Merge branch 'origin/main' into session-management

Conflict resolutions:
- models/migrations/v1_26/v328.go: kept origin/main's TokenPermissions
  migration; moved AddUserSessionTable to v1_27/v332.go (1.26.0 closed
  at migration 330; 1.27 starts at 331).
- models/migrations/migrations.go: registered session migration as 332
  using v1_27.AddUserSessionTable.
- tests/integration/api_admin_test.go: adopted new DecodeJSON return
  style; cron count is 30 (added cleanup_user_sessions task).

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>

models/actions/artifact.go

@@ -1,7 +1,7 @@
 // Copyright 2023 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-// This artifact server is inspired by https://github.com/nektos/act/blob/master/pkg/artifacts/server.go.
+// This artifact server is inspired by the Gitea runner artifact server implementation.
 // It updates url setting and uses ObjectStore to handle artifacts persistence.
 
 package actions
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 
@@ -53,36 +54,53 @@ func init() {
 	db.RegisterModel(new(ActionArtifact))
 }
 
+const (
+	ContentEncodingV3Gzip = "gzip"
+	ContentTypeZip        = "application/zip"
+)
+
 // ActionArtifact is a file that is stored in the artifact storage.
 type ActionArtifact struct {
 	ID                 int64 `xorm:"pk autoincr"`
-	RunID              int64 `xorm:"index unique(runid_name_path)"` // The run id of the artifact
+	RunID              int64 `xorm:"index unique(runid_attempt_name_path)"` // The run id of the artifact
+	RunAttemptID       int64 `xorm:"index unique(runid_attempt_name_path) NOT NULL DEFAULT 0"`
 	RunnerID           int64
 	RepoID             int64 `xorm:"index"`
 	OwnerID            int64
 	CommitSHA          string
-	StoragePath        string             // The path to the artifact in the storage
-	FileSize           int64              // The size of the artifact in bytes
-	FileCompressedSize int64              // The size of the artifact in bytes after gzip compression
-	ContentEncoding    string             // The content encoding of the artifact
-	ArtifactPath       string             `xorm:"index unique(runid_name_path)"` // The path to the artifact when runner uploads it
-	ArtifactName       string             `xorm:"index unique(runid_name_path)"` // The name of the artifact when runner uploads it
-	Status             ArtifactStatus     `xorm:"index"`                         // The status of the artifact, uploading, expired or need-delete
-	CreatedUnix        timeutil.TimeStamp `xorm:"created"`
-	UpdatedUnix        timeutil.TimeStamp `xorm:"updated index"`
-	ExpiredUnix        timeutil.TimeStamp `xorm:"index"` // The time when the artifact will be expired
+	StoragePath        string // The path to the artifact in the storage
+	FileSize           int64  // The size of the artifact in bytes
+	FileCompressedSize int64  // The size of the artifact in bytes after gzip compression
+
+	// The content encoding or content type of the artifact
+	// * empty or null: legacy (v3) uncompressed content
+	// * magic string "gzip" (ContentEncodingV3Gzip): v3 gzip compressed content
+	//   * requires gzip decoding before storing in a zip for download
+	//   * requires gzip content-encoding header when downloaded single files within a workflow
+	// * mime type for "Content-Type":
+	//   * "application/zip" (ContentTypeZip), seems to be an abuse, fortunately there is no conflict, and it won't cause problems?
+	//   * "application/pdf", "text/html", etc.: real content type of the artifact
+	ContentEncodingOrType string `xorm:"content_encoding"`
+
+	ArtifactPath string             `xorm:"index unique(runid_attempt_name_path)"` // The path to the artifact when runner uploads it
+	ArtifactName string             `xorm:"index unique(runid_attempt_name_path)"` // The name of the artifact when runner uploads it
+	Status       ArtifactStatus     `xorm:"index"`                                 // The status of the artifact, uploading, expired or need-delete
+	CreatedUnix  timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix  timeutil.TimeStamp `xorm:"updated index"`
+	ExpiredUnix  timeutil.TimeStamp `xorm:"index"` // The time when the artifact will be expired
 }
 
 func CreateArtifact(ctx context.Context, t *ActionTask, artifactName, artifactPath string, expiredDays int64) (*ActionArtifact, error) {
 	if err := t.LoadJob(ctx); err != nil {
 		return nil, err
 	}
-	artifact, err := getArtifactByNameAndPath(ctx, t.Job.RunID, artifactName, artifactPath)
+	artifact, err := getArtifactByNameAndPath(ctx, t.Job.RunID, t.Job.RunAttemptID, artifactName, artifactPath)
 	if errors.Is(err, util.ErrNotExist) {
 		artifact := &ActionArtifact{
 			ArtifactName: artifactName,
 			ArtifactPath: artifactPath,
 			RunID:        t.Job.RunID,
+			RunAttemptID: t.Job.RunAttemptID,
 			RunnerID:     t.RunnerID,
 			RepoID:       t.RepoID,
 			OwnerID:      t.OwnerID,
@@ -107,9 +125,9 @@ func CreateArtifact(ctx context.Context, t *ActionTask, artifactName, artifactPa
 	return artifact, nil
 }
 
-func getArtifactByNameAndPath(ctx context.Context, runID int64, name, fpath string) (*ActionArtifact, error) {
+func getArtifactByNameAndPath(ctx context.Context, runID, runAttemptID int64, name, fpath string) (*ActionArtifact, error) {
 	var art ActionArtifact
-	has, err := db.GetEngine(ctx).Where("run_id = ? AND artifact_name = ? AND artifact_path = ?", runID, name, fpath).Get(&art)
+	has, err := db.GetEngine(ctx).Where("run_id = ? AND run_attempt_id = ? AND artifact_name = ? AND artifact_path = ?", runID, runAttemptID, name, fpath).Get(&art)
 	if err != nil {
 		return nil, err
 	} else if !has {
@@ -129,6 +147,7 @@ type FindArtifactsOptions struct {
 	db.ListOptions
 	RepoID               int64
 	RunID                int64
+	RunAttemptID         optional.Option[int64] // use optional to allow filtering by zero (legacy artifacts have run_attempt_id=0)
 	ArtifactName         string
 	Status               int
 	FinalizedArtifactsV4 bool
@@ -148,6 +167,9 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	if opts.RunID > 0 {
 		cond = cond.And(builder.Eq{"run_id": opts.RunID})
 	}
+	if opts.RunAttemptID.Has() {
+		cond = cond.And(builder.Eq{"run_attempt_id": opts.RunAttemptID.Value()})
+	}
 	if opts.ArtifactName != "" {
 		cond = cond.And(builder.Eq{"artifact_name": opts.ArtifactName})
 	}
@@ -156,7 +178,8 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	}
 	if opts.FinalizedArtifactsV4 {
 		cond = cond.And(builder.Eq{"status": ArtifactStatusUploadConfirmed}.Or(builder.Eq{"status": ArtifactStatusExpired}))
-		cond = cond.And(builder.Eq{"content_encoding": "application/zip"})
+		// see the comment of ActionArtifact.ContentEncodingOrType: "*/*" means the field is a content type
+		cond = cond.And(builder.Like{"content_encoding", "%/%"})
 	}
 
 	return cond
@@ -167,15 +190,17 @@ type ActionArtifactMeta struct {
 	ArtifactName string
 	FileSize     int64
 	Status       ArtifactStatus
+	ExpiredUnix  timeutil.TimeStamp
 }
 
-// ListUploadedArtifactsMeta returns all uploaded artifacts meta of a run
-func ListUploadedArtifactsMeta(ctx context.Context, runID int64) ([]*ActionArtifactMeta, error) {
+// ListUploadedArtifactsMetaByRunAttempt returns uploaded artifacts meta scoped to a specific run and attempt.
+// Pass runAttemptID=0 to target legacy artifacts (pre-v331) belonging to the run.
+func ListUploadedArtifactsMetaByRunAttempt(ctx context.Context, repoID, runID, runAttemptID int64) ([]*ActionArtifactMeta, error) {
 	arts := make([]*ActionArtifactMeta, 0, 10)
 	return arts, db.GetEngine(ctx).Table("action_artifact").
-		Where("run_id=? AND (status=? OR status=?)", runID, ArtifactStatusUploadConfirmed, ArtifactStatusExpired).
+		Where("repo_id=? AND run_id=? AND run_attempt_id=? AND (status=? OR status=?)", repoID, runID, runAttemptID, ArtifactStatusUploadConfirmed, ArtifactStatusExpired).
 		GroupBy("artifact_name").
-		Select("artifact_name, sum(file_size) as file_size, max(status) as status").
+		Select("artifact_name, sum(file_size) as file_size, max(status) as status, max(expired_unix) as expired_unix").
 		Find(&arts)
 }
 
@@ -200,12 +225,29 @@ func SetArtifactExpired(ctx context.Context, artifactID int64) error {
 	return err
 }
 
-// SetArtifactNeedDelete sets an artifact to need-delete, cron job will delete it
-func SetArtifactNeedDelete(ctx context.Context, runID int64, name string) error {
-	_, err := db.GetEngine(ctx).Where("run_id=? AND artifact_name=? AND status = ?", runID, name, ArtifactStatusUploadConfirmed).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusPendingDeletion})
+// SetArtifactNeedDeleteByID sets an artifact to need-delete by ID, cron job will delete it.
+func SetArtifactNeedDeleteByID(ctx context.Context, artifactID int64) error {
+	_, err := db.GetEngine(ctx).Where("id=? AND status = ?", artifactID, ArtifactStatusUploadConfirmed).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusPendingDeletion})
 	return err
 }
 
+// SetArtifactNeedDeleteByRunAttempt sets an artifact to need-delete in a run attempt, cron job will delete it.
+// runAttemptID may be 0 for legacy artifacts created before ActionRunAttempt existed.
+func SetArtifactNeedDeleteByRunAttempt(ctx context.Context, runID, runAttemptID int64, name string) error {
+	_, err := db.GetEngine(ctx).Where("run_id=? AND run_attempt_id=? AND artifact_name=? AND status = ?", runID, runAttemptID, name, ArtifactStatusUploadConfirmed).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusPendingDeletion})
+	return err
+}
+
+// GetArtifactsByRunAttemptAndName returns all artifacts with the given name in the specified run attempt.
+// This supports both attempt-scoped data and legacy artifacts with run_attempt_id=0.
+func GetArtifactsByRunAttemptAndName(ctx context.Context, runID, runAttemptID int64, artifactName string) ([]*ActionArtifact, error) {
+	arts := make([]*ActionArtifact, 0)
+	return arts, db.GetEngine(ctx).
+		Where("run_id = ? AND run_attempt_id = ? AND artifact_name = ?", runID, runAttemptID, artifactName).
+		OrderBy("id").
+		Find(&arts)
+}
+
 // SetArtifactDeleted sets an artifact to deleted
 func SetArtifactDeleted(ctx context.Context, artifactID int64) error {
 	_, err := db.GetEngine(ctx).ID(artifactID).Cols("status").Update(&ActionArtifact{Status: ArtifactStatusDeleted})

models/actions/config.go

@@ -0,0 +1,74 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"code.gitea.io/gitea/models/perm"
+	repo_model "code.gitea.io/gitea/models/repo"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/json"
+	"code.gitea.io/gitea/modules/util"
+
+	"xorm.io/xorm/convert"
+)
+
+// OwnerActionsConfig defines the Actions configuration for a user or organization
+type OwnerActionsConfig struct {
+	// TokenPermissionMode defines the default permission mode (permissive, restricted)
+	TokenPermissionMode repo_model.ActionsTokenPermissionMode `json:"token_permission_mode,omitempty"`
+
+	// MaxTokenPermissions defines the absolute maximum permissions any token can have in this context.
+	MaxTokenPermissions *repo_model.ActionsTokenPermissions `json:"max_token_permissions,omitempty"`
+
+	// AllowedCrossRepoIDs is a list of specific repo IDs that can be accessed cross-repo
+	AllowedCrossRepoIDs []int64 `json:"allowed_cross_repo_ids,omitempty"`
+}
+
+var _ convert.ConversionFrom = (*OwnerActionsConfig)(nil)
+
+func (cfg *OwnerActionsConfig) FromDB(bytes []byte) error {
+	_ = json.Unmarshal(bytes, cfg)
+	cfg.TokenPermissionMode, _ = util.EnumValue(cfg.TokenPermissionMode)
+	return nil
+}
+
+// GetOwnerActionsConfig loads the OwnerActionsConfig for a user or organization from user settings
+// It returns a default config if no setting is found
+func GetOwnerActionsConfig(ctx context.Context, userID int64) (ret OwnerActionsConfig, err error) {
+	return user_model.GetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, ret)
+}
+
+// SetOwnerActionsConfig saves the OwnerActionsConfig for a user or organization to user settings
+func SetOwnerActionsConfig(ctx context.Context, userID int64, cfg OwnerActionsConfig) error {
+	return user_model.SetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, cfg)
+}
+
+// GetDefaultTokenPermissions returns the default token permissions by its TokenPermissionMode.
+func (cfg *OwnerActionsConfig) GetDefaultTokenPermissions() repo_model.ActionsTokenPermissions {
+	switch cfg.TokenPermissionMode {
+	case repo_model.ActionsTokenPermissionModeRestricted:
+		return repo_model.MakeRestrictedPermissions()
+	case repo_model.ActionsTokenPermissionModePermissive:
+		return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
+	default:
+		return repo_model.MakeActionsTokenPermissions(perm.AccessModeNone)
+	}
+}
+
+// GetMaxTokenPermissions returns the maximum allowed permissions
+func (cfg *OwnerActionsConfig) GetMaxTokenPermissions() repo_model.ActionsTokenPermissions {
+	if cfg.MaxTokenPermissions != nil {
+		return *cfg.MaxTokenPermissions
+	}
+	// Default max is write for everything
+	return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
+}
+
+// ClampPermissions ensures that the given permissions don't exceed the maximum
+func (cfg *OwnerActionsConfig) ClampPermissions(perms repo_model.ActionsTokenPermissions) repo_model.ActionsTokenPermissions {
+	maxPerms := cfg.GetMaxTokenPermissions()
+	return repo_model.ClampActionsTokenPermissions(perms, maxPerms)
+}

