feat: update gitea vendor

package/gitea/source/routers/web/repo/actions/actions.go

@@ -4,31 +4,34 @@
 package actions
 
 import (
-	"bytes"
 	stdCtx "context"
 	"errors"
+	"fmt"
 	"net/http"
+	"net/url"
 	"slices"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	shared_user "gitea.dev/routers/web/shared/user"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 
-	act_model "github.com/nektos/act/pkg/model"
+	act_model "gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -44,6 +47,20 @@ type WorkflowInfo struct {
 	Workflow *act_model.Workflow
 }
 
+type workflowBadge struct {
+	DisplayName string
+	BadgeURL    string
+	WorkflowURL string
+}
+
+// DisplayName returns the workflow name from the YAML file if present, otherwise the filename.
+func (w WorkflowInfo) DisplayName() string {
+	if w.Workflow != nil && w.Workflow.Name != "" {
+		return w.Workflow.Name
+	}
+	return w.Entry.Name()
+}
+
 // MustEnableActions check if actions are enabled in settings
 func MustEnableActions(ctx *context.Context) {
 	if !setting.Actions.Enabled {
@@ -57,7 +74,7 @@ func MustEnableActions(ctx *context.Context) {
 	}
 
 	if ctx.Repo.Repository != nil {
-		if !ctx.Repo.CanRead(unit.TypeActions) {
+		if !ctx.Repo.Permission.CanRead(unit.TypeActions) {
 			ctx.NotFound(nil)
 			return
 		}
@@ -82,12 +99,22 @@ func List(ctx *context.Context) {
 	if ctx.Written() {
 		return
 	}
-	prepareWorkflowDispatchTemplate(ctx, workflows, curWorkflowID)
+	curWorkflowRepoID := ctx.FormInt64("scoped_workflow_source_repo_id")
+	ctx.Data["CurWorkflowRepoID"] = curWorkflowRepoID
+	scopedNames := prepareScopedWorkflows(ctx, curWorkflowID, curWorkflowRepoID)
+	if ctx.Written() {
+		return
+	}
+	otherWorkflows := prepareOtherWorkflows(ctx, workflows, scopedNames, curWorkflowID)
+	if ctx.Written() {
+		return
+	}
+	prepareWorkflowDispatchTemplate(ctx, workflows, curWorkflowID, curWorkflowRepoID)
 	if ctx.Written() {
 		return
 	}
 
-	prepareWorkflowList(ctx, workflows)
+	prepareWorkflowList(ctx, workflows, otherWorkflows, len(scopedNames) > 0)
 	if ctx.Written() {
 		return
 	}
@@ -95,6 +122,33 @@ func List(ctx *context.Context) {
 	ctx.HTML(http.StatusOK, tplListActions)
 }
 
