fix(repo): do not check out existing repo content during auto-init (#40376) (#40383)

Backport #40376 by @bircni

Plain repository creation marked a new repository as ready before its
git data, hooks and initial commit existed, and auto-init cloned the new
repository to build its initial commit on top of whatever it already
contained.

- Auto-init builds the initial commit in a freshly initialized temp
repository instead of a clone
- New repositories are inserted as being created and marked ready once
initialized, as fork, template generation, adoption and migrations
already do

---------

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>

.changelog.yml

@@ -1,59 +0,0 @@
-# The full repository name
-repo: go-gitea/gitea
-
-# Service type (gitea or github)
-service: github
-
-# Base URL for Gitea instance if using gitea service type (optional)
-# Default: https://gitea.com
-base-url:
-
-# Changelog groups and which labeled PRs to add to each group
-groups:
-  -
-    name: BREAKING
-    labels:
-      - pr/breaking
-  -
-    name: SECURITY
-    labels:
-      - topic/security
-  -
-    name: FEATURES
-    labels:
-      - type/feature
-  -
-    name: ENHANCEMENTS
-    labels:
-      - type/enhancement
-  -
-    name: PERFORMANCE
-    labels:
-      - performance/memory
-      - performance/speed
-      - performance/bigrepo
-      - performance/cpu
-  -
-    name: BUGFIXES
-    labels:
-      - type/bug
-
-  -
-    name: TESTING
-    labels:
-      - type/testing
-  -
-    name: BUILD
-    labels:
-      - topic/build
-      - topic/code-linting
-  -
-    name: DOCS
-    labels:
-      - type/docs
-  -
-    name: MISC
-    default: true
-
-# regex indicating which labels to skip for the changelog
-skip-labels: skip-changelog|backport\/.+

.github/ISSUE_TEMPLATE/release.yaml

@@ -0,0 +1,59 @@
+name: Release
+description: Track a Gitea release (for release managers).
+title: "Release Gitea "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Follow the [release management guide](https://github.com/go-gitea/gitea/blob/main/docs/release-management.md).
+        Set the issue title and milestone to the version being released. Replace the examples below and mark inapplicable tasks as such.
+        CI signs the tag, generates release notes, and publishes binaries and containers. Track verification here; no manual changelog PR or release upload is needed.
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      placeholder: "28.0.1"
+    validations:
+      required: true
+  - type: input
+    id: branch
+    attributes:
+      label: Release branch
+      placeholder: "release/v28"
+    validations:
+      required: true
+  - type: textarea
+    id: checklist
+    attributes:
+      label: Release checklist
+      description: Keep workflow runs, release URLs, and follow-up PRs alongside the relevant tasks.
+      value: |
+        ### Preparation
+
+        - [ ] Resolve release blockers and confirm milestone issues and PRs are resolved or deferred.
+        - [ ] Confirm required backports are merged and release branch CI passes.
+        - [ ] For a new release line, create the release branch and tag its fork point on main with the next version's -dev tag.
+
+        ### Release
+
+        - [ ] Run https://github.com/go-gitea/gitea/actions/workflows/release-create-tag.yml on the release branch with the selected version and obtain maintainer approval.
+        - [ ] Confirm https://github.com/go-gitea/gitea/actions/workflows/release-tag-version.yml succeeds for the new tag (binaries and containers).
+        - [ ] Verify the public GitHub release, generated notes, binary attachments, and signatures at https://github.com/go-gitea/gitea/releases.
+        - [ ] Verify binaries and signatures at https://dl.gitea.com/gitea/ for this version.
+        - [ ] Verify versioned regular and rootless images on Docker Hub and GHCR, and smoke-test the release.
+
+        ### Follow-up
+
+        - [ ] Verify the automated https://dl.gitea.com/gitea/version.json update, where applicable to this release line.
+        - [ ] Verify automated Helm chart and Terraform provider update PRs and follow up if needed.
+        - [ ] Check Homebrew and Snap availability; record any outstanding packaging follow-up.
+        - [ ] Confirm documentation reflects the release, where applicable.
+        - [ ] Confirm and merge the release blog post, if planned: https://gitea.com/gitea/blog.
+        - [ ] Announce the release in Discord #announcements.
+    validations:
+      required: true
+  - type: textarea
+    id: notes
+    attributes:
+      label: Blockers and notes
+      description: Link outstanding work or release-specific checks using full URLs. Do not include undisclosed security details.

.github/workflows/giteabot-backport.yml

@@ -4,13 +4,14 @@ on:
   push:
     branches:
       - main
+      - release/v*
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
@@ -19,8 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: go-gitea/giteabot@4c9d4d3fd913b5c35f59dcc0b004a3d11d5b22bf # v1.0.7
+      - uses: go-gitea/giteabot@15b18fdedd98a80d0968d0bd9db3a9428814b808 # v1.5.1
         with:
           github_token: ${{ secrets.GITEABOT_TOKEN }}
           gitea_fork: giteabot/gitea
-          checks: backport
+          checks: backport,backport_conflict_free

.github/workflows/giteabot-review.yml

@@ -0,0 +1,19 @@
+name: giteabot-review
+
+# Relays PR reviews to giteabot.yml through its workflow_run trigger, because review
+# runs on fork PRs get no secrets and a read-only token. The job itself does nothing.
+
+on:
+  pull_request_review:
+    types:
+      - submitted
+      - edited
+      - dismissed
+
+permissions: {}
+
+jobs:
+  relay:
+    runs-on: ubuntu-latest
+    steps:
+      - run: "true"

.github/workflows/giteabot.yml

@@ -1,16 +1,11 @@
 name: giteabot
 
 on:
-  # When main advances, rerun merge queue maintenance so the oldest
-  # reviewed/wait-merge PR can be updated against the new base promptly.
-  push:
-    branches:
-      - main
   # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
   # forks, which the bot needs to write labels, statuses and comments. Safe here
   # because the job only runs a pinned action and never checks out PR HEAD.
-  # These PR lifecycle events drive label maintenance, queue maintenance, and
-  # explicit bot actions triggered by relevant label changes.
+  # These PR lifecycle events drive label maintenance, lgtm, and explicit bot
+  # actions triggered by relevant label changes.
   pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
@@ -20,15 +15,13 @@ on:
       - closed
       - review_requested
       - review_request_removed
-  # Review events keep review-derived state such as lgtm labels and status checks
-  # in sync after approvals, edits, or dismissals.
-  pull_request_review:
+  # Reviews arrive through giteabot-review because fork PR review runs get no secrets
+  workflow_run:
+    workflows:
+      - giteabot-review
     types:
-      - submitted
-      - edited
-      - dismissed
-  # Periodic maintenance is still useful as a backstop for queue cleanup and
-  # other housekeeping, even though main pushes now trigger it promptly.
+      - requested
+  # Daily housekeeping like locks, stale feedback issues, last calls and milestones
   schedule:
     - cron: "15 3 * * *"
   # Allow maintainers to rerun selected checks manually when debugging bot
@@ -38,17 +31,17 @@ on:
       checks:
         description: Comma-separated list of non-backport checks to run
         required: false
-        default: labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
+        default: backport_branches,backport_conflict_free,labels,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
 
 permissions: {}
 
 concurrency:
-  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
+  group: ${{ format('{0}-{1}', github.workflow, github.event_name == 'pull_request_target' && format('pr-{0}', github.event.pull_request.number) || github.event_name == 'workflow_run' && format('review-{0}', github.event.workflow_run.head_sha) || 'maintenance') }}
   cancel-in-progress: false
 
 jobs:
   giteabot:
-    if: github.repository == 'go-gitea/gitea'
+    if: github.repository == 'go-gitea/gitea' && (github.event_name != 'workflow_run' || github.event.workflow_run.event == 'pull_request_review')
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -57,9 +50,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      # pull_request_review runs without repository secrets on fork PRs, so fall
-      # back to the workflow token for the non-backport checks handled here.
-      - uses: go-gitea/giteabot@4c9d4d3fd913b5c35f59dcc0b004a3d11d5b22bf # v1.0.7
+      - uses: go-gitea/giteabot@15b18fdedd98a80d0968d0bd9db3a9428814b808 # v1.5.1
         with:
-          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
-          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
+          github_token: ${{ secrets.GITEABOT_TOKEN }}
+          checks: ${{ github.event.inputs.checks || 'backport_branches,backport_conflict_free,labels,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}

.github/workflows/merge-group.yml

@@ -0,0 +1,16 @@
+name: merge-group
+
+# Reports the required giteabot/lgtm check on merge queue commits. giteabot only sets it
+# on PR heads, which already passed it before entering the queue.
+
+on:
+  merge_group:
+
+permissions: {}
+
+jobs:
+  lgtm:
+    name: giteabot/lgtm
+    runs-on: ubuntu-latest
+    steps:
+      - run: "true"

.github/workflows/pull-compliance.yml

@@ -2,6 +2,7 @@ name: compliance
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/pull-db-tests.yml

@@ -2,6 +2,7 @@ name: db-tests
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/pull-e2e-tests.yml

@@ -2,6 +2,7 @@ name: e2e-tests
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/release-create-tag.yml

@@ -0,0 +1,34 @@
+name: release-create-tag
+run-name: Release v${{ inputs.version }} from ${{ github.ref_name }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to release, for example 28.0.1
+        required: true
+
+permissions: {}
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    environment:
+      name: release-signing
+      deployment: false
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          token: ${{ secrets.RELEASE_TOKEN }}
+      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
+          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
+          git_user_signingkey: true
+          git_committer_email: teabot@gitea.io
+      - env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          git tag -s -m "v$VERSION" "v$VERSION"
+          git push origin tag "v$VERSION"

.github/workflows/release-nightly-snapcraft.yml

@@ -37,8 +37,15 @@ jobs:
       # retry snapcraft uploads which can be flaky
       - name: Publish snap
         run: |
+          # part-gitea-pull.sh decides what is built, see the comments there:
+          # * grade devel (main or a prerelease tag) goes to latest/edge
+          # * grade stable (a new release tag) goes to latest/stable, and to latest/candidate which marks it as released
+          channel=latest/edge
+          if unsquashfs -cat "$SNAP" meta/snap.yaml | grep -qx 'grade: stable'; then
+            channel=latest/stable,latest/candidate
+          fi
           for attempt in 1 2 3 4 5; do
-            snapcraft upload "$SNAP" --release latest/edge && exit 0
+            snapcraft upload "$SNAP" --release "$channel" && exit 0
             echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
             sleep 15
           done

.github/workflows/release-tag-rc.yml

@@ -1,149 +0,0 @@
-name: release-tag-rc
-
-on:
-  push:
-    tags:
-      - "v1*-rc*"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  binary:
-    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
-      - run: make deps-frontend deps-backend
-      - run: make release
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-      - name: import gpg key
-        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
-        with:
-          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
-          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
-      - name: sign binaries
-        env:
-          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
-        run: |
-          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
-            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
-          done
-      # clean branch name to get the folder name in the object storage
-      - name: Get cleaned branch name
-        id: clean_name
-        env:
-          REF: ${{ github.ref }}
-        run: |
-          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
-          echo "Cleaned name is ${REF_NAME}"
-          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
-      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
-        with:
-          gh-cli-version: 2.39.1
-      - name: create github release
-        env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          gh release create "$TAG" --title "$TAG" --draft --notes-from-tag dist/release/*
-
-  container:
-    runs-on: namespace-profile-gitea-release-docker
-    permissions:
-      contents: read
-      packages: write # to publish to ghcr.io
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
-        with:
-          cache-image: false
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        id: meta
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          flavor: |
-            latest=false
-          # 1.2.3-rc0
-          tags: |
-            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            latest=false
-            suffix=-rootless
-          # 1.2.3-rc0
-          tags: |
-            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}

.github/workflows/release-tag-version.yml

@@ -3,9 +3,8 @@ name: release-tag-version
 on:
   push:
     tags:
-      - "v1.*"
-      - "!v1*-rc*"
-      - "!v1*-dev"
+      - "v[0-9]*"
+      - "!v[0-9]*-*"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -73,12 +72,23 @@ jobs:
         uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
         with:
           gh-cli-version: 2.39.1
+      - id: range
+        run: |
+          previous=$(git tag --list --sort=-v:refname | grep -xE 'v[0-9]+\.[0-9]+\.[0-9]+' | grep -A1 -xF "$GITHUB_REF_NAME" | tail -1) # highest stable version below this one
+          echo "range=$previous..$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+      - name: skip reverts and reverted commits in changelog
+        env:
+          RANGE: ${{ steps.range.outputs.range }}
+        run: ./tools/generate-cliffignore.sh "$RANGE" | sort -u > .cliffignore
+      - uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
+        with:
+          args: --tag ${{ github.ref_name }} ${{ steps.range.outputs.range }}
       - name: create github release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           TAG: ${{ github.ref_name }}
         run: |
-          gh release create "$TAG" --title "$TAG" --notes-from-tag dist/release/*
+          gh release create "$TAG" --title "$TAG" --notes-file git-cliff/CHANGELOG.md dist/release/*
 
   container:
     runs-on: namespace-profile-gitea-release-docker

CONTRIBUTING.md

@@ -169,7 +169,7 @@ In the PR title, describe the problem you are fixing, not how you are fixing it.
 Use the first comment as a summary of your PR. \
 In the PR summary, you can describe exactly how you are fixing this problem.
 
-PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/) format, because PRs are squash-merged and the PR title becomes the resulting commit message:
+PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/) format, because PRs are squash-merged and the PR title becomes the resulting commit message and release notes entry:
 
 ```text
 type(scope)!: subject

Dockerfile

@@ -48,7 +48,7 @@ FROM docker.io/library/alpine:3.24 AS gitea
 
 EXPOSE 22 3000
 
-RUN apk --no-cache add \
+RUN apk --no-cache upgrade && apk --no-cache add \
     bash \
     ca-certificates \
     curl \

Dockerfile.rootless

@@ -43,7 +43,7 @@ FROM docker.io/library/alpine:3.24 AS gitea-rootless
 
 EXPOSE 2222 3000
 
-RUN apk --no-cache add \
+RUN apk --no-cache upgrade && apk --no-cache add \
     bash \
     ca-certificates \
     dumb-init \

Makefile

@@ -6,7 +6,7 @@ SHASUM ?= shasum -a 256
 
 AIR_PACKAGE ?= github.com/air-verse/air@v1.67.4 # renovate: datasource=go
 EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v4/cmd/editorconfig-checker@v4.0.2 # renovate: datasource=go
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.17 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
 SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.36.6 # renovate: datasource=go
@@ -136,7 +136,7 @@ WEB_DIRS := web_src/js web_src/css
 
 ESLINT_FILES := web_src/js tools *.ts tests/e2e
 STYLELINT_FILES := web_src/css web_src/js/components/*.vue
-SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.json .github $(filter-out CHANGELOG.md, $(wildcard *.go *.md *.yml *.yaml *.toml))
+SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.json .github $(wildcard *.go *.md *.yml *.yaml *.toml)
 EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.json
 
 GO_SOURCES := $(wildcard *.go)

README.md

@@ -120,7 +120,7 @@ See [app.example.ini](https://github.com/go-gitea/gitea/blob/main/custom/conf/ap
 
 **Where can I find the security patches?**
 
-In the [release log](https://github.com/go-gitea/gitea/releases) or the [change log](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md), search for the keyword `SECURITY` to find the security patches.
+Check the [release notes](https://github.com/go-gitea/gitea/releases) and [security advisories](https://github.com/go-gitea/gitea/security/advisories) for security patches.
 
 (more FAQs are listed in [FAQ documentation](https://docs.gitea.com/help/faq))
 

README.zh-cn.md

@@ -125,7 +125,7 @@ Gitea 的发音是 [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY)，就像 "gi-tea
 
 **在哪里可以找到安全补丁？**
 
-在 [发布日志](https://github.com/go-gitea/gitea/releases) 或 [变更日志](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md) 中，搜索关键词 `SECURITY` 以找到安全补丁。
+在 [发布日志](https://github.com/go-gitea/gitea/releases) 中，搜索关键词 `SECURITY` 以找到安全补丁。
 
 ## 许可证
 

README.zh-tw.md

@@ -125,7 +125,7 @@ Gitea 的發音是 [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY)，就像 "gi-tea
 
 **在哪裡可以找到安全補丁？**
 
-在 [發佈日誌](https://github.com/go-gitea/gitea/releases) 或 [變更日誌](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md) 中，搜索關鍵詞 `SECURITY` 以找到安全補丁。
+在 [發佈日誌](https://github.com/go-gitea/gitea/releases) 中，搜索關鍵詞 `SECURITY` 以找到安全補丁。
 
 ## 許可證
 

assets/go-licenses.json

@@ -119,11 +119,6 @@
     "path": "github.com/andybalholm/brotli/LICENSE",
     "licenseText": "Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
   },
-  {
-    "name": "github.com/andybalholm/brotli/flate",
-    "path": "github.com/andybalholm/brotli/flate/LICENSE",
-    "licenseText": "Copyright (c) 2009 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
-  },
   {
     "name": "github.com/andybalholm/cascadia",
     "path": "github.com/andybalholm/cascadia/LICENSE",

cliff.toml

@@ -0,0 +1,10 @@
+[git]
+commit_parsers = [
+  { message = "^(chore|ci)(\\([\\w/.-]+\\))?!?: ", skip = true },
+  { message = "^feat", group = "Features" },
+  { message = "^enhance", group = "Enhancements" },
+  { message = "^perf", group = "Performance" },
+  { message = "^fix", group = "Bug Fixes" },
+  { message = "^docs", group = "Documentation" },
+  { message = ".*", group = "Miscellaneous" },
+]

cmd/admin_user_list.go

@@ -33,7 +33,7 @@ func runListUsers(ctx context.Context, c *cli.Command) error {
 		return err
 	}
 
-	users, err := user_model.GetAllUsers(ctx)
+	users, err := user_model.GetAllUsersForAdminListing(ctx)
 	if err != nil {
 		return err
 	}
@@ -41,17 +41,17 @@ func runListUsers(ctx context.Context, c *cli.Command) error {
 	w := tabwriter.NewWriter(os.Stdout, 5, 0, 1, ' ', 0)
 
 	if c.IsSet("admin") {
-		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\n")
+		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\tType\n")
 		for _, u := range users {
 			if u.IsAdmin {
-				fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", u.ID, u.Name, u.Email, u.IsActive)
+				fmt.Fprintf(w, "%d\t%s\t%s\t%t\t%s\n", u.ID, u.Name, u.Email, u.IsActive, u.Type.DisplayName())
 			}
 		}
 	} else {
 		twofa := user_model.UserList(users).GetTwoFaStatus(ctx)
-		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\tIsAdmin\t2FA\n")
+		fmt.Fprintf(w, "ID\tUsername\tEmail\tIsActive\tIsAdmin\t2FA\tType\n")
 		for _, u := range users {
-			fmt.Fprintf(w, "%d\t%s\t%s\t%t\t%t\t%t\n", u.ID, u.Name, u.Email, u.IsActive, u.IsAdmin, twofa[u.ID])
+			fmt.Fprintf(w, "%d\t%s\t%s\t%t\t%t\t%t\t%s\n", u.ID, u.Name, u.Email, u.IsActive, u.IsAdmin, twofa[u.ID], u.Type.DisplayName())
 		}
 	}
 

contrib/upgrade.sh

@@ -87,7 +87,7 @@ echo "Checking currently installed version..."
 current=$(giteacmd --version | cut -d ' ' -f 3)
 [[ "$current" == "$giteaversion" ]] && echo "$current is already installed, stopping." && exit 0
 if [[ -z "${no_confirm:-}"  ]]; then
-  echo "Make sure to read the changelog first: https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md"
+  echo "Make sure to read the changelog first: https://github.com/go-gitea/gitea/releases"
   echo "Are you ready to update Gitea from ${current} to ${giteaversion}? (y/N)"
   read -r confirm
   [[ "$confirm" == "y" ]] || [[ "$confirm" == "Y" ]] || exit 1

custom/conf/app.example.ini

@@ -536,7 +536,7 @@ INTERNAL_TOKEN =
 ;CONTENT_SECURITY_POLICY_GENERAL =
 ;;
 ;; Egress mode toggles between strictness of outgoing requests:
-;; Lax requires addresses to be allowed only if they are in private ranges, it allows all public ones
+;; Lax requires non-public targets (private, loopback, link-local, CGNAT and special-use ranges) to be allowed, it allows all public ones
 ;; Strict requires an explicit allow of all addresses
 ; EGRESS_MODE = lax
 ;;
@@ -551,10 +551,12 @@ INTERNAL_TOKEN =
 ;; a bracketed set of ports and ranges, | separated: *.mydomain.com:[80|443|3000-3010]
 ;; all ports: *.mydomain.com:*
 ;; A portless entry covers all ports in Lax mode, only 80 and 443 in Strict mode
-;; Port specs apply only where the list is consulted: in Lax mode that is private, loopback and CGNAT
-;; targets alone, public targets are allowed on every port whatever the list says. In Strict mode every
+;; Port specs apply only where the list is consulted: in Lax mode that is non-public targets alone,
+;; public targets are allowed on every port whatever the list says. In Strict mode every
 ;; target is checked, so ports restrict public hosts too.
-;; Reserved addresses like link-local and cloud metadata are denied
+;; Non-public targets need an IP or built-in entry, a host name entry alone never covers them.
+;; Reserved addresses (the IPv4-embedding NAT64, Teredo and 6to4 ranges, this-network, multicast and
+;; broadcast) are denied whatever the list says. To reach them configure an HTTP proxy
 ;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
 ;ALLOWED_HOST_LIST =
 
@@ -636,7 +638,8 @@ ENABLED = true
 ;; * https://github.com/git-ecosystem/git-credential-manager
 ;; * https://gitea.com/gitea/tea
 ;; * Gitea App (the official Gitea mobile app)
-;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app
+;; * https://gitea.com/gitea/gitea-vscode
+;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app, gitea-vscode
 ;;
 ;; By default, OAuth2 applications can only use "http" and "https" as their redirect URI schemes.
 ;; If you need to use other schemes (e.g. for desktop applications), you can specify them here as a comma-separated list.
@@ -808,7 +811,7 @@ LEVEL = Info
 ;[git.config]
 ;diff.algorithm = histogram
 ;core.logAllRefUpdates = true
-;gc.reflogExpire = 90
+;maintenance.strategy = gc
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1096,8 +1099,9 @@ LEVEL = Info
 ;; Force ssh:// clone url instead of scp-style uri when default SSH port is used
 ;USE_COMPAT_SSH_URI = false
 ;;
-;; Value for the "go get" request returns the repository url as https or ssh, default is https
-;GO_GET_CLONE_URL_PROTOCOL = https
+;; Scheme of the returned URL for the "go get" response.
+;; Default is "https" if DISABLE_HTTP_GIT=false or SSH is disabled, otherwise "ssh".
+;GO_GET_CLONE_URL_PROTOCOL =
 ;;
 ;; Close issues as long as a commit on any branch marks it as fixed
 ;DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH = false
@@ -3080,7 +3084,7 @@ LEVEL = Info
 ;LOG_RETENTION_DAYS = 365
 ;; Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever.
 ;; Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded.
-;; Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
+;; Workflows can request a shorter retention period, down to 1 day.
 ;ARTIFACT_RETENTION_DAYS = 90
 ;; Max artifact size in bytes that can be browsed or previewed in the web UI. Set to 0 to disable artifact previews, or -1 for no limit.
 ;ARTIFACT_PREVIEW_MAX_SIZE = 10485760

docs/community-governance.md

@@ -74,15 +74,13 @@ Changes to Gitea must be reviewed before they are accepted, including changes fr
 
 We require two maintainer approvals for every PR. When that is satisfied, your PR gets the `lgtm/done` label. After that, you mainly fix merge conflicts and respond to or implement maintainer requests; maintainers drive getting the PR merged.
 
-If a PR has `lgtm/done`, no open discussions, and no merge conflicts, any maintainer may add `reviewed/wait-merge`. That puts the PR in the merge queue. PRs are merged from the queue in the order of this list:
+If a PR has `lgtm/done`, no open discussions, and no merge conflicts, a merger rewrites its title and description into the final [commit message](#commit-messages) and clicks **Merge when ready**. That adds the PR to the [merge queue](https://github.com/go-gitea/gitea/queue/main), which tests it on top of the latest `main` and the PRs ahead of it, and merges it once CI passes. Edits to the title and description no longer reach the commit once the queue starts building the PR, so make them before queueing.
 
-<https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>
-
-Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. The backporter:
+Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. It:
 
+- Counts maintainer approvals and sets the `lgtm/*` labels and the `giteabot/lgtm` status.
+- Takes a PR out of the merge queue when it loses its approval.
 - Creates a backport PR when needed after the initial PR merges.
-- Removes the PR from the merge queue after it merges.
-- Keeps the oldest branch in the merge queue up to date with merges.
 
 ### Final call
 
@@ -164,7 +162,7 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:
 
-- Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
+- Adding PRs to the [merge queue](#getting-prs-merged) once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
 - Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
   In particular, mergers should edit the PR description.\
   Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.

docs/guidelines-backend.md

@@ -62,6 +62,10 @@ Operations that must roll back together should run inside `db.WithTx()` (or
 Functions that participate in a transaction take a `context.Context` as their first
 parameter so the transaction can be propagated.
 
+PostgreSQL, MySQL and MSSQL (via `READ_COMMITTED_SNAPSHOT`) read the last committed
+row version, so reads never wait for writers. Guard read-then-write logic with a
+conditional `UPDATE` or a lock.
+
 ### XORM gotchas
 
 - Never call `x.Update(exemplar)` without an explicit `WHERE` clause — it updates

docs/release-management.md

@@ -8,10 +8,9 @@ This document describes the release cycle, backports, versioning, and the releas
 
 We backport PRs given the following circumstances:
 
-1. Feature freeze is active, but `<version>-rc0` has not been released yet. Here, we backport as much as possible. <!-- TODO: Is that our definition with the new backport bot? -->
-2. `rc0` has been released. Here, we only backport bug- and security-fixes, and small enhancements. Large PRs such as refactors are not backported anymore. <!-- TODO: Is that our definition with the new backport bot? -->
-3. We never backport new features.
-4. We never backport breaking changes except when
+1. We backport bug- and security-fixes and small enhancements. Large changes such as refactors are not backported.
+2. We never backport new features.
+3. We never backport breaking changes except when
     1. The breaking change has no effect on the vast majority of users
     2. The component triggering the breaking change is marked as experimental
 
@@ -25,6 +24,8 @@ Now, that's not a requirement anymore as our [backport bot](https://github.com/G
 
 The `backport/manual` label signifies either that you want to backport the change yourself, or that there were conflicts when backporting, thus you **must** do it yourself.
 
+The bot labels open PRs targeting `main` that have a `backport/<version>` label with `backport/conflict-free` when they would cherry-pick onto the latest release branch without conflicts.
+
 ### Format of backport PRs
 
 The title of backport PRs should be
@@ -53,7 +54,6 @@ We use a release schedule so work, stabilization, and releases stay predictable.
 ### Cadence
 
 - Aim for a major release about every three or four months.
-- Roughly two or three months of general development, then about one month of testing and polish called the **release freeze**.
 - *Starting with v1.26 the release cycle will be more predictable and follow a more regular schedule.*
 
 ### Release schedule
@@ -65,16 +65,6 @@ We will try to publish a new major version every three months:
 - v1.28.0 in September 2026
 - v1.29.0 in December 2026
 
-#### How is the release handled?
-- The release manager will tag the release candidate (e.g. `v1.26.0-rc0`) and publish it for testing in the **first week of the release month**.
-- If there are no major issues, the release manager will check with the other maintainers and then tag the final release (e.g. `v1.26.0`) in the **one or two weeks following the release candidate**.
-
-### Feature freeze
-
-- Merge feature PRs before the freeze when you can.
-- Feature PRs still open at the freeze move to the next milestone. Watch Discord for the freeze announcement.
-- During the freeze, a **release branch** takes fixes backported from `main`. Release candidates ship for testing; the final release for that line is maintained from that branch.
-
 ### Patch releases
 
 During a cycle we may ship patch releases for an older line. For example, if the latest release is v1.2, we can still publish v1.1.1 after v1.1.0.
@@ -99,17 +89,13 @@ be reviewed by two maintainers and must pass the automatic tests.
 
 ## Releasing Gitea
 
-- Let MAJOR, MINOR and PATCH be Major, Minor and Patch version numbers, PATCH should be rc1, rc2, 0, 1, ...... MAJOR.MINOR will be kept the same as milestones on github or gitea in future.
-- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
-- If this is a big version first you have to create PR for changelog on branch `main` with PRs with label `changelog` and after it has been merged do following steps:
-  - Create `-dev` tag as `git tag -s -F release.notes vMAJOR.MINOR.0-dev` and push the tag as `git push origin vMAJOR.MINOR.0-dev`.
-  - When CI has finished building tag then you have to create a new branch named `release/vMAJOR.MINOR`
-- If it is bugfix version create PR for changelog on branch `release/vMAJOR.MINOR` and wait till it is reviewed and merged.
-- Add a tag as `git tag -s -F release.notes vMAJOR.MINOR.PATCH`, release.notes file could be a temporary file to only include the changelog this version which you added to `CHANGELOG.md`.
-- And then push the tag as `git push origin vMAJOR.MINOR.$`. CI will automatically create a release and upload all the compiled binary. (But currently it doesn't add the release notes automatically. Maybe we should fix that.)
-- If needed send a frontport PR for the changelog to branch `main` and update the version in `docs/config.yaml` to refer to the new version.
-- Send PR to [blog repository](https://gitea.com/gitea/blog) announcing the release.
+Track each release using the [release issue template](https://github.com/go-gitea/gitea/issues/new?template=release.yaml).
+
+- Before releasing, confirm all the version's milestone issues or PRs have been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
+- When creating a release branch, tag its fork point on `main` as the next version's `-dev` tag, e.g. `v30.0.0-dev` for `release/v29`.
+- In the GitHub Actions tab, open the `release-create-tag` workflow, click "Run workflow", select the release branch and enter a version such as `28.0.1`. After maintainer approval, it pushes a signed tag and CI publishes the release with generated notes.
+- Optionally send a PR to the [blog repository](https://gitea.com/gitea/blog) announcing the release.
 - Verify all release assets were correctly published through CI on dl.gitea.com and GitHub releases. Once ACKed:
-  - bump the version of https://dl.gitea.com/gitea/version.json
+  - verify the automated update of https://dl.gitea.com/gitea/version.json, where applicable to the release line
   - merge the blog post PR
   - announce the release in discord `#announcements`

go.mod

@@ -2,7 +2,7 @@ module gitea.dev
 
 go 1.27
 
-toolchain go1.27.1
+toolchain go1.27.4
 
 require (
 	connectrpc.com/connect v1.21.0
@@ -11,9 +11,9 @@ require (
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
 	gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
-	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
+	gitea.com/lunny/levelqueue v0.5.1
 	gitea.dev/actionslib v1.2.1
-	gitea.dev/sdk v1.2.0
+	gitea.dev/sdk v1.3.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/go-ntlmssp v0.1.1
@@ -94,22 +94,22 @@ require (
 	github.com/yuin/goldmark v1.8.6
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	gitlab.com/gitlab-org/api/client-go/v3 v3.13.0
-	go.yaml.in/yaml/v4 v4.0.0-rc.6
-	golang.org/x/crypto v0.57.0
+	go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525
+	golang.org/x/crypto v0.58.0
 	golang.org/x/image v0.46.0
 	golang.org/x/mod v0.41.0
-	golang.org/x/net v0.59.0
+	golang.org/x/net v0.62.0
 	golang.org/x/oauth2 v0.37.0
-	golang.org/x/sync v0.23.0
-	golang.org/x/sys v0.48.0
-	golang.org/x/text v0.42.0
+	golang.org/x/sync v0.24.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/text v0.43.0
 	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/ini.v1 v1.67.3
 	modernc.org/sqlite v1.59.0
 	mvdan.cc/xurls/v2 v2.6.0
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.4.1
+	xorm.io/xorm v1.4.3
 )
 
 require (
@@ -120,7 +120,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/RoaringBitmap/roaring/v2 v2.18.2 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
-	github.com/andybalholm/brotli v1.2.1 // indirect
+	github.com/andybalholm/brotli v1.2.7 // indirect
 	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -252,7 +252,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	golang.org/x/tools v0.51.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	modernc.org/libc v1.75.7 // indirect

go.sum

@@ -18,14 +18,14 @@ gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6 h1:YWzVGeC/8SZThrJS4
 gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:VyMQP6ue6MKHM8UsOXfNfuMKD0oSAWZdXVcpHIN2yaY=
-gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHqdhS7keYWioqfmxdnfblFDTGoOwcZ+o=
-gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
+gitea.com/lunny/levelqueue v0.5.1 h1:15q1oBWaO2Aw9t3rDthQSTX+vBNgjYNkCgRJgES9gA8=
+gitea.com/lunny/levelqueue v0.5.1/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGqTOXqu2aRi/XEQxDCBwM8yJtE6s=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
 gitea.dev/actionslib v1.2.1 h1:GL//K/0zIZV6h1OOksv1awvFVg0rg7fug2xWcG7mkG0=
 gitea.dev/actionslib v1.2.1/go.mod h1:1+gqOKGSEPn2IFHgY8S3GC5Ld+Hn8jF3OxiFHQ/fpx4=
-gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
-gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
+gitea.dev/sdk v1.3.0 h1:4U95+Ou6WHCQiRPDEyAzvl1Q7cxg5RUTWkqmOXr5w4I=
+gitea.dev/sdk v1.3.0/go.mod h1:85EBqSAqUn1KlFCk40y3sTjWjBsB/KouL3slGXMA/2o=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -71,8 +71,8 @@ github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
-github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
-github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A=
+github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
 github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -672,8 +672,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
