This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | minor | `9.0.3` -> `9.1.0` |
---
### Release Notes
<details>
<summary>forgejo/runner (code.forgejo.org/forgejo/runner)</summary>
### [`v9.1.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.1.0)
[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.3...v9.1.0)
- [User guide](https://forgejo.org/docs/next/user/actions/overview/)
- [Administrator guide](https://forgejo.org/docs/next/admin/actions/)
- [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions)
Release Notes
***
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS42MS4wIiwidXBkYXRlZEluVmVyIjoiNDEuNzYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiS2luZC9DaG9yZSJdfQ==-->
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/877): <!--number 877 --><!--line 0 --><!--description VXBkYXRlIGNvZGUuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9ydW5uZXIgRG9ja2VyIHRhZyB0byB2OS4xLjA=-->Update code.forgejo.org/forgejo/runner Docker tag to v9.1.0<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/877
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
A job with a `runs-on` that references matrix variables will not run with the expected labels. eg.
```
jobs:
matrix-runs-on:
strategy:
matrix:
os: [ubuntu-latest, ubuntu-20.04]
runs-on: ${{ matrix.os }}
steps:
...
```
Due to shared mutated state, both jobs that this generates will (w/ a race condition) either run with the `ubuntu-latest` or `ubuntu-20.04`, but rarely (never observed) with the expected outcome of running on both labels.
`EvaluateYamlNode` is used to evaluate expressions in the `runs-on` field in the context of the current running job, but mutating an object shared between multiple concurrent jobs (in matrix evaluation). This results in the evaluation results from one job spilling into another and corrupting their `runs-on` labels.
```
==================
WARNING: DATA RACE
Write at 0x00c00047e0b0 by goroutine 1739:
reflect.typedmemmove()
/.../go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/runtime/mbarrier.go:213 +0x0
reflect.Value.Set()
/.../go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:2062 +0x184
gopkg.in/yaml%2ev3.(*decoder).unmarshal()
/.../go/pkg/mod/gopkg.in/yaml.v3@v3.0.1/decode.go:493 +0x7b4
gopkg.in/yaml%2ev3.(*Node).Decode()
/.../go/pkg/mod/gopkg.in/yaml.v3@v3.0.1/yaml.go:149 +0x355
code.forgejo.org/forgejo/runner/v9/act/runner.expressionEvaluator.EvaluateYamlNode()
/.../forgejo-runner/act/runner/expression.go:372 +0x7a
code.forgejo.org/forgejo/runner/v9/act/runner.(*expressionEvaluator).EvaluateYamlNode()
<autogenerated>:1 +0x6b
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).runsOnPlatformNames()
/.../forgejo-runner/act/runner/run_context.go:1019 +0x2af
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).runsOnImage()
/.../forgejo-runner/act/runner/run_context.go:1002 +0x772
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).platformImage()
/.../forgejo-runner/act/runner/run_context.go:1032 +0x77
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).isEnabled()
/.../forgejo-runner/act/runner/run_context.go:1069 +0x3c7
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1()
/.../forgejo-runner/act/runner/run_context.go:964 +0x4b
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1()
/.../forgejo-runner/act/runner/runner.go:223 +0x271
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1()
/.../forgejo-runner/act/common/executor.go:107 +0x61
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1()
/.../forgejo-runner/act/common/executor.go:109 +0x4f
Previous read at 0x00c00047e0b0 by goroutine 1742:
code.forgejo.org/forgejo/runner/v9/act/model.(*Job).RunsOn()
/.../forgejo-runner/act/model/workflow.go:361 +0x3c4
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).runsOnImage()
/.../forgejo-runner/act/runner/run_context.go:991 +0x57a
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).platformImage()
/.../forgejo-runner/act/runner/run_context.go:1032 +0x77
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).isEnabled()
/.../forgejo-runner/act/runner/run_context.go:1069 +0x3c7
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1()
/.../forgejo-runner/act/runner/run_context.go:964 +0x4b
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1()
/.../forgejo-runner/act/runner/runner.go:223 +0x271
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1()
/.../forgejo-runner/act/common/executor.go:107 +0x61
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1()
/.../forgejo-runner/act/common/executor.go:109 +0x4f
...
==================
```
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/871): <!--number 871 --><!--line 0 --><!--description Zml4OiBkYXRhIHJhY2UgaW4gJ3J1bnMtb24nIGV4cHJlc3Npb25zIGNhdXNlcyBpbmNvcnJlY3Qgam9iIGxhYmVscyBkdXJpbmcgZXhlY3V0aW9u-->fix: data race in 'runs-on' expressions causes incorrect job labels during execution<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/871
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
- change the argument from string to error to differentiate
a timeout error
- when there is a timeout, display a message more descriptive than
"context deadline"
- always set the StoppedAt state value instead of only if the
result was unspecified: it is the last state update.
* add test
* return validation error not nil from function
Reviewed-on: https://gitea.com/gitea/act_runner/pulls/683
Reviewed-by: techknowlogick <techknowlogick@noreply.gitea.com>
Co-authored-by: Christopher Homberger <christopher.homberger@web.de>
Co-committed-by: Christopher Homberger <christopher.homberger@web.de>
(cherry picked from commit f0b5aff3bbeda469a682fe21144c16485ea2189a)
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- features
- [PR](https://code.forgejo.org/forgejo/runner/pulls/647): <!--number 647 --><!--line 0 --><!--description ZmVhdDogZmFpbCB3aGVuIHVzaW5nIGFuIGludmFsaWQgbGFiZWwgZHVyaW5nIG5vbiBpbnRlcmFjdGl2ZSByZWdpc3RyYXRpb24=-->feat: fail when using an invalid label during non interactive registration<!--description-->
<!--end release-notes-assistant-->
Co-authored-by: Christopher Homberger <christopher.homberger@web.de>
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/647
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
ctx & cancel are related and when cancel is called, the context is no
longer usable. Use the daemon context context to allow the reporter to
continue to operate and conclude the converation with the Forgejo
instance.
The daemon context is needed when the context of a job or the poller
is done. Otherwise it is no longer possible to send a conclusion
report to Forgejo, short of creating a context.Background() which
poses its own set of problems.
