PANIC: nil pointer dereference in actions concurrency during PR creation via API #136

New Issue

2026-05-23T22:13:41Z

jmiller commented

2026-05-23 22:13:41 +00:00

Summary

Creating a pull request via the REST API () triggers a nil pointer dereference panic in the actions concurrency module. The PR is created successfully, but the server returns a panic stack trace instead of a JSON response.

Steps to Reproduce

Create a PR via the API:

curl -X POST   -H "Authorization: token $TOKEN"   -H "Content-Type: application/json"   "https://git.mokoconsulting.tech/api/v1/repos/{owner}/{repo}/pulls"   -d '{"title": "...", "base": "main", "head": "dev", "body": "..."}'

Server returns a panic instead of the PR JSON response.

Expected Behavior

API returns HTTP 201 with the PR JSON object.

Actual Behavior

Server panics with:

PANIC: runtime error: invalid memory address or nil pointer dereference

Stack trace (key frames)

/go/src/code.gitea.io/gitea/services/actions/concurrency.go:39
/go/src/code.gitea.io/gitea/services/actions/run.go:91
/go/src/code.gitea.io/gitea/services/actions/run.go:61
/go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:347
/go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:242
/go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:113
/go/src/code.gitea.io/gitea/services/actions/notifier.go:392
/go/src/code.gitea.io/gitea/services/notify/notify.go:118
/go/src/code.gitea.io/gitea/services/pull/pull.go:181
/go/src/code.gitea.io/gitea/routers/api/v1/repo/pull.go:571

Root Cause (Probable)

The panic originates in which is called during the actions notifier flow after PR creation. A nil pointer is dereferenced when the actions runner tries to evaluate concurrency groups for workflows triggered by the event.

This likely occurs when:

A workflow has a key but the context variables resolve to nil
Or no runners are available/configured for the triggered workflow

Impact

Severity: Medium -- the PR is created successfully despite the panic, but the API caller receives no response and cannot programmatically extract the PR number/URL.
Workaround: Query after the failed POST to find the created PR.

Environment

Gitea version: MokoGitea fork (check deployed version)
Triggered by: PR creation from to on MokoOnyx repo
Observed: 2026-05-23

Upstream Reference

This may be related to upstream Gitea issues with the actions concurrency feature. Check if a fix exists in recent Gitea releases before patching the fork.

## Summary Creating a pull request via the REST API () triggers a nil pointer dereference panic in the actions concurrency module. The PR is created successfully, but the server returns a panic stack trace instead of a JSON response. ## Steps to Reproduce 1. Create a PR via the API: ```bash curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" "https://git.mokoconsulting.tech/api/v1/repos/{owner}/{repo}/pulls" -d '{"title": "...", "base": "main", "head": "dev", "body": "..."}' ``` 2. Server returns a panic instead of the PR JSON response. ## Expected Behavior API returns HTTP 201 with the PR JSON object. ## Actual Behavior Server panics with: ``` PANIC: runtime error: invalid memory address or nil pointer dereference ``` ### Stack trace (key frames) ``` /go/src/code.gitea.io/gitea/services/actions/concurrency.go:39 /go/src/code.gitea.io/gitea/services/actions/run.go:91 /go/src/code.gitea.io/gitea/services/actions/run.go:61 /go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:347 /go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:242 /go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:113 /go/src/code.gitea.io/gitea/services/actions/notifier.go:392 /go/src/code.gitea.io/gitea/services/notify/notify.go:118 /go/src/code.gitea.io/gitea/services/pull/pull.go:181 /go/src/code.gitea.io/gitea/routers/api/v1/repo/pull.go:571 ``` ## Root Cause (Probable) The panic originates in which is called during the actions notifier flow after PR creation. A nil pointer is dereferenced when the actions runner tries to evaluate concurrency groups for workflows triggered by the event. This likely occurs when: - A workflow has a key but the context variables resolve to nil - Or no runners are available/configured for the triggered workflow ## Impact - **Severity:** Medium -- the PR is created successfully despite the panic, but the API caller receives no response and cannot programmatically extract the PR number/URL. - **Workaround:** Query after the failed POST to find the created PR. ## Environment - **Gitea version:** MokoGitea fork (check deployed version) - **Triggered by:** PR creation from to on MokoOnyx repo - **Observed:** 2026-05-23 ## Upstream Reference This may be related to upstream Gitea issues with the actions concurrency feature. Check if a fix exists in recent Gitea releases before patching the fork.

jmiller referenced this issue from a commit

2026-05-23 23:18:15 +00:00

fix(actions): nil pointer dereference in concurrency during PR creation

jmiller referenced a pull request that will close this issue

2026-05-23 23:20:28 +00:00

fix(actions): nil pointer dereference in concurrency during PR creation #137

jmiller closed this issue

2026-05-24 03:26:43 +00:00

jmiller referenced this issue from a commit

2026-05-24 03:26:44 +00:00

Merge pull request 'fix(actions): nil pointer dereference in concurrency during PR creation' (#137) from fix/136-actions-concurrency-nil-panic into main

Sign in to join this conversation.