@trebired/git-host 2.0.0 → 2.2.0

package/dist/core/forge_actions.js

@@ -0,0 +1,1470 @@
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { GitHostError } from "../errors.js";
+import { text } from "../utils/text.js";
+import { uploadArtifact, downloadArtifact } from "./actions/artifacts.js";
+import { resolveWorkflowBoolean, resolveWorkflowString } from "./actions/expressions.js";
+import { materializeJobWorkspace, runShellCommand, setupRuntime } from "./actions/local_runner.js";
+import { normalizeEnv } from "./actions/normalize.js";
+import { assertAcyclicWorkflow, planWorkflowJobs, resolveRefName } from "./actions/planner.js";
+import { createRunRedactor } from "./actions/redaction.js";
+import { publishReleaseAsset } from "./actions/release_assets.js";
+import { resolveActionsWorkspaceRoot, resolveReleaseAssetsRoot } from "./actions/workspace.js";
+import { listRepositoryWorkflows, matchesWorkflowTrigger, readRepositoryWorkflow, resolveRepositoryWorkflowRoot } from "./actions/workflows.js";
+import { runGit } from "./run_git.js";
+const ACTIVITY_LISTENER_SYMBOL = Symbol.for("@trebired/git-host/actions-activity-listeners");
+const ACTIVITY_WRAPPED_SYMBOL = Symbol.for("@trebired/git-host/actions-activity-wrapped");
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 1000;
+const DEFAULT_LOCAL_RUNNER_LABELS = [
+    "bun",
+    "linux",
+    "local",
+    "node",
+    "ubuntu",
+    "ubuntu-22.04",
+    "ubuntu-latest",
+];
+const TERMINAL_RUN_STATUSES = new Set(["cancelled", "failed", "skipped", "success"]);
+const TERMINAL_JOB_STATUSES = new Set(["cancelled", "failed", "skipped", "success"]);
+function nowIso() {
+    return new Date().toISOString();
+}
+function isTerminalRunStatus(status) {
+    return TERMINAL_RUN_STATUSES.has(status);
+}
+function isTerminalJobStatus(status) {
+    return TERMINAL_JOB_STATUSES.has(status);
+}
+function ensureActionsStorage(storage) {
+    if (!storage) {
+        throw new GitHostError("forge_actions_not_configured", "Actions storage is required to use repository workflows.");
+    }
+    return storage;
+}
+function normalizeRunner(options) {
+    const runner = options?.runner || {};
+    const labels = Array.isArray(options?.localRunnerLabels) && options?.localRunnerLabels.length
+        ? options.localRunnerLabels.map((entry) => text(entry)).filter(Boolean)
+        : DEFAULT_LOCAL_RUNNER_LABELS;
+    return {
+        capabilities: Array.isArray(runner.capabilities)
+            ? runner.capabilities.map((entry) => text(entry)).filter(Boolean)
+            : ["artifacts", "env", "expressions", "matrix", "needs", "secrets", "socket-events", "snapshot", "uses"],
+        host: text(runner.host, "local-host"),
+        id: text(runner.id, "local-runner"),
+        kind: text(runner.kind, "local"),
+        labels,
+        platform_version: text(runner.platform_version, "@trebired/git-host"),
+    };
+}
+function aggregateJobStatus(statuses) {
+    if (statuses.some((status) => status === "failed"))
+        return "failed";
+    if (statuses.some((status) => status === "cancelled"))
+        return "cancelled";
+    if (statuses.every((status) => status === "skipped"))
+        return "skipped";
+    if (statuses.every((status) => status === "success"))
+        return "success";
+    return "queued";
+}
+function normalizeTriggerContext(input) {
+    return input && typeof input === "object" ? { ...input } : {};
+}
+function resolveGithubRef(run) {
+    if (text(run.ref).startsWith("refs/"))
+        return text(run.ref);
+    if (run.branch)
+        return `refs/heads/${run.branch}`;
+    return text(run.ref, "HEAD");
+}
+function buildExpressionContext(input) {
+    const githubRef = resolveGithubRef(input.run);
+    const eventName = input.run.trigger_kind === "manual" ? "workflow_dispatch" : input.run.trigger_kind;
+    return {
+        env: {
+            ...(input.execution.env || {}),
+            ...(input.extraEnv || {}),
+        },
+        github: {
+            actor: text(input.execution.actor?.id, input.run.created_by),
+            event: {
+                ...input.triggerContext,
+                inputs: input.execution.inputs,
+            },
+            event_name: eventName,
+            ref: githubRef,
+            ref_name: resolveRefName(githubRef),
+            repository: input.run.repository_id,
+            run_id: input.run.id,
+            sha: input.run.commit_hash,
+            workflow: input.workflow.name,
+            workflow_ref: input.run.workflow_id,
+        },
+        job: {
+            status: "queued",
+        },
+        ...(input.matrix ? { matrix: input.matrix } : {}),
+        ...(input.needs ? { needs: input.needs } : {}),
+        secrets: input.execution.secrets,
+    };
+}
+function resolveEnvLayer(layer, context) {
+    if (!layer)
+        return {};
+    const next = {};
+    for (const [key, value] of Object.entries(layer)) {
+        const envContext = {
+            ...context,
+            env: {
+                ...(context.env || {}),
+                ...next,
+            },
+        };
+        next[key] = resolveWorkflowString(value, envContext);
+    }
+    return next;
+}
+function mergeRuntimeEnv(input) {
+    let env = {
+        ...process.env,
+        ...(input.actions?.env || {}),
+        ...(input.execution.env || {}),
+    };
+    let context = buildExpressionContext({
+        execution: input.execution,
+        extraEnv: env,
+        ...(input.matrix ? { matrix: input.matrix } : {}),
+        run: input.run,
+        triggerContext: input.triggerContext,
+        workflow: input.workflow,
+    });
+    env = {
+        ...env,
+        ...resolveEnvLayer(input.workflow.env, context),
+    };
+    context = {
+        ...context,
+        env,
+    };
+    env = {
+        ...env,
+        ...resolveEnvLayer(input.jobEnv, context),
+    };
+    context = {
+        ...context,
+        env,
+    };
+    env = {
+        ...env,
+        ...resolveEnvLayer(input.stepEnv, context),
+        ...(input.execution.secrets || {}),
+    };
+    return env;
+}
+function validateDispatchInputs(workflow, provided) {
+    const inputs = workflow.on?.workflow_dispatch?.inputs || [];
+    const next = {};
+    for (const input of inputs) {
+        const value = provided?.[input.name];
+        if (value === undefined || value === null || value === "") {
+            if (input.default !== undefined) {
+                next[input.name] = input.default;
+                continue;
+            }
+            if (input.required) {
+                throw new GitHostError("forge_invalid_workflow_definition", `Manual workflow input "${input.name}" is required.`, {
+                    input: input.name,
+                    workflowId: workflow.id,
+                });
+            }
+            continue;
+        }
+        if (input.type === "boolean") {
+            if (typeof value === "boolean") {
+                next[input.name] = value;
+                continue;
+            }
+            if (value === "true" || value === "false") {
+                next[input.name] = value === "true";
+                continue;
+            }
+            throw new GitHostError("forge_invalid_workflow_definition", `Manual workflow input "${input.name}" must be a boolean.`, {
+                input: input.name,
+                value,
+            });
+        }
+        next[input.name] = String(value);
+    }
+    return next;
+}
+function createGitForgeActionsRuntime(options) {
+    const storage = ensureActionsStorage(options.storage);
+    const runListeners = new Map();
+    const runSequences = new Map();
+    const runExecutionContexts = new Map();
+    const queuedRuns = [];
