mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-09 17:37:20 -06:00
main
22020 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
silverwind
|
c62db5b2a3 |
perf: reduce git processes and queries on pull request view (#40224)
Removes redundant work from the pull request conversation tab. - Base and head refs resolve through the `cat-file` batch of the git repos the callers already hold, instead of two `git rev-parse` processes, reducing the number of git processes from 9 to 7 per page, about 17 ms faster locally. - Sidebar reviewers are batch-loaded and code-review comments reuse their loaded poster, reducing the number of SQL queries from 387 to 358 on a PR with 169 timeline entries and 15 reviews. Also fixes the commit list of merged pull requests, which resolved the merge base as a branch name and returned 500. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Andrew Barnes
|
4a9d49bb46 |
fix(dump): --file extension is ignored when --type is not set (#40235)
`gitea dump -f backup.tar.gz` without `--type` wrote a zip archive under that name. Detecting the type from the file name was requested in https://github.com/go-gitea/gitea/issues/24622 and intended in https://github.com/go-gitea/gitea/pull/30240, but the check read the still-empty result instead of `--file`, so every name fell back to zip. A supported extension now selects the type, other names like `backup` or `gitea.bak` still default to zip. An explicit `--type` still wins, and its help text now mentions the detection. AI disclosure: written with Claude Code (claude-opus-5-5). --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
b7c1fb2a39 |
enhance: enable DEFAULT_DELETE_BRANCH_AFTER_MERGE by default for new repos (#39975)
Switch the `DEFAULT_DELETE_BRANCH_AFTER_MERGE` default from https://github.com/go-gitea/gitea/pull/36917 to `true`, saving users a click on merge for the most common action that deletes the PR branch on merge. Docs: https://gitea.com/gitea/docs/pulls/608 |
||
|
rafał przypek
|
3b9b8a8976 |
fix(packages): return empty Chef dependencies instead of null (#40237)
Fixes #40230 Cookbooks without dependencies are served with `"dependencies": null` from the universe and version metadata endpoints. This happens because `omitempty` drops the empty map when the metadata is stored. Chef clients iterate over this value and Policyfile resolution crashes. Supermarket returns `{}` for these cookbooks, Gitea now does too. The fix checks whether dependencies are `nil` while building response, returns an empty map if true. This way cookbooks that are already stored are covered without a re-upload. Tested with the Chef integration test and `chef-cli install`. Assisted by Claude Code (claude-opus-5-5). |
||
|
Lunny Xiao
|
565f1b7d52 |
fix(migrations): Do not fail Bitbucket Server migration when pull request activities cannot be loaded (#40205)
Bitbucket Server can answer 500 for `/pull-requests/{id}/activities` of
some pull requests. That error aborted the whole repository migration:
`bitbucket server API .../pull-requests/128/activities returned status
500`
Now a 500 is logged as a warning and that pull request's comments,
reviews and merge commit are skipped, cached so the endpoint is not hit
again. Other errors are still returned, so the migration retries them as
before.
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
silverwind
|
e87ac3a0f4 |
chore(deps): update go.yaml.in/yaml/v4 to v4.0.0 (#40222)
Update go-yaml from the rc.6 pseudo-version to the stable v4.0.0 release, and actionslib to v1.5.2, which does the same in https://gitea.com/gitea/actionslib/pulls/32. The bump also brings in actionslib v1.5.1. v4 double-quotes the `on` key like yaml.v3 did, so one jobparser fixture changes. Runner counterpart: https://gitea.com/gitea/runner/pulls/1381. Fixes: https://github.com/go-gitea/gitea/issues/40145 |
||
|
GiteaBot
|
4477d47d07 | [skip ci] Updated translations via Crowdin | ||
|
Mark
|
bfbf8cd366 |
fix: fix missing accessible name on static Fomantic combobox dropdowns (#40163)
Fixes https://github.com/go-gitea/gitea/issues/40107 Static Fomantic dropdowns get `role="combobox"` or `role="menu"`, and neither role takes its accessible name from child contents (`nameFrom: author` only). Dropdowns like Filter and Sort on `/explore/repos` without `data-tooltip-content`, `aria-label` or `aria-labelledby` therefore had an empty accessible name. If the focusable element still has no `aria-label` or `aria-labelledby` after the tooltip check, link `aria-labelledby` to the dropdown's direct `.text` or `span` child. Selection dropdowns are skipped because their `.text` holds the current value, not a label. --------- Co-authored-by: Mark <14371969+malfunctionAI@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
dfe6db6149 |
fix(web): build issue popup request from parsed link (#40207)
