fix(repo): do not check out existing repo content during auto-init (#40376) (#40383)

Backport #40376 by @bircni

Plain repository creation marked a new repository as ready before its
git data, hooks and initial commit existed, and auto-init cloned the new
repository to build its initial commit on top of whatever it already
contained.

- Auto-init builds the initial commit in a freshly initialized temp
repository instead of a clone
- New repositories are inserted as being created and marked ready once
initialized, as fork, template generation, adoption and migrations
already do

---------

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>

.github/workflows/giteabot-backport.yml

@@ -4,13 +4,14 @@ on:
   push:
     branches:
       - main
+      - release/v*
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
@@ -19,8 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: go-gitea/giteabot@f48c6a15e0d384f037aea19cc05ff5e9551096b9 # v1.1.0
+      - uses: go-gitea/giteabot@15b18fdedd98a80d0968d0bd9db3a9428814b808 # v1.5.1
         with:
           github_token: ${{ secrets.GITEABOT_TOKEN }}
           gitea_fork: giteabot/gitea
-          checks: backport
+          checks: backport,backport_conflict_free

.github/workflows/giteabot.yml

@@ -1,16 +1,11 @@
 name: giteabot
 
 on:
-  # When main advances, rerun merge queue maintenance so the oldest
-  # reviewed/wait-merge PR can be updated against the new base promptly.
-  push:
-    branches:
-      - main
   # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
   # forks, which the bot needs to write labels, statuses and comments. Safe here
   # because the job only runs a pinned action and never checks out PR HEAD.
-  # These PR lifecycle events drive label maintenance, queue maintenance, and
-  # explicit bot actions triggered by relevant label changes.
+  # These PR lifecycle events drive label maintenance, lgtm, and explicit bot
+  # actions triggered by relevant label changes.
   pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
@@ -26,8 +21,7 @@ on:
       - giteabot-review
     types:
       - requested
-  # Periodic maintenance is still useful as a backstop for queue cleanup and
-  # other housekeeping, even though main pushes now trigger it promptly.
+  # Daily housekeeping like locks, stale feedback issues, last calls and milestones
   schedule:
     - cron: "15 3 * * *"
   # Allow maintainers to rerun selected checks manually when debugging bot
@@ -37,7 +31,7 @@ on:
       checks:
         description: Comma-separated list of non-backport checks to run
         required: false
-        default: labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
+        default: backport_branches,backport_conflict_free,labels,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
 
 permissions: {}
 
@@ -56,7 +50,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: go-gitea/giteabot@8033358e118c0bd97f5e9902dc5d6633eadc6aeb # v1.2.1
+      - uses: go-gitea/giteabot@15b18fdedd98a80d0968d0bd9db3a9428814b808 # v1.5.1
         with:
           github_token: ${{ secrets.GITEABOT_TOKEN }}
-          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
+          checks: ${{ github.event.inputs.checks || 'backport_branches,backport_conflict_free,labels,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}

.github/workflows/merge-group.yml

@@ -0,0 +1,16 @@
+name: merge-group
+
+# Reports the required giteabot/lgtm check on merge queue commits. giteabot only sets it
+# on PR heads, which already passed it before entering the queue.
+
+on:
+  merge_group:
+
+permissions: {}
+
+jobs:
+  lgtm:
+    name: giteabot/lgtm
+    runs-on: ubuntu-latest
+    steps:
+      - run: "true"

.github/workflows/pull-compliance.yml

@@ -2,6 +2,7 @@ name: compliance
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/pull-db-tests.yml

@@ -2,6 +2,7 @@ name: db-tests
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/pull-e2e-tests.yml

@@ -2,6 +2,7 @@ name: e2e-tests
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/release-create-tag.yml

@@ -13,7 +13,9 @@ permissions: {}
 jobs:
   tag:
     runs-on: ubuntu-latest
-    environment: release-signing
+    environment:
+      name: release-signing
+      deployment: false
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

Dockerfile

@@ -48,7 +48,7 @@ FROM docker.io/library/alpine:3.24 AS gitea
 
 EXPOSE 22 3000
 
-RUN apk --no-cache add \
+RUN apk --no-cache upgrade && apk --no-cache add \
     bash \
     ca-certificates \
     curl \

Dockerfile.rootless

@@ -43,7 +43,7 @@ FROM docker.io/library/alpine:3.24 AS gitea-rootless
 
 EXPOSE 2222 3000
 
-RUN apk --no-cache add \
+RUN apk --no-cache upgrade && apk --no-cache add \
     bash \
     ca-certificates \
     dumb-init \

assets/go-licenses.json

@@ -119,11 +119,6 @@
     "path": "github.com/andybalholm/brotli/LICENSE",
     "licenseText": "Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
   },
-  {
-    "name": "github.com/andybalholm/brotli/flate",
-    "path": "github.com/andybalholm/brotli/flate/LICENSE",
-    "licenseText": "Copyright (c) 2009 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
-  },
   {
     "name": "github.com/andybalholm/cascadia",
     "path": "github.com/andybalholm/cascadia/LICENSE",

cmd/admin_user_list.go

@@ -33,7 +33,7 @@ func runListUsers(ctx context.Context, c *cli.Command) error {
 		return err
 	}
 
-	users, err := user_model.GetAllUsers(ctx)
+	users, err := user_model.GetAllUsersForAdminListing(ctx)
 	if err != nil {
 		return err
 	}
@@ -41,17 +41,17 @@ func runListUsers(ctx context.Context, c *cli.Command) error {
 	w := tabwriter.NewWriter(os.Stdout, 5, 0, 1, ' ', 0)
 
 	if c.IsSet("admin") {
-		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\n")
+		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\tType\n")
 		for _, u := range users {
 			if u.IsAdmin {
-				fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", u.ID, u.Name, u.Email, u.IsActive)
+				fmt.Fprintf(w, "%d\t%s\t%s\t%t\t%s\n", u.ID, u.Name, u.Email, u.IsActive, u.Type.DisplayName())
 			}
 		}
 	} else {
 		twofa := user_model.UserList(users).GetTwoFaStatus(ctx)
-		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\tIsAdmin\t2FA\n")
+		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\tIsAdmin\t2FA\tType\n")
 		for _, u := range users {
-			fmt.Fprintf(w, "%d\t%s\t%s\t%t\t%t\t%t\n", u.ID, u.Name, u.Email, u.IsActive, u.IsAdmin, twofa[u.ID])
+			fmt.Fprintf(w, "%d\t%s\t%s\t%t\t%t\t%t\t%s\n", u.ID, u.Name, u.Email, u.IsActive, u.IsAdmin, twofa[u.ID], u.Type.DisplayName())
 		}
 	}
 

custom/conf/app.example.ini

@@ -811,6 +811,7 @@ LEVEL = Info
 ;[git.config]
 ;diff.algorithm = histogram
 ;core.logAllRefUpdates = true
+;maintenance.strategy = gc
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -3083,7 +3084,7 @@ LEVEL = Info
 ;LOG_RETENTION_DAYS = 365
 ;; Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever.
 ;; Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded.
-;; Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
+;; Workflows can request a shorter retention period, down to 1 day.
 ;ARTIFACT_RETENTION_DAYS = 90
 ;; Max artifact size in bytes that can be browsed or previewed in the web UI. Set to 0 to disable artifact previews, or -1 for no limit.
 ;ARTIFACT_PREVIEW_MAX_SIZE = 10485760

docs/community-governance.md

@@ -74,15 +74,13 @@ Changes to Gitea must be reviewed before they are accepted, including changes fr
 
 We require two maintainer approvals for every PR. When that is satisfied, your PR gets the `lgtm/done` label. After that, you mainly fix merge conflicts and respond to or implement maintainer requests; maintainers drive getting the PR merged.
 
-If a PR has `lgtm/done`, no open discussions, and no merge conflicts, any maintainer may add `reviewed/wait-merge`. That puts the PR in the merge queue. PRs are merged from the queue in the order of this list:
+If a PR has `lgtm/done`, no open discussions, and no merge conflicts, a merger rewrites its title and description into the final [commit message](#commit-messages) and clicks **Merge when ready**. That adds the PR to the [merge queue](https://github.com/go-gitea/gitea/queue/main), which tests it on top of the latest `main` and the PRs ahead of it, and merges it once CI passes. Edits to the title and description no longer reach the commit once the queue starts building the PR, so make them before queueing.
 
-<https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>
-
-Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. The backporter:
+Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. It:
 
+- Counts maintainer approvals and sets the `lgtm/*` labels and the `giteabot/lgtm` status.
+- Takes a PR out of the merge queue when it loses its approval.
 - Creates a backport PR when needed after the initial PR merges.
-- Removes the PR from the merge queue after it merges.
-- Keeps the oldest branch in the merge queue up to date with merges.
 
 ### Final call
 
@@ -164,7 +162,7 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:
 
-- Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
+- Adding PRs to the [merge queue](#getting-prs-merged) once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
 - Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
   In particular, mergers should edit the PR description.\
   Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.

docs/release-management.md

@@ -24,6 +24,8 @@ Now, that's not a requirement anymore as our [backport bot](https://github.com/G
 
 The `backport/manual` label signifies either that you want to backport the change yourself, or that there were conflicts when backporting, thus you **must** do it yourself.
 
+The bot labels open PRs targeting `main` that have a `backport/<version>` label with `backport/conflict-free` when they would cherry-pick onto the latest release branch without conflicts.
+
 ### Format of backport PRs
 
 The title of backport PRs should be

go.mod

@@ -2,7 +2,7 @@ module gitea.dev
 
 go 1.27
 
-toolchain go1.27.2
+toolchain go1.27.4
 
 require (
 	connectrpc.com/connect v1.21.0
@@ -11,9 +11,9 @@ require (
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
 	gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
-	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
+	gitea.com/lunny/levelqueue v0.5.1
 	gitea.dev/actionslib v1.2.1
-	gitea.dev/sdk v1.2.0
+	gitea.dev/sdk v1.3.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/go-ntlmssp v0.1.1
@@ -95,14 +95,14 @@ require (
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	gitlab.com/gitlab-org/api/client-go/v3 v3.13.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525
-	golang.org/x/crypto v0.57.0
+	golang.org/x/crypto v0.58.0
 	golang.org/x/image v0.46.0
 	golang.org/x/mod v0.41.0
-	golang.org/x/net v0.60.0
+	golang.org/x/net v0.62.0
 	golang.org/x/oauth2 v0.37.0
-	golang.org/x/sync v0.23.0
-	golang.org/x/sys v0.48.0
-	golang.org/x/text v0.42.0
+	golang.org/x/sync v0.24.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/text v0.43.0
 	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/ini.v1 v1.67.3
@@ -120,7 +120,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/RoaringBitmap/roaring/v2 v2.18.2 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
-	github.com/andybalholm/brotli v1.2.1 // indirect
+	github.com/andybalholm/brotli v1.2.7 // indirect
 	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -252,7 +252,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	golang.org/x/tools v0.51.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	modernc.org/libc v1.75.7 // indirect

go.sum

@@ -18,14 +18,14 @@ gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6 h1:YWzVGeC/8SZThrJS4
 gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:VyMQP6ue6MKHM8UsOXfNfuMKD0oSAWZdXVcpHIN2yaY=
-gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHqdhS7keYWioqfmxdnfblFDTGoOwcZ+o=
-gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
+gitea.com/lunny/levelqueue v0.5.1 h1:15q1oBWaO2Aw9t3rDthQSTX+vBNgjYNkCgRJgES9gA8=
+gitea.com/lunny/levelqueue v0.5.1/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGqTOXqu2aRi/XEQxDCBwM8yJtE6s=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
 gitea.dev/actionslib v1.2.1 h1:GL//K/0zIZV6h1OOksv1awvFVg0rg7fug2xWcG7mkG0=
 gitea.dev/actionslib v1.2.1/go.mod h1:1+gqOKGSEPn2IFHgY8S3GC5Ld+Hn8jF3OxiFHQ/fpx4=
-gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
-gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
+gitea.dev/sdk v1.3.0 h1:4U95+Ou6WHCQiRPDEyAzvl1Q7cxg5RUTWkqmOXr5w4I=
+gitea.dev/sdk v1.3.0/go.mod h1:85EBqSAqUn1KlFCk40y3sTjWjBsB/KouL3slGXMA/2o=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -71,8 +71,8 @@ github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
-github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
-github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A=
+github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
 github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -686,8 +686,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
@@ -714,8 +714,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -728,8 +728,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -756,8 +756,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -767,8 +767,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -779,8 +779,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -790,8 +790,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

models/actions/artifact.go

@@ -93,7 +93,12 @@ const artifactKeepForever timeutil.TimeStamp = 0
 
 func artifactExpiry(requested optional.Option[timeutil.TimeStamp]) timeutil.TimeStamp {
 	if requested.Has() {
-		return max(requested.Value(), artifactKeepForever+1)
+		now := timeutil.TimeStampNow()
+		expiry := max(requested.Value(), now.Add(timeutil.Day)) // v4 clients use the runner's clock
+		if setting.Actions.ArtifactRetentionDays > 0 {
+			expiry = min(expiry, now.Add(timeutil.Day*setting.Actions.ArtifactRetentionDays))
+		}
+		return expiry
 	}
 	if setting.Actions.ArtifactRetentionDays <= 0 {
 		return artifactKeepForever

models/actions/artifact_test.go

@@ -5,6 +5,12 @@ package actions
 
 import (
 	"testing"
+	"time"
+
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -25,3 +31,21 @@ func TestKeepLatestAttemptArtifacts(t *testing.T) {
 	}
 	assert.Equal(t, []int64{1, 4, 5}, ids)
 }
+
+func TestArtifactExpiry(t *testing.T) {
+	defer timeutil.MockSet(time.Unix(1_000_000_000, 0))()
+	now := timeutil.TimeStampNow()
+	days := func(n int64) timeutil.TimeStamp { return now.Add(n * timeutil.Day) }
+	requested := optional.Some[timeutil.TimeStamp]
+
+	defer test.MockVariableValue(&setting.Actions.ArtifactRetentionDays, 90)()
+	assert.Equal(t, days(90), artifactExpiry(optional.None[timeutil.TimeStamp]()))
+	assert.Equal(t, days(5), artifactExpiry(requested(days(5))))
+	assert.Equal(t, days(1), artifactExpiry(requested(days(-2))), "runner clock behind must not expire the artifact at once")
+	assert.Equal(t, days(90), artifactExpiry(requested(days(1000))), "runner must not exceed the instance retention")
+
+	setting.Actions.ArtifactRetentionDays = 0
+	assert.Equal(t, artifactKeepForever, artifactExpiry(optional.None[timeutil.TimeStamp]()))
+	assert.Equal(t, days(1000), artifactExpiry(requested(days(1000))))
+	assert.Equal(t, days(1), artifactExpiry(requested(now)))
+}

models/actions/run.go

@@ -34,8 +34,8 @@ type ActionRun struct {
 	RepoID            int64                  `xorm:"unique(repo_index) index(repo_status)"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	OwnerID           int64                  `xorm:"index"`
-	WorkflowID        string                 `xorm:"index"`                    // the name of workflow file
-	Index             int64                  `xorm:"index unique(repo_index)"` // a unique number for each run of a repository
+	WorkflowID        string                 `xorm:"index"`              // the name of workflow file
+	Index             int64                  `xorm:"unique(repo_index)"` // a unique number for each run of a repository
 	TriggerUserID     int64                  `xorm:"index"`
 	TriggerUser       *user_model.User       `xorm:"-"`
 	ScheduleID        int64

models/actions/run_job.go

@@ -25,7 +25,6 @@ import (
 
 // MaxJobNumPerRun is the maximum number of jobs in a single run.
 // https://docs.github.com/en/actions/reference/limits#existing-system-limits
-// TODO: check this limit when creating jobs
 const MaxJobNumPerRun = 256
 
 // ActionRunJob represents a job of a run
@@ -100,7 +99,7 @@ type ActionRunJob struct {
 
 	// IsReusableCaller marks this job as a reusable workflow caller.
 	// Caller jobs do not run on a runner; their status is derived from their child jobs.
-	IsReusableCaller bool `xorm:"index NOT NULL DEFAULT FALSE"`
+	IsReusableCaller bool `xorm:"NOT NULL DEFAULT FALSE"`
 	// IsExpanded reports whether this job's lazy expansion (children-row insertion) is complete.
 	// For a reusable workflow caller, true means children rows exist and CallPayload is populated.
 	IsExpanded bool `xorm:"NOT NULL DEFAULT FALSE"`
@@ -440,14 +439,6 @@ func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*
 	return out
 }
 
-// hasWaitingJobsToPick reports whether any waiting, unclaimed, non-reusable job
-// remains in the repo, i.e. work that an idle runner could still pick up.
-func hasWaitingJobsToPick(ctx context.Context, repoID int64) (bool, error) {
-	return db.GetEngine(ctx).
-		Where("repo_id = ? AND task_id = ? AND status = ? AND is_reusable_caller = ?", repoID, 0, StatusWaiting, false).
-		Exist(&ActionRunJob{})
-}
-
 func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, cols ...string) (int64, error) {
 	e := db.GetEngine(ctx)
 
@@ -498,7 +489,7 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 			// Only bump when waiting work actually remains for this repo, otherwise
 			// every job completion would needlessly bump the global version and wake
 			// every idle runner instance-wide for nothing.
-			hasWaiting, err := hasWaitingJobsToPick(ctx, job.RepoID)
+			hasWaiting, err := JobQueueOptions{RepoID: job.RepoID, Status: StatusWaiting}.session(ctx).Exist(new(ActionRunJob))
 			if err != nil {
 				return 0, err
 			}

models/actions/run_job_queue.go

@@ -27,13 +27,12 @@ func (opts JobQueueOptions) session(ctx context.Context) *xorm.Session {
 		sess = sess.And(builder.Eq{"`action_run_job`.repo_id": opts.RepoID})
 	}
 	if opts.OwnerID > 0 {
-		sess = sess.Join("INNER", "repository", "repository.id = `action_run_job`.repo_id AND repository.owner_id = ?", opts.OwnerID)
+		sess = sess.And(builder.In("`action_run_job`.repo_id", builder.Select("id").From("repository").Where(builder.Eq{"owner_id": opts.OwnerID})))
 	}
 	return sess.And(opts.statusCond())
 }
 
 var (
-	// keep in sync with CreateTaskForRunner
 	queuedJobsCond = builder.Eq{"`action_run_job`.status": StatusWaiting, "`action_run_job`.task_id": 0}
 	// a cancelling job still occupies its runner
 	runningJobsCond = builder.In("`action_run_job`.status", StatusRunning, StatusCancelling)

models/actions/scoped_workflow.go

@@ -65,26 +65,22 @@ func (opts FindScopedWorkflowSourceOpts) ToConds() builder.Cond {
 	if opts.SourceRepoID != 0 {
 		cond = cond.And(builder.Eq{"source_repo_id": opts.SourceRepoID})
 	}
-	return cond
+	return cond.And(scopedWorkflowSourceOwnedCond())
+}
+
+func scopedWorkflowSourceOwnedCond() builder.Cond {
+	return builder.Eq{"owner_id": 0}.Or(builder.Expr("EXISTS (SELECT 1 FROM repository WHERE repository.id = action_scoped_workflow_source.source_repo_id AND repository.owner_id = action_scoped_workflow_source.owner_id)"))
 }
 
 // GetEffectiveScopedWorkflowSources returns the scoped-workflow sources effective for a repo owned by repoOwnerID:
 // the owner's own sources plus instance-level (owner_id=0) sources.
 func GetEffectiveScopedWorkflowSources(ctx context.Context, repoOwnerID int64) ([]*ActionScopedWorkflowSource, error) {
-	owners := []int64{0}
-	if repoOwnerID != 0 {
-		owners = append(owners, repoOwnerID)
-	}
-	return db.Find[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: owners})
+	return db.Find[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: []int64{0, repoOwnerID}})
 }
 
