fix: suppress tar leading slash warnings

Replace the Tart-based prototype with a runner-oriented macOS VM
executor backed by runner-executor-macos and Apple Virtualization.

Assisted-by: Codet:MODEL_VERSION

.gitea/workflows/release-nightly.yml

@@ -74,10 +74,10 @@ jobs:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       - name: Login to DockerHub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
@@ -94,7 +94,7 @@ jobs:
           echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT
 
       - name: Build and push
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           file: ./Dockerfile

.gitea/workflows/release-tag.yml

@@ -77,10 +77,10 @@ jobs:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       - name: Login to DockerHub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
@@ -103,7 +103,7 @@ jobs:
             suffix=${{ matrix.variant.tag_suffix }},onlatest=true
 
       - name: Build and push
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           file: ./Dockerfile

.gitea/workflows/test.yml

@@ -30,8 +30,8 @@ jobs:
       # daemon retains them between runs, so this is usually a fast manifest re-check.
       - name: pre-pull test images
         env:
-          TEST_JOB_IMAGE: node:24-bookworm-slim@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 # renovate: datasource=docker
-          TEST_SERVICE_IMAGE: nginx:alpine@sha256:df221db836e1754089190208cee7eeda94f233197056426eda74a43ab1abeac2 # renovate: datasource=docker
+          TEST_JOB_IMAGE: node:24-bookworm-slim@sha256:ba849c60be29959425b8734d57b8b4b7d56f98edd9504c9af091d5281095a71e # renovate: datasource=docker
+          TEST_SERVICE_IMAGE: nginx:alpine@sha256:db35bfc6b2951e7f8a72db5db120288c127ffaeeb4a6d4b95a26fead017d5913 # renovate: datasource=docker
         run: |
           for image in "$TEST_JOB_IMAGE" "$TEST_SERVICE_IMAGE"; do
             for attempt in 1 2 3; do
@@ -53,8 +53,6 @@ jobs:
       # after `make test` so the images it needs are already present on the host daemon.
       - name: test against dind image
         run: make test-dind
-      - name: test against podman
-        run: make test-dind TARGET=podman
       - name: coverage report
         run: |
           make coverage-report

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

DEVELOPMENT.md

@@ -31,11 +31,6 @@ depending on the prefix:
 - Command *properties* also escape `%3A` and `%2C`, which the UI never decodes, so the reporter
   decodes exactly those two when folding a location into an annotation.
 
-## Built-in actions
-
-Each lives in `internal/pkg/action/<name>` and is registered in `builtinActions` in
-`act/runner/step_action_builtin.go`.
-
 ## End-to-end compatibility tests
 
 `make test-e2e` runs the runner against `E2E_GITEA_IMAGE`. It defaults to the nightly image.

Dockerfile

@@ -32,8 +32,6 @@ COPY scripts/s6 /etc/s6
 
 VOLUME /data
 
-ENV TINI_SUBREAPER=1
-
 ENTRYPOINT ["s6-svscan","/etc/s6"]
 
 ### DIND-ROOTLESS VARIANT
@@ -58,7 +56,6 @@ VOLUME /data
 RUN mkdir -p /data && chown -R rootless:rootless /etc/s6 /data
 
 ENV DOCKER_HOST=unix:///run/user/1000/docker.sock
-ENV TINI_SUBREAPER=1
 
 USER rootless
 ENTRYPOINT ["s6-svscan","/etc/s6"]

Makefile

@@ -6,12 +6,7 @@ SHASUM ?= shasum -a 256
 HAS_GO = $(shell hash $(GO) > /dev/null 2>&1 && echo "GO" || echo "NOGO" )
 XGO_PACKAGE ?= src.techknowlogick.com/[email protected] # renovate: datasource=go
 XGO_VERSION := go-1.27.x
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/[email protected]7 # renovate: datasource=go
-
-PODMAN_TEST_IMAGE ?= quay.io/containers/podman:v5.8.4-immutable@sha256:90405e3c6a86f33c5a6f8dbdfa8e02a98143a8ba4337b84bdaec5336d2ef008a # renovate: datasource=docker
-E2E_JOB_IMAGE ?= node:24-bookworm@sha256:64af3819f9275802414d7cdc38c27e9d82bd564dec4d4da87d008255d36c63b4 # renovate: datasource=docker
-SERVICE_IMAGE ?= nginx:1.31.4-alpine@sha256:db35bfc6b2951e7f8a72db5db120288c127ffaeeb4a6d4b95a26fead017d5913 # renovate: datasource=docker
-E2E_GITEA_IMAGE ?= gitea/gitea:main-nightly
+GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/[email protected]6 # renovate: datasource=go
 
 LINUX_ARCHS ?= linux/amd64,linux/arm64
 DARWIN_ARCHS ?= darwin-12/amd64,darwin-12/arm64
@@ -23,8 +18,8 @@ DOCKER_TAG ?= nightly
 DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
 DOCKER_ROOTLESS_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)-dind-rootless
 
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/[email protected].2 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.8.0 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/[email protected].1 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.7.0 # renovate: datasource=go
 
 GOTEST_FLAGS ?= -race -timeout 20m -parallel 8
 
@@ -101,8 +96,13 @@ go-check:
 	fi
 
 .PHONY: fmt-check
-fmt-check: ## check the Go code formatting
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) fmt --diff-colored
+fmt-check: fmt
+	@diff=$$(git diff --color=always -- '*.go'); \
+	if [ -n "$$diff" ]; then \
+		echo "Please run 'make fmt' and commit the result:"; \
+		printf "%s" "$${diff}"; \
+		exit 1; \
+	fi
 
 .PHONY: deps-tools
 deps-tools: ## install tool dependencies
@@ -149,8 +149,13 @@ tidy: ## run go mod tidy
 	fi
 
 .PHONY: tidy-check
-tidy-check: ## check that go.mod and go.sum are tidy
-	$(GO) mod tidy -diff
+tidy-check: tidy
+	@diff=$$(git diff --color=always -- go.mod go.sum); \
+	if [ -n "$$diff" ]; then \
+		echo "Please run 'make tidy' and commit the result:"; \
+		printf "%s" "$${diff}"; \
+		exit 1; \
+	fi
 
 .PHONY: test
 test: ## test everything (integration tests self-skip without docker/network)
@@ -163,9 +168,12 @@ coverage-report: ## turn coverage.txt from `make test` into .tmp/coverage.md
 	@echo "Wrote .tmp/coverage.md"
 
 .PHONY: test-dind
-test-dind: ## run the daemon-facing tests against the built dind image or podman (TARGET=dind|dind-rootless|podman)
-	@PODMAN_TEST_IMAGE=$(PODMAN_TEST_IMAGE) ./scripts/test-dind.sh $(TARGET)
+test-dind: ## run the daemon-facing tests against the built dind image (TARGET=dind|dind-rootless)
+	@./scripts/test-dind.sh $(TARGET)
 
+E2E_JOB_IMAGE ?= node:24-bookworm@sha256:be23f54a88d34e8824c741b19b91064094f92c1c97b194144bfc8b50d67258e2 # renovate: datasource=docker
+SERVICE_IMAGE ?= nginx:1.31.4-alpine@sha256:db35bfc6b2951e7f8a72db5db120288c127ffaeeb4a6d4b95a26fead017d5913 # renovate: datasource=docker
+E2E_GITEA_IMAGE ?= gitea/gitea:main-nightly
 E2E_CONCURRENCY ?= 8
 
 .PHONY: test-e2e

README.md

@@ -201,10 +201,10 @@ A label is written as:
 | Part | Meaning |
 | --- | --- |
 | `name` | The name a workflow refers to in `runs-on`, e.g. `ubuntu-latest`. |
-| `schema` | Either `docker` or `host`. Defaults to `host` when omitted. |
-| `args` | Only used by the `docker` schema: the image to run the job in. |
+| `schema` | Either `docker`, `host`, or `macos-vm`. Defaults to `host` when omitted. |
+| `args` | Used by `docker` for the image, and by `macos-vm` for the source VM. |
 
-Two schemas are supported:
+Three schemas are supported:
 
 - **`docker://<image>`** — the job runs inside a container created from `<image>`:
 
@@ -218,15 +218,21 @@ Two schemas are supported:
   macos:host
   ```
 
+- **`macos-vm://<source-vm>`** — the job runs inside an ephemeral macOS VM created by `runner-executor-macos`. The VM image must include the runner guest agent. Service containers are not supported with this schema. See `docs/macos-vm-executor.md` for configuration, integration testing, and cleanup details:
+
+  ```text
+  macos-latest:macos-vm://ghcr.io/cirruslabs/macos-sonoma-base:latest
+  ```
+
 So with the labels
 