+// prepareOtherWorkflows surfaces historical runs whose workflow file no longer
+// exists on the default branch (renamed, removed, or only on other branches).
+func prepareOtherWorkflows(ctx *context.Context, workflows []WorkflowInfo, scopedNames container.Set[string], curWorkflowID string) []string {
+	listed := make(container.Set[string], len(workflows))
+	for _, w := range workflows {
+		listed.Add(w.Entry.Name())
+	}
+
+	var other []string
+	if ctx.Repo.Repository.NumActionRuns > 0 {
+		// "Other workflows" lists repo-level orphans only: GetRepoRunWorkflowIDs excludes scoped runs.
+		ids, err := actions_model.GetRepoRunWorkflowIDs(ctx, ctx.Repo.Repository.ID)
+		if err != nil {
+			ctx.ServerError("GetRepoRunWorkflowIDs", err)
+			return nil
+		}
+		other = container.FilterSlice(ids, func(id string) (string, bool) {
+			return id, id != "" && !listed.Contains(id)
+		})
+	}
+
+	ctx.Data["OtherWorkflows"] = other
+	// A selected workflow counts as "listed" if it is a repo-level file or an active scoped workflow.
+	ctx.Data["CurWorkflowIsListed"] = curWorkflowID == "" || listed.Contains(curWorkflowID) || scopedNames.Contains(curWorkflowID)
+	return other
+}
+
 func WorkflowDispatchInputs(ctx *context.Context) {
 	ref := ctx.FormString("ref")
 	if ref == "" {
@@ -121,7 +175,7 @@ func WorkflowDispatchInputs(ctx *context.Context) {
 	if ctx.Written() {
 		return
 	}
-	prepareWorkflowDispatchTemplate(ctx, workflows, curWorkflowID)
+	prepareWorkflowDispatchTemplate(ctx, workflows, curWorkflowID, ctx.FormInt64("scoped_workflow_source_repo_id"))
 	if ctx.Written() {
 		return
 	}
@@ -145,7 +199,7 @@ func prepareWorkflowTemplate(ctx *context.Context, commit *git.Commit) (workflow
 			ctx.ServerError("GetContentFromEntry", err)
 			return nil, ""
 		}
-		wf, err := act_model.ReadWorkflow(bytes.NewReader(content))
+		wf, err := jobparser.ReadWorkflow(content)
 		if err != nil {
 			workflow.ErrMsg = ctx.Locale.TrString("actions.runs.invalid_workflow_helper", err.Error())
 			workflows = append(workflows, workflow)
@@ -169,19 +223,28 @@ func prepareWorkflowTemplate(ctx *context.Context, commit *git.Commit) (workflow
 			if !hasJobWithoutNeeds && len(j.Needs()) == 0 {
 				hasJobWithoutNeeds = true
 			}
+			if j.Uses != "" {
+				if _, err := actions_service.ResolveUses(ctx, j.Uses); err != nil {
+					workflow.ErrMsg = ctx.Locale.TrString("actions.runs.invalid_reusable_workflow_uses", err.Error())
+					break
+				}
+			}
 		}
-		if !hasJobWithoutNeeds {
-			workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job_without_needs")
-		}
-		if emptyJobsNumber == len(wf.Jobs) {
-			workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job")
+		if workflow.ErrMsg == "" {
+			if !hasJobWithoutNeeds {
+				workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job_without_needs")
+			}
+			if emptyJobsNumber == len(wf.Jobs) {
+				workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job")
+			}
 		}
 		workflows = append(workflows, workflow)
 	}
 
 	ctx.Data["workflows"] = workflows
 	ctx.Data["RepoLink"] = ctx.Repo.Repository.Link()
-	ctx.Data["AllowDisableOrEnableWorkflow"] = ctx.Repo.IsAdmin()
+	ctx.Data["RepoID"] = ctx.Repo.Repository.ID
+	ctx.Data["AllowDisableOrEnableWorkflow"] = ctx.Repo.Permission.IsAdmin()
 	actionsConfig := ctx.Repo.Repository.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
 	ctx.Data["ActionsConfig"] = actionsConfig
 	ctx.Data["CurWorkflow"] = curWorkflowID
@@ -190,21 +253,165 @@ func prepareWorkflowTemplate(ctx *context.Context, commit *git.Commit) (workflow
 	return workflows, curWorkflowID
 }
 
