mirror of
https://gitea.com/gitea/runner.git
synced 2026-11-04 14:35:32 +00:00
v5.1.0
1870
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  
|
470969dc74 |
chore(deps): update actionslib to v1.4.1 (#1313)
actionslib v1.4.1 no longer logs through logrus, so the workflow model no longer needs the logrus bridge. The bridge stays for docker/cli and moby/go-archive, which still log through logrus's global logger; the comment now says so. actionslib now logs through slog's global logger, which the runner did not capture. A new slog bridge forwards it to the process-wide logger, so its messages keep the runner's level, format and secret masking. Assisted-by: Codet Co-authored-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1313 Reviewed-by: silverwind <[email protected]> Co-authored-by: Lunny Xiao <[email protected]>v5.1.0 |
||
|
silverwind
|
be7ddcd15a |
fix: give each docker proxy its own job label key (#1314)
A runner nested behind another runner's docker proxy, as in gitea.com CI, had its `com.gitea.runner.job` label overwritten by the outer proxy, so its job cleanup removed nothing. This failed `TestDockerProxyWithDaemon` depending on the CI host, for example on https://gitea.com/gitea/runner/pulls/1312. Each proxy now sets `com.gitea.runner.job.<job>` and cleans up by that key, so nested proxies keep each other's. This replaces the `com.gitea.runner.job=<job>` label. Reviewed-on: https://gitea.com/gitea/runner/pulls/1314 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
Lunny Xiaoandbircni
|
c3c647ef83 |
test: use t.Context() instead of context.Background() (#1306)
The test context is cancelled when the test ends, so anything still holding it stops instead of leaking into the next test. Uses inside `t.Cleanup`, `defer` and `go func` blocks are left alone, as the context is already cancelled there. Stacked on https://gitea.com/gitea/runner/pulls/1305. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1306 Reviewed-by: bircni <[email protected]> |
||
|
bircni
|
160e18e705 |
enhance: report the steps of a task as they run (#1293)
Gitea derives the steps of a job from the workflow file, so the `pre` and `post` steps of actions only show up inside "Set up job" and "Complete job", see https://github.com/go-gitea/gitea/issues/24604. The runner now also reports the steps as it runs them (https://gitea.com/gitea/actions-proto-def/pulls/19): "Set up job", a "Pre" and "Post" step for each action that has one, the workflow steps with their evaluated names, and "Complete job", as actions/runner shows them. The per-step state Gitea reads today is unchanged, and the job log only moves "Complete job name" and "Matrix:" ahead of the pre steps, so older Gitea versions keep showing everything as before. Job hooks and containers stay part of "Set up job" and "Complete job". The `replace` of `gitea.dev/actionslib` is swapped for the release once the proto change is merged. Reviewed-on: https://gitea.com/gitea/runner/pulls/1293 Reviewed-by: Zettat123 <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
silverwind
|
20c8b4abc4 |
refactor: replace go-git with the git CLI for gitignore filtering (#1309)
Replace go-git in `exec --use-gitignore` filtering with `git ls-files`. The git CLI is already required for action clones since https://gitea.com/gitea/runner/pulls/1277, so this drops `go-git` and 14 other modules, and filtering now follows git's own ignore rules. Also stop deleting a remote action's `.gitignore` before copying it. Tracked files are never filtered, so the deletion only made copied actions differ from GitHub's action tarballs. Reviewed-on: https://gitea.com/gitea/runner/pulls/1309 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
  Renovate Botandsilverwind
|
ccb9afd7a5 |
chore(deps): update dependencies (#1308)
This PR contains the following updates: | Package | Type | Update | Change | Pending | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) ([changelog](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020..949feb2413d6458794dcd2491c4babbbce0c15c1)) | action | digest | `8207627` → `949feb2` | | | | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | require | patch | `v5.19.2` → `v5.19.3` | |  |  | | [github.com/moby/moby/api](https://github.com/moby/moby) | require | patch | `v1.56.0` → `v1.56.1` | |  |  | | [github.com/moby/moby/client](https://github.com/moby/moby) | require | patch | `v0.6.0` → `v0.6.1` | `v0.6.2` |  |  | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go) | require | patch | `v1.11.0` → `v1.11.1` | |  |  | | [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) | require | minor | [`v0.23.0` → `v0.24.0`](https://cs.opensource.google/go/x/sync/+/refs/tags/v0.23.0...refs/tags/v0.24.0) | |  |  | | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | require | minor | [`v0.48.0` → `v0.49.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.48.0...refs/tags/v0.49.0) | |  |  | | [node](https://github.com/nodejs/node) | | digest | `0e0ff40` → `d6aa754` | | | | --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.19.3`](https://github.com/go-git/go-git/releases/tag/v5.19.3) [Compare Source](https://github.com/go-git/go-git/compare/v5.19.2...v5.19.3) #### What's Changed - \[v5] git: repository, Ensure commondir is closed. by [@​arcaven](https://github.com/arcaven) in [#​2285](https://github.com/go-git/go-git/pull/2285) - config: read repositoryformatversion in unmarshalCore by [@​c-tonneslan](https://github.com/c-tonneslan) in [#​2167](https://github.com/go-git/go-git/pull/2167) - build: Update module github.com/go-git/go-git/v5 to v5.19.2 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2304](https://github.com/go-git/go-git/pull/2304) - \[v5] plumbing: revlist, Skip path validation in the object walk by [@​r0h1tb](https://github.com/r0h1tb) in [#​2305](https://github.com/go-git/go-git/pull/2305) - build: Update module golang.org/x/crypto to v0.55.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2348](https://github.com/go-git/go-git/pull/2348) - \[v5] plumbing: transport/http, Contain credentials across redirects by [@​hiddeco](https://github.com/hiddeco) in [#​2358](https://github.com/go-git/go-git/pull/2358) - build: Fix workflows for Go 1.27 (v5) by [@​pjbgf](https://github.com/pjbgf) in [#​2364](https://github.com/go-git/go-git/pull/2364) - plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalformedPack in parallel by [@​akashchamp](https://github.com/akashchamp) in [#​2421](https://github.com/go-git/go-git/pull/2421) - build: Update module golang.org/x/crypto to v0.56.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2357](https://github.com/go-git/go-git/pull/2357) - plumbing: format/packfile, Break cyclic delta chains instead of recur… by [@​jgoosens](https://github.com/jgoosens) in [#​2340](https://github.com/go-git/go-git/pull/2340) - build: Drop Go 1.25 by [@​pjbgf](https://github.com/pjbgf) in [#​2451](https://github.com/go-git/go-git/pull/2451) - build: Update module github.com/go-git/go-billy/v5 to v5.9.2 (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2467](https://github.com/go-git/go-git/pull/2467) - build: Bump pjbgf/sha1cd to v0.7.0 by [@​pjbgf](https://github.com/pjbgf) in [#​2468](https://github.com/go-git/go-git/pull/2468) #### New Contributors - [@​arcaven](https://github.com/arcaven) made their first contribution in [#​2285](https://github.com/go-git/go-git/pull/2285) - [@​c-tonneslan](https://github.com/c-tonneslan) made their first contribution in [#​2167](https://github.com/go-git/go-git/pull/2167) - [@​r0h1tb](https://github.com/r0h1tb) made their first contribution in [#​2305](https://github.com/go-git/go-git/pull/2305) - [@​akashchamp](https://github.com/akashchamp) made their first contribution in [#​2421](https://github.com/go-git/go-git/pull/2421) - [@​jgoosens](https://github.com/jgoosens) made their first contribution in [#​2340](https://github.com/go-git/go-git/pull/2340) **Full Changelog**: <https://github.com/go-git/go-git/compare/v5.19.2...v5.19.3> </details> <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.6.1`](https://github.com/moby/moby/compare/v0.6.0...v0.6.1) [Compare Source](https://github.com/moby/moby/compare/v0.6.0...v0.6.1) </details> <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary> ### [`v1.47.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.47.0): /v0.69.0/v0.23.0/v0.1.0 [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.46.0...v1.47.0) This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules: - `go.opentelemetry.io/otel/log` - `go.opentelemetry.io/otel/sdk/log` See our [versioning policy](https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md) for more information about these stability guarantees. ##### Added - Add `String` method for `KeyValue` type in `go.opentelemetry.io/otel/attribute`. ([#​8205](https://github.com/open-telemetry/opentelemetry-go/issues/8205)) - Add `String` method for `Set` type in `go.opentelemetry.io/otel/attribute`. ([#​8347](https://github.com/open-telemetry/opentelemetry-go/issues/8347)) - Add `WithMaxExportBatchSize` to `go.opentelemetry.io/otel/sdk/metric` to configure the maximum export batch size for `PeriodicReader`. ([#​8960](https://github.com/open-telemetry/opentelemetry-go/issues/8960)) - Add `WithAttributeValueDepthLimit`, `DefaultAttributeValueDepthLimit`, and `SpanLimits.AttributeValueDepthLimit` in `go.opentelemetry.io/otel/sdk/trace` to configure the maximum depth of span, event, link, and instrumentation scope attribute values. ([#​8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938)) - Add `WithAttributeValueDepthLimit` in `go.opentelemetry.io/otel/sdk/log` to configure the maximum depth of log record and instrumentation scope attribute values. ([#​8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938)) - Add `WithMaxResponseSize` to `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8941](https://github.com/open-telemetry/opentelemetry-go/issues/8941)) - Add experimental `ProbabilitySampler` in `go.opentelemetry.io/otel/sdk/trace/x` that conforms to the [OpenTelemetry specification's threshold-based sampling algorithm](https://opentelemetry.io/docs/specs/otel/trace/sdk/#probabilitysampler). ([#​8123](https://github.com/open-telemetry/opentelemetry-go/issues/8123)) - Add experimental `*Binder` extension interfaces in `go.opentelemetry.io/otel/metric/x` for instruments that support binding attributes ahead of time. ([#​8760](https://github.com/open-telemetry/opentelemetry-go/issues/8760)) - Add the experimental `Finisher` synchronous metric instrument extension interface to `go.opentelemetry.io/otel/metric/x`. ([#​8906](https://github.com/open-telemetry/opentelemetry-go/issues/8906)) ##### Changed - Use the [OpenTelemetry Attribute Collection representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#attribute-collection-representation-for-non-otlp) for metric data diffs in `go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest`. ([#​8993](https://github.com/open-telemetry/opentelemetry-go/issues/8993)) - Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in `go.opentelemetry.io/otel/sdk/trace` and `go.opentelemetry.io/otel/sdk/log`. ([#​8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938)) - Reduce allocations when applying attribute value length limits in `go.opentelemetry.io/otel/sdk/trace` and `go.opentelemetry.io/otel/sdk/log` by rebuilding composite values only when truncation is needed. ([#​8912](https://github.com/open-telemetry/opentelemetry-go/issues/8912)) - Decode `traceparent` using a hex lookup table in `go.opentelemetry.io/otel/propagation`, which rejects the specification-disallowed upper-case characters without a separate scan of the header. ([#​8739](https://github.com/open-telemetry/opentelemetry-go/issues/8739)) - Decode all characters at constant indices in `TraceIDFromHex` and `SpanIDFromHex` in `go.opentelemetry.io/otel/trace` to eliminate bounds checks. ([#​8740](https://github.com/open-telemetry/opentelemetry-go/issues/8740)) ##### Fixed - Count valid U+FFFD replacement characters toward attribute value length limits in `go.opentelemetry.io/otel/trace`, `go.opentelemetry.io/otel/sdk/trace`, and `go.opentelemetry.io/otel/sdk/log`. - Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in `go.opentelemetry.io/otel/trace`, `go.opentelemetry.io/otel/sdk/trace`, and `go.opentelemetry.io/otel/sdk/log`. ([#​9054](https://github.com/open-telemetry/opentelemetry-go/issues/9054)) - Fix a data race in `NewPeriodicReader` where `r.inst` was assigned after the background goroutine was launched in `go.opentelemetry.io/otel/sdk/metric`. ([#​9028](https://github.com/open-telemetry/opentelemetry-go/issues/9028)) - Prevent precision loss for large `int64` values in `Sum`, `Histogram`, and `ExponentialHistogram` aggregations in `go.opentelemetry.io/otel/sdk/metric`. ([#​8981](https://github.com/open-telemetry/opentelemetry-go/issues/8981)) - Ensure `grpc.DialOption` values passed via `WithDialOption` take precedence over conflicting internally-computed defaults in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8805](https://github.com/open-telemetry/opentelemetry-go/issues/8805), [#​8834](https://github.com/open-telemetry/opentelemetry-go/issues/8834), [#​8836](https://github.com/open-telemetry/opentelemetry-go/issues/8836)) - Treat overflowing `OTEL_METRIC_EXPORT_INTERVAL` and `OTEL_METRIC_EXPORT_TIMEOUT` values as invalid in `go.opentelemetry.io/otel/sdk/metric`. ([#​8800](https://github.com/open-telemetry/opentelemetry-go/issues/8800)) - Prevent a panic in `NewFixedSizeReservoir` and `FixedSizeReservoirProvider` when given a negative size in `go.opentelemetry.io/otel/sdk/metric/exemplar`; negative sizes are now clamped to zero, consistent with a size of zero. ([#​8832](https://github.com/open-telemetry/opentelemetry-go/issues/8832)) - Preserve exponential histogram `ZeroThreshold` during OTLP metric export in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8801](https://github.com/open-telemetry/opentelemetry-go/issues/8801)) - Ensure metric helpers in `go.opentelemetry.io/otel/semconv/v1.32.0`, `go.opentelemetry.io/otel/semconv/v1.33.0`, and `go.opentelemetry.io/otel/semconv/v1.34.0` record measurements only once when no attributes are provided. ([#​8849](https://github.com/open-telemetry/opentelemetry-go/issues/8849)) - Treat empty `OTEL_TRACES_SAMPLER` and `OTEL_TRACES_SAMPLER_ARG` values as unset in `go.opentelemetry.io/otel/sdk/trace`. ([#​8873](https://github.com/open-telemetry/opentelemetry-go/issues/8873)) - Normalize global `OTEL_EXPORTER_OTLP_ENDPOINT` path joining in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` so trailing-slash base URLs do not produce double-slash log export paths. ([#​8864](https://github.com/open-telemetry/opentelemetry-go/issues/8864)) - Prevent a deadlock when formatting an error passed to `RecordError` calls back into the span in `go.opentelemetry.io/otel/sdk/trace`. ([#​8815](https://github.com/open-telemetry/opentelemetry-go/issues/8815)) - Prevent `SimpleSpanProcessor.Shutdown` from panicking when constructed with a nil exporter in `go.opentelemetry.io/otel/sdk/trace`. ([#​8844](https://github.com/open-telemetry/opentelemetry-go/issues/8844)) - Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in `go.opentelemetry.io/otel/exporters/prometheus`. ([#​8839](https://github.com/open-telemetry/opentelemetry-go/issues/8839)) - Retain instrument advisory attributes configured with `go.opentelemetry.io/otel/metric/x.WithDefaultAttributes` when a matching View in `go.opentelemetry.io/otel/sdk/metric` does not specify an attribute filter. ([#​8859](https://github.com/open-telemetry/opentelemetry-go/issues/8859)) - Ignore HTTP URL paths when building OTLP/gRPC metric exporter targets from `OTEL_EXPORTER_OTLP_ENDPOINT` and `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`, while preserving `unix://` and `unix-abstract://` targets; treat `unix-abstract://` endpoints as insecure in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` and `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8862](https://github.com/open-telemetry/opentelemetry-go/issues/8862)) - Ignore HTTP(S) paths when deriving gRPC trace exporter endpoints from `OTEL_EXPORTER_OTLP_ENDPOINT` and `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8852](https://github.com/open-telemetry/opentelemetry-go/issues/8852)) - Bound memory used while parsing dense W3C property metadata by storing it compactly and materializing `Property` values on demand in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. ##### Removed - Remove the experimental `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE` environment variable in `go.opentelemetry.io/otel/sdk/metric`. Use the `WithMaxExportBatchSize` option instead. ([#​8960](https://github.com/open-telemetry/opentelemetry-go/issues/8960)) ##### What's Changed - Prevent panic in FixedSizeReservoir for negative sizes by [@​chiliec](https://github.com/chiliec) in [#​8832](https://github.com/open-telemetry/opentelemetry-go/pull/8832) - fix(metric): reject overflowing export durations by [@​maithilijoshi20](https://github.com/maithilijoshi20) in [#​8800](https://github.com/open-telemetry/opentelemetry-go/pull/8800) - chore(deps): update module github.com/gofrs/flock to v0.13.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8885](https://github.com/open-telemetry/opentelemetry-go/pull/8885) - chore(deps): update module github.com/4meepo/tagalign to v1.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8900](https://github.com/open-telemetry/opentelemetry-go/pull/8900) - fix(deps): update googleapis to [`18b4a75`](https://github.com/open-telemetry/opentelemetry-go/commit/18b4a75) by [@​renovate](https://github.com/renovate)\[bot] in [#​8907](https://github.com/open-telemetry/opentelemetry-go/pull/8907) - fix(deps): update module github.com/prometheus/client\_model to v0.6.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8908](https://github.com/open-telemetry/opentelemetry-go/pull/8908) - chore(deps): update module github.com/prometheus/procfs to v0.22.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8894](https://github.com/open-telemetry/opentelemetry-go/pull/8894) - chore(deps): update module github.com/godoc-lint/godoc-lint to v0.11.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8897](https://github.com/open-telemetry/opentelemetry-go/pull/8897) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`d60c349`](https://github.com/open-telemetry/opentelemetry-go/commit/d60c349) by [@​renovate](https://github.com/renovate)\[bot] in [#​8909](https://github.com/open-telemetry/opentelemetry-go/pull/8909) - fix(deps): update module github.com/prometheus/common to v0.71.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8911](https://github.com/open-telemetry/opentelemetry-go/pull/8911) - chore(deps): update golang.org/x/telemetry digest to [`86cb573`](https://github.com/open-telemetry/opentelemetry-go/commit/86cb573) by [@​renovate](https://github.com/renovate)\[bot] in [#​8895](https://github.com/open-telemetry/opentelemetry-go/pull/8895) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`7bb06b0`](https://github.com/open-telemetry/opentelemetry-go/commit/7bb06b0) by [@​renovate](https://github.com/renovate)\[bot] in [#​8902](https://github.com/open-telemetry/opentelemetry-go/pull/8902) - chore(deps): update module github.com/timonwong/loggercheck to v0.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8898](https://github.com/open-telemetry/opentelemetry-go/pull/8898) - \[otlptracegrpc] Grpc dialoption override bug by [@​ps-mir](https://github.com/ps-mir) in [#​8805](https://github.com/open-telemetry/opentelemetry-go/pull/8805) - otlpmetricgrpc: fix preference for user supplied dialOptions by [@​ps-mir](https://github.com/ps-mir) in [#​8834](https://github.com/open-telemetry/opentelemetry-go/pull/8834) - Do not panic on nil exporter in SimpleSpanProcessor.Shutdown by [@​ShreeyashPatil2708](https://github.com/ShreeyashPatil2708) in [#​8844](https://github.com/open-telemetry/opentelemetry-go/pull/8844) - \[chore] Add doc comments to exported internal symbols (1/N) by [@​om7057](https://github.com/om7057) in [#​8752](https://github.com/open-telemetry/opentelemetry-go/pull/8752) - \[chore] Add doc comments to exported internal symbols (3/N) by [@​om7057](https://github.com/om7057) in [#​8869](https://github.com/open-telemetry/opentelemetry-go/pull/8869) - \[chore] docs: mark Logs as release candidate by [@​pellared](https://github.com/pellared) in [#​8910](https://github.com/open-telemetry/opentelemetry-go/pull/8910) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.29 by [@​renovate](https://github.com/renovate)\[bot] in [#​8917](https://github.com/open-telemetry/opentelemetry-go/pull/8917) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`af8eda3`](https://github.com/open-telemetry/opentelemetry-go/commit/af8eda3) by [@​renovate](https://github.com/renovate)\[bot] in [#​8915](https://github.com/open-telemetry/opentelemetry-go/pull/8915) - chore(deps): update github.com/golangci/rowserrcheck digest to [`241134d`](https://github.com/open-telemetry/opentelemetry-go/commit/241134d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8913](https://github.com/open-telemetry/opentelemetry-go/pull/8913) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.66.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8918](https://github.com/open-telemetry/opentelemetry-go/pull/8918) - chore(deps): update otel/weaver docker tag to v0.26.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8922](https://github.com/open-telemetry/opentelemetry-go/pull/8922) - chore(deps): update open-telemetry/shared-workflows action to v0.13.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8921](https://github.com/open-telemetry/opentelemetry-go/pull/8921) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`043ea8a`](https://github.com/open-telemetry/opentelemetry-go/commit/043ea8a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8919](https://github.com/open-telemetry/opentelemetry-go/pull/8919) - fix(otlploggrpc): honor custom dial option precedence by [@​jstar0](https://github.com/jstar0) in [#​8836](https://github.com/open-telemetry/opentelemetry-go/pull/8836) - Define bound instrument API in metric/x by [@​dashpole](https://github.com/dashpole) in [#​8760](https://github.com/open-telemetry/opentelemetry-go/pull/8760) - fix(prometheus): report invalid histogram scale errors by [@​jstar0](https://github.com/jstar0) in [#​8839](https://github.com/open-telemetry/opentelemetry-go/pull/8839) - Add experimental metric Finisher interface by [@​MrAlias](https://github.com/MrAlias) in [#​8906](https://github.com/open-telemetry/opentelemetry-go/pull/8906) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`ae99b73`](https://github.com/open-telemetry/opentelemetry-go/commit/ae99b73) by [@​renovate](https://github.com/renovate)\[bot] in [#​8923](https://github.com/open-telemetry/opentelemetry-go/pull/8923) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8920](https://github.com/open-telemetry/opentelemetry-go/pull/8920) - sdk/trace/x: Add experimental `ProbabilitySampler` by [@​yuanyuanzhao3](https://github.com/yuanyuanzhao3) in [#​8123](https://github.com/open-telemetry/opentelemetry-go/pull/8123) - sdk/trace/x: Adding GoDev badge. by [@​yuanyuanzhao3](https://github.com/yuanyuanzhao3) in [#​8927](https://github.com/open-telemetry/opentelemetry-go/pull/8927) - perf(propagation): use a hex lookup table to decode traceparent by [@​itssaharsh](https://github.com/itssaharsh) in [#​8739](https://github.com/open-telemetry/opentelemetry-go/pull/8739) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`0277a17`](https://github.com/open-telemetry/opentelemetry-go/commit/0277a17) by [@​renovate](https://github.com/renovate)\[bot] in [#​8931](https://github.com/open-telemetry/opentelemetry-go/pull/8931) - fix(deps): update googleapis to [`f8649dd`](https://github.com/open-telemetry/opentelemetry-go/commit/f8649dd) by [@​renovate](https://github.com/renovate)\[bot] in [#​8929](https://github.com/open-telemetry/opentelemetry-go/pull/8929) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8930](https://github.com/open-telemetry/opentelemetry-go/pull/8930) - \[chore] Add doc comments to exported internal symbols (5/N) by [@​om7057](https://github.com/om7057) in [#​8934](https://github.com/open-telemetry/opentelemetry-go/pull/8934) - \[chore] Add doc comments to exported internal symbols (4/N) by [@​om7057](https://github.com/om7057) in [#​8926](https://github.com/open-telemetry/opentelemetry-go/pull/8926) - sdk: optimize composite attribute truncation by [@​pellared](https://github.com/pellared) in [#​8912](https://github.com/open-telemetry/opentelemetry-go/pull/8912) - chore(deps): update module github.com/go-critic/go-critic to v0.