Merge gitea/act into act/

Merges the `gitea.com/gitea/act` fork into this repository as the `act/`
directory and consumes it as a local package. The `replace github.com/nektos/act
=> gitea.com/gitea/act` directive is removed; act's dependencies are merged
into the root `go.mod`.

- Imports rewritten: `github.com/nektos/act/pkg/...` → `gitea.com/gitea/act_runner/act/...`
  (flattened — `pkg/` boundary dropped to match the layout forgejo-runner adopted).
- Dropped act's CLI (`cmd/`, `main.go`) and all upstream project files; kept
  the library tree + `LICENSE`.
- Added `// Copyright <year> The Gitea Authors ...` / `// Copyright <year> nektos`
  headers to 104 `.go` files.
- Pre-existing act lint violations annotated inline with
  `//nolint:<linter> // pre-existing issue from nektos/act`.
  `.golangci.yml` is unchanged vs `main`.
- Makefile test target: `-race -short` (matches forgejo-runner).
- Pre-existing integration test failures fixed: race in parallel executor
  (atomic counters); TestSetupEnv / command_test / expression_test /
  run_context_test updated to match gitea fork runtime; TestJobExecutor and
  TestActionCache gated on `testing.Short()`.

Full `gitea/act` commit history is reachable via the second parent.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>

act/runner/action.go

@@ -0,0 +1,728 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"embed"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/kballard/go-shellquote"
+)
+
+type actionStep interface {
+	step
+
+	getActionModel() *model.Action
+	getCompositeRunContext(context.Context) *RunContext
+	getCompositeSteps() *compositeSteps
+}
+
+type readAction func(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error)
+
+type actionYamlReader func(filename string) (io.Reader, io.Closer, error)
+
+type fileWriter func(filename string, data []byte, perm fs.FileMode) error
+
+type runAction func(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor
+
+//go:embed res/trampoline.js
+var trampoline embed.FS
+
+func readActionImpl(ctx context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
+	logger := common.Logger(ctx)
+	allErrors := []error{}
+	addError := func(fileName string, err error) {
+		if err != nil {
+			allErrors = append(allErrors, fmt.Errorf("failed to read '%s' from action '%s' with path '%s' of step %w", fileName, step.String(), actionPath, err))
+		} else {
+			// One successful read, clear error state
+			allErrors = nil
+		}
+	}
+	reader, closer, err := readFile("action.yml")
+	addError("action.yml", err)
+	if os.IsNotExist(err) {
+		reader, closer, err = readFile("action.yaml")
+		addError("action.yaml", err)
+		if os.IsNotExist(err) {
+			_, closer, err := readFile("Dockerfile")
+			addError("Dockerfile", err)
+			if err == nil {
+				closer.Close()
+				action := &model.Action{
+					Name: "(Synthetic)",
+					Runs: model.ActionRuns{
+						Using: "docker",
+						Image: "Dockerfile",
+					},
+				}
+				logger.Debugf("Using synthetic action %v for Dockerfile", action)
+				return action, nil
+			}
+			if step.With != nil {
+				if val, ok := step.With["args"]; ok {
+					var b []byte
+					if b, err = trampoline.ReadFile("res/trampoline.js"); err != nil {
+						return nil, err
+					}
+					err2 := writeFile(filepath.Join(actionDir, actionPath, "trampoline.js"), b, 0o400)
+					if err2 != nil {
+						return nil, err2
+					}
+					action := &model.Action{
+						Name: "(Synthetic)",
+						Inputs: map[string]model.Input{
+							"cwd": {
+								Description: "(Actual working directory)",
+								Required:    false,
+								Default:     filepath.Join(actionDir, actionPath),
+							},
+							"command": {
+								Description: "(Actual program)",
+								Required:    false,
+								Default:     val,
+							},
+						},
+						Runs: model.ActionRuns{
+							Using: "node12",
+							Main:  "trampoline.js",
+						},
+					}
+					logger.Debugf("Using synthetic action %v", action)
+					return action, nil
+				}
+			}
+		}
+	}
+	if allErrors != nil {
+		return nil, errors.Join(allErrors...)
+	}
+	defer closer.Close()
+
+	action, err := model.ReadAction(reader)
+	// For Gitea, reduce log noise
+	// logger.Debugf("Read action %v from '%s'", action, "Unknown")
+	return action, err
+}
+
+func maybeCopyToActionDir(ctx context.Context, step actionStep, actionDir, actionPath, containerActionDir string) error {
+	logger := common.Logger(ctx)
+	rc := step.getRunContext()
+	stepModel := step.getStepModel()
+
+	if stepModel.Type() != model.StepTypeUsesActionRemote {
+		return nil
+	}
+
+	var containerActionDirCopy string
+	containerActionDirCopy = strings.TrimSuffix(containerActionDir, actionPath)
+	logger.Debug(containerActionDirCopy)
+
+	if !strings.HasSuffix(containerActionDirCopy, `/`) {
+		containerActionDirCopy += `/`
+	}
+
+	if rc.Config != nil && rc.Config.ActionCache != nil {
+		raction := step.(*stepActionRemote)
+		ta, err := rc.Config.ActionCache.GetTarArchive(ctx, raction.cacheDir, raction.resolvedSha, "")
+		if err != nil {
+			return err
+		}
+		defer ta.Close()
+		return rc.JobContainer.CopyTarStream(ctx, containerActionDirCopy, ta)
+	}
+
+	if err := removeGitIgnore(ctx, actionDir); err != nil {
+		return err
+	}
+
+	return rc.JobContainer.CopyDir(containerActionDirCopy, actionDir+"/", rc.Config.UseGitIgnore)(ctx)
+}
+
+func runActionImpl(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor {
+	rc := step.getRunContext()
+	stepModel := step.getStepModel()
+
+	return func(ctx context.Context) error {
+		logger := common.Logger(ctx)
+		actionPath := ""
+		if remoteAction != nil && remoteAction.Path != "" {
+			actionPath = remoteAction.Path
+		}
+
+		action := step.getActionModel()
+		// For Gitea, reduce log noise
+		// logger.Debugf("About to run action %v", action)
+
+		err := setupActionEnv(ctx, step, remoteAction)
+		if err != nil {
+			return err
+		}
+
+		actionLocation := path.Join(actionDir, actionPath)
+		actionName, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
+
+		logger.Debugf("type=%v actionDir=%s actionPath=%s workdir=%s actionCacheDir=%s actionName=%s containerActionDir=%s", stepModel.Type(), actionDir, actionPath, rc.Config.Workdir, rc.ActionCacheDir(), actionName, containerActionDir)
+
+		x := action.Runs.Using
+		switch {
+		case x.IsNode():
+			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
+				return err
+			}
+			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Main)}
+			logger.Debugf("executing remote job container: %s", containerArgs)
+
+			rc.ApplyExtraPath(ctx, step.getEnv())
+
+			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
+		case x.IsDocker():
+			location := actionLocation
+			if remoteAction == nil {
+				location = containerActionDir
+			}
+			return execAsDocker(ctx, step, actionName, location, remoteAction == nil)
+		case x.IsComposite():
+			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
+				return err
+			}
+
+			return execAsComposite(step)(ctx)
+		case x == model.ActionRunsUsingGo:
+			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
+				return err
+			}
+
+			rc.ApplyExtraPath(ctx, step.getEnv())
+
+			execFileName := action.Runs.Main + ".out"
+			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Main}
+			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
+
+			return common.NewPipelineExecutor(
+				rc.execJobContainer(buildArgs, *step.getEnv(), "", containerActionDir),
+				rc.execJobContainer(execArgs, *step.getEnv(), "", ""),
+			)(ctx)
+		default:
+			return fmt.Errorf("The runs.using key must be one of: %v, got %s", []string{
+				model.ActionRunsUsingDocker,
+				model.ActionRunsUsingNode12,
+				model.ActionRunsUsingNode16,
+				model.ActionRunsUsingNode20,
+				model.ActionRunsUsingNode24,
+				model.ActionRunsUsingComposite,
+				model.ActionRunsUsingGo,
+			}, action.Runs.Using)
+		}
+	}
+}
+
+func setupActionEnv(ctx context.Context, step actionStep, _ *remoteAction) error {
+	rc := step.getRunContext()
+
+	// A few fields in the environment (e.g. GITHUB_ACTION_REPOSITORY)
+	// are dependent on the action. That means we can complete the
+	// setup only after resolving the whole action model and cloning
+	// the action
+	rc.withGithubEnv(ctx, step.getGithubContext(ctx), *step.getEnv())
+	populateEnvsFromSavedState(step.getEnv(), step, rc)
+	populateEnvsFromInput(ctx, step.getEnv(), step.getActionModel(), rc)
+
+	return nil
+}
+
+// https://github.com/nektos/act/issues/228#issuecomment-629709055
+// files in .gitignore are not copied in a Docker container
+// this causes issues with actions that ignore other important resources
+// such as `node_modules` for example
+func removeGitIgnore(ctx context.Context, directory string) error {
+	gitIgnorePath := path.Join(directory, ".gitignore")
+	if _, err := os.Stat(gitIgnorePath); err == nil {
+		// .gitignore exists
+		common.Logger(ctx).Debugf("Removing %s before docker cp", gitIgnorePath)
+		err := os.Remove(gitIgnorePath)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// TODO: break out parts of function to reduce complexicity
+//
+//nolint:gocyclo // function handles many cases
+func execAsDocker(ctx context.Context, step actionStep, actionName, basedir string, localAction bool) error {
+	logger := common.Logger(ctx)
+	rc := step.getRunContext()
+	action := step.getActionModel()
+
+	var prepImage common.Executor
+	var image string
+	forcePull := false
+	if after, ok := strings.CutPrefix(action.Runs.Image, "docker://"); ok {
+		image = after
+		// Apply forcePull only for prebuild docker images
+		forcePull = rc.Config.ForcePull
+	} else {
+		// "-dockeraction" enshures that "./", "./test " won't get converted to "act-:latest", "act-test-:latest" which are invalid docker image names
+		image = fmt.Sprintf("%s-dockeraction:%s", regexp.MustCompile("[^a-zA-Z0-9]").ReplaceAllString(actionName, "-"), "latest")
+		image = "act-" + strings.TrimLeft(image, "-")
+		image = strings.ToLower(image)
+		contextDir, fileName := filepath.Split(filepath.Join(basedir, action.Runs.Image))
+
+		anyArchExists, err := container.ImageExistsLocally(ctx, image, "any")
+		if err != nil {
+			return err
+		}
+
+		correctArchExists, err := container.ImageExistsLocally(ctx, image, rc.Config.ContainerArchitecture)
+		if err != nil {
+			return err
+		}
+
+		if anyArchExists && !correctArchExists {
+			wasRemoved, err := container.RemoveImage(ctx, image, true, true)
+			if err != nil {
+				return err
+			}
+			if !wasRemoved {
+				return fmt.Errorf("failed to remove image '%s'", image)
+			}
+		}
+
+		if !correctArchExists || rc.Config.ForceRebuild {
+			logger.Debugf("image '%s' for architecture '%s' will be built from context '%s", image, rc.Config.ContainerArchitecture, contextDir)
+			var buildContext io.ReadCloser
+			if localAction {
+				buildContext, err = rc.JobContainer.GetContainerArchive(ctx, contextDir+"/.")
+				if err != nil {
+					return err
+				}
+				defer buildContext.Close()
+			} else if rc.Config.ActionCache != nil {
+				rstep := step.(*stepActionRemote)
+				buildContext, err = rc.Config.ActionCache.GetTarArchive(ctx, rstep.cacheDir, rstep.resolvedSha, contextDir)
+				if err != nil {
+					return err
+				}
+				defer buildContext.Close()
+			}
+			prepImage = container.NewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
+				ContextDir:   contextDir,
+				Dockerfile:   fileName,
+				ImageTag:     image,
+				BuildContext: buildContext,
+				Platform:     rc.Config.ContainerArchitecture,
+			})
+		} else {
+			logger.Debugf("image '%s' for architecture '%s' already exists", image, rc.Config.ContainerArchitecture)
+		}
+	}
+	eval := rc.NewStepExpressionEvaluator(ctx, step)
+	cmd, err := shellquote.Split(eval.Interpolate(ctx, step.getStepModel().With["args"]))
+	if err != nil {
+		return err
+	}
+	if len(cmd) == 0 {
+		cmd = action.Runs.Args
+		evalDockerArgs(ctx, step, action, &cmd)
+	}
+	entrypoint := strings.Fields(eval.Interpolate(ctx, step.getStepModel().With["entrypoint"]))
+	if len(entrypoint) == 0 {
+		if action.Runs.Entrypoint != "" {
+			entrypoint, err = shellquote.Split(action.Runs.Entrypoint)
+			if err != nil {
+				return err
+			}
+		} else {
+			entrypoint = nil
+		}
+	}
+	stepContainer := newStepContainer(ctx, step, image, cmd, entrypoint)
+	return common.NewPipelineExecutor(
+		prepImage,
+		stepContainer.Pull(forcePull),
+		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
+		stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
+		stepContainer.Start(true),
+	).Finally(
+		stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
+	).Finally(stepContainer.Close())(ctx)
+}
+
+func evalDockerArgs(ctx context.Context, step step, action *model.Action, cmd *[]string) {
+	rc := step.getRunContext()
+	stepModel := step.getStepModel()
+
+	inputs := make(map[string]string)
+	eval := rc.NewExpressionEvaluator(ctx)
+	// Set Defaults
+	for k, input := range action.Inputs {
+		inputs[k] = eval.Interpolate(ctx, input.Default)
+	}
+	if stepModel.With != nil {
+		for k, v := range stepModel.With {
+			inputs[k] = eval.Interpolate(ctx, v)
+		}
+	}
+	mergeIntoMap(step, step.getEnv(), inputs)
+
+	stepEE := rc.NewStepExpressionEvaluator(ctx, step)
+	for i, v := range *cmd {
+		(*cmd)[i] = stepEE.Interpolate(ctx, v)
+	}
+	mergeIntoMap(step, step.getEnv(), action.Runs.Env)
+
+	ee := rc.NewStepExpressionEvaluator(ctx, step)
+	for k, v := range *step.getEnv() {
+		(*step.getEnv())[k] = ee.Interpolate(ctx, v)
+	}
+}
+
+func newStepContainer(ctx context.Context, step step, image string, cmd, entrypoint []string) container.Container {
+	rc := step.getRunContext()
+	stepModel := step.getStepModel()
+	rawLogger := common.Logger(ctx).WithField("raw_output", true)
+	logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
+		if rc.Config.LogOutput {
+			rawLogger.Infof("%s", s)
+		} else {
+			rawLogger.Debugf("%s", s)
+		}
+		return true
+	})
+	envList := make([]string, 0)
+	for k, v := range *step.getEnv() {
+		envList = append(envList, fmt.Sprintf("%s=%s", k, v))
+	}
+
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TOOL_CACHE", "/opt/hostedtoolcache"))
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_OS", "Linux"))
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_ARCH", container.RunnerArch(ctx)))
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TEMP", "/tmp"))
+
+	binds, mounts := rc.GetBindsAndMounts()
+	networkMode := "container:" + rc.jobContainerName()
+	if rc.IsHostEnv(ctx) {
+		networkMode = "default"
+	}
+	stepContainer := container.NewContainer(&container.NewContainerInput{
+		Cmd:          cmd,
+		Entrypoint:   entrypoint,
+		WorkingDir:   rc.JobContainer.ToContainerPath(rc.Config.Workdir),
+		Image:        image,
+		Username:     rc.Config.Secrets["DOCKER_USERNAME"],
+		Password:     rc.Config.Secrets["DOCKER_PASSWORD"],
+		Name:         createSimpleContainerName(rc.jobContainerName(), "STEP-"+stepModel.ID),
+		Env:          envList,
+		Mounts:       mounts,
+		NetworkMode:  networkMode,
+		Binds:        binds,
+		Stdout:       logWriter,
+		Stderr:       logWriter,
+		Privileged:   rc.Config.Privileged,
+		UsernsMode:   rc.Config.UsernsMode,
+		Platform:     rc.Config.ContainerArchitecture,
+		Options:      rc.Config.ContainerOptions,
+		AutoRemove:   rc.Config.AutoRemove,
+		ValidVolumes: rc.Config.ValidVolumes,
+	})
+	return stepContainer
+}
+
+func populateEnvsFromSavedState(env *map[string]string, step actionStep, rc *RunContext) {
+	state, ok := rc.IntraActionState[step.getStepModel().ID]
+	if ok {
+		for name, value := range state {
+			envName := "STATE_" + name
+			(*env)[envName] = value
+		}
+	}
+}
+
+func populateEnvsFromInput(ctx context.Context, env *map[string]string, action *model.Action, rc *RunContext) {
+	eval := rc.NewExpressionEvaluator(ctx)
+	for inputID, input := range action.Inputs {
+		envKey := regexp.MustCompile("[^A-Z0-9-]").ReplaceAllString(strings.ToUpper(inputID), "_")
+		envKey = "INPUT_" + envKey
+		if _, ok := (*env)[envKey]; !ok {
+			(*env)[envKey] = eval.Interpolate(ctx, input.Default)
+		}
+	}
+}
+
+func getContainerActionPaths(step *model.Step, actionDir string, rc *RunContext) (string, string) {
+	actionName := ""
+	containerActionDir := "."
+	if step.Type() != model.StepTypeUsesActionRemote {
+		actionName = getOsSafeRelativePath(actionDir, rc.Config.Workdir)
+		containerActionDir = rc.JobContainer.ToContainerPath(rc.Config.Workdir) + "/" + actionName
+		actionName = "./" + actionName
+	} else if step.Type() == model.StepTypeUsesActionRemote {
+		actionName = getOsSafeRelativePath(actionDir, rc.ActionCacheDir())
+		containerActionDir = rc.JobContainer.GetActPath() + "/actions/" + actionName
+	}
+
+	if actionName == "" {
+		actionName = filepath.Base(actionDir)
+		if runtime.GOOS == "windows" {
+			actionName = strings.ReplaceAll(actionName, "\\", "/")
+		}
+	}
+	return actionName, containerActionDir
+}
+
+func getOsSafeRelativePath(s, prefix string) string {
+	actionName := strings.TrimPrefix(s, prefix)
+	if runtime.GOOS == "windows" {
+		actionName = strings.ReplaceAll(actionName, "\\", "/")
+	}
+	actionName = strings.TrimPrefix(actionName, "/")
+
+	return actionName
+}
+
+func shouldRunPreStep(step actionStep) common.Conditional {
+	return func(ctx context.Context) bool {
+		log := common.Logger(ctx)
+
+		if step.getActionModel() == nil {
+			log.Debugf("skip pre step for '%s': no action model available", step.getStepModel())
+			return false
+		}
+
+		return true
+	}
+}
+
+func hasPreStep(step actionStep) common.Conditional {
+	return func(ctx context.Context) bool {
+		action := step.getActionModel()
+		return action.Runs.Using.IsComposite() ||
+			(action.Runs.Using.IsNode() &&
+				action.Runs.Pre != "") ||
+			(action.Runs.Using == model.ActionRunsUsingGo &&
+				action.Runs.Pre != "")
+	}
+}
+
+func runPreStep(step actionStep) common.Executor {
+	return func(ctx context.Context) error {
+		logger := common.Logger(ctx)
+		logger.Debugf("run pre step for '%s'", step.getStepModel())
+
+		rc := step.getRunContext()
+		stepModel := step.getStepModel()
+		action := step.getActionModel()
+
+		x := action.Runs.Using
+		switch {
+		case x.IsNode():
+			// defaults in pre steps were missing, however provided inputs are available
+			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
+			// todo: refactor into step
+			var actionDir string
+			var actionPath string
+			if _, ok := step.(*stepActionRemote); ok {
+				actionPath = newRemoteAction(stepModel.Uses).Path
+				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+			} else {
+				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+				actionPath = ""
+			}
+
+			var actionLocation string
+			if actionPath != "" {
+				actionLocation = path.Join(actionDir, actionPath)
+			} else {
+				actionLocation = actionDir
+			}
+
+			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
+
+			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
+				return err
+			}
+
+			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Pre)}
+			logger.Debugf("executing remote job container: %s", containerArgs)
+
+			rc.ApplyExtraPath(ctx, step.getEnv())
+
+			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
+
+		case x.IsComposite():
+			if step.getCompositeSteps() == nil {
+				step.getCompositeRunContext(ctx)
+			}
+
+			if steps := step.getCompositeSteps(); steps != nil && steps.pre != nil {
+				return steps.pre(ctx)
+			}
+			return errors.New("missing steps in composite action")
+
+		case x == model.ActionRunsUsingGo:
+			// defaults in pre steps were missing, however provided inputs are available
+			populateEnvsFromInput(ctx, step.getEnv(), action, rc)
+			// todo: refactor into step
+			var actionDir string
+			var actionPath string
+			if _, ok := step.(*stepActionRemote); ok {
+				actionPath = newRemoteAction(stepModel.Uses).Path
+				actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+			} else {
+				actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+				actionPath = ""
+			}
+
+			var actionLocation string
+			if actionPath != "" {
+				actionLocation = path.Join(actionDir, actionPath)
+			} else {
+				actionLocation = actionDir
+			}
+
+			_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
+
+			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
+				return err
+			}
+
+			rc.ApplyExtraPath(ctx, step.getEnv())
+
+			execFileName := action.Runs.Pre + ".out"
+			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Pre}
+			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
+
+			return common.NewPipelineExecutor(
+				rc.execJobContainer(buildArgs, *step.getEnv(), "", containerActionDir),
+				rc.execJobContainer(execArgs, *step.getEnv(), "", ""),
+			)(ctx)
+		default:
+			return nil
+		}
+	}
+}
+
+func shouldRunPostStep(step actionStep) common.Conditional {
+	return func(ctx context.Context) bool {
+		log := common.Logger(ctx)
+		stepResults := step.getRunContext().getStepsContext()
+		stepResult := stepResults[step.getStepModel().ID]
+
+		if stepResult == nil {
+			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s'; step was not executed", step.getStepModel())
+			return false
+		}
+
+		if stepResult.Conclusion == model.StepStatusSkipped {
+			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s'; main step was skipped", step.getStepModel())
+			return false
+		}
+
+		if step.getActionModel() == nil {
+			log.WithField("stepResult", model.StepStatusSkipped).Debugf("skipping post step for '%s': no action model available", step.getStepModel())
+			return false
+		}
+
+		return true
+	}
+}
+
+func hasPostStep(step actionStep) common.Conditional {
+	return func(ctx context.Context) bool {
+		action := step.getActionModel()
+		return action.Runs.Using.IsComposite() ||
+			(action.Runs.Using.IsNode() &&
+				action.Runs.Post != "") ||
+			(action.Runs.Using == model.ActionRunsUsingGo &&
+				action.Runs.Post != "")
+	}
+}
+
+func runPostStep(step actionStep) common.Executor {
+	return func(ctx context.Context) error {
+		logger := common.Logger(ctx)
+		logger.Debugf("run post step for '%s'", step.getStepModel())
+
+		rc := step.getRunContext()
+		stepModel := step.getStepModel()
+		action := step.getActionModel()
+
+		// todo: refactor into step
+		var actionDir string
+		var actionPath string
+		if _, ok := step.(*stepActionRemote); ok {
+			actionPath = newRemoteAction(stepModel.Uses).Path
+			actionDir = fmt.Sprintf("%s/%s", rc.ActionCacheDir(), stepModel.UsesHash())
+		} else {
+			actionDir = filepath.Join(rc.Config.Workdir, stepModel.Uses)
+			actionPath = ""
+		}
+
+		var actionLocation string
+		if actionPath != "" {
+			actionLocation = path.Join(actionDir, actionPath)
+		} else {
+			actionLocation = actionDir
+		}
+
+		_, containerActionDir := getContainerActionPaths(stepModel, actionLocation, rc)
+
+		x := action.Runs.Using
+		switch {
+		case x.IsNode():
+
+			populateEnvsFromSavedState(step.getEnv(), step, rc)
+
+			containerArgs := []string{"node", path.Join(containerActionDir, action.Runs.Post)}
+			logger.Debugf("executing remote job container: %s", containerArgs)
+
+			rc.ApplyExtraPath(ctx, step.getEnv())
+
+			return rc.execJobContainer(containerArgs, *step.getEnv(), "", "")(ctx)
+
+		case x.IsComposite():
+			if err := maybeCopyToActionDir(ctx, step, actionDir, actionPath, containerActionDir); err != nil {
+				return err
+			}
+
+			if steps := step.getCompositeSteps(); steps != nil && steps.post != nil {
+				return steps.post(ctx)
+			}
+			return errors.New("missing steps in composite action")
+
+		case x == model.ActionRunsUsingGo:
+			populateEnvsFromSavedState(step.getEnv(), step, rc)
+			rc.ApplyExtraPath(ctx, step.getEnv())
+
+			execFileName := action.Runs.Post + ".out"
+			buildArgs := []string{"go", "build", "-o", execFileName, action.Runs.Post}
+			execArgs := []string{filepath.Join(containerActionDir, execFileName)}
+
+			return common.NewPipelineExecutor(
+				rc.execJobContainer(buildArgs, *step.getEnv(), "", containerActionDir),
+				rc.execJobContainer(execArgs, *step.getEnv(), "", ""),
+			)(ctx)
+
+		default:
+			return nil
+		}
+	}
+}

act/runner/action_cache.go

@@ -0,0 +1,156 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// Copyright 2023 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"archive/tar"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"io"
+	"io/fs"
+	"path"
+	"strings"
+
+	git "github.com/go-git/go-git/v5"
+	config "github.com/go-git/go-git/v5/config"
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/object"
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	"github.com/go-git/go-git/v5/plumbing/transport/http"
+)
+
+type ActionCache interface {
+	Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error)
+	GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error)
+}
+
+type GoGitActionCache struct {
+	Path string
+}
+
+func (c GoGitActionCache) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {
+	gitPath := path.Join(c.Path, safeFilename(cacheDir)+".git")
+	gogitrepo, err := git.PlainInit(gitPath, true)
+	if errors.Is(err, git.ErrRepositoryAlreadyExists) {
+		gogitrepo, err = git.PlainOpen(gitPath)
+	}
+	if err != nil {
+		return "", err
+	}
+	tmpBranch := make([]byte, 12)
+	if _, err := rand.Read(tmpBranch); err != nil {
+		return "", err
+	}
+	branchName := hex.EncodeToString(tmpBranch)
+
+	var auth transport.AuthMethod
+	if token != "" {
+		auth = &http.BasicAuth{
+			Username: "token",
+			Password: token,
+		}
+	}
+	remote, err := gogitrepo.CreateRemoteAnonymous(&config.RemoteConfig{
+		Name: "anonymous",
+		URLs: []string{
+			url,
+		},
+	})
+	if err != nil {
+		return "", err
+	}
+	defer func() {
+		_ = gogitrepo.DeleteBranch(branchName)
+	}()
+	if err := remote.FetchContext(ctx, &git.FetchOptions{
+		RefSpecs: []config.RefSpec{
+			config.RefSpec(ref + ":" + branchName),
+		},
+		Auth:  auth,
+		Force: true,
+	}); err != nil {
+		return "", err
+	}
+	hash, err := gogitrepo.ResolveRevision(plumbing.Revision(branchName))
+	if err != nil {
+		return "", err
+	}
+	return hash.String(), nil
+}
+
+func (c GoGitActionCache) GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error) {
+	gitPath := path.Join(c.Path, safeFilename(cacheDir)+".git")
+	gogitrepo, err := git.PlainOpen(gitPath)
+	if err != nil {
+		return nil, err
+	}
+	commit, err := gogitrepo.CommitObject(plumbing.NewHash(sha))
+	if err != nil {
+		return nil, err
+	}
+	files, err := commit.Files()
+	if err != nil {
+		return nil, err
+	}
+	rpipe, wpipe := io.Pipe()
+	// Interrupt io.Copy using ctx
+	ch := make(chan int, 1)
+	go func() {
+		select {
+		case <-ctx.Done():
+			wpipe.CloseWithError(ctx.Err())
+		case <-ch:
+		}
+	}()
+	go func() {
+		defer wpipe.Close()
+		defer close(ch)
+		tw := tar.NewWriter(wpipe)
+		cleanIncludePrefix := path.Clean(includePrefix)
+		wpipe.CloseWithError(files.ForEach(func(f *object.File) error {
+			if err := ctx.Err(); err != nil {
+				return err
+			}
+			name := f.Name
+			if strings.HasPrefix(name, cleanIncludePrefix+"/") {
+				name = name[len(cleanIncludePrefix)+1:]
+			} else if cleanIncludePrefix != "." && name != cleanIncludePrefix {
+				return nil
+			}
+			fmode, err := f.Mode.ToOSFileMode()
+			if err != nil {
+				return err
+			}
+			if fmode&fs.ModeSymlink == fs.ModeSymlink {
+				content, err := f.Contents()
+				if err != nil {
+					return err
+				}
+				return tw.WriteHeader(&tar.Header{
+					Name:     name,
+					Mode:     int64(fmode),
+					Linkname: content,
+				})
+			}
+			err = tw.WriteHeader(&tar.Header{
+				Name: name,
+				Mode: int64(fmode),
+				Size: f.Size,
+			})
+			if err != nil {
+				return err
+			}
+			reader, err := f.Reader()
+			if err != nil {
+				return err
+			}
+			_, err = io.Copy(tw, reader)
+			return err
+		}))
+	}()
+	return rpipe, err
+}

act/runner/action_cache_offline_mode.go

@@ -0,0 +1,45 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// Copyright 2024 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"io"
+	"path"
+
+	git "github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+type GoGitActionCacheOfflineMode struct {
+	Parent GoGitActionCache
+}
+
+func (c GoGitActionCacheOfflineMode) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {
+	sha, fetchErr := c.Parent.Fetch(ctx, cacheDir, url, ref, token)
+	gitPath := path.Join(c.Parent.Path, safeFilename(cacheDir)+".git")
+	gogitrepo, err := git.PlainOpen(gitPath)
+	if err != nil {
+		return "", fetchErr
+	}
+	refName := plumbing.ReferenceName("refs/action-cache-offline/" + ref)
+	r, err := gogitrepo.Reference(refName, true)
+	if fetchErr == nil {
+		if err != nil || sha != r.Hash().String() {
+			if err == nil {
+				refName = r.Name()
+			}
+			ref := plumbing.NewHashReference(refName, plumbing.NewHash(sha))
+			_ = gogitrepo.Storer.SetReference(ref)
+		}
+	} else if err == nil {
+		return r.Hash().String(), nil
+	}
+	return sha, fetchErr
+}
+
+func (c GoGitActionCacheOfflineMode) GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error) {
+	return c.Parent.GetTarArchive(ctx, cacheDir, sha, includePrefix)
+}

act/runner/action_cache_test.go

@@ -0,0 +1,82 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// Copyright 2023 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestActionCache(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	a := assert.New(t)
+	cache := &GoGitActionCache{
+		Path: t.TempDir(),
+	}
+	ctx := context.Background()
+	cacheDir := "nektos/act-test-actions"
+	repo := "https://github.com/nektos/act-test-actions"
+	refs := []struct {
+		Name     string
+		CacheDir string
+		Repo     string
+		Ref      string
+	}{
+		{
+			Name:     "Fetch Branch Name",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "main",
+		},
+		{
+			Name:     "Fetch Branch Name Absolutely",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "refs/heads/main",
+		},
+		{
+			Name:     "Fetch HEAD",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "HEAD",
+		},
+		{
+			Name:     "Fetch Sha",
+			CacheDir: cacheDir,
+			Repo:     repo,
+			Ref:      "de984ca37e4df4cb9fd9256435a3b82c4a2662b1",
+		},
+	}
+	for _, c := range refs {
+		t.Run(c.Name, func(t *testing.T) {
+			sha, err := cache.Fetch(ctx, c.CacheDir, c.Repo, c.Ref, "")
+			if !a.NoError(err) || !a.NotEmpty(sha) { //nolint:testifylint // pre-existing issue from nektos/act
+				return
+			}
+			atar, err := cache.GetTarArchive(ctx, c.CacheDir, sha, "js")
+			if !a.NoError(err) || !a.NotEmpty(atar) { //nolint:testifylint // pre-existing issue from nektos/act
+				return
+			}
+			mytar := tar.NewReader(atar)
+			th, err := mytar.Next()
+			if !a.NoError(err) || !a.NotEqual(0, th.Size) { //nolint:testifylint // pre-existing issue from nektos/act
+				return
+			}
+			buf := &bytes.Buffer{}
+			// G110: Potential DoS vulnerability via decompression bomb (gosec)
+			_, err = io.Copy(buf, mytar)
+			a.NoError(err) //nolint:testifylint // pre-existing issue from nektos/act
+			str := buf.String()
+			a.NotEmpty(str)
+		})
+	}
+}

act/runner/action_composite.go

@@ -0,0 +1,241 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"errors"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+)
+
+func evaluateCompositeInputAndEnv(ctx context.Context, parent *RunContext, step actionStep) map[string]string {
+	env := make(map[string]string)
+	stepEnv := *step.getEnv()
+	for k, v := range stepEnv {
+		// do not set current inputs into composite action
+		// the required inputs are added in the second loop
+		if !strings.HasPrefix(k, "INPUT_") {
+			env[k] = v
+		}
+	}
+
+	ee := parent.NewStepExpressionEvaluator(ctx, step)
+
+	for inputID, input := range step.getActionModel().Inputs {
+		envKey := regexp.MustCompile("[^A-Z0-9-]").ReplaceAllString(strings.ToUpper(inputID), "_")
+		envKey = "INPUT_" + strings.ToUpper(envKey)
+
+		// lookup if key is defined in the step but the already
+		// evaluated value from the environment
+		_, defined := step.getStepModel().With[inputID]
+		if value, ok := stepEnv[envKey]; defined && ok {
+			env[envKey] = value
+		} else {
+			// defaults could contain expressions
+			env[envKey] = ee.Interpolate(ctx, input.Default)
+		}
+	}
+	gh := step.getGithubContext(ctx)
+	env["GITHUB_ACTION_REPOSITORY"] = gh.ActionRepository
+	env["GITHUB_ACTION_REF"] = gh.ActionRef
+
+	return env
+}
+
+func newCompositeRunContext(ctx context.Context, parent *RunContext, step actionStep, actionPath string) *RunContext {
+	env := evaluateCompositeInputAndEnv(ctx, parent, step)
+
+	// run with the global config but without secrets
+	configCopy := *(parent.Config)
+	configCopy.Secrets = nil
+
+	// create a run context for the composite action to run in
+	compositerc := &RunContext{
+		Name:    parent.Name,
+		JobName: parent.JobName,
+		Run: &model.Run{
+			JobID: parent.Run.JobID,
+			Workflow: &model.Workflow{
+				Name: parent.Run.Workflow.Name,
+				Jobs: map[string]*model.Job{
+					parent.Run.JobID: {},
+				},
+			},
+		},
+		Config:       &configCopy,
+		StepResults:  map[string]*model.StepResult{},
+		JobContainer: parent.JobContainer,
+		ActionPath:   actionPath,
+		Env:          env,
+		GlobalEnv:    parent.GlobalEnv,
+		Masks:        parent.Masks,
+		ExtraPath:    parent.ExtraPath,
+		Parent:       parent,
+		EventJSON:    parent.EventJSON,
+	}
+	compositerc.ExprEval = compositerc.NewExpressionEvaluator(ctx)
+
+	return compositerc
+}
+
+func execAsComposite(step actionStep) common.Executor {
+	rc := step.getRunContext()
+	action := step.getActionModel()
+
+	return func(ctx context.Context) error {
+		compositeRC := step.getCompositeRunContext(ctx)
+
+		steps := step.getCompositeSteps()
+
+		if steps == nil || steps.main == nil {
+			return errors.New("missing steps in composite action")
+		}
+
+		ctx = WithCompositeLogger(ctx, &compositeRC.Masks)
+
+		err := steps.main(ctx)
+
+		// Map outputs from composite RunContext to job RunContext
+		eval := compositeRC.NewExpressionEvaluator(ctx)
+		for outputName, output := range action.Outputs {
+			rc.setOutput(ctx, map[string]string{
+				"name": outputName,
+			}, eval.Interpolate(ctx, output.Value))
+		}
+
+		rc.Masks = append(rc.Masks, compositeRC.Masks...)
+		rc.ExtraPath = compositeRC.ExtraPath
+		// compositeRC.Env is dirty, contains INPUT_ and merged step env, only rely on compositeRC.GlobalEnv
+		mergeIntoMap := mergeIntoMapCaseSensitive
+		if rc.JobContainer.IsEnvironmentCaseInsensitive() {
+			mergeIntoMap = mergeIntoMapCaseInsensitive
+		}
+		if rc.GlobalEnv == nil {
+			rc.GlobalEnv = map[string]string{}
+		}
+		mergeIntoMap(rc.GlobalEnv, compositeRC.GlobalEnv)
+		mergeIntoMap(rc.Env, compositeRC.GlobalEnv)
+
+		return err
+	}
+}
+
+type compositeSteps struct {
+	pre  common.Executor
+	main common.Executor
+	post common.Executor
+}
+
+// Executor returns a pipeline executor for all the steps in the job
+func (rc *RunContext) compositeExecutor(action *model.Action) *compositeSteps {
+	steps := make([]common.Executor, 0)
+	preSteps := make([]common.Executor, 0)
+	var postExecutor common.Executor
+
+	sf := &stepFactoryImpl{}
+
+	for i, step := range action.Runs.Steps {
+		if step.ID == "" {
+			step.ID = strconv.Itoa(i)
+		}
+		step.Number = i
+
+		// create a copy of the step, since this composite action could
+		// run multiple times and we might modify the instance
+		stepcopy := step
+
+		step, err := sf.newStep(&stepcopy, rc)
+		if err != nil {
+			return &compositeSteps{
+				main: common.NewErrorExecutor(err),
+			}
+		}
+
+		stepID := step.getStepModel().ID
+		stepPre := rc.newCompositeCommandExecutor(step.pre())
+		preSteps = append(preSteps, newCompositeStepLogExecutor(stepPre, stepID))
+
+		steps = append(steps, func(ctx context.Context) error {
+			ctx = WithCompositeStepLogger(ctx, stepID)
+			logger := common.Logger(ctx)
+			err := rc.newCompositeCommandExecutor(step.main())(ctx)
+
+			if err != nil {
+				logger.Errorf("%v", err)
+				common.SetJobError(ctx, err)
+			} else if ctx.Err() != nil {
+				logger.Errorf("%v", ctx.Err())
+				common.SetJobError(ctx, ctx.Err())
+			}
+			return nil
+		})
+
+		// run the post executor in reverse order
+		if postExecutor != nil {
+			stepPost := rc.newCompositeCommandExecutor(step.post())
+			postExecutor = newCompositeStepLogExecutor(stepPost.Finally(postExecutor), stepID)
+		} else {
+			stepPost := rc.newCompositeCommandExecutor(step.post())
+			postExecutor = newCompositeStepLogExecutor(stepPost, stepID)
+		}
+	}
+
+	steps = append(steps, common.JobError)
+	return &compositeSteps{
+		pre: func(ctx context.Context) error {
+			return common.NewPipelineExecutor(preSteps...)(common.WithJobErrorContainer(ctx))
+		},
+		main: func(ctx context.Context) error {
+			return common.NewPipelineExecutor(steps...)(common.WithJobErrorContainer(ctx))
+		},
+		post: postExecutor,
+	}
+}
+
+func (rc *RunContext) newCompositeCommandExecutor(executor common.Executor) common.Executor {
+	return func(ctx context.Context) error {
+		ctx = WithCompositeLogger(ctx, &rc.Masks)
+
+		// We need to inject a composite RunContext related command
+		// handler into the current running job container
+		// We need this, to support scoping commands to the composite action
+		// executing.
+		rawLogger := common.Logger(ctx).WithField("raw_output", true)
+		logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
+			if rc.Config.LogOutput {
+				rawLogger.Infof("%s", s)
+			} else {
+				rawLogger.Debugf("%s", s)
+			}
+			return true
+		})
+
+		oldout, olderr := rc.JobContainer.ReplaceLogWriter(logWriter, logWriter)
+		defer rc.JobContainer.ReplaceLogWriter(oldout, olderr)
+
+		return executor(ctx)
+	}
+}
+
+func newCompositeStepLogExecutor(runStep common.Executor, stepID string) common.Executor {
+	return func(ctx context.Context) error {
+		ctx = WithCompositeStepLogger(ctx, stepID)
+		logger := common.Logger(ctx)
+		err := runStep(ctx)
+		if err != nil {
+			logger.Errorf("%v", err)
+			common.SetJobError(ctx, err)
+		} else if ctx.Err() != nil {
+			logger.Errorf("%v", ctx.Err())
+			common.SetJobError(ctx, ctx.Err())
+		}
+		return nil
+	}
+}

act/runner/action_test.go

@@ -0,0 +1,254 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"io"
+	"io/fs"
+	"strings"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+type closerMock struct {
+	mock.Mock
+}
+
+func (m *closerMock) Close() error {
+	m.Called()
+	return nil
+}
+
+func TestActionReader(t *testing.T) {
+	yaml := strings.ReplaceAll(`
+name: 'name'
+runs:
+	using: 'node16'
+	main: 'main.js'
+`, "\t", "  ")
+
+	table := []struct {
+		name        string
+		step        *model.Step
+		filename    string
+		fileContent string
+		expected    *model.Action
+	}{
+		{
+			name:        "readActionYml",
+			step:        &model.Step{},
+			filename:    "action.yml",
+			fileContent: yaml,
+			expected: &model.Action{
+				Name: "name",
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Main:   "main.js",
+					PreIf:  "always()",
+					PostIf: "always()",
+				},
+			},
+		},
+		{
+			name:        "readActionYaml",
+			step:        &model.Step{},
+			filename:    "action.yaml",
+			fileContent: yaml,
+			expected: &model.Action{
+				Name: "name",
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Main:   "main.js",
+					PreIf:  "always()",
+					PostIf: "always()",
+				},
+			},
+		},
+		{
+			name:        "readDockerfile",
+			step:        &model.Step{},
+			filename:    "Dockerfile",
+			fileContent: "FROM ubuntu:20.04",
+			expected: &model.Action{
+				Name: "(Synthetic)",
+				Runs: model.ActionRuns{
+					Using: "docker",
+					Image: "Dockerfile",
+				},
+			},
+		},
+		{
+			name: "readWithArgs",
+			step: &model.Step{
+				With: map[string]string{
+					"args": "cmd",
+				},
+			},
+			expected: &model.Action{
+				Name: "(Synthetic)",
+				Inputs: map[string]model.Input{
+					"cwd": {
+						Description: "(Actual working directory)",
+						Required:    false,
+						Default:     "actionDir/actionPath",
+					},
+					"command": {
+						Description: "(Actual program)",
+						Required:    false,
+						Default:     "cmd",
+					},
+				},
+				Runs: model.ActionRuns{
+					Using: "node12",
+					Main:  "trampoline.js",
+				},
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			closerMock := &closerMock{}
+
+			readFile := func(filename string) (io.Reader, io.Closer, error) {
+				if tt.filename != filename {
+					return nil, nil, fs.ErrNotExist
+				}
+
+				return strings.NewReader(tt.fileContent), closerMock, nil
+			}
+
+			writeFile := func(filename string, data []byte, perm fs.FileMode) error {
+				assert.Equal(t, "actionDir/actionPath/trampoline.js", filename)
+				assert.Equal(t, fs.FileMode(0o400), perm)
+				return nil
+			}
+
+			if tt.filename != "" {
+				closerMock.On("Close")
+			}
+
+			action, err := readActionImpl(context.Background(), tt.step, "actionDir", "actionPath", readFile, writeFile)
+
+			assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+			assert.Equal(t, tt.expected, action)
+
+			closerMock.AssertExpectations(t)
+		})
+	}
+}
+
+func TestActionRunner(t *testing.T) {
+	table := []struct {
+		name        string
+		step        actionStep
+		expectedEnv map[string]string
+	}{
+		{
+			name: "with-input",
+			step: &stepActionRemote{
+				Step: &model.Step{
+					Uses: "org/repo/path@ref",
+				},
+				RunContext: &RunContext{
+					Config: &Config{},
+					Run: &model.Run{
+						JobID: "job",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"job": {
+									Name: "job",
+								},
+							},
+						},
+					},
+				},
+				action: &model.Action{
+					Inputs: map[string]model.Input{
+						"key": {
+							Default: "default value",
+						},
+					},
+					Runs: model.ActionRuns{
+						Using: "node16",
+					},
+				},
+				env: map[string]string{},
+			},
+			expectedEnv: map[string]string{"INPUT_KEY": "default value"},
+		},
+		{
+			name: "restore-saved-state",
+			step: &stepActionRemote{
+				Step: &model.Step{
+					ID:   "step",
+					Uses: "org/repo/path@ref",
+				},
+				RunContext: &RunContext{
+					ActionPath: "path",
+					Config:     &Config{},
+					Run: &model.Run{
+						JobID: "job",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"job": {
+									Name: "job",
+								},
+							},
+						},
+					},
+					CurrentStep: "post-step",
+					StepResults: map[string]*model.StepResult{
+						"step": {},
+					},
+					IntraActionState: map[string]map[string]string{
+						"step": {
+							"name": "state value",
+						},
+					},
+				},
+				action: &model.Action{
+					Runs: model.ActionRuns{
+						Using: "node16",
+					},
+				},
+				env: map[string]string{},
+			},
+			expectedEnv: map[string]string{"STATE_name": "state value"},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			cm := &containerMock{}
+			cm.On("CopyDir", "/var/run/act/actions/dir/", "dir/", false).Return(func(ctx context.Context) error { return nil })
+
+			envMatcher := mock.MatchedBy(func(env map[string]string) bool {
+				for k, v := range tt.expectedEnv {
+					if env[k] != v {
+						return false
+					}
+				}
+				return true
+			})
+
+			cm.On("Exec", []string{"node", "/var/run/act/actions/dir/path"}, envMatcher, "", "").Return(func(ctx context.Context) error { return nil })
+
+			tt.step.getRunContext().JobContainer = cm
+
+			err := runActionImpl(tt.step, "dir", newRemoteAction("org/repo/path@ref"))(ctx)
+
+			assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+			cm.AssertExpectations(t)
+		})
+	}
+}

