refactor: drop logrus and other direct dependencies (#1319)

After https://gitea.com/gitea/runner/pulls/1304, logrus stayed only to forward logs from docker/cli and moby/go-archive. The runner used a small part of those: volume parsing, the build context tar, the `ssh://` connection and registry credentials. Own code that matches them replaces them, so logrus leaves the module graph. docker/cli stays for its logrus-free `opts` and `connhelper/ssh` packages.

Other dependencies that the standard library or existing ones cover go too: mergo, httprouter (replaced by `http.ServeMux`), retry-go, go-isatty, go-selinux, container-device-interface, gotest.tools and go-cmp (replaced by testify). The binary shrinks by 5%.

Behaviour differences:

1. An unreadable file in a build context is skipped with a warning, where go-archive left a truncated tar.
2. Build contexts no longer carry `security.capability` xattrs.
3. The cache and artifact servers answer HEAD on GET routes, and no longer redirect trailing slashes or answer OPTIONS.

*Written by Claude.*

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1319
Reviewed-by: bircni <[email protected]>
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/container/docker_build.go

@@ -7,15 +7,18 @@
 package container
 
 import (
+	"archive/tar"
 	"context"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
 
 	"gitea.com/gitea/runner/act/common"
 
-	"github.com/moby/go-archive"
-	"github.com/moby/go-archive/compression"
 	"github.com/moby/moby/client"
 	"github.com/moby/patternmatcher"
 	"github.com/moby/patternmatcher/ignorefile"
@@ -115,14 +118,140 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 		includes = append(includes, ".dockerignore", relDockerfile)
 	}
 
-	buildCtx, err := archive.TarWithOptions(contextDir, &archive.TarOptions{
-		Compression:     compression.None,
-		ExcludePatterns: excludes,
-		IncludeFiles:    includes,
-	})
+	pm, err := patternmatcher.New(excludes)
 	if err != nil {
 		return nil, err
 	}
-
-	return buildCtx, nil
+	reader, writer := io.Pipe()
+	go func() { writer.CloseWithError(writeBuildContext(ctx, writer, contextDir, includes, pm)) }()
+	return reader, nil
 }
+
+func writeBuildContext(ctx context.Context, w io.Writer, contextDir string, includes []string, pm *patternmatcher.PatternMatcher) error {
+	tw := tar.NewWriter(w)
+	seen := map[string]bool{}
+	hardlinks := map[uint64]string{}
+	buffer := make([]byte, 32*1024)
+	for _, include := range includes {
+		include = filepath.FromSlash(include)
+		var parents []parentMatch
+		root := strings.TrimSuffix(contextDir, string(filepath.Separator)) + string(filepath.Separator) + include // unlike filepath.Join, follows a symlinked context dir as docker build does
+		err := filepath.WalkDir(root, func(file string, entry fs.DirEntry, err error) error {
+			if err != nil {
+				return leaveOut(ctx, file, err)
+			}
+			rel, err := filepath.Rel(contextDir, file)
+			if err != nil || rel == "." {
+				return nil
+			}
+			if rel != include {
+				for len(parents) > 0 && !strings.HasPrefix(rel, parents[len(parents)-1].dir+string(filepath.Separator)) {
+					parents = parents[:len(parents)-1]
+				}
+				var parentInfo patternmatcher.MatchInfo
+				if len(parents) > 0 {
+					parentInfo = parents[len(parents)-1].info
+				}
+				skip, info, err := pm.MatchesUsingParentResults(rel, parentInfo)
+				if err != nil {
+					return err
+				}
+				if entry.IsDir() {
+					parents = append(parents, parentMatch{rel, info})
+				}
+				if skip {
+					if entry.IsDir() && !hasExceptionWithin(pm, rel) {
+						return filepath.SkipDir
+					}
+					return nil
+				}
+			}
+			if seen[rel] {
+				return nil
+			}
+			seen[rel] = true
+			return addBuildContextEntry(ctx, tw, file, rel, entry, hardlinks, buffer)
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return tw.Close()
+}
+
+type parentMatch struct {
+	dir  string
+	info patternmatcher.MatchInfo
+}
+
+func hasExceptionWithin(pm *patternmatcher.PatternMatcher, dir string) bool {
+	dirPrefix := dir + string(filepath.Separator)
+	for _, pattern := range pm.Patterns() {
+		if pattern.Exclusion() && strings.HasPrefix(pattern.String()+string(filepath.Separator), dirPrefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func leaveOut(ctx context.Context, file string, err error) error {
+	common.Logger(ctx).Warnf("Leaving %s out of the build context: %v", file, err)
+	return nil
+}
+
+func addBuildContextEntry(ctx context.Context, tw *tar.Writer, file, rel string, entry fs.DirEntry, hardlinks map[uint64]string, buffer []byte) error {
+	info, err := entry.Info()
+	if err != nil {
+		return leaveOut(ctx, file, err)
+	}
+	if info.Mode()&fs.ModeSocket != 0 {
+		return nil // tar has no socket type
+	}
+	var link string
+	if info.Mode()&fs.ModeSymlink != 0 {
+		if link, err = os.Readlink(file); err != nil {
+			return leaveOut(ctx, file, err)
+		}
+	}
+	header, err := tar.FileInfoHeader(noNameLookups{info}, link)
+	if err != nil {
+		return err
+	}
+	header.Name = filepath.ToSlash(rel)
+	inode, linked := hardlinkInode(info)
+	if target, ok := hardlinks[inode]; linked && ok {
+		header.Typeflag, header.Linkname, header.Size = tar.TypeLink, target, 0
+	}
+	var content *os.File
+	if header.Typeflag == tar.TypeReg && header.Size > 0 {
+		if content, err = os.Open(file); err != nil {
+			return leaveOut(ctx, file, err)
+		}
+		defer content.Close()
+	}
+	if linked && header.Typeflag != tar.TypeLink {
+		hardlinks[inode] = header.Name
+	}
+	if info.IsDir() {
+		header.Name += "/"
+	}
+	header.Format = tar.FormatPAX
+	header.ModTime = header.ModTime.Truncate(time.Second)
+	header.AccessTime, header.ChangeTime = time.Time{}, time.Time{}
+	if runtime.GOOS == "windows" {
+		header.Mode = header.Mode&0o755 | 0o111 // Windows has no exec bit, so mark everything executable like docker build
+	}
+	if err := tw.WriteHeader(header); err != nil {
+		return err
+	}
+	if content != nil {
+		_, err = io.CopyBuffer(tw, struct{ io.Reader }{content}, buffer) // hides os.File's WriteTo, which would allocate a buffer per file
+	}
+	return err
+}
+
+type noNameLookups struct{ fs.FileInfo } // leaves Uname and Gname empty like docker build, so packing never waits on NSS
+
+func (noNameLookups) Uname() (string, error) { return "", nil }
+
+func (noNameLookups) Gname() (string, error) { return "", nil }