feat(runner): add built-in actions framework with checkout (#871)

Adds built-in actions, native Go actions shipped with the runner and selected with `uses: builtin:<name>`. Jobs need no action download and no Node in their image.

The first one is `builtin:checkout`, a subset of `actions/checkout` with `repository`, `ref`, `token`, `path` and `fetch-depth`. Other inputs fail the step. The runner clones shallowly on its host and copies the tree into the job, while `gitea-runner exec` copies the local working directory for the workflow's own ref.

`actions/checkout` and other remote actions are unchanged. A clone ref of `HEAD` now shallow-clones the remote's default branch, which checkout uses for other repositories.

---------

Co-authored-by: silverwind <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/871
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>

act/common/git/git.go

@@ -438,10 +438,11 @@ func cloneAtDepth(ctx context.Context, input NewGitCloneExecutorInput, opts git.
 				return nil, err
 			}
 		} else {
-			for _, refName := range []plumbing.ReferenceName{
-				plumbing.NewBranchReferenceName(input.Ref),
-				plumbing.NewTagReferenceName(input.Ref),
-			} {
+			refNames := []plumbing.ReferenceName{plumbing.NewBranchReferenceName(input.Ref), plumbing.NewTagReferenceName(input.Ref)}
+			if input.Ref == plumbing.HEAD.String() || strings.HasPrefix(input.Ref, "refs/") {
+				refNames = []plumbing.ReferenceName{plumbing.ReferenceName(input.Ref)} // HEAD is the remote's default branch
+			}
+			for _, refName := range refNames {
 				shallowOpts := opts
 				shallowOpts.Depth = input.Depth
 				shallowOpts.SingleBranch = true

act/runner/runner_test.go

@@ -434,6 +434,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 
 		tables = append(tables, []TestJobFileInfo{
 			{workdir, "nix-prepend-path", "push", "", platforms, secrets},
+			{workdir, "builtin-checkout", "push", "", platforms, secrets},
 			{workdir, "inputs-via-env-context", "push", "", platforms, secrets},
 			{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
 			{workdir, "set-env-step-env-override", "push", "", platforms, secrets},

act/runner/step_action_builtin.go

@@ -0,0 +1,69 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+
+	"gitea.com/gitea/runner/act/common"
+	"gitea.com/gitea/runner/internal/pkg/action"
+	"gitea.com/gitea/runner/internal/pkg/action/checkout"
+
+	"gitea.dev/actionslib/pkg/model"
+)
+
+var builtinActions = map[string]func(context.Context, *action.Context) error{
+	"checkout": checkout.Main,
+}
+
+type stepActionBuiltin struct {
+	Step       *model.Step
+	RunContext *RunContext
+	run        func(context.Context, *action.Context) error
+	env        map[string]string
+}
+
+func (sab *stepActionBuiltin) pre() common.Executor { return common.NewPipelineExecutor() }
+
+func (sab *stepActionBuiltin) main() common.Executor {
+	sab.env = map[string]string{}
+	return runStepExecutor(sab, stepStageMain, func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+
+		printRunActionHeader(ctx, sab.Step, sab.env, sab.RunContext)
+		rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
+		defer rawLogger.Infof("::endgroup::")
+
+		rc := sab.RunContext
+		return sab.run(ctx, &action.Context{
+			Container:       rc.JobContainer,
+			Github:          rc.getGithubContext(ctx),
+			Inputs:          sab.Step.With,
+			HostWorkdir:     rc.Config.Workdir,
+			Workspace:       rc.JobContainer.ToContainerPath(rc.Config.Workdir),
+			BindWorkdir:     rc.Config.BindWorkdir,
+			NoSkipCheckout:  rc.Config.NoSkipCheckout,
+			UseGitIgnore:    rc.Config.UseGitIgnore,
+			InsecureSkipTLS: rc.Config.InsecureSkipTLS,
+		})
+	})
+}
+
+func (sab *stepActionBuiltin) post() common.Executor { return common.NewPipelineExecutor() }
+
+func (sab *stepActionBuiltin) getRunContext() *RunContext { return sab.RunContext }
+
+func (sab *stepActionBuiltin) getGithubContext(ctx context.Context) *model.GithubContext {
+	return sab.RunContext.getGithubContext(ctx)
+}
+
+func (sab *stepActionBuiltin) getStepModel() *model.Step { return sab.Step }
+
+func (sab *stepActionBuiltin) getEnv() *map[string]string { return &sab.env }
+
+func (sab *stepActionBuiltin) getIfExpression(_ context.Context, _ stepStage) string {
+	return sab.Step.If.Value
+}

act/runner/step_factory.go

@@ -6,6 +6,9 @@ package runner
 
 import (
 	"fmt"
+	"maps"
+	"slices"
+	"strings"
 
 	"gitea.dev/actionslib/pkg/model"
 )
@@ -33,6 +36,18 @@ func (sf *stepFactoryImpl) newStep(stepModel *model.Step, rc *RunContext) (step,
 			runAction:  runActionImpl,
 		}, nil
 	case model.StepTypeUsesActionRemote:
+		if name, ok := strings.CutPrefix(stepModel.Uses, "builtin:"); ok {
+			run, ok := builtinActions[name]
+			if !ok {
+				return nil, fmt.Errorf("unknown built-in action %q (known: %v) for job:%s step:%+v",
+					name, slices.Sorted(maps.Keys(builtinActions)), rc.Run, stepModel)
+			}
+			return &stepActionBuiltin{
+				Step:       stepModel,
+				RunContext: rc,
+				run:        run,
+			}, nil
+		}
 		return &stepActionRemote{
 			Step:       stepModel,
 			RunContext: rc,

act/runner/step_factory_test.go

@@ -57,6 +57,16 @@ func TestStepFactoryNewStep(t *testing.T) {
 				return ok
 			},
 		},
+		{
+			name: "StepBuiltinAction",
+			model: &model.Step{
+				Uses: "builtin:checkout",
+			},
+			check: func(s step) bool {
+				_, ok := s.(*stepActionBuiltin)
+				return ok
+			},
+		},
 	}
 
 	for _, tt := range table {
@@ -72,14 +82,11 @@ func TestStepFactoryNewStep(t *testing.T) {
 }
 
 func TestStepFactoryInvalidStep(t *testing.T) {
-	model := &model.Step{
-		Uses: "remote/action@v1",
-		Run:  "cmd",
+	for _, stepModel := range []*model.Step{
+		{Uses: "remote/action@v1", Run: "cmd"},
+		{Uses: "builtin:unknown"},
+	} {
+		_, err := (&stepFactoryImpl{}).newStep(stepModel, &RunContext{})
+		assert.Error(t, err, stepModel.Uses)
 	}
-
-	sf := &stepFactoryImpl{}
-
-	_, err := sf.newStep(model, &RunContext{})
-
-	assert.Error(t, err)
 }

act/runner/testdata/builtin-checkout/push.yml

@@ -0,0 +1,10 @@
+name: builtin-checkout
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: builtin:checkout
+        with:
+          path: ${{ 'sub' }}
+      - run: test -f sub/builtin-checkout/push.yml