+    const activeRuns = new Map();
+    const runner = normalizeRunner(options.actions);
+    let processing = false;
+    async function nextRunSequence(runId) {
+        const current = runSequences.get(runId);
+        if (Number.isFinite(current)) {
+            const next = Number(current) + 1;
+            runSequences.set(runId, next);
+            return next;
+        }
+        const existing = await storage.listWorkflowRunEvents(runId);
+        const next = existing.length + 1;
+        runSequences.set(runId, next);
+        return next;
+    }
+    async function emitRunEvent(run, input) {
+        const event = await storage.appendWorkflowRunEvent({
+            ...input,
+            created_at: nowIso(),
+            id: randomUUID(),
+            repository_id: run.repository_id,
+            run_id: run.id,
+            sequence: await nextRunSequence(run.id),
+            workflow_id: run.workflow_id,
+        });
+        const listeners = Array.from(runListeners.get(run.id) || []);
+        await Promise.all(listeners.map(async (listener) => {
+            try {
+                await listener(event);
+            }
+            catch { }
+        }));
+        return event;
+    }
+    async function readRepositoryPath(repositoryId) {
+        const summary = await options.gitHost.readSummary(repositoryId);
+        return summary.repository.path;
+    }
+    async function resolveCommit(repositoryPath, refInput) {
+        const ref = text(refInput, "HEAD");
+        const res = await runGit(["rev-parse", ref], { cwd: repositoryPath });
+        if (!res.ok) {
+            throw new GitHostError("git_command_failed", text(res.stderr, `Failed to resolve ref "${ref}".`), {
+                ref,
+                repositoryPath,
+            });
+        }
+        return text(res.stdout);
+    }
+    async function resolveRunTarget(repositoryId, input) {
+        const summary = await options.gitHost.readSummary(repositoryId);
+        const repositoryPath = summary.repository.path;
+        const branch = text(input.branch, summary.repository.current_branch) || null;
+        const ref = text(input.ref, branch || "HEAD");
+        const commitHash = text(input.commitHash) || await resolveCommit(repositoryPath, ref);
+        return {
+            branch,
+            commitHash,
+            ref,
+            repositoryPath,
+        };
+    }
+    async function readRequiredRun(repositoryId, runId) {
+        const run = await storage.readWorkflowRun(repositoryId, runId);
+        if (!run) {
+            throw new GitHostError("forge_resource_not_found", `Workflow run "${runId}" was not found.`, {
+                repositoryId,
+                runId,
+            });
+        }
+        return run;
+    }
+    async function updateRun(repositoryId, runId, input) {
+        const run = await storage.updateWorkflowRun(repositoryId, runId, input);
+        if (!run) {
+            throw new GitHostError("forge_resource_not_found", `Workflow run "${runId}" was not found.`, {
+                repositoryId,
+                runId,
+            });
+        }
+        return run;
+    }
+    async function updateJob(runId, jobRunId, input) {
+        const job = await storage.updateWorkflowRunJob(runId, jobRunId, input);
+        if (!job) {
+            throw new GitHostError("forge_resource_not_found", `Workflow job run "${jobRunId}" was not found.`, {
+                jobRunId,
+                runId,
+            });
+        }
+        return job;
+    }
+    async function updateStep(runId, stepId, input) {
+        const step = await storage.updateWorkflowRunStep(runId, stepId, input);
+        if (!step) {
+            throw new GitHostError("forge_resource_not_found", `Workflow run step "${stepId}" was not found.`, {
+                runId,
+                stepId,
+            });
+        }
+        return step;
+    }
+    async function readWorkflowAtRef(repositoryId, repositoryPath, ref, workflowId) {
+        const workflowRoot = await resolveRepositoryWorkflowRoot(options.actions, repositoryId);
+        return await readRepositoryWorkflow({
+            ref,
+            repositoryId,
+            repositoryPath,
+            workflowId,
+            workflowRoot,
+        });
+    }
+    async function resolveExecutionContext(repositoryId, workflow, input) {
+        const resolved = options.actions?.resolveExecutionContext
+            ? await options.actions.resolveExecutionContext({
+                actor: input.actor,
+                repositoryId,
+                runInput: input,
+                triggerContext: input.triggerContext,
+                triggerKind: input.triggerKind,
+                workflow,
+            })
+            : null;
+        const manualExecution = input.executionContext || {};
+        return {
+            ...(resolved?.actor || manualExecution.actor ? { actor: { ...(resolved?.actor || {}), ...(manualExecution.actor || {}) } } : {}),
+            env: normalizeEnv({
+                ...(resolved?.env || {}),
+                ...(manualExecution.env || {}),
+                ...(input.env || {}),
+            }) || {},
+            inputs: validateDispatchInputs(workflow, input.inputs),
+            ...(resolved?.metadata || manualExecution.metadata ? { metadata: { ...(resolved?.metadata || {}), ...(manualExecution.metadata || {}) } } : {}),
+            secrets: normalizeEnv({
+                ...(resolved?.secrets || {}),
+                ...(manualExecution.secrets || {}),
+                ...(input.secrets || {}),
+            }) || {},
+        };
+    }
+    async function markQueuedStepsForJob(runId, jobRunId, status) {
+        const steps = await storage.listWorkflowRunSteps(runId, {
+            jobRunId,
+        });
+        const now = nowIso();
+        await Promise.all(steps
+            .filter((step) => step.status === "queued")
+            .map((step) => storage.updateWorkflowRunStep(runId, step.id, {
+            finished_at: now,
+            status,
+        })));
+    }
+    async function markQueuedJobsAndSteps(runId, status) {
+        const jobs = await storage.listWorkflowRunJobs(runId);
+        const now = nowIso();
+        await Promise.all(jobs.map(async (job) => {
+            if (job.status === "queued") {
+                await storage.updateWorkflowRunJob(runId, job.id, {
+                    finished_at: now,
+                    status,
+                    summary: status === "cancelled" ? "Cancelled before starting." : "Skipped before starting.",
+                });
+            }
+            await markQueuedStepsForJob(runId, job.id, status === "cancelled" ? "cancelled" : "skipped");
+        }));
+    }
+    async function finalizeRun(run, input) {
+        const finished = await updateRun(run.repository_id, run.id, {
+            current_job: null,
+            current_job_id: null,
+            current_step: null,
+            current_step_index: null,
+            finished_at: nowIso(),
+            status: input.status,
+            summary: input.summary,
+        });
+        await emitRunEvent(finished, {
+            status: input.status,
+            summary: input.summary,
+            type: input.eventType,
+        });
+        return finished;
+    }
+    async function resolveConcurrencyGroup(repositoryId, workflow, input, runTarget, execution) {
+        if (!workflow.concurrency?.group)
+            return null;
+        const temporaryRun = {
+            branch: runTarget.branch,
+            commit_hash: runTarget.commitHash,
+            created_at: nowIso(),
+            created_by: text(input.actor.id, "system"),
+            current_step: null,
