From 51e0bc0e5371c590dc06a4f3a18888115d0e0c02 Mon Sep 17 00:00:00 2001
From: Earl Warren <contact@earl-warren.org>
Date: Thu, 3 Jul 2025 16:37:30 +0000
Subject: [PATCH] feat: support for forgejo-exec --var (#645)

Refs forgejo/runner#387

https://code.forgejo.org/forgejo/runner/actions/runs/4284/jobs/1#jobstep-6-25

![image](/attachments/cf804b2b-e4c3-46a8-afac-27cfdb1fe6c2)

Co-authored-by: lautriva <lautriva@noreply.gitea.com>
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/645
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
---
 .forgejo/testdata/var.yml   |  9 +++++++++
 .forgejo/workflows/test.yml |  9 ++++++++-
 internal/app/cmd/exec.go    | 19 +++++++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 .forgejo/testdata/var.yml

diff --git a/.forgejo/testdata/var.yml b/.forgejo/testdata/var.yml
new file mode 100644
index 00000000..a967842e
--- /dev/null
+++ b/.forgejo/testdata/var.yml
@@ -0,0 +1,9 @@
+---
+on: push
+jobs:
+  var:
+    runs-on: docker
+    container:
+      image: code.forgejo.org/oci/debian:bookworm
+    steps:
+      - run: echo "VAR -> ${{ vars.MY_VAR }}"
diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml
index 095e62df..a0102f50 100644
--- a/.forgejo/workflows/test.yml
+++ b/.forgejo/workflows/test.yml
@@ -87,6 +87,8 @@ jobs:
         with:
           name: forgejo-runner
 
+      - run: chmod +x forgejo-runner
+
       - name: install docker
         run: |
           mkdir /etc/docker
@@ -113,10 +115,15 @@ jobs:
       - name: forgejo-runner exec --enable-ipv6
         run: |
           set -x
-          chmod +x forgejo-runner
           ./forgejo-runner exec --enable-ipv6 --workflows .forgejo/testdata/ipv6.yml
           if ./forgejo-runner exec --workflows .forgejo/testdata/ipv6.yml >& /tmp/out ; then
              cat /tmp/out
              echo "IPv6 not enabled, should fail"
              exit 1
           fi
+
+      - name: forgejo-runner exec --var
+        run: |
+          set -x
+          ./forgejo-runner exec --var MY_VAR=testvariable --workflows .forgejo/testdata/var.yml |& tee /tmp/var.out
+          grep --quiet 'Success - Main echo "VAR -> testvariable"' /tmp/var.out
diff --git a/internal/app/cmd/exec.go b/internal/app/cmd/exec.go
index 6020ee3a..ff84019b 100644
--- a/internal/app/cmd/exec.go
+++ b/internal/app/cmd/exec.go
@@ -40,6 +40,7 @@ type executeArgs struct {
 	envs                  []string
 	envfile               string
 	secrets               []string
+	vars                  []string
 	defaultActionsURL     string
 	insecureSecrets       bool
 	privileged            bool
@@ -132,6 +133,22 @@ func (i *executeArgs) LoadEnvs() map[string]string {
 	return envs
 }
 
+func (i *executeArgs) LoadVars() map[string]string {
+	vars := make(map[string]string)
+	if i.vars != nil {
+		for _, runVar := range i.vars {
+			e := strings.SplitN(runVar, `=`, 2)
+			if len(e) == 2 {
+				vars[e[0]] = e[1]
+			} else {
+				vars[e[0]] = ""
+			}
+		}
+	}
+
+	return vars
+}
+
 // Workdir returns path to workdir
 func (i *executeArgs) Workdir() string {
 	return i.resolve(".")
@@ -384,6 +401,7 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command
 			LogOutput:             true,
 			JSONLogger:            execArgs.jsonLogger,
 			Env:                   execArgs.LoadEnvs(),
+			Vars:                  execArgs.LoadVars(),
 			Secrets:               execArgs.LoadSecrets(),
 			InsecureSecrets:       execArgs.insecureSecrets,
 			Privileged:            execArgs.privileged,
@@ -471,6 +489,7 @@ func loadExecCmd(ctx context.Context) *cobra.Command {
 	execCmd.Flags().StringArrayVarP(&execArg.envs, "env", "", []string{}, "env to make available to actions with optional value (e.g. --env myenv=foo or --env myenv)")
 	execCmd.PersistentFlags().StringVarP(&execArg.envfile, "env-file", "", ".env", "environment file to read and use as env in the containers")
 	execCmd.Flags().StringArrayVarP(&execArg.secrets, "secret", "s", []string{}, "secret to make available to actions with optional value (e.g. -s mysecret=foo or -s mysecret)")
+	execCmd.Flags().StringArrayVarP(&execArg.vars, "var", "", []string{}, "variable to make available to actions with optional value (e.g. --var myvar=foo or --var myvar)")
 	execCmd.PersistentFlags().BoolVarP(&execArg.insecureSecrets, "insecure-secrets", "", false, "NOT RECOMMENDED! Doesn't hide secrets while printing logs.")
 	execCmd.Flags().BoolVar(&execArg.privileged, "privileged", false, "use privileged mode")
 	execCmd.Flags().StringVar(&execArg.usernsMode, "userns", "", "user namespace to use")