + description: 'owner/project relative to the URL' + default: '${{ forge.repository }}' + tag: + description: 'Tag of the release' + default: '${{ forge.ref_name }}' + title: + description: 'Title of the release (defaults to tag)' + sha: + description: 'SHA of the release' + default: '${{ forge.sha }}' + token: + description: 'Forgejo application token' + default: '${{ forge.token }}' + release-dir: + description: 'Directory in whichs release assets are uploaded or downloaded' + required: true + release-notes: + description: 'Release notes' + direction: + description: 'Can either be `download` or `upload`' + required: true + gpg-private-key: + description: 'GPG Private Key to sign the release artifacts' + gpg-passphrase: + description: 'Passphrase of the GPG Private Key' + download-retry: + description: 'Number of times to retry if the release is not ready (default 1)' + download-latest: + description: 'Download the latest release' + default: false + verbose: + description: 'Increase the verbosity level' + default: false + override: + description: 'Override an existing release by the same `{tag}`' + default: false + prerelease: + description: 'Mark Release as Pre-Release' + default: false + release-notes-assistant: + description: 'Generate release notes with Release Notes Assistant' + default: false + hide-archive-link: + description: 'Hide the archive links' + default: false + +runs: + using: "composite" + steps: + - if: ${{ inputs.release-notes-assistant }} + uses: https://data.forgejo.org/actions/cache@v4 + with: + key: rna-${{ inputs.repo }} + path: ${{ forge.action_path }}/rna + + - run: echo "${{ forge.action_path }}" >> $FORGEJO_PATH + shell: bash diff --git a/internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml b/internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml new file mode 100644 index 00000000..cb66d230 --- /dev/null +++ b/internal/app/cmd/testdata/validate/good-directory/subaction/action.yaml @@ -0,0 +1,67 @@ +# SPDX-License-Identifier: MIT +name: 'Forgejo release download and upload' +author: 'Forgejo authors' +description: | + Upload or download the assets of a release to a Forgejo instance. +inputs: + url: + description: 'URL of the Forgejo instance' + default: '${{ env.FORGEJO_SERVER_URL }}' + repo: + description: 'owner/project relative to the URL' + default: '${{ forge.repository }}' + tag: + description: 'Tag of the release' + default: '${{ forge.ref_name }}' + title: + description: 'Title of the release (defaults to tag)' + sha: + description: 'SHA of the release' + default: '${{ forge.sha }}' + token: + description: 'Forgejo application token' + default: '${{ forge.token }}' + release-dir: + description: 'Directory in whichs release assets are uploaded or downloaded' + required: true + release-notes: + description: 'Release notes' + direction: + description: 'Can either be `download` or `upload`' + required: true + gpg-private-key: + description: 'GPG Private Key to sign the release artifacts' + gpg-passphrase: + description: 'Passphrase of the GPG Private Key' + download-retry: + description: 'Number of times to retry if the release is not ready (default 1)' + download-latest: + description: 'Download the latest release' + default: false + verbose: + description: 'Increase the verbosity level' + default: false + override: + description: 'Override an existing release by the same `{tag}`' + default: false + prerelease: + description: 'Mark Release as Pre-Release' + default: false + release-notes-assistant: + description: 'Generate release notes with Release Notes Assistant' + default: false + hide-archive-link: + description: 'Hide the archive links' + default: false + +runs: + using: "composite" + steps: + - if: ${{ inputs.release-notes-assistant }} + uses: https://data.forgejo.org/actions/cache@v4 + with: + key: rna-${{ inputs.repo }} + path: ${{ forge.action_path }}/rna + + - run: echo "${{ forge.action_path }}" >> $FORGEJO_PATH + shell: bash diff --git a/internal/app/cmd/testdata/validate/make-repositories.sh b/internal/app/cmd/testdata/validate/make-repositories.sh index 6f3918ee..0047cb4c 100755 --- a/internal/app/cmd/testdata/validate/make-repositories.sh +++ b/internal/app/cmd/testdata/validate/make-repositories.sh @@ -35,6 +35,10 @@ git clone --bare $tmpdir/good good-repository rm -fr good-repository/hooks touch good-repository/refs/placeholder +rm -fr good-directory +git clone $tmpdir/good good-directory +rm -fr good-directory/.git + # bad mkdir $tmpdir/bad @@ -54,3 +58,7 @@ rm -fr bad-repository git clone --bare $tmpdir/bad bad-repository rm -fr bad-repository/hooks touch bad-repository/refs/placeholder + +rm -fr bad-directory +git clone $tmpdir/bad bad-directory +rm -fr bad-directory/.git diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index ca5ab732..474ff56f 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -23,6 +23,7 @@ type validateArgs struct { path string repository string clonedir string + directory string workflow bool action bool } @@ -145,8 +146,16 @@ func validateRepository(validateArgs *validateArgs) error { return nil } +func processDirectory(validateArgs *validateArgs) { + if len(validateArgs.directory) > 0 { + validateArgs.repository = validateArgs.directory + validateArgs.clonedir = validateArgs.directory + } +} + func runValidate(_ context.Context, validateArgs *validateArgs) func(cmd *cobra.Command, args []string) error { return func(cmd *cobra.Command, args []string) error { + processDirectory(validateArgs) if len(validateArgs.path) > 0 { return validatePath(validateArgs) } else if len(validateArgs.repository) > 0 { @@ -168,9 +177,15 @@ Validate workflows or actions with a schema verifying they are conformant. The --path argument is a filename that will be validated as a workflow (if the --workflow flag is set) or as an action (if the --action flag is set). -The --repository argument is a URL to a Git repository. It will be -cloned (in the --clonedir directory or a temporary location removed -when the validation completes). The following files will be validated: +The --repository argument is a URL to a Git repository that contains +workflows or actions. It will be cloned (in the --clonedir directory +or a temporary location removed when the validation completes). + +The --directory argument is the path a repository to be explored for +files to validate. + +The following files will be validated when exploring the clone of a repository +(--repository) or a directory (--directory): - All .forgejo/workflows/*.{yml,yaml} files as workflows - All **/action.{yml,yaml} files as actions @@ -185,9 +200,11 @@ when the validation completes). The following files will be validated: validateCmd.Flags().StringVar(&validateArgs.clonedir, "clonedir", "", "directory in which the repository will be cloned") validateCmd.Flags().StringVar(&validateArgs.repository, "repository", "", "URL to a repository to validate") + validateCmd.Flags().StringVar(&validateArgs.directory, "directory", "", "directory to a repository to validate") validateCmd.Flags().StringVar(&validateArgs.path, "path", "", "path to the file") - validateCmd.MarkFlagsOneRequired("repository", "path") - validateCmd.MarkFlagsMutuallyExclusive("repository", "path") + validateCmd.MarkFlagsOneRequired("repository", "path", "directory") + validateCmd.MarkFlagsMutuallyExclusive("repository", "path", "directory") + validateCmd.MarkFlagsMutuallyExclusive("directory", "clonedir") return validateCmd } diff --git a/internal/app/cmd/validate_test.go b/internal/app/cmd/validate_test.go index 7442d1d2..8a7c6c71 100644 --- a/internal/app/cmd/validate_test.go +++ b/internal/app/cmd/validate_test.go @@ -27,10 +27,20 @@ func Test_validateCmd(t *testing.T) { message: "one of --workflow or --action must be set", }, { - name: "MutuallyExclusive", + name: "MutuallyExclusiveActionWorkflow", args: []string{"--action", "--workflow", "--path", "/tmp"}, message: "[action workflow] were all set", }, + { + name: "MutuallyExclusiveRepositoryDirectory", + args: []string{"--repository", "example.com", "--directory", "."}, + message: "[directory repository] were all set", + }, + { + name: "MutuallyExclusiveClonedirDirectory", + args: []string{"--clonedir", ".", "--directory", "."}, + message: "[clonedir directory] were all set", + }, { name: "PathActionOK", args: []string{"--action", "--path", "testdata/validate/good-action.yml"}, @@ -51,6 +61,21 @@ func Test_validateCmd(t *testing.T) { args: []string{"--workflow", "--path", "testdata/validate/bad-workflow.yml"}, stdOut: "Unknown Property ruins-on", }, + { + name: "DirectoryOK", + args: []string{"--directory", "testdata/validate/good-directory"}, + stdOut: "action.yml action schema validation OK\nsubaction/action.yaml action schema validation OK\n.forgejo/workflows/action.yml workflow schema validation OK\n.forgejo/workflows/workflow1.yml workflow schema validation OK\n.forgejo/workflows/workflow2.yaml workflow schema validation OK", + }, + { + name: "DirectoryActionNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: "action.yml action schema validation failed", + }, + { + name: "DirectoryWorkflowNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + }, { name: "RepositoryOK", args: []string{"--repository", "testdata/validate/good-repository"}, From bcf2bfbf2054052e2f48a6dae6c3710bec4abd04 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 15:37:07 +0200 Subject: [PATCH 31/99] fix: find action.y*ml at the root of the directory The lookup of action.y*ml files failed at the root of the directory when specified with . because it does not start with a / when walking the directory. --- internal/app/cmd/validate.go | 17 +++++++++++++---- internal/app/cmd/validate_test.go | 9 +++++++++ 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index 474ff56f..49395000 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -65,8 +65,17 @@ func validatePath(validateArgs *validateArgs) error { return validate("", validateArgs.path, validateArgs.workflow, validateArgs.action) } -func validateHasYamlSuffix(s, suffix string) bool { - return strings.HasSuffix(s, suffix+".yml") || strings.HasSuffix(s, suffix+".yaml") +func validatePathMatch(existing, search string) bool { + if !validateHasYamlSuffix(existing) { + return false + } + existing = strings.TrimSuffix(existing, ".yml") + existing = strings.TrimSuffix(existing, ".yaml") + return existing == search || strings.HasSuffix(existing, "/"+search) +} + +func validateHasYamlSuffix(s string) bool { + return strings.HasSuffix(s, ".yml") || strings.HasSuffix(s, ".yaml") } func validateRepository(validateArgs *validateArgs) error { @@ -107,12 +116,12 @@ func validateRepository(validateArgs *validateArgs) error { } if err := filepath.Walk(clonedir, func(path string, fi fs.FileInfo, err error) error { - if validateHasYamlSuffix(path, "/.forgejo/workflows/action") { + if validatePathMatch(path, ".forgejo/workflows/action") { return nil } isWorkflow := false isAction := true - if validateHasYamlSuffix(path, "/action") { + if validatePathMatch(path, "action") { if err := validate(clonedir, path, isWorkflow, isAction); err != nil { return err } diff --git a/internal/app/cmd/validate_test.go b/internal/app/cmd/validate_test.go index 8a7c6c71..d620128b 100644 --- a/internal/app/cmd/validate_test.go +++ b/internal/app/cmd/validate_test.go @@ -10,6 +10,15 @@ import ( "github.com/stretchr/testify/assert" ) +func Test_validatePathMatch(t *testing.T) { + assert.False(t, validatePathMatch("nosuffix", "nosuffix")) + assert.True(t, validatePathMatch("something.yml", "something")) + assert.True(t, validatePathMatch("something.yaml", "something")) + assert.False(t, validatePathMatch("entire_something.yaml", "something")) + assert.True(t, validatePathMatch("nested/in/directory/something.yaml", "something")) + assert.False(t, validatePathMatch("nested/in/directory/entire_something.yaml", "something")) +} + func Test_validateCmd(t *testing.T) { ctx := context.Background() for _, testCase := range []struct { From 8c6c089a656dc9c720054c0188605f37e8300746 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 17 Sep 2025 15:41:55 +0200 Subject: [PATCH 32/99] fix: forgejo-runner validate exit with error when validation fails Refs forgejo/runner#1002 --- internal/app/cmd/validate.go | 15 ++++++----- internal/app/cmd/validate_test.go | 42 ++++++++++++++++++------------- 2 files changed, 33 insertions(+), 24 deletions(-) diff --git a/internal/app/cmd/validate.go b/internal/app/cmd/validate.go index 49395000..564922cc 100644 --- a/internal/app/cmd/validate.go +++ b/internal/app/cmd/validate.go @@ -50,12 +50,13 @@ func validate(dir, path string, isWorkflow, isAction bool) error { kind = "action" } if err != nil { - fmt.Printf("%s %s schema validation failed:\n%s\n", shortPath, kind, err.Error()) + err = fmt.Errorf("%s %s schema validation failed:\n%s", shortPath, kind, err.Error()) + fmt.Printf("%s\n", err.Error()) } else { fmt.Printf("%s %s schema validation OK\n", shortPath, kind) } - return nil + return err } func validatePath(validateArgs *validateArgs) error { @@ -115,6 +116,8 @@ func validateRepository(validateArgs *validateArgs) error { } } + var validationErrors error + if err := filepath.Walk(clonedir, func(path string, fi fs.FileInfo, err error) error { if validatePathMatch(path, ".forgejo/workflows/action") { return nil @@ -123,7 +126,7 @@ func validateRepository(validateArgs *validateArgs) error { isAction := true if validatePathMatch(path, "action") { if err := validate(clonedir, path, isWorkflow, isAction); err != nil { - return err + validationErrors = errors.Join(validationErrors, err) } } return nil @@ -141,9 +144,9 @@ func validateRepository(validateArgs *validateArgs) error { if err := filepath.Walk(workflowdir, func(path string, fi fs.FileInfo, err error) error { isWorkflow := true isAction := false - if validateHasYamlSuffix(path, "") { + if validateHasYamlSuffix(path) { if err := validate(clonedir, path, isWorkflow, isAction); err != nil { - return err + validationErrors = errors.Join(validationErrors, err) } } return nil @@ -152,7 +155,7 @@ func validateRepository(validateArgs *validateArgs) error { } } - return nil + return validationErrors } func processDirectory(validateArgs *validateArgs) { diff --git a/internal/app/cmd/validate_test.go b/internal/app/cmd/validate_test.go index d620128b..9b132d9f 100644 --- a/internal/app/cmd/validate_test.go +++ b/internal/app/cmd/validate_test.go @@ -56,9 +56,10 @@ func Test_validateCmd(t *testing.T) { stdOut: "schema validation OK", }, { - name: "PathActionNOK", - args: []string{"--action", "--path", "testdata/validate/bad-action.yml"}, - stdOut: "Expected a mapping got scalar", + name: "PathActionNOK", + args: []string{"--action", "--path", "testdata/validate/bad-action.yml"}, + stdOut: "Expected a mapping got scalar", + message: "testdata/validate/bad-action.yml action schema validation failed", }, { name: "PathWorkflowOK", @@ -66,9 +67,10 @@ func Test_validateCmd(t *testing.T) { stdOut: "schema validation OK", }, { - name: "PathWorkflowNOK", - args: []string{"--workflow", "--path", "testdata/validate/bad-workflow.yml"}, - stdOut: "Unknown Property ruins-on", + name: "PathWorkflowNOK", + args: []string{"--workflow", "--path", "testdata/validate/bad-workflow.yml"}, + stdOut: "Unknown Property ruins-on", + message: "testdata/validate/bad-workflow.yml workflow schema validation failed", }, { name: "DirectoryOK", @@ -76,14 +78,16 @@ func Test_validateCmd(t *testing.T) { stdOut: "action.yml action schema validation OK\nsubaction/action.yaml action schema validation OK\n.forgejo/workflows/action.yml workflow schema validation OK\n.forgejo/workflows/workflow1.yml workflow schema validation OK\n.forgejo/workflows/workflow2.yaml workflow schema validation OK", }, { - name: "DirectoryActionNOK", - args: []string{"--directory", "testdata/validate/bad-directory"}, - stdOut: "action.yml action schema validation failed", + name: "DirectoryActionNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: "action.yml action schema validation failed", + message: "action.yml action schema validation failed", }, { - name: "DirectoryWorkflowNOK", - args: []string{"--directory", "testdata/validate/bad-directory"}, - stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + name: "DirectoryWorkflowNOK", + args: []string{"--directory", "testdata/validate/bad-directory"}, + stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + message: ".forgejo/workflows/workflow1.yml workflow schema validation failed", }, { name: "RepositoryOK", @@ -91,14 +95,16 @@ func Test_validateCmd(t *testing.T) { stdOut: "action.yml action schema validation OK\nsubaction/action.yaml action schema validation OK\n.forgejo/workflows/action.yml workflow schema validation OK\n.forgejo/workflows/workflow1.yml workflow schema validation OK\n.forgejo/workflows/workflow2.yaml workflow schema validation OK", }, { - name: "RepositoryActionNOK", - args: []string{"--repository", "testdata/validate/bad-repository"}, - stdOut: "action.yml action schema validation failed", + name: "RepositoryActionNOK", + args: []string{"--repository", "testdata/validate/bad-repository"}, + stdOut: "action.yml action schema validation failed", + message: "action.yml action schema validation failed", }, { - name: "RepositoryWorkflowNOK", - args: []string{"--repository", "testdata/validate/bad-repository"}, - stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + name: "RepositoryWorkflowNOK", + args: []string{"--repository", "testdata/validate/bad-repository"}, + stdOut: ".forgejo/workflows/workflow1.yml workflow schema validation failed", + message: ".forgejo/workflows/workflow1.yml workflow schema validation failed", }, } { t.Run(testCase.name, func(t *testing.T) { From b8ab05e36702c5af27fc3cf585bd557699fed4b3 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 18 Sep 2025 07:19:44 +0000 Subject: [PATCH 33/99] fix: schema validation must accept aliases and merges (#1012) - aliases are an indirection to follow https://yaml.org/spec/1.2.1/#id2785586 - merges cannot be conveniently validated and are skipped https://yaml.org/type/merge.html Resolves forgejo/runner#1011 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1012): fix: schema validation must accept aliases and merges Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1012 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/schema/schema.go | 12 ++++++++++++ act/schema/schema_test.go | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/act/schema/schema.go b/act/schema/schema.go index cbb51283..e1d41e96 100644 --- a/act/schema/schema.go +++ b/act/schema/schema.go @@ -237,6 +237,9 @@ func (s *Node) UnmarshalYAML(node *yaml.Node) error { if node != nil && node.Kind == yaml.DocumentNode { return s.UnmarshalYAML(node.Content[0]) } + if node != nil && node.Kind == yaml.AliasNode { + return s.UnmarshalYAML(node.Alias) + } def := s.Schema.GetDefinition(s.Definition) if s.Context == nil { s.Context = def.Context @@ -360,6 +363,15 @@ func (s *Node) checkMapping(node *yaml.Node, def Definition) error { if node.Kind != yaml.MappingNode { return fmt.Errorf("%sExpected a mapping got %v", formatLocation(node), getStringKind(node.Kind)) } + // merges cannot be conveniently validated and are skipped + // https://yaml.org/type/merge.html + for i, n := range node.Content { + if i%2 == 0 { + if n.Kind == yaml.ScalarNode && n.Value == "<<" && (n.Tag == "" || n.ShortTag() == "!!merge") { + return nil + } + } + } insertDirective := regexp.MustCompile(`\${{\s*insert\s*}}`) var allErrors error for i, k := range node.Content { diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index dc54834e..2e77f3b7 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -243,3 +243,39 @@ runs: }) } } + +// https://yaml.org/spec/1.2.1/#id2785586 +// An anchor is denoted by the β€œ&” indicator. It marks a node for future reference. +// https://yaml.org/type/merge.html +// Specify one or more mappings to be merged with the current one. +func TestSchema_AnchorAndReference(t *testing.T) { + var node yaml.Node + err := yaml.Unmarshal([]byte(` +on: [push] +jobs: + test1: + runs-on: docker + steps: + - &step + run: echo All good! + - *step + test2: + runs-on: docker + steps: + - << : *step + name: other name + test3: + runs-on: docker + steps: + - !!merge << : *step + name: other name +`), &node) + if !assert.NoError(t, err) { + return + } + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.NoError(t, err) +} From f4eb8e57fb0bef1ed0248ff79e17a360b6dc2154 Mon Sep 17 00:00:00 2001 From: Freso Date: Thu, 18 Sep 2025 08:08:57 +0000 Subject: [PATCH 34/99] feat: add pre-commit hook for validator (#1002) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This will allow users to validate their Forgejo Actions files (both actions and workflows) prior to committing them to their repositories, using a `pre-commit` configuration similar to ```yaml - repo: https://code.forgejo.org/forgejo/runner rev: v11.1.0 hooks: - id: forgejo-runner-validate ``` - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1002): feat: add pre-commit hook for validator Co-authored-by: Frederik β€œFreso” S. Olesen Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1002 Reviewed-by: earl-warren Co-authored-by: Freso Co-committed-by: Freso --- .forgejo/workflows/test.yml | 50 +++++++++++++++++++++++++++++++++++++ .pre-commit-hooks.yaml | 16 ++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 .pre-commit-hooks.yaml diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml index 28ab84b9..773e0ae2 100644 --- a/.forgejo/workflows/test.yml +++ b/.forgejo/workflows/test.yml @@ -222,3 +222,53 @@ jobs: git diff --color=always exit 1 } + + validate-pre-commit: + name: validate pre-commit-hooks file + if: vars.ROLE == 'forgejo-coding' + runs-on: docker + container: + image: 'code.forgejo.org/oci/ci:1' + + steps: + - uses: https://data.forgejo.org/actions/checkout@v4 + + - name: install pre-commit + env: + DEBIAN_FRONTEND: noninteractive + PIP_ROOT_USER_ACTION: ignore + PIP_BREAK_SYSTEM_PACKAGES: 1 + PIP_PROGRESS_BAR: off + run: | + apt-get update -qq + apt-get -q install -qq -y python3-pip + python3 -m pip install 'pre-commit>=3.2.0' + + - name: validate .pre-commit-hooks.yaml + run: pre-commit validate-manifest .pre-commit-hooks.yaml + + # Will fail due to `act/runner/testdata/local-action-fails-schema-validation/action/action.yml` + - name: check pre-commit hook against local action files (should fail) + continue-on-error: true + run: | + pre-commit try-repo --all-files --verbose . forgejo-runner-validate + + - name: check that a bad workflow file doesn’t validate (should fail) + continue-on-error: true + run: | + mkdir -p test-repo + cd test-repo + git config set advice.defaultBranchName false + git init --quiet + mkdir -p .forgejo/workflows + cp ../act/runner/testdata/local-action-fails-schema-validation/action/action.yml ./ + touch .forgejo/workflows/bad-workflow.yml + cat > .pre-commit-config.yaml < Date: Thu, 18 Sep 2025 11:51:33 +0000 Subject: [PATCH 35/99] chore: document that DOCKER_HOST should be used instead of --container-daemon-socket (#1013) Resolves forgejo/runner#577 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1013): chore: document that DOCKER_HOST should be used instead of --container-daemon-socket Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1013 Reviewed-by: sclu1034 Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/cmd/exec.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go index 440387cf..f88fe327 100644 --- a/internal/app/cmd/exec.go +++ b/internal/app/cmd/exec.go @@ -371,6 +371,10 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command log.Infof("cache handler listens on: %v", handler.ExternalURL()) execArgs.cacheHandler = handler + if execArgs.containerDaemonSocket != "/var/run/docker.sock" { + log.Warnf("--container-daemon-socket %s: please use the DOCKER_HOST environment variable as documented at https://forgejo.org/docs/next/admin/actions/runner-installation/#setting-up-the-container-environment instead. See https://code.forgejo.org/forgejo/runner/issues/577 for more information.", execArgs.containerDaemonSocket) + } + // run the plan config := &runner.Config{ Workdir: execArgs.Workdir(), @@ -462,7 +466,7 @@ func loadExecCmd(ctx context.Context) *cobra.Command { execCmd.Flags().BoolVar(&execArg.privileged, "privileged", false, "use privileged mode") execCmd.Flags().StringVar(&execArg.usernsMode, "userns", "", "user namespace to use") execCmd.PersistentFlags().StringVarP(&execArg.containerArchitecture, "container-architecture", "", "", "Architecture which should be used to run containers, e.g.: linux/amd64. If not specified, will use host default architecture. Requires Docker server API Version 1.41+. Ignored on earlier Docker server platforms.") - execCmd.PersistentFlags().StringVarP(&execArg.containerDaemonSocket, "container-daemon-socket", "", "/var/run/docker.sock", "Path to Docker daemon socket which will be mounted to containers") + execCmd.PersistentFlags().StringVarP(&execArg.containerDaemonSocket, "container-daemon-socket", "", "/var/run/docker.sock", "Please use the DOCKER_HOST environment variable as documented at https://forgejo.org/docs/next/admin/actions/runner-installation/#setting-up-the-container-environment instead.") execCmd.Flags().BoolVar(&execArg.useGitIgnore, "use-gitignore", true, "Controls whether paths specified in .gitignore should be copied into container") execCmd.Flags().StringArrayVarP(&execArg.containerCapAdd, "container-cap-add", "", []string{}, "kernel capabilities to add to the workflow containers (e.g. --container-cap-add SYS_PTRACE)") execCmd.Flags().StringArrayVarP(&execArg.containerCapDrop, "container-cap-drop", "", []string{}, "kernel capabilities to remove from the workflow containers (e.g. --container-cap-drop SYS_PTRACE)") From c25bd51857c6ece05ab0fe390de8d6b1db51f797 Mon Sep 17 00:00:00 2001 From: Freso Date: Thu, 18 Sep 2025 12:02:07 +0000 Subject: [PATCH 36/99] =?UTF-8?q?fix(pre-commit):=20don=E2=80=99t=20defaul?= =?UTF-8?q?t=20`verbose`=20to=20on=20(#1015)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `verbose` was only set here as a work-around to make sure users saw the output of `validate` since there was no fail signal from the executable. As of https://code.forgejo.org/forgejo/runner/pulls/1009 there now is a signal that the validation failed which pre-commit can pick up on, so we no longer need to default `verbose` to be on. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1015): fix(pre-commit): don’t default `verbose` to on Co-authored-by: Frederik β€œFreso” S. Olesen Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1015 Reviewed-by: earl-warren Co-authored-by: Freso Co-committed-by: Freso --- .pre-commit-hooks.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml index 0c195cb0..315c03e1 100644 --- a/.pre-commit-hooks.yaml +++ b/.pre-commit-hooks.yaml @@ -11,6 +11,3 @@ # Old names (without the pre- prefix) are deprecated since 4.0.0. minimum_pre_commit_version: '3.2.0' stages: [pre-commit, pre-merge-commit, pre-push, manual] - # validate doesn’t currently provide non-success exit codes, - # so falling back to always printing verbose output for now. - verbose: true From 331979b887df761c14be6d59d4784727b1627a70 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Thu, 18 Sep 2025 16:17:56 +0000 Subject: [PATCH 37/99] fix: outputs are only set when the job is successful (#1017) Resolves forgejo/runner#1016 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1017): fix: outputs are only set when the job is successful Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1017 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/reporter.go | 10 ++++++---- internal/pkg/report/reporter_test.go | 14 ++++++++++++++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 0d1ebadb..e6322128 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -130,10 +130,12 @@ func (r *Reporter) Fire(entry *log.Entry) error { } } } - if v, ok := entry.Data["jobOutputs"]; ok { - _ = r.setOutputs(v.