+            current_step_index: null,
+            finished_at: null,
+            id: "pending",
+            ref: runTarget.ref,
+            repository_id: repositoryId,
+            runner: null,
+            started_at: null,
+            status: "queued",
+            summary: "",
+            trigger_context: input.triggerContext,
+            trigger_kind: input.triggerKind,
+            workflow_id: workflow.id,
+        };
+        const context = buildExpressionContext({
+            execution,
+            run: temporaryRun,
+            triggerContext: input.triggerContext,
+            workflow,
+        });
+        return resolveWorkflowString(workflow.concurrency.group, context);
+    }
+    async function cancelConflictingRuns(repositoryId, runId, concurrencyGroup, actor) {
+        const active = await storage.listWorkflowRuns(repositoryId, {
+            status: ["queued", "running", "starting"],
+        });
+        for (const entry of active) {
+            if (entry.id === runId)
+                continue;
+            if (text(entry.concurrency_group) !== text(concurrencyGroup))
+                continue;
+            await runtime.cancelWorkflowRun(repositoryId, entry.id, actor);
+        }
+    }
+    async function queueWorkflowRun(repositoryId, workflow, input) {
+        assertAcyclicWorkflow(workflow);
+        const triggerContext = normalizeTriggerContext(input.triggerContext);
+        const target = await resolveRunTarget(repositoryId, input);
+        const createdAt = nowIso();
+        const createdBy = text(input.actor.id, text(input.actor.name, "system"));
+        const execution = await resolveExecutionContext(repositoryId, workflow, {
+            ...input,
+            triggerContext,
+        });
+        const concurrencyGroup = await resolveConcurrencyGroup(repositoryId, workflow, {
+            ...input,
+            triggerContext,
+        }, target, execution);
+        const run = await storage.createWorkflowRun({
+            branch: target.branch,
+            commit_hash: target.commitHash,
+            ...(workflow.concurrency ? { concurrency_cancel_in_progress: workflow.concurrency.cancel_in_progress === true } : {}),
+            ...(concurrencyGroup ? { concurrency_group: concurrencyGroup } : {}),
+            created_at: createdAt,
+            created_by: createdBy,
+            current_job: null,
+            current_job_id: null,
+            current_step: null,
+            current_step_index: null,
+            execution_context: {
+                ...(execution.actor ? { actor: execution.actor } : {}),
+                env: execution.env,
+                inputs: execution.inputs,
+                ...(execution.metadata ? { metadata: execution.metadata } : {}),
+                secret_names: Object.keys(execution.secrets),
+            },
+            finished_at: null,
+            id: randomUUID(),
+            ref: target.ref,
+            release_id: text(triggerContext.release_id) || null,
+            repository_id: repositoryId,
+            runner: null,
+            started_at: null,
+            status: "queued",
+            summary: "Workflow run queued.",
+            trigger_context: {
+                ...triggerContext,
+                event_name: input.triggerKind === "manual" ? "workflow_dispatch" : input.triggerKind,
+                inputs: execution.inputs,
+                workflow_definition_path: workflow.definition_path,
+            },
+            trigger_kind: input.triggerKind,
+            workflow_id: workflow.id,
+        });
+        const plannedJobs = planWorkflowJobs(workflow);
+        for (const plannedJob of plannedJobs) {
+            const jobRun = await storage.createWorkflowRunJob({
+                current_step: null,
+                current_step_index: null,
+                finished_at: null,
+                id: randomUUID(),
+                index: plannedJob.index,
+                job_id: plannedJob.job.id,
+                ...(plannedJob.matrix ? { matrix: plannedJob.matrix } : {}),
+                name: plannedJob.name,
+                needs: plannedJob.job.needs,
+                run_id: run.id,
+                runner: null,
+                runs_on: plannedJob.job.runs_on,
+                started_at: null,
+                status: "queued",
+                summary: "Job queued.",
+            });
+            for (const [index, step] of plannedJob.job.steps.entries()) {
+                await storage.createWorkflowRunStep({
+                    command: text(step.run, step.uses),
+                    exit_code: null,
+                    finished_at: null,
+                    id: randomUUID(),
+                    index,
+                    job_run_id: jobRun.id,
+                    kind: step.kind || (step.uses ? "uses" : "shell"),
+                    metadata: {
+                        env: step.env,
+                        if: step.if,
+                        shell: step.shell,
+                        with: step.with,
+                    },
+                    name: text(step.name, `Step ${index + 1}`),
+                    output_preview: "",
+                    run_id: run.id,
+                    started_at: null,
+                    status: "queued",
+                    uses: text(step.uses) || null,
+                });
+            }
+        }
+        await emitRunEvent(run, {
+            metadata: {
+                branch: run.branch,
+                definition_path: workflow.definition_path,
+                ref: run.ref,
+            },
+            status: "queued",
+            summary: run.summary,
+            type: "run.accepted",
+        });
+        runExecutionContexts.set(run.id, execution);
+        if (run.concurrency_group && workflow.concurrency?.cancel_in_progress) {
+            await cancelConflictingRuns(repositoryId, run.id, run.concurrency_group, input.actor);
+        }
+        queuedRuns.push({
+            repositoryId,
+            runId: run.id,
+        });
+        scheduleQueueProcessing();
+        return run;
+    }
+    function scheduleQueueProcessing() {
+        if (processing)
+            return;
+        queueMicrotask(() => {
+            void processQueue();
+        });
+    }
+    function supportedRunnerLabels() {
+        return new Set(runner.labels || []);
+    }
+    function assertJobRunnerSupported(jobRun) {
+        const labels = supportedRunnerLabels();
+        const unsupported = jobRun.runs_on.filter((entry) => !labels.has(text(entry)));
+        if (unsupported.length) {
+            throw new GitHostError("forge_actions_runner_failed", `Job "${jobRun.name}" requested unsupported runner labels: ${unsupported.join(", ")}.`, {
+                jobRunId: jobRun.id,
+                labels: unsupported,
+            });
+        }
+    }
+    async function emitJobStarted(run, jobRun) {
+        await emitRunEvent(run, {
+            job_id: jobRun.job_id,
+            job_name: jobRun.name,
+            job_run_id: jobRun.id,
+            status: "running",
+            summary: `Running job ${jobRun.name}.`,
+            type: "job.started",
+        });
+    }
+    async function emitJobFinished(run, jobRun) {
+        await emitRunEvent(run, {
+            job_id: jobRun.job_id,
+            job_name: jobRun.name,
+            job_run_id: jobRun.id,
+            status: jobRun.status,
+            summary: jobRun.summary,
+            type: "job.finished",
+        });
+    }
+    async function finishStep(run, jobRun, stepRun, input) {
+        const finished = await updateStep(run.id, stepRun.id, {
+            exit_code: input.exitCode === undefined ? stepRun.exit_code : input.exitCode,
