fix: remove binaries from git tracking

Add GOLANGCI_LINT_CACHE and XDG_CACHE_HOME environment variables
pointing to job-specific cache directory to prevent parallel job
conflicts when running golangci-lint.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+tab_width = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{go}]
+indent_style = tab
+
+[Makefile]
+indent_style = tab

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.gitea/workflows/release-nightly.yml

@@ -1,22 +0,0 @@
-name: goreleaser
-
-on:
-  push:
-    branches: [ main ]
-
-jobs:
-  goreleaser:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: https://github.com/goreleaser/goreleaser-action@v4
-        with:
-            distribution: goreleaser-pro
-            version: latest
-            args: release --nightly --clean
-        env:
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          S3_BUCKET: ${{ secrets.S3_BUCKET }}
-          S3_REGION: ${{ secrets.AWS_REGION }}
-          AWS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.gitea/workflows/release-tag.yml

@@ -0,0 +1,79 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: linux-latest
+    strategy:
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+          - goos: windows
+            goarch: amd64
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v4
+        with:
+          go-version-file: 'go.mod'
+          cache: false
+
+      - name: Build
+        env:
+          GOPRIVATE: git.marketally.com
+          VERSION: ${{ github.ref_name }}
+        run: |
+          # Strip the v prefix from tag
+          VERSION="${VERSION#v}"
+          EXT=""
+          if [ "${{ matrix.goos }}" = "windows" ]; then
+            EXT=".exe"
+          fi
+          echo "Building version: ${VERSION}"
+          CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
+            go build -a -ldflags "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=${VERSION}" \
+            -o act_runner-${{ matrix.goos }}-${{ matrix.goarch }}${EXT}
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: act_runner-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: act_runner-*
+
+  release:
+    needs: build
+    runs-on: linux-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v3
+        with:
+          path: artifacts
+
+      - name: Prepare release files
+        run: |
+          mkdir -p release
+          find artifacts -type f -name 'act_runner-*' -exec mv {} release/ \;
+          cd release && sha256sum * > checksums.txt
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: release/*
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitea/workflows/test.yml

@@ -1,23 +1,33 @@
-name: checks
-on: 
-  - push
-  - pull_request
+name: CI
 
-env:
-  GOPROXY: https://goproxy.io,direct
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
 
 jobs:
-  lint:
-    name: check and test
+  build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.20
-      - uses: actions/checkout@v3
-      - name: vet checks
+          go-version-file: 'go.mod'
+          cache: false
+
+      - name: Vet
         run: make vet
-      - name: build
+        env:
+          GOPRIVATE: git.marketally.com
+
+      - name: Build
         run: make build
-      - name: test
-        run: make test
+        env:
+          GOPRIVATE: git.marketally.com
+
+      - name: Test
+        run: make test
+        env:
+          GOPRIVATE: git.marketally.com

.gitignore

@@ -1,4 +1,15 @@
-act_runner
+/act_runner
 .env
 .runner
-coverage.txt
+coverage.txt
+/gitea-vet
+/config.yaml
+
+# Jetbrains
+.idea
+# MS VSCode
+.vscode
+__debug_bin
+# gorelease binary folder
+dist
+act_runner-*

.golangci.yml

@@ -1,14 +1,11 @@
 linters:
   enable:
     - gosimple
-    - deadcode
     - typecheck
     - govet
     - errcheck
     - staticcheck
     - unused
-    - structcheck
-    - varcheck
     - dupl
     #- gocyclo # The cyclomatic complexety of a lot of functions is too high, we should refactor those another time.
     - gofmt
@@ -112,7 +109,6 @@ issues:
         - gocritic
     - linters:
         - unused
-        - deadcode
       text: "swagger"
     - path: contrib/pr/checkout.go
       linters:
@@ -154,9 +150,6 @@ issues:
     - path: cmd/dump.go
       linters:
         - dupl
-    - path: services/webhook/webhook.go
-      linters:
-        - structcheck
     - text: "commentFormatting: put a space between `//` and comment text"
       linters:
         - gocritic

.goreleaser.checksum.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+
+if [ -z "$1" ]; then
+  echo "usage: $0 <path>"
+  exit 1
+fi
+
+SUM=$(shasum -a 256 "$1" | cut -d' ' -f1)
+BASENAME=$(basename "$1")
+echo -n "${SUM}  ${BASENAME}" > "$1".sha256

.goreleaser.yaml

@@ -1,3 +1,5 @@
+version: 2
+
 before:
   hooks:
     - go mod tidy
@@ -14,8 +16,9 @@ builds:
   - amd64
   - arm
   - arm64
+  - loong64
   - s390x
-  - ppc64le
+  - riscv64
   goarm:
   - "5"
   - "6"
@@ -40,6 +43,8 @@ builds:
     - goos: windows
       goarch: arm
       goarm: "7"
+    - goos: windows
+      goarch: arm64
     - goos: freebsd
       goarch: ppc64le
     - goos: freebsd
@@ -53,14 +58,15 @@ builds:
     - goos: freebsd
       goarch: arm
       goarm: "7"
+    - goos: freebsd
+      goarch: arm64
   flags:
   - -trimpath
   ldflags:
-  - -s -w
+  - -s -w -X gitea.com/gitea/act_runner/internal/pkg/ver.version={{ .Summary }}
   binary: >-
     {{ .ProjectName }}-
-    {{- if .IsSnapshot }}{{ .Branch }}-
-    {{- else }}{{- .Version }}-{{ end }}
+    {{- .Version }}-
     {{- .Os }}-
     {{- if eq .Arch "amd64" }}amd64
     {{- else if eq .Arch "amd64_v1" }}amd64
@@ -68,13 +74,22 @@ builds:
     {{- else }}{{ .Arch }}{{ end }}
     {{- if .Arm }}-{{ .Arm }}{{ end }}
   no_unique_dist_dir: true
+  hooks:
+    post:
+      - cmd: xz -k -9 {{ .Path }}
+        dir: ./dist/
+      - cmd: sh .goreleaser.checksum.sh {{ .Path }}
+      - cmd: sh .goreleaser.checksum.sh {{ .Path }}.xz
 
 blobs:
   -
     provider: s3
     bucket: "{{ .Env.S3_BUCKET }}"
     region: "{{ .Env.S3_REGION }}"
-    folder: "act_runner/{{.Version}}"
+    directory: "act_runner/{{.Version}}"
+    extra_files:
+      - glob: ./**.xz
+      - glob: ./**.sha256
 
 archives:
   - format: binary
@@ -83,10 +98,23 @@ archives:
 
 checksum:
   name_template: 'checksums.txt'
+  extra_files:
+      - glob: ./**.xz
 
 snapshot:
-  name_template: "{{ incpatch .Version }}"
+  version_template: "{{ .Branch }}-devel"
 
 nightly:
-  publish_release: false
-  name_template: "{{ .Branch }}"
+  version_template: "nightly"
+
+gitea_urls:
+  api: https://gitea.com/api/v1
+  download: https://gitea.com
+
+release:
+  extra_files:
+    - glob: ./**.xz
+    - glob: ./**.xz.sha256
+
+# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj

Dockerfile

@@ -0,0 +1,64 @@
+### BUILDER STAGE
+#
+#
+FROM golang:1.24-alpine AS builder
+
+# Do not remove `git` here, it is required for getting runner version when executing `make build`
+RUN apk add --no-cache make git
+
+ARG GOPROXY
+ENV GOPROXY=${GOPROXY:-}
+
+COPY . /opt/src/act_runner
+WORKDIR /opt/src/act_runner
+
+RUN make clean && make build
+
+### DIND VARIANT
+#
+#
+FROM docker:28-dind AS dind
+
+RUN apk add --no-cache s6 bash git tzdata
+
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
+COPY scripts/run.sh /usr/local/bin/run.sh
+COPY scripts/s6 /etc/s6
+
+VOLUME /data
+
+ENTRYPOINT ["s6-svscan","/etc/s6"]
+
+### DIND-ROOTLESS VARIANT
+#
+#
+FROM docker:28-dind-rootless AS dind-rootless
+
+USER root
+RUN apk add --no-cache s6 bash git tzdata
+
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
+COPY scripts/run.sh /usr/local/bin/run.sh
+COPY scripts/s6 /etc/s6
+
+VOLUME /data
+
+RUN mkdir -p /data && chown -R rootless:rootless /etc/s6 /data
+
+ENV DOCKER_HOST=unix:///run/user/1000/docker.sock
+
+USER rootless
+ENTRYPOINT ["s6-svscan","/etc/s6"]
+
+### BASIC VARIANT
+#
+#
+FROM alpine AS basic
+RUN apk add --no-cache tini bash git tzdata
+
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
+COPY scripts/run.sh /usr/local/bin/run.sh
+
+VOLUME /data
+
+ENTRYPOINT ["/sbin/tini","--","run.sh"]

HOWTOSTART.md

@@ -0,0 +1,121 @@
+# How to Start a GitCaddy Runner
+
+This guide explains how to set up and start a GitCaddy Actions runner (act_runner) to execute your CI/CD workflows.
+
+## Prerequisites
+
+- A Linux, macOS, or Windows machine
+- Network access to your GitCaddy/Gitea instance
+- (Optional) Docker installed for container-based workflows
+
+## Quick Start
+
+### 1. Download the Runner
+
+Download the latest release from the [releases page](https://git.marketally.com/gitcaddy/act_runner/releases) or build from source:
+
+```bash
+git clone https://git.marketally.com/gitcaddy/act_runner.git
+cd act_runner
+make build
+```
+
+### 2. Register the Runner
+
+Get a registration token from your GitCaddy instance:
+- **Global runners**: Admin Area → Actions → Runners → Create Runner
+- **Organization runners**: Organization Settings → Actions → Runners
+- **Repository runners**: Repository Settings → Actions → Runners
+
+Then register:
+
+```bash
+./act_runner register --no-interactive \
+  --instance https://your-gitea-instance.com \
+  --token YOUR_REGISTRATION_TOKEN \
+  --name my-runner \
+  --labels linux,ubuntu-latest
+```
+
+### 3. Start the Runner
+
+```bash
+./act_runner daemon
+```
+
+## Configuration Options
+
+### Runner Labels
+
+Labels determine which jobs the runner can execute. Configure labels during registration or edit them in the admin UI.
+
+Common labels:
+- `linux`, `linux-latest` - Linux runners
+- `windows`, `windows-latest` - Windows runners
+- `macos`, `macos-latest` - macOS runners
+- `ubuntu`, `ubuntu-latest` - Ubuntu-specific
+- `self-hosted` - Self-hosted runners
+
+### Running as a Service
+
+#### Linux (systemd)
+
+```bash
+sudo cat > /etc/systemd/system/act_runner.service << 'SERVICE'
+[Unit]
+Description=GitCaddy Actions Runner
+After=network.target
+
+[Service]
+Type=simple
+User=runner
+WorkingDirectory=/opt/act_runner
+ExecStart=/opt/act_runner/act_runner daemon
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+SERVICE
+
+sudo systemctl enable act_runner
+sudo systemctl start act_runner
+```
+
+### Docker Support
+
+For workflows that use container actions, ensure Docker is installed and the runner user has access:
+
+```bash
+sudo usermod -aG docker $USER
+```
+
+## Capabilities Detection
+
+The runner automatically detects and reports:
+- Operating system and architecture
+- Available shells (bash, sh, powershell)
+- Installed tools (node, python, go, etc.)
+- Docker availability
+- Disk space and network bandwidth
+
+These capabilities help admins understand what each runner can handle.
+
+## Troubleshooting
+
+### Runner not connecting
+
+1. Check network connectivity to your GitCaddy instance
+2. Verify the registration token is valid
+3. Check firewall rules allow outbound HTTPS
+
+### Jobs not running
+
+1. Verify runner labels match the job's `runs-on` requirement
+2. Check runner is online in the admin panel
+3. Review runner logs: `journalctl -u act_runner -f`
+
+## More Information
+
+- [act_runner Repository](https://git.marketally.com/gitcaddy/act_runner)
+- [GitCaddy Documentation](https://git.marketally.com/gitcaddy/gitea)

Makefile

@@ -1,19 +1,26 @@
 DIST := dist
 EXECUTABLE := act_runner
 GOFMT ?= gofumpt -l
-DIST := dist
 DIST_DIRS := $(DIST)/binaries $(DIST)/release
 GO ?= go
 SHASUM ?= shasum -a 256
 HAS_GO = $(shell hash $(GO) > /dev/null 2>&1 && echo "GO" || echo "NOGO" )
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
-XGO_VERSION := go-1.18.x
+XGO_VERSION := go-1.24.x
 GXZ_PAGAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.10
 
 LINUX_ARCHS ?= linux/amd64,linux/arm64
 DARWIN_ARCHS ?= darwin-12/amd64,darwin-12/arm64
 WINDOWS_ARCHS ?= windows/amd64
-GOFILES := $(shell find . -type f -name "*.go" ! -name "generated.*")
+GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*")
+GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*")
+
+DOCKER_IMAGE ?= gitea/act_runner
+DOCKER_TAG ?= nightly
+DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
+DOCKER_ROOTLESS_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)-dind-rootless
+
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
 
 ifneq ($(shell uname), Darwin)
 	EXTLDFLAGS = -extldflags "-static" $(null)
@@ -49,7 +56,7 @@ else
 	ifneq ($(DRONE_BRANCH),)
 		VERSION ?= $(subst release/v,,$(DRONE_BRANCH))
 	else
-		VERSION ?= master
+		VERSION ?= main
 	endif
 
 	STORED_VERSION=$(shell cat $(STORED_VERSION_FILE) 2>/dev/null)
@@ -60,8 +67,11 @@ else
 	endif
 endif
 
+GO_PACKAGES_TO_VET ?= $(filter-out gitea.com/gitea/act_runner/internal/pkg/client/mocks,$(shell $(GO) list ./...))
+
+
 TAGS ?=
-LDFLAGS ?= -X 'main.Version=$(VERSION)'
+LDFLAGS ?= -X "gitea.com/gitea/act_runner/internal/pkg/ver.version=v$(RELASE_VERSION)"
 
 all: build
 
@@ -69,30 +79,51 @@ fmt:
 	@hash gofumpt > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GO) install mvdan.cc/gofumpt@latest; \
 	fi
-	$(GOFMT) -w $(GOFILES)
+	$(GOFMT) -w $(GO_FMT_FILES)
 
-vet:
-	$(GO) vet ./...
+.PHONY: go-check
+go-check:
+	$(eval MIN_GO_VERSION_STR := $(shell grep -Eo '^go\s+[0-9]+\.[0-9]+' go.mod | cut -d' ' -f2))
+	$(eval MIN_GO_VERSION := $(shell printf "%03d%03d" $(shell echo '$(MIN_GO_VERSION_STR)' | tr '.' ' ')))
+	$(eval GO_VERSION := $(shell printf "%03d%03d" $(shell $(GO) version | grep -Eo '[0-9]+\.[0-9]+' | tr '.' ' ');))
+	@if [ "$(GO_VERSION)" -lt "$(MIN_GO_VERSION)" ]; then \
+		echo "Act Runner requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
+		exit 1; \
+	fi
 
 .PHONY: fmt-check
 fmt-check:
 	@hash gofumpt > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
 		$(GO) install mvdan.cc/gofumpt@latest; \
 	fi
-	@diff=$$($(GOFMT) -d $(GOFILES)); \
+	@diff=$$($(GOFMT) -d $(GO_FMT_FILES)); \
 	if [ -n "$$diff" ]; then \
 		echo "Please run 'make fmt' and commit the result:"; \
 		echo "$${diff}"; \
 		exit 1; \
 	fi;
 
-test: fmt-check
+.PHONY: deps-tools
+deps-tools: ## install tool dependencies
+	$(GO) install $(GOVULNCHECK_PACKAGE)
+
+.PHONY: security-check
+security-check: deps-tools
+	GOEXPERIMENT= $(GO) run $(GOVULNCHECK_PACKAGE) -show color ./...
+
+test: fmt-check security-check
 	@$(GO) test -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
 
+.PHONY: vet
+vet:
+	@echo "Running go vet..."
+	@$(GO) build code.gitea.io/gitea-vet
+	@$(GO) vet -vettool=gitea-vet $(GO_PACKAGES_TO_VET)
+
 install: $(GOFILES)
 	$(GO) install -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)'
 
-build: $(EXECUTABLE)
+build: go-check $(EXECUTABLE)
 
 $(EXECUTABLE): $(GOFILES)
 	$(GO) build -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)' -o $@
@@ -142,6 +173,13 @@ release-check: | $(DIST_DIRS)
 release-compress: | $(DIST_DIRS)
 	cd $(DIST)/release/; for file in `find . -type f -name "*"`; do echo "compressing $${file}" && $(GO) run $(GXZ_PAGAGE) -k -9 $${file}; done;
 
+.PHONY: docker
+docker:
+	if ! docker buildx version >/dev/null 2>&1; then \
+		ARG_DISABLE_CONTENT_TRUST=--disable-content-trust=false; \
+	fi; \
+	docker build $${ARG_DISABLE_CONTENT_TRUST} -t $(DOCKER_REF) .
+
 clean:
 	$(GO) clean -x -i ./...
 	rm -rf coverage.txt $(EXECUTABLE) $(DIST)

README.md

@@ -1,61 +1,195 @@
-# act runner
+# GitCaddy Act Runner
 
-Act runner is a runner for Gitea based on [act](https://gitea.com/gitea/act).
+A Gitea Actions runner with enhanced capability detection and reporting for AI-friendly workflow generation.
 
-## Prerequisites
+> **This is a GitCaddy fork** of [gitea.com/gitea/act_runner](https://gitea.com/gitea/act_runner) with runner capability discovery features.
 
-Docker Engine Community version is required. To install Docker CE, follow the official [install instructions](https://docs.docker.com/engine/install/).
+## Overview
 
-## Quickstart
+Act Runner executes Gitea Actions workflows using [act](https://github.com/nektos/act). This fork adds automatic capability detection, enabling Gitea to expose runner capabilities via API for AI tools to query before generating workflows.
 
-### Build
+## Key Features
+
+- **Capability Detection**: Automatically detects OS, architecture, Docker support, available shells, and installed tools
+- **Capability Reporting**: Reports capabilities to Gitea server during runner declaration
+- **Full Compatibility**: Drop-in replacement for standard act_runner
+- **Multi-Platform**: Supports Linux, macOS, and Windows
+
+## Installation
+
+### Download Pre-built Binary
+
+Download from [Releases](https://git.marketally.com/gitcaddy/act_runner/releases):
 
 ```bash
+# Linux (amd64)
+curl -L -o act_runner https://git.marketally.com/gitcaddy/act_runner/releases/download/v0.3.1-gitcaddy/act_runner-linux-amd64
+chmod +x act_runner
+
+# macOS (Apple Silicon)
+curl -L -o act_runner https://git.marketally.com/gitcaddy/act_runner/releases/download/v0.3.1-gitcaddy/act_runner-darwin-arm64
+chmod +x act_runner
+```
+
+### Build from Source
+
+```bash
+git clone https://git.marketally.com/gitcaddy/act_runner.git
+cd act_runner
 make build
 ```
 
-### Register
+## Quick Start
+
+### 1. Enable Actions in Gitea
+
+Add to your Gitea `app.ini`:
+
+```ini
+[actions]
+ENABLED = true
+```
+
+### 2. Register the Runner
 
 ```bash
-./act_runner register
+./act_runner register \
+  --instance https://your-gitea-instance.com \
+  --token YOUR_RUNNER_TOKEN \
+  --name my-runner \
+  --labels ubuntu-latest,docker
 ```
 