act/runner/command.go

@@ -0,0 +1,200 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"regexp"
+	"strings"
+
+	"gitea.com/gitea/act_runner/act/common"
+)
+
+var commandPatternGA *regexp.Regexp
+
+var commandPatternADO *regexp.Regexp
+
+func init() {
+	commandPatternGA = regexp.MustCompile("^::([^ ]+)( (.+))?::([^\r\n]*)[\r\n]+$")
+	commandPatternADO = regexp.MustCompile("^##\\[([^ ]+)( (.+))?]([^\r\n]*)[\r\n]+$")
+}
+
+func tryParseRawActionCommand(line string) (command string, kvPairs map[string]string, arg string, ok bool) {
+	if m := commandPatternGA.FindStringSubmatch(line); m != nil {
+		command = m[1]
+		kvPairs = parseKeyValuePairs(m[3], ",")
+		arg = m[4]
+		ok = true
+	} else if m := commandPatternADO.FindStringSubmatch(line); m != nil {
+		command = m[1]
+		kvPairs = parseKeyValuePairs(m[3], ";")
+		arg = m[4]
+		ok = true
+	}
+	return command, kvPairs, arg, ok
+}
+
+func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler {
+	logger := common.Logger(ctx)
+	resumeCommand := ""
+	return func(line string) bool {
+		command, kvPairs, arg, ok := tryParseRawActionCommand(line)
+		if !ok {
+			return true
+		}
+
+		if resumeCommand != "" && command != resumeCommand {
+			// There should not be any emojis in the log output for Gitea.
+			// The code in the switch statement is the same.
+			logger.Infof("%s", line)
+			return false
+		}
+		arg = unescapeCommandData(arg)
+		kvPairs = unescapeKvPairs(kvPairs)
+		switch command {
+		case "set-env":
+			rc.setEnv(ctx, kvPairs, arg)
+		case "set-output":
+			rc.setOutput(ctx, kvPairs, arg)
+		case "add-path":
+			rc.addPath(ctx, arg)
+		case "debug":
+			logger.Infof("%s", line)
+		case "warning":
+			logger.Infof("%s", line)
+		case "error":
+			logger.Infof("%s", line)
+		case "add-mask":
+			rc.AddMask(arg)
+			logger.Infof("%s", "***")
+		case "stop-commands":
+			resumeCommand = arg
+			logger.Infof("%s", line)
+		case resumeCommand:
+			resumeCommand = ""
+			logger.Infof("%s", line)
+		case "save-state":
+			logger.Infof("%s", line)
+			rc.saveState(ctx, kvPairs, arg)
+		case "add-matcher":
+			logger.Infof("%s", line)
+		default:
+			logger.Infof("%s", line)
+		}
+
+		// return true to let gitea's logger handle these special outputs also
+		return true
+	}
+}
+
+func (rc *RunContext) setEnv(ctx context.Context, kvPairs map[string]string, arg string) {
+	name := kvPairs["name"]
+	common.Logger(ctx).Infof("::set-env:: %s=%s", name, arg)
+	if rc.Env == nil {
+		rc.Env = make(map[string]string)
+	}
+	if rc.GlobalEnv == nil {
+		rc.GlobalEnv = map[string]string{}
+	}
+	newenv := map[string]string{
+		name: arg,
+	}
+	mergeIntoMap := mergeIntoMapCaseSensitive
+	if rc.JobContainer != nil && rc.JobContainer.IsEnvironmentCaseInsensitive() {
+		mergeIntoMap = mergeIntoMapCaseInsensitive
+	}
+	mergeIntoMap(rc.Env, newenv)
+	mergeIntoMap(rc.GlobalEnv, newenv)
+}
+
+func (rc *RunContext) setOutput(ctx context.Context, kvPairs map[string]string, arg string) {
+	logger := common.Logger(ctx)
+	stepID := rc.CurrentStep
+	outputName := kvPairs["name"]
+	if outputMapping, ok := rc.OutputMappings[MappableOutput{StepID: stepID, OutputName: outputName}]; ok {
+		stepID = outputMapping.StepID
+		outputName = outputMapping.OutputName
+	}
+
+	result, ok := rc.StepResults[stepID]
+	if !ok {
+		logger.Infof("  \U00002757  no outputs used step '%s'", stepID)
+		return
+	}
+
+	logger.Infof("::set-output:: %s=%s", outputName, arg)
+	result.Outputs[outputName] = arg
+}
+
+func (rc *RunContext) addPath(ctx context.Context, arg string) {
+	common.Logger(ctx).Infof("::add-path:: %s", arg)
+	extraPath := []string{arg}
+	for _, v := range rc.ExtraPath {
+		if v != arg {
+			extraPath = append(extraPath, v)
+		}
+	}
+	rc.ExtraPath = extraPath
+}
+
+func parseKeyValuePairs(kvPairs, separator string) map[string]string {
+	rtn := make(map[string]string)
+	kvPairList := strings.SplitSeq(kvPairs, separator)
+	for kvPair := range kvPairList {
+		kv := strings.Split(kvPair, "=")
+		if len(kv) == 2 {
+			rtn[kv[0]] = kv[1]
+		}
+	}
+	return rtn
+}
+
+func unescapeCommandData(arg string) string {
+	escapeMap := map[string]string{
+		"%25": "%",
+		"%0D": "\r",
+		"%0A": "\n",
+	}
+	for k, v := range escapeMap {
+		arg = strings.ReplaceAll(arg, k, v)
+	}
+	return arg
+}
+
+func unescapeCommandProperty(arg string) string {
+	escapeMap := map[string]string{
+		"%25": "%",
+		"%0D": "\r",
+		"%0A": "\n",
+		"%3A": ":",
+		"%2C": ",",
+	}
+	for k, v := range escapeMap {
+		arg = strings.ReplaceAll(arg, k, v)
+	}
+	return arg
+}
+
+func unescapeKvPairs(kvPairs map[string]string) map[string]string {
+	for k, v := range kvPairs {
+		kvPairs[k] = unescapeCommandProperty(v)
+	}
+	return kvPairs
+}
+
+func (rc *RunContext) saveState(_ context.Context, kvPairs map[string]string, arg string) {
+	stepID := rc.CurrentStep
+	if stepID != "" {
+		if rc.IntraActionState == nil {
+			rc.IntraActionState = map[string]map[string]string{}
+		}
+		state, ok := rc.IntraActionState[stepID]
+		if !ok {
+			state = map[string]string{}
+			rc.IntraActionState[stepID] = state
+		}
+		state[kvPairs["name"]] = arg
+	}
+}

act/runner/command_test.go

@@ -0,0 +1,193 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSetEnv(t *testing.T) {
+	a := assert.New(t)
+	ctx := context.Background()
+	rc := new(RunContext)
+	handler := rc.commandHandler(ctx)
+
+	handler("::set-env name=x::valz\n")
+	a.Equal("valz", rc.Env["x"])
+}
+
+func TestSetOutput(t *testing.T) {
+	a := assert.New(t)
+	ctx := context.Background()
+	rc := new(RunContext)
+	rc.StepResults = make(map[string]*model.StepResult)
+	handler := rc.commandHandler(ctx)
+
+	rc.CurrentStep = "my-step"
+	rc.StepResults[rc.CurrentStep] = &model.StepResult{
+		Outputs: make(map[string]string),
+	}
+	handler("::set-output name=x::valz\n")
+	a.Equal("valz", rc.StepResults["my-step"].Outputs["x"])
+
+	handler("::set-output name=x::percent2%25\n")
+	a.Equal("percent2%", rc.StepResults["my-step"].Outputs["x"])
+
+	handler("::set-output name=x::percent2%25%0Atest\n")
+	a.Equal("percent2%\ntest", rc.StepResults["my-step"].Outputs["x"])
+
+	handler("::set-output name=x::percent2%25%0Atest another3%25test\n")
+	a.Equal("percent2%\ntest another3%test", rc.StepResults["my-step"].Outputs["x"])
+
+	handler("::set-output name=x%3A::percent2%25%0Atest\n")
+	a.Equal("percent2%\ntest", rc.StepResults["my-step"].Outputs["x:"])
+
+	handler("::set-output name=x%3A%2C%0A%25%0D%3A::percent2%25%0Atest\n")
+	a.Equal("percent2%\ntest", rc.StepResults["my-step"].Outputs["x:,\n%\r:"])
+}
+
+func TestAddpath(t *testing.T) {
+	a := assert.New(t)
+	ctx := context.Background()
+	rc := new(RunContext)
+	handler := rc.commandHandler(ctx)
+
+	handler("::add-path::/zoo\n")
+	a.Equal("/zoo", rc.ExtraPath[0])
+
+	handler("::add-path::/boo\n")
+	a.Equal("/boo", rc.ExtraPath[0])
+}
+
+func TestStopCommands(t *testing.T) {
+	logger, hook := test.NewNullLogger()
+
+	a := assert.New(t)
+	ctx := common.WithLogger(context.Background(), logger)
+	rc := new(RunContext)
+	handler := rc.commandHandler(ctx)
+
+	handler("::set-env name=x::valz\n")
+	a.Equal("valz", rc.Env["x"])
+	handler("::stop-commands::my-end-token\n")
+	handler("::set-env name=x::abcd\n")
+	a.Equal("valz", rc.Env["x"])
+	handler("::my-end-token::\n")
+	handler("::set-env name=x::abcd\n")
+	a.Equal("abcd", rc.Env["x"])
+
+	messages := make([]string, 0)
+	for _, entry := range hook.AllEntries() {
+		messages = append(messages, entry.Message)
+	}
+
+	a.Contains(messages, "::set-env name=x::abcd\n")
+}
+
+func TestAddpathADO(t *testing.T) {
+	a := assert.New(t)
+	ctx := context.Background()
+	rc := new(RunContext)
+	handler := rc.commandHandler(ctx)
+
+	handler("##[add-path]/zoo\n")
+	a.Equal("/zoo", rc.ExtraPath[0])
+
+	handler("##[add-path]/boo\n")
+	a.Equal("/boo", rc.ExtraPath[0])
+}
+
+func TestAddmask(t *testing.T) {
+	logger, hook := test.NewNullLogger()
+
+	a := assert.New(t)
+	ctx := context.Background()
+	loggerCtx := common.WithLogger(ctx, logger)
+
+	rc := new(RunContext)
+	handler := rc.commandHandler(loggerCtx)
+	handler("::add-mask::my-secret-value\n")
+
+	a.Equal("***", hook.LastEntry().Message)
+	a.NotEqual("*my-secret-value", hook.LastEntry().Message)
+}
+
+// based on https://stackoverflow.com/a/10476304
+func captureOutput(t *testing.T, f func()) string {
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	f()
+
+	outC := make(chan string)
+
+	go func() {
+		var buf bytes.Buffer
+		_, err := io.Copy(&buf, r)
+		if err != nil {
+			a := assert.New(t)
+			a.Fail("io.Copy failed")
+		}
+		outC <- buf.String()
+	}()
+
+	w.Close()
+	os.Stdout = old
+	out := <-outC
+
+	return out
+}
+
+func TestAddmaskUsemask(t *testing.T) {
+	rc := new(RunContext)
+	rc.StepResults = make(map[string]*model.StepResult)
+	rc.CurrentStep = "my-step"
+	rc.StepResults[rc.CurrentStep] = &model.StepResult{
+		Outputs: make(map[string]string),
+	}
+
+	a := assert.New(t)
+
+	config := &Config{
+		Secrets:         map[string]string{},
+		InsecureSecrets: false,
+	}
+
+	re := captureOutput(t, func() {
+		ctx := context.Background()
+		ctx = WithJobLogger(ctx, "0", "testjob", config, &rc.Masks, map[string]any{})
+
+		handler := rc.commandHandler(ctx)
+		handler("::add-mask::secret\n")
+		handler("::set-output:: token=secret\n")
+	})
+
+	a.Equal("[testjob] ***\n[testjob] ::set-output:: = token=***\n", re)
+}
+
+func TestSaveState(t *testing.T) {
+	rc := &RunContext{
+		CurrentStep: "step",
+		StepResults: map[string]*model.StepResult{},
+	}
+
+	ctx := context.Background()
+
+	handler := rc.commandHandler(ctx)
+	handler("::save-state name=state-name::state-value\n")
+
+	assert.Equal(t, "state-value", rc.IntraActionState["step"]["state-name"])
+}

act/runner/container_mock_test.go

@@ -0,0 +1,80 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"io"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/container"
+
+	"github.com/stretchr/testify/mock"
+)
+
+type containerMock struct {
+	mock.Mock
+	container.Container
+	container.LinuxContainerEnvironmentExtensions
+}
+
+func (cm *containerMock) Create(capAdd, capDrop []string) common.Executor {
+	args := cm.Called(capAdd, capDrop)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) Pull(forcePull bool) common.Executor {
+	args := cm.Called(forcePull)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) Start(attach bool) common.Executor {
+	args := cm.Called(attach)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) Remove() common.Executor {
+	args := cm.Called()
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) Close() common.Executor {
+	args := cm.Called()
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) UpdateFromEnv(srcPath string, env *map[string]string) common.Executor {
+	args := cm.Called(srcPath, env)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) UpdateFromImageEnv(env *map[string]string) common.Executor {
+	args := cm.Called(env)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) Copy(destPath string, files ...*container.FileEntry) common.Executor {
+	args := cm.Called(destPath, files)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) CopyDir(destPath, srcPath string, useGitIgnore bool) common.Executor {
+	args := cm.Called(destPath, srcPath, useGitIgnore)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) Exec(command []string, env map[string]string, user, workdir string) common.Executor {
+	args := cm.Called(command, env, user, workdir)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (cm *containerMock) GetContainerArchive(ctx context.Context, srcPath string) (io.ReadCloser, error) {
+	args := cm.Called(ctx, srcPath)
+	err, hasErr := args.Get(1).(error)
+	if !hasErr {
+		err = nil
+	}
+	return args.Get(0).(io.ReadCloser), err
+}

act/runner/expression.go

@@ -0,0 +1,583 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"maps"
+	"path"
+	"reflect"
+	"regexp"
+	"strings"
+	"time"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/exprparser"
+	"gitea.com/gitea/act_runner/act/model"
+
+	_ "embed"
+
+	"go.yaml.in/yaml/v4"
+)
+
+// ExpressionEvaluator is the interface for evaluating expressions
+type ExpressionEvaluator interface {
+	evaluate(context.Context, string, exprparser.DefaultStatusCheck) (any, error)
+	EvaluateYamlNode(context.Context, *yaml.Node) error
+	Interpolate(context.Context, string) string
+}
+
+// NewExpressionEvaluator creates a new evaluator
+func (rc *RunContext) NewExpressionEvaluator(ctx context.Context) ExpressionEvaluator {
+	return rc.NewExpressionEvaluatorWithEnv(ctx, rc.GetEnv())
+}
+
+func (rc *RunContext) NewExpressionEvaluatorWithEnv(ctx context.Context, env map[string]string) ExpressionEvaluator {
+	var workflowCallResult map[string]*model.WorkflowCallResult
+
+	// todo: cleanup EvaluationEnvironment creation
+	using := make(map[string]exprparser.Needs)
+	strategy := make(map[string]any)
+	if rc.Run != nil {
+		job := rc.Run.Job()
+		if job != nil && job.Strategy != nil {
+			strategy["fail-fast"] = job.Strategy.FailFast
+			strategy["max-parallel"] = job.Strategy.MaxParallel
+		}
+
+		jobs := rc.Run.Workflow.Jobs
+		jobNeeds := rc.Run.Job().Needs()
+
+		for _, needs := range jobNeeds {
+			using[needs] = exprparser.Needs{
+				Outputs: jobs[needs].Outputs,
+				Result:  jobs[needs].Result,
+			}
+		}
+
+		// only setup jobs context in case of workflow_call
+		// and existing expression evaluator (this means, jobs are at
+		// least ready to run)
+		if rc.caller != nil && rc.ExprEval != nil {
+			workflowCallResult = map[string]*model.WorkflowCallResult{}
+
+			for jobName, job := range jobs {
+				result := model.WorkflowCallResult{
+					Outputs: map[string]string{},
+				}
+				maps.Copy(result.Outputs, job.Outputs)
+				workflowCallResult[jobName] = &result
+			}
+		}
+	}
+
+	ghc := rc.getGithubContext(ctx)
+	inputs := getEvaluatorInputs(ctx, rc, nil, ghc)
+
+	ee := &exprparser.EvaluationEnvironment{
+		Github: ghc,
+		Env:    env,
+		Job:    rc.getJobContext(),
+		Jobs:   &workflowCallResult,
+		// todo: should be unavailable
+		// but required to interpolate/evaluate the step outputs on the job
+		Steps:     rc.getStepsContext(),
+		Secrets:   getWorkflowSecrets(ctx, rc),
+		Vars:      getWorkflowVars(ctx, rc),
+		Strategy:  strategy,
+		Matrix:    rc.Matrix,
+		Needs:     using,
+		Inputs:    inputs,
+		HashFiles: getHashFilesFunction(ctx, rc),
+	}
+	if rc.JobContainer != nil {
+		ee.Runner = rc.JobContainer.GetRunnerContext(ctx)
+	}
+	return expressionEvaluator{
+		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
+			Run:        rc.Run,
+			WorkingDir: rc.Config.Workdir,
+			Context:    "job",
+		}),
+	}
+}
+
+//go:embed hashfiles/index.js
+var hashfiles string
+
+// NewStepExpressionEvaluator creates a new evaluator
+func (rc *RunContext) NewStepExpressionEvaluator(ctx context.Context, step step) ExpressionEvaluator {
+	// todo: cleanup EvaluationEnvironment creation
+	job := rc.Run.Job()
+	strategy := make(map[string]any)
+	if job.Strategy != nil {
+		strategy["fail-fast"] = job.Strategy.FailFast
+		strategy["max-parallel"] = job.Strategy.MaxParallel
+	}
+
+	jobs := rc.Run.Workflow.Jobs
+	jobNeeds := rc.Run.Job().Needs()
+
+	using := make(map[string]exprparser.Needs)
+	for _, needs := range jobNeeds {
+		using[needs] = exprparser.Needs{
+			Outputs: jobs[needs].Outputs,
+			Result:  jobs[needs].Result,
+		}
+	}
+
+	ghc := rc.getGithubContext(ctx)
+	inputs := getEvaluatorInputs(ctx, rc, step, ghc)
+
+	ee := &exprparser.EvaluationEnvironment{
+		Github:   step.getGithubContext(ctx),
+		Env:      *step.getEnv(),
+		Job:      rc.getJobContext(),
+		Steps:    rc.getStepsContext(),
+		Secrets:  getWorkflowSecrets(ctx, rc),
+		Vars:     getWorkflowVars(ctx, rc),
+		Strategy: strategy,
+		Matrix:   rc.Matrix,
+		Needs:    using,
+		// todo: should be unavailable
+		// but required to interpolate/evaluate the inputs in actions/composite
+		Inputs:    inputs,
+		HashFiles: getHashFilesFunction(ctx, rc),
+	}
+	if rc.JobContainer != nil {
+		ee.Runner = rc.JobContainer.GetRunnerContext(ctx)
+	}
+	return expressionEvaluator{
+		interpreter: exprparser.NewInterpeter(ee, exprparser.Config{
+			Run:        rc.Run,
+			WorkingDir: rc.Config.Workdir,
+			Context:    "step",
+		}),
+	}
+}
+
+func getHashFilesFunction(ctx context.Context, rc *RunContext) func(v []reflect.Value) (any, error) {
+	hashFiles := func(v []reflect.Value) (any, error) {
+		if rc.JobContainer != nil {
+			timeed, cancel := context.WithTimeout(ctx, time.Minute)
+			defer cancel()
+			name := "workflow/hashfiles/index.js"
+			hout := &bytes.Buffer{}
+			herr := &bytes.Buffer{}
+			patterns := []string{}
+			followSymlink := false
+
+			for i, p := range v {
+				s := p.String()
+				if i == 0 {
+					if strings.HasPrefix(s, "--") {
+						if strings.EqualFold(s, "--follow-symbolic-links") {
+							followSymlink = true
+							continue
+						}
+						return "", fmt.Errorf("Invalid glob option %s, available option: '--follow-symbolic-links'", s)
+					}
+				}
+				patterns = append(patterns, s)
+			}
+			env := map[string]string{}
+			maps.Copy(env, rc.Env)
+			env["patterns"] = strings.Join(patterns, "\n")
+			if followSymlink {
+				env["followSymbolicLinks"] = "true"
+			}
+
+			stdout, stderr := rc.JobContainer.ReplaceLogWriter(hout, herr)
+			_ = rc.JobContainer.Copy(rc.JobContainer.GetActPath(), &container.FileEntry{
+				Name: name,
+				Mode: 0o644,
+				Body: hashfiles,
+			}).
+				Then(rc.execJobContainer([]string{"node", path.Join(rc.JobContainer.GetActPath(), name)},
+					env, "", "")).
+				Finally(func(context.Context) error {
+					rc.JobContainer.ReplaceLogWriter(stdout, stderr)
+					return nil
+				})(timeed)
+			output := hout.String() + "\n" + herr.String()
+			guard := "__OUTPUT__"
+			outstart := strings.Index(output, guard)
+			if outstart != -1 {
+				outstart += len(guard)
+				outend := strings.Index(output[outstart:], guard)
+				if outend != -1 {
+					return output[outstart : outstart+outend], nil
+				}
+			}
+		}
+		return "", nil
+	}
+	return hashFiles
+}
+
+type expressionEvaluator struct {
+	interpreter exprparser.Interpreter
+}
+
+func (ee expressionEvaluator) evaluate(ctx context.Context, in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) {
+	logger := common.Logger(ctx)
+	logger.Debugf("evaluating expression '%s'", in)
+	evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck)
+
+	printable := regexp.MustCompile(`::add-mask::.*`).ReplaceAllString(fmt.Sprintf("%t", evaluated), "::add-mask::***)")
+	logger.Debugf("expression '%s' evaluated to '%s'", in, printable)
+
+	return evaluated, err
+}
+
+func (ee expressionEvaluator) evaluateScalarYamlNode(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
+	var in string
+	if err := node.Decode(&in); err != nil {
+		return nil, err
+	}
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
+	}
+	expr, _ := rewriteSubExpression(ctx, in, false)
+	res, err := ee.evaluate(ctx, expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		return nil, err
+	}
+	ret := &yaml.Node{}
+	if err := ret.Encode(res); err != nil {
+		return nil, err
+	}
+	return ret, err
+}
+
+func (ee expressionEvaluator) evaluateMappingYamlNode(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
+	var ret *yaml.Node
+	// GitHub has this undocumented feature to merge maps, called insert directive
+	insertDirective := regexp.MustCompile(`\${{\s*insert\s*}}`)
+	for i := 0; i < len(node.Content)/2; i++ {
+		changed := func() error {
+			if ret == nil {
+				ret = &yaml.Node{}
+				if err := ret.Encode(node); err != nil {
+					return err
+				}
+				ret.Content = ret.Content[:i*2]
+			}
+			return nil
+		}
+		k := node.Content[i*2]
+		v := node.Content[i*2+1]
+		ev, err := ee.evaluateYamlNodeInternal(ctx, v)
+		if err != nil {
+			return nil, err
+		}
+		if ev != nil {
+			if err := changed(); err != nil {
+				return nil, err
+			}
+		} else {
+			ev = v
+		}
+		var sk string
+		// Merge the nested map of the insert directive
+		if k.Decode(&sk) == nil && insertDirective.MatchString(sk) {
+			if ev.Kind != yaml.MappingNode {
+				return nil, fmt.Errorf("failed to insert node %v into mapping %v unexpected type %v expected MappingNode", ev, node, ev.Kind)
+			}
+			if err := changed(); err != nil {
+				return nil, err
+			}
+			ret.Content = append(ret.Content, ev.Content...)
+		} else {
+			ek, err := ee.evaluateYamlNodeInternal(ctx, k)
+			if err != nil {
+				return nil, err
+			}
+			if ek != nil {
+				if err := changed(); err != nil {
+					return nil, err
+				}
+			} else {
+				ek = k
+			}
+			if ret != nil {
+				ret.Content = append(ret.Content, ek, ev)
+			}
+		}
+	}
+	return ret, nil
+}
+
+func (ee expressionEvaluator) evaluateSequenceYamlNode(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
+	var ret *yaml.Node
+	for i := 0; i < len(node.Content); i++ {
+		v := node.Content[i]
+		// Preserve nested sequences
+		wasseq := v.Kind == yaml.SequenceNode
+		ev, err := ee.evaluateYamlNodeInternal(ctx, v)
+		if err != nil {
+			return nil, err
+		}
+		if ev != nil {
+			if ret == nil {
+				ret = &yaml.Node{}
+				if err := ret.Encode(node); err != nil {
+					return nil, err
+				}
+				ret.Content = ret.Content[:i]
+			}
+			// GitHub has this undocumented feature to merge sequences / arrays
+			// We have a nested sequence via evaluation, merge the arrays
+			if ev.Kind == yaml.SequenceNode && !wasseq {
+				ret.Content = append(ret.Content, ev.Content...)
+			} else {
+				ret.Content = append(ret.Content, ev)
+			}
+		} else if ret != nil {
+			ret.Content = append(ret.Content, v)
+		}
+	}
+	return ret, nil
+}
+
+func (ee expressionEvaluator) evaluateYamlNodeInternal(ctx context.Context, node *yaml.Node) (*yaml.Node, error) {
+	switch node.Kind {
+	case yaml.ScalarNode:
+		return ee.evaluateScalarYamlNode(ctx, node)
+	case yaml.MappingNode:
+		return ee.evaluateMappingYamlNode(ctx, node)
+	case yaml.SequenceNode:
+		return ee.evaluateSequenceYamlNode(ctx, node)
+	default:
+		return nil, nil //nolint:nilnil // pre-existing issue from nektos/act
+	}
+}
+
+func (ee expressionEvaluator) EvaluateYamlNode(ctx context.Context, node *yaml.Node) error {
+	ret, err := ee.evaluateYamlNodeInternal(ctx, node)
+	if err != nil {
+		return err
+	}
+	if ret != nil {
+		return ret.Decode(node)
+	}
+	return nil
+}
+
+func (ee expressionEvaluator) Interpolate(ctx context.Context, in string) string {
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return in
+	}
+
+	expr, _ := rewriteSubExpression(ctx, in, true)
+	evaluated, err := ee.evaluate(ctx, expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		common.Logger(ctx).Errorf("Unable to interpolate expression '%s': %s", expr, err)
+		return ""
+	}
+
+	value, ok := evaluated.(string)
+	if !ok {
+		panic(fmt.Sprintf("Expression %s did not evaluate to a string", expr))
+	}
+
+	return value
+}
+
+// EvalBool evaluates an expression against given evaluator
+func EvalBool(ctx context.Context, evaluator ExpressionEvaluator, expr string, defaultStatusCheck exprparser.DefaultStatusCheck) (bool, error) {
+	nextExpr, _ := rewriteSubExpression(ctx, expr, false)
+
+	evaluated, err := evaluator.evaluate(ctx, nextExpr, defaultStatusCheck)
+	if err != nil {
+		return false, err
+	}
+
+	return exprparser.IsTruthy(evaluated), nil
+}
+
+func escapeFormatString(in string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(in, "{", "{{"), "}", "}}")
+}
+
+//nolint:gocyclo // function handles many cases
+func rewriteSubExpression(ctx context.Context, in string, forceFormat bool) (string, error) { //nolint:unparam // pre-existing issue from nektos/act
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return in, nil
+	}
+
+	strPattern := regexp.MustCompile("(?:''|[^'])*'")
+	pos := 0
+	exprStart := -1
+	strStart := -1
+	var results []string
+	var formatOut strings.Builder
+	for pos < len(in) {
+		if strStart > -1 {
+			matches := strPattern.FindStringIndex(in[pos:])
+			if matches == nil {
+				panic("unclosed string.")
+			}
+
+			strStart = -1
+			pos += matches[1]
+		} else if exprStart > -1 {
+			exprEnd := strings.Index(in[pos:], "}}")
+			strStart = strings.Index(in[pos:], "'")
+
+			if exprEnd > -1 && strStart > -1 {
+				if exprEnd < strStart {
+					strStart = -1
+				} else {
+					exprEnd = -1
+				}
+			}
+
+			if exprEnd > -1 {
+				fmt.Fprintf(&formatOut, "{%d}", len(results))
+				results = append(results, strings.TrimSpace(in[exprStart:pos+exprEnd]))
+				pos += exprEnd + 2
+				exprStart = -1
+			} else if strStart > -1 {
+				pos += strStart + 1
+			} else {
+				panic("unclosed expression.")
+			}
+		} else {
+			exprStart = strings.Index(in[pos:], "${{")
+			if exprStart != -1 {
+				formatOut.WriteString(escapeFormatString(in[pos : pos+exprStart]))
+				exprStart = pos + exprStart + 3
+				pos = exprStart
+			} else {
+				formatOut.WriteString(escapeFormatString(in[pos:]))
+				pos = len(in)
+			}
+		}
+	}
+
+	if len(results) == 1 && formatOut.String() == "{0}" && !forceFormat {
+		return in, nil
+	}
+
+	out := fmt.Sprintf("format('%s', %s)", strings.ReplaceAll(formatOut.String(), "'", "''"), strings.Join(results, ", "))
+	if in != out {
+		common.Logger(ctx).Debugf("expression '%s' rewritten to '%s'", in, out)
+	}
+	return out, nil
+}
+
+//nolint:gocyclo // function handles many cases
+func getEvaluatorInputs(ctx context.Context, rc *RunContext, step step, ghc *model.GithubContext) map[string]any {
+	inputs := map[string]any{}
+
+	setupWorkflowInputs(ctx, &inputs, rc)
+
+	var env map[string]string
+	if step != nil {
+		env = *step.getEnv()
+	} else {
+		env = rc.GetEnv()
+	}
+
+	for k, v := range env {
+		if after, ok := strings.CutPrefix(k, "INPUT_"); ok {
+			inputs[strings.ToLower(after)] = v
+		}
+	}
+
+	if ghc.EventName == "workflow_dispatch" {
+		config := rc.Run.Workflow.WorkflowDispatchConfig()
+		if config != nil && config.Inputs != nil {
+			for k, v := range config.Inputs {
+				value := nestedMapLookup(ghc.Event, "inputs", k)
+				if value == nil {
+					value = v.Default
+				}
+				if v.Type == "boolean" {
+					inputs[k] = value == "true"
+				} else {
+					inputs[k] = value
+				}
+			}
+		}
+	}
+
+	if ghc.EventName == "workflow_call" {
+		config := rc.Run.Workflow.WorkflowCallConfig()
+		if config != nil && config.Inputs != nil {
+			for k, v := range config.Inputs {
+				value := nestedMapLookup(ghc.Event, "inputs", k)
+				if value == nil {
+					value = v.Default
+				}
+				if v.Type == "boolean" {
+					inputs[k] = value == "true"
+				} else {
+					inputs[k] = value
+				}
+			}
+		}
+	}
+	return inputs
+}
+
+func setupWorkflowInputs(ctx context.Context, inputs *map[string]any, rc *RunContext) {
+	if rc.caller != nil {
+		config := rc.Run.Workflow.WorkflowCallConfig()
+
+		for name, input := range config.Inputs {
+			value := rc.caller.runContext.Run.Job().With[name]
+			if value != nil {
+				if str, ok := value.(string); ok {
+					// evaluate using the calling RunContext (outside)
+					value = rc.caller.runContext.ExprEval.Interpolate(ctx, str)
+				}
+			}
+
+			if value == nil && config != nil && config.Inputs != nil {
+				value = input.Default
+				if rc.ExprEval != nil {
+					if str, ok := value.(string); ok {
+						// evaluate using the called RunContext (inside)
+						value = rc.ExprEval.Interpolate(ctx, str)
+					}
+				}
+			}
+
+			(*inputs)[name] = value
+		}
+	}
+}
+
+func getWorkflowSecrets(ctx context.Context, rc *RunContext) map[string]string {
+	if rc.caller != nil {
+		job := rc.caller.runContext.Run.Job()
+		secrets := job.Secrets()
+
+		if secrets == nil && job.InheritSecrets() {
+			secrets = rc.caller.runContext.Config.Secrets
+		}
+
+		if secrets == nil {
+			secrets = map[string]string{}
+		}
+
+		for k, v := range secrets {
+			secrets[k] = rc.caller.runContext.ExprEval.Interpolate(ctx, v)
+		}
+
+		return secrets
+	}
+
+	return rc.Config.Secrets
+}
+
+func getWorkflowVars(_ context.Context, rc *RunContext) map[string]string {
+	return rc.Config.Vars
+}

act/runner/expression_test.go

@@ -0,0 +1,323 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/exprparser"
+	"gitea.com/gitea/act_runner/act/model"
+
+	assert "github.com/stretchr/testify/assert"
+	yaml "go.yaml.in/yaml/v4"
+)
+
+func createRunContext(t *testing.T) *RunContext {
+	var yml yaml.Node
+	err := yml.Encode(map[string][]any{
+		"os":  {"Linux", "Windows"},
+		"foo": {"bar", "baz"},
+	})
+	assert.NoError(t, err)
+
+	return &RunContext{
+		Config: &Config{
+			Workdir: ".",
+			Secrets: map[string]string{
+				"CASE_INSENSITIVE_SECRET": "value",
+			},
+			Vars: map[string]string{
+				"CASE_INSENSITIVE_VAR": "value",
+			},
+		},
+		Env: map[string]string{
+			"key": "value",
+		},
+		Run: &model.Run{
+			JobID: "job1",
+			Workflow: &model.Workflow{
+				Name: "test-workflow",
+				Jobs: map[string]*model.Job{
+					"job1": {
+						Strategy: &model.Strategy{
+							RawMatrix: yml,
+						},
+					},
+				},
+			},
+		},
+		Matrix: map[string]any{
+			"os":  "Linux",
+			"foo": "bar",
+		},
+		StepResults: map[string]*model.StepResult{
+			"idwithnothing": {
+				Conclusion: model.StepStatusSuccess,
+				Outcome:    model.StepStatusFailure,
+				Outputs: map[string]string{
+					"foowithnothing": "barwithnothing",
+				},
+			},
+			"id-with-hyphens": {
+				Conclusion: model.StepStatusSuccess,
+				Outcome:    model.StepStatusFailure,
+				Outputs: map[string]string{
+					"foo-with-hyphens": "bar-with-hyphens",
+				},
+			},
+			"id_with_underscores": {
+				Conclusion: model.StepStatusSuccess,
+				Outcome:    model.StepStatusFailure,
+				Outputs: map[string]string{
+					"foo_with_underscores": "bar_with_underscores",
+				},
+			},
+		},
+	}
+}
+
+func TestEvaluateRunContext(t *testing.T) {
+	rc := createRunContext(t)
+	ee := rc.NewExpressionEvaluator(context.Background())
+
+	tables := []struct {
+		in      string
+		out     any
+		errMesg string
+	}{
+		{" 1 ", 1, ""},
+		// {"1 + 3", "4", ""},
+		// {"(1 + 3) * -2", "-8", ""},
+		{"'my text'", "my text", ""},
+		{"contains('my text', 'te')", true, ""},
+		{"contains('my TEXT', 'te')", true, ""},
+		{"contains(fromJSON('[\"my text\"]'), 'te')", false, ""},
+		{"contains(fromJSON('[\"foo\",\"bar\"]'), 'bar')", true, ""},
+		{"startsWith('hello world', 'He')", true, ""},
+		{"endsWith('hello world', 'ld')", true, ""},
+		{"format('0:{0} 2:{2} 1:{1}', 'zero', 'one', 'two')", "0:zero 2:two 1:one", ""},
+		{"join(fromJSON('[\"hello\"]'),'octocat')", "hello", ""},
+		{"join(fromJSON('[\"hello\",\"mona\",\"the\"]'),'octocat')", "hellooctocatmonaoctocatthe", ""},
+		{"join('hello','mona')", "hello", ""},
+		{"toJSON(env)", "{\n  \"ACT\": \"true\",\n  \"ACT_SKIP_CHECKOUT\": \"true\",\n  \"key\": \"value\"\n}", ""},
+		{"toJson(env)", "{\n  \"ACT\": \"true\",\n  \"ACT_SKIP_CHECKOUT\": \"true\",\n  \"key\": \"value\"\n}", ""},
+		{"(fromJSON('{\"foo\":\"bar\"}')).foo", "bar", ""},
+		{"(fromJson('{\"foo\":\"bar\"}')).foo", "bar", ""},
+		{"(fromJson('[\"foo\",\"bar\"]'))[1]", "bar", ""},
+		// github does return an empty string for non-existent files
+		{"hashFiles('**/non-extant-files')", "", ""},
+		{"hashFiles('**/non-extant-files', '**/more-non-extant-files')", "", ""},
+		{"hashFiles('**/non.extant.files')", "", ""},
+		{"hashFiles('**/non''extant''files')", "", ""},
+		{"success()", true, ""},
+		{"failure()", false, ""},
+		{"always()", true, ""},
+		{"cancelled()", false, ""},
+		{"github.workflow", "test-workflow", ""},
+		{"github.actor", "nektos/act", ""},
+		{"github.run_id", "1", ""},
+		{"github.run_number", "1", ""},
+		{"job.status", "success", ""},
+		{"matrix.os", "Linux", ""},
+		{"matrix.foo", "bar", ""},
+		{"env.key", "value", ""},
+		{"secrets.CASE_INSENSITIVE_SECRET", "value", ""},
+		{"secrets.case_insensitive_secret", "value", ""},
+		{"vars.CASE_INSENSITIVE_VAR", "value", ""},
+		{"vars.case_insensitive_var", "value", ""},
+		{"format('{{0}}', 'test')", "{0}", ""},
+		{"format('{{{0}}}', 'test')", "{test}", ""},
+		{"format('}}')", "}", ""},
+		{"format('echo Hello {0} ${{Test}}', 'World')", "echo Hello World ${Test}", ""},
+		{"format('echo Hello {0} ${{Test}}', github.undefined_property)", "echo Hello  ${Test}", ""},
+		{"format('echo Hello {0}{1} ${{Te{0}st}}', github.undefined_property, 'World')", "echo Hello World ${Test}", ""},
+		{"format('{0}', '{1}', 'World')", "{1}", ""},
+		{"format('{{{0}', '{1}', 'World')", "{{1}", ""},
+	}
+
+	for _, table := range tables {
+		t.Run(table.in, func(t *testing.T) {
+			assertObject := assert.New(t)
+			out, err := ee.evaluate(context.Background(), table.in, exprparser.DefaultStatusCheckNone)
+			if table.errMesg == "" {
+				assertObject.NoError(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
+				assertObject.Equal(table.out, out, table.in)
+			} else {
+				assertObject.Error(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
+				assertObject.Equal(table.errMesg, err.Error(), table.in)
+			}
+		})
+	}
+}
+
+func TestEvaluateStep(t *testing.T) {
+	rc := createRunContext(t)
+	step := &stepRun{
+		RunContext: rc,
+	}
+
+	ee := rc.NewStepExpressionEvaluator(context.Background(), step)
+
+	tables := []struct {
+		in      string
+		out     any
+		errMesg string
+	}{
+		{"steps.idwithnothing.conclusion", model.StepStatusSuccess.String(), ""},
+		{"steps.idwithnothing.outcome", model.StepStatusFailure.String(), ""},
+		{"steps.idwithnothing.outputs.foowithnothing", "barwithnothing", ""},
+		{"steps.id-with-hyphens.conclusion", model.StepStatusSuccess.String(), ""},
+		{"steps.id-with-hyphens.outcome", model.StepStatusFailure.String(), ""},
+		{"steps.id-with-hyphens.outputs.foo-with-hyphens", "bar-with-hyphens", ""},
+		{"steps.id_with_underscores.conclusion", model.StepStatusSuccess.String(), ""},
+		{"steps.id_with_underscores.outcome", model.StepStatusFailure.String(), ""},
+		{"steps.id_with_underscores.outputs.foo_with_underscores", "bar_with_underscores", ""},
+	}
+
+	for _, table := range tables {
+		t.Run(table.in, func(t *testing.T) {
+			assertObject := assert.New(t)
+			out, err := ee.evaluate(context.Background(), table.in, exprparser.DefaultStatusCheckNone)
+			if table.errMesg == "" {
+				assertObject.NoError(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
+				assertObject.Equal(table.out, out, table.in)
+			} else {
+				assertObject.Error(err, table.in) //nolint:testifylint // pre-existing issue from nektos/act
+				assertObject.Equal(table.errMesg, err.Error(), table.in)
+			}
+		})
+	}
+}
+
+func TestInterpolate(t *testing.T) {
+	rc := &RunContext{
+		Config: &Config{
+			Workdir: ".",
+			Secrets: map[string]string{
+				"CASE_INSENSITIVE_SECRET": "value",
+			},
+			Vars: map[string]string{
+				"CASE_INSENSITIVE_VAR": "value",
+			},
+		},
+		Env: map[string]string{
+			"KEYWITHNOTHING":       "valuewithnothing",
+			"KEY-WITH-HYPHENS":     "value-with-hyphens",
+			"KEY_WITH_UNDERSCORES": "value_with_underscores",
+			"SOMETHING_TRUE":       "true",
+			"SOMETHING_FALSE":      "false",
+		},
+		Run: &model.Run{
+			JobID: "job1",
+			Workflow: &model.Workflow{
+				Name: "test-workflow",
+				Jobs: map[string]*model.Job{
+					"job1": {},
+				},
+			},
+		},
+	}
+	ee := rc.NewExpressionEvaluator(context.Background())
+	tables := []struct {
+		in  string
+		out string
+	}{
+		{" text ", " text "},
+		{" $text ", " $text "},
+		{" ${text} ", " ${text} "},
+		{" ${{          1                         }} to ${{2}} ", " 1 to 2 "},
+		{" ${{  (true || false)  }} to ${{2}} ", " true to 2 "},
+		{" ${{  (false   ||  '}}'  )    }} to ${{2}} ", " }} to 2 "},
+		{" ${{ env.KEYWITHNOTHING }} ", " valuewithnothing "},
+		{" ${{ env.KEY-WITH-HYPHENS }} ", " value-with-hyphens "},
+		{" ${{ env.KEY_WITH_UNDERSCORES }} ", " value_with_underscores "},
+		{"${{ secrets.CASE_INSENSITIVE_SECRET }}", "value"},
+		{"${{ secrets.case_insensitive_secret }}", "value"},
+		{"${{ vars.CASE_INSENSITIVE_VAR }}", "value"},
+		{"${{ vars.case_insensitive_var }}", "value"},
+		{"${{ env.UNKNOWN }}", ""},
+		{"${{ env.SOMETHING_TRUE }}", "true"},
+		{"${{ env.SOMETHING_FALSE }}", "false"},
+		{"${{ !env.SOMETHING_TRUE }}", "false"},
+		{"${{ !env.SOMETHING_FALSE }}", "false"},
+		{"${{ !env.SOMETHING_TRUE && true }}", "false"},
+		{"${{ !env.SOMETHING_FALSE && true }}", "false"},
+		{"${{ env.SOMETHING_TRUE && true }}", "true"},
+		{"${{ env.SOMETHING_FALSE && true }}", "true"},
+		{"${{ !env.SOMETHING_TRUE || true }}", "true"},
+		{"${{ !env.SOMETHING_FALSE || true }}", "true"},
+		{"${{ !env.SOMETHING_TRUE && false }}", "false"},
+		{"${{ !env.SOMETHING_FALSE && false }}", "false"},
+		{"${{ !env.SOMETHING_TRUE || false }}", "false"},
+		{"${{ !env.SOMETHING_FALSE || false }}", "false"},
+		{"${{ env.SOMETHING_TRUE || false }}", "true"},
+		{"${{ env.SOMETHING_FALSE || false }}", "false"},
+		{"${{ env.SOMETHING_FALSE }} && ${{ env.SOMETHING_TRUE }}", "false && true"},
+		{"${{ fromJSON('{}') < 2 }}", "false"},
+	}
+
+	for _, table := range tables {
+		t.Run("interpolate", func(t *testing.T) {
+			assertObject := assert.New(t)
+			out := ee.Interpolate(context.Background(), table.in)
+			assertObject.Equal(table.out, out, table.in)
+		})
+	}
+}
+
+func TestRewriteSubExpression(t *testing.T) {
+	table := []struct {
+		in  string
+		out string
+	}{
+		{in: "Hello World", out: "Hello World"},
+		{in: "${{ true }}", out: "${{ true }}"},
+		{in: "${{ true }} ${{ true }}", out: "format('{0} {1}', true, true)"},
+		{in: "${{ true || false }} ${{ true && true }}", out: "format('{0} {1}', true || false, true && true)"},
+		{in: "${{ '}}' }}", out: "${{ '}}' }}"},
+		{in: "${{ '''}}''' }}", out: "${{ '''}}''' }}"},
+		{in: "${{ '''' }}", out: "${{ '''' }}"},
+		{in: `${{ fromJSON('"}}"') }}`, out: `${{ fromJSON('"}}"') }}`},
+		{in: `${{ fromJSON('"\"}}\""') }}`, out: `${{ fromJSON('"\"}}\""') }}`},
+		{in: `${{ fromJSON('"''}}"') }}`, out: `${{ fromJSON('"''}}"') }}`},
+		{in: "Hello ${{ 'World' }}", out: "format('Hello {0}', 'World')"},
+	}
+
+	for _, table := range table {
+		t.Run("TestRewriteSubExpression", func(t *testing.T) {
+			assertObject := assert.New(t)
+			out, err := rewriteSubExpression(context.Background(), table.in, false)
+			if err != nil {
+				t.Fatal(err)
+			}
+			assertObject.Equal(table.out, out, table.in)
+		})
+	}
+}
+
+func TestRewriteSubExpressionForceFormat(t *testing.T) {
+	table := []struct {
+		in  string
+		out string
+	}{
+		{in: "Hello World", out: "Hello World"},
+		{in: "${{ true }}", out: "format('{0}', true)"},
+		{in: "${{ '}}' }}", out: "format('{0}', '}}')"},
+		{in: `${{ fromJSON('"}}"') }}`, out: `format('{0}', fromJSON('"}}"'))`},
+		{in: "Hello ${{ 'World' }}", out: "format('Hello {0}', 'World')"},
+	}
+
+	for _, table := range table {
+		t.Run("TestRewriteSubExpressionForceFormat", func(t *testing.T) {
+			assertObject := assert.New(t)
+			out, err := rewriteSubExpression(context.Background(), table.in, true)
+			if err != nil {
+				t.Fatal(err)
+			}
+			assertObject.Equal(table.out, out, table.in)
+		})
+	}
+}