- WithDaemonContext is used to store the daemon context
- The poller uses the daemon context instead of context.Background
The `setupShell` function would update the shell stored on the `Step` object, setting it to either a default value from the job, an expression evaluated in the context of the job, a default from the workflow, or finally falling back to bash or powershell defaults. Typically this would be fine -- although it would trigger the data race detector because the `Step` is a shared object between multiple concurrent matrix evaluations for the job.
In the *really quite unlikely* case that the `shell` field on a step or job referenced a matrix variable, this data race would actually trigger the shared step's `Shell` value to end up as "whichever one was evaluated last", causing the wrong shell to be used. The new `matrix-shell` test triggers this behavior, and fails without the associated code fix.
As a fix, the `Shell` field in `Step` is never mutated; instead only the value on non-shared `stepRun` instance is updated from `setupShellCommand`. `Shell` was renamed to `RawShell` as part of verifying all references were updated and it seemed to make sense to keep that name since it is a pre-evaluator value.
```
==================
WARNING: DATA RACE
Write at 0x00c00013e9b0 by goroutine 1470:
code.forgejo.org/forgejo/runner/v9/act/runner.(*stepRun).setupShell()
/.../forgejo-runner/act/runner/step_run.go:210 +0x8f2
code.forgejo.org/forgejo/runner/v9/act/common/git.FindGitRevision()
/.../forgejo-runner/act/common/git/git.go:58 +0xc4
code.forgejo.org/forgejo/runner/v9/act/model.(*GithubContext).SetSha()
/.../forgejo-runner/act/model/github_context.go:161 +0x6b5
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).getGithubContext()
/.../forgejo-runner/act/runner/run_context.go:1228 +0x26ca
...
Previous write at 0x00c00013e9b0 by goroutine 1469:
code.forgejo.org/forgejo/runner/v9/act/runner.(*stepRun).setupShell()
/.../forgejo-runner/act/runner/step_run.go:210 +0x8f2
code.forgejo.org/forgejo/runner/v9/act/common/git.FindGitRevision()
/.../forgejo-runner/act/common/git/git.go:58 +0xc4
code.forgejo.org/forgejo/runner/v9/act/model.(*GithubContext).SetSha()
/.../forgejo-runner/act/model/github_context.go:161 +0x6b5
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).getGithubContext()
/.../forgejo-runner/act/runner/run_context.go:1228 +0x26ca
...
==================
```
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/865): <!--number 865 --><!--line 0 --><!--description Zml4OiBkYXRhIHJhY2UgY29uZGl0aW9uIGNhdXNpbmcgaW5jb3JyZWN0IGBzaGVsbGAgb24gYSB0YXNrIHN0ZXAgaWYgaXQgcmVmZXJlbmNlZCBhIG1hdHJpeCB2YXJpYWJsZQ==-->fix: data race condition causing incorrect `shell` on a task step if it referenced a matrix variable<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/865
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
The other setting that asks you for a URL as input
does so while specifically stating it should have a
trailing slash. This commit adds similar
clarification to the other setting.
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/866): <!--number 866 --><!--line 0 --><!--description ZG9jczogQ2xhcmlmeSBhY3Rpb25zX2NhY2hlX3VybF9vcHRpb24gW3NraXAgY2FzY2FkZV0=-->docs: Clarify actions_cache_url_option [skip cascade]<!--description-->
<!--end release-notes-assistant-->
Co-authored-by: Shuroii <shuroii@local.local>
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/866
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Shuroii <shuroii@noreply.code.forgejo.org>
Co-committed-by: Shuroii <shuroii@noreply.code.forgejo.org>
In `setJobResult` there is no coordination between multiple jobs that are completing, leading to a possible condition where `jobResult` can be read from the matrix job as `"success"` by a job, marked as `"failed"` by another job, and then marked as `"success"` by other jobs.
To my knowledge, the race condition has not been observed in a real-world case, but has been reproduced in a unit test.
```
==================
WARNING: DATA RACE
Read at 0x00c0006d08a0 by goroutine 29232:
code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult()
/.../forgejo-runner/act/runner/job_executor.go:173
+0x359
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func6()
/.../forgejo-runner/act/runner/job_executor.go:118
+0x15d
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func14()
/.../forgejo-runner/act/common/executor.go:183 +0x86
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func7()
/.../forgejo-runner/act/runner/job_executor.go:161
+0x191
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func16()
/.../forgejo-runner/act/common/executor.go:183 +0x86
...
Previous write at 0x00c0006d08a0 by goroutine 29234:
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).result()
/.../forgejo-runner/act/runner/run_context.go:897
+0x271
code.forgejo.org/forgejo/runner/v9/act/runner.setJobResult()
/.../forgejo-runner/act/runner/job_executor.go:181
+0x66e
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func6()
/.../forgejo-runner/act/runner/job_executor.go:118
+0x15d
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func14()
/.../forgejo-runner/act/common/executor.go:183 +0x86
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.func7()
/.../forgejo-runner/act/runner/job_executor.go:161
+0x191
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.Executor.Finally.func16()
/.../forgejo-runner/act/common/executor.go:183 +0x86
...
==================
```
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/862): <!--number 862 --><!--line 0 --><!--description Zml4OiByYWNlIGNvbmRpdGlvbiBpbiBtYXRyaXggam9iIHJlc3VsdCBzdGF0ZSBtYXkgcmVzdWx0IGluIGZhaWxlZCBqb2JzIGJlaW5nIG1hcmtlZCBhcyBzdWNjZXNzZnVs-->fix: race condition in matrix job result state may result in failed jobs being marked as successful<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/862
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
Tests were using `count` and similar variables without any concurrency safety and have been updated to use atomic operations. This may have caused rare miscounts in tests as operations like `count++` are not thread-safe, but to my knowledge these have never been observed.
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/860
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
`ContainerDaemonSocket` is stored on a shared struct and was mutated to a default value when empty, which trips the data race detector as a mutation of shared state without any synchronization. However as all codepaths would be setting it to the same value in the mutation, here's no functional bug. This commit prevents the "false positive", but it also centralizes the default value for a slightly better programming practice.
