feat: Add support for dynamic matrix evaluation in Gitea Actions workflows (#36564)

Adds dynamic matrix evaluation to Gitea Actions: a job's
`strategy.matrix` can be built from the outputs of the jobs it needs.

```yaml
jobs:
  generate:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set.outputs.result }}
    steps:
      - id: set
        run: echo "result=[1,2,3]" >> $GITHUB_OUTPUT

  build:
    needs: [generate]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        version: ${{ fromJson(needs.generate.outputs.matrix) }}
    steps:
      - run: echo "building ${{ matrix.version }}"
```

Such a matrix cannot be expanded at planning time, so the job is planned
as a single placeholder and expanded by the job emitter once its needs
finish. Each combination is then gated by `if:` and concurrency as
usual.

- A matrix that resolves to no combination fails the job, as on GitHub.
- Expansion is capped at `MaxJobNumPerRun`.
- Workflows without a needs-dependent matrix are unaffected.

Fixes https://github.com/go-gitea/gitea/issues/25179

---------

Signed-off-by: Pascal Zimmermann <pascal.zimmermann@theiotstudio.com>
Signed-off-by: ZPascal <pascal.zimmermann@theiotstudio.com>
Co-authored-by: Claude <claude-sonnet-4-5@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.8) <noreply@anthropic.com>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

services/actions/rerun.go

@@ -136,6 +136,12 @@ type rerunPlan struct {
 	// skipCloneTemplateJobIDs holds the template-attempt DB row IDs of descendants of any reusable caller in rerunAttemptJobIDs.
 	// These jobs should not be cloned, since the caller's lazy expansion will re-insert them fresh.
 	skipCloneTemplateJobIDs container.Set[int64]
+
+	// matrixPlaceholderTemplateIDs holds, per dynamic-matrix job whose matrix must be re-derived in the new attempt,
+	// the template DB row ID to clone as a restored unexpanded placeholder.
+	// The group's remaining combination rows are in matrixSiblingSkipTemplateIDs and are not cloned: they'll be re-expanded.
+	matrixPlaceholderTemplateIDs container.Set[int64]
+	matrixSiblingSkipTemplateIDs container.Set[int64]
 }
 
 // buildRerunPlan constructs a rerunPlan for the given workflow run without writing to the database.
@@ -174,6 +180,7 @@ func buildRerunPlan(ctx context.Context, run *actions_model.ActionRun, triggerUs
 		return nil, err
 	}
 	plan.skipCloneTemplateJobIDs = plan.collectResetCallerDescendants()
+	plan.collectMatrixCollapse()
 
 	return plan, nil
 }
@@ -247,9 +254,19 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 			if plan.skipCloneTemplateJobIDs.Contains(templateJob.ID) {
 				continue
 			}
+			// siblings of a collapsed dynamic-matrix job are not cloned either: re-expansion re-inserts them
+			if plan.matrixSiblingSkipTemplateIDs.Contains(templateJob.ID) {
+				continue
+			}
 
 			newJob := cloneRunJobForAttempt(templateJob, newAttempt)
 
+			if plan.matrixPlaceholderTemplateIDs.Contains(templateJob.ID) {
+				if err := restoreDeferredMatrixPlaceholder(newJob); err != nil {
+					return fmt.Errorf("restore matrix placeholder from job %d: %w", templateJob.ID, err)
+				}
+			}
+
 			// Remap ParentJobID from template attempts's DB ID -> new attempt's DB ID.
 			if templateJob.ParentJobID != 0 {
 				newParentID, ok := templateIDToNewID[templateJob.ParentJobID]
@@ -261,7 +278,9 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 			}
 
 			if plan.rerunAttemptJobIDs.Contains(templateJob.AttemptJobID) {
-				shouldBlockJob := shouldBlock || plan.hasRerunDependency(templateJob)
+				// A deferred-matrix placeholder must go through the emitter, which is the only place
+				// that expands it: dispatching it directly would hand the runner the raw payload.
+				shouldBlockJob := shouldBlock || plan.hasRerunDependency(templateJob) || newJob.IsMatrixDeferred
 
 				newJob.Status = util.Iif(shouldBlockJob, actions_model.StatusBlocked, actions_model.StatusWaiting)
 				newJob.TaskID = 0
@@ -360,8 +379,9 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 	CreateCommitStatusForRunJobs(ctx, plan.run, newJobs...)
 	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, newJobsToRerun)
 
