chore(deps): update dependencies (#1365)

Co-authored-by: Renovate Bot <[email protected]>

.gitea/workflows/pull-pr-title.yml

@@ -21,7 +21,7 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
     - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
       with:
-        node-version: 24
+        node-version: 26
     - run: make lint-pr-title
       env:
         PR_TITLE: ${{ github.event.pull_request.title }}

.gitea/workflows/test.yml

@@ -25,7 +25,7 @@ jobs:
       # daemon retains them between runs, and their digest pins skip the registry when it has them.
       - name: pre-pull test images
         env:
-          TEST_JOB_IMAGE: node:24-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205 # renovate: datasource=docker
+          TEST_JOB_IMAGE: node:26-bookworm-slim@sha256:bc0a2afd3b74ce12222fc8bab99271e66257f021078f5f4a5d687a77d280c1d9 # renovate: datasource=docker
           TEST_SERVICE_IMAGE: nginx:alpine@sha256:a3554c0d0b48177b1413c26e01f695334428020d9df01243fbae3e11cfd17417 # renovate: datasource=docker
         run: |
           for image in "$TEST_JOB_IMAGE" "$TEST_SERVICE_IMAGE"; do

DEVELOPMENT.md

@@ -57,12 +57,15 @@ Each lives in `internal/pkg/action/<name>` and is registered in `builtinActions`
 
 `make test-e2e` runs the runner against `E2E_GITEA_IMAGE`. It defaults to the nightly image.
 It requires Docker and is excluded from `make test`. CI runs stable and nightly variants in
-parallel.
+parallel. Outside a container it runs `go test` in a Linux container on its own network, as CI does,
+so both take the same paths. `E2E_ARGS` passes extra flags, e.g. `make test-e2e E2E_ARGS='-run TestCompatibility/dispatch'`.
 
 The `cli_*` scenarios build the binary and drive `register` and `daemon` as a user would, including `--once`,
-`--labels` and shutdown with a running job. `failure_paths` covers failed, skipped, tolerated and timed-out jobs.
-`label_routing` and `capacity` cover scheduling, `reconnect` drops the connection to Gitea through a proxy, and
-`host_mode` and `reusable_workflow` cover host labels and `workflow_call`.
+`--labels` and shutdown with a running job. `failure_paths` covers failed, skipped and tolerated jobs, `job_timeout`
+a job killed at the runner's deadline. `label_routing` and `capacity` cover scheduling, `reconnect` drops the
+connection to Gitea through a proxy, and `host_mode` and `reusable_workflow` cover host labels and `workflow_call`.
+`dispatch`, `failure_paths` and `reusable_workflow` run in every mode: through the daemon and `exec`, each on
+Docker and Kubernetes.
 
-The suite shares one Gitea and regular runner. Cache and ephemeral scenarios use isolated
+The suite shares one Gitea, regular runner and k3s cluster. Cache and ephemeral scenarios use isolated
 repository runners. A run path is `<workflow>@<ref>` and a log row is `<timestamp>Z <payload>`.

Dockerfile

@@ -19,7 +19,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 ### DIND VARIANT
 #
 #
-FROM docker:29.9.1-dind AS dind
+FROM docker:29.9.2-dind AS dind
 
 ARG VERSION=dev
 
@@ -41,7 +41,7 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 ### DIND-ROOTLESS VARIANT
 #
 #
-FROM docker:29.9.1-dind-rootless AS dind-rootless
+FROM docker:29.9.2-dind-rootless AS dind-rootless
 
 ARG VERSION=dev
 

Makefile

@@ -4,7 +4,7 @@ GO ?= go
 HAS_GO = $(shell hash $(GO) > /dev/null 2>&1 && echo "GO" || echo "NOGO" )
 
 PODMAN_TEST_IMAGE ?= quay.io/containers/podman:v5.8.9-immutable@sha256:87f42f37fa85b421664c30b8f5f9cfc23920057f5e5fcadf0b6f68d9edc6d415 # renovate: datasource=docker
-E2E_JOB_IMAGE ?= docker.gitea.com/runner-images:ubuntu-latest@sha256:8856b200466e9a5af9cc0d4de4ca96f73547833bcdddf9a567189ff772c4d372 # renovate: datasource=docker
+E2E_JOB_IMAGE ?= docker.gitea.com/runner-images:ubuntu-latest@sha256:657378e5cfd898e36f820459c60ef8e69be8fcda9fd354e4381a8b654d091bbc # renovate: datasource=docker
 SERVICE_IMAGE ?= nginx:1.31.7-alpine@sha256:892bb2152464f0c5d8972593a5f5afaf8054552580b699d95f8ff4af08c2d33d # renovate: datasource=docker
 E2E_GITEA_IMAGE ?= gitea/gitea:main-nightly
 E2E_K3S_IMAGE ?= rancher/k3s:v1.37.1-k3s1@sha256:ca7f37d993d82ef0dcdcfecb2e0e2618ea541dbaffc620c8cedebe01a82acd0d # renovate: datasource=docker
@@ -154,7 +154,7 @@ E2E_CONCURRENCY ?= 8
 
 .PHONY: test-e2e
 test-e2e: ## run Gitea compatibility tests against E2E_GITEA_IMAGE
-	@E2E_CONCURRENCY=$(E2E_CONCURRENCY) E2E_GITEA_IMAGE=$(E2E_GITEA_IMAGE) E2E_K3S_IMAGE=$(E2E_K3S_IMAGE) E2E_JOB_IMAGE=$(E2E_JOB_IMAGE) GO=$(GO) SERVICE_IMAGE=$(SERVICE_IMAGE) ./tools/test-e2e.sh
+	@E2E_CONCURRENCY=$(E2E_CONCURRENCY) E2E_GITEA_IMAGE=$(E2E_GITEA_IMAGE) E2E_K3S_IMAGE=$(E2E_K3S_IMAGE) E2E_JOB_IMAGE=$(E2E_JOB_IMAGE) GO=$(GO) SERVICE_IMAGE=$(SERVICE_IMAGE) ./tools/test-e2e.sh $(E2E_ARGS)
 
 .PHONY: install
 install: $(GOFILES) ## install the runner binary via `go install`

README.md

@@ -303,6 +303,8 @@ Use `uses: builtin:checkout` to check out a repository without downloading `acti
 
 Each runner starts its own cache server, so runners do not share cached entries. A runner in a container on the jobs' Docker daemon attaches itself to each job network, so jobs reach its cache without extra setup.
 
+As on GitHub, a job restores caches saved for its own ref, its pull request's base branch and the default branch, so a cache saved by a pull request is only restored by that pull request.
+
 **Sharing a cache between runners**
 
 Run one `gitea-runner cache-server` and point every runner at it, using the same secret everywhere, for example from `openssl rand -hex 32`:

act/artifactcache/doc.go

@@ -6,7 +6,5 @@
 //
 // Inspired by https://github.com/sp-ricard-valverde/github-act-cache-server
 //
-// TODO: Authorization
-// TODO: Restrictions for accessing a cache, see https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache
 // TODO: Force deleting cache entries, see https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#force-deleting-cache-entries
 package artifactcache

act/artifactcache/handler.go

@@ -59,6 +59,10 @@ type credKey struct{}
 type JobCredential struct {
 	Repo string `json:"repo"`
 
+	Ref        string `json:"ref"`
+	BaseRef    string `json:"base_ref"`
+	DefaultRef string `json:"default_ref"`
+
 	// Results is the instance whose artifact service this server forwards for the job, and
 	// InsecureTLS how the runner reaches it; see results.go.
 	Results     string `json:"-"`
@@ -68,6 +72,10 @@ type JobCredential struct {
 	PublicURL string `json:"public_url"`
 }
 
+func (cred JobCredential) owns(cache *Cache) bool {
+	return cache.Repo == cred.Repo && cache.Ref == cred.Ref
+}
+
 // credEntry holds a registered job's credential along with an active
 // registration count. RegisterJob is reference-counted so that if two tasks
 // briefly share an ACTIONS_RUNTIME_TOKEN — e.g. a runner that retries a task
@@ -653,7 +661,7 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request) {
 	}
 	defer db.Close()
 
-	cache, err := h.lookupCache(db, cred.Repo, keys, version)
+	cache, err := h.lookupCache(db, cred, keys, version)
 	if err != nil {
 		h.responseJSON(w, r, 500, err)
 		return
@@ -669,26 +677,27 @@ func (h *Handler) find(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
-// lookupCache returns the entry to restore for these keys, or (nil, nil) when there is none:
-// either nothing matched, or the match had lost its blob to a prune, in which case the dangling
-// entry is dropped on the way out.
-func (h *Handler) lookupCache(db *cacheDB, repo string, keys []string, version string) (*Cache, error) {
-	cache, err := findCache(db, repo, keys, version)
-	if err != nil || cache == nil {
-		return nil, err
+// lookupCache returns the entry to restore or (nil, nil), dropping matches whose blob was pruned.
+func (h *Handler) lookupCache(db *cacheDB, cred JobCredential, keys []string, version string) (*Cache, error) {
+	for {
+		cache, err := findCache(db, cred, keys, version)
+		if err != nil || cache == nil {
+			return nil, err
+		}
+		ok, err := h.storage.Exist(cache.ID)
+		if err != nil {
+			return nil, err
+		}
+		if ok {
+			// Handing out a download URL counts as access, or eviction could drop the entry between
+			// this call and the GET that follows it.
+			h.touch(db, cache)
+			return cache, nil
+		}
+		if !h.deleteCache(db, cache) {
+			return nil, nil //nolint:nilnil // absence is not an error here
+		}
 	}
-	ok, err := h.storage.Exist(cache.ID)
-	if err != nil {
-		return nil, err
-	}
-	if !ok {
-		h.deleteCache(db, cache)
-		return nil, nil //nolint:nilnil // absence is not an error here
-	}
-	// Handing out a download URL counts as access, or eviction could drop the entry between
-	// this call and the GET that follows it.
-	h.touch(db, cache)
-	return cache, nil
 }
 
 // POST /_apis/artifactcache/caches
@@ -700,7 +709,7 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	cache := &Cache{Repo: cred.Repo, Key: api.Key, Version: api.Version, Size: api.Size}
+	cache := &Cache{Repo: cred.Repo, Ref: cred.Ref, Key: api.Key, Version: api.Version, Size: api.Size}
 	if cache.Size == 0 {
 		cache.Size = -1
 	}
@@ -749,7 +758,7 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if cache.Repo != cred.Repo {
+	if !cred.owns(cache) {
 		h.responseJSON(w, r, 403, fmt.Errorf("cache %d: forbidden", id))
 		return
 	}
@@ -808,7 +817,7 @@ func (h *Handler) commit(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if cache.Repo != cred.Repo {
+	if !cred.owns(cache) {
 		h.responseJSON(w, r, 403, fmt.Errorf("cache %d: forbidden", id))
 		return
 	}
@@ -1071,25 +1080,35 @@ func (h *Handler) signedArtifactURL(cred JobCredential, cacheID uint64, exp time
 	return h.signedURL(cred, apiPath+"/artifacts", "", cacheID, exp)
 }
 
-// if not found, return (nil, nil) instead of an error.
-func findCache(db *cacheDB, repo string, keys []string, version string) (*Cache, error) {
-	for _, prefix := range keys {
-		// if a key in the list matches exactly, don't return partial matches
-		exact, err := findExactCache(db, repo, prefix, version, true)
-		if err != nil {
-			return nil, err
+// findCache tries every key in one ref before the next ref, and returns (nil, nil) on a miss.
+func findCache(db *cacheDB, cred JobCredential, keys []string, version string) (*Cache, error) {
+	refs := []string{cred.Ref}
+	for _, ref := range []string{cred.BaseRef, cred.DefaultRef} {
+		if ref != "" && !slices.Contains(refs, ref) {
+			refs = append(refs, ref)
 		}
-		if exact != nil {
-			return exact, nil
-		}
-		caches, err := db.find(func(cache *Cache) bool {
-			return cache.Repo == repo && strings.HasPrefix(cache.Key, prefix) && cache.Version == version && cache.Complete
-		})
-		if err != nil {
-			return nil, fmt.Errorf("find cache: %w", err)
-		}
-		if cache := latest(caches, (*Cache).createdAtNano); cache != nil {
-			return cache, nil
+	}
+	caches, err := db.find(func(cache *Cache) bool {
+		return cache.Repo == cred.Repo && cache.Version == version && cache.Complete && slices.Contains(refs, cache.Ref) &&
+			slices.ContainsFunc(keys, func(prefix string) bool { return strings.HasPrefix(cache.Key, prefix) })
+	})
+	if err != nil {
+		return nil, fmt.Errorf("find cache: %w", err)
+	}
+	for _, ref := range refs {
+		for _, prefix := range keys {
+			var exact, partial []*Cache
+			for _, cache := range caches {
+				if cache.Ref == ref && cache.Key == prefix {
+					exact = append(exact, cache)
+				} else if cache.Ref == ref && strings.HasPrefix(cache.Key, prefix) {
+					partial = append(partial, cache)
+				}
+			}
+			// if a key in the list matches exactly, don't return partial matches
+			if cache := cmp.Or(latest(exact, (*Cache).createdAtNano), latest(partial, (*Cache).createdAtNano)); cache != nil {
+				return cache, nil
+			}
 		}
 	}
 	return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
@@ -1111,9 +1130,9 @@ func latest(caches []*Cache, stamp func(*Cache) int64) *Cache {
 // A completed entry is the one to restore, sorted by when it was written. An incomplete one is a
 // reservation being uploaded to, sorted by when it was last written to, because the upload route
 // touches UsedAt on every part.
-func findExactCache(db *cacheDB, repo, key, version string, complete bool) (*Cache, error) {
+func findExactCache(db *cacheDB, cred JobCredential, key, version string, complete bool) (*Cache, error) {
 	caches, err := db.find(func(cache *Cache) bool {
-		return cache.Key == key && cache.Repo == repo && cache.Version == version && cache.Complete == complete
+		return cred.owns(cache) && cache.Key == key && cache.Version == version && cache.Complete == complete
 	})
 	if err != nil {
 		return nil, fmt.Errorf("find cache: %w", err)
@@ -1280,13 +1299,12 @@ func (h *Handler) evictExpired(db *cacheDB) {
 	h.sweep(db, func(cache *Cache) bool { return cache.UsedAt < expired })
 }
 
-// evictSuperseded removes entries a newer one with the same key and version replaced. The
-// grouping includes Repo so two repos sharing a (key, version) do not evict each other.
+// evictSuperseded removes entries a newer one with the same repo, ref, key and version replaced.
 func (h *Handler) evictSuperseded(db *cacheDB) {
-	type entry struct{ repo, key, version string }
+	type entry struct{ repo, ref, key, version string }
 	groups := make(map[entry][]*Cache)
 	for _, cache := range h.caches(db, func(cache *Cache) bool { return cache.Complete }) {
-		group := entry{cache.Repo, cache.Key, cache.Version}
+		group := entry{cache.Repo, cache.Ref, cache.Key, cache.Version}
 		groups[group] = append(groups[group], cache)
 	}
 	for _, caches := range groups {

act/artifactcache/handler_test.go

@@ -759,11 +759,55 @@ func TestHandler_PrefixUsesNewestReservationWithinSecond(t *testing.T) {
 	db, err := handler.openDB()
 	require.NoError(t, err)
 	defer db.Close()
-	cache, err := findCache(db, testRepo, []string{"deps-"}, "v")
+	cache, err := findCache(db, JobCredential{Repo: testRepo}, []string{"deps-"}, "v")
 	require.NoError(t, err)
 	require.Equal(t, newer, cache)
 }
 