The issue reference popup built its `/info` request from the raw link path, so a link ending in `/owner/repo/issues/N` queried an unrelated location. It now builds the request from the owner, repo, type and index parsed from the link, with `parseIssueHref` anchored to the pathname under `appSubUrl`. |
||
|
Lazizbek Ergashev
|
d1c980cf8b |
fix(web): inline the site manifest (#40198)
Inline the web app manifest as a `data:` URL instead of serving it from `/assets/site-manifest.json`. That endpoint has been linked through `STATIC_URL_PREFIX` since https://github.com/go-gitea/gitea/pull/37405 and fails to load when: 1. a reverse proxy checks auth on every request, because browsers fetch manifests without cookies 2. `STATIC_URL_PREFIX` serves the `public/` directory from disk, which has no such file 3. `STATIC_URL_PREFIX` is cross-origin, because the endpoint sends no CORS headers The manifest is built per request so `start_url` follows `PUBLIC_URL_DETECTION`. A reverse proxy that adds a stricter CSP must allow `manifest-src data:`. Fixes https://github.com/go-gitea/gitea/issues/40197 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
1152bc0cf2 |
fix(actions): evaluate job if: against needs finished in the same pass (#40126)
The job emitter resolves a dependency chain in several rounds in memory, but a job's `if:` reads its needs' results from the database, where a need skipped or failed earlier in the same pass was still blocked. A job with `if: always() && needs.build.result == 'skipped'` was therefore skipped instead of started. Finished statuses are now persisted at the end of each round, which also replaces the separate handling of skipped and failed reusable workflow callers. |
||
|
silverwind
|
159e6d7e75 |
test(actions): run repo Actions API tests as a non-owner repo admin (#40183)
The repo-level runner, secret and variable API tests ran as the repo owner, who bypasses the repo admin check. That's how the regression fixed in https://github.com/go-gitea/gitea/pull/40174 slipped through. As suggested in https://github.com/go-gitea/gitea/pull/40174#issuecomment-6591991824, they now run as an admin collaborator, which replaces the duplicate subtest added there. The tests are also trimmed to one case per status code, because `services/secrets/validation_test.go` already unit tests name validation. |
||
|
Paul van der lei
|
f29eedad83 |
fix(pull): code owner team is requested again after a member reviewed (#40187)
When a member of a CODEOWNERS team approves or rejects a pull request, `SubmitReview` removes the team's review request. On the next push, `PullRequestCodeOwnersReview` finds no request for that team and adds it again, so every team member except the author gets a new "Requested to review" mail. This happens even when the push doesn't change the PR's diff (for example, merging the base branch into the PR branch) and the approval is still valid. Individual code owners don't have this problem: they are skipped when they already have a review. This PR applies the same rule to teams. A team is not requested again while one of its members has an approve or reject review on the PR that hasn't been dismissed. If that review is dismissed (for example by "Dismiss stale approvals"), the team is requested again as before. Testing: `TestPullView_CodeOwnerTeamAnsweredByMember` creates an org repo with `README.md @org3/team1`, opens a PR, and checks three things: the team is requested; after a member approves, a code owner pass (what a push runs) doesn't request the team again; after the approval is dismissed, the team is requested again. The test fails without the change. `make lint-backend` and the `TestPull*` integration tests pass locally on SQLite. AI disclosure: I used Claude to help trace the cause and draft the change, test and description. I reviewed and tested it myself and can explain every line. Fixes #34884. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Basavaraj S m
|
e9c5804075 |
fix(issues): hide unreadable issue types in search and milestone views (#40192)
The repository issue search JSON route sits behind the issues reader check only, and the milestone page is open to anyone who can read either issues or pull requests, since the issue routes have to tolerate pull request permissions. Neither handler narrows the issue type to what the viewer may read: the search route takes `type=pulls` straight from the query or lists both types when it is absent, and the milestone page always lists both. A team member granted only the Issues unit on a private repository can therefore fetch every pull request's title and body as JSON and see pull requests on milestone pages, while a pull-requests-only reader sees issues there. I noticed it while comparing these routes with the API `ListIssues` handler and the web issue suggestions endpoint, which both already narrow the type. The narrowing now lives in one small helper used by all three handlers, with the search route answering 404 for a requested type the viewer cannot read, like the API does. A unit test covers both handlers with an issues-only permission. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Shivansh Garg