 ```text
-ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest,macos:host
+ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest,macos:host,macos-latest:macos-vm://ghcr.io/cirruslabs/macos-sonoma-base:latest
 ```
 
-a workflow with `runs-on: ubuntu-latest` is executed in the `runner-images:ubuntu-latest` container, and one with `runs-on: macos` is executed directly on the host.
+a workflow with `runs-on: ubuntu-latest` is executed in the `runner-images:ubuntu-latest` container, one with `runs-on: macos` is executed directly on the host, and one with `runs-on: macos-latest` is executed in the macOS VM.
 
-Names may themselves contain a colon (for example `pool:e57e18d4-10d4-406f-93bf-60f127221bdd`); only `host` and `docker` are treated as schemas.
+Names may themselves contain a colon (for example `pool:e57e18d4-10d4-406f-93bf-60f127221bdd`); only `host`, `docker`, and `macos-vm` are treated as schemas.
 
 If a job's `runs-on` matches none of the runner's labels, or sets no `runs-on` at all, it still runs: in `runner.default_image` where docker is available, on the host where it is not. Images maintained for this purpose are listed at [gitea/runner-images](https://gitea.com/gitea/runner-images).
 
@@ -266,17 +272,6 @@ A job in a container reaches a service by its id on the job network, on the port
 
 Unlike GitHub, a job whose steps run on the host (a `host` label without `container:`) starts no service containers, so `job.services` and `job.container` stay empty. Give such a job a `container:` when it needs services.
 
-#### Docker from a job (`GITEA_DOCKER_WORKSPACE`)
-
-Containers a job starts through the Docker socket can bind-mount the workspace by the job's own path, as on a host, for example `docker run -v "$PWD:/src"`. Without the Docker proxy, for example with a remote `DOCKER_HOST`, use `GITEA_DOCKER_WORKSPACE`, the path the daemon sees, as the prefix of workspace binds, with `.` as the fallback for local use:
-
-```yaml
-volumes:
-  - ${GITEA_DOCKER_WORKSPACE:-.}/data:/app/data
-```
-
-Linux container jobs use a Docker proxy when socket sharing and permissions allow it. Other setups use the daemon socket directly. The proxy removes containers, networks and volumes after post steps and the completed hook. Named volumes created through it are job-scoped. To retain resources, mount the daemon socket explicitly in `container.options`. Host jobs use their existing Docker access, where `.` works.
-
 #### Proxy
 
 Set these variables in the runner's environment, with systemd `Environment=`, `docker run -e`, or Kubernetes `env:`:
@@ -291,14 +286,14 @@ The runner uses them for its own requests and gives them to every job, in lower
 
 These hosts are added to `no_proxy` for jobs, so they are always reached directly:
 
-- the built-in cache server, whose address is assigned at startup
+- the cache server
 - `localhost`, `127.0.0.1` and `::1`
 - the job's service containers
 - the Docker daemon, when it is reached over `tcp://`
 
 Gitea is not added. Add it to `no_proxy` yourself if it should be reached directly.
 
-For one step, set it in the step's `env:`, for the rest of a job, write it to `$GITHUB_ENV`. Setting it at workflow or job level or in `container.env` has no effect. To change it for the whole runner, set it in `runner.envs`. A `no_proxy` set there is added to the list above instead of replacing it.
+To change a value for one job, set it in a step's `env:` or in the job's `container.env`. Setting it at workflow or job level has no effect. To change it for the whole runner, set it in `runner.envs`. A `no_proxy` set there is added to the list above instead of replacing it.
 
 Images are pulled by the Docker daemon, which needs its own proxy setting. In the `dind` images the daemon runs in the same container and reads the variables above. For any other daemon, see [the Docker documentation](https://docs.docker.com/engine/daemon/proxy/). The runner logs a warning at startup if it has a proxy and the daemon does not.
 
@@ -306,68 +301,63 @@ Dockerfile actions are built with these variables as build arguments, so their `
 
 A password in a proxy URL is hidden in job logs. Any step can still read it, because the step is given the proxy URL in its environment.
 
-#### Built-in actions (`uses: builtin:<name>`)
-
-Use `uses: builtin:checkout` to check out a repository without downloading `actions/checkout` or needing Node in the job image, see **[docs/builtin-actions.md](docs/builtin-actions.md)**.
-
 #### Caching (`actions/cache`)
 
-Each runner starts its own cache server, so runners do not share cached entries. A runner in a container on the jobs' Docker daemon attaches itself to each job network, so jobs reach its cache without extra setup.
-
-**Sharing a cache between runners**
-
-Run one `gitea-runner cache-server` and point every runner at it, using the same secret everywhere, for example from `openssl rand -hex 32`:
-
-```yaml
-# cache-server.yaml
-cache:
-  dir: /data/actcache
-  port: 8088
-  external_secret: "<secret>" # or external_secret_file: /path/to/secret
-```
-
-```bash
-gitea-runner -c cache-server.yaml cache-server
-```
-
-```yaml
-# each runner's config
-cache:
-  external_server: "http://<cache-server-host>:8088/"
-  external_secret: "<secret>"
-```
-
-`--dir`, `--host` and `--port` override the matching `cache` keys. Eviction settings take effect on the cache server, not on the runners.
-
-Runners can also share one `cache.dir` on a file system with working file locks, at the cost of slower cache requests.
-
-**Storing the cache in an S3-compatible bucket**
-
-The cache can also be stored in an S3-compatible bucket such as AWS S3, MinIO or RustFS, with no cache server. Runners with the same settings use the same cache:
-
-```yaml
-cache:
-  s3:
-    endpoint: "http://minio:9000"
-    region: "us-east-1"
-    bucket: "runner-cache"
-    prefix: "gitea-runner-cache"
-    path_style: true
-    access_key_file: "/run/secrets/cache-s3-access-key"
-    secret_key_file: "/run/secrets/cache-s3-secret-key"
-```
-
-A cache saved on one runner can be restored on the others within 30 seconds. The eviction settings below do not apply to the bucket, so add lifecycle rules to it that expire old caches and abort incomplete multipart uploads.
+Each runner starts its own cache server automatically. Cache entries are local to that runner — runners do not share a cache by default.
 
 **Eviction**
 
-Entries not read or written within `retention` (default `168h`) are removed. A repository over `repo_size_limit` (default `10GB`) loses its least recently used entries, and `size_limit` (off by default) caps the whole cache the same way. Entries in use are never removed. The cache also keeps 1024 MiB free on its volume, or `health_check.min_free_disk_space_mb` when health checks are enabled. See [config.example.yaml](internal/pkg/config/config.example.yaml) for all options.
+An entry nothing has read or written for `retention` is removed, and a repository past `repo_size_limit` loses its least recently accessed entries until it fits; `size_limit` caps the whole cache the same way. Age alone never retires an entry still in use, and whatever these allow, the cache keeps free space above `health_check.min_free_disk_space_mb` when health checks are enabled.
+
+These apply where the cache server runs, so on a shared server they belong in *its* config, not the runners'. See `retention`, `repo_size_limit`, `size_limit` and `sweep_interval` in [config.example.yaml](internal/pkg/config/config.example.yaml) for units and defaults.
 
 **Cache service v2**
 
-`actions/cache` v3.4.0, v4.2.0 and later use the cache service v2 API, which the runner serves by default. These actions fall back to v1 on hosts they do not recognize as GitHub, so the runner removes that check from them while a job runs. This also lets the stock `actions/upload-artifact` v4.4.0 and `actions/download-artifact` v4.1.8 and later work without the `gitea-upload-artifact` fork. With `runner.patch_actions: false`, the cache stays on v1 and the artifact actions fail.
+`actions/cache@v4.2` and later can use the *cache service v2* API. The runner serves it from the same store as v1, on by default, and it works with `external_server`. Turn it off with:
 
-With v2, artifact calls also go through the cache server, so jobs must be able to reach it. `cache.v2: false` sends them to Gitea directly, unless the Gitea URL has a path or `runner.insecure` is set with HTTPS.
+```yaml
+cache:
+  v2: false
+```
+
+Those actions refuse any host they do not take for GitHub. Rather than misreport the server URL, the runner edits that check out of the action's own bundle on its way into the job, undone whenever the action is downloaded again. A bundle it does not recognise is left alone and keeps to v1. The same edit lets the stock `actions/upload-artifact` and `actions/download-artifact` work from `v4.4.0` on, without the `gitea-upload-artifact` fork, so it is made whatever `v2` says: that setting only governs the API the runner advertises. Set `runner.patch_actions: false` to leave every bundle exactly as shipped, an escape hatch for an action the edit breaks. The artifact actions then refuse again and the cache client keeps to v1.
+
+**Shared cache across multiple runners**
+
+Run one dedicated `gitea-runner cache-server` that all runners point at.
+
+1. Create a config file for the cache server host:
+
+   ```yaml
+   cache:
+     dir: /data/actcache
+     port: 8088
+     external_secret: "replace-with-a-strong-random-secret"
+     # external_secret_file: /path/to/secret # secret can also be passed via a file
+   ```
+
+2. Start the server:
+
+   ```bash
+   gitea-runner -c cache-server-config.yaml cache-server
+   ```
+
+3. On every runner:
+
+   ```yaml
+   cache:
+     external_server: "http://<cache-server-host>:8088/"
+     external_secret: "replace-with-a-strong-random-secret"  # must match the server
+     # external_secret_file: /path/to/secret # secret can also be passed via a file
+   ```
+
+Jobs reach the cache server at `external_server`, so when a reverse proxy fronts the server, point `external_server` at the proxy. The cache server itself needs no extra configuration.
+
+Alternatively, mount the same NFS/CIFS share on every runner and point `cache.dir` at it — simpler, but with weaker isolation between repositories.
+
+**S3 / MinIO** — mount object storage as a FUSE filesystem (e.g. [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) or [goofys](https://github.com/kahing/goofys)) and set `cache.dir` to the mount point.
+
+Flags `--dir`, `--host`, and `--port` on `cache-server` override the corresponding `cache.*` YAML keys; all other settings, including `external_secret`, require the config file.
 
 #### Official Docker image
 
@@ -402,10 +392,6 @@ Both hooks are synchronous and block the job while they run. Either one exiting
 
 See **[docs/job-hooks.md](docs/job-hooks.md)** for the execution order, environment, and platform notes.
 
-#### OpenTelemetry (`OTEL_*`)
-
-Set `OTEL_EXPORTER_OTLP_ENDPOINT` in the runner's environment to send a trace of every job to an OpenTelemetry collector. See **[docs/telemetry.md](docs/telemetry.md)**.
-
 #### Local job logs (`log.job.dir`)
 
 Set `log.job.dir` to a path and the runner writes a copy of every task's log there as `<start time>-task-<id>.log`: the rows exactly as Gitea received them, with the same secrets masked and the job's result on the last line. Off by default, and what Gitea shows does not change.

act/artifactcache/handler.go

@@ -10,7 +10,6 @@ import (
 	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha256"
-	"encoding/binary"
 	"encoding/hex"
 	"encoding/json/v2"
 	"errors"
@@ -18,10 +17,10 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"net/http/httputil"
 	"net/url"
 	"os"
 	"path/filepath"
+	"regexp"
 	"slices"
 	"strconv"
 	"strings"
@@ -59,9 +58,10 @@ type JobCredential struct {
 	Repo string `json:"repo"`
 
 	// Results is the instance whose artifact service this server forwards for the job, and
-	// InsecureTLS how the runner reaches it; see results.go.
-	Results     string `json:"-"`
-	InsecureTLS bool   `json:"-"`
+	// InsecureTLS how the runner reaches it; see results.go. The tags are the wire format a
+	// remote runner registers with.
+	Results     string `json:"results"`
+	InsecureTLS bool   `json:"insecure_tls"`
 
 	// PublicURL is this server as a reverse proxy makes the job reach it, not the listen address.
 	PublicURL string `json:"public_url"`
@@ -79,8 +79,7 @@ type credEntry struct {
 
 type Handler struct {
 	dir      string
-	storage  cacheStorage
-	s3       *s3Storage
+	storage  *Storage
 	router   *httprouter.Router
 	listener net.Listener
 	port     int
@@ -90,9 +89,6 @@ type Handler struct {
 	gcing atomic.Bool
 	gcAt  time.Time
 
-	stopSync context.CancelFunc
-	syncing  sync.WaitGroup
-
 	outboundIP string
 
 	// internalSecret guards /_internal/{register,revoke}. When set, a remote
@@ -122,8 +118,6 @@ type Options struct {
 	Dir        string
 	OutboundIP string
 	Port       uint16
-	S3         *S3Options
-	Upstream   string
 
 	// InternalSecret, when non-empty, enables a control-plane API at
 	// /_internal/{register,revoke} that lets a remote runner pre-register the
@@ -136,7 +130,7 @@ type Options struct {
 	Logger logrus.FieldLogger
 }
 
-// StartHandler starts an embedded cache or forwards cache requests to Upstream.
+// StartHandler opens the on-disk cache store and starts the HTTP server.
 func StartHandler(opts Options) (*Handler, error) {
 	dir, logger := opts.Dir, opts.Logger
 	h := &Handler{
@@ -154,25 +148,6 @@ func StartHandler(opts Options) (*Handler, error) {
 	logger = logger.WithField("module", "artifactcache")
 	h.logger = logger
 
-	if opts.OutboundIP != "" {
-		h.outboundIP = opts.OutboundIP
-	} else if ip := common.GetOutboundIP(); ip == nil {
-		return nil, errors.New("unable to determine outbound IP address")
-	} else {
-		h.outboundIP = ip.String()
-	}
-
-	if opts.Upstream != "" {
-		handler, err := h.cacheForwarder(opts.Upstream)
-		if err != nil {
-			return nil, err
-		}
-		if err := h.serve(opts.Port, handler); err != nil {
-			return nil, err
-		}
-		return h, nil
-	}
-
 	if dir == "" {
 		home, err := os.UserHomeDir()
 		if err != nil {
@@ -191,11 +166,13 @@ func StartHandler(opts Options) (*Handler, error) {
 		return nil, err
 	}
 	h.storage = storage
-	if opts.S3 != nil {
-		if h.s3, err = newS3Storage(storage, *opts.S3); err != nil {
-			return nil, err
-		}
-		h.storage = h.s3
+
+	if opts.OutboundIP != "" {
+		h.outboundIP = opts.OutboundIP
+	} else if ip := common.GetOutboundIP(); ip == nil {
+		return nil, errors.New("unable to determine outbound IP address")
+	} else {
+		h.outboundIP = ip.String()
 	}
 
 	secret, err := loadOrCreateSecret(dir)
@@ -225,79 +202,39 @@ func StartHandler(opts Options) (*Handler, error) {
 
 	h.gcCache()
 
-	if err := h.serve(opts.Port, router); err != nil {
-		return nil, err
-	}
-	if h.s3 != nil {
-		ctx, cancel := context.WithCancel(context.Background())
-		h.stopSync = cancel
-		h.syncing.Go(func() { h.syncMetadata(ctx) })
-	}
-	return h, nil
-}
-
-func (h *Handler) serve(port uint16, handler http.Handler) error {
 	// Listen on all interfaces. Binding to outboundIP only would give no real
 	// security benefit (it is the LAN/internet-facing address either way) and
 	// can break Docker Desktop variants where the host's outbound IP is not
 	// routable from inside the container network. Authentication is enforced
 	// by the bearer middleware and per-repo scoping, not by reachability.
-	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
+	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", opts.Port))
 	if err != nil {
-		return err
+		return nil, err
 	}
 	addr, ok := listener.Addr().(*net.TCPAddr)
 	if !ok {
 		listener.Close()
-		return fmt.Errorf("cache server listens on %T, want a TCP address", listener.Addr())
+		return nil, fmt.Errorf("cache server listens on %T, want a TCP address", listener.Addr())
 	}
 	h.port = addr.Port
 	server := &http.Server{
 		ReadHeaderTimeout: 2 * time.Second,
-		Handler:           handler,
+		Handler:           router,
 	}
 	go func() {
 		if err := server.Serve(listener); err != nil && errors.Is(err, net.ErrClosed) {
-			h.logger.Errorf("http serve: %v", err)
+			logger.Errorf("http serve: %v", err)
 		}
 	}()
 	h.listener = listener
 	h.server = server
 
-	return nil
-}
-
-func (h *Handler) cacheForwarder(upstream string) (http.Handler, error) {
-	target, err := url.Parse(strings.TrimRight(upstream, "/"))
-	if err != nil {
-		return nil, fmt.Errorf("parse cache upstream: %w", err)
-	}
-	transport, _ := http.DefaultTransport.(*http.Transport)
-	transport = transport.Clone()
-	transport.MaxIdleConnsPerHost = 64 // parallel block uploads would otherwise redial past the default 2
-	proxy := &httputil.ReverseProxy{
-		Transport: transport,
-		Rewrite: func(r *httputil.ProxyRequest) {
-			r.SetURL(target)
-			r.Out.URL.RawQuery = r.In.URL.RawQuery // Rewrite drops unparsable query params, and signed URLs must pass verbatim.
-		},
-		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
-			h.logger.Warnf("cache forward %s %s: %v", r.Method, r.URL.Path, err)
-			h.twirpError(w, r, twirpUnavailable, errors.New("cache upstream is unavailable"))
-		},
-	}
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasPrefix(r.URL.Path, apiPath+"/") || strings.HasPrefix(r.URL.Path, cacheServiceV2Path+"/") {
-			proxy.ServeHTTP(w, r)
-		} else {
-			h.forwardOrNotFound(w, r)
-		}
-	}), nil
+	return h, nil
 }
 
 func (h *Handler) ExternalURL() string {
 	// TODO: make the external url configurable if necessary
-	return "http://" + net.JoinHostPort(h.outboundIP, strconv.Itoa(h.port))
+	return fmt.Sprintf("http://%s:%d", h.outboundIP, h.port)
 }
 
 func (h *Handler) baseURL(cred JobCredential) string {
@@ -397,10 +334,6 @@ func (h *Handler) Close() error {
 	if h == nil {
 		return nil
 	}
-	if h.stopSync != nil {
-		h.stopSync()
-		h.syncing.Wait()
-	}
 	var retErr error
 	if h.server != nil {
 		err := h.server.Close()
@@ -434,72 +367,6 @@ func (h *Handler) openDB() (*bolthold.Store, error) {
 	})
 }
 
-// syncMetadata mirrors the bucket into the store until ctx ends, so no request waits on S3 for it.
-func (h *Handler) syncMetadata(ctx context.Context) {
-	ticker := time.NewTicker(metadataSyncInterval)
-	defer ticker.Stop()
-	for {
-		if err := h.importMetadata(ctx); err != nil && ctx.Err() == nil {
-			h.logger.Warnf("sync S3 cache: %v", err)
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-		}
-	}
-}
-
-// importMetadata lists after snapshotting the store, so an entry committed meanwhile, published before it is stored, stays.
-func (h *Handler) importMetadata(ctx context.Context) error {
-	db, err := h.openDB()
-	if err != nil {
-		return err
-	}
-	local := h.caches(db, bolthold.Where("Complete").Eq(true).Index("Complete"))
-	db.Close()
-
-	published, err := h.s3.published(ctx)
-	if err != nil {
-		return err
-	}
-	var gone []*Cache
-	for _, cache := range local {
-		if !published[cache.ID] {
-			gone = append(gone, cache)
-		}
-		delete(published, cache.ID)
-	}
-	added := make([]*Cache, 0, len(published))
-	for id := range published {
-		cache, err := h.s3.fetch(ctx, id)
-		if err != nil {
-			return err
-		}
-		added = append(added, cache)
-	}
-
-	db, err = h.openDB()
-	if err != nil {
-		return err
-	}
-	defer db.Close()
-	return db.Bolt().Update(func(tx *bbolt.Tx) error {
-		for _, cache := range added {
-			if err := db.TxUpsert(tx, cache.ID, cache); err != nil {
-				return err
-			}
-		}
-		for _, cache := range gone {
-			_ = h.s3.Storage.Remove(cache.ID) // a blob kept on disk before the runner used S3
-			if err := db.TxDelete(tx, cache.ID, cache); err != nil && !errors.Is(err, bolthold.ErrNotFound) {
-				return err
-			}
-		}
-		return nil
-	})
-}
-
 // GET /_apis/artifactcache/cache
 func (h *Handler) find(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 	cred := credFromContext(r.Context())
@@ -542,7 +409,7 @@ func (h *Handler) lookupCache(db *bolthold.Store, repo string, keys []string, ve
 		return nil, err
 	}
 	if !ok {
-		h.deleteCache(db, cache)
+		_ = db.Delete(cache.ID, cache)
 		return nil, nil //nolint:nilnil // absence is not an error here
 	}
 	// Handing out a download URL counts as access, or eviction could drop the entry between
@@ -574,7 +441,7 @@ func (h *Handler) reserve(w http.ResponseWriter, r *http.Request, _ httprouter.P
 	now := time.Now().Unix()
 	cache.CreatedAt = now
 	cache.UsedAt = now
-	if err := h.insertCache(db, cache); err != nil {
+	if err := insertCache(db, cache); err != nil {
 		h.responseJSON(w, r, 500, err)
 		return
 	}
@@ -688,12 +555,6 @@ func (h *Handler) commitCache(cache *Cache) error {
 	cache.Size = written
 	cache.Complete = true
 	cache.UsedAt = time.Now().Unix() // a just-written entry counts as accessed, so it cannot be its own eviction victim
-	if h.s3 != nil {
-		if err := h.s3.publish(cache); err != nil {
-			_ = h.storage.Remove(cache.ID)
-			return err
-		}
-	}
 
 	db, err := h.openDB()
 	if err != nil {
@@ -703,9 +564,6 @@ func (h *Handler) commitCache(cache *Cache) error {
 	if err := db.Update(cache.ID, cache); err != nil {
 		return err
 	}
-	if h.s3 != nil {
-		return nil // lifecycle rules on the bucket bound its size
-	}
 	// A commit is the only thing that grows the store, so the only thing that can push the
 	// volume under the floor.
 	h.evictRepo(db, cache.Repo)
@@ -745,12 +603,12 @@ func (h *Handler) bearerAuth(handler httprouter.Handle) httprouter.Handle {
 		h.logger.Debugf("%s %s", r.Method, r.URL.Path)
 		token := bearerToken(r)
 		if token == "" {
-			h.unauthorized(w, r, errors.New("missing bearer token"))
+			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("missing bearer token"))
 			return
 		}
 		cred, ok := h.lookupCredential(token)
 		if !ok {
-			h.unauthorized(w, r, errors.New("unknown bearer token"))
+			h.responseJSON(w, r, http.StatusUnauthorized, errors.New("unknown bearer token"))
 			return
 		}
 		ctx := context.WithValue(r.Context(), credKey{}, cred)
@@ -759,14 +617,6 @@ func (h *Handler) bearerAuth(handler httprouter.Handle) httprouter.Handle {
 	}
 }
 
-func (h *Handler) unauthorized(w http.ResponseWriter, r *http.Request, err error) {
-	if strings.HasPrefix(r.URL.Path, cacheServiceV2Path) {
-		h.twirpError(w, r, twirpUnauthenticated, err)
-		return
-	}
-	h.responseJSON(w, r, http.StatusUnauthorized, err)
-}
-
 // signedAuth authenticates a signed URL. purpose separates the flavours of URL the
 // handler hands out, so one cannot be replayed as another; see computeSignature.
 func (h *Handler) signedAuth(purpose string, handler httprouter.Handle) httprouter.Handle {
@@ -851,7 +701,8 @@ func (h *Handler) internalRegister(w http.ResponseWriter, r *http.Request, _ htt
 		return
 	}
 	h.RegisterJob(body.Token, body.JobCredential)
-	h.responseJSON(w, r, http.StatusOK)
+	// A server too old to forward answers without this, which is how the caller knows.
+	h.responseJSON(w, r, http.StatusOK, map[string]any{"results_url": h.ResultsURL(body.JobCredential)})
 }
 
 // POST /_internal/revoke
@@ -869,12 +720,6 @@ func (h *Handler) internalRevoke(w http.ResponseWriter, r *http.Request, _ httpr
 	h.responseJSON(w, r, http.StatusOK)
 }
 
-// hashedToken fingerprints a job's bearer, so a reservation can tell its own retry from another job.
-func hashedToken(token string) string {
-	sum := sha256.Sum256([]byte(token))
-	return hex.EncodeToString(sum[:])
-}
-
 func bearerToken(r *http.Request) string {
 	auth := r.Header.Get("Authorization")
 	const prefix = "Bearer "
@@ -925,9 +770,14 @@ func findCache(db *bolthold.Store, repo string, keys []string, version string) (
 		if exact != nil {
 			return exact, nil
 		}
+		prefixPattern := "^" + regexp.QuoteMeta(prefix)
+		re, err := regexp.Compile(prefixPattern)
+		if err != nil {
+			continue
+		}
 		if err := db.FindOne(cache,
-			bolthold.Where("Repo").Eq(repo).Index("Repo").
-				And("Key").MatchFunc(func(key string) (bool, error) { return strings.HasPrefix(key, prefix), nil }).
+			bolthold.Where("Repo").Eq(repo).
+				And("Key").RegExp(re).
 				And("Version").Eq(version).
 				And("Complete").Eq(true).
 				SortBy("CreatedAt").Reverse()); err != nil {
@@ -955,8 +805,8 @@ func findExactCache(db *bolthold.Store, repo, key, version string, complete bool
 	}
 	cache := &Cache{}
 	err := db.FindOne(cache,
-		bolthold.Where("Key").Eq(key).Index("Key").
-			And("Repo").Eq(repo).
+		bolthold.Where("Repo").Eq(repo).
+			And("Key").Eq(key).
 			And("Version").Eq(version).
 			And("Complete").Eq(complete).
 			SortBy(sortBy).Reverse())
@@ -969,23 +819,15 @@ func findExactCache(db *bolthold.Store, repo, key, version string, complete bool
 	return cache, nil
 }
 
-func (h *Handler) insertCache(db *bolthold.Store, cache *Cache) error {
-	if h.s3 != nil {
-		var id [8]byte
-		_, _ = rand.Read(id[:])
-		cache.ID = binary.BigEndian.Uint64(id[:]) >> 11 // IDs must be unique across runners, and v1 clients parse an ID as a JS number
-		return db.Insert(cache.ID, cache)
+func insertCache(db *bolthold.Store, cache *Cache) error {
+	if err := db.Insert(bolthold.NextSequence(), cache); err != nil {
+		return fmt.Errorf("insert cache: %w", err)
 	}
-	return db.Bolt().Update(func(tx *bbolt.Tx) error {
-		if err := db.TxInsert(tx, bolthold.NextSequence(), cache); err != nil {
-			return fmt.Errorf("insert cache: %w", err)
-		}
-		// write back id to db
-		if err := db.TxUpdate(tx, cache.ID, cache); err != nil {
-			return fmt.Errorf("write back id to db: %w", err)
-		}
-		return nil
-	})
+	// write back id to db
+	if err := db.Update(cache.ID, cache); err != nil {
+		return fmt.Errorf("write back id to db: %w", err)
+	}
+	return nil
 }
 
 // touchCache stamps UsedAt so gcCache does not reap an entry mid-upload. With requireIncomplete
@@ -1010,9 +852,6 @@ func (h *Handler) touchCache(id uint64, requireIncomplete bool) error {
 	if requireIncomplete && cache.Complete {
 		return fmt.Errorf("cache %d: already complete", id)
 	}
-	if !touchNeeded(cache) {
-		return nil
-	}
 	cache.UsedAt = time.Now().Unix()
 	return db.Update(cache.ID, cache)
 }
@@ -1022,19 +861,15 @@ const (
 
 	defaultSweepInterval = time.Hour
 
-	touchStale = time.Minute // how stale a completed entry's UsedAt may get before an access rewrites it, sparing hits the fsync
-
-	// inUseGrace covers artifactURLTTL plus the touchStale lag so an entry outlives every signed URL
-	// still usable for it, and no sweep cuts off a download in progress.
-	inUseGrace = artifactURLTTL + touchStale
+	// inUseGrace matches artifactURLTTL so an entry outlives every signed URL still usable
+	// for it, and no sweep cuts off a download in progress.
+	inUseGrace = artifactURLTTL
 
 	// uploadStallTimeout is how long a reservation may sit without a chunk before it counts
 	// as abandoned. Widening it also widens the window for findExactCache to hand a finalize
 	// a stale reservation.
 	uploadStallTimeout = 5 * time.Minute
 
-	metadataSyncInterval = 30 * time.Second
-
 	defaultMinFreeDisk = 1024 * miB
 )
 
@@ -1082,9 +917,6 @@ func (h *Handler) gcCache() {
 	defer db.Close()
 
 	h.evictIncomplete(db)
-	if h.s3 != nil {
-		return // lifecycle rules on the bucket expire its entries
-	}
 	h.evictExpired(db)
 	h.evictSuperseded(db)
 	h.evictOversized(db)
@@ -1125,7 +957,7 @@ func (h *Handler) evictExpired(db *bolthold.Store) {
 		return
 	}
 	// Never below inUseGrace, or a short retention would outrun a signed URL already issued.
-	window := max(h.policy.Retention+touchStale, inUseGrace)
+	window := max(h.policy.Retention, inUseGrace)
 	h.sweep(db, bolthold.Where("UsedAt").Lt(time.Now().Add(-window).Unix()).Index("UsedAt"))
 }
 
@@ -1226,18 +1058,10 @@ func inUse(cache *Cache) bool {
 	return time.Since(time.Unix(cache.UsedAt, 0)) < inUseGrace
 }
 
-// touchNeeded skips a write that would not change the second, and completed entries fresher than touchStale.
-func touchNeeded(cache *Cache) bool {
-	return cache.UsedAt < time.Now().Unix() && (!cache.Complete || time.Since(time.Unix(cache.UsedAt, 0)) >= touchStale)
-}
-
 // touch stamps UsedAt through the caller's store, a bolt write on the read path. It cannot
 // go through touchCache, which opens its own store and would block on the exclusive lock
 // for as long as the caller holds one.
 func (h *Handler) touch(db *bolthold.Store, cache *Cache) {
-	if !touchNeeded(cache) {
-		return
-	}
 	cache.UsedAt = time.Now().Unix()
 	if err := db.Update(cache.ID, cache); err != nil {
 		h.logger.Warnf("touch cache: %v", err)
@@ -1282,11 +1106,7 @@ func totalSize(caches []*Cache) int64 {
 // deleteCache drops an entry and its bytes, reporting whether it went fully. The blob goes
 // first, so a failed unlink leaves the row for the next sweep instead of orphaning bytes.
 func (h *Handler) deleteCache(db *bolthold.Store, cache *Cache) bool {
-	storage := h.storage
-	if h.s3 != nil && !cache.Complete {
-		storage = h.s3.Storage // an upload not yet committed has nothing in the bucket
-	}
-	if err := storage.Remove(cache.ID); err != nil {
+	if err := h.storage.Remove(cache.ID); err != nil {
 		h.logger.Warnf("remove cache blob: %v", err)
 		return false
 	}

act/artifactcache/handler_test.go

@@ -12,7 +12,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -53,59 +52,6 @@ func signArtifactURL(h *Handler, id int64) string {
 	return h.signedArtifactURL(JobCredential{}, uint64(id), time.Now().Add(artifactURLTTL))
 }
 
-func TestHandler_ExternalURL(t *testing.T) {
-	assert.Equal(t, "http://[2001:db8::1]:8080", (&Handler{outboundIP: "2001:db8::1", port: 8080}).ExternalURL())
-}
-
-func TestHandler_Upstream(t *testing.T) {
-	var upstream *httptest.Server
-	upstream = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, http.MethodPut, r.Method)
-		assert.Equal(t, "/cache%20server"+blobPath+"/%34%32", r.URL.EscapedPath())
-		assert.Equal(t, "sig=opaque%2Fvalue&raw=a;b", r.URL.RawQuery)
-		assert.Equal(t, strings.TrimPrefix(upstream.URL, "http://"), r.Host)
-		assert.Equal(t, "Bearer unregistered", r.Header.Get("Authorization"))
-		_, err := io.Copy(w, r.Body)
-		assert.NoError(t, err)
-	}))
-	t.Cleanup(upstream.Close)
-	dir := filepath.Join(t.TempDir(), "artifactcache")
-	handler, err := StartHandler(Options{
-		Dir:        dir,
-		OutboundIP: "127.0.0.1",
-		Upstream:   upstream.URL + "/cache%20server//",
-	})
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, handler.Close()) })
-
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodPut,
-		handler.ExternalURL()+blobPath+"/%34%32?sig=opaque%2Fvalue&raw=a;b", strings.NewReader("cache content"))
-	require.NoError(t, err)
-	req.Header.Set("Authorization", "Bearer unregistered")
-	resp, err := http.DefaultClient.Do(req)
-	require.NoError(t, err)
-	forwarded, err := io.ReadAll(resp.Body)
-	resp.Body.Close()
-	require.NoError(t, err)
-	assert.Equal(t, "cache content", string(forwarded))
-
-	resp, err = http.Post(handler.ExternalURL()+internalPath+"/register", "application/json", nil)
-	require.NoError(t, err)
-	resp.Body.Close()
-	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
-
-	upstream.Close()
-	resp, err = http.Post(handler.ExternalURL()+cacheServiceV2Path+"/CreateCacheEntry", "application/json", strings.NewReader(`{}`))
-	require.NoError(t, err)
-	var failure map[string]string
-	err = json.UnmarshalRead(resp.Body, &failure)
-	resp.Body.Close()
-	require.NoError(t, err)
-	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
-	assert.Equal(t, map[string]string{"code": "unavailable", "msg": "cache upstream is unavailable"}, failure)
-	assert.NoDirExists(t, dir)
-}
-
 func TestHandler(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "artifactcache")
 	handler, err := StartHandler(Options{Dir: dir})
@@ -821,7 +767,7 @@ func TestHandler_gcCache(t *testing.T) {
 				Key:       "test_key_3",
 				Version:   "test_version",
 				Complete:  true,
-				UsedAt:    now.Add(-(testRetention + touchStale + time.Second)).Unix(),
+				UsedAt:    now.Add(-(testRetention + time.Second)).Unix(),
 				CreatedAt: now.Add(-(testRetention + time.Hour)).Unix(),
 			},
 			Kept: false,
@@ -864,7 +810,7 @@ func TestHandler_gcCache(t *testing.T) {
 	db, err := handler.openDB()
 	require.NoError(t, err)
 	for _, c := range cases {
-		require.NoError(t, handler.insertCache(db, c.Cache))
+		require.NoError(t, insertCache(db, c.Cache))
 	}
 	require.NoError(t, db.Close())
 
@@ -1036,7 +982,7 @@ func TestHandler_SweepKeepsEntryWhenBlobSurvives(t *testing.T) {
 	handler := newTestHandler(t, Policy{Retention: testRetention}, cache)
 
 	// A non-empty directory where the blob belongs makes os.Remove fail on every platform.
-	blob := handler.storage.(*Storage).filename(cache.ID)
+	blob := handler.storage.filename(cache.ID)
 	require.NoError(t, os.MkdirAll(blob, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(blob, "held"), []byte("x"), 0o600))
 
@@ -1096,51 +1042,27 @@ func TestHandler_gcCacheInterval(t *testing.T) {
 	assert.Empty(t, keptKeys(t, handler, []*Cache{cache}))
 }
 
-func TestHandler_touchCacheSkipsFreshCompletedEntries(t *testing.T) {
-	fresh := &Cache{Repo: testRepo, Key: "fresh", Version: "v", Complete: true, UsedAt: time.Now().Unix()}
-	pending := &Cache{Repo: testRepo, Key: "pending", Version: "v", UsedAt: time.Now().Add(-time.Second).Unix()}
-	handler := newTestHandler(t, Policy{}, fresh, pending)
-	txID := func() int {
-		db, err := handler.openDB()
-		require.NoError(t, err)
-		defer db.Close()
-		var id int
-		require.NoError(t, db.Bolt().View(func(tx *bbolt.Tx) error { id = tx.ID(); return nil }))
-		return id
-	}
-
-	before := txID()
-	require.NoError(t, handler.touchCache(fresh.ID, false))
-	assert.Equal(t, before, txID())
-	require.NoError(t, handler.touchCache(pending.ID, false))
-	assert.Greater(t, txID(), before)
-}
-
 // newTestHandler starts a handler with testToken registered, seeded with entries.
 func newTestHandler(t *testing.T, policy Policy, entries ...*Cache) *Handler {
 	t.Helper()
-	handler := startTestHandler(t, Options{Policy: policy})
+	handler, err := StartHandler(Options{
+		Dir:        filepath.Join(t.TempDir(), "artifactcache"),
+		OutboundIP: "127.0.0.1",
+		Policy:     policy,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, handler.Close()) })
+	handler.RegisterJob(testToken, JobCredential{Repo: testRepo})
 
 	db, err := handler.openDB()
 	require.NoError(t, err)
 	for _, e := range entries {
-		require.NoError(t, handler.insertCache(db, e))
+		require.NoError(t, insertCache(db, e))
 	}
 	require.NoError(t, db.Close())
 	return handler
 }
 
-func startTestHandler(t *testing.T, opts Options) *Handler {
-	t.Helper()
-	opts.Dir = filepath.Join(t.TempDir(), "artifactcache")
-	opts.OutboundIP = "127.0.0.1"
-	handler, err := StartHandler(opts)
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, handler.Close()) })
-	handler.RegisterJob(testToken, JobCredential{Repo: testRepo})
-	return handler
-}
-
 // keptKeys reports which of entries are still in the store.
 func keptKeys(t *testing.T, handler *Handler, entries []*Cache) []string {
 	t.Helper()
@@ -1481,8 +1403,8 @@ func TestHandler_GC_PerRepoDedup(t *testing.T) {
 	stale := time.Now().Add(-inUseGrace - time.Minute).Unix()
 	a := &Cache{Repo: "owner/repoA", Key: key, Version: version, Complete: true, CreatedAt: stale, UsedAt: stale, Size: 1}
 	b := &Cache{Repo: "owner/repoB", Key: key, Version: version, Complete: true, CreatedAt: now, UsedAt: now, Size: 1}
-	require.NoError(t, handler.insertCache(db, a))
-	require.NoError(t, handler.insertCache(db, b))
+	require.NoError(t, insertCache(db, a))
+	require.NoError(t, insertCache(db, b))
 	// Write the backing blobs so the dedup deletion has something to remove.
 	require.NoError(t, handler.storage.Write(a.ID, 0, strings.NewReader("a")))
 	_, err = handler.storage.Commit(a.ID, 1)
@@ -1576,10 +1498,7 @@ func TestHandler_InternalAPI_AuthAndUsage(t *testing.T) {
 		}
 
 		assert.Equal(t, http.StatusUnauthorized, probe("via-internal-api"))
-		assert.Equal(t, http.StatusOK, post("/_internal/register", secret, `{"token":"via-internal-api","repo":"owner/repo","public_url":"http://runner.example","results":"https://gitea.example","insecure_tls":true}`))
-		cred, ok := handler.lookupCredential("via-internal-api")
-		require.True(t, ok)
-		assert.Equal(t, JobCredential{Repo: testRepo, PublicURL: "http://runner.example"}, cred)
+		assert.Equal(t, http.StatusOK, post("/_internal/register", secret, `{"token":"via-internal-api","repo":"owner/repo"}`))
 		assert.NotEqual(t, http.StatusUnauthorized, probe("via-internal-api"))
 		assert.Equal(t, http.StatusOK, post("/_internal/revoke", secret, `{"token":"via-internal-api"}`))
 		assert.Equal(t, http.StatusUnauthorized, probe("via-internal-api"))

act/artifactcache/handler_v2.go

@@ -39,9 +39,8 @@ const (
 
 	blobUploadURLTTL = time.Hour
 
-	twirpInternal        = "internal"
-	twirpUnavailable     = "unavailable"
-	twirpUnauthenticated = "unauthenticated"
+	// twirpInternal is the only error code that is not the client's fault.
+	twirpInternal = "internal"
 )
 
 func (h *Handler) registerV2Routes(router *httprouter.Router) {
@@ -57,7 +56,7 @@ func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request, _ h
 	cred := credFromContext(r.Context())
 	req, err := decodeTwirpRequest[v2CreateRequest](r)
 	if err != nil {
-		h.twirpError(w, r, "malformed", err)
+		h.twirpError(w, r, "malformed_request", err)
 		return
 	}
 	if req.Key == "" || req.Version == "" {
@@ -84,35 +83,16 @@ func (h *Handler) v2CreateCacheEntry(w http.ResponseWriter, r *http.Request, _ h
 		return
 	}
 
-	// A second live reservation is finalized by whichever job calls last, against the other's upload.
-	owner := hashedToken(bearerToken(r))
-	if pending, err := findExactCache(db, cred.Repo, req.Key, req.Version, false); err != nil {
-		h.twirpError(w, r, twirpInternal, err)
-		return
-	} else if pending != nil && pending.UsedAt > time.Now().Add(-uploadStallTimeout).Unix() {
-		if pending.Owner != owner {
-			h.twirpNotOK(w, r)
-			return
-		}
-		h.touch(db, pending)                                // still uploading, so it must not go stale under the sweep
-		h.responseJSON(w, r, http.StatusOK, map[string]any{ // this job retrying its own reservation
-			"ok":                true,
-			"signed_upload_url": h.signedURL(cred, blobPath, blobUploadPurpose, pending.ID, time.Now().Add(blobUploadURLTTL)),
-		})
-		return
-	}
-
 	now := time.Now().Unix()
 	cache := &Cache{
 		Repo:      cred.Repo,
 		Key:       req.Key,
 		Version:   req.Version,
-		Owner:     owner,
 		Size:      -1, // the size is only known at finalize time
 		CreatedAt: now,
 		UsedAt:    now,
 	}
-	if err := h.insertCache(db, cache); err != nil {
+	if err := insertCache(db, cache); err != nil {
 		h.twirpError(w, r, twirpInternal, err)
 		return
 	}
@@ -127,7 +107,7 @@ func (h *Handler) v2FinalizeCacheEntryUpload(w http.ResponseWriter, r *http.Requ
 	cred := credFromContext(r.Context())
 	req, err := decodeTwirpRequest[v2FinalizeRequest](r)
 	if err != nil {
-		h.twirpError(w, r, "malformed", err)
+		h.twirpError(w, r, "malformed_request", err)
 		return
 	}
 
@@ -139,13 +119,6 @@ func (h *Handler) v2FinalizeCacheEntryUpload(w http.ResponseWriter, r *http.Requ
 	defer db.Close()
 
 	cache, err := findExactCache(db, cred.Repo, req.Key, req.Version, false)
-	if err == nil && cache != nil && cache.Owner != hashedToken(bearerToken(r)) {
-		cache = nil // not the reservation this job made, so not this job's to commit
-	}
-	if err == nil && cache == nil {
-		// A retry whose first response was lost finds the entry already committed.
-		cache, err = findExactCache(db, cred.Repo, req.Key, req.Version, true)
-	}
 	if err != nil {
 		h.twirpError(w, r, twirpInternal, err)
 		return
@@ -154,15 +127,13 @@ func (h *Handler) v2FinalizeCacheEntryUpload(w http.ResponseWriter, r *http.Requ
 		h.twirpNotOK(w, r)
 		return
 	}
+	db.Close() // commitCache needs the store closed
 
-	if !cache.Complete {
-		db.Close() // commitCache needs the store closed
-		cache.Size = int64(cmp.Or(req.SizeBytes, req.SizeBytesCamel))
-		if err := h.commitCache(cache); err != nil {
-			h.logger.Errorf("finalize cache %d (%s): %v", cache.ID, cache.Key, err)
-			h.twirpNotOK(w, r)
-			return
-		}
+	cache.Size = int64(cmp.Or(req.SizeBytes, req.SizeBytesCamel))
+	if err := h.commitCache(cache); err != nil {
+		h.logger.Errorf("finalize cache %d (%s): %v", cache.ID, cache.Key, err)
+		h.twirpNotOK(w, r)
+		return
 	}
 
 	h.responseJSON(w, r, http.StatusOK, map[string]any{
@@ -176,7 +147,7 @@ func (h *Handler) v2GetCacheEntryDownloadURL(w http.ResponseWriter, r *http.Requ
 	cred := credFromContext(r.Context())
 	req, err := decodeTwirpRequest[v2DownloadRequest](r)
 	if err != nil {
-		h.twirpError(w, r, "malformed", err)
+		h.twirpError(w, r, "malformed_request", err)
 		return
 	}
 
@@ -259,13 +230,8 @@ func (h *Handler) twirpNotOK(w http.ResponseWriter, r *http.Request) {
 func (h *Handler) twirpError(w http.ResponseWriter, r *http.Request, code string, err error) {
 	h.logger.Debugf("%s %s: %v", r.Method, r.URL.Path, err)
 	status := http.StatusBadRequest
-	switch code {
-	case twirpInternal:
+	if code == twirpInternal {
 		status = http.StatusInternalServerError
-	case twirpUnavailable:
-		status = http.StatusServiceUnavailable
-	case twirpUnauthenticated:
-		status = http.StatusUnauthorized
 	}
 	h.responseJSON(w, r, status, map[string]any{"code": code, "msg": err.Error()})
 }

act/artifactcache/handler_v2_test.go

@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"strconv"
 	"strings"
 	"testing"
@@ -142,17 +141,6 @@ func TestCacheServiceV2BlockUpload(t *testing.T) {
 	}
 	list.WriteString(`</BlockList>`)
 	require.Equal(t, http.StatusCreated, putBlob(t, uploadURL+"&comp=blocklist", list.Bytes()))
-	require.Equal(t, http.StatusCreated, putBlob(t, uploadURL+"&comp=blocklist", list.Bytes()),
-		"a client that lost the first answer retries the list it already sent")
-
-	var reordered bytes.Buffer
-	reordered.WriteString(`<?xml version="1.0" encoding="utf-8"?><BlockList>`)
-	for _, blockID := range []string{order[1], order[0], order[2]} {
-		fmt.Fprintf(&reordered, "<Latest>%s</Latest>", blockID)
-	}
-	reordered.WriteString(`</BlockList>`)
-	assert.Equal(t, http.StatusInternalServerError, putBlob(t, uploadURL+"&comp=blocklist", reordered.Bytes()),
-		"the blocks are already assembled, so a different order would silently disagree with them")
 
 	finalized := v2Call(t, handler, testClient, "FinalizeCacheEntryUpload", map[string]any{
 		"key": "blocks", "version": "v1", "size_bytes": len("hello world!"),
@@ -253,101 +241,3 @@ func TestCacheServiceV2Lookups(t *testing.T) {
 		assert.Equal(t, false, got["ok"])
 	})
 }
-
-func TestCacheServiceV2RefusalsAreTwirp(t *testing.T) {
-	handler := newTestHandler(t, Policy{})
-
-	tests := []struct {
-		name   string
-		token  string
-		body   string
-		status int
-		code   string
-	}{
-		{"no bearer at all", "", `{"key":"k","version":"v"}`, http.StatusUnauthorized, twirpUnauthenticated},
-		{"a bearer nobody registered", "not-a-job", `{"key":"k","version":"v"}`, http.StatusUnauthorized, twirpUnauthenticated},
-		{"a body that is not the request", testToken, `{`, http.StatusBadRequest, "malformed"},
-		{"a request missing its key", testToken, `{"version":"v"}`, http.StatusBadRequest, "invalid_argument"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			req, err := http.NewRequestWithContext(t.Context(), http.MethodPost,
-				handler.ExternalURL()+cacheServiceV2Path+"/CreateCacheEntry", strings.NewReader(tt.body))
-			require.NoError(t, err)
-			if tt.token != "" {
-				req.Header.Set("Authorization", "Bearer "+tt.token)
-			}
-			resp, err := http.DefaultClient.Do(req)
-			require.NoError(t, err)
-			defer resp.Body.Close()
-
-			require.Equal(t, tt.status, resp.StatusCode)
-			got := map[string]string{}
-			require.NoError(t, json.UnmarshalRead(resp.Body, &got))
-			assert.Equal(t, tt.code, got["code"])
-			assert.NotEmpty(t, got["msg"])
-		})
-	}
-}
-
-func TestCacheServiceV2ConcurrentSaveAndRetries(t *testing.T) {
-	handler := newTestHandler(t, Policy{})
-	content := []byte("the cached archive")
-
-	const otherJob = "another-jobs-token"
-	defer handler.RegisterJob(otherJob, JobCredential{Repo: testRepo})()
-	reserve := func(client *http.Client) map[string]any {
-		return v2Call(t, handler, client, "CreateCacheEntry", map[string]any{"key": "shared", "version": "v1"})
-	}
-	first := reserve(testClient)
-	require.Equal(t, true, first["ok"])
-	retry := reserve(testClient)
-	assert.Equal(t, true, retry["ok"], "a job retrying its own reservation is not a conflict")
-	entryOf := func(reserved map[string]any) string {
-		parsed, err := url.Parse(reserved["signed_upload_url"].(string))
-		require.NoError(t, err)
-		return parsed.Path
-	}
-	assert.Equal(t, entryOf(first), entryOf(retry), "the same reservation, however freshly its URL is signed")
-	assert.Equal(t, false, reserve(&http.Client{Transport: &bearerTransport{token: otherJob}})["ok"],
-		"another job's reservation would be finalized against the first upload")
-
-	otherClient := &http.Client{Transport: &bearerTransport{token: otherJob}}
-	reserved := v2Call(t, handler, otherClient, "CreateCacheEntry", map[string]any{"key": "owned", "version": "v1"})
-	require.Equal(t, true, reserved["ok"])
-	require.Equal(t, http.StatusCreated, putBlob(t, reserved["signed_upload_url"].(string), content))
-	assert.Equal(t, false, v2Call(t, handler, testClient, "FinalizeCacheEntryUpload",
-		map[string]any{"key": "owned", "version": "v1", "size_bytes": strconv.Itoa(len(content))})["ok"],
-		"another job's upload is not this job's to finalize")
-
-	base := handler.ExternalURL() + apiPath
-	reserveV1, err := json.Marshal(&Request{Key: "v1-made", Version: "v1", Size: int64(len(content))})
-	require.NoError(t, err)
-	resp, err := testClient.Post(base+"/caches", "application/json", bytes.NewReader(reserveV1))
-	require.NoError(t, err)
-	var madeByV1 struct {
-		CacheID uint64 `json:"cacheId"`
-	}
-	require.NoError(t, json.UnmarshalRead(resp.Body, &madeByV1))
-	resp.Body.Close()
-	upload, err := http.NewRequestWithContext(t.Context(), http.MethodPatch,
-		fmt.Sprintf("%s/caches/%d", base, madeByV1.CacheID), bytes.NewReader(content))
-	require.NoError(t, err)
-	upload.Header.Set("Content-Range", fmt.Sprintf("bytes 0-%d/*", len(content)-1))
-	resp, err = testClient.Do(upload)
-	require.NoError(t, err)
-	resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode)
-
-	assert.Equal(t, false, v2Call(t, handler, testClient, "FinalizeCacheEntryUpload",
-		map[string]any{"key": "v1-made", "version": "v1", "size_bytes": strconv.Itoa(len(content))})["ok"],
-		"a reservation this job did not make through v2 is not its to commit")
-
-	finalized, _ := saveV2(t, handler, "deps", "v1", content)
-	require.Equal(t, true, finalized["ok"])
-	again := v2Call(t, handler, testClient, "FinalizeCacheEntryUpload", map[string]any{
-		"key": "deps", "version": "v1", "size_bytes": strconv.Itoa(len(content)),
-	})
-	assert.Equal(t, true, again["ok"], "a retry whose first answer was lost must not report a failed save")
-	assert.Equal(t, finalized["entry_id"], again["entry_id"])
-}

act/artifactcache/model.go

@@ -16,7 +16,6 @@ type Cache struct {
 	Key       string `json:"key" boltholdIndex:"Key"`
 	Version   string `json:"version" boltholdIndex:"Version"`
 	Size      int64  `json:"cacheSize"`
-	Owner     string `json:"owner"` // hashed bearer, so a job's own retry is not another job's reservation
 	Complete  bool   `json:"complete" boltholdIndex:"Complete"`
 	UsedAt    int64  `json:"usedAt" boltholdIndex:"UsedAt"`
 	CreatedAt int64  `json:"createdAt" boltholdIndex:"CreatedAt"`

act/artifactcache/results.go

@@ -5,8 +5,6 @@ package artifactcache
 
 import (
 	"crypto/tls"
-	"errors"
-	"fmt"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
@@ -17,38 +15,23 @@ import (
 // Gitea implements only the artifact half of it. Forwarding that half from here makes this origin
 // the whole service, so ACTIONS_RESULTS_URL can point at it truthfully, which is what the clients
 // this runner cannot patch need, docker buildx among them.
+//
+// The instance to forward to travels with the job registration rather than with configuration, so
+// a cache server shared between runners serves each of their instances.
 const artifactServicePath = "/twirp/github.actions.results.api.v1.ArtifactService/"
 
 // forwardOrNotFound is the router's fallback: the artifact service of the instance the job
 // registered with, and the 404 the router would have written otherwise.
 func (h *Handler) forwardOrNotFound(w http.ResponseWriter, r *http.Request) {
-	if !strings.HasPrefix(r.URL.Path, artifactServicePath) {
+	cred, ok := h.lookupCredential(bearerToken(r))
+	if !ok || cred.Results == "" || !strings.HasPrefix(r.URL.Path, artifactServicePath) {
 		http.NotFound(w, r)
 		return
 	}
-	cred, ok := h.lookupCredential(bearerToken(r))
-	if !ok {
-		h.twirpError(w, r, twirpUnauthenticated, errors.New("unknown bearer token"))
-		return
-	}
-	if cred.Results == "" {
-		h.twirpError(w, r, twirpInternal, errors.New("no instance is registered for this job"))
-		return
-	}
 	target, err := url.Parse(strings.TrimSuffix(cred.Results, "/"))
-	if err == nil && (target.Hostname() == "" || (target.Scheme != "http" && target.Scheme != "https")) {
-		err = errors.New("not an absolute http or https URL the job could use")
-	}
 	if err != nil {
 		h.logger.Errorf("artifact service forward to %q: %v", cred.Results, err)
-		h.twirpError(w, r, twirpInternal, fmt.Errorf("artifact service address %q is unusable: %w", cred.Results, err))
-		return
-	}
-	if !h.mustProxy(r, cred, target) {
-		redirect := target.JoinPath(r.URL.EscapedPath())
-		redirect.RawQuery = mergeQuery(target.RawQuery, r.URL.RawQuery)
-		h.logger.Debugf("%s %s: redirecting to %s", r.Method, r.URL.Path, target)
-		http.Redirect(w, r, redirect.String(), http.StatusTemporaryRedirect)
+		w.WriteHeader(http.StatusBadGateway)
 		return
 	}
 	h.logger.Debugf("%s %s: forwarding to %s", r.Method, r.URL.Path, target)
@@ -61,9 +44,9 @@ func (h *Handler) forwardOrNotFound(w http.ResponseWriter, r *http.Request) {
 			// directly and never through here.
 			r.Out.Host = target.Host
 		},
-		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
+		ErrorHandler: func(w http.ResponseWriter, _ *http.Request, err error) {
 			h.logger.Warnf("artifact service forward to %s: %v", target, err)
-			h.twirpError(w, r, twirpInternal, fmt.Errorf("cache server cannot reach the artifact service at %s: %w", target, err))
+			w.WriteHeader(http.StatusBadGateway)
 		},
 	}
 	if cred.InsecureTLS {
@@ -72,24 +55,5 @@ func (h *Handler) forwardOrNotFound(w http.ResponseWriter, r *http.Request) {
 	proxy.ServeHTTP(w, r)
 }
 
-// A protocol switch loses the bearer or the agent, and an untrusted instance needs skipped verification.
-func (h *Handler) mustProxy(r *http.Request, cred JobCredential, target *url.URL) bool {
-	if cred.InsecureTLS && target.Scheme == "https" {
-		return true
-	}
-	scheme := r.Header.Get("X-Forwarded-Proto")
-	if scheme == "" {
-		scheme = "http"
-	}
-	return scheme != target.Scheme
-}
-
-func mergeQuery(target, request string) string {
-	if target == "" || request == "" {
-		return target + request
-	}
-	return target + "&" + request
-}
-
 // insecureTransport is shared, because a transport per request would pool no connections.
-var insecureTransport = &http.Transport{Proxy: http.ProxyFromEnvironment, TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // the runner reaches its instance on the operator's say-so
+var insecureTransport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // the runner reaches its instance on the operator's say-so

act/artifactcache/results_test.go

@@ -4,8 +4,6 @@
 package artifactcache
 
 import (
-	"cmp"
-	"encoding/json/v2"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -16,6 +14,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// The artifact half is forwarded under the Host Gitea knows itself by, so the URLs it hands back
+// still point at Gitea, and nothing else is proxied.
 func TestFrontResultsService(t *testing.T) {
 	var gotHost, gotPath, gotProto string
 	gitea := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -23,112 +23,34 @@ func TestFrontResultsService(t *testing.T) {
 		_, _ = io.WriteString(w, `{"ok":true}`)
 	}))
 	defer gitea.Close()
-	selfSigned := httptest.NewTLSServer(gitea.Config.Handler)
-	defer selfSigned.Close()
 
 	handler, err := StartHandler(Options{Dir: t.TempDir(), OutboundIP: "127.0.0.1"})
 	require.NoError(t, err)
 	defer handler.Close()
-	const token, rpc = "forward-token", artifactServicePath + "CreateArtifact"
+	const token = "forward-token"
 
-	noRedirect := func(token string) *http.Client {
-		return &http.Client{
-			Transport:     &bearerTransport{token: token},
-			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
-		}
-	}
-	post := func(path string) (int, map[string]string) {
+	client := &http.Client{Transport: &bearerTransport{token: token}}
+	post := func(path string) int {
 		req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, handler.ExternalURL()+path, nil)
 		require.NoError(t, err)
-		resp, err := noRedirect(token).Do(req)
+		resp, err := client.Do(req)
 		require.NoError(t, err)
-		defer resp.Body.Close()
-		body := map[string]string{}
-		_ = json.UnmarshalRead(resp.Body, &body)
-		return resp.StatusCode, body
+		resp.Body.Close()
+		return resp.StatusCode
 	}
 
-	status, body := post(rpc)
-	assert.Equal(t, http.StatusUnauthorized, status, "an unregistered token is told so, not left to parse a 404 page")
-	assert.Equal(t, twirpUnauthenticated, body["code"])
-	assert.Contains(t, body["msg"], "bearer")
-	assert.NotEmpty(t, body["msg"])
+	assert.Equal(t, http.StatusNotFound, post(artifactServicePath+"CreateArtifact"),
+		"an unregistered token is forwarded nowhere")
 
-	defer handler.RegisterJob(token, JobCredential{Repo: "owner/repo", Results: selfSigned.URL, InsecureTLS: true})()
+	defer handler.RegisterJob(token, JobCredential{Repo: "owner/repo", Results: gitea.URL})()
 
-	status, _ = post(rpc)
-	require.Equal(t, http.StatusOK, status, "an http job reaching an https instance must proxy")
-	assert.Equal(t, strings.TrimPrefix(selfSigned.URL, "https://"), gotHost, "Gitea must see the host it mints its URLs from")
+	assert.Equal(t, http.StatusOK, post(artifactServicePath+"CreateArtifact"))
+	assert.Equal(t, strings.TrimPrefix(gitea.URL, "http://"), gotHost, "Gitea must see the host it mints its URLs from")
 	assert.Empty(t, gotProto, "a forwarded scheme would make an https Gitea mint http URLs")
-	assert.Equal(t, rpc, gotPath)
+	assert.Equal(t, artifactServicePath+"CreateArtifact", gotPath)
 
 	gotPath = ""
-	status, _ = post("/twirp/github.actions.results.api.v1.OtherService/Do")
-	assert.Equal(t, http.StatusNotFound, status)
-	status, _ = post("/api/v1/repos/owner/repo")
-	assert.Equal(t, http.StatusNotFound, status)
+	assert.Equal(t, http.StatusNotFound, post("/twirp/github.actions.results.api.v1.OtherService/Do"))
+	assert.Equal(t, http.StatusNotFound, post("/api/v1/repos/owner/repo"))
 	assert.Empty(t, gotPath, "only the artifact service is forwarded")
-
-	tests := []struct {
-		name           string
-		cred           JobCredential
-		forwardedProto string
-		reqQuery       string
-		want           int
-		location       string
-		wantMsg        string
-	}{
-		{name: "an instance the job reaches itself", cred: JobCredential{Results: gitea.URL}, want: http.StatusTemporaryRedirect},
-		{name: "a sub-path instance keeps its prefix", cred: JobCredential{Results: gitea.URL + "/sub"}, want: http.StatusTemporaryRedirect},
-		{name: "an instance with no certificate to distrust", cred: JobCredential{Results: gitea.URL, InsecureTLS: true}, want: http.StatusTemporaryRedirect},
-		{
-			name: "both queries survive", cred: JobCredential{Results: gitea.URL + "?tenant=one"}, reqQuery: "?run=7",
-			want: http.StatusTemporaryRedirect, location: gitea.URL + rpc + "?tenant=one&run=7",
-		},
-		{
-			name: "a trusted https instance is reached by the job itself",
-			cred: JobCredential{Results: selfSigned.URL}, forwardedProto: "https", want: http.StatusTemporaryRedirect,
-		},
-		{
-			name: "the job does not share this server's disregard for the certificate",
-			cred: JobCredential{Results: selfSigned.URL, InsecureTLS: true}, forwardedProto: "https", want: http.StatusOK,
-		},
-		{name: "an http job is not redirected to an https instance", cred: JobCredential{Results: selfSigned.URL}, want: http.StatusInternalServerError},
-		{
-			name: "a forwarded https scheme onto an http instance is proxied",
-			cred: JobCredential{Results: gitea.URL}, forwardedProto: "https", want: http.StatusOK,
-		},
-		{
-			name: "a scheme the job could not use is refused before it is sent one",
-			cred: JobCredential{Results: "ftp://gitea.example"}, want: http.StatusInternalServerError, wantMsg: "unusable",
-		},
-		{
-			name: "an address with no host is refused before it is sent one",
-			cred: JobCredential{Results: "http://:3000"}, want: http.StatusInternalServerError, wantMsg: "unusable",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			defer handler.RegisterJob(tt.name, tt.cred)()