-func prepareWorkflowDispatchTemplate(ctx *context.Context, workflowInfos []WorkflowInfo, curWorkflowID string) {
-	actionsConfig := ctx.Repo.Repository.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
-	if curWorkflowID == "" || !ctx.Repo.CanWrite(unit.TypeActions) || actionsConfig.IsWorkflowDisabled(curWorkflowID) {
+// ScopedWorkflowInfo describes a scoped workflow effective for the current repo, listed under its source group.
+type ScopedWorkflowInfo struct {
+	SourceRepoID int64
+	EntryName    string
+	DisplayName  string
+	Required     bool
+	Disabled     bool
+}
+
+// ScopedWorkflowSourceGroup groups the scoped workflows contributed by one source repo for the All-Workflows sidebar.
+type ScopedWorkflowSourceGroup struct {
+	SourceRepoID        int64
+	SourceRepoName      string // owner/name of the source repo; shown for instance-level sources and used as the tooltip
+	SourceRepoShortName string // name only; shown for owner-level sources, where the owner is always the current owner
+	FromInstance        bool   // registered at instance level (owner_id == 0) rather than by the owner
+	IsActive            bool   // the currently-selected workflow belongs to this source; render the group expanded
+	Workflows           []ScopedWorkflowInfo
+}
+
+// prepareScopedWorkflows lists the scoped workflows effective for the repo's owner (and instance) for the All-Workflows sidebar.
+func prepareScopedWorkflows(ctx *context.Context, curWorkflowID string, curWorkflowRepoID int64) container.Set[string] {
+	scopedNames := make(container.Set[string])
+
+	repo := ctx.Repo.Repository
+	sources, err := actions_model.GetEffectiveScopedWorkflowSources(ctx, repo.OwnerID)
+	if err != nil {
+		ctx.ServerError("GetEffectiveScopedWorkflowSources", err)
+		return scopedNames
+	}
+	if len(sources) == 0 {
+		return scopedNames
+	}
+
+	actionsConfig := repo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
+
+	groups := make([]ScopedWorkflowSourceGroup, 0, len(sources))
+	seen := make(map[int64]bool, len(sources))
+	for _, source := range sources {
+		if seen[source.SourceRepoID] {
+			continue
+		}
+		seen[source.SourceRepoID] = true
+
+		sourceRepo, err := repo_model.GetRepositoryByID(ctx, source.SourceRepoID)
+		if err != nil {
+			log.Error("scoped workflows list: load source repo %d: %v", source.SourceRepoID, err)
+			continue
+		}
+		if sourceRepo.IsEmpty {
+			continue
+		}
+
+		_, entries, err := actions_service.LoadParsedScopedWorkflows(ctx, sourceRepo)
+		if err != nil {
+			log.Error("scoped workflows list: parse %s: %v", sourceRepo.FullName(), err)
+			continue
+		}
+		if len(entries) == 0 {
+			continue
+		}
+
+		group := ScopedWorkflowSourceGroup{
+			SourceRepoID:        sourceRepo.ID,
+			SourceRepoName:      sourceRepo.FullName(),
+			SourceRepoShortName: sourceRepo.Name,
+			FromInstance:        source.OwnerID == 0,
+		}
+		for _, e := range entries {
+			scopedNames.Add(e.EntryName)
+			required := actions_model.IsWorkflowRequiredInSources(sources, sourceRepo.ID, e.EntryName)
+			disabled := actionsConfig.IsScopedWorkflowDisabled(sourceRepo.ID, e.EntryName)
+			group.Workflows = append(group.Workflows, ScopedWorkflowInfo{
+				SourceRepoID: sourceRepo.ID,
+				EntryName:    e.EntryName,
+				DisplayName:  e.DisplayName,
+				Required:     required,
+				Disabled:     disabled,
+			})
+
+			if curWorkflowID == e.EntryName && curWorkflowRepoID == sourceRepo.ID {
+				ctx.Data["CurWorkflowDisabled"] = disabled
+				ctx.Data["CurWorkflowScopedRepoID"] = sourceRepo.ID
+				ctx.Data["CurWorkflowRequired"] = required
+				group.IsActive = true // keep this group expanded so the selected workflow stays visible
+			}
+		}
+		groups = append(groups, group)
+	}
+
+	ctx.Data["ScopedWorkflowGroups"] = groups
+	return scopedNames
+}
+
+// loadScopedWorkflowModel reads and parses a scoped workflow's content from its source repo's default branch.
+func loadScopedWorkflowModel(ctx *context.Context, repo *repo_model.Repository, sourceRepoID int64, workflowID string) *act_model.Workflow {
+	effective, err := actions_model.IsScopedWorkflowSourceEffective(ctx, repo.OwnerID, sourceRepoID)
+	if err != nil {
+		log.Error("scoped dispatch: IsScopedWorkflowSourceEffective: %v", err)
+		return nil
+	}
+	if !effective {
+		return nil
+	}
+
+	sourceRepo, err := repo_model.GetRepositoryByID(ctx, sourceRepoID)
+	if err != nil || sourceRepo.IsEmpty {
+		return nil
+	}
+	content, err := actions_service.ScopedWorkflowContent(ctx, sourceRepo, workflowID)
+	if err != nil {
+		log.Error("scoped dispatch: content of %s in %s: %v", workflowID, sourceRepo.RelativePath(), err)
+		return nil
+	}
+	if content == nil {
+		return nil // the workflow does not exist on the source's default branch
+	}
+	wf, err := jobparser.ReadWorkflow(content)
+	if err != nil {
+		return nil
+	}
+	return wf
+}
+
+func prepareWorkflowDispatchTemplate(ctx *context.Context, workflowInfos []WorkflowInfo, curWorkflowID string, curWorkflowRepoID int64) {
+	repo := ctx.Repo.Repository
+	if curWorkflowID == "" || !ctx.Repo.Permission.CanWrite(unit.TypeActions) {
+		return
+	}
+	actionsConfig := repo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
+
+	isScoped := curWorkflowRepoID > 0
+	if isScoped {
+		// a required scoped workflow can never be opted out, so a stale disabled flag must not hide its dispatch form
+		optedOut, err := actions_model.IsScopedWorkflowOptedOut(ctx, actionsConfig, repo.OwnerID, curWorkflowRepoID, curWorkflowID)
+		if err != nil {
+			log.Error("IsScopedWorkflowOptedOut: %v", err)
+			return
+		}
+		if optedOut {
+			return
+		}
+	} else if actionsConfig.IsWorkflowDisabled(curWorkflowID) {
 		return
 	}
 