|
be297b7e05 |
fix(webhook): fire repository event on repository transfer (#40200)
Transferring a repository fired no `repository` webhook. It now sends a `transferred` action shaped like GitHub's, with the previous owner in `changes.owner.from.user` or `changes.owner.from.organization`. Like GitHub, it goes to the new owner's webhooks, plus the repository's own and system webhooks. - Chat webhooks render "Repository transferred from <owner>". - Actions workflows are unaffected, no trigger matches `repository` events. Fixes https://github.com/go-gitea/gitea/issues/33584 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lunny Xiao
|
fca64e7330 |
perf: reuse request-scoped git repo in pull request conversion (#40208)
Reuse the request-scoped base git repository in `ToAPIPullRequest`, `ToPayloadPullRequest` and `ToAPIPullRequests` instead of reopening it for each conversion, so conversions share the request's `cat-file` process. - Same-repo PRs reuse the base repository for the head instead of opening it a second time. - Drop a redundant second open of the base repository. - Fork head repositories stay opened per call. A request-cached fork keeps its `cat-file` running until the request ends, which blocks deleting the fork on Windows and keeps one process per fork alive in batch status changes. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Myers Carpenter
|
58279e39fd |
fix(actions): match pull_request unlabeled on label removal (#40215)
Fixes https://github.com/go-gitea/gitea/issues/34317 Removing a label from a pull request still started workflows with `types: [labeled]` and never matched `types: [unlabeled]`. https://github.com/go-gitea/gitea/pull/34316 derived `labeled`/`unlabeled` from the added and removed labels for issues only, while pull requests kept mapping every `label_updated` to `labeled`. Both events now share one conversion, so they cannot drift apart again. Two other label changes also triggered the wrong workflows: - Clearing all labels started no `unlabeled` workflow, because the Actions notifier ignored it - Replacing labels reported every old label as removed, so a replace that kept a label also matched `unlabeled` AI disclosure: written with Claude Code (claude-opus-5-5), session https://claude.ai/code/session_01Kw9ySGNd4ynmyX9GcVdUfw --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Nico Schlömer
|
ab295e62e4 |
fix(markup): make heading anchors match GitHub for whitespace and combining marks (#40195)
Heading anchors now keep the same characters as GitHub: letters, marks, decimal and letter numbers, connector punctuation and alphabetic symbols, with ASCII spaces turned into `-`. The rule follows [github-slugger](https://github.com/Flet/github-slugger), whose fixtures are generated from real GitHub renders. - Other whitespace, including newlines in multi-line headings, is dropped instead of becoming `-`, so `1<em space>ab` gets `#1ab` - Combining marks are kept, so `हिन्दी` no longer becomes `हनद` - Other numbers like `²` and `①` are dropped Fixes https://github.com/go-gitea/gitea/issues/27754 This PR was written with Claude Code. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
wxiaoguang
|
d919301d36 |
refactor: remove UnmarshalHandleDoubleEncode patch and fix repo unit TODO (#39998)
Remove the `UnmarshalHandleDoubleEncode` runtime workaround for an old xorm bug, and normalize legacy double-encoded JSON in `repo_unit.config` and `login_source.cfg` with a migration instead. - Config `FromDB` no longer fails on corrupted values. A broken auth source is deactivated, so admins can still fix it in the admin panel - Remove `ProjectsConfig.GetProjectsMode`, `FromDB` already defaults `ProjectsMode` Actually it doesn't need so many changes, just because AI thinks it should handle "corrupted database value" for auth sources. --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Alan Hsu
|
666e6e2d17 |
fix(web): allow clearing the full name in profile settings (#40186)
Clearing "Full Name" in the profile settings shows success but keeps the old value: since #31959 it is only updated when non-empty, because the input is disabled (not submitted) when `change_full_name` is disabled. Use `*string` for the field, so a missing field keeps the value and an empty one clears it. With `change_full_name` disabled, any submitted value (including empty) is now rejected. Not `optional.Option[string]`, because `MaxSize` would count slice elements instead of characters. Fixes #40185 --- AI disclosure: written with Claude Code (claude-opus-5-5) and tested locally. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Jon Fuller
|
4d00ed2a1e |
fix(notifications): avoid deadlock when creating issue notifications concurrently (#40166)
