add ValidVolumes Config

internal/app/run/runner.go

@@ -197,6 +197,7 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		DefaultActionInstance: taskContext["gitea_default_actions_url"].GetStringValue(),
 		PlatformPicker:        r.labels.PickPlatform,
 		Vars:                  task.Vars,
+		ValidVolumes:          r.cfg.Container.ValidVolumes,
 	}
 
 	rr, err := runner.New(runnerConfig)

internal/pkg/config/config.example.yaml

@@ -53,3 +53,7 @@ container:
   # The parent directory of a job's working directory.
   # If it's empty, /workspace will be used.
   workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers.
+  # This is a sequence. If the sequence is empty, any volume can be mounted.
+  # Used for `jobs.<job_id>.container.volumes` or `jobs.<job_id>.services.<service_id>.volumes`
+  valid_volumes:

internal/pkg/config/config.go

@@ -35,11 +35,12 @@ type Config struct {
 		Port    uint16 `yaml:"port"`
 	} `yaml:"cache"`
 	Container struct {
-		Network       string `yaml:"network"`
-		NetworkMode   string `yaml:"network_mode"` // Deprecated: use Network instead. Could be removed after Gitea 1.20
-		Privileged    bool   `yaml:"privileged"`
-		Options       string `yaml:"options"`
-		WorkdirParent string `yaml:"workdir_parent"`
+		Network       string   `yaml:"network"`
+		NetworkMode   string   `yaml:"network_mode"` // Deprecated: use Network instead. Could be removed after Gitea 1.20
+		Privileged    bool     `yaml:"privileged"`
+		Options       string   `yaml:"options"`
+		WorkdirParent string   `yaml:"workdir_parent"`
+		ValidVolumes  []string `yaml:"valid_volumes"`
 	} `yaml:"container"`
 }