+            finished_at: nowIso(),
+            output_preview: text(input.outputPreview, stepRun.output_preview),
+            status: input.status,
+        });
+        await emitRunEvent(run, {
+            command: finished.command,
+            job_id: jobRun.job_id,
+            job_name: jobRun.name,
+            job_run_id: jobRun.id,
+            metadata: {
+                exit_code: finished.exit_code,
+            },
+            status: finished.status,
+            step_id: finished.id,
+            step_index: finished.index,
+            step_name: finished.name,
+            summary: input.summary,
+            type: "step.finished",
+        });
+        return finished;
+    }
+    async function skipJob(run, jobRun, summary) {
+        await markQueuedStepsForJob(run.id, jobRun.id, "skipped");
+        const finished = await updateJob(run.id, jobRun.id, {
+            finished_at: nowIso(),
+            status: "skipped",
+            summary,
+        });
+        await emitJobFinished(run, finished);
+        return finished;
+    }
+    async function cancelJob(run, jobRun, summary) {
+        await markQueuedStepsForJob(run.id, jobRun.id, "cancelled");
+        const finished = await updateJob(run.id, jobRun.id, {
+            finished_at: nowIso(),
+            status: "cancelled",
+            summary,
+        });
+        await emitJobFinished(run, finished);
+        return finished;
+    }
+    async function executePublishReleaseAssetStep(input) {
+        const assetName = text(input.stepWith.name);
+        const pathSpec = text(input.stepWith.path);
+        const format = text(input.stepWith.format, "tar.gz") === "zip" ? "zip" : "tar.gz";
+        if (!assetName || !pathSpec) {
+            throw new GitHostError("forge_actions_runner_failed", "actions/publish-release-asset requires with.name and with.path.", {
+                uses: input.stepRun.uses,
+            });
+        }
+        const tagName = text(input.stepWith.tag, resolveRefName(resolveGithubRef(input.run)));
+        if (!tagName) {
+            throw new GitHostError("forge_actions_runner_failed", "actions/publish-release-asset could not resolve a tag name; pass with.tag explicitly.", {
+                uses: input.stepRun.uses,
+            });
+        }
+        const { asset, release } = await publishReleaseAsset({
+            assetName,
+            format,
+            releaseAssetsRoot: resolveReleaseAssetsRoot(options.actions),
+            releaseId: text(input.run.release_id) || undefined,
+            releases: options.releases,
+            repositoryId: input.run.repository_id,
+            sourcePath: path.resolve(input.workspacePath, pathSpec),
+            tagName,
+        });
+        await emitRunEvent(input.run, {
+            job_id: input.jobRun.job_id,
+            job_name: input.jobRun.name,
+            job_run_id: input.jobRun.id,
+            metadata: {
+                asset_id: asset.id,
+                asset_name: asset.name,
+                release_id: release.id,
+                size: asset.size,
+                tag_name: release.tag_name,
+            },
+            status: "success",
+            step_id: input.stepRun.id,
+            step_index: input.stepRun.index,
+            step_name: input.stepRun.name,
+            summary: `Published release asset ${asset.name}.`,
+            type: "release_asset.published",
+        });
+        return {
+            outputPreview: `Published release asset ${asset.name} to release ${release.tag_name}.\n`,
+            summary: `Published release asset ${asset.name}.`,
+        };
+    }
+    async function executeUsesStep(input) {
+        const uses = text(input.stepRun.uses);
+        if (uses === "actions/checkout" || uses === "actions/checkout@v4") {
+            const targetRef = text(input.stepWith.ref);
+            const targetPath = text(input.stepWith.path, ".");
+            if (targetRef && targetRef !== input.run.ref && targetRef !== resolveGithubRef(input.run)) {
+                throw new GitHostError("forge_actions_runner_failed", "actions/checkout only supports the workflow snapshot ref in v1.", {
+                    requestedRef: targetRef,
+                    runRef: input.run.ref,
+                });
+            }
+            if (targetPath && targetPath !== ".") {
+                throw new GitHostError("forge_actions_runner_failed", "actions/checkout path overrides are not supported in v1.", {
+                    path: targetPath,
+                });
+            }
+            return {
+                outputPreview: "Checked out workflow snapshot.\n",
+                summary: "Checked out workflow snapshot.",
+            };
+        }
+        if (uses === "actions/setup-node" || uses === "actions/setup-node@v4") {
+            const version = await setupRuntime("node", input.workspacePath);
+            return {
+                outputPreview: text(version.stdout, version.stderr),
+                summary: "Node runtime is available.",
+            };
+        }
+        if (uses === "oven-sh/setup-bun" || uses === "oven-sh/setup-bun@v2") {
+            const version = await setupRuntime("bun", input.workspacePath);
+            return {
+                outputPreview: text(version.stdout, version.stderr),
+                summary: "Bun runtime is available.",
+            };
+        }
+        if (uses === "actions/upload-artifact" || uses === "actions/upload-artifact@v4") {
+            const artifactName = text(input.stepWith.name);
+            const pathSpec = text(input.stepWith.path);
+            if (!artifactName || !pathSpec) {
+                throw new GitHostError("forge_actions_runner_failed", "actions/upload-artifact requires with.name and with.path.", {
+                    uses,
+                });
+            }
+            const stored = uploadArtifact({
+                artifactName,
+                artifactsRoot: input.artifactsRoot,
+                pathSpec,
+                workspacePath: input.workspacePath,
+            });
+            const artifact = await storage.createWorkflowRunArtifact({
+                created_at: nowIso(),
+                file_count: stored.fileCount,
+                id: randomUUID(),
+                job_run_id: input.jobRun.id,
+                name: artifactName,
+                path: stored.path,
+                repository_id: input.run.repository_id,
+                run_id: input.run.id,
+                size: stored.size,
+                step_id: input.stepRun.id,
+            });
+            await emitRunEvent(input.run, {
+                artifact_id: artifact.id,
+                artifact_name: artifact.name,
+                job_id: input.jobRun.job_id,
+                job_name: input.jobRun.name,
+                job_run_id: input.jobRun.id,
+                metadata: {
+                    file_count: artifact.file_count,
+                    size: artifact.size,
+                },
+                status: "success",
+                step_id: input.stepRun.id,
+                step_index: input.stepRun.index,
+                step_name: input.stepRun.name,
+                summary: `Uploaded artifact ${artifact.name}.`,
+                type: "artifact.uploaded",
+            });
+            return {
+                outputPreview: `Uploaded artifact ${artifactName} (${stored.fileCount} files).\n`,
+                summary: `Uploaded artifact ${artifactName}.`,
+            };
+        }
+        if (uses === "actions/download-artifact" || uses === "actions/download-artifact@v4") {
+            const artifactName = text(input.stepWith.name);
