fix: align runner behaviours (#1338)

Contains a number of small bug fixes where jobs behaved differently from GitHub or failed silently.

1. Hooks fail on a refused `::set-env::` or `::add-path::` and no longer inherit the last step's identity
1. Docker build, exec and wait errors are returned instead of swallowed, token-only registry credentials work, logs of `--tty` services decode
1. Env files split lines like GitHub on each OS, so a carriage return is kept on Linux and CRLF ends a line on Windows, empty heredoc names or delimiters are rejected
1. Post steps run after their pre step even when main was skipped, composites see undeclared inputs, `runs.args` wins without `with.args` being parsed
1. Docker actions skip evaluating defaults of inputs given in `with` and read `entryPoint` and `args` in any case, a lowercase `dockerfile` is found, undeclared inputs get GitHub's warning
1. A user-set `CI` is kept, `GITHUB_REPOSITORY_ID` and the other missing `GITHUB_*` variables are exported
1. `timeout-minutes` can read the step's own `env`, a step-level `ACTIONS_ALLOW_UNSECURE_COMMANDS: false` beats a job-level `true` while the runner's own opt-in still wins, `pwsh` quotes the script path
1. A step `env:` given as one expression such as `${{ fromJSON(matrix.env) }}` is applied, `hashFiles` fails with GitHub's messages on script errors and after 120 seconds, a job image without node still gets an empty hash
1. A step whose command files cannot be reset fails instead of importing stale ones, a timeout between steps fails the job instead of reporting success
1. One named volume can be mounted at several paths, host-mode PTY steps keep their last output when they fail, host scratch directories are removed when job setup fails
1. Cancelling a step right after it starts kills its whole process tree
1. Cache prefix restores pick the newest entry created within the same second, also on S3, cache commits with a wrong size are rejected
1. Artifact chunks are written at their offset, download URLs are escaped, listing a run without artifacts no longer crashes
1. Poll backoff reaches `fetch_interval_max`, proxy passwords are masked in more forms, secrets are also masked in step names and in their quoted form in the runner log, a failed final report is logged
1. On Windows hosts a differently cased unsecure-commands opt-in or proxy variable counts, and an early cancel no longer leaks a job object handle
1. Interactive `register` prompts for a missing token and stops on SIGTERM, `exec --list --detect-event` no longer panics without events, `config set` works on `cache.s3` keys

Reviewed-on: https://gitea.com/gitea/runner/pulls/1338
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

act/runner/step.go

@@ -170,25 +170,16 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			initialFiles = append([]*container.FileEntry{{Name: summaryFileCommand, Mode: 0o666}}, files...)
 			topRC.summaryFileInitialized[stepSummaryIndex] = true
 		}
-		if err := rc.JobContainer.Copy(actPath, initialFiles...)(ctx); err != nil && len(initialFiles) > len(files) {
-			_ = rc.JobContainer.Copy(actPath, files...)(ctx) // the summary goes first and the resets retry alone, so neither failure blocks the other
+		fileCommandInitErr := rc.JobContainer.Copy(actPath, initialFiles...)(ctx)
+		if fileCommandInitErr != nil && len(initialFiles) > len(files) {
+			fileCommandInitErr = rc.JobContainer.Copy(actPath, files...)(ctx) // a broken summary must not block the resets
 		}
 
