fix: align common behaviour with GitHub's runner (#1413)

Closes differences from GitHub's runner that common workflows hit:

- `ACTIONS_STEP_DEBUG` set as a repository variable enables debug output as on GitHub, where a secret of the same name still takes precedence. `runner.debug` and `RUNNER_DEBUG` are now also set inside composite actions, which lost the secret.
- `github.env` and `github.path` hold the file-command paths instead of being empty, so `echo "A=1" >> "${{ github.env }}"` works.
- Remote composite actions only get a pre stage when they nest actions. That stage evaluated `with:` before earlier steps ran, so an input like `${{ fromJSON(steps.meta.outputs.json).v }}` failed the job.
- `ports` on a job container are published, they were ignored while service ports worked.
- Dockerfile action build output reaches the job log. It was logged at debug and dropped, so a failing `RUN` showed only the final error.
- Local Docker actions honor their `.dockerignore`, as `docker build` does.
- Cancelling or timing out a host-mode step sends SIGINT, then SIGTERM after 7.5 seconds and SIGKILL after 2.5 more, as GitHub's runner does, so `trap` handlers and shutdown hooks run.
- `.sh` job hooks fall back to `sh` where bash is missing, and `.ps1` hooks to `powershell` where pwsh is missing, as on GitHub.

_Written by Claude (Opus 5.5)._

Reviewed-on: https://gitea.com/gitea/runner/pulls/1413
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/container/docker_build_test.go

@@ -7,6 +7,8 @@ package container
 
 import (
 	"archive/tar"
+	"bytes"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -35,7 +37,7 @@ func TestDockerBuildLabelsImageWithItsTagAndReportsDaemonError(t *testing.T) {
 	t.Setenv("DOCKER_AUTH_CONFIG", "")
 
 	require.ErrorContains(t, NewDockerBuildExecutor(NewDockerBuildExecutorInput{
-		ImageTag: "action:test", Dockerfile: "Dockerfile", BuildContext: strings.NewReader(""),
+		ImageTag: "action:test", Dockerfile: "Dockerfile", BuildContext: strings.NewReader(""), Stdout: io.Discard,
 	})(t.Context()), "build rejected")
 	require.JSONEq(t, `{"com.gitea.runner.image":"action:test"}`, labels)
 }
@@ -72,3 +74,56 @@ func TestCreateBuildContextFollowsDockerignoreAndSymlinkedRootButKeepsDockerfile
 		require.Equal(t, []string{".dockerignore", "a.txt", "build/keep.txt", "empty/", "Dockerfile"}, names, contextDir)
 	}
 }
+
+func TestFilterBuildContextAppliesDockerignoreAndMaterializesHardlinksToExcludedFiles(t *testing.T) {
+	const dockerignore = "*.log\nbuild\n!build/keep.txt\nActionfile\n.dockerignore\n"
+	for _, prefix := range []string{"", "./"} {
+		var archive bytes.Buffer
+		writer := tar.NewWriter(&archive)
+		for _, entry := range []struct {
+			name, body, link string
+			typeflag         byte
+		}{
+			{"Actionfile", "FROM scratch", "", tar.TypeReg},
+			{"output.log", "log", "", tar.TypeReg},
+			{"build/", "", "", tar.TypeDir},
+			{"build/drop.txt", "drop", "", tar.TypeReg},
+			{"build/keep.txt", "keep", "", tar.TypeReg},
+			{"entrypoint", "", prefix + "output.log", tar.TypeLink},
+			{"other-entrypoint", "", prefix + "output.log", tar.TypeLink},
+			{".dockerignore", dockerignore, "", tar.TypeReg},
+		} {
+			require.NoError(t, writer.WriteHeader(&tar.Header{Name: prefix + entry.name, Linkname: entry.link, Typeflag: entry.typeflag, Size: int64(len(entry.body)), Mode: 0o644}))
+			_, err := io.WriteString(writer, entry.body)
+			require.NoError(t, err)
+		}
+		require.NoError(t, writer.Close())
+
+		unfiltered, err := filterBuildContext(bytes.NewReader(archive.Bytes()), nil, "Actionfile")
+		require.NoError(t, err)
+		passedThrough, err := io.ReadAll(unfiltered)
+		require.NoError(t, err)
+		require.Equal(t, archive.Bytes(), passedThrough)
+
+		filtered, err := filterBuildContext(bytes.NewReader(archive.Bytes()), []byte(dockerignore), "Actionfile")
+		require.NoError(t, err)
+		var entries []string
+		for reader := tar.NewReader(filtered); ; {
+			header, err := reader.Next()
+			if err == io.EOF {
+				break
+			}
+			require.NoError(t, err)
+			body, err := io.ReadAll(reader)
+			require.NoError(t, err)
+			entries = append(entries, fmt.Sprintf("%s %c %s %s", strings.TrimPrefix(header.Name, prefix), header.Typeflag, strings.TrimPrefix(header.Linkname, prefix), body))
+		}
+		require.Equal(t, []string{
+			"Actionfile 0  FROM scratch",
+			"build/keep.txt 0  keep",
+			"entrypoint 0  log",
+			"other-entrypoint 1 entrypoint ",
+			".dockerignore 0  " + dockerignore,
+		}, entries, prefix)
+	}
+}