Concurrent `notification-service` workers can deadlock in the transaction for-loop. The transaction is useless, so it is removed to avoid deadlock. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
ce0da8a378 |
build: cross-compile in docker (#40136)
Building the backend under QEMU takes 46 to 54 minutes per foreign platform in the nightly image build, against 7 minutes natively. The backend stage now runs on the build platform and cross-compiles with `GOOS`/`GOARCH`/`GOARM`, so every platform builds at native speed. - `go generate` runs once instead of once per platform. - The PR docker dry run builds all three platforms in a single job, on any docker-related change. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
Gaurav Dubey
|
f26a314636 |
fix(api): keep wiki page name when editing with an empty title (#40153)
Match `PATCH /repos/{owner}/{repo}/wiki/page/{pageName}` document "leave
empty to keep unchanged"
Fixes #39179
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
Jon Fuller
|
5c68ba3e0a |
fix(repo): avoid deadlock when updating language stats concurrently (#40167)
The `repo_stats_update` queue only deduplicates waiting items, so several workers can index the same repository at once, then `UpdateLanguageStats` can lead to transaction deadlock. Use a global lock to avoid concurrent updates, and also helps https://github.com/go-gitea/gitea/pull/39342 to avoid duplicate updates. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
78eb95ab19 |
fix: enable more djlint rules and improve keyboard navigation (#40081)
Enable djlint's [H018](https://djlint.com/docs/linter/#h018), [H046](https://djlint.com/docs/linter/#h046) and [H054](https://djlint.com/docs/linter/#h054) rules, fix their findings and the keyboard navigation problems around them. H054 found links nested in `<button>` dropdowns and radio inputs nested in links, both invalid HTML. - "Add File" and "More Operations" in the repo file list become `div` dropdowns, the disabled state stays unfocusable - The diff whitespace menu marks the current option with a check and `aria-current` instead of radios, which made our dropdown aria patch announce it as a combobox - Sign-in moves "Forgot password?" below "Sign In" and drops the positive tabindexes from https://github.com/go-gitea/gitea/pull/31689, so the tab order follows the DOM: username, password, remember, sign in, forgot - The focus ring on primary, red and green buttons is near-white on dark themes and near-black on light ones, the primary-colored ring was invisible on primary buttons <img width="500" alt="Whitespace menu, before and after" src="https://github.com/user-attachments/assets/d22a423d-95e5-434c-aec4-59264c7132b7" /> <img width="600" alt="Sign-in form, main and this PR" src="https://github.com/user-attachments/assets/d6780690-d906-4791-8a2b-8d80fb03067a" /> <img width="215" height="132" alt="Keyboard-focused primary and red buttons, dark and light theme" src="https://github.com/user-attachments/assets/a2400b18-4802-4383-8560-7e8267a7f02f" /> --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
5c723ee0fd |
refactor(markdown): remove goldmark-highlighting (#39751)
Render fenced code blocks with Gitea's own code block renderer instead of `goldmark-highlighting`, using the managed lexer lookup from `modules/highlight`. Indented and fenced blocks now share one rendering path. Rendered output is unchanged. The trailing newline is stripped on copy in the frontend since https://github.com/go-gitea/gitea/pull/39755. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Giteabot
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE]
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) | Type |
Update | Pending |
|---|---|---|---|---|---|---|
| [@primer/octicons](https://primer.style/octicons)
([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` →
`19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0)
|
|
| dependencies | minor | |
|
[@typescript-eslint/parser](https://typescript-eslint.io/packages/parser)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| @​vitest/eslint-plugin | [`1.6.27` →
`1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28)
|
|
| devDependencies | patch | |
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
`v10.3.0` → `v10.3.2` |
|
| action | patch | `v10.3.3` |
| [chart.js](https://www.chartjs.org)
([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` →
`4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |
|
| dependencies | minor | |
| [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3`
|
|
| | patch | |
|
[connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go)
| `v2.0.1` → `v2.0.2` |
|
| require | patch | |
|
[crowdin/github-action](https://redirect.github.com/crowdin/github-action)
| `v3.4.0` → `v3.5.0` |
|
| action | minor | |
| [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` →
