初始提交: Gitea 项目代码

models/actions/artifact.go

@@ -0,0 +1,255 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// This artifact server is inspired by the Gitea runner artifact server implementation.
+// It updates url setting and uses ObjectStore to handle artifacts persistence.
+
+package actions
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+
+	"xorm.io/builder"
+)
+
+// ArtifactStatus is the status of an artifact, uploading, expired or need-delete
+type ArtifactStatus int64
+
+const (
+	ArtifactStatusUploadPending   ArtifactStatus = iota + 1 // 1， ArtifactStatusUploadPending is the status of an artifact upload that is pending
+	ArtifactStatusUploadConfirmed                           // 2， ArtifactStatusUploadConfirmed is the status of an artifact upload that is confirmed
+	ArtifactStatusUploadError                               // 3， ArtifactStatusUploadError is the status of an artifact upload that is errored
+	ArtifactStatusExpired                                   // 4, ArtifactStatusExpired is the status of an artifact that is expired
+	ArtifactStatusPendingDeletion                           // 5, ArtifactStatusPendingDeletion is the status of an artifact that is pending deletion
+	ArtifactStatusDeleted                                   // 6, ArtifactStatusDeleted is the status of an artifact that is deleted
+)
+
+func (status ArtifactStatus) ToString() string {
+	switch status {
+	case ArtifactStatusUploadPending:
+		return "upload is not yet completed"
+	case ArtifactStatusUploadConfirmed:
+		return "upload is completed"
+	case ArtifactStatusUploadError:
+		return "upload failed"
+	case ArtifactStatusExpired:
+		return "expired"
+	case ArtifactStatusPendingDeletion:
+		return "pending deletion"
+	case ArtifactStatusDeleted:
+		return "deleted"
+	default:
+		return "unknown"
+	}
+}
+
+func init() {
+	db.RegisterModel(new(ActionArtifact))
+}
+
+const (
+	ContentEncodingV3Gzip = "gzip"
+	ContentTypeZip        = "application/zip"
+)
+
+// ActionArtifact is a file that is stored in the artifact storage.
+type ActionArtifact struct {
+	ID                 int64 `xorm:"pk autoincr"`
+	RunID              int64 `xorm:"index unique(runid_attempt_name_path)"` // The run id of the artifact
+	RunAttemptID       int64 `xorm:"index unique(runid_attempt_name_path) NOT NULL DEFAULT 0"`
+	RunnerID           int64
+	RepoID             int64 `xorm:"index"`
+	OwnerID            int64
+	CommitSHA          string
+	StoragePath        string // The path to the artifact in the storage
+	FileSize           int64  // The size of the artifact in bytes
+	FileCompressedSize int64  // The size of the artifact in bytes after gzip compression
+
+	// The content encoding or content type of the artifact
+	// * empty or null: legacy (v3) uncompressed content
+	// * magic string "gzip" (ContentEncodingV3Gzip): v3 gzip compressed content
+	//   * requires gzip decoding before storing in a zip for download
+	//   * requires gzip content-encoding header when downloaded single files within a workflow
+	// * mime type for "Content-Type":
+	//   * "application/zip" (ContentTypeZip), seems to be an abuse, fortunately there is no conflict, and it won't cause problems?
+	//   * "application/pdf", "text/html", etc.: real content type of the artifact
+	ContentEncodingOrType string `xorm:"content_encoding"`
+
+	ArtifactPath string             `xorm:"index unique(runid_attempt_name_path)"` // The path to the artifact when runner uploads it
+	ArtifactName string             `xorm:"index unique(runid_attempt_name_path)"` // The name of the artifact when runner uploads it
+	Status       ArtifactStatus     `xorm:"index"`                                 // The status of the artifact, uploading, expired or need-delete
+	CreatedUnix  timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix  timeutil.TimeStamp `xorm:"updated index"`
+	ExpiredUnix  timeutil.TimeStamp `xorm:"index"` // The time when the artifact will be expired
+}
+
+func CreateArtifact(ctx context.Context, t *ActionTask, artifactName, artifactPath string, expiredDays int64) (*ActionArtifact, error) {
+	if err := t.LoadJob(ctx); err != nil {
+		return nil, err
+	}
+	artifact, err := getArtifactByNameAndPath(ctx, t.Job.RunID, t.Job.RunAttemptID, artifactName, artifactPath)
+	if errors.Is(err, util.ErrNotExist) {
+		artifact := &ActionArtifact{
+			ArtifactName: artifactName,
+			ArtifactPath: artifactPath,
+			RunID:        t.Job.RunID,
+			RunAttemptID: t.Job.RunAttemptID,
+			RunnerID:     t.RunnerID,
+			RepoID:       t.RepoID,
+			OwnerID:      t.OwnerID,
+			CommitSHA:    t.CommitSHA,
+			Status:       ArtifactStatusUploadPending,
+			ExpiredUnix:  timeutil.TimeStamp(time.Now().Unix() + timeutil.Day*expiredDays),
+		}
+		if _, err := db.GetEngine(ctx).Insert(artifact); err != nil {
+			return nil, err
+		}
+		return artifact, nil
+	} else if err != nil {
+		return nil, err
+	}
+
+	if _, err := db.GetEngine(ctx).ID(artifact.ID).Cols("expired_unix").Update(&ActionArtifact{
+		ExpiredUnix: timeutil.TimeStamp(time.Now().Unix() + timeutil.Day*expiredDays),
+	}); err != nil {
+		return nil, err
+	}
+
+	return artifact, nil
+}
+
+func getArtifactByNameAndPath(ctx context.Context, runID, runAttemptID int64, name, fpath string) (*ActionArtifact, error) {
+	var art ActionArtifact
+	has, err := db.GetEngine(ctx).Where("run_id = ? AND run_attempt_id = ? AND artifact_name = ? AND artifact_path = ?", runID, runAttemptID, name, fpath).Get(&art)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, util.ErrNotExist
+	}
+	return &art, nil
+}
+
+// UpdateArtifactByID updates an artifact by id
+func UpdateArtifactByID(ctx context.Context, id int64, art *ActionArtifact) error {
+	art.ID = id
+	_, err := db.GetEngine(ctx).ID(id).AllCols().Update(art)
+	return err
+}
+
+type FindArtifactsOptions struct {
+	db.ListOptions
+	RepoID               int64
+	RunID                int64
+	RunAttemptID         optional.Option[int64] // use optional to allow filtering by zero (legacy artifacts have run_attempt_id=0)
+	ArtifactName         string
+	Status               int
+	FinalizedArtifactsV4 bool
+}
+
+func (opts FindArtifactsOptions) ToOrders() string {
+	return "id"
+}
+
+var _ db.FindOptionsOrder = (*FindArtifactsOptions)(nil)
+
+func (opts FindArtifactsOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+	if opts.RunID > 0 {
+		cond = cond.And(builder.Eq{"run_id": opts.RunID})
+	}
+	if opts.RunAttemptID.Has() {
+		cond = cond.And(builder.Eq{"run_attempt_id": opts.RunAttemptID.Value()})
+	}
+	if opts.ArtifactName != "" {
+		cond = cond.And(builder.Eq{"artifact_name": opts.ArtifactName})
+	}
+	if opts.Status > 0 {
+		cond = cond.And(builder.Eq{"status": opts.Status})
+	}
+	if opts.FinalizedArtifactsV4 {
+		cond = cond.And(builder.Eq{"status": ArtifactStatusUploadConfirmed}.Or(builder.Eq{"status": ArtifactStatusExpired}))
+		// see the comment of ActionArtifact.ContentEncodingOrType: "*/*" means the field is a content type
+		cond = cond.And(builder.Like{"content_encoding", "%/%"})
+	}
+
+	return cond
+}
+
+// ActionArtifactMeta is the meta-data of an artifact
+type ActionArtifactMeta struct {
+	ArtifactName string
+	FileSize     int64
+	Status       ArtifactStatus
+	ExpiredUnix  timeutil.TimeStamp
+}
+
+// ListUploadedArtifactsMetaByRunAttempt returns uploaded artifacts meta scoped to a specific run and attempt.
+// Pass runAttemptID=0 to target legacy artifacts (pre-v331) belonging to the run.
+func ListUploadedArtifactsMetaByRunAttempt(ctx context.Context, repoID, runID, runAttemptID int64) ([]*ActionArtifactMeta, error) {
+	arts := make([]*ActionArtifactMeta, 0, 10)
+	return arts, db.GetEngine(ctx).Table("action_artifact").
+		Where("repo_id=? AND run_id=? AND run_attempt_id=? AND (status=? OR status=?)", repoID, runID, runAttemptID, ArtifactStatusUploadConfirmed, ArtifactStatusExpired).
+		GroupBy("artifact_name").
+		Select("artifact_name, sum(file_size) as file_size, max(status) as status, max(expired_unix) as expired_unix").
+		Find(&arts)
+}
+
+// ListNeedExpiredArtifacts returns all need expired artifacts but not deleted
+func ListNeedExpiredArtifacts(ctx context.Context) ([]*ActionArtifact, error) {
+	arts := make([]*ActionArtifact, 0, 10)
+	return arts, db.GetEngine(ctx).
+		Where("expired_unix < ? AND status = ?", timeutil.TimeStamp(time.Now().Unix()), ArtifactStatusUploadConfirmed).Find(&arts)
+}
+
+// ListPendingDeleteArtifacts returns all artifacts in pending-delete status.
+// limit is the max number of artifacts to return.
+func ListPendingDeleteArtifacts(ctx context.Context, limit int) ([]*ActionArtifact, error) {
+	arts := make([]*ActionArtifact, 0, limit)
+	return arts, db.GetEngine(ctx).
+		Where("status = ?", ArtifactStatusPendingDeletion).Limit(limit).Find(&arts)
+}
+
+// SetArtifactExpired sets an artifact to expired
+func SetArtifactExpired(ctx context.Context, artifactID int64) error {
+	_, err := db.GetEngine(ctx).Where("id=? AND status = ?", artifactID, ArtifactStatusUploadConfirmed).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusExpired})
+	return err
+}
+
+// SetArtifactNeedDeleteByID sets an artifact to need-delete by ID, cron job will delete it.
+func SetArtifactNeedDeleteByID(ctx context.Context, artifactID int64) error {
+	_, err := db.GetEngine(ctx).Where("id=? AND status = ?", artifactID, ArtifactStatusUploadConfirmed).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusPendingDeletion})
+	return err
+}
+
+// SetArtifactNeedDeleteByRunAttempt sets an artifact to need-delete in a run attempt, cron job will delete it.
+// runAttemptID may be 0 for legacy artifacts created before ActionRunAttempt existed.
+func SetArtifactNeedDeleteByRunAttempt(ctx context.Context, runID, runAttemptID int64, name string) error {
+	_, err := db.GetEngine(ctx).Where("run_id=? AND run_attempt_id=? AND artifact_name=? AND status = ?", runID, runAttemptID, name, ArtifactStatusUploadConfirmed).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusPendingDeletion})
+	return err
+}
+
+// GetArtifactsByRunAttemptAndName returns all artifacts with the given name in the specified run attempt.
+// This supports both attempt-scoped data and legacy artifacts with run_attempt_id=0.
+func GetArtifactsByRunAttemptAndName(ctx context.Context, runID, runAttemptID int64, artifactName string) ([]*ActionArtifact, error) {
+	arts := make([]*ActionArtifact, 0)
+	return arts, db.GetEngine(ctx).
+		Where("run_id = ? AND run_attempt_id = ? AND artifact_name = ?", runID, runAttemptID, artifactName).
+		OrderBy("id").
+		Find(&arts)
+}
+
+// SetArtifactDeleted sets an artifact to deleted
+func SetArtifactDeleted(ctx context.Context, artifactID int64) error {
+	_, err := db.GetEngine(ctx).ID(artifactID).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusDeleted})
+	return err
+}

models/actions/config.go

@@ -0,0 +1,74 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
+
+	"xorm.io/xorm/convert"
+)
+
+// OwnerActionsConfig defines the Actions configuration for a user or organization
+type OwnerActionsConfig struct {
+	// TokenPermissionMode defines the default permission mode (permissive, restricted)
+	TokenPermissionMode repo_model.ActionsTokenPermissionMode `json:"token_permission_mode,omitempty"`
+
+	// MaxTokenPermissions defines the absolute maximum permissions any token can have in this context.
+	MaxTokenPermissions *repo_model.ActionsTokenPermissions `json:"max_token_permissions,omitempty"`
+
+	// AllowedCrossRepoIDs is a list of specific repo IDs that can be accessed cross-repo
+	AllowedCrossRepoIDs []int64 `json:"allowed_cross_repo_ids,omitempty"`
+}
+
+var _ convert.ConversionFrom = (*OwnerActionsConfig)(nil)
+
+func (cfg *OwnerActionsConfig) FromDB(bytes []byte) error {
+	_ = json.Unmarshal(bytes, cfg)
+	cfg.TokenPermissionMode, _ = util.EnumValue(cfg.TokenPermissionMode)
+	return nil
+}
+
+// GetOwnerActionsConfig loads the OwnerActionsConfig for a user or organization from user settings
+// It returns a default config if no setting is found
+func GetOwnerActionsConfig(ctx context.Context, userID int64) (ret OwnerActionsConfig, err error) {
+	return user_model.GetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, ret)
+}
+
+// SetOwnerActionsConfig saves the OwnerActionsConfig for a user or organization to user settings
+func SetOwnerActionsConfig(ctx context.Context, userID int64, cfg OwnerActionsConfig) error {
+	return user_model.SetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, cfg)
+}
+
+// GetDefaultTokenPermissions returns the default token permissions by its TokenPermissionMode.
+func (cfg *OwnerActionsConfig) GetDefaultTokenPermissions() repo_model.ActionsTokenPermissions {
+	switch cfg.TokenPermissionMode {
+	case repo_model.ActionsTokenPermissionModeRestricted:
+		return repo_model.MakeRestrictedPermissions()
+	case repo_model.ActionsTokenPermissionModePermissive:
+		return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
+	default:
+		return repo_model.MakeActionsTokenPermissions(perm.AccessModeNone)
+	}
+}
+
+// GetMaxTokenPermissions returns the maximum allowed permissions
+func (cfg *OwnerActionsConfig) GetMaxTokenPermissions() repo_model.ActionsTokenPermissions {
+	if cfg.MaxTokenPermissions != nil {
+		return *cfg.MaxTokenPermissions
+	}
+	// Default max is write for everything
+	return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
+}
+
+// ClampPermissions ensures that the given permissions don't exceed the maximum
+func (cfg *OwnerActionsConfig) ClampPermissions(perms repo_model.ActionsTokenPermissions) repo_model.ActionsTokenPermissions {
+	maxPerms := cfg.GetMaxTokenPermissions()
+	return repo_model.ClampActionsTokenPermissions(perms, maxPerms)
+}

models/actions/main_test.go

@@ -0,0 +1,21 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"gitea.dev/models/unittest"
+)
+
+func TestMain(m *testing.M) {
+	unittest.MainTest(m, &unittest.TestOptions{
+		FixtureFiles: []string{
+			"action_runner_token.yml",
+			"action_run.yml",
+			"repository.yml",
+			"user.yml",
+		},
+	})
+}

