0
0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-27 22:09:24 +01:00

1714 Commits

Author SHA1 Message Date
Copilot
a3cc34472b
Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
Pass `ServeHeaderOptions` by value instead of pointer across all call
sites — no nil-check semantics are needed and the struct is small enough
that copying is fine.

## Changes

- **`services/context/base.go`**: `SetServeHeaders` and `ServeContent`
accept `ServeHeaderOptions` (value, not pointer); internal unsafe
pointer cast replaced with a clean type conversion
- **`routers/api/packages/helper/helper.go`**: `ServePackageFile`
variadic changed from `...*context.ServeHeaderOptions` to
`...context.ServeHeaderOptions`; internal variable is now a value type
- **All call sites** (13 files): `&context.ServeHeaderOptions{...}` →
`context.ServeHeaderOptions{...}`

Before/after at the definition level:
```go
// Before
func (b *Base) SetServeHeaders(opt *ServeHeaderOptions) { ... }
func (b *Base) ServeContent(r io.ReadSeeker, opts *ServeHeaderOptions) { ... }
func ServePackageFile(..., forceOpts ...*context.ServeHeaderOptions) { ... }

// After
func (b *Base) SetServeHeaders(opts ServeHeaderOptions) { ... }
func (b *Base) ServeContent(r io.ReadSeeker, opts ServeHeaderOptions) { ... }
func ServePackageFile(..., forceOpts ...context.ServeHeaderOptions) { ... }
```

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-25 16:07:59 -07:00
ChristopherHX
bc5c554072
Feature non-zipped actions artifacts (action v7) (#36786)
- content_encoding contains a slash => v4 artifact
- updated proto files to support mime_type and no longer return errors for upload-artifact v7
- json and txt files are now previewed in browser
- normalized content-disposition header creation
- azure blob storage uploads directly in servedirect mode (no proxying data)
- normalize content-disposition headers based on go mime package
  - getting both filename and filename* encoding is done via custom code

Closes #36829

-----

Signed-off-by: ChristopherHX <christopher.homberger@web.de>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-26 00:37:48 +08:00
Nicolas
e24c3f7a40
Fix org contact email not clearable once set (#36975)
When the email field was submitted as empty in org settings (web and
API), the previous guard `if form.Email != ""` silently skipped the
update, making it impossible to remove a contact email after it was set.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-25 15:23:11 +08:00
ChristopherHX
0ab612f5ab
Refactor storage content-type handling of ServeDirectURL (#36804)
* replace raw url.Values by *storage.ServeDirectOptions
* implement content-type in azblob
* implement content-disposition in azblob
* add tests for content types in response
* http.MethodPut for azure now allows implementing servedirect uploads

---------

Signed-off-by: ChristopherHX <christopher.homberger@web.de>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-21 21:26:13 -07:00
bircni
b22123ef86
Feature: Add button to re-run failed jobs in Actions (#36924)
Fixes #35997

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-21 21:27:13 +00:00
wxiaoguang
00060ff73c
Make container registry support Apple Container (basic auth) (#36920)
Fix #36907
2026-03-18 23:43:44 +00:00
Nicolas
b3b2d111da
Feature: Add per-runner “Disable/Pause” (#36776)
This PR adds per-runner disable/enable support for Gitea Actions so a
registered runner can be paused from picking up new jobs without
unregistering.

Disabled runners stay registered and online but are excluded from new
task assignment; running tasks are allowed to finish. Re-enabling
restores pickup, and runner list/get responses now expose disabled
state.

Also added an endpoint for testing
http://localhost:3000/devtest/runner-edit/enable

<img width="1509" height="701" alt="Bildschirmfoto 2026-02-27 um 22 13
24"
src="https://github.com/user-attachments/assets/5328eda9-e59c-46b6-b398-f436e50ee3da"
/>


Fixes: https://github.com/go-gitea/gitea/issues/36767
2026-03-16 10:24:36 -07:00
majianhan
877f091305
Fix typos in code comments: doesnt, dont, wont (#36890)
Fix missing apostrophes in contractions across multiple source files.