 // IsScopedWorkflowSourceEffective reports whether sourceRepoID is a scoped-workflow source effective for a repo owned by repoOwnerID.
 func IsScopedWorkflowSourceEffective(ctx context.Context, repoOwnerID, sourceRepoID int64) (bool, error) {
-	owners := []int64{0}
-	if repoOwnerID != 0 {
-		owners = append(owners, repoOwnerID)
-	}
-	return db.Exist[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: owners, SourceRepoID: sourceRepoID}.ToConds())
+	return db.Exist[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: []int64{0, repoOwnerID}, SourceRepoID: sourceRepoID}.ToConds())
 }
 
 // IsWorkflowRequiredInSources reports whether workflowID from sourceRepoID is required by any of the given sources.
@@ -138,12 +134,10 @@ func GetScopedWorkflowSourcesByOwner(ctx context.Context, ownerID int64) ([]*Act
 
 // GetScopedWorkflowSource returns the (owner, repo) source registration or a NotExist error.
 func GetScopedWorkflowSource(ctx context.Context, ownerID, repoID int64) (*ActionScopedWorkflowSource, error) {
-	src := &ActionScopedWorkflowSource{}
-	has, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Get(src)
+	src, has, err := db.Get[ActionScopedWorkflowSource](ctx, builder.Eq{"owner_id": ownerID, "source_repo_id": repoID}.And(scopedWorkflowSourceOwnedCond()))
 	if err != nil {
 		return nil, err
-	}
-	if !has {
+	} else if !has {
 		return nil, util.NewNotExistErrorf("scoped workflow source (owner %d, repo %d) does not exist", ownerID, repoID)
 	}
 	return src, nil
@@ -181,3 +175,9 @@ func RemoveScopedWorkflowSource(ctx context.Context, ownerID, repoID int64) erro
 	_, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Delete(new(ActionScopedWorkflowSource))
 	return err
 }
+
+// RemoveOwnerScopedWorkflowSources removes every owner-level registration of repoID, as only its current owner may hold one.
+func RemoveOwnerScopedWorkflowSources(ctx context.Context, repoID int64) error {
+	_, err := db.GetEngine(ctx).Where("owner_id <> 0 AND source_repo_id = ?", repoID).Delete(new(ActionScopedWorkflowSource))
+	return err
+}

models/actions/scoped_workflow_test.go

@@ -48,26 +48,28 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	ctx := t.Context()
 
-	rows := []*ActionScopedWorkflowSource{
-		{OwnerID: 2, SourceRepoID: 100, WorkflowConfigs: nil}, // org 2 registers repo 100 (optional)
-		{OwnerID: 0, SourceRepoID: 100, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"a.yml": {Required: true, Patterns: []string{"p"}}}}, // instance also registers repo 100 (required)
-		{OwnerID: 0, SourceRepoID: 200, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"b.yml": {Required: true, Patterns: []string{"p"}}}}, // instance source 200
-		{OwnerID: 3, SourceRepoID: 300, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"c.yml": {Required: true, Patterns: []string{"p"}}}}, // a different owner's source
-	}
-	for _, r := range rows {
-		require.NoError(t, db.Insert(ctx, r))
+	for _, source := range []*ActionScopedWorkflowSource{
+		{OwnerID: 2, SourceRepoID: 1},
+		{OwnerID: 0, SourceRepoID: 1, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"a.yml": {Required: true}}},
+		{OwnerID: 0, SourceRepoID: 200, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"b.yml": {Required: true}}},
+		{OwnerID: 3, SourceRepoID: 3, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"c.yml": {Required: true}}},
+		{OwnerID: 2, SourceRepoID: 3, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"c.yml": {Required: true}}},
+	} {
+		require.NoError(t, db.Insert(ctx, source))
 	}
 
 	// owner 2 sees its own sources plus instance-level ones, but not owner 3's.
 	owner2, err := GetEffectiveScopedWorkflowSources(ctx, 2)
 	require.NoError(t, err)
 	assert.Len(t, owner2, 3)
+	_, err = GetScopedWorkflowSource(ctx, 2, 3)
+	assert.ErrorIs(t, err, util.ErrNotExist)
 
-	required, err := IsScopedWorkflowRequired(ctx, 2, 100, "a.yml")
+	required, err := IsScopedWorkflowRequired(ctx, 2, 1, "a.yml")
 	require.NoError(t, err)
 	assert.True(t, required, "instance marks a.yml required → required for owner 2 even though org left it optional")
 
-	required, err = IsScopedWorkflowRequired(ctx, 2, 100, "x.yml")
+	required, err = IsScopedWorkflowRequired(ctx, 2, 1, "x.yml")
 	require.NoError(t, err)
 	assert.False(t, required)
 
@@ -76,12 +78,12 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	assert.True(t, required)
 
 	// owner 3's source must not be effective for owner 2.
-	required, err = IsScopedWorkflowRequired(ctx, 2, 300, "c.yml")
+	required, err = IsScopedWorkflowRequired(ctx, 2, 3, "c.yml")
 	require.NoError(t, err)
 	assert.False(t, required)
 
 	// IsScopedWorkflowSourceEffective: owner-level and instance-level sources are effective; another owner's is not.
-	effective, err := IsScopedWorkflowSourceEffective(ctx, 2, 100)
+	effective, err := IsScopedWorkflowSourceEffective(ctx, 2, 1)
 	require.NoError(t, err)
 	assert.True(t, effective, "owner 2's own source")
 
@@ -89,7 +91,7 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	require.NoError(t, err)
 	assert.True(t, effective, "instance-level source is effective for any owner")
 
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 2, 300)
+	effective, err = IsScopedWorkflowSourceEffective(ctx, 2, 3)
 	require.NoError(t, err)
 	assert.False(t, effective, "owner 3's source is not effective for owner 2")
 
@@ -97,7 +99,7 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	require.NoError(t, err)
 	assert.False(t, effective, "unknown source repo")
 
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 3, 300)
+	effective, err = IsScopedWorkflowSourceEffective(ctx, 3, 3)
 	require.NoError(t, err)
 	assert.True(t, effective, "owner 3's own source is effective for owner 3")
 }
@@ -107,8 +109,8 @@ func TestScopedWorkflowSourceCRUD(t *testing.T) {
 	ctx := t.Context()
 
 	// add is idempotent
-	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 10))
-	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 10))
+	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 4))
+	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 4))
 	sources, err := GetScopedWorkflowSourcesByOwner(ctx, 5)
 	require.NoError(t, err)
 	assert.Len(t, sources, 1)
@@ -118,20 +120,20 @@ func TestScopedWorkflowSourceCRUD(t *testing.T) {
 		"a.yml": {Required: true, Patterns: []string{"src: a.yml / *"}},
 		"b.yml": {Required: false, Patterns: []string{"src: b.yml / build (push)"}},
 	}
-	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 10, configs))
-	src, err := GetScopedWorkflowSource(ctx, 5, 10)
+	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 4, configs))
+	src, err := GetScopedWorkflowSource(ctx, 5, 4)
 	require.NoError(t, err)
 	assert.Equal(t, configs, src.WorkflowConfigs)
 
 	// clearing the configs works
-	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 10, nil))
-	src, err = GetScopedWorkflowSource(ctx, 5, 10)
+	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 4, nil))
+	src, err = GetScopedWorkflowSource(ctx, 5, 4)
 	require.NoError(t, err)
 	assert.Empty(t, src.WorkflowConfigs)
 
 	// remove
-	require.NoError(t, RemoveScopedWorkflowSource(ctx, 5, 10))
-	_, err = GetScopedWorkflowSource(ctx, 5, 10)
+	require.NoError(t, RemoveScopedWorkflowSource(ctx, 5, 4))
+	_, err = GetScopedWorkflowSource(ctx, 5, 4)
 	assert.ErrorIs(t, err, util.ErrNotExist)
 	sources, err = GetScopedWorkflowSourcesByOwner(ctx, 5)
 	require.NoError(t, err)

models/actions/task.go

@@ -261,21 +261,10 @@ var pickTaskBatchSize = 100
 // atomically claims it. It iterates through all matching jobs so that a
 // concurrent claim by another runner (which would lose the optimistic lock on
 // job #1) does not leave the remaining jobs permanently unassigned.
-func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask, bool, error) {
+func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (task *ActionTask, cancelledJobs []*ActionRunJob, err error) {
 	if db.InTransaction(ctx) {
-		return nil, false, errors.New("CreateTaskForRunner must not be called within a database transaction")
+		return nil, nil, errors.New("CreateTaskForRunner must not be called within a database transaction")
 	}
-	e := db.GetEngine(ctx)
-
-	jobCond := builder.NewCond()
-	if runner.RepoID != 0 {
-		jobCond = builder.Eq{"repo_id": runner.RepoID}
-	} else if runner.OwnerID != 0 {
-		jobCond = builder.In("repo_id", builder.Select("`repository`.id").From("repository").
-			Join("INNER", "repo_unit", "`repository`.id = `repo_unit`.repo_id").
-			Where(builder.Eq{"`repository`.owner_id": runner.OwnerID, "`repo_unit`.type": unit.TypeActions}))
-	}
-	baseCond := builder.Eq{"task_id": 0, "status": StatusWaiting, "is_reusable_caller": false}.And(jobCond)
 
 	// TODO: a more efficient way to filter labels
 	log.Trace("runner labels: %v", runner.AgentLabels)
@@ -286,17 +275,17 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 	var cursorUpdated timeutil.TimeStamp
 	var cursorID int64
 	for {
-		cond := baseCond
+		sess := JobQueueOptions{RepoID: runner.RepoID, OwnerID: runner.OwnerID, Status: StatusWaiting}.session(ctx)
 		if cursorID > 0 {
-			cond = cond.And(builder.Or(
+			sess.And(builder.Or(
 				builder.Gt{"updated": cursorUpdated},
 				builder.And(builder.Eq{"updated": cursorUpdated}, builder.Gt{"id": cursorID}),
 			))
 		}
 
 		var jobs []*ActionRunJob
-		if err := e.Where(cond).Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
-			return nil, false, err
+		if err := sess.Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
+			return nil, cancelledJobs, err
 		}
 		// A short page means no waiting jobs remain beyond it.
 		isLastPage := len(jobs) < pickTaskBatchSize
@@ -309,28 +298,29 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 			if !runner.CanMatchLabels(v.RunsOn) {
 				continue
 			}
-			task, ok, err := claimJobForRunner(ctx, runner, v)
-			if err != nil {
-				return nil, false, err
+			task, cancelled, err := claimJobForRunner(ctx, runner, v)
+			if cancelled {
+				cancelledJobs = append(cancelledJobs, v)
 			}
-			if ok {
-				return task, true, nil
+			if err != nil || task != nil {
+				return task, cancelledJobs, err
 			}
-			// Another runner claimed this job concurrently; try the next one.
+			// Another runner claimed this job concurrently, or it was cancelled. Try the next one.
 		}
 
 		if isLastPage {
-			return nil, false, nil
+			return nil, cancelledJobs, nil
 		}
 	}
 }
 
 // claimJobForRunner attempts to atomically claim job for runner inside its own
-// transaction. Returns (task, true, nil) on success, or (nil, false, nil) when
-// another runner wins the optimistic-lock race (the caller should try the next
-// candidate job).
+// transaction. Returns the task on success, cancelled when the job's repository
+// has Actions disabled, or neither when another runner wins the optimistic-lock
+// race (the caller should try the next candidate job).
 func claimJobForRunner(ctx context.Context, runner *ActionRunner, job *ActionRunJob) (*ActionTask, bool, error) {
 	var resultTask *ActionTask
+	var cancelled bool
 
 	err := db.WithTx(ctx, func(ctx context.Context) error {
 		e := db.GetEngine(ctx)
@@ -338,6 +328,15 @@ func claimJobForRunner(ctx context.Context, runner *ActionRunner, job *ActionRun
 		if err := job.LoadAttributes(ctx); err != nil {
 			return err
 		}
+		if err := job.Run.Repo.LoadUnits(ctx); err != nil {
+			return err
+		}
+		if !job.Run.Repo.UnitEnabled(ctx, unit.TypeActions) {
+			job.Status, job.Stopped = StatusCancelled, timeutil.TimeStampNow()
+			affected, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0, "status": StatusWaiting}, "status", "stopped")
+			cancelled = err == nil && affected == 1
+			return err
+		}
 
 		now := timeutil.TimeStampNow()
 		job.Started = now
@@ -403,13 +402,10 @@ func claimJobForRunner(ctx context.Context, runner *ActionRunner, job *ActionRun
 		return nil
 	})
 
-	if errors.Is(err, errJobAlreadyClaimed) {
-		return nil, false, nil
-	}
-	if err != nil {
+	if err != nil && !errors.Is(err, errJobAlreadyClaimed) {
 		return nil, false, err
 	}
-	return resultTask, true, nil
+	return resultTask, cancelled, nil
 }
 
 // ReleaseTaskForRunner reverts a freshly-claimed but undelivered task: it deletes

models/actions/task_test.go

@@ -13,6 +13,7 @@ import (
 	runnerv1 "gitea.dev/actionslib/runner/v1"
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/timeutil"
@@ -258,6 +259,11 @@ func TestReleaseTaskForRunner(t *testing.T) {
 	}
 	require.NoError(t, db.Insert(t.Context(), run))
 
+	disabledRun := &ActionRun{RepoID: 2, TriggerUserID: 2}
+	require.NoError(t, db.Insert(t.Context(), disabledRun))
+	disabledJob := &ActionRunJob{RunID: disabledRun.ID, RepoID: 2, Status: StatusWaiting, RunsOn: []string{"ubuntu-latest"}}
+	require.NoError(t, db.Insert(t.Context(), disabledJob))
+
 	job := &ActionRunJob{
 		RunID:           run.ID,
 		RepoID:          run.RepoID,
@@ -279,11 +285,13 @@ func TestReleaseTaskForRunner(t *testing.T) {
 	}
 	runner.GenerateAndFillToken()
 	require.NoError(t, db.Insert(t.Context(), runner))
+	require.NoError(t, db.Insert(t.Context(), &repo_model.RepoUnit{RepoID: run.RepoID, Type: unit.TypeActions}))
 
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
+	task, cancelledJobs, err := CreateTaskForRunner(t.Context(), runner)
 	require.NoError(t, err)
-	require.True(t, ok)
 	require.NotNil(t, task)
+	require.Len(t, cancelledJobs, 1)
+	assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: disabledJob.ID}).Status)
 
 	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
 	require.Equal(t, StatusRunning, claimed.Status)
@@ -324,6 +332,11 @@ func TestCreateTaskForRunnerPagination(t *testing.T) {
 	}
 	require.NoError(t, db.Insert(t.Context(), run))
 
+	disabledRun := &ActionRun{RepoID: 2, TriggerUserID: 2}
+	require.NoError(t, db.Insert(t.Context(), disabledRun))
+	disabledJob := &ActionRunJob{RunID: disabledRun.ID, RepoID: 2, Status: StatusWaiting, RunsOn: []string{"ubuntu-latest"}}
+	require.NoError(t, db.Insert(t.Context(), disabledJob))
+
 	// Five waiting jobs the runner cannot run, then one it can.
 	// With a page size of 2 the matching job only appears on the third page.
 	for i := range 5 {
@@ -362,11 +375,13 @@ func TestCreateTaskForRunnerPagination(t *testing.T) {
 	}
 	runner.GenerateAndFillToken()
 	require.NoError(t, db.Insert(t.Context(), runner))
+	require.NoError(t, db.Insert(t.Context(), &repo_model.RepoUnit{RepoID: run.RepoID, Type: unit.TypeActions}))
 
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
+	task, cancelledJobs, err := CreateTaskForRunner(t.Context(), runner)
 	require.NoError(t, err)
-	require.True(t, ok)
 	require.NotNil(t, task)
+	require.Len(t, cancelledJobs, 1)
+	assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: disabledJob.ID}).Status)
 
 	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: target.ID})
 	assert.Equal(t, StatusRunning, claimed.Status)

models/activities/notification.go

@@ -180,15 +180,14 @@ func updateIssueNotification(ctx context.Context, userID, issueID, commentID, up
 	}
 
 	// NOTICE: Only update comment id when the before notification on this issue is read, otherwise you may miss some old comments.
-	// But we need update update_by so that the notification will be reorder
-	var cols []string
+	// Always update so that updated_unix moves the notification to the top of the list
+	// Actually, it's unclear what UpdatedBy is used for, or maybe not used at all, or maybe it should just be dropped.
+	notification.UpdatedBy = updatedByID
+	cols := []string{"updated_by"}
 	if notification.Status == NotificationStatusRead {
 		notification.Status = NotificationStatusUnread
 		notification.CommentID = commentID
-		cols = []string{"status", "update_by", "comment_id"}
-	} else {
-		notification.UpdatedBy = updatedByID
-		cols = []string{"update_by"}
+		cols = append(cols, "status", "comment_id")
 	}
 
 	_, err = db.GetEngine(ctx).ID(notification.ID).Cols(cols...).Update(notification)

models/activities/notification_list.go

@@ -71,16 +71,6 @@ func (opts FindNotificationOptions) ToOrders() string {
 // receiverID > 0 just send to receiver, else send to all watcher
 // Returns the set of user IDs whose notification rows were created or updated.
 func CreateOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) ([]int64, error) {
-	var notifiedIDs []int64
-	err := db.WithTx(ctx, func(ctx context.Context) error {
-		var innerErr error
-		notifiedIDs, innerErr = createOrUpdateIssueNotifications(ctx, issueID, commentID, notificationAuthorID, receiverID)
-		return innerErr
-	})
-	return notifiedIDs, err
-}
-
-func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) ([]int64, error) {
 	// init
 	var toNotify container.Set[int64]
 	notifications, err := db.Find[Notification](ctx, FindNotificationOptions{
@@ -181,7 +171,11 @@ func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, n
 		if notificationExists(notifications, issue.ID, userID) {
 			err = updateIssueNotification(ctx, userID, issue.ID, commentID, notificationAuthorID)
 		} else {
-			err = createIssueNotification(ctx, userID, issue, commentID, notificationAuthorID)
+			if err = createIssueNotification(ctx, userID, issue, commentID, notificationAuthorID); err != nil {
+				if errUpdate := updateIssueNotification(ctx, userID, issue.ID, commentID, notificationAuthorID); errUpdate == nil {
+					err = nil
+				}
+			}
 		}
 		if err != nil {
 			return nil, err

models/activities/notification_test.go

@@ -31,6 +31,18 @@ func TestCreateOrUpdateIssueNotifications(t *testing.T) {
 
 	notf = unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{UserID: 4, IssueID: issue.ID})
 	assert.Equal(t, activities_model.NotificationStatusUnread, notf.Status)
+
+	// unread notification should get latest updated_unix when re-notified
+	_, err = db.GetEngine(t.Context()).ID(notf.ID).NoAutoTime().Cols("updated_unix").Update(&activities_model.Notification{UpdatedUnix: 123})
+	assert.NoError(t, err)
+	notf = unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{ID: notf.ID})
+	assert.EqualValues(t, 123, notf.UpdatedUnix)
+
+	_, err = activities_model.CreateOrUpdateIssueNotifications(t.Context(), issue.ID, 0, 3, 0)
+	assert.NoError(t, err)
+	notf = unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{ID: notf.ID})
+	assert.NotEqualValues(t, 123, notf.UpdatedUnix)
+	assert.EqualValues(t, 3, notf.UpdatedBy)
 }
 
 func TestCreateOrUpdateIssueNotificationsForAssigneeAndReviewer(t *testing.T) {

models/asymkey/gpg_key.go

@@ -85,7 +85,7 @@ func (opts FindGPGKeyOptions) ToConds() builder.Cond {
 		cond = cond.And(builder.Eq{"primary_key_id": ""})
 	}
 
