enhance: test on Windows and fix what it found (#1348)

Adds a weekly and on-demand workflow that runs the cross-compiled tests on Windows Server 2025 Core in a [dockur/windows](https://github.com/dockur/windows) QEMU VM, and fixes the Windows bugs it found in host and UNC paths, env handling, shell quoting, post-task scripts, health checks, checkout, action symlinks, step summaries, Git client certificates and docker mode from a Windows host.

Host-mode steps now emit UTF-8, `bash` falls back to Git's bash instead of the WSL launcher, the runner can run as a native Windows service, steps can keep background helpers with `RUNNER_TRACKING_ID`, and Windows arm64 binaries are released.

Fixes: https://gitea.com/gitea/runner/issues/1339
Fixes: https://gitea.com/gitea/runner/issues/637
Fixes: https://gitea.com/gitea/runner/issues/1172
Fixes: https://gitea.com/gitea/runner/issues/347
Reviewed-on: https://gitea.com/gitea/runner/pulls/1348
Reviewed-by: bircni <[email protected]>

act/container/container_types.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"path"
+	"runtime"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -20,6 +21,8 @@ import (
 	"github.com/moby/moby/api/types/container"
 )
 
+var hostOS = runtime.GOOS // replaced in tests
+
 // ExitCodeError reports a non-zero process exit code from a container command.
 type ExitCodeError int
 

act/container/docker_build.go

@@ -125,6 +125,10 @@ func createBuildContext(ctx context.Context, contextDir, relDockerfile string) (
 }
 
 func writeBuildContext(ctx context.Context, w io.Writer, contextDir string, includes []string, pm *patternmatcher.PatternMatcher) error {
+	contextDir, err := filepath.EvalSymlinks(contextDir)
+	if err != nil {
+		return err
+	}
 	tw := tar.NewWriter(w)
 	seen := map[string]bool{}
 	hardlinks := map[uint64]string{}
@@ -132,8 +136,7 @@ func writeBuildContext(ctx context.Context, w io.Writer, contextDir string, incl
 	for _, include := range includes {
 		include = filepath.FromSlash(include)
 		var parents []parentMatch
-		root := strings.TrimSuffix(contextDir, string(filepath.Separator)) + string(filepath.Separator) + include // unlike filepath.Join, follows a symlinked context dir as docker build does
-		err := filepath.WalkDir(root, func(file string, entry fs.DirEntry, err error) error {
+		err := filepath.WalkDir(filepath.Join(contextDir, include), func(file string, entry fs.DirEntry, err error) error {
 			if err != nil {
 				return leaveOut(ctx, file, err)
 			}
@@ -210,7 +213,7 @@ func addBuildContextEntry(ctx context.Context, tw *tar.Writer, file, rel string,
 			return leaveOut(ctx, file, err)
 		}
 	}
-	header, err := tar.FileInfoHeader(noNameLookups{info}, link)
+	header, err := tar.FileInfoHeader(noNameLookups{info}, filepath.ToSlash(link))
 	if err != nil {
 		return err
 	}

act/container/docker_build_test.go

@@ -50,7 +50,7 @@ func TestCreateBuildContextFollowsDockerignoreAndSymlinkedRootButKeepsDockerfile
 
 	contexts := []string{dir}
 	if link := filepath.Join(t.TempDir(), "link"); os.Symlink(dir, link) == nil {
-		contexts = append(contexts, link+string(filepath.Separator))
+		contexts = append(contexts, link, link+string(filepath.Separator))
 	}
 
 	for _, contextDir := range contexts {

act/container/docker_cli.go

@@ -351,7 +351,7 @@ type containerConfig struct {
 // parse parses the args for the specified command and generates a Config,
 // a HostConfig and returns them with the specified command.
 // If the specified args are not valid, it will return an error.
-func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*containerConfig, error) { //nolint:gocyclo,unparam // verbatim copy from docker/cli
+func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*containerConfig, error) { //nolint:gocyclo // verbatim copy from docker/cli
 	var (
 		attachStdin  = copts.attach.Get("stdin")
 		attachStdout = copts.attach.Get("stdout")
@@ -724,6 +724,10 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 	}, nil
 }
 
+func isUserDefinedNetwork(mode container.NetworkMode) bool { // Docker's helper uses the host OS instead of the daemon's.
+	return !mode.IsDefault() && mode != network.NetworkBridge && mode != network.NetworkHost && !mode.IsNone() && !mode.IsContainer()
+}
+
 // parseNetworkOpts converts --network advanced options to endpoint-specs, and combines
 // them with the old --network-alias and --links. If returns an error if conflicting options
 // are found.
@@ -752,7 +756,7 @@ func parseNetworkOpts(copts *containerOptions) (map[string]*network.EndpointSett
 	}
 
 	for i, n := range copts.netMode.Value() {
-		if container.NetworkMode(n.Target).IsUserDefined() {
+		if isUserDefinedNetwork(container.NetworkMode(n.Target)) {
 			hasUserDefined = true
 		} else {
 			hasNonUserDefined = true
@@ -814,7 +818,7 @@ func applyContainerOptions(n *opts.NetworkAttachmentOpts, copts *containerOption
 	}
 	// For a user-defined network, "--link" is an endpoint option, it creates an alias. But,
 	// for the default bridge it defines a legacy-link.
-	if container.NetworkMode(n.Target).IsUserDefined() && copts.links.Len() > 0 {
+	if isUserDefinedNetwork(container.NetworkMode(n.Target)) && copts.links.Len() > 0 {
 		n.Links = slices.Clone(copts.links.GetSlice())
 	}
 	if copts.ipv4Address != nil {
@@ -840,7 +844,7 @@ func parseNetworkAttachmentOpt(ep opts.NetworkAttachmentOpts) (*network.Endpoint
 	if strings.TrimSpace(ep.Target) == "" {
 		return nil, errors.New("no name set for network")
 	}
-	if !container.NetworkMode(ep.Target).IsUserDefined() {
+	if !isUserDefinedNetwork(container.NetworkMode(ep.Target)) {
 		if len(ep.Aliases) > 0 {
 			return nil, errors.New("network-scoped aliases are only supported for user-defined networks")
 		}

act/container/docker_proxy_test.go

@@ -484,6 +484,10 @@ type probeClient struct {
 	containers []container.Summary
 }
 
