mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-09 17:37:20 -06:00
main
1286 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
silverwind
|
3c41728017 |
test(e2e): assert server-rendered biography after profile update (#40176)
Since Playwright 1.56, a WebKit click on a native submit button can return before the form navigation starts, so `toHaveValue` passed on the old page with the value `fill()` just set, and the next step raced the reload. Assert the textarea's text instead, its server-rendered default, which only the reloaded page has. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
|
Lunny Xiao
|
3561478109 |
fix(projects): move only the dragged card on project boards (#40182)
The board reported every card of the target column on each drag, and the server wrote all of them into that column. A stale board in another browser therefore pulled cards moved by someone else back to their old column. The client now sends only the dragged issue and its predecessor, and the server computes the position in one transaction: - Only the dragged issue changes column, the others are just renumbered. - A predecessor that is no longer in the column puts the card at the end. Added an e2e test. Fixes https://github.com/go-gitea/gitea/issues/21243 Fixes https://github.com/go-gitea/gitea/issues/32070 Fixes https://github.com/go-gitea/gitea/issues/13498 --- Assisted-by: Codet:claude --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lunny Xiao
|
bccc90d654 |
fix(api): lock and unlock issues as the signed-in user, not the repository owner (#40291)
`PUT/DELETE /repos/{owner}/{repo}/issues/{index}/lock` passed
`ctx.ContextUser` as the doer of `LockIssue` / `UnlockIssue`. In the
repo routes that is the owner of the repository, so on a repository of
an organization the lock and unlock timeline comments were created by
the organization instead of the user who did it. The web handler already
uses the signed-in user; this uses `ctx.Doer` as well.
Adds a subtest `DoerOnOrganizationRepo` to the existing
`TestAPILockIssue`: a member of an organization locks and unlocks an
issue of an organization repository, and the comments must be posted by
that member.
Found while testing audit logging of the issue lock events downstream.
_Authored by Codet (Claude)._
|
||
|
wxiaoguang
|
772f365254 |
refactor: use RunWithStderr for git commands (#40295)
If the stderr output is not handled, then it needs to use RunWithStderr to make sure the git error message is included in the returned error. Otherwise, when the git command fails, the error log won't show useful information. Ref: * #39795 : no useful information in log messages * https://github.com/go-gitea/gitea/pull/40160#pullrequestreview-5752720866 |
||
|
bircni
|
e0b2f3425e |
fix(actions): run pull_request workflows on the merge commit (#40076)
`pull_request` workflow runs checked out the PR head, so a PR could pass CI and still break the base branch once merged. Gitea now maintains `refs/pull/<index>/merge`, a test merge of the head into the base branch, for open pull requests. It is updated on creation and mergeability checks and removed on close or merge. - `pull_request` runs read their workflows from the test merge and expose it as `github.ref`, `github.sha` and `github.event.pull_request.merge_commit_sha`. Commit statuses, the API's `head_sha`, `workflow_run` payloads and `paths` filters stay on the head. - Runs fall back to the head when the merge conflicts, the pull request is closed or git is older than 2.40. - Hidden refs keep each run's test merge (`refs/gitea/run/<id>`) and merged commits (`refs/gitea/pull/<index>/merged`) from `git gc`, for reruns and after the base branch is deleted or force-pushed. Fixes: https://github.com/go-gitea/gitea/issues/27039 Fixes: https://github.com/go-gitea/gitea/issues/13134 Fixes: https://github.com/go-gitea/gitea/issues/30972 Docs: https://gitea.com/gitea/docs/pulls/617 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
d715a5ae75 |
test(api): cover null milestone due_on (#40172)
Removing a milestone deadline with `"due_on": null` was untested, only `""` was. On release/v28 the null case returned HTTP 500 (https://github.com/go-gitea/gitea/pull/40171). main already handles it, this adds the case to the existing test so it stays that way. |
||
|
silverwind
|
8cb6fb2001 |
fix: add missing checks to more handlers and services (#40131)
