fix: prevent premature token revocation in reusable workflows #1081

Merged

mfenniak merged 4 commits from :fix/reusable-workflow-finalization-and-token-revocation into main 2025-10-14 01:45:54 +00:00

Conversation 12 Commits 4 Files changed 4 +374 -17

Ghost commented 2025-10-10 19:12:23 +00:00

• Copy link
• Copy Markdown

Problem

When using reusable workflows, the Forgejo runner prematurely revokes GITHUB_TOKEN after the first step completes, causing subsequent steps to fail with authentication errors.

Reproduction

When the reusable workflow contains multiple steps that require authentication:

1. First step (e.g., checkout) completes successfully
2. Reporter receives completion banner from child workflow
3. Token is revoked prematurely
4. Second step fails with authentication error

• bug fixes
  • PR: fix: prevent premature token revocation in reusable workflows

## Problem When using reusable workflows, the Forgejo runner prematurely revokes `GITHUB_TOKEN` after the first step completes, causing subsequent steps to fail with authentication errors. ### Reproduction When the reusable workflow contains multiple steps that require authentication: 1. First step (e.g., checkout) completes successfully 2. Reporter receives completion banner from child workflow 3. Token is revoked prematurely 4. Second step fails with authentication error <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1081): <!--number 1081 --><!--line 0 --><!--description Zml4OiBwcmV2ZW50IHByZW1hdHVyZSB0b2tlbiByZXZvY2F0aW9uIGluIHJldXNhYmxlIHdvcmtmbG93cw==-->fix: prevent premature token revocation in reusable workflows<!--description--> <!--end release-notes-assistant-->

Ghost added 1 commit 2025-10-10 19:12:23 +00:00

fix: prevent premature token revocation in reusable workflows d013126979

Ghost added 1 commit 2025-10-11 08:53:23 +00:00

test: add test for skipping banner in child reusable workflows 2f0a1725d0

earl-warren added the

Kind/Bug

label 2025-10-11 09:25:02 +00:00

earl-warren commented 2025-10-11 09:26:17 +00:00

Contributor

• Copy link
• Copy Markdown

https://code.forgejo.org/forgejo/runner/actions/runs/11197/jobs/2/attempt/1#jobstep-5-1035 the CI failure is related.

https://code.forgejo.org/forgejo/runner/actions/runs/11197/jobs/2/attempt/1#jobstep-5-1035 the CI failure is related.

Ghost added 1 commit 2025-10-11 09:32:08 +00:00

test: fix job executor test flakiness in CI environment 4da9ddfeca

Ghost commented 2025-10-11 09:52:52 +00:00

• Copy link
• Copy Markdown

@earl-warren wrote in #1081 (comment):

https://code.forgejo.org/forgejo/runner/actions/runs/11197/jobs/2/attempt/1#jobstep-5-1035 the CI failure is related.

Fixed, should work now

@earl-warren wrote in https://code.forgejo.org/forgejo/runner/pulls/1081#issuecomment-63115: > https://code.forgejo.org/forgejo/runner/actions/runs/11197/jobs/2/attempt/1#jobstep-5-1035 the CI failure is related. Fixed, should work now

mfenniak commented 2025-10-12 00:25:09 +00:00

Owner

• Copy link
• Copy Markdown

@syncstack The change here looks to make sense to me, but it is still failing another integration test TestRunner_RunEvent/uses-composite-check-for-input-in-if-uses.

@syncstack The change here looks to make sense to me, but it is still failing another integration test `TestRunner_RunEvent/uses-composite-check-for-input-in-if-uses`.

Ghost added 1 commit 2025-10-12 06:17:27 +00:00

ci: trigger workflow 1099b63edf

Ghost commented 2025-10-12 06:23:35 +00:00

• Copy link
• Copy Markdown

@mfenniak I deployed the exact uses-composite-check-for-input-in-if-uses workflow to my repository running the patched runner, and all steps pass successfully.

I've retriggered the CI workflow to see if it's a transient failure.

