feat(ci): run docker:// container actions

[zoetaka38]

uses: docker://<image> steps now execute instead of being skipped — the one uses: category that's self-contained (no Actions JS toolkit needed).

Behavior

• The image runs with the job workspace bind-mounted (/github/workspace), network isolated (--network none), and the step's with: inputs passed as GitHub-style INPUT_* env vars (uppercased, non-alphanumeric → _, ${{ }} interpolated).
• Output is captured as job log lines (secret-masked); a non-zero exit fails the job.
• The container runner is injectable for tests.

JS/marketplace actions (which need the full Actions runtime + action registry) remain logged as unsupported and skipped without failing the run — a deliberate scope boundary.

Verified live

uses: docker://og-test-action:latest with with: {greeting: hello-from-workflow, my-name: ${{ github.actor }}}:

Run docker://og-test-action:latest
action says: greeting=hello-from-workflow name=alice   # dash normalized, actor interpolated
after action                                            # following run step still executes
run -> success

Unit tests cover input env construction (incl. dash normalization), image extraction, and failure handling with an injected runner.

[orange-codens]

🍊 Orange Codens レビュー

指摘事項はありません。✨

_{head: 2a83fc5 | 🍊 Reviewed by Orange Codens — AI code review & security audit}