Fix actions concurrency groups cross-branch leak

services/actions/context.go

@@ -22,6 +22,20 @@ import (
 
 type GiteaContext map[string]any
 
+// runIDForContext returns a stable identifier for the run suitable for use as
+// github.run_id in expression contexts. Prefer the persisted run.ID; fall back
+// to run.Index during pre-insert workflow-level concurrency evaluation, where
+// run.ID is still 0 but run.Index is already assigned.
+func runIDForContext(run *actions_model.ActionRun) string {
+	if run.ID > 0 {
+		return strconv.FormatInt(run.ID, 10)
+	}
+	if run.Index > 0 {
+		return strconv.FormatInt(run.Index, 10)
+	}
+	return ""
+}
+
 // GenerateGiteaContext generate the gitea context without token and gitea_runtime_token
 // job can be nil when generating a context for parsing workflow-level expressions
 func GenerateGiteaContext(run *actions_model.ActionRun, job *actions_model.ActionRunJob) GiteaContext {
@@ -73,7 +87,7 @@ func GenerateGiteaContext(run *actions_model.ActionRun, job *actions_model.Actio
 		"repository_owner":  run.Repo.OwnerName,                       // string, The repository owner's name. For example, Codertocat.
 		"repositoryUrl":     run.Repo.HTMLURL(),                       // string, The Git URL to the repository. For example, git://github.com/codertocat/hello-world.git.
 		"retention_days":    "",                                       // string, The number of days that workflow run logs and artifacts are kept.
-		"run_id":            "",                                       // string, A unique number for each workflow run within a repository. This number does not change if you re-run the workflow run.
+		"run_id":            runIDForContext(run),                     // string, A unique number for each workflow run within a repository. This number does not change if you re-run the workflow run.
 		"run_number":        strconv.FormatInt(run.Index, 10),         // string, A unique number for each run of a particular workflow in a repository. This number begins at 1 for the workflow's first run, and increments with each new run. This number does not change if you re-run the workflow run.
 		"run_attempt":       "",                                       // string, A unique number for each attempt of a particular workflow run in a repository. This number begins at 1 for the workflow run's first attempt, and increments with each re-run.
 		"secret_source":     "Actions",                                // string, The source of a secret used in a workflow. Possible values are None, Actions, Dependabot, or Codespaces.

services/actions/context_test.go

@@ -12,6 +12,16 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+func TestRunIDForContext(t *testing.T) {
+	// Regression: workflow-level concurrency is evaluated before the run is
+	// inserted (run.ID == 0), so github.run_id must fall back to run.Index —
+	// otherwise ${{ github.head_ref || github.run_id }} collapses to the same
+	// string across all push events, cancelling runs across unrelated branches.
+	assert.Equal(t, "42", runIDForContext(&actions_model.ActionRun{ID: 42, Index: 7}))
+	assert.Equal(t, "7", runIDForContext(&actions_model.ActionRun{ID: 0, Index: 7}))
+	assert.Empty(t, runIDForContext(&actions_model.ActionRun{ID: 0, Index: 0}))
+}
+
 func TestFindTaskNeeds(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 

services/actions/run.go

@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/modules/util"
 	notify_service "code.gitea.io/gitea/services/notify"
 
+	act_model "github.com/nektos/act/pkg/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -34,13 +35,6 @@ func PrepareRunAndInsert(ctx context.Context, content []byte, run *actions_model
 		return fmt.Errorf("ReadWorkflowRawConcurrency: %w", err)
 	}
 
-	if wfRawConcurrency != nil {
-		err = EvaluateRunConcurrencyFillModel(ctx, run, wfRawConcurrency, vars, inputsWithDefaults)
-		if err != nil {
-			return fmt.Errorf("EvaluateRunConcurrencyFillModel: %w", err)
-		}
-	}
-
 	giteaCtx := GenerateGiteaContext(run, nil)
 
 	jobs, err := jobparser.Parse(content, jobparser.WithVars(vars), jobparser.WithGitContext(giteaCtx.ToGitHubContext()), jobparser.WithInputs(inputsWithDefaults))
@@ -52,7 +46,7 @@ func PrepareRunAndInsert(ctx context.Context, content []byte, run *actions_model
 		run.Title = jobs[0].RunName
 	}
 
-	if err = InsertRun(ctx, run, jobs, vars, inputsWithDefaults); err != nil {
+	if err = InsertRun(ctx, run, jobs, vars, inputsWithDefaults, wfRawConcurrency); err != nil {
 		return fmt.Errorf("InsertRun: %w", err)
 	}
 
@@ -74,7 +68,7 @@ func PrepareRunAndInsert(ctx context.Context, content []byte, run *actions_model
 
 // InsertRun inserts a run
 // The title will be cut off at 255 characters if it's longer than 255 characters.
-func InsertRun(ctx context.Context, run *actions_model.ActionRun, jobs []*jobparser.SingleWorkflow, vars map[string]string, inputs map[string]any) error {
+func InsertRun(ctx context.Context, run *actions_model.ActionRun, jobs []*jobparser.SingleWorkflow, vars map[string]string, inputs map[string]any, wfRawConcurrency *act_model.RawConcurrency) error {
 	return db.WithTx(ctx, func(ctx context.Context) error {
 		index, err := db.GetNextResourceIndex(ctx, "action_run_index", run.RepoID)
 		if err != nil {
@@ -83,6 +77,16 @@ func InsertRun(ctx context.Context, run *actions_model.ActionRun, jobs []*jobpar
 		run.Index = index
 		run.Title = util.EllipsisDisplayString(run.Title, 255)
 
+		// Evaluate workflow-level concurrency now that run.Index is populated,
+		// so expressions referencing github.run_id resolve to a per-run unique
+		// value instead of an empty string (which would collapse all pushes to
+		// the same group across branches).
+		if wfRawConcurrency != nil {
+			if err := EvaluateRunConcurrencyFillModel(ctx, run, wfRawConcurrency, vars, inputs); err != nil {
+				return fmt.Errorf("EvaluateRunConcurrencyFillModel: %w", err)
+			}
+		}
+
 		// check run (workflow-level) concurrency
 		run.Status, err = PrepareToStartRunWithConcurrency(ctx, run)
 		if err != nil {