```
==================
WARNING: DATA RACE
Read at 0x00c00027f9e0 by goroutine 1104:
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).GetBindsAndMounts()
/.../forgejo-runner/act/runner/run_context.go:130 +0x87
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).prepareJobContainer()
/.../forgejo-runner/act/runner/run_context.go:449 +0xad1
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1.(*RunContext).startJobContainer.2()
/.../forgejo-runner/act/runner/run_context.go:587 +0x5e
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1()
/.../forgejo-runner/act/runner/run_context.go:836 +0xf3
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.NewPipelineExecutor.Executor.Then.func21()
/.../forgejo-runner/act/common/executor.go:136 +0x57
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1()
/.../forgejo-runner/act/runner/run_context.go:929 +0x68
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1()
/.../forgejo-runner/act/runner/runner.go:218 +0x271
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1()
/.../forgejo-runner/act/common/executor.go:107 +0x61
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1()
/.../forgejo-runner/act/common/executor.go:109 +0x4f
Previous write at 0x00c00027f9e0 by goroutine 1103:
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).GetBindsAndMounts()
/.../forgejo-runner/act/runner/run_context.go:131 +0xc7
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).prepareJobContainer()
/.../forgejo-runner/act/runner/run_context.go:449 +0xad1
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1.(*RunContext).startJobContainer.2()
/.../forgejo-runner/act/runner/run_context.go:587 +0x5e
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).startContainer.func1()
/.../forgejo-runner/act/runner/run_context.go:836 +0xf3
code.forgejo.org/forgejo/runner/v9/act/runner.newJobExecutor.NewPipelineExecutor.Executor.Then.func21()
/.../forgejo-runner/act/common/executor.go:136 +0x57
code.forgejo.org/forgejo/runner/v9/act/runner.(*RunContext).Executor.func1()
/.../forgejo-runner/act/runner/run_context.go:929 +0x68
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.1()
/.../forgejo-runner/act/runner/runner.go:218 +0x271
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.1()
/.../forgejo-runner/act/common/executor.go:107 +0x61
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2.gowrap1()
/.../forgejo-runner/act/common/executor.go:109 +0x4f
Goroutine 1104 (running) created at:
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2()
/.../forgejo-runner/act/common/executor.go:105 +0x144
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1()
/.../forgejo-runner/act/common/executor.go:107 +0x61
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1()
/.../forgejo-runner/act/common/executor.go:109 +0x4f
Goroutine 1103 (running) created at:
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.2()
/.../forgejo-runner/act/common/executor.go:105 +0x144
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.1()
/.../forgejo-runner/act/common/executor.go:107 +0x61
code.forgejo.org/forgejo/runner/v9/act/runner.(*runnerImpl).NewPlanExecutor.func1.NewParallelExecutor.3.gowrap1()
/.../forgejo-runner/act/common/executor.go:109 +0x4f
==================
```
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/859): <!--number 859 --><!--line 0 --><!--description Y2hvcmU6IHByZXZlbnQgImZhbHNlIHBvc2l0aXZlIiBkYXRhIHJhY2UgZGV0ZWN0aW9uIHcvIENvbnRhaW5lckRhZW1vblNvY2tldA==-->chore: prevent "false positive" data race detection w/ ContainerDaemonSocket<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/859
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
Data race is being flagged because a goroutine is currently writing tar data into `atar`, and `assert.NotEmpty(atar)` performs internal structure reflection into the returned `io.PipeWriter` and violates its internal synchronization primitives. This assertion doesn't seem to add any value to the test compared to just reading the pipe, so it has been removed.
Data race details (abbreviated):
```
==================
WARNING: DATA RACE
Write at 0x00c00041fbc0 by goroutine 55:
sync/atomic.CompareAndSwapInt32()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/runtime/race_amd64.s:361
+0xb
sync/atomic.CompareAndSwapInt32()
<autogenerated>:1 +0x18
sync.(*Mutex).Lock()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/sync/mutex.go:46
+0x28
io.(*pipe).write()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/io/pipe.go:81
+0x9e
io.(*PipeWriter).Write()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/io/pipe.go:161
+0x46
archive/tar.(*Writer).Flush()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/archive/tar/writer.go:59
+0xcc
archive/tar.(*Writer).WriteHeader()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/archive/tar/writer.go:71
+0x46
code.forgejo.org/forgejo/runner/v9/act/runner.actionCacheCopyFileOrDir()
/home/mfenniak/Dev/forgejo-runner/act/runner/action_cache.go:203
+0xabd
code.forgejo.org/forgejo/runner/v9/act/runner.GoGitActionCache.GetTarArchive.func2.1()
/home/mfenniak/Dev/forgejo-runner/act/runner/action_cache.go:154
+0xa5
...
Previous read at 0x00c00041fbc0 by goroutine 9:
reflect.typedmemmove()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/runtime/mbarrier.go:213
+0x0
reflect.packEface()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:136
+0xc5
reflect.valueInterface()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:1513
+0x179
reflect.Value.Interface()
/home/mfenniak/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.24.6.linux-amd64/src/reflect/value.go:1484
+0x106
github.com/stretchr/testify/assert.isEmpty()
/home/mfenniak/go/pkg/mod/github.com/stretchr/testify@v1.10.0/assert/assertions.go:735
+0x7f
github.com/stretchr/testify/assert.NotEmpty()
/home/mfenniak/go/pkg/mod/github.com/stretchr/testify@v1.10.0/assert/assertions.go:769
+0x56
github.com/stretchr/testify/assert.(*Assertions).NotEmpty()
/home/mfenniak/go/pkg/mod/github.com/stretchr/testify@v1.10.0/assert/assertion_forward.go:1175
+0xb1
code.forgejo.org/forgejo/runner/v9/act/runner.TestActionCache.func1()
/home/mfenniak/Dev/forgejo-runner/act/runner/action_cache_test.go:60
+0x21e
==================
```
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/858): <!--number 858 --><!--line 0 --><!--description dGVzdDogcHJldmVudCBkYXRhIHJhY2UgZGV0ZWN0aW9uIGluIFRlc3RBY3Rpb25DYWNoZSBbc2tpcCBjYXNjYWRlXQ==-->test: prevent data race detection in TestActionCache [skip cascade]<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/858
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
When a reusable workflow is called twice in the same workflow in
parallel, it may require a dedicated network to run (for instance if
it spawns services) and will always require unique volumes to mount
the workdir and the env.
There really is no way to guarantee a unique name derived from the
job name etc. Instead, a random name is set and used as a base for
both the internal volumes and the dedicated network (if any).