models/actions/run.go

@@ -0,0 +1,384 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
+)
+
+// ActionRun represents a run of a workflow file
+type ActionRun struct {
+	ID                int64
+	Title             string
+	RepoID            int64                  `xorm:"unique(repo_index)"`
+	Repo              *repo_model.Repository `xorm:"-"`
+	OwnerID           int64                  `xorm:"index"`
+	WorkflowID        string                 `xorm:"index"`                    // the name of workflow file
+	Index             int64                  `xorm:"index unique(repo_index)"` // a unique number for each run of a repository
+	TriggerUserID     int64                  `xorm:"index"`
+	TriggerUser       *user_model.User       `xorm:"-"`
+	ScheduleID        int64
+	Ref               string `xorm:"index"` // the commit/tag/… that caused the run
+	IsRefDeleted      bool   `xorm:"-"`
+	CommitSHA         string
+	IsForkPullRequest bool                         // If this is triggered by a PR from a forked repository or an untrusted user, we need to check if it is approved and limit permissions when running the workflow.
+	NeedApproval      bool                         // may need approval if it's a fork pull request
+	ApprovedBy        int64                        `xorm:"index"` // who approved
+	Event             webhook_module.HookEventType // the webhook event that causes the workflow to run
+	EventPayload      string                       `xorm:"LONGTEXT"`
+	TriggerEvent      string                       // the trigger event defined in the `on` configuration of the triggered workflow
+	Status            Status                       `xorm:"index"`
+	Version           int                          `xorm:"version default 0"` // Status could be updated concomitantly, so an optimistic lock is needed
+	RawConcurrency    string                       // raw concurrency
+
+	// Started and Stopped are identical to the latest attempt after ActionRunAttempt was introduced.
+	// When a rerun creates a new latest attempt, they are reset until the new attempt starts and stops.
+	Started timeutil.TimeStamp
+	Stopped timeutil.TimeStamp
+
+	// PreviousDuration is kept only for legacy runs created before ActionRunAttempt existed.
+	// New runs and reruns no longer update this field and use attempt-scoped durations instead.
+	PreviousDuration time.Duration
+
+	LatestAttemptID int64 `xorm:"index NOT NULL DEFAULT 0"`
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(ActionRun))
+	db.RegisterModel(new(ActionRunIndex))
+}
+
+func (run *ActionRun) HTMLURL(ctxOpt ...context.Context) string {
+	if run.Repo == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.HTMLURL(ctxOpt...), run.ID)
+}
+
+func (run *ActionRun) Link() string {
+	if run.Repo == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.Link(), run.ID)
+}
+
+func (run *ActionRun) WorkflowLink() string {
+	if run.Repo == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s/actions/?workflow=%s", run.Repo.Link(), run.WorkflowID)
+}
+
+// RefLink return the url of run's ref
+func (run *ActionRun) RefLink() string {
+	refName := git.RefName(run.Ref)
+	if refName.IsPull() {
+		return run.Repo.Link() + "/pulls/" + refName.ShortName()
+	}
+	return run.Repo.Link() + "/src/" + refName.RefWebLinkPath()
+}
+
+// PrettyRef return #id for pull ref or ShortName for others
+func (run *ActionRun) PrettyRef() string {
+	refName := git.RefName(run.Ref)
+	if refName.IsPull() {
+		return "#" + strings.TrimSuffix(strings.TrimPrefix(run.Ref, git.PullPrefix), "/head")
+	}
+	return refName.ShortName()
+}
+
+// RefTooltip return a tooltop of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
+func (run *ActionRun) RefTooltip() string {
+	payload, err := run.GetPullRequestEventPayload()
+	if err == nil && payload != nil && payload.PullRequest != nil {
+		return payload.PullRequest.Title
+	}
+	return git.RefName(run.Ref).ShortName()
+}
+
+// LoadAttributes load Repo TriggerUser if not loaded
+func (run *ActionRun) LoadAttributes(ctx context.Context) error {
+	if err := run.LoadRepo(ctx); err != nil {
+		return err
+	}
+
+	if err := run.Repo.LoadAttributes(ctx); err != nil {
+		return err
+	}
+
+	return run.LoadTriggerUser(ctx)
+}
+
+func (run *ActionRun) LoadTriggerUser(ctx context.Context) (err error) {
+	if run.TriggerUser != nil {
+		return nil
+	}
+	run.TriggerUserID, run.TriggerUser, err = user_model.GetPossibleUserByID(ctx, run.TriggerUserID)
+	return err
+}
+
+func (run *ActionRun) LoadRepo(ctx context.Context) error {
+	if run.Repo != nil {
+		return nil
+	}
+
+	repo, err := repo_model.GetRepositoryByID(ctx, run.RepoID)
+	if err != nil {
+		return err
+	}
+	run.Repo = repo
+	return nil
+}
+
+func (run *ActionRun) Duration() time.Duration {
+	d := calculateDuration(run.Started, run.Stopped, run.Status, run.Updated) + run.PreviousDuration
+	if d < 0 {
+		return 0
+	}
+	return d
+}
+
+// GetLatestAttempt returns
+//   - the latest attempt of the run
+//   - (nil, false, nil) for legacy runs that have no attempt records
+func (run *ActionRun) GetLatestAttempt(ctx context.Context) (*ActionRunAttempt, bool, error) {
+	if run.LatestAttemptID == 0 {
+		return nil, false, nil
+	}
+	attempt, err := GetRunAttemptByRepoAndID(ctx, run.RepoID, run.LatestAttemptID)
+	if err != nil {
+		return nil, false, err
+	}
+	return attempt, true, nil
+}
+
+func (run *ActionRun) GetEffectiveConcurrency(ctx context.Context) (string, bool, error) {
+	attempt, has, err := run.GetLatestAttempt(ctx)
+	if err != nil {
+		return "", false, err
+	}
+	if has {
+		return attempt.ConcurrencyGroup, attempt.ConcurrencyCancel, nil
+	}
+	return "", false, nil
+}
+
+func (run *ActionRun) GetPushEventPayload() (*api.PushPayload, error) {
+	if run.Event == webhook_module.HookEventPush {
+		var payload api.PushPayload
+		if err := json.Unmarshal([]byte(run.EventPayload), &payload); err != nil {
+			return nil, err
+		}
+		return &payload, nil
+	}
+	return nil, fmt.Errorf("event %s is not a push event", run.Event)
+}
+
+func (run *ActionRun) GetPullRequestEventPayload() (*api.PullRequestPayload, error) {
+	if run.Event.IsPullRequest() || run.Event.IsPullRequestReview() {
+		var payload api.PullRequestPayload
+		if err := json.Unmarshal([]byte(run.EventPayload), &payload); err != nil {
+			return nil, err
+		}
+		return &payload, nil
+	}
+	return nil, fmt.Errorf("event %s is not a pull request event", run.Event)
+}
+
+func (run *ActionRun) GetWorkflowRunEventPayload() (*api.WorkflowRunPayload, error) {
+	if run.Event == webhook_module.HookEventWorkflowRun {
+		var payload api.WorkflowRunPayload
+		if err := json.Unmarshal([]byte(run.EventPayload), &payload); err != nil {
+			return nil, err
+		}
+		return &payload, nil
+	}
+	return nil, fmt.Errorf("event %s is not a workflow run event", run.Event)
+}
+
+func (run *ActionRun) IsSchedule() bool {
+	return run.ScheduleID > 0
+}
+
+// UpdateRepoRunsNumbers updates the number of runs and closed runs of a repository.
+// Callers MUST invoke this from outside any transaction that has X-locked action_run rows for the same repo, otherwise, transaction deadlock
+func UpdateRepoRunsNumbers(ctx context.Context, repoID int64) {
+	if db.InTransaction(ctx) {
+		setting.PanicInDevOrTesting("UpdateRepoRunsNumbers must not be called inside a transaction")
+	}
+
+	e := db.GetEngine(ctx)
+
+	numActionRuns, err := e.Where("repo_id = ?", repoID).Count(new(ActionRun))
+	if err != nil {
+		log.Error("UpdateRepoRunsNumbers count num_action_runs for repo %d: %v", repoID, err)
+		return
+	}
+
+	numClosedActionRuns, err := e.Where("repo_id = ?", repoID).
+		In("status", StatusSuccess, StatusFailure, StatusCancelled, StatusSkipped).
+		Count(new(ActionRun))
+	if err != nil {
+		log.Error("UpdateRepoRunsNumbers count num_closed_action_runs for repo %d: %v", repoID, err)
+		return
+	}
+
+	if _, err := e.ID(repoID).Cols("num_action_runs", "num_closed_action_runs").NoAutoTime().Update(&repo_model.Repository{
+		NumActionRuns:       int(numActionRuns),
+		NumClosedActionRuns: int(numClosedActionRuns),
+	}); err != nil {
+		log.Error("UpdateRepoRunsNumbers update repo %d: %v", repoID, err)
+	}
+}
+
+func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, error) {
+	var run ActionRun
+	has, err := db.GetEngine(ctx).Where("id=? AND repo_id=?", runID, repoID).Get(&run)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run with id %d: %w", runID, util.ErrNotExist)
+	}
+
+	return &run, nil
+}
+
+func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
+	run := &ActionRun{
+		RepoID: repoID,
+		Index:  runIndex,
+	}
+	has, err := db.GetEngine(ctx).Get(run)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run with repo_id %d and index %d: %w", repoID, runIndex, util.ErrNotExist)
+	}
+
+	return run, nil
+}
+
+func GetLatestRun(ctx context.Context, repoID int64) (*ActionRun, error) {
+	run := &ActionRun{
+		RepoID: repoID,
+	}
+	has, err := db.GetEngine(ctx).Where("repo_id=?", repoID).Desc("index").Get(run)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("latest run with repo_id %d: %w", repoID, util.ErrNotExist)
+	}
+	return run, nil
+}
+
+func GetWorkflowLatestRun(ctx context.Context, repoID int64, workflowFile, branch, event string) (*ActionRun, error) {
+	var run ActionRun
+	q := db.GetEngine(ctx).Where("repo_id=?", repoID).
+		And("ref = ?", branch).
+		And("workflow_id = ?", workflowFile)
+	if event != "" {
+		q.And("event = ?", event)
+	}
+	has, err := q.Desc("id").Get(&run)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, util.NewNotExistErrorf("run with repo_id %d, ref %s, workflow_id %s", repoID, branch, workflowFile)
+	}
+	return &run, nil
+}
+
+// UpdateRun updates a run.
+// It requires the inputted run has Version set.
+// It will return error if the version is not matched (it means the run has been changed after loaded).
+func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {
+	sess := db.GetEngine(ctx).ID(run.ID)
+	if len(cols) > 0 {
+		sess.Cols(cols...)
+	}
+	run.Title = util.EllipsisDisplayString(run.Title, 255)
+	affected, err := sess.Update(run)
+	if err != nil {
+		return err
+	}
+	if affected == 0 {
+		return errors.New("run has changed")
+		// It's impossible that the run is not found, since Gitea never deletes runs.
+	}
+
+	return nil
+}
+
+type ActionRunIndex db.ResourceIndex
+
+// GetConcurrentRunAttemptsAndJobs returns run attempts and jobs in the same concurrency group by statuses.
+func GetConcurrentRunAttemptsAndJobs(ctx context.Context, repoID int64, concurrencyGroup string, status []Status) ([]*ActionRunAttempt, []*ActionRunJob, error) {
+	attempts, err := FindConcurrentRunAttempts(ctx, repoID, concurrencyGroup, status)
+	if err != nil {
+		return nil, nil, fmt.Errorf("find run attempts: %w", err)
+	}
+
+	jobs, err := db.Find[ActionRunJob](ctx, &FindRunJobOptions{
+		RepoID:           repoID,
+		ConcurrencyGroup: concurrencyGroup,
+		Statuses:         status,
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("find jobs: %w", err)
+	}
+
+	return attempts, jobs, nil
+}
+
+func CancelPreviousJobsByRunConcurrency(ctx context.Context, attempt *ActionRunAttempt) ([]*ActionRunJob, error) {
+	if attempt.ConcurrencyGroup == "" {
+		return nil, nil
+	}
+
+	var jobsToCancel []*ActionRunJob
+
+	statusFindOption := []Status{StatusWaiting, StatusBlocked}
+	if attempt.ConcurrencyCancel {
+		statusFindOption = append(statusFindOption, StatusRunning)
+		statusFindOption = append(statusFindOption, StatusCancelling)
+	}
+	attempts, jobs, err := GetConcurrentRunAttemptsAndJobs(ctx, attempt.RepoID, attempt.ConcurrencyGroup, statusFindOption)
+	if err != nil {
+		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
+	}
+	jobsToCancel = append(jobsToCancel, jobs...)
+
+	// cancel runs in the same concurrency group
+	for _, concurrentAttempt := range attempts {
+		if concurrentAttempt.RunID == attempt.RunID {
+			continue
+		}
+		jobs, err := GetRunJobsByRunAndAttemptID(ctx, concurrentAttempt.RunID, concurrentAttempt.ID)
+		if err != nil {
+			return nil, fmt.Errorf("find run %d attempt %d jobs: %w", concurrentAttempt.RunID, concurrentAttempt.ID, err)
+		}
+		jobsToCancel = append(jobsToCancel, jobs...)
+	}
+
+	return CancelJobs(ctx, jobsToCancel)
+}

models/actions/run_attempt.go

@@ -0,0 +1,140 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"time"
+
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+)
+
+// ActionRunAttempt represents a single execution attempt of an ActionRun.
+type ActionRunAttempt struct {
+	ID      int64
+	RepoID  int64      `xorm:"index(repo_concurrency_status)"`
+	RunID   int64      `xorm:"UNIQUE(run_attempt)"`
+	Run     *ActionRun `xorm:"-"`
+	Attempt int64      `xorm:"UNIQUE(run_attempt)"`
+
+	TriggerUserID int64
+	TriggerUser   *user_model.User `xorm:"-"`
+
+	ConcurrencyGroup  string `xorm:"index(repo_concurrency_status) NOT NULL DEFAULT ''"`
+	ConcurrencyCancel bool   `xorm:"NOT NULL DEFAULT FALSE"`
+
+	Status  Status `xorm:"index(repo_concurrency_status)"`
+	Started timeutil.TimeStamp
+	Stopped timeutil.TimeStamp
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
+}
+
+func (*ActionRunAttempt) TableName() string {
+	return "action_run_attempt"
+}
+
+func init() {
+	db.RegisterModel(new(ActionRunAttempt))
+}
+
+func (attempt *ActionRunAttempt) Duration() time.Duration {
+	return calculateDuration(attempt.Started, attempt.Stopped, attempt.Status, attempt.Updated)
+}
+
+func (attempt *ActionRunAttempt) LoadAttributes(ctx context.Context) (err error) {
+	if attempt.Run == nil {
+		run, err := GetRunByRepoAndID(ctx, attempt.RepoID, attempt.RunID)
+		if err != nil {
+			return err
+		}
+		if err := run.LoadAttributes(ctx); err != nil {
+			return err
+		}
+		attempt.Run = run
+	}
+
+	if attempt.TriggerUser == nil {
+		attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func GetRunAttemptByRepoAndID(ctx context.Context, repoID, attemptID int64) (*ActionRunAttempt, error) {
+	var attempt ActionRunAttempt
+	has, err := db.GetEngine(ctx).Where("repo_id=? AND id=?", repoID, attemptID).Get(&attempt)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run attempt %d in repo %d: %w", attemptID, repoID, util.ErrNotExist)
+	}
+	return &attempt, nil
+}
+
+func GetRunAttemptByRunIDAndAttemptNum(ctx context.Context, runID, attemptNum int64) (*ActionRunAttempt, error) {
+	var attempt ActionRunAttempt
+	has, err := db.GetEngine(ctx).Where("run_id=? AND attempt=?", runID, attemptNum).Get(&attempt)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run attempt %d for run %d: %w", attemptNum, runID, util.ErrNotExist)
+	}
+	return &attempt, nil
+}
+
+// FindConcurrentRunAttempts returns attempts in the given concurrency group and status set.
+// Results are unordered; callers must not depend on any particular row order.
+func FindConcurrentRunAttempts(ctx context.Context, repoID int64, concurrencyGroup string, statuses []Status) ([]*ActionRunAttempt, error) {
+	attempts := make([]*ActionRunAttempt, 0)
+	sess := db.GetEngine(ctx).Where("repo_id=? AND concurrency_group=?", repoID, concurrencyGroup)
+	if len(statuses) > 0 {
+		sess = sess.In("status", statuses)
+	}
+	return attempts, sess.Find(&attempts)
+}
+
+func UpdateRunAttempt(ctx context.Context, attempt *ActionRunAttempt, cols ...string) error {
+	if slices.Contains(cols, "status") && attempt.Started.IsZero() && attempt.Status.IsRunning() {
+		attempt.Started = timeutil.TimeStampNow()
+		cols = append(cols, "started")
+	}
+
+	sess := db.GetEngine(ctx).ID(attempt.ID)
+	if len(cols) > 0 {
+		sess.Cols(cols...)
+	}
+	if _, err := sess.Update(attempt); err != nil {
+		return err
+	}
+
+	// Only status/timing changes on an attempt need to update the latest run.
+	if len(cols) > 0 && !slices.Contains(cols, "status") && !slices.Contains(cols, "started") && !slices.Contains(cols, "stopped") {
+		return nil
+	}
+
+	run, err := GetRunByRepoAndID(ctx, attempt.RepoID, attempt.RunID)
+	if err != nil {
+		return err
+	}
+	if run.LatestAttemptID != attempt.ID {
+		log.Warn("run %d cannot be updated by an old attempt %d", run.LatestAttemptID, attempt.ID)
+		return nil
+	}
+
+	run.Status = attempt.Status
+	run.Started = attempt.Started
+	run.Stopped = attempt.Stopped
+	return UpdateRun(ctx, run, "status", "started", "stopped")
+}

models/actions/run_attempt_list.go

@@ -0,0 +1,46 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+)
+
+type ActionRunAttemptList []*ActionRunAttempt
+
+// GetUserIDs returns a slice of user's id
+func (attempts ActionRunAttemptList) GetUserIDs() []int64 {
+	return container.FilterSlice(attempts, func(attempt *ActionRunAttempt) (int64, bool) {
+		return attempt.TriggerUserID, true
+	})
+}
+
+func (attempts ActionRunAttemptList) LoadTriggerUser(ctx context.Context) error {
+	userIDs := attempts.GetUserIDs()
+	users := make(map[int64]*user_model.User, len(userIDs))
+	if err := db.GetEngine(ctx).In("id", userIDs).Find(&users); err != nil {
+		return err
+	}
+	for _, attempt := range attempts {
+		if attempt.TriggerUserID == user_model.ActionsUserID {
+			attempt.TriggerUser = user_model.NewActionsUser()
+		} else {
+			attempt.TriggerUser = users[attempt.TriggerUserID]
+			if attempt.TriggerUser == nil {
+				attempt.TriggerUser = user_model.NewGhostUser()
+			}
+		}
+	}
+	return nil
+}
+
+// ListRunAttemptsByRunID returns all attempts of a run, ordered by attempt number DESC (newest first).
+func ListRunAttemptsByRunID(ctx context.Context, runID int64) (ActionRunAttemptList, error) {
+	var attempts ActionRunAttemptList
+	return attempts, db.GetEngine(ctx).Where("run_id=?", runID).OrderBy("attempt DESC").Find(&attempts)
+}