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8924](https://github.com/open-telemetry/opentelemetry-go/pull/8924) - chore(deps): update module go.augendre.info/fatcontext to v0.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8939](https://github.com/open-telemetry/opentelemetry-go/pull/8939) - chore(deps): update module mvdan.cc/gofumpt to v0.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8935](https://github.com/open-telemetry/opentelemetry-go/pull/8935) - chore(deps): update module dev.gaijin.team/go/exhaustruct/v5 to v5.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8928](https://github.com/open-telemetry/opentelemetry-go/pull/8928) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8936](https://github.com/open-telemetry/opentelemetry-go/pull/8936) - chore(deps): update module github.com/ghostiam/protogetter to v1.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8940](https://github.com/open-telemetry/opentelemetry-go/pull/8940) - fix(trace): avoid reentrant RecordError deadlock by [@​jstar0](https://github.com/jstar0) in [#​8815](https://github.com/open-telemetry/opentelemetry-go/pull/8815) - \[chore] Add doc comments to exported internal symbols (6/6), remove exclusion by [@​om7057](https://github.com/om7057) in [#​8937](https://github.com/open-telemetry/opentelemetry-go/pull/8937) - otlploghttp: normalize global endpoint path joining by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8864](https://github.com/open-telemetry/opentelemetry-go/pull/8864) - sdk/trace: treat empty sampler env values as unset by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8873](https://github.com/open-telemetry/opentelemetry-go/pull/8873) - Run full benchmarks weekly by [@​XSAM](https://github.com/XSAM) in [#​8932](https://github.com/open-telemetry/opentelemetry-go/pull/8932) - fix(semconv): avoid duplicate metric recording without attributes by [@​jstar0](https://github.com/jstar0) in [#​8849](https://github.com/open-telemetry/opentelemetry-go/pull/8849) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.30 by [@​renovate](https://github.com/renovate)\[bot] in [#​8946](https://github.com/open-telemetry/opentelemetry-go/pull/8946) - chore(deps): update ubuntu:26.04 docker digest to [`e5a4d62`](https://github.com/open-telemetry/opentelemetry-go/commit/e5a4d62) by [@​renovate](https://github.com/renovate)\[bot] in [#​8945](https://github.com/open-telemetry/opentelemetry-go/pull/8945) - chore(deps): update github/codeql-action action to v4.38.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8944](https://github.com/open-telemetry/opentelemetry-go/pull/8944) - chore(deps): update golang.org/x/telemetry digest to [`55ac43c`](https://github.com/open-telemetry/opentelemetry-go/commit/55ac43c) by [@​renovate](https://github.com/renovate)\[bot] in [#​8943](https://github.com/open-telemetry/opentelemetry-go/pull/8943) - otlptracegrpc: fix env endpoint URL parsing by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8852](https://github.com/open-telemetry/opentelemetry-go/pull/8852) - otlpmetricgrpc: preserve gRPC env endpoint targets by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8862](https://github.com/open-telemetry/opentelemetry-go/pull/8862) - chore(deps): update module github.com/sourcegraph/go-diff to v0.9.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8947](https://github.com/open-telemetry/opentelemetry-go/pull/8947) - feat(otlphttp): configure maximum response size by [@​pellared](https://github.com/pellared) in [#​8941](https://github.com/open-telemetry/opentelemetry-go/pull/8941) - fix(otlpmetric): preserve exponential histogram zero threshold by [@​maithilijoshi20](https://github.com/maithilijoshi20) in [#​8801](https://github.com/open-telemetry/opentelemetry-go/pull/8801) - chore(deps): update golang.org/x/telemetry digest to [`15ceca2`](https://github.com/open-telemetry/opentelemetry-go/commit/15ceca2) by [@​renovate](https://github.com/renovate)\[bot] in [#​8948](https://github.com/open-telemetry/opentelemetry-go/pull/8948) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6c9e17d`](https://github.com/open-telemetry/opentelemetry-go/commit/6c9e17d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8950](https://github.com/open-telemetry/opentelemetry-go/pull/8950) - chore(deps): update module github.com/dave/dst to v0.28.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8949](https://github.com/open-telemetry/opentelemetry-go/pull/8949) - fix(deps): update googleapis to [`f61a6ca`](https://github.com/open-telemetry/opentelemetry-go/commit/f61a6ca) by [@​renovate](https://github.com/renovate)\[bot] in [#​8951](https://github.com/open-telemetry/opentelemetry-go/pull/8951) - chore(deps): update module github.com/nishanths/exhaustive to v0.13.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8953](https://github.com/open-telemetry/opentelemetry-go/pull/8953) - chore(deps): update module github.com/xo/terminfo to v1.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8954](https://github.com/open-telemetry/opentelemetry-go/pull/8954) - sdk/log: add queue\_full shutdown regression test by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8754](https://github.com/open-telemetry/opentelemetry-go/pull/8754) - internal/tools/verifyreadmes: skip hidden dot-directories on Windows by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8729](https://github.com/open-telemetry/opentelemetry-go/pull/8729) - sdk/metric: add internal finish-aware Sum lifecycle by [@​MrAlias](https://github.com/MrAlias) in [#​8925](https://github.com/open-telemetry/opentelemetry-go/pull/8925) - sdk: limit nested attribute value depth by [@​pellared](https://github.com/pellared) in [#​8938](https://github.com/open-telemetry/opentelemetry-go/pull/8938) - chore(deps): update codecov/codecov-action action to v7.1.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8966](https://github.com/open-telemetry/opentelemetry-go/pull/8966) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.67.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8965](https://github.com/open-telemetry/opentelemetry-go/pull/8965) - chore(deps): update open-telemetry/shared-workflows action to v0.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8961](https://github.com/open-telemetry/opentelemetry-go/pull/8961) - Fix Alex Kats emeritus mention by [@​dmathieu](https://github.com/dmathieu) in [#​8933](https://github.com/open-telemetry/opentelemetry-go/pull/8933) - sdk/metric: stabilize max batch size in PeriodicReader by [@​dashpole](https://github.com/dashpole) in [#​8960](https://github.com/open-telemetry/opentelemetry-go/pull/8960) - chore(deps): update ubuntu:26.04 docker digest to [`61ebaa5`](https://github.com/open-telemetry/opentelemetry-go/commit/61ebaa5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8968](https://github.com/open-telemetry/opentelemetry-go/pull/8968) - sdk/metric: Retain advisory attributes when View has no AttributeFilter by [@​dashpole](https://github.com/dashpole) in [#​8859](https://github.com/open-telemetry/opentelemetry-go/pull/8859) - chore(deps): update module github.com/ldez/tagliatelle to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8970](https://github.com/open-telemetry/opentelemetry-go/pull/8970) - sdk/metric: Document nil AttributeFilter behavior by [@​pellared](https://github.com/pellared) in [#​8971](https://github.com/open-telemetry/opentelemetry-go/pull/8971) - chore: fix gofumpt extra-rules warning by [@​dmathieu](https://github.com/dmathieu) in [#​8942](https://github.com/open-telemetry/opentelemetry-go/pull/8942) - chore(deps): update codecov/codecov-action action to v7.1.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8975](https://github.com/open-telemetry/opentelemetry-go/pull/8975) - chore(deps): update module github.com/ldez/gomoddirectives to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8974](https://github.com/open-telemetry/opentelemetry-go/pull/8974) - sdk/trace/x: deduplicate tracestate combination error report in ProbabilitySampler by [@​alex131125](https://github.com/alex131125) in [#​8969](https://github.com/open-telemetry/opentelemetry-go/pull/8969) - \[chore]: fix article and word typos in doc comments by [@​simpleqt](https://github.com/simpleqt) in [#​8972](https://github.com/open-telemetry/opentelemetry-go/pull/8972) - \[chore]: fix two doc comments that name the wrong method by [@​simpleqt](https://github.com/simpleqt) in [#​8973](https://github.com/open-telemetry/opentelemetry-go/pull/8973) - Update googleapis to [`eeb232e`](https://github.com/open-telemetry/opentelemetry-go/commit/eeb232e) by [@​renovate](https://github.com/renovate)\[bot] in [#​8983](https://github.com/open-telemetry/opentelemetry-go/pull/8983) - sdk/metric: extract generic hotColdMap for delta aggregators by [@​dashpole](https://github.com/dashpole) in [#​8756](https://github.com/open-telemetry/opentelemetry-go/pull/8756) - Update github/codeql-action action to v4.38.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8987](https://github.com/open-telemetry/opentelemetry-go/pull/8987) - Update googleapis to [`cecb647`](https://github.com/open-telemetry/opentelemetry-go/commit/cecb647) by [@​renovate](https://github.com/renovate)\[bot] in [#​8986](https://github.com/open-telemetry/opentelemetry-go/pull/8986) - \[chore]: remove CLAUDE.md in favor of AGENTS.md by [@​jarrensj](https://github.com/jarrensj) in [#​8988](https://github.com/open-telemetry/opentelemetry-go/pull/8988) - test(internal/tools/verifyreadmes): add unit tests for verifyReadme by [@​marcschaeferger](https://github.com/marcschaeferger) in [#​8066](https://github.com/open-telemetry/opentelemetry-go/pull/8066) - perf(trace): unroll hex decoders to drop bounds checks by [@​itssaharsh](https://github.com/itssaharsh) in [#​8740](https://github.com/open-telemetry/opentelemetry-go/pull/8740) - sdk/metric: add canonical attribute identity by [@​MrAlias](https://github.com/MrAlias) in [#​8963](https://github.com/open-telemetry/opentelemetry-go/pull/8963) - attribute: add Set.String by [@​iyiola-dev](https://github.com/iyiola-dev) in [#​8347](https://github.com/open-telemetry/opentelemetry-go/pull/8347) - attribute: add String method for KeyValue by [@​pellared](https://github.com/pellared) in [#​8205](https://github.com/open-telemetry/opentelemetry-go/pull/8205) - Update open-telemetry/shared-workflows action to v0.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8992](https://github.com/open-telemetry/opentelemetry-go/pull/8992) - Update googleapis to [`b142276`](https://github.com/open-telemetry/opentelemetry-go/commit/b142276) by [@​renovate](https://github.com/renovate)\[bot] in [#​8991](https://github.com/open-telemetry/opentelemetry-go/pull/8991) - Update golang.org/x/telemetry digest to [`bdcd072`](https://github.com/open-telemetry/opentelemetry-go/commit/bdcd072) by [@​renovate](https://github.com/renovate)\[bot] in [#​8990](https://github.com/open-telemetry/opentelemetry-go/pull/8990) - Update module google.golang.org/grpc to v1.84.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8982](https://github.com/open-telemetry/opentelemetry-go/pull/8982) - Update open-telemetry/shared-workflows action to v0.16.