Skip to content

fix(actions): prevent panic when workflow contains null jobs#37570

Merged
silverwind merged 8 commits into
go-gitea:mainfrom
Exgene:fix/#37568-fix-null-jobs-panic
May 7, 2026
Merged

fix(actions): prevent panic when workflow contains null jobs#37570
silverwind merged 8 commits into
go-gitea:mainfrom
Exgene:fix/#37568-fix-null-jobs-panic

Conversation

@Exgene
Copy link
Copy Markdown
Contributor

@Exgene Exgene commented May 6, 2026

The issue

Closes #37568. Basically due to empty fields being present in the actions file, the jobs would be produced as nil inside jobparser.go . Because of this when we call Parse on the jobparser module.

Needs:   job.Needs(),

would propagate the nil job down the chain.

The fix

For now i decide to fix it by guarding with an if job == nil check.

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label May 6, 2026
@lunny
Copy link
Copy Markdown
Member

lunny commented May 6, 2026

Please add a test

@lunny lunny added type/bug backport/v1.26 This PR should be backported to Gitea 1.26 labels May 6, 2026
@Exgene
Copy link
Copy Markdown
Contributor Author

Exgene commented May 6, 2026

sure @lunny I think some new commits were made in the main branch, do i rebase it or merge?

@lunny
Copy link
Copy Markdown
Member

lunny commented May 6, 2026

sure @lunny I think some new commits were made in the main branch, do i rebase it or merge?

Merge the main branch into the branch

@wxiaoguang
Copy link
Copy Markdown
Contributor

The error seems unclear, it should report something like "needed job is not found"

@Exgene
Copy link
Copy Markdown
Contributor Author

Exgene commented May 6, 2026

yeah i agree, will udpate the error message as well

@Exgene
Copy link
Copy Markdown
Contributor Author

Exgene commented May 6, 2026

@lunny @wxiaoguang made the relevant changes

@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 6, 2026
Comment thread modules/actions/jobparser/jobparser.go Outdated
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 6, 2026
@lunny lunny added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 6, 2026
@Exgene
Copy link
Copy Markdown
Contributor Author

Exgene commented May 6, 2026

off topic: @wxiaoguang are there any issues i can work on, Id love to contribute more, maybe helping with developing a feature etc.

@wxiaoguang
Copy link
Copy Markdown
Contributor

off topic: @wxiaoguang are there any issues i can work on, Id love to contribute more, maybe helping with developing a feature etc.

I ever opened an issue "Some "good first issues" (likely easy to fix) for contributors #35015", but there were too many low-quality AI PRs (say, AI slop), so I closed it.

If you have understood the problems, feel free to open PRs to fix or improve. Thank you very much.

And you can also read through the whole code base or issue list, if anything seems wrong, feel free to propose correct changes.

@Exgene
Copy link
Copy Markdown
Contributor Author

Exgene commented May 6, 2026

off topic: @wxiaoguang are there any issues i can work on, Id love to contribute more, maybe helping with developing a feature etc.

I ever opened an issue "Some "good first issues" (likely easy to fix) for contributors #35015", but there were too many low-quality AI PRs (say, AI slop), so I closed it.

If you have understood the problems, feel free to open PRs to fix or improve. Thank you very much.

And you can also read through the whole code base or issue list, if anything seems wrong, feel free to propose correct changes.

agreed, lot of slop out there, i think ill take some time off to go through the codebase, I want to learn go (in detail) so open source seems like a nice way to contribute and learn at the same time.

@wxiaoguang
Copy link
Copy Markdown
Contributor

Yep, use AI to learn truths/knowledge and generate high-quality code, but be careful about AI hallucination and slop.

@wxiaoguang
Copy link
Copy Markdown
Contributor

wxiaoguang commented May 6, 2026

@Exgene

off topic: are there any issues i can work on, Id love to contribute more, maybe helping with developing a feature etc.

I did a quick look through, I think this one "Missing Source Repository URL in Migration Status (API vs UI) #36952" is a good first issue, maybe just need to add the missing field assignment in the API code.