models/actions/run_job.go

@@ -0,0 +1,695 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"time"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
+
+	"xorm.io/builder"
+)
+
+// MaxJobNumPerRun is the maximum number of jobs in a single run.
+// https://docs.github.com/en/actions/reference/limits#existing-system-limits
+// TODO: check this limit when creating jobs
+const MaxJobNumPerRun = 256
+
+// ActionRunJob represents a job of a run
+type ActionRunJob struct {
+	ID                int64
+	RunID             int64                  `xorm:"index"`
+	Run               *ActionRun             `xorm:"-"`
+	RepoID            int64                  `xorm:"index(repo_concurrency)"`
+	Repo              *repo_model.Repository `xorm:"-"`
+	OwnerID           int64                  `xorm:"index"`
+	CommitSHA         string                 `xorm:"index"`
+	IsForkPullRequest bool
+	Name              string `xorm:"VARCHAR(255)"`
+
+	// for legacy jobs, this counts how many times the job has run;
+	// otherwise it matches the Attempt of the ActionRunAttempt identified by job.RunAttemptID
+	Attempt int64
+
+	// WorkflowPayload is act/jobparser.SingleWorkflow for act/jobparser.Parse
+	// it should contain exactly one job with global workflow fields for this model
+	WorkflowPayload []byte
+
+	JobID  string   `xorm:"VARCHAR(255)"` // job id in workflow, not job's id
+	Needs  []string `xorm:"JSON TEXT"`
+	RunsOn []string `xorm:"JSON TEXT"`
+
+	TaskID       int64 // the task created by this job in its own attempt
+	SourceTaskID int64 `xorm:"NOT NULL DEFAULT 0"` // SourceTaskID points to a historical task when this job reuses an earlier attempt's result.
+
+	Status Status `xorm:"index"`
+
+	RawConcurrency string // raw concurrency from job YAML's "concurrency" section
+
+	// IsConcurrencyEvaluated is only valid/needed when this job's RawConcurrency is not empty.
+	// If RawConcurrency can't be evaluated (e.g. depend on other job's outputs or have errors), this field will be false.
+	// If RawConcurrency has been successfully evaluated, this field will be true, ConcurrencyGroup and ConcurrencyCancel are also set.
+	IsConcurrencyEvaluated bool
+
+	ConcurrencyGroup  string `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"` // evaluated concurrency.group
+	ConcurrencyCancel bool   `xorm:"NOT NULL DEFAULT FALSE"`                      // evaluated concurrency.cancel-in-progress
+
+	// TokenPermissions stores the explicit permissions from workflow/job YAML (no org/repo clamps applied).
+	// Org/repo clamps are enforced when the token is used at runtime.
+	// It is JSON-encoded repo_model.ActionsTokenPermissions and may be empty if not specified.
+	TokenPermissions *repo_model.ActionsTokenPermissions `xorm:"JSON TEXT"`
+
+	// RunAttemptID identifies the ActionRunAttempt this job belongs to.
+	// A value of 0 indicates a legacy job created before ActionRunAttempt existed.
+	RunAttemptID int64 `xorm:"index NOT NULL DEFAULT 0"`
+	// AttemptJobID is unique within a single attempt.
+	// For jobs created after ActionRunAttempt was introduced, the same logical job is expected to keep the same AttemptJobID across attempts.
+	// A value of 0 indicates a legacy job created before ActionRunAttempt existed.
+	AttemptJobID int64 `xorm:"index NOT NULL DEFAULT 0"`
+
+	// WorkflowSourceRepoID + WorkflowSourceCommitSHA record the (repo, commit) this job's containing workflow file came from.
+	WorkflowSourceRepoID    int64  `xorm:"NOT NULL DEFAULT 0"`
+	WorkflowSourceCommitSHA string `xorm:"VARCHAR(64) NOT NULL DEFAULT ''"`
+
+	// IsReusableCaller marks this job as a reusable workflow caller.
+	// Caller jobs do not run on a runner; their status is derived from their child jobs.
+	IsReusableCaller bool `xorm:"index NOT NULL DEFAULT FALSE"`
+	// IsExpanded reports whether this job's lazy expansion (children-row insertion) is complete.
+	// For a reusable workflow caller, true means children rows exist and CallPayload is populated.
+	IsExpanded bool `xorm:"NOT NULL DEFAULT FALSE"`
+	// CallUses stores the raw "uses:" string of a reusable workflow caller job.
+	// Only set when IsReusableCaller is true.
+	CallUses string `xorm:"VARCHAR(512) NOT NULL DEFAULT ''"`
+	// ReusableWorkflowContent is the content of the reusable workflow specified by "uses:".
+	// Only set when IsReusableCaller is true.
+	ReusableWorkflowContent []byte `xorm:"LONGBLOB"`
+	// CallSecrets encodes the reusable workflow caller's "secrets:" section:
+	//   - ""           : no "secrets:" section (children only see auto-generated tokens).
+	//   - "inherit"    : the caller wrote "secrets: inherit".
+	//   - JSON object  : explicit mapping {alias: source_name}; names only, no values.
+	// Only set when IsReusableCaller is true.
+	CallSecrets string `xorm:"LONGTEXT"`
+	// CallPayload is the JSON-encoded WorkflowCallPayload exposed to children as gitea.event.
+	// Populated atomically with IsExpanded at the end of expandReusableWorkflowCaller.
+	// Only set when IsReusableCaller is true.
+	CallPayload string `xorm:"LONGTEXT"`
+
+	// ParentJobID scopes `Needs` resolution: name lookups happen only among rows sharing the same ParentJobID. 0 for top-level rows.
+	ParentJobID int64 `xorm:"index NOT NULL DEFAULT 0"`
+
+	Started timeutil.TimeStamp
+	Stopped timeutil.TimeStamp
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated index"`
+}
+
+// ActionRunAttemptJobIDIndex backs the run-wide AttemptJobID counter, keyed by ActionRun.ID.
+// Use GetNextAttemptJobID to allocate the next ID for a run.
+type ActionRunAttemptJobIDIndex db.ResourceIndex
+
+// GetNextAttemptJobID atomically allocates the next AttemptJobID for a job in the given run.
+// AttemptJobIDs are unique within a single attempt and stable across attempts for the same logical job
+func GetNextAttemptJobID(ctx context.Context, runID int64) (int64, error) {
+	return db.GetNextResourceIndex(ctx, "action_run_attempt_job_id_index", runID)
+}
+
+func init() {
+	db.RegisterModel(new(ActionRunJob))
+	db.RegisterModel(new(ActionRunAttemptJobIDIndex))
+}
+
+func (job *ActionRunJob) Duration() time.Duration {
+	return calculateDuration(job.Started, job.Stopped, job.Status, job.Updated)
+}
+
+func (job *ActionRunJob) EffectiveTaskID() int64 {
+	if job.TaskID > 0 {
+		return job.TaskID
+	}
+	return job.SourceTaskID
+}
+
+func (job *ActionRunJob) LoadRun(ctx context.Context) error {
+	if job.Run == nil {
+		run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+		if err != nil {
+			return err
+		}
+		job.Run = run
+	}
+	return nil
+}
+
+func (job *ActionRunJob) LoadRepo(ctx context.Context) error {
+	if job.Repo == nil {
+		repo, err := repo_model.GetRepositoryByID(ctx, job.RepoID)
+		if err != nil {
+			return err
+		}
+		job.Repo = repo
+	}
+	return nil
+}
+
+// LoadAttributes load Run if not loaded
+func (job *ActionRunJob) LoadAttributes(ctx context.Context) error {
+	if err := job.LoadRun(ctx); err != nil {
+		return err
+	}
+
+	return job.Run.LoadAttributes(ctx)
+}
+
+// ParseJob parses the job structure from the ActionRunJob.WorkflowPayload
+func (job *ActionRunJob) ParseJob() (*jobparser.Job, error) {
+	// job.WorkflowPayload is a SingleWorkflow created from an ActionRun's workflow, which exactly contains this job's YAML definition.
+	// Ideally it shouldn't be called "Workflow", it is just a job with global workflow fields + trigger
+	parsedWorkflows, err := jobparser.Parse(job.WorkflowPayload)
+	if err != nil {
+		return nil, fmt.Errorf("job %d single workflow: unable to parse: %w", job.ID, err)
+	} else if len(parsedWorkflows) != 1 {
+		return nil, fmt.Errorf("job %d single workflow: not single workflow", job.ID)
+	}
+	_, workflowJob := parsedWorkflows[0].Job()
+	if workflowJob == nil {
+		// it shouldn't happen, and since the callers don't check nil, so return an error instead of nil
+		return nil, util.ErrorWrap(util.ErrNotExist, "job %d single workflow: payload doesn't contain a job", job.ID)
+	}
+	return workflowJob, nil
+}
+
+func GetRunJobByRepoAndID(ctx context.Context, repoID, jobID int64) (*ActionRunJob, error) {
+	var job ActionRunJob
+	has, err := db.GetEngine(ctx).Where("id=? AND repo_id=?", jobID, repoID).Get(&job)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run job with id %d: %w", jobID, util.ErrNotExist)
+	}
+
+	return &job, nil
+}
+
+func GetRunJobByRunAndID(ctx context.Context, runID, jobID int64) (*ActionRunJob, error) {
+	var job ActionRunJob
+	has, err := db.GetEngine(ctx).Where("id=? AND run_id=?", jobID, runID).Get(&job)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run job with id %d: %w", jobID, util.ErrNotExist)
+	}
+
+	return &job, nil
+}
+
+func GetRunJobByAttemptJobID(ctx context.Context, runID, attemptID, attemptJobID int64) (*ActionRunJob, error) {
+	var job ActionRunJob
+	has, err := db.GetEngine(ctx).Where("run_id=? AND run_attempt_id=? AND attempt_job_id=?", runID, attemptID, attemptJobID).Get(&job)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run job with attempt_job_id %d in run %d attempt %d: %w", attemptJobID, runID, attemptID, util.ErrNotExist)
+	}
+
+	return &job, nil
+}
+
+// GetLatestAttemptJobsByRepoAndRunID returns the jobs of the latest attempt for a run.
+// It prefers the latest attempt when one exists, and falls back to legacy jobs with run_attempt_id=0 for runs created before ActionRunAttempt existed.
+func GetLatestAttemptJobsByRepoAndRunID(ctx context.Context, repoID, runID int64) (ActionJobList, error) {
+	run, err := GetRunByRepoAndID(ctx, repoID, runID)
+	if err != nil {
+		return nil, err
+	}
+	if run.LatestAttemptID > 0 {
+		return GetRunJobsByRunAndAttemptID(ctx, runID, run.LatestAttemptID)
+	}
+
+	var jobs []*ActionRunJob
+	if err := db.GetEngine(ctx).Where("repo_id=? AND run_id=? AND run_attempt_id=0", repoID, runID).OrderBy("id").Find(&jobs); err != nil {
+		return nil, err
+	}
+	return jobs, nil
+}
+
+// GetAllRunJobsByRepoAndRunID returns all jobs for a run across all attempts.
+func GetAllRunJobsByRepoAndRunID(ctx context.Context, repoID, runID int64) (ActionJobList, error) {
+	var jobs []*ActionRunJob
+	if err := db.GetEngine(ctx).Where("repo_id=? AND run_id=?", repoID, runID).OrderBy("id").Find(&jobs); err != nil {
+		return nil, err
+	}
+	return jobs, nil
+}
+
+// GetRunJobsByRunAndAttemptID returns jobs for a run within a specific attempt.
+// runAttemptID may be 0 to address legacy jobs that were created before ActionRunAttempt existed and therefore have no attempt association.
+func GetRunJobsByRunAndAttemptID(ctx context.Context, runID, runAttemptID int64) (ActionJobList, error) {
+	var jobs []*ActionRunJob
+	if err := db.GetEngine(ctx).Where("run_id=? AND run_attempt_id=?", runID, runAttemptID).OrderBy("id").Find(&jobs); err != nil {
+		return nil, err
+	}
+	return jobs, nil
+}
+
+// GetPriorAttemptChildrenByParent returns the children of the most recent prior attempt where
+// the parent (identified by parentAttemptJobID) actually had children, indexed by child JobID then child Name.
+// Returns (nil, nil) when no such attempt exists.
+// The (JobID, Name) key disambiguates both reusable-workflow subtrees and matrix-expanded instances (whose Name carries the matrix suffix).
+func GetPriorAttemptChildrenByParent(ctx context.Context, runID, currentAttemptID, parentAttemptJobID int64) (map[string]map[string]*ActionRunJob, error) {
+	// query every prior caller row sharing this AttemptJobID, newest first.
+	var priorCallers []*ActionRunJob
+	if err := db.GetEngine(ctx).
+		Where("run_id = ? AND attempt_job_id = ? AND run_attempt_id < ?", runID, parentAttemptJobID, currentAttemptID).
+		Desc("run_attempt_id").
+		Find(&priorCallers); err != nil {
+		return nil, fmt.Errorf("find prior callers: %w", err)
+	}
+	if len(priorCallers) == 0 {
+		return nil, nil //nolint:nilnil // caller is brand new in this attempt
+	}
+
+	// query for every child of every prior caller
+	callerIDs := make([]int64, len(priorCallers))
+	for i, c := range priorCallers {
+		callerIDs[i] = c.ID
+	}
+	var allChildren []*ActionRunJob
+	if err := db.GetEngine(ctx).
+		Where("run_id = ?", runID).
+		In("parent_job_id", callerIDs).
+		Find(&allChildren); err != nil {
+		return nil, fmt.Errorf("find prior children: %w", err)
+	}
+
+	childrenByCallerID := make(map[int64][]*ActionRunJob, len(callerIDs))
+	for _, c := range allChildren {
+		childrenByCallerID[c.ParentJobID] = append(childrenByCallerID[c.ParentJobID], c)
+	}
+
+	// Walk priorCallers in run_attempt_id-desc order and return the children of the first caller that actually had any.
+	// Skipped attempts (caller exists but no children) are bypassed.
+	for _, caller := range priorCallers {
+		children := childrenByCallerID[caller.ID]
+		if len(children) == 0 {
+			continue
+		}
+		out := make(map[string]map[string]*ActionRunJob)
+		for _, c := range children {
+			if out[c.JobID] == nil {
+				out[c.JobID] = make(map[string]*ActionRunJob)
+			}
+			out[c.JobID][c.Name] = c
+		}
+		return out, nil
+	}
+
+	return nil, nil //nolint:nilnil // every prior attempt skipped this caller
+}
+
+// GetDirectChildJobsByParent returns the direct child jobs of a parent job (e.g. a reusable workflow caller).
+func GetDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) (ActionJobList, error) {
+	var jobs []*ActionRunJob
+	if err := db.GetEngine(ctx).
+		Where("run_id=? AND parent_job_id=?", parentJob.RunID, parentJob.ID).
+		OrderBy("id").
+		Find(&jobs); err != nil {
+		return nil, err
+	}
+	return jobs, nil
+}
+
+// CollectAllDescendantJobs returns every job in `allJobs` that lives under parent's subtree (recursively), excluding `parent` itself
+func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*ActionRunJob {
+	parents := map[int64]bool{parent.ID: true}
+	for {
+		grew := false
+		for _, j := range allJobs {
+			if j.ParentJobID == 0 {
+				continue
+			}
+			if parents[j.ParentJobID] && !parents[j.ID] {
+				parents[j.ID] = true
+				grew = true
+			}
+		}
+		if !grew {
+			break
+		}
+	}
+	out := make([]*ActionRunJob, 0)
+	for _, j := range allJobs {
+		if j.ID == parent.ID || !parents[j.ID] {
+			continue
+		}
+		out = append(out, j)
+	}
+	return out
+}
+
+func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, cols ...string) (int64, error) {
+	e := db.GetEngine(ctx)
+
+	sess := e.ID(job.ID)
+	if len(cols) > 0 {
+		sess.Cols(cols...)
+	}
+
+	if cond != nil {
+		sess.Where(cond)
+	}
+
+	affected, err := sess.Update(job)
+	if err != nil {
+		return 0, err
+	}
+
+	// xorm's Update writes only non-zero fields when cols is empty, so a zero job.Status
+	// with empty cols means status isn't actually being persisted — skip aggregation.
+	statusUpdated := slices.Contains(cols, "status") || (len(cols) == 0 && job.Status != 0)
+	if affected == 0 || !statusUpdated {
+		return affected, nil
+	}
+
+	// Reusable workflow caller jobs are never picked up by runners, so they don't need a task-version bump.
+	if statusUpdated && job.Status.IsWaiting() && !job.IsReusableCaller {
+		// if the status of job changes to waiting again, increase tasks version.
+		if err := IncreaseTaskVersion(ctx, job.OwnerID, job.RepoID); err != nil {
+			return 0, err
+		}
+	}
+
+	if job.RunID == 0 {
+		var err error
+		if job, err = GetRunJobByRepoAndID(ctx, job.RepoID, job.ID); err != nil {
+			return 0, err
+		}
+	}
+
+	if statusUpdated && job.ParentJobID > 0 {
+		// Reusable workflow caller's children cascade their status changes upward to the parent caller.
+		parent, err := GetRunJobByRunAndID(ctx, job.RunID, job.ParentJobID)
+		if err != nil {
+			return affected, fmt.Errorf("load parent caller %d: %w", job.ParentJobID, err)
+		}
+		return affected, RefreshReusableCallerStatus(ctx, parent)
+	}
+
+	{
+		// Other goroutines may aggregate the status of the attempt/run and update it too.
+		// So we need to load the current jobs before updating the aggregate state.
+		if job.RunAttemptID > 0 {
+			attempt, err := GetRunAttemptByRepoAndID(ctx, job.RepoID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetRunJobsByRunAndAttemptID(ctx, job.RunID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			attempt.Status = AggregateJobStatus(jobs)
+			if attempt.Started.IsZero() && attempt.Status.IsRunning() {
+				attempt.Started = timeutil.TimeStampNow()
+			}
+			if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
+				attempt.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
+			}
+		} else {
+			// TODO: Remove this fallback in the future.
+			// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
+			// This path keeps those runs' status consistent when their jobs finish, including:
+			//   - jobs created before migration v331 and complete on the new version starts
+			//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
+			run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetLatestAttemptJobsByRepoAndRunID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			run.Status = AggregateJobStatus(jobs)
+			if run.Started.IsZero() && run.Status.IsRunning() {
+				run.Started = timeutil.TimeStampNow()
+			}
+			if run.Stopped.IsZero() && run.Status.IsDone() {
+				run.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run %d: %w", run.ID, err)
+			}
+		}
+	}
+
+	return affected, nil
+}
+
+// RefreshReusableCallerStatus recomputes a reusable workflow caller's Status, Started and Stopped from its current direct children and persists the change.
+// No-op if caller is not a reusable caller.
+//
+// Concurrency: two sibling children finishing at roughly the same time can each invoke this for the same parent caller.
+// No row-level lock is taken because AggregateJobStatus is a pure function of the children's statuses (order-independent), so racing callers arrive at the same Status.
+func RefreshReusableCallerStatus(ctx context.Context, caller *ActionRunJob) error {
+	if !caller.IsReusableCaller {
+		return nil
+	}
+	children, err := GetDirectChildJobsByParent(ctx, caller)
+	if err != nil {
+		return err
+	}
+
+	newStatus := AggregateJobStatus(children)
+	cols := make([]string, 0, 3)
+	if caller.Status != newStatus {
+		caller.Status = newStatus
+		cols = append(cols, "status")
+	}
+	if newStatus != StatusSkipped {
+		now := timeutil.TimeStampNow()
+		if caller.Started.IsZero() && newStatus == StatusRunning {
+			caller.Started = now
+			cols = append(cols, "started")
+		}
+		if caller.Stopped.IsZero() && newStatus.IsDone() {
+			caller.Stopped = now
+			cols = append(cols, "stopped")
+		}
+	}
+	if len(cols) == 0 {
+		return nil
+	}
+	_, err = UpdateRunJob(ctx, caller, nil, cols...)
+	return err
+}
+
+func AggregateJobStatus(jobs []*ActionRunJob) Status {
+	allSuccessOrSkipped := len(jobs) != 0
+	allSkipped := len(jobs) != 0
+	var hasFailure, hasCancelled, hasCancelling, hasWaiting, hasRunning, hasBlocked bool
+	for _, job := range jobs {
+		allSuccessOrSkipped = allSuccessOrSkipped && (job.Status == StatusSuccess || job.Status == StatusSkipped)
+		allSkipped = allSkipped && job.Status == StatusSkipped
+		hasFailure = hasFailure || job.Status == StatusFailure
+		hasCancelled = hasCancelled || job.Status == StatusCancelled
+		hasCancelling = hasCancelling || job.Status == StatusCancelling
+		hasWaiting = hasWaiting || job.Status == StatusWaiting
+		hasRunning = hasRunning || job.Status == StatusRunning
+		hasBlocked = hasBlocked || job.Status == StatusBlocked
+	}
+	switch {
+	case allSkipped:
+		return StatusSkipped
+	case allSuccessOrSkipped:
+		return StatusSuccess
+	case hasCancelling:
+		return StatusCancelling
+	case hasRunning:
+		return StatusRunning
+	case hasWaiting:
+		return StatusWaiting
+	case hasBlocked:
+		// Blocked is still a pending state, so it should outrank terminal
+		// statuses like cancelled/failure when no job is waiting or running.
+		return StatusBlocked
+	case hasCancelled:
+		return StatusCancelled
+	case hasFailure:
+		return StatusFailure
+	default:
+		return StatusUnknown // it shouldn't happen
+	}
+}
+
+// CancelPreviousJobs cancels all previous jobs of the same repository, reference, workflow, and event.
+// It's useful when a new run is triggered, and all previous runs needn't be continued anymore.
+func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID string, event webhook_module.HookEventType) ([]*ActionRunJob, error) {
+	// Find all runs in the specified repository, reference, and workflow with non-final status
+	runs, total, err := db.FindAndCount[ActionRun](ctx, FindRunOptions{
+		RepoID:       repoID,
+		Ref:          ref,
+		WorkflowID:   workflowID,
+		TriggerEvent: event,
+		Status:       []Status{StatusRunning, StatusWaiting, StatusBlocked, StatusCancelling},
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// If there are no runs found, there's no need to proceed with cancellation, so return nil.
+	if total == 0 {
+		return nil, nil
+	}
+
+	cancelledJobs := make([]*ActionRunJob, 0, total)
+
+	// Iterate over each found run and cancel its associated jobs.
+	for _, run := range runs {
+		// Find all jobs associated with the current run.
+		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
+			RunID: run.ID,
+		})
+		if err != nil {
+			return cancelledJobs, err
+		}
+
+		cjs, err := CancelJobs(ctx, jobs)
+		if err != nil {
+			return cancelledJobs, err
+		}
+		cancelledJobs = append(cancelledJobs, cjs...)
+	}
+
+	// Return nil to indicate successful cancellation of all running and waiting jobs.
+	return cancelledJobs, nil
+}
+
+func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob) (jobsToCancel []*ActionRunJob, _ error) {
+	if job.RawConcurrency == "" {
+		return nil, nil
+	}
+	if !job.IsConcurrencyEvaluated {
+		return nil, nil
+	}
+	if job.ConcurrencyGroup == "" {
+		return nil, nil
+	}
+
+	statusFindOption := []Status{StatusWaiting, StatusBlocked}
+	if job.ConcurrencyCancel {
+		statusFindOption = append(statusFindOption, StatusRunning)
+		statusFindOption = append(statusFindOption, StatusCancelling)
+	}
+	attempts, jobs, err := GetConcurrentRunAttemptsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, statusFindOption)
+	if err != nil {
+		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
+	}
+	jobs = slices.DeleteFunc(jobs, func(j *ActionRunJob) bool { return j.ID == job.ID })
+	jobsToCancel = append(jobsToCancel, jobs...)
+
+	// cancel runs in the same concurrency group
+	for _, attempt := range attempts {
+		if attempt.ID == job.RunAttemptID {
+			continue
+		}
+		jobs, err := GetRunJobsByRunAndAttemptID(ctx, attempt.RunID, attempt.ID)
+		if err != nil {
+			return nil, fmt.Errorf("find run %d attempt %d jobs: %w", attempt.RunID, attempt.ID, err)
+		}
+		jobsToCancel = append(jobsToCancel, jobs...)
+	}
+
+	return CancelJobs(ctx, jobsToCancel)
+}
+
+func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
+	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))
+
+	for _, job := range jobs {
+		if job.IsReusableCaller {
+			sub, err := cancelReusableCaller(ctx, job)
+			if err != nil {
+				return cancelledJobs, err
+			}
+			cancelledJobs = append(cancelledJobs, sub...)
+			continue
+		}
+
+		c, err := cancelOneJob(ctx, job)
+		if err != nil {
+			return cancelledJobs, err
+		}
+		if c != nil {
+			cancelledJobs = append(cancelledJobs, c)
+		}
+	}
+	return cancelledJobs, nil
+}
+
+// cancelOneJob cancels a single job and returns the post-cancel row
+func cancelOneJob(ctx context.Context, job *ActionRunJob) (*ActionRunJob, error) {
+	if job.Status.IsDone() {
+		return nil, nil //nolint:nilnil // signal "nothing to cancel; not an error"
+	}
+	// No associated task: mark Cancelled directly. This includes reusable callers and jobs that never reached PickTask.
+	if job.TaskID == 0 {
+		job.Status = StatusCancelled
+		job.Stopped = timeutil.TimeStampNow()
+		n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
+		if err != nil {
+			return nil, err
+		}
+		if n == 0 {
+			log.Error("Failed to cancel job %d because it has changed", job.ID)
+			return nil, nil //nolint:nilnil // signal "nothing to cancel; not an error"
+		}
+		return job, nil
+	}
+	// Has a task: stop the task and re-read the row.
+	if err := StopTask(ctx, job.TaskID, StatusCancelling); err != nil {
+		return nil, err
+	}
+	updated, err := GetRunJobByRunAndID(ctx, job.RunID, job.ID)
+	if err != nil {
+		return nil, fmt.Errorf("get job: %w", err)
+	}
+	return updated, nil
+}
+
+// cancelReusableCaller cancels `caller` and all its child jobs
+func cancelReusableCaller(ctx context.Context, caller *ActionRunJob) ([]*ActionRunJob, error) {
+	cancelledJobs := make([]*ActionRunJob, 0)
+
+	if c, err := cancelOneJob(ctx, caller); err != nil {
+		return cancelledJobs, err
+	} else if c != nil {
+		cancelledJobs = append(cancelledJobs, c)
+	}
+
+	attemptJobs, err := GetRunJobsByRunAndAttemptID(ctx, caller.RunID, caller.RunAttemptID)
+	if err != nil {
+		return cancelledJobs, err
+	}
+
+	for _, c := range CollectAllDescendantJobs(caller, attemptJobs) {
+		cancelled, err := cancelOneJob(ctx, c)
+		if err != nil {
+			return cancelledJobs, err
+		}
+		if cancelled != nil {
+			cancelledJobs = append(cancelledJobs, cancelled)
+		}
+	}
+	return cancelledJobs, nil
+}