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8995](https://github.com/open-telemetry/opentelemetry-go/pull/8995) - Update github.com/opentracing-contrib/go-grpc/test digest to [`c4b3818`](https://github.com/open-telemetry/opentelemetry-go/commit/c4b3818) by [@​renovate](https://github.com/renovate)\[bot] in [#​8994](https://github.com/open-telemetry/opentelemetry-go/pull/8994) - Revert "Update module google.golang.org/grpc to v1.84.0 ([#​8982](https://github.com/open-telemetry/opentelemetry-go/issues/8982))" by [@​dashpole](https://github.com/dashpole) in [#​8997](https://github.com/open-telemetry/opentelemetry-go/pull/8997) - metricdatatest: use attribute collection formatting by [@​pellared](https://github.com/pellared) in [#​8993](https://github.com/open-telemetry/opentelemetry-go/pull/8993) - Update github.com/charmbracelet/ultraviolet digest to [`4e49372`](https://github.com/open-telemetry/opentelemetry-go/commit/4e49372) by [@​renovate](https://github.com/renovate)\[bot] in [#​8998](https://github.com/open-telemetry/opentelemetry-go/pull/8998) - fix(sdk/metric): preserve int64 precision in sum and histogram aggregations by [@​dashpole](https://github.com/dashpole) in [#​8981](https://github.com/open-telemetry/opentelemetry-go/pull/8981) - Update golang.org/x/telemetry digest to [`c6096d2`](https://github.com/open-telemetry/opentelemetry-go/commit/c6096d2) by [@​renovate](https://github.com/renovate)\[bot] in [#​9000](https://github.com/open-telemetry/opentelemetry-go/pull/9000) - Fix OSS-Fuzz issues in FuzzHashKVs, FuzzGetBin, and FuzzSpanIDFromHex by [@​dashpole](https://github.com/dashpole) in [#​8996](https://github.com/open-telemetry/opentelemetry-go/pull/8996) - Update github.com/timakin/bodyclose digest to [`98ded9a`](https://github.com/open-telemetry/opentelemetry-go/commit/98ded9a) by [@​renovate](https://github.com/renovate)\[bot] in [#​9003](https://github.com/open-telemetry/opentelemetry-go/pull/9003) - Update module github.com/ProtonMail/go-crypto to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9004](https://github.com/open-telemetry/opentelemetry-go/pull/9004) - Update module github.com/ProtonMail/go-crypto to v1.5.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​9021](https://github.com/open-telemetry/opentelemetry-go/pull/9021) - Update golang.org/x/telemetry digest to [`9662f6f`](https://github.com/open-telemetry/opentelemetry-go/commit/9662f6f) by [@​renovate](https://github.com/renovate)\[bot] in [#​9020](https://github.com/open-telemetry/opentelemetry-go/pull/9020) - Update module github.com/mgechev/revive to v1.17.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9022](https://github.com/open-telemetry/opentelemetry-go/pull/9022) - Add ps-mir as an approver by [@​MrAlias](https://github.com/MrAlias) in [#​9018](https://github.com/open-telemetry/opentelemetry-go/pull/9018) - Add Marc Schäfer as a project Triager by [@​MrAlias](https://github.com/MrAlias) in [#​9019](https://github.com/open-telemetry/opentelemetry-go/pull/9019) - Update golang.org/x/telemetry digest to [`ed294f9`](https://github.com/open-telemetry/opentelemetry-go/commit/ed294f9) by [@​renovate](https://github.com/renovate)\[bot] in [#​9027](https://github.com/open-telemetry/opentelemetry-go/pull/9027) - Update github/codeql-action action to v4.38.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​9025](https://github.com/open-telemetry/opentelemetry-go/pull/9025) - Update module github.com/golangci/golangci-lint/v2 to v2.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9026](https://github.com/open-telemetry/opentelemetry-go/pull/9026) - Update github.com/charmbracelet/ultraviolet digest to [`b78653f`](https://github.com/open-telemetry/opentelemetry-go/commit/b78653f) by [@​renovate](https://github.com/renovate)\[bot] in [#​9036](https://github.com/open-telemetry/opentelemetry-go/pull/9036) - Update github.com/charmbracelet/ultraviolet digest to [`bbf040a`](https://github.com/open-telemetry/opentelemetry-go/commit/bbf040a) by [@​renovate](https://github.com/renovate)\[bot] in [#​9037](https://github.com/open-telemetry/opentelemetry-go/pull/9037) - Update module github.com/golangci/golines to v0.16.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9043](https://github.com/open-telemetry/opentelemetry-go/pull/9043) - Update module github.com/prometheus/common to v0.72.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9044](https://github.com/open-telemetry/opentelemetry-go/pull/9044) - Update module go.opentelemetry.io/collector/pdata to v1.68.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9046](https://github.com/open-telemetry/opentelemetry-go/pull/9046) - Update module github.com/uudashr/iface to v1.5.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​9042](https://github.com/open-telemetry/opentelemetry-go/pull/9042) - Update module github.com/ProtonMail/go-crypto to v1.5.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​9040](https://github.com/open-telemetry/opentelemetry-go/pull/9040) - Update open-telemetry/shared-workflows action to v0.17.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9047](https://github.com/open-telemetry/opentelemetry-go/pull/9047) - Update github.com/golangci/canonicalheader digest to [`e18e5c5`](https://github.com/open-telemetry/opentelemetry-go/commit/e18e5c5) by [@​renovate](https://github.com/renovate)\[bot] in [#​9039](https://github.com/open-telemetry/opentelemetry-go/pull/9039) - Update googleapis to [`8a89bd6`](https://github.com/open-telemetry/opentelemetry-go/commit/8a89bd6) by [@​renovate](https://github.com/renovate)\[bot] in [#​9041](https://github.com/open-telemetry/opentelemetry-go/pull/9041) - Update github.com/charmbracelet/ultraviolet digest to [`666ce5e`](https://github.com/open-telemetry/opentelemetry-go/commit/666ce5e) by [@​renovate](https://github.com/renovate)\[bot] in [#​9051](https://github.com/open-telemetry/opentelemetry-go/pull/9051) - Remove retired Go Report Card badge from README by [@​kijimad](https://github.com/kijimad) in [#​9050](https://github.com/open-telemetry/opentelemetry-go/pull/9050) - fix(sdk/metric): Fix data race with initialization of NewPeriodicReader by [@​CTrando](https://github.com/CTrando) in [#​9028](https://github.com/open-telemetry/opentelemetry-go/pull/9028) - Update module github.com/dlclark/regexp2/v2 to v2.8.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​9061](https://github.com/open-telemetry/opentelemetry-go/pull/9061) - Update github.com/charmbracelet/ultraviolet digest to [`270558f`](https://github.com/open-telemetry/opentelemetry-go/commit/270558f) by [@​renovate](https://github.com/renovate)\[bot] in [#​9060](https://github.com/open-telemetry/opentelemetry-go/pull/9060) - chore: Replace deprecated gofumpt extra-rules with extra options by [@​kijimad](https://github.com/kijimad) in [#​9062](https://github.com/open-telemetry/opentelemetry-go/pull/9062) - Update module github.com/pjbgf/sha1cd to v0.7.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9064](https://github.com/open-telemetry/opentelemetry-go/pull/9064) - Update github.com/golangci/rowserrcheck digest to [`f772fe6`](https://github.com/open-telemetry/opentelemetry-go/commit/f772fe6) by [@​renovate](https://github.com/renovate)\[bot] in [#​9066](https://github.com/open-telemetry/opentelemetry-go/pull/9066) - Update github.com/charmbracelet/ultraviolet digest to [`8786532`](https://github.com/open-telemetry/opentelemetry-go/commit/8786532) by [@​renovate](https://github.com/renovate)\[bot] in [#​9065](https://github.com/open-telemetry/opentelemetry-go/pull/9065) - Fix zero attribute value length for malformed UTF-8 by [@​pellared](https://github.com/pellared) in [#​9054](https://github.com/open-telemetry/opentelemetry-go/pull/9054) - Update module github.com/uudashr/iface to v1.5.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​9067](https://github.com/open-telemetry/opentelemetry-go/pull/9067) - Update ubuntu:26.04 Docker digest to [`88a381d`](https://github.com/open-telemetry/opentelemetry-go/commit/88a381d) by [@​renovate](https://github.com/renovate)\[bot] in [#​9069](https://github.com/open-telemetry/opentelemetry-go/pull/9069) - Release 1.47.0/0.69.0/0.23.0/0.1.0 by [@​pellared](https://github.com/pellared) in [#​9024](https://github.com/open-telemetry/opentelemetry-go/pull/9024) ##### New Contributors - [@​chiliec](https://github.com/chiliec) made their first contribution in [#​8832](https://github.com/open-telemetry/opentelemetry-go/pull/8832) - [@​maithilijoshi20](https://github.com/maithilijoshi20) made their first contribution in [#​8800](https://github.com/open-telemetry/opentelemetry-go/pull/8800) - [@​ps-mir](https://github.com/ps-mir) made their first contribution in [#​8805](https://github.com/open-telemetry/opentelemetry-go/pull/8805) - [@​ShreeyashPatil2708](https://github.com/ShreeyashPatil2708) made their first contribution in [#​8844](https://github.com/open-telemetry/opentelemetry-go/pull/8844) - [@​alex131125](https://github.com/alex131125) made their first contribution in [#​8969](https://github.com/open-telemetry/opentelemetry-go/pull/8969) - [@​simpleqt](https://github.com/simpleqt) made their first contribution in [#​8972](https://github.com/open-telemetry/opentelemetry-go/pull/8972) - [@​jarrensj](https://github.com/jarrensj) made their first contribution in [#​8988](https://github.com/open-telemetry/opentelemetry-go/pull/8988) - [@​iyiola-dev](https://github.com/iyiola-dev) made their first contribution in [#​8347](https://github.com/open-telemetry/opentelemetry-go/pull/8347) - [@​kijimad](https://github.com/kijimad) made their first contribution in [#​9050](https://github.com/open-telemetry/opentelemetry-go/pull/9050) - [@​CTrando](https://github.com/CTrando) made their first contribution in [#​9028](https://github.com/open-telemetry/opentelemetry-go/pull/9028) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.47.0-rc.1...v1.47.0> </details> <details> <summary>open-telemetry/opentelemetry-proto-go (go.opentelemetry.io/proto/otlp)</summary> ### [`v1.11.1`](https://github.com/open-telemetry/opentelemetry-proto-go/releases/tag/v1.11.1): /v0.4.1 [Compare Source](https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.11.0...v1.11.1) Generated Go code for the [`v1.11.1`][otlp] version of the OTLP. [otlp]: https://github.com/open-telemetry/opentelemetry-proto/releases/tag/v1.11.1 #### What's Changed - chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​664](https://github.com/open-telemetry/opentelemetry-proto-go/pull/664) - chore(deps): update ossf/scorecard-action action to v2.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​663](https://github.com/open-telemetry/opentelemetry-proto-go/pull/663) - chore(deps): update googleapis to [`3fe39f3`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/3fe39f3) by [@​renovate](https://github.com/renovate)\[bot] in [#​662](https://github.com/open-telemetry/opentelemetry-proto-go/pull/662) - chore(deps): update googleapis to [`b2f2020`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/b2f2020) by [@​renovate](https://github.com/renovate)\[bot] in [#​665](https://github.com/open-telemetry/opentelemetry-proto-go/pull/665) - chore(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​666](https://github.com/open-telemetry/opentelemetry-proto-go/pull/666) - chore(deps): update googleapis to [`6c54ddd`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/6c54ddd) by [@​renovate](https://github.com/renovate)\[bot] in [#​667](https://github.com/open-telemetry/opentelemetry-proto-go/pull/667) - chore(deps): update google.golang.org/genproto/googleapis/api digest to [`8efbd57`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8efbd57) by [@​renovate](https://github.com/renovate)\[bot] in [#​670](https://github.com/open-telemetry/opentelemetry-proto-go/pull/670) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​669](https://github.com/open-telemetry/opentelemetry-proto-go/pull/669) - chore(deps): update google.golang.org/genproto/googleapis/rpc digest to [`8efbd57`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8efbd57) by [@​renovate](https://github.com/renovate)\[bot] in [#​671](https://github.com/open-telemetry/opentelemetry-proto-go/pull/671) - chore(deps): update github/codeql-action action to v4.37.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​673](https://github.com/open-telemetry/opentelemetry-proto-go/pull/673) - fix(deps): update module google.golang.org/grpc to v1.83.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​672](https://github.com/open-telemetry/opentelemetry-proto-go/pull/672) - chore: Change Renovate configuration to best practices by [@​thompson-tomo](https://github.com/thompson-tomo) in [#​674](https://github.com/open-telemetry/opentelemetry-proto-go/pull/674) - chore(deps): pin dependencies by [@​renovate](https://github.com/renovate)\[bot] in [#​677](https://github.com/open-telemetry/opentelemetry-proto-go/pull/677) - chore(deps): update github/codeql-action action to v4.37.