`==1.47.1` |
|
| dependency-groups | minor | `1.49.2` (+4) |
| [docker/login-action](https://redirect.github.com/docker/login-action)
| `v4.6.0` → `v4.7.0` |
|
| action | minor | |
| [elasticsearch](https://hub.docker.com/_/elasticsearch)
([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c`
→ `ef5cafd` | | | service | digest | |
|
[eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn)
| [`78.0.0` →
`79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0)
|
|
| devDependencies | major | |
| [eslint-plugin-vue](https://eslint.vuejs.org)
([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) |
[`10.11.1` →
`10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0)
|
|
| devDependencies | minor | |
|
[getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch)
| `c94e58c` → `1f578fa` | | | service | digest | |
| [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0`
|
|
| require | minor | `v1.5.1` |
|
[github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html)
| `v3.17.1` → `v3.17.3` |
|
| require | patch | |
|
[github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2)
| `v2.9.1` → `v2.11.0` |
|
| require | minor | `v2.12.0` |
|
[github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi)
| `v0.151.0` → `v0.152.0` |
|
| require | minor | |
|
[github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron)
| `v2.22.0` → `v2.23.0` |
|
| require | minor | |
|
[github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync)
| `v4.18.0` → `v4.18.1` |
|
| require | patch | |
| [github.com/google/pprof](https://redirect.github.com/google/pprof) |
`1facf8f` → `dbd0ed3` |
|
| require | digest | |
|
[gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go)
| `v3.29.0` → `v3.39.1` |
|
| require | minor | `v3.40.2` (+3) |
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
`v1.84.0` → `v1.85.0` |
|
| require | minor | |
| [katex](https://katex.org)
([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` →
`0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |
|
| dependencies | patch | |
|
[markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli)
| [`0.49.1` →
`0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0)
|
|
| devDependencies | minor | |
|
[material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md)
([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme))
| [`5.39.0` →
`5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0)
|
|
| devDependencies | minor | |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` →
`v1.61.0` |
|
| require | minor | `v1.61.1` |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.14.0` →
`12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| packageManager | minor | |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`>= 12.14.0` → `>=
12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| engines | minor | |
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` →
`8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |
|
| dependencies | patch | |
| [renovate](https://renovatebot.com)
([source](https://redirect.github.com/renovatebot/renovate)) |
[`44.172.2` →
`44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1)
|
|
| | minor | `44.200.0` (+21) |
|
[renovatebot/github-action](https://redirect.github.com/renovatebot/github-action)
| `v46.3.9` → `v46.3.10` |
|
| action | patch | `v46.3.12` (+1) |
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.4` →
`8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |
|
| dependencies | patch | |
---
### Release Notes
<details>
<summary>primer/octicons (@​primer/octicons)</summary>
###
[`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0)
[Compare
Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0)
##### Minor Changes
- [#​1381](https://redirect.github.com/primer/octicons/pull/1381)
[`d25ce68df9d08abd65431a8a48b45446432f1b45`](
|
||
|
wxiaoguang
|
cdadd0c788 |
fix(actions): make Actions API work with repo admin permission (#40174)
The web route already uses "repo admin" for repo-level Actions management. * Fix #40173 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Abdellatif Anaflous
|
2ed6a6f61b |
fix(web): read the wiki blob excerpt from the wiki repository (#40165)
The "load more lines" button in wiki diffs returned 404. `ExcerptBlob` loads the commit from the wiki repo but read the blob from `ctx.Repo.GitRepo`, a regression from https://github.com/go-gitea/gitea/pull/38464. Read the blob from the repo the commit was loaded from. --------- Co-authored-by: Abdel <hktitof@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
1f51d2c318 |
test: run e2e tests in WebKit on Linux (#40152)
