feat(actions): update actionslib, support self:, misc fixes (#39358)

Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1, moves workflow
parsing into it and aligns behaviour with GitHub.

1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths.
1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept
expressions, including over `needs`. A job whose `name`, `runs-on` or
`continue-on-error` reads `needs` is resolved once they finish.
1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and
is decided before the matrix, as on github.com.
1. Matrix `fail-fast` cancels the other combinations, and `always()`
jobs keep running when a run is cancelled.
1. Invalid workflow files, including a malformed `on:` and unknown or
cyclic `needs`, show up on push as failed runs with the error.
1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or
failed with the error, instead of staying blocked.
1. Reusable workflows: a missing and an unreadable repository fail
alike, public callers cannot use private workflows, nested jobs cannot
exceed the caller's token permissions.
1. Runner labels match case-insensitively, and `runs-on` accepts an
array from an expression.

Runner PR: https://gitea.com/gitea/runner/pulls/1247
Docs PR: https://gitea.com/gitea/docs/pulls/553
Fixes: https://github.com/go-gitea/gitea/issues/38990
Fixes: https://github.com/go-gitea/gitea/issues/39382
Fixes: https://github.com/go-gitea/gitea/issues/32364
Fixes: https://github.com/go-gitea/gitea/issues/36077
Fixes: https://github.com/go-gitea/gitea/issues/23277
Fixes: https://github.com/go-gitea/gitea/issues/29020
Co-authored-by: Claude (Opus 5) <noreply@anthropic.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

routers/web/repo/actions/actions.go

@@ -33,8 +33,6 @@ import (
 	actions_service "gitea.dev/services/actions"
 	"gitea.dev/services/context"
 	"gitea.dev/services/convert"
-
-	"go.yaml.in/yaml/v4"
 )
 
 const (
@@ -226,7 +224,7 @@ func prepareWorkflowTemplate(ctx *context.Context, commit *git.Commit) (workflow
 			workflows = append(workflows, workflow)
 			continue
 		}
-		if err := actions.ValidateWorkflowContent(content); err != nil {
+		if _, err := actions.GetEventsFromContent(content); err != nil {
 			workflow.ErrMsg = ctx.Locale.TrString("actions.runs.invalid_workflow_helper", err.Error())
 			workflows = append(workflows, workflow)
 			continue
@@ -441,12 +439,13 @@ func prepareWorkflowDispatchTemplate(ctx *context.Context, workflowInfos []Workf
 	}
 
 	ctx.Data["CurWorkflowExists"] = true
-	curWfDispatchCfg := workflowDispatchConfig(curWorkflow)
+	curWfDispatchCfg := curWorkflow.WorkflowDispatchConfig()
 	if curWfDispatchCfg == nil {
 		return
 	}
 
 	ctx.Data["WorkflowDispatchConfig"] = curWfDispatchCfg
+	ctx.Data["WorkflowDispatchInputs"] = curWorkflow.WorkflowDispatchInputs()
 
 	branchOpts := git_model.FindBranchOptions{
 		RepoID:          ctx.Repo.Repository.ID,
@@ -750,91 +749,6 @@ func loadIsRefDeleted(ctx stdCtx.Context, repoID int64, runs actions_model.RunLi
 	return nil
 }
 
-type WorkflowDispatchInput struct {
-	Name        string   `yaml:"name"`
-	Description string   `yaml:"description"`
-	Required    bool     `yaml:"required"`
-	Default     string   `yaml:"default"`
-	Type        string   `yaml:"type"`
-	Options     []string `yaml:"options"`
-}
-
-func (i WorkflowDispatchInput) IsDefaultTrue() bool {
-	return util.ParseYamlBool(i.Default)
-}
-
-type WorkflowDispatch struct {
-	Inputs []WorkflowDispatchInput
-}
-
-func workflowDispatchConfig(w *act_model.Workflow) *WorkflowDispatch {
-	switch w.RawOn.Kind {
-	case yaml.ScalarNode:
-		var val string
-		if !decodeNode(w.RawOn, &val) {
-			return nil
-		}
-		if val == "workflow_dispatch" {
-			return &WorkflowDispatch{}
-		}
-	case yaml.SequenceNode:
-		var val []string
-		if !decodeNode(w.RawOn, &val) {
-			return nil
-		}
-		if slices.Contains(val, "workflow_dispatch") {
-			return &WorkflowDispatch{}
-		}
-	case yaml.MappingNode:
-		var val map[string]yaml.Node
-		if !decodeNode(w.RawOn, &val) {
-			return nil
-		}
-
-		workflowDispatchNode, found := val["workflow_dispatch"]
-		if !found {
-			return nil
-		}
-
-		var workflowDispatch WorkflowDispatch
-		var workflowDispatchVal map[string]yaml.Node
-		if !decodeNode(workflowDispatchNode, &workflowDispatchVal) {
-			return &workflowDispatch
-		}
-
-		inputsNode, found := workflowDispatchVal["inputs"]
-		if !found || inputsNode.Kind != yaml.MappingNode {
-			return &workflowDispatch
-		}
-
-		i := 0
-		for {
-			if i+1 >= len(inputsNode.Content) {
-				break
-			}
-			var input WorkflowDispatchInput
-			if decodeNode(*inputsNode.Content[i+1], &input) {
-				input.Name = inputsNode.Content[i].Value
-				workflowDispatch.Inputs = append(workflowDispatch.Inputs, input)
-			}
-			i += 2
-		}
-		return &workflowDispatch
-
-	default:
-		return nil
-	}
-	return nil
-}
-
-func decodeNode(node yaml.Node, out any) bool {
-	if err := node.Decode(out); err != nil {
-		log.Warn("Failed to decode node %v into %T: %v", node, out, err)
-		return false
-	}
-	return true
-}
-
 func actionsListRedirectURL(repoLink, workflow, scopedWorkflowSourceRepoID, actor, status, branch string) string {
 	return fmt.Sprintf("%s/actions?workflow=%s&scoped_workflow_source_repo_id=%s&actor=%s&status=%s&branch=%s",
 		repoLink,