-			req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, handler.ExternalURL()+rpc+tt.reqQuery, nil)
-			require.NoError(t, err)
-			if tt.forwardedProto != "" {
-				req.Header.Set("X-Forwarded-Proto", tt.forwardedProto)
-			}
-			resp, err := noRedirect(tt.name).Do(req)
-			require.NoError(t, err)
-			defer resp.Body.Close()
-
-			require.Equal(t, tt.want, resp.StatusCode)
-			switch tt.want {
-			case http.StatusTemporaryRedirect:
-				assert.Equal(t, cmp.Or(tt.location, tt.cred.Results+rpc), resp.Header.Get("Location"))
-			case http.StatusInternalServerError:
-				body := map[string]string{}
-				require.NoError(t, json.UnmarshalRead(resp.Body, &body))
-				assert.Equal(t, twirpInternal, body["code"])
-				assert.Contains(t, body["msg"], cmp.Or(tt.wantMsg, tt.cred.Results))
-			}
-		})
-	}
 }

act/artifactcache/s3_storage.go

@@ -1,326 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"bytes"
-	"cmp"
-	"context"
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/json/v2"
-	"encoding/xml"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"maps"
-	"net/http"
-	"net/url"
-	"os"
-	"path"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// S3Options configures the bucket that stores completed cache entries.
-type S3Options struct {
-	Endpoint  string
-	Region    string
-	Bucket    string
-	Prefix    string
-	PathStyle *bool // nil uses virtual-hosted requests on AWS and path-style ones elsewhere
-	AccessKey string
-	SecretKey string
-}
-
-type cacheStorage interface {
-	Exist(uint64) (bool, error)
-	Write(uint64, int64, io.Reader) error
-	WriteBlock(uint64, string, io.Reader) error
-	OrderBlocks(uint64, []string) error
-	Commit(uint64, int64) (int64, error)
-	Serve(http.ResponseWriter, *http.Request, uint64)
-	Remove(uint64) error
-}
-
-const s3PartSize = 5 << 30 // the largest part S3 accepts
-
-// s3Storage stages uploads on disk and keeps completed entries and their metadata in a bucket.
-type s3Storage struct {
-	*Storage
-	client    *http.Client
-	bucketURL *url.URL
-	opts      S3Options
-}
-
-type s3Part struct {
-	PartNumber int
-	ETag       string
-}
-
-func newS3Storage(staging *Storage, opts S3Options) (*s3Storage, error) {
-	endpoint, err := url.Parse(opts.Endpoint)
-	if err != nil || endpoint.Host == "" || (endpoint.Scheme != "http" && endpoint.Scheme != "https") {
-		return nil, fmt.Errorf("invalid S3 endpoint %q", opts.Endpoint)
-	}
-	transport, _ := http.DefaultTransport.(*http.Transport)
-	transport = transport.Clone()
-	transport.ResponseHeaderTimeout = time.Minute // a stalled endpoint must not hold the store forever
-	pathStyle := !strings.HasSuffix(endpoint.Hostname(), ".amazonaws.com")
-	if opts.PathStyle != nil {
-		pathStyle = *opts.PathStyle
-	}
-	if pathStyle {
-		endpoint.Path = "/" + opts.Bucket
-	} else {
-		endpoint.Host = opts.Bucket + "." + endpoint.Host
-		endpoint.Path = "/"
-	}
-	opts.Region = cmp.Or(opts.Region, "us-east-1")
-	return &s3Storage{Storage: staging, client: &http.Client{Transport: transport}, bucketURL: endpoint, opts: opts}, nil
-}
-
-func (s *s3Storage) blobKey(id uint64) string {
-	return path.Join(s.opts.Prefix, "blobs", strconv.FormatUint(id, 10))
-}
-
-func (s *s3Storage) metadataDir() string {
-	return path.Join(s.opts.Prefix, "metadata") + "/"
-}
-
-func (s *s3Storage) metadataKey(id uint64) string {
-	return s.metadataDir() + strconv.FormatUint(id, 10) + ".json"
-}
-
-func (s *s3Storage) url(key string, query url.Values) *url.URL {
-	u := *s.bucketURL
-	u.Path = path.Join(u.Path, key)
-	u.RawPath = strings.NewReplacer("+", "%20", "%2F", "/").Replace(url.QueryEscape(u.Path)) // SigV4 encoding
-	u.RawQuery = strings.ReplaceAll(query.Encode(), "+", "%20")
-	return &u
-}
-
-// sign authorizes req with AWS Signature Version 4, leaving the payload unsigned so bodies can stream.
-// https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
-func (s *s3Storage) sign(req *http.Request, now time.Time) {
-	date := now.UTC().Format("20060102T150405Z")
-	req.Header.Set("X-Amz-Date", date)
-	if req.Header.Get("X-Amz-Content-Sha256") == "" {
-		req.Header.Set("X-Amz-Content-Sha256", "UNSIGNED-PAYLOAD")
-	}
-	headers := map[string]string{"host": req.URL.Host}
-	for name, values := range req.Header {
-		if name = strings.ToLower(name); strings.HasPrefix(name, "x-amz-") {
-			headers[name] = strings.Join(values, ",")
-		}
-	}
-	names := slices.Sorted(maps.Keys(headers))
-	canonical := []string{req.Method, req.URL.EscapedPath(), req.URL.RawQuery}
-	for _, name := range names {
-		canonical = append(canonical, name+":"+headers[name])
-	}
-	canonical = append(canonical, "", strings.Join(names, ";"), req.Header.Get("X-Amz-Content-Sha256"))
-	scope := date[:8] + "/" + s.opts.Region + "/s3/aws4_request"
-	signature := []byte("AWS4" + s.opts.SecretKey)
-	for _, data := range []string{date[:8], s.opts.Region, "s3", "aws4_request", fmt.Sprintf("AWS4-HMAC-SHA256\n%s\n%s\n%x", date, scope, sha256.Sum256([]byte(strings.Join(canonical, "\n"))))} { // key derivation, the last round signs
-		mac := hmac.New(sha256.New, signature)
-		_, _ = mac.Write([]byte(data))
-		signature = mac.Sum(nil)
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("AWS4-HMAC-SHA256 Credential=%s/%s,SignedHeaders=%s,Signature=%x", s.opts.AccessKey, scope, strings.Join(names, ";"), signature))
-}
-
-// do returns the response to a signed request when it succeeded, fs.ErrNotExist for a missing key.
-func (s *s3Storage) do(ctx context.Context, method, key string, query url.Values, header http.Header, body io.Reader) (*http.Response, error) {
-	var size int64
-	if sized, ok := body.(interface{ Size() int64 }); ok {
-		size = sized.Size()
-	}
-	if size == 0 {
-		body = nil
-	}
-	req, err := http.NewRequestWithContext(ctx, method, s.url(key, query).String(), body)
-	if err != nil {
-		return nil, err
-	}
-	req.ContentLength = size
-	maps.Copy(req.Header, header)
-	s.sign(req, time.Now())
-	resp, err := s.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	if resp.StatusCode < http.StatusMultipleChoices {
-		return resp, nil
-	}
-	defer drain(resp)
-	var failure struct{ Code, Message string }
-	_ = xml.NewDecoder(resp.Body).Decode(&failure)
-	if resp.StatusCode == http.StatusNotFound && (failure.Code == "NoSuchKey" || failure.Code == "" && method == http.MethodHead) {
-		return nil, fs.ErrNotExist
-	}
-	return nil, fmt.Errorf("S3 %s %s: %s", method, key, cmp.Or(strings.TrimSpace(failure.Code+" "+failure.Message), resp.Status))
-}
-
-func (s *s3Storage) call(ctx context.Context, method, key string, query url.Values, body io.Reader, result any) (http.Header, error) {
-	resp, err := s.do(ctx, method, key, query, nil, body)
-	if err != nil {
-		return nil, err
-	}
-	defer drain(resp)
-	if result == nil {
-		return resp.Header, nil
-	}
-	return resp.Header, xml.NewDecoder(resp.Body).Decode(result)
-}
-
-// drain reads a response to its end before closing it, so its connection gets reused.
-func drain(resp *http.Response) {
-	_, _ = io.Copy(io.Discard, resp.Body)
-	_ = resp.Body.Close()
-}
-
-func (s *s3Storage) Exist(id uint64) (bool, error) {
-	_, err := s.call(context.Background(), http.MethodHead, s.blobKey(id), nil, nil, nil)
-	if errors.Is(err, fs.ErrNotExist) {
-		return false, nil
-	}
-	return err == nil, err
-}
-
-func (s *s3Storage) Commit(id uint64, size int64) (int64, error) {
-	written, err := s.Storage.Commit(id, size)
-	if err != nil {
-		return 0, err
-	}
-	defer func() { _ = s.Storage.Remove(id) }()
-	file, err := os.Open(s.filename(id))
-	if err != nil {
-		return 0, err
-	}
-	defer file.Close()
-	if err := s.upload(context.Background(), s.blobKey(id), file, written); err != nil {
-		return 0, fmt.Errorf("upload cache to S3: %w", err)
-	}
-	return written, nil
-}
-
-// upload always goes in parts, the only way S3 takes an object over 5 GiB.
-func (s *s3Storage) upload(ctx context.Context, key string, file io.ReaderAt, size int64) error {
-	var created struct {
-		UploadID string `xml:"UploadId"`
-	}
-	if _, err := s.call(ctx, http.MethodPost, key, url.Values{"uploads": {""}}, nil, &created); err != nil {
-		return err
-	}
-	var completion struct {
-		XMLName xml.Name `xml:"CompleteMultipartUpload"`
-		Parts   []s3Part `xml:"Part"`
-	}
-	for offset := int64(0); offset == 0 || offset < size; offset += s3PartSize {
-		number, length := len(completion.Parts)+1, min(s3PartSize, size-offset)
-		query := url.Values{"partNumber": {strconv.Itoa(number)}, "uploadId": {created.UploadID}}
-		header, err := s.call(ctx, http.MethodPut, key, query, io.NewSectionReader(file, offset, length), nil)
-		if err != nil {
-			return err
-		}
-		completion.Parts = append(completion.Parts, s3Part{number, header.Get("ETag")})
-	}
-	body, err := xml.Marshal(completion)
-	if err != nil {
-		return err
-	}
-	var result struct{ Code, Message string } // a completion can fail after its 200 status
-	if _, err := s.call(ctx, http.MethodPost, key, url.Values{"uploadId": {created.UploadID}}, bytes.NewReader(body), &result); err != nil {
-		return err
-	}
-	if result.Code != "" {
-		return fmt.Errorf("S3 complete upload %s: %s %s", key, result.Code, result.Message)
-	}
-	return nil
-}
-
-func (s *s3Storage) Serve(w http.ResponseWriter, r *http.Request, id uint64) {
-	header := http.Header{}
-	if byteRange := r.Header.Get("Range"); byteRange != "" {
-		header.Set("Range", byteRange)
-	}
-	resp, err := s.do(r.Context(), http.MethodGet, s.blobKey(id), nil, header, nil)
-	if errors.Is(err, fs.ErrNotExist) {
-		http.NotFound(w, r)
-		return
-	} else if err != nil {
-		http.Error(w, "read cache from S3", http.StatusBadGateway)
-		return
-	}
-	defer resp.Body.Close()
-	for _, name := range []string{"Content-Length", "Content-Range"} {
-		if value := resp.Header.Get(name); value != "" {
-			w.Header().Set(name, value)
-		}
-	}
-	w.WriteHeader(resp.StatusCode)
-	_, _ = io.Copy(w, resp.Body)
-}
-
-// Remove unpublishes an entry before deleting its blob, so no runner imports it without its bytes.
-func (s *s3Storage) Remove(id uint64) error {
-	for _, key := range []string{s.metadataKey(id), s.blobKey(id)} {
-		if _, err := s.call(context.Background(), http.MethodDelete, key, nil, nil, nil); err != nil && !errors.Is(err, fs.ErrNotExist) {
-			return fmt.Errorf("remove %s from S3: %w", key, err)
-		}
-	}
-	return s.Storage.Remove(id)
-}
-
-func (s *s3Storage) publish(cache *Cache) error {
-	data, err := json.Marshal(cache)
-	if err != nil {
-		return err
-	}
-	if _, err := s.call(context.Background(), http.MethodPut, s.metadataKey(cache.ID), nil, bytes.NewReader(data), nil); err != nil {
-		return fmt.Errorf("publish cache to S3: %w", err)
-	}
-	return nil
-}
-
-func (s *s3Storage) published(ctx context.Context) (map[uint64]bool, error) {
-	ids := make(map[uint64]bool)
-	query := url.Values{"list-type": {"2"}, "prefix": {s.metadataDir()}}
-	for {
-		var page struct {
-			Contents              []struct{ Key string }
-			IsTruncated           bool
-			NextContinuationToken string
-		}
-		if _, err := s.call(ctx, http.MethodGet, "", query, nil, &page); err != nil {
-			return nil, fmt.Errorf("list S3 cache metadata: %w", err)
-		}
-		for _, object := range page.Contents {
-			if id, err := strconv.ParseUint(strings.TrimSuffix(strings.TrimPrefix(object.Key, s.metadataDir()), ".json"), 10, 64); err == nil {
-				ids[id] = true
-			}
-		}
-		if !page.IsTruncated {
-			return ids, nil
-		}
-		query.Set("continuation-token", page.NextContinuationToken)
-	}
-}
-
-func (s *s3Storage) fetch(ctx context.Context, id uint64) (*Cache, error) {
-	resp, err := s.do(ctx, http.MethodGet, s.metadataKey(id), nil, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	cache := &Cache{}
-	if err := json.UnmarshalRead(resp.Body, cache); err != nil {
-		return nil, fmt.Errorf("read S3 cache metadata %d: %w", id, err)
-	}
-	return cache, nil
-}

act/artifactcache/s3_storage_test.go

@@ -1,46 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package artifactcache
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/johannesboyne/gofakes3"
-	"github.com/johannesboyne/gofakes3/backend/s3mem"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestHandler_S3SharesEntriesAndDropsExpiredOnes(t *testing.T) {
-	backend := s3mem.New()
-	require.NoError(t, backend.CreateBucket("cache"))
-	server := httptest.NewServer(gofakes3.New(backend).Server())
-	t.Cleanup(server.Close)
-	opts := Options{S3: &S3Options{Endpoint: server.URL, Bucket: "cache", Prefix: "runners", AccessKey: "key", SecretKey: "secret"}}
-	saver, restorer := startTestHandler(t, opts), startTestHandler(t, opts)
-	entry := map[string]any{"key": "deps", "version": "v1"}
-
-	finalized, _ := saveV2(t, saver, "deps", "v1", []byte("archive"))
-	require.Equal(t, true, finalized["ok"])
-	require.NoError(t, restorer.importMetadata(t.Context()))
-	found := v2Call(t, restorer, testClient, "GetCacheEntryDownloadURL", entry)
-	require.Equal(t, true, found["ok"])
-	assert.Equal(t, []byte("archive"), getURL(t, found["signed_download_url"].(string)))
-
-	require.NoError(t, backend.ForceDeleteBucket("cache"))
-	require.NoError(t, backend.CreateBucket("cache"))
-	require.NoError(t, restorer.importMetadata(t.Context()))
-	assert.Equal(t, true, v2Call(t, restorer, testClient, "CreateCacheEntry", entry)["ok"])
-}
-
-func TestS3StorageSignsLikeAWS(t *testing.T) {
-	storage := &s3Storage{opts: S3Options{Region: "us-east-1", AccessKey: "AKIAIOSFODNN7EXAMPLE", SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"}}
-	req := httptest.NewRequest(http.MethodGet, "https://examplebucket.s3.amazonaws.com/?max-keys=2&prefix=J", nil)
-	req.Header.Set("X-Amz-Content-Sha256", "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855")
-	storage.sign(req, time.Date(2013, 5, 24, 0, 0, 0, 0, time.UTC))
-	assert.Equal(t, "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=34b48302e7b5fa45bde8084f4b7868a86f0a534bc59db6670ed5711ef69dc6f7", req.Header.Get("Authorization"))
-}

act/artifactcache/storage.go

@@ -5,10 +5,8 @@
 package artifactcache
 
 import (
-	"bytes"
 	"crypto/sha256"
 	"encoding/hex"
-	"encoding/json/v2"
 	"fmt"
 	"io"
 	"net/http"
@@ -68,18 +66,6 @@ func (s *Storage) WriteBlock(id uint64, blockID string, reader io.Reader) error
 // rename pass is safe because a staged name always carries blockFilePrefix and a target name
 // never does, so no rename can collide with a block not yet moved.
 func (s *Storage) OrderBlocks(id uint64, blockIDs []string) error {
-	wanted, err := json.Marshal(blockIDs) // a block id is client-chosen, so it cannot be a separator
-	if err != nil {
-		return err
-	}
-	list := filepath.Join(s.tempDir(id), blockFilePrefix+"list")
-	if recorded, err := os.ReadFile(list); err == nil {
-		// A retry repeats the list it already sent; another one would reorder what is now staged.
-		if !bytes.Equal(recorded, wanted) {
-			return fmt.Errorf("cache %d was already assembled from a different block list", id)
-		}
-		return nil
-	}
 	for i, blockID := range blockIDs {
 		if err := os.Rename(s.blockName(id, blockID), s.tempName(id, int64(i))); err != nil {
 			if os.IsNotExist(err) {
@@ -88,7 +74,7 @@ func (s *Storage) OrderBlocks(id uint64, blockIDs []string) error {
 			return err
 		}
 	}
-	return os.WriteFile(list, wanted, 0o600)
+	return nil
 }
 
 func (s *Storage) Commit(id uint64, size int64) (int64, error) {

act/artifacts/server.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"net"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -221,14 +220,14 @@ func Serve(ctx context.Context, artifactPath, addr, port string) context.CancelF
 	downloads(router, artifactPath)
 
 	server := &http.Server{
-		Addr:              net.JoinHostPort(addr, port),
+		Addr:              fmt.Sprintf("%s:%s", addr, port),
 		ReadHeaderTimeout: 2 * time.Second,
 		Handler:           router,
 	}
 
 	// run server
 	go func() {
-		logger.Infof("Start server on http://%s", server.Addr)
+		logger.Infof("Start server on http://%s:%s", addr, port)
 		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 			logger.Fatal(err)
 		}

act/common/git/git.go

@@ -325,6 +325,33 @@ func CloneIfRequired(ctx context.Context, refName plumbing.ReferenceName, input
 	return r, false, nil
 }
 
+func gitOptions(token string) (fetchOptions git.FetchOptions, pullOptions git.PullOptions) {
+	fetchOptions.RefSpecs = []config.RefSpec{"refs/*:refs/*", "HEAD:refs/heads/HEAD"}
+	fetchOptions.Force = true
+	pullOptions.Force = true
+
+	if token != "" {
+		auth := &http.BasicAuth{
+			Username: "token",
+			Password: token,
+		}
+		fetchOptions.Auth = auth
+		pullOptions.Auth = auth
+	}
+
+	return fetchOptions, pullOptions
+}
+
+// staleRefreshErr reports why a failed refresh must abort: the resolve and
+// checkout that follow are local and succeed on a cancelled context, which
+// would hand back the cached revision as if it were fresh.
+func staleRefreshErr(ctx context.Context, err error) error {
+	if err == nil || errors.Is(err, git.NoErrAlreadyUpToDate) {
+		return nil
+	}
+	return ctx.Err()
+}
+
 // NewGitCloneExecutor creates an executor to clone git repos
 func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
@@ -346,34 +373,25 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 
 		isOfflineMode := input.OfflineMode
 
-		fetchOptions := git.FetchOptions{
-			RefSpecs:        []config.RefSpec{"refs/*:refs/*", "HEAD:refs/heads/HEAD", "refs/heads/*:refs/remotes/origin/*"},
-			Force:           true,
-			InsecureSkipTLS: input.InsecureSkipTLS,
-		}
-		if input.Token != "" {
-			fetchOptions.Auth = &http.BasicAuth{
-				Username: "token",
-				Password: input.Token,
-			}
+		// fetch latest changes
+		fetchOptions, pullOptions := gitOptions(input.Token)
+
+		if input.InsecureSkipTLS { // For Gitea
+			fetchOptions.InsecureSkipTLS = true
+			pullOptions.InsecureSkipTLS = true
 		}
 
 		// Action clones only ever need the tip commit, so keep a shallow cache cheap on update at depth 1 regardless of its original depth
 		// Turning action_shallow_clone off does not convert an existing shallow cache; evict it for a full clone.
-		if isShallow(r) {
+		shallow := isShallow(r)
+		if shallow {
 			fetchOptions.Depth = 1
 			if spec, ok := shallowFetchRefSpec(r, input.Ref); ok {
 				fetchOptions.RefSpecs = []config.RefSpec{spec}
 			}
 		}
 
-		// A just-cloned ref is as current as a fetch would make it, and a commit hash never moves.
-		// TODO: revalidate a mutable ref with a conditional archive request instead, once every
-		// supported Gitea sends an ETag for them: https://github.com/go-gitea/gitea/pull/39289
-		_, present := refRevision(r, input.Ref)
-		refresh := !isOfflineMode && (!present || (reused && !plumbing.IsHash(input.Ref)))
-
-		if refresh {
+		if !isOfflineMode {
 			err = r.FetchContext(ctx, &fetchOptions)
 			if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
 				return err
@@ -393,7 +411,23 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 			}
 		}
 
-		rev, _ = refRevision(r, input.Ref)
+		// At this point we need to know if it's a tag or a branch
+		// And the easiest way to do it is duck typing
+		//
+		// If err is nil, it's a tag so let's proceed with that hash like we would if
+		// it was a sha
+		refType := "tag"
+		rev = plumbing.Revision(path.Join("refs", "tags", input.Ref))
+		if _, err := r.Tag(input.Ref); errors.Is(err, git.ErrTagNotFound) {
+			rName := plumbing.ReferenceName(path.Join("refs", "remotes", "origin", input.Ref))
+			if _, err := r.Reference(rName, false); errors.Is(err, plumbing.ErrReferenceNotFound) {
+				refType = "sha"
+				rev = plumbing.Revision(input.Ref)
+			} else {
+				refType = "branch"
+				rev = plumbing.Revision(rName)
+			}
+		}
 
 		if hash, err = r.ResolveRevision(rev); err != nil {
 			logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
@@ -405,13 +439,47 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 			return err
 		}
 
+		// If the hash resolved doesn't match the ref provided in a workflow then we're
+		// using a branch or tag ref, not a sha
+		//
+		// Repos on disk point to commit hashes, and need to checkout input.Ref before
+		// we try and pull down any changes
+		if hash.String() != input.Ref && refType == "branch" {
+			logger.Debugf("Provided ref is not a sha. Checking out branch before pulling changes")
+			sourceRef := plumbing.ReferenceName(path.Join("refs", "remotes", "origin", input.Ref))
+			if err = w.Checkout(&git.CheckoutOptions{
+				Branch: sourceRef,
+				Force:  true,
+			}); err != nil {
+				logger.Errorf("Unable to checkout %s: %v", sourceRef, err)
+				return err
+			}
+		}
+
 		reusedMsg := ""
-		if isOfflineMode && reused {
+
+		switch {
+		case !isOfflineMode && !shallow:
+			// In shallow mode the depth-limited fetch above already advanced the ref.
+			if err = w.PullContext(ctx, &pullOptions); err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
+				logger.Debugf("Unable to pull %s: %v", refName, err)
+			}
+			if err := staleRefreshErr(ctx, err); err != nil {
+				return err
+			}
+		case isOfflineMode && reused:
 			reusedMsg = " (reused in offline mode)"
 		}
 
 		logger.Debugf("Cloned %s to %s%s", input.URL, input.Dir, reusedMsg)
 
+		if hash.String() != input.Ref && refType == "branch" {
+			logger.Debugf("Provided ref is not a sha. Updating branch ref after pull")
+			if hash, err = r.ResolveRevision(rev); err != nil {
+				logger.Errorf("Unable to resolve %s: %v", input.Ref, err)
+				return err
+			}
+		}
 		if err = w.Checkout(&git.CheckoutOptions{
 			Hash:  *hash,
 			Force: true,
@@ -420,43 +488,40 @@ func NewGitCloneExecutor(input NewGitCloneExecutorInput) common.Executor {
 			return err
 		}
 
+		if err = w.Reset(&git.ResetOptions{
+			Mode:   git.HardReset,
+			Commit: *hash,
+		}); err != nil {
+			logger.Errorf("Unable to reset to %s: %v", hash.String(), err)
+			return err
+		}
+
 		logger.Debugf("Checked out %s", input.Ref)
 		return nil
 	}
 }
 
-// cloneAtDepth falls back to a full clone when the shallow attempt fails.
+// cloneAtDepth clones input.URL into input.Dir using opts.
+// With input.Depth > 0 it first tries a shallow, single-branch clone of input.Ref, falling back when error.
 func cloneAtDepth(ctx context.Context, input NewGitCloneExecutorInput, opts git.CloneOptions, logger log.FieldLogger) (*git.Repository, error) {
 	if input.Depth > 0 {
-		if plumbing.IsHash(input.Ref) {
-			r, err := fetchPinnedSHA(ctx, input, opts)
+		for _, refName := range []plumbing.ReferenceName{
+			plumbing.NewBranchReferenceName(input.Ref),
+			plumbing.NewTagReferenceName(input.Ref),
+		} {
+			shallowOpts := opts
+			shallowOpts.Depth = input.Depth
+			shallowOpts.SingleBranch = true
+			shallowOpts.ReferenceName = refName
+			shallowOpts.Tags = git.NoTags
+
+			r, err := git.PlainCloneContext(ctx, input.Dir, false, &shallowOpts)
 			if err == nil {
 				return r, nil
 			}
-			logger.Debugf("Shallow fetch of %s at %s failed: %v", input.URL, input.Ref, err)
-			if err := removePartialClone(input.Dir); err != nil {
-				return nil, err
-			}
-		} else {
-			refNames := []plumbing.ReferenceName{plumbing.NewBranchReferenceName(input.Ref), plumbing.NewTagReferenceName(input.Ref)}
-			if input.Ref == plumbing.HEAD.String() || strings.HasPrefix(input.Ref, "refs/") {
-				refNames = []plumbing.ReferenceName{plumbing.ReferenceName(input.Ref)} // HEAD is the remote's default branch
-			}
-			for _, refName := range refNames {
-				shallowOpts := opts
-				shallowOpts.Depth = input.Depth
-				shallowOpts.SingleBranch = true
-				shallowOpts.ReferenceName = refName
-				shallowOpts.Tags = git.NoTags
-
-				r, err := git.PlainCloneContext(ctx, input.Dir, false, &shallowOpts)
-				if err == nil {
-					return r, nil
-				}
-				logger.Debugf("Shallow clone of %s as %s failed: %v", input.URL, refName, err)
-				if err := removePartialClone(input.Dir); err != nil {
-					return nil, err
-				}
+			logger.Debugf("Shallow clone of %s as %s failed: %v", input.URL, refName, err)
+			if rmErr := os.RemoveAll(input.Dir); rmErr != nil {
+				return nil, fmt.Errorf("remove partial clone %s: %w", input.Dir, rmErr)
 			}
 		}
 		logger.Debugf("Falling back to a full clone of %s for ref %q", input.URL, input.Ref)
@@ -465,65 +530,14 @@ func cloneAtDepth(ctx context.Context, input NewGitCloneExecutorInput, opts git.
 	return git.PlainCloneContext(ctx, input.Dir, false, &opts)
 }
 
-func removePartialClone(dir string) error {
-	if err := os.RemoveAll(dir); err != nil {
-		return fmt.Errorf("remove partial clone %s: %w", dir, err)
-	}
-	return nil
-}
-
-func fetchPinnedSHA(ctx context.Context, input NewGitCloneExecutorInput, opts git.CloneOptions) (*git.Repository, error) {
-	r, err := git.PlainInit(input.Dir, false)
-	if err != nil {
-		return nil, err
-	}
-	if _, err := r.CreateRemote(&config.RemoteConfig{Name: "origin", URLs: []string{input.URL}}); err != nil {
-		return nil, err
-	}
-	if err := r.FetchContext(ctx, &git.FetchOptions{
-		RefSpecs:        []config.RefSpec{pinnedRefSpec(input.Ref)},
-		Depth:           input.Depth,
-		Tags:            git.NoTags,
-		Auth:            opts.Auth,
-		Progress:        opts.Progress,
-		InsecureSkipTLS: opts.InsecureSkipTLS,
-	}); err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
-// pinnedRefSpec keeps a hash-shaped name out of refs/heads and refs/tags.
-func pinnedRefSpec(sha string) config.RefSpec {
-	return config.RefSpec(fmt.Sprintf("+%s:refs/pinned/%s", sha, sha))
-}
-
-// refRevision picks the revision to check out and reports whether it resolves locally.
-func refRevision(r *git.Repository, ref string) (plumbing.Revision, bool) {
-	if plumbing.IsHash(ref) {
-		// git ignores a ref named as 40 hex digits, so a full hash always denotes the commit itself.
-		_, err := r.CommitObject(plumbing.NewHash(ref))
-		return plumbing.Revision(ref), err == nil
-	}
-	if _, err := r.Tag(ref); err == nil {
-		return plumbing.Revision(path.Join("refs", "tags", ref)), true
-	}
-	remoteRef := plumbing.ReferenceName(path.Join("refs", "remotes", "origin", ref))
-	if _, err := r.Reference(remoteRef, false); err == nil {
-		return plumbing.Revision(remoteRef), true
-	}
-	rev := plumbing.Revision(ref)
-	_, err := r.ResolveRevision(rev)
-	return rev, err == nil
-}
-
 // isShallow reports whether the local repository was cloned with a limited depth.
 func isShallow(r *git.Repository) bool {
 	shallows, err := r.Storer.Shallow()
 	return err == nil && len(shallows) > 0
 }
 
-// shallowFetchRefSpec limits a shallow update to the requested ref, falling back to the broad refspec when it is not present locally.
+// shallowFetchRefSpec returns the single refspec that updates only input.Ref, keeping a shallow clone from re-downloading every branch's history.
+// ok is false when the ref is not present locally as a tag or remote-tracking branch, in which case the broad default refspec is used.
 func shallowFetchRefSpec(r *git.Repository, ref string) (config.RefSpec, bool) {
 	tagRef := plumbing.NewTagReferenceName(ref)
 	if _, err := r.Reference(tagRef, false); err == nil {
@@ -534,9 +548,5 @@ func shallowFetchRefSpec(r *git.Repository, ref string) (config.RefSpec, bool) {
 		branchRef := plumbing.NewBranchReferenceName(ref)
 		return config.RefSpec(fmt.Sprintf("+%s:%s", branchRef, remoteRef)), true
 	}
-	if plumbing.IsHash(ref) {
-		// The broad refspec carries only advertised tips, never a pinned commit.
-		return pinnedRefSpec(ref), true
-	}
 	return "", false
 }

act/common/git/git_test.go

@@ -6,6 +6,7 @@ package git
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -15,7 +16,6 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"sync/atomic"
 	"syscall"
 	"testing"
 	"time"
@@ -24,9 +24,6 @@ import (
 
 	gogit "github.com/go-git/go-git/v5"
 	gogitconfig "github.com/go-git/go-git/v5/config"
-	"github.com/go-git/go-git/v5/plumbing/transport"
-	gogitclient "github.com/go-git/go-git/v5/plumbing/transport/client"
-	gogitfile "github.com/go-git/go-git/v5/plumbing/transport/file"
 	log "github.com/sirupsen/logrus"
 	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
@@ -438,7 +435,7 @@ func TestGitCloneExecutorShallow(t *testing.T) {
 		require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", m))
 	}
 	require.NoError(t, gitCmd("-C", workDir, "tag", "v1"))
-	unadvertisedSHA := gitRevParse(t, workDir, "HEAD~1")
+	sha := gitRevParse(t, workDir, "HEAD~1") // c2, a SHA that go-git cannot shallow-clone
 	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
 	require.NoError(t, gitCmd("-C", workDir, "push", "origin", "v1"))
 
@@ -464,43 +461,14 @@ func TestGitCloneExecutorShallow(t *testing.T) {
 		assert.Equal(t, "c3", gitHeadSubject(t, dir))
 	})
 
-	unadvertisedRemote := func(t *testing.T, allowUnadvertised bool) string {
-		remote := filepath.Join(t.TempDir(), "remote.git")
-		require.NoError(t, gitCmd("clone", "--bare", remoteDir, remote))
-		require.NoError(t, gitCmd("-C", remote, "config", "uploadpack.allowAnySHA1InWant", strconv.FormatBool(allowUnadvertised)))
-		return remote
-	}
-
-	t.Run("commit hash falls back to a full clone when the remote refuses unadvertised objects", func(t *testing.T) {
+	t.Run("SHA falls back to a full clone", func(t *testing.T) {
 		dir := t.TempDir()
 		require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-			URL: unadvertisedRemote(t, false), Ref: unadvertisedSHA, Dir: dir, Depth: 1,
+			URL: remoteDir, Ref: sha, Dir: dir, Depth: 1,
 		})(t.Context()))
-		assert.NoFileExists(t, shallowMarker(dir))
-		assert.Equal(t, unadvertisedSHA, gitRevParse(t, dir, "HEAD"))
-	})
-
-	t.Run("commit hash is fetched shallowly, moved to another hash, then reused without reaching the remote", func(t *testing.T) {
-		remote := unadvertisedRemote(t, true)
-		dir := t.TempDir()
-		cloneAt := func(ref string) error {
-			return NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL: remote, Ref: ref, Dir: dir, Depth: 1,
-			})(t.Context())
-		}
-
-		require.NoError(t, cloneAt(unadvertisedSHA))
-		assert.FileExists(t, shallowMarker(dir))
-		assert.Equal(t, 1, gitRevCount(t, dir))
-		assert.Equal(t, unadvertisedSHA, gitRevParse(t, dir, "HEAD"))
-
-		olderSHA := gitRevParse(t, workDir, "HEAD~2")
-		require.NoError(t, cloneAt(olderSHA))
-		assert.Equal(t, olderSHA, gitRevParse(t, dir, "HEAD"))
-
-		require.NoError(t, os.RemoveAll(remote))
-		require.NoError(t, cloneAt(olderSHA))
-		assert.Equal(t, olderSHA, gitRevParse(t, dir, "HEAD"))
+		// go-git cannot shallow-clone a raw SHA, so it falls back to a full clone; the absence of a shallow marker proves the fallback happened.
+		assert.NoFileExists(t, shallowMarker(dir), "a SHA ref must not produce a shallow clone")
+		assert.Equal(t, sha, gitRevParse(t, dir, "HEAD"))
 	})
 
 	t.Run("moving branch updates while staying shallow", func(t *testing.T) {
@@ -523,98 +491,6 @@ func TestGitCloneExecutorShallow(t *testing.T) {
 	})
 }
 
-func TestGitCloneExecutorTransportSessions(t *testing.T) {
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--initial-branch=main", workDir))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "c1"))
-	require.NoError(t, gitCmd("-C", workDir, "tag", "v1"))
-	require.NoError(t, gitCmd("-C", workDir, "tag", "-a", "v2", "-m", "v2"))
-
-	for name, tt := range map[string]struct {
-		Ref   string
-		Depth int
-	}{
-		"shallow branch":       {"main", 1},
-		"full clone branch":    {"main", 0},
-		"full lightweight tag": {"v1", 0},
-		"full annotated tag":   {"v2", 0},
-	} {
-		t.Run(name, func(t *testing.T) {
-			counter := installCountingTransport(t)
-			dir := t.TempDir()
-			clone := NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL: workDir, Ref: tt.Ref, Dir: dir, Depth: tt.Depth,
-			})
-			require.NoError(t, clone(t.Context()))
-			assert.Equal(t, int64(1), counter.sessions.Swap(0), "cold clone")
-			assert.Equal(t, gitRevParse(t, workDir, tt.Ref+"^{commit}"), gitRevParse(t, dir, "HEAD"))
-
-			require.NoError(t, clone(t.Context()))
-			assert.Equal(t, int64(1), counter.sessions.Swap(0), "unchanged warm cache")
-
-			require.NoError(t, os.WriteFile(filepath.Join(workDir, "action.yml"), []byte(name), 0o644))
-			require.NoError(t, gitCmd("-C", workDir, "add", "action.yml"))
-			require.NoError(t, gitCmd("-C", workDir, "commit", "-m", name))
-			require.NoError(t, gitCmd("-C", workDir, "tag", "--force", "v1"))
-			require.NoError(t, gitCmd("-C", workDir, "tag", "--force", "-a", "v2", "-m", "v2"))
-
-			require.NoError(t, os.WriteFile(filepath.Join(dir, "action.yml"), []byte("staged"), 0o644))
-			require.NoError(t, gitCmd("-C", dir, "add", "action.yml"))
-			require.NoError(t, os.WriteFile(filepath.Join(dir, "action.yml"), []byte("unstaged"), 0o644))
-
-			require.NoError(t, clone(t.Context()))
-			assert.Equal(t, int64(1), counter.sessions.Load(), "updated warm cache")
-			assert.Equal(t, gitRevParse(t, workDir, "HEAD"), gitRevParse(t, dir, "HEAD"))
-			status, err := exec.Command("git", "-C", dir, "status", "--porcelain").Output()
-			require.NoError(t, err)
-			assert.Empty(t, string(status))
-		})
-	}
-}
-
-func TestGitCloneExecutorPinnedHashIgnoresShadowingRef(t *testing.T) {
-	remoteDir := t.TempDir()
-	require.NoError(t, gitCmd("init", "--bare", "--initial-branch=main", remoteDir))
-	workDir := t.TempDir()
-	require.NoError(t, gitCmd("clone", remoteDir, workDir))
-	require.NoError(t, gitCmd("-C", workDir, "checkout", "-b", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "pinned"))
-	pinned := gitRevParse(t, workDir, "HEAD")
-	require.NoError(t, gitCmd("-C", workDir, "commit", "--allow-empty", "-m", "decoy"))
-	require.NoError(t, gitCmd("-C", workDir, "tag", pinned))
-	require.NoError(t, gitCmd("-C", workDir, "push", "-u", "origin", "main"))
-	require.NoError(t, gitCmd("-C", workDir, "push", "origin", pinned))
-
-	for name, depth := range map[string]int{"shallow": 1, "full clone": 0} {
-		t.Run(name, func(t *testing.T) {
-			dir := t.TempDir()
-			require.NoError(t, NewGitCloneExecutor(NewGitCloneExecutorInput{
-				URL: remoteDir, Ref: pinned, Dir: dir, Depth: depth,
-			})(t.Context()))
-			assert.Equal(t, pinned, gitRevParse(t, dir, "HEAD"))
-		})
-	}
-}
-
-type countingTransport struct {
-	transport.Transport
-	sessions atomic.Int64
-}
-
-func (c *countingTransport) NewUploadPackSession(ep *transport.Endpoint, auth transport.AuthMethod) (transport.UploadPackSession, error) {
-	c.sessions.Add(1)
-	return c.Transport.NewUploadPackSession(ep, auth)
-}
-
-func installCountingTransport(t *testing.T) *countingTransport {
-	t.Helper()
-	counter := &countingTransport{Transport: gogitfile.DefaultClient}
-	gogitclient.InstallProtocol("file", counter)
-	t.Cleanup(func() { gogitclient.InstallProtocol("file", gogitfile.DefaultClient) })
-
-	return counter
-}
-
 func gitRevParse(t *testing.T, dir, rev string) string {
 	t.Helper()
 	out, err := exec.Command("git", "-C", dir, "rev-parse", rev).Output()
@@ -756,3 +632,12 @@ func TestNewGitCloneExecutorFetchHonoursContext(t *testing.T) {
 		t.Fatal("fetch ignored context cancellation")
 	}
 }
+
+func TestStaleRefreshErr(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	require.NoError(t, staleRefreshErr(ctx, errors.New("remote hung up")))
+
+	cancel()
+	require.ErrorIs(t, staleRefreshErr(ctx, errors.New("remote hung up")), context.Canceled)
+	require.NoError(t, staleRefreshErr(ctx, gogit.NoErrAlreadyUpToDate))
+}

act/container/container_types.go

@@ -9,10 +9,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"path"
-	"strings"
-	"sync"
-	"sync/atomic"
 
 	"gitea.com/gitea/runner/act/common"
 
@@ -79,24 +75,6 @@ const (
 // fragment, missingContainerError composes it into the message every operation shares.
 var ErrContainerNotFound = errors.New("does not exist")
 
-// DockerProxy is a job's docker socket, fronting the daemon's for the job's lifetime.
-type DockerProxy struct {
-	Socket    string
-	close     func(context.Context) error
-	closeOnce sync.Once
-	closeErr  error
-	mounts    atomic.Value
-}
-
-func (p *DockerProxy) SetMounts(mounts map[string]string) {
-	p.mounts.Store(mounts)
-}
-
-func (p *DockerProxy) Close(ctx context.Context) error {
-	p.closeOnce.Do(func() { p.closeErr = p.close(ctx) })
-	return p.closeErr
-}
-
 // Info is a snapshot of a container, as of one inspect.
 type Info struct {
 	ID       string
@@ -106,24 +84,13 @@ type Info struct {
 	// HealthOutput is the last healthcheck probe's output.
 	HealthOutput string
 	Ports        map[string]string // container port ("5432") to the host port it is published on
-	Mounts       map[string]string // container path to its source on the daemon
-}
-
-// DaemonPath maps target to its daemon path through the nearest mount with a source, empty without one.
-func (info *Info) DaemonPath(target string) string {
-	for dir := target; dir != "/" && dir != "."; dir = path.Dir(dir) {
-		if source := info.Mounts[dir]; source != "" {
-			return path.Join(source, strings.TrimPrefix(target, dir))
-		}
-	}
-	return ""
 }
 
 // Container for managing docker run containers
 type Container interface {
 	Create(capAdd, capDrop []string) common.Executor
 	Copy(destPath string, files ...*FileEntry) common.Executor
-	CopyDir(destPath, srcPath string, useGitIgnore, skipGitDir bool) common.Executor
+	CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor
 	GetContainerArchive(ctx context.Context, srcPath string) (io.ReadCloser, error)
 	Inspect(ctx context.Context) (*Info, error)
 	DumpLogs(ctx context.Context) error

act/container/docker_cli.go

@@ -4,10 +4,9 @@
 
 //go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
 
-// This file is exact copy of https://github.com/docker/cli/blob/4a63305d74332de5ceba7fcbccbc3cbb7412f5ba/cli/command/container/opts.go with:
+// This file is exact copy of https://github.com/docker/cli/blob/dfc4efb1e2ab8c06d70d2a1366ad448d2f917e90/cli/command/container/opts.go with:
 // * appended with license information
 // * regexp and loader.ParseVolume in place of the import-restricted internal/lazyregexp and internal/volumespec
-// * jsontext in place of json.Compact for the seccomp profile
 // * invalidParameter from the package's errors.go, and convertPortSet/convertPortMap for the callers in docker_run.go
 //
 // docker/cli is licensed under the Apache License, Version 2.0.
@@ -153,7 +152,6 @@ type containerOptions struct {
 	runtime             string
 	autoRemove          bool
 	init                bool
-	umask               opts.UmaskOpt
 	annotations         *opts.MapOpts
 
 	Image string
@@ -328,9 +326,6 @@ func addFlags(flags *pflag.FlagSet) *containerOptions {
 	flags.Var(&copts.shmSize, "shm-size", "Size of /dev/shm")
 	flags.StringVar(&copts.utsMode, "uts", "", "UTS namespace to use")
 	flags.StringVar(&copts.runtime, "runtime", "", "Runtime to use for this container")
-	flags.Var(&copts.umask, "umask", "Set umask for the container")
-	flags.SetAnnotation("umask", "version", []string{"1.56"})
-	flags.SetAnnotation("umask", "ostype", []string{"linux"})
 
 	flags.BoolVar(&copts.init, "init", false, "Run an init inside the container that forwards signals and reaps processes")
 	flags.SetAnnotation("init", "version", []string{"1.25"})
@@ -726,7 +721,6 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		MaskedPaths:    maskedPaths,
 		ReadonlyPaths:  readonlyPaths,
 		Annotations:    copts.annotations.GetAll(),
-		Umask:          copts.umask.Value(),
 	}
 
 	if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() {

act/container/docker_cli_test.go

@@ -2,7 +2,7 @@
 // Copyright 2022 The nektos/act Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-// This file is exact copy of https://github.com/docker/cli/blob/4a63305d74332de5ceba7fcbccbc3cbb7412f5ba/cli/command/container/opts_test.go with:
+// This file is exact copy of https://github.com/docker/cli/blob/dfc4efb1e2ab8c06d70d2a1366ad448d2f917e90/cli/command/container/opts_test.go with:
 // * appended with license information
 // * added tests for the locally changed parseDevice, validateDevice and invalidParameter
 //
@@ -167,19 +167,6 @@ func TestParseRunLinks(t *testing.T) {
 	}
 }
 
-func TestParseRunWithoutUmask(t *testing.T) {
-	_, hostConfig, _, err := parseRun([]string{"ubuntu", "bash"})
-	assert.NilError(t, err)
-	assert.Assert(t, hostConfig.Umask == nil)
-}
-
-func TestParseRunUmask(t *testing.T) {
-	_, hostConfig, _, err := parseRun([]string{"--umask", "0022", "ubuntu", "bash"})
-	assert.NilError(t, err)
-	assert.Assert(t, hostConfig.Umask != nil)
-	assert.Equal(t, uint32(0o22), *hostConfig.Umask)
-}
-
 func TestParseRunAttach(t *testing.T) {
 	tests := []struct {
 		input    string

act/container/docker_network.go

@@ -10,14 +10,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net/netip"
 	"strings"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
 )
 
@@ -35,17 +32,17 @@ const (
 // had an endpoint on it at the time. Each one holds a subnet of the daemon's address pool
 // until it is removed. Networks created after createdBefore are left alone, so a job starting
 // while this runs cannot lose the network it has created but not yet attached a container to.
-func RemoveOrphanNetworks(ctx context.Context, runnerUUID, detach string, createdBefore time.Time) error {
+func RemoveOrphanNetworks(ctx context.Context, runnerUUID string, createdBefore time.Time) error {
 	cli, err := GetDockerClient(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to connect to the docker daemon: %w", err)
 	}
 	defer cli.Close()
 
-	return removeOrphanNetworks(ctx, cli, runnerUUID, detach, createdBefore)
+	return removeOrphanNetworks(ctx, cli, runnerUUID, createdBefore)
 }
 
-func removeOrphanNetworks(ctx context.Context, cli client.APIClient, runnerUUID, detach string, createdBefore time.Time) error {
+func removeOrphanNetworks(ctx context.Context, cli client.APIClient, runnerUUID string, createdBefore time.Time) error {
 	networks, err := cli.NetworkList(ctx, client.NetworkListOptions{
 		Filters: make(client.Filters).Add("label", runnerUUIDLabel+"="+runnerUUID),
 	})
@@ -54,7 +51,6 @@ func removeOrphanNetworks(ctx context.Context, cli client.APIClient, runnerUUID,
 	}
 
 	var errs []error
-networks:
 	for _, n := range networks.Items {
 		result, err := cli.NetworkInspect(ctx, n.ID, client.NetworkInspectOptions{})
 		if err != nil {
@@ -63,18 +59,9 @@ networks:
 		}
 		// the emptiness check, not the label, is what keeps a live job of another process
 		// sharing this registration safe
-		if len(result.Network.Containers) > 1 || result.Network.Created.After(createdBefore) {
+		if len(result.Network.Containers) != 0 || result.Network.Created.After(createdBefore) {
 			continue
 		}
-		for containerID := range result.Network.Containers {
-			if detach == "" || !strings.HasPrefix(containerID, detach) {
-				continue networks
-			}
-			if err := disconnectNetwork(ctx, cli, n.ID, containerID); err != nil {
-				errs = append(errs, fmt.Errorf("failed to disconnect container from network %s: %w", n.Name, err))
-				continue networks
-			}
-		}
 		if _, err := cli.NetworkRemove(ctx, n.ID, client.NetworkRemoveOptions{}); err != nil {
 			errs = append(errs, fmt.Errorf("failed to remove network %s: %w", n.Name, err))
 			continue
@@ -147,50 +134,6 @@ func isAddressPoolExhausted(err error) bool {
 		strings.Contains(msg, "could not find an available, non-overlapping IPv4 address pool among the defaults") // docker 24 and older
 }
 
-func NewDockerNetworkConnectExecutor(networkName, container string) common.Executor {
-	return func(ctx context.Context) error {
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-		if err := connectNetwork(ctx, cli, networkName, container); err != nil {
-			common.Logger(ctx).Warnf("cannot connect %s to network %s, so jobs on it cannot reach the cache: %v", container, networkName, err)
-		}
-		return nil
-	}
-}
-
-func connectNetwork(ctx context.Context, cli client.APIClient, networkName, container string) error {
-	_, err := cli.NetworkConnect(ctx, networkName, client.NetworkConnectOptions{
-		Container:      container,
-		EndpointConfig: &network.EndpointSettings{Aliases: []string{container}},
-	})
-	if err != nil && (strings.Contains(err.Error(), "already exists in network") || strings.Contains(err.Error(), "already connected")) {
-		return nil
-	}
-	return err
-}
-
-func NewDockerNetworkDisconnectExecutor(networkName, container string) common.Executor {
-	return func(ctx context.Context) error {
-		cli, err := GetDockerClient(ctx)
-		if err != nil {
-			return err
-		}
-		defer cli.Close()
-		return disconnectNetwork(ctx, cli, networkName, container)
-	}
-}
-
-func disconnectNetwork(ctx context.Context, cli client.APIClient, networkName, container string) error {
-	_, err := cli.NetworkDisconnect(ctx, networkName, client.NetworkDisconnectOptions{Container: container, Force: true})
-	if cerrdefs.IsNotFound(err) || (err != nil && strings.Contains(err.Error(), "is not connected")) {
-		return nil
-	}
-	return err
-}
-
 func NewDockerNetworkRemoveExecutor(name string) common.Executor {
 	return func(ctx context.Context) error {
 		cli, err := GetDockerClient(ctx)
@@ -229,49 +172,3 @@ func NewDockerNetworkRemoveExecutor(name string) common.Executor {
 		return errors.Join(errs...)
 	}
 }
-
-// IsolatedCacheContainer returns the container holding addr, when jobs on jobNetwork cannot reach it there.
-func IsolatedCacheContainer(ctx context.Context, addr netip.Addr, jobNetwork string) (string, error) {
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		return "", err
-	}
-	defer cli.Close()
-	return isolatedCacheContainer(ctx, cli, addr, jobNetwork)
-}
-
-func isolatedCacheContainer(ctx context.Context, cli client.APIClient, addr netip.Addr, jobNetwork string) (string, error) {
-	if jobNetwork == "host" || strings.HasPrefix(jobNetwork, "container:") {
-		return "", nil
-	}
-	containers, err := cli.ContainerList(ctx, client.ContainerListOptions{})
-	if err != nil {
-		return "", err
-	}
-	var holderID, holderContainer string
-	for _, summary := range containers.Items {
-		if summary.NetworkSettings == nil {
-			continue
-		}
-		for _, endpoint := range summary.NetworkSettings.Networks {
-			if endpoint != nil && (endpoint.IPAddress == addr || endpoint.GlobalIPv6Address == addr) {
-				holderID = endpoint.NetworkID
-				holderContainer = summary.ID[:12]
-			}
-		}
-	}
-	if holderID == "" {
-		return "", nil
-	}
-	holder, err := cli.NetworkInspect(ctx, holderID, client.NetworkInspectOptions{})
-	if err != nil || holder.Network.Driver != "bridge" {
-		return "", err
-	}
-	if jobNetwork != "" {
-		job, err := cli.NetworkInspect(ctx, jobNetwork, client.NetworkInspectOptions{})
-		if err != nil || job.Network.ID == holderID {
-			return "", err
-		}
-	}
-	return holderContainer, nil
-}

act/container/docker_network_test.go

@@ -6,95 +6,25 @@ package container
 import (
 	"context"
 	"errors"
-	"net/netip"
 	"testing"
 	"time"
 
 	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/network"
 	mobyclient "github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func TestIsolatedCacheContainer(t *testing.T) {
-	ctx := context.Background()
-	cache, lan := netip.MustParseAddr("172.18.0.3"), netip.MustParseAddr("192.168.1.20")
-	client := &mockDockerClient{}
-	client.On("ContainerList", ctx, mobyclient.ContainerListOptions{}).Return(mobyclient.ContainerListResult{Items: []container.Summary{{}, {
-		ID: "0123456789abcdef",
-		NetworkSettings: &container.NetworkSettingsSummary{Networks: map[string]*network.EndpointSettings{
-			"compose": {NetworkID: "c0ffee", IPAddress: cache},
-			"lan":     {NetworkID: "beef", IPAddress: lan},
-		}},
-	}}}, nil)
-	for ref, inspected := range map[string]network.Network{
-		"c0ffee": {ID: "c0ffee", Name: "compose", Driver: "bridge"},
-		"beef":   {ID: "beef", Name: "lan", Driver: "macvlan"},
-		"c0f":    {ID: "c0ffee"},
-		"jobs":   {ID: "f00d"},
-	} {
-		client.On("NetworkInspect", ctx, ref, mobyclient.NetworkInspectOptions{}).
-			Return(mobyclient.NetworkInspectResult{Network: network.Inspect{Network: inspected}}, nil)
-	}
-	check := func(addr netip.Addr, jobNetwork, want string) {
-		got, err := isolatedCacheContainer(ctx, client, addr, jobNetwork)
-		require.NoError(t, err)
-		assert.Equal(t, want, got, jobNetwork)
-	}
-	check(cache, "", "0123456789ab")
-	check(cache, "jobs", "0123456789ab")
-	check(cache, "c0f", "")
-	check(cache, "host", "")
-	check(lan, "", "")
-	check(netip.MustParseAddr("10.0.0.5"), "", "")
-}
-
 func TestIsAddressPoolExhausted(t *testing.T) {
 	assert.True(t, isAddressPoolExhausted(cerrdefs.ErrInvalidArgument.WithMessage("Error response from daemon: all predefined address pools have been fully subnetted")))
 	assert.True(t, isAddressPoolExhausted(errors.New("could not find an available, non-overlapping IPv4 address pool among the defaults to assign to the network")))
 	assert.False(t, isAddressPoolExhausted(cerrdefs.ErrInvalidArgument.WithMessage("invalid subnet 10.0.0.0/8: it overlaps with an existing network")))
 }
 
-func (m *mockDockerClient) NetworkConnect(ctx context.Context, id string, opts mobyclient.NetworkConnectOptions) (mobyclient.NetworkConnectResult, error) {
-	return mobyclient.NetworkConnectResult{}, m.Called(ctx, id, opts).Error(0)
-}
-
-func (m *mockDockerClient) NetworkDisconnect(ctx context.Context, id string, opts mobyclient.NetworkDisconnectOptions) (mobyclient.NetworkDisconnectResult, error) {
-	return mobyclient.NetworkDisconnectResult{}, m.Called(ctx, id, opts).Error(0)
-}
-
-func TestConnectAndDisconnectNetwork(t *testing.T) {
-	ctx := context.Background()
-	connect := func(answer error) error {
-		client := &mockDockerClient{}
-		client.On("NetworkConnect", ctx, "jobs", mobyclient.NetworkConnectOptions{
-			Container:      "0123456789ab",
-			EndpointConfig: &network.EndpointSettings{Aliases: []string{"0123456789ab"}},
-		}).Return(answer).Once()
-		return connectNetwork(ctx, client, "jobs", "0123456789ab")
-	}
-	require.NoError(t, connect(nil))
-	require.NoError(t, connect(errors.New("endpoint with name runner already exists in network jobs")))
-	require.NoError(t, connect(errors.New("container runner already connected to network jobs")))
-	require.ErrorIs(t, connect(context.Canceled), context.Canceled)
-
-	disconnect := func(answer error) error {
-		client := &mockDockerClient{}
-		client.On("NetworkDisconnect", ctx, "jobs", mobyclient.NetworkDisconnectOptions{
-			Container: "0123456789ab", Force: true,
-		}).Return(answer).Once()
-		return disconnectNetwork(ctx, client, "jobs", "0123456789ab")
-	}
-	require.NoError(t, disconnect(cerrdefs.ErrNotFound))
-	require.NoError(t, disconnect(errors.New("container runner is not connected to the network jobs")))
-	require.ErrorIs(t, disconnect(context.Canceled), context.Canceled)
-}
-
-// Of this runner's networks, only the ones nothing but its own cache container is attached to
-// and old enough to predate any job now starting are the runner's to reclaim. An unexpected
-// NetworkRemove fails the test on its own, since testify has no expectation to match it against.
+// Of this runner's networks, only the ones nothing is attached to and old enough to predate
+// any job now starting are the runner's to reclaim. An unexpected NetworkRemove fails the
+// test on its own, since testify has no expectation to match it against.
 func TestRemoveOrphanNetworks(t *testing.T) {
 	ctx := context.Background()
 	cutoff := time.Date(2026, time.April, 29, 20, 0, 0, 0, time.UTC)
@@ -105,29 +35,16 @@ func TestRemoveOrphanNetworks(t *testing.T) {
 		{ID: "orphan"},
 		{ID: "busy"},
 		{ID: "starting"},
-		{ID: "cached"},
-		{ID: "shared"},
 	}}, nil)
 	client.On("NetworkInspect", ctx, "orphan", mobyclient.NetworkInspectOptions{}).
 		Return(mobyclient.NetworkInspectResult{}, nil)
 	client.On("NetworkInspect", ctx, "busy", mobyclient.NetworkInspectOptions{}).
 		Return(mobyclient.NetworkInspectResult{Network: network.Inspect{Containers: map[string]network.EndpointResource{"c": {}}}}, nil)
 	client.On("NetworkInspect", ctx, "starting", mobyclient.NetworkInspectOptions{}).
-		Return(mobyclient.NetworkInspectResult{Network: network.Inspect{
-			Network:    network.Network{Created: cutoff.Add(time.Second)},
-			Containers: map[string]network.EndpointResource{"0123456789abcdef": {}},
-		}}, nil)
-	client.On("NetworkInspect", ctx, "cached", mobyclient.NetworkInspectOptions{}).
-		Return(mobyclient.NetworkInspectResult{Network: network.Inspect{Containers: map[string]network.EndpointResource{"0123456789abcdef": {}}}}, nil)
-	client.On("NetworkInspect", ctx, "shared", mobyclient.NetworkInspectOptions{}).
-		Return(mobyclient.NetworkInspectResult{Network: network.Inspect{Containers: map[string]network.EndpointResource{"0123456789abcdef": {}, "job": {}}}}, nil)
+		Return(mobyclient.NetworkInspectResult{Network: network.Inspect{Network: network.Network{Created: cutoff.Add(time.Second)}}}, nil)
 	client.On("NetworkRemove", ctx, "orphan", mobyclient.NetworkRemoveOptions{}).
 		Return(mobyclient.NetworkRemoveResult{}, nil)
-	client.On("NetworkDisconnect", ctx, "cached", mobyclient.NetworkDisconnectOptions{Container: "0123456789abcdef", Force: true}).
-		Return(nil).Once()
-	client.On("NetworkRemove", ctx, "cached", mobyclient.NetworkRemoveOptions{}).
-		Return(mobyclient.NetworkRemoveResult{}, nil).Once()
 
-	require.NoError(t, removeOrphanNetworks(ctx, client, "runner-1", "0123456789ab", cutoff))
+	require.NoError(t, removeOrphanNetworks(ctx, client, "runner-1", cutoff))
 	client.AssertExpectations(t)
 }

act/container/docker_proxy.go

@@ -1,587 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"maps"
-	"mime"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"os"
-	"path"
-	"path/filepath"
-	"regexp"
-	"runtime"
-	"slices"
-	"strings"
-	"sync"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/mount"
-	"github.com/moby/moby/client"
-)
-
-const (
-	jobLabel      = "com.gitea.runner.job"
-	maxCreateBody = 8 << 20
-
-	dockerProxyProbeTimeout = 5 * time.Second
-)
-
-var (
-	createPath    = regexp.MustCompile(`^(/v[0-9.]+)?/(containers|networks|volumes)/create$`)
-	rawStreamPath = regexp.MustCompile(`^(/v[0-9.]+)?/(containers/[^/]+/attach|exec/[^/]+/start)$`)
-)
-
-func NewDockerProxy(ctx context.Context, job string) *DockerProxy {
-	if host := os.Getenv("DOCKER_HOST"); runtime.GOOS != "linux" || host != "" && !strings.HasPrefix(host, "unix://") {
-		return nil
-	}
-	probeCtx, cancel := context.WithTimeout(ctx, dockerProxyProbeTimeout)
-	defer cancel()
-	cli, err := GetDockerClient(probeCtx)
-	if err != nil {
-		return nil
-	}
-	defer cli.Close()
-	daemonSocket, ok := strings.CutPrefix(cli.DaemonHost(), "unix://")
-	if !ok {
-		return nil
-	}
-	if info, err := os.Stat(daemonSocket); err != nil || info.Mode()&os.ModeSocket == 0 {
-		return nil
-	}
-	dir, daemonDir := runnerContainerWorkdir(probeCtx, cli)
-	seen := daemonDir != ""
-	if !seen {
-		if dir, err = filepath.Abs(os.TempDir()); err == nil {
-			daemonDir = dir
-			seen, err = daemonSeesDir(probeCtx, cli, dir, daemonDir)
-		}
-	}
-	if err != nil {
-		common.Logger(ctx).Infof("docker proxy probe failed, jobs get the daemon socket directly: %v", err)
-		return nil
-	}
-	if !seen {
-		common.Logger(ctx).Infof("the docker daemon cannot reach the runner's temporary or working directory, jobs get the daemon socket directly")
-		return nil
-	}
-	if ctx.Err() != nil {
-		return nil
-	}
-	proxy, err := StartDockerProxy(daemonSocket, dir, job)
-	if err != nil {
-		common.Logger(ctx).Warnf("docker proxy not started, the job gets the daemon socket directly: %v", err)
-		return nil
-	}
-	proxy.Socket = daemonDir + strings.TrimPrefix(proxy.Socket, dir)
-	return proxy
-}
-
-// runnerContainerWorkdir looks the runner's container up by hostname to find the daemon's path to its working directory.
-func runnerContainerWorkdir(ctx context.Context, cli client.APIClient) (workdir, daemonDir string) {
-	workdir, err := os.Getwd()
-	hostname, hostnameErr := os.Hostname()
-	if err != nil || hostnameErr != nil {
-		return "", ""
-	}
-	self, err := cli.ContainerInspect(ctx, hostname, client.ContainerInspectOptions{})
-	if err != nil {
-		return "", ""
-	}
-	if daemonDir = containerInfoFromInspect(self.Container).DaemonPath(workdir); daemonDir == "" {
-		return "", ""
-	}
-	if seen, _ := containerSeesMarker(ctx, cli, workdir, self.Container.ID, workdir); !seen { // the hostname may name another container
-		return "", ""
-	}
-	return workdir, daemonDir
-}
-
-func containerSeesMarker(ctx context.Context, cli client.APIClient, dir, id, containerDir string) (bool, error) {
-	marker, err := os.CreateTemp(dir, "gitea-runner-probe-")
-	if err != nil {
-		return false, err
-	}
-	defer func() {
-		if err := os.Remove(marker.Name()); err != nil {
-			common.Logger(ctx).Warnf("removing the docker proxy probe marker failed: %v", err)
-		}
-	}()
-	if err := marker.Close(); err != nil {
-		return false, err
-	}
-	_, err = cli.ContainerStatPath(ctx, id, client.ContainerStatPathOptions{Path: path.Join(containerDir, filepath.Base(marker.Name()))})
-	if cerrdefs.IsNotFound(err) {
-		return false, nil
-	}
-	return err == nil, err
-}
-
-// daemonSeesDir reports whether the daemon opens the files the runner writes in dir by their path in daemonDir,
-// which is what a job's proxy socket mounted from there needs.
-func daemonSeesDir(ctx context.Context, cli client.APIClient, dir, daemonDir string) (bool, error) {
-	images, err := cli.ImageList(ctx, client.ImageListOptions{})
-	if err != nil {