Replace asserting hard coded names with assertions on how the services
and the job container relate. It slightly improves logic coverage and
makes the test insensitive to how network and volume names are created.
- compare the network names of the services and the job container to be
equal, demonstrating they can communicate
- verify the mounts and valid volumes of services to be empty
- verify the internal mounts of the job container to be valid volumes
If the run context has a parent, both share the same unique random
name. A composite action does not have a run context of its own, it
re-uses the run context of the job that calls it: this is when a
parent is used and needed.
There may be any level of parent / child relationship and ensureRandom
name recursively look for the first parent with a non empty random.
- getInternalVolumeWorkdir is used instead of rc.jobContainerName()
- getInternalVolumeEnv is used insted of rc.jobContainerName() + "-env"
- getInternalVolumeNames is used when all internal volumes are needed
- networkName becomes ensureNetworkName and stores the results
in the run context instead of returning it
- the getNetworkName and getNetworkCreated accessors are used
instead of local variables
- remove the force argument as it is always false
- accept more than one volume to be removed
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/854): <!--number 854 --><!--line 0 --><!--description Y2hvcmU6IHJlZmFjdG9yIE5ld0RvY2tlclZvbHVtZVJlbW92ZUV4ZWN1dG9y-->chore: refactor NewDockerVolumeRemoveExecutor<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/854
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
If that happens so much will go wrong that there is no point in continuing to do anything. It simplifies the requirements of the caller: it may be a function that is assumed to never error.
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/853): <!--number 853 --><!--line 0 --><!--description Y2hvcmU6IHBhbmljIGlmIGEgcmFuZG9tIG5hbWUgY2Fubm90IGJlIGNyZWF0ZWQ=-->chore: panic if a random name cannot be created<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/853
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
If a container is configured for implicit removal in the docker/podman server, it will race against the explicit removal performed by the runner.
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/851): <!--number 851 --><!--line 0 --><!--description Zml4OiBjb250YWluZXIgcmVtb3ZhbCBpcyB0aGUgcnVubmVyIHJlc3BvbnNpYmlsaXR5-->fix: container removal is the runner responsibility<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/851
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
rc.Config should be treated as read-only and not as a temporary storage for the variable list of valid volumes for containers sharing this configuration.
Refs forgejo/runner#848
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/849): <!--number 849 --><!--line 0 --><!--description Zml4OiB0aGUgY29uZmlndXJhdGlvbiBtdXN0IG5vdCBiZSB1c2VkIGFzIHRlbXBvcmFyeSBzdG9yYWdl-->fix: the configuration must not be used as temporary storage<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/849
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
A multiline secret transformed into a single line by replacing with \ followed by n is also redacted.
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/845): <!--number 845 --><!--line 0 --><!--description Zml4KHNlY3VyaXR5KTogbXVsdGxpbmUgc2VjcmV0cyB0cml2aWFsbHkgdHJhbnNmb3JtZWQgYXJlIHJlZGFjdGVk-->fix(security): multline secrets trivially transformed are redacted<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/845
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
```
2025-08-11T13:02:51.0737198Z --- FAIL: TestRunner_RunEvent (431.14s)
2025-08-11T13:02:51.0737236Z --- FAIL: TestRunner_RunEvent/evalmatrix (2.69s)
2025-08-11T13:02:51.0737270Z runner_test.go:211:
2025-08-11T13:02:51.0737303Z Error Trace: /home/debian/.cache/act/1682da88a8a84081/hostexecutor/act/runner/runner_test.go:211
2025-08-11T13:02:51.0737398Z /home/debian/.cache/act/1682da88a8a84081/hostexecutor/act/runner/runner_test.go:362
2025-08-11T13:02:51.0737436Z Error: Received unexpected error:
2025-08-11T13:02:51.0737470Z failed to copy content to container: Error response from daemon: Could not find the file /var/run/act/ in container ab61dffc6010bc922c0ab2d2c7edb7a7fe066258ce0145d4146771ce6afbc8f9
2025-08-11T13:02:51.0737507Z Test: TestRunner_RunEvent/evalmatrix
2025-08-11T13:02:51.0737551Z Messages: /home/debian/.cache/act/1682da88a8a84081/hostexecutor/act/runner/testdata/evalmatrix
```
```
2025-08-11T13:12:06.9179188Z --- FAIL: TestRunner_RunEvent (343.90s)
2025-08-11T13:12:06.9179215Z --- FAIL: TestRunner_RunEvent/strategy (7.71s)
2025-08-11T13:12:06.9179241Z runner_test.go:211:
2025-08-11T13:12:06.9179269Z Error Trace: /home/debian/.cache/act/5a78e5e8c5cb3275/hostexecutor/act/runner/runner_test.go:211
2025-08-11T13:12:06.9179296Z /home/debian/.cache/act/5a78e5e8c5cb3275/hostexecutor/act/runner/runner_test.go:362
2025-08-11T13:12:06.9179325Z Error: Received unexpected error:
2025-08-11T13:12:06.9179352Z failed to copy content to container: Error response from daemon: Could not find the file /var/run/act/ in container 0bee24fbd0b16843147b45915d25aa7bb32c09d68bfdff81cc73bf7278d1c72d
2025-08-11T13:12:06.9179381Z Test: TestRunner_RunEvent/strategy
2025-08-11T13:12:06.9179407Z Messages: /home/debian/.cache/act/5a78e5e8c5cb3275/hostexecutor/act/model/testdata/strategy
```
```
2025-08-11T13:34:24.7442134Z --- FAIL: TestRunner_RunEvent (369.80s)
2025-08-11T13:34:24.7442158Z --- FAIL: TestRunner_RunEvent/no-panic-on-invalid-composite-action (3.04s)
2025-08-11T13:34:24.7442185Z runner_test.go:214:
2025-08-11T13:34:24.7442209Z Error Trace: /home/debian/.cache/act/690f62172f9b2595/hostexecutor/act/runner/runner_test.go:214
2025-08-11T13:34:24.7442235Z /home/debian/.cache/act/690f62172f9b2595/hostexecutor/act/runner/runner_test.go:362
2025-08-11T13:34:24.7442262Z Error: Error "failed to copy content to container: Error response from daemon: Could not find the file /var/run/act/ in container 6441c18fec5b0e3a172672a243e599b628f7729ecaeb543fa3bd2cd02af146e1" does not contain "missing steps in composite action"
2025-08-11T13:34:24.7442295Z Test: TestRunner_RunEvent/no-panic-on-invalid-composite-action
```
In the absence of a stack trace, having three different places in the
sources where the same error message shows does not help to figure out
how it can happen.