(map[string]string)) - } else { - log.Panicf("received log entry with jobResult, but without jobOutputs -- outputs will be corrupted for this job") + if r.state.Result == runnerv1.Result_RESULT_SUCCESS { + if v, ok := entry.Data["jobOutputs"]; ok { + _ = r.setOutputs(v.(map[string]string)) + } else { + log.Panicf("received log entry with successful jobResult, but without jobOutputs -- outputs will be corrupted for this job") + } } } if !r.duringSteps() { diff --git a/internal/pkg/report/reporter_test.go b/internal/pkg/report/reporter_test.go index a949c01b..f41282cb 100644 --- a/internal/pkg/report/reporter_test.go +++ b/internal/pkg/report/reporter_test.go @@ -301,6 +301,20 @@ func TestReporter_Fire(t *testing.T) { value, _ := reporter.outputs.Load("key1") assert.EqualValues(t, "value1", value) }) + + t.Run("jobResult jobOutputs is absent if not success", func(t *testing.T) { + reporter, _, _ := mockReporter(t) + + dataStep0 := map[string]any{ + "stage": "Post", + "stepNumber": 0, + "raw_output": true, + "jobResult": "skipped", + } + assert.NoError(t, reporter.Fire(&log.Entry{Message: "skipped!", Data: dataStep0})) + + assert.EqualValues(t, runnerv1.Result_RESULT_SKIPPED, reporter.state.Result) + }) } func TestReporterReportState(t *testing.T) { From aed4dd8766c6be76c7e60e42349ad1275a05f568 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 19 Sep 2025 04:31:14 +0000 Subject: [PATCH 38/99] Update forgejo-runner to v11.1.1 (#1018) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | minor | `11.0.0` -> `11.1.1` | | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | minor | `11.0.0` -> `11.1.1` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v11.1.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.1.1) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v11.1.0...v11.1.1) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1017): fix: outputs are only set when the job is successful - [PR](https://code.forgejo.org/forgejo/runner/pulls/1015): fix(pre-commit): don’t default `verbose` to on - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1013): chore: document that DOCKER\_HOST should be used instead of --container-daemon-socket ### [`v11.1.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.1.0) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v11.0.0...v11.1.0) > **Warning** Upgrade to v11.1.1 instead. A [regression was found](https://code.forgejo.org/forgejo/runner/issues/1016) that crashed the runner on skipped or failed jobs. - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1002): feat: add pre-commit hook for validator - [PR](https://code.forgejo.org/forgejo/runner/pulls/1008): feat: validate --directory alternative to --repository to not clone - [PR](https://code.forgejo.org/forgejo/runner/pulls/999): feat: the forgejo context is equivalent to the github context - [PR](https://code.forgejo.org/forgejo/runner/pulls/997): feat: add support for a Debian GNU/Linux LXC backend based on trixie (e.g. trixie-lxc:lxc://debian:trixie) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1012): fix: schema validation must accept aliases and merges - [PR](https://code.forgejo.org/forgejo/runner/pulls/1009): fix: forgejo-runner validate exit with error when validation fails - [PR](https://code.forgejo.org/forgejo/runner/pulls/1006): fix: do not save .runner unless it is modified - [PR](https://code.forgejo.org/forgejo/runner/pulls/1003): fix: remove LXC working directory when it completes - [PR](https://code.forgejo.org/forgejo/runner/pulls/995): fix: send job outputs & job result to Forgejo in sync with each other - [PR](https://code.forgejo.org/forgejo/runner/pulls/986): fix: if the Forgejo instance failed a job, cancel it - [PR](https://code.forgejo.org/forgejo/runner/pulls/982): fix: enforce job..timeout-minutes - [PR](https://code.forgejo.org/forgejo/runner/pulls/972): fix: use a fixed runner name for old (<= v1.20) Forgejo instances - [PR](https://code.forgejo.org/forgejo/runner/pulls/965): fix: docker-compose example: allow the runner to keep its labels - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1001): Update dependency forgejo/lxc-helpers to v1.1.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1000): chore: minimal integration test for the LXC backend - [PR](https://code.forgejo.org/forgejo/runner/pulls/993): chore: unify actions URLs in .forgejo/workflows - [PR](https://code.forgejo.org/forgejo/runner/pulls/992): Update action to v2.3.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/990): chore: data.forgejo.org/actions/cascading-pr is the canonical location - [PR](https://code.forgejo.org/forgejo/runner/pulls/989): Update dependency forgejo/release-notes-assistant to v1.4.1 - [PR](https://code.forgejo.org/forgejo/runner/pulls/988): chore: wait 4 times longer for the forgejo cascade pull request to complete - [PR](https://code.forgejo.org/forgejo/runner/pulls/985): Remove windows build/test pipeline for GitHub - [PR](https://code.forgejo.org/forgejo/runner/pulls/981): Update module code.forgejo.org/forgejo/actions-proto to v0.5.2 - [PR](https://code.forgejo.org/forgejo/runner/pulls/969): Update action to v3.0.3 - [PR](https://code.forgejo.org/forgejo/runner/pulls/975): Update forgejo-runner to v11 (major) - [PR](https://code.forgejo.org/forgejo/runner/pulls/973): ci: update forgejo version for release integration - [PR](https://code.forgejo.org/forgejo/runner/pulls/970): chore: lxc-systemd may need more time to start on slow machines - [PR](https://code.forgejo.org/forgejo/runner/pulls/966): Update module golang.org/x/term to v0.35.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/964): chore: call the release notes assistant when opening a new pull request - [PR](https://code.forgejo.org/forgejo/runner/pulls/954): chore: skip release-notes-assistant for dependency updates
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1018 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index a2597d54..7aeae3ec 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:11.0.0 + image: code.forgejo.org/forgejo/runner:11.1.1 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:11.0.0 + image: code.forgejo.org/forgejo/runner:11.1.1 links: - docker-in-docker - forgejo diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index d49940a0..8e689f00 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.1.0 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=11.0.0 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 71bd44f9a0dcb3f4ea2bef61ab2f4ba047fef8d6 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 20 Sep 2025 16:26:21 +0000 Subject: [PATCH 39/99] Update https://data.forgejo.org/actions/setup-forgejo action to v3.0.4 (#1021) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) | action | patch | `v3.0.3` -> `v3.0.4` | --- ### Release Notes
actions/setup-forgejo (https://data.forgejo.org/actions/setup-forgejo) ### [`v3.0.4`](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.3...v3.0.4) [Compare Source](https://code.forgejo.org/actions/setup-forgejo/compare/v3.0.3...v3.0.4)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1021 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index e57ec989..ace95632 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -29,7 +29,7 @@ jobs: - uses: https://data.forgejo.org/actions/checkout@v4 - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4 with: user: root password: admin1234 diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index 04ac8f54..ddad6563 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -34,7 +34,7 @@ jobs: - name: install Forgejo so it can be used as a container registry id: registry - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4 with: user: ${{ env.FORGEJO_USER }} password: ${{ env.FORGEJO_PASSWORD }} diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index e2d1a54b..1a6bec4e 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -53,7 +53,7 @@ jobs: done - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.3 + uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4 with: user: root password: admin1234 From ed7dcb008135c7305520a4cc8c5932e76306eaf3 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 20 Sep 2025 16:30:19 +0000 Subject: [PATCH 40/99] fix: a composite action must not change the result of the calling step before it completes (#1019) Resolves forgejo/runner#1014 --- Manual testing can also be done using the [reproducer from the issue](https://code.forgejo.org/forgejo/runner/issues/1014#issuecomment-60694). ## Before The first step of the local composite action sets the step result of the job to success which confuses Forgejo display. ![image](/attachments/4f5c9477-47b8-4450-a858-c86312ced946) ## After Forgejo displays the progress of the composite action in the step calling it. ![image](/attachments/eed08b5d-b590-472f-9140-eced739dd47b) - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1019): fix: a composite action must not change the result of the calling step before it completes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1019 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/logger.go | 20 +++++++++++ act/runner/logger_test.go | 63 +++++++++++++++++++++++++++++++++ internal/pkg/report/reporter.go | 3 +- 3 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 act/runner/logger_test.go diff --git a/act/runner/logger.go b/act/runner/logger.go index f97292bf..5f4dae1d 100644 --- a/act/runner/logger.go +++ b/act/runner/logger.go @@ -146,6 +146,26 @@ func WithCompositeStepLogger(ctx context.Context, stepID string) context.Context }).WithContext(ctx)) } +func GetOuterStepResult(entry *logrus.Entry) any { + r, ok := entry.Data["stepResult"] + if !ok { + return nil + } + + // composite actions steps log with a list of stepID + if s, ok := entry.Data["stepID"]; ok { + if stepIDs, ok := s.([]string); ok { + if len(stepIDs) > 1 { + return nil + } + } + } else { + return nil + } + + return r +} + func withStepLogger(ctx context.Context, stepNumber int, stepID, stepName, stageName string) context.Context { rtn := common.Logger(ctx).WithFields(logrus.Fields{ "stepNumber": stepNumber, diff --git a/act/runner/logger_test.go b/act/runner/logger_test.go new file mode 100644 index 00000000..4df2db12 --- /dev/null +++ b/act/runner/logger_test.go @@ -0,0 +1,63 @@ +package runner + +import ( + "testing" + + "code.forgejo.org/forgejo/runner/v11/act/common" + + "github.com/sirupsen/logrus/hooks/test" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestRunner_GetOuterStepResult(t *testing.T) { + nullLogger, hook := test.NewNullLogger() + ctx := common.WithLogger(t.Context(), nullLogger) + + t.Run("no stepResult", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).Info("βœ… Success") + entry := hook.LastEntry() + require.NotNil(t, entry) + assert.Nil(t, GetOuterStepResult(entry)) + }) + + t.Run("stepResult and no stepID", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).WithField("stepResult", "success").Info("βœ… Success") + entry := hook.LastEntry() + require.NotNil(t, entry) + assert.Nil(t, GetOuterStepResult(entry)) + }) + + stepNumber := 123 + stepID := "step id" + stepName := "readable name" + stageName := "Main" + ctx = withStepLogger(ctx, stepNumber, stepID, stepName, stageName) + + t.Run("stepResult and stepID", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).WithField("stepResult", "success").Info("βœ… Success") + entry := hook.LastEntry() + actualStepIDs, ok := entry.Data["stepID"] + require.True(t, ok) + require.Equal(t, []string{stepID}, actualStepIDs) + require.NotNil(t, entry) + assert.Equal(t, "success", GetOuterStepResult(entry)) + }) + + compositeStepID := "composite step id" + ctx = WithCompositeStepLogger(ctx, compositeStepID) + + t.Run("stepResult and composite stepID", func(t *testing.T) { + hook.Reset() + common.Logger(ctx).WithField("stepResult", "success").Info("βœ… Success") + entry := hook.LastEntry() + actualStepIDs, ok := entry.Data["stepID"] + require.True(t, ok) + require.Equal(t, []string{stepID, compositeStepID}, actualStepIDs) + require.NotNil(t, entry) + assert.Nil(t, GetOuterStepResult(entry)) + }) +} diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index e6322128..7e46b8bb 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -13,6 +13,7 @@ import ( "time" runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" + "code.forgejo.org/forgejo/runner/v11/act/runner" "connectrpc.com/connect" retry "github.com/avast/retry-go/v4" log "github.com/sirupsen/logrus" @@ -173,7 +174,7 @@ func (r *Reporter) Fire(entry *log.Entry) error { } else if !r.duringSteps() { r.logRows = appendIfNotNil(r.logRows, r.parseLogRow(entry)) } - if v, ok := entry.Data["stepResult"]; ok { + if v := runner.GetOuterStepResult(entry); v != nil { if stepResult, ok := r.parseResult(v); ok { if step.LogLength == 0 { step.LogIndex = int64(r.logOffset + len(r.logRows)) From 8512d76ce7f924163de123b1e96d8fd7b6d442e2 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 20 Sep 2025 20:57:17 +0000 Subject: [PATCH 41/99] chore: upgrade LXC example to Debian GNU/Linux trixie (#1020) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1020): chore: upgrade LXC example to Debian GNU/Linux trixie Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1020 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/example-lxc-systemd.yml | 2 +- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index 1a6bec4e..e333092b 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -18,7 +18,7 @@ env: jobs: example-lxc-systemd: if: vars.ROLE == 'forgejo-coding' - runs-on: lxc-bookworm + runs-on: lxc-trixie steps: - uses: https://data.forgejo.org/actions/checkout@v4 diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 8e689f00..c0334bea 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -27,7 +27,7 @@ DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=fo : ${KILL_AFTER:=21600} # 6h == 21600 NODEJS_VERSION=20 -DEBIAN_RELEASE=bookworm +DEBIAN_RELEASE=trixie YQ_VERSION=v4.45.1 SELF=${BASH_SOURCE[0]} SELF_FILENAME=$(basename "$SELF") From 225a05e1a5dcc7fdedb79b7bf2d436368be30e98 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 21 Sep 2025 06:51:38 +0000 Subject: [PATCH 42/99] Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.6 (#1022) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/forgejo](https://forgejo.org) ([source](https://codeberg.org/forgejo/forgejo)) | patch | `11.0.5` -> `11.0.6` | --- ### Release Notes
forgejo/forgejo (code.forgejo.org/forgejo/forgejo) ### [`v11.0.6`](https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.6) [Compare Source](https://codeberg.org/forgejo/forgejo/compare/v11.0.5...v11.0.6) See
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1022 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index ace95632..0a1c216b 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -19,7 +19,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.5 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: release-simulation: diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index ddad6563..ec8469ca 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -21,7 +21,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.5 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo FORGEJO_USER: root FORGEJO_PASSWORD: admin1234 From fb1a38b840014686a87d953948b7357cfb3ef5d8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 22 Sep 2025 10:10:07 +0000 Subject: [PATCH 43/99] Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.5.0 (#1023) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/golangci/golangci-lint/v2/cmd/golangci-lint](https://github.com/golangci/golangci-lint) | `v2.4.0` -> `v2.5.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.5.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgolangci%2fgolangci-lint%2fv2%2fcmd%2fgolangci-lint/v2.4.0/v2.5.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
golangci/golangci-lint (github.com/golangci/golangci-lint/v2/cmd/golangci-lint) ### [`v2.5.0`](https://github.com/golangci/golangci-lint/blob/HEAD/CHANGELOG.md#v250) [Compare Source](https://github.com/golangci/golangci-lint/compare/v2.4.0...v2.5.0) 1. New linters - Add `godoclint` linter - Add `unqueryvet` linter - Add `iotamixing` linter 2. Linters new features or changes - `embeddedstructfieldcheck`: from 0.3.0 to 0.4.0 (new option: `empty-line`) - `err113`: from [`aea10b5`](https://github.com/golangci/golangci-lint/commit/aea10b59be24) to 0.1.1 (skip internals of `Is` methods for `error` type) - `ginkgolinter`: from 0.20.0 to 0.21.0 (new option: `force-tonot`) - `gofumpt`: from 0.8.0 to 0.9.1 (new rule is to "clothe" naked returns for the sake of clarity) - `ineffassign`: from 0.1.0 to 0.2.0 (new option: `check-escaping-errors`) - `musttag`: from 0.13.1 to 0.14.0 (support interface methods) - `revive`: from 1.11.0 to 1.12.0 (new options: `identical-ifelseif-branches`, `identical-ifelseif-conditions`, `identical-switch-branches`, `identical-switch-conditions`, `package-directory-mismatch`, `unsecure-url-scheme`, `use-waitgroup-go`, `useless-fallthrough`) - `thelper`: from 0.6.3 to 0.7.1 (skip `t.Helper` in functions passed to `synctest.Test`) - `wsl`: from 5.1.1 to 5.2.0 (improvements related to subexpressions) 3. Linters bug fixes - `asciicheck`: from 0.4.1 to 0.5.0 - `errname`: from 1.1.0 to 1.1.1 - `fatcontext`: from 0.8.0 to 0.8.1 - `go-printf-func-name`: from 0.1.0 to 0.1.1 - `godot`: from 1.5.1 to 1.5.4 - `gosec`: from 2.22.7 to 2.22.8 - `nilerr`: from 0.1.1 to a temporary fork - `nilnil`: from 1.1.0 to 1.1.1 - `protogetter`: from 0.3.15 to 0.3.16 - `tagliatelle`: from 0.7.1 to 0.7.2 - `testifylint`: from 1.6.1 to 1.6.4 4. Misc. - fix: "no export data" errors are now handled as a standard typecheck error 5. Documentation - Improve nolint section about syntax
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1023 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 06029b7f..07ab0134 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,7 @@ GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*") GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*") MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.5 # renovate: datasource=go -GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 # renovate: datasource=go +GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0 # renovate: datasource=go DOCKER_IMAGE ?= gitea/act_runner DOCKER_TAG ?= nightly From 8debbe699ed69cd7a224694fd9417e82a7d3ec22 Mon Sep 17 00:00:00 2001 From: Gusted Date: Tue, 23 Sep 2025 06:41:07 +0000 Subject: [PATCH 44/99] chore: fix typo in the documentation (#1025) Ref: forgejo/docs#1506 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1025): Fix typo Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1025 Reviewed-by: Beowulf Co-authored-by: Gusted Co-committed-by: Gusted --- internal/pkg/config/config.example.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index 14decb32..4e447e9d 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -138,7 +138,7 @@ cache: # different network than the Forgejo runner (for instance when the # docker server used to create containers is not running on the same # host as the Forgejo runner), it may be impossible to figure that - # out automatically. In that case you can specifify which IP or + # out automatically. In that case you can specify which IP or # hostname to use to reach the internal cache server created by the # Forgejo runner. # From 6bdb7ed9c793b3cf93341c95a0b6629bd1381b34 Mon Sep 17 00:00:00 2001 From: Kwonunn Date: Fri, 26 Sep 2025 07:02:45 +0000 Subject: [PATCH 45/99] fix: Correctly override the value of `Forgejo-Cache-Host` when ACTIONS_CACHE_URL is overridden. (#1027) This fixes a bug currently preventing use of an external cache server in the Codeberg runner setup. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1027): fix: Correctly override the value of `Forgejo-Cache-Host` when ACTIONS_CACHE_URL is overridden. Co-authored-by: Vivian Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1027 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Kwonunn Co-committed-by: Kwonunn --- act/cacheproxy/handler.go | 10 +++++++--- internal/app/run/runner.go | 4 +--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 17adf3b5..e494b9c5 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -37,7 +37,8 @@ type Handler struct { outboundIP string - cacheServerHost string + cacheServerHost string + cacheProxyHostOverride string cacheSecret string @@ -55,7 +56,7 @@ func (h *Handler) CreateRunData(fullName, runNumber, timestamp, writeIsolationKe } } -func StartHandler(targetHost, outboundIP string, port uint16, cacheSecret string, logger logrus.FieldLogger) (*Handler, error) { +func StartHandler(targetHost, outboundIP string, port uint16, cacheProxyHostOverride, cacheSecret string, logger logrus.FieldLogger) (*Handler, error) { h := &Handler{} if logger == nil { @@ -77,6 +78,7 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheSecret string } h.cacheServerHost = targetHost + h.cacheProxyHostOverride = cacheProxyHostOverride proxy, err := h.newReverseProxy(targetHost) if err != nil { @@ -153,7 +155,9 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er } func (h *Handler) ExternalURL() string { - // TODO: make the external url configurable if necessary + if h.cacheProxyHostOverride != "" { + return h.cacheProxyHostOverride + } return fmt.Sprintf("http://%s", net.JoinHostPort(h.outboundIP, strconv.Itoa(h.listener.Addr().(*net.TCPAddr).Port))) } diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index a1283d61..98a39f92 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -144,6 +144,7 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler cacheURL, cfg.Cache.Host, cfg.Cache.ProxyPort, + cfg.Cache.ActionsCacheURLOverride, cacheSecret, log.StandardLogger().WithField("module", "cache_proxy"), ) @@ -152,9 +153,6 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler } envs["ACTIONS_CACHE_URL"] = cacheProxy.ExternalURL() - if cfg.Cache.ActionsCacheURLOverride != "" { - envs["ACTIONS_CACHE_URL"] = cfg.Cache.ActionsCacheURLOverride - } return cacheProxy } From 9c09ca3f565af655d415c4a92a1fcda46677cdad Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 26 Sep 2025 07:10:58 +0000 Subject: [PATCH 46/99] Update module connectrpc.com/connect to v1.19.0 (#1029) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.18.1` -> `v1.19.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/connectrpc.com%2fconnect/v1.19.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/connectrpc.com%2fconnect/v1.18.1/v1.19.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
connectrpc/connect-go (connectrpc.com/connect) ### [`v1.19.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.18.1...v1.19.0) This release introduces the highly requested "simple" flag for code generation, making Connect significantly more ergonomic for everyday RPC development. The new simple flag in protoc-gen-connect-go generates cleaner, more intuitive client and handler interfaces that eliminate request/response wrappers for most use cases. This addresses community feedback about verbosity and provides a more straightforward API. When enabled, metadata (headers/trailers) can be passed through context instead of explicit wrapper objects, optimizing for the common case where developers don't need direct access to HTTP headers. #### What's Changed ##### Enhancements - Add simple flag for more ergonomic generated code by [@​bufdev](https://github.com/bufdev) and [@​smaye81](https://github.com/smaye81) in [#​851](https://github.com/connectrpc/connect-go/pull/851) - Update Go to v1.24 and document http.Protocol use removing the dependency on `golang.org/x/net/http2` by [@​maxbrunet](https://github.com/maxbrunet) in [#​873](https://github.com/connectrpc/connect-go/pull/873), [#​877](https://github.com/connectrpc/connect-go/pull/877) - Add support for Edition 2024 by [@​emcfarlane](https://github.com/emcfarlane) in [#​878](https://github.com/connectrpc/connect-go/pull/878) ##### Bugfixes - Include valid spec and headers when calling recover handler for streaming RPCs by [@​jhump](https://github.com/jhump) in [#​817](https://github.com/connectrpc/connect-go/pull/817) ##### Other changes - Go version support updated to latest two instead of three by [@​jhump](https://github.com/jhump) in [#​837](https://github.com/connectrpc/connect-go/pull/837) - CI testing improvements by [@​pkwarren](https://github.com/pkwarren) and [@​jhump](https://github.com/jhump) in [#​838](https://github.com/connectrpc/connect-go/pull/838), [#​839](https://github.com/connectrpc/connect-go/pull/839) - Code quality improvements by [@​mattrobenolt](https://github.com/mattrobenolt) and [@​bufdev](https://github.com/bufdev) in [#​841](https://github.com/connectrpc/connect-go/pull/841), [#​867](https://github.com/connectrpc/connect-go/pull/867) - Documentation improvements by [@​adlion](https://github.com/adlion) and [@​stefanvanburen](https://github.com/stefanvanburen) in [#​821](https://github.com/connectrpc/connect-go/pull/821), [#​880](https://github.com/connectrpc/connect-go/pull/880) #### New Contributors - [@​adlion](https://github.com/adlion) made their first contribution in [#​821](https://github.com/connectrpc/connect-go/pull/821) - [@​maxbrunet](https://github.com/maxbrunet) made their first contribution in [#​873](https://github.com/connectrpc/connect-go/pull/873) - [@​stefanvanburen](https://github.com/stefanvanburen) made their first contribution in [#​880](https://github.com/connectrpc/connect-go/pull/880) **Full Changelog**:
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1029 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index d1763deb..93e4f33b 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.7 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 - connectrpc.com/connect v1.18.1 + connectrpc.com/connect v1.19.0 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 diff --git a/go.sum b/go.sum index d5b9a302..fea04a05 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= -connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= -connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= +connectrpc.com/connect v1.19.0 h1:LuqUbq01PqbtL0o7vn0WMRXzR2nNsiINe5zfcJ24pJM= +connectrpc.com/connect v1.19.0/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= From 014b4ba5f652f7b22adf9162c8b97f54884f1247 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 26 Sep 2025 20:01:46 +0000 Subject: [PATCH 47/99] fix: event.pull_request.action == closed can use the cache of the base repository (#1031) It was tested locally with https://code.forgejo.org/forgejo/end-to-end/pulls/1062/files. ## Before ![image](/attachments/26890572-08ba-4904-b6a5-f01762141a51) ## After ![image](/attachments/56352930-99a3-4011-b921-b12217c5fa54) --- When the "closed" action of a pull request event was triggered by a merge, it effectively runs in the context of the base repository. It was merged by a user with write access to the base repository. It is authorized to write the base repository cache. Resolves forgejo/runner#1030 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1031): fix: event.pull_request.action == closed can use the cache of the base repository Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1031 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/app/run/runner.go | 63 ++++++++++++++++++++------- internal/app/run/runner_test.go | 77 +++++++++++++++++++++++++++++++++ 2 files changed, 124 insertions(+), 16 deletions(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 98a39f92..1bf32c78 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -193,6 +193,44 @@ func explainFailedGenerateWorkflow(task *runnerv1.Task, log func(message string, return fmt.Errorf("the workflow file is not usable") } +func getWriteIsolationKey(ctx context.Context, eventName, ref string, event map[string]any) (string, error) { + if eventName == "pull_request" { + // The "closed" action of a pull request event runs in the context of the base repository + // and was merged by a user with write access to the base repository. It is authorized to + // write the repository cache. + if event["action"] == "closed" { + pullRequest, ok := event["pull_request"].(map[string]any) + if !ok { + return "", fmt.Errorf("getWriteIsolationKey: event.pull_request is not a map[string]any but %T", event["pull_request"]) + } + merged, ok := pullRequest["merged"].(bool) + if !ok { + return "", fmt.Errorf("getWriteIsolationKey: event.pull_request.merged is not a bool but %T", pullRequest["merged"]) + } + if merged { + return "", nil + } + // a pull request that is closed but not merged falls thru and is expected to obey the same + // constraints as an opened pull request, it may be closed by a user with no write permissions to the + // base repository + } + // When performing an action on an event from an opened PR, provide a "write isolation key" to the cache. The generated + // ACTIONS_CACHE_URL will be able to read the cache, and write to a cache, but its writes will be isolated to + // future runs of the PR's workflows and won't be shared with other pull requests or actions. This is a security + // measure to prevent a malicious pull request from poisoning the cache with secret-stealing code which would + // later be executed on another action. + // Ensure that `ref` has the expected format so that we don't end up with a useless write isolation key + if !strings.HasPrefix(ref, "refs/pull/") { + return "", fmt.Errorf("getWriteIsolationKey: expected ref to be refs/pull/..., but was %q", ref) + } + return ref, nil + } + + // Other events do not allow the trigger user to modify the content of the repository and + // are allowed to write the cache without an isolation key + return "", nil +} + func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.Reporter) (err error) { defer func() { if r := recover(); r != nil { @@ -226,15 +264,18 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. defaultActionURL, r.client.Address()) + eventName := taskContext["event_name"].GetStringValue() + ref := taskContext["ref"].GetStringValue() + event := taskContext["event"].GetStructValue().AsMap() preset := &model.GithubContext{ - Event: taskContext["event"].GetStructValue().AsMap(), + Event: event, RunID: taskContext["run_id"].GetStringValue(), RunNumber: taskContext["run_number"].GetStringValue(), Actor: taskContext["actor"].GetStringValue(), Repository: taskContext["repository"].GetStringValue(), - EventName: taskContext["event_name"].GetStringValue(), + EventName: eventName, Sha: taskContext["sha"].GetStringValue(), - Ref: taskContext["ref"].GetStringValue(), + Ref: ref, RefName: taskContext["ref_name"].GetStringValue(), RefType: taskContext["ref_type"].GetStringValue(), HeadRef: taskContext["head_ref"].GetStringValue(), @@ -264,19 +305,9 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report. // Register the run with the cacheproxy and modify the CACHE_URL if r.cacheProxy != nil { - writeIsolationKey := "" - - // When performing an action on an event from a PR, provide a "write isolation key" to the cache. The generated - // ACTIONS_CACHE_URL will be able to read the cache, and write to a cache, but its writes will be isolated to - // future runs of the PR's workflows and won't be shared with other pull requests or actions. This is a security - // measure to prevent a malicious pull request from poisoning the cache with secret-stealing code which would - // later be executed on another action. - if taskContext["event_name"].GetStringValue() == "pull_request" { - // Ensure that `Ref` has the expected format so that we don't end up with a useless write isolation key - if !strings.HasPrefix(preset.Ref, "refs/pull/") { - return fmt.Errorf("write isolation key: expected preset.Ref to be refs/pull/..., but was %q", preset.Ref) - } - writeIsolationKey = preset.Ref + writeIsolationKey, err := getWriteIsolationKey(ctx, eventName, ref, event) + if err != nil { + return err } timestamp := strconv.FormatInt(time.Now().Unix(), 10) diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 65690832..eda5de9e 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -141,6 +141,83 @@ func (m *forgejoClientMock) UpdateLog(ctx context.Context, request *connect.Requ }), nil } +func TestRunner_getWriteIsolationKey(t *testing.T) { + t.Run("push", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "push", "whatever", nil) + require.NoError(t, err) + assert.Empty(t, key) + }) + + t.Run("pull_request synchronized key is ref", func(t *testing.T) { + expectedKey := "refs/pull/1/head" + actualKey, err := getWriteIsolationKey(t.Context(), "pull_request", expectedKey, map[string]any{ + "action": "synchronized", + }) + require.NoError(t, err) + assert.Equal(t, expectedKey, actualKey) + }) + + t.Run("pull_request synchronized ref is invalid", func(t *testing.T) { + invalidKey := "refs/is/invalid" + key, err := getWriteIsolationKey(t.Context(), "pull_request", invalidKey, map[string]any{ + "action": "synchronized", + }) + require.Empty(t, key) + assert.ErrorContains(t, err, invalidKey) + }) + + t.Run("pull_request closed and not merged key is ref", func(t *testing.T) { + expectedKey := "refs/pull/1/head" + actualKey, err := getWriteIsolationKey(t.Context(), "pull_request", expectedKey, map[string]any{ + "action": "closed", + "pull_request": map[string]any{ + "merged": false, + }, + }) + require.NoError(t, err) + assert.Equal(t, expectedKey, actualKey) + }) + + t.Run("pull_request closed and merged key is empty", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + "pull_request": map[string]any{ + "merged": true, + }, + }) + require.NoError(t, err) + assert.Empty(t, key) + }) + + t.Run("pull_request missing event.pull_request", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + }) + require.Empty(t, key) + assert.ErrorContains(t, err, "event.pull_request is not a map") + }) + + t.Run("pull_request missing event.pull_request.merge", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + "pull_request": map[string]any{}, + }) + require.Empty(t, key) + assert.ErrorContains(t, err, "event.pull_request.merged is not a bool") + }) + + t.Run("pull_request with event.pull_request.merge of an unexpected type", func(t *testing.T) { + key, err := getWriteIsolationKey(t.Context(), "pull_request", "whatever", map[string]any{ + "action": "closed", + "pull_request": map[string]any{ + "merged": "string instead of bool", + }, + }) + require.Empty(t, key) + assert.ErrorContains(t, err, "not a bool but string") + }) +} + func TestRunnerCacheConfiguration(t *testing.T) { if testing.Short() { t.Skip("skipping integration test") From 56ef60060b1c83d7942c5f413f98fc48e03689fc Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sat, 27 Sep 2025 04:37:36 +0000 Subject: [PATCH 48/99] feat: support evaluating workflow-level concurrency blocks in jobparser (#1026) - Changes `EvaluateConcurrency` to `EvaluateWorkflowConcurrency`, which has no job-related arguments - Changes gitContext to be sent as an object rather than a map - Allows `nil` to be returned for `cancelInProgress`, which indicates that the value wasn't specified in the input yaml -- required for distinguishing the `cancel-in-progress: false` case from not being specified at all. ReadWorkflowRawConcurrency & EvaluateWorkflowConcurrency were never used in forgejo yet, so this shouldn't break the forgejo build. Prerequisite for https://codeberg.org/forgejo/forgejo/pulls/9434. - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1026): feat: support evaluating workflow-level concurrency blocks in jobparser Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1026 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/jobparser/interpeter.go | 30 ++++++++++++ act/jobparser/model.go | 91 ++++++------------------------------- act/jobparser/model_test.go | 72 +++++++++++++++++------------ 3 files changed, 87 insertions(+), 106 deletions(-) diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go index e82444e4..362e18cc 100644 --- a/act/jobparser/interpeter.go +++ b/act/jobparser/interpeter.go @@ -76,6 +76,36 @@ func NewInterpeter( return exprparser.NewInterpeter(ee, config) } +// Returns an interpeter used in the server in the context of workflow-level templates. Needs github, inputs, and vars +// context only. +func NewWorkflowInterpeter( + gitCtx *model.GithubContext, + vars map[string]string, + inputs map[string]any, +) exprparser.Interpreter { + ee := &exprparser.EvaluationEnvironment{ + Github: gitCtx, + Env: nil, // no need + Job: nil, // no need + Steps: nil, // no need + Runner: nil, // no need + Secrets: nil, // no need + Strategy: nil, // no need + Matrix: nil, // no need + Needs: nil, // no need + Inputs: inputs, + Vars: vars, + } + + config := exprparser.Config{ + Run: nil, + WorkingDir: "", // WorkingDir is used for the function hashFiles, but it's not needed in the server + Context: "workflow", + } + + return exprparser.NewInterpeter(ee, config) +} + // JobResult is the minimum requirement of job results for Interpeter type JobResult struct { Needs []string diff --git a/act/jobparser/model.go b/act/jobparser/model.go index ed6e5ece..e94123e3 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -1,7 +1,6 @@ package jobparser import ( - "bytes" "fmt" "code.forgejo.org/forgejo/runner/v11/act/model" @@ -193,83 +192,32 @@ func (evt *Event) Schedules() []map[string]string { return evt.schedules } -func ReadWorkflowRawConcurrency(content []byte) (*model.RawConcurrency, error) { - w := new(model.Workflow) - err := yaml.NewDecoder(bytes.NewReader(content)).Decode(w) - return w.RawConcurrency, err -} - -func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (string, bool, error) { - actJob := &model.Job{} - if job != nil { - actJob.Strategy = &model.Strategy{ - FailFastString: job.Strategy.FailFastString, - MaxParallelString: job.Strategy.MaxParallelString, - RawMatrix: job.Strategy.RawMatrix, - } - actJob.Strategy.FailFast = actJob.Strategy.GetFailFast() - actJob.Strategy.MaxParallel = actJob.Strategy.GetMaxParallel() - } - - matrix := make(map[string]any) - matrixes, err := actJob.GetMatrixes() - if err != nil { - return "", false, err - } - if len(matrixes) > 0 { - matrix = matrixes[0] - } - - evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs)) +// Convert the raw YAML from the `concurrency` block on a workflow into the evaluated concurrency group and +// cancel-in-progress value. This implementation only supports workflow-level concurrency definition, where we expect +// expressions to be able to access only the github, inputs and vars contexts. If RawConcurrency is empty, then the +// returned concurrency group will be "" and cancel-in-progress will be nil -- this can be used to distinguish from an +// explicit cancel-in-progress choice even if a group isn't specified. +func EvaluateWorkflowConcurrency(rc *model.RawConcurrency, gitCtx *model.GithubContext, vars map[string]string, inputs map[string]any) (string, *bool, error) { + evaluator := NewExpressionEvaluator(NewWorkflowInterpeter(gitCtx, vars, inputs)) var node yaml.Node if err := node.Encode(rc); err != nil { - return "", false, fmt.Errorf("failed to encode concurrency: %w", err) + return "", nil, fmt.Errorf("failed to encode concurrency: %w", err) } if err := evaluator.EvaluateYamlNode(&node); err != nil { - return "", false, fmt.Errorf("failed to evaluate concurrency: %w", err) + return "", nil, fmt.Errorf("failed to evaluate concurrency: %w", err) } var evaluated model.RawConcurrency if err := node.Decode(&evaluated); err != nil { - return "", false, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err) + return "", nil, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err) } if evaluated.RawExpression != "" { - return evaluated.RawExpression, false, nil + return evaluated.RawExpression, nil, nil } - return evaluated.Group, evaluated.CancelInProgress == "true", nil -} - -func toGitContext(input map[string]any) *model.GithubContext { - gitContext := &model.GithubContext{ - EventPath: asString(input["event_path"]), - Workflow: asString(input["workflow"]), - RunID: asString(input["run_id"]), - RunNumber: asString(input["run_number"]), - Actor: asString(input["actor"]), - Repository: asString(input["repository"]), - EventName: asString(input["event_name"]), - Sha: asString(input["sha"]), - Ref: asString(input["ref"]), - RefName: asString(input["ref_name"]), - RefType: asString(input["ref_type"]), - HeadRef: asString(input["head_ref"]), - BaseRef: asString(input["base_ref"]), - Token: asString(input["token"]), - Workspace: asString(input["workspace"]), - Action: asString(input["action"]), - ActionPath: asString(input["action_path"]), - ActionRef: asString(input["action_ref"]), - ActionRepository: asString(input["action_repository"]), - Job: asString(input["job"]), - RepositoryOwner: asString(input["repository_owner"]), - RetentionDays: asString(input["retention_days"]), + if evaluated.CancelInProgress == "" { + return evaluated.Group, nil, nil } - - event, ok := input["event"].(map[string]any) - if ok { - gitContext.Event = event - } - - return gitContext + cancelInProgress := evaluated.CancelInProgress == "true" + return evaluated.Group, &cancelInProgress, nil } func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { @@ -430,12 +378,3 @@ func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) { return scalars, datas, nil } - -func asString(v any) string { - if v == nil { - return "" - } else if s, ok := v.(string); ok { - return s - } - return "" -} diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index fd62ef65..45d77428 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -342,10 +342,11 @@ func TestParseMappingNode(t *testing.T) { func TestEvaluateConcurrency(t *testing.T) { tests := []struct { - name string - input model.RawConcurrency - group string - cancelInProgress bool + name string + input model.RawConcurrency + group string + cancelInProgressNil bool + cancelInProgress bool }{ { name: "basic", @@ -357,18 +358,18 @@ func TestEvaluateConcurrency(t *testing.T) { cancelInProgress: true, }, { - name: "undefined", - input: model.RawConcurrency{}, - group: "", - cancelInProgress: false, + name: "undefined", + input: model.RawConcurrency{}, + group: "", + cancelInProgressNil: true, }, { name: "group-evaluation", input: model.RawConcurrency{ Group: "${{ github.workflow }}-${{ github.ref }}", }, - group: "test_workflow-main", - cancelInProgress: false, + group: "test_workflow-main", + cancelInProgressNil: true, }, { name: "cancel-evaluation-true", @@ -393,37 +394,44 @@ func TestEvaluateConcurrency(t *testing.T) { input: model.RawConcurrency{ Group: "user-${{ github.event.commits[0].author.username }}", }, - group: "user-someone", - cancelInProgress: false, + group: "user-someone", + cancelInProgressNil: true, }, { name: "arbitrary-var", input: model.RawConcurrency{ Group: "${{ vars.eval_arbitrary_var }}", }, - group: "123", - cancelInProgress: false, + group: "123", + cancelInProgressNil: true, }, { name: "arbitrary-input", input: model.RawConcurrency{ Group: "${{ inputs.eval_arbitrary_input }}", }, - group: "456", - cancelInProgress: false, + group: "456", + cancelInProgressNil: true, + }, + { + name: "cancel-in-progress-only", + input: model.RawConcurrency{ + CancelInProgress: "true", + }, + group: "", + cancelInProgress: true, }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { - group, cancelInProgress, err := EvaluateConcurrency( + group, cancelInProgress, err := EvaluateWorkflowConcurrency( &test.input, - "job-id", - nil, // job - map[string]any{ - "workflow": "test_workflow", - "ref": "main", - "event": map[string]any{ + // gitCtx + &model.GithubContext{ + Workflow: "test_workflow", + Ref: "main", + Event: map[string]any{ "commits": []any{ map[string]any{ "author": map[string]any{ @@ -437,20 +445,24 @@ func TestEvaluateConcurrency(t *testing.T) { }, }, }, - }, // gitCtx - map[string]*JobResult{ - "job-id": {}, - }, // results + }, + // vars map[string]string{ "eval_arbitrary_var": "123", - }, // vars + }, + // inputs map[string]any{ "eval_arbitrary_input": "456", - }, // inputs + }, ) assert.NoError(t, err) assert.EqualValues(t, test.group, group) - assert.EqualValues(t, test.cancelInProgress, cancelInProgress) + if test.cancelInProgressNil { + assert.Nil(t, cancelInProgress) + } else { + require.NotNil(t, cancelInProgress) + assert.EqualValues(t, test.cancelInProgress, *cancelInProgress) + } }) } } From 46a955d1ffecdb44bfbb38af95b6dc3b81db2402 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 27 Sep 2025 07:55:28 +0200 Subject: [PATCH 49/99] Revert "Update module connectrpc.com/connect to v1.19.0 (#1029)" This reverts commit 9c09ca3f565af655d415c4a92a1fcda46677cdad. --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 93e4f33b..d1763deb 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.7 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 - connectrpc.com/connect v1.19.0 + connectrpc.com/connect v1.18.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 diff --git a/go.sum b/go.sum index fea04a05..d5b9a302 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= -connectrpc.com/connect v1.19.0 h1:LuqUbq01PqbtL0o7vn0WMRXzR2nNsiINe5zfcJ24pJM= -connectrpc.com/connect v1.19.0/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= +connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= +connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= From ea824bde1ca7392705ffba72086197c232a02ad4 Mon Sep 17 00:00:00 2001 From: 2franix <2franix@noreply.code.forgejo.org> Date: Sun, 28 Sep 2025 07:15:51 +0000 Subject: [PATCH 50/99] chore: test: exercise contexts in matrix when validating workflows (#1033) After realizing my mistake on my proposed fixes in #1028, I figured I could at least propose another test covering the use of contexts in `jobs..strategy.matrix`. The specification for available contexts is [here](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#context-availability): | Workflow key | Context | | -------------------- | ----------- | | `jobs..strategy` | `github`, `needs`, `vars`, `inputs` | In Forgejo, the `forge` and `forgejo` contexts are supported in addition to `github`. The new test covers a matrix with [`include`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstrategymatrixinclude), [`exclude`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstrategymatrixexclude) and custom properties. Both available and unavailable contexts are tested. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1033): chore: test: exercise contexts in matrix when validating workflows Co-authored-by: 2franix Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1033 Reviewed-by: earl-warren Co-authored-by: 2franix <2franix@noreply.code.forgejo.org> Co-committed-by: 2franix <2franix@noreply.code.forgejo.org> --- act/schema/schema_test.go | 78 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index 2e77f3b7..9661b930 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -30,6 +30,84 @@ jobs: assert.NoError(t, err) } +func TestContextsInWorkflowMatrix(t *testing.T) { + t.Run("KnownContexts", func(t *testing.T) { + // Parse raw YAML snippet. + var node yaml.Node + err := yaml.Unmarshal([]byte(` +on: push + +jobs: + job: + uses: ./.forgejo/workflow/test.yaml + strategy: + matrix: + input1: + - ${{ forge.KEY }} + - ${{ forgejo.KEY }} + - ${{ github.KEY }} + - ${{ inputs.KEY }} + - ${{ vars.KEY }} + - ${{ needs.KEY }} + include: + - forge: ${{ forge.KEY }} + - forgejo: ${{ forgejo.KEY }} + - github: ${{ github.KEY }} + - inputs: ${{ inputs.KEY }} + - vars: ${{ vars.KEY }} + - needs: ${{ needs.KEY }} + exclude: + - forge: ${{ forge.KEY }} + - forgejo: ${{ forgejo.KEY }} + - github: ${{ github.KEY }} + - inputs: ${{ inputs.KEY }} + - vars: ${{ vars.KEY }} + - needs: ${{ needs.KEY }} +`), &node) + if !assert.NoError(t, err) { + return + } + + // Parse YAML node as a validated workflow. + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.NoError(t, err) + }) + + t.Run("UnknownContext", func(t *testing.T) { + for _, property := range []string{"include", "exclude", "input1"} { + t.Run(property, func(t *testing.T) { + for _, context := range []string{"secrets", "job", "steps", "runner", "matrix", "strategy"} { + t.Run(context, func(t *testing.T) { + var node yaml.Node + err := yaml.Unmarshal([]byte(fmt.Sprintf(` +on: push + +jobs: + job: + uses: ./.forgejo/workflow/test.yaml + strategy: + matrix: + %[1]s: + - input1: ${{ %[2]s.KEY }} +`, property, context)), &node) + if !assert.NoError(t, err) { + return + } + err = (&Node{ + Definition: "workflow-root", + Schema: GetWorkflowSchema(), + }).UnmarshalYAML(&node) + assert.ErrorContains(t, err, "Unknown Variable Access "+context) + }) + } + }) + } + }) +} + func TestReusableWorkflow(t *testing.T) { t.Run("KnownContexts", func(t *testing.T) { var node yaml.Node From 7f90c8acb252825d2b4098df06edb75f02010c90 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sun, 28 Sep 2025 14:49:45 +0000 Subject: [PATCH 51/99] fix: do not attempt to run the LXC stop script with self-hosted (#1037) The test is covered by TestRunnerLXC which verifies the script actually runs on LXC. Resolves forgejo/runner#1035 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1037): fix: do not attempt to run the LXC stop script with self-hosted Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1037 Reviewed-by: fnetX Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/run_context.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index bf74a92f..f344a046 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -254,6 +254,10 @@ func (rc *RunContext) stopHostEnvironment(ctx context.Context) error { logger := common.Logger(ctx) logger.Debugf("stopHostEnvironment") + if !rc.IsLXCHostEnv(ctx) { + return nil + } + var stopScript bytes.Buffer if err := stopTemplate.Execute(&stopScript, struct { Name string From d79d043696008be003e734ce8001c5e466c57b38 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 30 Sep 2025 19:12:45 +0000 Subject: [PATCH 52/99] fix: allow GC & cache operations to operate concurrently (#1040) Fixes #1039. Rather than opening and closing the Bolt DB instance constantly, the cache now maintains one open `*bolthold.Store` for its lifetime, allowing GC, cache read, and cache write operations to occur concurrently. The major risk is this change is, "is it safe to use one Bolt instance across goroutines concurrently?" [Bolt does document its concurrency requirements](https://github.com/boltdb/bolt?tab=readme-ov-file#transactions), and an analysis of our DB interactions looks to me like it introduces very little risk. Most of the cache operations perform multiple touches to the database; for example `useCache` performs a read to fetch a cache object, and then an update to set its `UsedAt` timestamp. If we wanted to ensure consistency in these operations, they should use a Bolt ReadWrite transaction -- but concurrent access would just be setting the field to the same value anyway. The `gcCache` is the complex operation where a transaction might be warranted -- but doing so would also cause the same bug that #1039 indicates. I believe it is safe to run without a transaction because it is protected by an application-level mutex (to prevent multiple concurrent GCs), it is the only code that performs deletes from the database -- these should guarantee that all its delete attempts are successful. In the event of unexpected failure to do the DB write, `gcCache` deletes from the storage before deleting from the DB, so it should just attempt to cleanup again next run. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1040): fix: allow GC & cache operations to operate concurrently Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1040 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/artifactcache/caches.go | 47 +++++++++++++++-------------- act/artifactcache/caches_test.go | 5 ++-- act/artifactcache/handler.go | 28 +++++++----------- act/artifactcache/handler_test.go | 49 ++++++------------------------- act/artifactcache/mock_caches.go | 23 ++++++--------- 5 files changed, 53 insertions(+), 99 deletions(-) diff --git a/act/artifactcache/caches.go b/act/artifactcache/caches.go index 6d499c8a..b4d9bd17 100644 --- a/act/artifactcache/caches.go +++ b/act/artifactcache/caches.go @@ -19,12 +19,13 @@ import ( //go:generate mockery --inpackage --name caches type caches interface { - openDB() (*bolthold.Store, error) + getDB() *bolthold.Store validateMac(rundata RunData) (string, error) readCache(id uint64, repo string) (*Cache, error) useCache(id uint64) error setgcAt(at time.Time) gcCache() + close() serve(w http.ResponseWriter, r *http.Request, id uint64) commit(id uint64, size int64) (int64, error) @@ -38,6 +39,8 @@ type cachesImpl struct { logger logrus.FieldLogger secret string + db *bolthold.Store + gcing atomic.Bool gcAt time.Time } @@ -68,12 +71,6 @@ func newCaches(dir, secret string, logger logrus.FieldLogger) (caches, error) { } c.storage = storage - c.gcCache() - - return c, nil -} - -func (c *cachesImpl) openDB() (*bolthold.Store, error) { file := filepath.Join(c.dir, "bolt.db") db, err := bolthold.Open(file, 0o644, &bolthold.Options{ Encoder: json.Marshal, @@ -87,7 +84,22 @@ func (c *cachesImpl) openDB() (*bolthold.Store, error) { if err != nil { return nil, fmt.Errorf("Open(%s): %w", file, err) } - return db, nil + c.db = db + + c.gcCache() + + return c, nil +} + +func (c *cachesImpl) close() { + if c.db != nil { + c.db.Close() + c.db = nil + } +} + +func (c *cachesImpl) getDB() *bolthold.Store { + return c.db } var findCacheWithIsolationKeyFallback = func(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) { @@ -156,11 +168,7 @@ func insertCache(db *bolthold.Store, cache *Cache) error { } func (c *cachesImpl) readCache(id uint64, repo string) (*Cache, error) { - db, err := c.openDB() - if err != nil { - return nil, err - } - defer db.Close() + db := c.getDB() cache := &Cache{} if err := db.Get(id, cache); err != nil { return nil, fmt.Errorf("readCache: Get(%v): %w", id, err) @@ -173,11 +181,7 @@ func (c *cachesImpl) readCache(id uint64, repo string) (*Cache, error) { } func (c *cachesImpl) useCache(id uint64) error { - db, err := c.openDB() - if err != nil { - return err - } - defer db.Close() + db := c.getDB() cache := &Cache{} if err := db.Get(id, cache); err != nil { return fmt.Errorf("useCache: Get(%v): %w", id, err) @@ -232,12 +236,7 @@ func (c *cachesImpl) gcCache() { c.gcAt = time.Now() c.logger.Debugf("gc: %v", c.gcAt.String()) - db, err := c.openDB() - if err != nil { - fatal(c.logger, err) - return - } - defer db.Close() + db := c.getDB() // Remove the caches which are not completed for a while, they are most likely to be broken. var caches []*Cache diff --git a/act/artifactcache/caches_test.go b/act/artifactcache/caches_test.go index a08a9af7..34eab331 100644 --- a/act/artifactcache/caches_test.go +++ b/act/artifactcache/caches_test.go @@ -14,6 +14,7 @@ import ( func TestCacheReadWrite(t *testing.T) { caches, err := newCaches(t.TempDir(), "secret", logrus.New()) require.NoError(t, err) + defer caches.close() t.Run("NotFound", func(t *testing.T) { found, err := caches.readCache(456, "repo") assert.Nil(t, found) @@ -33,9 +34,7 @@ func TestCacheReadWrite(t *testing.T) { cache.Repo = repo t.Run("Insert", func(t *testing.T) { - db, err := caches.openDB() - require.NoError(t, err) - defer db.Close() + db := caches.getDB() assert.NoError(t, insertCache(db, cache)) }) diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 0b574397..29ff61e3 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -122,6 +122,10 @@ func (h *handler) Close() error { return nil } var retErr error + if h.caches != nil { + h.caches.close() + h.caches = nil + } if h.server != nil { err := h.server.Close() if err != nil { @@ -151,6 +155,9 @@ func (h *handler) getCaches() caches { } func (h *handler) setCaches(caches caches) { + if h.caches != nil { + h.caches.close() + } h.caches = caches } @@ -170,12 +177,7 @@ func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter } version := r.URL.Query().Get("version") - db, err := h.caches.openDB() - if err != nil { - h.responseFatalJSON(w, r, err) - return - } - defer db.Close() + db := h.caches.getDB() cache, err := findCacheWithIsolationKeyFallback(db, repo, keys, version, rundata.WriteIsolationKey) if err != nil { @@ -221,12 +223,7 @@ func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprou api.Key = strings.ToLower(api.Key) cache := api.ToCache() - db, err := h.caches.openDB() - if err != nil { - h.responseFatalJSON(w, r, err) - return - } - defer db.Close() + db := h.caches.getDB() now := time.Now().Unix() cache.CreatedAt = now @@ -335,12 +332,7 @@ func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprout // write real size back to cache, it may be different from the current value when the request doesn't specify it. cache.Size = size - db, err := h.caches.openDB() - if err != nil { - h.responseFatalJSON(w, r, err) - return - } - defer db.Close() + db := h.caches.getDB() cache.Complete = true if err := db.Update(cache.ID, cache); err != nil { diff --git a/act/artifactcache/handler_test.go b/act/artifactcache/handler_test.go index 136f1a87..91754f77 100644 --- a/act/artifactcache/handler_test.go +++ b/act/artifactcache/handler_test.go @@ -78,9 +78,7 @@ func TestHandler(t *testing.T) { defer func() { t.Run("inspect db", func(t *testing.T) { - db, err := handler.getCaches().openDB() - require.NoError(t, err) - defer db.Close() + db := handler.getCaches().getDB() require.NoError(t, db.Bolt().View(func(tx *bbolt.Tx) error { return tx.Bucket([]byte("Cache")).ForEach(func(k, v []byte) error { t.Logf("%s: %s", k, v) @@ -937,40 +935,11 @@ func TestHandlerAPIFatalErrors(t *testing.T) { handler.find(w, req, nil) }, }, - { - name: "find open", - caches: func(t *testing.T, message string) caches { - caches := newMockCaches(t) - caches.On("validateMac", RunData{}).Return(cacheRepo, nil) - caches.On("openDB", mock.Anything, mock.Anything).Return(nil, errors.New(message)) - return caches - }, - call: func(t *testing.T, handler Handler, w http.ResponseWriter) { - req, err := http.NewRequest("GET", "example.com/cache", nil) - require.NoError(t, err) - handler.find(w, req, nil) - }, - }, - { - name: "reserve", - caches: func(t *testing.T, message string) caches { - caches := newMockCaches(t) - caches.On("validateMac", RunData{}).Return(cacheRepo, nil) - caches.On("openDB", mock.Anything, mock.Anything).Return(nil, errors.New(message)) - return caches - }, - call: func(t *testing.T, handler Handler, w http.ResponseWriter) { - body, err := json.Marshal(&Request{}) - require.NoError(t, err) - req, err := http.NewRequest("POST", "example.com/caches", bytes.NewReader(body)) - require.NoError(t, err) - handler.reserve(w, req, nil) - }, - }, { name: "upload", caches: func(t *testing.T, message string) caches { caches := newMockCaches(t) + caches.On("close").Return() caches.On("validateMac", RunData{}).Return(cacheRepo, nil) caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) return caches @@ -988,6 +957,7 @@ func TestHandlerAPIFatalErrors(t *testing.T) { name: "commit", caches: func(t *testing.T, message string) caches { caches := newMockCaches(t) + caches.On("close").Return() caches.On("validateMac", RunData{}).Return(cacheRepo, nil) caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) return caches @@ -1005,6 +975,7 @@ func TestHandlerAPIFatalErrors(t *testing.T) { name: "get", caches: func(t *testing.T, message string) caches { caches := newMockCaches(t) + caches.On("close").Return() caches.On("validateMac", RunData{}).Return(cacheRepo, nil) caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message)) return caches @@ -1042,10 +1013,12 @@ func TestHandlerAPIFatalErrors(t *testing.T) { dir := filepath.Join(t.TempDir(), "artifactcache") handler, err := StartHandler(dir, "", 0, "secret", nil) require.NoError(t, err) + defer handler.Close() fatalMessage = "" - handler.setCaches(testCase.caches(t, message)) + caches := testCase.caches(t, message) // doesn't need to be closed because it will be given to handler + handler.setCaches(caches) w := httptest.NewRecorder() testCase.call(t, handler, w) @@ -1138,18 +1111,15 @@ func TestHandler_gcCache(t *testing.T) { }, } - db, err := handler.getCaches().openDB() - require.NoError(t, err) + db := handler.getCaches().getDB() for _, c := range cases { require.NoError(t, insertCache(db, c.Cache)) } - require.NoError(t, db.Close()) handler.getCaches().setgcAt(time.Time{}) // ensure gcCache will not skip handler.getCaches().gcCache() - db, err = handler.getCaches().openDB() - require.NoError(t, err) + db = handler.getCaches().getDB() for i, v := range cases { t.Run(fmt.Sprintf("%d_%s", i, v.Cache.Key), func(t *testing.T) { cache := &Cache{} @@ -1161,7 +1131,6 @@ func TestHandler_gcCache(t *testing.T) { } }) } - require.NoError(t, db.Close()) } func TestHandler_ExternalURL(t *testing.T) { diff --git a/act/artifactcache/mock_caches.go b/act/artifactcache/mock_caches.go index 9d484f80..cadf0b95 100644 --- a/act/artifactcache/mock_caches.go +++ b/act/artifactcache/mock_caches.go @@ -19,6 +19,11 @@ type mockCaches struct { mock.Mock } +// close provides a mock function with no fields +func (_m *mockCaches) close() { + _m.Called() +} + // commit provides a mock function with given fields: id, size func (_m *mockCaches) commit(id uint64, size int64) (int64, error) { ret := _m.Called(id, size) @@ -80,19 +85,15 @@ func (_m *mockCaches) gcCache() { _m.Called() } -// openDB provides a mock function with no fields -func (_m *mockCaches) openDB() (*bolthold.Store, error) { +// getDB provides a mock function with no fields +func (_m *mockCaches) getDB() *bolthold.Store { ret := _m.Called() if len(ret) == 0 { - panic("no return value specified for openDB") + panic("no return value specified for getDB") } var r0 *bolthold.Store - var r1 error - if rf, ok := ret.Get(0).(func() (*bolthold.Store, error)); ok { - return rf() - } if rf, ok := ret.Get(0).(func() *bolthold.Store); ok { r0 = rf() } else { @@ -101,13 +102,7 @@ func (_m *mockCaches) openDB() (*bolthold.Store, error) { } } - if rf, ok := ret.Get(1).(func() error); ok { - r1 = rf() - } else { - r1 = ret.Error(1) - } - - return r0, r1 + return r0 } // readCache provides a mock function with given fields: id, repo From 01766ff4e2f0b9e2fd3b012bc91b4dfa1d4abb05 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 1 Oct 2025 16:38:38 +0000 Subject: [PATCH 53/99] fix: modifying a cache secret does not invalidate cached entries (#1043) Resolves forgejo/runner#1041 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1043): fix: modifying a cache secret does not invalidate cached entries Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1043 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/config/config.example.yaml | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index 4e447e9d..c32526e1 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -110,25 +110,20 @@ cache: # external_server: "" # - ####################################################################### - # - # Common to the internal and external cache server - # - ####################################################################### - # # The shared cache secret used to secure the communications between # the cache proxy and the cache server. # # If empty, it will be generated to a new secret automatically when # the server starts and it will stay the same until it restarts. # - # Every time the secret is modified, all cache entries that were - # created with it are invalidated. In order to ensure that the cache - # content is reused when the runner restarts, this secret must be - # set, for instance with the output of openssl rand -hex 40. - # secret: "" # + ####################################################################### + # + # Common to the internal and external cache server + # + ####################################################################### + # # The IP or hostname (195.84.20.30 or example.com) to use when constructing # ACTIONS_CACHE_URL which is the URL of the cache proxy. # From 63351343ba07fa11763a03768e615ab6e1c9b39f Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Thu, 2 Oct 2025 22:43:50 +0000 Subject: [PATCH 54/99] fix: improve logging to diagnose mystery job terminations (#1048) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Additional logging to support #1044. Manual testing only. Cases tested: Cancel a job from Forgejo UI; this seems like the most likely missing piece in #1044 as two jobs were simultaneously marked as "Failed". There are codepaths in Forgejo that can set this state to both cancelled and failed, but the runner didn't provide log output indicating that's why a job was stopping: ``` time="2025-10-02T13:22:53-06:00" level=info msg="UpdateTask returned task result RESULT_CANCELLED for a task that was in local state RESULT_UNSPECIFIED - beginning local task termination" func="[ReportState]" file="[reporter.go:410]" ``` Host-based executor hits step timeout in exec, or, is cancelled. This occurred but only logged the `err` from `exec`, not the context error indicating whether it was a timeout or a cancellation: ``` [Test Action/job1] this step has been cancelled: ctx: context deadline exceeded, exec: RUN signal: killed [Test Action/job1] this step has been cancelled: ctx: context canceled, exec: RUN signal: killed ``` Unable to `ReportState` due to Forgejo inaccessible. If the runner isn't able to update state to Forgejo a job could be considered a zombie; this would trigger one of the codepaths where the job would be marked as failed. If connectivity was later restored, then the runner could identify it was marked as failed and cancel the job context. (This combination doesn't seem likely, but, I think it's reasonable to consider these failures as warnings because there may be unexpected errors here that we're not aware of). ``` time="2025-10-02T13:27:19-06:00" level=warning msg="ReportState error: unavailable: 502 Bad Gateway" func="[RunDaemon]" file="[reporter.go:207]" ``` Runner shutdown logging; just changed up to `Info` level: ``` time="2025-10-02T13:31:36-06:00" level=info msg="forcing the jobs to shutdown" func="[Shutdown]" file="[poller.go:93]" [Test Action/job1] ❌ Failure - Main sleep 120 [Test Action/job1] this step has been cancelled: ctx: context canceled, exec: RUN signal: killed ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1048): fix: improve logging to diagnose mystery job terminations Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1048 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/container/host_environment.go | 2 +- act/runner/run_context.go | 2 +- act/runner/step.go | 6 +++--- internal/app/poll/poller.go | 4 ++-- internal/pkg/report/reporter.go | 24 +++++++++++++++++++++--- 5 files changed, 28 insertions(+), 10 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index 405862a9..c8742008 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -389,7 +389,7 @@ func (e *HostEnvironment) ExecWithCmdLine(command []string, cmdline string, env if err := e.exec(ctx, command, cmdline, env, user, workdir); err != nil { select { case <-ctx.Done(): - return fmt.Errorf("this step has been cancelled: %w", err) + return fmt.Errorf("this step has been cancelled: ctx: %w, exec: %w", ctx.Err(), err) default: return err } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index f344a046..bb79ad3a 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -949,7 +949,7 @@ func (rc *RunContext) Executor() (common.Executor, error) { return err } if res { - timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, rc.Run.Job().TimeoutMinutes) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, "job", rc.ExprEval, rc.Run.Job().TimeoutMinutes) defer cancelTimeOut() return executor(timeoutctx) diff --git a/act/runner/step.go b/act/runner/step.go index 322b6f7e..c93291c4 100644 --- a/act/runner/step.go +++ b/act/runner/step.go @@ -177,7 +177,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo Mode: 0o666, })(ctx) - timeoutctx, cancelTimeOut := evaluateTimeout(ctx, rc.ExprEval, stepModel.TimeoutMinutes) + timeoutctx, cancelTimeOut := evaluateTimeout(ctx, "step", rc.ExprEval, stepModel.TimeoutMinutes) defer cancelTimeOut() err = executor(timeoutctx) @@ -213,12 +213,12 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo } } -func evaluateTimeout(ctx context.Context, exprEval ExpressionEvaluator, timeoutMinutes string) (context.Context, context.CancelFunc) { +func evaluateTimeout(ctx context.Context, contextType string, exprEval ExpressionEvaluator, timeoutMinutes string) (context.Context, context.CancelFunc) { timeout := exprEval.Interpolate(ctx, timeoutMinutes) if timeout != "" { timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64) if err == nil { - common.Logger(ctx).Debugf("the step will stop in timeout-minutes %s", timeout) + common.Logger(ctx).Debugf("the %s will stop in timeout-minutes %s", contextType, timeout) return context.WithTimeout(ctx, time.Duration(timeOutMinutes)*time.Minute) } common.Logger(ctx).Errorf("timeout-minutes %s cannot be parsed and will be ignored: %w", timeout, err) diff --git a/internal/app/poll/poller.go b/internal/app/poll/poller.go index 7b954cb7..c880bc67 100644 --- a/internal/app/poll/poller.go +++ b/internal/app/poll/poller.go @@ -90,10 +90,10 @@ func (p *poller) Shutdown(ctx context.Context) error { return nil case <-ctx.Done(): - log.Trace("forcing the jobs to shutdown") + log.Info("forcing the jobs to shutdown") p.shutdownJobs() <-p.done - log.Trace("all jobs have been shutdown") + log.Info("all jobs have been shutdown") return ctx.Err() } } diff --git a/internal/pkg/report/reporter.go b/internal/pkg/report/reporter.go index 7e46b8bb..804744cc 100644 --- a/internal/pkg/report/reporter.go +++ b/internal/pkg/report/reporter.go @@ -48,6 +48,7 @@ type Reporter struct { debugOutputEnabled bool stopCommandEndToken string + issuedLocalCancel bool } func NewReporter(ctx context.Context, cancel context.CancelFunc, c client.Client, task *runnerv1.Task, reportInterval time.Duration) *Reporter { @@ -192,11 +193,19 @@ func (r *Reporter) RunDaemon() { return } if r.ctx.Err() != nil { + // This shouldn't happen because DaemonContext is used for `r.ctx` which should outlive any running job. + log.Warnf("Terminating RunDaemon on an active job due to error: %v", r.ctx.Err()) return } - _ = r.ReportLog(false) - _ = r.ReportState() + err := r.ReportLog(false) + if err != nil { + log.Warnf("ReportLog error: %v", err) + } + err = r.ReportState() + if err != nil { + log.Warnf("ReportState error: %v", err) + } time.AfterFunc(r.reportInterval, r.RunDaemon) } @@ -391,8 +400,17 @@ func (r *Reporter) ReportState() error { r.outputs.Store(k, struct{}{}) } - switch resp.Msg.GetState().GetResult() { + localResultState := state.GetResult() + remoteResultState := resp.Msg.GetState().GetResult() + switch remoteResultState { case runnerv1.Result_RESULT_CANCELLED, runnerv1.Result_RESULT_FAILURE: + // issuedLocalCancel is just used to deduplicate this log message if our local state doesn't catch up with our + // remote state as quickly as the report-interval, which would cause this message to repeat in the logs. + if !r.issuedLocalCancel && remoteResultState != localResultState { + log.Infof("UpdateTask returned task result %v for a task that was in local state %v - beginning local task termination", + remoteResultState, localResultState) + r.issuedLocalCancel = true + } r.cancel() } From b772be7131102d2c19a745811a569cd4ff1cbced Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 3 Oct 2025 08:22:06 +0000 Subject: [PATCH 55/99] fix(security): a multiline secret may be found in a single log entry (#1051) With secrets.MULTILINE set to ``` ABC DEF GHI ``` the following is logged in debug mode: ``` 2025-09-18T10:54:04.4656189Z expression '${{ secrets.MULTILINE }}' rewritten to 'format('{0}', secrets.MULTILINE)' 2025-09-18T10:54:04.4656426Z evaluating expression 'format('{0}', secrets.MULTILINE)' 2025-09-18T10:54:04.4656797Z expression 'format('{0}', secrets.MULTILINE)' evaluated to '%!t(string=ABC\nDEF\nGHI)' ``` Although it is displayed with \ followed by n, it is a single line entry displayed with the secret verbatim and must also be redacted. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1051): fix(security): a multiline secret may be found in a single log entry Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1051 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- internal/pkg/report/mask.go | 2 +- internal/pkg/report/mask_test.go | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/internal/pkg/report/mask.go b/internal/pkg/report/mask.go index 2ae19b8f..3dbb6f42 100644 --- a/internal/pkg/report/mask.go +++ b/internal/pkg/report/mask.go @@ -38,7 +38,7 @@ func (o *masker) add(secret string) { }) // a multiline secret transformed into a single line by replacing // newlines with \ followed by n must also be redacted - secret = strings.Join(lines, "\\n") + o.lines = append(o.lines, strings.Join(lines, "\\n")) } o.lines = append(o.lines, secret) diff --git a/internal/pkg/report/mask_test.go b/internal/pkg/report/mask_test.go index 8f26e698..b785c4dc 100644 --- a/internal/pkg/report/mask_test.go +++ b/internal/pkg/report/mask_test.go @@ -7,6 +7,8 @@ import ( "fmt" "testing" + runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1" + "github.com/stretchr/testify/assert" ) @@ -267,4 +269,17 @@ SIX` assert.Equal(t, testCase.out, rowsToString(rows)) }) } + + t.Run("MultilineSecretInSingleRow", func(t *testing.T) { + secret := "ABC\nDEF\nGHI" + m := newMasker() + m.add(secret) + rows := []*runnerv1.LogRow{ + {Content: fmt.Sprintf("BEFORE%sAFTER", secret)}, + } + noMore := false + needMore := m.replace(rows, noMore) + assert.False(t, needMore) + assert.Equal(t, "BEFORE***AFTER\n", rowsToString(rows)) + }) } From 1fa156c7e40c908a742742961e0f1c165ab42699 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 3 Oct 2025 09:03:32 +0000 Subject: [PATCH 56/99] Update dependency forgejo/lxc-helpers to v1.1.1 (#1050) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers) | patch | `1.1.0` -> `1.1.1` | --- ### Release Notes
forgejo/lxc-helpers (forgejo/lxc-helpers) ### [`v1.1.1`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.0...v1.1.1) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.0...v1.1.1)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1050 Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index c0334bea..0c1e2204 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -20,7 +20,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_TOKEN:=} : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} -DEFAULT_LXC_HELPERS_VERSION=1.1.0 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers +DEFAULT_LXC_HELPERS_VERSION=1.1.1 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} From a980acd9369da246bfc8f72a6aa8992c3ab71feb Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Fri, 3 Oct 2025 09:09:29 +0000 Subject: [PATCH 57/99] fix: make the creation of LXC templates atomic so they cannot be interrupted while building (#1049) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/49 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1049): cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers refs/pull/49/head to forgejo/lxc-helpers-49 Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1049 Reviewed-by: earl-warren Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 78 ++++++++++++++++++++++++++++------- 1 file changed, 63 insertions(+), 15 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index 78d70113..cd855a89 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -11,6 +11,8 @@ LXC_IPV6_PREFIX_DEFAULT="fd15" LXC_DOCKER_PREFIX_DEFAULT="172.17" LXC_IPV6_DOCKER_PREFIX_DEFAULT="fd00:d0ca" LXC_APT_TOO_OLD='1 week ago' +: ${LXC_TRANSACTION_TIMEOUT:=600} +LXC_TRANSACTION_LOCK_FILE=/tmp/lxc-helper.lock : ${LXC_SUDO:=} : ${LXC_CONTAINER_RELEASE:=bookworm} @@ -28,16 +30,22 @@ function lxc_template_release() { echo lxc-helpers-$LXC_CONTAINER_RELEASE } +function lxc_directory() { + local name="$1" + + echo /var/lib/lxc/$name +} + function lxc_root() { local name="$1" - echo /var/lib/lxc/$name/rootfs + echo $(lxc_directory $name)/rootfs } function lxc_config() { local name="$1" - echo /var/lib/lxc/$name/config + echo $(lxc_directory $name)/config } function lxc_container_run() { @@ -47,6 +55,44 @@ function lxc_container_run() { $LXC_SUDO lxc-attach --clear-env --name $name -- "$@" } +function lxc_transaction_lock() { + exec 7>$LXC_TRANSACTION_LOCK_FILE + flock --timeout $LXC_TRANSACTION_TIMEOUT 7 +} + +function lxc_transaction_unlock() { + exec 7>&- +} + +function lxc_transaction_draft_name() { + echo "lxc-helper-draft" +} + +function lxc_transaction_begin() { + local name=$1 # not actually used but it helps when reading in the caller + local draft=$(lxc_transaction_draft_name) + + lxc_transaction_lock + lxc_container_destroy $draft + + echo $draft +} + +function lxc_transaction_commit() { + local name=$1 + local draft=$(lxc_transaction_draft_name) + + # do not use lxc-copy because it is not atomic if lxc-copy is + # interrupted it may leave the $name container half populated + $LXC_SUDO sed -i -e "s/$draft/$name/g" \ + $(lxc_config $draft) \ + $(lxc_root $draft)/etc/hosts \ + $(lxc_root $draft)/etc/hostname + $LXC_SUDO rm -f $(lxc_root $draft)/var/lib/dhcp/dhclient.* + $LXC_SUDO mv $(lxc_directory $draft) $(lxc_directory $name) + lxc_transaction_unlock +} + function lxc_container_run_script_as() { local name="$1" local user="$2" @@ -242,7 +288,7 @@ function lxc_container_configure() { function lxc_container_install_lxc_helpers() { local name="$1" - $LXC_SUDO cp -a $LXC_SELF_DIR/lxc-helpers*.sh $root/$LXC_BIN + $LXC_SUDO cp -a $LXC_SELF_DIR/lxc-helpers*.sh $(lxc_root $name)/$LXC_BIN # # Wait for the network to come up # @@ -304,10 +350,9 @@ function lxc_container_stop() { function lxc_container_destroy() { local name="$1" - local root="$2" if lxc_exists "$name"; then - lxc_container_stop $name $root + lxc_container_stop $name $LXC_SUDO lxc-destroy --force --name="$name" fi } @@ -346,14 +391,15 @@ function lxc_build_template_release() { return fi - local root=$(lxc_root $name) - $LXC_SUDO lxc-create --name $name --template debian -- --release=$LXC_CONTAINER_RELEASE - echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $name) - lxc_container_install_lxc_helpers $name - lxc_container_start $name - lxc_container_run $name apt-get update -qq - lxc_apt_install $name sudo git python3 - lxc_container_stop $name + local draft=$(lxc_transaction_begin $name) + $LXC_SUDO lxc-create --name $draft --template debian -- --release=$LXC_CONTAINER_RELEASE + echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $draft) + lxc_container_install_lxc_helpers $draft + lxc_container_start $draft + lxc_container_run $draft apt-get update -qq + lxc_apt_install $draft sudo git python3 + lxc_container_stop $draft + lxc_transaction_commit $name } function lxc_build_template() { @@ -368,10 +414,12 @@ function lxc_build_template() { lxc_build_template_release fi - if ! $LXC_SUDO lxc-copy --name=$name --newname=$newname; then - echo lxc-copy --name=$name --newname=$newname failed + local draft=$(lxc_transaction_begin $newname) + if ! $LXC_SUDO lxc-copy --name=$name --newname=$draft; then + echo lxc-copy --name=$name --newname=$draft failed return 1 fi + lxc_transaction_commit $newname lxc_container_configure $newname } From 413a52605df9d06dc4d6f375164f80eb2a6649bd Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 3 Oct 2025 16:14:08 +0000 Subject: [PATCH 58/99] fix: remove LXC backend leftovers when the job completes (#1054) - remove the root of the LXC container after destroying it, with sudo as it may contain files owned by root while the runner id is not root - os.RemoveAll only for native host runs, it is no longer needed for the LXC backend - remove the CleanUp function that is an indirection with no use Resolves forgejo/runner#442 When running the test from a non-root user and without this fix, it fails as follow: ``` go test -v -count=1 -run='TestRunnerLXC' ./internal/app/run === RUN TestRunnerLXC ... time="2025-10-03T15:05:12+02:00" level=debug msg=stopHostEnvironment time="2025-10-03T15:05:13+02:00" level=debug msg="HostEnvironment.Remove /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor" time="2025-10-03T15:05:13+02:00" level=error msg="Error while stop job container FORGEJO-ACTIONS-TASK-0_WORKFLOW-3ede81fbc69d42e6db70bef5820490fc3e7dc4d9dcbfb64981f2d00f08a30d6e_JOB-job: unlinkat /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor/some/directory/owned/by/root: permission denied" === NAME TestRunnerLXC runner_test.go:469: Error Trace: /home/earl-warren/software/runner/internal/app/run/runner_test.go:469 /home/earl-warren/software/runner/internal/app/run/runner_test.go:496 Error: Received unexpected error: Error occurred running finally: unlinkat /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor/some/directory/owned/by/root: permission denied (original error: ) Test: TestRunnerLXC Messages: OK === NAME TestRunnerLXC/OK testing.go:1679: test executed panic(nil) or runtime.Goexit: subtest may have called FailNow on a parent test === NAME TestRunnerLXC testing.go:1267: TempDir RemoveAll cleanup: unlinkat /tmp/TestRunnerLXC1841090130/001/d29c1256e2912892/hostexecutor/some/directory/owned/by/root: permission denied --- FAIL: TestRunnerLXC (6.84s) --- FAIL: TestRunnerLXC/OK (6.84s) FAIL FAIL code.forgejo.org/forgejo/runner/v11/internal/app/run 6.847s FAIL ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1054): fix: remove LXC backend leftovers when the job completes Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1054 Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/host_environment.go | 10 +++++----- act/runner/run_context.go | 9 ++++----- internal/app/run/runner_test.go | 2 +- 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/act/container/host_environment.go b/act/container/host_environment.go index c8742008..34d24b9b 100644 --- a/act/container/host_environment.go +++ b/act/container/host_environment.go @@ -34,7 +34,6 @@ type HostEnvironment struct { Workdir string ActPath string Root string - CleanUp func() StdOut io.Writer LXC bool } @@ -404,11 +403,12 @@ func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string) func (e *HostEnvironment) Remove() common.Executor { return func(ctx context.Context) error { - if e.CleanUp != nil { - e.CleanUp() + if e.GetLXC() { + // there may be files owned by root: removal + // is the responsibility of the LXC backend + return nil } - common.Logger(ctx).Debugf("HostEnvironment.Remove %s", e.Path) - return os.RemoveAll(e.Path) + return os.RemoveAll(e.Root) } } diff --git a/act/runner/run_context.go b/act/runner/run_context.go index bb79ad3a..59fcf6f8 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -248,6 +248,8 @@ var stopTemplate = template.Must(template.New("stop").Parse(`#!