-		return false, err
-	}
-	if len(images.Items) == 0 {
-		return false, errors.New("no image available for the docker proxy probe")
-	}
-	created, err := cli.ContainerCreate(ctx, client.ContainerCreateOptions{
-		Config: &container.Config{Image: images.Items[0].ID, Cmd: []string{"true"}},
-		HostConfig: &container.HostConfig{Mounts: []mount.Mount{
-			{Type: mount.TypeBind, Source: daemonDir, Target: "/gitea-runner-probe", ReadOnly: true}, // not the marker itself, podman creates a missing bind source where docker rejects it
-		}},
-	})
-	if cerrdefs.IsInvalidArgument(err) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	seen, err := containerSeesMarker(ctx, cli, dir, created.ID, "/gitea-runner-probe")
-	cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), dockerProxyProbeTimeout)
-	defer cancel()
-	if _, removeErr := cli.ContainerRemove(cleanupCtx, created.ID, client.ContainerRemoveOptions{Force: true, RemoveVolumes: true}); removeErr != nil {
-		return false, fmt.Errorf("removing the docker proxy probe container failed: %w", removeErr)
-	}
-	return seen, err
-}
-
-// StartDockerProxy serves a job's docker socket in dir, labelling what the job creates through it.
-func StartDockerProxy(daemonSocket, dir, job string) (*DockerProxy, error) {
-	info, err := os.Stat(daemonSocket)
-	if err != nil {
-		return nil, err
-	}
-	if info.Mode()&os.ModeSocket == 0 {
-		return nil, errors.New("docker daemon path is not a Unix socket")
-	}
-	if err := os.MkdirAll(dir, 0o700); err != nil {
-		return nil, err
-	}
-	instance, err := os.MkdirTemp(dir, "p-")
-	if err != nil {
-		return nil, err
-	}
-	socket := filepath.Join(instance, "docker.sock")
-	listener, err := net.Listen("unix", socket)
-	if err != nil {
-		return nil, errors.Join(err, os.RemoveAll(instance))
-	}
-	if err := copyDockerSocketPermissions(daemonSocket, socket, info); err != nil {
-		return nil, errors.Join(err, listener.Close(), os.RemoveAll(instance))
-	}
-	dial := func(ctx context.Context, _, _ string) (net.Conn, error) {
-		return (&net.Dialer{}).DialContext(ctx, "unix", daemonSocket)
-	}
-	transport := &http.Transport{DialContext: dial}
-	forward := &httputil.ReverseProxy{
-		Rewrite: func(r *httputil.ProxyRequest) {
-			r.Out.URL.Scheme = "http"
-			r.Out.URL.Host = "docker"
-		},
-		Transport: transport,
-	}
-	proxy := &DockerProxy{Socket: socket}
-	streams, cancelStreams := context.WithCancel(context.Background())
-	creates, cancelCreates := context.WithCancel(context.Background())
-	var admission sync.Mutex
-	var handlers sync.WaitGroup
-	server := &http.Server{ReadHeaderTimeout: 30 * time.Second, ConnContext: func(ctx context.Context, conn net.Conn) context.Context {
-		return context.WithValue(ctx, dockerProxyConnKey{}, conn)
-	}, Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		admission.Lock()
-		if streams.Err() != nil {
-			admission.Unlock()
-			http.Error(w, "docker proxy is closing", http.StatusServiceUnavailable)
-			return
-		}
-		handlers.Add(1)
-		admission.Unlock()
-		defer handlers.Done()
-		creating := r.Method == http.MethodPost && createPath.MatchString(r.URL.Path)
-		parent, lifetime := r.Context(), streams
-		if creating {
-			parent, lifetime = context.WithoutCancel(parent), creates
-		}
-		ctx, cancel := context.WithCancel(parent)
-		defer cancel()
-		stop := context.AfterFunc(lifetime, func() {
-			cancel()
-			if !creating {
-				if conn, ok := parent.Value(dockerProxyConnKey{}).(net.Conn); ok {
-					_ = conn.Close()
-				}
-			}
-		})
-		defer stop()
-		r = r.WithContext(ctx)
-		if creating {
-			r.Body = http.MaxBytesReader(w, r.Body, maxCreateBody)
-			mounts, _ := proxy.mounts.Load().(map[string]string)
-			if err := rewriteCreate(r, job, mounts); err != nil {
-				status := http.StatusBadRequest
-				if _, ok := errors.AsType[*http.MaxBytesError](err); ok {
-					status = http.StatusRequestEntityTooLarge
-				}
-				http.Error(w, err.Error(), status)
-				return
-			}
-		} else if r.Method == http.MethodPost && rawStreamPath.MatchString(r.URL.Path) {
-			tunnel(w, r, dial, forward)
-			return
-		}
-		forward.ServeHTTP(w, r)
-	})}
-	served := make(chan struct{})
-	go func() {
-		defer close(served)
-		_ = server.Serve(listener)
-	}()
-	proxy.close = func(ctx context.Context) error {
-		ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
-		defer cancel()
-		admission.Lock()
-		listenerErr := listener.Close()
-		cancelStreams()
-		admission.Unlock()
-		<-served
-		shutdownErr := server.Shutdown(ctx)
-		cancelCreates()
-		serverErr := server.Close()
-		handlers.Wait()
-		transport.CloseIdleConnections()
-		return errors.Join(ctx.Err(), listenerErr, shutdownErr, serverErr, os.RemoveAll(instance))
-	}
-	return proxy, nil
-}
-
-func rewriteCreate(r *http.Request, job string, mounts map[string]string) error {
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		return err
-	}
-	if len(bytes.TrimSpace(body)) == 0 {
-		body = []byte("{}")
-	}
-	var fields map[string]json.RawMessage
-	var config struct{ Labels map[string]string }
-	if err := json.Unmarshal(body, &fields); err != nil {
-		return fmt.Errorf("invalid create request: %w", err)
-	}
-	if err := json.Unmarshal(body, &config); err != nil {
-		return fmt.Errorf("invalid create labels: %w", err)
-	}
-	if fields == nil {
-		fields = make(map[string]json.RawMessage)
-	}
-	if len(mounts) > 0 && !hasAmbiguousFields(body) {
-		translateBinds(fields, createPath.FindStringSubmatch(r.URL.Path)[2], mounts)
-	}
-	maps.DeleteFunc(fields, func(name string, _ json.RawMessage) bool {
-		return strings.EqualFold(name, "Labels")
-	})
-	if config.Labels == nil {
-		config.Labels = make(map[string]string)
-	}
-	config.Labels[jobLabel] = job
-	if fields["Labels"], err = json.Marshal(config.Labels); err != nil {
-		return err
-	}
-	if body, err = json.Marshal(fields); err != nil {
-		return err
-	}
-	r.Body = io.NopCloser(bytes.NewReader(body))
-	r.ContentLength = int64(len(body))
-	r.TransferEncoding = nil
-	return nil
-}
-
-func translateBinds(fields map[string]json.RawMessage, kind string, mounts map[string]string) {
-	cleanedSource := func(source string) string {
-		cleaned := path.Clean(source)
-		if target := jobMount(cleaned, mounts); mounts[target] != "" {
-			return mounts[target] + cleaned[len(target):]
-		}
-		return source
-	}
-	spelledSource := func(source string) string { // dockerd checks these as spelled
-		target := jobMount(path.Clean(source), mounts)
-		if rest, spelled := strings.CutPrefix(source, target); mounts[target] != "" && spelled && (rest == "" || rest[0] == '/') && filepath.IsLocal("."+rest) {
-			return mounts[target] + rest
-		}
-		return cleanedSource(source)
-	}
-	switch kind {
-	case "volumes":
-		var driver string
-		var options map[string]any
-		decodeField(fields, "Driver", &driver)
-		if key := decodeField(fields, "DriverOpts", &options); options != nil {
-			translateDevice(driver, options, spelledSource)
-			if encoded, err := json.Marshal(options); err == nil {
-				fields[key] = encoded
-			}
-		}
-	case "containers":
-		var hostConfig map[string]any
-		key := decodeField(fields, "HostConfig", &hostConfig)
-		binds, _ := field(hostConfig, "Binds").([]any)
-		for i, bind := range binds {
-			bind, _ := bind.(string)
-			source, target, _ := strings.Cut(bind, ":")
-			if translated := cleanedSource(source); strings.HasPrefix(target, "/") && !strings.Contains(translated, ":") {
-				binds[i] = translated + ":" + target
-			}
-		}
-		specs, _ := field(hostConfig, "Mounts").([]any)
-		for _, spec := range specs {
-			spec, _ := spec.(map[string]any)
-			switch field(spec, "Type") {
-			case "bind":
-				if source, ok := field(spec, "Source").(string); ok {
-					spec["Source"] = spelledSource(source)
-				}
-			case "volume":
-				volumeOptions, _ := field(spec, "VolumeOptions").(map[string]any)
-				driverConfig, _ := field(volumeOptions, "DriverConfig").(map[string]any)
-				translateDevice(field(driverConfig, "Name"), field(driverConfig, "Options"), spelledSource)
-			}
-		}
-		if encoded, err := json.Marshal(hostConfig); err == nil && hostConfig != nil {
-			fields[key] = encoded
-		}
-	}
-}
-
-func decodeField(fields map[string]json.RawMessage, name string, value any) string {
-	for key, raw := range fields {
-		if strings.EqualFold(key, name) {
-			decoder := json.NewDecoder(bytes.NewReader(raw))
-			decoder.UseNumber()
-			_ = decoder.Decode(value) // wrong types stay unset for dockerd to reject
-			return key
-		}
-	}
-	return ""
-}
-
-func translateDevice(driver, options any, translate func(string) string) {
-	optionMap, _ := options.(map[string]any)
-	device, ok := optionMap["device"].(string)
-	flags, _ := optionMap["o"].(string)
-	tokens := strings.Split(flags, ",")
-	local := driver == nil || driver == "" || driver == "local"
-	if ok && local && (slices.Contains(tokens, "bind") || slices.Contains(tokens, "rbind")) && !slices.Contains(tokens, "remount") {
-		optionMap["device"] = translate(device)
-	}
-}
-
-// field also renames the matched key to name.
-func field(object map[string]any, name string) any {
-	for key, value := range object {
-		if strings.EqualFold(key, name) {
-			delete(object, key)
-			object[name] = value
-			return value
-		}
-	}
-	return nil
-}
-
-var (
-	requestFields = []string{"hostconfig", "driver", "driveropts"}
-	asciiFolds    = strings.NewReplacer("ſ", "s", "K", "k") // the non-ASCII runes strings.EqualFold matches to ASCII letters
-)
-
-// dockerd settles repeated names by order, which re-encoding loses.
-func hasAmbiguousFields(body []byte) bool {
-	type frame struct {
-		names     map[string]bool
-		key       string
-		expectKey bool
-		nested    bool
-	}
-	decoder := json.NewDecoder(bytes.NewReader(body))
-	decoder.UseNumber()
-	stack := []*frame{{}}
-	for {
-		token, err := decoder.Token()
-		if err != nil {
-			return !errors.Is(err, io.EOF)
-		}
-		top := stack[len(stack)-1]
-		if name, ok := token.(string); ok && top.expectKey {
-			top.key, top.expectKey = strings.ToLower(asciiFolds.Replace(name)), false
-			if top.names[top.key] && (top.nested || slices.Contains(requestFields, top.key)) {
-				return true
-			}
-			top.names[top.key] = true
-			continue
-		}
-		top.expectKey = top.names != nil
-		nested := top.nested || len(stack) == 2 && slices.Contains(requestFields, top.key)
-		switch token {
-		case json.Delim('{'):
-			stack = append(stack, &frame{names: map[string]bool{}, expectKey: true, nested: nested})
-		case json.Delim('['):
-			stack = append(stack, &frame{nested: nested})
-		case json.Delim('}'), json.Delim(']'):
-			stack = stack[:len(stack)-1]
-		}
-	}
-}
-
-// jobMount returns "" also for a path already naming a daemon source.
-func jobMount(source string, mounts map[string]string) string {
-	target := ""
-	for destination, daemonSource := range mounts {
-		if daemonSource != "" && (source == daemonSource || strings.HasPrefix(source, daemonSource+"/")) {
-			return ""
-		}
-		if len(destination) > len(target) && (source == destination || strings.HasPrefix(source, destination+"/")) {
-			target = destination
-		}
-	}
-	return target
-}
-
-type dockerProxyConnKey struct{}
-
-type dockerProxyResponse struct {
-	response *http.Response
-}
-
-func (r dockerProxyResponse) RoundTrip(_ *http.Request) (*http.Response, error) {
-	return r.response, nil
-}
-
-// tunnel splices attach and exec streams, which the daemon hijacks with or without an HTTP upgrade
-func tunnel(w http.ResponseWriter, r *http.Request, dial func(context.Context, string, string) (net.Conn, error), forward *httputil.ReverseProxy) {
-	upstream, err := dial(r.Context(), "", "")
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadGateway)
-		return
-	}
-	defer upstream.Close()
-	stop := context.AfterFunc(r.Context(), func() { _ = upstream.Close() })
-	defer stop()
-	if err := r.Write(upstream); err != nil {
-		http.Error(w, err.Error(), http.StatusBadGateway)
-		return
-	}
-	reader := bufio.NewReader(upstream)
-	var response *http.Response
-	for {
-		response, err = http.ReadResponse(reader, r)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusBadGateway)
-			return
-		}
-		if response.StatusCode >= 200 || response.StatusCode == http.StatusSwitchingProtocols {
-			break
-		}
-		maps.Copy(w.Header(), response.Header)
-		w.WriteHeader(response.StatusCode)
-		clear(w.Header())
-		_ = response.Body.Close()
-	}
-	defer func() {
-		_ = upstream.Close()
-		_ = response.Body.Close()
-	}()
-	mediaType, _, _ := mime.ParseMediaType(response.Header.Get("Content-Type"))
-	if response.StatusCode != http.StatusSwitchingProtocols && (response.StatusCode != http.StatusOK || mediaType != "application/vnd.docker.raw-stream") {
-		ordinary := *forward
-		ordinary.Transport = dockerProxyResponse{response: response}
-		ordinary.ServeHTTP(w, r)
-		return
-	}
-	downstream, buffered, err := http.NewResponseController(w).Hijack()
-	if err != nil {
-		return
-	}
-	defer downstream.Close()
-	if _, err := fmt.Fprintf(buffered, "%s %s\r\n", response.Proto, response.Status); err != nil {
-		return
-	}
-	if err := response.Header.Write(buffered); err != nil {
-		return
-	}
-	if _, err := buffered.WriteString("\r\n"); err != nil {
-		return
-	}
-	if err := buffered.Flush(); err != nil {
-		return
-	}
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		if _, err := io.Copy(upstream, io.MultiReader(io.LimitReader(buffered, int64(buffered.Reader.Buffered())), downstream)); err != nil { // Bypass net/http after the prefix so stdin EOF preserves output.
-			_ = upstream.Close()
-		} else if writer, ok := upstream.(interface{ CloseWrite() error }); ok {
-			_ = writer.CloseWrite()
-		} else {
-			_ = upstream.Close()
-		}
-	}()
-	_, _ = io.Copy(downstream, reader)
-	_ = downstream.Close()
-	_ = upstream.Close()
-	<-done
-}
-
-func RemoveDockerJobResources(ctx context.Context, job string) error {
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		return err
-	}
-	defer cli.Close()
-	return removeLabelled(ctx, cli, job)
-}
-
-func removeLabelled(ctx context.Context, cli client.APIClient, job string) error {
-	logger := common.Logger(ctx)
-	filters := make(client.Filters).Add("label", jobLabel+"="+job)
-	containers, err := cli.ContainerList(ctx, client.ContainerListOptions{All: true, Filters: filters})
-	errs := []error{err}
-	for _, c := range containers.Items {
-		logger.Infof("removing container %s the job left behind", strings.TrimPrefix(strings.Join(c.Names, ","), "/"))
-		errs = append(errs, (&containerReference{cli: cli, id: c.ID}).remove()(ctx))
-	}
-	networks, err := cli.NetworkList(ctx, client.NetworkListOptions{Filters: filters})
-	errs = append(errs, err)
-	for _, n := range networks.Items {
-		if _, err := cli.NetworkRemove(ctx, n.ID, client.NetworkRemoveOptions{}); n.Scope == "swarm" && cerrdefs.IsInvalidArgument(err) { // swarm refuses while a service or its tasks use it
-			logger.Infof("keeping network %s, a swarm service still uses it", n.Name)
-		} else if err != nil && !cerrdefs.IsNotFound(err) {
-			errs = append(errs, fmt.Errorf("failed to remove network %s: %w", n.Name, err))
-		}
-	}
-	volumes, err := cli.VolumeList(ctx, client.VolumeListOptions{Filters: filters})
-	errs = append(errs, err)
-	for _, v := range volumes.Items {
-		if _, err := cli.VolumeRemove(ctx, v.Name, client.VolumeRemoveOptions{}); err != nil && !cerrdefs.IsNotFound(err) {
-			errs = append(errs, fmt.Errorf("failed to remove volume %s: %w", v.Name, err))
-		}
-	}
-	return errors.Join(errs...)
-}

act/container/docker_proxy_test.go

@@ -1,543 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package container
-
-import (
-	"archive/tar"
-	"bufio"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/image"
-	"github.com/moby/moby/api/types/mount"
-	"github.com/moby/moby/api/types/network"
-	"github.com/moby/moby/api/types/volume"
-	mobyclient "github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-func (m *mockDockerClient) VolumeList(ctx context.Context, opts mobyclient.VolumeListOptions) (mobyclient.VolumeListResult, error) {
-	args := m.Called(ctx, opts)
-	return args.Get(0).(mobyclient.VolumeListResult), args.Error(1)
-}
-
-func (m *mockDockerClient) VolumeRemove(ctx context.Context, id string, opts mobyclient.VolumeRemoveOptions) (mobyclient.VolumeRemoveResult, error) {
-	args := m.Called(ctx, id, opts)
-	return args.Get(0).(mobyclient.VolumeRemoveResult), args.Error(1)
-}
-
-// unix socket paths are limited to about a hundred bytes, which the default macOS TMPDIR exceeds
-func shortTempDir(t testing.TB) string {
-	t.Helper()
-	t.Setenv("TMPDIR", "/tmp")
-	return t.TempDir()
-}
-
-func daemonSocketPath(t testing.TB, cli mobyclient.APIClient) string {
-	t.Helper()
-	host := cli.DaemonHost()
-	if !strings.HasPrefix(host, "unix://") {
-		t.Skipf("skipping: daemon at %s is not a unix socket", host)
-	}
-	return strings.TrimPrefix(host, "unix://")
-}
-
-func TestDockerProxy(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("Unix socket ownership is unavailable on Windows")
-	}
-	bodies := make(chan []byte, 8)
-	createStarted, releaseCreate := make(chan struct{}), make(chan struct{})
-	streamsDone := make(chan struct{}, 2)
-	daemonSocket := filepath.Join(shortTempDir(t), "d.sock")
-	listener, err := net.Listen("unix", daemonSocket)
-	require.NoError(t, err)
-	daemon := &http.Server{ReadHeaderTimeout: time.Second, Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case strings.HasSuffix(r.URL.Path, "/create"):
-			body, _ := io.ReadAll(r.Body)
-			if r.URL.RawQuery == "wait" {
-				close(createStarted)
-				<-releaseCreate
-			}
-			bodies <- body
-			w.WriteHeader(http.StatusCreated)
-		case r.URL.Path == "/exec/detached/start" || r.URL.Path == "/exec/error/start":
-			if r.URL.Path == "/exec/error/start" {
-				w.Header().Set("Content-Type", "application/vnd.docker.raw-stream")
-				w.WriteHeader(http.StatusBadRequest)
-			}
-			_, _ = w.Write([]byte("ordinary"))
-		case rawStreamPath.MatchString(r.URL.Path) || r.URL.Path == "/session":
-			_, _ = io.Copy(io.Discard, r.Body)
-			conn, buffered, err := w.(http.Hijacker).Hijack()
-			if err != nil {
-				return
-			}
-			defer conn.Close()
-			if r.Header.Get("Upgrade") != "" {
-				_, _ = conn.Write([]byte("HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: tcp\r\n\r\nready\n"))
-			} else {
-				_, _ = conn.Write([]byte("HTTP/1.1 200 OK\r\nContent-Type: application/vnd.docker.raw-stream\r\n\r\nready\n"))
-			}
-			input, _ := io.ReadAll(buffered)
-			_, _ = conn.Write(append([]byte("final:"), input...))
-			streamsDone <- struct{}{}
-		default:
-			w.Header().Set("Api-Version", "1.47")
-			_, _ = w.Write([]byte("OK " + r.Method + " " + r.URL.Path))
-		}
-	})}
-	go func() { _ = daemon.Serve(listener) }()
-	t.Cleanup(func() { _ = daemon.Close() })
-	proxy, err := StartDockerProxy(daemonSocket, shortTempDir(t), "job-1")
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = proxy.Close(context.Background()) })
-	proxy.SetMounts(map[string]string{"/workspace/o/r": "/volumes/job/_data", "/workspace/o/r/tmp": "", "/var/run/docker.sock": "/tmp/p/docker.sock", "/volumes": "/daemon/volumes"})
-	client := &http.Client{Timeout: 5 * time.Second, Transport: &http.Transport{DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
-		return (&net.Dialer{}).DialContext(ctx, "unix", proxy.Socket)
-	}}}
-	t.Cleanup(client.CloseIdleConnections)
-	dialProxy := func(t *testing.T) *net.UnixConn {
-		t.Helper()
-		conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: proxy.Socket, Net: "unix"})
-		require.NoError(t, err)
-		t.Cleanup(func() { _ = conn.Close() })
-		require.NoError(t, conn.SetDeadline(time.Now().Add(5*time.Second)))
-		return conn
-	}
-	startStream := func(t *testing.T, path, upgrade string) (*net.UnixConn, *bufio.Reader) {
-		t.Helper()
-		conn := dialProxy(t)
-		_, err := fmt.Fprintf(conn, "POST %s HTTP/1.1\r\nHost: docker\r\n%sContent-Length: 2\r\n\r\n{}input", path, upgrade)
-		require.NoError(t, err)
-		reader := bufio.NewReader(conn)
-		resp, err := http.ReadResponse(reader, nil)
-		require.NoError(t, err)
-		t.Cleanup(func() {
-			_ = conn.Close()
-			_ = resp.Body.Close()
-		})
-		prefix, err := reader.ReadString('\n')
-		require.NoError(t, err)
-		require.Equal(t, "ready\n", prefix)
-		return conn, reader
-	}
-
-	t.Run("labels creates", func(t *testing.T) {
-		for _, testCase := range []struct{ path, body, want string }{
-			{
-				"/v1.47/containers/create", `{"Image":"alpine","Unknown":{"enabled":true},"Labels":{"own":"1","com.gitea.runner.job":"other"}}`,
-				`{"Image":"alpine","Unknown":{"enabled":true},"Labels":{"own":"1","com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/containers/create", `{"HostConfig":{"Binds":["/workspace/o/r:/src:ro","/workspace/o/r/../r/sub/:/sub","workspace/o/r:/relative","/workspace/o/rest:/rest","/workspace/o/r/tmp/x:/tmp","named:/named","/anonymous","/workspace/o/r:ro","/volumes/job/_data/x:/daemon-path"]},"DriverOpts":{"o":"bind","device":"/workspace/o/r"},"Labels":{"Foo":"1","foo":"2"}}`,
-				`{"HostConfig":{"Binds":["/volumes/job/_data:/src:ro","/volumes/job/_data/sub:/sub","workspace/o/r:/relative","/workspace/o/rest:/rest","/workspace/o/r/tmp/x:/tmp","named:/named","/anonymous","/workspace/o/r:ro","/volumes/job/_data/x:/daemon-path"]},"DriverOpts":{"o":"bind","device":"/workspace/o/r"},"Labels":{"Foo":"1","foo":"2","com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/containers/create", `{"HostConfig":{"Mounts":[{"Type":"bind","Source":"/var/run/docker.sock","Target":"/var/run/docker.sock"},{"type":"bind","source":"/workspace/o/r/sub/","target":"/m"},{"Type":"bind","Source":"/workspace/o/r/sub/../data","Target":"/dotted"},{"Type":"bind","Source":"/workspace/o/r/../r","Target":"/escaping"},{"Type":"BIND","Source":"/workspace/o/r"},{"Type":"volume","Source":"/workspace/o/r"}]}}`,
-				`{"HostConfig":{"Mounts":[{"Type":"bind","Source":"/tmp/p/docker.sock","Target":"/var/run/docker.sock"},{"Type":"bind","Source":"/volumes/job/_data/sub/","target":"/m"},{"Type":"bind","Source":"/volumes/job/_data/sub/../data","Target":"/dotted"},{"Type":"bind","Source":"/volumes/job/_data","Target":"/escaping"},{"Type":"BIND","Source":"/workspace/o/r"},{"Type":"volume","Source":"/workspace/o/r"}]},"Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/containers/create", `{"HostConfig":{"Mounts":[{"Type":"volume","VolumeOptions":{"DriverConfig":{"Options":{"o":"bind","device":"/workspace/o/r/data"}}}},{"Type":"volume","VolumeOptions":{"DriverConfig":{"Options":{"o":"unbindable","device":"/workspace/o/r"}}}},{"Type":"volume","VolumeOptions":{"DriverConfig":{"Options":{"o":"bind,remount","device":"/workspace/o/r"}}}},{"Type":"volume","VolumeOptions":{"DriverConfig":{"Name":"plugin","Options":{"o":"bind","device":"/workspace/o/r"}}}}]}}`,
-				`{"HostConfig":{"Mounts":[{"Type":"volume","VolumeOptions":{"DriverConfig":{"Options":{"o":"bind","device":"/volumes/job/_data/data"}}}},{"Type":"volume","VolumeOptions":{"DriverConfig":{"Options":{"o":"unbindable","device":"/workspace/o/r"}}}},{"Type":"volume","VolumeOptions":{"DriverConfig":{"Options":{"o":"bind,remount","device":"/workspace/o/r"}}}},{"Type":"volume","VolumeOptions":{"DriverConfig":{"Name":"plugin","Options":{"o":"bind","device":"/workspace/o/r"}}}}]},"Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/containers/create", `{"HostConfig":{"privileged":true,"Privileged":false,"Binds":["/workspace/o/r:/src"]},"hoſtconfig":null}`,
-				`{"HostConfig":{"privileged":true,"Privileged":false,"Binds":["/workspace/o/r:/src"]},"hoſtconfig":null,"Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/networks/create", `{"Name":"n"}`,
-				`{"Name":"n","Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/volumes/create", `{"Name":"v","labels":null,"DriverOpts":{"type":"none","o":"rbind,ro","device":"/workspace/o/r/"},"HostConfig":{"Binds":["/workspace/o/r:/src"]}}`,
-				`{"Name":"v","Labels":{"com.gitea.runner.job":"job-1"},"DriverOpts":{"type":"none","o":"rbind,ro","device":"/volumes/job/_data/"},"HostConfig":{"Binds":["/workspace/o/r:/src"]}}`,
-			},
-			{
-				"/volumes/create", `{"Name":"d","DriverOpts":{"o":"bind","device":1,"device":"/workspace/o/r"}}`,
-				`{"Name":"d","DriverOpts":{"o":"bind","device":1,"device":"/workspace/o/r"},"Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/volumes/create", `{"Name":"p","Driver":"plugin","DriverOpts":{"o":"bind","device":"/workspace/o/r"}}`,
-				`{"Name":"p","Driver":"plugin","DriverOpts":{"o":"bind","device":"/workspace/o/r"},"Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/volumes/create", "",
-				`{"Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/volumes/create", "null",
-				`{"Labels":{"com.gitea.runner.job":"job-1"}}`,
-			},
-			{
-				"/volumes/create", `{"Labels":{"discard":"1"},"labels":null,"LABELS":{"own":"1"},"LABELS":{"extra":"2"}}`,
-				`{"Labels":{"own":"1","extra":"2","com.gitea.runner.job":"job-1"}}`,
-			},
-		} {
-			resp, err := client.Post("http://docker"+testCase.path, "application/json", strings.NewReader(testCase.body))
-			require.NoError(t, err)
-			resp.Body.Close()
-			require.Equal(t, http.StatusCreated, resp.StatusCode)
-			assert.JSONEq(t, testCase.want, string(<-bodies), testCase.body)
-		}
-	})
-
-	t.Run("passes other requests through", func(t *testing.T) {
-		resp, err := client.Get("http://docker/v1.47/_ping")
-		require.NoError(t, err)
-		defer resp.Body.Close()
-		body, _ := io.ReadAll(resp.Body)
-		assert.Equal(t, "1.47", resp.Header.Get("Api-Version"))
-		assert.Equal(t, "OK GET /v1.47/_ping", string(body))
-	})
-
-	t.Run("tunnels raw streams through stdin EOF", func(t *testing.T) {
-		for _, stream := range []struct{ path, upgrade string }{
-			{path: "/v1.47/exec/abc/start"},
-			{path: "/containers/abc/attach", upgrade: "Connection: Upgrade\r\nUpgrade: tcp\r\n"},
-		} {
-			conn, reader := startStream(t, stream.path, stream.upgrade)
-			require.NoError(t, conn.CloseWrite())
-			output, err := io.ReadAll(reader)
-			require.NoError(t, err)
-			assert.Equal(t, "final:input", string(output))
-			<-streamsDone
-		}
-	})
-
-	t.Run("detached and error responses retain keepalive label injection", func(t *testing.T) {
-		conn := dialProxy(t)
-		reader := bufio.NewReader(conn)
-		for endpoint, status := range map[string]int{"detached": http.StatusOK, "error": http.StatusBadRequest} {
-			_, err := fmt.Fprintf(conn, "POST /exec/%s/start HTTP/1.1\r\nHost: docker\r\nContent-Length: 2\r\n\r\n{}", endpoint)
-			require.NoError(t, err)
-			resp, err := http.ReadResponse(reader, nil)
-			require.NoError(t, err)
-			body, err := io.ReadAll(resp.Body)
-			require.NoError(t, err)
-			require.NoError(t, resp.Body.Close())
-			assert.Equal(t, status, resp.StatusCode)
-			assert.Equal(t, "ordinary", string(body))
-			_, err = io.WriteString(conn, "POST /volumes/create HTTP/1.1\r\nHost: docker\r\nContent-Length: 0\r\n\r\n")
-			require.NoError(t, err)
-			resp, err = http.ReadResponse(reader, nil)
-			require.NoError(t, err)
-			require.NoError(t, resp.Body.Close())
-			require.Equal(t, http.StatusCreated, resp.StatusCode)
-			assert.JSONEq(t, `{"Labels":{"com.gitea.runner.job":"job-1"}}`, string(<-bodies))
-		}
-	})
-
-	t.Run("close joins streams and admitted create", func(t *testing.T) {
-		t.Cleanup(func() { close(releaseCreate) })
-		_, raw := startStream(t, "/exec/live/start", "")
-		_, upgraded := startStream(t, "/session", "Connection: Upgrade\r\nUpgrade: tcp\r\n")
-		creator := dialProxy(t)
-		_, err := io.WriteString(creator, "POST /volumes/create?wait HTTP/1.1\r\nHost: docker\r\nContent-Length: 2\r\n\r\n{}")
-		require.NoError(t, err)
-		<-createStarted
-		require.NoError(t, creator.CloseWrite())
-		closed := make(chan error, 1)
-		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
-		defer cancel()
-		go func() { closed <- proxy.Close(ctx) }()
-		for _, reader := range []*bufio.Reader{raw, upgraded} {
-			_, err := reader.ReadByte()
-			require.ErrorIs(t, err, io.EOF)
-			<-streamsDone
-		}
-		select {
-		case err := <-closed:
-			t.Fatalf("Close returned before admitted create settled: %v", err)
-		default:
-		}
-		releaseCreate <- struct{}{}
-		resp, err := http.ReadResponse(bufio.NewReader(creator), nil)
-		require.NoError(t, err)
-		require.NoError(t, resp.Body.Close())
-		require.Equal(t, http.StatusCreated, resp.StatusCode)
-		assert.JSONEq(t, `{"Labels":{"com.gitea.runner.job":"job-1"}}`, string(<-bodies))
-		require.NoError(t, <-closed)
-	})
-}
-
-func TestRemoveLabelledRemovesContainersNetworksAndVolumes(t *testing.T) {
-	containerFailure := errors.New("container removal failed")
-	listFailure := errors.New("listing failed")
-	volumeFailure := errors.New("volume removal failed")
-	ctx := context.Background()
-	filters := make(mobyclient.Filters).Add("label", jobLabel+"=job-1")
-	cli := &mockDockerClient{}
-	cli.On("ContainerList", ctx, mobyclient.ContainerListOptions{All: true, Filters: filters}).
-		Return(mobyclient.ContainerListResult{Items: []container.Summary{{ID: "c1", Names: []string{"/app"}}}}, nil).Once()
-	cli.On("ContainerKill", ctx, "c1", mock.Anything).Return(mobyclient.ContainerKillResult{}, nil).Once()
-	cli.On("ContainerRemove", ctx, "c1", mobyclient.ContainerRemoveOptions{RemoveVolumes: true, Force: true}).
-		Return(mobyclient.ContainerRemoveResult{}, containerFailure).Once()
-	cli.On("NetworkList", ctx, mobyclient.NetworkListOptions{Filters: filters}).
-		Return(mobyclient.NetworkListResult{Items: []network.Summary{{ID: "n1", Name: "stack_default", Scope: "swarm"}}}, listFailure).Once()
-	cli.On("NetworkRemove", ctx, "n1", mobyclient.NetworkRemoveOptions{}).Return(mobyclient.NetworkRemoveResult{}, cerrdefs.ErrInvalidArgument).Once()
-	cli.On("VolumeList", ctx, mobyclient.VolumeListOptions{Filters: filters}).
-		Return(mobyclient.VolumeListResult{Items: []volume.Volume{{Name: "app_data"}}}, nil).Once()
-	cli.On("VolumeRemove", ctx, "app_data", mobyclient.VolumeRemoveOptions{}).Return(mobyclient.VolumeRemoveResult{}, volumeFailure).Once()
-
-	err := removeLabelled(ctx, cli, "job-1")
-	require.ErrorIs(t, err, containerFailure)
-	require.ErrorIs(t, err, listFailure)
-	require.ErrorIs(t, err, volumeFailure)
-	require.NotErrorIs(t, err, cerrdefs.ErrInvalidArgument)
-	require.ErrorContains(t, err, "failed to remove container c1")
-	require.ErrorContains(t, err, "failed to remove volume app_data")
-	cli.AssertExpectations(t)
-}
-
-func TestDockerProxyWithDaemon(t *testing.T) {
-	requireDocker(t)
-	ctx := context.Background()
-	require.NoError(t, NewDockerPullExecutor(NewDockerPullExecutorInput{Image: "alpine"})(ctx))
-	direct, err := GetDockerClient(ctx)
-	require.NoError(t, err)
-	defer direct.Close()
-	dir := shortTempDir(t)
-	seen, err := daemonSeesDir(ctx, direct, dir, dir)
-	require.NoError(t, err)
-	t.Logf("daemon sees the runner's filesystem: %v", seen)
-	seen, err = daemonSeesDir(ctx, direct, dir, shortTempDir(t))
-	require.NoError(t, err)
-	assert.False(t, seen)
-
-	job := "proxy-test-" + strconv.FormatInt(time.Now().UnixNano(), 36)
-	proxy, err := StartDockerProxy(daemonSocketPath(t, direct), dir, job)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = proxy.Close(context.Background()) })
-	viaProxy, err := mobyclient.New(mobyclient.WithHost("unix://" + proxy.Socket))
-	require.NoError(t, err)
-	defer viaProxy.Close()
-
-	created, err := viaProxy.ContainerCreate(ctx, mobyclient.ContainerCreateOptions{
-		Config: &container.Config{Image: "alpine", Cmd: []string{"sleep", "300"}, Labels: map[string]string{"own": "1"}},
-	})
-	require.NoError(t, err)
-	t.Cleanup(func() { _, _ = direct.ContainerRemove(ctx, created.ID, mobyclient.ContainerRemoveOptions{Force: true}) })
-	_, err = viaProxy.ContainerStart(ctx, created.ID, mobyclient.ContainerStartOptions{})
-	require.NoError(t, err)
-	net, err := viaProxy.NetworkCreate(ctx, job, mobyclient.NetworkCreateOptions{})
-	require.NoError(t, err)
-	t.Cleanup(func() { _, _ = direct.NetworkRemove(ctx, net.ID, mobyclient.NetworkRemoveOptions{}) })
-	_, err = viaProxy.VolumeCreate(ctx, mobyclient.VolumeCreateOptions{Name: job})
-	require.NoError(t, err)
-	t.Cleanup(func() { _, _ = direct.VolumeRemove(ctx, job, mobyclient.VolumeRemoveOptions{Force: true}) })
-
-	inspected, err := direct.ContainerInspect(ctx, created.ID, mobyclient.ContainerInspectOptions{})
-	require.NoError(t, err)
-	assert.Equal(t, map[string]string{"own": "1", jobLabel: job}, inspected.Container.Config.Labels)
-	vol, err := direct.VolumeInspect(ctx, job, mobyclient.VolumeInspectOptions{})
-	require.NoError(t, err)
-	assert.Equal(t, job, vol.Volume.Labels[jobLabel])
-
-	exec, err := viaProxy.ExecCreate(ctx, created.ID, mobyclient.ExecCreateOptions{Cmd: []string{"cat"}, AttachStdin: true, AttachStdout: true, TTY: true})
-	require.NoError(t, err)
-	attached, err := viaProxy.ExecAttach(ctx, exec.ID, mobyclient.ExecAttachOptions{TTY: true})
-	require.NoError(t, err)
-	_, err = attached.Conn.Write([]byte("hello\n"))
-	require.NoError(t, err)
-	echoed, err := attached.Reader.ReadString('\n')
-	require.NoError(t, err)
-	assert.Equal(t, "hello\r\n", echoed)
-	attached.Close()
-
-	require.NoError(t, proxy.Close(ctx))
-	require.NoError(t, RemoveDockerJobResources(ctx, job))
-	_, err = direct.ContainerInspect(ctx, created.ID, mobyclient.ContainerInspectOptions{})
-	assert.True(t, cerrdefs.IsNotFound(err))
-	_, err = direct.NetworkInspect(ctx, net.ID, mobyclient.NetworkInspectOptions{})
-	assert.True(t, cerrdefs.IsNotFound(err))
-	_, err = direct.VolumeInspect(ctx, job, mobyclient.VolumeInspectOptions{})
-	assert.True(t, cerrdefs.IsNotFound(err))
-}
-
-func BenchmarkDockerProxy(b *testing.B) {
-	ctx := context.Background()
-	direct, err := GetDockerClient(ctx)
-	require.NoError(b, err)
-	defer direct.Close()
-	if _, err := direct.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-		b.Skipf("docker daemon unreachable: %v", err)
-	}
-	proxy, err := StartDockerProxy(daemonSocketPath(b, direct), shortTempDir(b), "bench")
-	require.NoError(b, err)
-	defer func() { _ = proxy.Close(ctx) }()
-	viaProxy, err := mobyclient.New(mobyclient.WithHost("unix://" + proxy.Socket))
-	require.NoError(b, err)
-	defer viaProxy.Close()
-
-	require.NoError(b, NewDockerPullExecutor(NewDockerPullExecutorInput{Image: "alpine"})(ctx))
-	created, err := direct.ContainerCreate(ctx, mobyclient.ContainerCreateOptions{Config: &container.Config{Image: "alpine", Cmd: []string{"sleep", "600"}}})
-	require.NoError(b, err)
-	defer func() { _, _ = direct.ContainerRemove(ctx, created.ID, mobyclient.ContainerRemoveOptions{Force: true}) }()
-	_, err = direct.ContainerStart(ctx, created.ID, mobyclient.ContainerStartOptions{})
-	require.NoError(b, err)
-
-	var archive bytes.Buffer
-	writer := tar.NewWriter(&archive)
-	payload := make([]byte, 64<<20)
-	require.NoError(b, writer.WriteHeader(&tar.Header{Name: "blob", Mode: 0o600, Size: int64(len(payload))}))
-	_, _ = writer.Write(payload)
-	require.NoError(b, writer.Close())
-
-	for name, cli := range map[string]mobyclient.APIClient{"direct": direct, "proxy": viaProxy} {
-		b.Run("ping/"+name, func(b *testing.B) {
-			for b.Loop() {
-				if _, err := cli.Ping(ctx, mobyclient.PingOptions{}); err != nil {
-					b.Fatal(err)
-				}
-			}
-		})
-		b.Run("copy64MiB/"+name, func(b *testing.B) {
-			b.SetBytes(int64(archive.Len()))
-			for b.Loop() {
-				_, err := cli.CopyToContainer(ctx, created.ID, mobyclient.CopyToContainerOptions{DestinationPath: "/tmp", Content: bytes.NewReader(archive.Bytes())})
-				if err != nil {
-					b.Fatal(err)
-				}
-			}
-		})
-	}
-}
-
-type probeClient struct {
-	mobyclient.APIClient
-	create func(mobyclient.ContainerCreateOptions) (mobyclient.ContainerCreateResult, error)
-	remove func(context.Context, string, mobyclient.ContainerRemoveOptions) (mobyclient.ContainerRemoveResult, error)
-	stat   func(string) error
-	mounts []container.MountPoint
-}
-
-func (c *probeClient) ContainerInspect(context.Context, string, mobyclient.ContainerInspectOptions) (mobyclient.ContainerInspectResult, error) {
-	return mobyclient.ContainerInspectResult{Container: container.InspectResponse{Mounts: c.mounts}}, nil
-}
-
-func (c *probeClient) ImageList(context.Context, mobyclient.ImageListOptions) (mobyclient.ImageListResult, error) {
-	return mobyclient.ImageListResult{Items: []image.Summary{{ID: "probe-image"}}}, nil
-}
-
-func (c *probeClient) ContainerCreate(_ context.Context, opts mobyclient.ContainerCreateOptions) (mobyclient.ContainerCreateResult, error) {
-	return c.create(opts)
-}
-
-func (c *probeClient) ContainerRemove(ctx context.Context, id string, opts mobyclient.ContainerRemoveOptions) (mobyclient.ContainerRemoveResult, error) {
-	return c.remove(ctx, id, opts)
-}
-
-func (c *probeClient) ContainerStatPath(_ context.Context, _ string, opts mobyclient.ContainerStatPathOptions) (mobyclient.ContainerStatPathResult, error) {
-	return mobyclient.ContainerStatPathResult{}, c.stat(opts.Path)
-}
-
-func TestDaemonSeesDir(t *testing.T) {
-	dir := t.TempDir()
-	markers := make(map[string]bool)
-	for _, testCase := range []struct {
-		name      string
-		daemonDir string
-		removeErr error
-		seen      bool
-		removed   bool
-	}{
-		{name: "cleanup after cancellation", daemonDir: dir, seen: true, removed: true},
-		{name: "daemon without the directory", daemonDir: filepath.Join(dir, "missing")},
-		{name: "daemon with a different directory at that path", daemonDir: t.TempDir(), removed: true},
-		{name: "cleanup error after cancellation", daemonDir: dir, removeErr: errors.New("cleanup failed"), removed: true},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(t.Context())
-			defer cancel()
-			removed := false
-			cli := &probeClient{
-				create: func(opts mobyclient.ContainerCreateOptions) (mobyclient.ContainerCreateResult, error) {
-					assert.Equal(t, []mount.Mount{{Type: mount.TypeBind, Source: testCase.daemonDir, Target: "/gitea-runner-probe", ReadOnly: true}}, opts.HostConfig.Mounts)
-					cancel()
-					if _, err := os.Stat(testCase.daemonDir); err != nil {
-						return mobyclient.ContainerCreateResult{}, cerrdefs.ErrInvalidArgument
-					}
-					return mobyclient.ContainerCreateResult{ID: "probe"}, nil
-				},
-				stat: func(path string) error {
-					marker := strings.TrimPrefix(path, "/gitea-runner-probe/")
-					assert.False(t, markers[marker])
-					markers[marker] = true
-					if _, err := os.Stat(filepath.Join(testCase.daemonDir, marker)); err != nil {
-						return cerrdefs.ErrNotFound
-					}
-					return nil
-				},
-				remove: func(ctx context.Context, id string, opts mobyclient.ContainerRemoveOptions) (mobyclient.ContainerRemoveResult, error) {
-					removed = true
-					assert.Equal(t, "probe", id)
-					assert.Equal(t, mobyclient.ContainerRemoveOptions{Force: true, RemoveVolumes: true}, opts)
-					require.NoError(t, ctx.Err())
-					_, bounded := ctx.Deadline()
-					assert.True(t, bounded)
-					return mobyclient.ContainerRemoveResult{}, testCase.removeErr
-				},
-			}
-			seen, err := daemonSeesDir(ctx, cli, dir, testCase.daemonDir)
-			require.ErrorIs(t, err, testCase.removeErr)
-			assert.Equal(t, testCase.seen, seen)
-			assert.Equal(t, testCase.removed, removed)
-			entries, err := os.ReadDir(dir)
-			require.NoError(t, err)
-			assert.Empty(t, entries)
-		})
-	}
-}
-
-func TestRunnerContainerWorkdir(t *testing.T) {
-	workdir := t.TempDir()
-	t.Chdir(workdir)
-	volume := container.MountPoint{Type: mount.TypeVolume, Source: "/daemon/_data", Destination: filepath.Dir(workdir)}
-	for _, testCase := range []struct {
-		name      string
-		mount     container.MountPoint
-		foreign   bool
-		daemonDir string
-	}{
-		{name: "volume above the working directory", mount: volume, daemonDir: filepath.Join(volume.Source, filepath.Base(workdir))},
-		{name: "tmpfs", mount: container.MountPoint{Type: mount.TypeTmpfs, Destination: volume.Destination}},
-		{name: "hostname of another container", mount: volume, foreign: true},
-	} {
-		cli := &probeClient{
-			mounts: []container.MountPoint{testCase.mount},
-			stat: func(path string) error {
-				if _, err := os.Stat(path); err != nil || testCase.foreign {
-					return cerrdefs.ErrNotFound
-				}
-				return nil
-			},
-		}
-		dir, daemonDir := runnerContainerWorkdir(t.Context(), cli)
-		assert.Equal(t, testCase.daemonDir, daemonDir, testCase.name)
-		assert.Equal(t, testCase.daemonDir != "", dir == workdir, testCase.name)
-	}
-	entries, err := os.ReadDir(workdir)
-	require.NoError(t, err)
-	assert.Empty(t, entries)
-}

act/container/docker_proxy_unix.go

@@ -1,48 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !WITHOUT_DOCKER && (linux || darwin || netbsd)
-
-package container
-
-import (
-	"encoding/binary"
-	"errors"
-	"io/fs"
-	"math"
-	"os"
-	"path/filepath"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func copyDockerSocketPermissions(daemonSocket, socket string, info os.FileInfo) error {
-	stat, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.New("docker socket ownership is unavailable")
-	}
-	groupErr := os.Chown(socket, int(stat.Uid), int(stat.Gid))
-	if groupErr != nil && (!errors.Is(groupErr, fs.ErrPermission) || int(stat.Uid) != os.Geteuid()) {
-		return groupErr
-	}
-	if err := os.Chown(filepath.Dir(socket), int(stat.Uid), -1); err != nil {
-		return err
-	}
-	mode := uint16(info.Mode().Perm())
-	if err := os.Chmod(socket, fs.FileMode(mode)); err != nil || groupErr == nil {
-		return err
-	}
-	if size, err := unix.Getxattr(daemonSocket, "system.posix_acl_access", nil); err == nil && size > 0 {
-		return groupErr
-	}
-	owner, group, other := mode>>6, mode>>3&7, mode&7
-	acl := binary.LittleEndian.AppendUint32(nil, 2)
-	for _, entry := range []struct {
-		tag, perm uint16
-		id        uint32
-	}{{1, owner, math.MaxUint32}, {4, other, math.MaxUint32}, {8, group, stat.Gid}, {16, group | other, math.MaxUint32}, {32, other, math.MaxUint32}} {
-		acl = binary.LittleEndian.AppendUint32(binary.LittleEndian.AppendUint16(binary.LittleEndian.AppendUint16(acl, entry.tag), entry.perm), entry.id)
-	}
-	return unix.Setxattr(socket, "system.posix_acl_access", acl, 0) // names the group a rootless runner cannot chown to, its own group keeps what others had
-}

act/container/docker_proxy_windows.go

@@ -1,15 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !WITHOUT_DOCKER
-
-package container
-
-import (
-	"errors"
-	"os"
-)
-
-func copyDockerSocketPermissions(_, _ string, _ os.FileInfo) error {
-	return errors.New("docker socket ownership cannot be preserved on Windows")
-}

act/container/docker_run.go

@@ -14,7 +14,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path"
 	"path/filepath"
 	"reflect"
 	"regexp"
@@ -28,13 +27,13 @@ import (
 	"gitea.com/gitea/runner/act/filecollector"
 
 	"dario.cat/mergo"
-	"github.com/bmatcuk/doublestar/v4"
 	cerrdefs "github.com/containerd/errdefs"
 	"github.com/docker/cli/cli/compose/loader"
 	"github.com/docker/cli/cli/connhelper"
 	"github.com/go-git/go-billy/v5/helper/polyfill"
 	"github.com/go-git/go-billy/v5/osfs"
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
+	"github.com/gobwas/glob"
 	"github.com/joho/godotenv"
 	"github.com/moby/moby/api/pkg/stdcopy"
 	"github.com/moby/moby/api/types/container"
@@ -139,12 +138,12 @@ func (cr *containerReference) Copy(destPath string, files ...*FileEntry) common.
 	).IfNot(common.Dryrun)
 }
 
-func (cr *containerReference) CopyDir(destPath, srcPath string, useGitIgnore, skipGitDir bool) common.Executor {
+func (cr *containerReference) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
 	return common.NewPipelineExecutor(
 		common.NewInfoExecutor("docker cp src=%s dst=%s", srcPath, destPath),
 		cr.connect(),
 		cr.find(),
-		cr.copyDir(destPath, srcPath, useGitIgnore, skipGitDir),
+		cr.copyDir(destPath, srcPath, useGitIgnore),
 		func(ctx context.Context) error {
 			// If this fails, then folders have wrong permissions on non root container
 			if cr.UID != 0 || cr.GID != 0 {
@@ -253,31 +252,6 @@ func containerInfoFromInspect(inspect container.InspectResponse) *Info {
 		ID:     inspect.ID,
 		Health: HealthNone,
 		Ports:  map[string]string{}, // an empty map, never null, in the expression context
-		Mounts: make(map[string]string, len(inspect.Mounts)),
-	}
-	for _, mountPoint := range inspect.Mounts {
-		info.Mounts[mountPoint.Destination] = mountPoint.Source
-	}
-	if hostConfig := inspect.HostConfig; hostConfig != nil { // Mounts omits --tmpfs targets and subpaths
-		for target := range hostConfig.Tmpfs {
-			info.Mounts[path.Clean(target)] = ""
-		}
-		for _, spec := range hostConfig.Mounts {
-			subpath := ""
-			if spec.VolumeOptions != nil {
-				subpath = spec.VolumeOptions.Subpath
-			} else if spec.ImageOptions != nil {
-				subpath = spec.ImageOptions.Subpath
-			}
-			if target := path.Clean(spec.Target); subpath != "" && info.Mounts[target] != "" {
-				info.Mounts[target] = path.Join(info.Mounts[target], subpath)
-			}
-		}
-	}
-	for _, target := range []string{"/etc/hosts", "/etc/hostname", "/etc/resolv.conf"} { // specific to the job's network namespace
-		if _, mounted := info.Mounts[target]; !mounted {
-			info.Mounts[target] = ""
-		}
 	}
 
 	if state := inspect.State; state != nil {
@@ -510,11 +484,14 @@ func (cr *containerReference) remove() common.Executor {
 			RemoveVolumes: true,
 			Force:         true,
 		})
-		if cerrdefs.IsConflict(err) {
-			err = cr.waitForRemoval(ctx, idOrName)
-		}
-		if err != nil && !cerrdefs.IsNotFound(err) {
-			return fmt.Errorf("failed to remove container %s: %w", idOrName, err)
+		switch {
+		case cerrdefs.IsConflict(err):
+			// the daemon's own AutoRemove teardown is running, and it releases the volume
+			// references and the network endpoint only once it finishes
+			cr.waitForRemoval(ctx, idOrName)
+		case err != nil && !cerrdefs.IsNotFound(err):
+			logger.Error(fmt.Errorf("failed to remove container %s: %w", idOrName, err))
+			return nil // keep the id, the container is still there for a later Remove()
 		}
 
 		logger.Debugf("Removed container: %v", idOrName)
@@ -523,7 +500,7 @@ func (cr *containerReference) remove() common.Executor {
 	}
 }
 
-func (cr *containerReference) waitForRemoval(ctx context.Context, idOrName string) error {
+func (cr *containerReference) waitForRemoval(ctx context.Context, idOrName string) {
 	// per container, against the one minute the post-job executor allows for the whole
 	// cleanup, so a job with several services can spend most of that budget here
 	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
@@ -533,13 +510,18 @@ func (cr *containerReference) waitForRemoval(ctx context.Context, idOrName strin
 		Condition: container.WaitConditionRemoved,
 	})
 	select {
-	case result := <-waitResult.Result:
-		if result.Error != nil {
-			return errors.New(result.Error.Message)
-		}
-		return nil
-	case err := <-waitResult.Error:
-		return err
+	case <-waitResult.Result:
+	case <-waitResult.Error:
+	case <-ctx.Done():
+		// the client delivers the result over an unbuffered channel, so leave a receiver
+		// behind or its goroutine parks on the send for the lifetime of the process
+		go func() {
+			select {
+			case <-waitResult.Result:
+			case <-waitResult.Error:
+			}
+		}()
+		common.Logger(ctx).Warnf("Timed out waiting for the daemon to remove container %s, its volumes and network may be left behind", idOrName)
 	}
 }
 
@@ -593,8 +575,7 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 
 	// If the `privileged` config has been disabled, `copts.privileged` need to be forced to false,
 	// even if the user specifies `--privileged` in the options string.
-	if !hostConfig.Privileged && copts.privileged {
-		logger.Warnf("container option %q is not allowed when privileged mode is disabled and will be ignored", "--privileged")
+	if !hostConfig.Privileged {
 		copts.privileged = false
 	}
 
@@ -630,7 +611,6 @@ func (cr *containerReference) mergeContainerConfigs(ctx context.Context, config
 
 	logger.Debugf("Custom container.HostConfig from options ==> %+v", containerConfig.HostConfig)
 
-	cr.sanitizeConfig(ctx, nil, containerConfig.HostConfig) // a dropped volume must not displace the runner's own
 	overlayVolumes(hostConfig, containerConfig.HostConfig)
 	binds := hostConfig.Binds
 	mounts := hostConfig.Mounts
@@ -960,7 +940,7 @@ func (cr *containerReference) waitForCommand(ctx context.Context, resp client.Hi
 	}
 }
 
-func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore, skipGitDir bool) common.Executor {
+func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore bool) common.Executor {
 	return func(ctx context.Context) error {
 		if cr.id == "" {
 			return cr.missingContainerError("copy directory to %s", dstPath)
@@ -1001,10 +981,9 @@ func (cr *containerReference) copyDir(dstPath, srcPath string, useGitIgnore, ski
 		}
 
 		fc := &filecollector.FileCollector{
-			Ignorer:    ignorer,
-			SrcPath:    srcPath,
-			SrcPrefix:  srcPrefix,
-			SkipGitDir: skipGitDir,
+			Ignorer:   ignorer,
+			SrcPath:   srcPath,
+			SrcPrefix: srcPrefix,
 			Handler: &filecollector.TarCollector{
 				TarWriter: tw,
 				UID:       cr.UID,
@@ -1263,12 +1242,6 @@ func (cr *containerReference) sanitizeConfig(ctx context.Context, config *contai
 	return config, hostConfig
 }
 
-func SanitizeBinds(ctx context.Context, validVolumes, binds []string) []string {
-	cr := &containerReference{input: &NewContainerInput{ValidVolumes: validVolumes}}
-	_, hostConfig := cr.sanitizeConfig(ctx, nil, &container.HostConfig{Binds: binds})
-	return hostConfig.Binds
-}
-
 // bindTarget returns the container path a bind mounts onto, empty if it cannot be parsed.
 func bindTarget(bind string) string {
 	parsed, err := loader.ParseVolume(bind)
@@ -1299,15 +1272,15 @@ func overlayVolumes(dst, src *container.HostConfig) {
 
 type validVolumeMatcher struct {
 	allowAll bool
-	named    []string
-	host     []string
+	named    []glob.Glob
+	host     []glob.Glob
 }
 
 func newValidVolumeMatcher(ctx context.Context, validVolumes []string) validVolumeMatcher {
 	logger := common.Logger(ctx)
 	ret := validVolumeMatcher{
-		named: make([]string, 0, len(validVolumes)),
-		host:  make([]string, 0, len(validVolumes)),
+		named: make([]glob.Glob, 0, len(validVolumes)),
+		host:  make([]glob.Glob, 0, len(validVolumes)),
 	}
 
 	for _, v := range validVolumes {
@@ -1316,10 +1289,10 @@ func newValidVolumeMatcher(ctx context.Context, validVolumes []string) validVolu
 			continue
 		}
 		if !isHostVolumePattern(v) {
-			if doublestar.ValidatePattern(v) {
-				ret.named = append(ret.named, v)
+			if g, err := glob.Compile(v); err != nil {
+				logger.Errorf("create glob from %s error: %v", v, err)
 			} else {
-				logger.Errorf("invalid volume pattern %s", v)
+				ret.named = append(ret.named, g)
 			}
 			continue
 		}
@@ -1328,10 +1301,10 @@ func newValidVolumeMatcher(ctx context.Context, validVolumes []string) validVolu
 			logger.Errorf("normalize volume pattern %s error: %v", v, err)
 			continue
 		}
-		if doublestar.ValidatePathPattern(normalized) {
-			ret.host = append(ret.host, normalized)
+		if g, err := glob.Compile(normalized); err != nil {
+			logger.Errorf("create glob from %s error: %v", normalized, err)
 		} else {
-			logger.Errorf("invalid volume pattern %s", normalized)
+			ret.host = append(ret.host, g)
 		}
 	}
 
@@ -1347,15 +1320,15 @@ func (m validVolumeMatcher) isValid(source string, sourceType mount.Type) bool {
 		if err != nil {
 			return false
 		}
-		for _, pattern := range m.host {
-			if doublestar.PathMatchUnvalidated(pattern, normalized) {
+		for _, g := range m.host {
+			if g.Match(normalized) {
 				return true
 			}
 		}
 		return false
 	}
-	for _, pattern := range m.named {
-		if doublestar.MatchUnvalidated(pattern, source) {
+	for _, g := range m.named {
+		if g.Match(source) {
 			return true
 		}
 	}

act/container/docker_run_test.go

@@ -345,22 +345,18 @@ func TestDockerWaitFailure(t *testing.T) {
 // A remove that raced the daemon's AutoRemove teardown is not a failure and must not
 // be logged as one.
 func TestRemoveIgnoresAutoRemoveRace(t *testing.T) {
-	removeFailure := errors.New("driver failed to remove root filesystem")
 	removeOpts := mobyclient.ContainerRemoveOptions{RemoveVolumes: true, Force: true}
 	killOpts := mobyclient.ContainerKillOptions{Signal: "SIGKILL"}
 	for _, tc := range []struct {
-		name     string
-		err      error
-		wantWait bool
-		waitErr  error
-		wantErr  error
+		name        string
+		err         error
+		wantWait    bool
+		wantFailure bool
 	}{
 		{name: "removal in progress", err: cerrdefs.ErrConflict.WithMessage("removal of container abc is already in progress"), wantWait: true},
-		{name: "wait canceled", err: cerrdefs.ErrConflict, wantWait: true, waitErr: context.Canceled, wantErr: context.Canceled},
-		{name: "removed during wait", err: cerrdefs.ErrConflict, wantWait: true, waitErr: cerrdefs.ErrNotFound},
 		{name: "already removed", err: cerrdefs.ErrNotFound.WithMessage("No such container: abc")},
 		{name: "removed cleanly", err: nil},
-		{name: "real failure", err: removeFailure, wantErr: removeFailure},
+		{name: "real failure", err: errors.New("driver failed to remove root filesystem"), wantFailure: true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			logger, hook := test.NewNullLogger()
@@ -370,24 +366,21 @@ func TestRemoveIgnoresAutoRemoveRace(t *testing.T) {
 			client.On("ContainerRemove", ctx, "abc", removeOpts).Return(mobyclient.ContainerRemoveResult{}, tc.err)
 			if tc.wantWait {
 				removed := make(chan container.WaitResponse, 1)
-				waitErrors := make(chan error, 1)
-				if tc.waitErr == nil {
-					removed <- container.WaitResponse{}
-				} else {
-					waitErrors <- tc.waitErr
-				}
+				removed <- container.WaitResponse{}
 				client.On("ContainerWait", mock.Anything, "abc", mobyclient.ContainerWaitOptions{Condition: container.WaitConditionRemoved}).
-					Return(mobyclient.ContainerWaitResult{Result: removed, Error: waitErrors})
+					Return(mobyclient.ContainerWaitResult{Result: removed})
 			}
 			cr := &containerReference{id: "abc", cli: client}
 
-			require.ErrorIs(t, cr.remove()(ctx), tc.wantErr)
-			if tc.wantErr != nil {
+			require.NoError(t, cr.remove()(ctx))
+			// a failure keeps the id, so a later Remove() can retry it
+			if tc.wantFailure {
 				assert.Equal(t, "abc", cr.id)
+				assert.Len(t, hook.AllEntries(), 1)
 			} else {
 				assert.Empty(t, cr.id)
+				assert.Empty(t, hook.AllEntries())
 			}
-			assert.Empty(t, hook.AllEntries())
 			client.AssertExpectations(t)
 		})
 	}
@@ -478,7 +471,7 @@ func TestRejectsMissingContainer(t *testing.T) {
 		assert.Contains(t, err.Error(), `container "job-1" does not exist`, op)
 	}
 	check("copyContent", cr.copyContent("/var/run/act", &FileEntry{Name: "x", Mode: 0o644})(ctx))
-	check("copyDir", cr.copyDir("/var/run/act", "/src", false, false)(ctx))
+	check("copyDir", cr.copyDir("/var/run/act", "/src", false)(ctx))
 	check("exec", cr.exec([]string{"echo"}, nil, "", "")(ctx))
 	_, err := cr.GetContainerArchive(ctx, "/var/run/act/x")
 	check("GetContainerArchive", err)
@@ -560,14 +553,11 @@ func TestCheckVolumes(t *testing.T) {
 				"shared_volume",
 				"/home/test/data",
 				"/etc/conf.d/*.json",
-				"/opt/**",
 			},
 			binds: []string{
 				"shared_volume:/shared_volume",
 				"/home/test/data:/test_data",
 				"/etc/conf.d/base.json:/config/base.json",
-				"/etc/conf.d/sub/nested.json:/config/nested.json",
-				"/opt/app/cache:/cache",
 				"sql_data:/sql_data",
 				"/secrets/keys:/keys",
 			},
@@ -575,7 +565,6 @@ func TestCheckVolumes(t *testing.T) {
 				"shared_volume:/shared_volume",
 				"/home/test/data:/test_data",
 				"/etc/conf.d/base.json:/config/base.json",
-				"/opt/app/cache:/cache",
 			},
 		},
 	}
@@ -682,7 +671,6 @@ func mergeOptions(t *testing.T, runnerOptions, workflowOptions string, privilege
 		WorkflowOptions: workflowOptions,
 		NetworkMode:     "bridge",
 		UsernsMode:      "private",
-		ValidVolumes:    []string{"**"},
 	}}
 
 	_, hostConfig, err := cr.mergeContainerConfigs(common.WithLogger(context.Background(), logger), &container.Config{}, &container.HostConfig{
@@ -813,31 +801,6 @@ func TestContainerInfoFromInspect(t *testing.T) {
 		assert.Equal(t, "abc123", info.ID)
 		assert.Equal(t, HealthNone, info.Health)
 	})
-
-	t.Run("reports the mount sources by container path", func(t *testing.T) {
-		info := containerInfoFromInspect(container.InspectResponse{
-			Mounts: []container.MountPoint{
-				{Type: mount.TypeVolume, Name: "job", Source: "/var/lib/docker/volumes/job/_data", Destination: "/workspace/owner/repo"},
-				{Type: mount.TypeBind, Source: "/var/run/docker.sock", Destination: "/var/run/docker.sock"},
-				{Type: mount.TypeVolume, Name: "cache", Source: "/var/lib/docker/volumes/cache/_data", Destination: "/cache"},
-				{Type: mount.TypeBind, Source: "/custom/resolv.conf", Destination: "/etc/resolv.conf"},
-			},
-			HostConfig: &container.HostConfig{
-				Tmpfs:  map[string]string{"/workspace/owner/repo//tmp/": "size=1m"},
-				Mounts: []mount.Mount{{Type: mount.TypeVolume, Source: "cache", Target: "/cache/", VolumeOptions: &mount.VolumeOptions{Subpath: "project"}}},
-			},
-		})
-
-		assert.Equal(t, map[string]string{
-			"/workspace/owner/repo":     "/var/lib/docker/volumes/job/_data",
-			"/workspace/owner/repo/tmp": "",
-			"/var/run/docker.sock":      "/var/run/docker.sock",
-			"/cache":                    "/var/lib/docker/volumes/cache/_data/project",
