fix: align common behaviour with GitHub's runner (#1413)

Closes differences from GitHub's runner that common workflows hit:

- `ACTIONS_STEP_DEBUG` set as a repository variable enables debug output as on GitHub, where a secret of the same name still takes precedence. `runner.debug` and `RUNNER_DEBUG` are now also set inside composite actions, which lost the secret.
- `github.env` and `github.path` hold the file-command paths instead of being empty, so `echo "A=1" >> "${{ github.env }}"` works.
- Remote composite actions only get a pre stage when they nest actions. That stage evaluated `with:` before earlier steps ran, so an input like `${{ fromJSON(steps.meta.outputs.json).v }}` failed the job.
- `ports` on a job container are published, they were ignored while service ports worked.
- Dockerfile action build output reaches the job log. It was logged at debug and dropped, so a failing `RUN` showed only the final error.
- Local Docker actions honor their `.dockerignore`, as `docker build` does.
- Cancelling or timing out a host-mode step sends SIGINT, then SIGTERM after 7.5 seconds and SIGKILL after 2.5 more, as GitHub's runner does, so `trap` handlers and shutdown hooks run.
- `.sh` job hooks fall back to `sh` where bash is missing, and `.ps1` hooks to `powershell` where pwsh is missing, as on GitHub.

_Written by Claude (Opus 5.5)._

Reviewed-on: https://gitea.com/gitea/runner/pulls/1413
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/container/container_types.go

@@ -152,6 +152,8 @@ type NewDockerBuildExecutorInput struct {
 	ContextDir   string
 	Dockerfile   string
 	BuildContext io.Reader
+	Dockerignore []byte // applied to BuildContext as the docker CLI applies it
+	Stdout       io.Writer
 	ImageTag     string
 	Platform     string
 	BuildArgs    map[string]*string

act/container/docker_build.go

@@ -8,10 +8,13 @@ package container
 
 import (
 	"archive/tar"
+	"bytes"
 	"context"
+	"fmt"
 	"io"
 	"io/fs"
 	"os"
+	"path"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -63,7 +66,7 @@ func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 		}
 		var buildContext io.ReadCloser
 		if input.BuildContext != nil {
-			buildContext = io.NopCloser(input.BuildContext)
+			buildContext, err = filterBuildContext(input.BuildContext, input.Dockerignore, input.Dockerfile)
 		} else {
 			buildContext, err = createBuildContext(ctx, input.ContextDir, input.Dockerfile)
 		}
@@ -78,10 +81,97 @@ func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 		if err != nil {
 			return err
 		}
-		return logDockerResponse(logger, resp.Body, false)
+		err = logDockerResponse(logger, resp.Body, func(format string, args ...any) { fmt.Fprintf(input.Stdout, format, args...) })
+		common.FlushWriter(input.Stdout)
+		return err
 	}
 }
 