+func (c *probeClient) Info(_ctx context.Context, _opts mobyclient.InfoOptions) (mobyclient.SystemInfoResult, error) {
+	return mobyclient.SystemInfoResult{}, nil
+}
+
 func (c *probeClient) Close() error {
 	return nil
 }
@@ -766,6 +770,9 @@ func TestDaemonSeesDir(t *testing.T) {
 }
 
 func TestRunnerContainerWorkdir(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("a runner container is Linux")
+	}
 	workdir := t.TempDir()
 	t.Chdir(workdir)
 	volume := container.MountPoint{Type: mount.TypeVolume, Source: "/daemon/_data", Destination: filepath.Dir(workdir)}

act/container/docker_run.go

@@ -366,6 +366,7 @@ type containerReference struct {
 	id         string
 	input      *NewContainerInput
 	pullPolicy string
+	daemonOS   string
 	UID        int
 	GID        int
 	// attachDone is closed by the attach() streaming goroutine once it has
@@ -375,13 +376,18 @@ type containerReference struct {
 	LinuxContainerEnvironmentExtensions
 }
 
-func GetDockerClient(ctx context.Context) (cli client.APIClient, err error) {
+func GetDockerClient(ctx context.Context) (client.APIClient, error) {
+	cli, _, err := newDockerClient(ctx)
+	return cli, err
+}
+
+func newDockerClient(ctx context.Context) (cli client.APIClient, daemonOS string, err error) {
 	dockerHost := os.Getenv("DOCKER_HOST")
 
 	if strings.HasPrefix(dockerHost, "ssh://") {
 		var args []string
 		if args, err = sshArgs(dockerHost); err != nil {
-			return nil, err
+			return nil, "", err
 		}
 		cli, err = client.New(
 			client.WithHost("http://docker.example.com"), // the dialer below ignores the address
@@ -391,16 +397,17 @@ func GetDockerClient(ctx context.Context) (cli client.APIClient, err error) {
 		cli, err = client.New(client.FromEnv)
 	}
 	if err != nil {
-		return nil, fmt.Errorf("failed to connect to docker daemon: %w", err)
+		return nil, "", fmt.Errorf("failed to connect to docker daemon: %w", err)
 	}
 	// Best-effort API version negotiation, matching the old client.NegotiateAPIVersion
 	// behaviour. Ping failures here are non-fatal: the connection is exercised again on
 	// the first real call, and the client falls back to the daemon's default API version.
-	if _, err := cli.Ping(ctx, client.PingOptions{NegotiateAPIVersion: true}); err != nil {
+	ping, err := cli.Ping(ctx, client.PingOptions{NegotiateAPIVersion: true})
+	if err != nil {
 		common.Logger(ctx).Warnf("docker daemon ping during version negotiation failed, continuing: %v", err)
 	}
 
-	return cli, nil
+	return cli, ping.OSType, nil
 }
 
 func GetHostInfo(ctx context.Context) (system.Info, error) {
@@ -440,16 +447,32 @@ func RunnerArch(ctx context.Context) string {
 	return info.Architecture
 }
 
+func (cr *containerReference) targetOS(ctx context.Context) string {
+	if cr.daemonOS == "" {
+		cr.daemonOS = "linux"
+		if cr.cli != nil {
+			if result, err := cr.cli.Info(ctx, client.InfoOptions{}); err == nil && result.Info.OSType != "" {
+				cr.daemonOS = result.Info.OSType
+			}
+		}
+	}
+	return cr.daemonOS
+}
+
+func (cr *containerReference) markExecutable(ctx context.Context) bool {
+	return hostOS == "windows" && cr.targetOS(ctx) == "linux"
+}
+
 func (cr *containerReference) connect() common.Executor {
 	return func(ctx context.Context) error {
 		if cr.cli != nil {
 			return nil
 		}
-		cli, err := GetDockerClient(ctx)
+		cli, daemonOS, err := newDockerClient(ctx)
 		if err != nil {
 			return err
 		}
-		cr.cli = cli
+		cr.cli, cr.daemonOS = cli, daemonOS
 		return nil
 	}
 }
@@ -459,6 +482,7 @@ func (cr *containerReference) Close() common.Executor {
 		if cr.cli != nil {
 			err := cr.cli.Close()
 			cr.cli = nil
+			cr.daemonOS = ""
 			if err != nil {
 				return fmt.Errorf("failed to close client: %w", err)
 			}
@@ -603,7 +627,8 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 		copts.privileged = false
 	}
 
-	containerConfig, err := parse(flags, copts, runtime.GOOS)
+	serverOS := cr.targetOS(ctx)
+	containerConfig, err := parse(flags, copts, serverOS)
 	if err != nil {
 		return fmt.Errorf("cannot process container options: '%s': '%w'", options, err)
 	}
@@ -618,7 +643,7 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 
 	// For Gitea, forcing --privileged off is not enough, other options reach the host too
 	if !hostConfig.Privileged {
-		trusted, err := parseOptionsHostConfig(cr.input.RunnerOptions)
+		trusted, err := parseOptionsHostConfig(cr.input.RunnerOptions, serverOS)
 		if err != nil {
 			return err
 		}
@@ -731,9 +756,7 @@ func (cr *containerReference) create(capAdd, capDrop []string) common.Executor {
 		cr.sanitizeConfig(ctx, hostConfig)
 
 		var networkingConfig *network.NetworkingConfig
-		n := hostConfig.NetworkMode
-		// IsUserDefined and IsHost are broken on windows
-		if n.IsUserDefined() && n != "host" && len(input.NetworkAliases) > 0 {
+		if isUserDefinedNetwork(hostConfig.NetworkMode) && len(input.NetworkAliases) > 0 {
 			networkingConfig = &network.NetworkingConfig{
 				EndpointsConfig: map[string]*network.EndpointSettings{
 					input.NetworkMode: {Aliases: input.NetworkAliases},
@@ -919,7 +942,7 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore, ski
 		if actPath := cr.GetActPath(); strings.HasPrefix(dstPath+"/", actPath+"/") {
 			extractionRoot = actPath // keeps tar entries from crossing the image's /var/run symlink
 		}
-		if err := writeDirTar(ctx, tarFile, path.Join("/", strings.TrimPrefix(dstPath, extractionRoot)), srcPath, useGitIgnore, skipGitDir, cr.UID, cr.GID); err != nil {
+		if err := writeDirTar(ctx, tarFile, path.Join("/", strings.TrimPrefix(dstPath, extractionRoot)), srcPath, useGitIgnore, skipGitDir, cr.UID, cr.GID, cr.markExecutable(ctx)); err != nil {
 			return err
 		}
 