Several code paths skipped checks that their siblings already perform. - Code comment replies are rejected when they target a review of another pull request or another user's pending review - OAuth2 refuses tokens for users who can't sign in, and introspection reports their tokens and already used refresh tokens as inactive - AGit proc-receive runs the same pull request permission and wiki checks as pre-receive - Repository transfer drops the repository's owner-level scoped workflow source registrations, and registrations whose source the owner no longer owns are ignored - The web editor's base branch copy into a fork and the fork's upstream divergence info require read access to the base repository - LFS downloads require sign-in under strict `REQUIRE_SIGNIN_VIEW`, like git smart HTTP - Unknown AGit target branches are reported as an unexpected ref again |
||
|
silverwind
|
cd92c6a008 |
fix: paste copied code as text, not as a markdown table (#40053)
Copying lines from a diff, file view, blame, code search or code preview and pasting them into a comment on Gitea or GitHub produced a markdown table with escaped pipes and stripped indentation. Both use `@github/paste-markdown`, which converts copied HTML tables unless they carry `data-paste-markdown-skip`, as GitHub's own code tables do. Gitea's code tables now set it too. The test is a bit more complicated because of a upstream bug which causes `paste-markdown` to insert pasted content twice, once https://github.com/github/paste-markdown/pull/128 is merged and released, the negative assertion could be removed. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
Sandiyo Christan
|
c54ec52f0f |
fix(auth): limit failed TOTP attempts per account (#39993)
Gitea accepted unlimited wrong TOTP passcodes, so anyone holding an account's password could enumerate the 6-digit code in minutes. This allows 5 failed attempts per account, then refuses TOTP until 15 minutes after the last one. - The count lives in the cache, and the global lock spans the check, validation and counting, so new sessions and concurrent requests cannot widen it. With Redis, both are shared across instances - Applies to every TOTP check: the web 2FA page, account recovery and Basic auth with `X-Gitea-OTP` (API, git, packages) - Only wrong or replayed passcodes count, server errors do not - Scratch codes and WebAuthn stay usable as the recovery path while locked - Failures log `Failed authentication attempt for <user> from <ip>`, which the fail2ban filter already matches --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
|
Lazizbek Ergashev
|
884884308d |
fix(pull): don't add a timeline entry for pending API reviews (#40260)
Pending reviews created through the API went through `SubmitReview`, which added a timeline entry and sent notifications before the review was submitted, so submitting it later showed the review twice. - Pending reviews skip the timeline entry and notifications until submitted, like on GitHub - `CreatePullReview` rejects comments without a `path` or a positive line with 422, like GitHub - Already duplicated reviews stay as they are Fixes https://github.com/go-gitea/gitea/issues/40259 Assisted-by: Claude Code:claude-opus-5-5 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Renox
|
462ab3801a |
fix(web): don't block README images with REQUIRE_SIGNIN_VIEW = expensive (#40264)
Relax expensive endpoint list, then README can render its images. --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Mitrahsoft
|
3aca9c8fb7 |
enhance(actions): create commit status for workflow_dispatch runs (#39961)
Runs triggered by `workflow_dispatch` never created a commit status, so the commit showed no sign that a workflow ran on it. - Post the status on the run's commit, e.g. `ci / e2e (workflow_dispatch)`. `schedule` runs stay unchanged. - These statuses don't count for pull requests. They don't show in a PR's checks and can't satisfy or fail its required checks, even through broad globs like `ci / e2e*`. Closes https://github.com/go-gitea/gitea/issues/39639 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Trung Hehe
|
6bc92f464a |
fix(org): enforce unique team names in the database (#40228)
Concurrent requests could create teams with the same name in one
organization, because only the service checked the name. Editing such a
team, or renaming a team to a taken name, then failed with a 500.
- Add a unique index on `team (org_id, lower_name)`. Migration 368
renames every duplicate except the oldest to a free `<name>-<n>` and
logs each rename. IDs, members, repositories and permissions are kept,
but lookups by the old name (CODEOWNERS, group-to-team sync, mentions,
URLs) now reach only the kept team.
- Team writes report a name rejected by the index as
`ErrTeamAlreadyExist`, so duplicates, concurrent ones included, return
409 from `POST /orgs/{org}/teams` (previously 422) and `PATCH
/teams/{id}`, and a form error in the web UI.
