fix(workflow): point to correct repo

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [code.forgejo.org/forgejo/forgejo](https://forgejo.org) ([source](https://codeberg.org/forgejo/forgejo)) | patch | `11.0.6` -> `11.0.7` |

---

### Release Notes

<details>
<summary>forgejo/forgejo (code.forgejo.org/forgejo/forgejo)</summary>

### [`v11.0.7`](https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.7)

[Compare Source](https://codeberg.org/forgejo/forgejo/compare/v11.0.6...v11.0.7)

See <https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/11.0.7.md>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNTIuOSIsInVwZGF0ZWRJblZlciI6IjQxLjE1Mi45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJLaW5kL0RlcGVuZGVuY3lVcGRhdGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyJdfQ==-->

Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1113
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>

.forgejo/cascading-pr-setup-forgejo

@@ -1,16 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-setup_forgejo=$1
-setup_forgejo_pr=$2
-runner=$3
-runner_pr=$4
-
-url=$(jq --raw-output .head.repo.html_url < $runner_pr)
-test "$url" != null
-branch=$(jq --raw-output .head.ref < $runner_pr)
-test "$branch" != null
-cd $setup_forgejo
-./utils/upgrade-runner.sh $url @$branch
-date > last-upgrade

.forgejo/cascading-setup-forgejo

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -ex
+
+setup_forgejo=$1
+setup_forgejo_pr=$2
+runner=$3
+runner_pr_or_ref=$4
+
+if test -f "$runner_pr_or_ref"; then
+  url=$(jq --raw-output .head.repo.html_url <$runner_pr_or_ref)
+  test "$url" != null
+  branch=$(jq --raw-output .head.ref <$runner_pr_or_ref)
+else
+  url=https://code.forgejo.org/forgejo/runner
+  branch=${runner_pr_or_ref#refs/heads/}
+fi
+test "$url"
+test "$branch"
+test "$branch" != null
+cd $setup_forgejo
+./utils/upgrade-runner.sh $url @$branch
+rm -f .forgejo/workflows/integration*.yml
+date >last-upgrade

.forgejo/labelscompare.py

@@ -8,7 +8,7 @@ expectedLabels = {
     "org.opencontainers.image.source": "https://code.forgejo.org/forgejo/runner",
     "org.opencontainers.image.version": "1.2.3",
     "org.opencontainers.image.vendor": "Forgejo",
-    "org.opencontainers.image.licenses": "MIT",
+    "org.opencontainers.image.licenses": "GPL-3.0-or-later",
     "org.opencontainers.image.title": "Forgejo Runner",
     "org.opencontainers.image.description": "A runner for Forgejo Actions.",
 }

.forgejo/workflows/build-ipcei.yml

@@ -0,0 +1,27 @@
+name: ci
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ">=1.25.1"
+      - name: Test code
+        run: make test
+      - name: Run GoReleaser
+        uses: https://github.com/goreleaser/goreleaser-action@v6
+        env:
+          GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
+        with:
+          args: release --clean

.forgejo/workflows/build-release-integration.yml

@@ -18,19 +18,22 @@ on:
 
 enable-email-notifications: true
 
+env:
+  FORGEJO_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo
+
 jobs:
   release-simulation:
     runs-on: lxc-bookworm
     if: vars.ROLE == 'forgejo-coding'
     steps:
-      - uses: actions/checkout@v4
+      - uses:  https://data.forgejo.org/actions/checkout@v4
 
       - id: forgejo
-        uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2
+        uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4
         with:
           user: root
           password: admin1234
-          image-version: 1.20
+          image-version: ${{ env.FORGEJO_VERSION }}
           lxc-ip-prefix: 10.0.9
 
       - name: publish

.forgejo/workflows/build-release.yml

@@ -23,7 +23,7 @@ jobs:
     # root is used for testing, allow it
     if: vars.ROLE == 'forgejo-integration' || forge.repository_owner == 'root'
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
 
       - name: Increase the verbosity when there are no secrets
         id: verbose

.forgejo/workflows/cascade-forgejo.yml

@@ -87,10 +87,10 @@ jobs:
         with:
           fetch-depth: '0'
           show-progress: 'false'
-      - uses: actions/setup-go@v5
+      - uses: https://data.forgejo.org/actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.1
+      - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0
         with:
           origin-url: ${{ forge.server_url }}
           origin-repo: ${{ forge.repository }}
@@ -106,4 +106,5 @@ jobs:
           close: true
           verbose: ${{ vars.VERBOSE == 'yes' }}
           debug: ${{ vars.DEBUG == 'yes' }}
+          wait-iteration: 120
           update: .forgejo/cascading-forgejo

.forgejo/workflows/cascade-setup-forgejo.yml

@@ -1,31 +1,99 @@
+# Copyright 2025 The Forgejo Authors
 # SPDX-License-Identifier: MIT
+#
+# CASCADING_PR_ORIGIN is a token from the https://code.forgejo.org/cascading-pr user
+# with scope write:issue read:repository read:user
+# CASCADING_PR_DESTINATION is a token from the https://code.forgejo.org/cascading-pr user
+# with scope write:issue write:repository read:user
+#
+# To modify this workflow:
+#
+#  - push it to the wip-cascade branch on the repository
+#    otherwise it will not have access to the secrets required to push
+#    the cascading PR
+#
+#  - once it works, open a pull request for the sake of keeping track
+#    of the change even if the PR won't run it because it will use
+#    whatever is in the default branch instead
+#
+#  - after it is merged, double check it works by setting the
+#    label on a pull request (any pull request will do)
+#
+name: cascade
+
 on:
+  push:
+    branches:
+      - 'wip-cascade'
   pull_request_target:
     types:
-      - opened
       - synchronize
+      - labeled
       - closed
 
 enable-email-notifications: true
 
 jobs:
-  cascade:
+  debug:
+    if: >
+      vars.DEBUG == 'yes'
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:22-bookworm
+    steps:
+      - name: event
+        run: |
+          cat <<'EOF'
+          ${{ toJSON(forge.event.pull_request.labels.*.name) }}
+          EOF
+          cat <<'EOF'
+          push => ${{ forge.event_name == 'push' && ( forge.ref_name == 'wip-cascade') }}
+          pull_request_target synchornized => ${{ ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) }}
+          pull_request_target label_updated => ${{ ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-end-to-end-tests' ) }}
+          contains => ${{ contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') }}
+          contains boolean => ${{ contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') == true }}
+          EOF
+          cat <<'EOF'
+          ${{ toJSON(forge) }}
+          EOF
+
+  end-to-end:
+    #
+    # Always run when a commit is pushed to the wip-cascade branch
+    # If this is a pull request, run
+    #   - when the `run-end-to-end-tests` label is set (label_updated) (but not if another label is set or if a label is removed)
+    #   - when a new commit is pushed to the pull request (synchronized) if the `run-end-to-end-tests` is already present
+    #   - when the pull request is closed, which also happens when it is merged, so that the setup-forgejo & end-to-end pull requests are closed
+    #
+    if: >
+      vars.ROLE == 'forgejo-coding' && (
+        (
+          forge.event_name == 'push' && ( forge.ref_name == 'wip-cascade' )
+        ) || (
+          forge.event_name == 'pull_request_target' && (
+            forge.event.action == 'closed' ||
+            ( forge.event.action == 'synchronized' && contains(forge.event.pull_request.labels.*.name, 'run-end-to-end-tests') ) ||
+            ( forge.event.action == 'label_updated' && forge.event.label.name == 'run-end-to-end-tests' )
+          )
+        )
+      )
     runs-on: docker
     container:
       image: 'code.forgejo.org/oci/node:22-bookworm'
-    if: >
-      ! contains(forge.event.pull_request.title, '[skip cascade]')
     steps:
-      - uses: https://code.forgejo.org/actions/cascading-pr@v2.2.1
+      - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.0
         with:
-          origin-url: ${{ env.FORGEJO_SERVER_URL }}
-          origin-repo: forgejo/runner
+          origin-url: ${{ forge.server_url }}
+          origin-repo: ${{ forge.repository }}
           origin-token: ${{ secrets.CASCADING_PR_ORIGIN }}
           origin-pr: ${{ forge.event.pull_request.number }}
-          destination-url: ${{ env.FORGEJO_SERVER_URL }}
+          origin-ref: ${{ forge.event_name == 'push' && forge.event.ref || '' }}
+          destination-url: ${{ forge.server_url }}
           destination-repo: actions/setup-forgejo
           destination-fork-repo: cascading-pr/setup-forgejo
           destination-branch: main
           destination-token: ${{ secrets.CASCADING_PR_DESTINATION }}
-          close-merge: true
-          update: .forgejo/cascading-pr-setup-forgejo
+          close: true
+          verbose: ${{ vars.VERBOSE == 'yes' }}
+          debug: ${{ vars.DEBUG == 'yes' }}
+          update: .forgejo/cascading-setup-forgejo

.forgejo/workflows/docker-build-push-action-in-lxc.yml

@@ -21,7 +21,7 @@ on:
 enable-email-notifications: true
 
 env:
-  FORGEJO_VERSION: 11.0.3 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo
+  FORGEJO_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo
   FORGEJO_USER: root
   FORGEJO_PASSWORD: admin1234
 
@@ -34,7 +34,7 @@ jobs:
 
       - name: install Forgejo so it can be used as a container registry
         id: registry
-        uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2
+        uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4
         with:
           user: ${{ env.FORGEJO_USER }}
           password: ${{ env.FORGEJO_PASSWORD }}

.forgejo/workflows/example-docker-compose.yml

@@ -15,7 +15,7 @@ jobs:
     if: vars.ROLE == 'forgejo-coding'
     runs-on: lxc-bookworm
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
 
       - name: Install docker
         run: |

.forgejo/workflows/example-lxc-systemd.yml

@@ -14,11 +14,12 @@ env:
   SERIAL: "30"
   LIFETIME: "60"
   SYSTEMD_OPTIONS: "--no-pager --full"
+  USE_VERSION: 11.0.7 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo
 
 jobs:
   example-lxc-systemd:
     if: vars.ROLE == 'forgejo-coding'
-    runs-on: lxc-bookworm
+    runs-on: lxc-trixie
     steps:
        - uses: https://data.forgejo.org/actions/checkout@v4
 
@@ -53,11 +54,11 @@ jobs:
            done
 
        - id: forgejo
-         uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2
+         uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.4
          with:
            user: root
            password: admin1234
-           binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v7.0.12/forgejo-7.0.12-linux-amd64
+           binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v${{ env.USE_VERSION }}/forgejo-${{ env.USE_VERSION }}-linux-amd64
            # must be the same as LXC_IPV4_PREFIX in examples/lxc-systemd/forgejo-runner-service.sh
            lxc-ip-prefix: 10.105.7
 
@@ -123,8 +124,8 @@ jobs:
            started_running=/etc/forgejo-runner/$serial/started-running
            killed_gracefully=/etc/forgejo-runner/$serial/killed-gracefully
            stopped_gracefully=/etc/forgejo-runner/$serial/stopped-gracefully
-           retry --delay 5 --times 20 cp -a $started_running /tmp/first-run
-           retry --delay 1 --times 30 grep --quiet 'Starting runner daemon' /var/log/forgejo-runner/$serial.log
+           retry --delay 10 --times 20 cp -a $started_running /tmp/first-run
+           retry --delay 2 --times 30 grep --quiet 'Starting runner daemon' /var/log/forgejo-runner/$serial.log
            systemctl stop forgejo-runner@$serial
            ! systemctl $all status forgejo-runner@$serial
            ls -l /etc/forgejo-runner/$serial
@@ -136,7 +137,7 @@ jobs:
            ! test -f $killed_gracefully
            ! test -f $stopped_gracefully
            lifetime=${{ env.LIFETIME }}
-           # give it time to restart at least once
+           : give it time to restart at least once
            ls -l /etc/forgejo-runner/$serial
            sleep $lifetime ; sleep $lifetime
            ls -l /etc/forgejo-runner/$serial

.forgejo/workflows/release-notes-assistant.yml

@@ -6,16 +6,17 @@ name: issue-labels
 on:
   pull_request_target:
     types:
+      - opened
       - edited
       - synchronize
       - labeled
 
 env:
-  RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
+  RNA_VERSION: v1.4.1 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant
 
 jobs:
   release-notes:
-    if: vars.ROLE == 'forgejo-coding'
+    if: vars.ROLE == 'forgejo-coding' && !contains(forge.event.pull_request.labels.*.name, 'Kind/DependencyUpdate')
     runs-on: docker
     container:
       image: 'data.forgejo.org/oci/ci:1'

.forgejo/workflows/test.yml

@@ -14,7 +14,6 @@ env:
   FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
   FORGEJO_SCRIPT: |
     /usr/bin/s6-svscan /etc/s6 & sleep 10 ; su -c "forgejo admin user create --admin --username $FORGEJO_ADMIN_USER --password $FORGEJO_ADMIN_PASSWORD --email root@example.com" git && su -c "forgejo forgejo-cli actions register --labels docker --name therunner --secret $FORGEJO_RUNNER_SECRET" git && sleep infinity
-  GOPROXY: https://goproxy.io,direct
 
 jobs:
   build-and-tests:
@@ -60,7 +59,7 @@ jobs:
 
       - run: make build
 
-      - uses: https://code.forgejo.org/actions/upload-artifact@v3
+      - uses: https://data.forgejo.org/actions/upload-artifact@v3
         with:
           name: forgejo-runner
           path: forgejo-runner
@@ -80,9 +79,9 @@ jobs:
     needs: [build-and-tests]
     steps:
 
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
 
-      - uses: https://code.forgejo.org/actions/download-artifact@v3
+      - uses: https://data.forgejo.org/actions/download-artifact@v3
         with:
           name: forgejo-runner
 
@@ -157,9 +156,9 @@ jobs:
     needs: [build-and-tests]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
 
-      - uses: actions/setup-go@v5
+      - uses: https://data.forgejo.org/actions/setup-go@v5
         with:
           go-version-file: go.mod
 
@@ -186,6 +185,11 @@ jobs:
           EOF
           apt --quiet install --yes -qq docker.io make
 
+      - name: install LXC
+        run: |
+          act/runner/lxc-helpers.sh lxc_prepare_environment
+          act/runner/lxc-helpers.sh lxc_install_lxc_inside 10.39.28 fdb1
+
       - run: apt-get -q install -qq -y gcc # required for `-race`
 
       - run: make integration-test
@@ -218,3 +222,53 @@ jobs:
             git diff --color=always
             exit 1
           }
+
+  validate-pre-commit:
+    name: validate pre-commit-hooks file
+    if: vars.ROLE == 'forgejo-coding'
+    runs-on: docker
+    container:
+      image: 'code.forgejo.org/oci/ci:1'
+
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: install pre-commit
+        env:
+          DEBIAN_FRONTEND: noninteractive
+          PIP_ROOT_USER_ACTION: ignore
+          PIP_BREAK_SYSTEM_PACKAGES: 1
+          PIP_PROGRESS_BAR: off
+        run: |
+          apt-get update -qq
+          apt-get -q install -qq -y python3-pip
+          python3 -m pip install 'pre-commit>=3.2.0'
+
+      - name: validate .pre-commit-hooks.yaml
+        run: pre-commit validate-manifest .pre-commit-hooks.yaml
+
+      # Will fail due to `act/runner/testdata/local-action-fails-schema-validation/action/action.yml`
+      - name: check pre-commit hook against local action files (should fail)
+        continue-on-error: true
+        run: |
+          pre-commit try-repo --all-files --verbose . forgejo-runner-validate
+
+      - name: check that a bad workflow file doesn’t validate (should fail)
+        continue-on-error: true
+        run: |
+          mkdir -p test-repo
+          cd test-repo
+          git config set advice.defaultBranchName false
+          git init --quiet
+          mkdir -p .forgejo/workflows
+          cp ../act/runner/testdata/local-action-fails-schema-validation/action/action.yml ./
+          touch .forgejo/workflows/bad-workflow.yml
+          cat > .pre-commit-config.yaml <<EOF
+          repos:
+            - repo: ..
+              rev: ${{ forge.sha }}
+              hooks:
+                - id: forgejo-runner-validate
+          EOF
+          git add .
+          pre-commit run --all-files --verbose forgejo-runner-validate

.github/workflows/build-release.yml

@@ -1,151 +0,0 @@
-# This workflow:
-#  - builds and uploads a binary artifact for each Windows architecture
-#  - tests the runner on Windows with a Forgejo server container running on Windows Subsystem for Linux (WSL)
-#  - releases the binary artifact (if triggered on a pushed tag)
-#
-# This build is currently supported on https://github.com/Crown0815/forgejo-runner-windows
-
-name: Build Release
-
-on:
-  push:
-    tags: ['v*']
-    branches: [ main ]
-
-jobs:
-  build:
-    name: Build ${{matrix.architecture}}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        architecture: ['386', amd64, arm, arm64]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build for ${{matrix.architecture}}
-        run: |
-          env GOOS=windows GOARCH=${{matrix.architecture}} \
-          go build \
-            -ldflags "-s -w -X code.forgejo.org/forgejo/runner/internal/pkg/ver.version=${{ github.ref_name }}" \
-            -o forgejo-runner-windows-${{matrix.architecture}}.exe
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: forgejo-runner-windows-${{matrix.architecture}}
-          path: forgejo-runner-windows-${{matrix.architecture}}.exe
-
-
-  test:
-    name: Run Tests on Windows with Linux Forgejo Server
-    runs-on: windows-latest
-    env:
-      FORGEJO_ROOT_URL: 'http://localhost:3000/'
-      FORGEJO_ADMIN_USER: 'admin_user'
-      FORGEJO_ADMIN_PASSWORD: 'admin_password'
-      FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
-      MAX_WAIT_ITERATIONS: 30
-
-    steps:
-      - name: Windows - Checkout code
-        uses: actions/checkout@v4
-
-      - name: Windows - Setup Windows Subsystem for Linux (WSL)
-        uses: Vampire/setup-wsl@v5
-        with:
-          distribution: Alpine
-          wsl-shell-user: root
-          additional-packages: bash
-
-      - name: WSL - Install Docker
-        shell: wsl-bash {0}
-        run: |
-          apk --update add --no-cache docker curl
-
-          rc-update add docker default
-          openrc default
-
-          # Wait for Docker to be ready
-          i=0
-          until docker info > /dev/null 2>&1 || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do
-            echo "Waiting for Docker to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})"
-            sleep 1
-          done
-          [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Docker is ready!" || { echo "Timed out waiting for Docker" ; exit 1; }
-
-      - name: WSL - Start Forgejo Server
-        shell: wsl-bash {0}
-        run: |
-          docker run -d --name forgejo \
-            -p 3000:3000 \
-            -e USER_UID=1000 \
-            -e USER_GID=1000 \
-            -e FORGEJO__security__INSTALL_LOCK=true \
-            -e FORGEJO__server__DOMAIN=localhost \
-            -e FORGEJO__server__ROOT_URL=${{ env.FORGEJO_ROOT_URL }} \
-            codeberg.org/forgejo/forgejo:11.0-rootless
-
-      - name: Windows - Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Windows - Install dependencies
-        run: go mod download
-
-      - name: WSL - Register Runner on Forgejo Server
-        # Starting the Forgejo server takes some time.
-        # That time used to install go.
-        shell: wsl-bash {0}
-        run: |
-          i=0
-          until curl -s ${{ env.FORGEJO_ROOT_URL }}/api/v1/version > /dev/null || (( i == ${{ env.MAX_WAIT_ITERATIONS }} )); do
-            echo "Waiting for Forgejo to be ready... ($(( ++i ))/${{ env.MAX_WAIT_ITERATIONS }})"
-            sleep 1
-          done
-          [ $i -lt ${{ env.MAX_WAIT_ITERATIONS }} ] && echo "Forgejo is ready!" || { echo "Timed out waiting for Forgejo" ; exit 1; }
-
-          # Create admin user and generate runner token
-          docker exec forgejo forgejo admin user create --admin --username ${{ env.FORGEJO_ADMIN_USER }} --password ${{ env.FORGEJO_ADMIN_PASSWORD }} --email root@example.com
-          docker exec forgejo forgejo forgejo-cli actions register --labels docker --name therunner --secret ${{ env.FORGEJO_RUNNER_SECRET }}
-
-      - name: Windows - Connect to Forgejo server
-        run: |
-          $configFileContent = @"
-          log:
-            level: debug
-          runner:
-            labels:
-              - windows:host
-              - docker:docker://node:20
-          "@
-          Set-Content -Path temporaryConfig.yml -Value $configFileContent
-
-          # Register the runner
-          go run main.go create-runner-file --config temporaryConfig.yml --instance ${{ env.FORGEJO_ROOT_URL }} --secret ${{ env.FORGEJO_RUNNER_SECRET }} --name "windows-test-runner"
-
-      - name: Windows - Run tests
-        run: go test -v ./...
-        env:
-          FORGEJO_URL: ${{ env.FORGEJO_ROOT_URL }}
-          FORGEJO_RUNNER_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }}
-          FORGEJO_RUNNER_HEX_SECRET: ${{ env.FORGEJO_RUNNER_SECRET }}
-
-
-  release:
-    runs-on: ubuntu-latest
-    needs: [build, test]
-    if: github.event_name == 'push' && github.ref_type == 'tag'
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          path: .
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ github.ref_name }}
-          files: forgejo-runner-windows-*/forgejo-runner-windows-*.exe
-          draft: false
-          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }}
-          token: ${{ secrets.RELEASE_TOKEN }}
-          fail_on_unmatched_files: true
-          body: See [original release notes](https://code.forgejo.org/forgejo/runner/releases/tag/${{ github.ref_name }}).

.goreleaser.yaml

@@ -0,0 +1,60 @@
+version: 2
+
+before:
+  hooks:
+    - go mod download
+
+builds:
+  - env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+
+archives:
+  - formats: [binary]
+    # this name template makes the OS and Arch compatible with the results of `uname`.
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+
+changelog:
+  abbrev: 10
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+  format: "{{.SHA}}: {{.Message}}"
+  groups:
+    - title: Features
+      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
+      order: 0
+    - title: "Bug fixes"
+      regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
+      order: 1
+    - title: "Chores"
+      regexp: '^.*?chore(\([[:word:]]+\))??!?:.+$'
+      order: 2
+    - title: Others
+      order: 999
+  sort: asc
+
+release:
+  gitea:
+    owner: DevFW-CICD
+    name: runner
+
+force_token: gitea
+gitea_urls:
+  api: https://edp.buildth.ing/api/v1
+  download: https://edp.buildth.ing
+  # set to true if you use a self-signed certificate
+  skip_tls_verify: false

.pre-commit-hooks.yaml

@@ -0,0 +1,13 @@
+- id: forgejo-runner-validate
+  name: Validate Forgejo Actions files
+  description: This hook validates Forgejo Actions action and workflow files.
+  language: golang
+  entry: runner validate
+  args: ['--directory', '.']
+  pass_filenames: false
+  files: (?:(?:^|/)action|^\.(?:forgejo|github|gitea)/workflows/[^/\n]+)\.ya?ml$
+  types: [yaml]
+  # 3.2.0 is when the pre-* `stages` used here were added.
+  # Old names (without the pre- prefix) are deprecated since 4.0.0.
+  minimum_pre_commit_version: '3.2.0'
+  stages: [pre-commit, pre-merge-commit, pre-push, manual]

Dockerfile

@@ -1,6 +1,6 @@
 FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/xx AS xx
 
-FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.24-alpine3.22 AS build-env
+FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.25-alpine3.22 AS build-env
 
 #
 # Transparently cross compile for the target platform
@@ -32,7 +32,7 @@ LABEL maintainer="contact@forgejo.org" \
       org.opencontainers.image.source="https://code.forgejo.org/forgejo/runner" \
       org.opencontainers.image.version="${RELEASE_VERSION}" \
       org.opencontainers.image.vendor="Forgejo" \
-      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.licenses="GPL-3.0-or-later" \
       org.opencontainers.image.title="Forgejo Runner" \
       org.opencontainers.image.description="A runner for Forgejo Actions."
 