@@ -1090,12 +1113,12 @@ func resetOption[T any](logger *logging.Logger, option string, field *T, trusted
 
 // parseOptionsHostConfig parses one options string on its own, to see what it alone asks for.
 // Even "" goes through the parser, or its empty slices and maps would differ from a real parse.
-func parseOptionsHostConfig(options string) (*container.HostConfig, error) {
+func parseOptionsHostConfig(options, serverOS string) (*container.HostConfig, error) {
 	flags, copts, _, err := parseContainerOptions(options)
 	if err != nil {
 		return nil, err
 	}
-	containerConfig, err := parse(flags, copts, runtime.GOOS)
+	containerConfig, err := parse(flags, copts, serverOS)
 	if err != nil {
 		return nil, fmt.Errorf("cannot process container options: '%s': '%w'", options, err)
 	}

act/container/docker_run_test.go

@@ -27,10 +27,12 @@ import (
 	"gitea.com/gitea/runner/act/common/logging/logtest"
 
 	cerrdefs "github.com/containerd/errdefs"
+	"github.com/kballard/go-shellquote"
 	"github.com/moby/moby/api/pkg/stdcopy"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/mount"
 	"github.com/moby/moby/api/types/network"
+	"github.com/moby/moby/api/types/system"
 	mobyclient "github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
@@ -65,6 +67,14 @@ func TestDockerEnvironmentUsesContainerPath(t *testing.T) {
 type mockDockerClient struct {
 	mobyclient.APIClient
 	mock.Mock
+	info      system.Info
+	infoErr   error
+	infoCalls int
+}
+
+func (m *mockDockerClient) Info(_ctx context.Context, _opts mobyclient.InfoOptions) (mobyclient.SystemInfoResult, error) {
+	m.infoCalls++
+	return mobyclient.SystemInfoResult{Info: m.info}, m.infoErr
 }
 
 func (m *mockDockerClient) ServerVersion(ctx context.Context, opts mobyclient.ServerVersionOptions) (mobyclient.ServerVersionResult, error) {
@@ -689,11 +699,11 @@ func TestMergeContainerConfigsDropsVolumeDriversFromWorkflows(t *testing.T) {
 }
 
 func TestMergeContainerConfigsKeepsTheRunnersFilesAndEnvToItself(t *testing.T) {
-	hostFile := filepath.Join(t.TempDir(), "host.env")
+	hostFile := filepath.Join(t.TempDir(), "host file.env")
 	require.NoError(t, os.WriteFile(hostFile, []byte("STOLEN=from-the-host\n"), 0o600))
 	t.Setenv("RUNNER_SECRET", "s3cr3t")
 
-	for _, option := range []string{"--env-file " + hostFile, "--label-file " + hostFile} {
+	for _, option := range []string{shellquote.Join("--env-file", hostFile), shellquote.Join("--label-file", hostFile)} {
 		logger := logging.New(logtest.New())
 		cr := &containerReference{input: &NewContainerInput{NetworkMode: "bridge", WorkflowOptions: option}}
 
@@ -933,6 +943,7 @@ func TestContainerInfoFromInspect(t *testing.T) {
 			"/etc/hosts":                "",
 			"/etc/hostname":             "",
 		}, info.Mounts)
+		assert.Equal(t, "/var/lib/docker/volumes/job/_data/subdir", info.DaemonPath("/workspace/owner/repo/subdir"))
 	})
 }
 
@@ -998,6 +1009,39 @@ func TestDockerCreateKeepsInputEntrypoint(t *testing.T) {
 	}
 }
 
