fix: handle workflow commands like GitHub's runner (#1333)

Commands the runner applies itself, like the `::set-output::` older actions still print, showed up raw in the job log. The reporter also re-parsed every line with one job-wide stop-commands and echo state, while act keeps one command handler per step, stage, composite child and hook, as GitHub does. A `::stop-commands::` left active in one of them kept the reporter suppressed for the others, so their `::add-mask::` values were never registered, and post steps logged command lines twice.

- act's command handler decides what reaches the log, as GitHub's runner does: applied commands only under `ACTIONS_STEP_DEBUG` or `::echo::on`, `::stop-commands::` and its resume line shown with long tokens masked
- Masks go straight to the reporter, which no longer parses command lines
- One parser follows GitHub's rules: leading whitespace, `##[...]` anywhere in a line, registered commands only
- Service logs honour only `::add-mask::`

---------

Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1333
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

internal/pkg/report/globalmask_test.go

@@ -5,6 +5,7 @@ package report
 
 import (
 	"strings"
+	"sync"
 	"testing"
 
 	"gitea.com/gitea/runner/act/common/logging"
@@ -53,7 +54,11 @@ func TestGlobalMasks(t *testing.T) {
 
 	// A workflow could otherwise mask "error" here and rewrite every other task's log.
 	third := register("s3cr3t", "***")
-	third.addMask("runtime-secret")
+	var writers sync.WaitGroup
+	for _, mask := range []string{"runtime-secret", "another-secret"} {
+		writers.Go(func() { third.AddMask(mask) })
+	}
+	writers.Wait()
 	assert.Contains(t, format("saw runtime-secret"), "runtime-secret")
-	assert.NotContains(t, third.mask("saw runtime-secret"), "runtime-secret")
+	assert.Equal(t, "saw *** ***", third.mask("saw runtime-secret another-secret"))
 }