+func TestHandler_RestoreRefs(t *testing.T) {
+	t.Parallel()
+	const main, release, pull = "refs/heads/main", "refs/heads/release", "refs/pull/1/head"
+	now := time.Now().Unix()
+	entry := func(ref, key string, age int64) *Cache {
+		return &Cache{Repo: testRepo, Ref: ref, Key: key, Version: "v", Complete: true, CreatedAt: now - 3600 + age, UsedAt: now}
+	}
+	exactOnMain := entry(main, "deps-exact", -1)
+	onRelease := entry(release, "deps-release", 0)
+	onMain := entry(main, "deps-main", 1)
+	onPull := entry(pull, "deps-pull", 2)
+	unscoped := entry("", "deps-unscoped", 3)
+	handler := newTestHandler(t, Policy{}, exactOnMain, onRelease, onMain, onPull, unscoped, entry("refs/pull/2/head", "deps-lost", 4))
+	for _, cache := range []*Cache{exactOnMain, onRelease, onMain, onPull, unscoped} {
+		writeBlob(t, handler, cache.ID)
+	}
+
+	db, err := handler.openDB()
+	require.NoError(t, err)
+	defer db.Close()
+
+	for _, tc := range []struct {
+		name string
+		cred JobCredential
+		keys []string
+		want *Cache
+	}{
+		{"the default branch never restores what a pull request wrote", JobCredential{Ref: main, DefaultRef: main}, []string{"deps-"}, onMain},
+		{"a pull request restores its own entry first", JobCredential{Ref: pull, BaseRef: release, DefaultRef: main}, []string{"deps-"}, onPull},
+		{"a pull request falls back past a lost blob to its base branch before the default branch", JobCredential{Ref: "refs/pull/2/head", BaseRef: release, DefaultRef: main}, []string{"deps-"}, onRelease},
+		{"a branch does not restore a sibling branch", JobCredential{Ref: "refs/heads/other", DefaultRef: main}, []string{"deps-"}, onMain},
+		{"a prefix in the own ref wins over an exact key in the default branch", JobCredential{Ref: release, DefaultRef: main}, []string{"deps-exact", "deps-"}, onRelease},
+		{"a job with a ref never restores entries saved without one", JobCredential{Ref: "refs/heads/other"}, []string{"deps-"}, nil},
+		{"a job without a ref only restores entries saved without one", JobCredential{}, []string{"deps-"}, unscoped},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			tc.cred.Repo = testRepo
+			cache, err := handler.lookupCache(db, tc.cred, tc.keys, "v")
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, cache)
+		})
+	}
+}
+
 func TestHandler_evictOnCommit(t *testing.T) {
 	t.Parallel()
 	full := &Cache{Repo: testRepo, Key: "full", Version: "v", Complete: true, Size: 4 * miB, UsedAt: time.Now().Add(-time.Hour).Unix()}
@@ -938,6 +982,7 @@ func TestHandler_CrossRepoIsolation(t *testing.T) {
 	defer handler.Close()
 	handler.RegisterJob("token-a", JobCredential{Repo: "owner/repoA"})
 	handler.RegisterJob("token-b", JobCredential{Repo: "owner/repoB"})
+	handler.RegisterJob("token-a-pull", JobCredential{Repo: "owner/repoA", Ref: "refs/pull/1/head"})
 
 	base := handler.ExternalURL() + apiPath
 	key := "shared-key"
@@ -972,13 +1017,20 @@ func TestHandler_CrossRepoIsolation(t *testing.T) {
 	resp.Body.Close()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
-	req, err = http.NewRequest(http.MethodPatch, fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader([]byte("poison")))
-	require.NoError(t, err)
-	req.Header.Set("Content-Range", "bytes 0-5/*")
-	resp, err = clientB.Do(req)
-	require.NoError(t, err)
-	resp.Body.Close()
-	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+	for _, client := range []*http.Client{clientB, {Transport: &bearerTransport{token: "token-a-pull"}}} {
+		req, err = http.NewRequest(http.MethodPatch, fmt.Sprintf("%s/caches/%d", base, id), bytes.NewReader([]byte("poison")))
+		require.NoError(t, err)
+		req.Header.Set("Content-Range", "bytes 0-5/*")
+		resp, err = client.Do(req)
+		require.NoError(t, err)
+		resp.Body.Close()
+		assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+		resp, err = client.Post(fmt.Sprintf("%s/caches/%d", base, id), "", nil)
+		require.NoError(t, err)
+		resp.Body.Close()
+		assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+	}
 }
 
 func TestHandler_ArtifactSignature(t *testing.T) {
@@ -1083,49 +1135,20 @@ func TestHandler_ArtifactSignatureDownload(t *testing.T) {
 	assert.Equal(t, content, body)
 }
 
-func TestHandler_GC_PerRepoDedup(t *testing.T) {
+func TestHandler_GC_DedupPerRepoAndRef(t *testing.T) {
 	t.Parallel()
-	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(Options{Dir: dir})
-	require.NoError(t, err)
-	defer handler.Close()
-	handler.RegisterJob("tok-a", JobCredential{Repo: "owner/repoA"})
-	handler.RegisterJob("tok-b", JobCredential{Repo: "owner/repoB"})
-
-	key := "shared-dedup-key"
-	version := "c19da02a2bd7e77277f1ac29ab45c09b7d46a4ee758284e26bb3045ad11d9d20"
-
-	db, err := handler.openDB()
-	require.NoError(t, err)
 	now := time.Now().Unix()
 	stale := time.Now().Add(-inUseGrace - time.Minute).Unix()
-	a := &Cache{Repo: "owner/repoA", Key: key, Version: version, Complete: true, CreatedAt: stale, UsedAt: stale, Size: 1}
-	b := &Cache{Repo: "owner/repoB", Key: key, Version: version, Complete: true, CreatedAt: now, UsedAt: now, Size: 1}
-	require.NoError(t, handler.insertCache(db, a))
-	require.NoError(t, handler.insertCache(db, b))
-	require.NoError(t, handler.storage.Write(a.ID, 0, strings.NewReader("a")))
-	_, err = handler.storage.Commit(a.ID, 1)
-	require.NoError(t, err)
-	require.NoError(t, handler.storage.Write(b.ID, 0, strings.NewReader("b")))
-	_, err = handler.storage.Commit(b.ID, 1)
-	require.NoError(t, err)
-	require.NoError(t, db.Close())
-
+	entries := []*Cache{
+		{Repo: "owner/repoA", Key: "shared", Version: "v", Complete: true, CreatedAt: stale, UsedAt: stale, Size: 1},
+		{Repo: "owner/repoB", Key: "shared", Version: "v", Complete: true, CreatedAt: now, UsedAt: now, Size: 1},
+		{Repo: "owner/repoA", Ref: "refs/pull/1/head", Key: "shared", Version: "v", Complete: true, CreatedAt: now, UsedAt: now, Size: 1},
+	}
+	handler := newTestHandler(t, Policy{}, entries...)
 	handler.gcAt = time.Time{}
 	handler.gcCache()
 
-	db, err = handler.openDB()
-	require.NoError(t, err)
-	defer db.Close()
-	after, err := db.find(func(cache *Cache) bool { return cache.Key == key && cache.Version == version })
-	require.NoError(t, err)
-
-	repos := make(map[string]bool)
-	for _, c := range after {
-		repos[c.Repo] = true
-	}
-	assert.True(t, repos["owner/repoA"], "repoA's cache must survive dedup against repoB")
-	assert.True(t, repos["owner/repoB"], "repoB's cache must survive dedup against repoA")
+	assert.Len(t, keptKeys(t, handler, entries), len(entries))
 }
 
 func TestHandler_InternalAPI_Disabled(t *testing.T) {
@@ -1190,10 +1213,10 @@ func TestHandler_InternalAPI_AuthAndUsage(t *testing.T) {
 		}
 
 		assert.Equal(t, http.StatusUnauthorized, probe("via-internal-api"))
-		assert.Equal(t, http.StatusOK, post("/_internal/register", secret, `{"token":"via-internal-api","repo":"owner/repo","public_url":"http://runner.example","results":"https://gitea.example","insecure_tls":true}`))
+		assert.Equal(t, http.StatusOK, post("/_internal/register", secret, `{"token":"via-internal-api","repo":"owner/repo","ref":"refs/pull/1/head","base_ref":"refs/heads/release","default_ref":"refs/heads/main","public_url":"http://runner.example","results":"https://gitea.example","insecure_tls":true}`))
 		cred, ok := handler.lookupCredential("via-internal-api")
 		require.True(t, ok)
-		assert.Equal(t, JobCredential{Repo: testRepo, PublicURL: "http://runner.example"}, cred)
+		assert.Equal(t, JobCredential{Repo: testRepo, Ref: "refs/pull/1/head", BaseRef: "refs/heads/release", DefaultRef: "refs/heads/main", PublicURL: "http://runner.example"}, cred)
 		assert.NotEqual(t, http.StatusUnauthorized, probe("via-internal-api"))
 		assert.Equal(t, http.StatusOK, post("/_internal/revoke", secret, `{"token":"via-internal-api"}`))
 		assert.Equal(t, http.StatusUnauthorized, probe("via-internal-api"))

act/artifactcache/handler_v2.go

@@ -73,7 +73,7 @@ func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request) {
 	// An exact (key, version) match means the entry is already cached; the client then skips
 	// the upload. A prefix match must not count here, or a shorter key would be reported as
 	// existing and silently never saved.
-	if existing, err := findExactCache(db, cred.Repo, req.Key, req.Version, true); err != nil {
+	if existing, err := findExactCache(db, cred, req.Key, req.Version, true); err != nil {
 		h.twirpError(w, r, twirpInternal, err)
 		return
 	} else if existing != nil {
@@ -84,7 +84,7 @@ func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request) {
 
 	// A second live reservation is finalized by whichever job calls last, against the other's upload.
 	owner := hashedToken(bearerToken(r))
-	if pending, err := findExactCache(db, cred.Repo, req.Key, req.Version, false); err != nil {
+	if pending, err := findExactCache(db, cred, req.Key, req.Version, false); err != nil {
 		h.twirpError(w, r, twirpInternal, err)
 		return
 	} else if pending != nil && pending.UsedAt > time.Now().Add(-uploadStallTimeout).Unix() {
@@ -103,6 +103,7 @@ func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request) {
 	now := time.Now()
 	cache := &Cache{
 		Repo:           cred.Repo,
+		Ref:            cred.Ref,
 		Key:            req.Key,
 		Version:        req.Version,
 		Owner:          owner,
@@ -137,13 +138,13 @@ func (h *Handler) v2FinalizeCacheEntryUpload(w http.ResponseWriter, r *http.Requ
 	}
 	defer db.Close()
 
-	cache, err := findExactCache(db, cred.Repo, req.Key, req.Version, false)
+	cache, err := findExactCache(db, cred, req.Key, req.Version, false)
 	if err == nil && cache != nil && cache.Owner != hashedToken(bearerToken(r)) {
 		cache = nil // not the reservation this job made, so not this job's to commit
 	}
 	if err == nil && cache == nil {
 		// A retry whose first response was lost finds the entry already committed.
-		cache, err = findExactCache(db, cred.Repo, req.Key, req.Version, true)
+		cache, err = findExactCache(db, cred, req.Key, req.Version, true)
 	}
 	if err != nil {
 		h.twirpError(w, r, twirpInternal, err)
@@ -186,7 +187,7 @@ func (h *Handler) v2GetCacheEntryDownloadURL(w http.ResponseWriter, r *http.Requ
 	}
 	defer db.Close()
 
-	cache, err := h.lookupCache(db, cred.Repo, req.keys(), req.Version)
+	cache, err := h.lookupCache(db, cred, req.keys(), req.Version)
 	if err != nil {
 		h.twirpError(w, r, twirpInternal, err)
 		return

act/artifactcache/handler_v2_test.go

@@ -231,6 +231,24 @@ func TestCacheServiceV2Lookups(t *testing.T) {
 		got := v2Call(t, handler, otherClient, "GetCacheEntryDownloadURL", map[string]any{"key": "deps-abc", "version": "v1"})
 		assert.Equal(t, false, got["ok"])
 	})
+
+	t.Run("each ref saves and restores its own entry for the same key", func(t *testing.T) {
+		clients := map[string]*http.Client{"x": testClient}
+		for _, ref := range []string{"y", "z"} {
+			handler.RegisterJob(ref, JobCredential{Repo: testRepo, Ref: "refs/pull/" + ref + "/head"})
+			clients[ref] = &http.Client{Transport: &bearerTransport{token: ref}}
+			created := v2Call(t, handler, clients[ref], "CreateCacheEntry", map[string]any{"key": "deps-abc", "version": "v1"})
+			require.Equal(t, true, created["ok"])
+			require.Equal(t, http.StatusCreated, putBlob(t, created["signed_upload_url"].(string), []byte(ref)))
+		}
+		for _, ref := range []string{"y", "z"} {
+			require.Equal(t, true, v2Call(t, handler, clients[ref], "FinalizeCacheEntryUpload", map[string]any{"key": "deps-abc", "version": "v1", "size_bytes": 1})["ok"])
+		}
+		for content, client := range clients {
+			got := v2Call(t, handler, client, "GetCacheEntryDownloadURL", map[string]any{"key": "deps-abc", "version": "v1"})
+			assert.Equal(t, content, string(getURL(t, got["signed_download_url"].(string))))
+		}
+	})
 }
 
 func TestCacheServiceV2RefusalsAreTwirp(t *testing.T) {

act/artifactcache/model.go

@@ -15,6 +15,7 @@ type Request struct {
 type Cache struct {
 	ID             uint64 `json:"id"`
 	Repo           string `json:"repo"`
+	Ref            string `json:"ref,omitzero"`
 	Key            string `json:"key"`
 	Version        string `json:"version"`
 	Size           int64  `json:"cacheSize"`

act/container/kubernetes.go

@@ -10,10 +10,12 @@ import (
 	"compress/gzip"
 	"context"
 	"crypto/rand"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"maps"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
@@ -24,6 +26,7 @@ import (
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
+	"gitea.com/gitea/runner/act/common/logging"
 
 	"github.com/kballard/go-shellquote"
 	"github.com/spf13/pflag"
@@ -37,6 +40,7 @@ type KubernetesOptions struct {
 	MaxLifetime  time.Duration
 	ForcePull    bool
 	RunnerUUID   string
+	Transfer     *KubernetesTransfer
 }
 
 // KubernetesPod runs a job container and its service containers as one pod.
@@ -47,6 +51,10 @@ type KubernetesPod struct {
 	job              *kubernetesContainer
 	services         []*kubernetesContainer
 	arch, path       string
+	ips              []net.IP
+	transfer         *transferServer
+	transferImage    string
+	transferHelper   string // empty when copies go through the API server
 }
 
 type kubernetesContainer struct {
@@ -76,6 +84,7 @@ type podStatus struct {
 	Spec   struct{ Containers []struct{} }
 	Status struct {
 		Phase, Reason, Message                   string
+		PodIPs                                   []struct{ IP string }
 		Conditions                               []struct{ Type, Status, Message string }
 		InitContainerStatuses, ContainerStatuses []containerStatus
 	}
@@ -131,14 +140,24 @@ func (p *KubernetesPod) create(ctx context.Context) error {
 		labels[runnerUUIDLabel] = p.options.RunnerUUID
 	}
 	metadata := map[string]any{"name": name, "labels": labels}
+	var runnerImage string
 	if hostname, err := os.Hostname(); p.client.inCluster && err == nil {
-		var runner struct{ Metadata struct{ Name, UID string } }
+		var runner struct {
+			Metadata struct{ Name, UID string }
+			Spec     struct{ Containers []struct{ Image string } }
+		}
 		if err := p.client.do(ctx, http.MethodGet, p.client.path("pods/"+hostname), nil, &runner); err == nil {
 			metadata["ownerReferences"] = []any{map[string]any{"apiVersion": "v1", "kind": "Pod", "name": runner.Metadata.Name, "uid": runner.Metadata.UID}}
+			if len(runner.Spec.Containers) == 1 {
+				runnerImage = runner.Spec.Containers[0].Image
+			}
 		} else {
 			common.Logger(ctx).Debugf("The runner is not pod %s, job pods get no owner: %v", hostname, err)
 		}
 	}
+	if err := p.setupTransfer(runnerImage); err != nil {
+		return err
+	}
 	secretData := map[string]string{}
 	manifest, err := p.manifest(name, secretData, metadata)
 	if err != nil {
@@ -207,6 +226,18 @@ func (p *KubernetesPod) manifest(secret string, secretData map[string]string, me
 		}
 	}
 	spec := map[string]any{"restartPolicy": "Never", "containers": containers, "volumes": volumes}
+	if p.transferHelper != "" {
+		transfer := map[string]any{
+			"name": "gitea-runner-transfer", "image": p.transferImage, "terminationMessagePolicy": "FallbackToLogsOnError",
+			"command":         []string{"gitea-runner", KubernetesTransferCommand, "install", p.transferHelper},
+			"volumeMounts":    []any{map[string]any{"name": "act", "mountPath": p.job.GetActPath()}},
+			"securityContext": map[string]any{"allowPrivilegeEscalation": false, "capabilities": map[string]any{"drop": []string{"ALL"}}},
+		}
+		if p.options.ForcePull {
+			transfer["imagePullPolicy"] = "Always"
+		}
+		spec["initContainers"] = []any{transfer}
+	}
 	if len(hostnames) > 0 {
 		spec["hostAliases"] = []any{map[string]any{"ip": "127.0.0.1", "hostnames": hostnames}}
 	}
@@ -343,7 +374,13 @@ func (p *KubernetesPod) waitStarted(ctx context.Context) error {
 			return err
 		}
 		if pod.Status.Phase == "Failed" {
-			return fmt.Errorf("pod %s failed: %s", p.name, cmp.Or(pod.Status.Message, pod.Status.Reason))
+			reason := cmp.Or(pod.Status.Message, pod.Status.Reason)
+			for _, status := range append(pod.Status.InitContainerStatuses, pod.Status.ContainerStatuses...) {
+				if terminated := status.State.Terminated; reason == "" && terminated != nil && terminated.ExitCode != 0 {
+					reason = fmt.Sprintf("container %s exited with %d: %s", status.Name, terminated.ExitCode, strings.TrimSpace(terminated.Message))
+				}
+			}
+			return fmt.Errorf("pod %s failed: %s", p.name, reason)
 		}
 		started := len(pod.Status.ContainerStatuses) == len(pod.Spec.Containers)
 		for _, status := range append(pod.Status.InitContainerStatuses, pod.Status.ContainerStatuses...) {
@@ -356,6 +393,9 @@ func (p *KubernetesPod) waitStarted(ctx context.Context) error {
 			}
 		}
 		if started {
+			for _, ip := range pod.Status.PodIPs {
+				p.ips = append(p.ips, net.ParseIP(ip.IP))
+			}
 			return nil
 		}
 		for _, condition := range pod.Status.Conditions {
@@ -457,22 +497,35 @@ func (c *kubernetesContainer) Exec(command []string, env map[string]string, _, w
 	}
 }
 