-And you will be asked to input:
-
-1. Gitea instance URL, like `http://192.168.8.8:3000/`. You should use your gitea instance ROOT_URL as the instance argument
- and you should not use `localhost` or `127.0.0.1` as instance IP;
-2. Runner token, you can get it from `http://192.168.8.8:3000/admin/runners`;
-3. Runner name, you can just leave it blank;
-4. Runner labels, you can just leave it blank.
-
-The process looks like:
-
-```text
-INFO Registering runner, arch=amd64, os=darwin, version=0.1.5.
-WARN Runner in user-mode.
-INFO Enter the Gitea instance URL (for example, https://gitea.com/):
-http://192.168.8.8:3000/
-INFO Enter the runner token:
-fe884e8027dc292970d4e0303fe82b14xxxxxxxx
-INFO Enter the runner name (if set empty, use hostname:Test.local ):
-
-INFO Enter the runner labels, leave blank to use the default labels (comma-separated, for example, self-hosted,ubuntu-20.04:docker://node:16-bullseye,ubuntu-18.04:docker://node:16-buster):
-
-INFO Registering runner, name=Test.local, instance=http://192.168.8.8:3000/, labels=[ubuntu-latest:docker://node:16-bullseye ubuntu-22.04:docker://node:16-bullseye ubuntu-20.04:docker://node:16-bullseye ubuntu-18.04:docker://node:16-buster].
-DEBU Successfully pinged the Gitea instance server
-INFO Runner registered successfully.
-```
-
-You can also register with command line arguments.
-
-```bash
-./act_runner register --instance http://192.168.8.8:3000 --token <my_runner_token> --no-interactive
-```
-
-If the registry succeed, it will run immediately. Next time, you could run the runner directly.
-
-### Run
+### 3. Start the Runner
 
 ```bash
 ./act_runner daemon
-```
+```
+
+On startup, the runner will:
+1. Detect system capabilities (OS, arch, Docker, shells, tools)
+2. Report capabilities to Gitea via the Declare API
+3. Begin polling for jobs
+
+## Capability Detection
+
+The runner automatically detects:
+
+| Category | Examples |
+|----------|----------|
+| **OS/Arch** | linux/amd64, darwin/arm64, windows/amd64 |
+| **Container Runtime** | Docker, Podman |
+| **Shells** | bash, sh, zsh, powershell, cmd |
+| **Tools** | Node.js, Go, Python, Java, .NET, Rust |
+| **Features** | Cache support, Docker Compose |
+
+### Example Capabilities JSON
+
+```json
+{
+  "os": "linux",
+  "arch": "amd64",
+  "docker": true,
+  "docker_compose": true,
+  "container_runtime": "docker",
+  "shell": ["bash", "sh"],
+  "tools": {
+    "node": ["18.19.0"],
+    "go": ["1.21.5"],
+    "python": ["3.11.6"]
+  },
+  "features": {
+    "cache": true,
+    "docker_services": true
+  },
+  "limitations": []
+}
+```
+
+## Configuration
+
+Create a config file or use command-line flags:
+
+```bash
+./act_runner generate-config > config.yaml
+./act_runner -c config.yaml daemon
+```
+
+Example configuration:
+
+```yaml
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 1
+  timeout: 3h
+  labels:
+    - ubuntu-latest:docker://node:18-bullseye
+    - ubuntu-22.04:docker://ubuntu:22.04
+
+container:
+  docker_host: ""
+  force_pull: false
+  privileged: false
+
+cache:
+  enabled: true
+  dir: ~/.cache/actcache
+```
+
+## Docker Deployment
+
+```bash
+docker run -d \
+  --name act_runner \
+  -e GITEA_INSTANCE_URL=https://your-gitea.com \
+  -e GITEA_RUNNER_REGISTRATION_TOKEN=<token> \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v ./data:/data \
+  gitcaddy/act_runner:latest
+```
+
+## GitCaddy Integration
+
+This runner is designed to work with the [GitCaddy Gitea fork](https://git.marketally.com/gitcaddy/gitea), which provides:
+
+- **Runner Capabilities API** (`/api/v2/repos/{owner}/{repo}/actions/runners/capabilities`)
+- **Workflow Validation API** for pre-flight checks
+- **Action Compatibility Database** for GitHub Actions mapping
+
+### How It Works
+
+```
+
+  act_runner                      Gitea                    AI Tool
+      |                             |                         |
+      |  Declare + Capabilities     |                         |
+      |---------------------------->|                         |
+      |                             |                         |
+      |                             |  GET /api/v2/.../caps   |
+      |                             |<------------------------|
+      |                             |                         |
+      |                             |  Runner capabilities    |
+      |                             |------------------------>|
+      |                             |                         |
+      |                             |     Generates workflow  |
+      |                             |     with correct config |
+
+```
+
+## Related Projects
+
+| Project | Description |
+|---------|-------------|
+| [gitcaddy/gitea](https://git.marketally.com/gitcaddy/gitea) | Gitea with AI-friendly enhancements |
+| [gitcaddy/actions-proto-go](https://git.marketally.com/gitcaddy/actions-proto-go) | Protocol definitions with capability support |
+
+## Upstream
+
+This project is a fork of [gitea.com/gitea/act_runner](https://gitea.com/gitea/act_runner). We contribute enhancements back to upstream where appropriate.
+
+## License
+
+MIT License - see [LICENSE](LICENSE) for details.

build.go

@@ -0,0 +1,11 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build vendor
+
+package main
+
+import (
+	// for vet
+	_ "code.gitea.io/gitea-vet"
+)

cmd/cmd.go

@@ -1,63 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"os"
-
-	"github.com/spf13/cobra"
-)
-
-const version = "0.1.5"
-
-type globalArgs struct {
-	EnvFile string
-}
-
-func Execute(ctx context.Context) {
-	// task := runtime.NewTask("gitea", 0, nil, nil)
-
-	var gArgs globalArgs
-
-	// ./act_runner
-	rootCmd := &cobra.Command{
-		Use:          "act [event name to run]\nIf no event name passed, will default to \"on: push\"",
-		Short:        "Run GitHub actions locally by specifying the event name (e.g. `push`) or an action name directly.",
-		Args:         cobra.MaximumNArgs(1),
-		Version:      version,
-		SilenceUsage: true,
-	}
-	rootCmd.PersistentFlags().StringVarP(&gArgs.EnvFile, "env-file", "", ".env", "Read in a file of environment variables.")
-
-	// ./act_runner register
-	var regArgs registerArgs
-	registerCmd := &cobra.Command{
-		Use:   "register",
-		Short: "Register a runner to the server",
-		Args:  cobra.MaximumNArgs(0),
-		RunE:  runRegister(ctx, &regArgs, gArgs.EnvFile), // must use a pointer to regArgs
-	}
-	registerCmd.Flags().BoolVar(&regArgs.NoInteractive, "no-interactive", false, "Disable interactive mode")
-	registerCmd.Flags().StringVar(&regArgs.InstanceAddr, "instance", "", "Gitea instance address")
-	registerCmd.Flags().BoolVar(&regArgs.Insecure, "insecure", false, "If check server's certificate if it's https protocol")
-	registerCmd.Flags().StringVar(&regArgs.Token, "token", "", "Runner token")
-	registerCmd.Flags().StringVar(&regArgs.RunnerName, "name", "", "Runner name")
-	registerCmd.Flags().StringVar(&regArgs.Labels, "labels", "", "Runner tags, comma separated")
-	rootCmd.AddCommand(registerCmd)
-
-	// ./act_runner daemon
-	daemonCmd := &cobra.Command{
-		Use:   "daemon",
-		Short: "Run as a runner daemon",
-		Args:  cobra.MaximumNArgs(1),
-		RunE:  runDaemon(ctx, gArgs.EnvFile),
-	}
-	// add all command
-	rootCmd.AddCommand(daemonCmd)
-
-	// hide completion command
-	rootCmd.CompletionOptions.HiddenDefaultCmd = true
-
-	if err := rootCmd.Execute(); err != nil {
-		os.Exit(1)
-	}
-}

cmd/daemon.go

@@ -1,112 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"os"
-	"strings"
-
-	"gitea.com/gitea/act_runner/client"
-	"gitea.com/gitea/act_runner/config"
-	"gitea.com/gitea/act_runner/engine"
-	"gitea.com/gitea/act_runner/poller"
-	"gitea.com/gitea/act_runner/runtime"
-
-	"github.com/joho/godotenv"
-	"github.com/mattn/go-isatty"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-	"golang.org/x/sync/errgroup"
-)
-
-func runDaemon(ctx context.Context, envFile string) func(cmd *cobra.Command, args []string) error {
-	return func(cmd *cobra.Command, args []string) error {
-		log.Infoln("Starting runner daemon")
-
-		_ = godotenv.Load(envFile)
-		cfg, err := config.FromEnviron()
-		if err != nil {
-			log.WithError(err).
-				Fatalln("invalid configuration")
-		}
-
-		initLogging(cfg)
-
-		// require docker if a runner label uses a docker backend
-		needsDocker := false
-		for _, l := range cfg.Runner.Labels {
-			splits := strings.SplitN(l, ":", 2)
-			if len(splits) == 2 && strings.HasPrefix(splits[1], "docker://") {
-				needsDocker = true
-				break
-			}
-		}
-
-		if needsDocker {
-			// try to connect to docker daemon
-			// if failed, exit with error
-			if err := engine.Start(ctx); err != nil {
-				log.WithError(err).Fatalln("failed to connect docker daemon engine")
-			}
-		}
-
-		var g errgroup.Group
-
-		cli := client.New(
-			cfg.Client.Address,
-			cfg.Client.Insecure,
-			cfg.Runner.UUID,
-			cfg.Runner.Token,
-		)
-
-		runner := &runtime.Runner{
-			Client:        cli,
-			Machine:       cfg.Runner.Name,
-			ForgeInstance: cfg.Client.Address,
-			Environ:       cfg.Runner.Environ,
-			Labels:        cfg.Runner.Labels,
-		}
-
-		poller := poller.New(
-			cli,
-			runner.Run,
-			cfg.Runner.Capacity,
-		)
-
-		g.Go(func() error {
-			l := log.WithField("capacity", cfg.Runner.Capacity).
-				WithField("endpoint", cfg.Client.Address).
-				WithField("os", cfg.Platform.OS).
-				WithField("arch", cfg.Platform.Arch)
-			l.Infoln("polling the remote server")
-
-			if err := poller.Poll(ctx); err != nil {
-				l.Errorf("poller error: %v", err)
-			}
-			poller.Wait()
-			return nil
-		})
-
-		err = g.Wait()
-		if err != nil {
-			log.WithError(err).
-				Errorln("shutting down the server")
-		}
-		return err
-	}
-}
-
-// initLogging setup the global logrus logger.
-func initLogging(cfg config.Config) {
-	isTerm := isatty.IsTerminal(os.Stdout.Fd())
-	log.SetFormatter(&log.TextFormatter{
-		DisableColors: !isTerm,
-		FullTimestamp: true,
-	})
-
-	if cfg.Debug {
-		log.SetLevel(log.DebugLevel)
-	}
-	if cfg.Trace {
-		log.SetLevel(log.TraceLevel)
-	}
-}

cmd/register.go

@@ -1,305 +0,0 @@
-package cmd
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"os"
-	"os/signal"
-	"runtime"
-	"strings"
-	"time"
-
-	pingv1 "code.gitea.io/actions-proto-go/ping/v1"
-	"gitea.com/gitea/act_runner/client"
-	"gitea.com/gitea/act_runner/config"
-	"gitea.com/gitea/act_runner/register"
-
-	"github.com/bufbuild/connect-go"
-	"github.com/joho/godotenv"
-	"github.com/mattn/go-isatty"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-)
-
-// runRegister registers a runner to the server
-func runRegister(ctx context.Context, regArgs *registerArgs, envFile string) func(*cobra.Command, []string) error {
-	return func(cmd *cobra.Command, args []string) error {
-		log.SetReportCaller(false)
-		isTerm := isatty.IsTerminal(os.Stdout.Fd())
-		log.SetFormatter(&log.TextFormatter{
-			DisableColors:    !isTerm,
-			DisableTimestamp: true,
-		})
-		log.SetLevel(log.DebugLevel)
-
-		log.Infof("Registering runner, arch=%s, os=%s, version=%s.",
-			runtime.GOARCH, runtime.GOOS, version)
-
-		// runner always needs root permission
-		if os.Getuid() != 0 {
-			// TODO: use a better way to check root permission
-			log.Warnf("Runner in user-mode.")
-		}
-
-		if regArgs.NoInteractive {
-			if err := registerNoInteractive(envFile, regArgs); err != nil {
-				return err
-			}
-		} else {
-			go func() {
-				if err := registerInteractive(envFile); err != nil {
-					// log.Errorln(err)
-					os.Exit(2)
-					return
-				}
-				os.Exit(0)
-			}()
-
-			c := make(chan os.Signal, 1)
-			signal.Notify(c, os.Interrupt)
-			<-c
-		}
-
-		return nil
-	}
-}
-
-// registerArgs represents the arguments for register command
-type registerArgs struct {
-	NoInteractive bool
-	InstanceAddr  string
-	Insecure      bool
-	Token         string
-	RunnerName    string
-	Labels        string
-}
-
-type registerStage int8
-
-const (
-	StageUnknown              registerStage = -1
-	StageOverwriteLocalConfig registerStage = iota + 1
-	StageInputInstance
-	StageInputToken
-	StageInputRunnerName
-	StageInputCustomLabels
-	StageWaitingForRegistration
-	StageExit
-)
-
-var defaultLabels = []string{
-	"ubuntu-latest:docker://node:16-bullseye",
-	"ubuntu-22.04:docker://node:16-bullseye", // There's no node:16-bookworm yet
-	"ubuntu-20.04:docker://node:16-bullseye",
-	"ubuntu-18.04:docker://node:16-buster",
-}
-
-type registerInputs struct {
-	InstanceAddr string
-	Insecure     bool
-	Token        string
-	RunnerName   string
-	CustomLabels []string
-}
-
-func (r *registerInputs) validate() error {
-	if r.InstanceAddr == "" {
-		return fmt.Errorf("instance address is empty")
-	}
-	if r.Token == "" {
-		return fmt.Errorf("token is empty")
-	}
-	if len(r.CustomLabels) > 0 {
-		return validateLabels(r.CustomLabels)
-	}
-	return nil
-}
-
-func validateLabels(labels []string) error {
-	for _, label := range labels {
-		values := strings.SplitN(label, ":", 2)
-		if len(values) > 2 {
-			return fmt.Errorf("Invalid label: %s", label)
-		}
-		// len(values) == 1, label for non docker execution environment
-		// TODO: validate value format, like docker://node:16-buster
-	}
-	return nil
-}
-
-func (r *registerInputs) assignToNext(stage registerStage, value string) registerStage {
-	// must set instance address and token.
-	// if empty, keep current stage.
-	if stage == StageInputInstance || stage == StageInputToken {
-		if value == "" {
-			return stage
-		}
-	}
-
-	// set hostname for runner name if empty
-	if stage == StageInputRunnerName && value == "" {
-		value, _ = os.Hostname()
-	}
-
-	switch stage {
-	case StageOverwriteLocalConfig:
-		if value == "Y" || value == "y" {
-			return StageInputInstance
-		}
-		return StageExit
-	case StageInputInstance:
-		r.InstanceAddr = value
-		return StageInputToken
-	case StageInputToken:
-		r.Token = value
-		return StageInputRunnerName
-	case StageInputRunnerName:
-		r.RunnerName = value
-		return StageInputCustomLabels
-	case StageInputCustomLabels:
-		r.CustomLabels = defaultLabels
-		if value != "" {
-			r.CustomLabels = strings.Split(value, ",")
-		}
-
-		if validateLabels(r.CustomLabels) != nil {
-			log.Infoln("Invalid labels, please input again, leave blank to use the default labels (for example, ubuntu-20.04:docker://node:16-bullseye,ubuntu-18.04:docker://node:16-buster)")
-			return StageInputCustomLabels
-		}
-		return StageWaitingForRegistration
-	}
-	return StageUnknown
-}
-
-func registerInteractive(envFile string) error {
-	var (
-		reader = bufio.NewReader(os.Stdin)
-		stage  = StageInputInstance
-		inputs = new(registerInputs)
-	)
-
-	// check if overwrite local config
-	_ = godotenv.Load(envFile)
-	cfg, _ := config.FromEnviron()
-	if f, err := os.Stat(cfg.Runner.File); err == nil && !f.IsDir() {
-		stage = StageOverwriteLocalConfig
-	}
-
-	for {
-		printStageHelp(stage)
-
-		cmdString, err := reader.ReadString('\n')
-		if err != nil {
-			return err
-		}
-		stage = inputs.assignToNext(stage, strings.TrimSpace(cmdString))
-
-		if stage == StageWaitingForRegistration {
-			log.Infof("Registering runner, name=%s, instance=%s, labels=%v.", inputs.RunnerName, inputs.InstanceAddr, inputs.CustomLabels)
-			if err := doRegister(&cfg, inputs); err != nil {
-				log.Errorf("Failed to register runner: %v", err)
-			} else {
-				log.Infof("Runner registered successfully.")
-			}
-			return nil
-		}
-
-		if stage == StageExit {
-			return nil
-		}
-
-		if stage <= StageUnknown {
-			log.Errorf("Invalid input, please re-run act command.")
-			return nil
-		}
-	}
-}
-
-func printStageHelp(stage registerStage) {
-	switch stage {
-	case StageOverwriteLocalConfig:
-		log.Infoln("Runner is already registered, overwrite local config? [y/N]")
-	case StageInputInstance:
-		log.Infoln("Enter the Gitea instance URL (for example, https://gitea.com/):")
-	case StageInputToken:
-		log.Infoln("Enter the runner token:")
-	case StageInputRunnerName:
-		hostname, _ := os.Hostname()
-		log.Infof("Enter the runner name (if set empty, use hostname:%s ):\n", hostname)
-	case StageInputCustomLabels:
-		log.Infoln("Enter the runner labels, leave blank to use the default labels (comma-separated, for example, self-hosted,ubuntu-20.04:docker://node:16-bullseye,ubuntu-18.04:docker://node:16-buster):")
-	case StageWaitingForRegistration:
-		log.Infoln("Waiting for registration...")
-	}
-}
-
-func registerNoInteractive(envFile string, regArgs *registerArgs) error {
-	_ = godotenv.Load(envFile)
-	cfg, _ := config.FromEnviron()
-	inputs := &registerInputs{
-		InstanceAddr: regArgs.InstanceAddr,
-		Insecure:     regArgs.Insecure,
-		Token:        regArgs.Token,
-		RunnerName:   regArgs.RunnerName,
-		CustomLabels: defaultLabels,
-	}
-	regArgs.Labels = strings.TrimSpace(regArgs.Labels)
-	if regArgs.Labels != "" {
-		inputs.CustomLabels = strings.Split(regArgs.Labels, ",")
-	}
-	if inputs.RunnerName == "" {
-		inputs.RunnerName, _ = os.Hostname()
-		log.Infof("Runner name is empty, use hostname '%s'.", inputs.RunnerName)
-	}
-	if err := inputs.validate(); err != nil {
-		log.WithError(err).Errorf("Invalid input, please re-run act command.")
-		return nil
-	}
-	if err := doRegister(&cfg, inputs); err != nil {
-		log.Errorf("Failed to register runner: %v", err)
-		return nil
-	}
-	log.Infof("Runner registered successfully.")
-	return nil
-}
-
-func doRegister(cfg *config.Config, inputs *registerInputs) error {
-	ctx := context.Background()
-
-	// initial http client
-	cli := client.New(
-		inputs.InstanceAddr,
-		inputs.Insecure,
-		"", "",
-	)
-
-	for {
-		_, err := cli.Ping(ctx, connect.NewRequest(&pingv1.PingRequest{
-			Data: inputs.RunnerName,
-		}))
-		select {
-		case <-ctx.Done():
-			return nil
-		default:
-		}
-		if ctx.Err() != nil {
-			break
-		}
-		if err != nil {
-			log.WithError(err).
-				Errorln("Cannot ping the Gitea instance server")
-			// TODO: if ping failed, retry or exit
-			time.Sleep(time.Second)
-		} else {
-			log.Debugln("Successfully pinged the Gitea instance server")
-			break
-		}
-	}
-
-	cfg.Runner.Name = inputs.RunnerName
-	cfg.Runner.Token = inputs.Token
-	cfg.Runner.Labels = inputs.CustomLabels
-	_, err := register.New(cli).Register(ctx, cfg.Runner)
-	return err
-}

cmd/register_test.go

@@ -1,10 +0,0 @@
-package cmd
-
-import "testing"
-
-func TestValidateLabels(t *testing.T) {
-	labels := []string{"ubuntu-latest:docker://node:16-buster", "self-hosted"}
-	if err := validateLabels(labels); err != nil {
-		t.Errorf("validateLabels() error = %v", err)
-	}
-}

config/config.go

@@ -1,114 +0,0 @@
-package config
-
-import (
-	"encoding/json"
-	"io"
-	"os"
-	"runtime"
-	"strconv"
-
-	"gitea.com/gitea/act_runner/core"
-
-	"github.com/joho/godotenv"
-	"github.com/kelseyhightower/envconfig"
-)
-
-type (
-	// Config provides the system configuration.
-	Config struct {
-		Debug    bool `envconfig:"GITEA_DEBUG"`
-		Trace    bool `envconfig:"GITEA_TRACE"`
-		Client   Client
-		Runner   Runner
-		Platform Platform
-	}
-
-	Client struct {
-		Address  string `ignored:"true"`
-		Insecure bool
-	}
-
-	Runner struct {
-		UUID     string            `ignored:"true"`
-		Name     string            `envconfig:"GITEA_RUNNER_NAME"`
-		Token    string            `ignored:"true"`
-		Capacity int               `envconfig:"GITEA_RUNNER_CAPACITY" default:"1"`
-		File     string            `envconfig:"GITEA_RUNNER_FILE" default:".runner"`
-		Environ  map[string]string `envconfig:"GITEA_RUNNER_ENVIRON"`
-		EnvFile  string            `envconfig:"GITEA_RUNNER_ENV_FILE"`
-		Labels   []string          `envconfig:"GITEA_RUNNER_LABELS"`
-	}
-
-	Platform struct {
-		OS   string `envconfig:"GITEA_PLATFORM_OS"`
-		Arch string `envconfig:"GITEA_PLATFORM_ARCH"`
-	}
-)
-
-// FromEnviron returns the settings from the environment.
-func FromEnviron() (Config, error) {
-	cfg := Config{}
-	if err := envconfig.Process("", &cfg); err != nil {
-		return cfg, err
-	}
-
-	// check runner config exist
-	f, err := os.Stat(cfg.Runner.File)
-	if err == nil && !f.IsDir() {
-		jsonFile, _ := os.Open(cfg.Runner.File)
-		defer jsonFile.Close()
-		byteValue, _ := io.ReadAll(jsonFile)
-		var runner core.Runner
-		if err := json.Unmarshal(byteValue, &runner); err != nil {
-			return cfg, err
-		}
-		if runner.UUID != "" {
-			cfg.Runner.UUID = runner.UUID
-		}
-		if runner.Token != "" {
-			cfg.Runner.Token = runner.Token
-		}
-		if len(runner.Labels) != 0 {
-			cfg.Runner.Labels = runner.Labels
-		}
-		if runner.Address != "" {
-			cfg.Client.Address = runner.Address
-		}
-		if runner.Insecure != "" {
-			cfg.Client.Insecure, _ = strconv.ParseBool(runner.Insecure)
-		}
-	} else if err != nil {
-		return cfg, err
-	}
-
-	// runner config
-	if cfg.Runner.Environ == nil {
-		cfg.Runner.Environ = map[string]string{
-			"GITHUB_API_URL":    cfg.Client.Address + "/api/v1",
-			"GITHUB_SERVER_URL": cfg.Client.Address,
-		}
-	}
-	if cfg.Runner.Name == "" {
-		cfg.Runner.Name, _ = os.Hostname()
-	}
-
-	// platform config
-	if cfg.Platform.OS == "" {
-		cfg.Platform.OS = runtime.GOOS
-	}
-	if cfg.Platform.Arch == "" {
-		cfg.Platform.Arch = runtime.GOARCH
-	}
-
-	if file := cfg.Runner.EnvFile; file != "" {
-		envs, err := godotenv.Read(file)
-		if err != nil {
-			return cfg, err
-		}
-		for k, v := range envs {
-			cfg.Runner.Environ[k] = v
-		}
-	}
-
-	return cfg, nil
-}

core/runner.go

@@ -1,17 +0,0 @@
-package core
-
-const (
-	UUIDHeader  = "x-runner-uuid"
-	TokenHeader = "x-runner-token"
-)
-
-// Runner struct
-type Runner struct {
-	ID       int64    `json:"id"`
-	UUID     string   `json:"uuid"`
-	Name     string   `json:"name"`
-	Token    string   `json:"token"`
-	Address  string   `json:"address"`
-	Insecure string   `json:"insecure"`
-	Labels   []string `json:"labels"`
-}

engine/docker.go

@@ -1,37 +0,0 @@
-package engine
-
-import (
-	"context"
-
-	"github.com/docker/docker/client"
-)
-
-type Docker struct {
-	client   client.APIClient
-	hidePull bool
-}
-
-func New(opts ...Option) (*Docker, error) {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
-	if err != nil {
-		return nil, err
-	}
-
-	srv := &Docker{
-		client: cli,
-	}
-
-	// Loop through each option
-	for _, opt := range opts {
-		// Call the option giving the instantiated
-		opt.Apply(srv)
-	}
-
-	return srv, nil
-}
-
-// Ping pings the Docker daemon.
-func (e *Docker) Ping(ctx context.Context) error {
-	_, err := e.client.Ping(ctx)
-	return err
-}

engine/engine.go

@@ -1,43 +0,0 @@
-package engine
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// Start start docker engine api loop
-func Start(ctx context.Context) error {
-	engine, err := New()
-	if err != nil {
-		return err
-	}
-
-	count := 0
-	for {
-		err := engine.Ping(ctx)
-		if err == context.Canceled {
-			break
-		}
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		default:
-		}
-		if err != nil {
-			log.WithError(err).
-				Errorln("cannot ping the docker daemon")
-			count++
-			if count == 5 {
-				return fmt.Errorf("retry connect to docker daemon failed: %d times", count)
-			}
-			time.Sleep(time.Second)
-		} else {
-			log.Infoln("successfully ping the docker daemon")
-			break
-		}
-	}
-	return nil
-}

engine/options.go

@@ -1,30 +0,0 @@
-package engine
-
-import "github.com/docker/docker/client"
-
-// An Option configures a mutex.
-type Option interface {
-	Apply(*Docker)
-}
-
-// OptionFunc is a function that configure a value.
-type OptionFunc func(*Docker)
-
-// Apply calls f(option)
-func (f OptionFunc) Apply(docker *Docker) {
-	f(docker)
-}
-
-// WithClient set custom client
-func WithClient(c client.APIClient) Option {
-	return OptionFunc(func(q *Docker) {
-		q.client = c
-	})
-}
-
-// WithHidePull hide pull event.
-func WithHidePull(v bool) Option {
-	return OptionFunc(func(q *Docker) {
-		q.hidePull = v
-	})
-}

examples/README.md

@@ -0,0 +1,12 @@
+# Usage Examples for `act_runner`
+
+Welcome to our collection of usage and deployment examples specifically designed for Gitea setups. Whether you're a beginner or an experienced user, you'll find practical resources here that you can directly apply to enhance your Gitea experience. We encourage you to contribute your own insights and knowledge to make this collection even more comprehensive and valuable.
+
+| Section                     | Description                                                                                                                                                                                                                                                   |
+|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [`docker`](docker)              | This section provides you with scripts and instructions tailored for running containers on a workstation or server where Docker is installed. It simplifies the process of setting up and managing your Gitea deployment using Docker.                     |
+| [`docker-compose`](docker-compose) | In this section, you'll discover examples demonstrating how to utilize docker-compose to efficiently handle your Gitea deployments. It offers a straightforward approach to managing multiple containerized components of your Gitea setup.                 |
+| [`kubernetes`](kubernetes)     | If you're utilizing Kubernetes clusters for your infrastructure, this section is specifically designed for you. It presents examples and guidelines for configuring Gitea deployments within Kubernetes clusters, enabling you to leverage the scalability and flexibility of Kubernetes.   |
+| [`vm`](vm)                      | This section is dedicated to examples that assist you in setting up Gitea on virtual or physical servers. Whether you're working with virtual machines or physical hardware, you'll find helpful resources to guide you through the deployment process.                   |
+
+We hope these resources provide you with valuable insights and solutions for your Gitea setup. Feel free to explore, contribute, and adapt these examples to suit your specific requirements.

examples/docker-compose/README.md

@@ -0,0 +1,61 @@
+### Running `act_runner` using `docker-compose`
+
+```yml
+...
+  gitea:
+    image: gitea/gitea
+    ...
+    healthcheck:
+      # checks availability of Gitea's front-end with curl
+      test: ["CMD", "curl", "-f", "<instance_url>"]
+      interval: 10s
+      retries: 3
+      start_period: 30s
+      timeout: 10s
+    environment:
+      # GITEA_RUNNER_REGISTRATION_TOKEN can be used to set a global runner registration token.
+      # The Gitea version must be v1.23 or higher.
+      # It's also possible to use GITEA_RUNNER_REGISTRATION_TOKEN_FILE to pass the location.
+      # - GITEA_RUNNER_REGISTRATION_TOKEN=<user-defined registration token>
+
+  runner:
+    image: gitea/act_runner
+    restart: always
+    depends_on:
+      gitea:
+        # required so runner can attach to gitea, see "healthcheck"
+        condition: service_healthy 
+        restart: true
+    volumes:
+      - ./data/act_runner:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - GITEA_INSTANCE_URL=<instance url>
+      # When using Docker Secrets, it's also possible to use
+      # GITEA_RUNNER_REGISTRATION_TOKEN_FILE to pass the location.
+      # The env var takes precedence.
+      # Needed only for the first start.
+      - GITEA_RUNNER_REGISTRATION_TOKEN=<registration token>
+```
+
+### Running `act_runner` using Docker-in-Docker (DIND) 
+
+```yml
+...
+  runner:
+    image: gitea/act_runner:latest-dind-rootless
+    restart: always
+    privileged: true
+    depends_on:
+      - gitea
+    volumes:
+      - ./data/act_runner:/data
+    environment:
+      - GITEA_INSTANCE_URL=<instance url>
+      - DOCKER_HOST=unix:///var/run/user/1000/docker.sock
+      # When using Docker Secrets, it's also possible to use
+      # GITEA_RUNNER_REGISTRATION_TOKEN_FILE to pass the location.
+      # The env var takes precedence.
+      # Needed only for the first start.
+      - GITEA_RUNNER_REGISTRATION_TOKEN=<registration token>
+```

examples/docker/README.md

@@ -0,0 +1,8 @@
+### Run `act_runner` in a Docker Container
+
+```sh
+docker run -e GITEA_INSTANCE_URL=http://192.168.8.18:3000 -e GITEA_RUNNER_REGISTRATION_TOKEN=<runner_token> -v /var/run/docker.sock:/var/run/docker.sock -v $PWD/data:/data --name my_runner gitea/act_runner:nightly
+```
+
+The `/data` directory inside the docker container contains the runner API keys after registration.
+It must be persisted, otherwise the runner would try to register again, using the same, now defunct registration token.

examples/kubernetes/README.md

@@ -0,0 +1,11 @@
+## Kubernetes Docker in Docker Deployment with `act_runner`
+
+NOTE: Docker in Docker (dind) requires elevated privileges on Kubernetes. The current way to achieve this is to set the pod `SecurityContext` to `privileged`. Keep in mind that this is a potential security issue that has the potential for a malicious application to break out of the container context.
+
+Files in this directory:
+
+- [`dind-docker.yaml`](dind-docker.yaml)
+  How to create a Deployment and Persistent Volume for Kubernetes to act as a runner. The Docker credentials are re-generated each time the pod connects and does not need to be persisted.
+
+- [`rootless-docker.yaml`](rootless-docker.yaml)
+  How to create a rootless Deployment and Persistent Volume for Kubernetes to act as a runner. The Docker credentials are re-generated each time the pod connects and does not need to be persisted.

examples/kubernetes/dind-docker.yaml

@@ -0,0 +1,81 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: act-runner-vol
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: standard
+---
+apiVersion: v1
+data:
+  # The registration token can be obtained from the web UI, API or command-line.
+  # You can also set a pre-defined global runner registration token for the Gitea instance via 
+  # `GITEA_RUNNER_REGISTRATION_TOKEN`/`GITEA_RUNNER_REGISTRATION_TOKEN_FILE` environment variable.
+  token: << base64 encoded registration token >>
+kind: Secret
+metadata:
+  name: runner-secret
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: act-runner
+  name: act-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: act-runner
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: act-runner
+    spec:
+      restartPolicy: Always
+      volumes:
+      - name: docker-certs
+        emptyDir: {}
+      - name: runner-data
+        persistentVolumeClaim:
+          claimName: act-runner-vol
+      containers:
+      - name: runner
+        image: gitea/act_runner:nightly
+        command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- run.sh"]
+        env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
+        - name: GITEA_INSTANCE_URL
+          value: http://gitea-http.gitea.svc.cluster.local:3000
+        - name: GITEA_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: runner-secret
+              key: token
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs
+        - name: runner-data
+          mountPath: /data
+      - name: daemon
+        image: docker:23.0.6-dind
+        env:
+        - name: DOCKER_TLS_CERTDIR
+          value: /certs
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs

examples/kubernetes/rootless-docker.yaml

@@ -0,0 +1,73 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: act-runner-vol
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: standard
+---
+apiVersion: v1
+data:
+  # The registration token can be obtained from the web UI, API or command-line.
+  # You can also set a pre-defined global runner registration token for the Gitea instance via 
+  # `GITEA_RUNNER_REGISTRATION_TOKEN`/`GITEA_RUNNER_REGISTRATION_TOKEN_FILE` environment variable.
+  token: << base64 encoded registration token >>
+kind: Secret
+metadata:
+  name: runner-secret
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: act-runner
+  name: act-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: act-runner
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: act-runner
+    spec:
+      restartPolicy: Always
+      volumes:
+      - name: runner-data
+        persistentVolumeClaim:
+          claimName: act-runner-vol
+      securityContext:
+        fsGroup: 1000
+      containers:
+      - name: runner
+        image: gitea/act_runner:nightly-dind-rootless
+        imagePullPolicy: Always
+        # command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- /opt/act/run.sh"]
+        env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
+        - name: GITEA_INSTANCE_URL
+          value: http://gitea-http.gitea.svc.cluster.local:3000
+        - name: GITEA_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: runner-secret
+              key: token
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: runner-data
+          mountPath: /data
+

examples/vm/README.md

@@ -0,0 +1,6 @@
+## `act_runner` on Virtual or Physical Servers
+
+Files in this directory:
+
+- [`rootless-docker.md`](rootless-docker.md)
+  How to set up a rootless docker implementation of the runner.

examples/vm/rootless-docker.md

@@ -0,0 +1,95 @@
+## Using Rootless Docker with`act_runner`
+
+Here is a simple example of how to set up `act_runner` with rootless Docker. It has been created with Debian, but other Linux should work the same way.
+
+Note: This procedure needs a real login shell -- using `sudo su` or other method of accessing the account will fail some of the steps below.
+
+As `root`:
+
+- Create a user to run both `docker` and `act_runner`. In this example, we use a non-privileged account called `rootless`.
+
+```bash
+ useradd -m rootless
+ passwd rootless
+ apt-get install -y uidmap # Not mentioned but needed for docker rootless.
+ ```
+
+- Install [`docker-ce`](https://docs.docker.com/engine/install/)
+- (Recommended) Disable the system-wide Docker daemon
+
+     ``systemctl disable --now docker.service docker.socket``
+
+As the `rootless` user:
+
+- Follow the instructions for [enabling rootless mode](https://docs.docker.com/engine/security/rootless/)
+- Add the following line to the `/home/rootless/.bashrc`:
+
+```bash
+for f in ./.bashrc.d/*.bash; do echo "Processing $f file..."; . "$f"; done
+```
+
+- Create the .bashrc.d directory `mkdir ~/.bashrc.d`
+- Add the following lines to the `/home/rootless/.bashrc.d/rootless-docker.bash`:
+
+```bash
+export XDG_RUNTIME_DIR=/home/rootless/.docker/run
+export PATH=/home/rootless/bin:$PATH
+export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock
+```
+
+- Reboot. Ensure that the Docker process is working.
+- Create a directory for saving `act_runner` data between restarts
+
+ `mkdir /home/rootless/act_runner`
+
+- Register the runner from the data directory
+
+```bash
+ cd /home/rootless/act_runner
+ act_runner register
+```
+
+- Generate a `act_runner` configuration file in the data directory. Edit the file to adjust for the system.
+
+```bash
+ act_runner generate-config >/home/rootless/act_runner/config
+```
+
+- Create a new user-level`systemd` unit file as `/home/rootless/.config/systemd/user/act_runner.service` with the following contents:
+
+```bash
+ Description=Gitea Actions runner
+ Documentation=https://gitea.com/gitea/act_runner
+ After=docker.service
+
+ [Service]
+ Environment=PATH=/home/rootless/bin:/sbin:/usr/sbin:/home/rootless/bin:/home/rootless/bin:/home/rootless/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
+ Environment=DOCKER_HOST=unix:///run/user/1001/docker.sock
+ ExecStart=/usr/bin/act_runner daemon -c /home/rootless/act_runner/config
+ ExecReload=/bin/kill -s HUP $MAINPID
+ WorkingDirectory=/home/rootless/act_runner
+ TimeoutSec=0
+ RestartSec=2
+ Restart=always
+ StartLimitBurst=3
+ StartLimitInterval=60s
+ LimitNOFILE=infinity
+ LimitNPROC=infinity
+ LimitCORE=infinity
+ TasksMax=infinity
+ Delegate=yes
+ Type=notify
+ NotifyAccess=all
+ KillMode=mixed
+
+ [Install]
+ WantedBy=default.target
+```
+
+- Reboot
+
+After the system restarts, check that the`act_runner` is working and that the runner is connected to Gitea.
+
+````bash
+ systemctl --user status act_runner
+ journalctl --user -xeu act_runner

go.mod

@@ -1,80 +1,114 @@
 module gitea.com/gitea/act_runner
 
-go 1.18
+go 1.24.0
+
+toolchain go1.24.11
 
 require (
-	code.gitea.io/actions-proto-go v0.2.0
-	github.com/avast/retry-go/v4 v4.3.1
-	github.com/bufbuild/connect-go v1.3.1
-	github.com/docker/docker v20.10.21+incompatible
-	github.com/joho/godotenv v1.4.0
-	github.com/kelseyhightower/envconfig v1.4.0
-	github.com/mattn/go-isatty v0.0.16
-	github.com/nektos/act v0.0.0
-	github.com/sirupsen/logrus v1.9.0
-	github.com/spf13/cobra v1.6.1
-	golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde
-	google.golang.org/protobuf v1.28.1
+	code.gitea.io/actions-proto-go v0.5.2
+	code.gitea.io/gitea-vet v0.2.3
+	connectrpc.com/connect v1.16.2
+	github.com/avast/retry-go/v4 v4.6.0
+	github.com/docker/docker v25.0.13+incompatible
+	github.com/joho/godotenv v1.5.1
+	github.com/mattn/go-isatty v0.0.20
+	github.com/nektos/act v0.0.0 // will be replaced
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/cobra v1.8.1
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/term v0.36.0
+	golang.org/x/time v0.12.0
+	google.golang.org/protobuf v1.35.2
+	gopkg.in/yaml.v3 v3.0.1
+	gotest.tools/v3 v3.5.1
 )
 