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.KeyID != "" {

models/asymkey/ssh_key.go

@@ -224,7 +224,7 @@ func (opts FindPublicKeyOptions) ToOrders() string {
 
 func (opts FindPublicKeyOptions) ToConds() builder.Cond {
 	cond := builder.NewCond()
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.Fingerprint != "" {

models/auth/twofactor.go

@@ -12,8 +12,11 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
+	"strconv"
 
 	"gitea.dev/models/db"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/secret"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/timeutil"
@@ -48,6 +51,11 @@ func (err ErrTwoFactorNotEnrolled) Unwrap() error {
 	return util.ErrNotExist
 }
 
+const (
+	totpMaxAttempts = 5
+	totpAttemptsTTL = 15 * 60 // seconds, renewed by every failed attempt
+)
+
 // TwoFactor represents a two-factor authentication token.
 type TwoFactor struct {
 	ID               int64 `xorm:"pk autoincr"`
@@ -120,26 +128,59 @@ func (t *TwoFactor) validateTOTP(passcode string) (bool, error) {
 	return totp.Validate(passcode, secretStr), nil
 }
 
+type TwoFactorResult int
+
+const (
+	TwoFactorResultValid TwoFactorResult = iota + 1
+	TwoFactorResultInvalid
+	TwoFactorResultTooManyAttempts
+)
+
 // ValidateAndConsumeTOTP validates the passcode and atomically records it as used so that the
-// same passcode cannot be redeemed more than once (RFC 6238 §5.2). It returns false for an
-// invalid passcode as well as for a replay, including the case where a concurrent request with
-// the same passcode won the race first. All TOTP login surfaces must go through this helper.
-func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (bool, error) {
-	ok, err := t.validateTOTP(passcode)
-	if err != nil || !ok {
-		return false, err
+// same passcode cannot be redeemed more than once (RFC 6238 §5.2). Invalid passcodes and replays
+// return TwoFactorResultInvalid; exhausted attempts return TwoFactorResultTooManyAttempts.
+// All TOTP login surfaces must go through this helper.
+func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (result TwoFactorResult, err error) {
+	if passcode == "" {
+		// password-only Basic auth clients must not use up the attempts
+		return TwoFactorResultInvalid, nil
 	}
-	// Conditional update: only a row whose stored passcode differs from this one is updated, so a
-	// replay (or a concurrent duplicate) matches zero rows and is rejected. The row lock taken by
-	// the UPDATE serializes racing requests, closing the read-validate-write TOCTOU window.
-	t.LastUsedPasscode = passcode
-	n, err := db.GetEngine(ctx).ID(t.ID).
-		Where(builder.Or(builder.IsNull{"last_used_passcode"}, builder.Neq{"last_used_passcode": passcode})).
-		Cols("last_used_passcode").Update(t)
-	if err != nil {
-		return false, err
-	}
-	return n == 1, nil
+	// the lock spans check, validation and counting so that concurrent requests cannot exceed the limit
+	attemptsKey := fmt.Sprintf("twofa_attempts_%d", t.UID)
+	err = globallock.LockAndDo(ctx, attemptsKey, func(ctx context.Context) error {
+		value, _ := cache.GetCache().Get(attemptsKey)
+		attempts, _ := strconv.Atoi(value)
+		if attempts >= totpMaxAttempts {
+			result = TwoFactorResultTooManyAttempts
+			return nil
+		}
+
+		valid, err := t.validateTOTP(passcode)
+		if err != nil {
+			return err
+		}
+		if valid {
+			// Conditional update: only a row whose stored passcode differs from this one is updated, so a
+			// replay (or a concurrent duplicate) matches zero rows and is rejected. The row lock taken by
+			// the UPDATE serializes racing requests, closing the read-validate-write TOCTOU window.
+			t.LastUsedPasscode = passcode
+			n, err := db.GetEngine(ctx).ID(t.ID).
+				Where(builder.Or(builder.IsNull{"last_used_passcode"}, builder.Neq{"last_used_passcode": passcode})).
+				Cols("last_used_passcode").Update(t)
+			if err != nil {
+				return err
+			}
+			valid = n == 1
+		}
+		if !valid {
+			result = TwoFactorResultInvalid
+			return cache.GetCache().Put(attemptsKey, strconv.Itoa(attempts+1), totpAttemptsTTL)
+		}
+		cache.Remove(attemptsKey)
+		result = TwoFactorResultValid
+		return nil
+	})
+	return result, err
 }
 
 // NewTwoFactor creates a new two-factor authentication token.

models/auth/twofactor_test.go

@@ -4,11 +4,15 @@
 package auth_test
 
 import (
+	"fmt"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/unittest"
+	"gitea.dev/modules/cache"
 
 	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pquerna/otp/totp"
@@ -30,21 +34,42 @@ func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
 	require.NoError(t, err)
 
 	// first use of a valid passcode succeeds
-	ok, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
+	result, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
 	require.NoError(t, err)
-	assert.True(t, ok)
+	assert.Equal(t, auth_model.TwoFactorResultValid, result)
 
 	// replaying the same passcode is refused, even when still inside the TOTP validity window
 	reloaded, err := auth_model.GetTwoFactorByUID(t.Context(), tfa.UID)
 	require.NoError(t, err)
-	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
+	result, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
 	require.NoError(t, err)
-	assert.False(t, ok)
+	assert.Equal(t, auth_model.TwoFactorResultInvalid, result)
 
-	// an invalid passcode is rejected without consuming anything
-	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), "000000")
+	var limited atomic.Int32
+	var wg sync.WaitGroup
+	for range 10 {
+		wg.Go(func() {
+			result, err := reloaded.ValidateAndConsumeTOTP(t.Context(), "0000000")
+			assert.NoError(t, err)
+			if result == auth_model.TwoFactorResultTooManyAttempts {
+				limited.Add(1)
+			} else {
+				assert.Equal(t, auth_model.TwoFactorResultInvalid, result)
+			}
+		})
+	}
+	wg.Wait()
+	assert.EqualValues(t, 6, limited.Load())
+	nextPasscode, err := totp.GenerateCode(key.Secret(), time.Now().Add(30*time.Second))
 	require.NoError(t, err)
-	assert.False(t, ok)
+	result, err = reloaded.ValidateAndConsumeTOTP(t.Context(), nextPasscode)
+	require.NoError(t, err)
+	assert.Equal(t, auth_model.TwoFactorResultTooManyAttempts, result)
+
+	cache.Remove(fmt.Sprintf("twofa_attempts_%d", tfa.UID))
+	result, err = reloaded.ValidateAndConsumeTOTP(t.Context(), nextPasscode)
+	require.NoError(t, err)
+	assert.Equal(t, auth_model.TwoFactorResultValid, result)
 }
 
 func TestDisableTwoFactor(t *testing.T) {

models/fixtures/oauth2_grant.yml

@@ -7,7 +7,7 @@
   updated_unix: 1546869730
 
 - id: 2
-  user_id: 3
+  user_id: 14
   application_id: 1
   counter: 1
   scope: "openid"
@@ -23,7 +23,7 @@
   updated_unix: 1546869730
 
 - id: 4
-  user_id: 99
+  user_id: 2
   application_id: 2
   counter: 1
   scope: "whatever"

models/git/commit_status.go

@@ -39,7 +39,7 @@ type CommitStatus struct {
 	RepoID int64                          `xorm:"UNIQUE(repo_sha_index)"`
 	SHA    string                         `xorm:"VARCHAR(64) NOT NULL INDEX UNIQUE(repo_sha_index)"`
 	Index  int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
-	Repo   *repo_model.Repository         `xorm:"-"`
+	Repo   *repo_model.Repository         `xorm:"-" json:"-"`
 	State  commitstatus.CommitStatusState `xorm:"VARCHAR(7) NOT NULL"`
 
 	// TargetURL points to the commit status page reported by a CI system
@@ -49,7 +49,7 @@ type CommitStatus struct {
 	Description string           `xorm:"TEXT"`
 	ContextHash string           `xorm:"VARCHAR(64) index"`
 	Context     string           `xorm:"TEXT"`
-	Creator     *user_model.User `xorm:"-"`
+	Creator     *user_model.User `xorm:"-" json:"-"`
 	CreatorID   int64
 
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
@@ -182,7 +182,7 @@ func GetNextCommitStatusIndex(ctx context.Context, repoID int64, sha string) (in
 
 func (status *CommitStatus) loadRepository(ctx context.Context) (err error) {
 	if status.Repo == nil {
-		status.Repo, err = repo_model.GetRepositoryByID(ctx, status.RepoID)
+		status.Repo, err = cache.GetWithContextCache(ctx, cachegroup.Repository, status.RepoID, repo_model.GetRepositoryByID)
 		if err != nil {
 			return fmt.Errorf("getRepositoryByID [%d]: %w", status.RepoID, err)
 		}
@@ -230,11 +230,9 @@ func (status *CommitStatus) cutTargetURLGiteaActionsPrefix(ctx context.Context)
 		return "", false
 	}
 
-	if status.Repo == nil {
-		if err := status.loadRepository(ctx); err != nil {
-			log.Error("loadRepository: %v", err)
-			return "", false
-		}
+	if err := status.loadRepository(ctx); err != nil {
+		log.Error("loadRepository: %v", err)
+		return "", false
 	}
 
 	prefix := status.Repo.Link() + "/actions"
@@ -572,11 +570,12 @@ func SignCommitsApplyDoerPermission(ctx context.Context, doer *user_model.User,
 }
 
 func statusRepoCanReadActions(ctx context.Context, doer *user_model.User, status *CommitStatus) bool {
+	if err := status.loadRepository(ctx); err != nil {
+		log.Error("loadRepository: %v", err)
+		return false
+	}
 	perm, err := cache.GetWithContextCache(ctx, cachegroup.RepoUserPermission, access_model.RepoUserPermissionCacheKey(status.RepoID, doer),
-		func(ctx context.Context, _ string) (access_model.Permission, error) { // only runs on a cache miss
-			if err := status.loadRepository(ctx); err != nil {
-				return access_model.Permission{}, err
-			}
+		func(ctx context.Context, _key string) (access_model.Permission, error) {
 			return access_model.GetDoerRepoPermission(ctx, status.Repo, doer)
 		},
 	)

models/git/commit_status_test.go

@@ -13,6 +13,7 @@ import (
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
 	"gitea.dev/modules/commitstatus"
 	"gitea.dev/modules/git"
 
@@ -281,8 +282,10 @@ func TestCommitStatusesApplyDoerPermission(t *testing.T) {
 		},
 	}
 
-	git_model.CommitStatusesApplyDoerPermission(t.Context(), doer, statuses)
+	git_model.CommitStatusesApplyDoerPermission(cache.WithCacheContext(t.Context()), doer, statuses)
 	assert.Equal(t, visibleURL, statuses[0].TargetURL)
 	assert.Empty(t, statuses[1].TargetURL)
 	assert.Equal(t, "https://mycicd.org/1", statuses[2].TargetURL)
+	assert.NotNil(t, statuses[0].Repo)
+	assert.Same(t, statuses[0].Repo, statuses[2].Repo)
 }

models/issues/comment.go

@@ -34,6 +34,7 @@ import (
 	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
+	"xorm.io/xorm"
 )
 
 // ErrCommentNotExist represents a "CommentNotExist" kind of error.
@@ -369,12 +370,19 @@ func (c *Comment) LoadIssue(ctx context.Context) (err error) {
 	return err
 }
 
+var (
+	_ xorm.BeforeInsertProcessor = (*Comment)(nil)
+	_ xorm.BeforeUpdateProcessor = (*Comment)(nil)
+)
+
 // BeforeInsert will be invoked by XORM before inserting a record
 func (c *Comment) BeforeInsert() {
 	c.PatchQuoted = c.Patch
 	if !utf8.ValidString(c.Patch) {
 		c.PatchQuoted = strconv.Quote(c.Patch)
 	}
+
+	sanitizeDatabaseStringContent(&c.Content)
 }
 
 // BeforeUpdate will be invoked by XORM before updating a record
@@ -383,6 +391,8 @@ func (c *Comment) BeforeUpdate() {
 	if !utf8.ValidString(c.Patch) {
 		c.PatchQuoted = strconv.Quote(c.Patch)
 	}
+
+	sanitizeDatabaseStringContent(&c.Content)
 }
 
 // AfterLoad is invoked from XORM after setting the values of all fields of this object.
@@ -1164,6 +1174,11 @@ func UpdateComment(ctx context.Context, c *Comment, contentVersion int, doer *us
 		if affected == 0 {
 			return ErrCommentAlreadyChanged
 		}
+		if c.Type == CommentTypeReview {
+			if _, err := db.GetEngine(ctx).ID(c.ReviewID).Cols("content").NoAutoTime().Update(&Review{Content: c.Content}); err != nil { // updated_unix picks a reviewer's latest review
+				return err
+			}
+		}
 		if err := c.LoadIssue(ctx); err != nil {
 			return err
 		}

models/issues/issue.go

@@ -11,6 +11,7 @@ import (
 	"regexp"
 	"slices"
 	"strconv"
+	"strings"
 
 	"gitea.dev/models/db"
 	project_model "gitea.dev/models/project"
@@ -25,6 +26,7 @@ import (
 	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
+	"xorm.io/xorm"
 )
 
 // ErrIssueNotExist represents a "IssueNotExist" kind of error.
@@ -53,7 +55,7 @@ var ErrIssueAlreadyChanged = util.NewInvalidArgumentErrorf("the issue is already
 // Issue represents an issue or pull request of repository.
 type Issue struct {
 	ID                int64                  `xorm:"pk autoincr"`
-	RepoID            int64                  `xorm:"INDEX UNIQUE(repo_index)"`
+	RepoID            int64                  `xorm:"INDEX(repo_closed_pull) UNIQUE(repo_index)"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	Index             int64                  `xorm:"UNIQUE(repo_index)"` // Index in one repository.
 	PosterID          int64                  `xorm:"INDEX"`
@@ -75,9 +77,9 @@ type Issue struct {
 	AssigneeID        int64            `xorm:"-"`
 	Assignee          *user_model.User `xorm:"-"`
 	isAssigneeLoaded  bool             `xorm:"-"`
-	IsClosed          bool             `xorm:"INDEX"`
+	IsClosed          bool             `xorm:"INDEX(repo_closed_pull)"`
 	IsRead            bool             `xorm:"-"`
-	IsPull            bool             `xorm:"INDEX"` // Indicates whether is a pull request or not.
+	IsPull            bool             `xorm:"INDEX(repo_closed_pull)"` // Indicates whether is a pull request or not.
 	PullRequest       *PullRequest     `xorm:"-"`
 	NumComments       int
 
@@ -123,6 +125,27 @@ func init() {
 	db.RegisterModel(new(IssueIndex))
 }
 
+func sanitizeDatabaseStringContent(s *string) {
+	// postgresql doesn't like "\x00"
+	// this is only a simple workaround for issues like https://github.com/go-gitea/gitea/issues/28890 and https://github.com/go-gitea/gitea/issues/40003
+	*s = strings.ReplaceAll(*s, "\x00", " ")
+}
+
+var (
+	_ xorm.BeforeInsertProcessor = (*Issue)(nil)
+	_ xorm.BeforeUpdateProcessor = (*Issue)(nil)
+)
+
+func (issue *Issue) BeforeInsert() {
+	sanitizeDatabaseStringContent(&issue.Title)
+	sanitizeDatabaseStringContent(&issue.Content)
+}
+
+func (issue *Issue) BeforeUpdate() {
+	sanitizeDatabaseStringContent(&issue.Title)
+	sanitizeDatabaseStringContent(&issue.Content)
+}
+
 // LoadTotalTimes load total tracked time
 func (issue *Issue) LoadTotalTimes(ctx context.Context) (err error) {
 	opts := FindTrackedTimesOptions{IssueID: issue.ID}

models/issues/issue_search.go

@@ -75,11 +75,11 @@ func applySorts(sess db.Session, sortType string, priorityRepoID int64) {
 	// Since this sortType is dynamically created, it has to be treated specially.
 	if after, ok := strings.CutPrefix(sortType, ScopeSortPrefix); ok {
 		scope := after
-		sess.Join("LEFT", "issue_label", "issue.id = issue_label.issue_id")
-		// "exclusive_order=0" means "no order is set", so exclude it from the JOIN criteria and then "LEFT JOIN" result is also null
-		sess.Join("LEFT", "label", "label.id = issue_label.label_id AND label.exclusive_order <> 0 AND label.name LIKE ?", scope+"/%")
-		// Use COALESCE to make sure we sort NULL last regardless of backend DB (2147483647 == max int)
-		sess.OrderBy("COALESCE(label.exclusive_order, 2147483647) ASC").Desc("issue.id")
+		// a subquery instead of a JOIN keeps one row per issue, "exclusive_order=0" means unset and COALESCE sorts it last on every DB
+		sess.OrderBy("COALESCE((SELECT MIN(label.exclusive_order) FROM issue_label"+
+			" INNER JOIN label ON label.id = issue_label.label_id"+
+			" WHERE issue_label.issue_id = issue.id AND label.exclusive_order <> 0 AND label.name LIKE ?), 2147483647) ASC", scope+"/%").
+			Desc("issue.id")
 		return
 	}
 
@@ -218,10 +218,7 @@ func applyRepoConditions(sess db.Session, opts *IssuesOptions) {
 		opts.RepoCond = builder.In("issue.repo_id", opts.RepoIDs)
 	}
 	if opts.AllPublic {
-		if opts.RepoCond == nil {
-			opts.RepoCond = builder.NewCond()
-		}
-		opts.RepoCond = opts.RepoCond.Or(builder.In("issue.repo_id", builder.Select("id").From("repository").Where(repo_model.PublicRepoUnderPublicOwnerCond())))
+		opts.RepoCond = builder.Or(opts.RepoCond, repo_model.PublicRepoUnderPublicOwnerCond())
 	}
 	if opts.RepoCond != nil {
 		sess.And(opts.RepoCond)
@@ -402,22 +399,17 @@ func applyReviewRequestedCondition(sess db.Session, reviewRequestedID int64) {
 		From("team_user").
 		Where(builder.Eq{"team_user.uid": reviewRequestedID})
 