-// compressCopyMin is the size from which Copy compresses: below it gzip saves next to nothing on the wire and costs a process in the pod.
+// compressCopyMin is the size from which Copy compresses and uses the transfer helper: below it that saves next to nothing on the wire and costs a process in the pod.
 const compressCopyMin = 64 << 10
 
-// extract streams the tar write produces into destPath over exec, which goes through the API server.
-// With compress it is gzipped on the way, as copied actions shrink about fivefold and API server traffic often crosses zones.
+// extract streams the tar write produces into destPath, gzipped with compress, as copied actions shrink about fivefold and API server traffic often crosses zones.
 func (c *kubernetesContainer) extract(ctx context.Context, destPath string, compress bool, write func(io.Writer) error) error {
+	if compress && c.pod.transferHelper != "" {
+		request, done := c.pod.transfer.offer(c.pod.ips, write)
+		stdin, _ := json.Marshal(request)
+		var stderr bytes.Buffer
+		err := c.pod.client.exec(ctx, c.pod.name, c.name, []string{c.pod.transferHelper, KubernetesTransferCommand, "fetch", destPath}, bytes.NewReader(stdin), io.Discard, &stderr)
+		taken, writeErr := done()
+		if err == nil || ctx.Err() != nil {
+			return err
+		}
+		if taken || !c.pod.options.Transfer.Fallback {
+			return fmt.Errorf("copy to %s over the pod network: %w: %s", destPath, errors.Join(writeErr, err), strings.TrimSpace(stderr.String()))
+		}
+		c.pod.transferHelper = "" // a pod that cannot reach the runner once will not later
+		logging.Warnf("Copying into pod %s over the pod network failed, copying through the API server instead: %v: %s", c.pod.name, err, strings.TrimSpace(stderr.String()))
+	}
 	compress = compress && c.gzip
 	reader, writer := io.Pipe()
 	defer reader.Close()
 	go func() {
-		if !compress {
+		if compress {
+			writer.CloseWithError(writeGzip(writer, write))
+		} else {
 			writer.CloseWithError(write(writer))
-			return
 		}
-		compressed, _ := gzip.NewWriterLevel(writer, gzip.BestSpeed) // fast enough to not slow copies down, nearly as small as the default level
-		writer.CloseWithError(errors.Join(write(compressed), compressed.Close()))
 	}()
 	script := `mkdir -p "$1" && tar -xf - -C "$1"`
 	if compress {
@@ -485,6 +538,12 @@ func (c *kubernetesContainer) extract(ctx context.Context, destPath string, comp
 	return nil
 }
 
+// writeGzip gzips what write produces into w, at a level fast enough to not slow copies down and nearly as small as the default.
+func writeGzip(w io.Writer, write func(io.Writer) error) error {
+	compressed, _ := gzip.NewWriterLevel(w, gzip.BestSpeed)
+	return errors.Join(write(compressed), compressed.Close())
+}
+
 func (c *kubernetesContainer) Copy(destPath string, files ...*FileEntry) common.Executor {
 	return func(ctx context.Context) error {
 		size := 0

act/container/kubernetes_test.go

@@ -403,6 +403,13 @@ func TestKubernetesPodFailsBeforeSteps(t *testing.T) {
 	job := pod.JobContainer(&NewContainerInput{Image: "missing"})
 	require.NoError(t, job.Create(nil, nil)(t.Context()))
 	require.ErrorContains(t, job.Start(false)(t.Context()), "ErrImagePull: no such image")
+	failed, _ := fakeKubernetes(t, `{"spec":{"containers":[{}]},"status":{"phase":"Failed","initContainerStatuses":[
+		{"name":"gitea-runner-transfer","state":{"terminated":{"exitCode":1,"message":"exec format error\n"}}}]}}`)
+	pod, err = NewKubernetesPod(KubernetesOptions{Kubeconfig: failed})
+	require.NoError(t, err)
+	job = pod.JobContainer(&NewContainerInput{Image: "node"})
+	require.NoError(t, job.Create(nil, nil)(t.Context()))
+	require.ErrorContains(t, job.Start(false)(t.Context()), "container gitea-runner-transfer exited with 1: exec format error")
 
 	plugin := filepath.Join(t.TempDir(), "kubeconfig")
 	require.NoError(t, os.WriteFile(plugin, []byte(`

act/container/kubernetes_transfer.go

@@ -0,0 +1,248 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"cmp"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"gitea.com/gitea/runner/act/common"
+	"gitea.com/gitea/runner/act/common/logging"
+)
+
+// KubernetesTransfer has job pods fetch large copies from the runner over the pod network instead of through the API server.
+type KubernetesTransfer struct {
+	Host     string // empty uses the outbound IP
+	Port     uint16 // 0 picks a free port
+	Image    string // has gitea-runner on its PATH, for an init container to copy into each job pod
+	Fallback bool   // copy through the API server when a job pod cannot reach the runner, else fail
+}
+
+// KubernetesTransferCommand is the hidden runner subcommand job pods run the transfer helper with.
+const KubernetesTransferCommand = "kubernetes-transfer"
+
+// transferRequest goes to the helper on the exec stream's stdin, keeping the token out of the command line and the audit log.
+type transferRequest struct {
+	URL string `json:"url"`
+	Pin string `json:"pin"` // hex SHA-256 of the runner's certificate
+}
+
+type transferServer struct {
+	base    string
+	pin     string
+	mu      sync.Mutex
+	pending map[string]transferOffer
+}
+
+type transferOffer struct {
+	clients []net.IP
+	write   func(io.Writer) error
+	result  chan error
+}
+
+var (
+	transferServersMu sync.Mutex
+	transferServers   = map[string]*transferServer{}
+)
+
+// startTransferServer returns the runner's server for these settings, started on first use.
+func startTransferServer(host string, port uint16) (*transferServer, error) {
+	transferServersMu.Lock()
+	defer transferServersMu.Unlock()
+	configured := net.JoinHostPort(host, strconv.Itoa(int(port)))
+	if server, ok := transferServers[configured]; ok {
+		return server, nil
+	}
+	if host == "" {
+		ip := common.GetOutboundIP()
+		if ip == nil {
+			return nil, errors.New("no outbound IP for job pods to reach the runner at, set kubernetes.transfer.host")
+		}
+		host = ip.String()
+	}
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	template := &x509.Certificate{SerialNumber: big.NewInt(1)} // trusted by its pin alone, so no CA, names or validity
+	certificate, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		return nil, err
+	}
+	listener, err := net.Listen("tcp", net.JoinHostPort(host, strconv.Itoa(int(port))))
+	if err != nil {
+		return nil, fmt.Errorf("listen for job pod transfers: %w", err)
+	}
+	pin := sha256.Sum256(certificate)
+	server := &transferServer{base: "https://" + listener.Addr().String() + "/", pin: hex.EncodeToString(pin[:]), pending: map[string]transferOffer{}}
+	httpServer := &http.Server{
+		Handler:           server,
+		TLSConfig:         &tls.Config{Certificates: []tls.Certificate{{Certificate: [][]byte{certificate}, PrivateKey: privateKey}}, MinVersion: tls.VersionTLS13},
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       30 * time.Second,
+	}
+	go func() { _ = httpServer.ServeTLS(listener, "", "") }()
+	transferServers[configured] = server
+	return server, nil
+}
+
+// offer serves write once to one of clients until done, which reports whether a client took it and what write failed with.
+func (s *transferServer) offer(clients []net.IP, write func(io.Writer) error) (request transferRequest, done func() (taken bool, err error)) {
+	token := rand.Text()
+	result := make(chan error, 1)
+	s.mu.Lock()
+	s.pending[token] = transferOffer{clients: clients, write: write, result: result}
+	s.mu.Unlock()
+	return transferRequest{URL: s.base + token, Pin: s.pin}, func() (bool, error) {
+		s.mu.Lock()
+		_, pending := s.pending[token]
+		delete(s.pending, token)
+		s.mu.Unlock()
+		select {
+		case err := <-result:
+			return true, err
+		default:
+			return !pending, nil
+		}
+	}
+}
+
+func (s *transferServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	host, _, _ := net.SplitHostPort(r.RemoteAddr)
+	token := strings.TrimPrefix(r.URL.Path, "/")
+	s.mu.Lock()
+	offer, ok := s.pending[token]
+	ok = ok && r.Method == http.MethodGet && slices.ContainsFunc(offer.clients, net.ParseIP(host).Equal)
+	if ok {
+		delete(s.pending, token)
+	}
+	s.mu.Unlock()
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Encoding", "gzip")
+	err := writeGzip(w, offer.write)
+	offer.result <- err
+	if err != nil {
+		panic(http.ErrAbortHandler) // a cut-off body fails the fetch, a short tar might not
+	}
+}
+
+// FetchKubernetesTransfer reads a transferRequest from request and extracts the tar it points to into dest.
+func FetchKubernetesTransfer(ctx context.Context, request io.Reader, dest string) error {
+	var transfer transferRequest
+	if err := json.NewDecoder(request).Decode(&transfer); err != nil {
+		return fmt.Errorf("read transfer request: %w", err)
+	}
+	client := &http.Client{Transport: &http.Transport{
+		DialContext:           (&net.Dialer{Timeout: 10 * time.Second}).DialContext,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ResponseHeaderTimeout: time.Minute,
+		TLSClientConfig: &tls.Config{
+			MinVersion:         tls.VersionTLS13,
+			InsecureSkipVerify: true, // VerifyConnection checks the pin instead
+			VerifyConnection: func(state tls.ConnectionState) error {
+				if sum := sha256.Sum256(state.PeerCertificates[0].Raw); hex.EncodeToString(sum[:]) != transfer.Pin {
+					return errors.New("runner certificate does not match the pin")
+				}
+				return nil
+			},
+		},
+	}}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodGet, transfer.URL, nil)
+	if err != nil {
+		return err
+	}
+	response, err := client.Do(httpRequest)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return fmt.Errorf("fetch: %s", response.Status)
+	}
+	if err := os.MkdirAll(dest, 0o777); err != nil {
+		return err
+	}
+	cmd := exec.CommandContext(ctx, "tar", "-xf", "-", "-C", dest)
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = response.Body, os.Stderr, os.Stderr
+	if err := cmd.Run(); err != nil {
+		return err
+	}
+	_, err = io.Copy(io.Discard, response.Body) // tar stops at the first zero blocks, a cut-off body after them still fails
+	return err
+}
+
+// InstallKubernetesTransferHelper copies the running binary to target.
+func InstallKubernetesTransferHelper(target string) error {
+	executable, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	source, err := os.Open(executable)
+	if err != nil {
+		return err
+	}
+	defer source.Close()
+	if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+		return err
+	}
+	_ = os.Remove(target) // a file left in a reused act volume would keep its mode
+	file, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o755)
+	if err != nil {
+		return err
+	}
+	_, err = io.Copy(file, source)
+	return errors.Join(err, file.Close())
+}
+
+// setupTransfer turns on transfers for the pod, with the runner pod's image unless one is set.
+func (p *KubernetesPod) setupTransfer(runnerImage string) error {
+	settings := p.options.Transfer
+	if settings == nil {
+		return nil
+	}
+	image := cmp.Or(settings.Image, runnerImage)
+	var err error
+	var server *transferServer
+	if image == "" {
+		err = errors.New("set kubernetes.transfer.image, the runner is no single-container pod in kubernetes.namespace to take it from")
+	} else {
+		server, err = startTransferServer(settings.Host, settings.Port)
+	}
+	if err != nil {
+		if !settings.Fallback {
+			return fmt.Errorf("kubernetes.transfer: %w", err)
+		}
+		logging.Warnf("Job pod copies go through the API server: %v", err)
+		return nil
+	}
+	p.transfer, p.transferImage = server, image
+	p.transferHelper = path.Join(p.job.GetActPath(), "bin", "gitea-runner")
+	return nil
+}