LICENSE

@@ -1,20 +1,674 @@
-Copyright (c) 2023-2025 The Forgejo Authors
-Copyright (c) 2022 The Gitea Authors
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
+                            Preamble
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

Makefile

@@ -13,8 +13,8 @@ WINDOWS_ARCHS ?= windows/amd64
 GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*")
 GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*")
 
-MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.4 # renovate: datasource=go
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0 # renovate: datasource=go
+MOCKERY_PACKAGE ?= github.com/vektra/mockery/v2@v2.53.5 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0 # renovate: datasource=go
 
 DOCKER_IMAGE ?= gitea/act_runner
 DOCKER_TAG ?= nightly
@@ -62,18 +62,18 @@ else
 	endif
 endif
 
-GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/v9/internal/pkg/client/mocks,$(shell $(GO) list ./...))
+GO_PACKAGES_TO_VET ?= $(filter-out code.forgejo.org/forgejo/runner/v11/internal/pkg/client/mocks code.forgejo.org/forgejo/runner/v11/act/artifactcache/mock_caches.go,$(shell $(GO) list ./...))
 
 TAGS ?=
-LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=v$(RELEASE_VERSION)"
+LDFLAGS ?= -X "code.forgejo.org/forgejo/runner/v11/internal/pkg/ver.version=v$(RELEASE_VERSION)"
 
 all: build
 
-.PHONY: lint
+.PHONY: lint-check
 lint-check:
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run $(GOLANGCI_LINT_ARGS)
 
-.PHONY: lint-fix
+.PHONY: lint
 lint:
 	$(GO) run $(GOLANGCI_LINT_PACKAGE) run $(GOLANGCI_LINT_ARGS) --fix
 
@@ -120,7 +120,7 @@ vet:
 
 .PHONY: generate
 generate:
-	$(GO) generate ./internal/...
+	$(GO) generate ./...
 
 install: $(GOFILES)
 	$(GO) install -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)'

README.md

@@ -2,19 +2,13 @@
 
 A daemon that connects to a Forgejo instance and runs jobs for continuous integration. The [installation and usage instructions](https://forgejo.org/docs/next/admin/actions/) are part of the Forgejo documentation.
 
-# Reporting bugs
-
-When filing a bug in [the issue tracker](https://code.forgejo.org/forgejo/runner/issues), it is very helpful to propose a pull request [in the end-to-end tests](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions) repository that adds a reproducer. It will fail the CI and unambiguously demonstrate that the problem exists. In most cases it is enough to add a workflow ([see the echo example](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions/example-echo)). For more complicated cases it is also possible to add a runner config file as well as shell scripts to setup and teardown the test case ([see the service example](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions/example-service)).
+# Reporting security-related issues
 
 Sensitive security-related issues should be reported to [security@forgejo.org](mailto:security@forgejo.org) using [encryption](https://keyoxide.org/security@forgejo.org).
 
-
 ## License
 
-The Forgejo runner source code is distributed under the terms of the following licenses:
-
-- [MIT](LICENSE) for the most part.
-- [Apache 2](act/container/DOCKER_LICENSE) for parts found in the [act/container](act/container) directory.
+The Forgejo runner is distributed under the terms of the [GPL version 3.0](LICENSE) or any later version.
 
 # Architectures & OS
 
@@ -36,77 +30,44 @@ The Forgejo runner is a dependency of the [setup-forgejo action](https://code.fo
 - Install [Go](https://go.dev/doc/install) and `make(1)`
 - `make build`
 
-The [test workflow](.forgejo/workflows/test.yml) is a full example that builds the binary, runs the tests and launches the runner binary against a live Forgejo instance.
+## Linting
 
-## Generate mocks
+- `make lint-check`
+- `make lint` # will fix some lint errors
 
-- `make deps-tools`
-- `make generate`
+## Testing
 
-If there are changes, commit them to the repository.
+The [workflow](.forgejo/workflows/test.yml) that runs in the CI uses similar commands.
 
-## Local debug
+### Without a Forgejo instance
 
-The repositories are checked out in the same directory:
+- Install [Docker](https://docs.docker.com/engine/install/)
+- `make test integration-test`
 
-- **runner**: [Forgejo runner](https://code.forgejo.org/forgejo/runner)
-- **setup-forgejo**: [setup-forgejo](https://code.forgejo.org/actions/setup-forgejo)
+The `TestRunner_RunEvent` test suite contains most integration tests
+with real-world workflows and is time-consuming to run. During
+development, it is helpful to run a specific test through a targeted
+command such as this:
 
-### Install dependencies
+- `go test -count=1 -run='TestRunner_RunEvent$/local-action-dockerfile$' ./act/runner`
 
-The dependencies are installed manually or with:
+### With a Forgejo instance
 
-```shell
-setup-forgejo/forgejo-dependencies.sh
+- Run a Forgejo instance locally (for instance at http://0.0.0.0:8080) and create as shared secret
+```sh
+export FORGEJO_RUNNER_SECRET='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
+export FORGEJO_URL=http://0.0.0.0:8080
+forgejo forgejo-cli actions register --labels docker --name therunner --secret $FORGEJO_RUNNER_SECRET
 ```
+- `make test integration-test` # which will run addional tests because FORGEJO_URL is set
 
-### Build the Forgejo runner
+### end-to-end
 
-```shell
-cd runner ; rm -f forgejo-runner ; make forgejo-runner
-```
-
-### Launch Forgejo and the runner
-
-A Forgejo instance is launched with:
-
-```shell
-cd setup-forgejo
-./forgejo.sh setup
-firefox $(cat forgejo-url)
-```
-
-The user is `root` with password `admin1234`. The runner is registered with:
-
-```
-cd setup-forgejo
-docker exec --user 1000 forgejo forgejo actions generate-runner-token > forgejo-runner-token
-../runner/forgejo-runner register --no-interactive --instance "$(cat forgejo-url)" --name runner --token $(cat forgejo-runner-token) --labels docker:docker://node:22-bookworm,self-hosted:host,lxc:lxc://debian:bookworm
-```
-
-And launched with:
-
-```shell
-cd setup-forgejo ; ../runner/forgejo-runner --config runner-config.yml daemon
-```
-
-Note that the `runner-config.yml` is required in that particular case
-to configure the network in `bridge` mode, otherwise the runner will
-create a network that cannot reach the forgejo instance.
-
-### Try a sample workflow
-
-From the Forgejo web interface, create a repository and add the
-following to `.forgejo/workflows/try.yaml`. It will launch the job and
-the result can be observed from the `actions` tab.
-
-```yaml
-on: [push]
-jobs:
-  ls:
-    runs-on: docker
-    steps:
-      - uses: actions/checkout@v4
-      - run: |
-          ls ${{ github.workspace }}
-```
+- Follow the instructions from the end-to-end tests to [run actions tests locally](https://code.forgejo.org/forgejo/end-to-end#running-from-locally-built-binary).
+- `./end-to-end.sh actions_teardown` # stop the Forgejo and runner daemons running in the end-to-end environment
+- `( cd ~/clone-of-the-runner-repo ; make build ; cp forgejo-runner /tmp/forgejo-end-to-end/forgejo-runner )` # install the runner built from sources
+- `./end-to-end.sh actions_setup 13.0` # start Forgejo v13.0 and the runner daemon in the end-to-end environment
+- `./end-to-end.sh actions_verify_example echo` # run the [echo workflow](https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions/example-echo/.forgejo/workflows/test.yml)
+- `xdg-open http://127.0.0.1:3000/root/example-echo/actions/runs/1` # see the logs workflow
+- `less /tmp/forgejo-end-to-end/forgejo-runner.log` # analyze the runner logs
+- `less /tmp/forgejo-end-to-end/forgejo-work-path/log/forgejo.log` # analyze the Forgejo logs

act/artifactcache/caches.go

@@ -0,0 +1,324 @@
+package artifactcache
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sync/atomic"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"github.com/timshannon/bolthold"
+	"go.etcd.io/bbolt"
+)
+
+//go:generate mockery --inpackage --name caches
+type caches interface {
+	getDB() *bolthold.Store
+	validateMac(rundata RunData) (string, error)
+	readCache(id uint64, repo string) (*Cache, error)
+	useCache(id uint64) error
+	setgcAt(at time.Time)
+	gcCache()
+	close()
+
+	serve(w http.ResponseWriter, r *http.Request, id uint64)
+	commit(id uint64, size int64) (int64, error)
+	exist(id uint64) (bool, error)
+	write(id, offset uint64, reader io.Reader) error
+}
+
+type cachesImpl struct {
+	dir     string
+	storage *Storage
+	logger  logrus.FieldLogger
+	secret  string
+
+	db *bolthold.Store
+
+	gcing atomic.Bool
+	gcAt  time.Time
+}
+
+func newCaches(dir, secret string, logger logrus.FieldLogger) (caches, error) {
+	c := &cachesImpl{
+		secret: secret,
+	}
+
+	c.logger = logger
+
+	if dir == "" {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return nil, err
+		}
+		dir = filepath.Join(home, ".cache", "actcache")
+	}
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return nil, err
+	}
+
+	c.dir = dir
+
+	storage, err := NewStorage(filepath.Join(dir, "cache"))
+	if err != nil {
+		return nil, err
+	}
+	c.storage = storage
+
+	file := filepath.Join(c.dir, "bolt.db")
+	db, err := bolthold.Open(file, 0o644, &bolthold.Options{
+		Encoder: json.Marshal,
+		Decoder: json.Unmarshal,
+		Options: &bbolt.Options{
+			Timeout:      5 * time.Second,
+			NoGrowSync:   bbolt.DefaultOptions.NoGrowSync,
+			FreelistType: bbolt.DefaultOptions.FreelistType,
+		},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("Open(%s): %w", file, err)
+	}
+	c.db = db
+
+	c.gcCache()
+
+	return c, nil
+}
+
+func (c *cachesImpl) close() {
+	if c.db != nil {
+		c.db.Close()
+		c.db = nil
+	}
+}
+
+func (c *cachesImpl) getDB() *bolthold.Store {
+	return c.db
+}
+
+var findCacheWithIsolationKeyFallback = func(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) {
+	cache, err := findCache(db, repo, keys, version, writeIsolationKey)
+	if err != nil {
+		return nil, err
+	}
+	// If read was scoped to WriteIsolationKey and didn't find anything, we can fallback to the non-isolated cache read
+	if cache == nil && writeIsolationKey != "" {
+		cache, err = findCache(db, repo, keys, version, "")
+		if err != nil {
+			return nil, err
+		}
+	}
+	return cache, nil
+}
+
+// if not found, return (nil, nil) instead of an error.
+func findCache(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) {
+	cache := &Cache{}
+	for _, prefix := range keys {
+		// if a key in the list matches exactly, don't return partial matches
+		if err := db.FindOne(cache,
+			bolthold.Where("Repo").Eq(repo).Index("Repo").
+				And("Key").Eq(prefix).
+				And("Version").Eq(version).
+				And("WriteIsolationKey").Eq(writeIsolationKey).
+				And("Complete").Eq(true).
+				SortBy("CreatedAt").Reverse()); err == nil || !errors.Is(err, bolthold.ErrNotFound) {
+			if err != nil {
+				return nil, fmt.Errorf("find cache entry equal to %s: %w", prefix, err)
+			}
+			return cache, nil
+		}
+		prefixPattern := fmt.Sprintf("^%s", regexp.QuoteMeta(prefix))
+		re, err := regexp.Compile(prefixPattern)
+		if err != nil {
+			continue
+		}
+		if err := db.FindOne(cache,
+			bolthold.Where("Repo").Eq(repo).Index("Repo").
+				And("Key").RegExp(re).
+				And("Version").Eq(version).
+				And("WriteIsolationKey").Eq(writeIsolationKey).
+				And("Complete").Eq(true).
+				SortBy("CreatedAt").Reverse()); err != nil {
+			if errors.Is(err, bolthold.ErrNotFound) {
+				continue
+			}
+			return nil, fmt.Errorf("find cache entry starting with %s: %w", prefix, err)
+		}
+		return cache, nil
+	}
+	return nil, nil
+}
+
+func insertCache(db *bolthold.Store, cache *Cache) error {
+	if err := db.Insert(bolthold.NextSequence(), cache); err != nil {
+		return fmt.Errorf("insert cache: %w", err)
+	}
+	// write back id to db
+	if err := db.Update(cache.ID, cache); err != nil {
+		return fmt.Errorf("write back id to db: %w", err)
+	}
+	return nil
+}
+
+func (c *cachesImpl) readCache(id uint64, repo string) (*Cache, error) {
+	db := c.getDB()
+	cache := &Cache{}
+	if err := db.Get(id, cache); err != nil {
+		return nil, fmt.Errorf("readCache: Get(%v): %w", id, err)
+	}
+	if cache.Repo != repo {
+		return nil, fmt.Errorf("readCache: Get(%v): cache.Repo %s != repo %s", id, cache.Repo, repo)
+	}
+
+	return cache, nil
+}
+
+func (c *cachesImpl) useCache(id uint64) error {
+	db := c.getDB()
+	cache := &Cache{}
+	if err := db.Get(id, cache); err != nil {
+		return fmt.Errorf("useCache: Get(%v): %w", id, err)
+	}
+	cache.UsedAt = time.Now().Unix()
+	if err := db.Update(cache.ID, cache); err != nil {
+		return fmt.Errorf("useCache: Update(%v): %v", cache.ID, err)
+	}
+	return nil
+}
+
+func (c *cachesImpl) serve(w http.ResponseWriter, r *http.Request, id uint64) {
+	c.storage.Serve(w, r, id)
+}
+
+func (c *cachesImpl) commit(id uint64, size int64) (int64, error) {
+	return c.storage.Commit(id, size)
+}
+
+func (c *cachesImpl) exist(id uint64) (bool, error) {
+	return c.storage.Exist(id)
+}
+
+func (c *cachesImpl) write(id, offset uint64, reader io.Reader) error {
+	return c.storage.Write(id, offset, reader)
+}
+
+const (
+	keepUsed   = 30 * 24 * time.Hour
+	keepUnused = 7 * 24 * time.Hour
+	keepTemp   = 5 * time.Minute
+	keepOld    = 5 * time.Minute
+)
+
+func (c *cachesImpl) setgcAt(at time.Time) {
+	c.gcAt = at
+}
+
+func (c *cachesImpl) gcCache() {
+	if c.gcing.Load() {
+		return
+	}
+	if !c.gcing.CompareAndSwap(false, true) {
+		return
+	}
+	defer c.gcing.Store(false)
+
+	if time.Since(c.gcAt) < time.Hour {
+		c.logger.Debugf("skip gc: %v", c.gcAt.String())
+		return
+	}
+	c.gcAt = time.Now()
+	c.logger.Debugf("gc: %v", c.gcAt.String())
+
+	db := c.getDB()
+
+	// Remove the caches which are not completed for a while, they are most likely to be broken.
+	var caches []*Cache
+	if err := db.Find(&caches, bolthold.
+		Where("UsedAt").Lt(time.Now().Add(-keepTemp).Unix()).
+		And("Complete").Eq(false),
+	); err != nil {
+		fatal(c.logger, fmt.Errorf("gc caches not completed: %v", err))
+	} else {
+		for _, cache := range caches {
+			c.storage.Remove(cache.ID)
+			if err := db.Delete(cache.ID, cache); err != nil {
+				c.logger.Errorf("delete cache: %v", err)
+				continue
+			}
+			c.logger.Infof("deleted cache: %+v", cache)
+		}
+	}
+
+	// Remove the old caches which have not been used recently.
+	caches = caches[:0]
+	if err := db.Find(&caches, bolthold.
+		Where("UsedAt").Lt(time.Now().Add(-keepUnused).Unix()),
+	); err != nil {
+		fatal(c.logger, fmt.Errorf("gc caches old not used: %v", err))
+	} else {
+		for _, cache := range caches {
+			c.storage.Remove(cache.ID)
+			if err := db.Delete(cache.ID, cache); err != nil {
+				c.logger.Warnf("delete cache: %v", err)
+				continue
+			}
+			c.logger.Infof("deleted cache: %+v", cache)
+		}
+	}
+
+	// Remove the old caches which are too old.
+	caches = caches[:0]
+	if err := db.Find(&caches, bolthold.
+		Where("CreatedAt").Lt(time.Now().Add(-keepUsed).Unix()),
+	); err != nil {
+		fatal(c.logger, fmt.Errorf("gc caches too old: %v", err))
+	} else {
+		for _, cache := range caches {
+			c.storage.Remove(cache.ID)
+			if err := db.Delete(cache.ID, cache); err != nil {
+				c.logger.Warnf("delete cache: %v", err)
+				continue
+			}
+			c.logger.Infof("deleted cache: %+v", cache)
+		}
+	}
+
+	// Remove the old caches with the same key and version, keep the latest one.
+	// Also keep the olds which have been used recently for a while in case of the cache is still in use.
+	if results, err := db.FindAggregate(
+		&Cache{},
+		bolthold.Where("Complete").Eq(true),
+		"Key", "Version",
+	); err != nil {
+		fatal(c.logger, fmt.Errorf("gc aggregate caches: %v", err))
+	} else {
+		for _, result := range results {
+			if result.Count() <= 1 {
+				continue
+			}
+			result.Sort("CreatedAt")
+			caches = caches[:0]
+			result.Reduction(&caches)
+			for _, cache := range caches[:len(caches)-1] {
+				if time.Since(time.Unix(cache.UsedAt, 0)) < keepOld {
+					// Keep it since it has been used recently, even if it's old.
+					// Or it could break downloading in process.
+					continue
+				}
+				c.storage.Remove(cache.ID)
+				if err := db.Delete(cache.ID, cache); err != nil {
+					c.logger.Warnf("delete cache: %v", err)
+					continue
+				}
+				c.logger.Infof("deleted cache: %+v", cache)
+			}
+		}
+	}
+}

act/artifactcache/caches_test.go

@@ -0,0 +1,53 @@
+package artifactcache
+
+import (
+	"testing"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"github.com/timshannon/bolthold"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCacheReadWrite(t *testing.T) {
+	caches, err := newCaches(t.TempDir(), "secret", logrus.New())
+	require.NoError(t, err)
+	defer caches.close()
+	t.Run("NotFound", func(t *testing.T) {
+		found, err := caches.readCache(456, "repo")
+		assert.Nil(t, found)
+		assert.ErrorIs(t, err, bolthold.ErrNotFound)
+	})
+
+	repo := "repository"
+	cache := &Cache{
+		Repo:    repo,
+		Key:     "key",
+		Version: "version",
+		Size:    444,
+	}
+	now := time.Now().Unix()
+	cache.CreatedAt = now
+	cache.UsedAt = now
+	cache.Repo = repo
+
+	t.Run("Insert", func(t *testing.T) {
+		db := caches.getDB()
+		assert.NoError(t, insertCache(db, cache))
+	})
+
+	t.Run("Found", func(t *testing.T) {
+		found, err := caches.readCache(cache.ID, cache.Repo)
+		require.NoError(t, err)
+		assert.Equal(t, cache.ID, found.ID)
+	})
+
+	t.Run("InvalidRepo", func(t *testing.T) {
+		invalidRepo := "INVALID REPO"
+		found, err := caches.readCache(cache.ID, invalidRepo)
+		assert.Nil(t, found)
+		assert.ErrorContains(t, err, invalidRepo)
+	})
+}

act/artifactcache/handler.go

@@ -7,46 +7,56 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"os"
-	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"
-	"sync/atomic"
 	"time"
 
 	"github.com/julienschmidt/httprouter"
 	"github.com/sirupsen/logrus"
 	"github.com/timshannon/bolthold"
-	"go.etcd.io/bbolt"
 
-	"code.forgejo.org/forgejo/runner/v9/act/cacheproxy"
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 const (
 	urlBase = "/_apis/artifactcache"
 )
 
-type Handler struct {
-	dir      string
-	storage  *Storage
+var fatal = func(logger logrus.FieldLogger, err error) {
+	logger.Errorf("unrecoverable error in the cache: %v", err)
+	if err := suicide(); err != nil {
+		logger.Errorf("unrecoverable error in the cache: failed to send the TERM signal to shutdown the daemon %v", err)
+	}
+}
+
+type Handler interface {
+	ExternalURL() string
+	Close() error
+	isClosed() bool
+	getCaches() caches
+	setCaches(caches caches)
+	find(w http.ResponseWriter, r *http.Request, params httprouter.Params)
+	reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params)
+	upload(w http.ResponseWriter, r *http.Request, params httprouter.Params)
+	commit(w http.ResponseWriter, r *http.Request, params httprouter.Params)
+	get(w http.ResponseWriter, r *http.Request, params httprouter.Params)
+	clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params)
+	middleware(handler httprouter.Handle) httprouter.Handle
+	responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any)
+}
+
+type handler struct {
+	caches   caches
 	router   *httprouter.Router
 	listener net.Listener
 	server   *http.Server
 	logger   logrus.FieldLogger
-	secret   string
-
-	gcing atomic.Bool
-	gcAt  time.Time
 
 	outboundIP string
 }
 
-func StartHandler(dir, outboundIP string, port uint16, secret string, logger logrus.FieldLogger) (*Handler, error) {
-	h := &Handler{
-		secret: secret,
-	}
+func StartHandler(dir, outboundIP string, port uint16, secret string, logger logrus.FieldLogger) (Handler, error) {
+	h := &handler{}
 
 	if logger == nil {
 		discard := logrus.New()
@@ -56,24 +66,11 @@ func StartHandler(dir, outboundIP string, port uint16, secret string, logger log
 	logger = logger.WithField("module", "artifactcache")
 	h.logger = logger
 
-	if dir == "" {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return nil, err
-		}
-		dir = filepath.Join(home, ".cache", "actcache")
-	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return nil, err
-	}
-
-	h.dir = dir
-
-	storage, err := NewStorage(filepath.Join(dir, "cache"))
+	caches, err := newCaches(dir, secret, logger)
 	if err != nil {
 		return nil, err
 	}
-	h.storage = storage
+	h.caches = caches
 
 	if outboundIP != "" {
 		h.outboundIP = outboundIP
@@ -93,8 +90,6 @@ func StartHandler(dir, outboundIP string, port uint16, secret string, logger log
 
 	h.router = router
 
-	h.gcCache()
-
 	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port)) // listen on all interfaces
 	if err != nil {
 		return nil, err
@@ -114,18 +109,22 @@ func StartHandler(dir, outboundIP string, port uint16, secret string, logger log
 	return h, nil
 }
 
-func (h *Handler) ExternalURL() string {
+func (h *handler) ExternalURL() string {
 	port := strconv.Itoa(h.listener.Addr().(*net.TCPAddr).Port)
 
 	// TODO: make the external url configurable if necessary
 	return fmt.Sprintf("http://%s", net.JoinHostPort(h.outboundIP, port))
 }
 
-func (h *Handler) Close() error {
+func (h *handler) Close() error {
 	if h == nil {
 		return nil
 	}
 	var retErr error
+	if h.caches != nil {
+		h.caches.close()
+		h.caches = nil
+	}
 	if h.server != nil {
 		err := h.server.Close()
 		if err != nil {
@@ -146,22 +145,25 @@ func (h *Handler) Close() error {
 	return retErr
 }
 
-func (h *Handler) openDB() (*bolthold.Store, error) {
-	return bolthold.Open(filepath.Join(h.dir, "bolt.db"), 0o644, &bolthold.Options{
-		Encoder: json.Marshal,
-		Decoder: json.Unmarshal,
-		Options: &bbolt.Options{
-			Timeout:      5 * time.Second,
-			NoGrowSync:   bbolt.DefaultOptions.NoGrowSync,
-			FreelistType: bbolt.DefaultOptions.FreelistType,
-		},
-	})
+func (h *handler) isClosed() bool {
+	return h.listener == nil && h.server == nil
+}
+
+func (h *handler) getCaches() caches {
+	return h.caches
+}
+
+func (h *handler) setCaches(caches caches) {
+	if h.caches != nil {
+		h.caches.close()
+	}
+	h.caches = caches
 }
 
 // GET /_apis/artifactcache/cache
-func (h *Handler) find(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
+func (h *handler) find(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
 	rundata := runDataFromHeaders(r)
-	repo, err := h.validateMac(rundata)
+	repo, err := h.caches.validateMac(rundata)
 	if err != nil {
 		h.responseJSON(w, r, 403, err)
 		return
@@ -174,16 +176,11 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request, params httprouter
 	}
 	version := r.URL.Query().Get("version")
 
-	db, err := h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
+	db := h.caches.getDB()
 
-	cache, err := findCache(db, repo, keys, version)
+	cache, err := findCacheWithIsolationKeyFallback(db, repo, keys, version, rundata.WriteIsolationKey)
 	if err != nil {
-		h.responseJSON(w, r, 500, err)
+		h.responseFatalJSON(w, r, err)
 		return
 	}
 	if cache == nil {
@@ -191,7 +188,7 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request, params httprouter
 		return
 	}
 
-	if ok, err := h.storage.Exist(cache.ID); err != nil {
+	if ok, err := h.caches.exist(cache.ID); err != nil {
 		h.responseJSON(w, r, 500, err)
 		return
 	} else if !ok {
@@ -208,9 +205,9 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request, params httprouter
 }
 
 // POST /_apis/artifactcache/caches
-func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
+func (h *handler) reserve(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
 	rundata := runDataFromHeaders(r)
-	repo, err := h.validateMac(rundata)
+	repo, err := h.caches.validateMac(rundata)
 	if err != nil {
 		h.responseJSON(w, r, 403, err)
 		return
@@ -225,17 +222,13 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, params httprou
 	api.Key = strings.ToLower(api.Key)
 
 	cache := api.ToCache()
-	db, err := h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
+	db := h.caches.getDB()
 
 	now := time.Now().Unix()
 	cache.CreatedAt = now
 	cache.UsedAt = now
 	cache.Repo = repo
+	cache.WriteIsolationKey = rundata.WriteIsolationKey
 	if err := insertCache(db, cache); err != nil {
 		h.responseJSON(w, r, 500, err)
 		return
@@ -246,9 +239,9 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, params httprou
 }
 
 // PATCH /_apis/artifactcache/caches/:id
-func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
+func (h *handler) upload(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
 	rundata := runDataFromHeaders(r)
-	repo, err := h.validateMac(rundata)
+	repo, err := h.caches.validateMac(rundata)
 	if err != nil {
 		h.responseJSON(w, r, 403, err)
 		return
@@ -260,19 +253,18 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprout
 		return
 	}
 
-	cache, err := h.readCache(id)
+	cache, err := h.caches.readCache(id, repo)
 	if err != nil {
 		if errors.Is(err, bolthold.ErrNotFound) {
 			h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id))
 			return
 		}
-		h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err))
+		h.responseFatalJSON(w, r, fmt.Errorf("cache Get: %w", err))
 		return
 	}
 
-	// Should not happen
-	if cache.Repo != repo {
-		h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid"))
+	if cache.WriteIsolationKey != rundata.WriteIsolationKey {
+		h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey))
 		return
 	}
 
@@ -285,11 +277,11 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprout
 		h.responseJSON(w, r, 400, fmt.Errorf("cache parseContentRange(%s): %w", r.Header.Get("Content-Range"), err))
 		return
 	}
-	if err := h.storage.Write(cache.ID, start, r.Body); err != nil {
+	if err := h.caches.write(cache.ID, start, r.Body); err != nil {
 		h.responseJSON(w, r, 500, fmt.Errorf("cache storage.Write: %w", err))
 		return
 	}
-	if err := h.useCache(id); err != nil {
+	if err := h.caches.useCache(id); err != nil {
 		h.responseJSON(w, r, 500, fmt.Errorf("cache useCache: %w", err))
 		return
 	}
@@ -297,9 +289,9 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request, params httprout
 }
 
 // POST /_apis/artifactcache/caches/:id
-func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
+func (h *handler) commit(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
 	rundata := runDataFromHeaders(r)
-	repo, err := h.validateMac(rundata)
+	repo, err := h.caches.validateMac(rundata)
 	if err != nil {
 		h.responseJSON(w, r, 403, err)
 		return
@@ -311,19 +303,18 @@ func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprout
 		return
 	}
 
-	cache, err := h.readCache(id)
+	cache, err := h.caches.readCache(id, repo)
 	if err != nil {
 		if errors.Is(err, bolthold.ErrNotFound) {
 			h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id))
 			return
 		}
-		h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err))
+		h.responseFatalJSON(w, r, fmt.Errorf("cache Get: %w", err))
 		return
 	}
 
-	// Should not happen
-	if cache.Repo != repo {
-		h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid"))
+	if cache.WriteIsolationKey != rundata.WriteIsolationKey {
+		h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey))
 		return
 	}
 
@@ -332,20 +323,15 @@ func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprout
 		return
 	}
 
-	size, err := h.storage.Commit(cache.ID, cache.Size)
+	size, err := h.caches.commit(cache.ID, cache.Size)
 	if err != nil {
-		h.responseJSON(w, r, 500, err)
+		h.responseJSON(w, r, 500, fmt.Errorf("commit(%v): %w", cache.ID, err))
 		return
 	}
 	// write real size back to cache, it may be different from the current value when the request doesn't specify it.
 	cache.Size = size
 
-	db, err := h.openDB()
-	if err != nil {
-		h.responseJSON(w, r, 500, err)
-		return
-	}
-	defer db.Close()
+	db := h.caches.getDB()
 
 	cache.Complete = true
 	if err := db.Update(cache.ID, cache); err != nil {
@@ -357,9 +343,9 @@ func (h *Handler) commit(w http.ResponseWriter, r *http.Request, params httprout
 }
 
 // GET /_apis/artifactcache/artifacts/:id
-func (h *Handler) get(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
+func (h *handler) get(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
 	rundata := runDataFromHeaders(r)
-	repo, err := h.validateMac(rundata)
+	repo, err := h.caches.validateMac(rundata)
 	if err != nil {
 		h.responseJSON(w, r, 403, err)
 		return
@@ -371,33 +357,33 @@ func (h *Handler) get(w http.ResponseWriter, r *http.Request, params httprouter.
 		return
 	}
 
-	cache, err := h.readCache(id)
+	cache, err := h.caches.readCache(id, repo)
 	if err != nil {
 		if errors.Is(err, bolthold.ErrNotFound) {
 			h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id))
 			return
 		}
-		h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err))
+		h.responseFatalJSON(w, r, fmt.Errorf("cache Get: %w", err))
 		return
 	}
 
-	// Should not happen
-	if cache.Repo != repo {
-		h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid"))
+	// reads permitted against caches w/ the same isolation key, or no isolation key
+	if cache.WriteIsolationKey != rundata.WriteIsolationKey && cache.WriteIsolationKey != "" {
+		h.responseJSON(w, r, 403, fmt.Errorf("cache authorized for write isolation %q, but attempting to operate on %q", rundata.WriteIsolationKey, cache.WriteIsolationKey))
 		return
 	}
 
-	if err := h.useCache(id); err != nil {
+	if err := h.caches.useCache(id); err != nil {
 		h.responseJSON(w, r, 500, fmt.Errorf("cache useCache: %w", err))
 		return
 	}
-	h.storage.Serve(w, r, id)
+	h.caches.serve(w, r, id)
 }
 
 // POST /_apis/artifactcache/clean
-func (h *Handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+func (h *handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 	rundata := runDataFromHeaders(r)
-	_, err := h.validateMac(rundata)
+	_, err := h.caches.validateMac(rundata)
 	if err != nil {
 		h.responseJSON(w, r, 403, err)
 		return
@@ -408,204 +394,20 @@ func (h *Handler) clean(w http.ResponseWriter, r *http.Request, _ httprouter.Par
 	h.responseJSON(w, r, 200)
 }
 
-func (h *Handler) middleware(handler httprouter.Handle) httprouter.Handle {
+func (h *handler) middleware(handler httprouter.Handle) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
 		h.logger.Debugf("%s %s", r.Method, r.RequestURI)
 		handler(w, r, params)
-		go h.gcCache()
+		go h.caches.gcCache()
 	}
 }
 
-// if not found, return (nil, nil) instead of an error.
-func findCache(db *bolthold.Store, repo string, keys []string, version string) (*Cache, error) {
-	cache := &Cache{}
-	for _, prefix := range keys {
-		// if a key in the list matches exactly, don't return partial matches
-		if err := db.FindOne(cache,
-			bolthold.Where("Repo").Eq(repo).Index("Repo").
-				And("Key").Eq(prefix).
-				And("Version").Eq(version).
-				And("Complete").Eq(true).
-				SortBy("CreatedAt").Reverse()); err == nil || !errors.Is(err, bolthold.ErrNotFound) {
-			if err != nil {