+require golang.org/x/sys v0.37.0
+
 require (
+	cyphar.com/go-pathrs v0.2.1 // indirect
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
-	github.com/Microsoft/go-winio v0.5.2 // indirect
-	github.com/Microsoft/hcsshim v0.9.3 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20220404123522-616f957b79ad // indirect
-	github.com/acomagu/bufpipe v1.0.3 // indirect
-	github.com/containerd/cgroups v1.0.3 // indirect
-	github.com/containerd/containerd v1.6.6 // indirect
-	github.com/creack/pty v1.1.18 // indirect
-	github.com/docker/cli v20.10.21+incompatible // indirect
-	github.com/docker/distribution v2.8.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.6.4 // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
-	github.com/emirpasic/gods v1.12.0 // indirect
-	github.com/fatih/color v1.13.0 // indirect
-	github.com/go-git/gcfg v1.5.0 // indirect
-	github.com/go-git/go-billy/v5 v5.3.1 // indirect
-	github.com/go-git/go-git/v5 v5.4.2 // indirect
-	github.com/go-ini/ini v1.67.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/containerd/containerd v1.7.29 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/creack/pty v1.1.21 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v25.0.3+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/fatih/color v1.17.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-git/go-git/v5 v5.12.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/imdario/mergo v0.3.13 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/julienschmidt/httprouter v1.3.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/mapstructure v1.1.2 // indirect
-	github.com/moby/buildkit v0.10.6 // indirect
-	github.com/moby/sys/mount v0.3.1 // indirect
-	github.com/moby/sys/mountinfo v0.6.0 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/moby/buildkit v0.12.5 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799 // indirect
-	github.com/opencontainers/runc v1.1.2 // indirect
-	github.com/opencontainers/selinux v1.10.2 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/selinux v1.13.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/rhysd/actionlint v1.6.22 // indirect
-	github.com/rivo/uniseg v0.3.4 // indirect
-	github.com/robfig/cron v1.2.0 // indirect
-	github.com/sergi/go-diff v1.2.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rhysd/actionlint v1.7.1 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/xanzy/ssh-agent v0.3.1 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f // indirect
-	go.opencensus.io v0.23.0 // indirect
-	golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29 // indirect
-	golang.org/x/net v0.0.0-20220906165146-f3363e06e74c // indirect
-	golang.org/x/sys v0.0.0-20220818161305-2296e01440c6 // indirect
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	go.etcd.io/bbolt v1.3.10 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
+	go.opentelemetry.io/otel v1.28.0 // indirect
+	go.opentelemetry.io/otel/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/trace v1.28.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/net v0.45.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/tools v0.23.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-replace github.com/nektos/act => gitea.com/gitea/act v0.234.3-0.20230224062034-1252e551b867
+replace github.com/nektos/act => gitea.com/gitea/act v0.261.7-0.20251202193638-5417d3ac6742
+
+replace github.com/go-git/go-git/v5 => github.com/go-git/go-git/v5 v5.16.2
+
+// Remove after
+replace github.com/distribution/reference v0.6.0 => github.com/distribution/reference v0.5.0
+
+// Use GitCaddy fork with capability support
+replace code.gitea.io/actions-proto-go => git.marketally.com/gitcaddy/actions-proto-go v0.5.7

internal/app/cmd/cache-server.go

@@ -0,0 +1,69 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+
+	"gitea.com/gitea/act_runner/internal/pkg/config"
+
+	"github.com/nektos/act/pkg/artifactcache"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+type cacheServerArgs struct {
+	Dir  string
+	Host string
+	Port uint16
+}
+
+func runCacheServer(ctx context.Context, configFile *string, cacheArgs *cacheServerArgs) func(cmd *cobra.Command, args []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		cfg, err := config.LoadDefault(*configFile)
+		if err != nil {
+			return fmt.Errorf("invalid configuration: %w", err)
+		}
+
+		initLogging(cfg)
+
+		var (
+			dir  = cfg.Cache.Dir
+			host = cfg.Cache.Host
+			port = cfg.Cache.Port
+		)
+
+		// cacheArgs has higher priority
+		if cacheArgs.Dir != "" {
+			dir = cacheArgs.Dir
+		}
+		if cacheArgs.Host != "" {
+			host = cacheArgs.Host
+		}
+		if cacheArgs.Port != 0 {
+			port = cacheArgs.Port
+		}
+
+		cacheHandler, err := artifactcache.StartHandler(
+			dir,
+			host,
+			port,
+			log.StandardLogger().WithField("module", "cache_request"),
+		)
+		if err != nil {
+			return err
+		}
+
+		log.Infof("cache server is listening on %v", cacheHandler.ExternalURL())
+
+		c := make(chan os.Signal, 1)
+		signal.Notify(c, os.Interrupt)
+		<-c
+
+		return nil
+	}
+}

internal/app/cmd/cmd.go

@@ -0,0 +1,88 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"gitea.com/gitea/act_runner/internal/pkg/config"
+	"gitea.com/gitea/act_runner/internal/pkg/ver"
+)
+
+func Execute(ctx context.Context) {
+	// ./act_runner
+	rootCmd := &cobra.Command{
+		Use:          "act_runner [event name to run]\nIf no event name passed, will default to \"on: push\"",
+		Short:        "Run GitHub actions locally by specifying the event name (e.g. `push`) or an action name directly.",
+		Args:         cobra.MaximumNArgs(1),
+		Version:      ver.Version(),
+		SilenceUsage: true,
+	}
+	configFile := ""
+	rootCmd.PersistentFlags().StringVarP(&configFile, "config", "c", "", "Config file path")
+
+	// ./act_runner register
+	var regArgs registerArgs
+	registerCmd := &cobra.Command{
+		Use:   "register",
+		Short: "Register a runner to the server",
+		Args:  cobra.MaximumNArgs(0),
+		RunE:  runRegister(ctx, &regArgs, &configFile), // must use a pointer to regArgs
+	}
+	registerCmd.Flags().BoolVar(&regArgs.NoInteractive, "no-interactive", false, "Disable interactive mode")
+	registerCmd.Flags().StringVar(&regArgs.InstanceAddr, "instance", "", "Gitea instance address")
+	registerCmd.Flags().StringVar(&regArgs.Token, "token", "", "Runner token")
+	registerCmd.Flags().StringVar(&regArgs.RunnerName, "name", "", "Runner name")
+	registerCmd.Flags().StringVar(&regArgs.Labels, "labels", "", "Runner tags, comma separated")
+	registerCmd.Flags().BoolVar(&regArgs.Ephemeral, "ephemeral", false, "Configure the runner to be ephemeral and only ever be able to pick a single job (stricter than --once)")
+	rootCmd.AddCommand(registerCmd)
+
+	// ./act_runner daemon
+	var daemArgs daemonArgs
+	daemonCmd := &cobra.Command{
+		Use:   "daemon",
+		Short: "Run as a runner daemon",
+		Args:  cobra.MaximumNArgs(0),
+		RunE:  runDaemon(ctx, &daemArgs, &configFile),
+	}
+	daemonCmd.Flags().BoolVar(&daemArgs.Once, "once", false, "Run one job then exit")
+	rootCmd.AddCommand(daemonCmd)
+
+	// ./act_runner exec
+	rootCmd.AddCommand(loadExecCmd(ctx))
+
+	// ./act_runner config
+	rootCmd.AddCommand(&cobra.Command{
+		Use:   "generate-config",
+		Short: "Generate an example config file",
+		Args:  cobra.MaximumNArgs(0),
+		Run: func(_ *cobra.Command, _ []string) {
+			fmt.Printf("%s", config.Example)
+		},
+	})
+
+	// ./act_runner cache-server
+	var cacheArgs cacheServerArgs
+	cacheCmd := &cobra.Command{
+		Use:   "cache-server",
+		Short: "Start a cache server for the cache action",
+		Args:  cobra.MaximumNArgs(0),
+		RunE:  runCacheServer(ctx, &configFile, &cacheArgs),
+	}
+	cacheCmd.Flags().StringVarP(&cacheArgs.Dir, "dir", "d", "", "Cache directory")
+	cacheCmd.Flags().StringVarP(&cacheArgs.Host, "host", "s", "", "Host of the cache server")
+	cacheCmd.Flags().Uint16VarP(&cacheArgs.Port, "port", "p", 0, "Port of the cache server")
+	rootCmd.AddCommand(cacheCmd)
+
+	// hide completion command
+	rootCmd.CompletionOptions.HiddenDefaultCmd = true
+
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

internal/app/cmd/daemon.go

@@ -0,0 +1,380 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"connectrpc.com/connect"
+	"github.com/mattn/go-isatty"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"gitea.com/gitea/act_runner/internal/app/poll"
+	"gitea.com/gitea/act_runner/internal/app/run"
+	"gitea.com/gitea/act_runner/internal/pkg/client"
+	"gitea.com/gitea/act_runner/internal/pkg/config"
+	"gitea.com/gitea/act_runner/internal/pkg/envcheck"
+	"gitea.com/gitea/act_runner/internal/pkg/labels"
+	"gitea.com/gitea/act_runner/internal/pkg/ver"
+)
+
+const (
+	// DiskSpaceWarningThreshold is the percentage at which to warn about low disk space
+	DiskSpaceWarningThreshold = 85.0
+	// DiskSpaceCriticalThreshold is the percentage at which to log critical warnings
+	DiskSpaceCriticalThreshold = 95.0
+	// CapabilitiesUpdateInterval is how often to update capabilities (including disk space)
+	CapabilitiesUpdateInterval = 5 * time.Minute
+	// BandwidthTestInterval is how often to run bandwidth tests (hourly)
+	BandwidthTestInterval = 1 * time.Hour
+)
+
+// Global bandwidth manager - accessible for triggering manual tests
+var bandwidthManager *envcheck.BandwidthManager
+
+func runDaemon(ctx context.Context, daemArgs *daemonArgs, configFile *string) func(cmd *cobra.Command, args []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		cfg, err := config.LoadDefault(*configFile)
+		if err != nil {
+			return fmt.Errorf("invalid configuration: %w", err)
+		}
+
+		initLogging(cfg)
+		log.Infoln("Starting runner daemon")
+
+		reg, err := config.LoadRegistration(cfg.Runner.File)
+		if os.IsNotExist(err) {
+			log.Error("registration file not found, please register the runner first")
+			return err
+		} else if err != nil {
+			return fmt.Errorf("failed to load registration file: %w", err)
+		}
+
+		lbls := reg.Labels
+		if len(cfg.Runner.Labels) > 0 {
+			lbls = cfg.Runner.Labels
+		}
+
+		ls := labels.Labels{}
+		for _, l := range lbls {
+			label, err := labels.Parse(l)
+			if err != nil {
+				log.WithError(err).Warnf("ignored invalid label %q", l)
+				continue
+			}
+			ls = append(ls, label)
+		}
+		if len(ls) == 0 {
+			log.Warn("no labels configured, runner may not be able to pick up jobs")
+		}
+
+		if ls.RequireDocker() || cfg.Container.RequireDocker {
+			// Wait for dockerd be ready
+			if timeout := cfg.Container.DockerTimeout; timeout > 0 {
+				tctx, cancel := context.WithTimeout(ctx, timeout)
+				defer cancel()
+				keepRunning := true
+				for keepRunning {
+					dockerSocketPath, err := getDockerSocketPath(cfg.Container.DockerHost)
+					if err != nil {
+						log.Errorf("Failed to get socket path: %s", err.Error())
+					} else if err = envcheck.CheckIfDockerRunning(tctx, dockerSocketPath); errors.Is(err, context.Canceled) {
+						log.Infof("Docker wait timeout of %s expired", timeout.String())
+						break
+					} else if err != nil {
+						log.Errorf("Docker connection failed: %s", err.Error())
+					} else {
+						log.Infof("Docker is ready")
+						break
+					}
+					select {
+					case <-time.After(time.Second):
+					case <-tctx.Done():
+						log.Infof("Docker wait timeout of %s expired", timeout.String())
+						keepRunning = false
+					}
+				}
+			}
+			// Require dockerd be ready
+			dockerSocketPath, err := getDockerSocketPath(cfg.Container.DockerHost)
+			if err != nil {
+				return err
+			}
+			if err := envcheck.CheckIfDockerRunning(ctx, dockerSocketPath); err != nil {
+				return err
+			}
+			// if dockerSocketPath passes the check, override DOCKER_HOST with dockerSocketPath
+			os.Setenv("DOCKER_HOST", dockerSocketPath)
+			// empty cfg.Container.DockerHost means act_runner need to find an available docker host automatically
+			// and assign the path to cfg.Container.DockerHost
+			if cfg.Container.DockerHost == "" {
+				cfg.Container.DockerHost = dockerSocketPath
+			}
+			// check the scheme, if the scheme is not npipe or unix
+			// set cfg.Container.DockerHost to "-" because it can't be mounted to the job container
+			if protoIndex := strings.Index(cfg.Container.DockerHost, "://"); protoIndex != -1 {
+				scheme := cfg.Container.DockerHost[:protoIndex]
+				if !strings.EqualFold(scheme, "npipe") && !strings.EqualFold(scheme, "unix") {
+					cfg.Container.DockerHost = "-"
+				}
+			}
+		}
+
+		if !slices.Equal(reg.Labels, ls.ToStrings()) {
+			reg.Labels = ls.ToStrings()
+			if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil {
+				return fmt.Errorf("failed to save runner config: %w", err)
+			}
+			log.Infof("labels updated to: %v", reg.Labels)
+		}
+
+		cli := client.New(
+			reg.Address,
+			cfg.Runner.Insecure,
+			reg.UUID,
+			reg.Token,
+			ver.Version(),
+		)
+
+		runner := run.NewRunner(cfg, reg, cli)
+
+		// Detect runner capabilities for AI-friendly workflow generation
+		dockerHost := cfg.Container.DockerHost
+		if dockerHost == "" {
+			if dh, err := getDockerSocketPath(""); err == nil {
+				dockerHost = dh
+			}
+		}
+
+		// Initialize bandwidth manager with the Gitea server address
+		bandwidthManager = envcheck.NewBandwidthManager(reg.Address, BandwidthTestInterval)
+		bandwidthManager.Start(ctx)
+		log.Infof("bandwidth manager started, testing against: %s", reg.Address)
+
+		capabilities := envcheck.DetectCapabilities(ctx, dockerHost, cfg.Container.WorkdirParent)
+		// Include initial bandwidth result if available
+		capabilities.Bandwidth = bandwidthManager.GetLastResult()
+		capabilitiesJson := capabilities.ToJSON()
+		log.Infof("detected capabilities: %s", capabilitiesJson)
+
+		// Check disk space and warn if low
+		checkDiskSpaceWarnings(capabilities)
+
+		// declare the labels of the runner before fetching tasks
+		resp, err := runner.Declare(ctx, ls.Names(), capabilitiesJson)
+		if err != nil && connect.CodeOf(err) == connect.CodeUnimplemented {
+			log.Errorf("Your Gitea version is too old to support runner declare, please upgrade to v1.21 or later")
+			return err
+		} else if err != nil {
+			log.WithError(err).Error("fail to invoke Declare")
+			return err
+		} else {
+			log.Infof("runner: %s, with version: %s, with labels: %v, declare successfully",
+				resp.Msg.Runner.Name, resp.Msg.Runner.Version, resp.Msg.Runner.Labels)
+		}
+
+		// Start periodic capabilities update goroutine
+		go periodicCapabilitiesUpdate(ctx, runner, ls.Names(), dockerHost, cfg.Container.WorkdirParent)
+		// Start periodic stale job cache cleanup (every hour, remove caches older than 2 hours)
+		go func() {
+			ticker := time.NewTicker(1 * time.Hour)
+			defer ticker.Stop()
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case <-ticker.C:
+					runner.CleanStaleJobCaches(2 * time.Hour)
+				}
+			}
+		}()
+
+		poller := poll.New(cfg, cli, runner)
+		poller.SetBandwidthManager(bandwidthManager)
+
+		if daemArgs.Once || reg.Ephemeral {
+			done := make(chan struct{})
+			go func() {
+				defer close(done)
+				poller.PollOnce()
+			}()
+
+			// shutdown when we complete a job or cancel is requested
+			select {
+			case <-ctx.Done():
+			case <-done:
+			}
+		} else {
+			go poller.Poll()
+
+			<-ctx.Done()
+		}
+
+		log.Infof("runner: %s shutdown initiated, waiting %s for running jobs to complete before shutting down", resp.Msg.Runner.Name, cfg.Runner.ShutdownTimeout)
+
+		ctx, cancel := context.WithTimeout(context.Background(), cfg.Runner.ShutdownTimeout)
+		defer cancel()
+
+		err = poller.Shutdown(ctx)
+		if err != nil {
+			log.Warnf("runner: %s cancelled in progress jobs during shutdown", resp.Msg.Runner.Name)
+		}
+
+		return nil
+	}
+}
+
+// checkDiskSpaceWarnings logs warnings if disk space is low
+func checkDiskSpaceWarnings(capabilities *envcheck.RunnerCapabilities) {
+	if capabilities.Disk == nil {
+		return
+	}
+
+	usedPercent := capabilities.Disk.UsedPercent
+	freeGB := float64(capabilities.Disk.Free) / (1024 * 1024 * 1024)
+
+	if usedPercent >= DiskSpaceCriticalThreshold {
+		log.Errorf("CRITICAL: Disk space critically low! %.1f%% used, only %.2f GB free. Runner may fail to execute jobs!", usedPercent, freeGB)
+	} else if usedPercent >= DiskSpaceWarningThreshold {
+		log.Warnf("WARNING: Disk space running low. %.1f%% used, %.2f GB free. Consider cleaning up disk space.", usedPercent, freeGB)
+	}
+}
+
+// periodicCapabilitiesUpdate periodically updates capabilities including disk space and bandwidth
+func periodicCapabilitiesUpdate(ctx context.Context, runner *run.Runner, labelNames []string, dockerHost string, workingDir string) {
+	ticker := time.NewTicker(CapabilitiesUpdateInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			log.Debug("stopping periodic capabilities update")
+			if bandwidthManager != nil {
+				bandwidthManager.Stop()
+			}
+			return
+		case <-ticker.C:
+			// Detect updated capabilities (disk space changes over time)
+			capabilities := envcheck.DetectCapabilities(ctx, dockerHost, workingDir)
+
+			// Include latest bandwidth result
+			if bandwidthManager != nil {
+				capabilities.Bandwidth = bandwidthManager.GetLastResult()
+			}
+
+			capabilitiesJson := capabilities.ToJSON()
+
+			// Check for disk space warnings
+			checkDiskSpaceWarnings(capabilities)
+
+			// Send updated capabilities to server
+			_, err := runner.Declare(ctx, labelNames, capabilitiesJson)
+			if err != nil {
+				log.WithError(err).Debug("failed to update capabilities")
+			} else {
+				bandwidthInfo := ""
+				if capabilities.Bandwidth != nil {
+					bandwidthInfo = fmt.Sprintf(", bandwidth: %.1f Mbps", capabilities.Bandwidth.DownloadMbps)
+				}
+				log.Debugf("capabilities updated: disk %.1f%% used, %.2f GB free%s",
+					capabilities.Disk.UsedPercent,
+					float64(capabilities.Disk.Free)/(1024*1024*1024),
+					bandwidthInfo)
+			}
+		}
+	}
+}
+
+type daemonArgs struct {
+	Once bool
+}
+
+// initLogging setup the global logrus logger.
+func initLogging(cfg *config.Config) {
+	callPrettyfier := func(f *runtime.Frame) (string, string) {
+		// get function name
+		s := strings.Split(f.Function, ".")
+		funcname := "[" + s[len(s)-1] + "]"
+		// get file name and line number
+		_, filename := path.Split(f.File)
+		filename = "[" + filename + ":" + strconv.Itoa(f.Line) + "]"
+		return funcname, filename
+	}
+
+	isTerm := isatty.IsTerminal(os.Stdout.Fd())
+	format := &log.TextFormatter{
+		DisableColors:    !isTerm,
+		FullTimestamp:    true,
+		CallerPrettyfier: callPrettyfier,
+	}
+	log.SetFormatter(format)
+
+	l := cfg.Log.Level
+	if l == "" {
+		log.Infof("Log level not set, sticking to info")
+		return
+	}
+
+	level, err := log.ParseLevel(l)
+	if err != nil {
+		log.WithError(err).
+			Errorf("invalid log level: %q", l)
+	}
+
+	// debug level
+	switch level {
+	case log.DebugLevel, log.TraceLevel:
+		log.SetReportCaller(true) // Only in debug or trace because it takes a performance toll
+		log.Infof("Log level %s requested, setting up report caller for further debugging", level)
+	}
+
+	if log.GetLevel() != level {
+		log.Infof("log level set to %v", level)
+		log.SetLevel(level)
+	}
+}
+
+var commonSocketPaths = []string{
+	"/var/run/docker.sock",
+	"/run/podman/podman.sock",
+	"$HOME/.colima/docker.sock",
+	"$XDG_RUNTIME_DIR/docker.sock",
+	"$XDG_RUNTIME_DIR/podman/podman.sock",
+	`\\.\pipe\docker_engine`,
+	"$HOME/.docker/run/docker.sock",
+}
+
+func getDockerSocketPath(configDockerHost string) (string, error) {
+	// a `-` means don't mount the docker socket to job containers
+	if configDockerHost != "" && configDockerHost != "-" {
+		return configDockerHost, nil
+	}
+
+	socket, found := os.LookupEnv("DOCKER_HOST")
+	if found {
+		return socket, nil
+	}
+
+	for _, p := range commonSocketPaths {
+		if _, err := os.Lstat(os.ExpandEnv(p)); err == nil {
+			if strings.HasPrefix(p, `\\.\`) {
+				return "npipe://" + filepath.ToSlash(os.ExpandEnv(p)), nil
+			}
+			return "unix://" + filepath.ToSlash(os.ExpandEnv(p)), nil
+		}
+	}
+
+	return "", fmt.Errorf("daemon Docker Engine socket not found and docker_host config was invalid")
+}