+            if (!artifactName) {
+                throw new GitHostError("forge_actions_runner_failed", "actions/download-artifact requires with.name.", {
+                    uses,
+                });
+            }
+            const artifacts = await storage.listWorkflowRunArtifacts(input.run.id, {
+                name: artifactName,
+            });
+            const artifact = artifacts[0];
+            if (!artifact) {
+                throw new GitHostError("forge_actions_runner_failed", `Artifact "${artifactName}" was not found for this run.`, {
+                    artifactName,
+                    runId: input.run.id,
+                });
+            }
+            downloadArtifact({
+                artifact,
+                artifactsRoot: input.artifactsRoot,
+                destinationPath: text(input.stepWith.path, "."),
+                workspacePath: input.workspacePath,
+            });
+            await emitRunEvent(input.run, {
+                artifact_id: artifact.id,
+                artifact_name: artifact.name,
+                job_id: input.jobRun.job_id,
+                job_name: input.jobRun.name,
+                job_run_id: input.jobRun.id,
+                status: "success",
+                step_id: input.stepRun.id,
+                step_index: input.stepRun.index,
+                step_name: input.stepRun.name,
+                summary: `Downloaded artifact ${artifact.name}.`,
+                type: "artifact.downloaded",
+            });
+            return {
+                outputPreview: `Downloaded artifact ${artifactName}.\n`,
+                summary: `Downloaded artifact ${artifactName}.`,
+            };
+        }
+        if (uses === "actions/publish-release-asset" || uses === "actions/publish-release-asset@v1") {
+            return await executePublishReleaseAssetStep(input);
+        }
+        throw new GitHostError("forge_actions_runner_failed", `Unsupported action "${uses}".`, {
+            uses,
+        });
+    }
+    async function executeJob(input) {
+        const workflowJob = input.workflow.jobs.find((entry) => entry.id === input.jobRun.job_id);
+        if (!workflowJob) {
+            throw new GitHostError("forge_invalid_workflow_definition", `Workflow job "${input.jobRun.job_id}" no longer exists.`, {
+                jobId: input.jobRun.job_id,
+                workflowId: input.workflow.id,
+            });
+        }
+        const baseContext = buildExpressionContext({
+            execution: input.execution,
+            ...(input.jobRun.matrix ? { matrix: input.jobRun.matrix } : {}),
+            needs: input.needs,
+            run: input.run,
+            triggerContext: normalizeTriggerContext(input.run.trigger_context),
+            workflow: input.workflow,
+        });
+        const dependencyStatus = Object.values(input.needs).map((entry) => entry.result);
+        if (!workflowJob.if && dependencyStatus.some((status) => status !== "success")) {
+            return await skipJob(input.run, input.jobRun, "Skipped because a dependency did not complete successfully.");
+        }
+        if (workflowJob.if && !resolveWorkflowBoolean(workflowJob.if, baseContext, true)) {
+            return await skipJob(input.run, input.jobRun, `Skipped by if condition for job ${input.jobRun.name}.`);
+        }
+        if (input.activeState.cancelRequested) {
+            return await cancelJob(input.run, input.jobRun, "Cancelled before job start.");
+        }
+        try {
+            assertJobRunnerSupported(input.jobRun);
+        }
+        catch (error) {
+            await markQueuedStepsForJob(input.run.id, input.jobRun.id, "skipped");
+            const failedJob = await updateJob(input.run.id, input.jobRun.id, {
+                finished_at: nowIso(),
+                status: "failed",
+                summary: error instanceof Error ? error.message : `Job ${input.jobRun.name} failed before start.`,
+            });
+            await emitJobFinished(input.run, failedJob);
+            return failedJob;
+        }
+        const workspaceRoot = resolveActionsWorkspaceRoot(options.actions, input.run.repository_id, input.run.id);
+        const workspacePath = path.join(workspaceRoot, "jobs", input.jobRun.id, "workspace");
+        await materializeJobWorkspace({
+            commitHash: input.run.commit_hash,
+            repositoryPath: input.repositoryPath,
+            workspacePath,
+        });
+        let jobRun = await updateJob(input.run.id, input.jobRun.id, {
+            runner,
+            started_at: nowIso(),
+            status: "running",
+            summary: `Running job ${input.jobRun.name}.`,
+        });
+        await updateRun(input.run.repository_id, input.run.id, {
+            current_job: jobRun.name,
+            current_job_id: jobRun.id,
+            status: "running",
+            summary: `Running job ${jobRun.name}.`,
+        });
+        await emitJobStarted(input.run, jobRun);
+        const stepRuns = await storage.listWorkflowRunSteps(input.run.id, {
+            jobRunId: jobRun.id,
+        });
+        for (const stepRun of stepRuns) {
+            if (input.activeState.cancelRequested) {
+                await finishStep(input.run, jobRun, stepRun, {
+                    status: "cancelled",
+                    summary: `Cancelled before step ${stepRun.name}.`,
+                });
+                continue;
+            }
+            const stepContext = {
+                ...baseContext,
+                env: mergeRuntimeEnv({
+                    actions: options.actions,
+                    execution: input.execution,
+                    jobEnv: workflowJob.env,
+                    ...(input.jobRun.matrix ? { matrix: input.jobRun.matrix } : {}),
+                    run: input.run,
+                    stepEnv: normalizeEnv(stepRun.metadata?.env),
+                    triggerContext: normalizeTriggerContext(input.run.trigger_context),
+                    workflow: input.workflow,
+                }),
+                job: {
+                    status: jobRun.status,
+                },
+            };
+            const stepIf = text(stepRun.metadata?.if);
+            if (stepIf && !resolveWorkflowBoolean(stepIf, stepContext, true)) {
+                await finishStep(input.run, jobRun, stepRun, {
+                    status: "skipped",
+                    summary: `Skipped step ${stepRun.name}.`,
+                });
+                continue;
+            }
+            const redactor = createRunRedactor(options.actions, input.run, stepRun, input.execution.secrets);
+            const resolvedCommand = stepRun.kind === "shell"
+                ? resolveWorkflowString(stepRun.command, stepContext)
+                : resolveWorkflowString(text(stepRun.uses), stepContext);
+            const startedStep = await updateStep(input.run.id, stepRun.id, {
+                started_at: nowIso(),
+                status: "running",
+            });
+            jobRun = await updateJob(input.run.id, jobRun.id, {
+                current_step: startedStep.name,
+                current_step_index: startedStep.index,
+            });
+            await updateRun(input.run.repository_id, input.run.id, {
+                current_job: jobRun.name,
+                current_job_id: jobRun.id,
+                current_step: startedStep.name,
+                current_step_index: startedStep.index,
+                status: "running",
+                summary: `Running ${jobRun.name} / ${startedStep.name}.`,
+            });
+            await emitRunEvent(input.run, {
+                command: await redactor(resolvedCommand),
+                job_id: jobRun.job_id,