models/actions/run.go

@@ -30,7 +30,7 @@ import (
 type ActionRun struct {
 	ID                int64
 	Title             string
-	RepoID            int64                  `xorm:"unique(repo_index) index(repo_concurrency)"`
+	RepoID            int64                  `xorm:"unique(repo_index)"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	OwnerID           int64                  `xorm:"index"`
 	WorkflowID        string                 `xorm:"index"`                    // the name of workflow file
@@ -50,15 +50,20 @@ type ActionRun struct {
 	Status            Status                       `xorm:"index"`
 	Version           int                          `xorm:"version default 0"` // Status could be updated concomitantly, so an optimistic lock is needed
 	RawConcurrency    string                       // raw concurrency
-	ConcurrencyGroup  string                       `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"`
-	ConcurrencyCancel bool                         `xorm:"NOT NULL DEFAULT FALSE"`
-	// Started and Stopped is used for recording last run time, if rerun happened, they will be reset to 0
+
+	// Started and Stopped are identical to the latest attempt after ActionRunAttempt was introduced.
+	// When a rerun creates a new latest attempt, they are reset until the new attempt starts and stops.
 	Started timeutil.TimeStamp
 	Stopped timeutil.TimeStamp
-	// PreviousDuration is used for recording previous duration
+
+	// PreviousDuration is kept only for legacy runs created before ActionRunAttempt existed.
+	// New runs and reruns no longer update this field and use attempt-scoped durations instead.
 	PreviousDuration time.Duration
-	Created          timeutil.TimeStamp `xorm:"created"`
-	Updated          timeutil.TimeStamp `xorm:"updated"`
+
+	LatestAttemptID int64 `xorm:"index NOT NULL DEFAULT 0"`
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
 }
 
 func init() {
@@ -66,11 +71,11 @@ func init() {
 	db.RegisterModel(new(ActionRunIndex))
 }
 
-func (run *ActionRun) HTMLURL() string {
+func (run *ActionRun) HTMLURL(ctxOpt ...context.Context) string {
 	if run.Repo == nil {
 		return ""
 	}
-	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.HTMLURL(), run.ID)
+	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.HTMLURL(ctxOpt...), run.ID)
 }
 
 func (run *ActionRun) Link() string {
@@ -116,10 +121,6 @@ func (run *ActionRun) RefTooltip() string {
 
 // LoadAttributes load Repo TriggerUser if not loaded
 func (run *ActionRun) LoadAttributes(ctx context.Context) error {
-	if run == nil {
-		return nil
-	}
-
 	if err := run.LoadRepo(ctx); err != nil {
 		return err
 	}
@@ -128,19 +129,19 @@ func (run *ActionRun) LoadAttributes(ctx context.Context) error {
 		return err
 	}
 
-	if run.TriggerUser == nil {
-		u, err := user_model.GetPossibleUserByID(ctx, run.TriggerUserID)
-		if err != nil {
-			return err
-		}
-		run.TriggerUser = u
-	}
+	return run.LoadTriggerUser(ctx)
+}
 
-	return nil
+func (run *ActionRun) LoadTriggerUser(ctx context.Context) (err error) {
+	if run.TriggerUser != nil {
+		return nil
+	}
+	run.TriggerUserID, run.TriggerUser, err = user_model.GetPossibleUserByID(ctx, run.TriggerUserID)
+	return err
 }
 
 func (run *ActionRun) LoadRepo(ctx context.Context) error {
-	if run == nil || run.Repo != nil {
+	if run.Repo != nil {
 		return nil
 	}
 
@@ -153,7 +154,36 @@ func (run *ActionRun) LoadRepo(ctx context.Context) error {
 }
 
 func (run *ActionRun) Duration() time.Duration {
-	return calculateDuration(run.Started, run.Stopped, run.Status) + run.PreviousDuration
+	d := calculateDuration(run.Started, run.Stopped, run.Status, run.Updated) + run.PreviousDuration
+	if d < 0 {
+		return 0
+	}
+	return d
+}
+
+// GetLatestAttempt returns
+//   - the latest attempt of the run
+//   - (nil, false, nil) for legacy runs that have no attempt records
+func (run *ActionRun) GetLatestAttempt(ctx context.Context) (*ActionRunAttempt, bool, error) {
+	if run.LatestAttemptID == 0 {
+		return nil, false, nil
+	}
+	attempt, err := GetRunAttemptByRepoAndID(ctx, run.RepoID, run.LatestAttemptID)
+	if err != nil {
+		return nil, false, err
+	}
+	return attempt, true, nil
+}
+
+func (run *ActionRun) GetEffectiveConcurrency(ctx context.Context) (string, bool, error) {
+	attempt, has, err := run.GetLatestAttempt(ctx)
+	if err != nil {
+		return "", false, err
+	}
+	if has {
+		return attempt.ConcurrencyGroup, attempt.ConcurrencyCancel, nil
+	}
+	return "", false, nil
 }
 
 func (run *ActionRun) GetPushEventPayload() (*api.PushPayload, error) {
@@ -322,16 +352,16 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }
 
-func GetRunByIndex(ctx context.Context, repoID, index int64) (*ActionRun, error) {
+func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
 	run := &ActionRun{
 		RepoID: repoID,
-		Index:  index,
+		Index:  runIndex,
 	}
 	has, err := db.GetEngine(ctx).Get(run)
 	if err != nil {
 		return nil, err
 	} else if !has {
-		return nil, fmt.Errorf("run with index %d %d: %w", repoID, index, util.ErrNotExist)
+		return nil, fmt.Errorf("run with repo_id %d and index %d: %w", repoID, runIndex, util.ErrNotExist)
 	}
 
 	return run, nil
@@ -402,14 +432,11 @@ func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {
 
 type ActionRunIndex db.ResourceIndex
 
-func GetConcurrentRunsAndJobs(ctx context.Context, repoID int64, concurrencyGroup string, status []Status) ([]*ActionRun, []*ActionRunJob, error) {
-	runs, err := db.Find[ActionRun](ctx, &FindRunOptions{
-		RepoID:           repoID,
-		ConcurrencyGroup: concurrencyGroup,
-		Status:           status,
-	})
+// GetConcurrentRunAttemptsAndJobs returns run attempts and jobs in the same concurrency group by statuses.
+func GetConcurrentRunAttemptsAndJobs(ctx context.Context, repoID int64, concurrencyGroup string, status []Status) ([]*ActionRunAttempt, []*ActionRunJob, error) {
+	attempts, err := FindConcurrentRunAttempts(ctx, repoID, concurrencyGroup, status)
 	if err != nil {
-		return nil, nil, fmt.Errorf("find runs: %w", err)
+		return nil, nil, fmt.Errorf("find run attempts: %w", err)
 	}
 
 	jobs, err := db.Find[ActionRunJob](ctx, &FindRunJobOptions{
@@ -421,36 +448,34 @@ func GetConcurrentRunsAndJobs(ctx context.Context, repoID int64, concurrencyGrou
 		return nil, nil, fmt.Errorf("find jobs: %w", err)
 	}
 
-	return runs, jobs, nil
+	return attempts, jobs, nil
 }
 
-func CancelPreviousJobsByRunConcurrency(ctx context.Context, actionRun *ActionRun) ([]*ActionRunJob, error) {
-	if actionRun.ConcurrencyGroup == "" {
+func CancelPreviousJobsByRunConcurrency(ctx context.Context, attempt *ActionRunAttempt) ([]*ActionRunJob, error) {
+	if attempt.ConcurrencyGroup == "" {
 		return nil, nil
 	}
 
 	var jobsToCancel []*ActionRunJob
 
 	statusFindOption := []Status{StatusWaiting, StatusBlocked}
-	if actionRun.ConcurrencyCancel {
+	if attempt.ConcurrencyCancel {
 		statusFindOption = append(statusFindOption, StatusRunning)
 	}
-	runs, jobs, err := GetConcurrentRunsAndJobs(ctx, actionRun.RepoID, actionRun.ConcurrencyGroup, statusFindOption)
+	attempts, jobs, err := GetConcurrentRunAttemptsAndJobs(ctx, attempt.RepoID, attempt.ConcurrencyGroup, statusFindOption)
 	if err != nil {
 		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
 	}
 	jobsToCancel = append(jobsToCancel, jobs...)
 
 	// cancel runs in the same concurrency group
-	for _, run := range runs {
-		if run.ID == actionRun.ID {
+	for _, concurrentAttempt := range attempts {
+		if concurrentAttempt.RunID == attempt.RunID {
 			continue
 		}
-		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
-			RunID: run.ID,
-		})
+		jobs, err := GetRunJobsByRunAndAttemptID(ctx, concurrentAttempt.RunID, concurrentAttempt.ID)
 		if err != nil {
-			return nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
+			return nil, fmt.Errorf("find run %d attempt %d jobs: %w", concurrentAttempt.RunID, concurrentAttempt.ID, err)
 		}
 		jobsToCancel = append(jobsToCancel, jobs...)
 	}

models/actions/run_attempt.go

@@ -0,0 +1,140 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"time"
+
+	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/timeutil"
+	"code.gitea.io/gitea/modules/util"
+)
+
+// ActionRunAttempt represents a single execution attempt of an ActionRun.
+type ActionRunAttempt struct {
+	ID      int64
+	RepoID  int64      `xorm:"index(repo_concurrency_status)"`
+	RunID   int64      `xorm:"UNIQUE(run_attempt)"`
+	Run     *ActionRun `xorm:"-"`
+	Attempt int64      `xorm:"UNIQUE(run_attempt)"`
+
+	TriggerUserID int64
+	TriggerUser   *user_model.User `xorm:"-"`
+
+	ConcurrencyGroup  string `xorm:"index(repo_concurrency_status) NOT NULL DEFAULT ''"`
+	ConcurrencyCancel bool   `xorm:"NOT NULL DEFAULT FALSE"`
+
+	Status  Status `xorm:"index(repo_concurrency_status)"`
+	Started timeutil.TimeStamp
+	Stopped timeutil.TimeStamp
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
+}
+
+func (*ActionRunAttempt) TableName() string {
+	return "action_run_attempt"
+}
+
+func init() {
+	db.RegisterModel(new(ActionRunAttempt))
+}
+
+func (attempt *ActionRunAttempt) Duration() time.Duration {
+	return calculateDuration(attempt.Started, attempt.Stopped, attempt.Status, attempt.Updated)
+}
+
+func (attempt *ActionRunAttempt) LoadAttributes(ctx context.Context) (err error) {
+	if attempt.Run == nil {
+		run, err := GetRunByRepoAndID(ctx, attempt.RepoID, attempt.RunID)
+		if err != nil {
+			return err
+		}
+		if err := run.LoadAttributes(ctx); err != nil {
+			return err
+		}
+		attempt.Run = run
+	}
+
+	if attempt.TriggerUser == nil {
+		attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func GetRunAttemptByRepoAndID(ctx context.Context, repoID, attemptID int64) (*ActionRunAttempt, error) {
+	var attempt ActionRunAttempt
+	has, err := db.GetEngine(ctx).Where("repo_id=? AND id=?", repoID, attemptID).Get(&attempt)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run attempt %d in repo %d: %w", attemptID, repoID, util.ErrNotExist)
+	}
+	return &attempt, nil
+}
+
+func GetRunAttemptByRunIDAndAttemptNum(ctx context.Context, runID, attemptNum int64) (*ActionRunAttempt, error) {
+	var attempt ActionRunAttempt
+	has, err := db.GetEngine(ctx).Where("run_id=? AND attempt=?", runID, attemptNum).Get(&attempt)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run attempt %d for run %d: %w", attemptNum, runID, util.ErrNotExist)
+	}
+	return &attempt, nil
+}
+
+// FindConcurrentRunAttempts returns attempts in the given concurrency group and status set.
+// Results are unordered; callers must not depend on any particular row order.
+func FindConcurrentRunAttempts(ctx context.Context, repoID int64, concurrencyGroup string, statuses []Status) ([]*ActionRunAttempt, error) {
+	attempts := make([]*ActionRunAttempt, 0)
+	sess := db.GetEngine(ctx).Where("repo_id=? AND concurrency_group=?", repoID, concurrencyGroup)
+	if len(statuses) > 0 {
+		sess = sess.In("status", statuses)
+	}
+	return attempts, sess.Find(&attempts)
+}
+
+func UpdateRunAttempt(ctx context.Context, attempt *ActionRunAttempt, cols ...string) error {
+	if slices.Contains(cols, "status") && attempt.Started.IsZero() && attempt.Status.IsRunning() {
+		attempt.Started = timeutil.TimeStampNow()
+		cols = append(cols, "started")
+	}
+
+	sess := db.GetEngine(ctx).ID(attempt.ID)
+	if len(cols) > 0 {
+		sess.Cols(cols...)
+	}
+	if _, err := sess.Update(attempt); err != nil {
+		return err
+	}
+
+	// Only status/timing changes on an attempt need to update the latest run.
+	if len(cols) > 0 && !slices.Contains(cols, "status") && !slices.Contains(cols, "started") && !slices.Contains(cols, "stopped") {
+		return nil
+	}
+
+	run, err := GetRunByRepoAndID(ctx, attempt.RepoID, attempt.RunID)
+	if err != nil {
+		return err
+	}
+	if run.LatestAttemptID != attempt.ID {
+		log.Warn("run %d cannot be updated by an old attempt %d", run.LatestAttemptID, attempt.ID)
+		return nil
+	}
+
+	run.Status = attempt.Status
+	run.Started = attempt.Started
+	run.Stopped = attempt.Stopped
+	return UpdateRun(ctx, run, "status", "started", "stopped")
+}

