jojo/services/actions
forgejo-backport-action 3f65795f4d [v15.0/forgejo] fix: prevent jobs with unknown needs from running (#12077)
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/12046

If Forgejo encounters an Actions workflow with unknown jobs in a needs definition, Forgejo will ignore those and run the job anyway. That is bad. For example, releases could be published without any testing because the name of the testing job was misspelt.

Workflow that demonstrates the problem:

```yaml
on:
  push:
  workflow_dispatch:
jobs:
  build:
    runs-on: debian
    steps:
      - run: |
          echo "OK"
  test:
    runs-on: debian
    needs: [does-not-exist]
    steps:
      - run: |
          echo "OK"
```

Now, before a workflow is run, Forgejo will check whether all jobs referenced in `needs` exist. If any of them does not, it raises a pre-execution error which fails the workflow immediately. It also displays an appropriate error to the user, for example:

```
Workflow was not executed due to an error that blocked the execution attempt.
Job with ID test references unknown jobs in `needs`: does-not-exist.
```

Futhermore, workflows with pre-execution errors can no longer be rerun, which was previously possible.

Original issue: https://code.forgejo.org/forgejo/runner/issues/977.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Tests for JavaScript changes

(can be removed for Go changes)

- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Co-authored-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12077
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
2026-04-10 18:22:49 +02:00
..
Test_checkJobsOfRun fix: newly expanded dynamic matrix jobs can become stuck in a 'blocked' state (#11184) 2026-02-07 14:36:49 +01:00
Test_tryHandleIncompleteMatrix fix: empty dynamic matrix can leave action run hanging incomplete (#11063) 2026-01-27 17:10:59 +01:00
Test_tryHandleWorkflowCallOuterJob [v15.0/forgejo] fix: superfluous increment of ActionTask attempt breaks job view (#11964) 2026-04-03 18:29:31 +02:00
TestActions_CancelOrApproveRun refactor: migrate from lib/pq to jackc/pgx (#10219) 2025-11-30 17:47:45 +01:00
TestActions_consistencyCheckRun [v15.0/forgejo] fix: prevent jobs with unknown needs from running (#12077) 2026-04-10 18:22:49 +02:00
TestActionsNotifier_IsTrusted chore(refactor): replace ifNeedApproval with trust management 2025-11-06 11:07:39 +01:00
TestActionsTrust_GetPullRequestUserIsTrustedWithActions feat: trust management for runs created from a forked pull request 2025-11-06 11:07:38 +01:00
TestCancelAbandonedJobs fix: don't abandon Action jobs waiting for approval (#11145) 2026-02-04 16:00:18 +01:00
TestCancelPreviousJobs refactor: migrate from lib/pq to jackc/pgx (#10219) 2025-11-30 17:47:45 +01:00
TestCancelPreviousWithConcurrencyGroup refactor: migrate from lib/pq to jackc/pgx (#10219) 2025-11-30 17:47:45 +01:00
TestCreateCommitStatus fix: don't duplicate commit status records on workflows with empty name (#10678) 2026-01-02 19:02:10 +01:00
TestExpandLocalReusableWorkflows feat: expand reusable workflow calls into their inner jobs (#10525) 2025-12-24 20:47:21 +01:00
TestGetSecretsOfJob feat: support jobs.<job_id>.secrets with reusable workflow expansion (#10627) 2025-12-30 17:33:21 +01:00
TestServiceActions_startTask [v15.0/forgejo] feat: support timezone in scheduled workflows (#11986) 2026-04-04 19:16:35 +02:00
TestServicesActions_TransferLingeringLogs refactor: migrate from lib/pq to jackc/pgx (#10219) 2025-11-30 17:47:45 +01:00
auth.go feat: add OIDC workload identity federation support (#10481) 2026-01-15 03:39:00 +01:00
auth_test.go feat: add OIDC workload identity federation support (#10481) 2026-01-15 03:39:00 +01:00
cleanup.go feat: implement ephemeral runners (#9962) 2026-02-16 18:56:56 +01:00
