fix: align Docker actions, job env and host mode with GitHub (#1268)

- Docker actions evaluate `runs.args` and `runs.env` with their own `inputs`, so a same-named `workflow_dispatch` input no longer replaces the step's `with:` value
- Dockerfile action images are tagged per step and job and removed afterwards, so changed Dockerfiles rebuild and concurrent jobs never share an image
- Workflow and job `env` are evaluated before job and service container credentials and service `env` use them
- Docker actions in host jobs get the host workspace and file-command directory mounted, and no longer inherit the runner's own `PATH`
- Cache server address detection accepts a single interface address

Fixes: https://gitea.com/gitea/runner/issues/390
Fixes: https://gitea.com/gitea/runner/issues/406
Fixes: https://gitea.com/gitea/runner/issues/578
Related: https://gitea.com/gitea/runner/issues/64
Reviewed-on: https://gitea.com/gitea/runner/pulls/1268
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/runner/expression.go

@@ -246,18 +246,19 @@ func inputsFromEnv(env map[string]string) map[string]any {
 }
 
 func getEvaluatorInputs(rc *RunContext, stepInputs map[string]any, ghc *model.GithubContext) map[string]any {
+	if stepInputs != nil { // an action's own inputs, which workflow inputs must not shadow
+		return maps.Clone(stepInputs)
+	}
 	inputs := map[string]any{}
 
 	// only a called workflow's job itself takes the inputs Gitea resolved,
 	// composite actions copy its Config but have their own `inputs`
 	if rc.Config.WorkflowCallInputs != nil && rc.Parent == nil {
 		maps.Copy(inputs, rc.Config.WorkflowCallInputs)
-		maps.Copy(inputs, stepInputs)
 		return inputs
 	}
 
 	maps.Copy(inputs, rc.workflowCallInputs)
-	maps.Copy(inputs, stepInputs)
 
 	switch ghc.EventName {
 	case "workflow_dispatch":