-			"/etc/resolv.conf":          "/custom/resolv.conf",
-			"/etc/hosts":                "",
-			"/etc/hostname":             "",
-		}, info.Mounts)
-	})
 }
 
 func TestMergeContainerConfigsVolumesReplaceRunnerMounts(t *testing.T) {
@@ -845,10 +808,8 @@ func TestMergeContainerConfigsVolumesReplaceRunnerMounts(t *testing.T) {
 	ctx := common.WithLogger(context.Background(), logger)
 	cr := &containerReference{
 		input: &NewContainerInput{
-			NetworkMode:     "bridge",
-			RunnerOptions:   "--volume /host/tools:/opt/hostedtoolcache",
-			WorkflowOptions: "--volume /unapproved:/var/run/docker.sock",
-			ValidVolumes:    []string{"/host/tools"},
+			NetworkMode:   "bridge",
+			RunnerOptions: "--volume /host/tools:/opt/hostedtoolcache",
 		},
 	}
 
@@ -870,7 +831,6 @@ func TestMergeContainerConfigsWarnsOnlyAboutOptionsThatWereGiven(t *testing.T) {
 	assert.Zero(t, warnings("--volume /host/tools:/opt/hostedtoolcache", ""))
 	assert.Zero(t, warnings("", "--shm-size 1g"))
 	assert.Equal(t, 1, warnings("--network host", ""))
-	assert.Equal(t, 1, warnings("", "--privileged"))
 }
 
 func TestMergeContainerConfigsKeepsNetworkAliasesFromOptions(t *testing.T) {

act/container/docker_stub.go

@@ -9,7 +9,6 @@ package container
 import (
 	"context"
 	"errors"
-	"net/netip"
 	"runtime"
 	"time"
 
@@ -18,10 +17,6 @@ import (
 	"github.com/moby/moby/api/types/system"
 )
 
-func IsolatedCacheContainer(context.Context, netip.Addr, string) (string, error) {
-	return "", nil
-}
-
 // ImageExistsLocally returns a boolean indicating if an image with the
 // requested name, tag and architecture exists in the local docker image store
 func ImageExistsLocally(ctx context.Context, imageName, platform string) (bool, error) {
@@ -34,18 +29,6 @@ func RemoveImage(ctx context.Context, imageName string, force, pruneChildren boo
 	return false, errors.New("Unsupported Operation")
 }
 
-func RemoveDockerJobResources(_ context.Context, _ string) error {
-	return nil
-}
-
-func NewDockerProxy(_ context.Context, _ string) *DockerProxy {
-	return nil
-}
-
-func StartDockerProxy(daemonSocket, dir, job string) (*DockerProxy, error) {
-	return nil, errors.New("Unsupported Operation")
-}
-
 // NewDockerBuildExecutor function to create a run executor for the container
 func NewDockerBuildExecutor(input NewDockerBuildExecutorInput) common.Executor {
 	return func(ctx context.Context) error {
@@ -91,30 +74,6 @@ func NewDockerNetworkRemoveExecutor(name string) common.Executor {
 	}
 }
 
-func NewDockerNetworkConnectExecutor(_, _ string) common.Executor {
-	return func(_ context.Context) error {
-		return nil
-	}
-}
-
-func NewDockerNetworkDisconnectExecutor(_, _ string) common.Executor {
-	return func(_ context.Context) error {
-		return nil
-	}
-}
-
-func RemoveOrphanNetworks(_ context.Context, _, _ string, _ time.Time) error {
-	return nil
-}
-
-func SanitizeBinds(_ context.Context, _, binds []string) []string {
-	return binds
-}
-
-func CreateJobVolumes(ctx context.Context, runnerUUID string, volumeNames []string) error {
-	return nil
-}
-
-func RemoveOrphanJobVolumes(ctx context.Context, runnerUUID string, createdBefore time.Time) error {
+func RemoveOrphanNetworks(ctx context.Context, runnerUUID string, createdBefore time.Time) error {
 	return nil
 }

act/container/docker_volume.go

@@ -8,67 +8,40 @@ package container
 
 import (
 	"context"
-	"errors"
-	"fmt"
-	"time"
 
 	"gitea.com/gitea/runner/act/common"
 
-	cerrdefs "github.com/containerd/errdefs"
 	"github.com/moby/moby/client"
 )
 
-func CreateJobVolumes(ctx context.Context, runnerUUID string, volumeNames []string) error {
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		return err
-	}
-	defer cli.Close()
-
-	for _, volumeName := range volumeNames {
-		if _, err := cli.VolumeCreate(ctx, client.VolumeCreateOptions{
-			Name:   volumeName,
-			Labels: runnerLabels(runnerUUID),
-		}); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func RemoveOrphanJobVolumes(ctx context.Context, runnerUUID string, createdBefore time.Time) error {
-	cli, err := GetDockerClient(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to connect to the docker daemon: %w", err)
-	}
-	defer cli.Close()
-
-	volumes, err := cli.VolumeList(ctx, client.VolumeListOptions{
-		Filters: make(client.Filters).Add("label", runnerUUIDLabel+"="+runnerUUID).Add("dangling", "true"),
-	})
-	if err != nil {
-		return err
-	}
-
-	var errs []error
-	for _, item := range volumes.Items {
-		created, err := time.Parse(time.RFC3339, item.CreatedAt)
-		// an unreadable or recent timestamp may belong to a job that is still starting up
-		if err != nil || created.After(createdBefore) || item.Labels[runnerUUIDLabel] != runnerUUID {
-			continue
-		}
-		if _, err := cli.VolumeRemove(ctx, item.Name, client.VolumeRemoveOptions{}); err != nil && !cerrdefs.IsNotFound(err) {
-			errs = append(errs, fmt.Errorf("failed to remove volume %s: %w", item.Name, err))
-			continue
-		}
-		common.Logger(ctx).Infof("removed docker volume %s left behind by an earlier job", item.Name)
-	}
-	return errors.Join(errs...)
-}
-
 func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executor {
 	return func(ctx context.Context) error {
-		common.Logger(ctx).Debugf("docker volume rm %s", volumeName)
+		cli, err := GetDockerClient(ctx)
+		if err != nil {
+			return err
+		}
+		defer cli.Close()
+
+		list, err := cli.VolumeList(ctx, client.VolumeListOptions{})
+		if err != nil {
+			return err
+		}
+
+		for _, vol := range list.Items {
+			if vol.Name == volumeName {
+				return removeExecutor(volumeName, force)(ctx)
+			}
+		}
+
+		// Volume not found - do nothing
+		return nil
+	}
+}
+
+func removeExecutor(volume string, force bool) common.Executor {
+	return func(ctx context.Context) error {
+		logger := common.Logger(ctx)
+		logger.Debugf("docker volume rm %s", volume)
 
 		if common.Dryrun(ctx) {
 			return nil
@@ -80,10 +53,7 @@ func NewDockerVolumeRemoveExecutor(volumeName string, force bool) common.Executo
 		}
 		defer cli.Close()
 
-		_, err = cli.VolumeRemove(ctx, volumeName, client.VolumeRemoveOptions{Force: force})
-		if cerrdefs.IsNotFound(err) { // already gone is the outcome we wanted
-			return nil
-		}
+		_, err = cli.VolumeRemove(ctx, volume, client.VolumeRemoveOptions{Force: force})
 		return err
 	}
 }

act/container/host_environment.go

@@ -92,7 +92,7 @@ func (e *HostEnvironment) Copy(destPath string, files ...*FileEntry) common.Exec
 	}
 }
 
-func (e *HostEnvironment) CopyDir(destPath, srcPath string, useGitIgnore, skipGitDir bool) common.Executor {
+func (e *HostEnvironment) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		srcPrefix := filepath.Dir(srcPath)
@@ -110,10 +110,9 @@ func (e *HostEnvironment) CopyDir(destPath, srcPath string, useGitIgnore, skipGi
 			ignorer = gitignore.NewMatcher(ps)
 		}
 		fc := &filecollector.FileCollector{
-			Ignorer:    ignorer,
-			SrcPath:    srcPath,
-			SrcPrefix:  srcPrefix,
-			SkipGitDir: skipGitDir,
+			Ignorer:   ignorer,
+			SrcPath:   srcPath,
+			SrcPrefix: srcPrefix,
 			Handler: &filecollector.CopyCollector{
 				DstDir: destPath,
 			},

act/container/host_environment_test.go

@@ -47,32 +47,10 @@ func TestCopyDir(t *testing.T) {
 	_ = os.MkdirAll(e.TmpDir, 0o700)
 	_ = os.MkdirAll(e.ToolCache, 0o700)
 	_ = os.MkdirAll(e.ActPath, 0o700)
-	err := e.CopyDir(e.Workdir, e.Path, true, false)(ctx)
+	err := e.CopyDir(e.Workdir, e.Path, true)(ctx)
 	assert.NoError(t, err)
 }
 
-func TestCopyDirSkipGitDir(t *testing.T) {
-	for name, skipGitDir := range map[string]bool{"kept for a workspace copy": false, "skipped for an action copy": true} {
-		t.Run(name, func(t *testing.T) {
-			src := filepath.Join(t.TempDir(), "action")
-			require.NoError(t, os.MkdirAll(filepath.Join(src, ".git", "objects"), 0o700))
-			require.NoError(t, os.WriteFile(filepath.Join(src, ".git", "objects", "pack"), []byte("x"), 0o600))
-			require.NoError(t, os.WriteFile(filepath.Join(src, "action.yml"), []byte("name: x\n"), 0o600))
-
-			dest := filepath.Join(t.TempDir(), "dest")
-			e := &HostEnvironment{StdOut: os.Stdout}
-			require.NoError(t, e.CopyDir(dest, src+string(filepath.Separator), false, skipGitDir)(context.Background()))
-
-			assert.FileExists(t, filepath.Join(dest, "action.yml"))
-			if skipGitDir {
-				assert.NoDirExists(t, filepath.Join(dest, ".git"))
-			} else {
-				assert.FileExists(t, filepath.Join(dest, ".git", "objects", "pack"))
-			}
-		})
-	}
-}
-
 func TestGetContainerArchive(t *testing.T) {
 	dir := t.TempDir()
 	ctx := context.Background()

act/container/macos_vm_cleanup.go

@@ -0,0 +1,73 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+type macOSVM struct {
+	Name       string `json:"name"`
+	State      string `json:"state"`
+	Running    bool   `json:"running"`
+	AccessedAt string `json:"accessed_at"`
+}
+
+// CleanupOrphanMacOSVMs deletes local macOS VMs left behind by this runner that
+// have not been accessed since cutoff.
+func CleanupOrphanMacOSVMs(ctx context.Context, executorPath, uuid string, cutoff time.Time) error {
+	if uuid == "" {
+		return nil
+	}
+
+	output, err := exec.CommandContext(ctx, executorPath, "list", "--format", "json").Output()
+	if err != nil {
+		return fmt.Errorf("list macOS VMs: %w", err)
+	}
+
+	var vms []macOSVM
+	if err := json.Unmarshal(output, &vms); err != nil {
+		return fmt.Errorf("parse macOS VM list: %w", err)
+	}
+
+	var errs []error
+	for _, name := range macOSVMsToDelete(vms, uuid, cutoff) {
+		if err := exec.CommandContext(ctx, executorPath, "destroy", name).Run(); err != nil {
+			errs = append(errs, fmt.Errorf("destroy macOS VM %s: %w", name, err))
+		}
+	}
+	return errors.Join(errs...)
+}
+
+func macOSVMsToDelete(vms []macOSVM, uuid string, cutoff time.Time) []string {
+	prefix := "GITEA-MACOS-VM-" + uuid + "-"
+	var stale []string
+	for _, vm := range vms {
+		if vm.Running || !strings.HasPrefix(vm.Name, prefix) {
+			continue
+		}
+		accessed, err := parseMacOSVMTime(vm.AccessedAt)
+		if err != nil || accessed.After(cutoff) {
+			continue
+		}
+		stale = append(stale, vm.Name)
+	}
+	return stale
+}
+
+func parseMacOSVMTime(raw string) (time.Time, error) {
+	if raw == "" {
+		return time.Time{}, errors.New("empty access time")
+	}
+	if parsed, err := time.Parse(time.RFC3339Nano, raw); err == nil {
+		return parsed, nil
+	}
+	return time.Parse(time.RFC3339, raw)
+}

act/container/macos_vm_cleanup_test.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMacOSVMsToDelete(t *testing.T) {
+	cutoff := time.Date(2026, 9, 5, 10, 0, 0, 0, time.UTC)
+	vms := []macOSVM{
+		{Name: "GITEA-MACOS-VM-runner-1-stale", AccessedAt: "2026-09-04T10:00:00Z"},
+		{Name: "GITEA-MACOS-VM-runner-1-running", AccessedAt: "2026-09-04T10:00:00Z", Running: true},
+		{Name: "GITEA-MACOS-VM-runner-1-fresh", AccessedAt: "2026-09-05T11:00:00Z"},
+		{Name: "GITEA-MACOS-VM-runner-2-stale", AccessedAt: "2026-09-04T10:00:00Z"},
+	}
+
+	assert.Equal(t, []string{"GITEA-MACOS-VM-runner-1-stale"}, macOSVMsToDelete(vms, "runner-1", cutoff))
+}
+
+func TestParseMacOSVMTime(t *testing.T) {
+	parsed, err := parseMacOSVMTime("2026-09-05T10:00:00Z")
+	require.NoError(t, err)
+	assert.Equal(t, time.Date(2026, 9, 5, 10, 0, 0, 0, time.UTC), parsed)
+
+	parsed, err = parseMacOSVMTime("2026-09-05T10:00:00.123456789Z")
+	require.NoError(t, err)
+	assert.Equal(t, time.Date(2026, 9, 5, 10, 0, 0, 123456789, time.UTC), parsed)
+
+	_, err = parseMacOSVMTime("")
+	require.Error(t, err)
+}

act/container/macos_vm_environment.go

@@ -0,0 +1,450 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"archive/tar"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"gitea.com/gitea/runner/act/common"
+	"gitea.com/gitea/runner/act/filecollector"
+
+	"github.com/go-git/go-billy/v5/helper/polyfill"
+	"github.com/go-git/go-billy/v5/osfs"
+	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
+)
+
+const (
+	defaultMacOSVMBootTimeout = 5 * time.Minute
+	macOSVMReadyPollInterval  = 500 * time.Millisecond
+	macOSVMStopWaitTimeout    = 10 * time.Second
+)
+
+// MacOSVMEnvironment runs workflow steps in an ephemeral macOS VM.
+type MacOSVMEnvironment struct {
+	Path         string // guest scratch directory
+	TmpDir       string // guest temp directory
+	ToolCache    string // guest tool cache directory
+	Workdir      string // host-side workspace path
+	GuestWorkdir string // guest-side workspace path
+	ActPath      string // guest act directory
+
+	Image        string
+	VMName       string
+	ExecutorPath string
+	CPU          int
+	Memory       int
+	BootTimeout  time.Duration
+
+	Stdout io.Writer
+	Stderr io.Writer
+
+	executorPath string
+	running      bool
+	runCmd       *exec.Cmd
+	runDone      chan struct{}
+	runErr       error
+}
+
+// MacOSVMEnvironmentInput is the input for NewMacOSVMEnvironment.
+type MacOSVMEnvironmentInput struct {
+	Path         string
+	TmpDir       string
+	ToolCache    string
+	Workdir      string
+	GuestWorkdir string
+	ActPath      string
+	Image        string
+	VMName       string
+	ExecutorPath string
+	CPU          int
+	Memory       int
+	BootTimeout  time.Duration
+	Stdout       io.Writer
+	Stderr       io.Writer
+}
+
+func NewMacOSVMEnvironment(input MacOSVMEnvironmentInput) (*MacOSVMEnvironment, error) {
+	if input.Image == "" {
+		return nil, errors.New("macOS VM image is required")
+	}
+	if input.VMName == "" {
+		return nil, errors.New("macOS VM name is required")
+	}
+	if input.BootTimeout <= 0 {
+		input.BootTimeout = defaultMacOSVMBootTimeout
+	}
+	if input.ExecutorPath == "" {
+		input.ExecutorPath = "runner-executor-macos"
+	}
+	return &MacOSVMEnvironment{
+		Path:         input.Path,
+		TmpDir:       input.TmpDir,
+		ToolCache:    input.ToolCache,
+		Workdir:      input.Workdir,
+		GuestWorkdir: input.GuestWorkdir,
+		ActPath:      input.ActPath,
+		Image:        input.Image,
+		VMName:       input.VMName,
+		ExecutorPath: input.ExecutorPath,
+		CPU:          input.CPU,
+		Memory:       input.Memory,
+		BootTimeout:  input.BootTimeout,
+		Stdout:       input.Stdout,
+		Stderr:       input.Stderr,
+		executorPath: input.ExecutorPath,
+	}, nil
+}
+
+var _ ExecutionsEnvironment = &MacOSVMEnvironment{}
+
+func (e *MacOSVMEnvironment) Create(_, _ []string) common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		// A previous run can leave the deterministic job VM behind. Destroy it first.
+		_ = e.runExecutor(ctx, nil, io.Discard, io.Discard, "destroy", e.VMName)
+
+		args := []string{"provision", e.Image, e.VMName}
+		if e.CPU > 0 {
+			args = append(args, "--cpu", strconv.Itoa(e.CPU))
+		}
+		if e.Memory > 0 {
+			args = append(args, "--memory", strconv.Itoa(e.Memory))
+		}
+		return e.runExecutor(ctx, nil, e.Stdout, e.Stderr, args...)
+	}
+}
+
+func (e *MacOSVMEnvironment) Copy(destPath string, files ...*FileEntry) common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		for _, file := range files {
+			dest := path.Join(destPath, file.Name)
+			script := `mkdir -p "$1" && cat > "$2" && chmod "$3" "$2"`
+			mode := file.Mode
+			if mode == 0 {
+				mode = 0o644
+			}
+			args := []string{"exec", "--stdin", e.VMName, "/bin/sh", "-c", script, "sh", path.Dir(dest), dest, strconv.FormatInt(mode, 8)}
+			if err := e.runExecutor(ctx, strings.NewReader(file.Body), e.Stdout, e.Stderr, args...); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+func (e *MacOSVMEnvironment) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		pipeReader, pipeWriter := io.Pipe()
+		writeDone := make(chan error, 1)
+		go func() {
+			err := e.writeTar(ctx, pipeWriter, srcPath, useGitIgnore)
+			_ = pipeWriter.CloseWithError(err)
+			writeDone <- err
+		}()
+
+		script := `export COPYFILE_DISABLE=1; mkdir -p "$1" && /usr/bin/tar -xf - -C "$1"`
+		cmdErr := e.runExecutor(ctx, pipeReader, e.Stdout, e.Stderr, "exec", "--stdin", e.VMName, "/bin/sh", "-c", script, "sh", destPath)
+		_ = pipeReader.Close()
+		writeErr := <-writeDone
+		return errors.Join(cmdErr, writeErr)
+	}
+}
+
+func (e *MacOSVMEnvironment) writeTar(ctx context.Context, writer io.Writer, srcPath string, useGitIgnore bool) error {
+	tarWriter := tar.NewWriter(writer)
+	defer tarWriter.Close()
+
+	srcPrefix := filepath.Dir(srcPath)
+	if !strings.HasSuffix(srcPrefix, string(filepath.Separator)) {
+		srcPrefix += string(filepath.Separator)
+	}
+
+	var ignorer gitignore.Matcher
+	if useGitIgnore {
+		patterns, err := gitignore.ReadPatterns(polyfill.New(osfs.New(srcPath)), nil)
+		if err != nil {
+			common.Logger(ctx).Debugf("Error loading .gitignore: %v", err)
+		}
+		ignorer = gitignore.NewMatcher(patterns)
+	}
+
+	collector := &filecollector.FileCollector{
+		Ignorer:   ignorer,
+		SrcPath:   srcPath,
+		SrcPrefix: srcPrefix,
+		Handler:   &filecollector.TarCollector{TarWriter: tarWriter},
+	}
+	return filepath.Walk(srcPath, collector.CollectFiles(ctx, []string{}))
+}
+
+func (e *MacOSVMEnvironment) GetContainerArchive(ctx context.Context, srcPath string) (io.ReadCloser, error) {
+	if common.Dryrun(ctx) {
+		return nil, errors.New("DRYRUN is not supported in GetContainerArchive")
+	}
+	cmd := exec.CommandContext(ctx, e.executorPath, "exec", e.VMName, "/usr/bin/env", "COPYFILE_DISABLE=1", "/usr/bin/tar", "-cf", "-", "-C", "/", strings.TrimPrefix(srcPath, "/"))
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	cmd.Stderr = e.Stderr
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	return &macOSVMArchiveReader{ReadCloser: stdout, cmd: cmd}, nil
+}
+
+type macOSVMArchiveReader struct {
+	io.ReadCloser
+	cmd *exec.Cmd
+}
+
+func (r *macOSVMArchiveReader) Close() error {
+	closeErr := r.ReadCloser.Close()
+	return errors.Join(closeErr, r.cmd.Wait())
+}
+
+func (e *MacOSVMEnvironment) Inspect(ctx context.Context) (*Info, error) {
+	if common.Dryrun(ctx) {
+		return &Info{Health: HealthNone, Ports: map[string]string{}}, nil
+	}
+	state := "exited"
+	if e.running {
+		state = StateRunning
+	}
+	return &Info{ID: e.VMName, State: state, Health: HealthNone, Ports: map[string]string{}}, nil
+}
+
+func (e *MacOSVMEnvironment) DumpLogs(context.Context) error {
+	return nil
+}
+
+func (e *MacOSVMEnvironment) Pull(forcePull bool) common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		return nil
+	}
+}
+
+func (e *MacOSVMEnvironment) Start(bool) common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		cmd := exec.Command(e.executorPath, "start", "--no-graphics", e.VMName)
+		cmd.Stdout = e.Stdout
+		cmd.Stderr = e.Stderr
+		if err := cmd.Start(); err != nil {
+			return err
+		}
+		e.runCmd = cmd
+		e.runDone = make(chan struct{})
+		go func() {
+			e.runErr = cmd.Wait()
+			close(e.runDone)
+		}()
+		e.running = true
+		return e.waitReady(ctx)
+	}
+}
+
+func (e *MacOSVMEnvironment) waitReady(ctx context.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, e.BootTimeout)
+	defer cancel()
+
+	var lastErr error
+	for {
+		if err := e.runExecutor(ctx, nil, io.Discard, io.Discard, "exec", e.VMName, "/usr/bin/true"); err == nil {
+			return nil
+		} else {
+			lastErr = err
+		}
+
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("macOS VM %s did not become ready: %w", e.VMName, lastErr)
+		case <-e.runDone:
+			if e.runErr != nil {
+				return fmt.Errorf("macOS VM start exited before the VM became ready: %w", e.runErr)
+			}
+			return errors.New("macOS VM start exited before the VM became ready")
+		case <-time.After(macOSVMReadyPollInterval):
+		}
+	}
+}
+
+func (e *MacOSVMEnvironment) Exec(command []string, env map[string]string, _, workdir string) common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		err := e.runExecutor(ctx, nil, e.Stdout, e.Stderr, macOSVMExecArgs(e.VMName, command, env, e.resolveWorkdir(workdir))...)
+		if exitErr, ok := errors.AsType[*exec.ExitError](err); ok {
+			return ExitCodeError(exitErr.ExitCode())
+		}
+		return err
+	}
+}
+
+func macOSVMExecArgs(vmName string, command []string, env map[string]string, workdir string) []string {
+	args := []string{"exec", vmName, "/usr/bin/env"}
+	for _, key := range slices.Sorted(maps.Keys(env)) {
+		args = append(args, key+"="+env[key])
+	}
+	args = append(args, "/bin/sh", "-c", `cd "$1" && shift && exec "$@"`, "sh", workdir)
+	return append(args, command...)
+}
+
+func (e *MacOSVMEnvironment) resolveWorkdir(workdir string) string {
+	switch {
+	case workdir == "":
+		return e.GuestWorkdir
+	case strings.HasPrefix(workdir, "/"):
+		return workdir
+	default:
+		return path.Join(e.GuestWorkdir, workdir)
+	}
+}
+
+func (e *MacOSVMEnvironment) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
+	return parseEnvFile(e, srcPath, env)
+}
+
+func (e *MacOSVMEnvironment) UpdateFromImageEnv(*map[string]string) common.Executor {
+	return func(context.Context) error {
+		return nil
+	}
+}
+
+func (e *MacOSVMEnvironment) Remove() common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		cleanCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), time.Minute)
+		defer cancel()
+
+		if e.runCmd != nil && e.runDone != nil {
+			select {
+			case <-e.runDone:
+			default:
+				if err := e.runExecutor(cleanCtx, nil, e.Stdout, e.Stderr, "stop", e.VMName, "--timeout", "20"); err != nil {
+					common.Logger(ctx).Debugf("macOS VM stop failed for VM %s: %v", e.VMName, err)
+				}
+				select {
+				case <-e.runDone:
+				case <-time.After(macOSVMStopWaitTimeout):
+					if e.runCmd.Process != nil {
+						_ = e.runCmd.Process.Kill()
+					}
+					common.Logger(ctx).Warnf("timed out waiting for macOS VM start to exit for VM %s", e.VMName)
+				}
+			}
+		}
+		e.running = false
+		if err := e.runExecutor(cleanCtx, nil, e.Stdout, e.Stderr, "destroy", e.VMName); err != nil {
+			common.Logger(ctx).Warnf("failed to destroy macOS VM %s: %v", e.VMName, err)
+		}
+		return nil
+	}
+}
+
+func (e *MacOSVMEnvironment) Close() common.Executor {
+	return func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+		if e.runCmd != nil && e.runCmd.Process != nil {
+			_ = e.runCmd.Process.Kill()
+		}
+		e.runCmd = nil
+		return nil
+	}
+}
+
+func (e *MacOSVMEnvironment) ReplaceLogWriter(stdout, stderr io.Writer) (io.Writer, io.Writer) {
+	oldOut := e.Stdout
+	oldErr := e.Stderr
+	e.Stdout = stdout
+	e.Stderr = stderr
+	return oldOut, oldErr
+}
+
+func (e *MacOSVMEnvironment) ToContainerPath(hostPath string) string {
+	if filepath.Clean(hostPath) == filepath.Clean(e.Workdir) {
+		return e.GuestWorkdir
+	}
+	if rel, err := filepath.Rel(e.Workdir, hostPath); err == nil && rel != "." && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return path.Join(e.GuestWorkdir, filepath.ToSlash(rel))
+	}
+	return filepath.ToSlash(hostPath)
+}
+
+func (e *MacOSVMEnvironment) GetActPath() string {
+	return e.ActPath
+}
+
+func (*MacOSVMEnvironment) GetPathVariableName() string {
+	return "PATH"
+}
+
+func (*MacOSVMEnvironment) DefaultPathVariable() string {
+	return "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+}
+
+func (*MacOSVMEnvironment) JoinPathVariable(paths ...string) string {
+	return strings.Join(paths, ":")
+}
+
+func (e *MacOSVMEnvironment) GetRunnerContext(context.Context) map[string]any {
+	return map[string]any{
+		"os":         "macOS",
+		"arch":       goArchToActionArch(runtime.GOARCH),
+		"temp":       e.TmpDir,
+		"tool_cache": e.ToolCache,
+	}
+}
+
+func (*MacOSVMEnvironment) IsEnvironmentCaseInsensitive() bool {
+	return false
+}
+
+func (e *MacOSVMEnvironment) runExecutor(ctx context.Context, stdin io.Reader, stdout, stderr io.Writer, args ...string) error {
+	if stdout == nil {
+		stdout = e.Stdout
+	}
+	if stderr == nil {
+		stderr = e.Stderr
+	}
+	cmd := exec.CommandContext(ctx, e.executorPath, args...)
+	cmd.Stdin = stdin
+	cmd.Stdout = stdout
+	cmd.Stderr = stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("macOS VM executor %s: %w", args[0], err)
+	}
+	return nil
+}

act/container/macos_vm_environment_integration_test.go

@@ -0,0 +1,97 @@
+//go:build macos_vm_integration
+
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMacOSVMEnvironmentIntegration(t *testing.T) {
+	if runtime.GOOS != "darwin" {
+		t.Skip("macOS VMs run on macOS")
+	}
+	if _, err := exec.LookPath("runner-executor-macos"); err != nil {
+		t.Skip("runner-executor-macos executable not found")
+	}
+	image := os.Getenv("MACOS_VM_TEST_IMAGE")
+	if image == "" {
+		t.Skip("set MACOS_VM_TEST_IMAGE to a macOS VM image to run this test")
+	}
+
+	ctx := context.Background()
+	vmName := fmt.Sprintf("gitea-runner-test-%d", time.Now().UnixNano())
+	base := "/Users/admin/runner"
+	if os.Getenv("RUNNER_EXECUTOR_MACOS_DEV_MODE") == "1" {
+		base = t.TempDir()
+	}
+	env, err := NewMacOSVMEnvironment(MacOSVMEnvironmentInput{
+		Path:         base + "/scratch/" + vmName,
+		TmpDir:       base + "/scratch/" + vmName + "/tmp",
+		ToolCache:    base + "/scratch/" + vmName + "/tool_cache",
+		Workdir:      t.TempDir(),
+		GuestWorkdir: base + "/workspace/" + vmName,
+		ActPath:      base + "/scratch/" + vmName + "/act",
+		Image:        image,
+		VMName:       vmName,
+		ExecutorPath: "runner-executor-macos",
+		BootTimeout:  10 * time.Minute,
+		Stdout:       io.Discard,
+		Stderr:       io.Discard,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = env.Remove()(context.Background())
+	})
+
+	require.NoError(t, env.Create(nil, nil)(ctx))
+	require.NoError(t, env.Start(false)(ctx))
+	if os.Getenv("RUNNER_EXECUTOR_MACOS_DEV_MODE") == "1" {
+		require.NoError(t, os.MkdirAll(env.GuestWorkdir, 0o755))
+	}
+	require.NoError(t, env.Exec([]string{"/bin/mkdir", "-p", env.GuestWorkdir}, nil, "", "/")(ctx))
+
+	require.NoError(t, env.Copy("/tmp", &FileEntry{
+		Name: "gitea-runner-macos.txt",
+		Mode: 0o644,
+		Body: "hello from macos-vm",
+	})(ctx))
+
+	archive, err := env.GetContainerArchive(ctx, "/tmp/gitea-runner-macos.txt")
+	require.NoError(t, err)
+	body := readFirstTarFile(t, archive)
+	require.NoError(t, archive.Close())
+	require.Equal(t, "hello from macos-vm", body)
+
+	var output bytes.Buffer
+	oldOut, oldErr := env.ReplaceLogWriter(&output, &output)
+	defer env.ReplaceLogWriter(oldOut, oldErr)
+	require.NoError(t, env.Exec([]string{"/usr/bin/uname", "-s"}, nil, "", "")(ctx))
+	require.Contains(t, output.String(), "Darwin")
+
+	require.NoError(t, env.Remove()(ctx))
+}
+
+func readFirstTarFile(t *testing.T, archive io.Reader) string {
+	t.Helper()
+	reader := tar.NewReader(archive)
+	header, err := reader.Next()
+	require.NoError(t, err)
+	require.Contains(t, header.Name, "gitea-runner-macos.txt")
+	body, err := io.ReadAll(reader)
+	require.NoError(t, err)
+	return string(body)
+}

act/container/macos_vm_environment_test.go

@@ -0,0 +1,91 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package container
+
+import (
+	"context"
+	"io"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewMacOSVMEnvironment(t *testing.T) {
+	env, err := NewMacOSVMEnvironment(MacOSVMEnvironmentInput{
+		Image:  "ghcr.io/cirruslabs/macos-sonoma-base:latest",
+		VMName: "job-vm",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "ghcr.io/cirruslabs/macos-sonoma-base:latest", env.Image)
+	assert.Equal(t, "job-vm", env.VMName)
+	assert.Equal(t, defaultMacOSVMBootTimeout, env.BootTimeout)
+	assert.Equal(t, "runner-executor-macos", env.executorPath)
+
+	_, err = NewMacOSVMEnvironment(MacOSVMEnvironmentInput{VMName: "job-vm"})
+	require.Error(t, err)
+	_, err = NewMacOSVMEnvironment(MacOSVMEnvironmentInput{Image: "macos"})
+	require.Error(t, err)
+}
+
+func TestMacOSVMExecArgs(t *testing.T) {
+	args := macOSVMExecArgs("vm", []string{"bash", "-c", "echo hi"}, map[string]string{"B": "two", "A": "one"}, "/Users/admin/work")
+	assert.Equal(t, []string{
+		"exec", "vm", "/usr/bin/env",
+		"A=one", "B=two",
+		"/bin/sh", "-c", `cd "$1" && shift && exec "$@"`, "sh", "/Users/admin/work",
+		"bash", "-c", "echo hi",
+	}, args)
+
+	args = macOSVMExecArgs("vm", []string{"true"}, nil, "")
+	assert.Equal(t, []string{
+		"exec", "vm", "/usr/bin/env",
+		"/bin/sh", "-c", `cd "$1" && shift && exec "$@"`, "sh", "",
+		"true",
+	}, args)
+}
+
+func TestMacOSVMEnvironmentResolveWorkdir(t *testing.T) {
+	env := &MacOSVMEnvironment{GuestWorkdir: "/Users/admin/work"}
+	assert.Equal(t, "/Users/admin/work", env.resolveWorkdir(""))
+	assert.Equal(t, "/Users/admin/work/sub", env.resolveWorkdir("sub"))
+	assert.Equal(t, "/tmp", env.resolveWorkdir("/tmp"))
+}
+
+func TestMacOSVMEnvironmentToContainerPath(t *testing.T) {
+	env := &MacOSVMEnvironment{Workdir: "/workspace/owner/repo", GuestWorkdir: "/Users/admin/work/owner/repo"}
+	assert.Equal(t, "/Users/admin/work/owner/repo", env.ToContainerPath("/workspace/owner/repo"))
+	assert.Equal(t, "/Users/admin/work/owner/repo/sub", env.ToContainerPath("/workspace/owner/repo/sub"))
+	assert.Equal(t, "/elsewhere", env.ToContainerPath("/elsewhere"))
+}
+
+func TestMacOSVMEnvironmentGetRunnerContext(t *testing.T) {
+	env := &MacOSVMEnvironment{
+		TmpDir:    "/Users/admin/scratch/tmp",
+		ToolCache: "/Users/admin/scratch/tool_cache",
+	}
+	ctx := env.GetRunnerContext(context.Background())
+	assert.Equal(t, "macOS", ctx["os"])
+	assert.Equal(t, goArchToActionArch(runtime.GOARCH), ctx["arch"])
+	assert.Equal(t, "/Users/admin/scratch/tmp", ctx["temp"])
+	assert.Equal(t, "/Users/admin/scratch/tool_cache", ctx["tool_cache"])
+}
+
+func TestMacOSVMEnvironmentReplaceLogWriter(t *testing.T) {
+	oldOut := io.Discard
+	oldErr := io.Discard
+	env := &MacOSVMEnvironment{Stdout: oldOut, Stderr: oldErr}
+	newOut, newErr := env.ReplaceLogWriter(io.Discard, io.Discard)
+	assert.Equal(t, oldOut, newOut)
+	assert.Equal(t, oldErr, newErr)
+}
+
+func TestMacOSVMEnvironmentDefaultPathVariable(t *testing.T) {
+	env := &MacOSVMEnvironment{}
+	assert.Equal(t, "PATH", env.GetPathVariableName())
+	assert.Equal(t, "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin", env.DefaultPathVariable())
+	assert.Equal(t, "/a:/b", env.JoinPathVariable("/a", "/b"))
+	assert.False(t, env.IsEnvironmentCaseInsensitive())
+}

act/filecollector/file_collector.go

@@ -94,11 +94,10 @@ func (cc *CopyCollector) WriteFile(fpath string, fi fs.FileInfo, linkName string
 }
 
 type FileCollector struct {
-	Ignorer    gitignore.Matcher
-	SrcPath    string
-	SrcPrefix  string
-	SkipGitDir bool
-	Handler    Handler
+	Ignorer   gitignore.Matcher
+	SrcPath   string
+	SrcPrefix string
+	Handler   Handler
 }
 
 func openGitIndex(path string) (*index.Index, error) {
@@ -125,12 +124,6 @@ func (fc *FileCollector) CollectFiles(ctx context.Context, submodulePath []strin
 		if fi.IsDir() && len(split) > 0 && split[len(split)-1] == "." {
 			return nil
 		}
-		if fc.SkipGitDir && split[len(split)-1] == ".git" {
-			if fi.IsDir() {
-				return filepath.SkipDir
-			}
-			return nil
-		}
 		var entry *index.Entry
 		if i != nil {
 			entry, err = i.Entry(strings.Join(split[len(submodulePath):], "/"))

act/ghcontext/github_context.go

@@ -12,7 +12,6 @@ import (
 	"context"
 	"fmt"
 	"strings"
-	"sync"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/common/git"
@@ -26,26 +25,6 @@ var (
 	findGithubRepo  = git.FindGithubRepo
 )
 
-type pinnedKey struct{}
-
-// WithPinnedCheckout keeps a run's sha and ref fixed when HEAD moves.
-func WithPinnedCheckout(ctx context.Context) context.Context {
-	if ctx.Value(pinnedKey{}) != nil {
-		return ctx
-	}
-	return context.WithValue(ctx, pinnedKey{}, &sync.Map{})
-}
-
-func pinned(ctx context.Context, key string, lookup func() (string, error)) (string, error) {
-	cache, ok := ctx.Value(pinnedKey{}).(*sync.Map)
-	if !ok {
-		return lookup()
-	}
-	cached, _ := cache.LoadOrStore(key, sync.OnceValues(lookup))
-	lookupOnce, _ := cached.(func() (string, error))
-	return lookupOnce()
-}
-
 // SetRef resolves the ref of the context from its event payload, falling back
 // to the ref checked out in repoPath.
 func SetRef(ctx context.Context, ghc *model.GithubContext, repoPath string) {
@@ -72,7 +51,7 @@ func SetRef(ctx context.Context, ghc *model.GithubContext, repoPath string) {
 	}
 
 	if ghc.Ref == "" {
-		ref, err := pinned(ctx, "ref:"+repoPath, func() (string, error) { return findGitRef(ctx, repoPath) })
+		ref, err := findGitRef(ctx, repoPath)
 		if err != nil {
 			logger.Warningf("unable to get git ref: %v", err)
 		} else {
@@ -116,10 +95,7 @@ func SetSha(ctx context.Context, ghc *model.GithubContext, repoPath string) {
 	}
 
 	if ghc.Sha == "" {
-		sha, err := pinned(ctx, "sha:"+repoPath, func() (string, error) {
-			_, revision, err := findGitRevision(ctx, repoPath)
-			return revision, err
-		})
+		_, sha, err := findGitRevision(ctx, repoPath)
 		if err != nil {
 			logger.Warningf("unable to get git revision: %v", err)
 		} else {

act/ghcontext/github_context_test.go

@@ -214,17 +214,4 @@ func TestSetSha(t *testing.T) {
 			assert.Equal(t, table.sha, ghc.Sha)
 		})
 	}
-
-	t.Run("pinned checkout keeps the first sha and ref", func(t *testing.T) {
-		ctx := WithPinnedCheckout(context.Background())
-		for _, head := range []string{"first", "moved"} {
-			findGitRevision = func(context.Context, string) (string, string, error) { return "", head, nil }
-			findGitRef = func(context.Context, string) (string, error) { return "refs/heads/" + head, nil }
-			ghc := &model.GithubContext{Event: map[string]any{}}
-			SetSha(ctx, ghc, "/some/dir")
-			SetRef(ctx, ghc, "/some/dir")
-			assert.Equal(t, "first", ghc.Sha)
-			assert.Equal(t, "refs/heads/first", ghc.Ref)
-		}
-	})
 }

act/runner/action.go

@@ -13,7 +13,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"maps"
 	"os"
 	"path"
 	"path/filepath"
@@ -148,14 +147,14 @@ func maybeCopyToActionDir(ctx context.Context, step actionStep, actionDir, actio
 
 	if !rc.Config.NoActionPatch {
 		// A concurrent job's prepare resets this directory, so patch under the copy's lock.
-		defer patchActions(ctx, actionScriptPaths(filepath.Join(actionDir, actionPath), step.getActionModel()))()
+		patchActions(ctx, actionScriptPaths(filepath.Join(actionDir, actionPath), step.getActionModel()))
 	}
 
 	if err := removeGitIgnore(ctx, actionDir); err != nil {
 		return err
 	}
 
-	return rc.JobContainer.CopyDir(containerActionDirCopy, actionDir+"/", rc.Config.UseGitIgnore, true)(ctx)
+	return rc.JobContainer.CopyDir(containerActionDirCopy, actionDir+"/", rc.Config.UseGitIgnore)(ctx)
 }
 
 func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor {
@@ -354,7 +353,12 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 			logger.Debugf("image '%s' for architecture '%s' already exists", image, rc.Config.ContainerArchitecture)
 		}
 	}
-	cmd, err := shellquote.Split(step.getStepModel().With["args"])
+	eval := rc.NewActionInputsExpressionEvaluator(ctx, step)
+	args, err := eval.Interpolate(ctx, step.getStepModel().With["args"])
+	if err != nil {
+		return fmt.Errorf("unable to interpolate with.args: %w", err)
+	}
+	cmd, err := shellquote.Split(args)
 	if err != nil {
 		return err
 	}
@@ -371,11 +375,14 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 			}
 		}
 	}
-	entrypoint, err := dockerEntrypoint(step, stage)
+	entrypoint, err := dockerEntrypoint(ctx, step, eval, stage)
+	if err != nil {
+		return err
+	}
+	stepContainer, err := newStepContainer(ctx, step, image, cmd, entrypoint, rc.Config.ContainerOptions)
 	if err != nil {
 		return err
 	}
-	stepContainer := newStepContainer(ctx, step, image, cmd, entrypoint, rc.Config.ContainerOptions)
 	return common.NewPipelineExecutor(
 		prepImage,
 		stepContainer.Pull(forcePull),
@@ -387,7 +394,7 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 
 // dockerEntrypoint returns the entrypoint the action's image runs with for the given
 // stage. Only the main stage honours the `entrypoint` input.
-func dockerEntrypoint(step actionStep, stage stepStage) ([]string, error) {
+func dockerEntrypoint(ctx context.Context, step actionStep, eval *expressionEvaluator, stage stepStage) ([]string, error) {
 	runs := step.getActionModel().Runs
 
 	var entrypoint string
@@ -399,7 +406,11 @@ func dockerEntrypoint(step actionStep, stage stepStage) ([]string, error) {
 	default:
 		entrypoint = runs.Entrypoint
 		if entrypoint == "" {
-			if fields := strings.Fields(step.getStepModel().With["entrypoint"]); len(fields) > 0 {
+			withEntrypoint, err := eval.Interpolate(ctx, step.getStepModel().With["entrypoint"])
+			if err != nil {
+				return nil, fmt.Errorf("unable to interpolate with.entrypoint: %w", err)
+			}
+			if fields := strings.Fields(withEntrypoint); len(fields) > 0 {
 				return fields, nil
 			}
 		}
@@ -414,6 +425,7 @@ func dockerEntrypoint(step actionStep, stage stepStage) ([]string, error) {
 // evalDockerEnv returns an evaluator bound to the environment it installed.
 func evalDockerEnv(ctx context.Context, step step, action *model.Action) (*expressionEvaluator, error) {
 	rc := step.getRunContext()
+	stepModel := step.getStepModel()
 
 	var err error
 	inputs := make(map[string]string)
@@ -424,20 +436,27 @@ func evalDockerEnv(ctx context.Context, step step, action *model.Action) (*expre
 			return nil, fmt.Errorf("unable to interpolate the default of input %s: %w", k, err)
 		}
 	}
-	mergeIntoMap(step, step.getEnv(), inputs, step.getStepModel().With)
+	for k, v := range stepModel.With {
+		if inputs[k], err = eval.Interpolate(ctx, v); err != nil {
+			return nil, fmt.Errorf("unable to interpolate with.%s: %w", k, err)
+		}
+	}
+	mergeIntoMap(step, step.getEnv(), inputs)
+
+	env := make(map[string]string, len(action.Runs.Env)+len(*step.getEnv()))
+	mergeIntoMap(step, &env, action.Runs.Env, *step.getEnv())
+	*step.getEnv() = env
 
 	ee := rc.NewActionInputsExpressionEvaluator(ctx, step)
-	runsEnv := make(map[string]string, len(action.Runs.Env))
-	for k, v := range action.Runs.Env {
-		if runsEnv[k], err = ee.Interpolate(ctx, v); err != nil {
+	for k, v := range *step.getEnv() {
+		if (*step.getEnv())[k], err = ee.Interpolate(ctx, v); err != nil {
 			return nil, fmt.Errorf("unable to interpolate env %s: %w", k, err)
 		}
 	}
-	mergeIntoMap(step, step.getEnv(), runsEnv, maps.Clone(*step.getEnv()))
 	return ee, nil
 }
 
-func newStepContainer(ctx context.Context, step step, image string, cmd, entrypoint []string, runnerOptions string) container.Container {
+func newStepContainer(ctx context.Context, step step, image string, cmd, entrypoint []string, runnerOptions string) (container.Container, error) {
 	rc := step.getRunContext()
 	logWriter := rc.commandLogWriter(ctx)
 	envList := make([]string, 0)
@@ -447,7 +466,10 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo
 
 	envList = append(envList, rc.runnerEnv(ctx)...)
 
-	binds, mounts := rc.GetBindsAndMounts(ctx)
+	binds, mounts, err := rc.GetBindsAndMounts()
+	if err != nil {
+		return nil, err
+	}
 	networkMode := "container:" + rc.jobContainerName()
 	if rc.IsHostEnv() {
 		networkMode = "default"
@@ -471,7 +493,7 @@ func newStepContainer(ctx context.Context, step step, image string, cmd, entrypo
 		AutoRemove:    true,
 		ValidVolumes:  rc.validVolumes(),
 		AllocatePTY:   rc.Config.AllocatePTY,
-	})
+	}), nil
 }
 
 func populateEnvsFromSavedState(env *map[string]string, step actionStep, rc *RunContext) {

act/runner/action_composite.go

@@ -104,8 +104,6 @@ func newCompositeRunContext(ctx context.Context, parent *RunContext, step action
 		Parent:        parent,
 		EventJSON:     parent.EventJSON,
 		platformImage: parent.platformImage,
-		jobIndex:      parent.jobIndex,
-		jobTotal:      parent.jobTotal,
 	}
 	compositerc.setCompositeActionEnv(env)
 	compositerc.ExprEval = compositerc.NewExpressionEvaluator(ctx)

act/runner/action_composite_test.go

@@ -12,21 +12,18 @@ import (
 	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v4"
 )
 
 func TestCompositeActionParity(t *testing.T) {
 	t.Run("inherits contexts without leaking inputs", func(t *testing.T) {
 		ctx := t.Context()
-		strategy := &model.Strategy{MaxParallelString: "3", RawMatrix: yaml.Node{Kind: yaml.MappingNode}}
+		strategy := &model.Strategy{MaxParallel: 3}
 		parent := &RunContext{
 			Config:        &Config{},
 			Matrix:        map[string]any{"os": "linux"},
 			Run:           &model.Run{JobID: "job", Workflow: &model.Workflow{Name: "workflow", Jobs: map[string]*model.Job{"job": {Strategy: strategy}}}},
 			JobContainer:  &jobContainerMock{},
 			platformImage: "-self-hosted",
-			jobIndex:      1,
-			jobTotal:      4,
 		}
 		composite, err := newCompositeRunContext(ctx, parent, &stepActionRemote{
 			Step:       &model.Step{With: map[string]string{"SHARED": "outer"}},
@@ -39,9 +36,9 @@ func TestCompositeActionParity(t *testing.T) {
 		assert.Same(t, strategy, composite.Run.Job().Strategy)
 		assert.True(t, composite.IsHostEnv())
 		interpolated, err := composite.NewExpressionEvaluator(ctx).Interpolate(ctx,
-			"${{ matrix.os }}|${{ strategy.max-parallel }}|${{ strategy.job-index }}|${{ inputs.shared }}")
+			"${{ matrix.os }}|${{ strategy.max-parallel }}|${{ inputs.shared }}")
 		require.NoError(t, err)
-		assert.Equal(t, "linux|3|1|outer", interpolated)
+		assert.Equal(t, "linux|3|outer", interpolated)
 		assert.NotContains(t, composite.Env, "INPUT_SHARED")
 
 		nestedEnv := composite.GetEnv()
@@ -120,51 +117,3 @@ func TestAppendUniqueMasksNoExponentialGrowth(t *testing.T) {
 
 	assert.Equal(t, []string{"secret"}, parentMasks)
 }
-
-func TestCompositeStepIfReadsJobStatusExceptInItsOwnMainSteps(t *testing.T) {
-	failStep := func(rc *RunContext) {
-		rc.StepResults["failed"] = &model.StepResult{Conclusion: model.StepStatusFailure}
-	}
-	tests := []struct {
-		name   string
-		setup  func(job, composite *RunContext)
-		nested bool
-		stage  stepStage
-		want   map[string]bool
-	}{
-		{"post-if reads the failed job", func(job, _ *RunContext) { failStep(job) }, false, stepStagePost, map[string]bool{"success()": false, "failure()": true, "job.status == 'failure'": true}},
-		{"main if ignores the failed job", func(job, _ *RunContext) { failStep(job) }, false, stepStageMain, map[string]bool{"success()": true, "failure()": false}},
-		{"main if reads the composite's own failure", func(_, composite *RunContext) { failStep(composite) }, false, stepStageMain, map[string]bool{"success()": false, "failure()": true}},
-		{"nested main if ignores the outer composite's failure", func(_, composite *RunContext) { failStep(composite) }, true, stepStageMain, map[string]bool{"success()": true}},
-		{"main if sees the cancelled job", func(job, _ *RunContext) { job.markCancelled() }, false, stepStageMain, map[string]bool{"cancelled()": true, "success()": false}},
-		{"post-if sees the cancelled job", func(job, _ *RunContext) { job.markCancelled() }, false, stepStagePost, map[string]bool{"cancelled()": true, "success()": false}},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			job := makeTestRC(t, "runs-on: ubuntu-latest")
-			composite := newTestCompositeRunContext(t, job)
-			rc := composite
-			if tt.nested {
-				rc = newTestCompositeRunContext(t, composite)
-			}
-			tt.setup(job, composite)
-			step := &stepRun{RunContext: rc}
-			for expr, want := range tt.want {
-				enabled, err := isStepEnabled(t.Context(), expr, step, tt.stage)
-				require.NoError(t, err)
-				assert.Equal(t, want, enabled, expr)
-			}
-		})
-	}
-}
-
-func newTestCompositeRunContext(t *testing.T, parent *RunContext) *RunContext {
-	composite, err := newCompositeRunContext(t.Context(), parent, &stepActionRemote{
-		Step:       &model.Step{},
-		RunContext: parent,
-		action:     &model.Action{},
-		env:        map[string]string{},
-	}, "/action")
-	require.NoError(t, err)
-	return composite
-}

act/runner/action_test.go

@@ -227,7 +227,7 @@ func TestActionRunner(t *testing.T) {
 			ctx := context.Background()
 
 			cm := &containerMock{}
-			cm.On("CopyDir", "/var/run/act/actions/dir/", "dir/", false, true).Return(func(ctx context.Context) error { return nil })
+			cm.On("CopyDir", "/var/run/act/actions/dir/", "dir/", false).Return(func(ctx context.Context) error { return nil })
 
 			envMatcher := mock.MatchedBy(func(env map[string]string) bool {
 				for k, v := range tt.expectedEnv {
@@ -242,7 +242,7 @@ func TestActionRunner(t *testing.T) {
 
 			tt.step.getRunContext().JobContainer = cm
 
-			err := runActionImpl(tt.step, "dir", mustNewRemoteAction(t, "org/repo/path@ref"))(ctx)
+			err := runActionImpl(tt.step, "dir", newRemoteAction("org/repo/path@ref"))(ctx)
 
 			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
 			cm.AssertExpectations(t)
@@ -316,7 +316,7 @@ func TestNewStepContainerDoesNotUseDockerSecrets(t *testing.T) {
 	step.On("getStepModel").Return(&model.Step{ID: "action"})
 	step.On("getEnv").Return(&env)
 
-	newStepContainer(ctx, step, "registry.example.com/action:tag", nil, nil, "")
+	_, _ = newStepContainer(ctx, step, "registry.example.com/action:tag", nil, nil, "")
 
 	// DOCKER_USERNAME/DOCKER_PASSWORD should not be injected as pull credentials for docker action containers.
 	assert.Empty(t, captured.Username)
@@ -337,7 +337,7 @@ func TestMaybeCopyToActionDirHoldsCloneLock(t *testing.T) {
 	copyEntered := make(chan struct{})
 
 	cm := &containerMock{}
-	cm.On("CopyDir", "/var/run/act/actions/", actionDir+"/", false, true).Return(func(ctx context.Context) error {
+	cm.On("CopyDir", "/var/run/act/actions/", actionDir+"/", false).Return(func(ctx context.Context) error {
 		close(copyEntered)
 		<-releaseCopy
 		return nil
@@ -461,11 +461,18 @@ func TestExecAsDockerHoldsCloneLockForRemoteUncached(t *testing.T) {
 	case <-innerEntered:
 	case err := <-done:
 		t.Fatalf("execAsDocker returned without entering inner: %v", err)
+	case <-time.After(time.Second):
+		t.Fatal("inner build executor not entered after lock released")
 	}
 
 	cancel()
 	releaseOnce()
-	<-done
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("execAsDocker did not return after inner was released and ctx was canceled")
+	}
 }
 
 func TestDockerActionImageTag(t *testing.T) {

act/runner/cancellation_test.go

@@ -14,7 +14,6 @@ import (
 	"gitea.dev/actionslib/pkg/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.opentelemetry.io/otel/trace"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -250,8 +249,7 @@ func TestPreStepFailureAffectsMainStepIfStatus(t *testing.T) {
 // SetJobError dereferences a nil map and panics. The post context must therefore be detached
 // from cancellation (so the steps run) yet still carry a usable error container.
 func TestPostStepsContextCancelledIsUsableForFailingStep(t *testing.T) {
-	jobSpan := trace.NewSpanContext(trace.SpanContextConfig{TraceID: trace.TraceID{1}, SpanID: trace.SpanID{1}})
-	cancelled, cancel := context.WithCancel(trace.ContextWithSpanContext(common.WithJobErrorContainer(context.Background()), jobSpan))
+	cancelled, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
 	cancel()
 	require.ErrorIs(t, cancelled.Err(), context.Canceled)
 
@@ -260,7 +258,6 @@ func TestPostStepsContextCancelledIsUsableForFailingStep(t *testing.T) {
 
 	// Detached from cancellation, so the post steps actually run.
 	require.NoError(t, postCtx.Err(), "post context must not be cancelled")
-	assert.Equal(t, jobSpan, trace.SpanContextFromContext(postCtx), "post steps must stay in the job's trace")
 
 	// A failing post step records its error instead of panicking.
 	require.NotPanics(t, func() {

act/runner/container_mock_test.go

@@ -57,8 +57,8 @@ func (cm *containerMock) Copy(destPath string, files ...*container.FileEntry) co
 	return args.Get(0).(func(context.Context) error)
 }
 
-func (cm *containerMock) CopyDir(destPath, srcPath string, useGitIgnore, skipGitDir bool) common.Executor {
-	args := cm.Called(destPath, srcPath, useGitIgnore, skipGitDir)
+func (cm *containerMock) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
+	args := cm.Called(destPath, srcPath, useGitIgnore)
 	return args.Get(0).(func(context.Context) error)
 }
 

act/runner/docker_proxy_integration_test.go

@@ -1,110 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !(WITHOUT_DOCKER || !(linux || darwin || windows || netbsd))
-
-package runner
-
-import (
-	"context"
-	"crypto/rand"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/act/container"
-
-	"gitea.dev/actionslib/pkg/model"
-	cerrdefs "github.com/containerd/errdefs"
-	"github.com/moby/moby/client"
-	"github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDockerProxyMountedJob(t *testing.T) {
-	mode := os.Getenv("ACT_TEST_DOCKER_PROXY")
-	if mode == "" {
-		t.Skip("set ACT_TEST_DOCKER_PROXY=proxy or direct to verify mounted Docker access")
-	}
-	require.Contains(t, []string{"proxy", "direct"}, mode)
-	ctx, cancel := context.WithTimeout(t.Context(), 2*time.Minute)
-	defer cancel()
-	dockerClient, err := container.GetDockerClient(ctx)
-	require.NoError(t, err)
-	t.Cleanup(func() { assert.NoError(t, dockerClient.Close()) })
-	require.True(t, strings.HasPrefix(dockerClient.DaemonHost(), "unix://"), "mounted Docker coverage requires a Unix daemon socket")
-
-	fixtureDir, err := filepath.Abs("testdata/docker-proxy")
-	require.NoError(t, err)
-	resourceName := "gitea-proxy-test-" + strings.ToLower(rand.Text())
-	runner, err := New(&Config{
-		Workdir:               fixtureDir,
-		ActionCacheDir:        t.TempDir(),
-		EventName:             "push",
-		PlatformPicker:        mapPlatformPicker(platforms),
-		ContainerNamePrefix:   resourceName,
-		ContainerDaemonSocket: dockerClient.DaemonHost(),
-		ContainerMaxLifetime:  2 * time.Minute,
-		ContainerOptions:      "-v /usr/local/bin/docker:/usr/local/bin/docker:ro -v /usr/local/libexec/docker/cli-plugins:/usr/local/libexec/docker/cli-plugins:ro",
-		ValidVolumes:          []string{"/usr/local/bin/docker", "/usr/local/libexec/docker/cli-plugins"},
-		Env:                   map[string]string{"PROXY_TEST_RESOURCE": resourceName, "PROXY_TEST_MODE": mode, "PROXY_TEST_IMAGE": baseImage, "COMPOSE_PROJECT_NAME": resourceName},
-	})
-	require.NoError(t, err)
-	planner, err := model.NewWorkflowPlanner(filepath.Join(fixtureDir, "push.yml"), true)
-	require.NoError(t, err)
-	plan, err := planner.PlanEvent("push")
-	if mode == "direct" {
-		plan, err = planner.PlanJob("proxy")
-	}
-	require.NoError(t, err)
-	runContext, err := runner.newRunContext(ctx, plan.Stages[0].Runs[0], nil)
-	require.NoError(t, err)
-	jobName := runContext.jobContainerName()
-	jobNetwork, _ := runContext.networkNameForGitea()
-	t.Cleanup(func() {
-		cleanCtx, cleanCancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
-		defer cleanCancel()
-		if _, err := dockerClient.ContainerRemove(cleanCtx, jobName, client.ContainerRemoveOptions{Force: true, RemoveVolumes: true}); !cerrdefs.IsNotFound(err) {
-			assert.NoError(t, err)
-		}
-		for _, name := range []string{resourceName, jobNetwork} {
-			if _, err := dockerClient.NetworkRemove(cleanCtx, name, client.NetworkRemoveOptions{}); !cerrdefs.IsNotFound(err) {
-				assert.NoError(t, err)
-			}
-		}
-		for _, name := range []string{resourceName, jobName, jobName + "-env"} {
-			if _, err := dockerClient.VolumeRemove(cleanCtx, name, client.VolumeRemoveOptions{}); !cerrdefs.IsNotFound(err) {
-				assert.NoError(t, err)
-			}
-		}
-	})
-
-	hook := &test.Hook{}
-	require.NoError(t, runner.NewPlanExecutor(plan)(common.WithLoggerHook(ctx, hook)))
-	var messages []string
-	for _, entry := range hook.AllEntries() {
-		messages = append(messages, strings.TrimSpace(entry.Message))
-	}
-	require.Contains(t, messages, "docker proxy post verified")
-	if mode == "proxy" {
-		require.Contains(t, messages, "docker binds verified")
-	}
-	_, err = dockerClient.ContainerInspect(ctx, jobName, client.ContainerInspectOptions{})
-	assert.True(t, cerrdefs.IsNotFound(err), "job container survived cleanup: %v", err)
-	_, err = dockerClient.NetworkInspect(ctx, resourceName, client.NetworkInspectOptions{})
-	if mode == "proxy" {
-		assert.True(t, cerrdefs.IsNotFound(err), "labelled network survived cleanup: %v", err)
-	} else {
-		require.NoError(t, err)
-	}
-	_, err = dockerClient.VolumeInspect(ctx, resourceName, client.VolumeInspectOptions{})
-	if mode == "proxy" {
-		assert.True(t, cerrdefs.IsNotFound(err), "labelled volume survived cleanup: %v", err)
-	} else {
-		require.NoError(t, err)
-	}
-}

act/runner/expression.go

@@ -13,6 +13,7 @@ import (
 	"reflect"
 	"regexp"
 	"strings"
+	"sync"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
@@ -35,9 +36,24 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map
 	var workflowCallResult map[string]*model.WorkflowCallResult
 
 	// todo: cleanup EvaluationEnvironment creation
+	using := make(map[string]exprparser.Needs)
 	strategy := make(map[string]any)
 	if rc.Run != nil {
-		strategy = exprparser.StrategyContext(rc.Run.Job().Strategy, rc.jobIndex, rc.jobTotal)
+		job := rc.Run.Job()
+		if job != nil && job.Strategy != nil {
+			strategy["fail-fast"] = job.Strategy.FailFast
+			strategy["max-parallel"] = job.Strategy.MaxParallel
+		}
+
+		jobs := rc.Run.Workflow.Jobs
+		jobNeeds := rc.Run.Job().Needs()
+
+		for _, needs := range jobNeeds {
+			using[needs] = exprparser.Needs{
+				Outputs: jobs[needs].Outputs,
+				Result:  jobs[needs].NeedsResult(),
+			}
+		}
 
 		// only setup jobs context in case of workflow_call
 		// and existing expression evaluator (this means, jobs are at
@@ -45,7 +61,7 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map
 		if rc.caller != nil && rc.ExprEval != nil {
 			workflowCallResult = map[string]*model.WorkflowCallResult{}
 
-			for jobName, job := range rc.Run.Workflow.Jobs {
+			for jobName, job := range jobs {
 				result := model.WorkflowCallResult{
 					Outputs: map[string]string{},
 				}
@@ -70,7 +86,7 @@ func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map
 		Vars:      getWorkflowVars(ctx, rc),
 		Strategy:  strategy,
 		Matrix:    rc.Matrix,
-		Needs:     exprparser.NeedsContext(rc.Run),
+		Needs:     using,
 		Inputs:    inputs,
 		HashFiles: getHashFilesFunction(ctx, rc),
 	}
@@ -89,26 +105,44 @@ var hashfiles string
 
 // NewStepExpressionEvaluator creates a new evaluator with the `inputs` of the enclosing workflow or composite action
 func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step) *ExpressionEvaluator {
-	return rc.newStepExpressionEvaluator(ctx, step, rc.actionInputs, rc.getJobContext())
+	return rc.newStepExpressionEvaluator(ctx, step, rc.actionInputs)
 }
 
 // NewActionInputsExpressionEvaluator creates a new evaluator with the step's own with: values as `inputs`
 func (rc *RunContext) NewActionInputsExpressionEvaluator(ctx context.Context, step step) *ExpressionEvaluator {
-	return rc.newStepExpressionEvaluator(ctx, step, inputsFromEnv(*step.getEnv()), rc.getJobContext())
+	return rc.newStepExpressionEvaluator(ctx, step, inputsFromEnv(*step.getEnv()))
 }
 
-func (rc *RunContext) newStepExpressionEvaluator(ctx context.Context, step step, stepInputs map[string]any, jobContext *model.JobContext) *ExpressionEvaluator {
+func (rc *RunContext) newStepExpressionEvaluator(ctx context.Context, step step, stepInputs map[string]any) *ExpressionEvaluator {
 	// todo: cleanup EvaluationEnvironment creation
+	job := rc.Run.Job()
+	strategy := make(map[string]any)
+	if job.Strategy != nil {
+		strategy["fail-fast"] = job.Strategy.FailFast
+		strategy["max-parallel"] = job.Strategy.MaxParallel
+	}
+
+	jobs := rc.Run.Workflow.Jobs
+	jobNeeds := rc.Run.Job().Needs()
+
+	using := make(map[string]exprparser.Needs)
+	for _, needs := range jobNeeds {
+		using[needs] = exprparser.Needs{
+			Outputs: jobs[needs].Outputs,
+			Result:  jobs[needs].NeedsResult(),
+		}
+	}
+
 	ee := &exprparser.EvaluationEnvironment{
 		Github:   step.getGithubContext(ctx),
 		Env:      *step.getEnv(),
-		Job:      jobContext,
+		Job:      rc.getJobContext(),
 		Steps:    rc.getStepsContext(),
 		Secrets:  getWorkflowSecrets(rc),
 		Vars:     getWorkflowVars(ctx, rc),
-		Strategy: exprparser.StrategyContext(rc.Run.Job().Strategy, rc.jobIndex, rc.jobTotal),
+		Strategy: strategy,
 		Matrix:   rc.Matrix,
-		Needs:    exprparser.NeedsContext(rc.Run),
+		Needs:    using,
 		// todo: should be unavailable
 		// but required to interpolate/evaluate the inputs in actions/composite
 		Inputs:    getEvaluatorInputs(rc, stepInputs, rc.getGithubContext(ctx)),
@@ -248,41 +282,48 @@ func inputsFromEnv(env map[string]string) map[string]any {
 func getEvaluatorInputs(rc *RunContext, stepInputs map[string]any, ghc *model.GithubContext) map[string]any {
 	inputs := map[string]any{}
 
-	// only a called workflow's job itself takes the inputs Gitea resolved,
-	// composite actions copy its Config but have their own `inputs`
-	if rc.Config.WorkflowCallInputs != nil && rc.Parent == nil {
-		maps.Copy(inputs, rc.Config.WorkflowCallInputs)
-		maps.Copy(inputs, stepInputs)
-		return inputs
-	}
-
 	maps.Copy(inputs, rc.workflowCallInputs)
 	maps.Copy(inputs, stepInputs)
 
-	switch ghc.EventName {
-	case "workflow_dispatch":
-		if config := rc.Run.Workflow.WorkflowDispatchConfig(); config != nil {
-			for name, input := range config.Inputs {
-				if input.Type == "number" {
-					input.Type = "string" // boolean is the only typed dispatch input, as in Gitea
+	if ghc.EventName == "workflow_dispatch" {
+		config := rc.Run.Workflow.WorkflowDispatchConfig()
+		if config != nil && config.Inputs != nil {
+			for k, v := range config.Inputs {
+				value := nestedMapLookup(ghc.Event, "inputs", k)
+				if value == nil {
+					value = v.Default
 				}
-				setEvaluatorInput(inputs, ghc, name, model.WorkflowCallInput{Type: input.Type, Default: input.Default})
+				inputs[k] = coerceInputValue(value, v.Type)
 			}
 		}
-	case "workflow_call":
-		for name, input := range rc.Run.Workflow.WorkflowCallConfig().Inputs {
