feat: update gitea vendor

package/gitea/source/services/actions/workflow.go

@@ -5,24 +5,24 @@ package actions
 
 import (
 	"fmt"
+	"strconv"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/reqctx"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/reqctx"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 
-	"github.com/nektos/act/pkg/model"
-	"go.yaml.in/yaml/v4"
+	"gitea.com/gitea/runner/act/model"
 )
 
 func EnableOrDisableWorkflow(ctx *context.APIContext, workflowID string, isEnable bool) error {
@@ -43,7 +43,9 @@ func EnableOrDisableWorkflow(ctx *context.APIContext, workflowID string, isEnabl
 	return repo_model.UpdateRepoUnitConfig(ctx, cfgUnit)
 }
 
-func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, repo *repo_model.Repository, gitRepo *git.Repository, workflowID, ref string, processInputs func(model *model.WorkflowDispatch, inputs map[string]any) error) (runID int64, _ error) {
+// DispatchActionWorkflow manually triggers a workflow_dispatch run.
+// scopedWorkflowSourceRepoID selects the workflow source: 0 means a repo-level workflow in this repo; a non-zero value is the source repo of a scoped workflow.
+func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, repo *repo_model.Repository, gitRepo *git.Repository, workflowID, ref string, scopedWorkflowSourceRepoID int64, processInputs func(model *model.WorkflowDispatch, inputs map[string]any) error) (runID int64, _ error) {
 	if workflowID == "" {
 		return 0, util.ErrorWrapTranslatable(
 			util.NewNotExistErrorf("workflowID is empty"),
@@ -58,10 +60,20 @@ func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, re
 		)
 	}
 
-	// can not rerun job when workflow is disabled
+	isScoped := scopedWorkflowSourceRepoID > 0
+
 	cfgUnit := repo.MustGetUnit(ctx, unit.TypeActions)
 	cfg := cfgUnit.ActionsConfig()
-	if cfg.IsWorkflowDisabled(workflowID) {
+	var workflowDisabled bool
+	if isScoped {
+		var err error
+		if workflowDisabled, err = actions_model.IsScopedWorkflowOptedOut(ctx, cfg, repo.OwnerID, scopedWorkflowSourceRepoID, workflowID); err != nil {
+			return 0, err
+		}
+	} else {
+		workflowDisabled = cfg.IsWorkflowDisabled(workflowID)
+	}
+	if workflowDisabled {
 		return 0, util.ErrorWrapTranslatable(
 			util.NewPermissionDeniedErrorf("workflow is disabled"),
 			"actions.workflow.disabled",
@@ -87,17 +99,8 @@ func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, re
 		)
 	}
 
-	// get workflow entry from runTargetCommit
-	_, entries, err := actions.ListWorkflows(runTargetCommit)
-	if err != nil {
-		return 0, err
-	}
-
-	// find workflow from commit
-	var entry *git.TreeEntry
-
 	run := &actions_model.ActionRun{
-		Title:             runTargetCommit.Summary(),
+		Title:             runTargetCommit.MessageTitle(),
 		RepoID:            repo.ID,
 		Repo:              repo,
 		OwnerID:           repo.OwnerID,
@@ -110,42 +113,35 @@ func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, re
 		Event:             "workflow_dispatch",
 		TriggerEvent:      "workflow_dispatch",
 		Status:            actions_model.StatusWaiting,
+		// local dispatch: own repo at the target commit; the scoped path overrides these below
+		WorkflowRepoID:    repo.ID,
+		WorkflowCommitSHA: runTargetCommit.ID.String(),
 	}
 
-	for _, e := range entries {
-		if e.Name() != workflowID {
-			continue
-		}
-		entry = e
-		break
-	}
-
-	if entry == nil {
-		return 0, util.ErrorWrapTranslatable(
-			util.NewNotExistErrorf("workflow %q doesn't exist", workflowID),
-			"actions.workflow.not_found", workflowID,
-		)
-	}
-
-	content, err := actions.GetContentFromEntry(entry)
+	// resolve the workflow content and record its source on the run (scoped runs read from the source repo)
+	content, err := resolveDispatchWorkflowContent(ctx, repo, runTargetCommit, workflowID, scopedWorkflowSourceRepoID, isScoped, run)
 	if err != nil {
 		return 0, err
 	}
 
-	singleWorkflow := &jobparser.SingleWorkflow{}
-	if err := yaml.Unmarshal(content, singleWorkflow); err != nil {
+	workflow, err := jobparser.ReadWorkflow(content)
+	if err != nil {
 		return 0, fmt.Errorf("failed to unmarshal workflow content: %w", err)
 	}
 	// get inputs from post
-	workflow := &model.Workflow{
-		RawOn: singleWorkflow.RawOn,
+	workflowDispatch := workflow.WorkflowDispatchConfig()
+	if workflowDispatch == nil {
+		return 0, util.ErrorWrapTranslatable(
+			util.NewInvalidArgumentErrorf("workflow %q has no workflow_dispatch event trigger", workflowID),
+			"actions.workflow.has_no_workflow_dispatch", workflowID,
+		)
 	}
+
 	inputsWithDefaults := make(map[string]any)
-	if workflowDispatch := workflow.WorkflowDispatchConfig(); workflowDispatch != nil {
-		if err = processInputs(workflowDispatch, inputsWithDefaults); err != nil {
-			return 0, err
-		}
+	if err = processInputs(workflowDispatch, inputsWithDefaults); err != nil {
+		return 0, err
 	}
+	coerceDispatchInputTypes(workflowDispatch, inputsWithDefaults)
 
