ssh clone from all except CodeCommit

services/migrations/codebase.go

@@ -33,22 +33,19 @@ type CodebaseDownloaderFactory struct{}
 
 // New returns a downloader related to this factory according MigrateOptions
 func (f *CodebaseDownloaderFactory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
-	u.User = nil
-
-	fields := strings.Split(strings.Trim(u.Path, "/"), "/")
-	if len(fields) != 2 {
-		return nil, fmt.Errorf("invalid path: %s", u.Path)
+	if len(info.segments) != 2 {
+		return nil, fmt.Errorf("invalid path: %s", info.repoPath)
 	}
-	project := fields[0]
-	repoName := strings.TrimSuffix(fields[1], ".git")
+	project := info.segments[0]
+	repoName := strings.TrimSuffix(info.segments[1], ".git")
 
-	log.Trace("Create Codebase downloader. BaseURL: %v RepoName: %s", u, repoName)
+	log.Trace("Create Codebase downloader. BaseURL: %v RepoName: %s", info.apiURL, repoName)
 
-	return NewCodebaseDownloader(ctx, u, project, repoName, opts.AuthUsername, opts.AuthPassword), nil
+	return NewCodebaseDownloader(ctx, info.apiURL, project, repoName, opts.AuthUsername, opts.AuthPassword), nil
 }
 
 // GitServiceType returns the type of git service

services/migrations/codecommit.go

@@ -34,26 +34,23 @@ type CodeCommitDownloaderFactory struct{}
 
 // New returns a Downloader related to this factory according MigrateOptions
 func (c *CodeCommitDownloaderFactory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
 
-	hostElems := strings.Split(u.Host, ".")
+	hostElems := strings.Split(info.apiURL.Host, ".")
 	if len(hostElems) != 4 {
 		return nil, errors.New("cannot get the region from clone URL")
 	}
 	region := hostElems[1]
 
-	pathElems := strings.Split(u.Path, "/")
-	if len(pathElems) == 0 {
+	if len(info.segments) == 0 || info.segments[len(info.segments)-1] == "" {
 		return nil, errors.New("cannot get the repo name from clone URL")
 	}
-	repoName := pathElems[len(pathElems)-1]
+	repoName := info.segments[len(info.segments)-1]
 
-	baseURL := u.Scheme + "://" + u.Host
-
-	return NewCodeCommitDownloader(ctx, repoName, baseURL, opts.AWSAccessKeyID, opts.AWSSecretAccessKey, region), nil
+	return NewCodeCommitDownloader(ctx, repoName, info.apiURL.String(), opts.AWSAccessKeyID, opts.AWSSecretAccessKey, region), nil
 }
 
 // GitServiceType returns the type of git service

services/migrations/common.go

@@ -5,6 +5,7 @@ package migrations
 
 import (
 	"fmt"
+	"net/url"
 	"strings"
 
 	system_model "gitea.dev/models/system"
@@ -13,6 +14,36 @@ import (
 	base "gitea.dev/modules/migration"
 )
 
+// serviceCloneURLInfo bundles the API base URL and parsed repo path of a clone
+// address, hiding scheme conversion (ssh→https) needed for forge API calls.
+type serviceCloneURLInfo struct {
+	apiURL   *url.URL
+	repoPath string
+	segments []string
+}
+
+// parseServiceCloneURL parses a clone address and returns its API base URL
+// (always http/https — ssh/git are promoted to https for API calls) together
+// with the repo path and its segments.
+func parseServiceCloneURL(cloneAddr string) (*serviceCloneURLInfo, error) {
+	u, err := url.Parse(cloneAddr)
+	if err != nil {
+		return nil, err
+	}
+	apiURL := *u
+	apiURL.User = nil
+	apiURL.Path = ""
+	apiURL.RawQuery = ""
+	apiURL.Fragment = ""
+	// Forge APIs are HTTP(S) only; promote ssh/git clone schemes to https.
+	if apiURL.Scheme == "ssh" || apiURL.Scheme == "git" {
+		apiURL.Scheme = "https"
+	}
+	repoPath := strings.TrimPrefix(u.Path, "/")
+	segments := strings.Split(repoPath, "/")
+	return &serviceCloneURLInfo{apiURL: &apiURL, repoPath: repoPath, segments: segments}, nil
+}
+
 // WarnAndNotice will log the provided message and send a repository notice
 func WarnAndNotice(fmtStr string, args ...any) {
 	log.Warn(fmtStr, args...)