Fixes https://github.com/go-gitea/gitea/issues/39632
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
Michael Lopez
|
5d9bfa1e14 |
feat(packages): add private Terraform module registry (#38040)
Adds a Terraform module registry package type implementing the [module registry protocol](https://developer.hashicorp.com/terraform/internals/module-registry-protocol), so `terraform init` and Terragrunt `tfr://` can resolve modules from Gitea: ```hcl module "vpc" { source = "gitea.example.com/owner/vpc/aws" version = "~> 1.0" } ``` - Modules are uploaded with `PUT /api/packages/-/terraform/modules/{owner}/{name}/{provider}/{version}` as a `.tar.gz` with the module at its root, stored verbatim and immutable. - `X-Terraform-Get` is a short-lived signed URL because Terraform sends no credentials when downloading the archive. - The package page shows install snippets, README, the root module's inputs, outputs and providers, and `modules/*` submodules. - Metadata is read by a small in-tree HCL scanner instead of `hashicorp/hcl/v2`, which would add 5 modules and ~1.4 MB to the binary. Docs: https://gitea.com/gitea/docs/pulls/433 --------- Signed-off-by: Michael Lopez <mickael.lopez@gmail.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
b23c70d439 |
fix: add missing checks to several handlers and services (#40120)
Several code paths skipped checks their siblings perform, or cleaned up more than they validated. - Official team review requests now count, and removing one no longer marks an unrelated review official - Release edits only delete files of validated attachments - Rejected container uploads no longer delete an existing blob - Attachment removal only removes the uploader's own pending uploads - OpenID sign-in checks the allow and block lists against the normalized identifier - HTTP git access is rejected while a repository is being created, like SSH --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Mitrahsoft
|
b6c291f87a |
fix(api): honor branch protection force push and allowlist options on create and edit (#39990)
The branch protection API handled push and force push options
inconsistently. Create dropped force push unless push was enabled, and
edit ignored allowlist fields unless their parent was set to true in the
same request.
- Create treats force push independently of push, like edit and the web
UI. Enforcement is unchanged.
- Edit applies `enable_push_whitelist`, `enable_force_push_allowlist`
and both deploy key flags against the rule's resulting state, like the
deletion fields. `{"enable_push_whitelist": false}` now disables the
whitelist instead of being ignored.
- Documents that `enable_force_push_allowlist` requires
`enable_force_push` on create.
Fixes https://github.com/go-gitea/gitea/issues/35121
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
Zettat123
|
c74f2f9216 |
fix(repo): mark repository as non-empty before git push returns (#40102)
The post-receive hook syncs pushed branches to the database, but
`is_empty` and the default branch of an empty repository were only
updated later by the `push_update` queue. Until then the API treated the
repository as empty (branch list `null`, `GET /branches/{branch}` 500),
and the queue overwrote the default branch chosen by the hook or set via
the API.
`SyncBranchesToDB` now initializes an empty repository and repairs a
default branch missing in git in its locked transaction, so the state is
final when `git push` returns. The push queue and web file edits retry
it while the repository is still empty.
- The default branch is the configured one if it exists, else `main`,
else `master`, else the first branch by name, like GitLab. HEAD follows
it.
- A first push of several branches no longer depends on push order. The
push that initializes a repository still prints no pull request hints,
like GitHub.
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
silverwind
|
ede9ec3e10 |
fix: stop discarding file close and test setup errors (#39987)
- Fix https://github.com/go-gitea/gitea/security/quality/rules/go%2Funhandled-writable-file-close, ignored close errors hide failed flushes, which could lose rotated logs and truncate authorized_keys - Fix `TestProjects` fixture reset, from https://github.com/go-gitea/gitea/security/quality/ai-findings, `TruncateBeans` rejected the table names and the ignored error let the test run against fixture data |
||
|
silverwind
|
24700dca2a |
test(e2e): retry clipboard reads rejected by Firefox (#40155)
The Firefox mermaid e2e test fails intermittently with `Clipboard read operation is not allowed.`, for example in https://github.com/go-gitea/gitea/actions/runs/41281998298/job/124776072700. Firefox rejects `readText()` when it overlaps the page's still pending clipboard write, and `expect.poll` does not retry errors thrown by its callback, so one overlapping read fails the test. https://github.com/go-gitea/gitea/pull/39838 only removed the paste prompt, not this rejection. - A new `assertClipboardText` helper treats a rejected read as a mismatch so it is polled again - The bot token copy test had the same race and uses it too _Written by Claude (Opus 5.5)._ |