 	var curWorkflow *act_model.Workflow
-	for _, workflowInfo := range workflowInfos {
-		if workflowInfo.Entry.Name() == curWorkflowID {
-			if workflowInfo.Workflow == nil {
-				log.Debug("CurWorkflowID %s is found but its workflowInfo.Workflow is nil", curWorkflowID)
-				return
+	if isScoped {
+		// a scoped workflow's content lives in its source repo, not in workflowInfos (the consumer's own files)
+		curWorkflow = loadScopedWorkflowModel(ctx, repo, curWorkflowRepoID, curWorkflowID)
+	} else {
+		for _, workflowInfo := range workflowInfos {
+			if workflowInfo.Entry.Name() == curWorkflowID {
+				if workflowInfo.Workflow == nil {
+					log.Debug("CurWorkflowID %s is found but its workflowInfo.Workflow is nil", curWorkflowID)
+					return
+				}
+				curWorkflow = workflowInfo.Workflow
+				break
 			}
-			curWorkflow = workflowInfo.Workflow
-			break
 		}
 	}
 
@@ -245,10 +452,12 @@ func prepareWorkflowDispatchTemplate(ctx *context.Context, workflowInfos []Workf
 	ctx.Data["Tags"] = tags
 }
 
-func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
+func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo, otherWorkflows []string, hasScopedWorkflows bool) {
 	actorID := ctx.FormInt64("actor")
 	status := ctx.FormInt("status")
 	workflowID := ctx.FormString("workflow")
+	scopedWorkflowSourceRepoID := ctx.FormInt64("scoped_workflow_source_repo_id")
+	branch := ctx.FormString("branch")
 	page := ctx.FormInt("page")
 	if page <= 0 {
 		page = 1
@@ -258,7 +467,8 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 	// they will be 0 by default, which indicates get all status or actors
 	ctx.Data["CurActor"] = actorID
 	ctx.Data["CurStatus"] = status
-	if actorID > 0 || status > int(actions_model.StatusUnknown) {
+	ctx.Data["CurBranch"] = branch
+	if actorID > 0 || status > int(actions_model.StatusUnknown) || branch != "" {
 		ctx.Data["IsFiltered"] = true
 	}
 
@@ -267,15 +477,24 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 			Page:     page,
 			PageSize: convert.ToCorrectPageSize(ctx.FormInt("limit")),
 		},
-		RepoID:        ctx.Repo.Repository.ID,
-		WorkflowID:    workflowID,
-		TriggerUserID: actorID,
+		RepoID:         ctx.Repo.Repository.ID,
+		WorkflowID:     workflowID,
+		WorkflowRepoID: scopedWorkflowSourceRepoID,
+		TriggerUserID:  actorID,
+	}
+
+	// Constrain scoped vs repo-level only for a listed workflow, whose link carries scoped_workflow_source_repo_id.
+	if workflowID != "" && !slices.Contains(otherWorkflows, workflowID) {
+		opts.IsScopedRun = optional.Some(scopedWorkflowSourceRepoID > 0)
 	}
 