services/migrations/common_test.go

@@ -0,0 +1,98 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package migrations
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseServiceCloneURL(t *testing.T) {
+	tests := []struct {
+		name        string
+		cloneURL    string
+		apiURL      string
+		repoPath    string
+		pathSegment []string
+	}{
+		{
+			name:        "https",
+			cloneURL:    "https://github.com/go-gitea/gitea.git",
+			apiURL:      "https://github.com",
+			repoPath:    "go-gitea/gitea.git",
+			pathSegment: []string{"go-gitea", "gitea.git"},
+		},
+		{
+			name:        "ssh",
+			cloneURL:    "ssh://github.com/go-gitea/gitea.git",
+			apiURL:      "https://github.com",
+			repoPath:    "go-gitea/gitea.git",
+			pathSegment: []string{"go-gitea", "gitea.git"},
+		},
+		{
+			name:        "git protocol",
+			cloneURL:    "git://github.com/go-gitea/gitea.git",
+			apiURL:      "https://github.com",
+			repoPath:    "go-gitea/gitea.git",
+			pathSegment: []string{"go-gitea", "gitea.git"},
+		},
+		{
+			name:        "sub-path instance",
+			cloneURL:    "ssh://example.com/gitbucket/team/repo.git",
+			apiURL:      "https://example.com",
+			repoPath:    "gitbucket/team/repo.git",
+			pathSegment: []string{"gitbucket", "team", "repo.git"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			info, err := parseServiceCloneURL(tt.cloneURL)
+			require.NoError(t, err)
+			assert.Equal(t, tt.apiURL, info.apiURL.String())
+			assert.Equal(t, tt.repoPath, info.repoPath)
+			assert.Equal(t, tt.pathSegment, info.segments)
+		})
+	}
+}
+
+func TestGithubDownloaderFactoryNewWithSSHCloneURL(t *testing.T) {
+	downloader, err := (&GithubDownloaderV3Factory{}).New(t.Context(), MigrateOptions{
+		CloneAddr: "ssh://github.com/go-gitea/gitea.git",
+	})
+	require.NoError(t, err)
+
+	githubDownloader, ok := downloader.(*GithubDownloaderV3)
+	require.True(t, ok)
+	assert.Equal(t, "https://github.com", githubDownloader.baseURL)
+	assert.Equal(t, "go-gitea", githubDownloader.repoOwner)
+	assert.Equal(t, "gitea", githubDownloader.repoName)
+}
+
+func TestGitBucketDownloaderFactoryNewWithSSHCloneURL(t *testing.T) {
+	downloader, err := (&GitBucketDownloaderFactory{}).New(t.Context(), MigrateOptions{
+		CloneAddr: "ssh://example.com/git/team/repo.git",
+	})
+	require.NoError(t, err)
+
+	gitBucketDownloader, ok := downloader.(*GitBucketDownloader)
+	require.True(t, ok)
+	assert.Equal(t, "https://example.com", gitBucketDownloader.baseURL)
+	assert.Equal(t, "team", gitBucketDownloader.repoOwner)
+	assert.Equal(t, "repo", gitBucketDownloader.repoName)
+}
+
+func TestCodeCommitDownloaderFactoryNewWithSSHCloneURL(t *testing.T) {
+	downloader, err := (&CodeCommitDownloaderFactory{}).New(t.Context(), MigrateOptions{
+		CloneAddr: "ssh://git-codecommit.us-east-1.amazonaws.com/v1/repos/test-repo",
+	})
+	require.NoError(t, err)
+
+	codeCommitDownloader, ok := downloader.(*CodeCommitDownloader)
+	require.True(t, ok)
+	assert.Equal(t, "https://git-codecommit.us-east-1.amazonaws.com", codeCommitDownloader.baseURL)
+	assert.Equal(t, "test-repo", codeCommitDownloader.repoName)
+}

services/migrations/gitbucket.go

@@ -6,7 +6,6 @@ package migrations
 import (
 	"context"
 	"fmt"
-	"net/url"
 	"strings"
 
 	"gitea.dev/modules/log"
@@ -28,19 +27,24 @@ type GitBucketDownloaderFactory struct{}
 
 // New returns a Downloader related to this factory according MigrateOptions
 func (f *GitBucketDownloaderFactory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
-
-	fields := strings.Split(u.Path, "/")
-	if len(fields) < 2 {
-		return nil, fmt.Errorf("invalid path: %s", u.Path)
+	if len(info.segments) < 2 {
+		return nil, fmt.Errorf("invalid path: %s", info.repoPath)
 	}
-	baseURL := u.Scheme + "://" + u.Host + strings.TrimSuffix(strings.Join(fields[:len(fields)-2], "/"), "/git")
 
