fix: stop a failed step disabling the toolkit patch (#1177)

A step that failed, for any reason, made the runner restore the action's stock bundle and mark it never to be patched again. Every later `actions/upload-artifact` run then failed with `GHESNotSupportedError`, and nothing in the log said why.

The edit is now made as the action is copied into the job container, under the lock that guards the copy, and nothing reverts it. That also closes the race where another job's checkout reset the bundle mid-job.

`cache.v2` no longer decides whether the edit is made, it only withdraws the v2 advertisement, so artifacts work whatever the cache is set to.

Also added a new `runner.patch_actions` option to turn the edit off if it ever breaks an action.

Fixes https://gitea.com/gitea/runner/issues/1176

Reviewed-on: https://gitea.com/gitea/runner/pulls/1177
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

internal/pkg/config/config.example.yaml

@@ -80,6 +80,10 @@ runner:
   # When true (the default), inject the ACT=true environment variable into jobs.
   # Set to false so workflows gated on `if: ${{ !env.ACT }}` behave like they do on GitHub.
   #set_act_env: true
+  # When true (the default), apply compatibility patches to the actions a job runs, so actions
+  # written for GitHub work against this instance. Set to false to run them exactly as published,
+  # at the price of the stock artifact actions refusing and the cache client keeping to v1.
+  #patch_actions: true
   # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
   # Like: "macos-arm64:host" or "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
   # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
@@ -164,10 +168,10 @@ cache:
   # A moved tag (e.g. a re-tagged "v6") or an updated branch stays at the cached commit
   # until its cache entry expires or is manually removed.
   #offline_mode: false
-  # Serve the actions cache service v2 API, used by actions/[email protected] and later. Those actions
-  # refuse any host they do not take for GitHub, so reaching it means editing that check out of
-  # the action's own bundle, keeping the untouched copy beside it. The same edit lets the stock
-  # upload-artifact and download-artifact work here. A bundle that does not match is left alone.
+  # Serve the actions cache service v2 API. The actions that use it refuse any host they do not
+  # take for GitHub, so reaching it means editing that check out of their own bundle, undone
+  # whenever it is downloaded again. That edit is made either way, this only governs the API
+  # advertised. A bundle that does not match is left alone.
   #v2: true
   # How the cache server discards entries, ignored when external_server is set since that
   # server applies its own. Leave a setting out for its default; 0s or 0 turns the three