This is a daily false negative.
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/846): <!--number 846 --><!--line 0 --><!--description Y2hvcmUodGVzdHMpOiBkaWZmZXJlbnRpYXRlICdmYWlsZWQgdG8gY29weSBjb250ZW50JyBlcnJvcnM=-->chore(tests): differentiate 'failed to copy content' errors<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/846
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
It's worth noting for users: the runner does not actually invoke different versions of node depending on the `using` tag -- it just defers to the `node` command in the path regardless of the tagged value. This change allows `node24` to be provided without error, the same level of support as node12...node20.
FYI: This allows the use of `github.com/actions/checkout@v5`, which was released today and is marked `using: node24`.
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/847
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
It is not a breaking change for Forgejo because Forgejo v13 already depends on Go v1.24 and Forgejo runner v9 is not compatible with Forgejo versions before v13 from an API point of view. It is however compatible from a protocol point of view and this does not depend on the Go version being used.
It would be a breaking change for third party software using the runner as a package but it is not designed or supported for that.
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/839): <!--number 839 --><!--line 0 --><!--description Y2hvcmU6IHJlcXVpcmUgR28gdjEuMjQ=-->chore: require Go v1.24<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/839
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [code.forgejo.org/forgejo/runner](https://forgejo.org) ([source](https://code.forgejo.org/forgejo/runner)) | major | `7.0.0` -> `9.0.3` |
---
### Release Notes
<details>
<summary>forgejo/runner (code.forgejo.org/forgejo/runner)</summary>
### [`v9.0.3`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.3)
[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.2...v9.0.3)
- [User guide](https://forgejo.org/docs/next/user/actions/overview/)
- [Administrator guide](https://forgejo.org/docs/next/admin/actions/)
- [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions)
Release Notes
***
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- features
- [PR](https://code.forgejo.org/forgejo/runner/pulls/804): <!--number 804 --><!--line 0 --><!--description ZmVhdDogbHhjLXN5c3RlbWQgZGVmYXVsdHMgdG8gdXNpbmcgRm9yZ2VqbyBydW5uZXIgOS4wLjI=-->feat: lxc-systemd defaults to using Forgejo runner 9.0.2<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/784): <!--number 784 --><!--line 0 --><!--description ZmVhdDogLS1oZWFsdGgtKiBvcHRpb25zIGFyZSBhbGxvd2VkIGluIGpvYi48aWQ+LnNlcnZpY2VzLjxpZD4ub3B0aW9ucw==-->feat: --health-\* options are allowed in `job.<id>.services.<id>.options`<!--description-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/810): <!--number 810 --><!--line 0 --><!--description Zml4OiBsb2cgdGhlIFVSTCBvZiB0aGUgYWN0aW9uIHdoZW4gaXQgZmFpbHMgc2NoZW1hIHZhbGlkYXRpb24=-->fix: log the URL of the action when it fails schema validation<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/798): <!--number 798 --><!--line 0 --><!--description Zml4OiBsaW5nZXJpbmcgc2VydmljZXMvdm9sdW1lcy9uZXR3b3JrcyBhZnRlciBqb2JzIGlmIGNsZWFudXAgdGFrZXMgPjFtaW4=-->fix: lingering services/volumes/networks after jobs if cleanup takes >1min<!--description-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/806): <!--number 806 --><!--line 0 --><!--description Y2hvcmU6IHVwZ3JhZGUgbHhjLWhlbHBlcnM=-->chore: upgrade lxc-helpers<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/627): <!--number 627 --><!--line 0 --><!--description Y2hvcmU6IHRlYWNoIHJlbm92YXRlIGFib3V0IGV4YW1wbGVzL2x4Yy1zeXN0ZW1kL2Zvcmdlam8tcnVubmVyLXNlcnZpY2Uuc2g=-->chore: teach renovate about examples/lxc-systemd/forgejo-runner-service.sh<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/807): <!--number 807 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2NvbnRhaW5lcmQvZXJyZGVmcyB0byB2MQ==-->Update module github.com/containerd/errdefs to v1<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/803): <!--number 803 --><!--line 0 --><!--description Y2hvcmU6IGV4cGxhaW4gdGhhdCBwYXJ0IG9mIHRoZSBzb3VyY2UgaXMgQXBhY2hlIDI=-->chore: explain that part of the source is Apache 2<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/790): <!--number 790 --><!--line 0 --><!--description Y2hvcmUoY2xlYW51cCk6IGRpc3BhdGNoIHdvcmtmbG93cyBhY2NvcmRpbmcgdG8gdGhlIHJvbGUgb2YgdGhlIHJlcG9zaXRvcnk=-->chore(cleanup): dispatch workflows according to the role of the repository<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/797): <!--number 797 --><!--line 0 --><!--description Y2hvcmU6IHVuaWZ5IGZvcmdlam8gaW1hZ2UgbmFtZXMgbG9jYXRpb24=-->chore: unify forgejo image names location<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/799): <!--number 799 --><!--line 0 --><!--description Y2hvcmU6IHJlcGxhY2UgZG9ja2VyIGh1YiB3aXRoIGNvZGUuZm9yZ2Vqby5vcmc=-->chore: replace docker hub with code.forgejo.org<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/802): <!--number 802 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZ2NpL2dvbGFuZ2NpLWxpbnQvdjIvY21kL2dvbGFuZ2NpLWxpbnQgdG8gdjIuMy4x-->Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.3.1<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/801): <!--number 801 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL29wZW5jb250YWluZXJzL3NlbGludXggdG8gdjEuMTIuMA==-->Update module github.com/opencontainers/selinux to v1.12.0<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/800): <!--number 800 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWdpdC9nby1naXQvdjUgdG8gdjUuMTYuMg==-->Update module github.com/go-git/go-git/v5 to v5.16.2<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/796): <!--number 796 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2RvY2tlci9jbGkgdG8gdjI4LjMuMytpbmNvbXBhdGlibGU=-->Update module github.com/docker/cli to v28.3.3+incompatible<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/795): <!