act/runner/job_executor.go

@@ -0,0 +1,237 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+)
+
+type jobInfo interface {
+	matrix() map[string]any
+	steps() []*model.Step
+	startContainer() common.Executor
+	stopContainer() common.Executor
+	closeContainer() common.Executor
+	interpolateOutputs() common.Executor
+	result(result string)
+}
+
+//nolint:contextcheck,gocyclo // composes many step executors
+func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executor {
+	steps := make([]common.Executor, 0)
+	preSteps := make([]common.Executor, 0)
+	var postExecutor common.Executor
+
+	steps = append(steps, func(ctx context.Context) error {
+		logger := common.Logger(ctx)
+		if len(info.matrix()) > 0 {
+			logger.Infof("\U0001F9EA  Matrix: %v", info.matrix())
+		}
+		return nil
+	})
+
+	infoSteps := info.steps()
+
+	if len(infoSteps) == 0 {
+		return common.NewDebugExecutor("No steps found")
+	}
+
+	preSteps = append(preSteps, func(ctx context.Context) error {
+		// Have to be skipped for some Tests
+		if rc.Run == nil {
+			return nil
+		}
+		rc.ExprEval = rc.NewExpressionEvaluator(ctx)
+		// evaluate environment variables since they can contain
+		// GitHub's special environment variables.
+		for k, v := range rc.GetEnv() {
+			rc.Env[k] = rc.ExprEval.Interpolate(ctx, v)
+		}
+		return nil
+	})
+
+	for i, stepModel := range infoSteps {
+		if stepModel == nil {
+			return func(ctx context.Context) error {
+				return fmt.Errorf("invalid Step %v: missing run or uses key", i)
+			}
+		}
+		if stepModel.ID == "" {
+			stepModel.ID = strconv.Itoa(i)
+		}
+		stepModel.Number = i
+
+		step, err := sf.newStep(stepModel, rc)
+		if err != nil {
+			return common.NewErrorExecutor(err)
+		}
+
+		preExec := step.pre()
+		preSteps = append(preSteps, useStepLogger(rc, stepModel, stepStagePre, func(ctx context.Context) error {
+			logger := common.Logger(ctx)
+			preErr := preExec(ctx)
+			if preErr != nil {
+				logger.Errorf("%v", preErr)
+				common.SetJobError(ctx, preErr)
+			} else if ctx.Err() != nil {
+				logger.Errorf("%v", ctx.Err())
+				common.SetJobError(ctx, ctx.Err())
+			}
+			return preErr
+		}))
+
+		stepExec := step.main()
+		steps = append(steps, useStepLogger(rc, stepModel, stepStageMain, func(ctx context.Context) error {
+			logger := common.Logger(ctx)
+			err := stepExec(ctx)
+			if err != nil {
+				logger.Errorf("%v", err)
+				common.SetJobError(ctx, err)
+			} else if ctx.Err() != nil {
+				logger.Errorf("%v", ctx.Err())
+				common.SetJobError(ctx, ctx.Err())
+			}
+			return nil
+		}))
+
+		postExec := useStepLogger(rc, stepModel, stepStagePost, step.post())
+		if postExecutor != nil {
+			// run the post executor in reverse order
+			postExecutor = postExec.Finally(postExecutor)
+		} else {
+			postExecutor = postExec
+		}
+	}
+
+	postExecutor = postExecutor.Finally(func(ctx context.Context) error {
+		jobError := common.JobError(ctx)
+		var err error
+		if rc.Config.AutoRemove || jobError == nil {
+			// always allow 1 min for stopping and removing the runner, even if we were cancelled
+			ctx, cancel := context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), time.Minute)
+			defer cancel()
+
+			logger := common.Logger(ctx)
+			// For Gitea
+			// We don't need to call `stopServiceContainers` here since it will be called by following `info.stopContainer`
+			// logger.Infof("Cleaning up services for job %s", rc.JobName)
+			// if err := rc.stopServiceContainers()(ctx); err != nil {
+			// 	logger.Errorf("Error while cleaning services: %v", err)
+			// }
+
+			logger.Infof("Cleaning up container for job %s", rc.JobName)
+			if err = info.stopContainer()(ctx); err != nil {
+				logger.Errorf("Error while stop job container: %v", err)
+			}
+
+			// For Gitea
+			// We don't need to call `NewDockerNetworkRemoveExecutor` here since it is called by above `info.stopContainer`
+			// if !rc.IsHostEnv(ctx) && rc.Config.ContainerNetworkMode == "" {
+			// 	// clean network in docker mode only
+			// 	// if the value of `ContainerNetworkMode` is empty string,
+			// 	// it means that the network to which containers are connecting is created by `act_runner`,
+			// 	// so, we should remove the network at last.
+			// 	networkName, _ := rc.networkName()
+			// 	logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, networkName)
+			// 	if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil {
+			// 		logger.Errorf("Error while cleaning network: %v", err)
+			// 	}
+			// }
+		}
+		setJobResult(ctx, info, rc, jobError == nil)
+		setJobOutputs(ctx, rc)
+
+		return err
+	})
+
+	pipeline := make([]common.Executor, 0)
+	pipeline = append(pipeline, preSteps...)
+	pipeline = append(pipeline, steps...)
+
+	return common.NewPipelineExecutor(info.startContainer(), common.NewPipelineExecutor(pipeline...).
+		Finally(func(ctx context.Context) error { //nolint:contextcheck // intentionally detaches from canceled parent
+			var cancel context.CancelFunc
+			if ctx.Err() == context.Canceled {
+				// in case of an aborted run, we still should execute the
+				// post steps to allow cleanup.
+				ctx, cancel = context.WithTimeout(common.WithLogger(context.Background(), common.Logger(ctx)), 5*time.Minute)
+				defer cancel()
+			}
+			return postExecutor(ctx)
+		}).
+		Finally(info.interpolateOutputs()).
+		Finally(info.closeContainer()))
+}
+
+func setJobResult(ctx context.Context, info jobInfo, rc *RunContext, success bool) {
+	logger := common.Logger(ctx)
+
+	jobResult := "success"
+	// we have only one result for a whole matrix build, so we need
+	// to keep an existing result state if we run a matrix
+	if len(info.matrix()) > 0 && rc.Run.Job().Result != "" {
+		jobResult = rc.Run.Job().Result
+	}
+
+	if !success {
+		jobResult = "failure"
+	}
+
+	info.result(jobResult)
+	if rc.caller != nil {
+		// set reusable workflow job result
+		rc.caller.setReusedWorkflowJobResult(rc.JobName, jobResult) // For Gitea
+		return
+	}
+
+	jobResultMessage := "succeeded"
+	if jobResult != "success" {
+		jobResultMessage = "failed"
+	}
+
+	logger.WithField("jobResult", jobResult).Infof("\U0001F3C1  Job %s", jobResultMessage)
+}
+
+func setJobOutputs(ctx context.Context, rc *RunContext) {
+	if rc.caller != nil {
+		// map outputs for reusable workflows
+		callerOutputs := make(map[string]string)
+
+		ee := rc.NewExpressionEvaluator(ctx)
+
+		for k, v := range rc.Run.Workflow.WorkflowCallConfig().Outputs {
+			callerOutputs[k] = ee.Interpolate(ctx, ee.Interpolate(ctx, v.Value))
+		}
+
+		rc.caller.runContext.Run.Job().Outputs = callerOutputs
+	}
+}
+
+func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor {
+	return func(ctx context.Context) error {
+		ctx = withStepLogger(ctx, stepModel.Number, stepModel.ID, rc.ExprEval.Interpolate(ctx, stepModel.String()), stage.String())
+
+		rawLogger := common.Logger(ctx).WithField("raw_output", true)
+		logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
+			if rc.Config.LogOutput {
+				rawLogger.Infof("%s", s)
+			} else {
+				rawLogger.Debugf("%s", s)
+			}
+			return true
+		})
+
+		oldout, olderr := rc.JobContainer.ReplaceLogWriter(logWriter, logWriter)
+		defer rc.JobContainer.ReplaceLogWriter(oldout, olderr)
+
+		return executor(ctx)
+	}
+}

act/runner/job_executor_test.go

@@ -0,0 +1,343 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestJobExecutor(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	tables := []TestJobFileInfo{
+		{workdir, "uses-and-run-in-one-step", "push", "Invalid run/uses syntax for job:test step:Test", platforms, secrets},
+		{workdir, "uses-github-empty", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
+		{workdir, "uses-github-noref", "push", "Expected format {org}/{repo}[/path]@ref", platforms, secrets},
+		{workdir, "uses-github-root", "push", "", platforms, secrets},
+		{workdir, "uses-github-path", "push", "", platforms, secrets},
+		{workdir, "uses-docker-url", "push", "", platforms, secrets},
+		{workdir, "uses-github-full-sha", "push", "", platforms, secrets},
+		{workdir, "uses-github-short-sha", "push", "Unable to resolve action `actions/hello-world-docker-action@b136eb8`, the provided ref `b136eb8` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `b136eb8894c5cb1dd5807da824be97ccdf9b5423` instead", platforms, secrets},
+		{workdir, "job-nil-step", "push", "invalid Step 0: missing run or uses key", platforms, secrets},
+	}
+	// These tests are sufficient to only check syntax.
+	ctx := common.WithDryrun(context.Background(), true)
+	for _, table := range tables {
+		t.Run(table.workflowPath, func(t *testing.T) {
+			table.runTest(ctx, t, &Config{})
+		})
+	}
+}
+
+type jobInfoMock struct {
+	mock.Mock
+}
+
+func (jim *jobInfoMock) matrix() map[string]any {
+	args := jim.Called()
+	return args.Get(0).(map[string]any)
+}
+
+func (jim *jobInfoMock) steps() []*model.Step {
+	args := jim.Called()
+
+	return args.Get(0).([]*model.Step)
+}
+
+func (jim *jobInfoMock) startContainer() common.Executor {
+	args := jim.Called()
+
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (jim *jobInfoMock) stopContainer() common.Executor {
+	args := jim.Called()
+
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (jim *jobInfoMock) closeContainer() common.Executor {
+	args := jim.Called()
+
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (jim *jobInfoMock) interpolateOutputs() common.Executor {
+	args := jim.Called()
+
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (jim *jobInfoMock) result(result string) {
+	jim.Called(result)
+}
+
+type jobContainerMock struct {
+	container.Container
+	container.LinuxContainerEnvironmentExtensions
+}
+
+func (jcm *jobContainerMock) ReplaceLogWriter(_, _ io.Writer) (io.Writer, io.Writer) {
+	return nil, nil
+}
+
+type stepFactoryMock struct {
+	mock.Mock
+}
+
+func (sfm *stepFactoryMock) newStep(model *model.Step, rc *RunContext) (step, error) {
+	args := sfm.Called(model, rc)
+	return args.Get(0).(step), args.Error(1)
+}
+
+func TestNewJobExecutor(t *testing.T) {
+	table := []struct {
+		name          string
+		steps         []*model.Step
+		preSteps      []bool
+		postSteps     []bool
+		executedSteps []string
+		result        string
+		hasError      bool
+	}{
+		{
+			name:          "zeroSteps",
+			steps:         []*model.Step{},
+			preSteps:      []bool{},
+			postSteps:     []bool{},
+			executedSteps: []string{},
+			result:        "success",
+			hasError:      false,
+		},
+		{
+			name: "stepWithoutPrePost",
+			steps: []*model.Step{{
+				ID: "1",
+			}},
+			preSteps:  []bool{false},
+			postSteps: []bool{false},
+			executedSteps: []string{
+				"startContainer",
+				"step1",
+				"stopContainer",
+				"interpolateOutputs",
+				"closeContainer",
+			},
+			result:   "success",
+			hasError: false,
+		},
+		{
+			name: "stepWithFailure",
+			steps: []*model.Step{{
+				ID: "1",
+			}},
+			preSteps:  []bool{false},
+			postSteps: []bool{false},
+			executedSteps: []string{
+				"startContainer",
+				"step1",
+				"interpolateOutputs",
+				"closeContainer",
+			},
+			result:   "failure",
+			hasError: true,
+		},
+		{
+			name: "stepWithPre",
+			steps: []*model.Step{{
+				ID: "1",
+			}},
+			preSteps:  []bool{true},
+			postSteps: []bool{false},
+			executedSteps: []string{
+				"startContainer",
+				"pre1",
+				"step1",
+				"stopContainer",
+				"interpolateOutputs",
+				"closeContainer",
+			},
+			result:   "success",
+			hasError: false,
+		},
+		{
+			name: "stepWithPost",
+			steps: []*model.Step{{
+				ID: "1",
+			}},
+			preSteps:  []bool{false},
+			postSteps: []bool{true},
+			executedSteps: []string{
+				"startContainer",
+				"step1",
+				"post1",
+				"stopContainer",
+				"interpolateOutputs",
+				"closeContainer",
+			},
+			result:   "success",
+			hasError: false,
+		},
+		{
+			name: "stepWithPreAndPost",
+			steps: []*model.Step{{
+				ID: "1",
+			}},
+			preSteps:  []bool{true},
+			postSteps: []bool{true},
+			executedSteps: []string{
+				"startContainer",
+				"pre1",
+				"step1",
+				"post1",
+				"stopContainer",
+				"interpolateOutputs",
+				"closeContainer",
+			},
+			result:   "success",
+			hasError: false,
+		},
+		{
+			name: "stepsWithPreAndPost",
+			steps: []*model.Step{{
+				ID: "1",
+			}, {
+				ID: "2",
+			}, {
+				ID: "3",
+			}},
+			preSteps:  []bool{true, false, true},
+			postSteps: []bool{false, true, true},
+			executedSteps: []string{
+				"startContainer",
+				"pre1",
+				"pre3",
+				"step1",
+				"step2",
+				"step3",
+				"post3",
+				"post2",
+				"stopContainer",
+				"interpolateOutputs",
+				"closeContainer",
+			},
+			result:   "success",
+			hasError: false,
+		},
+	}
+
+	contains := func(needle string, haystack []string) bool {
+		return slices.Contains(haystack, needle)
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			fmt.Printf("::group::%s\n", tt.name) //nolint:forbidigo // pre-existing issue from nektos/act
+
+			ctx := common.WithJobErrorContainer(context.Background())
+			jim := &jobInfoMock{}
+			sfm := &stepFactoryMock{}
+			rc := &RunContext{
+				JobContainer: &jobContainerMock{},
+				Run: &model.Run{
+					JobID: "test",
+					Workflow: &model.Workflow{
+						Jobs: map[string]*model.Job{
+							"test": {},
+						},
+					},
+				},
+				Config: &Config{},
+			}
+			rc.ExprEval = rc.NewExpressionEvaluator(ctx)
+			executorOrder := make([]string, 0)
+
+			jim.On("steps").Return(tt.steps)
+
+			if len(tt.steps) > 0 {
+				jim.On("startContainer").Return(func(ctx context.Context) error {
+					executorOrder = append(executorOrder, "startContainer")
+					return nil
+				})
+			}
+
+			for i, stepModel := range tt.steps {
+				sm := &stepMock{}
+
+				sfm.On("newStep", stepModel, rc).Return(sm, nil)
+
+				sm.On("pre").Return(func(ctx context.Context) error {
+					if tt.preSteps[i] {
+						executorOrder = append(executorOrder, "pre"+stepModel.ID)
+					}
+					return nil
+				})
+
+				sm.On("main").Return(func(ctx context.Context) error {
+					executorOrder = append(executorOrder, "step"+stepModel.ID)
+					if tt.hasError {
+						return errors.New("error")
+					}
+					return nil
+				})
+
+				sm.On("post").Return(func(ctx context.Context) error {
+					if tt.postSteps[i] {
+						executorOrder = append(executorOrder, "post"+stepModel.ID)
+					}
+					return nil
+				})
+
+				defer sm.AssertExpectations(t)
+			}
+
+			if len(tt.steps) > 0 {
+				jim.On("matrix").Return(map[string]any{})
+
+				jim.On("interpolateOutputs").Return(func(ctx context.Context) error {
+					executorOrder = append(executorOrder, "interpolateOutputs")
+					return nil
+				})
+
+				if contains("stopContainer", tt.executedSteps) {
+					jim.On("stopContainer").Return(func(ctx context.Context) error {
+						executorOrder = append(executorOrder, "stopContainer")
+						return nil
+					})
+				}
+
+				jim.On("result", tt.result)
+
+				jim.On("closeContainer").Return(func(ctx context.Context) error {
+					executorOrder = append(executorOrder, "closeContainer")
+					return nil
+				})
+			}
+
+			executor := newJobExecutor(jim, sfm, rc)
+			err := executor(ctx)
+			assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+			assert.Equal(t, tt.executedSteps, executorOrder)
+
+			jim.AssertExpectations(t)
+			sfm.AssertExpectations(t)
+
+			fmt.Println("::endgroup::") //nolint:forbidigo // pre-existing issue from nektos/act
+		})
+	}
+}

act/runner/local_repository_cache.go

@@ -0,0 +1,95 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// Copyright 2024 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"io/fs"
+	goURL "net/url"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gitea.com/gitea/act_runner/act/filecollector"
+)
+
+type LocalRepositoryCache struct {
+	Parent            ActionCache
+	LocalRepositories map[string]string
+	CacheDirCache     map[string]string
+}
+
+func (l *LocalRepositoryCache) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {
+	if dest, ok := l.LocalRepositories[fmt.Sprintf("%s@%s", url, ref)]; ok {
+		l.CacheDirCache[fmt.Sprintf("%s@%s", cacheDir, ref)] = dest
+		return ref, nil
+	}
+	if purl, err := goURL.Parse(url); err == nil {
+		if dest, ok := l.LocalRepositories[fmt.Sprintf("%s@%s", strings.TrimPrefix(purl.Path, "/"), ref)]; ok {
+			l.CacheDirCache[fmt.Sprintf("%s@%s", cacheDir, ref)] = dest
+			return ref, nil
+		}
+	}
+	return l.Parent.Fetch(ctx, cacheDir, url, ref, token)
+}
+
+func (l *LocalRepositoryCache) GetTarArchive(ctx context.Context, cacheDir, sha, includePrefix string) (io.ReadCloser, error) {
+	// sha is mapped to ref in fetch if there is a local override
+	if dest, ok := l.CacheDirCache[fmt.Sprintf("%s@%s", cacheDir, sha)]; ok {
+		srcPath := filepath.Join(dest, includePrefix)
+		buf := &bytes.Buffer{}
+		tw := tar.NewWriter(buf)
+		defer tw.Close()
+		srcPath = filepath.Clean(srcPath)
+		fi, err := os.Lstat(srcPath)
+		if err != nil {
+			return nil, err
+		}
+		tc := &filecollector.TarCollector{
+			TarWriter: tw,
+		}
+		if fi.IsDir() {
+			srcPrefix := srcPath
+			if !strings.HasSuffix(srcPrefix, string(filepath.Separator)) {
+				srcPrefix += string(filepath.Separator)
+			}
+			fc := &filecollector.FileCollector{
+				Fs:        &filecollector.DefaultFs{},
+				SrcPath:   srcPath,
+				SrcPrefix: srcPrefix,
+				Handler:   tc,
+			}
+			err = filepath.Walk(srcPath, fc.CollectFiles(ctx, []string{}))
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			var f io.ReadCloser
+			var linkname string
+			if fi.Mode()&fs.ModeSymlink != 0 {
+				linkname, err = os.Readlink(srcPath)
+				if err != nil {
+					return nil, err
+				}
+			} else {
+				f, err = os.Open(srcPath)
+				if err != nil {
+					return nil, err
+				}
+				defer f.Close()
+			}
+			err := tc.WriteFile(fi.Name(), fi, linkname, f)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return io.NopCloser(buf), nil
+	}
+	return l.Parent.GetTarArchive(ctx, cacheDir, sha, includePrefix)
+}

act/runner/logger.go

@@ -0,0 +1,284 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"sync"
+
+	"gitea.com/gitea/act_runner/act/common"
+
+	"github.com/sirupsen/logrus"
+	"golang.org/x/term"
+)
+
+const (
+	// nocolor = 0
+	red     = 31
+	green   = 32
+	yellow  = 33
+	blue    = 34
+	magenta = 35
+	cyan    = 36
+	gray    = 37
+)
+
+var (
+	colors    []int
+	nextColor int
+	mux       sync.Mutex
+)
+
+func init() {
+	nextColor = 0
+	colors = []int{
+		blue, yellow, green, magenta, red, gray, cyan,
+	}
+}
+
+type masksContextKey string
+
+const masksContextKeyVal = masksContextKey("logrus.FieldLogger")
+
+// Logger returns the appropriate logger for current context
+func Masks(ctx context.Context) *[]string {
+	val := ctx.Value(masksContextKeyVal)
+	if val != nil {
+		if masks, ok := val.(*[]string); ok {
+			return masks
+		}
+	}
+	return &[]string{}
+}
+
+// WithMasks adds a value to the context for the logger
+func WithMasks(ctx context.Context, masks *[]string) context.Context {
+	return context.WithValue(ctx, masksContextKeyVal, masks)
+}
+
+type JobLoggerFactory interface {
+	WithJobLogger() *logrus.Logger
+}
+
+type jobLoggerFactoryContextKey string
+
+var jobLoggerFactoryContextKeyVal = (jobLoggerFactoryContextKey)("jobloggerkey")
+
+func WithJobLoggerFactory(ctx context.Context, factory JobLoggerFactory) context.Context {
+	return context.WithValue(ctx, jobLoggerFactoryContextKeyVal, factory)
+}
+
+// WithJobLogger attaches a new logger to context that is aware of steps
+func WithJobLogger(ctx context.Context, jobID, jobName string, config *Config, masks *[]string, matrix map[string]any) context.Context {
+	ctx = WithMasks(ctx, masks)
+
+	var logger *logrus.Logger
+	if jobLoggerFactory, ok := ctx.Value(jobLoggerFactoryContextKeyVal).(JobLoggerFactory); ok && jobLoggerFactory != nil {
+		logger = jobLoggerFactory.WithJobLogger()
+	} else {
+		var formatter logrus.Formatter
+		if config.JSONLogger {
+			formatter = &logrus.JSONFormatter{}
+		} else {
+			mux.Lock()
+			defer mux.Unlock()
+			nextColor++
+			formatter = &jobLogFormatter{
+				color:          colors[nextColor%len(colors)],
+				logPrefixJobID: config.LogPrefixJobID,
+			}
+		}
+
+		logger = logrus.New()
+		logger.SetOutput(os.Stdout)
+		logger.SetLevel(logrus.GetLevel())
+		logger.SetFormatter(formatter)
+	}
+
+	{ // Adapt to Gitea
+		if hook := common.LoggerHook(ctx); hook != nil {
+			logger.AddHook(hook)
+		}
+		if config.JobLoggerLevel != nil {
+			logger.SetLevel(*config.JobLoggerLevel)
+		} else {
+			logger.SetLevel(logrus.TraceLevel)
+		}
+	}
+
+	logger.SetFormatter(&maskedFormatter{
+		Formatter: logger.Formatter,
+		masker:    valueMasker(config.InsecureSecrets, config.Secrets),
+	})
+	rtn := logger.WithFields(logrus.Fields{
+		"job":    jobName,
+		"jobID":  jobID,
+		"dryrun": common.Dryrun(ctx),
+		"matrix": matrix,
+	}).WithContext(ctx)
+
+	return common.WithLogger(ctx, rtn)
+}
+
+func WithCompositeLogger(ctx context.Context, masks *[]string) context.Context {
+	ctx = WithMasks(ctx, masks)
+	return common.WithLogger(ctx, common.Logger(ctx).WithFields(logrus.Fields{}).WithContext(ctx))
+}
+
+func WithCompositeStepLogger(ctx context.Context, stepID string) context.Context {
+	val := common.Logger(ctx)
+	stepIDs := make([]string, 0)
+
+	if logger, ok := val.(*logrus.Entry); ok {
+		if oldStepIDs, ok := logger.Data["stepID"].([]string); ok {
+			stepIDs = append(stepIDs, oldStepIDs...)
+		}
+	}
+
+	stepIDs = append(stepIDs, stepID)
+
+	return common.WithLogger(ctx, common.Logger(ctx).WithFields(logrus.Fields{
+		"stepID": stepIDs,
+	}).WithContext(ctx))
+}
+
+func withStepLogger(ctx context.Context, stepNumber int, stepID, stepName, stageName string) context.Context {
+	rtn := common.Logger(ctx).WithFields(logrus.Fields{
+		"stepNumber": stepNumber,
+		"step":       stepName,
+		"stepID":     []string{stepID},
+		"stage":      stageName,
+	})
+	return common.WithLogger(ctx, rtn)
+}
+
+type entryProcessor func(entry *logrus.Entry) *logrus.Entry
+
+func valueMasker(insecureSecrets bool, secrets map[string]string) entryProcessor {
+	return func(entry *logrus.Entry) *logrus.Entry {
+		if insecureSecrets {
+			return entry
+		}
+
+		masks := Masks(entry.Context)
+
+		for _, v := range secrets {
+			if v != "" {
+				entry.Message = strings.ReplaceAll(entry.Message, v, "***")
+			}
+		}
+
+		for _, v := range *masks {
+			if v != "" {
+				entry.Message = strings.ReplaceAll(entry.Message, v, "***")
+			}
+		}
+
+		return entry
+	}
+}
+
+type maskedFormatter struct {
+	logrus.Formatter
+	masker entryProcessor
+}
+
+func (f *maskedFormatter) Format(entry *logrus.Entry) ([]byte, error) {
+	return f.Formatter.Format(f.masker(entry))
+}
+
+type jobLogFormatter struct {
+	color          int
+	logPrefixJobID bool
+}
+
+func (f *jobLogFormatter) Format(entry *logrus.Entry) ([]byte, error) {
+	b := &bytes.Buffer{}
+
+	if f.isColored(entry) {
+		f.printColored(b, entry)
+	} else {
+		f.print(b, entry)
+	}
+
+	b.WriteByte('\n')
+	return b.Bytes(), nil
+}
+
+func (f *jobLogFormatter) printColored(b *bytes.Buffer, entry *logrus.Entry) {
+	entry.Message = strings.TrimSuffix(entry.Message, "\n")
+
+	var job any
+	if f.logPrefixJobID {
+		job = entry.Data["jobID"]
+	} else {
+		job = entry.Data["job"]
+	}
+
+	debugFlag := ""
+	if entry.Level == logrus.DebugLevel {
+		debugFlag = "[DEBUG] "
+	}
+
+	if entry.Data["raw_output"] == true {
+		fmt.Fprintf(b, "\x1b[%dm|\x1b[0m %s", f.color, entry.Message)
+	} else if entry.Data["dryrun"] == true {
+		fmt.Fprintf(b, "\x1b[1m\x1b[%dm\x1b[7m*DRYRUN*\x1b[0m \x1b[%dm[%s] \x1b[0m%s%s", gray, f.color, job, debugFlag, entry.Message)
+	} else {
+		fmt.Fprintf(b, "\x1b[%dm[%s] \x1b[0m%s%s", f.color, job, debugFlag, entry.Message)
+	}
+}
+
+func (f *jobLogFormatter) print(b *bytes.Buffer, entry *logrus.Entry) {
+	entry.Message = strings.TrimSuffix(entry.Message, "\n")
+
+	var job any
+	if f.logPrefixJobID {
+		job = entry.Data["jobID"]
+	} else {
+		job = entry.Data["job"]
+	}
+
+	debugFlag := ""
+	if entry.Level == logrus.DebugLevel {
+		debugFlag = "[DEBUG] "
+	}
+
+	if entry.Data["raw_output"] == true {
+		fmt.Fprintf(b, "[%s]   | %s", job, entry.Message)
+	} else if entry.Data["dryrun"] == true {
+		fmt.Fprintf(b, "*DRYRUN* [%s] %s%s", job, debugFlag, entry.Message)
+	} else {
+		fmt.Fprintf(b, "[%s] %s%s", job, debugFlag, entry.Message)
+	}
+}
+
+func (f *jobLogFormatter) isColored(entry *logrus.Entry) bool {
+	isColored := checkIfTerminal(entry.Logger.Out)
+
+	if force, ok := os.LookupEnv("CLICOLOR_FORCE"); ok && force != "0" {
+		isColored = true
+	} else if ok && force == "0" {
+		isColored = false
+	} else if os.Getenv("CLICOLOR") == "0" {
+		isColored = false
+	}
+
+	return isColored
+}
+
+func checkIfTerminal(w io.Writer) bool {
+	switch v := w.(type) {
+	case *os.File:
+		return term.IsTerminal(int(v.Fd()))
+	default:
+		return false
+	}
+}

act/runner/max_parallel_test.go

@@ -0,0 +1,67 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+	"go.yaml.in/yaml/v4"
+)
+
+func TestMaxParallelStrategy(t *testing.T) {
+	tests := []struct {
+		name                string
+		maxParallelString   string
+		expectedMaxParallel int
+	}{
+		{
+			name:                "max-parallel-1",
+			maxParallelString:   "1",
+			expectedMaxParallel: 1,
+		},
+		{
+			name:                "max-parallel-2",
+			maxParallelString:   "2",
+			expectedMaxParallel: 2,
+		},
+		{
+			name:                "max-parallel-default",
+			maxParallelString:   "",
+			expectedMaxParallel: 4,
+		},
+		{
+			name:                "max-parallel-10",
+			maxParallelString:   "10",
+			expectedMaxParallel: 10,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			matrix := map[string][]any{
+				"version": {1, 2, 3, 4, 5},
+			}
+
+			var rawMatrix yaml.Node
+			err := rawMatrix.Encode(matrix)
+			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+			job := &model.Job{
+				Strategy: &model.Strategy{
+					MaxParallelString: tt.maxParallelString,
+					RawMatrix:         rawMatrix,
+				},
+			}
+
+			matrixes, err := job.GetMatrixes()
+			assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+			assert.NotNil(t, matrixes)
+			assert.Equal(t, 5, len(matrixes)) //nolint:testifylint // pre-existing issue from nektos/act
+			assert.Equal(t, tt.expectedMaxParallel, job.Strategy.MaxParallel)
+		})
+	}
+}

act/runner/res/trampoline.js

@@ -0,0 +1,14 @@
+const { spawnSync } = require('child_process')
+const spawnArguments = {
+  cwd: process.env.INPUT_CWD,
+  stdio: [
+    process.stdin,
+    process.stdout,
+    process.stderr
+  ]
+}
+const child = spawnSync(
+  '/bin/sh',
+  ['-c'].concat(process.env.INPUT_COMMAND),
+  spawnArguments)
+process.exit(child.status)

act/runner/reusable_workflow.go

@@ -0,0 +1,334 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"archive/tar"
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/url"
+	"os"
+	"path"
+	"regexp"
+	"strings"
+	"sync"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/common/git"
+	"gitea.com/gitea/act_runner/act/model"
+)
+
+func newLocalReusableWorkflowExecutor(rc *RunContext) common.Executor {
+	if !rc.Config.NoSkipCheckout {
+		fullPath := rc.Run.Job().Uses
+
+		fileName := path.Base(fullPath)
+		workflowDir := strings.TrimSuffix(fullPath, path.Join("/", fileName))
+		workflowDir = strings.TrimPrefix(workflowDir, "./")
+
+		return common.NewPipelineExecutor(
+			newReusableWorkflowExecutor(rc, workflowDir, fileName),
+		)
+	}
+
+	// ./.gitea/workflows/wf.yml -> .gitea/workflows/wf.yml
+	trimmedUses := strings.TrimPrefix(rc.Run.Job().Uses, "./")
+	// uses string format is {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}
+	uses := fmt.Sprintf("%s/%s@%s", rc.Config.PresetGitHubContext.Repository, trimmedUses, rc.Config.PresetGitHubContext.Sha)
+
+	remoteReusableWorkflow := newRemoteReusableWorkflowWithPlat(rc.Config.GitHubInstance, uses)
+	if remoteReusableWorkflow == nil {
+		return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
+	}
+
+	workflowDir := fmt.Sprintf("%s/%s", rc.ActionCacheDir(), safeFilename(uses))
+
+	// If the repository is private, we need a token to clone it
+	token := rc.Config.GetToken()
+
+	return common.NewPipelineExecutor(
+		newMutexExecutor(cloneIfRequired(rc, *remoteReusableWorkflow, workflowDir, token)),
+		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
+	)
+}
+
+func newRemoteReusableWorkflowExecutor(rc *RunContext) common.Executor {
+	uses := rc.Run.Job().Uses
+
+	var remoteReusableWorkflow *remoteReusableWorkflow
+	if strings.HasPrefix(uses, "http://") || strings.HasPrefix(uses, "https://") {
+		remoteReusableWorkflow = newRemoteReusableWorkflowFromAbsoluteURL(uses)
+		if remoteReusableWorkflow == nil {
+			return common.NewErrorExecutor(fmt.Errorf("expected format http(s)://{domain}/{owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
+		}
+	} else {
+		remoteReusableWorkflow = newRemoteReusableWorkflowWithPlat(rc.Config.GitHubInstance, uses)
+		if remoteReusableWorkflow == nil {
+			return common.NewErrorExecutor(fmt.Errorf("expected format {owner}/{repo}/.{git_platform}/workflows/{filename}@{ref}. Actual '%s' Input string was not in a correct format", uses))
+		}
+	}
+
+	// uses with safe filename makes the target directory look something like this {owner}-{repo}-.github-workflows-{filename}@{ref}
+	// instead we will just use {owner}-{repo}@{ref} as our target directory. This should also improve performance when we are using
+	// multiple reusable workflows from the same repository and ref since for each workflow we won't have to clone it again
+	filename := fmt.Sprintf("%s/%s@%s", remoteReusableWorkflow.Org, remoteReusableWorkflow.Repo, remoteReusableWorkflow.Ref)
+	workflowDir := fmt.Sprintf("%s/%s", rc.ActionCacheDir(), safeFilename(filename))
+
+	if rc.Config.ActionCache != nil {
+		return newActionCacheReusableWorkflowExecutor(rc, filename, remoteReusableWorkflow)
+	}
+
+	token := getGitCloneToken(rc.Config, remoteReusableWorkflow.CloneURL())
+
+	return common.NewPipelineExecutor(
+		newMutexExecutor(cloneIfRequired(rc, *remoteReusableWorkflow, workflowDir, token)),
+		newReusableWorkflowExecutor(rc, workflowDir, remoteReusableWorkflow.FilePath()),
+	)
+}
+
+func newActionCacheReusableWorkflowExecutor(rc *RunContext, filename string, remoteReusableWorkflow *remoteReusableWorkflow) common.Executor {
+	return func(ctx context.Context) error {
+		ghctx := rc.getGithubContext(ctx)
+		remoteReusableWorkflow.URL = ghctx.ServerURL
+		sha, err := rc.Config.ActionCache.Fetch(ctx, filename, remoteReusableWorkflow.CloneURL(), remoteReusableWorkflow.Ref, ghctx.Token)
+		if err != nil {
+			return err
+		}
+		archive, err := rc.Config.ActionCache.GetTarArchive(ctx, filename, sha, ".github/workflows/"+remoteReusableWorkflow.Filename)
+		if err != nil {
+			return err
+		}
+		defer archive.Close()
+		treader := tar.NewReader(archive)
+		if _, err = treader.Next(); err != nil {
+			return err
+		}
+		planner, err := model.NewSingleWorkflowPlanner(remoteReusableWorkflow.Filename, treader)
+		if err != nil {
+			return err
+		}
+		plan, err := planner.PlanEvent("workflow_call")
+		if err != nil {
+			return err
+		}
+
+		runner, err := NewReusableWorkflowRunner(rc)
+		if err != nil {
+			return err
+		}
+
+		return runner.NewPlanExecutor(plan)(ctx)
+	}
+}
+
+var executorLock sync.Mutex
+
+func newMutexExecutor(executor common.Executor) common.Executor {
+	return func(ctx context.Context) error {
+		executorLock.Lock()
+		defer executorLock.Unlock()
+
+		return executor(ctx)
+	}
+}
+
+func cloneIfRequired(rc *RunContext, remoteReusableWorkflow remoteReusableWorkflow, targetDirectory, token string) common.Executor {
+	return common.NewConditionalExecutor(
+		func(ctx context.Context) bool {
+			_, err := os.Stat(targetDirectory)
+			notExists := errors.Is(err, fs.ErrNotExist)
+			return notExists
+		},
+		func(ctx context.Context) error {
+			// interpolate the cloneURL
+			cloneURL := rc.NewExpressionEvaluator(ctx).Interpolate(ctx, remoteReusableWorkflow.CloneURL())
+			// Do not change the remoteReusableWorkflow.URL, because:
+			// 	1. Gitea doesn't support specifying GithubContext.ServerURL by the GITHUB_SERVER_URL env
+			//	2. Gitea has already full URL with rc.Config.GitHubInstance when calling newRemoteReusableWorkflowWithPlat
+			// remoteReusableWorkflow.URL = rc.getGithubContext(ctx).ServerURL
+			return git.NewGitCloneExecutor(git.NewGitCloneExecutorInput{
+				URL:         cloneURL,
+				Ref:         remoteReusableWorkflow.Ref,
+				Dir:         targetDirectory,
+				Token:       token,
+				OfflineMode: rc.Config.ActionOfflineMode,
+			})(ctx)
+		},
+		nil,
+	)
+}
+
+func newReusableWorkflowExecutor(rc *RunContext, directory, workflow string) common.Executor {
+	return func(ctx context.Context) error {
+		planner, err := model.NewWorkflowPlanner(path.Join(directory, workflow), true)
+		if err != nil {
+			return err
+		}
+
+		plan, err := planner.PlanEvent("workflow_call")
+		if err != nil {
+			return err
+		}
+
+		runner, err := NewReusableWorkflowRunner(rc)
+		if err != nil {
+			return err
+		}
+
+		// return runner.NewPlanExecutor(plan)(ctx)
+		return common.NewPipelineExecutor( // For Gitea
+			runner.NewPlanExecutor(plan),
+			setReusedWorkflowCallerResult(rc, runner),
+		)(ctx)
+	}
+}
+
+func NewReusableWorkflowRunner(rc *RunContext) (Runner, error) {
+	runner := &runnerImpl{
+		config:    rc.Config,
+		eventJSON: rc.EventJSON,
+		caller: &caller{
+			runContext: rc,
+
+			reusedWorkflowJobResults: map[string]string{}, // For Gitea
+		},
+	}
+
+	return runner.configure()
+}
+
+type remoteReusableWorkflow struct {
+	URL      string
+	Org      string
+	Repo     string
+	Filename string
+	Ref      string
+
+	GitPlatform string
+}
+
+func (r *remoteReusableWorkflow) CloneURL() string {
+	// In Gitea, r.URL always has the protocol prefix, we don't need to add extra prefix in this case.
+	if strings.HasPrefix(r.URL, "http://") || strings.HasPrefix(r.URL, "https://") {
+		return fmt.Sprintf("%s/%s/%s", r.URL, r.Org, r.Repo)
+	}
+	return fmt.Sprintf("https://%s/%s/%s", r.URL, r.Org, r.Repo)
+}
+
+func (r *remoteReusableWorkflow) FilePath() string {
+	return fmt.Sprintf("./.%s/workflows/%s", r.GitPlatform, r.Filename)
+}
+
+// For Gitea
+// newRemoteReusableWorkflowWithPlat create a `remoteReusableWorkflow`
+// workflows from `.gitea/workflows` and `.github/workflows` are supported
+func newRemoteReusableWorkflowWithPlat(url, uses string) *remoteReusableWorkflow {
+	// GitHub docs:
+	// https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_iduses
+	r := regexp.MustCompile(`^([^/]+)/([^/]+)/\.([^/]+)/workflows/([^@]+)@(.*)$`)
+	matches := r.FindStringSubmatch(uses)
+	if len(matches) != 6 {
+		return nil
+	}
+	return &remoteReusableWorkflow{
+		Org:         matches[1],
+		Repo:        matches[2],
+		GitPlatform: matches[3],
+		Filename:    matches[4],
+		Ref:         matches[5],
+		URL:         url,
+	}
+}
+
+// For Gitea
+// newRemoteReusableWorkflowWithPlat create a `remoteReusableWorkflow` from an absolute url
+func newRemoteReusableWorkflowFromAbsoluteURL(uses string) *remoteReusableWorkflow {
+	r := regexp.MustCompile(`^(https?://.*)/([^/]+)/([^/]+)/\.([^/]+)/workflows/([^@]+)@(.*)$`)
+	matches := r.FindStringSubmatch(uses)
+	if len(matches) != 7 {
+		return nil
+	}
+	return &remoteReusableWorkflow{
+		URL:         matches[1],
+		Org:         matches[2],
+		Repo:        matches[3],
+		GitPlatform: matches[4],
+		Filename:    matches[5],
+		Ref:         matches[6],
+	}
+}
+
+// For Gitea
+func setReusedWorkflowCallerResult(rc *RunContext, runner Runner) common.Executor {
+	return func(ctx context.Context) error {
+		logger := common.Logger(ctx)
+
+		runnerImpl, ok := runner.(*runnerImpl)
+		if !ok {
+			logger.Warn("Failed to get caller from runner")
+			return nil
+		}
+		caller := runnerImpl.caller
+
+		allJobDone := true
+		hasFailure := false
+		for _, result := range caller.reusedWorkflowJobResults {
+			if result == "pending" {
+				allJobDone = false
+				break
+			}
+			if result == "failure" {
+				hasFailure = true
+			}
+		}
+
+		if allJobDone {
+			reusedWorkflowJobResult := "success"
+			reusedWorkflowJobResultMessage := "succeeded"
+			if hasFailure {
+				reusedWorkflowJobResult = "failure"
+				reusedWorkflowJobResultMessage = "failed"
+			}
+
+			if rc.caller != nil {
+				rc.caller.setReusedWorkflowJobResult(rc.JobName, reusedWorkflowJobResult)
+			} else {
+				rc.result(reusedWorkflowJobResult)
+				logger.WithField("jobResult", reusedWorkflowJobResult).Infof("\U0001F3C1  Job %s", reusedWorkflowJobResultMessage)
+			}
+		}
+
+		return nil
+	}
+}
+
+// For Gitea
+// getGitCloneToken returns GITEA_TOKEN when shouldCloneURLUseToken returns true,
+// otherwise returns an empty string
+func getGitCloneToken(conf *Config, cloneURL string) string {
+	if !shouldCloneURLUseToken(conf.GitHubInstance, cloneURL) {
+		return ""
+	}
+	return conf.GetToken()
+}
+
+// For Gitea
+// shouldCloneURLUseToken returns true when the following conditions are met:
+// 1. cloneURL is from the same Gitea instance that the runner is registered to
+// 2. the cloneURL does not have basic auth embedded
+func shouldCloneURLUseToken(instanceURL, cloneURL string) bool {
+	u1, err1 := url.Parse(instanceURL)
+	u2, err2 := url.Parse(cloneURL)
+	if err1 != nil || err2 != nil {
+		return false
+	}
+	if u2.User != nil {
+		return false
+	}
+
+	return u1.Host == u2.Host
+}