||
|
silverwind
|
7e18e81c7d |
refactor: remove duplicated and dead Go code (#40244)
Pure refactors with no behavior change, mostly reusing existing helpers and dropping duplicated or dead code. Net −222 lines. - Reuse existing helpers instead of inlined copies: `getIssueIndex`, `NewLabel`, `ToCommitUser`, `GetPackageFileDescriptors`, `util.SplitTrimSpace` - Merge copy-pasted blocks in review comment deletion, project deletion and the pre/post-receive hook templates - Drop dead code: an error `toStringKeys` never returned, impossible `bytes.Buffer` write errors, redundant nil-map branches, a `base64` wrapper - Use stdlib where it fits: `strings.Cut`, `bytes.IndexAny`, `cmp.Compare`, `min`/`max`, `slices.Concat`, map lookups instead of key scans |
||
|
Shivansh Garg
|
a5201dc427 |
feat(release): allow setting a release as the latest (#40214)
Gitea picks the latest release by commit date, while GitHub keeps an explicit pointer, so repositories migrated from GitHub could show a different latest release than their source. Fixes https://github.com/go-gitea/gitea/issues/35273. - Add a "Set as Latest Release" checkbox and GitHub's `make_latest` API option. Without them, the newest stable release by commit date stays the latest. - Migrations from GitHub and Gitea carry over the source's latest release. - Migrated releases are dated by their commit like native ones, and equally dated ones keep the source's order. <img width="355" height="122" alt="Set as Latest Release checkbox" src="https://github.com/user-attachments/assets/d35f5324-7ae0-4e9f-b73c-d3c90496fb00" /> --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lazizbek Ergashev
|
98c937170f |
fix(repo): reject unparsable required approvals in branch protection (#40213)
Saving a branch protection rule with a "Required approvals" value that can't be parsed as an integer (like `99999999999999999999` or `abc`) showed the success message and stored 0, because the binding error was never checked. The form now uses `form-fetch-action` with `GetFetchActionForm`, so invalid input is rejected and nothing is saved. Dev mode still answers unparsable numbers with a 500 until `TypeCastError` gets a message, see https://github.com/go-gitea/gitea/pull/40212. - Validation errors show on the page and highlight the offending field, keeping the form input - Negative approvals are rejected before any rule lookup, and the input gets `min="0"` Fixes https://github.com/go-gitea/gitea/issues/40211 Assisted-by: Claude Code:claude-opus-5-5 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Basavaraj S m
|
8d14c9af20 |
fix(pull): enforce user blocks on pull request reviews (#40194)
Code review never checked user blocks, so a user blocked by the poster or repository owner could still post reviews, code comments and replies through the web, API and email. - `CreateCodeComment` and `SubmitReview` now check blocks, with the repo admin exemption issue comments have. - Official reviewers blocked only by the author can still review, so an author can't keep a maintainer from requesting changes. - Review requests are handled in https://github.com/go-gitea/gitea/pull/39296. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
wxiaoguang
|
fd98ab5472 |
enhance(codeowners): support section / glob / file view display / skip review request (#40243)
Document: https://gitea.com/gitea/docs/pulls/634 ([doc PR
preview](
|
||
|
silverwind
|
c62db5b2a3 |
perf: reduce git processes and queries on pull request view (#40224)
Removes redundant work from the pull request conversation tab. - Base and head refs resolve through the `cat-file` batch of the git repos the callers already hold, instead of two `git rev-parse` processes, reducing the number of git processes from 9 to 7 per page, about 17 ms faster locally. - Sidebar reviewers are batch-loaded and code-review comments reuse their loaded poster, reducing the number of SQL queries from 387 to 358 on a PR with 169 timeline entries and 15 reviews. Also fixes the commit list of merged pull requests, which resolved the merge base as a branch name and returned 500. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
b7c1fb2a39 |
enhance: enable DEFAULT_DELETE_BRANCH_AFTER_MERGE by default for new repos (#39975)
Switch the `DEFAULT_DELETE_BRANCH_AFTER_MERGE` default from https://github.com/go-gitea/gitea/pull/36917 to `true`, saving users a click on merge for the most common action that deletes the PR branch on merge. Docs: https://gitea.com/gitea/docs/pulls/608 |
||
|
rafał przypek
|
3b9b8a8976 |
fix(packages): return empty Chef dependencies instead of null (#40237)
Fixes #40230 Cookbooks without dependencies are served with `"dependencies": null` from the universe and version metadata endpoints. This happens because `omitempty` drops the empty map when the metadata is stored. Chef clients iterate over this value and Policyfile resolution crashes. Supermarket returns `{}` for these cookbooks, Gitea now does too. The fix checks whether dependencies are `nil` while building response, returns an empty map if true. This way cookbooks that are already stored are covered without a re-upload. Tested with the Chef integration test and `chef-cli install`. Assisted by Claude Code (claude-opus-5-5). |