-go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525 h1:FtzHH3s777Nx50YcPAcodAPm1mNakc228nMYbr3f+90=
+go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 go4.org v0.0.0-20260112195520-a5071408f32f h1:ziUVAjmTPwQMBmYR1tbdRFJPtTcQUI12fH9QQjfb0Sw=
 go4.org v0.0.0-20260112195520-a5071408f32f/go.mod h1:ZRJnO5ZI4zAwMFp+dS1+V6J6MSyAowhRqAE+DPa1Xp0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -686,8 +686,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
@@ -714,8 +714,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -728,8 +728,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -756,8 +756,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -767,8 +767,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -779,8 +779,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -790,8 +790,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -862,5 +862,5 @@ pgregory.net/rapid v0.4.2 h1:lsi9jhvZTYvzVpeG93WWgimPRmiJQfGFRNTEZh1dtY0=
 pgregory.net/rapid v0.4.2/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
-xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.4.3 h1:MwWFWzVr+/6D07qGCDhBAfABcuT0gvqY3XmTy1215BM=
+xorm.io/xorm v1.4.3/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=

modelmigration/migrations.go

@@ -33,6 +33,7 @@ import (
 	"gitea.dev/modelmigration/v1_8"
 	"gitea.dev/modelmigration/v1_9"
 	"gitea.dev/modelmigration/v28"
+	"gitea.dev/modelmigration/v29"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -429,6 +430,10 @@ func prepareMigrationTasks() []*migration {
 		newMigration(353, "Add audit event table", v28.AddAuditEventTable),
 		newMigration(354, "Add Actions job queue indexes", v28.AddActionQueueIndexes),
 		newMigration(355, "Add AutoMerge merged_commit_id column", v28.AddAutoMergeMergedCommitID),
+		// Gitea 28.0.0 ends at migration ID number 355 (database version 356)
+		// HERE: 2 migrations from 29 are added since they don't change database structure
+		newMigration(356, "Add index on action_run commit_sha", v29.AddActionRunCommitSHAIndex),
+		newMigration(357, "Normalize legacy team authorize values", v29.NormalizeLegacyTeamAuthorize),
 	}
 	return preparedMigrations
 }

modelmigration/v29/main_test.go

@@ -0,0 +1,14 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"testing"
+
+	"gitea.dev/modelmigration/migrationtest"
+)
+
+func TestMain(m *testing.M) {
+	migrationtest.MainTest(m)
+}

modelmigration/v29/v356.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"context"
+
+	"gitea.dev/modelmigration/base"
+
+	"xorm.io/xorm"
+)
+
+// AddActionRunCommitSHAIndex indexes the runs lookup by commit, which the API `head_sha` filter uses.
+func AddActionRunCommitSHAIndex(_ context.Context, x base.EngineMigration) error {
+	type ActionRun struct {
+		CommitSHA string `xorm:"index"`
+	}
+
+	_, err := x.SyncWithOptions(xorm.SyncOptions{
+		IgnoreDropIndices: true,
+		IgnoreConstrains:  true,
+	}, new(ActionRun))
+	return err
+}

modelmigration/v29/v357.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"context"
+
+	"gitea.dev/modelmigration/base"
+)
+
+// NormalizeLegacyTeamAuthorize sets leftover read/write authorize values to none.
+// https://github.com/go-gitea/gitea/pull/34128 made non-admin teams use team_unit (authorize=none).
+// authorize>=write now means blanket access on every unit; migrating legacy read/write
+// to none preserves their existing team_unit-scoped access.
+func NormalizeLegacyTeamAuthorize(_ context.Context, x base.EngineMigration) error {
+	// AccessModeNone=0, AccessModeRead=1, AccessModeWrite=2, AccessModeAdmin=3
+	_, err := x.Exec(`
+UPDATE team SET authorize = 0
+WHERE authorize > 0 AND authorize < 3
+	AND EXISTS (
+		SELECT 1 FROM team_unit WHERE team_unit.team_id = team.id
+  );`)
+	return err
+}

modelmigration/v29/v357_test.go

@@ -0,0 +1,55 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"testing"
+
+	"gitea.dev/modelmigration/migrationtest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeLegacyTeamAuthorize(t *testing.T) {
+	type Team struct {
+		ID        int64 `xorm:"pk"`
+		Authorize int
+	}
+	type TeamUnit struct {
+		ID     int64 `xorm:"pk"`
+		TeamID int64 `xorm:"INDEX"`
+	}
+
+	x, deferrable := migrationtest.PrepareTestEnv(t, 0, new(Team), new(TeamUnit))
+	defer deferrable()
+	if x == nil || t.Failed() {
+		return
+	}
+
+	_, err := x.Insert(
+		&Team{ID: 1, Authorize: 4},
+		&Team{ID: 2, Authorize: 3},
+		&Team{ID: 3, Authorize: 2},
+		&Team{ID: 4, Authorize: 1},
+		&Team{ID: 5, Authorize: 0},
+
+		&TeamUnit{TeamID: 3},
+	)
+	require.NoError(t, err)
+	require.NoError(t, NormalizeLegacyTeamAuthorize(t.Context(), x))
+
+	get := func(id int64) int {
+		tBean := &Team{ID: id}
+		has, err := x.Get(tBean)
+		require.NoError(t, err)
+		require.True(t, has)
+		return tBean.Authorize
+	}
+	assert.Equal(t, 4, get(1))
+	assert.Equal(t, 3, get(2))
+	assert.Equal(t, 0, get(3)) // has team unit, reset to none
+	assert.Equal(t, 1, get(4)) // no team unit, kept
+	assert.Equal(t, 0, get(5))
+}

models/actions/artifact.go

@@ -93,7 +93,12 @@ const artifactKeepForever timeutil.TimeStamp = 0
 
 func artifactExpiry(requested optional.Option[timeutil.TimeStamp]) timeutil.TimeStamp {
 	if requested.Has() {
-		return max(requested.Value(), artifactKeepForever+1)
+		now := timeutil.TimeStampNow()
+		expiry := max(requested.Value(), now.Add(timeutil.Day)) // v4 clients use the runner's clock
+		if setting.Actions.ArtifactRetentionDays > 0 {
+			expiry = min(expiry, now.Add(timeutil.Day*setting.Actions.ArtifactRetentionDays))
+		}
+		return expiry
 	}
 	if setting.Actions.ArtifactRetentionDays <= 0 {
 		return artifactKeepForever

models/actions/artifact_test.go

@@ -5,6 +5,12 @@ package actions
 
 import (
 	"testing"
+	"time"
+
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -25,3 +31,21 @@ func TestKeepLatestAttemptArtifacts(t *testing.T) {
 	}
 	assert.Equal(t, []int64{1, 4, 5}, ids)
 }
+
+func TestArtifactExpiry(t *testing.T) {
+	defer timeutil.MockSet(time.Unix(1_000_000_000, 0))()
+	now := timeutil.TimeStampNow()
+	days := func(n int64) timeutil.TimeStamp { return now.Add(n * timeutil.Day) }
+	requested := optional.Some[timeutil.TimeStamp]
+
+	defer test.MockVariableValue(&setting.Actions.ArtifactRetentionDays, 90)()
+	assert.Equal(t, days(90), artifactExpiry(optional.None[timeutil.TimeStamp]()))
+	assert.Equal(t, days(5), artifactExpiry(requested(days(5))))
+	assert.Equal(t, days(1), artifactExpiry(requested(days(-2))), "runner clock behind must not expire the artifact at once")
+	assert.Equal(t, days(90), artifactExpiry(requested(days(1000))), "runner must not exceed the instance retention")
+
+	setting.Actions.ArtifactRetentionDays = 0
+	assert.Equal(t, artifactKeepForever, artifactExpiry(optional.None[timeutil.TimeStamp]()))
+	assert.Equal(t, days(1000), artifactExpiry(requested(days(1000))))
+	assert.Equal(t, days(1), artifactExpiry(requested(now)))
+}

models/actions/run.go

@@ -34,14 +34,14 @@ type ActionRun struct {
 	RepoID            int64                  `xorm:"unique(repo_index) index(repo_status)"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	OwnerID           int64                  `xorm:"index"`
-	WorkflowID        string                 `xorm:"index"`                    // the name of workflow file
-	Index             int64                  `xorm:"index unique(repo_index)"` // a unique number for each run of a repository
+	WorkflowID        string                 `xorm:"index"`              // the name of workflow file
+	Index             int64                  `xorm:"unique(repo_index)"` // a unique number for each run of a repository
 	TriggerUserID     int64                  `xorm:"index"`
 	TriggerUser       *user_model.User       `xorm:"-"`
 	ScheduleID        int64
-	Ref               string `xorm:"index"` // the commit/tag/… that caused the run
-	IsRefDeleted      bool   `xorm:"-"`
-	CommitSHA         string
+	Ref               string                       `xorm:"index"` // the commit/tag/… that caused the run
+	IsRefDeleted      bool                         `xorm:"-"`
+	CommitSHA         string                       `xorm:"index"`
 	IsForkPullRequest bool                         // If this is triggered by a PR from a forked repository or an untrusted user, we need to check if it is approved and limit permissions when running the workflow.
 	NeedApproval      bool                         // may need approval if it's a fork pull request
 	ApprovedBy        int64                        `xorm:"index"` // who approved
@@ -295,9 +295,8 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }
 
-func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
-	var runs []*ActionRun
-	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
+func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) (runs []*ActionRun, err error) {
+	err = db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).OrderBy("id").Find(&runs)
 	return runs, err
 }
 

models/actions/run_job.go

@@ -25,7 +25,6 @@ import (
 
 // MaxJobNumPerRun is the maximum number of jobs in a single run.
 // https://docs.github.com/en/actions/reference/limits#existing-system-limits
-// TODO: check this limit when creating jobs
 const MaxJobNumPerRun = 256
 
 // ActionRunJob represents a job of a run
@@ -100,7 +99,7 @@ type ActionRunJob struct {
 
 	// IsReusableCaller marks this job as a reusable workflow caller.
 	// Caller jobs do not run on a runner; their status is derived from their child jobs.
-	IsReusableCaller bool `xorm:"index NOT NULL DEFAULT FALSE"`
+	IsReusableCaller bool `xorm:"NOT NULL DEFAULT FALSE"`
 	// IsExpanded reports whether this job's lazy expansion (children-row insertion) is complete.
 	// For a reusable workflow caller, true means children rows exist and CallPayload is populated.
 	IsExpanded bool `xorm:"NOT NULL DEFAULT FALSE"`
@@ -440,14 +439,6 @@ func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*
 	return out
 }
 
-// hasWaitingJobsToPick reports whether any waiting, unclaimed, non-reusable job
-// remains in the repo, i.e. work that an idle runner could still pick up.
-func hasWaitingJobsToPick(ctx context.Context, repoID int64) (bool, error) {
-	return db.GetEngine(ctx).
-		Where("repo_id = ? AND task_id = ? AND status = ? AND is_reusable_caller = ?", repoID, 0, StatusWaiting, false).
-		Exist(&ActionRunJob{})
-}
-
 func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, cols ...string) (int64, error) {
 	e := db.GetEngine(ctx)
 
@@ -498,7 +489,7 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 			// Only bump when waiting work actually remains for this repo, otherwise
 			// every job completion would needlessly bump the global version and wake
 			// every idle runner instance-wide for nothing.
-			hasWaiting, err := hasWaitingJobsToPick(ctx, job.RepoID)
+			hasWaiting, err := JobQueueOptions{RepoID: job.RepoID, Status: StatusWaiting}.session(ctx).Exist(new(ActionRunJob))
 			if err != nil {
 				return 0, err
 			}
@@ -853,25 +844,34 @@ func cancelReusableCaller(ctx context.Context, caller *ActionRunJob, force bool)
 	}
 
 	// Cancel descendants deepest-first, then the caller: a caller's status is aggregated from its children,
-	// so each child must reach its final state before its parent caller is re-aggregated.
+	// so each child must be cancelled before its parent caller is re-read.
 	// A child's ID always exceeds its parent's, so descending ID is a valid deepest-first order.
 	descendants := CollectAllDescendantJobs(caller, attemptJobs)
 	slices.SortFunc(descendants, func(a, b *ActionRunJob) int { return cmp.Compare(b.ID, a.ID) })
+	callersWithChildren := make(container.Set[int64])
+	for _, d := range descendants {
+		callersWithChildren.Add(d.ParentJobID)
+	}
 
-	for _, c := range descendants {
-		cancelled, err := cancelOneJob(ctx, c, force)
+	for _, job := range append(descendants, caller) {
+		if !callersWithChildren.Contains(job.ID) {
+			cancelled, err := cancelOneJob(ctx, job, force)
+			if err != nil {
+				return cancelledJobs, err
+			}
+			if cancelled != nil {
+				cancelledJobs = append(cancelledJobs, cancelled)
+			}
+			continue
+		}
+		// the job is a caller and its children's cascade already re-aggregated it
+		reloaded, err := GetRunJobByRunAndID(ctx, job.RunID, job.ID)
 		if err != nil {
 			return cancelledJobs, err
 		}
-		if cancelled != nil {
-			cancelledJobs = append(cancelledJobs, cancelled)
+		if reloaded.Status != job.Status {
+			cancelledJobs = append(cancelledJobs, reloaded)
 		}
 	}
-
-	if c, err := cancelOneJob(ctx, caller, force); err != nil {
-		return cancelledJobs, err
-	} else if c != nil {
-		cancelledJobs = append(cancelledJobs, c)
-	}
 	return cancelledJobs, nil
 }

models/actions/run_job_queue.go

@@ -27,13 +27,12 @@ func (opts JobQueueOptions) session(ctx context.Context) *xorm.Session {
 		sess = sess.And(builder.Eq{"`action_run_job`.repo_id": opts.RepoID})
 	}
 	if opts.OwnerID > 0 {
-		sess = sess.Join("INNER", "repository", "repository.id = `action_run_job`.repo_id AND repository.owner_id = ?", opts.OwnerID)
+		sess = sess.And(builder.In("`action_run_job`.repo_id", builder.Select("id").From("repository").Where(builder.Eq{"owner_id": opts.OwnerID})))
 	}
 	return sess.And(opts.statusCond())
 }
 
 var (
-	// keep in sync with CreateTaskForRunner
 	queuedJobsCond = builder.Eq{"`action_run_job`.status": StatusWaiting, "`action_run_job`.task_id": 0}
 	// a cancelling job still occupies its runner
 	runningJobsCond = builder.In("`action_run_job`.status", StatusRunning, StatusCancelling)

models/actions/run_job_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"testing"
 
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/timeutil"
@@ -397,3 +398,72 @@ func TestForceCancelJobs(t *testing.T) {
 		assert.Equal(t, StatusCancelled, callerAfter.Status)
 	})
 }
+
+func TestCancelJobs_CallerWaitsForCancellingChild(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	run := &ActionRun{
+		Title:         "caller-cancelling-child",
+		RepoID:        4,
+		Index:         9811,
+		OwnerID:       1,
+		WorkflowID:    "test.yaml",
+		TriggerUserID: 1,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		EventPayload:  "{}",
+		Status:        StatusRunning,
+	}
+	require.NoError(t, db.Insert(ctx, run))
+	attempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 1, TriggerUserID: 1, Status: StatusRunning}
+	require.NoError(t, db.Insert(ctx, attempt))
+	run.LatestAttemptID = attempt.ID
+	require.NoError(t, UpdateRun(ctx, run, "latest_attempt_id"))
+
+	newJob := func(name string, parentID int64, isCaller bool) *ActionRunJob {
+		job := &ActionRunJob{
+			RunID:            run.ID,
+			RunAttemptID:     attempt.ID,
+			RepoID:           run.RepoID,
+			OwnerID:          run.OwnerID,
+			CommitSHA:        run.CommitSHA,
+			Name:             name,
+			JobID:            name,
+			Attempt:          1,
+			Status:           StatusRunning,
+			ParentJobID:      parentID,
+			IsReusableCaller: isCaller,
+			IsExpanded:       isCaller,
+		}
+		require.NoError(t, db.Insert(ctx, job))
+		return job
+	}
+	outer := newJob("outer", 0, true)
+	inner := newJob("inner", outer.ID, true)
+	child := newJob("child", inner.ID, false)
+
+	runner := &ActionRunner{UUID: "caller-cancelling-child", Name: "caller-cancelling-child", HasCancellingSupport: true}
+	require.NoError(t, db.Insert(ctx, runner))
+	task := &ActionTask{JobID: child.ID, Attempt: 1, RunnerID: runner.ID, Status: StatusRunning, Started: timeutil.TimeStampNow(), RepoID: run.RepoID, OwnerID: run.OwnerID, CommitSHA: run.CommitSHA}
+	require.NoError(t, db.Insert(ctx, task))
+	child.TaskID = task.ID
+	_, err := UpdateRunJob(ctx, child, nil, "task_id")
+	require.NoError(t, err)
+
+	cancelled, err := CancelJobs(ctx, []*ActionRunJob{outer}, false)
+	require.NoError(t, err)
+	assert.Len(t, cancelled, 3)
+	for _, job := range []*ActionRunJob{outer, inner, child} {
+		assert.Equal(t, StatusCancelling, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status, job.Name)
+	}
+
+	_, err = UpdateTaskByState(ctx, runner.ID, &runnerv1.TaskState{Id: task.ID, Result: runnerv1.Result_RESULT_CANCELLED})
+	require.NoError(t, err)
+	for _, job := range []*ActionRunJob{outer, inner, child} {
+		assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status, job.Name)
+	}
+	assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID}).Status)
+}

models/actions/schedule.go

@@ -11,6 +11,7 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
 	webhook_module "gitea.dev/modules/webhook"
@@ -110,7 +111,7 @@ func CleanRepoScheduleTasks(ctx context.Context, repo *repo_model.Repository) ([
 	jobs, err := CancelPreviousJobs(
 		ctx,
 		repo.ID,
-		repo.DefaultBranch,
+		git.RefNameFromBranch(repo.DefaultBranch).String(),
 		"",
 		webhook_module.HookEventSchedule,
 	)

models/actions/scoped_workflow.go

@@ -65,26 +65,22 @@ func (opts FindScopedWorkflowSourceOpts) ToConds() builder.Cond {
 	if opts.SourceRepoID != 0 {
 		cond = cond.And(builder.Eq{"source_repo_id": opts.SourceRepoID})
 	}
-	return cond
+	return cond.And(scopedWorkflowSourceOwnedCond())
+}
+
+func scopedWorkflowSourceOwnedCond() builder.Cond {
+	return builder.Eq{"owner_id": 0}.Or(builder.Expr("EXISTS (SELECT 1 FROM repository WHERE repository.id = action_scoped_workflow_source.source_repo_id AND repository.owner_id = action_scoped_workflow_source.owner_id)"))
 }
 
 // GetEffectiveScopedWorkflowSources returns the scoped-workflow sources effective for a repo owned by repoOwnerID:
 // the owner's own sources plus instance-level (owner_id=0) sources.
 func GetEffectiveScopedWorkflowSources(ctx context.Context, repoOwnerID int64) ([]*ActionScopedWorkflowSource, error) {
-	owners := []int64{0}
-	if repoOwnerID != 0 {
-		owners = append(owners, repoOwnerID)
-	}
-	return db.Find[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: owners})
+	return db.Find[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: []int64{0, repoOwnerID}})
 }
 
 // IsScopedWorkflowSourceEffective reports whether sourceRepoID is a scoped-workflow source effective for a repo owned by repoOwnerID.
 func IsScopedWorkflowSourceEffective(ctx context.Context, repoOwnerID, sourceRepoID int64) (bool, error) {
-	owners := []int64{0}
-	if repoOwnerID != 0 {
-		owners = append(owners, repoOwnerID)
-	}
-	return db.Exist[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: owners, SourceRepoID: sourceRepoID}.ToConds())
+	return db.Exist[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: []int64{0, repoOwnerID}, SourceRepoID: sourceRepoID}.ToConds())
 }
 
 // IsWorkflowRequiredInSources reports whether workflowID from sourceRepoID is required by any of the given sources.
@@ -138,12 +134,10 @@ func GetScopedWorkflowSourcesByOwner(ctx context.Context, ownerID int64) ([]*Act
 
 // GetScopedWorkflowSource returns the (owner, repo) source registration or a NotExist error.
 func GetScopedWorkflowSource(ctx context.Context, ownerID, repoID int64) (*ActionScopedWorkflowSource, error) {
-	src := &ActionScopedWorkflowSource{}
-	has, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Get(src)
+	src, has, err := db.Get[ActionScopedWorkflowSource](ctx, builder.Eq{"owner_id": ownerID, "source_repo_id": repoID}.And(scopedWorkflowSourceOwnedCond()))
 	if err != nil {
 		return nil, err
-	}
-	if !has {
+	} else if !has {
 		return nil, util.NewNotExistErrorf("scoped workflow source (owner %d, repo %d) does not exist", ownerID, repoID)
 	}
 	return src, nil
@@ -181,3 +175,9 @@ func RemoveScopedWorkflowSource(ctx context.Context, ownerID, repoID int64) erro
 	_, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Delete(new(ActionScopedWorkflowSource))
 	return err
 }
+
+// RemoveOwnerScopedWorkflowSources removes every owner-level registration of repoID, as only its current owner may hold one.
+func RemoveOwnerScopedWorkflowSources(ctx context.Context, repoID int64) error {
+	_, err := db.GetEngine(ctx).Where("owner_id <> 0 AND source_repo_id = ?", repoID).Delete(new(ActionScopedWorkflowSource))
+	return err
+}

models/actions/scoped_workflow_test.go

@@ -48,26 +48,28 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	ctx := t.Context()
 
-	rows := []*ActionScopedWorkflowSource{
-		{OwnerID: 2, SourceRepoID: 100, WorkflowConfigs: nil}, // org 2 registers repo 100 (optional)
-		{OwnerID: 0, SourceRepoID: 100, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"a.yml": {Required: true, Patterns: []string{"p"}}}}, // instance also registers repo 100 (required)
-		{OwnerID: 0, SourceRepoID: 200, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"b.yml": {Required: true, Patterns: []string{"p"}}}}, // instance source 200
-		{OwnerID: 3, SourceRepoID: 300, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"c.yml": {Required: true, Patterns: []string{"p"}}}}, // a different owner's source
-	}
-	for _, r := range rows {
-		require.NoError(t, db.Insert(ctx, r))
+	for _, source := range []*ActionScopedWorkflowSource{
+		{OwnerID: 2, SourceRepoID: 1},
+		{OwnerID: 0, SourceRepoID: 1, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"a.yml": {Required: true}}},
+		{OwnerID: 0, SourceRepoID: 200, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"b.yml": {Required: true}}},
+		{OwnerID: 3, SourceRepoID: 3, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"c.yml": {Required: true}}},
+		{OwnerID: 2, SourceRepoID: 3, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"c.yml": {Required: true}}},