act/container/kubernetes_transfer_test.go

@@ -0,0 +1,185 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const transferHelperEnv = "GITEA_RUNNER_TEST_TRANSFER_HELPER"
+
+func TestMain(m *testing.M) {
+	if os.Getenv(transferHelperEnv) == "1" && len(os.Args) == 4 && os.Args[1] == KubernetesTransferCommand && os.Args[2] == "fetch" {
+		if err := FetchKubernetesTransfer(context.Background(), os.Stdin, os.Args[3]); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		os.Exit(0)
+	}
+	os.Exit(m.Run())
+}
+
+func fetch(t *testing.T, request transferRequest) error {
+	t.Helper()
+	body, err := json.Marshal(request)
+	require.NoError(t, err)
+	return FetchKubernetesTransfer(t.Context(), bytes.NewReader(body), t.TempDir())
+}
+
+func TestTransferServer(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("extracts with tar")
+	}
+	server, err := startTransferServer("127.0.0.1", 0)
+	require.NoError(t, err)
+	again, err := startTransferServer("127.0.0.1", 0)
+	require.NoError(t, err)
+	assert.Same(t, server, again)
+	loopback := []net.IP{net.ParseIP("127.0.0.1")}
+	nothing := func(io.Writer) error { return nil }
+
+	t.Run("serves an offer gzipped once to an IP of its job pod", func(t *testing.T) {
+		request, done := server.offer([]net.IP{net.ParseIP("fd00::1"), loopback[0]}, nothing)
+		client := &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, DisableCompression: true}}
+		response, err := client.Get(request.URL)
+		require.NoError(t, err)
+		require.NoError(t, response.Body.Close())
+		assert.Equal(t, "gzip", response.Header.Get("Content-Encoding"))
+		require.ErrorContains(t, fetch(t, request), "404")
+		taken, _ := done()
+		assert.True(t, taken)
+	})
+
+	t.Run("another pod can neither take nor block an offer", func(t *testing.T) {
+		request, done := server.offer([]net.IP{net.ParseIP("10.1.2.3")}, nothing)
+		require.ErrorContains(t, fetch(t, request), "404")
+		taken, _ := done()
+		assert.False(t, taken)
+	})
+
+	t.Run("a failed write fails the fetch even past the end blocks tar stops at, and done reports it", func(t *testing.T) {
+		request, done := server.offer(loopback, func(w io.Writer) error {
+			_, _ = w.Write(make([]byte, 1024))
+			_, _ = io.CopyN(w, rand.Reader, 1<<20)
+			return errors.New("source gone")
+		})
+		require.Error(t, fetch(t, request))
+		taken, err := done()
+		assert.True(t, taken)
+		require.EqualError(t, err, "source gone")
+	})
+
+	t.Run("the helper refuses a runner whose certificate does not match its pin", func(t *testing.T) {
+		request, done := server.offer(loopback, nothing)
+		request.Pin = strings.Repeat("0", 64)
+		require.ErrorContains(t, fetch(t, request), "does not match the pin")
+		taken, _ := done()
+		assert.False(t, taken)
+	})
+}
+
+func TestKubernetesPodTransferImage(t *testing.T) {
+	newPod := func(image string, fallback bool) *KubernetesPod {
+		pod := &KubernetesPod{options: KubernetesOptions{Transfer: &KubernetesTransfer{Host: "127.0.0.1", Image: image, Fallback: fallback}}}
+		pod.JobContainer(&NewContainerInput{})
+		return pod
+	}
+
+	pod := newPod("", false)
+	require.NoError(t, pod.setupTransfer("gitea/runner:latest"))
+	assert.Equal(t, "gitea/runner:latest", pod.transferImage)
+
+	pod = newPod("registry.example/runner:1", false)
+	require.NoError(t, pod.setupTransfer("gitea/runner:latest"))
+	assert.Equal(t, "registry.example/runner:1", pod.transferImage)
+
+	pod = newPod("", true)
+	require.NoError(t, pod.setupTransfer(""))
+	assert.Empty(t, pod.transferHelper)
+
+	pod = newPod("", false)
+	require.ErrorContains(t, pod.setupTransfer(""), "kubernetes.transfer.image")
+}
+
+func TestKubernetesPodCopiesLargeFilesOverPodNetwork(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("uses POSIX shell")
+	}
+	ctx := t.Context()
+	workdir, err := filepath.EvalSymlinks(t.TempDir())
+	require.NoError(t, err)
+	kubeconfig, cluster := fakeKubernetes(t, `{"spec":{"containers":[{}]},"status":{"phase":"Running","podIPs":[{"ip":"127.0.0.1"}],"containerStatuses":[
+		{"name":"job","ready":true,"state":{"running":{}}}]}}`, transferHelperEnv+"=1")
+	pod, err := NewKubernetesPod(KubernetesOptions{Kubeconfig: kubeconfig, ForcePull: true, Transfer: &KubernetesTransfer{Host: "127.0.0.1", Image: "gitea/runner:latest", Fallback: true}})
+	require.NoError(t, err)
+	job := pod.JobContainer(&NewContainerInput{Name: "job", Image: "node", WorkingDir: workdir, Stdout: io.Discard, Stderr: io.Discard})
+	require.NoError(t, job.Create(nil, nil)(ctx))
+
+	var manifest struct {
+		Spec struct {
+			InitContainers []struct {
+				Image, ImagePullPolicy string
+				Command                []string
+				VolumeMounts           []struct{ Name, MountPath string }
+			}
+		}
+	}
+	require.NoError(t, json.Unmarshal([]byte(cluster.requests["POST /api/v1/namespaces/ci/pods"][0]), &manifest))
+	require.Len(t, manifest.Spec.InitContainers, 1)
+	initContainer := manifest.Spec.InitContainers[0]
+	assert.Equal(t, "gitea/runner:latest", initContainer.Image)
+	assert.Equal(t, "Always", initContainer.ImagePullPolicy)
+	assert.Equal(t, []string{"gitea-runner", KubernetesTransferCommand, "install", "/var/run/act/bin/gitea-runner"}, initContainer.Command)
+	assert.Equal(t, []struct{ Name, MountPath string }{{"act", "/var/run/act"}}, initContainer.VolumeMounts)
+	require.NoError(t, job.Start(false)(ctx))
+
+	helper := filepath.Join(t.TempDir(), "bin", "gitea-runner")
+	require.NoError(t, InstallKubernetesTransferHelper(helper))
+	pod.transferHelper = helper
+	lastExec := func() string { return cluster.requests["exec"][len(cluster.requests["exec"])-1] }
+	large := &FileEntry{Name: "large", Mode: 0o644, Body: strings.Repeat("a", compressCopyMin)}
+	copyLarge := func(dir string) error { return job.Copy(filepath.Join(workdir, dir)+"/", large)(ctx) }
+	require.NoError(t, copyLarge("transferred"))
+	content, err := os.ReadFile(filepath.Join(workdir, "transferred", "large"))
+	require.NoError(t, err)
+	assert.Equal(t, large.Body, string(content))
+	assert.Contains(t, lastExec(), "command="+KubernetesTransferCommand)
+	assert.NotContains(t, lastExec(), "127.0.0.1")
+
+	require.NoError(t, job.Copy(workdir+"/act/", &FileEntry{Name: "event.json", Mode: 0o644, Body: `{}`})(ctx))
+	assert.NotContains(t, lastExec(), "command="+KubernetesTransferCommand)
+
+	require.NoError(t, os.WriteFile(filepath.Join(workdir, "file"), nil, 0o644))
+	require.ErrorContains(t, copyLarge("file"), "over the pod network")
+	assert.Equal(t, helper, pod.transferHelper)
+
+	unreachable := filepath.Join(workdir, "unreachable")
+	require.NoError(t, os.WriteFile(unreachable, []byte("#!/bin/sh\necho 'connection refused' >&2\nexit 1\n"), 0o755))
+	pod.transferHelper = unreachable
+	pod.options.Transfer.Fallback = false
+	require.ErrorContains(t, copyLarge("direct"), "connection refused")
+	assert.NoFileExists(t, filepath.Join(workdir, "direct", "large"))
+
+	pod.options.Transfer.Fallback = true
+	require.NoError(t, copyLarge("auto"))
+	assert.FileExists(t, filepath.Join(workdir, "auto", "large"))
+	assert.Empty(t, pod.transferHelper)
+}

act/runner/action.go

@@ -456,6 +456,7 @@ func evalDockerEnv(ctx context.Context, step step, action *model.Action) (*expre
 		}
 	}
 	mergeIntoMap(step, step.getEnv(), runsEnv, maps.Clone(*step.getEnv()))
+	aliasGiteaEnv(*step.getEnv())
 	return ee, nil
 }
 

act/runner/action_composite_test.go

@@ -19,7 +19,7 @@ import (
 )
 
 func TestCompositeActionParity(t *testing.T) {
-	t.Run("input defaults use the step identity", func(t *testing.T) {
+	t.Run("input defaults use the step identity and docker env keeps the GITEA aliases", func(t *testing.T) {
 		for _, uses := range []string{"./action", "own/action@v2"} {
 			t.Run(uses, func(t *testing.T) {
 				rc := &RunContext{
@@ -33,13 +33,17 @@ func TestCompositeActionParity(t *testing.T) {
 					currentStep = &stepActionRemote{RunContext: rc, Step: &model.Step{Uses: uses}, env: map[string]string{}, remoteAction: mustNewRemoteAction(t, uses)}
 					want = "own/action|v2"
 				}
-				action := &model.Action{Inputs: map[string]model.Input{"identity": {Default: "${{ github.action_repository }}|${{ github.action_ref }}"}}}
+				action := &model.Action{
+					Inputs: map[string]model.Input{"identity": {Default: "${{ github.action_repository }}|${{ github.action_ref }}"}},
+					Runs:   model.ActionRuns{Env: map[string]string{"GITHUB_WORKFLOW_SHA": "runs-sha"}},
+				}
 				require.NoError(t, setupEnv(t.Context(), currentStep))
 				require.NoError(t, populateEnvsFromInput(t.Context(), currentStep, action))
 				assert.Equal(t, want, (*currentStep.getEnv())["INPUT_IDENTITY"])
 				_, err := evalDockerEnv(t.Context(), currentStep, action)
 				require.NoError(t, err)
 				assert.Equal(t, want, (*currentStep.getEnv())["identity"])
+				assert.Equal(t, "runs-sha", (*currentStep.getEnv())["GITEA_WORKFLOW_SHA"])
 			})
 		}
 	})

act/runner/job_executor_test.go

@@ -1047,23 +1047,25 @@ func makeTestRC(t *testing.T, jobYAML string) *RunContext {
 
 func TestApplyJobTimeout(t *testing.T) {
 	cases := []struct {
-		name        string
-		yaml        string
-		wantTimeout bool
+		name string
+		yaml string
+		want time.Duration
 	}{
-		{"empty", "runs-on: ubuntu-latest", false},
-		{"integer", "timeout-minutes: 5\nruns-on: ubuntu-latest", true},
-		{"zero ignored", "timeout-minutes: 0\nruns-on: ubuntu-latest", false},
-		{"non-numeric ignored", "timeout-minutes: abc\nruns-on: ubuntu-latest", false},
+		{"empty", "runs-on: ubuntu-latest", 0},
+		{"integer", "timeout-minutes: 5\nruns-on: ubuntu-latest", 5 * time.Minute},
+		{"zero ignored", "timeout-minutes: 0\nruns-on: ubuntu-latest", 0},
+		{"non-numeric ignored", "timeout-minutes: abc\nruns-on: ubuntu-latest", 0},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			rc := makeTestRC(t, tc.yaml)
-			ctx := t.Context()
-			newCtx, cancel := applyJobTimeout(ctx, rc, rc.Run.Job())
+			newCtx, cancel := applyJobTimeout(t.Context(), rc, rc.Run.Job())
 			defer cancel()
-			_, hasDeadline := newCtx.Deadline()
-			assert.Equal(t, tc.wantTimeout, hasDeadline)
+			deadline, hasDeadline := newCtx.Deadline()
+			assert.Equal(t, tc.want != 0, hasDeadline)
+			if hasDeadline {
+				assert.WithinDuration(t, time.Now().Add(tc.want), deadline, time.Minute)
+			}
 		})
 	}
 }

act/runner/job_hooks.go

@@ -84,8 +84,7 @@ func (rc *RunContext) setupHookFileCommands(ctx context.Context, env map[string]
 	actPath := rc.JobContainer.GetActPath()
 	env["GITHUB_ENV"] = path.Join(actPath, hookEnvFileCommand)
 	env["GITHUB_PATH"] = path.Join(actPath, hookPathFileCommand)
-	env["GITEA_ENV"] = env["GITHUB_ENV"]
-	env["GITEA_PATH"] = env["GITHUB_PATH"]
+	aliasGiteaEnv(env)
 
 	return rc.JobContainer.Copy(actPath,
 		&container.FileEntry{Name: hookEnvFileCommand, Mode: 0o666},

act/runner/job_hooks_test.go

@@ -121,6 +121,7 @@ func TestRunJobHook(t *testing.T) {
 		assert.Equal(t, "job", jobContainer.env["GITHUB_JOB"])
 		assert.Equal(t, "/var/run/act/workflow/hook-envs.txt", jobContainer.env["GITHUB_ENV"])
 		assert.Equal(t, "/var/run/act/workflow/hook-path.txt", jobContainer.env["GITHUB_PATH"])
+		assert.Equal(t, jobContainer.env["GITHUB_PATH"], jobContainer.env["GITEA_PATH"])
 	})
 
 	t.Run("each hook has its own command state", func(t *testing.T) {

act/runner/reusable_workflow.go

@@ -23,13 +23,14 @@ func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
 		return common.NewErrorExecutor(err)
 	}
 
-	if !rc.Config.NoSkipCheckout {
+	preset := rc.Config.PresetGitHubContext
+	if preset == nil {
 		// resolve the local workflow against the workspace root, not the process
 		// working directory, so it is found regardless of where the runner is invoked
 		return newReusableWorkflowExecutor(rc, rc.Config.Workdir, localWorkflow.Path, false)
 	}
 
-	uses := fmt.Sprintf("%s/%s@%s", rc.Config.PresetGitHubContext.Repository, localWorkflow.Path, rc.Config.PresetGitHubContext.Sha)
+	uses := fmt.Sprintf("%s/%s@%s", preset.Repository, localWorkflow.Path, preset.Sha)
 
 	remoteReusableWorkflow, err := newRemoteReusableWorkflow(rc.Config.GitHubInstance, uses)
 	if err != nil {

act/runner/reusable_workflow_test.go

@@ -122,7 +122,7 @@ func TestNewLocalReusableWorkflowExecutorFindsSameRepositoryPaths(t *testing.T)
 
 	for _, uses := range []string{"./.gitea/workflows/reusable.yml", "$/.gitea/workflows/reusable.yml"} {
 		rc := &RunContext{
-			Config: &Config{Workdir: workdir},
+			Config: &Config{Workdir: workdir, NoSkipCheckout: true},
 			Run:    &model.Run{JobID: "job", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"job": {Uses: uses}}}},
 		}
 		err := newLocalReusableWorkflowExecutor(rc)(t.Context())

act/runner/run_context.go

@@ -1602,6 +1602,23 @@ func isLocalCheckout(ghc *model.GithubContext, step *model.Step) bool {
 	return true
 }
 
+// aliasGiteaEnv mirrors the runner's GITHUB_* variables as GITEA_*, call it after the last write to them.
+func aliasGiteaEnv(env map[string]string) {
+	for _, suffix := range []string{
+		"ACTION", "ACTION_PATH", "ACTION_REF", "ACTION_REPOSITORY", "ACTIONS", "ACTOR", "ACTOR_ID", "API_URL", "BASE_REF",
+		"ENV", "EVENT_NAME", "EVENT_PATH", "GRAPHQL_URL", "HEAD_REF", "JOB", "OUTPUT", "PATH", "REF", "REF_NAME",
+		"REF_PROTECTED", "REF_TYPE", "REPOSITORY", "REPOSITORY_ID", "REPOSITORY_OWNER", "REPOSITORY_OWNER_ID",
+		"RETENTION_DAYS", "RUN_ATTEMPT", "RUN_ID", "RUN_NUMBER", "SERVER_URL", "SHA", "STATE", "STEP_SUMMARY",
+		"TRIGGERING_ACTOR", "WORKFLOW", "WORKFLOW_REF", "WORKFLOW_SHA", "WORKSPACE",
+	} {
+		if value, ok := env["GITHUB_"+suffix]; ok {
+			env["GITEA_"+suffix] = value
+		} else {
+			delete(env, "GITEA_"+suffix)
+		}
+	}
+}
+
 func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubContext, env map[string]string) {
 	if _, ok := env["CI"]; !ok {
 		env["CI"] = "true"
@@ -1654,6 +1671,7 @@ func (rc *RunContext) withGithubEnv(ctx context.Context, github *model.GithubCon
 
 	env["GITHUB_GRAPHQL_URL"] = ""
 	env["GITHUB_RUN_ATTEMPT"] = github.RunAttempt
+	aliasGiteaEnv(env)
 
 	env["RUNNER_NAME"] = rc.Config.RunnerName
 	env["RUNNER_ENVIRONMENT"] = "self-hosted"

act/runner/run_context_test.go

@@ -877,25 +877,25 @@ func TestGetGitHubContext(t *testing.T) {
 		RepositoryID:      "34",
 		RepositoryOwnerID: "56",
 		WorkflowRef:       "owner/repo/.gitea/workflows/test.yml@refs/heads/main",
-		WorkflowSha:       "workflow-sha",
 		RefProtected:      true,
 	}
 	ghc = rc.getGithubContext(t.Context())
 	assert.Equal(t, "preset-actor", ghc.Actor)
 	assert.Equal(t, "triggerer", ghc.TriggeringActor)
 	assert.Equal(t, "job1", ghc.Job)
-	env := map[string]string{}
+	env := map[string]string{"GITHUB_WORKFLOW_SHA": "workflow-sha"}
 	rc.withGithubEnv(t.Context(), ghc, env)
-	for name, value := range map[string]string{
-		"GITHUB_ACTOR_ID":            "12",
-		"GITHUB_TRIGGERING_ACTOR":    "triggerer",
-		"GITHUB_REPOSITORY_ID":       "34",
-		"GITHUB_REPOSITORY_OWNER_ID": "56",
-		"GITHUB_WORKFLOW_REF":        "owner/repo/.gitea/workflows/test.yml@refs/heads/main",
-		"GITHUB_WORKFLOW_SHA":        "workflow-sha",
-		"GITHUB_REF_PROTECTED":       "true",
+	for suffix, value := range map[string]string{
+		"ACTOR_ID":            "12",
+		"TRIGGERING_ACTOR":    "triggerer",
+		"REPOSITORY_ID":       "34",
+		"REPOSITORY_OWNER_ID": "56",
+		"WORKFLOW_REF":        "owner/repo/.gitea/workflows/test.yml@refs/heads/main",
+		"WORKFLOW_SHA":        "workflow-sha",
+		"REF_PROTECTED":       "true",
 	} {
-		assert.Equal(t, value, env[name], name)
+		assert.Equal(t, value, env["GITHUB_"+suffix], suffix)
+		assert.Equal(t, value, env["GITEA_"+suffix], suffix)
 	}
 	ghc.RefProtected = false
 	rc.withGithubEnv(t.Context(), ghc, env)
@@ -922,12 +922,12 @@ func TestGetGitHubContext(t *testing.T) {
 			github := rc.getGithubContext(t.Context())
 			assert.Equal(t, testcase.serverURL, github.ServerURL)
 			assert.Equal(t, testcase.apiURL, github.APIURL)
-			env := map[string]string{}
+			env := map[string]string{"GITEA_SERVER_URL": "stale", "GITEA_API_URL": "stale"}
 			rc.withGithubEnv(t.Context(), github, env)
 			_, exported := env["GITHUB_SERVER_URL"]
 			assert.Equal(t, testcase.serverURL != "", exported)
-			assert.Equal(t, testcase.serverURL, env["GITHUB_SERVER_URL"])
-			assert.Equal(t, testcase.apiURL, env["GITHUB_API_URL"])
+			assert.Equal(t, testcase.serverURL, env["GITEA_SERVER_URL"])
+			assert.Equal(t, testcase.apiURL, env["GITEA_API_URL"])
 		})
 	}
 }

