fix: crash malformed composite action (#1616)

* fix: crash malformed composite action

* Add remote composite action test

---------

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

pkg/runner/action.go

@@ -503,7 +503,10 @@ func runPreStep(step actionStep) common.Executor {
 				step.getCompositeRunContext(ctx)
 			}
 
-			return step.getCompositeSteps().pre(ctx)
+			if steps := step.getCompositeSteps(); steps != nil && steps.pre != nil {
+				return steps.pre(ctx)
+			}
+			return fmt.Errorf("missing steps in composite action")
 
 		default:
 			return nil
@@ -592,7 +595,10 @@ func runPostStep(step actionStep) common.Executor {
 				return err
 			}
 
-			return step.getCompositeSteps().post(ctx)
+			if steps := step.getCompositeSteps(); steps != nil && steps.post != nil {
+				return steps.post(ctx)
+			}
+			return fmt.Errorf("missing steps in composite action")
 
 		default:
 			return nil

pkg/runner/action_composite.go

@@ -86,6 +86,10 @@ func execAsComposite(step actionStep) common.Executor {
 
 		steps := step.getCompositeSteps()
 
+		if steps == nil || steps.main == nil {
+			return fmt.Errorf("missing steps in composite action")
+		}
+
 		ctx = WithCompositeLogger(ctx, &compositeRC.Masks)
 
 		err := steps.main(ctx)

pkg/runner/runner_test.go

@@ -299,6 +299,7 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
 		{workdir, "set-env-step-env-override", "push", "", platforms, secrets},
 		{workdir, "set-env-new-env-file-per-step", "push", "", platforms, secrets},
+		{workdir, "no-panic-on-invalid-composite-action", "push", "jobs failed due to invalid action", platforms, secrets},
 	}
 
 	for _, table := range tables {
@@ -401,6 +402,7 @@ func TestRunEventHostEnvironment(t *testing.T) {
 			{workdir, "do-not-leak-step-env-in-composite", "push", "", platforms, secrets},
 			{workdir, "set-env-step-env-override", "push", "", platforms, secrets},
 			{workdir, "set-env-new-env-file-per-step", "push", "", platforms, secrets},
+			{workdir, "no-panic-on-invalid-composite-action", "push", "jobs failed due to invalid action", platforms, secrets},
 		}...)
 	}
 

pkg/runner/testdata/no-panic-on-invalid-composite-action/push.yml

@@ -0,0 +1,29 @@
+on: push
+jobs:
+  local-invalid-step:
+    runs-on: ubuntu-latest
+    steps:
+    - run: |
+        runs:
+          using: composite
+          steps:
+          - name: Foo
+          - uses: Foo/Bar
+      shell: cp {0} action.yml
+    - uses: ./
+  local-missing-steps:
+    runs-on: ubuntu-latest
+    steps:
+    - run: |
+        runs:
+          using: composite
+      shell: cp {0} action.yml
+    - uses: ./
+  remote-invalid-step:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: nektos/act-test-actions/invalid-composite-action/invalid-step@main
+  remote-missing-steps:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: nektos/act-test-actions/invalid-composite-action/missing-steps@main