runner/act
Earl Warren 11a96bb462
fix(security): ensure unique names for container images created by actions
Container images built by the runner are tagged with a unique name:

- based on the specified `uses` URL for remote actions.
- random for local actions.

In the case of local actions, this will create new tags for each run
but the images (and their layers) will be shared and not be
duplicated. The least recently used tags can be garbage collected by
tools such as https://github.com/stepchowfun/docuum.

Using a different method for creating the tag name for the remote
actions is to help with maintenance by establishing a direct relation
with the `uses` field. It was instead relying on a name transformed
multiple times which makes it more difficult to verify name collision
are not accidentally made possible by one of those transformations.

Without this fix, when a workflow ran a local [docker action](https://forgejo.org/docs/next/user/actions/actions/#docker-actions)
(e.g. the [example in the end-to-end
tests](8f920b4b7a/actions/example-force-rebuild/.forgejo/workflows/test.yml)),
it used an image tag that could collide with other workflows that
happen to use the same name.

The workaround for older runner versions is to set
[`[container].force_rebuild: true`](https://forgejo.org/docs/next/admin/actions/runner-installation/#configuration)
in the runner configuration file.
2025-09-01 13:41:06 +02:00
..
artifactcache fix: artifact cache DB not using indexes for searching (#878) 2025-08-19 20:19:23 +00:00
cacheproxy chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
common test: fix data race in TestNewParallelExecutor... tests (#860) 2025-08-15 09:12:32 +00:00
container chore: remove github.com/pkg/errors (#873) 2025-08-28 09:33:52 +00:00
exprparser chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
filecollector chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
jobparser chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00
lookpath chore: use the same .golangci.yml as the runner & gofumpt over gofmt (#206) 2025-07-28 12:26:41 +00:00
model chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00
runner fix(security): ensure unique names for container images created by actions 2025-09-01 13:41:06 +02:00
schema chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00
workflowpattern chore: modernize code (#857) 2025-08-15 04:54:13 +00:00