feat(actions): update actionslib, support self:, misc fixes (#39358)

Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1, moves workflow
parsing into it and aligns behaviour with GitHub.

1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths.
1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept
expressions, including over `needs`. A job whose `name`, `runs-on` or
`continue-on-error` reads `needs` is resolved once they finish.
1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and
is decided before the matrix, as on github.com.
1. Matrix `fail-fast` cancels the other combinations, and `always()`
jobs keep running when a run is cancelled.
1. Invalid workflow files, including a malformed `on:` and unknown or
cyclic `needs`, show up on push as failed runs with the error.
1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or
failed with the error, instead of staying blocked.
1. Reusable workflows: a missing and an unreadable repository fail
alike, public callers cannot use private workflows, nested jobs cannot
exceed the caller's token permissions.
1. Runner labels match case-insensitively, and `runs-on` accepts an
array from an expression.

Runner PR: https://gitea.com/gitea/runner/pulls/1247
Docs PR: https://gitea.com/gitea/docs/pulls/553
Fixes: https://github.com/go-gitea/gitea/issues/38990
Fixes: https://github.com/go-gitea/gitea/issues/39382
Fixes: https://github.com/go-gitea/gitea/issues/32364
Fixes: https://github.com/go-gitea/gitea/issues/36077
Fixes: https://github.com/go-gitea/gitea/issues/23277
Fixes: https://github.com/go-gitea/gitea/issues/29020
Co-authored-by: Claude (Opus 5) <noreply@anthropic.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

tests/integration/actions_reusable_workflow_test.go

@@ -14,7 +14,9 @@ import (
 	runnerv1 "gitea.dev/actionslib/runner/v1"
 	actions_model "gitea.dev/models/actions"
 	auth_model "gitea.dev/models/auth"
+	perm_model "gitea.dev/models/perm"
 	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	actions_module "gitea.dev/modules/actions"
@@ -81,6 +83,8 @@ on:
 
 jobs:
   reusable1_job1:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - run: echo 'reusable1_job1'
@@ -135,6 +139,8 @@ jobs:
 
   caller_job2:
     needs: [caller_job1]
+    permissions:
+      contents: read
     uses: './.gitea/workflows/reusable1.yaml'
     with:
       str_input: 'from_caller_job2'
@@ -204,6 +210,8 @@ jobs:
 				_, r1Job1, _ := getTaskAndJobAndRunByTaskID(t, r1Job1Task.Id)
 				assert.Equal(t, "reusable1_job1", r1Job1.JobID)
 				assert.Equal(t, callerJob2ID, r1Job1.ParentJobID)
+				require.NotNil(t, r1Job1.TokenPermissions)
+				assert.Equal(t, perm_model.AccessModeRead, r1Job1.TokenPermissions.UnitAccessModes[unit.TypeCode])
 				payload := getWorkflowCallPayloadFromTask(t, r1Job1Task)
 				if assert.Len(t, payload.Inputs, 5) {
 					assert.Equal(t, "from_caller_job2", payload.Inputs["str_input"])
@@ -253,6 +261,8 @@ jobs:
 				r1Job3AttemptJobID = r1Job3.AttemptJobID
 				r2Job1 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable2_job1"})
 				assert.Equal(t, r1Job3ID, r2Job1.ParentJobID)
+				require.NotNil(t, r2Job1.TokenPermissions)
+				assert.Equal(t, perm_model.AccessModeRead, r2Job1.TokenPermissions.UnitAccessModes[unit.TypeCode])
 				r2Job1AttemptJobID = r2Job1.AttemptJobID
 
 				r2Job1Task := defaultRunner.fetchTask(t) // for reusable2_job1
@@ -575,7 +585,7 @@ jobs:
 			assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRun{RepoID: repo.ID}))
 		})
 
-		t.Run("Nested caller with missing callee fails instead of blocking", func(t *testing.T) {
+		t.Run("Nested caller with missing callee fails with the error as summary instead of blocking", func(t *testing.T) {
 			// When the expansion hits a terminal error (e.g. missing callee), the emitter must fail the caller and let the run finish as failed, not retry the expansion forever.
 			apiRepo := createActionsTestRepo(t, user2Token, "nested-caller-missing-callee", false)
 			repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
@@ -616,6 +626,9 @@ jobs:
 			assert.Equal(t, actions_model.StatusFailure, finalRun.Status)
 
 			runner.fetchNoTask(t) // no task scheduled for the failed caller; the run is not stuck
+			summary, err := actions_model.GetActionRunJobSummary(t.Context(), repo.ID, run.ID, badCaller.RunAttemptID, badCaller.ID, 0)
+			require.NoError(t, err)
+			assert.Contains(t, summary.Content, "does-not-exist.yml")
 		})
 
 		t.Run("Fork PR with secrets: inherit does not leak base repo secrets", func(t *testing.T) {