WebKit was removed from the e2e tests in https://github.com/go-gitea/gitea/pull/37315 because Linux WebKit kept crashing. The crashes came from a use-after-free in the libsoup bundled with WebKit, which killed the network process and surfaced as `WebKit encountered an internal error`. macOS WebKit never had them because it does not use libsoup. Playwright 1.64 bundles libsoup 3.6.6 with the fix (https://github.com/microsoft/playwright/issues/42803), so WebKit now runs on all platforms. Builds on https://github.com/go-gitea/gitea/pull/40140. The e2e job ran 50 times on `ubuntu-latest` with WebKit enabled, and all runs passed without WebKit errors. The third browser adds about 1.5 to 2 minutes per run. 1. Playwright installs its system dependencies on GitHub runners too, which only come with the Chromium and Firefox libraries 1. The passkey test skips Linux WebKit, which has no WebAuthn, Playwright only stubs `PublicKeyCredential` there --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
bircni
|
d3021b69ee |
enhance: replace tea CLI with gt (#40036)
tea has been replaced by [gitea-cli](https://gitea.com/gitea/cli) (`gt`), which reuses tea's OAuth2 client ID. - The repository clone panel now offers `gt repo clone owner/repo` under a "Gitea CLI" tab. - The built-in OAuth2 application is renamed from `tea` to `gitea-cli`. `tea` in `[oauth2] DEFAULT_APPLICATIONS` is still accepted as an alias, so existing configs keep working. - Instances that already registered the app keep its stored display name "tea". |
||
|
silverwind
|
c62e07f18a |
fix(projects): only require project write to move board cards (#40161)
Follow-up to https://github.com/go-gitea/gitea/pull/30205, per https://github.com/go-gitea/gitea/pull/30205#discussion_r4435046605. Moving a card on a project board is a project operation, so project write is enough again. Repository boards already show every card to project writers, who then got a 404 when moving one. The per-card archived check is removed too. The frontend sends every card of the target column, so one card from an archived repository rejected all drops and reorders into that column, silently. Project workflows already skip archived repositories, and an archived repository's own board is read-only. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
bircni
|
51368e1997 |
ci: use GitHub merge queue (#40130)
Requiring branches to be up to date reruns the full CI matrix on every waiting PR after each merge, which saturates our 20 concurrent jobs. A merge queue still tests against the latest `main`, but once per batch. This runs the PR workflows on `merge_group` and reports `giteabot/lgtm` on queue commits, since GiteaBot only sets it on PR heads. Mergers queue PRs with "Merge when ready" instead of `reviewed/wait-merge`, so giteabot no longer updates branches. Nothing changes until the `merge-queue` ruleset is enabled and "Require branches to be up to date" is turned off. Backport to `release/v28` before the ruleset covers it. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
eba3a81c9a |
ci: build snap nightlies every 12 hours instead of on every push (#40150)
The snap nightly ran on every push to `main`, about 58 runs and 520 job minutes a week on GitHub-hosted runners, which share the concurrent job limit with PR CI. It now runs as a job in `release-nightly.yml`, reusing its 12-hourly check for new commits on `main`, like https://github.com/go-gitea/gitea/pull/40138 did for the other nightlies. A new release tag is still published by the first build after `main` changes. |
||
|
silverwind
|
2a5c34c379 |
fix(pull): reject pull requests without common history (#39872)
Pull requests between branches without a common history show no commits and can never be merged. The web form already rejects them, but the API and crafted `..` compare POSTs did not. The API compared with `..` since https://github.com/go-gitea/gitea/pull/36105, it now uses `...` again and returns 422 when there is no merge base. |
||
|
silverwind
|
91a49fadc1 |
fix(repo): don't get stuck generating contributor stats (#40125)
A failed contributor stats generation never released its lock, so after the cached error expired, the contributors and code frequency pages kept saying stats are being generated until a restart. A generation outlasting the 5 second wait also leaked its goroutine on an unread channel. The lock is now claimed atomically and released together with the completion signal when generation ends, and a cache miss after the wait counts as still generating. |
||
|
silverwind
|
db9d2944d8 |
fix(api): return language of starred and watched repositories (#40127)
The starred and watched repository API lists converted repositories without loading their attributes, so `language` was always empty. They are now loaded in one batch, owners included. Three of these handlers also continued after an internal error and wrote a second response body, they now return. |
||
|
Norbert Szulc
|
da7b81d407 |
feat: add commitstatus access token scope (#40144)
Add `read:commitstatus` and `write:commitstatus` token scopes, so CI and
other integrations can report commit statuses without a token that
grants full repository access.
