@@ -14,7 +14,6 @@ import (
1414 "code.gitea.io/gitea/modules/git"
1515 "code.gitea.io/gitea/modules/json"
1616 "code.gitea.io/gitea/modules/log"
17- secret_module "code.gitea.io/gitea/modules/secret"
1817 "code.gitea.io/gitea/modules/setting"
1918 "code.gitea.io/gitea/services/actions"
2019
@@ -31,14 +30,24 @@ func pickTask(ctx context.Context, runner *actions_model.ActionRunner) (*runnerv
3130 return nil , false , nil
3231 }
3332
33+ secrets , err := secret_model .GetSecretsOfTask (ctx , t )
34+ if err != nil {
35+ return nil , false , fmt .Errorf ("GetSecretsOfTask: %w" , err )
36+ }
37+
38+ vars , err := actions_model .GetVariablesOfRun (ctx , t .Job .Run )
39+ if err != nil {
40+ return nil , false , fmt .Errorf ("GetVariablesOfRun: %w" , err )
41+ }
42+
3443 actions .CreateCommitStatus (ctx , t .Job )
3544
3645 task := & runnerv1.Task {
3746 Id : t .ID ,
3847 WorkflowPayload : t .Job .WorkflowPayload ,
3948 Context : generateTaskContext (t ),
40- Secrets : getSecretsOfTask ( ctx , t ) ,
41- Vars : getVariablesOfTask ( ctx , t ) ,
49+ Secrets : secrets ,
50+ Vars : vars ,
4251 }
4352
4453 if needs , err := findTaskNeeds (ctx , t ); err != nil {
@@ -54,65 +63,6 @@ func pickTask(ctx context.Context, runner *actions_model.ActionRunner) (*runnerv
5463 return task , true , nil
5564}
5665
57- func getSecretsOfTask (ctx context.Context , task * actions_model.ActionTask ) map [string ]string {
58- secrets := map [string ]string {}
59-
60- secrets ["GITHUB_TOKEN" ] = task .Token
61- secrets ["GITEA_TOKEN" ] = task .Token
62-
63- if task .Job .Run .IsForkPullRequest && task .Job .Run .TriggerEvent != actions_module .GithubEventPullRequestTarget {
64- // ignore secrets for fork pull request, except GITHUB_TOKEN and GITEA_TOKEN which are automatically generated.
65- // for the tasks triggered by pull_request_target event, they could access the secrets because they will run in the context of the base branch
66- // see the documentation: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
67- return secrets
68- }
69-
70- ownerSecrets , err := secret_model .FindSecrets (ctx , secret_model.FindSecretsOptions {OwnerID : task .Job .Run .Repo .OwnerID })
71- if err != nil {
72- log .Error ("find secrets of owner %v: %v" , task .Job .Run .Repo .OwnerID , err )
73- // go on
74- }
75- repoSecrets , err := secret_model .FindSecrets (ctx , secret_model.FindSecretsOptions {RepoID : task .Job .Run .RepoID })
76- if err != nil {
77- log .Error ("find secrets of repo %v: %v" , task .Job .Run .RepoID , err )
78- // go on
79- }
80-
81- for _ , secret := range append (ownerSecrets , repoSecrets ... ) {
82- if v , err := secret_module .DecryptSecret (setting .SecretKey , secret .Data ); err != nil {
83- log .Error ("decrypt secret %v %q: %v" , secret .ID , secret .Name , err )
84- // go on
85- } else {
86- secrets [secret .Name ] = v
87- }
88- }
89-
90- return secrets
91- }
92-
93- func getVariablesOfTask (ctx context.Context , task * actions_model.ActionTask ) map [string ]string {
94- variables := map [string ]string {}
95-
96- // Org / User level
97- ownerVariables , err := actions_model .FindVariables (ctx , actions_model.FindVariablesOpts {OwnerID : task .Job .Run .Repo .OwnerID })
98- if err != nil {
99- log .Error ("find variables of org: %d, error: %v" , task .Job .Run .Repo .OwnerID , err )
100- }
101-
102- // Repo level
103- repoVariables , err := actions_model .FindVariables (ctx , actions_model.FindVariablesOpts {RepoID : task .Job .Run .RepoID })
104- if err != nil {
105- log .Error ("find variables of repo: %d, error: %v" , task .Job .Run .RepoID , err )
106- }
107-
108- // Level precedence: Repo > Org / User
109- for _ , v := range append (ownerVariables , repoVariables ... ) {
110- variables [v .Name ] = v .Data
111- }
112-
113- return variables
114- }
115-
11666func generateTaskContext (t * actions_model.ActionTask ) * structpb.Struct {
11767 event := map [string ]any {}
11868 _ = json .Unmarshal ([]byte (t .Job .Run .EventPayload ), & event )
0 commit comments