 	// ctx.Req.PostForm -> WorkflowDispatchPayload.Inputs -> ActionRun.EventPayload -> runner: ghc.Event
 	// https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
@@ -154,7 +150,7 @@ func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, re
 		Workflow:   workflowID,
 		Ref:        ref,
 		Repository: convert.ToRepo(ctx, repo, access_model.Permission{AccessMode: perm.AccessModeNone}),
-		Inputs:     inputsWithDefaults,
+		Inputs:     dispatchEventInputs(inputsWithDefaults),
 		Sender:     convert.ToUserWithAccessMode(ctx, doer, perm.AccessModeNone),
 	}
 
@@ -170,3 +166,89 @@ func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, re
 	}
 	return run.ID, nil
 }
+
+// coerceDispatchInputTypes types `inputs`, where boolean is the only non-string dispatch input type.
+func coerceDispatchInputTypes(dispatch *model.WorkflowDispatch, inputs map[string]any) {
+	for name, cfg := range dispatch.Inputs {
+		if cfg.Type != "boolean" {
+			continue
+		}
+		if s, ok := inputs[name].(string); ok {
+			inputs[name] = util.ParseYamlBool(s)
+		}
+	}
+}
+
+// dispatchEventInputs stringifies the typed inputs for `github.event.inputs`.
+// workflow_dispatch input types are string, choice, boolean and environment, so after
+// coerceDispatchInputTypes a value is either already a string or a bool.
+func dispatchEventInputs(inputs map[string]any) map[string]any {
+	eventInputs := make(map[string]any, len(inputs))
+	for name, value := range inputs {
+		if b, ok := value.(bool); ok {
+			eventInputs[name] = strconv.FormatBool(b)
+		} else {
+			eventInputs[name] = value
+		}
+	}
+	return eventInputs
+}
+
+// resolveDispatchWorkflowContent returns the YAML for a dispatched workflow and records its source on the run.
+//   - Repo-level: from the consumer's runTargetCommit.
+//   - Scoped: from the source repo's default branch.
+func resolveDispatchWorkflowContent(ctx reqctx.RequestContext, repo *repo_model.Repository, runTargetCommit *git.Commit, workflowID string, sourceRepoID int64, isScoped bool, run *actions_model.ActionRun) ([]byte, error) {
+	if isScoped {
+		return resolveScopedDispatchContent(ctx, repo, sourceRepoID, workflowID, run)
+	}
+
+	_, entries, err := actions.ListWorkflows(runTargetCommit)
+	if err != nil {
+		return nil, err
+	}
+	for _, e := range entries {
+		if e.Name() == workflowID {
+			return actions.GetContentFromEntry(e)
+		}
+	}
+	return nil, util.ErrorWrapTranslatable(
+		util.NewNotExistErrorf("workflow %q doesn't exist", workflowID),
+		"actions.workflow.not_found", workflowID,
+	)
+}
+
+func resolveScopedDispatchContent(ctx reqctx.RequestContext, repo *repo_model.Repository, sourceRepoID int64, workflowID string, run *actions_model.ActionRun) ([]byte, error) {
+	// the source must be an effective scoped source for this consumer repo
+	effective, err := actions_model.IsScopedWorkflowSourceEffective(ctx, repo.OwnerID, sourceRepoID)
+	if err != nil {
+		return nil, err
+	}
+	if !effective {
+		return nil, util.ErrorWrapTranslatable(
+			util.NewNotExistErrorf("scoped workflow source %d is not effective for this repository", sourceRepoID),
+			"actions.workflow.not_found", workflowID,
+		)
+	}
+
+	sourceRepo, err := repo_model.GetRepositoryByID(ctx, sourceRepoID)
+	if err != nil {
+		return nil, err
+	}
+
+	sha, parsed, err := LoadParsedScopedWorkflows(ctx, sourceRepo)
+	if err != nil {
+		return nil, err
+	}
+	for _, p := range parsed {
+		if p.EntryName == workflowID {
+			run.WorkflowRepoID = sourceRepo.ID
+			run.WorkflowCommitSHA = sha
+			run.IsScopedRun = true
+			return p.Content, nil
+		}
+	}
+	return nil, util.ErrorWrapTranslatable(
+		util.NewNotExistErrorf("scoped workflow %q doesn't exist", workflowID),
+		"actions.workflow.not_found", workflowID,
+	)
+}