 	// if status is not StatusUnknown, it means user has selected a status filter
 	if actions_model.Status(status) != actions_model.StatusUnknown {
 		opts.Status = []actions_model.Status{actions_model.Status(status)}
 	}
+	if branch != "" {
+		opts.Ref = string(git.RefNameFromBranch(branch))
+	}
 
 	runs, total, err := db.FindAndCount[actions_model.ActionRun](ctx, opts)
 	if err != nil {
@@ -308,32 +527,40 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 		return
 	}
 	for _, run := range runs {
-		if !run.Status.In(actions_model.StatusWaiting, actions_model.StatusRunning) {
+		if !run.Status.In(actions_model.StatusWaiting, actions_model.StatusRunning, actions_model.StatusBlocked) {
 			continue
 		}
-		jobs, err := actions_model.GetRunJobsByRunID(ctx, run.ID)
+		jobs, err := actions_model.GetLatestAttemptJobsByRepoAndRunID(ctx, run.RepoID, run.ID)
 		if err != nil {
 			ctx.ServerError("GetRunJobsByRunID", err)
 			return
 		}
 		for _, job := range jobs {
-			if !job.Status.IsWaiting() {
+			if !job.Status.In(actions_model.StatusWaiting, actions_model.StatusBlocked) {
 				continue
 			}
 			if err := actions.ValidateWorkflowContent(job.WorkflowPayload); err != nil {
 				runErrors[run.ID] = ctx.Locale.TrString("actions.runs.invalid_workflow_helper", err.Error())
 				break
 			}
-			hasOnlineRunner := false
-			for _, runner := range runners {
-				if !runner.IsDisabled && runner.CanMatchLabels(job.RunsOn) {
-					hasOnlineRunner = true
+			if job.CallUses != "" {
+				if _, err := actions_service.ResolveUses(ctx, job.CallUses); err != nil {
+					runErrors[run.ID] = ctx.Locale.TrString("actions.runs.invalid_reusable_workflow_uses", err.Error())
 					break
 				}
 			}
-			if !hasOnlineRunner {
-				runErrors[run.ID] = ctx.Locale.TrString("actions.runs.no_matching_online_runner_helper", strings.Join(job.RunsOn, ","))
-				break
+			if job.Status.IsWaiting() {
+				hasOnlineRunner := false
+				for _, runner := range runners {
+					if !runner.IsDisabled && runner.CanMatchLabels(job.RunsOn) {
+						hasOnlineRunner = true
+						break
+					}
+				}
+				if !hasOnlineRunner {
+					runErrors[run.ID] = ctx.Locale.TrString("actions.runs.no_matching_online_runner_helper", strings.Join(job.RunsOn, ","))
+					break
+				}
 			}
 		}
 	}
@@ -341,6 +568,22 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 
 	ctx.Data["Runs"] = runs
 
+	workflowNames := make(map[string]string, len(workflows))
+	workflowDisplayName := workflowID
+	for _, wf := range workflows {
+		displayName := wf.DisplayName()
+		workflowNames[wf.Entry.Name()] = displayName
+		if wf.Entry.Name() == workflowID {
+			workflowDisplayName = displayName
+		}
+	}
+	ctx.Data["WorkflowNames"] = workflowNames
+	// A scoped workflow has no repo-level badge on this repo (the badge endpoint reads is_scoped_run=false runs),
+	// so don't offer the "create status badge" entry for it.
+	if scopedWorkflowSourceRepoID == 0 {
+		prepareWorkflowBadgeTemplate(ctx, workflowID, workflowDisplayName)
+	}
+
 	actors, err := actions_model.GetActors(ctx, ctx.Repo.Repository.ID)
 	if err != nil {
 		ctx.ServerError("GetActors", err)
@@ -350,12 +593,36 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 
 	ctx.Data["StatusInfoList"] = actions_model.GetStatusInfoList(ctx, ctx.Locale)
 