||
|
Mark
|
bfbf8cd366 |
fix: fix missing accessible name on static Fomantic combobox dropdowns (#40163)
Fixes https://github.com/go-gitea/gitea/issues/40107 Static Fomantic dropdowns get `role="combobox"` or `role="menu"`, and neither role takes its accessible name from child contents (`nameFrom: author` only). Dropdowns like Filter and Sort on `/explore/repos` without `data-tooltip-content`, `aria-label` or `aria-labelledby` therefore had an empty accessible name. If the focusable element still has no `aria-label` or `aria-labelledby` after the tooltip check, link `aria-labelledby` to the dropdown's direct `.text` or `span` child. Selection dropdowns are skipped because their `.text` holds the current value, not a label. --------- Co-authored-by: Mark <14371969+malfunctionAI@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lazizbek Ergashev
|
d1c980cf8b |
fix(web): inline the site manifest (#40198)
Inline the web app manifest as a `data:` URL instead of serving it from `/assets/site-manifest.json`. That endpoint has been linked through `STATIC_URL_PREFIX` since https://github.com/go-gitea/gitea/pull/37405 and fails to load when: 1. a reverse proxy checks auth on every request, because browsers fetch manifests without cookies 2. `STATIC_URL_PREFIX` serves the `public/` directory from disk, which has no such file 3. `STATIC_URL_PREFIX` is cross-origin, because the endpoint sends no CORS headers The manifest is built per request so `start_url` follows `PUBLIC_URL_DETECTION`. A reverse proxy that adds a stricter CSP must allow `manifest-src data:`. Fixes https://github.com/go-gitea/gitea/issues/40197 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
159e6d7e75 |
test(actions): run repo Actions API tests as a non-owner repo admin (#40183)
The repo-level runner, secret and variable API tests ran as the repo owner, who bypasses the repo admin check. That's how the regression fixed in https://github.com/go-gitea/gitea/pull/40174 slipped through. As suggested in https://github.com/go-gitea/gitea/pull/40174#issuecomment-6591991824, they now run as an admin collaborator, which replaces the duplicate subtest added there. The tests are also trimmed to one case per status code, because `services/secrets/validation_test.go` already unit tests name validation. |
||
|
Shivansh Garg
|
be297b7e05 |
fix(webhook): fire repository event on repository transfer (#40200)
Transferring a repository fired no `repository` webhook. It now sends a `transferred` action shaped like GitHub's, with the previous owner in `changes.owner.from.user` or `changes.owner.from.organization`. Like GitHub, it goes to the new owner's webhooks, plus the repository's own and system webhooks. - Chat webhooks render "Repository transferred from <owner>". - Actions workflows are unaffected, no trigger matches `repository` events. Fixes https://github.com/go-gitea/gitea/issues/33584 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Myers Carpenter
|
58279e39fd |
fix(actions): match pull_request unlabeled on label removal (#40215)
Fixes https://github.com/go-gitea/gitea/issues/34317 Removing a label from a pull request still started workflows with `types: [labeled]` and never matched `types: [unlabeled]`. https://github.com/go-gitea/gitea/pull/34316 derived `labeled`/`unlabeled` from the added and removed labels for issues only, while pull requests kept mapping every `label_updated` to `labeled`. Both events now share one conversion, so they cannot drift apart again. Two other label changes also triggered the wrong workflows: - Clearing all labels started no `unlabeled` workflow, because the Actions notifier ignored it - Replacing labels reported every old label as removed, so a replace that kept a label also matched `unlabeled` AI disclosure: written with Claude Code (claude-opus-5-5), session https://claude.ai/code/session_01Kw9ySGNd4ynmyX9GcVdUfw --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Alan Hsu
|
666e6e2d17 |
fix(web): allow clearing the full name in profile settings (#40186)
Clearing "Full Name" in the profile settings shows success but keeps the old value: since #31959 it is only updated when non-empty, because the input is disabled (not submitted) when `change_full_name` is disabled. Use `*string` for the field, so a missing field keeps the value and an empty one clears it. With `change_full_name` disabled, any submitted value (including empty) is now rejected. Not `optional.Option[string]`, because `MaxSize` would count slice elements instead of characters. Fixes #40185 --- AI disclosure: written with Claude Code (claude-opus-5-5) and tested locally. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Gaurav Dubey
|
f26a314636 |
fix(api): keep wiki page name when editing with an empty title (#40153)
Match `PATCH /repos/{owner}/{repo}/wiki/page/{pageName}` document "leave
empty to keep unchanged"
Fixes #39179