act/runner/run_context_test.go

@@ -0,0 +1,644 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/exprparser"
+	"gitea.com/gitea/act_runner/act/model"
+
+	log "github.com/sirupsen/logrus"
+	assert "github.com/stretchr/testify/assert"
+	yaml "go.yaml.in/yaml/v4"
+)
+
+func TestRunContext_EvalBool(t *testing.T) {
+	var yml yaml.Node
+	err := yml.Encode(map[string][]any{
+		"os":  {"Linux", "Windows"},
+		"foo": {"bar", "baz"},
+	})
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	rc := &RunContext{
+		Config: &Config{
+			Workdir: ".",
+		},
+		Env: map[string]string{
+			"SOMETHING_TRUE":  "true",
+			"SOMETHING_FALSE": "false",
+			"SOME_TEXT":       "text",
+		},
+		Run: &model.Run{
+			JobID: "job1",
+			Workflow: &model.Workflow{
+				Name: "test-workflow",
+				Jobs: map[string]*model.Job{
+					"job1": {
+						Strategy: &model.Strategy{
+							RawMatrix: yml,
+						},
+					},
+				},
+			},
+		},
+		Matrix: map[string]any{
+			"os":  "Linux",
+			"foo": "bar",
+		},
+		StepResults: map[string]*model.StepResult{
+			"id1": {
+				Conclusion: model.StepStatusSuccess,
+				Outcome:    model.StepStatusFailure,
+				Outputs: map[string]string{
+					"foo": "bar",
+				},
+			},
+		},
+	}
+	rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
+
+	tables := []struct {
+		in      string
+		out     bool
+		wantErr bool
+	}{
+		// The basic ones
+		{in: "failure()", out: false},
+		{in: "success()", out: true},
+		{in: "cancelled()", out: false},
+		{in: "always()", out: true},
+		// TODO: move to sc.NewExpressionEvaluator(), because "steps" context is not available here
+		// {in: "steps.id1.conclusion == 'success'", out: true},
+		// {in: "steps.id1.conclusion != 'success'", out: false},
+		// {in: "steps.id1.outcome == 'failure'", out: true},
+		// {in: "steps.id1.outcome != 'failure'", out: false},
+		{in: "true", out: true},
+		{in: "false", out: false},
+		// TODO: This does not throw an error, because the evaluator does not know if the expression is inside ${{ }} or not
+		// {in: "!true", wantErr: true},
+		// {in: "!false", wantErr: true},
+		{in: "1 != 0", out: true},
+		{in: "1 != 1", out: false},
+		{in: "${{ 1 != 0 }}", out: true},
+		{in: "${{ 1 != 1 }}", out: false},
+		{in: "1 == 0", out: false},
+		{in: "1 == 1", out: true},
+		{in: "1 > 2", out: false},
+		{in: "1 < 2", out: true},
+		// And or
+		{in: "true && false", out: false},
+		{in: "true && 1 < 2", out: true},
+		{in: "false || 1 < 2", out: true},
+		{in: "false || false", out: false},
+		// None boolable
+		{in: "env.UNKNOWN == 'true'", out: false},
+		{in: "env.UNKNOWN", out: false},
+		// Inline expressions
+		{in: "env.SOME_TEXT", out: true},
+		{in: "env.SOME_TEXT == 'text'", out: true},
+		{in: "env.SOMETHING_TRUE == 'true'", out: true},
+		{in: "env.SOMETHING_FALSE == 'true'", out: false},
+		{in: "env.SOMETHING_TRUE", out: true},
+		{in: "env.SOMETHING_FALSE", out: true},
+		// TODO: This does not throw an error, because the evaluator does not know if the expression is inside ${{ }} or not
+		// {in: "!env.SOMETHING_TRUE", wantErr: true},
+		// {in: "!env.SOMETHING_FALSE", wantErr: true},
+		{in: "${{ !env.SOMETHING_TRUE }}", out: false},
+		{in: "${{ !env.SOMETHING_FALSE }}", out: false},
+		{in: "${{ ! env.SOMETHING_TRUE }}", out: false},
+		{in: "${{ ! env.SOMETHING_FALSE }}", out: false},
+		{in: "${{ env.SOMETHING_TRUE }}", out: true},
+		{in: "${{ env.SOMETHING_FALSE }}", out: true},
+		{in: "${{ !env.SOMETHING_TRUE }}", out: false},
+		{in: "${{ !env.SOMETHING_FALSE }}", out: false},
+		{in: "${{ !env.SOMETHING_TRUE && true }}", out: false},
+		{in: "${{ !env.SOMETHING_FALSE && true }}", out: false},
+		{in: "${{ !env.SOMETHING_TRUE || true }}", out: true},
+		{in: "${{ !env.SOMETHING_FALSE || false }}", out: false},
+		{in: "${{ env.SOMETHING_TRUE && true }}", out: true},
+		{in: "${{ env.SOMETHING_FALSE || true }}", out: true},
+		{in: "${{ env.SOMETHING_FALSE || false }}", out: true},
+		// TODO: This does not throw an error, because the evaluator does not know if the expression is inside ${{ }} or not
+		// {in: "!env.SOMETHING_TRUE || true", wantErr: true},
+		{in: "${{ env.SOMETHING_TRUE == 'true'}}", out: true},
+		{in: "${{ env.SOMETHING_FALSE == 'true'}}", out: false},
+		{in: "${{ env.SOMETHING_FALSE == 'false'}}", out: true},
+		{in: "${{ env.SOMETHING_FALSE }} && ${{ env.SOMETHING_TRUE }}", out: true},
+
+		// All together now
+		{in: "false || env.SOMETHING_TRUE == 'true'", out: true},
+		{in: "true || env.SOMETHING_FALSE == 'true'", out: true},
+		{in: "true && env.SOMETHING_TRUE == 'true'", out: true},
+		{in: "false && env.SOMETHING_TRUE == 'true'", out: false},
+		{in: "env.SOMETHING_FALSE == 'true' && env.SOMETHING_TRUE == 'true'", out: false},
+		{in: "env.SOMETHING_FALSE == 'true' && true", out: false},
+		{in: "${{ env.SOMETHING_FALSE == 'true' }} && true", out: true},
+		{in: "true && ${{ env.SOMETHING_FALSE == 'true' }}", out: true},
+		// Check github context
+		{in: "github.actor == 'nektos/act'", out: true},
+		{in: "github.actor == 'unknown'", out: false},
+		{in: "github.job == 'job1'", out: true},
+		// The special ACT flag
+		{in: "${{ env.ACT }}", out: true},
+		{in: "${{ !env.ACT }}", out: false},
+		// Invalid expressions should be reported
+		{in: "INVALID_EXPRESSION", wantErr: true},
+	}
+
+	for _, table := range tables {
+		t.Run(table.in, func(t *testing.T) {
+			assertObject := assert.New(t)
+			b, err := EvalBool(context.Background(), rc.ExprEval, table.in, exprparser.DefaultStatusCheckSuccess)
+			if table.wantErr {
+				assertObject.Error(err) //nolint:testifylint // pre-existing issue from nektos/act
+			}
+
+			assertObject.Equal(table.out, b, fmt.Sprintf("Expected %s to be %v, was %v", table.in, table.out, b)) //nolint:testifylint // pre-existing issue from nektos/act
+		})
+	}
+}
+
+func TestRunContext_GetBindsAndMounts(t *testing.T) {
+	rctemplate := &RunContext{
+		Name: "TestRCName",
+		Run: &model.Run{
+			Workflow: &model.Workflow{
+				Name: "TestWorkflowName",
+			},
+		},
+		Config: &Config{
+			BindWorkdir: false,
+		},
+	}
+
+	tests := []struct {
+		windowsPath bool
+		name        string
+		rc          *RunContext
+		wantbind    string
+		wantmount   string
+	}{
+		{false, "/mnt/linux", rctemplate, "/mnt/linux", "/mnt/linux"},
+		{false, "/mnt/path with spaces/linux", rctemplate, "/mnt/path with spaces/linux", "/mnt/path with spaces/linux"},
+		{true, "C:\\Users\\TestPath\\MyTestPath", rctemplate, "/mnt/c/Users/TestPath/MyTestPath", "/mnt/c/Users/TestPath/MyTestPath"},
+		{true, "C:\\Users\\Test Path with Spaces\\MyTestPath", rctemplate, "/mnt/c/Users/Test Path with Spaces/MyTestPath", "/mnt/c/Users/Test Path with Spaces/MyTestPath"},
+		{true, "/LinuxPathOnWindowsShouldFail", rctemplate, "", ""},
+	}
+
+	isWindows := runtime.GOOS == "windows"
+
+	for _, testcase := range tests {
+		// pin for scopelint
+		for _, bindWorkDir := range []bool{true, false} {
+			// pin for scopelint
+			testBindSuffix := ""
+			if bindWorkDir {
+				testBindSuffix = "Bind"
+			}
+
+			// Only run windows path tests on windows and non-windows on non-windows
+			if (isWindows && testcase.windowsPath) || (!isWindows && !testcase.windowsPath) {
+				t.Run((testcase.name + testBindSuffix), func(t *testing.T) {
+					config := testcase.rc.Config
+					config.Workdir = testcase.name
+					config.BindWorkdir = bindWorkDir
+					gotbind, gotmount := rctemplate.GetBindsAndMounts()
+
+					// Name binds/mounts are either/or
+					if config.BindWorkdir {
+						fullBind := testcase.name + ":" + testcase.wantbind
+						if runtime.GOOS == "darwin" {
+							fullBind += ":delegated"
+						}
+						assert.Contains(t, gotbind, fullBind)
+					} else {
+						mountkey := testcase.rc.jobContainerName()
+						assert.EqualValues(t, testcase.wantmount, gotmount[mountkey]) //nolint:testifylint // pre-existing issue from nektos/act
+					}
+				})
+			}
+		}
+	}
+
+	t.Run("ContainerVolumeMountTest", func(t *testing.T) {
+		tests := []struct {
+			name      string
+			volumes   []string
+			wantbind  string
+			wantmount map[string]string
+		}{
+			{"BindAnonymousVolume", []string{"/volume"}, "/volume", map[string]string{}},
+			{"BindHostFile", []string{"/path/to/file/on/host:/volume"}, "/path/to/file/on/host:/volume", map[string]string{}},
+			{"MountExistingVolume", []string{"volume-id:/volume"}, "", map[string]string{"volume-id": "/volume"}},
+		}
+
+		for _, testcase := range tests {
+			t.Run(testcase.name, func(t *testing.T) {
+				job := &model.Job{}
+				err := job.RawContainer.Encode(map[string][]string{
+					"volumes": testcase.volumes,
+				})
+				assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+				rc := &RunContext{
+					Name: "TestRCName",
+					Run: &model.Run{
+						Workflow: &model.Workflow{
+							Name: "TestWorkflowName",
+						},
+					},
+					Config: &Config{
+						BindWorkdir: false,
+					},
+				}
+				rc.Run.JobID = "job1"
+				rc.Run.Workflow.Jobs = map[string]*model.Job{"job1": job}
+
+				gotbind, gotmount := rc.GetBindsAndMounts()
+
+				if len(testcase.wantbind) > 0 {
+					assert.Contains(t, gotbind, testcase.wantbind)
+				}
+
+				for k, v := range testcase.wantmount {
+					assert.Contains(t, gotmount, k)
+					assert.Equal(t, gotmount[k], v)
+				}
+			})
+		}
+	})
+}
+
+func TestGetGitHubContext(t *testing.T) {
+	log.SetLevel(log.DebugLevel)
+
+	cwd, err := os.Getwd()
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	rc := &RunContext{
+		Config: &Config{
+			EventName: "push",
+			Workdir:   cwd,
+			Env: map[string]string{
+				"GITHUB_REPOSITORY": "nektos/act",
+			},
+		},
+		Run: &model.Run{
+			Workflow: &model.Workflow{
+				Name: "GitHubContextTest",
+			},
+		},
+		Name:           "GitHubContextTest",
+		CurrentStep:    "step",
+		Matrix:         map[string]any{},
+		Env:            map[string]string{},
+		ExtraPath:      []string{},
+		StepResults:    map[string]*model.StepResult{},
+		OutputMappings: map[MappableOutput]MappableOutput{},
+	}
+	rc.Run.JobID = "job1"
+
+	ghc := rc.getGithubContext(context.Background())
+
+	log.Debugf("%v", ghc)
+
+	actor := "nektos/act"
+	if a := os.Getenv("ACT_ACTOR"); a != "" {
+		actor = a
+	}
+
+	repo := "nektos/act"
+	if r := os.Getenv("ACT_REPOSITORY"); r != "" {
+		repo = r
+	}
+
+	owner := "nektos"
+	if o := os.Getenv("ACT_OWNER"); o != "" {
+		owner = o
+	}
+
+	assert.Equal(t, ghc.RunID, "1")         //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, ghc.RunNumber, "1")     //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, ghc.RetentionDays, "0") //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, ghc.Actor, actor)
+	assert.Equal(t, ghc.Repository, repo)
+	assert.Equal(t, ghc.RepositoryOwner, owner)
+	assert.Equal(t, ghc.RunnerPerflog, "/dev/null") //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, ghc.Token, rc.Config.Secrets["GITHUB_TOKEN"])
+	assert.Equal(t, ghc.Job, "job1") //nolint:testifylint // pre-existing issue from nektos/act
+}
+
+func TestGetGithubContextRef(t *testing.T) {
+	table := []struct {
+		event string
+		json  string
+		ref   string
+	}{
+		{event: "push", json: `{"ref":"0000000000000000000000000000000000000000"}`, ref: "0000000000000000000000000000000000000000"},
+		{event: "create", json: `{"ref":"0000000000000000000000000000000000000000"}`, ref: "0000000000000000000000000000000000000000"},
+		{event: "workflow_dispatch", json: `{"ref":"0000000000000000000000000000000000000000"}`, ref: "0000000000000000000000000000000000000000"},
+		{event: "delete", json: `{"repository":{"default_branch": "main"}}`, ref: "refs/heads/main"},
+		{event: "pull_request", json: `{"number":123}`, ref: "refs/pull/123/merge"},
+		{event: "pull_request_review", json: `{"number":123}`, ref: "refs/pull/123/merge"},
+		{event: "pull_request_review_comment", json: `{"number":123}`, ref: "refs/pull/123/merge"},
+		{event: "pull_request_target", json: `{"pull_request":{"base":{"ref": "main"}}}`, ref: "refs/heads/main"},
+		{event: "deployment", json: `{"deployment": {"ref": "tag-name"}}`, ref: "tag-name"},
+		{event: "deployment_status", json: `{"deployment": {"ref": "tag-name"}}`, ref: "tag-name"},
+		{event: "release", json: `{"release": {"tag_name": "tag-name"}}`, ref: "refs/tags/tag-name"},
+	}
+
+	for _, data := range table {
+		t.Run(data.event, func(t *testing.T) {
+			rc := &RunContext{
+				EventJSON: data.json,
+				Config: &Config{
+					EventName: data.event,
+					Workdir:   "",
+				},
+				Run: &model.Run{
+					Workflow: &model.Workflow{
+						Name: "GitHubContextTest",
+					},
+				},
+			}
+
+			ghc := rc.getGithubContext(context.Background())
+
+			assert.Equal(t, data.ref, ghc.Ref)
+		})
+	}
+}
+
+func createIfTestRunContext(jobs map[string]*model.Job) *RunContext {
+	rc := &RunContext{
+		Config: &Config{
+			Workdir: ".",
+			Platforms: map[string]string{
+				"ubuntu-latest": "ubuntu-latest",
+			},
+		},
+		Env: map[string]string{},
+		Run: &model.Run{
+			JobID: "job1",
+			Workflow: &model.Workflow{
+				Name: "test-workflow",
+				Jobs: jobs,
+			},
+		},
+	}
+	rc.ExprEval = rc.NewExpressionEvaluator(context.Background())
+
+	return rc
+}
+
+func createJob(t *testing.T, input, result string) *model.Job {
+	var job *model.Job
+	err := yaml.Unmarshal([]byte(input), &job)
+	assert.NoError(t, err)
+	job.Result = result
+
+	return job
+}
+
+func TestRunContextRunsOnPlatformNames(t *testing.T) {
+	log.SetLevel(log.DebugLevel)
+	assertObject := assert.New(t)
+
+	rc := createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
+	})
+	assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ${{ 'ubuntu-latest' }}`, ""),
+	})
+	assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: [self-hosted, my-runner]`, ""),
+	})
+	assertObject.Equal([]string{"self-hosted", "my-runner"}, rc.runsOnPlatformNames(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: [self-hosted, "${{ 'my-runner' }}"]`, ""),
+	})
+	assertObject.Equal([]string{"self-hosted", "my-runner"}, rc.runsOnPlatformNames(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ${{ fromJSON('["ubuntu-latest"]') }}`, ""),
+	})
+	assertObject.Equal([]string{"ubuntu-latest"}, rc.runsOnPlatformNames(context.Background()))
+
+	// test missing / invalid runs-on
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `name: something`, ""),
+	})
+	assertObject.Equal([]string{}, rc.runsOnPlatformNames(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on:
+  mapping: value`, ""),
+	})
+	assertObject.Equal([]string{}, rc.runsOnPlatformNames(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ${{ invalid expression }}`, ""),
+	})
+	assertObject.Equal([]string{}, rc.runsOnPlatformNames(context.Background()))
+}
+
+func TestRunContextIsEnabled(t *testing.T) {
+	log.SetLevel(log.DebugLevel)
+	assertObject := assert.New(t)
+
+	// success()
+	rc := createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest
+if: success()`, ""),
+	})
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "failure"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+needs: [job1]
+if: success()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.False(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "success"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+needs: [job1]
+if: success()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "failure"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+if: success()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	// failure()
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest
+if: failure()`, ""),
+	})
+	assertObject.False(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "failure"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+needs: [job1]
+if: failure()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "success"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+needs: [job1]
+if: failure()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.False(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "failure"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+if: failure()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.False(rc.isEnabled(context.Background()))
+
+	// always()
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest
+if: always()`, ""),
+	})
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "failure"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+needs: [job1]
+if: always()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "success"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+needs: [job1]
+if: always()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `runs-on: ubuntu-latest`, "success"),
+		"job2": createJob(t, `runs-on: ubuntu-latest
+if: always()`, ""),
+	})
+	rc.Run.JobID = "job2"
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `uses: ./.github/workflows/reusable.yml`, ""),
+	})
+	assertObject.True(rc.isEnabled(context.Background()))
+
+	rc = createIfTestRunContext(map[string]*model.Job{
+		"job1": createJob(t, `uses: ./.github/workflows/reusable.yml
+if: false`, ""),
+	})
+	assertObject.False(rc.isEnabled(context.Background()))
+}
+
+func TestRunContextGetEnv(t *testing.T) {
+	tests := []struct {
+		description string
+		rc          *RunContext
+		targetEnv   string
+		want        string
+	}{
+		{
+			description: "Env from Config should overwrite",
+			rc: &RunContext{
+				Config: &Config{
+					Env: map[string]string{"OVERWRITTEN": "true"},
+				},
+				Run: &model.Run{
+					Workflow: &model.Workflow{
+						Jobs: map[string]*model.Job{"test": {Name: "test"}},
+						Env:  map[string]string{"OVERWRITTEN": "false"},
+					},
+					JobID: "test",
+				},
+			},
+			targetEnv: "OVERWRITTEN",
+			want:      "true",
+		},
+		{
+			description: "No overwrite occurs",
+			rc: &RunContext{
+				Config: &Config{
+					Env: map[string]string{"SOME_OTHER_VAR": "true"},
+				},
+				Run: &model.Run{
+					Workflow: &model.Workflow{
+						Jobs: map[string]*model.Job{"test": {Name: "test"}},
+						Env:  map[string]string{"OVERWRITTEN": "false"},
+					},
+					JobID: "test",
+				},
+			},
+			targetEnv: "OVERWRITTEN",
+			want:      "false",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			envMap := test.rc.GetEnv()
+			assert.EqualValues(t, test.want, envMap[test.targetEnv]) //nolint:testifylint // pre-existing issue from nektos/act
+		})
+	}
+}
+
+func Test_createSimpleContainerName(t *testing.T) {
+	tests := []struct {
+		parts []string
+		want  string
+	}{
+		{
+			parts: []string{"a--a", "BB正", "c-C"},
+			want:  "a-a_BB_c-C",
+		},
+		{
+			parts: []string{"a-a", "", "-"},
+			want:  "a-a",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(strings.Join(tt.parts, " "), func(t *testing.T) {
+			assert.Equalf(t, tt.want, createSimpleContainerName(tt.parts...), "createSimpleContainerName(%v)", tt.parts)
+		})
+	}
+}

act/runner/runner.go

@@ -0,0 +1,335 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"runtime"
+	"sync"
+	"time"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+
+	docker_container "github.com/docker/docker/api/types/container"
+	log "github.com/sirupsen/logrus"
+)
+
+// Runner provides capabilities to run GitHub actions
+type Runner interface {
+	NewPlanExecutor(plan *model.Plan) common.Executor
+}
+
+// Config contains the config for a new runner
+type Config struct {
+	Actor                              string                       // the user that triggered the event
+	Workdir                            string                       // path to working directory
+	ActionCacheDir                     string                       // path used for caching action contents
+	ActionOfflineMode                  bool                         // when offline, use caching action contents
+	BindWorkdir                        bool                         // bind the workdir to the job container
+	EventName                          string                       // name of event to run
+	EventPath                          string                       // path to JSON file to use for event.json in containers
+	DefaultBranch                      string                       // name of the main branch for this repository
+	ReuseContainers                    bool                         // reuse containers to maintain state
+	ForcePull                          bool                         // force pulling of the image, even if already present
+	ForceRebuild                       bool                         // force rebuilding local docker image action
+	LogOutput                          bool                         // log the output from docker run
+	JSONLogger                         bool                         // use json or text logger
+	LogPrefixJobID                     bool                         // switches from the full job name to the job id
+	Env                                map[string]string            // env for containers
+	Inputs                             map[string]string            // manually passed action inputs
+	Secrets                            map[string]string            // list of secrets
+	Vars                               map[string]string            // list of vars
+	Token                              string                       // GitHub token
+	InsecureSecrets                    bool                         // switch hiding output when printing to terminal
+	Platforms                          map[string]string            // list of platforms
+	Privileged                         bool                         // use privileged mode
+	UsernsMode                         string                       // user namespace to use
+	ContainerArchitecture              string                       // Desired OS/architecture platform for running containers
+	ContainerDaemonSocket              string                       // Path to Docker daemon socket
+	ContainerOptions                   string                       // Options for the job container
+	UseGitIgnore                       bool                         // controls if paths in .gitignore should not be copied into container, default true
+	GitHubInstance                     string                       // GitHub instance to use, default "github.com"
+	ContainerCapAdd                    []string                     // list of kernel capabilities to add to the containers
+	ContainerCapDrop                   []string                     // list of kernel capabilities to remove from the containers
+	AutoRemove                         bool                         // controls if the container is automatically removed upon workflow completion
+	ArtifactServerPath                 string                       // the path where the artifact server stores uploads
+	ArtifactServerAddr                 string                       // the address the artifact server binds to
+	ArtifactServerPort                 string                       // the port the artifact server binds to
+	NoSkipCheckout                     bool                         // do not skip actions/checkout
+	RemoteName                         string                       // remote name in local git repo config
+	ReplaceGheActionWithGithubCom      []string                     // Use actions from GitHub Enterprise instance to GitHub
+	ReplaceGheActionTokenWithGithubCom string                       // Token of private action repo on GitHub.
+	Matrix                             map[string]map[string]bool   // Matrix config to run
+	ContainerNetworkMode               docker_container.NetworkMode // the network mode of job containers (the value of --network)
+	ActionCache                        ActionCache                  // Use a custom ActionCache Implementation
+
+	PresetGitHubContext   *model.GithubContext         // the preset github context, overrides some fields like DefaultBranch, Env, Secrets etc.
+	EventJSON             string                       // the content of JSON file to use for event.json in containers, overrides EventPath
+	ContainerNamePrefix   string                       // the prefix of container name
+	ContainerMaxLifetime  time.Duration                // the max lifetime of job containers
+	DefaultActionInstance string                       // the default actions web site
+	PlatformPicker        func(labels []string) string // platform picker, it will take precedence over Platforms if isn't nil
+	JobLoggerLevel        *log.Level                   // the level of job logger
+	ValidVolumes          []string                     // only volumes (and bind mounts) in this slice can be mounted on the job container or service containers
+	InsecureSkipTLS       bool                         // whether to skip verifying TLS certificate of the Gitea instance
+	MaxParallel           int                          // max parallel jobs to run across all workflows (0 = no limit, uses CPU count)
+}
+
+// GetToken: Adapt to Gitea
+func (c Config) GetToken() string {
+	token := c.Secrets["GITHUB_TOKEN"]
+	if c.Secrets["GITEA_TOKEN"] != "" {
+		token = c.Secrets["GITEA_TOKEN"]
+	}
+	return token
+}
+
+type caller struct {
+	runContext *RunContext
+
+	updateResultLock         sync.Mutex        // For Gitea
+	reusedWorkflowJobResults map[string]string // For Gitea
+}
+
+type runnerImpl struct {
+	config    *Config
+	eventJSON string
+	caller    *caller // the job calling this runner (caller of a reusable workflow)
+}
+
+// New Creates a new Runner
+func New(runnerConfig *Config) (Runner, error) {
+	runner := &runnerImpl{
+		config: runnerConfig,
+	}
+
+	return runner.configure()
+}
+
+func (runner *runnerImpl) configure() (Runner, error) {
+	runner.eventJSON = "{}"
+	if runner.config.EventJSON != "" {
+		runner.eventJSON = runner.config.EventJSON
+	} else if runner.config.EventPath != "" {
+		log.Debugf("Reading event.json from %s", runner.config.EventPath)
+		eventJSONBytes, err := os.ReadFile(runner.config.EventPath)
+		if err != nil {
+			return nil, err
+		}
+		runner.eventJSON = string(eventJSONBytes)
+	} else if len(runner.config.Inputs) != 0 {
+		eventMap := map[string]map[string]string{
+			"inputs": runner.config.Inputs,
+		}
+		eventJSON, err := json.Marshal(eventMap)
+		if err != nil {
+			return nil, err
+		}
+		runner.eventJSON = string(eventJSON)
+	}
+	return runner, nil
+}
+
+// NewPlanExecutor ...
+//
+//nolint:gocyclo // function handles many cases
+func (runner *runnerImpl) NewPlanExecutor(plan *model.Plan) common.Executor {
+	maxJobNameLen := 0
+
+	stagePipeline := make([]common.Executor, 0)
+	log.Debugf("Plan Stages: %v", plan.Stages)
+
+	for i := range plan.Stages {
+		stage := plan.Stages[i]
+		stagePipeline = append(stagePipeline, func(ctx context.Context) error {
+			pipeline := make([]common.Executor, 0)
+			for _, run := range stage.Runs {
+				log.Debugf("Stages Runs: %v", stage.Runs)
+				stageExecutor := make([]common.Executor, 0)
+				job := run.Job()
+				log.Debugf("Job.Name: %v", job.Name)
+				log.Debugf("Job.RawNeeds: %v", job.RawNeeds)
+				log.Debugf("Job.RawRunsOn: %v", job.RawRunsOn)
+				log.Debugf("Job.Env: %v", job.Env)
+				log.Debugf("Job.If: %v", job.If)
+				for step := range job.Steps {
+					if nil != job.Steps[step] {
+						log.Debugf("Job.Steps: %v", job.Steps[step].String())
+					}
+				}
+				log.Debugf("Job.TimeoutMinutes: %v", job.TimeoutMinutes)
+				log.Debugf("Job.Services: %v", job.Services)
+				log.Debugf("Job.Strategy: %v", job.Strategy)
+				log.Debugf("Job.RawContainer: %v", job.RawContainer)
+				log.Debugf("Job.Defaults.Run.Shell: %v", job.Defaults.Run.Shell)
+				log.Debugf("Job.Defaults.Run.WorkingDirectory: %v", job.Defaults.Run.WorkingDirectory)
+				log.Debugf("Job.Outputs: %v", job.Outputs)
+				log.Debugf("Job.Uses: %v", job.Uses)
+				log.Debugf("Job.With: %v", job.With)
+				// log.Debugf("Job.RawSecrets: %v", job.RawSecrets)
+				log.Debugf("Job.Result: %v", job.Result)
+
+				if job.Strategy != nil {
+					log.Debugf("Job.Strategy.FailFast: %v", job.Strategy.FailFast)
+					log.Debugf("Job.Strategy.MaxParallel: %v", job.Strategy.MaxParallel)
+					log.Debugf("Job.Strategy.FailFastString: %v", job.Strategy.FailFastString)
+					log.Debugf("Job.Strategy.MaxParallelString: %v", job.Strategy.MaxParallelString)
+					log.Debugf("Job.Strategy.RawMatrix: %v", job.Strategy.RawMatrix)
+
+					strategyRc := runner.newRunContext(ctx, run, nil)
+					// Resolve template expressions in the matrix node before Matrix() is called.
+					// On failure the literal string is kept and normalizeMatrixValue wraps it as a fallback.
+					if err := strategyRc.NewExpressionEvaluator(ctx).EvaluateYamlNode(ctx, &job.Strategy.RawMatrix); err != nil {
+						log.Errorf("Error while evaluating matrix: %v", err)
+					}
+				}
+
+				var matrixes []map[string]any
+				if m, err := job.GetMatrixes(); err != nil {
+					log.Errorf("Error while get job's matrix: %v", err)
+				} else {
+					log.Debugf("Job Matrices: %v", m)
+					log.Debugf("Runner Matrices: %v", runner.config.Matrix)
+					matrixes = selectMatrixes(m, runner.config.Matrix)
+				}
+				log.Debugf("Final matrix after applying user inclusions '%v'", matrixes)
+
+				maxParallel := 4
+				if job.Strategy != nil {
+					// Ensure GetMaxParallel() is called if MaxParallel is still 0
+					if job.Strategy.MaxParallel == 0 {
+						job.Strategy.MaxParallel = job.Strategy.GetMaxParallel()
+					}
+					maxParallel = job.Strategy.MaxParallel
+					log.Debugf("Using job.Strategy.MaxParallel: %d", maxParallel)
+				}
+
+				if len(matrixes) < maxParallel {
+					log.Debugf("Adjusting maxParallel from %d to %d (number of matrix combinations)", maxParallel, len(matrixes))
+					maxParallel = len(matrixes)
+				}
+
+				log.Infof("Running job with maxParallel=%d for %d matrix combinations", maxParallel, len(matrixes))
+
+				for i, matrix := range matrixes {
+					rc := runner.newRunContext(ctx, run, matrix)
+					rc.JobName = rc.Name
+					if len(matrixes) > 1 {
+						rc.Name = fmt.Sprintf("%s-%d", rc.Name, i+1)
+					}
+					if len(rc.String()) > maxJobNameLen {
+						maxJobNameLen = len(rc.String())
+					}
+					if rc.caller != nil { // For Gitea
+						rc.caller.setReusedWorkflowJobResult(rc.JobName, "pending")
+					}
+					stageExecutor = append(stageExecutor, func(ctx context.Context) error {
+						jobName := fmt.Sprintf("%-*s", maxJobNameLen, rc.String())
+						executor, err := rc.Executor()
+						if err != nil {
+							return err
+						}
+
+						return executor(common.WithJobErrorContainer(WithJobLogger(ctx, rc.Run.JobID, jobName, rc.Config, &rc.Masks, matrix)))
+					})
+				}
+				pipeline = append(pipeline, common.NewParallelExecutor(maxParallel, stageExecutor...))
+			}
+
+			// For pipeline execution:
+			// - If only 1 element: run it directly (no need for additional parallelization)
+			// - If multiple elements: run them in parallel up to maxParallel or ncpu
+			if len(pipeline) == 0 {
+				return nil
+			}
+
+			if len(pipeline) == 1 {
+				// Single run/job: execute directly without additional parallelization wrapper
+				// This ensures max-parallel is the only limiting factor
+				log.Debugf("Single pipeline element, executing directly")
+				return pipeline[0](ctx)
+			}
+
+			// Multiple runs/jobs: execute in parallel up to maxParallel (if set) or ncpu
+			parallelism := runtime.NumCPU()
+
+			// If MaxParallel is set in config, use it
+			if runner.config.MaxParallel > 0 {
+				parallelism = runner.config.MaxParallel
+				log.Debugf("Using configured max-parallel: %d", parallelism)
+			} else {
+				log.Debugf("Using CPU count for parallelism: %d", parallelism)
+			}
+
+			// Don't exceed the number of pipeline elements
+			if parallelism > len(pipeline) {
+				parallelism = len(pipeline)
+			}
+
+			log.Infof("Executing %d pipeline elements with parallelism %d", len(pipeline), parallelism)
+			return common.NewParallelExecutor(parallelism, pipeline...)(ctx)
+		})
+	}
+
+	return common.NewPipelineExecutor(stagePipeline...).Then(handleFailure(plan))
+}
+
+func handleFailure(plan *model.Plan) common.Executor {
+	return func(ctx context.Context) error {
+		for _, stage := range plan.Stages {
+			for _, run := range stage.Runs {
+				if run.Job().Result == "failure" {
+					return fmt.Errorf("Job '%s' failed", run.String())
+				}
+			}
+		}
+		return nil
+	}
+}
+
+func selectMatrixes(originalMatrixes []map[string]any, targetMatrixValues map[string]map[string]bool) []map[string]any {
+	matrixes := make([]map[string]any, 0)
+	for _, original := range originalMatrixes {
+		flag := true
+		for key, val := range original {
+			if allowedVals, ok := targetMatrixValues[key]; ok {
+				valToString := fmt.Sprintf("%v", val)
+				if _, ok := allowedVals[valToString]; !ok {
+					flag = false
+				}
+			}
+		}
+		if flag {
+			matrixes = append(matrixes, original)
+		}
+	}
+	return matrixes
+}
+
+func (runner *runnerImpl) newRunContext(ctx context.Context, run *model.Run, matrix map[string]any) *RunContext {
+	rc := &RunContext{
+		Config:      runner.config,
+		Run:         run,
+		EventJSON:   runner.eventJSON,
+		StepResults: make(map[string]*model.StepResult),
+		Matrix:      matrix,
+		caller:      runner.caller,
+	}
+	rc.ExprEval = rc.NewExpressionEvaluator(ctx)
+	rc.Name = rc.ExprEval.Interpolate(ctx, run.String())
+
+	return rc
+}
+
+// For Gitea
+func (c *caller) setReusedWorkflowJobResult(jobName, result string) {
+	c.updateResultLock.Lock()
+	defer c.updateResultLock.Unlock()
+	c.reusedWorkflowJobResults[jobName] = result
+}

act/runner/runner_max_parallel_test.go

@@ -0,0 +1,109 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestMaxParallelConfig tests that MaxParallel config is properly set
+func TestMaxParallelConfig(t *testing.T) {
+	t.Run("MaxParallel set to 2", func(t *testing.T) {
+		config := &Config{
+			Workdir:     "testdata",
+			MaxParallel: 2,
+		}
+
+		runner, err := New(config)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+		assert.NotNil(t, runner)
+
+		// Verify config is properly stored
+		runnerImpl, ok := runner.(*runnerImpl)
+		assert.True(t, ok)
+		assert.Equal(t, 2, runnerImpl.config.MaxParallel)
+	})
+
+	t.Run("MaxParallel set to 0 (no limit)", func(t *testing.T) {
+		config := &Config{
+			Workdir:     "testdata",
+			MaxParallel: 0,
+		}
+
+		runner, err := New(config)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+		assert.NotNil(t, runner)
+
+		runnerImpl, ok := runner.(*runnerImpl)
+		assert.True(t, ok)
+		assert.Equal(t, 0, runnerImpl.config.MaxParallel)
+	})
+
+	t.Run("MaxParallel not set (defaults to 0)", func(t *testing.T) {
+		config := &Config{
+			Workdir: "testdata",
+		}
+
+		runner, err := New(config)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+		assert.NotNil(t, runner)
+
+		runnerImpl, ok := runner.(*runnerImpl)
+		assert.True(t, ok)
+		assert.Equal(t, 0, runnerImpl.config.MaxParallel)
+	})
+}
+
+// TestMaxParallelConcurrencyTracking tests that max-parallel actually limits concurrent execution
+func TestMaxParallelConcurrencyTracking(t *testing.T) {
+	// This is a unit test for the parallel executor logic
+	// We test that when MaxParallel is set, it limits the number of workers
+
+	var mu sync.Mutex
+	var maxConcurrent int
+	var currentConcurrent int
+
+	// Create a function that tracks concurrent execution
+	trackingFunc := func() {
+		mu.Lock()
+		currentConcurrent++
+		if currentConcurrent > maxConcurrent {
+			maxConcurrent = currentConcurrent
+		}
+		mu.Unlock()
+
+		// Simulate work
+		time.Sleep(50 * time.Millisecond)
+
+		mu.Lock()
+		currentConcurrent--
+		mu.Unlock()
+	}
+
+	// Run multiple tasks with limited parallelism
+	maxConcurrent = 0
+	currentConcurrent = 0
+
+	// This simulates what NewParallelExecutor does with a semaphore
+	var wg sync.WaitGroup
+	semaphore := make(chan struct{}, 2) // Limit to 2 concurrent
+
+	for range 6 {
+		wg.Go(func() {
+			semaphore <- struct{}{}        // Acquire
+			defer func() { <-semaphore }() // Release
+			trackingFunc()
+		})
+	}
+
+	wg.Wait()
+
+	// With a semaphore of 2, max concurrent should be <= 2
+	assert.LessOrEqual(t, maxConcurrent, 2, "Maximum concurrent executions should not exceed limit")
+	assert.GreaterOrEqual(t, maxConcurrent, 1, "Should have at least 1 concurrent execution")
+}