Changes:
- `doesnt` -> `doesn't` in `routers/api/v1/repo/git_ref.go` (2
occurrences)
- `dont` -> `don't` in `models/activities/notification_list.go`,
`modules/indexer/code/bleve/token/path/path.go`,
`routers/api/v1/repo/release.go`,
`services/migrations/gitea_downloader.go`,
`services/repository/contributors_graph.go`
- `wont` -> `won't` in `routers/api/v1/repo/issue_subscription.go`,
`models/issues/label_test.go`

Ref: #35015 (good first issues - improve English)

---------

Co-authored-by: majianhan <majianhan@kylinos.cn>
Co-authored-by: silverwind <me@silverwind.io>
2026-03-13 09:58:44 -07:00
Zettat123
385994295d
Replace index with id in actions routes (#36842)
This PR migrates the web Actions run/job routes from index-based
`runIndex` or `jobIndex` to database IDs.

**⚠️ BREAKING ⚠️**: Existing saved links/bookmarks that use the old
index-based URLs will no longer resolve after this change.

Improvements of this change:
- Previously, `jobIndex` depended on list order, making it hard to
locate a specific job. Using `jobID` provides stable addressing.
- Web routes now align with API, which already use IDs.
- Behavior is closer to GitHub, which exposes run/job IDs in URLs.
- Provides a cleaner base for future features without relying on list
order.
- #36388 this PR improves the support for reusable workflows. If a job
uses a reusable workflow, it may contain multiple child jobs, which
makes relying on job index to locate a job much more complicated

---------

Signed-off-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-03-10 22:14:48 +01:00
silverwind
0724344a8a
Fix CodeQL code scanning alerts (#36858)
Fixes 10 CodeQL code scanning alerts:

- Change `NewPagination`/`SetLinkHeader` to accept `int64` for total
count, clamping internally to fix incorrect-integer-conversion alerts
([#110](https://github.com/go-gitea/gitea/security/code-scanning/110),
[#114](https://github.com/go-gitea/gitea/security/code-scanning/114),
[#115](https://github.com/go-gitea/gitea/security/code-scanning/115),
[#116](https://github.com/go-gitea/gitea/security/code-scanning/116))
- Use `strconv.Atoi()` in `htmlrenderer.go` to avoid int64 intermediate
([#105](https://github.com/go-gitea/gitea/security/code-scanning/105),
[#106](https://github.com/go-gitea/gitea/security/code-scanning/106))
- Clamp regex match indices in `escape_stream.go` to fix
allocation-size-overflow
([#161](https://github.com/go-gitea/gitea/security/code-scanning/161),
[#162](https://github.com/go-gitea/gitea/security/code-scanning/162),
[#163](https://github.com/go-gitea/gitea/security/code-scanning/163))
- Cap slice pre-allocation in `GetIssueDependencies`
([#181](https://github.com/go-gitea/gitea/security/code-scanning/181))

---------

Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-08 14:35:50 +00:00
wxiaoguang
3f1ef703d5
Refactor auth middleware (#36848)
Principles: let the caller decide what it needs, but not let the
framework (middleware) guess what it should do.

Then a lot of hacky code can be removed. And some FIXMEs can be fixed.

This PR introduces a new kind of middleware: "PreMiddleware", it will be
executed before all other middlewares on the same routing level, then a
route can declare its options for other middlewares.

By the way, allow the workflow badge to be accessed by Basic or OAuth2
auth.

