Support job containers, service containers, and Docker container actions

[gjkim42]

Context

GitHub Actions supports job-level container, per-job services, and action metadata with runs.using: docker. Open Actions rejects the job fields during workflow validation and rejects Docker action metadata during action preparation.

Issue #35 provides a Docker-capable runner for workflow commands such as Buildx and Kind. That capability does not implement these workflow and action contracts.

Goal

Provide GitHub-compatible containerized job, service, and Docker action behavior while retaining Open Actions isolation and scheduling guarantees.

Acceptance criteria

• Parse and validate all documented scalar and mapping forms of jobs.<job_id>.container and jobs.<job_id>.services.
• Support documented image, credentials, environment, ports, volumes, and options behavior.
• Make service hostnames, port mappings, health checks, and network reachability match GitHub-visible behavior for container and host jobs.
• Run shell steps and actions inside the job container when configured, with compatible workspace, command-file, tool-cache, and environment mounts.
• Support Docker container actions from registry images and Dockerfiles, including inputs, entrypoint, arguments, environment, workspace state, and cleanup.
• Keep credentials, networks, containers, and volumes isolated per job and clean them up after success, failure, timeout, and cancellation.
• Define runner capability matching so incompatible jobs remain queued rather than failing after assignment.
• Add end-to-end coverage for a container job, multiple services, registry credentials, a Dockerfile action, an image action, failure cleanup, and cancellation cleanup.
• Document administrator prerequisites without changing workflow-visible semantics.

References:

• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainer
• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservices
• https://docs.github.com/en/actions/reference/workflows-and-actions/metadata-syntax#runs-for-docker-container-actions

[kelos-bot]

🤖 Kelos Task Status

Task open-actions-triage-issues-c358cefea040 has failed. ❌

[gjkim42]

A real migration hit this limitation in jipscope/jipscope#104.

The original workflow used a standard services.postgres definition. Open Actions rejected that contract, so the migrated workflow now:

• selects a Docker-capable runner explicitly;
• starts PostgreSQL with docker run;
• publishes port 5432 manually; and
• implements its own health polling and failure-log handling.

This turns the declarative service block into roughly 25 lines of shell and couples the job to the Docker execution profile. Supporting the original service block unchanged would remove the largest Open-Actions-specific edit in that CI workflow.