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​676](https://github.com/open-telemetry/opentelemetry-proto-go/pull/676) - chore(deps): update googleapis to [`6ac0973`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/6ac0973) by [@​renovate](https://github.com/renovate)\[bot] in [#​678](https://github.com/open-telemetry/opentelemetry-proto-go/pull/678) - chore(deps): update github/codeql-action action to v4.37.6 by [@​renovate](https://github.com/renovate)\[bot] in [#​679](https://github.com/open-telemetry/opentelemetry-proto-go/pull/679) - ci: add shared security scanning workflow by [@​opentelemetrybot](https://github.com/opentelemetrybot) in [#​675](https://github.com/open-telemetry/opentelemetry-proto-go/pull/675) - chore(deps): update open-telemetry/shared-workflows action to v0.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​682](https://github.com/open-telemetry/opentelemetry-proto-go/pull/682) - chore(deps): update module github.com/cloudflare/circl to v1.6.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​681](https://github.com/open-telemetry/opentelemetry-proto-go/pull/681) - fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​680](https://github.com/open-telemetry/opentelemetry-proto-go/pull/680) - chore(deps): update googleapis to [`c8921c7`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/c8921c7) by [@​renovate](https://github.com/renovate)\[bot] in [#​684](https://github.com/open-telemetry/opentelemetry-proto-go/pull/684) - chore(deps): update open-telemetry/shared-workflows action to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​683](https://github.com/open-telemetry/opentelemetry-proto-go/pull/683) - chore(deps): update googleapis to [`ec0a776`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/ec0a776) by [@​renovate](https://github.com/renovate)\[bot] in [#​685](https://github.com/open-telemetry/opentelemetry-proto-go/pull/685) - fix(deps): update module google.golang.org/protobuf to v1.36.12 by [@​renovate](https://github.com/renovate)\[bot] in [#​686](https://github.com/open-telemetry/opentelemetry-proto-go/pull/686) - chore(deps): update module golang.org/x/mod to v0.39.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​687](https://github.com/open-telemetry/opentelemetry-proto-go/pull/687) - ci: use shared OSSF Scorecard workflow by [@​opentelemetrybot](https://github.com/opentelemetrybot) in [#​688](https://github.com/open-telemetry/opentelemetry-proto-go/pull/688) - chore(deps): update all golang.org/x packages by [@​renovate](https://github.com/renovate)\[bot] in [#​689](https://github.com/open-telemetry/opentelemetry-proto-go/pull/689) - chore(deps): update otel/build-protobuf docker tag to v0.26.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​668](https://github.com/open-telemetry/opentelemetry-proto-go/pull/668) - chore(deps): update module golang.org/x/mod to v0.40.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​690](https://github.com/open-telemetry/opentelemetry-proto-go/pull/690) - chore(deps): update open-telemetry/shared-workflows action to v0.7.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​691](https://github.com/open-telemetry/opentelemetry-proto-go/pull/691) - chore(deps): update googleapis to [`ac3dfec`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/ac3dfec) by [@​renovate](https://github.com/renovate)\[bot] in [#​692](https://github.com/open-telemetry/opentelemetry-proto-go/pull/692) - chore(deps): update googleapis to [`1b09341`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/1b09341) by [@​renovate](https://github.com/renovate)\[bot] in [#​693](https://github.com/open-telemetry/opentelemetry-proto-go/pull/693) - fix(deps): update module google.golang.org/grpc to v1.83.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​694](https://github.com/open-telemetry/opentelemetry-proto-go/pull/694) - chore(deps): update googleapis to [`08b0e42`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/08b0e42) by [@​renovate](https://github.com/renovate)\[bot] in [#​695](https://github.com/open-telemetry/opentelemetry-proto-go/pull/695) - chore(deps): update open-telemetry/shared-workflows action to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​696](https://github.com/open-telemetry/opentelemetry-proto-go/pull/696) - chore(deps): update open-telemetry/shared-workflows action to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​697](https://github.com/open-telemetry/opentelemetry-proto-go/pull/697) - chore(deps): update open-telemetry/shared-workflows action to v0.11.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​698](https://github.com/open-telemetry/opentelemetry-proto-go/pull/698) - chore(deps): update googleapis to [`da73d73`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/da73d73) by [@​renovate](https://github.com/renovate)\[bot] in [#​700](https://github.com/open-telemetry/opentelemetry-proto-go/pull/700) - fix(deps): update module google.golang.org/grpc to v1.83.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​699](https://github.com/open-telemetry/opentelemetry-proto-go/pull/699) - chore(deps): update module github.com/skeema/knownhosts to v1.3.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​702](https://github.com/open-telemetry/opentelemetry-proto-go/pull/702) - chore(deps): update open-telemetry/shared-workflows action to v0.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​701](https://github.com/open-telemetry/opentelemetry-proto-go/pull/701) - chore(deps): update googleapis to [`18b4a75`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/18b4a75) by [@​renovate](https://github.com/renovate)\[bot] in [#​703](https://github.com/open-telemetry/opentelemetry-proto-go/pull/703) - chore(deps): update open-telemetry/shared-workflows action to v0.13.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​704](https://github.com/open-telemetry/opentelemetry-proto-go/pull/704) - chore(deps): update googleapis to [`f8649dd`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/f8649dd) by [@​renovate](https://github.com/renovate)\[bot] in [#​706](https://github.com/open-telemetry/opentelemetry-proto-go/pull/706) - chore(deps): update googleapis to [`f61a6ca`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/f61a6ca) by [@​renovate](https://github.com/renovate)\[bot] in [#​708](https://github.com/open-telemetry/opentelemetry-proto-go/pull/708) - Make slim OTLP descriptors coexist with canonical OTLP by [@​pellared](https://github.com/pellared) in [#​707](https://github.com/open-telemetry/opentelemetry-proto-go/pull/707) - chore(deps): update open-telemetry/shared-workflows action to v0.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​710](https://github.com/open-telemetry/opentelemetry-proto-go/pull/710) - Drop support for Go 1.25 by [@​pellared](https://github.com/pellared) in [#​711](https://github.com/open-telemetry/opentelemetry-proto-go/pull/711) - chore(deps): update all golang.org/x packages by [@​renovate](https://github.com/renovate)\[bot] in [#​709](https://github.com/open-telemetry/opentelemetry-proto-go/pull/709) - chore(deps): update googleapis to [`eeb232e`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/eeb232e) by [@​renovate](https://github.com/renovate)\[bot] in [#​713](https://github.com/open-telemetry/opentelemetry-proto-go/pull/713) - fix(deps): update module google.golang.org/grpc to v1.84.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​712](https://github.com/open-telemetry/opentelemetry-proto-go/pull/712) - chore(deps): update googleapis to [`cecb647`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/cecb647) by [@​renovate](https://github.com/renovate)\[bot] in [#​714](https://github.com/open-telemetry/opentelemetry-proto-go/pull/714) - chore(deps): update googleapis to [`b142276`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/b142276) by [@​renovate](https://github.com/renovate)\[bot] in [#​715](https://github.com/open-telemetry/opentelemetry-proto-go/pull/715) - chore(deps): update open-telemetry/shared-workflows action to v0.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​716](https://github.com/open-telemetry/opentelemetry-proto-go/pull/716) - chore(deps): update open-telemetry/shared-workflows action to v0.16.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​717](https://github.com/open-telemetry/opentelemetry-proto-go/pull/717) - chore(deps): update module github.com/protonmail/go-crypto to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​718](https://github.com/open-telemetry/opentelemetry-proto-go/pull/718) - chore(deps): update module github.com/protonmail/go-crypto to v1.5.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​719](https://github.com/open-telemetry/opentelemetry-proto-go/pull/719) - fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.31.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​720](https://github.com/open-telemetry/opentelemetry-proto-go/pull/720) - chore(deps): update googleapis to [`8a89bd6`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8a89bd6) by [@​renovate](https://github.com/renovate)\[bot] in [#​723](https://github.com/open-telemetry/opentelemetry-proto-go/pull/723) - chore(deps): update open-telemetry/shared-workflows action to v0.17.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​722](https://github.com/open-telemetry/opentelemetry-proto-go/pull/722) - chore(deps): update module github.com/protonmail/go-crypto to v1.5.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​721](https://github.com/open-telemetry/opentelemetry-proto-go/pull/721) - Release v1.11.1 by [@​pellared](https://github.com/pellared) in [#​724](https://github.com/open-telemetry/opentelemetry-proto-go/pull/724) #### New Contributors - [@​thompson-tomo](https://github.com/thompson-tomo) made their first contribution in [#​674](https://github.com/open-telemetry/opentelemetry-proto-go/pull/674) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.11.0...v1.11.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1308 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Lunny Xiaoandbircni
|
49e34813ae |
docs: describe the logging package (#1305)
Drop the logrus references from the docs and the config example, and add a Logging section to `DEVELOPMENT.md` on how to log and test logging. Stacked on https://gitea.com/gitea/runner/pulls/1304. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1305 Reviewed-by: bircni <[email protected]> |
||
|
Lunny Xiaoandbircni
|
e0ef637805 |
refactor(logging): replace the logrus backend with log/slog (#1304)
Log through `log/slog`, with a console `slog.Handler` that writes the text the runner has always written (sorted `key=value` fields on a plain stream, a colored prefix on a terminal), so nothing changes for users. I compared its output byte for byte with logrus's `TextFormatter` over plain, colored, timestamped and caller cases. Why not `slog.TextHandler`: its output differs from what users and their log parsers see today, and `ReplaceAttr` cannot close the gap. - level is `WARN` where logrus wrote `warning`, and time has milliseconds and no quotes - fields keep call order instead of being sorted - the caller is one `source=` key, where the runner writes `func=` and `file=` (reshaped by `callPrettyfier`), and `ReplaceAttr` returns a single attribute - no colored prefix on a terminal - no hook to rewrite a whole formatted line, which the process-wide secret masking relies on Libraries that log through logrus's global logger (the workflow model, the Docker client) are forwarded to the process-wide logger, so they keep following its level, format and secret masking. This is why logrus stays in `go.mod`. Stacked on https://gitea.com/gitea/runner/pulls/1303. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1304 Reviewed-by: bircni <[email protected]> |
||
|
Lunny Xiaoandbircni
|
8502663d0e |
chore(lint): forbid importing logrus outside the logging package (#1303)
