feat(actions): update actionslib, support self:, misc fixes (#39358)

Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1, moves workflow
parsing into it and aligns behaviour with GitHub.

1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths.
1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept
expressions, including over `needs`. A job whose `name`, `runs-on` or
`continue-on-error` reads `needs` is resolved once they finish.
1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and
is decided before the matrix, as on github.com.
1. Matrix `fail-fast` cancels the other combinations, and `always()`
jobs keep running when a run is cancelled.
1. Invalid workflow files, including a malformed `on:` and unknown or
cyclic `needs`, show up on push as failed runs with the error.
1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or
failed with the error, instead of staying blocked.
1. Reusable workflows: a missing and an unreadable repository fail
alike, public callers cannot use private workflows, nested jobs cannot
exceed the caller's token permissions.
1. Runner labels match case-insensitively, and `runs-on` accepts an
array from an expression.

Runner PR: https://gitea.com/gitea/runner/pulls/1247
Docs PR: https://gitea.com/gitea/docs/pulls/553
Fixes: https://github.com/go-gitea/gitea/issues/38990
Fixes: https://github.com/go-gitea/gitea/issues/39382
Fixes: https://github.com/go-gitea/gitea/issues/32364
Fixes: https://github.com/go-gitea/gitea/issues/36077
Fixes: https://github.com/go-gitea/gitea/issues/23277
Fixes: https://github.com/go-gitea/gitea/issues/29020
Co-authored-by: Claude (Opus 5) <noreply@anthropic.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

tests/integration/actions_dynamic_matrix_test.go

@@ -22,16 +22,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// TestDynamicMatrixEvaluation covers a job whose matrix references ${{ needs.*.outputs.* }}: it is
-// planned as a single placeholder and expanded once its dependency completes. `build` exercises the
-// expansion, `report` that a downstream job sees the combinations' outputs, `gated` and `partial` the
-// `if:` gates on either side of it, and `static` that a matrix expanded at plan time is left alone.
-// `included` covers the placeholder shapes that only survive as long as nothing re-parses their
-// payload: `include:` is still a scalar there, which act refuses to read at all.
-// `partial` and `strict` gate on `matrix.*` from either direction: neither may be decided before the
-// combinations exist, or the whole job is skipped instead of the combinations the gate excludes.
-// A full rerun then re-derives the matrix from the new attempt's outputs instead of reusing the
-// previous combinations, keeping the AttemptJobID of every combination that recurs.
 func TestDynamicMatrixEvaluation(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
@@ -93,24 +83,6 @@ jobs:
         value: ${{ fromJson(needs.generate.outputs.matrix) }}
     steps:
       - run: echo "${{ matrix.value }}"
-  partial:
-    needs: [generate]
-    if: ${{ matrix.value != 1 }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        value: ${{ fromJson(needs.generate.outputs.matrix) }}
-    steps:
-      - run: echo "${{ matrix.value }}"
-  strict:
-    needs: [generate]
-    if: matrix.value == 1
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        value: ${{ fromJson(needs.generate.outputs.matrix) }}
-    steps:
-      - run: echo "${{ matrix.value }}"
   report:
     needs: [build]
     runs-on: ubuntu-latest
@@ -151,20 +123,12 @@ jobs:
 			return names
 		}
 
-		seen := execAttempt(t, 9)
+		seen := execAttempt(t, 7)
 		firstAttemptIDs := maps.Clone(attemptJobIDs)
-		//  `gated` is decided before the matrix is touched, so it never expands and is skipped as one job;
-		//  `partial (1)` and `strict (2)` are decided afterwards, each against its own combination.
 		assert.ElementsMatch(t, []string{
-			"build (1)", "build (2)", "included (x)", "included (y)",
-			"static (a)", "static (b)", "partial (2)", "strict (1)", "report",
+			"build (1)", "build (2)", "included (x)", "included (y)", "static (a)", "static (b)", "report",
 		}, seen)
-		for _, name := range []string{"partial (1)", "strict (2)"} {
-			skipped := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, Name: name})
-			assert.Equal(t, actions_model.StatusSkipped, skipped.Status)
-		}
-		// A gate reading `matrix.*` must not be decided against the unexpanded placeholder.
-		unittest.AssertNotExistsBean(t, &actions_model.ActionRunJob{RunID: run.ID, Name: "strict"})
+		assert.Equal(t, actions_model.StatusSkipped, unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, Name: "gated"}).Status)
 
 		buildNeed, ok := reportTask.Needs["build"]
 		require.True(t, ok, "report must see the expanded combinations as its 'build' need")
@@ -186,10 +150,9 @@ jobs:
 		})
 
 		// The matrix now yields a third value, while `static` is cloned as-is rather than collapsed.
-		seenRerun := execAttempt(t, 11)
+		seenRerun := execAttempt(t, 8)
 		assert.ElementsMatch(t, []string{
-			"build (1)", "build (2)", "build (3)", "included (x)", "included (y)",
-			"static (a)", "static (b)", "partial (2)", "partial (3)", "strict (1)", "report",
+			"build (1)", "build (2)", "build (3)", "included (x)", "included (y)", "static (a)", "static (b)", "report",
 		}, seenRerun)
 		for name, firstID := range firstAttemptIDs {
 			assert.Equal(t, firstID, attemptJobIDs[name], "%s keeps its AttemptJobID across attempts", name)