-	// if the review is approved or rejected, it should not be shown in the review requested list
-	maxReview := builder.Select("MAX(r.id)").
-		From("review as r").
-		Where(builder.In("r.type", []ReviewType{ReviewTypeApprove, ReviewTypeReject, ReviewTypeRequest})).
-		GroupBy("r.issue_id, r.reviewer_id, r.reviewer_team_id")
-
 	subQuery := builder.Select("review.issue_id").
 		From("review").
-		Where(builder.And(
-			builder.Eq{"review.type": ReviewTypeRequest},
-			builder.Or(
-				builder.Eq{"review.reviewer_id": reviewRequestedID},
-				builder.In("review.reviewer_team_id", existInTeamQuery),
-			),
-			builder.In("review.id", maxReview),
-		))
+		Where(builder.Eq{"review.type": ReviewTypeRequest}).
+		And(builder.Or(
+			builder.Eq{"review.reviewer_id": reviewRequestedID},
+			builder.In("review.reviewer_team_id", existInTeamQuery),
+		)).
+		// if the review is approved or rejected, it should not be shown in the review requested list
+		And(builder.NotExists(builder.Select("1").From("review as r").
+			Where(builder.Expr("r.issue_id = review.issue_id AND r.reviewer_id = review.reviewer_id AND r.reviewer_team_id = review.reviewer_team_id AND r.id > review.id").
+				And(builder.In("r.type", []ReviewType{ReviewTypeApprove, ReviewTypeReject, ReviewTypeRequest})))))
 	sess.Where("issue.poster_id <> ?", reviewRequestedID).
 		And(builder.In("issue.id", subQuery))
 }

models/issues/milestone_list.go

@@ -39,12 +39,13 @@ func (milestones MilestoneList) SplitByOpenClosed() (open, closed MilestoneList)
 // FindMilestoneOptions contain options to get milestones
 type FindMilestoneOptions struct {
 	db.ListOptions
-	RepoID   int64
-	IsClosed optional.Option[bool]
-	Name     string
-	SortType string
-	RepoCond builder.Cond
-	RepoIDs  []int64
+	RepoID    int64
+	IsClosed  optional.Option[bool]
+	Name      string
+	SortType  string
+	RepoCond  builder.Cond
+	RepoIDs   []int64
+	ProjectID int64
 }
 
 func (opts FindMilestoneOptions) ToConds() builder.Cond {
@@ -64,6 +65,11 @@ func (opts FindMilestoneOptions) ToConds() builder.Cond {
 	if len(opts.Name) != 0 {
 		cond = cond.And(db.BuildCaseInsensitiveLike("name", opts.Name))
 	}
+	if opts.ProjectID != 0 {
+		cond = cond.And(builder.In("id", builder.Select("issue.milestone_id").From("issue").
+			InnerJoin("project_issue", "project_issue.issue_id = issue.id").
+			Where(builder.Eq{"project_issue.project_id": opts.ProjectID})))
+	}
 
 	return cond
 }

models/issues/pull.go

@@ -378,7 +378,7 @@ func (pr *PullRequest) getReviewedByLines(ctx context.Context, writer io.Writer)
 	reviewersWritten := 0
 
 	for _, review := range reviews {
-		if maxReviewers > 0 && reviewersWritten > maxReviewers {
+		if maxReviewers > 0 && reviewersWritten >= maxReviewers {
 			break
 		}
 

models/issues/pull_list.go

@@ -335,8 +335,8 @@ func (prs PullRequestList) LoadReviews(ctx context.Context) (ReviewList, error)
 			"reviewer_team_id":   0,
 		}).
 		GroupBy("issue_id, reviewer_id")
-	// Get latest review of each reviewer, sorted in order they were made
-	if err := db.GetEngine(ctx).In("id", subQuery).OrderBy("review.updated_unix ASC").Find(&reviews); err != nil {
+	// Get latest review of each reviewer, sorted in order they were made. Joined because MySQL scans all reviews for "id IN (subquery)", xorm aliases the subquery "review".
+	if err := db.GetEngine(ctx).Table("review").Alias("latest").Join("INNER", subQuery, "latest.id = review.id").OrderBy("latest.updated_unix ASC").Find(&reviews); err != nil {
 		return nil, err
 	}
 
@@ -350,7 +350,7 @@ func (prs PullRequestList) LoadReviews(ctx context.Context) (ReviewList, error)
 		"reviewer_team_id": 0,
 	}).
 		GroupBy("issue_id, reviewer_team_id")
-	if err := db.GetEngine(ctx).In("id", subQueryTeam).OrderBy("review.updated_unix ASC").Find(&teamReviewRequests); err != nil {
+	if err := db.GetEngine(ctx).Table("review").Alias("latest").Join("INNER", subQueryTeam, "latest.id = review.id").OrderBy("latest.updated_unix ASC").Find(&teamReviewRequests); err != nil {
 		return nil, err
 	}
 

models/issues/pull_test.go

@@ -14,6 +14,7 @@ import (
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -403,6 +404,10 @@ func testGetApprovers(t *testing.T) {
 	approvers := pr.GetApprovers(t.Context())
 	expected := "Reviewed-by: User Five <user5@example.com>\nReviewed-by: Org Six <org6@example.com>\n"
 	assert.Equal(t, expected, approvers)
+
+	defer test.MockVariableValue(&setting.Repository.PullRequest.DefaultMergeMessageMaxApprovers, 1)()
+	approvers = pr.GetApprovers(t.Context())
+	assert.Equal(t, "Reviewed-by: User Five <user5@example.com>\n", approvers)
 }
 
 func testGetPullRequestByMergedCommit(t *testing.T) {

models/issues/review.go

@@ -285,23 +285,12 @@ func IsOfficialReviewer(ctx context.Context, issue *Issue, reviewer *user_model.
 	}
 	if rule == nil {
 		// if no rule is found, then user with write access can make official reviews
-		err := pr.LoadBaseRepo(ctx)
-		if err != nil {
+		if err := pr.LoadBaseRepo(ctx); err != nil {
 			return false, err
 		}
-		writeAccess, err := access_model.HasAccessUnit(ctx, reviewer, pr.BaseRepo, unit.TypeCode, perm.AccessModeWrite)
-		if err != nil {
-			return false, err
-		}
-		return writeAccess, nil
+		return access_model.HasAccessUnit(ctx, reviewer, pr.BaseRepo, unit.TypeCode, perm.AccessModeWrite)
 	}
-
-	official, err := git_model.IsUserOfficialReviewer(ctx, rule, reviewer)
-	if official || err != nil {
-		return official, err
-	}
-
-	return false, nil
+	return git_model.IsUserOfficialReviewer(ctx, rule, reviewer)
 }
 
 // IsOfficialReviewerTeam check if reviewer in this team can make official reviews in issue (counts towards required approvals)
@@ -313,66 +302,82 @@ func IsOfficialReviewerTeam(ctx context.Context, issue *Issue, team *organizatio
 	if err != nil {
 		return false, err
 	}
-	if pb == nil {
-		return false, nil
+	if pb != nil && pb.EnableApprovalsWhitelist {
+		return slices.Contains(pb.ApprovalsWhitelistTeamIDs, team.ID), nil
 	}
-
-	if !pb.EnableApprovalsWhitelist {
-		return team.UnitAccessMode(ctx, unit.TypeCode) >= perm.AccessModeWrite, nil
-	}
-
-	return slices.Contains(pb.ApprovalsWhitelistTeamIDs, team.ID), nil
+	return team.UnitAccessMode(ctx, unit.TypeCode) >= perm.AccessModeWrite, nil
 }
 
-// RecalculateReviewsOfficial re-evaluates the "official" flag of the latest approve
-// and reject reviews of an issue against its pull request's current base branch.
-// It must be called whenever the target branch changes, otherwise an approval that
-// was official on the previous (possibly unprotected) branch would keep satisfying
-// the new branch's protection rules.
-func RecalculateReviewsOfficial(ctx context.Context, issue *Issue) error {
-	if err := issue.LoadPullRequest(ctx); err != nil {
+// updateReviewerOfficial keeps the official flag only on the reviewer's latest approval, rejection or review request, and only if the reviewer is official
+func updateReviewerOfficial(ctx context.Context, issueID, reviewerID int64, official bool) error {
+	if _, err := db.GetEngine(ctx).Where(builder.Eq{"issue_id": issueID, "reviewer_id": reviewerID}).
+		NoAutoTime().Cols("official").Update(&Review{}); err != nil {
 		return err
 	}
+	if !official {
+		return nil
+	}
+	latest, err := GetReviewByIssueIDAndUserID(ctx, issueID, reviewerID)
+	if IsErrReviewNotExist(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	_, err = db.GetEngine(ctx).ID(latest.ID).NoAutoTime().Cols("official").Update(&Review{Official: true})
+	return err
+}
 
-	// Clearing and restoring the official flags must happen atomically, otherwise a
-	// failure in between would leave the reviews without any official flag set.
+// RecalculateReviewsOfficial re-evaluates the "official" flag of an issue's reviews and review requests
+// against its pull request's current base branch. It must be called whenever the target branch changes,
+// otherwise an approval that was official on the previous (possibly unprotected) branch would keep
+// satisfying the new branch's protection rules.
+func RecalculateReviewsOfficial(ctx context.Context, issue *Issue) error {
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		// Only the latest approve/reject review of each reviewer counts as official, so
-		// clear the flag on all of them first and restore it only where it still applies.
-		if _, err := db.GetEngine(ctx).
-			Where("issue_id = ?", issue.ID).
-			In("type", ReviewTypeApprove, ReviewTypeReject).
-			Cols("official").
-			Update(&Review{Official: false}); err != nil {
+		if _, err := db.GetEngine(ctx).Where("issue_id = ?", issue.ID).NoAutoTime().Cols("official").Update(&Review{}); err != nil {
 			return err
 		}
 
-		reviews, err := FindLatestReviews(ctx, FindReviewOptions{
-			Types:   []ReviewType{ReviewTypeApprove, ReviewTypeReject},
-			IssueID: issue.ID,
-		})
-		if err != nil {
+		reviewerIDs := make([]int64, 0, 5)
+		if err := db.GetEngine(ctx).Table("review").Cols("reviewer_id").
+			Where(builder.Eq{"issue_id": issue.ID, "original_author_id": 0}).
+			And(builder.In("type", ReviewTypeApprove, ReviewTypeReject, ReviewTypeRequest)).
+			And(builder.Neq{"reviewer_id": 0}).
+			Distinct("reviewer_id").Find(&reviewerIDs); err != nil {
 			return err
 		}
-
-		for _, review := range reviews {
-			if err := review.LoadReviewer(ctx); err != nil {
-				return err
-			}
-			if review.Reviewer == nil {
-				continue
-			}
-			official, err := IsOfficialReviewer(ctx, issue, review.Reviewer)
+		for _, reviewerID := range reviewerIDs {
+			_, reviewer, err := user_model.GetPossibleUserByID(ctx, reviewerID)
 			if err != nil {
 				return err
 			}
-			if official {
-				if _, err := db.GetEngine(ctx).ID(review.ID).Cols("official").Update(&Review{Official: true}); err != nil {
-					return err
-				}
+			official, err := IsOfficialReviewer(ctx, issue, reviewer)
+			if err != nil {
+				return err
+			}
+			if err := updateReviewerOfficial(ctx, issue.ID, reviewerID, official); err != nil {
+				return err
 			}
 		}
 
+		teamRequests := make([]*Review, 0, 5)
+		if err := db.GetEngine(ctx).Where(builder.Eq{"issue_id": issue.ID, "type": ReviewTypeRequest}).
+			And(builder.Gt{"reviewer_team_id": 0}).Find(&teamRequests); err != nil {
+			return err
+		}
+		for _, request := range teamRequests {
+			if err := request.LoadReviewerTeam(ctx); organization.IsErrTeamNotExist(err) {
+				continue
+			} else if err != nil {
+				return err
+			}
+			official, err := IsOfficialReviewerTeam(ctx, issue, request.ReviewerTeam)
+			if err != nil {
+				return err
+			}
+			if _, err := db.GetEngine(ctx).ID(request.ID).NoAutoTime().Cols("official").Update(&Review{Official: official}); err != nil {
+				return err
+			}
+		}
 		return nil
 	})
 }
@@ -474,7 +479,13 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 	defer committer.Close()
 	sess := db.GetEngine(ctx)
 
+	isApproveOrReject := reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject
 	official := false
+	if isApproveOrReject {
+		if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
+			return nil, nil, err
+		}
+	}
 
 	review, err := GetCurrentReview(ctx, doer, issue)
 	if err != nil {
@@ -486,16 +497,6 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 			return nil, nil, ContentEmptyErr{}
 		}
 
-		if reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject {
-			// Only reviewers latest review of type approve and reject shall count as "official", so existing reviews needs to be cleared
-			if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_id=?", false, issue.ID, doer.ID); err != nil {
-				return nil, nil, err
-			}
-			if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
-				return nil, nil, err
-			}
-		}
-
 		// No current review. Create a new one!
 		if review, err = CreateReview(ctx, CreateReviewOptions{
 			Type:     reviewType,
@@ -516,16 +517,6 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 			return nil, nil, ContentEmptyErr{}
 		}
 
-		if reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject {
-			// Only reviewers latest review of type approve and reject shall count as "official", so existing reviews needs to be cleared
-			if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_id=?", false, issue.ID, doer.ID); err != nil {
-				return nil, nil, err
-			}
-			if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
-				return nil, nil, err
-			}
-		}
-
 		review.Official = official
 		review.Issue = issue
 		review.Content = content
@@ -546,6 +537,16 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 		}
 	}
 
+	if isApproveOrReject {
+		if err := updateReviewerOfficial(ctx, issue.ID, doer.ID, official); err != nil {
+			return nil, nil, err
+		}
+	}
+
+	if reviewType == ReviewTypePending {
+		return review, nil, committer.Commit()
+	}
+
 	comm, err := CreateComment(ctx, &CreateCommentOptions{
 		Type:        CommentTypeReview,
 		Doer:        doer,
@@ -560,7 +561,7 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 	}
 
 	// try to remove team review request if need
-	if issue.Repo.Owner.IsOrganization() && (reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject) {
+	if issue.Repo.Owner.IsOrganization() && isApproveOrReject {
 		teamReviewRequests := make([]*Review, 0, 10)
 		if err := sess.SQL("SELECT * FROM review WHERE issue_id = ? AND reviewer_team_id > 0 AND type = ?", issue.ID, ReviewTypeRequest).Find(&teamReviewRequests); err != nil {
 			return nil, nil, err
@@ -698,8 +699,6 @@ func InsertReviews(ctx context.Context, reviews []*Review) error {
 // AddReviewRequest add a review request from one reviewer
 func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_model.User, isCodeOwners bool) (*Comment, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Comment, error) {
-		sess := db.GetEngine(ctx)
-
 		review, err := GetReviewByIssueIDAndUserID(ctx, issue.ID, reviewer.ID)
 		if err != nil && !IsErrReviewNotExist(err) {
 			return nil, err
@@ -725,15 +724,9 @@ func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_mo
 			}
 		}
 
-		// if the reviewer is an official reviewer,
-		// remove the official flag in the all previous reviews
 		official, err := IsOfficialReviewer(ctx, issue, reviewer)
 		if err != nil {
 			return nil, err
-		} else if official {
-			if _, err := sess.Exec("UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_id=?", false, issue.ID, reviewer.ID); err != nil {
-				return nil, err
-			}
 		}
 
 		review, err = CreateReview(ctx, CreateReviewOptions{
@@ -747,6 +740,10 @@ func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_mo
 			return nil, err
 		}
 
+		if err := updateReviewerOfficial(ctx, issue.ID, reviewer.ID, official); err != nil {
+			return nil, err
+		}
+
 		comment, err := CreateComment(ctx, &CreateCommentOptions{
 			Type:            CommentTypeReviewRequest,
 			Doer:            doer,
@@ -787,10 +784,9 @@ func RemoveReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user
 		official, err := IsOfficialReviewer(ctx, issue, reviewer)
 		if err != nil {
 			return nil, err
-		} else if official {
-			if err := restoreLatestOfficialReview(ctx, issue.ID, reviewer.ID); err != nil {
-				return nil, err
-			}
+		}
+		if err := updateReviewerOfficial(ctx, issue.ID, reviewer.ID, official); err != nil {
+			return nil, err
 		}
 
 		return CreateComment(ctx, &CreateCommentOptions{
@@ -804,22 +800,6 @@ func RemoveReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user
 	})
 }
 
-// Recalculate the latest official review for reviewer
-func restoreLatestOfficialReview(ctx context.Context, issueID, reviewerID int64) error {
-	review, err := GetReviewByIssueIDAndUserID(ctx, issueID, reviewerID)
-	if err != nil && !IsErrReviewNotExist(err) {
-		return err
-	}
-
-	if review != nil {
-		if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE id=?", true, review.ID); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
 // AddTeamReviewRequest add a review request from one team
 func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organization.Team, doer *user_model.User, isCodeOwners bool) (*Comment, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Comment, error) {
@@ -836,10 +816,6 @@ func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organizat
 		official, err := IsOfficialReviewerTeam(ctx, issue, reviewer)
 		if err != nil {
 			return nil, fmt.Errorf("isOfficialReviewerTeam(): %w", err)
-		} else if !official {
-			if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
-				return nil, fmt.Errorf("isOfficialReviewer(): %w", err)
-			}
 		}
 
 		if review, err = CreateReview(ctx, CreateReviewOptions{
@@ -852,12 +828,6 @@ func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organizat
 			return nil, err
 		}
 
-		if official {
-			if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_team_id=?", false, issue.ID, reviewer.ID); err != nil {
-				return nil, err
-			}
-		}
-
 		comment, err := CreateComment(ctx, &CreateCommentOptions{
 			Type:            CommentTypeReviewRequest,
 			Doer:            doer,
@@ -892,25 +862,6 @@ func RemoveTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organi
 			return nil, err
 		}
 
-		official, err := IsOfficialReviewerTeam(ctx, issue, reviewer)
-		if err != nil {
-			return nil, fmt.Errorf("isOfficialReviewerTeam(): %w", err)
-		}
-
-		if official {
-			// recalculate which is the latest official review from that team
-			review, err := GetReviewByIssueIDAndUserID(ctx, issue.ID, -reviewer.ID)
-			if err != nil && !IsErrReviewNotExist(err) {
-				return nil, err
-			}
-
-			if review != nil {
-				if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE id=?", true, review.ID); err != nil {
-					return nil, err
-				}
-			}
-		}
-
 		if doer == nil {
 			return nil, nil
 		}
@@ -1037,10 +988,8 @@ func DeleteReview(ctx context.Context, r *Review) error {
 			return err
 		}
 
-		if r.Official {
-			if err := restoreLatestOfficialReview(ctx, r.IssueID, r.ReviewerID); err != nil {
-				return err
-			}
+		if r.Official && r.OriginalAuthorID == 0 {
+			return updateReviewerOfficial(ctx, r.IssueID, r.ReviewerID, true)
 		}
 		return nil
 	})

models/issues/review_test.go

@@ -9,6 +9,7 @@ import (
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
 	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
@@ -440,3 +441,17 @@ func TestRecalculateReviewsOfficial(t *testing.T) {
 	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
 	assert.True(t, review.Official)
 }
+
+func TestTeamReviewRequestOfficial(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 12})
+	assert.NoError(t, issue.LoadRepo(t.Context()))
+	comment, err := issues_model.AddTeamReviewRequest(t.Context(), issue, unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2}), &user_model.User{ID: 2}, false)
+	assert.NoError(t, err)
+	assert.True(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: comment.ReviewID}).Official)
+
+	assert.NoError(t, db.Insert(t.Context(), &git_model.ProtectedBranch{RepoID: issue.RepoID, RuleName: "master", EnableApprovalsWhitelist: true}))
+	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
+	assert.False(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: comment.ReviewID}).Official)
+}

models/organization/org_list.go

@@ -70,7 +70,7 @@ func queryUserOrgIDs(userID int64, includePrivate bool) *builder.Builder {
 
 func (opts FindOrgOptions) ToConds() builder.Cond {
 	var cond builder.Cond = builder.Eq{"`user`.`type`": user_model.UserTypeOrganization}
-	if opts.UserID > 0 {
+	if opts.UserID != 0 {
 		cond = cond.And(builder.In("`user`.`id`", queryUserOrgIDs(opts.UserID, opts.IncludeVisibility == structs.VisibleTypePrivate)))
 	}
 	// public=0, limited=1, private=2

models/organization/team_repo.go

@@ -13,12 +13,12 @@ import (
 	"xorm.io/builder"
 )
 
