MokoConsulting/MokoGitea
1
0
Fork 0
Code Issues 86 Pull Requests 3 Actions Packages Projects Releases 27 Wiki Activity

PANIC: nil pointer dereference in actions concurrency during PR creation via API #136

New Issue
Closed
opened 2026-05-23 22:13:41 +00:00 by jmiller · 0 comments
jmiller commented 2026-05-23 22:13:41 +00:00
Owner
Copy Link
Copy Source

Summary

Creating a pull request via the REST API () triggers a nil pointer dereference panic in the actions concurrency module. The PR is created successfully, but the server returns a panic stack trace instead of a JSON response.

Steps to Reproduce

  1. Create a PR via the API:
curl -X POST   -H "Authorization: token $TOKEN"   -H "Content-Type: application/json"   "https://git.mokoconsulting.tech/api/v1/repos/{owner}/{repo}/pulls"   -d '{"title": "...", "base": "main", "head": "dev", "body": "..."}'
  1. Server returns a panic instead of the PR JSON response.

Expected Behavior

API returns HTTP 201 with the PR JSON object.

Actual Behavior

Server panics with:

PANIC: runtime error: invalid memory address or nil pointer dereference

Stack trace (key frames)

/go/src/code.gitea.io/gitea/services/actions/concurrency.go:39
/go/src/code.gitea.io/gitea/services/actions/run.go:91
/go/src/code.gitea.io/gitea/services/actions/run.go:61
/go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:347
/go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:242
/go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:113
/go/src/code.gitea.io/gitea/services/actions/notifier.go:392
/go/src/code.gitea.io/gitea/services/notify/notify.go:118
/go/src/code.gitea.io/gitea/services/pull/pull.go:181
/go/src/code.gitea.io/gitea/routers/api/v1/repo/pull.go:571

Root Cause (Probable)

The panic originates in which is called during the actions notifier flow after PR creation. A nil pointer is dereferenced when the actions runner tries to evaluate concurrency groups for workflows triggered by the event.

This likely occurs when:

  • A workflow has a key but the context variables resolve to nil
  • Or no runners are available/configured for the triggered workflow

Impact

  • Severity: Medium -- the PR is created successfully despite the panic, but the API caller receives no response and cannot programmatically extract the PR number/URL.
  • Workaround: Query after the failed POST to find the created PR.

Environment

  • Gitea version: MokoGitea fork (check deployed version)
  • Triggered by: PR creation from to on MokoOnyx repo
  • Observed: 2026-05-23

Upstream Reference

This may be related to upstream Gitea issues with the actions concurrency feature. Check if a fix exists in recent Gitea releases before patching the fork.

## Summary Creating a pull request via the REST API () triggers a nil pointer dereference panic in the actions concurrency module. The PR is created successfully, but the server returns a panic stack trace instead of a JSON response. ## Steps to Reproduce 1. Create a PR via the API: ```bash curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" "https://git.mokoconsulting.tech/api/v1/repos/{owner}/{repo}/pulls" -d '{"title": "...", "base": "main", "head": "dev", "body": "..."}' ``` 2. Server returns a panic instead of the PR JSON response. ## Expected Behavior API returns HTTP 201 with the PR JSON object. ## Actual Behavior Server panics with: ``` PANIC: runtime error: invalid memory address or nil pointer dereference ``` ### Stack trace (key frames) ``` /go/src/code.gitea.io/gitea/services/actions/concurrency.go:39 /go/src/code.gitea.io/gitea/services/actions/run.go:91 /go/src/code.gitea.io/gitea/services/actions/run.go:61 /go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:347 /go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:242 /go/src/code.gitea.io/gitea/services/actions/notifier_helper.go:113 /go/src/code.gitea.io/gitea/services/actions/notifier.go:392 /go/src/code.gitea.io/gitea/services/notify/notify.go:118 /go/src/code.gitea.io/gitea/services/pull/pull.go:181 /go/src/code.gitea.io/gitea/routers/api/v1/repo/pull.go:571 ``` ## Root Cause (Probable) The panic originates in which is called during the actions notifier flow after PR creation. A nil pointer is dereferenced when the actions runner tries to evaluate concurrency groups for workflows triggered by the event. This likely occurs when: - A workflow has a key but the context variables resolve to nil - Or no runners are available/configured for the triggered workflow ## Impact - **Severity:** Medium -- the PR is created successfully despite the panic, but the API caller receives no response and cannot programmatically extract the PR number/URL. - **Workaround:** Query after the failed POST to find the created PR. ## Environment - **Gitea version:** MokoGitea fork (check deployed version) - **Triggered by:** PR creation from to on MokoOnyx repo - **Observed:** 2026-05-23 ## Upstream Reference This may be related to upstream Gitea issues with the actions concurrency feature. Check if a fix exists in recent Gitea releases before patching the fork.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking-change
Breaking API or behavior change
 ci-cd
CI/CD pipeline changes
 config
Configuration changes
 dependencies
Dependency updates
 deploy-failure
Deployment failed
 docker
Docker/container changes
 documentation
Documentation changes
 good first issue
Good for newcomers
 health-check
Repo health check result
 help wanted
Extra attention needed
 mokostandards
Related to MokoStandards framework
 pending: testing
Feature implemented but not yet tested with documented proof
 priority: critical
Must fix immediately
 priority: high
Important, fix soon
 priority: low
Nice to have
 priority: medium
Normal priority
 push-failure
Git push operation failed
 security
Security vulnerability or hardening
 size/l
200-500 lines changed
 size/m
50-200 lines changed
 size/s
10-50 lines changed
 size/xl
500+ lines changed
 size/xs
< 10 lines changed
 standards-drift
Deviates from MokoStandards
 standards-update
MokoStandards compliance update
 status: blocked
Blocked by dependency or decision
 status: in-progress
Actively being worked on
 status: needs-review
Awaiting code review
 status: on-hold
Paused intentionally
 status: wontfix
Will not be addressed
 sync-failure
Sync or mirror failed
 type: bug
Something isn't working
 type: bug
type: chore
Maintenance, dependencies, cleanup
 type: enhancement
Improvement to existing feature
 type: feature
New functionality
 type: refactor
Code restructuring without behavior change
 type: version
Version bump or release
 upstream
work-in-progress
Draft or incomplete work
bug
Something is not working
 chore
Maintenance and housekeeping
 documentation
Documentation improvements
 enhancement
Improvement to existing functionality
 feature
New feature or request
 pending: dependency
Blocked by another issue or external dependency
 pending: deployment
Tested and approved, awaiting deployment to production
 pending: design
Needs UI/UX or architecture design before implementation
 pending: documentation
Feature works, needs documentation/wiki update
 pending: feedback
Awaiting feedback or decision from stakeholder
 pending: review
Implementation complete, awaiting code review
 pending: testing
Feature implemented but not yet tested
 priority: critical
Must fix immediately
 priority: high
Should fix soon
 priority: low
Nice to have
 priority: medium
Fix when convenient
 refactor
Code restructuring without behavior change
 roadmap
Planned feature or enhancement tracked on the roadmap
 scope: client
Client-specific work
 scope: dolibarr
Dolibarr modules and customizations
 scope: infrastructure
Server, CI, backups, monitoring
 scope: joomla
Joomla templates and extensions
 scope: waas
MokoWaaS platform
 security
Security vulnerability or hardening
 status: blocked
Waiting on external dependency
 status: duplicate
Duplicate of another issue
 status: in-progress
Being worked on
 status: needs-review
Ready for review
 status: wontfix
Will not be addressed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea#136
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?