act/runner/runner_test.go

@@ -0,0 +1,688 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/joho/godotenv"
+	log "github.com/sirupsen/logrus"
+	assert "github.com/stretchr/testify/assert"
+	"go.yaml.in/yaml/v4"
+)
+
+var (
+	baseImage = "node:16-buster-slim"
+	platforms map[string]string
+	logLevel  = log.DebugLevel
+	workdir   = "testdata"
+	secrets   map[string]string
+)
+
+func init() {
+	if p := os.Getenv("ACT_TEST_IMAGE"); p != "" {
+		baseImage = p
+	}
+
+	platforms = map[string]string{
+		"ubuntu-latest": baseImage,
+	}
+
+	if l := os.Getenv("ACT_TEST_LOG_LEVEL"); l != "" {
+		if lvl, err := log.ParseLevel(l); err == nil {
+			logLevel = lvl
+		}
+	}
+
+	if wd, err := filepath.Abs(workdir); err == nil {
+		workdir = wd
+	}
+
+	secrets = map[string]string{}
+}
+
+func TestNoWorkflowsFoundByPlanner(t *testing.T) {
+	planner, err := model.NewWorkflowPlanner("res", true)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	out := log.StandardLogger().Out
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	log.SetLevel(log.DebugLevel)
+	plan, err := planner.PlanEvent("pull_request")
+	assert.NotNil(t, plan)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Contains(t, buf.String(), "no workflows found by planner")
+	buf.Reset()
+	plan, err = planner.PlanAll()
+	assert.NotNil(t, plan)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Contains(t, buf.String(), "no workflows found by planner")
+	log.SetOutput(out)
+}
+
+func TestGraphMissingEvent(t *testing.T) {
+	planner, err := model.NewWorkflowPlanner("testdata/issue-1595/no-event.yml", true)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	out := log.StandardLogger().Out
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	log.SetLevel(log.DebugLevel)
+
+	plan, err := planner.PlanEvent("push")
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.NotNil(t, plan)
+	assert.Equal(t, 0, len(plan.Stages)) //nolint:testifylint // pre-existing issue from nektos/act
+
+	assert.Contains(t, buf.String(), "no events found for workflow: no-event.yml")
+	log.SetOutput(out)
+}
+
+func TestGraphMissingFirst(t *testing.T) {
+	planner, err := model.NewWorkflowPlanner("testdata/issue-1595/no-first.yml", true)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	plan, err := planner.PlanEvent("push")
+	assert.EqualError(t, err, "unable to build dependency graph for no first (no-first.yml)") //nolint:testifylint // pre-existing issue from nektos/act
+	assert.NotNil(t, plan)
+	assert.Equal(t, 0, len(plan.Stages)) //nolint:testifylint // pre-existing issue from nektos/act
+}
+
+func TestGraphWithMissing(t *testing.T) {
+	planner, err := model.NewWorkflowPlanner("testdata/issue-1595/missing.yml", true)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	out := log.StandardLogger().Out
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	log.SetLevel(log.DebugLevel)
+
+	plan, err := planner.PlanEvent("push")
+	assert.NotNil(t, plan)
+	assert.Equal(t, 0, len(plan.Stages))                                                    //nolint:testifylint // pre-existing issue from nektos/act
+	assert.EqualError(t, err, "unable to build dependency graph for missing (missing.yml)") //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Contains(t, buf.String(), "unable to build dependency graph for missing (missing.yml)")
+	log.SetOutput(out)
+}
+
+func TestGraphWithSomeMissing(t *testing.T) {
+	log.SetLevel(log.DebugLevel)
+
+	planner, err := model.NewWorkflowPlanner("testdata/issue-1595/", true)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	out := log.StandardLogger().Out
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	log.SetLevel(log.DebugLevel)
+
+	plan, err := planner.PlanAll()
+	assert.Error(t, err, "unable to build dependency graph for no first (no-first.yml)") //nolint:testifylint // pre-existing issue from nektos/act
+	assert.NotNil(t, plan)
+	assert.Equal(t, 1, len(plan.Stages)) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Contains(t, buf.String(), "unable to build dependency graph for missing (missing.yml)")
+	assert.Contains(t, buf.String(), "unable to build dependency graph for no first (no-first.yml)")
+	log.SetOutput(out)
+}
+
+func TestGraphEvent(t *testing.T) {
+	planner, err := model.NewWorkflowPlanner("testdata/basic", true)
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	plan, err := planner.PlanEvent("push")
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.NotNil(t, plan)
+	assert.NotNil(t, plan.Stages)
+	assert.Equal(t, len(plan.Stages), 3, "stages")                  //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, len(plan.Stages[0].Runs), 1, "stage0.runs")     //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, len(plan.Stages[1].Runs), 1, "stage1.runs")     //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, len(plan.Stages[2].Runs), 1, "stage2.runs")     //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, plan.Stages[0].Runs[0].JobID, "check", "jobid") //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, plan.Stages[1].Runs[0].JobID, "build", "jobid") //nolint:testifylint // pre-existing issue from nektos/act
+	assert.Equal(t, plan.Stages[2].Runs[0].JobID, "test", "jobid")  //nolint:testifylint // pre-existing issue from nektos/act
+
+	plan, err = planner.PlanEvent("release")
+	assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+	assert.NotNil(t, plan)
+	assert.Equal(t, 0, len(plan.Stages)) //nolint:testifylint // pre-existing issue from nektos/act
+}
+
+type TestJobFileInfo struct {
+	workdir      string
+	workflowPath string
+	eventName    string
+	errorMessage string
+	platforms    map[string]string
+	secrets      map[string]string
+}
+
+func (j *TestJobFileInfo) runTest(ctx context.Context, t *testing.T, cfg *Config) {
+	fmt.Printf("::group::%s\n", j.workflowPath) //nolint:forbidigo // pre-existing issue from nektos/act
+
+	log.SetLevel(logLevel)
+
+	workdir, err := filepath.Abs(j.workdir)
+	assert.Nil(t, err, workdir) //nolint:testifylint // pre-existing issue from nektos/act
+
+	fullWorkflowPath := filepath.Join(workdir, j.workflowPath)
+	runnerConfig := &Config{
+		Workdir:               workdir,
+		BindWorkdir:           false,
+		EventName:             j.eventName,
+		EventPath:             cfg.EventPath,
+		Platforms:             j.platforms,
+		ReuseContainers:       false,
+		Env:                   cfg.Env,
+		Secrets:               cfg.Secrets,
+		Inputs:                cfg.Inputs,
+		GitHubInstance:        "github.com",
+		ContainerArchitecture: cfg.ContainerArchitecture,
+		Matrix:                cfg.Matrix,
+		ActionCache:           cfg.ActionCache,
+	}
+
+	runner, err := New(runnerConfig)
+	assert.Nil(t, err, j.workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+
+	planner, err := model.NewWorkflowPlanner(fullWorkflowPath, true)
+	assert.Nil(t, err, fullWorkflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+
+	plan, err := planner.PlanEvent(j.eventName)
+	assert.True(t, (err == nil) != (plan == nil), "PlanEvent should return either a plan or an error") //nolint:testifylint // pre-existing issue from nektos/act
+	if err == nil && plan != nil {
+		err = runner.NewPlanExecutor(plan)(ctx)
+		if j.errorMessage == "" {
+			assert.Nil(t, err, fullWorkflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+		} else {
+			assert.Error(t, err, j.errorMessage) //nolint:testifylint // pre-existing issue from nektos/act
+		}
+	}
+
+	fmt.Println("::endgroup::") //nolint:forbidigo // pre-existing issue from nektos/act
+}
+
+type TestConfig struct {
+	LocalRepositories map[string]string `yaml:"local-repositories"`
+}
+
+func TestRunEvent(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	ctx := context.Background()
+
+	tables := []TestJobFileInfo{
+		// Shells
+		{workdir, "shells/defaults", "push", "", platforms, secrets},
+		// TODO: figure out why it fails
+		// {workdir, "shells/custom", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, }, // custom image with pwsh
+		{workdir, "shells/pwsh", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, secrets}, // custom image with pwsh
+		{workdir, "shells/bash", "push", "", platforms, secrets},
+		{workdir, "shells/python", "push", "", map[string]string{"ubuntu-latest": "node:16-buster"}, secrets}, // slim doesn't have python
+		{workdir, "shells/sh", "push", "", platforms, secrets},
+
+		// Local action
+		{workdir, "local-action-docker-url", "push", "", platforms, secrets},
+		{workdir, "local-action-dockerfile", "push", "", platforms, secrets},
+		{workdir, "local-action-via-composite-dockerfile", "push", "", platforms, secrets},
+		{workdir, "local-action-js", "push", "", platforms, secrets},
+
+		// Uses
+		{workdir, "uses-composite", "push", "", platforms, secrets},
+		{workdir, "uses-composite-with-error", "push", "Job 'failing-composite-action' failed", platforms, secrets},
+		{workdir, "uses-nested-composite", "push", "", platforms, secrets},
+		{workdir, "remote-action-composite-js-pre-with-defaults", "push", "", platforms, secrets},
+		{workdir, "remote-action-composite-action-ref", "push", "", platforms, secrets},
+		{workdir, "uses-workflow", "push", "", platforms, map[string]string{"secret": "keep_it_private"}},
+		{workdir, "uses-workflow", "pull_request", "", platforms, map[string]string{"secret": "keep_it_private"}},
+		{workdir, "uses-docker-url", "push", "", platforms, secrets},
+		{workdir, "act-composite-env-test", "push", "", platforms, secrets},
+
+		// Eval
+		{workdir, "evalmatrix", "push", "", platforms, secrets},
+		{workdir, "evalmatrixneeds", "push", "", platforms, secrets},
+		{workdir, "evalmatrixneeds2", "push", "", platforms, secrets},
+		{workdir, "evalmatrix-merge-map", "push", "", platforms, secrets},
+		{workdir, "evalmatrix-merge-array", "push", "", platforms, secrets},
+		{workdir, "issue-1195", "push", "", platforms, secrets},
+
+		{workdir, "basic", "push", "", platforms, secrets},
+		{workdir, "fail", "push", "exit with `FAILURE`: 1", platforms, secrets},
+		{workdir, "runs-on", "push", "", platforms, secrets},
+		{workdir, "checkout", "push", "", platforms, secrets},
+		{workdir, "job-container", "push", "", platforms, secrets},
+		{workdir, "job-container-non-root", "push", "", platforms, secrets},
+		{workdir, "job-container-invalid-credentials", "push", "failed to handle credentials: failed to interpolate container.credentials.password", platforms, secrets},
+		{workdir, "container-hostname", "push", "", platforms, secrets},
+		{workdir, "remote-action-docker", "push", "", platforms, secrets},
+		{workdir, "remote-action-js", "push", "", platforms, secrets},
+		{workdir, "remote-action-js-node-user", "push", "", platforms, secrets}, // Test if this works with non root container
+		{workdir, "matrix", "push", "", platforms, secrets},
+		{workdir, "matrix-include-exclude", "push", "", platforms, secrets},
+		{workdir, "matrix-exitcode", "push", "Job 'test' failed", platforms, secrets},
+		{workdir, "commands", "push", "", platforms, secrets},
+		{workdir, "workdir", "push", "", platforms, secrets},
+		{workdir, "defaults-run", "push", "", platforms, secrets},
+		{workdir, "composite-fail-with-output", "push", "", platforms, secrets},
+		{workdir, "issue-597", "push", "", platforms, secrets},
+		{workdir, "issue-598", "push", "", platforms, secrets},
+		{workdir, "if-env-act", "push", "", platforms, secrets},
+		{workdir, "env-and-path", "push", "", platforms, secrets},
+		{workdir, "environment-files", "push", "", platforms, secrets},
+		{workdir, "GITHUB_STATE", "push", "", platforms, secrets},
+		{workdir, "environment-files-parser-bug", "push", "", platforms, secrets},
+		{workdir, "non-existent-action", "push", "Job 'nopanic' failed", platforms, secrets},
+		{workdir, "outputs", "push", "", platforms, secrets},
+		{workdir, "networking", "push", "", platforms, secrets},
+		{workdir, "steps-context/conclusion", "push", "", platforms, secrets},
+		{workdir, "steps-context/outcome", "push", "", platforms, secrets},
+		{workdir, "job-status-check", "push", "job 'fail' failed", platforms, secrets},
+		{workdir, "if-expressions", "push", "Job 'mytest' failed", platforms, secrets},
+		{workdir, "actions-environment-and-context-tests", "push", "", platforms, secrets},
+		{workdir, "uses-action-with-pre-and-post-step", "push", "", platforms, secrets},
+		{workdir, "evalenv", "push", "", platforms, secrets},
+		{workdir, "docker-action-custom-path", "push", "", platforms, secrets},
+		{workdir, "GITHUB_ENV-use-in-env-ctx", "push", "", platforms, secrets},
+		{workdir, "ensure-post-steps", "push", "Job 'second-post-step-should-fail' failed", platforms, secrets},
+		{workdir, "workflow_call_inputs", "workflow_call", "", platforms, secrets},
+		{workdir, "workflow_dispatch", "workflow_dispatch", "", platforms, secrets},
+		{workdir, "workflow_dispatch_no_inputs_mapping", "workflow_dispatch", "", platforms, secrets},
+		{workdir, "workflow_dispatch-scalar", "workflow_dispatch", "", platforms, secrets},
+		{workdir, "workflow_dispatch-scalar-composite-action", "workflow_dispatch", "", platforms, secrets},
+		{workdir, "job-needs-context-contains-result", "push", "", platforms, secrets},
+		{"../model/testdata", "strategy", "push", "", platforms, secrets}, // TODO: move all testdata into pkg so we can validate it with planner and runner
+		{"../model/testdata", "container-volumes", "push", "", platforms, secrets},
+		{workdir, "path-handling", "push", "", platforms, secrets},
+		{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
+		{workdir, "set-env-step-env-override", "push", "", platforms, secrets},
+		{workdir, "set-env-new-env-file-per-step", "push", "", platforms, secrets},
+		{workdir, "no-panic-on-invalid-composite-action", "push", "jobs failed due to invalid action", platforms, secrets},
+
+		// services
+		{workdir, "services", "push", "", platforms, secrets},
+		{workdir, "services-host-network", "push", "", platforms, secrets},
+		{workdir, "services-with-container", "push", "", platforms, secrets},
+
+		// local remote action overrides
+		{workdir, "local-remote-action-overrides", "push", "", platforms, secrets},
+	}
+
+	for _, table := range tables {
+		t.Run(table.workflowPath, func(t *testing.T) {
+			config := &Config{
+				Secrets: table.secrets,
+			}
+
+			eventFile := filepath.Join(workdir, table.workflowPath, "event.json")
+			if _, err := os.Stat(eventFile); err == nil {
+				config.EventPath = eventFile
+			}
+
+			testConfigFile := filepath.Join(workdir, table.workflowPath, "config.yml")
+			if file, err := os.ReadFile(testConfigFile); err == nil {
+				testConfig := &TestConfig{}
+				if yaml.Unmarshal(file, testConfig) == nil {
+					if testConfig.LocalRepositories != nil {
+						config.ActionCache = &LocalRepositoryCache{
+							Parent: GoGitActionCache{
+								path.Clean(path.Join(workdir, "cache")),
+							},
+							LocalRepositories: testConfig.LocalRepositories,
+							CacheDirCache:     map[string]string{},
+						}
+					}
+				}
+			}
+
+			table.runTest(ctx, t, config)
+		})
+	}
+}
+
+func TestRunEventHostEnvironment(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	ctx := context.Background()
+
+	tables := []TestJobFileInfo{}
+
+	if runtime.GOOS == "linux" {
+		platforms := map[string]string{
+			"ubuntu-latest": "-self-hosted",
+		}
+
+		tables = append(tables, []TestJobFileInfo{
+			// Shells
+			{workdir, "shells/defaults", "push", "", platforms, secrets},
+			{workdir, "shells/pwsh", "push", "", platforms, secrets},
+			{workdir, "shells/bash", "push", "", platforms, secrets},
+			{workdir, "shells/python", "push", "", platforms, secrets},
+			{workdir, "shells/sh", "push", "", platforms, secrets},
+
+			// Local action
+			{workdir, "local-action-js", "push", "", platforms, secrets},
+
+			// Uses
+			{workdir, "uses-composite", "push", "", platforms, secrets},
+			{workdir, "uses-composite-with-error", "push", "Job 'failing-composite-action' failed", platforms, secrets},
+			{workdir, "uses-nested-composite", "push", "", platforms, secrets},
+			{workdir, "act-composite-env-test", "push", "", platforms, secrets},
+
+			// Eval
+			{workdir, "evalmatrix", "push", "", platforms, secrets},
+			{workdir, "evalmatrixneeds", "push", "", platforms, secrets},
+			{workdir, "evalmatrixneeds2", "push", "", platforms, secrets},
+			{workdir, "evalmatrix-merge-map", "push", "", platforms, secrets},
+			{workdir, "evalmatrix-merge-array", "push", "", platforms, secrets},
+			{workdir, "issue-1195", "push", "", platforms, secrets},
+
+			{workdir, "fail", "push", "exit with `FAILURE`: 1", platforms, secrets},
+			{workdir, "runs-on", "push", "", platforms, secrets},
+			{workdir, "checkout", "push", "", platforms, secrets},
+			{workdir, "remote-action-js", "push", "", platforms, secrets},
+			{workdir, "matrix", "push", "", platforms, secrets},
+			{workdir, "matrix-include-exclude", "push", "", platforms, secrets},
+			{workdir, "commands", "push", "", platforms, secrets},
+			{workdir, "defaults-run", "push", "", platforms, secrets},
+			{workdir, "composite-fail-with-output", "push", "", platforms, secrets},
+			{workdir, "issue-597", "push", "", platforms, secrets},
+			{workdir, "issue-598", "push", "", platforms, secrets},
+			{workdir, "if-env-act", "push", "", platforms, secrets},
+			{workdir, "env-and-path", "push", "", platforms, secrets},
+			{workdir, "non-existent-action", "push", "Job 'nopanic' failed", platforms, secrets},
+			{workdir, "outputs", "push", "", platforms, secrets},
+			{workdir, "steps-context/conclusion", "push", "", platforms, secrets},
+			{workdir, "steps-context/outcome", "push", "", platforms, secrets},
+			{workdir, "job-status-check", "push", "job 'fail' failed", platforms, secrets},
+			{workdir, "if-expressions", "push", "Job 'mytest' failed", platforms, secrets},
+			{workdir, "uses-action-with-pre-and-post-step", "push", "", platforms, secrets},
+			{workdir, "evalenv", "push", "", platforms, secrets},
+			{workdir, "ensure-post-steps", "push", "Job 'second-post-step-should-fail' failed", platforms, secrets},
+		}...)
+	}
+	if runtime.GOOS == "windows" {
+		platforms := map[string]string{
+			"windows-latest": "-self-hosted",
+		}
+
+		tables = append(tables, []TestJobFileInfo{
+			{workdir, "windows-prepend-path", "push", "", platforms, secrets},
+			{workdir, "windows-add-env", "push", "", platforms, secrets},
+			{workdir, "windows-shell-cmd", "push", "", platforms, secrets},
+		}...)
+	} else {
+		platforms := map[string]string{
+			"self-hosted":   "-self-hosted",
+			"ubuntu-latest": "-self-hosted",
+		}
+
+		tables = append(tables, []TestJobFileInfo{
+			{workdir, "nix-prepend-path", "push", "", platforms, secrets},
+			{workdir, "inputs-via-env-context", "push", "", platforms, secrets},
+			{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
+			{workdir, "set-env-step-env-override", "push", "", platforms, secrets},
+			{workdir, "set-env-new-env-file-per-step", "push", "", platforms, secrets},
+			{workdir, "no-panic-on-invalid-composite-action", "push", "jobs failed due to invalid action", platforms, secrets},
+		}...)
+	}
+
+	for _, table := range tables {
+		t.Run(table.workflowPath, func(t *testing.T) {
+			table.runTest(ctx, t, &Config{})
+		})
+	}
+}
+
+func TestDryrunEvent(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	ctx := common.WithDryrun(context.Background(), true)
+
+	tables := []TestJobFileInfo{
+		// Shells
+		{workdir, "shells/defaults", "push", "", platforms, secrets},
+		{workdir, "shells/pwsh", "push", "", map[string]string{"ubuntu-latest": "catthehacker/ubuntu:pwsh-latest"}, secrets}, // custom image with pwsh
+		{workdir, "shells/bash", "push", "", platforms, secrets},
+		{workdir, "shells/python", "push", "", map[string]string{"ubuntu-latest": "node:16-buster"}, secrets}, // slim doesn't have python
+		{workdir, "shells/sh", "push", "", platforms, secrets},
+
+		// Local action
+		{workdir, "local-action-docker-url", "push", "", platforms, secrets},
+		{workdir, "local-action-dockerfile", "push", "", platforms, secrets},
+		{workdir, "local-action-via-composite-dockerfile", "push", "", platforms, secrets},
+		{workdir, "local-action-js", "push", "", platforms, secrets},
+	}
+
+	for _, table := range tables {
+		t.Run(table.workflowPath, func(t *testing.T) {
+			table.runTest(ctx, t, &Config{})
+		})
+	}
+}
+
+func TestDockerActionForcePullForceRebuild(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	ctx := context.Background()
+
+	config := &Config{
+		ForcePull:    true,
+		ForceRebuild: true,
+	}
+
+	tables := []TestJobFileInfo{
+		{workdir, "local-action-dockerfile", "push", "", platforms, secrets},
+		{workdir, "local-action-via-composite-dockerfile", "push", "", platforms, secrets},
+	}
+
+	for _, table := range tables {
+		t.Run(table.workflowPath, func(t *testing.T) {
+			table.runTest(ctx, t, config)
+		})
+	}
+}
+
+func TestRunDifferentArchitecture(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: "basic",
+		eventName:    "push",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	tjfi.runTest(context.Background(), t, &Config{ContainerArchitecture: "linux/arm64"})
+}
+
+type maskJobLoggerFactory struct {
+	Output bytes.Buffer
+}
+
+func (f *maskJobLoggerFactory) WithJobLogger() *log.Logger {
+	logger := log.New()
+	logger.SetOutput(io.MultiWriter(&f.Output, os.Stdout))
+	logger.SetLevel(log.DebugLevel)
+	return logger
+}
+
+func TestMaskValues(t *testing.T) {
+	assertNoSecret := func(text, secret string) { //nolint:unparam // pre-existing issue from nektos/act
+		found := strings.Contains(text, "composite secret")
+		if found {
+			fmt.Printf("\nFound Secret in the given text:\n%s\n", text) //nolint:forbidigo // pre-existing issue from nektos/act
+		}
+		assert.False(t, strings.Contains(text, "composite secret")) //nolint:testifylint // pre-existing issue from nektos/act
+	}
+
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	log.SetLevel(log.DebugLevel)
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: "mask-values",
+		eventName:    "push",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	logger := &maskJobLoggerFactory{}
+	tjfi.runTest(WithJobLoggerFactory(common.WithLogger(context.Background(), logger.WithJobLogger()), logger), t, &Config{})
+	output := logger.Output.String()
+
+	assertNoSecret(output, "secret value")
+	assertNoSecret(output, "YWJjCg==")
+}
+
+func TestRunEventSecrets(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	workflowPath := "secrets"
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: workflowPath,
+		eventName:    "push",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	env, err := godotenv.Read(filepath.Join(workdir, workflowPath, ".env"))
+	assert.NoError(t, err, "Failed to read .env") //nolint:testifylint // pre-existing issue from nektos/act
+	secrets, _ := godotenv.Read(filepath.Join(workdir, workflowPath, ".secrets"))
+	assert.NoError(t, err, "Failed to read .secrets") //nolint:testifylint // pre-existing issue from nektos/act
+
+	tjfi.runTest(context.Background(), t, &Config{Secrets: secrets, Env: env})
+}
+
+func TestRunWithService(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	log.SetLevel(log.DebugLevel)
+	ctx := context.Background()
+
+	platforms := map[string]string{
+		"ubuntu-latest": "node:12.20.1-buster-slim",
+	}
+
+	workflowPath := "services"
+	eventName := "push"
+
+	workdir, err := filepath.Abs("testdata")
+	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+
+	runnerConfig := &Config{
+		Workdir:         workdir,
+		EventName:       eventName,
+		Platforms:       platforms,
+		ReuseContainers: false,
+	}
+	runner, err := New(runnerConfig)
+	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+
+	planner, err := model.NewWorkflowPlanner("testdata/"+workflowPath, true)
+	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+
+	plan, err := planner.PlanEvent(eventName)
+	assert.NoError(t, err, workflowPath) //nolint:testifylint // pre-existing issue from nektos/act
+
+	err = runner.NewPlanExecutor(plan)(ctx)
+	assert.NoError(t, err, workflowPath)
+}
+
+func TestRunActionInputs(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	workflowPath := "input-from-cli"
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: workflowPath,
+		eventName:    "workflow_dispatch",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	inputs := map[string]string{
+		"SOME_INPUT": "input",
+	}
+
+	tjfi.runTest(context.Background(), t, &Config{Inputs: inputs})
+}
+
+func TestRunEventPullRequest(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	workflowPath := "pull-request"
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: workflowPath,
+		eventName:    "pull_request",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	tjfi.runTest(context.Background(), t, &Config{EventPath: filepath.Join(workdir, workflowPath, "event.json")})
+}
+
+func TestRunMatrixWithUserDefinedInclusions(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	workflowPath := "matrix-with-user-inclusions"
+
+	tjfi := TestJobFileInfo{
+		workdir:      workdir,
+		workflowPath: workflowPath,
+		eventName:    "push",
+		errorMessage: "",
+		platforms:    platforms,
+	}
+
+	matrix := map[string]map[string]bool{
+		"node": {
+			"8":   true,
+			"8.x": true,
+		},
+		"os": {
+			"ubuntu-18.04": true,
+		},
+	}
+
+	tjfi.runTest(context.Background(), t, &Config{Matrix: matrix})
+}

act/runner/step.go

@@ -0,0 +1,335 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2020 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"fmt"
+	maps0 "maps"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/exprparser"
+	"gitea.com/gitea/act_runner/act/model"
+)
+
+type step interface {
+	pre() common.Executor
+	main() common.Executor
+	post() common.Executor
+
+	getRunContext() *RunContext
+	getGithubContext(ctx context.Context) *model.GithubContext
+	getStepModel() *model.Step
+	getEnv() *map[string]string
+	getIfExpression(context context.Context, stage stepStage) string
+}
+
+type stepStage int
+
+const (
+	stepStagePre stepStage = iota
+	stepStageMain
+	stepStagePost
+)
+
+// Controls how many symlinks are resolved for local and remote Actions
+const maxSymlinkDepth = 10
+
+func (s stepStage) String() string {
+	switch s {
+	case stepStagePre:
+		return "Pre"
+	case stepStageMain:
+		return "Main"
+	case stepStagePost:
+		return "Post"
+	}
+	return "Unknown"
+}
+
+func processRunnerEnvFileCommand(ctx context.Context, fileName string, rc *RunContext, setter func(context.Context, map[string]string, string)) error {
+	env := map[string]string{}
+	err := rc.JobContainer.UpdateFromEnv(path.Join(rc.JobContainer.GetActPath(), fileName), &env)(ctx)
+	if err != nil {
+		return err
+	}
+	for k, v := range env {
+		setter(ctx, map[string]string{"name": k}, v)
+	}
+	return nil
+}
+
+func runStepExecutor(step step, stage stepStage, executor common.Executor) common.Executor {
+	return func(ctx context.Context) error {
+		logger := common.Logger(ctx)
+		rc := step.getRunContext()
+		stepModel := step.getStepModel()
+
+		ifExpression := step.getIfExpression(ctx, stage)
+		rc.CurrentStep = stepModel.ID
+
+		stepResult := &model.StepResult{
+			Outcome:    model.StepStatusSuccess,
+			Conclusion: model.StepStatusSuccess,
+			Outputs:    make(map[string]string),
+		}
+		if stage == stepStageMain {
+			rc.StepResults[rc.CurrentStep] = stepResult
+		}
+
+		err := setupEnv(ctx, step)
+		if err != nil {
+			return err
+		}
+
+		runStep, err := isStepEnabled(ctx, ifExpression, step, stage)
+		if err != nil {
+			stepResult.Conclusion = model.StepStatusFailure
+			stepResult.Outcome = model.StepStatusFailure
+			return err
+		}
+
+		if !runStep {
+			stepResult.Conclusion = model.StepStatusSkipped
+			stepResult.Outcome = model.StepStatusSkipped
+			logger.WithField("stepResult", stepResult.Outcome).Debugf("Skipping step '%s' due to '%s'", stepModel, ifExpression)
+			return nil
+		}
+
+		stepString := rc.ExprEval.Interpolate(ctx, stepModel.String())
+		if strings.Contains(stepString, "::add-mask::") {
+			stepString = "add-mask command"
+		}
+		logger.Infof("\u2B50 Run %s %s", stage, stepString)
+
+		// Prepare and clean Runner File Commands
+		actPath := rc.JobContainer.GetActPath()
+
+		outputFileCommand := path.Join("workflow", "outputcmd.txt")
+		(*step.getEnv())["GITHUB_OUTPUT"] = path.Join(actPath, outputFileCommand)
+
+		stateFileCommand := path.Join("workflow", "statecmd.txt")
+		(*step.getEnv())["GITHUB_STATE"] = path.Join(actPath, stateFileCommand)
+
+		pathFileCommand := path.Join("workflow", "pathcmd.txt")
+		(*step.getEnv())["GITHUB_PATH"] = path.Join(actPath, pathFileCommand)
+
+		envFileCommand := path.Join("workflow", "envs.txt")
+		(*step.getEnv())["GITHUB_ENV"] = path.Join(actPath, envFileCommand)
+
+		summaryFileCommand := path.Join("workflow", "SUMMARY.md")
+		(*step.getEnv())["GITHUB_STEP_SUMMARY"] = path.Join(actPath, summaryFileCommand)
+
+		{
+			// For Gitea
+			(*step.getEnv())["GITEA_OUTPUT"] = (*step.getEnv())["GITHUB_OUTPUT"]
+			(*step.getEnv())["GITEA_STATE"] = (*step.getEnv())["GITHUB_STATE"]
+			(*step.getEnv())["GITEA_PATH"] = (*step.getEnv())["GITHUB_PATH"]
+			(*step.getEnv())["GITEA_ENV"] = (*step.getEnv())["GITHUB_ENV"]
+			(*step.getEnv())["GITEA_STEP_SUMMARY"] = (*step.getEnv())["GITHUB_STEP_SUMMARY"]
+		}
+
+		_ = rc.JobContainer.Copy(actPath, &container.FileEntry{
+			Name: outputFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: stateFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: pathFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: envFileCommand,
+			Mode: 0o666,
+		}, &container.FileEntry{
+			Name: summaryFileCommand,
+			Mode: 0o666,
+		})(ctx)
+
+		timeoutctx, cancelTimeOut := evaluateStepTimeout(ctx, rc.ExprEval, stepModel)
+		defer cancelTimeOut()
+		err = executor(timeoutctx)
+
+		if err == nil {
+			logger.WithField("stepResult", stepResult.Outcome).Infof("  \u2705  Success - %s %s", stage, stepString)
+		} else {
+			stepResult.Outcome = model.StepStatusFailure
+
+			continueOnError, parseErr := isContinueOnError(ctx, stepModel.RawContinueOnError, step, stage)
+			if parseErr != nil {
+				stepResult.Conclusion = model.StepStatusFailure
+				return parseErr
+			}
+
+			if continueOnError {
+				logger.Infof("Failed but continue next step")
+				err = nil
+				stepResult.Conclusion = model.StepStatusSuccess
+			} else {
+				stepResult.Conclusion = model.StepStatusFailure
+			}
+
+			logger.WithField("stepResult", stepResult.Outcome).Errorf("  \u274C  Failure - %s %s", stage, stepString)
+		}
+		// Process Runner File Commands
+		orgerr := err
+		err = processRunnerEnvFileCommand(ctx, envFileCommand, rc, rc.setEnv)
+		if err != nil {
+			return err
+		}
+		err = processRunnerEnvFileCommand(ctx, stateFileCommand, rc, rc.saveState)
+		if err != nil {
+			return err
+		}
+		err = processRunnerEnvFileCommand(ctx, outputFileCommand, rc, rc.setOutput)
+		if err != nil {
+			return err
+		}
+		err = rc.UpdateExtraPath(ctx, path.Join(actPath, pathFileCommand))
+		if err != nil {
+			return err
+		}
+		if orgerr != nil {
+			return orgerr
+		}
+		return err
+	}
+}
+
+func evaluateStepTimeout(ctx context.Context, exprEval ExpressionEvaluator, stepModel *model.Step) (context.Context, context.CancelFunc) {
+	timeout := exprEval.Interpolate(ctx, stepModel.TimeoutMinutes)
+	if timeout != "" {
+		if timeOutMinutes, err := strconv.ParseInt(timeout, 10, 64); err == nil {
+			return context.WithTimeout(ctx, time.Duration(timeOutMinutes)*time.Minute)
+		}
+	}
+	return ctx, func() {}
+}
+
+func setupEnv(ctx context.Context, step step) error { //nolint:unparam // pre-existing issue from nektos/act
+	rc := step.getRunContext()
+
+	mergeEnv(ctx, step)
+	// merge step env last, since it should not be overwritten
+	mergeIntoMap(step, step.getEnv(), step.getStepModel().GetEnv())
+
+	exprEval := rc.NewExpressionEvaluator(ctx)
+	for k, v := range *step.getEnv() {
+		if !strings.HasPrefix(k, "INPUT_") {
+			(*step.getEnv())[k] = exprEval.Interpolate(ctx, v)
+		}
+	}
+	// after we have an evaluated step context, update the expressions evaluator with a new env context
+	// you can use step level env in the with property of a uses construct
+	exprEval = rc.NewExpressionEvaluatorWithEnv(ctx, *step.getEnv())
+	for k, v := range *step.getEnv() {
+		if strings.HasPrefix(k, "INPUT_") {
+			(*step.getEnv())[k] = exprEval.Interpolate(ctx, v)
+		}
+	}
+
+	// For Gitea, reduce log noise
+	// common.Logger(ctx).Debugf("setupEnv => %v", *step.getEnv())
+
+	return nil
+}
+
+func mergeEnv(ctx context.Context, step step) {
+	env := step.getEnv()
+	rc := step.getRunContext()
+	job := rc.Run.Job()
+
+	c := job.Container()
+	if c != nil {
+		mergeIntoMap(step, env, rc.GetEnv(), c.Env)
+	} else {
+		mergeIntoMap(step, env, rc.GetEnv())
+	}
+
+	rc.withGithubEnv(ctx, step.getGithubContext(ctx), *env)
+}
+
+func isStepEnabled(ctx context.Context, expr string, step step, stage stepStage) (bool, error) {
+	rc := step.getRunContext()
+
+	var defaultStatusCheck exprparser.DefaultStatusCheck
+	if stage == stepStagePost {
+		defaultStatusCheck = exprparser.DefaultStatusCheckAlways
+	} else {
+		defaultStatusCheck = exprparser.DefaultStatusCheckSuccess
+	}
+
+	runStep, err := EvalBool(ctx, rc.NewStepExpressionEvaluator(ctx, step), expr, defaultStatusCheck)
+	if err != nil {
+		return false, fmt.Errorf("  \u274C  Error in if-expression: \"if: %s\" (%s)", expr, err)
+	}
+
+	return runStep, nil
+}
+
+func isContinueOnError(ctx context.Context, expr string, step step, _ stepStage) (bool, error) {
+	// https://github.com/github/docs/blob/3ae84420bd10997bb5f35f629ebb7160fe776eae/content/actions/reference/workflow-syntax-for-github-actions.md?plain=true#L962
+	if len(strings.TrimSpace(expr)) == 0 {
+		return false, nil
+	}
+
+	rc := step.getRunContext()
+
+	continueOnError, err := EvalBool(ctx, rc.NewStepExpressionEvaluator(ctx, step), expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		return false, fmt.Errorf("  \u274C  Error in continue-on-error-expression: \"continue-on-error: %s\" (%s)", expr, err)
+	}
+
+	return continueOnError, nil
+}
+
+func mergeIntoMap(step step, target *map[string]string, maps ...map[string]string) {
+	if rc := step.getRunContext(); rc != nil && rc.JobContainer != nil && rc.JobContainer.IsEnvironmentCaseInsensitive() {
+		mergeIntoMapCaseInsensitive(*target, maps...)
+	} else {
+		mergeIntoMapCaseSensitive(*target, maps...)
+	}
+}
+
+func mergeIntoMapCaseSensitive(target map[string]string, maps ...map[string]string) {
+	for _, m := range maps {
+		maps0.Copy(target, m)
+	}
+}
+
+func mergeIntoMapCaseInsensitive(target map[string]string, maps ...map[string]string) {
+	foldKeys := make(map[string]string, len(target))
+	for k := range target {
+		foldKeys[strings.ToLower(k)] = k
+	}
+	toKey := func(s string) string {
+		foldKey := strings.ToLower(s)
+		if k, ok := foldKeys[foldKey]; ok {
+			return k
+		}
+		foldKeys[strings.ToLower(foldKey)] = s
+		return s
+	}
+	for _, m := range maps {
+		for k, v := range m {
+			target[toKey(k)] = v
+		}
+	}
+}
+
+func symlinkJoin(filename, sym, parent string) (string, error) {
+	dir := path.Dir(filename)
+	dest := path.Join(dir, sym)
+	prefix := path.Clean(parent) + "/"
+	if strings.HasPrefix(dest, prefix) || prefix == "./" {
+		return dest, nil
+	}
+	return "", fmt.Errorf("symlink tries to access file '%s' outside of '%s'", strings.ReplaceAll(dest, "'", "''"), strings.ReplaceAll(parent, "'", "''"))
+}

act/runner/step_action_local.go

@@ -0,0 +1,138 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"archive/tar"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+)
+
+type stepActionLocal struct {
+	Step                *model.Step
+	RunContext          *RunContext
+	compositeRunContext *RunContext
+	compositeSteps      *compositeSteps
+	runAction           runAction
+	readAction          readAction
+	env                 map[string]string
+	action              *model.Action
+}
+
+func (sal *stepActionLocal) pre() common.Executor {
+	sal.env = map[string]string{}
+
+	return func(ctx context.Context) error {
+		return nil
+	}
+}
+
+func (sal *stepActionLocal) main() common.Executor {
+	return runStepExecutor(sal, stepStageMain, func(ctx context.Context) error {
+		if common.Dryrun(ctx) {
+			return nil
+		}
+
+		actionDir := filepath.Join(sal.getRunContext().Config.Workdir, sal.Step.Uses)
+
+		localReader := func(ctx context.Context) actionYamlReader {
+			_, cpath := getContainerActionPaths(sal.Step, path.Join(actionDir, ""), sal.RunContext)
+			return func(filename string) (io.Reader, io.Closer, error) {
+				spath := path.Join(cpath, filename)
+				for range maxSymlinkDepth {
+					tars, err := sal.RunContext.JobContainer.GetContainerArchive(ctx, spath)
+					if errors.Is(err, fs.ErrNotExist) {
+						return nil, nil, err
+					} else if err != nil {
+						return nil, nil, fs.ErrNotExist
+					}
+					treader := tar.NewReader(tars)
+					header, err := treader.Next()
+					if errors.Is(err, io.EOF) {
+						return nil, nil, os.ErrNotExist
+					} else if err != nil {
+						return nil, nil, err
+					}
+					if header.FileInfo().Mode()&os.ModeSymlink == os.ModeSymlink {
+						spath, err = symlinkJoin(spath, header.Linkname, cpath)
+						if err != nil {
+							return nil, nil, err
+						}
+					} else {
+						return treader, tars, nil
+					}
+				}
+				return nil, nil, fmt.Errorf("max depth %d of symlinks exceeded while reading %s", maxSymlinkDepth, spath)
+			}
+		}
+
+		actionModel, err := sal.readAction(ctx, sal.Step, actionDir, "", localReader(ctx), os.WriteFile)
+		if err != nil {
+			return err
+		}
+
+		sal.action = actionModel
+
+		return sal.runAction(sal, actionDir, nil)(ctx)
+	})
+}
+
+func (sal *stepActionLocal) post() common.Executor {
+	return runStepExecutor(sal, stepStagePost, runPostStep(sal)).If(hasPostStep(sal)).If(shouldRunPostStep(sal))
+}
+
+func (sal *stepActionLocal) getRunContext() *RunContext {
+	return sal.RunContext
+}
+
+func (sal *stepActionLocal) getGithubContext(ctx context.Context) *model.GithubContext {
+	return sal.getRunContext().getGithubContext(ctx)
+}
+
+func (sal *stepActionLocal) getStepModel() *model.Step {
+	return sal.Step
+}
+
+func (sal *stepActionLocal) getEnv() *map[string]string {
+	return &sal.env
+}
+
+func (sal *stepActionLocal) getIfExpression(_ context.Context, stage stepStage) string {
+	switch stage {
+	case stepStageMain:
+		return sal.Step.If.Value
+	case stepStagePost:
+		return sal.action.Runs.PostIf
+	}
+	return ""
+}
+
+func (sal *stepActionLocal) getActionModel() *model.Action {
+	return sal.action
+}
+
+func (sal *stepActionLocal) getCompositeRunContext(ctx context.Context) *RunContext {
+	if sal.compositeRunContext == nil {
+		actionDir := filepath.Join(sal.RunContext.Config.Workdir, sal.Step.Uses)
+		_, containerActionDir := getContainerActionPaths(sal.getStepModel(), actionDir, sal.RunContext)
+
+		sal.compositeRunContext = newCompositeRunContext(ctx, sal.RunContext, sal, containerActionDir)
+		sal.compositeSteps = sal.compositeRunContext.compositeExecutor(sal.action)
+	}
+	return sal.compositeRunContext
+}
+
+func (sal *stepActionLocal) getCompositeSteps() *compositeSteps {
+	return sal.compositeSteps
+}

act/runner/step_action_local_test.go

@@ -0,0 +1,298 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"go.yaml.in/yaml/v4"
+)
+
+type stepActionLocalMocks struct {
+	mock.Mock
+}
+
+func (salm *stepActionLocalMocks) runAction(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor {
+	args := salm.Called(step, actionDir, remoteAction)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (salm *stepActionLocalMocks) readAction(_ context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
+	args := salm.Called(step, actionDir, actionPath, readFile, writeFile)
+	return args.Get(0).(*model.Action), args.Error(1)
+}
+
+func TestStepActionLocalTest(t *testing.T) {
+	ctx := context.Background()
+
+	cm := &containerMock{}
+	salm := &stepActionLocalMocks{}
+
+	sal := &stepActionLocal{
+		readAction: salm.readAction,
+		runAction:  salm.runAction,
+		RunContext: &RunContext{
+			StepResults: map[string]*model.StepResult{},
+			ExprEval:    &expressionEvaluator{},
+			Config: &Config{
+				Workdir: "/tmp",
+			},
+			Run: &model.Run{
+				JobID: "1",
+				Workflow: &model.Workflow{
+					Jobs: map[string]*model.Job{
+						"1": {
+							Defaults: model.Defaults{
+								Run: model.RunDefaults{
+									Shell: "bash",
+								},
+							},
+						},
+					},
+				},
+			},
+			JobContainer: cm,
+		},
+		Step: &model.Step{
+			ID:   "1",
+			Uses: "./path/to/action",
+		},
+	}
+
+	salm.On("readAction", sal.Step, filepath.Clean("/tmp/path/to/action"), "", mock.Anything, mock.Anything).
+		Return(&model.Action{}, nil)
+
+	cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
+
+	salm.On("runAction", sal, filepath.Clean("/tmp/path/to/action"), (*remoteAction)(nil)).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	err := sal.pre()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	err = sal.main()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	cm.AssertExpectations(t)
+	salm.AssertExpectations(t)
+}
+
+func TestStepActionLocalPost(t *testing.T) {
+	table := []struct {
+		name               string
+		stepModel          *model.Step
+		actionModel        *model.Action
+		initialStepResults map[string]*model.StepResult
+		err                error
+		mocks              struct {
+			env  bool
+			exec bool
+		}
+	}{
+		{
+			name: "main-success",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "./local/action",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "always()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusSuccess,
+					Outcome:    model.StepStatusSuccess,
+					Outputs:    map[string]string{},
+				},
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  true,
+				exec: true,
+			},
+		},
+		{
+			name: "main-failed",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "./local/action",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "always()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusFailure,
+					Outcome:    model.StepStatusFailure,
+					Outputs:    map[string]string{},
+				},
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  true,
+				exec: true,
+			},
+		},
+		{
+			name: "skip-if-failed",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "./local/action",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "success()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusFailure,
+					Outcome:    model.StepStatusFailure,
+					Outputs:    map[string]string{},
+				},
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  false,
+				exec: false,
+			},
+		},
+		{
+			name: "skip-if-main-skipped",
+			stepModel: &model.Step{
+				ID:   "step",
+				If:   yaml.Node{Value: "failure()"},
+				Uses: "./local/action",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "always()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusSkipped,
+					Outcome:    model.StepStatusSkipped,
+					Outputs:    map[string]string{},
+				},
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  false,
+				exec: false,
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			cm := &containerMock{}
+
+			sal := &stepActionLocal{
+				env: map[string]string{},
+				RunContext: &RunContext{
+					Config: &Config{
+						GitHubInstance: "https://github.com",
+					},
+					JobContainer: cm,
+					Run: &model.Run{
+						JobID: "1",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"1": {},
+							},
+						},
+					},
+					StepResults: tt.initialStepResults,
+				},
+				Step:   tt.stepModel,
+				action: tt.actionModel,
+			}
+			sal.RunContext.ExprEval = sal.RunContext.NewExpressionEvaluator(ctx)
+
+			if tt.mocks.exec {
+				suffixMatcher := func(suffix string) any {
+					return mock.MatchedBy(func(array []string) bool {
+						return strings.HasSuffix(array[1], suffix)
+					})
+				}
+				cm.On("Exec", suffixMatcher("runner/local/action/post.js"), sal.env, "", "").Return(func(ctx context.Context) error { return tt.err })
+
+				cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
+			}
+
+			err := sal.post()(ctx)
+
+			assert.Equal(t, tt.err, err)
+			assert.Equal(t, sal.RunContext.StepResults["post-step"], (*model.StepResult)(nil)) //nolint:testifylint // pre-existing issue from nektos/act
+			cm.AssertExpectations(t)
+		})
+	}
+}

