Commit Graph

776 Commits

Author SHA1 Message Date
wxiaoguang
72be55f7d3 Refactor git command stderr handling (#36402)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
And clean up legacy fragile & incorrect logic
2026-01-18 15:10:33 -08:00
TheFox0x7
906ad802cf add support for archive-upload rpc (#36391)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Add support for fetching archives with `git archive --remote <repo-url>`

closes: https://github.com/go-gitea/gitea/issues/23425

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-17 15:17:00 +00:00
TheFox0x7
69c5921d71 Add ability to download subpath archive (#36371)
closes: https://github.com/go-gitea/gitea/issues/4478

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-16 09:31:12 +00:00
Zeno
3f46de8265 Add chunked transfer encoding support for LFS uploads (#36380)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Enable chunked transfer encoding for Git LFS uploads by adding
Transfer-Encoding: chunked header to upload action responses. This
prevents large file uploads (100+ MB) from being blocked by reverse
proxies like Cloudflare that buffer non-chunked requests.

Fix https://github.com/go-gitea/gitea/issues/22233

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-16 07:15:18 +08:00
Lunny Xiao
c8b5a1ddf7 Fix cancel auto merge bug (#36341) 2026-01-12 13:47:06 -08:00
Lunny Xiao
fbea2c68e8 Fix delete attachment check (#36320) 2026-01-12 08:16:59 +00:00
wxiaoguang
eec8ee056c Fix some trivial problems (#36336)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
1. correctly parse git protocol's "OldCommit NewCommit RefName" line, it
should be explicitly split by space
2. add missing "return" in CreatePullRequest
3. add comments for "/user.keys" and "/user.gpg" outputs
4. trim space for the "commit status context name" to follow the same
behavior of git_model.NewCommitStatus
2026-01-09 20:58:21 +02:00
Daniel Mach
1d01286f4c Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
WebUI has a checkbox for enabling maintainer edits you can check right
away when creating a new pull request.
Also, it is possible to set `allow_maintainer_edit` in an existing pull
request via API.
This change enables the option while creating a new pull request via
API.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-06 01:00:26 +08:00
wxiaoguang
b79dbfa990 Fix link/origin referrer and login redirect (#36279)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Fix #35998

1. Fix `<a rel>` :
    * "_blank" already means "noopener"
* "noreferrer" is already provided by page's `<meta name="referrer">`
2. Fix "redirect_to" mechisam
* Use "referer" header to determine the redirect link for a successful
login
3. Simplify code and merge duplicate logic
2026-01-03 11:43:04 +08:00
wxiaoguang
094104bc91 Make "commit statuses" API accept slashes in "ref" (#36264)
Fix #36253

Support slashes in `{ref}` (follow GitHub's behavior)
2026-01-01 09:56:07 +08:00
silverwind
42d294941c Replace CSRF cookie with CrossOriginProtection (#36183)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
Removes the CSRF cookie in favor of
[`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection)
which relies purely on HTTP headers.

Fixes: https://github.com/go-gitea/gitea/issues/11188
Fixes: https://github.com/go-gitea/gitea/issues/30333
Helps: https://github.com/go-gitea/gitea/issues/35107

TODOs:

- [x] Fix tests
- [ ] Ideally add tests to validates the protection

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-12-25 12:33:34 +02:00
Gregorius Bima Kharisma Wicaksana
b6ffe0e4e9 refactor: extract helper functions from SearchIssues (#36158)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
## Summary

This PR refactors the `SearchIssues` function in
`routers/api/v1/repo/issue.go` by extracting common logic into reusable
helper functions:

- `parseIssueIsClosed()`: Parses the "state" query parameter and returns
the corresponding `isClosed` option
- `parseIssueIsPull()`: Parses the "type" query parameter and returns
the corresponding `isPull` option
- `buildSearchIssuesRepoIDs()`: Builds the list of repository IDs for
issue search based on query parameters

### Benefits:
- Improved code readability
- Smaller, more focused functions
- Easier to test individual components
- Potential for reuse in other handlers

### Changes:
- Extracted 3 helper functions from the ~292 line `SearchIssues`
function
- No functional changes - behavior remains the same
- Proper error handling preserved

## Test plan
- [ ] Verify existing API tests pass
- [ ] Manual testing of `/repos/issues/search` endpoint

Ref: #35015

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-12-20 17:57:41 -08:00
Lunny Xiao
efd5dd4f0b Fix bug when creating pull request (#36166)
Extract from #36105 

Fix #36116
Fix #35912
Fix #20906
2025-12-17 21:21:04 +00:00
Lunny Xiao
ebf9b4dc6b Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
The test `TestGiteaUploadUpdateGitForPullRequest` modified the shared
meta test repositories directly, so this PR removes that test and
replaces it with an integration test that migrates a real repository
from gitea.com into a local test instance.