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
silverwind
|
78eb95ab19 |
fix: enable more djlint rules and improve keyboard navigation (#40081)
Enable djlint's [H018](https://djlint.com/docs/linter/#h018), [H046](https://djlint.com/docs/linter/#h046) and [H054](https://djlint.com/docs/linter/#h054) rules, fix their findings and the keyboard navigation problems around them. H054 found links nested in `<button>` dropdowns and radio inputs nested in links, both invalid HTML. - "Add File" and "More Operations" in the repo file list become `div` dropdowns, the disabled state stays unfocusable - The diff whitespace menu marks the current option with a check and `aria-current` instead of radios, which made our dropdown aria patch announce it as a combobox - Sign-in moves "Forgot password?" below "Sign In" and drops the positive tabindexes from https://github.com/go-gitea/gitea/pull/31689, so the tab order follows the DOM: username, password, remember, sign in, forgot - The focus ring on primary, red and green buttons is near-white on dark themes and near-black on light ones, the primary-colored ring was invisible on primary buttons <img width="500" alt="Whitespace menu, before and after" src="https://github.com/user-attachments/assets/d22a423d-95e5-434c-aec4-59264c7132b7" /> <img width="600" alt="Sign-in form, main and this PR" src="https://github.com/user-attachments/assets/d6780690-d906-4791-8a2b-8d80fb03067a" /> <img width="215" height="132" alt="Keyboard-focused primary and red buttons, dark and light theme" src="https://github.com/user-attachments/assets/a2400b18-4802-4383-8560-7e8267a7f02f" /> --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Giteabot
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE]
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) | Type |
Update | Pending |
|---|---|---|---|---|---|---|
| [@primer/octicons](https://primer.style/octicons)
([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` →
`19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0)
|
|
| dependencies | minor | |
|
[@typescript-eslint/parser](https://typescript-eslint.io/packages/parser)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| @​vitest/eslint-plugin | [`1.6.27` →
`1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28)
|
|
| devDependencies | patch | |
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
`v10.3.0` → `v10.3.2` |
|
| action | patch | `v10.3.3` |
| [chart.js](https://www.chartjs.org)
([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` →
`4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |
|
| dependencies | minor | |
| [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3`
|
|
| | patch | |
|
[connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go)
| `v2.0.1` → `v2.0.2` |
|
| require | patch | |
|
[crowdin/github-action](https://redirect.github.com/crowdin/github-action)
| `v3.4.0` → `v3.5.0` |
|
| action | minor | |
| [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` →
`==1.47.1` |
|
| dependency-groups | minor | `1.49.2` (+4) |
| [docker/login-action](https://redirect.github.com/docker/login-action)
| `v4.6.0` → `v4.7.0` |
|
| action | minor | |
| [elasticsearch](https://hub.docker.com/_/elasticsearch)
([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c`
→ `ef5cafd` | | | service | digest | |
|
[eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn)
| [`78.0.0` →
`79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0)
|
|
| devDependencies | major | |
| [eslint-plugin-vue](https://eslint.vuejs.org)
([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) |
[`10.11.1` →
`10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0)
|
|
| devDependencies | minor | |
|
[getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch)
| `c94e58c` → `1f578fa` | | | service | digest | |
| [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0`
|
|
| require | minor | `v1.5.1` |
|
[github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html)
| `v3.17.1` → `v3.17.3` |
|
| require | patch | |
|
[github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2)
| `v2.9.1` → `v2.11.0` |
|
| require | minor | `v2.12.0` |
|
[github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi)
| `v0.151.0` → `v0.152.0` |
|
| require | minor | |
|
[github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron)
| `v2.22.0` → `v2.23.0` |
|
| require | minor | |
|
[github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync)
| `v4.18.0` → `v4.18.1` |
|
| require | patch | |
| [github.com/google/pprof](https://redirect.github.com/google/pprof) |
`1facf8f` → `dbd0ed3` |
|
| require | digest | |
|
[gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go)
| `v3.29.0` → `v3.39.1` |
|
| require | minor | `v3.40.2` (+3) |
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
`v1.84.0` → `v1.85.0` |
|
| require | minor | |
| [katex](https://katex.org)
([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` →
`0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |
|
| dependencies | patch | |
|
[markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli)
| [`0.49.1` →