models/actions/run_attempt_list.go

@@ -0,0 +1,46 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/container"
+)
+
+type ActionRunAttemptList []*ActionRunAttempt
+
+// GetUserIDs returns a slice of user's id
+func (attempts ActionRunAttemptList) GetUserIDs() []int64 {
+	return container.FilterSlice(attempts, func(attempt *ActionRunAttempt) (int64, bool) {
+		return attempt.TriggerUserID, true
+	})
+}
+
+func (attempts ActionRunAttemptList) LoadTriggerUser(ctx context.Context) error {
+	userIDs := attempts.GetUserIDs()
+	users := make(map[int64]*user_model.User, len(userIDs))
+	if err := db.GetEngine(ctx).In("id", userIDs).Find(&users); err != nil {
+		return err
+	}
+	for _, attempt := range attempts {
+		if attempt.TriggerUserID == user_model.ActionsUserID {
+			attempt.TriggerUser = user_model.NewActionsUser()
+		} else {
+			attempt.TriggerUser = users[attempt.TriggerUserID]
+			if attempt.TriggerUser == nil {
+				attempt.TriggerUser = user_model.NewGhostUser()
+			}
+		}
+	}
+	return nil
+}
+
+// ListRunAttemptsByRunID returns all attempts of a run, ordered by attempt number DESC (newest first).
+func ListRunAttemptsByRunID(ctx context.Context, runID int64) (ActionRunAttemptList, error) {
+	var attempts ActionRunAttemptList
+	return attempts, db.GetEngine(ctx).Where("run_id=?", runID).OrderBy("attempt DESC").Find(&attempts)
+}

models/actions/run_job.go

@@ -18,6 +18,11 @@ import (
 	"xorm.io/builder"
 )
 
+// MaxJobNumPerRun is the maximum number of jobs in a single run.
+// https://docs.github.com/en/actions/reference/limits#existing-system-limits
+// TODO: check this limit when creating jobs
+const MaxJobNumPerRun = 256
+
 // ActionRunJob represents a job of a run
 type ActionRunJob struct {
 	ID                int64
@@ -29,7 +34,10 @@ type ActionRunJob struct {
 	CommitSHA         string                 `xorm:"index"`
 	IsForkPullRequest bool
 	Name              string `xorm:"VARCHAR(255)"`
-	Attempt           int64
+
+	// for legacy jobs, this counts how many times the job has run;
+	// otherwise it matches the Attempt of the ActionRunAttempt identified by job.RunAttemptID
+	Attempt int64
 
 	// WorkflowPayload is act/jobparser.SingleWorkflow for act/jobparser.Parse
 	// it should contain exactly one job with global workflow fields for this model
@@ -38,8 +46,11 @@ type ActionRunJob struct {
 	JobID  string   `xorm:"VARCHAR(255)"` // job id in workflow, not job's id
 	Needs  []string `xorm:"JSON TEXT"`
 	RunsOn []string `xorm:"JSON TEXT"`
-	TaskID int64    // the latest task of the job
-	Status Status   `xorm:"index"`
+
+	TaskID       int64 // the task created by this job in its own attempt
+	SourceTaskID int64 `xorm:"NOT NULL DEFAULT 0"` // SourceTaskID points to a historical task when this job reuses an earlier attempt's result.
+
+	Status Status `xorm:"index"`
 
 	RawConcurrency string // raw concurrency from job YAML's "concurrency" section
 
@@ -51,6 +62,19 @@ type ActionRunJob struct {
 	ConcurrencyGroup  string `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"` // evaluated concurrency.group
 	ConcurrencyCancel bool   `xorm:"NOT NULL DEFAULT FALSE"`                      // evaluated concurrency.cancel-in-progress
 
+	// TokenPermissions stores the explicit permissions from workflow/job YAML (no org/repo clamps applied).
+	// Org/repo clamps are enforced when the token is used at runtime.
+	// It is JSON-encoded repo_model.ActionsTokenPermissions and may be empty if not specified.
+	TokenPermissions *repo_model.ActionsTokenPermissions `xorm:"JSON TEXT"`
+
+	// RunAttemptID identifies the ActionRunAttempt this job belongs to.
+	// A value of 0 indicates a legacy job created before ActionRunAttempt existed.
+	RunAttemptID int64 `xorm:"index NOT NULL DEFAULT 0"`
+	// AttemptJobID is unique within a single attempt.
+	// For jobs created after ActionRunAttempt was introduced, the same logical job is expected to keep the same AttemptJobID across attempts.
+	// A value of 0 indicates a legacy job created before ActionRunAttempt existed.
+	AttemptJobID int64 `xorm:"index NOT NULL DEFAULT 0"`
+
 	Started timeutil.TimeStamp
 	Stopped timeutil.TimeStamp
 	Created timeutil.TimeStamp `xorm:"created"`
@@ -62,7 +86,14 @@ func init() {
 }
 
 func (job *ActionRunJob) Duration() time.Duration {
-	return calculateDuration(job.Started, job.Stopped, job.Status)
+	return calculateDuration(job.Started, job.Stopped, job.Status, job.Updated)
+}
+
+func (job *ActionRunJob) EffectiveTaskID() int64 {
+	if job.TaskID > 0 {
+		return job.TaskID
+	}
+	return job.SourceTaskID
 }
 
 func (job *ActionRunJob) LoadRun(ctx context.Context) error {
@@ -89,10 +120,6 @@ func (job *ActionRunJob) LoadRepo(ctx context.Context) error {
 
 // LoadAttributes load Run if not loaded
 func (job *ActionRunJob) LoadAttributes(ctx context.Context) error {
-	if job == nil {
-		return nil
-	}
-
 	if err := job.LoadRun(ctx); err != nil {
 		return err
 	}
@@ -142,9 +169,50 @@ func GetRunJobByRunAndID(ctx context.Context, runID, jobID int64) (*ActionRunJob
 	return &job, nil
 }
 
-func GetRunJobsByRunID(ctx context.Context, runID int64) (ActionJobList, error) {
+func GetRunJobByAttemptJobID(ctx context.Context, runID, attemptID, attemptJobID int64) (*ActionRunJob, error) {
+	var job ActionRunJob
+	has, err := db.GetEngine(ctx).Where("run_id=? AND run_attempt_id=? AND attempt_job_id=?", runID, attemptID, attemptJobID).Get(&job)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, fmt.Errorf("run job with attempt_job_id %d in run %d attempt %d: %w", attemptJobID, runID, attemptID, util.ErrNotExist)
+	}
+
+	return &job, nil
+}
+
+// GetLatestAttemptJobsByRepoAndRunID returns the jobs of the latest attempt for a run.
+// It prefers the latest attempt when one exists, and falls back to legacy jobs with run_attempt_id=0 for runs created before ActionRunAttempt existed.
+func GetLatestAttemptJobsByRepoAndRunID(ctx context.Context, repoID, runID int64) (ActionJobList, error) {
+	run, err := GetRunByRepoAndID(ctx, repoID, runID)
+	if err != nil {
+		return nil, err
+	}
+	if run.LatestAttemptID > 0 {
+		return GetRunJobsByRunAndAttemptID(ctx, runID, run.LatestAttemptID)
+	}
+
 	var jobs []*ActionRunJob
-	if err := db.GetEngine(ctx).Where("run_id=?", runID).OrderBy("id").Find(&jobs); err != nil {
+	if err := db.GetEngine(ctx).Where("repo_id=? AND run_id=? AND run_attempt_id=0", repoID, runID).OrderBy("id").Find(&jobs); err != nil {
+		return nil, err
+	}
+	return jobs, nil
+}
+
+// GetAllRunJobsByRepoAndRunID returns all jobs for a run across all attempts.
+func GetAllRunJobsByRepoAndRunID(ctx context.Context, repoID, runID int64) (ActionJobList, error) {
+	var jobs []*ActionRunJob
+	if err := db.GetEngine(ctx).Where("repo_id=? AND run_id=?", repoID, runID).OrderBy("id").Find(&jobs); err != nil {
+		return nil, err
+	}
+	return jobs, nil
+}
+
+// GetRunJobsByRunAndAttemptID returns jobs for a run within a specific attempt.
+// runAttemptID may be 0 to address legacy jobs that were created before ActionRunAttempt existed and therefore have no attempt association.
+func GetRunJobsByRunAndAttemptID(ctx context.Context, runID, runAttemptID int64) (ActionJobList, error) {
+	var jobs []*ActionRunJob
+	if err := db.GetEngine(ctx).Where("run_id=? AND run_attempt_id=?", runID, runAttemptID).OrderBy("id").Find(&jobs); err != nil {
 		return nil, err
 	}
 	return jobs, nil
@@ -186,25 +254,51 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 	}
 
 	{
-		// Other goroutines may aggregate the status of the run and update it too.
-		// So we need load the run and its jobs before updating the run.
-		run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
-		if err != nil {
-			return 0, err
-		}
-		jobs, err := GetRunJobsByRunID(ctx, job.RunID)
-		if err != nil {
-			return 0, err
-		}
-		run.Status = AggregateJobStatus(jobs)
-		if run.Started.IsZero() && run.Status.IsRunning() {
-			run.Started = timeutil.TimeStampNow()
-		}
-		if run.Stopped.IsZero() && run.Status.IsDone() {
-			run.Stopped = timeutil.TimeStampNow()
-		}
-		if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
-			return 0, fmt.Errorf("update run %d: %w", run.ID, err)
+		// Other goroutines may aggregate the status of the attempt/run and update it too.
+		// So we need to load the current jobs before updating the aggregate state.
+		if job.RunAttemptID > 0 {
+			attempt, err := GetRunAttemptByRepoAndID(ctx, job.RepoID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetRunJobsByRunAndAttemptID(ctx, job.RunID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			attempt.Status = AggregateJobStatus(jobs)
+			if attempt.Started.IsZero() && attempt.Status.IsRunning() {
+				attempt.Started = timeutil.TimeStampNow()
+			}
+			if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
+				attempt.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
+			}
+		} else {
+			// TODO: Remove this fallback in the future.
+			// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
+			// This path keeps those runs' status consistent when their jobs finish, including:
+			//   - jobs created before migration v331 and complete on the new version starts
+			//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
+			run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetLatestAttemptJobsByRepoAndRunID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			run.Status = AggregateJobStatus(jobs)
+			if run.Started.IsZero() && run.Status.IsRunning() {
+				run.Started = timeutil.TimeStampNow()
+			}
+			if run.Stopped.IsZero() && run.Status.IsDone() {
+				run.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run %d: %w", run.ID, err)
+			}
 		}
 	}
 
@@ -259,7 +353,7 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 	if job.ConcurrencyCancel {
 		statusFindOption = append(statusFindOption, StatusRunning)
 	}
-	runs, jobs, err := GetConcurrentRunsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, statusFindOption)
+	attempts, jobs, err := GetConcurrentRunAttemptsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, statusFindOption)
 	if err != nil {
 		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
 	}
@@ -267,12 +361,13 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 	jobsToCancel = append(jobsToCancel, jobs...)
 