internal/app/cmd/exec.go

@@ -0,0 +1,511 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// Copyright 2019 nektos
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/joho/godotenv"
+	"github.com/nektos/act/pkg/artifactcache"
+	"github.com/nektos/act/pkg/artifacts"
+	"github.com/nektos/act/pkg/common"
+	"github.com/nektos/act/pkg/model"
+	"github.com/nektos/act/pkg/runner"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+)
+
+type executeArgs struct {
+	runList               bool
+	job                   string
+	event                 string
+	workdir               string
+	workflowsPath         string
+	noWorkflowRecurse     bool
+	autodetectEvent       bool
+	forcePull             bool
+	forceRebuild          bool
+	jsonLogger            bool
+	envs                  []string
+	envfile               string
+	secrets               []string
+	vars                  []string
+	defaultActionsURL     string
+	insecureSecrets       bool
+	privileged            bool
+	usernsMode            string
+	containerArchitecture string
+	containerDaemonSocket string
+	useGitIgnore          bool
+	containerCapAdd       []string
+	containerCapDrop      []string
+	containerOptions      string
+	artifactServerPath    string
+	artifactServerAddr    string
+	artifactServerPort    string
+	noSkipCheckout        bool
+	debug                 bool
+	dryrun                bool
+	image                 string
+	cacheHandler          *artifactcache.Handler
+	network               string
+	githubInstance        string
+}
+
+// WorkflowsPath returns path to workflow file(s)
+func (i *executeArgs) WorkflowsPath() string {
+	return i.resolve(i.workflowsPath)
+}
+
+// Envfile returns path to .env
+func (i *executeArgs) Envfile() string {
+	return i.resolve(i.envfile)
+}
+
+func (i *executeArgs) LoadSecrets() map[string]string {
+	s := make(map[string]string)
+	for _, secretPair := range i.secrets {
+		secretPairParts := strings.SplitN(secretPair, "=", 2)
+		secretPairParts[0] = strings.ToUpper(secretPairParts[0])
+		if strings.ToUpper(s[secretPairParts[0]]) == secretPairParts[0] {
+			log.Errorf("Secret %s is already defined (secrets are case insensitive)", secretPairParts[0])
+		}
+		if len(secretPairParts) == 2 {
+			s[secretPairParts[0]] = secretPairParts[1]
+		} else if env, ok := os.LookupEnv(secretPairParts[0]); ok && env != "" {
+			s[secretPairParts[0]] = env
+		} else {
+			fmt.Printf("Provide value for '%s': ", secretPairParts[0])
+			val, err := term.ReadPassword(int(os.Stdin.Fd()))
+			fmt.Println()
+			if err != nil {
+				log.Errorf("failed to read input: %v", err)
+				os.Exit(1)
+			}
+			s[secretPairParts[0]] = string(val)
+		}
+	}
+	return s
+}
+
+func readEnvs(path string, envs map[string]string) bool {
+	if _, err := os.Stat(path); err == nil {
+		env, err := godotenv.Read(path)
+		if err != nil {
+			log.Fatalf("Error loading from %s: %v", path, err)
+		}
+		for k, v := range env {
+			envs[k] = v
+		}
+		return true
+	}
+	return false
+}
+
+func (i *executeArgs) LoadEnvs() map[string]string {
+	envs := make(map[string]string)
+	if i.envs != nil {
+		for _, envVar := range i.envs {
+			e := strings.SplitN(envVar, `=`, 2)
+			if len(e) == 2 {
+				envs[e[0]] = e[1]
+			} else {
+				envs[e[0]] = ""
+			}
+		}
+	}
+	_ = readEnvs(i.Envfile(), envs)
+
+	envs["ACTIONS_CACHE_URL"] = i.cacheHandler.ExternalURL() + "/"
+
+	return envs
+}
+
+func (i *executeArgs) LoadVars() map[string]string {
+	vars := make(map[string]string)
+	if i.vars != nil {
+		for _, runVar := range i.vars {
+			e := strings.SplitN(runVar, `=`, 2)
+			if len(e) == 2 {
+				vars[e[0]] = e[1]
+			} else {
+				vars[e[0]] = ""
+			}
+		}
+	}
+
+	return vars
+}
+
+// Workdir returns path to workdir
+func (i *executeArgs) Workdir() string {
+	return i.resolve(".")
+}
+
+func (i *executeArgs) resolve(path string) string {
+	basedir, err := filepath.Abs(i.workdir)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if path == "" {
+		return path
+	}
+	if !filepath.IsAbs(path) {
+		path = filepath.Join(basedir, path)
+	}
+	return path
+}
+
+func printList(plan *model.Plan) error {
+	type lineInfoDef struct {
+		jobID   string
+		jobName string
+		stage   string
+		wfName  string
+		wfFile  string
+		events  string
+	}
+	lineInfos := []lineInfoDef{}
+
+	header := lineInfoDef{
+		jobID:   "Job ID",
+		jobName: "Job name",
+		stage:   "Stage",
+		wfName:  "Workflow name",
+		wfFile:  "Workflow file",
+		events:  "Events",
+	}
+
+	jobs := map[string]bool{}
+	duplicateJobIDs := false
+
+	jobIDMaxWidth := len(header.jobID)
+	jobNameMaxWidth := len(header.jobName)
+	stageMaxWidth := len(header.stage)
+	wfNameMaxWidth := len(header.wfName)
+	wfFileMaxWidth := len(header.wfFile)
+	eventsMaxWidth := len(header.events)
+
+	for i, stage := range plan.Stages {
+		for _, r := range stage.Runs {
+			jobID := r.JobID
+			line := lineInfoDef{
+				jobID:   jobID,
+				jobName: r.String(),
+				stage:   strconv.Itoa(i),
+				wfName:  r.Workflow.Name,
+				wfFile:  r.Workflow.File,
+				events:  strings.Join(r.Workflow.On(), `,`),
+			}
+			if _, ok := jobs[jobID]; ok {
+				duplicateJobIDs = true
+			} else {
+				jobs[jobID] = true
+			}
+			lineInfos = append(lineInfos, line)
+			if jobIDMaxWidth < len(line.jobID) {
+				jobIDMaxWidth = len(line.jobID)
+			}
+			if jobNameMaxWidth < len(line.jobName) {
+				jobNameMaxWidth = len(line.jobName)
+			}
+			if stageMaxWidth < len(line.stage) {
+				stageMaxWidth = len(line.stage)
+			}
+			if wfNameMaxWidth < len(line.wfName) {
+				wfNameMaxWidth = len(line.wfName)
+			}
+			if wfFileMaxWidth < len(line.wfFile) {
+				wfFileMaxWidth = len(line.wfFile)
+			}
+			if eventsMaxWidth < len(line.events) {
+				eventsMaxWidth = len(line.events)
+			}
+		}
+	}
+
+	jobIDMaxWidth += 2
+	jobNameMaxWidth += 2
+	stageMaxWidth += 2
+	wfNameMaxWidth += 2
+	wfFileMaxWidth += 2
+
+	fmt.Printf("%*s%*s%*s%*s%*s%*s\n",
+		-stageMaxWidth, header.stage,
+		-jobIDMaxWidth, header.jobID,
+		-jobNameMaxWidth, header.jobName,
+		-wfNameMaxWidth, header.wfName,
+		-wfFileMaxWidth, header.wfFile,
+		-eventsMaxWidth, header.events,
+	)
+	for _, line := range lineInfos {
+		fmt.Printf("%*s%*s%*s%*s%*s%*s\n",
+			-stageMaxWidth, line.stage,
+			-jobIDMaxWidth, line.jobID,
+			-jobNameMaxWidth, line.jobName,
+			-wfNameMaxWidth, line.wfName,
+			-wfFileMaxWidth, line.wfFile,
+			-eventsMaxWidth, line.events,
+		)
+	}
+	if duplicateJobIDs {
+		fmt.Print("\nDetected multiple jobs with the same job name, use `-W` to specify the path to the specific workflow.\n")
+	}
+	return nil
+}
+
+func runExecList(ctx context.Context, planner model.WorkflowPlanner, execArgs *executeArgs) error {
+	// plan with filtered jobs - to be used for filtering only
+	var filterPlan *model.Plan
+
+	// Determine the event name to be filtered
+	var filterEventName string
+
+	if len(execArgs.event) > 0 {
+		log.Infof("Using chosed event for filtering: %s", execArgs.event)
+		filterEventName = execArgs.event
+	} else if execArgs.autodetectEvent {
+		// collect all events from loaded workflows
+		events := planner.GetEvents()
+
+		// set default event type to first event from many available
+		// this way user dont have to specify the event.
+		log.Infof("Using first detected workflow event for filtering: %s", events[0])
+
+		filterEventName = events[0]
+	}
+
+	var err error
+	if execArgs.job != "" {
+		log.Infof("Preparing plan with a job: %s", execArgs.job)
+		filterPlan, err = planner.PlanJob(execArgs.job)
+		if err != nil {
+			return err
+		}
+	} else if filterEventName != "" {
+		log.Infof("Preparing plan for a event: %s", filterEventName)
+		filterPlan, err = planner.PlanEvent(filterEventName)
+		if err != nil {
+			return err
+		}
+	} else {
+		log.Infof("Preparing plan with all jobs")
+		filterPlan, err = planner.PlanAll()
+		if err != nil {
+			return err
+		}
+	}
+
+	_ = printList(filterPlan)
+
+	return nil
+}
+
+func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command, args []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		planner, err := model.NewWorkflowPlanner(execArgs.WorkflowsPath(), execArgs.noWorkflowRecurse)
+		if err != nil {
+			return err
+		}
+
+		if execArgs.runList {
+			return runExecList(ctx, planner, execArgs)
+		}
+
+		// plan with triggered jobs
+		var plan *model.Plan
+
+		// Determine the event name to be triggered
+		var eventName string
+
+		// collect all events from loaded workflows
+		events := planner.GetEvents()
+
+		if len(execArgs.event) > 0 {
+			log.Infof("Using chosed event for filtering: %s", execArgs.event)
+			eventName = execArgs.event
+		} else if len(events) == 1 && len(events[0]) > 0 {
+			log.Infof("Using the only detected workflow event: %s", events[0])
+			eventName = events[0]
+		} else if execArgs.autodetectEvent && len(events) > 0 && len(events[0]) > 0 {
+			// set default event type to first event from many available
+			// this way user dont have to specify the event.
+			log.Infof("Using first detected workflow event: %s", events[0])
+			eventName = events[0]
+		} else {
+			log.Infof("Using default workflow event: push")
+			eventName = "push"
+		}
+
+		// build the plan for this run
+		if execArgs.job != "" {
+			log.Infof("Planning job: %s", execArgs.job)
+			plan, err = planner.PlanJob(execArgs.job)
+			if err != nil {
+				return err
+			}
+		} else {
+			log.Infof("Planning jobs for event: %s", eventName)
+			plan, err = planner.PlanEvent(eventName)
+			if err != nil {
+				return err
+			}
+		}
+
+		maxLifetime := 3 * time.Hour
+		if deadline, ok := ctx.Deadline(); ok {
+			maxLifetime = time.Until(deadline)
+		}
+
+		// init a cache server
+		handler, err := artifactcache.StartHandler("", "", 0, log.StandardLogger().WithField("module", "cache_request"))
+		if err != nil {
+			return err
+		}
+		log.Infof("cache handler listens on: %v", handler.ExternalURL())
+		execArgs.cacheHandler = handler
+
+		if len(execArgs.artifactServerAddr) == 0 {
+			ip := common.GetOutboundIP()
+			if ip == nil {
+				return fmt.Errorf("unable to determine outbound IP address")
+			}
+			execArgs.artifactServerAddr = ip.String()
+		}
+
+		if len(execArgs.artifactServerPath) == 0 {
+			tempDir, err := os.MkdirTemp("", "gitea-act-")
+			if err != nil {
+				fmt.Println(err)
+			}
+			defer os.RemoveAll(tempDir)
+
+			execArgs.artifactServerPath = tempDir
+		}
+
+		// run the plan
+		config := &runner.Config{
+			Workdir:               execArgs.Workdir(),
+			BindWorkdir:           false,
+			ReuseContainers:       false,
+			ForcePull:             execArgs.forcePull,
+			ForceRebuild:          execArgs.forceRebuild,
+			LogOutput:             true,
+			JSONLogger:            execArgs.jsonLogger,
+			Env:                   execArgs.LoadEnvs(),
+			Vars:                  execArgs.LoadVars(),
+			Secrets:               execArgs.LoadSecrets(),
+			InsecureSecrets:       execArgs.insecureSecrets,
+			Privileged:            execArgs.privileged,
+			UsernsMode:            execArgs.usernsMode,
+			ContainerArchitecture: execArgs.containerArchitecture,
+			ContainerDaemonSocket: execArgs.containerDaemonSocket,
+			UseGitIgnore:          execArgs.useGitIgnore,
+			GitHubInstance:        execArgs.githubInstance,
+			ContainerCapAdd:       execArgs.containerCapAdd,
+			ContainerCapDrop:      execArgs.containerCapDrop,
+			ContainerOptions:      execArgs.containerOptions,
+			AutoRemove:            true,
+			ArtifactServerPath:    execArgs.artifactServerPath,
+			ArtifactServerPort:    execArgs.artifactServerPort,
+			ArtifactServerAddr:    execArgs.artifactServerAddr,
+			NoSkipCheckout:        execArgs.noSkipCheckout,
+			// PresetGitHubContext:   preset,
+			// EventJSON:             string(eventJSON),
+			ContainerNamePrefix:   fmt.Sprintf("GITEA-ACTIONS-TASK-%s", eventName),
+			ContainerMaxLifetime:  maxLifetime,
+			ContainerNetworkMode:  container.NetworkMode(execArgs.network),
+			DefaultActionInstance: execArgs.defaultActionsURL,
+			PlatformPicker: func(_ []string) string {
+				return execArgs.image
+			},
+			ValidVolumes: []string{"**"}, // All volumes are allowed for `exec` command
+		}
+
+		config.Env["ACT_EXEC"] = "true"
+
+		if t := config.Secrets["GITEA_TOKEN"]; t != "" {
+			config.Token = t
+		} else if t := config.Secrets["GITHUB_TOKEN"]; t != "" {
+			config.Token = t
+		}
+
+		if !execArgs.debug {
+			logLevel := log.InfoLevel
+			config.JobLoggerLevel = &logLevel
+		}
+
+		r, err := runner.New(config)
+		if err != nil {
+			return err
+		}
+
+		artifactCancel := artifacts.Serve(ctx, execArgs.artifactServerPath, execArgs.artifactServerAddr, execArgs.artifactServerPort)
+		log.Debugf("artifacts server started at %s:%s", execArgs.artifactServerPath, execArgs.artifactServerPort)
+
+		ctx = common.WithDryrun(ctx, execArgs.dryrun)
+		executor := r.NewPlanExecutor(plan).Finally(func(ctx context.Context) error {
+			artifactCancel()
+			return nil
+		})
+
+		return executor(ctx)
+	}
+}
+
+func loadExecCmd(ctx context.Context) *cobra.Command {
+	execArg := executeArgs{}
+
+	execCmd := &cobra.Command{
+		Use:   "exec",
+		Short: "Run workflow locally.",
+		Args:  cobra.MaximumNArgs(20),
+		RunE:  runExec(ctx, &execArg),
+	}
+
+	execCmd.Flags().BoolVarP(&execArg.runList, "list", "l", false, "list workflows")
+	execCmd.Flags().StringVarP(&execArg.job, "job", "j", "", "run a specific job ID")
+	execCmd.Flags().StringVarP(&execArg.event, "event", "E", "", "run a event name")
+	execCmd.PersistentFlags().StringVarP(&execArg.workflowsPath, "workflows", "W", "./.gitea/workflows/", "path to workflow file(s)")
+	execCmd.PersistentFlags().StringVarP(&execArg.workdir, "directory", "C", ".", "working directory")
+	execCmd.PersistentFlags().BoolVarP(&execArg.noWorkflowRecurse, "no-recurse", "", false, "Flag to disable running workflows from subdirectories of specified path in '--workflows'/'-W' flag")
+	execCmd.Flags().BoolVarP(&execArg.autodetectEvent, "detect-event", "", false, "Use first event type from workflow as event that triggered the workflow")
+	execCmd.Flags().BoolVarP(&execArg.forcePull, "pull", "p", false, "pull docker image(s) even if already present")
+	execCmd.Flags().BoolVarP(&execArg.forceRebuild, "rebuild", "", false, "rebuild local action docker image(s) even if already present")
+	execCmd.PersistentFlags().BoolVar(&execArg.jsonLogger, "json", false, "Output logs in json format")
+	execCmd.Flags().StringArrayVarP(&execArg.envs, "env", "", []string{}, "env to make available to actions with optional value (e.g. --env myenv=foo or --env myenv)")
+	execCmd.PersistentFlags().StringVarP(&execArg.envfile, "env-file", "", ".env", "environment file to read and use as env in the containers")
+	execCmd.Flags().StringArrayVarP(&execArg.secrets, "secret", "s", []string{}, "secret to make available to actions with optional value (e.g. -s mysecret=foo or -s mysecret)")
+	execCmd.Flags().StringArrayVarP(&execArg.vars, "var", "", []string{}, "variable to make available to actions with optional value (e.g. --var myvar=foo or --var myvar)")
+	execCmd.PersistentFlags().BoolVarP(&execArg.insecureSecrets, "insecure-secrets", "", false, "NOT RECOMMENDED! Doesn't hide secrets while printing logs.")
+	execCmd.Flags().BoolVar(&execArg.privileged, "privileged", false, "use privileged mode")
+	execCmd.Flags().StringVar(&execArg.usernsMode, "userns", "", "user namespace to use")
+	execCmd.PersistentFlags().StringVarP(&execArg.containerArchitecture, "container-architecture", "", "", "Architecture which should be used to run containers, e.g.: linux/amd64. If not specified, will use host default architecture. Requires Docker server API Version 1.41+. Ignored on earlier Docker server platforms.")
+	execCmd.PersistentFlags().StringVarP(&execArg.containerDaemonSocket, "container-daemon-socket", "", "/var/run/docker.sock", "Path to Docker daemon socket which will be mounted to containers")
+	execCmd.Flags().BoolVar(&execArg.useGitIgnore, "use-gitignore", true, "Controls whether paths specified in .gitignore should be copied into container")
+	execCmd.Flags().StringArrayVarP(&execArg.containerCapAdd, "container-cap-add", "", []string{}, "kernel capabilities to add to the workflow containers (e.g. --container-cap-add SYS_PTRACE)")
+	execCmd.Flags().StringArrayVarP(&execArg.containerCapDrop, "container-cap-drop", "", []string{}, "kernel capabilities to remove from the workflow containers (e.g. --container-cap-drop SYS_PTRACE)")
+	execCmd.Flags().StringVarP(&execArg.containerOptions, "container-opts", "", "", "container options")
+	execCmd.PersistentFlags().StringVarP(&execArg.artifactServerPath, "artifact-server-path", "", ".", "Defines the path where the artifact server stores uploads and retrieves downloads from. If not specified the artifact server will not start.")
+	execCmd.PersistentFlags().StringVarP(&execArg.artifactServerAddr, "artifact-server-addr", "", "", "Defines the address where the artifact server listens")
+	execCmd.PersistentFlags().StringVarP(&execArg.artifactServerPort, "artifact-server-port", "", "34567", "Defines the port where the artifact server listens (will only bind to localhost).")
+	execCmd.PersistentFlags().StringVarP(&execArg.defaultActionsURL, "default-actions-url", "", "https://github.com", "Defines the default url of action instance.")
+	execCmd.PersistentFlags().BoolVarP(&execArg.noSkipCheckout, "no-skip-checkout", "", false, "Do not skip actions/checkout")
+	execCmd.PersistentFlags().BoolVarP(&execArg.debug, "debug", "d", false, "enable debug log")
+	execCmd.PersistentFlags().BoolVarP(&execArg.dryrun, "dryrun", "n", false, "dryrun mode")
+	execCmd.PersistentFlags().StringVarP(&execArg.image, "image", "i", "docker.gitea.com/runner-images:ubuntu-latest", "Docker image to use. Use \"-self-hosted\" to run directly on the host.")
+	execCmd.PersistentFlags().StringVarP(&execArg.network, "network", "", "", "Specify the network to which the container will connect")
+	execCmd.PersistentFlags().StringVarP(&execArg.githubInstance, "gitea-instance", "", "", "Gitea instance to use.")
+
+	return execCmd
+}

internal/app/cmd/register.go

@@ -0,0 +1,394 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	goruntime "runtime"
+	"strings"
+	"time"
+
+	pingv1 "code.gitea.io/actions-proto-go/ping/v1"
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	"connectrpc.com/connect"
+	"github.com/mattn/go-isatty"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"gitea.com/gitea/act_runner/internal/pkg/client"
+	"gitea.com/gitea/act_runner/internal/pkg/config"
+	"gitea.com/gitea/act_runner/internal/pkg/labels"
+	"gitea.com/gitea/act_runner/internal/pkg/ver"
+)
+
+// runRegister registers a runner to the server
+func runRegister(ctx context.Context, regArgs *registerArgs, configFile *string) func(*cobra.Command, []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		log.SetReportCaller(false)
+		isTerm := isatty.IsTerminal(os.Stdout.Fd())
+		log.SetFormatter(&log.TextFormatter{
+			DisableColors:    !isTerm,
+			DisableTimestamp: true,
+		})
+		log.SetLevel(log.DebugLevel)
+
+		log.Infof("Registering runner, arch=%s, os=%s, version=%s.",
+			goruntime.GOARCH, goruntime.GOOS, ver.Version())
+
+		// runner always needs root permission
+		if os.Getuid() != 0 {
+			// TODO: use a better way to check root permission
+			log.Warnf("Runner in user-mode.")
+		}
+
+		if regArgs.NoInteractive {
+			if err := registerNoInteractive(ctx, *configFile, regArgs); err != nil {
+				return err
+			}
+		} else {
+			go func() {
+				if err := registerInteractive(ctx, *configFile, regArgs); err != nil {
+					log.Fatal(err)
+					return
+				}
+				os.Exit(0)
+			}()
+
+			c := make(chan os.Signal, 1)
+			signal.Notify(c, os.Interrupt)
+			<-c
+		}
+
+		return nil
+	}
+}
+
+// registerArgs represents the arguments for register command
+type registerArgs struct {
+	NoInteractive bool
+	InstanceAddr  string
+	Token         string
+	RunnerName    string
+	Labels        string
+	Ephemeral     bool
+}
+
+type registerStage int8
+
+const (
+	StageUnknown              registerStage = -1
+	StageOverwriteLocalConfig registerStage = iota + 1
+	StageInputInstance
+	StageInputToken
+	StageInputRunnerName
+	StageInputLabels
+	StageWaitingForRegistration
+	StageExit
+)
+
+var defaultLabels = []string{
+	"ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest",
+	"ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04",
+	"ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04",
+}
+
+type registerInputs struct {
+	InstanceAddr string
+	Token        string
+	RunnerName   string
+	Labels       []string
+	Ephemeral    bool
+}
+
+func (r *registerInputs) validate() error {
+	if r.InstanceAddr == "" {
+		return fmt.Errorf("instance address is empty")
+	}
+	if r.Token == "" {
+		return fmt.Errorf("token is empty")
+	}
+	if len(r.Labels) > 0 {
+		return validateLabels(r.Labels)
+	}
+	return nil
+}
+
+func validateLabels(ls []string) error {
+	for _, label := range ls {
+		if _, err := labels.Parse(label); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (r *registerInputs) stageValue(stage registerStage) string {
+	switch stage {
+	case StageInputInstance:
+		return r.InstanceAddr
+	case StageInputToken:
+		return r.Token
+	case StageInputRunnerName:
+		return r.RunnerName
+	case StageInputLabels:
+		if len(r.Labels) > 0 {
+			return strings.Join(r.Labels, ",")
+		}
+	}
+	return ""
+}
+
+func (r *registerInputs) assignToNext(stage registerStage, value string, cfg *config.Config) registerStage {
+	// must set instance address and token.
+	// if empty, keep current stage.
+	if stage == StageInputInstance || stage == StageInputToken {
+		if value == "" {
+			return stage
+		}
+	}
+
+	// set hostname for runner name if empty
+	if stage == StageInputRunnerName && value == "" {
+		value, _ = os.Hostname()
+	}
+
+	switch stage {
+	case StageOverwriteLocalConfig:
+		if value == "Y" || value == "y" {
+			return StageInputInstance
+		}
+		return StageExit
+	case StageInputInstance:
+		r.InstanceAddr = value
+		return StageInputToken
+	case StageInputToken:
+		r.Token = value
+		return StageInputRunnerName
+	case StageInputRunnerName:
+		r.RunnerName = value
+		// if there are some labels configured in config file, skip input labels stage
+		if len(cfg.Runner.Labels) > 0 {
+			ls := make([]string, 0, len(cfg.Runner.Labels))
+			for _, l := range cfg.Runner.Labels {
+				_, err := labels.Parse(l)
+				if err != nil {
+					log.WithError(err).Warnf("ignored invalid label %q", l)
+					continue
+				}
+				ls = append(ls, l)
+			}
+			if len(ls) == 0 {
+				log.Warn("no valid labels configured in config file, runner may not be able to pick up jobs")
+			}
+			r.Labels = ls
+			return StageWaitingForRegistration
+		}
+		return StageInputLabels
+	case StageInputLabels:
+		r.Labels = defaultLabels
+		if value != "" {
+			r.Labels = strings.Split(value, ",")
+		}
+
+		if validateLabels(r.Labels) != nil {
+			log.Infoln("Invalid labels, please input again, leave blank to use the default labels (for example, ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest)")
+			r.Labels = nil
+			return StageInputLabels
+		}
+		return StageWaitingForRegistration
+	}
+	return StageUnknown
+}
+
+func initInputs(regArgs *registerArgs) *registerInputs {
+	inputs := &registerInputs{
+		InstanceAddr: regArgs.InstanceAddr,
+		Token:        regArgs.Token,
+		RunnerName:   regArgs.RunnerName,
+		Ephemeral:    regArgs.Ephemeral,
+	}
+	regArgs.Labels = strings.TrimSpace(regArgs.Labels)
+	// command line flag.
+	if regArgs.Labels != "" {
+		inputs.Labels = strings.Split(regArgs.Labels, ",")
+	}
+	return inputs
+}
+
+func registerInteractive(ctx context.Context, configFile string, regArgs *registerArgs) error {
+	var (
+		reader = bufio.NewReader(os.Stdin)
+		stage  = StageInputInstance
+	)
+
+	cfg, err := config.LoadDefault(configFile)
+	if err != nil {
+		return fmt.Errorf("failed to load config: %v", err)
+	}
+	if f, err := os.Stat(cfg.Runner.File); err == nil && !f.IsDir() {
+		stage = StageOverwriteLocalConfig
+	}
+	inputs := initInputs(regArgs)
+
+	for {
+		cmdString := inputs.stageValue(stage)
+		if cmdString == "" {
+			printStageHelp(stage)
+			var err error
+			cmdString, err = reader.ReadString('\n')
+			if err != nil {
+				return err
+			}
+		}
+		stage = inputs.assignToNext(stage, strings.TrimSpace(cmdString), cfg)
+
+		if stage == StageWaitingForRegistration {
+			log.Infof("Registering runner, name=%s, instance=%s, labels=%v.", inputs.RunnerName, inputs.InstanceAddr, inputs.Labels)
+			if err := doRegister(ctx, cfg, inputs); err != nil {
+				return fmt.Errorf("Failed to register runner: %w", err)
+			}
+			log.Infof("Runner registered successfully.")
+			return nil
+		}
+
+		if stage == StageExit {
+			return nil
+		}
+
+		if stage <= StageUnknown {
+			log.Errorf("Invalid input, please re-run act command.")
+			return nil
+		}
+	}
+}
+
+func printStageHelp(stage registerStage) {
+	switch stage {
+	case StageOverwriteLocalConfig:
+		log.Infoln("Runner is already registered, overwrite local config? [y/N]")
+	case StageInputInstance:
+		log.Infoln("Enter the Gitea instance URL (for example, https://gitea.com/):")
+	case StageInputToken:
+		log.Infoln("Enter the runner token:")
+	case StageInputRunnerName:
+		hostname, _ := os.Hostname()
+		log.Infof("Enter the runner name (if set empty, use hostname: %s):\n", hostname)
+	case StageInputLabels:
+		log.Infoln("Enter the runner labels, leave blank to use the default labels (comma-separated, for example, ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest):")
+	case StageWaitingForRegistration:
+		log.Infoln("Waiting for registration...")
+	}
+}
+
+func registerNoInteractive(ctx context.Context, configFile string, regArgs *registerArgs) error {
+	cfg, err := config.LoadDefault(configFile)
+	if err != nil {
+		return err
+	}
+	inputs := initInputs(regArgs)
+	// specify labels in config file.
+	if len(cfg.Runner.Labels) > 0 {
+		if regArgs.Labels != "" {
+			log.Warn("Labels from command will be ignored, use labels defined in config file.")
+		}
+		inputs.Labels = cfg.Runner.Labels
+	}
+	if len(inputs.Labels) == 0 {
+		inputs.Labels = defaultLabels
+	}
+
+	if inputs.RunnerName == "" {
+		inputs.RunnerName, _ = os.Hostname()
+		log.Infof("Runner name is empty, use hostname '%s'.", inputs.RunnerName)
+	}
+	if err := inputs.validate(); err != nil {
+		log.WithError(err).Errorf("Invalid input, please re-run act command.")
+		return err
+	}
+	if err := doRegister(ctx, cfg, inputs); err != nil {
+		return fmt.Errorf("Failed to register runner: %w", err)
+	}
+	log.Infof("Runner registered successfully.")
+	return nil
+}
+
+func doRegister(ctx context.Context, cfg *config.Config, inputs *registerInputs) error {
+	// initial http client
+	cli := client.New(
+		inputs.InstanceAddr,
+		cfg.Runner.Insecure,
+		"",
+		"",
+		ver.Version(),
+	)
+
+	for {
+		_, err := cli.Ping(ctx, connect.NewRequest(&pingv1.PingRequest{
+			Data: inputs.RunnerName,
+		}))
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+		if ctx.Err() != nil {
+			break
+		}
+		if err != nil {
+			log.WithError(err).
+				Errorln("Cannot ping the Gitea instance server")
+			// TODO: if ping failed, retry or exit
+			time.Sleep(time.Second)
+		} else {
+			log.Debugln("Successfully pinged the Gitea instance server")
+			break
+		}
+	}
+
+	reg := &config.Registration{
+		Name:      inputs.RunnerName,
+		Token:     inputs.Token,
+		Address:   inputs.InstanceAddr,
+		Labels:    inputs.Labels,
+		Ephemeral: inputs.Ephemeral,
+	}
+
+	ls := make([]string, len(reg.Labels))
+	for i, v := range reg.Labels {
+		l, _ := labels.Parse(v)
+		ls[i] = l.Name
+	}
+	// register new runner.
+	resp, err := cli.Register(ctx, connect.NewRequest(&runnerv1.RegisterRequest{
+		Name:        reg.Name,
+		Token:       reg.Token,
+		Version:     ver.Version(),
+		AgentLabels: ls, // Could be removed after Gitea 1.20
+		Labels:      ls,
+		Ephemeral:   reg.Ephemeral,
+	}))
+	if err != nil {
+		log.WithError(err).Error("poller: cannot register new runner")
+		return err
+	}
+
+	reg.ID = resp.Msg.Runner.Id
+	reg.UUID = resp.Msg.Runner.Uuid
+	reg.Name = resp.Msg.Runner.Name
+	reg.Token = resp.Msg.Runner.Token
+
+	if inputs.Ephemeral != resp.Msg.Runner.Ephemeral {
+		// TODO we cannot remove the configuration via runner api, if we return an error here we just fill the database
+		log.Error("poller: cannot register new runner as ephemeral upgrade Gitea to gain security, run-once will be used automatically")
+	}
+
+	if err := config.SaveRegistration(cfg.Runner.File, reg); err != nil {
+		return fmt.Errorf("failed to save runner config: %w", err)
+	}
+	return nil
+}

internal/app/cmd/register_test.go

@@ -0,0 +1,19 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestRegisterNonInteractiveReturnsLabelValidationError(t *testing.T) {
+	err := registerNoInteractive(t.Context(), "", &registerArgs{
+		Labels:       "label:invalid",
+		Token:        "token",
+		InstanceAddr: "http://localhost:3000",
+	})
+	assert.Error(t, err, "unsupported schema: invalid")
+}

internal/app/poll/poller.go

@@ -0,0 +1,220 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package poll
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"sync/atomic"
+
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	"connectrpc.com/connect"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/time/rate"
+
+	"gitea.com/gitea/act_runner/internal/app/run"
+	"gitea.com/gitea/act_runner/internal/pkg/client"
+	"gitea.com/gitea/act_runner/internal/pkg/config"
+	"gitea.com/gitea/act_runner/internal/pkg/envcheck"
+)
+
+type Poller struct {
+	client           client.Client
+	runner           *run.Runner
+	cfg              *config.Config
+	tasksVersion     atomic.Int64 // tasksVersion used to store the version of the last task fetched from the Gitea.
+	bandwidthManager *envcheck.BandwidthManager
+
+	pollingCtx      context.Context
+	shutdownPolling context.CancelFunc
+
+	jobsCtx      context.Context
+	shutdownJobs context.CancelFunc
+
+	done chan struct{}
+}
+
+func New(cfg *config.Config, client client.Client, runner *run.Runner) *Poller {
+	pollingCtx, shutdownPolling := context.WithCancel(context.Background())
+
+	jobsCtx, shutdownJobs := context.WithCancel(context.Background())
+
+	done := make(chan struct{})
+
+	return &Poller{
+		client: client,
+		runner: runner,
+		cfg:    cfg,
+
+		pollingCtx:      pollingCtx,
+		shutdownPolling: shutdownPolling,
+
+		jobsCtx:      jobsCtx,
+		shutdownJobs: shutdownJobs,
+
+		done: done,
+	}
+}
+
+// SetBandwidthManager sets the bandwidth manager for on-demand testing
+func (p *Poller) SetBandwidthManager(bm *envcheck.BandwidthManager) {
+	p.bandwidthManager = bm
+}
+
+func (p *Poller) Poll() {
+	limiter := rate.NewLimiter(rate.Every(p.cfg.Runner.FetchInterval), 1)
+	wg := &sync.WaitGroup{}
+	for i := 0; i < p.cfg.Runner.Capacity; i++ {
+		wg.Add(1)
+		go p.poll(wg, limiter)
+	}
+	wg.Wait()
+
+	// signal that we shutdown
+	close(p.done)
+}
+
+func (p *Poller) PollOnce() {
+	limiter := rate.NewLimiter(rate.Every(p.cfg.Runner.FetchInterval), 1)
+
+	p.pollOnce(limiter)
+
+	// signal that we're done
+	close(p.done)
+}
+
+func (p *Poller) Shutdown(ctx context.Context) error {
+	p.shutdownPolling()
+
+	select {
+	// graceful shutdown completed succesfully
+	case <-p.done:
+		return nil
+
+	// our timeout for shutting down ran out
+	case <-ctx.Done():
+		// when both the timeout fires and the graceful shutdown
+		// completed succsfully, this branch of the select may
+		// fire. Do a non-blocking check here against the graceful
+		// shutdown status to avoid sending an error if we don't need to.
+		_, ok := <-p.done
+		if !ok {
+			return nil
+		}
+
+		// force a shutdown of all running jobs
+		p.shutdownJobs()
+
+		// wait for running jobs to report their status to Gitea
+		_, _ = <-p.done
+
+		return ctx.Err()
+	}
+}
+
+func (p *Poller) poll(wg *sync.WaitGroup, limiter *rate.Limiter) {
+	defer wg.Done()
+	for {
+		p.pollOnce(limiter)
+
+		select {
+		case <-p.pollingCtx.Done():
+			return
+		default:
+			continue
+		}
+	}
+}
+
+func (p *Poller) pollOnce(limiter *rate.Limiter) {
+	for {
+		if err := limiter.Wait(p.pollingCtx); err != nil {
+			if p.pollingCtx.Err() != nil {
+				log.WithError(err).Debug("limiter wait failed")
+			}
+			return
+		}
+		task, ok := p.fetchTask(p.pollingCtx)
+		if !ok {
+			continue
+		}
+
+		p.runTaskWithRecover(p.jobsCtx, task)
+		return
+	}
+}
+
+func (p *Poller) runTaskWithRecover(ctx context.Context, task *runnerv1.Task) {
+	defer func() {
+		if r := recover(); r != nil {
+			err := fmt.Errorf("panic: %v", r)
+			log.WithError(err).Error("panic in runTaskWithRecover")
+		}
+	}()
+
+	if err := p.runner.Run(ctx, task); err != nil {
+		log.WithError(err).Error("failed to run task")
+	}
+}
+
+func (p *Poller) fetchTask(ctx context.Context) (*runnerv1.Task, bool) {
+	reqCtx, cancel := context.WithTimeout(ctx, p.cfg.Runner.FetchTimeout)
+	defer cancel()
+
+	// Detect capabilities including current disk space
+	caps := envcheck.DetectCapabilities(ctx, p.cfg.Container.DockerHost, p.cfg.Container.WorkdirParent)
+
+	// Include latest bandwidth result if available
+	if p.bandwidthManager != nil {
+		caps.Bandwidth = p.bandwidthManager.GetLastResult()
+	}
+
+	capsJson := caps.ToJSON()
+
+	// Load the version value that was in the cache when the request was sent.
+	v := p.tasksVersion.Load()
+	fetchReq := &runnerv1.FetchTaskRequest{
+		TasksVersion:     v,
+		CapabilitiesJson: capsJson,
+	}
+	resp, err := p.client.FetchTask(reqCtx, connect.NewRequest(fetchReq))
+	if errors.Is(err, context.DeadlineExceeded) {
+		err = nil
+	}
+	if err != nil {
+		log.WithError(err).Error("failed to fetch task")
+		return nil, false
+	}
+
+	if resp == nil || resp.Msg == nil {
+		return nil, false
+	}
+
+	// Check if server requested a bandwidth test
+	if resp.Msg.RequestBandwidthTest && p.bandwidthManager != nil {
+		log.Info("Server requested bandwidth test, running now...")
+		go func() {
+			result := p.bandwidthManager.RunTest(ctx)
+			if result != nil {
+				log.Infof("Bandwidth test completed: %.1f Mbps download, %.0f ms latency",
+					result.DownloadMbps, result.Latency)
+			}
+		}()
+	}
+
+	if resp.Msg.TasksVersion > v {
+		p.tasksVersion.CompareAndSwap(v, resp.Msg.TasksVersion)
+	}
+
+	if resp.Msg.Task == nil {
+		return nil, false
+	}
+
+	// got a task, set tasksVersion to zero to force query db in next request.
+	p.tasksVersion.CompareAndSwap(resp.Msg.TasksVersion, 0)
+
+	return resp.Msg.Task, true
+}