+                job_name: jobRun.name,
+                job_run_id: jobRun.id,
+                status: "running",
+                step_id: startedStep.id,
+                step_index: startedStep.index,
+                step_name: startedStep.name,
+                type: "step.started",
+            });
+            if (startedStep.kind === "uses") {
+                const resolvedWith = Object.fromEntries(Object.entries((startedStep.metadata?.with && typeof startedStep.metadata.with === "object")
+                    ? startedStep.metadata.with
+                    : {})
+                    .map(([key, value]) => [key, resolveWorkflowString(String(value), stepContext)]));
+                try {
+                    const result = await executeUsesStep({
+                        artifactsRoot: input.artifactsRoot,
+                        execution: input.execution,
+                        jobRun,
+                        run: input.run,
+                        stepWith: resolvedWith,
+                        stepRun: startedStep,
+                        workspacePath,
+                    });
+                    const preview = await redactor(result.outputPreview || "");
+                    if (preview) {
+                        await emitRunEvent(input.run, {
+                            chunk: preview,
+                            job_id: jobRun.job_id,
+                            job_name: jobRun.name,
+                            job_run_id: jobRun.id,
+                            status: "running",
+                            step_id: startedStep.id,
+                            step_index: startedStep.index,
+                            step_name: startedStep.name,
+                            stream: "stdout",
+                            type: "step.output",
+                        });
+                        await emitRunEvent(input.run, {
+                            chunk: preview,
+                            job_id: jobRun.job_id,
+                            job_name: jobRun.name,
+                            job_run_id: jobRun.id,
+                            status: "running",
+                            step_id: startedStep.id,
+                            step_index: startedStep.index,
+                            step_name: startedStep.name,
+                            stream: "stdout",
+                            type: "job.output",
+                        });
+                    }
+                    await finishStep(input.run, jobRun, startedStep, {
+                        outputPreview: preview,
+                        status: "success",
+                        summary: result.summary,
+                    });
+                    continue;
+                }
+                catch (error) {
+                    const summary = error instanceof Error ? error.message : "Action step failed.";
+                    await finishStep(input.run, jobRun, startedStep, {
+                        outputPreview: summary,
+                        status: input.activeState.cancelRequested ? "cancelled" : "failed",
+                        summary,
+                    });
+                    await markQueuedStepsForJob(input.run.id, jobRun.id, input.activeState.cancelRequested ? "cancelled" : "skipped");
+                    jobRun = await updateJob(input.run.id, jobRun.id, {
+                        current_step: null,
+                        current_step_index: null,
+                        finished_at: nowIso(),
+                        status: input.activeState.cancelRequested ? "cancelled" : "failed",
+                        summary,
+                    });
+                    await emitJobFinished(input.run, jobRun);
+                    return jobRun;
+                }
+            }
+            const shell = text(startedStep.metadata?.shell, text(options.actions?.shell, "bash"));
+            const runtimeEnv = mergeRuntimeEnv({
+                actions: options.actions,
+                execution: input.execution,
+                jobEnv: workflowJob.env,
+                ...(input.jobRun.matrix ? { matrix: input.jobRun.matrix } : {}),
+                run: input.run,
+                stepEnv: normalizeEnv(startedStep.metadata?.env),
+                triggerContext: normalizeTriggerContext(input.run.trigger_context),
+                workflow: input.workflow,
+            });
+            const result = await runShellCommand({
+                command: resolvedCommand,
+                cwd: workspacePath,
+                env: runtimeEnv,
+                heartbeatIntervalMs: Math.max(250, Number(options.actions?.heartbeatIntervalMs) || DEFAULT_HEARTBEAT_INTERVAL_MS),
+                onHeartbeat: async () => {
+                    await emitRunEvent(input.run, {
+                        job_id: jobRun.job_id,
+                        job_name: jobRun.name,
+                        job_run_id: jobRun.id,
+                        status: "running",
+                        step_id: startedStep.id,
+                        step_index: startedStep.index,
+                        step_name: startedStep.name,
+                        type: "step.heartbeat",
+                    });
+                    await emitRunEvent(input.run, {
+                        job_id: jobRun.job_id,
+                        job_name: jobRun.name,
+                        job_run_id: jobRun.id,
+                        status: "running",
+                        step_id: startedStep.id,
+                        step_index: startedStep.index,
+                        step_name: startedStep.name,
+                        type: "job.heartbeat",
+                    });
+                },
+                onOutput: async (stream, chunk) => {
+                    const redacted = await redactor(chunk, stream);
+                    await emitRunEvent(input.run, {
+                        chunk: redacted,
+                        job_id: jobRun.job_id,
+                        job_name: jobRun.name,
+                        job_run_id: jobRun.id,
+                        status: "running",
+                        step_id: startedStep.id,
+                        step_index: startedStep.index,
+                        step_name: startedStep.name,
+                        stream,
+                        type: "step.output",
+                    });
+                    await emitRunEvent(input.run, {
+                        chunk: redacted,
+                        job_id: jobRun.job_id,
+                        job_name: jobRun.name,
+                        job_run_id: jobRun.id,
+                        status: "running",
+                        step_id: startedStep.id,
+                        step_index: startedStep.index,
+                        step_name: startedStep.name,
+                        stream,
+                        type: "job.output",
+                    });
+                },
+                onSpawn: (child) => {
+                    input.activeState.child = child;
+                },
+                shell: shell || "bash",
+            });
+            const redactedPreview = await redactor(result.outputPreview);
+            if (input.activeState.cancelRequested || result.exitCode === 130) {
+                await finishStep(input.run, jobRun, startedStep, {
+                    exitCode: result.exitCode,
+                    outputPreview: redactedPreview,
+                    status: "cancelled",
+                    summary: `Cancelled during step ${startedStep.name}.`,
+                });
+                await markQueuedStepsForJob(input.run.id, jobRun.id, "cancelled");
+                jobRun = await updateJob(input.run.id, jobRun.id, {