-// TeamRepo represents an team-repository relation.
+// TeamRepo represents an org-team-repository relation.
 type TeamRepo struct {
 	ID     int64 `xorm:"pk autoincr"`
 	OrgID  int64 `xorm:"INDEX"`
 	TeamID int64 `xorm:"UNIQUE(s)"`
-	RepoID int64 `xorm:"UNIQUE(s)"`
+	RepoID int64 `xorm:"UNIQUE(s) INDEX"`
 }
 
 // HasTeamRepo returns true if given repository belongs to team.

models/organization/team_user.go

@@ -12,12 +12,12 @@ import (
 	"xorm.io/builder"
 )
 
-// TeamUser represents an team-user relation.
+// TeamUser represents a team-user relation.
 type TeamUser struct {
 	ID     int64 `xorm:"pk autoincr"`
 	OrgID  int64 `xorm:"INDEX"`
 	TeamID int64 `xorm:"UNIQUE(s)"`
-	UID    int64 `xorm:"UNIQUE(s)"`
+	UID    int64 `xorm:"UNIQUE(s) INDEX"`
 }
 
 // IsTeamMember returns true if given user is a member of team.

models/packages/package_blob.go

@@ -122,8 +122,8 @@ func GetTotalUnreferencedBlobSize(ctx context.Context) (int64, error) {
 }
 
 // IsBlobAccessibleForUser tests if the user has access to the blob
-func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model.User) (bool, error) {
-	if user.IsAdmin {
+func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model.User, publicOnly bool) (bool, error) {
+	if user.IsAdmin && !publicOnly {
 		return true, nil
 	}
 	ownerVisibilities := []structs.VisibleType{structs.VisibleTypePublic}
@@ -153,6 +153,9 @@ func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model
 			Or(builder.Eq{"`user`.type": user_model.UserTypeOrganization}.
 				And(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamAuthorize}.Or(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamUnitAccessMode}))),
 	)
+	if publicOnly {
+		cond = cond.And(builder.Eq{"`user`.visibility": structs.VisibleTypePublic})
+	}
 
 	return db.GetEngine(ctx).
 		Table("package_blob").

models/packages/package_blob_test.go

@@ -64,11 +64,15 @@ func TestIsBlobAccessibleForRestrictedUser(t *testing.T) {
 	_, err = TryInsertFile(t.Context(), &PackageFile{VersionID: version.ID, BlobID: blob.ID, Name: "blob", LowerName: "blob"})
 	require.NoError(t, err)
 
-	accessible, err := IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}))
+	accessible, err := IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}), false)
 	require.NoError(t, err)
 	assert.True(t, accessible)
 
-	accessible, err = IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 29}))
+	accessible, err = IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 29}), false)
+	require.NoError(t, err)
+	assert.False(t, accessible)
+
+	accessible, err = IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}), true)
 	require.NoError(t, err)
 	assert.False(t, accessible)
 }

models/packages/package_property.go

@@ -30,9 +30,9 @@ const (
 // PackageProperty represents a property of a package, version or file
 type PackageProperty struct {
 	ID      int64        `xorm:"pk autoincr"`
-	RefType PropertyType `xorm:"INDEX NOT NULL"`
-	RefID   int64        `xorm:"INDEX NOT NULL"`
-	Name    string       `xorm:"INDEX NOT NULL"`
+	RefType PropertyType `xorm:"NOT NULL"`
+	RefID   int64        `xorm:"INDEX(ref_id_name) NOT NULL"`
+	Name    string       `xorm:"INDEX(ref_id_name) NOT NULL"`
 	Value   string       `xorm:"LONGTEXT NOT NULL"`
 }
 

models/perm/access/access.go

@@ -25,7 +25,7 @@ import (
 type Access struct {
 	ID     int64 `xorm:"pk autoincr"`
 	UserID int64 `xorm:"UNIQUE(s)"`
-	RepoID int64 `xorm:"UNIQUE(s)"`
+	RepoID int64 `xorm:"UNIQUE(s) INDEX"`
 	Mode   perm.AccessMode
 }
 

models/perm/access/repo_permission.go

@@ -506,13 +506,16 @@ func GetIndividualUserRepoPermission(ctx context.Context, repo *repo_model.Repos
 		}
 	}
 
-	// if user in an owner team
+	// Apply repository-level access from teams.
 	for _, team := range perm.orgRepoTeams {
 		if team.IsOwnerTeam() || team.AccessMode == perm_model.AccessModeOwner {
 			perm.AccessMode = perm_model.AccessModeOwner
 			perm.unitsMode = nil
 			return perm, nil
 		}
+		if team.AccessMode == perm_model.AccessModeAdmin {
+			perm.AccessMode = max(perm.AccessMode, perm_model.AccessModeAdmin)
+		}
 	}
 
 	for _, u := range repo.Units {

models/perm/access/repo_permission_test.go

@@ -236,6 +236,32 @@ func testGetIndividualUserRepoPermission(t *testing.T) {
 		require.Empty(t, users)
 	})
 
+	t.Run("DoerWithAdminTeamWithoutAccessRow", func(t *testing.T) {
+		_, err := db.GetEngine(ctx).ID(team.ID).Cols("authorize").Update(&organization.Team{AccessMode: perm_model.AccessModeAdmin})
+		require.NoError(t, err)
+		defer func() {
+			_, err := db.GetEngine(ctx).ID(team.ID).Cols("authorize").Update(&organization.Team{AccessMode: perm_model.AccessModeNone})
+			require.NoError(t, err)
+		}()
+
+		for _, repo := range []*repo_model.Repository{repo3, repo32} {
+			perm, err := GetIndividualUserRepoPermission(ctx, repo, user)
+			require.NoError(t, err)
+			assert.Equal(t, perm_model.AccessModeAdmin, perm.AccessMode)
+			assert.True(t, perm.IsAdmin())
+			assert.False(t, perm.IsOwner())
+			for _, repoUnit := range repo.Units {
+				assert.Equal(t, perm_model.AccessModeAdmin, perm.UnitAccessMode(repoUnit.Type))
+			}
+		}
+
+		unrelatedRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 5})
+		require.Equal(t, org.ID, unrelatedRepo.OwnerID)
+		perm, err := GetIndividualUserRepoPermission(ctx, unrelatedRepo, user)
+		require.NoError(t, err)
+		assert.False(t, perm.IsAdmin())
+	})
+
 	require.NoError(t, db.Insert(ctx, repo_model.Collaboration{RepoID: repo3.ID, UserID: user.ID, Mode: perm_model.AccessModeWrite}))
 	require.NoError(t, db.Insert(ctx, Access{RepoID: repo3.ID, UserID: user.ID, Mode: perm_model.AccessModeWrite}))
 	t.Run("DoerWithReadIssueTeamAndWriteCollaboratorOnPrivateRepo", func(t *testing.T) {

models/project/project.go

@@ -225,7 +225,7 @@ func (opts SearchOptions) ToConds() builder.Cond {
 	if opts.Type > 0 {
 		cond = cond.And(builder.Eq{"type": opts.Type})
 	}
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 

models/repo/attachment.go

@@ -42,6 +42,10 @@ func init() {
 	db.RegisterModel(new(Attachment))
 }
 
+func (a *Attachment) IsLinked() bool {
+	return a.IssueID > 0 || a.ReleaseID > 0 || a.CommentID > 0
+}
+
 // IncreaseDownloadCount is update download count + 1
 func (a *Attachment) IncreaseDownloadCount(ctx context.Context) error {
 	// Update download count.

models/repo/language_stats.go

@@ -151,7 +151,7 @@ func UpdateLanguageStats(ctx context.Context, repo *Repository, commitID string,
 		var topLang string
 		var s int64
 		for lang, size := range stats {
-			if size > s {
+			if size > s || (size == s && lang < topLang) {
 				s = size
 				topLang = lang
 			}

models/repo/language_stats_test.go

@@ -0,0 +1,28 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package repo_test
+
+import (
+	"testing"
+
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateLanguageStatsPrimaryTie(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+
+	require.NoError(t, repo_model.UpdateLanguageStats(t.Context(), repo, "1234567890", map[string]int64{"Go": 10, "C": 10}))
+
+	stats, err := repo_model.GetLanguageStats(t.Context(), repo)
+	require.NoError(t, err)
+	require.Len(t, stats, 2)
+	for _, stat := range stats {
+		assert.Equal(t, stat.Language == "C", stat.IsPrimary, stat.Language)
+	}
+}

models/repo/repo.go

@@ -494,10 +494,9 @@ func (repo *Repository) composeCommonMetas(ctx context.Context) map[string]strin
 		repo.MustOwner(ctx)
 		if repo.Owner.IsOrganization() {
 			teams := make([]string, 0, 5)
-			_ = db.GetEngine(ctx).Table("team_repo").
+			_ = db.GetEngine(ctx).Select("team.lower_name").Table("team_repo").
 				Join("INNER", "team", "team.id = team_repo.team_id").
 				Where("team_repo.repo_id = ?", repo.ID).
-				Select("team.lower_name").
 				OrderBy("team.lower_name").
 				Find(&teams)
 			metas["teams"] = "," + strings.Join(teams, ",") + ","

models/repo/repo_list.go

@@ -373,8 +373,7 @@ func SearchRepositoryCondition(opts SearchRepoOptions) builder.Cond {
 	cond := builder.NewCond()
 
 	if opts.Private {
-		if opts.Actor != nil && !opts.Actor.IsAdmin && opts.Actor.ID != opts.OwnerID {
-			// OK we're in the context of a User
+		if opts.Actor != nil && !opts.Actor.IsAdmin {
 			cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
 		}
 	} else {
@@ -762,7 +761,8 @@ func FindUserCodeAccessibleOwnerRepoIDs(ctx context.Context, ownerID int64, user
 func PublicRepoUnderPublicOwnerCond() builder.Cond {
 	return builder.And(
 		builder.Eq{"`repository`.is_private": false},
-		builder.In("`repository`.owner_id", builder.Select("id").From("`user`").Where(builder.Eq{"visibility": structs.VisibleTypePublic})),
+		builder.Exists(builder.Select("1").From("`user` repo_owner").
+			Where(builder.Expr("repo_owner.id = `repository`.owner_id").And(builder.Eq{"repo_owner.visibility": structs.VisibleTypePublic}))),
 	)
 }
 

models/repo/update.go

@@ -77,7 +77,7 @@ func IsErrRepoAlreadyExist(err error) bool {
 }
 
 func (err ErrRepoAlreadyExist) Error() string {
-	return fmt.Sprintf("repository already exists [uname: %s, name: %s]", err.Uname, err.Name)
+	return fmt.Sprintf("repository already exists [owner: %s, repo: %s]", err.Uname, err.Name)
 }
 
 func (err ErrRepoAlreadyExist) Unwrap() error {

models/repo/watch.go

@@ -39,7 +39,7 @@ const (
 type Watch struct {
 	ID          int64              `xorm:"pk autoincr"`
 	UserID      int64              `xorm:"UNIQUE(watch)"`
-	RepoID      int64              `xorm:"UNIQUE(watch)"`
+	RepoID      int64              `xorm:"UNIQUE(watch) INDEX"`
 	Mode        WatchMode          `xorm:"SMALLINT NOT NULL DEFAULT 1"`
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
@@ -112,6 +112,9 @@ func IsWatchingRepo(ctx context.Context, userID, repoID int64) bool {
 }
 
 func watchRepoByMode(ctx context.Context, watch *Watch, mode WatchMode) (err error) {
+	if watch.UserID <= 0 {
+		return nil
+	}
 	if watch.Mode == mode {
 		return nil
 	}

models/repo/watch_test.go

@@ -34,7 +34,7 @@ func TestGetWatchers(t *testing.T) {
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 	watches, err := repo_model.GetWatchers(t.Context(), repo.ID)
 	assert.NoError(t, err)
-	// One watchers are inactive, thus minus 1
+	// One watcher is inactive, thus minus 1
 	assert.Len(t, watches, repo.NumWatches-1)
 	for _, watch := range watches {
 		assert.Equal(t, repo.ID, watch.RepoID)
@@ -90,24 +90,30 @@ func TestWatchIfAuto(t *testing.T) {
 
 	setting.Service.AutoWatchOnChanges = true
 
-	// Must not add watch
+	// Must not add watch (user 8 has "don't watch" set)
 	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), 8, 1, true))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
-	// Should not add watch
+	// Should not add watch (read operation)
 	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), 12, 1, false))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
-	// Should add watch
+	// Should add watch (write operation)
 	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), 12, 1, true))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount+1)
 
+	// Should not add watch (system user should not be able to watch)
+	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), user_model.ActionsUserID, 1, true))
+	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
+	assert.NoError(t, err)
+	assert.Len(t, watchers, prevCount+1)
+
 	// Should remove watch, inhibit from adding auto
 	assert.NoError(t, repo_model.WatchRepoAuto(t.Context(), user12, repo, false))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})

models/unittest/mock_http.go

@@ -12,6 +12,7 @@ import (
 	"net/url"
 	"os"
 	"slices"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -103,6 +104,10 @@ func NewMockWebServer(t *testing.T, liveServerBaseURL, testDataDir string, liveM
 			require.NoError(t, err, "creating fixture %s", fixturePath)
 			defer out.Close()
 
+			if resp.StatusCode != http.StatusOK {
+				_, err = fmt.Fprintf(out, "HTTP/1.1 %d %s\n", resp.StatusCode, http.StatusText(resp.StatusCode))
+				require.NoError(t, err, "writing fixture header for %s", liveURL)
+			}
 			for _, name := range slices.Sorted(maps.Keys(resp.Header)) {
 				if slices.Contains(ignoredHeaders, strings.ToLower(name)) {
 					continue
@@ -125,14 +130,21 @@ func NewMockWebServer(t *testing.T, liveServerBaseURL, testDataDir string, liveM
 
 		replayed := strings.ReplaceAll(string(raw), liveServerBaseURL, mockURL)
 		headers, body, _ := strings.Cut(replayed, "\n\n")
+		code := http.StatusOK
 		for line := range strings.SplitSeq(headers, "\n") {
+			if strings.HasPrefix(line, "HTTP/") {
+				parts := strings.SplitN(line, " ", 3)
+				require.Len(t, parts, 3)
+				code, _ = strconv.Atoi(parts[1])
+				continue
+			}
 			name, value, ok := strings.Cut(line, ": ")
 			if !ok || strings.EqualFold(name, "Content-Length") {
 				continue
 			}
 			w.Header().Set(name, value)
 		}
-		w.WriteHeader(http.StatusOK)
+		w.WriteHeader(code)
 		_, err = w.Write([]byte(body))
 		require.NoError(t, err)
 	})

models/user/follow.go

@@ -8,6 +8,7 @@ import (
 
 	"gitea.dev/models/db"
 	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -32,6 +33,9 @@ func IsFollowing(ctx context.Context, userID, followID int64) bool {
 
 // FollowUser marks someone be another's follower.
 func FollowUser(ctx context.Context, user, follow *User) (err error) {
+	if !follow.IsFollowable() {
+		return util.NewInvalidArgumentErrorf("user %d can not be followed", follow.ID)
+	}
 	if user.ID == follow.ID || IsFollowing(ctx, user.ID, follow.ID) {
 		return nil
 	}

models/user/user.go

@@ -68,13 +68,20 @@ const (
 	UserTypeRemoteUser // 5
 )
 
+// AdminListedUserTypes HINT: USER-TYPE-GLOSSARY: administrators list every user type except organizations
+var AdminListedUserTypes = []UserType{UserTypeIndividual, UserTypeUserReserved, UserTypeBot, UserTypeRemoteUser}
+
 // DisplayName returns the English name of the user type for logs and the CLI, the UI translates "concept_user_*" instead
 func (t UserType) DisplayName() string {
 	switch t {
 	case UserTypeOrganization, UserTypeOrganizationReserved:
 		return "Organization"
+	case UserTypeUserReserved:
+		return "Reserved"
 	case UserTypeBot:
 		return "Bot"
+	case UserTypeRemoteUser:
+		return "Remote"
 	default:
 		return "User"
 	}
@@ -250,10 +257,10 @@ func (u *User) GetEmail() string {
 	return u.Email
 }
 
-// GetAllUsers returns a slice of all individual users found in DB.
-func GetAllUsers(ctx context.Context) ([]*User, error) {
-	users := make([]*User, 0)
-	return users, db.GetEngine(ctx).OrderBy("id").Where("type = ?", UserTypeIndividual).Find(&users)
+// GetAllUsersForAdminListing returns a slice of all users of AdminListedUserTypes found in DB.
+func GetAllUsersForAdminListing(ctx context.Context) (users []*User, err error) {
+	err = db.GetEngine(ctx).OrderBy("id").In("type", AdminListedUserTypes).Find(&users)
+	return users, err
 }
 
 // IsLocal returns true if user login type is LoginPlain.
@@ -440,6 +447,18 @@ func (u *User) IsIndividual() bool {
 	return u.ID > 0 && u.Type == UserTypeIndividual
 }
 
+// IsFollowable returns whether other users can follow this user (individuals, bots and organizations)
+func (u *User) IsFollowable() bool {
+	if u.ID <= 0 {
+		return false
+	}
+	switch u.Type {
+	case UserTypeIndividual, UserTypeBot, UserTypeOrganization:
+		return true
+	}
+	return false
+}
+
 // IsTypeBot returns whether the user is of type bot
 func (u *User) IsTypeBot() bool {
 	return u.Type == UserTypeBot
@@ -1048,7 +1067,7 @@ func GetUserByIDs(ctx context.Context, ids []int64) ([]*User, error) {
 	return users, err
 }
 
-// Glossaries for XxxUser:
+// HINT: USER-TYPE-GLOSSARY: Glossaries for XxxUser:
 // * Possible: The user may or may not exist in the database, but we can still return a valid user object (e.g. Ghost user) for the given ID.
 // * Individual: The user is a real person, not an organization or a bot.
 // * Doer: The user is the one performing an action

modules/actions/commit_status_info.go

@@ -11,7 +11,6 @@ import (
 	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
-	repo_model "gitea.dev/models/repo"
 	"gitea.dev/modules/log"
 )
 
@@ -36,19 +35,11 @@ func GetCommitActionsStatusMap(ctx context.Context, statuses []*git_model.Commit
 		return nil
 	}
 	statusByJobID := make(map[int64]*git_model.CommitStatus)
-	repoByID := make(map[int64]*repo_model.Repository)
 	for _, status := range statuses {
 		if status == nil || status.TargetURL == "" {
 			continue
 		}
-		if status.Repo == nil {
-			status.Repo = repoByID[status.RepoID]
-		}
-		// ParseGiteaActionsTargetURL lazy-loads status.Repo on miss; cache the
-		// outcome so later entries with the same RepoID skip that load.
-		_, jobID, ok := status.ParseGiteaActionsTargetURL(ctx)
-		repoByID[status.RepoID] = status.Repo
-		if ok {
+		if _, jobID, ok := status.ParseGiteaActionsTargetURL(ctx); ok {
 			statusByJobID[jobID] = status
 		}
 	}

modules/cachegroup/cachegroup.go

@@ -8,5 +8,6 @@ const (
 	EmailAvatarLink    = "email_avatar_link"
 	UserEmailAddresses = "user_email_addresses"
 	GPGKeyWithSubKeys  = "gpg_key_with_subkeys"
+	Repository         = "repository"
 	RepoUserPermission = "repo_user_permission"
 )

modules/charset/charset.go

@@ -52,7 +52,7 @@ func Lookup(label string) (e encoding.Encoding, name string) {
 
 type ConvertOpts struct {
 	KeepBOM           bool
-	ErrorReplacement  []byte
+	ErrorReplacement  []byte // leave it empty to remove the invalid bytes
 	ErrorReturnOrigin bool
 }
 