cleanup_test.go feat: implement ephemeral runners (#9962) 2026-02-16 18:56:56 +01:00
clear_tasks.go Revert "fix: ensure actions logs are transferred when a task is done (#10008)" (#11462) 2026-03-02 15:34:09 +01:00
clear_tasks_test.go fix: don't abandon Action jobs waiting for approval (#11145) 2026-02-04 16:00:18 +01:00
commit_status.go fix: retain Forgejo Action's commit_status entries with distinct descriptions (#10696) 2026-01-05 14:47:27 +01:00
commit_status_test.go fix: retain Forgejo Action's commit_status entries with distinct descriptions (#10696) 2026-01-05 14:47:27 +01:00
context.go feat: add Forgejo server version to runner context (#10642) 2025-12-30 22:39:34 +01:00
context_test.go feat: support workflow inputs on expanded reusable workflows (#10614) 2025-12-29 15:37:44 +01:00
init.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
interface.go feat: add HTTP API endpoint for runner registration (#10677) 2026-01-05 04:59:04 +01:00
job_emitter.go [v15.0/forgejo] fix: prevent jobs with unknown needs from running (#12077) 2026-04-10 18:22:49 +02:00
job_emitter_test.go [v15.0/forgejo] fix: prevent jobs with unknown needs from running (#12077) 2026-04-10 18:22:49 +02:00
log.go fix: garbage collect lingering actions logs (#10009) 2025-11-18 18:59:01 +01:00
log_test.go chore: fix typos throughout the codebase (#10753) 2026-01-26 22:57:33 +01:00
main_test.go chore: move all test blank imports in a single package (#10662) 2026-01-02 05:32:32 +01:00
notifier.go fix: cancel runs pending approval when a PR is closed (#11134) 2026-02-02 23:20:41 +01:00
notifier_helper.go [v15.0/forgejo] feat: support timezone in scheduled workflows (#11986) 2026-04-04 19:16:35 +02:00
notifier_helper_test.go feat: expand reusable workflow calls into their inner jobs (#10525) 2025-12-24 20:47:21 +01:00
rerun.go [v15.0/forgejo]: chore: add modernizer linter (#11949) 2026-04-02 16:54:46 +02:00
rerun_test.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
reusable_workflows.go feat: expand reusable workflow calls into their inner jobs (#10525) 2025-12-24 20:47:21 +01:00
reusable_workflows_test.go feat: expand reusable workflow calls into their inner jobs (#10525) 2025-12-24 20:47:21 +01:00
run.go [v15.0/forgejo] fix: prevent jobs with unknown needs from running (#12077) 2026-04-10 18:22:49 +02:00
run_test.go [v15.0/forgejo] fix: prevent jobs with unknown needs from running (#12077) 2026-04-10 18:22:49 +02:00
schedule_tasks.go fix: make concurrency group job cancellation effect runs that are failed (#10863) 2026-01-16 10:54:01 +01:00
schedule_tasks_test.go [v15.0/forgejo] feat: support timezone in scheduled workflows (#11986) 2026-04-04 19:16:35 +02:00
secret.go feat: support jobs.<job_id>.secrets with reusable workflow expansion (#10627) 2025-12-30 17:33:21 +01:00
secret_test.go feat: support jobs.<job_id>.secrets with reusable workflow expansion (#10627) 2025-12-30 17:33:21 +01:00
task.go feat: allow runners to request a particular job (#11676) 2026-03-25 17:27:05 +01:00
task_test.go feat: add OIDC workload identity federation support (#10481) 2026-01-15 03:39:00 +01:00
trust.go fix: cancel runs pending approval when a PR is closed (#11134) 2026-02-02 23:20:41 +01:00
trust_test.go fix: cancel runs pending approval when a PR is closed (#11134) 2026-02-02 23:20:41 +01:00
variables.go feat: allow renaming and replacing secrets (#11732) 2026-03-23 03:30:02 +01:00
variables_test.go fix: allow Forgejo Actions environment variables starting with CI (#8850) 2025-08-10 22:56:16 +02:00
workflows.go feat: expand reusable workflow calls into their inner jobs (#10525) 2025-12-24 20:47:21 +01:00
workflows_test.go Update module code.forgejo.org/forgejo/runner/v11 to v12 (forgejo) (#10213) 2025-11-23 15:58:57 +01:00