/bin/bash source $(dirname $0)/lxc-helpers-lib.sh lxc_container_destroy "{{.Name}}" +lxc_maybe_sudo +$LXC_SUDO rm -fr "{{ .Root }}" `)) func (rc *RunContext) stopHostEnvironment(ctx context.Context) error { @@ -314,11 +316,8 @@ func (rc *RunContext) startHostEnvironment() common.Executor { ToolCache: rc.getToolCache(ctx), Workdir: rc.Config.Workdir, ActPath: actPath, - CleanUp: func() { - os.RemoveAll(miscpath) - }, - StdOut: logWriter, - LXC: rc.IsLXCHostEnv(ctx), + StdOut: logWriter, + LXC: rc.IsLXCHostEnv(ctx), } rc.cleanUpJobContainer = func(ctx context.Context) error { if err := rc.stopHostEnvironment(ctx); err != nil { diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index eda5de9e..bbd6c235 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -491,7 +491,7 @@ jobs: job: runs-on: lxc steps: - - run: echo OK + - run: mkdir -p some/directory/owned/by/root ` runWorkflow(ctx, cancel, workflow, "push", "refs/heads/main", "OK") }) From 996ac343ee155a4b47d89a6bf1854feb1c04fdb2 Mon Sep 17 00:00:00 2001 From: limiting-factor Date: Fri, 3 Oct 2025 16:15:43 +0000 Subject: [PATCH 59/99] chore(cleanup): lxc-helpers does not need a global lock (#1047) - https://code.forgejo.org/forgejo/lxc-helpers/src/tag/v1.1.1 has locking and atomicity - this lock was only good for when two release templates are populated simultaneously and not when it was interrupted Refs forgejo/lxc-helpers#8 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1047): WIP: chore(cleanup): lxc-helpers does not need a global lock Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1047 Reviewed-by: earl-warren Co-authored-by: limiting-factor Co-committed-by: limiting-factor --- act/runner/run_context.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 59fcf6f8..ff551322 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -193,8 +193,6 @@ var lxcHelpers string var startTemplate = template.Must(template.New("start").Parse(`#!/bin/bash -e -exec 5<>/tmp/forgejo-runner-lxc.lock ; flock --timeout 21600 5 - LXC_CONTAINER_CONFIG="{{.Config}}" LXC_CONTAINER_RELEASE="{{.Release}}" From 2bccbec3aec926d28894e73dc42690d7b64b4367 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 4 Oct 2025 11:15:31 +0000 Subject: [PATCH 60/99] Update forgejo-runner to v11.1.2 (#1055) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | patch | `11.1.1` -> `11.1.2` | | [forgejo/runner](https://code.forgejo.org/forgejo/runner) | patch | `11.1.1` -> `11.1.2` | --- ### Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner) ### [`v11.1.2`](https://code.forgejo.org/forgejo/runner/releases/tag/v11.1.2) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v11.1.1...v11.1.2) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1026): feat: support evaluating workflow-level concurrency blocks in jobparser - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1051): fix(security): a multiline secret may be found in a single log entry - [PR](https://code.forgejo.org/forgejo/runner/pulls/1048): fix: improve logging to diagnose mystery job terminations - [PR](https://code.forgejo.org/forgejo/runner/pulls/1043): fix: modifying a cache secret does not invalidate cached entries - [PR](https://code.forgejo.org/forgejo/runner/pulls/1040): fix: allow GC & cache operations to operate concurrently - [PR](https://code.forgejo.org/forgejo/runner/pulls/1037): fix: do not attempt to run the LXC stop script with self-hosted - [PR](https://code.forgejo.org/forgejo/runner/pulls/1031): fix: event.pull\_request.action == closed can use the cache of the base repository - [PR](https://code.forgejo.org/forgejo/runner/pulls/1027): fix: Correctly override the value of `Forgejo-Cache-Host` when ACTIONS\_CACHE\_URL is overridden. - [PR](https://code.forgejo.org/forgejo/runner/pulls/1019): fix: a composite action must not change the result of the calling step before it completes - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1033): chore: test: exercise contexts in matrix when validating workflows - [PR](https://code.forgejo.org/forgejo/runner/pulls/1029): Update module connectrpc.com/connect to v1.19.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1025): chore: fix typo in the documentation - [PR](https://code.forgejo.org/forgejo/runner/pulls/1023): Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.5.0 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1022): Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.6 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1020): chore: upgrade LXC example to Debian GNU/Linux trixie - [PR](https://code.forgejo.org/forgejo/runner/pulls/1021): Update action to v3.0.4 - [PR](https://code.forgejo.org/forgejo/runner/pulls/1018): Update forgejo-runner to v11.1.1
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1055 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/docker-compose/compose-forgejo-and-runner.yml | 4 ++-- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/docker-compose/compose-forgejo-and-runner.yml b/examples/docker-compose/compose-forgejo-and-runner.yml index 7aeae3ec..201650ae 100644 --- a/examples/docker-compose/compose-forgejo-and-runner.yml +++ b/examples/docker-compose/compose-forgejo-and-runner.yml @@ -51,7 +51,7 @@ services: - 8080:3000 runner-register: - image: code.forgejo.org/forgejo/runner:11.1.1 + image: code.forgejo.org/forgejo/runner:11.1.2 links: - docker-in-docker - forgejo @@ -77,7 +77,7 @@ services: ' runner-daemon: - image: code.forgejo.org/forgejo/runner:11.1.1 + image: code.forgejo.org/forgejo/runner:11.1.2 links: - docker-in-docker - forgejo diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index 0c1e2204..e949f3de 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -22,7 +22,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_LIFETIME:=7d} DEFAULT_LXC_HELPERS_VERSION=1.1.1 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} -DEFAULT_RUNNER_VERSION=11.1.1 # renovate: datasource=forgejo-releases depName=forgejo/runner +DEFAULT_RUNNER_VERSION=11.1.2 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} : ${KILL_AFTER:=21600} # 6h == 21600 From 5f3ff3d2e2020b0ca16dfae69baa5adbfff62160 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Sat, 4 Oct 2025 11:16:16 +0000 Subject: [PATCH 61/99] chore: teach renovate about example-lxc-systemd.yml (#1053) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1053 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .forgejo/workflows/example-lxc-systemd.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index e333092b..c8907609 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -14,6 +14,7 @@ env: SERIAL: "30" LIFETIME: "60" SYSTEMD_OPTIONS: "--no-pager --full" + USE_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: example-lxc-systemd: @@ -57,7 +58,7 @@ jobs: with: user: root password: admin1234 - binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v7.0.12/forgejo-7.0.12-linux-amd64 + binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v${{ env.USE_VERSION }}/forgejo-${{ env.USE_VERSION }}-linux-amd64 # must be the same as LXC_IPV4_PREFIX in examples/lxc-systemd/forgejo-runner-service.sh lxc-ip-prefix: 10.105.7 From 4010e6116501bae290629330aa54b46d98304a4b Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 5 Oct 2025 07:39:29 +0000 Subject: [PATCH 62/99] Update module google.golang.org/protobuf to v1.36.10 (#1058) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [google.golang.org/protobuf](https://github.com/protocolbuffers/protobuf-go) | `v1.36.9` -> `v1.36.10` | [![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fprotobuf/v1.36.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fprotobuf/v1.36.9/v1.36.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
protocolbuffers/protobuf-go (google.golang.org/protobuf) ### [`v1.36.10`](https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.10) [Compare Source](https://github.com/protocolbuffers/protobuf-go/compare/v1.36.9...v1.36.10) **Full Changelog**: Bug fixes: [CL/704415](https://go-review.googlesource.com/c/protobuf/+/704415): reflect/protodesc: edition-2024-specific properties should not be lost when converting FileDescriptorProto to protoreflect.FileDescriptor Maintenance: [CL/708555](https://go-review.googlesource.com/c/protobuf/+/708555): internal/race\_test: add missing impl.LazyEnabled() t.Skip [CL/703295](https://go-review.googlesource.com/c/protobuf/+/703295): proto: add more invalid group encoding test cases [CL/703276](https://go-review.googlesource.com/c/protobuf/+/703276): internal/impl: verify lazy unmarshal on Deterministic encoding [CL/703275](https://go-review.googlesource.com/c/protobuf/+/703275): internal/impl: stop using deprecated .Field in lazy\_test.go [CL/702795](https://go-review.googlesource.com/c/protobuf/+/702795): all: update to latest github.com/google/go-cmp
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1058 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index d1763deb..0ebcf50e 100644 --- a/go.mod +++ b/go.mod @@ -39,7 +39,7 @@ require ( go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.35.0 golang.org/x/time v0.13.0 - google.golang.org/protobuf v1.36.9 + google.golang.org/protobuf v1.36.10 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index d5b9a302..5231c673 100644 --- a/go.sum +++ b/go.sum @@ -260,8 +260,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU= google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw= google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA= -google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw= -google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= +google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= +google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From ba1beb08f4c774df55f3b431bf6c516384956949 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Sun, 5 Oct 2025 07:40:06 +0000 Subject: [PATCH 63/99] fix: log error for why cache couldn't be started (#1057) Example, `cache.port` set to `22`: ``` time="2025-10-04T09:27:42-06:00" level=error msg="Could not start the cache server, cache will be disabled: listen tcp :22: bind: permission denied" func="[setupCache]" file="[runner.go:126]" ``` - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1057): fix: log error for why cache couldn't be started Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1057 Reviewed-by: limiting-factor Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- internal/app/run/runner.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 1bf32c78..82deea2b 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -123,7 +123,7 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler log.StandardLogger().WithField("module", "cache_request"), ) if err != nil { - log.Error("Could not start the cache server, cache will be disabled") + log.Errorf("Could not start the cache server, cache will be disabled: %v", err) return nil } From e68940619c1194f86f527125f2be1af9aefc5b20 Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Mon, 6 Oct 2025 03:51:19 +0000 Subject: [PATCH 64/99] chore(docs): clarify the behavior of `[container].docker_host` (#1059) The description of `container.docker_host` was misleading (and IMO the setting itself does too many things, see forgejo/forgejo-actions-feature-requests#58). I clarified the comments in the example config to clearly explain that it will mount the specified socket inside the job container, and give some example values - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1059): Clarify the behavior of `container.docker_host` Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1059 Reviewed-by: earl-warren Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- internal/pkg/config/config.example.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index c32526e1..5addac41 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -176,10 +176,12 @@ container: # valid_volumes: # - '**' valid_volumes: [] - # overrides the docker client host with the specified one. - # If "-" or "", an available docker host will automatically be found. + # Overrides the docker host set by the DOCKER_HOST environment variable, and mounts on the job container. + # If "-" or "", no docker host will be mounted in the job container # If "automount", an available docker host will automatically be found and mounted in the job container (e.g. /var/run/docker.sock). - # Otherwise the specified docker host will be used and an error will be returned if it doesn't work. + # If it's a url, the specified docker host will be mounted in the job container + # Example urls: unix:///run/docker.socket or ssh://user@host + # The specified socket is mounted within the job container at /var/run/docker.sock docker_host: "-" # Pull docker image(s) even if already present force_pull: false From a22c5a2e659ef1cc296681940f4db24e078ac446 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 6 Oct 2025 04:22:26 +0000 Subject: [PATCH 65/99] Update module github.com/go-git/go-git/v5 to v5.16.3 (#1062) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.16.2` -> `v5.16.3` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.16.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.16.2/v5.16.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
go-git/go-git (github.com/go-git/go-git/v5) ### [`v5.16.3`](https://github.com/go-git/go-git/releases/tag/v5.16.3) [Compare Source](https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3) #### What's Changed - internal: Expand regex to fix build \[5.x] by [@​baloo](https://github.com/baloo) in [#​1644](https://github.com/go-git/go-git/pull/1644) - build: raise timeouts for windows CI tests and disable CIFuzz \[5.x] by [@​baloo](https://github.com/baloo) in [#​1646](https://github.com/go-git/go-git/pull/1646) - plumbing: support commits extra headers, support jujutsu signed commit \[5.x] by [@​baloo](https://github.com/baloo) in [#​1633](https://github.com/go-git/go-git/pull/1633) **Full Changelog**:
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1062 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 0ebcf50e..ec37b2c5 100644 --- a/go.mod +++ b/go.mod @@ -17,7 +17,7 @@ require ( github.com/docker/docker v28.4.0+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 - github.com/go-git/go-git/v5 v5.16.2 + github.com/go-git/go-git/v5 v5.16.3 github.com/gobwas/glob v0.2.3 github.com/google/go-cmp v0.7.0 github.com/google/uuid v1.6.0 diff --git a/go.sum b/go.sum index 5231c673..59f8c95c 100644 --- a/go.sum +++ b/go.sum @@ -69,8 +69,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM= -github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8= +github.com/go-git/go-git/v5 v5.16.3 h1:Z8BtvxZ09bYm/yYNgPKCzgWtaRqDTgIKRgIRHBfU6Z8= +github.com/go-git/go-git/v5 v5.16.3/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From 0a0b25d88609b47c4ebd2068b4edc19df6f71d98 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 7 Oct 2025 08:09:14 +0000 Subject: [PATCH 66/99] fix: don't panic on cacheproxy startup failure (#1067) In #1064 I theorized that a failure to start up the cache proxy server might cause it to still be registered as `ACTIONS_CACHE_URL`. It turns out to not be the case as it will just panic, since `cacheProxy` is `nil`. But regardless, it seems better to not panic and crash if the intent here is "cache will be disabled" as documented in the log message. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1067): fix: don't panic on cacheproxy startup failure Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1067 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- internal/app/run/runner.go | 4 +- internal/app/run/runner_test.go | 93 +++++++++++++++++++++++++++++++++ 2 files changed, 95 insertions(+), 2 deletions(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 82deea2b..31a1b320 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -150,10 +150,10 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler ) if err != nil { log.Errorf("cannot init cache proxy, cache will be disabled: %v", err) + } else { + envs["ACTIONS_CACHE_URL"] = cacheProxy.ExternalURL() } - envs["ACTIONS_CACHE_URL"] = cacheProxy.ExternalURL() - return cacheProxy } diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index bbd6c235..5de1b58c 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "net" "os" "testing" "time" @@ -421,6 +422,98 @@ jobs: }) } +func TestRunnerCacheStartupFailure(t *testing.T) { + if testing.Short() { + t.Skip("skipping integration test") + } + + testCases := []struct { + desc string + listen string + }{ + { + desc: "disable cache server", + listen: "127.0.0.1:40715", + }, + { + desc: "disable cache proxy server", + listen: "127.0.0.1:40716", + }, + } + + for _, tc := range testCases { + t.Run(tc.desc, func(t *testing.T) { + forgejoClient := &forgejoClientMock{} + + forgejoClient.On("Address").Return("https://127.0.0.1:8080") // not expected to be used in this test + forgejoClient.On("UpdateLog", mock.Anything, mock.Anything).Return(nil, nil) + forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). + Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + + // We'll be listening on some network port in this test that will conflict with the cache configuration... + l, err := net.Listen("tcp4", tc.listen) + require.NoError(t, err) + defer l.Close() + + runner := NewRunner( + &config.Config{ + Cache: config.Cache{ + Port: 40715, + ProxyPort: 40716, + Dir: t.TempDir(), + }, + Host: config.Host{ + WorkdirParent: t.TempDir(), + }, + }, + &config.Registration{ + Labels: []string{"ubuntu-latest:docker://code.forgejo.org/oci/node:20-bookworm"}, + }, + forgejoClient) + require.NotNil(t, runner) + + // Ensure that cacheProxy failed to start + assert.Nil(t, runner.cacheProxy) + + runWorkflow := func(ctx context.Context, cancel context.CancelFunc, yamlContent string) { + task := &runnerv1.Task{ + WorkflowPayload: []byte(yamlContent), + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "token": structpb.NewStringValue("some token here"), + "forgejo_default_actions_url": structpb.NewStringValue("https://data.forgejo.org"), + "repository": structpb.NewStringValue("runner"), + "event_name": structpb.NewStringValue("push"), + "ref": structpb.NewStringValue("refs/heads/main"), + }, + }, + } + + reporter := report.NewReporter(ctx, cancel, forgejoClient, task, time.Second) + err := runner.run(ctx, task, reporter) + reporter.Close(nil) + require.NoError(t, err) + } + + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + checkCacheYaml := ` +name: Verify No ACTIONS_CACHE_URL +on: + push: +jobs: + job-cache-check-1: + runs-on: ubuntu-latest + steps: + - run: echo $ACTIONS_CACHE_URL + - run: '[[ "$ACTIONS_CACHE_URL" = "" ]] || exit 1' +` + runWorkflow(ctx, cancel, checkCacheYaml) + }) + } +} + func TestRunnerLXC(t *testing.T) { if testing.Short() { t.Skip("skipping integration test") From a3d46d7597e31d491ea70e2a76152177613507ec Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 7 Oct 2025 08:12:16 +0000 Subject: [PATCH 67/99] chore: add additional logging to cacheproxy (#1065) In support of diagnosing #1064, I hope. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1065): chore: add additional logging to cacheproxy Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1065 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/cacheproxy/handler.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index e494b9c5..499c5167 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -64,7 +64,7 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheProxyHostOver discard.Out = io.Discard logger = discard } - logger = logger.WithField("module", "artifactcache") + logger = logger.WithField("module", "cacheproxy") h.logger = logger h.cacheSecret = cacheSecret @@ -139,6 +139,7 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er r.SetURL(targetURL) r.Out.URL.Path = uri + h.logger.Debugf("proxy req %s %q to %q", r.In.Method, r.In.URL, r.Out.URL) r.Out.Header.Set("Forgejo-Cache-Repo", runData.RepositoryFullName) r.Out.Header.Set("Forgejo-Cache-RunNumber", runData.RunNumber) @@ -150,6 +151,10 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er r.Out.Header.Set("Forgejo-Cache-WriteIsolationKey", runData.WriteIsolationKey) } }, + ModifyResponse: func(r *http.Response) error { + h.logger.Debugf("proxy resp %s w/ %d bytes", r.Status, r.ContentLength) + return nil + }, } return proxy, nil } From 041524d663fa205ec5e72a9dc22b9b01ffa2c481 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 7 Oct 2025 08:13:23 +0000 Subject: [PATCH 68/99] Update module github.com/docker/cli to v28.5.0+incompatible (#1066) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v28.4.0+incompatible` -> `v28.5.0+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fcli/v28.5.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fcli/v28.4.0+incompatible/v28.5.0+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/cli (github.com/docker/cli) ### [`v28.5.0+incompatible`](https://github.com/docker/cli/compare/v28.4.0...v28.5.0) [Compare Source](https://github.com/docker/cli/compare/v28.4.0...v28.5.0)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1066 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index ec37b2c5..4e85c9b6 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 - github.com/docker/cli v28.4.0+incompatible + github.com/docker/cli v28.5.0+incompatible github.com/docker/docker v28.4.0+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 diff --git a/go.sum b/go.sum index 59f8c95c..0cc56d8b 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY0UUU4C9kY= -github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v28.5.0+incompatible h1:crVqLrtKsrhC9c00ythRx435H8LiQnUKRtJLRR+Auxk= +github.com/docker/cli v28.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk= github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= From 3f52c56d1e24c31297290eacfd035fb703e6b810 Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Tue, 7 Oct 2025 14:41:55 +0000 Subject: [PATCH 69/99] feat: improve readability of error messages from ParseRawOn (#1063) With https://codeberg.org/forgejo/forgejo/pulls/9530, the error messages from `ParseRawOn` are user-facing and need a pass to improve their meaning. - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1063): feat: improve readability of error messages from ParseRawOn Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1063 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/jobparser/model.go | 60 ++++++++++++++++----------------- act/jobparser/model_test.go | 67 ++++++++++++++++++++++++++++++++++--- 2 files changed, 93 insertions(+), 34 deletions(-) diff --git a/act/jobparser/model.go b/act/jobparser/model.go index e94123e3..74de0450 100644 --- a/act/jobparser/model.go +++ b/act/jobparser/model.go @@ -2,6 +2,7 @@ package jobparser import ( "fmt" + "strings" "code.forgejo.org/forgejo/runner/v11/act/model" "go.yaml.in/yaml/v3" @@ -226,7 +227,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { var val string err := rawOn.Decode(&val) if err != nil { - return nil, err + return nil, fmt.Errorf("unable to interpret scalar value into a string: %w", err) } return []*Event{ {Name: val}, @@ -238,12 +239,12 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { return nil, err } res := make([]*Event, 0, len(val)) - for _, v := range val { + for i, v := range val { switch t := v.(type) { case string: res = append(res, &Event{Name: t}) default: - return nil, fmt.Errorf("invalid type %T", t) + return nil, fmt.Errorf("value at index %d was unexpected type %[2]T; must be a string but was %#[2]v", i, v) } } return res, nil @@ -263,16 +264,6 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { continue } switch t := v.(type) { - case string: - res = append(res, &Event{ - Name: k, - acts: map[string][]string{}, - }) - case []string: - res = append(res, &Event{ - Name: k, - acts: map[string][]string{}, - }) case map[string]any: acts := make(map[string][]string, len(t)) for act, branches := range t { @@ -286,15 +277,15 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { for i, v := range b { var ok bool if acts[act][i], ok = v.(string); !ok { - return nil, fmt.Errorf("unknown on type: %#v", branches) + return nil, fmt.Errorf("key %q.%q index %d had unexpected type %[4]T; a string was expected but was %#[4]v", k, act, i, v) } } case map[string]any: - if isInvalidOnType(k, act) { - return nil, fmt.Errorf("unknown on type: %#v", v) + if err := isInvalidOnType(k, act); err != nil { + return nil, fmt.Errorf("invalid value on key %q: %w", k, err) } default: - return nil, fmt.Errorf("unknown on type: %#v", branches) + return nil, fmt.Errorf("key %q.%q had unexpected type %T; was %#v", k, act, branches, branches) } } if k == "workflow_dispatch" || k == "workflow_call" { @@ -306,19 +297,22 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { }) case []any: if k != "schedule" { - return nil, fmt.Errorf("unknown on type: %#v", v) + return nil, fmt.Errorf("key %q had an type %T; only the 'schedule' key is expected with this type", k, v) } schedules := make([]map[string]string, len(t)) for i, tt := range t { vv, ok := tt.(map[string]any) if !ok { - return nil, fmt.Errorf("unknown on type: %#v", v) + return nil, fmt.Errorf("key %q[%d] had unexpected type %[3]T; a map with a key \"cron\" was expected, but value was %#[3]v", k, i, tt) } schedules[i] = make(map[string]string, len(vv)) - for k, vvv := range vv { + for kk, vvv := range vv { + if strings.ToLower(kk) != "cron" { + return nil, fmt.Errorf("key %q[%d] had unexpected key %q; \"cron\" was expected", k, i, kk) + } var ok bool - if schedules[i][k], ok = vvv.(string); !ok { - return nil, fmt.Errorf("unknown on type: %#v", v) + if schedules[i][kk], ok = vvv.(string); !ok { + return nil, fmt.Errorf("key %q[%d].%q had unexpected type %[4]T; a string was expected by was %#[4]v", k, i, kk, vvv) } } } @@ -327,23 +321,29 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) { schedules: schedules, }) default: - return nil, fmt.Errorf("unknown on type: %#v", v) + return nil, fmt.Errorf("key %q had unexpected type %[2]T; expected a map or array but was %#[2]v", k, v) } } return res, nil default: - return nil, fmt.Errorf("unknown on type: %v", rawOn.Kind) + return nil, fmt.Errorf("unexpected yaml node in `on`: %v", rawOn.Kind) } } -func isInvalidOnType(onType, subKey string) bool { - if onType == "workflow_dispatch" && subKey == "inputs" { - return false +func isInvalidOnType(onType, subKey string) error { + if onType == "workflow_dispatch" { + if subKey == "inputs" { + return nil + } + return fmt.Errorf("workflow_dispatch only supports key \"inputs\", but key %q was found", subKey) } - if onType == "workflow_call" && (subKey == "inputs" || subKey == "outputs") { - return false + if onType == "workflow_call" { + if subKey == "inputs" || subKey == "outputs" { + return nil + } + return fmt.Errorf("workflow_call only supports keys \"inputs\" and \"outputs\", but key %q was found", subKey) } - return true + return fmt.Errorf("unexpected key %q.