+	} {
+		require.NoError(t, db.Insert(ctx, source))
 	}
 
 	// owner 2 sees its own sources plus instance-level ones, but not owner 3's.
 	owner2, err := GetEffectiveScopedWorkflowSources(ctx, 2)
 	require.NoError(t, err)
 	assert.Len(t, owner2, 3)
+	_, err = GetScopedWorkflowSource(ctx, 2, 3)
+	assert.ErrorIs(t, err, util.ErrNotExist)
 
-	required, err := IsScopedWorkflowRequired(ctx, 2, 100, "a.yml")
+	required, err := IsScopedWorkflowRequired(ctx, 2, 1, "a.yml")
 	require.NoError(t, err)
 	assert.True(t, required, "instance marks a.yml required → required for owner 2 even though org left it optional")
 
-	required, err = IsScopedWorkflowRequired(ctx, 2, 100, "x.yml")
+	required, err = IsScopedWorkflowRequired(ctx, 2, 1, "x.yml")
 	require.NoError(t, err)
 	assert.False(t, required)
 
@@ -76,12 +78,12 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	assert.True(t, required)
 
 	// owner 3's source must not be effective for owner 2.
-	required, err = IsScopedWorkflowRequired(ctx, 2, 300, "c.yml")
+	required, err = IsScopedWorkflowRequired(ctx, 2, 3, "c.yml")
 	require.NoError(t, err)
 	assert.False(t, required)
 
 	// IsScopedWorkflowSourceEffective: owner-level and instance-level sources are effective; another owner's is not.
-	effective, err := IsScopedWorkflowSourceEffective(ctx, 2, 100)
+	effective, err := IsScopedWorkflowSourceEffective(ctx, 2, 1)
 	require.NoError(t, err)
 	assert.True(t, effective, "owner 2's own source")
 
@@ -89,7 +91,7 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	require.NoError(t, err)
 	assert.True(t, effective, "instance-level source is effective for any owner")
 
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 2, 300)
+	effective, err = IsScopedWorkflowSourceEffective(ctx, 2, 3)
 	require.NoError(t, err)
 	assert.False(t, effective, "owner 3's source is not effective for owner 2")
 
@@ -97,7 +99,7 @@ func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
 	require.NoError(t, err)
 	assert.False(t, effective, "unknown source repo")
 
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 3, 300)
+	effective, err = IsScopedWorkflowSourceEffective(ctx, 3, 3)
 	require.NoError(t, err)
 	assert.True(t, effective, "owner 3's own source is effective for owner 3")
 }
@@ -107,8 +109,8 @@ func TestScopedWorkflowSourceCRUD(t *testing.T) {
 	ctx := t.Context()
 
 	// add is idempotent
-	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 10))
-	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 10))
+	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 4))
+	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 4))
 	sources, err := GetScopedWorkflowSourcesByOwner(ctx, 5)
 	require.NoError(t, err)
 	assert.Len(t, sources, 1)
@@ -118,20 +120,20 @@ func TestScopedWorkflowSourceCRUD(t *testing.T) {
 		"a.yml": {Required: true, Patterns: []string{"src: a.yml / *"}},
 		"b.yml": {Required: false, Patterns: []string{"src: b.yml / build (push)"}},
 	}
-	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 10, configs))
-	src, err := GetScopedWorkflowSource(ctx, 5, 10)
+	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 4, configs))
+	src, err := GetScopedWorkflowSource(ctx, 5, 4)
 	require.NoError(t, err)
 	assert.Equal(t, configs, src.WorkflowConfigs)
 
 	// clearing the configs works
-	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 10, nil))
-	src, err = GetScopedWorkflowSource(ctx, 5, 10)
+	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 4, nil))
+	src, err = GetScopedWorkflowSource(ctx, 5, 4)
 	require.NoError(t, err)
 	assert.Empty(t, src.WorkflowConfigs)
 
 	// remove
-	require.NoError(t, RemoveScopedWorkflowSource(ctx, 5, 10))
-	_, err = GetScopedWorkflowSource(ctx, 5, 10)
+	require.NoError(t, RemoveScopedWorkflowSource(ctx, 5, 4))
+	_, err = GetScopedWorkflowSource(ctx, 5, 4)
 	assert.ErrorIs(t, err, util.ErrNotExist)
 	sources, err = GetScopedWorkflowSourcesByOwner(ctx, 5)
 	require.NoError(t, err)

models/actions/task.go

@@ -236,13 +236,13 @@ func GetRunningTaskByToken(ctx context.Context, token string) (*ActionTask, erro
 
 func makeTaskStepDisplayName(step *jobparser.Step, limit int) (name string) {
 	if step.Name != "" {
-		name = string(step.Name) // the step has an explicit name
+		name = step.Name // the step has an explicit name
 	} else {
 		// for unnamed step, its "String()" method tries to get a display name by its "name", "uses",
 		// "run" or "id" (last fallback), we add the "Run " prefix for unnamed steps for better display
 		// for multi-line "run" scripts, only use the first line to match GitHub's behavior
 		// https://github.com/actions/runner/blob/66800900843747f37591b077091dd2c8cf2c1796/src/Runner.Worker/Handlers/ScriptHandler.cs#L45-L58
-		runStr, _, _ := strings.Cut(strings.TrimSpace(string(step.Run)), "\n")
+		runStr, _, _ := strings.Cut(strings.TrimSpace(step.Run), "\n")
 		name = "Run " + util.IfZero(strings.TrimSpace(runStr), step.String())
 	}
 	return util.EllipsisDisplayString(name, limit) // database column has a length limit
@@ -261,21 +261,10 @@ var pickTaskBatchSize = 100
 // atomically claims it. It iterates through all matching jobs so that a
 // concurrent claim by another runner (which would lose the optimistic lock on
 // job #1) does not leave the remaining jobs permanently unassigned.
-func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask, bool, error) {
+func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (task *ActionTask, cancelledJobs []*ActionRunJob, err error) {
 	if db.InTransaction(ctx) {
-		return nil, false, errors.New("CreateTaskForRunner must not be called within a database transaction")
+		return nil, nil, errors.New("CreateTaskForRunner must not be called within a database transaction")
 	}
-	e := db.GetEngine(ctx)
-
-	jobCond := builder.NewCond()
-	if runner.RepoID != 0 {
-		jobCond = builder.Eq{"repo_id": runner.RepoID}
-	} else if runner.OwnerID != 0 {
-		jobCond = builder.In("repo_id", builder.Select("`repository`.id").From("repository").
-			Join("INNER", "repo_unit", "`repository`.id = `repo_unit`.repo_id").
-			Where(builder.Eq{"`repository`.owner_id": runner.OwnerID, "`repo_unit`.type": unit.TypeActions}))
-	}
-	baseCond := builder.Eq{"task_id": 0, "status": StatusWaiting, "is_reusable_caller": false}.And(jobCond)
 
 	// TODO: a more efficient way to filter labels
 	log.Trace("runner labels: %v", runner.AgentLabels)
@@ -286,48 +275,52 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 	var cursorUpdated timeutil.TimeStamp
 	var cursorID int64
 	for {
-		cond := baseCond
+		sess := JobQueueOptions{RepoID: runner.RepoID, OwnerID: runner.OwnerID, Status: StatusWaiting}.session(ctx)
 		if cursorID > 0 {
-			cond = cond.And(builder.Or(
+			sess.And(builder.Or(
 				builder.Gt{"updated": cursorUpdated},
 				builder.And(builder.Eq{"updated": cursorUpdated}, builder.Gt{"id": cursorID}),
 			))
 		}
 
 		var jobs []*ActionRunJob
-		if err := e.Where(cond).Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
-			return nil, false, err
+		if err := sess.Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
+			return nil, cancelledJobs, err
+		}
+		// A short page means no waiting jobs remain beyond it.
+		isLastPage := len(jobs) < pickTaskBatchSize
+		if !isLastPage {
+			last := jobs[len(jobs)-1] // read before a lost claim bumps Updated
+			cursorUpdated, cursorID = last.Updated, last.ID
 		}
 
 		for _, v := range jobs {
 			if !runner.CanMatchLabels(v.RunsOn) {
 				continue
 			}
-			task, ok, err := claimJobForRunner(ctx, runner, v)
-			if err != nil {
-				return nil, false, err
+			task, cancelled, err := claimJobForRunner(ctx, runner, v)
+			if cancelled {
+				cancelledJobs = append(cancelledJobs, v)
 			}
-			if ok {
-				return task, true, nil
+			if err != nil || task != nil {
+				return task, cancelledJobs, err
 			}
-			// Another runner claimed this job concurrently; try the next one.
+			// Another runner claimed this job concurrently, or it was cancelled. Try the next one.
 		}
 
-		// A short page means no waiting jobs remain beyond it.
-		if len(jobs) < pickTaskBatchSize {
-			return nil, false, nil
+		if isLastPage {
+			return nil, cancelledJobs, nil
 		}
-		last := jobs[len(jobs)-1]
-		cursorUpdated, cursorID = last.Updated, last.ID
 	}
 }
 
 // claimJobForRunner attempts to atomically claim job for runner inside its own
-// transaction. Returns (task, true, nil) on success, or (nil, false, nil) when
-// another runner wins the optimistic-lock race (the caller should try the next
-// candidate job).
+// transaction. Returns the task on success, cancelled when the job's repository
+// has Actions disabled, or neither when another runner wins the optimistic-lock
+// race (the caller should try the next candidate job).
 func claimJobForRunner(ctx context.Context, runner *ActionRunner, job *ActionRunJob) (*ActionTask, bool, error) {
 	var resultTask *ActionTask
+	var cancelled bool
 
 	err := db.WithTx(ctx, func(ctx context.Context) error {
 		e := db.GetEngine(ctx)
@@ -335,6 +328,15 @@ func claimJobForRunner(ctx context.Context, runner *ActionRunner, job *ActionRun
 		if err := job.LoadAttributes(ctx); err != nil {
 			return err
 		}
+		if err := job.Run.Repo.LoadUnits(ctx); err != nil {
+			return err
+		}
+		if !job.Run.Repo.UnitEnabled(ctx, unit.TypeActions) {
+			job.Status, job.Stopped = StatusCancelled, timeutil.TimeStampNow()
+			affected, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0, "status": StatusWaiting}, "status", "stopped")
+			cancelled = err == nil && affected == 1
+			return err
+		}
 
 		now := timeutil.TimeStampNow()
 		job.Started = now
@@ -400,13 +402,10 @@ func claimJobForRunner(ctx context.Context, runner *ActionRunner, job *ActionRun
 		return nil
 	})
 
-	if errors.Is(err, errJobAlreadyClaimed) {
-		return nil, false, nil
-	}
-	if err != nil {
+	if err != nil && !errors.Is(err, errJobAlreadyClaimed) {
 		return nil, false, err
 	}
-	return resultTask, true, nil
+	return resultTask, cancelled, nil
 }
 
 // ReleaseTaskForRunner reverts a freshly-claimed but undelivered task: it deletes

models/actions/task_test.go

@@ -13,6 +13,7 @@ import (
 	runnerv1 "gitea.dev/actionslib/runner/v1"
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/timeutil"
@@ -94,14 +95,14 @@ func TestMakeTaskStepDisplayName(t *testing.T) {
 		{
 			name: "very long name truncated",
 			jobStep: &jobparser.Step{
-				Name: jobparser.BlockSafeString(strings.Repeat("a", 300)),
+				Name: strings.Repeat("a", 300),
 			},
 			expected: strings.Repeat("a", 252) + "…",
 		},
 		{
 			name: "very long run truncated",
 			jobStep: &jobparser.Step{
-				Run: jobparser.BlockSafeString(strings.Repeat("a", 300)),
+				Run: strings.Repeat("a", 300),
 			},
 			expected: "Run " + strings.Repeat("a", 248) + "…",
 		},
@@ -258,6 +259,11 @@ func TestReleaseTaskForRunner(t *testing.T) {
 	}
 	require.NoError(t, db.Insert(t.Context(), run))
 
+	disabledRun := &ActionRun{RepoID: 2, TriggerUserID: 2}
+	require.NoError(t, db.Insert(t.Context(), disabledRun))
+	disabledJob := &ActionRunJob{RunID: disabledRun.ID, RepoID: 2, Status: StatusWaiting, RunsOn: []string{"ubuntu-latest"}}
+	require.NoError(t, db.Insert(t.Context(), disabledJob))
+
 	job := &ActionRunJob{
 		RunID:           run.ID,
 		RepoID:          run.RepoID,
@@ -279,11 +285,13 @@ func TestReleaseTaskForRunner(t *testing.T) {
 	}
 	runner.GenerateAndFillToken()
 	require.NoError(t, db.Insert(t.Context(), runner))
+	require.NoError(t, db.Insert(t.Context(), &repo_model.RepoUnit{RepoID: run.RepoID, Type: unit.TypeActions}))
 
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
+	task, cancelledJobs, err := CreateTaskForRunner(t.Context(), runner)
 	require.NoError(t, err)
-	require.True(t, ok)
 	require.NotNil(t, task)
+	require.Len(t, cancelledJobs, 1)
+	assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: disabledJob.ID}).Status)
 
 	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
 	require.Equal(t, StatusRunning, claimed.Status)
@@ -324,6 +332,11 @@ func TestCreateTaskForRunnerPagination(t *testing.T) {
 	}
 	require.NoError(t, db.Insert(t.Context(), run))
 
+	disabledRun := &ActionRun{RepoID: 2, TriggerUserID: 2}
+	require.NoError(t, db.Insert(t.Context(), disabledRun))
+	disabledJob := &ActionRunJob{RunID: disabledRun.ID, RepoID: 2, Status: StatusWaiting, RunsOn: []string{"ubuntu-latest"}}
+	require.NoError(t, db.Insert(t.Context(), disabledJob))
+
 	// Five waiting jobs the runner cannot run, then one it can.
 	// With a page size of 2 the matching job only appears on the third page.
 	for i := range 5 {
@@ -362,11 +375,13 @@ func TestCreateTaskForRunnerPagination(t *testing.T) {
 	}
 	runner.GenerateAndFillToken()
 	require.NoError(t, db.Insert(t.Context(), runner))
+	require.NoError(t, db.Insert(t.Context(), &repo_model.RepoUnit{RepoID: run.RepoID, Type: unit.TypeActions}))
 
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
+	task, cancelledJobs, err := CreateTaskForRunner(t.Context(), runner)
 	require.NoError(t, err)
-	require.True(t, ok)
 	require.NotNil(t, task)
+	require.Len(t, cancelledJobs, 1)
+	assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: disabledJob.ID}).Status)
 
 	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: target.ID})
 	assert.Equal(t, StatusRunning, claimed.Status)

models/activities/notification.go

@@ -180,15 +180,14 @@ func updateIssueNotification(ctx context.Context, userID, issueID, commentID, up
 	}
 
 	// NOTICE: Only update comment id when the before notification on this issue is read, otherwise you may miss some old comments.
-	// But we need update update_by so that the notification will be reorder
-	var cols []string
+	// Always update so that updated_unix moves the notification to the top of the list
+	// Actually, it's unclear what UpdatedBy is used for, or maybe not used at all, or maybe it should just be dropped.
+	notification.UpdatedBy = updatedByID
+	cols := []string{"updated_by"}
 	if notification.Status == NotificationStatusRead {
 		notification.Status = NotificationStatusUnread
 		notification.CommentID = commentID
-		cols = []string{"status", "update_by", "comment_id"}
-	} else {
-		notification.UpdatedBy = updatedByID
-		cols = []string{"update_by"}
+		cols = append(cols, "status", "comment_id")
 	}
 
 	_, err = db.GetEngine(ctx).ID(notification.ID).Cols(cols...).Update(notification)

models/activities/notification_list.go

@@ -71,16 +71,6 @@ func (opts FindNotificationOptions) ToOrders() string {
 // receiverID > 0 just send to receiver, else send to all watcher
 // Returns the set of user IDs whose notification rows were created or updated.
 func CreateOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) ([]int64, error) {
-	var notifiedIDs []int64
-	err := db.WithTx(ctx, func(ctx context.Context) error {
-		var innerErr error
-		notifiedIDs, innerErr = createOrUpdateIssueNotifications(ctx, issueID, commentID, notificationAuthorID, receiverID)
-		return innerErr
-	})
-	return notifiedIDs, err
-}
-
-func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, notificationAuthorID, receiverID int64) ([]int64, error) {
 	// init
 	var toNotify container.Set[int64]
 	notifications, err := db.Find[Notification](ctx, FindNotificationOptions{
@@ -181,7 +171,11 @@ func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, n
 		if notificationExists(notifications, issue.ID, userID) {
 			err = updateIssueNotification(ctx, userID, issue.ID, commentID, notificationAuthorID)
 		} else {
-			err = createIssueNotification(ctx, userID, issue, commentID, notificationAuthorID)
+			if err = createIssueNotification(ctx, userID, issue, commentID, notificationAuthorID); err != nil {
+				if errUpdate := updateIssueNotification(ctx, userID, issue.ID, commentID, notificationAuthorID); errUpdate == nil {
+					err = nil
+				}
+			}
 		}
 		if err != nil {
 			return nil, err

models/activities/notification_test.go

@@ -31,6 +31,18 @@ func TestCreateOrUpdateIssueNotifications(t *testing.T) {
 
 	notf = unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{UserID: 4, IssueID: issue.ID})
 	assert.Equal(t, activities_model.NotificationStatusUnread, notf.Status)
+
+	// unread notification should get latest updated_unix when re-notified
+	_, err = db.GetEngine(t.Context()).ID(notf.ID).NoAutoTime().Cols("updated_unix").Update(&activities_model.Notification{UpdatedUnix: 123})
+	assert.NoError(t, err)
+	notf = unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{ID: notf.ID})
+	assert.EqualValues(t, 123, notf.UpdatedUnix)
+
+	_, err = activities_model.CreateOrUpdateIssueNotifications(t.Context(), issue.ID, 0, 3, 0)
+	assert.NoError(t, err)
+	notf = unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{ID: notf.ID})
+	assert.NotEqualValues(t, 123, notf.UpdatedUnix)
+	assert.EqualValues(t, 3, notf.UpdatedBy)
 }
 
 func TestCreateOrUpdateIssueNotificationsForAssigneeAndReviewer(t *testing.T) {

models/asymkey/gpg_key.go

@@ -85,7 +85,7 @@ func (opts FindGPGKeyOptions) ToConds() builder.Cond {
 		cond = cond.And(builder.Eq{"primary_key_id": ""})
 	}
 
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.KeyID != "" {

models/asymkey/ssh_key.go

@@ -199,7 +199,7 @@ func SearchPrincipalKey(ctx context.Context, principalKey string) (*PublicKey, e
 	// In the future, the existing principal keys should be migrated to use the fingerprint ("principal:{name}") instead of the content
 	key := new(PublicKey)
 	has, err := db.GetEngine(ctx).
-		Where("content = ?", principalKey).
+		Where("content = ? AND type = ?", principalKey, KeyTypePrincipal).
 		Get(key)
 	if err != nil {
 		return nil, err
@@ -224,7 +224,7 @@ func (opts FindPublicKeyOptions) ToOrders() string {
 
 func (opts FindPublicKeyOptions) ToConds() builder.Cond {
 	cond := builder.NewCond()
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.Fingerprint != "" {

models/asymkey/ssh_key_test.go

@@ -12,11 +12,13 @@ import (
 	"strings"
 	"testing"
 
+	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/setting"
 
 	"github.com/42wim/sshsig"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func Test_SSHParsePublicKey(t *testing.T) {
@@ -481,6 +483,20 @@ func TestPublicKeysAreExternallyManaged(t *testing.T) {
 	assert.False(t, externals[0])
 }
 
+func TestSearchPrincipalKeyIgnoresOtherKeyTypes(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	userKey := unittest.AssertExistsAndLoadBean(t, &PublicKey{ID: 1})
+
+	_, err := SearchPrincipalKey(t.Context(), userKey.Content)
+	assert.True(t, IsErrKeyNotExist(err))
+
+	principal := &PublicKey{OwnerID: 1, Name: userKey.Content, Content: userKey.Content, Type: KeyTypePrincipal}
+	require.NoError(t, db.Insert(t.Context(), principal))
+	key, err := SearchPrincipalKey(t.Context(), userKey.Content)
+	require.NoError(t, err)
+	assert.Equal(t, principal.ID, key.ID)
+}
+
 // TestCheckPublicKeyStringOversized tests if oversized SSH2 public key strings are rejected before triggering costly operations.
 func TestCheckPublicKeyStringOversized(t *testing.T) {
 	_, err := parseKeyString(strings.Repeat("a", maxKeyContentBytes+1))

models/auth/auth_token.go

@@ -44,9 +44,10 @@ func GetAuthTokenByID(ctx context.Context, id string) (*AuthToken, error) {
 	return at, nil
 }
 
-func UpdateAuthTokenByID(ctx context.Context, t *AuthToken) error {
-	_, err := db.GetEngine(ctx).ID(t.ID).Cols("token_hash", "expires_unix").Update(t)
-	return err
+func UpdateAuthTokenByID(ctx context.Context, t *AuthToken, oldHash string) (bool, error) {
+	affected, err := db.GetEngine(ctx).ID(t.ID).Where("token_hash = ?", oldHash).
+		Cols("token_hash", "expires_unix").Update(t)
+	return affected == 1, err
 }
 
 func DeleteAuthTokenByID(ctx context.Context, id string) error {

models/auth/oauth2.go

@@ -88,6 +88,16 @@ func BuiltinApplications() map[string]*BuiltinOAuth2Application {
 		DisplayName:  "Gitea App",
 		RedirectURIs: []string{"com.gitea.app://oauth/callback"},
 	}
+	m["75a9ec3e-42b5-40cb-9144-9ea96ecd56a6"] = &BuiltinOAuth2Application{
+		ConfigName:  "gitea-vscode",
+		DisplayName: "gitea-vscode",
+		RedirectURIs: []string{
+			"http://127.0.0.1",
+			"https://127.0.0.1",
+			"vscode://gitea.gitea-for-vscode/auth/callback",
+			"vscode-insiders://gitea.gitea-for-vscode/auth/callback",
+		},
+	}
 	return m
 }
 
@@ -564,6 +574,12 @@ func (grant *OAuth2Grant) SetNonce(ctx context.Context, nonce string) error {
 	return nil
 }
 
+func UpdateGrantScope(ctx context.Context, grant *OAuth2Grant, newScope string) error {
+	grant.Scope = newScope
+	_, err := db.GetEngine(ctx).ID(grant.ID).Cols("scope").Update(grant)
+	return err
+}
+
 // GetOAuth2GrantByID returns the grant with the given ID
 func GetOAuth2GrantByID(ctx context.Context, id int64) (grant *OAuth2Grant, err error) {
 	grant = new(OAuth2Grant)

models/auth/twofactor.go

@@ -12,8 +12,11 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
+	"strconv"
 
 	"gitea.dev/models/db"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/secret"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/timeutil"
@@ -48,6 +51,11 @@ func (err ErrTwoFactorNotEnrolled) Unwrap() error {
 	return util.ErrNotExist
 }
 
+const (
+	totpMaxAttempts = 5
+	totpAttemptsTTL = 15 * 60 // seconds, renewed by every failed attempt
+)
+
 // TwoFactor represents a two-factor authentication token.
 type TwoFactor struct {