Fixes: https://github.com/go-gitea/gitea/pull/36830
Fixes: https://github.com/go-gitea/gitea/issues/36859
2026-03-08 17:59:46 +08:00
wxiaoguang
2ce71629c3
Fix dbfs error handling (#36844)
Add tests for opening non-existing files.
2026-03-07 00:28:46 +08:00
Lunny Xiao
57b5ed3f25
Fix org permission API visibility checks for hidden members and private orgs (#36798)
- fix wrong parameter of HasOrgOrUserVisible in
routers/api/v1/org/org.go
- add integration tests covering the bug fix
- merge permissions API tests

---
Generated by a coding agent with Codex 5.2
2026-03-05 20:32:15 -08:00
ChristopherHX
867c4af481
Fix artifacts v4 backend upload problems (#36805)
* Use base64.RawURLEncoding to avoid equal sign
  * using the nodejs package they seem to get lost
* Support uploads with unspecified length
* Support uploads with a single named blockid
  * without requiring a blockmap

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-05 16:49:01 +01:00
OptionalValue
484eacb7bf
fix: /repos/{owner}/{repo}/actions/{runs,jobs} requiring owner permissions (#36818)
Resolves #36268

The REST endpoints:

`/repos/{owner}/{repo}/actions/runs`
`/repos/{owner}/{repo}/actions/jobs`

currently require repository/organisation owner permissions, even though
in GitHub they only need simple "read" permissions on the repo.
In the web interface this is implemented correctly, where anyone with
"read" permissions can see the list of action runs.

---------

Co-authored-by: Leonard Immel <l.immel@lipowsky.de>
2026-03-03 11:23:27 -08:00
silverwind
761b9d439b
Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
The `PATCH /api/v1/repos/{owner}/{repo}` endpoint silently ignores pull
request config fields (like `default_delete_branch_after_merge`,
`allow_squash_merge`, etc.) unless `has_pull_requests: true` is also
included in the request body. This is because the entire PR unit config
block was gated behind `if opts.HasPullRequests != nil`.

This PR restructures the logic so that PR config options are applied
whenever the pull request unit already exists on the repo, without
requiring `has_pull_requests` to be explicitly set. A new unit is only
created when `has_pull_requests: true` is explicitly sent.

Fixes https://github.com/go-gitea/gitea/issues/36466
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-03-02 22:08:53 +00:00
Nicolas
054eb6d8a5
feat: Add Actions API rerun endpoints for runs and jobs (#36768)
This PR adds official REST API endpoints to rerun Gitea Actions workflow
runs and individual jobs:

* POST /api/v1/repos/{owner}/{repo}/actions/runs/{run}/rerun
* POST /api/v1/repos/{owner}/{repo}/actions/runs/{run}/jobs/{job_id}/rerun

It reuses the existing rerun behavior from the web UI and exposes it
through stable API routes.

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-03-02 21:34:06 +00:00
Lunny Xiao
0e0daa8afe
Delete non-exist branch should return 404 (#36694)
Fix #36682

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-02 11:08:16 -08:00
Lunny Xiao
716a800f50
Remove API registration-token (#36801)
Replace #36793

---------

Co-authored-by: ChristopherHX <christopher.homberger@web.de>
2026-03-02 10:31:42 -08:00
ChristopherHX
bc9817b317
WorkflowDispatch api optionally return runid (#36706)
Implements
https://github.blog/changelog/2026-02-19-workflow-dispatch-api-now-returns-run-ids

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-01 11:58:16 -08:00
wxiaoguang
2c624d4deb
Refactor avatar package, support default avatar fallback (#36788)
* Fix #34715
2026-03-01 13:32:35 +00:00
wxiaoguang
1592576fa5
Mark unused&immature activitypub as "not implemented" (#36789)
After many years, "activitypub" is still "in progress" and no real
progress for end users. So it is not mature.

