ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-25 14:13:40 +09:00
Code Issues Projects Releases Wiki Activity

feat(actions): update actionslib, support self:, misc fixes (#39358)

Browse Source 
Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1, moves workflow
parsing into it and aligns behaviour with GitHub.

1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths.
1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept
expressions, including over `needs`. A job whose `name`, `runs-on` or
`continue-on-error` reads `needs` is resolved once they finish.
1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and
is decided before the matrix, as on github.com.
1. Matrix `fail-fast` cancels the other combinations, and `always()`
jobs keep running when a run is cancelled.
1. Invalid workflow files, including a malformed `on:` and unknown or
cyclic `needs`, show up on push as failed runs with the error.
1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or
failed with the error, instead of staying blocked.
1. Reusable workflows: a missing and an unreadable repository fail
alike, public callers cannot use private workflows, nested jobs cannot
exceed the caller's token permissions.
1. Runner labels match case-insensitively, and `runs-on` accepts an
array from an expression.

Runner PR: https://gitea.com/gitea/runner/pulls/1247
Docs PR: https://gitea.com/gitea/docs/pulls/553
Fixes: https://github.com/go-gitea/gitea/issues/38990
Fixes: https://github.com/go-gitea/gitea/issues/39382
Fixes: https://github.com/go-gitea/gitea/issues/32364
Fixes: https://github.com/go-gitea/gitea/issues/36077
Fixes: https://github.com/go-gitea/gitea/issues/23277
Fixes: https://github.com/go-gitea/gitea/issues/29020
Co-authored-by: Claude (Opus 5) <noreply@anthropic.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>
This commit is contained in:
silverwind
2026-09-25 00:06:42 +02:00
committed by GitHub
parent 64f31d9b70
commit f757631a47
59 changed files with 1509 additions and 2223 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/actions/run_job.go
+33 -20
View File
@@ -10,6 +10,7 @@ import (
"slices"
"time"
act_model "gitea.dev/actionslib/pkg/model"
"gitea.dev/models/db"
repo_model "gitea.dev/models/repo"
"gitea.dev/modules/actions/jobparser"
@@ -192,32 +193,26 @@ func (job *ActionRunJob) LoadAttributes(ctx context.Context) error {
// ParseJob parses the job structure from the ActionRunJob.WorkflowPayload
func (job *ActionRunJob) ParseJob() (*jobparser.Job, error) {
if job.IsMatrixDeferred {
// The needs were erased before the placeholder was persisted, so jobparser.Parse no longer
// recognises the raw matrix it still carries and would re-expand it: see ParseRawSingleWorkflow.
_, workflowJob, err := jobparser.ParseRawSingleWorkflow(job.WorkflowPayload)
if err != nil {
return nil, fmt.Errorf("job %d deferred matrix placeholder: unable to parse: %w", job.ID, err)
}
return workflowJob, nil
}
// job.WorkflowPayload is a SingleWorkflow created from an ActionRun's workflow, which exactly contains this job's YAML definition.
// Ideally it shouldn't be called "Workflow", it is just a job with global workflow fields + trigger
parsedWorkflows, err := jobparser.Parse(job.WorkflowPayload)
// read as stored, jobparser.Parse would evaluate the payload again and reset its strategy.job-index
_, workflowJob, err := jobparser.ParseRawSingleWorkflow(job.WorkflowPayload)
if err != nil {
return nil, fmt.Errorf("job %d single workflow: unable to parse: %w", job.ID, err)
} else if len(parsedWorkflows) != 1 {
return nil, fmt.Errorf("job %d single workflow: not single workflow", job.ID)
}
_, workflowJob := parsedWorkflows[0].Job()
if workflowJob == nil {
// it shouldn't happen, and since the callers don't check nil, so return an error instead of nil
return nil, util.ErrorWrap(util.ErrNotExist, "job %d single workflow: payload doesn't contain a job", job.ID)
}
return workflowJob, nil
}
func (job *ActionRunJob) IsMatrixSiblingOf(other *ActionRunJob) bool {
return job.JobID == other.JobID && job.ParentJobID == other.ParentJobID && job.ID != other.ID
}
func (job *ActionRunJob) GetFailFast() (bool, error) {
parsed, err := job.ParseJob()
if err != nil {
return false, err
}
return (&act_model.Strategy{FailFastString: parsed.Strategy.FailFastString}).GetFailFast(), nil
}
func GetRunJobByRepoAndID(ctx context.Context, repoID, jobID int64) (*ActionRunJob, error) {
var job ActionRunJob
has, err := db.GetEngine(ctx).Where("id=? AND repo_id=?", jobID, repoID).Get(&job)
@@ -663,6 +658,9 @@ func AggregateJobStatus(jobs []*ActionRunJob) Status {
// statuses like cancelled/failure when no job is waiting or running.