- The commit status endpoints (`/statuses/{sha}`,
`/commits/{ref}/status` and `/commits/{ref}/statuses`) accept the new
scopes, and the repository scopes keep working as they include them
- Creating a status still requires code write permission on the
repository, the scope only narrows what the token may do
- `public-only` tokens still cannot reach private repositories
- `PathGroup` middlewares now run only for a matched path, so unrelated
methods and paths that fall back to the group are not rejected by its
scope check
Fixes: https://github.com/go-gitea/gitea/issues/32625
Ref: https://github.com/go-gitea/gitea/pull/35383
Docs: https://gitea.com/gitea/docs/pulls/622
Signed-off-by: Norbert Szulc <norbert@not7cd.net>
Co-authored-by: Aiden Scandella <git@sca.ndella.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
|
||
|
GiteaBot
|
b46b820cec | [skip ci] Updated translations via Crowdin | ||
|
silverwind
|
5d84bbd525 |
test: run e2e tests in WebKit on macOS (#40140)
WebKit was removed from the e2e tests in https://github.com/go-gitea/gitea/pull/37315 because Linux WebKit kept crashing. `make test-e2e` on macOS now also runs WebKit, which does not show these crashes there. CI stays on Linux, because macOS runners would need about an extra GB of cache storage. 1. The bot account test clicks the user type dropdown, Safari only moves Tab focus between text fields 1. On macOS, Playwright runs with a single libuv thread, concurrent `getaddrinfo` lookups of `localhost` there sporadically stall for 5s --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
59cbacc924 |
ci: build nightlies every 12 hours instead of on every push (#40138)
Building nightlies on every push to `main` and `release/v*` costs about 1000 runner minutes a day, a third of it in runs cancelled by the next push. Nightlies now run every 12 hours and only build branches with commits since the last successful run. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
sarankumar
|
a4d1711777 |
fix(api): remove git remote when deleting a push mirror (#40049)
Fixes https://github.com/go-gitea/gitea/issues/40037 `DELETE /repos/{owner}/{repo}/push_mirrors/{name}` only deleted the `push_mirror` row and left the `remote_mirror_*` git remotes, which embed the mirror credentials, in the repository and wiki config. Each create/delete cycle through the API left more credentials behind. - Remove the git remotes before deleting the row and record it in the audit log, like the web settings handler. - Return 404 for an unknown name, as documented, instead of 204. - Ignore an already missing code remote, so the wiki remote is still removed and such mirrors can be deleted through both the API and the web settings. --- AI disclosure: I used an AI coding assistant to help write this change and the PR description. I reviewed the code and ran the tests myself. --------- Signed-off-by: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
bircni
|
4ed6f89b60 |
fix(auth): only auto-link the account the external identity points to (#40121)
With `[oauth2_client].ACCOUNT_LINKING = auto`, submitting the link account sign-up form with a user name or email that already exists linked the external identity to that existing account and signed in as it, without checking that the external identity belongs to that account. Automatic linking now only happens when the existing user matches the external identity: its email equals the provider email, or its name equals the user name derived from the provider (per `[oauth2_client].USERNAME`, same as auto registration). Otherwise the linking login page is shown, which requires the existing account's password. Auto registration is unchanged, since the name and email there already come from the provider. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
wxiaoguang
|
723095e66d | docs: update contributing.md (#40129) | ||
|
Lunny Xiao
|
40507491f7 |
perf(pull): load the repository once for all commit statuses (#39930)
Pages showing commit statuses loaded the repository of every status separately, so a PR with ~75 statuses ran ~75 identical repository queries per merge box render (about 3.4s in a production trace). `statusRepoCanReadActions` only loaded the repository inside the permission cache loader, which never runs once `RepoAssignment` has published the permission. - `CommitStatus.loadRepository` resolves through the request context cache - `statusRepoCanReadActions` loads the repository before the permission lookup - `RepoAssignment` publishes its repository to the context cache next to the permission - `GetCommitActionsStatusMap` drops its own repository map Queries per request with 50 statuses (45 Actions, 5 external) on the head commit, SQLite: | Page | Repository queries | Total queries | |---|---|---| | PR view | 61 → 11 | 157 → 107 | | Commit | 6 → 5 | 24 → 23 | | Branches | 6 → 5 | 33 → 32 | | Commits | 6 → 5 | 23 → 22 | | Repo home | 8 → 7 | 35 → 34 | | `/pulls` | 15 → 15 | 37 → 37 | --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Shreyansh Jain