models/actions/run_job_list.go

@@ -0,0 +1,154 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"slices"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+type ActionJobList []*ActionRunJob
+
+func (jobs ActionJobList) GetRunIDs() []int64 {
+	return container.FilterSlice(jobs, func(j *ActionRunJob) (int64, bool) {
+		return j.RunID, j.RunID != 0
+	})
+}
+
+// SortMatrixGroupsByName natural-sorts each contiguous run of jobs that share a JobID
+// so matrix expansions (e.g. "test (1)", "test (2)", "test (10)") appear in human order.
+// Input is expected to be in DB id order so JobID groups are contiguous; cross-group order is preserved.
+func (jobs ActionJobList) SortMatrixGroupsByName() {
+	for i := 0; i < len(jobs); {
+		j := i + 1
+		for j < len(jobs) && jobs[j].JobID == jobs[i].JobID {
+			j++
+		}
+		slices.SortFunc(jobs[i:j], func(a, b *ActionRunJob) int {
+			return base.NaturalSortCompare(a.Name, b.Name)
+		})
+		i = j
+	}
+}
+
+func (jobs ActionJobList) LoadRepos(ctx context.Context) error {
+	repoIDs := container.FilterSlice(jobs, func(j *ActionRunJob) (int64, bool) {
+		return j.RepoID, j.RepoID != 0 && j.Repo == nil
+	})
+	if len(repoIDs) == 0 {
+		return nil
+	}
+
+	repos := make(map[int64]*repo_model.Repository, len(repoIDs))
+	if err := db.GetEngine(ctx).In("id", repoIDs).Find(&repos); err != nil {
+		return err
+	}
+	for _, j := range jobs {
+		if j.RepoID > 0 && j.Repo == nil {
+			j.Repo = repos[j.RepoID]
+		}
+	}
+	return nil
+}
+
+func (jobs ActionJobList) LoadRuns(ctx context.Context, withRepo bool) error {
+	if withRepo {
+		if err := jobs.LoadRepos(ctx); err != nil {
+			return err
+		}
+	}
+
+	runIDs := jobs.GetRunIDs()
+	runs := make(map[int64]*ActionRun, len(runIDs))
+	if err := db.GetEngine(ctx).In("id", runIDs).Find(&runs); err != nil {
+		return err
+	}
+	for _, j := range jobs {
+		if j.Run == nil {
+			j.Run = runs[j.RunID]
+		}
+		if j.Run != nil {
+			j.Run.Repo = j.Repo
+		}
+	}
+	return nil
+}
+
+func (jobs ActionJobList) LoadAttributes(ctx context.Context, withRepo bool) error {
+	return jobs.LoadRuns(ctx, withRepo)
+}
+
+type FindRunJobOptions struct {
+	db.ListOptions
+	RunID            int64
+	RunAttemptID     optional.Option[int64] // use optional to allow filtering by zero (legacy jobs have run_attempt_id=0)
+	RepoID           int64
+	OwnerID          int64
+	CommitSHA        string
+	Statuses         []Status
+	UpdatedBefore    timeutil.TimeStamp
+	ConcurrencyGroup string
+	OrderBy          db.SearchOrderBy
+}
+
+var JobOrderByMap = map[string]map[string]db.SearchOrderBy{
+	"asc":  {"id": "`action_run_job`.id ASC"},
+	"desc": {"id": "`action_run_job`.id DESC"},
+}
+
+func (opts FindRunJobOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RunID > 0 {
+		cond = cond.And(builder.Eq{"`action_run_job`.run_id": opts.RunID})
+	}
+	if opts.RunAttemptID.Has() {
+		cond = cond.And(builder.Eq{"`action_run_job`.run_attempt_id": opts.RunAttemptID.Value()})
+	}
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"`action_run_job`.repo_id": opts.RepoID})
+	}
+	if opts.CommitSHA != "" {
+		cond = cond.And(builder.Eq{"`action_run_job`.commit_sha": opts.CommitSHA})
+	}
+	if len(opts.Statuses) > 0 {
+		cond = cond.And(builder.In("`action_run_job`.status", opts.Statuses))
+	}
+	if opts.UpdatedBefore > 0 {
+		cond = cond.And(builder.Lt{"`action_run_job`.updated": opts.UpdatedBefore})
+	}
+	if opts.ConcurrencyGroup != "" {
+		if opts.RepoID == 0 {
+			panic("Invalid FindRunJobOptions: repo_id is required")
+		}
+		cond = cond.And(builder.Eq{"`action_run_job`.concurrency_group": opts.ConcurrencyGroup})
+	}
+	return cond
+}
+
+func (opts FindRunJobOptions) ToJoins() []db.JoinFunc {
+	if opts.OwnerID > 0 {
+		return []db.JoinFunc{
+			func(sess db.Engine) error {
+				sess.Join("INNER", "repository", "repository.id = repo_id AND repository.owner_id = ?", opts.OwnerID)
+				return nil
+			},
+		}
+	}
+	return nil
+}
+
+func (opts FindRunJobOptions) ToOrders() string {
+	return string(opts.OrderBy)
+}
+
+var _ db.FindOptionsOrder = FindRunJobOptions{}

models/actions/run_job_list_test.go

@@ -0,0 +1,61 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestActionJobList_SortMatrixGroupsByName(t *testing.T) {
+	mk := func(jobID, name string) *ActionRunJob {
+		return &ActionRunJob{JobID: jobID, Name: name}
+	}
+	names := func(jobs ActionJobList) []string {
+		out := make([]string, len(jobs))
+		for i, j := range jobs {
+			out[i] = j.Name
+		}
+		return out
+	}
+
+	t.Run("matrix group sorted naturally", func(t *testing.T) {
+		jobs := ActionJobList{
+			mk("build", "build"),
+			mk("test", "test (10)"),
+			mk("test", "test (2)"),
+			mk("test", "test (1)"),
+			mk("deploy", "deploy"),
+		}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"build", "test (1)", "test (2)", "test (10)", "deploy"}, names(jobs))
+	})
+
+	t.Run("non-adjacent same JobID stays in input order", func(t *testing.T) {
+		jobs := ActionJobList{
+			mk("test", "test (10)"),
+			mk("build", "build"),
+			mk("test", "test (1)"),
+		}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"test (10)", "build", "test (1)"}, names(jobs))
+	})
+
+	t.Run("groups stay in input order", func(t *testing.T) {
+		jobs := ActionJobList{
+			mk("z", "z"),
+			mk("a", "a"),
+		}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"z", "a"}, names(jobs))
+	})
+
+	t.Run("empty and singleton", func(t *testing.T) {
+		ActionJobList(nil).SortMatrixGroupsByName()
+		jobs := ActionJobList{mk("only", "only")}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"only"}, names(jobs))
+	})
+}

models/actions/run_job_status_test.go

@@ -0,0 +1,96 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAggregateJobStatus(t *testing.T) {
+	testStatuses := func(expected Status, statuses []Status) {
+		t.Helper()
+		var jobs []*ActionRunJob
+		for _, v := range statuses {
+			jobs = append(jobs, &ActionRunJob{Status: v})
+		}
+		actual := AggregateJobStatus(jobs)
+		if !assert.Equal(t, expected, actual) {
+			var statusStrings []string
+			for _, s := range statuses {
+				statusStrings = append(statusStrings, s.String())
+			}
+			t.Errorf("AggregateJobStatus(%v) = %v, want %v", statusStrings, statusNames[actual], statusNames[expected])
+		}
+	}
+
+	cases := []struct {
+		statuses []Status
+		expected Status
+	}{
+		// unknown cases, maybe it shouldn't happen in real world
+		{[]Status{}, StatusUnknown},
+		{[]Status{StatusUnknown, StatusSuccess}, StatusUnknown},
+		{[]Status{StatusUnknown, StatusSkipped}, StatusUnknown},
+		{[]Status{StatusUnknown, StatusFailure}, StatusFailure},
+		{[]Status{StatusUnknown, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusUnknown, StatusCancelling}, StatusCancelling},
+		{[]Status{StatusUnknown, StatusWaiting}, StatusWaiting},
+		{[]Status{StatusUnknown, StatusRunning}, StatusRunning},
+		{[]Status{StatusUnknown, StatusBlocked}, StatusBlocked},
+
+		// success with other status
+		{[]Status{StatusSuccess}, StatusSuccess},
+		{[]Status{StatusSuccess, StatusSkipped}, StatusSuccess}, // skipped doesn't affect success
+		{[]Status{StatusSuccess, StatusFailure}, StatusFailure},
+		{[]Status{StatusSuccess, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusSuccess, StatusCancelling}, StatusCancelling},
+		{[]Status{StatusSuccess, StatusWaiting}, StatusWaiting},
+		{[]Status{StatusSuccess, StatusRunning}, StatusRunning},
+		{[]Status{StatusSuccess, StatusBlocked}, StatusBlocked},
+
+		// any cancelled, then cancelled
+		{[]Status{StatusCancelled}, StatusCancelled},
+		{[]Status{StatusCancelled, StatusSuccess}, StatusCancelled},
+		{[]Status{StatusCancelled, StatusSkipped}, StatusCancelled},
+		{[]Status{StatusCancelled, StatusFailure}, StatusCancelled},
+		{[]Status{StatusCancelled, StatusCancelling}, StatusCancelling},
+		{[]Status{StatusCancelled, StatusWaiting}, StatusWaiting},
+		{[]Status{StatusCancelled, StatusRunning}, StatusRunning},
+		{[]Status{StatusCancelled, StatusBlocked}, StatusBlocked},
+
+		{[]Status{StatusCancelling}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusRunning}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusWaiting}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusFailure}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusSkipped}, StatusCancelling},
+
+		// failure with other status, usually fail fast, but "running" wins to match GitHub's behavior
+		// another reason that we can't make "failure" wins over "running": it would cause a weird behavior that user cannot cancel a workflow or get current running workflows correctly by filter after a job fail.
+		{[]Status{StatusFailure}, StatusFailure},
+		{[]Status{StatusFailure, StatusSuccess}, StatusFailure},
+		{[]Status{StatusFailure, StatusSkipped}, StatusFailure},
+		{[]Status{StatusFailure, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusFailure, StatusCancelling}, StatusCancelling},
+		{[]Status{StatusFailure, StatusWaiting}, StatusWaiting},
+		{[]Status{StatusFailure, StatusRunning}, StatusRunning},
+		{[]Status{StatusFailure, StatusBlocked}, StatusBlocked},
+
+		// skipped with other status
+		// "all skipped" is also considered as "mergeable" by "services/actions.toCommitStatus", the same as GitHub
+		{[]Status{StatusSkipped}, StatusSkipped},
+		{[]Status{StatusSkipped, StatusSuccess}, StatusSuccess},
+		{[]Status{StatusSkipped, StatusFailure}, StatusFailure},
+		{[]Status{StatusSkipped, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusSkipped, StatusCancelling}, StatusCancelling},
+		{[]Status{StatusSkipped, StatusWaiting}, StatusWaiting},
+		{[]Status{StatusSkipped, StatusRunning}, StatusRunning},
+		{[]Status{StatusSkipped, StatusBlocked}, StatusBlocked},
+	}
+
+	for _, c := range cases {
+		testStatuses(c.expected, c.statuses)
+	}
+}

models/actions/run_job_test.go

@@ -0,0 +1,133 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetPriorAttemptChildrenByParent(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	// 3 attempts of one run:
+	//   1: caller expanded with 3 matrix instances of "work" + non-matrix sibling "summary".
+	//   2: caller skipped, no children rows.
+	//   3: placeholder "current" attempt for the walkback subtest.
+
+	run := &ActionRun{
+		Title:         "prior-children-test",
+		RepoID:        4,
+		Index:         9501,
+		OwnerID:       1,
+		WorkflowID:    "matrix.yaml",
+		TriggerUserID: 1,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		EventPayload:  "{}",
+		Status:        StatusSuccess,
+	}
+	require.NoError(t, db.Insert(ctx, run))
+
+	const callerAttemptJobID int64 = 9001
+	insertAttempt := func(t *testing.T, num int64, status Status) *ActionRunAttempt {
+		t.Helper()
+		a := &ActionRunAttempt{
+			RepoID:        run.RepoID,
+			RunID:         run.ID,
+			Attempt:       num,
+			TriggerUserID: 1,
+			Status:        status,
+		}
+		require.NoError(t, db.Insert(ctx, a))
+		return a
+	}
+	insertCaller := func(t *testing.T, attemptID int64, status Status, expanded bool) *ActionRunJob {
+		t.Helper()
+		caller := &ActionRunJob{
+			RunID:            run.ID,
+			RunAttemptID:     attemptID,
+			RepoID:           run.RepoID,
+			OwnerID:          run.OwnerID,
+			CommitSHA:        run.CommitSHA,
+			Name:             "caller",
+			JobID:            "caller",
+			Attempt:          1,
+			Status:           status,
+			AttemptJobID:     callerAttemptJobID,
+			IsReusableCaller: true,
+			IsExpanded:       expanded,
+		}
+		require.NoError(t, db.Insert(ctx, caller))
+		return caller
+	}
+	insertChild := func(t *testing.T, attemptID, parentID, attemptJobID int64, name, jobID string) {
+		t.Helper()
+		require.NoError(t, db.Insert(ctx, &ActionRunJob{
+			RunID:        run.ID,
+			RunAttemptID: attemptID,
+			RepoID:       run.RepoID,
+			OwnerID:      run.OwnerID,
+			CommitSHA:    run.CommitSHA,
+			Name:         name,
+			JobID:        jobID,
+			Attempt:      1,
+			Status:       StatusSuccess,
+			AttemptJobID: attemptJobID,
+			ParentJobID:  parentID,
+		}))
+	}
+
+	attempt1 := insertAttempt(t, 1, StatusSuccess)
+	caller1 := insertCaller(t, attempt1.ID, StatusSuccess, true)
+	insertChild(t, attempt1.ID, caller1.ID, 101, "work (alpha)", "work")
+	insertChild(t, attempt1.ID, caller1.ID, 102, "work (beta)", "work")
+	insertChild(t, attempt1.ID, caller1.ID, 103, "work (gamma)", "work")
+	insertChild(t, attempt1.ID, caller1.ID, 104, "summary", "summary")
+
+	attempt2 := insertAttempt(t, 2, StatusSkipped)
+	insertCaller(t, attempt2.ID, StatusSkipped, false) // no children intentionally
+
+	// both subtests expect attempt 1's expansion, differing only in the "current" attempt id
+	assertAttempt1Children := func(t *testing.T, out map[string]map[string]*ActionRunJob) {
+		t.Helper()
+		// outer map keyed by JobID: "work" has 3 matrix instances, "summary" 1
+		assert.Len(t, out, 2)
+		assert.Len(t, out["work"], 3, "matrix instances must each get their own inner-map entry")
+		assert.Len(t, out["summary"], 1)
+
+		require.NotNil(t, out["work"]["work (alpha)"])
+		require.NotNil(t, out["work"]["work (beta)"])
+		require.NotNil(t, out["work"]["work (gamma)"])
+		require.NotNil(t, out["summary"]["summary"])
+
+		assert.Equal(t, int64(101), out["work"]["work (alpha)"].AttemptJobID)
+		assert.Equal(t, int64(102), out["work"]["work (beta)"].AttemptJobID)
+		assert.Equal(t, int64(103), out["work"]["work (gamma)"].AttemptJobID)
+		assert.Equal(t, int64(104), out["summary"]["summary"].AttemptJobID)
+	}
+
+	t.Run("matrix instances and non-matrix sibling are indexed by (JobID, Name)", func(t *testing.T) {
+		// "current" = attempt 2; prior = attempt 1, which is the immediately preceding attempt.
+		out, err := GetPriorAttemptChildrenByParent(ctx, run.ID, attempt2.ID, callerAttemptJobID)
+		require.NoError(t, err)
+		assertAttempt1Children(t, out)
+	})
+
+	t.Run("walkback past an attempt where the caller had no children", func(t *testing.T) {
+		attempt3 := insertAttempt(t, 3, StatusRunning)
+		// "current" = attempt 3; the immediately preceding attempt 2 has no children, so the lookup must walk further back to attempt 1.
+		out, err := GetPriorAttemptChildrenByParent(ctx, run.ID, attempt3.ID, callerAttemptJobID)
+		require.NoError(t, err)
+		assertAttempt1Children(t, out)
+	})
+}

models/actions/run_list.go

@@ -0,0 +1,171 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/translation"
+	webhook_module "gitea.dev/modules/webhook"
+
+	"xorm.io/builder"
+)
+
+type RunList []*ActionRun
+
+func (runs RunList) LoadTriggerUser(ctx context.Context) error {
+	userIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
+		return run.TriggerUserID, run.TriggerUser == nil
+	})
+	users := make(map[int64]*user_model.User, len(userIDs))
+	if err := db.GetEngine(ctx).In("id", userIDs).Find(&users); err != nil {
+		return err
+	}
+	for _, run := range runs {
+		if run.TriggerUser != nil {
+			continue
+		}
+		run.TriggerUser = users[run.TriggerUserID]
+		if run.TriggerUserID < 0 {
+			run.TriggerUserID, run.TriggerUser, _ = user_model.GetPossibleUserByID(ctx, run.TriggerUserID)
+		} else if run.TriggerUser == nil {
+			run.TriggerUserID, run.TriggerUser, _ = user_model.GetPossibleUserByID(ctx, user_model.GhostUserID)
+		}
+	}
+	return nil
+}
+
+func (runs RunList) LoadRepos(ctx context.Context) error {
+	repoIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
+		return run.RepoID, run.Repo == nil
+	})
+	repos, err := repo_model.GetRepositoriesMapByIDs(ctx, repoIDs)
+	if err != nil {
+		return err
+	}
+	for _, run := range runs {
+		if run.Repo == nil {
+			run.Repo = repos[run.RepoID]
+		}
+	}
+	return nil
+}
+
+type FindRunOptions struct {
+	db.ListOptions
+	RepoID           int64
+	OwnerID          int64
+	WorkflowID       string
+	Ref              string // the commit/tag/… that caused this workflow
+	TriggerUserID    int64
+	TriggerEvent     webhook_module.HookEventType
+	Approved         bool // not util.OptionalBool, it works only when it's true
+	Status           []Status
+	ConcurrencyGroup string
+	CommitSHA        string
+}
+
+func (opts FindRunOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"`action_run`.repo_id": opts.RepoID})
+	}
+	if opts.WorkflowID != "" {
+		cond = cond.And(builder.Eq{"`action_run`.workflow_id": opts.WorkflowID})
+	}
+	if opts.TriggerUserID > 0 {
+		cond = cond.And(builder.Eq{"`action_run`.trigger_user_id": opts.TriggerUserID})
+	}
+	if opts.Approved {
+		cond = cond.And(builder.Gt{"`action_run`.approved_by": 0})
+	}
+	if len(opts.Status) > 0 {
+		cond = cond.And(builder.In("`action_run`.status", opts.Status))
+	}
+	if opts.Ref != "" {
+		cond = cond.And(builder.Eq{"`action_run`.ref": opts.Ref})
+	}
+	if opts.TriggerEvent != "" {
+		cond = cond.And(builder.Eq{"`action_run`.trigger_event": opts.TriggerEvent})
+	}
+	if opts.CommitSHA != "" {
+		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
+	}
+	return cond
+}
+
+func (opts FindRunOptions) ToJoins() []db.JoinFunc {
+	if opts.OwnerID > 0 {
+		return []db.JoinFunc{func(sess db.Engine) error {
+			sess.Join("INNER", "repository", "repository.id = repo_id AND repository.owner_id = ?", opts.OwnerID)
+			return nil
+		}}
+	}
+	return nil
+}
+
+func (opts FindRunOptions) ToOrders() string {
+	return "`action_run`.`id` DESC"
+}
+
+type StatusInfo struct {
+	Status          int
+	DisplayedStatus string
+}
+
+// GetStatusInfoList returns a slice of StatusInfo
+func GetStatusInfoList(ctx context.Context, lang translation.Locale) []StatusInfo {
+	// same as those in aggregateJobStatus
+	allStatus := []Status{StatusSuccess, StatusFailure, StatusWaiting, StatusRunning, StatusCancelling}
+	statusInfoList := make([]StatusInfo, 0, len(allStatus))
+	for _, s := range allStatus {
+		statusInfoList = append(statusInfoList, StatusInfo{
+			Status:          int(s),
+			DisplayedStatus: s.LocaleString(lang),
+		})
+	}
+	return statusInfoList
+}
+
+// GetRunBranches returns branch names for the run-list "Branch" filter.
+// Sourced from the `branch` table (indexed by repo_id) rather than DISTINCT-ing
+// `action_run.ref`, which is wildcard-matched and slow on large repos; as a side
+// effect the list reflects existing branches, not only ones that produced a run.
+func GetRunBranches(ctx context.Context, repoID int64) ([]string, error) {
+	branches := make([]string, 0, 10)
+	return branches, db.GetEngine(ctx).Table("branch").
+		Where("repo_id = ?", repoID).
+		And("is_deleted = ?", false).
+		Cols("name").
+		OrderBy("name ASC").
+		Find(&branches)
+}
+
+// GetRunWorkflowIDs returns all distinct WorkflowIDs that have at least
+// one ActionRun in the given repo.
+func GetRunWorkflowIDs(ctx context.Context, repoID int64) ([]string, error) {
+	ids := make([]string, 0, 10)
+	return ids, db.GetEngine(ctx).Table("action_run").
+		Where(builder.Eq{"repo_id": repoID}).
+		Distinct("workflow_id").
+		Cols("workflow_id").
+		Asc("workflow_id").
+		Find(&ids)
+}
+
+// GetActors returns a slice of Actors
+func GetActors(ctx context.Context, repoID int64) ([]*user_model.User, error) {
+	actors := make([]*user_model.User, 0, 10)
+
+	return actors, db.GetEngine(ctx).Where(builder.In("id", builder.Select("`action_run`.trigger_user_id").From("`action_run`").
+		GroupBy("`action_run`.trigger_user_id").
+		Where(builder.Eq{"`action_run`.repo_id": repoID}))).
+		Cols("id", "name", "full_name", "avatar", "avatar_email", "use_custom_avatar").
+		OrderBy(user_model.GetOrderByName()).
+		Find(&actors)
+}

models/actions/run_list_test.go

@@ -0,0 +1,24 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetRunWorkflowIDs(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	ids, err := GetRunWorkflowIDs(t.Context(), 4)
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"artifact.yaml", "test.yaml"}, ids)
+
+	ids, err = GetRunWorkflowIDs(t.Context(), 999999)
+	assert.NoError(t, err)
+	assert.Empty(t, ids)
+}

