hinterland/hearth
2
2
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: update gitea vendor
runner nix smoke / nix label and flake smoke (push) Failing after 1m28s
Details

Browse Source
This commit is contained in:
yukkop
2026-09-26 21:18:24 +00:00
parent c439c1b948
commit d9b2a4e787
3538 changed files with 116131 additions and 44340 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package/gitea/source/models/secret/main_test.go
+14
View File
@@ -0,0 +1,14 @@
// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package secret
import (
"testing"
"gitea.dev/models/unittest"
)
func TestMain(m *testing.M) {
unittest.MainTest(m)
}
package/gitea/source/models/secret/secret.go
+66 -14
View File
@@ -8,14 +8,16 @@ import (
"fmt"
"strings"
actions_model "code.gitea.io/gitea/models/actions"
"code.gitea.io/gitea/models/db"
actions_module "code.gitea.io/gitea/modules/actions"
"code.gitea.io/gitea/modules/log"
secret_module "code.gitea.io/gitea/modules/secret"
"code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/modules/timeutil"
"code.gitea.io/gitea/modules/util"
actions_model "gitea.dev/models/actions"
"gitea.dev/models/db"
actions_module "gitea.dev/modules/actions"
"gitea.dev/modules/actions/jobparser"
"gitea.dev/modules/json"
"gitea.dev/modules/log"
secret_module "gitea.dev/modules/secret"
"gitea.dev/modules/setting"
"gitea.dev/modules/timeutil"
"gitea.dev/modules/util"
"xorm.io/builder"
)
@@ -152,16 +154,16 @@ func UpdateSecret(ctx context.Context, secretID int64, data, description string)
}
func GetSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) (map[string]string, error) {
secrets := map[string]string{}
baseSecrets := map[string]string{}
secrets["GITHUB_TOKEN"] = task.Token
secrets["GITEA_TOKEN"] = task.Token
baseSecrets["GITHUB_TOKEN"] = task.Token
baseSecrets["GITEA_TOKEN"] = task.Token
if task.Job.Run.IsForkPullRequest && task.Job.Run.TriggerEvent != actions_module.GithubEventPullRequestTarget {
// ignore secrets for fork pull request, except GITHUB_TOKEN and GITEA_TOKEN which are automatically generated.
// for the tasks triggered by pull_request_target event, they could access the secrets because they will run in the context of the base branch
// see the documentation: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
return secrets, nil
return baseSecrets, nil
}
ownerSecrets, err := db.Find[Secret](ctx, FindSecretsOptions{OwnerID: task.Job.Run.Repo.OwnerID})
@@ -181,10 +183,60 @@ func GetSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) (map[
log.Error("Unable to decrypt Actions secret %v %q, maybe SECRET_KEY is wrong: %v", secret.ID, secret.Name, err)
continue
}
secrets[secret.Name] = v
baseSecrets[secret.Name] = v
}
return secrets, nil
return getScopedSecretsForJob(ctx, task.Job, baseSecrets)
}
// getScopedSecretsForJob walks up the caller chain (ParentJobID) and applies
// each caller's secrets policy:
// - "secrets: inherit" passes the parent scope's secrets through unchanged.
// - explicit mapping {alias: SOURCE} only forwards the named secrets, plus the auto-generated tokens.
//
// For top-level jobs (ParentJobID == 0) the base secrets are returned as-is.
func getScopedSecretsForJob(ctx context.Context, job *actions_model.ActionRunJob, baseSecrets map[string]string) (map[string]string, error) {
if job.ParentJobID == 0 {
return baseSecrets, nil
}
caller, err := actions_model.GetRunJobByRunAndID(ctx, job.RunID, job.ParentJobID)
if err != nil {
return nil, fmt.Errorf("load caller job %d: %w", job.ParentJobID, err)
}
parentScope, err := getScopedSecretsForJob(ctx, caller, baseSecrets)
if err != nil {
return nil, err
}
if caller.CallSecrets == jobparser.SecretsInherit {
return parentScope, nil
}
// Empty or explicit-mapping path: only auto-tokens + (any) mapped aliases are exposed.
scoped := map[string]string{
"GITHUB_TOKEN": baseSecrets["GITHUB_TOKEN"],
"GITEA_TOKEN": baseSecrets["GITEA_TOKEN"],
}
if caller.CallSecrets == "" {
return scoped, nil
}
var mapping map[string]string
if err := json.Unmarshal([]byte(caller.CallSecrets), &mapping); err != nil {
return nil, fmt.Errorf("decode caller %d secret map: %w", caller.ID, err)
}
for alias, source := range mapping {
if v, ok := parentScope[source]; ok {
scoped[alias] = v
continue
}
// Secret names are case-insensitive in storage (uppercased).