@@ -99,7 +99,12 @@ func ToUTF8DropErrors(content []byte) []byte {
 func ToUTF8(content []byte, opts ConvertOpts) []byte {
 	charsetLabel, _ := DetectEncoding(content)
 	if charsetLabel == "UTF-8" {
-		return maybeRemoveBOM(content, opts)
+		// even if the detected charset is UTF-8, the content may contain invalid UTF-8 sequences, so need to convert it to valid UTF-8
+		content = maybeRemoveBOM(content, opts)
+		if opts.ErrorReturnOrigin {
+			return content
+		}
+		return bytes.ToValidUTF8(content, opts.ErrorReplacement)
 	}
 
 	encoding, _ := Lookup(charsetLabel)
@@ -123,11 +128,7 @@ func ToUTF8(content []byte, opts ConvertOpts) []byte {
 		if opts.ErrorReturnOrigin {
 			return content
 		}
-		if opts.ErrorReplacement == nil {
-			decoded = append(decoded, content[idx+n])
-		} else {
-			decoded = append(decoded, opts.ErrorReplacement...)
-		}
+		decoded = append(decoded, opts.ErrorReplacement...)
 		idx += n + 1
 	}
 	return maybeRemoveBOM(decoded, opts)

modules/charset/charset_test.go

@@ -171,6 +171,8 @@ func TestToUTF8DropErrors(t *testing.T) {
 
 	res = ToUTF8DropErrors([]byte{0x00, 0x00, 0x00, 0x00})
 	assert.Equal(t, []byte{0x00, 0x00, 0x00, 0x00}, res)
+
+	assert.Equal(t, "caf ", string(ToUTF8DropErrors([]byte("caf\xe9"))))
 }
 
 func TestDetectEncoding(t *testing.T) {

modules/charset/escape_stream.go

@@ -55,11 +55,9 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 		es.allowed = opts[0].Allowed
 	}
 
-	readCount := 0
-	lastIsTag := false
+	isContentBegin := true
 	for {
 		parts, partInTag, err := es.readRunes()
-		readCount++
 		if err == io.EOF {
 			return es.escaped, nil
 		} else if err != nil {
@@ -67,17 +65,14 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 		}
 		for i, part := range parts {
 			if partInTag[i] {
-				lastIsTag = true
+				isContentBegin = true
 				es.trackHtmlTag(part)
 				if _, err := out.Write(part); err != nil {
 					return nil, err
 				}
 			} else {
-				// if last part is tag, then this part is content begin
-				// if the content is the first part of the first read, then it's also content begin
-				isContentBegin := lastIsTag || (readCount == 1 && i == 0)
-				lastIsTag = false
 				if isContentBegin {
+					isContentBegin = false
 					if part, err = es.trimAndWriteBom(part); err != nil {
 						return nil, err
 					}
@@ -236,18 +231,23 @@ func (e *htmlChunkReader) readRunes() (parts [][]byte, partInTag []bool, _ error
 		copy(curPart, e.readBuf[pos:curPartEnd])
 		// now we get the curPart bytes, but we can't directly use it, the last rune in it might have been cut
 		// try to decode the last rune, if it's invalid, then we cut the last byte and try again until we get a valid rune or no byte left
-		for i := curPartLen - 1; i >= 0; i-- {
-			last, lastSize := utf8.DecodeRune(curPart[i:])
-			if last == utf8.RuneError && lastSize == 1 {
-				curPartLen--
-			} else {
-				curPartLen += lastSize - 1
-				break
+		if e.readErr == nil && curPartEnd == len(e.readBuf) {
+			for i := curPartLen - 1; i >= 0; i-- {
+				last, lastSize := utf8.DecodeRune(curPart[i:])
+				if last == utf8.RuneError && lastSize == 1 {
+					curPartLen--
+				} else {
+					curPartLen += lastSize - 1
+					break
+				}
 			}
 		}
 		if curPartLen == 0 {
+			if !utf8.FullRune(curPart) && len(curPart) <= cap(e.readBuf)*3/4 {
+				break // keep a rune cut by the read boundary for the next read
+			}
 			// actually it's impossible that the part doesn't contain any valid rune,
-			// the only case is that the cap(readBuf) is too small, or the origin contain indeed doesn't contain any valid rune
+			// the only case is that the cap(readBuf) is too small, or the origin content indeed doesn't contain any valid rune
 			// * try to leave the last 4 bytes (possible longest utf-8 encoding) to next round
 			// * at least consume 1 byte to avoid infinite loop
 			curPartLen = max(len(curPart)-utf8.UTFMax, 1)

modules/charset/escape_test.go

@@ -6,6 +6,7 @@ package charset
 import (
 	"strings"
 	"testing"
+	"testing/iotest"
 
 	"gitea.dev/modules/htmlutil"
 	"gitea.dev/modules/setting"
@@ -160,6 +161,11 @@ func TestEscapeControlReader(t *testing.T) {
 			assert.Equal(t, tt.result, outStr)
 		})
 	}
+
+	output := &htmlutil.HTMLBuilder{}
+	_, err := EscapeControlReader(iotest.OneByteReader(strings.NewReader("\xef\xbb\xbftest")), output, &translation.MockLocale{})
+	assert.NoError(t, err)
+	assert.Equal(t, "\xef\xbb\xbftest", output.String())
 }
 
 func TestTrackHtmlTag(t *testing.T) {
@@ -234,4 +240,11 @@ func TestHTMLChunkReader(t *testing.T) {
 	testReadChunks(t, 5, input, []textPart{{"<Aé", true}, {"啊", true}, {"🌞>", true}, {"Aé", false}, {"啊", false}, {"🌞", false}})
 	testReadChunks(t, 6, input, []textPart{{"<Aé", true}, {"啊", true}, {"🌞>", true}, {"A", false}, {"é啊", false}, {"🌞", false}})
 	testReadChunks(t, 7, input, []textPart{{"<Aé啊", true}, {"🌞>", true}, {"A", false}, {"é啊", false}, {"🌞", false}})
+
+	for chunkSize := 6; chunkSize < 5+len(rune4); chunkSize++ {
+		testReadChunks(t, chunkSize, "<abc>"+rune4, []textPart{{"<abc>", true}, {rune4, false}})
+	}
+	testReadChunks(t, 6, "<abc>"+rune3[:2], []textPart{{"<abc>", true}, {rune3[:2], false}})
+	testReadChunks(t, 7, "<abc>"+rune3[:2]+"<b>", []textPart{{"<abc>", true}, {rune3[:2], false}, {"<b>", true}})
+	testReadChunks(t, 1, rune2, []textPart{{rune2[:1], false}, {rune2[1:], false}})
 }

modules/git/diff.go

@@ -5,6 +5,7 @@ package git
 
 import (
 	"bufio"
+	"cmp"
 	"context"
 	"fmt"
 	"io"
@@ -200,22 +201,18 @@ func CutDiffAroundLine(originalDiff io.Reader, line int64, old bool, numbersOfLi
 			}
 			if old {
 				begin, _ = strconv.ParseInt(groups["beginOld"], 10, 64)
-				end, _ = strconv.ParseInt(groups["endOld"], 10, 64)
+				end, _ = strconv.ParseInt(cmp.Or(groups["endOld"], "1"), 10, 64)
 				// init otherLine with begin of opposite side
 				otherLine, _ = strconv.ParseInt(groups["beginNew"], 10, 64)
 			} else {
 				begin, _ = strconv.ParseInt(groups["beginNew"], 10, 64)
-				if groups["endNew"] != "" {
-					end, _ = strconv.ParseInt(groups["endNew"], 10, 64)
-				} else {
-					end = 0
-				}
+				end, _ = strconv.ParseInt(cmp.Or(groups["endNew"], "1"), 10, 64)
 				// init otherLine with begin of opposite side
 				otherLine, _ = strconv.ParseInt(groups["beginOld"], 10, 64)
 			}
 			end += begin // end is for real only the number of lines in hunk
 			// lof is between begin and end
-			if begin <= line && end >= line {
+			if begin <= line && line < end {
 				hunk = append(hunk, lof)
 				currentLine = begin
 				continue
@@ -265,27 +262,26 @@ func CutDiffAroundLine(originalDiff io.Reader, line int64, old bool, numbersOfLi
 		oldBegin = otherLine
 		newBegin = currentLine
 	}
-	// headers + hunk header
-	newHunk := make([]string, headerLines)
-	// transfer existing headers
-	copy(newHunk, hunk[:headerLines])
-	// transfer last n lines
-	newHunk = append(newHunk, hunk[len(hunk)-numbersOfLine-1:]...)
 	// calculate newBegin, ... by counting lines
-	for i := len(hunk) - 1; i >= len(hunk)-numbersOfLine; i-- {
-		switch hunk[i][0] {
+	start := len(hunk)
+	for count := 0; count < numbersOfLine && start > headerLines+1; {
+		start--
+		switch hunk[start][0] {
 		case '+':
 			newBegin--
 			newNumOfLines++
 		case '-':
 			oldBegin--
 			oldNumOfLines++
+		case '\\':
+			continue
 		default:
 			oldBegin--
 			newBegin--
 			newNumOfLines++
 			oldNumOfLines++
 		}
+		count++
 	}
 
 	// "git diff" outputs "@@ -1 +1,3 @@" for "OLD" => "A\nB\nC"
@@ -294,9 +290,9 @@ func CutDiffAroundLine(originalDiff io.Reader, line int64, old bool, numbersOfLi
 	// For example: "L1\nL2" => "A\nB", then the patch shows "L2" as line 1 on the left (deleted part)
 
 	// construct the new hunk header
-	newHunk[headerLines] = fmt.Sprintf("@@ -%d,%d +%d,%d @@",
+	hunk[headerLines] = fmt.Sprintf("@@ -%d,%d +%d,%d @@",
 		oldBegin, oldNumOfLines, newBegin, newNumOfLines)
-	return strings.Join(newHunk, "\n"), nil
+	return strings.Join(append(hunk[:headerLines+1], hunk[start:]...), "\n"), nil
 }
 
 // GetAffectedFiles returns the affected files between two commits
@@ -312,31 +308,18 @@ func GetAffectedFiles(ctx context.Context, repo *Repository, branchName, oldComm
 		oldCommitID = startCommitID
 	}
 
-	affectedFiles := make([]string, 0, 32)
-
-	// Run `git diff --name-only` to get the names of the changed files
-	cmd := gitcmd.NewCommand("diff", "--name-only").AddDynamicArguments(oldCommitID, newCommitID)
-	stdoutReader, stdoutReaderClose := cmd.MakeStdoutPipe()
-	defer stdoutReaderClose()
-	err := cmd.WithEnv(env).WithRepo(repo).
-		WithPipelineFunc(func(ctx gitcmd.Context) error {
-			// Now scan the output from the command
-			scanner := bufio.NewScanner(stdoutReader)
-			for scanner.Scan() {
-				path := strings.TrimSpace(scanner.Text())
-				if len(path) == 0 {
-					continue
-				}
-				affectedFiles = append(affectedFiles, path)
-			}
-			return scanner.Err()
-		}).
-		Run(ctx)
+	// use "diff-tree -r -z": paths are NUL-separated (never quoted) and renames report both the old and new path
+	cmd := gitcmd.NewCommand("diff-tree", "--name-only", "--no-commit-id", "-r", "-z").AddDynamicArguments(oldCommitID, newCommitID)
+	stdout, _, err := cmd.WithEnv(env).WithRepo(repo).RunStdString(ctx)
 	if err != nil {
 		log.Error("Unable to get affected files for commits from %s to %s in %s: %v", oldCommitID, newCommitID, repo.LogString(), err)
+		return nil, err
 	}
-
-	return affectedFiles, err
+	affectedFiles := strings.Split(strings.TrimSuffix(stdout, "\x00"), "\x00")
+	if len(affectedFiles) == 1 && affectedFiles[0] == "" {
+		affectedFiles = nil
+	}
+	return affectedFiles, nil
 }
 
 // GetReverseRawDiff dumps the reverse diff results of repository in given commit ID to io.Writer.

modules/git/diff_test.go

@@ -4,10 +4,14 @@
 package git
 
 import (
+	"path/filepath"
 	"strings"
 	"testing"
 
+	"gitea.dev/modules/git/gitcmd"
+
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 const exampleDiff = `diff --git a/README.md b/README.md
@@ -120,10 +124,18 @@ func TestCutDiffAroundLine(t *testing.T) {
 	assert.Empty(t, emptyResult)
 
 	// Line is out of scope
-	emptyResult, err = CutDiffAroundLine(strings.NewReader(exampleDiff), 434, false, 0)
+	emptyResult, err = CutDiffAroundLine(strings.NewReader(exampleDiff), 7, false, 3)
 	assert.NoError(t, err)
 	assert.Empty(t, emptyResult)
 
+	noNewlineDiff := "diff --git a/a b/a\n--- a/a\n+++ b/a\n@@ -1 +1 @@\n-a\n\\ No newline at end of file\n+a"
+	result, err = CutDiffAroundLine(strings.NewReader(noNewlineDiff), 1, false, 2)
+	assert.NoError(t, err)
+	assert.Equal(t, "diff --git a/a b/a\n--- a/a\n+++ b/a\n@@ -1,1 +1,1 @@\n-a\n\\ No newline at end of file\n+a", result)
+	result, err = CutDiffAroundLine(strings.NewReader(noNewlineDiff), 1, true, 2)
+	assert.NoError(t, err)
+	assert.Equal(t, "diff --git a/a b/a\n--- a/a\n+++ b/a\n@@ -1 +1 @@\n-a", result)
+
 	// Handle minus diffs properly
 	minusDiff, err := CutDiffAroundLine(strings.NewReader(breakingDiff), 2, false, 4)
 	assert.NoError(t, err)
@@ -182,3 +194,40 @@ func TestParseDiffHunkString(t *testing.T) {
 	assert.Equal(t, 19, rightLine)
 	assert.Equal(t, 5, rightHunk)
 }
+
+func TestGetAffectedFilesSpecialNames(t *testing.T) {
+	repoDir := filepath.Join(t.TempDir(), "repo.git")
+	require.NoError(t, gitcmd.NewCommand("init").AddDynamicArguments(repoDir).Run(t.Context()))
+	stdin := `commit refs/heads/main
+committer User <user@example.com> 1714310400 +0000
+data 1
+a
+M 100644 inline base.txt
+data 1
+x
+
+commit refs/heads/main
+committer User <user@example.com> 1714310401 +0000
+data 1
+b
+M 100644 inline "protected/we\"ird.md"
+data 1
+x
+M 100644 inline "protected/\344\270\255\346\226\207.md"
+data 1
+x
+M 100644 inline protected/normal.md
+data 1
+x
+R base.txt protected/renamed.md
+`
+	require.NoError(t, gitcmd.NewCommand("fast-import").WithDir(repoDir).WithStdinBytes([]byte(stdin)).Run(t.Context()))
+
+	repo, err := OpenRepository(t.Context(), mockRepository(repoDir))
+	require.NoError(t, err)
+	defer repo.Close()
+
+	files, err := GetAffectedFiles(t.Context(), repo, "main", "main~1", "main", nil)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{`protected/we"ird.md`, "protected/中文.md", "protected/normal.md", "base.txt", "protected/renamed.md"}, files)
+}

modules/git/git.go

@@ -71,12 +71,12 @@ func DefaultFeatures() *Features {
 func loadGitVersionFeatures() (*Features, error) {
 	stdout, _, runErr := gitcmd.NewCommand("version").RunStdString(context.Background())
 	if runErr != nil {
-		return nil, runErr
+		return nil, fmt.Errorf(`failed to run command "git version": %w`, runErr)
 	}
 
 	ver, err := parseGitVersionLine(strings.TrimSpace(stdout))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf(`failed to parse output of command "git version": %w`, err)
 	}
 
 	features := &Features{gitVersion: ver, UsingGogit: isGogit}
@@ -108,7 +108,11 @@ func parseGitVersionLine(s string) (*version.Version, error) {
 	if len(versionFields) > 3 {
 		versionFields = versionFields[:3]
 	}
-	return version.NewVersion(strings.Join(versionFields, "."))
+	ver, err := version.NewVersion(strings.Join(versionFields, "."))
+	if err != nil {
+		return nil, fmt.Errorf("invalid git version: %q: %w", s, err)
+	}
+	return ver, nil
 }
 
 func checkGitVersionCompatibility(gitVer *version.Version) error {

modules/git/gitcmd/error.go

@@ -93,6 +93,7 @@ const (
 	StderrPathSpec           StderrPrefix = "fatal: pathspec"
 	StderrBadRevision        StderrPrefix = "fatal: bad revision"
 	StderrNoSuchPath         StderrPrefix = "fatal: no such path"
+	StderrBadObject          StderrPrefix = "fatal: bad object "
 
 	StderrNoSuchRemote1 StderrPrefix = "fatal: no such remote" // git < 2.30, exit status 128
 	StderrNoSuchRemote2 StderrPrefix = "error: no such remote" // git >= 2.30. exit status 2

modules/httplib/serve.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"mime"
 	"net/http"
 	"path"
 	"strconv"
@@ -60,11 +61,13 @@ func serveSetHeaderContentRelated(w http.ResponseWriter, contentType string) {
 	header.Set("X-Content-Type-Options", "nosniff")
 
 	csp := serveHeaderCspDefault
-	if strings.HasPrefix(contentType, "application/pdf") {
-		csp = serveHeaderCspPdf
-	}
-	if strings.HasPrefix(contentType, "video/") || strings.HasPrefix(contentType, "audio/") {
-		csp = serveHeaderCspAudioVideo
+	if mediaType, _, err := mime.ParseMediaType(contentType); err == nil { // browsers may parse malformed types differently
+		if mediaType == "application/pdf" {
+			csp = serveHeaderCspPdf
+		}
+		if strings.HasPrefix(mediaType, "video/") || strings.HasPrefix(mediaType, "audio/") {
+			csp = serveHeaderCspAudioVideo
+		}
 	}
 	if csp != "" {
 		header.Set("Content-Security-Policy", csp)

modules/httplib/serve_test.go

@@ -117,9 +117,10 @@ func TestServeSetHeaderContentRelated(t *testing.T) {
 		{"", serveHeaderCspDefault},
 		{"any", serveHeaderCspDefault},
 		{"application/pdf", serveHeaderCspPdf},
-		{"application/pdf; other", serveHeaderCspPdf},
+		{"application/pdf; charset=binary", serveHeaderCspPdf},
 		{"audio/mp4", serveHeaderCspAudioVideo},
-		{"video/ogg; other", serveHeaderCspAudioVideo},
+		{"video/ogg; codecs=theora", serveHeaderCspAudioVideo},
+		{"video/mp4;,text/html", serveHeaderCspDefault},
 		{typesniffer.MimeTypeImageSvg, serveHeaderCspDefault},
 	}
 	for _, c := range cases {

modules/indexer/stats/db.go

@@ -9,6 +9,7 @@ import (
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/git/languagestats"
+	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/graceful"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/process"
@@ -23,6 +24,13 @@ func (db *DBIndexer) Index(id int64) error {
 	ctx, _, finished := process.GetManager().AddContext(graceful.GetManager().ShutdownContext(), fmt.Sprintf("Stats.DB Index Repo[%d]", id))
 	defer finished()
 