 	ID               int64 `xorm:"pk autoincr"`
@@ -120,26 +128,59 @@ func (t *TwoFactor) validateTOTP(passcode string) (bool, error) {
 	return totp.Validate(passcode, secretStr), nil
 }
 
+type TwoFactorResult int
+
+const (
+	TwoFactorResultValid TwoFactorResult = iota + 1
+	TwoFactorResultInvalid
+	TwoFactorResultTooManyAttempts
+)
+
 // ValidateAndConsumeTOTP validates the passcode and atomically records it as used so that the
-// same passcode cannot be redeemed more than once (RFC 6238 §5.2). It returns false for an
-// invalid passcode as well as for a replay, including the case where a concurrent request with
-// the same passcode won the race first. All TOTP login surfaces must go through this helper.
-func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (bool, error) {
-	ok, err := t.validateTOTP(passcode)
-	if err != nil || !ok {
-		return false, err
+// same passcode cannot be redeemed more than once (RFC 6238 §5.2). Invalid passcodes and replays
+// return TwoFactorResultInvalid; exhausted attempts return TwoFactorResultTooManyAttempts.
+// All TOTP login surfaces must go through this helper.
+func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (result TwoFactorResult, err error) {
+	if passcode == "" {
+		// password-only Basic auth clients must not use up the attempts
+		return TwoFactorResultInvalid, nil
 	}
-	// Conditional update: only a row whose stored passcode differs from this one is updated, so a
-	// replay (or a concurrent duplicate) matches zero rows and is rejected. The row lock taken by
-	// the UPDATE serializes racing requests, closing the read-validate-write TOCTOU window.
-	t.LastUsedPasscode = passcode
-	n, err := db.GetEngine(ctx).ID(t.ID).
-		Where(builder.Or(builder.IsNull{"last_used_passcode"}, builder.Neq{"last_used_passcode": passcode})).
-		Cols("last_used_passcode").Update(t)
-	if err != nil {
-		return false, err
-	}
-	return n == 1, nil
+	// the lock spans check, validation and counting so that concurrent requests cannot exceed the limit
+	attemptsKey := fmt.Sprintf("twofa_attempts_%d", t.UID)
+	err = globallock.LockAndDo(ctx, attemptsKey, func(ctx context.Context) error {
+		value, _ := cache.GetCache().Get(attemptsKey)
+		attempts, _ := strconv.Atoi(value)
+		if attempts >= totpMaxAttempts {
+			result = TwoFactorResultTooManyAttempts
+			return nil
+		}
+
+		valid, err := t.validateTOTP(passcode)
+		if err != nil {
+			return err
+		}
+		if valid {
+			// Conditional update: only a row whose stored passcode differs from this one is updated, so a
+			// replay (or a concurrent duplicate) matches zero rows and is rejected. The row lock taken by
+			// the UPDATE serializes racing requests, closing the read-validate-write TOCTOU window.
+			t.LastUsedPasscode = passcode
+			n, err := db.GetEngine(ctx).ID(t.ID).
+				Where(builder.Or(builder.IsNull{"last_used_passcode"}, builder.Neq{"last_used_passcode": passcode})).
+				Cols("last_used_passcode").Update(t)
+			if err != nil {
+				return err
+			}
+			valid = n == 1
+		}
+		if !valid {
+			result = TwoFactorResultInvalid
+			return cache.GetCache().Put(attemptsKey, strconv.Itoa(attempts+1), totpAttemptsTTL)
+		}
+		cache.Remove(attemptsKey)
+		result = TwoFactorResultValid
+		return nil
+	})
+	return result, err
 }
 
 // NewTwoFactor creates a new two-factor authentication token.

models/auth/twofactor_test.go

@@ -4,11 +4,15 @@
 package auth_test
 
 import (
+	"fmt"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/unittest"
+	"gitea.dev/modules/cache"
 
 	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pquerna/otp/totp"
@@ -30,21 +34,42 @@ func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
 	require.NoError(t, err)
 
 	// first use of a valid passcode succeeds
-	ok, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
+	result, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
 	require.NoError(t, err)
-	assert.True(t, ok)
+	assert.Equal(t, auth_model.TwoFactorResultValid, result)
 
 	// replaying the same passcode is refused, even when still inside the TOTP validity window
 	reloaded, err := auth_model.GetTwoFactorByUID(t.Context(), tfa.UID)
 	require.NoError(t, err)
-	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
+	result, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
 	require.NoError(t, err)
-	assert.False(t, ok)
+	assert.Equal(t, auth_model.TwoFactorResultInvalid, result)
 
-	// an invalid passcode is rejected without consuming anything
-	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), "000000")
+	var limited atomic.Int32
+	var wg sync.WaitGroup
+	for range 10 {
+		wg.Go(func() {
+			result, err := reloaded.ValidateAndConsumeTOTP(t.Context(), "0000000")
+			assert.NoError(t, err)
+			if result == auth_model.TwoFactorResultTooManyAttempts {
+				limited.Add(1)
+			} else {
+				assert.Equal(t, auth_model.TwoFactorResultInvalid, result)
+			}
+		})
+	}
+	wg.Wait()
+	assert.EqualValues(t, 6, limited.Load())
+	nextPasscode, err := totp.GenerateCode(key.Secret(), time.Now().Add(30*time.Second))
 	require.NoError(t, err)
-	assert.False(t, ok)
+	result, err = reloaded.ValidateAndConsumeTOTP(t.Context(), nextPasscode)
+	require.NoError(t, err)
+	assert.Equal(t, auth_model.TwoFactorResultTooManyAttempts, result)
+
+	cache.Remove(fmt.Sprintf("twofa_attempts_%d", tfa.UID))
+	result, err = reloaded.ValidateAndConsumeTOTP(t.Context(), nextPasscode)
+	require.NoError(t, err)
+	assert.Equal(t, auth_model.TwoFactorResultValid, result)
 }
 
 func TestDisableTwoFactor(t *testing.T) {

models/db/engine_init.go

@@ -5,7 +5,9 @@ package db
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
+	"time"
 
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -59,6 +61,11 @@ func InitEngine(ctx context.Context) error {
 	xe.SetMaxIdleConns(setting.Database.MaxIdleConns)
 	xe.SetConnMaxLifetime(setting.Database.ConnMaxLifetime)
 
+	if setting.Database.Type.IsMySQL() {
+		// like PostgreSQL and MSSQL, avoids MariaDB snapshot isolation errors
+		xe.SetDefaultTxOptions(&sql.TxOptions{Isolation: sql.LevelReadCommitted})
+	}
+
 	if setting.Database.SlowQueryThreshold > 0 {
 		xe.AddHook(&EngineHook{
 			Threshold: setting.Database.SlowQueryThreshold,
@@ -103,6 +110,10 @@ func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Conte
 
 	preprocessDatabaseCollation(xormEngine)
 
+	if setting.Database.Type.IsMSSQL() {
+		enableMSSQLReadCommittedSnapshot(ctx, xormEngine)
+	}
+
 	// We have to run migrateFunc here in case the user is re-running installation on a previously created DB.
 	// If we do not then table schemas will be changed and there will be conflicts when the migrations run properly.
 	//
@@ -125,3 +136,12 @@ func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Conte
 
 	return nil
 }
+
+// enableMSSQLReadCommittedSnapshot stops MSSQL reads waiting on writers, like PostgreSQL and MySQL
+func enableMSSQLReadCommittedSnapshot(ctx context.Context, engine EngineMigration) {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second) // ALTER waits for all other connections to close
+	defer cancel()
+	if _, err := engine.Context(ctx).Exec("IF (SELECT is_read_committed_snapshot_on FROM sys.databases WHERE database_id = DB_ID()) = 0 ALTER DATABASE CURRENT SET READ_COMMITTED_SNAPSHOT ON"); err != nil {
+		log.Error("Unable to set READ_COMMITTED_SNAPSHOT=ON: %v", err)
+	}
+}

models/fixtures/oauth2_grant.yml

@@ -7,7 +7,7 @@
   updated_unix: 1546869730
 
 - id: 2
-  user_id: 3
+  user_id: 14
   application_id: 1
   counter: 1
   scope: "openid"
@@ -23,7 +23,7 @@
   updated_unix: 1546869730
 
 - id: 4
-  user_id: 99
+  user_id: 2
   application_id: 2
   counter: 1
   scope: "whatever"

models/git/commit_status.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"net/url"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -35,11 +36,11 @@ import (
 // CommitStatus holds a single Status of a single Commit
 type CommitStatus struct {
 	ID     int64                          `xorm:"pk autoincr"`
-	Index  int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
-	RepoID int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
-	Repo   *repo_model.Repository         `xorm:"-"`
-	State  commitstatus.CommitStatusState `xorm:"VARCHAR(7) NOT NULL"`
+	RepoID int64                          `xorm:"UNIQUE(repo_sha_index)"`
 	SHA    string                         `xorm:"VARCHAR(64) NOT NULL INDEX UNIQUE(repo_sha_index)"`
+	Index  int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
+	Repo   *repo_model.Repository         `xorm:"-" json:"-"`
+	State  commitstatus.CommitStatusState `xorm:"VARCHAR(7) NOT NULL"`
 
 	// TargetURL points to the commit status page reported by a CI system
 	// If Gitea Actions is used, it is a relative link like "{RepoLink}/actions/runs/{RunID}/jobs{JobID}"
@@ -48,7 +49,7 @@ type CommitStatus struct {
 	Description string           `xorm:"TEXT"`
 	ContextHash string           `xorm:"VARCHAR(64) index"`
 	Context     string           `xorm:"TEXT"`
-	Creator     *user_model.User `xorm:"-"`
+	Creator     *user_model.User `xorm:"-" json:"-"`
 	CreatorID   int64
 
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
@@ -181,7 +182,7 @@ func GetNextCommitStatusIndex(ctx context.Context, repoID int64, sha string) (in
 
 func (status *CommitStatus) loadRepository(ctx context.Context) (err error) {
 	if status.Repo == nil {
-		status.Repo, err = repo_model.GetRepositoryByID(ctx, status.RepoID)
+		status.Repo, err = cache.GetWithContextCache(ctx, cachegroup.Repository, status.RepoID, repo_model.GetRepositoryByID)
 		if err != nil {
 			return fmt.Errorf("getRepositoryByID [%d]: %w", status.RepoID, err)
 		}
@@ -229,11 +230,9 @@ func (status *CommitStatus) cutTargetURLGiteaActionsPrefix(ctx context.Context)
 		return "", false
 	}
 
-	if status.Repo == nil {
-		if err := status.loadRepository(ctx); err != nil {
-			log.Error("loadRepository: %v", err)
-			return "", false
-		}
+	if err := status.loadRepository(ctx); err != nil {
+		log.Error("loadRepository: %v", err)
+		return "", false
 	}
 
 	prefix := status.Repo.Link() + "/actions"
@@ -311,17 +310,17 @@ func (opts *CommitStatusOptions) ToConds() builder.Cond {
 func (opts *CommitStatusOptions) ToOrders() string {
 	switch opts.SortType {
 	case "oldest":
-		return "created_unix ASC"
+		return "created_unix ASC, `index` ASC"
 	case "recentupdate":
-		return "updated_unix DESC"
+		return "updated_unix DESC, `index` DESC"
 	case "leastupdate":
-		return "updated_unix ASC"
+		return "updated_unix ASC, `index` ASC"
 	case "leastindex":
 		return "`index` DESC"
 	case "highestindex":
 		return "`index` ASC"
 	default:
-		return "created_unix DESC"
+		return "created_unix DESC, `index` DESC" // timestamps have 1s resolution, `index` keeps paging stable
 	}
 }
 
@@ -420,46 +419,48 @@ func GetLatestCommitStatusForPairs(ctx context.Context, repoSHAs []RepoSHA) (map
 	return repoStatuses, nil
 }
 
-// GetLatestCommitStatusForRepoCommitIDs returns all statuses with a unique context for a given list of repo-sha pairs
-func GetLatestCommitStatusForRepoCommitIDs(ctx context.Context, repoID int64, commitIDs []string) (map[string][]*CommitStatus, error) {
-	type result struct {
+// GetLatestCommitStatusForRepoCommitIDs returns the commit statuses with a unique context for a given list of repo-sha pairs
+// If the provided commit IDs are too many, only the first part and the last part of the commit IDs will be queried.
+func GetLatestCommitStatusForRepoCommitIDs(ctx context.Context, repoID int64, allCommitIDs []string) (map[string][]*CommitStatus, error) {
+	const maxCommitIDs = 500
+	const maxBatchSize = 200
+	queryCommitIDs := allCommitIDs
+	if len(allCommitIDs) > maxCommitIDs {
+		// The commit IDs are usually from "commits list" or "compare" page (create a PR or compare commits), nobody can read so many commits at once.
+		// The commit IDs are usually sorted by time, so we can take the first half and the last half of the commit IDs to get the latest statuses.
+		log.Warn("GetLatestCommitStatusForRepoCommitIDs: too many commit IDs (%d) for repo %d, truncating to %d", len(allCommitIDs), repoID, maxCommitIDs)
+		queryCommitIDs = allCommitIDs[:maxCommitIDs/2]
+		queryCommitIDs = append(queryCommitIDs, allCommitIDs[len(allCommitIDs)-maxCommitIDs/2:]...)
+	}
+
+	baseSql := func() db.Session {
+		return db.GetEngine(ctx).Table(&CommitStatus{}).Where("repo_id = ?", repoID)
+	}
+
+	type shaMaxIndexResult struct {
 		Index int64
 		SHA   string
 	}
-
-	getBase := func() db.Session {
-		return db.GetEngine(ctx).Table(&CommitStatus{}).Where("repo_id = ?", repoID)
-	}
-	results := make([]result, 0, len(commitIDs))
-
-	conds := make([]builder.Cond, 0, len(commitIDs))
-	for _, sha := range commitIDs {
-		conds = append(conds, builder.Eq{"sha": sha})
-	}
-	sess := getBase().And(builder.Or(conds...)).
-		Select("max( `index` ) as `index`, sha").
-		GroupBy("context_hash, sha").OrderBy("max( `index` ) desc")
-
-	err := sess.Find(&results)
+	shaMaxIndexResults := make([]*shaMaxIndexResult, 0, len(allCommitIDs))
+	err := baseSql().And(builder.In("sha", queryCommitIDs)).
+		Select("max(`index`) as `index`, sha").
+		GroupBy("context_hash, sha").
+		Find(&shaMaxIndexResults)
 	if err != nil {
 		return nil, err
 	}
 
 	repoStatuses := make(map[string][]*CommitStatus)
-
-	if len(results) > 0 {
-		statuses := make([]*CommitStatus, 0, len(results))
-
-		conds = make([]builder.Cond, 0, len(results))
-		for _, result := range results {
-			conds = append(conds, builder.Eq{"`index`": result.Index, "sha": result.SHA})
+	for chunk := range slices.Chunk(shaMaxIndexResults, maxBatchSize) {
+		statuses := make([]*CommitStatus, 0, len(chunk))
+		condIndexSha := make([]builder.Cond, 0, len(chunk))
+		for _, res := range chunk {
+			condIndexSha = append(condIndexSha, builder.Eq{"`index`": res.Index, "sha": res.SHA})
 		}
-		err = getBase().And(builder.Or(conds...)).Find(&statuses)
+		err = baseSql().And(builder.Or(condIndexSha...)).Find(&statuses)
 		if err != nil {
 			return nil, err
 		}
-
-		// Group the statuses by commit
 		for _, status := range statuses {
 			repoStatuses[status.SHA] = append(repoStatuses[status.SHA], status)
 		}
@@ -569,11 +570,12 @@ func SignCommitsApplyDoerPermission(ctx context.Context, doer *user_model.User,
 }
 
 func statusRepoCanReadActions(ctx context.Context, doer *user_model.User, status *CommitStatus) bool {
+	if err := status.loadRepository(ctx); err != nil {
+		log.Error("loadRepository: %v", err)
+		return false
+	}
 	perm, err := cache.GetWithContextCache(ctx, cachegroup.RepoUserPermission, access_model.RepoUserPermissionCacheKey(status.RepoID, doer),
-		func(ctx context.Context, _ string) (access_model.Permission, error) { // only runs on a cache miss
-			if err := status.loadRepository(ctx); err != nil {
-				return access_model.Permission{}, err
-			}
+		func(ctx context.Context, _key string) (access_model.Permission, error) {
 			return access_model.GetDoerRepoPermission(ctx, status.Repo, doer)
 		},
 	)

models/git/commit_status_test.go

@@ -4,6 +4,7 @@
 package git_test
 
 import (
+	"fmt"
 	"testing"
 	"time"
 
@@ -12,6 +13,7 @@ import (
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
 	"gitea.dev/modules/commitstatus"
 	"gitea.dev/modules/git"
 
@@ -22,46 +24,71 @@ func TestGetCommitStatuses(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 
 	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-
 	sha1 := "1234123412341234123412341234123412341234" // the mocked commit ID in test fixtures
 
-	statuses, maxResults, err := db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
-		ListOptions: db.ListOptions{Page: 1, PageSize: 50},
-		RepoID:      repo1.ID,
-		SHA:         sha1,
+	t.Run("CommitStatusOptions", func(t *testing.T) {
+		statuses, maxResults, err := db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
+			ListOptions: db.ListOptions{Page: 1, PageSize: 50},
+			RepoID:      repo1.ID,
+			SHA:         sha1,
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, 5, int(maxResults))
+		var indexes []int64
+		for _, status := range statuses {
+			indexes = append(indexes, status.Index)
+		}
+		assert.Equal(t, []int64{5, 4, 3, 2, 1}, indexes)
+		assert.Equal(t, "deploy/awesomeness", statuses[0].Context)
+		assert.Equal(t, commitstatus.CommitStatusError, statuses[0].State)
+		assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[0].APIURL(t.Context()))
+
+		statuses, maxResults, err = db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
+			ListOptions: db.ListOptions{Page: 2, PageSize: 50},
+			RepoID:      repo1.ID,
+			SHA:         sha1,
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, 5, int(maxResults))
+		assert.Empty(t, statuses)
 	})
-	assert.NoError(t, err)
-	assert.Equal(t, 5, int(maxResults))
-	assert.Len(t, statuses, 5)
 
-	assert.Equal(t, "ci/awesomeness", statuses[0].Context)
-	assert.Equal(t, commitstatus.CommitStatusPending, statuses[0].State)
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[0].APIURL(t.Context()))
+	t.Run("GetCountLatestCommitStatus", func(t *testing.T) {
+		commitStatuses, err := git_model.GetLatestCommitStatus(t.Context(), repo1.ID, sha1, db.ListOptions{
+			Page:     1,
+			PageSize: 2,
+		})
+		assert.NoError(t, err)
+		assert.Len(t, commitStatuses, 2)
+		assert.Equal(t, commitstatus.CommitStatusFailure, commitStatuses[0].State)
+		assert.Equal(t, "ci/awesomeness", commitStatuses[0].Context)
+		assert.Equal(t, commitstatus.CommitStatusError, commitStatuses[1].State)
+		assert.Equal(t, "deploy/awesomeness", commitStatuses[1].Context)
 
-	assert.Equal(t, "cov/awesomeness", statuses[1].Context)
-	assert.Equal(t, commitstatus.CommitStatusWarning, statuses[1].State)
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[1].APIURL(t.Context()))
-
-	assert.Equal(t, "cov/awesomeness", statuses[2].Context)
-	assert.Equal(t, commitstatus.CommitStatusSuccess, statuses[2].State)
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[2].APIURL(t.Context()))
-
-	assert.Equal(t, "ci/awesomeness", statuses[3].Context)
-	assert.Equal(t, commitstatus.CommitStatusFailure, statuses[3].State)
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[3].APIURL(t.Context()))
-
-	assert.Equal(t, "deploy/awesomeness", statuses[4].Context)
-	assert.Equal(t, commitstatus.CommitStatusError, statuses[4].State)
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[4].APIURL(t.Context()))
-
-	statuses, maxResults, err = db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
-		ListOptions: db.ListOptions{Page: 2, PageSize: 50},
-		RepoID:      repo1.ID,
-		SHA:         sha1,
+		count, err := git_model.CountLatestCommitStatus(t.Context(), repo1.ID, sha1)
+		assert.NoError(t, err)
+		assert.EqualValues(t, 3, count)
+	})
+
+	t.Run("GetLatestCommitStatusForRepoCommitIDs", func(t *testing.T) {
+		commitIDs := []string{sha1}
+		// SQLite has a limit of 1000 for WHERE expression variables per query, use a larger slice to test
+		for i := range 2000 {
+			commitIDs = append(commitIDs, fmt.Sprintf("%040x", i+1))
+		}
+		statuses, err := git_model.GetLatestCommitStatusForRepoCommitIDs(t.Context(), repo1.ID, commitIDs)
+		assert.NoError(t, err)
+		assert.Len(t, statuses[sha1], 3)
+		latestIndexes := make(map[string]int64)
+		for _, status := range statuses[sha1] {
+			latestIndexes[status.Context] = status.Index
+		}
+		assert.Equal(t, map[string]int64{
+			"ci/awesomeness":     4,
+			"cov/awesomeness":    3,
+			"deploy/awesomeness": 5,
+		}, latestIndexes)
 	})
-	assert.NoError(t, err)
-	assert.Equal(t, 5, int(maxResults))
-	assert.Empty(t, statuses)
 }
 
 func Test_CalcCommitStatus(t *testing.T) {
@@ -255,31 +282,10 @@ func TestCommitStatusesApplyDoerPermission(t *testing.T) {
 		},
 	}
 
-	git_model.CommitStatusesApplyDoerPermission(t.Context(), doer, statuses)
+	git_model.CommitStatusesApplyDoerPermission(cache.WithCacheContext(t.Context()), doer, statuses)
 	assert.Equal(t, visibleURL, statuses[0].TargetURL)
 	assert.Empty(t, statuses[1].TargetURL)
 	assert.Equal(t, "https://mycicd.org/1", statuses[2].TargetURL)
-}
-
-func TestGetCountLatestCommitStatus(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-
-	sha1 := "1234123412341234123412341234123412341234" // the mocked commit ID in test fixtures
-
-	commitStatuses, err := git_model.GetLatestCommitStatus(t.Context(), repo1.ID, sha1, db.ListOptions{
-		Page:     1,
-		PageSize: 2,
-	})
-	assert.NoError(t, err)
-	assert.Len(t, commitStatuses, 2)
-	assert.Equal(t, commitstatus.CommitStatusFailure, commitStatuses[0].State)
-	assert.Equal(t, "ci/awesomeness", commitStatuses[0].Context)
-	assert.Equal(t, commitstatus.CommitStatusError, commitStatuses[1].State)
-	assert.Equal(t, "deploy/awesomeness", commitStatuses[1].Context)
-
-	count, err := git_model.CountLatestCommitStatus(t.Context(), repo1.ID, sha1)
-	assert.NoError(t, err)
-	assert.EqualValues(t, 3, count)
+	assert.NotNil(t, statuses[0].Repo)
+	assert.Same(t, statuses[0].Repo, statuses[2].Repo)
 }

models/git/protected_branch.go

@@ -99,8 +99,8 @@ func (protectBranch *ProtectedBranch) loadGlob() {
 	var err error
 	protectBranch.globRule, err = glob.Compile(protectBranch.RuleName, '/')
 	if err != nil {
-		log.Warn("Invalid glob rule for ProtectedBranch[%d]: %s %v", protectBranch.ID, protectBranch.RuleName, err)
-		protectBranch.globRule = glob.MustCompile(glob.QuoteMeta(protectBranch.RuleName), '/')