act/runner/step.go

@@ -157,15 +157,7 @@ func runStepExecutor(step step, stage stepStage, executor common.Executor) commo
 		stepSummaryIndex := topRC.CurrentStepIndex
 		summaryFileCommand := path.Join("workflow", "step-summary-"+strconv.Itoa(stepSummaryIndex)+".md")
 		(*step.getEnv())["GITHUB_STEP_SUMMARY"] = path.Join(actPath, summaryFileCommand)
-
-		{
-			// For Gitea
-			(*step.getEnv())["GITEA_OUTPUT"] = (*step.getEnv())["GITHUB_OUTPUT"]
-			(*step.getEnv())["GITEA_STATE"] = (*step.getEnv())["GITHUB_STATE"]
-			(*step.getEnv())["GITEA_PATH"] = (*step.getEnv())["GITHUB_PATH"]
-			(*step.getEnv())["GITEA_ENV"] = (*step.getEnv())["GITHUB_ENV"]
-			(*step.getEnv())["GITEA_STEP_SUMMARY"] = (*step.getEnv())["GITHUB_STEP_SUMMARY"]
-		}
+		aliasGiteaEnv(*step.getEnv())
 
 		// Reset the per-phase file-command files. GITHUB_STEP_SUMMARY is intentionally
 		// excluded here and initialized below at most once per step so writes from later

act/runner/step_run_test.go

@@ -58,7 +58,10 @@ func TestStepRun(t *testing.T) {
 		},
 	}
 	sr.RunContext.ExprEval = sr.RunContext.NewExpressionEvaluator(t.Context())
-	require.NoError(t, sr.Step.Env.Encode(map[string]string{"GITHUB_ACTION_REPOSITORY": "forged/repo", "GITHUB_ACTION_REF": "forged-ref"}))
+	require.NoError(t, sr.Step.Env.Encode(map[string]string{
+		"GITHUB_ACTION_REPOSITORY": "forged/repo", "GITHUB_ACTION_REF": "forged-ref",
+		"GITEA_ACTION_REPOSITORY": "forged/repo", "GITEA_ACTION_REF": "forged-ref",
+	}))
 
 	cm.On("Copy", "/var/run/act", []*container.FileEntry{fileEntry}).Return(noopExecutor)
 	cm.On("Exec", []string{"bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "/var/run/act/workflow/1.sh"}, mock.AnythingOfType("map[string]string"), "", "workdir").Return(noopExecutor)
@@ -67,6 +70,9 @@ func TestStepRun(t *testing.T) {
 	require.NoError(t, sr.main()(t.Context()))
 	assert.Empty(t, sr.env["GITHUB_ACTION_REPOSITORY"])
 	assert.Empty(t, sr.env["GITHUB_ACTION_REF"])
+	assert.Empty(t, sr.env["GITEA_ACTION_REPOSITORY"])
+	assert.Empty(t, sr.env["GITEA_ACTION_REF"])
+	assert.Equal(t, sr.env["GITHUB_STEP_SUMMARY"], sr.env["GITEA_STEP_SUMMARY"])
 	assert.Equal(t, "other/composite", sr.RunContext.Env["GITHUB_ACTION_REPOSITORY"])
 	assert.Equal(t, "v1", sr.RunContext.Env["GITHUB_ACTION_REF"])
 

act/runner/step_test.go

@@ -155,18 +155,14 @@ func TestSetupEnv(t *testing.T) {
 	require.NoError(t, setupEnv(t.Context(), testStep))
 	require.NoError(t, setupInputs(t.Context(), testStep))
 
-	delete(env, "GITHUB_REF")
-	delete(env, "GITHUB_REF_NAME")
-	delete(env, "GITHUB_REF_TYPE")
-	delete(env, "GITHUB_SHA")
-	delete(env, "GITHUB_WORKSPACE")
-	delete(env, "GITHUB_REPOSITORY")
-	delete(env, "GITHUB_REPOSITORY_OWNER")
-	delete(env, "GITHUB_ACTOR")
+	for _, suffix := range []string{"REF", "REF_NAME", "REF_TYPE", "SHA", "WORKSPACE", "REPOSITORY", "REPOSITORY_OWNER", "ACTOR"} {
+		delete(env, "GITHUB_"+suffix)
+		delete(env, "GITEA_"+suffix)
+	}
 	delete(env, "RUNNER_NAME")
 	delete(env, "RUNNER_WORKSPACE")
 
-	assert.Equal(t, map[string]string{
+	expected := map[string]string{
 		"ACT":                      "true",
 		"ACT_SKIP_CHECKOUT":        "true",
 		"CI":                       "true",
@@ -193,7 +189,13 @@ func TestSetupEnv(t *testing.T) {
 		"RUNNER_ENVIRONMENT":       "self-hosted",
 		"RUNNER_PERFLOG":           "/dev/null",
 		"RUNNER_TRACKING_ID":       "",
-	}, env)
+	}
+	for name, value := range expected {
+		if suffix, ok := strings.CutPrefix(name, "GITHUB_"); ok {
+			expected["GITEA_"+suffix] = value
+		}
+	}
+	assert.Equal(t, expected, env)
 
 	for _, expression := range []string{"inputs.args", "env.ARGS"} {
 		t.Run("deferred inputs from "+expression, func(t *testing.T) {

act/runner/testdata/actions/docker-local-noargs/Dockerfile

@@ -1,5 +1,5 @@
 # Container image that runs your code
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 
 # Copies your code file from your action repository to the filesystem path `/` of the container
 COPY entrypoint.sh /entrypoint.sh

act/runner/testdata/actions/docker-local/Dockerfile

@@ -1,5 +1,5 @@
 # Container image that runs your code
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 
 # Copies your code file from your action repository to the filesystem path `/` of the container
 COPY entrypoint.sh /entrypoint.sh

act/runner/testdata/actions/docker-url/action.yml

@@ -8,7 +8,7 @@ inputs:
     default: World
 runs:
   using: docker
-  image: docker://node:24-bookworm-slim
+  image: docker://node:26-bookworm-slim
   entrypoint: /bin/sh -c
   env:
     TEST: enabled

docs/job-hooks.md

@@ -45,7 +45,7 @@ A hook path that does not exist inside the job environment fails the job with `N
 
 ## Environment
 
-A hook sees the job's environment: the workflow, job and `container:` `env:`, the runner's `envs`, and the `GITHUB_*` context variables, with the same masking applied to its output as to a step's. The step-specific ones (`GITHUB_ACTION`, `GITHUB_OUTPUT`, `GITHUB_STATE`) are not set — a hook is not a step, so `::save-state::` and `::set-output::` have nowhere to go.
+A hook sees the job's environment: the workflow, job and `container:` `env:`, the runner's `envs`, and the `GITHUB_*`/`GITEA_*` context variables, with the same masking applied to its output as to a step's. The step-specific ones (`GITHUB_ACTION`, `GITHUB_OUTPUT`, `GITHUB_STATE`) are not set — a hook is not a step, so `::save-state::` and `::set-output::` have nowhere to go.
 
 Its stdout is part of the job log, after a collapsible group naming the hook and its shell, and is scanned for workflow commands. `::add-mask::` registers a value to be masked for the rest of the job. `::set-env::` and `::add-path::` apply to the steps that follow, but as in a step they need `ACTIONS_ALLOW_UNSECURE_COMMANDS: true`, and a refused one fails the hook.
 

docs/kubernetes.md

@@ -49,6 +49,60 @@ A job with `runs-on: [linux, gpu]` gets the `linux` and then the `gpu` entry of
 
 Job pods mount no service account token unless the template sets `automountServiceAccountToken: true`. Job pods and their Secrets are labeled `app.kubernetes.io/managed-by: gitea-runner` and `com.gitea.runner.uuid: <runner UUID>`. The idle cleanup removes those the runner did not get to remove, once they are older than `runner.workdir_cleanup_age`.
 
+## Copying files over the pod network
+
+The runner copies files into the job container, such as the actions a step uses, with `tar` over `pods/exec`. That data goes through the API server, which on a managed cluster often sits in other zones than the nodes, so each byte can cross zones twice. With `transfer.mode` set to `auto` or `direct`, the job container instead fetches directories, such as actions and workspaces, and other copies of 64 KiB or more gzipped from the runner pod. Smaller ones, like step scripts, stay on `pods/exec`, as do copies out of the job container and step output.
+
+```yaml
+kubernetes:
+  transfer:
+    mode: direct # api (default), auto or direct
+    host: "" # address the runner listens on and job pods reach it at, defaults to its outbound IP, the pod IP in a cluster
+    port: 0 # port it listens on, defaults to a free one
+    image: "" # image with gitea-runner on its PATH, defaults to the image of a single-container runner pod in kubernetes.namespace
+```
+
+Each job pod then gets an init container named `gitea-runner-transfer` from `image`, which copies its `gitea-runner` into the `act` volume for the job container to fetch with over HTTPS. The modes differ in what happens when a job pod cannot reach the runner, for example because of a NetworkPolicy, or when no `image` is set and the runner is not a single-container pod in `kubernetes.namespace`:
+
+| Mode | Copies | When the pod network does not work |
+|---|---|---|
+| `api` | through the API server | not used |
+| `auto` | over the pod network | the job pod gets its copies through the API server, after one failed attempt, and a warning is logged |
+| `direct` | over the pod network | the job fails, so a broken setup shows instead of quietly costing API server traffic again |
+
+In both `auto` and `direct`, a job fails when its init container does, for example when `image` cannot be pulled or has no `gitea-runner` on its PATH. A private `image` needs `imagePullSecrets` in `pod_template`, and a versioned tag keeps job pods on the runner's version. An `initContainers` entry named `gitea-runner-transfer` in `pod_template` merges into the init container, for example to set its `resources`.
+
+The copies include secrets, such as `run` scripts with `${{ secrets.* }}` expanded, SSH keys for checkout and the runner's client key, so a runner only serves them to its own job pods:
+
+- The runner listens with a certificate it generates at start. Its SHA-256 pin reaches the job pod over the `pods/exec` stream, which the API server protects with TLS, and the job pod trusts no other certificate, so nobody on the pod network can read or change a copy.
+- Every copy has a one-time token, sent on that stream's stdin, so it shows neither in the command line nor in the API server audit log.
+- The runner serves a copy only to a connection from an IP of the job pod it is for. Other pods get a 404 and leave the copy for its job pod. This needs the runner to see the job pods' own addresses, so it does not work for a runner outside the cluster or behind a proxy that rewrites source addresses.
+
+To also keep other pods from connecting at all, allow the port only from the runner's own job pods, which carry its UUID in the `com.gitea.runner.uuid` label. The policy denies every other connection to the runner pod, so it also needs to allow `cache.port`, and both ports need fixed values:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: gitea-runner-transfer
+spec:
+  podSelector:
+    matchLabels:
+      app: runner # the runner pod
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: <kubernetes.namespace>
+          podSelector:
+            matchLabels:
+              com.gitea.runner.uuid: <runner UUID, from the .runner file>
+      ports:
+        - port: 9090 # kubernetes.transfer.port
+        - port: 9091 # cache.port
+```
+
 ## Services
 
 Services share the pod's network, so a step reaches one by its id or `localhost`, and two services cannot listen on the same port. An id that is not a valid hostname is sanitized, so `my_db` is reached as `my-db`. Pass secrets to services through `env`, as `command` is visible in the pod spec. Of `options`, only `--health-*` is supported. They become a startup probe with Docker's defaults, which stops a service that fails its retries, so the job fails as on Docker.

e2e/cancel_test.go

@@ -28,7 +28,7 @@ func testRunCancellation(t *testing.T) {
 	pushWorkflow(t, api, repo, "cancel.yml")
 
 	wfRun := waitForRun(t, api, repo)
-	waitForRunningJobLog(t, api, repo, wfRun.ID, "e2e-live-log-marker")
+	waitForRunningJobLog(t, api, repo, wfRun.ID, "e2e-live-log-marker", 1)
 	if !cancelSupported {
 		requireSuccess(t, api, repo, wfRun.ID)
 		return
@@ -49,31 +49,32 @@ func testRunCancellation(t *testing.T) {
 	}
 }
 
-func waitForRunningJobLog(t *testing.T, api *GiteaAPI, repo string, runID int64, substr string) {
+func waitForRunningJobLog(t *testing.T, api *GiteaAPI, repo string, runID int64, prefix string, count int) {
 	t.Helper()
 	// The budget covers scheduling and the container start, which a loaded runner makes slow.
 	ctx, cancel := context.WithTimeout(t.Context(), runTimeout)
 	defer cancel()
 