+func filterBuildContext(buildContext io.Reader, dockerignore []byte, relDockerfile string) (io.ReadCloser, error) {
+	excludes, err := ignorefile.ReadAll(bytes.NewReader(dockerignore))
+	if err != nil || len(excludes) == 0 {
+		return io.NopCloser(buildContext), err
+	}
+	pm, err := patternmatcher.New(excludes)
+	if err != nil {
+		return nil, err
+	}
+	reader, writer := io.Pipe()
+	go func() {
+		writer.CloseWithError(writeFilteredBuildContext(writer, buildContext, pm, path.Clean(filepath.ToSlash(relDockerfile))))
+	}()
+	return reader, nil
+}
+
+func writeFilteredBuildContext(w io.Writer, buildContext io.Reader, pm *patternmatcher.PatternMatcher, relDockerfile string) error {
+	spool, err := os.CreateTemp("", "gitea-runner-build-") // excluded content, for a kept hardlink to it
+	if err != nil {
+		return err
+	}
+	defer os.Remove(spool.Name())
+	defer spool.Close()
+
+	reader := tar.NewReader(buildContext)
+	writer := tar.NewWriter(w)
+	buffer := make([]byte, 32*1024)
+	excluded := map[string]*excludedBuildContextEntry{}
+	for {
+		header, err := reader.Next()
+		if err == io.EOF {
+			return writer.Close()
+		}
+		if err != nil {
+			return err
+		}
+		name := path.Clean(header.Name)
+		var target *excludedBuildContextEntry
+		if header.Typeflag == tar.TypeLink {
+			target = excluded[path.Clean(header.Linkname)]
+		}
+		if name != ".dockerignore" && name != relDockerfile {
+			skip, err := pm.MatchesOrParentMatches(name)
+			if err != nil {
+				return err
+			}
+			if skip {
+				if target != nil {
+					excluded[name] = target
+				} else if header.Typeflag != tar.TypeDir {
+					offset, err := spool.Seek(0, io.SeekCurrent)
+					if err != nil {
+						return err
+					}
+					excluded[name] = &excludedBuildContextEntry{header: header, offset: offset}
+					if _, err := io.CopyBuffer(spool, reader, buffer); err != nil {
+						return err
+					}
+				}
+				continue
+			}
+		}
+		var content io.Reader = reader
+		if target != nil && target.keptName != "" {
+			header.Linkname = target.keptName
+		} else if target != nil {
+			header.Typeflag, header.Linkname, header.Size = target.header.Typeflag, target.header.Linkname, target.header.Size
+			content = io.NewSectionReader(spool, target.offset, header.Size)
+			target.keptName = header.Name
+		}
+		if err := writer.WriteHeader(header); err != nil {
+			return err
+		}
+		if _, err := io.CopyBuffer(writer, content, buffer); err != nil {
+			return err
+		}
+	}
+}
+
+type excludedBuildContextEntry struct {
+	header   *tar.Header
+	offset   int64
+	keptName string
+}
+
 func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (io.ReadCloser, error) {
 	common.Logger(ctx).Debugf("Creating archive for build context dir '%s' with relative dockerfile '%s'", contextDir, relDockerfile)
 

act/container/docker_build_test.go

@@ -7,6 +7,8 @@ package container
 
 import (
 	"archive/tar"
+	"bytes"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -35,7 +37,7 @@ func TestDockerBuildLabelsImageWithItsTagAndReportsDaemonError(t *testing.T) {
 	t.Setenv("DOCKER_AUTH_CONFIG", "")
 