+		log.Debug("Invalid glob rule for ProtectedBranch[%d]: %s %v", protectBranch.ID, protectBranch.RuleName, err)
+		protectBranch.globRule, _ = glob.Compile(glob.QuoteMeta(protectBranch.RuleName), '/')
 	}
 }
 
@@ -110,7 +110,9 @@ func (protectBranch *ProtectedBranch) Match(branchName string) bool {
 	if protectBranch.isPlainName {
 		return strings.EqualFold(protectBranch.RuleName, branchName)
 	}
-
+	if protectBranch.globRule == nil {
+		return false // in case of invalid glob rule, we don't match anything
+	}
 	return protectBranch.globRule.Match(branchName)
 }
 
@@ -123,23 +125,13 @@ func (protectBranch *ProtectedBranch) LoadRepo(ctx context.Context) (err error)
 }
 
 // CanUserPush returns if some user could push to this protected branch
-func (protectBranch *ProtectedBranch) CanUserPush(ctx context.Context, user *user_model.User) bool {
+func (protectBranch *ProtectedBranch) CanUserPush(ctx context.Context, user *user_model.User, permissionInRepo access_model.Permission) bool {
 	if !protectBranch.CanPush {
 		return false
 	}
 
 	if !protectBranch.EnableWhitelist {
-		if err := protectBranch.LoadRepo(ctx); err != nil {
-			log.Error("LoadRepo: %v", err)
-			return false
-		}
-
-		writeAccess, err := access_model.HasAccessUnit(ctx, user, protectBranch.Repo, unit.TypeCode, perm.AccessModeWrite)
-		if err != nil {
-			log.Error("HasAccessUnit: %v", err)
-			return false
-		}
-		return writeAccess
+		return permissionInRepo.CanWrite(unit.TypeCode)
 	}
 
 	if slices.Contains(protectBranch.WhitelistUserIDs, user.ID) {
@@ -160,17 +152,17 @@ func (protectBranch *ProtectedBranch) CanUserPush(ctx context.Context, user *use
 
 // CanUserForcePush returns if some user could force push to this protected branch
 // Since force-push extends normal push, we also check if user has regular push access
-func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user *user_model.User) bool {
+func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user *user_model.User, permissionInRepo access_model.Permission) bool {
 	if !protectBranch.CanForcePush {
 		return false
 	}
 
 	if !protectBranch.EnableForcePushAllowlist {
-		return protectBranch.CanUserPush(ctx, user)
+		return protectBranch.CanUserPush(ctx, user, permissionInRepo)
 	}
 
 	if slices.Contains(protectBranch.ForcePushAllowlistUserIDs, user.ID) {
-		return protectBranch.CanUserPush(ctx, user)
+		return protectBranch.CanUserPush(ctx, user, permissionInRepo)
 	}
 
 	if len(protectBranch.ForcePushAllowlistTeamIDs) == 0 {
@@ -182,7 +174,7 @@ func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user
 		log.Error("IsUserInTeams: %v", err)
 		return false
 	}
-	return in && protectBranch.CanUserPush(ctx, user)
+	return in && protectBranch.CanUserPush(ctx, user, permissionInRepo)
 }
 
 // IsUserMergeWhitelisted checks if some user is whitelisted to merge to this branch

models/git/protected_branch_list.go

@@ -9,6 +9,7 @@ import (
 
 	"gitea.dev/models/db"
 	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
 	"gitea.dev/modules/optional"
 )
 
@@ -55,10 +56,17 @@ func FindRepoProtectedBranchRules(ctx context.Context, repoID int64) (ProtectedB
 // FindAllMatchedBranches find all matched branches
 func FindAllMatchedBranches(ctx context.Context, repoID int64, ruleName string) ([]string, error) {
 	results := make([]string, 0, 10)
+	rule, err := glob.Compile(ruleName)
+	if err != nil {
+		log.Debug("Failed to compile rule %s: %v", ruleName, err)
+		return results, nil
+	}
+
+	const pageSize = 100
 	for page := 1; ; page++ {
-		brancheNames, err := FindBranchNames(ctx, FindBranchOptions{
+		branchNames, err := FindBranchNames(ctx, FindBranchOptions{
 			ListOptions: db.ListOptions{
-				PageSize: 100,
+				PageSize: pageSize,
 				Page:     page,
 			},
 			RepoID:          repoID,
@@ -67,14 +75,12 @@ func FindAllMatchedBranches(ctx context.Context, repoID int64, ruleName string)
 		if err != nil {
 			return nil, err
 		}
-		rule := glob.MustCompile(ruleName)
-
-		for _, branch := range brancheNames {
+		for _, branch := range branchNames {
 			if rule.Match(branch) {
 				results = append(results, branch)
 			}
 		}
-		if len(brancheNames) < 100 {
+		if len(branchNames) < pageSize {
 			break
 		}
 	}

models/issues/comment.go

@@ -34,6 +34,7 @@ import (
 	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
+	"xorm.io/xorm"
 )
 
 // ErrCommentNotExist represents a "CommentNotExist" kind of error.
@@ -369,12 +370,19 @@ func (c *Comment) LoadIssue(ctx context.Context) (err error) {
 	return err
 }
 
+var (
+	_ xorm.BeforeInsertProcessor = (*Comment)(nil)
+	_ xorm.BeforeUpdateProcessor = (*Comment)(nil)
+)
+
 // BeforeInsert will be invoked by XORM before inserting a record
 func (c *Comment) BeforeInsert() {
 	c.PatchQuoted = c.Patch
 	if !utf8.ValidString(c.Patch) {
 		c.PatchQuoted = strconv.Quote(c.Patch)
 	}
+
+	sanitizeDatabaseStringContent(&c.Content)
 }
 
 // BeforeUpdate will be invoked by XORM before updating a record
@@ -383,6 +391,8 @@ func (c *Comment) BeforeUpdate() {
 	if !utf8.ValidString(c.Patch) {
 		c.PatchQuoted = strconv.Quote(c.Patch)
 	}
+
+	sanitizeDatabaseStringContent(&c.Content)
 }
 
 // AfterLoad is invoked from XORM after setting the values of all fields of this object.
@@ -1164,6 +1174,11 @@ func UpdateComment(ctx context.Context, c *Comment, contentVersion int, doer *us
 		if affected == 0 {
 			return ErrCommentAlreadyChanged
 		}
+		if c.Type == CommentTypeReview {
+			if _, err := db.GetEngine(ctx).ID(c.ReviewID).Cols("content").NoAutoTime().Update(&Review{Content: c.Content}); err != nil { // updated_unix picks a reviewer's latest review
+				return err
+			}
+		}
 		if err := c.LoadIssue(ctx); err != nil {
 			return err
 		}

models/issues/issue.go

@@ -11,6 +11,7 @@ import (
 	"regexp"
 	"slices"
 	"strconv"
+	"strings"
 
 	"gitea.dev/models/db"
 	project_model "gitea.dev/models/project"
@@ -25,6 +26,7 @@ import (
 	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
+	"xorm.io/xorm"
 )
 
 // ErrIssueNotExist represents a "IssueNotExist" kind of error.
@@ -53,7 +55,7 @@ var ErrIssueAlreadyChanged = util.NewInvalidArgumentErrorf("the issue is already
 // Issue represents an issue or pull request of repository.
 type Issue struct {
 	ID                int64                  `xorm:"pk autoincr"`
-	RepoID            int64                  `xorm:"INDEX UNIQUE(repo_index)"`
+	RepoID            int64                  `xorm:"INDEX(repo_closed_pull) UNIQUE(repo_index)"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	Index             int64                  `xorm:"UNIQUE(repo_index)"` // Index in one repository.
 	PosterID          int64                  `xorm:"INDEX"`
@@ -75,13 +77,13 @@ type Issue struct {
 	AssigneeID        int64            `xorm:"-"`
 	Assignee          *user_model.User `xorm:"-"`
 	isAssigneeLoaded  bool             `xorm:"-"`
-	IsClosed          bool             `xorm:"INDEX"`
+	IsClosed          bool             `xorm:"INDEX(repo_closed_pull)"`
 	IsRead            bool             `xorm:"-"`
-	IsPull            bool             `xorm:"INDEX"` // Indicates whether is a pull request or not.
+	IsPull            bool             `xorm:"INDEX(repo_closed_pull)"` // Indicates whether is a pull request or not.
 	PullRequest       *PullRequest     `xorm:"-"`
 	NumComments       int
 
-	// TODO: RemoveIssueRef: see "repo/issue/branch_selector_field.tmpl"
+	// TODO: ISSUE-SIDEBAR-REF-SELECTOR: see "repo/issue/branch_selector_field.tmpl"
 	Ref string
 
 	PinOrder int `xorm:"-"` // 0 means not loaded, -1 means loaded but not pinned
@@ -123,6 +125,27 @@ func init() {
 	db.RegisterModel(new(IssueIndex))
 }
 
+func sanitizeDatabaseStringContent(s *string) {
+	// postgresql doesn't like "\x00"
+	// this is only a simple workaround for issues like https://github.com/go-gitea/gitea/issues/28890 and https://github.com/go-gitea/gitea/issues/40003
+	*s = strings.ReplaceAll(*s, "\x00", " ")
+}
+
+var (
+	_ xorm.BeforeInsertProcessor = (*Issue)(nil)
+	_ xorm.BeforeUpdateProcessor = (*Issue)(nil)
+)
+
+func (issue *Issue) BeforeInsert() {
+	sanitizeDatabaseStringContent(&issue.Title)
+	sanitizeDatabaseStringContent(&issue.Content)
+}
+
+func (issue *Issue) BeforeUpdate() {
+	sanitizeDatabaseStringContent(&issue.Title)
+	sanitizeDatabaseStringContent(&issue.Content)
+}
+
 // LoadTotalTimes load total tracked time
 func (issue *Issue) LoadTotalTimes(ctx context.Context) (err error) {
 	opts := FindTrackedTimesOptions{IssueID: issue.ID}

models/issues/issue_search.go

@@ -75,11 +75,11 @@ func applySorts(sess db.Session, sortType string, priorityRepoID int64) {
 	// Since this sortType is dynamically created, it has to be treated specially.
 	if after, ok := strings.CutPrefix(sortType, ScopeSortPrefix); ok {
 		scope := after
-		sess.Join("LEFT", "issue_label", "issue.id = issue_label.issue_id")
-		// "exclusive_order=0" means "no order is set", so exclude it from the JOIN criteria and then "LEFT JOIN" result is also null
-		sess.Join("LEFT", "label", "label.id = issue_label.label_id AND label.exclusive_order <> 0 AND label.name LIKE ?", scope+"/%")
-		// Use COALESCE to make sure we sort NULL last regardless of backend DB (2147483647 == max int)
-		sess.OrderBy("COALESCE(label.exclusive_order, 2147483647) ASC").Desc("issue.id")
+		// a subquery instead of a JOIN keeps one row per issue, "exclusive_order=0" means unset and COALESCE sorts it last on every DB
+		sess.OrderBy("COALESCE((SELECT MIN(label.exclusive_order) FROM issue_label"+
+			" INNER JOIN label ON label.id = issue_label.label_id"+
+			" WHERE issue_label.issue_id = issue.id AND label.exclusive_order <> 0 AND label.name LIKE ?), 2147483647) ASC", scope+"/%").
+			Desc("issue.id")
 		return
 	}
 
@@ -218,10 +218,7 @@ func applyRepoConditions(sess db.Session, opts *IssuesOptions) {
 		opts.RepoCond = builder.In("issue.repo_id", opts.RepoIDs)
 	}
 	if opts.AllPublic {
-		if opts.RepoCond == nil {
-			opts.RepoCond = builder.NewCond()
-		}
-		opts.RepoCond = opts.RepoCond.Or(builder.In("issue.repo_id", builder.Select("id").From("repository").Where(repo_model.PublicRepoUnderPublicOwnerCond())))
+		opts.RepoCond = builder.Or(opts.RepoCond, repo_model.PublicRepoUnderPublicOwnerCond())
 	}
 	if opts.RepoCond != nil {
 		sess.And(opts.RepoCond)
@@ -402,22 +399,17 @@ func applyReviewRequestedCondition(sess db.Session, reviewRequestedID int64) {
 		From("team_user").
 		Where(builder.Eq{"team_user.uid": reviewRequestedID})
 
-	// if the review is approved or rejected, it should not be shown in the review requested list
-	maxReview := builder.Select("MAX(r.id)").
-		From("review as r").
-		Where(builder.In("r.type", []ReviewType{ReviewTypeApprove, ReviewTypeReject, ReviewTypeRequest})).
-		GroupBy("r.issue_id, r.reviewer_id, r.reviewer_team_id")
-
 	subQuery := builder.Select("review.issue_id").
 		From("review").
-		Where(builder.And(
-			builder.Eq{"review.type": ReviewTypeRequest},
-			builder.Or(
-				builder.Eq{"review.reviewer_id": reviewRequestedID},
-				builder.In("review.reviewer_team_id", existInTeamQuery),
-			),
-			builder.In("review.id", maxReview),
-		))
+		Where(builder.Eq{"review.type": ReviewTypeRequest}).
+		And(builder.Or(
+			builder.Eq{"review.reviewer_id": reviewRequestedID},
+			builder.In("review.reviewer_team_id", existInTeamQuery),
+		)).
+		// if the review is approved or rejected, it should not be shown in the review requested list
+		And(builder.NotExists(builder.Select("1").From("review as r").
+			Where(builder.Expr("r.issue_id = review.issue_id AND r.reviewer_id = review.reviewer_id AND r.reviewer_team_id = review.reviewer_team_id AND r.id > review.id").
+				And(builder.In("r.type", []ReviewType{ReviewTypeApprove, ReviewTypeReject, ReviewTypeRequest})))))
 	sess.Where("issue.poster_id <> ?", reviewRequestedID).
 		And(builder.In("issue.id", subQuery))
 }
@@ -477,7 +469,7 @@ func applySubscribedCondition(sess db.Session, subscriberID int64) {
 				Select("repo_id").
 				From("watch").
 				Where(builder.And(builder.Eq{"user_id": subscriberID},
-					builder.In("mode", repo_model.WatchModeNormal, repo_model.WatchModeAuto))),
+					builder.In("mode", repo_model.WatchModeNormal, repo_model.WatchModeAuto, repo_model.WatchModeCustom))),
 			),
 		),
 	)

models/issues/label.go

@@ -269,27 +269,23 @@ func UpdateLabel(ctx context.Context, l *Label) error {
 	return updateLabelCols(ctx, l, "name", "description", "color", "exclusive", "exclusive_order", "archived_unix")
 }
 
-// DeleteLabel delete a label
-func DeleteLabel(ctx context.Context, id, labelID int64) error {
-	l, err := GetLabelByID(ctx, labelID)
-	if err != nil {
-		if IsErrLabelNotExist(err) {
-			return nil
-		}
-		return err
-	}
+// DeleteRepoLabel deletes a repository label.
+func DeleteRepoLabel(ctx context.Context, repoID, labelID int64) error {
+	return deleteLabel(ctx, labelID, builder.Eq{"repo_id": repoID, "org_id": 0})
+}
 
+// DeleteOrgLabel deletes an organization label.
+func DeleteOrgLabel(ctx context.Context, orgID, labelID int64) error {
+	return deleteLabel(ctx, labelID, builder.Eq{"org_id": orgID, "repo_id": 0})
+}
+
+func deleteLabel(ctx context.Context, labelID int64, ownerCond builder.Cond) error {
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		if l.BelongsToOrg() && l.OrgID != id {
-			return nil
-		}
-		if l.BelongsToRepo() && l.RepoID != id {
-			return nil
-		}
-
-		if _, err = db.DeleteByID[Label](ctx, labelID); err != nil {
+		deleted, err := db.GetEngine(ctx).ID(labelID).Where(ownerCond).Delete(new(Label))
+		if err != nil || deleted == 0 {
 			return err
-		} else if _, err = db.GetEngine(ctx).
+		}
+		if _, err = db.GetEngine(ctx).
 			Where("label_id = ?", labelID).
 			Delete(new(IssueLabel)); err != nil {
 			return err

models/issues/label_test.go

@@ -320,13 +320,29 @@ func TestUpdateLabel(t *testing.T) {
 func TestDeleteLabel(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	label := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 1})
-	assert.NoError(t, issues_model.DeleteLabel(t.Context(), label.RepoID, label.ID))
+	orgLabel := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 3})
+	repoLabel := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 10, RepoID: orgLabel.OrgID})
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), repoLabel.RepoID, repoLabel.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: repoLabel.ID})
+
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), orgLabel.OrgID, orgLabel.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: orgLabel.ID})
+
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), unittest.NonexistentID, orgLabel.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: orgLabel.ID})
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), orgLabel.OrgID, orgLabel.ID))
+	unittest.AssertNotExistsBean(t, &issues_model.Label{ID: orgLabel.ID})
+
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), unittest.NonexistentID, label.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: label.ID})
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), label.RepoID, label.ID))
 	unittest.AssertNotExistsBean(t, &issues_model.Label{ID: label.ID, RepoID: label.RepoID})
 
-	assert.NoError(t, issues_model.DeleteLabel(t.Context(), label.RepoID, label.ID))
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), label.RepoID, label.ID))
 	unittest.AssertNotExistsBean(t, &issues_model.Label{ID: label.ID})
 
-	assert.NoError(t, issues_model.DeleteLabel(t.Context(), unittest.NonexistentID, unittest.NonexistentID))
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), unittest.NonexistentID, unittest.NonexistentID))
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), unittest.NonexistentID, unittest.NonexistentID))
 	unittest.CheckConsistencyFor(t, &issues_model.Label{}, &repo_model.Repository{})
 }
 

models/issues/milestone_list.go

@@ -39,12 +39,13 @@ func (milestones MilestoneList) SplitByOpenClosed() (open, closed MilestoneList)
 // FindMilestoneOptions contain options to get milestones
 type FindMilestoneOptions struct {
 	db.ListOptions
-	RepoID   int64
-	IsClosed optional.Option[bool]
-	Name     string
-	SortType string
-	RepoCond builder.Cond
-	RepoIDs  []int64
+	RepoID    int64
+	IsClosed  optional.Option[bool]
+	Name      string
+	SortType  string
+	RepoCond  builder.Cond
+	RepoIDs   []int64
+	ProjectID int64
 }
 
 func (opts FindMilestoneOptions) ToConds() builder.Cond {
@@ -64,6 +65,11 @@ func (opts FindMilestoneOptions) ToConds() builder.Cond {
 	if len(opts.Name) != 0 {
 		cond = cond.And(db.BuildCaseInsensitiveLike("name", opts.Name))
 	}
+	if opts.ProjectID != 0 {
+		cond = cond.And(builder.In("id", builder.Select("issue.milestone_id").From("issue").
+			InnerJoin("project_issue", "project_issue.issue_id = issue.id").
+			Where(builder.Eq{"project_issue.project_id": opts.ProjectID})))
+	}
 
 	return cond
 }

models/issues/pull.go

@@ -378,7 +378,7 @@ func (pr *PullRequest) getReviewedByLines(ctx context.Context, writer io.Writer)
 	reviewersWritten := 0
 
 	for _, review := range reviews {
-		if maxReviewers > 0 && reviewersWritten > maxReviewers {
+		if maxReviewers > 0 && reviewersWritten >= maxReviewers {
 			break
 		}
 
@@ -407,6 +407,21 @@ func (pr *PullRequest) GetGitHeadRefName() string { // TODO: make it return RefN
 	return git.RefNameFromPullIndex(pr.Index).String()
 }
 
+func (pr *PullRequest) GetInstructionsCliArgs() (ret struct {
+	BaseBranchArg  string
+	HeadBranchArg  string
+	LocalBranchArg string
+},
+) {
+	ret.BaseBranchArg = util.ShellEscape(pr.BaseBranch)
+	ret.HeadBranchArg = util.ShellEscape(pr.HeadBranch)
+	ret.LocalBranchArg = ret.HeadBranchArg
+	if pr.HeadRepo != nil && pr.HeadRepoID != pr.BaseRepoID {
+		ret.LocalBranchArg = util.ShellEscape(pr.HeadRepo.OwnerName) + "-" + ret.HeadBranchArg
+	}
+	return ret
+}
+
 // GetReviewCommentsCount returns the number of review comments made on the diff of a PR review (not including comments on commits or issues in a PR)
 func (pr *PullRequest) GetReviewCommentsCount(ctx context.Context) int {
 	opts := FindCommentsOptions{

models/issues/pull_list.go

@@ -335,8 +335,8 @@ func (prs PullRequestList) LoadReviews(ctx context.Context) (ReviewList, error)
 			"reviewer_team_id":   0,
 		}).
 		GroupBy("issue_id, reviewer_id")
-	// Get latest review of each reviewer, sorted in order they were made
-	if err := db.GetEngine(ctx).In("id", subQuery).OrderBy("review.updated_unix ASC").Find(&reviews); err != nil {
+	// Get latest review of each reviewer, sorted in order they were made. Joined because MySQL scans all reviews for "id IN (subquery)", xorm aliases the subquery "review".
+	if err := db.GetEngine(ctx).Table("review").Alias("latest").Join("INNER", subQuery, "latest.id = review.id").OrderBy("latest.updated_unix ASC").Find(&reviews); err != nil {
 		return nil, err
 	}
 
@@ -350,7 +350,7 @@ func (prs PullRequestList) LoadReviews(ctx context.Context) (ReviewList, error)
 		"reviewer_team_id": 0,
 	}).
 		GroupBy("issue_id, reviewer_team_id")
-	if err := db.GetEngine(ctx).In("id", subQueryTeam).OrderBy("review.updated_unix ASC").Find(&teamReviewRequests); err != nil {
+	if err := db.GetEngine(ctx).Table("review").Alias("latest").Join("INNER", subQueryTeam, "latest.id = review.id").OrderBy("latest.updated_unix ASC").Find(&teamReviewRequests); err != nil {
 		return nil, err
 	}
 

models/issues/pull_test.go

@@ -14,6 +14,7 @@ import (
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -403,6 +404,10 @@ func testGetApprovers(t *testing.T) {
 	approvers := pr.GetApprovers(t.Context())
 	expected := "Reviewed-by: User Five <user5@example.com>\nReviewed-by: Org Six <org6@example.com>\n"
 	assert.Equal(t, expected, approvers)
+
+	defer test.MockVariableValue(&setting.Repository.PullRequest.DefaultMergeMessageMaxApprovers, 1)()
+	approvers = pr.GetApprovers(t.Context())
+	assert.Equal(t, "Reviewed-by: User Five <user5@example.com>\n", approvers)
 }
 
 func testGetPullRequestByMergedCommit(t *testing.T) {

models/issues/review.go

@@ -285,23 +285,12 @@ func IsOfficialReviewer(ctx context.Context, issue *Issue, reviewer *user_model.
 	}
 	if rule == nil {
 		// if no rule is found, then user with write access can make official reviews
-		err := pr.LoadBaseRepo(ctx)
-		if err != nil {
+		if err := pr.LoadBaseRepo(ctx); err != nil {
 			return false, err
 		}
-		writeAccess, err := access_model.HasAccessUnit(ctx, reviewer, pr.BaseRepo, unit.TypeCode, perm.AccessModeWrite)
-		if err != nil {
-			return false, err
-		}
-		return writeAccess, nil
+		return access_model.HasAccessUnit(ctx, reviewer, pr.BaseRepo, unit.TypeCode, perm.AccessModeWrite)
 	}
-
-	official, err := git_model.IsUserOfficialReviewer(ctx, rule, reviewer)
-	if official || err != nil {
-		return official, err
-	}
-
-	return false, nil
+	return git_model.IsUserOfficialReviewer(ctx, rule, reviewer)
 }
 
 // IsOfficialReviewerTeam check if reviewer in this team can make official reviews in issue (counts towards required approvals)
@@ -313,66 +302,82 @@ func IsOfficialReviewerTeam(ctx context.Context, issue *Issue, team *organizatio
 	if err != nil {
 		return false, err
 	}
-	if pb == nil {
-		return false, nil
+	if pb != nil && pb.EnableApprovalsWhitelist {
+		return slices.Contains(pb.ApprovalsWhitelistTeamIDs, team.ID), nil
 	}
-
-	if !pb.EnableApprovalsWhitelist {