-	status := "none"
 	for {
 		jobs, err := api.Jobs(ctx, repo, runID)
 		if err != nil {
 			t.Fatalf("list jobs: %v", err)
 		}
-		if len(jobs) > 0 {
-			status = jobs[0].Status
-			if status == "in_progress" {
-				logs, err := api.JobLogs(ctx, repo, jobs[0].ID)
-				if err == nil && commandRow(logs, substr) == substr {
-					return
+		logged := 0
+		for _, job := range jobs {
+			if job.Status == "in_progress" {
+				if logs, err := api.JobLogs(ctx, repo, job.ID); err == nil && commandRow(logs, prefix) != "" {
+					logged++
 				}
 			}
 		}
+		if logged >= count {
+			return
+		}
 		select {
 		case <-ctx.Done():
 			dumpRunLogs(t, api, repo, runID)
-			t.Fatalf("job of run %d is %q and never logged %q", runID, status, substr)
+			t.Fatalf("%d of %d running jobs of run %d logged %q", logged, count, runID, prefix)
 		case <-time.After(pollInterval):
 		}
 	}

e2e/cli_test.go

@@ -67,10 +67,9 @@ func newCLIRunner(t *testing.T, label, extraRunnerConfig string) *cliRunner {
   log_report_interval: 500ms
 %scache:
   dir: %s
-`, filepath.Join(dir, ".runner"), extraRunnerConfig, filepath.Join(dir, "cache"))
-	if fixture.network != "" {
-		cfg += "container:\n  network: " + fixture.network + "\n"
-	}
+container:
+  network: %s
+`, filepath.Join(dir, ".runner"), extraRunnerConfig, filepath.Join(dir, "cache"), fixture.network)
 	c := &cliRunner{api: api, repo: repo, bin: bin, cfgFile: filepath.Join(dir, "config.yaml"), dir: dir}
 	if err := os.WriteFile(c.cfgFile, []byte(cfg), 0o600); err != nil {
 		t.Fatalf("write config: %v", err)
@@ -221,13 +220,26 @@ func testCLILabelsOverride(t *testing.T) {
 func testCLIShutdownDrains(t *testing.T) {
 	t.Parallel()
 	c := newCLIRunner(t, "e2e-shutdown", "  shutdown_timeout: 1m\n")
+	gate, release := newGate(t)
+	if err := c.api.CreateVariable(t.Context(), c.repo, "E2E_GATE", gate); err != nil {
+		t.Fatalf("create gate variable: %v", err)
+	}
 	d := c.startDaemon(t)
 
 	pushWorkflow(t, c.api, c.repo, "cli_shutdown.yml")
 	wfRun := waitForRun(t, c.api, c.repo)
-	waitForRunningJobLog(t, c.api, c.repo, wfRun.ID, "e2e-shutdown-started")
+	waitForRunningJobLog(t, c.api, c.repo, wfRun.ID, "e2e-shutdown-started", 1)
 
 	d.terminate(t)
+	deadline := time.After(time.Minute)
+	for !strings.Contains(d.log.String(), "shutdown initiated") {
+		select {
+		case <-deadline:
+			t.Fatalf("daemon never started shutting down\n%s", d.log)
+		case <-time.After(pollInterval):
+		}
+	}
+	release()
 	if err := d.wait(t, runTimeout); err != nil {
 		t.Errorf("daemon did not exit cleanly: %v\n%s", err, d.log)
 	}
@@ -248,7 +260,7 @@ func testCLIShutdownCancels(t *testing.T) {
 
 	pushWorkflow(t, c.api, c.repo, "cli_shutdown.yml")
 	wfRun := waitForRun(t, c.api, c.repo)
-	waitForRunningJobLog(t, c.api, c.repo, wfRun.ID, "e2e-shutdown-started")
+	waitForRunningJobLog(t, c.api, c.repo, wfRun.ID, "e2e-shutdown-started", 1)
 
 	d.terminate(t)
 	if err := d.wait(t, runTimeout); err != nil {
@@ -297,10 +309,7 @@ func testExecArtifacts(t *testing.T) {
 	}
 
 	artifacts := t.TempDir()
-	args := []string{"exec", "-C", workdir, "-W", workflows, "-i", os.Getenv("E2E_JOB_IMAGE"), "--artifact-server-path", artifacts}
-	if fixture.network != "" {
-		args = append(args, "--network", fixture.network)
-	}
+	args := []string{"exec", "-C", workdir, "-W", workflows, "-i", os.Getenv("E2E_JOB_IMAGE"), "--artifact-server-path", artifacts, "--network", fixture.network}
 	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.Env = slices.DeleteFunc(os.Environ(), func(kv string) bool { return strings.HasPrefix(kv, "ACTIONS_") })
 	if out, err := cmd.CombinedOutput(); err != nil {

e2e/compatibility_test.go

@@ -28,19 +28,20 @@ func TestCompatibility(t *testing.T) {
 	t.Run("payloads", testPayloads)
 	t.Run("cache_and_artifacts", testCacheAndArtifactRoundTrips)
 	t.Run("cancellation_and_log_streaming", testRunCancellation)
-	t.Run("dispatch", testWorkflowDispatch)
+	t.Run("dispatch", inAllModes(testWorkflowDispatch))
 	t.Run("builtin_checkout", testBuiltinCheckout)
 	t.Run("exec_artifacts", testExecArtifacts)
 	t.Run("moving_action_ref", testMovingActionRef)
 	t.Run("ephemeral", testEphemeralRunner)
-	t.Run("failure_paths", testFailurePaths)
+	t.Run("failure_paths", inAllModes(testFailurePaths))
+	t.Run("job_timeout", testJobTimeout)
 	t.Run("cli_register_daemon", testCLIRegisterDaemon)
 	t.Run("cli_once", testCLIOnce)
 	t.Run("cli_labels_override", testCLILabelsOverride)
 	t.Run("cli_shutdown_drains", testCLIShutdownDrains)
 	t.Run("cli_shutdown_cancels", testCLIShutdownCancels)
 	t.Run("host_mode", testHostMode)
-	t.Run("reusable_workflow", testReusableWorkflow)
+	t.Run("reusable_workflow", inAllModes(testReusableWorkflow))
 	t.Run("label_routing", testLabelRouting)
 	t.Run("capacity", testCapacity)
 	t.Run("reconnect", testReconnect)

e2e/dispatch_test.go

@@ -11,27 +11,11 @@ import (
 	"time"
 )
 
-func testWorkflowDispatch(t *testing.T) {
-	t.Parallel()
-	ctx := t.Context()
-
-	api, repo := newScenario(t)
-	pushWorkflow(t, api, repo, "dispatch.yml")
-
-	branch, err := api.DefaultBranch(ctx, repo)
-	if err != nil {
-		t.Fatalf("get default branch: %v", err)
+func testWorkflowDispatch(t *testing.T, m mode) {
+	result := runWorkflow(t, m, workflowSpec{files: []string{"dispatch.yml"}, inputs: map[string]string{"subject": "dispatch-input-value"}})
+	if result.conclusion != "success" {
+		t.Errorf("run concluded %q, want success", result.conclusion)
 	}
-	inputs := map[string]string{"subject": "dispatch-input-value"}
-	if err := waitForDispatch(ctx, api, repo, "dispatch.yml", branch, inputs); err != nil {
-		t.Fatalf("dispatch workflow: %v", err)
-	}
-
-	dispatched := waitForRun(t, api, repo)
-	if dispatched.Event != "workflow_dispatch" {
-		t.Fatalf("run event is %q, want workflow_dispatch", dispatched.Event)
-	}
-	requireSuccess(t, api, repo, dispatched.ID)
 }
 
 // Gitea indexes workflows asynchronously after the Contents API commit.

e2e/failure_test.go

@@ -5,55 +5,41 @@
 
 package e2e
 
-import "testing"
+import (
+	"testing"
+	"time"
+)
 
-func testFailurePaths(t *testing.T) {
+func testFailurePaths(t *testing.T, m mode) {
+	result := runWorkflow(t, m, workflowSpec{files: []string{"failure.yml"}})
+	if result.conclusion != "failure" {
+		t.Errorf("run concluded %q, want failure", result.conclusion)
+	}
+	for job, want := range map[string]string{"fail": "failure", "tolerated": "success", "dependent": "skipped"} {
+		if got := result.job(job); got != want {
+			t.Errorf("job %q concluded %q, want %q", job, got, want)
+		}
+	}
+	for _, marker := range []string{"e2e-before-fail", "e2e-failure-cleanup", "e2e-tolerated-next"} {
+		if !result.hasLine(marker) {
+			t.Errorf("logs are missing %q", marker)
+		}
+	}
+	if result.hasLine("e2e-skipped-step") {
+		t.Error("a success() step ran after a failed step")
+	}
+}
+
+func testJobTimeout(t *testing.T) {
 	t.Parallel()
-	ctx := t.Context()
-
-	api, repo := newScenario(t)
-	pushWorkflow(t, api, repo, "failure.yml")
-
+	api, repo, _ := startIsolatedScenario(t, "timeout.yml", "e2e-timeout", runnerOptions{timeout: 15 * time.Second})
 	wfRun := waitForRun(t, api, repo)
-	completed, err := api.WaitForRunConclusion(ctx, repo, wfRun.ID, runTimeout)
+	completed, err := api.WaitForRunConclusion(t.Context(), repo, wfRun.ID, runTimeout)
 	if err != nil {
 		dumpRunLogs(t, api, repo, wfRun.ID)
 		t.Fatalf("wait for run: %v", err)
 	}
-	if completed.Conclusion != "failure" {
-		t.Errorf("run concluded %q, want failure", completed.Conclusion)
-	}
-
-	jobs, err := api.Jobs(ctx, repo, wfRun.ID)
-	if err != nil {
-		t.Fatalf("list jobs: %v", err)
-	}
-	want := map[string]string{
-		"fail":      "failure",
-		"tolerated": "success",
-		"dependent": "skipped",
-		"timeout":   "failure",
-	}
-	for _, job := range jobs {
-		if w, ok := want[job.Name]; ok && job.Conclusion != w {
-			t.Errorf("job %q concluded %q, want %q", job.Name, job.Conclusion, w)
-		}
-		delete(want, job.Name)
-	}
-	for name := range want {
-		t.Errorf("job %q not found", name)
-	}
-
-	logs := runLogs(t, api, repo, wfRun.ID)
-	for _, marker := range []string{"e2e-before-fail", "e2e-failure-cleanup", "e2e-tolerated-next", "e2e-timeout-started"} {
-		if commandRow(logs, marker) != marker {
-			t.Errorf("logs are missing %q", marker)
-		}
-	}
-	if commandRow(logs, "e2e-skipped-step") != "" {
-		t.Error("a success() step ran after a failed step")
-	}
-	if t.Failed() {
-		t.Logf("full stored logs:\n%s", logs)
+	if logs := runLogs(t, api, repo, wfRun.ID); completed.Conclusion != "failure" || commandRow(logs, "e2e-timeout-started") == "" {
+		t.Errorf("run concluded %q, want failure after the job started, logs:\n%s", completed.Conclusion, logs)
 	}
 }

e2e/gitea_api.go

@@ -53,12 +53,16 @@ func (a *GiteaAPI) CreateRepo(ctx context.Context, name string) error {
 }
 
 func (a *GiteaAPI) CreateFile(ctx context.Context, repo, path, content, message string) error {
-	body := map[string]any{
-		"content": base64.StdEncoding.EncodeToString([]byte(content)),
-		"message": message,
+	return a.CreateFiles(ctx, repo, map[string]string{path: content}, message)
+}
+
+func (a *GiteaAPI) CreateFiles(ctx context.Context, repo string, files map[string]string, message string) error {
+	var operations []map[string]string
+	for path, content := range files {
+		operations = append(operations, map[string]string{"operation": "create", "path": path, "content": base64.StdEncoding.EncodeToString([]byte(content))})
 	}
-	url := fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s", giteaAdminUser, repo, path)
-	return a.doJSON(ctx, http.MethodPost, url, body, nil)
+	body := map[string]any{"files": operations, "message": message}
+	return a.doJSON(ctx, http.MethodPost, fmt.Sprintf("/api/v1/repos/%s/%s/contents", giteaAdminUser, repo), body, nil)
 }
 
 func (a *GiteaAPI) CreateTag(ctx context.Context, repo, name string) error {

e2e/gitea_fixture.go

@@ -15,9 +15,7 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"net/netip"
 	"os"
-	"strconv"
 	"strings"
 	"time"
 
@@ -40,7 +38,8 @@ type GiteaFixture struct {
 	image      string
 	version    string
 	baseURL    string
-	network    string // set in container mode; jobs must join it
+	network    string // the user-defined network every container of the suite joins
+	selfIP     string // the test process's address on network, which job containers can reach
 	adminToken string
 }
 
@@ -55,44 +54,10 @@ func dockerClient(ctx context.Context) (mobyclient.APIClient, error) {
 	return cli, nil
 }
 
-// Prefer docker bridge gateway, then LAN IP; never 127.0.0.1 (ACTIONS_RUNTIME_URL must reach the host from job containers).
-func hostAddress(ctx context.Context, cli mobyclient.APIClient) netip.Addr {
-	if gateway, ok := bridgeGateway(ctx, cli); ok && bindable(gateway) {
-		return gateway
-	}
-
-	loopback := netip.AddrFrom4([4]byte{127, 0, 0, 1})
-
-	conn, err := net.Dial("udp", "192.0.2.1:80") // TEST-NET-1: routing table only
-	if err != nil {
-		return loopback
-	}
-	defer conn.Close()
-
-	addr, ok := conn.LocalAddr().(*net.UDPAddr)
-	if !ok {
-		return loopback
-	}
-	return addr.AddrPort().Addr().Unmap()
-}
-
-func bridgeGateway(ctx context.Context, cli mobyclient.APIClient) (netip.Addr, bool) {
-	inspected, err := cli.NetworkInspect(ctx, "bridge", mobyclient.NetworkInspectOptions{})
-	if err != nil {
-		return netip.Addr{}, false
-	}
-	for _, cfg := range inspected.Network.IPAM.Config {
-		if cfg.Gateway.Is4() {
-			return cfg.Gateway, true
-		}
-	}
-	return netip.Addr{}, false
-}
-
 // When tests run inside a container (sibling docker daemon), join that network and address by name.
-func selfNetwork(ctx context.Context, cli mobyclient.APIClient) (string, bool) {
+func selfNetwork(ctx context.Context, cli mobyclient.APIClient) (string, string, bool) {
 	if _, err := os.Stat("/.dockerenv"); err != nil {
-		return "", false
+		return "", "", false
 	}
 
 	id, err := os.ReadFile("/proc/sys/kernel/hostname")
@@ -100,42 +65,19 @@ func selfNetwork(ctx context.Context, cli mobyclient.APIClient) (string, bool) {
 		id, err = os.ReadFile("/etc/hostname")
 	}
 	if err != nil {
-		return "", false
+		return "", "", false
 	}
 
 	inspected, err := cli.ContainerInspect(ctx, strings.TrimSpace(string(id)), mobyclient.ContainerInspectOptions{})
 	if err != nil || inspected.Container.NetworkSettings == nil {
-		return "", false
+		return "", "", false
 	}
-	for name := range inspected.Container.NetworkSettings.Networks {
+	for name, endpoint := range inspected.Container.NetworkSettings.Networks {
 		if name != "host" && name != "none" && name != "bridge" { // only user-defined nets have DNS
-			return name, true
+			return name, endpoint.IPAddress.String(), true
 		}
 	}
-	return "", false
-}
-
-func bindable(addr netip.Addr) bool {
-	l, err := net.Listen("tcp", net.JoinHostPort(addr.String(), "0"))
-	if err != nil {
-		return false
-	}
-	_ = l.Close()
-	return true
-}
-
-func freeHostPort(host string) (int, error) {
-	l, err := net.Listen("tcp", net.JoinHostPort(host, "0"))
-	if err != nil {
-		return 0, err
-	}
-	defer l.Close()
-
-	addr, ok := l.Addr().(*net.TCPAddr)
-	if !ok {
-		return 0, fmt.Errorf("unexpected listener address type %T", l.Addr())
-	}
-	return addr.Port, nil
+	return "", "", false
 }
 
 func StartGitea(ctx context.Context, cli mobyclient.APIClient) (*GiteaFixture, error) {
@@ -151,31 +93,12 @@ func StartGitea(ctx context.Context, cli mobyclient.APIClient) (*GiteaFixture, e
 		return nil, errors.New("E2E_GITEA_IMAGE is not set")
 	}
 
-	name := fmt.Sprintf("gitea-runner-e2e-%d", time.Now().UnixNano())
-	containerPort := network.MustParsePort("3000/tcp")
-
-	var (
-		baseURL      string
-		hostConfig   = &apicontainer.HostConfig{}
-		netConfig    *network.NetworkingConfig
-		sharedNet, _ = selfNetwork(ctx, cli)
-	)
-	if sharedNet != "" {
-		baseURL = "http://" + net.JoinHostPort(name, "3000")
-		netConfig = &network.NetworkingConfig{
-			EndpointsConfig: map[string]*network.EndpointSettings{sharedNet: {}},
-		}
-	} else {
-		host := hostAddress(ctx, cli)
-		port, err := freeHostPort(host.String())
-		if err != nil {
-			return nil, fmt.Errorf("find a free host port: %w", err)
-		}
-		baseURL = "http://" + net.JoinHostPort(host.String(), strconv.Itoa(port))
-		hostConfig.PortBindings = network.PortMap{
-			containerPort: []network.PortBinding{{HostIP: host, HostPort: strconv.Itoa(port)}},
-		}
+	sharedNet, selfIP, ok := selfNetwork(ctx, cli)
+	if !ok {
+		return nil, errors.New("e2e tests must run in a container on a user-defined network, `make test-e2e` provides one")
 	}
+	name := fmt.Sprintf("gitea-runner-e2e-%d", time.Now().UnixNano())
+	baseURL := "http://" + net.JoinHostPort(name, "3000")
 
 	if _, err := cli.ImageInspect(ctx, image); err != nil {
 		return nil, fmt.Errorf("inspect gitea image %s: %w", image, err)
@@ -191,17 +114,16 @@ func StartGitea(ctx context.Context, cli mobyclient.APIClient) (*GiteaFixture, e
 				"GITEA__server__LFS_START_SERVER=true",
 				"GITEA__server__ROOT_URL=" + baseURL + "/",
 			},
-			ExposedPorts: network.PortSet{containerPort: struct{}{}},
 		},
-		HostConfig:       hostConfig,
-		NetworkingConfig: netConfig,
+		HostConfig:       &apicontainer.HostConfig{Tmpfs: map[string]string{"/data": "exec"}},
+		NetworkingConfig: &network.NetworkingConfig{EndpointsConfig: map[string]*network.EndpointSettings{sharedNet: {}}},
 		Name:             name,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("create gitea container: %w", err)
 	}
 