models/actions/run_test.go

@@ -0,0 +1,46 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+	"time"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUpdateRepoRunsNumbers(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	// update the number to a wrong one, the original is 3
+	_, err := db.GetEngine(t.Context()).ID(4).Cols("num_closed_action_runs").Update(&repo_model.Repository{
+		NumClosedActionRuns: 2,
+	})
+	assert.NoError(t, err)
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	assert.Equal(t, 4, repo.NumActionRuns)
+	assert.Equal(t, 2, repo.NumClosedActionRuns)
+
+	// now update will correct them, only num_actionr_runs and num_closed_action_runs should be updated
+	UpdateRepoRunsNumbers(t.Context(), repo.ID)
+	repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	assert.Equal(t, 4, repo.NumActionRuns)
+	assert.Equal(t, 3, repo.NumClosedActionRuns)
+}
+
+func TestActionRun_Duration_NonNegative(t *testing.T) {
+	run := &ActionRun{
+		Started:          timeutil.TimeStamp(100),
+		Stopped:          timeutil.TimeStamp(200),
+		Status:           StatusSuccess,
+		PreviousDuration: -time.Hour,
+	}
+	assert.Equal(t, time.Duration(0), run.Duration())
+}

models/actions/runner.go

@@ -0,0 +1,418 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/shared/types"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+
+	"xorm.io/builder"
+)
+
+// ActionRunner represents runner machines
+//
+// It can be:
+//  1. global runner, OwnerID is 0 and RepoID is 0
+//  2. org/user level runner, OwnerID is org/user ID and RepoID is 0
+//  3. repo level runner, OwnerID is 0 and RepoID is repo ID
+//
+// Please note that it's not acceptable to have both OwnerID and RepoID to be non-zero,
+// or it will be complicated to find runners belonging to a specific owner.
+// For example, conditions like `OwnerID = 1` will also return runner {OwnerID: 1, RepoID: 1},
+// but it's a repo level runner, not an org/user level runner.
+// To avoid this, make it clear with {OwnerID: 0, RepoID: 1} for repo level runners.
+type ActionRunner struct {
+	ID          int64
+	UUID        string                 `xorm:"CHAR(36) UNIQUE"`
+	Name        string                 `xorm:"VARCHAR(255)"`
+	Version     string                 `xorm:"VARCHAR(64)"`
+	OwnerID     int64                  `xorm:"index"`
+	Owner       *user_model.User       `xorm:"-"`
+	RepoID      int64                  `xorm:"index"`
+	Repo        *repo_model.Repository `xorm:"-"`
+	Description string                 `xorm:"TEXT"`
+	Base        int                    // 0 native 1 docker 2 virtual machine
+	RepoRange   string                 // glob match which repositories could use this runner
+
+	Token     string `xorm:"-"`
+	TokenHash string `xorm:"UNIQUE"` // sha256 of token
+	TokenSalt string
+	// TokenLastEight string `xorm:"token_last_eight"` // it's unnecessary because we don't find runners by token
+
+	LastOnline timeutil.TimeStamp `xorm:"index"`
+	LastActive timeutil.TimeStamp `xorm:"index"`
+
+	// Store labels defined in state file (default: .runner file) of `act_runner`
+	AgentLabels []string `xorm:"TEXT"`
+	// Store if this is a runner that only ever get one single job assigned
+	Ephemeral bool `xorm:"ephemeral NOT NULL DEFAULT false"`
+	// Store if this runner is disabled and should not pick up new jobs
+	IsDisabled bool `xorm:"is_disabled NOT NULL DEFAULT false"`
+	// Store if this runner supports the StatusCancelling flow
+	HasCancellingSupport bool `xorm:"has_cancelling_support NOT NULL DEFAULT false"`
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
+	Deleted timeutil.TimeStamp `xorm:"deleted"`
+}
+
+const (
+	RunnerOfflineTime = time.Minute
+	RunnerIdleTime    = 10 * time.Second
+)
+
+// BelongsToOwnerName before calling, should guarantee that all attributes are loaded
+func (r *ActionRunner) BelongsToOwnerName() string {
+	if r.RepoID != 0 {
+		return r.Repo.FullName()
+	}
+	if r.OwnerID != 0 {
+		return r.Owner.Name
+	}
+	return ""
+}
+
+func (r *ActionRunner) BelongsToOwnerType() types.OwnerType {
+	if r.RepoID != 0 {
+		return types.OwnerTypeRepository
+	}
+	if r.OwnerID != 0 {
+		switch r.Owner.Type {
+		case user_model.UserTypeOrganization:
+			return types.OwnerTypeOrganization
+		case user_model.UserTypeIndividual:
+			return types.OwnerTypeIndividual
+		}
+	}
+	return types.OwnerTypeSystemGlobal
+}
+
+// if the logic here changed, you should also modify FindRunnerOptions.ToCond
+func (r *ActionRunner) Status() runnerv1.RunnerStatus {
+	if time.Since(r.LastOnline.AsTime()) > RunnerOfflineTime {
+		return runnerv1.RunnerStatus_RUNNER_STATUS_OFFLINE
+	}
+	if time.Since(r.LastActive.AsTime()) > RunnerIdleTime {
+		return runnerv1.RunnerStatus_RUNNER_STATUS_IDLE
+	}
+	return runnerv1.RunnerStatus_RUNNER_STATUS_ACTIVE
+}
+
+func (r *ActionRunner) StatusName() string {
+	return strings.ToLower(strings.TrimPrefix(r.Status().String(), "RUNNER_STATUS_"))
+}
+
+func (r *ActionRunner) StatusLocaleName(lang translation.Locale) string {
+	return lang.TrString("actions.runners.status." + r.StatusName())
+}
+
+func (r *ActionRunner) IsOnline() bool {
+	status := r.Status()
+	if status == runnerv1.RunnerStatus_RUNNER_STATUS_IDLE || status == runnerv1.RunnerStatus_RUNNER_STATUS_ACTIVE {
+		return true
+	}
+	return false
+}
+
+// EditableInContext checks if the runner is editable by the "context" owner/repo
+// ownerID == 0 and repoID == 0 means "admin" context, any runner including global runners could be edited
+// ownerID == 0 and repoID != 0 means "repo" context, any runner belonging to the given repo could be edited
+// ownerID != 0 and repoID == 0 means "owner(org/user)" context, any runner belonging to the given user/org could be edited
+// ownerID != 0 and repoID != 0 means "owner" OR "repo" context, legacy behavior, but we should forbid using it
+func (r *ActionRunner) EditableInContext(ownerID, repoID int64) bool {
+	if ownerID != 0 && repoID != 0 {
+		setting.PanicInDevOrTesting("ownerID and repoID should not be both set")
+	}
+	if ownerID == 0 && repoID == 0 {
+		return true
+	}
+	if ownerID > 0 && r.OwnerID == ownerID {
+		return true
+	}
+	return repoID > 0 && r.RepoID == repoID
+}
+
+// LoadAttributes loads the attributes of the runner
+func (r *ActionRunner) LoadAttributes(ctx context.Context) error {
+	if r.OwnerID > 0 {
+		var user user_model.User
+		has, err := db.GetEngine(ctx).ID(r.OwnerID).Get(&user)
+		if err != nil {
+			return err
+		}
+		if has {
+			r.Owner = &user
+		}
+	}
+	if r.RepoID > 0 {
+		var repo repo_model.Repository
+		has, err := db.GetEngine(ctx).ID(r.RepoID).Get(&repo)
+		if err != nil {
+			return err
+		}
+		if has {
+			r.Repo = &repo
+		}
+	}
+	return nil
+}
+
+func (r *ActionRunner) GenerateAndFillToken() {
+	r.Token, r.TokenSalt, r.TokenHash, _ = generateSaltedToken()
+}
+
+// CanMatchLabels checks whether the runner's labels can match a job's "runs-on"
+// See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idruns-on
+func (r *ActionRunner) CanMatchLabels(jobRunsOn []string) bool {
+	runnerLabelSet := container.SetOf(r.AgentLabels...)
+	return runnerLabelSet.Contains(jobRunsOn...) // match all labels
+}
+
+func init() {
+	db.RegisterModel(&ActionRunner{})
+}
+
+// FindRunnerOptions
+// ownerID == 0 and repoID == 0 means any runner including global runners
+// repoID != 0 and WithAvailable == false means any runner for the given repo
+// repoID != 0 and WithAvailable == true means any runner for the given repo, parent user/org, and global runners
+// ownerID != 0 and repoID == 0 and WithAvailable == false means any runner for the given user/org
+// ownerID != 0 and repoID == 0 and WithAvailable == true means any runner for the given user/org and global runners
+type FindRunnerOptions struct {
+	db.ListOptions
+	IDs           []int64
+	RepoID        int64
+	OwnerID       int64 // it will be ignored if RepoID is set
+	Sort          string
+	Filter        string
+	IsOnline      optional.Option[bool]
+	IsDisabled    optional.Option[bool]
+	WithAvailable bool // not only runners belong to, but also runners can be used
+}
+
+func (opts FindRunnerOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+
+	if len(opts.IDs) > 0 {
+		if len(opts.IDs) == 1 {
+			cond = cond.And(builder.Eq{"id": opts.IDs[0]})
+		} else {
+			cond = cond.And(builder.In("id", opts.IDs))
+		}
+	}
+
+	if opts.RepoID > 0 {
+		c := builder.NewCond().And(builder.Eq{"repo_id": opts.RepoID})
+		if opts.WithAvailable {
+			c = c.Or(builder.Eq{"owner_id": builder.Select("owner_id").From("repository").Where(builder.Eq{"id": opts.RepoID})})
+			c = c.Or(builder.Eq{"repo_id": 0, "owner_id": 0})
+		}
+		cond = cond.And(c)
+	} else if opts.OwnerID > 0 { // OwnerID is ignored if RepoID is set
+		c := builder.NewCond().And(builder.Eq{"owner_id": opts.OwnerID})
+		if opts.WithAvailable {
+			c = c.Or(builder.Eq{"repo_id": 0, "owner_id": 0})
+		}
+		cond = cond.And(c)
+	}
+
+	if opts.Filter != "" {
+		cond = cond.And(builder.Like{"name", opts.Filter})
+	}
+
+	if opts.IsOnline.Has() {
+		if opts.IsOnline.Value() {
+			cond = cond.And(builder.Gt{"last_online": time.Now().Add(-RunnerOfflineTime).Unix()})
+		} else {
+			cond = cond.And(builder.Lte{"last_online": time.Now().Add(-RunnerOfflineTime).Unix()})
+		}
+	}
+
+	if opts.IsDisabled.Has() {
+		cond = cond.And(builder.Eq{"is_disabled": opts.IsDisabled.Value()})
+	}
+	return cond
+}
+
+func (opts FindRunnerOptions) ToOrders() string {
+	switch opts.Sort {
+	case "online":
+		return "last_online DESC"
+	case "offline":
+		return "last_online ASC"
+	case "alphabetically":
+		return "name ASC"
+	case "reversealphabetically":
+		return "name DESC"
+	case "newest":
+		return "id DESC"
+	case "oldest":
+		return "id ASC"
+	}
+	return "last_online DESC"
+}
+
+// GetRunnerByUUID returns a runner via uuid
+func GetRunnerByUUID(ctx context.Context, uuid string) (*ActionRunner, error) {
+	var runner ActionRunner
+	has, err := db.GetEngine(ctx).Where("uuid=?", uuid).Get(&runner)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("runner with uuid %s: %w", uuid, util.ErrNotExist)
+	}
+	return &runner, nil
+}
+
+// GetRunnerByID returns a runner via id
+func GetRunnerByID(ctx context.Context, id int64) (*ActionRunner, error) {
+	var runner ActionRunner
+	has, err := db.GetEngine(ctx).Where("id=?", id).Get(&runner)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("runner with id %d: %w", id, util.ErrNotExist)
+	}
+	return &runner, nil
+}
+
+// UpdateRunner updates runner's information.
+func UpdateRunner(ctx context.Context, r *ActionRunner, cols ...string) error {
+	e := db.GetEngine(ctx)
+	r.Name = util.EllipsisDisplayString(r.Name, 255)
+	var err error
+	if len(cols) == 0 {
+		_, err = e.ID(r.ID).AllCols().Update(r)
+	} else {
+		_, err = e.ID(r.ID).Cols(cols...).Update(r)
+	}
+	return err
+}
+
+func SetRunnerDisabled(ctx context.Context, runner *ActionRunner, isDisabled bool) error {
+	if runner.IsDisabled == isDisabled {
+		return nil
+	}
+
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		runner.IsDisabled = isDisabled
+		if err := UpdateRunner(ctx, runner, "is_disabled"); err != nil {
+			return err
+		}
+		return IncreaseTaskVersion(ctx, runner.OwnerID, runner.RepoID)
+	})
+}
+
+// DeleteRunner deletes a runner by given ID.
+func DeleteRunner(ctx context.Context, id int64) error {
+	if _, err := GetRunnerByID(ctx, id); err != nil {
+		return err
+	}
+
+	_, err := db.DeleteByID[ActionRunner](ctx, id)
+	return err
+}
+
+// DeleteEphemeralRunner deletes a ephemeral runner by given ID.
+func DeleteEphemeralRunner(ctx context.Context, id int64) error {
+	runner, err := GetRunnerByID(ctx, id)
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			return nil
+		}
+		return err
+	}
+	if !runner.Ephemeral {
+		return nil
+	}
+
+	_, err = db.DeleteByID[ActionRunner](ctx, id)
+	return err
+}
+
+// CreateRunner creates new runner.
+func CreateRunner(ctx context.Context, t *ActionRunner) error {
+	if t.OwnerID != 0 && t.RepoID != 0 {
+		// It's trying to create a runner that belongs to a repository, but OwnerID has been set accidentally.
+		// Remove OwnerID to avoid confusion; it's not worth returning an error here.
+		t.OwnerID = 0
+	}
+	t.Name = util.EllipsisDisplayString(t.Name, 255)
+	return db.Insert(ctx, t)
+}
+
+func CountRunnersWithoutBelongingOwner(ctx context.Context) (int64, error) {
+	// Only affect action runners were a owner ID is set, as actions runners
+	// could also be created on a repository.
+	return db.GetEngine(ctx).Table("action_runner").
+		Join("LEFT", "`user`", "`action_runner`.owner_id = `user`.id").
+		Where("`action_runner`.owner_id != ?", 0).
+		And(builder.IsNull{"`user`.id"}).
+		Count(new(ActionRunner))
+}
+
+func FixRunnersWithoutBelongingOwner(ctx context.Context) (int64, error) {
+	subQuery := builder.Select("`action_runner`.id").
+		From("`action_runner`").
+		Join("LEFT", "`user`", "`action_runner`.owner_id = `user`.id").
+		Where(builder.Neq{"`action_runner`.owner_id": 0}).
+		And(builder.IsNull{"`user`.id"})
+	b := builder.Delete(builder.In("id", subQuery)).From("`action_runner`")
+	res, err := db.GetEngine(ctx).Exec(b)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
+func CountRunnersWithoutBelongingRepo(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Table("action_runner").
+		Join("LEFT", "`repository`", "`action_runner`.repo_id = `repository`.id").
+		Where("`action_runner`.repo_id != ?", 0).
+		And(builder.IsNull{"`repository`.id"}).
+		Count(new(ActionRunner))
+}
+
+func FixRunnersWithoutBelongingRepo(ctx context.Context) (int64, error) {
+	subQuery := builder.Select("`action_runner`.id").
+		From("`action_runner`").
+		Join("LEFT", "`repository`", "`action_runner`.repo_id = `repository`.id").
+		Where(builder.Neq{"`action_runner`.repo_id": 0}).
+		And(builder.IsNull{"`repository`.id"})
+	b := builder.Delete(builder.In("id", subQuery)).From("`action_runner`")
+	res, err := db.GetEngine(ctx).Exec(b)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
+func CountWrongRepoLevelRunners(ctx context.Context) (int64, error) {
+	var result int64
+	_, err := db.GetEngine(ctx).SQL("SELECT count(`id`) FROM `action_runner` WHERE `repo_id` > 0 AND `owner_id` > 0").Get(&result)
+	return result, err
+}
+
+func UpdateWrongRepoLevelRunners(ctx context.Context) (int64, error) {
+	result, err := db.GetEngine(ctx).Exec("UPDATE `action_runner` SET `owner_id` = 0 WHERE `repo_id` > 0 AND `owner_id` > 0")
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}

models/actions/runner_list.go

@@ -0,0 +1,65 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+)
+
+type RunnerList []*ActionRunner
+
+// GetUserIDs returns a slice of user's id
+func (runners RunnerList) GetUserIDs() []int64 {
+	return container.FilterSlice(runners, func(runner *ActionRunner) (int64, bool) {
+		return runner.OwnerID, runner.OwnerID != 0
+	})
+}
+
+func (runners RunnerList) LoadOwners(ctx context.Context) error {
+	userIDs := runners.GetUserIDs()
+	users := make(map[int64]*user_model.User, len(userIDs))
+	if err := db.GetEngine(ctx).In("id", userIDs).Find(&users); err != nil {
+		return err
+	}
+	for _, runner := range runners {
+		if runner.OwnerID > 0 && runner.Owner == nil {
+			runner.Owner = users[runner.OwnerID]
+		}
+	}
+	return nil
+}
+
+func (runners RunnerList) getRepoIDs() []int64 {
+	return container.FilterSlice(runners, func(runner *ActionRunner) (int64, bool) {
+		return runner.RepoID, runner.RepoID > 0
+	})
+}
+
+func (runners RunnerList) LoadRepos(ctx context.Context) error {
+	repoIDs := runners.getRepoIDs()
+	repos := make(map[int64]*repo_model.Repository, len(repoIDs))
+	if err := db.GetEngine(ctx).In("id", repoIDs).Find(&repos); err != nil {
+		return err
+	}
+
+	for _, runner := range runners {
+		if runner.RepoID > 0 && runner.Repo == nil {
+			runner.Repo = repos[runner.RepoID]
+		}
+	}
+	return nil
+}
+
+func (runners RunnerList) LoadAttributes(ctx context.Context) error {
+	if err := runners.LoadOwners(ctx); err != nil {
+		return err
+	}
+
+	return runners.LoadRepos(ctx)
+}

models/actions/runner_token.go

@@ -0,0 +1,121 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+)
+
+// ActionRunnerToken represents runner tokens
+//
+// It can be:
+//  1. global token, OwnerID is 0 and RepoID is 0
+//  2. org/user level token, OwnerID is org/user ID and RepoID is 0
+//  3. repo level token, OwnerID is 0 and RepoID is repo ID
+//
+// Please note that it's not acceptable to have both OwnerID and RepoID to be non-zero,
+// or it will be complicated to find tokens belonging to a specific owner.
+// For example, conditions like `OwnerID = 1` will also return token {OwnerID: 1, RepoID: 1},
+// but it's a repo level token, not an org/user level token.
+// To avoid this, make it clear with {OwnerID: 0, RepoID: 1} for repo level tokens.
+type ActionRunnerToken struct {
+	ID       int64
+	Token    string                 `xorm:"UNIQUE"`
+	OwnerID  int64                  `xorm:"index"`
+	Owner    *user_model.User       `xorm:"-"`
+	RepoID   int64                  `xorm:"index"`
+	Repo     *repo_model.Repository `xorm:"-"`
+	IsActive bool                   // true means it can be used
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
+	Deleted timeutil.TimeStamp `xorm:"deleted"`
+}
+
+func init() {
+	db.RegisterModel(new(ActionRunnerToken))
+}
+
+// GetRunnerToken returns a action runner via token
+func GetRunnerToken(ctx context.Context, token string) (*ActionRunnerToken, error) {
+	var runnerToken ActionRunnerToken
+	has, err := db.GetEngine(ctx).Where("token=?", token).Get(&runnerToken)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf(`runner token "%s...": %w`, util.TruncateRunes(token, 3), util.ErrNotExist)
+	}
+	return &runnerToken, nil
+}
+
+// UpdateRunnerToken updates runner token information.
+func UpdateRunnerToken(ctx context.Context, r *ActionRunnerToken, cols ...string) (err error) {
+	e := db.GetEngine(ctx)
+
+	if len(cols) == 0 {
+		_, err = e.ID(r.ID).AllCols().Update(r)
+	} else {
+		_, err = e.ID(r.ID).Cols(cols...).Update(r)
+	}
+	return err
+}
+
+// NewRunnerTokenWithValue creates a new active runner token and invalidate all old tokens
+// ownerID will be ignored and treated as 0 if repoID is non-zero.
+func NewRunnerTokenWithValue(ctx context.Context, ownerID, repoID int64, token string) (*ActionRunnerToken, error) {
+	if ownerID != 0 && repoID != 0 {
+		// It's trying to create a runner token that belongs to a repository, but OwnerID has been set accidentally.
+		// Remove OwnerID to avoid confusion; it's not worth returning an error here.
+		ownerID = 0
+	}
+
+	runnerToken := &ActionRunnerToken{
+		OwnerID:  ownerID,
+		RepoID:   repoID,
+		IsActive: true,
+		Token:    token,
+	}
+
+	return runnerToken, db.WithTx(ctx, func(ctx context.Context) error {
+		if _, err := db.GetEngine(ctx).Where("owner_id =? AND repo_id = ?", ownerID, repoID).Cols("is_active").Update(&ActionRunnerToken{
+			IsActive: false,
+		}); err != nil {
+			return err
+		}
+
+		_, err := db.GetEngine(ctx).Insert(runnerToken)
+		return err
+	})
+}
+
+func NewRunnerToken(ctx context.Context, ownerID, repoID int64) (*ActionRunnerToken, error) {
+	token := util.CryptoRandomString(40)
+	return NewRunnerTokenWithValue(ctx, ownerID, repoID, token)
+}
+
+// GetLatestRunnerToken returns the latest runner token
+func GetLatestRunnerToken(ctx context.Context, ownerID, repoID int64) (*ActionRunnerToken, error) {
+	if ownerID != 0 && repoID != 0 {
+		// It's trying to get a runner token that belongs to a repository, but OwnerID has been set accidentally.
+		// Remove OwnerID to avoid confusion; it's not worth returning an error here.
+		ownerID = 0
+	}
+
+	var runnerToken ActionRunnerToken
+	has, err := db.GetEngine(ctx).Where("owner_id=? AND repo_id=?", ownerID, repoID).
+		OrderBy("id DESC").Get(&runnerToken)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("runner token: %w", util.ErrNotExist)
+	}
+	return &runnerToken, nil
+}