-		return team.UnitAccessMode(ctx, unit.TypeCode) >= perm.AccessModeWrite, nil
-	}
-
-	return slices.Contains(pb.ApprovalsWhitelistTeamIDs, team.ID), nil
+	return team.UnitAccessMode(ctx, unit.TypeCode) >= perm.AccessModeWrite, nil
 }
 
-// RecalculateReviewsOfficial re-evaluates the "official" flag of the latest approve
-// and reject reviews of an issue against its pull request's current base branch.
-// It must be called whenever the target branch changes, otherwise an approval that
-// was official on the previous (possibly unprotected) branch would keep satisfying
-// the new branch's protection rules.
-func RecalculateReviewsOfficial(ctx context.Context, issue *Issue) error {
-	if err := issue.LoadPullRequest(ctx); err != nil {
+// updateReviewerOfficial keeps the official flag only on the reviewer's latest approval, rejection or review request, and only if the reviewer is official
+func updateReviewerOfficial(ctx context.Context, issueID, reviewerID int64, official bool) error {
+	if _, err := db.GetEngine(ctx).Where(builder.Eq{"issue_id": issueID, "reviewer_id": reviewerID}).
+		NoAutoTime().Cols("official").Update(&Review{}); err != nil {
 		return err
 	}
+	if !official {
+		return nil
+	}
+	latest, err := GetReviewByIssueIDAndUserID(ctx, issueID, reviewerID)
+	if IsErrReviewNotExist(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	_, err = db.GetEngine(ctx).ID(latest.ID).NoAutoTime().Cols("official").Update(&Review{Official: true})
+	return err
+}
 
-	// Clearing and restoring the official flags must happen atomically, otherwise a
-	// failure in between would leave the reviews without any official flag set.
+// RecalculateReviewsOfficial re-evaluates the "official" flag of an issue's reviews and review requests
+// against its pull request's current base branch. It must be called whenever the target branch changes,
+// otherwise an approval that was official on the previous (possibly unprotected) branch would keep
+// satisfying the new branch's protection rules.
+func RecalculateReviewsOfficial(ctx context.Context, issue *Issue) error {
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		// Only the latest approve/reject review of each reviewer counts as official, so
-		// clear the flag on all of them first and restore it only where it still applies.
-		if _, err := db.GetEngine(ctx).
-			Where("issue_id = ?", issue.ID).
-			In("type", ReviewTypeApprove, ReviewTypeReject).
-			Cols("official").
-			Update(&Review{Official: false}); err != nil {
+		if _, err := db.GetEngine(ctx).Where("issue_id = ?", issue.ID).NoAutoTime().Cols("official").Update(&Review{}); err != nil {
 			return err
 		}
 
-		reviews, err := FindLatestReviews(ctx, FindReviewOptions{
-			Types:   []ReviewType{ReviewTypeApprove, ReviewTypeReject},
-			IssueID: issue.ID,
-		})
-		if err != nil {
+		reviewerIDs := make([]int64, 0, 5)
+		if err := db.GetEngine(ctx).Table("review").Cols("reviewer_id").
+			Where(builder.Eq{"issue_id": issue.ID, "original_author_id": 0}).
+			And(builder.In("type", ReviewTypeApprove, ReviewTypeReject, ReviewTypeRequest)).
+			And(builder.Neq{"reviewer_id": 0}).
+			Distinct("reviewer_id").Find(&reviewerIDs); err != nil {
 			return err
 		}
-
-		for _, review := range reviews {
-			if err := review.LoadReviewer(ctx); err != nil {
-				return err
-			}
-			if review.Reviewer == nil {
-				continue
-			}
-			official, err := IsOfficialReviewer(ctx, issue, review.Reviewer)
+		for _, reviewerID := range reviewerIDs {
+			_, reviewer, err := user_model.GetPossibleUserByID(ctx, reviewerID)
 			if err != nil {
 				return err
 			}
-			if official {
-				if _, err := db.GetEngine(ctx).ID(review.ID).Cols("official").Update(&Review{Official: true}); err != nil {
-					return err
-				}
+			official, err := IsOfficialReviewer(ctx, issue, reviewer)
+			if err != nil {
+				return err
+			}
+			if err := updateReviewerOfficial(ctx, issue.ID, reviewerID, official); err != nil {
+				return err
 			}
 		}
 
+		teamRequests := make([]*Review, 0, 5)
+		if err := db.GetEngine(ctx).Where(builder.Eq{"issue_id": issue.ID, "type": ReviewTypeRequest}).
+			And(builder.Gt{"reviewer_team_id": 0}).Find(&teamRequests); err != nil {
+			return err
+		}
+		for _, request := range teamRequests {
+			if err := request.LoadReviewerTeam(ctx); organization.IsErrTeamNotExist(err) {
+				continue
+			} else if err != nil {
+				return err
+			}
+			official, err := IsOfficialReviewerTeam(ctx, issue, request.ReviewerTeam)
+			if err != nil {
+				return err
+			}
+			if _, err := db.GetEngine(ctx).ID(request.ID).NoAutoTime().Cols("official").Update(&Review{Official: official}); err != nil {
+				return err
+			}
+		}
 		return nil
 	})
 }
@@ -474,7 +479,13 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 	defer committer.Close()
 	sess := db.GetEngine(ctx)
 
+	isApproveOrReject := reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject
 	official := false
+	if isApproveOrReject {
+		if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
+			return nil, nil, err
+		}
+	}
 
 	review, err := GetCurrentReview(ctx, doer, issue)
 	if err != nil {
@@ -486,16 +497,6 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 			return nil, nil, ContentEmptyErr{}
 		}
 
-		if reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject {
-			// Only reviewers latest review of type approve and reject shall count as "official", so existing reviews needs to be cleared
-			if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_id=?", false, issue.ID, doer.ID); err != nil {
-				return nil, nil, err
-			}
-			if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
-				return nil, nil, err
-			}
-		}
-
 		// No current review. Create a new one!
 		if review, err = CreateReview(ctx, CreateReviewOptions{
 			Type:     reviewType,
@@ -516,16 +517,6 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 			return nil, nil, ContentEmptyErr{}
 		}
 
-		if reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject {
-			// Only reviewers latest review of type approve and reject shall count as "official", so existing reviews needs to be cleared
-			if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_id=?", false, issue.ID, doer.ID); err != nil {
-				return nil, nil, err
-			}
-			if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
-				return nil, nil, err
-			}
-		}
-
 		review.Official = official
 		review.Issue = issue
 		review.Content = content
@@ -546,6 +537,16 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 		}
 	}
 
+	if isApproveOrReject {
+		if err := updateReviewerOfficial(ctx, issue.ID, doer.ID, official); err != nil {
+			return nil, nil, err
+		}
+	}
+
+	if reviewType == ReviewTypePending {
+		return review, nil, committer.Commit()
+	}
+
 	comm, err := CreateComment(ctx, &CreateCommentOptions{
 		Type:        CommentTypeReview,
 		Doer:        doer,
@@ -560,7 +561,7 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 	}
 
 	// try to remove team review request if need
-	if issue.Repo.Owner.IsOrganization() && (reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject) {
+	if issue.Repo.Owner.IsOrganization() && isApproveOrReject {
 		teamReviewRequests := make([]*Review, 0, 10)
 		if err := sess.SQL("SELECT * FROM review WHERE issue_id = ? AND reviewer_team_id > 0 AND type = ?", issue.ID, ReviewTypeRequest).Find(&teamReviewRequests); err != nil {
 			return nil, nil, err
@@ -698,8 +699,6 @@ func InsertReviews(ctx context.Context, reviews []*Review) error {
 // AddReviewRequest add a review request from one reviewer
 func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_model.User, isCodeOwners bool) (*Comment, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Comment, error) {
-		sess := db.GetEngine(ctx)
-
 		review, err := GetReviewByIssueIDAndUserID(ctx, issue.ID, reviewer.ID)
 		if err != nil && !IsErrReviewNotExist(err) {
 			return nil, err
@@ -725,15 +724,9 @@ func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_mo
 			}
 		}
 
-		// if the reviewer is an official reviewer,
-		// remove the official flag in the all previous reviews
 		official, err := IsOfficialReviewer(ctx, issue, reviewer)
 		if err != nil {
 			return nil, err
-		} else if official {
-			if _, err := sess.Exec("UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_id=?", false, issue.ID, reviewer.ID); err != nil {
-				return nil, err
-			}
 		}
 
 		review, err = CreateReview(ctx, CreateReviewOptions{
@@ -747,6 +740,10 @@ func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_mo
 			return nil, err
 		}
 
+		if err := updateReviewerOfficial(ctx, issue.ID, reviewer.ID, official); err != nil {
+			return nil, err
+		}
+
 		comment, err := CreateComment(ctx, &CreateCommentOptions{
 			Type:            CommentTypeReviewRequest,
 			Doer:            doer,
@@ -787,10 +784,9 @@ func RemoveReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user
 		official, err := IsOfficialReviewer(ctx, issue, reviewer)
 		if err != nil {
 			return nil, err
-		} else if official {
-			if err := restoreLatestOfficialReview(ctx, issue.ID, reviewer.ID); err != nil {
-				return nil, err
-			}
+		}
+		if err := updateReviewerOfficial(ctx, issue.ID, reviewer.ID, official); err != nil {
+			return nil, err
 		}
 
 		return CreateComment(ctx, &CreateCommentOptions{
@@ -804,22 +800,6 @@ func RemoveReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user
 	})
 }
 
-// Recalculate the latest official review for reviewer
-func restoreLatestOfficialReview(ctx context.Context, issueID, reviewerID int64) error {
-	review, err := GetReviewByIssueIDAndUserID(ctx, issueID, reviewerID)
-	if err != nil && !IsErrReviewNotExist(err) {
-		return err
-	}
-
-	if review != nil {
-		if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE id=?", true, review.ID); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
 // AddTeamReviewRequest add a review request from one team
 func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organization.Team, doer *user_model.User, isCodeOwners bool) (*Comment, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Comment, error) {
@@ -836,10 +816,6 @@ func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organizat
 		official, err := IsOfficialReviewerTeam(ctx, issue, reviewer)
 		if err != nil {
 			return nil, fmt.Errorf("isOfficialReviewerTeam(): %w", err)
-		} else if !official {
-			if official, err = IsOfficialReviewer(ctx, issue, doer); err != nil {
-				return nil, fmt.Errorf("isOfficialReviewer(): %w", err)
-			}
 		}
 
 		if review, err = CreateReview(ctx, CreateReviewOptions{
@@ -852,12 +828,6 @@ func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organizat
 			return nil, err
 		}
 
-		if official {
-			if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE issue_id=? AND reviewer_team_id=?", false, issue.ID, reviewer.ID); err != nil {
-				return nil, err
-			}
-		}
-
 		comment, err := CreateComment(ctx, &CreateCommentOptions{
 			Type:            CommentTypeReviewRequest,
 			Doer:            doer,
@@ -892,25 +862,6 @@ func RemoveTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organi
 			return nil, err
 		}
 
-		official, err := IsOfficialReviewerTeam(ctx, issue, reviewer)
-		if err != nil {
-			return nil, fmt.Errorf("isOfficialReviewerTeam(): %w", err)
-		}
-
-		if official {
-			// recalculate which is the latest official review from that team
-			review, err := GetReviewByIssueIDAndUserID(ctx, issue.ID, -reviewer.ID)
-			if err != nil && !IsErrReviewNotExist(err) {
-				return nil, err
-			}
-
-			if review != nil {
-				if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE id=?", true, review.ID); err != nil {
-					return nil, err
-				}
-			}
-		}
-
 		if doer == nil {
 			return nil, nil
 		}
@@ -1037,10 +988,8 @@ func DeleteReview(ctx context.Context, r *Review) error {
 			return err
 		}
 
-		if r.Official {
-			if err := restoreLatestOfficialReview(ctx, r.IssueID, r.ReviewerID); err != nil {
-				return err
-			}
+		if r.Official && r.OriginalAuthorID == 0 {
+			return updateReviewerOfficial(ctx, r.IssueID, r.ReviewerID, true)
 		}
 		return nil
 	})

models/issues/review_test.go

@@ -9,6 +9,7 @@ import (
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
 	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
@@ -440,3 +441,17 @@ func TestRecalculateReviewsOfficial(t *testing.T) {
 	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
 	assert.True(t, review.Official)
 }
+
+func TestTeamReviewRequestOfficial(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 12})
+	assert.NoError(t, issue.LoadRepo(t.Context()))
+	comment, err := issues_model.AddTeamReviewRequest(t.Context(), issue, unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2}), &user_model.User{ID: 2}, false)
+	assert.NoError(t, err)
+	assert.True(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: comment.ReviewID}).Official)
+
+	assert.NoError(t, db.Insert(t.Context(), &git_model.ProtectedBranch{RepoID: issue.RepoID, RuleName: "master", EnableApprovalsWhitelist: true}))
+	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
+	assert.False(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: comment.ReviewID}).Official)
+}

models/organization/org_list.go

@@ -70,7 +70,7 @@ func queryUserOrgIDs(userID int64, includePrivate bool) *builder.Builder {
 
 func (opts FindOrgOptions) ToConds() builder.Cond {
 	var cond builder.Cond = builder.Eq{"`user`.`type`": user_model.UserTypeOrganization}
-	if opts.UserID > 0 {
+	if opts.UserID != 0 {
 		cond = cond.And(builder.In("`user`.`id`", queryUserOrgIDs(opts.UserID, opts.IncludeVisibility == structs.VisibleTypePrivate)))
 	}
 	// public=0, limited=1, private=2

models/organization/team_repo.go

@@ -13,12 +13,12 @@ import (
 	"xorm.io/builder"
 )
 
-// TeamRepo represents an team-repository relation.
+// TeamRepo represents an org-team-repository relation.
 type TeamRepo struct {
 	ID     int64 `xorm:"pk autoincr"`
 	OrgID  int64 `xorm:"INDEX"`
 	TeamID int64 `xorm:"UNIQUE(s)"`
-	RepoID int64 `xorm:"UNIQUE(s)"`
+	RepoID int64 `xorm:"UNIQUE(s) INDEX"`
 }
 
 // HasTeamRepo returns true if given repository belongs to team.

models/organization/team_user.go

@@ -12,12 +12,12 @@ import (
 	"xorm.io/builder"
 )
 
-// TeamUser represents an team-user relation.
+// TeamUser represents a team-user relation.
 type TeamUser struct {
 	ID     int64 `xorm:"pk autoincr"`
 	OrgID  int64 `xorm:"INDEX"`
 	TeamID int64 `xorm:"UNIQUE(s)"`
-	UID    int64 `xorm:"UNIQUE(s)"`
+	UID    int64 `xorm:"UNIQUE(s) INDEX"`
 }
 
 // IsTeamMember returns true if given user is a member of team.

models/packages/package_blob.go

@@ -122,8 +122,8 @@ func GetTotalUnreferencedBlobSize(ctx context.Context) (int64, error) {
 }
 
 // IsBlobAccessibleForUser tests if the user has access to the blob
-func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model.User) (bool, error) {
-	if user.IsAdmin {
+func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model.User, publicOnly bool) (bool, error) {
+	if user.IsAdmin && !publicOnly {
 		return true, nil
 	}
 	ownerVisibilities := []structs.VisibleType{structs.VisibleTypePublic}
@@ -153,6 +153,9 @@ func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model
 			Or(builder.Eq{"`user`.type": user_model.UserTypeOrganization}.
 				And(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamAuthorize}.Or(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamUnitAccessMode}))),
 	)
+	if publicOnly {
+		cond = cond.And(builder.Eq{"`user`.visibility": structs.VisibleTypePublic})
+	}
 
 	return db.GetEngine(ctx).
 		Table("package_blob").

models/packages/package_blob_test.go

@@ -64,11 +64,15 @@ func TestIsBlobAccessibleForRestrictedUser(t *testing.T) {
 	_, err = TryInsertFile(t.Context(), &PackageFile{VersionID: version.ID, BlobID: blob.ID, Name: "blob", LowerName: "blob"})
 	require.NoError(t, err)
 
-	accessible, err := IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}))
+	accessible, err := IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}), false)
 	require.NoError(t, err)
 	assert.True(t, accessible)
 
-	accessible, err = IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 29}))
+	accessible, err = IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 29}), false)
+	require.NoError(t, err)
+	assert.False(t, accessible)
+
+	accessible, err = IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}), true)
 	require.NoError(t, err)
 	assert.False(t, accessible)
 }

models/packages/package_property.go

@@ -30,9 +30,9 @@ const (
 // PackageProperty represents a property of a package, version or file
 type PackageProperty struct {
 	ID      int64        `xorm:"pk autoincr"`
-	RefType PropertyType `xorm:"INDEX NOT NULL"`
-	RefID   int64        `xorm:"INDEX NOT NULL"`
-	Name    string       `xorm:"INDEX NOT NULL"`
+	RefType PropertyType `xorm:"NOT NULL"`
+	RefID   int64        `xorm:"INDEX(ref_id_name) NOT NULL"`
+	Name    string       `xorm:"INDEX(ref_id_name) NOT NULL"`
 	Value   string       `xorm:"LONGTEXT NOT NULL"`
 }
 

models/perm/access/access.go

@@ -25,7 +25,7 @@ import (
 type Access struct {
 	ID     int64 `xorm:"pk autoincr"`
 	UserID int64 `xorm:"UNIQUE(s)"`
-	RepoID int64 `xorm:"UNIQUE(s)"`
+	RepoID int64 `xorm:"UNIQUE(s) INDEX"`
 	Mode   perm.AccessMode
 }
 

models/perm/access/repo_permission.go

@@ -506,13 +506,16 @@ func GetIndividualUserRepoPermission(ctx context.Context, repo *repo_model.Repos
 		}
 	}
 
-	// if user in an owner team
+	// Apply repository-level access from teams.
 	for _, team := range perm.orgRepoTeams {
 		if team.IsOwnerTeam() || team.AccessMode == perm_model.AccessModeOwner {
 			perm.AccessMode = perm_model.AccessModeOwner
 			perm.unitsMode = nil
 			return perm, nil
 		}
+		if team.AccessMode == perm_model.AccessModeAdmin {
+			perm.AccessMode = max(perm.AccessMode, perm_model.AccessModeAdmin)
+		}
 	}
 
 	for _, u := range repo.Units {

models/perm/access/repo_permission_test.go

@@ -236,6 +236,32 @@ func testGetIndividualUserRepoPermission(t *testing.T) {
 		require.Empty(t, users)
 	})
 
+	t.Run("DoerWithAdminTeamWithoutAccessRow", func(t *testing.T) {
+		_, err := db.GetEngine(ctx).ID(team.ID).Cols("authorize").Update(&organization.Team{AccessMode: perm_model.AccessModeAdmin})
+		require.NoError(t, err)
+		defer func() {
+			_, err := db.GetEngine(ctx).ID(team.ID).Cols("authorize").Update(&organization.Team{AccessMode: perm_model.AccessModeNone})
+			require.NoError(t, err)
+		}()
+
+		for _, repo := range []*repo_model.Repository{repo3, repo32} {
+			perm, err := GetIndividualUserRepoPermission(ctx, repo, user)
+			require.NoError(t, err)
+			assert.Equal(t, perm_model.AccessModeAdmin, perm.AccessMode)
+			assert.True(t, perm.IsAdmin())
+			assert.False(t, perm.IsOwner())
+			for _, repoUnit := range repo.Units {
+				assert.Equal(t, perm_model.AccessModeAdmin, perm.UnitAccessMode(repoUnit.Type))
+			}
+		}
+
+		unrelatedRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 5})
+		require.Equal(t, org.ID, unrelatedRepo.OwnerID)
+		perm, err := GetIndividualUserRepoPermission(ctx, unrelatedRepo, user)
+		require.NoError(t, err)
+		assert.False(t, perm.IsAdmin())
+	})
+
 	require.NoError(t, db.Insert(ctx, repo_model.Collaboration{RepoID: repo3.ID, UserID: user.ID, Mode: perm_model.AccessModeWrite}))
 	require.NoError(t, db.Insert(ctx, Access{RepoID: repo3.ID, UserID: user.ID, Mode: perm_model.AccessModeWrite}))
 	t.Run("DoerWithReadIssueTeamAndWriteCollaboratorOnPrivateRepo", func(t *testing.T) {

models/project/project.go

@@ -225,7 +225,7 @@ func (opts SearchOptions) ToConds() builder.Cond {
 	if opts.Type > 0 {
 		cond = cond.And(builder.Eq{"type": opts.Type})
 	}
-	if opts.OwnerID > 0 {
+	if opts.OwnerID != 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 

models/renderhelper/repo_file_test.go

@@ -9,6 +9,7 @@ import (
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/test"
 
 	_ "gitea.dev/modules/markup/orgmode"
 
@@ -80,6 +81,23 @@ func TestRepoFile(t *testing.T) {
 <video src="/user2/repo1/media/commit/1234/my%20dir/LINK">
 </video>`, rendered)
 	})
+
+	t.Run("PictureSource", func(t *testing.T) {
+		rctx := NewRenderContextRepoFile(t.Context(), repo1, RepoFileOptions{CurrentRefSubURL: "branch/main"}).
+			WithMarkupType(markdown.MarkupName)
+		rendered, err := testRenderString(rctx, `<picture><source media="(prefers-color-scheme: dark)" srcset="dark.svg"><img src="light.svg"></picture>`)
+		assert.NoError(t, err)
+		assert.Equal(t, test.NormalizeHTMLSpaces(`
+<p>
+	<a href="/user2/repo1/src/branch/main/light.svg" target="_blank" rel="nofollow noopener">
+		<picture>
+			<source media="(prefers-color-scheme: dark)" srcset="/user2/repo1/media/branch/main/dark.svg"/>
+			<img src="/user2/repo1/media/branch/main/light.svg"/>
+		</picture>
+	</a>
+</p>
+`), test.NormalizeHTMLSpaces(rendered))
+	})
 }
 
 func TestRepoFileOrgMode(t *testing.T) {

models/repo/attachment.go

@@ -42,6 +42,10 @@ func init() {
 	db.RegisterModel(new(Attachment))
 }
 
+func (a *Attachment) IsLinked() bool {
+	return a.IssueID > 0 || a.ReleaseID > 0 || a.CommentID > 0
+}
+
 // IncreaseDownloadCount is update download count + 1
 func (a *Attachment) IncreaseDownloadCount(ctx context.Context) error {
 	// Update download count.
@@ -133,6 +137,9 @@ func ExistAttachmentsByUUID(ctx context.Context, uuid string) (bool, error) {
 