-				return nil, fmt.Errorf("find cache: %w", err)
-			}
-			return cache, nil
-		}
-		prefixPattern := fmt.Sprintf("^%s", regexp.QuoteMeta(prefix))
-		re, err := regexp.Compile(prefixPattern)
-		if err != nil {
-			continue
-		}
-		if err := db.FindOne(cache,
-			bolthold.Where("Repo").Eq(repo).Index("Repo").
-				And("Key").RegExp(re).
-				And("Version").Eq(version).
-				And("Complete").Eq(true).
-				SortBy("CreatedAt").Reverse()); err != nil {
-			if errors.Is(err, bolthold.ErrNotFound) {
-				continue
-			}
-			return nil, fmt.Errorf("find cache: %w", err)
-		}
-		return cache, nil
-	}
-	return nil, nil
+func (h *handler) responseFatalJSON(w http.ResponseWriter, r *http.Request, err error) {
+	h.responseJSON(w, r, 500, err)
+	fatal(h.logger, err)
 }
 
-func insertCache(db *bolthold.Store, cache *Cache) error {
-	if err := db.Insert(bolthold.NextSequence(), cache); err != nil {
-		return fmt.Errorf("insert cache: %w", err)
-	}
-	// write back id to db
-	if err := db.Update(cache.ID, cache); err != nil {
-		return fmt.Errorf("write back id to db: %w", err)
-	}
-	return nil
-}
-
-func (h *Handler) readCache(id uint64) (*Cache, error) {
-	db, err := h.openDB()
-	if err != nil {
-		return nil, err
-	}
-	defer db.Close()
-	cache := &Cache{}
-	if err := db.Get(id, cache); err != nil {
-		return nil, err
-	}
-	return cache, nil
-}
-
-func (h *Handler) useCache(id uint64) error {
-	db, err := h.openDB()
-	if err != nil {
-		return err
-	}
-	defer db.Close()
-	cache := &Cache{}
-	if err := db.Get(id, cache); err != nil {
-		return err
-	}
-	cache.UsedAt = time.Now().Unix()
-	return db.Update(cache.ID, cache)
-}
-
-const (
-	keepUsed   = 30 * 24 * time.Hour
-	keepUnused = 7 * 24 * time.Hour
-	keepTemp   = 5 * time.Minute
-	keepOld    = 5 * time.Minute
-)
-
-func (h *Handler) gcCache() {
-	if h.gcing.Load() {
-		return
-	}
-	if !h.gcing.CompareAndSwap(false, true) {
-		return
-	}
-	defer h.gcing.Store(false)
-
-	if time.Since(h.gcAt) < time.Hour {
-		h.logger.Debugf("skip gc: %v", h.gcAt.String())
-		return
-	}
-	h.gcAt = time.Now()
-	h.logger.Debugf("gc: %v", h.gcAt.String())
-
-	db, err := h.openDB()
-	if err != nil {
-		return
-	}
-	defer db.Close()
-
-	// Remove the caches which are not completed for a while, they are most likely to be broken.
-	var caches []*Cache
-	if err := db.Find(&caches, bolthold.
-		Where("UsedAt").Lt(time.Now().Add(-keepTemp).Unix()).
-		And("Complete").Eq(false),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
-	}
-
-	// Remove the old caches which have not been used recently.
-	caches = caches[:0]
-	if err := db.Find(&caches, bolthold.
-		Where("UsedAt").Lt(time.Now().Add(-keepUnused).Unix()),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
-	}
-
-	// Remove the old caches which are too old.
-	caches = caches[:0]
-	if err := db.Find(&caches, bolthold.
-		Where("CreatedAt").Lt(time.Now().Add(-keepUsed).Unix()),
-	); err != nil {
-		h.logger.Warnf("find caches: %v", err)
-	} else {
-		for _, cache := range caches {
-			h.storage.Remove(cache.ID)
-			if err := db.Delete(cache.ID, cache); err != nil {
-				h.logger.Warnf("delete cache: %v", err)
-				continue
-			}
-			h.logger.Infof("deleted cache: %+v", cache)
-		}
-	}
-
-	// Remove the old caches with the same key and version, keep the latest one.
-	// Also keep the olds which have been used recently for a while in case of the cache is still in use.
-	if results, err := db.FindAggregate(
-		&Cache{},
-		bolthold.Where("Complete").Eq(true),
-		"Key", "Version",
-	); err != nil {
-		h.logger.Warnf("find aggregate caches: %v", err)
-	} else {
-		for _, result := range results {
-			if result.Count() <= 1 {
-				continue
-			}
-			result.Sort("CreatedAt")
-			caches = caches[:0]
-			result.Reduction(&caches)
-			for _, cache := range caches[:len(caches)-1] {
-				if time.Since(time.Unix(cache.UsedAt, 0)) < keepOld {
-					// Keep it since it has been used recently, even if it's old.
-					// Or it could break downloading in process.
-					continue
-				}
-				h.storage.Remove(cache.ID)
-				if err := db.Delete(cache.ID, cache); err != nil {
-					h.logger.Warnf("delete cache: %v", err)
-					continue
-				}
-				h.logger.Infof("deleted cache: %+v", cache)
-			}
-		}
-	}
-}
-
-func (h *Handler) responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) {
+func (h *handler) responseJSON(w http.ResponseWriter, r *http.Request, code int, v ...any) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	var data []byte
 	if len(v) == 0 || v[0] == nil {
@@ -638,11 +440,20 @@ func parseContentRange(s string) (uint64, uint64, error) {
 	return start, stop, nil
 }
 
-func runDataFromHeaders(r *http.Request) cacheproxy.RunData {
-	return cacheproxy.RunData{
+type RunData struct {
+	RepositoryFullName string
+	RunNumber          string
+	Timestamp          string
+	RepositoryMAC      string
+	WriteIsolationKey  string
+}
+
+func runDataFromHeaders(r *http.Request) RunData {
+	return RunData{
 		RepositoryFullName: r.Header.Get("Forgejo-Cache-Repo"),
 		RunNumber:          r.Header.Get("Forgejo-Cache-RunNumber"),
 		Timestamp:          r.Header.Get("Forgejo-Cache-Timestamp"),
 		RepositoryMAC:      r.Header.Get("Forgejo-Cache-MAC"),
+		WriteIsolationKey:  r.Header.Get("Forgejo-Cache-WriteIsolationKey"),
 	}
 }

act/artifactcache/handler_test.go

@@ -4,48 +4,71 @@ import (
 	"bytes"
 	"crypto/rand"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/signal"
 	"path/filepath"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"code.forgejo.org/forgejo/runner/v11/testutils"
+	"github.com/julienschmidt/httprouter"
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/mock"
 	"github.com/timshannon/bolthold"
 	"go.etcd.io/bbolt"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 const (
 	cacheRepo      = "testuser/repo"
 	cacheRunnum    = "1"
 	cacheTimestamp = "0"
-	cacheMac       = "c13854dd1ac599d1d61680cd93c26b77ba0ee10f374a3408bcaea82f38ca1865"
+	cacheMac       = "bc2e9167f9e310baebcead390937264e4c0b21d2fdd49f5b9470d54406099360"
 )
 
 var handlerExternalURL string
 
 type AuthHeaderTransport struct {
-	T http.RoundTripper
+	T                  http.RoundTripper
+	WriteIsolationKey  string
+	OverrideDefaultMac string
 }
 
 func (t *AuthHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req.Header.Set("Forgejo-Cache-Repo", cacheRepo)
 	req.Header.Set("Forgejo-Cache-RunNumber", cacheRunnum)
 	req.Header.Set("Forgejo-Cache-Timestamp", cacheTimestamp)
-	req.Header.Set("Forgejo-Cache-MAC", cacheMac)
+	if t.OverrideDefaultMac != "" {
+		req.Header.Set("Forgejo-Cache-MAC", t.OverrideDefaultMac)
+	} else {
+		req.Header.Set("Forgejo-Cache-MAC", cacheMac)
+	}
 	req.Header.Set("Forgejo-Cache-Host", handlerExternalURL)
+	if t.WriteIsolationKey != "" {
+		req.Header.Set("Forgejo-Cache-WriteIsolationKey", t.WriteIsolationKey)
+	}
 	return t.T.RoundTrip(req)
 }
 
 var (
-	httpClientTransport = AuthHeaderTransport{http.DefaultTransport}
+	httpClientTransport = AuthHeaderTransport{T: http.DefaultTransport}
 	httpClient          = http.Client{Transport: &httpClientTransport}
 )
 
 func TestHandler(t *testing.T) {
+	defer testutils.MockVariable(&fatal, func(_ logrus.FieldLogger, err error) {
+		t.Fatalf("unexpected call to fatal(%v)", err)
+	})()
+
 	dir := filepath.Join(t.TempDir(), "artifactcache")
 	handler, err := StartHandler(dir, "", 0, "secret", nil)
 	require.NoError(t, err)
@@ -54,10 +77,8 @@ func TestHandler(t *testing.T) {
 	base := fmt.Sprintf("%s%s", handler.ExternalURL(), urlBase)
 
 	defer func() {
-		t.Run("inpect db", func(t *testing.T) {
-			db, err := handler.openDB()
-			require.NoError(t, err)
-			defer db.Close()
+		t.Run("inspect db", func(t *testing.T) {
+			db := handler.getCaches().getDB()
 			require.NoError(t, db.Bolt().View(func(tx *bbolt.Tx) error {
 				return tx.Bucket([]byte("Cache")).ForEach(func(k, v []byte) error {
 					t.Logf("%s: %s", k, v)
@@ -67,8 +88,7 @@ func TestHandler(t *testing.T) {
 		})
 		t.Run("close", func(t *testing.T) {
 			require.NoError(t, handler.Close())
-			assert.Nil(t, handler.server)
-			assert.Nil(t, handler.listener)
+			assert.True(t, handler.isClosed())
 			_, err := httpClient.Post(fmt.Sprintf("%s/caches/%d", base, 1), "", nil)
 			assert.Error(t, err)
 		})
@@ -88,7 +108,7 @@ func TestHandler(t *testing.T) {
 		content := make([]byte, 100)
 		_, err := rand.Read(content)
 		require.NoError(t, err)
-		uploadCacheNormally(t, base, key, version, content)
+		uploadCacheNormally(t, base, key, version, "", content)
 	})
 
 	t.Run("clean", func(t *testing.T) {
@@ -380,7 +400,7 @@ func TestHandler(t *testing.T) {
 		_, err := rand.Read(content)
 		require.NoError(t, err)
 
-		uploadCacheNormally(t, base, key, version, content)
+		uploadCacheNormally(t, base, key, version, "", content)
 
 		// Perform the request with the custom `httpClient` which will send correct MAC data
 		resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
@@ -416,7 +436,7 @@ func TestHandler(t *testing.T) {
 		for i := range contents {
 			_, err := rand.Read(contents[i])
 			require.NoError(t, err)
-			uploadCacheNormally(t, base, keys[i], version, contents[i])
+			uploadCacheNormally(t, base, keys[i], version, "", contents[i])
 			time.Sleep(time.Second) // ensure CreatedAt of caches are different
 		}
 
@@ -454,13 +474,98 @@ func TestHandler(t *testing.T) {
 		assert.Equal(t, contents[except], content)
 	})
 
+	t.Run("find can't match without WriteIsolationKey match", func(t *testing.T) {
+		defer func() { httpClientTransport.WriteIsolationKey = "" }()
+
+		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
+		key := strings.ToLower(t.Name())
+
+		uploadCacheNormally(t, base, key, version, "TestWriteKey", make([]byte, 64))
+
+		func() {
+			defer overrideWriteIsolationKey("AnotherTestWriteKey")()
+			resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			require.NoError(t, err)
+			require.Equal(t, 204, resp.StatusCode)
+		}()
+
+		{
+			resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			require.NoError(t, err)
+			require.Equal(t, 204, resp.StatusCode)
+		}
+
+		func() {
+			defer overrideWriteIsolationKey("TestWriteKey")()
+			resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			require.NoError(t, err)
+			require.Equal(t, 200, resp.StatusCode)
+		}()
+	})
+
+	t.Run("find prefers WriteIsolationKey match", func(t *testing.T) {
+		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21"
+		key := strings.ToLower(t.Name())
+
+		// Between two values with the same `key`...
+		uploadCacheNormally(t, base, key, version, "TestWriteKey", make([]byte, 64))
+		uploadCacheNormally(t, base, key, version, "", make([]byte, 128))
+
+		// We should read the value with the matching WriteIsolationKey from the cache...
+		func() {
+			defer overrideWriteIsolationKey("TestWriteKey")()
+
+			resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			require.NoError(t, err)
+			require.Equal(t, 200, resp.StatusCode)
+
+			got := struct {
+				ArchiveLocation string `json:"archiveLocation"`
+			}{}
+			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
+			contentResp, err := httpClient.Get(got.ArchiveLocation)
+			require.NoError(t, err)
+			require.Equal(t, 200, contentResp.StatusCode)
+			content, err := io.ReadAll(contentResp.Body)
+			require.NoError(t, err)
+			// Which we finally check matches the correct WriteIsolationKey's content here.
+			assert.Equal(t, make([]byte, 64), content)
+		}()
+	})
+
+	t.Run("find falls back if matching WriteIsolationKey not available", func(t *testing.T) {
+		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21"
+		key := strings.ToLower(t.Name())
+
+		uploadCacheNormally(t, base, key, version, "", make([]byte, 128))
+
+		func() {
+			defer overrideWriteIsolationKey("TestWriteKey")()
+
+			resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			require.NoError(t, err)
+			require.Equal(t, 200, resp.StatusCode)
+
+			got := struct {
+				ArchiveLocation string `json:"archiveLocation"`
+			}{}
+			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
+			contentResp, err := httpClient.Get(got.ArchiveLocation)
+			require.NoError(t, err)
+			require.Equal(t, 200, contentResp.StatusCode)
+			content, err := io.ReadAll(contentResp.Body)
+			require.NoError(t, err)
+			assert.Equal(t, make([]byte, 128), content)
+		}()
+	})
+
 	t.Run("case insensitive", func(t *testing.T) {
 		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
 		key := strings.ToLower(t.Name())
 		content := make([]byte, 100)
 		_, err := rand.Read(content)
 		require.NoError(t, err)
-		uploadCacheNormally(t, base, key+"_ABC", version, content)
+		uploadCacheNormally(t, base, key+"_ABC", version, "", content)
 
 		{
 			reqKey := key + "_aBc"
@@ -494,7 +599,7 @@ func TestHandler(t *testing.T) {
 		for i := range contents {
 			_, err := rand.Read(contents[i])
 			require.NoError(t, err)
-			uploadCacheNormally(t, base, keys[i], version, contents[i])
+			uploadCacheNormally(t, base, keys[i], version, "", contents[i])
 			time.Sleep(time.Second) // ensure CreatedAt of caches are different
 		}
 
@@ -545,7 +650,7 @@ func TestHandler(t *testing.T) {
 		for i := range contents {
 			_, err := rand.Read(contents[i])
 			require.NoError(t, err)
-			uploadCacheNormally(t, base, keys[i], version, contents[i])
+			uploadCacheNormally(t, base, keys[i], version, "", contents[i])
 			time.Sleep(time.Second) // ensure CreatedAt of caches are different
 		}
 
@@ -581,9 +686,166 @@ func TestHandler(t *testing.T) {
 		require.NoError(t, err)
 		assert.Equal(t, contents[expect], content)
 	})
+
+	t.Run("upload across WriteIsolationKey", func(t *testing.T) {
+		defer overrideWriteIsolationKey("CorrectKey")()
+
+		key := strings.ToLower(t.Name())
+		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
+		content := make([]byte, 256)
+
+		var id uint64
+		// reserve
+		{
+			body, err := json.Marshal(&Request{
+				Key:     key,
+				Version: version,
+				Size:    int64(len(content)),
+			})
+			require.NoError(t, err)
+			resp, err := httpClient.Post(fmt.Sprintf("%s/caches", base), "application/json", bytes.NewReader(body))
+			require.NoError(t, err)
+			assert.Equal(t, 200, resp.StatusCode)
+
+			got := struct {
+				CacheID uint64 `json:"cacheId"`
+			}{}
+			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
+			id = got.CacheID
+		}
+		// upload, but with the incorrect write isolation key relative to the cache obj created
+		func() {
+			defer overrideWriteIsolationKey("WrongKey")()
+			req, err := http.NewRequest(http.MethodPatch,
+				fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader(content))
+			require.NoError(t, err)
+			req.Header.Set("Content-Type", "application/octet-stream")
+			req.Header.Set("Content-Range", "bytes 0-99/*")
+			resp, err := httpClient.Do(req)
+			require.NoError(t, err)
+			assert.Equal(t, 403, resp.StatusCode)
+		}()
+	})
+
+	t.Run("commit across WriteIsolationKey", func(t *testing.T) {
+		defer overrideWriteIsolationKey("CorrectKey")()
+
+		key := strings.ToLower(t.Name())
+		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
+		content := make([]byte, 256)
+
+		var id uint64
+		// reserve
+		{
+			body, err := json.Marshal(&Request{
+				Key:     key,
+				Version: version,
+				Size:    int64(len(content)),
+			})
+			require.NoError(t, err)
+			resp, err := httpClient.Post(fmt.Sprintf("%s/caches", base), "application/json", bytes.NewReader(body))
+			require.NoError(t, err)
+			assert.Equal(t, 200, resp.StatusCode)
+
+			got := struct {
+				CacheID uint64 `json:"cacheId"`
+			}{}
+			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
+			id = got.CacheID
+		}
+		// upload
+		{
+			req, err := http.NewRequest(http.MethodPatch,
+				fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader(content))
+			require.NoError(t, err)
+			req.Header.Set("Content-Type", "application/octet-stream")
+			req.Header.Set("Content-Range", "bytes 0-99/*")
+			resp, err := httpClient.Do(req)
+			require.NoError(t, err)
+			assert.Equal(t, 200, resp.StatusCode)
+		}
+		// commit, but with the incorrect write isolation key relative to the cache obj created
+		func() {
+			defer overrideWriteIsolationKey("WrongKey")()
+			resp, err := httpClient.Post(fmt.Sprintf("%s/caches/%d", base, id), "", nil)
+			require.NoError(t, err)
+			assert.Equal(t, 403, resp.StatusCode)
+		}()
+	})
+
+	t.Run("get across WriteIsolationKey", func(t *testing.T) {
+		defer func() { httpClientTransport.WriteIsolationKey = "" }()
+
+		version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d21"
+		key := strings.ToLower(t.Name())
+		uploadCacheNormally(t, base, key, version, "", make([]byte, 128))
+		keyIsolated := strings.ToLower(t.Name()) + "_isolated"
+		uploadCacheNormally(t, base, keyIsolated, version, "CorrectKey", make([]byte, 128))
+
+		// Perform the 'get' without the right WriteIsolationKey for the cache entry... should be OK for `key` since it
+		// was written with WriteIsolationKey "" meaning it is available for non-isolated access
+		func() {
+			defer overrideWriteIsolationKey("WhoopsWrongKey")()
+
+			resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, key, version))
+			require.NoError(t, err)
+			require.Equal(t, 200, resp.StatusCode)
+			got := struct {
+				ArchiveLocation string `json:"archiveLocation"`
+			}{}
+			require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
+
+			contentResp, err := httpClient.Get(got.ArchiveLocation)
+			require.NoError(t, err)
+			require.Equal(t, 200, contentResp.StatusCode)
+			httpClientTransport.WriteIsolationKey = "CorrectKey" // reset for next find
+		}()
+
+		// Perform the 'get' without the right WriteIsolationKey for the cache entry... should be 403 for `keyIsolated`
+		// because it was written with a different WriteIsolationKey.
+		{
+			got := func() struct {
+				ArchiveLocation string `json:"archiveLocation"`
+			} {
+				defer overrideWriteIsolationKey("CorrectKey")() // for test purposes make the `find` successful...
+				resp, err := httpClient.Get(fmt.Sprintf("%s/cache?keys=%s&version=%s", base, keyIsolated, version))
+				require.NoError(t, err)
+				require.Equal(t, 200, resp.StatusCode)
+				got := struct {
+					ArchiveLocation string `json:"archiveLocation"`
+				}{}
+				require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
+				return got
+			}()
+
+			func() {
+				defer overrideWriteIsolationKey("WhoopsWrongKey")() // but then access w/ the wrong key for `get`
+				contentResp, err := httpClient.Get(got.ArchiveLocation)
+				require.NoError(t, err)
+				require.Equal(t, 403, contentResp.StatusCode)
+			}()
+		}
+	})
 }
 
-func uploadCacheNormally(t *testing.T, base, key, version string, content []byte) {
+func overrideWriteIsolationKey(writeIsolationKey string) func() {
+	originalWriteIsolationKey := httpClientTransport.WriteIsolationKey
+	originalMac := httpClientTransport.OverrideDefaultMac
+
+	httpClientTransport.WriteIsolationKey = writeIsolationKey
+	httpClientTransport.OverrideDefaultMac = ComputeMac("secret", cacheRepo, cacheRunnum, cacheTimestamp, httpClientTransport.WriteIsolationKey)
+
+	return func() {
+		httpClientTransport.WriteIsolationKey = originalWriteIsolationKey
+		httpClientTransport.OverrideDefaultMac = originalMac
+	}
+}
+
+func uploadCacheNormally(t *testing.T, base, key, version, writeIsolationKey string, content []byte) {
+	if writeIsolationKey != "" {
+		defer overrideWriteIsolationKey(writeIsolationKey)()
+	}
+
 	var id uint64
 	{
 		body, err := json.Marshal(&Request{
@@ -642,6 +904,130 @@ func uploadCacheNormally(t *testing.T, base, key, version string, content []byte
 	}
 }
 
+func TestHandlerAPIFatalErrors(t *testing.T) {
+	for _, testCase := range []struct {
+		name    string
+		prepare func(message string) func()
+		caches  func(t *testing.T, message string) caches
+		call    func(t *testing.T, handler Handler, w http.ResponseWriter)
+	}{
+		{
+			name: "find",
+			prepare: func(message string) func() {
+				return testutils.MockVariable(&findCacheWithIsolationKeyFallback, func(db *bolthold.Store, repo string, keys []string, version, writeIsolationKey string) (*Cache, error) {
+					return nil, errors.New(message)
+				})
+			},
+			caches: func(t *testing.T, message string) caches {
+				caches, err := newCaches(t.TempDir(), "secret", logrus.New())
+				require.NoError(t, err)
+				return caches
+			},
+			call: func(t *testing.T, handler Handler, w http.ResponseWriter) {
+				keyOne := "ONE"
+				req, err := http.NewRequest("GET", fmt.Sprintf("http://example.com/cache?keys=%s", keyOne), nil)
+				require.NoError(t, err)
+				req.Header.Set("Forgejo-Cache-Repo", cacheRepo)
+				req.Header.Set("Forgejo-Cache-RunNumber", cacheRunnum)
+				req.Header.Set("Forgejo-Cache-Timestamp", cacheTimestamp)
+				req.Header.Set("Forgejo-Cache-MAC", cacheMac)
+				req.Header.Set("Forgejo-Cache-Host", "http://example.com")
+				handler.find(w, req, nil)
+			},
+		},
+		{
+			name: "upload",
+			caches: func(t *testing.T, message string) caches {
+				caches := newMockCaches(t)
+				caches.On("close").Return()
+				caches.On("validateMac", RunData{}).Return(cacheRepo, nil)
+				caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message))
+				return caches
+			},
+			call: func(t *testing.T, handler Handler, w http.ResponseWriter) {
+				id := 1234
+				req, err := http.NewRequest("PATCH", fmt.Sprintf("http://example.com/caches/%d", id), nil)
+				require.NoError(t, err)
+				handler.upload(w, req, httprouter.Params{
+					httprouter.Param{Key: "id", Value: fmt.Sprintf("%d", id)},
+				})
+			},
+		},
+		{
+			name: "commit",
+			caches: func(t *testing.T, message string) caches {
+				caches := newMockCaches(t)
+				caches.On("close").Return()
+				caches.On("validateMac", RunData{}).Return(cacheRepo, nil)
+				caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message))
+				return caches
+			},
+			call: func(t *testing.T, handler Handler, w http.ResponseWriter) {
+				id := 1234
+				req, err := http.NewRequest("POST", fmt.Sprintf("http://example.com/caches/%d", id), nil)
+				require.NoError(t, err)
+				handler.commit(w, req, httprouter.Params{
+					httprouter.Param{Key: "id", Value: fmt.Sprintf("%d", id)},
+				})
+			},
+		},
+		{
+			name: "get",
+			caches: func(t *testing.T, message string) caches {
+				caches := newMockCaches(t)
+				caches.On("close").Return()
+				caches.On("validateMac", RunData{}).Return(cacheRepo, nil)
+				caches.On("readCache", mock.Anything, mock.Anything).Return(nil, errors.New(message))
+				return caches
+			},
+			call: func(t *testing.T, handler Handler, w http.ResponseWriter) {
+				id := 1234
+				req, err := http.NewRequest("GET", fmt.Sprintf("http://example.com/artifacts/%d", id), nil)
+				require.NoError(t, err)
+				handler.get(w, req, httprouter.Params{
+					httprouter.Param{Key: "id", Value: fmt.Sprintf("%d", id)},
+				})
+			},
+		},
+		// it currently is a noop
+		//{
+		//name: "clean",
+		//}
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			message := "ERROR MESSAGE"
+			if testCase.prepare != nil {
+				defer testCase.prepare(message)()
+			}
+
+			fatalMessage := "<unset>"
+			defer testutils.MockVariable(&fatal, func(_ logrus.FieldLogger, err error) {
+				fatalMessage = err.Error()
+			})()
+
+			assertFatalMessage := func(t *testing.T, expected string) {
+				t.Helper()
+				assert.Contains(t, fatalMessage, expected)
+			}
+
+			dir := filepath.Join(t.TempDir(), "artifactcache")
+			handler, err := StartHandler(dir, "", 0, "secret", nil)
+			require.NoError(t, err)
+			defer handler.Close()
+
+			fatalMessage = "<unset>"
+
+			caches := testCase.caches(t, message) // doesn't need to be closed because it will be given to handler
+			handler.setCaches(caches)
+
+			w := httptest.NewRecorder()
+			testCase.call(t, handler, w)
+			require.Equal(t, 500, w.Code)
+			assertFatalMessage(t, message)
+		})
+	}
+}
+
 func TestHandler_gcCache(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
 	handler, err := StartHandler(dir, "", 0, "", nil)
@@ -725,18 +1111,15 @@ func TestHandler_gcCache(t *testing.T) {
 		},
 	}
 
-	db, err := handler.openDB()
-	require.NoError(t, err)
+	db := handler.getCaches().getDB()
 	for _, c := range cases {
 		require.NoError(t, insertCache(db, c.Cache))
 	}
-	require.NoError(t, db.Close())
 
-	handler.gcAt = time.Time{} // ensure gcCache will not skip
-	handler.gcCache()
+	handler.getCaches().setgcAt(time.Time{}) // ensure gcCache will not skip
+	handler.getCaches().gcCache()
 
-	db, err = handler.openDB()
-	require.NoError(t, err)
+	db = handler.getCaches().getDB()
 	for i, v := range cases {
 		t.Run(fmt.Sprintf("%d_%s", i, v.Cache.Key), func(t *testing.T) {
 			cache := &Cache{}
@@ -748,7 +1131,6 @@ func TestHandler_gcCache(t *testing.T) {
 			}
 		})
 	}
-	require.NoError(t, db.Close())
 }
 
 func TestHandler_ExternalURL(t *testing.T) {
@@ -759,8 +1141,7 @@ func TestHandler_ExternalURL(t *testing.T) {
 
 		assert.Equal(t, handler.ExternalURL(), "http://127.0.0.1:34567")
 		require.NoError(t, handler.Close())
-		assert.Nil(t, handler.server)
-		assert.Nil(t, handler.listener)
+		assert.True(t, handler.isClosed())
 	})
 
 	t.Run("reports correct URL on IPv6 zero host", func(t *testing.T) {
@@ -770,8 +1151,7 @@ func TestHandler_ExternalURL(t *testing.T) {
 
 		assert.Equal(t, handler.ExternalURL(), "http://[2001:db8::]:34567")
 		require.NoError(t, handler.Close())
-		assert.Nil(t, handler.server)
-		assert.Nil(t, handler.listener)
+		assert.True(t, handler.isClosed())
 	})
 
 	t.Run("reports correct URL on IPv6", func(t *testing.T) {
@@ -781,7 +1161,45 @@ func TestHandler_ExternalURL(t *testing.T) {
 
 		assert.Equal(t, handler.ExternalURL(), "http://[2001:db8::1:2:3:4]:34567")
 		require.NoError(t, handler.Close())
-		assert.Nil(t, handler.server)
-		assert.Nil(t, handler.listener)
+		assert.True(t, handler.isClosed())
 	})
 }
+
+var (
+	settleTime       = 100 * time.Millisecond
+	fatalWaitingTime = 30 * time.Second
+)
+
