fix(actions): evaluate job-level if: before concurrency check (#39437)

Gitea doesn't evaluate a job's `if:` before checking the job's
concurrency group, which causes a job that should have been skipped to
incorrectly cancel other jobs in the same concurrency group.

This PR makes Gitea decide `if:` for every job before it becomes
waiting, including jobs without `needs` at insertion, on approval and on
rerun. A skipped job therefore no longer takes part in job concurrency
or holds a max-parallel slot, and a reusable caller whose `if:` is false
is no longer expanded on approval or rerun. An invalid `if:` skips the
job with an error summary.

After this PR, Gitea decides all jobs' `if:` expressions and sends `if:
always()` to the runner, so the runner no longer needs to evaluate a
job's `if:` again ([gitea/runner
`run_context.go`](https://gitea.com/gitea/runner/src/commit/81add274599355ec1838b6ebe45804890d40bab9/act/runner/run_context.go#L1195)).

---------

Co-authored-by: silverwind <me@silverwind.io>

services/actions/task_test.go

@@ -9,6 +9,7 @@ import (
 	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
+	"gitea.dev/modules/actions/jobparser"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -72,3 +73,17 @@ func TestReleaseTaskForRunnerCleanup(t *testing.T) {
 	assert.Zero(t, released.TaskID)
 	unittest.AssertNotExistsBean(t, &actions_model.ActionTask{ID: task.ID})
 }
+
+func TestRunnerWorkflowPayload(t *testing.T) {
+	payload, err := runnerWorkflowPayload(&actions_model.ActionRunJob{
+		JobID:           "build",
+		WorkflowPayload: []byte("name: ci\njobs:\n  build:\n    if: false\n    steps:\n      - run: echo\n"),
+	})
+	require.NoError(t, err)
+
+	swf, parsedJob, err := jobparser.ParseRawSingleWorkflow(payload)
+	require.NoError(t, err)
+	assert.Equal(t, "ci", swf.Name)
+	assert.Equal(t, "always()", parsedJob.If.Value)
+	assert.Len(t, parsedJob.Steps, 1)
+}