@Exgene
Copy link
Copy Markdown
Contributor Author

Exgene commented May 6, 2026

@wxiaoguang thanks will take a look!

@silverwind silverwind enabled auto-merge (squash) May 7, 2026 01:23
@silverwind silverwind merged commit 6302584 into go-gitea:main May 7, 2026
23 checks passed
@GiteaBot GiteaBot added this to the 1.27.0 milestone May 7, 2026
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 7, 2026
@GiteaBot GiteaBot added the backport/done All backports for this PR have been created label May 7, 2026
silverwind pushed a commit that referenced this pull request May 7, 2026
…#37576)

Backport #37570 by @Exgene

## The issue

Closes #37568. Basically due to empty fields being present in the
actions file, the jobs would be produced as `nil` inside `jobparser.go`
. Because of this when we call `Parse` on the `jobparser` module.

```go
Needs:   job.Needs(),
```

would propagate the `nil` job down the chain. 

## The fix

For now i decide to fix it by guarding with an `if job == nil` check.

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Kausthubh J Rao <105716675+Exgene@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
silverwind added a commit to silverwind/gitea that referenced this pull request May 8, 2026
* origin/main: (41 commits)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  [skip ci] Updated translations via Crowdin
  refactor: use modernc sqlite driver as default (go-gitea#37562)
  refactor(templates): remove ctxData from tmpl files, use ctx.RootData instead (go-gitea#37567)
  ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (go-gitea#37565)
  fix(deps): update go dependencies (go-gitea#37541)
  refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (go-gitea#37557)
  ci: lint PR titles with commitlint (go-gitea#37498)
  Make ServeSetHeaders default to download attachment if filename exists (go-gitea#37552)
  fix(actions): validate workflow param to prevent 500 error (go-gitea#37546)
  Fix various problems (go-gitea#37547)
  docs: fix 4 typos in CHANGELOG.md (go-gitea#37549)
  ...

# Conflicts:
#	templates/repo/actions/runs_list.tmpl
#	templates/repo/issue/view_content/pull_merge_box.tmpl
#	templates/repo/pulls/status.tmpl
silverwind added a commit to silverwind/gitea that referenced this pull request May 8, 2026
* origin/main:
  chore(renovate): detect Makefile tools, enable `go` bumps (go-gitea#37595)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  [skip ci] Updated translations via Crowdin

# Conflicts:
#	services/pull/pull.go
zjjhot added a commit to zjjhot/gitea that referenced this pull request May 8, 2026
* main:
  chore(deps): bump tool deps and pin, update `golangci-lint` (go-gitea#37574)
  build: update pnpm to v11 (go-gitea#37591)
  chore(renovate): detect Makefile tools, enable `go` bumps (go-gitea#37595)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  [skip ci] Updated translations via Crowdin
  refactor: use modernc sqlite driver as default (go-gitea#37562)
  refactor(templates): remove ctxData from tmpl files, use ctx.RootData instead (go-gitea#37567)
  ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (go-gitea#37565)

# Conflicts:
#	models/user/user.go
silverwind added a commit to mohammad-rj/gitea that referenced this pull request May 8, 2026
* origin/main: (82 commits)
  build(deps): bump fast-uri from 3.1.0 to 3.1.2 (go-gitea#37616)
  fix: make clone URL respect public URL detection setting (go-gitea#37615)
  chore(deps): bump go-git/go-git/v5 to 5.19.0 (go-gitea#37608)
  chore(deps): update action dependencies (go-gitea#37603)
  fix(actions): fix blank lines after `::endgroup::` (go-gitea#37597)
  fix: treat email addresses case-insensitively (go-gitea#37600)
  fix(git): Fix smart http request scope bug (go-gitea#37583)
  chore(deps): update dependency go to v1.26.3 (go-gitea#37601)
  chore(deps): bump tool deps and pin, update `golangci-lint` (go-gitea#37574)
  build: update pnpm to v11 (go-gitea#37591)
  chore(renovate): detect Makefile tools, enable `go` bumps (go-gitea#37595)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  ...