--number 795 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS40LjA=-->Update dependency forgejo/release-notes-assistant to v1.4.0<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/794): <!--number 794 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3NwZjEzL3BmbGFnIHRvIHYxLjAuNw==-->Update module github.com/spf13/pflag to v1.0.7<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/793): <!--number 793 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL29wZW5jb250YWluZXJzL2ltYWdlLXNwZWMgdG8gdjEuMS4x-->Update module github.com/opencontainers/image-spec to v1.1.1<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/792): <!--number 792 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnby5ldGNkLmlvL2Jib2x0IHRvIHYxLjQuMg==-->Update module go.etcd.io/bbolt to v1.4.2<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/791): <!--number 791 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3JoeXNkL2FjdGlvbmxpbnQgdG8gdjEuNy43-->Update module github.com/rhysd/actionlint to v1.7.7<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/787): <!--number 787 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWdpdC9nby1iaWxseS92NSB0byB2NS42LjI=-->Update module github.com/go-git/go-billy/v5 to v5.6.2<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/789): <!--number 789 --><!--line 0 --><!--description Y2hvcmU6IHRoZSByZWxlYXNlIGxpbmsgdG8gUkVMRUFTRS1OT1RFUy5tZCBpcyBubyBsb25nZXIgbmVlZGVkICh0YWtlIDIp-->chore: the release link to RELEASE-NOTES.md is no longer needed (take 2)<!--description-->
<!--end release-notes-assistant-->
### [`v9.0.2`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.2)
[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.1...v9.0.2)
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- features
- [PR](https://code.forgejo.org/forgejo/runner/pulls/783): <!--number 783 --><!--line 0 --><!--description ZmVhdDogdXNlIGNhY2hlLXtmcm9tLHRvfTogdHlwZT1naGEgaW4gdGhlIGRvY2tlci9idWlsZC1wdXNoLWFjdGlvbiBleGFtcGxl-->feat: use cache-{from,to}: type=gha in the docker/build-push-action example<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/781): <!--number 781 --><!--line 0 --><!--description ZmVhdDogYWRkIGFuIExYQyBiYXNlZCBleGFtcGxlIG9mIGRvY2tlci9idWlsZC1wdXNoLWFjdGlvbiB1c2FnZQ==-->feat: add an LXC based example of docker/build-push-action usage<!--description-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/786): <!--number 786 --><!--line 0 --><!--description Zml4OiB2YXJzIGNvbnRleHQgaXMgYWxsb3dlZCBpbiBkZWZhdWx0IHZhbHVlcyBvZiBhY3Rpb24gaW5wdXRz-->fix: vars context is allowed in default values of action inputs<!--description-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/788): <!--number 788 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9mb3JnZWpvL2Zvcmdlam8tYnVpbGQtcHVibGlzaCBhY3Rpb24gdG8gdjUuNC4x-->Update https://data.forgejo.org/forgejo/forgejo-build-publish action to v5.4.1<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/782): <!--number 782 --><!--line 0 --><!--description Y2hvcmU6IHRoZSByZWxlYXNlIGxpbmsgdG8gUkVMRUFTRS1OT1RFUy5tZCBpcyBubyBsb25nZXIgbmVlZGVk-->chore: the release link to RELEASE-NOTES.md is no longer needed<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/780): <!--number 780 --><!--line 0 --><!--description Y2hvcmUoY2kpOiBhdXRvcmVtb3ZlIHdoZW4gcnVubmluZyBhIHdvcmtmbG93IGluIGEgdGVzdA==-->chore(ci): autoremove when running a workflow in a test<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/778): <!--number 778 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS4zLjY=-->Update dependency forgejo/release-notes-assistant to v1.3.6<!--description-->
<!--end release-notes-assistant-->
### [`v9.0.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.1)
[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v9.0.0...v9.0.1)
<!--start release-notes-assistant-->
<!--URL:https://placeholder:cf42304136a3685c49de800f5b056f97d6471d33@​code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/777): <!--number 777 --><!--line 0 --><!--description Y2hvcmU6IHRvIGFsbG93IHRoZSBydW5uZXIgdG8gYmUgaW1wb3J0ZWQsIHY5IG5lZWRzIHRvIGJlIGluIHRoZSBnbyBtb2R1bGU=-->chore: to allow the runner to be imported, v9 needs to be in the go module<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/776): <!--number 776 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2RvY2tlci9kb2NrZXIgdG8gdjI4LjMuMytpbmNvbXBhdGlibGUgW1NFQ1VSSVRZXQ==-->Update module github.com/docker/docker to v28.3.3+incompatible \[SECURITY]<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/775): <!--number 775 --><!--line 0 --><!--description Y2hvcmU6IHJlbGVhc2Ugbm90ZXMgYXJlIG5vdyBwdWJsaXNoZWQgdG9nZXRoZXIgd2l0aCB0aGUgcmVsZWFzZQ==-->chore: release notes are now published together with the release<!--description-->
<!--end release-notes-assistant-->
### [`v9.0.0`](https://code.forgejo.org/forgejo/runner/releases/tag/v9.0.0)
[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v8.0.1...v9.0.0)
Workflows and actions go through a schema validation and the runner will not start a job if they do not pass. Some existing workflows or actions may have syntax errors that did not prevent them from running with versions 7.0.0 and below but they will no longer work with versions 8.0.0 and above.
Existing workflows can be verified and fixed before upgrading by using the new `forgejo-runner validate` command. For instance, the following will try to validate workflows and/or actions found in the Git repository at `https://example.com/my/repo` (a local directory at the root of a Git repository can also be used):
```sh
$ forgejo-runner validate --repository https://example.com/my/repo
.forgejo/workflows/release.yml workflow schema validation OK
.forgejo/workflows/test.yml workflow schema validation OK
```
If the error is not immediately obvious, please file an issue with a copy of the failed workflow and revert to using version 7.0.0 until it is resolved.