act/runner/step_action_remote.go

@@ -0,0 +1,358 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"archive/tar"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/common/git"
+	"gitea.com/gitea/act_runner/act/model"
+
+	gogit "github.com/go-git/go-git/v5"
+)
+
+type stepActionRemote struct {
+	Step                *model.Step
+	RunContext          *RunContext
+	compositeRunContext *RunContext
+	compositeSteps      *compositeSteps
+	readAction          readAction
+	runAction           runAction
+	action              *model.Action
+	env                 map[string]string
+	remoteAction        *remoteAction
+	cacheDir            string
+	resolvedSha         string
+}
+
+var stepActionRemoteNewCloneExecutor = git.NewGitCloneExecutor
+
+//nolint:gocyclo // function handles many cases
+func (sar *stepActionRemote) prepareActionExecutor() common.Executor {
+	return func(ctx context.Context) error {
+		if sar.remoteAction != nil && sar.action != nil {
+			// we are already good to run
+			return nil
+		}
+
+		// For gitea:
+		// Since actions can specify the download source via a url prefix.
+		// The prefix may contain some sensitive information that needs to be stored in secrets,
+		// so we need to interpolate the expression value for uses first.
+		sar.Step.Uses = sar.RunContext.NewExpressionEvaluator(ctx).Interpolate(ctx, sar.Step.Uses)
+
+		sar.remoteAction = newRemoteAction(sar.Step.Uses)
+		if sar.remoteAction == nil {
+			return fmt.Errorf("Expected format {org}/{repo}[/path]@ref. Actual '%s' Input string was not in a correct format", sar.Step.Uses)
+		}
+
+		github := sar.getGithubContext(ctx)
+		if sar.remoteAction.IsCheckout() && isLocalCheckout(github, sar.Step) && !sar.RunContext.Config.NoSkipCheckout {
+			common.Logger(ctx).Debugf("Skipping local actions/checkout because workdir was already copied")
+			return nil
+		}
+
+		for _, action := range sar.RunContext.Config.ReplaceGheActionWithGithubCom {
+			if strings.EqualFold(fmt.Sprintf("%s/%s", sar.remoteAction.Org, sar.remoteAction.Repo), action) {
+				sar.remoteAction.URL = "https://github.com"
+				github.Token = sar.RunContext.Config.ReplaceGheActionTokenWithGithubCom
+			}
+		}
+		if sar.RunContext.Config.ActionCache != nil {
+			cache := sar.RunContext.Config.ActionCache
+
+			var err error
+			sar.cacheDir = fmt.Sprintf("%s/%s", sar.remoteAction.Org, sar.remoteAction.Repo)
+			repoURL := sar.remoteAction.URL + "/" + sar.cacheDir
+			repoRef := sar.remoteAction.Ref
+			sar.resolvedSha, err = cache.Fetch(ctx, sar.cacheDir, repoURL, repoRef, github.Token)
+			if err != nil {
+				return fmt.Errorf("failed to fetch \"%s\" version \"%s\": %w", repoURL, repoRef, err)
+			}
+
+			remoteReader := func(ctx context.Context) actionYamlReader {
+				return func(filename string) (io.Reader, io.Closer, error) {
+					spath := path.Join(sar.remoteAction.Path, filename)
+					for range maxSymlinkDepth {
+						tars, err := cache.GetTarArchive(ctx, sar.cacheDir, sar.resolvedSha, spath)
+						if err != nil {
+							return nil, nil, os.ErrNotExist
+						}
+						treader := tar.NewReader(tars)
+						header, err := treader.Next()
+						if err != nil {
+							return nil, nil, os.ErrNotExist
+						}
+						if header.FileInfo().Mode()&os.ModeSymlink == os.ModeSymlink {
+							spath, err = symlinkJoin(spath, header.Linkname, ".")
+							if err != nil {
+								return nil, nil, err
+							}
+						} else {
+							return treader, tars, nil
+						}
+					}
+					return nil, nil, fmt.Errorf("max depth %d of symlinks exceeded while reading %s", maxSymlinkDepth, spath)
+				}
+			}
+
+			actionModel, err := sar.readAction(ctx, sar.Step, sar.resolvedSha, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)
+			sar.action = actionModel
+			return err
+		}
+
+		actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
+		token := getGitCloneToken(sar.getRunContext().Config, sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance))
+		gitClone := stepActionRemoteNewCloneExecutor(git.NewGitCloneExecutorInput{
+			URL:         sar.remoteAction.CloneURL(sar.RunContext.Config.DefaultActionInstance),
+			Ref:         sar.remoteAction.Ref,
+			Dir:         actionDir,
+			Token:       token,
+			OfflineMode: sar.RunContext.Config.ActionOfflineMode,
+
+			InsecureSkipTLS: sar.cloneSkipTLS(), // For Gitea
+		})
+		var ntErr common.Executor
+		if err := gitClone(ctx); err != nil {
+			if errors.Is(err, git.ErrShortRef) {
+				return fmt.Errorf("Unable to resolve action `%s`, the provided ref `%s` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `%s` instead",
+					sar.Step.Uses, sar.remoteAction.Ref, err.(*git.Error).Commit())
+			} else if errors.Is(err, gogit.ErrForceNeeded) { // TODO: figure out if it will be easy to shadow/alias go-git err's
+				ntErr = common.NewInfoExecutor("Non-terminating error while running 'git clone': %v", err)
+			} else {
+				return err
+			}
+		}
+
+		remoteReader := func(ctx context.Context) actionYamlReader { //nolint:unparam // pre-existing issue from nektos/act
+			return func(filename string) (io.Reader, io.Closer, error) {
+				f, err := os.Open(filepath.Join(actionDir, sar.remoteAction.Path, filename))
+				return f, f, err
+			}
+		}
+
+		return common.NewPipelineExecutor(
+			ntErr,
+			func(ctx context.Context) error {
+				actionModel, err := sar.readAction(ctx, sar.Step, actionDir, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)
+				sar.action = actionModel
+				return err
+			},
+		)(ctx)
+	}
+}
+
+func (sar *stepActionRemote) pre() common.Executor {
+	sar.env = map[string]string{}
+
+	return common.NewPipelineExecutor(
+		sar.prepareActionExecutor(),
+		runStepExecutor(sar, stepStagePre, runPreStep(sar)).If(hasPreStep(sar)).If(shouldRunPreStep(sar)))
+}
+
+func (sar *stepActionRemote) main() common.Executor {
+	return common.NewPipelineExecutor(
+		sar.prepareActionExecutor(),
+		runStepExecutor(sar, stepStageMain, func(ctx context.Context) error {
+			github := sar.getGithubContext(ctx)
+			if sar.remoteAction.IsCheckout() && isLocalCheckout(github, sar.Step) && !sar.RunContext.Config.NoSkipCheckout {
+				if sar.RunContext.Config.BindWorkdir {
+					common.Logger(ctx).Debugf("Skipping local actions/checkout because you bound your workspace")
+					return nil
+				}
+				eval := sar.RunContext.NewExpressionEvaluator(ctx)
+				copyToPath := path.Join(sar.RunContext.JobContainer.ToContainerPath(sar.RunContext.Config.Workdir), eval.Interpolate(ctx, sar.Step.With["path"]))
+				return sar.RunContext.JobContainer.CopyDir(copyToPath, sar.RunContext.Config.Workdir+string(filepath.Separator)+".", sar.RunContext.Config.UseGitIgnore)(ctx)
+			}
+
+			actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
+
+			return sar.runAction(sar, actionDir, sar.remoteAction)(ctx)
+		}),
+	)
+}
+
+func (sar *stepActionRemote) post() common.Executor {
+	return runStepExecutor(sar, stepStagePost, runPostStep(sar)).If(hasPostStep(sar)).If(shouldRunPostStep(sar))
+}
+
+func (sar *stepActionRemote) getRunContext() *RunContext {
+	return sar.RunContext
+}
+
+func (sar *stepActionRemote) getGithubContext(ctx context.Context) *model.GithubContext {
+	ghc := sar.getRunContext().getGithubContext(ctx)
+
+	// extend github context if we already have an initialized remoteAction
+	remoteAction := sar.remoteAction
+	if remoteAction != nil {
+		ghc.ActionRepository = fmt.Sprintf("%s/%s", remoteAction.Org, remoteAction.Repo)
+		ghc.ActionRef = remoteAction.Ref
+	}
+
+	return ghc
+}
+
+func (sar *stepActionRemote) getStepModel() *model.Step {
+	return sar.Step
+}
+
+func (sar *stepActionRemote) getEnv() *map[string]string {
+	return &sar.env
+}
+
+func (sar *stepActionRemote) getIfExpression(ctx context.Context, stage stepStage) string {
+	switch stage {
+	case stepStagePre:
+		github := sar.getGithubContext(ctx)
+		if sar.remoteAction.IsCheckout() && isLocalCheckout(github, sar.Step) && !sar.RunContext.Config.NoSkipCheckout {
+			// skip local checkout pre step
+			return "false"
+		}
+		return sar.action.Runs.PreIf
+	case stepStageMain:
+		return sar.Step.If.Value
+	case stepStagePost:
+		return sar.action.Runs.PostIf
+	}
+	return ""
+}
+
+func (sar *stepActionRemote) getActionModel() *model.Action {
+	return sar.action
+}
+
+func (sar *stepActionRemote) getCompositeRunContext(ctx context.Context) *RunContext {
+	if sar.compositeRunContext == nil {
+		actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), sar.Step.UsesHash())
+		actionLocation := path.Join(actionDir, sar.remoteAction.Path)
+		_, containerActionDir := getContainerActionPaths(sar.getStepModel(), actionLocation, sar.RunContext)
+
+		sar.compositeRunContext = newCompositeRunContext(ctx, sar.RunContext, sar, containerActionDir)
+		sar.compositeSteps = sar.compositeRunContext.compositeExecutor(sar.action)
+	} else {
+		// Re-evaluate environment here. For remote actions the environment
+		// need to be re-created for every stage (pre, main, post) as there
+		// might be required context changes (inputs/outputs) while the action
+		// stages are executed. (e.g. the output of another action is the
+		// input for this action during the main stage, but the env
+		// was already created during the pre stage)
+		env := evaluateCompositeInputAndEnv(ctx, sar.RunContext, sar)
+		sar.compositeRunContext.Env = env
+		sar.compositeRunContext.ExtraPath = sar.RunContext.ExtraPath
+	}
+	return sar.compositeRunContext
+}
+
+func (sar *stepActionRemote) getCompositeSteps() *compositeSteps {
+	return sar.compositeSteps
+}
+
+// For Gitea
+// cloneSkipTLS returns true if the runner can clone an action from the Gitea instance
+func (sar *stepActionRemote) cloneSkipTLS() bool {
+	if !sar.RunContext.Config.InsecureSkipTLS {
+		// Return false if the Gitea instance is not an insecure instance
+		return false
+	}
+	if sar.remoteAction.URL == "" {
+		// Empty URL means the default action instance should be used
+		// Return true if the URL of the Gitea instance is the same as the URL of the default action instance
+		return sar.RunContext.Config.DefaultActionInstance == sar.RunContext.Config.GitHubInstance
+	}
+	// Return true if the URL of the remote action is the same as the URL of the Gitea instance
+	return sar.remoteAction.URL == sar.RunContext.Config.GitHubInstance
+}
+
+type remoteAction struct {
+	URL  string
+	Org  string
+	Repo string
+	Path string
+	Ref  string
+}
+
+func (ra *remoteAction) CloneURL(u string) string {
+	if ra.URL == "" {
+		if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") {
+			u = "https://" + u
+		}
+	} else {
+		u = ra.URL
+	}
+
+	return fmt.Sprintf("%s/%s/%s", u, ra.Org, ra.Repo)
+}
+
+func (ra *remoteAction) IsCheckout() bool {
+	if ra.Org == "actions" && ra.Repo == "checkout" {
+		return true
+	}
+	return false
+}
+
+func newRemoteAction(action string) *remoteAction {
+	// support http(s)://host/owner/repo@v3
+	for _, schema := range []string{"https://", "http://"} {
+		if after, ok := strings.CutPrefix(action, schema); ok {
+			splits := strings.SplitN(after, "/", 2)
+			if len(splits) != 2 {
+				return nil
+			}
+			ret := parseAction(splits[1])
+			if ret == nil {
+				return nil
+			}
+			ret.URL = schema + splits[0]
+			return ret
+		}
+	}
+
+	return parseAction(action)
+}
+
+func parseAction(action string) *remoteAction {
+	// GitHub's document[^] describes:
+	// > We strongly recommend that you include the version of
+	// > the action you are using by specifying a Git ref, SHA, or Docker tag number.
+	// Actually, the workflow stops if there is the uses directive that hasn't @ref.
+	// [^]: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
+	r := regexp.MustCompile(`^([^/@]+)/([^/@]+)(/([^@]*))?(@(.*))?$`)
+	matches := r.FindStringSubmatch(action)
+	if len(matches) < 7 || matches[6] == "" {
+		return nil
+	}
+	return &remoteAction{
+		Org:  matches[1],
+		Repo: matches[2],
+		Path: matches[4],
+		Ref:  matches[6],
+		URL:  "",
+	}
+}
+
+func safeFilename(s string) string {
+	return strings.NewReplacer(
+		`<`, "-",
+		`>`, "-",
+		`:`, "-",
+		`"`, "-",
+		`/`, "-",
+		`\`, "-",
+		`|`, "-",
+		`?`, "-",
+		`*`, "-",
+	).Replace(s)
+}

act/runner/step_action_remote_test.go

@@ -0,0 +1,762 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/common/git"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"go.yaml.in/yaml/v4"
+)
+
+type stepActionRemoteMocks struct {
+	mock.Mock
+}
+
+func (sarm *stepActionRemoteMocks) readAction(_ context.Context, step *model.Step, actionDir, actionPath string, readFile actionYamlReader, writeFile fileWriter) (*model.Action, error) {
+	args := sarm.Called(step, actionDir, actionPath, readFile, writeFile)
+	return args.Get(0).(*model.Action), args.Error(1)
+}
+
+func (sarm *stepActionRemoteMocks) runAction(step actionStep, actionDir string, remoteAction *remoteAction) common.Executor {
+	args := sarm.Called(step, actionDir, remoteAction)
+	return args.Get(0).(func(context.Context) error)
+}
+
+func TestStepActionRemote(t *testing.T) {
+	table := []struct {
+		name      string
+		stepModel *model.Step
+		result    *model.StepResult
+		mocks     struct {
+			env    bool
+			cloned bool
+			read   bool
+			run    bool
+		}
+		runError error
+	}{
+		{
+			name: "run-successful",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "remote/action@v1",
+			},
+			result: &model.StepResult{
+				Conclusion: model.StepStatusSuccess,
+				Outcome:    model.StepStatusSuccess,
+				Outputs:    map[string]string{},
+			},
+			mocks: struct {
+				env    bool
+				cloned bool
+				read   bool
+				run    bool
+			}{
+				env:    true,
+				cloned: true,
+				read:   true,
+				run:    true,
+			},
+		},
+		{
+			name: "run-skipped",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "remote/action@v1",
+				If:   yaml.Node{Value: "false"},
+			},
+			result: &model.StepResult{
+				Conclusion: model.StepStatusSkipped,
+				Outcome:    model.StepStatusSkipped,
+				Outputs:    map[string]string{},
+			},
+			mocks: struct {
+				env    bool
+				cloned bool
+				read   bool
+				run    bool
+			}{
+				env:    true,
+				cloned: true,
+				read:   true,
+				run:    false,
+			},
+		},
+		{
+			name: "run-error",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "remote/action@v1",
+			},
+			result: &model.StepResult{
+				Conclusion: model.StepStatusFailure,
+				Outcome:    model.StepStatusFailure,
+				Outputs:    map[string]string{},
+			},
+			mocks: struct {
+				env    bool
+				cloned bool
+				read   bool
+				run    bool
+			}{
+				env:    true,
+				cloned: true,
+				read:   true,
+				run:    true,
+			},
+			runError: errors.New("error"),
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			cm := &containerMock{}
+			sarm := &stepActionRemoteMocks{}
+
+			clonedAction := false
+
+			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
+			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
+				return func(ctx context.Context) error {
+					clonedAction = true
+					return nil
+				}
+			}
+			defer (func() {
+				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
+			})()
+
+			sar := &stepActionRemote{
+				RunContext: &RunContext{
+					Config: &Config{
+						GitHubInstance: "github.com",
+						ActionCacheDir: "/tmp/test-cache",
+					},
+					Run: &model.Run{
+						JobID: "1",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"1": {},
+							},
+						},
+					},
+					StepResults:  map[string]*model.StepResult{},
+					JobContainer: cm,
+				},
+				Step:       tt.stepModel,
+				readAction: sarm.readAction,
+				runAction:  sarm.runAction,
+			}
+			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
+
+			suffixMatcher := func(suffix string) any {
+				return mock.MatchedBy(func(actionDir string) bool {
+					return strings.HasSuffix(actionDir, suffix)
+				})
+			}
+
+			if tt.mocks.read {
+				sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
+			}
+			if tt.mocks.run {
+				sarm.On("runAction", sar, suffixMatcher(sar.Step.UsesHash()), newRemoteAction(sar.Step.Uses)).Return(func(ctx context.Context) error { return tt.runError })
+
+				cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
+			}
+
+			err := sar.pre()(ctx)
+			if err == nil {
+				err = sar.main()(ctx)
+			}
+
+			assert.Equal(t, tt.runError, err)
+			assert.Equal(t, tt.mocks.cloned, clonedAction)
+			assert.Equal(t, tt.result, sar.RunContext.StepResults["step"])
+
+			sarm.AssertExpectations(t)
+			cm.AssertExpectations(t)
+		})
+	}
+}
+
+func TestStepActionRemotePre(t *testing.T) {
+	table := []struct {
+		name      string
+		stepModel *model.Step
+	}{
+		{
+			name: "run-pre",
+			stepModel: &model.Step{
+				Uses: "org/repo/path@ref",
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			clonedAction := false
+			sarm := &stepActionRemoteMocks{}
+
+			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
+			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
+				return func(ctx context.Context) error {
+					clonedAction = true
+					return nil
+				}
+			}
+			defer (func() {
+				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
+			})()
+
+			sar := &stepActionRemote{
+				Step: tt.stepModel,
+				RunContext: &RunContext{
+					Config: &Config{
+						GitHubInstance: "https://github.com",
+						ActionCacheDir: "/tmp/test-cache",
+					},
+					Run: &model.Run{
+						JobID: "1",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"1": {},
+							},
+						},
+					},
+				},
+				readAction: sarm.readAction,
+			}
+
+			suffixMatcher := func(suffix string) any {
+				return mock.MatchedBy(func(actionDir string) bool {
+					return strings.HasSuffix(actionDir, suffix)
+				})
+			}
+
+			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "path", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
+
+			err := sar.pre()(ctx)
+
+			assert.Nil(t, err)                  //nolint:testifylint // pre-existing issue from nektos/act
+			assert.Equal(t, true, clonedAction) //nolint:testifylint // pre-existing issue from nektos/act
+
+			sarm.AssertExpectations(t)
+		})
+	}
+}
+
+func TestStepActionRemotePreThroughAction(t *testing.T) {
+	table := []struct {
+		name      string
+		stepModel *model.Step
+	}{
+		{
+			name: "run-pre",
+			stepModel: &model.Step{
+				Uses: "org/repo/path@ref",
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			clonedAction := false
+			sarm := &stepActionRemoteMocks{}
+
+			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
+			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
+				return func(ctx context.Context) error {
+					if input.URL == "https://github.com/org/repo" {
+						clonedAction = true
+					}
+					return nil
+				}
+			}
+			defer (func() {
+				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
+			})()
+
+			sar := &stepActionRemote{
+				Step: tt.stepModel,
+				RunContext: &RunContext{
+					Config: &Config{
+						GitHubInstance:                "https://enterprise.github.com",
+						ReplaceGheActionWithGithubCom: []string{"org/repo"},
+						ActionCacheDir:                "/tmp/test-cache",
+					},
+					Run: &model.Run{
+						JobID: "1",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"1": {},
+							},
+						},
+					},
+				},
+				readAction: sarm.readAction,
+			}
+
+			suffixMatcher := func(suffix string) any {
+				return mock.MatchedBy(func(actionDir string) bool {
+					return strings.HasSuffix(actionDir, suffix)
+				})
+			}
+
+			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "path", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
+
+			err := sar.pre()(ctx)
+
+			assert.Nil(t, err)                  //nolint:testifylint // pre-existing issue from nektos/act
+			assert.Equal(t, true, clonedAction) //nolint:testifylint // pre-existing issue from nektos/act
+
+			sarm.AssertExpectations(t)
+		})
+	}
+}
+
+func TestStepActionRemotePreThroughActionToken(t *testing.T) {
+	table := []struct {
+		name      string
+		stepModel *model.Step
+	}{
+		{
+			name: "run-pre",
+			stepModel: &model.Step{
+				Uses: "org/repo/path@ref",
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			var actualURL string
+			var actualToken string
+			sarm := &stepActionRemoteMocks{}
+
+			origStepAtionRemoteNewCloneExecutor := stepActionRemoteNewCloneExecutor
+			stepActionRemoteNewCloneExecutor = func(input git.NewGitCloneExecutorInput) common.Executor {
+				return func(ctx context.Context) error {
+					actualURL = input.URL
+					actualToken = input.Token
+					return nil
+				}
+			}
+			defer (func() {
+				stepActionRemoteNewCloneExecutor = origStepAtionRemoteNewCloneExecutor
+			})()
+
+			// Use unique cache directory to ensure action gets cloned, not served from cache
+			uniqueCacheDir := fmt.Sprintf("/tmp/test-cache-token-%d", time.Now().UnixNano())
+
+			sar := &stepActionRemote{
+				Step: tt.stepModel,
+				RunContext: &RunContext{
+					Config: &Config{
+						GitHubInstance:                     "https://enterprise.github.com",
+						ReplaceGheActionWithGithubCom:      []string{"org/repo"},
+						ReplaceGheActionTokenWithGithubCom: "PRIVATE_ACTIONS_TOKEN_ON_GITHUB",
+						ActionCacheDir:                     uniqueCacheDir,
+						Token:                              "PRIVATE_ACTIONS_TOKEN_ON_GITHUB",
+					},
+					Run: &model.Run{
+						JobID: "1",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"1": {},
+							},
+						},
+					},
+				},
+				readAction: sarm.readAction,
+			}
+
+			suffixMatcher := func(suffix string) any {
+				return mock.MatchedBy(func(actionDir string) bool {
+					return strings.HasSuffix(actionDir, suffix)
+				})
+			}
+
+			sarm.On("readAction", sar.Step, suffixMatcher(sar.Step.UsesHash()), "path", mock.Anything, mock.Anything).Return(&model.Action{}, nil)
+
+			err := sar.pre()(ctx)
+
+			assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+			// Verify that the clone was called (URL should be redirected to github.com)
+			assert.True(t, actualURL != "", "Expected clone to be called") //nolint:testifylint // pre-existing issue from nektos/act
+			assert.Equal(t, "https://github.com/org/repo", actualURL, "URL should be redirected to github.com")
+			// Note: Token might be empty because getGitCloneToken doesn't check ReplaceGheActionTokenWithGithubCom
+			// The important part is that the URL replacement works
+			if actualToken != "" {
+				assert.Equal(t, "PRIVATE_ACTIONS_TOKEN_ON_GITHUB", actualToken, "If token is set, it should be the replacement token")
+			}
+
+			sarm.AssertExpectations(t)
+		})
+	}
+}
+
+func TestStepActionRemotePost(t *testing.T) {
+	table := []struct {
+		name               string
+		stepModel          *model.Step
+		actionModel        *model.Action
+		initialStepResults map[string]*model.StepResult
+		IntraActionState   map[string]map[string]string
+		expectedEnv        map[string]string
+		err                error
+		mocks              struct {
+			env  bool
+			exec bool
+		}
+	}{
+		{
+			name: "main-success",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "remote/action@v1",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "always()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusSuccess,
+					Outcome:    model.StepStatusSuccess,
+					Outputs:    map[string]string{},
+				},
+			},
+			IntraActionState: map[string]map[string]string{
+				"step": {
+					"key": "value",
+				},
+			},
+			expectedEnv: map[string]string{
+				"STATE_key": "value",
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  true,
+				exec: true,
+			},
+		},
+		{
+			name: "main-failed",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "remote/action@v1",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "always()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusFailure,
+					Outcome:    model.StepStatusFailure,
+					Outputs:    map[string]string{},
+				},
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  true,
+				exec: true,
+			},
+		},
+		{
+			name: "skip-if-failed",
+			stepModel: &model.Step{
+				ID:   "step",
+				Uses: "remote/action@v1",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "success()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusFailure,
+					Outcome:    model.StepStatusFailure,
+					Outputs:    map[string]string{},
+				},
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  true,
+				exec: false,
+			},
+		},
+		{
+			name: "skip-if-main-skipped",
+			stepModel: &model.Step{
+				ID:   "step",
+				If:   yaml.Node{Value: "failure()"},
+				Uses: "remote/action@v1",
+			},
+			actionModel: &model.Action{
+				Runs: model.ActionRuns{
+					Using:  "node16",
+					Post:   "post.js",
+					PostIf: "always()",
+				},
+			},
+			initialStepResults: map[string]*model.StepResult{
+				"step": {
+					Conclusion: model.StepStatusSkipped,
+					Outcome:    model.StepStatusSkipped,
+					Outputs:    map[string]string{},
+				},
+			},
+			mocks: struct {
+				env  bool
+				exec bool
+			}{
+				env:  false,
+				exec: false,
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			cm := &containerMock{}
+
+			sar := &stepActionRemote{
+				env: map[string]string{},
+				RunContext: &RunContext{
+					Config: &Config{
+						GitHubInstance: "https://github.com",
+						ActionCacheDir: "/tmp/test-cache",
+					},
+					JobContainer: cm,
+					Run: &model.Run{
+						JobID: "1",
+						Workflow: &model.Workflow{
+							Jobs: map[string]*model.Job{
+								"1": {},
+							},
+						},
+					},
+					StepResults:      tt.initialStepResults,
+					IntraActionState: tt.IntraActionState,
+				},
+				Step:   tt.stepModel,
+				action: tt.actionModel,
+			}
+			sar.RunContext.ExprEval = sar.RunContext.NewExpressionEvaluator(ctx)
+
+			if tt.mocks.exec {
+				// Use mock.MatchedBy to match the exec command with hash-based path
+				execMatcher := mock.MatchedBy(func(args []string) bool {
+					if len(args) != 2 {
+						return false
+					}
+					return args[0] == "node" && strings.Contains(args[1], "post.js")
+				})
+
+				cm.On("Exec", execMatcher, sar.env, "", "").Return(func(ctx context.Context) error { return tt.err })
+
+				cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+					return nil
+				})
+
+				cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
+			}
+
+			err := sar.post()(ctx)
+
+			assert.Equal(t, tt.err, err)
+			if tt.expectedEnv != nil {
+				for key, value := range tt.expectedEnv {
+					assert.Equal(t, value, sar.env[key])
+				}
+			}
+			// Enshure that StepResults is nil in this test
+			assert.Equal(t, sar.RunContext.StepResults["post-step"], (*model.StepResult)(nil)) //nolint:testifylint // pre-existing issue from nektos/act
+			cm.AssertExpectations(t)
+		})
+	}
+}
+
+func Test_newRemoteAction(t *testing.T) {
+	tests := []struct {
+		action       string
+		want         *remoteAction
+		wantCloneURL string
+	}{
+		{
+			action: "actions/heroku@main",
+			want: &remoteAction{
+				URL:  "",
+				Org:  "actions",
+				Repo: "heroku",
+				Path: "",
+				Ref:  "main",
+			},
+			wantCloneURL: "https://github.com/actions/heroku",
+		},
+		{
+			action: "actions/aws/ec2@main",
+			want: &remoteAction{
+				URL:  "",
+				Org:  "actions",
+				Repo: "aws",
+				Path: "ec2",
+				Ref:  "main",
+			},
+			wantCloneURL: "https://github.com/actions/aws",
+		},
+		{
+			action: "./.github/actions/my-action", // it's valid for GitHub, but act don't support it
+			want:   nil,
+		},
+		{
+			action: "docker://alpine:3.8", // it's valid for GitHub, but act don't support it
+			want:   nil,
+		},
+		{
+			action: "https://gitea.com/actions/heroku@main", // it's invalid for GitHub, but gitea supports it
+			want: &remoteAction{
+				URL:  "https://gitea.com",
+				Org:  "actions",
+				Repo: "heroku",
+				Path: "",
+				Ref:  "main",
+			},
+			wantCloneURL: "https://gitea.com/actions/heroku",
+		},
+		{
+			action: "https://gitea.com/actions/aws/ec2@main", // it's invalid for GitHub, but gitea supports it
+			want: &remoteAction{
+				URL:  "https://gitea.com",
+				Org:  "actions",
+				Repo: "aws",
+				Path: "ec2",
+				Ref:  "main",
+			},
+			wantCloneURL: "https://gitea.com/actions/aws",
+		},
+		{
+			action: "http://gitea.com/actions/heroku@main", // it's invalid for GitHub, but gitea supports it
+			want: &remoteAction{
+				URL:  "http://gitea.com",
+				Org:  "actions",
+				Repo: "heroku",
+				Path: "",
+				Ref:  "main",
+			},
+			wantCloneURL: "http://gitea.com/actions/heroku",
+		},
+		{
+			action: "http://gitea.com/actions/aws/ec2@main", // it's invalid for GitHub, but gitea supports it
+			want: &remoteAction{
+				URL:  "http://gitea.com",
+				Org:  "actions",
+				Repo: "aws",
+				Path: "ec2",
+				Ref:  "main",
+			},
+			wantCloneURL: "http://gitea.com/actions/aws",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.action, func(t *testing.T) {
+			got := newRemoteAction(tt.action)
+			assert.Equalf(t, tt.want, got, "newRemoteAction(%v)", tt.action)
+			cloneURL := ""
+			if got != nil {
+				cloneURL = got.CloneURL("github.com")
+			}
+			assert.Equalf(t, tt.wantCloneURL, cloneURL, "newRemoteAction(%v).CloneURL()", tt.action)
+		})
+	}
+}
+
+func Test_safeFilename(t *testing.T) {
+	tests := []struct {
+		s    string
+		want string
+	}{
+		{
+			s:    "https://test.com/test/",
+			want: "https---test.com-test-",
+		},
+		{
+			s:    `<>:"/\|?*`,
+			want: "---------",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.s, func(t *testing.T) {
+			assert.Equalf(t, tt.want, safeFilename(tt.s), "safeFilename(%v)", tt.s)
+		})
+	}
+}

act/runner/step_docker.go

@@ -0,0 +1,140 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/kballard/go-shellquote"
+)
+
+type stepDocker struct {
+	Step       *model.Step
+	RunContext *RunContext
+	env        map[string]string
+}
+
+func (sd *stepDocker) pre() common.Executor {
+	return func(ctx context.Context) error {
+		return nil
+	}
+}
+
+func (sd *stepDocker) main() common.Executor {
+	sd.env = map[string]string{}
+
+	return runStepExecutor(sd, stepStageMain, sd.runUsesContainer())
+}
+
+func (sd *stepDocker) post() common.Executor {
+	return func(ctx context.Context) error {
+		return nil
+	}
+}
+
+func (sd *stepDocker) getRunContext() *RunContext {
+	return sd.RunContext
+}
+
+func (sd *stepDocker) getGithubContext(ctx context.Context) *model.GithubContext {
+	return sd.getRunContext().getGithubContext(ctx)
+}
+
+func (sd *stepDocker) getStepModel() *model.Step {
+	return sd.Step
+}
+
+func (sd *stepDocker) getEnv() *map[string]string {
+	return &sd.env
+}
+
+func (sd *stepDocker) getIfExpression(_ context.Context, _ stepStage) string {
+	return sd.Step.If.Value
+}
+
+func (sd *stepDocker) runUsesContainer() common.Executor {
+	rc := sd.RunContext
+	step := sd.Step
+
+	return func(ctx context.Context) error {
+		image := strings.TrimPrefix(step.Uses, "docker://")
+		eval := rc.NewExpressionEvaluator(ctx)
+		cmd, err := shellquote.Split(eval.Interpolate(ctx, step.With["args"]))
+		if err != nil {
+			return err
+		}
+
+		var entrypoint []string
+		if entry := eval.Interpolate(ctx, step.With["entrypoint"]); entry != "" {
+			entrypoint = []string{entry}
+		}
+
+		stepContainer := sd.newStepContainer(ctx, image, cmd, entrypoint)
+
+		return common.NewPipelineExecutor(
+			stepContainer.Pull(rc.Config.ForcePull),
+			stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
+			stepContainer.Create(rc.Config.ContainerCapAdd, rc.Config.ContainerCapDrop),
+			stepContainer.Start(true),
+		).Finally(
+			stepContainer.Remove().IfBool(!rc.Config.ReuseContainers),
+		).Finally(stepContainer.Close())(ctx)
+	}
+}
+
+var ContainerNewContainer = container.NewContainer
+
+func (sd *stepDocker) newStepContainer(ctx context.Context, image string, cmd, entrypoint []string) container.Container {
+	rc := sd.RunContext
+	step := sd.Step
+
+	rawLogger := common.Logger(ctx).WithField("raw_output", true)
+	logWriter := common.NewLineWriter(rc.commandHandler(ctx), func(s string) bool {
+		if rc.Config.LogOutput {
+			rawLogger.Infof("%s", s)
+		} else {
+			rawLogger.Debugf("%s", s)
+		}
+		return true
+	})
+	envList := make([]string, 0)
+	for k, v := range sd.env {
+		envList = append(envList, fmt.Sprintf("%s=%s", k, v))
+	}
+
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TOOL_CACHE", "/opt/hostedtoolcache"))
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_OS", "Linux"))
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_ARCH", container.RunnerArch(ctx)))
+	envList = append(envList, fmt.Sprintf("%s=%s", "RUNNER_TEMP", "/tmp"))
+
+	binds, mounts := rc.GetBindsAndMounts()
+	stepContainer := ContainerNewContainer(&container.NewContainerInput{
+		Cmd:          cmd,
+		Entrypoint:   entrypoint,
+		WorkingDir:   rc.JobContainer.ToContainerPath(rc.Config.Workdir),
+		Image:        image,
+		Username:     rc.Config.Secrets["DOCKER_USERNAME"],
+		Password:     rc.Config.Secrets["DOCKER_PASSWORD"],
+		Name:         createSimpleContainerName(rc.jobContainerName(), "STEP-"+step.ID),
+		Env:          envList,
+		Mounts:       mounts,
+		NetworkMode:  "container:" + rc.jobContainerName(),
+		Binds:        binds,
+		Stdout:       logWriter,
+		Stderr:       logWriter,
+		Privileged:   rc.Config.Privileged,
+		UsernsMode:   rc.Config.UsernsMode,
+		Platform:     rc.Config.ContainerArchitecture,
+		AutoRemove:   rc.Config.AutoRemove,
+		ValidVolumes: rc.Config.ValidVolumes,
+	})
+	return stepContainer
+}

act/runner/step_docker_test.go

@@ -0,0 +1,120 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestStepDockerMain(t *testing.T) {
+	cm := &containerMock{}
+
+	var input *container.NewContainerInput
+
+	// mock the new container call
+	origContainerNewContainer := ContainerNewContainer
+	ContainerNewContainer = func(containerInput *container.NewContainerInput) container.ExecutionsEnvironment {
+		input = containerInput
+		return cm
+	}
+	defer (func() {
+		ContainerNewContainer = origContainerNewContainer
+	})()
+
+	ctx := context.Background()
+
+	sd := &stepDocker{
+		RunContext: &RunContext{
+			StepResults: map[string]*model.StepResult{},
+			Config:      &Config{},
+			Run: &model.Run{
+				JobID: "1",
+				Workflow: &model.Workflow{
+					Jobs: map[string]*model.Job{
+						"1": {
+							Defaults: model.Defaults{
+								Run: model.RunDefaults{
+									Shell: "bash",
+								},
+							},
+						},
+					},
+				},
+			},
+			JobContainer: cm,
+		},
+		Step: &model.Step{
+			ID:               "1",
+			Uses:             "docker://node:14",
+			WorkingDirectory: "workdir",
+		},
+	}
+	sd.RunContext.ExprEval = sd.RunContext.NewExpressionEvaluator(ctx)
+
+	cm.On("Pull", false).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("Remove").Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("Create", []string(nil), []string(nil)).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("Start", true).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("Close").Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
+
+	err := sd.main()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	assert.Equal(t, "node:14", input.Image)
+
+	cm.AssertExpectations(t)
+}
+
+func TestStepDockerPrePost(t *testing.T) {
+	ctx := context.Background()
+	sd := &stepDocker{}
+
+	err := sd.pre()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	err = sd.post()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+}

act/runner/step_factory.go

@@ -0,0 +1,50 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"fmt"
+
+	"gitea.com/gitea/act_runner/act/model"
+)
+
+type stepFactory interface {
+	newStep(step *model.Step, rc *RunContext) (step, error)
+}
+
+type stepFactoryImpl struct{}
+
+func (sf *stepFactoryImpl) newStep(stepModel *model.Step, rc *RunContext) (step, error) {
+	switch stepModel.Type() {
+	case model.StepTypeInvalid:
+		return nil, fmt.Errorf("Invalid run/uses syntax for job:%s step:%+v", rc.Run, stepModel)
+	case model.StepTypeRun:
+		return &stepRun{
+			Step:       stepModel,
+			RunContext: rc,
+		}, nil
+	case model.StepTypeUsesActionLocal:
+		return &stepActionLocal{
+			Step:       stepModel,
+			RunContext: rc,
+			readAction: readActionImpl,
+			runAction:  runActionImpl,
+		}, nil
+	case model.StepTypeUsesActionRemote:
+		return &stepActionRemote{
+			Step:       stepModel,
+			RunContext: rc,
+			readAction: readActionImpl,
+			runAction:  runActionImpl,
+		}, nil
+	case model.StepTypeUsesDockerURL:
+		return &stepDocker{
+			Step:       stepModel,
+			RunContext: rc,
+		}, nil
+	}
+
+	return nil, fmt.Errorf("Unable to determine how to run job:%s step:%+v", rc.Run, stepModel)
+}

act/runner/step_factory_test.go

@@ -0,0 +1,86 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStepFactoryNewStep(t *testing.T) {
+	table := []struct {
+		name  string
+		model *model.Step
+		check func(s step) bool
+	}{
+		{
+			name: "StepRemoteAction",
+			model: &model.Step{
+				Uses: "remote/action@v1",
+			},
+			check: func(s step) bool {
+				_, ok := s.(*stepActionRemote)
+				return ok
+			},
+		},
+		{
+			name: "StepLocalAction",
+			model: &model.Step{
+				Uses: "./action@v1",
+			},
+			check: func(s step) bool {
+				_, ok := s.(*stepActionLocal)
+				return ok
+			},
+		},
+		{
+			name: "StepDocker",
+			model: &model.Step{
+				Uses: "docker://image:tag",
+			},
+			check: func(s step) bool {
+				_, ok := s.(*stepDocker)
+				return ok
+			},
+		},
+		{
+			name: "StepRun",
+			model: &model.Step{
+				Run: "cmd",
+			},
+			check: func(s step) bool {
+				_, ok := s.(*stepRun)
+				return ok
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			sf := &stepFactoryImpl{}
+
+			step, err := sf.newStep(tt.model, &RunContext{})
+
+			assert.True(t, tt.check((step)))
+			assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+		})
+	}
+}
+
+func TestStepFactoryInvalidStep(t *testing.T) {
+	model := &model.Step{
+		Uses: "remote/action@v1",
+		Run:  "cmd",
+	}
+
+	sf := &stepFactoryImpl{}
+
+	_, err := sf.newStep(model, &RunContext{})
+
+	assert.Error(t, err)
+}

act/runner/step_run.go

@@ -0,0 +1,224 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"runtime"
+	"strings"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/lookpath"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/kballard/go-shellquote"
+)
+
+type stepRun struct {
+	Step             *model.Step
+	RunContext       *RunContext
+	cmd              []string
+	cmdline          string
+	env              map[string]string
+	WorkingDirectory string
+}
+
+func (sr *stepRun) pre() common.Executor {
+	return func(ctx context.Context) error {
+		return nil
+	}
+}
+
+func (sr *stepRun) main() common.Executor {
+	sr.env = map[string]string{}
+	return runStepExecutor(sr, stepStageMain, common.NewPipelineExecutor(
+		sr.setupShellCommandExecutor(),
+		func(ctx context.Context) error {
+			sr.getRunContext().ApplyExtraPath(ctx, &sr.env)
+			if he, ok := sr.getRunContext().JobContainer.(*container.HostEnvironment); ok && he != nil {
+				return he.ExecWithCmdLine(sr.cmd, sr.cmdline, sr.env, "", sr.WorkingDirectory)(ctx)
+			}
+			return sr.getRunContext().JobContainer.Exec(sr.cmd, sr.env, "", sr.WorkingDirectory)(ctx)
+		},
+	))
+}
+
+func (sr *stepRun) post() common.Executor {
+	return func(ctx context.Context) error {
+		return nil
+	}
+}
+
+func (sr *stepRun) getRunContext() *RunContext {
+	return sr.RunContext
+}
+
+func (sr *stepRun) getGithubContext(ctx context.Context) *model.GithubContext {
+	return sr.getRunContext().getGithubContext(ctx)
+}
+
+func (sr *stepRun) getStepModel() *model.Step {
+	return sr.Step
+}
+
+func (sr *stepRun) getEnv() *map[string]string {
+	return &sr.env
+}
+
+func (sr *stepRun) getIfExpression(_ context.Context, _ stepStage) string {
+	return sr.Step.If.Value
+}
+
+func (sr *stepRun) setupShellCommandExecutor() common.Executor {
+	return func(ctx context.Context) error {
+		scriptName, script, err := sr.setupShellCommand(ctx)
+		if err != nil {
+			return err
+		}
+
+		rc := sr.getRunContext()
+		return rc.JobContainer.Copy(rc.JobContainer.GetActPath(), &container.FileEntry{
+			Name: scriptName,
+			Mode: 0o755,
+			Body: script,
+		})(ctx)
+	}
+}
+
+func getScriptName(rc *RunContext, step *model.Step) string {
+	scriptName := step.ID
+	for rcs := rc; rcs.Parent != nil; rcs = rcs.Parent {
+		scriptName = fmt.Sprintf("%s-composite-%s", rcs.Parent.CurrentStep, scriptName)
+	}
+	return "workflow/" + scriptName
+}
+
+// TODO: Currently we just ignore top level keys, BUT we should return proper error on them
+// BUTx2 I leave this for when we rewrite act to use actionlint for workflow validation
+// so we return proper errors before any execution or spawning containers
+// it will error anyway with:
+// OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: "${{": executable file not found in $PATH: unknown
+func (sr *stepRun) setupShellCommand(ctx context.Context) (name, script string, err error) {
+	logger := common.Logger(ctx)
+	sr.setupShell(ctx)
+	sr.setupWorkingDirectory(ctx)
+
+	step := sr.Step
+
+	script = sr.RunContext.NewStepExpressionEvaluator(ctx, sr).Interpolate(ctx, step.Run)
+
+	scCmd := step.ShellCommand()
+
+	name = getScriptName(sr.RunContext, step)
+
+	// Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L47-L64
+	// Reference: https://github.com/actions/runner/blob/8109c962f09d9acc473d92c595ff43afceddb347/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs#L19-L27
+	runPrepend := ""
+	runAppend := ""
+	switch step.Shell {
+	case "bash", "sh":
+		name += ".sh"
+	case "pwsh", "powershell":
+		name += ".ps1"
+		runPrepend = "$ErrorActionPreference = 'stop'"
+		runAppend = "if ((Test-Path -LiteralPath variable:/LASTEXITCODE)) { exit $LASTEXITCODE }"
+	case "cmd":
+		name += ".cmd"
+		runPrepend = "@echo off"
+	case "python":
+		name += ".py"
+	}
+
+	script = fmt.Sprintf("%s\n%s\n%s", runPrepend, script, runAppend)
+
+	if !strings.Contains(script, "::add-mask::") && !sr.RunContext.Config.InsecureSecrets {
+		logger.Debugf("Wrote command \n%s\n to '%s'", script, name)
+	} else {
+		logger.Debugf("Wrote add-mask command to '%s'", name)
+	}
+
+	rc := sr.getRunContext()
+	scriptPath := fmt.Sprintf("%s/%s", rc.JobContainer.GetActPath(), name)
+	sr.cmdline = strings.Replace(scCmd, `{0}`, scriptPath, 1)
+	sr.cmd, err = shellquote.Split(sr.cmdline)
+
+	return name, script, err
+}
+
+type localEnv struct {
+	env map[string]string
+}
+
+func (l *localEnv) Getenv(name string) string {
+	if runtime.GOOS == "windows" {
+		for k, v := range l.env {
+			if strings.EqualFold(name, k) {
+				return v
+			}
+		}
+		return ""
+	}
+	return l.env[name]
+}
+
+func (sr *stepRun) setupShell(ctx context.Context) {
+	rc := sr.RunContext
+	step := sr.Step
+
+	if step.Shell == "" {
+		step.Shell = rc.Run.Job().Defaults.Run.Shell
+	}
+
+	step.Shell = rc.NewExpressionEvaluator(ctx).Interpolate(ctx, step.Shell)
+
+	if step.Shell == "" {
+		step.Shell = rc.Run.Workflow.Defaults.Run.Shell
+	}
+
+	if step.Shell == "" {
+		if _, ok := rc.JobContainer.(*container.HostEnvironment); ok {
+			shellWithFallback := []string{"bash", "sh"}
+			// Don't use bash on windows by default, if not using a docker container
+			if runtime.GOOS == "windows" {
+				shellWithFallback = []string{"pwsh", "powershell"}
+			}
+			step.Shell = shellWithFallback[0]
+			lenv := &localEnv{env: map[string]string{}}
+			maps.Copy(lenv.env, sr.env)
+			sr.getRunContext().ApplyExtraPath(ctx, &lenv.env)
+			_, err := lookpath.LookPath2(shellWithFallback[0], lenv)
+			if err != nil {
+				step.Shell = shellWithFallback[1]
+			}
+		} else if containerImage := rc.containerImage(ctx); containerImage != "" {
+			// Currently only linux containers are supported, use sh by default like actions/runner
+			step.Shell = "sh"
+		}
+	}
+}
+
+func (sr *stepRun) setupWorkingDirectory(ctx context.Context) {
+	rc := sr.RunContext
+	step := sr.Step
+	var workingdirectory string
+
+	if step.WorkingDirectory == "" {
+		workingdirectory = rc.Run.Job().Defaults.Run.WorkingDirectory
+	} else {
+		workingdirectory = step.WorkingDirectory
+	}
+
+	// jobs can receive context values, so we interpolate
+	workingdirectory = rc.NewExpressionEvaluator(ctx).Interpolate(ctx, workingdirectory)
+
+	// but top level keys in workflow file like `defaults` or `env` can't
+	if workingdirectory == "" {
+		workingdirectory = rc.Run.Workflow.Defaults.Run.WorkingDirectory
+	}
+	sr.WorkingDirectory = workingdirectory
+}

act/runner/step_run_test.go

@@ -0,0 +1,98 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/container"
+	"gitea.com/gitea/act_runner/act/model"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestStepRun(t *testing.T) {
+	cm := &containerMock{}
+	fileEntry := &container.FileEntry{
+		Name: "workflow/1.sh",
+		Mode: 0o755,
+		Body: "\ncmd\n",
+	}
+
+	sr := &stepRun{
+		RunContext: &RunContext{
+			StepResults: map[string]*model.StepResult{},
+			ExprEval:    &expressionEvaluator{},
+			Config:      &Config{},
+			Run: &model.Run{
+				JobID: "1",
+				Workflow: &model.Workflow{
+					Jobs: map[string]*model.Job{
+						"1": {
+							Defaults: model.Defaults{
+								Run: model.RunDefaults{
+									Shell: "bash",
+								},
+							},
+						},
+					},
+				},
+			},
+			JobContainer: cm,
+		},
+		Step: &model.Step{
+			ID:               "1",
+			Run:              "cmd",
+			WorkingDirectory: "workdir",
+		},
+	}
+
+	cm.On("Copy", "/var/run/act", []*container.FileEntry{fileEntry}).Return(func(ctx context.Context) error {
+		return nil
+	})
+	cm.On("Exec", []string{"bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "/var/run/act/workflow/1.sh"}, mock.AnythingOfType("map[string]string"), "", "workdir").Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("Copy", "/var/run/act", mock.AnythingOfType("[]*container.FileEntry")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/envs.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/statecmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	cm.On("UpdateFromEnv", "/var/run/act/workflow/outputcmd.txt", mock.AnythingOfType("*map[string]string")).Return(func(ctx context.Context) error {
+		return nil
+	})
+
+	ctx := context.Background()
+
+	cm.On("GetContainerArchive", ctx, "/var/run/act/workflow/pathcmd.txt").Return(io.NopCloser(&bytes.Buffer{}), nil)
+
+	err := sr.main()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	cm.AssertExpectations(t)
+}
+
+func TestStepRunPrePost(t *testing.T) {
+	ctx := context.Background()
+	sr := &stepRun{}
+
+	err := sr.pre()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	err = sr.post()(ctx)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+}

