fix: align runner behaviours (#1338)

Contains a number of small bug fixes where jobs behaved differently from GitHub or failed silently.

1. Hooks fail on a refused `::set-env::` or `::add-path::` and no longer inherit the last step's identity
1. Docker build, exec and wait errors are returned instead of swallowed, token-only registry credentials work, logs of `--tty` services decode
1. Env files split lines like GitHub on each OS, so a carriage return is kept on Linux and CRLF ends a line on Windows, empty heredoc names or delimiters are rejected
1. Post steps run after their pre step even when main was skipped, composites see undeclared inputs, `runs.args` wins without `with.args` being parsed
1. Docker actions skip evaluating defaults of inputs given in `with` and read `entryPoint` and `args` in any case, a lowercase `dockerfile` is found, undeclared inputs get GitHub's warning
1. A user-set `CI` is kept, `GITHUB_REPOSITORY_ID` and the other missing `GITHUB_*` variables are exported
1. `timeout-minutes` can read the step's own `env`, a step-level `ACTIONS_ALLOW_UNSECURE_COMMANDS: false` beats a job-level `true` while the runner's own opt-in still wins, `pwsh` quotes the script path
1. A step `env:` given as one expression such as `${{ fromJSON(matrix.env) }}` is applied, `hashFiles` fails with GitHub's messages on script errors and after 120 seconds, a job image without node still gets an empty hash
1. A step whose command files cannot be reset fails instead of importing stale ones, a timeout between steps fails the job instead of reporting success
1. One named volume can be mounted at several paths, host-mode PTY steps keep their last output when they fail, host scratch directories are removed when job setup fails
1. Cancelling a step right after it starts kills its whole process tree
1. Cache prefix restores pick the newest entry created within the same second, also on S3, cache commits with a wrong size are rejected
1. Artifact chunks are written at their offset, download URLs are escaped, listing a run without artifacts no longer crashes
1. Poll backoff reaches `fetch_interval_max`, proxy passwords are masked in more forms, secrets are also masked in step names and in their quoted form in the runner log, a failed final report is logged
1. On Windows hosts a differently cased unsecure-commands opt-in or proxy variable counts, and an early cancel no longer leaks a job object handle
1. Interactive `register` prompts for a missing token and stops on SIGTERM, `exec --list --detect-event` no longer panics without events, `config set` works on `cache.s3` keys

Reviewed-on: https://gitea.com/gitea/runner/pulls/1338
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>

internal/app/run/proxy.go

@@ -111,15 +111,20 @@ func WarnIfDaemonHasNoProxy(ctx context.Context) {
 
 // proxyPasswords returns the passwords embedded in the runner's proxy URLs, to mask before
 // a job echoes its environment.
-func proxyPasswords() []string {
-	cfg := proxyFromEnv()
-	if cfg == nil {
-		return nil
+func proxyPasswords(envs map[string]string) []string {
+	cfg := httpproxy.FromEnvironment()
+	raws := []string{cfg.HTTPProxy, cfg.HTTPSProxy}
+	for name, value := range envs {
+		if strings.EqualFold(name, "http_proxy") || strings.EqualFold(name, "https_proxy") { // Windows reads env names in any case
+			raws = append(raws, value)
+		}
 	}
-
 	var passwords []string
-	for _, raw := range []string{cfg.HTTPProxy, cfg.HTTPSProxy} {
+	for _, raw := range raws {
 		parsed, err := url.Parse(raw)
+		if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+			parsed, err = url.Parse("http://" + raw)
+		}
 		if err != nil {
 			continue
 		}

internal/app/run/proxy_test.go

@@ -169,10 +169,19 @@ func TestProxyPasswords(t *testing.T) {
 	clearProxyEnv(t)
 	t.Setenv("http_proxy", "http://user:hunter2@proxy:3128")
 	t.Setenv("https_proxy", "http://user:s3cret@proxy:3128")
-	assert.Equal(t, []string{"hunter2", "s3cret"}, proxyPasswords())
+	assert.Equal(t, []string{"hunter2", "s3cret"}, proxyPasswords(nil))
+
+	t.Setenv("http_proxy", "user:hunter2@proxy:3128")
+	t.Setenv("https_proxy", "user:s3cret@proxy:3128")
+	assert.Equal(t, []string{"hunter2", "s3cret"}, proxyPasswords(nil))
 