+func waitSig(t *testing.T, c <-chan os.Signal, sig os.Signal) {
+	t.Helper()
+
+	// Sleep multiple times to give the kernel more tries to
+	// deliver the signal.
+	start := time.Now()
+	timer := time.NewTimer(settleTime / 10)
+	defer timer.Stop()
+	for time.Since(start) < fatalWaitingTime {
+		select {
+		case s := <-c:
+			if s == sig {
+				return
+			}
+			t.Fatalf("signal was %v, want %v", s, sig)
+		case <-timer.C:
+			timer.Reset(settleTime / 10)
+		}
+	}
+	t.Fatalf("timeout after %v waiting for %v", fatalWaitingTime, sig)
+}
+
+func TestHandler_fatal(t *testing.T) {
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, syscall.SIGTERM)
+	defer signal.Stop(c)
+
+	discard := logrus.New()
+	discard.Out = io.Discard
+	fatal(discard, errors.New("fatal error"))
+
+	waitSig(t, c, syscall.SIGTERM)
+}

act/artifactcache/mac.go

@@ -10,19 +10,17 @@ import (
 	"errors"
 	"strconv"
 	"time"
-
-	"code.forgejo.org/forgejo/runner/v9/act/cacheproxy"
 )
 
 var ErrValidation = errors.New("validation error")
 
-func (h *Handler) validateMac(rundata cacheproxy.RunData) (string, error) {
+func (c *cachesImpl) validateMac(rundata RunData) (string, error) {
 	// TODO: allow configurable max age
 	if !validateAge(rundata.Timestamp) {
 		return "", ErrValidation
 	}
 
-	expectedMAC := computeMac(h.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp)
+	expectedMAC := ComputeMac(c.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp, rundata.WriteIsolationKey)
 	if hmac.Equal([]byte(expectedMAC), []byte(rundata.RepositoryMAC)) {
 		return rundata.RepositoryFullName, nil
 	}
@@ -40,12 +38,14 @@ func validateAge(ts string) bool {
 	return true
 }
 
-func computeMac(secret, repo, run, ts string) string {
+func ComputeMac(secret, repo, run, ts, writeIsolationKey string) string {
 	mac := hmac.New(sha256.New, []byte(secret))
 	mac.Write([]byte(repo))
 	mac.Write([]byte(">"))
 	mac.Write([]byte(run))
 	mac.Write([]byte(">"))
 	mac.Write([]byte(ts))
+	mac.Write([]byte(">"))
+	mac.Write([]byte(writeIsolationKey))
 	return hex.EncodeToString(mac.Sum(nil))
 }

act/artifactcache/mac_test.go

@@ -5,12 +5,11 @@ import (
 	"testing"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/cacheproxy"
 	"github.com/stretchr/testify/require"
 )
 
 func TestMac(t *testing.T) {
-	handler := &Handler{
+	cache := &cachesImpl{
 		secret: "secret for testing",
 	}
 
@@ -19,15 +18,15 @@ func TestMac(t *testing.T) {
 		run := "1"
 		ts := strconv.FormatInt(time.Now().Unix(), 10)
 
-		mac := computeMac(handler.secret, name, run, ts)
-		rundata := cacheproxy.RunData{
+		mac := ComputeMac(cache.secret, name, run, ts, "")
+		rundata := RunData{
 			RepositoryFullName: name,
 			RunNumber:          run,
 			Timestamp:          ts,
 			RepositoryMAC:      mac,
 		}
 
-		repoName, err := handler.validateMac(rundata)
+		repoName, err := cache.validateMac(rundata)
 		require.NoError(t, err)
 		require.Equal(t, name, repoName)
 	})
@@ -37,15 +36,15 @@ func TestMac(t *testing.T) {
 		run := "1"
 		ts := "9223372036854775807" // This should last us for a while...
 
-		mac := computeMac(handler.secret, name, run, ts)
-		rundata := cacheproxy.RunData{
+		mac := ComputeMac(cache.secret, name, run, ts, "")
+		rundata := RunData{
 			RepositoryFullName: name,
 			RunNumber:          run,
 			Timestamp:          ts,
 			RepositoryMAC:      mac,
 		}
 
-		_, err := handler.validateMac(rundata)
+		_, err := cache.validateMac(rundata)
 		require.Error(t, err)
 	})
 
@@ -54,14 +53,14 @@ func TestMac(t *testing.T) {
 		run := "1"
 		ts := strconv.FormatInt(time.Now().Unix(), 10)
 
-		rundata := cacheproxy.RunData{
+		rundata := RunData{
 			RepositoryFullName: name,
 			RunNumber:          run,
 			Timestamp:          ts,
 			RepositoryMAC:      "this is not the right mac :D",
 		}
 
-		repoName, err := handler.validateMac(rundata)
+		repoName, err := cache.validateMac(rundata)
 		require.Error(t, err)
 		require.Equal(t, "", repoName)
 	})
@@ -72,9 +71,12 @@ func TestMac(t *testing.T) {
 		run := "42"
 		ts := "1337"
 
-		mac := computeMac(secret, name, run, ts)
-		expectedMac := "f666f06f917acb7186e152195b2a8c8d36d068ce683454be0878806e08e04f2b" // * Precomputed, anytime the computeMac function changes this needs to be recalculated
+		mac := ComputeMac(secret, name, run, ts, "")
+		expectedMac := "4754474b21329e8beadd2b4054aa4be803965d66e710fa1fee091334ed804f29" // * Precomputed, anytime the ComputeMac function changes this needs to be recalculated
+		require.Equal(t, expectedMac, mac)
 
-		require.Equal(t, mac, expectedMac)
+		mac = ComputeMac(secret, name, run, ts, "refs/pull/12/head")
+		expectedMac = "9ca8f4cb5e1b083ee8cd215215bc00f379b28511d3ef7930bf054767de34766d" // * Precomputed, anytime the ComputeMac function changes this needs to be recalculated
+		require.Equal(t, expectedMac, mac)
 	})
 }

act/artifactcache/mock_caches.go

@@ -0,0 +1,225 @@
+// Code generated by mockery v2.53.5. DO NOT EDIT.
+
+package artifactcache
+
+import (
+	http "net/http"
+
+	bolthold "github.com/timshannon/bolthold"
+
+	io "io"
+
+	mock "github.com/stretchr/testify/mock"
+
+	time "time"
+)
+
+// mockCaches is an autogenerated mock type for the caches type
+type mockCaches struct {
+	mock.Mock
+}
+
+// close provides a mock function with no fields
+func (_m *mockCaches) close() {
+	_m.Called()
+}
+
+// commit provides a mock function with given fields: id, size
+func (_m *mockCaches) commit(id uint64, size int64) (int64, error) {
+	ret := _m.Called(id, size)
+
+	if len(ret) == 0 {
+		panic("no return value specified for commit")
+	}
+
+	var r0 int64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(uint64, int64) (int64, error)); ok {
+		return rf(id, size)
+	}
+	if rf, ok := ret.Get(0).(func(uint64, int64) int64); ok {
+		r0 = rf(id, size)
+	} else {
+		r0 = ret.Get(0).(int64)
+	}
+
+	if rf, ok := ret.Get(1).(func(uint64, int64) error); ok {
+		r1 = rf(id, size)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// exist provides a mock function with given fields: id
+func (_m *mockCaches) exist(id uint64) (bool, error) {
+	ret := _m.Called(id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for exist")
+	}
+
+	var r0 bool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(uint64) (bool, error)); ok {
+		return rf(id)
+	}
+	if rf, ok := ret.Get(0).(func(uint64) bool); ok {
+		r0 = rf(id)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	if rf, ok := ret.Get(1).(func(uint64) error); ok {
+		r1 = rf(id)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// gcCache provides a mock function with no fields
+func (_m *mockCaches) gcCache() {
+	_m.Called()
+}
+
+// getDB provides a mock function with no fields
+func (_m *mockCaches) getDB() *bolthold.Store {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for getDB")
+	}
+
+	var r0 *bolthold.Store
+	if rf, ok := ret.Get(0).(func() *bolthold.Store); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*bolthold.Store)
+		}
+	}
+
+	return r0
+}
+
+// readCache provides a mock function with given fields: id, repo
+func (_m *mockCaches) readCache(id uint64, repo string) (*Cache, error) {
+	ret := _m.Called(id, repo)
+
+	if len(ret) == 0 {
+		panic("no return value specified for readCache")
+	}
+
+	var r0 *Cache
+	var r1 error
+	if rf, ok := ret.Get(0).(func(uint64, string) (*Cache, error)); ok {
+		return rf(id, repo)
+	}
+	if rf, ok := ret.Get(0).(func(uint64, string) *Cache); ok {
+		r0 = rf(id, repo)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*Cache)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(uint64, string) error); ok {
+		r1 = rf(id, repo)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// serve provides a mock function with given fields: w, r, id
+func (_m *mockCaches) serve(w http.ResponseWriter, r *http.Request, id uint64) {
+	_m.Called(w, r, id)
+}
+
+// setgcAt provides a mock function with given fields: at
+func (_m *mockCaches) setgcAt(at time.Time) {
+	_m.Called(at)
+}
+
+// useCache provides a mock function with given fields: id
+func (_m *mockCaches) useCache(id uint64) error {
+	ret := _m.Called(id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for useCache")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(uint64) error); ok {
+		r0 = rf(id)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// validateMac provides a mock function with given fields: rundata
+func (_m *mockCaches) validateMac(rundata RunData) (string, error) {
+	ret := _m.Called(rundata)
+
+	if len(ret) == 0 {
+		panic("no return value specified for validateMac")
+	}
+
+	var r0 string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(RunData) (string, error)); ok {
+		return rf(rundata)
+	}
+	if rf, ok := ret.Get(0).(func(RunData) string); ok {
+		r0 = rf(rundata)
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	if rf, ok := ret.Get(1).(func(RunData) error); ok {
+		r1 = rf(rundata)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// write provides a mock function with given fields: id, offset, reader
+func (_m *mockCaches) write(id uint64, offset uint64, reader io.Reader) error {
+	ret := _m.Called(id, offset, reader)
+
+	if len(ret) == 0 {
+		panic("no return value specified for write")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(uint64, uint64, io.Reader) error); ok {
+		r0 = rf(id, offset, reader)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// newMockCaches creates a new instance of mockCaches. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func newMockCaches(t interface {
+	mock.TestingT
+	Cleanup(func())
+},
+) *mockCaches {
+	mock := &mockCaches{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

act/artifactcache/model.go

@@ -24,12 +24,13 @@ func (c *Request) ToCache() *Cache {
 }
 
 type Cache struct {
-	ID        uint64 `json:"id" boltholdKey:"ID"`
-	Repo      string `json:"repo" boltholdIndex:"Repo"`
-	Key       string `json:"key"`
-	Version   string `json:"version"`
-	Size      int64  `json:"cacheSize"`
-	Complete  bool   `json:"complete"`
-	UsedAt    int64  `json:"usedAt"`
-	CreatedAt int64  `json:"createdAt"`
+	ID                uint64 `json:"id" boltholdKey:"ID"`
+	Repo              string `json:"repo" boltholdIndex:"Repo"`
+	Key               string `json:"key"`
+	Version           string `json:"version"`
+	Size              int64  `json:"cacheSize"`
+	Complete          bool   `json:"complete"`
+	UsedAt            int64  `json:"usedAt"`
+	CreatedAt         int64  `json:"createdAt"`
+	WriteIsolationKey string `json:"writeIsolationKey"`
 }

act/artifactcache/utils.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package artifactcache
+
+import "syscall"
+
+func suicide() error {
+	return syscall.Kill(syscall.Getpid(), syscall.SIGTERM)
+}

act/artifactcache/utils_windows.go

@@ -0,0 +1,14 @@
+//go:build windows
+
+package artifactcache
+
+import "syscall"
+
+func suicide() error {
+	handle, err := syscall.GetCurrentProcess()
+	if err != nil {
+		return err
+	}
+
+	return syscall.TerminateProcess(handle, uint32(syscall.SIGTERM))
+}

act/cacheproxy/handler.go

@@ -4,9 +4,6 @@
 package cacheproxy
 
 import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -22,7 +19,8 @@ import (
 	"github.com/julienschmidt/httprouter"
 	"github.com/sirupsen/logrus"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/artifactcache"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 const (
@@ -39,31 +37,26 @@ type Handler struct {
 
 	outboundIP string
 
-	cacheServerHost string
+	cacheServerHost        string
+	cacheProxyHostOverride string
 
 	cacheSecret string
 
 	runs sync.Map
 }
 
-type RunData struct {
-	RepositoryFullName string
-	RunNumber          string
-	Timestamp          string
-	RepositoryMAC      string
-}
-
-func (h *Handler) CreateRunData(fullName, runNumber, timestamp string) RunData {
-	mac := computeMac(h.cacheSecret, fullName, runNumber, timestamp)
-	return RunData{
+func (h *Handler) CreateRunData(fullName, runNumber, timestamp, writeIsolationKey string) artifactcache.RunData {
+	mac := artifactcache.ComputeMac(h.cacheSecret, fullName, runNumber, timestamp, writeIsolationKey)
+	return artifactcache.RunData{
 		RepositoryFullName: fullName,
 		RunNumber:          runNumber,
 		Timestamp:          timestamp,
 		RepositoryMAC:      mac,
+		WriteIsolationKey:  writeIsolationKey,
 	}
 }
 
-func StartHandler(targetHost, outboundIP string, port uint16, cacheSecret string, logger logrus.FieldLogger) (*Handler, error) {
+func StartHandler(targetHost, outboundIP string, port uint16, cacheProxyHostOverride, cacheSecret string, logger logrus.FieldLogger) (*Handler, error) {
 	h := &Handler{}
 
 	if logger == nil {
@@ -71,7 +64,7 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheSecret string
 		discard.Out = io.Discard
 		logger = discard
 	}
-	logger = logger.WithField("module", "artifactcache")
+	logger = logger.WithField("module", "cacheproxy")
 	h.logger = logger
 
 	h.cacheSecret = cacheSecret
@@ -85,10 +78,11 @@ func StartHandler(targetHost, outboundIP string, port uint16, cacheSecret string
 	}
 
 	h.cacheServerHost = targetHost
+	h.cacheProxyHostOverride = cacheProxyHostOverride
 
 	proxy, err := h.newReverseProxy(targetHost)
 	if err != nil {
-		return nil, fmt.Errorf("unable to set up proxy to target host")
+		return nil, fmt.Errorf("unable to set up proxy to target host: %v", err)
 	}
 
 	router := httprouter.New()
@@ -140,11 +134,12 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er
 				h.logger.Warn(fmt.Sprintf("Tried starting a cache proxy with id %s, which does not exist.", id))
 				return
 			}
-			runData := data.(RunData)
+			runData := data.(artifactcache.RunData)
 			uri := matches[2]
 
 			r.SetURL(targetURL)
 			r.Out.URL.Path = uri
+			h.logger.Debugf("proxy req %s %q to %q", r.In.Method, r.In.URL, r.Out.URL)
 
 			r.Out.Header.Set("Forgejo-Cache-Repo", runData.RepositoryFullName)
 			r.Out.Header.Set("Forgejo-Cache-RunNumber", runData.RunNumber)
@@ -152,20 +147,29 @@ func (h *Handler) newReverseProxy(targetHost string) (*httputil.ReverseProxy, er
 			r.Out.Header.Set("Forgejo-Cache-Timestamp", runData.Timestamp)
 			r.Out.Header.Set("Forgejo-Cache-MAC", runData.RepositoryMAC)
 			r.Out.Header.Set("Forgejo-Cache-Host", h.ExternalURL())
+			if runData.WriteIsolationKey != "" {
+				r.Out.Header.Set("Forgejo-Cache-WriteIsolationKey", runData.WriteIsolationKey)
+			}
+		},
+		ModifyResponse: func(r *http.Response) error {
+			h.logger.Debugf("proxy resp %s w/ %d bytes", r.Status, r.ContentLength)
+			return nil
 		},
 	}
 	return proxy, nil
 }
 
 func (h *Handler) ExternalURL() string {
-	// TODO: make the external url configurable if necessary
+	if h.cacheProxyHostOverride != "" {
+		return h.cacheProxyHostOverride
+	}
 	return fmt.Sprintf("http://%s", net.JoinHostPort(h.outboundIP, strconv.Itoa(h.listener.Addr().(*net.TCPAddr).Port)))
 }
 
 // Informs the proxy of a workflow run that can make cache requests.
 // The RunData contains the information about the repository.
 // The function returns the 32-bit random key which the run will use to identify itself.
-func (h *Handler) AddRun(data RunData) (string, error) {
+func (h *Handler) AddRun(data artifactcache.RunData) (string, error) {
 	for range 3 {
 		key := common.MustRandName(4)
 		_, loaded := h.runs.LoadOrStore(key, data)
@@ -206,13 +210,3 @@ func (h *Handler) Close() error {
 	}
 	return retErr
 }
-
-func computeMac(secret, repo, run, ts string) string {
-	mac := hmac.New(sha256.New, []byte(secret))
-	mac.Write([]byte(repo))
-	mac.Write([]byte(">"))
-	mac.Write([]byte(run))
-	mac.Write([]byte(">"))
-	mac.Write([]byte(ts))
-	return hex.EncodeToString(mac.Sum(nil))
-}

act/common/git/git.go

@@ -19,7 +19,7 @@ import (
 	"github.com/mattn/go-isatty"
 	log "github.com/sirupsen/logrus"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 var (
@@ -305,7 +305,7 @@ func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.Pu
 func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
-		logger.Infof("  \u2601  git clone '%s' # ref=%s", input.URL, input.Ref)
+		logger.Infof("  \u2601\ufe0f  git clone '%s' # ref=%s", input.URL, input.Ref)
 		logger.Debugf("  cloning %s to %s", input.URL, input.Dir)
 
 		cloneLock.Lock()

act/common/git/git_test.go

@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 func TestFindGitSlug(t *testing.T) {

act/container/container_types.go

@@ -5,7 +5,7 @@ import (
 	"io"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 	"github.com/docker/go-connections/nat"
 )
 

act/container/docker_auth.go

@@ -6,7 +6,7 @@ import (
 	"context"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 	"github.com/docker/cli/cli/config"
 	"github.com/docker/cli/cli/config/credentials"
 	"github.com/docker/docker/api/types/registry"

act/container/docker_build.go

@@ -14,7 +14,7 @@ import (
 	"github.com/moby/patternmatcher"
 	"github.com/moby/patternmatcher/ignorefile"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 // NewDockerBuildExecutor function to create a run executor for the container

act/container/docker_cli.go

@@ -13,6 +13,7 @@ package container
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -32,7 +33,6 @@ import (
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/errdefs"
 	"github.com/docker/go-connections/nat"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/pflag"
 )
@@ -331,7 +331,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 	// Validate the input mac address
 	if copts.macAddress != "" {
 		if _, err := opts.ValidateMACAddress(copts.macAddress); err != nil {
-			return nil, errors.Errorf("%s is not a valid mac address", copts.macAddress)
+			return nil, fmt.Errorf("%s is not a valid mac address", copts.macAddress)
 		}
 	}
 	if copts.stdin {
@@ -347,7 +347,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 
 	swappiness := copts.swappiness
 	if swappiness != -1 && (swappiness < 0 || swappiness > 100) {
-		return nil, errors.Errorf("invalid value: %d. Valid memory swappiness range is 0-100", swappiness)
+		return nil, fmt.Errorf("invalid value: %d. Valid memory swappiness range is 0-100", swappiness)
 	}
 
 	mounts := copts.mounts.Value()
@@ -430,7 +430,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 	// Merge in exposed ports to the map of published ports
 	for _, e := range copts.expose.GetSlice() {
 		if strings.Contains(e, ":") {
-			return nil, errors.Errorf("invalid port format for --expose: %s", e)
+			return nil, fmt.Errorf("invalid port format for --expose: %s", e)
 		}
 		// support two formats for expose, original format <portnum>/[<proto>]
 		// or <startport-endport>/[<proto>]
@@ -439,7 +439,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		// if expose a port, the start and end port are the same
 		start, end, err := nat.ParsePortRange(port)
 		if err != nil {
-			return nil, errors.Errorf("invalid range format for --expose: %s, error: %s", e, err)
+			return nil, fmt.Errorf("invalid range format for --expose: %s, error: %s", e, err)
 		}
 		for i := start; i <= end; i++ {
 			p, err := nat.NewPort(proto, strconv.FormatUint(i, 10))
@@ -488,22 +488,22 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 
 	pidMode := container.PidMode(copts.pidMode)
 	if !pidMode.Valid() {
-		return nil, errors.Errorf("--pid: invalid PID mode")
+		return nil, errors.New("--pid: invalid PID mode")
 	}
 
 	utsMode := container.UTSMode(copts.utsMode)
 	if !utsMode.Valid() {
-		return nil, errors.Errorf("--uts: invalid UTS mode")
+		return nil, errors.New("--uts: invalid UTS mode")
 	}
 
 	usernsMode := container.UsernsMode(copts.usernsMode)
 	if !usernsMode.Valid() {
-		return nil, errors.Errorf("--userns: invalid USER mode")
+		return nil, errors.New("--userns: invalid USER mode")
 	}
 
 	cgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)
 	if !cgroupnsMode.Valid() {
-		return nil, errors.Errorf("--cgroupns: invalid CGROUP mode")
+		return nil, errors.New("--cgroupns: invalid CGROUP mode")
 	}
 
 	restartPolicy, err := opts.ParseRestartPolicy(copts.restartPolicy)
@@ -537,7 +537,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		copts.healthRetries != 0
 	if copts.noHealthcheck {
 		if haveHealthSettings {
-			return nil, errors.Errorf("--no-healthcheck conflicts with --health-* options")
+			return nil, errors.New("--no-healthcheck conflicts with --health-* options")
 		}
 		test := strslice.StrSlice{"NONE"}
 		healthConfig = &container.HealthConfig{Test: test}
@@ -548,16 +548,16 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 			probe = strslice.StrSlice(args)
 		}
 		if copts.healthInterval < 0 {
-			return nil, errors.Errorf("--health-interval cannot be negative")
+			return nil, errors.New("--health-interval cannot be negative")
 		}
 		if copts.healthTimeout < 0 {
-			return nil, errors.Errorf("--health-timeout cannot be negative")
+			return nil, errors.New("--health-timeout cannot be negative")
 		}
 		if copts.healthRetries < 0 {
-			return nil, errors.Errorf("--health-retries cannot be negative")
+			return nil, errors.New("--health-retries cannot be negative")
 		}
 		if copts.healthStartPeriod < 0 {
-			return nil, fmt.Errorf("--health-start-period cannot be negative")
+			return nil, errors.New("--health-start-period cannot be negative")
 		}
 
 		healthConfig = &container.HealthConfig{
@@ -677,7 +677,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 	}
 
 	if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() {
-		return nil, errors.Errorf("Conflicting options: --restart and --rm")
+		return nil, errors.New("Conflicting options: --restart and --rm")
 	}
 
 	// only set this value if the user provided the flag, else it should default to nil
@@ -741,7 +741,7 @@ func parseNetworkOpts(copts *containerOptions) (map[string]*networktypes.Endpoin
 			return nil, err
 		}
 		if _, ok := endpoints[n.Target]; ok {
-			return nil, errdefs.InvalidParameter(errors.Errorf("network %q is specified multiple times", n.Target))
+			return nil, errdefs.InvalidParameter(fmt.Errorf("network %q is specified multiple times", n.Target))
 		}
 
 		// For backward compatibility: if no custom options are provided for the network,
@@ -838,7 +838,7 @@ func convertToStandardNotation(ports []string) ([]string, error) {
 			for _, param := range strings.Split(publish, ",") {
 				opt := strings.Split(param, "=")
 				if len(opt) < 2 {
-					return optsList, errors.Errorf("invalid publish opts format (should be name=value but got '%s')", param)
+					return optsList, fmt.Errorf("invalid publish opts format (should be name=value but got '%s')", param)
 				}
 
 				params[opt[0]] = opt[1]
@@ -854,7 +854,7 @@ func convertToStandardNotation(ports []string) ([]string, error) {
 func parseLoggingOpts(loggingDriver string, loggingOpts []string) (map[string]string, error) {
 	loggingOptsMap := opts.ConvertKVStringsToMap(loggingOpts)
 	if loggingDriver == "none" && len(loggingOpts) > 0 {
-		return map[string]string{}, errors.Errorf("invalid logging opts for driver %s", loggingDriver)
+		return map[string]string{}, fmt.Errorf("invalid logging opts for driver %s", loggingDriver)
 	}
 	return loggingOptsMap, nil
 }
@@ -867,17 +867,17 @@ func parseSecurityOpts(securityOpts []string) ([]string, error) {
 			if strings.Contains(opt, ":") {
 				con = strings.SplitN(opt, ":", 2)
 			} else {
-				return securityOpts, errors.Errorf("Invalid --security-opt: %q", opt)
+				return securityOpts, fmt.Errorf("Invalid --security-opt: %q", opt)
 			}
 		}
 		if con[0] == "seccomp" && con[1] != "unconfined" {
 			f, err := os.ReadFile(con[1])
 			if err != nil {
-				return securityOpts, errors.Errorf("opening seccomp profile (%s) failed: %v", con[1], err)
+				return securityOpts, fmt.Errorf("opening seccomp profile (%s) failed: %v", con[1], err)
 			}
 			b := bytes.NewBuffer(nil)
 			if err := json.Compact(b, f); err != nil {
-				return securityOpts, errors.Errorf("compacting json for seccomp profile (%s) failed: %v", con[1], err)
+				return securityOpts, fmt.Errorf("compacting json for seccomp profile (%s) failed: %v", con[1], err)
 			}
 			securityOpts[key] = fmt.Sprintf("seccomp=%s", b.Bytes())
 		}
@@ -913,7 +913,7 @@ func parseStorageOpts(storageOpts []string) (map[string]string, error) {
 			opt := strings.SplitN(option, "=", 2)
 			m[opt[0]] = opt[1]
 		} else {
-			return nil, errors.Errorf("invalid storage option")
+			return nil, errors.New("invalid storage option")
 		}
 	}
 	return m, nil
@@ -927,7 +927,7 @@ func parseDevice(device, serverOS string) (container.DeviceMapping, error) {
 	case "windows":
 		return parseWindowsDevice(device)
 	}
-	return container.DeviceMapping{}, errors.Errorf("unknown server OS: %s", serverOS)
+	return container.DeviceMapping{}, fmt.Errorf("unknown server OS: %s", serverOS)
 }
 
 // parseLinuxDevice parses a device mapping string to a container.DeviceMapping struct
@@ -950,7 +950,7 @@ func parseLinuxDevice(device string) (container.DeviceMapping, error) {
 	case 1:
 		src = arr[0]
 	default:
-		return container.DeviceMapping{}, errors.Errorf("invalid device specification: %s", device)
+		return container.DeviceMapping{}, fmt.Errorf("invalid device specification: %s", device)
 	}
 
 	if dst == "" {
@@ -980,7 +980,7 @@ func validateDeviceCgroupRule(val string) (string, error) {
 		return val, nil
 	}
 
-	return val, errors.Errorf("invalid device cgroup format '%s'", val)
+	return val, fmt.Errorf("invalid device cgroup format '%s'", val)
 }
 
 // validDeviceMode checks if the mode for device is valid or not.
@@ -1012,7 +1012,7 @@ func validateDevice(val, serverOS string) (string, error) {
 		// Windows does validation entirely server-side
 		return val, nil
 	}
-	return "", errors.Errorf("unknown server OS: %s", serverOS)
+	return "", fmt.Errorf("unknown server OS: %s", serverOS)
 }
 
 // validateLinuxPath is the implementation of validateDevice knowing that the
@@ -1027,12 +1027,12 @@ func validateLinuxPath(val string, validator func(string) bool) (string, error)
 	var mode string
 
 	if strings.Count(val, ":") > 2 {