Add a `depguard` rule so everything logs through `act/common/logging`, which keeps the backend swappable. Stacked on https://gitea.com/gitea/runner/pulls/1302. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1303 Reviewed-by: Zettat123 <[email protected]> |
||
|
Lunny Xiaoandbircni
|
4e8037a93b |
refactor(logging): use the logging package in internal (#1302)
Move the log calls in `internal` onto `logging`, and add what the process-wide logger setup and its tests need: `SetTextFormat` with a line filter for secret masking (replacing `report.MaskingFormatter`), `SetReportCaller`, `SetDefault` and `logtest.SetDefault`. After this only the `logging` package imports logrus. Stacked on https://gitea.com/gitea/runner/pulls/1301. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1302 Reviewed-by: bircni <[email protected]> |
||
|
Lunny Xiaoandbircni
|
76110557ab |
refactor(logging): use the logging package for the remaining act log calls (#1301)
Move the global logrus calls left in `act` onto `logging`, and add `SetOutput` and `Output` for tests that capture the process logger. Behavior is unchanged. Stacked on https://gitea.com/gitea/runner/pulls/1300. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1301 Reviewed-by: bircni <[email protected]> |
||
|
Lunny Xiaoandbircni
|
3bc5cc03f8 |
test(logging): add logtest.NewLogger (#1300)
Return a `Logger` and its recording `Handler` together, so tests no longer need the two-line setup. Stacked on https://gitea.com/gitea/runner/pulls/1295. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1300 Reviewed-by: bircni <[email protected]> |
||
|
Lunny Xiaoandbircni
|
de961b91eb |
refactor(logging): add a logging abstraction and move the job logger onto it (#1295)
Add `act/common/logging`: a printf-style `Logger` on a slog-shaped `Handler`, with a logrus-backed handler as the only backend, plus a `logtest` handler for tests. Move the job logger onto it: `common.Logger` returns `*logging.Logger`, the job log formatters and the `Reporter` hook become handlers, and composite step IDs travel in the context. Logging is tightly coupled to logrus types (hooks, formatters, `Entry.Data`). Going through our own interface first lets the remaining call sites move over with unchanged behavior, and lets the backend be swapped for `log/slog` in one place afterwards. The global process logger and its masking formatter stay on logrus for now. Assisted-by: Codet Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1295 Reviewed-by: bircni <[email protected]> |
||
|
silverwind
|
ad9eeb668a |
fix: job container, daemon startup, action cache and exec fixes (#1294)
- Keep `GITHUB_ENV`, `GITHUB_OUTPUT`, `GITHUB_STATE` and `GITHUB_PATH` when a job times out or is cancelled, so post steps still get their state - Retry the startup Declare while Gitea is unreachable instead of exiting, still failing fast on rejected registrations, auth and misconfiguration - Reuse a local image when a platform variant such as `linux/arm/v7` is requested instead of pulling again - Read `PATH` from the created job container so cross-architecture jobs get tool paths for the right architecture - Extract action copies relative to the act volume so they never cross an image's `/var/run` symlink, which rootless Podman rejects - Keep the job container's entrypoint when container options set `--entrypoint`, warning instead of appending it to the keep-alive command - Lock action cache entries across runner processes that share a cache directory - `exec`: omit `GITHUB_SERVER_URL` and `GITHUB_API_URL` without `--gitea-instance` instead of exporting a bare `https://`, and read owner and repository from any origin remote Reviewed-on: https://gitea.com/gitea/runner/pulls/1294 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
Renovate Botandsilverwind
|
b741335222 |
fix(deps): update module golang.org/x/net to v0.60.0 [security] (#1292)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.59.0` → `v0.60.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.59.0...refs/tags/v0.60.0) |  |  | --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1292 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
20143c9558 |
fix(deps): update go toolchain directive to v1.27.2 [security] (#1291)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.27.1` → `1.27.2` | --- ### Reset context tracking on consecutive template expressions in html/template [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) / [GO-2026-6599](https://pkg.go.dev/vuln/GO-2026-6599) <details> <summary>More information</summary> #### Details When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped. #### Severity Unknown #### References - [https://go.dev/cl/839866](https://go.dev/cl/839866) - [https://go.dev/issue/81821](https://go.dev/issue/81821) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6599) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Recognize yield as regexp preceder keyword in html/template [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) / [GO-2026-6600](https://pkg.go.dev/vuln/GO-2026-6600) <details> <summary>More information</summary> #### Details A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped. #### Severity Unknown #### References - [https://go.dev/cl/840925](https://go.dev/cl/840925) - [https://go.dev/issue/81823](https://go.dev/issue/81823) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6600) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Root.Mkdir(All) can follow junctions out of the root on Windows in os [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) / [GO-2026-6604](https://pkg.go.dev/vuln/GO-2026-6604) <details> <summary>More information</summary> #### Details On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target). #### Severity Unknown #### References - [https://go.dev/cl/847305](https://go.dev/cl/847305) - [https://go.dev/issue/81739](https://go.dev/issue/81739) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6604) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/1 client connection desynchronization after CONNECT rejection in net/http [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) / [GO-2026-6605](https://pkg.go.dev/vuln/GO-2026-6605) <details> <summary>More information</summary> #### Details When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning. #### Severity Unknown #### References - [https://go.dev/cl/847306](https://go.dev/cl/847306) - [https://go.dev/issue/81740](https://go.dev/issue/81740) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6605) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Reject malformed ECH outer extension references in crypto/tls [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) / [GO-2026-6607](https://pkg.go.dev/vuln/GO-2026-6607) <details> <summary>More information</summary> #### Details Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result. #### Severity Unknown #### References - [https://go.dev/cl/847312](https://go.dev/cl/847312) - [https://go.dev/issue/81855](https://go.dev/issue/81855) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6607) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) / [GO-2026-6608](https://pkg.go.dev/vuln/GO-2026-6608) <details> <summary>More information</summary> #### Details Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. #### Severity Unknown #### References - [https://go.dev/cl/847307](https://go.dev/cl/847307) - [https://go.dev/issue/81741](https://go.dev/issue/81741) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6608) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Lack of limit on size of parsed Range headers in net/http [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) / [GO-2026-6609](https://pkg.go.dev/vuln/GO-2026-6609) <details> <summary>More information</summary> #### Details When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU. #### Severity Unknown #### References - [https://go.dev/cl/847309](https://go.dev/cl/847309) - [https://go.dev/issue/81858](https://go.dev/issue/81858) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6609) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) / [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613) <details> <summary>More information</summary> #### Details When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP. #### Severity Unknown #### References - [https://go.dev/cl/847311](https://go.dev/cl/847311) - [https://go.dev/issue/81744](https://go.dev/issue/81744) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6613) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1291 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
8b14a38d4a |
enhance!: send OTLP metrics under OpenTelemetry semantic conventions, add runner state (#1282)
Sends the OTLP metrics under [OpenTelemetry semantic convention](https://opentelemetry.io/docs/specs/semconv/) names where the runner's data matches the definition, like `cicd.worker.count`, `cicd.system.errors` and the `go.*` and `process.*` runtime metrics, and under `gitea.runner.*` otherwise. OTel dashboards then work without remapping, as they already do for the traces from https://gitea.com/gitea/runner/pulls/1206. Adds a `gitea_runner_state` gauge (`busy`, `idle`, `unavailable`), and `/readyz` now fails once the runner shuts down. **Breaking** 1. OTLP metric names, units, types and attribute values change, and the info and start time metrics move to resource attributes. 1. Prometheus `gitea_runner_client_errors_total` gains a `code` label, and `gitea_runner_job_total` counts jobs stopped by `runner.timeout` as `timeout` instead of `failure`. --------- Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1282 Reviewed-by: silverwind <[email protected]> Co-authored-by: wmTJc9IK0Q <[email protected]>v5.0.0 |
||
|
bircniandsilverwind
|
179e435cd0 |
enhance(config): add container.sweep option (#1275)
The Docker proxy labels every container, network and volume a job creates and removes them when the job ends, which breaks jobs that deploy long-running services to the runner's own Docker daemon. Document that behavior and add `container.sweep` (default `true`) so operators who deploy to the same daemon can opt out. Kept resources stay labeled with `com.gitea.runner.job`. Fixes: https://gitea.com/gitea/runner/issues/1243 Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1275 Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
|
f963e9cfe8 |
enhance: support client certificates for mutual TLS (#1273)
Add `runner.client_cert_file` and `runner.client_key_file` for Gitea instances that require mutual TLS. The runner presents the certificate on its RPCs, job summary uploads, and the action, reusable workflow and `builtin:checkout` clones from the instance. The files are read on use, so renewed certificates apply without a restart. Job steps do not get them. An incomplete or mismatched pair fails startup. Clones now decide the token, client certificate and `runner.insecure` with one host check, which also gives reusable workflow clones the TLS settings they lacked. `runner.insecure` still only covers the registered address. Fixes: https://gitea.com/gitea/runner/issues/321 Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1273 Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
|
e5aa9add02 |
fix: apply the daemon's mtu to job networks (#1270)
Copy the `mtu` of Docker's default bridge network to job networks, since Docker applies the daemon's `mtu` setting only to the default bridge. Docker's default of 1500 is not copied, so `default-network-opts` in the daemon config keeps applying. Closes https://gitea.com/gitea/runner/issues/232 --------- Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1270 Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
|
329115b148 |
enhance(config): expand environment values (#1274)
Config values can reference the runner's environment as `${NAME}`, for example `capacity: ${RUNNER_CAPACITY}`, so container deployments can configure the runner without templating the file. An unset `NAME` fails the load instead of silently becoming empty, and `$${NAME}` writes a literal `${NAME}`. Keys are never expanded.
Breaking: an existing value containing `${NAME}`, such as a shell command in a Kubernetes `pod_template`, now needs `$${NAME}`.