# Conflicts:
#	tests/e2e/events.test.ts
#	tests/integration/eventsource_test.go
eleboucher pushed a commit to eleboucher/apoci that referenced this pull request May 20, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [code.gitea.io/gitea](https://github.com/go-gitea/gitea) | `v1.26.1` → `v1.26.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/code.gitea.io%2fgitea/v1.26.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.gitea.io%2fgitea/v1.26.1/v1.26.2?slim=true) |

---

### Release Notes

<details>
<summary>go-gitea/gitea (code.gitea.io/gitea)</summary>

### [`v1.26.2`](https://github.com/go-gitea/gitea/releases/tag/v1.26.2)

[Compare Source](go-gitea/gitea@v1.26.1...v1.26.2)

- SECURITY
  - fix(permissions): Fix reading permission ([#&#8203;37769](go-gitea/gitea#37769))
  - fix(actions): make artifact signature payloads unambiguous ([#&#8203;37707](go-gitea/gitea#37707))
  - fix: Unify public-only token filtering in API queries and repo access checks ([#&#8203;37118](go-gitea/gitea#37118))
  - fix: Add missed token scope checking ([#&#8203;37735](go-gitea/gitea#37735))
  - fix(oauth): bind token exchanges to the original client request ([#&#8203;37704](go-gitea/gitea#37704))
  - fix(oauth): strengthen PKCE validation and refresh token replay protection ([#&#8203;37706](go-gitea/gitea#37706))
  - fix(web): enforce token scopes on raw, media, and attachment downloads ([#&#8203;37698](go-gitea/gitea#37698))
  - fix(security): enforce wiki git writes and LFS token access at request time ([#&#8203;37695](go-gitea/gitea#37695))
  - feat(api): encrypt AWS creds ([#&#8203;37679](go-gitea/gitea#37679))
  - fix(deps): update dependency mermaid to v11.15.0 \[security], add e2e test
  - fix(packages): Add label for private and internal package and fix composor package source permission check ([#&#8203;37610](go-gitea/gitea#37610))
  - fix(git): Fix smart http request scope bug ([#&#8203;37583](go-gitea/gitea#37583))
  - Fix basic auth bug ([#&#8203;37503](go-gitea/gitea#37503))
  - Fix allow maintainer edit permission check ([#&#8203;37479](go-gitea/gitea#37479)) ([#&#8203;37484](go-gitea/gitea#37484))
  - Fix URL sanitization to handle schemeless credentials ([#&#8203;37440](go-gitea/gitea#37440)) ([#&#8203;37471](go-gitea/gitea#37471))
  - Fix attachment Content-Security-Policy ([#&#8203;37455](go-gitea/gitea#37455)) ([#&#8203;37464](go-gitea/gitea#37464))
  - chore(deps): bump go-git/go-git/v5 to 5.19.0 ([#&#8203;37608](go-gitea/gitea#37608))