routers/web/repo/actions/actions_test.go

@@ -6,10 +6,8 @@ package actions
 import (
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
-	act_model "gitea.dev/actionslib/pkg/model"
 	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
@@ -21,150 +19,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestReadWorkflow_WorkflowDispatchConfig(t *testing.T) {
-	yaml := `
-    name: local-action-docker-url
-    `
-	workflow, err := act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch := workflowDispatchConfig(workflow)
-	assert.Nil(t, workflowDispatch)
-
-	yaml = `
-    name: local-action-docker-url
-    on: push
-    `
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.Nil(t, workflowDispatch)
-
-	yaml = `
-    name: local-action-docker-url
-    on: workflow_dispatch
-    `
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.NotNil(t, workflowDispatch)
-	assert.Nil(t, workflowDispatch.Inputs)
-
-	yaml = `
-    name: local-action-docker-url
-    on: [push, pull_request]
-    `
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.Nil(t, workflowDispatch)
-
-	yaml = `
-    name: local-action-docker-url
-    on:
-        push:
-        pull_request:
-    `
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.Nil(t, workflowDispatch)
-
-	yaml = `
-    name: local-action-docker-url
-    on: [push, workflow_dispatch]
-    `
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.NotNil(t, workflowDispatch)
-	assert.Nil(t, workflowDispatch.Inputs)
-
-	yaml = `
-    name: local-action-docker-url
-    on:
-        - push
-        - workflow_dispatch
-    `
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.NotNil(t, workflowDispatch)
-	assert.Nil(t, workflowDispatch.Inputs)
-
-	yaml = `
-    name: local-action-docker-url
-    on:
-        push:
-        pull_request:
-        workflow_dispatch:
-            inputs:
-    `
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.NotNil(t, workflowDispatch)
-	assert.Nil(t, workflowDispatch.Inputs)
-
-	yaml = `
-    name: local-action-docker-url
-    on:
-        push:
-        pull_request:
-        workflow_dispatch:
-            inputs:
-                logLevel:
-                    description: 'Log level'
-                    required: true
-                    default: 'warning'
-                    type: choice
-                    options:
-                    - info
-                    - warning
-                    - debug
-                boolean_default_true:
-                    description: 'Test scenario tags'
-                    required: true
-                    type: boolean
-                    default: true
-                boolean_default_false:
-                    description: 'Test scenario tags'
-                    required: true
-                    type: boolean
-                    default: false
-    `
-
-	workflow, err = act_model.ReadWorkflow(strings.NewReader(yaml))
-	assert.NoError(t, err, "read workflow should succeed")
-	workflowDispatch = workflowDispatchConfig(workflow)
-	assert.NotNil(t, workflowDispatch)
-	assert.Equal(t, WorkflowDispatchInput{
-		Name:        "logLevel",
-		Default:     "warning",
-		Description: "Log level",
-		Options: []string{
-			"info",
-			"warning",
-			"debug",
-		},
-		Required: true,
-		Type:     "choice",
-	}, workflowDispatch.Inputs[0])
-	assert.Equal(t, WorkflowDispatchInput{
-		Name:        "boolean_default_true",
-		Default:     "true",
-		Description: "Test scenario tags",
-		Required:    true,
-		Type:        "boolean",
-	}, workflowDispatch.Inputs[1])
-	assert.Equal(t, WorkflowDispatchInput{
-		Name:        "boolean_default_false",
-		Default:     "false",
-		Description: "Test scenario tags",
-		Required:    true,
-		Type:        "boolean",
-	}, workflowDispatch.Inputs[2])
-}
-
 func Test_loadIsRefDeleted(t *testing.T) {
 	unittest.PrepareTestEnv(t)
 