act/runner/step_test.go

@@ -0,0 +1,352 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Copyright 2022 The nektos/act Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"context"
+	"testing"
+
+	"gitea.com/gitea/act_runner/act/common"
+	"gitea.com/gitea/act_runner/act/model"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	yaml "go.yaml.in/yaml/v4"
+)
+
+func TestMergeIntoMap(t *testing.T) {
+	table := []struct {
+		name     string
+		target   map[string]string
+		maps     []map[string]string
+		expected map[string]string
+	}{
+		{
+			name:     "testEmptyMap",
+			target:   map[string]string{},
+			maps:     []map[string]string{},
+			expected: map[string]string{},
+		},
+		{
+			name:   "testMergeIntoEmptyMap",
+			target: map[string]string{},
+			maps: []map[string]string{
+				{
+					"key1": "value1",
+					"key2": "value2",
+				}, {
+					"key2": "overridden",
+					"key3": "value3",
+				},
+			},
+			expected: map[string]string{
+				"key1": "value1",
+				"key2": "overridden",
+				"key3": "value3",
+			},
+		},
+		{
+			name: "testMergeIntoExistingMap",
+			target: map[string]string{
+				"key1": "value1",
+				"key2": "value2",
+			},
+			maps: []map[string]string{
+				{
+					"key1": "overridden",
+				},
+			},
+			expected: map[string]string{
+				"key1": "overridden",
+				"key2": "value2",
+			},
+		},
+	}
+
+	for _, tt := range table {
+		t.Run(tt.name, func(t *testing.T) {
+			mergeIntoMapCaseSensitive(tt.target, tt.maps...)
+			assert.Equal(t, tt.expected, tt.target)
+			mergeIntoMapCaseInsensitive(tt.target, tt.maps...)
+			assert.Equal(t, tt.expected, tt.target)
+		})
+	}
+}
+
+type stepMock struct {
+	mock.Mock
+	step
+}
+
+func (sm *stepMock) pre() common.Executor {
+	args := sm.Called()
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (sm *stepMock) main() common.Executor {
+	args := sm.Called()
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (sm *stepMock) post() common.Executor {
+	args := sm.Called()
+	return args.Get(0).(func(context.Context) error)
+}
+
+func (sm *stepMock) getRunContext() *RunContext {
+	args := sm.Called()
+	return args.Get(0).(*RunContext)
+}
+
+func (sm *stepMock) getGithubContext(ctx context.Context) *model.GithubContext {
+	args := sm.Called()
+	return args.Get(0).(*RunContext).getGithubContext(ctx)
+}
+
+func (sm *stepMock) getStepModel() *model.Step {
+	args := sm.Called()
+	return args.Get(0).(*model.Step)
+}
+
+func (sm *stepMock) getEnv() *map[string]string {
+	args := sm.Called()
+	return args.Get(0).(*map[string]string)
+}
+
+func TestSetupEnv(t *testing.T) {
+	cm := &containerMock{}
+	sm := &stepMock{}
+
+	rc := &RunContext{
+		Config: &Config{
+			Env: map[string]string{
+				"GITHUB_RUN_ID": "runId",
+			},
+		},
+		Run: &model.Run{
+			JobID: "1",
+			Workflow: &model.Workflow{
+				Jobs: map[string]*model.Job{
+					"1": {
+						Env: yaml.Node{
+							Value: "JOB_KEY: jobvalue",
+						},
+					},
+				},
+			},
+		},
+		Env: map[string]string{
+			"RC_KEY": "rcvalue",
+		},
+		JobContainer: cm,
+	}
+	step := &model.Step{
+		With: map[string]string{
+			"STEP_WITH": "with-value",
+		},
+	}
+	env := map[string]string{}
+
+	sm.On("getRunContext").Return(rc)
+	sm.On("getGithubContext").Return(rc)
+	sm.On("getStepModel").Return(step)
+	sm.On("getEnv").Return(&env)
+
+	err := setupEnv(context.Background(), sm)
+	assert.Nil(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	// These are commit or system specific
+	delete((env), "GITHUB_REF")
+	delete((env), "GITHUB_REF_NAME")
+	delete((env), "GITHUB_REF_TYPE")
+	delete((env), "GITHUB_SHA")
+	delete((env), "GITHUB_WORKSPACE")
+	delete((env), "GITHUB_REPOSITORY")
+	delete((env), "GITHUB_REPOSITORY_OWNER")
+	delete((env), "GITHUB_ACTOR")
+
+	assert.Equal(t, map[string]string{
+		"ACT":                      "true",
+		"ACT_SKIP_CHECKOUT":        "true",
+		"CI":                       "true",
+		"GITHUB_ACTION":            "",
+		"GITHUB_ACTIONS":           "true",
+		"GITHUB_ACTION_PATH":       "",
+		"GITHUB_ACTION_REF":        "",
+		"GITHUB_ACTION_REPOSITORY": "",
+		"GITHUB_API_URL":           "https:///api/v1", // Gitea uses api/v1 (upstream GitHub: api/v3)
+		"GITHUB_BASE_REF":          "",
+		"GITHUB_EVENT_NAME":        "",
+		"GITHUB_EVENT_PATH":        "/var/run/act/workflow/event.json",
+		"GITHUB_GRAPHQL_URL":       "",
+		"GITHUB_HEAD_REF":          "",
+		"GITHUB_JOB":               "1",
+		"GITHUB_RETENTION_DAYS":    "0",
+		"GITHUB_RUN_ATTEMPT":       "",
+		"GITHUB_RUN_ID":            "runId",
+		"GITHUB_RUN_NUMBER":        "1",
+		"GITHUB_SERVER_URL":        "https://",
+		"GITHUB_WORKFLOW":          "",
+		"INPUT_STEP_WITH":          "with-value",
+		"RC_KEY":                   "rcvalue",
+		"RUNNER_PERFLOG":           "/dev/null",
+		"RUNNER_TRACKING_ID":       "",
+	}, env)
+
+	cm.AssertExpectations(t)
+}
+
+func TestIsStepEnabled(t *testing.T) {
+	createTestStep := func(t *testing.T, input string) step {
+		var step *model.Step
+		err := yaml.Unmarshal([]byte(input), &step)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+		return &stepRun{
+			RunContext: &RunContext{
+				Config: &Config{
+					Workdir: ".",
+					Platforms: map[string]string{
+						"ubuntu-latest": "ubuntu-latest",
+					},
+				},
+				StepResults: map[string]*model.StepResult{},
+				Env:         map[string]string{},
+				Run: &model.Run{
+					JobID: "job1",
+					Workflow: &model.Workflow{
+						Name: "workflow1",
+						Jobs: map[string]*model.Job{
+							"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
+						},
+					},
+				},
+			},
+			Step: step,
+		}
+	}
+
+	log.SetLevel(log.DebugLevel)
+	assertObject := assert.New(t)
+
+	// success()
+	step := createTestStep(t, "if: success()")
+	assertObject.True(isStepEnabled(context.Background(), step.getIfExpression(context.Background(), stepStageMain), step, stepStageMain))
+
+	step = createTestStep(t, "if: success()")
+	step.getRunContext().StepResults["a"] = &model.StepResult{
+		Conclusion: model.StepStatusSuccess,
+	}
+	assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+
+	step = createTestStep(t, "if: success()")
+	step.getRunContext().StepResults["a"] = &model.StepResult{
+		Conclusion: model.StepStatusFailure,
+	}
+	assertObject.False(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+
+	// failure()
+	step = createTestStep(t, "if: failure()")
+	assertObject.False(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+
+	step = createTestStep(t, "if: failure()")
+	step.getRunContext().StepResults["a"] = &model.StepResult{
+		Conclusion: model.StepStatusSuccess,
+	}
+	assertObject.False(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+
+	step = createTestStep(t, "if: failure()")
+	step.getRunContext().StepResults["a"] = &model.StepResult{
+		Conclusion: model.StepStatusFailure,
+	}
+	assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+
+	// always()
+	step = createTestStep(t, "if: always()")
+	assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+
+	step = createTestStep(t, "if: always()")
+	step.getRunContext().StepResults["a"] = &model.StepResult{
+		Conclusion: model.StepStatusSuccess,
+	}
+	assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+
+	step = createTestStep(t, "if: always()")
+	step.getRunContext().StepResults["a"] = &model.StepResult{
+		Conclusion: model.StepStatusFailure,
+	}
+	assertObject.True(isStepEnabled(context.Background(), step.getStepModel().If.Value, step, stepStageMain))
+}
+
+func TestIsContinueOnError(t *testing.T) {
+	createTestStep := func(t *testing.T, input string) step {
+		var step *model.Step
+		err := yaml.Unmarshal([]byte(input), &step)
+		assert.NoError(t, err) //nolint:testifylint // pre-existing issue from nektos/act
+
+		return &stepRun{
+			RunContext: &RunContext{
+				Config: &Config{
+					Workdir: ".",
+					Platforms: map[string]string{
+						"ubuntu-latest": "ubuntu-latest",
+					},
+				},
+				StepResults: map[string]*model.StepResult{},
+				Env:         map[string]string{},
+				Run: &model.Run{
+					JobID: "job1",
+					Workflow: &model.Workflow{
+						Name: "workflow1",
+						Jobs: map[string]*model.Job{
+							"job1": createJob(t, `runs-on: ubuntu-latest`, ""),
+						},
+					},
+				},
+			},
+			Step: step,
+		}
+	}
+
+	log.SetLevel(log.DebugLevel)
+	assertObject := assert.New(t)
+
+	// absent
+	step := createTestStep(t, "name: test")
+	continueOnError, err := isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain)
+	assertObject.False(continueOnError)
+	assertObject.Nil(err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	// explcit true
+	step = createTestStep(t, "continue-on-error: true")
+	continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain)
+	assertObject.True(continueOnError)
+	assertObject.Nil(err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	// explicit false
+	step = createTestStep(t, "continue-on-error: false")
+	continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain)
+	assertObject.False(continueOnError)
+	assertObject.Nil(err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	// expression true
+	step = createTestStep(t, "continue-on-error: ${{ 'test' == 'test' }}")
+	continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain)
+	assertObject.True(continueOnError)
+	assertObject.Nil(err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	// expression false
+	step = createTestStep(t, "continue-on-error: ${{ 'test' != 'test' }}")
+	continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain)
+	assertObject.False(continueOnError)
+	assertObject.Nil(err) //nolint:testifylint // pre-existing issue from nektos/act
+
+	// expression parse error
+	step = createTestStep(t, "continue-on-error: ${{ 'test' != test }}")
+	continueOnError, err = isContinueOnError(context.Background(), step.getStepModel().RawContinueOnError, step, stepStageMain)
+	assertObject.False(continueOnError)
+	assertObject.NotNil(err) //nolint:testifylint // pre-existing issue from nektos/act
+}

act/runner/testdata/GITHUB_ENV-use-in-env-ctx/push.yml

@@ -0,0 +1,27 @@
+on: push
+jobs:
+  _:
+    runs-on: ubuntu-latest
+    env:
+      MYGLOBALENV3: myglobalval3
+    steps:
+    - run: |
+        echo MYGLOBALENV1=myglobalval1 > $GITHUB_ENV
+        echo "::set-env name=MYGLOBALENV2::myglobalval2"
+    - uses: nektos/act-test-actions/script@main
+      with:
+        main: |
+          env
+          [[ "$MYGLOBALENV1" = "${{ env.MYGLOBALENV1 }}" ]]
+          [[ "$MYGLOBALENV1" = "${{ env.MYGLOBALENV1ALIAS }}" ]]
+          [[ "$MYGLOBALENV1" = "$MYGLOBALENV1ALIAS" ]]
+          [[ "$MYGLOBALENV2" = "${{ env.MYGLOBALENV2 }}" ]]
+          [[ "$MYGLOBALENV2" = "${{ env.MYGLOBALENV2ALIAS }}" ]]
+          [[ "$MYGLOBALENV2" = "$MYGLOBALENV2ALIAS" ]]
+          [[ "$MYGLOBALENV3" = "${{ env.MYGLOBALENV3 }}" ]]
+          [[ "$MYGLOBALENV3" = "${{ env.MYGLOBALENV3ALIAS }}" ]]
+          [[ "$MYGLOBALENV3" = "$MYGLOBALENV3ALIAS" ]]
+      env:
+        MYGLOBALENV1ALIAS: ${{ env.MYGLOBALENV1 }}
+        MYGLOBALENV2ALIAS: ${{ env.MYGLOBALENV2 }}
+        MYGLOBALENV3ALIAS: ${{ env.MYGLOBALENV3 }}

act/runner/testdata/GITHUB_STATE/push.yml

@@ -0,0 +1,48 @@
+on: push
+jobs:
+  _:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: nektos/act-test-actions/script@main
+      with:
+        pre: |
+          env
+          echo mystate0=mystateval > $GITHUB_STATE
+          echo "::save-state name=mystate1::mystateval"
+        main: |
+          env
+          echo mystate2=mystateval > $GITHUB_STATE
+          echo "::save-state name=mystate3::mystateval"
+        post: |
+          env
+          [ "$STATE_mystate0" = "mystateval" ]
+          [ "$STATE_mystate1" = "mystateval" ]
+          [ "$STATE_mystate2" = "mystateval" ]
+          [ "$STATE_mystate3" = "mystateval" ]
+  test-id-collision-bug:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: nektos/act-test-actions/script@main
+      id: script
+      with:
+        pre: |
+          env
+          echo mystate0=mystateval > $GITHUB_STATE
+          echo "::save-state name=mystate1::mystateval"
+        main: |
+          env
+          echo mystate2=mystateval > $GITHUB_STATE
+          echo "::save-state name=mystate3::mystateval"
+        post: |
+          env
+          [ "$STATE_mystate0" = "mystateval" ]
+          [ "$STATE_mystate1" = "mystateval" ]
+          [ "$STATE_mystate2" = "mystateval" ]
+          [ "$STATE_mystate3" = "mystateval" ]
+    - uses: nektos/act-test-actions/script@main
+      id: pre-script
+      with:
+        main: |
+          env
+          echo mystate0=mystateerror > $GITHUB_STATE
+          echo "::save-state name=mystate1::mystateerror"

act/runner/testdata/act-composite-env-test/action1/action.yml

@@ -0,0 +1,21 @@
+name: action1
+description: action1
+runs:
+  using: composite
+  steps:
+  - name: env.COMPOSITE_OVERRIDE != '1'
+    run: exit 1
+    if: env.COMPOSITE_OVERRIDE != '1'
+    shell: bash
+  - name: env.JOB != '1'
+    run: exit 1
+    if: env.JOB != '1'
+    shell: bash
+  - name: env.GLOBAL != '1'
+    run: exit 1
+    if: env.GLOBAL != '1'
+    shell: bash
+  - uses: ./act-composite-env-test/action2
+    env:
+      COMPOSITE_OVERRIDE: "2"
+      COMPOSITE: "1"

act/runner/testdata/act-composite-env-test/action2/action.yml

@@ -0,0 +1,21 @@
+name: action2
+description: actions2
+runs:
+  using: composite
+  steps:
+  - name: env.COMPOSITE_OVERRIDE != '2'
+    run: exit 1
+    if: env.COMPOSITE_OVERRIDE != '2'
+    shell: bash
+  - name: env.COMPOSITE != '1'
+    run: exit 1
+    if: env.COMPOSITE != '1'
+    shell: bash
+  - name: env.JOB != '1'
+    run: exit 1
+    if: env.JOB != '1'
+    shell: bash
+  - name: env.GLOBAL != '1'
+    run: exit 1
+    if: env.GLOBAL != '1'
+    shell: bash

act/runner/testdata/act-composite-env-test/push.yml

@@ -0,0 +1,13 @@
+on: push
+env:
+  GLOBAL: "1"
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      JOB: "1"
+    steps:
+    - uses: actions/checkout@v2
+    - uses: ./act-composite-env-test/action1
+      env:
+        COMPOSITE_OVERRIDE: "1"

act/runner/testdata/actions-environment-and-context-tests/docker/Dockerfile

@@ -0,0 +1,5 @@
+FROM alpine:3
+
+COPY entrypoint.sh /entrypoint.sh
+
+ENTRYPOINT [ "/entrypoint.sh" ]

act/runner/testdata/actions-environment-and-context-tests/docker/action.yml

@@ -0,0 +1,5 @@
+name: 'Test'
+description: 'Test'
+runs:
+  using: 'docker'
+  image: 'Dockerfile'

act/runner/testdata/actions-environment-and-context-tests/docker/entrypoint.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+checkEnvVar() {
+	name=$1
+	value=$2
+	allowEmpty=$3
+
+	if [ -z "$value" ]; then
+		echo "Missing environment variable: $name"
+		exit 1
+	fi
+
+	if [ "$allowEmpty" != "true" ]; then
+		test=$(echo "$value" |cut -f 2 -d "=")
+		if [ -z "$test" ]; then
+			echo "Environment variable is empty: $name"
+			exit 1
+		fi
+	fi
+
+	echo "$value"
+}
+
+checkEnvVar "GITHUB_ACTION" "$(env |grep "GITHUB_ACTION=")" false
+checkEnvVar "GITHUB_ACTION_REPOSITORY" "$(env |grep "GITHUB_ACTION_REPOSITORY=")" true
+checkEnvVar "GITHUB_ACTION_REF" "$(env |grep "GITHUB_ACTION_REF=")" true

act/runner/testdata/actions-environment-and-context-tests/js/action.yml

@@ -0,0 +1,5 @@
+name: 'Test'
+description: 'Test'
+runs:
+  using: 'node12'
+  main: 'index.js'

act/runner/testdata/actions-environment-and-context-tests/js/index.js

@@ -0,0 +1,15 @@
+function checkEnvVar({ name, allowEmpty }) {
+  if (
+    process.env[name] === undefined ||
+    (allowEmpty === false && process.env[name] === "")
+  ) {
+    throw new Error(
+      `${name} is undefined` + (allowEmpty === false ? " or empty" : "")
+    );
+  }
+  console.log(`${name}=${process.env[name]}`);
+}
+
+checkEnvVar({ name: "GITHUB_ACTION", allowEmpty: false });
+checkEnvVar({ name: "GITHUB_ACTION_REPOSITORY", allowEmpty: true /* allows to be empty for local actions */ });
+checkEnvVar({ name: "GITHUB_ACTION_REF", allowEmpty: true /* allows to be empty for local actions */ });

act/runner/testdata/actions-environment-and-context-tests/push.yml

@@ -0,0 +1,15 @@
+name: actions-with-environment-and-context-tests
+description: "Actions with environment (env vars) and context (expression) tests"
+on: push
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: './actions-environment-and-context-tests/js'
+      - uses: './actions-environment-and-context-tests/docker'
+      - uses: 'nektos/act-test-actions/js@main'
+      - uses: 'nektos/act-test-actions/docker@main'
+      - uses: 'nektos/act-test-actions/docker-file@main'
+      - uses: 'nektos/act-test-actions/docker-relative-context/action@main'

act/runner/testdata/actions/action1/Dockerfile

@@ -0,0 +1 @@
+FROM ubuntu:18.04

act/runner/testdata/actions/action1/action.yml

@@ -0,0 +1,4 @@
+name: 'action1'
+runs:
+  using: 'docker'
+  image: 'Dockerfile'

act/runner/testdata/actions/composite-fail-with-output/action.yml

@@ -0,0 +1,13 @@
+outputs:
+  customoutput:
+    value: my-customoutput-${{ steps.random-color-generator.outputs.SELECTED_COLOR }}
+runs:
+  using: composite
+  steps:
+  - name: Set selected color
+    run: echo '::set-output name=SELECTED_COLOR::green'
+    id: random-color-generator
+    shell: bash
+  - name: fail
+    run: exit 1
+    shell: bash

act/runner/testdata/actions/docker-local-noargs/Dockerfile

@@ -0,0 +1,8 @@
+# Container image that runs your code
+FROM node:12-buster-slim
+
+# Copies your code file from your action repository to the filesystem path `/` of the container
+COPY entrypoint.sh /entrypoint.sh
+
+# Code file to execute when the docker container starts up (`entrypoint.sh`)
+ENTRYPOINT ["/entrypoint.sh"]

act/runner/testdata/actions/docker-local-noargs/action.yml

@@ -0,0 +1,15 @@
+name: 'Hello World'
+description: 'Greet someone and record the time'
+inputs:
+  who-to-greet:  # id of input
+    description: 'Who to greet'
+    required: true
+    default: 'World'
+outputs:
+  time: # id of output
+    description: 'The time we greeted you'
+runs:
+  using: 'docker'
+  image: 'Dockerfile'
+  env:
+    WHOAMI: ${{ inputs.who-to-greet }}

act/runner/testdata/actions/docker-local-noargs/entrypoint.sh

@@ -0,0 +1,8 @@
+#!/bin/sh -l
+
+echo "Hello $1"
+time=$(date)
+echo ::set-output name=time::$time
+echo ::set-output name=whoami::$WHOAMI
+
+echo "SOMEVAR=$1" >>$GITHUB_ENV

act/runner/testdata/actions/docker-local/Dockerfile

@@ -0,0 +1,8 @@
+# Container image that runs your code
+FROM node:16-buster-slim
+
+# Copies your code file from your action repository to the filesystem path `/` of the container
+COPY entrypoint.sh /entrypoint.sh
+
+# Code file to execute when the docker container starts up (`entrypoint.sh`)
+ENTRYPOINT ["/entrypoint.sh"]

act/runner/testdata/actions/docker-local/action.yml

@@ -0,0 +1,17 @@
+name: 'Hello World'
+description: 'Greet someone and record the time'
+inputs:
+  who-to-greet:  # id of input
+    description: 'Who to greet'
+    required: true
+    default: 'World'
+outputs:
+  time: # id of output
+    description: 'The time we greeted you'
+runs:
+  using: 'docker'
+  image: 'Dockerfile'
+  env:
+    WHOAMI: ${{ inputs.who-to-greet }}
+  args:
+    - ${{ inputs.who-to-greet }}

act/runner/testdata/actions/docker-local/entrypoint.sh

@@ -0,0 +1,8 @@
+#!/bin/sh -l
+
+echo "Hello $1"
+time=$(date)
+echo ::set-output name=time::$time
+echo ::set-output name=whoami::$WHOAMI
+
+echo "SOMEVAR=$1" >>$GITHUB_ENV

act/runner/testdata/actions/docker-url/action.yml

@@ -0,0 +1,16 @@
+name: docker-url
+author: nektos
+description: testing
+inputs:
+  who-to-greet:
+    description: who to greet
+    required: true
+    default: World
+runs:
+  using: docker
+  image: docker://node:16-buster-slim
+  entrypoint: /bin/sh -c
+  env:
+    TEST: enabled
+  args:
+    - env

act/runner/testdata/actions/node12/action.yml

@@ -0,0 +1,13 @@
+name: 'Hello World'
+description: 'Greet someone and record the time'
+inputs:
+  who-to-greet:  # id of input
+    description: 'Who to greet'
+    required: true
+    default: 'World'
+outputs:
+  time: # id of output
+    description: 'The time we greeted you'
+runs:
+  using: 'node12'
+  main: 'dist/index.js'

act/runner/testdata/actions/node12/index.js

@@ -0,0 +1,15 @@
+const core = require('@actions/core');
+const github = require('@actions/github');
+
+try {
+  // `who-to-greet` input defined in action metadata file
+  const nameToGreet = core.getInput('who-to-greet');
+  console.log(`Hello ${nameToGreet}!`);
+  const time = (new Date()).toTimeString();
+  core.setOutput("time", time);
+  // Get the JSON webhook payload for the event that triggered the workflow
+  const payload = JSON.stringify(github.context.payload, undefined, 2)
+  console.log(`The event payload: ${payload}`);
+} catch (error) {
+  core.setFailed(error.message);
+}

act/runner/testdata/actions/node12/node_modules/.bin/ncc

@@ -0,0 +1 @@
+../@vercel/ncc/dist/ncc/cli.js

act/runner/testdata/actions/node12/node_modules/.bin/uuid

@@ -0,0 +1 @@
+../uuid/dist/bin/uuid

act/runner/testdata/actions/node12/node_modules/.package-lock.json

@@ -0,0 +1,244 @@
+{
+  "name": "node12",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "node_modules/@actions/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
+      "dependencies": {
+        "@actions/http-client": "^2.0.1",
+        "uuid": "^8.3.2"
+      }
+    },
+    "node_modules/@actions/github": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-4.0.0.tgz",
+      "integrity": "sha512-Ej/Y2E+VV6sR9X7pWL5F3VgEWrABaT292DRqRU6R4hnQjPtC/zD3nagxVdXWiRQvYDh8kHXo7IDmG42eJ/dOMA==",
+      "dependencies": {
+        "@actions/http-client": "^1.0.8",
+        "@octokit/core": "^3.0.0",
+        "@octokit/plugin-paginate-rest": "^2.2.3",
+        "@octokit/plugin-rest-endpoint-methods": "^4.0.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@actions/http-client": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-1.0.11.tgz",
+      "integrity": "sha512-VRYHGQV1rqnROJqdMvGUbY/Kn8vriQe/F9HR2AlYHzmKuM/p3kjNuXhmdBfcVgsvRWTz5C5XW5xvndZrVBuAYg==",
+      "dependencies": {
+        "tunnel": "0.0.6"
+      }
+    },
+    "node_modules/@actions/http-client": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.1.1.tgz",
+      "integrity": "sha512-qhrkRMB40bbbLo7gF+0vu+X+UawOvQQqNAA/5Unx774RS8poaOhThDOG6BGmxvAnxhQnDp2BG/ZUm65xZILTpw==",
+      "dependencies": {
+        "tunnel": "^0.0.6"
+      }
+    },
+    "node_modules/@octokit/auth-token": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
+      "integrity": "sha512-r5FVUJCOLl19AxiuZD2VRZ/ORjp/4IN98Of6YJoJOkY75CIBuYfmiNHGrDwXr+aLGG55igl9QrxX3hbiXlLb+g==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz",
+      "integrity": "sha512-7RKRKuA4xTjMhY+eG3jthb3hlZCsOwg3rztWh75Xc+ShDWOfDDATWbeZpAHBNRpm4Tv9WgBMOy1zEJYXG6NJ7Q==",
+      "dependencies": {
+        "@octokit/auth-token": "^2.4.4",
+        "@octokit/graphql": "^4.5.8",
+        "@octokit/request": "^5.6.3",
+        "@octokit/request-error": "^2.0.5",
+        "@octokit/types": "^6.0.3",
+        "before-after-hook": "^2.2.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "6.0.12",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.12.tgz",
+      "integrity": "sha512-lF3puPwkQWGfkMClXb4k/eUT/nZKQfxinRWJrdZaJO85Dqwo/G0yOC434Jr2ojwafWJMYqFGFa5ms4jJUgujdA==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "is-plain-object": "^5.0.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.8.0.tgz",
+      "integrity": "sha512-0gv+qLSBLKF0z8TKaSKTsS39scVKF9dbMxJpj3U0vC7wjNWFuIpL/z76Qe2fiuCbDRcJSavkXsVtMS6/dtQQsg==",
+      "dependencies": {
+        "@octokit/request": "^5.6.0",
+        "@octokit/types": "^6.0.3",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "12.11.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
+      "integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ=="
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "2.21.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.21.3.tgz",
+      "integrity": "sha512-aCZTEf0y2h3OLbrgKkrfFdjRL6eSOo8komneVQJnYecAxIej7Bafor2xhuDJOIFau4pk0i/P28/XgtbyPF0ZHw==",
+      "dependencies": {
+        "@octokit/types": "^6.40.0"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=2"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "4.15.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-4.15.1.tgz",
+      "integrity": "sha512-4gQg4ySoW7ktKB0Mf38fHzcSffVZd6mT5deJQtpqkuPuAqzlED5AJTeW8Uk7dPRn7KaOlWcXB0MedTFJU1j4qA==",
+      "dependencies": {
+        "@octokit/types": "^6.13.0",
+        "deprecation": "^2.3.1"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=3"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz",
+      "integrity": "sha512-bFJl0I1KVc9jYTe9tdGGpAMPy32dLBXXo1dS/YwSCTL/2nd9XeHsY616RE3HPXDVk+a+dBuzyz5YdlXwcDTr2A==",
+      "dependencies": {
+        "@octokit/endpoint": "^6.0.1",
+        "@octokit/request-error": "^2.1.0",
+        "@octokit/types": "^6.16.1",
+        "is-plain-object": "^5.0.0",
+        "node-fetch": "^2.6.7",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz",
+      "integrity": "sha512-1VIvgXxs9WHSjicsRwq8PlR2LR2x6DwsJAaFgzdi0JfJoGSO8mYI/cHJQ+9FbN21aa+DrgNLnwObmyeSC8Rmpg==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "6.41.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
+      "integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
+      "dependencies": {
+        "@octokit/openapi-types": "^12.11.0"
+      }
+    },
+    "node_modules/@vercel/ncc": {
+      "version": "0.24.1",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.24.1.tgz",
+      "integrity": "sha512-r9m7brz2hNmq5TF3sxrK4qR/FhXn44XIMglQUir4sT7Sh5GOaYXlMYikHFwJStf8rmQGTlvOoBXt4yHVonRG8A==",
+      "dev": true,
+      "bin": {
+        "ncc": "dist/ncc/cli.js"
+      }
+    },
+    "node_modules/before-after-hook": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="
+    },
+    "node_modules/deprecation": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
+    },
+    "node_modules/is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "2.6.12",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.12.tgz",
+      "integrity": "sha512-C/fGU2E8ToujUivIO0H+tpQ6HWo4eEmchoPIoXtxCrVghxdKq+QOHqEZW7tuP3KlV3bC8FRMO5nMCC7Zm1VP6g==",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
+    },
+    "node_modules/tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+      "engines": {
+        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
+      }
+    },
+    "node_modules/universal-user-agent": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
+      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+    },
+    "node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}

act/runner/testdata/actions/node12/node_modules/@actions/core/LICENSE.md

@@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright 2019 GitHub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/command.d.ts

@@ -0,0 +1,15 @@
+export interface CommandProperties {
+    [key: string]: any;
+}
+/**
+ * Commands
+ *
+ * Command Format:
+ *   ::name key=value,key=value::message
+ *
+ * Examples:
+ *   ::warning::This is the message
+ *   ::set-env name=MY_VAR::some value
+ */
+export declare function issueCommand(command: string, properties: CommandProperties, message: any): void;
+export declare function issue(name: string, message?: string): void;

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/command.js

@@ -0,0 +1,92 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.issue = exports.issueCommand = void 0;
+const os = __importStar(require("os"));
+const utils_1 = require("./utils");
+/**
+ * Commands
+ *
+ * Command Format:
+ *   ::name key=value,key=value::message
+ *
+ * Examples:
+ *   ::warning::This is the message
+ *   ::set-env name=MY_VAR::some value
+ */
+function issueCommand(command, properties, message) {
+    const cmd = new Command(command, properties, message);
+    process.stdout.write(cmd.toString() + os.EOL);
+}
+exports.issueCommand = issueCommand;
+function issue(name, message = '') {
+    issueCommand(name, {}, message);
+}
+exports.issue = issue;
+const CMD_STRING = '::';
+class Command {
+    constructor(command, properties, message) {
+        if (!command) {
+            command = 'missing.command';
+        }
+        this.command = command;
+        this.properties = properties;
+        this.message = message;
+    }
+    toString() {
+        let cmdStr = CMD_STRING + this.command;
+        if (this.properties && Object.keys(this.properties).length > 0) {
+            cmdStr += ' ';
+            let first = true;
+            for (const key in this.properties) {
+                if (this.properties.hasOwnProperty(key)) {
+                    const val = this.properties[key];
+                    if (val) {
+                        if (first) {
+                            first = false;
+                        }
+                        else {
+                            cmdStr += ',';
+                        }
+                        cmdStr += `${key}=${escapeProperty(val)}`;
+                    }
+                }
+            }
+        }
+        cmdStr += `${CMD_STRING}${escapeData(this.message)}`;
+        return cmdStr;
+    }
+}
+function escapeData(s) {
+    return utils_1.toCommandValue(s)
+        .replace(/%/g, '%25')
+        .replace(/\r/g, '%0D')
+        .replace(/\n/g, '%0A');
+}
+function escapeProperty(s) {
+    return utils_1.toCommandValue(s)
+        .replace(/%/g, '%25')
+        .replace(/\r/g, '%0D')
+        .replace(/\n/g, '%0A')
+        .replace(/:/g, '%3A')
+        .replace(/,/g, '%2C');
+}
+//# sourceMappingURL=command.js.map

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAwB;AACxB,mCAAsC;AAWtC;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAC1B,OAAe,EACf,UAA6B,EAC7B,OAAY;IAEZ,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;AAC/C,CAAC;AAPD,oCAOC;AAED,SAAgB,KAAK,CAAC,IAAY,EAAE,OAAO,GAAG,EAAE;IAC9C,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;AACjC,CAAC;AAFD,sBAEC;AAED,MAAM,UAAU,GAAG,IAAI,CAAA;AAEvB,MAAM,OAAO;IAKX,YAAY,OAAe,EAAE,UAA6B,EAAE,OAAe;QACzE,IAAI,CAAC,OAAO,EAAE;YACZ,OAAO,GAAG,iBAAiB,CAAA;SAC5B;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAED,QAAQ;QACN,IAAI,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC,OAAO,CAAA;QAEtC,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;YAC9D,MAAM,IAAI,GAAG,CAAA;YACb,IAAI,KAAK,GAAG,IAAI,CAAA;YAChB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE;gBACjC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE;oBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;oBAChC,IAAI,GAAG,EAAE;wBACP,IAAI,KAAK,EAAE;4BACT,KAAK,GAAG,KAAK,CAAA;yBACd;6BAAM;4BACL,MAAM,IAAI,GAAG,CAAA;yBACd;wBAED,MAAM,IAAI,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;qBAC1C;iBACF;aACF;SACF;QAED,MAAM,IAAI,GAAG,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAA;QACpD,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAAM;IACxB,OAAO,sBAAc,CAAC,CAAC,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,CAAM;IAC5B,OAAO,sBAAc,CAAC,CAAC,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACzB,CAAC"}

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/core.d.ts

@@ -0,0 +1,198 @@
+/**
+ * Interface for getInput options
+ */
+export interface InputOptions {
+    /** Optional. Whether the input is required. If required and not present, will throw. Defaults to false */
+    required?: boolean;
+    /** Optional. Whether leading/trailing whitespace will be trimmed for the input. Defaults to true */
+    trimWhitespace?: boolean;
+}
+/**
+ * The code to exit an action
+ */
+export declare enum ExitCode {
+    /**
+     * A code indicating that the action was successful
+     */
+    Success = 0,
+    /**
+     * A code indicating that the action was a failure
+     */
+    Failure = 1
+}
+/**
+ * Optional properties that can be sent with annotatation commands (notice, error, and warning)
+ * See: https://docs.github.com/en/rest/reference/checks#create-a-check-run for more information about annotations.
+ */
+export interface AnnotationProperties {
+    /**
+     * A title for the annotation.
+     */
+    title?: string;
+    /**
+     * The path of the file for which the annotation should be created.
+     */
+    file?: string;
+    /**
+     * The start line for the annotation.
+     */
+    startLine?: number;
+    /**
+     * The end line for the annotation. Defaults to `startLine` when `startLine` is provided.
+     */
+    endLine?: number;
+    /**
+     * The start column for the annotation. Cannot be sent when `startLine` and `endLine` are different values.
+     */
+    startColumn?: number;
+    /**
+     * The start column for the annotation. Cannot be sent when `startLine` and `endLine` are different values.
+     * Defaults to `startColumn` when `startColumn` is provided.
+     */
+    endColumn?: number;
+}
+/**
+ * Sets env variable for this action and future actions in the job
+ * @param name the name of the variable to set
+ * @param val the value of the variable. Non-string values will be converted to a string via JSON.stringify
+ */
+export declare function exportVariable(name: string, val: any): void;
+/**
+ * Registers a secret which will get masked from logs
+ * @param secret value of the secret
+ */
+export declare function setSecret(secret: string): void;
+/**
+ * Prepends inputPath to the PATH (for this action and future actions)
+ * @param inputPath
+ */
+export declare function addPath(inputPath: string): void;
+/**
+ * Gets the value of an input.
+ * Unless trimWhitespace is set to false in InputOptions, the value is also trimmed.
+ * Returns an empty string if the value is not defined.
+ *
+ * @param     name     name of the input to get
+ * @param     options  optional. See InputOptions.
+ * @returns   string
+ */
+export declare function getInput(name: string, options?: InputOptions): string;
+/**
+ * Gets the values of an multiline input.  Each value is also trimmed.
+ *
+ * @param     name     name of the input to get
+ * @param     options  optional. See InputOptions.
+ * @returns   string[]
+ *
+ */
+export declare function getMultilineInput(name: string, options?: InputOptions): string[];
+/**
+ * Gets the input value of the boolean type in the YAML 1.2 "core schema" specification.
+ * Support boolean input list: `true | True | TRUE | false | False | FALSE` .
+ * The return value is also in boolean type.
+ * ref: https://yaml.org/spec/1.2/spec.html#id2804923
+ *
+ * @param     name     name of the input to get
+ * @param     options  optional. See InputOptions.
+ * @returns   boolean
+ */
+export declare function getBooleanInput(name: string, options?: InputOptions): boolean;
+/**
+ * Sets the value of an output.
+ *
+ * @param     name     name of the output to set
+ * @param     value    value to store. Non-string values will be converted to a string via JSON.stringify
+ */
+export declare function setOutput(name: string, value: any): void;
+/**
+ * Enables or disables the echoing of commands into stdout for the rest of the step.
+ * Echoing is disabled by default if ACTIONS_STEP_DEBUG is not set.
+ *
+ */
+export declare function setCommandEcho(enabled: boolean): void;
+/**
+ * Sets the action status to failed.
+ * When the action exits it will be with an exit code of 1
+ * @param message add error issue message
+ */
+export declare function setFailed(message: string | Error): void;
+/**
+ * Gets whether Actions Step Debug is on or not
+ */
+export declare function isDebug(): boolean;
+/**
+ * Writes debug message to user log
+ * @param message debug message
+ */
+export declare function debug(message: string): void;
+/**
+ * Adds an error issue
+ * @param message error issue message. Errors will be converted to string via toString()
+ * @param properties optional properties to add to the annotation.
+ */
+export declare function error(message: string | Error, properties?: AnnotationProperties): void;
+/**
+ * Adds a warning issue
+ * @param message warning issue message. Errors will be converted to string via toString()
+ * @param properties optional properties to add to the annotation.
+ */
+export declare function warning(message: string | Error, properties?: AnnotationProperties): void;
+/**
+ * Adds a notice issue
+ * @param message notice issue message. Errors will be converted to string via toString()
+ * @param properties optional properties to add to the annotation.
+ */
+export declare function notice(message: string | Error, properties?: AnnotationProperties): void;
+/**
+ * Writes info to log with console.log.
+ * @param message info message
+ */
+export declare function info(message: string): void;
+/**
+ * Begin an output group.
+ *
+ * Output until the next `groupEnd` will be foldable in this group
+ *
+ * @param name The name of the output group
+ */
+export declare function startGroup(name: string): void;
+/**
+ * End an output group.
+ */
+export declare function endGroup(): void;
+/**
+ * Wrap an asynchronous function call in a group.
+ *
+ * Returns the same type as the function itself.
+ *
+ * @param name The name of the group
+ * @param fn The function to wrap in the group
+ */
+export declare function group<T>(name: string, fn: () => Promise<T>): Promise<T>;
+/**
+ * Saves state for current action, the state can only be retrieved by this action's post job execution.
+ *
+ * @param     name     name of the state to store
+ * @param     value    value to store. Non-string values will be converted to a string via JSON.stringify
+ */
+export declare function saveState(name: string, value: any): void;
+/**
+ * Gets the value of an state set by this action's main execution.
+ *
+ * @param     name     name of the state to get
+ * @returns   string
+ */
+export declare function getState(name: string): string;
+export declare function getIDToken(aud?: string): Promise<string>;
+/**
+ * Summary exports
+ */
+export { summary } from './summary';
+/**
+ * @deprecated use core.summary
+ */
+export { markdownSummary } from './summary';
+/**
+ * Path exports
+ */
+export { toPosixPath, toWin32Path, toPlatformPath } from './path-utils';

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/core.js

@@ -0,0 +1,336 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getIDToken = exports.getState = exports.saveState = exports.group = exports.endGroup = exports.startGroup = exports.info = exports.notice = exports.warning = exports.error = exports.debug = exports.isDebug = exports.setFailed = exports.setCommandEcho = exports.setOutput = exports.getBooleanInput = exports.getMultilineInput = exports.getInput = exports.addPath = exports.setSecret = exports.exportVariable = exports.ExitCode = void 0;
+const command_1 = require("./command");
+const file_command_1 = require("./file-command");
+const utils_1 = require("./utils");
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const oidc_utils_1 = require("./oidc-utils");
+/**
+ * The code to exit an action
+ */
+var ExitCode;
+(function (ExitCode) {
+    /**
+     * A code indicating that the action was successful
+     */
+    ExitCode[ExitCode["Success"] = 0] = "Success";
+    /**
+     * A code indicating that the action was a failure
+     */
+    ExitCode[ExitCode["Failure"] = 1] = "Failure";
+})(ExitCode = exports.ExitCode || (exports.ExitCode = {}));
+//-----------------------------------------------------------------------
+// Variables
+//-----------------------------------------------------------------------
+/**
+ * Sets env variable for this action and future actions in the job
+ * @param name the name of the variable to set
+ * @param val the value of the variable. Non-string values will be converted to a string via JSON.stringify
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function exportVariable(name, val) {
+    const convertedVal = utils_1.toCommandValue(val);
+    process.env[name] = convertedVal;
+    const filePath = process.env['GITHUB_ENV'] || '';
+    if (filePath) {
+        return file_command_1.issueFileCommand('ENV', file_command_1.prepareKeyValueMessage(name, val));
+    }
+    command_1.issueCommand('set-env', { name }, convertedVal);
+}
+exports.exportVariable = exportVariable;
+/**
+ * Registers a secret which will get masked from logs
+ * @param secret value of the secret
+ */
+function setSecret(secret) {
+    command_1.issueCommand('add-mask', {}, secret);
+}
+exports.setSecret = setSecret;
+/**
+ * Prepends inputPath to the PATH (for this action and future actions)
+ * @param inputPath
+ */
+function addPath(inputPath) {
+    const filePath = process.env['GITHUB_PATH'] || '';
+    if (filePath) {
+        file_command_1.issueFileCommand('PATH', inputPath);
+    }
+    else {
+        command_1.issueCommand('add-path', {}, inputPath);
+    }
+    process.env['PATH'] = `${inputPath}${path.delimiter}${process.env['PATH']}`;
+}
+exports.addPath = addPath;
+/**
+ * Gets the value of an input.
+ * Unless trimWhitespace is set to false in InputOptions, the value is also trimmed.
+ * Returns an empty string if the value is not defined.
+ *
+ * @param     name     name of the input to get
+ * @param     options  optional. See InputOptions.
+ * @returns   string
+ */
+function getInput(name, options) {
+    const val = process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`] || '';
+    if (options && options.required && !val) {
+        throw new Error(`Input required and not supplied: ${name}`);
+    }
+    if (options && options.trimWhitespace === false) {
+        return val;
+    }
+    return val.trim();
+}
+exports.getInput = getInput;
+/**
+ * Gets the values of an multiline input.  Each value is also trimmed.
+ *
+ * @param     name     name of the input to get
+ * @param     options  optional. See InputOptions.
+ * @returns   string[]
+ *
+ */
+function getMultilineInput(name, options) {
+    const inputs = getInput(name, options)
+        .split('\n')
+        .filter(x => x !== '');
+    if (options && options.trimWhitespace === false) {
+        return inputs;
+    }
+    return inputs.map(input => input.trim());
+}
+exports.getMultilineInput = getMultilineInput;
+/**
+ * Gets the input value of the boolean type in the YAML 1.2 "core schema" specification.
+ * Support boolean input list: `true | True | TRUE | false | False | FALSE` .
+ * The return value is also in boolean type.
+ * ref: https://yaml.org/spec/1.2/spec.html#id2804923
+ *
+ * @param     name     name of the input to get
+ * @param     options  optional. See InputOptions.
+ * @returns   boolean
+ */
+function getBooleanInput(name, options) {
+    const trueValue = ['true', 'True', 'TRUE'];
+    const falseValue = ['false', 'False', 'FALSE'];
+    const val = getInput(name, options);
+    if (trueValue.includes(val))
+        return true;
+    if (falseValue.includes(val))
+        return false;
+    throw new TypeError(`Input does not meet YAML 1.2 "Core Schema" specification: ${name}\n` +
+        `Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
+}
+exports.getBooleanInput = getBooleanInput;
+/**
+ * Sets the value of an output.
+ *
+ * @param     name     name of the output to set
+ * @param     value    value to store. Non-string values will be converted to a string via JSON.stringify
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function setOutput(name, value) {
+    const filePath = process.env['GITHUB_OUTPUT'] || '';
+    if (filePath) {
+        return file_command_1.issueFileCommand('OUTPUT', file_command_1.prepareKeyValueMessage(name, value));
+    }
+    process.stdout.write(os.EOL);
+    command_1.issueCommand('set-output', { name }, utils_1.toCommandValue(value));
+}
+exports.setOutput = setOutput;
+/**
+ * Enables or disables the echoing of commands into stdout for the rest of the step.
+ * Echoing is disabled by default if ACTIONS_STEP_DEBUG is not set.
+ *
+ */
+function setCommandEcho(enabled) {
+    command_1.issue('echo', enabled ? 'on' : 'off');
+}
+exports.setCommandEcho = setCommandEcho;
+//-----------------------------------------------------------------------
+// Results
+//-----------------------------------------------------------------------
+/**
+ * Sets the action status to failed.
+ * When the action exits it will be with an exit code of 1
+ * @param message add error issue message
+ */
+function setFailed(message) {
+    process.exitCode = ExitCode.Failure;
+    error(message);
+}
+exports.setFailed = setFailed;
+//-----------------------------------------------------------------------
+// Logging Commands
+//-----------------------------------------------------------------------
+/**
+ * Gets whether Actions Step Debug is on or not
+ */
+function isDebug() {
+    return process.env['RUNNER_DEBUG'] === '1';
+}
+exports.isDebug = isDebug;
+/**
+ * Writes debug message to user log
+ * @param message debug message
+ */
+function debug(message) {
+    command_1.issueCommand('debug', {}, message);
+}
+exports.debug = debug;
+/**
+ * Adds an error issue
+ * @param message error issue message. Errors will be converted to string via toString()
+ * @param properties optional properties to add to the annotation.
+ */
+function error(message, properties = {}) {
+    command_1.issueCommand('error', utils_1.toCommandProperties(properties), message instanceof Error ? message.toString() : message);
+}
+exports.error = error;
+/**
+ * Adds a warning issue
+ * @param message warning issue message. Errors will be converted to string via toString()
+ * @param properties optional properties to add to the annotation.
+ */
+function warning(message, properties = {}) {
+    command_1.issueCommand('warning', utils_1.toCommandProperties(properties), message instanceof Error ? message.toString() : message);
+}
+exports.warning = warning;
+/**
+ * Adds a notice issue
+ * @param message notice issue message. Errors will be converted to string via toString()
+ * @param properties optional properties to add to the annotation.
+ */
+function notice(message, properties = {}) {
+    command_1.issueCommand('notice', utils_1.toCommandProperties(properties), message instanceof Error ? message.toString() : message);
+}
+exports.notice = notice;
+/**
+ * Writes info to log with console.log.
+ * @param message info message
+ */
+function info(message) {
+    process.stdout.write(message + os.EOL);
+}
+exports.info = info;
+/**
+ * Begin an output group.
+ *
+ * Output until the next `groupEnd` will be foldable in this group
+ *
+ * @param name The name of the output group
+ */
+function startGroup(name) {
+    command_1.issue('group', name);
+}
+exports.startGroup = startGroup;
+/**
+ * End an output group.
+ */
+function endGroup() {
+    command_1.issue('endgroup');
+}
+exports.endGroup = endGroup;
+/**
+ * Wrap an asynchronous function call in a group.
+ *
+ * Returns the same type as the function itself.
+ *
+ * @param name The name of the group
+ * @param fn The function to wrap in the group
+ */
+function group(name, fn) {
+    return __awaiter(this, void 0, void 0, function* () {
+        startGroup(name);
+        let result;
+        try {
+            result = yield fn();
+        }
+        finally {
+            endGroup();
+        }
+        return result;
+    });
+}
+exports.group = group;
+//-----------------------------------------------------------------------
+// Wrapper action state
+//-----------------------------------------------------------------------
+/**
+ * Saves state for current action, the state can only be retrieved by this action's post job execution.
+ *
+ * @param     name     name of the state to store
+ * @param     value    value to store. Non-string values will be converted to a string via JSON.stringify
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function saveState(name, value) {
+    const filePath = process.env['GITHUB_STATE'] || '';
+    if (filePath) {
+        return file_command_1.issueFileCommand('STATE', file_command_1.prepareKeyValueMessage(name, value));
+    }
+    command_1.issueCommand('save-state', { name }, utils_1.toCommandValue(value));
+}
+exports.saveState = saveState;
+/**
+ * Gets the value of an state set by this action's main execution.
+ *
+ * @param     name     name of the state to get
+ * @returns   string
+ */
+function getState(name) {
+    return process.env[`STATE_${name}`] || '';
+}
+exports.getState = getState;
+function getIDToken(aud) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return yield oidc_utils_1.OidcClient.getIDToken(aud);
+    });
+}
+exports.getIDToken = getIDToken;
+/**
+ * Summary exports
+ */
+var summary_1 = require("./summary");
+Object.defineProperty(exports, "summary", { enumerable: true, get: function () { return summary_1.summary; } });
+/**
+ * @deprecated use core.summary
+ */
+var summary_2 = require("./summary");
+Object.defineProperty(exports, "markdownSummary", { enumerable: true, get: function () { return summary_2.markdownSummary; } });
+/**
+ * Path exports
+ */
+var path_utils_1 = require("./path-utils");
+Object.defineProperty(exports, "toPosixPath", { enumerable: true, get: function () { return path_utils_1.toPosixPath; } });
+Object.defineProperty(exports, "toWin32Path", { enumerable: true, get: function () { return path_utils_1.toWin32Path; } });
+Object.defineProperty(exports, "toPlatformPath", { enumerable: true, get: function () { return path_utils_1.toPlatformPath; } });
+//# sourceMappingURL=core.js.map