This PR also fixes a bug where pull-request migrations were not
correctly syncing head branches to the database.
2025-12-17 12:00:07 -08:00
silverwind
84b74d7c3e Enable bodyclose linter (#36168)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Enabe
[`bodyclose`](https://golangci-lint.run/docs/linters/configuration/#bodyclose).
The only issue in non-test code (`services/migrations/dump.go`) was a
false-positive and I think there are a number of undetected cases, but I
guess it's still better than not having it.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2025-12-16 14:08:43 +01:00
Lunny Xiao
1f5237e0d7 Check user visibility when redirecting to a renamed user (#36148)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
Fix #34169
2025-12-14 03:14:18 +01:00
Lunny Xiao
29057ea55f Fix bug when viewing the commit diff page with non-ANSI files (#36149)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Fix #35504

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-12-13 21:54:03 +08:00
wxiaoguang
f25409fab8 Make Golang correctly delete temp files during uploading (#36128)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Fix #36127
2025-12-11 19:59:42 +01:00
Lunny Xiao
a440116a16 Support updating branch via API (#35951)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Resolve #35368
2025-12-10 19:23:26 +00:00
a1012112796
98ef79d73a allow action user have read permission in public repo like other user (#36095)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
related #28187

---------

Signed-off-by: a1012112796 <1012112796@qq.com>
2025-12-07 10:07:04 -08:00
Lunny Xiao
cb5082f8fe Fix the bug when ssh clone with redirect user or repository (#36039)
Fix #36026 

The redirect should be checked when original user/repo doesn't exist.
2025-12-04 19:17:49 +00:00
Lunny Xiao
e30a130b9a Fix edit user email bug in API (#36068)
Follow #36058 for API edit user bug when editing email.

- The Admin Edit User API includes a breaking change. Previously, when
updating a user with an email from an unallowed domain, the request
would succeed but return a warning in the response headers. Now, the
request will fail and return an error in the response body instead.
- Removed `AdminAddOrSetPrimaryEmailAddress` because it will not be used
any where.

Fix https://github.com/go-gitea/gitea/pull/36058#issuecomment-3600005186

---------

Co-authored-by: Giteabot <teabot@gitea.io>
2025-12-04 09:05:13 +01:00
Bryan Mutai
7d6861ac54 Add "Go to file", "Delete Directory" to repo file list page (#35911)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
/claim #35898
Resolves #35898 

### Summary of key changes:

1. Add file name search/Go to file functionality to repo button row.
2. Add backend functionality to delete directory
3. Add context menu for directories with functionality to copy path & delete a directory
4. Move Add/Upload file dropdown to right for parity with Github UI
5. Add tree view to the edit/upload UI

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-11-30 11:58:15 +08:00
Zettat123
f4e38e6367 Fix Actions pull_request.paths being triggered incorrectly by rebase (#36045)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
Partially fix #34710 

The bug described in #34710 can be divided into two parts: `push.paths`
and `pull_request.paths`. This PR fixes the issue related to
`pull_request.paths`. The root cause is that the check for whether the
workflow can be triggered happens **before** updating the PR’s merge
base. This causes the file-change detection to use the old merge base.
Therefore, we need to update the merge base first and then check whether
the workflow can be triggered.
2025-11-28 19:33:52 +00:00
silverwind
66707bc3ea Fix actions lint (#36029)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
actionlint since https://github.com/rhysd/actionlint/releases/tag/v1.7.9
detects constant conditions and this workflow was being disabled in
58d2a87c6c
by such a condition which made the lint fail:


https://github.com/go-gitea/gitea/actions/runs/19673752806/job/56349128912?pr=36028

Instead, remove the whole workflow file. I'm sure we can re-create it if
the need arises.

Also, I locked the actionlint dependency to prevent similar surprises in
the future.
2025-11-26 10:13:37 -08:00
Zettat123
ed977d9702 Use GitHub-style commit message for squash merge (#35987)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
2025-11-22 09:20:45 -08:00
Lunny Xiao
62d750eadb Fix various permission & login related bugs (#36002)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
Permission & protection check:

- Fix Delete Release permission check
- Fix Update Pull Request with rebase branch protection check
- Fix Issue Dependency permission check
- Fix Delete Comment History ID check

Information leaking:

- Show unified message for non-existing user and invalid password
    - Fix #35984
- Don't expose release draft to non-writer users.
- Make API returns signature's email address instead of the user
profile's.

Auth & Login:

- Avoid GCM OAuth2 attempt when OAuth2 is disabled
    - Fix #35510

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-11-22 07:16:08 +00:00
Lunny Xiao
a60a8c6966 Allow empty commit when merging pull request with squash style (#35989)
Before this PR, when merging an empty PR with squash style will result
in 500.

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-11-22 06:02:25 +00:00
wxiaoguang
358de23a50 Fix container push tag overwriting (#35936)
Fix #35853
2025-11-14 03:49:57 +00:00
wxiaoguang
1f3558b65c Fix corrupted external render content (#35946)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
Fix #35944
2025-11-14 08:31:11 +08:00
wxiaoguang
e31f224ad2 Make OAuth2 issuer configurable (#35915)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
The new (correct) behavior breaks the old (incorrect) logins.

Add a config option to support legacy "issuer".