+func TestDockerCreateNetworkAliases(t *testing.T) {
+	for _, test := range []struct {
+		networkMode string
+		wantAliases bool
+	}{
+		{"job-network", true},
+		{"host", false},
+		{"bridge", false},
+		{"default", false},
+		{"none", false},
+		{"container:x", false},
+	} {
+		t.Run(test.networkMode, func(t *testing.T) {
+			cr := &containerReference{
+				input: &NewContainerInput{NetworkMode: test.networkMode, NetworkAliases: []string{"service"}},
+				cli: &probeClient{create: func(_ctx context.Context, opts mobyclient.ContainerCreateOptions) (mobyclient.ContainerCreateResult, error) {
+					assert.Equal(t, container.NetworkMode(test.networkMode), opts.HostConfig.NetworkMode)
+					if test.wantAliases {
+						assert.Equal(t, &network.NetworkingConfig{EndpointsConfig: map[string]*network.EndpointSettings{
+							"job-network": {Aliases: []string{"service"}},
+						}}, opts.NetworkingConfig)
+					} else {
+						assert.Nil(t, opts.NetworkingConfig)
+					}
+					return mobyclient.ContainerCreateResult{ID: "created"}, nil
+				}},
+			}
+			require.NoError(t, cr.create(nil, nil)(t.Context()))
+			assert.Equal(t, "created", cr.id)
+		})
+	}
+}
+
 func TestMergeContainerConfigsKeepsNetworkAliasesFromOptions(t *testing.T) {
 	logger := logging.New(logtest.New())
 	cr := &containerReference{input: &NewContainerInput{
@@ -1019,3 +1063,92 @@ func TestSupportsContainerImagePlatformDaemonError(t *testing.T) {
 	require.ErrorContains(t, err, "cannot connect to the Docker daemon")
 	assert.False(t, supported)
 }
+
+func TestContainerOptionsUseDaemonOS(t *testing.T) {
+	for _, testcase := range []struct {
+		name     string
+		serverOS string
+		infoErr  error
+		device   string
+		expected container.DeviceMapping
+	}{
+		{name: "Linux daemon", serverOS: "linux", device: "/dev/kvm:/dev/kvm:rwm", expected: container.DeviceMapping{PathOnHost: "/dev/kvm", PathInContainer: "/dev/kvm", CgroupPermissions: "rwm"}},
+		{name: "unknown daemon", device: "/dev/kvm:/dev/kvm:rwm", expected: container.DeviceMapping{PathOnHost: "/dev/kvm", PathInContainer: "/dev/kvm", CgroupPermissions: "rwm"}},
+		{name: "unavailable daemon info", infoErr: errors.New("unavailable"), device: "/dev/kvm:/dev/kvm:rwm", expected: container.DeviceMapping{PathOnHost: "/dev/kvm", PathInContainer: "/dev/kvm", CgroupPermissions: "rwm"}},
+		{name: "Windows daemon", serverOS: "windows", device: "class/01234567-89ab-cdef-0123-456789abcdef", expected: container.DeviceMapping{PathOnHost: "class/01234567-89ab-cdef-0123-456789abcdef"}},
+	} {
+		t.Run(testcase.name, func(t *testing.T) {
+			cli := &mockDockerClient{info: system.Info{OSType: testcase.serverOS}, infoErr: testcase.infoErr}
+			cr := &containerReference{cli: cli, input: &NewContainerInput{RunnerOptions: "--device=" + testcase.device, WorkflowOptions: "--device=" + testcase.device, NetworkMode: "bridge"}}
+			for range 2 {
+				hostConfig := &container.HostConfig{}
+				require.NoError(t, cr.mergeContainerConfigs(t.Context(), &container.Config{}, hostConfig))
+				assert.Equal(t, []container.DeviceMapping{testcase.expected}, hostConfig.Devices)
+			}
+			assert.Equal(t, 1, cli.infoCalls)
+		})
+	}
+}
+
+func TestConnectTakesDaemonOSFromPing(t *testing.T) {
+	var infos atomic.Int32
+	daemon := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		writer.Header().Set("API-Version", "1.47")
+		writer.Header().Set("OSType", "windows")
+		if strings.HasSuffix(request.URL.Path, "/info") {
+			infos.Add(1)
+		}
+	}))
+	t.Cleanup(daemon.Close)
+	t.Setenv("DOCKER_HOST", daemon.URL)
+	cr := &containerReference{input: &NewContainerInput{}}
+	require.NoError(t, cr.connect()(t.Context()))
+	assert.Equal(t, "windows", cr.targetOS(t.Context()))
+	assert.Zero(t, infos.Load())
+}
+
+func TestContainerCopyModes(t *testing.T) {
+	for _, testcase := range []struct {
+		hostOS, serverOS string
+		expected         int64
+	}{
+		{"windows", "linux", 0o755},
+		{"windows", "windows", 0o666},
+		{"linux", "linux", 0o666},
+	} {
+		t.Run(testcase.hostOS+"-"+testcase.serverOS, func(t *testing.T) {
+			source := t.TempDir()
+			require.NoError(t, os.WriteFile(filepath.Join(source, "run.sh"), []byte("#!/bin/sh\n"), 0o666))
+			require.NoError(t, os.Chmod(filepath.Join(source, "run.sh"), 0o666))
+			file := &FileEntry{Name: "run.sh", Mode: 0o600, Body: "#!/bin/sh\n"}
+			original := hostOS
+			hostOS = testcase.hostOS
+			t.Cleanup(func() { hostOS = original })
+			cli := &mockDockerClient{info: system.Info{OSType: testcase.serverOS}}
+			var modes []int64
+			cli.On("CopyToContainer", mock.Anything, "job", mock.Anything).
+				Run(func(args mock.Arguments) {
+					reader := tar.NewReader(args.Get(2).(mobyclient.CopyToContainerOptions).Content)
+					header, err := reader.Next()
+					require.NoError(t, err)
+					modes = append(modes, header.Mode)
+					assert.Equal(t, "run.sh", filepath.Base(header.Name))
+					content, err := io.ReadAll(reader)
+					require.NoError(t, err)
+					assert.Equal(t, file.Body, string(content))
+					_, err = reader.Next()
+					require.ErrorIs(t, err, io.EOF)
+				}).Return(mobyclient.CopyToContainerResult{}, nil).Twice()
+			cr := &containerReference{cli: cli, id: "job", input: &NewContainerInput{}}
+			require.NoError(t, cr.copyContent("/workspace", file)(t.Context()))
+			require.NoError(t, cr.copyDir("/workspace", source+string(filepath.Separator), false, true)(t.Context()))
+			assert.Equal(t, []int64{0o600, testcase.expected}, modes)
+			if testcase.hostOS == "windows" {
+				assert.Equal(t, 1, cli.infoCalls)
+			} else {
+				assert.Zero(t, cli.infoCalls)
+			}
+			cli.AssertExpectations(t)
+		})
+	}
+}

act/container/executions_environment.go

@@ -4,7 +4,18 @@
 
 package container
 
-import "context"
+import (
+	"context"
+	"path"
+	"strings"
+)
+
+func JoinPath(elem ...string) string { // path.Join would collapse the leading // of a UNC act path on a Windows host
+	if len(elem) > 0 && strings.HasPrefix(elem[0], "//") {
+		return "/" + path.Join(elem...)
+	}
+	return path.Join(elem...)
+}
 
 type ExecutionsEnvironment interface {
 	Container

act/container/host_environment.go

@@ -40,7 +40,8 @@ type HostEnvironment struct {
 	// when Workdir points at a caller-owned checkout (e.g. `act` local mode).
 	CleanWorkdir bool
 	ActPath      string
-	CleanUp      func()
+	Root         string
+	TrackingID   string // RUNNER_TRACKING_ID of the job, a step with another value keeps its leftovers
 	StdOut       io.Writer
 	AllocatePTY  bool // allocate a pseudo-TTY for each step's process
 
@@ -261,6 +262,7 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 	// Flush any buffered, not-yet-newline-terminated trailing line, as the docker backend
 	// does in waitForCommand, so the final line of a command's output is not lost.
 	defer common.FlushWriter(e.StdOut)
+	process.UTF8Console()
 
 	f, err := lookupPathHost(command[0], env, e.StdOut)
 	if err != nil {
@@ -270,7 +272,12 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 	cmd.Path = f
 	cmd.Args = command
 	cmd.Stdout = e.StdOut
-	cmd.Env = getEnvListFromMap(env)
+	trackingID := e.TrackingID
+	if value, ok := common.LookupFold(env, "RUNNER_TRACKING_ID", e.IsEnvironmentCaseInsensitive()); ok {
+		trackingID = value
+	}
+	tracked := trackingID == e.TrackingID
+	cmd.Env = append(getEnvListFromMap(env), "RUNNER_TRACKING_ID="+trackingID)
 	cmd.Stderr = e.StdOut
 	cmd.Dir = wd
 	cmd.SysProcAttr = process.SysProcAttr(cmdline, false)
@@ -278,6 +285,7 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 	// Kills the step's whole tree on cancellation and bounds the post-exit I/O
 	// wait, so an orphan holding cmd's stdout pipe cannot hang cmd.Wait().
 	treeKill := process.NewTreeKill(cmd)
+	treeKill.KeepLeftovers = !tracked
 