@mfenniak I deployed the exact `uses-composite-check-for-input-in-if-uses` workflow to my repository running the patched runner, and all steps pass successfully. I've retriggered the CI workflow to see if it's a transient failure.

earl-warren commented 2025-10-12 07:02:39 +00:00

Contributor

• Copy link
• Copy Markdown

This is very well done, impressive.

This is very well done, impressive.

Ghost commented 2025-10-12 07:48:40 +00:00

• Copy link
• Copy Markdown

Thank you! It was a tricky one to debug, glad the solution works well.

Thank you! It was a tricky one to debug, glad the solution works well.

earl-warren commented 2025-10-12 09:59:31 +00:00

Contributor

• Copy link
• Copy Markdown

Could you please create an associated bug report that includes a reproducer to run this against? It could be used to add a end-to-end test at https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions

This is a tricky part of the runner codebase: currently implemented more as a hack than a feature, which makes it hard to work with. Writing tests in such a context is very difficult kudos.

Could you please create an associated bug report that includes a reproducer to run this against? It could be used to add a end-to-end test at https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions This is a tricky part of the runner codebase: currently implemented more as a hack than a feature, which makes it hard to work with. Writing tests in such a context is very difficult kudos.

earl-warren added the

run-end-to-end-tests

label 2025-10-12 10:02:24 +00:00

cascading-pr referenced this pull request from actions/setup-forgejo 2025-10-12 10:02:41 +00:00

cascading-pr from https://code.forgejo.org/forgejo/runner refs/pull/1081/head to forgejo/runner-1081 #721

cascading-pr commented 2025-10-12 10:02:43 +00:00

Contributor

• Copy link
• Copy Markdown

cascading-pr updated at actions/setup-forgejo#721

cascading-pr updated at https://code.forgejo.org/actions/setup-forgejo/pulls/721

earl-warren commented 2025-10-12 12:00:04 +00:00

Contributor

• Copy link
• Copy Markdown

If this a reproducer matching this bug fix, there is no need to create another issue.

v13.next.forgejo.org/2franix/Test@01d365eb9f/.forgejo/workflows/reusable_first_failing.yaml

If [this a reproducer matching this bug fix](https://codeberg.org/forgejo/forgejo/issues/6657#issuecomment-7688446), there is no need to create another issue. https://v13.next.forgejo.org/2franix/Test/src/commit/01d365eb9f62f6a51720a19f6dddd75da5dcb1cb/.forgejo/workflows/reusable_first_failing.yaml

Ghost commented 2025-10-12 12:24:35 +00:00

• Copy link
• Copy Markdown

@earl-warren Yes, this is the same bug. Initially I thought it was only a token issue, but this PR actually fixes a chain of related problems:

The core issue:

• Workflows completed with "success" status while still writing logs in background
• Any step during that background phase could fail silently
• You'd only discover errors by manually checking logs

Manifestation:

• Fast-running jobs appeared to work fine
• Adding needs guaranteed token authorization errors
• actions/checkout could be worked around with explicit token
• Artifacts were completely broken (no workaround)

It worked sometimes depending on job execution speed, making it look intermittent when it was actually systematic.

This PR should close all these behaviors.

@earl-warren Yes, this is the same bug. Initially I thought it was only a token issue, but this PR actually fixes a chain of related problems: The core issue: - Workflows completed with "success" status while still writing logs in background - Any step during that background phase could fail silently - You'd only discover errors by manually checking logs Manifestation: - Fast-running jobs appeared to work fine - Adding needs guaranteed token authorization errors - actions/checkout could be worked around with explicit token - Artifacts were completely broken (no workaround) It worked sometimes depending on job execution speed, making it look intermittent when it was actually systematic. This PR should close all these behaviors.