Fix #35830
2025-11-10 23:45:01 +08:00
Luohao Wang
bfaddbcd0d Fix conda null depend issue (#35900)
Fix #35895
2025-11-08 23:29:17 +08:00
Lunny Xiao
d9c0f86de8 Fix incorrect pull request counter (#35819)
Fix #35781, #27472

The PR will not correct the wrong numbers automatically. 

There is a cron task `check_repo_stats` which will be run when Gitea
start or midnight. It will correct the numbers.
2025-11-03 20:52:13 +00:00
silverwind
37208fef7e Fix a number of strictNullChecks-related issues (#35795)
In preparation to work on enabling
https://www.typescriptlang.org/tsconfig/#strictNullChecks, I fixed all
the issues outside of `web_src` that came up when the option was
enabled. There was also one lint issue in web_src that apparently only
came up with the option enabled, so I fixed that as well.

`isTruthy` is introduced because Typescript has a bug regarding
`filter(Boolean)` which they are seemingly unwilling to fix.

---------

Signed-off-by: silverwind <me@silverwind.io>
2025-11-03 20:17:06 +00:00
Lunny Xiao
b3e5b96111 Fix clone mixed bug (#35810)
Fix #35807
2025-11-02 00:52:59 -07:00
Lunny Xiao
b148bef471 Remove unnecessary function parameter (#35765)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
2025-10-31 21:56:08 -07:00
wxiaoguang
de70cd3853 Fix cli "Before" handling (#35797)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Regression of #34973

Fix #35796
2025-10-31 18:12:03 +00:00
Zettat123
3ab8ae5807 Fix actions rerun bug (#35783)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
Related issues: #35780, #35782 

Rerunning a job or a run is only allowed when the job is done and the
run is done.

Related PR: #34970
2025-10-30 01:08:59 +00:00
Zettat123
8aa1179ce4 Fix actions schedule update issue (#35767)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Fix #34472

Add integration tests for actions schedule update.
2025-10-29 16:04:40 +00:00
Lunny Xiao
95b18eb781 Remove unnecessary code and fix comments (#35761)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
Follow #35459, #32562

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-28 18:03:57 +00:00
Zettat123
c9beb0b01f Support actions and reusable workflows from private repos (#32562)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Resolve https://gitea.com/gitea/act_runner/issues/102

This PR allows administrators of a private repository to specify some
collaborative owners. The repositories of collaborative owners will be
allowed to access this repository's actions and workflows.

Settings for private repos:


![image](https://github.com/user-attachments/assets/e591c877-f94d-48fb-82f3-3b051f21557e)

---

This PR also moves "Enable Actions" setting to `Actions > General` page

<img width="960" alt="image"
src="https://github.com/user-attachments/assets/49337ec2-afb1-4a67-8516-5c9ef0ce05d4"
/>

<img width="960" alt="image"
src="https://github.com/user-attachments/assets/f58ee6d5-17f9-4180-8760-a78e859f1c37"
/>

---------

Signed-off-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: ChristopherHX <christopher.homberger@web.de>
2025-10-25 17:37:33 +00:00
Lunny Xiao
5454fdacd4 Use git model to detect whether branch exist instead of gitrepo method (#35459) 2025-10-25 10:08:25 -07:00
wxiaoguang
9a73a1fb83 Make "update file" API can create a new file when SHA is not set (#35738)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
Fix #19008, use GitHub's behavior (empty SHA to create a new file)
2025-10-24 12:46:54 +08:00
Lunny Xiao
397d666432 Fix review request webhook bug (#35339) (#35723)
Frontport #35339
Fix #35327
2025-10-23 20:08:21 -07:00
silverwind
e03a68c48b Misc tool tweaks (#35734)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
Some minor tooling tweaks:

- Ignore .venv in golangci-lint
- Move go tools to tools directory (e.g. everything that is not "build")
- Enable reportUnusedInlineConfigs in eslint, no current violations
- Apply modernize fix in code-batch-process, modernize cli did
apparently not catch it because of the `go:build ignore` tag.
2025-10-23 09:07:39 +00:00
wxiaoguang
522c466e24 Make external iframe render work (#35730)
Fix #35729, #17635, #21098
2025-10-23 08:01:38 +00:00
wxiaoguang
195fc715ff Fix external render (#35727)
Fix #35725

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-22 23:41:38 +00:00
ChristopherHX
08b9776970 Refactor Actions Token Access (#35688)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
* use a single function to do Action Tokens Permission checks
* allows easier customization
* add basic tests
* lfs file locks should work now

---------

Signed-off-by: ChristopherHX <christopher.homberger@web.de>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-22 11:12:31 +00:00
Kemal Zebari
a9f2ea720b Honor delete branch on merge repo setting when using merge API (#35488)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
Fix #35463.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-22 05:06:56 +00:00
a1012112796
a4e23b81d3 fix attachment file size limit in server backend (#35519)
Some checks failed
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-docker-rootful (push) Has been cancelled
release-nightly / nightly-docker-rootless (push) Has been cancelled
cron-translations / crowdin-pull (push) Has been cancelled
fix #35512

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2025-10-21 15:07:11 +00:00