 	require.ErrorContains(t, NewDockerBuildExecutor(NewDockerBuildExecutorInput{
-		ImageTag: "action:test", Dockerfile: "Dockerfile", BuildContext: strings.NewReader(""),
+		ImageTag: "action:test", Dockerfile: "Dockerfile", BuildContext: strings.NewReader(""), Stdout: io.Discard,
 	})(t.Context()), "build rejected")
 	require.JSONEq(t, `{"com.gitea.runner.image":"action:test"}`, labels)
 }
@@ -72,3 +74,56 @@ func TestCreateBuildContextFollowsDockerignoreAndSymlinkedRootButKeepsDockerfile
 		require.Equal(t, []string{".dockerignore", "a.txt", "build/keep.txt", "empty/", "Dockerfile"}, names, contextDir)
 	}
 }
+
+func TestFilterBuildContextAppliesDockerignoreAndMaterializesHardlinksToExcludedFiles(t *testing.T) {
+	const dockerignore = "*.log\nbuild\n!build/keep.txt\nActionfile\n.dockerignore\n"
+	for _, prefix := range []string{"", "./"} {
+		var archive bytes.Buffer
+		writer := tar.NewWriter(&archive)
+		for _, entry := range []struct {
+			name, body, link string
+			typeflag         byte
+		}{
+			{"Actionfile", "FROM scratch", "", tar.TypeReg},
+			{"output.log", "log", "", tar.TypeReg},
+			{"build/", "", "", tar.TypeDir},
+			{"build/drop.txt", "drop", "", tar.TypeReg},
+			{"build/keep.txt", "keep", "", tar.TypeReg},
+			{"entrypoint", "", prefix + "output.log", tar.TypeLink},
+			{"other-entrypoint", "", prefix + "output.log", tar.TypeLink},
+			{".dockerignore", dockerignore, "", tar.TypeReg},
+		} {
+			require.NoError(t, writer.WriteHeader(&tar.Header{Name: prefix + entry.name, Linkname: entry.link, Typeflag: entry.typeflag, Size: int64(len(entry.body)), Mode: 0o644}))
+			_, err := io.WriteString(writer, entry.body)
+			require.NoError(t, err)
+		}
+		require.NoError(t, writer.Close())
+
+		unfiltered, err := filterBuildContext(bytes.NewReader(archive.Bytes()), nil, "Actionfile")
+		require.NoError(t, err)
+		passedThrough, err := io.ReadAll(unfiltered)
+		require.NoError(t, err)
+		require.Equal(t, archive.Bytes(), passedThrough)
+
+		filtered, err := filterBuildContext(bytes.NewReader(archive.Bytes()), []byte(dockerignore), "Actionfile")
+		require.NoError(t, err)
+		var entries []string
+		for reader := tar.NewReader(filtered); ; {
+			header, err := reader.Next()
+			if err == io.EOF {
+				break
+			}
+			require.NoError(t, err)
+			body, err := io.ReadAll(reader)
+			require.NoError(t, err)
+			entries = append(entries, fmt.Sprintf("%s %c %s %s", strings.TrimPrefix(header.Name, prefix), header.Typeflag, strings.TrimPrefix(header.Linkname, prefix), body))
+		}
+		require.Equal(t, []string{
+			"Actionfile 0  FROM scratch",
+			"build/keep.txt 0  keep",
+			"entrypoint 0  log",
+			"other-entrypoint 1 entrypoint ",
+			".dockerignore 0  " + dockerignore,
+		}, entries, prefix)
+	}
+}

act/container/docker_images_test.go

@@ -38,7 +38,7 @@ func loadScratchImage(t *testing.T, platform string) string {
 	response, err := cli.ImageLoad(t.Context(), &archive)
 	require.NoError(t, err)
 	defer response.Close()
-	require.NoError(t, logDockerResponse(common.Logger(t.Context()), response, false))
+	require.NoError(t, logDockerResponse(common.Logger(t.Context()), response, common.Logger(t.Context()).Debugf))
 	t.Cleanup(func() {
 		_, _ = cli.ImageRemove(context.WithoutCancel(t.Context()), tag, mobyclient.ImageRemoveOptions{Force: true})
 	})

act/container/docker_logger.go

@@ -8,6 +8,7 @@ package container
 
 import (
 	"bufio"
+	"cmp"
 	"encoding/json/v2"
 	"errors"
 	"io"
@@ -26,10 +27,7 @@ type dockerMessage struct {
 	Progress string `json:"progress"`
 }
 
-func logDockerResponse(logger *logging.Logger, dockerResponse io.ReadCloser, isError bool) error {
-	if dockerResponse == nil {
-		return nil
-	}
+func logDockerResponse(logger *logging.Logger, dockerResponse io.ReadCloser, log func(string, ...any)) error {
 	defer dockerResponse.Close()
 
 	scanner := bufio.NewScanner(dockerResponse)
@@ -38,41 +36,28 @@ func logDockerResponse(logger *logging.Logger, dockerResponse io.ReadCloser, isE
 		line := scanner.Bytes()
 		var msg dockerMessage
 		if err := json.Unmarshal(line, &msg); err != nil {
-			writeLog(logger, false, "Unable to unmarshal line [%s] ==> %v", string(line), err)
+			logger.Debugf("Unable to unmarshal line [%s] ==> %v", string(line), err)
 			continue
 		}
 