***
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- features including breaking changes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/740): <!--number 740 --><!--line 0 --><!--description ZmVhdCE6IHJlbW92ZSBzdXBwb3J0IGZvciB1c2luZyBhbiBhcnRpZmFjdCBzZXJ2ZXIgdmlhIENMSQ==-->feat!: remove support for using an artifact server via CLI<!--description-->
- features
- [PR](https://code.forgejo.org/forgejo/runner/pulls/757): <!--number 757 --><!--line 0 --><!--description ZmVhdDogdGhlIG5ldyBgZm9yZ2Vqby1ydW5uZXIgdmFsaWRhdGVgIGNvbW1hbmQgY2FuIGJlIHVzZWQgdG8gdmVyaWZ5IGlmIGFuIGFjdGlvbiBvciBhIHdvcmtmbG93IGlzIGNvbmZvcm1hbnQgd2l0aCB0aGUgZXhwZWN0ZWQgc2NoZW1hLiBgZm9yZ2Vqby1ydW5uZXIgdmFsaWRhdGUgLS1yZXBvc2l0b3J5IGh0dHBzOi8vZXhhbXBsZS5jb20vbXkvcmVwb3NpdG9yeWAgd2lsbCB2YWxpZGF0ZSBhbGwgdGhlIHdvcmtmbG93cyBhbmQgYWN0aW9ucyBhIEdpdCByZXBvc2l0b3J5IGNvbnRhaW5zLiBBbHRlcm5hdGl2ZWx5ICBgZm9yZ2Vqby1ydW5uZXIgdmFsaWRhdGUgLS1wYXRoIG15YWN0aW9uL2FjdGlvbi55bWwgLS1hY3Rpb25gIG9yIGBmb3JnZWpvLXJ1bm5lciB2YWxpZGF0ZSAtLXBhdGggLmZvcmdlam8vd29ya2Zsb3dzL3Rlc3QueW1sIC0td29ya2Zsb3dgIGNhbiBiZSB1c2VkIHRvIHZhbGlkYXRlIGEgc2luZ2xlIGZpbGUuIEl0IGlzIHJlY29tbWVuZGVkIHRvIHVzZSB0aGVzZSBjb21tYW5kcyB0byB2ZXJpZnkgZXhpc3RpbmcgYWN0aW9ucyBhbmQgd29ya2Zsb3dzIHBhc3MgYmVmb3JlIHVwZ3JhZGluZyB0byBbRm9yZ2VqbyBydW5uZXIgdjguMC4wXShodHRwczovL2NvZGUuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9ydW5uZXIvc3JjL2JyYW5jaC9tYWluL1JFTEVBU0UtTk9URVMubWQjOC0wLTApIG9yIGFib3ZlIHRvIG5vdCBkaXNydXB0IGV4aXN0aW5nIHdvcmtmbG93cy4=-->feat: the new `forgejo-runner validate` command can be used to verify if an action or a workflow is conformant with the expected schema. `forgejo-runner validate --repository https://example.com/my/repository` will validate all the workflows and actions a Git repository contains. Alternatively `forgejo-runner validate --path myaction/action.yml --action` or `forgejo-runner validate --path .forgejo/workflows/test.yml --workflow` can be used to validate a single file. It is recommended to use these commands to verify existing actions and workflows pass before upgrading to [Forgejo runner v8.0.0](https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#8-0-0) or above to not disrupt existing workflows.<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/768): <!--number 768 --><!--line 0 --><!--description ZmVhdChzZWN1cml0eSk6IHJlY29tbWVuZCBzZWN1cml0eSBpc3N1ZXMgYXJlIHJlcG9ydGVkIHRvIHNlY3VyaXR5QGZvcmdlam8ub3Jn-->feat(security): recommend security issues are reported to security@forgejo.org<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/769): <!--number 769 --><!--line 0 --><!--description ZmVhdCh0ZXN0cyk6IGNtZCBleGVjdXRlQ29tbWFuZCBjYXB0dXJlcyBzdGRlcnIgJiBzdGRvdXQ=-->feat(tests): cmd executeCommand captures stderr & stdout<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/753): <!--number 753 --><!--line 0 --><!--description ZmVhdDogbWVyZ2UgZm9yZ2Vqby9hY3QvcGtnIGluIHRoZSBhY3QgZGlyZWN0b3J5-->feat: merge forgejo/act/pkg in the act directory<!--description-->
- bug fixes
- [PR](https://code.forgejo.org/forgejo/runner/pulls/770): <!--number 770 --><!--line 0 --><!--description Zml4OiBhbGxvdyBleHByZXNzaW9ucyBpbiBhY3Rpb24gZGVzY3JpcHRpb25zIGFuZCBpbmNvbXBsZXRlIGFjdGlvbiBpbnB1dHM=-->fix: allow expressions in action descriptions and incomplete action inputs<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/761): <!--number 761 --><!--line 0 --><!--description Zml4OiB0aGUgdmFycyBjb250ZXh0IGlzIGFsbG93ZWQgaW4gYW4gYWN0aW9uIHN0ZXAgZW52-->fix: the vars context is allowed in an action step env<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/766): <!--number 766 --><!--line 0 --><!--description Zml4OiBhbGxvdyBleHByZXNzaW9ucyBpbiBzdGVwIGFuZCBqb2IgdXNlczo=-->fix: allow expressions in step and job uses:<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/762): <!--number 762 --><!--line 0 --><!--description Zml4KGNpKTogdXNlIGNvZGUuZm9yZ2Vqby5vcmcgaW5zdGVhZCBvZiB0aGUgZG9ja2VyIGh1Yg==-->fix(ci): use code.forgejo.org instead of the docker hub<!--description-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/772): <!--number 772 --><!--line 0 --><!--description UmVzdG9yZSBgY29udHJpYi9mb3JnZWpvLXJ1bm5lci5zZXJ2aWNlYA==-->Restore `contrib/forgejo-runner.service`<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/767): <!--number 767 --><!--line 0 --><!--description Y2hvcmU6IHJlbW92ZSB1bnVzZWQvdW5tYWludGFpbmVkIGZpbGVz-->chore: remove unused/unmaintained files<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/759): <!--number 759 --><!--line 0 --><!--description Y2hvcmU6IGEgc2luZ2xlIHRlc3R1dGlscyBmb3IgYm90aCBhY3QgYW5kIHRoZSBydW5uZXI=-->chore: a single testutils for both act and the runner<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/758): <!--number 758 --><!--line 0 --><!--description Y2hvcmU6IHJlbm92YXRlIG11c3Qgbm90IGxvb2sgYXQgYW55IHRlc3RkYXRhIHN1YmRpcmVjdG9yeQ==-->chore: renovate must not look at any testdata subdirectory<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/756): <!--number 756 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZS1ub3Rlcyk6IGZpbmFsaXplIDkuMC4w-->chore(release-notes): finalize 9.0.0<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/754): <!--number 754 --><!--line 0 --><!--description Y2hvcmU6IHVzZSB0aGUgYWN0IGRpcmVjdG9yeSBpbnN0ZWFkIG9mIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9mb3JnZWpvL2FjdA==-->chore: use the act directory instead of https://code.forgejo.org/forgejo/act<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/752): <!--number 752 --><!--line 0 --><!--description Y2hvcmUoZG9jcyk6IG5ha2VkIGBob3N0YCBzY2hlbWEgaW4gOC4wLjAgaXMgYSBicmVha2luZyBjaGFuZ2U=-->chore(docs): naked `host` schema in 8.0.0 is a breaking change<!--description-->
- [PR](https://code.forgejo.org/forgejo/runner/pulls/750): <!--number 750 --><!--line 0 --><!--description Y2hvcmU6IGRpc2FibGUgcGFja2FnZSBuYW1lIGNoZWNrcyBmb3IgcmV2aXZlIFtza2lwIGNhc2NhZGVd-->chore: disable package name checks for revive \[skip cascade]<!--description-->
<!--end release-notes-assistant-->
### [`v8.0.1`](https://code.forgejo.org/forgejo/runner/blob/HEAD/RELEASE-NOTES.md#801)
[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v8.0.0...v8.0.1)
- [tolerate strings for fail-fast, max-parallel, timeout-minutes, cancel-timeout-minutes](https://code.forgejo.org/forgejo/act/pulls/203).