models/actions/runner_token_test.go

@@ -0,0 +1,39 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetLatestRunnerToken(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	token := unittest.AssertExistsAndLoadBean(t, &ActionRunnerToken{ID: 3})
+	expectedToken, err := GetLatestRunnerToken(t.Context(), 1, 0)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedToken, token)
+}
+
+func TestNewRunnerToken(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	token, err := NewRunnerToken(t.Context(), 1, 0)
+	assert.NoError(t, err)
+	expectedToken, err := GetLatestRunnerToken(t.Context(), 1, 0)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedToken, token)
+}
+
+func TestUpdateRunnerToken(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	token := unittest.AssertExistsAndLoadBean(t, &ActionRunnerToken{ID: 3})
+	token.IsActive = true
+	assert.NoError(t, UpdateRunnerToken(t.Context(), token))
+	expectedToken, err := GetLatestRunnerToken(t.Context(), 1, 0)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedToken, token)
+}

models/actions/schedule.go

@@ -0,0 +1,127 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
+)
+
+// ActionSchedule represents a schedule of a workflow file
+type ActionSchedule struct {
+	ID            int64
+	Title         string
+	Specs         []string
+	RepoID        int64                  `xorm:"index"`
+	Repo          *repo_model.Repository `xorm:"-"`
+	OwnerID       int64                  `xorm:"index"`
+	WorkflowID    string
+	TriggerUserID int64
+	TriggerUser   *user_model.User `xorm:"-"`
+	Ref           string
+	CommitSHA     string
+	Event         webhook_module.HookEventType
+	EventPayload  string `xorm:"LONGTEXT"`
+	Content       []byte
+	Created       timeutil.TimeStamp `xorm:"created"`
+	Updated       timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(ActionSchedule))
+}
+
+// GetSchedulesMapByIDs returns the schedules by given id slice.
+func GetSchedulesMapByIDs(ctx context.Context, ids []int64) (map[int64]*ActionSchedule, error) {
+	schedules := make(map[int64]*ActionSchedule, len(ids))
+	if len(ids) == 0 {
+		return schedules, nil
+	}
+	return schedules, db.GetEngine(ctx).In("id", ids).Find(&schedules)
+}
+
+// CreateScheduleTask creates new schedule task.
+func CreateScheduleTask(ctx context.Context, rows []*ActionSchedule) error {
+	// Return early if there are no rows to insert
+	if len(rows) == 0 {
+		return nil
+	}
+
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		// Loop through each schedule row
+		for _, row := range rows {
+			row.Title = util.EllipsisDisplayString(row.Title, 255)
+			// Create new schedule row
+			if err := db.Insert(ctx, row); err != nil {
+				return err
+			}
+
+			// Loop through each schedule spec and create a new spec row
+			now := time.Now()
+
+			for _, spec := range row.Specs {
+				specRow := &ActionScheduleSpec{
+					RepoID:     row.RepoID,
+					ScheduleID: row.ID,
+					Spec:       spec,
+				}
+				// Parse the spec and check for errors
+				schedule, err := specRow.Parse()
+				if err != nil {
+					continue // skip to the next spec if there's an error
+				}
+
+				specRow.Next = timeutil.TimeStamp(schedule.Next(now).Unix())
+
+				// Insert the new schedule spec row
+				if err = db.Insert(ctx, specRow); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+}
+
+func DeleteScheduleTaskByRepo(ctx context.Context, id int64) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		if _, err := db.GetEngine(ctx).Delete(&ActionSchedule{RepoID: id}); err != nil {
+			return err
+		}
+
+		if _, err := db.GetEngine(ctx).Delete(&ActionScheduleSpec{RepoID: id}); err != nil {
+			return err
+		}
+
+		return nil
+	})
+}
+
+func CleanRepoScheduleTasks(ctx context.Context, repo *repo_model.Repository) ([]*ActionRunJob, error) {
+	// If actions disabled when there is schedule task, this will remove the outdated schedule tasks
+	// There is no other place we can do this because the app.ini will be changed manually
+	if err := DeleteScheduleTaskByRepo(ctx, repo.ID); err != nil {
+		return nil, fmt.Errorf("DeleteCronTaskByRepo: %v", err)
+	}
+	// cancel running cron jobs of this repository and delete old schedules
+	jobs, err := CancelPreviousJobs(
+		ctx,
+		repo.ID,
+		repo.DefaultBranch,
+		"",
+		webhook_module.HookEventSchedule,
+	)
+	if err != nil {
+		return jobs, fmt.Errorf("CancelPreviousJobs: %v", err)
+	}
+	return jobs, nil
+}

models/actions/schedule_list.go

@@ -0,0 +1,34 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"gitea.dev/models/db"
+
+	"xorm.io/builder"
+)
+
+type ScheduleList []*ActionSchedule
+
+type FindScheduleOptions struct {
+	db.ListOptions
+	RepoID  int64
+	OwnerID int64
+}
+
+func (opts FindScheduleOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+	if opts.OwnerID > 0 {
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
+	}
+
+	return cond
+}
+
+func (opts FindScheduleOptions) ToOrders() string {
+	return "`id` DESC"
+}

models/actions/schedule_spec.go

@@ -0,0 +1,73 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/timeutil"
+
+	"github.com/robfig/cron/v3"
+)
+
+// ActionScheduleSpec represents a schedule spec of a workflow file
+type ActionScheduleSpec struct {
+	ID         int64
+	RepoID     int64                  `xorm:"index"`
+	Repo       *repo_model.Repository `xorm:"-"`
+	ScheduleID int64                  `xorm:"index"`
+	Schedule   *ActionSchedule        `xorm:"-"`
+
+	// Next time the job will run, or the zero time if Cron has not been
+	// started or this entry's schedule is unsatisfiable
+	Next timeutil.TimeStamp `xorm:"index"`
+	// Prev is the last time this job was run, or the zero time if never.
+	Prev timeutil.TimeStamp
+	Spec string
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
+}
+
+// Parse parses the spec and returns a cron.Schedule
+// Unlike the default cron parser, Parse uses UTC timezone as the default if none is specified.
+func (s *ActionScheduleSpec) Parse() (cron.Schedule, error) {
+	parser := cron.NewParser(cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow | cron.Descriptor)
+	schedule, err := parser.Parse(s.Spec)
+	if err != nil {
+		return nil, err
+	}
+
+	// If the spec has specified a timezone, use it
+	if strings.HasPrefix(s.Spec, "TZ=") || strings.HasPrefix(s.Spec, "CRON_TZ=") {
+		return schedule, nil
+	}
+
+	specSchedule, ok := schedule.(*cron.SpecSchedule)
+	// If it's not a spec schedule, like "@every 5m", timezone is not relevant
+	if !ok {
+		return schedule, nil
+	}
+
+	// Set the timezone to UTC
+	specSchedule.Location = time.UTC
+	return specSchedule, nil
+}
+
+func init() {
+	db.RegisterModel(new(ActionScheduleSpec))
+}
+
+func UpdateScheduleSpec(ctx context.Context, spec *ActionScheduleSpec, cols ...string) error {
+	sess := db.GetEngine(ctx).ID(spec.ID)
+	if len(cols) > 0 {
+		sess.Cols(cols...)
+	}
+	_, err := sess.Update(spec)
+	return err
+}

models/actions/schedule_spec_list.go

@@ -0,0 +1,97 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/container"
+
+	"xorm.io/builder"
+)
+
+type SpecList []*ActionScheduleSpec
+
+func (specs SpecList) GetScheduleIDs() []int64 {
+	return container.FilterSlice(specs, func(spec *ActionScheduleSpec) (int64, bool) {
+		return spec.ScheduleID, true
+	})
+}
+
+func (specs SpecList) LoadSchedules(ctx context.Context) error {
+	scheduleIDs := specs.GetScheduleIDs()
+	schedules, err := GetSchedulesMapByIDs(ctx, scheduleIDs)
+	if err != nil {
+		return err
+	}
+	for _, spec := range specs {
+		spec.Schedule = schedules[spec.ScheduleID]
+	}
+
+	repoIDs := specs.GetRepoIDs()
+	repos, err := repo_model.GetRepositoriesMapByIDs(ctx, repoIDs)
+	if err != nil {
+		return err
+	}
+	for _, spec := range specs {
+		spec.Repo = repos[spec.RepoID]
+	}
+
+	return nil
+}
+
+func (specs SpecList) GetRepoIDs() []int64 {
+	return container.FilterSlice(specs, func(spec *ActionScheduleSpec) (int64, bool) {
+		return spec.RepoID, true
+	})
+}
+
+func (specs SpecList) LoadRepos(ctx context.Context) error {
+	repoIDs := specs.GetRepoIDs()
+	repos, err := repo_model.GetRepositoriesMapByIDs(ctx, repoIDs)
+	if err != nil {
+		return err
+	}
+	for _, spec := range specs {
+		spec.Repo = repos[spec.RepoID]
+	}
+	return nil
+}
+
+type FindSpecOptions struct {
+	db.ListOptions
+	RepoID int64
+	Next   int64
+}
+
+func (opts FindSpecOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+
+	if opts.Next > 0 {
+		cond = cond.And(builder.Lte{"next": opts.Next})
+	}
+
+	return cond
+}
+
+func (opts FindSpecOptions) ToOrders() string {
+	return "`id` DESC"
+}
+
+func FindSpecs(ctx context.Context, opts FindSpecOptions) (SpecList, int64, error) {
+	specs, total, err := db.FindAndCount[ActionScheduleSpec](ctx, opts)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	if err := SpecList(specs).LoadSchedules(ctx); err != nil {
+		return nil, 0, err
+	}
+	return specs, total, nil
+}

models/actions/schedule_spec_test.go

@@ -0,0 +1,69 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+	"time"
+
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestActionScheduleSpec_Parse(t *testing.T) {
+	// Mock the local timezone is not UTC
+	tz, err := time.LoadLocation("Asia/Shanghai")
+	require.NoError(t, err)
+	defer test.MockVariableValue(&time.Local, tz)()
+
+	now, err := time.Parse(time.RFC3339, "2024-07-31T15:47:55+08:00")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		spec    string
+		want    string
+		wantErr assert.ErrorAssertionFunc
+	}{
+		{
+			name:    "regular",
+			spec:    "0 10 * * *",
+			want:    "2024-07-31T10:00:00Z",
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "invalid",
+			spec:    "0 10 * *",
+			want:    "",
+			wantErr: assert.Error,
+		},
+		{
+			name:    "with timezone",
+			spec:    "TZ=America/New_York 0 10 * * *",
+			want:    "2024-07-31T14:00:00Z",
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "timezone irrelevant",
+			spec:    "@every 5m",
+			want:    "2024-07-31T07:52:55Z",
+			wantErr: assert.NoError,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &ActionScheduleSpec{
+				Spec: tt.spec,
+			}
+			got, err := s.Parse()
+			tt.wantErr(t, err)
+
+			if err == nil {
+				assert.Equal(t, tt.want, got.Next(now).UTC().Format(time.RFC3339))
+			}
+		})
+	}
+}

models/actions/status.go

@@ -0,0 +1,129 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"slices"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/modules/translation"
+)
+
+// Status represents the status of ActionRun, ActionRunJob, ActionTask, or ActionTaskStep
+type Status int
+
+const (
+	StatusUnknown    Status = iota // 0, consistent with runnerv1.Result_RESULT_UNSPECIFIED
+	StatusSuccess                  // 1, consistent with runnerv1.Result_RESULT_SUCCESS
+	StatusFailure                  // 2, consistent with runnerv1.Result_RESULT_FAILURE
+	StatusCancelled                // 3, consistent with runnerv1.Result_RESULT_CANCELLED
+	StatusSkipped                  // 4, consistent with runnerv1.Result_RESULT_SKIPPED
+	StatusWaiting                  // 5, isn't a runnerv1.Result
+	StatusRunning                  // 6, isn't a runnerv1.Result
+	StatusBlocked                  // 7, isn't a runnerv1.Result
+	StatusCancelling               // 8, isn't a runnerv1.Result
+)
+
+var statusNames = map[Status]string{
+	StatusUnknown:    "unknown",
+	StatusWaiting:    "waiting",
+	StatusRunning:    "running",
+	StatusSuccess:    "success",
+	StatusFailure:    "failure",
+	StatusCancelled:  "cancelled",
+	StatusCancelling: "cancelling",
+	StatusSkipped:    "skipped",
+	StatusBlocked:    "blocked",
+}
+
+// String returns the string name of the Status
+func (s Status) String() string {
+	return statusNames[s]
+}
+
+// LocaleString returns the locale string name of the Status
+func (s Status) LocaleString(lang translation.Locale) string {
+	return lang.TrString("actions.status." + s.String())
+}
+
+// IsDone returns whether the Status is final
+func (s Status) IsDone() bool {
+	return s.In(StatusSuccess, StatusFailure, StatusCancelled, StatusSkipped)
+}
+
+// HasRun returns whether the Status is a result of running
+func (s Status) HasRun() bool {
+	return s.In(StatusSuccess, StatusFailure)
+}
+
+func (s Status) IsUnknown() bool {
+	return s == StatusUnknown
+}
+
+func (s Status) IsSuccess() bool {
+	return s == StatusSuccess
+}
+
+func (s Status) IsFailure() bool {
+	return s == StatusFailure
+}
+
+func (s Status) IsCancelled() bool {
+	return s == StatusCancelled
+}
+
+func (s Status) IsSkipped() bool {
+	return s == StatusSkipped
+}
+
+func (s Status) IsWaiting() bool {
+	return s == StatusWaiting
+}
+
+func (s Status) IsRunning() bool {
+	return s == StatusRunning
+}
+
+func (s Status) IsBlocked() bool {
+	return s == StatusBlocked
+}
+
+func (s Status) IsCancelling() bool {
+	return s == StatusCancelling
+}
+
+// In returns whether s is one of the given statuses
+func (s Status) In(statuses ...Status) bool {
+	return slices.Contains(statuses, s)
+}
+
+func (s Status) AsResult() runnerv1.Result {
+	switch s {
+	case StatusSuccess:
+		return runnerv1.Result_RESULT_SUCCESS
+	case StatusFailure:
+		return runnerv1.Result_RESULT_FAILURE
+	case StatusCancelled, StatusCancelling:
+		return runnerv1.Result_RESULT_CANCELLED
+	case StatusSkipped:
+		return runnerv1.Result_RESULT_SKIPPED
+	default:
+		return runnerv1.Result_RESULT_UNSPECIFIED
+	}
+}
+
+func StatusFromResult(r runnerv1.Result) Status {
+	switch r {
+	case runnerv1.Result_RESULT_SUCCESS:
+		return StatusSuccess
+	case runnerv1.Result_RESULT_FAILURE:
+		return StatusFailure
+	case runnerv1.Result_RESULT_CANCELLED:
+		return StatusCancelled
+	case runnerv1.Result_RESULT_SKIPPED:
+		return StatusSkipped
+	default:
+		return StatusUnknown
+	}
+}

models/actions/status_test.go

@@ -0,0 +1,50 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStatusAsResult(t *testing.T) {
+	cases := []struct {
+		status Status
+		want   runnerv1.Result
+	}{
+		{StatusUnknown, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusWaiting, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusRunning, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusBlocked, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusSuccess, runnerv1.Result_RESULT_SUCCESS},
+		{StatusFailure, runnerv1.Result_RESULT_FAILURE},
+		{StatusCancelled, runnerv1.Result_RESULT_CANCELLED},
+		{StatusCancelling, runnerv1.Result_RESULT_CANCELLED},
+		{StatusSkipped, runnerv1.Result_RESULT_SKIPPED},
+	}
+
+	for _, tt := range cases {
+		assert.Equal(t, tt.want, tt.status.AsResult(), "status=%s", tt.status)
+	}
+}
+
+func TestStatusFromResult(t *testing.T) {
+	cases := []struct {
+		result runnerv1.Result
+		want   Status
+	}{
+		{runnerv1.Result_RESULT_UNSPECIFIED, StatusUnknown},
+		{runnerv1.Result_RESULT_SUCCESS, StatusSuccess},
+		{runnerv1.Result_RESULT_FAILURE, StatusFailure},
+		{runnerv1.Result_RESULT_CANCELLED, StatusCancelled},
+		{runnerv1.Result_RESULT_SKIPPED, StatusSkipped},
+	}
+
+	for _, tt := range cases {
+		assert.Equal(t, tt.want, StatusFromResult(tt.result), "result=%s", tt.result)
+	}
+}