return StatusBlocked
case hasCancelled:
if hasFailure && hasFailFastMatrixFailure(jobs) {
return StatusFailure
}
return StatusCancelled
case hasFailure:
return StatusFailure
@@ -671,6 +669,21 @@ func AggregateJobStatus(jobs []*ActionRunJob) Status {
}
}
func hasFailFastMatrixFailure(jobs []*ActionRunJob) bool {
for _, failed := range jobs {
if failed.Status != StatusFailure || failed.ContinueOnError || !slices.ContainsFunc(jobs, func(sibling *ActionRunJob) bool {
return sibling.IsMatrixSiblingOf(failed) && sibling.Status == StatusCancelled
}) {
continue
}
failFast, err := failed.GetFailFast()
if err == nil && failFast {
return true
}
}
return false
}
// CancelPreviousJobs cancels all previous jobs of the same repository, reference, workflow, and event.
// It's useful when a new run is triggered, and all previous runs needn't be continued anymore.
func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID string, event webhook_module.HookEventType) ([]*ActionRunJob, error) {
models/actions/run_job_status_test.go
-1
View File
@@ -51,7 +51,6 @@ func TestAggregateJobStatus(t *testing.T) {
{[]Status{StatusSuccess, StatusRunning}, StatusRunning},
{[]Status{StatusSuccess, StatusBlocked}, StatusBlocked},
// any cancelled, then cancelled
{[]Status{StatusCancelled}, StatusCancelled},
{[]Status{StatusCancelled, StatusSuccess}, StatusCancelled},
{[]Status{StatusCancelled, StatusSkipped}, StatusCancelled},
models/actions/run_job_test.go
+3 -7
View File
@@ -308,8 +308,6 @@ jobs:
`, matrix)
}
// The shape Parse happens to survive, so only the name tells the two paths apart. What Parse makes
// of every other shape is asserted in TestParseRawSingleWorkflowRoundTripsDeferredPlaceholder.
t.Run("a placeholder is read back, not re-expanded", func(t *testing.T) {
job := &ActionRunJob{ID: 1, JobID: "build", IsMatrixDeferred: true, WorkflowPayload: payload("version: ${{ fromJson(needs.setup.outputs.m) }}")}
parsed, err := job.ParseJob()
@@ -318,13 +316,11 @@ jobs:
assert.Equal(t, "build", parsed.Name)
})
t.Run("an expanded job still goes through the full parse", func(t *testing.T) {
job := &ActionRunJob{ID: 1, JobID: "build", WorkflowPayload: payload("version: [1]")}
t.Run("an expanded job keeps its stored job-index", func(t *testing.T) {
job := &ActionRunJob{ID: 1, JobID: "build", WorkflowPayload: payload("version: [1]\n job-index: 1\n job-total: 2")}
parsed, err := job.ParseJob()
require.NoError(t, err)
require.NotNil(t, parsed)
// Parse bakes the combination into the name, ParseRawSingleWorkflow would not.