|
bbb8ef8244 |
fix(actions): default-branch push discards a due schedule occurrence (#40073)
Default-branch pushes and Actions unit saves recreated the repository's schedules with `Next` recomputed from that moment, so a push between a cron's due minute and the scheduler's pass skipped the occurrence, and `@every` timers restarted. Re-registration now updates schedule rows in place and keeps the spec rows of unchanged crons, so their cursor survives and an in-flight scheduler pass still finds its schedule. Re-detection also clears schedules when no scheduled workflow remains. Fixes https://github.com/go-gitea/gitea/issues/40062 Written with AI assistance. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 5.5) <noreply@anthropic.com> |
||
|
leo
|
7df657116c |
fix(api): honor label archive options (#40008)
Updating a label through the API without `is_archived`, for example to rename or recolor it, silently unarchived it. Creating an organization label also ignored `is_archived`. - Keep a label's archive state when a PATCH omits `is_archived`, for repository and organization labels - Honor `is_archived` when creating organization labels, as repository labels already do AI-assisted by Codex (GPT-6); prepared and tested by the assistant. --------- Co-authored-by: Hello-Liar <80651389+Hello-Liar@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
Phoenix
|
9cd06bf57f |
fix(migrations): wait out GitHub rate limits and tolerate failed patch downloads (#40012)
Large GitHub migrations failed once the API budget ran out. A rejected request never updated the downloader's rate state, so go-github refused every retry locally. - Record the rate limit from error responses too, so the next request waits for the reset - Retry repository-wide comment pages like the other downloader calls - Stop `waitAndPickClient` spinning when the rate refresh fails - Skip reaction requests when the reaction rollup reports none - Log a failed patch download instead of failing the migration --------- Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
silverwind
|
680f2a2598 |
fix: don't roll back branches on out-of-order post-receive hooks (#40110)
The post-receive hook wrote each push's new commit into the branch table. Each push runs its own hook after the ref is updated, so with pushes in close succession, like CI pushing back or a quick force-push, a slower first hook can finish last. The table then keeps the older commit, or marks a re-created branch as deleted. - The sync reads each pushed branch's state from git under a repo-scoped lock - Deletions go through the same sync, so a re-created branch stays active - A branch that fails to sync is logged and skipped instead of aborting the batch --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
silverwind
|
70d0f190a1 |
perf: speed up repository issue and pull request lists (#40114)
The repository issue and pull request lists filter `access` by `repo_id`, which no index covers, so every load scans the whole table. Issue counts on larger repositories merge three single-column indices, and the API pull request list loads the latest reviews with `id IN (SELECT max(id) ... GROUP BY ...)`, which MySQL runs as a scan of every review, about 1.1s on https://gitea.com/api/v1/repos/gitea/gitea-mcp/pulls?limit=1. - Index `access.repo_id` - Index `team_repo.repo_id` - Replace the single `repo_id`, `is_closed` and `is_pull` indices with one `issue` index on `(repo_id, is_closed, is_pull)` - Join the latest review ids instead of `id IN (subquery)` Median times in ms on MySQL 8.4 with tables sized like gitea.com (1M access rows, 500k issues, 200k reviews), for a copy of https://gitea.com/gitea/gitea-mcp and a repository with 9.7k issues: | Page | Before | After | |---|---|---| | `/{owner}/{repo}/issues` | 107 | 40 | | `/{owner}/{repo}/pulls` | 106 | 32 | | `/{owner}/{repo}/pulls?state=closed` | 153 | 35 | | `/{owner}/{repo}/issues/{index}` | 141 | 60 | | `/{owner}/{repo}/issues`, 9.7k issues | 303 | 53 | | `/api/v1/repos/{owner}/{repo}/pulls?limit=50` | 180 | 46 | | `/api/v1/repos/{owner}/{repo}/pulls?limit=1` | 137 | 16 | | `/api/v1/repos/{owner}/{repo}/issues`, 9.7k issues | 248 | 43 | --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io> |