-		return val, errors.Errorf("bad format for path: %s", val)
+		return val, fmt.Errorf("bad format for path: %s", val)
 	}
 
 	split := strings.SplitN(val, ":", 3)
 	if split[0] == "" {
-		return val, errors.Errorf("bad format for path: %s", val)
+		return val, fmt.Errorf("bad format for path: %s", val)
 	}
 	switch len(split) {
 	case 1:
@@ -1051,13 +1051,13 @@ func validateLinuxPath(val string, validator func(string) bool) (string, error)
 		containerPath = split[1]
 		mode = split[2]
 		if isValid := validator(split[2]); !isValid {
-			return val, errors.Errorf("bad mode specified: %s", mode)
+			return val, fmt.Errorf("bad mode specified: %s", mode)
 		}
 		val = fmt.Sprintf("%s:%s:%s", split[0], containerPath, mode)
 	}
 
 	if !path.IsAbs(containerPath) {
-		return val, errors.Errorf("%s is not an absolute path", containerPath)
+		return val, fmt.Errorf("%s is not an absolute path", containerPath)
 	}
 	return val, nil
 }
@@ -1070,13 +1070,13 @@ func validateAttach(val string) (string, error) {
 			return s, nil
 		}
 	}
-	return val, errors.Errorf("valid streams are STDIN, STDOUT and STDERR")
+	return val, errors.New("valid streams are STDIN, STDOUT and STDERR")
 }
 
 func validateAPIVersion(c *containerConfig, serverAPIVersion string) error {
 	for _, m := range c.HostConfig.Mounts {
 		if m.BindOptions != nil && m.BindOptions.NonRecursive && versions.LessThan(serverAPIVersion, "1.40") {
-			return errors.Errorf("bind-nonrecursive requires API v1.40 or later")
+			return errors.New("bind-nonrecursive requires API v1.40 or later")
 		}
 	}
 	return nil

act/container/docker_cli_test.go

@@ -10,6 +10,7 @@
 package container
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -21,7 +22,6 @@ import (
 	"github.com/docker/docker/api/types/container"
 	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/go-connections/nat"
-	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -288,7 +288,7 @@ func compareRandomizedStrings(a, b, c, d string) error {
 	if a == d && b == c {
 		return nil
 	}
-	return errors.Errorf("strings don't match")
+	return errors.New("strings don't match")
 }
 
 // Simple parse with MacAddress validation

act/container/docker_images.go

@@ -6,7 +6,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 	cerrdefs "github.com/containerd/errdefs"
 	"github.com/docker/docker/api/types/image"
 )

act/container/docker_network.go

@@ -5,7 +5,7 @@ package container
 import (
 	"context"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 	"github.com/docker/docker/api/types/network"
 )
 

act/container/docker_pull.go

@@ -13,7 +13,7 @@ import (
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/registry"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 // NewDockerPullExecutor function to create a run executor for the container

act/container/docker_run.go

@@ -38,8 +38,8 @@ import (
 	"github.com/spf13/pflag"
 	"golang.org/x/term"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/filecollector"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/filecollector"
 )
 
 // NewContainer creates a reference to a container
@@ -483,6 +483,14 @@ func (cr *containerReference) mergeJobOptions(ctx context.Context, config *conta
 		}
 	}
 
+	if jobConfig.HostConfig.Memory > 0 {
+		logger.Debugf("--memory %v", jobConfig.HostConfig.Memory)
+		if hostConfig.Memory > 0 && jobConfig.HostConfig.Memory > hostConfig.Memory {
+			return nil, nil, fmt.Errorf("the --memory %v option found in the workflow cannot be greater than the --memory %v option from the runner configuration file", jobConfig.HostConfig.Memory, hostConfig.Memory)
+		}
+		hostConfig.Memory = jobConfig.HostConfig.Memory
+	}
+
 	if len(jobConfig.Config.Hostname) > 0 {
 		logger.Debugf("--hostname %v", jobConfig.Config.Hostname)
 		config.Hostname = jobConfig.Config.Hostname

act/container/docker_run_test.go

@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"

act/container/docker_stub.go

@@ -4,12 +4,12 @@ package container
 
 import (
 	"context"
+	"errors"
 	"runtime"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/system"
-	"github.com/pkg/errors"
 )
 
 // ImageExistsLocally returns a boolean indicating if an image with the

act/container/docker_volume.go

@@ -6,7 +6,7 @@ import (
 	"context"
 	"slices"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/volume"
 )

act/container/host_environment.go

@@ -13,6 +13,7 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/go-git/go-billy/v5/helper/polyfill"
@@ -20,9 +21,9 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
 	"golang.org/x/term"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/filecollector"
-	"code.forgejo.org/forgejo/runner/v9/act/lookpath"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/filecollector"
+	"code.forgejo.org/forgejo/runner/v11/act/lookpath"
 )
 
 type HostEnvironment struct {
@@ -33,7 +34,6 @@ type HostEnvironment struct {
 	Workdir   string
 	ActPath   string
 	Root      string
-	CleanUp   func()
 	StdOut    io.Writer
 	LXC       bool
 }
@@ -191,12 +191,12 @@ func (e *HostEnvironment) Start(_ bool) common.Executor {
 
 type ptyWriter struct {
 	Out       io.Writer
-	AutoStop  bool
+	AutoStop  atomic.Bool
 	dirtyLine bool
 }
 
 func (w *ptyWriter) Write(buf []byte) (int, error) {
-	if w.AutoStop && len(buf) > 0 && buf[len(buf)-1] == 4 {
+	if w.AutoStop.Load() && len(buf) > 0 && buf[len(buf)-1] == 4 {
 		n, err := w.Out.Write(buf[:len(buf)-1])
 		if err != nil {
 			return n, err
@@ -365,7 +365,7 @@ func (e *HostEnvironment) exec(ctx context.Context, commandparam []string, cmdli
 		return fmt.Errorf("RUN %w", err)
 	}
 	if tty != nil {
-		writer.AutoStop = true
+		writer.AutoStop.Store(true)
 		if _, err := tty.Write([]byte("\x04")); err != nil {
 			common.Logger(ctx).Debug("Failed to write EOT")
 		}
@@ -388,7 +388,7 @@ func (e *HostEnvironment) ExecWithCmdLine(command []string, cmdline string, env
 		if err := e.exec(ctx, command, cmdline, env, user, workdir); err != nil {
 			select {
 			case <-ctx.Done():
-				return fmt.Errorf("this step has been cancelled: %w", err)
+				return fmt.Errorf("this step has been cancelled: ctx: %w, exec: %w", ctx.Err(), err)
 			default:
 				return err
 			}
@@ -403,10 +403,12 @@ func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string)
 
 func (e *HostEnvironment) Remove() common.Executor {
 	return func(ctx context.Context) error {
-		if e.CleanUp != nil {
-			e.CleanUp()
+		if e.GetLXC() {
+			// there may be files owned by root: removal
+			// is the responsibility of the LXC backend
+			return nil
 		}
-		return os.RemoveAll(e.Path)
+		return os.RemoveAll(e.Root)
 	}
 }
 

act/container/parse_env_file.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 func parseEnvFile(e Container, srcPath string, env *map[string]string) common.Executor {

act/exprparser/functions.go

@@ -15,7 +15,7 @@ import (
 
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/rhysd/actionlint"
 )
 

act/exprparser/functions_test.go

@@ -4,7 +4,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/stretchr/testify/assert"
 )
 

act/exprparser/interpreter.go

@@ -7,7 +7,7 @@ import (
 	"reflect"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/rhysd/actionlint"
 )
 
@@ -158,6 +158,8 @@ func (impl *interperterImpl) evaluateVariable(variableNode *actionlint.VariableN
 		return impl.env.Github, nil
 	case "forge":
 		return impl.env.Github, nil
+	case "forgejo":
+		return impl.env.Github, nil
 	case "env":
 		return impl.env.Env, nil
 	case "job":

act/exprparser/interpreter_test.go

@@ -4,7 +4,7 @@ import (
 	"math"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/stretchr/testify/assert"
 )
 

act/jobparser/evaluator.go

@@ -5,7 +5,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
+	"code.forgejo.org/forgejo/runner/v11/act/exprparser"
 	"go.yaml.in/yaml/v3"
 )
 

act/jobparser/interpeter.go

@@ -1,8 +1,8 @@
 package jobparser
 
 import (
-	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/exprparser"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"go.yaml.in/yaml/v3"
 )
 
@@ -76,6 +76,36 @@ func NewInterpeter(
 	return exprparser.NewInterpeter(ee, config)
 }
 
+// Returns an interpeter used in the server in the context of workflow-level templates. Needs github, inputs, and vars
+// context only.
+func NewWorkflowInterpeter(
+	gitCtx *model.GithubContext,
+	vars map[string]string,
+	inputs map[string]any,
+) exprparser.Interpreter {
+	ee := &exprparser.EvaluationEnvironment{
+		Github:   gitCtx,
+		Env:      nil, // no need
+		Job:      nil, // no need
+		Steps:    nil, // no need
+		Runner:   nil, // no need
+		Secrets:  nil, // no need
+		Strategy: nil, // no need
+		Matrix:   nil, // no need
+		Needs:    nil, // no need
+		Inputs:   inputs,
+		Vars:     vars,
+	}
+
+	config := exprparser.Config{
+		Run:        nil,
+		WorkingDir: "", // WorkingDir is used for the function hashFiles, but it's not needed in the server
+		Context:    "workflow",
+	}
+
+	return exprparser.NewInterpeter(ee, config)
+}
+
 // JobResult is the minimum requirement of job results for Interpeter
 type JobResult struct {
 	Needs   []string

act/jobparser/jobparser.go

@@ -8,7 +8,7 @@ import (
 
 	"go.yaml.in/yaml/v3"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 func Parse(content []byte, validate bool, options ...ParseOption) ([]*SingleWorkflow, error) {

act/jobparser/model.go

@@ -1,10 +1,10 @@
 package jobparser
 
 import (
-	"bytes"
 	"fmt"
+	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"go.yaml.in/yaml/v3"
 )
 
@@ -193,83 +193,32 @@ func (evt *Event) Schedules() []map[string]string {
 	return evt.schedules
 }
 
-func ReadWorkflowRawConcurrency(content []byte) (*model.RawConcurrency, error) {
-	w := new(model.Workflow)
-	err := yaml.NewDecoder(bytes.NewReader(content)).Decode(w)
-	return w.RawConcurrency, err
-}
-
-func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (string, bool, error) {
-	actJob := &model.Job{}
-	if job != nil {
-		actJob.Strategy = &model.Strategy{
-			FailFastString:    job.Strategy.FailFastString,
-			MaxParallelString: job.Strategy.MaxParallelString,
-			RawMatrix:         job.Strategy.RawMatrix,
-		}
-		actJob.Strategy.FailFast = actJob.Strategy.GetFailFast()
-		actJob.Strategy.MaxParallel = actJob.Strategy.GetMaxParallel()
-	}
-
-	matrix := make(map[string]any)
-	matrixes, err := actJob.GetMatrixes()
-	if err != nil {
-		return "", false, err
-	}
-	if len(matrixes) > 0 {
-		matrix = matrixes[0]
-	}
-
-	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs))
+// Convert the raw YAML from the `concurrency` block on a workflow into the evaluated concurrency group and
+// cancel-in-progress value. This implementation only supports workflow-level concurrency definition, where we expect
+// expressions to be able to access only the github, inputs and vars contexts. If RawConcurrency is empty, then the
+// returned concurrency group will be "" and cancel-in-progress will be nil -- this can be used to distinguish from an
+// explicit cancel-in-progress choice even if a group isn't specified.
+func EvaluateWorkflowConcurrency(rc *model.RawConcurrency, gitCtx *model.GithubContext, vars map[string]string, inputs map[string]any) (string, *bool, error) {
+	evaluator := NewExpressionEvaluator(NewWorkflowInterpeter(gitCtx, vars, inputs))
 	var node yaml.Node
 	if err := node.Encode(rc); err != nil {
-		return "", false, fmt.Errorf("failed to encode concurrency: %w", err)
+		return "", nil, fmt.Errorf("failed to encode concurrency: %w", err)
 	}
 	if err := evaluator.EvaluateYamlNode(&node); err != nil {
-		return "", false, fmt.Errorf("failed to evaluate concurrency: %w", err)
+		return "", nil, fmt.Errorf("failed to evaluate concurrency: %w", err)
 	}
 	var evaluated model.RawConcurrency
 	if err := node.Decode(&evaluated); err != nil {
-		return "", false, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err)
+		return "", nil, fmt.Errorf("failed to unmarshal evaluated concurrency: %w", err)
 	}
 	if evaluated.RawExpression != "" {
-		return evaluated.RawExpression, false, nil
+		return evaluated.RawExpression, nil, nil
 	}
-	return evaluated.Group, evaluated.CancelInProgress == "true", nil
-}
-
-func toGitContext(input map[string]any) *model.GithubContext {
-	gitContext := &model.GithubContext{
-		EventPath:        asString(input["event_path"]),
-		Workflow:         asString(input["workflow"]),
-		RunID:            asString(input["run_id"]),
-		RunNumber:        asString(input["run_number"]),
-		Actor:            asString(input["actor"]),
-		Repository:       asString(input["repository"]),
-		EventName:        asString(input["event_name"]),
-		Sha:              asString(input["sha"]),
-		Ref:              asString(input["ref"]),
-		RefName:          asString(input["ref_name"]),
-		RefType:          asString(input["ref_type"]),
-		HeadRef:          asString(input["head_ref"]),
-		BaseRef:          asString(input["base_ref"]),
-		Token:            asString(input["token"]),
-		Workspace:        asString(input["workspace"]),
-		Action:           asString(input["action"]),
-		ActionPath:       asString(input["action_path"]),
-		ActionRef:        asString(input["action_ref"]),
-		ActionRepository: asString(input["action_repository"]),
-		Job:              asString(input["job"]),
-		RepositoryOwner:  asString(input["repository_owner"]),
-		RetentionDays:    asString(input["retention_days"]),
+	if evaluated.CancelInProgress == "" {
+		return evaluated.Group, nil, nil
 	}
-
-	event, ok := input["event"].(map[string]any)
-	if ok {
-		gitContext.Event = event
-	}
-
-	return gitContext
+	cancelInProgress := evaluated.CancelInProgress == "true"
+	return evaluated.Group, &cancelInProgress, nil
 }
 
 func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
@@ -278,7 +227,7 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		var val string
 		err := rawOn.Decode(&val)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("unable to interpret scalar value into a string: %w", err)
 		}
 		return []*Event{
 			{Name: val},
@@ -290,12 +239,12 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 			return nil, err
 		}
 		res := make([]*Event, 0, len(val))
-		for _, v := range val {
+		for i, v := range val {
 			switch t := v.(type) {
 			case string:
 				res = append(res, &Event{Name: t})
 			default:
-				return nil, fmt.Errorf("invalid type %T", t)
+				return nil, fmt.Errorf("value at index %d was unexpected type %[2]T; must be a string but was %#[2]v", i, v)
 			}
 		}
 		return res, nil
@@ -315,16 +264,6 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 				continue
 			}
 			switch t := v.(type) {
-			case string:
-				res = append(res, &Event{
-					Name: k,
-					acts: map[string][]string{},
-				})
-			case []string:
-				res = append(res, &Event{
-					Name: k,
-					acts: map[string][]string{},
-				})
 			case map[string]any:
 				acts := make(map[string][]string, len(t))
 				for act, branches := range t {
@@ -338,15 +277,15 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 						for i, v := range b {
 							var ok bool
 							if acts[act][i], ok = v.(string); !ok {
-								return nil, fmt.Errorf("unknown on type: %#v", branches)
+								return nil, fmt.Errorf("key %q.%q index %d had unexpected type %[4]T; a string was expected but was %#[4]v", k, act, i, v)
 							}
 						}
 					case map[string]any:
-						if isInvalidOnType(k, act) {
-							return nil, fmt.Errorf("unknown on type: %#v", v)
+						if err := isInvalidOnType(k, act); err != nil {
+							return nil, fmt.Errorf("invalid value on key %q: %w", k, err)
 						}
 					default:
-						return nil, fmt.Errorf("unknown on type: %#v", branches)
+						return nil, fmt.Errorf("key %q.%q had unexpected type %T; was %#v", k, act, branches, branches)
 					}
 				}
 				if k == "workflow_dispatch" || k == "workflow_call" {
@@ -358,19 +297,22 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 				})
 			case []any:
 				if k != "schedule" {
-					return nil, fmt.Errorf("unknown on type: %#v", v)
+					return nil, fmt.Errorf("key %q had an type %T; only the 'schedule' key is expected with this type", k, v)
 				}
 				schedules := make([]map[string]string, len(t))
 				for i, tt := range t {
 					vv, ok := tt.(map[string]any)
 					if !ok {
-						return nil, fmt.Errorf("unknown on type: %#v", v)
+						return nil, fmt.Errorf("key %q[%d] had unexpected type %[3]T; a map with a key \"cron\" was expected, but value was %#[3]v", k, i, tt)
 					}
 					schedules[i] = make(map[string]string, len(vv))
-					for k, vvv := range vv {
+					for kk, vvv := range vv {
+						if strings.ToLower(kk) != "cron" {
+							return nil, fmt.Errorf("key %q[%d] had unexpected key %q; \"cron\" was expected", k, i, kk)
+						}
 						var ok bool
-						if schedules[i][k], ok = vvv.(string); !ok {
-							return nil, fmt.Errorf("unknown on type: %#v", v)
+						if schedules[i][kk], ok = vvv.(string); !ok {
+							return nil, fmt.Errorf("key %q[%d].%q had unexpected type %[4]T; a string was expected by was %#[4]v", k, i, kk, vvv)
 						}
 					}
 				}
@@ -379,23 +321,29 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 					schedules: schedules,
 				})
 			default:
-				return nil, fmt.Errorf("unknown on type: %#v", v)
+				return nil, fmt.Errorf("key %q had unexpected type %[2]T; expected a map or array but was %#[2]v", k, v)
 			}
 		}
 		return res, nil
 	default:
-		return nil, fmt.Errorf("unknown on type: %v", rawOn.Kind)
+		return nil, fmt.Errorf("unexpected yaml node in `on`: %v", rawOn.Kind)
 	}
 }
 
-func isInvalidOnType(onType, subKey string) bool {
-	if onType == "workflow_dispatch" && subKey == "inputs" {
-		return false
+func isInvalidOnType(onType, subKey string) error {
+	if onType == "workflow_dispatch" {
+		if subKey == "inputs" {
+			return nil
+		}
+		return fmt.Errorf("workflow_dispatch only supports key \"inputs\", but key %q was found", subKey)
 	}
-	if onType == "workflow_call" && (subKey == "inputs" || subKey == "outputs") {
-		return false
+	if onType == "workflow_call" {
+		if subKey == "inputs" || subKey == "outputs" {
+			return nil
+		}
+		return fmt.Errorf("workflow_call only supports keys \"inputs\" and \"outputs\", but key %q was found", subKey)
 	}
-	return true
+	return fmt.Errorf("unexpected key %q.%q", onType, subKey)
 }
 
 // parseMappingNode parse a mapping node and preserve order.
@@ -430,12 +378,3 @@ func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) {
 
 	return scalars, datas, nil
 }
-
-func asString(v any) string {
-	if v == nil {
-		return ""
-	} else if s, ok := v.(string); ok {
-		return s
-	}
-	return ""
-}

act/jobparser/model_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -16,6 +16,7 @@ func TestParseRawOn(t *testing.T) {
 	kases := []struct {
 		input  string
 		result []*Event
+		err    string
 	}{
 		{
 			input: "on: issue_comment",
@@ -33,7 +34,10 @@ func TestParseRawOn(t *testing.T) {
 				},
 			},
 		},
-
+		{
+			input: "on: [123]",
+			err:   "value at index 0 was unexpected type int; must be a string but was 123",
+		},
 		{
 			input: "on:\n  - push\n  - pull_request",
 			result: []*Event{
@@ -45,6 +49,19 @@ func TestParseRawOn(t *testing.T) {
 				},
 			},
 		},
+		{
+			input: "on: { push: null }",
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{},
+				},
+			},
+		},
+		{
+			input: "on: { push: 'abc' }",
+			err:   "key \"push\" had unexpected type string; expected a map or array but was \"abc\"",
+		},
 		{
 			input: "on:\n  push:\n    branches:\n      - master",
 			result: []*Event{
@@ -72,6 +89,10 @@ func TestParseRawOn(t *testing.T) {
 				},
 			},
 		},
+		{
+			input: "on:\n  branch_protection_rule:\n    types: [123, deleted]",
+			err:   "key \"branch_protection_rule\".\"types\" index 0 had unexpected type int; a string was expected but was 123",
+		},
 		{
 			input: "on:\n  project:\n    types: [created, deleted]\n  milestone:\n    types: [opened, deleted]",
 			result: []*Event{
@@ -189,6 +210,22 @@ func TestParseRawOn(t *testing.T) {
 				},
 			},
 		},
+		{
+			input: "on:\n  schedule2:\n    - cron: '20 6 * * *'",
+			err:   "key \"schedule2\" had an type []interface {}; only the 'schedule' key is expected with this type",
+		},
+		{
+			input: "on:\n  schedule:\n    - 123",
+			err:   "key \"schedule\"[0] had unexpected type int; a map with a key \"cron\" was expected, but value was 123",
+		},
+		{
+			input: "on:\n  schedule:\n    - corn: '20 6 * * *'",
+			err:   "key \"schedule\"[0] had unexpected key \"corn\"; \"cron\" was expected",
+		},
+		{
+			input: "on:\n  schedule:\n    - cron: 123",
+			err:   "key \"schedule\"[0].\"cron\" had unexpected type int; a string was expected by was 123",
+		},
 		{
 			input: `
 on:
@@ -222,15 +259,37 @@ on:
 				},
 			},
 		},
+		{
+			input: `
+on:
+  workflow_call:
+    mistake:
+      access-token:
+        description: 'A token passed from the caller workflow'
+        required: false
+`,
+			err: "invalid value on key \"workflow_call\": workflow_call only supports keys \"inputs\" and \"outputs\", but key \"mistake\" was found",
+		},
+		{
+			input: `
+on:
+  workflow_call: { map: 123 }
+`,
+			err: "key \"workflow_call\".\"map\" had unexpected type int; was 123",
+		},
 	}
 	for _, kase := range kases {
 		t.Run(kase.input, func(t *testing.T) {
 			origin, err := model.ReadWorkflow(strings.NewReader(kase.input), false)
-			assert.NoError(t, err)
+			require.NoError(t, err)
 
 			events, err := ParseRawOn(&origin.RawOn)
-			assert.NoError(t, err)
-			assert.EqualValues(t, kase.result, events, fmt.Sprintf("%#v", events))
+			if kase.err != "" {
+				assert.ErrorContains(t, err, kase.err)
+			} else {
+				assert.NoError(t, err)
+				assert.EqualValues(t, kase.result, events, fmt.Sprintf("%#v", events))
+			}
 		})
 	}
 }
@@ -342,10 +401,11 @@ func TestParseMappingNode(t *testing.T) {
 
 func TestEvaluateConcurrency(t *testing.T) {
 	tests := []struct {
-		name             string
-		input            model.RawConcurrency
-		group            string
-		cancelInProgress bool
+		name                string
+		input               model.RawConcurrency
+		group               string
+		cancelInProgressNil bool
+		cancelInProgress    bool
 	}{
 		{
 			name: "basic",
@@ -357,18 +417,18 @@ func TestEvaluateConcurrency(t *testing.T) {
 			cancelInProgress: true,
 		},
 		{
-			name:             "undefined",
-			input:            model.RawConcurrency{},
-			group:            "",
-			cancelInProgress: false,
+			name:                "undefined",
+			input:               model.RawConcurrency{},
+			group:               "",
+			cancelInProgressNil: true,
 		},
 		{
 			name: "group-evaluation",
 			input: model.RawConcurrency{
 				Group: "${{ github.workflow }}-${{ github.ref }}",
 			},
-			group:            "test_workflow-main",
-			cancelInProgress: false,
+			group:               "test_workflow-main",
+			cancelInProgressNil: true,
 		},
 		{
 			name: "cancel-evaluation-true",
@@ -393,37 +453,44 @@ func TestEvaluateConcurrency(t *testing.T) {
 			input: model.RawConcurrency{
 				Group: "user-${{ github.event.commits[0].author.username }}",
 			},
-			group:            "user-someone",
-			cancelInProgress: false,
+			group:               "user-someone",
+			cancelInProgressNil: true,
 		},
 		{
 			name: "arbitrary-var",
 			input: model.RawConcurrency{
 				Group: "${{ vars.eval_arbitrary_var }}",
 			},
-			group:            "123",
-			cancelInProgress: false,
+			group:               "123",
+			cancelInProgressNil: true,
 		},
 		{
 			name: "arbitrary-input",
 			input: model.RawConcurrency{
 				Group: "${{ inputs.eval_arbitrary_input }}",
 			},
-			group:            "456",
-			cancelInProgress: false,
+			group:               "456",
+			cancelInProgressNil: true,
+		},
+		{
+			name: "cancel-in-progress-only",
+			input: model.RawConcurrency{
+				CancelInProgress: "true",
+			},
+			group:            "",
+			cancelInProgress: true,
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			group, cancelInProgress, err := EvaluateConcurrency(
+			group, cancelInProgress, err := EvaluateWorkflowConcurrency(
 				&test.input,
-				"job-id",
-				nil, // job
-				map[string]any{
-					"workflow": "test_workflow",
-					"ref":      "main",
-					"event": map[string]any{
+				// gitCtx
+				&model.GithubContext{
+					Workflow: "test_workflow",
+					Ref:      "main",
+					Event: map[string]any{
 						"commits": []any{
 							map[string]any{
 								"author": map[string]any{
@@ -437,20 +504,24 @@ func TestEvaluateConcurrency(t *testing.T) {
 							},
 						},
 					},
-				}, // gitCtx
-				map[string]*JobResult{
-					"job-id": {},
-				}, // results
+				},
+				// vars
 				map[string]string{
 					"eval_arbitrary_var": "123",
-				}, // vars
+				},
+				// inputs
 				map[string]any{
 					"eval_arbitrary_input": "456",
-				}, // inputs
+				},
 			)
 			assert.NoError(t, err)
 			assert.EqualValues(t, test.group, group)
-			assert.EqualValues(t, test.cancelInProgress, cancelInProgress)
+			if test.cancelInProgressNil {
+				assert.Nil(t, cancelInProgress)
+			} else {
+				require.NotNil(t, cancelInProgress)
+				assert.EqualValues(t, test.cancelInProgress, *cancelInProgress)
+			}
 		})
 	}
 }

act/jobparser/testdata_test.go

@@ -6,7 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 
 	"github.com/stretchr/testify/require"
 )

act/model/action.go

@@ -5,7 +5,7 @@ import (
 	"io"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/schema"
+	"code.forgejo.org/forgejo/runner/v11/act/schema"
 	"go.yaml.in/yaml/v3"
 )
 

act/model/github_context.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/common/git"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common/git"
 )
 
 type GithubContext struct {

act/model/workflow.go

@@ -13,8 +13,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/schema"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/schema"
 	log "github.com/sirupsen/logrus"