internal/app/run/logging.go

@@ -0,0 +1,24 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package run
+
+import (
+	"io"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// NullLogger is used to create a new JobLogger to discard logs. This
+// will prevent these logs from being logged to the stdout, but
+// forward them to the Reporter via its hook.
+type NullLogger struct{}
+
+// WithJobLogger creates a new logrus.Logger that will discard all logs.
+func (n NullLogger) WithJobLogger() *log.Logger {
+	logger := log.New()
+	logger.SetOutput(io.Discard)
+	logger.SetLevel(log.TraceLevel)
+
+	return logger
+}

internal/app/run/runner.go

@@ -0,0 +1,313 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package run
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	"connectrpc.com/connect"
+	"github.com/docker/docker/api/types/container"
+	"github.com/nektos/act/pkg/artifactcache"
+	"github.com/nektos/act/pkg/common"
+	"github.com/nektos/act/pkg/model"
+	"github.com/nektos/act/pkg/runner"
+	log "github.com/sirupsen/logrus"
+
+	"gitea.com/gitea/act_runner/internal/pkg/client"
+	"gitea.com/gitea/act_runner/internal/pkg/config"
+	"gitea.com/gitea/act_runner/internal/pkg/labels"
+	"gitea.com/gitea/act_runner/internal/pkg/report"
+	"gitea.com/gitea/act_runner/internal/pkg/ver"
+)
+
+// Runner runs the pipeline.
+type Runner struct {
+	name string
+
+	cfg *config.Config
+
+	client client.Client
+	labels labels.Labels
+	envs   map[string]string
+
+	runningTasks sync.Map
+}
+
+// getJobCacheDir returns a job-isolated cache directory
+func (r *Runner) getJobCacheDir(taskID int64) string {
+	return filepath.Join(r.cfg.Host.WorkdirParent, "jobs", fmt.Sprintf("%d", taskID))
+}
+
+// cleanupJobCache removes the job-specific cache directory after completion
+func (r *Runner) cleanupJobCache(taskID int64) {
+	jobCacheDir := r.getJobCacheDir(taskID)
+	if err := os.RemoveAll(jobCacheDir); err != nil {
+		log.Warnf("failed to cleanup job cache %s: %v", jobCacheDir, err)
+	} else {
+		log.Infof("cleaned up job cache: %s", jobCacheDir)
+	}
+}
+
+// CleanStaleJobCaches removes job cache directories older than maxAge
+func (r *Runner) CleanStaleJobCaches(maxAge time.Duration) {
+	jobsDir := filepath.Join(r.cfg.Host.WorkdirParent, "jobs")
+	entries, err := os.ReadDir(jobsDir)
+	if err != nil {
+		return // directory may not exist yet
+	}
+
+	cutoff := time.Now().Add(-maxAge)
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil {
+			continue
+		}
+		if info.ModTime().Before(cutoff) {
+			jobPath := filepath.Join(jobsDir, entry.Name())
+			if err := os.RemoveAll(jobPath); err != nil {
+				log.Warnf("failed to remove stale job cache %s: %v", jobPath, err)
+			} else {
+				log.Infof("evicted stale job cache: %s", jobPath)
+			}
+		}
+	}
+}
+func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client) *Runner {
+	ls := labels.Labels{}
+	for _, v := range reg.Labels {
+		if l, err := labels.Parse(v); err == nil {
+			ls = append(ls, l)
+		}
+	}
+	envs := make(map[string]string, len(cfg.Runner.Envs))
+	for k, v := range cfg.Runner.Envs {
+		envs[k] = v
+	}
+	if cfg.Cache.Enabled == nil || *cfg.Cache.Enabled {
+		if cfg.Cache.ExternalServer != "" {
+			envs["ACTIONS_CACHE_URL"] = cfg.Cache.ExternalServer
+		} else {
+			cacheHandler, err := artifactcache.StartHandler(
+				cfg.Cache.Dir,
+				cfg.Cache.Host,
+				cfg.Cache.Port,
+				log.StandardLogger().WithField("module", "cache_request"),
+			)
+			if err != nil {
+				log.Errorf("cannot init cache server, it will be disabled: %v", err)
+				// go on
+			} else {
+				envs["ACTIONS_CACHE_URL"] = cacheHandler.ExternalURL() + "/"
+			}
+		}
+	}
+
+	// set artifact gitea api
+	artifactGiteaAPI := strings.TrimSuffix(cli.Address(), "/") + "/api/actions_pipeline/"
+	envs["ACTIONS_RUNTIME_URL"] = artifactGiteaAPI
+	envs["ACTIONS_RESULTS_URL"] = strings.TrimSuffix(cli.Address(), "/")
+
+	// Set specific environments to distinguish between Gitea and GitHub
+	envs["GITEA_ACTIONS"] = "true"
+	envs["GITEA_ACTIONS_RUNNER_VERSION"] = ver.Version()
+
+	return &Runner{
+		name:   reg.Name,
+		cfg:    cfg,
+		client: cli,
+		labels: ls,
+		envs:   envs,
+	}
+}
+
+func (r *Runner) Run(ctx context.Context, task *runnerv1.Task) error {
+	if _, ok := r.runningTasks.Load(task.Id); ok {
+		return fmt.Errorf("task %d is already running", task.Id)
+	}
+	r.runningTasks.Store(task.Id, struct{}{})
+	defer r.runningTasks.Delete(task.Id)
+	defer r.cleanupJobCache(task.Id)
+
+	ctx, cancel := context.WithTimeout(ctx, r.cfg.Runner.Timeout)
+	defer cancel()
+	reporter := report.NewReporter(ctx, cancel, r.client, task)
+	var runErr error
+	defer func() {
+		lastWords := ""
+		if runErr != nil {
+			lastWords = runErr.Error()
+		}
+		_ = reporter.Close(lastWords)
+	}()
+	reporter.RunDaemon()
+	runErr = r.run(ctx, task, reporter)
+
+	return nil
+}
+
+// getDefaultActionsURL
+// when DEFAULT_ACTIONS_URL == "https://github.com" and GithubMirror is not blank,
+// it should be set to GithubMirror first.
+func (r *Runner) getDefaultActionsURL(ctx context.Context, task *runnerv1.Task) string {
+	giteaDefaultActionsURL := task.Context.Fields["gitea_default_actions_url"].GetStringValue()
+	if giteaDefaultActionsURL == "https://github.com" && r.cfg.Runner.GithubMirror != "" {
+		return r.cfg.Runner.GithubMirror
+	}
+	return giteaDefaultActionsURL
+}
+
+func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.Reporter) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("panic: %v", r)
+		}
+	}()
+
+	reporter.Logf("%s(version:%s) received task %v of job %v, be triggered by event: %s", r.name, ver.Version(), task.Id, task.Context.Fields["job"].GetStringValue(), task.Context.Fields["event_name"].GetStringValue())
+
+	workflow, jobID, err := generateWorkflow(task)
+	if err != nil {
+		return err
+	}
+
+	plan, err := model.CombineWorkflowPlanner(workflow).PlanJob(jobID)
+	if err != nil {
+		return err
+	}
+	job := workflow.GetJob(jobID)
+	reporter.ResetSteps(len(job.Steps))
+
+	taskContext := task.Context.Fields
+
+	log.Infof("task %v repo is %v %v %v", task.Id, taskContext["repository"].GetStringValue(),
+		r.getDefaultActionsURL(ctx, task),
+		r.client.Address())
+
+	preset := &model.GithubContext{
+		Event:           taskContext["event"].GetStructValue().AsMap(),
+		RunID:           taskContext["run_id"].GetStringValue(),
+		RunNumber:       taskContext["run_number"].GetStringValue(),
+		Actor:           taskContext["actor"].GetStringValue(),
+		Repository:      taskContext["repository"].GetStringValue(),
+		EventName:       taskContext["event_name"].GetStringValue(),
+		Sha:             taskContext["sha"].GetStringValue(),
+		Ref:             taskContext["ref"].GetStringValue(),
+		RefName:         taskContext["ref_name"].GetStringValue(),
+		RefType:         taskContext["ref_type"].GetStringValue(),
+		HeadRef:         taskContext["head_ref"].GetStringValue(),
+		BaseRef:         taskContext["base_ref"].GetStringValue(),
+		Token:           taskContext["token"].GetStringValue(),
+		RepositoryOwner: taskContext["repository_owner"].GetStringValue(),
+		RetentionDays:   taskContext["retention_days"].GetStringValue(),
+	}
+	if t := task.Secrets["GITEA_TOKEN"]; t != "" {
+		preset.Token = t
+	} else if t := task.Secrets["GITHUB_TOKEN"]; t != "" {
+		preset.Token = t
+	}
+
+	if actionsIdTokenRequestUrl := taskContext["actions_id_token_request_url"].GetStringValue(); actionsIdTokenRequestUrl != "" {
+		r.envs["ACTIONS_ID_TOKEN_REQUEST_URL"] = actionsIdTokenRequestUrl
+		r.envs["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] = taskContext["actions_id_token_request_token"].GetStringValue()
+		task.Secrets["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] = r.envs["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]
+	}
+
+	giteaRuntimeToken := taskContext["gitea_runtime_token"].GetStringValue()
+	if giteaRuntimeToken == "" {
+		// use task token to action api token for previous Gitea Server Versions
+		giteaRuntimeToken = preset.Token
+	}
+	r.envs["ACTIONS_RUNTIME_TOKEN"] = giteaRuntimeToken
+
+	eventJSON, err := json.Marshal(preset.Event)
+	if err != nil {
+		return err
+	}
+
+	maxLifetime := 3 * time.Hour
+	if deadline, ok := ctx.Deadline(); ok {
+		maxLifetime = time.Until(deadline)
+	}
+
+	// Create job-specific environment with isolated cache directories
+	jobCacheDir := r.getJobCacheDir(task.Id)
+	jobEnvs := make(map[string]string, len(r.envs)+2)
+	for k, v := range r.envs {
+		jobEnvs[k] = v
+	}
+	// Isolate golangci-lint cache to prevent parallel job conflicts
+	jobEnvs["GOLANGCI_LINT_CACHE"] = filepath.Join(jobCacheDir, "golangci-lint")
+	// Set XDG_CACHE_HOME to isolate other tools that respect it
+	jobEnvs["XDG_CACHE_HOME"] = jobCacheDir
+
+	runnerConfig := &runner.Config{
+		// On Linux, Workdir will be like "/<parent_directory>/<owner>/<repo>"
+		// On Windows, Workdir will be like "\<parent_directory>\<owner>\<repo>"
+		Workdir:        filepath.FromSlash(fmt.Sprintf("/%s/%s", strings.TrimLeft(r.cfg.Container.WorkdirParent, "/"), preset.Repository)),
+		BindWorkdir:    false,
+		ActionCacheDir: filepath.FromSlash(jobCacheDir),
+
+		ReuseContainers:       false,
+		ForcePull:             r.cfg.Container.ForcePull,
+		ForceRebuild:          r.cfg.Container.ForceRebuild,
+		LogOutput:             true,
+		JSONLogger:            false,
+		Env:                   jobEnvs,
+		Secrets:               task.Secrets,
+		GitHubInstance:        strings.TrimSuffix(r.client.Address(), "/"),
+		AutoRemove:            true,
+		NoSkipCheckout:        true,
+		PresetGitHubContext:   preset,
+		EventJSON:             string(eventJSON),
+		ContainerNamePrefix:   fmt.Sprintf("GITEA-ACTIONS-TASK-%d", task.Id),
+		ContainerMaxLifetime:  maxLifetime,
+		ContainerNetworkMode:  container.NetworkMode(r.cfg.Container.Network),
+		ContainerOptions:      r.cfg.Container.Options,
+		ContainerDaemonSocket: r.cfg.Container.DockerHost,
+		Privileged:            r.cfg.Container.Privileged,
+		DefaultActionInstance: r.getDefaultActionsURL(ctx, task),
+		PlatformPicker:        r.labels.PickPlatform,
+		Vars:                  task.Vars,
+		ValidVolumes:          r.cfg.Container.ValidVolumes,
+		InsecureSkipTLS:       r.cfg.Runner.Insecure,
+	}
+
+	rr, err := runner.New(runnerConfig)
+	if err != nil {
+		return err
+	}
+	executor := rr.NewPlanExecutor(plan)
+
+	reporter.Logf("workflow prepared")
+
+	// add logger recorders
+	ctx = common.WithLoggerHook(ctx, reporter)
+
+	if !log.IsLevelEnabled(log.DebugLevel) {
+		ctx = runner.WithJobLoggerFactory(ctx, NullLogger{})
+	}
+
+	execErr := executor(ctx)
+	reporter.SetOutputs(job.Outputs)
+	return execErr
+}
+
+func (r *Runner) Declare(ctx context.Context, labels []string, capabilitiesJson string) (*connect.Response[runnerv1.DeclareResponse], error) {
+	return r.client.Declare(ctx, connect.NewRequest(&runnerv1.DeclareRequest{
+		Version:          ver.Version(),
+		Labels:           labels,
+		CapabilitiesJson: capabilitiesJson,
+	}))
+}

internal/app/run/workflow.go

@@ -0,0 +1,54 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package run
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	"github.com/nektos/act/pkg/model"
+	"gopkg.in/yaml.v3"
+)
+
+func generateWorkflow(task *runnerv1.Task) (*model.Workflow, string, error) {
+	workflow, err := model.ReadWorkflow(bytes.NewReader(task.WorkflowPayload))
+	if err != nil {
+		return nil, "", err
+	}
+
+	jobIDs := workflow.GetJobIDs()
+	if len(jobIDs) != 1 {
+		return nil, "", fmt.Errorf("multiple jobs found: %v", jobIDs)
+	}
+	jobID := jobIDs[0]
+
+	needJobIDs := make([]string, 0, len(task.Needs))
+	for id, need := range task.Needs {
+		needJobIDs = append(needJobIDs, id)
+		needJob := &model.Job{
+			Outputs: need.Outputs,
+			Result:  strings.ToLower(strings.TrimPrefix(need.Result.String(), "RESULT_")),
+		}
+		workflow.Jobs[id] = needJob
+	}
+	sort.Strings(needJobIDs)
+
+	rawNeeds := yaml.Node{
+		Kind:    yaml.SequenceNode,
+		Content: make([]*yaml.Node, 0, len(needJobIDs)),
+	}
+	for _, id := range needJobIDs {
+		rawNeeds.Content = append(rawNeeds.Content, &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Value: id,
+		})
+	}
+
+	workflow.Jobs[jobID].RawNeeds = rawNeeds
+
+	return workflow, jobID, nil
+}

internal/app/run/workflow_test.go

@@ -0,0 +1,74 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package run
+
+import (
+	"testing"
+
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	"github.com/nektos/act/pkg/model"
+	"github.com/stretchr/testify/require"
+	"gotest.tools/v3/assert"
+)
+
+func Test_generateWorkflow(t *testing.T) {
+	type args struct {
+		task *runnerv1.Task
+	}
+	tests := []struct {
+		name    string
+		args    args
+		assert  func(t *testing.T, wf *model.Workflow)
+		want1   string
+		wantErr bool
+	}{
+		{
+			name: "has needs",
+			args: args{
+				task: &runnerv1.Task{
+					WorkflowPayload: []byte(`
+name: Build and deploy
+on: push
+
+jobs:
+  job9:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - run: ./deploy --build ${{ needs.job1.outputs.output1 }}
+      - run: ./deploy --build ${{ needs.job2.outputs.output2 }}
+`),
+					Needs: map[string]*runnerv1.TaskNeed{
+						"job1": {
+							Outputs: map[string]string{
+								"output1": "output1 value",
+							},
+							Result: runnerv1.Result_RESULT_SUCCESS,
+						},
+						"job2": {
+							Outputs: map[string]string{
+								"output2": "output2 value",
+							},
+							Result: runnerv1.Result_RESULT_SUCCESS,
+						},
+					},
+				},
+			},
+			assert: func(t *testing.T, wf *model.Workflow) {
+				assert.DeepEqual(t, wf.GetJob("job9").Needs(), []string{"job1", "job2"})
+			},
+			want1:   "job9",
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, got1, err := generateWorkflow(tt.args.task)
+			require.NoError(t, err)
+			tt.assert(t, got)
+			assert.Equal(t, got1, tt.want1)
+		})
+	}
+}

internal/pkg/client/client.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
 package client
 
 import (
@@ -6,6 +9,8 @@ import (
 )
 
 // A Client manages communication with the runner.
+//
+//go:generate mockery --name Client
 type Client interface {
 	pingv1connect.PingServiceClient
 	runnerv1connect.RunnerServiceClient

internal/pkg/client/header.go

@@ -0,0 +1,11 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package client
+
+const (
+	UUIDHeader  = "x-runner-uuid"
+	TokenHeader = "x-runner-token"
+	// Deprecated: could be removed after Gitea 1.20 released
+	VersionHeader = "x-runner-version"
+)

internal/pkg/client/http.go

@@ -1,3 +1,6 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
 package client
 
 import (
@@ -8,11 +11,10 @@ import (
 
 	"code.gitea.io/actions-proto-go/ping/v1/pingv1connect"
 	"code.gitea.io/actions-proto-go/runner/v1/runnerv1connect"
-	"gitea.com/gitea/act_runner/core"
-	"github.com/bufbuild/connect-go"
+	"connectrpc.com/connect"
 )
 
-func getHttpClient(endpoint string, insecure bool) *http.Client {
+func getHTTPClient(endpoint string, insecure bool) *http.Client {
 	if strings.HasPrefix(endpoint, "https://") && insecure {
 		return &http.Client{
 			Transport: &http.Transport{
@@ -26,16 +28,20 @@ func getHttpClient(endpoint string, insecure bool) *http.Client {
 }
 
 // New returns a new runner client.
-func New(endpoint string, insecure bool, uuid, token string, opts ...connect.ClientOption) *HTTPClient {
+func New(endpoint string, insecure bool, uuid, token, version string, opts ...connect.ClientOption) *HTTPClient {
 	baseURL := strings.TrimRight(endpoint, "/") + "/api/actions"
 
 	opts = append(opts, connect.WithInterceptors(connect.UnaryInterceptorFunc(func(next connect.UnaryFunc) connect.UnaryFunc {
 		return func(ctx context.Context, req connect.AnyRequest) (connect.AnyResponse, error) {
 			if uuid != "" {
-				req.Header().Set(core.UUIDHeader, uuid)
+				req.Header().Set(UUIDHeader, uuid)
 			}
 			if token != "" {
-				req.Header().Set(core.TokenHeader, token)
+				req.Header().Set(TokenHeader, token)
+			}
+			// TODO: version will be removed from request header after Gitea 1.20 released.
+			if version != "" {
+				req.Header().Set(VersionHeader, version)
 			}
 			return next(ctx, req)
 		}
@@ -43,12 +49,12 @@ func New(endpoint string, insecure bool, uuid, token string, opts ...connect.Cli
 
 	return &HTTPClient{
 		PingServiceClient: pingv1connect.NewPingServiceClient(
-			getHttpClient(endpoint, insecure),
+			getHTTPClient(endpoint, insecure),
 			baseURL,
 			opts...,
 		),
 		RunnerServiceClient: runnerv1connect.NewRunnerServiceClient(
-			getHttpClient(endpoint, insecure),
+			getHTTPClient(endpoint, insecure),
 			baseURL,
 			opts...,
 		),

internal/pkg/client/mocks/Client.go

@@ -0,0 +1,251 @@
+// Code generated by mockery v2.42.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	connect "connectrpc.com/connect"
+
+	mock "github.com/stretchr/testify/mock"
+
+	pingv1 "code.gitea.io/actions-proto-go/ping/v1"
+
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+)
+
+// Client is an autogenerated mock type for the Client type
+type Client struct {
+	mock.Mock
+}
+
+// Address provides a mock function with given fields:
+func (_m *Client) Address() string {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Address")
+	}
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
+// Declare provides a mock function with given fields: _a0, _a1
+func (_m *Client) Declare(_a0 context.Context, _a1 *connect.Request[runnerv1.DeclareRequest]) (*connect.Response[runnerv1.DeclareResponse], error) {
+	ret := _m.Called(_a0, _a1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Declare")
+	}
+
+	var r0 *connect.Response[runnerv1.DeclareResponse]
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.DeclareRequest]) (*connect.Response[runnerv1.DeclareResponse], error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.DeclareRequest]) *connect.Response[runnerv1.DeclareResponse]); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.Response[runnerv1.DeclareResponse])
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *connect.Request[runnerv1.DeclareRequest]) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// FetchTask provides a mock function with given fields: _a0, _a1
+func (_m *Client) FetchTask(_a0 context.Context, _a1 *connect.Request[runnerv1.FetchTaskRequest]) (*connect.Response[runnerv1.FetchTaskResponse], error) {
+	ret := _m.Called(_a0, _a1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for FetchTask")
+	}
+
+	var r0 *connect.Response[runnerv1.FetchTaskResponse]
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.FetchTaskRequest]) (*connect.Response[runnerv1.FetchTaskResponse], error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.FetchTaskRequest]) *connect.Response[runnerv1.FetchTaskResponse]); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.Response[runnerv1.FetchTaskResponse])
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *connect.Request[runnerv1.FetchTaskRequest]) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Insecure provides a mock function with given fields:
+func (_m *Client) Insecure() bool {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Insecure")
+	}
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func() bool); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// Ping provides a mock function with given fields: _a0, _a1
+func (_m *Client) Ping(_a0 context.Context, _a1 *connect.Request[pingv1.PingRequest]) (*connect.Response[pingv1.PingResponse], error) {
+	ret := _m.Called(_a0, _a1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Ping")
+	}
+
+	var r0 *connect.Response[pingv1.PingResponse]
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[pingv1.PingRequest]) (*connect.Response[pingv1.PingResponse], error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[pingv1.PingRequest]) *connect.Response[pingv1.PingResponse]); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.Response[pingv1.PingResponse])
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *connect.Request[pingv1.PingRequest]) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Register provides a mock function with given fields: _a0, _a1
+func (_m *Client) Register(_a0 context.Context, _a1 *connect.Request[runnerv1.RegisterRequest]) (*connect.Response[runnerv1.RegisterResponse], error) {
+	ret := _m.Called(_a0, _a1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Register")
+	}
+
+	var r0 *connect.Response[runnerv1.RegisterResponse]
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.RegisterRequest]) (*connect.Response[runnerv1.RegisterResponse], error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.RegisterRequest]) *connect.Response[runnerv1.RegisterResponse]); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.Response[runnerv1.RegisterResponse])
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *connect.Request[runnerv1.RegisterRequest]) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// UpdateLog provides a mock function with given fields: _a0, _a1
+func (_m *Client) UpdateLog(_a0 context.Context, _a1 *connect.Request[runnerv1.UpdateLogRequest]) (*connect.Response[runnerv1.UpdateLogResponse], error) {
+	ret := _m.Called(_a0, _a1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for UpdateLog")
+	}
+
+	var r0 *connect.Response[runnerv1.UpdateLogResponse]
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.UpdateLogRequest]) (*connect.Response[runnerv1.UpdateLogResponse], error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.UpdateLogRequest]) *connect.Response[runnerv1.UpdateLogResponse]); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.Response[runnerv1.UpdateLogResponse])
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *connect.Request[runnerv1.UpdateLogRequest]) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// UpdateTask provides a mock function with given fields: _a0, _a1
+func (_m *Client) UpdateTask(_a0 context.Context, _a1 *connect.Request[runnerv1.UpdateTaskRequest]) (*connect.Response[runnerv1.UpdateTaskResponse], error) {
+	ret := _m.Called(_a0, _a1)
+
+	if len(ret) == 0 {
+		panic("no return value specified for UpdateTask")
+	}
+
+	var r0 *connect.Response[runnerv1.UpdateTaskResponse]
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.UpdateTaskRequest]) (*connect.Response[runnerv1.UpdateTaskResponse], error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *connect.Request[runnerv1.UpdateTaskRequest]) *connect.Response[runnerv1.UpdateTaskResponse]); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*connect.Response[runnerv1.UpdateTaskResponse])
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *connect.Request[runnerv1.UpdateTaskRequest]) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// NewClient creates a new instance of Client. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+},
+) *Client {
+	mock := &Client{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

internal/pkg/config/config.example.yaml

@@ -0,0 +1,110 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+
+# You don't have to copy this file to your instance,
+# just run `./act_runner generate-config > config.yaml` to generate a config file.
+
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # Extra environment variables to run jobs.
+  envs:
+    A_TEST_ENV_NAME_1: a_test_env_value_1
+    A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if its timeout is shorter than this.
+  timeout: 3h
+  # The timeout for the runner to wait for running jobs to finish when shutting down.
+  # Any running jobs that haven't finished after this timeout will be cancelled.
+  shutdown_timeout: 0s
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The github_mirror of a runner is used to specify the mirror address of the github that pulls the action repository.
+  # It works when something like `uses: actions/checkout@v4` is used and DEFAULT_ACTIONS_URL is set to github,
+  # and github_mirror is not empty. In this case,
+  # it replaces https://github.com with the value here, which is useful for some special network environments.
+  github_mirror: ''
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: "macos-arm64:host" or "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+  # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `daemon`, will use labels in `.runner` file.
+  labels:
+    - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+    - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+    - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: true
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: ""
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # Any other options to be used when the container is started (e.g., --add-host=my.gitea.url:host-gateway).
+  options:
+  # The parent directory of a job's working directory.
+  # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
+  # If the path starts with '/', the '/' will be trimmed.
+  # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes: []
+  # Overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+  # Pull docker image(s) even if already present
+  force_pull: true
+  # Rebuild docker image(s) even if already present
+  force_rebuild: false
+  # Always require a reachable docker daemon, even if not required by act_runner
+  require_docker: false
+  # Timeout to wait for the docker daemon to be reachable, if docker is required by require_docker or act_runner
+  docker_timeout: 0s
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:

internal/pkg/config/config.go

@@ -0,0 +1,155 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package config
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/joho/godotenv"
+	log "github.com/sirupsen/logrus"
+	"gopkg.in/yaml.v3"
+)
+
+// Log represents the configuration for logging.
+type Log struct {
+	Level string `yaml:"level"` // Level indicates the logging level.
+}
+
+// Runner represents the configuration for the runner.
+type Runner struct {
+	File            string            `yaml:"file"`             // File specifies the file path for the runner.
+	Capacity        int               `yaml:"capacity"`         // Capacity specifies the capacity of the runner.
+	Envs            map[string]string `yaml:"envs"`             // Envs stores environment variables for the runner.
+	EnvFile         string            `yaml:"env_file"`         // EnvFile specifies the path to the file containing environment variables for the runner.
+	Timeout         time.Duration     `yaml:"timeout"`          // Timeout specifies the duration for runner timeout.
+	ShutdownTimeout time.Duration     `yaml:"shutdown_timeout"` // ShutdownTimeout specifies the duration to wait for running jobs to complete during a shutdown of the runner.
+	Insecure        bool              `yaml:"insecure"`         // Insecure indicates whether the runner operates in an insecure mode.
+	FetchTimeout    time.Duration     `yaml:"fetch_timeout"`    // FetchTimeout specifies the timeout duration for fetching resources.
+	FetchInterval   time.Duration     `yaml:"fetch_interval"`   // FetchInterval specifies the interval duration for fetching resources.
+	Labels          []string          `yaml:"labels"`           // Labels specify the labels of the runner. Labels are declared on each startup
+	GithubMirror    string            `yaml:"github_mirror"`    // GithubMirror defines what mirrors should be used when using github
+}
+
+// Cache represents the configuration for caching.
+type Cache struct {
+	Enabled        *bool  `yaml:"enabled"`         // Enabled indicates whether caching is enabled. It is a pointer to distinguish between false and not set. If not set, it will be true.
+	Dir            string `yaml:"dir"`             // Dir specifies the directory path for caching.
+	Host           string `yaml:"host"`            // Host specifies the caching host.
+	Port           uint16 `yaml:"port"`            // Port specifies the caching port.
+	ExternalServer string `yaml:"external_server"` // ExternalServer specifies the URL of external cache server
+}
+
+// Container represents the configuration for the container.
+type Container struct {
+	Network       string        `yaml:"network"`        // Network specifies the network for the container.
+	NetworkMode   string        `yaml:"network_mode"`   // Deprecated: use Network instead. Could be removed after Gitea 1.20
+	Privileged    bool          `yaml:"privileged"`     // Privileged indicates whether the container runs in privileged mode.
+	Options       string        `yaml:"options"`        // Options specifies additional options for the container.
+	WorkdirParent string        `yaml:"workdir_parent"` // WorkdirParent specifies the parent directory for the container's working directory.
+	ValidVolumes  []string      `yaml:"valid_volumes"`  // ValidVolumes specifies the volumes (including bind mounts) can be mounted to containers.
+	DockerHost    string        `yaml:"docker_host"`    // DockerHost specifies the Docker host. It overrides the value specified in environment variable DOCKER_HOST.
+	ForcePull     bool          `yaml:"force_pull"`     // Pull docker image(s) even if already present
+	ForceRebuild  bool          `yaml:"force_rebuild"`  // Rebuild docker image(s) even if already present
+	RequireDocker bool          `yaml:"require_docker"` // Always require a reachable docker daemon, even if not required by act_runner
+	DockerTimeout time.Duration `yaml:"docker_timeout"` // Timeout to wait for the docker daemon to be reachable, if docker is required by require_docker or act_runner
+}
+
+// Host represents the configuration for the host.
+type Host struct {
+	WorkdirParent string `yaml:"workdir_parent"` // WorkdirParent specifies the parent directory for the host's working directory.
+}
+
+// Config represents the overall configuration.
+type Config struct {
+	Log       Log       `yaml:"log"`       // Log represents the configuration for logging.
+	Runner    Runner    `yaml:"runner"`    // Runner represents the configuration for the runner.
+	Cache     Cache     `yaml:"cache"`     // Cache represents the configuration for caching.
+	Container Container `yaml:"container"` // Container represents the configuration for the container.
+	Host      Host      `yaml:"host"`      // Host represents the configuration for the host.
+}
+
+// LoadDefault returns the default configuration.
+// If file is not empty, it will be used to load the configuration.
+func LoadDefault(file string) (*Config, error) {
+	cfg := &Config{}
+	if file != "" {
+		content, err := os.ReadFile(file)
+		if err != nil {
+			return nil, fmt.Errorf("open config file %q: %w", file, err)
+		}
+		if err := yaml.Unmarshal(content, cfg); err != nil {
+			return nil, fmt.Errorf("parse config file %q: %w", file, err)
+		}
+	}
+	compatibleWithOldEnvs(file != "", cfg)
+
+	if cfg.Runner.EnvFile != "" {
+		if stat, err := os.Stat(cfg.Runner.EnvFile); err == nil && !stat.IsDir() {
+			envs, err := godotenv.Read(cfg.Runner.EnvFile)
+			if err != nil {
+				return nil, fmt.Errorf("read env file %q: %w", cfg.Runner.EnvFile, err)
+			}
+			if cfg.Runner.Envs == nil {
+				cfg.Runner.Envs = map[string]string{}
+			}
+			for k, v := range envs {
+				cfg.Runner.Envs[k] = v
+			}
+		}
+	}
+
+	if cfg.Log.Level == "" {
+		cfg.Log.Level = "info"
+	}
+	if cfg.Runner.File == "" {
+		cfg.Runner.File = ".runner"
+	}
+	if cfg.Runner.Capacity <= 0 {
+		cfg.Runner.Capacity = 1
+	}
+	if cfg.Runner.Timeout <= 0 {
+		cfg.Runner.Timeout = 3 * time.Hour
+	}
+	if cfg.Cache.Enabled == nil {
+		b := true
+		cfg.Cache.Enabled = &b
+	}
+	if *cfg.Cache.Enabled {
+		if cfg.Cache.Dir == "" {
+			home, _ := os.UserHomeDir()
+			cfg.Cache.Dir = filepath.Join(home, ".cache", "actcache")
+		}
+	}
+	if cfg.Container.WorkdirParent == "" {
+		cfg.Container.WorkdirParent = "workspace"
+	}
+	if cfg.Host.WorkdirParent == "" {
+		home, _ := os.UserHomeDir()
+		cfg.Host.WorkdirParent = filepath.Join(home, ".cache", "act")
+	}
+	if cfg.Runner.FetchTimeout <= 0 {
+		cfg.Runner.FetchTimeout = 5 * time.Second
+	}
+	if cfg.Runner.FetchInterval <= 0 {
+		cfg.Runner.FetchInterval = 2 * time.Second
+	}
+
+	// although `container.network_mode` will be deprecated, but we have to be compatible with it for now.
+	if cfg.Container.NetworkMode != "" && cfg.Container.Network == "" {
+		log.Warn("You are trying to use deprecated configuration item of `container.network_mode`, please use `container.network` instead.")
+		if cfg.Container.NetworkMode == "bridge" {
+			// Previously, if the value of `container.network_mode` is `bridge`, we will create a new network for job.
+			// But “bridge” is easily confused with the bridge network created by Docker by default.
+			// So we set the value of `container.network` to empty string to make `act_runner` automatically create a new network for job.
+			cfg.Container.Network = ""
+		} else {
+			cfg.Container.Network = cfg.Container.NetworkMode
+		}
+	}
+
+	return cfg, nil
+}

internal/pkg/config/deprecated.go

@@ -0,0 +1,62 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package config
+
+import (
+	"os"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// Deprecated: could be removed in the future. TODO: remove it when Gitea 1.20.0 is released.
+// Be compatible with old envs.
+func compatibleWithOldEnvs(fileUsed bool, cfg *Config) {
+	handleEnv := func(key string) (string, bool) {
+		if v, ok := os.LookupEnv(key); ok {
+			if fileUsed {
+				log.Warnf("env %s has been ignored because config file is used", key)
+				return "", false
+			}
+			log.Warnf("env %s will be deprecated, please use config file instead", key)
+			return v, true
+		}
+		return "", false
+	}
+
+	if v, ok := handleEnv("GITEA_DEBUG"); ok {
+		if b, _ := strconv.ParseBool(v); b {
+			cfg.Log.Level = "debug"
+		}
+	}
+	if v, ok := handleEnv("GITEA_TRACE"); ok {
+		if b, _ := strconv.ParseBool(v); b {
+			cfg.Log.Level = "trace"
+		}
+	}
+	if v, ok := handleEnv("GITEA_RUNNER_CAPACITY"); ok {
+		if i, _ := strconv.Atoi(v); i > 0 {
+			cfg.Runner.Capacity = i
+		}
+	}
+	if v, ok := handleEnv("GITEA_RUNNER_FILE"); ok {
+		cfg.Runner.File = v
+	}
+	if v, ok := handleEnv("GITEA_RUNNER_ENVIRON"); ok {
+		splits := strings.Split(v, ",")
+		if cfg.Runner.Envs == nil {
+			cfg.Runner.Envs = map[string]string{}
+		}
+		for _, split := range splits {
+			kv := strings.SplitN(split, ":", 2)
+			if len(kv) == 2 && kv[0] != "" {
+				cfg.Runner.Envs[kv[0]] = kv[1]
+			}
+		}
+	}
+	if v, ok := handleEnv("GITEA_RUNNER_ENV_FILE"); ok {
+		cfg.Runner.EnvFile = v
+	}
+}

internal/pkg/config/embed.go

@@ -0,0 +1,9 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package config
+
+import _ "embed"
+
+//go:embed config.example.yaml
+var Example []byte

internal/pkg/config/registration.go

@@ -0,0 +1,55 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package config
+
+import (
+	"encoding/json"
+	"os"
+)
+
+const registrationWarning = "This file is automatically generated by act-runner. Do not edit it manually unless you know what you are doing. Removing this file will cause act runner to re-register as a new runner."
+
+// Registration is the registration information for a runner
+type Registration struct {
+	Warning string `json:"WARNING"` // Warning message to display, it's always the registrationWarning constant
+
+	ID        int64    `json:"id"`
+	UUID      string   `json:"uuid"`
+	Name      string   `json:"name"`
+	Token     string   `json:"token"`
+	Address   string   `json:"address"`
+	Labels    []string `json:"labels"`
+	Ephemeral bool     `json:"ephemeral"`
+}
+
+func LoadRegistration(file string) (*Registration, error) {
+	f, err := os.Open(file)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	var reg Registration
+	if err := json.NewDecoder(f).Decode(&reg); err != nil {
+		return nil, err
+	}
+
+	reg.Warning = ""
+
+	return &reg, nil
+}
+
+func SaveRegistration(file string, reg *Registration) error {
+	f, err := os.Create(file)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	reg.Warning = registrationWarning
+
+	enc := json.NewEncoder(f)
+	enc.SetIndent("", "  ")
+	return enc.Encode(reg)
+}

internal/pkg/envcheck/bandwidth.go

@@ -0,0 +1,209 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package envcheck
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"sync"
+	"time"
+)
+
+// BandwidthInfo holds network bandwidth test results
+type BandwidthInfo struct {
+	DownloadMbps float64   `json:"download_mbps"`
+	UploadMbps   float64   `json:"upload_mbps,omitempty"`
+	Latency      float64   `json:"latency_ms,omitempty"`
+	TestedAt     time.Time `json:"tested_at"`
+}
+
+// BandwidthManager handles periodic bandwidth testing
+type BandwidthManager struct {
+	serverURL    string
+	lastResult   *BandwidthInfo
+	mu           sync.RWMutex
+	testInterval time.Duration
+	stopChan     chan struct{}
+}
+
+// NewBandwidthManager creates a new bandwidth manager
+func NewBandwidthManager(serverURL string, testInterval time.Duration) *BandwidthManager {
+	return &BandwidthManager{
+		serverURL:    serverURL,
+		testInterval: testInterval,
+		stopChan:     make(chan struct{}),
+	}
+}
+
+// Start begins periodic bandwidth testing
+func (bm *BandwidthManager) Start(ctx context.Context) {
+	// Run initial test
+	bm.RunTest(ctx)
+
+	// Start periodic testing
+	go func() {
+		ticker := time.NewTicker(bm.testInterval)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ticker.C:
+				bm.RunTest(ctx)
+			case <-bm.stopChan:
+				return
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+}
+
+// Stop stops the periodic testing
+func (bm *BandwidthManager) Stop() {
+	close(bm.stopChan)
+}
+
+// RunTest runs a bandwidth test and stores the result
+func (bm *BandwidthManager) RunTest(ctx context.Context) *BandwidthInfo {
+	result := TestBandwidth(ctx, bm.serverURL)
+
+	bm.mu.Lock()
+	bm.lastResult = result
+	bm.mu.Unlock()
+
+	return result
+}
+
+// GetLastResult returns the most recent bandwidth test result
+func (bm *BandwidthManager) GetLastResult() *BandwidthInfo {
+	bm.mu.RLock()
+	defer bm.mu.RUnlock()
+	return bm.lastResult
+}
+
+// TestBandwidth tests network bandwidth to the Gitea server
+func TestBandwidth(ctx context.Context, serverURL string) *BandwidthInfo {
+	if serverURL == "" {
+		return nil
+	}
+
+	info := &BandwidthInfo{
+		TestedAt: time.Now(),
+	}
+
+	// Test latency first
+	info.Latency = testLatency(ctx, serverURL)
+
+	// Test download speed
+	info.DownloadMbps = testDownloadSpeed(ctx, serverURL)
+
+	return info
+}
+
+func testLatency(ctx context.Context, serverURL string) float64 {
+	client := &http.Client{
+		Timeout: 10 * time.Second,
+	}
+
+	reqCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(reqCtx, "HEAD", serverURL, nil)
+	if err != nil {
+		return 0
+	}
+
+	start := time.Now()
+	resp, err := client.Do(req)
+	if err != nil {
+		return 0
+	}
+	resp.Body.Close()
+
+	latency := time.Since(start).Seconds() * 1000 // Convert to ms
+	return float64(int(latency*100)) / 100        // Round to 2 decimals
+}
+
+func testDownloadSpeed(ctx context.Context, serverURL string) float64 {
+	// Try multiple endpoints to accumulate ~1MB of data
+	endpoints := []string{
+		"/assets/css/index.css",
+		"/assets/js/index.js",
+		"/assets/img/logo.svg",
+		"/assets/img/logo.png",
+		"/",
+	}
+
+	client := &http.Client{
+		Timeout: 30 * time.Second,
+	}
+
+	var totalBytes int64
+	var totalDuration time.Duration
+	targetBytes := int64(1024 * 1024) // 1MB target
+	maxAttempts := 10                 // Limit iterations
+
+	for attempt := 0; attempt < maxAttempts && totalBytes < targetBytes; attempt++ {
+		for _, endpoint := range endpoints {
+			if totalBytes >= targetBytes {
+				break
+			}
+
+			url := serverURL + endpoint
+
+			reqCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+			req, err := http.NewRequestWithContext(reqCtx, "GET", url, nil)
+			if err != nil {
+				cancel()
+				continue
+			}
+
+			start := time.Now()
+			resp, err := client.Do(req)
+			if err != nil {
+				cancel()
+				continue
+			}
+
+			n, _ := io.Copy(io.Discard, resp.Body)
+			resp.Body.Close()
+			cancel()
+
+			duration := time.Since(start)
+
+			if n > 0 {
+				totalBytes += n
+				totalDuration += duration
+			}
+		}
+	}
+
+	if totalBytes == 0 || totalDuration == 0 {
+		return 0
+	}
+
+	// Calculate speed in Mbps
+	seconds := totalDuration.Seconds()
+	if seconds == 0 {
+		return 0
+	}
+
+	bytesPerSecond := float64(totalBytes) / seconds
+	mbps := (bytesPerSecond * 8) / (1024 * 1024)
+
+	return float64(int(mbps*100)) / 100
+}
+
+// FormatBandwidth formats bandwidth for display
+func FormatBandwidth(mbps float64) string {
+	if mbps == 0 {
+		return "Unknown"
+	}
+	if mbps >= 1000 {
+		return fmt.Sprintf("%.1f Gbps", mbps/1000)
+	}
+	return fmt.Sprintf("%.1f Mbps", mbps)
+}

internal/pkg/envcheck/capabilities.go

@@ -0,0 +1,889 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package envcheck
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/client"
+)
+
+// DiskInfo holds disk space information
+type DiskInfo struct {
+	Path        string  `json:"path,omitempty"`  // Path being checked (working directory)
+	Total       uint64  `json:"total_bytes"`
+	Free        uint64  `json:"free_bytes"`
+	Used        uint64  `json:"used_bytes"`
+	UsedPercent float64 `json:"used_percent"`
+}
+
+// DistroInfo holds Linux distribution information
+type DistroInfo struct {
+	ID         string `json:"id,omitempty"`          // e.g., "ubuntu", "debian", "fedora"
+	VersionID  string `json:"version_id,omitempty"`  // e.g., "24.04", "12"
+	PrettyName string `json:"pretty_name,omitempty"` // e.g., "Ubuntu 24.04 LTS"
+}
+
+// XcodeInfo holds Xcode and iOS development information
+type XcodeInfo struct {
+	Version    string   `json:"version,omitempty"`
+	Build      string   `json:"build,omitempty"`
+	SDKs       []string `json:"sdks,omitempty"`        // e.g., ["iOS 17.0", "macOS 14.0"]
+	Simulators []string `json:"simulators,omitempty"` // Available iOS simulators
+}
+
+// RunnerCapabilities represents the capabilities of a runner for AI consumption
+type RunnerCapabilities struct {
+	OS               string              `json:"os"`
+	Arch             string              `json:"arch"`
+	Distro           *DistroInfo         `json:"distro,omitempty"`
+	Xcode            *XcodeInfo          `json:"xcode,omitempty"`
+	Docker           bool                `json:"docker"`
+	DockerCompose    bool                `json:"docker_compose"`
+	ContainerRuntime string              `json:"container_runtime,omitempty"`
+	Shell            []string            `json:"shell,omitempty"`
+	Tools            map[string][]string `json:"tools,omitempty"`
+	BuildTools       []string            `json:"build_tools,omitempty"`  // Available build/installer tools
+	PackageManagers  []string            `json:"package_managers,omitempty"`
+	Features         *CapabilityFeatures `json:"features,omitempty"`
+	Limitations      []string            `json:"limitations,omitempty"`
+	Disk             *DiskInfo           `json:"disk,omitempty"`
+	Bandwidth        *BandwidthInfo      `json:"bandwidth,omitempty"`
+	SuggestedLabels  []string            `json:"suggested_labels,omitempty"`
+}
+
+// CapabilityFeatures represents feature support flags
+type CapabilityFeatures struct {
+	ArtifactsV4      bool `json:"artifacts_v4"`
+	Cache            bool `json:"cache"`
+	Services         bool `json:"services"`
+	CompositeActions bool `json:"composite_actions"`
+}
+
+// DetectCapabilities detects the runner's capabilities
+// workingDir is the directory where builds will run (for disk space detection)
+func DetectCapabilities(ctx context.Context, dockerHost string, workingDir string) *RunnerCapabilities {
+	cap := &RunnerCapabilities{
+		OS:              runtime.GOOS,
+		Arch:            runtime.GOARCH,
+		Tools:           make(map[string][]string),
+		BuildTools:      []string{},
+		PackageManagers: []string{},
+		Shell:           detectShells(),
+		Features: &CapabilityFeatures{
+			ArtifactsV4:      false, // Gitea doesn't support v4 artifacts
+			Cache:            true,
+			Services:         true,
+			CompositeActions: true,
+		},
+		Limitations: []string{
+			"actions/upload-artifact@v4 not supported (use v3 or direct API upload)",
+			"actions/download-artifact@v4 not supported (use v3)",
+		},
+	}
+
+	// Detect Linux distribution
+	if runtime.GOOS == "linux" {
+		cap.Distro = detectLinuxDistro()
+	}
+
+	// Detect macOS Xcode/iOS
+	if runtime.GOOS == "darwin" {
+		cap.Xcode = detectXcode(ctx)
+	}
+
+	// Detect Docker
+	cap.Docker, cap.ContainerRuntime = detectDocker(ctx, dockerHost)
+	if cap.Docker {
+		cap.DockerCompose = detectDockerCompose(ctx)
+		cap.Features.Services = true
+	}
+
+	// Detect common tools
+	detectTools(ctx, cap)
+
+	// Detect build tools
+	detectBuildTools(ctx, cap)
+
+	// Detect package managers
+	detectPackageManagers(ctx, cap)
+
+	// Detect disk space on the working directory's filesystem
+	cap.Disk = detectDiskSpace(workingDir)
+
+	// Generate suggested labels based on detected capabilities
+	cap.SuggestedLabels = generateSuggestedLabels(cap)
+
+	return cap
+}
+
+// detectXcode detects Xcode and iOS development capabilities on macOS
+func detectXcode(ctx context.Context) *XcodeInfo {
+	timeoutCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	// Check for xcodebuild
+	cmd := exec.CommandContext(timeoutCtx, "xcodebuild", "-version")
+	output, err := cmd.Output()
+	if err != nil {
+		return nil
+	}
+
+	xcode := &XcodeInfo{}
+	lines := strings.Split(string(output), "\n")
+	for _, line := range lines {
+		if strings.HasPrefix(line, "Xcode ") {
+			xcode.Version = strings.TrimPrefix(line, "Xcode ")
+		} else if strings.HasPrefix(line, "Build version ") {
+			xcode.Build = strings.TrimPrefix(line, "Build version ")
+		}
+	}
+
+	// Get available SDKs
+	cmd = exec.CommandContext(timeoutCtx, "xcodebuild", "-showsdks")
+	output, err = cmd.Output()
+	if err == nil {
+		lines = strings.Split(string(output), "\n")
+		for _, line := range lines {
+			line = strings.TrimSpace(line)
+			// Look for SDK lines like "-sdk iphoneos17.0" or "iOS 17.0"
+			if strings.Contains(line, "SDK") || strings.HasPrefix(line, "-sdk") {
+				continue // Skip header lines
+			}
+			if strings.Contains(line, "iOS") || strings.Contains(line, "macOS") ||
+				strings.Contains(line, "watchOS") || strings.Contains(line, "tvOS") ||
+				strings.Contains(line, "visionOS") || strings.Contains(line, "xrOS") {
+				// Extract SDK name
+				if idx := strings.Index(line, "-sdk"); idx != -1 {
+					sdkPart := strings.TrimSpace(line[:idx])
+					if sdkPart != "" {
+						xcode.SDKs = append(xcode.SDKs, sdkPart)
+					}
+				}
+			}
+		}
+	}
+
+	// Get available simulators
+	cmd = exec.CommandContext(timeoutCtx, "xcrun", "simctl", "list", "devices", "available", "-j")
+	output, err = cmd.Output()
+	if err == nil {
+		var simData struct {
+			Devices map[string][]struct {
+				Name  string `json:"name"`
+				State string `json:"state"`
+			} `json:"devices"`
+		}
+		if json.Unmarshal(output, &simData) == nil {
+			seen := make(map[string]bool)
+			for runtime, devices := range simData.Devices {
+				if strings.Contains(runtime, "iOS") {
+					for _, dev := range devices {
+						key := dev.Name
+						if !seen[key] {
+							seen[key] = true
+							xcode.Simulators = append(xcode.Simulators, dev.Name)
+						}
+					}
+				}
+			}
+		}
+	}
+
+	if xcode.Version == "" {
+		return nil
+	}
+
+	return xcode
+}
+
+// detectLinuxDistro reads /etc/os-release to get distribution info
+func detectLinuxDistro() *DistroInfo {
+	file, err := os.Open("/etc/os-release")
+	if err != nil {
+		return nil
+	}
+	defer file.Close()
+
+	distro := &DistroInfo{}
+	scanner := bufio.NewScanner(file)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		if strings.HasPrefix(line, "ID=") {
+			distro.ID = strings.Trim(strings.TrimPrefix(line, "ID="), "\"")
+		} else if strings.HasPrefix(line, "VERSION_ID=") {
+			distro.VersionID = strings.Trim(strings.TrimPrefix(line, "VERSION_ID="), "\"")
+		} else if strings.HasPrefix(line, "PRETTY_NAME=") {
+			distro.PrettyName = strings.Trim(strings.TrimPrefix(line, "PRETTY_NAME="), "\"")
+		}
+	}
+
+	if distro.ID == "" {
+		return nil
+	}
+
+	return distro
+}
+
+// generateSuggestedLabels creates industry-standard labels based on capabilities
+func generateSuggestedLabels(cap *RunnerCapabilities) []string {
+	labels := []string{}
+	seen := make(map[string]bool)
+
+	addLabel := func(label string) {
+		if label != "" && !seen[label] {
+			seen[label] = true
+			labels = append(labels, label)
+		}
+	}
+
+	// OS labels
+	switch cap.OS {
+	case "linux":
+		addLabel("linux")
+		addLabel("linux-latest")
+	case "windows":
+		addLabel("windows")
+		addLabel("windows-latest")
+	case "darwin":
+		addLabel("macos")
+		addLabel("macos-latest")
+	}
+
+	// Distro labels (Linux only)
+	if cap.Distro != nil && cap.Distro.ID != "" {
+		distro := strings.ToLower(cap.Distro.ID)
+		addLabel(distro)
+		addLabel(distro + "-latest")
+	}
+
+	// Xcode/iOS labels (macOS only)
+	if cap.Xcode != nil {
+		addLabel("xcode")
+		// Check for SDKs
+		for _, sdk := range cap.Xcode.SDKs {
+			sdkLower := strings.ToLower(sdk)
+			if strings.Contains(sdkLower, "ios") {
+				addLabel("ios")
+			}
+			if strings.Contains(sdkLower, "visionos") || strings.Contains(sdkLower, "xros") {
+				addLabel("visionos")
+			}
+			if strings.Contains(sdkLower, "watchos") {
+				addLabel("watchos")
+			}
+			if strings.Contains(sdkLower, "tvos") {
+				addLabel("tvos")
+			}
+		}
+		// If simulators available, add simulator label
+		if len(cap.Xcode.Simulators) > 0 {
+			addLabel("ios-simulator")
+		}
+	}
+
+	// Tool-based labels
+	if _, ok := cap.Tools["dotnet"]; ok {
+		addLabel("dotnet")
+	}
+	if _, ok := cap.Tools["java"]; ok {
+		addLabel("java")
+	}
+	if _, ok := cap.Tools["node"]; ok {
+		addLabel("node")
+	}
+
+	// Build tool labels
+	for _, tool := range cap.BuildTools {
+		switch tool {
+		case "msbuild":
+			addLabel("msbuild")
+		case "visual-studio":
+			addLabel("vs2022") // or detect actual version
+		case "inno-setup":
+			addLabel("inno-setup")
+		case "nsis":
+			addLabel("nsis")
+		}
+	}
+
+	return labels
+}
+
+// ToJSON converts capabilities to JSON string for transmission
+func (c *RunnerCapabilities) ToJSON() string {
+	data, err := json.Marshal(c)
+	if err != nil {
+		return "{}"
+	}
+	return string(data)
+}
+
+func detectShells() []string {
+	shells := []string{}
+
+	switch runtime.GOOS {
+	case "windows":
+		if _, err := exec.LookPath("pwsh"); err == nil {
+			shells = append(shells, "pwsh")
+		}
+		if _, err := exec.LookPath("powershell"); err == nil {
+			shells = append(shells, "powershell")
+		}
+		shells = append(shells, "cmd")
+	case "darwin":
+		if _, err := exec.LookPath("zsh"); err == nil {
+			shells = append(shells, "zsh")
+		}
+		if _, err := exec.LookPath("bash"); err == nil {
+			shells = append(shells, "bash")
+		}
+		shells = append(shells, "sh")
+	default: // linux and others
+		if _, err := exec.LookPath("bash"); err == nil {
+			shells = append(shells, "bash")
+		}
+		shells = append(shells, "sh")
+	}
+
+	return shells
+}
+
+func detectDocker(ctx context.Context, dockerHost string) (bool, string) {
+	opts := []client.Opt{client.FromEnv}
+	if dockerHost != "" {
+		opts = append(opts, client.WithHost(dockerHost))
+	}
+
+	cli, err := client.NewClientWithOpts(opts...)
+	if err != nil {
+		return false, ""
+	}
+	defer cli.Close()
+
+	timeoutCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	_, err = cli.Ping(timeoutCtx)
+	if err != nil {
+		return false, ""
+	}
+
+	// Check if it's podman or docker
+	info, err := cli.Info(timeoutCtx)
+	if err == nil {
+		if strings.Contains(strings.ToLower(info.Name), "podman") {
+			return true, "podman"
+		}
+	}
+
+	return true, "docker"
+}
+
+func detectDockerCompose(ctx context.Context) bool {
+	// Check for docker compose v2 (docker compose)
+	cmd := exec.CommandContext(ctx, "docker", "compose", "version")
+	if err := cmd.Run(); err == nil {
+		return true
+	}
+
+	// Check for docker-compose v1
+	if _, err := exec.LookPath("docker-compose"); err == nil {
+		return true
+	}
+
+	return false
+}
+
+func detectTools(ctx context.Context, cap *RunnerCapabilities) {
+	toolDetectors := map[string]func(context.Context) []string{
+		"node":       detectNodeVersions,
+		"go":         detectGoVersions,
+		"python":     detectPythonVersions,
+		"java":       detectJavaVersions,
+		"dotnet":     detectDotnetVersions,
+		"rust":       detectRustVersions,
+		"ruby":       detectRubyVersions,
+		"php":        detectPHPVersions,
+		"swift":      detectSwiftVersions,
+		"kotlin":     detectKotlinVersions,
+		"flutter":    detectFlutterVersions,
+		"dart":       detectDartVersions,
+		"powershell": detectPowerShellVersions,
+	}
+
+	for tool, detector := range toolDetectors {
+		if versions := detector(ctx); len(versions) > 0 {
+			cap.Tools[tool] = versions
+		}
+	}
+
+	// Detect additional tools that just need presence check
+	simpleTools := map[string]string{
+		"git":    "git",
+		"cmake":  "cmake",
+		"make":   "make",
+		"ninja":  "ninja",
+		"gradle": "gradle",
+		"maven":  "mvn",
+		"npm":    "npm",
+		"yarn":   "yarn",
+		"pnpm":   "pnpm",
+		"cargo":  "cargo",
+		"pip":    "pip3",
+	}
+
+	for name, cmd := range simpleTools {
+		if v := detectSimpleToolVersion(ctx, cmd); v != "" {
+			cap.Tools[name] = []string{v}
+		}
+	}
+}
+
+func detectBuildTools(ctx context.Context, cap *RunnerCapabilities) {
+	switch runtime.GOOS {
+	case "windows":
+		detectWindowsBuildTools(ctx, cap)
+	case "darwin":
+		detectMacOSBuildTools(ctx, cap)
+	case "linux":
+		detectLinuxBuildTools(ctx, cap)
+	}
+}
+
+func detectWindowsBuildTools(ctx context.Context, cap *RunnerCapabilities) {
+	// Check for Visual Studio via vswhere
+	vswherePaths := []string{
+		`C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe`,
+		`C:\Program Files\Microsoft Visual Studio\Installer\vswhere.exe`,
+	}
+	for _, vswhere := range vswherePaths {
+		if _, err := os.Stat(vswhere); err == nil {
+			cmd := exec.CommandContext(ctx, vswhere, "-latest", "-property", "displayName")
+			if output, err := cmd.Output(); err == nil && len(output) > 0 {
+				cap.BuildTools = append(cap.BuildTools, "visual-studio")
+				break
+			}
+		}
+	}
+
+	// Check for MSBuild
+	msbuildPaths := []string{
+		`C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin\MSBuild.exe`,
+		`C:\Program Files\Microsoft Visual Studio\2022\Professional\MSBuild\Current\Bin\MSBuild.exe`,
+		`C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\MSBuild.exe`,
+		`C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\MSBuild.exe`,
+		`C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\MSBuild\Current\Bin\MSBuild.exe`,
+		`C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin\MSBuild.exe`,
+	}
+	for _, msbuild := range msbuildPaths {
+		if _, err := os.Stat(msbuild); err == nil {
+			cap.BuildTools = append(cap.BuildTools, "msbuild")
+			break
+		}
+	}
+
+	// Check for Inno Setup
+	innoSetupPaths := []string{
+		`C:\Program Files (x86)\Inno Setup 6\ISCC.exe`,
+		`C:\Program Files\Inno Setup 6\ISCC.exe`,
+		`C:\Program Files (x86)\Inno Setup 5\ISCC.exe`,
+		`C:\Program Files\Inno Setup 5\ISCC.exe`,
+	}
+	for _, iscc := range innoSetupPaths {
+		if _, err := os.Stat(iscc); err == nil {
+			cap.BuildTools = append(cap.BuildTools, "inno-setup")
+			break
+		}
+	}
+	// Also check PATH
+	if _, err := exec.LookPath("iscc"); err == nil {
+		if !contains(cap.BuildTools, "inno-setup") {
+			cap.BuildTools = append(cap.BuildTools, "inno-setup")
+		}
+	}
+
+	// Check for NSIS
+	nsisPaths := []string{
+		`C:\Program Files (x86)\NSIS\makensis.exe`,
+		`C:\Program Files\NSIS\makensis.exe`,
+	}
+	for _, nsis := range nsisPaths {
+		if _, err := os.Stat(nsis); err == nil {
+			cap.BuildTools = append(cap.BuildTools, "nsis")
+			break
+		}
+	}
+	if _, err := exec.LookPath("makensis"); err == nil {
+		if !contains(cap.BuildTools, "nsis") {
+			cap.BuildTools = append(cap.BuildTools, "nsis")
+		}
+	}
+
+	// Check for WiX Toolset
+	wixPaths := []string{
+		`C:\Program Files (x86)\WiX Toolset v3.11\bin\candle.exe`,
+		`C:\Program Files (x86)\WiX Toolset v3.14\bin\candle.exe`,
+	}
+	for _, wix := range wixPaths {
+		if _, err := os.Stat(wix); err == nil {
+			cap.BuildTools = append(cap.BuildTools, "wix")
+			break
+		}
+	}
+
+	// Check for signtool (Windows SDK)
+	signtoolPaths, _ := filepath.Glob(`C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe`)
+	if len(signtoolPaths) > 0 {
+		cap.BuildTools = append(cap.BuildTools, "signtool")
+	}
+}
+
+func detectMacOSBuildTools(ctx context.Context, cap *RunnerCapabilities) {
+	// Check for xcpretty
+	if _, err := exec.LookPath("xcpretty"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "xcpretty")
+	}
+
+	// Check for fastlane
+	if _, err := exec.LookPath("fastlane"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "fastlane")
+	}
+
+	// Check for CocoaPods
+	if _, err := exec.LookPath("pod"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "cocoapods")
+	}
+
+	// Check for Carthage
+	if _, err := exec.LookPath("carthage"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "carthage")
+	}
+
+	// Check for SwiftLint
+	if _, err := exec.LookPath("swiftlint"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "swiftlint")
+	}
+
+	// Check for create-dmg or similar
+	if _, err := exec.LookPath("create-dmg"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "create-dmg")
+	}
+
+	// Check for Packages (packagesbuild)
+	if _, err := exec.LookPath("packagesbuild"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "packages")
+	}
+
+	// Check for pkgbuild (built-in)
+	if _, err := exec.LookPath("pkgbuild"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "pkgbuild")
+	}
+
+	// Check for codesign (built-in)
+	if _, err := exec.LookPath("codesign"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "codesign")
+	}
+
+	// Check for notarytool (built-in with Xcode)
+	if _, err := exec.LookPath("notarytool"); err == nil {
+		cap.BuildTools = append(cap.BuildTools, "notarytool")
+	}
+}
+
+func detectLinuxBuildTools(ctx context.Context, cap *RunnerCapabilities) {
+	// Check for common Linux build tools
+	tools := []string{
+		"gcc", "g++", "clang", "clang++",
+		"autoconf", "automake", "libtool",
+		"pkg-config", "meson",
+		"dpkg-deb", "rpmbuild", "fpm",
+		"appimage-builder", "linuxdeploy",
+	}
+
+	for _, tool := range tools {
+		if _, err := exec.LookPath(tool); err == nil {
+			cap.BuildTools = append(cap.BuildTools, tool)
+		}
+	}
+}
+
+func detectPackageManagers(ctx context.Context, cap *RunnerCapabilities) {
+	switch runtime.GOOS {
+	case "windows":
+		if _, err := exec.LookPath("choco"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "chocolatey")
+		}
+		if _, err := exec.LookPath("scoop"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "scoop")
+		}
+		if _, err := exec.LookPath("winget"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "winget")
+		}
+	case "darwin":
+		if _, err := exec.LookPath("brew"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "homebrew")
+		}
+		if _, err := exec.LookPath("port"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "macports")
+		}
+	case "linux":
+		if _, err := exec.LookPath("apt"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "apt")
+		}
+		if _, err := exec.LookPath("yum"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "yum")
+		}
+		if _, err := exec.LookPath("dnf"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "dnf")
+		}
+		if _, err := exec.LookPath("pacman"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "pacman")
+		}
+		if _, err := exec.LookPath("zypper"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "zypper")
+		}
+		if _, err := exec.LookPath("apk"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "apk")
+		}
+		if _, err := exec.LookPath("snap"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "snap")
+		}
+		if _, err := exec.LookPath("flatpak"); err == nil {
+			cap.PackageManagers = append(cap.PackageManagers, "flatpak")
+		}
+	}
+}
+
+func detectNodeVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "node", "--version", "v")
+}
+
+func detectGoVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "go", "version", "go")
+}
+
+func detectPythonVersions(ctx context.Context) []string {
+	versions := []string{}
+
+	// Try python3 first
+	if v := detectToolVersion(ctx, "python3", "--version", "Python "); len(v) > 0 {
+		versions = append(versions, v...)
+	}
+
+	// Also try python
+	if v := detectToolVersion(ctx, "python", "--version", "Python "); len(v) > 0 {
+		for _, ver := range v {
+			if !contains(versions, ver) {
+				versions = append(versions, ver)
+			}
+		}
+	}
+
+	return versions
+}
+
+func detectJavaVersions(ctx context.Context) []string {
+	cmd := exec.CommandContext(ctx, "java", "-version")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return nil
+	}
+
+	lines := strings.Split(string(output), "\n")
+	for _, line := range lines {
+		if strings.Contains(line, "version") {
+			start := strings.Index(line, "\"")
+			end := strings.LastIndex(line, "\"")
+			if start != -1 && end > start {
+				version := line[start+1 : end]
+				parts := strings.Split(version, ".")
+				if len(parts) > 0 {
+					if parts[0] == "1" && len(parts) > 1 {
+						return []string{parts[1]}
+					}
+					return []string{parts[0]}
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func detectDotnetVersions(ctx context.Context) []string {
+	cmd := exec.CommandContext(ctx, "dotnet", "--list-sdks")
+	output, err := cmd.Output()
+	if err != nil {
+		return nil
+	}
+
+	versions := []string{}
+	lines := strings.Split(string(output), "\n")
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		parts := strings.Split(line, " ")
+		if len(parts) > 0 {
+			version := parts[0]
+			major := strings.Split(version, ".")[0]
+			if !contains(versions, major) {
+				versions = append(versions, major)
+			}
+		}
+	}
+
+	return versions
+}
+
+func detectRustVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "rustc", "--version", "rustc ")
+}
+
+func detectRubyVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "ruby", "--version", "ruby ")
+}
+
+func detectPHPVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "php", "--version", "PHP ")
+}
+
+func detectSwiftVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "swift", "--version", "Swift version ")
+}
+
+func detectKotlinVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "kotlin", "-version", "Kotlin version ")
+}
+
+func detectFlutterVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "flutter", "--version", "Flutter ")
+}
+
+func detectDartVersions(ctx context.Context) []string {
+	return detectToolVersion(ctx, "dart", "--version", "Dart SDK version: ")
+}
+
+func detectPowerShellVersions(ctx context.Context) []string {
+	versions := []string{}
+
+	// Check for pwsh (PowerShell Core / PowerShell 7+)
+	if v := detectPwshVersion(ctx, "pwsh"); v != "" {
+		versions = append(versions, "pwsh:"+v)
+	}
+
+	// Check for powershell (Windows PowerShell 5.x)
+	if runtime.GOOS == "windows" {
+		if v := detectPwshVersion(ctx, "powershell"); v != "" {
+			versions = append(versions, "powershell:"+v)
+		}
+	}
+
+	return versions
+}
+
+func detectPwshVersion(ctx context.Context, cmd string) string {
+	timeoutCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	// Use -Command to get version
+	var c *exec.Cmd
+	if cmd == "pwsh" {
+		c = exec.CommandContext(timeoutCtx, cmd, "-Command", "$PSVersionTable.PSVersion.ToString()")
+	} else {
+		c = exec.CommandContext(timeoutCtx, cmd, "-Command", "$PSVersionTable.PSVersion.ToString()")
+	}
+
+	output, err := c.Output()
+	if err != nil {
+		return ""
+	}
+
+	version := strings.TrimSpace(string(output))
+	// Return major.minor
+	parts := strings.Split(version, ".")
+	if len(parts) >= 2 {
+		return parts[0] + "." + parts[1]
+	}
+	return version
+}
+
+func detectSimpleToolVersion(ctx context.Context, cmd string) string {
+	if _, err := exec.LookPath(cmd); err != nil {
+		return ""
+	}
+
+	timeoutCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	c := exec.CommandContext(timeoutCtx, cmd, "--version")
+	output, err := c.Output()
+	if err != nil {
+		// Try without --version for tools that don't support it
+		return "installed"
+	}
+
+	line := strings.TrimSpace(strings.Split(string(output), "\n")[0])
+	// Extract version number if possible
+	parts := strings.Fields(line)
+	for _, part := range parts {
+		// Look for something that looks like a version
+		if len(part) > 0 && (part[0] >= '0' && part[0] <= '9' || part[0] == 'v') {
+			return strings.TrimPrefix(part, "v")
+		}
+	}
+
+	return "installed"
+}
+
+func detectToolVersion(ctx context.Context, cmd string, args string, prefix string) []string {
+	timeoutCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	c := exec.CommandContext(timeoutCtx, cmd, args)
+	output, err := c.Output()
+	if err != nil {
+		return nil
+	}
+
+	line := strings.TrimSpace(string(output))
+	if prefix != "" {
+		if idx := strings.Index(line, prefix); idx != -1 {
+			line = line[idx+len(prefix):]
+		}
+	}
+
+	parts := strings.Fields(line)
+	if len(parts) > 0 {
+		version := parts[0]
+		version = strings.TrimPrefix(version, "v")
+		vparts := strings.Split(version, ".")
+		if len(vparts) >= 2 {
+			return []string{vparts[0] + "." + vparts[1]}
+		}
+		return []string{vparts[0]}
+	}
+
+	return nil
+}
+
+func contains(slice []string, item string) bool {
+	for _, s := range slice {
+		if s == item {
+			return true
+		}
+	}
+	return false
+}