-	oldOwner := fields[len(fields)-2]
-	oldName := strings.TrimSuffix(fields[len(fields)-1], ".git")
+	// GitBucket exposes its API at "<host>/<sub-path>" where <sub-path> is the URL
+	// minus the trailing "/git/<owner>/<repo>.git" used for the git clone endpoint.
+	subPath := strings.Join(info.segments[:len(info.segments)-2], "/")
+	if subPath != "" {
+		subPath = "/" + subPath
+	}
+	baseURL := info.apiURL.String() + strings.TrimSuffix(subPath, "/git")
+
+	oldOwner := info.segments[len(info.segments)-2]
+	oldName := strings.TrimSuffix(info.segments[len(info.segments)-1], ".git")
 
 	log.Trace("Create GitBucket downloader. BaseURL: %s RepoOwner: %s RepoName: %s", baseURL, oldOwner, oldName)
 	return NewGitBucketDownloader(ctx, baseURL, opts.AuthUsername, opts.AuthPassword, opts.AuthToken, oldOwner, oldName)

services/migrations/gitea_downloader.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"strings"
 	"time"
 
@@ -33,24 +32,21 @@ type GiteaDownloaderFactory struct{}
 
 // New returns a Downloader related to this factory according MigrateOptions
 func (f *GiteaDownloaderFactory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
 
-	baseURL := u.Scheme + "://" + u.Host
-	repoNameSpace := strings.TrimPrefix(u.Path, "/")
-	repoNameSpace = strings.TrimSuffix(repoNameSpace, ".git")
-
+	repoNameSpace := strings.TrimSuffix(info.repoPath, ".git")
 	path := strings.Split(repoNameSpace, "/")
 	if len(path) < 2 {
 		return nil, fmt.Errorf("invalid path: %s", repoNameSpace)
 	}
 
+	baseURL := info.apiURL.String()
 	repoPath := strings.Join(path[len(path)-2:], "/")
 	if len(path) > 2 {
-		subPath := strings.Join(path[:len(path)-2], "/")
-		baseURL += "/" + subPath
+		baseURL += "/" + strings.Join(path[:len(path)-2], "/")
 	}
 
 	log.Trace("Create gitea downloader. BaseURL: %s RepoName: %s", baseURL, repoNameSpace)

services/migrations/github.go

@@ -40,15 +40,17 @@ type GithubDownloaderV3Factory struct{}
 
 // New returns a Downloader related to this factory according MigrateOptions
 func (f *GithubDownloaderV3Factory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
+	if len(info.segments) < 2 {
+		return nil, fmt.Errorf("invalid path: %s", info.repoPath)
+	}
 
-	baseURL := u.Scheme + "://" + u.Host
-	fields := strings.Split(u.Path, "/")
-	oldOwner := fields[1]
-	oldName := strings.TrimSuffix(fields[2], ".git")
+	baseURL := info.apiURL.String()
+	oldOwner := info.segments[0]
+	oldName := strings.TrimSuffix(info.segments[1], ".git")
 
 	log.Trace("Create github downloader BaseURL: %s %s/%s", baseURL, oldOwner, oldName)
 

services/migrations/gitlab.go

@@ -39,14 +39,13 @@ type GitlabDownloaderFactory struct{}
 
 // New returns a Downloader related to this factory according MigrateOptions
 func (f *GitlabDownloaderFactory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
 
-	baseURL := u.Scheme + "://" + u.Host
-	repoNameSpace := strings.TrimPrefix(u.Path, "/")
-	repoNameSpace = strings.TrimSuffix(repoNameSpace, ".git")
+	baseURL := info.apiURL.String()
+	repoNameSpace := strings.TrimSuffix(info.repoPath, ".git")
 
 	log.Trace("Create gitlab downloader. BaseURL: %s RepoName: %s", baseURL, repoNameSpace)
 

services/migrations/gogs.go

@@ -32,22 +32,19 @@ type GogsDownloaderFactory struct{}
 
 // New returns a Downloader related to this factory according MigrateOptions
 func (f *GogsDownloaderFactory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
 
-	baseURL := u.Scheme + "://" + u.Host
-	repoNameSpace := strings.TrimSuffix(u.Path, ".git")
-	repoNameSpace = strings.Trim(repoNameSpace, "/")
-
-	fields := strings.Split(repoNameSpace, "/")
-	if len(fields) < 2 {
+	repoNameSpace := strings.TrimSuffix(info.repoPath, ".git")
+	if len(info.segments) < 2 || info.segments[0] == "" {
 		return nil, fmt.Errorf("invalid path: %s", repoNameSpace)
 	}
 
