workflow_dispatch does not validate input type number, accepts strings #14159

New Issue

GiteaMirror · 2025-11-02T11:04:49-06:00

GiteaMirror commented

2025-11-02 11:04:49 -06:00

Originally created by @PDCuong on GitHub (Feb 20, 2025).

Description

In Gitea v1.23, when using workflow_dispatch in actions, the number input type is not properly validated. It accepts string values instead of enforcing numeric input.

Gitea Version

v1.23

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

Define a workflow with an input of type number:

on:
  push:
  workflow_dispatch:
    inputs:
      number_required_1:
        description: 'number-1 '
        type: number
        required: true
        default: '100'
      number_required_2:
        description: 'number-2'
        type: number
        required: true
        default: '100'
      number_required_3:
        description: 'number-3'
        type: number
        required: true
        default: '100'
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Demo non-main branch"
      - run: env | grep inputs

Trigger the workflow manually and enter a string value (e.g., "abc").
The workflow proceeds without validation, even though build_number is expected to be a number.

-> Action logs:

inputs_number_required_3=100
inputs_number_required_2=abc
inputs_number_required_1=100

Trigger the workflow manually and enter a string value (e.g., "abc").
The workflow proceeds without validation, even though build_number is expected to be a number.

Operating System

ubuntu 22.04 LTS

How are you running Gitea?

in docker

Database

None

Originally created by @PDCuong on GitHub (Feb 20, 2025). ### Description In Gitea v1.23, when using workflow_dispatch in actions, the number input type is not properly validated. It accepts string values instead of enforcing numeric input. ### Gitea Version v1.23 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist Define a workflow with an input of type number: ``` yaml on: push: workflow_dispatch: inputs: number_required_1: description: 'number-1 ' type: number required: true default: '100' number_required_2: description: 'number-2' type: number required: true default: '100' number_required_3: description: 'number-3' type: number required: true default: '100' jobs: build: runs-on: ubuntu-latest steps: - run: echo "Demo non-main branch" - run: env | grep inputs ``` Trigger the workflow manually and enter a string value (e.g., "abc"). The workflow proceeds without validation, even though build_number is expected to be a number. -> Action logs: ``` inputs_number_required_3=100 inputs_number_required_2=abc inputs_number_required_1=100 ``` Trigger the workflow manually and enter a string value (e.g., "abc"). The workflow proceeds without validation, even though build_number is expected to be a number. ### Operating System ubuntu 22.04 LTS ### How are you running Gitea? in docker ### Database None

GiteaMirror added the topic/gitea-actions type/bug labels 2025-11-02 11:04:49 -06:00

GiteaMirror commented

2025-11-02 11:04:50 -06:00

@ChristopherHX commented on GitHub (Feb 22, 2025):

The last time I looked into the "number" type in dispatch, the result was the exact same between GitHub Actions and Gitea Actions e.g. number behaves exactly like string and becomes type string for the inputs context.

(workflow_call has a number type that is validated and has the correct type in the inputs context)

@ChristopherHX commented on GitHub (Feb 22, 2025): The last time I looked into the "number" type in dispatch, the result was the exact same between GitHub Actions and Gitea Actions e.g. number behaves exactly like string and becomes type string for the `inputs` context. (workflow_call has a number type that is validated and has the correct type in the `inputs` context)

GiteaMirror commented

2025-11-02 11:04:51 -06:00

@PDCuong commented on GitHub (Feb 26, 2025):

number behaves exactly like string and becomes type string for the inputs context.

However, in the UI, number fields are not validated and can accept string input. This applies to Gitea's workflow_dispatch input.
The expectation is for the UI to validate the input as a string and prevent the workflow from running if it is invalid. Running jobs with invalid input is pretty meaningless.

@PDCuong commented on GitHub (Feb 26, 2025): > number behaves exactly like string and becomes type string for the inputs context. However, in the UI, number fields are not validated and can accept string input. This applies to Gitea's workflow_dispatch input. The expectation is for the UI to validate the input as a string and prevent the workflow from running if it is invalid. Running jobs with invalid input is pretty meaningless.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14159