-	f := &GiteaFixture{cli: cli, id: resp.ID, image: image, baseURL: baseURL, network: sharedNet}
+	f := &GiteaFixture{cli: cli, id: resp.ID, image: image, baseURL: baseURL, network: sharedNet, selfIP: selfIP}
 	closeClient = false
 
 	if _, err := cli.ContainerStart(ctx, f.id, mobyclient.ContainerStartOptions{}); err != nil {

e2e/kubernetes_test.go

@@ -9,15 +9,16 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
-	"net"
-	"net/netip"
 	"net/url"
 	"os"
 	"path/filepath"
-	"strconv"
+	"slices"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -32,125 +33,168 @@ import (
 func testKubernetes(t *testing.T) {
 	t.Parallel()
 	ctx := t.Context()
-	k3sID, kubernetes, images := startK3s(t)
+	cluster := requireCluster(t)
 
 	api, repo := newScenario(t)
-	if err := api.CreateVariable(ctx, repo, "E2E_SERVICE_IMAGE", images[1]); err != nil {
+	if err := api.CreateVariable(ctx, repo, "E2E_SERVICE_IMAGE", cluster.serviceImage); err != nil {
 		t.Fatalf("create service image variable: %v", err)
 	}
-	startRunner(t, repo, "e2e-kubernetes", runnerOptions{image: images[0], kubernetes: kubernetes})
+	startRunner(t, repo, "e2e-kubernetes", runnerOptions{image: cluster.jobImage, kubernetes: cluster.kubernetes})
 	pushWorkflow(t, api, repo, "kubernetes.yml")
 
 	wfRun := waitForRun(t, api, repo)
 	requireSuccess(t, api, repo, wfRun.ID)
+}
 
-	if out, err := containerExec(ctx, fixture.cli, k3sID, "", nil,
+// checkClusterLeaks runs after every test, so a pod or secret any of them left behind fails the suite.
+func checkClusterLeaks() error {
+	if !clusterStarted.Load() {
+		return nil
+	}
+	cluster, err := k3s()
+	if err != nil {
+		return nil // the tests that needed the cluster already failed
+	}
+	if out, err := containerExec(context.Background(), dockerCLI, cluster.id, "", nil,
 		"kubectl", "wait", "--for=delete", "pods,secrets", "--selector=app.kubernetes.io/managed-by=gitea-runner", "--timeout=1m",
 	); err != nil {
-		t.Errorf("job pods or secrets left behind: %v: %s", err, out)
+		return fmt.Errorf("job pods or secrets left behind: %w: %s", err, out)
+	}
+	return nil
+}
+
+type kubeCluster struct {
+	id                     string
+	kubernetes             *config.Kubernetes
+	jobImage, serviceImage string
+}
+
+var (
+	k3s            = sync.OnceValues(startK3s) // independent of Gitea, so it can boot alongside it
+	clusterStarted atomic.Bool
+	clusterCleanup []func()
+	sharedCluster  = sync.OnceValues(func() (*kubeCluster, error) {
+		cluster, err := k3s()
+		if err != nil {
+			return nil, err
+		}
+		gitea, err := fixture.cli.ContainerInspect(context.Background(), fixture.id, mobyclient.ContainerInspectOptions{})
+		if err != nil {
+			return nil, fmt.Errorf("inspect gitea container: %w", err)
+		}
+		giteaURL, err := url.Parse(fixture.baseURL)
+		if err != nil {
+			return nil, fmt.Errorf("parse gitea url: %w", err)
+		}
+		cluster.kubernetes.PodTemplate = map[string]any{"spec": map[string]any{"hostAliases": []any{map[string]any{
+			"ip":        gitea.Container.NetworkSettings.Networks[fixture.network].IPAddress.String(),
+			"hostnames": []any{giteaURL.Hostname()},
+		}}}}
+		return cluster, nil
+	})
+)
+
+func requireCluster(t *testing.T) *kubeCluster {
+	t.Helper()
+	cluster, err := sharedCluster()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return cluster
+}
+
+func stopCluster() {
+	if !clusterStarted.Load() {
+		return
+	}
+	_, _ = k3s()
+	for _, cleanup := range slices.Backward(clusterCleanup) {
+		cleanup()
 	}
 }
 
-func startK3s(t *testing.T) (string, *config.Kubernetes, []string) {
-	t.Helper()
-	ctx := t.Context()
-	cli := fixture.cli
+func startK3s() (*kubeCluster, error) {
+	clusterStarted.Store(true)
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+	cli := dockerCLI
+	sharedNet, _, ok := selfNetwork(ctx, cli)
+	if !ok {
+		return nil, errors.New("e2e tests must run in a container on a user-defined network")
+	}
 
 	name := fmt.Sprintf("gitea-runner-e2e-k3s-%d", time.Now().UnixNano())
-	apiPort := network.MustParsePort("6443/tcp")
 	server := "https://" + name + ":6443"
-	hostConfig := &apicontainer.HostConfig{Privileged: true}
-	var netConfig *network.NetworkingConfig
-	if fixture.network != "" {
-		netConfig = &network.NetworkingConfig{EndpointsConfig: map[string]*network.EndpointSettings{fixture.network: {}}}
-	} else {
-		loopback := netip.MustParseAddr("127.0.0.1")
-		port, err := freeHostPort(loopback.String())
-		if err != nil {
-			t.Fatalf("find a free host port: %v", err)
-		}
-		server = "https://" + net.JoinHostPort(loopback.String(), strconv.Itoa(port))
-		hostConfig.PortBindings = network.PortMap{apiPort: []network.PortBinding{{HostIP: loopback, HostPort: strconv.Itoa(port)}}}
-	}
 
 	created, err := cli.ContainerCreate(ctx, mobyclient.ContainerCreateOptions{
 		Config: &apicontainer.Config{
-			Image:        os.Getenv("E2E_K3S_IMAGE"),
-			Cmd:          []string{"server", "--disable=traefik,metrics-server,servicelb,local-storage,coredns", "--tls-san=" + name, "--kubelet-arg=fail-cgroupv1=false"},
-			ExposedPorts: network.PortSet{apiPort: struct{}{}},
+			Image: os.Getenv("E2E_K3S_IMAGE"),
+			Cmd:   []string{"server", "--disable=traefik,metrics-server,servicelb,local-storage,coredns", "--tls-san=" + name, "--kubelet-arg=fail-cgroupv1=false"},
 		},
-		HostConfig:       hostConfig,
-		NetworkingConfig: netConfig,
+		HostConfig:       &apicontainer.HostConfig{Privileged: true},
+		NetworkingConfig: &network.NetworkingConfig{EndpointsConfig: map[string]*network.EndpointSettings{sharedNet: {}}},
 		Name:             name,
 	})
 	if err != nil {
-		t.Fatalf("create k3s container: %v", err)
+		return nil, fmt.Errorf("create k3s container: %w", err)
 	}
-	t.Cleanup(func() {
+	clusterCleanup = append(clusterCleanup, func() {
 		_, _ = cli.ContainerRemove(context.Background(), created.ID, mobyclient.ContainerRemoveOptions{Force: true, RemoveVolumes: true})
 	})
 	if _, err := cli.ContainerStart(ctx, created.ID, mobyclient.ContainerStartOptions{}); err != nil {
-		t.Fatalf("start k3s container: %v", err)
+		return nil, fmt.Errorf("start k3s container: %w", err)
 	}
 
-	containerdCtx, stopWaiting := context.WithTimeout(ctx, 2*time.Minute)
-	defer stopWaiting()
-	if err := waitForContainerLog(containerdCtx, created.ID, "containerd is now running"); err != nil {
-		t.Fatalf("wait for k3s containerd: %v", err)
+	if err := waitForContainerLog(ctx, created.ID, "containerd is now running"); err != nil {
+		return nil, fmt.Errorf("wait for k3s containerd: %w", err)
+	}
+	sandboxPulled := make(chan struct{})
+	go func() { // first pods would otherwise pull the sandbox image themselves
+		defer close(sandboxPulled)
+		pullCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+		defer cancel()
+		_, _ = containerExec(pullCtx, cli, created.ID, "", nil, "sh", "-c",
+			`ctr --namespace=k8s.io images pull "docker.io/$(sed -n 's/^ *sandbox = "\(.*\)"$/\1/p' /var/lib/rancher/k3s/agent/etc/containerd/config.toml)"`)
+	}()
+	images, err := preloadImages(ctx, created.ID, os.Getenv("E2E_JOB_IMAGE"), os.Getenv("SERVICE_IMAGE"))
+	<-sandboxPulled
+	if err != nil {
+		return nil, err
 	}
-	images := preloadImages(t, created.ID, os.Getenv("E2E_JOB_IMAGE"), os.Getenv("SERVICE_IMAGE"))
 
-	waitCtx, cancel := context.WithTimeout(ctx, 2*time.Minute)
-	defer cancel()
 	for {
-		_, err := containerExec(waitCtx, cli, created.ID, "", nil, "kubectl", "get", "serviceaccount", "default")
+		_, err := containerExec(ctx, cli, created.ID, "", nil, "kubectl", "get", "serviceaccount", "default")
 		if err == nil {
 			break
 		}
 		inspected, inspectErr := cli.ContainerInspect(ctx, created.ID, mobyclient.ContainerInspectOptions{})
-		if inspectErr != nil || !inspected.Container.State.Running || waitCtx.Err() != nil {
+		if inspectErr != nil || !inspected.Container.State.Running || ctx.Err() != nil {
 			var logs bytes.Buffer
-			if reader, logsErr := cli.ContainerLogs(ctx, created.ID, mobyclient.ContainerLogsOptions{ShowStdout: true, ShowStderr: true, Tail: "30"}); logsErr == nil {
+			if reader, logsErr := cli.ContainerLogs(context.Background(), created.ID, mobyclient.ContainerLogsOptions{ShowStdout: true, ShowStderr: true, Tail: "30"}); logsErr == nil {
 				_, _ = stdcopy.StdCopy(&logs, &logs, reader)
 				_ = reader.Close()
 			}
-			t.Fatalf("k3s did not start: %v, state %+v %v, last log lines:\n%s", err, inspected.Container.State, inspectErr, logs.String())
+			return nil, fmt.Errorf("k3s did not start: %w, state %+v %v, last log lines:\n%s", err, inspected.Container.State, inspectErr, logs.String())
 		}
 		select {
-		case <-waitCtx.Done():
+		case <-ctx.Done():
 		case <-time.After(pollInterval):
 		}
 	}
 
 	kubeconfig, err := containerExec(ctx, cli, created.ID, "", nil, "cat", "/etc/rancher/k3s/k3s.yaml")
 	if err != nil {
-		t.Fatalf("read kubeconfig: %v", err)
+		return nil, fmt.Errorf("read kubeconfig: %w", err)
 	}
-	path := filepath.Join(t.TempDir(), "kubeconfig")
+	path := filepath.Join(binDir, "kubeconfig")
 	if err := os.WriteFile(path, []byte(strings.ReplaceAll(kubeconfig, "https://127.0.0.1:6443", server)), 0o600); err != nil {
-		t.Fatalf("write kubeconfig: %v", err)
+		return nil, fmt.Errorf("write kubeconfig: %w", err)
 	}
-	kubernetes := &config.Kubernetes{Kubeconfig: path, Namespace: "default"}
-
-	if fixture.network != "" {
-		gitea, err := cli.ContainerInspect(ctx, fixture.id, mobyclient.ContainerInspectOptions{})
-		if err != nil {
-			t.Fatalf("inspect gitea container: %v", err)
-		}
-		giteaURL, err := url.Parse(fixture.baseURL)
-		if err != nil {
-			t.Fatalf("parse gitea url: %v", err)
-		}
-		kubernetes.PodTemplate = map[string]any{"spec": map[string]any{"hostAliases": []any{map[string]any{
-			"ip":        gitea.Container.NetworkSettings.Networks[fixture.network].IPAddress.String(),
-			"hostnames": []any{giteaURL.Hostname()},
-		}}}}
-	}
-	return created.ID, kubernetes, images
+	return &kubeCluster{id: created.ID, kubernetes: &config.Kubernetes{Kubeconfig: path, Namespace: "default"}, jobImage: images[0], serviceImage: images[1]}, nil
 }
 
 func waitForContainerLog(ctx context.Context, id, message string) error {
-	logs, err := fixture.cli.ContainerLogs(ctx, id, mobyclient.ContainerLogsOptions{ShowStdout: true, ShowStderr: true, Follow: true})
+	logs, err := dockerCLI.ContainerLogs(ctx, id, mobyclient.ContainerLogsOptions{ShowStdout: true, ShowStderr: true, Follow: true})
 	if err != nil {
 		return err
 	}
@@ -175,25 +219,23 @@ func waitForContainerLog(ctx context.Context, id, message string) error {
 	return fmt.Errorf("container exited before logging %q", message)
 }
 
-func preloadImages(t *testing.T, k3sID string, images ...string) []string {
-	t.Helper()
-	ctx := t.Context()
+func preloadImages(ctx context.Context, k3sID string, images ...string) ([]string, error) {
 	var aliases []string
 	for index, image := range images {
 		alias := fmt.Sprintf("gitea-runner-e2e/preload-%d:%d", index, time.Now().UnixNano())
-		if _, err := fixture.cli.ImageTag(ctx, mobyclient.ImageTagOptions{Source: image, Target: alias}); err != nil {
-			t.Fatalf("tag %s: %v", image, err)
+		if _, err := dockerCLI.ImageTag(ctx, mobyclient.ImageTagOptions{Source: image, Target: alias}); err != nil {
+			return nil, fmt.Errorf("tag %s: %w", image, err)
 		}
-		t.Cleanup(func() { _, _ = fixture.cli.ImageRemove(context.Background(), alias, mobyclient.ImageRemoveOptions{}) })
+		clusterCleanup = append(clusterCleanup, func() { _, _ = dockerCLI.ImageRemove(context.Background(), alias, mobyclient.ImageRemoveOptions{}) })
 		aliases = append(aliases, alias)
 	}
-	archive, err := fixture.cli.ImageSave(ctx, aliases)
+	archive, err := dockerCLI.ImageSave(ctx, aliases)
 	if err != nil {
-		t.Fatalf("save %v: %v", images, err)
+		return nil, fmt.Errorf("save %v: %w", images, err)
 	}
 	defer archive.Close()
-	if out, err := containerExec(ctx, fixture.cli, k3sID, "", archive, "ctr", "--namespace=k8s.io", "images", "import", "-"); err != nil {
-		t.Fatalf("import %v into k3s: %v: %s", images, err, out)
+	if out, err := containerExec(ctx, dockerCLI, k3sID, "", archive, "ctr", "--namespace=k8s.io", "images", "import", "-"); err != nil {
+		return nil, fmt.Errorf("import %v into k3s: %w: %s", images, err, out)
 	}
-	return aliases
+	return aliases, nil
 }

e2e/main_test.go

@@ -9,18 +9,24 @@ import (
 	"cmp"
 	"context"
 	"errors"
+	"flag"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"gitea.com/gitea/runner/internal/app/poll"
+
+	mobyclient "github.com/moby/moby/client"
 )
 
 const runTimeout = 3 * time.Minute
@@ -33,6 +39,8 @@ var skipReason string
 
 var binDir string
 
+var dockerCLI mobyclient.APIClient
+
 var runnerBinary = sync.OnceValues(func() (string, error) {
 	bin := filepath.Join(binDir, "gitea-runner")
 	if out, err := exec.Command(cmp.Or(os.Getenv("GO"), "go"), "build", "-o", bin, "..").CombinedOutput(); err != nil {
@@ -54,6 +62,17 @@ func runSuite(m *testing.M) int {
 		skipReason = fmt.Sprintf("docker unavailable: %v", err)
 		return m.Run()
 	}
+	dockerCLI = cli
+
+	if binDir, err = os.MkdirTemp("", "gitea-runner-e2e-"); err != nil {
+		fmt.Fprintf(os.Stderr, "create binary dir: %v\n", err)
+		return 1
+	}
+	defer os.RemoveAll(binDir)
+	defer stopCluster()
+	if flag.Parse(); flag.Lookup("test.run").Value.String() == "" { // a filtered run starts the cluster only if it needs it
+		go func() { _, _ = k3s() }()
+	}
 
 	f, err := StartGitea(ctx, cli)
 	if err != nil {
@@ -63,15 +82,14 @@ func runSuite(m *testing.M) int {
 	fixture = f
 	defer func() { _ = fixture.Close(context.Background()) }()
 