-	log.Trace("Create gogs downloader. BaseURL: %s RepoOwner: %s RepoName: %s", baseURL, fields[0], fields[1])
-	return NewGogsDownloader(ctx, baseURL, opts.AuthUsername, opts.AuthPassword, opts.AuthToken, fields[0], fields[1]), nil
+	baseURL := info.apiURL.String()
+	log.Trace("Create gogs downloader. BaseURL: %s RepoOwner: %s RepoName: %s", baseURL, info.segments[0], info.segments[1])
+	return NewGogsDownloader(ctx, baseURL, opts.AuthUsername, opts.AuthPassword, opts.AuthToken, info.segments[0], strings.TrimSuffix(info.segments[1], ".git")), nil
 }
 
 // GitServiceType returns the type of git service

services/migrations/onedev.go

@@ -37,19 +37,14 @@ type OneDevDownloaderFactory struct{}
 
 // New returns a downloader related to this factory according MigrateOptions
 func (f *OneDevDownloaderFactory) New(ctx context.Context, opts base.MigrateOptions) (base.Downloader, error) {
-	u, err := url.Parse(opts.CloneAddr)
+	info, err := parseServiceCloneURL(opts.CloneAddr)
 	if err != nil {
 		return nil, err
 	}
 
-	repoPath := strings.Trim(u.Path, "/")
+	log.Trace("Create onedev downloader. BaseURL: %v RepoPath: %s", info.apiURL, info.repoPath)
 
-	u.Path = ""
-	u.Fragment = ""
-
-	log.Trace("Create onedev downloader. BaseURL: %v RepoPath: %s", u, repoPath)
-
-	return NewOneDevDownloader(ctx, u, opts.AuthUsername, opts.AuthPassword, repoPath), nil
+	return NewOneDevDownloader(ctx, info.apiURL, opts.AuthUsername, opts.AuthPassword, info.repoPath), nil
 }
 
 // GitServiceType returns the type of git service

templates/repo/migrate/codebase.tmpl

@@ -19,14 +19,15 @@
 					</span>
 				</div>
 
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_username">{{ctx.Locale.Tr "username"}}</label>
 					<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_password">{{ctx.Locale.Tr "password"}}</label>
 					<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">
 				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/git.tmpl

@@ -17,31 +17,16 @@
 					<span class="help">
 					{{ctx.Locale.Tr "repo.migrate.clone_address_desc"}}{{if .ContextUser.CanImportLocal}} {{ctx.Locale.Tr "repo.migrate.clone_local_path"}}{{end}}
 					</span>
-					<span class="help ssh-help tw-hidden">
-					<br><strong>{{ctx.Locale.Tr "repo.migrate.ssh_helper_title"}}:</strong> {{ctx.Locale.Tr "repo.migrate.ssh_helper_desc"}}
-					<a href="{{AppSubUrl}}/user/settings/keys" target="_blank">{{ctx.Locale.Tr "repo.migrate.ssh_helper_link"}}</a>
-					</span>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_username">{{ctx.Locale.Tr "username"}}</label>
 					<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_password">{{ctx.Locale.Tr "password"}}</label>
 					<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">
 				</div>
-				<div class="inline field ssh-key-owner-selector tw-hidden" data-signed-user-id="{{.SignedUser.ID}}">
-					<label>{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_label"}}</label>
-					<div class="ui selection dropdown">
-						<input id="ssh_key_owner_id" name="ssh_key_owner_id" type="hidden" value="0">
-						<div class="default text">{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_org_default"}}</div>
-						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
-						<div class="menu">
-							<div class="item" data-value="0">{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_org_default"}}</div>
-							<div class="item" data-value="{{.SignedUser.ID}}">{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_personal" .SignedUser.Name}}</div>
-						</div>
-					</div>
-				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/gitbucket.tmpl

@@ -19,14 +19,15 @@
 					</span>
 				</div>
 
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_username">{{ctx.Locale.Tr "username"}}</label>
 					<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_password">{{ctx.Locale.Tr "password"}}</label>
 					<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">
 				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/gitea.tmpl

@@ -23,6 +23,7 @@
 					<input id="auth_token" name="auth_token" type="password" autocomplete="new-password" value="{{.auth_token}}" {{if not .auth_token}} data-need-clear="true" {{end}}>
 					<a target="_blank" href="https://docs.gitea.com/development/api-usage">{{svg "octicon-question"}}</a>
 				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/github.tmpl

@@ -26,6 +26,7 @@
 					{{ctx.Locale.Tr "repo.migrate.github_token_desc"}}
 					</span>
 				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/gitlab.tmpl

@@ -23,6 +23,7 @@
 					<input id="auth_token" name="auth_token" type="password" autocomplete="new-password" value="{{.auth_token}}" {{if not .auth_token}}data-need-clear="true"{{end}}>
 					<a target="_blank" href="https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html">{{svg "octicon-question"}}</a>
 				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/gogs.tmpl

@@ -23,6 +23,7 @@
 					<input id="auth_token" name="auth_token" type="password" autocomplete="new-password" value="{{.auth_token}}" {{if not .auth_token}} data-need-clear="true" {{end}}>
 					<!-- <a target="_blank" href="https://docs.gitea.com/development/api-usage">{{svg "octicon-question"}}</a> -->
 				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/onedev.tmpl

@@ -19,14 +19,15 @@
 					</span>
 				</div>
 
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_username">{{ctx.Locale.Tr "username"}}</label>
 					<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}}">
+				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
 					<label for="auth_password">{{ctx.Locale.Tr "password"}}</label>
 					<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">
 				</div>
+				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 

templates/repo/migrate/ssh_options.tmpl

@@ -0,0 +1,19 @@
+<div class="inline field tw-hidden ssh-help-field">
+	<label></label>
+	<span class="help">
+		<strong>{{ctx.Locale.Tr "repo.migrate.ssh_helper_title"}}:</strong> {{ctx.Locale.Tr "repo.migrate.ssh_helper_desc"}}
+		<a href="{{AppSubUrl}}/user/settings/keys" target="_blank">{{ctx.Locale.Tr "repo.migrate.ssh_helper_link"}}</a>
+	</span>
+</div>
+<div class="inline field ssh-key-owner-selector tw-hidden" data-signed-user-id="{{.SignedUser.ID}}">
+	<label>{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_label"}}</label>
+	<div class="ui selection dropdown">
+		<input id="ssh_key_owner_id" name="ssh_key_owner_id" type="hidden" value="0">
+		<div class="default text">{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_org_default"}}</div>
+		{{svg "octicon-triangle-down" 14 "dropdown icon"}}
+		<div class="menu">
+			<div class="item" data-value="0">{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_org_default"}}</div>
+			<div class="item" data-value="{{.SignedUser.ID}}">{{ctx.Locale.Tr "repo.migrate.ssh_key_owner_personal" .SignedUser.Name}}</div>
+		</div>
+	</div>
+</div>

web_src/js/features/repo-migrate.ts

@@ -68,30 +68,27 @@ function isSSHURL(url: string): boolean {
 
 export function initRepoMigrationForm() {
   const cloneAddrInput = document.querySelector<HTMLInputElement>('#clone_addr');
-  const authUsernameInput = document.querySelector<HTMLInputElement>('#auth_username');
-  const authPasswordInput = document.querySelector<HTMLInputElement>('#auth_password');
-  const sshHelpText = document.querySelector('.help.ssh-help');
+  if (!cloneAddrInput) return;
 
-  if (!cloneAddrInput || !authUsernameInput || !authPasswordInput || !sshHelpText) return;
+  // SSH URLs use key-based auth, so username/password fields become useless
+  // and are hidden. Forge token fields stay visible — the token is still
+  // needed for API calls (issues/PRs/etc.) regardless of the git transport.
+  const userpassFields = document.querySelectorAll<HTMLElement>('.auth-userpass-field');
+  const sshHelpField = document.querySelector<HTMLElement>('.ssh-help-field');
 
   function updateAuthFields() {
-    const url = cloneAddrInput!.value.trim();
-    const isSSH = isSSHURL(url);
+    const isSSH = isSSHURL(cloneAddrInput!.value.trim());
 
-    const usernameField = authUsernameInput!.parentElement!;
-    const passwordField = authPasswordInput!.parentElement!;
-
-    if (isSSH) {
-      // Hide auth fields entirely for SSH URLs (key-based auth only)
-      authUsernameInput!.value = '';
-      authPasswordInput!.value = '';
-      hideElem(usernameField);
-      hideElem(passwordField);
-      showElem(sshHelpText!);
-    } else {
-      showElem(usernameField);
-      showElem(passwordField);
-      hideElem(sshHelpText!);
+    for (const field of userpassFields) {
+      if (isSSH) {
+        for (const input of field.querySelectorAll<HTMLInputElement>('input')) input.value = '';
+        hideElem(field);
+      } else {
+        showElem(field);
+      }
+    }
+    if (sshHelpField) {
+      if (isSSH) showElem(sshHelpField); else hideElem(sshHelpField);
     }
   }