Ghost commented 2025-10-12 12:34:14 +00:00

• Copy link
• Copy Markdown

P.S. I'm actively testing this while migrating from GitLab pipelines to Forgejo with full decomposition. Currently running complex real-world scenarios:

• Reusable workflows with workflow_call + needs chains
• Composite actions that handle artifacts across jobs
• Release pipelines: unit-tests → build → publish release → deploy
• Multi-step artifact passing (upload-artifact → download-artifact between jobs)
• Container matrix builds with S3 deployments

Example structure:

# Caller workflow
jobs:
  release:
    uses: org/ci-templates/.forgejo/workflows/release-frontend.yml@v1
    
# Reusable template with artifact chains
jobs:
  build: ...
  test:
    needs: [build]
  release:
    needs: [test]
    steps:
      - uses: org/ci-templates/actions/release/publish@v1  # composite action
  deploy:
    needs: [release]
    steps:
      - uses: actions/download-artifact@v4  # artifact from previous job
      - uses: org/ci-templates/actions/s3/deploy@v1

**P.S.** I'm actively testing this while migrating from GitLab pipelines to Forgejo with full decomposition. Currently running complex real-world scenarios: - Reusable workflows with `workflow_call` + `needs` chains - Composite actions that handle artifacts across jobs - Release pipelines: unit-tests → build → publish release → deploy - Multi-step artifact passing (`upload-artifact` → `download-artifact` between jobs) - Container matrix builds with S3 deployments Example structure: ```yaml # Caller workflow jobs: release: uses: org/ci-templates/.forgejo/workflows/release-frontend.yml@v1 # Reusable template with artifact chains jobs: build: ... test: needs: [build] release: needs: [test] steps: - uses: org/ci-templates/actions/release/publish@v1 # composite action deploy: needs: [release] steps: - uses: actions/download-artifact@v4 # artifact from previous job - uses: org/ci-templates/actions/s3/deploy@v1 ```

mfenniak approved these changes 2025-10-14 01:45:16 +00:00

mfenniak merged commit f48e9b3ba6 into main 2025-10-14 01:45:54 +00:00

mfenniak referenced this pull request from a commit 2025-10-14 01:45:56 +00:00

fix: prevent premature token revocation in reusable workflows (#1081)

viceice-bot referenced this pull request 2025-10-20 00:04:37 +00:00

Update forgejo-runner to v11.2.0 #1097

viceice-bot referenced this pull request from actions/setup-forgejo 2025-10-20 00:05:49 +00:00

Update dependency forgejo/runner to v11.2.0 #727

forgejo-mirror referenced this pull request from a commit 2025-10-20 02:01:34 +00:00

Update module code.forgejo.org/forgejo/runner/v11 to v11.2.0 (forgejo) (#9759)

vadiml1024 referenced this pull request from a commit 2025-10-25 14:35:55 +00:00

fix: prevent premature token revocation in reusable workflows (#1081)

viceice-bot referenced this pull request from actions/setup-forgejo 2025-11-05 00:02:42 +00:00

Update dependency forgejo/runner to v11.3.0 #736

viceice-bot referenced this pull request 2025-11-05 02:31:23 +00:00

Update forgejo-runner to v11.3.0 #1121

mfenniak referenced this pull request from a commit 2025-11-05 02:44:47 +00:00

Update forgejo-runner to v11.3.0 (#1121)

Ghost referenced this pull request 2026-02-10 19:28:56 +00:00

fix: premature task completion when chaining multiple reusable workflows #1367

Sign in to join this conversation.

Reviewers

No reviewers

mfenniak

Labels

Clear labels   

FreeBSD

  

Kind/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Chore

It is no fun but it needs to be done, this is a chore.

  

Kind/DependencyUpdate

for pull requests that are created by renovate when updating a dependency

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

  

Windows

Windows ports is an independent project, see https://github.com/Crown0815/Forgejo-runner-windows-builder

  

linux-powerpc64le

powerpc64le

  

linux-riscv64

  

linux-s390x

  

run-end-to-end-tests

Run https://code.forgejo.org/forgejo/end-to-end with a runner compiled from this pull request

  

run-forgejo-tests

Run https://codeberg.org/forgejo/forgejo tests importing the runner from this pull request

  

run-multi-platform-tests

Label a PR for automatic execution of test suite on arm64 architecture.

No labels

FreeBSD

Kind/Breaking

Kind/Bug

Kind/Chore

Kind/DependencyUpdate

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Windows

linux-powerpc64le

linux-riscv64

linux-s390x

run-end-to-end-tests

run-forgejo-tests

run-multi-platform-tests

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

4 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

forgejo/runner!1081

No description provided.