1
0
Fork 0
mirror of https://code.forgejo.org/forgejo/runner.git synced 2025-09-30 19:22:09 +00:00
forgejo-runner/act/runner
Earl Warren 11a96bb462
fix(security): ensure unique names for container images created by actions
Container images built by the runner are tagged with a unique name:

- based on the specified `uses` URL for remote actions.
- random for local actions.

In the case of local actions, this will create new tags for each run
but the images (and their layers) will be shared and not be
duplicated. The least recently used tags can be garbage collected by
tools such as https://github.com/stepchowfun/docuum.

Using a different method for creating the tag name for the remote
actions is to help with maintenance by establishing a direct relation
with the `uses` field. It was instead relying on a name transformed
multiple times which makes it more difficult to verify name collision
are not accidentally made possible by one of those transformations.

Without this fix, when a workflow ran a local [docker action](https://forgejo.org/docs/next/user/actions/actions/#docker-actions)
(e.g. the [example in the end-to-end
tests](8f920b4b7a/actions/example-force-rebuild/.forgejo/workflows/test.yml)),
it used an image tag that could collide with other workflows that
happen to use the same name.

The workaround for older runner versions is to set
[`[container].force_rebuild: true`](https://forgejo.org/docs/next/admin/actions/runner-installation/#configuration)
in the runner configuration file.
2025-09-01 13:41:06 +02:00
..
hashfiles [RDNF #11] fix: skipped jobs have no result & fix: favor command-line over files & chore: fix some comments (#143) 2025-06-09 10:25:43 +00:00
res Add super-linter + fix lint issues (#650) 2021-05-03 09:52:03 -07:00
testdata chore: local action name collision regression tests 2025-09-01 13:41:06 +02:00
action.go fix(security): ensure unique names for container images created by actions 2025-09-01 13:41:06 +02:00
action_cache.go chore: panic if a random name cannot be created (#853) 2025-08-14 15:46:01 +00:00
action_cache_offline_mode.go feat: offline mode for new action cache (#2173) 2025-04-12 14:03:12 +00:00
action_cache_test.go test: prevent data race detection in TestActionCache (#858) 2025-08-15 09:00:50 +00:00
action_composite.go chore: fix 'false positive' data race detection in Id/Number default init (#867) 2025-08-20 19:56:03 +00:00
action_test.go chore: use t.Context for tests, activate usetesting for lint + add t.TempDir and t.Chdir (#844) 2025-08-11 13:21:42 +00:00
command.go chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
command_test.go chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
container_mock_test.go chore: to allow the runner to be imported, v9 needs to be in the go module (#777) 2025-07-31 10:35:11 +00:00
expression.go chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00
expression_test.go chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00
job_executor.go chore: fix 'false positive' data race detection in Id/Number default init (#867) 2025-08-20 19:56:03 +00:00
job_executor_test.go chore: fix 'false positive' data race detection in Id/Number default init (#867) 2025-08-20 19:56:03 +00:00
local_repository_cache.go chore: to allow the runner to be imported, v9 needs to be in the go module (#777) 2025-07-31 10:35:11 +00:00
logger.go chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
lxc-helpers-lib.sh upgrade lxc-helpers (#806) 2025-08-04 08:06:31 +00:00
lxc-helpers.sh chore(upgrade): sync lxc-helpers v1.0.3 2025-01-29 10:30:12 +01:00
reusable_workflow.go fix: a remote reusable workflow may be from any host 2025-08-15 09:20:19 +02:00
run_context.go fix: data race in 'runs-on' expressions causes incorrect job labels during execution (#871) 2025-08-16 20:44:40 +00:00
run_context_test.go chore: remove TestRunContext_GetGitHubContext (#900) 2025-08-21 11:54:04 +00:00
runner.go chore: prevent 'false positive' data race detection with Job.If [skip cascade] (#864) 2025-08-15 19:19:54 +00:00
runner_test.go chore: local action name collision regression tests 2025-09-01 13:41:06 +02:00
step.go chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
step_action_local.go chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
step_action_local_test.go chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00
step_action_remote.go chore: modernize code (#857) 2025-08-15 04:54:13 +00:00
step_action_remote_test.go chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00
step_docker.go chore: refactor GetBindsAndMounts to have a context.Context arg 2025-08-14 17:48:34 +02:00
step_docker_test.go chore: use t.Context for tests, activate usetesting for lint + add t.TempDir and t.Chdir (#844) 2025-08-11 13:21:42 +00:00
step_factory.go chore: to allow the runner to be imported, v9 needs to be in the go module (#777) 2025-07-31 10:35:11 +00:00
step_factory_test.go chore: to allow the runner to be imported, v9 needs to be in the go module (#777) 2025-07-31 10:35:11 +00:00
step_run.go fix: data race condition causing incorrect shell on a task step if it referenced a matrix variable (#865) 2025-08-15 21:10:53 +00:00
step_run_test.go fix: data race condition causing incorrect shell on a task step if it referenced a matrix variable (#865) 2025-08-15 21:10:53 +00:00
step_test.go chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#888) 2025-08-20 20:49:49 +00:00