internal/pkg/envcheck/disk_unix.go

@@ -0,0 +1,43 @@
+//go:build unix
+
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package envcheck
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+// detectDiskSpace detects disk space on the specified path's filesystem (Unix version)
+// If path is empty, defaults to "/"
+func detectDiskSpace(path string) *DiskInfo {
+	if path == "" {
+		path = "/"
+	}
+
+	var stat unix.Statfs_t
+
+	err := unix.Statfs(path, &stat)
+	if err != nil {
+		// Fallback to root if the path doesn't exist
+		err = unix.Statfs("/", &stat)
+		if err != nil {
+			return nil
+		}
+		path = "/"
+	}
+
+	total := stat.Blocks * uint64(stat.Bsize)
+	free := stat.Bavail * uint64(stat.Bsize)
+	used := total - free
+	usedPercent := float64(used) / float64(total) * 100
+
+	return &DiskInfo{
+		Path:        path,
+		Total:       total,
+		Free:        free,
+		Used:        used,
+		UsedPercent: usedPercent,
+	}
+}

internal/pkg/envcheck/disk_windows.go

@@ -0,0 +1,57 @@
+//go:build windows
+
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package envcheck
+
+import (
+	"path/filepath"
+
+	"golang.org/x/sys/windows"
+)
+
+// detectDiskSpace detects disk space on the specified path's drive (Windows version)
+// If path is empty, defaults to "C:\"
+func detectDiskSpace(path string) *DiskInfo {
+	if path == "" {
+		path = "C:\\"
+	}
+
+	// Resolve to absolute path
+	absPath, err := filepath.Abs(path)
+	if err != nil {
+		absPath = "C:\\"
+	}
+
+	// Extract drive letter (e.g., "D:\" from "D:\builds\runner")
+	drivePath := filepath.VolumeName(absPath) + "\\"
+	if drivePath == "\\" {
+		drivePath = "C:\\"
+	}
+
+	var freeBytesAvailable, totalNumberOfBytes, totalNumberOfFreeBytes uint64
+
+	pathPtr := windows.StringToUTF16Ptr(drivePath)
+	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytesAvailable, &totalNumberOfBytes, &totalNumberOfFreeBytes)
+	if err != nil {
+		// Fallback to C: drive
+		pathPtr = windows.StringToUTF16Ptr("C:\\")
+		err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytesAvailable, &totalNumberOfBytes, &totalNumberOfFreeBytes)
+		if err != nil {
+			return nil
+		}
+		drivePath = "C:\\"
+	}
+
+	used := totalNumberOfBytes - totalNumberOfFreeBytes
+	usedPercent := float64(used) / float64(totalNumberOfBytes) * 100
+
+	return &DiskInfo{
+		Path:        drivePath,
+		Total:       totalNumberOfBytes,
+		Free:        totalNumberOfFreeBytes,
+		Used:        used,
+		UsedPercent: usedPercent,
+	}
+}

internal/pkg/envcheck/doc.go

@@ -0,0 +1,5 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Package envcheck provides a simple way to check if the environment is ready to run jobs.
+package envcheck

internal/pkg/envcheck/docker.go

@@ -0,0 +1,34 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package envcheck
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/docker/docker/client"
+)
+
+func CheckIfDockerRunning(ctx context.Context, configDockerHost string) error {
+	opts := []client.Opt{
+		client.FromEnv,
+	}
+
+	if configDockerHost != "" {
+		opts = append(opts, client.WithHost(configDockerHost))
+	}
+
+	cli, err := client.NewClientWithOpts(opts...)
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+
+	_, err = cli.Ping(ctx)
+	if err != nil {
+		return fmt.Errorf("cannot ping the docker daemon, is it running? %w", err)
+	}
+
+	return nil
+}

internal/pkg/labels/labels.go

@@ -0,0 +1,106 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package labels
+
+import (
+	"fmt"
+	"strings"
+)
+
+const (
+	SchemeHost   = "host"
+	SchemeDocker = "docker"
+)
+
+type Label struct {
+	Name   string
+	Schema string
+	Arg    string
+}
+
+func Parse(str string) (*Label, error) {
+	splits := strings.SplitN(str, ":", 3)
+	label := &Label{
+		Name:   splits[0],
+		Schema: "host",
+		Arg:    "",
+	}
+	if len(splits) >= 2 {
+		label.Schema = splits[1]
+	}
+	if len(splits) >= 3 {
+		label.Arg = splits[2]
+	}
+	if label.Schema != SchemeHost && label.Schema != SchemeDocker {
+		return nil, fmt.Errorf("unsupported schema: %s", label.Schema)
+	}
+	return label, nil
+}
+
+type Labels []*Label
+
+func (l Labels) RequireDocker() bool {
+	for _, label := range l {
+		if label.Schema == SchemeDocker {
+			return true
+		}
+	}
+	return false
+}
+
+func (l Labels) PickPlatform(runsOn []string) string {
+	platforms := make(map[string]string, len(l))
+	for _, label := range l {
+		switch label.Schema {
+		case SchemeDocker:
+			// "//" will be ignored
+			platforms[label.Name] = strings.TrimPrefix(label.Arg, "//")
+		case SchemeHost:
+			platforms[label.Name] = "-self-hosted"
+		default:
+			// It should not happen, because Parse has checked it.
+			continue
+		}
+	}
+	for _, v := range runsOn {
+		if v, ok := platforms[v]; ok {
+			return v
+		}
+	}
+
+	// TODO: support multiple labels
+	// like:
+	//   ["ubuntu-22.04"] => "ubuntu:22.04"
+	//   ["with-gpu"] => "linux:with-gpu"
+	//   ["ubuntu-22.04", "with-gpu"] => "ubuntu:22.04_with-gpu"
+
+	// return default.
+	// So the runner receives a task with a label that the runner doesn't have,
+	// it happens when the user have edited the label of the runner in the web UI.
+	// TODO: it may be not correct, what if the runner is used as host mode only?
+	return "docker.gitea.com/runner-images:ubuntu-latest"
+}
+
+func (l Labels) Names() []string {
+	names := make([]string, 0, len(l))
+	for _, label := range l {
+		names = append(names, label.Name)
+	}
+	return names
+}
+
+func (l Labels) ToStrings() []string {
+	ls := make([]string, 0, len(l))
+	for _, label := range l {
+		lbl := label.Name
+		if label.Schema != "" {
+			lbl += ":" + label.Schema
+			if label.Arg != "" {
+				lbl += ":" + label.Arg
+			}
+		}
+		ls = append(ls, lbl)
+	}
+	return ls
+}

internal/pkg/labels/labels_test.go

@@ -0,0 +1,63 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package labels
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gotest.tools/v3/assert"
+)
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		args    string
+		want    *Label
+		wantErr bool
+	}{
+		{
+			args: "ubuntu:docker://node:18",
+			want: &Label{
+				Name:   "ubuntu",
+				Schema: "docker",
+				Arg:    "//node:18",
+			},
+			wantErr: false,
+		},
+		{
+			args: "ubuntu:host",
+			want: &Label{
+				Name:   "ubuntu",
+				Schema: "host",
+				Arg:    "",
+			},
+			wantErr: false,
+		},
+		{
+			args: "ubuntu",
+			want: &Label{
+				Name:   "ubuntu",
+				Schema: "host",
+				Arg:    "",
+			},
+			wantErr: false,
+		},
+		{
+			args:    "ubuntu:vm:ubuntu-18.04",
+			want:    nil,
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.args, func(t *testing.T) {
+			got, err := Parse(tt.args)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.DeepEqual(t, got, tt.want)
+		})
+	}
+}

internal/pkg/report/reporter.go

@@ -1,20 +1,24 @@
-package runtime
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package report
 
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
 
 	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"gitea.com/gitea/act_runner/client"
-
-	retry "github.com/avast/retry-go/v4"
-	"github.com/bufbuild/connect-go"
+	"connectrpc.com/connect"
+	"github.com/avast/retry-go/v4"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"gitea.com/gitea/act_runner/internal/pkg/client"
 )
 
 type Reporter struct {
@@ -28,8 +32,14 @@ type Reporter struct {
 	logOffset   int
 	logRows     []*runnerv1.LogRow
 	logReplacer *strings.Replacer
-	state       *runnerv1.TaskState
-	stateM      sync.RWMutex
+	oldnew      []string
+
+	state   *runnerv1.TaskState
+	stateMu sync.RWMutex
+	outputs sync.Map
+
+	debugOutputEnabled  bool
+	stopCommandEndToken string
 }
 
 func NewReporter(ctx context.Context, cancel context.CancelFunc, client client.Client, task *runnerv1.Task) *Reporter {
@@ -37,24 +47,34 @@ func NewReporter(ctx context.Context, cancel context.CancelFunc, client client.C
 	if v := task.Context.Fields["token"].GetStringValue(); v != "" {
 		oldnew = append(oldnew, v, "***")
 	}
+	if v := task.Context.Fields["gitea_runtime_token"].GetStringValue(); v != "" {
+		oldnew = append(oldnew, v, "***")
+	}
 	for _, v := range task.Secrets {
 		oldnew = append(oldnew, v, "***")
 	}
 
-	return &Reporter{
+	rv := &Reporter{
 		ctx:         ctx,
 		cancel:      cancel,
 		client:      client,
+		oldnew:      oldnew,
 		logReplacer: strings.NewReplacer(oldnew...),
 		state: &runnerv1.TaskState{
 			Id: task.Id,
 		},
 	}
+
+	if task.Secrets["ACTIONS_STEP_DEBUG"] == "true" {
+		rv.debugOutputEnabled = true
+	}
+
+	return rv
 }
 
 func (r *Reporter) ResetSteps(l int) {
-	r.stateM.Lock()
-	defer r.stateM.Unlock()
+	r.stateMu.Lock()
+	defer r.stateMu.Unlock()
 	for i := 0; i < l; i++ {
 		r.state.Steps = append(r.state.Steps, &runnerv1.StepState{
 			Id: int64(i),
@@ -66,9 +86,16 @@ func (r *Reporter) Levels() []log.Level {
 	return log.AllLevels
 }
 
+func appendIfNotNil[T any](s []*T, v *T) []*T {
+	if v != nil {
+		return append(s, v)
+	}
+	return s
+}
+
 func (r *Reporter) Fire(entry *log.Entry) error {
-	r.stateM.Lock()
-	defer r.stateM.Unlock()
+	r.stateMu.Lock()
+	defer r.stateMu.Unlock()
 
 	log.WithFields(entry.Data).Trace(entry.Message)
 
@@ -87,25 +114,28 @@ func (r *Reporter) Fire(entry *log.Entry) error {
 				for _, s := range r.state.Steps {
 					if s.Result == runnerv1.Result_RESULT_UNSPECIFIED {
 						s.Result = runnerv1.Result_RESULT_CANCELLED
+						if jobResult == runnerv1.Result_RESULT_SKIPPED {
+							s.Result = runnerv1.Result_RESULT_SKIPPED
+						}
 					}
 				}
 			}
 		}
 		if !r.duringSteps() {
-			r.logRows = append(r.logRows, r.parseLogRow(entry))
+			r.logRows = appendIfNotNil(r.logRows, r.parseLogRow(entry))
 		}
 		return nil
 	}
 
 	var step *runnerv1.StepState
 	if v, ok := entry.Data["stepNumber"]; ok {
-		if v, ok := v.(int); ok {
+		if v, ok := v.(int); ok && len(r.state.Steps) > v {
 			step = r.state.Steps[v]
 		}
 	}
 	if step == nil {
 		if !r.duringSteps() {
-			r.logRows = append(r.logRows, r.parseLogRow(entry))
+			r.logRows = appendIfNotNil(r.logRows, r.parseLogRow(entry))
 		}
 		return nil
 	}
@@ -113,16 +143,24 @@ func (r *Reporter) Fire(entry *log.Entry) error {
 	if step.StartedAt == nil {
 		step.StartedAt = timestamppb.New(timestamp)
 	}
+
+	// Force reporting log errors as raw output to prevent silent failures
+	if entry.Level == log.ErrorLevel {
+		entry.Data["raw_output"] = true
+	}
+
 	if v, ok := entry.Data["raw_output"]; ok {
 		if rawOutput, ok := v.(bool); ok && rawOutput {
-			if step.LogLength == 0 {
-				step.LogIndex = int64(r.logOffset + len(r.logRows))
+			if row := r.parseLogRow(entry); row != nil {
+				if step.LogLength == 0 {
+					step.LogIndex = int64(r.logOffset + len(r.logRows))
+				}
+				step.LogLength++
+				r.logRows = append(r.logRows, row)
 			}
-			step.LogLength++
-			r.logRows = append(r.logRows, r.parseLogRow(entry))
 		}
 	} else if !r.duringSteps() {
-		r.logRows = append(r.logRows, r.parseLogRow(entry))
+		r.logRows = appendIfNotNil(r.logRows, r.parseLogRow(entry))
 	}
 	if v, ok := entry.Data["stepResult"]; ok {
 		if stepResult, ok := r.parseResult(v); ok {
@@ -152,9 +190,13 @@ func (r *Reporter) RunDaemon() {
 }
 
 func (r *Reporter) Logf(format string, a ...interface{}) {
-	r.stateM.Lock()
-	defer r.stateM.Unlock()
+	r.stateMu.Lock()
+	defer r.stateMu.Unlock()
 
+	r.logf(format, a...)
+}
+
+func (r *Reporter) logf(format string, a ...interface{}) {
 	if !r.duringSteps() {
 		r.logRows = append(r.logRows, &runnerv1.LogRow{
 			Time:    timestamppb.Now(),
@@ -163,10 +205,30 @@ func (r *Reporter) Logf(format string, a ...interface{}) {
 	}
 }
 
+func (r *Reporter) SetOutputs(outputs map[string]string) {
+	r.stateMu.Lock()
+	defer r.stateMu.Unlock()
+
+	for k, v := range outputs {
+		if len(k) > 255 {
+			r.logf("ignore output because the key is too long: %q", k)
+			continue
+		}
+		if l := len(v); l > 1024*1024 {
+			log.Println("ignore output because the value is too long:", k, l)
+			r.logf("ignore output because the value %q is too long: %d", k, l)
+		}
+		if _, ok := r.outputs.Load(k); ok {
+			continue
+		}
+		r.outputs.Store(k, v)
+	}
+}
+
 func (r *Reporter) Close(lastWords string) error {
 	r.closed = true
 
-	r.stateM.Lock()
+	r.stateMu.Lock()
 	if r.state.Result == runnerv1.Result_RESULT_UNSPECIFIED {
 		if lastWords == "" {
 			lastWords = "Early termination"
@@ -176,18 +238,19 @@ func (r *Reporter) Close(lastWords string) error {
 				v.Result = runnerv1.Result_RESULT_CANCELLED
 			}
 		}
+		r.state.Result = runnerv1.Result_RESULT_FAILURE
 		r.logRows = append(r.logRows, &runnerv1.LogRow{
 			Time:    timestamppb.Now(),
 			Content: lastWords,
 		})
-		return nil
+		r.state.StoppedAt = timestamppb.Now()
 	} else if lastWords != "" {
 		r.logRows = append(r.logRows, &runnerv1.LogRow{
 			Time:    timestamppb.Now(),
 			Content: lastWords,
 		})
 	}
-	r.stateM.Unlock()
+	r.stateMu.Unlock()
 
 	return retry.Do(func() error {
 		if err := r.ReportLog(true); err != nil {
@@ -201,9 +264,9 @@ func (r *Reporter) ReportLog(noMore bool) error {
 	r.clientM.Lock()
 	defer r.clientM.Unlock()
 
-	r.stateM.RLock()
+	r.stateMu.RLock()
 	rows := r.logRows
-	r.stateM.RUnlock()
+	r.stateMu.RUnlock()
 
 	resp, err := r.client.UpdateLog(r.ctx, connect.NewRequest(&runnerv1.UpdateLogRequest{
 		TaskId: r.state.Id,
@@ -220,10 +283,10 @@ func (r *Reporter) ReportLog(noMore bool) error {
 		return fmt.Errorf("submitted logs are lost")
 	}
 
-	r.stateM.Lock()
+	r.stateMu.Lock()
 	r.logRows = r.logRows[ack-r.logOffset:]
 	r.logOffset = ack
-	r.stateM.Unlock()
+	r.stateMu.Unlock()
 
 	if noMore && ack < r.logOffset+len(rows) {
 		return fmt.Errorf("not all logs are submitted")
@@ -236,21 +299,45 @@ func (r *Reporter) ReportState() error {
 	r.clientM.Lock()
 	defer r.clientM.Unlock()
 
-	r.stateM.RLock()
+	r.stateMu.RLock()
 	state := proto.Clone(r.state).(*runnerv1.TaskState)
-	r.stateM.RUnlock()
+	r.stateMu.RUnlock()
+
+	outputs := make(map[string]string)
+	r.outputs.Range(func(k, v interface{}) bool {
+		if val, ok := v.(string); ok {
+			outputs[k.(string)] = val
+		}
+		return true
+	})
 
 	resp, err := r.client.UpdateTask(r.ctx, connect.NewRequest(&runnerv1.UpdateTaskRequest{
-		State: state,
+		State:   state,
+		Outputs: outputs,
 	}))
 	if err != nil {
 		return err
 	}
 
+	for _, k := range resp.Msg.SentOutputs {
+		r.outputs.Store(k, struct{}{})
+	}
+
 	if resp.Msg.State != nil && resp.Msg.State.Result == runnerv1.Result_RESULT_CANCELLED {
 		r.cancel()
 	}
 
+	var noSent []string
+	r.outputs.Range(func(k, v interface{}) bool {
+		if _, ok := v.(string); ok {
+			noSent = append(noSent, k.(string))
+		}
+		return true
+	})
+	if len(noSent) > 0 {
+		return fmt.Errorf("there are still outputs that have not been sent: %v", noSent)
+	}
+
 	return nil
 }
 
@@ -284,11 +371,70 @@ func (r *Reporter) parseResult(result interface{}) (runnerv1.Result, bool) {
 	return ret, ok
 }
 