+	// the unique queue doesn't stop two workers from indexing the same repository at once
+	releaser, err := globallock.Lock(ctx, fmt.Sprintf("repo_stats_index_%d", id))
+	if err != nil {
+		return err
+	}
+	defer releaser()
+
 	repo, err := repo_model.GetRepositoryByID(ctx, id)
 	if err != nil {
 		return err

modules/json/json.go

@@ -23,7 +23,7 @@ type Decoder interface {
 // Interface represents an interface to handle json data
 type Interface interface {
 	Marshal(v any) ([]byte, error)
-	MarshalWrite(w io.Writer, v any) error
+	MarshalWriteRelaxed(w io.Writer, v any) error
 	Unmarshal(data []byte, v any) error
 	NewEncoder(writer io.Writer) Encoder
 	NewDecoder(reader io.Reader) Decoder
@@ -37,9 +37,10 @@ func Marshal(v any) ([]byte, error) {
 	return DefaultJSONHandler.Marshal(v)
 }
 
-// MarshalWrite writes the JSON encoding of v to the given writer
-func MarshalWrite(w io.Writer, v any) error {
-	return DefaultJSONHandler.MarshalWrite(w, v)
+// MarshalWriteRelaxed writes the JSON encoding of v to the given writer
+// It tolerates invalid UTF-8 in strings and replaces them with the Unicode replacement character U+FFFD.
+func MarshalWriteRelaxed(w io.Writer, v any) error {
+	return DefaultJSONHandler.MarshalWriteRelaxed(w, v)
 }
 
 // Unmarshal decodes object from bytes

modules/json/jsonv2.go

@@ -13,6 +13,7 @@ import (
 
 type JSONv2 struct {
 	marshalOptions                  jsonv2.Options
+	marshalRelaxedOptions           jsonv2.Options
 	marshalKeepOptionalEmptyOptions jsonv2.Options
 	unmarshalOptions                jsonv2.Options
 	unmarshalCaseInsensitiveOptions jsonv2.Options
@@ -26,6 +27,8 @@ func init() {
 		jsonv2.FormatNilMapAsNull(true),
 	}
 	jsonV2.marshalOptions = jsonv2.JoinOptions(commonMarshalOptions...)
+	// when handling user's data, we want to allow invalid UTF-8 to be replaced with the replacement character, rather than returning an error.
+	jsonV2.marshalRelaxedOptions = jsonv2.JoinOptions(append(commonMarshalOptions, jsontext.AllowInvalidUTF8(true))...)
 	jsonV2.unmarshalOptions = jsonv2.DefaultOptionsV2()
 
 	// By default, "json/v2" omitempty removes all `""` empty strings, no matter where it comes from.
@@ -53,8 +56,8 @@ func (j *JSONv2) Marshal(v any) ([]byte, error) {
 	return jsonv2.Marshal(v, j.marshalOptions)
 }
 
-func (j *JSONv2) MarshalWrite(w io.Writer, v any) error {
-	return jsonv2.MarshalWrite(w, v, j.marshalOptions)
+func (j *JSONv2) MarshalWriteRelaxed(w io.Writer, v any) error {
+	return jsonv2.MarshalWrite(w, v, j.marshalRelaxedOptions)
 }
 
 func (j *JSONv2) Unmarshal(data []byte, v any) error {

modules/lfs/client.go

@@ -22,7 +22,7 @@ type UploadCallback func(p Pointer, objectError error) (io.ReadCloser, error)
 // Client is used to communicate with a LFS source
 type Client interface {
 	BatchSize() int
-	Download(ctx context.Context, objects []Pointer, callback DownloadCallback) error
+	Download(ctx context.Context, ref string, objects []Pointer, callback DownloadCallback) error // ref is the full git ref name the objects belong to, may be empty
 	Upload(ctx context.Context, objects []Pointer, callback UploadCallback) error
 }
 

modules/lfs/filesystem_client.go

@@ -38,7 +38,7 @@ func (c *FilesystemClient) objectPath(oid string) (string, error) {
 }
 
 // Download reads the specific LFS object from the target path
-func (c *FilesystemClient) Download(ctx context.Context, objects []Pointer, callback DownloadCallback) error {
+func (c *FilesystemClient) Download(ctx context.Context, _ string, objects []Pointer, callback DownloadCallback) error {
 	for _, object := range objects {
 		p := Pointer{object.Oid, object.Size}
 

modules/lfs/http_client.go

@@ -67,18 +67,18 @@ func (c *HTTPClient) transferNames() []string {
 	return keys
 }
 
-func (c *HTTPClient) batch(ctx context.Context, operation string, objects []Pointer) (*BatchResponse, error) {
+func (c *HTTPClient) batch(ctx context.Context, operation, ref string, objects []Pointer) (*BatchResponse, error) {
 	log.Trace("BATCH operation with objects: %v", objects)
 
 	url := c.endpoint + "/objects/batch"
 
-	// Original:  In some lfs server implementations, they require the ref attribute. #32838
-	// `ref` is an "optional object describing the server ref that the objects belong to"
-	// but some (incorrect) lfs servers like aliyun require it, so maybe adding an empty ref here doesn't break the correct ones.
+	// `ref` is optional, but some servers like aliyun require it, while others like Hugging Face reject an empty or null one
 	// https://github.com/git-lfs/git-lfs/blob/a32a02b44bf8a511aa14f047627c49e1a7fd5021/docs/api/batch.md?plain=1#L37
-	//
-	// UPDATE: it can't use "empty ref" here because it breaks others like https://github.com/go-gitea/gitea/issues/33453
-	request := &BatchRequest{operation, c.transferNames(), nil, objects}
+	// Related issues: #32838, #33453, #39891
+	request := &BatchRequest{Operation: operation, Transfers: c.transferNames(), Objects: objects}
+	if ref != "" {
+		request.Ref = &Reference{Name: ref}
+	}
 
 	payload := new(bytes.Buffer)
 	err := json.NewEncoder(payload).Encode(request)
@@ -113,17 +113,17 @@ func (c *HTTPClient) batch(ctx context.Context, operation string, objects []Poin
 }
 
 // Download reads the specific LFS object from the LFS server
-func (c *HTTPClient) Download(ctx context.Context, objects []Pointer, callback DownloadCallback) error {
-	return c.performOperation(ctx, objects, callback, nil)
+func (c *HTTPClient) Download(ctx context.Context, ref string, objects []Pointer, callback DownloadCallback) error {
+	return c.performOperation(ctx, ref, objects, callback, nil)
 }
 
 // Upload sends the specific LFS object to the LFS server
 func (c *HTTPClient) Upload(ctx context.Context, objects []Pointer, callback UploadCallback) error {
-	return c.performOperation(ctx, objects, nil, callback)
+	return c.performOperation(ctx, "", objects, nil, callback)
 }
 
 // performOperation takes a slice of LFS object pointers, batches them, and performs the upload/download operations concurrently in each batch
-func (c *HTTPClient) performOperation(ctx context.Context, objects []Pointer, dc DownloadCallback, uc UploadCallback) error {
+func (c *HTTPClient) performOperation(ctx context.Context, ref string, objects []Pointer, dc DownloadCallback, uc UploadCallback) error {
 	if len(objects) == 0 {
 		return nil
 	}
@@ -133,7 +133,7 @@ func (c *HTTPClient) performOperation(ctx context.Context, objects []Pointer, dc
 		operation = "upload"
 	}
 
-	result, err := c.batch(ctx, operation, objects)
+	result, err := c.batch(ctx, operation, ref, objects)
 	if err != nil {
 		return err
 	}

modules/lfs/http_client_test.go

@@ -175,6 +175,7 @@ func TestHTTPClientDownload(t *testing.T) {
 		assert.NoError(t, err)
 
 		assert.Equal(t, "download", batchRequest.Operation)
+		assert.Equal(t, &Reference{Name: "refs/heads/main"}, batchRequest.Ref)
 		assert.Len(t, batchRequest.Objects, 1)
 		assert.Equal(t, p.Oid, batchRequest.Objects[0].Oid)
 		assert.Equal(t, p.Size, batchRequest.Objects[0].Size)
@@ -248,7 +249,7 @@ func TestHTTPClientDownload(t *testing.T) {
 				},
 			}
 
-			err := client.Download(t.Context(), []Pointer{p}, func(p Pointer, content io.ReadCloser, objectError error) error {
+			err := client.Download(t.Context(), "refs/heads/main", []Pointer{p}, func(p Pointer, content io.ReadCloser, objectError error) error {
 				if objectError != nil {
 					return objectError
 				}
@@ -283,6 +284,7 @@ func TestHTTPClientUpload(t *testing.T) {
 		assert.NoError(t, err)
 
 		assert.Equal(t, "upload", batchRequest.Operation)
+		assert.Nil(t, batchRequest.Ref)
 		assert.Len(t, batchRequest.Objects, 1)
 		assert.Equal(t, p.Oid, batchRequest.Objects[0].Oid)
 		assert.Equal(t, p.Size, batchRequest.Objects[0].Size)

modules/markup/html.go

@@ -153,8 +153,6 @@ func PostProcessCommitMessageSubject(ctx *RenderContext, defaultLink, content st
 		issueIndexPatternProcessor,
 		commitCrossReferencePatternProcessor,
 		hashCurrentPatternProcessor,
-		emojiShortCodeProcessor,
-		emojiProcessor,
 		linkProcessor,
 	}
 
@@ -175,6 +173,9 @@ func PostProcessCommitMessageSubject(ctx *RenderContext, defaultLink, content st
 		node.DataAtom = atom.A
 		node.Attr = []html.Attribute{{Key: "href", Val: defaultLink}, {Key: "class", Val: "muted title-full-link"}}
 		node.FirstChild, node.LastChild = ch, ch
+		for n := node.FirstChild; n != nil; {
+			n = visitNode(ctx, emojiProcessors, n)
+		}
 	})
 	rendered := postProcessHTML(ctx, procs, htmlutil.EscapeString(content))
 	return htmlutil.HTMLFormat(`<span class="title-full-link-hover">%s</span>`, rendered)

modules/markup/sanitizer_default.go

@@ -31,8 +31,9 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 	// Chroma always uses 1-2 letters for style names, we could tolerate it at the moment
 	policy.AllowAttrs("class").Matching(regexp.MustCompile(`^\w{0,2}$`)).OnElements("span")
 
-	// Line numbers on codepreview
+	// Line numbers and paste behavior on codepreview
 	policy.AllowAttrs("data-line-number").OnElements("span")
+	policy.AllowAttrs("data-paste-markdown-skip").OnElements("table")
 
 	// emoji aliases for dark theme inversion
 	policy.AllowAttrs("data-alias").OnElements("span")

modules/markup/sanitizer_default_test.go

@@ -49,6 +49,8 @@ func TestSanitizer(t *testing.T) {
 		`<p style="bad-color: red">Hello World</p>`, `<p>Hello World</p>`,
 		`<code style="bad-color: red">Hello World</code>`, `<code>Hello World</code>`,
 
+		`<table data-paste-markdown-skip><tr><td>1</td></tr></table>`, `<table data-paste-markdown-skip=""><tr><td>1</td></tr></table>`,
+
 		// Org mode status of list items.
 		`<li class="checked"></li>`, `<li class="checked"></li>`,
 		`<li class="unchecked"></li>`, `<li class="unchecked"></li>`,

modules/optional/serialization.go

@@ -4,17 +4,28 @@
 package optional
 
 import (
+	"reflect"
+
 	"gitea.dev/modules/json"
 
 	"go.yaml.in/yaml/v4"
 )
 
+func (o *Option[T]) assignUnmarshalledValue(v *T) {
+	if reflect.TypeFor[T]().Kind() == reflect.Pointer && v == nil {
+		var zero T
+		*o = Some[T](zero)
+	} else {
+		*o = FromPtr(v)
+	}
+}
+
 func (o *Option[T]) UnmarshalJSON(data []byte) error {
 	var v *T
 	if err := json.Unmarshal(data, &v); err != nil {
 		return err
 	}
-	*o = FromPtr(v)
+	o.assignUnmarshalledValue(v)
 	return nil
 }
 
@@ -31,7 +42,7 @@ func (o *Option[T]) UnmarshalYAML(value *yaml.Node) error {
 	if err := value.Decode(&v); err != nil {
 		return err
 	}
-	*o = FromPtr(v)
+	o.assignUnmarshalledValue(v)
 	return nil
 }
 

modules/optional/serialization_test.go

@@ -6,6 +6,7 @@ package optional_test
 import (
 	std_json "encoding/json" //nolint:depguard // for testing purpose
 	"testing"
+	"time"
 
 	"gitea.dev/modules/json"
 	"gitea.dev/modules/optional"
@@ -28,6 +29,14 @@ type testSerializationStruct struct {
 	OptTwoString optional.Option[string] `json:"optional_two_string" yaml:"optional_two_string"`
 }
 
+type testSerializationNullValue struct {
+	OptString optional.Option[string] `json:"opt_null,omitempty" yaml:"opt_null,omitempty"`
+}
+
+type testSerializationNullPointer struct {
+	OptNull optional.Option[*time.Time] `json:"opt_null,omitempty" yaml:"opt_null,omitempty"`
+}
+
 func TestOptionalToJson(t *testing.T) {
 	tests := []struct {
 		name string
@@ -63,6 +72,32 @@ func TestOptionalToJson(t *testing.T) {
 			assert.Equal(t, tc.want, string(b), "std json module returned unexpected")
 		})
 	}
+
+	t.Run("NullValue", func(t *testing.T) {
+		var v1 testSerializationNullValue
+		err := json.Unmarshal([]byte(`{"opt_null":null}`), &v1)
+		assert.NoError(t, err)
+		assert.False(t, v1.OptString.Has())
+	})
+
+	t.Run("NullPointer", func(t *testing.T) {
+		var v1 testSerializationNullPointer
+		err := json.Unmarshal([]byte(`{"opt_null":null}`), &v1)
+		assert.NoError(t, err)
+		assert.True(t, v1.OptNull.Has())
+		assert.Nil(t, v1.OptNull.Value())
+
+		var v2 testSerializationNullPointer
+		err = std_json.Unmarshal([]byte(`{}`), &v2)
+		assert.NoError(t, err)
+		assert.False(t, v2.OptNull.Has())
+
+		var v3 testSerializationNullPointer
+		err = std_json.Unmarshal([]byte(`{"opt_null":"2006-01-02T15:04:05Z"}`), &v3)
+		assert.NoError(t, err)
+		assert.True(t, v3.OptNull.Has())
+		assert.NotNil(t, v3.OptNull.Value())
+	})
 }
 
 func TestOptionalFromJson(t *testing.T) {

modules/packages/composer/metadata.go

@@ -15,6 +15,7 @@ import (
 	"regexp"
 	"strings"
 
+	"gitea.dev/modules/charset"
 	"gitea.dev/modules/json"
 	"gitea.dev/modules/util"
 	"gitea.dev/modules/validation"
@@ -261,6 +262,7 @@ func ParsePackage(r ReadSeekAt, optVersion ...string) (*PackageInfo, error) {
 		cj.Readme = "README.md"
 	}
 	dataReadmeMd, _ := readPackageFile(pkgExt, r, cj.Readme, 10*1024)
+	dataReadmeMd = charset.ToUTF8DropErrors(dataReadmeMd)
 
 	// FIXME: legacy problem, the "Readme" field is abused, it should always be the path to the readme file
 	if len(dataReadmeMd) == 0 {

modules/packages/composer/metadata_test.go

@@ -4,8 +4,6 @@
 package composer
 
 import (
-	"archive/tar"
-	"archive/zip"
 	"bytes"
 	"compress/gzip"
 	"io"
@@ -13,6 +11,7 @@ import (
 	"testing"
 
 	"gitea.dev/modules/json"
+	"gitea.dev/modules/test"
 
 	"github.com/dsnet/compress/bzip2"
 	"github.com/stretchr/testify/assert"
@@ -76,37 +75,8 @@ func TestCommentsUnmarshal(t *testing.T) {
 }
 
 func TestParsePackage(t *testing.T) {
-	createArchive := func(files map[string]string) []byte {
-		var buf bytes.Buffer
-		archive := zip.NewWriter(&buf)
-		for name, content := range files {
-			w, _ := archive.Create(name)
-			_, _ = w.Write([]byte(content))
-		}
-		_ = archive.Close()
-		return buf.Bytes()
-	}
-
-	createArchiveTar := func(comp func(io.Writer) io.WriteCloser, files map[string]string) []byte {
-		var buf bytes.Buffer
-		w := comp(&buf)
-		archive := tar.NewWriter(w)
-		for name, content := range files {
-			hdr := &tar.Header{
-				Name: name,
-				Mode: 0o600,
-				Size: int64(len(content)),
-			}
-			_ = archive.WriteHeader(hdr)
-			_, _ = archive.Write([]byte(content))
-		}
-		_ = w.Close()
-		_ = archive.Close()
-		return buf.Bytes()
-	}
-
 	t.Run("MissingComposerFile", func(t *testing.T) {
-		data := createArchive(map[string]string{"dummy.txt": ""})
+		data := test.WriteZipArchive(map[string]string{"dummy.txt": ""}).Bytes()
 
 		cp, err := ParsePackage(bytes.NewReader(data))
 		assert.Nil(t, cp)
@@ -114,7 +84,7 @@ func TestParsePackage(t *testing.T) {
 	})
 
 	t.Run("MissingComposerFileInRoot", func(t *testing.T) {
-		data := createArchive(map[string]string{"sub/sub/composer.json": ""})
+		data := test.WriteZipArchive(map[string]string{"sub/sub/composer.json": ""}).Bytes()
 
 		cp, err := ParsePackage(bytes.NewReader(data))
 		assert.Nil(t, cp)
@@ -122,7 +92,7 @@ func TestParsePackage(t *testing.T) {
 	})
 
 	t.Run("InvalidComposerFile", func(t *testing.T) {
-		data := createArchive(map[string]string{"composer.json": ""})
+		data := test.WriteZipArchive(map[string]string{"composer.json": ""}).Bytes()
 
 		cp, err := ParsePackage(bytes.NewReader(data))
 		assert.Nil(t, cp)
@@ -130,7 +100,7 @@ func TestParsePackage(t *testing.T) {
 	})
 
 	t.Run("InvalidPackageName", func(t *testing.T) {
-		data := createArchive(map[string]string{"composer.json": "{}"})
+		data := test.WriteZipArchive(map[string]string{"composer.json": "{}"}).Bytes()
 
 		cp, err := ParsePackage(bytes.NewReader(data))
 		assert.Nil(t, cp)
@@ -138,7 +108,7 @@ func TestParsePackage(t *testing.T) {
 	})
 
 	t.Run("InvalidPackageVersion", func(t *testing.T) {
-		data := createArchive(map[string]string{"composer.json": `{"name": "gitea/composer-package", "version": "1.a.3"}`})
+		data := test.WriteZipArchive(map[string]string{"composer.json": `{"name": "gitea/composer-package", "version": "1.a.3"}`}).Bytes()
 
 		cp, err := ParsePackage(bytes.NewReader(data))
 		assert.Nil(t, cp)
@@ -146,7 +116,7 @@ func TestParsePackage(t *testing.T) {
 	})
 
 	t.Run("InvalidReadmePath", func(t *testing.T) {
-		data := createArchive(map[string]string{"composer.json": `{"name": "gitea/composer-package", "readme": "sub/README.md"}`})
+		data := test.WriteZipArchive(map[string]string{"composer.json": `{"name": "gitea/composer-package", "readme": "sub/README.md"}`}).Bytes()
 
 		cp, err := ParsePackage(bytes.NewReader(data))
 		assert.NoError(t, err)
@@ -177,22 +147,29 @@ func TestParsePackage(t *testing.T) {
 	}
 
 	t.Run("ValidZip", func(t *testing.T) {
-		data := createArchive(map[string]string{"composer.json": buildComposerContent(""), "README.md": readme})
+		data := test.WriteZipArchive(map[string]string{"composer.json": buildComposerContent(""), "README.md": readme}).Bytes()
 		assertValidPackage(t, data, "", "gitea-composer-package.zip")
 	})
 
 	t.Run("ValidTarBz2", func(t *testing.T) {
-		data := createArchiveTar(func(w io.Writer) io.WriteCloser {
+		data := test.WriteTarCompression(func(w io.Writer) io.WriteCloser {
 			bz2Writer, _ := bzip2.NewWriter(w, nil)
 			return bz2Writer
-		}, map[string]string{"composer.json": buildComposerContent("1.0"), "README.md": readme})
+		}, map[string]string{"composer.json": buildComposerContent("1.0"), "README.md": readme}).Bytes()
 		assertValidPackage(t, data, "1.0", "gitea-composer-package.1.0.tar.bz2")
 	})
 
 	t.Run("ValidTarGz", func(t *testing.T) {
-		data := createArchiveTar(func(w io.Writer) io.WriteCloser {
+		data := test.WriteTarCompression(func(w io.Writer) io.WriteCloser {
 			return gzip.NewWriter(w)
-		}, map[string]string{"composer.json": buildComposerContent(""), "README.md": readme})
+		}, map[string]string{"composer.json": buildComposerContent(""), "README.md": readme}).Bytes()
 		assertValidPackage(t, data, "", "gitea-composer-package.tar.gz")
 	})
+
+	t.Run("ReadmeEncoding", func(t *testing.T) {
+		data := test.WriteZipArchive(map[string]string{"composer.json": buildComposerContent(""), "README.md": "🌞🌞"[:6]}).Bytes()
+		cp, err := ParsePackage(bytes.NewReader(data))
+		require.NoError(t, err)
+		assert.Equal(t, "🌞 ", cp.Metadata.Readme)
+	})
 }

modules/packages/helm/metadata.go

@@ -10,6 +10,7 @@ import (
 	"io"
 	"strings"
 
+	"gitea.dev/modules/packages"
 	"gitea.dev/modules/util"
 	"gitea.dev/modules/validation"
 
@@ -69,6 +70,8 @@ type Dependency struct {
 	Alias        string   `json:"alias,omitempty" yaml:"alias,omitempty"`
 }
 
+const maxArchiveSize = 256 * 1024 * 1024 // tar members are inflated while looking for Chart.yaml
+
 // ParseChartArchive parses the metadata of a Helm archive
 func ParseChartArchive(r io.Reader) (*Metadata, error) {
 	gzr, err := gzip.NewReader(r)
@@ -77,7 +80,7 @@ func ParseChartArchive(r io.Reader) (*Metadata, error) {
 	}
 	defer gzr.Close()
 
-	tr := tar.NewReader(gzr)
+	tr := tar.NewReader(packages.NewLimitedReader(gzr, maxArchiveSize))
 	for {
 		hd, err := tr.Next()
 		if err == io.EOF {

modules/packages/limited_reader.go

@@ -0,0 +1,29 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package packages
+
+import (
+	"io"
+
+	"gitea.dev/modules/util"
+)
+
+var ErrContentTooLarge = util.NewInvalidArgumentErrorf("content exceeds the size limit")
+
+type limitedReader struct {
+	io.LimitedReader
+}
+
+// NewLimitedReader returns a reader that fails with ErrContentTooLarge once it reads a byte past limit
+func NewLimitedReader(r io.Reader, limit int64) io.Reader {
+	return &limitedReader{io.LimitedReader{R: r, N: limit + 1}}
+}
+
+func (l *limitedReader) Read(p []byte) (int, error) {
+	n, err := l.LimitedReader.Read(p)
+	if l.N == 0 {
+		return max(n-1, 0), ErrContentTooLarge
+	}
+	return n, err
+}

modules/packages/rubygems/metadata.go

@@ -8,6 +8,8 @@ import (
 	"compress/gzip"
 	"io"
 	"regexp"
+	"slices"
+	"strings"
 	"sync"
 
 	"gitea.dev/modules/util"
@@ -23,6 +25,8 @@ var (
 	ErrInvalidName = util.NewInvalidArgumentErrorf("package name is invalid")
 	// ErrInvalidVersion indicates an invalid version in the metadata.gz file
 	ErrInvalidVersion = util.NewInvalidArgumentErrorf("package version is invalid")
+	// ErrInvalidMetadata indicates metadata that would corrupt the generated index
+	ErrInvalidMetadata = util.NewInvalidArgumentErrorf("package metadata is invalid")
 )
 
 var globalVars = sync.OnceValue(func() (ret struct {
@@ -220,6 +224,19 @@ func parseMetadataFile(r io.Reader) (*Package, error) {
 		}
 	}
 
+	values := []string{m.Platform}
+	reqs := slices.Concat(m.RequiredRubyVersion, m.RequiredRubygemsVersion)
+	for _, dep := range slices.Concat(m.RuntimeDependencies, m.DevelopmentDependencies) {
+		values = append(values, dep.Name)
+		reqs = append(reqs, dep.Version...)
+	}
+	for _, req := range reqs {
+		values = append(values, req.Restriction, req.Version)
+	}
+	if slices.ContainsFunc(values, func(s string) bool { return strings.ContainsAny(s, "\r\n") }) {
+		return nil, ErrInvalidMetadata // the compact index is line-based, a line break would forge entries
+	}
+
 	return &Package{
 		Name:     spec.Name,
 		Version:  spec.Version.Version,

modules/packages/rubygems/metadata_test.go

@@ -43,6 +43,19 @@ version:
 			assert.Nil(t, rp)
 		}
 	})
+
+	t.Run("LineBreakInIndexedMetadata", func(t *testing.T) {
+		for _, field := range []string{
+			`platform: "ruby\nx"`,
+			`dependencies: [{name: "d\nx"}]`,
+			`dependencies: [{name: d, requirement: {requirements: [[">=", {version: "1\nx"}]]}}]`,
+			`required_ruby_version: {requirements: [[">=", {version: "1\nx"}]]}`,
+		} {
+			rp, err := parseMetadataFile(test.CompressGzip("name: g\nversion:\n  version: 1\n" + field + "\n"))
+			assert.ErrorIs(t, err, ErrInvalidMetadata, field)
+			assert.Nil(t, rp)
+		}
+	})
 }
 
 func TestParseMetadataFile(t *testing.T) {

modules/queue/base_levelqueue.go

@@ -5,10 +5,8 @@ package queue
 
 import (
 	"context"
-	"sync/atomic"
 
 	"gitea.dev/modules/nosql"
-	"gitea.dev/modules/queue/lqinternal"
 
 	"gitea.com/lunny/levelqueue"
 	"github.com/syndtr/goleveldb/leveldb"
@@ -16,7 +14,7 @@ import (
 
 type baseLevelQueue struct {
 	*baseLevelQueueCommonImpl
-	internal atomic.Pointer[levelqueue.Queue]
+	internal *levelqueue.Queue
 
 	conn string
 	cfg  *BaseConfig
@@ -41,12 +39,11 @@ func newBaseLevelQueueSimple(cfg *BaseConfig) (baseQueue, error) {
 		return nil, err
 	}
 	q := &baseLevelQueue{conn: conn, cfg: cfg, db: db}
-	lq, err := levelqueue.NewQueue(db, []byte(cfg.QueueFullName), false)
+	q.internal, err = levelqueue.NewQueue(db, []byte(cfg.QueueFullName), false)
 	if err != nil {
 		return nil, err
 	}
-	q.internal.Store(lq)
-	q.baseLevelQueueCommonImpl = baseLevelQueueCommon(q.cfg, nil, func() baseLevelQueuePushPoper { return q.internal.Load() })
+	q.baseLevelQueueCommonImpl = baseLevelQueueCommon(q.cfg, nil, q.internal)
 	return q, nil
 }
 
@@ -55,24 +52,16 @@ func (q *baseLevelQueue) HasItem(ctx context.Context, data []byte) (bool, error)
 }
 
 func (q *baseLevelQueue) Len(ctx context.Context) (int, error) {
-	return int(q.internal.Load().Len()), nil
+	return int(q.internal.Len()), nil
 }
 
 func (q *baseLevelQueue) Close() error {
-	err := q.internal.Load().Close()
+	err := q.internal.Close()
 	_ = nosql.GetManager().CloseLevelDB(q.conn)
 	q.db = nil // the db is not managed by us, it's managed by the nosql manager
 	return err
 }
 
 func (q *baseLevelQueue) RemoveAll(ctx context.Context) error {
-	lqinternal.RemoveLevelQueueKeys(q.db, []byte(q.cfg.QueueFullName))
-	lq, err := levelqueue.NewQueue(q.db, []byte(q.cfg.QueueFullName), false)
-	if err != nil {
-		return err
-	}
-	old := q.internal.Load()
-	q.internal.Store(lq)
-	_ = old.Close() // Not ideal for concurrency. Luckily, the levelqueue only sets its db=nil because it doesn't manage the db, so far so good
-	return nil
+	return q.internal.RemoveAll()
 }

modules/queue/base_levelqueue_common.go

@@ -26,9 +26,9 @@ type baseLevelQueuePushPoper interface {
 
 type baseLevelQueueCommonImpl struct {
 	*baseQueueNotifiable
-	length       int
-	internalFunc func() baseLevelQueuePushPoper
-	muCommon     *sync.Mutex
+	length   int
+	internal baseLevelQueuePushPoper
+	muCommon *sync.Mutex
 }
 
 func (q *baseLevelQueueCommonImpl) PushItem(ctx context.Context, data []byte) error {
@@ -38,11 +38,11 @@ func (q *baseLevelQueueCommonImpl) PushItem(ctx context.Context, data []byte) er
 			defer q.muCommon.Unlock()
 		}
 
-		cnt := int(q.internalFunc().Len())
+		cnt := int(q.internal.Len())
 		if cnt >= q.length {
 			return true, nil, nil
 		}
-		retry, err = false, q.internalFunc().RPush(data)
+		retry, err = false, q.internal.RPush(data)
 		if err == levelqueue.ErrAlreadyInQueue {
 			err = ErrAlreadyInQueue
 		}
@@ -61,7 +61,7 @@ func (q *baseLevelQueueCommonImpl) PopItem(ctx context.Context) ([]byte, error)
 			defer q.muCommon.Unlock()
 		}
 
-		data, err = q.internalFunc().LPop()
+		data, err = q.internal.LPop()
 		if err == levelqueue.ErrNotFound {
 			return true, nil, nil
 		}
@@ -72,8 +72,8 @@ func (q *baseLevelQueueCommonImpl) PopItem(ctx context.Context) ([]byte, error)
 	})
 }
 
-func baseLevelQueueCommon(cfg *BaseConfig, mu *sync.Mutex, internalFunc func() baseLevelQueuePushPoper) *baseLevelQueueCommonImpl {
-	return &baseLevelQueueCommonImpl{length: cfg.Length, muCommon: mu, internalFunc: internalFunc, baseQueueNotifiable: newBaseQueueNotifiable()}
+func baseLevelQueueCommon(cfg *BaseConfig, mu *sync.Mutex, internal baseLevelQueuePushPoper) *baseLevelQueueCommonImpl {
+	return &baseLevelQueueCommonImpl{length: cfg.Length, muCommon: mu, internal: internal, baseQueueNotifiable: newBaseQueueNotifiable()}
 }
 
 func prepareLevelDB(cfg *BaseConfig) (conn string, db *leveldb.DB, err error) {

modules/queue/base_levelqueue_test.go

@@ -6,13 +6,9 @@ package queue
 import (
 	"testing"
 
-	"gitea.dev/modules/queue/lqinternal"
 	"gitea.dev/modules/setting"
 
-	"gitea.com/lunny/levelqueue"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/syndtr/goleveldb/leveldb"
 )
 
 func TestBaseLevelDB(t *testing.T) {
@@ -27,53 +23,3 @@ func TestBaseLevelDB(t *testing.T) {
 	testQueueBasic(t, newBaseLevelQueueSimple, toBaseConfig("baseLevelQueue", setting.QueueSettings{Datadir: t.TempDir() + "/queue-test", Length: 10}), optsSimple)
 	testQueueBasic(t, newBaseLevelQueueUnique, toBaseConfig("baseLevelQueueUnique", setting.QueueSettings{ConnStr: "leveldb://" + t.TempDir() + "/queue-test", Length: 10}), optsUnique)
 }
-
-func TestCorruptedLevelQueue(t *testing.T) {
-	// sometimes the levelqueue could be in a corrupted state, this test is to make sure it can recover from it
-	dbDir := t.TempDir() + "/levelqueue-test"
-	db, err := leveldb.OpenFile(dbDir, nil)
-	require.NoError(t, err)
-	defer db.Close()
-
-	assert.NoError(t, db.Put([]byte("other-key"), []byte("other-value"), nil))
-
-	nameQueuePrefix := []byte("queue_name")
-	nameSetPrefix := []byte("set_name")
-	lq, err := levelqueue.NewUniqueQueue(db, nameQueuePrefix, nameSetPrefix, false)
-	assert.NoError(t, err)
-	assert.NoError(t, lq.RPush([]byte("item-1")))
-
-	itemKey := lqinternal.QueueItemKeyBytes(nameQueuePrefix, 1)
-	itemValue, err := db.Get(itemKey, nil)
-	assert.NoError(t, err)
-	assert.Equal(t, []byte("item-1"), itemValue)
-
-	// there should be 5 keys in db: queue low, queue high, 1 queue item, 1 set item, and "other-key"
-	keys := lqinternal.ListLevelQueueKeys(db)
-	assert.Len(t, keys, 5)
-
-	// delete the queue item key, to corrupt the queue
-	assert.NoError(t, db.Delete(itemKey, nil))
-	// now the queue is corrupted, it never works again
-	_, err = lq.LPop()
-	assert.ErrorIs(t, err, levelqueue.ErrNotFound)
-	assert.NoError(t, lq.Close())
-
-	// remove all the queue related keys to reset the queue
-	lqinternal.RemoveLevelQueueKeys(db, nameQueuePrefix)
-	lqinternal.RemoveLevelQueueKeys(db, nameSetPrefix)
-	// now there should be only 1 key in db: "other-key"
-	keys = lqinternal.ListLevelQueueKeys(db)
-	assert.Len(t, keys, 1)
-	assert.Equal(t, []byte("other-key"), keys[0])
-
-	// re-create a queue from db
-	lq, err = levelqueue.NewUniqueQueue(db, nameQueuePrefix, nameSetPrefix, false)
-	assert.NoError(t, err)
-	assert.NoError(t, lq.RPush([]byte("item-new-1")))
-	// now the queue works again
-	itemValue, err = lq.LPop()
-	assert.NoError(t, err)
-	assert.Equal(t, []byte("item-new-1"), itemValue)
-	assert.NoError(t, lq.Close())
-}

modules/queue/base_levelqueue_unique.go

@@ -6,10 +6,8 @@ package queue
 import (
 	"context"
 	"sync"
-	"sync/atomic"
 
 	"gitea.dev/modules/nosql"
-	"gitea.dev/modules/queue/lqinternal"
 
 	"gitea.com/lunny/levelqueue"
 	"github.com/syndtr/goleveldb/leveldb"
@@ -17,13 +15,13 @@ import (
 
 type baseLevelQueueUnique struct {
 	*baseLevelQueueCommonImpl
-	internal atomic.Pointer[levelqueue.UniqueQueue]
+	internal *levelqueue.UniqueQueue
 
 	conn string
 	cfg  *BaseConfig
 	db   *leveldb.DB
 
-	muBase sync.Mutex // the levelqueue.UniqueQueue is not thread-safe, there is no mutex protecting the underlying queue&set together
+	muBase sync.Mutex // protects multi-step queue+set operations, e.g. the length check followed by a push
 }
 
 var (
@@ -37,31 +35,30 @@ func newBaseLevelQueueUnique(cfg *BaseConfig) (baseQueue, error) {
 		return nil, err
 	}
 	q := &baseLevelQueueUnique{conn: conn, cfg: cfg, db: db}
-	lq, err := levelqueue.NewUniqueQueue(db, []byte(cfg.QueueFullName), []byte(cfg.SetFullName), false)
+	q.internal, err = levelqueue.NewUniqueQueue(db, []byte(cfg.QueueFullName), []byte(cfg.SetFullName), false)
 	if err != nil {
 		return nil, err
 	}
-	q.internal.Store(lq)
-	q.baseLevelQueueCommonImpl = baseLevelQueueCommon(q.cfg, &q.muBase, func() baseLevelQueuePushPoper { return q.internal.Load() })
+	q.baseLevelQueueCommonImpl = baseLevelQueueCommon(q.cfg, &q.muBase, q.internal)
 	return q, nil
 }
 
 func (q *baseLevelQueueUnique) HasItem(ctx context.Context, data []byte) (bool, error) {
 	q.muBase.Lock()
 	defer q.muBase.Unlock()
-	return q.internal.Load().Has(data)
+	return q.internal.Has(data)
 }
 
 func (q *baseLevelQueueUnique) Len(ctx context.Context) (int, error) {
 	q.muBase.Lock()
 	defer q.muBase.Unlock()
-	return int(q.internal.Load().Len()), nil
+	return int(q.internal.Len()), nil
 }
 
 func (q *baseLevelQueueUnique) Close() error {
 	q.muBase.Lock()
 	defer q.muBase.Unlock()
-	err := q.internal.Load().Close()
+	err := q.internal.Close()
 	q.db = nil // the db is not managed by us, it's managed by the nosql manager
 	_ = nosql.GetManager().CloseLevelDB(q.conn)
 	return err
@@ -70,14 +67,5 @@ func (q *baseLevelQueueUnique) Close() error {
 func (q *baseLevelQueueUnique) RemoveAll(ctx context.Context) error {
 	q.muBase.Lock()
 	defer q.muBase.Unlock()
-	lqinternal.RemoveLevelQueueKeys(q.db, []byte(q.cfg.QueueFullName))
-	lqinternal.RemoveLevelQueueKeys(q.db, []byte(q.cfg.SetFullName))
-	lq, err := levelqueue.NewUniqueQueue(q.db, []byte(q.cfg.QueueFullName), []byte(q.cfg.SetFullName), false)
-	if err != nil {
-		return err
-	}
-	old := q.internal.Load()
-	q.internal.Store(lq)
-	_ = old.Close() // Not ideal for concurrency. Luckily, the levelqueue only sets its db=nil because it doesn't manage the db, so far so good
-	return nil
+	return q.internal.RemoveAll()
 }

modules/queue/base_test.go

@@ -25,7 +25,7 @@ func testQueueBasic(t *testing.T, newFn func(cfg *BaseConfig) (baseQueue, error)
 		assert.NoError(t, err)
 
 		ctx := t.Context()
-		_ = q.RemoveAll(ctx)
+		assert.NoError(t, q.RemoveAll(ctx))
 		cnt, err := q.Len(ctx)
 		assert.NoError(t, err)
 		assert.Equal(t, 0, cnt)
@@ -138,11 +138,14 @@ func testQueueBasic(t *testing.T, newFn func(cfg *BaseConfig) (baseQueue, error)
 		assert.NoError(t, err)
 		assert.Equal(t, cfg.Length, cnt)
 
-		_ = q.RemoveAll(ctx)
+		assert.NoError(t, q.RemoveAll(ctx))
 
 		cnt, err = q.Len(ctx)
 		assert.NoError(t, err)
 		assert.Equal(t, 0, cnt)
+
+		// a removed payload must not stay reserved in the set, or this returns ErrAlreadyInQueue
+		assert.NoError(t, q.PushItem(ctx, []byte("item-0")))
 	})
 }