 	// cancel runs in the same concurrency group
-	for _, run := range runs {
-		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
-			RunID: run.ID,
-		})
+	for _, attempt := range attempts {
+		if attempt.ID == job.RunAttemptID {
+			continue
+		}
+		jobs, err := GetRunJobsByRunAndAttemptID(ctx, attempt.RunID, attempt.ID)
 		if err != nil {
-			return nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
+			return nil, fmt.Errorf("find run %d attempt %d jobs: %w", attempt.RunID, attempt.ID, err)
 		}
 		jobsToCancel = append(jobsToCancel, jobs...)
 	}

models/actions/run_job_list.go

@@ -9,6 +9,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/container"
+	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/timeutil"
 
 	"xorm.io/builder"
@@ -55,8 +56,10 @@ func (jobs ActionJobList) LoadRuns(ctx context.Context, withRepo bool) error {
 		return err
 	}
 	for _, j := range jobs {
-		if j.RunID > 0 && j.Run == nil {
+		if j.Run == nil {
 			j.Run = runs[j.RunID]
+		}
+		if j.Run != nil {
 			j.Run.Repo = j.Repo
 		}
 	}
@@ -70,6 +73,7 @@ func (jobs ActionJobList) LoadAttributes(ctx context.Context, withRepo bool) err
 type FindRunJobOptions struct {
 	db.ListOptions
 	RunID            int64
+	RunAttemptID     optional.Option[int64] // use optional to allow filtering by zero (legacy jobs have run_attempt_id=0)
 	RepoID           int64
 	OwnerID          int64
 	CommitSHA        string
@@ -83,6 +87,9 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 	if opts.RunID > 0 {
 		cond = cond.And(builder.Eq{"`action_run_job`.run_id": opts.RunID})
 	}
+	if opts.RunAttemptID.Has() {
+		cond = cond.And(builder.Eq{"`action_run_job`.run_attempt_id": opts.RunAttemptID.Value()})
+	}
 	if opts.RepoID > 0 {
 		cond = cond.And(builder.Eq{"`action_run_job`.repo_id": opts.RepoID})
 	}

models/actions/run_list.go

@@ -18,46 +18,40 @@ import (
 
 type RunList []*ActionRun
 
-// GetUserIDs returns a slice of user's id
-func (runs RunList) GetUserIDs() []int64 {
-	return container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
-		return run.TriggerUserID, true
-	})
-}
-
-func (runs RunList) GetRepoIDs() []int64 {
-	return container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
-		return run.RepoID, true
-	})
-}
-
 func (runs RunList) LoadTriggerUser(ctx context.Context) error {
-	userIDs := runs.GetUserIDs()
+	userIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
+		return run.TriggerUserID, run.TriggerUser == nil
+	})
 	users := make(map[int64]*user_model.User, len(userIDs))
 	if err := db.GetEngine(ctx).In("id", userIDs).Find(&users); err != nil {
 		return err
 	}
 	for _, run := range runs {
-		if run.TriggerUserID == user_model.ActionsUserID {
-			run.TriggerUser = user_model.NewActionsUser()
-		} else {
-			run.TriggerUser = users[run.TriggerUserID]
-			if run.TriggerUser == nil {
-				run.TriggerUser = user_model.NewGhostUser()
-			}
+		if run.TriggerUser != nil {
+			continue
+		}
+		run.TriggerUser = users[run.TriggerUserID]
+		if run.TriggerUserID < 0 {
+			run.TriggerUserID, run.TriggerUser, _ = user_model.GetPossibleUserByID(ctx, run.TriggerUserID)
+		} else if run.TriggerUser == nil {
+			run.TriggerUserID, run.TriggerUser, _ = user_model.GetPossibleUserByID(ctx, user_model.GhostUserID)
 		}
 	}
 	return nil
 }
 
 func (runs RunList) LoadRepos(ctx context.Context) error {
-	repoIDs := runs.GetRepoIDs()
+	repoIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
+		return run.RepoID, run.Repo == nil
+	})
 	repos, err := repo_model.GetRepositoriesMapByIDs(ctx, repoIDs)
 	if err != nil {
 		return err
 	}
 	for _, run := range runs {
-		run.Repo = repos[run.RepoID]
+		if run.Repo == nil {
+			run.Repo = repos[run.RepoID]
+		}
 	}
 	return nil
 }
@@ -102,12 +96,6 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.CommitSHA != "" {
 		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
 	}
-	if len(opts.ConcurrencyGroup) > 0 {
-		if opts.RepoID == 0 {
-			panic("Invalid FindRunOptions: repo_id is required")
-		}
-		cond = cond.And(builder.Eq{"`action_run`.concurrency_group": opts.ConcurrencyGroup})
-	}
 	return cond
 }
 

models/actions/run_test.go

@@ -5,10 +5,12 @@ package actions
 
 import (
 	"testing"
+	"time"
 
 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/unittest"
+	"code.gitea.io/gitea/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -30,6 +32,16 @@ func TestUpdateRepoRunsNumbers(t *testing.T) {
 	err = UpdateRepoRunsNumbers(t.Context(), repo)
 	assert.NoError(t, err)
 	repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
-	assert.Equal(t, 5, repo.NumActionRuns)
+	assert.Equal(t, 4, repo.NumActionRuns)
 	assert.Equal(t, 3, repo.NumClosedActionRuns)
 }
+
+func TestActionRun_Duration_NonNegative(t *testing.T) {
+	run := &ActionRun{
+		Started:          timeutil.TimeStamp(100),
+		Stopped:          timeutil.TimeStamp(200),
+		Status:           StatusSuccess,
+		PreviousDuration: -time.Hour,
+	}
+	assert.Equal(t, time.Duration(0), run.Duration())
+}

models/actions/runner.go

@@ -171,9 +171,8 @@ func (r *ActionRunner) LoadAttributes(ctx context.Context) error {
 	return nil
 }
 
-func (r *ActionRunner) GenerateToken() (err error) {
-	r.Token, r.TokenSalt, r.TokenHash, _, err = generateSaltedToken()
-	return err
+func (r *ActionRunner) GenerateAndFillToken() {
+	r.Token, r.TokenSalt, r.TokenHash, _ = generateSaltedToken()
 }
 
 // CanMatchLabels checks whether the runner's labels can match a job's "runs-on"

models/actions/runner_token.go

@@ -97,10 +97,7 @@ func NewRunnerTokenWithValue(ctx context.Context, ownerID, repoID int64, token s
 }
 
 func NewRunnerToken(ctx context.Context, ownerID, repoID int64) (*ActionRunnerToken, error) {
-	token, err := util.CryptoRandomString(40)
-	if err != nil {
-		return nil, err
-	}
+	token := util.CryptoRandomString(40)
 	return NewRunnerTokenWithValue(ctx, ownerID, repoID, token)
 }
 

models/actions/schedule_list.go

@@ -4,62 +4,13 @@
 package actions
 
 import (
-	"context"
-
 	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
 
 	"xorm.io/builder"
 )
 
 type ScheduleList []*ActionSchedule
 
-// GetUserIDs returns a slice of user's id
-func (schedules ScheduleList) GetUserIDs() []int64 {
-	return container.FilterSlice(schedules, func(schedule *ActionSchedule) (int64, bool) {
-		return schedule.TriggerUserID, true
-	})
-}
-
-func (schedules ScheduleList) GetRepoIDs() []int64 {
-	return container.FilterSlice(schedules, func(schedule *ActionSchedule) (int64, bool) {
-		return schedule.RepoID, true
-	})
-}
-
-func (schedules ScheduleList) LoadTriggerUser(ctx context.Context) error {
-	userIDs := schedules.GetUserIDs()
-	users := make(map[int64]*user_model.User, len(userIDs))
-	if err := db.GetEngine(ctx).In("id", userIDs).Find(&users); err != nil {
-		return err
-	}
-	for _, schedule := range schedules {
-		if schedule.TriggerUserID == user_model.ActionsUserID {
-			schedule.TriggerUser = user_model.NewActionsUser()
-		} else {
-			schedule.TriggerUser = users[schedule.TriggerUserID]
-			if schedule.TriggerUser == nil {
-				schedule.TriggerUser = user_model.NewGhostUser()
-			}
-		}
-	}
-	return nil
-}
-
-func (schedules ScheduleList) LoadRepos(ctx context.Context) error {
-	repoIDs := schedules.GetRepoIDs()
-	repos, err := repo_model.GetRepositoriesMapByIDs(ctx, repoIDs)
-	if err != nil {
-		return err
-	}
-	for _, schedule := range schedules {
-		schedule.Repo = repos[schedule.RepoID]
-	}
-	return nil
-}
-
 type FindScheduleOptions struct {
 	db.ListOptions
 	RepoID  int64

models/actions/task.go

@@ -77,7 +77,7 @@ func init() {
 }
 
 func (task *ActionTask) Duration() time.Duration {
-	return calculateDuration(task.Started, task.Stopped, task.Status)
+	return calculateDuration(task.Started, task.Stopped, task.Status, task.Updated)
 }
 
 func (task *ActionTask) IsStopped() bool {
@@ -125,9 +125,6 @@ func (task *ActionTask) LoadJob(ctx context.Context) error {
 
 // LoadAttributes load Job Steps if not loaded
 func (task *ActionTask) LoadAttributes(ctx context.Context) error {
-	if task == nil {
-		return nil
-	}
 	if err := task.LoadJob(ctx); err != nil {
 		return err
 	}
@@ -147,9 +144,8 @@ func (task *ActionTask) LoadAttributes(ctx context.Context) error {
 	return nil
 }
 
-func (task *ActionTask) GenerateToken() (err error) {
-	task.Token, task.TokenSalt, task.TokenHash, task.TokenLastEight, err = generateSaltedToken()
-	return err
+func (task *ActionTask) GenerateAndFillToken() {
+	task.Token, task.TokenSalt, task.TokenHash, task.TokenLastEight = generateSaltedToken()
 }
 
 func GetTaskByID(ctx context.Context, id int64) (*ActionTask, error) {
@@ -273,7 +269,6 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 	}
 
 	now := timeutil.TimeStampNow()
-	job.Attempt++
 	job.Started = now
 	job.Status = StatusRunning
 
@@ -288,9 +283,7 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 		CommitSHA:         job.CommitSHA,
 		IsForkPullRequest: job.IsForkPullRequest,
 	}
-	if err := task.GenerateToken(); err != nil {
-		return nil, false, err
-	}
+	task.GenerateAndFillToken()
 
 	workflowJob, err := job.ParseJob()
 	if err != nil {

models/actions/task_step.go

@@ -28,7 +28,7 @@ type ActionTaskStep struct {
 }
 
 func (step *ActionTaskStep) Duration() time.Duration {
-	return calculateDuration(step.Started, step.Stopped, step.Status)
+	return calculateDuration(step.Started, step.Stopped, step.Status, step.Updated)
 }
 
 func init() {

models/actions/token_permissions.go

@@ -0,0 +1,60 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
+)
+
+// ComputeTaskTokenPermissions computes the effective permissions for a job token against the target repository.
+// It uses the job's stored permissions (if any), then applies org/repo clamps and fork/cross-repo restrictions.
+// Note: target repository access policy checks are enforced in GetActionsUserRepoPermission; this function only computes the job token's effective permission ceiling.
+func ComputeTaskTokenPermissions(ctx context.Context, task *ActionTask, targetRepo *repo_model.Repository) (ret repo_model.ActionsTokenPermissions, err error) {
+	if err := task.LoadJob(ctx); err != nil {
+		return ret, err
+	}
+	if err := task.Job.LoadRepo(ctx); err != nil {
+		return ret, err
+	}
+	runRepo := task.Job.Repo
+
+	if err := runRepo.LoadOwner(ctx); err != nil {
+		return ret, err
+	}
+
+	repoActionsCfg := runRepo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
+	ownerActionsCfg, err := GetOwnerActionsConfig(ctx, runRepo.OwnerID)
+	if err != nil {
+		return ret, err
+	}
+
+	var jobDeclaredPerms repo_model.ActionsTokenPermissions
+	if task.Job.TokenPermissions != nil {
+		jobDeclaredPerms = *task.Job.TokenPermissions
+	} else if repoActionsCfg.OverrideOwnerConfig {
+		jobDeclaredPerms = repoActionsCfg.GetDefaultTokenPermissions()
+	} else {
+		jobDeclaredPerms = ownerActionsCfg.GetDefaultTokenPermissions()
+	}
+
+	var effectivePerms repo_model.ActionsTokenPermissions
+	if repoActionsCfg.OverrideOwnerConfig {
+		effectivePerms = repoActionsCfg.ClampPermissions(jobDeclaredPerms)
+	} else {
+		effectivePerms = ownerActionsCfg.ClampPermissions(jobDeclaredPerms)
+	}
+
+	// Cross-repository access and fork pull requests are strictly read-only for security.
+	// This ensures a "task repo" cannot gain write access to other repositories via CrossRepoAccess settings.
+	isSameRepo := task.Job.RepoID == targetRepo.ID
+	restrictCrossRepoAccess := task.IsForkPullRequest || !isSameRepo
+	if restrictCrossRepoAccess {
+		effectivePerms = repo_model.ClampActionsTokenPermissions(effectivePerms, repo_model.MakeRestrictedPermissions())
+	}
+
+	return effectivePerms, nil
+}

models/actions/utils.go

@@ -13,22 +13,17 @@ import (
 	"time"
 
 	auth_model "code.gitea.io/gitea/models/auth"
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 )
 
-func generateSaltedToken() (string, string, string, string, error) {
-	salt, err := util.CryptoRandomString(10)
-	if err != nil {
-		return "", "", "", "", err
-	}
-	buf, err := util.CryptoRandomBytes(20)
-	if err != nil {
-		return "", "", "", "", err
-	}
+func generateSaltedToken() (string, string, string, string) {
+	salt := util.CryptoRandomString(10)
+	buf := util.CryptoRandomBytes(20)
 	token := hex.EncodeToString(buf)
 	hash := auth_model.HashToken(token, salt)
-	return token, salt, hash, token[len(token)-8:], nil
+	return token, salt, hash, token[len(token)-8:]
 }
 