 	var ppty *os.File
 	var tty *os.File
@@ -311,10 +319,10 @@ func (e *HostEnvironment) exec(ctx context.Context, command []string, cmdline st
 	if err := cmd.Start(); err != nil {
 		return err
 	}
-	// Assign before the step's Killer so the step's job nests inside the group's;
-	// cancellation still scopes to this step's tree.
-	if err := e.processGroup(ctx).Assign(cmd.Process); err != nil {
-		common.Logger(ctx).Warnf("could not assign the step's process to the job's process group; a process it leaves behind may outlive the job: %v", err)
+	if tracked {
+		if err := e.processGroup(ctx).Assign(cmd.Process); err != nil {
+			common.Logger(ctx).Warnf("could not assign the step's process to the job's process group, a process it leaves behind may outlive the job: %v", err)
+		}
 	}
 	if k, kerr := treeKill.Capture(cmd.Process); kerr != nil {
 		common.Logger(ctx).Warnf("process tree kill setup failed, falling back to single-process kill: %v", kerr)
@@ -365,9 +373,7 @@ func (e *HostEnvironment) UpdateFromEnv(srcPath string, env *map[string]string)
 // removeAll is a var so tests can substitute a blocking stub.
 var removeAll = os.RemoveAll
 
-// removeAllWithContext returns once the delete finishes or ctx is cancelled. On
-// cancellation the goroutine leaks: a delete inside a syscall cannot be
-// interrupted (see runWithTimeout).
+// Returns on cancel while an uninterruptible delete keeps running, freeing the runner's capacity slot.
 func removeAllWithContext(ctx context.Context, path string) error {
 	done := make(chan error, 1)
 	go func() { done <- removeAll(path) }()
@@ -409,35 +415,6 @@ func removePathWithRetry(ctx context.Context, path string) error {
 	return lastErr
 }
 
-// buildWindowsWorkspaceKillScript builds a PowerShell command that taskkills
-// every process tree whose ExecutablePath or CommandLine references one of the
-// given workspace dirs, releasing file handles for cleanup. Win32_Process
-// exposes both fields (Get-Process doesn't, wmic is deprecated); matching is on
-// the dir+separator prefix via ordinal String methods, so a name-prefix sibling
-// (job1 vs job10) is spared and path metacharacters stay literal.
-func buildWindowsWorkspaceKillScript(dirs []string) string {
-	quoted := make([]string, len(dirs))
-	for i, d := range dirs {
-		// Single-quoted PowerShell literal; escape ' by doubling it.
-		quoted[i] = "'" + strings.ReplaceAll(d, "'", "''") + "'"
-	}
-
-	return `$paths = @(` + strings.Join(quoted, ",") + `)
-$selfPid = $PID
-Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
-    if ($_.ProcessId -eq $selfPid) { return $false }
-    foreach ($p in $paths) {
-        $prefix = $p + '\'
-        if ($_.ExecutablePath -and $_.ExecutablePath.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)) { return $true }
-        if ($_.CommandLine -and $_.CommandLine.IndexOf($prefix, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) { return $true }
-    }
-    return $false
-} | ForEach-Object {
-    & taskkill.exe /PID $_.ProcessId /T /F 2>$null | Out-Null
-}
-`
-}
-
 func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
 	if runtime.GOOS != "windows" {
 		return
@@ -471,20 +448,10 @@ func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
 		return
 	}
 
-	script := buildWindowsWorkspaceKillScript(dirs)
-
-	cmd := exec.CommandContext(killCtx, "powershell.exe", "-NoProfile", "-NonInteractive", "-Command", script)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		logger.Debugf("workspace process-tree kill via PowerShell failed: %v output=%s", err, strings.TrimSpace(string(out)))
-	}
-
-	// Win32_Process exposes no working directory, so the scan above misses a
-	// process that merely runs in a workspace dir while pinning a handle on it.
-	if killed, err := process.KillProcessesWithCWDUnder(killCtx, dirs); err != nil {
-		logger.Debugf("workspace process kill by working directory reported errors: %v", err)
+	if killed, err := process.KillProcessesWithPaths(killCtx, dirs, e.TrackingID); err != nil {
+		logger.Debugf("workspace process cleanup reported errors: %v", err)
 	} else if killed > 0 {
-		logger.Debugf("terminated %d leftover process(es) by workspace working directory", killed)
+		logger.Debugf("terminated %d leftover workspace process(es)", killed)
 	}
 }
 
@@ -492,26 +459,6 @@ func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
 // wedge the runner slot. A var so tests can shrink it.
 var hostCleanupTimeout = 30 * time.Second
 
-// runWithTimeout returns context.DeadlineExceeded once timeout elapses, leaking
-// the goroutine: a delete blocked in a syscall (AV filter driver, dead network
-// mount) cannot be interrupted, and leaking scratch state beats losing the
-// runner's capacity slot forever. The idle stale-dir sweep reclaims it later.
-func runWithTimeout(fn func(), timeout time.Duration) error {
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		fn()
-	}()
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-	select {
-	case <-done:
-		return nil
-	case <-timer.C:
-		return context.DeadlineExceeded
-	}
-}
-
 func (e *HostEnvironment) Remove() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
@@ -523,25 +470,14 @@ func (e *HostEnvironment) Remove() common.Executor {
 		}
 		e.terminateRunningProcesses(ctx)
 