 	"go.yaml.in/yaml/v3"
 )

act/runner/action.go

@@ -16,9 +16,9 @@ import (
 
 	"github.com/kballard/go-shellquote"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 type actionStep interface {
@@ -277,7 +277,6 @@ func removeGitIgnore(ctx context.Context, directory string) error {
 	return nil
 }
 
-// TODO: break out parts of function to reduce complexicity
 func execAsDocker(ctx context.Context, step actionStep, actionName, basedir string, localAction bool) error {
 	logger := common.Logger(ctx)
 	rc := step.getRunContext()
@@ -291,10 +290,11 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, basedir stri
 		// Apply forcePull only for prebuild docker images
 		forcePull = rc.Config.ForcePull
 	} else {
-		// "-dockeraction" enshures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
-		image = fmt.Sprintf("%s-dockeraction:%s", regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(actionName, "-"), "latest")
-		image = fmt.Sprintf("act-%s", strings.TrimLeft(image, "-"))
-		image = strings.ToLower(image)
+		if localAction {
+			image = fmt.Sprintf("runner-local-docker-action-%s:latest", common.MustRandName(16))
+		} else {
+			image = fmt.Sprintf("runner-remote-docker-action-%s:latest", common.Sha256(step.getStepModel().Uses))
+		}
 		contextDir, fileName := filepath.Split(filepath.Join(basedir, action.Runs.Image))
 
 		anyArchExists, err := container.ImageExistsLocally(ctx, image, "any")

act/runner/action_cache.go

@@ -18,7 +18,7 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/transport"
 	"github.com/go-git/go-git/v5/plumbing/transport/http"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 )
 
 type ActionCache interface {

act/runner/action_composite.go

@@ -6,8 +6,8 @@ import (
 	"regexp"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 func evaluateCompositeInputAndEnv(ctx context.Context, parent *RunContext, step actionStep) map[string]string {

act/runner/action_test.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )

act/runner/command.go

@@ -5,7 +5,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 
 	"github.com/sirupsen/logrus"
 )

act/runner/command_test.go

@@ -9,8 +9,8 @@ import (
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 func TestCommandSetEnv(t *testing.T) {

act/runner/container_mock_test.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"io"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
 	"github.com/stretchr/testify/mock"
 )
 

act/runner/expression.go

@@ -13,10 +13,10 @@ import (
 
 	_ "embed"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/exprparser"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"go.yaml.in/yaml/v3"
 )
 
@@ -479,8 +479,6 @@ func rewriteSubExpression(ctx context.Context, in string, forceFormat bool) (str
 func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *model.GithubContext) map[string]any {
 	inputs := map[string]any{}
 
-	setupWorkflowInputs(ctx, &inputs, rc)
-
 	var env map[string]string
 	if step != nil {
 		env = *step.getEnv()
@@ -494,6 +492,8 @@ func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *mod
 		}
 	}
 
+	setupWorkflowInputs(ctx, &inputs, rc)
+
 	if rc.caller == nil && ghc.EventName == "workflow_dispatch" {
 		config := rc.Run.Workflow.WorkflowDispatchConfig()
 		if config != nil && config.Inputs != nil {

act/runner/expression_test.go

@@ -3,8 +3,8 @@ package runner
 import (
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/exprparser"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	assert "github.com/stretchr/testify/assert"
 	yaml "go.yaml.in/yaml/v3"
 )

act/runner/job_executor.go

@@ -5,9 +5,10 @@ import (
 	"fmt"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
+	"github.com/sirupsen/logrus"
 )
 
 type jobInfo interface {
@@ -104,37 +105,40 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 		}
 	}
 
-	postExecutor = postExecutor.Finally(func(ctx context.Context) error {
+	setJobResults := func(ctx context.Context) error {
 		jobError := common.JobError(ctx)
 
 		// Fresh context to ensure job result output works even if prev. context was a cancelled job
 		ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
 		defer cancel()
 		setJobResult(ctx, info, rc, jobError == nil)
-		setJobOutputs(ctx, rc)
 
+		return nil
+	}
+
+	cleanupJob := func(_ context.Context) error {
 		var err error
-		{
-			// Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job
-			ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
-			defer cancel()
 
-			logger := common.Logger(ctx)
-			logger.Debugf("Cleaning up container for job %s", rc.jobContainerName())
-			if err = info.stopContainer()(ctx); err != nil {
-				logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err)
-			}
+		// Separate timeout for cleanup tasks; logger is cleared so that cleanup logs go to runner, not job
+		ctx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
+		defer cancel()
 
-			if !rc.IsHostEnv(ctx) && rc.getNetworkCreated(ctx) {
-				networkName := rc.getNetworkName(ctx)
-				logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName())
-				if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil {
-					logger.Errorf("Error while cleaning network %s: %v", networkName, err)
-				}
+		logger := common.Logger(ctx)
+		logger.Debugf("Cleaning up container for job %s", rc.jobContainerName())
+		if err = info.stopContainer()(ctx); err != nil {
+			logger.Errorf("Error while stop job container %s: %v", rc.jobContainerName(), err)
+		}
+
+		if !rc.IsHostEnv(ctx) && rc.getNetworkCreated(ctx) {
+			networkName := rc.getNetworkName(ctx)
+			logger.Debugf("Cleaning up network %s for job %s", networkName, rc.jobContainerName())
+			if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil {
+				logger.Errorf("Error while cleaning network %s: %v", networkName, err)
 			}
 		}
+
 		return err
-	})
+	}
 
 	pipeline := make([]common.Executor, 0)
 	pipeline = append(pipeline, preSteps...)
@@ -152,6 +156,8 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 			return postExecutor(ctx)
 		}).
 		Finally(info.interpolateOutputs()).
+		Finally(setJobResults).
+		Finally(cleanupJob).
 		Finally(info.closeContainer()))
 }
 
@@ -174,33 +180,42 @@ func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success boo
 		jobResult = "failure"
 	}
 
+	// Set local result on current job (child or parent)
 	info.result(jobResult)
+
 	if rc.caller != nil {
-		// set reusable workflow job result
+		// Child reusable workflow:
+		// 1) propagate result to parent job state
 		rc.caller.runContext.result(jobResult)
+
+		// 2) copy workflow_call outputs from child to parent (as in upstream)
+		jobOutputs := make(map[string]string)
+		ee := rc.NewExpressionEvaluator(ctx)
+		if wfcc := rc.Run.Workflow.WorkflowCallConfig(); wfcc != nil {
+			for k, v := range wfcc.Outputs {
+				jobOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value))
+			}
+		}
+		rc.caller.runContext.Run.Job().Outputs = jobOutputs
+
+		// 3) DO NOT print banner in child job (prevents premature token revocation)
+		logger.Debugf("Reusable job result=%s (parent will finalize, no banner)", jobResult)
+		return
 	}
 
+	// Parent job: print the final banner ONCE (job-level)
 	jobResultMessage := "succeeded"
 	if jobResult != "success" {
 		jobResultMessage = "failed"
 	}
+	jobOutputs := rc.Run.Job().Outputs
 
-	logger.WithField("jobResult", jobResult).Infof("\U0001F3C1  Job %s", jobResultMessage)
-}
-
-func setJobOutputs(ctx context.Context, rc *RunContext) {
-	if rc.caller != nil {
-		// map outputs for reusable workflows
-		callerOutputs := make(map[string]string)
-
-		ee := rc.NewExpressionEvaluator(ctx)
-
-		for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs {
-			callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value))
-		}
-
-		rc.caller.runContext.Run.Job().Outputs = callerOutputs
-	}
+	logger.
+		WithFields(logrus.Fields{
+			"jobResult":  jobResult,
+			"jobOutputs": jobOutputs,
+		}).
+		Infof("\U0001F3C1  Job %s", jobResultMessage)
 }
 
 func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor {

act/runner/job_executor_test.go

@@ -9,13 +9,17 @@ import (
 	"testing"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/runner/mocks"
+	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )
 
+//go:generate mockery --srcpkg=github.com/sirupsen/logrus --name=FieldLogger
+
 func TestJobExecutor(t *testing.T) {
 	tables := []TestJobFileInfo{
 		{workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets},
@@ -127,8 +131,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 			executedSteps: []string{
 				"startContainer",
 				"step1",
-				"stopContainer",
 				"interpolateOutputs",
+				"setJobResults",
+				"stopContainer",
 				"closeContainer",
 			},
 			result:   "success",
@@ -144,8 +149,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 			executedSteps: []string{
 				"startContainer",
 				"step1",
-				"stopContainer",
 				"interpolateOutputs",
+				"setJobResults",
+				"stopContainer",
 				"closeContainer",
 			},
 			result:   "failure",
@@ -162,8 +168,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 				"startContainer",
 				"pre1",
 				"step1",
-				"stopContainer",
 				"interpolateOutputs",
+				"setJobResults",
+				"stopContainer",
 				"closeContainer",
 			},
 			result:   "success",
@@ -180,8 +187,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 				"startContainer",
 				"step1",
 				"post1",
-				"stopContainer",
 				"interpolateOutputs",
+				"setJobResults",
+				"stopContainer",
 				"closeContainer",
 			},
 			result:   "success",
@@ -199,8 +207,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 				"pre1",
 				"step1",
 				"post1",
-				"stopContainer",
 				"interpolateOutputs",
+				"setJobResults",
+				"stopContainer",
 				"closeContainer",
 			},
 			result:   "success",
@@ -229,8 +238,9 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 				"step3",
 				"post3",
 				"post2",
-				"stopContainer",
 				"interpolateOutputs",
+				"setJobResults",
+				"stopContainer",
 				"closeContainer",
 			},
 			result:   "success",
@@ -246,7 +256,27 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			fmt.Printf("::group::%s\n", tt.name)
 
-			ctx := common.WithJobErrorContainer(t.Context())
+			executorOrder := make([]string, 0)
+
+			mockLogger := mocks.NewFieldLogger(t)
+			mockLogger.On("Debugf", mock.Anything, mock.Anything).Return(0).Maybe()
+			mockLogger.On("Warningf", mock.Anything, mock.Anything).Return(0).Maybe()
+			mockLogger.On("WithField", mock.Anything, mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe()
+			// When `WithFields()` is called with jobResult & jobOutputs field, add `setJobResults` to executorOrder.
+			mockLogger.On("WithFields",
+				mock.MatchedBy(func(fields logrus.Fields) bool {
+					_, okJobResult := fields["jobResult"]
+					_, okJobOutput := fields["jobOutputs"]
+					return okJobOutput && okJobResult
+				})).
+				Run(func(args mock.Arguments) {
+					executorOrder = append(executorOrder, "setJobResults")
+				}).
+				Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe()
+
+			mockLogger.On("WithFields", mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe()
+
+			ctx := common.WithLogger(common.WithJobErrorContainer(t.Context()), mockLogger)
 			jim := &jobInfoMock{}
 			sfm := &stepFactoryMock{}
 			rc := &RunContext{
@@ -262,7 +292,6 @@ func TestJobExecutorNewJobExecutor(t *testing.T) {
 				Config: &Config{},
 			}
 			rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-			executorOrder := make([]string, 0)
 
 			jim.On("steps").Return(tt.steps)
 
@@ -415,3 +444,76 @@ func TestSetJobResultConcurrency(t *testing.T) {
 
 	assert.Equal(t, "failure", lastResult)
 }
+
+func TestSetJobResult_SkipsBannerInChildReusableWorkflow(t *testing.T) {
+	// Test that child reusable workflow does not print final banner
+	// to prevent premature token revocation
+
+	mockLogger := mocks.NewFieldLogger(t)
+	// Allow all variants of Debugf (git operations can call with 1-3 args)
+	mockLogger.On("Debugf", mock.Anything).Return(0).Maybe()
+	mockLogger.On("Debugf", mock.Anything, mock.Anything).Return(0).Maybe()
+	mockLogger.On("Debugf", mock.Anything, mock.Anything, mock.Anything).Return(0).Maybe()
+	// CRITICAL: In CI, git ref detection may fail and call Warningf
+	mockLogger.On("Warningf", mock.Anything, mock.Anything).Return(0).Maybe()
+	mockLogger.On("WithField", mock.Anything, mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe()
+	mockLogger.On("WithFields", mock.Anything).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Maybe()
+
+	ctx := common.WithLogger(common.WithJobErrorContainer(t.Context()), mockLogger)
+
+	// Setup parent job
+	parentJob := &model.Job{
+		Result: "success",
+	}
+	parentRC := &RunContext{
+		Config: &Config{Env: map[string]string{}}, // Must have Config
+		Run: &model.Run{
+			JobID: "parent",
+			Workflow: &model.Workflow{
+				Jobs: map[string]*model.Job{
+					"parent": parentJob,
+				},
+			},
+		},
+	}
+
+	// Setup child job with caller reference
+	childJob := &model.Job{
+		Result: "success",
+	}
+	childRC := &RunContext{
+		Config: &Config{Env: map[string]string{}}, // Must have Config
+		Run: &model.Run{
+			JobID: "child",
+			Workflow: &model.Workflow{
+				Jobs: map[string]*model.Job{
+					"child": childJob,
+				},
+			},
+		},
+		caller: &caller{
+			runContext: parentRC,
+		},
+	}
+
+	jim := &jobInfoMock{}
+	jim.On("matrix").Return(map[string]any{}) // REQUIRED: setJobResult always calls matrix()
+	jim.On("result", "success")
+
+	// Call setJobResult for child workflow
+	setJobResult(ctx, jim, childRC, true)
+
+	// Verify:
+	// 1. Child result is set
+	jim.AssertCalled(t, "result", "success")
+
+	// 2. Parent result is propagated
+	assert.Equal(t, "success", parentJob.Result)
+
+	// 3. Final banner was NOT printed by child (critical for token security)
+	mockLogger.AssertNotCalled(t, "WithFields", mock.MatchedBy(func(fields logrus.Fields) bool {
+		_, okJobResult := fields["jobResult"]
+		_, okJobOutput := fields["jobOutputs"]
+		return okJobOutput && okJobResult
+	}))
+}

act/runner/local_repository_cache.go

@@ -12,7 +12,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/filecollector"
+	"code.forgejo.org/forgejo/runner/v11/act/filecollector"
 )
 
 type LocalRepositoryCache struct {

act/runner/logger.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"sync"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
 
 	"github.com/sirupsen/logrus"
 	"golang.org/x/term"
@@ -146,6 +146,26 @@ func WithCompositeStepLogger(ctx context.Context, stepID string) context.Context
 	}).WithContext(ctx))
 }
 
+func GetOuterStepResult(entry *logrus.Entry) any {
+	r, ok := entry.Data["stepResult"]
+	if !ok {
+		return nil
+	}
+
+	// composite actions steps log with a list of stepID
+	if s, ok := entry.Data["stepID"]; ok {
+		if stepIDs, ok := s.([]string); ok {
+			if len(stepIDs) > 1 {
+				return nil
+			}
+		}
+	} else {
+		return nil
+	}
+
+	return r
+}
+
 func withStepLogger(ctx context.Context, stepNumber int, stepID, stepName, stageName string) context.Context {
 	rtn := common.Logger(ctx).WithFields(logrus.Fields{
 		"stepNumber": stepNumber,

act/runner/logger_test.go

@@ -0,0 +1,63 @@
+package runner
+
+import (
+	"testing"
+
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+
+	"github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunner_GetOuterStepResult(t *testing.T) {
+	nullLogger, hook := test.NewNullLogger()
+	ctx := common.WithLogger(t.Context(), nullLogger)
+
+	t.Run("no stepResult", func(t *testing.T) {
+		hook.Reset()
+		common.Logger(ctx).Info("✅ Success")
+		entry := hook.LastEntry()
+		require.NotNil(t, entry)
+		assert.Nil(t, GetOuterStepResult(entry))
+	})
+
+	t.Run("stepResult and no stepID", func(t *testing.T) {
+		hook.Reset()
+		common.Logger(ctx).WithField("stepResult", "success").Info("✅ Success")
+		entry := hook.LastEntry()
+		require.NotNil(t, entry)
+		assert.Nil(t, GetOuterStepResult(entry))
+	})
+
+	stepNumber := 123
+	stepID := "step id"
+	stepName := "readable name"
+	stageName := "Main"
+	ctx = withStepLogger(ctx, stepNumber, stepID, stepName, stageName)
+
+	t.Run("stepResult and stepID", func(t *testing.T) {
+		hook.Reset()
+		common.Logger(ctx).WithField("stepResult", "success").Info("✅ Success")
+		entry := hook.LastEntry()
+		actualStepIDs, ok := entry.Data["stepID"]
+		require.True(t, ok)
+		require.Equal(t, []string{stepID}, actualStepIDs)
+		require.NotNil(t, entry)
+		assert.Equal(t, "success", GetOuterStepResult(entry))
+	})
+
+	compositeStepID := "composite step id"
+	ctx = WithCompositeStepLogger(ctx, compositeStepID)
+
+	t.Run("stepResult and composite stepID", func(t *testing.T) {
+		hook.Reset()
+		common.Logger(ctx).WithField("stepResult", "success").Info("✅ Success")
+		entry := hook.LastEntry()
+		actualStepIDs, ok := entry.Data["stepID"]
+		require.True(t, ok)
+		require.Equal(t, []string{stepID, compositeStepID}, actualStepIDs)
+		require.NotNil(t, entry)
+		assert.Nil(t, GetOuterStepResult(entry))
+	})
+}

act/runner/lxc-helpers-lib.sh

@@ -11,6 +11,8 @@ LXC_IPV6_PREFIX_DEFAULT="fd15"
 LXC_DOCKER_PREFIX_DEFAULT="172.17"
 LXC_IPV6_DOCKER_PREFIX_DEFAULT="fd00:d0ca"
 LXC_APT_TOO_OLD='1 week ago'
+: ${LXC_TRANSACTION_TIMEOUT:=600}
+LXC_TRANSACTION_LOCK_FILE=/tmp/lxc-helper.lock
 
 : ${LXC_SUDO:=}
 : ${LXC_CONTAINER_RELEASE:=bookworm}
@@ -28,16 +30,22 @@ function lxc_template_release() {
     echo lxc-helpers-$LXC_CONTAINER_RELEASE
 }
 
+function lxc_directory() {
+    local name="$1"
+
+    echo /var/lib/lxc/$name
+}
+
 function lxc_root() {
     local name="$1"
 
-    echo /var/lib/lxc/$name/rootfs
+    echo $(lxc_directory $name)/rootfs
 }
 
 function lxc_config() {
     local name="$1"
 
-    echo /var/lib/lxc/$name/config
+    echo $(lxc_directory $name)/config
 }
 
 function lxc_container_run() {
@@ -47,6 +55,42 @@ function lxc_container_run() {
     $LXC_SUDO lxc-attach --clear-env --name $name -- "$@"
 }
 
+function lxc_transaction_lock() {
+    exec 7>$LXC_TRANSACTION_LOCK_FILE
+    flock --timeout $LXC_TRANSACTION_TIMEOUT 7
+}
+
+function lxc_transaction_unlock() {
+    exec 7>&-
+}
+
+function lxc_transaction_draft_name() {
+    echo "lxc-helper-draft"
+}
+
+function lxc_transaction_begin() {
+    local name=$1 # not actually used but it helps when reading in the caller
+    local draft=$(lxc_transaction_draft_name)
+
+    lxc_transaction_lock
+    lxc_container_destroy $draft
+}
+
+function lxc_transaction_commit() {
+    local name=$1
+    local draft=$(lxc_transaction_draft_name)
+
+    # do not use lxc-copy because it is not atomic if lxc-copy is
+    # interrupted it may leave the $name container half populated
+    $LXC_SUDO sed -i -e "s/$draft/$name/g" \
+        $(lxc_config $draft) \
+        $(lxc_root $draft)/etc/hosts \
+        $(lxc_root $draft)/etc/hostname
+    $LXC_SUDO rm -f $(lxc_root $draft)/var/lib/dhcp/dhclient.*
+    $LXC_SUDO mv $(lxc_directory $draft) $(lxc_directory $name)
+    lxc_transaction_unlock
+}
+
 function lxc_container_run_script_as() {
     local name="$1"
     local user="$2"
@@ -242,7 +286,7 @@ function lxc_container_configure() {
 function lxc_container_install_lxc_helpers() {
     local name="$1"
 
-    $LXC_SUDO cp -a $LXC_SELF_DIR/lxc-helpers*.sh $root/$LXC_BIN
+    $LXC_SUDO cp -a $LXC_SELF_DIR/lxc-helpers*.sh $(lxc_root $name)/$LXC_BIN
     #
     # Wait for the network to come up
     #
@@ -304,10 +348,9 @@ function lxc_container_stop() {
 
 function lxc_container_destroy() {
     local name="$1"
-    local root="$2"
 
     if lxc_exists "$name"; then
-        lxc_container_stop $name $root
+        lxc_container_stop $name
         $LXC_SUDO lxc-destroy --force --name="$name"
     fi
 }
@@ -342,36 +385,44 @@ function lxc_running() {
 function lxc_build_template_release() {
     local name="$(lxc_template_release)"
 
+    lxc_transaction_begin $name
+
     if lxc_exists_and_apt_not_old $name; then
+        lxc_transaction_unlock
         return
     fi
 
-    local root=$(lxc_root $name)
-    $LXC_SUDO lxc-create --name $name --template debian -- --release=$LXC_CONTAINER_RELEASE
-    echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $name)
-    lxc_container_install_lxc_helpers $name
-    lxc_container_start $name
-    lxc_container_run $name apt-get update -qq
-    lxc_apt_install $name sudo git python3
-    lxc_container_stop $name
+    local draft=$(lxc_transaction_draft_name)
+    $LXC_SUDO lxc-create --name $draft --template debian -- --release=$LXC_CONTAINER_RELEASE
+    echo 'lxc.apparmor.profile = unconfined' | $LXC_SUDO tee -a $(lxc_config $draft)
+    lxc_container_install_lxc_helpers $draft
+    lxc_container_start $draft
+    lxc_container_run $draft apt-get update -qq
+    lxc_apt_install $draft sudo git python3
+    lxc_container_stop $draft
+    lxc_transaction_commit $name
 }
 
 function lxc_build_template() {
     local name="$1"
     local newname="$2"
 
-    if lxc_exists_and_apt_not_old $newname; then
-        return
-    fi
-
     if test "$name" = "$(lxc_template_release)"; then
         lxc_build_template_release
     fi
 
-    if ! $LXC_SUDO lxc-copy --name=$name --newname=$newname; then
-        echo lxc-copy --name=$name --newname=$newname failed
+    lxc_transaction_begin $name
+    if lxc_exists_and_apt_not_old $newname; then
+        lxc_transaction_unlock
+        return
+    fi
+
+    local draft=$(lxc_transaction_draft_name)
+    if ! $LXC_SUDO lxc-copy --name=$name --newname=$draft; then
+        echo lxc-copy --name=$name --newname=$draft failed
         return 1
     fi
+    lxc_transaction_commit $newname
     lxc_container_configure $newname
 }
 
@@ -413,7 +464,7 @@ function lxc_install_lxc_inside() {
     local prefixv6="${2:-$LXC_IPV6_PREFIX_DEFAULT}"
 
     local packages="make git libvirt0 libpam-cgfs bridge-utils uidmap dnsmasq-base dnsmasq dnsmasq-utils qemu-user-static lxc-templates debootstrap"
-    if test "$(lxc_release)" = bookworm; then
+    if test "$(lxc_release)" != bullseye; then
         packages="$packages distro-info"
     fi
 

act/runner/lxc-helpers.sh

@@ -18,11 +18,11 @@ lxc-helpers.sh - LXC container management helpers
 SYNOPSIS
 
    lxc-helpers.sh [-v|--verbose] [-h|--help]
-		  [-o|--os {bookworm|bullseye} (default bookworm)]
+		  [-o|--os {trixie|bookworm|bullseye} (default bookworm)]
 		  command [arguments]
 
    lxc-helpers.sh [-v|--verbose] [-h|--help]
-		  [-o|--os {bookworm|bullseye} (default bookworm)]
+		  [-o|--os {trixie|bookworm|bullseye} (default bookworm)]
 		  [-c|--config {unprivileged lxc libvirt docker k8s} (default "lxc libvirt docker")]
 		  lxc_container_create [arguments]
 

act/runner/mocks/FieldLogger.go

@@ -0,0 +1,264 @@
+// Code generated by mockery v2.53.5. DO NOT EDIT.
+
+package mocks
+
+import (
+	logrus "github.com/sirupsen/logrus"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// FieldLogger is an autogenerated mock type for the FieldLogger type
+type FieldLogger struct {
+	mock.Mock
+}
+
+// Debug provides a mock function with given fields: args
+func (_m *FieldLogger) Debug(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Debugf provides a mock function with given fields: format, args
+func (_m *FieldLogger) Debugf(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Debugln provides a mock function with given fields: args
+func (_m *FieldLogger) Debugln(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Error provides a mock function with given fields: args
+func (_m *FieldLogger) Error(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Errorf provides a mock function with given fields: format, args
+func (_m *FieldLogger) Errorf(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Errorln provides a mock function with given fields: args
+func (_m *FieldLogger) Errorln(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Fatal provides a mock function with given fields: args
+func (_m *FieldLogger) Fatal(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Fatalf provides a mock function with given fields: format, args
+func (_m *FieldLogger) Fatalf(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Fatalln provides a mock function with given fields: args
+func (_m *FieldLogger) Fatalln(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Info provides a mock function with given fields: args
+func (_m *FieldLogger) Info(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Infof provides a mock function with given fields: format, args
+func (_m *FieldLogger) Infof(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Infoln provides a mock function with given fields: args
+func (_m *FieldLogger) Infoln(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Panic provides a mock function with given fields: args
+func (_m *FieldLogger) Panic(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Panicf provides a mock function with given fields: format, args
+func (_m *FieldLogger) Panicf(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Panicln provides a mock function with given fields: args
+func (_m *FieldLogger) Panicln(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Print provides a mock function with given fields: args
+func (_m *FieldLogger) Print(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Printf provides a mock function with given fields: format, args
+func (_m *FieldLogger) Printf(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Println provides a mock function with given fields: args
+func (_m *FieldLogger) Println(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Warn provides a mock function with given fields: args
+func (_m *FieldLogger) Warn(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Warnf provides a mock function with given fields: format, args
+func (_m *FieldLogger) Warnf(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Warning provides a mock function with given fields: args