 /*
@@ -72,13 +67,25 @@ func (indexes *LogIndexes) ToDB() ([]byte, error) {
 
 var timeSince = time.Since
 
-func calculateDuration(started, stopped timeutil.TimeStamp, status Status) time.Duration {
+// calculateDuration computes wall time for a run, job, task, or step. When status is terminal
+// but stopped is missing or inconsistent with started, fallbackEnd (typically the row Updated
+// time) is used so duration still reflects approximate elapsed time instead of 0 or a negative.
+func calculateDuration(started, stopped timeutil.TimeStamp, status Status, fallbackEnd timeutil.TimeStamp) time.Duration {
 	if started == 0 {
 		return 0
 	}
 	s := started.AsTime()
 	if status.IsDone() {
-		return stopped.AsTime().Sub(s)
+		end := stopped
+		if stopped.IsZero() || stopped < started {
+			if !fallbackEnd.IsZero() && fallbackEnd >= started {
+				end = fallbackEnd
+			} else {
+				log.Trace("actions: invalid duration timestamps (started=%d, stopped=%d, fallbackEnd=%d, status=%s)", started, stopped, fallbackEnd, status)
+				return 0
+			}
+		}
+		return end.AsTime().Sub(s)
 	}
 	return timeSince(s).Truncate(time.Second)
 }

models/actions/utils_test.go

@@ -45,9 +45,10 @@ func Test_calculateDuration(t *testing.T) {
 		return timeutil.TimeStamp(1000).AsTime().Sub(t)
 	}
 	type args struct {
-		started timeutil.TimeStamp
-		stopped timeutil.TimeStamp
-		status  Status
+		started     timeutil.TimeStamp
+		stopped     timeutil.TimeStamp
+		status      Status
+		fallbackEnd timeutil.TimeStamp
 	}
 	tests := []struct {
 		name string
@@ -81,10 +82,48 @@ func Test_calculateDuration(t *testing.T) {
 			},
 			want: 100 * time.Second,
 		},
+		{
+			name: "done_stopped_zero_no_fallback",
+			args: args{
+				started: 500,
+				stopped: 0,
+				status:  StatusSuccess,
+			},
+			want: 0,
+		},
+		{
+			name: "done_stopped_zero_uses_fallback",
+			args: args{
+				started:     500,
+				stopped:     0,
+				status:      StatusSuccess,
+				fallbackEnd: 600,
+			},
+			want: 100 * time.Second,
+		},
+		{
+			name: "done_stopped_before_started_no_fallback",
+			args: args{
+				started: 600,
+				stopped: 550,
+				status:  StatusSuccess,
+			},
+			want: 0,
+		},
+		{
+			name: "done_stopped_before_started_uses_fallback",
+			args: args{
+				started:     600,
+				stopped:     550,
+				status:      StatusSuccess,
+				fallbackEnd: 650,
+			},
+			want: 50 * time.Second,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equalf(t, tt.want, calculateDuration(tt.args.started, tt.args.stopped, tt.args.status), "calculateDuration(%v, %v, %v)", tt.args.started, tt.args.stopped, tt.args.status)
+			assert.Equalf(t, tt.want, calculateDuration(tt.args.started, tt.args.stopped, tt.args.status, tt.args.fallbackEnd), "calculateDuration(%v, %v, %v, %v)", tt.args.started, tt.args.stopped, tt.args.status, tt.args.fallbackEnd)
 		})
 	}
 }

models/activities/action.go

@@ -186,15 +186,7 @@ func (a *Action) LoadActUser(ctx context.Context) {
 	if a.ActUser != nil {
 		return
 	}
-	var err error
-	a.ActUser, err = user_model.GetPossibleUserByID(ctx, a.ActUserID)
-	if err == nil {
-		return
-	} else if user_model.IsErrUserNotExist(err) {
-		a.ActUser = user_model.NewGhostUser()
-	} else {
-		log.Error("GetUserByID(%d): %v", a.ActUserID, err)
-	}
+	a.ActUserID, a.ActUser, _ = user_model.GetPossibleUserByID(ctx, a.ActUserID)
 }
 
 func (a *Action) LoadRepo(ctx context.Context) error {

models/activities/action_list.go

@@ -282,9 +282,3 @@ func GetFeeds(ctx context.Context, opts GetFeedsOptions) (ActionList, int64, err
 
 	return actions, count, nil
 }
-
-func CountUserFeeds(ctx context.Context, userID int64) (int64, error) {
-	return db.GetEngine(ctx).Where("user_id = ?", userID).
-		And("is_deleted = ?", false).
-		Count(&Action{})
-}

models/activities/user_heatmap.go

@@ -62,6 +62,7 @@ func getUserHeatmapData(ctx context.Context, user *user_model.User, team *organi
 		return nil, err
 	}
 
+	// HINT: USER-ACTIVITY-PUSH-COMMITS: it only uses the doer's action time, it doesn't use git commit's time
 	return hdata, db.GetEngine(ctx).
 		Select(groupBy+" AS timestamp, count(user_id) as contributions").
 		Table("action").

models/asymkey/error.go

@@ -192,28 +192,6 @@ func (err ErrGPGKeyIDAlreadyUsed) Unwrap() error {
 	return util.ErrAlreadyExist
 }
 
-// ErrGPGKeyAccessDenied represents a "GPGKeyAccessDenied" kind of Error.
-type ErrGPGKeyAccessDenied struct {
-	UserID int64
-	KeyID  int64
-}
-
-// IsErrGPGKeyAccessDenied checks if an error is a ErrGPGKeyAccessDenied.
-func IsErrGPGKeyAccessDenied(err error) bool {
-	_, ok := err.(ErrGPGKeyAccessDenied)
-	return ok
-}
-
-// Error pretty-prints an error of type ErrGPGKeyAccessDenied.
-func (err ErrGPGKeyAccessDenied) Error() string {
-	return fmt.Sprintf("user does not have access to the key [user_id: %d, key_id: %d]",
-		err.UserID, err.KeyID)
-}
-
-func (err ErrGPGKeyAccessDenied) Unwrap() error {
-	return util.ErrPermissionDenied
-}
-
 // ErrKeyAccessDenied represents a "KeyAccessDenied" kind of error.
 type ErrKeyAccessDenied struct {
 	UserID int64

models/asymkey/ssh_key.go

@@ -15,6 +15,7 @@ import (
 	"code.gitea.io/gitea/models/perm"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 
@@ -64,7 +65,12 @@ func (key *PublicKey) AfterLoad() {
 
 // OmitEmail returns content of public key without email address.
 func (key *PublicKey) OmitEmail() string {
-	return strings.Join(strings.Split(key.Content, " ")[:2], " ")
+	fields := strings.Split(key.Content, " ") // format: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC... comment
+	if len(fields) < 2 {
+		setting.PanicInDevOrTesting("invalid public key %d content: %s", key.ID, key.Content)
+		return "" // not a valid public key, it shouldn't really happen, the value is managed internally
+	}
+	return strings.Join(fields[:2], " ")
 }
 
 func addKey(ctx context.Context, key *PublicKey) (err error) {

models/asymkey/ssh_key_deploy.go

@@ -105,14 +105,6 @@ func addDeployKey(ctx context.Context, keyID, repoID int64, name, fingerprint st
 	return key, db.Insert(ctx, key)
 }
 
-// HasDeployKey returns true if public key is a deploy key of given repository.
-func HasDeployKey(ctx context.Context, keyID, repoID int64) bool {
-	has, _ := db.GetEngine(ctx).
-		Where("key_id = ? AND repo_id = ?", keyID, repoID).
-		Get(new(DeployKey))
-	return has
-}
-
 // AddDeployKey add new deploy key to database and authorized_keys file.
 func AddDeployKey(ctx context.Context, repoID int64, name, content string, readOnly bool) (*DeployKey, error) {
 	fingerprint, err := CalcFingerprint(content)

models/auth/access_token.go

@@ -98,19 +98,13 @@ func init() {
 
 // NewAccessToken creates new access token.
 func NewAccessToken(ctx context.Context, t *AccessToken) error {
-	salt, err := util.CryptoRandomString(10)
-	if err != nil {
-		return err
-	}
-	token, err := util.CryptoRandomBytes(20)
-	if err != nil {
-		return err
-	}
+	salt := util.CryptoRandomString(10)
+	token := util.CryptoRandomBytes(20)
 	t.TokenSalt = salt
 	t.Token = hex.EncodeToString(token)
 	t.TokenHash = HashToken(t.Token, t.TokenSalt)
 	t.TokenLastEight = t.Token[len(t.Token)-8:]
-	_, err = db.GetEngine(ctx).Insert(t)
+	_, err := db.GetEngine(ctx).Insert(t)
 	return err
 }
 

models/auth/oauth2.go

@@ -185,10 +185,7 @@ var base32Lower = base32.NewEncoding(lowerBase32Chars).WithPadding(base32.NoPadd
 
 // GenerateClientSecret will generate the client secret and returns the plaintext and saves the hash at the database
 func (app *OAuth2Application) GenerateClientSecret(ctx context.Context) (string, error) {
-	rBytes, err := util.CryptoRandomBytes(32)
-	if err != nil {
-		return "", err
-	}
+	rBytes := util.CryptoRandomBytes(32)
 	// Add a prefix to the base32, this is in order to make it easier
 	// for code scanners to grab sensitive tokens.
 	clientSecret := "gto_" + base32Lower.EncodeToString(rBytes)
@@ -220,7 +217,7 @@ func (app *OAuth2Application) GetGrantByUserID(ctx context.Context, userID int64
 	return grant, nil
 }
 
-// CreateGrant generates a grant for an user
+// CreateGrant generates a grant for a user
 func (app *OAuth2Application) CreateGrant(ctx context.Context, userID int64, scope string) (*OAuth2Grant, error) {
 	grant := &OAuth2Grant{
 		ApplicationID: app.ID,
@@ -464,7 +461,7 @@ func GetOAuth2AuthorizationByCode(ctx context.Context, code string) (auth *OAuth
 
 //////////////////////////////////////////////////////
 
-// OAuth2Grant represents the permission of an user for a specific application to access resources
+// OAuth2Grant represents the permission of a user for a specific application to access resources
 type OAuth2Grant struct {
 	ID            int64              `xorm:"pk autoincr"`
 	UserID        int64              `xorm:"INDEX unique(user_application)"`
@@ -484,10 +481,7 @@ func (grant *OAuth2Grant) TableName() string {
 
 // GenerateNewAuthorizationCode generates a new authorization code for a grant and saves it to the database
 func (grant *OAuth2Grant) GenerateNewAuthorizationCode(ctx context.Context, redirectURI, codeChallenge, codeChallengeMethod string) (code *OAuth2AuthorizationCode, err error) {
-	rBytes, err := util.CryptoRandomBytes(32)
-	if err != nil {
-		return &OAuth2AuthorizationCode{}, err
-	}
+	rBytes := util.CryptoRandomBytes(32)
 	// Add a prefix to the base32, this is in order to make it easier
 	// for code scanners to grab sensitive tokens.
 	codeSecret := "gta_" + base32Lower.EncodeToString(rBytes)
@@ -633,7 +627,7 @@ func GetActiveOAuth2SourceByAuthName(ctx context.Context, name string) (*Source,
 	}
 
 	if !has {
-		return nil, fmt.Errorf("oauth2 source not found, name: %q", name)
+		return nil, util.NewNotExistErrorf("oauth2 source not found, name: %q", name)
 	}
 
 	return authSource, nil

models/auth/oauth2_test.go

@@ -12,19 +12,30 @@ import (
 	"code.gitea.io/gitea/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-func TestOAuth2AuthorizationCodeValidity(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
+func TestOAuth2AuthorizationCode(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
 
 	t.Run("GenerateSetsValidUntil", func(t *testing.T) {
 		grant := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Grant{ID: 1})
 		expectedValidUntil := timeutil.TimeStamp(time.Now().Unix() + 600)
 		code, err := grant.GenerateNewAuthorizationCode(t.Context(), "http://127.0.0.1/", "", "")
-		assert.NoError(t, err)
+		require.NoError(t, err)
 		assert.Equal(t, expectedValidUntil, code.ValidUntil)
 		assert.False(t, code.IsExpired())
+		assert.Equal(t, int64(1), code.ID)
+
+		code2, err := auth_model.GetOAuth2AuthorizationByCode(t.Context(), code.Code)
+		require.NoError(t, err)
+		assert.Equal(t, code.Code, code2.Code)
+
 		assert.NoError(t, code.Invalidate(t.Context()))
+
+		code, err = auth_model.GetOAuth2AuthorizationByCode(t.Context(), "does not exist")
+		require.NoError(t, err)
+		require.Nil(t, code)
 	})
 
 	t.Run("Expired", func(t *testing.T) {
@@ -34,13 +45,14 @@ func TestOAuth2AuthorizationCodeValidity(t *testing.T) {
 		assert.True(t, code.IsExpired())
 	})
 
-	t.Run("InvalidateTwice", func(t *testing.T) {
-		code, err := auth_model.GetOAuth2AuthorizationByCode(t.Context(), "authcode")
-		assert.NoError(t, err)
-		if assert.NotNil(t, code) {
-			assert.NoError(t, code.Invalidate(t.Context()))
-			assert.ErrorIs(t, code.Invalidate(t.Context()), auth_model.ErrOAuth2AuthorizationCodeInvalidated)
-		}
+	t.Run("Invalidate", func(t *testing.T) {
+		grant := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Grant{ID: 1})
+		code, err := grant.GenerateNewAuthorizationCode(t.Context(), "http://127.0.0.1/", "", "")
+		require.NoError(t, err)
+		require.NotNil(t, code)
+		require.NoError(t, code.Invalidate(t.Context()))
+		unittest.AssertNotExistsBean(t, &auth_model.OAuth2AuthorizationCode{Code: code.Code})
+		assert.ErrorIs(t, code.Invalidate(t.Context()), auth_model.ErrOAuth2AuthorizationCodeInvalidated)
 	})
 }
 