-			setEvaluatorInput(inputs, ghc, name, input)
+	}
+
+	if ghc.EventName == "workflow_call" {
+		config := rc.Run.Workflow.WorkflowCallConfig()
+		if config != nil && config.Inputs != nil {
+			for k, v := range config.Inputs {
+				value := nestedMapLookup(ghc.Event, "inputs", k)
+				if value == nil {
+					value = v.Default
+				}
+				inputs[k] = coerceInputValue(value, v.Type)
+			}
 		}
 	}
 	return inputs
 }
 
-func setEvaluatorInput(inputs map[string]any, ghc *model.GithubContext, name string, input model.WorkflowCallInput) {
-	value := model.NestedMapLookup(ghc.Event, "inputs", name)
-	if value == nil {
-		value, _ = input.DefaultValue()
+// coerceInputValue converts an input value to the type declared by the workflow.
+// The event payload carries natively typed JSON values on newer Gitea versions,
+// while defaults and older servers provide strings.
+func coerceInputValue(value any, inputType string) any {
+	if inputType != "boolean" {
+		return value
 	}
-	inputs[name] = model.CoerceInputValue(value, input.Type)
+	if b, ok := value.(bool); ok {
+		return b
+	}
+	return value == "true"
 }
 
 // resolveWorkflowCall evaluates the caller's with: and secrets: once, as the server does before dispatching a called workflow.
@@ -290,32 +331,36 @@ func (rc *RunContext) resolveWorkflowCall(ctx context.Context) error {
 	if rc.caller == nil {
 		return nil
 	}
-	logger := common.Logger(ctx)
 	callerJob := rc.caller.runContext.Run.Job()
-	callerEval := rc.caller.runContext.ExprEval.shared(ctx)
-	var callerWith map[string]any
-	if err := model.DecodeEvaluated("workflow inputs", callerJob.RawWith, callerEval.EvaluateYamlNode, &callerWith); err != nil {
-		return err
-	}
-	if !rc.Run.Workflow.IsWorkflowCall() {
-		logger.Warn("workflow_call key is not defined in the referenced workflow")
-	}
+	callerEval := rc.caller.runContext.ExprEval
+	calleeEval := sync.OnceValue(func() *expressionEvaluator { return rc.NewExpressionEvaluator(ctx) })
 	config := rc.Run.Workflow.WorkflowCallConfig()
-	var err error
-	if rc.workflowCallInputs, err = callerEval.ResolveWorkflowCallInputs(config, callerWith); err != nil {
-		logger.Warn(err)
+
+	rc.workflowCallInputs = make(map[string]any, len(config.Inputs))
+	for name, input := range config.Inputs {
+		value, eval, label := callerJob.With[name], callerEval, "input"
+		if value == nil {
+			value, eval, label = input.Default, calleeEval(), "the default of input"
+		}
+		if str, ok := value.(string); ok {
+			var err error
+			if value, err = eval.Interpolate(ctx, str); err != nil {
+				return fmt.Errorf("unable to interpolate %s %s: %w", label, name, err)
+			}
+		}
+		rc.workflowCallInputs[name] = coerceInputValue(value, input.Type)
 	}
 
-	if callerJob.InheritSecrets() {
-		rc.workflowCallSecrets = getWorkflowSecrets(rc.caller.runContext)
-		return nil
-	}
 	secrets := callerJob.Secrets()
-	if err := config.ValidateSecrets(secrets); err != nil {
-		logger.Warn(err)
+	if secrets == nil && callerJob.InheritSecrets() {
+		secrets = rc.caller.runContext.Config.Secrets
 	}
-	if rc.workflowCallSecrets, err = callerEval.EvaluateCallerSecrets(secrets); err != nil {
-		return fmt.Errorf("unable to interpolate %w", err)
+	rc.workflowCallSecrets = make(map[string]string, len(secrets))
+	for k, v := range secrets {
+		var err error
+		if rc.workflowCallSecrets[k], err = callerEval.Interpolate(ctx, v); err != nil {
+			return fmt.Errorf("unable to interpolate secret %s: %w", k, err)
+		}
 	}
 	return nil
 }

act/runner/expression_test.go

@@ -89,7 +89,7 @@ func TestEvaluateRunContext(t *testing.T) {
 		out     any
 		errMesg string
 	}{
-		{" 1 ", 1.0, ""},
+		{" 1 ", 1, ""},
 		// {"1 + 3", "4", ""},
 		// {"(1 + 3) * -2", "-8", ""},
 		{"'my text'", "my text", ""},
@@ -266,6 +266,7 @@ func TestInterpolate(t *testing.T) {
 		{"${{ null }}", ""},
 		{"${{ fromJSON('[1,2]') }}", "Array"},
 		{"${{ fromJSON('{\"a\":1}') }}", "Object"},
+		{"${{ 1", "${{ 1"},
 	}
 
 	for _, table := range tables {
@@ -276,7 +277,7 @@ func TestInterpolate(t *testing.T) {
 		})
 	}
 
-	for _, in := range []string{"${{ 1) && (2 }}", "run ${{ 1) && (2 }} now", "${{ 1"} {
+	for _, in := range []string{"${{ 1) && (2 }}", "run ${{ 1) && (2 }} now"} {
 		_, err := ee.Interpolate(context.Background(), in)
 		assert.Error(t, err, in)
 	}
@@ -294,8 +295,6 @@ on:
       name:
         type: string
         default: gitea
-      unset:
-        type: boolean
 `,
 		"workflow_dispatch": `
 on:
@@ -307,8 +306,6 @@ on:
       name:
         type: string
         default: gitea
-      unset:
-        type: boolean
 `,
 	}
 
@@ -360,98 +357,9 @@ on:
 				inputs := getEvaluatorInputs(rc, nil, ghc)
 				assert.Equal(t, table.flag, inputs["flag"])
 				assert.Equal(t, "gitea", inputs["name"])
-				assert.Equal(t, false, inputs["unset"])
 			})
 		}
 	}
-
-	t.Run("deferred workflow call inputs", func(t *testing.T) {
-		workflow, err := model.ReadWorkflow(strings.NewReader(workflows["workflow_call"] + `
-jobs:
-  test: {}
-  call:
-    uses: ./reuse.yml
-    with: ${{ fromJSON(matrix.args) }}
-`))
-		require.NoError(t, err)
-		workflow.GetJob("test")
-		job := workflow.GetJob("call")
-		rawWith := model.CloneYamlNode(job.RawWith)
-		for _, value := range []string{"true", "false"} {
-			t.Run(value, func(t *testing.T) {
-				t.Parallel()
-				parent, err := (&runnerImpl{config: &Config{}}).newRunContext(t.Context(), &model.Run{Workflow: workflow, JobID: "call"}, map[string]any{"args": `{"flag":` + value + `,"name":"${{ 'runner' }}"}`})
-				require.NoError(t, err)
-				child, err := (&runnerImpl{config: &Config{}, caller: &caller{runContext: parent}}).newRunContext(t.Context(), &model.Run{Workflow: workflow, JobID: "test"}, nil)
-				require.NoError(t, err)
-				assert.Equal(t, map[string]any{"flag": value == "true", "name": "${{ 'runner' }}", "unset": false}, child.workflowCallInputs)
-				assert.Equal(t, rawWith, job.RawWith)
-				assert.Nil(t, job.With)
-			})
-		}
-	})
-}
-
-func TestGetEvaluatorInputsResolvedByGitea(t *testing.T) {
-	wf, err := model.ReadWorkflow(strings.NewReader(`
-on:
-  workflow_call:
-    inputs:
-      name: {type: string, default: callee}
-  workflow_dispatch:
-    inputs:
-      name: {type: string}
-`))
-	require.NoError(t, err)
-	config := &Config{Workdir: ".", WorkflowCallInputs: map[string]any{"name": "caller", "target": "dispatch"}}
-	ghc := &model.GithubContext{EventName: "workflow_dispatch", Event: map[string]any{"inputs": map[string]any{"name": "dispatch"}}}
-
-	// the event's own inputs must not override those Gitea resolved
-	job := &RunContext{Config: config, Run: &model.Run{JobID: "job1", Workflow: wf}}
-	assert.Equal(t, map[string]any{"name": "caller", "target": "dispatch"}, getEvaluatorInputs(job, nil, ghc))
-
-	composite := &RunContext{Config: config, Run: &model.Run{JobID: "job1", Workflow: &model.Workflow{}}, Parent: job}
-	assert.Equal(t, map[string]any{"arg": "x"}, getEvaluatorInputs(composite, map[string]any{"arg": "x"}, ghc))
-}
-
-func TestResolveWorkflowCallToleratesMismatchesAndPassesInheritedSecretsVerbatim(t *testing.T) {
-	callerWorkflow, err := model.ReadWorkflow(strings.NewReader(`
-jobs:
-  call:
-    uses: ./reuse.yml
-    with: {flag: not-a-boolean}
-    secrets: {undeclared: "${{ secrets.token }}"}
-  inherit:
-    uses: ./reuse.yml
-    secrets: inherit
-`))
-	require.NoError(t, err)
-	callee, err := model.ReadWorkflow(strings.NewReader(`
-on:
-  workflow_call:
-    inputs:
-      flag: {type: boolean, default: true}
-jobs:
-  test: {}
-`))
-	require.NoError(t, err)
-	notCallable, err := model.ReadWorkflow(strings.NewReader("on: push\njobs:\n  test: {}\n"))
-	require.NoError(t, err)
-	config := &Config{Secrets: map[string]string{"token": "${{ github.token }}"}}
-	resolve := func(callerJobID string, workflow *model.Workflow) *RunContext {
-		parent, err := (&runnerImpl{config: config}).newRunContext(t.Context(), &model.Run{Workflow: callerWorkflow, JobID: callerJobID}, nil)
-		require.NoError(t, err)
-		child, err := (&runnerImpl{config: config, caller: &caller{runContext: parent}}).newRunContext(t.Context(), &model.Run{Workflow: workflow, JobID: "test"}, nil)
-		require.NoError(t, err)
-		return child
-	}
-
-	called := resolve("call", callee)
-	assert.Equal(t, map[string]any{"flag": true}, called.workflowCallInputs)
-	assert.Equal(t, map[string]string{"undeclared": "${{ github.token }}"}, called.workflowCallSecrets)
-	inherited := resolve("inherit", notCallable)
-	assert.Empty(t, inherited.workflowCallInputs)
-	assert.Equal(t, config.Secrets, inherited.workflowCallSecrets)
 }
 
 func TestJobNameMasksSecrets(t *testing.T) {

act/runner/job_executor.go

@@ -18,6 +18,7 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 	"unicode"
 
@@ -262,27 +263,26 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 		return err
 	})
 
-	return common.Executor(func(ctx context.Context) error {
-		if err := info.startContainer()(ctx); err != nil {
-			return err
-		}
-		return newStepsExecutor(rc, preSteps, steps).Finally(func(ctx context.Context) error {
+	stepsExecutor := newStepsExecutor(rc, preSteps, steps)
+
+	return common.NewPipelineExecutor(info.startContainer(), stepsExecutor.
+		Finally(func(ctx context.Context) error {
 			// Record an interrupt (backstop for interrupts that land outside the main
 			// step loop) so the post steps observe the cancelled/failed job status.
 			rc.markInterrupted(ctx.Err())
 			postCtx, cancel := postStepsContext(ctx)
 			defer cancel()
 			return postExecutor(postCtx)
-		})(ctx)
-	}).Finally(info.closeContainer())
+		}).
+		Finally(info.closeContainer()))
 }
 
 // postStepsContext derives the context used to run the job's post/cleanup steps from the
 // finished main-pipeline context. Cleanup has to run even when the run was interrupted, so the
 // returned context always carries a fresh bounded deadline and is never itself cancelled.
 //
-//   - context.Canceled (server cancel): detach with WithoutCancel under a fresh job-error
-//     container, so a failing post step cannot turn the cancellation into a failure.
+//   - context.Canceled (server cancel): detach from the cancelled context via a fresh root so
+//     the post steps can run.
 //   - context.DeadlineExceeded (job timeout): detach the deadline with WithoutCancel, which
 //     keeps the original values — including the job-error container — so the timeout failure and
 //     any post-step error are preserved and the job is still reported as failed.
@@ -290,7 +290,10 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 func postStepsContext(ctx context.Context) (context.Context, context.CancelFunc) {
 	switch ctx.Err() {
 	case context.Canceled:
-		return context.WithTimeout(common.WithJobErrorContainer(context.WithoutCancel(ctx)), 5*time.Minute)
+		// The cancelled context is abandoned for a fresh root, which drops the job-error
+		// container installed at the job root. Re-attach a fresh one so a failing post step
+		// records its error via SetJobError instead of panicking on a nil container.
+		return context.WithTimeout(common.WithJobErrorContainer(common.WithLogger(context.Background(), common.Logger(ctx))), 5*time.Minute)
 	case context.DeadlineExceeded:
 		return context.WithTimeout(context.WithoutCancel(ctx), 5*time.Minute)
 	default:
@@ -410,41 +413,41 @@ func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success boo
 	logger.WithField("jobResult", jobResult).Infof("Job %s", jobResultMessage)
 }
 
-// evaluateJobEnvAndDefaults resolves the job's env, defaults.run and container env once, as GitHub does at job setup.
+// evaluateJobEnvAndDefaults resolves the job's env and defaults.run once, as GitHub does at job setup.
 func evaluateJobEnvAndDefaults(ctx context.Context, rc *RunContext) error {
 	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-	env := rc.GetEnv()
-	var workflowEnv map[string]string
-	if rc.Run.Workflow.Env == nil {
-		if err := model.DecodeEvaluated("workflow env", rc.Run.Workflow.RawEnv, rc.ExprEval.shared(ctx).EvaluateYamlNode, &workflowEnv); err != nil {
-			return err
-		}
-	}
-	if workflowEnv != nil {
-		rc.Env = mergeMaps(workflowEnv, env)
-		rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-	}
 	var err error
-	for k, v := range env {
+	for k, v := range rc.GetEnv() {
 		if rc.Env[k], err = rc.ExprEval.Interpolate(ctx, v); err != nil {
 			return fmt.Errorf("unable to interpolate env %s: %w", k, err)
 		}
 	}
-	var defaults model.Defaults
-	if err := model.DecodeEvaluated("defaults", rc.Run.Job().RawDefaults, rc.ExprEval.shared(ctx).EvaluateYamlNode, &defaults); err != nil {
-		return err
+	defaults := rc.Run.Job().Defaults.Run
+	if rc.jobRunDefaults.Shell, err = rc.ExprEval.Interpolate(ctx, defaults.Shell); err != nil {
+		return fmt.Errorf("unable to interpolate defaults.run.shell: %w", err)
 	}
-	rc.jobRunDefaults = defaults.Run
-	return model.DecodeEvaluated("container env", rc.containerEnv, rc.ExprEval.shared(ctx).EvaluateYamlNode, &rc.containerSpec.Env)
+	if rc.jobRunDefaults.WorkingDirectory, err = rc.ExprEval.Interpolate(ctx, defaults.WorkingDirectory); err != nil {
+		return fmt.Errorf("unable to interpolate defaults.run.working-directory: %w", err)
+	}
+	return nil
 }
 
 func setJobOutputs(ctx context.Context, rc *RunContext) error {
 	if rc.caller == nil {
 		return nil
 	}
-	callerOutputs, err := rc.NewExpressionEvaluator(ctx).shared(ctx).EvaluateWorkflowCallOutputs(rc.Run.Workflow.WorkflowCallConfig())
-	if err != nil {
-		return fmt.Errorf("unable to interpolate workflow %w", err)
+	outputs := rc.Run.Workflow.WorkflowCallConfig().Outputs
+	callerOutputs := make(map[string]string, len(outputs))
+	ee := sync.OnceValue(func() *expressionEvaluator { return rc.NewExpressionEvaluator(ctx) })
+	for k, v := range outputs {
+		value := v.Value
+		for range 2 { // two passes, the value resolves through a job output
+			var err error
+			if value, err = ee().Interpolate(ctx, value); err != nil {
+				return fmt.Errorf("unable to interpolate workflow output %s: %w", k, err)
+			}
+		}
+		callerOutputs[k] = value
 	}
 
 	// Matrix combinations of a reusable-workflow caller share the caller's *model.Job;
@@ -462,7 +465,7 @@ func applyJobTimeout(ctx context.Context, rc *RunContext, job *model.Job) (conte
 	if err != nil {
 		common.Logger(ctx).Errorf("An error occurred when attempting to determine the job timeout: %s", err)
 	} else if timeout != "" {
-		if timeoutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil && timeoutMinutes > 0 {
+		if timeoutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil {
 			return context.WithTimeout(ctx, time.Duration(timeoutMinutes)*time.Minute)
 		}
 	}

act/runner/job_executor_test.go

@@ -300,8 +300,6 @@ func TestNewJobExecutor(t *testing.T) {
 		result        string
 		hasError      bool
 		output        string
-		startError    error
-		cancelOnStart bool
 	}{
 		{
 			name:          "zeroSteps",
@@ -437,21 +435,6 @@ func TestNewJobExecutor(t *testing.T) {
 			result:        "failure",
 			output:        "${{ 'test' != test }}",
 		},
-		{
-			name:          "start failure",
-			steps:         []*model.Step{{ID: "1"}},
-			executedSteps: []string{"startContainer", "closeContainer"},
-			startError:    errors.New("start failed"),
-		},
-		{
-			name:          "cancelled at startup boundary",
-			steps:         []*model.Step{{ID: "1"}},
-			preSteps:      []bool{false},
-			postSteps:     []bool{true},
-			executedSteps: []string{"startContainer", "step1", "post1", "interpolateOutputs", "stopContainer", "closeContainer"},
-			result:        "cancelled",
-			cancelOnStart: true,
-		},
 	}
 
 	contains := func(needle string, haystack []string) bool {
@@ -462,8 +445,7 @@ func TestNewJobExecutor(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			fmt.Printf("::group::%s\n", tt.name) //nolint:forbidigo // pre-existing issue from nektos/act
 
-			ctx, cancel := context.WithCancel(common.WithJobErrorContainer(context.Background()))
-			defer cancel()
+			ctx := common.WithJobErrorContainer(context.Background())
 			jim := &jobInfoMock{}
 			sfm := &stepFactoryMock{}
 			rc := &RunContext{
@@ -479,7 +461,8 @@ func TestNewJobExecutor(t *testing.T) {
 				Config: &Config{},
 			}
 			if tt.output != "" {
-				require.NoError(t, rc.Run.Job().RawOutputs.Encode(map[string]string{"bad": tt.output}))
+				rc.Run.Job().Outputs = map[string]string{"bad": tt.output}
+				rc.outputTemplate = map[string]string{"bad": tt.output}
 			}
 			rc.ExprEval = rc.NewExpressionEvaluator(ctx)
 			executorOrder := make([]string, 0)
@@ -487,12 +470,9 @@ func TestNewJobExecutor(t *testing.T) {
 			jim.On("steps").Return(tt.steps)
 
 			if len(tt.steps) > 0 {
-				jim.On("startContainer").Return(func(_ context.Context) error {
+				jim.On("startContainer").Return(func(ctx context.Context) error {
 					executorOrder = append(executorOrder, "startContainer")
-					if tt.cancelOnStart {
-						cancel()
-					}
-					return tt.startError
+					return nil
 				})
 			}
 
@@ -526,7 +506,7 @@ func TestNewJobExecutor(t *testing.T) {
 				defer sm.AssertExpectations(t)
 			}
 
-			if len(tt.steps) > 0 && tt.startError == nil {
+			if len(tt.steps) > 0 {
 				jim.On("matrix").Return(map[string]any{})
 
 				jim.On("interpolateOutputs").Return(func(ctx context.Context) error {
@@ -540,17 +520,12 @@ func TestNewJobExecutor(t *testing.T) {
 				if contains("stopContainer", tt.executedSteps) {
 					jim.On("stopContainer").Return(func(ctx context.Context) error {
 						executorOrder = append(executorOrder, "stopContainer")
-						require.NoError(t, ctx.Err())
-						_, bounded := ctx.Deadline()
-						require.True(t, bounded)
 						return nil
 					})
 				}
 
 				jim.On("result", tt.result)
-			}
 
-			if len(tt.steps) > 0 {
 				jim.On("closeContainer").Return(func(ctx context.Context) error {
 					executorOrder = append(executorOrder, "closeContainer")
 					return nil
@@ -559,14 +534,7 @@ func TestNewJobExecutor(t *testing.T) {
 
 			executor := newJobExecutor(jim, sfm, rc)
 			err := executor(ctx)
-			switch {
-			case tt.startError != nil:
-				require.ErrorIs(t, err, tt.startError)
-			case tt.cancelOnStart:
-				require.ErrorIs(t, err, context.Canceled)
-			default:
-				require.NoError(t, err)
-			}
+			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
 			assert.Empty(t, rc.Run.Job().Outputs["bad"])
 			assert.Equal(t, tt.executedSteps, executorOrder)
 
@@ -1081,7 +1049,6 @@ func TestApplyJobTimeout(t *testing.T) {
 	}{
 		{"empty", "runs-on: ubuntu-latest", false},
 		{"integer", "timeout-minutes: 5\nruns-on: ubuntu-latest", true},
-		{"zero ignored", "timeout-minutes: 0\nruns-on: ubuntu-latest", false},
 		{"non-numeric ignored", "timeout-minutes: abc\nruns-on: ubuntu-latest", false},
 	}
 	for _, tc := range cases {

act/runner/job_hooks.go

@@ -7,6 +7,7 @@ import (
 	"cmp"
 	"context"
 	"fmt"
+	"maps"
 	"path"
 	"strings"
 
@@ -50,7 +51,11 @@ func (rc *RunContext) runJobHook(ctx context.Context, hookPath, name string) err
 		rawLogger.Infof("shell: %s", shell)
 	}
 
-	env := mergeMaps(rc.containerSpec.Env, rc.GetEnv())
+	env := map[string]string{}
+	if jobContainer := rc.Run.Job().Container(); jobContainer != nil {
+		maps.Copy(env, jobContainer.Env)
+	}
+	maps.Copy(env, rc.GetEnv())
 	rc.withGithubEnv(ctx, rc.getGithubContext(ctx), env)
 	rc.ApplyExtraPath(ctx, &env)
 

act/runner/max_parallel_test.go

@@ -4,7 +4,6 @@
 package runner
 
 import (
-	"strings"
 	"testing"
 
 	"gitea.dev/actionslib/pkg/model"
@@ -35,14 +34,9 @@ func TestMaxParallelStrategy(t *testing.T) {
 			expectedMaxParallel: 4,
 		},
 		{
-			name:                "max-parallel-10-clamped-to-combinations",
+			name:                "max-parallel-10",
 			maxParallelString:   "10",
-			expectedMaxParallel: 5,
-		},
-		{
-			name:                "max-parallel-invalid-falls-back-to-default",
-			maxParallelString:   "tow",
-			expectedMaxParallel: 4,
+			expectedMaxParallel: 10,
 		},
 	}
 
@@ -67,29 +61,9 @@ func TestMaxParallelStrategy(t *testing.T) {
 			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
 			assert.NotNil(t, matrixes)
 			assert.Len(t, matrixes, 5)
-			assert.Equal(t, tt.expectedMaxParallel, maxParallelFor(job.Strategy, len(matrixes)))
+			assert.Equal(t, tt.expectedMaxParallel, job.Strategy.MaxParallel)
 		})
 	}
-
-	t.Run("deferred strategy", func(t *testing.T) {
-		workflow, err := model.ReadWorkflow(strings.NewReader(`
-jobs:
-  test:
-    if: false
-    strategy: ${{ fromJSON('{"max-parallel":2,"fail-fast":false,"matrix":{"os":["ubuntu","windows"]}}') }}
-`))
-		require.NoError(t, err)
-		job := workflow.Jobs["test"]
-		rawStrategy := model.CloneYamlNode(job.RawStrategy)
-		require.NoError(t, (&runnerImpl{config: &Config{}}).NewPlanExecutor(&model.Plan{Stages: []*model.Stage{{Runs: []*model.Run{{Workflow: workflow, JobID: "test"}}}}})(t.Context()))
-		require.NotNil(t, job.Strategy)
-		assert.False(t, job.Strategy.GetFailFast())
-		assert.Equal(t, 2, maxParallelFor(job.Strategy, 5))
-		matrixes, err := job.GetMatrixes()
-		require.NoError(t, err)
-		assert.Equal(t, []map[string]any{{"os": "ubuntu"}, {"os": "windows"}}, matrixes)
-		assert.Equal(t, rawStrategy, job.RawStrategy)
-	})
 }
 
 func TestNewPlanExecutorInvalidMatrix(t *testing.T) {
@@ -107,15 +81,4 @@ func TestNewPlanExecutorInvalidMatrix(t *testing.T) {
 	runner := &runnerImpl{config: &Config{}}
 
 	require.ErrorContains(t, runner.NewPlanExecutor(plan)(t.Context()), "could not get job matrix:")
-
-	for _, strategy := range []string{
-		`${{ fromJSON('invalid') }}`,
-		`${{ '${{ inputs.unresolved }}' }}`,
-	} {
-		t.Run(strategy, func(t *testing.T) {
-			workflow, err := model.ReadWorkflow(strings.NewReader("jobs:\n  test:\n    strategy: " + strategy))
-			require.NoError(t, err)
-			require.Error(t, runner.NewPlanExecutor(&model.Plan{Stages: []*model.Stage{{Runs: []*model.Run{{Workflow: workflow, JobID: "test"}}}}})(t.Context()))
-		})
-	}
 }

act/runner/patch_actions.go

@@ -28,8 +28,8 @@ import (
 // of upload-artifact.
 //
 // getCacheServiceURL() then resolves the cache service from ACTIONS_RESULTS_URL alone, where v1
-// reads ACTIONS_CACHE_URL first. Both reads there are given the same preference, so a patched cache
-// client reaches the cache server by its own address rather than through the results origin.
+// reads ACTIONS_CACHE_URL first. Both reads there are given the same preference, which is what
+// keeps the runner out of the artifact path: the results URL still points at Gitea.
 //
 // Either of these landing upstream makes this file deletable:
 //
@@ -105,45 +105,37 @@ func actionScriptPaths(dir string, action *model.Action) []string {
 	return paths
 }
 
-// patchActions returns a restore: the tree is shared, so a job with patching off gets no edits.
-func patchActions(ctx context.Context, scripts []string) func() {
-	restore := map[string][]byte{}
+// patchActions edits the toolkit in an action's bundles. The caller holds the action directory's
+// clone lock, which is what keeps another job's checkout from resetting them before the copy.
+func patchActions(ctx context.Context, scripts []string) {
 	for _, script := range scripts {
-		original, err := patchBundle(script)
-		if original != nil {
-			restore[script] = original // also when the write failed part way through
-		}
-		if err != nil {
+		switch patched, err := patchBundle(script); {
+		case err != nil:
 			common.Logger(ctx).Warnf("actions toolkit: %s left unpatched: %v", script, err)
-		}
-	}
-	return func() {
-		for script, original := range restore {
-			if err := os.WriteFile(script, original, 0o644); err != nil { //nolint:gosec // as the checkout wrote it
-				common.Logger(ctx).Warnf("actions toolkit: %s left patched in the shared copy: %v", script, err)
-			}
+		case patched:
+			common.Logger(ctx).Debugf("actions toolkit: patched %s", script)
 		}
 	}
 }
 
-// patchBundle returns the bytes it replaced, or nil when it left the bundle alone.
-func patchBundle(script string) ([]byte, error) {
+func patchBundle(script string) (bool, error) {
 	info, err := os.Stat(script)
 	if err != nil {
-		return nil, err
+		return false, err
 	}
 	if info.Size() > maxBundleSize {
-		return nil, nil
+		return false, nil
 	}
 	data, err := os.ReadFile(script)
 	if err != nil {
-		return nil, err
+		return false, err
 	}
 	patched, ok := patchedBundle(data)
 	if !ok {
-		return nil, nil
+		return false, nil
 	}
-	return data, os.WriteFile(script, patched, info.Mode().Perm())
+	// No atomic write needed: every prepare checks the action out and hard resets it.
+	return true, os.WriteFile(script, patched, info.Mode().Perm())
 }
 
 // patchedBundle opens the GHES gate, and where the cache toolkit is present, points the cache

act/runner/patch_actions_test.go

@@ -176,16 +176,16 @@ func TestPatchedBundleSurvivesInsideAStringLiteral(t *testing.T) {
 func TestPatchBundleIsIdempotent(t *testing.T) {
 	script := bundleFile(t, gateTSC)
 
-	original, err := patchBundle(script)
+	done, err := patchBundle(script)
 	require.NoError(t, err)
-	require.NotNil(t, original)
+	require.True(t, done)
 	patched, err := os.ReadFile(script)
 	require.NoError(t, err)
 	require.True(t, gateOpened(string(patched)))
 
-	original, err = patchBundle(script)
+	done, err = patchBundle(script)
 	require.NoError(t, err)
-	assert.Nil(t, original, "a patched bundle is not patched again")
+	assert.False(t, done, "a patched bundle is not patched again")
 	again, err := os.ReadFile(script)
 	require.NoError(t, err)
 	assert.Equal(t, string(patched), string(again))
@@ -194,9 +194,9 @@ func TestPatchBundleIsIdempotent(t *testing.T) {
 func TestPatchBundleLeavesOtherActionsAlone(t *testing.T) {
 	script := bundleFile(t, `console.log("checkout")`)
 
-	original, err := patchBundle(script)
+	done, err := patchBundle(script)
 	require.NoError(t, err)
-	assert.Nil(t, original)
+	assert.False(t, done)
 	body, err := os.ReadFile(script)
 	require.NoError(t, err)
 	assert.Equal(t, `console.log("checkout")`, string(body))
@@ -244,16 +244,13 @@ func TestPatchActionsAtTheContainerCopy(t *testing.T) {
 		require.NoError(t, os.WriteFile(script, []byte(gateTSC), 0o600))
 
 		var copied string
-		cm.On("CopyDir", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(func(context.Context) error {
+		cm.On("CopyDir", mock.Anything, mock.Anything, mock.Anything).Return(func(context.Context) error {
 			body, err := os.ReadFile(script)
 			require.NoError(t, err)
 			copied = string(body)
 			return nil
 		})
 		require.NoError(t, maybeCopyToActionDir(t.Context(), sar, sar.actionDir(), "sub", "/var/run/act/actions/repo/sub"))
-		source, err := os.ReadFile(script)
-		require.NoError(t, err)
-		assert.Equal(t, gateTSC, string(source), "the shared copy is left as it was found")
 		return copied
 	}
 

act/runner/reusable_workflow.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"net/url"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 
@@ -19,22 +20,28 @@ import (
 )
 
 func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
-	localWorkflow, err := model.ParseReusableWorkflowUses(rc.Run.Job().Uses)
-	if err != nil {
-		return common.NewErrorExecutor(err)
-	}
-
 	if !rc.Config.NoSkipCheckout {
-		// resolve the local workflow against the workspace root, not the process
-		// working directory, so it is found regardless of where the runner is invoked
-		return newReusableWorkflowExecutor(rc, rc.Config.Workdir, localWorkflow.Path)
+		fullPath := rc.Run.Job().Uses
+
+		fileName := path.Base(fullPath)
+		workflowDir := strings.TrimSuffix(fullPath, path.Join("/", fileName))
+		workflowDir = strings.TrimPrefix(workflowDir, "./")
+
+		return common.NewPipelineExecutor(
+			// resolve the local workflow against the workspace root, not the process
+			// working directory, so it is found regardless of where the runner is invoked
+			newReusableWorkflowExecutor(rc, filepath.Join(rc.Config.Workdir, workflowDir), fileName),
+		)
 	}
 
-	uses := fmt.Sprintf("%s/%s@%s", rc.Config.PresetGitHubContext.Repository, localWorkflow.Path, rc.Config.PresetGitHubContext.Sha)
+	// ./.gitea/workflows/wf.yml -> .gitea/workflows/wf.yml
+	trimmedUses := strings.TrimPrefix(rc.Run.Job().Uses, "./")
+	// uses string format is {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}
+	uses := fmt.Sprintf("%s/%s@%s", rc.Config.PresetGitHubContext.Repository, trimmedUses, rc.Config.PresetGitHubContext.Sha)
 
-	remoteReusableWorkflow, err := newRemoteReusableWorkflow(rc.Config.GitHubInstance, uses)
-	if err != nil {
-		return common.NewErrorExecutor(err)
+	remoteReusableWorkflow := newRemoteReusableWorkflowWithPlat(rc.Config.GitHubInstance, uses)
+	if remoteReusableWorkflow == nil {
+		return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
 	}
 
 	workflowDir := fmt.Sprintf("%s/%s", rc.ActionCacheDir(), safeFilename(uses))
@@ -44,27 +51,37 @@ func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
 
 	return common.NewPipelineExecutor(
 		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
-		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.Path),
+		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
 	)
 }
 
 func newRemoteReusableWorkflowExecutor(rc *RunContext) common.Executor {
-	remoteReusableWorkflow, err := newRemoteReusableWorkflow(rc.Config.GitHubInstance, rc.Run.Job().Uses)
-	if err != nil {
-		return common.NewErrorExecutor(err)
+	uses := rc.Run.Job().Uses
+
+	var remoteReusableWorkflow *remoteReusableWorkflow
+	if strings.HasPrefix(uses, "http://") || strings.HasPrefix(uses, "https://") {
+		remoteReusableWorkflow = newRemoteReusableWorkflowFromAbsoluteURL(uses)
+		if remoteReusableWorkflow == nil {
+			return common.NewErrorExecutor(fmt.Errorf("expected format http(s)://{domain}/{owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
+		}
+	} else {
+		remoteReusableWorkflow = newRemoteReusableWorkflowWithPlat(rc.Config.GitHubInstance, uses)
+		if remoteReusableWorkflow == nil {
+			return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
+		}
 	}
 
 	// uses with safe filename makes the target directory look something like this {owner}-{repo}-.github-workflows-{filename}@{ref}
 	// instead we will just use {owner}-{repo}@{ref} as our target directory. This should also improve performance when we are using
 	// multiple reusable workflows from the same repository and ref since for each workflow we won't have to clone it again
-	filename := fmt.Sprintf("%s/%s@%s", remoteReusableWorkflow.Owner, remoteReusableWorkflow.Repo, remoteReusableWorkflow.Ref)
+	filename := fmt.Sprintf("%s/%s@%s", remoteReusableWorkflow.Org, remoteReusableWorkflow.Repo, remoteReusableWorkflow.Ref)
 	workflowDir := fmt.Sprintf("%s/%s", rc.ActionCacheDir(), safeFilename(filename))
 
 	token := getGitCloneToken(rc.Config, remoteReusableWorkflow.CloneURL())
 
 	return common.NewPipelineExecutor(
 		cloneRemoteReusableWorkflow(rc, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, workflowDir, token),
-		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.Path),
+		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
 	)
 }
 
@@ -73,7 +90,7 @@ func newRemoteReusableWorkflowExecutor(rc *RunContext) common.Executor {
 //
 // Callers must not change remoteReusableWorkflow.URL, because:
 //  1. Gitea doesn't support specifying GithubContext.ServerURL by the GITHUB_SERVER_URL env
-//  2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflow
+//  2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflowWithPlat
 //
 // remoteReusableWorkflow.URL = rc.getGithubContext(ctx).ServerURL
 func cloneRemoteReusableWorkflow(rc *RunContext, cloneURL, ref, targetDirectory, token string) common.Executor {
@@ -136,34 +153,64 @@ func newReusableWorkflowRunner(rc *RunContext) (*runnerImpl, error) {
 }
 
 type remoteReusableWorkflow struct {
-	*model.ReusableWorkflowUses
-	URL string
+	URL      string
+	Org      string
+	Repo     string
+	Filename string
+	Ref      string
+
+	GitPlatform string
 }
 
 func (r *remoteReusableWorkflow) CloneURL() string {
 	// In Gitea, r.URL always has the protocol prefix, we don't need to add extra prefix in this case.
 	if strings.HasPrefix(r.URL, "http://") || strings.HasPrefix(r.URL, "https://") {
-		return fmt.Sprintf("%s/%s/%s", r.URL, r.Owner, r.Repo)
+		return fmt.Sprintf("%s/%s/%s", r.URL, r.Org, r.Repo)
 	}
-	return fmt.Sprintf("https://%s/%s/%s", r.URL, r.Owner, r.Repo)
+	return fmt.Sprintf("https://%s/%s/%s", r.URL, r.Org, r.Repo)
 }
 
-var absoluteReusableWorkflowURLRegex = regexp.MustCompile(`^(https?://.*)/([^/]+/[^/]+/\.[^/]+/workflows/[^@]+@.*)$`)
+func (r *remoteReusableWorkflow) FilePath() string {
+	return fmt.Sprintf("./.%s/workflows/%s", r.GitPlatform, r.Filename)
+}
 
 // For Gitea
-// newRemoteReusableWorkflow parses a remote `uses`, an absolute URL up to `{owner}/{repo}/.{git_platform}/workflows/` replaces baseURL
-func newRemoteReusableWorkflow(baseURL, uses string) (*remoteReusableWorkflow, error) {
-	if matches := absoluteReusableWorkflowURLRegex.FindStringSubmatch(uses); matches != nil {
-		baseURL, uses = matches[1], matches[2]
+// newRemoteReusableWorkflowWithPlat create a `remoteReusableWorkflow`
+// workflows from `.gitea/workflows` and `.github/workflows` are supported
+func newRemoteReusableWorkflowWithPlat(url, uses string) *remoteReusableWorkflow {
+	// GitHub docs:
+	// https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_iduses
+	r := regexp.MustCompile(`^([^/]+)/([^/]+)/\.([^/]+)/workflows/([^@]+)@(.*)$`)
+	matches := r.FindStringSubmatch(uses)
+	if len(matches) != 6 {
+		return nil
 	}
-	parsed, err := model.ParseReusableWorkflowUses(uses)
-	if err != nil {
-		return nil, err
+	return &remoteReusableWorkflow{
+		Org:         matches[1],
+		Repo:        matches[2],
+		GitPlatform: matches[3],
+		Filename:    matches[4],
+		Ref:         matches[5],
+		URL:         url,
 	}
-	if parsed.IsLocal() {
-		return nil, fmt.Errorf("expected a remote reusable workflow, got %q", uses)
+}
+
+// For Gitea
+// newRemoteReusableWorkflowWithPlat create a `remoteReusableWorkflow` from an absolute url
+func newRemoteReusableWorkflowFromAbsoluteURL(uses string) *remoteReusableWorkflow {
+	r := regexp.MustCompile(`^(https?://.*)/([^/]+)/([^/]+)/\.([^/]+)/workflows/([^@]+)@(.*)$`)
+	matches := r.FindStringSubmatch(uses)
+	if len(matches) != 7 {
+		return nil
+	}
+	return &remoteReusableWorkflow{
+		URL:         matches[1],
+		Org:         matches[2],
+		Repo:        matches[3],
+		GitPlatform: matches[4],
+		Filename:    matches[5],
+		Ref:         matches[6],
 	}
-	return &remoteReusableWorkflow{ReusableWorkflowUses: parsed, URL: baseURL}, nil
 }
 
 // For Gitea

act/runner/reusable_workflow_test.go

@@ -5,7 +5,6 @@ package runner
 
 import (
 	"context"
-	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -107,22 +106,6 @@ func TestNewReusableWorkflowExecutorHoldsCloneLock(t *testing.T) {
 	}
 }
 
-func TestNewLocalReusableWorkflowExecutorFindsSameRepositoryPaths(t *testing.T) {
-	workdir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(workdir, ".gitea", "workflows"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(workdir, ".gitea", "workflows", "reusable.yml"), []byte(":"), 0o644))
-
-	for _, uses := range []string{"./.gitea/workflows/reusable.yml", "$/.gitea/workflows/reusable.yml"} {
-		rc := &RunContext{
-			Config: &Config{Workdir: workdir},
-			Run:    &model.Run{JobID: "job", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"job": {Uses: uses}}}},
-		}
-		err := newLocalReusableWorkflowExecutor(rc)(t.Context())
-		require.Error(t, err)
-		require.NotErrorIs(t, err, fs.ErrNotExist)
-	}
-}
-
 func TestGetGitCloneTokenWithSchemalessGiteaInstance(t *testing.T) {
 	conf := &Config{
 		GitHubInstance: "gitea.example.net",

act/runner/run_context_test.go

@@ -7,32 +7,23 @@ package runner
 import (
 	"bytes"
 	"context"
-	"encoding/json/v2"
 	"errors"
 	"fmt"
 	"io"
-	"maps"
-	"net"
-	"net/http"
-	"net/http/httptest"
 	"os"
-	"path/filepath"
 	"runtime"
-	"slices"
 	"strings"
 	"testing"
-	"testing/synctest"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
+	"gitea.com/gitea/runner/internal/pkg/labels"
 
 	"gitea.dev/actionslib/pkg/exprparser"
 	"gitea.dev/actionslib/pkg/model"
 	"github.com/docker/cli/cli/compose/loader"
-	"github.com/moby/moby/api/types/volume"
 	log "github.com/sirupsen/logrus"
-	logrustest "github.com/sirupsen/logrus/hooks/test"
 	assert "github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	require "github.com/stretchr/testify/require"
@@ -186,6 +177,38 @@ func TestRunContext_EvalBool(t *testing.T) {
 	}
 }
 
+func TestRunContextHandleCredentialsDoesNotUseDockerSecrets(t *testing.T) {
+	workflow, err := model.ReadWorkflow(strings.NewReader(`
+name: test
+on: push
+jobs:
+  job:
+    runs-on: ubuntu-latest
+    steps: []
+`))
+	require.NoError(t, err)
+
+	rc := &RunContext{
+		Config: &Config{
+			Secrets: map[string]string{
+				"DOCKER_USERNAME": "docker-user",
+				"DOCKER_PASSWORD": "docker-password",
+			},
+			Env: map[string]string{},
+		},
+		Run: &model.Run{
+			JobID:    "job",
+			Workflow: workflow,
+		},
+	}
+
+	// DOCKER_USERNAME/DOCKER_PASSWORD secrets should not be used as implicit job container pull credentials.
+	username, password, err := rc.handleCredentials(t.Context())
+	require.NoError(t, err)
+	assert.Empty(t, username)
+	assert.Empty(t, password)
+}
+
 // fakeContainer turns every container operation into a no-op, so startJobContainer
 // runs without a Docker daemon. The embedded interface is nil, so any method the
 // test does not exercise panics rather than silently doing the wrong thing.
@@ -199,9 +222,8 @@ func (fakeContainer) Start(bool) common.Executor { return func(context.Context)
 
 func (fakeContainer) Remove() common.Executor { return func(context.Context) error { return nil } }
 
-func (fakeContainer) Close() common.Executor             { return func(context.Context) error { return nil } }
-func (fakeContainer) GetActPath() string                 { return "/var/run/act" }
-func (fakeContainer) ToContainerPath(path string) string { return path }
+func (fakeContainer) Close() common.Executor { return func(context.Context) error { return nil } }
+func (fakeContainer) GetActPath() string     { return "/var/run/act" }
 func (fakeContainer) Create([]string, []string) common.Executor {
 	return func(context.Context) error { return nil }
 }
@@ -216,20 +238,8 @@ func (fakeContainer) Inspect(context.Context) (*container.Info, error) {
 
 func (fakeContainer) DumpLogs(context.Context) error { return nil }
 
-func fakeDockerDaemon(t *testing.T, handler http.HandlerFunc) {
-	t.Helper()
-	daemon := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
-		writer.Header().Set("Content-Type", "application/json")
-		if strings.HasSuffix(request.URL.Path, "/_ping") {
-			writer.Header().Set("API-Version", "1.47")
-		} else {
-			handler(writer, request)
-		}
-	}))
-	t.Cleanup(daemon.Close)
-	t.Setenv("DOCKER_HOST", daemon.URL)
-}
-
+// startJobContainerInputs runs startJobContainer against fakeContainer and returns the
+// inputs it built, one per container.
 func startJobContainerInputs(t *testing.T, workflowYAML string, cfg *Config) []*container.NewContainerInput {
 	t.Helper()
 	workflow, err := model.ReadWorkflow(strings.NewReader(workflowYAML))
@@ -260,28 +270,9 @@ func startJobContainerInputs(t *testing.T, workflowYAML string, cfg *Config) []*
 	rc.ExprEval = rc.NewExpressionEvaluator(t.Context())
 	require.NoError(t, rc.resolvePlatformImage(t.Context()))
 
-	daemon := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch {
-		case strings.HasSuffix(r.URL.Path, "/_ping"):
-			w.Header().Set("API-Version", "1.47")
-			_, _ = io.WriteString(w, "OK")
-		case strings.HasSuffix(r.URL.Path, "/containers/json"), strings.HasSuffix(r.URL.Path, "/networks"):
-			_, _ = io.WriteString(w, "[]")
-		case strings.HasSuffix(r.URL.Path, "/volumes"):
-			_, _ = io.WriteString(w, `{"Volumes":[]}`)
-		case r.Method == http.MethodDelete && strings.Contains(r.URL.Path, "/volumes/"):
-			w.WriteHeader(http.StatusNoContent)
-		case strings.HasSuffix(r.URL.Path, "/info"):
-			_, _ = io.WriteString(w, `{"Architecture":"amd64","OSType":"linux"}`)
-		default:
-			t.Errorf("unexpected Docker request: %s %s", r.Method, r.URL)
-			http.NotFound(w, r)
-		}
-	}))
-	t.Cleanup(daemon.Close)
-	t.Setenv("DOCKER_HOST", daemon.URL)
-	require.NoError(t, rc.startJobContainer()(t.Context()))
+	// the inputs are built before the missing daemon fails the first call
+	t.Setenv("DOCKER_HOST", "unix:///nonexistent.sock")
+	require.Error(t, rc.startJobContainer()(t.Context()))
 
 	return inputs
 }
@@ -339,29 +330,6 @@ jobs:
 	require.Equal(t, map[string]string{"data": "/data"}, redis.Mounts)
 	require.Empty(t, redis.Binds) // the docker socket is the job container's alone
 	require.Empty(t, redis.WorkingDir)
-	require.Nil(t, redis.Entrypoint)
-	require.Nil(t, redis.Cmd)
-}
-
-func TestStartJobContainerBuildsEvaluatedJobAndServiceInputs(t *testing.T) {
-	inputs := startJobContainerInputs(t, `
-jobs:
-  job:
-    container: ${{ fromJSON('{"image":"docker://node:20","options":"--label ${{ github.job }}","credentials":{"username":"user","password":"${{ vars.TITLE }}"}}') }}
-    services: ${{ fromJSON('{"redis":{"image":"docker://redis:latest","volumes":["data:/data"],"env":{"TITLE":"${{ github.job }}"},"credentials":{"username":"user","password":"${{ github.job }}"},"entrypoint":"/entry.sh","command":"redis-server --port 6380"}}') }}
-`, &Config{})
-	redis, job := inputs[0], inputs[1]
-
-	require.Equal(t, "redis:latest", redis.Image)
-	require.Equal(t, map[string]string{"data": "/data"}, redis.Mounts)
-	require.Equal(t, []string{"TITLE=${{ github.job }}"}, redis.Env)
-	require.Equal(t, "${{ github.job }}", redis.Password)
-	require.Equal(t, []string{"/entry.sh"}, redis.Entrypoint)
-	require.Equal(t, []string{"redis-server", "--port", "6380"}, redis.Cmd)
-	require.Equal(t, "node:20", job.Image)
-	require.Equal(t, "sleep", job.Entrypoint[0])
-	require.Equal(t, "--label ${{ github.job }}", job.WorkflowOptions)
-	require.Equal(t, "${{ vars.TITLE }}", job.Password)
 }
 
 // Only the workflow's options may be stripped later, so the two sources have to reach the
@@ -414,14 +382,17 @@ jobs:
     steps: []
 `, &Config{ProxyEnv: map[string]string{"http_proxy": "http://proxy:3128", "no_proxy": "internal.example"}})
 
-	db, redis := inputs[0], inputs[1]
+	env := map[string][]string{}
+	for _, in := range inputs {
+		env[in.Image] = in.Env
+	}
 
-	require.Contains(t, redis.Env, "http_proxy=http://proxy:3128")
-	require.Contains(t, redis.Env, "no_proxy=internal.example")
+	require.Contains(t, env["redis:latest"], "http_proxy=http://proxy:3128")
+	require.Contains(t, env["redis:latest"], "no_proxy=internal.example")
 	// the service's own env wins over what the runner injected, without dropping the rest
-	require.Contains(t, db.Env, "no_proxy=db-only.example")
-	require.NotContains(t, db.Env, "no_proxy=internal.example")
-	require.Contains(t, db.Env, "http_proxy=http://proxy:3128")
+	require.Contains(t, env["postgres:latest"], "no_proxy=db-only.example")
+	require.NotContains(t, env["postgres:latest"], "no_proxy=internal.example")
+	require.Contains(t, env["postgres:latest"], "http_proxy=http://proxy:3128")
 }
 
 // act builds Dockerfile actions through the API, which does not pre-populate the proxy
@@ -482,7 +453,8 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 					config := testcase.rc.Config
 					config.Workdir = testcase.name
 					config.BindWorkdir = bindWorkDir
-					gotbind, gotmount := rctemplate.GetBindsAndMounts(t.Context())
+					gotbind, gotmount, err := rctemplate.GetBindsAndMounts()
+					require.NoError(t, err)
 
 					// Name binds/mounts are either/or
 					if config.BindWorkdir {
@@ -518,9 +490,8 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 
 		t.Run("InterpolatedContainerVolumes", func(t *testing.T) {
 			job := &model.Job{}
-			err := job.RawContainer.Encode(map[string]any{
-				"image":   "node:20",
-				"volumes": []string{"${{ secrets.MAME }}:/root/.mame/roms:ro"},
+			err := job.RawContainer.Encode(map[string][]string{
+				"volumes": {"${{ secrets.MAME }}:/root/.mame/roms:ro"},
 			})
 			require.NoError(t, err)
 
@@ -532,8 +503,7 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 					},
 				},
 				Config: &Config{
-					BindWorkdir:  false,
-					ValidVolumes: []string{"**"},
+					BindWorkdir: false,
 					Secrets: map[string]string{
 						"MAME": "/host/mame/roms",
 					},
@@ -542,9 +512,9 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 			rc.Run.JobID = "job1"
 			rc.Run.Workflow.Jobs = map[string]*model.Job{"job1": job}
 			rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
-			require.NoError(t, rc.resolvePlatformImage(context.Background()))
 
-			gotbind, gotmount := rc.GetBindsAndMounts(t.Context())
+			gotbind, gotmount, err := rc.GetBindsAndMounts()
+			require.NoError(t, err)
 			assert.Contains(t, gotbind, "/host/mame/roms:/root/.mame/roms:ro")
 			assert.NotContains(t, gotbind, "${{ secrets.MAME }}")
 			assert.NotContains(t, gotmount, "${{ secrets.MAME }}")
@@ -552,6 +522,12 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 
 		for _, testcase := range tests {
 			t.Run(testcase.name, func(t *testing.T) {
+				job := &model.Job{}
+				err := job.RawContainer.Encode(map[string][]string{
+					"volumes": testcase.volumes,
+				})
+				assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
 				rc := &RunContext{
 					Name: "TestRCName",
 					Run: &model.Run{
@@ -562,13 +538,13 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 					Config: &Config{
 						BindWorkdir:     false,
 						SharedToolCache: true, // so OverridesToolCache has a mount to displace
-						ValidVolumes:    []string{"**"},
 					},
-					containerSpec: model.ContainerSpec{Volumes: testcase.volumes},
 				}
 				rc.Run.JobID = "job1"
+				rc.Run.Workflow.Jobs = map[string]*model.Job{"job1": job}
 
-				gotbind, gotmount := rc.GetBindsAndMounts(t.Context())
+				gotbind, gotmount, err := rc.GetBindsAndMounts()
+				require.NoError(t, err)
 
 				if len(testcase.wantbind) > 0 {
 					assert.Contains(t, gotbind, testcase.wantbind)
@@ -603,35 +579,15 @@ func TestRunContext_GetBindsAndMounts(t *testing.T) {
 			Config: &Config{},
 		}
 
-		_, gotmount := rc.GetBindsAndMounts(t.Context())
+		_, gotmount, err := rc.GetBindsAndMounts()
+		require.NoError(t, err)
 		assert.NotContains(t, gotmount, sharedToolCacheVolume)
 
 		rc.Config.SharedToolCache = true
-		rc.containerSpec.Volumes = []string{"/unapproved:" + container.DefaultToolCache}
-		_, gotmount = rc.GetBindsAndMounts(t.Context())
+		_, gotmount, err = rc.GetBindsAndMounts()
+		require.NoError(t, err)
 		assert.Equal(t, container.DefaultToolCache, gotmount[sharedToolCacheVolume])
 	})
-
-	t.Run("DaemonMountsAboveOwnerRepo", func(t *testing.T) {
-		if runtime.GOOS == "windows" {
-			t.Skip("container paths are linux paths")
-		}
-		rc := &RunContext{
-			Run:    &model.Run{JobID: "job1", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"job1": {}}}},
-			Config: &Config{BindWorkdir: true, Workdir: "/workspace/1/owner/repo", PresetGitHubContext: &model.GithubContext{}, ValidVolumes: []string{"claimed"}},
-		}
-
-		gotbind, _ := rc.GetBindsAndMounts(t.Context())
-		assert.True(t, slices.ContainsFunc(gotbind, func(bind string) bool { return strings.HasPrefix(bind, "/workspace/1:/workspace/1") }), gotbind)
-
-		rc.Config.BindWorkdir = false
-		_, gotmount := rc.GetBindsAndMounts(t.Context())
-		assert.Equal(t, "/workspace/1", gotmount[rc.jobContainerName()])
-
-		rc.containerSpec.Volumes = []string{"claimed:/workspace/1"}
-		_, gotmount = rc.GetBindsAndMounts(t.Context())
-		assert.Equal(t, "/workspace/1/owner/repo", gotmount[rc.jobContainerName()])
-	})
 }
 
 func TestRunContextValidVolumes(t *testing.T) {
@@ -660,8 +616,6 @@ func TestRunContextValidVolumes(t *testing.T) {
 	assert.NotContains(t, rc.validVolumes(), rc.Config.Workdir)
 	rc.Config.BindWorkdir = true
 	assert.Contains(t, rc.validVolumes(), rc.Config.Workdir)
-	rc.Config.PresetGitHubContext = &model.GithubContext{}
-	assert.Contains(t, rc.validVolumes(), filepath.FromSlash("/workspace/1"))
 }
 
 func TestCleanupJobResourcesCleansServicesWithoutJobContainer(t *testing.T) {
@@ -674,182 +628,55 @@ func TestCleanupJobResourcesCleansServicesWithoutJobContainer(t *testing.T) {
 		serviceContainers: []*serviceContainer{{name: "svc", container: service}},
 	}
 
-	err := rc.cleanupJobResources("external-network", false, true)(common.WithDryrun(t.Context(), true))
+	err := rc.cleanupJobResources("external-network", false)(context.Background())
 	require.NoError(t, err)
 	service.AssertExpectations(t)
 }
 
-func TestCleanupJobVolumesReapsAbandonedDeferredCleanup(t *testing.T) {
-	now := time.Date(2026, time.September, 10, 12, 0, 0, 0, time.UTC)
-	rc := &RunContext{
-		Config:       &Config{ContainerNetworkCreateOptions: container.NewDockerNetworkCreateExecutorInput{RunnerUUID: "runner-1"}},
-		Run:          &model.Run{Workflow: &model.Workflow{Name: "workflow"}, JobID: "job"},
-		JobContainer: fakeContainer{},
-	}
-	volumes := map[string]volume.Volume{}
-	fakeDockerDaemon(t, func(writer http.ResponseWriter, request *http.Request) {
-		path := strings.TrimPrefix(request.URL.Path, "/v1.47")
-		switch {
-		case path == "/volumes/create":
-			options := volume.Volume{CreatedAt: now.Format(time.RFC3339)}
-			assert.NoError(t, json.UnmarshalRead(request.Body, &options))
-			volumes[options.Name] = options
-			assert.NoError(t, json.MarshalWrite(writer, volumes[options.Name]))
-		case path == "/volumes":
-			assert.JSONEq(t, `{"label":{"com.gitea.runner.uuid=runner-1":true},"dangling":{"true":true}}`, request.URL.Query().Get("filters"))
-			assert.NoError(t, json.MarshalWrite(writer, map[string]any{"Volumes": slices.Collect(maps.Values(volumes))}))
-		case request.Method == http.MethodDelete:
-			name := strings.TrimPrefix(path, "/volumes/")
-			assert.NotContains(t, []string{"1", "true"}, request.URL.Query().Get("force"))
-			if name == "became-active" || name == "remove-failed" {
-				writer.WriteHeader(http.StatusConflict)
-				_, _ = fmt.Fprintf(writer, `{"message":%q}`, name)
-				return
-			}
-			delete(volumes, name)
-			writer.WriteHeader(http.StatusNoContent)
-		default:
-			t.Errorf("unexpected Docker request: %s %s", request.Method, request.URL)
-		}
-	})
-	name := rc.jobContainerName()
-	require.NoError(t, rc.createJobVolumes(t.Context(), map[string]string{name: "/workspace", name + "-env": "/var/run/act", "shared-cache": "/cache"}))
-	assert.ElementsMatch(t, []string{name, name + "-env"}, slices.Collect(maps.Keys(volumes)))
-	rc.deferVolumeCleanup = func(common.Executor) {}
-	require.NoError(t, rc.cleanupJobResources("", false, false)(t.Context()))
-	require.Len(t, volumes, 2)
-	for _, name := range []string{"became-active", "remove-failed"} {
-		volumes[name] = volume.Volume{Name: name, Labels: volumes[rc.jobContainerName()].Labels, CreatedAt: now.Format(time.RFC3339)}
-	}
-	volumes["foreign"] = volume.Volume{Name: "foreign", Labels: map[string]string{"com.gitea.runner.uuid": "runner-2"}, CreatedAt: now.Format(time.RFC3339)}
-	volumes["fresh"] = volume.Volume{Name: "fresh", Labels: volumes[name].Labels, CreatedAt: now.Add(48 * time.Hour).Format(time.RFC3339)}
-	volumes["unknown-age"] = volume.Volume{Name: "unknown-age", Labels: volumes[name].Labels}
-	err := container.RemoveOrphanJobVolumes(t.Context(), "runner-1", now.Add(24*time.Hour))
-	require.ErrorContains(t, err, "became-active")
-	require.ErrorContains(t, err, "remove-failed")
-	assert.ElementsMatch(t, []string{"became-active", "remove-failed", "foreign", "fresh", "unknown-age"}, slices.Collect(maps.Keys(volumes)))
-}
-
+// cleanup used to bail out on a previous step's error and on a cancelled context
 func TestCleanupJobResourcesContinuesAfterFailure(t *testing.T) {
-	t.Setenv("TMPDIR", "/tmp")
-	proxyDir := t.TempDir()
-	for _, name := range []string{"synchronous", "proxy", "closed proxy", "deferred", "preclean deferred", "canceled"} {
-		t.Run(name, func(t *testing.T) {
-			proxy, preclean, deferred := strings.HasSuffix(name, "proxy"), strings.HasPrefix(name, "preclean"), strings.HasSuffix(name, "deferred")
-			if proxy && runtime.GOOS == "windows" {
-				t.Skip("Unix socket ownership is unavailable on Windows")
-			}
-			jobError, removeError, closeError := errors.New("remove job"), errors.New("remove service"), errors.New("close service")
-			job, service := &containerMock{}, &containerMock{}
-			job.On("Remove").Return(func(context.Context) error { return jobError }).Once()
-			service.On("Remove").Return(func(context.Context) error { return removeError }).Once()
-			service.On("Close").Return(func(context.Context) error { return closeError }).Once()
-			rc := &RunContext{
-				Config:            &Config{CacheContainer: "cache-container"},
-				Run:               &model.Run{Workflow: &model.Workflow{Name: "wf"}, JobID: "job"},
-				JobContainer:      job,
-				serviceContainers: []*serviceContainer{{name: "svc", container: service}},
-			}
-			var volumeCleanup []common.Executor
-			if deferred {
-				rc.deferVolumeCleanup = func(cleanup common.Executor) { volumeCleanup = append(volumeCleanup, cleanup) }
-			}
-			volumeRemovals := 0
-			fakeDockerDaemon(t, func(writer http.ResponseWriter, request *http.Request) {
-				if request.Method == http.MethodDelete {
-					volumeRemovals++
-				}
-				operation := request.Method + " " + strings.TrimPrefix(request.URL.Path, "/v1.47")
-				if request.URL.Query().Has("filters") {
-					operation = "labelled " + operation
-				}
-				writer.WriteHeader(http.StatusInternalServerError)
-				_, _ = fmt.Fprintf(writer, `{"message":%q}`, operation)
-			})
-			if proxy {
-				listener, err := net.Listen("unix", filepath.Join(proxyDir, "d.sock"))
-				require.NoError(t, err)
-				t.Cleanup(func() { require.NoError(t, listener.Close()) })
-				rc.dockerProxy, err = container.StartDockerProxy(listener.Addr().String(), proxyDir, rc.jobContainerName())
-				require.NoError(t, err)
-				t.Cleanup(func() { require.NoError(t, rc.closeDockerProxy(context.Background())) })
-				if name == "closed proxy" {
-					require.NoError(t, rc.closeDockerProxy(t.Context()))
-				}
-			}
-			ctx, cancel := context.WithCancel(t.Context())
-			defer cancel()
-			if name == "canceled" {
-				cancel()
-			}
-			err := rc.cleanupJobResources("job-network", true, preclean)(ctx)
-			if deferred && !preclean {
-				require.Len(t, volumeCleanup, 1)
-				assert.Zero(t, volumeRemovals)
-				err = errors.Join(err, volumeCleanup[0](ctx))
-			} else {
-				assert.Empty(t, volumeCleanup)
-			}
-			for _, failure := range []error{jobError, removeError, closeError} {
-				require.ErrorIs(t, err, failure)
-			}
-			if name == "canceled" {
-				require.ErrorIs(t, err, context.Canceled)
-			} else {
-				for _, operation := range []string{"DELETE /volumes/" + rc.jobContainerName(), "DELETE /volumes/" + rc.jobContainerName() + "-env", "POST /networks/job-network/disconnect", "GET /networks"} {
-					require.ErrorContains(t, err, operation)
-				}
-				assert.Equal(t, 2, volumeRemovals)
-			}
-			assert.Equal(t, proxy || preclean, strings.Contains(err.Error(), "labelled GET /containers/json"))
-			if proxy || preclean {
-				require.ErrorContains(t, err, "labelled GET /networks")
-				require.ErrorContains(t, err, "labelled GET /volumes")
-			}
-			assert.Nil(t, rc.dockerProxy)
-			assert.Equal(t, proxy, rc.hadDockerProxy)
-		})
+	t.Setenv("DOCKER_HOST", "unix:///nonexistent.sock")
+
+	jobContainer := &containerMock{}
+	jobContainer.On("Remove").Return(func(context.Context) error { return errors.New("removal failed") }).Once()
+	service := &containerMock{}
+	service.On("Remove").Return(func(context.Context) error { return nil }).Once()
+	service.On("Close").Return(func(context.Context) error { return nil }).Once()
+
+	rc := &RunContext{
+		Name:              "job",
+		Config:            &Config{},
+		Run:               &model.Run{Workflow: &model.Workflow{Name: "wf"}, JobID: "job"},
+		JobContainer:      jobContainer,
+		serviceContainers: []*serviceContainer{{name: "svc", container: service}},
 	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	require.Error(t, rc.cleanupJobResources("job-network", true)(ctx))
+	jobContainer.AssertExpectations(t)
+	service.AssertExpectations(t)
 }
 
-func TestInterpolateOutputsIsPerMatrixComboKeepingNeedsOutputs(t *testing.T) {
+// TestInterpolateOutputsIsPerMatrixCombo guards the matrix-output fix: combinations share one
+// *model.Job, so each must interpolate from its own pristine snapshot. Otherwise the first
+// combo's resolved value freezes the shared template and later combos can't resolve their own.
+func TestInterpolateOutputsIsPerMatrixCombo(t *testing.T) {
 	job := &model.Job{Outputs: map[string]string{"o": "${{ matrix.v }}"}}
-	require.NoError(t, job.RawOutputs.Encode(job.Outputs))
-	needed := &model.Job{Outputs: map[string]string{"o": "from-gitea"}}
-	run := &model.Run{JobID: "j", Workflow: &model.Workflow{Name: "w", Jobs: map[string]*model.Job{"j": job, "needed": needed}}}
+	run := &model.Run{JobID: "j", Workflow: &model.Workflow{Name: "w", Jobs: map[string]*model.Job{"j": job}}}
 	r := &runnerImpl{config: &Config{}}
 	ctx := context.Background()
 
-	_, err := r.newRunContext(ctx, &model.Run{JobID: "needed", Workflow: run.Workflow}, nil)
