Update Dependencies

[MarcusSmith]

Do a pass on dependency updates, biggest most important ones being the docker changes (new package, a lot of breaking interface changes). Gitea still hasn't made these changes, so needed to pull them in from nektos/act while trying to make sure I didn't undo any Gitea or AllSpice changes.

Test process:
I also updated a lot of dependencies in act_runner, linking act using this branch locally. Set up act_runner to run specifically using docker instead of host (since so much of this was docker related), set up a workflow that logged stuff from the allspice value and using ALLSPICE envs in a locally running Hub. Confirmed in the workflow that the allspice specific changes were still available, and that there were no docker errors

Next steps:
After this has gone through review and is tagged, I will open a PR for the corresponding act_runner changes. Then do a full walkthrough with the new tags in a local docker compose setup to check on docker in docker, then will coordinate the updates to these new tags with infra

[schottra]

Set up act_runner to run specifically using docker instead of host (since so much of this was docker related)

I assume this is just for testing, right? I didn't see anything in the code that forces usage of docker? And that's important because we support both DinD and bare host deployments for this....

As for the versioning scheme: It was meant to track the upstream version that it's based on with a suffix to indicate which internal iteration we are using.

If this is truly switching off the gitea upstream as a base with the goal of using the act code as a base, then it would technically be correct to switch the version scheme to mirror that one. However, since it uses lower version numbers (0.2.89 is latest), it would result in the next tag being considered an earlier release.

I would either:

• Bump this to v0.262.0 and consider us hard-forked from gitea/act, and make a note in the README that our versions no longer track that upstream.
• Bump this to v0.261.9-allspice.2 if we intend to keep using gitea/act as an upstream.

And once that's done and published, you can update the act_runner image to use this version and publish a new tag there (same versioning scheme should apply in that repo)

[schottra]

It feels like a lot of changes. Generally okay with it, but will need e2e verification with act_runner in deployed environments.

[MarcusSmith]

I assume this is just for testing, right?

yes, this was an act_runner configuration so that I could ensure that it was making the actual docker commands (which didn't occur when running using just the host) since so much of these changes were related to the docker library

Considering that most of this code was pulled back in from nektos and that gitea isn't updating their act enough for us to be able to keep our security vulnerabilities patched with updates, I'm going to go with the hard fork option. I will make the readme changes