-	if binDir, err = os.MkdirTemp("", "gitea-runner-e2e-"); err != nil {
-		fmt.Fprintf(os.Stderr, "create binary dir: %v\n", err)
-		return 1
-	}
-	defer os.RemoveAll(binDir)
-
 	fmt.Fprintf(os.Stderr, "gitea fixture: image=%s version=%s\n", fixture.image, fixture.version)
 
-	return m.Run()
+	code := m.Run()
+	if err := checkClusterLeaks(); err != nil && code == 0 {
+		fmt.Fprintln(os.Stderr, err)
+		code = 1
+	}
+	return code
 }
 
 func newScenario(t *testing.T) (*GiteaAPI, string) {
@@ -162,6 +180,24 @@ func dumpRunLogs(t *testing.T, api *GiteaAPI, repo string, runID int64) {
 	}
 }
 
+// newGate serves a URL that answers 503 until release, for jobs to poll instead of sleeping.
+func newGate(t *testing.T) (string, func()) {
+	t.Helper()
+	var released atomic.Bool
+	listener, err := net.Listen("tcp", ":0")
+	if err != nil {
+		t.Fatalf("listen for the gate: %v", err)
+	}
+	server := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		if !released.Load() {
+			w.WriteHeader(http.StatusServiceUnavailable)
+		}
+	}), ReadHeaderTimeout: time.Second}
+	go func() { _ = server.Serve(listener) }()
+	t.Cleanup(func() { _ = server.Close() })
+	return fmt.Sprintf("http://%s/", net.JoinHostPort(fixture.selfIP, strconv.Itoa(listener.Addr().(*net.TCPAddr).Port))), func() { released.Store(true) }
+}
+
 func waitForRun(t *testing.T, api *GiteaAPI, repo string) *ActionRun {
 	t.Helper()
 	return waitForRunAfter(t, api, repo, 0)

e2e/modes_test.go

@@ -0,0 +1,227 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build e2e
+
+package e2e
+
+import (
+	"bufio"
+	"bytes"
+	"cmp"
+	"encoding/json"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+)
+
+type mode struct {
+	exec, kubernetes bool
+}
+
+var allModes = []mode{{}, {kubernetes: true}, {exec: true}, {exec: true, kubernetes: true}}
+
+func (m mode) String() string {
+	driver, backend := "daemon", "docker"
+	if m.exec {
+		driver = "exec"
+	}
+	if m.kubernetes {
+		backend = "kubernetes"
+	}
+	return driver + "_" + backend
+}
+
+func inAllModes(scenario func(*testing.T, mode)) func(*testing.T) {
+	return func(t *testing.T) {
+		t.Parallel()
+		for _, m := range allModes {
+			t.Run(m.String(), func(t *testing.T) {
+				t.Parallel()
+				scenario(t, m)
+			})
+		}
+	}
+}
+
+type workflowSpec struct {
+	files    []string
+	inputs   map[string]string // dispatches files[0] instead of relying on push
+	execArgs []string
+}
+
+type workflowResult struct {
+	conclusion string
+	jobs       map[string]string
+	lines      []string
+}
+
+func (r *workflowResult) job(id string) string {
+	return cmp.Or(r.jobs[id], "skipped") // exec reports nothing for a job it skipped
+}
+
+func (r *workflowResult) hasLine(line string) bool {
+	return slices.Contains(r.lines, line)
+}
+
+func runWorkflow(t *testing.T, m mode, spec workflowSpec) *workflowResult {
+	t.Helper()
+	run := daemonWorkflow
+	if m.exec {
+		run = execWorkflow
+	}
+	result := run(t, m, spec)
+	t.Cleanup(func() {
+		if t.Failed() {
+			t.Logf("%s concluded %q, jobs %v, logs:\n%s", m, result.conclusion, result.jobs, strings.Join(result.lines, "\n"))
+		}
+	})
+	return result
+}
+
+func daemonWorkflow(t *testing.T, m mode, spec workflowSpec) *workflowResult {
+	t.Helper()
+	ctx := t.Context()
+
+	api, repo := newScenario(t)
+	if m.kubernetes {
+		cluster := requireCluster(t)
+		startRunner(t, repo, "e2e-kubernetes", runnerOptions{image: cluster.jobImage, kubernetes: cluster.kubernetes, capacity: 16})
+	}
+	files := map[string]string{}
+	for _, file := range spec.files {
+		content, err := os.ReadFile(filepath.Join("testdata", "workflows", file))
+		if err != nil {
+			t.Fatalf("read workflow fixture %s: %v", file, err)
+		}
+		if m.kubernetes {
+			content = bytes.ReplaceAll(content, []byte("runs-on: ubuntu-latest"), []byte("runs-on: e2e-kubernetes"))
+		}
+		files[".gitea/workflows/"+file] = string(content)
+	}
+	if err := api.CreateFiles(ctx, repo, files, "add workflows"); err != nil {
+		t.Fatalf("push workflows: %v", err)
+	}
+	if spec.inputs != nil {
+		branch, err := api.DefaultBranch(ctx, repo)
+		if err != nil {
+			t.Fatalf("get default branch: %v", err)
+		}
+		if err := waitForDispatch(ctx, api, repo, spec.files[0], branch, spec.inputs); err != nil {
+			t.Fatalf("dispatch workflow: %v", err)
+		}
+	}
+
+	wfRun := waitForRun(t, api, repo)
+	completed, err := api.WaitForRunConclusion(ctx, repo, wfRun.ID, runTimeout)
+	if err != nil {
+		dumpRunLogs(t, api, repo, wfRun.ID)
+		t.Fatalf("wait for run: %v", err)
+	}
+	jobs, err := api.Jobs(ctx, repo, wfRun.ID)
+	if err != nil {
+		t.Fatalf("list jobs: %v", err)
+	}
+	result := &workflowResult{conclusion: completed.Conclusion, jobs: map[string]string{}}
+	for _, job := range jobs {
+		result.jobs[job.Name] = job.Conclusion
+	}
+	for line := range strings.SplitSeq(runLogs(t, api, repo, wfRun.ID), "\n") {
+		if _, payload, found := strings.Cut(line, "Z "); found {
+			result.lines = append(result.lines, strings.TrimRight(payload, "\r"))
+		}
+	}
+	return result
+}
+
+func execWorkflow(t *testing.T, m mode, spec workflowSpec) *workflowResult {
+	t.Helper()
+	ctx := t.Context()
+
+	bin, err := runnerBinary()
+	if err != nil {
+		t.Fatal(err)
+	}
+	workdir := t.TempDir()
+	workflows := filepath.Join(workdir, ".gitea", "workflows")
+	if err := os.MkdirAll(workflows, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for _, file := range spec.files {
+		content, err := os.ReadFile(filepath.Join("testdata", "workflows", file))
+		if err != nil {
+			t.Fatalf("read workflow fixture %s: %v", file, err)
+		}
+		if err := os.WriteFile(filepath.Join(workflows, file), content, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, args := range [][]string{
+		{"init", "-q"},
+		{"remote", "add", "origin", "https://example.com/e2e/exec.git"},
+		{"-c", "user.name=e2e", "-c", "[email protected]", "commit", "-q", "--allow-empty", "-m", "init"},
+	} {
+		if out, err := exec.CommandContext(ctx, "git", append([]string{"-C", workdir}, args...)...).CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %v\n%s", args, err, out)
+		}
+	}
+
+	args := []string{"exec", "--json", "-C", workdir, "-W", workflows, "--artifact-server-path", t.TempDir(), "--artifact-server-port", "0"}
+	env := slices.DeleteFunc(os.Environ(), func(kv string) bool { return strings.HasPrefix(kv, "ACTIONS_") })
+	if m.kubernetes {
+		cluster := requireCluster(t)
+		args = append(args, "-i", "kubernetes://"+cluster.jobImage)
+		env = append(env, "KUBECONFIG="+cluster.kubernetes.Kubeconfig)
+	} else {
+		args = append(args, "-i", os.Getenv("E2E_JOB_IMAGE"), "--network", fixture.network)
+	}
+	if spec.inputs != nil {
+		args = append(args, "-E", "workflow_dispatch")
+		for name, value := range spec.inputs {
+			args = append(args, "--input", name+"="+value)
+		}
+	}
+	cmd := exec.CommandContext(ctx, bin, append(args, spec.execArgs...)...)
+	cmd.Env = env
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &stdout, &stderr
+	runErr := cmd.Run()
+	var exitErr *exec.ExitError
+	if runErr != nil && !errors.As(runErr, &exitErr) {
+		t.Fatalf("exec: %v\n%s", runErr, stderr.String())
+	}
+
+	result := &workflowResult{conclusion: "success", jobs: map[string]string{}}
+	if runErr != nil {
+		result.conclusion = "failure"
+	}
+	scanner := bufio.NewScanner(&stdout)
+	scanner.Buffer(nil, 1<<20)
+	for scanner.Scan() {
+		var entry struct {
+			JobID     string `json:"jobID"`
+			JobResult string `json:"jobResult"`
+			Msg       string `json:"msg"`
+			RawOutput bool   `json:"raw_output"`
+		}
+		if json.Unmarshal(scanner.Bytes(), &entry) != nil {
+			continue
+		}
+		if entry.JobResult != "" {
+			result.jobs[entry.JobID] = entry.JobResult
+		}
+		if entry.RawOutput {
+			for line := range strings.SplitSeq(strings.TrimRight(entry.Msg, "\n"), "\n") {
+				result.lines = append(result.lines, strings.TrimRight(line, "\r"))
+			}
+		}
+	}
+	if result.conclusion != "success" && len(result.jobs) == 0 {
+		t.Fatalf("exec ran no job: %v\n%s", runErr, stderr.String())
+	}
+	return result
+}

e2e/reconnect_test.go

@@ -10,6 +10,8 @@ import (
 	"io"
 	"net"
 	"net/url"
+	"strconv"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -101,6 +103,10 @@ func (p *flakyProxy) restore() { p.down.Store(false) }
 func testReconnect(t *testing.T) {
 	t.Parallel()
 	api, repo := newScenario(t)
+	gate, release := newGate(t)
+	if err := api.CreateVariable(t.Context(), repo, "E2E_GATE", gate); err != nil {
+		t.Fatalf("create gate variable: %v", err)
+	}
 	proxy := newFlakyProxy(t, fixture.baseURL)
 	startRunner(t, repo, "e2e-reconnect", runnerOptions{host: true, address: proxy.URL()})
 
@@ -112,14 +118,19 @@ func testReconnect(t *testing.T) {
 
 	pushWorkflow(t, api, repo, "reconnect.yml")
 	slow := waitForRunAfter(t, api, repo, idle.ID)
-	waitForRunningJobLog(t, api, repo, slow.ID, "e2e-before-outage")
-	// the job logs a line per second, so a long outage spans several that can only arrive after it
+	waitForRunningJobLog(t, api, repo, slow.ID, "e2e-before-outage", 1)
+	// the job logs a line every 200ms until released, so the outage spans several that can only arrive after it
 	proxy.cut(t, 8)
 	proxy.restore()
+	release()
 	requireSuccess(t, api, repo, slow.ID)
 	logs := runLogs(t, api, repo, slow.ID)
-	for i := 1; i <= 15; i++ {
-		if tick := fmt.Sprintf("tick-%02d", i); commandRow(logs, tick) != tick {
+	ticks, err := strconv.Atoi(strings.TrimPrefix(commandRow(logs, "ticks="), "ticks="))
+	if err != nil {
+		t.Fatalf("the job did not report its tick count: %v\n%s", err, logs)
+	}
+	for i := 1; i <= ticks; i++ {
+		if tick := fmt.Sprintf("tick-%d", i); commandRow(logs, tick) != tick {
 			t.Errorf("log line %s written during or after the outage was lost:\n%s", tick, logs)
 			break
 		}

e2e/reusable_test.go

@@ -8,15 +8,12 @@ package e2e
 import "testing"
 
 // testReusableWorkflow runs a local workflow_call workflow and consumes its output.
-func testReusableWorkflow(t *testing.T) {
-	t.Parallel()
-	api, repo := newScenario(t)
-	pushWorkflow(t, api, repo, "reusable_callee.yml")
-	pushWorkflow(t, api, repo, "reusable_caller.yml")
-
-	wfRun := waitForRun(t, api, repo)
-	requireSuccess(t, api, repo, wfRun.ID)
-	if logs := runLogs(t, api, repo, wfRun.ID); commandRow(logs, "e2e-reusable-ran") == "" {
-		t.Errorf("the called workflow did not run:\n%s", logs)
+func testReusableWorkflow(t *testing.T, m mode) {
+	result := runWorkflow(t, m, workflowSpec{
+		files:    []string{"reusable_callee.yml", "reusable_caller.yml"},
+		execArgs: []string{"--no-skip-checkout"},
+	})
+	if result.conclusion != "success" || !result.hasLine("e2e-reusable-ran") {
+		t.Errorf("run concluded %q, want success with the called workflow's marker", result.conclusion)
 	}
 }

e2e/runner_harness.go

@@ -33,6 +33,7 @@ type runnerOptions struct {
 	host       bool   // register a host-mode label instead of a docker one
 	name       string // suffix that keeps runner names unique when a test starts several
 	address    string // Gitea address the runner talks to, default the fixture
+	timeout    time.Duration
 }
 
 func startRunner(t *testing.T, repo, labelName string, options runnerOptions) *poll.Poller {
@@ -60,9 +61,8 @@ func startRunner(t *testing.T, repo, labelName string, options runnerOptions) *p
 	cfg.Runner.StateReportInterval = 500 * time.Millisecond // so cancel reaches the job quickly
 	cfg.Runner.LogReportInterval = 500 * time.Millisecond
 	cfg.Runner.Capacity = max(options.capacity, 1)
-	if fixture.network != "" {
-		cfg.Container.Network = fixture.network
-	}
+	cfg.Runner.Timeout = cmp.Or(options.timeout, cfg.Runner.Timeout)
+	cfg.Container.Network = fixture.network
 
 	scheme := labels.SchemeDocker
 	if options.kubernetes != nil {

e2e/scheduling_test.go

@@ -75,10 +75,16 @@ func testCapacity(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			api, repo := newScenario(t)
+			gate, release := newGate(t)
+			if err := api.CreateVariable(t.Context(), repo, "E2E_GATE", gate); err != nil {
+				t.Fatalf("create gate variable: %v", err)
+			}
 			startRunner(t, repo, "e2e-capacity", runnerOptions{capacity: tc.capacity})
 			pushWorkflow(t, api, repo, "capacity.yml")
 
 			wfRun := waitForRun(t, api, repo)
+			waitForRunningJobLog(t, api, repo, wfRun.ID, "span-start=", tc.capacity)
+			release()
 			requireSuccess(t, api, repo, wfRun.ID)
 
 			jobs, err := api.Jobs(t.Context(), repo, wfRun.ID)

e2e/testdata/workflows/capacity.yml

@@ -6,12 +6,12 @@ jobs:
     steps:
       - run: |
           echo "span-start=$(date +%s%N)"
-          sleep 8
+          until curl -fs "${{ vars.E2E_GATE }}" > /dev/null; do sleep 0.1; done
           echo "span-end=$(date +%s%N)"
   two:
     runs-on: e2e-capacity
     steps:
       - run: |
           echo "span-start=$(date +%s%N)"
-          sleep 8
+          until curl -fs "${{ vars.E2E_GATE }}" > /dev/null; do sleep 0.1; done
           echo "span-end=$(date +%s%N)"

e2e/testdata/workflows/cli_shutdown.yml

@@ -6,5 +6,5 @@ jobs:
     steps:
       - run: |
           echo e2e-shutdown-started
-          sleep 8
+          until curl -fs "${{ vars.E2E_GATE }}" > /dev/null; do sleep 0.1; done
           echo e2e-shutdown-finished

e2e/testdata/workflows/failure.yml

@@ -21,10 +21,3 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - run: echo dependent
-  timeout:
-    runs-on: ubuntu-latest
-    timeout-minutes: 1
-    steps:
-      - run: |
-          echo e2e-timeout-started
-          sleep 300