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/file-command.d.ts

@@ -0,0 +1,2 @@
+export declare function issueFileCommand(command: string, message: any): void;
+export declare function prepareKeyValueMessage(key: string, value: any): string;

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/file-command.js

@@ -0,0 +1,58 @@
+"use strict";
+// For internal use, subject to change.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareKeyValueMessage = exports.issueFileCommand = void 0;
+// We use any as a valid input type
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const uuid_1 = require("uuid");
+const utils_1 = require("./utils");
+function issueFileCommand(command, message) {
+    const filePath = process.env[`GITHUB_${command}`];
+    if (!filePath) {
+        throw new Error(`Unable to find environment variable for file command ${command}`);
+    }
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`Missing file at path: ${filePath}`);
+    }
+    fs.appendFileSync(filePath, `${utils_1.toCommandValue(message)}${os.EOL}`, {
+        encoding: 'utf8'
+    });
+}
+exports.issueFileCommand = issueFileCommand;
+function prepareKeyValueMessage(key, value) {
+    const delimiter = `ghadelimiter_${uuid_1.v4()}`;
+    const convertedValue = utils_1.toCommandValue(value);
+    // These should realistically never happen, but just in case someone finds a
+    // way to exploit uuid generation let's not allow keys or values that contain
+    // the delimiter.
+    if (key.includes(delimiter)) {
+        throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter}"`);
+    }
+    if (convertedValue.includes(delimiter)) {
+        throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
+    }
+    return `${key}<<${delimiter}${os.EOL}${convertedValue}${os.EOL}${delimiter}`;
+}
+exports.prepareKeyValueMessage = prepareKeyValueMessage;
+//# sourceMappingURL=file-command.js.map

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/file-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-command.js","sourceRoot":"","sources":["../src/file-command.ts"],"names":[],"mappings":";AAAA,uCAAuC;;;;;;;;;;;;;;;;;;;;;;AAEvC,mCAAmC;AACnC,uDAAuD;AAEvD,uCAAwB;AACxB,uCAAwB;AACxB,+BAAiC;AACjC,mCAAsC;AAEtC,SAAgB,gBAAgB,CAAC,OAAe,EAAE,OAAY;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;IACjD,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,IAAI,KAAK,CACb,wDAAwD,OAAO,EAAE,CAClE,CAAA;KACF;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;KACrD;IAED,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,sBAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QACjE,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAA;AACJ,CAAC;AAdD,4CAcC;AAED,SAAgB,sBAAsB,CAAC,GAAW,EAAE,KAAU;IAC5D,MAAM,SAAS,GAAG,gBAAgB,SAAM,EAAE,EAAE,CAAA;IAC5C,MAAM,cAAc,GAAG,sBAAc,CAAC,KAAK,CAAC,CAAA;IAE5C,4EAA4E;IAC5E,6EAA6E;IAC7E,iBAAiB;IACjB,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,GAAG,CACzE,CAAA;KACF;IAED,IAAI,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;QACtC,MAAM,IAAI,KAAK,CACb,6DAA6D,SAAS,GAAG,CAC1E,CAAA;KACF;IAED,OAAO,GAAG,GAAG,KAAK,SAAS,GAAG,EAAE,CAAC,GAAG,GAAG,cAAc,GAAG,EAAE,CAAC,GAAG,GAAG,SAAS,EAAE,CAAA;AAC9E,CAAC;AApBD,wDAoBC"}

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/oidc-utils.d.ts

@@ -0,0 +1,7 @@
+export declare class OidcClient {
+    private static createHttpClient;
+    private static getRequestToken;
+    private static getIDTokenUrl;
+    private static getCall;
+    static getIDToken(audience?: string): Promise<string>;
+}

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/oidc-utils.js

@@ -0,0 +1,77 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcClient = void 0;
+const http_client_1 = require("@actions/http-client");
+const auth_1 = require("@actions/http-client/lib/auth");
+const core_1 = require("./core");
+class OidcClient {
+    static createHttpClient(allowRetry = true, maxRetry = 10) {
+        const requestOptions = {
+            allowRetries: allowRetry,
+            maxRetries: maxRetry
+        };
+        return new http_client_1.HttpClient('actions/oidc-client', [new auth_1.BearerCredentialHandler(OidcClient.getRequestToken())], requestOptions);
+    }
+    static getRequestToken() {
+        const token = process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'];
+        if (!token) {
+            throw new Error('Unable to get ACTIONS_ID_TOKEN_REQUEST_TOKEN env variable');
+        }
+        return token;
+    }
+    static getIDTokenUrl() {
+        const runtimeUrl = process.env['ACTIONS_ID_TOKEN_REQUEST_URL'];
+        if (!runtimeUrl) {
+            throw new Error('Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable');
+        }
+        return runtimeUrl;
+    }
+    static getCall(id_token_url) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const httpclient = OidcClient.createHttpClient();
+            const res = yield httpclient
+                .getJson(id_token_url)
+                .catch(error => {
+                throw new Error(`Failed to get ID Token. \n 
+        Error Code : ${error.statusCode}\n 
+        Error Message: ${error.result.message}`);
+            });
+            const id_token = (_a = res.result) === null || _a === void 0 ? void 0 : _a.value;
+            if (!id_token) {
+                throw new Error('Response json body do not have ID Token field');
+            }
+            return id_token;
+        });
+    }
+    static getIDToken(audience) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                // New ID Token is requested from action service
+                let id_token_url = OidcClient.getIDTokenUrl();
+                if (audience) {
+                    const encodedAudience = encodeURIComponent(audience);
+                    id_token_url = `${id_token_url}&audience=${encodedAudience}`;
+                }
+                core_1.debug(`ID token url is ${id_token_url}`);
+                const id_token = yield OidcClient.getCall(id_token_url);
+                core_1.setSecret(id_token);
+                return id_token;
+            }
+            catch (error) {
+                throw new Error(`Error message: ${error.message}`);
+            }
+        });
+    }
+}
+exports.OidcClient = OidcClient;
+//# sourceMappingURL=oidc-utils.js.map

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/oidc-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-utils.js","sourceRoot":"","sources":["../src/oidc-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,sDAA+C;AAC/C,wDAAqE;AACrE,iCAAuC;AAKvC,MAAa,UAAU;IACb,MAAM,CAAC,gBAAgB,CAC7B,UAAU,GAAG,IAAI,EACjB,QAAQ,GAAG,EAAE;QAEb,MAAM,cAAc,GAAmB;YACrC,YAAY,EAAE,UAAU;YACxB,UAAU,EAAE,QAAQ;SACrB,CAAA;QAED,OAAO,IAAI,wBAAU,CACnB,qBAAqB,EACrB,CAAC,IAAI,8BAAuB,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,EAC3D,cAAc,CACf,CAAA;IACH,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;QAC3D,IAAI,CAAC,KAAK,EAAE;YACV,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAA;SACF;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,MAAM,CAAC,aAAa;QAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAA;QAC9D,IAAI,CAAC,UAAU,EAAE;YACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;SAC3E;QACD,OAAO,UAAU,CAAA;IACnB,CAAC;IAEO,MAAM,CAAO,OAAO,CAAC,YAAoB;;;YAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAA;YAEhD,MAAM,GAAG,GAAG,MAAM,UAAU;iBACzB,OAAO,CAAgB,YAAY,CAAC;iBACpC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACb,MAAM,IAAI,KAAK,CACb;uBACa,KAAK,CAAC,UAAU;yBACd,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CACtC,CAAA;YACH,CAAC,CAAC,CAAA;YAEJ,MAAM,QAAQ,SAAG,GAAG,CAAC,MAAM,0CAAE,KAAK,CAAA;YAClC,IAAI,CAAC,QAAQ,EAAE;gBACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;aACjE;YACD,OAAO,QAAQ,CAAA;;KAChB;IAED,MAAM,CAAO,UAAU,CAAC,QAAiB;;YACvC,IAAI;gBACF,gDAAgD;gBAChD,IAAI,YAAY,GAAW,UAAU,CAAC,aAAa,EAAE,CAAA;gBACrD,IAAI,QAAQ,EAAE;oBACZ,MAAM,eAAe,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;oBACpD,YAAY,GAAG,GAAG,YAAY,aAAa,eAAe,EAAE,CAAA;iBAC7D;gBAED,YAAK,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAA;gBAExC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBACvD,gBAAS,CAAC,QAAQ,CAAC,CAAA;gBACnB,OAAO,QAAQ,CAAA;aAChB;YAAC,OAAO,KAAK,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;aACnD;QACH,CAAC;KAAA;CACF;AAzED,gCAyEC"}

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/path-utils.d.ts

@@ -0,0 +1,25 @@
+/**
+ * toPosixPath converts the given path to the posix form. On Windows, \\ will be
+ * replaced with /.
+ *
+ * @param pth. Path to transform.
+ * @return string Posix path.
+ */
+export declare function toPosixPath(pth: string): string;
+/**
+ * toWin32Path converts the given path to the win32 form. On Linux, / will be
+ * replaced with \\.
+ *
+ * @param pth. Path to transform.
+ * @return string Win32 path.
+ */
+export declare function toWin32Path(pth: string): string;
+/**
+ * toPlatformPath converts the given path to a platform-specific path. It does
+ * this by replacing instances of / and \ with the platform-specific path
+ * separator.
+ *
+ * @param pth The path to platformize.
+ * @return string The platform-specific path.
+ */
+export declare function toPlatformPath(pth: string): string;

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/path-utils.js

@@ -0,0 +1,58 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPlatformPath = exports.toWin32Path = exports.toPosixPath = void 0;
+const path = __importStar(require("path"));
+/**
+ * toPosixPath converts the given path to the posix form. On Windows, \\ will be
+ * replaced with /.
+ *
+ * @param pth. Path to transform.
+ * @return string Posix path.
+ */
+function toPosixPath(pth) {
+    return pth.replace(/[\\]/g, '/');
+}
+exports.toPosixPath = toPosixPath;
+/**
+ * toWin32Path converts the given path to the win32 form. On Linux, / will be
+ * replaced with \\.
+ *
+ * @param pth. Path to transform.
+ * @return string Win32 path.
+ */
+function toWin32Path(pth) {
+    return pth.replace(/[/]/g, '\\');
+}
+exports.toWin32Path = toWin32Path;
+/**
+ * toPlatformPath converts the given path to a platform-specific path. It does
+ * this by replacing instances of / and \ with the platform-specific path
+ * separator.
+ *
+ * @param pth The path to platformize.
+ * @return string The platform-specific path.
+ */
+function toPlatformPath(pth) {
+    return pth.replace(/[/\\]/g, path.sep);
+}
+exports.toPlatformPath = toPlatformPath;
+//# sourceMappingURL=path-utils.js.map

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/path-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-utils.js","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4B;AAE5B;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AAClC,CAAC;AAFD,kCAEC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC;AAFD,kCAEC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;AACxC,CAAC;AAFD,wCAEC"}

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/summary.d.ts

@@ -0,0 +1,202 @@
+export declare const SUMMARY_ENV_VAR = "GITHUB_STEP_SUMMARY";
+export declare const SUMMARY_DOCS_URL = "https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary";
+export declare type SummaryTableRow = (SummaryTableCell | string)[];
+export interface SummaryTableCell {
+    /**
+     * Cell content
+     */
+    data: string;
+    /**
+     * Render cell as header
+     * (optional) default: false
+     */
+    header?: boolean;
+    /**
+     * Number of columns the cell extends
+     * (optional) default: '1'
+     */
+    colspan?: string;
+    /**
+     * Number of rows the cell extends
+     * (optional) default: '1'
+     */
+    rowspan?: string;
+}
+export interface SummaryImageOptions {
+    /**
+     * The width of the image in pixels. Must be an integer without a unit.
+     * (optional)
+     */
+    width?: string;
+    /**
+     * The height of the image in pixels. Must be an integer without a unit.
+     * (optional)
+     */
+    height?: string;
+}
+export interface SummaryWriteOptions {
+    /**
+     * Replace all existing content in summary file with buffer contents
+     * (optional) default: false
+     */
+    overwrite?: boolean;
+}
+declare class Summary {
+    private _buffer;
+    private _filePath?;
+    constructor();
+    /**
+     * Finds the summary file path from the environment, rejects if env var is not found or file does not exist
+     * Also checks r/w permissions.
+     *
+     * @returns step summary file path
+     */
+    private filePath;
+    /**
+     * Wraps content in an HTML tag, adding any HTML attributes
+     *
+     * @param {string} tag HTML tag to wrap
+     * @param {string | null} content content within the tag
+     * @param {[attribute: string]: string} attrs key-value list of HTML attributes to add
+     *
+     * @returns {string} content wrapped in HTML element
+     */
+    private wrap;
+    /**
+     * Writes text in the buffer to the summary buffer file and empties buffer. Will append by default.
+     *
+     * @param {SummaryWriteOptions} [options] (optional) options for write operation
+     *
+     * @returns {Promise<Summary>} summary instance
+     */
+    write(options?: SummaryWriteOptions): Promise<Summary>;
+    /**
+     * Clears the summary buffer and wipes the summary file
+     *
+     * @returns {Summary} summary instance
+     */
+    clear(): Promise<Summary>;
+    /**
+     * Returns the current summary buffer as a string
+     *
+     * @returns {string} string of summary buffer
+     */
+    stringify(): string;
+    /**
+     * If the summary buffer is empty
+     *
+     * @returns {boolen} true if the buffer is empty
+     */
+    isEmptyBuffer(): boolean;
+    /**
+     * Resets the summary buffer without writing to summary file
+     *
+     * @returns {Summary} summary instance
+     */
+    emptyBuffer(): Summary;
+    /**
+     * Adds raw text to the summary buffer
+     *
+     * @param {string} text content to add
+     * @param {boolean} [addEOL=false] (optional) append an EOL to the raw text (default: false)
+     *
+     * @returns {Summary} summary instance
+     */
+    addRaw(text: string, addEOL?: boolean): Summary;
+    /**
+     * Adds the operating system-specific end-of-line marker to the buffer
+     *
+     * @returns {Summary} summary instance
+     */
+    addEOL(): Summary;
+    /**
+     * Adds an HTML codeblock to the summary buffer
+     *
+     * @param {string} code content to render within fenced code block
+     * @param {string} lang (optional) language to syntax highlight code
+     *
+     * @returns {Summary} summary instance
+     */
+    addCodeBlock(code: string, lang?: string): Summary;
+    /**
+     * Adds an HTML list to the summary buffer
+     *
+     * @param {string[]} items list of items to render
+     * @param {boolean} [ordered=false] (optional) if the rendered list should be ordered or not (default: false)
+     *
+     * @returns {Summary} summary instance
+     */
+    addList(items: string[], ordered?: boolean): Summary;
+    /**
+     * Adds an HTML table to the summary buffer
+     *
+     * @param {SummaryTableCell[]} rows table rows
+     *
+     * @returns {Summary} summary instance
+     */
+    addTable(rows: SummaryTableRow[]): Summary;
+    /**
+     * Adds a collapsable HTML details element to the summary buffer
+     *
+     * @param {string} label text for the closed state
+     * @param {string} content collapsable content
+     *
+     * @returns {Summary} summary instance
+     */
+    addDetails(label: string, content: string): Summary;
+    /**
+     * Adds an HTML image tag to the summary buffer
+     *
+     * @param {string} src path to the image you to embed
+     * @param {string} alt text description of the image
+     * @param {SummaryImageOptions} options (optional) addition image attributes
+     *
+     * @returns {Summary} summary instance
+     */
+    addImage(src: string, alt: string, options?: SummaryImageOptions): Summary;
+    /**
+     * Adds an HTML section heading element
+     *
+     * @param {string} text heading text
+     * @param {number | string} [level=1] (optional) the heading level, default: 1
+     *
+     * @returns {Summary} summary instance
+     */
+    addHeading(text: string, level?: number | string): Summary;
+    /**
+     * Adds an HTML thematic break (<hr>) to the summary buffer
+     *
+     * @returns {Summary} summary instance
+     */
+    addSeparator(): Summary;
+    /**
+     * Adds an HTML line break (<br>) to the summary buffer
+     *
+     * @returns {Summary} summary instance
+     */
+    addBreak(): Summary;
+    /**
+     * Adds an HTML blockquote to the summary buffer
+     *
+     * @param {string} text quote text
+     * @param {string} cite (optional) citation url
+     *
+     * @returns {Summary} summary instance
+     */
+    addQuote(text: string, cite?: string): Summary;
+    /**
+     * Adds an HTML anchor tag to the summary buffer
+     *
+     * @param {string} text link text/content
+     * @param {string} href hyperlink
+     *
+     * @returns {Summary} summary instance
+     */
+    addLink(text: string, href: string): Summary;
+}
+/**
+ * @deprecated use `core.summary`
+ */
+export declare const markdownSummary: Summary;
+export declare const summary: Summary;
+export {};

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/summary.js

@@ -0,0 +1,283 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.summary = exports.markdownSummary = exports.SUMMARY_DOCS_URL = exports.SUMMARY_ENV_VAR = void 0;
+const os_1 = require("os");
+const fs_1 = require("fs");
+const { access, appendFile, writeFile } = fs_1.promises;
+exports.SUMMARY_ENV_VAR = 'GITHUB_STEP_SUMMARY';
+exports.SUMMARY_DOCS_URL = 'https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary';
+class Summary {
+    constructor() {
+        this._buffer = '';
+    }
+    /**
+     * Finds the summary file path from the environment, rejects if env var is not found or file does not exist
+     * Also checks r/w permissions.
+     *
+     * @returns step summary file path
+     */
+    filePath() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this._filePath) {
+                return this._filePath;
+            }
+            const pathFromEnv = process.env[exports.SUMMARY_ENV_VAR];
+            if (!pathFromEnv) {
+                throw new Error(`Unable to find environment variable for $${exports.SUMMARY_ENV_VAR}. Check if your runtime environment supports job summaries.`);
+            }
+            try {
+                yield access(pathFromEnv, fs_1.constants.R_OK | fs_1.constants.W_OK);
+            }
+            catch (_a) {
+                throw new Error(`Unable to access summary file: '${pathFromEnv}'. Check if the file has correct read/write permissions.`);
+            }
+            this._filePath = pathFromEnv;
+            return this._filePath;
+        });
+    }
+    /**
+     * Wraps content in an HTML tag, adding any HTML attributes
+     *
+     * @param {string} tag HTML tag to wrap
+     * @param {string | null} content content within the tag
+     * @param {[attribute: string]: string} attrs key-value list of HTML attributes to add
+     *
+     * @returns {string} content wrapped in HTML element
+     */
+    wrap(tag, content, attrs = {}) {
+        const htmlAttrs = Object.entries(attrs)
+            .map(([key, value]) => ` ${key}="${value}"`)
+            .join('');
+        if (!content) {
+            return `<${tag}${htmlAttrs}>`;
+        }
+        return `<${tag}${htmlAttrs}>${content}</${tag}>`;
+    }
+    /**
+     * Writes text in the buffer to the summary buffer file and empties buffer. Will append by default.
+     *
+     * @param {SummaryWriteOptions} [options] (optional) options for write operation
+     *
+     * @returns {Promise<Summary>} summary instance
+     */
+    write(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const overwrite = !!(options === null || options === void 0 ? void 0 : options.overwrite);
+            const filePath = yield this.filePath();
+            const writeFunc = overwrite ? writeFile : appendFile;
+            yield writeFunc(filePath, this._buffer, { encoding: 'utf8' });
+            return this.emptyBuffer();
+        });
+    }
+    /**
+     * Clears the summary buffer and wipes the summary file
+     *
+     * @returns {Summary} summary instance
+     */
+    clear() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.emptyBuffer().write({ overwrite: true });
+        });
+    }
+    /**
+     * Returns the current summary buffer as a string
+     *
+     * @returns {string} string of summary buffer
+     */
+    stringify() {
+        return this._buffer;
+    }
+    /**
+     * If the summary buffer is empty
+     *
+     * @returns {boolen} true if the buffer is empty
+     */
+    isEmptyBuffer() {
+        return this._buffer.length === 0;
+    }
+    /**
+     * Resets the summary buffer without writing to summary file
+     *
+     * @returns {Summary} summary instance
+     */
+    emptyBuffer() {
+        this._buffer = '';
+        return this;
+    }
+    /**
+     * Adds raw text to the summary buffer
+     *
+     * @param {string} text content to add
+     * @param {boolean} [addEOL=false] (optional) append an EOL to the raw text (default: false)
+     *
+     * @returns {Summary} summary instance
+     */
+    addRaw(text, addEOL = false) {
+        this._buffer += text;
+        return addEOL ? this.addEOL() : this;
+    }
+    /**
+     * Adds the operating system-specific end-of-line marker to the buffer
+     *
+     * @returns {Summary} summary instance
+     */
+    addEOL() {
+        return this.addRaw(os_1.EOL);
+    }
+    /**
+     * Adds an HTML codeblock to the summary buffer
+     *
+     * @param {string} code content to render within fenced code block
+     * @param {string} lang (optional) language to syntax highlight code
+     *
+     * @returns {Summary} summary instance
+     */
+    addCodeBlock(code, lang) {
+        const attrs = Object.assign({}, (lang && { lang }));
+        const element = this.wrap('pre', this.wrap('code', code), attrs);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML list to the summary buffer
+     *
+     * @param {string[]} items list of items to render
+     * @param {boolean} [ordered=false] (optional) if the rendered list should be ordered or not (default: false)
+     *
+     * @returns {Summary} summary instance
+     */
+    addList(items, ordered = false) {
+        const tag = ordered ? 'ol' : 'ul';
+        const listItems = items.map(item => this.wrap('li', item)).join('');
+        const element = this.wrap(tag, listItems);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML table to the summary buffer
+     *
+     * @param {SummaryTableCell[]} rows table rows
+     *
+     * @returns {Summary} summary instance
+     */
+    addTable(rows) {
+        const tableBody = rows
+            .map(row => {
+            const cells = row
+                .map(cell => {
+                if (typeof cell === 'string') {
+                    return this.wrap('td', cell);
+                }
+                const { header, data, colspan, rowspan } = cell;
+                const tag = header ? 'th' : 'td';
+                const attrs = Object.assign(Object.assign({}, (colspan && { colspan })), (rowspan && { rowspan }));
+                return this.wrap(tag, data, attrs);
+            })
+                .join('');
+            return this.wrap('tr', cells);
+        })
+            .join('');
+        const element = this.wrap('table', tableBody);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds a collapsable HTML details element to the summary buffer
+     *
+     * @param {string} label text for the closed state
+     * @param {string} content collapsable content
+     *
+     * @returns {Summary} summary instance
+     */
+    addDetails(label, content) {
+        const element = this.wrap('details', this.wrap('summary', label) + content);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML image tag to the summary buffer
+     *
+     * @param {string} src path to the image you to embed
+     * @param {string} alt text description of the image
+     * @param {SummaryImageOptions} options (optional) addition image attributes
+     *
+     * @returns {Summary} summary instance
+     */
+    addImage(src, alt, options) {
+        const { width, height } = options || {};
+        const attrs = Object.assign(Object.assign({}, (width && { width })), (height && { height }));
+        const element = this.wrap('img', null, Object.assign({ src, alt }, attrs));
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML section heading element
+     *
+     * @param {string} text heading text
+     * @param {number | string} [level=1] (optional) the heading level, default: 1
+     *
+     * @returns {Summary} summary instance
+     */
+    addHeading(text, level) {
+        const tag = `h${level}`;
+        const allowedTag = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6'].includes(tag)
+            ? tag
+            : 'h1';
+        const element = this.wrap(allowedTag, text);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML thematic break (<hr>) to the summary buffer
+     *
+     * @returns {Summary} summary instance
+     */
+    addSeparator() {
+        const element = this.wrap('hr', null);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML line break (<br>) to the summary buffer
+     *
+     * @returns {Summary} summary instance
+     */
+    addBreak() {
+        const element = this.wrap('br', null);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML blockquote to the summary buffer
+     *
+     * @param {string} text quote text
+     * @param {string} cite (optional) citation url
+     *
+     * @returns {Summary} summary instance
+     */
+    addQuote(text, cite) {
+        const attrs = Object.assign({}, (cite && { cite }));
+        const element = this.wrap('blockquote', text, attrs);
+        return this.addRaw(element).addEOL();
+    }
+    /**
+     * Adds an HTML anchor tag to the summary buffer
+     *
+     * @param {string} text link text/content
+     * @param {string} href hyperlink
+     *
+     * @returns {Summary} summary instance
+     */
+    addLink(text, href) {
+        const element = this.wrap('a', text, { href });
+        return this.addRaw(element).addEOL();
+    }
+}
+const _summary = new Summary();
+/**
+ * @deprecated use `core.summary`
+ */
+exports.markdownSummary = _summary;
+exports.summary = _summary;
+//# sourceMappingURL=summary.js.map

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/utils.d.ts

@@ -0,0 +1,14 @@
+import { AnnotationProperties } from './core';
+import { CommandProperties } from './command';
+/**
+ * Sanitizes an input into a string so it can be passed into issueCommand safely
+ * @param input input to sanitize into a string
+ */
+export declare function toCommandValue(input: any): string;
+/**
+ *
+ * @param annotationProperties
+ * @returns The command properties to send with the actual annotation command
+ * See IssueCommandProperties: https://github.com/actions/runner/blob/main/src/Runner.Worker/ActionCommandManager.cs#L646
+ */
+export declare function toCommandProperties(annotationProperties: AnnotationProperties): CommandProperties;

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/utils.js

@@ -0,0 +1,40 @@
+"use strict";
+// We use any as a valid input type
+/* eslint-disable @typescript-eslint/no-explicit-any */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toCommandProperties = exports.toCommandValue = void 0;
+/**
+ * Sanitizes an input into a string so it can be passed into issueCommand safely
+ * @param input input to sanitize into a string
+ */
+function toCommandValue(input) {
+    if (input === null || input === undefined) {
+        return '';
+    }
+    else if (typeof input === 'string' || input instanceof String) {
+        return input;
+    }
+    return JSON.stringify(input);
+}
+exports.toCommandValue = toCommandValue;
+/**
+ *
+ * @param annotationProperties
+ * @returns The command properties to send with the actual annotation command
+ * See IssueCommandProperties: https://github.com/actions/runner/blob/main/src/Runner.Worker/ActionCommandManager.cs#L646
+ */
+function toCommandProperties(annotationProperties) {
+    if (!Object.keys(annotationProperties).length) {
+        return {};
+    }
+    return {
+        title: annotationProperties.title,
+        file: annotationProperties.file,
+        line: annotationProperties.startLine,
+        endLine: annotationProperties.endLine,
+        col: annotationProperties.startColumn,
+        endColumn: annotationProperties.endColumn
+    };
+}
+exports.toCommandProperties = toCommandProperties;
+//# sourceMappingURL=utils.js.map

act/runner/testdata/actions/node12/node_modules/@actions/core/lib/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":";AAAA,mCAAmC;AACnC,uDAAuD;;;AAKvD;;;GAGG;AACH,SAAgB,cAAc,CAAC,KAAU;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE;QACzC,OAAO,EAAE,CAAA;KACV;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,MAAM,EAAE;QAC/D,OAAO,KAAe,CAAA;KACvB;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAPD,wCAOC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,oBAA0C;IAE1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE;QAC7C,OAAO,EAAE,CAAA;KACV;IAED,OAAO;QACL,KAAK,EAAE,oBAAoB,CAAC,KAAK;QACjC,IAAI,EAAE,oBAAoB,CAAC,IAAI;QAC/B,IAAI,EAAE,oBAAoB,CAAC,SAAS;QACpC,OAAO,EAAE,oBAAoB,CAAC,OAAO;QACrC,GAAG,EAAE,oBAAoB,CAAC,WAAW;QACrC,SAAS,EAAE,oBAAoB,CAAC,SAAS;KAC1C,CAAA;AACH,CAAC;AAfD,kDAeC"}

act/runner/testdata/actions/node12/node_modules/@actions/core/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@actions/core",
+  "version": "1.10.0",
+  "description": "Actions core lib",
+  "keywords": [
+    "github",
+    "actions",
+    "core"
+  ],
+  "homepage": "https://github.com/actions/toolkit/tree/main/packages/core",
+  "license": "MIT",
+  "main": "lib/core.js",
+  "types": "lib/core.d.ts",
+  "directories": {
+    "lib": "lib",
+    "test": "__tests__"
+  },
+  "files": [
+    "lib",
+    "!.DS_Store"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/toolkit.git",
+    "directory": "packages/core"
+  },
+  "scripts": {
+    "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json",
+    "test": "echo \"Error: run tests from root\" && exit 1",
+    "tsc": "tsc"
+  },
+  "bugs": {
+    "url": "https://github.com/actions/toolkit/issues"
+  },
+  "dependencies": {
+    "@actions/http-client": "^2.0.1",
+    "uuid": "^8.3.2"
+  },
+  "devDependencies": {
+    "@types/node": "^12.0.2",
+    "@types/uuid": "^8.3.4"
+  }
+}

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/context.d.ts

@@ -0,0 +1,29 @@
+import { WebhookPayload } from './interfaces';
+export declare class Context {
+    /**
+     * Webhook payload object that triggered the workflow
+     */
+    payload: WebhookPayload;
+    eventName: string;
+    sha: string;
+    ref: string;
+    workflow: string;
+    action: string;
+    actor: string;
+    job: string;
+    runNumber: number;
+    runId: number;
+    /**
+     * Hydrate the context from the environment
+     */
+    constructor();
+    get issue(): {
+        owner: string;
+        repo: string;
+        number: number;
+    };
+    get repo(): {
+        owner: string;
+        repo: string;
+    };
+}

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/context.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Context = void 0;
+const fs_1 = require("fs");
+const os_1 = require("os");
+class Context {
+    /**
+     * Hydrate the context from the environment
+     */
+    constructor() {
+        this.payload = {};
+        if (process.env.GITHUB_EVENT_PATH) {
+            if (fs_1.existsSync(process.env.GITHUB_EVENT_PATH)) {
+                this.payload = JSON.parse(fs_1.readFileSync(process.env.GITHUB_EVENT_PATH, { encoding: 'utf8' }));
+            }
+            else {
+                const path = process.env.GITHUB_EVENT_PATH;
+                process.stdout.write(`GITHUB_EVENT_PATH ${path} does not exist${os_1.EOL}`);
+            }
+        }
+        this.eventName = process.env.GITHUB_EVENT_NAME;
+        this.sha = process.env.GITHUB_SHA;
+        this.ref = process.env.GITHUB_REF;
+        this.workflow = process.env.GITHUB_WORKFLOW;
+        this.action = process.env.GITHUB_ACTION;
+        this.actor = process.env.GITHUB_ACTOR;
+        this.job = process.env.GITHUB_JOB;
+        this.runNumber = parseInt(process.env.GITHUB_RUN_NUMBER, 10);
+        this.runId = parseInt(process.env.GITHUB_RUN_ID, 10);
+    }
+    get issue() {
+        const payload = this.payload;
+        return Object.assign(Object.assign({}, this.repo), { number: (payload.issue || payload.pull_request || payload).number });
+    }
+    get repo() {
+        if (process.env.GITHUB_REPOSITORY) {
+            const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/');
+            return { owner, repo };
+        }
+        if (this.payload.repository) {
+            return {
+                owner: this.payload.repository.owner.login,
+                repo: this.payload.repository.name
+            };
+        }
+        throw new Error("context.repo requires a GITHUB_REPOSITORY environment variable like 'owner/repo'");
+    }
+}
+exports.Context = Context;
+//# sourceMappingURL=context.js.map

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;;AAEA,2BAA2C;AAC3C,2BAAsB;AAEtB,MAAa,OAAO;IAgBlB;;OAEG;IACH;QACE,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE;YACjC,IAAI,eAAU,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE;gBAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CACvB,iBAAY,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAC,QAAQ,EAAE,MAAM,EAAC,CAAC,CAChE,CAAA;aACF;iBAAM;gBACL,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;gBAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,kBAAkB,QAAG,EAAE,CAAC,CAAA;aACvE;SACF;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAA2B,CAAA;QACxD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAoB,CAAA;QAC3C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAoB,CAAA;QAC3C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAyB,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAuB,CAAA;QACjD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAsB,CAAA;QAC/C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAoB,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAA2B,EAAE,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAuB,EAAE,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,KAAK;QACP,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAE5B,uCACK,IAAI,CAAC,IAAI,KACZ,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,MAAM,IAClE;IACH,CAAC;IAED,IAAI,IAAI;QACN,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE;YACjC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9D,OAAO,EAAC,KAAK,EAAE,IAAI,EAAC,CAAA;SACrB;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;YAC3B,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK;gBAC1C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI;aACnC,CAAA;SACF;QAED,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAA;IACH,CAAC;CACF;AApED,0BAoEC"}

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/github.d.ts

@@ -0,0 +1,11 @@
+import * as Context from './context';
+import { GitHub } from './utils';
+import { OctokitOptions } from '@octokit/core/dist-types/types';
+export declare const context: Context.Context;
+/**
+ * Returns a hydrated octokit ready to use for GitHub Actions
+ *
+ * @param     token    the repo PAT or GITHUB_TOKEN
+ * @param     options  other options to set
+ */
+export declare function getOctokit(token: string, options?: OctokitOptions): InstanceType<typeof GitHub>;

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/github.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOctokit = exports.context = void 0;
+const Context = __importStar(require("./context"));
+const utils_1 = require("./utils");
+exports.context = new Context.Context();
+/**
+ * Returns a hydrated octokit ready to use for GitHub Actions
+ *
+ * @param     token    the repo PAT or GITHUB_TOKEN
+ * @param     options  other options to set
+ */
+function getOctokit(token, options) {
+    return new utils_1.GitHub(utils_1.getOctokitOptions(token, options));
+}
+exports.getOctokit = getOctokit;
+//# sourceMappingURL=github.js.map

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../src/github.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAoC;AACpC,mCAAiD;AAKpC,QAAA,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;AAE5C;;;;;GAKG;AACH,SAAgB,UAAU,CACxB,KAAa,EACb,OAAwB;IAExB,OAAO,IAAI,cAAM,CAAC,yBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;AACtD,CAAC;AALD,gCAKC"}

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/interfaces.d.ts

@@ -0,0 +1,40 @@
+export interface PayloadRepository {
+    [key: string]: any;
+    full_name?: string;
+    name: string;
+    owner: {
+        [key: string]: any;
+        login: string;
+        name?: string;
+    };
+    html_url?: string;
+}
+export interface WebhookPayload {
+    [key: string]: any;
+    repository?: PayloadRepository;
+    issue?: {
+        [key: string]: any;
+        number: number;
+        html_url?: string;
+        body?: string;
+    };
+    pull_request?: {
+        [key: string]: any;
+        number: number;
+        html_url?: string;
+        body?: string;
+    };
+    sender?: {
+        [key: string]: any;
+        type: string;
+    };
+    action?: string;
+    installation?: {
+        id: number;
+        [key: string]: any;
+    };
+    comment?: {
+        id: number;
+        [key: string]: any;
+    };
+}

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/interfaces.js

@@ -0,0 +1,4 @@
+"use strict";
+/* eslint-disable @typescript-eslint/no-explicit-any */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=interfaces.js.map

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":";AAAA,uDAAuD"}

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/internal/utils.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="node" />
+import * as http from 'http';
+import { OctokitOptions } from '@octokit/core/dist-types/types';
+export declare function getAuthString(token: string, options: OctokitOptions): string | undefined;
+export declare function getProxyAgent(destinationUrl: string): http.Agent;
+export declare function getApiBaseUrl(): string;

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/internal/utils.js

@@ -0,0 +1,43 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getApiBaseUrl = exports.getProxyAgent = exports.getAuthString = void 0;
+const httpClient = __importStar(require("@actions/http-client"));
+function getAuthString(token, options) {
+    if (!token && !options.auth) {
+        throw new Error('Parameter token or opts.auth is required');
+    }
+    else if (token && options.auth) {
+        throw new Error('Parameters token and opts.auth may not both be specified');
+    }
+    return typeof options.auth === 'string' ? options.auth : `token ${token}`;
+}
+exports.getAuthString = getAuthString;
+function getProxyAgent(destinationUrl) {
+    const hc = new httpClient.HttpClient();
+    return hc.getAgent(destinationUrl);
+}
+exports.getProxyAgent = getProxyAgent;
+function getApiBaseUrl() {
+    return process.env['GITHUB_API_URL'] || 'https://api.github.com';
+}
+exports.getApiBaseUrl = getApiBaseUrl;
+//# sourceMappingURL=utils.js.map

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/internal/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/internal/utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AACA,iEAAkD;AAGlD,SAAgB,aAAa,CAC3B,KAAa,EACb,OAAuB;IAEvB,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;KAC5D;SAAM,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE;QAChC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;KAC5E;IAED,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAA;AAC3E,CAAC;AAXD,sCAWC;AAED,SAAgB,aAAa,CAAC,cAAsB;IAClD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,UAAU,EAAE,CAAA;IACtC,OAAO,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;AACpC,CAAC;AAHD,sCAGC;AAED,SAAgB,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,wBAAwB,CAAA;AAClE,CAAC;AAFD,sCAEC"}

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/utils.d.ts

@@ -0,0 +1,21 @@
+import * as Context from './context';
+import { Octokit } from '@octokit/core';
+import { OctokitOptions } from '@octokit/core/dist-types/types';
+export declare const context: Context.Context;
+export declare const GitHub: (new (...args: any[]) => {
+    [x: string]: any;
+}) & {
+    new (...args: any[]): {
+        [x: string]: any;
+    };
+    plugins: any[];
+} & typeof Octokit & import("@octokit/core/dist-types/types").Constructor<import("@octokit/plugin-rest-endpoint-methods/dist-types/generated/method-types").RestEndpointMethods & {
+    paginate: import("@octokit/plugin-paginate-rest").PaginateInterface;
+}>;
+/**
+ * Convience function to correctly format Octokit Options to pass into the constructor.
+ *
+ * @param     token    the repo PAT or GITHUB_TOKEN
+ * @param     options  other options to set
+ */
+export declare function getOctokitOptions(token: string, options?: OctokitOptions): OctokitOptions;

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/utils.js

@@ -0,0 +1,54 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOctokitOptions = exports.GitHub = exports.context = void 0;
+const Context = __importStar(require("./context"));
+const Utils = __importStar(require("./internal/utils"));
+// octokit + plugins
+const core_1 = require("@octokit/core");
+const plugin_rest_endpoint_methods_1 = require("@octokit/plugin-rest-endpoint-methods");
+const plugin_paginate_rest_1 = require("@octokit/plugin-paginate-rest");
+exports.context = new Context.Context();
+const baseUrl = Utils.getApiBaseUrl();
+const defaults = {
+    baseUrl,
+    request: {
+        agent: Utils.getProxyAgent(baseUrl)
+    }
+};
+exports.GitHub = core_1.Octokit.plugin(plugin_rest_endpoint_methods_1.restEndpointMethods, plugin_paginate_rest_1.paginateRest).defaults(defaults);
+/**
+ * Convience function to correctly format Octokit Options to pass into the constructor.
+ *
+ * @param     token    the repo PAT or GITHUB_TOKEN
+ * @param     options  other options to set
+ */
+function getOctokitOptions(token, options) {
+    const opts = Object.assign({}, options || {}); // Shallow clone - don't mutate the object provided by the caller
+    // Auth
+    const auth = Utils.getAuthString(token, opts);
+    if (auth) {
+        opts.auth = auth;
+    }
+    return opts;
+}
+exports.getOctokitOptions = getOctokitOptions;
+//# sourceMappingURL=utils.js.map

act/runner/testdata/actions/node12/node_modules/@actions/github/lib/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAoC;AACpC,wDAAyC;AAEzC,oBAAoB;AACpB,wCAAqC;AAErC,wFAAyE;AACzE,wEAA0D;AAE7C,QAAA,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;AAE5C,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,CAAA;AACrC,MAAM,QAAQ,GAAG;IACf,OAAO;IACP,OAAO,EAAE;QACP,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC;KACpC;CACF,CAAA;AAEY,QAAA,MAAM,GAAG,cAAO,CAAC,MAAM,CAClC,kDAAmB,EACnB,mCAAY,CACb,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAEpB;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,OAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,IAAI,EAAE,CAAC,CAAA,CAAC,iEAAiE;IAE/G,OAAO;IACP,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC7C,IAAI,IAAI,EAAE;QACR,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;KACjB;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAbD,8CAaC"}