GoGitActionCache race condition with concurrent matrix jobs

[jun-mercury]

Bug report

Describe the bug

When multiple matrix jobs within a reusable workflow concurrently fetch the same action via GoGitActionCache, a race condition causes intermittent failures:

failed to read 'action.yml' from action 'Assume deploy ASG Role' with path '' of step: file does not exist

or:

GoGitActionCache failed to fetch https://github.com/... : repository not found: Repository not found.

Root cause

GoGitActionCache.Fetch() operates on a shared bare git repo at gitPath (derived from cacheDir). When two goroutines call Fetch() for the same repo concurrently:

1. Both call git.PlainInit(gitPath, true) — one succeeds, one gets ErrRepositoryAlreadyExists
2. Both create anonymous remotes and call FetchContext() concurrently on the same bare repo
3. The deferred DeleteBranch(branchName) cleanup in one goroutine can remove objects that another goroutine's GetTarArchive() is reading

This manifests as:

• action.yml not found (objects not yet written when read)
• Repository not found (bare repo in inconsistent state during concurrent init/fetch)

To reproduce

1. Create a workflow with a reusable workflow that uses fromJSON() matrix with 2+ entries
2. Each matrix job must reference the same external action (e.g., aws-actions/configure-aws-credentials)
3. Run with act using containerized runners (GoGitActionCache is used)
4. The failure is intermittent — depends on goroutine scheduling

Expected behavior

Concurrent matrix jobs should be able to safely share the action cache.

Suggested fix

Add a per-repo sync.Mutex (stored in a sync.Map on GoGitActionCache) to serialize Fetch() and GetTarArchive() calls for the same gitPath. Different repos remain fully parallel.

act version

v0.2.84