-	// Post-commit kick for expanded callers: let job_emitter resolve its child jobs
-	if hasWaitingCallerJobs {
+	// Post-commit kick for expanded callers and restored matrix placeholders: let job_emitter
+	// resolve child jobs, and re-expand a placeholder whose needs may all be pass-through and done.
+	if hasWaitingCallerJobs || len(plan.matrixPlaceholderTemplateIDs) > 0 {
 		if err := EmitJobsIfReadyByRun(plan.run.ID); err != nil {
 			log.Error("emit run %d after rerun: %v", plan.run.ID, err)
 		}
@@ -519,6 +539,8 @@ func cloneRunJobForAttempt(templateJob *actions_model.ActionRunJob, attempt *act
 		Needs:                  slices.Clone(templateJob.Needs),
 		RunsOn:                 slices.Clone(templateJob.RunsOn),
 		ContinueOnError:        templateJob.ContinueOnError,
+		IsMatrixDeferred:       templateJob.IsMatrixDeferred,
+		DeferredMatrixPayload:  slices.Clone(templateJob.DeferredMatrixPayload),
 		Status:                 templateJob.Status,
 		RawConcurrency:         templateJob.RawConcurrency,
 		IsConcurrencyEvaluated: templateJob.IsConcurrencyEvaluated,
@@ -600,3 +622,52 @@ func createOriginalAttemptForLegacyRun(ctx context.Context, run *actions_model.A
 		return actions_model.UpdateRun(ctx, run, "latest_attempt_id")
 	})
 }
+
+// collectMatrixCollapse decides, per dynamic-matrix job in the rerun set, whether the new
+// attempt must re-derive the matrix instead of reusing the previous attempt's combinations,
+// and fills matrixPlaceholderTemplateIDs / matrixSiblingSkipTemplateIDs accordingly.
+func (p *rerunPlan) collectMatrixCollapse() {
+	p.matrixPlaceholderTemplateIDs = make(container.Set[int64])
+	p.matrixSiblingSkipTemplateIDs = make(container.Set[int64])
+
+	// Group every template row by the key the rows of one matrix job share.
+	type groupKey struct {
+		parentJobID int64
+		jobID       string
+	}
+	groups := make(map[groupKey][]*actions_model.ActionRunJob)
+	for _, tj := range p.templateJobs {
+		key := groupKey{tj.ParentJobID, tj.JobID}
+		groups[key] = append(groups[key], tj)
+	}
+
+	for _, rows := range groups {
+		anchorIdx := slices.IndexFunc(rows, func(j *actions_model.ActionRunJob) bool {
+			return len(j.DeferredMatrixPayload) > 0
+		})
+		if anchorIdx < 0 {
+			continue // not a dynamic-matrix job: a plain job, or a matrix expanded at plan time
+		}
+		anchor := rows[anchorIdx]
+		// Descendants of a reset caller are not cloned at all; the caller's expansion re-inserts the job.
+		if p.skipCloneTemplateJobIDs.Contains(anchor.ID) {
+			continue
+		}
+		inRerunSet := slices.ContainsFunc(rows, func(j *actions_model.ActionRunJob) bool {
+			return p.rerunAttemptJobIDs.Contains(j.AttemptJobID)
+		})
+		if !inRerunSet {
+			continue // pass-through group, cloned as-is
+		}
+		unexpanded := len(rows) == 1 && anchor.IsMatrixDeferred
+		if !unexpanded && !p.hasRerunDependency(anchor) {
+			continue // needs keep their outputs, reuse the combinations
+		}
+		p.matrixPlaceholderTemplateIDs.Add(anchor.ID)
+		for _, row := range rows {
+			if row.ID != anchor.ID {
+				p.matrixSiblingSkipTemplateIDs.Add(row.ID)
+			}
+		}
+	}
+}