-		// The command handler needs the step's env to judge ACTIONS_ALLOW_UNSECURE_COMMANDS.
-		// Cloned: the step executor keeps writing to its own env map after this point, on a
-		// different goroutine from the command handler that reads it.
-		rc.setCurrentStepEnv(maps0.Clone(*step.getEnv()))
-		defer rc.setCurrentStepEnv(nil)
-		_ = rc.takeUnsecureCommandError() // a refusal from before any step belongs to no step
-
-		timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, rc.ExprEval, stepModel)
+		timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, step)
 		defer cancelTimeOut()
-		err = executor(timeoutctx)
-		// Always take it, so the job-scoped error cannot leak onto a later step. A refusal
-		// fails the step as it does on GitHub, but the executor's own error wins.
-		insecureErr := rc.takeUnsecureCommandError()
+		err = fileCommandInitErr
 		if err == nil {
-			err = insecureErr
+			err = rc.runWithCommands(timeoutctx, *step.getEnv(), executor)
 		}
 		fileCommandCtx := ctx
 		if ctx.Err() != nil { // an interrupted step still records its file commands, a live deadline stays in force
@@ -196,17 +187,19 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 			fileCommandCtx, cancelFileCommands = context.WithTimeout(context.WithoutCancel(ctx), jobCleanupTimeout)
 			defer cancelFileCommands()
 		}
-		if fileErr := processRunnerEnvFileCommand(fileCommandCtx, envFileCommand, rc, rc.setEnvFile); fileErr != nil && err == nil {
-			err = fileErr
-		}
-		if fileErr := processRunnerEnvFileCommand(fileCommandCtx, stateFileCommand, rc, rc.saveState); fileErr != nil && err == nil {
-			err = fileErr
-		}
-		if fileErr := processRunnerEnvFileCommand(fileCommandCtx, outputFileCommand, rc, rc.setOutput); fileErr != nil && err == nil {
-			err = fileErr
-		}
-		if fileErr := rc.UpdateExtraPath(fileCommandCtx, path.Join(actPath, pathFileCommand)); fileErr != nil && err == nil {
-			err = fileErr
+		if fileCommandInitErr == nil {
+			if fileErr := processRunnerEnvFileCommand(fileCommandCtx, envFileCommand, rc, rc.setEnvFile); fileErr != nil && err == nil {
+				err = fileErr
+			}
+			if fileErr := processRunnerEnvFileCommand(fileCommandCtx, stateFileCommand, rc, rc.saveState); fileErr != nil && err == nil {
+				err = fileErr
+			}
+			if fileErr := processRunnerEnvFileCommand(fileCommandCtx, outputFileCommand, rc, rc.setOutput); fileErr != nil && err == nil {
+				err = fileErr
+			}
+			if fileErr := rc.UpdateExtraPath(fileCommandCtx, path.Join(actPath, pathFileCommand)); fileErr != nil && err == nil {
+				err = fileErr
+			}
 		}
 		_ = rc.JobContainer.Copy(actPath, files...)(fileCommandCtx)
 
@@ -239,8 +232,11 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 	}
 }
 
-func evaluateStepTimeout(ctx context.Context, exprEval *expressionEvaluator, stepModel *model.Step) (context.Context, context.CancelFunc) {
-	timeout, err := exprEval.Interpolate(ctx, stepModel.TimeoutMinutes)
+func evaluateStepTimeout(ctx context.Context, step step) (context.Context, context.CancelFunc) {
+	if step.getStepModel().TimeoutMinutes == "" {
+		return ctx, func() {}
+	}
+	timeout, err := step.getRunContext().NewStepExpressionEvaluator(ctx, step).Interpolate(ctx, step.getStepModel().TimeoutMinutes)
 	if err != nil {
 		common.Logger(ctx).Errorf("An error occurred when attempting to determine the step timeout: %s", err)
 	} else if timeout != "" {
@@ -262,9 +258,15 @@ func setupEnv(ctx context.Context, step step) error {
 	var err error
 	exprEval := rc.NewExpressionEvaluator(ctx)
 	stepEnv := step.getStepModel().Environment()
-	for k, v := range stepEnv {
-		if stepEnv[k], err = exprEval.Interpolate(ctx, v); err != nil {
-			return fmt.Errorf("unable to interpolate env %s: %w", k, err)
+	if envNode := step.getStepModel().Env; strings.Contains(envNode.Value, "${{") { // only a whole-map expression has a value
+		if err := model.DecodeEvaluated("step env", envNode, exprEval.shared(ctx).EvaluateYamlNode, &stepEnv); err != nil {
+			return err
+		}
+	} else {
+		for k, v := range stepEnv {
+			if stepEnv[k], err = exprEval.Interpolate(ctx, v); err != nil {
+				return fmt.Errorf("unable to interpolate env %s: %w", k, err)
+			}
 		}
 	}
 	// merge step env last, since it should not be overwritten