%q", onType, subKey) } // parseMappingNode parse a mapping node and preserve order. diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go index 45d77428..454de71c 100644 --- a/act/jobparser/model_test.go +++ b/act/jobparser/model_test.go @@ -16,6 +16,7 @@ func TestParseRawOn(t *testing.T) { kases := []struct { input string result []*Event + err string }{ { input: "on: issue_comment", @@ -33,7 +34,10 @@ func TestParseRawOn(t *testing.T) { }, }, }, - + { + input: "on: [123]", + err: "value at index 0 was unexpected type int; must be a string but was 123", + }, { input: "on:\n - push\n - pull_request", result: []*Event{ @@ -45,6 +49,19 @@ func TestParseRawOn(t *testing.T) { }, }, }, + { + input: "on: { push: null }", + result: []*Event{ + { + Name: "push", + acts: map[string][]string{}, + }, + }, + }, + { + input: "on: { push: 'abc' }", + err: "key \"push\" had unexpected type string; expected a map or array but was \"abc\"", + }, { input: "on:\n push:\n branches:\n - master", result: []*Event{ @@ -72,6 +89,10 @@ func TestParseRawOn(t *testing.T) { }, }, }, + { + input: "on:\n branch_protection_rule:\n types: [123, deleted]", + err: "key \"branch_protection_rule\".\"types\" index 0 had unexpected type int; a string was expected but was 123", + }, { input: "on:\n project:\n types: [created, deleted]\n milestone:\n types: [opened, deleted]", result: []*Event{ @@ -189,6 +210,22 @@ func TestParseRawOn(t *testing.T) { }, }, }, + { + input: "on:\n schedule2:\n - cron: '20 6 * * *'", + err: "key \"schedule2\" had an type []interface {}; only the 'schedule' key is expected with this type", + }, + { + input: "on:\n schedule:\n - 123", + err: "key \"schedule\"[0] had unexpected type int; a map with a key \"cron\" was expected, but value was 123", + }, + { + input: "on:\n schedule:\n - corn: '20 6 * * *'", + err: "key \"schedule\"[0] had unexpected key \"corn\"; \"cron\" was expected", + }, + { + input: "on:\n schedule:\n - cron: 123", + err: "key \"schedule\"[0].\"cron\" had unexpected type int; a string was expected by was 123", + }, { input: ` on: @@ -222,15 +259,37 @@ on: }, }, }, + { + input: ` +on: + workflow_call: + mistake: + access-token: + description: 'A token passed from the caller workflow' + required: false +`, + err: "invalid value on key \"workflow_call\": workflow_call only supports keys \"inputs\" and \"outputs\", but key \"mistake\" was found", + }, + { + input: ` +on: + workflow_call: { map: 123 } +`, + err: "key \"workflow_call\".\"map\" had unexpected type int; was 123", + }, } for _, kase := range kases { t.Run(kase.input, func(t *testing.T) { origin, err := model.ReadWorkflow(strings.NewReader(kase.input), false) - assert.NoError(t, err) + require.NoError(t, err) events, err := ParseRawOn(&origin.RawOn) - assert.NoError(t, err) - assert.EqualValues(t, kase.result, events, fmt.Sprintf("%#v", events)) + if kase.err != "" { + assert.ErrorContains(t, err, kase.err) + } else { + assert.NoError(t, err) + assert.EqualValues(t, kase.result, events, fmt.Sprintf("%#v", events)) + } }) } } From b17b1f00b318535684897c5c9e49a2e10252b572 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 8 Oct 2025 09:42:15 +0000 Subject: [PATCH 70/99] Update dependency go to v1.24.8 (#1069) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.24.7` -> `1.24.8` | --- ### Configuration πŸ“… **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1069 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 4e85c9b6..c10be44a 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.forgejo.org/forgejo/runner/v11 go 1.24.0 -toolchain go1.24.7 +toolchain go1.24.8 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 From bda2295f7176879a1849e0d1e2d00b86d3e15f25 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 9 Oct 2025 08:55:16 +0000 Subject: [PATCH 71/99] Update module github.com/docker/cli to v28.5.1+incompatible (#1072) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v28.5.0+incompatible` -> `v28.5.1+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fcli/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fcli/v28.5.0+incompatible/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/cli (github.com/docker/cli) ### [`v28.5.1+incompatible`](https://github.com/docker/cli/compare/v28.5.0...v28.5.1) [Compare Source](https://github.com/docker/cli/compare/v28.5.0...v28.5.1)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1072 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c10be44a..8da4b204 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 - github.com/docker/cli v28.5.0+incompatible + github.com/docker/cli v28.5.1+incompatible github.com/docker/docker v28.4.0+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 diff --git a/go.sum b/go.sum index 0cc56d8b..3f4fb106 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/cli v28.5.0+incompatible h1:crVqLrtKsrhC9c00ythRx435H8LiQnUKRtJLRR+Auxk= -github.com/docker/cli v28.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v28.5.1+incompatible h1:ESutzBALAD6qyCLqbQSEf1a/U8Ybms5agw59yGVc+yY= +github.com/docker/cli v28.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk= github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= From 44b8b91540266b9208c047eba014a7b9c8629a44 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 10 Oct 2025 13:39:56 +0000 Subject: [PATCH 72/99] Update module connectrpc.com/connect to v1.19.1 (#1078) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.18.1` -> `v1.19.1` | [![age](https://developer.mend.io/api/mc/badges/age/go/connectrpc.com%2fconnect/v1.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/connectrpc.com%2fconnect/v1.18.1/v1.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
connectrpc/connect-go (connectrpc.com/connect) ### [`v1.19.1`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.1) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.0...v1.19.1) #### What's Changed ##### Bugfixes - Fix bounds check on envelope for 32-bit archs by [@​emcfarlane](https://github.com/emcfarlane) in [#​887](https://github.com/connectrpc/connect-go/issues/887) - Fix CallInfo header/trailer propagation on error responses by [@​emcfarlane](https://github.com/emcfarlane) in [#​892](https://github.com/connectrpc/connect-go/issues/892) **Full Changelog**: ### [`v1.19.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.18.1...v1.19.0) This release introduces the highly requested "simple" flag for code generation, making Connect significantly more ergonomic for everyday RPC development. The new simple flag in protoc-gen-connect-go generates cleaner, more intuitive client and handler interfaces that eliminate request/response wrappers for most use cases. This addresses community feedback about verbosity and provides a more straightforward API. When enabled, metadata (headers/trailers) can be passed through context instead of explicit wrapper objects, optimizing for the common case where developers don't need direct access to HTTP headers. #### What's Changed ##### Enhancements - Add simple flag for more ergonomic generated code by [@​bufdev](https://github.com/bufdev) and [@​smaye81](https://github.com/smaye81) in [#​851](https://github.com/connectrpc/connect-go/pull/851) - Update Go to v1.24 and document http.Protocol use removing the dependency on `golang.org/x/net/http2` by [@​maxbrunet](https://github.com/maxbrunet) in [#​873](https://github.com/connectrpc/connect-go/pull/873), [#​877](https://github.com/connectrpc/connect-go/pull/877) - Add support for Edition 2024 by [@​emcfarlane](https://github.com/emcfarlane) in [#​878](https://github.com/connectrpc/connect-go/pull/878) ##### Bugfixes - Include valid spec and headers when calling recover handler for streaming RPCs by [@​jhump](https://github.com/jhump) in [#​817](https://github.com/connectrpc/connect-go/pull/817) ##### Other changes - Go version support updated to latest two instead of three by [@​jhump](https://github.com/jhump) in [#​837](https://github.com/connectrpc/connect-go/pull/837) - CI testing improvements by [@​pkwarren](https://github.com/pkwarren) and [@​jhump](https://github.com/jhump) in [#​838](https://github.com/connectrpc/connect-go/pull/838), [#​839](https://github.com/connectrpc/connect-go/pull/839) - Code quality improvements by [@​mattrobenolt](https://github.com/mattrobenolt) and [@​bufdev](https://github.com/bufdev) in [#​841](https://github.com/connectrpc/connect-go/pull/841), [#​867](https://github.com/connectrpc/connect-go/pull/867) - Documentation improvements by [@​adlion](https://github.com/adlion) and [@​stefanvanburen](https://github.com/stefanvanburen) in [#​821](https://github.com/connectrpc/connect-go/pull/821), [#​880](https://github.com/connectrpc/connect-go/pull/880) #### New Contributors - [@​adlion](https://github.com/adlion) made their first contribution in [#​821](https://github.com/connectrpc/connect-go/pull/821) - [@​maxbrunet](https://github.com/maxbrunet) made their first contribution in [#​873](https://github.com/connectrpc/connect-go/pull/873) - [@​stefanvanburen](https://github.com/stefanvanburen) made their first contribution in [#​880](https://github.com/connectrpc/connect-go/pull/880) **Full Changelog**:
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1078 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 8da4b204..0f88eac9 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.8 require ( code.forgejo.org/forgejo/actions-proto v0.5.2 - connectrpc.com/connect v1.18.1 + connectrpc.com/connect v1.19.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 github.com/avast/retry-go/v4 v4.6.1 diff --git a/go.sum b/go.sum index 3f4fb106..3ac63d38 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= -connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw= -connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8= +connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14= +connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= From 66a7e82c43ef0831297b5d2145cc03499e152208 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Fri, 10 Oct 2025 14:33:07 +0000 Subject: [PATCH 73/99] feat: allow --memory in workflow container options (#1079) First hand experience to implement this feature can be found at https://codeberg.org/forgejo/forgejo/issues/9406. In a nutshell it is a service container in the CI that randomly uses massive amounts of memory (>50GB RSS) but normally less than 100MB. --- See also the [matching documentation pull request](https://codeberg.org/forgejo/docs/pulls/1539). --- It is already possible to limit the memory used by all containers in the config file: ```yaml container: options: --memory 200M ``` This limit can be further reduced (but not increased) by the same option in a job: ```yaml jobs: job: runs-on: docker container: image: code.forgejo.org/oci/node:20-bookworm options: --memory 200M steps: - run: echo OK ``` or a service container: ```yaml job: my-job: runs-on: docker services: pgsql: image: postgres:15 options: --memory 1G ``` Refs https://docs.docker.com/engine/containers/resource_constraints/#limit-a-containers-access-to-memory - features - [PR](https://code.forgejo.org/forgejo/runner/pulls/1079): feat: allow --memory in workflow container options Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1079 Reviewed-by: Michael Kriese Reviewed-by: Mathieu Fenniak Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/container/docker_run.go | 8 ++ internal/app/run/runner_test.go | 166 ++++++++++++++++++++++++++++++++ 2 files changed, 174 insertions(+) diff --git a/act/container/docker_run.go b/act/container/docker_run.go index b1247528..cf15887c 100644 --- a/act/container/docker_run.go +++ b/act/container/docker_run.go @@ -483,6 +483,14 @@ func (cr *containerReference) mergeJobOptions(ctx context.Context, config *conta } } + if jobConfig.HostConfig.Memory > 0 { + logger.Debugf("--memory %v", jobConfig.HostConfig.Memory) + if hostConfig.Memory > 0 && jobConfig.HostConfig.Memory > hostConfig.Memory { + return nil, nil, fmt.Errorf("the --memory %v option found in the workflow cannot be greater than the --memory %v option from the runner configuration file", jobConfig.HostConfig.Memory, hostConfig.Memory) + } + hostConfig.Memory = jobConfig.HostConfig.Memory + } + if len(jobConfig.Config.Hostname) > 0 { logger.Debugf("--hostname %v", jobConfig.Config.Hostname) config.Hostname = jobConfig.Config.Hostname diff --git a/internal/app/run/runner_test.go b/internal/app/run/runner_test.go index 5de1b58c..c46fefb4 100644 --- a/internal/app/run/runner_test.go +++ b/internal/app/run/runner_test.go @@ -71,6 +71,7 @@ func TestLabelUpdate(t *testing.T) { type forgejoClientMock struct { mock.Mock + sent string } func (m *forgejoClientMock) Address() string { @@ -123,11 +124,20 @@ func (m *forgejoClientMock) UpdateTask(ctx context.Context, request *connect.Req return args.Get(0).(*connect.Response[runnerv1.UpdateTaskResponse]), args.Error(1) } +func rowsToString(rows []*runnerv1.LogRow) string { + s := "" + for _, row := range rows { + s += row.Content + "\n" + } + return s +} + func (m *forgejoClientMock) UpdateLog(ctx context.Context, request *connect.Request[runnerv1.UpdateLogRequest]) (*connect.Response[runnerv1.UpdateLogResponse], error) { // Enable for log output from runs if needed. // for _, row := range request.Msg.Rows { // println(fmt.Sprintf("UpdateLog: %q", row.Content)) // } + m.sent += rowsToString(request.Msg.Rows) args := m.Called(ctx, request) mockRetval := args.Get(0) mockError := args.Error(1) @@ -589,3 +599,159 @@ jobs: runWorkflow(ctx, cancel, workflow, "push", "refs/heads/main", "OK") }) } + +func TestRunnerResources(t *testing.T) { + if testing.Short() { + t.Skip("skipping integration test") + } + + forgejoClient := &forgejoClientMock{} + + forgejoClient.On("Address").Return("https://127.0.0.1:8080") // not expected to be used in this test + forgejoClient.On("UpdateLog", mock.Anything, mock.Anything).Return(nil, nil) + forgejoClient.On("UpdateTask", mock.Anything, mock.Anything). + Return(connect.NewResponse(&runnerv1.UpdateTaskResponse{}), nil) + + workdirParent := t.TempDir() + + runWorkflow := func(ctx context.Context, cancel context.CancelFunc, yamlContent, options, errorMessage, logMessage string) { + task := &runnerv1.Task{ + WorkflowPayload: []byte(yamlContent), + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "token": structpb.NewStringValue("some token here"), + "forgejo_default_actions_url": structpb.NewStringValue("https://data.forgejo.org"), + "repository": structpb.NewStringValue("runner"), + "event_name": structpb.NewStringValue("push"), + "ref": structpb.NewStringValue("refs/heads/main"), + }, + }, + } + + runner := NewRunner( + &config.Config{ + Log: config.Log{ + JobLevel: "trace", + }, + Host: config.Host{ + WorkdirParent: workdirParent, + }, + Container: config.Container{ + Options: options, + }, + }, + &config.Registration{ + Labels: []string{"docker:docker://code.forgejo.org/oci/node:20-bookworm"}, + }, + forgejoClient) + require.NotNil(t, runner) + + reporter := report.NewReporter(ctx, cancel, forgejoClient, task, time.Second) + err := runner.run(ctx, task, reporter) + reporter.Close(nil) + if len(errorMessage) > 0 { + require.Error(t, err) + assert.ErrorContains(t, err, errorMessage) + } else { + require.NoError(t, err) + } + if len(logMessage) > 0 { + assert.Contains(t, forgejoClient.sent, logMessage) + } + } + + t.Run("config.yaml --memory set and enforced", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + steps: + - run: | + # more than 300MB + perl -e '$a = "a" x (300 * 1024 * 1024)' +` + runWorkflow(ctx, cancel, workflow, "--memory 200M", "Job 'job' failed", "Killed") + }) + + t.Run("config.yaml --memory set and within limits", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + steps: + - run: echo OK +` + runWorkflow(ctx, cancel, workflow, "--memory 200M", "", "") + }) + + t.Run("config.yaml --memory set and container fails to increase it", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + container: + image: code.forgejo.org/oci/node:20-bookworm + options: --memory 4G + steps: + - run: | + # more than 300MB + perl -e '$a = "a" x (300 * 1024 * 1024)' +` + runWorkflow(ctx, cancel, workflow, "--memory 200M", "option found in the workflow cannot be greater than", "") + }) + + t.Run("container --memory set and enforced", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + container: + image: code.forgejo.org/oci/node:20-bookworm + options: --memory 200M + steps: + - run: | + # more than 300MB + perl -e '$a = "a" x (300 * 1024 * 1024)' +` + runWorkflow(ctx, cancel, workflow, "", "Job 'job' failed", "Killed") + }) + + t.Run("container --memory set and within limits", func(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + + workflow := ` +on: + push: +jobs: + job: + runs-on: docker + container: + image: code.forgejo.org/oci/node:20-bookworm + options: --memory 200M + steps: + - run: echo OK +` + runWorkflow(ctx, cancel, workflow, "", "", "") + }) +} From 02247b852aab7bc47027bbfbabe66cc36c81b78f Mon Sep 17 00:00:00 2001 From: Mathieu Fenniak Date: Fri, 10 Oct 2025 21:55:08 +0000 Subject: [PATCH 74/99] fix: allow mapping into env variable INPUT_N from ${{ inputs.n }} (#1080) When using a reusable workflow such as: ```yaml name: "use-inputs-impl" on: workflow_call: inputs: image: description: "Image to be used in job" type: string required: false default: "docker.io/alpine:3.22" condition: description: "Only run a job if this is true" type: string required: false default: false jobs: works: runs-on: docker container: image: alpine:3.22 env: INPUT_IMAGE: ${{ inputs.image }} INPUT_CONDITION: ${{ inputs.condition }} steps: - run: echo "Hello world from Alpine" - run: cat /etc/alpine-release - run: echo "INPUT_IMAGE=$INPUT_IMAGE" - run: echo "INPUT_CONDITION=$INPUT_CONDITION" ``` The runner will currently output un-evaluated expressions: ``` INPUT_IMAGE=${{ inputs.image }} INPUT_CONDITION=${{ inputs.condition }} ``` Internally, the workflow is using `INPUT_...` environment variables to transfer data into local reusable workflows, and the order of evaluation in `getEvaluatorInputs` was preferring to use the un-evaluated value, over the evaluated value. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1080): fix: allow mapping into env variable INPUT_N from ${{ inputs.n }} Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1080 Reviewed-by: earl-warren Co-authored-by: Mathieu Fenniak Co-committed-by: Mathieu Fenniak --- act/runner/expression.go | 4 ++-- act/runner/runner_test.go | 1 + .../workflows/local-reusable-env-input.yml | 21 +++++++++++++++++++ .../testdata/uses-workflow-env-input/push.yml | 8 +++++++ 4 files changed, 32 insertions(+), 2 deletions(-) create mode 100644 act/runner/testdata/.github/workflows/local-reusable-env-input.yml create mode 100644 act/runner/testdata/uses-workflow-env-input/push.yml diff --git a/act/runner/expression.go b/act/runner/expression.go index e17af233..152a2f8e 100644 --- a/act/runner/expression.go +++ b/act/runner/expression.go @@ -479,8 +479,6 @@ func rewriteSubExpression(ctx context.Context, in string, forceFormat bool) (str func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *model.GithubContext) map[string]any { inputs := map[string]any{} - setupWorkflowInputs(ctx, &inputs, rc) - var env map[string]string if step != nil { env = *step.getEnv() @@ -494,6 +492,8 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod } } + setupWorkflowInputs(ctx, &inputs, rc) + if rc.caller == nil && ghc.EventName == "workflow_dispatch" { config := rc.Run.Workflow.WorkflowDispatchConfig() if config != nil && config.Inputs != nil { diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go index 0d29eca8..f8b3918c 100644 --- a/act/runner/runner_test.go +++ b/act/runner/runner_test.go @@ -263,6 +263,7 @@ func TestRunner_RunEvent(t *testing.T) { {workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}}, {workdir, "uses-docker-url", "push", "", platforms, secrets}, {workdir, "act-composite-env-test", "push", "", platforms, secrets}, + {workdir, "uses-workflow-env-input", "push", "", platforms, secrets}, // Eval {workdir, "evalmatrix", "push", "", platforms, secrets}, diff --git a/act/runner/testdata/.github/workflows/local-reusable-env-input.yml b/act/runner/testdata/.github/workflows/local-reusable-env-input.yml new file mode 100644 index 00000000..eb1d9092 --- /dev/null +++ b/act/runner/testdata/.github/workflows/local-reusable-env-input.yml @@ -0,0 +1,21 @@ +name: "use-inputs-impl" + +on: + workflow_call: + inputs: + greet_target: + type: string + required: false + default: "Some Default Value" + +jobs: + works: + runs-on: ubuntu-latest + env: + MY_INPUT_TEST: ${{ inputs.greet_target }} + INPUT_TEST: ${{ inputs.greet_target }} + INPUT_GREET_TARGET: ${{ inputs.greet_target }} + steps: + - run: '[ "$MY_INPUT_TEST" = "Mona the Octocat" ] || exit 1' + - run: '[ "$INPUT_TEST" = "Mona the Octocat" ] || exit 1' + - run: '[ "$INPUT_GREET_TARGET" = "Mona the Octocat" ] || exit 1' diff --git a/act/runner/testdata/uses-workflow-env-input/push.yml b/act/runner/testdata/uses-workflow-env-input/push.yml new file mode 100644 index 00000000..d702c4bb --- /dev/null +++ b/act/runner/testdata/uses-workflow-env-input/push.yml @@ -0,0 +1,8 @@ +name: local-action-env-input +on: push +jobs: + test: + runs-on: docker + uses: ./testdata/.github/workflows/local-reusable-env-input.yml + with: + greet_target: 'Mona the Octocat' From 21d451085f7a8651be931a6a8d62870aadbfe1d7 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Oct 2025 09:02:22 +0000 Subject: [PATCH 75/99] Update module code.forgejo.org/forgejo/actions-proto to v0.5.3 (#1082) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [code.forgejo.org/forgejo/actions-proto](https://code.forgejo.org/forgejo/actions-proto) | `v0.5.2` -> `v0.5.3` | [![age](https://developer.mend.io/api/mc/badges/age/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.forgejo.org%2fforgejo%2factions-proto/v0.5.2/v0.5.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
forgejo/actions-proto (code.forgejo.org/forgejo/actions-proto) ### [`v0.5.3`](https://code.forgejo.org/forgejo/actions-proto/compare/v0.5.2...v0.5.3) [Compare Source](https://code.forgejo.org/forgejo/actions-proto/compare/v0.5.2...v0.5.3)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1082 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 0f88eac9..0a87ec30 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.24.0 toolchain go1.24.8 require ( - code.forgejo.org/forgejo/actions-proto v0.5.2 + code.forgejo.org/forgejo/actions-proto v0.5.3 connectrpc.com/connect v1.19.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 diff --git a/go.sum b/go.sum index 3ac63d38..da01e521 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -code.forgejo.org/forgejo/actions-proto v0.5.2 h1:2+j3pXKk7l4cqATb7de75ZPPsNqc6e7RWX7xJ8DmySY= -code.forgejo.org/forgejo/actions-proto v0.5.2/go.mod h1:6CtsEiLzyODMO/3sqsdoTij4Y3gyQ29Nn8QnWunOw98= +code.forgejo.org/forgejo/actions-proto v0.5.3 h1:dDProRNB4CDvEl9gfo8jkiVfGdiW7fXAt5TM9Irka28= +code.forgejo.org/forgejo/actions-proto v0.5.3/go.mod h1:33iTdur/jVa/wAQP+BuciRTK9WZcVaxy0BNEnSWWFDM= connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14= connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= From c80a40023c53628396f782a35fcbc8f1a939d314 Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Sat, 11 Oct 2025 09:23:28 +0000 Subject: [PATCH 76/99] feat: disambiguate cloud emoji (#1076) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Many emoji technically have two forms, the colorful form and the monochrome text form. For some reason, on macOS, ☁️ defaults to the latter, which is also really tiny for some reason?. Adding the invisible emoji variant selector (U+FE0F) causes it to always render as the colorful full-width graphic Before: ![Screenshot 2025-10-08 at 22.53.36](/attachments/beaeea4a-d355-4db6-9cca-2425a62b6ea9) After: ![Screenshot 2025-10-08 at 22.53.14](/attachments/dd670d38-fed6-41dc-a0c2-421846bc26bd) - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1076): disambiguate cloud emoji Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1076 Reviewed-by: Michael Kriese Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- act/common/git/git.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/common/git/git.go b/act/common/git/git.go index 2d3f1249..2c47b5d2 100644 --- a/act/common/git/git.go +++ b/act/common/git/git.go @@ -305,7 +305,7 @@ func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.Pu func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor { return func(ctx context.Context) error { logger := common.Logger(ctx) - logger.Infof(" \u2601 git clone '%s' # ref=%s", input.URL, input.Ref) + logger.Infof(" \u2601\ufe0f git clone '%s' # ref=%s", input.URL, input.Ref) logger.Debugf(" cloning %s to %s", input.URL, input.Dir) cloneLock.Lock() From 08723cf6238dac006c54c352e39496b7a0feb947 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 12 Oct 2025 01:47:52 +0000 Subject: [PATCH 77/99] Update module github.com/rhysd/actionlint to v1.7.8 (#1084) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.7.7` -> `v1.7.8` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2frhysd%2factionlint/v1.7.8?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2frhysd%2factionlint/v1.7.7/v1.7.8?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
rhysd/actionlint (github.com/rhysd/actionlint) ### [`v1.7.8`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v178---2025-10-11) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.7...v1.7.8) - Support `models` permission in `permissions` section. ([#​531](https://github.com/rhysd/actionlint/issues/531), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Support `job.check_run_id` property. ([#​576](https://github.com/rhysd/actionlint/issues/576), thanks [@​muzimuzhi](https://github.com/muzimuzhi) for fixing the type at [#​577](https://github.com/rhysd/actionlint/issues/577)) - Support `node24` runtime at `using` section in action metadata. ([#​561](https://github.com/rhysd/actionlint/issues/561), thanks [@​salmanmkc](https://github.com/salmanmkc)) - Add support for the following runner labels - [`macos-26` and `macos-26-large`](https://github.blog/changelog/2025-09-11-actions-macos-26-image-now-in-public-preview/) ([#​572](https://github.com/rhysd/actionlint/issues/572), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - [`macos-15`](https://github.blog/changelog/2025-09-19-github-actions-macos-13-runner-image-is-closing-down/#what-you-need-to-do) ([#​572](https://github.com/rhysd/actionlint/issues/572), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Drop support for the following runner labels. - [`ubuntu-20.04`](https://github.com/actions/runner-images/issues/11101) ([#​534](https://github.com/rhysd/actionlint/issues/534), thanks [@​shogo82148](https://github.com/shogo82148)) - [`windows-2019`](https://github.blog/changelog/2025-04-15-upcoming-breaking-changes-and-releases-for-github-actions/#windows-server-2019-is-closing-down) ([#​572](https://github.com/rhysd/actionlint/issues/572), thanks [@​muzimuzhi](https://github.com/muzimuzhi)) - Support [`deprecationMessage`](https://docs.github.com/en/actions/reference/workflows-and-actions/metadata-syntax#inputsinput_iddeprecationmessage) in action inputs. ([#​540](https://github.com/rhysd/actionlint/issues/540), thanks [@​saansh45](https://github.com/saansh45)) - Support [`windows-11-arm` runner](https://github.blog/changelog/2025-04-14-windows-arm64-hosted-runners-now-available-in-public-preview/). ([#​542](https://github.com/rhysd/actionlint/issues/542), thanks [@​trim21](https://github.com/trim21)) - Handle `ubuntu-latest` runner label as `ubuntu-24.04` and `macos-latest` runner label as `macos-15`. - Report mixing Intel Mac labels and Arm Mac labels as error. - Add new types to `issues` and `pull_request_target` webhooks. - Update the popular actions data set to the latest and add more actions to it (thanks [@​sethvargo](https://github.com/sethvargo) for fixing the `go generate` scripts) - `actions/create-github-app-token` - `actions/attest-sbom` - `actions/ai-inference` - `peter-evans/create-or-update-comment` - `release-drafter/release-drafter` - `SamKirkland/FTP-Deploy-Action` - Fix the version value in `actionlint -version` can be empty. - Fix outdated URL links in some error messages and documents. - [Homebrew formula in this repository](https://github.com/rhysd/actionlint/blob/main/HomebrewFormula/actionlint.rb) is deprecated and [Homebrew cask](https://github.com/rhysd/actionlint/blob/main/Casks/actionlint.rb) is newly added instead because [GoReleaser no longer supports Homebrew formula update](https://goreleaser.com/deprecations/#brews). Note that Homebrew's official `actionlint` formula is still maintained. Please read the [documentation](https://github.com/rhysd/actionlint/blob/main/docs/install.md#homebrew) for more details. - Drop support for Go 1.23 and earlier because they are no longer maintained officially. Go 1.24 and later are supported to build actionlint. - Replace [`go-yaml/yaml@v3`](https://github.com/go-yaml/yaml) package with [`yaml/go-yaml@v4`](https://github.com/yaml/go-yaml) package. `go-yaml/yaml` was used for parsing workflow files however it was unmaintained. `yaml/go-yaml` is a successor of the library officially maintained by YAML organization. ([#​575](https://github.com/rhysd/actionlint/issues/575)) - Improve error messages on parsing workflow and action metadata files. \[Changes]\[v1.7.8]