+	runBranches, err := actions_model.GetRunBranches(ctx, ctx.Repo.Repository.ID)
+	if err != nil {
+		ctx.ServerError("GetRunBranches", err)
+		return
+	}
+	ctx.Data["RunBranches"] = runBranches
+
 	pager := context.NewPagination(total, opts.PageSize, opts.Page, 5)
 	pager.AddParamFromRequest(ctx.Req)
 	ctx.Data["Page"] = pager
-	ctx.Data["HasWorkflowsOrRuns"] = len(workflows) > 0 || len(runs) > 0
+	ctx.Data["HasWorkflowsOrRuns"] = len(workflows) > 0 || len(otherWorkflows) > 0 || len(runs) > 0 || hasScopedWorkflows
 
-	ctx.Data["CanWriteRepoUnitActions"] = ctx.Repo.CanWrite(unit.TypeActions)
+	ctx.Data["CanWriteRepoUnitActions"] = ctx.Repo.Permission.CanWrite(unit.TypeActions)
+}
+
+func prepareWorkflowBadgeTemplate(ctx *context.Context, workflowID, displayName string) {
+	if workflowID == "" {
+		return
+	}
+	displayName = util.IfZero(displayName, workflowID)
+
+	repoURL := ctx.Repo.Repository.HTMLURL(ctx)
+	badgeURL := fmt.Sprintf("%s/actions/workflows/%s/badge.svg?branch=%s", repoURL, util.PathEscapeSegments(workflowID), url.QueryEscape(ctx.Repo.Repository.DefaultBranch))
+	workflowURL := fmt.Sprintf("%s/actions?workflow=%s", repoURL, url.QueryEscape(workflowID))
+
+	ctx.Data["WorkflowBadge"] = workflowBadge{
+		BadgeURL:    badgeURL,
+		WorkflowURL: workflowURL,
+		DisplayName: displayName,
+	}
 }
 
 // loadIsRefDeleted loads the IsRefDeleted field for each run in the list.
@@ -395,6 +662,10 @@ type WorkflowDispatchInput struct {
 	Options     []string `yaml:"options"`
 }
 
+func (i WorkflowDispatchInput) IsDefaultTrue() bool {
+	return util.ParseYamlBool(i.Default)
+}
+
 type WorkflowDispatch struct {
 	Inputs []WorkflowDispatchInput
 }
@@ -466,3 +737,14 @@ func decodeNode(node yaml.Node, out any) bool {
 	}
 	return true
 }
+
+func actionsListRedirectURL(repoLink, workflow, scopedWorkflowSourceRepoID, actor, status, branch string) string {
+	return fmt.Sprintf("%s/actions?workflow=%s&scoped_workflow_source_repo_id=%s&actor=%s&status=%s&branch=%s",
+		repoLink,
+		url.QueryEscape(workflow),
+		url.QueryEscape(scopedWorkflowSourceRepoID),
+		url.QueryEscape(actor),
+		url.QueryEscape(status),
+		url.QueryEscape(branch),
+	)
+}

package/gitea/source/routers/web/repo/actions/actions_test.go

@@ -4,14 +4,20 @@
 package actions
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	unittest "code.gitea.io/gitea/models/unittest"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	unittest "gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	web_context "gitea.dev/services/context"
 
-	act_model "github.com/nektos/act/pkg/model"
+	act_model "gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -176,3 +182,41 @@ func Test_loadIsRefDeleted(t *testing.T) {
 		assert.True(t, run.IsRefDeleted)
 	}
 }
+
+func TestPrepareWorkflowBadgeTemplate(t *testing.T) {
+	defer test.MockVariableValue(&setting.AppURL, "https://gitea.example.com/")()
+
+	t.Run("no workflow selected", func(t *testing.T) {
+		ctx := newWorkflowBadgeTestContext(t)
+
+		prepareWorkflowBadgeTemplate(ctx, "", "ignored")
+
+		assert.NotContains(t, ctx.Data, "WorkflowBadge")
+	})
+
+	t.Run("selected workflow", func(t *testing.T) {
+		ctx := newWorkflowBadgeTestContext(t)
+
+		prepareWorkflowBadgeTemplate(ctx, "build/test workflow.yml", `CI [prod]\build "fast" <ok>`)
+
+		assert.Equal(t, workflowBadge{
+			BadgeURL:    "https://gitea.example.com/user1/repo1/actions/workflows/build/test%20workflow.yml/badge.svg?branch=release%2F1.0+%26+hotfix",
+			WorkflowURL: "https://gitea.example.com/user1/repo1/actions?workflow=build%2Ftest+workflow.yml",
+			DisplayName: `CI [prod]\build "fast" <ok>`,
+		}, ctx.Data["WorkflowBadge"])
+	})
+}
+
+func newWorkflowBadgeTestContext(t *testing.T) *web_context.Context {
+	t.Helper()
+
+	req := httptest.NewRequest(http.MethodGet, "https://gitea.example.com/user1/repo1/actions", nil)
+	resp := httptest.NewRecorder()
+	ctx := web_context.NewWebContext(web_context.NewBaseContextForTest(resp, req), nil, nil)
+	ctx.Repo.Repository = &repo_model.Repository{
+		OwnerName:     "user1",
+		Name:          "repo1",
+		DefaultBranch: "release/1.0 & hotfix",
+	}
+	return ctx
+}