Closes https://gitea.com/gitea/runner/issues/551
Co-authored-by: silverwind <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1274
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>
|
||
|
bircniandsilverwind
|
ff30f39b1b |
enhance(runner): add extra HTTP headers (#1269)
Add `runner.extra_headers` for reverse proxies that require request headers on the runner's API requests to Gitea, like registration, polling and log and status reports. Headers the runner sets itself (authentication, User-Agent, protocol headers) stay authoritative. Extra headers are dropped when a redirect changes the hostname or leaves HTTPS, while the runner's own authentication headers follow redirects as before. Invalid or case-insensitively duplicated header names are rejected at config load. Fixes: https://gitea.com/gitea/runner/issues/171 Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1269 Co-authored-by: bircni <[email protected]> |
||
|
bircniandsilverwind
|
3802feb3fe |
fix: enforce read-only volume restrictions (#1272)
Allow `valid_volumes` entries ending in `:ro` to permit only read-only mounts, so a workflow can no longer mount writable a host path the runner only shares read-only, like a certificate store. `**:ro` allows any volume read-only. An entry without `:ro` that matches too still allows writable mounts. A named volume allowed only through `:ro` is mounted with `nocopy`, because Docker otherwise fills an empty volume from the image even when it is mounted read-only. Fixes: https://gitea.com/gitea/runner/issues/407 Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1272 Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
|
27e9b4de87 |
fix!: use the git CLI for action clones and make builtin:checkout match actions/checkout (#1277)
The runner now uses the `git` command line instead of go-git to download actions and reusable workflows. go-git had recurring bugs and does not support SHA-256 repositories, and full clones of actions are several times faster. `builtin:checkout` now runs `git` where the job runs and behaves like `actions/checkout`: 1. A branch is checked out as a local branch tracking `origin`, tag and pull request runs keep their ref, and a triggering tag that moved fails the step. 1. Later steps can fetch and push with the persisted token or SSH key. 1. It supports the `ssh-*`, `lfs`, `submodules`, `sparse-checkout`, `filter`, `fetch-tags`, `clean`, `persist-credentials`, `show-progress` and `set-safe-directory` inputs and the `ref` and `commit` outputs. 1. SHA-256 repositories work for actions, reusable workflows and `builtin:checkout`. Git keeps the token off its command line, ignores `GIT_DIR` and similar variables inherited by the runner, and keeps action files LF regardless of `core.autocrlf`. A cancelled job lets git remove its lock files. This is a breaking change: the runner needs Git 2.34.1 or newer on its `PATH`, and so do job images that use `builtin:checkout`. The official runner images include it. Fixes: https://gitea.com/gitea/runner/issues/1077 Fixes: https://gitea.com/gitea/runner/issues/1267 Fixes: https://gitea.com/gitea/runner/issues/1279 Fixes: https://gitea.com/gitea/runner/issues/1284 Fixes: https://gitea.com/gitea/runner/issues/1285 Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1277 Reviewed-by: Lunny Xiao <[email protected]> Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
bircniandsilverwind
|
4bedadef9d |
fix: reject workflows with jobs lacking runs-on (#1271)
Fail the workflow before any of its jobs run when a regular job omits `runs-on` or leaves it empty, as GitHub does, instead of running the job in the fallback image. Gitea rejects such workflows itself since https://github.com/go-gitea/gitea/pull/39480. This covers released Gitea versions, which hand a job without labels to any runner, and `exec`. Reusable workflow jobs and the stepless placeholders the runner builds for a job's `needs` are exempt. Closes https://gitea.com/gitea/runner/issues/836 --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1271 Reviewed-by: silverwind <[email protected]> |
||
|
|
83b63250a3 |
fix: strip log-driver and OOM options when privileged is off (#1283)
When privileged mode is disabled, reset `--log-driver`, `--log-opt`, `--oom-score-adj` and `--oom-kill-disable` from workflow `container.options`. Log drivers run in the host daemon, so a workflow could make it connect to any address, and `--oom-score-adj -1000` exempts a job from the host OOM killer. Breaking: on unprivileged runners, workflows can no longer set these options, e.g. `--log-driver none` or `--log-opt max-size=10m`. They are dropped with a warning and the job still runs. Runner-level `container.options` and privileged runners are unaffected. Fixes: https://github.com/go-gitea/gitea/security/advisories/GHSA-cgx2-cw7h-xgcx Fixes: https://github.com/go-gitea/gitea/security/advisories/GHSA-c988-q5xx-2cff Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1283 Reviewed-by: silverwind <[email protected]> |
||
|
silverwind
|
2e59141ae9 |
fix: allow tmpfs mounts in container options (#1289)
Support tmpfs in container `options` via `--mount type=tmpfs,...`, like GitHub does. The `valid_volumes` check silently dropped these mounts because they have no source. A tmpfs is backed by memory and exposes nothing from the host, same as `--tmpfs`, which already passes. Every other mount still goes through the allowlist.
Both forms now work:
```yaml
services:
mysql:
image: mysql:8.4
options: --tmpfs /var/lib/mysql # already worked
```
```yaml
services:
mysql:
image: mysql:8.4
options: --mount type=tmpfs,destination=/var/lib/mysql # was dropped, now works
```
Reviewed-on: https://gitea.com/gitea/runner/pulls/1289
Reviewed-by: bircni <[email protected]>
Co-authored-by: silverwind <[email protected]>
|
||
|
020f0d2861 |
fix: extract copied directories at their destination in Kubernetes pods (#1286)
The Kubernetes backend extracted CopyDir archives at "/" with entries like "var/run/act/actions/<sha>/...". Ubuntu's patched tar refuses to extract through an absolute symlink, failing with "Invalid cross-device link" on images that link /var/run to /run, so actions never reached the job container. Extract at the destination with relative entries instead, like Copy already does. This is a similar issue to #1128, but for k8s instead of Docker. I built the image and deployed it to my k8s cluster to verify the fix. --------- Co-authored-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1286 Reviewed-by: silverwind <[email protected]> Co-authored-by: Drew Inglis <[email protected]> |
||
|
|
711b72735b |
chore(deps): update dependencies (#1288)
Co-authored-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1288 Reviewed-by: bircni <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
silverwind
|
436d0d2942 |
fix: recognize Gitea's 401 reply for an unregistered runner (#1287)
Since https://github.com/go-gitea/gitea/pull/39578 (backported to v28), Gitea answers an unregistered runner with a Connect `Unauthenticated` error instead of a gRPC status wrapped as `Unknown`. `IsRegistrationRejected` missed it, so an ephemeral runner kept its spent registration file and failed on every restart. This also fails the `gitea/gitea:main-nightly` e2e job. Match on the `unregistered runner` message suffix, which both shapes share. The code can't distinguish Gitea from a proxy, because a proxy's 401 with a JSON body also decodes as a wire `Unauthenticated` error. Written by Claude Code. Reviewed-on: https://gitea.com/gitea/runner/pulls/1287 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
silverwind
|
a284a62d96 |
chore(deps): update gitea.dev/actionslib to v1.3.0 (#1278)
Updates to [actionslib v1.3.0](https://gitea.com/gitea/actionslib/releases/tag/v1.3.0). Matrix include and exclude entries now match combinations with expression equality like GitHub, so an include of `os: LINUX` extends the `os: linux` combination instead of adding a new one. No code changes are needed. Reviewed-on: https://gitea.com/gitea/runner/pulls/1278 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
bircni
|
2b1e64e414 |
ci: Skip builds on push on main (#1276)
These builds were already tested on pr merge so why run again? Reviewed-on: https://gitea.com/gitea/runner/pulls/1276 Reviewed-by: silverwind <[email protected]> |
||
|
silverwind
|
ddee2e054a |
fix: align Docker actions, job env and host mode with GitHub (#1268)
- Docker actions evaluate `runs.args` and `runs.env` with their own `inputs`, so a same-named `workflow_dispatch` input no longer replaces the step's `with:` value - Dockerfile action images are tagged per step and job and removed afterwards, so changed Dockerfiles rebuild and concurrent jobs never share an image - Workflow and job `env` are evaluated before job and service container credentials and service `env` use them - Docker actions in host jobs get the host workspace and file-command directory mounted, and no longer inherit the runner's own `PATH` - Cache server address detection accepts a single interface address Fixes: https://gitea.com/gitea/runner/issues/390 Fixes: https://gitea.com/gitea/runner/issues/406 Fixes: https://gitea.com/gitea/runner/issues/578 Related: https://gitea.com/gitea/runner/issues/64 Reviewed-on: https://gitea.com/gitea/runner/pulls/1268 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]>v4.1.0 |
||
|
silverwindandbircni
|
629e062f86 |
fix: drop stalled HTTP/2 connections in action clones (#1266)
go-git sends all concurrent action clones from a host over one HTTP/2 connection, and Go sends no health-check pings by default. When that connection stalls, every clone on it hangs until the job timeout and cancellation can't free them, as in https://gitea.com/gitea/runner/actions/runs/1003885/jobs/1361593. Ping idle connections so a stalled one is dropped after about 45s. --------- Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1266 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
bircniandsilverwind
|
73e9552f06 |
fix: fail fast in register and honor GITEA_MAX_REG_ATTEMPTS (#1197)
`gitea-runner register` pinged the instance in an unbounded loop, so a permanent failure like an untrusted certificate or a wrong URL never returned. It now pings once and returns the error, like other one-shot commands. The image entrypoint keeps retrying registration indefinitely by default, like the daemon, so a container without a restart policy still recovers once Gitea is reachable. `GITEA_MAX_REG_ATTEMPTS` had no effect because its counter was incremented outside the loop. When set, it now caps the attempts, after which the entrypoint exits non-zero. Fixes: https://gitea.com/gitea/runner/issues/1195 Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1197 Reviewed-by: Lunny Xiao <[email protected]> Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
silverwindandbircni
|
05162998eb |
fix: dind image readiness, exit codes and shutdown order (#1265)
Fixes https://gitea.com/gitea/runner/issues/1263 - Wait for dockerd without a check limit. s6 readiness gave up after 7 checks, so the runner never started on slow hosts, also seen in https://gitea.com/gitea/runner/issues/712, https://gitea.com/gitea/runner/issues/652 and https://gitea.com/gitea/runner/issues/758. - Let the runner run the docker service's readiness check itself instead of reading s6 status, which can be missing at startup or stale after an unclean stop. - Exit the container with the first failing service's exit code instead of always 0, so `restart: on-failure` works. A requested stop still exits 0. - Stop the runner before dockerd, so running jobs can finish within `shutdown_timeout`. The stop grace period has to cover that drain. - Check the supervision exit codes in `make test-dind`. --------- Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1265 Reviewed-by: bircni <[email protected]> |
||
|
|
568f89d186 |
enhance: export the Prometheus metrics over OpenTelemetry (#1248)
Push the runner's Prometheus metrics to the OTLP endpoint next to the job traces, so both land in the same backend. The `/metrics` registry is converted as the [Prometheus compatibility spec](https://opentelemetry.io/docs/specs/otel/compatibility/prometheus_and_openmetrics/) describes and sent through the existing gRPC-free client, so names stay unchanged and no second metrics stack is linked. Metrics are on by default and pushed every interval and once on shutdown, so ephemeral runners report too. New standard variables, each `OTEL_EXPORTER_OTLP_*` one with `TRACES` and `METRICS` variants: - `OTEL_METRICS_EXPORTER`, `none` turns metrics off - `OTEL_METRIC_EXPORT_INTERVAL`, `OTEL_METRIC_EXPORT_TIMEOUT` - `OTEL_EXPORTER_OTLP_TIMEOUT`, `OTEL_EXPORTER_OTLP_COMPRESSION` - `OTEL_EXPORTER_OTLP_CERTIFICATE`, `OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE`, `OTEL_EXPORTER_OTLP_CLIENT_KEY` --------- Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1248 Reviewed-by: silverwind <[email protected]> Reviewed-by: bircni <[email protected]> Co-authored-by: wmTJc9IK0Q <[email protected]> |