models/actions/task.go

@@ -0,0 +1,549 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+
+	lru "github.com/hashicorp/golang-lru/v2"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"xorm.io/builder"
+)
+
+// ActionTask represents a distribution of job
+type ActionTask struct {
+	ID       int64
+	JobID    int64
+	Job      *ActionRunJob     `xorm:"-"`
+	Steps    []*ActionTaskStep `xorm:"-"`
+	Attempt  int64
+	RunnerID int64              `xorm:"index"`
+	Status   Status             `xorm:"index"`
+	Started  timeutil.TimeStamp `xorm:"index"`
+	Stopped  timeutil.TimeStamp `xorm:"index(stopped_log_expired)"`
+
+	RepoID            int64  `xorm:"index"`
+	OwnerID           int64  `xorm:"index"`
+	CommitSHA         string `xorm:"index"`
+	IsForkPullRequest bool
+
+	Token          string `xorm:"-"`
+	TokenHash      string `xorm:"UNIQUE"` // sha256 of token
+	TokenSalt      string
+	TokenLastEight string `xorm:"index token_last_eight"`
+
+	LogFilename  string     // file name of log
+	LogInStorage bool       // read log from database or from storage
+	LogLength    int64      // lines count
+	LogSize      int64      // blob size
+	LogIndexes   LogIndexes `xorm:"LONGBLOB"`                   // line number to offset
+	LogExpired   bool       `xorm:"index(stopped_log_expired)"` // files that are too old will be deleted
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated index"`
+}
+
+var successfulTokenTaskCache *lru.Cache[string, any]
+
+func init() {
+	db.RegisterModel(new(ActionTask), func() error {
+		if setting.SuccessfulTokensCacheSize > 0 {
+			var err error
+			successfulTokenTaskCache, err = lru.New[string, any](setting.SuccessfulTokensCacheSize)
+			if err != nil {
+				return fmt.Errorf("unable to allocate Task cache: %v", err)
+			}
+		} else {
+			successfulTokenTaskCache = nil
+		}
+		return nil
+	})
+}
+
+func (task *ActionTask) Duration() time.Duration {
+	return calculateDuration(task.Started, task.Stopped, task.Status, task.Updated)
+}
+
+func (task *ActionTask) IsStopped() bool {
+	return task.Stopped > 0
+}
+
+func (task *ActionTask) GetRunLink() string {
+	if task.Job == nil || task.Job.Run == nil {
+		return ""
+	}
+	return task.Job.Run.Link()
+}
+
+func (task *ActionTask) GetCommitLink() string {
+	if task.Job == nil || task.Job.Run == nil || task.Job.Run.Repo == nil {
+		return ""
+	}
+	return task.Job.Run.Repo.CommitLink(task.CommitSHA)
+}
+
+func (task *ActionTask) GetRepoName() string {
+	if task.Job == nil || task.Job.Run == nil || task.Job.Run.Repo == nil {
+		return ""
+	}
+	return task.Job.Run.Repo.FullName()
+}
+
+func (task *ActionTask) GetRepoLink() string {
+	if task.Job == nil || task.Job.Run == nil || task.Job.Run.Repo == nil {
+		return ""
+	}
+	return task.Job.Run.Repo.Link()
+}
+
+func (task *ActionTask) LoadJob(ctx context.Context) error {
+	if task.Job == nil {
+		job, err := GetRunJobByRepoAndID(ctx, task.RepoID, task.JobID)
+		if err != nil {
+			return err
+		}
+		task.Job = job
+	}
+	return nil
+}
+
+// LoadAttributes load Job Steps if not loaded
+func (task *ActionTask) LoadAttributes(ctx context.Context) error {
+	if err := task.LoadJob(ctx); err != nil {
+		return err
+	}
+
+	if err := task.Job.LoadAttributes(ctx); err != nil {
+		return err
+	}
+
+	if task.Steps == nil { // be careful, an empty slice (not nil) also means loaded
+		steps, err := GetTaskStepsByTaskID(ctx, task.ID)
+		if err != nil {
+			return err
+		}
+		task.Steps = steps
+	}
+
+	return nil
+}
+
+func (task *ActionTask) GenerateAndFillToken() {
+	task.Token, task.TokenSalt, task.TokenHash, task.TokenLastEight = generateSaltedToken()
+}
+
+func GetTaskByID(ctx context.Context, id int64) (*ActionTask, error) {
+	var task ActionTask
+	has, err := db.GetEngine(ctx).Where("id=?", id).Get(&task)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("task with id %d: %w", id, util.ErrNotExist)
+	}
+
+	return &task, nil
+}
+
+func GetRunningTaskByToken(ctx context.Context, token string) (*ActionTask, error) {
+	errNotExist := fmt.Errorf("task with token %q: %w", token, util.ErrNotExist)
+	if token == "" {
+		return nil, errNotExist
+	}
+	// A token is defined as being SHA1 sum these are 40 hexadecimal bytes long
+	if len(token) != 40 {
+		return nil, errNotExist
+	}
+	for _, x := range []byte(token) {
+		if x < '0' || (x > '9' && x < 'a') || x > 'f' {
+			return nil, errNotExist
+		}
+	}
+
+	lastEight := token[len(token)-8:]
+
+	if id := getTaskIDFromCache(token); id > 0 {
+		task := &ActionTask{
+			TokenLastEight: lastEight,
+		}
+		// Re-get the task from the db in case it has been deleted in the intervening period
+		has, err := db.GetEngine(ctx).ID(id).Get(task)
+		if err != nil {
+			return nil, err
+		}
+		if has {
+			return task, nil
+		}
+		successfulTokenTaskCache.Remove(token)
+	}
+
+	var tasks []*ActionTask
+	// Cancelling tasks are still authenticating — post-run cleanup steps need API access (artifact uploads, cache saves, etc.) before the runner finalizes the task.
+	err := db.GetEngine(ctx).Where("token_last_eight = ? AND status IN (?, ?)", lastEight, StatusRunning, StatusCancelling).Find(&tasks)
+	if err != nil {
+		return nil, err
+	} else if len(tasks) == 0 {
+		return nil, errNotExist
+	}
+
+	for _, t := range tasks {
+		tempHash := auth_model.HashToken(token, t.TokenSalt)
+		if subtle.ConstantTimeCompare([]byte(t.TokenHash), []byte(tempHash)) == 1 {
+			if successfulTokenTaskCache != nil {
+				successfulTokenTaskCache.Add(token, t.ID)
+			}
+			return t, nil
+		}
+	}
+	return nil, errNotExist
+}
+
+func makeTaskStepDisplayName(step *jobparser.Step, limit int) (name string) {
+	if step.Name != "" {
+		name = step.Name // the step has an explicit name
+	} else {
+		// for unnamed step, its "String()" method tries to get a display name by its "name", "uses",
+		// "run" or "id" (last fallback), we add the "Run " prefix for unnamed steps for better display
+		// for multi-line "run" scripts, only use the first line to match GitHub's behavior
+		// https://github.com/actions/runner/blob/66800900843747f37591b077091dd2c8cf2c1796/src/Runner.Worker/Handlers/ScriptHandler.cs#L45-L58
+		runStr, _, _ := strings.Cut(strings.TrimSpace(step.Run), "\n")
+		name = "Run " + util.IfZero(strings.TrimSpace(runStr), step.String())
+	}
+	return util.EllipsisDisplayString(name, limit) // database column has a length limit
+}
+
+func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask, bool, error) {
+	ctx, committer, err := db.TxContext(ctx)
+	if err != nil {
+		return nil, false, err
+	}
+	defer committer.Close()
+
+	e := db.GetEngine(ctx)
+
+	jobCond := builder.NewCond()
+	if runner.RepoID != 0 {
+		jobCond = builder.Eq{"repo_id": runner.RepoID}
+	} else if runner.OwnerID != 0 {
+		jobCond = builder.In("repo_id", builder.Select("`repository`.id").From("repository").
+			Join("INNER", "repo_unit", "`repository`.id = `repo_unit`.repo_id").
+			Where(builder.Eq{"`repository`.owner_id": runner.OwnerID, "`repo_unit`.type": unit.TypeActions}))
+	}
+	if jobCond.IsValid() {
+		jobCond = builder.In("run_id", builder.Select("id").From("action_run").Where(jobCond))
+	}
+
+	var jobs []*ActionRunJob
+	if err := e.Where("task_id=? AND status=? AND is_reusable_caller=?", 0, StatusWaiting, false).And(jobCond).Asc("updated", "id").Find(&jobs); err != nil {
+		return nil, false, err
+	}
+
+	// TODO: a more efficient way to filter labels
+	var job *ActionRunJob
+	log.Trace("runner labels: %v", runner.AgentLabels)
+	for _, v := range jobs {
+		if runner.CanMatchLabels(v.RunsOn) {
+			job = v
+			break
+		}
+	}
+	if job == nil {
+		return nil, false, nil
+	}
+	if err := job.LoadAttributes(ctx); err != nil {
+		return nil, false, err
+	}
+
+	now := timeutil.TimeStampNow()
+	job.Started = now
+	job.Status = StatusRunning
+
+	task := &ActionTask{
+		JobID:             job.ID,
+		Attempt:           job.Attempt,
+		RunnerID:          runner.ID,
+		Started:           now,
+		Status:            StatusRunning,
+		RepoID:            job.RepoID,
+		OwnerID:           job.OwnerID,
+		CommitSHA:         job.CommitSHA,
+		IsForkPullRequest: job.IsForkPullRequest,
+	}
+	task.GenerateAndFillToken()
+
+	workflowJob, err := job.ParseJob()
+	if err != nil {
+		return nil, false, fmt.Errorf("load job %d: %w", job.ID, err)
+	}
+
+	if _, err := e.Insert(task); err != nil {
+		return nil, false, err
+	}
+
+	task.LogFilename = logFileName(job.Run.Repo.FullName(), task.ID)
+	if err := UpdateTask(ctx, task, "log_filename"); err != nil {
+		return nil, false, err
+	}
+
+	if len(workflowJob.Steps) > 0 {
+		steps := make([]*ActionTaskStep, len(workflowJob.Steps))
+		for i, v := range workflowJob.Steps {
+			steps[i] = &ActionTaskStep{
+				Name:   makeTaskStepDisplayName(v, 255),
+				TaskID: task.ID,
+				Index:  int64(i),
+				RepoID: task.RepoID,
+				Status: StatusWaiting,
+			}
+		}
+		if _, err := e.Insert(steps); err != nil {
+			return nil, false, err
+		}
+		task.Steps = steps
+	}
+
+	job.TaskID = task.ID
+	if n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}); err != nil {
+		return nil, false, err
+	} else if n != 1 {
+		return nil, false, nil
+	}
+
+	task.Job = job
+
+	if err := committer.Commit(); err != nil {
+		return nil, false, err
+	}
+
+	return task, true, nil
+}
+
+func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
+	sess := db.GetEngine(ctx).ID(task.ID)
+	if len(cols) > 0 {
+		sess.Cols(cols...)
+	}
+	_, err := sess.Update(task)
+
+	// Automatically delete the ephemeral runner if the task is done
+	if err == nil && task.Status.IsDone() && util.SliceContainsString(cols, "status") {
+		return DeleteEphemeralRunner(ctx, task.RunnerID)
+	}
+	return err
+}
+
+// UpdateTaskByState updates the task by the state.
+// It will always update the task if the state is not final, even there is no change.
+// So it will update ActionTask.Updated to avoid the task being judged as a zombie task.
+func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.TaskState) (*ActionTask, error) {
+	stepStates := map[int64]*runnerv1.StepState{}
+	for _, v := range state.Steps {
+		stepStates[v.Id] = v
+	}
+
+	return db.WithTx2(ctx, func(ctx context.Context) (*ActionTask, error) {
+		e := db.GetEngine(ctx)
+
+		task := &ActionTask{}
+		if has, err := e.ID(state.Id).Get(task); err != nil {
+			return nil, err
+		} else if !has {
+			return nil, util.ErrNotExist
+		} else if runnerID != task.RunnerID {
+			return nil, errors.New("invalid runner for task")
+		}
+
+		if task.Status.IsDone() {
+			// the state is final, do nothing
+			return task, nil
+		}
+
+		// state.Result is not unspecified means the task is finished
+		if state.Result != runnerv1.Result_RESULT_UNSPECIFIED {
+			if task.Status == StatusCancelling {
+				// The runner may report SUCCESS/FAILURE for the cleanup phase; preserve user intent.
+				task.Status = StatusCancelled
+			} else {
+				task.Status = StatusFromResult(state.Result)
+			}
+			task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
+			if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
+				return nil, err
+			}
+			if _, err := UpdateRunJob(ctx, &ActionRunJob{
+				ID:      task.JobID,
+				RepoID:  task.RepoID,
+				Status:  task.Status,
+				Stopped: task.Stopped,
+			}, nil, "status", "stopped"); err != nil {
+				return nil, err
+			}
+		} else {
+			// Force update ActionTask.Updated to avoid the task being judged as a zombie task
+			task.Updated = timeutil.TimeStampNow()
+			if err := UpdateTask(ctx, task, "updated"); err != nil {
+				return nil, err
+			}
+		}
+
+		if err := task.LoadAttributes(ctx); err != nil {
+			return nil, err
+		}
+
+		for _, step := range task.Steps {
+			var result runnerv1.Result
+			if v, ok := stepStates[step.Index]; ok {
+				result = v.Result
+				step.LogIndex = v.LogIndex
+				step.LogLength = v.LogLength
+				step.Started = convertTimestamp(v.StartedAt)
+				step.Stopped = convertTimestamp(v.StoppedAt)
+			}
+			if result != runnerv1.Result_RESULT_UNSPECIFIED {
+				step.Status = StatusFromResult(result)
+			} else if step.Started != 0 {
+				step.Status = StatusRunning
+			}
+			if _, err := e.ID(step.ID).Update(step); err != nil {
+				return nil, err
+			}
+		}
+
+		return task, nil
+	})
+}
+
+func StopTask(ctx context.Context, taskID int64, status Status) error {
+	if !status.IsDone() && status != StatusCancelling {
+		return fmt.Errorf("cannot stop task with status %v", status)
+	}
+	e := db.GetEngine(ctx)
+
+	task := &ActionTask{}
+	if has, err := e.ID(taskID).Get(task); err != nil {
+		return err
+	} else if !has {
+		return util.ErrNotExist
+	}
+	if task.Status.IsDone() {
+		return nil
+	}
+
+	now := timeutil.TimeStampNow()
+	if status == StatusCancelling {
+		runner, err := GetRunnerByID(ctx, task.RunnerID)
+		if err != nil {
+			if !errors.Is(err, util.ErrNotExist) {
+				return err
+			}
+			status = StatusCancelled
+		} else if !runner.HasCancellingSupport {
+			status = StatusCancelled
+		}
+	}
+
+	if status == StatusCancelling {
+		task.Status = StatusCancelling
+
+		if _, err := UpdateRunJob(ctx, &ActionRunJob{
+			ID:     task.JobID,
+			RepoID: task.RepoID,
+			Status: StatusCancelling,
+		}, nil, "status"); err != nil {
+			return err
+		}
+
+		return UpdateTask(ctx, task, "status")
+	}
+
+	task.Status = status
+	task.Stopped = now
+	if _, err := UpdateRunJob(ctx, &ActionRunJob{
+		ID:      task.JobID,
+		RepoID:  task.RepoID,
+		Status:  task.Status,
+		Stopped: task.Stopped,
+	}, nil); err != nil {
+		return err
+	}
+
+	if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
+		return err
+	}
+
+	if err := task.LoadAttributes(ctx); err != nil {
+		return err
+	}
+
+	for _, step := range task.Steps {
+		if !step.Status.IsDone() {
+			step.Status = status
+			if step.Started == 0 {
+				step.Started = now
+			}
+			step.Stopped = now
+		}
+		if _, err := e.ID(step.ID).Update(step); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func FindOldTasksToExpire(ctx context.Context, olderThan timeutil.TimeStamp, limit int) ([]*ActionTask, error) {
+	e := db.GetEngine(ctx)
+
+	tasks := make([]*ActionTask, 0, limit)
+	// Check "stopped > 0" to avoid deleting tasks that are still running
+	return tasks, e.Where("stopped > 0 AND stopped < ? AND log_expired = ?", olderThan, false).
+		Limit(limit).
+		Find(&tasks)
+}
+
+func convertTimestamp(timestamp *timestamppb.Timestamp) timeutil.TimeStamp {
+	if timestamp.GetSeconds() == 0 && timestamp.GetNanos() == 0 {
+		return timeutil.TimeStamp(0)
+	}
+	return timeutil.TimeStamp(timestamp.AsTime().Unix())
+}
+
+func logFileName(repoFullName string, taskID int64) string {
+	ret := fmt.Sprintf("%s/%02x/%d.log", repoFullName, taskID%256, taskID)
+
+	if setting.Actions.LogCompression.IsZstd() {
+		ret += ".zst"
+	}
+
+	return ret
+}
+
+func getTaskIDFromCache(token string) int64 {
+	if successfulTokenTaskCache == nil {
+		return 0
+	}
+	tInterface, ok := successfulTokenTaskCache.Get(token)
+	if !ok {
+		return 0
+	}
+	t, ok := tInterface.(int64)
+	if !ok {
+		return 0
+	}
+	return t
+}

models/actions/task_list.go

@@ -0,0 +1,91 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+type TaskList []*ActionTask
+
+func (tasks TaskList) GetJobIDs() []int64 {
+	return container.FilterSlice(tasks, func(t *ActionTask) (int64, bool) {
+		return t.JobID, t.JobID != 0
+	})
+}
+
+func (tasks TaskList) LoadJobs(ctx context.Context) error {
+	jobIDs := tasks.GetJobIDs()
+	jobs := make(map[int64]*ActionRunJob, len(jobIDs))
+	if err := db.GetEngine(ctx).In("id", jobIDs).Find(&jobs); err != nil {
+		return err
+	}
+	for _, t := range tasks {
+		if t.JobID > 0 && t.Job == nil {
+			t.Job = jobs[t.JobID]
+		}
+	}
+
+	// TODO: Replace with "ActionJobList(maps.Values(jobs))" once available
+	var jobsList ActionJobList = make([]*ActionRunJob, 0, len(jobs))
+	for _, j := range jobs {
+		jobsList = append(jobsList, j)
+	}
+	return jobsList.LoadAttributes(ctx, true)
+}
+
+func (tasks TaskList) LoadAttributes(ctx context.Context) error {
+	return tasks.LoadJobs(ctx)
+}
+
+type FindTaskOptions struct {
+	db.ListOptions
+	RepoID        int64
+	JobID         int64
+	OwnerID       int64
+	CommitSHA     string
+	Status        Status
+	UpdatedBefore timeutil.TimeStamp
+	StartedBefore timeutil.TimeStamp
+	RunnerID      int64
+}
+
+func (opts FindTaskOptions) ToConds() builder.Cond {
+	cond := builder.NewCond()
+	if opts.RepoID > 0 {
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+	if opts.JobID > 0 {
+		cond = cond.And(builder.Eq{"job_id": opts.JobID})
+	}
+	if opts.OwnerID > 0 {
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
+	}
+	if opts.CommitSHA != "" {
+		cond = cond.And(builder.Eq{"commit_sha": opts.CommitSHA})
+	}
+	if opts.Status > StatusUnknown {
+		cond = cond.And(builder.Eq{"status": opts.Status})
+	}
+	if opts.UpdatedBefore > 0 {
+		cond = cond.And(builder.Lt{"updated": opts.UpdatedBefore})
+	}
+	if opts.StartedBefore > 0 {
+		cond = cond.And(builder.Lt{"started": opts.StartedBefore})
+	}
+	if opts.RunnerID > 0 {
+		cond = cond.And(builder.Eq{"runner_id": opts.RunnerID})
+	}
+	return cond
+}
+
+func (opts FindTaskOptions) ToOrders() string {
+	return "`id` DESC"
+}

models/actions/task_output.go

@@ -0,0 +1,55 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+)
+
+// ActionTaskOutput represents an output of ActionTask.
+// So the outputs are bound to a task, that means when a completed job has been rerun,
+// the outputs of the job will be reset because the task is new.
+// It's by design, to avoid the outputs of the old task to be mixed with the new task.
+type ActionTaskOutput struct {
+	ID          int64
+	TaskID      int64  `xorm:"INDEX UNIQUE(task_id_output_key)"`
+	OutputKey   string `xorm:"VARCHAR(255) UNIQUE(task_id_output_key)"`
+	OutputValue string `xorm:"MEDIUMTEXT"`
+}
+
+func init() {
+	db.RegisterModel(new(ActionTaskOutput))
+}
+
+// FindTaskOutputByTaskID returns the outputs of the task.
+func FindTaskOutputByTaskID(ctx context.Context, taskID int64) ([]*ActionTaskOutput, error) {
+	var outputs []*ActionTaskOutput
+	return outputs, db.GetEngine(ctx).Where("task_id=?", taskID).Find(&outputs)
+}
+
+// FindTaskOutputKeyByTaskID returns the keys of the outputs of the task.
+func FindTaskOutputKeyByTaskID(ctx context.Context, taskID int64) ([]string, error) {
+	var keys []string
+	return keys, db.GetEngine(ctx).Table(ActionTaskOutput{}).Where("task_id=?", taskID).Cols("output_key").Find(&keys)
+}
+
+// InsertTaskOutputIfNotExist inserts a new task output if it does not exist.
+func InsertTaskOutputIfNotExist(ctx context.Context, taskID int64, key, value string) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		sess := db.GetEngine(ctx)
+		if exist, err := sess.Exist(&ActionTaskOutput{TaskID: taskID, OutputKey: key}); err != nil {
+			return err
+		} else if exist {
+			return nil
+		}
+		_, err := sess.Insert(&ActionTaskOutput{
+			TaskID:      taskID,
+			OutputKey:   key,
+			OutputValue: value,
+		})
+		return err
+	})
+}

models/actions/task_step.go

@@ -0,0 +1,41 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"time"
+
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+)
+
+// ActionTaskStep represents a step of ActionTask
+type ActionTaskStep struct {
+	ID        int64
+	Name      string `xorm:"VARCHAR(255)"` // the step name, for display purpose only, it will be truncated if it is too long
+	TaskID    int64  `xorm:"index unique(task_index)"`
+	Index     int64  `xorm:"index unique(task_index)"`
+	RepoID    int64  `xorm:"index"`
+	Status    Status `xorm:"index"`
+	LogIndex  int64
+	LogLength int64
+	Started   timeutil.TimeStamp
+	Stopped   timeutil.TimeStamp
+	Created   timeutil.TimeStamp `xorm:"created"`
+	Updated   timeutil.TimeStamp `xorm:"updated"`
+}
+
+func (step *ActionTaskStep) Duration() time.Duration {
+	return calculateDuration(step.Started, step.Stopped, step.Status, step.Updated)
+}
+
+func init() {
+	db.RegisterModel(new(ActionTaskStep))
+}
+
+func GetTaskStepsByTaskID(ctx context.Context, taskID int64) ([]*ActionTaskStep, error) {
+	var steps []*ActionTaskStep
+	return steps, db.GetEngine(ctx).Where("task_id=?", taskID).OrderBy("`index` ASC").Find(&steps)
+}