@@ -224,19 +236,6 @@ func TestRevokeOAuth2Grant(t *testing.T) {
 
 //////////////////// Authorization Code
 
-func TestGetOAuth2AuthorizationByCode(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-	code, err := auth_model.GetOAuth2AuthorizationByCode(t.Context(), "authcode")
-	assert.NoError(t, err)
-	assert.NotNil(t, code)
-	assert.Equal(t, "authcode", code.Code)
-	assert.Equal(t, int64(1), code.ID)
-
-	code, err = auth_model.GetOAuth2AuthorizationByCode(t.Context(), "does not exist")
-	assert.NoError(t, err)
-	assert.Nil(t, code)
-}
-
 func TestOAuth2AuthorizationCode_ValidateCodeChallenge(t *testing.T) {
 	// test plain
 	code := &auth_model.OAuth2AuthorizationCode{
@@ -284,13 +283,6 @@ func TestOAuth2AuthorizationCode_GenerateRedirectURI(t *testing.T) {
 	assert.Equal(t, "https://example.com/callback?code=thecode", redirect.String())
 }
 
-func TestOAuth2AuthorizationCode_Invalidate(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-	code := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2AuthorizationCode{Code: "authcode"})
-	assert.NoError(t, code.Invalidate(t.Context()))
-	unittest.AssertNotExistsBean(t, &auth_model.OAuth2AuthorizationCode{Code: "authcode"})
-}
-
 func TestOAuth2AuthorizationCode_TableName(t *testing.T) {
 	assert.Equal(t, "oauth2_authorization_code", new(auth_model.OAuth2AuthorizationCode).TableName())
 }

models/auth/source.go

@@ -12,6 +12,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/optional"
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 
@@ -99,7 +100,7 @@ var registeredConfigs = map[Type]func() Config{}
 
 // RegisterTypeConfig register a config for a provided type
 func RegisterTypeConfig(typ Type, exemplar Config) {
-	if reflect.TypeOf(exemplar).Kind() == reflect.Ptr {
+	if reflect.TypeOf(exemplar).Kind() == reflect.Pointer {
 		// Pointer:
 		registeredConfigs[typ] = func() Config {
 			return reflect.New(reflect.ValueOf(exemplar).Elem().Type()).Interface().(Config)
@@ -139,7 +140,10 @@ func init() {
 // BeforeSet is invoked from XORM before setting the value of a field of this object.
 func (source *Source) BeforeSet(colName string, val xorm.Cell) {
 	if colName == "type" {
-		typ := Type(db.Cell2Int64(val))
+		typ, _, err := db.CellToInt(val, NoType)
+		if err != nil {
+			setting.PanicInDevOrTesting("Unable to convert login source (id=%d) type: %v", source.ID, err)
+		}
 		constructor, ok := registeredConfigs[typ]
 		if !ok {
 			return

models/auth/source_test.go

@@ -17,13 +17,9 @@ import (
 )
 
 type TestSource struct {
-	auth_model.ConfigBase
+	auth_model.ConfigBase `json:"-"`
 
-	Provider                      string
-	ClientID                      string
-	ClientSecret                  string
-	OpenIDConnectAutoDiscoveryURL string
-	IconURL                       string
+	TestField string
 }
 
 // FromDB fills up a LDAPConfig from serialized format.
@@ -37,27 +33,23 @@ func (source *TestSource) ToDB() ([]byte, error) {
 }
 
 func TestDumpAuthSource(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
+	require.NoError(t, unittest.PrepareTestDatabase())
 
 	authSourceSchema, err := unittest.GetXORMEngine().TableInfo(new(auth_model.Source))
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	auth_model.RegisterTypeConfig(auth_model.OAuth2, new(TestSource))
+	source := &auth_model.Source{
+		Type: auth_model.OAuth2,
+		Name: "TestSource",
+		Cfg:  &TestSource{TestField: "TestValue"},
+	}
+	require.NoError(t, auth_model.CreateSource(t.Context(), source))
 
-	auth_model.CreateSource(t.Context(), &auth_model.Source{
-		Type:     auth_model.OAuth2,
-		Name:     "TestSource",
-		IsActive: false,
-		Cfg: &TestSource{
-			Provider: "ConvertibleSourceName",
-			ClientID: "42",
-		},
-	})
-
-	sb := new(strings.Builder)
-
-	// TODO: this test is quite hacky, it should use a low-level "select" (without model processors) but not a database dump
-	engine := unittest.GetXORMEngine()
-	require.NoError(t, engine.DumpTables([]*schemas.Table{authSourceSchema}, sb))
-	assert.Contains(t, sb.String(), `"Provider":"ConvertibleSourceName"`)
+	// intentionally test the "dump" to make sure the dumped JSON is correct: https://github.com/go-gitea/gitea/pull/16847
+	sb := &strings.Builder{}
+	require.NoError(t, unittest.GetXORMEngine().DumpTables([]*schemas.Table{authSourceSchema}, sb))
+	// the dumped SQL is something like:
+	// INSERT INTO `login_source` (`id`, `type`, `name`, `is_active`, `is_sync_enabled`, `two_factor_policy`, `cfg`, `created_unix`, `updated_unix`) VALUES (1,6,'TestSource',0,0,'','{"TestField":"TestValue"}',1774179784,1774179784);
+	assert.Contains(t, sb.String(), `'{"TestField":"TestValue"}'`)
 }

models/auth/twofactor.go

@@ -65,14 +65,11 @@ func init() {
 
 // GenerateScratchToken recreates the scratch token the user is using.
 func (t *TwoFactor) GenerateScratchToken() (string, error) {
-	tokenBytes, err := util.CryptoRandomBytes(6)
-	if err != nil {
-		return "", err
-	}
+	tokenBytes := util.CryptoRandomBytes(6)
 	// these chars are specially chosen, avoid ambiguous chars like `0`, `O`, `1`, `I`.
 	const base32Chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
 	token := base32.NewEncoding(base32Chars).WithPadding(base32.NoPadding).EncodeToString(tokenBytes)
-	t.ScratchSalt, _ = util.CryptoRandomString(10)
+	t.ScratchSalt = util.CryptoRandomString(10)
 	t.ScratchHash = HashToken(token, t.ScratchSalt)
 	return token, nil
 }

models/auth/webauthn.go

@@ -200,13 +200,3 @@ func DeleteCredential(ctx context.Context, id, userID int64) (bool, error) {
 	had, err := db.GetEngine(ctx).ID(id).Where("user_id = ?", userID).Delete(&WebAuthnCredential{})
 	return had > 0, err
 }
-
-// WebAuthnCredentials implements the webauthn.User interface
-func WebAuthnCredentials(ctx context.Context, userID int64) ([]webauthn.Credential, error) {
-	dbCreds, err := GetWebAuthnCredentialsByUID(ctx, userID)
-	if err != nil {
-		return nil, err
-	}
-
-	return dbCreds.ToCredentials(), nil
-}

models/db/conn.go

@@ -0,0 +1,187 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package db
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+)
+
+type ConnOptions struct {
+	Type     setting.DatabaseType
+	Host     string
+	Database string
+	User     string
+	Passwd   string
+	Schema   string
+	SSLMode  string
+
+	SQLitePath        string
+	SQLiteBusyTimeout int
+	SQLiteJournalMode string
+}
+
+type SQLiteConnStrOptions struct {
+	FilePath string
+	// how long a concurrent query can wait for others (milliseconds),
+	// if timeout is reached, the error is something like "database is locked (SQLITE_BUSY)"
+	BusyTimeout int
+	JournalMode string
+}
+
+func GlobalConnOptions() ConnOptions {
+	return ConnOptions{
+		Type:     setting.Database.Type,
+		Host:     setting.Database.Host,
+		Database: setting.Database.Name,
+		User:     setting.Database.User,
+		Passwd:   setting.Database.Passwd,
+		Schema:   setting.Database.Schema,
+		SSLMode:  setting.Database.SSLMode,
+
+		SQLitePath:        setting.Database.Path,
+		SQLiteBusyTimeout: setting.Database.SQLiteBusyTimeout,
+		SQLiteJournalMode: setting.Database.SQLiteJournalMode,
+	}
+}
+
+const (
+	sqlDriverPostgresSchema = "postgresschema"
+	sqlDriverSQLite3        = "sqlite3" // although database type also has "sqlite3", they are different, for different purposes
+)
+
+var makeSQLiteConnStr = func(opts SQLiteConnStrOptions) (string, string, error) {
+	return "", "", errors.New(`this Gitea binary was not built with SQLite3 support, get an official release or rebuild with correct "-tags"`)
+}
+
+func registerSQLiteConnStrMaker(fn func(opts SQLiteConnStrOptions) (string, string, error)) {
+	if slices.Contains(setting.SupportedDatabaseTypes, setting.DatabaseTypeSQLite3) {
+		panic("another sqlite3 driver has been registered")
+	}
+	setting.SupportedDatabaseTypes = append(setting.SupportedDatabaseTypes, setting.DatabaseTypeSQLite3)
+	makeSQLiteConnStr = fn
+}
+
+func ConnStrDefaultDatabase(opts ConnOptions) (string, string, error) {
+	opts.Database, opts.Schema = "", ""
+	return ConnStr(opts)
+}
+
+func ConnStr(opts ConnOptions) (string, string, error) {
+	switch {
+	case opts.Type.IsMySQL():
+		// use unix socket or tcp socket
+		connType := util.Iif(strings.HasPrefix(opts.Host, "/"), "unix", "tcp")
+		// allow (Postgres-inspired) default value to work in MySQL
+		tls := util.Iif(opts.SSLMode == "disable", "false", opts.SSLMode)
+		// in case the database name is a partial connection string which contains "?" parameters
+		paramSep := util.Iif(strings.Contains(opts.Database, "?"), "&", "?")
+		connStr := fmt.Sprintf("%s:%s@%s(%s)/%s%sparseTime=true&tls=%s", opts.User, opts.Passwd, connType, opts.Host, opts.Database, paramSep, tls)
+		return "mysql", connStr, nil
+
+	case opts.Type.IsPostgreSQL():
+		connStr := makePgSQLConnStr(opts.Host, opts.User, opts.Passwd, opts.Database, opts.SSLMode)
+		driver := util.Iif(opts.Schema == "", "postgres", sqlDriverPostgresSchema)
+		registerPostgresSchemaDriver()
+		return driver, connStr, nil
+
+	case opts.Type.IsMSSQL():
+		host, port := parseMSSQLHostPort(opts.Host)
+		connStr := fmt.Sprintf("server=%s; port=%s; user id=%s; password=%s;", host, port, opts.User, opts.Passwd)
+		if opts.Database != "" {
+			connStr += "; database=" + opts.Database
+		}
+		return "mssql", connStr, nil
+
+	case opts.Type.IsSQLite3():
+		if opts.SQLitePath == "" {
+			return "", "", errors.New("sqlite3 database path cannot be empty")
+		}
+		if err := os.MkdirAll(filepath.Dir(opts.SQLitePath), os.ModePerm); err != nil {
+			return "", "", fmt.Errorf("failed to create directories: %w", err)
+		}
+		return makeSQLiteConnStr(SQLiteConnStrOptions{
+			FilePath:    opts.SQLitePath,
+			JournalMode: opts.SQLiteJournalMode,
+			BusyTimeout: opts.SQLiteBusyTimeout,
+		})
+	}
+	return "", "", fmt.Errorf("unknown database type: %s", opts.Type)
+}
+
+// parsePgSQLHostPort parses given input in various forms defined in
+// https://www.postgresql.org/docs/current/static/libpq-connect.html#LIBPQ-CONNSTRING
+// and returns proper host and port number.
+func parsePgSQLHostPort(info string) (host, port string) {
+	if h, p, err := net.SplitHostPort(info); err == nil {
+		host, port = h, p
+	} else {
+		// treat the "info" as "host", if it's an IPv6 address, remove the wrapper
+		host = info
+		if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
+			host = host[1 : len(host)-1]
+		}
+	}
+
+	// set fallback values
+	if host == "" {
+		host = "127.0.0.1"
+	}
+	if port == "" {
+		port = "5432"
+	}
+	return host, port
+}
+
+func makePgSQLConnStr(dbHost, dbUser, dbPasswd, dbName, dbsslMode string) (connStr string) {
+	dbName, dbParam, _ := strings.Cut(dbName, "?")
+	host, port := parsePgSQLHostPort(dbHost)
+	connURL := url.URL{
+		Scheme:   "postgres",
+		User:     url.UserPassword(dbUser, dbPasswd),
+		Host:     net.JoinHostPort(host, port),
+		Path:     dbName,
+		OmitHost: false,
+		RawQuery: dbParam,
+	}
+	query := connURL.Query()
+	if strings.HasPrefix(host, "/") { // looks like a unix socket
+		query.Add("host", host)
+		connURL.Host = ":" + port
+	}
+	query.Set("sslmode", dbsslMode)
+	connURL.RawQuery = query.Encode()
+	return connURL.String()
+}
+
+// parseMSSQLHostPort splits the host into host and port
+func parseMSSQLHostPort(info string) (string, string) {
+	// the default port "0" might be related to MSSQL's dynamic port, maybe it should be double-confirmed in the future
+	host, port := "127.0.0.1", "0"
+	if strings.Contains(info, ":") {
+		host = strings.Split(info, ":")[0]
+		port = strings.Split(info, ":")[1]
+	} else if strings.Contains(info, ",") {
+		host = strings.Split(info, ",")[0]
+		port = strings.TrimSpace(strings.Split(info, ",")[1])
+	} else if len(info) > 0 {
+		host = info
+	}
+	if host == "" {
+		host = "127.0.0.1"
+	}
+	if port == "" {
+		port = "0"
+	}
+	return host, port
+}