assert.Equal(t, "build (1)", parsed.Name)
assert.Equal(t, []any{"build", 1, 2}, []any{parsed.Name, parsed.Strategy.JobIndex, parsed.Strategy.JobTotal})
})
}
models/actions/runner.go
+2 -3
View File
@@ -7,6 +7,7 @@ import (
"context"
"errors"
"fmt"
"slices"
"strings"
"time"
@@ -15,7 +16,6 @@ import (
repo_model "gitea.dev/models/repo"
"gitea.dev/models/shared/types"
user_model "gitea.dev/models/user"
"gitea.dev/modules/container"
"gitea.dev/modules/optional"
"gitea.dev/modules/setting"
"gitea.dev/modules/timeutil"
@@ -200,8 +200,7 @@ func (r *ActionRunner) GenerateAndFillToken() {
// CanMatchLabels checks whether the runner's labels can match a job's "runs-on"
// See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idruns-on
func (r *ActionRunner) CanMatchLabels(jobRunsOn []string) bool {
runnerLabelSet := container.SetOf(r.AgentLabels...)
return runnerLabelSet.Contains(jobRunsOn...) // match all labels
return !slices.ContainsFunc(jobRunsOn, func(label string) bool { return !util.SliceContainsString(r.AgentLabels, label, true) })
}
func init() {
models/actions/runner_test.go
+6
View File
@@ -81,3 +81,9 @@ func TestShouldPersistLastActive(t *testing.T) {
})
}
}
func TestCanMatchLabelsCaseInsensitive(t *testing.T) {
runner := &ActionRunner{AgentLabels: []string{"self-hosted", "Linux", "X64"}}
assert.True(t, runner.CanMatchLabels([]string{"SELF-HOSTED", "linux"}))
assert.False(t, runner.CanMatchLabels([]string{"linux", "arm64"}))
}
models/perm/access/actions_repo_permission_test.go
+11
View File
@@ -93,6 +93,17 @@ func TestGetActionsUserRepoPermission(t *testing.T) {
// Fork PR never gets cross-repo access to other private repos
assert.False(t, perm.CanRead(unit.TypeCode))
publicCaller := *repo2
publicCaller.IsPrivate = false
run := &actions_model.ActionRun{RepoID: repo2.ID, Repo: &publicCaller}
allowed, err := CanReadWorkflowCrossRepo(ctx, repo15, run)
require.NoError(t, err)
assert.False(t, allowed)
run.Repo = repo2
allowed, err = CanReadWorkflowCrossRepo(ctx, repo15, run)
require.NoError(t, err)
assert.True(t, allowed)
})
t.Run("CollaborativeOwner_ForkPR_Denied", func(t *testing.T) {
models/perm/access/repo_permission.go
+5 -7
View File
@@ -686,18 +686,16 @@ func CanReadWorkflowCrossRepo(ctx context.Context, targetRepo *repo_model.Reposi
if err := run.LoadRepo(ctx); err != nil {
return false, err
}
if targetRepo.IsPrivate && !run.Repo.IsPrivate {
return false, nil
}
// (1) Same owner: always allowed (fork-PR scrubbing handled inside).
// (1) Same owner: allowed by owner policy (fork-PR scrubbing handled inside).
if checkSameOwnerCrossRepoAccess(ctx, run.Repo, targetRepo, run.IsForkPullRequest) {
return true, nil
}
// (2) Cross-owner: respect the target repo's collaborative-owner allowlist on its Actions unit.
// The caller (run.Repo) must itself be private. The collaborative-owner grant is owner-level, so without this
// guard a public caller owned by a grantee could pull a private reusable workflow and expose its definition and
// logs in a publicly visible run; requiring a private caller keeps private content flowing private -> private.
// This is intentionally stricter than GitHub, which gates on the target repo's access setting (introduced in #32562):
// https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#allowing-access-to-components-in-a-private-repository
// (2) Cross-owner access requires a private caller and the target's collaborative-owner grant.
if run.Repo.IsPrivate && !run.IsForkPullRequest {
if actionsUnit, err := targetRepo.GetUnit(ctx, unit.TypeActions); err == nil {
if actionsUnit.ActionsConfig().IsCollaborativeOwner(run.Repo.OwnerID) {