 // GetAttachmentsByIssueID returns all attachments of an issue.
 func GetAttachmentsByIssueID(ctx context.Context, issueID int64) ([]*Attachment, error) {
+	if issueID == 0 { // unsaved issue, would match every issue-less attachment
+		return []*Attachment{}, nil
+	}
 	attachments := make([]*Attachment, 0, 10)
 	return attachments, db.GetEngine(ctx).Where("issue_id = ? AND comment_id = 0", issueID).Find(&attachments)
 }

models/repo/attachment_test.go

@@ -36,6 +36,10 @@ func TestGetByCommentOrIssueID(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Len(t, attachments, 1)
 
+	attachments, err = repo_model.GetAttachmentsByIssueID(t.Context(), 0)
+	assert.NoError(t, err)
+	assert.Empty(t, attachments)
+
 	attachments, err = repo_model.GetAttachmentsByCommentID(t.Context(), 1)
 	assert.NoError(t, err)
 	assert.Len(t, attachments, 2)

models/repo/language_stats.go

@@ -151,7 +151,7 @@ func UpdateLanguageStats(ctx context.Context, repo *Repository, commitID string,
 		var topLang string
 		var s int64
 		for lang, size := range stats {
-			if size > s {
+			if size > s || (size == s && lang < topLang) {
 				s = size
 				topLang = lang
 			}

models/repo/language_stats_test.go

@@ -0,0 +1,28 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package repo_test
+
+import (
+	"testing"
+
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateLanguageStatsPrimaryTie(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+
+	require.NoError(t, repo_model.UpdateLanguageStats(t.Context(), repo, "1234567890", map[string]int64{"Go": 10, "C": 10}))
+
+	stats, err := repo_model.GetLanguageStats(t.Context(), repo)
+	require.NoError(t, err)
+	require.Len(t, stats, 2)
+	for _, stat := range stats {
+		assert.Equal(t, stat.Language == "C", stat.IsPrimary, stat.Language)
+	}
+}

models/repo/release.go

@@ -191,6 +191,10 @@ func AddReleaseAttachments(ctx context.Context, releaseID int64, attachmentUUIDs
 	}
 
 	for i := range attachments {
+		if attachments[i].IssueID != 0 || attachments[i].CommentID != 0 || attachments[i].ReleaseID != 0 {
+			return util.NewPermissionDeniedErrorf("attachment is already linked")
+		}
+
 		if attachments[i].RepoID == 0 && attachments[i].CreatedUnix < LegacyAttachmentMissingRepoIDCutoff {
 			attachments[i].RepoID = rel.RepoID
 			if _, err = db.GetEngine(ctx).ID(attachments[i].ID).Cols("repo_id").Update(attachments[i]); err != nil {
@@ -201,10 +205,6 @@ func AddReleaseAttachments(ctx context.Context, releaseID int64, attachmentUUIDs
 		if attachments[i].RepoID != rel.RepoID {
 			return util.NewPermissionDeniedErrorf("attachment belongs to different repository")
 		}
-
-		if attachments[i].ReleaseID != 0 {
-			return util.NewPermissionDeniedErrorf("release permission denied")
-		}
 		attachments[i].ReleaseID = releaseID
 		// No assign value could be 0, so ignore AllCols().
 		if _, err = db.GetEngine(ctx).ID(attachments[i].ID).Cols("release_id").Update(attachments[i]); err != nil {
@@ -357,21 +357,21 @@ func GetLatestReleaseByRepoID(ctx context.Context, repoID int64) (*Release, erro
 }
 
 type releaseMetaSearch struct {
-	ID  []int64
-	Rel []*Release
+	IDs      []int64
+	Releases []*Release
 }
 
 func (s releaseMetaSearch) Len() int {
-	return len(s.ID)
+	return len(s.IDs)
 }
 
 func (s releaseMetaSearch) Swap(i, j int) {
-	s.ID[i], s.ID[j] = s.ID[j], s.ID[i]
-	s.Rel[i], s.Rel[j] = s.Rel[j], s.Rel[i]
+	s.IDs[i], s.IDs[j] = s.IDs[j], s.IDs[i]
+	s.Releases[i], s.Releases[j] = s.Releases[j], s.Releases[i]
 }
 
 func (s releaseMetaSearch) Less(i, j int) bool {
-	return s.ID[i] < s.ID[j]
+	return s.IDs[i] < s.IDs[j]
 }
 
 func hasDuplicateName(attaches []*Attachment) bool {
@@ -396,19 +396,26 @@ func GetReleaseAttachments(ctx context.Context, rels ...*Release) (err error) {
 	//    then merge join them
 
 	// Sort
-	sortedRels := releaseMetaSearch{ID: make([]int64, len(rels)), Rel: make([]*Release, len(rels))}
+	sortedRels := releaseMetaSearch{IDs: make([]int64, 0, len(rels)), Releases: make([]*Release, 0, len(rels))}
 	var attachments []*Attachment
-	for index, element := range rels {
-		element.Attachments = []*Attachment{}
-		sortedRels.ID[index] = element.ID
-		sortedRels.Rel[index] = element
+	for _, rel := range rels {
+		// if a provided "Release" has no ID, don't query it, otherwise, the "IN" query will return all other attachments for the repo
+		if rel.ID == 0 {
+			continue
+		}
+		rel.Attachments = []*Attachment{}
+		sortedRels.IDs = append(sortedRels.IDs, rel.ID)
+		sortedRels.Releases = append(sortedRels.Releases, rel)
+	}
+	if len(sortedRels.IDs) == 0 {
+		return nil
 	}
 	sort.Sort(sortedRels)
 
 	// Select attachments
 	err = db.GetEngine(ctx).
 		Asc("release_id", "name").
-		In("release_id", sortedRels.ID).
+		In("release_id", sortedRels.IDs).
 		Find(&attachments)
 	if err != nil {
 		return err
@@ -417,14 +424,14 @@ func GetReleaseAttachments(ctx context.Context, rels ...*Release) (err error) {
 	// merge join
 	currentIndex := 0
 	for _, attachment := range attachments {
-		for sortedRels.ID[currentIndex] < attachment.ReleaseID {
+		for sortedRels.IDs[currentIndex] < attachment.ReleaseID {
 			currentIndex++
 		}
-		sortedRels.Rel[currentIndex].Attachments = append(sortedRels.Rel[currentIndex].Attachments, attachment)
+		sortedRels.Releases[currentIndex].Attachments = append(sortedRels.Releases[currentIndex].Attachments, attachment)
 	}
 
 	// Makes URL's predictable
-	for _, release := range rels {
+	for _, release := range sortedRels.Releases {
 		// If we have no Repo, we don't need to execute this loop
 		if release.Repo == nil {
 			continue

models/repo/release_test.go

@@ -53,6 +53,18 @@ func TestAddReleaseAttachmentsRejectsDifferentRepo(t *testing.T) {
 	assert.Zero(t, attach.ReleaseID, "attachment should not be linked to release on failure")
 }
 
+func TestAddReleaseAttachmentsRejectsIssueAttachment(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	uuid := "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11"
+	err := AddReleaseAttachments(t.Context(), 1, []string{uuid})
+	assert.ErrorIs(t, err, util.ErrPermissionDenied)
+
+	attach, err := GetAttachmentByUUID(t.Context(), uuid)
+	assert.NoError(t, err)
+	assert.Zero(t, attach.ReleaseID)
+}
+
 func TestAddReleaseAttachmentsAllowsLegacyMissingRepoID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 

models/repo/repo.go

@@ -494,10 +494,9 @@ func (repo *Repository) composeCommonMetas(ctx context.Context) map[string]strin
 		repo.MustOwner(ctx)
 		if repo.Owner.IsOrganization() {
 			teams := make([]string, 0, 5)
-			_ = db.GetEngine(ctx).Table("team_repo").
+			_ = db.GetEngine(ctx).Select("team.lower_name").Table("team_repo").
 				Join("INNER", "team", "team.id = team_repo.team_id").
 				Where("team_repo.repo_id = ?", repo.ID).
-				Select("team.lower_name").
 				OrderBy("team.lower_name").
 				Find(&teams)
 			metas["teams"] = "," + strings.Join(teams, ",") + ","
@@ -616,6 +615,15 @@ func ComposeHTTPSCloneURL(ctx context.Context, owner, repo string) string {
 
 // ComposeSSHCloneURL returns SSH clone URL based on the given owner and repository name.
 func ComposeSSHCloneURL(doer *user_model.User, ownerName, repoName string) string {
+	return composeSSHCloneURL(doer, ownerName, repoName, setting.Repository.UseCompatSSHURI)
+}
+
+// ComposeSSHCloneURI is like ComposeSSHCloneURL but always returns the "ssh://" form, because "go get" rejects scp-style addresses
+func ComposeSSHCloneURI(doer *user_model.User, ownerName, repoName string) string {
+	return composeSSHCloneURL(doer, ownerName, repoName, true)
+}
+
+func composeSSHCloneURL(doer *user_model.User, ownerName, repoName string, useURI bool) string {
 	sshUser := setting.SSH.User
 	sshDomain := setting.SSH.Domain
 
@@ -642,7 +650,7 @@ func ComposeSSHCloneURL(doer *user_model.User, ownerName, repoName string) strin
 	if ip := net.ParseIP(sshHost); ip != nil && ip.To4() == nil {
 		sshHost = "[" + sshHost + "]" // for IPv6 address, wrap it with brackets
 	}
-	if setting.Repository.UseCompatSSHURI {
+	if useURI {
 		return fmt.Sprintf("ssh://%s@%s/%s/%s.git", sshUser, sshHost, url.PathEscape(ownerName), url.PathEscape(repoName))
 	}
 	return fmt.Sprintf("%s@%s:%s/%s.git", sshUser, sshHost, url.PathEscape(ownerName), url.PathEscape(repoName))

models/repo/repo_list.go

@@ -373,8 +373,7 @@ func SearchRepositoryCondition(opts SearchRepoOptions) builder.Cond {
 	cond := builder.NewCond()
 
 	if opts.Private {
-		if opts.Actor != nil && !opts.Actor.IsAdmin && opts.Actor.ID != opts.OwnerID {
-			// OK we're in the context of a User
+		if opts.Actor != nil && !opts.Actor.IsAdmin {
 			cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
 		}
 	} else {
@@ -762,7 +761,8 @@ func FindUserCodeAccessibleOwnerRepoIDs(ctx context.Context, ownerID int64, user
 func PublicRepoUnderPublicOwnerCond() builder.Cond {
 	return builder.And(
 		builder.Eq{"`repository`.is_private": false},
-		builder.In("`repository`.owner_id", builder.Select("id").From("`user`").Where(builder.Eq{"visibility": structs.VisibleTypePublic})),
+		builder.Exists(builder.Select("1").From("`user` repo_owner").
+			Where(builder.Expr("repo_owner.id = `repository`.owner_id").And(builder.Eq{"repo_owner.visibility": structs.VisibleTypePublic}))),
 	)
 }
 

models/repo/repo_test.go

@@ -185,6 +185,8 @@ func TestComposeSSHCloneURL(t *testing.T) {
 	assert.Equal(t, "git@domain:user/repo.git", ComposeSSHCloneURL(&user_model.User{Name: "doer"}, "user", "repo"))
 	setting.Repository.UseCompatSSHURI = true
 	assert.Equal(t, "ssh://git@domain/user/repo.git", ComposeSSHCloneURL(&user_model.User{Name: "doer"}, "user", "repo"))
+	setting.Repository.UseCompatSSHURI = false
+	assert.Equal(t, "ssh://git@domain/user/repo.git", ComposeSSHCloneURI(nil, "user", "repo"))
 	// test SSH_DOMAIN while use non-standard SSH port
 	setting.SSH.Port = 123
 	setting.Repository.UseCompatSSHURI = false

models/repo/update.go

@@ -77,7 +77,7 @@ func IsErrRepoAlreadyExist(err error) bool {
 }
 
 func (err ErrRepoAlreadyExist) Error() string {
-	return fmt.Sprintf("repository already exists [uname: %s, name: %s]", err.Uname, err.Name)
+	return fmt.Sprintf("repository already exists [owner: %s, repo: %s]", err.Uname, err.Name)
 }
 
 func (err ErrRepoAlreadyExist) Unwrap() error {

models/repo/watch.go

@@ -20,9 +20,10 @@ type WatchMode int8
 const (
 	WatchModeNone WatchMode = iota // 0 watch nothing unless mentioned
 
-	WatchModeNormal // 1 proactively watching (all or custom)
+	WatchModeNormal // 1 proactively watching (all, or custom before WatchModeCustom)
 	WatchModeDont   // 2 ignore the repo
 	WatchModeAuto   // 3 automatically watching (from AutoWatchOnChanges)
+	WatchModeCustom // 4 watching the events picked in the custom watch options
 )
 
 // WatchType is the `watch` column gating one kind of notification
@@ -38,7 +39,7 @@ const (
 type Watch struct {
 	ID          int64              `xorm:"pk autoincr"`
 	UserID      int64              `xorm:"UNIQUE(watch)"`
-	RepoID      int64              `xorm:"UNIQUE(watch)"`
+	RepoID      int64              `xorm:"UNIQUE(watch) INDEX"`
 	Mode        WatchMode          `xorm:"SMALLINT NOT NULL DEFAULT 1"`
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
@@ -79,7 +80,7 @@ func (w *Watch) IsWatching() bool {
 
 // IsWatchingAll reports whether every event is enabled, which is the "all activity" mode
 func (w *Watch) IsWatchingAll() bool {
-	return w.IncludePullRequests && w.IncludeIssues && w.IncludeReleases
+	return w.Mode != WatchModeCustom && w.IncludePullRequests && w.IncludeIssues && w.IncludeReleases
 }
 
 func (w *Watch) IsWatchingAny() bool {
@@ -111,6 +112,9 @@ func IsWatchingRepo(ctx context.Context, userID, repoID int64) bool {
 }
 
 func watchRepoByMode(ctx context.Context, watch *Watch, mode WatchMode) (err error) {
+	if watch.UserID <= 0 {
+		return nil
+	}
 	if watch.Mode == mode {
 		return nil
 	}
@@ -166,6 +170,9 @@ func WatchRepoAuto(ctx context.Context, doer *user_model.User, repo *Repository,
 	if user_model.IsUserBlockedBy(ctx, doer, repo.OwnerID) {
 		return user_model.ErrBlockedUser
 	}
+	if watch.Mode == WatchModeCustom { // keep the events the user picked
+		return nil
+	}
 
 	return watchRepoByMode(ctx, watch, WatchModeNormal)
 }
@@ -189,7 +196,7 @@ func WatchRepoWithOptions(ctx context.Context, doer *user_model.User, repo *Repo
 		if err != nil {
 			return err
 		}
-		if opts.Mode == WatchModeNormal {
+		if opts.Mode == WatchModeNormal || opts.Mode == WatchModeCustom {
 			_, err = db.GetEngine(ctx).Where("user_id=? AND repo_id=?", doer.ID, repo.ID).
 				Cols("include_pull_requests", "include_issues", "include_releases").
 				Update(&Watch{IncludePullRequests: opts.WatchPullRequests, IncludeIssues: opts.WatchIssues, IncludeReleases: opts.WatchReleases})
@@ -247,6 +254,16 @@ func GetRepoIgnorersIDs(ctx context.Context, repoID int64) ([]int64, error) {
 // but avoids joining with `user` for performance reasons
 // User permissions must be verified elsewhere if required
 func GetRepoWatchersIDs(ctx context.Context, repoID int64, watchType WatchType) ([]int64, error) {
+	return getRepoWatchersIDs(ctx, repoID, watchType, false)
+}
+
+// GetRepoCustomWatchersIDs is GetRepoWatchersIDs limited to custom watches, which unlike
+// watching all activity are never set up automatically (e.g. by AutoWatchNewRepos)
+func GetRepoCustomWatchersIDs(ctx context.Context, repoID int64, watchType WatchType) ([]int64, error) {
+	return getRepoWatchersIDs(ctx, repoID, watchType, true)
+}
+
+func getRepoWatchersIDs(ctx context.Context, repoID int64, watchType WatchType, customOnly bool) ([]int64, error) {
 	ids := make([]int64, 0, 64)
 	var watchColName string
 	switch watchType {
@@ -259,12 +276,19 @@ func GetRepoWatchersIDs(ctx context.Context, repoID int64, watchType WatchType)
 	default:
 		panic("invalid WatchType")
 	}
-	return ids, db.GetEngine(ctx).Table("watch").
+	sess := db.GetEngine(ctx).Table("watch").
 		Where("watch.repo_id=?", repoID).
 		And("watch.mode<>?", WatchModeDont).
-		And(builder.Eq{watchColName: true}).
-		Select("user_id").
-		Find(&ids)
+		And(builder.Eq{watchColName: true})
+	if customOnly { // matches SelectedMode() == "custom"
+		sess = sess.And(builder.Or(
+			builder.Eq{"watch.mode": WatchModeCustom},
+			builder.Eq{"watch.include_pull_requests": false},
+			builder.Eq{"watch.include_issues": false},
+			builder.Eq{"watch.include_releases": false},
+		))
+	}
+	return ids, sess.Select("user_id").Find(&ids)
 }
 
 // GetRepoWatchers returns range of users watching given repository.

models/repo/watch_test.go

@@ -34,7 +34,7 @@ func TestGetWatchers(t *testing.T) {
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 	watches, err := repo_model.GetWatchers(t.Context(), repo.ID)
 	assert.NoError(t, err)
-	// One watchers are inactive, thus minus 1
+	// One watcher is inactive, thus minus 1
 	assert.Len(t, watches, repo.NumWatches-1)
 	for _, watch := range watches {
 		assert.Equal(t, repo.ID, watch.RepoID)
@@ -90,24 +90,30 @@ func TestWatchIfAuto(t *testing.T) {
 
 	setting.Service.AutoWatchOnChanges = true
 
-	// Must not add watch
+	// Must not add watch (user 8 has "don't watch" set)
 	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), 8, 1, true))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
-	// Should not add watch
+	// Should not add watch (read operation)
 	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), 12, 1, false))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
-	// Should add watch
+	// Should add watch (write operation)
 	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), 12, 1, true))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount+1)
 
+	// Should not add watch (system user should not be able to watch)
+	assert.NoError(t, repo_model.WatchIfAuto(t.Context(), user_model.ActionsUserID, 1, true))
+	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
+	assert.NoError(t, err)
+	assert.Len(t, watchers, prevCount+1)
+
 	// Should remove watch, inhibit from adding auto
 	assert.NoError(t, repo_model.WatchRepoAuto(t.Context(), user12, repo, false))
 	watchers, err = repo_model.GetRepoWatchers(t.Context(), repo.ID, db.ListOptions{Page: 1})
@@ -145,7 +151,7 @@ func TestWatchOptions(t *testing.T) {
 	// repo 1 is watched by users 1, 4, 9 and 11, all with every event enabled
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	assert.NoError(t, repo_model.WatchRepoWithOptions(t.Context(), user, repo, repo_model.WatchOptions{Mode: repo_model.WatchModeNormal, WatchPullRequests: true}))
+	assert.NoError(t, repo_model.WatchRepoWithOptions(t.Context(), user, repo, repo_model.WatchOptions{Mode: repo_model.WatchModeNormal, WatchPullRequests: true})) // custom watches were stored like this before WatchModeCustom
 
 	for watchType, expected := range map[repo_model.WatchType][]int64{
 		repo_model.WatchPullRequests: {1, 4, 9, 11},
@@ -157,6 +163,20 @@ func TestWatchOptions(t *testing.T) {
 		assert.ElementsMatch(t, expected, ids, watchType)
 	}
 
+	// a custom watch picking every event differs from all activity, which can be set up automatically
+	customUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+	assert.NoError(t, repo_model.WatchRepoWithOptions(t.Context(), customUser, repo, repo_model.WatchOptions{Mode: repo_model.WatchModeCustom, WatchPullRequests: true, WatchIssues: true, WatchReleases: true}))
+	assert.NoError(t, repo_model.WatchRepoAuto(t.Context(), customUser, repo, true)) // must keep the custom watch
+	for watchType, expected := range map[repo_model.WatchType][]int64{
+		repo_model.WatchPullRequests: {1, 4},
+		repo_model.WatchIssues:       {4},
+		repo_model.WatchReleases:     {4},
+	} {
+		ids, err := repo_model.GetRepoCustomWatchersIDs(t.Context(), repo.ID, watchType)
+		assert.NoError(t, err)
+		assert.ElementsMatch(t, expected, ids, watchType)
+	}
+
 	// the options of one user must not show up for another
 	watches, err := repo_model.GetUserWatches(t.Context(), 4, []int64{repo.ID})
 	assert.NoError(t, err)
@@ -176,5 +196,6 @@ func TestWatchSelectedMode(t *testing.T) {
 	assert.Equal(t, "participate", (&repo_model.Watch{Mode: repo_model.WatchModeNormal}).SelectedMode())
 	assert.Equal(t, "ignore", (&repo_model.Watch{Mode: repo_model.WatchModeDont}).SelectedMode())
 	assert.Equal(t, "custom", (&repo_model.Watch{Mode: repo_model.WatchModeNormal, IncludeIssues: true}).SelectedMode())
+	assert.Equal(t, "custom", (&repo_model.Watch{Mode: repo_model.WatchModeCustom, IncludePullRequests: true, IncludeIssues: true, IncludeReleases: true}).SelectedMode())
 	assert.Equal(t, "all", (&repo_model.Watch{Mode: repo_model.WatchModeAuto, IncludePullRequests: true, IncludeIssues: true, IncludeReleases: true}).SelectedMode())
 }

models/unittest/mock_http.go

@@ -12,6 +12,7 @@ import (
 	"net/url"
 	"os"
 	"slices"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -103,6 +104,10 @@ func NewMockWebServer(t *testing.T, liveServerBaseURL, testDataDir string, liveM
 			require.NoError(t, err, "creating fixture %s", fixturePath)
 			defer out.Close()
 
+			if resp.StatusCode != http.StatusOK {
+				_, err = fmt.Fprintf(out, "HTTP/1.1 %d %s\n", resp.StatusCode, http.StatusText(resp.StatusCode))
+				require.NoError(t, err, "writing fixture header for %s", liveURL)
+			}
 			for _, name := range slices.Sorted(maps.Keys(resp.Header)) {
 				if slices.Contains(ignoredHeaders, strings.ToLower(name)) {
 					continue
@@ -125,14 +130,21 @@ func NewMockWebServer(t *testing.T, liveServerBaseURL, testDataDir string, liveM
 
 		replayed := strings.ReplaceAll(string(raw), liveServerBaseURL, mockURL)
 		headers, body, _ := strings.Cut(replayed, "\n\n")
+		code := http.StatusOK
 		for line := range strings.SplitSeq(headers, "\n") {
+			if strings.HasPrefix(line, "HTTP/") {
+				parts := strings.SplitN(line, " ", 3)
+				require.Len(t, parts, 3)
+				code, _ = strconv.Atoi(parts[1])
+				continue
+			}
 			name, value, ok := strings.Cut(line, ": ")
 			if !ok || strings.EqualFold(name, "Content-Length") {
 				continue
 			}
 			w.Header().Set(name, value)
 		}
-		w.WriteHeader(http.StatusOK)
+		w.WriteHeader(code)
 		_, err = w.Write([]byte(body))
 		require.NoError(t, err)
 	})

models/user/email_address_test.go

@@ -151,16 +151,28 @@ func TestListEmails(t *testing.T) {
 
 func TestEmailAddressValidate(t *testing.T) {
 	cases := map[string]bool{
-		"":                   false,
-		"root@localhost":     true,
-		"user@[192.168.1.2]": true,
-		"@a":                 false,
-		"abc@gmail.com":      true,
-		"abc@gmail.com\n":    false,
+		"":   false,
+		"@a": false,
+
+		// "_" shouldn't appear in domain but can appear in hostname, since we can't stop site admins from doing so, just accept it
+		"root@local_host": true,
+		"root@localhost":  true,
+		"root@LOCALHOST":  true,
+
+		"user@[192.168.1.2]":  true,
+		"user@[IPv6:FFff::1]": true,
+
+		"abc@gmail.com":   true,
+		"abc@gmail.com.":  false,
+		"abc@gmail.com-":  false,
+		"abc@gmail.com\n": false,
+		"abc@gmail..com":  false,
+		"abc@gmail com":   false,
+		"abc@gmail*com":   false,
+
 		"Foo <foo@bar.com>":  false,
 		"abc@gmail.com (x)":  false,
-		"jürgen@example.com": false,
-		"a@foo_bar.com":      false,
+		"jürgen@example.com": false, // utf8 address is not supported yet
 	}
 	for tc, isValid := range cases {
 		t.Run(tc, func(t *testing.T) {