+                    current_step: null,
+                    current_step_index: null,
+                    finished_at: nowIso(),
+                    status: "cancelled",
+                    summary: `Cancelled during job ${jobRun.name}.`,
+                });
+                await emitJobFinished(input.run, jobRun);
+                return jobRun;
+            }
+            if (result.exitCode !== 0) {
+                await finishStep(input.run, jobRun, startedStep, {
+                    exitCode: result.exitCode,
+                    outputPreview: redactedPreview,
+                    status: "failed",
+                    summary: `Failed step ${startedStep.name}.`,
+                });
+                await markQueuedStepsForJob(input.run.id, jobRun.id, "skipped");
+                jobRun = await updateJob(input.run.id, jobRun.id, {
+                    current_step: null,
+                    current_step_index: null,
+                    finished_at: nowIso(),
+                    status: "failed",
+                    summary: `Job ${jobRun.name} failed in step ${startedStep.name}.`,
+                });
+                await emitJobFinished(input.run, jobRun);
+                return jobRun;
+            }
+            await finishStep(input.run, jobRun, startedStep, {
+                exitCode: result.exitCode,
+                outputPreview: redactedPreview,
+                status: "success",
+                summary: `Completed step ${startedStep.name}.`,
+            });
+        }
+        jobRun = await updateJob(input.run.id, jobRun.id, {
+            current_step: null,
+            current_step_index: null,
+            finished_at: nowIso(),
+            status: "success",
+            summary: `Job ${jobRun.name} completed successfully.`,
+        });
+        await emitJobFinished(input.run, jobRun);
+        return jobRun;
+    }
+    async function executeRun(repositoryId, runId) {
+        let run = await readRequiredRun(repositoryId, runId);
+        if (isTerminalRunStatus(run.status))
+            return run;
+        run = await updateRun(repositoryId, runId, {
+            runner,
+            started_at: nowIso(),
+            status: "starting",
+            summary: "Preparing workflow run.",
+        });
+        await emitRunEvent(run, {
+            metadata: {
+                runner,
+            },
+            status: "starting",
+            summary: run.summary,
+            type: "run.status",
+        });
+        const repositoryPath = await readRepositoryPath(repositoryId);
+        const workflow = await readWorkflowAtRef(repositoryId, repositoryPath, run.ref, run.workflow_id);
+        const execution = runExecutionContexts.get(run.id) || {
+            actor: (run.execution_context?.actor && typeof run.execution_context.actor === "object") ? run.execution_context.actor : undefined,
+            env: normalizeEnv(run.execution_context?.env) || {},
+            inputs: (run.trigger_context?.inputs && typeof run.trigger_context.inputs === "object")
+                ? run.trigger_context.inputs
+                : {},
+            metadata: (run.execution_context?.metadata && typeof run.execution_context.metadata === "object") ? run.execution_context.metadata : undefined,
+            secrets: {},
+        };
+        const activeState = {
+            cancelRequested: false,
+            child: null,
+        };
+        activeRuns.set(run.id, activeState);
+        try {
+            const artifactsRoot = path.join(resolveActionsWorkspaceRoot(options.actions, run.repository_id, run.id), "artifacts");
+            const allJobs = await storage.listWorkflowRunJobs(run.id);
+            const pendingJobs = Array.from(allJobs).sort((left, right) => left.index - right.index);
+            const completedByJobId = new Map();
+            while (pendingJobs.length) {
+                if (activeState.cancelRequested) {
+                    await markQueuedJobsAndSteps(run.id, "cancelled");
+                    return await finalizeRun(run, {
+                        eventType: "run.cancelled",
+                        status: "cancelled",
+                        summary: "Workflow run cancelled.",
+                    });
+                }
+                const nextIndex = pendingJobs.findIndex((job) => ((job.needs || []).every((need) => {
+                    const results = completedByJobId.get(need) || [];
+                    const expected = allJobs.filter((entry) => entry.job_id === need).length;
+                    return results.length === expected && results.every((entry) => isTerminalJobStatus(entry.status));
+                })));
+                if (nextIndex < 0) {
+                    throw new GitHostError("forge_invalid_workflow_definition", `Workflow "${workflow.id}" has no runnable job order.`, {
+                        workflowId: workflow.id,
+                    });
+                }
+                const nextJob = pendingJobs.splice(nextIndex, 1)[0];
+                const needs = Object.fromEntries((nextJob.needs || []).map((need) => {
+                    const statuses = (completedByJobId.get(need) || []).map((entry) => entry.status);
+                    return [need, { result: aggregateJobStatus(statuses) }];
+                }));
+                const finishedJob = await executeJob({
+                    activeState,
+                    artifactsRoot,
+                    execution,
+                    jobRun: nextJob,
+                    needs,
+                    repositoryPath,
+                    run,
+                    workflow,
+                });
+                const existing = completedByJobId.get(finishedJob.job_id) || [];
+                existing.push(finishedJob);
+                completedByJobId.set(finishedJob.job_id, existing);
+            }
+            const jobs = await storage.listWorkflowRunJobs(run.id);
+            if (jobs.some((job) => job.status === "failed")) {
+                const failedJob = jobs.find((job) => job.status === "failed");
+                await markQueuedJobsAndSteps(run.id, "skipped");
+                return await finalizeRun(run, {
+                    eventType: "run.failed",
+                    status: "failed",
+                    summary: text(failedJob?.summary, "Workflow run failed."),
+                });
+            }
+            if (jobs.some((job) => job.status === "cancelled")) {
+                await markQueuedJobsAndSteps(run.id, "cancelled");
+                return await finalizeRun(run, {
+                    eventType: "run.cancelled",
+                    status: "cancelled",
+                    summary: "Workflow run cancelled.",
+                });
+            }
+            if (jobs.every((job) => job.status === "skipped")) {
+                return await finalizeRun(run, {
+                    eventType: "run.finished",
+                    status: "skipped",
+                    summary: "Workflow run was skipped.",
+                });
+            }
+            return await finalizeRun(run, {
+                eventType: "run.finished",
+                status: "success",
+                summary: "Workflow run completed successfully.",
+            });
+        }
+        catch (error) {
+            await markQueuedJobsAndSteps(run.id, activeState.cancelRequested ? "cancelled" : "skipped");
+            return await finalizeRun(run, {
+                eventType: activeState.cancelRequested ? "run.cancelled" : "run.failed",
+                status: activeState.cancelRequested ? "cancelled" : "failed",
+                summary: activeState.cancelRequested
+                    ? "Workflow run cancelled."