Temporarily mark the endpoints as "501 not implemented",
and wait until the whole design is stable and usable.
2026-03-01 12:59:49 +00:00
Nicolas
dae2d32186
Correct spelling (#36783)
I was testing typos-cli and fixed some misspelled wording here.
All changes are internal — no public API fields, database columns,
locale keys, or migration names are affected.
2026-02-28 11:23:20 -08:00
danigm
d0f92cb0a1
Add created_by filter to SearchIssues (#36670)
This patch adds the created_by filter to the SearchIssues method.

tea cli has an option to filter by author when listing issues, but it's
not working. The tea command line creates this request for the API when
using the author filter:

```
$ tea issue list -l local --kind pull -A danigm -vvv http://localhost:3000/api/v1/repos/issues/search?created_by=danigm&labels=&limit=30&milestones=&page=1&state=open&type=pulls
```

This patch fixes the API to allow this kind of queries from go-sdk and
tea cli.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
2026-02-26 11:56:02 +00:00
wxiaoguang
840cf68c3e
Fix release draft access check logic (#36720)
1. remove hasRepoWriteScope to avoid abuse
2. clarify "ctx.Written" behavior
3. merge "read-only" tests to slightly improve performance
2026-02-25 20:59:29 +00:00
Lunny Xiao
1eced4a7c0
Fix get release draft permission check (#36659)
Draft release and it's attachments need a write permission to access.

---------

Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-02-22 20:56:46 +00:00
TheFox0x7
eb59b1a24a
various fixes (#36697)
fixes bad address concat causing malformed address
Introduces new config options to for release attachments and number of
files to avoid sharing limits for PR/issue attachments and release ones

Fixes: https://github.com/go-gitea/gitea/issues/31638
Fixes: https://github.com/go-gitea/gitea/issues/35812
Doc update: https://gitea.com/gitea/docs/pulls/348
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-02-22 08:01:43 +01:00
Lunny Xiao
5ad87616c9
Fix track time issue id (#36664) 2026-02-20 21:48:54 +00:00
silverwind
a0160694b9
Enable nilnil linter for new code (#36591)
Fixes: https://github.com/go-gitea/gitea/issues/36152

Enable the `nilnil` linter while adding `//nolint` comments to existing
violations. This will ensure no new issues enter the code base while we
can fix existing issues gradually.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 09:57:18 +00:00
ChristopherHX
34b34d2328
Refactor merge conan and container auth preserve actions taskID (#36560)
* Remove duplicated code
* Allow further ActionsUser package permission checks

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-02-09 03:04:56 +00:00
ChristopherHX
f65df2a69b
Refactor Nuget Auth to reuse Basic Auth Token Validation (#36558)
* Implicitly handle Actions Task Token for Nuget Api Keys
* Support same tokens as Basic Auth in Nuget Api Key Header

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-02-08 14:43:05 +00:00
Louis
e2104a1dd5
Allow configuring default PR base branch (fixes #36412) (#36425)
This adds a per-repository default PR base branch and wires it through
PR entry points. It updates compare links and recently pushed branch
prompts to respect the configured base branch, and prevents auto-merge
cleanup from deleting the configured base branch on same-repo PRs.

## Behavior changes
- New PR compare links on repo home/issue list and branch list honor the
configured default PR base branch.
- The "recently pushed new branches" prompt now compares against the
configured base branch.
- Auto-merge branch cleanup skips deleting the configured base branch
(same-repo PRs only).

---------

Signed-off-by: Louis <116039387+tototomate123@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
2026-02-07 01:34:29 +00:00
TheFox0x7
403a73dca0
Add paging headers (#36521)
Adds support for paging in admin/hooks api endpoint

fixes: https://github.com/go-gitea/gitea/issues/36516

---------

Co-authored-by: techknowlogick <techknowlogick@gitea.com>
Co-authored-by: techknowlogick <matti@mdranta.net>
2026-02-06 13:12:05 +00:00
Noel Jackson
65d93d819b
fix(packages/container): data race when uploading container blobs concurrently (#36524)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-02-04 00:08:20 +08:00
Nicolas
c2dea22926
Add resolve/unresolve review comment API endpoints (#36441)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-02-01 12:28:28 +00:00
Copilot
072de7d8cd
Unify repo names in system notices (#36491)
Fixes: https://github.com/go-gitea/gitea/issues/36211

This PR fixes ensures that all system notices consistently include
repository names in the format `"Action description (owner/repo): error
message"`.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: silverwind <115237+silverwind@users.noreply.github.com>
Co-authored-by: silverwind <me@silverwind.io>
2026-02-01 17:06:57 +08:00
wxiaoguang
7ad9bf4523
Refactor ActionsTaskID (#36503) 2026-01-31 22:01:08 -08:00
wxiaoguang
4c8f6dfa4e
Support rendering OpenAPI spec (#36449)
Fix #20852
2026-01-26 10:34:38 +08:00
Kemal Zebari
56c5d5e819
Restrict branch naming when new change matches with protection rules (#36405)
Resolves #36381 by only allowing admins to perform branch renames that
match to branch protection rules.

---------

Co-authored-by: Giteabot <teabot@gitea.io>
2026-01-23 11:42:24 +01:00
Thomas Beutlich
2a56c4ec3b
Fix spelling (#36399)
Signed-off-by: Thomas Beutlich <115483027+thbeu@users.noreply.github.com>
2026-01-22 02:52:39 +00:00
TheFox0x7
69c5921d71
Add ability to download subpath archive (#36371)
closes: https://github.com/go-gitea/gitea/issues/4478

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-16 09:31:12 +00:00
Lunny Xiao
07ac29da32
Fix bug when compare in the pull request (#36363)
The pull request comparison should not use `direct compare`.
2026-01-14 16:56:23 +00:00
Lunny Xiao
95ea2df00a
Add more check for stopwatch read or list (#36340) 2026-01-13 13:13:39 +00:00
Lunny Xiao
c8b5a1ddf7
Fix cancel auto merge bug (#36341) 2026-01-12 13:47:06 -08:00
Lunny Xiao
fbea2c68e8
Fix delete attachment check (#36320) 2026-01-12 08:16:59 +00:00
wxiaoguang
eec8ee056c
Fix some trivial problems (#36336)
1. correctly parse git protocol's "OldCommit NewCommit RefName" line, it
should be explicitly split by space
2. add missing "return" in CreatePullRequest
3. add comments for "/user.keys" and "/user.gpg" outputs
4. trim space for the "commit status context name" to follow the same
behavior of git_model.NewCommitStatus
2026-01-09 20:58:21 +02:00
Daniel Mach
1d01286f4c
Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
WebUI has a checkbox for enabling maintainer edits you can check right
away when creating a new pull request.
Also, it is possible to set `allow_maintainer_edit` in an existing pull
request via API.
This change enables the option while creating a new pull request via
API.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-06 01:00:26 +08:00
Lunny Xiao
8373f7deb3
improve the compare page (#36261)
- The compare page head title should be `compare` but not `new pull
request`.
- Use `UnstableGuessRefByShortName` instead of duplicated functions
calls.
- Direct-compare, tags, commits compare will not display `New Pull
Request` button any more.

The new screenshot
<img width="1459" height="391" alt="image"
src="https://github.com/user-attachments/assets/64e9b070-9c0b-41d1-b4b8-233b96270e1b"
/>

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-01 10:32:19 -08:00
wxiaoguang
094104bc91
Make "commit statuses" API accept slashes in "ref" (#36264)
Fix #36253

Support slashes in `{ref}` (follow GitHub's behavior)
2026-01-01 09:56:07 +08:00
Lunny Xiao
1771569300
Some refactor for repo path (#36251)
- Use `gitrepo.IsRepositoryExist` instead of `util.IsExit` or
`util.IsDir`
- Use `gitrepo.OpenRepository` instead of `git.OpenRepository`
- Use `gitrepo.DeleteRepository` instead of `util.RemoveAll`
- Use `gitrepo.RenameRepository` instead of `util.Rename`
2025-12-29 18:49:54 +00:00