### [`v8.0.0`](https://code.forgejo.org/forgejo/runner/blob/HEAD/RELEASE-NOTES.md#800)
[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v7.0.0...v8.0.0)
- Breaking change: workflows files go through a [schema validation](https://code.forgejo.org/forgejo/act/pulls/170) and will not run if they do not pass. Some existing workflows may have syntax errors that did not prevent them from running with versions 7.0.0 and below but they will no longer work with versions 8.0.0 and above.
Existing workflows can be verified and fixed before upgrading by using `forgejo-runner exec --workflows path-to-the-workflow`. For instance in a workflow where `ruins-on` was typed by mistake instead of `runs-on`:
```sh
$ forgejo-runner exec --event unknown --workflows ../forgejo/.forgejo/workflows/build-release.yml
Error: workflow is not valid. 'build-release.yml': Line: 32 Column 5: Failed to match job-factory: Line: 32 Column 5: Unknown Property ruins-on
Line: 32 Column 5: Failed to match workflow-job: Line: 32 Column 5: Unknown Property ruins-on
Line: 35 Column 5: Unknown Property steps
Forgejo Actions YAML Schema validation error
```
If the error is not immediately obvious, please file an issue with a copy of the failed workflow and revert to using version 7.0.0 until it is resolved.
- Breaking change: the logic assigning labels was updated and refactored:
- in the absence of a label or a label, [default to `docker://node:22-bookworm` instead of `docker://node:20-bullseye` or `host`](https://code.forgejo.org/forgejo/runner/issues/134).
- if the `lxc` scheme is set with no argument, it defaults to `lxc://debian:bookworm` instead of `lxc://debian:bullseye`.
- the `host` schema cannot have any argument, it can no longer be `host://-self-hosted`
- Breaking change: [bash fallback to sh if it is not available](https://code.forgejo.org/forgejo/runner/issues/150). It will use `bash` instead of `sh` when a container image is explicitly specified in the step. If a workflow depens on that behavior, it will need to be modified to explictly set the shell to `sh`.
- Breaking change: [sanitize network aliases to be valid DNS names](https://code.forgejo.org/forgejo/act/pulls/190). It is breaking for workflows with services that rely on host names (derived from the service name or the job name) that do not match `[^A-Z0-9-]+`. They will be sanitized and a message displayed in the logs showing the sanitized name. The service can either be renamed to match the constraint so it can be used as is. Or the sanitized name can be used. For instance of a PostgreSQL service runs as `data.base` it will be sanitized as `data_base`.
- [secrets that contain multiple lines are masked from the output](https://code.forgejo.org/forgejo/runner/pulls/661).
- [sum256 the container name so derivations do not overflow](https://code.forgejo.org/forgejo/act/pulls/191).
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS41MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuNTEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/838
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
> **Note** change the repository description once it is merged.
- Security issues are to be filed responsibly and will be taken care of by the security team.
Refs https://codeberg.org/forgejo/discussions/issues/377
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/774): <!--number 774 --><!--line 0 --><!--description Y2hvcmU6IHJlbW92ZSB0aGUgYWxwaGEgcXVhbGl0eSB3YXJuaW5nLCBpdCBpcyBzZWN1cmUgZW5vdWdoIHRvIGJlIHVzZWQgaW4gcHJvZHVjdGlvbg==-->chore: remove the alpha quality warning, it is secure enough to be used in production<!--description-->
<!--end release-notes-assistant-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/774
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
Refs https://github.com/nektos/act/pull/2495
---
* Disable "unable to get git repo" when none exists.
* Restore error back so it's included in bug reports
Change from Warningf to Debugf.
---------
Co-authored-by: Casey Lee <cplee@nektos.com>
(cherry picked from commit e42a534b2e65d28b41532f9a44d18c0354aecfc2)
<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
- [PR](https://code.forgejo.org/forgejo/runner/pulls/822): <!--number 822 --><!--line 0 --><!--description Y2hvcmU6ICJ1bmFibGUgdG8gZ2V0IGdpdCByZXBvIiBpcyBhIGRlYnVnIG1lc3NhZ2UsIG5vdCBhIHdhcm5pbmcgW3NraXAgY2FzY2FkZV0=-->chore: "unable to get git repo" is a debug message, not a warning [skip cascade]<!--description-->
<!--end release-notes-assistant-->
Co-authored-by: Steven Edwards <cureadvocate@gmail.com>
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/822
Reviewed-by: Gusted <gusted@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>