`0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0)
|
|
| devDependencies | minor | |
|
[material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md)
([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme))
| [`5.39.0` →
`5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0)
|
|
| devDependencies | minor | |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` →
`v1.61.0` |
|
| require | minor | `v1.61.1` |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.14.0` →
`12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| packageManager | minor | |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`>= 12.14.0` → `>=
12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| engines | minor | |
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` →
`8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |
|
| dependencies | patch | |
| [renovate](https://renovatebot.com)
([source](https://redirect.github.com/renovatebot/renovate)) |
[`44.172.2` →
`44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1)
|
|
| | minor | `44.200.0` (+21) |
|
[renovatebot/github-action](https://redirect.github.com/renovatebot/github-action)
| `v46.3.9` → `v46.3.10` |
|
| action | patch | `v46.3.12` (+1) |
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.4` →
`8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |
|
| dependencies | patch | |
---
### Release Notes
<details>
<summary>primer/octicons (@​primer/octicons)</summary>
###
[`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0)
[Compare
Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0)
##### Minor Changes
- [#​1381](https://redirect.github.com/primer/octicons/pull/1381)
[`d25ce68df9d08abd65431a8a48b45446432f1b45`](
|
||
|
wxiaoguang
|
cdadd0c788 |
fix(actions): make Actions API work with repo admin permission (#40174)
The web route already uses "repo admin" for repo-level Actions management. * Fix #40173 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Abdellatif Anaflous
|
2ed6a6f61b |
fix(web): read the wiki blob excerpt from the wiki repository (#40165)
The "load more lines" button in wiki diffs returned 404. `ExcerptBlob` loads the commit from the wiki repo but read the blob from `ctx.Repo.GitRepo`, a regression from https://github.com/go-gitea/gitea/pull/38464. Read the blob from the repo the commit was loaded from. --------- Co-authored-by: Abdel <hktitof@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
1f51d2c318 |
test: run e2e tests in WebKit on Linux (#40152)
WebKit was removed from the e2e tests in https://github.com/go-gitea/gitea/pull/37315 because Linux WebKit kept crashing. The crashes came from a use-after-free in the libsoup bundled with WebKit, which killed the network process and surfaced as `WebKit encountered an internal error`. macOS WebKit never had them because it does not use libsoup. Playwright 1.64 bundles libsoup 3.6.6 with the fix (https://github.com/microsoft/playwright/issues/42803), so WebKit now runs on all platforms. Builds on https://github.com/go-gitea/gitea/pull/40140. The e2e job ran 50 times on `ubuntu-latest` with WebKit enabled, and all runs passed without WebKit errors. The third browser adds about 1.5 to 2 minutes per run. 1. Playwright installs its system dependencies on GitHub runners too, which only come with the Chromium and Firefox libraries 1. The passkey test skips Linux WebKit, which has no WebAuthn, Playwright only stubs `PublicKeyCredential` there --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
bircni
|
d3021b69ee |
enhance: replace tea CLI with gt (#40036)
tea has been replaced by [gitea-cli](https://gitea.com/gitea/cli) (`gt`), which reuses tea's OAuth2 client ID. - The repository clone panel now offers `gt repo clone owner/repo` under a "Gitea CLI" tab. - The built-in OAuth2 application is renamed from `tea` to `gitea-cli`. `tea` in `[oauth2] DEFAULT_APPLICATIONS` is still accepted as an alias, so existing configs keep working. - Instances that already registered the app keep its stored display name "tea". |
||
|
silverwind
|
2a5c34c379 |
fix(pull): reject pull requests without common history (#39872)
Pull requests between branches without a common history show no commits and can never be merged. The web form already rejects them, but the API and crafted `..` compare POSTs did not. The API compared with `..` since https://github.com/go-gitea/gitea/pull/36105, it now uses `...` again and returns 422 when there is no merge base. |
||
|
silverwind
|
db9d2944d8 |
fix(api): return language of starred and watched repositories (#40127)
The starred and watched repository API lists converted repositories without loading their attributes, so `language` was always empty. They are now loaded in one batch, owners included. Three of these handlers also continued after an internal error and wrote a second response body, they now return. |
||
|
Norbert Szulc
|
da7b81d407 |
feat: add commitstatus access token scope (#40144)
Add `read:commitstatus` and `write:commitstatus` token scopes, so CI and
other integrations can report commit statuses without a token that
grants full repository access.
