Skip to content

fix(actions): evaluate each ${{ }} part on its own (#38754) - #38797

Merged
silverwind merged 2 commits into
go-gitea:release/v1.27from
silverwind:backport-38754-v1.27
Aug 6, 2026
Merged

fix(actions): evaluate each ${{ }} part on its own (#38754)#38797
silverwind merged 2 commits into
go-gitea:release/v1.27from
silverwind:backport-38754-v1.27

Conversation

@silverwind

Copy link
Copy Markdown
Member

Backport of #38754

Every ${{ }} part was spliced as raw text into a synthesized format('...', <raw>) call and re-parsed, so unbalanced parentheses restructured the whole expression:

run-name: ${{ 1) && (2 }}          # panicked, aborting workflow parsing for the push
if: ${{ 1 }} ${{ 0) && (0 }}       # silently skipped the job
runs-on: ${{ nosuchcontext.x }}    # silently queued the job against the label ""

One scanner shaped like GitHub's template reader now splits every value and each part is evaluated on its own, so nothing builds an expression out of text. A part that fails is an error instead of an empty string.

expressionCallsFunction is self-contained here, since this branch has no expressionsMatch to build it on. That makes github.com/rhysd/actionlint a direct dependency, which it already is on main.

Backport of go-gitea#38754

Interpolate spliced the raw text of every `${{ }}` part into a synthesized
format('...', <raw>) call and re-parsed it, so unbalanced parentheses in a
workflow expression escaped the wrapper and rewrote the whole expression.
`run-name: ${{ 1) && (2 }}` then evaluated to a non-string and panicked,
and `if: ${{ 1 }} ${{ 0) && (0 }}` silently skipped the job. Every value now
goes through one scanner shaped like GitHub's template reader, and each part
is evaluated on its own, so nothing builds an expression out of text.

A part that fails is an error instead of an empty string, so a `runs-on` that
cannot be evaluated no longer leaves the job queued against a label no runner
has, with the reason nowhere but a silent "".

`expressionCallsFunction` is self-contained here, since this branch has no
`expressionsMatch` to build it on.

Assisted-by: Claude Code:claude-opus-5
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Aug 6, 2026
@GiteaBot GiteaBot added this to the 1.27.2 milestone Aug 6, 2026
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Aug 6, 2026
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Aug 6, 2026
@silverwind
silverwind enabled auto-merge (squash) August 6, 2026 18:20
@silverwind silverwind added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Aug 6, 2026
@silverwind
silverwind merged commit 00a6372 into go-gitea:release/v1.27 Aug 6, 2026
23 checks passed
@silverwind
silverwind deleted the backport-38754-v1.27 branch August 6, 2026 23:28
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Aug 6, 2026
bigSmooth7867 pushed a commit to bigSmooth7867/swarm that referenced this pull request Aug 16, 2026
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [gitea/gitea](https://github.com/go-gitea/gitea) | patch | `1.27.1` → `1.27.2` |

---

### Release Notes

<details>
<summary>go-gitea/gitea (gitea/gitea)</summary>

### [`v1.27.2`](https://github.com/go-gitea/gitea/blob/HEAD/CHANGELOG.md#1272---2026-08-14)

[Compare Source](go-gitea/gitea@v1.27.1...v1.27.2)

- SECURITY
  - Fix: update collaborator access mode and httpsign ([#&#8203;38894](go-gitea/gitea#38894), [#&#8203;38862](go-gitea/gitea#38862)) ([#&#8203;38895](go-gitea/gitea#38895))
  - Refactor: external render ([#&#8203;38885](go-gitea/gitea#38885)) ([#&#8203;38898](go-gitea/gitea#38898))
  - Fix(actions): resolve pull\_request\_target reusable workflows at the base commit ([#&#8203;38886](go-gitea/gitea#38886)) ([#&#8203;38897](go-gitea/gitea#38897))
  - Refactor: markup render ([#&#8203;38864](go-gitea/gitea#38864)) ([#&#8203;38869](go-gitea/gitea#38869))
  - Fix(deps): update dependency mermaid to v11.16.1 ([#&#8203;38816](go-gitea/gitea#38816))
  - Fix(auth): set WebAuthn user verification per request ([#&#8203;38805](go-gitea/gitea#38805)) ([#&#8203;38810](go-gitea/gitea#38810))
  - Fix: render highlight language ([#&#8203;38793](go-gitea/gitea#38793)) ([#&#8203;38795](go-gitea/gitea#38795))