- BUGFIXES
  - fix(pull): handle empty pull request files view to allow reviews ([#&#8203;37783](go-gitea/gitea#37783))
  - fix(markup): make RenderString never fail ([#&#8203;37779](go-gitea/gitea#37779))
  - fix: add natural sort to sortTreeViewNodes ([#&#8203;37772](go-gitea/gitea#37772))
  - fix: package creation unique conflict ([#&#8203;37774](go-gitea/gitea#37774))
  - fix!: add DEFAULT\_TITLE\_SOURCE setting for pull request title default behavior ([#&#8203;37465](go-gitea/gitea#37465))
  - fix: Allow direct commits for unprotected files with push restrictions ([#&#8203;37657](go-gitea/gitea#37657))
  - fix(actions): wrong assumption that run id always >= job id ([#&#8203;37737](go-gitea/gitea#37737))
  - fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register ([#&#8203;37564](go-gitea/gitea#37564)) ([#&#8203;37588](go-gitea/gitea#37588))
  - fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState ([#&#8203;37692](go-gitea/gitea#37692))
  - fix(repo): /generate must sync the branch table for the new repo ([#&#8203;37693](go-gitea/gitea#37693))
  - build: Fix snap build (1.26)
  - fix(actions): run TransferLogs on UpdateLog{Rows:\[], NoMore:true} ([#&#8203;37631](go-gitea/gitea#37631))
  - fix show correct mergebase
  - fix: make clone URL respect public URL detection setting ([#&#8203;37615](go-gitea/gitea#37615))
  - fix: "run as root" check ([#&#8203;37622](go-gitea/gitea#37622))
  - chore(deps): update dependency go to v1.26.3 ([#&#8203;37601](go-gitea/gitea#37601))
  - Compare dropdown fails when selecting branch with no common merge-base ([#&#8203;37470](go-gitea/gitea#37470))
  - fix: treat email addresses case-insensitively ([#&#8203;37600](go-gitea/gitea#37600))
  - fix(actions): fix blank lines after ::endgroup:: ([#&#8203;37597](go-gitea/gitea#37597))
  - fix(actions): report individual step status in workflow job API response ([#&#8203;37592](go-gitea/gitea#37592))
  - fix: Invalid UTF-8 commit messages in JSON API responses ([#&#8203;37542](go-gitea/gitea#37542))
  - fix: use consistent GetUser family functions ([#&#8203;37553](go-gitea/gitea#37553))
  - fix(api): return 409 message instead of empty JSON for wrong commit id ([#&#8203;37572](go-gitea/gitea#37572))
  - fix(actions): prevent panic when workflow contains null jobs ([#&#8203;37570](go-gitea/gitea#37570))
  - Make ServeSetHeaders default to download attachment if filename exists ([#&#8203;37552](go-gitea/gitea#37552)) ([#&#8203;37555](go-gitea/gitea#37555))
  - Fix(actions): validate workflow param to prevent 500 error ([#&#8203;37546](go-gitea/gitea#37546)) ([#&#8203;37554](go-gitea/gitea#37554))
  - Don't unblock run-level-concurrency-blocked runs in the resolver ([#&#8203;37461](go-gitea/gitea#37461)) ([#&#8203;37538](go-gitea/gitea#37538))
  - Fix(packages): use file names for generic web downloads ([#&#8203;37514](go-gitea/gitea#37514)) ([#&#8203;37520](go-gitea/gitea#37520))
  - Fix merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once ([#&#8203;37512](go-gitea/gitea#37512)) ([#&#8203;37516](go-gitea/gitea#37516))
  - Fix update branch protection order ([#&#8203;37508](go-gitea/gitea#37508)) ([#&#8203;37513](go-gitea/gitea#37513))
  - Fix mCaptcha broken after Vite migration ([#&#8203;37492](go-gitea/gitea#37492)) ([#&#8203;37509](go-gitea/gitea#37509))
  - Fix review submission from single-commit PR view ([#&#8203;37475](go-gitea/gitea#37475)) ([#&#8203;37485](go-gitea/gitea#37485))
  - Fix scheduled action panic with null event payload ([#&#8203;37459](go-gitea/gitea#37459)) ([#&#8203;37466](go-gitea/gitea#37466))
  - Make GetPossibleUserByID can handle deleted user ([#&#8203;37430](go-gitea/gitea#37430)) ([#&#8203;37431](go-gitea/gitea#37431))
  - Remove excessive quote from terraform instructions ([#&#8203;37424](go-gitea/gitea#37424)) ([#&#8203;37426](go-gitea/gitea#37426))
  - Fix color regressions, add `priority` color ([#&#8203;37417](go-gitea/gitea#37417)) ([#&#8203;37421](go-gitea/gitea#37421))

- MISC
  - Add CurrentURL template variable back ([#&#8203;37444](go-gitea/gitea#37444)) ([#&#8203;37449](go-gitea/gitea#37449))

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/apoci/pulls/47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport/done All backports for this PR have been created backport/v1.26 This PR should be backported to Gitea 1.26 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

500 Internal server error with miscofigured action file.

6 participants