+                    : (error instanceof Error ? error.message : "Workflow run failed."),
+            });
+        }
+        finally {
+            if (activeState.child && !activeState.child.killed) {
+                try {
+                    activeState.child.kill("SIGKILL");
+                }
+                catch { }
+            }
+            activeRuns.delete(run.id);
+            runExecutionContexts.delete(run.id);
+        }
+    }
+    async function processQueue() {
+        if (processing)
+            return;
+        processing = true;
+        try {
+            while (queuedRuns.length) {
+                const next = queuedRuns.shift();
+                if (!next)
+                    continue;
+                const run = await storage.readWorkflowRun(next.repositoryId, next.runId);
+                if (!run || isTerminalRunStatus(run.status))
+                    continue;
+                await executeRun(next.repositoryId, next.runId);
+            }
+        }
+        finally {
+            processing = false;
+        }
+    }
+    async function enqueueWorkflowsForTrigger(repositoryId, triggerKind, actor, context) {
+        const target = await resolveRunTarget(repositoryId, {
+            branch: text(context.branch),
+            commitHash: text(context.commit_hash, text(context.head_commit)),
+            ref: text(context.ref, text(context.tag_name, text(context.branch, "HEAD"))),
+        });
+        const workflowRoot = await resolveRepositoryWorkflowRoot(options.actions, repositoryId);
+        const workflows = await listRepositoryWorkflows({
+            filters: {
+                enabled: true,
+            },
+            ref: target.ref,
+            repositoryId,
+            repositoryPath: target.repositoryPath,
+            workflowRoot,
+        });
+        const createdRuns = [];
+        for (const workflow of workflows) {
+            if (!matchesWorkflowTrigger(workflow, triggerKind, context))
+                continue;
+            createdRuns.push(await queueWorkflowRun(repositoryId, workflow, {
+                actor,
+                branch: target.branch || undefined,
+                commitHash: target.commitHash,
+                ref: target.ref,
+                triggerContext: context,
+                triggerKind,
+            }));
+        }
+        return createdRuns;
+    }
+    async function handleActivity(entry) {
+        const actor = {
+            id: text(entry.actor_id, text(entry.actor_label, "system")),
+            name: text(entry.actor_label, entry.actor_id),
+        };
+        if (entry.kind === "repository.push") {
+            await enqueueWorkflowsForTrigger(entry.repository_id, "push", actor, {
+                ...(entry.metadata || {}),
+                activity_id: entry.id,
+            });
+            return;
+        }
+        if (entry.kind === "release.create" || entry.kind === "release.update") {
+            const releaseId = text(entry.metadata?.release_id);
+            const release = releaseId ? await options.releases.readRelease(entry.repository_id, releaseId) : null;
+            const targetRef = text(release?.target_ref);
+            const repositoryPath = await readRepositoryPath(entry.repository_id);
+            const commitHash = targetRef ? await resolveCommit(repositoryPath, targetRef) : "";
+            await enqueueWorkflowsForTrigger(entry.repository_id, entry.kind, actor, {
+                ...(entry.metadata || {}),
+                activity_id: entry.id,
+                commit_hash: commitHash,
+                ref: text(release?.tag_name, targetRef),
+                release_id: release?.id,
+                tag_name: text(release?.tag_name, text(entry.metadata?.tag_name)),
+            });
+        }
+    }
+    function bindActivityStorage(activityStorage) {
+        const store = activityStorage;
+        if (!store[ACTIVITY_LISTENER_SYMBOL]) {
+            store[ACTIVITY_LISTENER_SYMBOL] = new Set();
+        }
+        store[ACTIVITY_LISTENER_SYMBOL].add(async (entry) => {
+            await handleActivity(entry);
+        });
+        if (store[ACTIVITY_WRAPPED_SYMBOL])
+            return;
+        store[ACTIVITY_WRAPPED_SYMBOL] = true;
+        const original = activityStorage.createActivity.bind(activityStorage);
+        activityStorage.createActivity = async (input) => {
+            const entry = await original(input);
+            const listeners = Array.from(store[ACTIVITY_LISTENER_SYMBOL] || []);
+            await Promise.all(listeners.map(async (listener) => {
+                try {
+                    await listener(entry);
+                }
+                catch { }
+            }));
+            return entry;
+        };
+    }
+    const runtime = {
+        bindActivityStorage,
+        async listWorkflows(repositoryId, filters) {
+            const repositoryPath = await readRepositoryPath(repositoryId);
+            const workflowRoot = await resolveRepositoryWorkflowRoot(options.actions, repositoryId);
+            return await listRepositoryWorkflows({
+                filters,
+                repositoryId,
+                repositoryPath,
+                workflowRoot,
+            });
+        },
+        async readWorkflow(repositoryId, workflowId) {
+            const repositoryPath = await readRepositoryPath(repositoryId);
+            return await readWorkflowAtRef(repositoryId, repositoryPath, undefined, workflowId);
+        },
+        async runWorkflow(repositoryId, workflowId, input) {
+            const target = await resolveRunTarget(repositoryId, input);
+            const workflow = await readWorkflowAtRef(repositoryId, target.repositoryPath, target.ref, workflowId);
+            if (!workflow.on?.workflow_dispatch && workflow.trigger !== "manual") {
+                throw new GitHostError("forge_invalid_workflow_definition", `Workflow "${workflowId}" does not support manual dispatch.`, {
+                    workflowId,
+                });
+            }
+            return await queueWorkflowRun(repositoryId, workflow, {
+                ...input,
+                branch: target.branch || undefined,
+                commitHash: target.commitHash,
+                ref: target.ref,
+                triggerKind: "manual",
+            });
+        },
+        async cancelWorkflowRun(repositoryId, runId, actor) {
+            const run = await readRequiredRun(repositoryId, runId);
+            if (isTerminalRunStatus(run.status))
+                return run;
+            const active = activeRuns.get(run.id);
+            await emitRunEvent(run, {
+                metadata: {
+                    actor_id: actor.id,
+                },
+                status: "running",
+                summary: `Cancellation requested by ${text(actor.id)}.`,
+                type: "run.cancellation_requested",
+            });
+            if (active) {
+                active.cancelRequested = true;
+                if (active.child && !active.child.killed) {
+                    try {
+                        active.child.kill("SIGTERM");
+                    }
+                    catch { }
+                }
+                return await updateRun(repositoryId, runId, {
+                    summary: `Cancellation requested by ${text(actor.id)}.`,
+                });
+            }
+            await markQueuedJobsAndSteps(run.id, "cancelled");
+            const cancelled = await updateRun(repositoryId, runId, {
+                finished_at: nowIso(),
+                status: "cancelled",
+                summary: `Cancelled by ${text(actor.id)}.`,
+            });
+            await emitRunEvent(cancelled, {
+                status: "cancelled",
+                summary: cancelled.summary,
+                type: "run.cancelled",
+            });
+            return cancelled;
+        },
+        async listWorkflowRuns(repositoryId, filters) {
+            return await storage.listWorkflowRuns(repositoryId, filters);
+        },
+        async readWorkflowRun(repositoryId, runId) {
+            return await readRequiredRun(repositoryId, runId);
+        },
+        async listWorkflowRunJobs(repositoryId, runId, filters) {
+            await readRequiredRun(repositoryId, runId);
+            return await storage.listWorkflowRunJobs(runId, filters);
+        },
+        async listWorkflowRunSteps(repositoryId, runId, filters) {
+            await readRequiredRun(repositoryId, runId);
+            return await storage.listWorkflowRunSteps(runId, filters);
+        },
+        async listWorkflowRunArtifacts(repositoryId, runId, filters) {
+            await readRequiredRun(repositoryId, runId);
+            return await storage.listWorkflowRunArtifacts(runId, filters);
+        },
+        async listWorkflowRunEvents(repositoryId, runId, filters) {
+            await readRequiredRun(repositoryId, runId);
+            return await storage.listWorkflowRunEvents(runId, filters);
+        },
+        subscribeWorkflowRun(repositoryId, runId, listener) {
+            void repositoryId;
+            let listeners = runListeners.get(runId);
+            if (!listeners) {
+                listeners = new Set();
+                runListeners.set(runId, listeners);
+            }
+            listeners.add(listener);
+            return {
+                close() {
+                    listeners?.delete(listener);
+                    if (listeners && listeners.size === 0) {
+                        runListeners.delete(runId);
+                    }
+                },
+            };
+        },
+    };
+    return runtime;
+}
+export { createGitForgeActionsRuntime, isTerminalRunStatus };
+//# sourceMappingURL=forge_actions.js.map