mirror of
https://gitea.com/gitea/act_runner.git
synced 2026-11-02 21:38:42 +08:00
fe2a66dc25
Contains a number of small bug fixes where jobs behaved differently from GitHub or failed silently.
1. Hooks fail on a refused `::set-env::` or `::add-path::` and no longer inherit the last step's identity
1. Docker build, exec and wait errors are returned instead of swallowed, token-only registry credentials work, logs of `--tty` services decode
1. Env files split lines like GitHub on each OS, so a carriage return is kept on Linux and CRLF ends a line on Windows, empty heredoc names or delimiters are rejected
1. Post steps run after their pre step even when main was skipped, composites see undeclared inputs, `runs.args` wins without `with.args` being parsed
1. Docker actions skip evaluating defaults of inputs given in `with` and read `entryPoint` and `args` in any case, a lowercase `dockerfile` is found, undeclared inputs get GitHub's warning
1. A user-set `CI` is kept, `GITHUB_REPOSITORY_ID` and the other missing `GITHUB_*` variables are exported
1. `timeout-minutes` can read the step's own `env`, a step-level `ACTIONS_ALLOW_UNSECURE_COMMANDS: false` beats a job-level `true` while the runner's own opt-in still wins, `pwsh` quotes the script path
1. A step `env:` given as one expression such as `${{ fromJSON(matrix.env) }}` is applied, `hashFiles` fails with GitHub's messages on script errors and after 120 seconds, a job image without node still gets an empty hash
1. A step whose command files cannot be reset fails instead of importing stale ones, a timeout between steps fails the job instead of reporting success
1. One named volume can be mounted at several paths, host-mode PTY steps keep their last output when they fail, host scratch directories are removed when job setup fails
1. Cancelling a step right after it starts kills its whole process tree
1. Cache prefix restores pick the newest entry created within the same second, also on S3, cache commits with a wrong size are rejected
1. Artifact chunks are written at their offset, download URLs are escaped, listing a run without artifacts no longer crashes
1. Poll backoff reaches `fetch_interval_max`, proxy passwords are masked in more forms, secrets are also masked in step names and in their quoted form in the runner log, a failed final report is logged
1. On Windows hosts a differently cased unsecure-commands opt-in or proxy variable counts, and an early cancel no longer leaks a job object handle
1. Interactive `register` prompts for a missing token and stops on SIGTERM, `exec --list --detect-event` no longer panics without events, `config set` works on `cache.s3` keys
Reviewed-on: https://gitea.com/gitea/runner/pulls/1338
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
72 lines
2.1 KiB
Go
72 lines
2.1 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package report
|
|
|
|
import (
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
"gitea.com/gitea/runner/act/common/logging"
|
|
"gitea.com/gitea/runner/act/runner"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestGlobalMasks(t *testing.T) {
|
|
prevOut := logging.Output()
|
|
t.Cleanup(func() {
|
|
logging.SetOutput(prevOut)
|
|
logging.SetTextFormat(logging.TextOptions{})
|
|
})
|
|
var out strings.Builder
|
|
logging.SetOutput(&out)
|
|
logging.SetTextFormat(logging.TextOptions{DisableTimestamp: true, Filter: MaskGlobal})
|
|
format := func(job string) string {
|
|
out.Reset()
|
|
logging.With("job", job).Info("line")
|
|
return out.String()
|
|
}
|
|
register := func(oldnew ...string) *Reporter {
|
|
r := &Reporter{oldnew: oldnew}
|
|
registerGlobalMasks(r)
|
|
t.Cleanup(func() { deregisterGlobalMasks(r) })
|
|
return r
|
|
}
|
|
|
|
assert.Contains(t, format("build s3cr3t"), "s3cr3t")
|
|
|
|
first := register("s3cr3t", "***")
|
|
second := register("other", "***", "otherlonger", "***")
|
|
|
|
line := format("build s3cr3t and other")
|
|
assert.NotContains(t, line, "s3cr3t") // masked though it rode a field, not the message
|
|
assert.NotContains(t, line, "other")
|
|
assert.NotContains(t, format("otherlonger"), "longer") // longest first, so not "***longer"
|
|
|
|
deregisterGlobalMasks(first)
|
|
line = format("build s3cr3t and other")
|
|
assert.Contains(t, line, "s3cr3t")
|
|
assert.NotContains(t, line, "other") // the task still running keeps its own
|
|
|
|
deregisterGlobalMasks(second)
|
|
assert.Nil(t, globalReplacer.Load())
|
|
|
|
// A workflow could otherwise mask "error" here and rewrite every other task's log.
|
|
third := register("s3cr3t", "***")
|
|
var writers sync.WaitGroup
|
|
for _, mask := range []string{"runtime-secret", "another-secret"} {
|
|
writers.Go(func() { third.AddMask(mask) })
|
|
}
|
|
writers.Wait()
|
|
assert.Contains(t, format("saw runtime-secret"), "runtime-secret")
|
|
assert.Equal(t, "saw *** ***", third.mask("saw runtime-secret another-secret"))
|
|
|
|
secret := "pass\a\v\x1b\u00a0word"
|
|
register(runner.AppendSecretMasker(nil, secret)...)
|
|
out.Reset()
|
|
logging.With("token", secret).Info(secret)
|
|
assert.Equal(t, "level=info msg=\"***\" token=\"***\"\n", out.String())
|
|
}
|