refactor: drop logrus and other direct dependencies (#1319)

After https://gitea.com/gitea/runner/pulls/1304, logrus stayed only to forward logs from docker/cli and moby/go-archive. The runner used a small part of those: volume parsing, the build context tar, the `ssh://` connection and registry credentials. Own code that matches them replaces them, so logrus leaves the module graph. docker/cli stays for its logrus-free `opts` and `connhelper/ssh` packages.

Other dependencies that the standard library or existing ones cover go too: mergo, httprouter (replaced by `http.ServeMux`), retry-go, go-isatty, go-selinux, container-device-interface, gotest.tools and go-cmp (replaced by testify). The binary shrinks by 5%.

Behaviour differences:

1. An unreadable file in a build context is skipped with a warning, where go-archive left a truncated tar.
2. Build contexts no longer carry `security.capability` xattrs.
3. The cache and artifact servers answer HEAD on GET routes, and no longer redirect trailing slashes or answer OPTIONS.

*Written by Claude.*

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1319
Reviewed-by: bircni <[email protected]>
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/common/logging/global.go

@@ -9,8 +9,6 @@ import (
 	"os"
 	"runtime"
 	"sync/atomic"
-
-	"github.com/sirupsen/logrus"
 )
 
 // TextOptions describes how the process-wide Logger writes a record as text.
@@ -41,11 +39,8 @@ func Default() *Logger { return std.Load() }
 // initial console Logger.
 func SetDefault(l *Logger) { std.Store(l) }
 
-// SetLevel sets the minimum level of the initial process-wide Logger and of what libraries log through logrus.
-func SetLevel(level Level) {
-	stdState.level.Set(slog.Level(level))
-	logrus.SetLevel(toLogrusLevel(level))
-}
+// SetLevel sets the minimum level of the initial process-wide Logger.
+func SetLevel(level Level) { stdState.level.Set(slog.Level(level)) }
 
 // GetLevel returns the minimum level of the initial process-wide Logger.
 func GetLevel() Level { return Level(stdState.level.Level()) }
@@ -72,7 +67,6 @@ func SetReportCaller(on bool) {
 	stdState.mu.Lock()
 	defer stdState.mu.Unlock()
 	stdState.reportCaller = on
-	logrus.SetReportCaller(on)
 }
 
 func Enabled(level Level) bool { return Default().Enabled(level) }

act/common/logging/logging_test.go

@@ -13,7 +13,6 @@ import (
 	"gitea.com/gitea/runner/act/common/logging"
 	"gitea.com/gitea/runner/act/common/logging/logtest"
 
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -132,43 +131,6 @@ func TestSlogHandler(t *testing.T) {
 	assert.Contains(t, out, "error=boom")
 }
 
-func TestLogrusBridge(t *testing.T) {
-	prevLevel, prevDefault := logging.GetLevel(), logging.Default()
-	t.Cleanup(func() {
-		logging.SetLevel(prevLevel)
-		logging.SetReportCaller(false)
-		logging.SetDefault(prevDefault)
-	})
-	logging.SetLevel(logging.LevelInfo)
-	assert.False(t, logrus.IsLevelEnabled(logrus.DebugLevel))
-	logging.SetLevel(logging.LevelTrace)
-	logging.SetReportCaller(true)
-	h := logtest.NewWithLevel(logging.LevelTrace)
-	logging.SetDefault(logging.New(h))
-
-	logrus.WithField("lib", "docker").Warnf("from a library %d", 1)
-	_, _, line, _ := runtime.Caller(0)
-	logrus.Debug("below")
-	logrus.Trace("lowest")
-
-	recs := h.AllRecords()
-	require.Len(t, recs, 3)
-	assert.Equal(t, "from a library 1", recs[0].Message)
-	assert.Equal(t, logging.LevelWarn, recs[0].Level)
-	v, _ := recs[0].Attr("lib")
-	assert.Equal(t, "docker", v)
-	assert.Equal(t, logging.LevelDebug, recs[1].Level)
-	f := frameOf(t, recs[1].PC)
-	assert.True(t, strings.HasSuffix(f.Function, "TestLogrusBridge"), f.Function)
-	assert.Equal(t, line+1, f.Line)
-	assert.Equal(t, logging.LevelTrace, recs[2].Level)
-
-	h = logtest.New() // logrus passes Debug, the Logger does not
-	logging.SetDefault(logging.New(h))
-	logrus.Debug("dropped")
-	assert.Empty(t, h.AllRecords())
-}
-
 func TestSlogBridge(t *testing.T) {
 	h := logtest.SetDefault(t)
 	slog.With("lib", "actionslib").Warn("from a library", "n", 1)
@@ -185,19 +147,3 @@ func TestSlogBridge(t *testing.T) {
 	assert.EqualValues(t, 1, n)
 	assert.Equal(t, line-1, frameOf(t, recs[0].PC).Line)
 }
-
-func TestLogrusBridgeIntact(t *testing.T) {
-	assert.True(t, logging.LogrusBridgeIntact())
-
-	prev := logrus.StandardLogger().Out
-	t.Cleanup(func() { logrus.SetOutput(prev) })
-	logrus.SetOutput(&strings.Builder{}) // what a dependency doing this would do
-	assert.False(t, logging.LogrusBridgeIntact())
-	logrus.SetOutput(prev)
-	assert.True(t, logging.LogrusBridgeIntact())
-
-	prevLevel := logrus.GetLevel()
-	t.Cleanup(func() { logrus.SetLevel(prevLevel) })
-	logrus.SetLevel(logrus.PanicLevel)
-	assert.False(t, logging.LogrusBridgeIntact())
-}