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1084 Reviewed-by: Mathieu Fenniak Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 9 +++++---- go.sum | 18 ++++++++++-------- 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 0a87ec30..89f68e37 100644 --- a/go.mod +++ b/go.mod @@ -29,7 +29,7 @@ require ( github.com/moby/patternmatcher v0.6.0 github.com/opencontainers/image-spec v1.1.1 github.com/opencontainers/selinux v1.12.0 - github.com/rhysd/actionlint v1.7.7 + github.com/rhysd/actionlint v1.7.8 github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.10.1 github.com/spf13/pflag v1.0.10 @@ -47,7 +47,7 @@ require ( github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect - github.com/bmatcuk/doublestar/v4 v4.8.0 // indirect + github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect github.com/cloudflare/circl v1.6.1 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect github.com/containerd/log v0.1.0 // indirect @@ -69,7 +69,7 @@ require ( github.com/kevinburke/ssh_config v1.2.0 // indirect github.com/klauspost/compress v1.18.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-runewidth v0.0.16 // indirect + github.com/mattn/go-runewidth v0.0.17 // indirect github.com/mattn/go-shellwords v1.0.12 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/moby/sys/atomicwriter v0.1.0 // indirect @@ -98,9 +98,10 @@ require ( go.opentelemetry.io/otel/metric v1.36.0 // indirect go.opentelemetry.io/otel/sdk v1.21.0 // indirect go.opentelemetry.io/otel/trace v1.36.0 // indirect + go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.39.0 // indirect - golang.org/x/sync v0.12.0 // indirect + golang.org/x/sync v0.17.0 // indirect golang.org/x/sys v0.36.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect diff --git a/go.sum b/go.sum index da01e521..98899777 100644 --- a/go.sum +++ b/go.sum @@ -21,8 +21,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk= github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA= -github.com/bmatcuk/doublestar/v4 v4.8.0 h1:DSXtrypQddoug1459viM9X9D3dp1Z7993fw36I2kNcQ= -github.com/bmatcuk/doublestar/v4 v4.8.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= +github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE= +github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM= github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0= @@ -115,8 +115,8 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= -github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= -github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mattn/go-runewidth v0.0.17 h1:78v8ZlW0bP43XfmAfPsdXcoNCelfMHsDmd/pkENfrjQ= +github.com/mattn/go-runewidth v0.0.17/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk= github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= @@ -151,8 +151,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/rhysd/actionlint v1.7.7 h1:0KgkoNTrYY7vmOCs9BW2AHxLvvpoY9nEUzgBHiPUr0k= -github.com/rhysd/actionlint v1.7.7/go.mod h1:AE6I6vJEkNaIfWqC2GNE5spIJNhxf8NCtLEKU4NnUXg= +github.com/rhysd/actionlint v1.7.8 h1:3d+N9ourgAxVYG4z2IFxFIk/YiT6V+VnKASfXGwT60E= +github.com/rhysd/actionlint v1.7.8/go.mod h1:3kiS6egcbXG+vQsJIhFxTz+UKaF1JprsE0SKrpCZKvU= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= @@ -222,6 +222,8 @@ go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lI go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s= +go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= @@ -230,8 +232,8 @@ golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbR golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY= golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E= -golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= -golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= +golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= From e25d6b3c911d64c78791385a9410d00b10596ebc Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 12 Oct 2025 06:53:05 +0000 Subject: [PATCH 78/99] Update module github.com/docker/docker to v28.5.1+incompatible (#1085) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | `v28.4.0+incompatible` -> `v28.5.1+incompatible` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fdocker/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fdocker/v28.4.0+incompatible/v28.5.1+incompatible?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
docker/docker (github.com/docker/docker) ### [`v28.5.1+incompatible`](https://github.com/docker/docker/compare/v28.5.0...v28.5.1) [Compare Source](https://github.com/docker/docker/compare/v28.5.0...v28.5.1) ### [`v28.5.0+incompatible`](https://github.com/docker/docker/compare/v28.4.0...v28.5.0) [Compare Source](https://github.com/docker/docker/compare/v28.4.0...v28.5.0)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1085 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 89f68e37..71005dc0 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 github.com/docker/cli v28.5.1+incompatible - github.com/docker/docker v28.4.0+incompatible + github.com/docker/docker v28.5.1+incompatible github.com/docker/go-connections v0.6.0 github.com/go-git/go-billy/v5 v5.6.2 github.com/go-git/go-git/v5 v5.16.3 diff --git a/go.sum b/go.sum index 98899777..ee15c6c1 100644 --- a/go.sum +++ b/go.sum @@ -45,8 +45,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/docker/cli v28.5.1+incompatible h1:ESutzBALAD6qyCLqbQSEf1a/U8Ybms5agw59yGVc+yY= github.com/docker/cli v28.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk= -github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v28.5.1+incompatible h1:Bm8DchhSD2J6PsFzxC35TZo4TLGR2PdW/E69rU45NhM= +github.com/docker/docker v28.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8= github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40= github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94= From 2d359067f617b9f8af389dc79eecea10200428bd Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Sun, 12 Oct 2025 08:53:45 +0000 Subject: [PATCH 79/99] fix: don't prepend server URL with https:// if it's an empty string (#1083) An attempt to address #1074 in a way that makes everyone happy Right now, any server URL that doesnt start with `http://` or `https://` automatically gets `https://` prepended to it. When no instance is set while running `forgejo-runner exec` this results in the `{FORGEJO,GITHUB}_SERVER_URL` environment variables being set to simply "https://". Any action using the GitHub actions toolkit chokes on this as an invalid URL and fails the run with a nondescript error. This PR instead leaves empty strings alone, which the actions toolkit seems much happier with Alternate fixes: * default the `--forgejo-instance` flag to a valid but unresolved url like 'http://example.com' so the actions don't crash * don't set the environment variables at all when the server URL is an empty string. This causes the actions toolkit to assume GitHub.com as a fallback - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1083): fix: don't prepend server URL with https:// if it's an empty string Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1083 Reviewed-by: earl-warren Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- act/runner/run_context.go | 14 ++------------ act/runner/run_context_test.go | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 12 deletions(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index ff551322..9e4c2981 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -1208,7 +1208,7 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext ghc.RetentionDays = preset.RetentionDays instance := rc.Config.GitHubInstance - if !strings.HasPrefix(instance, "http://") && + if instance != "" && !strings.HasPrefix(instance, "http://") && !strings.HasPrefix(instance, "https://") { instance = "https://" + instance } @@ -1251,7 +1251,7 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext { // Adapt to Gitea instance := rc.Config.GitHubInstance - if !strings.HasPrefix(instance, "http://") && + if instance != "" && !strings.HasPrefix(instance, "http://") && !strings.HasPrefix(instance, "https://") { instance = "https://" + instance } @@ -1353,16 +1353,6 @@ func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubCon set("SERVER_URL", github.ServerURL) set("API_URL", github.APIURL) - { // Adapt to Forgejo - instance := rc.Config.GitHubInstance - if !strings.HasPrefix(instance, "http://") && - !strings.HasPrefix(instance, "https://") { - instance = "https://" + instance - } - set("SERVER_URL", instance) - set("API_URL", instance+"/api/v1") - } - if rc.Config.ArtifactServerPath != "" { setActionRuntimeVars(rc, env) } diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index 110afb45..4e11ba62 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -280,6 +280,39 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) { }) } +func TestRunContext_GetGithubContextURL(t *testing.T) { + table := []struct { + instance string + serverURL string + APIURL string + }{ + {instance: "", serverURL: "", APIURL: "/api/v1"}, + {instance: "example.com", serverURL: "https://example.com", APIURL: "https://example.com/api/v1"}, + {instance: "http://example.com", serverURL: "http://example.com", APIURL: "http://example.com/api/v1"}, + {instance: "https://example.com", serverURL: "https://example.com", APIURL: "https://example.com/api/v1"}, + } + for _, data := range table { + t.Run(data.instance, func(t *testing.T) { + rc := &RunContext{ + EventJSON: "{}", + Config: &Config{ + GitHubInstance: data.instance, + }, + Run: &model.Run{ + Workflow: &model.Workflow{ + Name: "GitHubContextTest", + }, + }, + } + + ghc := rc.getGithubContext(t.Context()) + + assert.Equal(t, data.serverURL, ghc.ServerURL) + assert.Equal(t, data.APIURL, ghc.APIURL) + }) + } +} + func TestRunContext_GetGithubContextRef(t *testing.T) { table := []struct { event string From 4d685c129c26d784f27a20f351e30b95c07b1c91 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 13 Oct 2025 15:43:53 +0000 Subject: [PATCH 80/99] Update module golang.org/x/term to v0.36.0 (#1086) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.35.0` -> `v0.36.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.35.0...refs/tags/v0.36.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.36.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.35.0/v0.36.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1086 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 71005dc0..d2977e28 100644 --- a/go.mod +++ b/go.mod @@ -37,7 +37,7 @@ require ( github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 - golang.org/x/term v0.35.0 + golang.org/x/term v0.36.0 golang.org/x/time v0.13.0 google.golang.org/protobuf v1.36.10 gotest.tools/v3 v3.5.2 @@ -102,7 +102,7 @@ require ( golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.39.0 // indirect golang.org/x/sync v0.17.0 // indirect - golang.org/x/sys v0.36.0 // indirect + golang.org/x/sys v0.37.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index ee15c6c1..abcbc98b 100644 --- a/go.sum +++ b/go.sum @@ -244,11 +244,11 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= -golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= +golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ= -golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA= +golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q= +golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= From f48e9b3ba62bdd641b0af687dd25b73531442fb9 Mon Sep 17 00:00:00 2001 From: "Roman K." Date: Tue, 14 Oct 2025 01:45:54 +0000 Subject: [PATCH 81/99] fix: prevent premature token revocation in reusable workflows (#1081) ## Problem When using reusable workflows, the Forgejo runner prematurely revokes `GITHUB_TOKEN` after the first step completes, causing subsequent steps to fail with authentication errors. ### Reproduction When the reusable workflow contains multiple steps that require authentication: 1. First step (e.g., checkout) completes successfully 2. Reporter receives completion banner from child workflow 3. Token is revoked prematurely 4. Second step fails with authentication error - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1081): fix: prevent premature token revocation in reusable workflows Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1081 Reviewed-by: Mathieu Fenniak Co-authored-by: Roman K. Co-committed-by: Roman K. --- act/runner/job_executor.go | 34 ++-- act/runner/job_executor_test.go | 73 ++++++++ act/runner/reusable_workflow.go | 37 +++- act/runner/reusable_workflow_test.go | 247 +++++++++++++++++++++++++++ 4 files changed, 374 insertions(+), 17 deletions(-) create mode 100644 act/runner/reusable_workflow_test.go diff --git a/act/runner/job_executor.go b/act/runner/job_executor.go index 7a939930..f1ef21c5 100644 --- a/act/runner/job_executor.go +++ b/act/runner/job_executor.go @@ -180,31 +180,35 @@ func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success boo jobResult = "failure" } + // Set local result on current job (child or parent) info.result(jobResult) + if rc.caller != nil { - // set reusable workflow job result + // Child reusable workflow: + // 1) propagate result to parent job state rc.caller.runContext.result(jobResult) + + // 2) copy workflow_call outputs from child to parent (as in upstream) + jobOutputs := make(map[string]string) + ee := rc.NewExpressionEvaluator(ctx) + if wfcc := rc.Run.Workflow.WorkflowCallConfig(); wfcc != nil { + for k, v := range wfcc.Outputs { + jobOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) + } + } + rc.caller.runContext.Run.Job().Outputs = jobOutputs + + // 3) DO NOT print banner in child job (prevents premature token revocation) + logger.Debugf("Reusable job result=%s (parent will finalize, no banner)", jobResult) + return } + // Parent job: print the final banner ONCE (job-level) jobResultMessage := "succeeded" if jobResult != "success" { jobResultMessage = "failed" } - jobOutputs := rc.Run.Job().Outputs - if rc.caller != nil { - // Rewrite the job's outputs into the workflow_call outputs... - jobOutputs = make(map[string]string) - ee := rc.NewExpressionEvaluator(ctx) - for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs { - jobOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value)) - } - // When running as a daemon and receiving jobs from Forgejo, the next job (and any of it's `needs` outputs) will - // be provided by Forgejo based upon the data sent to the logger below. However, when running `forgejo-runner - // exec` with a reusable workflow, the next job will only be able to read outputs if those outputs are stored on - // the workflow -- that's what is accomplished here: - rc.caller.runContext.Run.Job().Outputs = jobOutputs - } logger. WithFields(logrus.Fields{ diff --git a/act/runner/job_executor_test.go b/act/runner/job_executor_test.go index fe40df0f..96ace803 100644 --- a/act/runner/job_executor_test.go +++ b/act/runner/job_executor_test.go @@ -444,3 +444,76 @@ func TestSetJobResultConcurrency(t *testing.T) { assert.Equal(t, "failure", lastResult) } + +func TestSetJobResult_SkipsBannerInChildReusableWorkflow(t *testing.T) { + // Test that child reusable workflow does not print final banner + // to prevent premature token revocation + + mockLogger := mocks.NewFieldLogger(t) + // Allow all variants of Debugf (git operations can call with 1-3 args) + mockLogger.On("Debugf", mock.Anything).Return(0).Maybe() + mockLogger.On("Debugf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("Debugf", mock.Anything, mock.Anything, mock.Anything).Return(0).Maybe() + // CRITICAL: In CI, git ref detection may fail and call Warningf + mockLogger.On("Warningf", mock.Anything, mock.Anything).Return(0).Maybe() + mockLogger.On("WithField", mock.Anything, mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + mockLogger.On("WithFields", mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe() + + ctx := common.WithLogger(common.WithJobErrorContainer(t.Context()), mockLogger) + + // Setup parent job + parentJob := &model.Job{ + Result: "success", + } + parentRC := &RunContext{ + Config: &Config{Env: map[string]string{}}, // Must have Config + Run: &model.Run{ + JobID: "parent", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "parent": parentJob, + }, + }, + }, + } + + // Setup child job with caller reference + childJob := &model.Job{ + Result: "success", + } + childRC := &RunContext{ + Config: &Config{Env: map[string]string{}}, // Must have Config + Run: &model.Run{ + JobID: "child", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "child": childJob, + }, + }, + }, + caller: &caller{ + runContext: parentRC, + }, + } + + jim := &jobInfoMock{} + jim.On("matrix").Return(map[string]any{}) // REQUIRED: setJobResult always calls matrix() + jim.On("result", "success") + + // Call setJobResult for child workflow + setJobResult(ctx, jim, childRC, true) + + // Verify: + // 1. Child result is set + jim.AssertCalled(t, "result", "success") + + // 2. Parent result is propagated + assert.Equal(t, "success", parentJob.Result) + + // 3. Final banner was NOT printed by child (critical for token security) + mockLogger.AssertNotCalled(t, "WithFields", mock.MatchedBy(func(fields logrus.Fields) bool { + _, okJobResult := fields["jobResult"] + _, okJobOutput := fields["jobOutputs"] + return okJobOutput && okJobResult + })) +} diff --git a/act/runner/reusable_workflow.go b/act/runner/reusable_workflow.go index 5e92ee88..c117c4a7 100644 --- a/act/runner/reusable_workflow.go +++ b/act/runner/reusable_workflow.go @@ -16,6 +16,7 @@ import ( "code.forgejo.org/forgejo/runner/v11/act/common" "code.forgejo.org/forgejo/runner/v11/act/common/git" "code.forgejo.org/forgejo/runner/v11/act/model" + "github.com/sirupsen/logrus" ) func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor { @@ -115,7 +116,10 @@ func newActionCacheReusableWorkflowExecutor(rc *RunContext, filename string, rem return err } - return runner.NewPlanExecutor(plan)(ctx) + planErr := runner.NewPlanExecutor(plan)(ctx) + + // Finalize from parent context: one job-level banner + return finalizeReusableWorkflow(ctx, rc, planErr) } } @@ -171,7 +175,10 @@ func newReusableWorkflowExecutor(rc *RunContext, directory, workflow string) com return err } - return runner.NewPlanExecutor(plan)(ctx) + planErr := runner.NewPlanExecutor(plan)(ctx) + + // Finalize from parent context: one job-level banner + return finalizeReusableWorkflow(ctx, rc, planErr) } } @@ -229,3 +236,29 @@ func newRemoteReusableWorkflowWithPlat(url, uses string) *remoteReusableWorkflow URL: url, } } + +// finalizeReusableWorkflow prints the final job banner from the parent job context. +// +// The Forgejo reporter waits for this banner (log entry with "jobResult" +// field and without stage="Main") before marking the job as complete and revoking +// tokens. Printing this banner from the child reusable workflow would cause +// premature token revocation, breaking subsequent steps in the parent workflow. +func finalizeReusableWorkflow(ctx context.Context, rc *RunContext, planErr error) error { + jobResult := "success" + jobResultMessage := "succeeded" + if planErr != nil { + jobResult = "failure" + jobResultMessage = "failed" + } + + // Outputs should already be present in the parent context: + // - copied by child's setJobResult branch (rc.caller != nil) + jobOutputs := rc.Run.Job().Outputs + + common.Logger(ctx).WithFields(logrus.Fields{ + "jobResult": jobResult, + "jobOutputs": jobOutputs, + }).Infof("\U0001F3C1 Job %s", jobResultMessage) + + return planErr +} diff --git a/act/runner/reusable_workflow_test.go b/act/runner/reusable_workflow_test.go new file mode 100644 index 00000000..f4aab893 --- /dev/null +++ b/act/runner/reusable_workflow_test.go @@ -0,0 +1,247 @@ +package runner + +import ( + "errors" + "testing" + + "code.forgejo.org/forgejo/runner/v11/act/common" + "code.forgejo.org/forgejo/runner/v11/act/model" + "code.forgejo.org/forgejo/runner/v11/act/runner/mocks" + "github.com/sirupsen/logrus" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/mock" +) + +func TestConfig_GetToken(t *testing.T) { + t.Run("returns GITEA_TOKEN when both GITEA_TOKEN and GITHUB_TOKEN present", func(t *testing.T) { + c := &Config{ + Secrets: map[string]string{ + "GITHUB_TOKEN": "github-token", + "GITEA_TOKEN": "gitea-token", + }, + } + assert.Equal(t, "gitea-token", c.GetToken()) + }) + + t.Run("returns GITHUB_TOKEN when only GITHUB_TOKEN present", func(t *testing.T) { + c := &Config{ + Secrets: map[string]string{ + "GITHUB_TOKEN": "github-token", + }, + } + assert.Equal(t, "github-token", c.GetToken()) + }) + + t.Run("returns empty string when no tokens present", func(t *testing.T) { + c := &Config{ + Secrets: map[string]string{}, + } + assert.Equal(t, "", c.GetToken()) + }) + + t.Run("returns empty string when Secrets is nil", func(t *testing.T) { + c := &Config{} + assert.Equal(t, "", c.GetToken()) + }) +} + +func TestRemoteReusableWorkflow_CloneURL(t *testing.T) { + t.Run("adds https prefix when missing", func(t *testing.T) { + rw := &remoteReusableWorkflow{ + URL: "code.forgejo.org", + Org: "owner", + Repo: "repo", + } + assert.Equal(t, "https://code.forgejo.org/owner/repo", rw.CloneURL()) + }) + + t.Run("preserves https prefix", func(t *testing.T) { + rw := &remoteReusableWorkflow{ + URL: "https://code.forgejo.org", + Org: "owner", + Repo: "repo", + } + assert.Equal(t, "https://code.forgejo.org/owner/repo", rw.CloneURL()) + }) + + t.Run("preserves http prefix", func(t *testing.T) { + rw := &remoteReusableWorkflow{ + URL: "http://localhost:3000", + Org: "owner", + Repo: "repo", + } + assert.Equal(t, "http://localhost:3000/owner/repo", rw.CloneURL()) + }) +} + +func TestRemoteReusableWorkflow_FilePath(t *testing.T) { + tests := []struct { + name string + gitPlatform string + filename string + expectedPath string + }{ + { + name: "github platform", + gitPlatform: "github", + filename: "test.yml", + expectedPath: "./.github/workflows/test.yml", + }, + { + name: "gitea platform", + gitPlatform: "gitea", + filename: "build.yaml", + expectedPath: "./.gitea/workflows/build.yaml", + }, + { + name: "forgejo platform", + gitPlatform: "forgejo", + filename: "deploy.yml", + expectedPath: "./.forgejo/workflows/deploy.yml", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + rw := &remoteReusableWorkflow{ + GitPlatform: tt.gitPlatform, + Filename: tt.filename, + } + assert.Equal(t, tt.expectedPath, rw.FilePath()) + }) + } +} + +func TestNewRemoteReusableWorkflowWithPlat(t *testing.T) { + tests := []struct { + name string + url string + uses string + expectedOrg string + expectedRepo string + expectedPlatform string + expectedFilename string + expectedRef string + shouldFail bool + }{ + { + name: "valid github workflow", + url: "github.com", + uses: "owner/repo/.github/workflows/test.yml@main", + expectedOrg: "owner", + expectedRepo: "repo", + expectedPlatform: "github", + expectedFilename: "test.yml", + expectedRef: "main", + shouldFail: false, + }, + { + name: "valid gitea workflow", + url: "code.forgejo.org", + uses: "forgejo/runner/.gitea/workflows/build.yaml@v1.0.0", + expectedOrg: "forgejo", + expectedRepo: "runner", + expectedPlatform: "gitea", + expectedFilename: "build.yaml", + expectedRef: "v1.0.0", + shouldFail: false, + }, + { + name: "invalid format - missing platform", + url: "github.com", + uses: "owner/repo/workflows/test.yml@main", + shouldFail: true, + }, + { + name: "invalid format - no ref", + url: "github.com", + uses: "owner/repo/.github/workflows/test.yml", + shouldFail: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + result := newRemoteReusableWorkflowWithPlat(tt.url, tt.uses) + + if tt.shouldFail { + assert.Nil(t, result) + } else { + assert.NotNil(t, result) + assert.Equal(t, tt.expectedOrg, result.Org) + assert.Equal(t, tt.expectedRepo, result.Repo) + assert.Equal(t, tt.expectedPlatform, result.GitPlatform) + assert.Equal(t, tt.expectedFilename, result.Filename) + assert.Equal(t, tt.expectedRef, result.Ref) + assert.Equal(t, tt.url, result.URL) + } + }) + } +} + +func TestFinalizeReusableWorkflow_PrintsBannerSuccess(t *testing.T) { + mockLogger := mocks.NewFieldLogger(t) + + bannerCalled := false + mockLogger.On("WithFields", + mock.MatchedBy(func(fields logrus.Fields) bool { + result, ok := fields["jobResult"].(string) + if !ok || result != "success" { + return false + } + outs, ok := fields["jobOutputs"].(map[string]string) + return ok && outs["foo"] == "bar" + }), + ).Run(func(args mock.Arguments) { + bannerCalled = true + }).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Once() + + ctx := common.WithLogger(t.Context(), mockLogger) + rc := &RunContext{ + Run: &model.Run{ + JobID: "parent", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "parent": { + Outputs: map[string]string{"foo": "bar"}, + }, + }, + }, + }, + } + + err := finalizeReusableWorkflow(ctx, rc, nil) + assert.NoError(t, err) + assert.True(t, bannerCalled, "final banner should be printed from parent") +} + +func TestFinalizeReusableWorkflow_PrintsBannerFailure(t *testing.T) { + mockLogger := mocks.NewFieldLogger(t) + + bannerCalled := false + mockLogger.On("WithFields", + mock.MatchedBy(func(fields logrus.Fields) bool { + result, ok := fields["jobResult"].(string) + return ok && result == "failure" + }), + ).Run(func(args mock.Arguments) { + bannerCalled = true + }).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Once() + + ctx := common.WithLogger(t.Context(), mockLogger) + rc := &RunContext{ + Run: &model.Run{ + JobID: "parent", + Workflow: &model.Workflow{ + Jobs: map[string]*model.Job{ + "parent": {}, + }, + }, + }, + } + + planErr := errors.New("workflow failed") + err := finalizeReusableWorkflow(ctx, rc, planErr) + assert.EqualError(t, err, "workflow failed") + assert.True(t, bannerCalled, "banner should be printed even on failure") +} From 05795ee286cf884eba70947b89709b9d1e281c0b Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 14 Oct 2025 08:07:05 +0000 Subject: [PATCH 82/99] Update dependency go to v1.24.9 (#1087) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.24.8` -> `1.24.9` | --- ### Configuration πŸ“… **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1087 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index d2977e28..2e114e84 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.forgejo.org/forgejo/runner/v11 go 1.24.0 -toolchain go1.24.8 +toolchain go1.24.9 require ( code.forgejo.org/forgejo/actions-proto v0.5.3 From 2de7e57e0834b56281c61a67f1a1b8b792c976de Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Tue, 14 Oct 2025 08:08:03 +0000 Subject: [PATCH 83/99] chore: log reason reverse proxy can't be started (#1089) Following on to #1065, the reason that the reverse proxy cannot be started (such as an invalid cache server URL) wasn't being logged. - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1089): chore: log reason reverse proxy can't be started Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1089 Reviewed-by: Mathieu Fenniak Reviewed-by: earl-warren Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- act/cacheproxy/handler.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/cacheproxy/handler.go b/act/cacheproxy/handler.go index 499c5167..ebaf65e2 100644 --- a/act/cacheproxy/handler.go +++ b/act/cacheproxy/handler.go @@ -82,7 +82,7 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheProxyHostOver proxy, err := h.newReverseProxy(targetHost) if err != nil { - return nil, fmt.Errorf("unable to set up proxy to target host") + return nil, fmt.Errorf("unable to set up proxy to target host: %v", err) } router := httprouter.New() From f31a1b031ee21ff37980474a99029563eb04c969 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 15 Oct 2025 06:54:17 +0000 Subject: [PATCH 84/99] Update module github.com/avast/retry-go/v4 to v4.7.0 (#1092) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/avast/retry-go/v4](https://github.com/avast/retry-go) | `v4.6.1` -> `v4.7.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2favast%2fretry-go%2fv4/v4.7.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2favast%2fretry-go%2fv4/v4.6.1/v4.7.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes
avast/retry-go (github.com/avast/retry-go/v4) ### [`v4.7.0`](https://github.com/avast/retry-go/releases/tag/v4.7.0) [Compare Source](https://github.com/avast/retry-go/compare/4.6.1...4.7.0) #### What's Changed - support context cancel cause by [@​NivKeidan](https://github.com/NivKeidan) in [#​117](https://github.com/avast/retry-go/pull/117) - Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​136](https://github.com/avast/retry-go/pull/136) - Add FullJitterBackoffDelay by [@​amirrezafahimi](https://github.com/amirrezafahimi) in [#​128](https://github.com/avast/retry-go/pull/128) - No delay after final retry on max attempts by [@​StounhandJ](https://github.com/StounhandJ) in [#​129](https://github.com/avast/retry-go/pull/129) - BackOffDelay multiplies attempts from zero by [@​StounhandJ](https://github.com/StounhandJ) in [#​130](https://github.com/avast/retry-go/pull/130) - add Go version 1.25 to test matrix for expanded compatibility testing by [@​JaSei](https://github.com/JaSei) in [#​142](https://github.com/avast/retry-go/pull/142) #### New Contributors - [@​NivKeidan](https://github.com/NivKeidan) made their first contribution in [#​117](https://github.com/avast/retry-go/pull/117) - [@​amirrezafahimi](https://github.com/amirrezafahimi) made their first contribution in [#​128](https://github.com/avast/retry-go/pull/128) - [@​StounhandJ](https://github.com/StounhandJ) made their first contribution in [#​129](https://github.com/avast/retry-go/pull/129) **Full Changelog**:
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1092 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2e114e84..a7cdb84c 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ require ( connectrpc.com/connect v1.19.1 dario.cat/mergo v1.0.2 github.com/Masterminds/semver v1.5.0 - github.com/avast/retry-go/v4 v4.6.1 + github.com/avast/retry-go/v4 v4.7.0 github.com/containerd/errdefs v1.0.0 github.com/creack/pty v1.1.24 github.com/distribution/reference v0.6.0 diff --git a/go.sum b/go.sum index abcbc98b..d14882d1 100644 --- a/go.sum +++ b/go.sum @@ -19,8 +19,8 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk= -github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA= +github.com/avast/retry-go/v4 v4.7.0 h1:yjDs35SlGvKwRNSykujfjdMxMhMQQM0TnIjJaHB+Zio= +github.com/avast/retry-go/v4 v4.7.0/go.mod h1:ZMPDa3sY2bKgpLtap9JRUgk2yTAba7cgiFhqxY2Sg6Q= github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE= github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM= From aa6eef94fd6eb6e8384d3070d4eb3bb347f2f3fe Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 16 Oct 2025 07:40:55 +0000 Subject: [PATCH 85/99] Update module golang.org/x/time to v0.14.0 (#1094) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [golang.org/x/time](https://pkg.go.dev/golang.org/x/time) | [`v0.13.0` -> `v0.14.0`](https://cs.opensource.google/go/x/time/+/refs/tags/v0.13.0...refs/tags/v0.14.0) | [![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2ftime/v0.14.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2ftime/v0.13.0/v0.14.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1094 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index a7cdb84c..009ac5f9 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( go.etcd.io/bbolt v1.4.3 go.yaml.in/yaml/v3 v3.0.4 golang.org/x/term v0.36.0 - golang.org/x/time v0.13.0 + golang.org/x/time v0.14.0 google.golang.org/protobuf v1.36.10 gotest.tools/v3 v3.5.2 ) diff --git a/go.sum b/go.sum index d14882d1..76b55827 100644 --- a/go.sum +++ b/go.sum @@ -252,8 +252,8 @@ golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= -golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI= -golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= +golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ= google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f h1:2yNACc1O40tTnrsbk9Cv6oxiW8pxI/pXj0wRtdlYmgY= From a7487dadd7b5da794d0f5858ebde66fb76e5fbd4 Mon Sep 17 00:00:00 2001 From: Andrew Cassidy Date: Thu, 16 Oct 2025 07:42:36 +0000 Subject: [PATCH 86/99] fix: use automatic IP detection instead of cache proxy host config value for internal cache server (#1088) The description for the `cache.host` config value is ``` # The IP or hostname (195.84.20.30 or example.com) to use when constructing # ACTIONS_CACHE_URL which is the URL of the cache proxy. ``` however the internal cache *server* was being started using that value, despite it clearly stating its for the *proxy*. While the address used to contact the cache proxy from the job is *usually* the same as the address for the cache proxy to contact the server, that is not the case with custom /etc/hosts entries, like what is used for the `host.containers.internal` address, which is needed for contacting the cache proxy on rootless podman (see #1075). Since the cache proxy and internal cache server are always running on the same host (or container), it's safe to use localhost for the server address instead. - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1088): fix: use automatic IP detection instead of cache proxy host config value for internal cache server Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1088 Reviewed-by: Mathieu Fenniak Reviewed-by: Kwonunn Reviewed-by: Michael Kriese Co-authored-by: Andrew Cassidy Co-committed-by: Andrew Cassidy --- internal/app/run/runner.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/app/run/runner.go b/internal/app/run/runner.go index 31a1b320..c709b462 100644 --- a/internal/app/run/runner.go +++ b/internal/app/run/runner.go @@ -117,7 +117,7 @@ func setupCache(cfg *config.Config, envs map[string]string) *cacheproxy.Handler cacheServer, err := artifactcache.StartHandler( cfg.Cache.Dir, - cfg.Cache.Host, + "", // automatically detect cfg.Cache.Port, cacheSecret, log.StandardLogger().WithField("module", "cache_request"), From d92a892ecebb7d5d362f252c487635c1fb9a4c6e Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Mon, 20 Oct 2025 11:55:59 +0000 Subject: [PATCH 87/99] fix: enforce LXC bootstrap locks (#1098) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/51 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1098): fix: enforce LXC bootstrap locks Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1098 Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index cd855a89..3f1d997a 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -74,8 +74,6 @@ function lxc_transaction_begin() { lxc_transaction_lock lxc_container_destroy $draft - - echo $draft } function lxc_transaction_commit() { @@ -391,7 +389,8 @@ function lxc_build_template_release() { return fi - local draft=$(lxc_transaction_begin $name) + lxc_transaction_begin $name + local draft=$(lxc_transaction_draft_name) $LXC_SUDO lxc-create --name $draft --template debian -- --release=$LXC_CONTAINER_RELEASE echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $draft) lxc_container_install_lxc_helpers $draft @@ -414,7 +413,8 @@ function lxc_build_template() { lxc_build_template_release fi - local draft=$(lxc_transaction_begin $newname) + lxc_transaction_begin $name + local draft=$(lxc_transaction_draft_name) if ! $LXC_SUDO lxc-copy --name=$name --newname=$draft; then echo lxc-copy --name=$name --newname=$draft failed return 1 From 44f45570059b8ea3096d78943a67fc220848f74b Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 20 Oct 2025 15:18:52 +0000 Subject: [PATCH 88/99] chore(ci): use code.forgejo.org/oci/alpine:latest (#1100) The current AWS outage revealed one location still using docker.io instead of the code.forgejo.org mirror: ``` 2025-10-20T09:22:44.6442259Z [actions-with-environment-and-context-tests/check] [DEBUG] Head "https://registry-1.docker.io/v2/library/alpine/manifests/3": received unexpected HTTP status: 503 Service Unavailable ``` https://code.forgejo.org/forgejo/runner/actions/runs/11442/jobs/2/attempt/3#jobstep-5-56398 - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1100): chore(ci): use code.forgejo.org/oci/alpine:latest Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1100 Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- .../actions-environment-and-context-tests/docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile b/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile index bd8fcb22..f50a50da 100644 --- a/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile +++ b/act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3 +FROM code.forgejo.org/oci/alpine:latest COPY entrypoint.sh /entrypoint.sh From 8034eaaabbe44cbd79a3b04e75d05b2db06c4a4e Mon Sep 17 00:00:00 2001 From: cascading-pr Date: Mon, 20 Oct 2025 21:03:14 +0000 Subject: [PATCH 89/99] fix: lxc_exists_and_apt_not_old must be in a transaction (#1104) cascading-pr from https://code.forgejo.org/forgejo/lxc-helpers/pulls/52 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1104): fix: lxc_exists_and_apt_not_old must be in a transaction Co-authored-by: cascading-pr Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1104 Reviewed-by: limiting-factor Co-authored-by: cascading-pr Co-committed-by: cascading-pr --- act/runner/lxc-helpers-lib.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/act/runner/lxc-helpers-lib.sh b/act/runner/lxc-helpers-lib.sh index 3f1d997a..4d3b959a 100755 --- a/act/runner/lxc-helpers-lib.sh +++ b/act/runner/lxc-helpers-lib.sh @@ -385,11 +385,13 @@ function lxc_running() { function lxc_build_template_release() { local name="$(lxc_template_release)" + lxc_transaction_begin $name + if lxc_exists_and_apt_not_old $name; then + lxc_transaction_unlock return fi - lxc_transaction_begin $name local draft=$(lxc_transaction_draft_name) $LXC_SUDO lxc-create --name $draft --template debian -- --release=$LXC_CONTAINER_RELEASE echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $draft) @@ -405,15 +407,16 @@ function lxc_build_template() { local name="$1" local newname="$2" - if lxc_exists_and_apt_not_old $newname; then - return - fi - if test "$name" = "$(lxc_template_release)"; then lxc_build_template_release fi lxc_transaction_begin $name + if lxc_exists_and_apt_not_old $newname; then + lxc_transaction_unlock + return + fi + local draft=$(lxc_transaction_draft_name) if ! $LXC_SUDO lxc-copy --name=$name --newname=$draft; then echo lxc-copy --name=$name --newname=$draft failed From 403489591e7f722e789233c7090ee972cbaff542 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Mon, 20 Oct 2025 21:05:05 +0000 Subject: [PATCH 90/99] Revert "chore(cleanup): lxc-helpers does not need a global lock (#1047)" (#1103) This reverts commit 996ac343ee155a4b47d89a6bf1854feb1c04fdb2. The lock is still needed to guard against the following scenario. https://code.forgejo.org/forgejo/runner/src/commit/d92a892ecebb7d5d362f252c487635c1fb9a4c6e/act/runner/run_context.go#L225-L236 - two or more jobs start - one of them creates the act template (`lxc_build_template $(lxc_template_release) $name`) - lxc-helpers now has transactions and they won't race against each other - once it is built all jobs will then try to install node in the container that was just built and race against each other with a global lock only the first one will build and populate the act template. The other will then do nothing because it already exists. The bug can trivially be reproduced with: ```yaml on: pull_request: jobs: test1: runs-on: lxc steps: - run: echo OK1 test2: runs-on: lxc steps: - run: echo OK2 test3: runs-on: lxc steps: - run: echo OK3 ``` - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1103): Revert "chore(cleanup): lxc-helpers does not need a global lock (#1047)" Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1103 Reviewed-by: Michael Kriese Reviewed-by: limiting-factor Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/runner/run_context.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 9e4c2981..dd72ff09 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -193,6 +193,8 @@ var lxcHelpers string var startTemplate = template.Must(template.New("start").Parse(`#!/bin/bash -e +exec 5<>/tmp/forgejo-runner-lxc.lock ; flock --timeout 21600 5 + LXC_CONTAINER_CONFIG="{{.Config}}" LXC_CONTAINER_RELEASE="{{.Release}}" From aab9e2281972615c7301dc3dc87fa9c085f91302 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 21 Oct 2025 03:21:33 +0000 Subject: [PATCH 91/99] Update dependency forgejo/lxc-helpers to v1.1.3 (#1106) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo/lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers) | patch | `1.1.1` -> `1.1.3` | --- ### Release Notes
forgejo/lxc-helpers (forgejo/lxc-helpers) ### [`v1.1.3`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.2...v1.1.3) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.2...v1.1.3) ### [`v1.1.2`](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.1...v1.1.2) [Compare Source](https://code.forgejo.org/forgejo/lxc-helpers/compare/v1.1.1...v1.1.2)
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1106 Reviewed-by: Mathieu Fenniak Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- examples/lxc-systemd/forgejo-runner-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/lxc-systemd/forgejo-runner-service.sh b/examples/lxc-systemd/forgejo-runner-service.sh index e949f3de..370d5fff 100755 --- a/examples/lxc-systemd/forgejo-runner-service.sh +++ b/examples/lxc-systemd/forgejo-runner-service.sh @@ -20,7 +20,7 @@ trap "rm -fr $TMPDIR" EXIT : ${INPUTS_TOKEN:=} : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} -DEFAULT_LXC_HELPERS_VERSION=1.1.1 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers +DEFAULT_LXC_HELPERS_VERSION=1.1.3 # renovate: datasource=forgejo-tags depName=forgejo/lxc-helpers : ${INPUTS_LXC_HELPERS_VERSION:=$DEFAULT_LXC_HELPERS_VERSION} DEFAULT_RUNNER_VERSION=11.1.2 # renovate: datasource=forgejo-releases depName=forgejo/runner : ${INPUTS_RUNNER_VERSION:=$DEFAULT_RUNNER_VERSION} From 2301db6f85b7d54f3e7d743cdbac0370ff5f5f20 Mon Sep 17 00:00:00 2001 From: Earl Warren Date: Wed, 22 Oct 2025 06:31:45 +0000 Subject: [PATCH 92/99] fix: ${{ env.VAR }} is allowed in container (#1108) Resolves forgejo/forgejo-actions-feature-requests#62 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1108): fix: ${{ env.VAR }} is allowed in container Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1108 Reviewed-by: Mathieu Fenniak Reviewed-by: Michael Kriese Co-authored-by: Earl Warren Co-committed-by: Earl Warren --- act/schema/schema_test.go | 2 +- act/schema/workflow_schema.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go index 9661b930..beb1c185 100644 --- a/act/schema/schema_test.go +++ b/act/schema/schema_test.go @@ -242,7 +242,7 @@ jobs: name: Build Silo Frontend DEV runs-on: ubuntu-latest container: - image: code.forgejo.org/oci/node:22-bookworm + image: code.forgejo.org/oci/${{ env.IMAGE }} uses: ./.forgejo/workflows/${{ vars.PATHNAME }} with: STAGE: dev diff --git a/act/schema/workflow_schema.json b/act/schema/workflow_schema.json index 56e7d5d4..99633cac 100644 --- a/act/schema/workflow_schema.json +++ b/act/schema/workflow_schema.json @@ -2008,7 +2008,7 @@ }, "container": { "description": "A container to run any steps in a job that don't already specify a container. If you have steps that use both script and container actions, the container actions will run as sibling containers on the same network with the same volume mounts.\n\nIf you do not set a container, all steps will run directly on the host specified by runs-on unless a step refers to an action configured to run in a container.", - "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix"], + "context": ["forge", "forgejo", "github", "inputs", "vars", "needs", "strategy", "matrix", "env"], "one-of": ["string", "container-mapping"] }, "container-mapping": { From 8a98a8a5128ddb1d7e142dd5103fc648e6dd8053 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 24 Oct 2025 06:37:56 +0000 Subject: [PATCH 93/99] Update data.forgejo.org/oci/golang Docker tag to v1.25 (#1110) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [data.forgejo.org/oci/golang](https://hub.docker.com/_/golang) ([source](https://github.com/docker-library/golang)) | stage | minor | `1.24-alpine3.22` -> `1.25-alpine3.22` | --- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1110 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index bcfe98f5..2c654211 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/xx AS xx -FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.24-alpine3.22 AS build-env +FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.25-alpine3.22 AS build-env # # Transparently cross compile for the target platform From ea961a70c3729da474d7069f065f2967840a291c Mon Sep 17 00:00:00 2001 From: volkmnv Date: Fri, 24 Oct 2025 07:00:43 +0000 Subject: [PATCH 94/99] fix: windows compilation (#1101) Original pull request: https://code.forgejo.org/forgejo/runner/pulls/987 Fixes https://code.forgejo.org/forgejo/runner/issues/1032 - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1101): fix: windows compilation Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1101 Reviewed-by: earl-warren Co-authored-by: volkmnv Co-committed-by: volkmnv --- act/artifactcache/handler.go | 3 +-- act/artifactcache/utils.go | 9 +++++++++ act/artifactcache/utils_windows.go | 14 ++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) create mode 100644 act/artifactcache/utils.go create mode 100644 act/artifactcache/utils_windows.go diff --git a/act/artifactcache/handler.go b/act/artifactcache/handler.go index 29ff61e3..cbc58d8f 100644 --- a/act/artifactcache/handler.go +++ b/act/artifactcache/handler.go @@ -9,7 +9,6 @@ import ( "net/http" "strconv" "strings" - "syscall" "time" "github.com/julienschmidt/httprouter" @@ -25,7 +24,7 @@ const ( var fatal = func(logger logrus.FieldLogger, err error) { logger.Errorf("unrecoverable error in the cache: %v", err) - if err := syscall.Kill(syscall.Getpid(), syscall.SIGTERM); err != nil { + if err := suicide(); err != nil { logger.Errorf("unrecoverable error in the cache: failed to send the TERM signal to shutdown the daemon %v", err) } } diff --git a/act/artifactcache/utils.go b/act/artifactcache/utils.go new file mode 100644 index 00000000..37274a4e --- /dev/null +++ b/act/artifactcache/utils.go @@ -0,0 +1,9 @@ +//go:build !windows + +package artifactcache + +import "syscall" + +func suicide() error { + return syscall.Kill(syscall.Getpid(), syscall.SIGTERM) +} diff --git a/act/artifactcache/utils_windows.go b/act/artifactcache/utils_windows.go new file mode 100644 index 00000000..90b0f112 --- /dev/null +++ b/act/artifactcache/utils_windows.go @@ -0,0 +1,14 @@ +//go:build windows + +package artifactcache + +import "syscall" + +func suicide() error { + handle, err := syscall.GetCurrentProcess() + if err != nil { + return err + } + + return syscall.TerminateProcess(handle, uint32(syscall.SIGTERM)) +} From 10a9ab9001b10f13f16d2b41be0b1b51067cd8a1 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 27 Oct 2025 07:33:24 +0000 Subject: [PATCH 95/99] Update code.forgejo.org/forgejo/forgejo Docker tag to v11.0.7 (#1113) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [code.forgejo.org/forgejo/forgejo](https://forgejo.org) ([source](https://codeberg.org/forgejo/forgejo)) | patch | `11.0.6` -> `11.0.7` | --- ### Release Notes
forgejo/forgejo (code.forgejo.org/forgejo/forgejo) ### [`v11.0.7`](https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.7) [Compare Source](https://codeberg.org/forgejo/forgejo/compare/v11.0.6...v11.0.7) See
--- ### Configuration πŸ“… **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1113 Reviewed-by: earl-warren Co-authored-by: Renovate Bot Co-committed-by: Renovate Bot --- .forgejo/workflows/build-release-integration.yml | 2 +- .forgejo/workflows/docker-build-push-action-in-lxc.yml | 2 +- .forgejo/workflows/example-lxc-systemd.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml index 0a1c216b..4f387998 100644 --- a/.forgejo/workflows/build-release-integration.yml +++ b/.forgejo/workflows/build-release-integration.yml @@ -19,7 +19,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: release-simulation: diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml index ec8469ca..dc1fe14b 100644 --- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml +++ b/.forgejo/workflows/docker-build-push-action-in-lxc.yml @@ -21,7 +21,7 @@ on: enable-email-notifications: true env: - FORGEJO_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + FORGEJO_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo FORGEJO_USER: root FORGEJO_PASSWORD: admin1234 diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml index c8907609..ba3c6a5d 100644 --- a/.forgejo/workflows/example-lxc-systemd.yml +++ b/.forgejo/workflows/example-lxc-systemd.yml @@ -14,7 +14,7 @@ env: SERIAL: "30" LIFETIME: "60" SYSTEMD_OPTIONS: "--no-pager --full" - USE_VERSION: 11.0.6 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo + USE_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo jobs: example-lxc-systemd: From 88e6654a6c29db2bfd700523dd771e6b5d38fb93 Mon Sep 17 00:00:00 2001 From: Richard Robert Reitz Date: Wed, 29 Oct 2025 11:12:12 +0100 Subject: [PATCH 96/99] feat(runner): Added waiting for a job arrival in the one-job command. --- internal/app/job/job.go | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/internal/app/job/job.go b/internal/app/job/job.go index 6babd498..654bc154 100644 --- a/internal/app/job/job.go +++ b/internal/app/job/job.go @@ -36,11 +36,20 @@ func NewJob(cfg *config.Config, client client.Client, runner run.RunnerInterface } func (j *Job) Run(ctx context.Context) error { - task, ok := j.fetchTask(ctx) - if !ok { - return fmt.Errorf("could not fetch task") + log.Info("Polling for a job...") + for { + task, ok := j.fetchTask(ctx) + if ok { + return j.runTaskWithRecover(ctx, task) + } + // No task available, continue polling + select { + case <-ctx.Done(): + return ctx.Err() + default: + // Continue to next iteration + } } - return j.runTaskWithRecover(ctx, task) } func (j *Job) runTaskWithRecover(ctx context.Context, task *runnerv1.Task) error { From cd83c525c894af84ea9fa5caa251b3c3bd5c66f9 Mon Sep 17 00:00:00 2001 From: Martin McCaffery Date: Thu, 30 Oct 2025 08:48:02 +0000 Subject: [PATCH 97/99] chore(workflow): set up simpler build pipeline --- .forgejo/workflows/build-ipcei.yml | 27 +++++++++++++ .goreleaser.yaml | 61 ++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+) create mode 100644 .forgejo/workflows/build-ipcei.yml create mode 100644 .goreleaser.yaml diff --git a/.forgejo/workflows/build-ipcei.yml b/.forgejo/workflows/build-ipcei.yml new file mode 100644 index 00000000..d2a754ba --- /dev/null +++ b/.forgejo/workflows/build-ipcei.yml @@ -0,0 +1,27 @@ +name: ci + +on: + push: + tags: + - v* + +jobs: + goreleaser: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Set up Go + uses: actions/setup-go@v6 + with: + go-version: ">=1.25.1" + - name: Test code + run: make test + - name: Run GoReleaser + uses: https://github.com/goreleaser/goreleaser-action@v6 + env: + GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }} + with: + args: release --clean diff --git a/.goreleaser.yaml b/.goreleaser.yaml new file mode 100644 index 00000000..1871ce88 --- /dev/null +++ b/.goreleaser.yaml @@ -0,0 +1,61 @@ +version: 2 + +before: + hooks: + - go mod download + - go generate ./... + +builds: + - env: + - CGO_ENABLED=0 + goos: + - linux + - darwin + - windows + goarch: + - amd64 + - arm64 + +archives: + - formats: [binary] + # this name template makes the OS and Arch compatible with the results of `uname`. + name_template: >- + {{ .ProjectName }}_ + {{- title .Os }}_ + {{- if eq .Arch "amd64" }}x86_64 + {{- else if eq .Arch "386" }}i386 + {{- else }}{{ .Arch }}{{ end }} + {{- if .Arm }}v{{ .Arm }}{{ end }} + +changelog: + abbrev: 10 + filters: + exclude: + - "^docs:" + - "^test:" + format: "{{.SHA}}: {{.Message}}" + groups: + - title: Features + regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$' + order: 0 + - title: "Bug fixes" + regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$' + order: 1 + - title: "Chores" + regexp: '^.*?chore(\([[:word:]]+\))??!?:.+$' + order: 2 + - title: Others + order: 999 + sort: asc + +release: + gitea: + owner: DevFW-CICD + name: edge-connect-client + +force_token: gitea +gitea_urls: + api: https://edp.buildth.ing/api/v1 + download: https://edp.buildth.ing + # set to true if you use a self-signed certificate + skip_tls_verify: false From 1f8217d99b404b1a5f14c8b4f6d79cc95ace886d Mon Sep 17 00:00:00 2001 From: Martin McCaffery Date: Thu, 30 Oct 2025 08:57:37 +0000 Subject: [PATCH 98/99] fix(workflow): remove go generate from goreleaser --- .goreleaser.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 1871ce88..4c299275 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -3,7 +3,6 @@ version: 2 before: hooks: - go mod download - - go generate ./... builds: - env: From d97839cd90f2527c6e6f1cb73f521c389b05bfb1 Mon Sep 17 00:00:00 2001 From: Martin McCaffery Date: Thu, 30 Oct 2025 09:09:10 +0000 Subject: [PATCH 99/99] fix(workflow): point to correct repo --- .goreleaser.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 4c299275..b7116d9b 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -50,7 +50,7 @@ changelog: release: gitea: owner: DevFW-CICD - name: edge-connect-client + name: runner force_token: gitea gitea_urls: