fix: align runner behaviours (#1338)

Contains a number of small bug fixes where jobs behaved differently from GitHub or failed silently.

1. Hooks fail on a refused `::set-env::` or `::add-path::` and no longer inherit the last step's identity
1. Docker build, exec and wait errors are returned instead of swallowed, token-only registry credentials work, logs of `--tty` services decode
1. Env files split lines like GitHub on each OS, so a carriage return is kept on Linux and CRLF ends a line on Windows, empty heredoc names or delimiters are rejected
1. Post steps run after their pre step even when main was skipped, composites see undeclared inputs, `runs.args` wins without `with.args` being parsed
1. Docker actions skip evaluating defaults of inputs given in `with` and read `entryPoint` and `args` in any case, a lowercase `dockerfile` is found, undeclared inputs get GitHub's warning
1. A user-set `CI` is kept, `GITHUB_REPOSITORY_ID` and the other missing `GITHUB_*` variables are exported
1. `timeout-minutes` can read the step's own `env`, a step-level `ACTIONS_ALLOW_UNSECURE_COMMANDS: false` beats a job-level `true` while the runner's own opt-in still wins, `pwsh` quotes the script path
1. A step `env:` given as one expression such as `${{ fromJSON(matrix.env) }}` is applied, `hashFiles` fails with GitHub's messages on script errors and after 120 seconds, a job image without node still gets an empty hash
1. A step whose command files cannot be reset fails instead of importing stale ones, a timeout between steps fails the job instead of reporting success
1. One named volume can be mounted at several paths, host-mode PTY steps keep their last output when they fail, host scratch directories are removed when job setup fails
1. Cancelling a step right after it starts kills its whole process tree
1. Cache prefix restores pick the newest entry created within the same second, also on S3, cache commits with a wrong size are rejected
1. Artifact chunks are written at their offset, download URLs are escaped, listing a run without artifacts no longer crashes
1. Poll backoff reaches `fetch_interval_max`, proxy passwords are masked in more forms, secrets are also masked in step names and in their quoted form in the runner log, a failed final report is logged
1. On Windows hosts a differently cased unsecure-commands opt-in or proxy variable counts, and an early cancel no longer leaks a job object handle
1. Interactive `register` prompts for a missing token and stops on SIGTERM, `exec --list --detect-event` no longer panics without events, `config set` works on `cache.s3` keys

Reviewed-on: https://gitea.com/gitea/runner/pulls/1338
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/container/docker_run.go

@@ -205,18 +205,30 @@ func (cr *containerReference) DumpLogs(ctx context.Context) error {
 	if cr.id == "" {
 		return cr.missingContainerError("read its logs")
 	}
+	tty, err := cr.containerTTY(ctx)
+	if err != nil {
+		return err
+	}
 
 	logs, err := cr.cli.ContainerLogs(ctx, cr.id, client.ContainerLogsOptions{ShowStdout: true, ShowStderr: true})
 	if err != nil {
 		return err
 	}
 	defer logs.Close()
-	return cr.copyOutput(logs)
+	return cr.copyOutput(logs, tty)
+}
+
+func (cr *containerReference) containerTTY(ctx context.Context) (bool, error) {
+	inspect, err := cr.cli.ContainerInspect(ctx, cr.id, client.ContainerInspectOptions{})
+	if err != nil {
+		return false, fmt.Errorf("failed to inspect container: %w", err)
+	}
+	return inspect.Container.Config != nil && inspect.Container.Config.Tty, nil
 }
 
 // copyOutput writes a container stream to the writers the container was created with,
 // demultiplexing it unless the container has a TTY, which sends a single raw stream.
-func (cr *containerReference) copyOutput(stream io.Reader) error {
+func (cr *containerReference) copyOutput(stream io.Reader, tty bool) error {
 	outWriter := cr.input.Stdout
 	if outWriter == nil {
 		outWriter = os.Stdout
@@ -227,7 +239,7 @@ func (cr *containerReference) copyOutput(stream io.Reader) error {
 	}
 
 	var err error
-	if !cr.input.AllocatePTY || os.Getenv("NORAW") != "" {
+	if !tty || os.Getenv("NORAW") != "" {
 		_, err = stdcopy.StdCopy(outWriter, errWriter, stream)
 	} else {
 		_, err = io.Copy(outWriter, stream)
@@ -296,7 +308,7 @@ func containerInfoFromInspect(inspect container.InspectResponse) *Info {
 }
 
 func (cr *containerReference) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
-	return parseEnvFile(cr, srcPath, env).IfNot(common.Dryrun)
+	return parseEnvFile(cr, srcPath, env, false).IfNot(common.Dryrun)
 }
 
 func (cr *containerReference) UpdateFromImageEnv(env *map[string]string) common.Executor {
@@ -499,7 +511,7 @@ func (cr *containerReference) remove() common.Executor {
 		if idOrName == "" && cr.input != nil {
 			idOrName = cr.input.Name
 		}
-		if idOrName == "" {
+		if idOrName == "" || cr.cli == nil {
 			return nil
 		}
 
@@ -851,7 +863,7 @@ func (cr *containerReference) waitForCommand(ctx context.Context, resp client.Hi
 	cmdResponse := make(chan error, 1)
 
 	go func() {
-		cmdResponse <- cr.copyOutput(resp.Reader)
+		cmdResponse <- cr.copyOutput(resp.Reader, cr.input.AllocatePTY)
 	}()
 
 	select {
@@ -876,11 +888,7 @@ func (cr *containerReference) waitForCommand(ctx context.Context, resp client.Hi
 		// from executing
 		return ctx.Err()
 	case err := <-cmdResponse:
-		if err != nil {
-			logger.Error(err)
-		}
-
-		return nil
+		return err
 	}
 }
 
@@ -897,7 +905,7 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore, ski
 		}
 		logger.Debugf("Writing tarball %s from %s", tarFile.Name(), srcPath)
 		defer func() {
-			if err := tarFile.Close(); !errors.Is(err, os.ErrClosed) {
+			if err := tarFile.Close(); err != nil && !errors.Is(err, os.ErrClosed) {
 				logger.Error(err)
 			}
 			if err := os.Remove(tarFile.Name()); err != nil {
@@ -944,6 +952,10 @@ func (cr *containerReference) upload(ctx context.Context, dstPath string, conten
 
 func (cr *containerReference) attach() common.Executor {
 	return func(ctx context.Context) error {
+		tty, err := cr.containerTTY(ctx)
+		if err != nil {
+			return err
+		}
 		out, err := cr.cli.ContainerAttach(ctx, cr.id, client.ContainerAttachOptions{
 			Stream: true,
 			Stdout: true,
@@ -954,9 +966,12 @@ func (cr *containerReference) attach() common.Executor {
 		}
 		done := make(chan struct{})
 		cr.attachDone = done
+		stopClose := context.AfterFunc(ctx, out.Close)
 		go func() {
 			defer close(done)
-			if copyErr := cr.copyOutput(out.Reader); copyErr != nil {
+			defer out.Close()
+			defer stopClose()
+			if copyErr := cr.copyOutput(out.Reader, tty); copyErr != nil && ctx.Err() == nil {
 				common.Logger(ctx).Error(copyErr)
 			}
 		}()
@@ -991,6 +1006,9 @@ func (cr *containerReference) wait() common.Executor {
 				return fmt.Errorf("failed to wait for container: %w", err)
 			}
 		case status := <-waitResult.Result:
+			if status.Error != nil {
+				return fmt.Errorf("failed to wait for container: %s", status.Error.Message)
+			}
 			statusCode = status.StatusCode
 		}