Complete runner context and support action defaults

[gjkim42]

What type of PR is this?

/kind bug

What this PR does / why we need it:

Completes the documented GitHub Actions runner context and makes it available while evaluating action metadata input defaults.

Open Actions now supplies:

• runner.name from the assigned Kubernetes Runner resource, with the matching trusted RUNNER_NAME default variable.
• runner.os, runner.arch, runner.temp, and runner.tool_cache from the existing execution environment.
• runner.environment as self-hosted, with matching RUNNER_ENVIRONMENT, because Open Actions executes on user-managed infrastructure.
• runner.debug and RUNNER_DEBUG as 1 when the ACTIONS_STEP_DEBUG Project secret or variable enables debug mode. The Secret takes precedence.

Runner-owned values cannot be replaced by workflow environment mappings or inherited image configuration. runner.debug and RUNNER_DEBUG remain absent when debug mode is disabled, matching GitHub Actions. Matching the GitHub Actions runner, the ACTIONS_STEP_DEBUG and ACTIONS_RUNNER_DEBUG secret names are excluded from secret masking so their common value (true) does not mask logs or suppress job outputs.

Action input defaults can read the complete runner context, so standard expressions such as ${{ runner.debug == '1' }} work with actions/github-script. The runner evaluates defaults only for inputs not supplied by the workflow while still validating every metadata default when loading the action.

Coverage verifies controller-to-Pod name injection, CLI configuration, expression values, protected default variables, action-default evaluation and rejection, case-insensitive debug-secret masking exemptions, and an authenticated actions/github-script@v7 metadata fixture in normal and debug modes.

Which issue(s) this PR is related to:

Fixes #39

Special notes for your reviewer:

GitHub documents runner.debug and RUNNER_DEBUG as absent when debug logging is disabled, so this PR intentionally does not expose 0 in the disabled state. This completes the documented runner object; broader context work remains tracked by #110.

Validated with:

• make update
• make verify
• make test
• make build

Does this PR introduce a user-facing change?

Open Actions now provides the complete runner context to workflows and action input defaults, including support for actions/github-script.

[gjkim42]

/kelos claude-review

[kelos-bot]

🤖 Kelos Task Status

Task open-actions-claude-reviewer-issue-comment-b33bfe6542b5 has succeeded. ✅

[kelos-bot]

🤖 Open Actions Claude Reviewer Agent @gjkim42

Review Summary

Verdict: APPROVE
Overall correctness: patch is correct
Scope: Completes the documented runner context (name, os, arch, temp, tool_cache, environment, conditional debug), wires RUNNER_NAME from the Runner resource through the controller, derives the debug indicator from the ACTIONS_STEP_DEBUG Project secret or variable, exempts the two debug secret names from output masking, and validates every action input default at load while evaluating defaults only for inputs the workflow does not supply.

Findings Overview

Priority	Count	File:Line	Summary
P0	0	—	none
P1	0	—	none
P2	0	—	none
P3	0	—	none

Findings

No qualifying findings. The previous review's P2 is resolved: docs/reference.md:318 now documents the case-insensitive masking exemption for secrets named ACTIONS_STEP_DEBUG and ACTIONS_RUNNER_DEBUG, including the consequence that their values can appear in logs and outputs, and docs/reference.md:332 documents the ACTIONS_STEP_DEBUG value parsing and Secret-over-Variable precedence.

Suggestions (optional)

• [P3] internal/runner/workflow_commands.go:237 — Rendered ::debug:: command lines still pass through to the step log unconditionally, while GitHub shows step debug messages only when step debug logging is enabled. This predates the PR (no debug indicator existed before), but stepDebugEnabled (internal/runner/runner.go:939) now provides the natural gate, so this is a small conformance follow-up.
• [P3] internal/runner/expression.go:15 — The official runner's action_yaml.json manifest schema allows github, strategy, matrix, job, runner, and hashFiles(1,255) in input-default-context; Open Actions allows github, open_actions, runner. The gap is pre-existing (this PR narrows it) and documented in the availability table, but since load-time validation fails the whole job for any marketplace action whose metadata uses one of the missing names, expanding to the official list deserves priority within Expose GitHub-compatible expression contexts at every workflow phase #110.

Key takeaways

• Verified against current GitHub documentation and the official runner source. All seven documented runner properties are supplied; runner.debug/RUNNER_DEBUG are absent when disabled and 1 when enabled; and stepDebugEnabled's trimmed, case-insensitive true match reproduces the official runner exactly — Variables.GetBoolean uses bool.TryParse, so ACTIONS_STEP_DEBUG=1 correctly does not enable debug, and the Secret value (even false) takes precedence over the Variable as documented.
• The masking exemption mirrors the official runner's SecretVariableMaskWhitelist — the same two names, matched case-insensitively — and the load-time rejection of unavailable contexts in defaults (e.g. ${{ secrets.TOKEN }}) is conformant, since the official input-default-context schema excludes secrets and env and the official runner also validates the manifest at load. Evaluating defaults only for unsupplied inputs matches the official runner's !inputs.ContainsKey behavior.
• Runner-owned values are protected on every path — workflow/job/step env maps, composite actions, GITHUB_ENV updates, and inherited image environment (stripped in both cmd/open-actions-runner/main.go and executePlan) — and the environment handed to the action resolver includes the trusted values, proven end-to-end by the five-case actions/github-script@v7 fixture that also pins untrusted inherited RUNNER_* values being overridden. NewExecutor fails fast on a missing runner name, matching the project's fail-fast convention.

[gjkim42]

/kelos claude-review

[gjkim42]

/kelos claude-review

[gjkim42]

/kelos claude-review

[gjkim42]

/kelos claude-review