||
|
bircniandsilverwind
|
d93b7d278a |
fix: clear consumed ephemeral registration state (#1256)
Ephemeral registrations are single-use, but the daemon kept `.runner` after the task, so a restarted container failed `Declare` with `unregistered runner` forever. An ephemeral runner now removes its registration file as soon as it fetches a task, so a container killed mid-job registers afresh on restart. It also removes the file when Gitea answers `unregistered runner` at startup or while polling. A proxy's 401 does not count. Persistent runners keep their file, because Gitea sends the same reply for a token mismatch. Closes https://gitea.com/gitea/runner/issues/818 --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1256 Reviewed-by: silverwind <[email protected]> |
||
|
0cedd98051 |
feat: add Kubernetes backend (#1260)
Adds a Kubernetes backend. A `name:kubernetes://image` label runs the job as one pod through the Kubernetes API, with services as containers of the same pod. Step env is exported by a script sent over exec stdin, keeping it out of the pod spec and process arguments, and service env goes into a per-job Secret. Docker actions and container options are rejected. See `docs/kubernetes.md`. Operators shape job pods with `kubernetes.pod_template`, with per-label `pod_templates` merged in `runs-on` order and a `$services` entry for service containers. The idle cleanup removes pods and Secrets a runner left behind. The client calls the Kubernetes API directly and runs step commands over `coder/websocket` (same dependency used in gitea) instead of pulling in the heavyweight `kubernetes/client-go`. Includes an e2e test against k3s. Replaces: https://gitea.com/gitea/runner/pulls/1000 Fixes: https://gitea.com/gitea/runner/issues/31 Assisted-by: Claude Code:claude-opus-5-5 Co-authored-by: Zettat123 <[email protected]> Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1260 Reviewed-by: Lunny Xiao <[email protected]> Reviewed-by: Zettat123 <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
|
07ca4bfa7f |
enhance: log task, job and run identifiers when a task starts (#1257)
Replace the `task N repo is ...` line with a structured `task started` entry carrying `task_id`, `job_id`, `run_id`, `run_number`, `repository` and the workflow's `job` key, so external supervisors can match runner activity to the job in Gitea. `job_id` is read from the runtime token's claims, tokens and secrets are never logged. Closes https://gitea.com/gitea/runner/issues/752 --------- Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1257 Reviewed-by: silverwind <[email protected]> |
||
|
|
78610b01f6 |
docs: recommend DinD for container jobs (#1258)
Make Docker-in-Docker the recommended and first-shown setup. Mounting the host's Docker socket gives every job root-equivalent access to the host, while DinD gives jobs their own daemon. The default `latest` tag is unchanged. Also shorten the image flavour docs to what users need to pick an image, and correct that `dind-rootless` needs `--privileged` too. Closes https://gitea.com/gitea/runner/issues/1227 --------- Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1258 Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> |
||
|
bircniandsilverwind
|
4a8ee4ce57 |
fix: resolve container sleep through PATH (#1255)
Resolve the job container's sleep command through PATH so images with nonstandard binary locations, including Nix, can run jobs. Closes https://gitea.com/gitea/runner/issues/808 --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1255 Reviewed-by: silverwind <[email protected]>v4.0.1 |
||
|
bircniandsilverwind
|
bf03f36d5a |
fix: honor configured Docker registration file (#1259)
The Docker entrypoint always checked `.runner` in `/data` and ignored `runner.file` from `CONFIG_FILE`. When `runner.file` pointed elsewhere, it re-registered on every start, or skipped registration because of a stale `.runner`. It now reads the path from a new `config runner-file` subcommand, which resolves `runner.file` the same way as `register` and `daemon`. Closes https://gitea.com/gitea/runner/issues/585 --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1259 Reviewed-by: silverwind <[email protected]> |
||
|
Renovate Botandsilverwind
|
5a38a3d0c4 |
chore(deps): update dependencies (#1254)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) | `v4.10.0` → `v4.10.2` |  |  | require | patch | | [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `v0.5.16` → `v0.5.17` |  |  | | patch | | nginx | `62ff208` → `df221db` | | | | digest | --- ### Release Notes <details> <summary>bmatcuk/doublestar (github.com/bmatcuk/doublestar/v4)</summary> ### [`v4.10.2`](https://github.com/bmatcuk/doublestar/releases/tag/v4.10.2): Better support for Windows "Junctions" [Compare Source](https://github.com/bmatcuk/doublestar/compare/v4.10.1...v4.10.2) Has improved support for reading "junctions" in Windows (ie, Windows' version of symlinks). Thanks [@​x0Lazarus](https://github.com/x0Lazarus) for the PR! #### What's Changed - Fix Windows junction traversal with Go 1.23 and later by [@​x0Lazarus](https://github.com/x0Lazarus) in [#​117](https://github.com/bmatcuk/doublestar/pull/117) #### New Contributors - [@​x0Lazarus](https://github.com/x0Lazarus) made their first contribution in [#​117](https://github.com/bmatcuk/doublestar/pull/117) **Full Changelog**: <https://github.com/bmatcuk/doublestar/compare/v4.10.1...v4.10.2> ### [`v4.10.1`](https://github.com/bmatcuk/doublestar/releases/tag/v4.10.1): Fixed issue with alternatives and character classes [Compare Source](https://github.com/bmatcuk/doublestar/compare/v4.10.0...v4.10.1) There was an issue where commas or ending curly brackets inside a character class would cause code looking for the next alternative (commas) or the end of alternatives (ending curly brackets) to erroneously match those characters inside the character classes. Thanks to [@​sidsri14](https://github.com/sidsri14) for the fix! #### What's Changed - fix brace alternation scanning with character classes by [@​sidsri14](https://github.com/sidsri14) in [#​115](https://github.com/bmatcuk/doublestar/pull/115) #### New Contributors - [@​sidsri14](https://github.com/sidsri14) made their first contribution in [#​115](https://github.com/bmatcuk/doublestar/pull/115) **Full Changelog**: <https://github.com/bmatcuk/doublestar/compare/v4.10.0...v4.10.1> </details> <details> <summary>ulikunitz/xz (github.com/ulikunitz/xz)</summary> ### [`v0.5.17`](https://github.com/ulikunitz/xz/compare/v0.5.16...v0.5.17) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.16...v0.5.17) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1254 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
silverwindandbircni
|
6618e67645 |
fix: apply a job container without image to the runs-on image (#1252)
Fixes https://gitea.com/gitea/runner/issues/1251, a regression from https://gitea.com/gitea/runner/pulls/1233. A job `container:` without an `image` key configures the runs-on image again, as in 3.x, so its `volumes`, `options`, `credentials` and `env` apply. An image that evaluates to empty still skips the container, as on GitHub. --------- Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1252 Reviewed-by: Lunny Xiao <[email protected]> Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
silverwind
|
2b599fae7f |
fix: misc bug fixed and improvements (#1253)
1. Host mode is selected only through `runs-on` again, as in upstream act. 1. A workflow volume that `valid_volumes` drops no longer displaces the runner's own socket, workspace, tool cache or `/var/run/act` mount, so `/var/run/docker.sock:/var/run/docker.sock` works on hosts whose daemon socket lives elsewhere. 1. `docker://` is stripped from job and service images, as on GitHub. 1. Each created service's log is printed at job end, and service log dumps no longer run workflow commands, as on GitHub. 1. A `--privileged` dropped because privileged mode is off now logs a warning. 1. README: the proxy variables change per step through `env:` or for the rest of a job through `$GITHUB_ENV`, `container.env` does not override them. Reviewed-on: https://gitea.com/gitea/runner/pulls/1253 Reviewed-by: Zettat123 <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
Zettat123
|
990ebaa2ac |
fix: restore the caller's event and inputs in reusable workflow jobs (#1250)
Fixes https://github.com/go-gitea/gitea/issues/38705 Gitea side: https://github.com/go-gitea/gitea/pull/39452 Jobs of a called workflow currently see `gitea.event_name == "workflow_call"`, and their `gitea.event.inputs` is replaced by the caller's `with:`. On GitHub they keep the caller's event, and their `inputs` are the run's `workflow_dispatch` inputs overlaid with the caller's `with:`. For compatibility with older runners, Gitea keeps sending that form and adds a `gitea_workflow_call` key with the original trigger event name and inputs of the run, and the `inputs` Gitea resolved for the job. When the key is present, the runner restores `gitea.event_name` and `gitea.event.inputs` from it, and uses the resolved `inputs` for the job's expressions and the setup log. Without that key (older Gitea, or jobs outside called workflows), nothing changes. Reviewed-on: https://gitea.com/gitea/runner/pulls/1250 Reviewed-by: bircni <[email protected]> Reviewed-by: silverwind <[email protected]> Co-authored-by: Zettat123 <[email protected]> |
||
|
bircniandsilverwind
|
81add27459 |
feat(cache): add shared S3-compatible storage (#1244)
Store the cache used by `actions/cache` in an S3-compatible bucket such as AWS S3 or RustFS, with no `cache-server`. Runners with the same settings use the same cache. A cache saved on one runner can be restored on the others within 30 seconds. The runner talks to the bucket over the S3 REST API with SigV4, without an SDK. Lifecycle rules on the bucket expire old caches. *Description rewritten by Claude.* --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1244 Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]>v4.0.0 |
||
|
silverwindandbircni
|
ace8653105 |
feat!: serve the actions cache from the runner (#1229)
Make cache requests go through the runner and remove outbound traffic from the cache server. The runner forwards them to `cache.external_server` when one is set, and attaches itself to each job network so jobs can reach it. Benefits: 1. Jobs need no http proxy rules for the cache server, which `@actions/http-client` mishandles for CIDR ranges in `no_proxy` (https://github.com/actions/toolkit/pull/2495). 2. Only runners reach a shared cache server, which needs no route to Gitea. 3. A runner container sharing the host Docker socket now caches, where jobs previously could not reach it. Breaks: 1. Jobs that reach `external_server` but not their runner, such as a remote `DOCKER_HOST`. The built-in cache has always needed that reachability, so both modes now agree. Set `cache.host` and `cache.port` to an address those jobs reach. 2. Jobs on `container.network: bridge`, where Docker rejects the alias, so the runner cannot attach and their cache fails as it does today. Leave `container.network` empty, or name a user-defined network. *Written by Claude.* --------- Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1229 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |
||
|
silverwindandbircni
|
95daa50d9b |
enhance!: match valid_volumes with bmatcuk/doublestar (#1214)
`valid_volumes` patterns now match with doublestar instead of gobwas/glob, which was compiled without separators so `*` crossed slashes. doublestar is already in the module graph, keeps `*` within one path segment and matches host paths with the OS separator, which fixes Windows patterns where a backslash was read as an escape. Breaking: a host pattern that relied on `*` matching nested paths needs `**`, e.g. `/data/**` instead of `/data/*`. Named volumes and the bare `**` are unaffected. Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1214 Reviewed-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> |