-		// Removes per-job misc state only, never the toolcache root. Bounded because
-		// CleanUp is a caller-supplied, typically unbounded os.RemoveAll.
-		if e.CleanUp != nil {
-			logger.Debugf("running host environment cleanup callback")
-			if err := runWithTimeout(e.CleanUp, hostCleanupTimeout); err != nil {
-				logger.Warnf("host environment cleanup did not finish within %s; continuing job completion, scratch state may be leaked and is reclaimed by the idle stale-dir sweep", hostCleanupTimeout)
-			} else {
-				logger.Debugf("host environment cleanup callback finished")
-			}
-		}
-
 		// Detach: a cancelled ctx would skip removePathWithRetry's retries,
 		// which absorb Windows file-handle release lag after the kill above.
 		rmCtx, rmCancel := context.WithTimeout(context.Background(), hostCleanupTimeout)
 		defer rmCancel()
 
 		var errs []error
-		if err := removePathWithRetry(rmCtx, e.Path); err != nil {
-			logger.Warnf("failed to remove host misc state %s: %v", e.Path, err)
+		if err := removePathWithRetry(rmCtx, cmp.Or(e.Root, e.Path)); err != nil {
+			logger.Warnf("failed to remove host misc state %s: %v", cmp.Or(e.Root, e.Path), err)
 			errs = append(errs, err)
 		}
 		if e.CleanWorkdir {

act/container/host_environment_test.go

@@ -161,10 +161,12 @@ func TestHostEnvironmentRemoveWorkdir(t *testing.T) {
 				Path:         filepath.Join(miscRoot, "hostexecutor"),
 				Workdir:      workdir,
 				CleanWorkdir: owned,
-				CleanUp:      func() { _ = os.RemoveAll(miscRoot) },
+				Root:         miscRoot,
 			}
 			require.NoError(t, os.MkdirAll(e.Path, 0o700))
+			require.NoError(t, os.MkdirAll(filepath.Join(miscRoot, "tmp"), 0o700))
 			require.NoError(t, e.Remove()(t.Context()))
+			assert.NoDirExists(t, miscRoot)
 			_, err := os.Stat(workdir)
 			if owned {
 				assert.ErrorIs(t, err, os.ErrNotExist)
@@ -201,87 +203,38 @@ func TestRemoveAllWithContextDoesNotHangOnStuckDelete(t *testing.T) {
 }
 
 func TestHostEnvironmentRemoveDoesNotHang(t *testing.T) {
-	for _, phase := range []string{"CleanUp callback", "path removal"} {
-		t.Run(phase, func(t *testing.T) {
-			synctest.Test(t, func(t *testing.T) {
-				origTimeout := hostCleanupTimeout
-				hostCleanupTimeout = 100 * time.Millisecond
-				t.Cleanup(func() { hostCleanupTimeout = origTimeout })
-				release, stubDone := make(chan struct{}), make(chan struct{})
-				block := func() {
-					defer close(stubDone)
-					<-release
-				}
-				e := &HostEnvironment{Path: filepath.Join(t.TempDir(), "misc", "hostexecutor"), StdOut: os.Stdout}
-				if phase == "CleanUp callback" {
-					e.CleanUp = block
-				} else {
-					origRemoveAll := removeAll
-					removeAll = func(string) error {
-						block()
-						return nil
-					}
-					t.Cleanup(func() { removeAll = origRemoveAll })
-				}
-				t.Cleanup(func() {
-					close(release)
-					<-stubDone
-				})
-				require.NoError(t, os.MkdirAll(e.Path, 0o700))
-				done := make(chan error, 1)
-				go func() { done <- e.Remove()(common.WithLogger(t.Context(), logging.Default())) }()
-				select {
-				case err := <-done:
-					require.NoError(t, err)
-				case <-time.After(10 * time.Second):
-					t.Fatalf("Remove() hung on a stuck %s", phase)
-				}
-			})
+	synctest.Test(t, func(t *testing.T) {
+		origTimeout, origRemoveAll := hostCleanupTimeout, removeAll
+		hostCleanupTimeout = 100 * time.Millisecond
+		release, stubDone := make(chan struct{}), make(chan struct{})
+		removeAll = func(string) error {
+			defer close(stubDone)
+			<-release
+			return nil
+		}
+		t.Cleanup(func() {
+			close(release)
+			<-stubDone
+			hostCleanupTimeout, removeAll = origTimeout, origRemoveAll
 		})
+		e := &HostEnvironment{Path: filepath.Join(t.TempDir(), "misc", "hostexecutor"), StdOut: os.Stdout}
+		require.NoError(t, os.MkdirAll(e.Path, 0o700))
+		done := make(chan error, 1)
+		go func() { done <- e.Remove()(common.WithLogger(t.Context(), logging.Default())) }()
+		select {
+		case err := <-done:
+			require.NoError(t, err)
+		case <-time.After(10 * time.Second):
+			t.Fatal("Remove() hung on a stuck path removal")
+		}
+	})
+}
+
+func TestJoinPath(t *testing.T) {
+	assert.Equal(t, "//server/share/act/workflow/envs.txt", JoinPath("//server/share/act", "workflow/envs.txt"))
+	assert.Equal(t, "/var/run/act/workflow/envs.txt", JoinPath("/var/run/act/", "workflow", "envs.txt"))
+	for _, root := range []string{"//server/share/act", "/var/run/act", "C:/act"} {
+		assert.Equal(t, root+"/actions/key/main.go.out", JoinPath(root+"/actions/key", "main.go.out"))
+		assert.Equal(t, root+"/workflow", JoinPath(root+"/workflow/outputcmd.txt", ".."))
 	}
 }
-
-func TestBuildWindowsWorkspaceKillScript(t *testing.T) {
-	t.Run("single dir", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{`C:\workspace\job1`})
-		assert.Contains(t, s, `$paths = @('C:\workspace\job1')`)
-		assert.Contains(t, s, "$selfPid = $PID")
-		assert.Contains(t, s, "$_.ProcessId -eq $selfPid")
-		assert.Contains(t, s, `$prefix = $p + '\'`)
-		assert.Contains(t, s, "$_.ExecutablePath.StartsWith($prefix")
-		assert.Contains(t, s, "$_.CommandLine.IndexOf($prefix")
-		assert.Contains(t, s, "taskkill.exe /PID $_.ProcessId /T /F")
-	})
-
-	t.Run("multiple dirs comma-separated", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{
-			`C:\work\path`,
-			`C:\work\workdir`,
-			`C:\Users\runner\AppData\Local\Temp\job-42`,
-		})
-		assert.Contains(t, s, `'C:\work\path'`)
-		assert.Contains(t, s, `'C:\work\workdir'`)
-		assert.Contains(t, s, `'C:\Users\runner\AppData\Local\Temp\job-42'`)
-		assert.Contains(t, s, `'C:\work\path','C:\work\workdir',`)
-	})
-
-	t.Run("path with single quote is escaped", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\it's\path`})
-		assert.Contains(t, s, `'C:\work\it''s\path'`)
-		assert.NotContains(t, s, `'C:\work\it's\path'`)
-	})
-
-	t.Run("path with wildcard metacharacters is matched literally", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript([]string{`C:\work\[job]?1`})
-		assert.Contains(t, s, `'C:\work\[job]?1'`)
-		assert.NotContains(t, s, "-like")
-		assert.Contains(t, s, "StartsWith")
-		assert.Contains(t, s, "IndexOf")
-	})
-
-	t.Run("empty dir list still produces a valid script", func(t *testing.T) {
-		s := buildWindowsWorkspaceKillScript(nil)
-		assert.Contains(t, s, "$paths = @()")
-		assert.Contains(t, s, "Get-CimInstance Win32_Process")
-	})
-}

act/container/host_environment_windows_test.go

@@ -0,0 +1,138 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+	"unsafe"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+func TestHostEnvironmentTrackingCleanup(t *testing.T) {
+	for _, tracking := range []string{"default", "", "shared-helper"} {
+		t.Run("tracking="+tracking, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+			defer cancel()
+			listener, err := net.Listen("tcp4", "127.0.0.1:0")
+			require.NoError(t, err)
+			defer listener.Close()
+			stop := context.AfterFunc(ctx, func() { _ = listener.Close() })
+			defer stop()
+			workspace := t.TempDir()
+			environment := &HostEnvironment{Path: t.TempDir(), TmpDir: workspace, Workdir: workspace, TrackingID: "gitea_test", StdOut: io.Discard}
+			env := map[string]string{}
+			for _, entry := range os.Environ() {
+				if name, value, ok := strings.Cut(entry, "="); ok && !strings.EqualFold(name, "RUNNER_TRACKING_ID") {
+					env[name] = value
+				}
+			}
+			env["GITEA_TRACKING_HELPER"] = "step"
+			env["GITEA_TRACKING_WORKSPACE"] = workspace
+			env["GITEA_TRACKING_ADDRESS"] = listener.Addr().String()
+			if tracking == "default" {
+				env["RUNNER_TRACKING_ID"] = environment.TrackingID
+				env["runner_tracking_id"] = "shared-helper"
+			} else {
+				env["runner_tracking_id"] = tracking
+			}
+			result := make(chan error, 1)
+			go func() {
+				result <- environment.Exec([]string{os.Args[0], "-test.run=^TestHostTrackingHelper$"}, env, "", workspace)(ctx)
+			}()
+			step, err := listener.Accept()
+			require.NoError(t, err)
+			defer step.Close()
+			require.NoError(t, step.SetDeadline(time.Now().Add(20*time.Second)))
+			var stepPID int
+			_, err = fmt.Fscanln(step, &stepPID)
+			require.NoError(t, err)
+			stepHandle, err := windows.OpenProcess(windows.PROCESS_QUERY_LIMITED_INFORMATION, false, uint32(stepPID))
+			require.NoError(t, err)
+			defer func() { _ = windows.CloseHandle(stepHandle) }()
+			require.Eventually(t, func() bool {
+				var assigned int32
+				result, _, _ := windows.NewLazySystemDLL("kernel32.dll").NewProc("IsProcessInJob").Call(uintptr(stepHandle), 0, uintptr(unsafe.Pointer(&assigned)))
+				return result != 0 && assigned != 0
+			}, 5*time.Second, 10*time.Millisecond)
+			_, err = step.Write([]byte{1})
+			require.NoError(t, err)
+			var helpers []windows.Handle
+			for range 2 {
+				connection, err := listener.Accept()
+				require.NoError(t, err)
+				t.Cleanup(func() { _ = connection.Close() })
+				require.NoError(t, connection.SetReadDeadline(time.Now().Add(20*time.Second)))
+				var pid int
+				_, err = fmt.Fscanln(connection, &pid)
+				require.NoError(t, err)
+				handle, err := windows.OpenProcess(windows.SYNCHRONIZE|windows.PROCESS_TERMINATE, false, uint32(pid))
+				require.NoError(t, err)
+				t.Cleanup(func() {
+					_ = windows.TerminateProcess(handle, 1)
+					_, _ = windows.WaitForSingleObject(handle, 5000)
+					_ = windows.CloseHandle(handle)
+				})
+				helpers = append(helpers, handle)
+			}
+			select {
+			case err := <-result:
+				require.NoError(t, err)
+			case <-ctx.Done():
+				t.Fatal(ctx.Err())
+			}
+			require.NoError(t, environment.Remove()(ctx))
+			for _, handle := range helpers {
+				if tracking == "default" {
+					result, err := windows.WaitForSingleObject(handle, 5000)
+					require.NoError(t, err)
+					require.EqualValues(t, windows.WAIT_OBJECT_0, result)
+				} else {
+					result, err := windows.WaitForSingleObject(handle, 0)
+					require.NoError(t, err)
+					require.EqualValues(t, windows.WAIT_TIMEOUT, result)
+				}
+			}
+		})
+	}
+}
+
+func TestHostTrackingHelper(t *testing.T) {
+	mode := os.Getenv("GITEA_TRACKING_HELPER")
+	if mode == "" {
+		return
+	}
+	connection, err := net.Dial("tcp4", os.Getenv("GITEA_TRACKING_ADDRESS"))
+	require.NoError(t, err)
+	_, err = fmt.Fprintln(connection, os.Getpid())
+	require.NoError(t, err)
+	if mode == "step" {
+		_, err := bufio.NewReader(connection).ReadByte()
+		require.NoError(t, err)
+	}
+	if mode != "descendant" {
+		child := exec.Command(os.Args[0], "-test.run=^TestHostTrackingHelper$", filepath.Join(os.Getenv("GITEA_TRACKING_WORKSPACE"), "tracking-reference"))
+		child.Env = append(os.Environ(), "GITEA_TRACKING_HELPER="+map[string]string{"step": "helper", "helper": "descendant"}[mode])
+		require.NoError(t, child.Start())
+		if mode == "step" {
+			require.NoError(t, connection.Close())
+			os.Exit(0)
+		}
+	}
+	_, err = io.Copy(io.Discard, connection)
+	require.NoError(t, err)
+	require.NoError(t, connection.Close())
+	os.Exit(0)
+}

act/container/kubernetes.go

@@ -557,7 +557,7 @@ func (c *kubernetesContainer) Copy(destPath string, files ...*FileEntry) common.
 func (c *kubernetesContainer) CopyDir(destPath, srcPath string, useGitIgnore, skipGitDir bool) common.Executor {
 	return func(ctx context.Context) error {
 		return c.extract(ctx, destPath, true, func(writer io.Writer) error { // directories are actions and workspaces, megabytes of compressible sources
-			return writeDirTar(ctx, writer, "/", srcPath, useGitIgnore, skipGitDir, 0, 0)
+			return writeDirTar(ctx, writer, "/", srcPath, useGitIgnore, skipGitDir, 0, 0, hostOS == "windows")
 		})
 	}
 }

