fix: prevent space prefix/suffix in runner labels (#829)

[Raised on Forgejo](https://codeberg.org/forgejo/forgejo/issues/8803): when a runner is registered with spaces in the comma-separated label list, eg. ` "docker:docker://node:22-bookworm, self-hosted:host, lxc:lxc://debian:bookworm"`, the runner will currently get the labels `"docker"`, `" self-hosted"`, and `" lxc"` which causes unexpected confusion.  Forgejo doesn't display the labels usefully, and targeting the runner with `runs-on` in an action would require an unexpected quoting (eg. `runs-on: " lxc"`).

As an alternative to fixing this in Forgejo's label display, two changes are present here:
- When registering labels via the CLI `--labels` option, or the interactive registering, automatically strip spaces around the commas in the comma-separated list.
- **Breaking**: During startup of the runner, label names that start/end with a space will be considered invalid, resulting in a logged error and the label being ignored:
    ```
    WARN[2025-08-08T21:00:13-06:00] ignored invalid label " debian-latest:docker://node:current-bookworm"  error="invalid label \" debian-latest\": starting or ending with a space is invalid"
    ```
    This is a breaking change in behavior in the case that someone has registered a runner with spaces and modified their activities to use them after recognizing the problem.  But I tend to think it's more likely that this change will *highlight* a misconfiguration and help someone fix it.

<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- bug fixes
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/829): <!--number 829 --><!--line 0 --><!--description Zml4OiBwcmV2ZW50IHNwYWNlIHByZWZpeC9zdWZmaXggaW4gcnVubmVyIGxhYmVscw==-->fix: prevent space prefix/suffix in runner labels<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/829
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>

internal/app/cmd/register.go

@@ -172,7 +172,7 @@ func (r *registerInputs) assignToNext(stage registerStage, value string, cfg *co
 	case StageInputLabels:
 		r.Labels = defaultLabels
 		if value != "" {
-			r.Labels = strings.Split(value, ",")
+			r.Labels = commaSplit(value)
 		}
 
 		if validateLabels(r.Labels) != nil {
@@ -260,7 +260,7 @@ func registerNoInteractive(ctx context.Context, configFile string, regArgs *regi
 	regArgs.Labels = strings.TrimSpace(regArgs.Labels)
 	// command line flag.
 	if regArgs.Labels != "" {
-		inputs.Labels = strings.Split(regArgs.Labels, ",")
+		inputs.Labels = commaSplit(regArgs.Labels)
 	}
 	// specify labels in config file.
 	if len(cfg.Runner.Labels) > 0 {
@@ -353,3 +353,24 @@ func doRegister(ctx context.Context, cfg *config.Config, inputs *registerInputs)
 	}
 	return nil
 }
+
+// Splits a string by commas, but trims whitespace around the commas. Used for label parsing to avoid a rogue whitespace
+// like "docker:docker://node:22-bookworm, self-hosted:host, lxc:lxc://debian:bookworm" becoming labeled with
+// " self-hosted" and " lxc".
+func commaSplit(s string) []string {
+	if s == "" {
+		return make([]string, 0)
+	}
+
+	parts := strings.Split(s, ",")
+	result := make([]string, 0, len(parts))
+
+	for _, part := range parts {
+		trimmed := strings.TrimSpace(part)
+		if trimmed != "" {
+			result = append(result, trimmed)
+		}
+	}
+
+	return result
+}

internal/app/cmd/register_test.go

@@ -0,0 +1,31 @@
+// Copyright 2025 The Forgejo Authors
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestCommaSplit(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected []string
+	}{
+		{"", []string{}},
+		{"abc", []string{"abc"}},
+		{"abc,def", []string{"abc", "def"}},
+		{"abc, def", []string{"abc", "def"}},
+		{" abc , def ", []string{"abc", "def"}},
+		{"abc,  ,def", []string{"abc", "def"}},
+		{" , , ", []string{}},
+	}
+
+	for _, test := range tests {
+		result := commaSplit(test.input)
+		if !slices.Equal(result, test.expected) {
+			t.Errorf("commaSplit(%q) = %v, want %v", test.input, result, test.expected)
+		}
+	}
+}

internal/pkg/labels/labels.go

@@ -31,6 +31,10 @@ func Parse(str string) (*Label, error) {
 		Schema: "docker",
 	}
 
+	if strings.TrimSpace(label.Name) != label.Name {
+		return nil, fmt.Errorf("invalid label %q: starting or ending with a space is invalid", label.Name)
+	}
+
 	if len(splits) >= 2 {
 		label.Schema = splits[1]
 		if label.Schema != SchemeHost && label.Schema != SchemeDocker && label.Schema != SchemeLXC {

internal/pkg/labels/labels_test.go

@@ -63,7 +63,6 @@ func TestParse(t *testing.T) {
 			},
 			wantErr: false,
 		},
-
 		{
 			args: "label1:host",
 			want: &Label{
@@ -78,12 +77,21 @@ func TestParse(t *testing.T) {
 			want:    nil,
 			wantErr: true,
 		},
-
 		{
 			args:    "label1:invalidscheme",
 			want:    nil,
 			wantErr: true,
 		},
+		{
+			args:    " label1:lxc://debian:buster",
+			want:    nil,
+			wantErr: true,
+		},
+		{
+			args:    "label1 :lxc://debian:buster",
+			want:    nil,
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.args, func(t *testing.T) {