routers/web/repo/actions/view.go

@@ -594,7 +594,7 @@ func fillViewRunResponseSummary(ctx *context_module.Context, resp *ViewResponse,
 	// Hide the Cancel button once a cancel is already in cancelling progress
 	resp.State.Run.CanCancel = isLatestAttempt && !resp.State.Run.Done && !effectiveStatus.IsCancelling() && ctx.Repo.Permission.CanWrite(unit.TypeActions)
 	resp.State.Run.CanApprove = isLatestAttempt && run.NeedApproval && ctx.Repo.Permission.CanWrite(unit.TypeActions)
-	resp.State.Run.CanRerun = isLatestAttempt && resp.State.Run.Done && ctx.Repo.Permission.CanWrite(unit.TypeActions)
+	resp.State.Run.CanRerun = isLatestAttempt && resp.State.Run.Done && len(jobs) > 0 && ctx.Repo.Permission.CanWrite(unit.TypeActions)
 	resp.State.Run.CanDeleteArtifact = resp.State.Run.Done && ctx.Repo.Permission.CanWrite(unit.TypeActions)
 	if resp.State.Run.CanRerun {
 		for _, job := range jobs {
@@ -682,7 +682,7 @@ func fillViewRunResponseSummary(ctx *context_module.Context, resp *ViewResponse,
 		return
 	}
 	if len(summaries) > 0 {
-		jobNameByID := make(map[int64]string, len(jobs))
+		jobNameByID := map[int64]string{0: run.WorkflowID} // a workflow-level summary, such as an invalid workflow file
 		for _, j := range jobs {
 			jobNameByID[j.ID] = j.Name
 		}
@@ -964,6 +964,10 @@ func Rerun(ctx *context_module.Context) {
 	if !checkRunRerunAllowed(ctx, run) {
 		return
 	}
+	if len(jobs) == 0 {
+		ctx.JSONError(ctx.Locale.Tr("actions.runs.no_job"))
+		return
+	}
 
 	currentJob, hasPathParam := findCurrentJobByPathParam(ctx, jobs)
 	if hasPathParam && currentJob == nil {
@@ -1097,7 +1101,7 @@ func getRunViewLink(run *actions_model.ActionRun, attempt *actions_model.ActionR
 }
 
 // getCurrentRunJobsByPathParam resolves the current run view context from path parameters, including the run, optional attempt, and jobs to render.
-// Any error will be written to the ctx, empty jobs will also result in 404 error, then the return values are all nil.
+// Any error will be written to the ctx, then the return values are all nil.
 func getCurrentRunJobsByPathParam(ctx *context_module.Context) (*actions_model.ActionRun, *actions_model.ActionRunAttempt, []*actions_model.ActionRunJob) {
 	run := getCurrentRunByPathParam(ctx)
 	if ctx.Written() {
@@ -1164,10 +1168,6 @@ func getCurrentRunJobsByPathParam(ctx *context_module.Context) (*actions_model.A
 		ctx.ServerError("get current jobs", err)
 		return nil, nil, nil
 	}
-	if len(jobs) == 0 {
-		ctx.NotFound(nil)
-		return nil, nil, nil
-	}
 	jobs.SortMatrixGroupsByName()
 
 	for _, job := range jobs {

routers/web/repo/view_file.go

@@ -186,7 +186,7 @@ func prepareFileView(ctx *context.Context, entry *git.TreeEntry) {
 		if err != nil {
 			log.Error("actions.GetContentFromEntry: %v", err)
 		}
-		if workFlowErr := actions.ValidateWorkflowContent(content); workFlowErr != nil {
+		if _, workFlowErr := actions.GetEventsFromContent(content); workFlowErr != nil {
 			ctx.Data["FileError"] = ctx.Locale.Tr("actions.runs.invalid_workflow_helper", workFlowErr.Error())
 		}
 	} else if issue_service.IsCodeOwnerFile(ctx.Repo.TreePath) {

routers/web/shared/actions/scoped_workflows.go

@@ -181,7 +181,7 @@ func deriveScopedStatusContexts(prefix, displayName string, content []byte, even
 		if job == nil {
 			continue
 		}
-		jobName := util.EllipsisDisplayString(job.Name, 255) // run creation truncates job names the same way
+		jobName := job.DisplayName()
 		for _, ev := range eventNames {
 			ctxName := actions_module.ScopedWorkflowStatusContextName(prefix, displayName, jobName, ev)
 			if seen.Contains(ctxName) {

routers/web/shared/actions/scoped_workflows_test.go

@@ -13,7 +13,7 @@ import (
 )
 
 func TestDeriveScopedStatusContexts(t *testing.T) {
-	t.Run("jobs x events; job name is its name: or its id", func(t *testing.T) {
+	t.Run("jobs x events; job name is its unescaped name: or its id", func(t *testing.T) {
 		content := []byte(`name: CI
 on: [push, pull_request]
 jobs:
@@ -26,6 +26,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - run: echo
+  test:
+    name: "${{ matrix.os }} ${{ '${{' }}"
+    strategy:
+      matrix:
+        os: [linux]
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo
 `)
 		events, err := actions_module.GetEventsFromContent(content)
 		require.NoError(t, err)
@@ -35,6 +43,8 @@ jobs:
 			"org/src: CI / lint (pull_request)",
 			"org/src: CI / Build It (push)",
 			"org/src: CI / Build It (pull_request)",
+			"org/src: CI / linux ${{ (push)",
+			"org/src: CI / linux ${{ (pull_request)",
 		}, got)
 	})