act/common/logging/logrus_bridge.go

@@ -1,102 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package logging
-
-import (
-	"context"
-	"io"
-
-	"github.com/sirupsen/logrus"
-)
-
-// Libraries the runner depends on, such as docker/cli and moby/go-archive, log through
-// logrus's global logger. Hand what they log to the process-wide Logger, so it follows the same
-// level, format and secret masking as the rest of the output.
-func init() {
-	logrus.SetOutput(io.Discard)
-	logrus.SetFormatter(discardFormatter{})
-	logrus.SetLevel(toLogrusLevel(GetLevel()))
-	logrus.AddHook(bridgeHook{})
-}
-
-type discardFormatter struct{}
-
-func (discardFormatter) Format(*logrus.Entry) ([]byte, error) { return nil, nil }
-
-type bridgeHook struct{}
-
-func (bridgeHook) Levels() []logrus.Level { return logrus.AllLevels }
-
-func (bridgeHook) Fire(e *logrus.Entry) error {
-	l := Default()
-	level := fromLogrusLevel(e.Level)
-	ctx := e.Context
-	if ctx == nil {
-		ctx = context.Background()
-	}
-	if !l.h.Enabled(ctx, level) {
-		return nil
-	}
-	attrs := make([]Attr, 0, len(e.Data))
-	for k, v := range e.Data {
-		attrs = append(attrs, Attr{Key: k, Value: v})
-	}
-	r := Record{Time: e.Time, Level: level, Message: e.Message, Attrs: attrs}
-	if e.Caller != nil {
-		r.PC = e.Caller.PC + 1 // Frame.PC is one below the return address Record.PC holds
-	}
-	return l.h.Handle(ctx, r)
-}
-
-func toLogrusLevel(l Level) logrus.Level {
-	switch {
-	case l <= LevelTrace:
-		return logrus.TraceLevel
-	case l <= LevelDebug:
-		return logrus.DebugLevel
-	case l <= LevelInfo:
-		return logrus.InfoLevel
-	case l <= LevelWarn:
-		return logrus.WarnLevel
-	default:
-		return logrus.ErrorLevel
-	}
-}
-
-func fromLogrusLevel(l logrus.Level) Level {
-	switch l {
-	case logrus.TraceLevel:
-		return LevelTrace
-	case logrus.DebugLevel:
-		return LevelDebug
-	case logrus.InfoLevel:
-		return LevelInfo
-	case logrus.WarnLevel:
-		return LevelWarn
-	default:
-		return LevelError
-	}
-}
-
-// LogrusBridgeIntact reports whether logrus's global logger is still set up as the bridge needs,
-// discarding its own output and following the process-wide level. A dependency that calls
-// logrus.SetOutput or SetLevel breaks that, and its lines then show up twice, or at the wrong level.
-func LogrusBridgeIntact() bool {
-	std := logrus.StandardLogger()
-	if std.Out != io.Discard || std.GetLevel() != toLogrusLevel(GetLevel()) {
-		return false
-	}
-	for _, level := range logrus.AllLevels {
-		found := false
-		for _, h := range std.Hooks[level] {
-			if _, ok := h.(bridgeHook); ok {
-				found = true
-			}
-		}
-		if !found {
-			return false
-		}
-	}
-	return true
-}