fix: stop artifact uploads depending on the cache server reaching Gitea (#1216)

Cache v2 makes the cache server the `ACTIONS_RESULTS_URL` origin, so artifact calls arrived there and were proxied on to Gitea, failing whenever it could not reach the instance.

- Artifact calls are answered with a redirect, so the cache server opens no connection to Gitea. A scheme change or an untrusted instance is still proxied, but there the cache server is the runner itself, which already reaches Gitea.
- Failures answer in twirp, not an empty `502` that clients report as `Unexpected end of JSON input`.
- `cache.v2: false` really points artifacts at Gitea now.
- Cache reservations are bound to the job that made them, so two jobs saving one key cannot commit against each other's upload, and a retry after a lost answer no longer fails a saved entry.
- The toolkit patch, which edits the GitHub-host check out of an action's bundle, was left in the shared checkout where a job running with `runner.patch_actions: false` could inherit it. It is put back after the job's copy.
- `exec` names an origin for the cache v2 it advertises, and masks its runtime token.

Behaviour changes: `no_proxy` no longer exempts `cache.external_server`, and `cache.enabled: false` also stops external registration.

Fixes https://gitea.com/gitea/runner/issues/1208
Fixes https://gitea.com/gitea/runner/issues/1211

Assisted by Claude (Opus 5).

Reviewed-on: https://gitea.com/gitea/runner/pulls/1216
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

internal/app/run/runner_test.go

@@ -143,6 +143,7 @@ func TestNewRunnerLeavesProxyToTheTask(t *testing.T) {
 
 	require.NotContains(t, r.envs, "http_proxy")
 	require.NotContains(t, r.envs, "no_proxy")
+	assert.Empty(t, r.builtInCacheURL(), "an external cache server is the operator's to exempt, not ours")
 }
 
 func taskWithDefaultActionsURL(url string) *runnerv1.Task {
@@ -189,11 +190,38 @@ func TestNewRunnerCacheServiceV2(t *testing.T) {
 	defer resp.Body.Close()
 
 	assert.Equal(t, http.StatusOK, resp.StatusCode, "the advertised results service serves no cache service")
+	assert.Equal(t, r.envs["ACTIONS_CACHE_URL"], r.builtInCacheURL(), "the address only the runner knows is bypassed for the operator")
+
+	envs := r.cloneEnvs()
+	r.setResultsService(envs, resultsURL)
+	assert.Equal(t, resultsURL, envs["ACTIONS_RESULTS_URL"])
+	assert.Equal(t, "true", envs[runner.CacheServiceV2Env])
 
-	// Turning v2 off withdraws the advertisement and nothing else.
-	assert.True(t, r.cacheServiceV2())
 	cfg.Cache.V2 = new(bool)
-	assert.False(t, r.cacheServiceV2())
+	envs = r.cloneEnvs()
+	envs[runner.CacheServiceV2Env] = "true"
+	r.setResultsService(envs, resultsURL)
+	assert.Equal(t, "https://gitea.example", envs["ACTIONS_RESULTS_URL"])
+	assert.Empty(t, envs[runner.CacheServiceV2Env], "a runner.envs entry would promise v2 at an origin not serving it")
+
+	envs = r.cloneEnvs()
+	envs[runner.CacheServiceV2Env] = "true"
+	envs["ACTIONS_RESULTS_URL"] = "https://gitea.example/sub"
+	r.setResultsService(envs, "")
+	assert.Equal(t, "https://gitea.example/sub", envs["ACTIONS_RESULTS_URL"], "with no cache server there is nothing to front with")
+	assert.Empty(t, envs[runner.CacheServiceV2Env])
+
+	for instance, insecure := range map[string]bool{
+		"https://gitea.example/sub":   false,
+		"https://self-signed.example": true,
+	} {
+		cfg.Runner.Insecure = insecure
+		envs = r.cloneEnvs()
+		envs["ACTIONS_RESULTS_URL"] = instance
+		r.setResultsService(envs, resultsURL)
+		assert.Equal(t, resultsURL, envs["ACTIONS_RESULTS_URL"], instance)
+		assert.Empty(t, envs[runner.CacheServiceV2Env])
+	}
 }
 
 // The v1 cache client appends its path to ACTIONS_CACHE_URL without a separator, so a configured