-	require.NoError(t, err)
 	rcA, err := r.newRunContext(ctx, run, map[string]any{"v": "a"})
 	require.NoError(t, err)
 	rcB, err := r.newRunContext(ctx, run, map[string]any{"v": "b"})
 	require.NoError(t, err)
-	rcEmpty, err := r.newRunContext(ctx, run, map[string]any{"v": ""})
-	require.NoError(t, err)
-	require.Empty(t, job.Outputs)
 
 	require.NoError(t, rcA.interpolateOutputs()(ctx))
 	require.NoError(t, rcB.interpolateOutputs()(ctx))
-	require.NoError(t, rcEmpty.interpolateOutputs()(ctx))
 
-	require.Equal(t, map[string]string{"o": "b"}, job.Outputs)
-	require.Equal(t, map[string]string{"o": "from-gitea"}, needed.Outputs)
-}
-
-// A whole-value `outputs:` expression only reaches the typed field through DecodeRaw.
-func TestInterpolateOutputsFromExpression(t *testing.T) {
-	var rawOutputs yaml.Node
-	require.NoError(t, rawOutputs.Encode(`${{ fromJSON('{"o":"resolved"}') }}`))
-
-	job := &model.Job{RawOutputs: rawOutputs}
-	run := &model.Run{JobID: "j", Workflow: &model.Workflow{Name: "w", Jobs: map[string]*model.Job{"j": job}}}
-	rc, err := (&runnerImpl{config: &Config{}}).newRunContext(t.Context(), run, nil)
-	require.NoError(t, err)
-
-	require.NoError(t, rc.interpolateOutputs()(t.Context()))
-	require.Equal(t, "resolved", job.Outputs["o"])
+	// Last combo wins (matching GitHub) instead of being frozen to combo A's "a".
+	require.Equal(t, "b", job.Outputs["o"])
 }
 
 func TestGetGitHubContext(t *testing.T) {
@@ -908,12 +735,6 @@ func TestGetGitHubContext(t *testing.T) {
 	assert.Equal(t, ghc.RunnerPerflog, "/dev/null") //nolint:testifylint // pre-existing issue from nektos/act
 	assert.Equal(t, ghc.Token, rc.Config.Secrets["GITHUB_TOKEN"])
 	assert.Equal(t, ghc.Job, "job1") //nolint:testifylint // pre-existing issue from nektos/act
-
-	rc.Config.PresetGitHubContext = &model.GithubContext{Actor: "preset-actor", TriggeringActor: "triggerer", Job: "preset-job"}
-	ghc = rc.getGithubContext(context.Background())
-	assert.Equal(t, "preset-actor", ghc.Actor)
-	assert.Equal(t, "triggerer", ghc.TriggeringActor)
-	assert.Equal(t, "job1", ghc.Job)
 }
 
 func TestGetGithubContextRef(t *testing.T) {
@@ -1143,13 +964,6 @@ if: always()`, ""),
 if: false`, ""),
 	})
 	assertObject.False(rc.isEnabled(context.Background()))
-
-	rc = createIfTestRunContext(map[string]*model.Job{
-		"job1": createJob(t, `if: ${{ fromJSON('not-json') }}`, ""),
-	})
-	enabled, err := rc.isEnabled(context.Background())
-	require.NoError(t, err)
-	assertObject.False(enabled)
 }
 
 func TestRunContextGetEnv(t *testing.T) {
@@ -1251,109 +1065,57 @@ func TestRunContext_cleanupFailedStart(t *testing.T) {
 	type ctxKey string
 	const sentinel = ctxKey("sentinel")
 
-	for name, canceled := range map[string]bool{"cancellation during cleanup": false, "already canceled": true} {
-		t.Run(name, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.WithValue(t.Context(), sentinel, "v"))
-			defer cancel()
-			if canceled {
-				cancel()
-			}
-			calls := 0
-			(&RunContext{cleanUpJobContainer: func(ctx context.Context) error {
-				calls++
-				cancel()
-				deadline, ok := ctx.Deadline()
-				require.True(t, ok)
-				assert.WithinDuration(t, time.Now().Add(time.Minute), deadline, time.Second)
-				require.NoError(t, ctx.Err())
-				assert.Equal(t, "v", ctx.Value(sentinel))
+	// the fresh context is cancelled via defer on return, so capture state inside the stub
+	type capture struct {
+		calls    int
+		err      error
+		sentinel any
+	}
+	newRC := func(c *capture) *RunContext {
+		return &RunContext{
+			JobName: "job",
+			cleanUpJobContainer: func(ctx context.Context) error {
+				c.calls++
+				c.err = ctx.Err()
+				c.sentinel = ctx.Value(sentinel)
 				return nil
-			}}).cleanupFailedStart(ctx)
-			assert.Equal(t, 1, calls)
-		})
+			},
+		}
 	}
 
-	for _, testcase := range []struct {
-		name, health          string
-		pullError, startError error
-	}{
-		{name: "healthy", health: container.HealthHealthy},
-		{name: "unhealthy", health: container.HealthUnhealthy},
-		{name: "pull failure", pullError: errors.New("pull failed")},
-		{name: "start failure", startError: errors.New("start failed")},
-	} {
-		t.Run(testcase.name, func(t *testing.T) {
-			var operations []string
-			record := func(operation string, failure error) func(context.Context) error {
-				return func(context.Context) error {
-					operations = append(operations, operation)
-					return failure
-				}
-			}
-			job, service := &containerMock{}, &containerMock{}
-			for name, instance := range map[string]*containerMock{"job": job, "service": service} {
-				instance.On("Pull", true).Return(record(name+".Pull", map[string]error{"job": testcase.pullError}[name]))
-				instance.On("Create", mock.Anything, mock.Anything).Return(record(name+".Create", nil))
-				instance.On("Start", false).Return(record(name+".Start", map[string]error{"service": testcase.startError}[name]))
-				instance.On("Remove").Return(record(name+".Remove", nil))
-				instance.On("Close").Return(record(name+".Close", nil))
-			}
-			job.On("Copy", mock.Anything, mock.Anything).Return(record("job.Copy", nil))
-			job.On("Inspect", mock.Anything).Return(&container.Info{ID: "job-id"}, nil).
-				Run(func(mock.Arguments) { operations = append(operations, "job.Inspect") })
-			for _, health := range []string{container.HealthStarting, testcase.health} {
-				service.On("Inspect", mock.Anything).Return(&container.Info{State: "running", Health: health}, nil).
-					Run(func(mock.Arguments) { operations = append(operations, "service.Inspect") }).Once()
-			}
-			stdouts := map[string]io.Writer{}
-			service.On("DumpLogs", mock.Anything).Return(nil).Run(func(mock.Arguments) {
-				operations = append(operations, "service.DumpLogs")
-				fmt.Fprintln(stdouts["postgres:latest"], "::add-mask::leak")
-			})
-			origNewContainer := newContainer
-			newContainer = func(input *container.NewContainerInput) container.ExecutionsEnvironment {
-				stdouts[input.Image] = input.Stdout
-				return map[string]*containerMock{"postgres:latest": service, "node:20": job}[input.Image]
-			}
-			t.Cleanup(func() { newContainer = origNewContainer })
-			workflow, err := model.ReadWorkflow(strings.NewReader("jobs: {job: {services: {postgres: {image: postgres:latest}}}}"))
-			require.NoError(t, err)
-			rc := &RunContext{
-				Config:        &Config{ForcePull: true, ContainerNetworkMode: "host", Workdir: "/workspace"},
-				Run:           &model.Run{JobID: "job", Workflow: workflow},
-				platformImage: "node:20",
-			}
-			logger, hook := logrustest.NewNullLogger()
-			ctx := common.WithLogger(common.WithDryrun(t.Context(), true), logger)
-			rc.ExprEval = rc.NewExpressionEvaluator(ctx)
-			err = rc.startContainer().Then(rc.stopContainer()).Finally(rc.closeContainer())(ctx)
-			want := "job.Remove service.Remove service.Close service.Pull job.Pull"
-			switch {
-			case testcase.pullError != nil:
-				require.ErrorIs(t, err, testcase.pullError)
-			case testcase.startError != nil:
-				require.ErrorIs(t, err, testcase.startError)
-				want += " service.Create service.Start service.DumpLogs"
-			default:
-				want += " service.Create service.Start service.Inspect job.Create job.Start job.Inspect job.Copy service.Inspect service.DumpLogs"
-				if testcase.health == container.HealthUnhealthy {
-					require.ErrorContains(t, err, "the service 'postgres' is unhealthy")
-				} else {
-					require.NoError(t, err)
-				}
-			}
-			assert.Equal(t, strings.Fields(want+" job.Remove service.Remove service.Close job.Close"), operations)
-			assert.Empty(t, rc.Masks)
-			assert.Equal(t, testcase.pullError == nil && testcase.health != container.HealthUnhealthy, slices.ContainsFunc(hook.AllEntries(), func(entry *log.Entry) bool {
-				return strings.HasPrefix(entry.Message, "::group::Print service container logs")
-			}))
-		})
-	}
+	t.Run("runs teardown on the live context", func(t *testing.T) {
+		var c capture
+		ctx := context.WithValue(context.Background(), sentinel, "v")
 
-	(&RunContext{}).cleanupFailedStart(t.Context())
+		newRC(&c).cleanupFailedStart(ctx)
+
+		assert.Equal(t, 1, c.calls)
+		require.NoError(t, c.err)
+		assert.Equal(t, "v", c.sentinel)
+	})
+
+	t.Run("falls back to a fresh context when the input is done", func(t *testing.T) {
+		var c capture
+		ctx, cancel := context.WithCancel(context.WithValue(context.Background(), sentinel, "v"))
+		cancel()
+
+		newRC(&c).cleanupFailedStart(ctx)
+
+		assert.Equal(t, 1, c.calls)
+		require.NoError(t, c.err)
+		assert.Nil(t, c.sentinel)
+	})
+
+	t.Run("no-op when there is nothing to clean up", func(t *testing.T) {
+		assert.NotPanics(t, func() { (&RunContext{}).cleanupFailedStart(context.Background()) })
+	})
 }
 
 func TestWaitForServiceContainers(t *testing.T) {
+	origInterval := serviceReadyPollInterval
+	serviceReadyPollInterval = time.Millisecond
+	defer func() { serviceReadyPollInterval = origInterval }()
+
 	newRunContext := func(timeout time.Duration, services ...*serviceContainer) *RunContext {
 		return &RunContext{
 			Config:            &Config{ServiceReadyTimeout: timeout},
@@ -1371,26 +1133,16 @@ func TestWaitForServiceContainers(t *testing.T) {
 		service.AssertExpectations(t)
 	})
 
-	t.Run("polls at a fixed interval and logs starting only once", func(t *testing.T) {
-		synctest.Test(t, func(t *testing.T) {
-			var pollTimes []time.Duration
-			started := time.Now()
-			service := &containerMock{}
-			service.On("Inspect", mock.Anything).
-				Run(func(_ mock.Arguments) { pollTimes = append(pollTimes, time.Since(started)) }).
-				Return(&container.Info{ID: "id", State: "running", Health: container.HealthStarting}, nil).Twice()
-			service.On("Inspect", mock.Anything).
-				Run(func(_ mock.Arguments) { pollTimes = append(pollTimes, time.Since(started)) }).
-				Return(&container.Info{ID: "id", State: "running", Health: container.HealthHealthy}, nil).Once()
+	t.Run("waits while a service is still starting", func(t *testing.T) {
+		service := &containerMock{}
+		service.On("Inspect", mock.Anything).
+			Return(&container.Info{ID: "id", State: "running", Health: container.HealthStarting}, nil).Twice()
+		service.On("Inspect", mock.Anything).
+			Return(&container.Info{ID: "id", State: "running", Health: container.HealthHealthy}, nil).Once()
 
-			var output bytes.Buffer
-			logger := log.New()
-			logger.SetOutput(&output)
-			require.NoError(t, newRunContext(0, &serviceContainer{name: "postgres", container: service}).waitForServiceContainers()(common.WithLogger(t.Context(), logger.WithFields(nil))))
-			assert.Equal(t, []time.Duration{0, time.Second, 2 * time.Second}, pollTimes)
-			assert.Equal(t, 1, strings.Count(output.String(), "postgres service is starting."))
-			assert.Contains(t, output.String(), "postgres service is healthy.")
-		})
+		rc := newRunContext(0, &serviceContainer{name: "postgres", container: service})
+		require.NoError(t, rc.waitForServiceContainers()(context.Background()))
+		service.AssertExpectations(t)
 	})
 
 	t.Run("fails with the probe output when a service is unhealthy", func(t *testing.T) {
@@ -1543,29 +1295,6 @@ func TestGetJobContextReportsContainers(t *testing.T) {
 	}, jobContext.Services)
 }
 
-func TestCaptureJobContainerInfoExportsDockerWorkspace(t *testing.T) {
-	job := &containerMock{}
-	job.On("Inspect", mock.Anything).Return(&container.Info{
-		ID:     "job-container-id",
-		Mounts: map[string]string{"/workspace": "/var/lib/docker/volumes/job/_data"},
-	}, nil)
-	rc := &RunContext{
-		Config:       &Config{Workdir: "/workspace/owner/repo/"},
-		Env:          map[string]string{},
-		JobContainer: job,
-	}
-
-	require.NoError(t, rc.captureJobContainerInfo()(context.Background()))
-
-	assert.Equal(t, "job-container-id", rc.jobContainerID)
-	assert.Equal(t, "/var/lib/docker/volumes/job/_data/owner/repo", rc.Env["GITEA_DOCKER_WORKSPACE"])
-
-	rc.Config.Workdir = "/elsewhere"
-	rc.Env = map[string]string{}
-	require.NoError(t, rc.captureJobContainerInfo()(context.Background()))
-	assert.NotContains(t, rc.Env, "GITEA_DOCKER_WORKSPACE")
-}
-
 // A job that never started a container reports an empty context, not a placeholder.
 func TestGetJobContextWithoutContainer(t *testing.T) {
 	jobContext := (&RunContext{}).getJobContext()
@@ -1602,39 +1331,12 @@ func TestImageOSFromImage(t *testing.T) {
 	}
 }
 
-func TestResolvePlatformImageAppliesImagelessContainerToRunsOnImage(t *testing.T) {
-	for _, tc := range []struct {
-		name, image string
-		want        model.ContainerSpec
-	}{
-		{"without image key", "", model.ContainerSpec{Volumes: []string{"/host/data:/data"}, Env: map[string]string{"KEY": "value"}}},
-		{"with empty image", "image: '', ", model.ContainerSpec{}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			rc := createIfTestRunContext(map[string]*model.Job{
-				"job1": createJob(t, "runs-on: toolkit\ncontainer: {"+tc.image+"volumes: [/host/data:/data], env: {KEY: value}}", ""),
-			})
-			require.NoError(t, rc.resolvePlatformImage(t.Context()))
-			require.NoError(t, evaluateJobEnvAndDefaults(t.Context(), rc))
-
-			assert.Equal(t, "ubuntu-latest", rc.platformImage)
-			assert.Equal(t, tc.want, rc.containerSpec)
-		})
-	}
-}
-
 func createRunsOnRunContext(t *testing.T, runsOn string) *RunContext {
 	return createIfTestRunContext(map[string]*model.Job{
 		"job1": createJob(t, "runs-on: "+runsOn, ""),
 	})
 }
 
-func TestRunContextContainerImageCannotSelectHost(t *testing.T) {
-	rc := createIfTestRunContext(map[string]*model.Job{"job1": createJob(t, "container: -self-hosted", "")})
-	require.NoError(t, rc.resolvePlatformImage(t.Context()))
-	assert.False(t, rc.IsHostEnv())
-}
-
 func TestRunContextImageOS(t *testing.T) {
 	ctx := context.Background()
 
@@ -1748,10 +1450,6 @@ func TestRunContextWithGithubEnvRunnerValues(t *testing.T) {
 	rc := createRunsOnRunContext(t, "ubuntu-latest")
 	rc.Config.RunnerName = "runner-1"
 	rc.Config.Secrets = map[string]string{"ACTIONS_STEP_DEBUG": "true"}
-	t.Setenv("ACTIONS_RUNTIME_URL", "")
-	rc.Config.ArtifactServerPath = "artifacts"
-	rc.Config.ArtifactServerAddr = "2001:db8::1"
-	rc.Config.ArtifactServerPort = "8080"
 
 	env := map[string]string{}
 	rc.withGithubEnv(ctx, &model.GithubContext{Workspace: "/workspace/owner/repo"}, env)
@@ -1760,5 +1458,26 @@ func TestRunContextWithGithubEnvRunnerValues(t *testing.T) {
 	assert.Equal(t, "self-hosted", env["RUNNER_ENVIRONMENT"])
 	assert.Equal(t, "/workspace/owner", env["RUNNER_WORKSPACE"])
 	assert.Equal(t, "1", env["RUNNER_DEBUG"])
-	assert.Equal(t, "http://[2001:db8::1]:8080/", env["ACTIONS_RUNTIME_URL"])
+}
+
+func TestRunContextMacOSVMPlatform(t *testing.T) {
+	rc := createRunsOnRunContext(t, "macos-latest")
+	rc.Config.PlatformPicker = func([]string) string {
+		return labels.MacOSVMSchemePrefix + "ghcr.io/cirruslabs/macos-sonoma-base:latest"
+	}
+	require.NoError(t, rc.resolvePlatformImage(t.Context()))
+
+	assert.True(t, rc.IsMacOSVMEnv())
+	assert.False(t, rc.IsHostEnv())
+	assert.Equal(t, "ghcr.io/cirruslabs/macos-sonoma-base:latest", rc.macOSVMImage())
+}
+
+func TestRunContextMacOSVMGuestWorkdir(t *testing.T) {
+	rc := createRunsOnRunContext(t, "macos-latest")
+	rc.Config.Workdir = "/workspace/owner/repo"
+	rc.Config.MacOSVM.WorkdirParent = "/Users/admin/runner"
+	rc.Config.RunnerUUID = "runner-1"
+
+	assert.Equal(t, "/Users/admin/runner/workspace/owner/repo", rc.macOSVMGuestWorkdir())
+	assert.Contains(t, rc.macOSVMName(), "GITEA-MACOS-VM-runner-1-")
 }

act/runner/runner.go

@@ -7,6 +7,7 @@ package runner
 import (
 	"context"
 	"fmt"
+	"maps"
 	"os"
 	"runtime"
 	"sync"
@@ -14,12 +15,10 @@ import (
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/act/ghcontext"
 
 	"gitea.dev/actionslib/pkg/model"
 	docker_container "github.com/moby/moby/api/types/container"
 	log "github.com/sirupsen/logrus"
-	"go.yaml.in/yaml/v4"
 )
 
 // Config contains the config for a new runner
@@ -57,12 +56,10 @@ type Config struct {
 	DisableActEnv                 bool                                          // do not inject the ACT=true environment variable into jobs
 	ContainerNetworkMode          docker_container.NetworkMode                  // the network mode of job containers (the value of --network)
 	ContainerNetworkCreateOptions container.NewDockerNetworkCreateExecutorInput // the default network create options
-	CacheContainer                string                                        // let jobs reach an otherwise isolated cache
 	ProxyEnv                      map[string]string                             // the proxy variables the job runs with, also given to service containers and image builds
 	NoActionPatch                 bool                                          // run actions exactly as published, applying no compatibility patches, see patch_actions.go
 
 	PresetGitHubContext   *model.GithubContext // overrides actor, ref, repository, token and related context fields
-	WorkflowCallInputs    map[string]any       // the `inputs` Gitea resolved for a called workflow's job, nil for other jobs
 	EventJSON             string               // the content of JSON file to use for event.json in containers, overrides EventPath
 	ContainerNamePrefix   string               // the prefix of container name
 	ContainerMaxLifetime  time.Duration        // the max lifetime of job containers
@@ -82,9 +79,20 @@ type Config struct {
 	MaxParallel                       int           // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
 	AllocatePTY                       bool          // allocate a pseudo-TTY for each step's process
 	ServiceReadyTimeout               time.Duration // how long a job waits for its service containers to report healthy (0 uses the default)
+	RunnerUUID                        string        // UUID this runner registered with, used to identify its macOS VMs
 	RunnerName                        string        // name this runner registered with, reported as `runner.name`, defaults to the hostname
 	JobStartedHook                    string        // script run inside the job environment before the job's first step; ACTIONS_RUNNER_HOOK_JOB_STARTED is read from Env when empty
 	JobCompletedHook                  string        // script run inside the job environment after the job's last step; ACTIONS_RUNNER_HOOK_JOB_COMPLETED is read from Env when empty
+	MacOSVM                           MacOSVMConfig // configures the macOS VM executor
+}
+
+// MacOSVMConfig contains the macOS VM executor settings that come from the runner config.
+type MacOSVMConfig struct {
+	ExecutorPath  string        // path to the runner-executor-macos binary
+	WorkdirParent string        // guest directory under which the job workspace is created
+	CPU           int           // number of virtual CPUs, 0 keeps the image default
+	Memory        int           // VM memory in megabytes, 0 keeps the image default
+	BootTimeout   time.Duration // how long to wait for the VM to become ready
 }
 
 // RunnerDebug reports whether debug logging is on, exposed as `runner.debug` and
@@ -158,18 +166,6 @@ func (runner *runnerImpl) configure() (*runnerImpl, error) {
 	return runner, nil
 }
 
-func maxParallelFor(strategy *model.Strategy, combinations int) int {
-	maxParallel := 4 // actionslib has no default for an undeclared max-parallel
-	if strategy != nil {
-		if limit, err := strategy.MaxParallel(); err != nil {
-			log.Errorf("Ignoring invalid max-parallel: %v", err)
-		} else if limit > 0 {
-			maxParallel = limit
-		}
-	}
-	return min(maxParallel, combinations)
-}
-
 // NewPlanExecutor ...
 func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
 	maxJobNameLen := 0
@@ -206,29 +202,21 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
 				log.Debugf("Job.With: %v", job.With)
 				log.Debugf("Job.Result: %v", job.Result)
 
-				if job.Strategy != nil || job.RawStrategy.Kind == yaml.ScalarNode {
+				if job.Strategy != nil {
+					log.Debugf("Job.Strategy.FailFast: %v", job.Strategy.FailFast)
+					log.Debugf("Job.Strategy.MaxParallel: %v", job.Strategy.MaxParallel)
+					log.Debugf("Job.Strategy.FailFastString: %v", job.Strategy.FailFastString)
+					log.Debugf("Job.Strategy.MaxParallelString: %v", job.Strategy.MaxParallelString)
+					log.Debugf("Job.Strategy.RawMatrix: %v", job.Strategy.RawMatrix)
+
 					strategyRc, err := runner.newRunContext(ctx, run, nil)
 					if err != nil {
 						return err
 					}
-					if job.RawStrategy.Kind == yaml.ScalarNode {
-						if err := model.DecodeEvaluated("job strategy", job.RawStrategy, strategyRc.ExprEval.shared(ctx).EvaluateYamlNode, &job.Strategy); err != nil {
-							return err
-						}
-					} else {
-						log.Debugf("Job.Strategy.FailFast: %v", job.Strategy.GetFailFast())
-						log.Debugf("Job.Strategy.FailFastString: %v", job.Strategy.FailFastString)
-						log.Debugf("Job.Strategy.MaxParallelString: %v", job.Strategy.MaxParallelString)
-						log.Debugf("Job.Strategy.RawMatrix: %v", job.Strategy.RawMatrix)
-						// An unevaluated expression is left in place, which GetMatrixes below rejects.
-						if err := strategyRc.NewExpressionEvaluator(ctx).EvaluateYamlNode(ctx, &job.Strategy.RawMatrix); err != nil {
-							log.Errorf("Error while evaluating matrix: %v", err)
-						}
-						for _, value := range []*string{&job.Strategy.FailFastString, &job.Strategy.MaxParallelString} {
-							if evaluated, err := strategyRc.ExprEval.Interpolate(ctx, *value); err == nil {
-								*value = evaluated
-							}
-						}
+					// Resolve template expressions in the matrix node before Matrix() is called.
+					// On failure the literal string is kept and normalizeMatrixValue wraps it as a fallback.
+					if err := strategyRc.NewExpressionEvaluator(ctx).EvaluateYamlNode(ctx, &job.Strategy.RawMatrix); err != nil {
+						log.Errorf("Error while evaluating matrix: %v", err)
 					}
 				}
 
@@ -238,21 +226,25 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
 				}
 				log.Debugf("Job Matrices: %v", matrixes)
 
-				maxParallel := maxParallelFor(job.Strategy, len(matrixes))
+				maxParallel := 4
+				if job.Strategy != nil {
+					// Ensure GetMaxParallel() is called if MaxParallel is still 0
+					if job.Strategy.MaxParallel == 0 {
+						job.Strategy.MaxParallel = job.Strategy.GetMaxParallel()
+					}
+					maxParallel = job.Strategy.MaxParallel
+					log.Debugf("Using job.Strategy.MaxParallel: %d", maxParallel)
+				}
+
+				if len(matrixes) < maxParallel {
+					log.Debugf("Adjusting maxParallel from %d to %d (number of matrix combinations)", maxParallel, len(matrixes))
+					maxParallel = len(matrixes)
+				}
 
 				log.Infof("Running job with maxParallel=%d for %d matrix combinations", maxParallel, len(matrixes))
 
 				for i, matrix := range matrixes {
-					index, total := i, len(matrixes)
-					if runner.caller == nil && runner.config.PresetGitHubContext != nil && len(matrix) > 0 {
-						var expanded struct {
-							Index int `yaml:"job-index"`
-							Total int `yaml:"job-total"`
-						}
-						_ = job.RawStrategy.Decode(&expanded) // Gitea expanded the combination, a version writing neither leaves them unknown
-						index, total = expanded.Index, expanded.Total
-					}
-					rc, err := runner.newCombinationRunContext(ctx, run, matrix, index, total)
+					rc, err := runner.newRunContext(ctx, run, matrix)
 					if err != nil {
 						return err
 					}
@@ -324,8 +316,7 @@ func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
 		})
 	}
 
-	executor := common.NewPipelineExecutor(stagePipeline...).Then(handleFailure(plan))
-	return func(ctx context.Context) error { return executor(ghcontext.WithPinnedCheckout(ctx)) }
+	return common.NewPipelineExecutor(stagePipeline...).Then(handleFailure(plan))
 }
 
 func handleFailure(plan *model.Plan) common.Executor {
@@ -342,10 +333,6 @@ func handleFailure(plan *model.Plan) common.Executor {
 }
 
 func (runner *runnerImpl) newRunContext(ctx context.Context, run *model.Run, matrix map[string]any) (*RunContext, error) {
-	return runner.newCombinationRunContext(ctx, run, matrix, 0, 1)
-}
-
-func (runner *runnerImpl) newCombinationRunContext(ctx context.Context, run *model.Run, matrix map[string]any, index, total int) (*RunContext, error) {
 	rc := &RunContext{
 		Config:      runner.config,
 		Run:         run,
@@ -353,16 +340,16 @@ func (runner *runnerImpl) newCombinationRunContext(ctx context.Context, run *mod
 		StepResults: make(map[string]*model.StepResult),
 		Matrix:      matrix,
 		caller:      runner.caller,
-		jobIndex:    index,
-		jobTotal:    total,
 	}
 	if err := rc.resolveWorkflowCall(ctx); err != nil {
 		return nil, err
 	}
 	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
 	rc.Name = rc.maskSecrets(rc.ExprEval.InterpolateName(ctx, run.String()))
-	if job := run.Job(); job != nil && job.RawOutputs.Kind != 0 {
-		job.Outputs = nil // a job no combination ran for reads "" as on GitHub, a Gitea needs placeholder has no RawOutputs and keeps its outputs
+	// Snapshot the job's pristine output expressions now, before any matrix combo runs and
+	// rewrites the shared Job.Outputs (see interpolateOutputs).
+	if job := run.Job(); job != nil {
+		rc.outputTemplate = maps.Clone(job.Outputs)
 	}
 
 	return rc, nil

act/runner/runner_test.go

@@ -7,7 +7,6 @@ package runner
 import (
 	"bytes"
 	"context"
-	"crypto/rand"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -30,7 +29,6 @@ var (
 	logLevel  = log.DebugLevel
 	workdir   = "testdata"
 	secrets   map[string]string
-	testRunID = strings.ToLower(rand.Text()[:8]) // keeps docker names apart from concurrent test processes on one daemon
 )
 
 func mapPlatformPicker(platforms map[string]string) func([]string) string {
@@ -218,7 +216,7 @@ func (j *TestJobFileInfo) runTest(ctx context.Context, t *testing.T, cfg *Config
 		EventPath:      cfg.EventPath,
 		PlatformPicker: mapPlatformPicker(j.platforms),
 		// fixtures reuse workflow and job names, so parallel tests would collide without this
-		ContainerNamePrefix: strings.ReplaceAll(t.Name(), "/", "-") + "-" + testRunID,
+		ContainerNamePrefix: strings.ReplaceAll(t.Name(), "/", "-"),
 		// 0 would run jobs runtime.NumCPU()-wide, making the network peak machine-dependent
 		MaxParallel:           2,
 		ForceRebuild:          true,
@@ -348,7 +346,7 @@ func TestRunEvent(t *testing.T) {
 
 			config := &Config{
 				Secrets: table.secrets,
-				Env:     map[string]string{"GITHUB_REPOSITORY": t.Name() + "-" + testRunID},
+				Env:     map[string]string{"GITHUB_REPOSITORY": t.Name()},
 			}
 
 			eventFile := filepath.Join(workdir, table.workflowPath, "event.json")
@@ -434,7 +432,6 @@ func TestRunEventHostEnvironment(t *testing.T) {
 
 		tables = append(tables, []TestJobFileInfo{
 			{workdir, "nix-prepend-path", "push", "", platforms, secrets},
-			{workdir, "builtin-checkout", "push", "", platforms, secrets},
 			{workdir, "inputs-via-env-context", "push", "", platforms, secrets},
 			{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
 			{workdir, "set-env-step-env-override", "push", "", platforms, secrets},

act/runner/step.go

@@ -11,11 +11,11 @@ import (
 	"path"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/internal/pkg/telemetry"
 
 	"gitea.dev/actionslib/pkg/exprparser"
 	"gitea.dev/actionslib/pkg/model"
@@ -66,34 +66,28 @@ func processRunnerEnvFileCommand(ctx context.Context, fileName string, rc *RunCo
 }
 
 func runStepExecutor(step step, stage stepStage, executor common.Executor) common.Executor {
-	return func(ctx context.Context) (err error) {
+	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		rc := step.getRunContext()
 		stepModel := step.getStepModel()
 
+		ifExpression := step.getIfExpression(ctx, stage)
+		rc.CurrentStep = stepModel.ID
+
 		stepResult := &model.StepResult{
 			Outcome:    model.StepStatusSuccess,
 			Conclusion: model.StepStatusSuccess,
 			Outputs:    make(map[string]string),
 		}
-		ctx, endStep := telemetry.StartStep(ctx, stepModel, stage.String())
-		defer func() { endStep(err, stepResult) }()
-
-		ifExpression := step.getIfExpression(ctx, stage)
-		rc.CurrentStep = stepModel.ID
-
 		if stage == stepStageMain {
 			rc.StepResults[rc.CurrentStep] = stepResult
 		}
 
-		err = setupEnv(ctx, step)
+		err := setupEnv(ctx, step)
 		var runStep bool
 		if err == nil {
 			runStep, err = isStepEnabled(ctx, ifExpression, step, stage)
 		}
-		if err == nil && runStep {
-			err = setupInputs(ctx, step)
-		}
 		if err != nil {
 			stepResult.Conclusion = model.StepStatusFailure
 			stepResult.Outcome = model.StepStatusFailure
@@ -245,39 +239,43 @@ func setupEnv(ctx context.Context, step step) error {
 	rc := step.getRunContext()
 
 	mergeEnv(ctx, step)
+	// merge step env last, since it should not be overwritten
+	mergeIntoMap(step, step.getEnv(), step.getStepModel().GetEnv())
 
 	var err error
 	exprEval := rc.NewExpressionEvaluator(ctx)
-	stepEnv := step.getStepModel().Environment()
-	for k, v := range stepEnv {
-		if stepEnv[k], err = exprEval.Interpolate(ctx, v); err != nil {
-			return fmt.Errorf("unable to interpolate env %s: %w", k, err)
+	for k, v := range *step.getEnv() {
+		if !strings.HasPrefix(k, "INPUT_") {
+			if (*step.getEnv())[k], err = exprEval.Interpolate(ctx, v); err != nil {
+				return fmt.Errorf("unable to interpolate env %s: %w", k, err)
+			}
 		}
 	}
-	// merge step env last, since it should not be overwritten
-	mergeIntoMap(step, step.getEnv(), stepEnv)
-	return nil
-}
-
-// setupInputs evaluates `with` once the condition passed, as GitHub does, so every consumer reads the evaluated With.
-func setupInputs(ctx context.Context, step step) error {
-	stepModel := step.getStepModel()
-	if stepModel.RawWith.Kind == 0 {
-		return nil
+	// after we have an evaluated step context, update the expressions evaluator with a new env context
+	// you can use step level env in the with property of a uses construct
+	inputEval := sync.OnceValue(func() *expressionEvaluator { return rc.NewExpressionEvaluatorWithEnv(ctx, *step.getEnv()) })
+	for k, v := range *step.getEnv() {
+		if strings.HasPrefix(k, "INPUT_") {
+			if (*step.getEnv())[k], err = inputEval().Interpolate(ctx, v); err != nil {
+				return fmt.Errorf("unable to interpolate env %s: %w", k, err)
+			}
+		}
 	}
-	if err := model.DecodeEvaluated("with", stepModel.RawWith, step.getRunContext().NewStepExpressionEvaluator(ctx, step).shared(ctx).EvaluateYamlNode, &stepModel.With); err != nil {
-		return err
-	}
-	mergeIntoMap(step, step.getEnv(), (&model.Step{With: stepModel.With}).GetEnv())
 	return nil
 }
 
 func mergeEnv(ctx context.Context, step step) {
 	env := step.getEnv()
 	rc := step.getRunContext()
+	job := rc.Run.Job()
 
-	// container env is the image's baseline, which job env and $GITHUB_ENV override
-	mergeIntoMap(step, env, rc.containerSpec.Env, rc.GetEnv())
+	c := job.Container()
+	if c != nil {
+		// container env is the image's baseline, which job env and $GITHUB_ENV override
+		mergeIntoMap(step, env, c.Env, rc.GetEnv())
+	} else {
+		mergeIntoMap(step, env, rc.GetEnv())
+	}
 
 	rc.withGithubEnv(ctx, step.getGithubContext(ctx), *env)
 }
@@ -292,12 +290,7 @@ func isStepEnabled(ctx context.Context, expr string, step step, stage stepStage)
 		defaultStatusCheck = exprparser.DefaultStatusCheckSuccess
 	}
 
-	// success() and failure() in a composite's own main steps read the composite's result, other stages the job's
-	jobContext := rc.getJobContext()
-	if rc.Parent != nil && stage == stepStageMain && jobContext.Status != "cancelled" {
-		jobContext.Status = rc.ownStatus()
-	}
-	runStep, err := EvalBool(ctx, rc.newStepExpressionEvaluator(ctx, step, rc.actionInputs, jobContext), expr, defaultStatusCheck)
+	runStep, err := EvalBool(ctx, rc.NewStepExpressionEvaluator(ctx, step), expr, defaultStatusCheck)
 	if err != nil {
 		return false, fmt.Errorf("if-expression %q evaluation failed: %s", expr, err)
 	}

act/runner/step_action_builtin.go

@@ -1,69 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package runner
-
-import (
-	"context"
-
-	"gitea.com/gitea/runner/act/common"
-	"gitea.com/gitea/runner/internal/pkg/action"
-	"gitea.com/gitea/runner/internal/pkg/action/checkout"
-
-	"gitea.dev/actionslib/pkg/model"
-)
-
-var builtinActions = map[string]func(context.Context, *action.Context) error{
-	"checkout": checkout.Main,
-}
-
-type stepActionBuiltin struct {
-	Step       *model.Step
-	RunContext *RunContext
-	run        func(context.Context, *action.Context) error
-	env        map[string]string
-}
-
-func (sab *stepActionBuiltin) pre() common.Executor { return common.NewPipelineExecutor() }
-
-func (sab *stepActionBuiltin) main() common.Executor {
-	sab.env = map[string]string{}
-	return runStepExecutor(sab, stepStageMain, func(ctx context.Context) error {
-		if common.Dryrun(ctx) {
-			return nil
-		}
-
-		printRunActionHeader(ctx, sab.Step, sab.env, sab.RunContext)
-		rawLogger := common.Logger(ctx).WithField(rawOutputField, true)
-		defer rawLogger.Infof("::endgroup::")
-
-		rc := sab.RunContext
-		return sab.run(ctx, &action.Context{
-			Container:       rc.JobContainer,
-			Github:          rc.getGithubContext(ctx),
-			Inputs:          sab.Step.With,
-			HostWorkdir:     rc.Config.Workdir,
-			Workspace:       rc.JobContainer.ToContainerPath(rc.Config.Workdir),
-			BindWorkdir:     rc.Config.BindWorkdir,
-			NoSkipCheckout:  rc.Config.NoSkipCheckout,
-			UseGitIgnore:    rc.Config.UseGitIgnore,
-			InsecureSkipTLS: rc.Config.InsecureSkipTLS,
-		})
-	})
-}
-
-func (sab *stepActionBuiltin) post() common.Executor { return common.NewPipelineExecutor() }
-
-func (sab *stepActionBuiltin) getRunContext() *RunContext { return sab.RunContext }
-
-func (sab *stepActionBuiltin) getGithubContext(ctx context.Context) *model.GithubContext {
-	return sab.RunContext.getGithubContext(ctx)
-}
-
-func (sab *stepActionBuiltin) getStepModel() *model.Step { return sab.Step }
-
-func (sab *stepActionBuiltin) getEnv() *map[string]string { return &sab.env }
-
-func (sab *stepActionBuiltin) getIfExpression(_ context.Context, _ stepStage) string {
-	return sab.Step.If.Value
-}

act/runner/step_action_remote.go

@@ -12,6 +12,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
@@ -57,8 +58,13 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
 		sar.Step.Uses = uses
 
 		github := sar.getGithubContext(ctx) // read before remoteAction is set, so `$/` resolves against the enclosing action
-		if sar.remoteAction, err = newRemoteAction(sar.Step.Uses, github, sar.RunContext.Config.GitHubInstance); err != nil {
-			return err
+		if strings.HasPrefix(sar.Step.Uses, selfRepoPrefix) {
+			sar.remoteAction = newSelfRepoAction(sar.Step.Uses, github)
+		} else {
+			sar.remoteAction = newRemoteAction(sar.Step.Uses)
+		}
+		if sar.remoteAction == nil {
+			return fmt.Errorf("expected format {org}/{repo}[/path]@ref or %s{path}. Actual '%s' Input string was not in a correct format", selfRepoPrefix, sar.Step.Uses)
 		}
 
 		if sar.remoteAction.IsCheckout() && isLocalCheckout(github, sar.Step) && !sar.RunContext.Config.NoSkipCheckout {
@@ -158,8 +164,12 @@ func (sar *stepActionRemote) main() common.Executor {
 					common.Logger(ctx).Debugf("Skipping local actions/checkout because you bound your workspace")
 					return nil
 				}
-				copyToPath := path.Join(sar.RunContext.JobContainer.ToContainerPath(sar.RunContext.Config.Workdir), sar.Step.With["path"])
-				return sar.RunContext.JobContainer.CopyDir(copyToPath, sar.RunContext.Config.Workdir+string(filepath.Separator)+".", sar.RunContext.Config.UseGitIgnore, false)(ctx)
+				checkoutPath, err := sar.RunContext.NewExpressionEvaluator(ctx).Interpolate(ctx, sar.Step.With["path"])
+				if err != nil {
+					return fmt.Errorf("unable to interpolate with.path: %w", err)
+				}
+				copyToPath := path.Join(sar.RunContext.JobContainer.ToContainerPath(sar.RunContext.Config.Workdir), checkoutPath)
+				return sar.RunContext.JobContainer.CopyDir(copyToPath, sar.RunContext.Config.Workdir+string(filepath.Separator)+".", sar.RunContext.Config.UseGitIgnore)(ctx)
 			}
 
 			return sar.runAction(sar, sar.actionDir(), sar.remoteAction)(ctx)
@@ -314,34 +324,61 @@ func (ra *remoteAction) IsCheckout() bool {
 	return false
 }
 
-// newRemoteAction resolves `self:` on instanceURL and `$/` in the enclosing composite action, else the workflow's repo and commit.
-func newRemoteAction(action string, github *model.GithubContext, instanceURL string) (*remoteAction, error) {
-	uses, err := model.ParseActionUses(action)
-	if err != nil {
-		return nil, err
+// newSelfRepoAction resolves `$/{path}` against the enclosing composite action, falling back to the workflow's own repo and commit.
+func newSelfRepoAction(action string, github *model.GithubContext) *remoteAction {
+	subPath := strings.TrimLeft(strings.TrimPrefix(action, selfRepoPrefix), "/")
+	if subPath == "" || strings.Contains(subPath, "@") || path.Clean("/"+subPath) != "/"+subPath { // rooted, so a leading ".." is rejected too
+		return nil
 	}
-	ra := &remoteAction{URL: uses.URL, Org: uses.Owner, Repo: uses.Repo, Path: uses.Path, Ref: uses.Ref}
-	switch uses.Kind {
-	case model.ActionUsesInstance:
-		if instanceURL == "" {
-			return nil, fmt.Errorf("unable to resolve %q without a Gitea instance", action)
-		}
-		ra.URL = instanceURL
-		if !strings.Contains(instanceURL, "://") {
-			ra.URL = "https://" + instanceURL
-		}
-	case model.ActionUsesSelfRepo:
-		repo, ref := github.ActionRepository, github.ActionRef
-		if repo == "" || ref == "" {
-			repo, ref = github.Repository, github.Sha
-		}
-		ra.Org, ra.Repo, _ = strings.Cut(repo, "/")
-		ra.URL, ra.Ref = github.ServerURL, ref
-		if ra.Org == "" || ra.Repo == "" || ra.Ref == "" {
-			return nil, fmt.Errorf("unable to resolve %q without a repository and commit", action)
+	repo, ref := github.ActionRepository, github.ActionRef
+	if repo == "" || ref == "" {
+		repo, ref = github.Repository, github.Sha
+	}
+	org, name, _ := strings.Cut(repo, "/")
+	if org == "" || name == "" || ref == "" {
+		return nil
+	}
+	return &remoteAction{URL: github.ServerURL, Org: org, Repo: name, Path: subPath, Ref: ref}
+}
+
+func newRemoteAction(action string) *remoteAction {
+	// support http(s)://host/owner/repo@v3
+	for _, schema := range []string{"https://", "http://", "ssh://"} {
+		if after, ok := strings.CutPrefix(action, schema); ok {
+			splits := strings.SplitN(after, "/", 2)
+			if len(splits) != 2 {
+				return nil
+			}
+			ret := parseAction(splits[1])
+			if ret == nil {
+				return nil
+			}
+			ret.URL = schema + splits[0]
+			return ret
 		}
 	}
-	return ra, nil
+
+	return parseAction(action)
+}
+
+func parseAction(action string) *remoteAction {
+	// GitHub's document[^] describes:
+	// > We strongly recommend that you include the version of
+	// > the action you are using by specifying a Git ref, SHA, or Docker tag number.
+	// Actually, the workflow stops if there is the uses directive that hasn't @ref.
+	// [^]: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
+	r := regexp.MustCompile(`^([^/@]+)/([^/@]+)(/([^@]*))?(@(.*))?$`)
+	matches := r.FindStringSubmatch(action)
+	if len(matches) < 7 || matches[6] == "" {
+		return nil
+	}
+	return &remoteAction{
+		Org:  matches[1],
+		Repo: matches[2],
+		Path: matches[4],
+		Ref:  matches[6],
+		URL:  "",
+	}
 }
 
 func safeFilename(s string) string {

act/runner/step_action_remote_test.go

@@ -216,7 +216,7 @@ func TestStepActionRemote(t *testing.T) {
 				sarm.On("readAction", sar.Step, actionDirSuffix(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
 			}
 			if tt.mocks.run {
-				sarm.On("runAction", sar, actionDirSuffix(sar.Step.UsesHash()), mustNewRemoteAction(t, sar.Step.Uses)).Return(func(ctx context.Context) error { return tt.runError })
+				sarm.On("runAction", sar, actionDirSuffix(sar.Step.UsesHash()), newRemoteAction(sar.Step.Uses)).Return(func(ctx context.Context) error { return tt.runError })
 
 				cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(noopExecutor)
 
@@ -249,7 +249,7 @@ func TestStepActionRemote(t *testing.T) {
 			RunContext:   &RunContext{Config: &Config{ActionCacheDir: t.TempDir()}, Run: &model.Run{JobID: "job", Workflow: &model.Workflow{Jobs: map[string]*model.Job{"job": {}}}}, JobContainer: &jobContainerMock{}},
 			action:       &model.Action{Inputs: map[string]model.Input{"shared": {}}},
 			env:          map[string]string{},
-			remoteAction: mustNewRemoteAction(t, "org/composite@v1"),
+			remoteAction: newRemoteAction("org/composite@v1"),
 		}
 
 		for _, value := range []string{"first", "second"} {
@@ -464,7 +464,7 @@ func TestStepActionRemotePost(t *testing.T) {
 				Step:   tt.stepModel,
 				action: tt.actionModel,
 				// post only ever runs after prepareActionExecutor resolved the action
-				remoteAction: mustNewRemoteAction(t, tt.stepModel.Uses),
+				remoteAction: newRemoteAction(tt.stepModel.Uses),
 			}
 			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
 
@@ -611,21 +611,10 @@ func Test_newRemoteAction(t *testing.T) {
 			action: "ssh://gitea.com/onlyonesegment@main", // missing org/repo after the host
 			want:   nil,
 		},
-		{
-			action: "self:owner/repo/sub@v1",
-			want: &remoteAction{
-				URL:  "https://gitea.example.com",
-				Org:  "owner",
-				Repo: "repo",
-				Path: "sub",
-				Ref:  "v1",
-			},
-			wantCloneURL: "https://gitea.example.com/owner/repo",
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.action, func(t *testing.T) {
-			got, _ := newRemoteAction(tt.action, nil, "gitea.example.com")
+			got := newRemoteAction(tt.action)
 			assert.Equalf(t, tt.want, got, "newRemoteAction(%v)", tt.action)
 			cloneURL := ""
 			if got != nil {
@@ -634,18 +623,9 @@ func Test_newRemoteAction(t *testing.T) {
 			assert.Equalf(t, tt.wantCloneURL, cloneURL, "newRemoteAction(%v).CloneURL()", tt.action)
 		})
 	}
-	_, err := newRemoteAction("self:owner/repo@v1", nil, "")
-	require.ErrorContains(t, err, "without a Gitea instance")
 }
 
-func mustNewRemoteAction(t *testing.T, uses string) *remoteAction {
-	t.Helper()
-	action, err := newRemoteAction(uses, nil, "")
-	require.NoError(t, err)
-	return action
-}
-
-func Test_newRemoteActionSelfRepo(t *testing.T) {
+func Test_newSelfRepoAction(t *testing.T) {
 	workflow := &model.GithubContext{
 		ServerURL:  "https://gitea.example.com",
 		Repository: "owner/workflow-repo",
@@ -694,8 +674,7 @@ func Test_newRemoteActionSelfRepo(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, _ := newRemoteAction(tt.action, tt.github, "")
-			assert.Equal(t, tt.want, got)
+			assert.Equal(t, tt.want, newSelfRepoAction(tt.action, tt.github))
 		})
 	}
 }
@@ -725,7 +704,7 @@ func Test_remoteActionReference(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.uses, func(t *testing.T) {
-			assert.Equal(t, tt.want, mustNewRemoteAction(t, tt.uses).Reference())
+			assert.Equal(t, tt.want, newRemoteAction(tt.uses).Reference())
 		})
 	}
 }
@@ -782,7 +761,7 @@ func TestStepActionRemotePreResolvesDownloadedCommit(t *testing.T) {
 func TestStepActionRemoteActionDownloadInfo(t *testing.T) {
 	t.Run("reports the action and its resolved commit", func(t *testing.T) {
 		sar := &stepActionRemote{
-			remoteAction: mustNewRemoteAction(t, "actions/checkout@v7"),
+			remoteAction: newRemoteAction("actions/checkout@v7"),
 			action:       &model.Action{},
 			resolvedSha:  "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
 		}
@@ -796,7 +775,7 @@ func TestStepActionRemoteActionDownloadInfo(t *testing.T) {
 
 	t.Run("reports nothing when no action was downloaded", func(t *testing.T) {
 		// The local checkout of the workflow's own repository resolves no action.
-		sar := &stepActionRemote{remoteAction: mustNewRemoteAction(t, "actions/checkout@v7")}
+		sar := &stepActionRemote{remoteAction: newRemoteAction("actions/checkout@v7")}
 
 		_, _, ok := sar.actionDownloadInfo()
 

act/runner/step_docker.go

@@ -6,6 +6,7 @@ package runner
 
 import (
 	"context"
+	"fmt"
 	"strings"
 
 	"gitea.com/gitea/runner/act/common"
@@ -57,17 +58,29 @@ func (sd *stepDocker) runUsesContainer() common.Executor {
 
 	return func(ctx context.Context) error {
 		image := strings.TrimPrefix(step.Uses, "docker://")
-		cmd, err := shellquote.Split(step.With["args"])
+		eval := rc.NewExpressionEvaluator(ctx)
+		args, err := eval.Interpolate(ctx, step.With["args"])
+		if err != nil {
+			return fmt.Errorf("unable to interpolate with.args: %w", err)
+		}
+		cmd, err := shellquote.Split(args)
 		if err != nil {
 			return err
 		}
 
 		var entrypoint []string
-		if entry := step.With["entrypoint"]; entry != "" {
+		entry, err := eval.Interpolate(ctx, step.With["entrypoint"])
+		if err != nil {
+			return fmt.Errorf("unable to interpolate with.entrypoint: %w", err)
+		}
+		if entry != "" {
 			entrypoint = []string{entry}
 		}
 
-		stepContainer := newStepContainer(ctx, sd, image, cmd, entrypoint, "")
+		stepContainer, err := newStepContainer(ctx, sd, image, cmd, entrypoint, "")
+		if err != nil {
+			return err
+		}
 
 		return common.NewPipelineExecutor(
 			stepContainer.Pull(rc.Config.ForcePull),

act/runner/step_docker_test.go

@@ -145,7 +145,7 @@ func TestStepDockerNewStepContainerAllocatePTY(t *testing.T) {
 			}
 			sd.RunContext.ExprEval = sd.RunContext.NewExpressionEvaluator(ctx)
 
-			newStepContainer(ctx, sd, "node:14", []string{"echo", "hi"}, nil, "")
+			_, _ = newStepContainer(ctx, sd, "node:14", []string{"echo", "hi"}, nil, "")
 			assert.Equal(t, tc.allocPTY, captured.AllocatePTY)
 		})
 	}
@@ -214,7 +214,7 @@ func TestStepDockerNewStepContainerNetworkMode(t *testing.T) {
 			require.NoError(t, sd.RunContext.resolvePlatformImage(ctx))
 			assert.Equal(t, tc.expectDefault, sd.RunContext.IsHostEnv(), "IsHostEnv mismatch for platform %q", tc.platform)
 
-			newStepContainer(ctx, sd, "alpine:3.20", []string{"echo", "hello"}, nil, "")
+			_, _ = newStepContainer(ctx, sd, "alpine:3.20", []string{"echo", "hello"}, nil, "")
 
 			if tc.expectDefault {
 				assert.Equal(t, "default", captured.NetworkMode,

act/runner/step_factory.go

@@ -6,9 +6,6 @@ package runner
 
 import (
 	"fmt"
-	"maps"
-	"slices"
-	"strings"
 
 	"gitea.dev/actionslib/pkg/model"
 )
@@ -36,18 +33,6 @@ func (sf *stepFactoryImpl) newStep(stepModel *model.Step, rc *RunContext) (step,
 			runAction:  runActionImpl,
 		}, nil
 	case model.StepTypeUsesActionRemote:
-		if name, ok := strings.CutPrefix(stepModel.Uses, "builtin:"); ok {
-			run, ok := builtinActions[name]
-			if !ok {
-				return nil, fmt.Errorf("unknown built-in action %q (known: %v) for job:%s step:%+v",
-					name, slices.Sorted(maps.Keys(builtinActions)), rc.Run, stepModel)
-			}
-			return &stepActionBuiltin{
-				Step:       stepModel,
-				RunContext: rc,
-				run:        run,
-			}, nil
-		}
 		return &stepActionRemote{
 			Step:       stepModel,
 			RunContext: rc,

act/runner/step_factory_test.go

@@ -57,16 +57,6 @@ func TestStepFactoryNewStep(t *testing.T) {
 				return ok
 			},
 		},
-		{
-			name: "StepBuiltinAction",
-			model: &model.Step{
-				Uses: "builtin:checkout",
-			},
-			check: func(s step) bool {
-				_, ok := s.(*stepActionBuiltin)
-				return ok
-			},
-		},
 	}
 
 	for _, tt := range table {
@@ -82,11 +72,14 @@ func TestStepFactoryNewStep(t *testing.T) {
 }
 
 func TestStepFactoryInvalidStep(t *testing.T) {
-	for _, stepModel := range []*model.Step{
-		{Uses: "remote/action@v1", Run: "cmd"},
-		{Uses: "builtin:unknown"},
-	} {
-		_, err := (&stepFactoryImpl{}).newStep(stepModel, &RunContext{})
-		assert.Error(t, err, stepModel.Uses)
+	model := &model.Step{
+		Uses: "remote/action@v1",
+		Run:  "cmd",
 	}
+
+	sf := &stepFactoryImpl{}
+
+	_, err := sf.newStep(model, &RunContext{})
+
+	assert.Error(t, err)
 }

act/runner/step_test.go

@@ -8,24 +8,17 @@ import (
 	"context"
 	"errors"
 	"os"
-	"strings"
 	"testing"
 
 	"gitea.com/gitea/runner/act/common"
 	"gitea.com/gitea/runner/act/container"
-	"gitea.com/gitea/runner/internal/pkg/telemetry"
 
 	"gitea.dev/actionslib/pkg/model"
-	runnerv1 "gitea.dev/actionslib/runner/v1"
 	log "github.com/sirupsen/logrus"
 	logrustest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	"go.opentelemetry.io/otel/sdk/trace/tracetest"
-	semconv "go.opentelemetry.io/otel/semconv/v1.43.0"
-	tracenoop "go.opentelemetry.io/otel/trace/noop"
 	yaml "go.yaml.in/yaml/v4"
 )
 
@@ -155,8 +148,11 @@ func TestSetupEnv(t *testing.T) {
 		},
 		JobContainer: cm,
 	}
-	step := &model.Step{}
-	require.NoError(t, step.RawWith.Encode(map[string]string{"STEP_WITH": "with-value", "ID": "${{ fromJSON('1234567') }}"}))
+	step := &model.Step{
+		With: map[string]string{
+			"STEP_WITH": "with-value",
+		},
+	}
 	env := map[string]string{}
 
 	sm.On("getRunContext").Return(rc)
@@ -165,7 +161,6 @@ func TestSetupEnv(t *testing.T) {
 	sm.On("getEnv").Return(&env)
 
 	require.NoError(t, setupEnv(context.Background(), sm))
-	require.NoError(t, setupInputs(context.Background(), sm))
 
 	// These are commit or system specific
 	delete(env, "GITHUB_REF")
@@ -202,7 +197,6 @@ func TestSetupEnv(t *testing.T) {
 		"GITHUB_RUN_NUMBER":        "1",
 		"GITHUB_SERVER_URL":        "https://",
 		"GITHUB_WORKFLOW":          "",
-		"INPUT_ID":                 "1234567",
 		"INPUT_STEP_WITH":          "with-value",
 		"RC_KEY":                   "rcvalue",
 		"RUNNER_ENVIRONMENT":       "self-hosted",
@@ -211,67 +205,6 @@ func TestSetupEnv(t *testing.T) {
 	}, env)
 
 	cm.AssertExpectations(t)
-
-	for _, expression := range []string{"inputs.args", "env.ARGS"} {
-		t.Run("deferred inputs from "+expression, func(t *testing.T) {
-			workflow, err := model.ReadWorkflow(strings.NewReader(`
-env: ${{ fromJSON(matrix.env) }}
-jobs:
-  test:
-    env:
-      PRIORITY: ${{ matrix.priority }}
-    defaults:
-      run: ${{ fromJSON(matrix.defaults) }}
-    container:
-      image: node:20
-      env:
-        CONTAINER: ${{ env.PRIORITY }}
-    steps:
-      - uses: ./act
-        env:
-          ARGS: ${{ inputs.args }}
-        with: ${{ fromJSON(` + expression + `) }}
-`))
-			require.NoError(t, err)
-			job := workflow.GetJob("test")
-			rawEnv := model.CloneYamlNode(workflow.RawEnv)
-			rawWith := model.CloneYamlNode(job.Steps[0].RawWith)
-			for _, value := range []string{"first", "second"} {
-				t.Run(value, func(t *testing.T) {
-					t.Parallel()
-					rc, err := (&runnerImpl{config: &Config{}}).newRunContext(t.Context(), &model.Run{Workflow: workflow, JobID: "test"}, map[string]any{"env": `{"WORKFLOW":"` + value + `${{ github.job }}","PRIORITY":"workflow"}`, "priority": "${{ github.job }}", "defaults": `{"shell":"` + value + `"}`})
-					require.NoError(t, err)
-					rc.workflowCallInputs = map[string]any{"args": `{"name":"` + value + `${{ github.job }}","fetch-depth":1234567}`}
-					enabled, err := rc.isEnabled(t.Context())
-					require.NoError(t, err)
-					require.True(t, enabled)
-					require.NoError(t, evaluateJobEnvAndDefaults(t.Context(), rc))
-					assert.Equal(t, model.RunDefaults{Shell: value}, rc.jobRunDefaults)
-					step := &stepRun{RunContext: rc, Step: job.Steps[0].Clone(), env: map[string]string{}}
-					require.NoError(t, setupEnv(t.Context(), step))
-					require.NoError(t, setupInputs(t.Context(), step))
-					assert.Equal(t, map[string]string{"ARGS": `${{ inputs.args }}`, "INPUT_NAME": value + "${{ github.job }}", "INPUT_FETCH-DEPTH": "1234567"}, step.Step.GetEnv())
-					assert.Equal(t, value+"${{ github.job }}", step.env["INPUT_NAME"])
-					assert.Equal(t, value+"${{ github.job }}", step.env["WORKFLOW"])
-					assert.Equal(t, "${{ github.job }}", step.env["PRIORITY"])
-					assert.Equal(t, "${{ github.job }}", step.env["CONTAINER"])
-					assert.Equal(t, rawEnv, workflow.RawEnv)
-					assert.Equal(t, rawWith, job.Steps[0].RawWith)
-					assert.Nil(t, workflow.Env)
-					assert.Nil(t, job.Steps[0].With)
-				})
-			}
-		})
-	}
-
-	t.Run("rejects inputs that still contain an expression", func(t *testing.T) {
-		workflow, err := model.ReadWorkflow(strings.NewReader("jobs:\n  test:\n    steps:\n      - uses: ./act\n        with: ${{ inputs.args }}\n"))
-		require.NoError(t, err)
-		rc, err := (&runnerImpl{config: &Config{}}).newRunContext(t.Context(), &model.Run{Workflow: workflow, JobID: "test"}, nil)
-		require.NoError(t, err)
-		rc.workflowCallInputs = map[string]any{"args": "${{ inputs.unresolved }}"}
-		require.ErrorContains(t, setupInputs(t.Context(), &stepRun{RunContext: rc, Step: workflow.Jobs["test"].Steps[0].Clone(), env: map[string]string{}}), "with:")
-	})
 }
 
 func TestIsStepEnabled(t *testing.T) {
@@ -553,29 +486,6 @@ func TestRunStepExecutorParity(t *testing.T) {
 		assert.Equal(t, "child", childRC.IntraActionState[child.Step.ID]["saved"])
 	})
 
-	t.Run("stages and composite steps are traced under Gitea's step names", func(t *testing.T) {
-		spans := tracetest.NewSpanRecorder()
-		telemetry.SetTracerProvider(sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(spans)))
-		t.Cleanup(func() { telemetry.SetTracerProvider(tracenoop.NewTracerProvider()) })
-		ctx, _ := telemetry.StartJob(t.Context(), &runnerv1.Task{Id: 7})
-		outer := newStep(t, &model.Step{ID: "outer", Uses: "actions/cache@v4", Number: 3})
-		child := newStep(t, &model.Step{ID: "child", Name: "Restore", Number: 1})
-		skipped := newStep(t, &model.Step{ID: "skipped", Name: "Deploy", Number: 4, If: yaml.Node{Value: "false"}})
-		broken := newStep(t, &model.Step{ID: "broken", Name: "Broken", Number: 5, If: yaml.Node{Value: badExpression}})
-
-		require.NoError(t, runStepExecutor(outer, stepStagePost, runStepExecutor(child, stepStageMain, noopExecutor))(ctx))
-		require.NoError(t, runStepExecutor(skipped, stepStageMain, noopExecutor)(ctx))
-		require.Error(t, runStepExecutor(broken, stepStageMain, noopExecutor)(ctx))
-
-		ended := spans.Ended()
-		require.Len(t, ended, 4)
-		assert.Equal(t, []string{"Restore", "Post Run actions/cache@v4", "Deploy", "Broken"}, []string{ended[0].Name(), ended[1].Name(), ended[2].Name(), ended[3].Name()})
-		assert.Equal(t, ended[1].SpanContext().SpanID(), ended[0].Parent().SpanID())
-		assert.Contains(t, ended[0].Attributes(), semconv.CICDPipelineTaskRunID("7.3.post.1"))
-		assert.Contains(t, ended[2].Attributes(), semconv.CICDPipelineTaskRunResultSkip)
-		assert.Contains(t, ended[3].Attributes(), semconv.CICDPipelineTaskRunResultFailure)
-	})
-
 	t.Run("timeout must be positive", func(t *testing.T) {
 		exprEval := createRunContext(t).NewExpressionEvaluator(context.Background())
 		for timeout, wantDeadline := range map[string]bool{"-1": false, "0": false, "1": true} {

act/runner/testdata/builtin-checkout/push.yml

@@ -1,10 +0,0 @@
-name: builtin-checkout
-on: push
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: builtin:checkout
-        with:
-          path: ${{ 'sub' }}
-      - run: test -f sub/builtin-checkout/push.yml

act/runner/testdata/docker-proxy/action/action.yml

@@ -1,6 +0,0 @@
-name: docker-proxy
-description: Verify mounted Docker access through post steps
-runs:
-  using: node24
-  main: index.js
-  post: index.js

act/runner/testdata/docker-proxy/action/index.js

@@ -1,53 +0,0 @@
-const assert = require('node:assert/strict');
-const {once} = require('node:events');
-const fs = require('node:fs');
-const http = require('node:http');
-
-async function request(method, path, body) {
-  const req = http.request({
-    socketPath: '/var/run/docker.sock',
-    method,
-    path,
-    headers: {'Content-Type': 'application/json'},
-    signal: AbortSignal.timeout(10000),
-  });
-  req.end(JSON.stringify(body));
-  const [res] = await once(req, 'response');
-  req.on('error', (error) => res.destroy(error));
-  let data = '';
-  for await (const chunk of res.setEncoding('utf8')) {
-    data += chunk;
-  }
-  assert(res.statusCode >= 200 && res.statusCode < 300, `${method} ${path}: ${res.statusCode} ${data}`);
-  return data;
-}
-
-async function main() {
-  assert(fs.statSync('/var/run/docker.sock').isSocket(), 'Docker mount must be a socket');
-  assert.equal(await request('GET', '/_ping'), 'OK');
-  const api = `/v${JSON.parse(await request('GET', '/version')).ApiVersion}`;
-  const name = process.env.PROXY_TEST_RESOURCE;
-  const job = process.env.JOB_CONTAINER_NAME;
-  const post = process.env.STATE_post === 'true';
-  assert(name);
-  assert(job);
-  if (!post) {
-    await request('POST', `${api}/volumes/create`, {Name: name});
-    await request('POST', `${api}/networks/create`, {Name: name});
-    await request('POST', `${api}/networks/${name}/connect`, {Container: job});
-    fs.appendFileSync(process.env.GITHUB_STATE, 'post=true\n');
-  }
-  const label = process.env.PROXY_TEST_MODE === 'proxy' ? job : undefined;
-  assert.equal(JSON.parse(await request('GET', `${api}/volumes/${name}`)).Labels?.['com.gitea.runner.job'], label);
-  const network = JSON.parse(await request('GET', `${api}/networks/${name}`));
-  assert.equal(network.Labels?.['com.gitea.runner.job'], label);
-  assert(Object.values(network.Containers).some((container) => container.Name === job));
-  if (post) {
-    console.log('docker proxy post verified');
-  }
-}
-
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});

act/runner/testdata/docker-proxy/push.yml

@@ -1,56 +0,0 @@
-name: docker-proxy
-on: push
-jobs:
-  proxy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./action
-      - if: env.PROXY_TEST_MODE == 'proxy'
-        run: |
-          docker run -d --restart always --network "$PROXY_TEST_RESOURCE" --name "$PROXY_TEST_RESOURCE-detached" "$PROXY_TEST_IMAGE" sleep infinity