models/db/conn_test.go

@@ -0,0 +1,109 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package db
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParsePgSQLHostPort(t *testing.T) {
+	tests := map[string]struct {
+		HostPort string
+		Host     string
+		Port     string
+	}{
+		"host-port": {
+			HostPort: "127.0.0.1:1234",
+			Host:     "127.0.0.1",
+			Port:     "1234",
+		},
+		"no-port": {
+			HostPort: "127.0.0.1",
+			Host:     "127.0.0.1",
+			Port:     "5432",
+		},
+		"ipv6-port": {
+			HostPort: "[::1]:1234",
+			Host:     "::1",
+			Port:     "1234",
+		},
+		"ipv6-no-port": {
+			HostPort: "[::1]",
+			Host:     "::1",
+			Port:     "5432",
+		},
+		"unix-socket": {
+			HostPort: "/tmp/pg.sock:1234",
+			Host:     "/tmp/pg.sock",
+			Port:     "1234",
+		},
+		"unix-socket-no-port": {
+			HostPort: "/tmp/pg.sock",
+			Host:     "/tmp/pg.sock",
+			Port:     "5432",
+		},
+	}
+	for k, test := range tests {
+		t.Run(k, func(t *testing.T) {
+			t.Log(test.HostPort)
+			host, port := parsePgSQLHostPort(test.HostPort)
+			assert.Equal(t, test.Host, host)
+			assert.Equal(t, test.Port, port)
+		})
+	}
+}
+
+func TestMakePgSQLConnStr(t *testing.T) {
+	tests := []struct {
+		Host    string
+		User    string
+		Passwd  string
+		Name    string
+		SSLMode string
+		Output  string
+	}{
+		{
+			Host:   "", // empty means default
+			Output: "postgres://:@127.0.0.1:5432?sslmode=",
+		},
+		{
+			Host:    "/tmp/pg.sock",
+			User:    "testuser",
+			Passwd:  "space space !#$%^^%^```-=?=",
+			Name:    "gitea",
+			SSLMode: "false",
+			Output:  "postgres://testuser:space%20space%20%21%23$%25%5E%5E%25%5E%60%60%60-=%3F=@:5432/gitea?host=%2Ftmp%2Fpg.sock&sslmode=false",
+		},
+		{
+			Host:    "/tmp/pg.sock:6432",
+			User:    "testuser",
+			Passwd:  "pass",
+			Name:    "gitea",
+			SSLMode: "false",
+			Output:  "postgres://testuser:pass@:6432/gitea?host=%2Ftmp%2Fpg.sock&sslmode=false",
+		},
+		{
+			Host:    "localhost",
+			User:    "pgsqlusername",
+			Passwd:  "I love Gitea!",
+			Name:    "gitea",
+			SSLMode: "true",
+			Output:  "postgres://pgsqlusername:I%20love%20Gitea%21@localhost:5432/gitea?sslmode=true",
+		},
+		{
+			Host:   "localhost:1234",
+			User:   "user",
+			Passwd: "pass",
+			Name:   "gitea?param=1",
+			Output: "postgres://user:pass@localhost:1234/gitea?param=1&sslmode=",
+		},
+	}
+
+	for _, test := range tests {
+		connStr := makePgSQLConnStr(test.Host, test.User, test.Passwd, test.Name, test.SSLMode)
+		assert.Equal(t, test.Output, connStr)
+	}
+}

models/db/context.go

@@ -17,12 +17,15 @@ import (
 	"xorm.io/xorm"
 )
 
-type engineContextKeyType struct{}
+type contextKey struct{ key string }
 
-var engineContextKey = engineContextKeyType{}
+var (
+	contextKeyEngine       = contextKey{"engine"}
+	ContextKeyTestFixtures = contextKey{"test-fixtures"}
+)
 
 func withContextEngine(ctx context.Context, e Engine) context.Context {
-	return context.WithValue(ctx, engineContextKey, e)
+	return context.WithValue(ctx, contextKeyEngine, e)
 }
 
 var (
@@ -68,7 +71,7 @@ func contextSafetyCheck(e Engine) {
 
 // GetEngine gets an existing db Engine/Statement or creates a new Session
 func GetEngine(ctx context.Context) Engine {
-	if engine, ok := ctx.Value(engineContextKey).(Engine); ok {
+	if engine, ok := ctx.Value(contextKeyEngine).(Engine); ok {
 		// if reusing the existing session, need to do "contextSafetyCheck" because the Iterate creates a "autoResetStatement=false" session
 		contextSafetyCheck(engine)
 		return engine
@@ -309,7 +312,7 @@ func InTransaction(ctx context.Context) bool {
 }
 
 func getTransactionSession(ctx context.Context) *xorm.Session {
-	e, _ := ctx.Value(engineContextKey).(Engine)
+	e, _ := ctx.Value(contextKeyEngine).(Engine)
 	if sess, ok := e.(*xorm.Session); ok && sess.IsInTx() {
 		return sess
 	}

models/db/convert.go

@@ -5,12 +5,11 @@ package db
 
 import (
 	"fmt"
-	"strconv"
 
-	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 
 	"xorm.io/xorm"
+	"xorm.io/xorm/convert"
 	"xorm.io/xorm/schemas"
 )
 
@@ -74,15 +73,14 @@ WHERE ST.name ='varchar'`)
 	return err
 }
 
-// Cell2Int64 converts a xorm.Cell type to int64,
-// and handles possible irregular cases.
-func Cell2Int64(val xorm.Cell) int64 {
-	switch (*val).(type) {
-	case []uint8:
-		log.Trace("Cell2Int64 ([]uint8): %v", *val)
-
-		v, _ := strconv.ParseInt(string((*val).([]uint8)), 10, 64)
-		return v
+// CellToInt converts a xorm.Cell field value to an int value
+func CellToInt[T ~int | int64](cell xorm.Cell, def T) (ret T, has bool, err error) {
+	if *cell == nil {
+		return def, false, nil
 	}
-	return (*val).(int64)
+	val, err := convert.AsInt64(*cell)
+	if err != nil {
+		return def, false, err
+	}
+	return T(val), true, err
 }

models/db/driver_postgresschema.go

@@ -18,8 +18,8 @@ var registerOnce sync.Once
 
 func registerPostgresSchemaDriver() {
 	registerOnce.Do(func() {
-		sql.Register("postgresschema", &postgresSchemaDriver{})
-		dialects.RegisterDriver("postgresschema", dialects.QueryDriver("postgres"))
+		sql.Register(sqlDriverPostgresSchema, &postgresSchemaDriver{})
+		dialects.RegisterDriver(sqlDriverPostgresSchema, dialects.QueryDriver("postgres"))
 	})
 }
 

models/db/driver_sqlite_mattn.go

@@ -0,0 +1,31 @@
+//go:build sqlite_mattn && sqlite_unlock_notify
+
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package db
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	_ "github.com/mattn/go-sqlite3"
+)
+
+func init() {
+	registerSQLiteConnStrMaker(makeSQLiteConnStrMattnCGO)
+}
+
+func makeSQLiteConnStrMattnCGO(opts SQLiteConnStrOptions) (string, string, error) {
+	var params []string
+	params = append(params, "cache=shared")
+	params = append(params, "mode=rwc")
+	params = append(params, "_busy_timeout="+strconv.Itoa(opts.BusyTimeout))
+	params = append(params, "_txlock=immediate")
+	if opts.JournalMode != "" {
+		params = append(params, "_journal_mode="+opts.JournalMode)
+	}
+	connStr := fmt.Sprintf("file:%s?%s", opts.FilePath, strings.Join(params, "&"))
+	return sqlDriverSQLite3, connStr, nil
+}

models/db/driver_sqlite_modernc.go

@@ -0,0 +1,41 @@
+//go:build !sqlite_mattn
+
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// modernc driver is chosen as the default one (compared to mattn, ncruces)
+// * mattn was used as default, but it requires CGO
+// * the CI times are almost the same for these three (race detector must be disabled)
+// * modernc increases the binary size about 2MB, ncruces increases about 7MB
+// * compiling time: modernc is slightly slower than mattn, ncruces is the slowest
+
+package db
+
+import (
+	"database/sql"
+	"fmt"
+	"strings"
+
+	"modernc.org/sqlite"
+)
+
+func init() {
+	// this driver contains huge amount of Golang code, so it is much slower when "-race" check is enabled.
+	registerSQLiteConnStrMaker(makeSQLiteConnStrModerncCCGO)
+	sql.Register(sqlDriverSQLite3, &sqlite.Driver{})
+}
+
+func makeSQLiteConnStrModerncCCGO(opts SQLiteConnStrOptions) (string, string, error) {
+	var params []string
+	// TODO: there is a changed behavior from mattn driver:
+	// * mattn driver can wait for pretty long time for concurrent accesses (not limited by the busy timeout)
+	// * but other drivers will report something like "database is locked (5) (SQLITE_BUSY)" if the timeout is reached
+	// Maybe we need to relax the busy timeout to a reasonable long time in the future
+	params = append(params, fmt.Sprintf("_pragma=busy_timeout(%d)", opts.BusyTimeout))
+	params = append(params, "_txlock=immediate")
+	if opts.JournalMode != "" {
+		params = append(params, fmt.Sprintf("_pragma=journal_mode(%s)", opts.JournalMode))
+	}
+	connStr := fmt.Sprintf("file:%s?%s", opts.FilePath, strings.Join(params, "&"))
+	return sqlDriverSQLite3, connStr, nil
+}

models/db/engine.go

@@ -11,11 +11,11 @@ import (
 	"reflect"
 	"strings"
 
-	"xorm.io/xorm"
-
 	_ "github.com/go-sql-driver/mysql"  // Needed for the MySQL driver
 	_ "github.com/lib/pq"               // Needed for the Postgresql driver
 	_ "github.com/microsoft/go-mssqldb" // Needed for the MSSQL driver
+
+	"xorm.io/xorm"
 )
 
 var (

models/db/engine_dump.go

@@ -3,10 +3,14 @@
 
 package db
 
-import "xorm.io/xorm/schemas"
+import (
+	"code.gitea.io/gitea/modules/setting"
+
+	"xorm.io/xorm/schemas"
+)
 
 // DumpDatabase dumps all data from database according the special database SQL syntax to file system.
-func DumpDatabase(filePath, dbType string) error {
+func DumpDatabase(filePath string, dbType setting.DatabaseType) error {
 	var tbs []*schemas.Table
 	for _, t := range registeredModels {
 		t, err := xormEngine.TableInfo(t)

models/db/engine_hook.go

@@ -22,11 +22,17 @@ type EngineHook struct {
 var _ contexts.Hook = (*EngineHook)(nil)
 
 func (*EngineHook) BeforeProcess(c *contexts.ContextHook) (context.Context, error) {
+	if c.Ctx.Value(ContextKeyTestFixtures) != nil {
+		return c.Ctx, nil
+	}
 	ctx, _ := gtprof.GetTracer().Start(c.Ctx, gtprof.TraceSpanDatabase)
 	return ctx, nil
 }
 
 func (h *EngineHook) AfterProcess(c *contexts.ContextHook) error {
+	if c.Ctx.Value(ContextKeyTestFixtures) != nil {
+		return nil
+	}
 	span := gtprof.GetContextSpan(c.Ctx)
 	if span != nil {
 		// Do not record SQL parameters here:

models/db/engine_init.go

@@ -6,7 +6,6 @@ package db
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -24,31 +23,23 @@ func init() {
 
 // newXORMEngine returns a new XORM engine from the configuration
 func newXORMEngine() (*xorm.Engine, error) {
-	connStr, err := setting.DBConnStr()
+	connOpts := GlobalConnOptions()
+	driver, connStr, err := ConnStr(connOpts)
 	if err != nil {
 		return nil, err
 	}
 
-	var engine *xorm.Engine
-
-	if setting.Database.Type.IsPostgreSQL() && len(setting.Database.Schema) > 0 {
-		// OK whilst we sort out our schema issues - create a schema aware postgres
-		registerPostgresSchemaDriver()
-		engine, err = xorm.NewEngine("postgresschema", connStr)
-	} else {
-		engine, err = xorm.NewEngine(setting.Database.Type.String(), connStr)
-	}
-
+	engine, err := xorm.NewEngine(driver, connStr)
 	if err != nil {
 		return nil, err
 	}
-	switch setting.Database.Type {
-	case "mysql":
+	switch {
+	case connOpts.Type.IsMySQL():
 		engine.Dialect().SetParams(map[string]string{"rowFormat": "DYNAMIC"})
-	case "mssql":
+	case connOpts.Type.IsMSSQL():
 		engine.Dialect().SetParams(map[string]string{"DEFAULT_VARCHAR": "nvarchar"})
 	}
-	engine.SetSchema(setting.Database.Schema)
+	engine.SetSchema(connOpts.Schema)
 	return engine, nil
 }
 