package/gitea/source/routers/web/repo/actions/badge.go

@@ -9,14 +9,20 @@ import (
 	"path/filepath"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/badge"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/badge"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 func GetWorkflowBadge(ctx *context.Context) {
+	context.CheckRepoScopedToken(ctx, ctx.Repo.Repository, auth_model.Read)
+	if ctx.Written() {
+		return
+	}
+
 	workflowFile := ctx.PathParam("workflow_name")
 	branch := ctx.FormString("branch", ctx.Repo.Repository.DefaultBranch)
 	event := ctx.FormString("event")

package/gitea/source/routers/web/repo/actions/main_test.go

@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {

package/gitea/source/routers/web/repo/actions/view_test.go

@@ -6,14 +6,76 @@ package actions
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/translation"
+	actions_model "gitea.dev/models/actions"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestViewPullRequestFromRun(t *testing.T) {
+	repo := &repo_model.Repository{ID: 1, OwnerName: "owner", Name: "repo"}
+
+	t.Run("pull ref", func(t *testing.T) {
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/pull/123/head"}
+		assert.Equal(t, &ViewPullRequest{Index: "#123", Link: "/owner/repo/pulls/123"}, viewPullRequestFromRun(t.Context(), run, nil))
+	})
+
+	t.Run("pull request event payload", func(t *testing.T) {
+		// a non-pull ref forces the payload branch instead of the ref branch
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/heads/feature"}
+		payload := &api.PullRequestPayload{Index: 42}
+		assert.Equal(t, &ViewPullRequest{Index: "#42", Link: "/owner/repo/pulls/42"}, viewPullRequestFromRun(t.Context(), run, payload))
+	})
+
+	t.Run("nil repo", func(t *testing.T) {
+		run := &actions_model.ActionRun{Ref: "refs/pull/1/head"}
+		assert.Nil(t, viewPullRequestFromRun(t.Context(), run, nil))
+	})
+}
+
+func TestViewSummaryBranchFromRun(t *testing.T) {
+	repo := &repo_model.Repository{ID: 1, OwnerName: "owner", Name: "repo"}
+
+	t.Run("pull request event same repo", func(t *testing.T) {
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/pull/7/head"}
+		payload := &api.PullRequestPayload{
+			PullRequest: &api.PullRequest{Head: &api.PRBranchInfo{
+				Name:       "feature",
+				Ref:        "refs/heads/feature",
+				RepoID:     1,
+				Repository: &api.Repository{Link: "/owner/repo"},
+			}},
+		}
+		assert.Equal(t, ViewBranch{Name: "feature", Link: "/owner/repo/src/branch/feature"}, viewSummaryBranchFromRun(t.Context(), run, payload))
+	})
+
+	t.Run("pull request event from fork prefixes owner", func(t *testing.T) {
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/pull/7/head"}
+		payload := &api.PullRequestPayload{
+			PullRequest: &api.PullRequest{Head: &api.PRBranchInfo{
+				Name:   "feature",
+				Ref:    "refs/heads/feature",
+				RepoID: 2,
+				Repository: &api.Repository{
+					Link:  "/forkowner/repo",
+					Owner: &api.User{UserName: "forkowner"},
+				},
+			}},
+		}
+		assert.Equal(t, ViewBranch{Name: "forkowner:feature", Link: "/forkowner/repo/src/branch/feature"}, viewSummaryBranchFromRun(t.Context(), run, payload))
