chore(deps): update actionslib to v1.4.1 (#1313)

actionslib v1.4.1 no longer logs through logrus, so the workflow model no longer needs the logrus bridge. The bridge stays for docker/cli and moby/go-archive, which still log through logrus's global logger; the comment now says so.

actionslib now logs through slog's global logger, which the runner did not capture. A new slog bridge forwards it to the process-wide logger, so its messages keep the runner's level, format and secret masking.

Assisted-by: Codet
Co-authored-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1313
Reviewed-by: silverwind <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
This commit is contained in:
authored and silverwind committed 2026-10-14 12:09:48 +00:00
1 parent be7ddcd15a
commit 470969dc74
7 files changed
+65 -7

No files matched your search

+2 -2
View File
@@ -40,8 +40,8 @@ fields.
- The process-wide logger masks the secrets of every live task, the job logger masks its own.
Going around either leaks them.
- Libraries that log through logrus's global logger are forwarded to the process-wide one, so they
follow its level and masking too.
- Libraries that log through logrus's or slog's global logger are forwarded to the process-wide
one, so they follow its level and masking too.
- That forwarding only works while logrus's global logger is left as `logging` configures it. A
dependency that calls `logrus.SetOutput` or `SetLevel` breaks it, so check
`logging.LogrusBridgeIntact()` when adding or upgrading one.