@@ -56,10 +47,7 @@ func newXORMEngine() (*xorm.Engine, error) {
 func InitEngine(ctx context.Context) error {
 	xe, err := newXORMEngine()
 	if err != nil {
-		if strings.Contains(err.Error(), "SQLite3 support") {
-			return fmt.Errorf("sqlite3 requires: -tags sqlite,sqlite_unlock_notify\n%w", err)
-		}
-		return fmt.Errorf("failed to connect to database: %w", err)
+		return fmt.Errorf("failed to init database engine: %w", err)
 	}
 
 	xe.SetMapper(names.GonicMapper{})

models/db/engine_test.go

@@ -30,7 +30,7 @@ func TestDumpDatabase(t *testing.T) {
 	assert.NoError(t, db.GetEngine(t.Context()).Sync(new(Version)))
 
 	for _, dbType := range setting.SupportedDatabaseTypes {
-		assert.NoError(t, db.DumpDatabase(filepath.Join(dir, dbType+".sql"), dbType))
+		assert.NoError(t, db.DumpDatabase(filepath.Join(dir, dbType+".sql"), setting.DatabaseType(dbType)))
 	}
 }
 

models/fixtures/access.yml

@@ -177,3 +177,5 @@
   user_id: 40
   repo_id: 1
   mode: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/access_token.yml

@@ -31,3 +31,5 @@
   created_unix: 946687980
   updated_unix: 946687980
   # commented out tokens so you can see what they are in plaintext
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action.yml

@@ -73,3 +73,5 @@
   is_private: false
   created_unix: 1680454039
   content: '4|' # issueId 5
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action_artifact.yml

@@ -141,3 +141,41 @@
   created_unix: 1730330775
   updated_unix: 1730330775
   expired_unix: 1738106775
+
+-
+  id: 26
+  run_id: 792
+  runner_id: 1
+  repo_id: 4
+  owner_id: 1
+  commit_sha: c2d72f548424103f01ee1dc02889c1e2bff816b0
+  storage_path: "27/5/1730330775594233150.chunk"
+  file_size: 1024
+  file_compressed_size: 1024
+  content_encoding: "application/pdf"
+  artifact_path: "report.pdf"
+  artifact_name: "report.pdf"
+  status: 2
+  created_unix: 1730330775
+  updated_unix: 1730330775
+  expired_unix: 1738106775
+
+-
+  id: 27
+  run_id: 792
+  runner_id: 1
+  repo_id: 4
+  owner_id: 1
+  commit_sha: c2d72f548424103f01ee1dc02889c1e2bff816b0
+  storage_path: "27/5/1730330775594233150.chunk"
+  file_size: 1024
+  file_compressed_size: 1024
+  content_encoding: "application/html"
+  artifact_path: "report.html"
+  artifact_name: "report.html"
+  status: 2
+  created_unix: 1730330775
+  updated_unix: 1730330775
+  expired_unix: 1738106775
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action_run.yml

@@ -89,7 +89,7 @@
   ref: "refs/heads/test"
   commit_sha: "c2d72f548424103f01ee1dc02889c1e2bff816b0"
   event: "push"
-  trigger_event: "push"
+  trigger_event: "schedule"
   is_fork_pull_request: 0
   status: 1
   started: 1683636528
@@ -140,23 +140,4 @@
   need_approval: 0
   approved_by: 0
 
--
-  id: 805
-  title: "update actions"
-  repo_id: 4
-  owner_id: 1
-  workflow_id: "artifact.yaml"
-  index: 191
-  trigger_user_id: 1
-  ref: "refs/heads/master"
-  commit_sha: "c2d72f548424103f01ee1dc02889c1e2bff816b0"
-  event: "push"
-  trigger_event: "push"
-  is_fork_pull_request: 0
-  status: 5
-  started: 1683636528
-  stopped: 1683636626
-  created: 1683636108
-  updated: 1683636626
-  need_approval: 0
-  approved_by: 0
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action_run_job.yml

@@ -130,17 +130,4 @@
   started: 1683636528
   stopped: 1683636626
 
--
-  id: 206
-  run_id: 805
-  repo_id: 4
-  owner_id: 1
-  commit_sha: c2d72f548424103f01ee1dc02889c1e2bff816b0
-  is_fork_pull_request: 0
-  name: job_2
-  attempt: 1
-  job_id: job_2
-  task_id: 56
-  status: 3
-  started: 1683636528
-  stopped: 1683636626
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action_runner.yml

@@ -49,3 +49,5 @@
   repo_id: 0
   description: "This runner is going to be deleted"
   agent_labels: '["runner_to_be_deleted","linux"]'
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action_runner_token.yml

@@ -33,3 +33,5 @@
   is_active: 1
   created: 1695617751
   updated: 1695617751
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action_task.yml

@@ -178,22 +178,4 @@
   log_size: 0
   log_expired: 0
 
--
-  id: 56
-  attempt: 1
-  runner_id: 1
-  status: 3 # 3 is the status code for "cancelled"
-  started: 1683636528
-  stopped: 1683636626
-  repo_id: 4
-  owner_id: 1
-  commit_sha: c2d72f548424103f01ee1dc02889c1e2bff816b0
-  is_fork_pull_request: 0
-  token_hash: 6d8ef48297195edcc8e22c70b3020eaa06c52976db67d39b4240c64a69a2cc1508825121b7b8394e48e00b1bf3718b2aaaab
-  token_salt: eeeeeeee
-  token_last_eight: eeeeeeee
-  log_filename: artifact-test2/2f/47.log
-  log_in_storage: 1
-  log_length: 707
-  log_size: 90179
-  log_expired: 0
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/action_task_output.yml

@@ -18,3 +18,5 @@
   task_id: 50
   output_key: output_b
   output_value: bbb
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/attachment.yml

@@ -166,3 +166,5 @@
   download_count: 0
   size: 0
   created_unix: 946684800
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/badge.yml

@@ -0,0 +1,7 @@
+-
+  id: 1
+  slug: badge1
+  description: just a test badge
+  image_url: badge1.png
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/branch.yml

@@ -249,3 +249,5 @@
   is_deleted: false
   deleted_by_id: 0
   deleted_unix: 0
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/collaboration.yml

@@ -63,3 +63,5 @@
   repo_id: 32
   user_id: 10
   mode: 2 # write
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/comment.yml

@@ -102,3 +102,5 @@
   review_id: 22
   assignee_id: 5
   created_unix: 946684817
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/commit_status.yml

@@ -57,3 +57,5 @@
   context: deploy/awesomeness
   context_hash: ae9547713a6665fc4261d0756904932085a41cf2
   creator_id: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/commit_status_index.yml

@@ -3,3 +3,5 @@
   repo_id: 1
   sha: "1234123412341234123412341234123412341234"
   max_index: 5
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/deploy_key.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/email_address.yml

@@ -317,3 +317,5 @@
   lower_email: user40@example.com
   is_activated: true
   is_primary: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/external_login_user.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/follow.yml

@@ -17,3 +17,5 @@
   id: 4
   user_id: 31
   follow_id: 33
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/gpg_key.yml

@@ -21,3 +21,5 @@
   can_encrypt_comms: true
   can_encrypt_storage: true
   can_certify: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/gpg_key_import.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/hook_task.yml

@@ -1,37 +1,2 @@
--
-  id: 1
-  hook_id: 1
-  uuid: uuid1
-  is_delivered: true
-  is_succeed: false
-  request_content: >
-    {
-      "url": "/matrix-delivered",
-      "http_method":"PUT",
-      "headers": {
-        "X-Head": "42"
-      },
-      "body": "{}"
-    }
-
--
-  id: 2
-  hook_id: 1
-  uuid: uuid2
-  is_delivered: true
-
--
-  id: 3
-  hook_id: 1
-  uuid: uuid3
-  is_delivered: true
-  is_succeed: true
-  payload_content: '{"key":"value"}' # legacy task, payload saved in payload_content (and not in request_content)
-  request_content: >
-    {
-      "url": "/matrix-success",
-      "http_method":"PUT",
-      "headers": {
-        "X-Head": "42"
-      }
-    }
+[]
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/issue.yml

@@ -372,3 +372,5 @@
   created_unix: 1707270422
   updated_unix: 1707270422
   is_locked: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/issue_assignees.yml

@@ -18,3 +18,5 @@
   id: 5
   assignee_id: 10
   issue_id: 6
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/issue_index.yml

@@ -33,3 +33,5 @@
 -
   group_id: 51
   max_index: 1
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/issue_label.yml

@@ -17,3 +17,5 @@
   id: 4
   issue_id: 2
   label_id: 4
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/issue_pin.yml

@@ -4,3 +4,5 @@
   issue_id: 4
   is_pull: false
   pin_order: 1
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/issue_user.yml

@@ -18,3 +18,5 @@
   issue_id: 1
   is_read: false
   is_mentioned: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/issue_watch.yml

@@ -29,3 +29,5 @@
   is_watching: false
   created_unix: 946684800
   updated_unix: 946684800
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/label.yml

@@ -107,3 +107,5 @@
   num_issues: 0
   num_closed_issues: 0
   archived_unix: 0
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/lfs_meta_object.yml

@@ -30,3 +30,5 @@
   size: 25
   repository_id: 54
   created_unix: 1671607299
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/login_source.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/milestone.yml

@@ -52,3 +52,5 @@
   num_closed_issues: 0
   completeness: 0
   deadline_unix: 253370764800
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/mirror.yml

@@ -47,3 +47,5 @@
   next_update_unix: 0
   lfs_enabled: false
   lfs_endpoint: ""
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/notice.yml

@@ -12,3 +12,5 @@
   id: 3
   type: 1 # NoticeRepository
   description: description3
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/notification.yml

@@ -52,3 +52,5 @@
   issue_id: 4
   created_unix: 946688800
   updated_unix: 946688820
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/oauth2_application.yml

@@ -4,7 +4,7 @@
   name: "Test"
   client_id: "da7da3ba-9a13-4167-856f-3899de0b0138"
   client_secret: "$2a$10$UYRgUSgekzBp6hYe8pAdc.cgB4Gn06QRKsORUnIYTYQADs.YR/uvi" # bcrypt of "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=
-  redirect_uris: '["a", "https://example.com/xyzzy"]'
+  redirect_uris: '["https://example.com"]'
   created_unix: 1546869730
   updated_unix: 1546869730
   confidential_client: true
@@ -18,3 +18,5 @@
   created_unix: 1546869730
   updated_unix: 1546869730
   confidential_client: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/oauth2_authorization_code.yml

@@ -1,15 +1,2 @@
-- id: 1
-  grant_id: 1
-  code: "authcode"
-  code_challenge: "CjvyTLSdR47G5zYenDA-eDWW4lRrO8yvjcWwbD_deOg" # Code Verifier: N1Zo9-8Rfwhkt68r1r29ty8YwIraXR8eh_1Qwxg7yQXsonBt
-  code_challenge_method: "S256"
-  redirect_uri: "a"
-  valid_until: 3546869730
-
-- id: 2
-  grant_id: 4
-  code: "authcodepublic"
-  code_challenge: "CjvyTLSdR47G5zYenDA-eDWW4lRrO8yvjcWwbD_deOg" # Code Verifier: N1Zo9-8Rfwhkt68r1r29ty8YwIraXR8eh_1Qwxg7yQXsonBt
-  code_challenge_method: "S256"
-  redirect_uri: "http://127.0.0.1/"
-  valid_until: 3546869730
+[]
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/oauth2_grant.yml

@@ -29,3 +29,5 @@
   scope: "whatever"
   created_unix: 1546869730
   updated_unix: 1546869730
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/org_user.yml

@@ -135,3 +135,5 @@
   uid: 20
   org_id: 17
   is_public: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/project.yml

@@ -69,3 +69,5 @@
   type: 2
   created_unix: 1688973000
   updated_unix: 1688973000
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/project_board.yml

@@ -75,3 +75,5 @@
   default: true
   created_unix: 1588117528
   updated_unix: 1588117528
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/project_issue.yml

@@ -21,3 +21,5 @@
   issue_id: 5
   project_id: 1
   project_board_id: 3
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/protected_branch.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/protected_tag.yml

@@ -22,3 +22,5 @@
   allowlist_team_i_ds: "[]"
   created_unix: 1715596037
   updated_unix: 1715596037
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/public_key.yml

@@ -10,3 +10,5 @@
   updated_unix: 1565224552
   login_source_id: 0
   verified: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/pull_request.yml

@@ -117,3 +117,5 @@
   index: 1
   head_repo_id: 61
   base_repo_id: 61
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/reaction.yml

@@ -37,3 +37,5 @@
   comment_id: 2
   user_id: 1
   created_unix: 1573248005
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/release.yml

@@ -150,3 +150,5 @@
   is_prerelease: false
   is_tag: false
   created_unix: 946684803
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/renamed_branch.yml

@@ -3,3 +3,5 @@
   repo_id: 1
   from: dev
   to: master
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/repo_archiver.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/repo_indexer_status.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/repo_license.yml

@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/repo_redirect.yml

@@ -3,3 +3,5 @@
   owner_id: 2
   lower_name: oldrepo1
   redirect_repo_id: 1
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/repo_topic.yml

@@ -25,3 +25,5 @@
 -
   repo_id: 2
   topic_id: 6
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly

models/fixtures/repo_transfer.yml

@@ -29,3 +29,5 @@
   repo_id: 5
   created_unix: 1553610671
   updated_unix: 1553610671
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly