fix(actions): evaluate each ${{ }} part on its own (#38754)

Every `${{ }}` part was spliced as raw text into a synthesized
`format('...', <raw>)` call and re-parsed, so unbalanced parentheses
restructured the whole expression:

```yaml
run-name: ${{ 1) && (2 }}     # panicked, aborting workflow parsing for the push
if: x ${{ 1) && (2 }} y       # silently evaluated to 2
```

One scanner shaped like GitHub's template reader now splits every value
and each part is evaluated on its own, so nothing builds an expression
out of text. A part that fails is an error instead of an empty string,
making a `run-name`, `runs-on` or job name that GitHub rejects invalid
here too.

Replaces https://github.com/go-gitea/gitea/pull/38736 as the actual root-cause fix.
Signed-off-by: silverwind <me@silverwind.io>
This commit is contained in:
silverwind
2026-08-06 09:19:20 +00:00
committed by GitHub
parent caf2e03605
commit 231ba1da19
6 changed files with 239 additions and 137 deletions
+1 -10
View File
@@ -8,7 +8,6 @@ import (
"errors"
"fmt"
"gitea.com/gitea/runner/act/exprparser"
"gitea.com/gitea/runner/act/model"
"go.yaml.in/yaml/v4"
)
@@ -526,15 +525,7 @@ func EvaluateJobIfExpression(jobID string, job *Job, gitCtx map[string]any, resu
}
}
evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs))
expr, err := rewriteSubExpression(job.If.Value, false)
if err != nil {
return false, err
}
result, err := evaluator.evaluate(expr, exprparser.DefaultStatusCheckSuccess)
if err != nil {
return false, err
}
return exprparser.IsTruthy(result), nil
return evaluator.evaluateCondition(job.If.Value)
}
// parseMappingNode parse a mapping node and preserve order.