Panic when parseing actions workflow

[lunny]

Description

2026/03/23 14:19:25 services/cron/tasks.go:104:(*Task).RunWithUser.1.1() [E] PANIC whilst running task: start_schedule_tasks Value: Unrecognized permission scope: security-events
/Users/xxx/data/Projects/gitea/gitea/modules/setting/setting.go:244 (0x1017610ff)
        PanicInDevOrTesting: panic(fmt.Sprintf(msg, a...))
/Users/xxx/data/Projects/gitea/gitea/services/actions/permission_parser.go:121 (0x10263e4a7)
        parseRawPermissionsExplicit: setting.PanicInDevOrTesting("Unrecognized permission scope: %s", scope)
/Users/xxx/data/Projects/gitea/gitea/services/actions/permission_parser.go:23 (0x10263dd6b)
        ExtractJobPermissionsFromWorkflow: jobPerms := parseRawPermissionsExplicit(&job.RawPermissions)
/Users/xxx/data/Projects/gitea/gitea/services/actions/run.go:132 (0x102640427)
        PrepareRunAndInsert.InsertRun.func4: if perms := ExtractJobPermissionsFromWorkflow(v, job); perms != nil {
/Users/xxx/data/Projects/gitea/gitea/models/db/context.go:168 (0x1019bbf87)
        txWithNoCheck: if err := f(withContextEngine(parentCtx, sess)); err != nil {
/Users/xxx/data/Projects/gitea/gitea/models/db/context.go:149 (0x1019bbebb)
        WithTx: return txWithNoCheck(parentCtx, f)
/Users/xxx/data/Projects/gitea/gitea/services/actions/run.go:78 (0x10263fd7f)
        InsertRun: return db.WithTx(ctx, func(ctx context.Context) error {
/Users/xxx/data/Projects/gitea/gitea/services/actions/run.go:55 (0x10263fd80)
        PrepareRunAndInsert: if err = InsertRun(ctx, run, jobs, vars, inputsWithDefaults); err != nil {
/Users/xxx/data/Projects/gitea/gitea/services/actions/schedule_tasks.go:122 (0x102640f37)
        CreateScheduleTask: if err := PrepareRunAndInsert(ctx, cron.Content, run, nil); err != nil {
/Users/xxx/data/Projects/gitea/gitea/services/actions/schedule_tasks.go:70 (0x102640a83)
        startTasks: if err := CreateScheduleTask(ctx, row.Schedule); err != nil {
/Users/xxx/data/Projects/gitea/gitea/services/actions/schedule_tasks.go:22 (0x102e460e3)
        StartScheduleTasks: return startTasks(ctx)
/Users/xxx/data/Projects/gitea/gitea/services/cron/tasks_actions.go:64 (0x102e460e4)
        registerScheduleTasks.func1: return actions_service.StartScheduleTasks(ctx)
/Users/xxx/data/Projects/gitea/gitea/services/cron/tasks.go:122 (0x102e43007)
        (*Task).RunWithUser.func1: if err := t.fun(ctx, doer, config); err != nil {
/Users/xxx/data/Projects/gitea/gitea/modules/graceful/manager.go:88 (0x101818037)
        (*Manager).RunWithShutdownContext: run(ctx)
/Users/xxx/data/Projects/gitea/gitea/services/cron/tasks.go:99 (0x102e42ce3)
        (*Task).RunWithUser: graceful.GetManager().RunWithShutdownContext(func(baseCtx context.Context) {
/Users/xxx/data/Projects/gitea/gitea/services/cron/tasks.go:68 (0x102e46c27)
        (*Task).Run: t.RunWithUser(&user_model.User{
/Users/xxx/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.1.darwin-arm64/src/reflect/value.go:586 (0x100ff269b)
        Value.call: call(frametype, fn, stackArgs, uint32(frametype.Size()), uint32(abid.retOffset), uint32(frameSize), &regArgs)
/Users/xxx/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.1.darwin-arm64/src/reflect/value.go:369 (0x100ff1a13)
        Value.Call: return v.call("Call", in)
/Users/xxx/go/pkg/mod/github.com/go-co-op/gocron@v1.37.0/gocron.go:122 (0x102e2e657)
        callJobFuncWithParams: vals := f.Call(in)
/Users/xxx/go/pkg/mod/github.com/go-co-op/gocron@v1.37.0/executor.go:87 (0x102e2c97f)
        runJob: err := callJobFuncWithParams(f.function, f.parameters)
/Users/xxx/go/pkg/mod/github.com/go-co-op/gocron@v1.37.0/executor.go:213 (0x102e2d5af)
        (*executor).runJob: runJob(f)
/Users/xxx/go/pkg/mod/github.com/go-co-op/gocron@v1.37.0/executor.go:269 (0x102e2dfeb)
        (*executor).run.func1: e.runJob(f)
/Users/xxx/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.1.darwin-arm64/src/runtime/asm_arm64.s:1447 (0x100f7e7a3)
        goexit: MOVD    R0, R0  // NOP

Gitea Version

main

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Local Dev

Database

None

[silverwind]

Sounds like a regression from #36173.

[wxiaoguang]

Sounds like a regression from #36173.

No. Please read the code and understand the code

[bircni]

Anymore Information? An example Workflow or does it happen with every Workflow

[wxiaoguang]

Anymore Information? An example Workflow or does it happen with every Workflow

But the code is pretty clear: Unrecognized permission scope: security-events

We found that some unsupported permission scopes.

• If the scope is valid, add them to the list and leave a TODO comment.
• If the scope is not valid, it won't affect end users. Developers can fix their own development data.

[bircni]

Whats the wanted behaviour?
Sorry but a better bug description than just pasting a log would be great

[wxiaoguang]

Whats the wanted behaviour? Sorry but a better bug description than just pasting a log would be great

[TheFox0x7]

Scope is valid in the syntax: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
Full list of ones github supports:

permissions:
  actions: read|write|none
  artifact-metadata: read|write|none
  attestations: read|write|none
  checks: read|write|none
  contents: read|write|none
  deployments: read|write|none
  id-token: write|none
  issues: read|write|none
  models: read|none
  discussions: read|write|none
  packages: read|write|none
  pages: read|write|none
  pull-requests: read|write|none
  security-events: read|write|none
  statuses: read|write|none

[TheFox0x7]

Looking at this it's not a bug IMO. It's in dev/testing mode which isn't expected for a normal instance and the scope isn't supported by gitea (nor it can at the moment).
The only fix I see applicable here is just erroring on bad scope (or having it just ignore it silently). Panic seems like much for this, even log is IMO of questionable use - the admin doesn't really need to know you mistyped a scope name, the author of the workflow does.

Unless we want that switchcase to handle all github permissions even if they are a noop for us (though the issue of someone making a bad permissions list and spamming logs won't be fixed with that).

[wxiaoguang]

Yes, it is exactly for "defensive programming" for unknown cases. Catch the errors as early as possible, leave TODO and comments for the cases we know.

#36967 (comment)

If the scope is valid, add them to the list and leave a TODO comment.