feat(actions): support $/ prefix in reusable workflow uses: (#38822)

Fixes: https://github.com/go-gitea/gitea/issues/38818

Accepts GitHub's `$/` self-repository prefix in a reusable workflow
`uses:`, alongside `./`.

Gitea's `./` already resolves against the caller's own source repo and
commit, which is what `$/` means, so the two are aliases here. Cycle
detection folds both prefixes onto one key.

Related PR for step-level support:
https://gitea.com/gitea/runner/pulls/1150

services/actions/reusable_workflow.go

@@ -55,7 +55,7 @@ func loadReusableWorkflowSource(ctx context.Context, run *actions_model.ActionRu
 
 	switch ref.Kind {
 	case jobparser.UsesKindLocalSameRepo:
-		// `./` is resolved against the workflow file containing the `uses:` - i.e. the caller's own source repo + commit.
+		// `./` and `$/` are resolved against the workflow file containing the `uses:` - i.e. the caller's own source repo + commit.
 		callerRepo, err := repo_model.GetRepositoryByID(ctx, caller.WorkflowSourceRepoID)
 		if err != nil {
 			return nil, 0, "", fmt.Errorf("look up caller source repo %d: %w", caller.WorkflowSourceRepoID, err)
@@ -115,7 +115,7 @@ func readWorkflowFromRepo(ctx context.Context, repo *repo_model.Repository, refO
 //   - rejects cycles (caller.CallUses appearing in any ancestor's CallUses)
 //   - enforces MaxReusableCallLevels on the number of ancestors above `caller`
 //
-// Cycle detection is intentionally *syntactic* (string equality on CallUses), not semantic.
+// Cycle detection is intentionally *syntactic* (string equality on canonicalCallUses), not semantic.
 // So `owner/repo/lib.yml@v1` and `owner/repo/lib.yml@refs/heads/v1` resolving to the same commit are NOT treated as the same node.
 // Going semantic (Owner, Repo, Path, ResolvedSHA tuples) would require extra git reads.
 func checkCallerChain(ctx context.Context, caller *actions_model.ActionRunJob) error {
@@ -123,8 +123,7 @@ func checkCallerChain(ctx context.Context, caller *actions_model.ActionRunJob) e
 		return nil // top-level caller: depth 0, no ancestors to walk
 	}
 
-	visited := make(container.Set[string])
-	visited.Add(caller.CallUses)
+	visited := container.SetOf(canonicalCallUses(caller.CallUses))
 
 	depth := 0
 	current := caller
@@ -138,16 +137,21 @@ func checkCallerChain(ctx context.Context, caller *actions_model.ActionRunJob) e
 		if depth > MaxReusableCallLevels {
 			return fmt.Errorf("reusable workflow call exceeds the maximum nesting level of %d at %q", MaxReusableCallLevels, caller.CallUses)
 		}
-		if current.IsReusableCaller && current.CallUses != "" {
-			if visited.Contains(current.CallUses) {
-				return fmt.Errorf("reusable workflow call cycle detected: %q", current.CallUses)
-			}
-			visited.Add(current.CallUses)
+		if current.IsReusableCaller && current.CallUses != "" && !visited.Add(canonicalCallUses(current.CallUses)) {
+			return fmt.Errorf("reusable workflow call cycle detected: %q", current.CallUses)
 		}
 	}
 	return nil
 }
 
+// canonicalCallUses folds the two same-repo prefixes into one key, because `$/x.yml` and `./x.yml` name the same file.
+func canonicalCallUses(uses string) string {
+	if ref, err := jobparser.ParseUses(uses); err == nil && ref.Kind == jobparser.UsesKindLocalSameRepo {
+		return "./" + ref.Path
+	}
+	return uses
+}
+
 // expandReusableWorkflowCaller loads and parses the target reusable workflow and inserts the caller's direct child jobs.
 // It expands only ONE level: a child that is itself a reusable caller is inserted Blocked and expanded later by a subsequent resolver pass.
 // It does NOT schedule a follow-up resolver pass; the caller of this function is responsible for emitting.

services/actions/reusable_workflow_test.go

@@ -42,6 +42,17 @@ func TestCheckCallerChain_Cycle(t *testing.T) {
 		assert.ErrorContains(t, err, "cycle detected")
 	})
 
+	t.Run("MixedPrefixCycle", func(t *testing.T) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		// A -> A written with both same-repo prefixes: they name the same file.
+		chain := buildCallerChain(t,
+			"./.gitea/workflows/a.yml",
+			"$/.gitea/workflows/a.yml",
+		)
+		err := checkCallerChain(t.Context(), chain[len(chain)-1])
+		assert.ErrorContains(t, err, "cycle detected")
+	})
+
 	t.Run("NoCycle", func(t *testing.T) {
 		require.NoError(t, unittest.PrepareTestDatabase())
 		// Sanity: linear chain with distinct CallUses must not trip cycle detection.