- The commit status endpoints (`/statuses/{sha}`,
`/commits/{ref}/status` and `/commits/{ref}/statuses`) accept the new
scopes, and the repository scopes keep working as they include them
- Creating a status still requires code write permission on the
repository, the scope only narrows what the token may do
- `public-only` tokens still cannot reach private repositories
- `PathGroup` middlewares now run only for a matched path, so unrelated
methods and paths that fall back to the group are not rejected by its
scope check
Fixes: https://github.com/go-gitea/gitea/issues/32625
Ref: https://github.com/go-gitea/gitea/pull/35383
Docs: https://gitea.com/gitea/docs/pulls/622
Signed-off-by: Norbert Szulc <norbert@not7cd.net>
Co-authored-by: Aiden Scandella <git@sca.ndella.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
|
||
|
silverwind
|
5d84bbd525 |
test: run e2e tests in WebKit on macOS (#40140)
WebKit was removed from the e2e tests in https://github.com/go-gitea/gitea/pull/37315 because Linux WebKit kept crashing. `make test-e2e` on macOS now also runs WebKit, which does not show these crashes there. CI stays on Linux, because macOS runners would need about an extra GB of cache storage. 1. The bot account test clicks the user type dropdown, Safari only moves Tab focus between text fields 1. On macOS, Playwright runs with a single libuv thread, concurrent `getaddrinfo` lookups of `localhost` there sporadically stall for 5s --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
sarankumar
|
a4d1711777 |
fix(api): remove git remote when deleting a push mirror (#40049)
Fixes https://github.com/go-gitea/gitea/issues/40037 `DELETE /repos/{owner}/{repo}/push_mirrors/{name}` only deleted the `push_mirror` row and left the `remote_mirror_*` git remotes, which embed the mirror credentials, in the repository and wiki config. Each create/delete cycle through the API left more credentials behind. - Remove the git remotes before deleting the row and record it in the audit log, like the web settings handler. - Return 404 for an unknown name, as documented, instead of 204. - Ignore an already missing code remote, so the wiki remote is still removed and such mirrors can be deleted through both the API and the web settings. --- AI disclosure: I used an AI coding assistant to help write this change and the PR description. I reviewed the code and ran the tests myself. --------- Signed-off-by: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
bircni
|
4ed6f89b60 |
fix(auth): only auto-link the account the external identity points to (#40121)
With `[oauth2_client].ACCOUNT_LINKING = auto`, submitting the link account sign-up form with a user name or email that already exists linked the external identity to that existing account and signed in as it, without checking that the external identity belongs to that account. Automatic linking now only happens when the existing user matches the external identity: its email equals the provider email, or its name equals the user name derived from the provider (per `[oauth2_client].USERNAME`, same as auto registration). Otherwise the linking login page is shown, which requires the existing account's password. Auto registration is unchanged, since the name and email there already come from the provider. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
Shreyansh Jain
|
bbb8ef8244 |
fix(actions): default-branch push discards a due schedule occurrence (#40073)
Default-branch pushes and Actions unit saves recreated the repository's schedules with `Next` recomputed from that moment, so a push between a cron's due minute and the scheduler's pass skipped the occurrence, and `@every` timers restarted. Re-registration now updates schedule rows in place and keeps the spec rows of unchanged crons, so their cursor survives and an in-flight scheduler pass still finds its schedule. Re-detection also clears schedules when no scheduled workflow remains. Fixes https://github.com/go-gitea/gitea/issues/40062 Written with AI assistance. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 5.5) <noreply@anthropic.com> |
||
|
leo
|
7df657116c |
fix(api): honor label archive options (#40008)
Updating a label through the API without `is_archived`, for example to rename or recolor it, silently unarchived it. Creating an organization label also ignored `is_archived`. - Keep a label's archive state when a PATCH omits `is_archived`, for repository and organization labels - Honor `is_archived` when creating organization labels, as repository labels already do AI-assisted by Codex (GPT-6); prepared and tested by the assistant. --------- Co-authored-by: Hello-Liar <80651389+Hello-Liar@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
silverwind
|
d58be0bcff |
fix(pull): keep review body in sync when its comment is edited (#40058)
A review's text is stored on both the review and its timeline comment, but editing it in the web UI or through the issue comment API only updated the comment. The reviews API kept returning the old body afterwards. Extracted out of https://github.com/go-gitea/gitea/pull/39865. *Written by Claude.* Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
Basavaraj S m
|
36ea65a1df |
fix(projects): hide linked pull requests the viewer cannot read (#40016)
Project board cards list the pull requests that reference their issue, but loaded them without checking the viewer's access. A private pull request mentioning a public issue showed its title, number and state on that issue's board to anyone who can view the board, anonymous visitors included. Repository and organization boards now skip linked pull requests in repositories where the viewer cannot read pull requests, matching how the issue page already hides such references. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: Giteabot <teabot@gitea.io> |