-          echo "{services: {app: {image: $PROXY_TEST_IMAGE, command: sleep infinity, volumes: [named:/named]}}, volumes: {named: {}}}" | docker compose -f - up -d
-  binds:
-    needs: proxy
-    runs-on: ubuntu-latest
-    steps:
-      - run: |
-          test -z "$(docker ps -aq -f name="$PROXY_TEST_RESOURCE-detached" -f name="$PROXY_TEST_RESOURCE-app"; docker volume ls -q -f name="${PROXY_TEST_RESOURCE}_named"; docker network ls -q -f name="${PROXY_TEST_RESOURCE}_default")"
-          mkdir data && echo from-job > data/marker
-      - id: run
-        run: |
-          docker run --rm -v "${{ github.workspace }}:/src:ro" -v "$PWD:$PWD" -v ./data/created:/created -v "$GITHUB_OUTPUT:/output" \
-            --mount "type=bind,src=$PWD/data/../data,dst=/spelled,readonly" \
-            --mount "type=volume,dst=/device,volume-opt=type=none,volume-opt=o=bind,volume-opt=device=$PWD/data" \
-            "$PROXY_TEST_IMAGE" sh -c 'cat /src/data/marker "$0/data/marker" /spelled/marker /device/marker | grep -c from-job | grep -qx 4 && echo from-nested > /created/file && echo value=from-nested >> /output' "$PWD"
-          grep -qx from-nested data/created/file
-      - run: |
-          test "${{ steps.run.outputs.value }}" = from-nested
-          cat > compose.yaml <<'EOF'
-          services:
-            app:
-              image: ${PROXY_TEST_IMAGE}
-              command: cat /short/marker /long/marker /named/marker
-              volumes:
-                - ./data:/short
-                - type: bind
-                  source: ./data
-                  target: /long
-                  bind:
-                    create_host_path: false
-                - named:/named
-          volumes:
-            named:
-              driver: local
-              driver_opts:
-                type: none
-                o: bind
-                device: ./data
-          EOF
-          test "$(docker compose run --rm app | grep -c from-job)" = 3
-          docker compose down --volumes
-      - run: |
-          docker run --rm --user 1001 --group-add 2375 -v /var/run/docker.sock:/var/run/docker.sock -v /usr/local/bin/docker:/usr/local/bin/docker:ro -v "${GITEA_DOCKER_WORKSPACE:?}/data:/data:ro" \
-            "$PROXY_TEST_IMAGE" sh -c 'grep -qx from-job /data/marker && docker volume create "$0"' "$PROXY_TEST_RESOURCE-nested"
-          test "$(docker volume inspect -f '{{ index .Labels "com.gitea.runner.job" }}' "$PROXY_TEST_RESOURCE-nested")" = "$JOB_CONTAINER_NAME"
-          echo "docker binds verified"

docs/builtin-actions.md

@@ -1,21 +0,0 @@
-# Built-in actions
-
-Built-in actions ship with the runner, so a job needs no action download and no Node in its image.
-
-```yaml
-- uses: builtin:checkout
-```
-
-## checkout
-
-Works like `actions/checkout` with these inputs. Any other input fails the step.
-
-| Input | Default |
-| --- | --- |
-| `repository` | `github.repository` |
-| `ref` | the triggering commit, or the default branch of another repository |
-| `token` | `github.token` |
-| `path` | workspace root |
-| `fetch-depth` | `1`, `0` for full history |
-
-With `gitea-runner exec`, checking out the workflow's own repository copies your local working directory, unless `--no-skip-checkout` is set.

docs/macos-vm-executor.md

@@ -0,0 +1,93 @@
+# macOS VM executor
+
+The runner can execute a job in an ephemeral macOS VM by registering a
+`macos-vm` label:
+
+```yaml
+runner:
+  labels:
+    - macos-latest:macos-vm://registry.example.com/macos-15.2-xcode-26.1
+```
+
+The VM is created and managed by `runner-executor-macos`, a dedicated Swift
+binary built on Apple Virtualization.framework. The source VM must include the
+runner guest agent.
+
+## Configuration
+
+```yaml
+macos_vm:
+  executor_path: runner-executor-macos
+  workdir_parent: /Users/admin/runner
+  cpu: 0
+  memory: 0
+  boot_timeout: 5m
+```
+
+`workdir_parent` is the guest directory under which job workspaces are created.
+`executor_path` is the binary to invoke; an empty value uses PATH lookup.
+
+## Executor CLI
+
+The runner uses a narrow, runner-oriented command set:
+
+```text
+runner-executor-macos provision <image> <name> [--cpu N] [--memory MB]
+runner-executor-macos start <name> [--no-graphics]
+runner-executor-macos exec <name> [--stdin] <argv...>
+runner-executor-macos stop <name> [--timeout N]
+runner-executor-macos destroy <name>
+runner-executor-macos list --format json
+runner-executor-macos version
+```
+
+`list --format json` returns:
+
+```json
+[
+  {
+    "name": "GITEA-MACOS-VM-<runner-uuid>-...",
+    "state": "stopped",
+    "running": false,
+    "accessed_at": "2026-09-05T12:00:00Z"
+  }
+]
+```
+
+## Integration test
+
+The end-to-end test is opt-in because it provisions and boots a real VM:
+
+```bash
+MACOS_VM_TEST_IMAGE=/path/or/reference \
+  go test -tags macos_vm_integration ./act/container -run '^TestMacOSVMEnvironmentIntegration$' -v
+```
+
+The test skips when `MACOS_VM_TEST_IMAGE` is unset.
+
+## Orphaned VM cleanup
+
+Job VM names start with `GITEA-MACOS-VM-<runner-uuid>-`. While the runner is
+idle, it lists local VMs and destroys the non-running ones whose name has this
+runner's UUID and whose access time is older than
+`runner.workdir_cleanup_age`.
+
+## Service containers
+
+Service containers are intentionally rejected for macOS VM jobs today. Docker
+service containers live on a Docker network and are reached by workflow service
+id, which a macOS VM cannot resolve.
+
+Possible future designs:
+
+1. **Host-published Docker services + guest host mapping** — publish each
+   service port on the runner host and inject `<service-id> -> <host-ip>` into
+   the VM through the guest agent.
+2. **macOS VM services** — run each service as another VM; this requires
+   service discovery and is much heavier than Docker containers.
+3. **Environment-based discovery** — require workflows to read service
+   addresses from env vars instead of hostnames, breaking GitHub Actions
+   compatibility.
+
+Option 1 is the most compatible direction once the guest agent and host network
+configuration are stable.

docs/telemetry.md

@@ -1,46 +0,0 @@
-# OpenTelemetry tracing
-
-The runner can send a trace of every job it runs to an OpenTelemetry collector or any backend that accepts OTLP. Each job becomes a trace with a span per step, so you can see where CI time goes and which steps fail. Tracing stays off until you set an endpoint.
-
-## Setup
-
-Set the endpoint in the runner's environment, for example in its systemd unit, with `docker run -e` or in the Kubernetes pod spec:
-
-```sh
-OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
-```
-
-| Variable | Purpose |
-| --- | --- |
-| `OTEL_EXPORTER_OTLP_ENDPOINT` | Collector base URL, traces go to `/v1/traces` under it |
-| `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` | Full traces URL, takes precedence over the base URL |
-| `OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_EXPORTER_OTLP_TRACES_HEADERS` | Request headers such as an API key, as comma-separated `key=value` pairs with URL-encoded values |
-| `OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES` | Resource attributes, the service name defaults to `gitea-runner` |
-| `OTEL_TRACES_SAMPLER`, `OTEL_BSP_*` | Sampling and batching, see the [SDK variables](https://opentelemetry.io/docs/specs/otel/configuration/sdk-environment-variables/) |
-| `OTEL_SDK_DISABLED=true`, `OTEL_TRACES_EXPORTER=none` | Turn tracing off |
-
-Only the `http/protobuf` protocol is supported.
-
-## What is sent
-
-- A span per job, named `RUN {workflow} {job}`, with the repository, ref, commit, run URL, run number, attempt and result.
-- A span per step, named as in Gitea's step list, including `Pre` and `Post` stages and the steps of composite actions, with the step's result.
-- The runner's name, UUID and version.
-
-Logs, step output and secrets are never sent. Step names are taken from the workflow file as written, without expanding `${{ }}` expressions.
-
-## Tracing inside jobs
-
-Jobs receive `TRACEPARENT`, so tools in a job that use OpenTelemetry can add their spans to the job's trace. To let them export, set their `OTEL_*` variables in `runner.envs`, see [Security](#security).
-
-## Metrics
-
-Metrics stay on the Prometheus endpoint enabled by `metrics.enabled`. To get them into OpenTelemetry, scrape `/metrics` with the collector's `prometheus` receiver.
-
-## Security
-
-- OTLP has no authentication of its own. Send to a collector on the runner's host that holds the backend credentials, as the [OpenTelemetry security guide](https://opentelemetry.io/docs/security/config-best-practices/) recommends, or use `https` with a token in `OTEL_EXPORTER_OTLP_HEADERS`. Over plain `http`, headers travel unencrypted.
-- TLS certificates are verified against the system CA bundle, set `SSL_CERT_FILE` to use your own. Client certificates are not supported, use a local collector for mTLS. Redirects are not followed, so headers only reach the configured endpoint.
-- Jobs in containers never see the runner's `OTEL_*` variables. Jobs on the host inherit the runner's whole environment, headers included, and can read its files anyway since they run as the same user.
-- Every workflow can read `runner.envs`, so never put credentials there. Point jobs at a collector that holds them instead, keeping in mind that any workflow can then send data through it.
-- Traces carry the repository and step names of every job, private repositories included, so give the collector the same access controls as the runner's logs.

e2e/cache_test.go

@@ -28,24 +28,3 @@ func testActionsCacheRoundTrip(t *testing.T) {
 		})
 	}
 }
-
-func testArtifactRoundTrip(t *testing.T) {
-	t.Parallel()
-
-	v2 := true
-	for _, tc := range []struct {
-		name    string
-		options runnerOptions
-	}{
-		{"through_the_cache_server", runnerOptions{cacheV2: &v2}},
-		{"direct_with_no_reachable_cache", runnerOptions{cacheHost: "cache.invalid", cacheV2: new(bool)}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			api, repo, _ := startIsolatedScenario(t, "artifact.yml", "e2e-artifact", tc.options)
-
-			wfRun := waitForRun(t, api, repo)
-			requireSuccess(t, api, repo, wfRun.ID)
-		})
-	}
-}

e2e/cancel_test.go

@@ -51,29 +51,23 @@ func testRunCancellation(t *testing.T) {
 
 func waitForRunningJobLog(t *testing.T, api *GiteaAPI, repo string, runID int64, substr string) {
 	t.Helper()
-	// The budget covers scheduling and the container start, which a loaded runner makes slow.
-	ctx, cancel := context.WithTimeout(t.Context(), runTimeout)
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
 	defer cancel()
 
-	status := "none"
 	for {
 		jobs, err := api.Jobs(ctx, repo, runID)
 		if err != nil {
 			t.Fatalf("list jobs: %v", err)
 		}
-		if len(jobs) > 0 {
-			status = jobs[0].Status
-			if status == "in_progress" {
-				logs, err := api.JobLogs(ctx, repo, jobs[0].ID)
-				if err == nil && commandRow(logs, substr) == substr {
-					return
-				}
+		if len(jobs) > 0 && jobs[0].Status == "in_progress" {
+			logs, err := api.JobLogs(ctx, repo, jobs[0].ID)
+			if err == nil && commandRow(logs, substr) == substr {
+				return
 			}
 		}
 		select {
 		case <-ctx.Done():
-			dumpRunLogs(t, api, repo, runID)
-			t.Fatalf("job of run %d is %q and never logged %q", runID, status, substr)
+			t.Fatalf("running job for run %d never logged %q", runID, substr)
 		case <-time.After(pollInterval):
 		}
 	}

e2e/compatibility_test.go

@@ -27,7 +27,6 @@ func TestCompatibility(t *testing.T) {
 
 	t.Run("payloads", testPayloads)
 	t.Run("cache", testActionsCacheRoundTrip)
-	t.Run("artifact", testArtifactRoundTrip)
 	t.Run("cancellation_and_log_streaming", testRunCancellation)
 	t.Run("dispatch", testWorkflowDispatch)
 	t.Run("ephemeral", testEphemeralRunner)
@@ -69,7 +68,6 @@ func testPayloads(t *testing.T) {
 		"cell-a-2",
 		"cell-b-1",
 		"cell-b-2",
-		"imageless env=imageless-env-value host=imageless-host",
 	} {
 		if !strings.Contains(logs, want) {
 			t.Errorf("stored logs are missing %q", want)

e2e/gitea_fixture.go

@@ -160,7 +160,7 @@ func StartGitea(ctx context.Context, cli mobyclient.APIClient) (*GiteaFixture, e
 		sharedNet, _ = selfNetwork(ctx, cli)
 	)
 	if sharedNet != "" {
-		baseURL = "http://" + net.JoinHostPort(name, "3000")
+		baseURL = fmt.Sprintf("http://%s:3000", name)
 		netConfig = &network.NetworkingConfig{
 			EndpointsConfig: map[string]*network.EndpointSettings{sharedNet: {}},
 		}
@@ -170,7 +170,7 @@ func StartGitea(ctx context.Context, cli mobyclient.APIClient) (*GiteaFixture, e
 		if err != nil {
 			return nil, fmt.Errorf("find a free host port: %w", err)
 		}
-		baseURL = "http://" + net.JoinHostPort(host.String(), strconv.Itoa(port))
+		baseURL = fmt.Sprintf("http://%s:%d", host, port)
 		hostConfig.PortBindings = network.PortMap{
 			containerPort: []network.PortBinding{{HostIP: host, HostPort: strconv.Itoa(port)}},
 		}
@@ -360,6 +360,6 @@ func (f *GiteaFixture) Close(ctx context.Context) error {
 	if f.id == "" {
 		return f.cli.Close()
 	}
-	_, removeErr := f.cli.ContainerRemove(ctx, f.id, mobyclient.ContainerRemoveOptions{Force: true, RemoveVolumes: true})
+	_, removeErr := f.cli.ContainerRemove(ctx, f.id, mobyclient.ContainerRemoveOptions{Force: true})
 	return errors.Join(removeErr, f.cli.Close())
 }

e2e/runner_harness.go

@@ -27,7 +27,6 @@ type runnerOptions struct {
 	capacity  int
 	ephemeral bool
 	cacheV2   *bool
-	cacheHost string
 }
 
 func startRunner(t *testing.T, repo, labelName string, options runnerOptions) *poll.Poller {
@@ -50,7 +49,6 @@ func startRunner(t *testing.T, repo, labelName string, options runnerOptions) *p
 		cfg.Container.DockerHost = "unix:///var/run/docker.sock"
 	}
 	cfg.Cache.Dir = t.TempDir() + "/cache"
-	cfg.Cache.Host = options.cacheHost
 	cfg.Runner.Insecure = true
 	cfg.Runner.FetchInterval = 250 * time.Millisecond // faster than prod defaults for local fixture
 	cfg.Runner.FetchIntervalMax = 250 * time.Millisecond

e2e/testdata/workflows/artifact.yml

@@ -1,28 +0,0 @@
-name: artifact
-on: push
-jobs:
-  upload:
-    runs-on: e2e-artifact
-    steps:
-      - run: |
-          echo "results=$ACTIONS_RESULTS_URL cache=$ACTIONS_CACHE_URL v2=${ACTIONS_CACHE_SERVICE_V2:-unset}"
-          if [ "$ACTIONS_CACHE_SERVICE_V2" = "true" ]; then
-            test "$ACTIONS_RESULTS_URL/" = "$ACTIONS_CACHE_URL"
-          else
-            test "$ACTIONS_RESULTS_URL/" != "$ACTIONS_CACHE_URL"
-          fi
-          mkdir -p out
-          echo "artifact-payload" > out/data.txt
-      - uses: actions/upload-artifact@v7
-        with:
-          name: e2e-artifact-${{ github.run_id }}
-          path: out/data.txt
-  download:
-    needs: upload
-    runs-on: e2e-artifact
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: e2e-artifact-${{ github.run_id }}
-          path: got
-      - run: grep -q artifact-payload got/data.txt

e2e/testdata/workflows/cancel.yml

@@ -6,4 +6,4 @@ jobs:
     steps:
       - run: |
           echo e2e-live-log-marker
-          timeout 10s tail -f /dev/null || true
+          timeout 2s tail -f /dev/null || true

e2e/testdata/workflows/payloads.yml

@@ -3,10 +3,6 @@ on: push
 jobs:
   verify:
     runs-on: ubuntu-latest
-    container:
-      env:
-        IMAGELESS_ENV: imageless-env-value
-      options: --hostname imageless-host
     services:
       web:
         image: ${{ vars.E2E_SERVICE_IMAGE }}
@@ -23,7 +19,6 @@ jobs:
           echo '::notice::encoded-first%0Aencoded-second'
           echo "the variable is ${{ vars.GREETING }}"
           echo "the secret is ${{ secrets.FOO }}"
-          echo "imageless env=$IMAGELESS_ENV host=$(hostname)"
           curl --connect-timeout 1 --max-time 2 --retry 30 --retry-delay 1 --retry-max-time 30 --retry-all-errors -fsS -o /dev/null http://web/
   produce:
     runs-on: ubuntu-latest

go.mod

@@ -2,56 +2,50 @@ module gitea.com/gitea/runner
 
 go 1.27
 
-toolchain go1.27.1
+toolchain go1.27.0
 
 require (
-	connectrpc.com/connect v1.21.0
+	connectrpc.com/connect v1.20.0
 	dario.cat/mergo v1.0.2
-	gitea.dev/actionslib v1.2.1
+	gitea.dev/actionslib v0.7.0
 	github.com/avast/retry-go/v5 v5.0.0
-	github.com/bmatcuk/doublestar/v4 v4.10.2
 	github.com/containerd/errdefs v1.0.0
 	github.com/creack/pty v1.1.24
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v29.8.1+incompatible
+	github.com/docker/cli v29.7.2+incompatible
 	github.com/docker/go-connections v0.8.1
 	github.com/docker/go-units v0.5.0
 	github.com/go-git/go-billy/v5 v5.9.1
 	github.com/go-git/go-git/v5 v5.19.2
+	github.com/gobwas/glob v0.2.3
 	github.com/google/go-cmp v0.7.0
-	github.com/johannesboyne/gofakes3 v1.2.0
 	github.com/joho/godotenv v1.5.1
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/mattn/go-isatty v0.0.24
 	github.com/moby/go-archive v0.3.3
-	github.com/moby/moby/api v1.56.0
-	github.com/moby/moby/client v0.6.0
+	github.com/moby/moby/api v1.55.0
+	github.com/moby/moby/client v0.5.1
 	github.com/moby/patternmatcher v0.6.1
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/selinux v1.15.1
 	github.com/prometheus/client_golang v1.24.1
-	github.com/prometheus/client_model v0.6.3
-	github.com/sirupsen/logrus v1.10.2
+	github.com/prometheus/client_model v0.6.2
+	github.com/sirupsen/logrus v1.10.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.12.1
 	github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928
 	go.etcd.io/bbolt v1.5.0
-	go.opentelemetry.io/otel v1.46.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0
-	go.opentelemetry.io/otel/sdk v1.46.0
-	go.opentelemetry.io/otel/trace v1.46.0
-	go.opentelemetry.io/proto/otlp v1.11.0
-	go.yaml.in/yaml/v4 v4.0.0-rc.6
-	golang.org/x/net v0.59.0
-	golang.org/x/sync v0.23.0
-	golang.org/x/sys v0.48.0
-	golang.org/x/term v0.46.0
-	golang.org/x/text v0.42.0
+	go.yaml.in/yaml/v4 v4.0.0-rc.3
+	golang.org/x/net v0.58.0
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
+	golang.org/x/term v0.45.0
+	golang.org/x/text v0.41.0
 	google.golang.org/protobuf v1.36.12
 	gotest.tools/v3 v3.5.2
-	tags.cncf.io/container-device-interface v1.1.1
+	tags.cncf.io/container-device-interface v1.1.0
 )
 
 require (
@@ -59,13 +53,16 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.6.5 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
 	github.com/docker/docker-credential-helpers v0.9.8 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
@@ -73,12 +70,14 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/compress v1.19.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-runewidth v0.0.28 // indirect
+	github.com/mattn/go-shellwords v1.0.14 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/sys/sequential v0.7.0 // indirect
 	github.com/moby/sys/user v0.4.1 // indirect
@@ -88,18 +87,21 @@ require (
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
-	github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
+	github.com/rhysd/actionlint v1.7.12 // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
-	go.opentelemetry.io/otel/metric v1.46.0 // indirect
-	go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )

go.sum

@@ -1,11 +1,11 @@
-connectrpc.com/connect v1.21.0 h1:LhqSJt7jHf5NJBo9Jq/t/9FjcYAideif0mg+qe2jCUs=
-connectrpc.com/connect v1.21.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
+connectrpc.com/connect v1.20.0 h1:6TNDAB+WeNd2uolWNlYczB5E0KNNaVMNUEx8JEUsPmQ=
+connectrpc.com/connect v1.20.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
 cyphar.com/go-pathrs v0.2.5 h1:SnX9FBvnoyn3lUs1dkMgZ52bAETpirNu3FTRh5HlRik=
 cyphar.com/go-pathrs v0.2.5/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-gitea.dev/actionslib v1.2.1 h1:GL//K/0zIZV6h1OOksv1awvFVg0rg7fug2xWcG7mkG0=
-gitea.dev/actionslib v1.2.1/go.mod h1:1+gqOKGSEPn2IFHgY8S3GC5Ld+Hn8jF3OxiFHQ/fpx4=
+gitea.dev/actionslib v0.7.0 h1:JCV8eeIGwjlXcuSr7ojEdQC22VoE2466+K+D9vuQWKQ=
+gitea.dev/actionslib v0.7.0/go.mod h1:DI3Lqp+8TrycM7/semMdqsDQOHaBskjIAuMn+SXfZJ0=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -19,40 +19,14 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/avast/retry-go/v5 v5.0.0 h1:kf1Qc2UsTZ4qq8elDymqfbISvkyMuhgRxuJqX2NHP7k=
 github.com/avast/retry-go/v5 v5.0.0/go.mod h1://d+usmKWio1agtZfS1H/ltTqwtIfBnRq9zEwjc3eH8=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67 h1:9KxtdcIA/5xPNQyZRgUSpYOE6j9Bc4+D7nZua0KGYOM=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.67/go.mod h1:p3C44m+cfnbv763s52gCqrjaqyPikj9Sg47kUVaNZQQ=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75 h1:S61/E3N01oral6B3y9hZ2E1iFDqCZPPOBoBQretCnBI=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.75/go.mod h1:bDMQbkI1vJbNjnvJYpPTSNYBkI/VIv18ngWb/K84tkk=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
-github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
+github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cevatbarisyilmaz/ara v0.0.4 h1:SGH10hXpBJhhTlObuZzTuFn1rrdmjQImITXnZVPSodc=
-github.com/cevatbarisyilmaz/ara v0.0.4/go.mod h1:BfFOxnUd6Mj6xmcvRxHN3Sr21Z1T3U2MYkYOmoQe4Ts=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
 github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -70,10 +44,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
-github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v29.8.1+incompatible h1:qYL1bCp6cRw2SB1xmLlIOPyV171dilw9W2Jew38vy9c=
-github.com/docker/cli v29.8.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY=
+github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
 github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
@@ -84,6 +56,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -103,6 +77,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -115,8 +91,6 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/johannesboyne/gofakes3 v1.2.0 h1:I9VEzPWvvAUAGzDlhYFoZjF0AXMlkcEyZlmBwiI6Oms=
-github.com/johannesboyne/gofakes3 v1.2.0/go.mod h1:UHhRZRod9rENGFrUWTYnQHZqlNgSmjOq8DaD/ATQYRM=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
@@ -138,16 +112,22 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=
+github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-shellwords v1.0.14 h1:yUKzIgsCnosndOASY6/enly1EAuaXeFSQ7cdyA3OuYg=
+github.com/mattn/go-shellwords v1.0.14/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.3.3 h1:OxxR9paxsluYi+zDUEXTTaIxtkK3viymW+Ka7vRhhME=
 github.com/moby/go-archive v0.3.3/go.mod h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
-github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ=
-github.com/moby/moby/api v1.56.0/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
-github.com/moby/moby/client v0.6.0 h1:AJjEB21QPbXSXjDsZorFBoDZPhMrfbpaPLgSMAW9Bgs=
-github.com/moby/moby/client v0.6.0/go.mod h1:OCo00wNRyA3m4lmJ228W3JbyCN4ZNNYjpOXiJydBdcQ=
+github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
+github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/sys/mount v0.3.5 h1:eS3fsZTjHaBihwjp4/+5Z3jxqLXYsbwxqpVSfFv3M00=
@@ -177,28 +157,26 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
-github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
-github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
 github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
 github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
 github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/rhysd/actionlint v1.7.12 h1:vQ4GeJN86C0QH+gTUQcs8McmK62OLT3kmakPMtEWYnY=
+github.com/rhysd/actionlint v1.7.12/go.mod h1:krOUhujIsJusovkaYzQ/VNH8PFexjNKqU0q5XI/4w+g=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a8tTFrMLUcfWwyC0pnifVo2ClaLq+hP8=
-github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
-github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
+github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q=
+github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk=
 github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
 github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
-github.com/spf13/afero v1.2.1 h1:qgMbHoJbPbw579P+1zVY+6n4nIFuIchaIjzZ/I/Yq8M=
-github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -210,6 +188,7 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
@@ -220,6 +199,13 @@ github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 h1:zjNCuOOhh1T
 github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928/go.mod h1:PCFYfAEfKT+Nd6zWvUpsXduMR1bXFLf0uGSlEF05MCI=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
 go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
 go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
@@ -228,22 +214,16 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
-go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
-go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 h1:OFnwLJr+pF3iHrlGSzbxyuo6/6HyBlnlN1CWEJmBVcw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0/go.mod h1:716wFneO0ov19A2beH5hjfh9AK5z/VWNAtDijp1Y0/g=
-go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
-go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
-go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
-go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
-go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
-go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
-go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
-go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
-go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
-go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
-go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d h1:Ns9kd1Rwzw7t0BR8XMphenji4SmIoNZPn8zhYmaVKP8=
-go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d/go.mod h1:92Uoe3l++MlthCm+koNi0tcUCX3anayogF0Pa/sp24k=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
@@ -251,18 +231,18 @@ go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
-go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -271,25 +251,21 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce h1:xcEWjVhvbDy+nHP67nPDDpbYrY+ILlfndk4bRioVHaU=
-gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -301,5 +277,5 @@ gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
-tags.cncf.io/container-device-interface v1.1.1 h1:YPwQz4xg8PlQ0yT/baR0BtLpTQROe4l6M1yuRgAu1vc=
-tags.cncf.io/container-device-interface v1.1.1/go.mod h1:S1PSJWYPD4Iom0/39mvr/VVFCfG0Yt14j20d0OYrY2M=
+tags.cncf.io/container-device-interface v1.1.0 h1:RnxNhxF1JOu6CJUVpetTYvrXHdxw9j9jFYgZpI+anSY=
+tags.cncf.io/container-device-interface v1.1.0/go.mod h1:76Oj0Yqp9FwTx/pySDc8Bxjpg+VqXfDb50cKAXVJ34Q=

internal/app/cmd/cache-server.go

@@ -6,6 +6,8 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"os"
+	"os/signal"
 
 	"gitea.com/gitea/runner/act/artifactcache"
 	"gitea.com/gitea/runner/internal/app/run"
@@ -29,9 +31,6 @@ func runCacheServer(configFile *string, cacheArgs *cacheServerArgs) func(cmd *co
 		}
 
 		initLogging(cfg)
-		if cfg.Cache.S3 != nil {
-			return errors.New("cache-server does not support cache.s3; set cache.s3 on the runners instead")
-		}
 
 		var (
 			dir  = cfg.Cache.Dir
@@ -68,8 +67,10 @@ func runCacheServer(configFile *string, cacheArgs *cacheServerArgs) func(cmd *co
 
 		log.Infof("cache server is listening on %v", cacheHandler.ExternalURL())
 
-		<-cmd.Context().Done()
+		c := make(chan os.Signal, 1)
+		signal.Notify(c, os.Interrupt)
+		<-c
 
-		return cacheHandler.Close()
+		return nil
 	}
 }

internal/app/cmd/cmd.go

@@ -82,7 +82,7 @@ func Execute(ctx context.Context) {
 	// hide completion command
 	rootCmd.CompletionOptions.HiddenDefaultCmd = true
 
-	if err := rootCmd.ExecuteContext(ctx); err != nil {
+	if err := rootCmd.Execute(); err != nil {
 		os.Exit(1)
 	}
 }

internal/app/cmd/config.go

@@ -27,19 +27,6 @@ func loadConfigCmd(configFile *string) *cobra.Command {
 
 	configCmd.AddCommand(loadGenerateConfigCmd("generate"))
 	configCmd.AddCommand(loadInitConfigCmd(configFile))
-	configCmd.AddCommand(&cobra.Command{
-		Use:   "runner-file",
-		Short: "Print the registration file path used by the runner",
-		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
-			cfg, err := config.LoadDefault(*configFile)
-			if err != nil {
-				return err
-			}
-			fmt.Fprintln(cmd.OutOrStdout(), cfg.Runner.File)
-			return nil
-		},
-	})
 
 	configCmd.AddCommand(&cobra.Command{
 		Use:   "get <key>",

internal/app/cmd/config_test.go

@@ -97,14 +97,3 @@ func TestConfigCmdResolvesTheConfigFile(t *testing.T) {
 		assert.Contains(t, err.Error(), "--config")
 	})
 }
-
-func TestConfigCmdRunnerFileUsesConfiguredPathOrDefault(t *testing.T) {
-	out, _, err := runConfigCmd(t, "", "runner-file")
-	require.NoError(t, err)
-	assert.Equal(t, ".runner\n", out)
-	file := filepath.Join(t.TempDir(), "config.yaml")
-	require.NoError(t, os.WriteFile(file, []byte("runner:\n  file: 'state dir/registration.json'\n"), 0o600))
-	out, _, err = runConfigCmd(t, file, "runner-file")
-	require.NoError(t, err)
-	assert.Equal(t, "state dir/registration.json\n", out)
-}

internal/app/cmd/daemon.go

@@ -25,7 +25,6 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/lock"
 	"gitea.com/gitea/runner/internal/pkg/metrics"
 	"gitea.com/gitea/runner/internal/pkg/report"
-	"gitea.com/gitea/runner/internal/pkg/telemetry"
 	"gitea.com/gitea/runner/internal/pkg/ver"
 
 	"connectrpc.com/connect"
@@ -72,18 +71,6 @@ func runDaemon(ctx context.Context, daemArgs *daemonArgs, configFile *string) fu
 			defer func() { _ = releaseLock() }()
 		}
 
-		shutdownTelemetry, err := telemetry.Setup(ctx, reg.UUID, reg.Name)
-		if err != nil {
-			log.WithError(err).Warn("OpenTelemetry export failed to start")
-		}
-		defer func() {
-			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-			defer cancel()
-			if err := shutdownTelemetry(ctx); err != nil {
-				log.WithError(err).Warn("OpenTelemetry export failed to flush")
-			}
-		}()
-
 		lbls := resolveLabels(daemArgs.Labels, cfg.Runner.Labels, reg.Labels)
 
 		ls := labels.Labels{}

internal/app/cmd/exec.go

@@ -5,7 +5,6 @@
 package cmd
 
 import (
-	"cmp"
 	"context"
 	"crypto/rand"
 	"encoding/hex"
@@ -188,10 +187,7 @@ func (i *executeArgs) LoadEnvs() map[string]string {
 	envs := parseKVAndFile(i.envs, i.Envfile())
 
 	envs["ACTIONS_CACHE_URL"] = i.cacheHandler.ExternalURL() + "/"
-	// The same server answers cache v2, which docker buildx reads from the results origin alone.
-	if envs["ACTIONS_RESULTS_URL"] == "" {
-		envs["ACTIONS_RESULTS_URL"] = cmp.Or(os.Getenv("ACTIONS_RESULTS_URL"), i.cacheHandler.ExternalURL())
-	}
+	// The same server answers the cache service v2 API, so let the actions reach it.
 	envs[runner.CacheServiceV2Env] = "true"
 
 	return envs
@@ -544,7 +540,6 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command
 		}
 
 		config.Env["ACT_EXEC"] = "true"
-		config.Secrets[actionsRuntimeTokenEnvName] = actionsRuntimeToken
 
 		if t := config.Secrets["GITEA_TOKEN"]; t != "" {
 			config.Token = t

internal/app/cmd/exec_test.go

@@ -12,12 +12,9 @@ import (
 	"strings"
 	"testing"
 
-	"gitea.com/gitea/runner/act/artifactcache"
-	"gitea.com/gitea/runner/act/runner"
 	"gitea.com/gitea/runner/internal/pkg/config"
 
 	"gitea.dev/actionslib/pkg/model"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
 )
@@ -310,19 +307,3 @@ func captureStdout(t *testing.T, fn func()) string {
 	require.NoError(t, r.Close())
 	return buf.String()
 }
-
-func TestExecuteArgsLoadEnvsResultsOrigin(t *testing.T) {
-	t.Setenv("ACTIONS_RESULTS_URL", "") // the default is only supplied when nothing else does
-	handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: t.TempDir(), OutboundIP: "127.0.0.1"})
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = handler.Close() })
-	args := &executeArgs{cacheHandler: handler}
-
-	envs := args.LoadEnvs()
-	assert.Equal(t, handler.ExternalURL(), envs["ACTIONS_RESULTS_URL"],
-		"the v2 flag is advertised, so something has to serve that origin")
-	assert.Equal(t, "true", envs[runner.CacheServiceV2Env])
-
-	args.envs = []string{"ACTIONS_RESULTS_URL=https://gitea.example"}
-	assert.Equal(t, "https://gitea.example", args.LoadEnvs()["ACTIONS_RESULTS_URL"], "a supplied origin wins")
-}

internal/app/cmd/register_test.go

@@ -62,6 +62,7 @@ func TestRegisterInputsValidate(t *testing.T) {
 
 func TestValidateLabels(t *testing.T) {
 	require.NoError(t, validateLabels([]string{"ubuntu:host", "ubuntu:docker://node:18"}))
+	require.NoError(t, validateLabels([]string{"macos-latest:macos-vm://ghcr.io/cirruslabs/macos-sonoma-base:latest"}))
 	// a colon that is not a supported schema is part of the label name
 	require.NoError(t, validateLabels([]string{"pool:e57e18d4-10d4-406f-93bf-60f127221bdd"}))
 	require.Error(t, validateLabels([]string{"ubuntu:host", ""}))

internal/app/run/runner.go

@@ -5,16 +5,12 @@ package run
 
 import (
 	"bytes"
-	"cmp"
 	"context"
 	"encoding/json/v2"
 	"errors"
 	"fmt"
 	"maps"
-	"net"
 	"net/http"
-	"net/netip"
-	"net/url"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -36,7 +32,6 @@ import (
 	"gitea.com/gitea/runner/internal/pkg/labels"
 	"gitea.com/gitea/runner/internal/pkg/metrics"
 	"gitea.com/gitea/runner/internal/pkg/report"
-	"gitea.com/gitea/runner/internal/pkg/telemetry"
 	"gitea.com/gitea/runner/internal/pkg/ver"
 
 	"connectrpc.com/connect"
@@ -44,7 +39,6 @@ import (
 	runnerv1 "gitea.dev/actionslib/runner/v1"
 	docker_container "github.com/moby/moby/api/types/container"
 	log "github.com/sirupsen/logrus"
-	"go.yaml.in/yaml/v4"
 )
 
 // CapabilityCancelling tells the server this runner understands the
@@ -72,8 +66,6 @@ type Runner struct {
 	cacheHandler *artifactcache.Handler
 	capabilities string
 
-	isolatedCacheContainer func() string
-
 	runningTasks            sync.Map
 	runningCount            atomic.Int64
 	lastIdleCleanupUnixNano atomic.Int64
@@ -97,24 +89,27 @@ func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client)
 	envs := make(map[string]string, len(cfg.Runner.Envs))
 	maps.Copy(envs, cfg.Runner.Envs)
 	var cacheHandler *artifactcache.Handler
-	if cacheEnabled(cfg) {
-		warnIgnoredCachePolicy(cfg)
-		warnIgnoredCacheSecret(cfg)
-		handler, err := artifactcache.StartHandler(artifactcache.Options{
-			Dir:        cfg.Cache.Dir,
-			OutboundIP: cfg.Cache.Host,
-			Port:       cfg.Cache.Port,
-			Upstream:   cfg.Cache.ExternalServer,
-			S3:         cacheS3(cfg),
-			Policy:     CachePolicy(cfg),
-			Logger:     log.StandardLogger().WithField("module", "cache_request"),
-		})
-		if err != nil {
-			log.Errorf("cannot init cache server, it will be disabled: %v", err)
-			// go on
+	if cfg.Cache.Enabled == nil || *cfg.Cache.Enabled {
+		if cfg.Cache.ExternalServer != "" {
+			warnIgnoredCachePolicy(cfg)
+			// The v1 client appends its path to this without a separator, so the slash is required.
+			envs["ACTIONS_CACHE_URL"] = strings.TrimRight(cfg.Cache.ExternalServer, "/") + "/"
 		} else {
-			cacheHandler = handler
-			envs["ACTIONS_CACHE_URL"] = handler.ExternalURL() + "/"
+			warnIgnoredCacheSecret(cfg)
+			handler, err := artifactcache.StartHandler(artifactcache.Options{
+				Dir:        cfg.Cache.Dir,
+				OutboundIP: cfg.Cache.Host,
+				Port:       cfg.Cache.Port,
+				Policy:     CachePolicy(cfg),
+				Logger:     log.StandardLogger().WithField("module", "cache_request"),
+			})
+			if err != nil {
+				log.Errorf("cannot init cache server, it will be disabled: %v", err)
+				// go on
+			} else {
+				cacheHandler = handler
+				envs["ACTIONS_CACHE_URL"] = handler.ExternalURL() + "/"
+			}
 		}
 	}
 
@@ -138,7 +133,6 @@ func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client)
 		now:            time.Now,
 		runHealthCheck: executeHealthCheck,
 	}
-	runner.isolatedCacheContainer = sync.OnceValue(runner.detectIsolatedCacheContainer)
 	return runner
 }
 
@@ -150,7 +144,8 @@ func (r *Runner) Close() error {
 // removeOrphanNetworks is a variable so tests can substitute one that needs no Docker daemon.
 var removeOrphanNetworks = container.RemoveOrphanNetworks
 
-var removeOrphanJobVolumes = container.RemoveOrphanJobVolumes
+// removeOrphanMacOSVMs is a variable so tests can substitute one that needs no macOS VM executor.
+var removeOrphanMacOSVMs = container.CleanupOrphanMacOSVMs
 
 // OnIdle performs lightweight maintenance during polling idle windows.
 // It runs synchronously on the poller goroutine; shouldRunIdleCleanup
@@ -173,19 +168,31 @@ func (r *Runner) OnIdle(ctx context.Context) {
 	if hostRoot := filepath.FromSlash(r.cfg.Host.WorkdirParent); hostRoot != "" {
 		r.cleanupStaleDirs(ctx, hostRoot, isHostScratchDir)
 	}
-	r.cleanupOrphanDockerResources(ctx)
+	r.cleanupOrphanNetworks(ctx)
+	r.cleanupOrphanMacOSVMs(ctx)
 }
 
-func (r *Runner) cleanupOrphanDockerResources(ctx context.Context) {
-	if r.uuid == "" || (!r.requiresDocker() && !dockerReachable(ctx)) {
+// cleanupOrphanNetworks reclaims the per-job networks of jobs this runner did not live to
+// tear down. A labelled network with no containers on it is finished with, and as for the
+// directories above, a task beginning during the pass is safe because the cutoff keeps a
+// network it has created but not yet attached a container to out of scope.
+func (r *Runner) cleanupOrphanNetworks(ctx context.Context) {
+	if r.uuid == "" || !r.requiresDocker() {
 		return
 	}
 	cutoff := r.now().Add(-r.cfg.Runner.WorkdirCleanupAge)
-	if err := removeOrphanNetworks(ctx, r.uuid, r.isolatedCacheContainer(), cutoff); err != nil {
+	if err := removeOrphanNetworks(ctx, r.uuid, cutoff); err != nil {
 		log.Warnf("failed to clean up networks left behind by earlier jobs: %v", err)
 	}
-	if err := removeOrphanJobVolumes(ctx, r.uuid, cutoff); err != nil {
-		log.Warnf("failed to clean up volumes left behind by earlier jobs: %v", err)
+}
+
+func (r *Runner) cleanupOrphanMacOSVMs(ctx context.Context) {
+	if r.uuid == "" || !r.labels.RequireMacOSVM() || r.cfg.Runner.WorkdirCleanupAge <= 0 {
+		return
+	}
+	cutoff := r.now().Add(-r.cfg.Runner.WorkdirCleanupAge)
+	if err := removeOrphanMacOSVMs(ctx, r.cfg.MacOSVM.ExecutorPath, r.uuid, cutoff); err != nil {
+		log.Warnf("failed to clean up macOS VMs left behind by earlier jobs: %v", err)
 	}
 }
 
@@ -286,44 +293,32 @@ func (r *Runner) SetCapabilitiesFromDeclare(resp *connect.Response[runnerv1.Decl
 }
 
 func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) error {
-	if _, ok := r.runningTasks.LoadOrStore(task.Id, struct{}{}); ok {
+	if _, ok := r.runningTasks.Load(task.Id); ok {
 		return fmt.Errorf("task %d is already running", task.Id)
 	}
+	r.runningTasks.Store(task.Id, struct{}{})
 	defer r.runningTasks.Delete(task.Id)
 
 	r.runningCount.Add(1)
-	defer r.runningCount.Add(-1)
 
 	start := time.Now()
 
 	ctx, cancel := context.WithTimeout(ctx, r.cfg.Runner.Timeout)
 	defer cancel()
-	ctx, endJob := telemetry.StartJob(ctx, task)
 	// A proxy URL may carry credentials, and every job is given it; keep them out of the log.
 	reporter := report.NewReporter(ctx, cancel, r.client, task, r.cfg, proxyPasswords()...)
-	var volumeCleanup []common.Executor
-	var volumeCleanupMu sync.Mutex
-	if r.cfg.Runner.PostTaskScript == "" {
-		ctx = runner.WithJobVolumeCleanup(ctx, func(cleanup common.Executor) {
-			volumeCleanupMu.Lock()
-			defer volumeCleanupMu.Unlock()
-			volumeCleanup = append(volumeCleanup, cleanup)
-		})
-	}
 	var runErr error
 	defer func() {
+		r.runningCount.Add(-1)
+
 		lastWords := ""
 		if runErr != nil {
 			lastWords = runErr.Error()
 		}
 		_ = reporter.Close(lastWords)
-		if err := cleanupJobVolumes(ctx, volumeCleanup); err != nil {
-			log.Warnf("task %d volume cleanup after reporting: %v", task.Id, err)
-		}
 
 		metrics.JobDuration.Observe(time.Since(start).Seconds())
 		metrics.JobsTotal.WithLabelValues(metrics.ResultToStatusLabel(reporter.Result())).Inc()
-		endJob(reporter.Result())
 	}()
 	reporter.RunDaemon()
 	runErr = r.run(ctx, task, reporter)
@@ -331,16 +326,6 @@ func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) error {
 	return nil
 }
 
-func cleanupJobVolumes(ctx context.Context, cleanups []common.Executor) error {
-	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), time.Minute)
-	defer cancel()
-	var errs []error
-	for _, cleanup := range cleanups {
-		errs = append(errs, cleanup(ctx))
-	}
-	return errors.Join(errs...)
-}
-
 func (r *Runner) cloneEnvs() map[string]string {
 	// Reserve space for the per-task keys injected by run():
 	// ACTIONS_ID_TOKEN_REQUEST_URL, ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_RUNTIME_TOKEN,
@@ -350,25 +335,6 @@ func (r *Runner) cloneEnvs() map[string]string {
 	return envs
 }
 
-// restoreCalledWorkflowContext undoes Gitea's rewrite of `event_name` and `event.inputs` for older runners,
-// and returns the job's `inputs` from `gitea_workflow_call`, nil if it is not a called workflow's job.
-// See https://github.com/go-gitea/gitea/pull/39452
-func restoreCalledWorkflowContext(task *runnerv1.Task) map[string]any {
-	workflowCall := task.GetContext().GetFields()["gitea_workflow_call"].GetStructValue().GetFields()
-	if workflowCall == nil {
-		return nil
-	}
-	task.Context.Fields["event_name"] = workflowCall["original_event_name"]
-	if event := task.Context.Fields["event"].GetStructValue(); event != nil {
-		if inputs, ok := workflowCall["original_event_inputs"]; ok {
-			event.Fields["inputs"] = inputs
-		} else {
-			delete(event.Fields, "inputs")
-		}
-	}
-	return workflowCall["inputs"].GetStructValue().AsMap()
-}
-
 // getDefaultActionsURL
 // when DEFAULT_ACTIONS_URL == "https://github.com" and GithubMirror is not blank,
 // it should be set to GithubMirror first.
@@ -417,7 +383,6 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		}
 	}()
 
-	workflowCallInputs := restoreCalledWorkflowContext(task)
 	r.reportSetup(reporter, task)
 
 	workflow, jobID, err := generateWorkflow(task)
@@ -431,29 +396,13 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	}
 	job := workflow.GetJob(jobID)
 	reporter.ResetSteps(len(job.Steps))
-	telemetry.SetJobName(ctx, cmp.Or(job.Name, jobID))
 
 	taskContext := task.Context.Fields
 	envs := r.cloneEnvs()
 
-	// act asks for the platform once per step, so resolve the fallback at most once per task.
-	fallbackPlatform := sync.OnceValue(func() string { return r.fallbackPlatform(ctx) })
-	platformPicker := func(runsOn []string) string {
-		if platform := r.labels.PickPlatform(runsOn); platform != "" {
-			return platform
-		}
-		return fallbackPlatform()
-	}
-	cacheURL, cacheContainer := r.cacheForJob(job, platformPicker)
-	if cacheURL != "" {
-		envs["ACTIONS_CACHE_URL"] = cacheURL + "/"
-	}
-
 	// Added per task because this job's service containers must be reached directly, and
 	// act reaches them by their workflow key.
-	var services map[string]yaml.Node
-	_ = job.RawServices.Decode(&services) // a whole-value expression names no service before evaluation
-	proxyEnv := JobProxyEnv(envs, cacheURL, slices.Sorted(maps.Keys(services)))
+	proxyEnv := JobProxyEnv(envs, envs["ACTIONS_CACHE_URL"], slices.Sorted(maps.Keys(job.Services)))
 	maps.Copy(envs, proxyEnv)
 
 	if r.capabilities != "" {
@@ -462,13 +411,29 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	if v := taskContext["run_id"].GetStringValue(); v != "" {
 		envs["GITEA_RUN_ID"] = v
 	}
-	telemetry.AddJobEnv(ctx, envs)
 
 	log.Infof("task %v repo is %v %v %v", task.Id, taskContext["repository"].GetStringValue(),
 		r.getDefaultActionsURL(task),
 		r.client.Address())
 
-	preset := model.GithubContextFromMap(task.Context.AsMap())
+	preset := &model.GithubContext{
+		Event:           taskContext["event"].GetStructValue().AsMap(),
+		RunID:           taskContext["run_id"].GetStringValue(),
+		RunNumber:       taskContext["run_number"].GetStringValue(),
+		RunAttempt:      taskContext["run_attempt"].GetStringValue(),
+		Actor:           taskContext["actor"].GetStringValue(),
+		Repository:      taskContext["repository"].GetStringValue(),
+		EventName:       taskContext["event_name"].GetStringValue(),
+		Sha:             taskContext["sha"].GetStringValue(),
+		Ref:             taskContext["ref"].GetStringValue(),
+		RefName:         taskContext["ref_name"].GetStringValue(),
+		RefType:         taskContext["ref_type"].GetStringValue(),
+		HeadRef:         taskContext["head_ref"].GetStringValue(),
+		BaseRef:         taskContext["base_ref"].GetStringValue(),
+		Token:           taskContext["token"].GetStringValue(),
+		RepositoryOwner: taskContext["repository_owner"].GetStringValue(),
+		RetentionDays:   taskContext["retention_days"].GetStringValue(),
+	}
 	if t := task.Secrets["GITEA_TOKEN"]; t != "" {
 		preset.Token = t
 	} else if t := task.Secrets["GITHUB_TOKEN"]; t != "" {
@@ -498,9 +463,19 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	// cache requests from the job container can authenticate. The credential
 	// is removed when the task finishes, so a leaked token stops working as
 	// soon as the job ends rather than remaining valid for the runner's
-	// lifetime.
-	revokeCache, resultsURL := r.registerCacheForTask(giteaRuntimeToken, preset.Repository, cacheURL, reporter)
+	// lifetime. Only applies to the embedded cache server; when the operator
+	// points the runner at an external cache via cfg.Cache.ExternalServer, it
+	// is that server's responsibility to authenticate requests.
+	revokeCache, resultsURL := r.registerCacheForTask(giteaRuntimeToken, preset.Repository, reporter)
 	defer revokeCache()
+	// A cache server that agreed to forward the artifact half is the whole results service, so the
+	// job is pointed at it.
+	if resultsURL != "" {
+		envs["ACTIONS_RESULTS_URL"] = resultsURL
+		if r.cacheServiceV2() {
+			envs[runner.CacheServiceV2Env] = "true"
+		}
+	}
 
 	eventJSON, err := json.Marshal(preset.Event)
 	if err != nil {
@@ -532,7 +507,14 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	// Without bind_workdir, the workspace path omits the task id; concurrent host-mode jobs
 	// for the same repository would share this directory and can race with per-job cleanup.
 
-	r.setResultsService(envs, resultsURL)
+	// act asks for the platform once per step, so resolve the fallback at most once per task.
+	fallbackPlatform := sync.OnceValue(func() string { return r.fallbackPlatform(ctx) })
+	platformPicker := func(runsOn []string) string {
+		if platform := r.labels.PickPlatform(runsOn); platform != "" {
+			return platform
+		}
+		return fallbackPlatform()
+	}
 
 	runnerConfig := &runner.Config{
 		// On Linux, Workdir will be like "/<parent_directory>/<owner>/<repo>"
@@ -556,13 +538,11 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		NoSkipCheckout:       true,
 		DisableActEnv:        r.cfg.Runner.SetActEnv != nil && !*r.cfg.Runner.SetActEnv,
 		PresetGitHubContext:  preset,
-		WorkflowCallInputs:   workflowCallInputs,
 		EventJSON:            string(eventJSON),
 		ContainerNamePrefix:  fmt.Sprintf("GITEA-ACTIONS-TASK-%d", task.Id),
 		ContainerMaxLifetime: maxLifetime,
 		CleanWorkdir:         true,
 		ContainerNetworkMode: docker_container.NetworkMode(r.cfg.Container.Network),
-		CacheContainer:       cacheContainer,
 		ContainerNetworkCreateOptions: container.NewDockerNetworkCreateExecutorInput{
 			EnableIPv4: r.cfg.Container.NetworkCreateOptions.EnableIPv4,
 			EnableIPv6: r.cfg.Container.NetworkCreateOptions.EnableIPv6,
@@ -582,8 +562,16 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		Vars:                              task.Vars,
 		ValidVolumes:                      r.cfg.Container.ValidVolumes,
 		SharedToolCache:                   r.cfg.Runner.ToolCacheMode == config.ToolCacheModeShared,
-		InsecureSkipTLS:                   r.cfg.Runner.Insecure,
-		RunnerName:                        r.name,
+		MacOSVM: runner.MacOSVMConfig{
+			ExecutorPath:  r.cfg.MacOSVM.ExecutorPath,
+			WorkdirParent: r.cfg.MacOSVM.WorkdirParent,
+			CPU:           r.cfg.MacOSVM.CPU,
+			Memory:        r.cfg.MacOSVM.Memory,
+			BootTimeout:   r.cfg.MacOSVM.BootTimeout,
+		},
+		InsecureSkipTLS: r.cfg.Runner.Insecure,
+		RunnerUUID:      r.uuid,
+		RunnerName:      r.name,
 	}
 
 	rr, err := runner.New(runnerConfig)
@@ -618,66 +606,43 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	return execErr
 }
 
-func (r *Runner) builtInCacheURL() string {
-	if r.cacheHandler == nil {
-		return ""
-	}
-	return r.envs["ACTIONS_CACHE_URL"]
-}
-
-func cacheEnabled(cfg *config.Config) bool {
-	return cfg.Cache.Enabled == nil || *cfg.Cache.Enabled
-}
-
 // cacheServiceV2 reports whether jobs are told the cache service speaks v2. It is all cache.v2
 // turns off: the bundle edit that reaches it is what the artifact actions need too.
 func (r *Runner) cacheServiceV2() bool {
 	return r.cfg.Cache.V2 == nil || *r.cfg.Cache.V2
 }
 
-func (r *Runner) setResultsService(envs map[string]string, resultsURL string) {
-	v2 := resultsURL != "" && r.cacheServiceV2()
-	if v2 {
-		envs[runner.CacheServiceV2Env] = "true"
-	} else {
-		delete(envs, runner.CacheServiceV2Env)
-	}
-	// Cache v2 clients read no other variable for it, and some cannot use the instance address.
-	if v2 || (resultsURL != "" && r.instanceOutOfReach(envs["ACTIONS_RESULTS_URL"])) {
-		envs["ACTIONS_RESULTS_URL"] = resultsURL
-	}
-}
-
-// These clients keep only the origin they are handed, and reach it on the job's own trust.
-func (r *Runner) instanceOutOfReach(instance string) bool {
-	parsed, err := url.Parse(instance)
-	return err != nil || strings.Trim(parsed.Path, "/") != "" ||
-		(r.cfg.Runner.Insecure && parsed.Scheme == "https")
-}
-
 // registerCacheForTask tells the cache server to accept requests authenticated
 // with the given runtime token for the duration of this task. Returns a
 // function the caller must invoke (typically via defer) to revoke the
 // credential when the task finishes.
 //
+// Two modes:
+//   - Embedded handler: register in-process via RegisterJob.
+//   - external_server: POST to the remote server's /_internal/register, defer a
+//     POST to /_internal/revoke. This is what enables full per-job auth and
+//     repo scoping over the network.
+//
 // Safe with an empty token (older Gitea did not issue one).
-// It also returns the URL to advertise as ACTIONS_RESULTS_URL.
-func (r *Runner) registerCacheForTask(token, repo, publicURL string, reporter *report.Reporter) (func(), string) {
-	if token == "" || r.cacheHandler == nil {
+// It also returns the URL to advertise as ACTIONS_RESULTS_URL, which is the cache server itself
+// when it agreed to forward this instance's artifact service, and "" when it did not.
+func (r *Runner) registerCacheForTask(token, repo string, reporter *report.Reporter) (func(), string) {
+	if token == "" {
 		return func() {}, ""
 	}
 	cred := artifactcache.JobCredential{
 		Repo:        repo,
-		PublicURL:   publicURL,
 		Results:     r.envs["ACTIONS_RESULTS_URL"], // the instance as the job would reach it
 		InsecureTLS: r.cfg.Runner.Insecure,
 	}
-	revoke := r.cacheHandler.RegisterJob(token, cred)
-	if r.cfg.Cache.ExternalServer != "" {
-		revokeLocal, revokeExternal := revoke, r.registerExternalCacheJob(token, repo, publicURL, reporter)
-		revoke = func() { revokeLocal(); revokeExternal() }
+	if r.cacheHandler != nil {
+		return r.cacheHandler.RegisterJob(token, cred), r.cacheHandler.ResultsURL(cred)
 	}
-	return revoke, r.cacheHandler.ResultsURL(cred)
+	if r.cfg.Cache.ExternalServer != "" && r.cfg.Cache.ExternalSecret != "" {
+		return r.registerExternalCacheJob(token, cred, reporter)
+	}
+	// No cache server to register against: caching is disabled, or the built-in server failed to start.
+	return func() {}, ""
 }
 
 // registerExternalCacheJob POSTs to the remote cache-server's control-plane.
@@ -685,19 +650,23 @@ func (r *Runner) registerCacheForTask(token, repo, publicURL string, reporter *r
 // 401 the job's requests — better than failing the whole task for a cache
 // outage. The warning is mirrored to the job log so users can see why their
 // cache calls 401, instead of having to read the runner daemon's stderr.
-func (r *Runner) registerExternalCacheJob(token, repo, publicURL string, reporter *report.Reporter) func() {
+func (r *Runner) registerExternalCacheJob(token string, cred artifactcache.JobCredential, reporter *report.Reporter) (func(), string) {
 	base := strings.TrimRight(r.cfg.Cache.ExternalServer, "/")
-	if err := postInternalCache(base+"/_internal/register", r.cfg.Cache.ExternalSecret, map[string]any{
-		"token": token, "repo": repo, "public_url": publicURL,
+	resultsURL := ""
+	if body, err := postInternalCache(base+"/_internal/register", r.cfg.Cache.ExternalSecret, map[string]any{
+		"token": token, "repo": cred.Repo, "results": cred.Results, "insecure_tls": cred.InsecureTLS,
+		"public_url": base,
 	}); err != nil {
 		log.Warnf("cache external_server register failed (%s): %v", base, err)
 		if reporter != nil {
 			reporter.Logf("::warning::%s", runner.EscapeCommandData(fmt.Sprintf(
 				"cache external_server register failed (%s): %v — cache requests from this job will be unauthenticated and likely return 401", base, err)))
 		}
+	} else if forwarded, _ := body["results_url"].(string); forwarded != "" {
+		resultsURL = base // the answer only says it forwards, its own address need not be the job's
 	}
 	return func() {
-		if err := postInternalCache(base+"/_internal/revoke", r.cfg.Cache.ExternalSecret,
+		if _, err := postInternalCache(base+"/_internal/revoke", r.cfg.Cache.ExternalSecret,
 			map[string]any{"token": token}); err != nil {
 			log.Warnf("cache external_server revoke failed (%s): %v", base, err)
 			if reporter != nil {
@@ -705,30 +674,33 @@ func (r *Runner) registerExternalCacheJob(token, repo, publicURL string, reporte
 					"cache external_server revoke failed (%s): %v", base, err)))
 			}
 		}
-	}
+	}, resultsURL
 }
 
-func postInternalCache(url, secret string, body map[string]any) error {
+func postInternalCache(url, secret string, body map[string]any) (map[string]any, error) {
 	buf, err := json.Marshal(body)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(buf))
 	if err != nil {
-		return err
+		return nil, err
 	}
 	req.Header.Set("Authorization", "Bearer "+secret)
 	req.Header.Set("Content-Type", "application/json")
 	client := &http.Client{Timeout: 5 * time.Second}
 	resp, err := client.Do(req)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode/100 != 2 {
-		return fmt.Errorf("status %d", resp.StatusCode)
+		return nil, fmt.Errorf("status %d", resp.StatusCode)
 	}
-	return nil
+	answer := map[string]any{}
+	// A server too old to answer with a body is not an error, it simply tells us nothing.
+	_ = json.UnmarshalRead(resp.Body, &answer)
+	return answer, nil
 }
 
 func (r *Runner) RunningCount() int64 {
@@ -824,27 +796,12 @@ func CachePolicy(cfg *config.Config) artifactcache.Policy {
 	}
 }
 
-func cacheS3(cfg *config.Config) *artifactcache.S3Options {
-	s3 := cfg.Cache.S3
-	if s3 == nil {
-		return nil
-	}
-	return &artifactcache.S3Options{
-		Endpoint: s3.Endpoint, Region: s3.Region, Bucket: s3.Bucket, Prefix: s3.Prefix,
-		PathStyle: s3.PathStyle, AccessKey: s3.AccessKey, SecretKey: s3.SecretKey,
-	}
-}
-
-// warnIgnoredCachePolicy flags eviction settings configured on a runner that does not apply them.
+// warnIgnoredCachePolicy flags eviction settings configured on a runner that points at an external cache server.
 func warnIgnoredCachePolicy(cfg *config.Config) {
 	defaults := config.DefaultCache()
-	limits := cfg.Cache.Retention != defaults.Retention || cfg.Cache.RepoSizeLimit != defaults.RepoSizeLimit ||
-		cfg.Cache.SizeLimit != defaults.SizeLimit
-	switch {
-	case cfg.Cache.ExternalServer != "" && (limits || cfg.Cache.SweepInterval != defaults.SweepInterval):
+	if cfg.Cache.Retention != defaults.Retention || cfg.Cache.RepoSizeLimit != defaults.RepoSizeLimit ||
+		cfg.Cache.SizeLimit != defaults.SizeLimit || cfg.Cache.SweepInterval != defaults.SweepInterval {
 		log.Warn("cache eviction settings are ignored when cache.external_server is set; configure them on that server instead")
-	case cfg.Cache.S3 != nil && limits:
-		log.Warn("cache eviction settings are ignored when cache.s3 is set; use lifecycle rules on the bucket instead")
 	}
 }
 
@@ -864,35 +821,3 @@ func warnIgnoredCacheSecret(cfg *config.Config) {
 	}
 	log.Warnf("%s is set but cache.external_server is not; the built-in cache server does not use a shared secret, so the value is ignored", key)
 }
-
-// cacheForJob returns the cache address for the job, and the container to attach to its network to reach it there.
-func (r *Runner) cacheForJob(job *model.Job, pickPlatform func([]string) string) (string, string) {
-	jobContainer := job.Container()
-	cacheContainer := ""
-	if jobContainer != nil && jobContainer.Image != "" || pickPlatform(job.RunsOn()) != labels.SelfHostedPlatform {
-		cacheContainer = r.isolatedCacheContainer()
-	}
-	if cacheContainer == "" {
-		return strings.TrimSuffix(r.builtInCacheURL(), "/"), ""
-	}
-	cacheURL, _ := url.Parse(r.cacheHandler.ExternalURL())
-	cacheURL.Host = net.JoinHostPort(cacheContainer, cacheURL.Port())
-	return cacheURL.String(), cacheContainer
-}
-
-func (r *Runner) detectIsolatedCacheContainer() string {
-	if r.cacheHandler == nil {
-		return ""
-	}
-	addr, err := netip.ParseAddr(hostOf(r.cacheHandler.ExternalURL()))
-	if err != nil {
-		return ""
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	cacheContainer, err := container.IsolatedCacheContainer(ctx, addr, r.cfg.Container.Network)
-	if err != nil {
-		log.Warnf("cannot check whether jobs reach the cache server: %v", err)
-	}
-	return cacheContainer
-}