+	})
+
+	t.Run("push to tag does not query branch", func(t *testing.T) {
+		// a tag ref is not a branch, so no GetBranch DB lookup happens
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/tags/v1.0.0"}
+		assert.Equal(t, ViewBranch{Name: "v1.0.0", Link: "/owner/repo/src/tag/v1.0.0"}, viewSummaryBranchFromRun(t.Context(), run, nil))
+	})
+}
+
 func TestConvertToViewModel(t *testing.T) {
 	task := &actions_model.ActionTask{
 		Status: actions_model.StatusSuccess,
@@ -45,3 +107,79 @@ func TestConvertToViewModel(t *testing.T) {
 	}
 	assert.Equal(t, expectedViewJobs, viewJobSteps)
 }
+
+func TestConvertToViewModelCancellingTaskDoesNotRenderRunningSteps(t *testing.T) {
+	task := &actions_model.ActionTask{
+		Status: actions_model.StatusCancelling,
+		Steps: []*actions_model.ActionTaskStep{
+			{Name: "Run step-name", Index: 0, Status: actions_model.StatusRunning, LogLength: 1},
+		},
+	}
+
+	viewJobSteps, _, err := convertToViewModel(t.Context(), translation.MockLocale{}, nil, task)
+	require.NoError(t, err)
+
+	expectedViewJobs := []*ViewJobStep{
+		{
+			Summary:  "Set up job",
+			Duration: "0s",
+			Status:   "success",
+		},
+		{
+			Summary:  "Run step-name",
+			Duration: "0s",
+			Status:   "cancelling",
+		},
+		{
+			Summary:  "Complete job",
+			Duration: "0s",
+			Status:   "waiting",
+		},
+	}
+	assert.Equal(t, expectedViewJobs, viewJobSteps)
+}
+
+func TestPendingNeeds(t *testing.T) {
+	current := &actions_model.ActionRunJob{JobID: "deploy", Needs: []string{"build", "test"}}
+	jobs := []*actions_model.ActionRunJob{
+		current,
+		{JobID: "build", Status: actions_model.StatusSuccess},
+		{JobID: "test", Status: actions_model.StatusRunning},
+	}
+	// "test" is not done yet, "build" succeeded, so only "test" blocks.
+	assert.Equal(t, []string{"test"}, pendingNeeds(current, jobs))
+
+	t.Run("all needs done", func(t *testing.T) {
+		done := []*actions_model.ActionRunJob{
+			current,
+			{JobID: "build", Status: actions_model.StatusSuccess},
+			{JobID: "test", Status: actions_model.StatusSkipped},
+		}
+		assert.Empty(t, pendingNeeds(current, done))
+	})
+
+	t.Run("matrix expansion all required", func(t *testing.T) {
+		matrix := []*actions_model.ActionRunJob{
+			current,
+			{JobID: "build", Status: actions_model.StatusSuccess},
+			{JobID: "build", Status: actions_model.StatusRunning},
+			{JobID: "test", Status: actions_model.StatusSuccess},
+		}
+		assert.Equal(t, []string{"build"}, pendingNeeds(current, matrix))
+	})
+
+	t.Run("unresolved need treated as pending", func(t *testing.T) {
+		missing := []*actions_model.ActionRunJob{current}
+		assert.Equal(t, []string{"build", "test"}, pendingNeeds(current, missing))
+	})
+
+	t.Run("parent job scope", func(t *testing.T) {
+		// a same-named job under a different parent must not satisfy the need
+		scoped := &actions_model.ActionRunJob{JobID: "deploy", Needs: []string{"build"}, ParentJobID: 5}
+		jobs := []*actions_model.ActionRunJob{
+			scoped,
+			{JobID: "build", Status: actions_model.StatusSuccess, ParentJobID: 0},
+		}
+		assert.Equal(t, []string{"build"}, pendingNeeds(scoped, jobs))
+	})
+}