+var cmdRegex = regexp.MustCompile(`^::([^ :]+)( .*)?::(.*)$`)
+
+func (r *Reporter) handleCommand(originalContent, command, parameters, value string) *string {
+	if r.stopCommandEndToken != "" && command != r.stopCommandEndToken {
+		return &originalContent
+	}
+
+	switch command {
+	case "add-mask":
+		r.addMask(value)
+		return nil
+	case "debug":
+		if r.debugOutputEnabled {
+			return &value
+		}
+		return nil
+
+	case "notice":
+		// Not implemented yet, so just return the original content.
+		return &originalContent
+	case "warning":
+		// Not implemented yet, so just return the original content.
+		return &originalContent
+	case "error":
+		// Not implemented yet, so just return the original content.
+		return &originalContent
+	case "group":
+		// Returning the original content, because I think the frontend
+		// will use it when rendering the output.
+		return &originalContent
+	case "endgroup":
+		// Ditto
+		return &originalContent
+	case "stop-commands":
+		r.stopCommandEndToken = value
+		return nil
+	case r.stopCommandEndToken:
+		r.stopCommandEndToken = ""
+		return nil
+	}
+	return &originalContent
+}
+
 func (r *Reporter) parseLogRow(entry *log.Entry) *runnerv1.LogRow {
 	content := strings.TrimRightFunc(entry.Message, func(r rune) bool { return r == '\r' || r == '\n' })
+
+	matches := cmdRegex.FindStringSubmatch(content)
+	if matches != nil {
+		if output := r.handleCommand(content, matches[1], matches[2], matches[3]); output != nil {
+			content = *output
+		} else {
+			return nil
+		}
+	}
+
 	content = r.logReplacer.Replace(content)
+
 	return &runnerv1.LogRow{
 		Time:    timestamppb.New(entry.Time),
-		Content: content,
+		Content: strings.ToValidUTF8(content, "?"),
 	}
 }
+
+func (r *Reporter) addMask(msg string) {
+	r.oldnew = append(r.oldnew, msg, "***")
+	r.logReplacer = strings.NewReplacer(r.oldnew...)
+}

internal/pkg/report/reporter_test.go

@@ -0,0 +1,197 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package report
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	connect_go "connectrpc.com/connect"
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/structpb"
+
+	"gitea.com/gitea/act_runner/internal/pkg/client/mocks"
+)
+
+func TestReporter_parseLogRow(t *testing.T) {
+	tests := []struct {
+		name               string
+		debugOutputEnabled bool
+		args               []string
+		want               []string
+	}{
+		{
+			"No command", false,
+			[]string{"Hello, world!"},
+			[]string{"Hello, world!"},
+		},
+		{
+			"Add-mask", false,
+			[]string{
+				"foo mysecret bar",
+				"::add-mask::mysecret",
+				"foo mysecret bar",
+			},
+			[]string{
+				"foo mysecret bar",
+				"<nil>",
+				"foo *** bar",
+			},
+		},
+		{
+			"Debug enabled", true,
+			[]string{
+				"::debug::GitHub Actions runtime token access controls",
+			},
+			[]string{
+				"GitHub Actions runtime token access controls",
+			},
+		},
+		{
+			"Debug not enabled", false,
+			[]string{
+				"::debug::GitHub Actions runtime token access controls",
+			},
+			[]string{
+				"<nil>",
+			},
+		},
+		{
+			"notice", false,
+			[]string{
+				"::notice file=file.name,line=42,endLine=48,title=Cool Title::Gosh, that's not going to work",
+			},
+			[]string{
+				"::notice file=file.name,line=42,endLine=48,title=Cool Title::Gosh, that's not going to work",
+			},
+		},
+		{
+			"warning", false,
+			[]string{
+				"::warning file=file.name,line=42,endLine=48,title=Cool Title::Gosh, that's not going to work",
+			},
+			[]string{
+				"::warning file=file.name,line=42,endLine=48,title=Cool Title::Gosh, that's not going to work",
+			},
+		},
+		{
+			"error", false,
+			[]string{
+				"::error file=file.name,line=42,endLine=48,title=Cool Title::Gosh, that's not going to work",
+			},
+			[]string{
+				"::error file=file.name,line=42,endLine=48,title=Cool Title::Gosh, that's not going to work",
+			},
+		},
+		{
+			"group", false,
+			[]string{
+				"::group::",
+				"::endgroup::",
+			},
+			[]string{
+				"::group::",
+				"::endgroup::",
+			},
+		},
+		{
+			"stop-commands", false,
+			[]string{
+				"::add-mask::foo",
+				"::stop-commands::myverycoolstoptoken",
+				"::add-mask::bar",
+				"::debug::Stuff",
+				"myverycoolstoptoken",
+				"::add-mask::baz",
+				"::myverycoolstoptoken::",
+				"::add-mask::wibble",
+				"foo bar baz wibble",
+			},
+			[]string{
+				"<nil>",
+				"<nil>",
+				"::add-mask::bar",
+				"::debug::Stuff",
+				"myverycoolstoptoken",
+				"::add-mask::baz",
+				"<nil>",
+				"<nil>",
+				"*** bar baz ***",
+			},
+		},
+		{
+			"unknown command", false,
+			[]string{
+				"::set-mask::foo",
+			},
+			[]string{
+				"::set-mask::foo",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &Reporter{
+				logReplacer:        strings.NewReplacer(),
+				debugOutputEnabled: tt.debugOutputEnabled,
+			}
+			for idx, arg := range tt.args {
+				rv := r.parseLogRow(&log.Entry{Message: arg})
+				got := "<nil>"
+
+				if rv != nil {
+					got = rv.Content
+				}
+
+				assert.Equal(t, tt.want[idx], got)
+			}
+		})
+	}
+}
+
+func TestReporter_Fire(t *testing.T) {
+	t.Run("ignore command lines", func(t *testing.T) {
+		client := mocks.NewClient(t)
+		client.On("UpdateLog", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateLogRequest]) (*connect_go.Response[runnerv1.UpdateLogResponse], error) {
+			t.Logf("Received UpdateLog: %s", req.Msg.String())
+			return connect_go.NewResponse(&runnerv1.UpdateLogResponse{
+				AckIndex: req.Msg.Index + int64(len(req.Msg.Rows)),
+			}), nil
+		})
+		client.On("UpdateTask", mock.Anything, mock.Anything).Return(func(_ context.Context, req *connect_go.Request[runnerv1.UpdateTaskRequest]) (*connect_go.Response[runnerv1.UpdateTaskResponse], error) {
+			t.Logf("Received UpdateTask: %s", req.Msg.String())
+			return connect_go.NewResponse(&runnerv1.UpdateTaskResponse{}), nil
+		})
+		ctx, cancel := context.WithCancel(context.Background())
+		taskCtx, err := structpb.NewStruct(map[string]interface{}{})
+		require.NoError(t, err)
+		reporter := NewReporter(ctx, cancel, client, &runnerv1.Task{
+			Context: taskCtx,
+		})
+		defer func() {
+			assert.NoError(t, reporter.Close(""))
+		}()
+		reporter.ResetSteps(5)
+
+		dataStep0 := map[string]interface{}{
+			"stage":      "Main",
+			"stepNumber": 0,
+			"raw_output": true,
+		}
+
+		assert.NoError(t, reporter.Fire(&log.Entry{Message: "regular log line", Data: dataStep0}))
+		assert.NoError(t, reporter.Fire(&log.Entry{Message: "::debug::debug log line", Data: dataStep0}))
+		assert.NoError(t, reporter.Fire(&log.Entry{Message: "regular log line", Data: dataStep0}))
+		assert.NoError(t, reporter.Fire(&log.Entry{Message: "::debug::debug log line", Data: dataStep0}))
+		assert.NoError(t, reporter.Fire(&log.Entry{Message: "::debug::debug log line", Data: dataStep0}))
+		assert.NoError(t, reporter.Fire(&log.Entry{Message: "regular log line", Data: dataStep0}))
+
+		assert.Equal(t, int64(3), reporter.state.Steps[0].LogLength)
+	})
+}

internal/pkg/ver/version.go

@@ -0,0 +1,11 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package ver
+
+// go build -ldflags "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=1.2.3"
+var version = "dev"
+
+func Version() string {
+	return version
+}

main.go

@@ -1,34 +1,19 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
 package main
 
 import (
 	"context"
-	"os"
 	"os/signal"
 	"syscall"
 
-	"gitea.com/gitea/act_runner/cmd"
+	"gitea.com/gitea/act_runner/internal/app/cmd"
 )
 
-func withContextFunc(ctx context.Context, f func()) context.Context {
-	ctx, cancel := context.WithCancel(ctx)
-	go func() {
-		c := make(chan os.Signal, 1)
-		signal.Notify(c, syscall.SIGINT, syscall.SIGTERM)
-		defer signal.Stop(c)
-
-		select {
-		case <-ctx.Done():
-		case <-c:
-			cancel()
-			f()
-		}
-	}()
-
-	return ctx
-}
-
 func main() {
-	ctx := withContextFunc(context.Background(), func() {})
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
 	// run the command
 	cmd.Execute(ctx)
 }

poller/metric.go

@@ -1,33 +0,0 @@
-package poller
-
-import "sync/atomic"
-
-// Metric interface
-type Metric interface {
-	IncBusyWorker() int64
-	DecBusyWorker() int64
-	BusyWorkers() int64
-}
-
-var _ Metric = (*metric)(nil)
-
-type metric struct {
-	busyWorkers int64
-}
-
-// NewMetric for default metric structure
-func NewMetric() Metric {
-	return &metric{}
-}
-
-func (m *metric) IncBusyWorker() int64 {
-	return atomic.AddInt64(&m.busyWorkers, 1)
-}
-
-func (m *metric) DecBusyWorker() int64 {
-	return atomic.AddInt64(&m.busyWorkers, -1)
-}
-
-func (m *metric) BusyWorkers() int64 {
-	return atomic.LoadInt64(&m.busyWorkers)
-}

poller/poller.go

@@ -1,146 +0,0 @@
-package poller
-
-import (
-	"context"
-	"errors"
-	"sync"
-	"time"
-
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"gitea.com/gitea/act_runner/client"
-
-	"github.com/bufbuild/connect-go"
-	log "github.com/sirupsen/logrus"
-)
-
-var ErrDataLock = errors.New("Data Lock Error")
-
-func New(cli client.Client, dispatch func(context.Context, *runnerv1.Task) error, workerNum int) *Poller {
-	return &Poller{
-		Client:       cli,
-		Dispatch:     dispatch,
-		routineGroup: newRoutineGroup(),
-		metric:       &metric{},
-		workerNum:    workerNum,
-		ready:        make(chan struct{}, 1),
-	}
-}
-
-type Poller struct {
-	Client   client.Client
-	Dispatch func(context.Context, *runnerv1.Task) error
-
-	sync.Mutex
-	routineGroup *routineGroup
-	metric       *metric
-	ready        chan struct{}
-	workerNum    int
-}
-
-func (p *Poller) schedule() {
-	p.Lock()
-	defer p.Unlock()
-	if int(p.metric.BusyWorkers()) >= p.workerNum {
-		return
-	}
-
-	select {
-	case p.ready <- struct{}{}:
-	default:
-	}
-}
-
-func (p *Poller) Wait() {
-	p.routineGroup.Wait()
-}
-
-func (p *Poller) Poll(ctx context.Context) error {
-	l := log.WithField("func", "Poll")
-
-	for {
-		// check worker number
-		p.schedule()
-
-		select {
-		// wait worker ready
-		case <-p.ready:
-		case <-ctx.Done():
-			return nil
-		}
-	LOOP:
-		for {
-			select {
-			case <-ctx.Done():
-				break LOOP
-			default:
-				task, err := p.pollTask(ctx)
-				if task == nil || err != nil {
-					if err != nil {
-						l.Errorf("can't find the task: %v", err.Error())
-					}
-					time.Sleep(5 * time.Second)
-					break
-				}
-
-				p.metric.IncBusyWorker()
-				p.routineGroup.Run(func() {
-					defer p.schedule()
-					defer p.metric.DecBusyWorker()
-					if err := p.dispatchTask(ctx, task); err != nil {
-						l.Errorf("execute task: %v", err.Error())
-					}
-				})
-				break LOOP
-			}
-		}
-	}
-}
-
-func (p *Poller) pollTask(ctx context.Context) (*runnerv1.Task, error) {
-	l := log.WithField("func", "pollTask")
-	l.Info("poller: request stage from remote server")
-
-	reqCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-
-	// request a new build stage for execution from the central
-	// build server.
-	resp, err := p.Client.FetchTask(reqCtx, connect.NewRequest(&runnerv1.FetchTaskRequest{}))
-	if err == context.Canceled || err == context.DeadlineExceeded {
-		l.WithError(err).Trace("poller: no stage returned")
-		return nil, nil
-	}
-
-	if err != nil && err == ErrDataLock {
-		l.WithError(err).Info("task accepted by another runner")
-		return nil, nil
-	}
-
-	if err != nil {
-		l.WithError(err).Error("cannot accept task")
-		return nil, err
-	}
-
-	// exit if a nil or empty stage is returned from the system
-	// and allow the runner to retry.
-	if resp.Msg.Task == nil || resp.Msg.Task.Id == 0 {
-		return nil, nil
-	}
-
-	return resp.Msg.Task, nil
-}
-
-func (p *Poller) dispatchTask(ctx context.Context, task *runnerv1.Task) error {
-	l := log.WithField("func", "dispatchTask")
-	defer func() {
-		e := recover()
-		if e != nil {
-			l.Errorf("panic error: %v", e)
-		}
-	}()
-
-	runCtx, cancel := context.WithTimeout(ctx, time.Hour)
-	defer cancel()
-
-	return p.Dispatch(runCtx, task)
-}

poller/thread.go

@@ -1,24 +0,0 @@
-package poller
-
-import "sync"
-
-type routineGroup struct {
-	waitGroup sync.WaitGroup
-}
-
-func newRoutineGroup() *routineGroup {
-	return new(routineGroup)
-}
-
-func (g *routineGroup) Run(fn func()) {
-	g.waitGroup.Add(1)
-
-	go func() {
-		defer g.waitGroup.Done()
-		fn()
-	}()
-}
-
-func (g *routineGroup) Wait() {
-	g.waitGroup.Wait()
-}

register/register.go

@@ -1,63 +0,0 @@
-package register
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"strconv"
-	"strings"
-
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"gitea.com/gitea/act_runner/client"
-	"gitea.com/gitea/act_runner/config"
-	"gitea.com/gitea/act_runner/core"
-
-	"github.com/bufbuild/connect-go"
-	log "github.com/sirupsen/logrus"
-)
-
-func New(cli client.Client) *Register {
-	return &Register{
-		Client: cli,
-	}
-}
-
-type Register struct {
-	Client client.Client
-}
-
-func (p *Register) Register(ctx context.Context, cfg config.Runner) (*core.Runner, error) {
-	labels := make([]string, len(cfg.Labels))
-	for i, v := range cfg.Labels {
-		labels[i] = strings.SplitN(v, ":", 2)[0]
-	}
-	// register new runner.
-	resp, err := p.Client.Register(ctx, connect.NewRequest(&runnerv1.RegisterRequest{
-		Name:        cfg.Name,
-		Token:       cfg.Token,
-		AgentLabels: labels,
-	}))
-	if err != nil {
-		log.WithError(err).Error("poller: cannot register new runner")
-		return nil, err
-	}
-
-	data := &core.Runner{
-		ID:       resp.Msg.Runner.Id,
-		UUID:     resp.Msg.Runner.Uuid,
-		Name:     resp.Msg.Runner.Name,
-		Token:    resp.Msg.Runner.Token,
-		Address:  p.Client.Address(),
-		Insecure: strconv.FormatBool(p.Client.Insecure()),
-		Labels:   cfg.Labels,
-	}
-
-	file, err := json.MarshalIndent(data, "", "  ")
-	if err != nil {
-		log.WithError(err).Error("poller: cannot marshal the json input")
-		return data, err
-	}
-
-	// store runner config in .runner file
-	return data, os.WriteFile(cfg.File, file, 0o644)
-}

renovate.json5

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>gitea/renovate-config"
+  ]
+}

runtime/runtime.go

@@ -1,64 +0,0 @@
-package runtime
-
-import (
-	"context"
-	"strings"
-
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"gitea.com/gitea/act_runner/client"
-)
-
-// Runner runs the pipeline.
-type Runner struct {
-	Machine       string
-	ForgeInstance string
-	Environ       map[string]string
-	Client        client.Client
-	Labels        []string
-}
-
-// Run runs the pipeline stage.
-func (s *Runner) Run(ctx context.Context, task *runnerv1.Task) error {
-	return NewTask(s.ForgeInstance, task.Id, s.Client, s.Environ, s.platformPicker).Run(ctx, task)
-}
-
-func (s *Runner) platformPicker(labels []string) string {
-	// "ubuntu-18.04:docker://node:16-buster"
-	// "self-hosted"
-
-	platforms := make(map[string]string, len(labels))
-	for _, l := range s.Labels {
-		// "ubuntu-18.04:docker://node:16-buster"
-		splits := strings.SplitN(l, ":", 2)
-		if len(splits) == 1 {
-			// identifier for non docker execution environment
-			platforms[splits[0]] = "-self-hosted"
-			continue
-		}
-		// ["ubuntu-18.04", "docker://node:16-buster"]
-		k, v := splits[0], splits[1]
-
-		if prefix := "docker://"; !strings.HasPrefix(v, prefix) {
-			continue
-		} else {
-			v = strings.TrimPrefix(v, prefix)
-		}
-		// ubuntu-18.04 => node:16-buster
-		platforms[k] = v
-	}
-
-	for _, label := range labels {
-		if v, ok := platforms[label]; ok {
-			return v
-		}
-	}
-
-	// TODO: support multiple labels
-	// like:
-	//   ["ubuntu-22.04"] => "ubuntu:22.04"
-	//   ["with-gpu"] => "linux:with-gpu"
-	//   ["ubuntu-22.04", "with-gpu"] => "ubuntu:22.04_with-gpu"
-
-	// return default
-	return "node:16-bullseye"
-}

runtime/task.go

@@ -1,265 +0,0 @@
-package runtime
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-	"time"
-
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"gitea.com/gitea/act_runner/client"
-
-	"github.com/nektos/act/pkg/artifacts"
-	"github.com/nektos/act/pkg/common"
-	"github.com/nektos/act/pkg/model"
-	"github.com/nektos/act/pkg/runner"
-	log "github.com/sirupsen/logrus"
-)
-
-var globalTaskMap sync.Map
-
-type TaskInput struct {
-	repoDirectory string
-	// actor         string
-	// workdir string
-	// workflowsPath         string
-	// autodetectEvent       bool
-	// eventPath       string
-	// reuseContainers bool
-	// bindWorkdir     bool
-	// secrets         []string
-	envs map[string]string
-	// platforms       []string
-	// dryrun       bool
-	forcePull    bool
-	forceRebuild bool
-	// noOutput     bool
-	// envfile         string
-	// secretfile            string
-	insecureSecrets bool
-	// defaultBranch         string
-	privileged            bool
-	usernsMode            string
-	containerArchitecture string
-	containerDaemonSocket string
-	// noWorkflowRecurse     bool
-	useGitIgnore     bool
-	containerCapAdd  []string
-	containerCapDrop []string
-	// autoRemove         bool
-	artifactServerPath string
-	artifactServerPort string
-	jsonLogger         bool
-	// noSkipCheckout     bool
-	// remoteName            string
-
-	EnvFile string
-
-	containerNetworkMode string
-}
-
-type Task struct {
-	BuildID int64
-	Input   *TaskInput
-
-	client         client.Client
-	log            *log.Entry
-	platformPicker func([]string) string
-}
-
-// NewTask creates a new task
-func NewTask(forgeInstance string, buildID int64, client client.Client, runnerEnvs map[string]string, picker func([]string) string) *Task {
-	task := &Task{
-		Input: &TaskInput{
-			envs:                 runnerEnvs,
-			containerNetworkMode: "bridge", // TODO should be configurable
-		},
-		BuildID: buildID,
-
-		client:         client,
-		log:            log.WithField("buildID", buildID),
-		platformPicker: picker,
-	}
-	task.Input.repoDirectory, _ = os.Getwd()
-	return task
-}
-
-// getWorkflowsPath return the workflows directory, it will try .gitea first and then fallback to .github
-func getWorkflowsPath(dir string) (string, error) {
-	p := filepath.Join(dir, ".gitea/workflows")
-	_, err := os.Stat(p)
-	if err != nil {
-		if !os.IsNotExist(err) {
-			return "", err
-		}
-		return filepath.Join(dir, ".github/workflows"), nil
-	}
-	return p, nil
-}
-
-func getToken(task *runnerv1.Task) string {
-	token := task.Secrets["GITHUB_TOKEN"]
-	if task.Secrets["GITEA_TOKEN"] != "" {
-		token = task.Secrets["GITEA_TOKEN"]
-	}
-	if task.Context.Fields["token"].GetStringValue() != "" {
-		token = task.Context.Fields["token"].GetStringValue()
-	}
-	return token
-}
-
-func (t *Task) Run(ctx context.Context, task *runnerv1.Task) (lastErr error) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-	_, exist := globalTaskMap.Load(task.Id)
-	if exist {
-		return fmt.Errorf("task %d already exists", task.Id)
-	}
-
-	// set task ve to global map
-	// when task is done or canceled, it will be removed from the map
-	globalTaskMap.Store(task.Id, t)
-	defer globalTaskMap.Delete(task.Id)
-
-	lastWords := ""
-	reporter := NewReporter(ctx, cancel, t.client, task)
-	defer func() {
-		// set the job to failed on an error return value
-		if lastErr != nil {
-			reporter.Fire(&log.Entry{
-				Data: log.Fields{
-					"jobResult": "failure",
-				},
-			})
-		}
-		_ = reporter.Close(lastWords)
-	}()
-	reporter.RunDaemon()
-
-	reporter.Logf("received task %v of job %v", task.Id, task.Context.Fields["job"].GetStringValue())
-
-	workflowsPath, err := getWorkflowsPath(t.Input.repoDirectory)
-	if err != nil {
-		lastWords = err.Error()
-		return err
-	}
-	t.log.Debugf("workflows path: %s", workflowsPath)
-
-	workflow, err := model.ReadWorkflow(bytes.NewReader(task.WorkflowPayload))
-	if err != nil {
-		lastWords = err.Error()
-		return err
-	}
-
-	var plan *model.Plan
-	jobIDs := workflow.GetJobIDs()
-	if len(jobIDs) != 1 {
-		err := fmt.Errorf("multiple jobs found: %v", jobIDs)
-		lastWords = err.Error()
-		return err
-	}
-	jobID := jobIDs[0]
-	plan = model.CombineWorkflowPlanner(workflow).PlanJob(jobID)
-	job := workflow.GetJob(jobID)
-	reporter.ResetSteps(len(job.Steps))
-
-	log.Infof("plan: %+v", plan.Stages[0].Runs)
-
-	token := getToken(task)
-	dataContext := task.Context.Fields
-
-	log.Infof("task %v repo is %v %v %v", task.Id, dataContext["repository"].GetStringValue(),
-		dataContext["gitea_default_actions_url"].GetStringValue(),
-		t.client.Address())
-
-	preset := &model.GithubContext{
-		Event:           dataContext["event"].GetStructValue().AsMap(),
-		RunID:           dataContext["run_id"].GetStringValue(),
-		RunNumber:       dataContext["run_number"].GetStringValue(),
-		Actor:           dataContext["actor"].GetStringValue(),
-		Repository:      dataContext["repository"].GetStringValue(),
-		EventName:       dataContext["event_name"].GetStringValue(),
-		Sha:             dataContext["sha"].GetStringValue(),
-		Ref:             dataContext["ref"].GetStringValue(),
-		RefName:         dataContext["ref_name"].GetStringValue(),
-		RefType:         dataContext["ref_type"].GetStringValue(),
-		HeadRef:         dataContext["head_ref"].GetStringValue(),
-		BaseRef:         dataContext["base_ref"].GetStringValue(),
-		Token:           token,
-		RepositoryOwner: dataContext["repository_owner"].GetStringValue(),
-		RetentionDays:   dataContext["retention_days"].GetStringValue(),
-	}
-	eventJSON, err := json.Marshal(preset.Event)
-	if err != nil {
-		lastWords = err.Error()
-		return err
-	}
-
-	maxLifetime := 3 * time.Hour
-	if deadline, ok := ctx.Deadline(); ok {
-		maxLifetime = time.Until(deadline)
-	}
-
-	input := t.Input
-	config := &runner.Config{
-		Workdir:               "/" + preset.Repository,
-		BindWorkdir:           false,
-		ReuseContainers:       false,
-		ForcePull:             input.forcePull,
-		ForceRebuild:          input.forceRebuild,
-		LogOutput:             true,
-		JSONLogger:            input.jsonLogger,
-		Env:                   input.envs,
-		Secrets:               task.Secrets,
-		InsecureSecrets:       input.insecureSecrets,
-		Privileged:            input.privileged,
-		UsernsMode:            input.usernsMode,
-		ContainerArchitecture: input.containerArchitecture,
-		ContainerDaemonSocket: input.containerDaemonSocket,
-		UseGitIgnore:          input.useGitIgnore,
-		GitHubInstance:        t.client.Address(),
-		ContainerCapAdd:       input.containerCapAdd,
-		ContainerCapDrop:      input.containerCapDrop,
-		AutoRemove:            true,
-		ArtifactServerPath:    input.artifactServerPath,
-		ArtifactServerPort:    input.artifactServerPort,
-		NoSkipCheckout:        true,
-		PresetGitHubContext:   preset,
-		EventJSON:             string(eventJSON),
-		ContainerNamePrefix:   fmt.Sprintf("GITEA-ACTIONS-TASK-%d", task.Id),
-		ContainerMaxLifetime:  maxLifetime,
-		ContainerNetworkMode:  input.containerNetworkMode,
-		DefaultActionInstance: dataContext["gitea_default_actions_url"].GetStringValue(),
-		PlatformPicker:        t.platformPicker,
-	}
-	r, err := runner.New(config)
-	if err != nil {
-		lastWords = err.Error()
-		return err
-	}
-
-	artifactCancel := artifacts.Serve(ctx, input.artifactServerPath, input.artifactServerPort)
-	t.log.Debugf("artifacts server started at %s:%s", input.artifactServerPath, input.artifactServerPort)
-
-	executor := r.NewPlanExecutor(plan).Finally(func(ctx context.Context) error {
-		artifactCancel()
-		return nil
-	})
-
-	t.log.Infof("workflow prepared")
-	reporter.Logf("workflow prepared")
-
-	// add logger recorders
-	ctx = common.WithLoggerHook(ctx, reporter)
-
-	if err := executor(ctx); err != nil {
-		lastWords = err.Error()
-		return err
-	}
-
-	return nil
-}

scripts/run.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+
+if [[ ! -d /data ]]; then
+  mkdir -p /data
+fi
+
+cd /data
+
+RUNNER_STATE_FILE=${RUNNER_STATE_FILE:-'.runner'}
+
+CONFIG_ARG=""
+if [[ ! -z "${CONFIG_FILE}" ]]; then
+  CONFIG_ARG="--config ${CONFIG_FILE}"
+fi
+EXTRA_ARGS=""
+if [[ ! -z "${GITEA_RUNNER_LABELS}" ]]; then
+  EXTRA_ARGS="${EXTRA_ARGS} --labels ${GITEA_RUNNER_LABELS}"
+fi
+if [[ ! -z "${GITEA_RUNNER_EPHEMERAL}" ]]; then
+  EXTRA_ARGS="${EXTRA_ARGS} --ephemeral"
+fi
+RUN_ARGS=""
+if [[ ! -z "${GITEA_RUNNER_ONCE}" ]]; then
+  RUN_ARGS="${RUN_ARGS} --once"
+fi
+
+# In case no token is set, it's possible to read the token from a file, i.e. a Docker Secret
+if [[ -z "${GITEA_RUNNER_REGISTRATION_TOKEN}" ]] && [[ -f "${GITEA_RUNNER_REGISTRATION_TOKEN_FILE}" ]]; then
+  GITEA_RUNNER_REGISTRATION_TOKEN=$(cat "${GITEA_RUNNER_REGISTRATION_TOKEN_FILE}")
+fi
+
+# Use the same ENV variable names as https://github.com/vegardit/docker-gitea-act-runner
+test -f "$RUNNER_STATE_FILE" || echo "$RUNNER_STATE_FILE is missing or not a regular file"
+
+if [[ ! -s "$RUNNER_STATE_FILE" ]]; then
+  try=$((try + 1))
+  success=0
+
+  # The point of this loop is to make it simple, when running both act_runner and gitea in docker,
+  # for the act_runner to wait a moment for gitea to become available before erroring out.  Within
+  # the context of a single docker-compose, something similar could be done via healthchecks, but
+  # this is more flexible.
+  while [[ $success -eq 0 ]] && [[ $try -lt ${GITEA_MAX_REG_ATTEMPTS:-10} ]]; do
+    act_runner register \
+      --instance "${GITEA_INSTANCE_URL}" \
+      --token    "${GITEA_RUNNER_REGISTRATION_TOKEN}" \
+      --name     "${GITEA_RUNNER_NAME:-`hostname`}" \
+      ${CONFIG_ARG} ${EXTRA_ARGS} --no-interactive 2>&1 | tee /tmp/reg.log
+
+    cat /tmp/reg.log | grep 'Runner registered successfully' > /dev/null
+    if [[ $? -eq 0 ]]; then
+      echo "SUCCESS"
+      success=1
+    else
+      echo "Waiting to retry ..."
+      sleep 5
+    fi
+  done
+fi
+# Prevent reading the token from the act_runner process
+unset GITEA_RUNNER_REGISTRATION_TOKEN
+unset GITEA_RUNNER_REGISTRATION_TOKEN_FILE
+
+exec act_runner daemon ${CONFIG_ARG} ${RUN_ARGS}

scripts/s6/act_runner/finish

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+exec s6-svscanctl -t /etc/s6

scripts/s6/act_runner/run

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+s6-svwait -U /etc/s6/docker
+
+exec run.sh

scripts/s6/docker/data/check

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+if ! docker info &> /dev/null; then
+  echo "Waiting for Docker daemon to start..."
+  exit 1
+fi

scripts/s6/docker/finish

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+exec s6-svscanctl -t /etc/s6
+

scripts/s6/docker/notification-fd

@@ -0,0 +1 @@
+3

scripts/s6/docker/run

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+exec s6-notifyoncheck dockerd-entrypoint.sh