 	t.Setenv("https_proxy", "http://proxy:3128")
-	assert.Equal(t, []string{"hunter2"}, proxyPasswords())
+	assert.Equal(t, []string{"hunter2"}, proxyPasswords(nil))
+
+	clearProxyEnv(t)
+	assert.Equal(t, []string{"configured"}, proxyPasswords(map[string]string{
+		"Http_Proxy": "http://user:configured@proxy:3128",
+	}))
 }
 
 func TestAppendNoProxy(t *testing.T) {

internal/app/run/runner.go

@@ -287,7 +287,7 @@ func (r *Runner) cleanupStaleDirs(ctx context.Context, root string, match func(n
 	}
 }
 
-func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) error {
+func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) (err error) {
 	if _, ok := r.runningTasks.LoadOrStore(task.Id, struct{}{}); ok {
 		return fmt.Errorf("task %d is already running", task.Id)
 	}
@@ -302,7 +302,7 @@ func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) error {
 	defer cancel()
 	ctx, endJob := telemetry.StartJob(ctx, task)
 	// A proxy URL may carry credentials, and every job is given it; keep them out of the log.
-	reporter := report.NewReporter(ctx, cancel, r.client, task, r.cfg, proxyPasswords()...)
+	reporter := report.NewReporter(ctx, cancel, r.client, task, r.cfg, proxyPasswords(r.envs)...)
 	var volumeCleanup []common.Executor
 	var volumeCleanupMu sync.Mutex
 	if r.cfg.Runner.PostTaskScript == "" {
@@ -318,7 +318,7 @@ func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) error {
 		if runErr != nil {
 			lastWords = runErr.Error()
 		}
-		_ = reporter.Close(lastWords)
+		err = reporter.Close(lastWords)
 		if err := cleanupJobVolumes(ctx, volumeCleanup); err != nil {
 			logging.Warnf("task %d volume cleanup after reporting: %v", task.Id, err)
 		}
@@ -584,7 +584,7 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		Env:                  envs,
 		ProxyEnv:             proxyEnv,
 		Secrets:              task.Secrets,
-		ExtraMasks:           append(proxyPasswords(), preset.Token),
+		ExtraMasks:           append(proxyPasswords(r.envs), preset.Token),
 		GitHubInstance:       strings.TrimSuffix(r.client.Address(), "/"),
 		NoSkipCheckout:       true,
 		DisableActEnv:        r.cfg.Runner.SetActEnv != nil && !*r.cfg.Runner.SetActEnv,

internal/app/run/runner_test.go

@@ -6,6 +6,7 @@ package run
 import (
 	"context"
 	"encoding/base64"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -187,6 +188,29 @@ func TestCleanupJobVolumesJoinsErrorsAfterCancellation(t *testing.T) {
 	require.ErrorIs(t, err, io.ErrClosedPipe)
 }
 
+func TestRunnerReturnsMaskedFinalReportingError(t *testing.T) {
+	cfg, err := config.LoadDefault("")
+	require.NoError(t, err)
+	cfg.Cache.Enabled = new(false)
+	cfg.Runner.ReportCloseTimeout = time.Millisecond
+	cli := clientmocks.NewClient(t)
+	cli.AddressValue = "https://gitea.example/"
+	reportErr := errors.New("reporting unavailable for hunter2")
+	cli.On("UpdateLog", mock.Anything, mock.Anything).Return(nil, reportErr)
+	cli.On("UpdateTask", mock.Anything, mock.Anything).Return(nil, reportErr)
+	r := NewRunner(cfg, &config.Registration{}, cli)
+
+	err = r.Run(t.Context(), &runnerv1.Task{
+		Context:         &structpb.Struct{},
+		WorkflowPayload: []byte("["),
+		Secrets:         map[string]string{"PASSWORD": "hunter2"},
+	})
+
+	require.ErrorContains(t, err, "reporting unavailable for ***")
+	assert.NotContains(t, err.Error(), "hunter2")
+	assert.Zero(t, r.RunningCount())
+}
+
 func TestNewRunnerInitializesLabelsAndEnvironment(t *testing.T) {
 	cacheEnabled := false
 	cfg := &config.Config{}