act/container/parse_env_file.go

@@ -21,7 +21,12 @@ import (
 
 // parseEnvFile reads a GITHUB_ENV style file, splitting lines like GitHub's runner on Windows or elsewhere.
 func parseEnvFile(e Container, srcPath string, env *map[string]string, windows bool) common.Executor {
-	localEnv := *env
+	return ParseEnvFile(e, srcPath, func(name, value string) {
+		(*env)[name] = value
+	}, windows)
+}
+
+func ParseEnvFile(e Container, srcPath string, setEnv func(name, value string), windows bool) common.Executor {
 	return func(ctx context.Context) error {
 		envTar, err := e.GetContainerArchive(ctx, srcPath)
 		if err != nil {
@@ -64,7 +69,7 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string, windows b
 			multiLineEnv := strings.Index(line, "<<")
 			switch {
 			case singleLineEnv != -1 && (multiLineEnv == -1 || singleLineEnv < multiLineEnv):
-				localEnv[line[:singleLineEnv]] = line[singleLineEnv+1:]
+				setEnv(line[:singleLineEnv], line[singleLineEnv+1:])
 			case multiLineEnv != -1:
 				var multiLineEnvContent []string
 				multiLineEnvDelimiter := line[multiLineEnv+2:]
@@ -86,7 +91,7 @@ func parseEnvFile(e Container, srcPath string, env *map[string]string, windows b
 				if !delimiterFound {
 					return fmt.Errorf("invalid format delimiter '%v' not found before end of file", multiLineEnvDelimiter)
 				}
-				localEnv[line[:multiLineEnv]] = trimEnvLineEnding(strings.Join(multiLineEnvContent, ""), windows)
+				setEnv(line[:multiLineEnv], trimEnvLineEnding(strings.Join(multiLineEnvContent, ""), windows))
 			default:
 				return fmt.Errorf("invalid format '%v', expected a line with '=' or '<<'", line)
 			}

act/container/parse_env_file_test.go

@@ -34,6 +34,7 @@ func TestParseEnvFile(t *testing.T) {
 		want          map[string]string
 	}{
 		{"single line", "FOO=bar\nBAZ=qux\n", map[string]string{"FOO": "bar", "BAZ": "qux"}},
+		{"repeated names", "FOO=first\nfoo=middle\nFOO=last\n", map[string]string{"FOO": "last", "foo": "middle"}},
 		{"single line CRLF and final bare CR", "FOO=bar\r\nBAZ=qux\r", map[string]string{"FOO": "bar\r", "BAZ": "qux\r"}},
 		{"single line without final newline", "FOO=bar", map[string]string{"FOO": "bar"}},
 		{"blank lines", "\nFOO=bar\n\n   \nBAZ=qux\n\n", map[string]string{"FOO": "bar", "BAZ": "qux"}},
@@ -57,6 +58,17 @@ func TestParseEnvFile(t *testing.T) {
 			assert.Equal(t, test.want, env)
 		})
 	}
+	t.Run("ordered entries preserve repeated names", func(t *testing.T) {
+		hostEnv, envPath := newTestHostEnv(t)
+		require.NoError(t, os.WriteFile(envPath, []byte("FOO=first\r\nfoo<<EOF\r\nmiddle\r\nEOF\r\nFOO=last\r\n"), 0o600))
+		var entries [][2]string
+		require.NoError(t, ParseEnvFile(hostEnv, envPath, func(name, value string) {
+			entries = append(entries, [2]string{name, value})
+		}, true)(t.Context()))
+		assert.Equal(t, [][2]string{
+			{"FOO", "first"}, {"foo", "middle"}, {"FOO", "last"},
+		}, entries)
+	})
 	t.Run("Windows line endings", func(t *testing.T) {
 		hostEnv, envPath := newTestHostEnv(t)
 		require.NoError(t, os.WriteFile(envPath, []byte("FOO=bar\r\nMULTI<<EOF\r\nline1\r\nline2\nEOF\r\n"), 0o600))
@@ -86,13 +98,13 @@ func TestParseEnvFileInvalidHeredoc(t *testing.T) {
 	} {
 		t.Run(name, func(t *testing.T) {
 			e, envPath := newTestHostEnv(t)
-			require.NoError(t, os.WriteFile(envPath, []byte(content), 0o600))
+			require.NoError(t, os.WriteFile(envPath, []byte("APPLIED=before-error\n"+content), 0o600))
 
 			env := map[string]string{}
 			err := parseEnvFile(e, envPath, &env, false)(t.Context())
 			require.Error(t, err)
 			assert.Contains(t, err.Error(), "delimiter")
-			assert.Empty(t, env)
+			assert.Equal(t, map[string]string{"APPLIED": "before-error"}, env)
 		})
 	}
 }

act/container/tar.go

@@ -36,7 +36,7 @@ func writeFilesTar(ctx context.Context, w io.Writer, uid, gid int, files ...*Fil
 }
 
 // writeDirTar prefixes entries with dstPath for extraction at root.
-func writeDirTar(ctx context.Context, w io.Writer, dstPath, srcPath string, useGitIgnore, skipGitDir bool, uid, gid int) error {
+func writeDirTar(ctx context.Context, w io.Writer, dstPath, srcPath string, useGitIgnore, skipGitDir bool, uid, gid int, executable bool) error {
 	logger := common.Logger(ctx)
 	tw := tar.NewWriter(w)
 	srcPrefix := strings.TrimSuffix(filepath.Dir(srcPath), string(filepath.Separator)) + string(filepath.Separator)
@@ -47,7 +47,7 @@ func writeDirTar(ctx context.Context, w io.Writer, dstPath, srcPath string, useG
 		SrcPrefix:    srcPrefix,
 		SkipGitDir:   skipGitDir,
 		UseGitIgnore: useGitIgnore,
-		Handler:      &filecollector.TarCollector{TarWriter: tw, UID: uid, GID: gid, DstDir: dstPath[1:]},
+		Handler:      &filecollector.TarCollector{TarWriter: tw, UID: uid, GID: gid, DstDir: dstPath[1:], Executable: executable},
 	}).CollectFiles(ctx)); err != nil {
 		return err
 	}