models/actions/task_test.go

@@ -0,0 +1,308 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"strings"
+	"testing"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/timeutil"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func TestMakeTaskStepDisplayName(t *testing.T) {
+	tests := []struct {
+		name     string
+		jobStep  *jobparser.Step
+		expected string
+	}{
+		{
+			name: "explicit name",
+			jobStep: &jobparser.Step{
+				Name: "Test Step",
+			},
+			expected: "Test Step",
+		},
+		{
+			name: "uses step",
+			jobStep: &jobparser.Step{
+				Uses: "actions/checkout@v4",
+			},
+			expected: "Run actions/checkout@v4",
+		},
+		{
+			name: "single-line run",
+			jobStep: &jobparser.Step{
+				Run: "echo hello",
+			},
+			expected: "Run echo hello",
+		},
+		{
+			name: "multi-line run block scalar",
+			jobStep: &jobparser.Step{
+				Run: "\n  echo hello  \r\n  echo world  \n  ",
+			},
+			expected: "Run echo hello",
+		},
+		{
+			name: "fallback to id",
+			jobStep: &jobparser.Step{
+				ID: "step-id",
+			},
+			expected: "Run step-id",
+		},
+		{
+			name: "very long name truncated",
+			jobStep: &jobparser.Step{
+				Name: strings.Repeat("a", 300),
+			},
+			expected: strings.Repeat("a", 252) + "…",
+		},
+		{
+			name: "very long run truncated",
+			jobStep: &jobparser.Step{
+				Run: strings.Repeat("a", 300),
+			},
+			expected: "Run " + strings.Repeat("a", 248) + "…",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := makeTaskStepDisplayName(tt.jobStep, 255)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
+	newRunningTask := func(t *testing.T) (*ActionTask, *ActionRunJob) {
+		t.Helper()
+
+		run := &ActionRun{
+			Title:         "cancelling-test-run",
+			RepoID:        1,
+			OwnerID:       2,
+			WorkflowID:    "test.yaml",
+			Index:         999,
+			TriggerUserID: 2,
+			Ref:           "refs/heads/master",
+			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+			Event:         "push",
+			TriggerEvent:  "push",
+			Status:        StatusRunning,
+			Started:       timeutil.TimeStampNow(),
+		}
+		require.NoError(t, db.Insert(t.Context(), run))
+
+		job := &ActionRunJob{
+			RunID:     run.ID,
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+			Name:      "cancelling-finalization-job",
+			Attempt:   1,
+			JobID:     "cancelling-finalization-job",
+			Status:    StatusRunning,
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+
+		runner := &ActionRunner{
+			UUID:                 "runner-cancelling-supported",
+			Name:                 "runner-cancelling-supported",
+			HasCancellingSupport: true,
+		}
+		require.NoError(t, db.Insert(t.Context(), runner))
+
+		task := &ActionTask{
+			JobID:     job.ID,
+			Attempt:   1,
+			RunnerID:  runner.ID,
+			Status:    StatusRunning,
+			Started:   timeutil.TimeStampNow(),
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+		}
+		require.NoError(t, db.Insert(t.Context(), task))
+
+		job.TaskID = task.ID
+		_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+		require.NoError(t, err)
+
+		return task, job
+	}
+
+	testResult := func(t *testing.T, result runnerv1.Result) {
+		t.Helper()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		task, job := newRunningTask(t)
+		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+		assert.Equal(t, StatusCancelling, taskAfterStop.Status)
+
+		updatedTask, err := UpdateTaskByState(t.Context(), task.RunnerID, &runnerv1.TaskState{
+			Id:        task.ID,
+			Result:    result,
+			StoppedAt: timestamppb.Now(),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, StatusCancelled, updatedTask.Status)
+
+		taskAfterUpdate := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+		assert.Equal(t, StatusCancelled, taskAfterUpdate.Status)
+
+		jobAfterUpdate := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+		assert.Equal(t, StatusCancelled, jobAfterUpdate.Status)
+	}
+
+	t.Run("runner reports success", func(t *testing.T) {
+		testResult(t, runnerv1.Result_RESULT_SUCCESS)
+	})
+
+	t.Run("runner reports failure", func(t *testing.T) {
+		testResult(t, runnerv1.Result_RESULT_FAILURE)
+	})
+}
+
+func TestStopTaskCancellingFallsBackForLegacyRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "legacy-cancelling-job",
+		Attempt:   1,
+		JobID:     "legacy-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-legacy-no-cancelling",
+		Name:                 "runner-legacy-no-cancelling",
+		HasCancellingSupport: false,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+	require.NoError(t, err)
+
+	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
+}
+
+func TestStopTaskCancellingFallsBackForMissingRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "missing-runner-cancelling-job",
+		Attempt:   1,
+		JobID:     "missing-runner-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-cleaned-up-before-cancel",
+		Name:                 "runner-cleaned-up-before-cancel",
+		HasCancellingSupport: true,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+	require.NoError(t, err)
+
+	_, err = db.DeleteByID[ActionRunner](t.Context(), runner.ID)
+	require.NoError(t, err)
+
+	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
+}

models/actions/tasks_version.go

@@ -0,0 +1,101 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+)
+
+// ActionTasksVersion
+// If both ownerID and repoID is zero, its scope is global.
+// If ownerID is not zero and repoID is zero, its scope is org (there is no user-level runner currently).
+// If ownerID is zero and repoID is not zero, its scope is repo.
+type ActionTasksVersion struct {
+	ID          int64 `xorm:"pk autoincr"`
+	OwnerID     int64 `xorm:"UNIQUE(owner_repo)"`
+	RepoID      int64 `xorm:"INDEX UNIQUE(owner_repo)"`
+	Version     int64
+	CreatedUnix timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(ActionTasksVersion))
+}
+
+func GetTasksVersionByScope(ctx context.Context, ownerID, repoID int64) (int64, error) {
+	var tasksVersion ActionTasksVersion
+	has, err := db.GetEngine(ctx).Where("owner_id = ? AND repo_id = ?", ownerID, repoID).Get(&tasksVersion)
+	if err != nil {
+		return 0, err
+	} else if !has {
+		return 0, nil
+	}
+	return tasksVersion.Version, err
+}
+
+func insertTasksVersion(ctx context.Context, ownerID, repoID int64) (*ActionTasksVersion, error) {
+	tasksVersion := &ActionTasksVersion{
+		OwnerID: ownerID,
+		RepoID:  repoID,
+		Version: 1,
+	}
+	if _, err := db.GetEngine(ctx).Insert(tasksVersion); err != nil {
+		return nil, err
+	}
+	return tasksVersion, nil
+}
+
+func increaseTasksVersionByScope(ctx context.Context, ownerID, repoID int64) error {
+	result, err := db.GetEngine(ctx).Exec("UPDATE action_tasks_version SET version = version + 1 WHERE owner_id = ? AND repo_id = ?", ownerID, repoID)
+	if err != nil {
+		return err
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+
+	if affected == 0 {
+		// if update sql does not affect any rows, the database may be broken,
+		// so re-insert the row of version data here.
+		if _, err := insertTasksVersion(ctx, ownerID, repoID); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func IncreaseTaskVersion(ctx context.Context, ownerID, repoID int64) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		// 1. increase global
+		if err := increaseTasksVersionByScope(ctx, 0, 0); err != nil {
+			log.Error("IncreaseTasksVersionByScope(Global): %v", err)
+			return err
+		}
+
+		// 2. increase owner
+		if ownerID > 0 {
+			if err := increaseTasksVersionByScope(ctx, ownerID, 0); err != nil {
+				log.Error("IncreaseTasksVersionByScope(Owner): %v", err)
+				return err
+			}
+		}
+
+		// 3. increase repo
+		if repoID > 0 {
+			if err := increaseTasksVersionByScope(ctx, 0, repoID); err != nil {
+				log.Error("IncreaseTasksVersionByScope(Repo): %v", err)
+				return err
+			}
+		}
+
+		return nil
+	})
+}

models/actions/token_permissions.go

@@ -0,0 +1,60 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+)
+
+// ComputeTaskTokenPermissions computes the effective permissions for a job token against the target repository.
+// It uses the job's stored permissions (if any), then applies org/repo clamps and fork/cross-repo restrictions.
+// Note: target repository access policy checks are enforced in GetActionsUserRepoPermission; this function only computes the job token's effective permission ceiling.
+func ComputeTaskTokenPermissions(ctx context.Context, task *ActionTask, targetRepo *repo_model.Repository) (ret repo_model.ActionsTokenPermissions, err error) {
+	if err := task.LoadJob(ctx); err != nil {
+		return ret, err
+	}
+	if err := task.Job.LoadRepo(ctx); err != nil {
+		return ret, err
+	}
+	runRepo := task.Job.Repo
+
+	if err := runRepo.LoadOwner(ctx); err != nil {
+		return ret, err
+	}
+
+	repoActionsCfg := runRepo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
+	ownerActionsCfg, err := GetOwnerActionsConfig(ctx, runRepo.OwnerID)
+	if err != nil {
+		return ret, err
+	}
+
+	var jobDeclaredPerms repo_model.ActionsTokenPermissions
+	if task.Job.TokenPermissions != nil {
+		jobDeclaredPerms = *task.Job.TokenPermissions
+	} else if repoActionsCfg.OverrideOwnerConfig {
+		jobDeclaredPerms = repoActionsCfg.GetDefaultTokenPermissions()
+	} else {
+		jobDeclaredPerms = ownerActionsCfg.GetDefaultTokenPermissions()
+	}
+
+	var effectivePerms repo_model.ActionsTokenPermissions
+	if repoActionsCfg.OverrideOwnerConfig {
+		effectivePerms = repoActionsCfg.ClampPermissions(jobDeclaredPerms)
+	} else {
+		effectivePerms = ownerActionsCfg.ClampPermissions(jobDeclaredPerms)
+	}
+
+	// Cross-repository access and fork pull requests are strictly read-only for security.
+	// This ensures a "task repo" cannot gain write access to other repositories via CrossRepoAccess settings.
+	isSameRepo := task.Job.RepoID == targetRepo.ID
+	restrictCrossRepoAccess := task.IsForkPullRequest || !isSameRepo
+	if restrictCrossRepoAccess {
+		effectivePerms = repo_model.ClampActionsTokenPermissions(effectivePerms, repo_model.MakeRestrictedPermissions())
+	}
+
+	return effectivePerms, nil
+}

models/actions/utils.go

@@ -0,0 +1,110 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"time"
+
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+)
+
+func generateSaltedToken() (string, string, string, string) {
+	salt := util.CryptoRandomString(10)
+	buf := util.CryptoRandomBytes(20)
+	token := hex.EncodeToString(buf)
+	hash := auth_model.HashToken(token, salt)
+	return token, salt, hash, token[len(token)-8:]
+}
+
+/*
+LogIndexes is the index for mapping log line number to buffer offset.
+Because it uses varint encoding, it is impossible to predict its size.
+But we can make a simple estimate with an assumption that each log line has 200 byte, then:
+| lines     | file size           | index size         |
+|-----------|---------------------|--------------------|
+| 100       | 20 KiB(20000)       | 258 B(258)         |
+| 1000      | 195 KiB(200000)     | 2.9 KiB(2958)      |
+| 10000     | 1.9 MiB(2000000)    | 34 KiB(34715)      |
+| 100000    | 19 MiB(20000000)    | 386 KiB(394715)    |
+| 1000000   | 191 MiB(200000000)  | 4.1 MiB(4323626)   |
+| 10000000  | 1.9 GiB(2000000000) | 47 MiB(49323626)   |
+| 100000000 | 19 GiB(20000000000) | 490 MiB(513424280) |
+*/
+type LogIndexes []int64
+
+func (indexes *LogIndexes) FromDB(b []byte) error {
+	reader := bytes.NewReader(b)
+	for {
+		v, err := binary.ReadVarint(reader)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return nil
+			}
+			return fmt.Errorf("binary ReadVarint: %w", err)
+		}
+		*indexes = append(*indexes, v)
+	}
+}
+
+func (indexes *LogIndexes) ToDB() ([]byte, error) {
+	buf, i := make([]byte, binary.MaxVarintLen64*len(*indexes)), 0
+	for _, v := range *indexes {
+		n := binary.PutVarint(buf[i:], v)
+		i += n
+	}
+	return buf[:i], nil
+}
+
+var timeSince = time.Since
+
+// calculateDuration computes wall time for a run, job, task, or step. When status is terminal
+// but stopped is missing or inconsistent with started, fallbackEnd (typically the row Updated
+// time) is used so duration still reflects approximate elapsed time instead of 0 or a negative.
+func calculateDuration(started, stopped timeutil.TimeStamp, status Status, fallbackEnd timeutil.TimeStamp) time.Duration {
+	if started == 0 {
+		return 0
+	}
+	s := started.AsTime()
+	if status.IsDone() {
+		end := stopped
+		if stopped.IsZero() || stopped < started {
+			if !fallbackEnd.IsZero() && fallbackEnd >= started {
+				end = fallbackEnd
+			} else {
+				log.Trace("actions: invalid duration timestamps (started=%d, stopped=%d, fallbackEnd=%d, status=%s)", started, stopped, fallbackEnd, status)
+				return 0
+			}
+		}
+		return end.AsTime().Sub(s)
+	}
+	return timeSince(s).Truncate(time.Second)
+}
+
+// best effort function to convert an action schedule to action run, to be used in GenerateGiteaContext
+func (s *ActionSchedule) ToActionRun() *ActionRun {
+	return &ActionRun{
+		Title:         s.Title,
+		RepoID:        s.RepoID,
+		Repo:          s.Repo,
+		OwnerID:       s.OwnerID,
+		WorkflowID:    s.WorkflowID,
+		TriggerUserID: s.TriggerUserID,
+		TriggerUser:   s.TriggerUser,
+		Ref:           s.Ref,
+		CommitSHA:     s.CommitSHA,
+		Event:         s.Event,
+		EventPayload:  s.EventPayload,
+		Created:       s.Created,
+		Updated:       s.Updated,
+	}
+}

models/actions/utils_test.go

@@ -0,0 +1,129 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"math"
+	"testing"
+	"time"
+
+	"gitea.dev/modules/timeutil"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLogIndexes_ToDB(t *testing.T) {
+	tests := []struct {
+		indexes LogIndexes
+	}{
+		{
+			indexes: []int64{1, 2, 0, -1, -2, math.MaxInt64, math.MinInt64},
+		},
+	}
+	for _, tt := range tests {
+		t.Run("", func(t *testing.T) {
+			got, err := tt.indexes.ToDB()
+			require.NoError(t, err)
+
+			indexes := LogIndexes{}
+			require.NoError(t, indexes.FromDB(got))
+
+			assert.Equal(t, tt.indexes, indexes)
+		})
+	}
+}
+
+func Test_calculateDuration(t *testing.T) {
+	oldTimeSince := timeSince
+	defer func() {
+		timeSince = oldTimeSince
+	}()
+
+	timeSince = func(t time.Time) time.Duration {
+		return timeutil.TimeStamp(1000).AsTime().Sub(t)
+	}
+	type args struct {
+		started     timeutil.TimeStamp
+		stopped     timeutil.TimeStamp
+		status      Status
+		fallbackEnd timeutil.TimeStamp
+	}
+	tests := []struct {
+		name string
+		args args
+		want time.Duration
+	}{
+		{
+			name: "unknown",
+			args: args{
+				started: 0,
+				stopped: 0,
+				status:  StatusUnknown,
+			},
+			want: 0,
+		},
+		{
+			name: "running",
+			args: args{
+				started: 500,
+				stopped: 0,
+				status:  StatusRunning,
+			},
+			want: 500 * time.Second,
+		},
+		{
+			name: "done",
+			args: args{
+				started: 500,
+				stopped: 600,
+				status:  StatusSuccess,
+			},
+			want: 100 * time.Second,
+		},
+		{
+			name: "done_stopped_zero_no_fallback",
+			args: args{
+				started: 500,
+				stopped: 0,
+				status:  StatusSuccess,
+			},
+			want: 0,
+		},
+		{
+			name: "done_stopped_zero_uses_fallback",
+			args: args{
+				started:     500,
+				stopped:     0,
+				status:      StatusSuccess,
+				fallbackEnd: 600,
+			},
+			want: 100 * time.Second,
+		},
+		{
+			name: "done_stopped_before_started_no_fallback",
+			args: args{
+				started: 600,
+				stopped: 550,
+				status:  StatusSuccess,
+			},
+			want: 0,
+		},
+		{
+			name: "done_stopped_before_started_uses_fallback",
+			args: args{
+				started:     600,
+				stopped:     550,
+				status:      StatusSuccess,
+				fallbackEnd: 650,
+			},
+			want: 50 * time.Second,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, calculateDuration(tt.args.started, tt.args.stopped, tt.args.status, tt.args.fallbackEnd), "calculateDuration(%v, %v, %v, %v)", tt.args.started, tt.args.stopped, tt.args.status, tt.args.fallbackEnd)
+		})
+	}
+}

models/actions/variable.go

@@ -0,0 +1,184 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"strings"
+	"unicode/utf8"
+
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+
+	"xorm.io/builder"
+)
+
+// ActionVariable represents a variable that can be used in actions
+//
+// It can be:
+//  1. global variable, OwnerID is 0 and RepoID is 0
+//  2. org/user level variable, OwnerID is org/user ID and RepoID is 0
+//  3. repo level variable, OwnerID is 0 and RepoID is repo ID
+//
+// Please note that it's not acceptable to have both OwnerID and RepoID to be non-zero,
+// or it will be complicated to find variables belonging to a specific owner.
+// For example, conditions like `OwnerID = 1` will also return variable {OwnerID: 1, RepoID: 1},
+// but it's a repo level variable, not an org/user level variable.
+// To avoid this, make it clear with {OwnerID: 0, RepoID: 1} for repo level variables.
+type ActionVariable struct {
+	ID          int64              `xorm:"pk autoincr"`
+	OwnerID     int64              `xorm:"UNIQUE(owner_repo_name)"`
+	RepoID      int64              `xorm:"INDEX UNIQUE(owner_repo_name)"`
+	Name        string             `xorm:"UNIQUE(owner_repo_name) NOT NULL"`
+	Data        string             `xorm:"LONGTEXT NOT NULL"`
+	Description string             `xorm:"TEXT"`
+	CreatedUnix timeutil.TimeStamp `xorm:"created NOT NULL"`
+	UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
+}
+
+const (
+	VariableDataMaxLength        = 65536
+	VariableDescriptionMaxLength = 4096
+)
+
+func init() {
+	db.RegisterModel(new(ActionVariable))
+}
+
+func InsertVariable(ctx context.Context, ownerID, repoID int64, name, data, description string) (*ActionVariable, error) {
+	if ownerID != 0 && repoID != 0 {
+		// It's trying to create a variable that belongs to a repository, but OwnerID has been set accidentally.
+		// Remove OwnerID to avoid confusion; it's not worth returning an error here.
+		ownerID = 0
+	}
+
+	if utf8.RuneCountInString(data) > VariableDataMaxLength {
+		return nil, util.NewInvalidArgumentErrorf("data too long")
+	}
+
+	description = util.TruncateRunes(description, VariableDescriptionMaxLength)
+
+	variable := &ActionVariable{
+		OwnerID:     ownerID,
+		RepoID:      repoID,
+		Name:        strings.ToUpper(name),
+		Data:        data,
+		Description: description,
+	}
+	return variable, db.Insert(ctx, variable)
+}
+
+type FindVariablesOpts struct {
+	db.ListOptions
+	IDs     []int64
+	RepoID  int64
+	OwnerID int64 // it will be ignored if RepoID is set
+	Name    string
+}
+
+func (opts FindVariablesOpts) ToConds() builder.Cond {
+	cond := builder.NewCond()
+
+	if len(opts.IDs) > 0 {
+		if len(opts.IDs) == 1 {
+			cond = cond.And(builder.Eq{"id": opts.IDs[0]})
+		} else {
+			cond = cond.And(builder.In("id", opts.IDs))
+		}
+	}
+
+	// Since we now support instance-level variables,
+	// there is no need to check for null values for `owner_id` and `repo_id`
+	cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	if opts.RepoID != 0 { // if RepoID is set
+		// ignore OwnerID and treat it as 0
+		cond = cond.And(builder.Eq{"owner_id": 0})
+	} else {
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
+	}
+
+	if opts.Name != "" {
+		cond = cond.And(builder.Eq{"name": strings.ToUpper(opts.Name)})
+	}
+	return cond
+}
+
+func FindVariables(ctx context.Context, opts FindVariablesOpts) ([]*ActionVariable, error) {
+	return db.Find[ActionVariable](ctx, opts)
+}
+
+func UpdateVariableCols(ctx context.Context, variable *ActionVariable, cols ...string) (bool, error) {
+	if utf8.RuneCountInString(variable.Data) > VariableDataMaxLength {
+		return false, util.NewInvalidArgumentErrorf("data too long")
+	}
+
+	variable.Description = util.TruncateRunes(variable.Description, VariableDescriptionMaxLength)
+
+	variable.Name = strings.ToUpper(variable.Name)
+	count, err := db.GetEngine(ctx).
+		ID(variable.ID).
+		Cols(cols...).
+		Update(variable)
+	return count != 0, err
+}
+
+func DeleteVariable(ctx context.Context, id int64) error {
+	if _, err := db.DeleteByID[ActionVariable](ctx, id); err != nil {
+		return err
+	}
+	return nil
+}
+
+func GetVariablesOfRun(ctx context.Context, run *ActionRun) (map[string]string, error) {
+	variables := map[string]string{}
+
+	if err := run.LoadRepo(ctx); err != nil {
+		log.Error("LoadRepo: %v", err)
+		return nil, err
+	}
+
+	// Global
+	globalVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{})
+	if err != nil {
+		log.Error("find global variables: %v", err)
+		return nil, err
+	}
+
+	// Org / User level
+	ownerVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{OwnerID: run.Repo.OwnerID})
+	if err != nil {
+		log.Error("find variables of org: %d, error: %v", run.Repo.OwnerID, err)
+		return nil, err
+	}
+
+	// Repo level
+	repoVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{RepoID: run.RepoID})
+	if err != nil {
+		log.Error("find variables of repo: %d, error: %v", run.RepoID, err)
+		return nil, err
+	}
+
+	// Level precedence: Repo > Org / User > Global
+	for _, v := range append(globalVariables, append(ownerVariables, repoVariables...)...) {
+		variables[v.Name] = v.Data
+	}
+
+	return variables, nil
+}
+
+func CountWrongRepoLevelVariables(ctx context.Context) (int64, error) {
+	var result int64
+	_, err := db.GetEngine(ctx).SQL("SELECT count(`id`) FROM `action_variable` WHERE `repo_id` > 0 AND `owner_id` > 0").Get(&result)
+	return result, err
+}
+
+func UpdateWrongRepoLevelVariables(ctx context.Context) (int64, error) {
+	result, err := db.GetEngine(ctx).Exec("UPDATE `action_variable` SET `owner_id` = 0 WHERE `repo_id` > 0 AND `owner_id` > 0")
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}