+func (_m *FieldLogger) Warning(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Warningf provides a mock function with given fields: format, args
+func (_m *FieldLogger) Warningf(format string, args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, format)
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Warningln provides a mock function with given fields: args
+func (_m *FieldLogger) Warningln(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// Warnln provides a mock function with given fields: args
+func (_m *FieldLogger) Warnln(args ...interface{}) {
+	var _ca []interface{}
+	_ca = append(_ca, args...)
+	_m.Called(_ca...)
+}
+
+// WithError provides a mock function with given fields: err
+func (_m *FieldLogger) WithError(err error) *logrus.Entry {
+	ret := _m.Called(err)
+
+	if len(ret) == 0 {
+		panic("no return value specified for WithError")
+	}
+
+	var r0 *logrus.Entry
+	if rf, ok := ret.Get(0).(func(error) *logrus.Entry); ok {
+		r0 = rf(err)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*logrus.Entry)
+		}
+	}
+
+	return r0
+}
+
+// WithField provides a mock function with given fields: key, value
+func (_m *FieldLogger) WithField(key string, value interface{}) *logrus.Entry {
+	ret := _m.Called(key, value)
+
+	if len(ret) == 0 {
+		panic("no return value specified for WithField")
+	}
+
+	var r0 *logrus.Entry
+	if rf, ok := ret.Get(0).(func(string, interface{}) *logrus.Entry); ok {
+		r0 = rf(key, value)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*logrus.Entry)
+		}
+	}
+
+	return r0
+}
+
+// WithFields provides a mock function with given fields: fields
+func (_m *FieldLogger) WithFields(fields logrus.Fields) *logrus.Entry {
+	ret := _m.Called(fields)
+
+	if len(ret) == 0 {
+		panic("no return value specified for WithFields")
+	}
+
+	var r0 *logrus.Entry
+	if rf, ok := ret.Get(0).(func(logrus.Fields) *logrus.Entry); ok {
+		r0 = rf(fields)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*logrus.Entry)
+		}
+	}
+
+	return r0
+}
+
+// NewFieldLogger creates a new instance of FieldLogger. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewFieldLogger(t interface {
+	mock.TestingT
+	Cleanup(func())
+},
+) *FieldLogger {
+	mock := &FieldLogger{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

act/runner/reusable_workflow.go

@@ -13,9 +13,10 @@ import (
 	"strings"
 	"sync"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/common/git"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common/git"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
+	"github.com/sirupsen/logrus"
 )
 
 func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
@@ -115,7 +116,10 @@ func newActionCacheReusableWorkflowExecutor(rc *RunContext, filename string, rem
 			return err
 		}
 
-		return runner.NewPlanExecutor(plan)(ctx)
+		planErr := runner.NewPlanExecutor(plan)(ctx)
+
+		// Finalize from parent context: one job-level banner
+		return finalizeReusableWorkflow(ctx, rc, planErr)
 	}
 }
 
@@ -171,7 +175,10 @@ func newReusableWorkflowExecutor(rc *RunContext, directory, workflow string) com
 			return err
 		}
 
-		return runner.NewPlanExecutor(plan)(ctx)
+		planErr := runner.NewPlanExecutor(plan)(ctx)
+
+		// Finalize from parent context: one job-level banner
+		return finalizeReusableWorkflow(ctx, rc, planErr)
 	}
 }
 
@@ -229,3 +236,29 @@ func newRemoteReusableWorkflowWithPlat(url, uses string) *remoteReusableWorkflow
 		URL:         url,
 	}
 }
+
+// finalizeReusableWorkflow prints the final job banner from the parent job context.
+//
+// The Forgejo reporter waits for this banner (log entry with "jobResult"
+// field and without stage="Main") before marking the job as complete and revoking
+// tokens. Printing this banner from the child reusable workflow would cause
+// premature token revocation, breaking subsequent steps in the parent workflow.
+func finalizeReusableWorkflow(ctx context.Context, rc *RunContext, planErr error) error {
+	jobResult := "success"
+	jobResultMessage := "succeeded"
+	if planErr != nil {
+		jobResult = "failure"
+		jobResultMessage = "failed"
+	}
+
+	// Outputs should already be present in the parent context:
+	// - copied by child's setJobResult branch (rc.caller != nil)
+	jobOutputs := rc.Run.Job().Outputs
+
+	common.Logger(ctx).WithFields(logrus.Fields{
+		"jobResult":  jobResult,
+		"jobOutputs": jobOutputs,
+	}).Infof("\U0001F3C1  Job %s", jobResultMessage)
+
+	return planErr
+}

act/runner/reusable_workflow_test.go

@@ -0,0 +1,247 @@
+package runner
+
+import (
+	"errors"
+	"testing"
+
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/runner/mocks"
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestConfig_GetToken(t *testing.T) {
+	t.Run("returns GITEA_TOKEN when both GITEA_TOKEN and GITHUB_TOKEN present", func(t *testing.T) {
+		c := &Config{
+			Secrets: map[string]string{
+				"GITHUB_TOKEN": "github-token",
+				"GITEA_TOKEN":  "gitea-token",
+			},
+		}
+		assert.Equal(t, "gitea-token", c.GetToken())
+	})
+
+	t.Run("returns GITHUB_TOKEN when only GITHUB_TOKEN present", func(t *testing.T) {
+		c := &Config{
+			Secrets: map[string]string{
+				"GITHUB_TOKEN": "github-token",
+			},
+		}
+		assert.Equal(t, "github-token", c.GetToken())
+	})
+
+	t.Run("returns empty string when no tokens present", func(t *testing.T) {
+		c := &Config{
+			Secrets: map[string]string{},
+		}
+		assert.Equal(t, "", c.GetToken())
+	})
+
+	t.Run("returns empty string when Secrets is nil", func(t *testing.T) {
+		c := &Config{}
+		assert.Equal(t, "", c.GetToken())
+	})
+}
+
+func TestRemoteReusableWorkflow_CloneURL(t *testing.T) {
+	t.Run("adds https prefix when missing", func(t *testing.T) {
+		rw := &remoteReusableWorkflow{
+			URL:  "code.forgejo.org",
+			Org:  "owner",
+			Repo: "repo",
+		}
+		assert.Equal(t, "https://code.forgejo.org/owner/repo", rw.CloneURL())
+	})
+
+	t.Run("preserves https prefix", func(t *testing.T) {
+		rw := &remoteReusableWorkflow{
+			URL:  "https://code.forgejo.org",
+			Org:  "owner",
+			Repo: "repo",
+		}
+		assert.Equal(t, "https://code.forgejo.org/owner/repo", rw.CloneURL())
+	})
+
+	t.Run("preserves http prefix", func(t *testing.T) {
+		rw := &remoteReusableWorkflow{
+			URL:  "http://localhost:3000",
+			Org:  "owner",
+			Repo: "repo",
+		}
+		assert.Equal(t, "http://localhost:3000/owner/repo", rw.CloneURL())
+	})
+}
+
+func TestRemoteReusableWorkflow_FilePath(t *testing.T) {
+	tests := []struct {
+		name         string
+		gitPlatform  string
+		filename     string
+		expectedPath string
+	}{
+		{
+			name:         "github platform",
+			gitPlatform:  "github",
+			filename:     "test.yml",
+			expectedPath: "./.github/workflows/test.yml",
+		},
+		{
+			name:         "gitea platform",
+			gitPlatform:  "gitea",
+			filename:     "build.yaml",
+			expectedPath: "./.gitea/workflows/build.yaml",
+		},
+		{
+			name:         "forgejo platform",
+			gitPlatform:  "forgejo",
+			filename:     "deploy.yml",
+			expectedPath: "./.forgejo/workflows/deploy.yml",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rw := &remoteReusableWorkflow{
+				GitPlatform: tt.gitPlatform,
+				Filename:    tt.filename,
+			}
+			assert.Equal(t, tt.expectedPath, rw.FilePath())
+		})
+	}
+}
+
+func TestNewRemoteReusableWorkflowWithPlat(t *testing.T) {
+	tests := []struct {
+		name             string
+		url              string
+		uses             string
+		expectedOrg      string
+		expectedRepo     string
+		expectedPlatform string
+		expectedFilename string
+		expectedRef      string
+		shouldFail       bool
+	}{
+		{
+			name:             "valid github workflow",
+			url:              "github.com",
+			uses:             "owner/repo/.github/workflows/test.yml@main",
+			expectedOrg:      "owner",
+			expectedRepo:     "repo",
+			expectedPlatform: "github",
+			expectedFilename: "test.yml",
+			expectedRef:      "main",
+			shouldFail:       false,
+		},
+		{
+			name:             "valid gitea workflow",
+			url:              "code.forgejo.org",
+			uses:             "forgejo/runner/.gitea/workflows/build.yaml@v1.0.0",
+			expectedOrg:      "forgejo",
+			expectedRepo:     "runner",
+			expectedPlatform: "gitea",
+			expectedFilename: "build.yaml",
+			expectedRef:      "v1.0.0",
+			shouldFail:       false,
+		},
+		{
+			name:       "invalid format - missing platform",
+			url:        "github.com",
+			uses:       "owner/repo/workflows/test.yml@main",
+			shouldFail: true,
+		},
+		{
+			name:       "invalid format - no ref",
+			url:        "github.com",
+			uses:       "owner/repo/.github/workflows/test.yml",
+			shouldFail: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := newRemoteReusableWorkflowWithPlat(tt.url, tt.uses)
+
+			if tt.shouldFail {
+				assert.Nil(t, result)
+			} else {
+				assert.NotNil(t, result)
+				assert.Equal(t, tt.expectedOrg, result.Org)
+				assert.Equal(t, tt.expectedRepo, result.Repo)
+				assert.Equal(t, tt.expectedPlatform, result.GitPlatform)
+				assert.Equal(t, tt.expectedFilename, result.Filename)
+				assert.Equal(t, tt.expectedRef, result.Ref)
+				assert.Equal(t, tt.url, result.URL)
+			}
+		})
+	}
+}
+
+func TestFinalizeReusableWorkflow_PrintsBannerSuccess(t *testing.T) {
+	mockLogger := mocks.NewFieldLogger(t)
+
+	bannerCalled := false
+	mockLogger.On("WithFields",
+		mock.MatchedBy(func(fields logrus.Fields) bool {
+			result, ok := fields["jobResult"].(string)
+			if !ok || result != "success" {
+				return false
+			}
+			outs, ok := fields["jobOutputs"].(map[string]string)
+			return ok && outs["foo"] == "bar"
+		}),
+	).Run(func(args mock.Arguments) {
+		bannerCalled = true
+	}).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Once()
+
+	ctx := common.WithLogger(t.Context(), mockLogger)
+	rc := &RunContext{
+		Run: &model.Run{
+			JobID: "parent",
+			Workflow: &model.Workflow{
+				Jobs: map[string]*model.Job{
+					"parent": {
+						Outputs: map[string]string{"foo": "bar"},
+					},
+				},
+			},
+		},
+	}
+
+	err := finalizeReusableWorkflow(ctx, rc, nil)
+	assert.NoError(t, err)
+	assert.True(t, bannerCalled, "final banner should be printed from parent")
+}
+
+func TestFinalizeReusableWorkflow_PrintsBannerFailure(t *testing.T) {
+	mockLogger := mocks.NewFieldLogger(t)
+
+	bannerCalled := false
+	mockLogger.On("WithFields",
+		mock.MatchedBy(func(fields logrus.Fields) bool {
+			result, ok := fields["jobResult"].(string)
+			return ok && result == "failure"
+		}),
+	).Run(func(args mock.Arguments) {
+		bannerCalled = true
+	}).Return(&logrus.Entry{Logger: &logrus.Logger{}}).Once()
+
+	ctx := common.WithLogger(t.Context(), mockLogger)
+	rc := &RunContext{
+		Run: &model.Run{
+			JobID: "parent",
+			Workflow: &model.Workflow{
+				Jobs: map[string]*model.Job{
+					"parent": {},
+				},
+			},
+		},
+	}
+
+	planErr := errors.New("workflow failed")
+	err := finalizeReusableWorkflow(ctx, rc, planErr)
+	assert.EqualError(t, err, "workflow failed")
+	assert.True(t, bannerCalled, "banner should be printed even on failure")
+}

act/runner/run_context.go

@@ -21,10 +21,10 @@ import (
 	"text/template"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/exprparser"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/go-connections/nat"
 	"github.com/opencontainers/selinux/go-selinux"
@@ -248,12 +248,18 @@ var stopTemplate = template.Must(template.New("stop").Parse(`#!/bin/bash
 source $(dirname $0)/lxc-helpers-lib.sh
 
 lxc_container_destroy "{{.Name}}"
+lxc_maybe_sudo
+$LXC_SUDO rm -fr "{{ .Root }}"
 `))
 
 func (rc *RunContext) stopHostEnvironment(ctx context.Context) error {
 	logger := common.Logger(ctx)
 	logger.Debugf("stopHostEnvironment")
 
+	if !rc.IsLXCHostEnv(ctx) {
+		return nil
+	}
+
 	var stopScript bytes.Buffer
 	if err := stopTemplate.Execute(&stopScript, struct {
 		Name string
@@ -310,13 +316,18 @@ func (rc *RunContext) startHostEnvironment() common.Executor {
 			ToolCache: rc.getToolCache(ctx),
 			Workdir:   rc.Config.Workdir,
 			ActPath:   actPath,
-			CleanUp: func() {
-				os.RemoveAll(miscpath)
-			},
-			StdOut: logWriter,
-			LXC:    rc.IsLXCHostEnv(ctx),
+			StdOut:    logWriter,
+			LXC:       rc.IsLXCHostEnv(ctx),
+		}
+		rc.cleanUpJobContainer = func(ctx context.Context) error {
+			if err := rc.stopHostEnvironment(ctx); err != nil {
+				return err
+			}
+			if rc.JobContainer == nil {
+				return nil
+			}
+			return rc.JobContainer.Remove()(ctx)
 		}
-		rc.cleanUpJobContainer = rc.JobContainer.Remove()
 		for k, v := range rc.JobContainer.GetRunnerContext(ctx) {
 			if v, ok := v.(string); ok {
 				rc.Env[fmt.Sprintf("RUNNER_%s", strings.ToUpper(k))] = v
@@ -890,9 +901,6 @@ func (rc *RunContext) IsHostEnv(ctx context.Context) bool {
 
 func (rc *RunContext) stopContainer() common.Executor {
 	return func(ctx context.Context) error {
-		if rc.IsLXCHostEnv(ctx) {
-			return rc.stopHostEnvironment(ctx)
-		}
 		return rc.stopJobContainer()(ctx)
 	}
 }
@@ -900,9 +908,6 @@ func (rc *RunContext) stopContainer() common.Executor {
 func (rc *RunContext) closeContainer() common.Executor {
 	return func(ctx context.Context) error {
 		if rc.JobContainer != nil {
-			if rc.IsLXCHostEnv(ctx) {
-				return rc.stopHostEnvironment(ctx)
-			}
 			return rc.JobContainer.Close()(ctx)
 		}
 		return nil
@@ -943,7 +948,10 @@ func (rc *RunContext) Executor() (common.Executor, error) {
 			return err
 		}
 		if res {
-			return executor(ctx)
+			timeoutctx, cancelTimeOut := evaluateTimeout(ctx, "job", rc.ExprEval, rc.Run.Job().TimeoutMinutes)
+			defer cancelTimeOut()
+
+			return executor(timeoutctx)
 		}
 		return nil
 	}, nil
@@ -1202,7 +1210,7 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext
 			ghc.RetentionDays = preset.RetentionDays
 
 			instance := rc.Config.GitHubInstance
-			if !strings.HasPrefix(instance, "http://") &&
+			if instance != "" && !strings.HasPrefix(instance, "http://") &&
 				!strings.HasPrefix(instance, "https://") {
 				instance = "https://" + instance
 			}
@@ -1245,7 +1253,7 @@ func (rc *RunContext) getGithubContext(ctx context.Context) *model.GithubContext
 
 	{ // Adapt to Gitea
 		instance := rc.Config.GitHubInstance
-		if !strings.HasPrefix(instance, "http://") &&
+		if instance != "" && !strings.HasPrefix(instance, "http://") &&
 			!strings.HasPrefix(instance, "https://") {
 			instance = "https://" + instance
 		}
@@ -1347,16 +1355,6 @@ func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubCon
 	set("SERVER_URL", github.ServerURL)
 	set("API_URL", github.APIURL)
 
-	{ // Adapt to Forgejo
-		instance := rc.Config.GitHubInstance
-		if !strings.HasPrefix(instance, "http://") &&
-			!strings.HasPrefix(instance, "https://") {
-			instance = "https://" + instance
-		}
-		set("SERVER_URL", instance)
-		set("API_URL", instance+"/api/v1")
-	}
-
 	if rc.Config.ArtifactServerPath != "" {
 		setActionRuntimeVars(rc, env)
 	}

act/runner/run_context_test.go

@@ -5,17 +5,16 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"os"
 	"runtime"
 	"slices"
 	"strings"
 	"testing"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
-	"code.forgejo.org/forgejo/runner/v9/testutils"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/exprparser"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
+	"code.forgejo.org/forgejo/runner/v11/testutils"
 
 	"github.com/docker/go-connections/nat"
 	log "github.com/sirupsen/logrus"
@@ -281,61 +280,37 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 	})
 }
 
-func TestRunContext_GetGitHubContext(t *testing.T) {
-	log.SetLevel(log.DebugLevel)
-
-	cwd, err := os.Getwd()
-	assert.Nil(t, err)
-
-	rc := &RunContext{
-		Config: &Config{
-			EventName: "push",
-			Workdir:   cwd,
-		},
-		Run: &model.Run{
-			Workflow: &model.Workflow{
-				Name: "GitHubContextTest",
-			},
-		},
-		Name:           "GitHubContextTest",
-		CurrentStep:    "step",
-		Matrix:         map[string]any{},
-		Env:            map[string]string{},
-		ExtraPath:      []string{},
-		StepResults:    map[string]*model.StepResult{},
-		OutputMappings: map[MappableOutput]MappableOutput{},
+func TestRunContext_GetGithubContextURL(t *testing.T) {
+	table := []struct {
+		instance  string
+		serverURL string
+		APIURL    string
+	}{
+		{instance: "", serverURL: "", APIURL: "/api/v1"},
+		{instance: "example.com", serverURL: "https://example.com", APIURL: "https://example.com/api/v1"},
+		{instance: "http://example.com", serverURL: "http://example.com", APIURL: "http://example.com/api/v1"},
+		{instance: "https://example.com", serverURL: "https://example.com", APIURL: "https://example.com/api/v1"},
 	}
-	rc.Run.JobID = "job1"
+	for _, data := range table {
+		t.Run(data.instance, func(t *testing.T) {
+			rc := &RunContext{
+				EventJSON: "{}",
+				Config: &Config{
+					GitHubInstance: data.instance,
+				},
+				Run: &model.Run{
+					Workflow: &model.Workflow{
+						Name: "GitHubContextTest",
+					},
+				},
+			}
 
-	ghc := rc.getGithubContext(t.Context())
+			ghc := rc.getGithubContext(t.Context())
 
-	log.Debugf("%v", ghc)
-
-	actor := "nektos/act"
-	if a := os.Getenv("ACT_ACTOR"); a != "" {
-		actor = a
+			assert.Equal(t, data.serverURL, ghc.ServerURL)
+			assert.Equal(t, data.APIURL, ghc.APIURL)
+		})
 	}
-
-	repo := "forgejo/runner"
-	if r := os.Getenv("ACT_REPOSITORY"); r != "" {
-		repo = r
-	}
-
-	owner := "code.forgejo.org"
-	if o := os.Getenv("ACT_OWNER"); o != "" {
-		owner = o
-	}
-
-	assert.Equal(t, ghc.RunID, "1")
-	assert.Equal(t, ghc.RunNumber, "1")
-	assert.Equal(t, ghc.RetentionDays, "0")
-	assert.Equal(t, ghc.Actor, actor)
-	assert.True(t, strings.HasSuffix(ghc.Repository, repo))
-	assert.Equal(t, ghc.RepositoryOwner, owner)
-	assert.Equal(t, ghc.RunnerPerflog, "/dev/null")
-	assert.Equal(t, ghc.Token, rc.Config.Secrets["GITHUB_TOKEN"])
-	assert.Equal(t, ghc.Token, rc.Config.Secrets["FORGEJO_TOKEN"])
-	assert.Equal(t, ghc.Job, "job1")
 }
 
 func TestRunContext_GetGithubContextRef(t *testing.T) {

act/runner/runner.go

@@ -11,8 +11,8 @@ import (
 	docker_container "github.com/docker/docker/api/types/container"
 	log "github.com/sirupsen/logrus"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 // Runner provides capabilities to run GitHub actions

act/runner/runner_test.go

@@ -18,8 +18,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v3"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 var (
@@ -245,6 +245,8 @@ func TestRunner_RunEvent(t *testing.T) {
 		{workdir, "local-action-fails-schema-validation", "push", "Job 'test' failed", platforms, secrets},
 		{workdir, "local-action-docker-url", "push", "", platforms, secrets},
 		{workdir, "local-action-dockerfile", "push", "", platforms, secrets},
+		{workdir + "/local-action-dockerfile-tag/example1", "local-action-dockerfile-example1", "push", "", platforms, secrets},
+		{workdir + "/local-action-dockerfile-tag/example2", "local-action-dockerfile-example2", "push", "", platforms, secrets},
 		{workdir, "local-action-via-composite-dockerfile", "push", "", platforms, secrets},
 		{workdir, "local-action-js", "push", "", platforms, secrets},
 
@@ -261,6 +263,7 @@ func TestRunner_RunEvent(t *testing.T) {
 		{workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}},
 		{workdir, "uses-docker-url", "push", "", platforms, secrets},
 		{workdir, "act-composite-env-test", "push", "", platforms, secrets},
+		{workdir, "uses-workflow-env-input", "push", "", platforms, secrets},
 
 		// Eval
 		{workdir, "evalmatrix", "push", "", platforms, secrets},
@@ -270,6 +273,8 @@ func TestRunner_RunEvent(t *testing.T) {
 		{workdir, "evalmatrix-merge-array", "push", "", platforms, secrets},
 
 		{workdir, "basic", "push", "", platforms, secrets},
+		{workdir, "timeout-minutes-stop", "push", "Job 'check' failed", platforms, secrets},
+		{workdir, "timeout-minutes-job", "push", "context deadline exceeded", platforms, secrets},
 		{workdir, "fail", "push", "Job 'build' failed", platforms, secrets},
 		{workdir, "runs-on", "push", "", platforms, secrets},
 		{workdir, "checkout", "push", "", platforms, secrets},

act/runner/step.go

@@ -12,10 +12,10 @@ import (
 	"strings"
 	"time"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/exprparser"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 
 	"github.com/sirupsen/logrus"
 )
@@ -177,7 +177,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			Mode: 0o666,
 		})(ctx)
 
-		timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, rc.ExprEval, stepModel)
+		timeoutctx, cancelTimeOut := evaluateTimeout(ctx, "step", rc.ExprEval, stepModel.TimeoutMinutes)
 		defer cancelTimeOut()
 		err = executor(timeoutctx)
 
@@ -213,12 +213,15 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 	}
 }
 
-func evaluateStepTimeout(ctx context.Context, exprEval ExpressionEvaluator, stepModel *model.Step) (context.Context, context.CancelFunc) {
-	timeout := exprEval.Interpolate(ctx, stepModel.TimeoutMinutes)
+func evaluateTimeout(ctx context.Context, contextType string, exprEval ExpressionEvaluator, timeoutMinutes string) (context.Context, context.CancelFunc) {
+	timeout := exprEval.Interpolate(ctx, timeoutMinutes)
 	if timeout != "" {
-		if timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil {
+		timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64)
+		if err == nil {
+			common.Logger(ctx).Debugf("the %s will stop in timeout-minutes %s", contextType, timeout)
 			return context.WithTimeout(ctx, time.Duration(timeOutMinutes)*time.Minute)
 		}
+		common.Logger(ctx).Errorf("timeout-minutes %s cannot be parsed and will be ignored: %w", timeout, err)
 	}
 	return ctx, func() {}
 }

act/runner/step_action_local.go

@@ -11,8 +11,8 @@ import (
 	"path"
 	"path/filepath"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 type stepActionLocal struct {

act/runner/step_action_local_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"go.yaml.in/yaml/v3"

act/runner/step_action_remote.go

@@ -14,9 +14,9 @@ import (
 
 	gogit "github.com/go-git/go-git/v5"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/common/git"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common/git"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 type stepActionRemote struct {

act/runner/step_action_remote_test.go

@@ -11,9 +11,9 @@ import (
 	"github.com/stretchr/testify/mock"
 	"go.yaml.in/yaml/v3"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/common/git"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/common/git"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 type stepActionRemoteMocks struct {

act/runner/step_docker.go

@@ -5,9 +5,9 @@ import (
 	"fmt"
 	"strings"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/kballard/go-shellquote"
 )
 

act/runner/step_docker_test.go

@@ -6,8 +6,8 @@ import (
 	"io"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )

act/runner/step_factory.go

@@ -3,7 +3,7 @@ package runner
 import (
 	"fmt"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 type stepFactory interface {

act/runner/step_factory_test.go

@@ -3,7 +3,7 @@ package runner
 import (
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	"github.com/stretchr/testify/assert"
 )
 

act/runner/step_run.go

@@ -9,10 +9,10 @@ import (
 
 	"github.com/kballard/go-shellquote"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/lookpath"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/lookpath"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 type stepRun struct {

act/runner/step_run_test.go

@@ -9,8 +9,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 
-	"code.forgejo.org/forgejo/runner/v9/act/container"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/container"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 )
 
 func TestStepRun(t *testing.T) {

act/runner/step_test.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"testing"
 
-	"code.forgejo.org/forgejo/runner/v9/act/common"
-	"code.forgejo.org/forgejo/runner/v9/act/model"
+	"code.forgejo.org/forgejo/runner/v11/act/common"
+	"code.forgejo.org/forgejo/runner/v11/act/model"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"

act/runner/testdata/.github/workflows/local-reusable-env-input.yml

@@ -0,0 +1,21 @@
+name: "use-inputs-impl"
+
+on:
+  workflow_call:
+    inputs:
+      greet_target:
+        type: string
+        required: false
+        default: "Some Default Value"
+
+jobs:
+  works:
+    runs-on: ubuntu-latest
+    env:
+      MY_INPUT_TEST: ${{ inputs.greet_target }}
+      INPUT_TEST: ${{ inputs.greet_target }}
+      INPUT_GREET_TARGET: ${{ inputs.greet_target }}
+    steps:
+      - run: '[ "$MY_INPUT_TEST" = "Mona the Octocat" ] || exit 1'
+      - run: '[ "$INPUT_TEST" = "Mona the Octocat" ] || exit 1'
+      - run: '[ "$INPUT_GREET_TARGET" = "Mona the Octocat" ] || exit 1'

act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM code.forgejo.org/oci/alpine:latest
 
 COPY entrypoint.sh /entrypoint.sh
 

act/runner/testdata/basic/push.yml

@@ -18,7 +18,8 @@ jobs:
       - run: ls
       - run: echo 'hello world'
       - run: echo ${GITHUB_SHA} >> $(dirname "${GITHUB_WORKSPACE}")/sha.txt
-      - run: cat $(dirname "${GITHUB_WORKSPACE}")/sha.txt | grep ${GITHUB_SHA}
+      - timeout-minutes: 30
+        run: cat $(dirname "${GITHUB_WORKSPACE}")/sha.txt | grep ${GITHUB_SHA}
   build:
     runs-on: ubuntu-latest
     needs: [check]

act/runner/testdata/local-action-dockerfile-tag/README.txt

@@ -0,0 +1,4 @@
+example1 and example2 eacho use a local actions that have the same
+path (actions/docker-local) but do not behave the same. This verifies
+that the locally built images have different names and do not collide
+despite both being called with `uses: ./actions/docker-local.

act/runner/testdata/local-action-dockerfile-tag/example1/actions/docker-local/Dockerfile

@@ -0,0 +1,8 @@
+# Container image that runs your code
+FROM code.forgejo.org/oci/alpine:latest
+
+# Copies your code file from your action repository to the filesystem path `/` of the container
+COPY entrypoint.sh /entrypoint.sh
+
+# Code file to execute when the docker container starts up (`entrypoint.sh`)
+ENTRYPOINT ["/entrypoint.sh"]