- ENHANCEMENTS
  - enhance: add missing npm package metadata properties ([#&#8203;38826](go-gitea/gitea#38826)) ([#&#8203;38831](go-gitea/gitea#38831))

- BUGFIXES
  - fix(actions): keep github.event.inputs as strings for workflow\_dispatch ([#&#8203;38899](go-gitea/gitea#38899)) ([#&#8203;38908](go-gitea/gitea#38908))
  - fix(actions): let a rerun of selected jobs read the previous attempt's artifacts ([#&#8203;38857](go-gitea/gitea#38857)) ([#&#8203;38901](go-gitea/gitea#38901))
  - fix(lfs): accept successful transfer responses ([#&#8203;38866](go-gitea/gitea#38866)) ([#&#8203;38875](go-gitea/gitea#38875))
  - fix(packages): ignore nested Package.swift ([#&#8203;38788](go-gitea/gitea#38788)) ([#&#8203;38836](go-gitea/gitea#38836))
  - fix: drop newline-bearing member names in arch ParsePackage ([#&#8203;38102](go-gitea/gitea#38102)) ([#&#8203;38830](go-gitea/gitea#38830))
  - fix(storage): fix Azure Blob dump failing with file does not exist ([#&#8203;38814](go-gitea/gitea#38814)) ([#&#8203;38828](go-gitea/gitea#38828))
  - fix(migration): migration deletion returned json redirection ([#&#8203;38796](go-gitea/gitea#38796)) ([#&#8203;38825](go-gitea/gitea#38825))
  - fix(ui): change underlines to default browser style ([#&#8203;38819](go-gitea/gitea#38819)) ([#&#8203;38823](go-gitea/gitea#38823))
  - fix(actions): allow cancelling runs without running jobs ([#&#8203;35842](go-gitea/gitea#35842)) ([#&#8203;38812](go-gitea/gitea#38812))
  - fix(actions): evaluate each `${{ }}` part on its own ([#&#8203;38754](go-gitea/gitea#38754)) ([#&#8203;38797](go-gitea/gitea#38797))
  - fix(actions): write an action task report in one transaction ([#&#8203;38792](go-gitea/gitea#38792)) ([#&#8203;38794](go-gitea/gitea#38794))
  - fix: markup link ([#&#8203;38764](go-gitea/gitea#38764)) ([#&#8203;38765](go-gitea/gitea#38765))
  - fix: set a minio part size when the content size is unknown ([#&#8203;38753](go-gitea/gitea#38753)) ([#&#8203;38755](go-gitea/gitea#38755))
  - fix: bad path escape in subpath archive download ([#&#8203;38749](go-gitea/gitea#38749)) ([#&#8203;38750](go-gitea/gitea#38750))
  - fix: remove the pull merge box from UI when the refreshed page doesn't contain it ([#&#8203;38742](go-gitea/gitea#38742)) ([#&#8203;38744](go-gitea/gitea#38744))
  - fix(markdown): fix double strikethough on code ([#&#8203;38707](go-gitea/gitea#38707)) ([#&#8203;38729](go-gitea/gitea#38729))
  - fix(lfs): failed upload deletes a concurrent upload's meta object ([#&#8203;38693](go-gitea/gitea#38693)) ([#&#8203;38722](go-gitea/gitea#38722))
  - fix: correct full url when using sub-path ([#&#8203;38712](go-gitea/gitea#38712)) ([#&#8203;38716](go-gitea/gitea#38716))
  - fix: avoid markup render panic ([#&#8203;38698](go-gitea/gitea#38698)) ([#&#8203;38703](go-gitea/gitea#38703))
  - fix(ui): too many participants shown in commit avatar stacks ([#&#8203;38689](go-gitea/gitea#38689)) ([#&#8203;38700](go-gitea/gitea#38700))
  - fix: support HEAD requests on Alpine registry APKINDEX.tar.gz ([#&#8203;38686](go-gitea/gitea#38686)) ([#&#8203;38688](go-gitea/gitea#38688))
  - fix(migrations): use all configured GitHub tokens ([#&#8203;38841](go-gitea/gitea#38841)) ([#&#8203;38846](go-gitea/gitea#38846))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yNi4yIiwidXBkYXRlZEluVmVyIjoiNDQuMTQuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicGF0Y2giLCJyZW5vdmF0ZSJdfQ==-->

Reviewed-on: https://gitea.vcasaserver.com/omar/swarm/pulls/710
Co-authored-by: Renovate Bot <renovate-bot@vcasaserver.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants