2
0

769 Commits

Author SHA1 Message Date
12f4ea03a8 refactor: add /v3 suffix to module path for proper Go semver
Some checks failed
Build and Release / Create Release (push) Successful in 0s
Trigger Vault Plugin Rebuild / Trigger Vault Rebuild (push) Successful in 0s
Build and Release / Integration Tests (PostgreSQL) (push) Successful in 2m48s
Build and Release / Lint (push) Failing after 5m2s
Build and Release / Build Binaries (amd64, windows, windows-latest) (push) Has been skipped
Build and Release / Build Binaries (amd64, darwin, linux-latest) (push) Has been skipped
Build and Release / Build Binaries (amd64, linux, linux-latest) (push) Has been skipped
Build and Release / Build Binaries (arm64, darwin, linux-latest) (push) Has been skipped
Build and Release / Build Binaries (arm64, linux, linux-latest) (push) Has been skipped
Build and Release / Unit Tests (push) Successful in 5m37s
Go's semantic import versioning requires v2+ modules to include the
major version in the module path. This enables using proper version
tags (v3.x.x) instead of pseudo-versions.

Updated module path: code.gitcaddy.com/server/v3
2026-01-17 17:53:59 -05:00
af6d4addd4 code.caddy rename
All checks were successful
Build and Release / Create Release (push) Successful in 0s
Build and Release / Integration Tests (PostgreSQL) (push) Successful in 3m7s
Build and Release / Lint (push) Successful in 5m21s
Build and Release / Unit Tests (push) Successful in 5m46s
Build and Release / Build Binaries (amd64, linux, linux-latest) (push) Successful in 3m44s
Build and Release / Build Binaries (amd64, darwin, linux-latest) (push) Successful in 4m4s
Build and Release / Build Binaries (arm64, darwin, linux-latest) (push) Successful in 3m23s
Build and Release / Build Binaries (arm64, linux, linux-latest) (push) Successful in 3m47s
Build and Release / Build Binaries (amd64, windows, windows-latest) (push) Successful in 8h6m28s
2026-01-17 09:02:21 -05:00
wxiaoguang
4e04eedd20 Make "commit statuses" API accept slashes in "ref" (#36264)
Fix #36253

Support slashes in `{ref}` (follow GitHub's behavior)
2026-01-01 09:56:07 +08:00
silverwind
2662f75022 Replace CSRF cookie with CrossOriginProtection (#36183)
Removes the CSRF cookie in favor of
[`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection)
which relies purely on HTTP headers.

Fixes: https://github.com/go-gitea/gitea/issues/11188
Fixes: https://github.com/go-gitea/gitea/issues/30333
Helps: https://github.com/go-gitea/gitea/issues/35107

TODOs:

- [x] Fix tests
- [ ] Ideally add tests to validates the protection

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-12-25 12:33:34 +02:00
Gregorius Bima Kharisma Wicaksana
0c09add843 refactor: extract helper functions from SearchIssues (#36158)
## Summary

This PR refactors the `SearchIssues` function in
`routers/api/v1/repo/issue.go` by extracting common logic into reusable
helper functions:

- `parseIssueIsClosed()`: Parses the "state" query parameter and returns
the corresponding `isClosed` option
- `parseIssueIsPull()`: Parses the "type" query parameter and returns
the corresponding `isPull` option
- `buildSearchIssuesRepoIDs()`: Builds the list of repository IDs for
issue search based on query parameters

### Benefits:
- Improved code readability
- Smaller, more focused functions
- Easier to test individual components
- Potential for reuse in other handlers

### Changes:
- Extracted 3 helper functions from the ~292 line `SearchIssues`
function
- No functional changes - behavior remains the same
- Proper error handling preserved

## Test plan
- [ ] Verify existing API tests pass
- [ ] Manual testing of `/repos/issues/search` endpoint

Ref: #35015

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-12-20 17:57:41 -08:00
Lunny Xiao
c20415fd9f Fix bug when creating pull request (#36166)
Extract from #36105 

Fix #36116
Fix #35912
Fix #20906
2025-12-17 21:21:04 +00:00
Lunny Xiao
8bf2ce31ea Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
The test `TestGiteaUploadUpdateGitForPullRequest` modified the shared
meta test repositories directly, so this PR removes that test and
replaces it with an integration test that migrates a real repository
from gitea.com into a local test instance.

This PR also fixes a bug where pull-request migrations were not
correctly syncing head branches to the database.
2025-12-17 12:00:07 -08:00
silverwind
c79923a869 Enable bodyclose linter (#36168)
Enabe
[`bodyclose`](https://golangci-lint.run/docs/linters/configuration/#bodyclose).
The only issue in non-test code (`services/migrations/dump.go`) was a
false-positive and I think there are a number of undetected cases, but I
guess it's still better than not having it.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2025-12-16 14:08:43 +01:00
Lunny Xiao
372d2e3968 Check user visibility when redirecting to a renamed user (#36148)
Fix #34169
2025-12-14 03:14:18 +01:00
Lunny Xiao
e106ce4b02 Fix bug when viewing the commit diff page with non-ANSI files (#36149)
Fix #35504

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-12-13 21:54:03 +08:00
wxiaoguang
07b1da33ed Make Golang correctly delete temp files during uploading (#36128)
Fix #36127
2025-12-11 19:59:42 +01:00
Lunny Xiao
8ebc6423ae Support updating branch via API (#35951)
Resolve #35368
2025-12-10 19:23:26 +00:00
a1012112796
8c091c1185 allow action user have read permission in public repo like other user (#36095)
related #28187

---------

Signed-off-by: a1012112796 <1012112796@qq.com>
2025-12-07 10:07:04 -08:00
Lunny Xiao
3d642140e6 Fix the bug when ssh clone with redirect user or repository (#36039)
Fix #36026 

The redirect should be checked when original user/repo doesn't exist.
2025-12-04 19:17:49 +00:00
Lunny Xiao
9d858f6444 Fix edit user email bug in API (#36068)
Follow #36058 for API edit user bug when editing email.

- The Admin Edit User API includes a breaking change. Previously, when
updating a user with an email from an unallowed domain, the request
would succeed but return a warning in the response headers. Now, the
request will fail and return an error in the response body instead.
- Removed `AdminAddOrSetPrimaryEmailAddress` because it will not be used
any where.

Fix https://github.com/go-gitea/gitea/pull/36058#issuecomment-3600005186

---------

Co-authored-by: Giteabot <teabot@gitea.io>
2025-12-04 09:05:13 +01:00
Bryan Mutai
24d39f8425 Add "Go to file", "Delete Directory" to repo file list page (#35911)
/claim #35898
Resolves #35898 

### Summary of key changes:

1. Add file name search/Go to file functionality to repo button row.
2. Add backend functionality to delete directory
3. Add context menu for directories with functionality to copy path & delete a directory
4. Move Add/Upload file dropdown to right for parity with Github UI
5. Add tree view to the edit/upload UI

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-11-30 11:58:15 +08:00
Zettat123
c75cb00a32 Fix Actions pull_request.paths being triggered incorrectly by rebase (#36045)
Partially fix #34710 

The bug described in #34710 can be divided into two parts: `push.paths`
and `pull_request.paths`. This PR fixes the issue related to
`pull_request.paths`. The root cause is that the check for whether the
workflow can be triggered happens **before** updating the PR’s merge
base. This causes the file-change detection to use the old merge base.
Therefore, we need to update the merge base first and then check whether
the workflow can be triggered.
2025-11-28 19:33:52 +00:00
silverwind
c6374a6838 Fix actions lint (#36029)
actionlint since https://github.com/rhysd/actionlint/releases/tag/v1.7.9
detects constant conditions and this workflow was being disabled in
328928e788
by such a condition which made the lint fail:


https://github.com/go-gitea/gitea/actions/runs/19673752806/job/56349128912?pr=36028

Instead, remove the whole workflow file. I'm sure we can re-create it if
the need arises.

Also, I locked the actionlint dependency to prevent similar surprises in
the future.
2025-11-26 10:13:37 -08:00
Zettat123
88b673e207 Use GitHub-style commit message for squash merge (#35987) 2025-11-22 09:20:45 -08:00
Lunny Xiao
07c86b934f Fix various permission & login related bugs (#36002)
Permission & protection check:

- Fix Delete Release permission check
- Fix Update Pull Request with rebase branch protection check
- Fix Issue Dependency permission check
- Fix Delete Comment History ID check

Information leaking:

- Show unified message for non-existing user and invalid password
    - Fix #35984
- Don't expose release draft to non-writer users.
- Make API returns signature's email address instead of the user
profile's.

Auth & Login:

- Avoid GCM OAuth2 attempt when OAuth2 is disabled
    - Fix #35510

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-11-22 07:16:08 +00:00
Lunny Xiao
270907b8dd Allow empty commit when merging pull request with squash style (#35989)
Before this PR, when merging an empty PR with squash style will result
in 500.

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-11-22 06:02:25 +00:00
wxiaoguang
c492ade3e2 Fix container push tag overwriting (#35936)
Fix #35853
2025-11-14 03:49:57 +00:00
wxiaoguang
0bc18707ca Fix corrupted external render content (#35946)
Fix #35944
2025-11-14 08:31:11 +08:00
wxiaoguang
1d81aa978e Make OAuth2 issuer configurable (#35915)
The new (correct) behavior breaks the old (incorrect) logins.

Add a config option to support legacy "issuer".

Fix #35830
2025-11-10 23:45:01 +08:00
Luohao Wang
f1724af443 Fix conda null depend issue (#35900)
Fix #35895
2025-11-08 23:29:17 +08:00
Lunny Xiao
0f063214ce Fix incorrect pull request counter (#35819)
Fix #35781, #27472

The PR will not correct the wrong numbers automatically. 

There is a cron task `check_repo_stats` which will be run when Gitea
start or midnight. It will correct the numbers.
2025-11-03 20:52:13 +00:00
silverwind
c2b3ad3366 Fix a number of strictNullChecks-related issues (#35795)
In preparation to work on enabling
https://www.typescriptlang.org/tsconfig/#strictNullChecks, I fixed all
the issues outside of `web_src` that came up when the option was
enabled. There was also one lint issue in web_src that apparently only
came up with the option enabled, so I fixed that as well.

`isTruthy` is introduced because Typescript has a bug regarding
`filter(Boolean)` which they are seemingly unwilling to fix.

---------

Signed-off-by: silverwind <me@silverwind.io>
2025-11-03 20:17:06 +00:00
Lunny Xiao
0f4bc4a345 Fix clone mixed bug (#35810)
Fix #35807
2025-11-02 00:52:59 -07:00
Lunny Xiao
ff66fe1b0b Remove unnecessary function parameter (#35765) 2025-10-31 21:56:08 -07:00
wxiaoguang
673d378db7 Fix cli "Before" handling (#35797)
Regression of #34973

Fix #35796
2025-10-31 18:12:03 +00:00
Zettat123
15cb3080c3 Fix actions rerun bug (#35783)
Related issues: #35780, #35782 

Rerunning a job or a run is only allowed when the job is done and the
run is done.

Related PR: #34970
2025-10-30 01:08:59 +00:00
Zettat123
8b76700778 Fix actions schedule update issue (#35767)
Fix #34472

Add integration tests for actions schedule update.
2025-10-29 16:04:40 +00:00
Lunny Xiao
6c6da9037b Remove unnecessary code and fix comments (#35761)
Follow #35459, #32562

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-28 18:03:57 +00:00
Zettat123
caac49ce3f Support actions and reusable workflows from private repos (#32562)
Resolve https://gitea.com/gitea/act_runner/issues/102

This PR allows administrators of a private repository to specify some
collaborative owners. The repositories of collaborative owners will be
allowed to access this repository's actions and workflows.

Settings for private repos:


![image](https://github.com/user-attachments/assets/e591c877-f94d-48fb-82f3-3b051f21557e)

---

This PR also moves "Enable Actions" setting to `Actions > General` page

<img width="960" alt="image"
src="https://github.com/user-attachments/assets/49337ec2-afb1-4a67-8516-5c9ef0ce05d4"
/>

<img width="960" alt="image"
src="https://github.com/user-attachments/assets/f58ee6d5-17f9-4180-8760-a78e859f1c37"
/>

---------

Signed-off-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: ChristopherHX <christopher.homberger@web.de>
2025-10-25 17:37:33 +00:00
Lunny Xiao
51a8e144b0 Use git model to detect whether branch exist instead of gitrepo method (#35459) 2025-10-25 10:08:25 -07:00
wxiaoguang
23b5030f51 Make "update file" API can create a new file when SHA is not set (#35738)
Fix #19008, use GitHub's behavior (empty SHA to create a new file)
2025-10-24 12:46:54 +08:00
Lunny Xiao
7da7e70f7e Fix review request webhook bug (#35339) (#35723)
Frontport #35339
Fix #35327
2025-10-23 20:08:21 -07:00
silverwind
aa87c68d28 Misc tool tweaks (#35734)
Some minor tooling tweaks:

- Ignore .venv in golangci-lint
- Move go tools to tools directory (e.g. everything that is not "build")
- Enable reportUnusedInlineConfigs in eslint, no current violations
- Apply modernize fix in code-batch-process, modernize cli did
apparently not catch it because of the `go:build ignore` tag.
2025-10-23 09:07:39 +00:00
wxiaoguang
93d12fa8d3 Make external iframe render work (#35730)
Fix #35729, #17635, #21098
2025-10-23 08:01:38 +00:00
wxiaoguang
46eb175303 Fix external render (#35727)
Fix #35725

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-22 23:41:38 +00:00
ChristopherHX
d2f738628e Refactor Actions Token Access (#35688)
* use a single function to do Action Tokens Permission checks
* allows easier customization
* add basic tests
* lfs file locks should work now

---------

Signed-off-by: ChristopherHX <christopher.homberger@web.de>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-22 11:12:31 +00:00
Kemal Zebari
f0fa0ad6a9 Honor delete branch on merge repo setting when using merge API (#35488)
Fix #35463.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-22 05:06:56 +00:00
a1012112796
02e8bc20cd fix attachment file size limit in server backend (#35519)
fix #35512

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-21 15:07:11 +00:00
wxiaoguang
388f280842 Refactor legacy code (#35708)
And by the way, remove the legacy TODO, split large functions into small
ones, and add more tests
2025-10-20 11:43:08 -07:00
Zettat123
3e0beea6be Add quick approve button on PR page (#35678)
This PR adds a quick approve button on PR page to allow reviewers to
approve all pending checks. Only users with write permission to the 
Actions unit can approve.

---------

Signed-off-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-20 18:46:37 +08:00
wxiaoguang
ac17bbe1b8 Fix various bugs (#35684)
1. Fix incorrect column in `applySubscribedCondition`, add a test
2. Fix debian version parsing, add more tests fix #35695
3. Fix log level for HTTP errors, fix #35651
4. Fix abused "panic" handler in API `Migrate`
5. Fix the redirection from PR to issue, add a test
6. Fix Actions variable & secret name validation, add more tests
    * envNameCIRegexMatch is unnecessary, removed
    * validating in "delete" function doesn't make sense, removed
7. Fix incorrect link in release email

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: delvh <dev.lh@web.de>
2025-10-19 00:37:50 +08:00
ChristopherHX
9a977efc2e Fix workflow run event status while rerunning a failed job (#35689)
The event reported a completion status instead of requested, therefore
sent an email
2025-10-18 03:31:34 +00:00
Surya Purohit
9a24d250cc Use LFS object size instead of blob size when viewing a LFS file (#35679)
shows the main LFS filesize instead of the pointer filesize when viewing
a file

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-16 17:42:54 +08:00
wxiaoguang
9b350f66dc Fix missing Close when error occurs and abused connection pool (#35658)
Fix #35649

* Use upstream `git-lfs-transfer`
* The Close should be called when error occurs (bug fix)
* The connection pool should be shared (bug fix)
* Add more tests to cover "LFS over SSH download"
2025-10-15 09:47:12 +00:00
Lunny Xiao
74e6118a2e Fix merge panic (#35606)
To prevent potential bugs, the logic in #35543 makes `gitcmd.Command`
panic when attempting to override stdout or stderr. Instead of using
`PrepareCmd`, this PR now uses the WithXXX methods directly to avoid the
panic.

Fix #35603
2025-10-12 04:24:00 +02:00