-		if msg.Error != "" {
-			writeLog(logger, isError, "%s", msg.Error)
-			return errors.New(msg.Error)
-		}
-
-		if msg.ErrorDetail.Message != "" {
-			writeLog(logger, isError, "%s", msg.ErrorDetail.Message)
-			return errors.New(msg.ErrorDetail.Message)
+		if message := cmp.Or(msg.Error, msg.ErrorDetail.Message); message != "" {
+			log("%s", message)
+			return errors.New(message)
 		}
 
 		switch {
 		case msg.Status != "":
 			if msg.Progress != "" {
-				writeLog(logger, isError, "%s :: %s :: %s\n", msg.Status, msg.ID, msg.Progress)
+				log("%s :: %s :: %s\n", msg.Status, msg.ID, msg.Progress)
 			} else {
-				writeLog(logger, isError, "%s :: %s\n", msg.Status, msg.ID)
+				log("%s :: %s\n", msg.Status, msg.ID)
 			}
 		case msg.Stream != "":
-			writeLog(logger, isError, "%s", msg.Stream)
+			log("%s", msg.Stream)
 		default:
-			writeLog(logger, false, "Unable to handle line: %s", string(line))
+			logger.Debugf("Unable to handle line: %s", string(line))
 		}
 	}
 
 	return scanner.Err()
 }
-
-func writeLog(logger *logging.Logger, isError bool, format string, args ...any) {
-	if isError {
-		logger.Errorf(format, args...)
-	} else {
-		logger.Debugf(format, args...)
-	}
-}

act/container/docker_pull.go

@@ -61,11 +61,10 @@ func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
 		// stream rather than on the call itself, so both have to be checked
 		pullOnce := func(opts client.ImagePullOptions) error {
 			reader, err := cli.ImagePull(ctx, imageRef, opts)
-			streamErr := logDockerResponse(logger, reader, err != nil)
 			if err != nil {
 				return err
 			}
-			return streamErr
+			return logDockerResponse(logger, reader, logger.Debugf)
 		}
 
 		err = pullOnce(imagePullOptions)

act/container/docker_pull_test.go

@@ -95,15 +95,16 @@ func TestIsPinnedImage(t *testing.T) {
 // The pull path reports a failure the daemon sent mid-stream, so it must carry the reason
 // whichever of the two shapes the daemon used.
 func TestLogDockerResponseError(t *testing.T) {
-	logger := logging.New(logtest.New())
+	logger, hook := logtest.NewLogger()
 	streamErr := func(line string) error {
-		return logDockerResponse(logger, io.NopCloser(strings.NewReader(line)), false)
+		return logDockerResponse(logger, io.NopCloser(strings.NewReader(line)), logger.Infof)
 	}
 	require.EqualError(t, streamErr(`{"error":"toomanyrequests: rate limit exceeded"}`), "toomanyrequests: rate limit exceeded")
 	require.EqualError(t, streamErr(`{"errorDetail":{"message":"unexpected EOF"}}`), "unexpected EOF")
 	require.NoError(t, streamErr(`{"status":"Downloading"}`))
 	require.NoError(t, streamErr(`{"stream":"`+strings.Repeat("x", 70000)+`"}`))
+	assert.Equal(t, logging.LevelInfo, hook.LastRecord().Level)
 	require.ErrorIs(t, logDockerResponse(logger, io.NopCloser(io.MultiReader(
 		strings.NewReader(`{"status":"Downloading"}`+"\n"), iotest.ErrReader(io.ErrUnexpectedEOF),
-	)), false), io.ErrUnexpectedEOF)
+	)), logger.Infof), io.ErrUnexpectedEOF)
 }

act/container/host_environment.go

@@ -283,6 +283,7 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 	// wait, so an orphan holding cmd's stdout pipe cannot hang cmd.Wait().
 	treeKill := process.NewTreeKill(cmd)
 	treeKill.KeepLeftovers = !tracked
+	treeKill.GracefulCancel = true
 
 	var ppty *os.File
 	var tty *os.File