if v, ok := parentScope[strings.ToUpper(source)]; ok {
scoped[alias] = v
}
}
return scoped, nil
}
func CountWrongRepoLevelSecrets(ctx context.Context) (int64, error) {
package/gitea/source/models/secret/secret_test.go
+174
View File
@@ -0,0 +1,174 @@
// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package secret
import (
"testing"
actions_model "gitea.dev/models/actions"
"gitea.dev/models/db"
"gitea.dev/models/unittest"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestGetScopedSecretsForJob(t *testing.T) {
require.NoError(t, unittest.PrepareTestDatabase())
ctx := t.Context()
base := map[string]string{
"GITHUB_TOKEN": "tok",
"GITEA_TOKEN": "tok",
"PROD_API_KEY": "prod-secret",
"DEV_API_KEY": "dev-secret",
}
// insertCaller create an ActionRunJob caller row with the given CallSecrets policy
insertCaller := func(t *testing.T, runID, parentJobID int64, callSecrets string) *actions_model.ActionRunJob {
t.Helper()
job := &actions_model.ActionRunJob{
RunID: runID,
RepoID: 1,
IsReusableCaller: true,
ParentJobID: parentJobID,
CallSecrets: callSecrets,
Status: actions_model.StatusBlocked,
}
require.NoError(t, db.Insert(t.Context(), job))
return job
}
t.Run("TopLevelJob_ReturnsBaseUnchanged", func(t *testing.T) {
const runID = 9001
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: 0}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, base, got, "top-level jobs should see the full base scope")
})
t.Run("CallerInherit_PassesParentScopeThrough", func(t *testing.T) {
const runID = 9002
caller := insertCaller(t, runID, 0, "inherit")
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, base, got, "secrets: inherit forwards everything from parent scope")
})
t.Run("CallerEmptySecrets_ExposesOnlyAutoTokens", func(t *testing.T) {
const runID = 9003
caller := insertCaller(t, runID, 0, "")
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, map[string]string{
"GITHUB_TOKEN": "tok",
"GITEA_TOKEN": "tok",
}, got)
})
t.Run("CallerMapping_OnlyMappedAliasesPlusTokens", func(t *testing.T) {
const runID = 9004
// {alias: source} - the called workflow sees `secrets.MY_KEY` resolved to PROD_API_KEY's value.
caller := insertCaller(t, runID, 0, `{"MY_KEY":"PROD_API_KEY"}`)
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, map[string]string{
"GITHUB_TOKEN": "tok",
"GITEA_TOKEN": "tok",
"MY_KEY": "prod-secret",
// no "dev-secret"
}, got)
})
t.Run("CallerMapping_CaseInsensitiveSource", func(t *testing.T) {
const runID = 9005
caller := insertCaller(t, runID, 0, `{"alias":"prod_api_key"}`)
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, "prod-secret", got["alias"])
})
t.Run("CallerMapping_UnknownSourceDropsAlias", func(t *testing.T) {
const runID = 9006
// alias points at a non-existent secret name, so it must be dropped.
caller := insertCaller(t, runID, 0, `{"MAPPED_ALIAS":"DOES_NOT_EXIST"}`)
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
_, present := got["MAPPED_ALIAS"]
assert.False(t, present)
})
t.Run("Nested_InheritThenInherit_FullScope", func(t *testing.T) {
const runID = 9007
outer := insertCaller(t, runID, 0, "inherit")
inner := insertCaller(t, runID, outer.ID, "inherit")
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, base, got, "inherit-then-inherit should pass the full base scope through")
})
t.Run("Nested_InheritThenMapping_InnerNarrows", func(t *testing.T) {
const runID = 9008
// inner mapping narrows the full scope it inherited from outer.
outer := insertCaller(t, runID, 0, "inherit")
inner := insertCaller(t, runID, outer.ID, `{"ALIAS_OUT":"PROD_API_KEY"}`)
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, map[string]string{
"GITHUB_TOKEN": "tok",
"GITEA_TOKEN": "tok",
"ALIAS_OUT": "prod-secret",
// no "dev-secret"
}, got)
})
t.Run("Nested_MappingThenInherit_OuterNarrows", func(t *testing.T) {
const runID = 9009
// inner inherits outer's already-narrowed scope, so leaf sees only auto-tokens + OUTER_ALIAS.
outer := insertCaller(t, runID, 0, `{"OUTER_ALIAS":"PROD_API_KEY"}`)
inner := insertCaller(t, runID, outer.ID, "inherit")
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, map[string]string{
"GITHUB_TOKEN": "tok",
"GITEA_TOKEN": "tok",
"OUTER_ALIAS": "prod-secret",
// no "dev-secret"
}, got)
})
t.Run("Nested_MappingThenMapping_InnerSourceMustExistInOuterScope", func(t *testing.T) {
const runID = 9010
// inner can rename ALIAS_A (in outer's scope) to ALIAS_C, but cannot forward DEV_API_KEY, which outer dropped.
outer := insertCaller(t, runID, 0, `{"ALIAS_A":"PROD_API_KEY"}`)
inner := insertCaller(t, runID, outer.ID, `{"ALIAS_B":"DEV_API_KEY","ALIAS_C":"ALIAS_A"}`)
leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
got, err := getScopedSecretsForJob(ctx, leaf, base)
require.NoError(t, err)
assert.Equal(t, map[string]string{
"GITHUB_TOKEN": "tok",
"GITEA_TOKEN": "tok",
"ALIAS_C": "prod-secret",
// no "dev-secret"
}, got)
})
}